diff --git a/.github/ISSUE_TEMPLATE/feature-request.md b/.github/ISSUE_TEMPLATE/feature-request.md
index 45439ae92c..7955082fc7 100644
--- a/.github/ISSUE_TEMPLATE/feature-request.md
+++ b/.github/ISSUE_TEMPLATE/feature-request.md
@@ -11,6 +11,8 @@ assignees: ''
 Thanks for filing an issue!  Please use the prompts below to provide as much context as you can about your use case and motivations.
 -->
 
+Gong snippet: TODO <!-- Insert the link to the relevant, private Gong snippet ("Share internally" button). Remove this item if you don't have access to Fleet's Gong or there is no Gong recording available -->
+
 ## Problem
 
 <!-- Describe the problem you're trying to solve. What are you trying to accomplish? 
diff --git a/.github/ISSUE_TEMPLATE/release-qa.md b/.github/ISSUE_TEMPLATE/release-qa.md
index 19bf5104ee..5d77f255fc 100644
--- a/.github/ISSUE_TEMPLATE/release-qa.md
+++ b/.github/ISSUE_TEMPLATE/release-qa.md
@@ -118,6 +118,15 @@ Smoke tests are limited to core functionality and serve as a pre-release final r
 7. Verify scripts display correctly in Activity feed.
 </td><td>pass/fail</td></tr>
 
+<tr><td>Software</td><td>Verify software library and install / download</td><td>
+
+1. Verify software library upload/download/delete.
+2. From Host details (Windows and macOS) run an install that should PASS, verify.
+3. From My Device (Windows and macOS) software tab should have self-service items available, verify.
+4. Verify UI loading state and statuses for installing software.
+6. Verify software installs display correctly in Activity feed.
+</td><td>pass/fail</td></tr>
+
 <tr><td>OS settings</td><td>Verify OS settings functionality</td><td>
 
 1. Verify able to configure Disk encryption.
diff --git a/.github/ISSUE_TEMPLATE/story.md b/.github/ISSUE_TEMPLATE/story.md
index 509740bc63..bc76e169c1 100644
--- a/.github/ISSUE_TEMPLATE/story.md
+++ b/.github/ISSUE_TEMPLATE/story.md
@@ -32,13 +32,16 @@ What else should contributors [keep in mind](https://fleetdm.com/handbook/compan
 ## Changes
 
 ### Product
-- [ ] Reference documentation changes: TODO <!-- Specify references documentation changes at fleetdm.com/docs -->
-- [ ] UI changes: TODO <!-- Insert the link to the relevant Figma cover page. Remove this checkbox if there are no changes to the user interface. -->
-- [ ] CLI usage changes: TODO <!-- Insert the link to the relevant Figma cover page. Remove this checkbox if there are no changes to the CLI. -->
-- [ ] REST API changes: TODO <!-- Specify changes as a draft PR to the REST API doc page and request the API DRI for review (codeowner reviews are not automatically requested for drafts). Remove this checkbox if there are no changes necessary. Move this item to the engineering list below if engineering will design the API changes. -->
-- [ ] Fleet's agent (fleetd) changes: TODO <!-- Specify changes to fleetd. If the change requires a new Fleet (server) version, consider specifying to only enable this change in new Fleet versions. Remove this checkbox if there are no changes necessary. -->
-- [ ] Permissions changes: TODO <!-- Specify changes as a draft PR to the Manage access doc page. If doc changes aren't necessary, explicitly mention no changes to the doc page. Remove this checkbox if there are no permissions changes. -->
-- [ ] Changes to paid features or tiers: TODO  <!-- Specify "Fleet Free" or "Fleet Premium".  If only certain parts of the user story involve paid features, specify which parts.  Implementation of paid features should live in the `ee/` directory. -->
+- [ ] UI changes: TODO <!-- Insert the link to the relevant Figma cover page. Put "No changes" if there are no changes to the user interface. -->
+- [ ] CLI (fleetctl) usage changes: TODO <!-- Insert the link to the relevant Figma cover page. Put "No changes" if there are no changes to the CLI. -->
+- [ ] YAML changes: TODO <!-- Specify changes in the YAML files doc page as a PR to the reference docs release branch. Put "No changes" if there are no changes necessary. -->
+- [ ] REST API changes: TODO <!-- Specify changes in the the REST API doc page as a PR to reference docs release branch. Put "No changes" if there are no changes necessary. Move this item to the engineering list below if engineering will design the API changes. -->
+- [ ] Fleet's agent (fleetd) changes: TODO <!-- Specify changes to fleetd. If the change requires a new Fleet (server) version, consider specifying to only enable this change in new Fleet versions. Put "No changes" if there are no changes necessary. -->
+- [ ] Activity changes: TODO <!-- Specify changes to Fleet's activity feed as a draft PR to the Audit log page in the contributor docs: https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Audit-logs.md This PR will be closed before release because the Audit log page is automatically generated: https://fleetdm.com/handbook/company/communications#audit-logs Put "No changes" if there are no changes necessary. -->
+- [ ] Permissions changes: TODO <!-- Specify changes in the Manage access doc page as a PR to the reference docs release branch. If doc changes aren't necessary, explicitly mention no changes to the doc page. Put "No changes" if there are no permissions changes. -->
+- [ ] Changes to paid features or tiers: TODO  <!-- Specify changes in pricing-features-table.yml as a PR to reference docs release branch. Remove this checkbox and specify "Fleet Free" or "Fleet Premium" if there are no changes to the pricing page necessary. -->
+- [ ] Other reference documentation changes: TODO <!-- Any other reference doc changes? Specify changes as a PR to reference docs release branch. Put "No changes" if there are no changes necessary. -->
+- [ ] Once shipped, requester has been notified
 
 ### Engineering
 - [ ] Feature guide changes: TODO <!-- Specify if a new feature guide is required at fleetdm.com/guides, or if a previous guide should be updated to reflect feature changes. -->
diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
index af1f4818cf..cf6e9c46e2 100644
--- a/.github/pull_request_template.md
+++ b/.github/pull_request_template.md
@@ -9,6 +9,7 @@ If some of the following don't apply, delete the relevant line.
 - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements)
 - [ ] Added support on fleet's osquery simulator `cmd/osquery-perf` for new osquery data ingestion features.
 - [ ] Added/updated tests
+- [ ] If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes
 - [ ] If database migrations are included, checked table schema to confirm autoupdate
 - For database migrations:
   - [ ] Checked schema for all modified table for columns that will auto-update timestamps during migration.
diff --git a/.github/workflows/build-and-push-fleetctl-docker.yml b/.github/workflows/build-and-check-fleetctl-docker-and-deps.yml
similarity index 51%
rename from .github/workflows/build-and-push-fleetctl-docker.yml
rename to .github/workflows/build-and-check-fleetctl-docker-and-deps.yml
index 8ae3c7069e..ff20260409 100644
--- a/.github/workflows/build-and-push-fleetctl-docker.yml
+++ b/.github/workflows/build-and-check-fleetctl-docker-and-deps.yml
@@ -1,13 +1,14 @@
-name: Build and push fleetdm/fleetctl Docker image
+name: Build fleetctl docker dependencies and check vulnerabilities
 
-# Manually trigger this workflow for now
 on:
   workflow_dispatch:
     inputs:
       image_tag:
-        description: 'Docker image tag'
+        description: "Docker image tag"
         required: true
         type: string
+  schedule:
+    - cron: "0 6 * * *"
 
 # This allows a subsequently queued workflow run to interrupt previous runs
 concurrency:
@@ -23,7 +24,7 @@ permissions:
   contents: read
 
 jobs:
-  docker-push:
+  build-and-check:
     runs-on: ubuntu-latest
     environment: Docker Hub
     permissions:
@@ -46,25 +47,46 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
-          go-version: ${{ vars.GO_VERSION }}
+          go-version-file: 'go.mod'
 
       - name: Install Go Dependencies
         run: make deps-go
 
+      - name: Build fleetdm/wix
+        run: make wix-docker
+
+      - name: Build fleetdm/bomutils
+        run: make bomutils-docker
+
       - name: Build fleetdm/fleetctl
         run: make fleetctl-docker
 
-      - name: Push to Docker
-        run: |
-          docker tag fleetdm/fleetctl fleetdm/fleetctl:${{ inputs.image_tag }}
-          docker push fleetdm/fleetctl:${{ inputs.image_tag }}
-
-      - name: Push To quay.io
-        id: push-to-quay
-        uses: redhat-actions/push-to-registry@9986a6552bc4571882a4a67e016b17361412b4df # v2.7.1
+      - name: Run Trivy vulnerability scanner on fleetdm/wix
+        uses: aquasecurity/trivy-action@6e7b7d1fd3e4fef0c5fa8cce1229c54b2c9bd0d8
         with:
-          image: fleetdm/fleetctl
-          tags: ${{ inputs.image_tag }}
-          registry: quay.io/
-          username: fleetdm+fleetreleaser
-          password: ${{ secrets.QUAY_REGISTRY_PASSWORD }}
+          image-ref: "fleetdm/wix"
+          format: "table"
+          exit-code: "1"
+          ignore-unfixed: true
+          vuln-type: "os,library"
+          severity: "CRITICAL"
+
+      - name: Run Trivy vulnerability scanner on fleetdm/bomutils
+        uses: aquasecurity/trivy-action@6e7b7d1fd3e4fef0c5fa8cce1229c54b2c9bd0d8
+        with:
+          image-ref: "fleetdm/bomutils"
+          format: "table"
+          exit-code: "1"
+          ignore-unfixed: true
+          vuln-type: "os,library"
+          severity: "CRITICAL"
+
+      - name: Run Trivy vulnerability scanner on fleetdm/fleetctl
+        uses: aquasecurity/trivy-action@6e7b7d1fd3e4fef0c5fa8cce1229c54b2c9bd0d8
+        with:
+          image-ref: "fleetdm/fleetctl"
+          format: "table"
+          exit-code: "1"
+          ignore-unfixed: true
+          vuln-type: "os,library"
+          severity: "CRITICAL"
diff --git a/.github/workflows/build-binaries.yaml b/.github/workflows/build-binaries.yaml
index ed18437c74..278f958b28 100644
--- a/.github/workflows/build-binaries.yaml
+++ b/.github/workflows/build-binaries.yaml
@@ -29,10 +29,13 @@ jobs:
         with:
           egress-policy: audit
 
+      - name: Checkout Code
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+
       - name: Install Go
         uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
-          go-version: ${{ vars.GO_VERSION }}
+          go-version-file: 'go.mod'
 
       # Set the Node.js version
       - name: Set up Node.js ${{ vars.NODE_VERSION }}
@@ -40,9 +43,6 @@ jobs:
         with:
           node-version: ${{ vars.NODE_VERSION }}
 
-      - name: Checkout Code
-        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
-
       - name: JS Dependency Cache
         id: js-cache
         uses: actions/cache@69d9d449aced6a2ede0bc19182fadc3a0a42d2b0 # v2
diff --git a/.github/workflows/build-orbit.yaml b/.github/workflows/build-orbit.yaml
index 09f296aece..002d2657f6 100644
--- a/.github/workflows/build-orbit.yaml
+++ b/.github/workflows/build-orbit.yaml
@@ -59,7 +59,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
-          go-version: ${{ vars.GO_VERSION }}
+          go-version-file: 'go.mod'
 
       - name: Build, codesign and notarize orbit
         run: go run ./orbit/tools/build/build.go 
diff --git a/.github/workflows/check-automated-doc.yml b/.github/workflows/check-automated-doc.yml
index c654e7ae4f..d289c55318 100644
--- a/.github/workflows/check-automated-doc.yml
+++ b/.github/workflows/check-automated-doc.yml
@@ -36,15 +36,16 @@ jobs:
         with:
           egress-policy: audit
 
-      - name: Install Go
-        uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
-        with:
-          go-version: ${{ vars.GO_VERSION }}
       - name: Checkout Code
         uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2
         with:
           fetch-depth: 0
 
+      - name: Install Go
+        uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
+        with:
+          go-version-file: 'go.mod'
+
       - name: Verify golang generated documentation is up-to-date
         run: |
           make generate-doc
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 246c6418a1..c69888f874 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -56,7 +56,7 @@ jobs:
     - name: Set up Go
       uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
       with:
-        go-version: ${{ vars.GO_VERSION }}
+        go-version-file: 'go.mod'
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
diff --git a/.github/workflows/deploy-bulk-operations-dashboard.yml b/.github/workflows/deploy-bulk-operations-dashboard.yml
new file mode 100644
index 0000000000..090e409fac
--- /dev/null
+++ b/.github/workflows/deploy-bulk-operations-dashboard.yml
@@ -0,0 +1,89 @@
+name: Deploy app to bulk operations dashboard pipeline on Heroku.
+
+on:
+  push:
+    branches: [ main ]
+    paths:
+      - 'ee/bulk-operations-dashboard/**'
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    permissions:
+      contents: write  # for Git to git push
+    if: ${{ github.repository == 'fleetdm/fleet' }}
+
+    runs-on: ubuntu-latest
+
+    strategy:
+      matrix:
+        node-version: [14.x]
+
+    steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
+      with:
+        egress-policy: audit
+
+    - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+
+    # Configure our access credentials for the Heroku CLI
+    - uses: akhileshns/heroku-deploy@79ef2ae4ff9b897010907016b268fd0f88561820 # v3.6.8
+      with:
+        heroku_api_key: ${{secrets.HEROKU_API_TOKEN_FOR_BOT_USER}}
+        heroku_app_name: "" # this has to be blank or it doesn't work
+        heroku_email: ${{secrets.HEROKU_EMAIL_FOR_BOT_USER}}
+        justlogin: true
+    - run: heroku auth:whoami
+
+    # Set the Node.js version
+    - name: Use Node.js ${{ matrix.node-version }}
+      uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
+      with:
+        node-version: ${{ matrix.node-version }}
+
+    # Now start building!
+    # > …but first, get a little crazy for a sec and delete the top-level package.json file
+    # > i.e. the one used by the Fleet server.  This is because require() in node will go
+    # > hunting in ancestral directories for missing dependencies, and since some of the
+    # > bundled transpiler tasks sniff for package availability using require(), this trips
+    # > up when it encounters another Node universe in the parent directory.
+    - run: rm -rf package.json package-lock.json node_modules/
+    # > Turns out there's a similar issue with how eslint plugins are looked up, so we
+    # > delete the top level .eslintrc file too.
+    - run: rm -f .eslintrc.js
+    # > And, as a change to the top-level fleetdm/fleet .gitignore on May 2, 2022 revealed,
+    # > we also need to delete the top level .gitignore file too, so that its rules don't
+    # > interfere with the committing and force-pushing we're doing as part of our deploy
+    # > script here.  For more info, see: https://github.com/fleetdm/fleet/pull/5549
+    - run: rm -f .gitignore
+
+    # Get dependencies (including dev deps)
+    - run: cd ee/bulk-operations-dashboard/ && npm install
+
+    # Run sanity checks
+    - run: cd ee/bulk-operations-dashboard/ && npm test
+
+    # Compile assets
+    - run: cd ee/bulk-operations-dashboard/ && npm run build-for-prod
+
+    # Commit newly-built assets locally so we can push them to Heroku below.
+    # (This commit will never be pushed to GitHub- only to Heroku.)
+    # > The local config flags make this work in GitHub's environment.
+    - run: git add ee/bulk-operations-dashboard/.www
+    - run: git -c "user.name=GitHub" -c "user.email=github@example.com" commit -am 'AUTOMATED COMMIT - Deployed the latest, including modified HTML layouts and .sailsrc file that reference minified assets.'
+
+    # Configure the Heroku app we'll be deploying to
+    - run: heroku git:remote -a bulk-operations-dashboard
+    - run: git remote -v
+
+    # Deploy to Heroku (by pushing)
+    # > Since a shallow clone was grabbed, we have to "unshallow" it before forcepushing.
+    - run: echo "Unshallowing local repository…"
+    - run: git fetch --prune --unshallow
+    - run: echo "Deploying branch '${GITHUB_REF##*/}' to Heroku…"
+    - run: git push heroku +${GITHUB_REF##*/}:master
+    - name: 🌐 The dashboard has been deployed
+      run: echo '' && echo '--' && echo 'OK, done.  It should be live momentarily.' && echo '(if you get impatient, check the Heroku dashboard for status)'
diff --git a/.github/workflows/deploy-fleet-website.yml b/.github/workflows/deploy-fleet-website.yml
index 9fc044e13b..371a0014f0 100644
--- a/.github/workflows/deploy-fleet-website.yml
+++ b/.github/workflows/deploy-fleet-website.yml
@@ -64,7 +64,7 @@ jobs:
     - name: Set up Go
       uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
       with:
-        go-version: ${{ vars.GO_VERSION }}
+        go-version-file: 'go.mod'
 
     # Download top-level dependencies and build Storybook in the website's assets/ folder
     - run: npm install --legacy-peer-deps && npm run build-storybook -- -o ./website/assets/storybook --loglevel verbose
diff --git a/.github/workflows/dogfood-deploy.yml b/.github/workflows/dogfood-deploy.yml
index 39f6983824..f17768eec7 100644
--- a/.github/workflows/dogfood-deploy.yml
+++ b/.github/workflows/dogfood-deploy.yml
@@ -51,14 +51,17 @@ jobs:
       - id: fail-on-main
         run: "false"
         if: ${{ github.ref == 'main' }}
+
       - uses: aws-actions/configure-aws-credentials@67fbcbb121271f7775d2e7715933280b06314838 # v1.7.0
         with:
           role-to-assume: ${{env.AWS_IAM_ROLE}}
           aws-region: ${{ env.AWS_REGION }}
+
       - name: Set up Go
         uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
-          go-version: ${{ vars.GO_VERSION }}
+          go-version-file: 'go.mod'
+
       - uses: hashicorp/setup-terraform@633666f66e0061ca3b725c73b2ec20cd13a8fdd1 # v2.0.3
         with:
           terraform_version: 1.6.3
@@ -77,6 +80,26 @@ jobs:
         id: plan
         run: terraform plan -no-color
         continue-on-error: true
+      - name: Slack Notification
+        if: success()
+        uses: slackapi/slack-github-action@e28cf165c92ffef168d23c5c9000cffc8a25e117 # v1.24.0
+        with:
+          payload: |
+            {
+              "text": "${{ job.status }}\n${{ github.event.pull_request.html_url || github.event.head.html_url }}",
+              "blocks": [
+                {
+                  "type": "section",
+                  "text": {
+                    "type": "mrkdwn",
+                    "text": "🚀 🛠️ Dogfood deploy in progress\nhttps://github.com/fleetdm/fleet/actions/runs/${{  github.run_id }}"
+                  }
+                }
+              ]
+            }
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_G_HELP_ENGINEERING_WEBHOOK_URL }}
+          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK
         # first we'll scale everything down and create the new task definitions
       - name: Terraform Apply
         id: apply
diff --git a/.github/workflows/dogfood-gitops.yml b/.github/workflows/dogfood-gitops.yml
index 8b2e3217c0..487cdac1ad 100644
--- a/.github/workflows/dogfood-gitops.yml
+++ b/.github/workflows/dogfood-gitops.yml
@@ -69,6 +69,7 @@ jobs:
           DOGFOOD_GLOBAL_ENROLL_SECRET: ${{ secrets.DOGFOOD_GLOBAL_ENROLL_SECRET }}
           DOGFOOD_SSO_ISSUER_URI: ${{ secrets.DOGFOOD_SSO_ISSUER_URI }}
           DOGFOOD_SSO_METADATA: ${{ secrets.DOGFOOD_SSO_METADATA }}
+          DOGFOOD_MDM_SSO_METADATA_URL: ${{ secrets.DOGFOOD_MDM_SSO_METADATA_URL }}
           DOGFOOD_FAILING_POLICIES_WEBHOOK_URL: ${{ secrets.DOGFOOD_FAILING_POLICIES_WEBHOOK_URL }}
           DOGFOOD_VULNERABILITIES_WEBHOOK_URL: ${{ secrets.DOGFOOD_VULNERABILITIES_WEBHOOK_URL }}
           DOGFOOD_WORKSTATIONS_ENROLL_SECRET: ${{ secrets.DOGFOOD_WORKSTATIONS_ENROLL_SECRET }}
diff --git a/.github/workflows/fleet-and-orbit.yml b/.github/workflows/fleet-and-orbit.yml
index 4cab7da482..f4dfb2780e 100644
--- a/.github/workflows/fleet-and-orbit.yml
+++ b/.github/workflows/fleet-and-orbit.yml
@@ -62,7 +62,6 @@ jobs:
     timeout-minutes: 60
     strategy:
       matrix:
-        go-version: ["${{ vars.GO_VERSION }}"]
         mysql: ["mysql:8.0.36"]
     runs-on: ubuntu-latest
     needs: gen
@@ -72,10 +71,13 @@ jobs:
         with:
           egress-policy: audit
 
+      - name: Checkout Code
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+
       - name: Install Go
         uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
-          go-version: ${{ matrix.go-version }}
+          go-version-file: 'go.mod'
 
       # Set the Node.js version
       - name: Set up Node.js ${{ vars.NODE_VERSION }}
@@ -83,9 +85,6 @@ jobs:
         with:
           node-version: ${{ vars.NODE_VERSION }}
 
-      - name: Checkout Code
-        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
-
       - name: Start tunnel
         env:
           CERT_PEM: ${{ secrets.CLOUDFLARE_TUNNEL_FLEETUEM_CERT_B64 }}
@@ -111,7 +110,7 @@ jobs:
           done
 
       - name: Start Infra Dependencies
-        run: FLEET_MYSQL_IMAGE=${{ matrix.mysql }} docker-compose up -d mysql redis &
+        run: FLEET_MYSQL_IMAGE=${{ matrix.mysql }} docker compose up -d mysql redis &
 
       - name: Install JS Dependencies
         run: make deps-js
@@ -175,9 +174,6 @@ jobs:
   # This job also makes sure the Fleet server is up and running.
   set-enroll-secret:
     timeout-minutes: 60
-    strategy:
-      matrix:
-        go-version: ["${{ vars.GO_VERSION }}"]
     runs-on: ubuntu-latest
     needs: gen
     steps:
@@ -186,13 +182,13 @@ jobs:
         with:
           egress-policy: audit
 
+      - name: Checkout Code
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+
       - name: Install Go
         uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
-          go-version: ${{ matrix.go-version }}
-
-      - name: Checkout Code
-        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+          go-version-file: 'go.mod'
 
       - name: Build Fleetctl
         run: make fleetctl
@@ -218,9 +214,6 @@ jobs:
   # Here we generate the Fleet Desktop and osqueryd targets for
   # macOS which can only be generated from a macOS host.
   build-macos-targets:
-    strategy:
-      matrix:
-        go-version: ["${{ vars.GO_VERSION }}"]
     # Set macOS version to '12' (current equivalent to macos-latest) for
     # building the binary. This ensures compatibility with macOS version 13 and
     # later, avoiding runtime errors on systems using macOS 13 or newer.
@@ -234,13 +227,13 @@ jobs:
         with:
           egress-policy: audit
 
+      - name: Checkout Code
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+
       - name: Install Go
         uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
-          go-version: ${{ matrix.go-version }}
-
-      - name: Checkout Code
-        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+          go-version-file: 'go.mod'
 
       - name: Build desktop.app.tar.gz and osqueryd.app.tar.gz
         run: |
@@ -269,9 +262,6 @@ jobs:
   # installed, and installing it is time consuming and unreliable.
   run-tuf-and-gen-pkgs:
     timeout-minutes: 60
-    strategy:
-      matrix:
-        go-version: ["${{ vars.GO_VERSION }}"]
     runs-on: ubuntu-latest
     needs: [gen, build-macos-targets]
     steps:
@@ -280,13 +270,13 @@ jobs:
         with:
           egress-policy: audit
 
+      - name: Checkout Code
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+
       - name: Install Go
         uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
-          go-version: ${{ matrix.go-version }}
-
-      - name: Checkout Code
-        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+          go-version-file: 'go.mod'
 
       - name: Download macos pre-built apps
         id: download
diff --git a/.github/workflows/fleetctl-preview-latest.yml b/.github/workflows/fleetctl-preview-latest.yml
index dda4e0f73c..630cfd1dc3 100644
--- a/.github/workflows/fleetctl-preview-latest.yml
+++ b/.github/workflows/fleetctl-preview-latest.yml
@@ -53,7 +53,6 @@ jobs:
         #   - Unattended installation of Docker on macOS fails. (see
         #   https://github.com/docker/for-mac/issues/6450)
         os: [ubuntu-latest]
-        go-version: ['${{ vars.GO_VERSION }}']
     runs-on: ${{ matrix.os }}
     steps:
 
@@ -62,13 +61,13 @@ jobs:
       with:
         egress-policy: audit
 
+    - name: Checkout Code
+      uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+
     - name: Install Go
       uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
       with:
-        go-version: ${{ matrix.go-version }}
-
-    - name: Checkout Code
-      uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        go-version-file: 'go.mod'
 
     - name: Build Fleetctl
       run: make fleetctl
diff --git a/.github/workflows/fleetd-tuf.yml b/.github/workflows/fleetd-tuf.yml
index ebeca889da..7641589f10 100644
--- a/.github/workflows/fleetd-tuf.yml
+++ b/.github/workflows/fleetd-tuf.yml
@@ -30,16 +30,16 @@ jobs:
       with:
         egress-policy: audit
 
-    - name: Install Go
-      uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
-      with:
-        go-version: ${{ vars.GO_VERSION }}
-
     - name: Checkout Code
       uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2
       with:
         fetch-depth: 0
 
+    - name: Install Go
+      uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
+      with:
+        go-version-file: 'go.mod'
+
     - name: Update orbit/TUF.md
       run: |
         make fleetd-tuf
diff --git a/.github/workflows/generate-desktop-targets.yml b/.github/workflows/generate-desktop-targets.yml
index d8269e9948..93e5a30fce 100644
--- a/.github/workflows/generate-desktop-targets.yml
+++ b/.github/workflows/generate-desktop-targets.yml
@@ -13,18 +13,13 @@ on:
       - '.github/workflows/generate-desktop-targets.yml'
   workflow_dispatch:
 
-# This allows a subsequently queued workflow run to interrupt previous runs
-concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id}}
-  cancel-in-progress: true
-
 defaults:
   run:
     # fail-fast using bash -eo pipefail. See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference
     shell: bash
 
 env:
-  FLEET_DESKTOP_VERSION: 1.29.0
+  FLEET_DESKTOP_VERSION: 1.33.0
 
 permissions:
   contents: read
@@ -45,13 +40,13 @@ jobs:
         with:
           egress-policy: audit
 
+      - name: Checkout
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+
       - name: Install Go
         uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
-          go-version: ${{ vars.GO_VERSION }}
-
-      - name: Checkout
-        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+          go-version-file: 'go.mod'
 
       - name: Import signing keys
         env:
@@ -98,13 +93,13 @@ jobs:
         with:
           egress-policy: audit
 
+      - name: Checkout
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+
       - name: Install Go
         uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
-          go-version: ${{ vars.GO_VERSION }}
-
-      - name: Checkout
-        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+          go-version-file: 'go.mod'
 
       - name: Generate fleet-desktop.exe
         run: |
@@ -139,13 +134,13 @@ jobs:
         with:
           egress-policy: audit
 
+      - name: Checkout
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+
       - name: Install Go
         uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
-          go-version: ${{ vars.GO_VERSION }}
-
-      - name: Checkout
-        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+          go-version-file: 'go.mod'
 
       - name: Generate desktop.tar.gz
         run: |
@@ -167,13 +162,13 @@ jobs:
         with:
           egress-policy: audit
 
+      - name: Checkout
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+
       - name: Install Go
         uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
-          go-version: ${{ vars.GO_VERSION }}
-
-      - name: Checkout
-        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+          go-version-file: 'go.mod'
 
       - name: Generate desktop.tar.gz
         run: |
diff --git a/.github/workflows/generate-osqueryd-targets.yml b/.github/workflows/generate-osqueryd-targets.yml
index 12e08bddac..b27e074b6a 100644
--- a/.github/workflows/generate-osqueryd-targets.yml
+++ b/.github/workflows/generate-osqueryd-targets.yml
@@ -24,7 +24,7 @@ defaults:
     shell: bash
 
 env:
-  OSQUERY_VERSION: 5.12.2
+  OSQUERY_VERSION: 5.13.1
 
 permissions:
   contents: read
diff --git a/.github/workflows/golangci-lint.yml b/.github/workflows/golangci-lint.yml
index df6b9792b7..3d3e95ed2c 100644
--- a/.github/workflows/golangci-lint.yml
+++ b/.github/workflows/golangci-lint.yml
@@ -38,7 +38,6 @@ jobs:
       matrix:
         # See #9943, we just need to add windows-latest here once all issues are fixed.
         os: [ubuntu-latest, macos-latest]
-        go-version: ['${{ vars.GO_VERSION }}']
     runs-on: ${{ matrix.os }}
     steps:
       - name: Harden Runner
@@ -52,7 +51,7 @@ jobs:
       - name: Install Go
         uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
-          go-version: ${{ matrix.go-version }}
+          go-version-file: 'go.mod'
 
       - name: Install dependencies (Linux)
         if: matrix.os == 'ubuntu-latest'
diff --git a/.github/workflows/goreleaser-fleet.yaml b/.github/workflows/goreleaser-fleet.yaml
index 8de0089b62..6ba9aff8f0 100644
--- a/.github/workflows/goreleaser-fleet.yaml
+++ b/.github/workflows/goreleaser-fleet.yaml
@@ -20,7 +20,7 @@ permissions:
 
 jobs:
   goreleaser:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-20.04-4-cores
     environment: Docker Hub
     permissions:
       contents: write
@@ -44,7 +44,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
-          go-version: ${{ vars.GO_VERSION }}
+          go-version-file: 'go.mod'
 
       # Set the Node.js version
       - name: Set up Node.js ${{ vars.NODE_VERSION }}
diff --git a/.github/workflows/goreleaser-orbit.yaml b/.github/workflows/goreleaser-orbit.yaml
index 666f281120..e196901ead 100644
--- a/.github/workflows/goreleaser-orbit.yaml
+++ b/.github/workflows/goreleaser-orbit.yaml
@@ -5,11 +5,6 @@ on:
     tags:
       - "orbit-*" # For testing, use a pre-release tag like 'orbit-1.24.0-1'
 
-# This allows a subsequently queued workflow run to interrupt previous runs
-concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id}}
-  cancel-in-progress: true
-
 defaults:
   run:
     # fail-fast using bash -eo pipefail. See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference
@@ -56,7 +51,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
-          go-version: ${{ vars.GO_VERSION }}
+          go-version-file: 'go.mod'
 
       - name: Run GoReleaser
         run: go run github.com/goreleaser/goreleaser@56c9d09a1b925e2549631c6d180b0a1c2ebfac82 release --debug --rm-dist --skip-publish -f orbit/goreleaser-macos.yml # v1.20.0
@@ -95,7 +90,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
-          go-version: ${{ vars.GO_VERSION }}
+          go-version-file: 'go.mod'
 
       - name: Run GoReleaser
         run: go run github.com/goreleaser/goreleaser@56c9d09a1b925e2549631c6d180b0a1c2ebfac82 release --debug --rm-dist --skip-publish -f orbit/goreleaser-linux.yml # v1.20.0
@@ -128,7 +123,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
-          go-version: ${{ vars.GO_VERSION }}
+          go-version-file: 'go.mod'
 
       - name: Run GoReleaser
         run: go run github.com/goreleaser/goreleaser@56c9d09a1b925e2549631c6d180b0a1c2ebfac82 release --debug --rm-dist --skip-publish -f orbit/goreleaser-linux-arm64.yml # v1.20.0
@@ -161,7 +156,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
-          go-version: ${{ vars.GO_VERSION }}
+          go-version-file: 'go.mod'
 
       - name: Run GoReleaser
         run: go run github.com/goreleaser/goreleaser@56c9d09a1b925e2549631c6d180b0a1c2ebfac82 release --debug --rm-dist --skip-publish -f orbit/goreleaser-windows.yml # v1.20.0
diff --git a/.github/workflows/goreleaser-snapshot-fleet.yaml b/.github/workflows/goreleaser-snapshot-fleet.yaml
index 46c1da4193..927cf31be1 100644
--- a/.github/workflows/goreleaser-snapshot-fleet.yaml
+++ b/.github/workflows/goreleaser-snapshot-fleet.yaml
@@ -57,7 +57,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
-          go-version: ${{ vars.GO_VERSION }}
+          go-version-file: 'go.mod'
 
       # Set the Node.js version
       - name: Set up Node.js ${{ vars.NODE_VERSION }}
diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
index 015a464b4b..98c9cd3a59 100644
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -264,13 +264,13 @@ jobs:
         npm install -g fleetctl
         fleetctl config set --address ${{ needs.gen.outputs.address }} --token ${{ needs.login.outputs.token }}
 
+    - name: Checkout Code
+      uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+
     - name: Install Go
       uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
       with:
-        go-version: ${{ vars.GO_VERSION }}
-
-    - name: Checkout Code
-      uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        go-version-file: 'go.mod'
 
     - name: Build Fleetctl
       run: make fleetctl
diff --git a/.github/workflows/push-osquery-perf-to-ecr.yml b/.github/workflows/push-osquery-perf-to-ecr.yml
deleted file mode 100644
index 0760d03900..0000000000
--- a/.github/workflows/push-osquery-perf-to-ecr.yml
+++ /dev/null
@@ -1,64 +0,0 @@
-name: Build docker image and publish to ECR
-
-on:
-  workflow_dispatch:
-    inputs:
-      enroll_secret:
-        description: 'Enroll Secret'
-        required: true
-      url:
-        description: 'Fleet server URL'
-        required: true
-      host_count:
-        description: 'Amount of hosts to emulate'
-        required: true
-        default: 20
-      tag:
-        description: 'docker image tag'
-        required: true
-        default: latest
-
-# This allows a subsequently queued workflow run to interrupt previous runs
-concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id}}
-  cancel-in-progress: true
-
-defaults:
-  run:
-    # fail-fast using bash -eo pipefail. See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference
-    shell: bash
-
-permissions:
-  contents: read
-
-jobs:
-  build-docker:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
-        with:
-          egress-policy: audit
-
-      - name: Checkout Code
-        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
-
-      - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@05b148adc31e091bafbaf404f745055d4d3bc9d2 # v1
-        with:
-          aws-access-key-id: ${{ secrets.LOADTEST_AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.LOADTEST_AWS_SECRET_ACCESS_KEY }}
-          aws-region: us-east-2
-
-      - name: Login to Amazon ECR
-        id: login-ecr
-        uses: aws-actions/amazon-ecr-login@2f9f10ea3fa2eed41ac443fee8bfbd059af2d0a4 # v1
-
-      - name: Build, tag, and push image to Amazon ECR
-        env:
-          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
-          ECR_REPOSITORY: osquery-perf
-          IMAGE_TAG: ${{ github.event.inputs.tag }}
-        run: |
-          docker build -t $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG --build-arg ENROLL_SECRET=${{ github.event.inputs.enroll_secret }} --build-arg HOST_COUNT=${{ github.event.inputs.host_count }} --build-arg SERVER_URL=${{ github.event.inputs.url }} -f Dockerfile.osquery-perf .
-          docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
diff --git a/.github/workflows/release-fleetctl-docker-deps.yaml b/.github/workflows/release-fleetctl-docker-deps.yaml
new file mode 100644
index 0000000000..c751655d93
--- /dev/null
+++ b/.github/workflows/release-fleetctl-docker-deps.yaml
@@ -0,0 +1,84 @@
+# Builds and releases to production the fleetdm/bomutils:latest and fleetdm/wix:latest
+# docker images, which are the docker image dependencies of the fleetctl command.
+#
+# This is separate from Fleet releases because we only release
+# fleetdm/bomutils and fleetdm/wix only if we add new dependencies
+# or for security updates.
+name: Release fleetctl docker dependencies
+
+on:
+  push:
+    tags:
+      - "fleetctl-docker-deps-*"
+
+# This allows a subsequently queued workflow run to interrupt previous runs
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id}}
+  cancel-in-progress: true
+
+defaults:
+  run:
+    # fail-fast using bash -eo pipefail. See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference
+    shell: bash
+
+permissions:
+  contents: read
+
+jobs:
+  push_latest:
+    runs-on: ubuntu-latest
+    environment: Docker Hub
+    permissions:
+      contents: write
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout Code
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+
+      - name: Install Go
+        uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
+        with:
+          go-version-file: 'go.mod'
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_ACCESS_TOKEN }}
+
+      - name: Build fleetdm/wix
+        run: make wix-docker
+
+      - name: Build fleetdm/bomutils
+        run: make bomutils-docker
+
+      #
+      # After fleetdm/wix and fleetdm/bomutils are built,
+      # let's smoke test pkg/msi generation before pushing.
+      #
+
+      - name: Install Go Dependencies
+        run: make deps-go
+
+      - name: Build fleetctl
+        run: make fleetctl
+
+      - name: Build MSI
+        run: ./build/fleetctl package --type msi --enroll-secret=foo --fleet-url=https://localhost:8080
+
+      - name: Build PKG
+        run: ./build/fleetctl package --type pkg --enroll-secret=foo --fleet-url=https://localhost:8080
+
+      #
+      # Now push to production
+      #
+
+      - name: Push fleetdm/bomutils to docker hub
+        run: docker push fleetdm/bomutils:latest
+
+      - name: Push fleetdm/wix to docker hub
+        run: docker push fleetdm/wix:latest
diff --git a/.github/workflows/release-fleetd-base.yml b/.github/workflows/release-fleetd-base.yml
index d7b02cfcf7..9909901964 100644
--- a/.github/workflows/release-fleetd-base.yml
+++ b/.github/workflows/release-fleetd-base.yml
@@ -51,16 +51,16 @@ jobs:
         with:
           egress-policy: audit
 
-      - name: Install Go
-        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
-        with:
-          go-version: ${{ vars.GO_VERSION }}
-
       - name: Checkout Code
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           fetch-depth: 0
 
+      - name: Install Go
+        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
+        with:
+          go-version-file: 'go.mod'
+
       - name: Check for fleetd component updates
         id: check-for-fleetd-component-updates
         run: |
diff --git a/.github/workflows/test-bulk-operations-dashboard-changes.yml b/.github/workflows/test-bulk-operations-dashboard-changes.yml
new file mode 100644
index 0000000000..cfbb26205d
--- /dev/null
+++ b/.github/workflows/test-bulk-operations-dashboard-changes.yml
@@ -0,0 +1,60 @@
+name: Test bulk operations dashboard changes
+
+on:
+  pull_request:
+    paths:
+      - 'ee/bulk-operations-dashboard/**'
+      - '.github/workflows/test-bulk-operations-dashboard-changes.yml'
+
+# This allows a subsequently queued workflow run to interrupt previous runs
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id}}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    permissions:
+      contents: read
+    runs-on: ubuntu-latest
+
+    strategy:
+      matrix:
+        node-version: [16.x]
+
+    steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
+      with:
+        egress-policy: audit
+
+    - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+
+    # Set the Node.js version
+    - name: Use Node.js ${{ matrix.node-version }}
+      uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
+      with:
+        node-version: ${{ matrix.node-version }}
+
+
+    # Now start building!
+    # > …but first, get a little crazy for a sec and delete the top-level package.json file
+    # > i.e. the one used by the Fleet server.  This is because require() in node will go
+    # > hunting in ancestral directories for missing dependencies, and since some of the
+    # > bundled transpiler tasks sniff for package availability using require(), this trips
+    # > up when it encounters another Node universe in the parent directory.
+    - run: rm -rf package.json package-lock.json node_modules/
+    # > Turns out there's a similar issue with how eslint plugins are looked up, so we
+    # > delete the top level .eslintrc file too.
+    - run: rm -f .eslintrc.js
+
+    # Get dependencies (including dev deps)
+    - run: cd ee/bulk-operations-dashboard/ && npm install
+
+    # Run sanity checks
+    - run: cd ee/bulk-operations-dashboard/ && npm test
+
+    # Compile assets
+    - run: cd ee/bulk-operations-dashboard/ && npm run build-for-prod
diff --git a/.github/workflows/test-db-changes.yml b/.github/workflows/test-db-changes.yml
index 301645008e..2bd89ab82b 100644
--- a/.github/workflows/test-db-changes.yml
+++ b/.github/workflows/test-db-changes.yml
@@ -10,7 +10,7 @@ on:
     paths:
       - '**.go'
       - 'server/datastore/mysql/schema.sql'
-      - '.github/workflows/test-schema-changes.yml'
+      - '.github/workflows/test-db-changes.yml'
   workflow_dispatch: # Manual
 
 # This allows a subsequently queued workflow run to interrupt previous runs
@@ -35,18 +35,28 @@ jobs:
       with:
         egress-policy: audit
 
-    - name: Install Go
-      uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
-      with:
-        go-version: ${{ vars.GO_VERSION }}
     - name: Checkout Code
       uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5 # v2
       with:
         fetch-depth: 0
 
+    - name: Install Go
+      uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
+      with:
+        go-version-file: 'go.mod'
+
     - name: Start Infra Dependencies
       # Use & to background this
-      run: docker-compose up -d mysql_test &
+      run: docker compose up -d mysql_test &
+
+    - name: Wait for mysql
+      run: |
+        echo "waiting for mysql..."
+        until docker compose exec -T mysql_test sh -c "mysql -uroot -p\"\${MYSQL_ROOT_PASSWORD}\" -e \"SELECT 1=1\" fleet" &> /dev/null; do
+            echo "."
+            sleep 1
+        done
+        echo "mysql is ready"
 
     - name: Verify test schema changes
       run: |
diff --git a/.github/workflows/test-fleetd-chrome.yml b/.github/workflows/test-fleetd-chrome.yml
index 47ba496ebb..8cbb0125f9 100644
--- a/.github/workflows/test-fleetd-chrome.yml
+++ b/.github/workflows/test-fleetd-chrome.yml
@@ -66,7 +66,8 @@ jobs:
           npm test
 
       - name: Upload to Codecov
-        uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70 # v3.1.1
+        uses: codecov/codecov-action@e28ff129e5465c2c0dcc6f003fc735cb6ae0c673 # v4.5.0
         with:
+          token: ${{ secrets.CODECOV_TOKEN }}
           directory: ./ee/fleetd-chrome/coverage
           flags: fleetd-chrome
diff --git a/.github/workflows/test-go.yaml b/.github/workflows/test-go.yaml
index 0f128b8025..1066843684 100644
--- a/.github/workflows/test-go.yaml
+++ b/.github/workflows/test-go.yaml
@@ -44,8 +44,7 @@ jobs:
       matrix:
         suite: ["integration", "core"]
         os: [ubuntu-latest]
-        go-version: ['${{ vars.GO_VERSION }}']
-        mysql: ["mysql:8.0.36"]
+        mysql: ["mysql:8.0.36", "mysql:8.4.2"] # make sure to update supported versions docs when this changes
     continue-on-error: ${{ matrix.suite == 'integration' }} # Since integration tests have a higher chance of failing, often for unrelated reasons, we don't want to fail the whole job if they fail
     runs-on: ${{ matrix.os }}
 
@@ -59,18 +58,18 @@ jobs:
       with:
         egress-policy: audit
 
-    - name: Install Go
-      uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
-      with:
-        go-version: ${{ matrix.go-version }}
-
     - name: Checkout Code
       uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
 
+    - name: Install Go
+      uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
+      with:
+        go-version-file: 'go.mod'
+
     # Pre-starting dependencies here means they are ready to go when we need them.
     - name: Start Infra Dependencies
       # Use & to background this
-      run: FLEET_MYSQL_IMAGE=${{ matrix.mysql }} docker-compose -f docker-compose.yml -f docker-compose-redis-cluster.yml up -d mysql_test mysql_replica_test redis redis-cluster-1 redis-cluster-2 redis-cluster-3 redis-cluster-4 redis-cluster-5 redis-cluster-6 redis-cluster-setup minio saml_idp mailhog mailpit smtp4dev_test &
+      run: FLEET_MYSQL_IMAGE=${{ matrix.mysql }} docker compose -f docker-compose.yml -f docker-compose-redis-cluster.yml up -d mysql_test mysql_replica_test redis redis-cluster-1 redis-cluster-2 redis-cluster-3 redis-cluster-4 redis-cluster-5 redis-cluster-6 redis-cluster-setup minio saml_idp mailhog mailpit smtp4dev_test &
 
     - name: Add TLS certificate for SMTP Tests
       run: |
@@ -98,13 +97,13 @@ jobs:
     - name: Wait for mysql
       run: |
         echo "waiting for mysql..."
-        until docker-compose exec -T mysql_test sh -c "mysql -uroot -p\"\${MYSQL_ROOT_PASSWORD}\" -e \"SELECT 1=1\" fleet" &> /dev/null; do
+        until docker compose exec -T mysql_test sh -c "mysql -uroot -p\"\${MYSQL_ROOT_PASSWORD}\" -e \"SELECT 1=1\" fleet" &> /dev/null; do
             echo "."
             sleep 1
         done
         echo "mysql is ready"
         echo "waiting for mysql replica..."
-        until docker-compose exec -T mysql_replica_test sh -c "mysql -uroot -p\"\${MYSQL_ROOT_PASSWORD}\" -e \"SELECT 1=1\" fleet" &> /dev/null; do
+        until docker compose exec -T mysql_replica_test sh -c "mysql -uroot -p\"\${MYSQL_ROOT_PASSWORD}\" -e \"SELECT 1=1\" fleet" &> /dev/null; do
             echo "."
             sleep 1
         done
@@ -119,7 +118,6 @@ jobs:
         else
           RUN_TESTS_ARG=''
         fi
-
         GO_TEST_EXTRA_FLAGS="-v -race=$RACE_ENABLED -timeout=$GO_TEST_TIMEOUT $RUN_TESTS_ARG" \
           TEST_LOCK_FILE_PATH=$(pwd)/lock \
           NETWORK_TEST=1 \
@@ -132,13 +130,17 @@ jobs:
           NETWORK_TEST_GITHUB_TOKEN=${{ secrets.FLEET_RELEASE_GITHUB_PAT }} \
           make test-go 2>&1 | tee /tmp/gotest.log
 
-    # note: it's fine to upload multiple reports (one per matrix combination)
-    # for the same run, see https://docs.codecov.com/docs/merging-reports
-    - name: Upload to Codecov
-      uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70
+    - name: Create mysql identifier without colon
+      if: always()
+      run: |
+        echo "MATRIX_MYSQL_ID=$(echo ${{ matrix.mysql }} | tr -d ':')" >> $GITHUB_ENV
+
+    - name: Save coverage
+      uses: actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a # v4.3.6
       with:
-        files: coverage.txt
-        flags: backend
+        name: ${{ matrix.suite }}-${{ env.MATRIX_MYSQL_ID }}-coverage
+        path: ./coverage.txt
+        if-no-files-found: error
 
     - name: Generate summary of errors
       if: failure()
@@ -156,10 +158,6 @@ jobs:
         fi
         GO_FAIL_SUMMARY=$GO_FAIL_SUMMARY envsubst < .github/workflows/config/slack_payload_template.json > ./payload.json
 
-    # TODO: figure out a sane way to combine outputs from different matrix jobs
-    # into a single slack notification, instead of sending one per job. This
-    # problem already existed but now it's accentuated because we're running 4
-    # jobs.
     - name: Slack Notification
       if: github.event.schedule == '0 4 * * *' && failure()
       uses: slackapi/slack-github-action@e28cf165c92ffef168d23c5c9000cffc8a25e117 # v1.24.0
@@ -174,15 +172,32 @@ jobs:
 
     - name: Upload test log
       if: always()
-      uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v2
+      uses: actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a # v4.3.6
       with:
-        name: test-log
+        name: ${{ matrix.suite }}-${{ env.MATRIX_MYSQL_ID }}-test-log
         path: /tmp/gotest.log
         if-no-files-found: error
 
     - name: Upload summary test log
       if: always()
-      uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v2
+      uses: actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a  # v4.3.6
       with:
-        name: summary-test-log
+        name: ${{ matrix.suite }}-${{ env.MATRIX_MYSQL_ID }}-summary-test-log
         path: /tmp/summary.txt
+
+  # We upload all backend coverage in one step so that we're less like to end up in a situation with a partial coverage report.
+  upload-coverage:
+    needs: [test-go]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      - name: Download artifacts
+        uses: actions/download-artifact@9c19ed7fe5d278cd354c7dfd5d3b88589c7e2395 # v4.1.6
+        with:
+          pattern: '*-coverage'
+      - name: Upload to Codecov
+        uses: codecov/codecov-action@e28ff129e5465c2c0dcc6f003fc735cb6ae0c673 # v4.5.0
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          flags: backend
diff --git a/.github/workflows/test-js.yml b/.github/workflows/test-js.yml
index 9d63523737..15b4fd05ce 100644
--- a/.github/workflows/test-js.yml
+++ b/.github/workflows/test-js.yml
@@ -69,8 +69,9 @@ jobs:
           yarn test:ci
 
       - name: Upload to Codecov
-        uses: codecov/codecov-action@d9f34f8cd5cb3b3eb79b3e4b5dae3a16df499a70
+        uses: codecov/codecov-action@e28ff129e5465c2c0dcc6f003fc735cb6ae0c673 # v4.5.0
         with:
+          token: ${{ secrets.CODECOV_TOKEN }}
           flags: frontend
 
   lint-js:
diff --git a/.github/workflows/test-native-tooling-packaging.yml b/.github/workflows/test-native-tooling-packaging.yml
index db242cee0c..45a6e9abff 100644
--- a/.github/workflows/test-native-tooling-packaging.yml
+++ b/.github/workflows/test-native-tooling-packaging.yml
@@ -1,4 +1,4 @@
-# This workflow tests packaging of Fleet-osquery with the
+# This workflow tests generation of fleetd packages with the
 # `fleetdm/fleetctl` Docker image.
 name: Test native tooling packaging
 
@@ -21,6 +21,8 @@ on:
       - 'tools/bomutils-docker/**'
       - '.github/workflows/test-native-tooling-packaging.yml'
   workflow_dispatch: # Manual
+  schedule:
+    - cron: "0 5 * * *"
 
 # This allows a subsequently queued workflow run to interrupt previous runs
 concurrency:
@@ -41,7 +43,12 @@ jobs:
       fail-fast: false
       matrix:
         os: [ubuntu-latest]
-        go-version: ['${{ vars.GO_VERSION }}']
+        # build_type == 'remote' means this job will test the fleetdm/fleetctl:latest from Docker Hub.
+        # build_type == 'local' means this job will build the the image locally.
+        #
+        # TODO(lucas): We should only run 'remote' on schedule
+        # (adding conditionals to 'matrix' requires many tricks).
+        build_type: ["remote", "local"]
     runs-on: ${{ matrix.os }}
 
     steps:
@@ -50,18 +57,30 @@ jobs:
       with:
         egress-policy: audit
 
-    - name: Install Go
-      uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
-      with:
-        go-version: ${{ matrix.go-version }}
-
     - name: Checkout Code
+      if: ${{ matrix.build_type ==  'local' }}
       uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
 
+    - name: Install Go
+      if: ${{ matrix.build_type ==  'local' }}
+      uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
+      with:
+        go-version-file: 'go.mod'
+
     - name: Install Go Dependencies
+      if: ${{ matrix.build_type ==  'local' }}
       run: make deps-go
 
+    - name: Build fleetdm/wix
+      if: ${{ matrix.build_type ==  'local' }}
+      run: make wix-docker
+
+    - name: Build fleetdm/bomutils
+      if: ${{ matrix.build_type ==  'local' }}
+      run: make bomutils-docker
+
     - name: Build fleetdm/fleetctl
+      if: ${{ matrix.build_type ==  'local' }}
       run: make fleetctl-docker
 
     - name: Build DEB
@@ -87,3 +106,24 @@ jobs:
 
     - name: Build PKG with Fleet Desktop
       run: docker run -v "$(pwd):/build" fleetdm/fleetctl package --type pkg --enroll-secret=foo --fleet-url=https://localhost:8080 --fleet-desktop
+
+    - name: Slack Notification
+      if: github.event.schedule == '0 5 * * *' && failure()
+      uses: slackapi/slack-github-action@e28cf165c92ffef168d23c5c9000cffc8a25e117 # v1.24.0
+      with:
+        payload: |
+          {
+            "text": "${{ job.status }}\n${{ github.event.pull_request.html_url || github.event.head.html_url }}",
+            "blocks": [
+              {
+                "type": "section",
+                "text": {
+                  "type": "mrkdwn",
+                  "text": "⚠️  Tests on fleetdm/fleetctl docker image failed.\nhttps://github.com/fleetdm/fleet/actions/runs/${{  github.run_id }}"
+                }
+              }
+            ]
+          }
+      env:
+        SLACK_WEBHOOK_URL: ${{ secrets.SLACK_G_HELP_ENGINEERING_WEBHOOK_URL }}
+        SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK
diff --git a/.github/workflows/test-packaging-build-docker-deps.yml b/.github/workflows/test-packaging-build-docker-deps.yml
new file mode 100644
index 0000000000..d2f0cf7f95
--- /dev/null
+++ b/.github/workflows/test-packaging-build-docker-deps.yml
@@ -0,0 +1,94 @@
+# This workflow tests packaging of fleetd with the
+# `fleetctl package` command using locally built fleetdm/wix and fleetdm/bomutils images.
+#
+# It fetches the targets: orbit, osquery and fleet-desktop from the default
+# (Fleet's) TUF server, https://tuf.fleetctl.com.
+name: Test packaging with local fleetdm/wix and fleetdm/bomutils
+
+on:
+  push:
+    branches:
+      - main
+      - patch-*
+      - prepare-*
+    paths:
+      - "tools/bomutils-docker/**"
+      - "tools/wix-docker/**"
+      - ".github/workflows/test-packaging-build-docker-deps.yml"
+  pull_request:
+    paths:
+      - "tools/bomutils-docker/**"
+      - "tools/wix-docker/**"
+      - ".github/workflows/test-packaging-build-docker-deps.yml"
+  workflow_dispatch: # Manual
+
+# This allows a subsequently queued workflow run to interrupt previous runs
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id}}
+  cancel-in-progress: true
+
+defaults:
+  run:
+    # fail-fast using bash -eo pipefail. See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference
+    shell: bash
+
+permissions:
+  contents: read
+
+jobs:
+  test-packaging:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest]
+    runs-on: ${{ matrix.os }}
+
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout Code
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+
+      - name: Install Go
+        uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
+        with:
+          go-version-file: "go.mod"
+
+      - name: Install Go Dependencies
+        run: make deps-go
+
+      - name: Build fleetctl
+        run: make fleetctl
+
+      - name: Build fleetdm/wix
+        run: make wix-docker
+
+      - name: Build fleetdm/bomutils
+        run: make bomutils-docker
+
+      - name: Build DEB
+        run: ./build/fleetctl package --type deb --enroll-secret=foo --fleet-url=https://localhost:8080
+
+      - name: Build DEB with Fleet Desktop
+        run: ./build/fleetctl package --type deb --enroll-secret=foo --fleet-url=https://localhost:8080 --fleet-desktop
+
+      - name: Build RPM
+        run: ./build/fleetctl package --type rpm --enroll-secret=foo --fleet-url=https://localhost:8080
+
+      - name: Build RPM with Fleet Desktop
+        run: ./build/fleetctl package --type rpm --enroll-secret=foo --fleet-url=https://localhost:8080 --fleet-desktop
+
+      - name: Build MSI
+        run: ./build/fleetctl package --type msi --enroll-secret=foo --fleet-url=https://localhost:8080
+
+      - name: Build MSI with Fleet Desktop
+        run: ./build/fleetctl package --type msi --enroll-secret=foo --fleet-url=https://localhost:8080 --fleet-desktop
+
+      - name: Build PKG
+        run: ./build/fleetctl package --type pkg --enroll-secret=foo --fleet-url=https://localhost:8080
+
+      - name: Build PKG with Fleet Desktop
+        run: ./build/fleetctl package --type pkg --enroll-secret=foo --fleet-url=https://localhost:8080 --fleet-desktop
diff --git a/.github/workflows/test-packaging.yml b/.github/workflows/test-packaging.yml
index 7190314cb9..0d8ff6d9b0 100644
--- a/.github/workflows/test-packaging.yml
+++ b/.github/workflows/test-packaging.yml
@@ -1,7 +1,8 @@
-# This workflow tests packaging of Fleet-osquery with the
-# `fleetctl package` command. It fetches the targets: orbit,
-# osquery and fleet-desktop from the default (Fleet's) TUF server,
-# https://tuf.fleetctl.com.
+# This workflow tests packaging of fleetd with the
+# `fleetctl package` command.
+#
+# It fetches the targets: orbit, osquery and fleet-desktop from the default
+# (Fleet's) TUF server, https://tuf.fleetctl.com.
 name: Test packaging
 
 on:
@@ -47,81 +48,89 @@ jobs:
         # `macos-latest` uses arm64 by default now, so please be careful when
         # updating this version.
         os: [ubuntu-latest, macos-13]
-        go-version: ['${{ vars.GO_VERSION }}']
     runs-on: ${{ matrix.os }}
 
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
+        with:
+          egress-policy: audit
 
-    - name: Harden Runner
-      uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
-      with:
-        egress-policy: audit
+      - name: Run Colima
+        if: startsWith(matrix.os, 'macos')
+        timeout-minutes: 15
+        # notes:
+        # - docker to install the docker CLI and interact with the Colima
+        #   container runtime
+        # - colima is pre-installed in macos-12 runners, but not in macos-13 or
+        #   macos-14 runners
+        run: |
+          brew install docker
+          # The runners come with an old version of python@3.12 that fails to upgrade
+          # when python gets pulled in as a dep through the chain
+          # colima -> lima -> qemu -> glibc -> python@3.12
+          # Force upgrade it for now, remove once the problem is fixed
+          brew install --overwrite python@3.12
+          brew install colima
+          colima start --mount $TMPDIR:w
 
-    - name: Pull fleetdm/wix
-      # Run in background while other steps complete to speed up the workflow
-      run: docker pull fleetdm/wix:latest &
+      - name: Pull fleetdm/wix
+        # Run in background while other steps complete to speed up the workflow
+        run: docker pull fleetdm/wix:latest
 
-    - name: Run Colima
-      if: startsWith(matrix.os, 'macos')
-      timeout-minutes: 10
-      # notes:
-      # - docker to install the docker CLI and interact with the Colima
-      #   container runtime
-      # - colima is pre-installed in macos-12 runners, but not in macos-13 or
-      #   macos-14 runners
-      run: |
-        brew install docker colima
-        colima start --mount $TMPDIR:w
+      - name: Pull fleetdm/bomutils
+        # Run in background while other steps complete to speed up the workflow
+        run: docker pull fleetdm/bomutils:latest
 
-    - name: Install Go
-      uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
-      with:
-        go-version: ${{ matrix.go-version }}
+      - name: Checkout Code
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
 
-    - name: Checkout Code
-      uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      - name: Install Go
+        uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
+        with:
+          go-version-file: "go.mod"
 
-    - name: Install wine and wix
-      if: startsWith(matrix.os, 'macos')
-      run: |
-        ./scripts/macos-install-wine.sh -n
-        wget https://github.com/wixtoolset/wix3/releases/download/wix3112rtm/wix311-binaries.zip -nv -O wix.zip
-        mkdir wix
-        unzip wix.zip -d wix
-        rm -f wix.zip
-        echo wix installed at $(pwd)/wix
+      - name: Install wine and wix
+        if: startsWith(matrix.os, 'macos')
+        run: |
+          ./scripts/macos-install-wine.sh -n
+          wget https://github.com/wixtoolset/wix3/releases/download/wix3112rtm/wix311-binaries.zip -nv -O wix.zip
+          mkdir wix
+          unzip wix.zip -d wix
+          rm -f wix.zip
+          echo wix installed at $(pwd)/wix
 
-      # It seems faster not to cache Go dependencies
-    - name: Install Go Dependencies
-      run: make deps-go
+        # It seems faster not to cache Go dependencies
+      - name: Install Go Dependencies
+        run: make deps-go
 
-    - name: Build fleetctl
-      run: make fleetctl
+      - name: Build fleetctl
+        run: make fleetctl
 
-    - name: Build DEB
-      run: ./build/fleetctl package --type deb --enroll-secret=foo --fleet-url=https://localhost:8080
+      - name: Build DEB
+        run: ./build/fleetctl package --type deb --enroll-secret=foo --fleet-url=https://localhost:8080
 
-    - name: Build DEB with Fleet Desktop
-      run: ./build/fleetctl package --type deb --enroll-secret=foo --fleet-url=https://localhost:8080 --fleet-desktop
+      - name: Build DEB with Fleet Desktop
+        run: ./build/fleetctl package --type deb --enroll-secret=foo --fleet-url=https://localhost:8080 --fleet-desktop
 
-    - name: Build RPM
-      run: ./build/fleetctl package --type rpm --enroll-secret=foo --fleet-url=https://localhost:8080
+      - name: Build RPM
+        run: ./build/fleetctl package --type rpm --enroll-secret=foo --fleet-url=https://localhost:8080
 
-    - name: Build RPM with Fleet Desktop
-      run: ./build/fleetctl package --type rpm --enroll-secret=foo --fleet-url=https://localhost:8080 --fleet-desktop
+      - name: Build RPM with Fleet Desktop
+        run: ./build/fleetctl package --type rpm --enroll-secret=foo --fleet-url=https://localhost:8080 --fleet-desktop
 
-    - name: Build MSI
-      run: ./build/fleetctl package --type msi --enroll-secret=foo --fleet-url=https://localhost:8080
+      - name: Build MSI
+        run: ./build/fleetctl package --type msi --enroll-secret=foo --fleet-url=https://localhost:8080
 
-    - name: Build MSI with Fleet Desktop
-      run: ./build/fleetctl package --type msi --enroll-secret=foo --fleet-url=https://localhost:8080 --fleet-desktop
+      - name: Build MSI with Fleet Desktop
+        run: ./build/fleetctl package --type msi --enroll-secret=foo --fleet-url=https://localhost:8080 --fleet-desktop
 
-    - name: Build PKG
-      run: ./build/fleetctl package --type pkg --enroll-secret=foo --fleet-url=https://localhost:8080
+      - name: Build PKG
+        run: ./build/fleetctl package --type pkg --enroll-secret=foo --fleet-url=https://localhost:8080
 
-    - name: Build PKG with Fleet Desktop
-      run: ./build/fleetctl package --type pkg --enroll-secret=foo --fleet-url=https://localhost:8080 --fleet-desktop
+      - name: Build PKG with Fleet Desktop
+        run: ./build/fleetctl package --type pkg --enroll-secret=foo --fleet-url=https://localhost:8080 --fleet-desktop
 
-    - name: Build MSI (using local Wix)
-      if: startsWith(matrix.os, 'macos')
-      run: ./build/fleetctl package --type msi --enroll-secret=foo --fleet-url=https://localhost:8080 --fleet-desktop --local-wix-dir ./wix
+      - name: Build MSI (using local Wix)
+        if: startsWith(matrix.os, 'macos')
+        run: ./build/fleetctl package --type msi --enroll-secret=foo --fleet-url=https://localhost:8080 --fleet-desktop --local-wix-dir ./wix
diff --git a/.github/workflows/test-yml-specs.yml b/.github/workflows/test-yml-specs.yml
index 75e46d6af0..fe8f3ecace 100644
--- a/.github/workflows/test-yml-specs.yml
+++ b/.github/workflows/test-yml-specs.yml
@@ -33,7 +33,6 @@ jobs:
     strategy:
       matrix:
         os: [ubuntu-latest]
-        go-version: ['${{ vars.GO_VERSION }}']
     runs-on: ${{ matrix.os }}
 
     steps:
@@ -42,13 +41,13 @@ jobs:
       with:
         egress-policy: audit
 
+    - name: Checkout Code
+      uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+
     - name: Install Go
       uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
       with:
-        go-version: ${{ matrix.go-version }}
-
-    - name: Checkout Code
-      uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        go-version-file: 'go.mod'
 
     - name: Run apply spec tests
       run: |
diff --git a/.vscode/launch.json b/.vscode/launch.json
index 3e3ac95d6a..885f407fb8 100644
--- a/.vscode/launch.json
+++ b/.vscode/launch.json
@@ -61,6 +61,21 @@
                 "--dev_license"
             ]
         },
+        {
+            "name": "Fleet vuln_processing (licensed)",
+            "type": "go",
+            "request": "launch",
+            "mode": "auto",
+            "buildFlags": "-tags='full,fts5'",
+            "cwd": "${workspaceFolder}",
+            "program": "${workspaceFolder}/cmd/fleet",
+            "args": [
+                "vuln_processing",
+                "--dev",
+                "--logging_debug",
+                "--dev_license",
+            ]
+        },
         {
             "name": "Attach to a running Fleet server",
             "type": "go",
diff --git a/16538-preserve-manage-query-automations-modal-state b/16538-preserve-manage-query-automations-modal-state
deleted file mode 100644
index d8ea5ca981..0000000000
--- a/16538-preserve-manage-query-automations-modal-state
+++ /dev/null
@@ -1,2 +0,0 @@
-- Fix a bug where the manage query automations modal would lose its state when the user clicks
-  "Preview data"
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0cd42253b8..2e87456657 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,13 +1,174 @@
+## Fleet 4.56.0 (Sep 7, 2024)
+
+### Endpoint operations
+
+- Added index to `query_results` DB table to speed up finding last query timestamp for a given query and host.
+- Added a link in the UI to the error message when a CSR can't be downloaded due to missing private key.
+- Added a disabled overlay to the Other Workflows modal on the policy page.
+- Improved performance of live queries to accommodate for higher volumes when utilizing zero-trust workflows.
+- Improved `fleetctl` gitops error message when trying to change team name to a team that already exists.
+
+### Device management
+
+- Added server support for multiple VPP tokens.
+- Added new endpoints and updated existing endpoints for managing multiple Apple Business Manager tokens.
+- Added support for S3 to store MDM bootstrap packages (uses the same bucket configuration as for software installers).
+- Added support to UI for self service VPP software.
+- Added backend and gitops support for self service VPP.
+- Added ability for MDM migrations if the host is manually enrolled to a 3rd party MDM.
+- Added an offline screen to the macOS MDM migration flow.
+- Added new ABM page to Fleet UI.
+- Added new VPP page to the fleet UI
+- Added support to track the Apple Business Manager "terms expired" API error per token, as well as a global flag that gets set as soon as one token has its terms expired.
+- Updated the instructions on "My device" for MDM migrations on pre-Sonoma macOS hosts.
+- Updated to allow multiple teams to be assigned to the same VPP Token.
+- Updated process so that deleting installed software or VPP app now makes it available for re-installation.
+- Updated to enforce minimum OS version settings during Apple Automated Device Enrollment (ADE).
+- Updated ABM ingestion so that deleted iOS/iPadOS host will continue to report to Fleet as long as host is in Apple Business Manager (ABM).
+- Updated so that refetching an offline iOS/iPadOS host will not add new MDM commands to the queue if previous refetch has not completed yet.
+- Updated UI so that downloading a software installer package now shows the browser's built-in progress bar.
+- Updated relevant documentation to include references to multiple ABM and VPP tokens.
+- Consolidated Automatic Enrollment and VPP settings under the MDM settings integration page.
+- Cleared apps associated with a VPP token if it's moved off of a team.
+
+### Vulnerability management
+
+- Added ALAS bulletins as vulnerability source for Amazon Linux (instead of OVAL for Amazon Linux 2, and adds support for Amazon Linux 1, 2022, and 2023).
+- Added matching rules for July and August Microsoft 365 security updates (https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates).
+- Added the following filters to `/software/titles` and `/software/versions` API endpoints: `exploit: bool`, `min_cvss_score: float`, `max_cvss_score: float`.
+- Updated software titles/versions tables to allow for filtering by vulnerabilities including severity and known exploit.
+- Updated to use empty CVE description when the NVD CVE feed doesn't include description entries (instead of panicking).
+- Updated matching software that is not installed by Fleet so that it shows up as 'Available for install' on host details page.
+- Updated base images of `fleetdm/fleetctl`, `fleetdm/bomutils` and `fleetdm/wix` to fix critical vulnerabilities found by Trivy.
+- Updated vulnerability scanning to use `macos` SW target for CPEs of homebrew packages.
+- Updated vulnerability scanning to not ignore software with non-ASCII en dash and em dash characters.
+- Updated `GET /api/v1/fleet/vulnerabilities/{cve}` endpoint to add validation of CVE format, and a 204 response. The 204 response indicates that the vulnerability is known to Fleet but not present on any hosts.
+- Updated the UI to add new empty states for searching vulnerabilities: invalid CVE format searched, a known CVE serached but not present on hosts, not a known CVE searched, exploited vulnerability empty state, operating systems empty state, new icons.
+
+### Bug fixes and improvements
+
+- Added support for MySQL 8.4.2 LTS.
+- Updated Go to go1.22.6.
+- Updated Fleet server to now accept arguments via stdin. This is useful for passing secrets that you don't want to expose as env vars, in the command line, or in the config file.
+- Updated text for "Turn on MDM" banners in UI.
+- Updated ABM host tooltip copy on the manage host page to clarify when host vitals will be available to view.
+- Updated copy on auotmatic enrollment modal on my device page.
+- Updated host details activities tooltip and empty state copy to reflect recently added capabilities.
+- Updated Fleet Free so users see a Premium feature message when clicking to add software.
+- Updated usage reporting to report statistics on new AI features, maintenance window, and `fleetd`.
+- Fixed bug where configuration profile was still showing the old label name after the name was updated.
+- Fixed a bug when a cached prepared statement gets deleted in the MySQL server itself without Fleet knowing.
+- Fixed a bug where the wrong API path was used to download a software installer.
+- Fixed the failing_host_count so it is never 0. This count is normally updated once an hour during cleanups_then_aggregation cron job.
+- Fixed CVE-2024-4030 in Vulncheck feed incorrectly targeting non-Windows hosts.
+- Fixed a bug where the "Self-service" filter for the list of software and the list of host's software did not take App Store apps into account.
+- Fixed a bug where the "My device" page in Fleet Desktop did not show the self-service software tab when App Store apps were available as self-install.
+- Fixed a bug where a software installer (a package or a VPP app) that has been installed on a host still shows up as "Available for install" and can still be requested to be installed after the host is transferred to a different team without that installer (or after the installer is deleted).
+- Fixed the "Available for install" filter in the host's software page so that installers that were requested to be installed on the host (regardless of installation status) also show up in the list.
+- Fixed UI popup messages bleeding off viewport in some cases.
+- Fixed an issue with the scheduling of cron jobs at startup if the job has never run, which caused it to be delayed.
+- Fixed UI to display the label names in case-insensitive alphabetical order.
+
+## Fleet 4.55.2 (Sep 05, 2024)
+
+### Bug fixes
+
+- Removed validation of APNS certificate from server startup. This was no longer necessary because we now allow for APNS certificates to be renewed in the UI.
+- Fixed logic to properly catch and log APNs errors.
+
+## Fleet 4.55.1 (Aug 15, 2024)
+
+### Bug fixes
+
+- Added a disabled overlay to the Other Workflows modal on the policy page.
+- Updated text for "Turn on MDM" banners in UI.
+- Fixed a bug when a cached prepared statement got deleted in the MySQL server itself without Fleet knowing.
+- Continued with an empty CVE description when the NVD CVE feed didn't include description entries (instead of panicking).
+- Scheduled maintenance events are now scheduled over calendar events marked "Free" (not busy) in Google Calendar.
+- Fixed a bug where the wrong API path was used to download a software installer.
+- Improved fleetctl gitops error message when trying to change team name to a team that already exists.
+- Updated ABM (Apple Business Manager) host tooltip copy on the manage host page to clarify when host vitals will be available to view.
+- Added index to query_results DB table to speed up finding the last query timestamp for a given query and host.
+- Displayed the label names in case-insensitive alphabetical order in the fleet UI.
+
+## Fleet 4.55.0 (Aug 8, 2024)
+
+**NOTE:** Beginning with v4.55.0, Fleet no longer supports MySQL 5.7 because it has reached [end of life](https://mattermost.com/blog/mysql-5-7-reached-eol-upgrade-to-mysql-8-x-today/#:~:text=In%20October%202023%2C%20MySQL%205.7,to%20upgrade%20to%20MySQL%208.). The minimum version supported is MySQL 8.0.36.
+
+### Endpoint Operations
+
+- Added support for generating `fleetd` packages for Linux ARM64.
+- Added new `fleetctl package` --arch flag.
+- Updated `fleetctl package` command to remove the `--version` flag. The version of the package can be controlled by `--orbit-channel` flag.
+- Updated maintenance window descriptions to update regularly to match the failing policy description/resolution.
+- Updated maintenance windows using Google Calendar so that calendar events are now recreated within 30 seconds if deleted or moved to the past.
+  - Fleet server watches for potential changes for up to 1 week after original event time. If event is moved forward more than 1 week, then after 1 week Fleet server will check for event changes once every 30 minutes.
+  - **NOTE:** These near real-time updates may add additional load to the Google Calendar API, so it is recommended to use API usage alerts or other monitoring methods.
+
+### Device Management
+
+- Integrated [Escrow Buddy](https://github.com/macadmins/escrow-buddy) to add enforcement of FileVault during the MacOS Setup Assistant process for hosts that are 
+enrolled into teams (or no team) with disk encryption turned on. Thank you [homebysix](https://github.com/homebysix) and team!
+- Updated `fleetd` to use [Escrow Buddy](https://github.com/macadmins/escrow-buddy) to rotate FileVault keys. Removed or modified internal API endpoints documented in the API for contributors.
+- Added OS updates support to iOS/iPadOS devices.
+- Added iOS and iPadOS device details refetch triggered with the existing `POST /api/latest/fleet/hosts/:id/refetch` endpoint.
+- Added iOS and iPadOS user-installed apps to Fleet.
+- Added iOS and iPadOS apps to be installed using Apple's VPP (Volume Purchase Program) to Fleet.
+- Added support for VPP to GitOps.
+- Added the `POST /mdm/apple/vpp_token`, `DELETE /mdm/apple/vpp_token` and `GET /vpp` endpoints and related functionality.
+- Added new `GET /software/app_store_apps` and `POST /software/app_store_apps` endpoints and associated functionality.
+- Added the associated VPP apps to the `GET /software/titles` and `GET /software/titles/:id` endpoints.
+- Added the associated VPP apps to the `GET /hosts/:id/software` and `GET /device/:token/software` endpoints.
+- Added support to delete a VPP app from a team in `DELETE /software/titles/:software_title_id/available_for_install`.
+- Added `exclude_software` query parameter to "Get host by identifier" API.
+- Added ability to add/remove/disable apps with VPP in the Fleet UI.
+- Added a warning banner to the UI if the uploaded VPP token is about to expire/has expired.
+- Added UI updates for VPP feature on host software and my device pages.
+- Added global activity support for VPP-related activities.
+- Added UI features for managing VPP apps for iPadOS and iOS hosts.
+- Updated profile activities to include iOS and iPadOS.
+- Updated Fleet UI to show OS version compliance on host details page.
+- Added support for "No teams" on all software pages including adding software installers.
+- Added DB migration to support VPP software features.
+- Added DB migration to migrate older team configurations to the new version that includes both installers and App Store apps.
+- Linux lock/unlock scripts now make use of pam_nologin to keep AD users locked out.
+- Installed software list now includes Linux .deb packages that are 'on hold'.
+- Added a special-case to properly name the Notion .exe Windows installer the same as how it will be reported by osquery post-install.
+- Increased threshold to renew Apple SCEP certificates for MDM enrollments to 180 days.
+
+### Vulnerability Management
+
+- Fixed CVEs identified as 'Rejected' in NVD not matching against software.
+- Fixed false negative vulnerabilities with IntelliJ IDEA CE and PyCharm CE installed via Homebrew.
+
+### Bug fixes and improvements
+
+- Dropped support for MySQL 5.7 and raised minimum required to MySQL 8.0.36.
+- Updated software pre-install to use new GitOps format for query.
+- Updated UI tooltips for pending OS settings.
+- Fixed a styling issue in the controls > OS settings > disk encryption table.
+- Fixed a bug in `fleetctl preview` that was causing it to fail if Docker was installed without support for the deprecated `docker-compose` CLI.
+- Fixed an issue where the app-wide warning banners were not showing on the initial page load.
+- Fixed a bug where the hosts page would sometimes allow excess pagination.
+- Fixed a bug where software install results could not be retrieved for deleted hosts in the activity feed.
+- Fixed path that was incorrect for the download software installer package endpoint `GET /software/titles/:software_title_id/package`.
+- Fixed a bug that set `last_enrolled_at` during orbit re-enrollment, which caused osquery enroll failures when `FLEET_OSQUERY_ENROLL_COOLDOWN` is set.
+- Fixed a bug where Fleet google calendar events generated by Fleet <= 4.53.0 were not correctly processed by 4.54.0.
+- Fixed a bug where software install results could not be retrieved for deleted hosts in the activity feed.
+- Fixed a bug where a software installer (a package or a VPP app) that has been installed on a host still shows up as "Available for install" and can still be requested to be installed after the host is transferred to a different team without that installer (or after the installer is deleted).
+
 ## Fleet 4.54.1 (Jul 24, 2024)
 
 ### Bug fixes
-* Fixed a startup bug by performing an early restart of orbit if an agent options setting has changed.
-* Implemented a small refactor of orbit subsystems.
-* Removed the `--version` flag from the `fleetctl package` command. The version of the package can now be controlled by the `--orbit-channel` flag.
-* Fixed a bug that set `last_enrolled_at` during orbit re-enrollment, which caused osquery enroll failures when `FLEET_OSQUERY_ENROLL_COOLDOWN` is set .
-* In `fleetctl package` command, removed the `--version` flag. The version of the package can be controlled by `--orbit-channel` flag.
-* Fixed a bug where Fleet google calendar events generated by Fleet <= 4.53.0 were not correctly processed by 4.54.0.
-* Re-enabled cached logins after windows Unlock.
+
+- Fixed a startup bug by performing an early restart of orbit if an agent options setting has changed.
+- Implemented a small refactor of orbit subsystems.
+- Removed the `--version` flag from the `fleetctl package` command. The version of the package can now be controlled by the `--orbit-channel` flag.
+- Fixed a bug that set `last_enrolled_at` during orbit re-enrollment, which caused osquery enroll failures when `FLEET_OSQUERY_ENROLL_COOLDOWN` is set .
+- In `fleetctl package` command, removed the `--version` flag. The version of the package can be controlled by `--orbit-channel` flag.
+- Fixed a bug where Fleet google calendar events generated by Fleet <= 4.53.0 were not correctly processed by 4.54.0.
+- Re-enabled cached logins after windows Unlock.
+
 ## Fleet 4.54.0 (Jul 17, 2024)
 
 ### Endpoint Operations
@@ -93,19 +254,19 @@
 
 ### Bug fixes
 
-* Updated fleetctl get queries/labels/hosts descriptions.
-* Fixed exporting CSVs with fields that contain commas to render properly.
-* Fixed link to fleetd uninstall instructions in "Delete device" modal.
-* Rendered only one banner on the my device page based on priority order.
-* Hidden query delete checkboxes from team observers.
-* Fixed issue where the Fleet UI could not be used to renew the ABM token after the ABM user who created the token was deleted.
-* Fixed an issue where special characters in HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall broke the "installer_utils.ps1 -uninstallOrbit" step in the Windows MSI installer.
-* Fixed counts for hosts with low disk space in summary page.
-* Fleet UI fixes: Hide CTA on inherited queries/policies from team level users.
-* Updated software updated timestamp tooltip.
-* Fixed issue where some Windows applications were getting matched against Windows OS vulnerabilities.
-* Fixed crash in `fleetd` installer on Windows if there are registry keys with special characters on the system.
-* Fixed UI capitalizations.
+- Updated fleetctl get queries/labels/hosts descriptions.
+- Fixed exporting CSVs with fields that contain commas to render properly.
+- Fixed link to fleetd uninstall instructions in "Delete device" modal.
+- Rendered only one banner on the my device page based on priority order.
+- Hidden query delete checkboxes from team observers.
+- Fixed issue where the Fleet UI could not be used to renew the ABM token after the ABM user who created the token was deleted.
+- Fixed an issue where special characters in HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall broke the "installer_utils.ps1 -uninstallOrbit" step in the Windows MSI installer.
+- Fixed counts for hosts with low disk space in summary page.
+- Fleet UI fixes: Hide CTA on inherited queries/policies from team level users.
+- Updated software updated timestamp tooltip.
+- Fixed issue where some Windows applications were getting matched against Windows OS vulnerabilities.
+- Fixed crash in `fleetd` installer on Windows if there are registry keys with special characters on the system.
+- Fixed UI capitalizations.
 
 ## Fleet 4.53.0 (Jun 25, 2024)
 
diff --git a/CODEOWNERS b/CODEOWNERS
index a1102215a4..153161e7ee 100644
--- a/CODEOWNERS
+++ b/CODEOWNERS
@@ -39,19 +39,9 @@
 go.sum @fleetdm/go
 go.mod @fleetdm/go
 /cmd/ @fleetdm/go
-/orbit/ @lucasmrod @getvictor @roperzh @gillespi314
 /server/ @fleetdm/go
-/server/service/handler.go @lucasmrod @getvictor @roperzh @gillespi314
-/server/mdm/ @roperzh @gillespi314 @lucasmrod @georgekarrv
-/server/worker/ @lucasmrod @getvictor @roperzh @gillespi314
-/server/vulnerabilities/ @lucasmrod @mostlikelee @getvictor
-/server/cron/ @getvictor @lucasmrod @roperzh @mostlikelee
-/ee/fleetd-chrome @lucasmrod @getvictor @RachelElysia
-/ee/vulnerability-dashboard @eashaw
-/ee/cis @sharon-fdm @lucasmrod @RachelElysia @jacobshandling
-/ee/server/calendar @lucasmrod @getvictor @jacobshandling
-/ee/server/service @roperzh @gillespi314 @lucasmrod @getvictor
-/scripts/mdm @roperzh @gillespi314 @jahzielv @dantecatalfamo
+/ee/server/ @fleetdm/go
+/orbit/ @lucasmrod @roperzh @lukeheath @georgekarrv @sharon-fdm
 
 ##############################################################################################
 # 🚀 React files and other files related to the core product frontend.
@@ -66,9 +56,9 @@ go.mod @fleetdm/go
 # FUTURE: Look for a way to not have this notify every single person in this "github team".
 ##############################################################################################
 
-/infrastructure/ @rfairburn @ksatter @lukeheath @edwardsb @pacamaster @georgekarrv
-/charts/ @rfairburn @ksatter @lukeheath @edwardsb @pacamaster @georgekarrv
-/terraform/ @rfairburn @ksatter @lukeheath @edwardsb @pacamaster @georgekarrv
+/infrastructure/ @rfairburn @ksatter @lukeheath @edwardsb @georgekarrv
+/charts/ @rfairburn @ksatter @lukeheath @edwardsb @georgekarrv
+/terraform/ @rfairburn @ksatter @lukeheath @edwardsb @georgekarrv
 /it-and-security/ @noahtalerman @lukeheath @spokanemac @getvictor
 
 ##############################################################################################
@@ -76,8 +66,8 @@ go.mod @fleetdm/go
 #
 # (see website/config/custom.js for DRIs of other paths not listed here)
 ##############################################################################################
-/docs                                           @eashaw
-/docs/REST\ API/rest-api.md                     @lukeheath # « REST API reference documentation
+/docs                                           @rachaelshaw @lukeheath
+/docs/REST\ API/rest-api.md                     @rachaelshaw @lukeheath # « REST API reference documentation
 /docs/Contributing/API-for-contributors.md      @lukeheath # « Advanced / contributors-only API reference documentation
 /schema                                         @eashaw # « Data tables (osquery/fleetd schema) documentation
 /docs/Deploy/_kubernetes/ @dherder # « Kubernetes best practice
@@ -105,13 +95,13 @@ go.mod @fleetdm/go
 /handbook/README.md                                              @mikermcneil
 /handbook/company/open-positions.yml                             @sampfluger88
 /handbook/company/product-groups.md                              @lukeheath
-/handbook/business-operations/README.md                          @sampfluger88
-/handbook/business-operations/business-operations.rituals.yml    @sampfluger88
-/handbook/business-operations/Application-security.md            @lukeheath
-/handbook/business-operations/security-audits.md                 @lukeheath
-/handbook/business-operations/security-policies.md               @lukeheath
-/handbook/business-operations/security.md                        @lukeheath
-/handbook/business-operations/vendor-questionnaires.md           @lukeheath
+/handbook/finance/README.md                          @sampfluger88
+/handbook/finance/finance.rituals.yml    @sampfluger88
+/handbook/digital-experience/application-security.md            @lukeheath
+/handbook/digital-experience/security-audits.md                 @lukeheath
+/handbook/digital-experience/security-policies.md               @lukeheath
+/handbook/digital-experience/security.md                        @lukeheath
+/handbook/digital-experience/vendor-questionnaires.md           @lukeheath
 /handbook/digital-experience                              @sampfluger88
 /handbook/customer-success                                @sampfluger88
 /handbook/demand                                          @sampfluger88
@@ -137,43 +127,7 @@ go.mod @fleetdm/go
 ##############################################################################################
 # 🚀 GitHub workflows
 ##############################################################################################
-/.github/workflows/README.md @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/goreleaser-fleet.yaml @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/update-certs.yml @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/codeql-analysis.yml @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/codeql.yml @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/scorecards-analysis.yml @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/integration.yml @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/fleetctl-preview.yml @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/fleetctl-preview-latest.yml @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/goreleaser-orbit.yaml @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/trivy-scan.yml @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/goreleaser-snapshot-fleet.yaml @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/build-and-push-fleetctl-docker.yml @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/fleetd-tuf.yml @lucasmrod @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/generate-desktop-targets.yml @lucasmrod @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/test-yml-specs.yml @lucasmrod @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/build-binaries.yaml @lucasmrod @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/fleet-and-orbit.yml @lucasmrod @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/build-orbit.yaml @lucasmrod @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/generate-osqueryd-targets.yml @lucasmrod @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/test-packaging.yml @lucasmrod @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/release-helm.yaml @rfairburn @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/pr-helm.yaml @rfairburn @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/tfvalidate.yml @rfairburn @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/dogfood-deploy.yml @rfairburn @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/test-db-changes.yml @roperzh @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/test-go.yaml @roperzh @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/golangci-lint.yml @roperzh @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/test-native-tooling-packaging.yml @roperzh @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/check-tuf-timestamps.yml @roperzh @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/test-puppet.yml @roperzh @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/generate-nudge-targets.yml @roperzh @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/test-js.yml @ghernandez345 @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/dogfood-gitops.yml @getvictor @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/test-fleetd-chrome.yml @getvictor @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/release-fleetd-chrome.yml @getvictor @lukeheath @georgekarrv @sharon-fdm
-/.github/workflows/release-fleetd-chrome-beta.yml @getvictor @lukeheath @georgekarrv @sharon-fdm
+/.github/workflows/ @lukeheath @georgekarrv @sharon-fdm
 
 # ℹ️ But wait, there's more!
 # See the comments up top to learn where else DRIs and maintainers are configured.
diff --git a/Dockerfile-desktop-linux b/Dockerfile-desktop-linux
index b0ff52c050..c17d3894d0 100644
--- a/Dockerfile-desktop-linux
+++ b/Dockerfile-desktop-linux
@@ -1,4 +1,4 @@
-FROM --platform=linux/amd64 golang:1.22.4-bullseye@sha256:067c5c7fe6d79f900c5ebe8351166356d6e3bbfcc6f807030e89b9a929252273
+FROM --platform=linux/amd64 golang:1.23.1-bullseye@sha256:45b43371f21ec51276118e6806a22cbb0bca087ddd54c491fdc7149be01035d5
 LABEL maintainer="Fleet Developers"
 
 RUN mkdir -p /usr/src/fleet
diff --git a/Dockerfile.osquery-perf b/Dockerfile.osquery-perf
deleted file mode 100644
index 89331d9312..0000000000
--- a/Dockerfile.osquery-perf
+++ /dev/null
@@ -1,16 +0,0 @@
-FROM golang:1.22.4-alpine3.20@sha256:ace6cc3fe58d0c7b12303c57afe6d6724851152df55e08057b43990b927ad5e8 
-
-ARG ENROLL_SECRET
-ARG HOST_COUNT
-ARG SERVER_URL
-
-ENV ENROLL_SECRET ${ENROLL_SECRET}
-ENV HOST_COUNT ${HOST_COUNT}
-ENV SERVER_URL ${SERVER_URL}
-
-COPY ./cmd/osquery-perf/agent.go ./go.mod ./go.sum ./cmd/osquery-perf/mac10.14.6.tmpl /osquery-perf/
-WORKDIR /osquery-perf/
-RUN go mod download
-RUN go build -o osquery-perf
-
-CMD ./osquery-perf -enroll_secret $ENROLL_SECRET -host_count $HOST_COUNT -server_url $SERVER_URL
diff --git a/Makefile b/Makefile
index 2e7c317baa..9e63214ebd 100644
--- a/Makefile
+++ b/Makefile
@@ -74,6 +74,7 @@ define HELP_TEXT
 	make generate-go  - Generate and bundle required go code
 	make generate-js  - Generate and bundle required js code
 	make generate-dev - Generate and bundle required code in a watch loop
+	make generate-doc - Generate updated API documentation for activities, osquery flags
 
     make clean        - Clean all build artifacts
 	make clean-assets - Clean assets only
@@ -221,6 +222,12 @@ docker-push-release: docker-build-release
 fleetctl-docker: xp-fleetctl
 	docker build -t fleetdm/fleetctl --platform=linux/amd64 -f tools/fleetctl-docker/Dockerfile .
 
+bomutils-docker:
+	cd tools/bomutils-docker && docker build -t fleetdm/bomutils --platform=linux/amd64 -f Dockerfile .
+
+wix-docker:
+	cd tools/wix-docker && docker build -t fleetdm/wix --platform=linux/amd64 -f Dockerfile .
+
 .pre-binary-bundle:
 	rm -rf build/binary-bundle
 	mkdir -p build/binary-bundle/linux
@@ -281,7 +288,7 @@ binary-arch: .pre-binary-arch .pre-binary-bundle .pre-fleet
 
 # Drop, create, and migrate the e2e test database
 e2e-reset-db:
-	docker-compose exec -T mysql_test bash -c 'echo "drop database if exists e2e; create database e2e;" | MYSQL_PWD=toor mysql -uroot'
+	docker compose exec -T mysql_test bash -c 'echo "drop database if exists e2e; create database e2e;" | MYSQL_PWD=toor mysql -uroot'
 	./build/fleet prepare db --mysql_address=localhost:3307  --mysql_username=root --mysql_password=toor --mysql_database=e2e
 
 e2e-setup:
@@ -312,7 +319,7 @@ e2e-serve-premium: e2e-reset-db
 # Usage:
 # make e2e-set-desktop-token host_id=1 token=foo
 e2e-set-desktop-token:
-	docker-compose exec -T mysql_test bash -c 'echo "INSERT INTO e2e.host_device_auth (host_id, token) VALUES ($(host_id), \"$(token)\") ON DUPLICATE KEY UPDATE token=VALUES(token)" | MYSQL_PWD=toor mysql -uroot'
+	docker compose exec -T mysql_test bash -c 'echo "INSERT INTO e2e.host_device_auth (host_id, token) VALUES ($(host_id), \"$(token)\") ON DUPLICATE KEY UPDATE token=VALUES(token)" | MYSQL_PWD=toor mysql -uroot'
 
 changelog:
 	sh -c "find changes -type f | grep -v .keep | xargs -I {} sh -c 'grep \"\S\" {}; echo' > new-CHANGELOG.md"
@@ -347,7 +354,7 @@ fleetd-tuf:
 
 # Reset the development DB
 db-reset:
-	docker-compose exec -T mysql bash -c 'echo "drop database if exists fleet; create database fleet;" | MYSQL_PWD=toor mysql -uroot'
+	docker compose exec -T mysql bash -c 'echo "drop database if exists fleet; create database fleet;" | MYSQL_PWD=toor mysql -uroot'
 	./build/fleet prepare db --dev
 
 # Back up the development DB to file
diff --git a/README.md b/README.md
index 7e8651a618..3c23f067c3 100644
--- a/README.md
+++ b/README.md
@@ -43,8 +43,6 @@ Fleet has no ambition to replace all of your other tools.  (Though it might repl
 
 Fleet plays well with Munki, Chef, Puppet, and Ansible, as well as with security tools like Crowdstrike and SentinelOne.  For example, you can use the free version of Fleet to quickly report on what hosts are _actually_ running your EDR agent.
 
-While most folks prefer to use one or the other, Fleet can also coexist peacefully with Rapid7 and other agent-based vulnerability scanners.  This can be useful during migrations.
-
 #### Free as in free
 The free version of Fleet will [always be free](https://fleetdm.com/pricing).  Fleet is [independently backed](https://linkedin.com/company/fleetdm) and actively maintained with the help of many amazing [contributors](https://github.com/fleetdm/fleet/graphs/contributors).
 
diff --git a/docs/Using Fleet/Automations.md b/articles/automations.md
similarity index 92%
rename from docs/Using Fleet/Automations.md
rename to articles/automations.md
index e124fc779e..478b870556 100644
--- a/docs/Using Fleet/Automations.md	
+++ b/articles/automations.md
@@ -40,6 +40,9 @@ Host status automations send a webhook request if a configured percentage of hos
 
 Fleet sends these webhook requests once per day by default.
 
-<meta name="pageOrderInSection" value="1509">
+<meta name="category" value="guides">
+<meta name="authorGitHubUsername" value="noahtalerman">
+<meta name="authorFullName" value="Noah Talerman">
+<meta name="publishedOn" value="2024-07-03">
+<meta name="articleTitle" value="Automations">
 <meta name="description" value="Configure Fleet automations to trigger webhooks or create tickets in Jira and Zendesk for vulnerability, policy, and host status events.">
-<meta name="navSection" value="Device management">
diff --git a/docs/Using Fleet/enroll-chromebooks.md b/articles/chrome-os.md
similarity index 85%
rename from docs/Using Fleet/enroll-chromebooks.md
rename to articles/chrome-os.md
index 2c1684cc5f..d74dfb89c1 100644
--- a/docs/Using Fleet/enroll-chromebooks.md	
+++ b/articles/chrome-os.md
@@ -1,8 +1,6 @@
 # ChromeOS
 For visibility on ChromeOS hosts, Fleet provides the fleetd Chrome extension which provides similar functionality as osquery on other operating systems.
 
-## Adding ChromeOS hosts to Fleet
-
 To learn how to add ChromeOS hosts to Fleet, visit [here](https://fleetdm.com/docs/using-fleet/adding-hosts#enroll-chromebooks).
 
 > The fleetd Chrome browser extension is supported on ChromeOS operating systems that are managed using [Google Admin](https://admin.google.com). It is not intended for non-ChromeOS hosts with the Chrome browser installed.
@@ -23,6 +21,10 @@ By default, the hostname for a Chromebook host will be blank. The hostname can b
 
 ## Debugging ChromeOS
 To learn how to debug the Fleetd Chrome extension, visit [here](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Testing-and-local-development.md#fleetd-chrome-extension).
-<meta name="title" value="Enroll Chromebooks">
-<meta name="pageOrderInSection" value="2000">
-<meta name="navSection" value="Dig deeper">
+
+<meta name="category" value="guides">
+<meta name="authorGitHubUsername" value="zhumo">
+<meta name="authorFullName" value="Mo Zhu">
+<meta name="publishedOn" value="2023-11-21">
+<meta name="articleTitle" value="ChromeOS">
+<meta name="description" value="Learn about ChromeOS and Fleet.">
diff --git a/docs/Using Fleet/CIS-Benchmarks.md b/articles/cis-benchmarks.md
similarity index 91%
rename from docs/Using Fleet/CIS-Benchmarks.md
rename to articles/cis-benchmarks.md
index 9942eb0e3c..905d62efba 100644
--- a/docs/Using Fleet/CIS-Benchmarks.md	
+++ b/articles/cis-benchmarks.md
@@ -11,7 +11,7 @@ Fleet has implemented native support for CIS Benchmarks for the following platfo
 - Windows 10 Enterprise
 - Windows 11 Enterprise
 
-[Where possible](#limitations), each CIS Benchmark is implemented with a [policy query](./REST-API.md#policies) in Fleet. 
+[Where possible](#limitations), each CIS Benchmark is implemented with a [policy query](https://fleetdm.com/docs/rest-api/rest-api#policies) in Fleet. 
 
 These benchmarks are intended to gauge your organization's security posture, rather than the current state of a given host. A host may fail a CIS Benchmark policy despite having the correct settings enabled if there is no configuration profile or Group Policy Object (GPO) in place to enforce the setting. For example, this is the query for  **CIS - Ensure FileVault Is Enabled (MDM Required)**:
 
@@ -95,7 +95,7 @@ Following are the requirements to use the CIS Benchmarks in Fleet:
 
 - Devices must be running [`fleetd`](https://fleetdm.com/docs/using-fleet/orbit), Fleet's lightweight agent.
 - Some CIS Benchmarks explicitly involve verifying MDM-based controls, so devices must be enrolled to an MDM solution.
-- On macOS, the orbit component of fleetd must have "Full Disk Access", see [Grant Full Disk Access to Osquery on macOS](./Adding-hosts.md#grant-full-disk-access-to-osquery-on-macos).
+- On macOS, the orbit component of fleetd must have "Full Disk Access", see [Grant Full Disk Access to Osquery on macOS](https://fleetdm.com/guides/enroll-hosts#grant-full-disk-access-to-osquery-on-macos).
 
 ## Limitations
 
@@ -111,7 +111,9 @@ In August 2023, we completed scale testing on 10k Windows hosts and 70k macOS ho
 
 Detailed results are [here](https://docs.google.com/document/d/1OSpyzMkHjVhG_-EIBkLu7X3hj_XfVASGl3IXIYChpck/edit?usp=sharing).
 
-<meta name="pageOrderInSection" value="1700">
-<meta name="title" value="CIS Benchmarks">
-<meta name="description" value="Read about how Fleet's implementation of CIS Benchmarks offers consensus-based cybersecurity guidance, covering macOS 13.0 Ventura & Windows Enterprise.">
-<meta name="navSection" value="Security compliance">
+<meta name="category" value="guides">
+<meta name="authorGitHubUsername" value="lucasmrod">
+<meta name="authorFullName" value="Lucas Rodriguez">
+<meta name="publishedOn" value="2024-04-02">
+<meta name="articleTitle" value="CIS Benchmarks">
+<meta name="description" value="Read about how Fleet's implementation of CIS Benchmarks offers consensus-based cybersecurity guidance.">
diff --git a/articles/configuring-default-teams-for-devices-in-fleet.md b/articles/configuring-default-teams-for-devices-in-fleet.md
new file mode 100644
index 0000000000..1b22d16424
--- /dev/null
+++ b/articles/configuring-default-teams-for-devices-in-fleet.md
@@ -0,0 +1,46 @@
+# Configuring default teams for macOS, iOS, and iPadOS devices in Fleet
+
+Fleet allows you to configure default teams for macOS, iOS, and iPadOS devices as they automatically enroll in your instance. This ensures that devices are assigned to the correct teams and receive the appropriate apps and configuration profiles at enrollment.
+
+## Why configure default teams?
+
+The ability to assign default teams during device enrollment helps streamline the deployment process. Each device is automatically placed in its correct group, ensuring it receives the necessary configuration profiles and apps without requiring manual assignment.
+
+### Configuring default teams in Fleet
+
+Follow these steps to assign default teams to your devices:
+
+1. **Navigate to automatic enrollment settings**:
+
+   - Go to **Settings > Integrations > Mobile device management (MDM)**, and locate the **Automatic enrollment** section.
+
+2. **Edit the ABM token**:
+
+   - Click **Edit** next to the ABM token for which you want to configure default teams.
+
+3. **Assign default teams**:
+
+   - In the modal, use the dropdowns to select the appropriate default team for each platform (macOS, iOS, and iPadOS).
+
+4. **Save your changes**: 
+
+   - After selecting the teams, click **Save** to apply the changes. New devices will be automatically assigned to the selected teams upon enrollment.
+
+## Benefits of configuring default teams
+
+1. **Streamlined deployment**: Devices are configured and ready for use immediately after enrollment, reducing manual setup time.
+
+2. **Reduced errors**: Automating team assignments helps avoid misconfigurations and ensures that the right profiles and apps are installed on the correct devices.
+
+## Conclusion
+
+Configuring default teams in Fleet simplifies the enrollment and management of Apple devices, ensuring that each device is assigned to the correct team immediately upon enrollment. This feature reduces manual setup tasks for IT teams by automating the assignment of configuration profiles and apps based on team specifications. By streamlining the deployment process and minimizing errors, configuring default teams ensures that devices are ready to use right out of the box, helping organizations save time and maintain consistency across their device fleet.
+
+For organizations managing a large number of macOS, iOS, or iPadOS devices, this feature plays a crucial role in automating routine tasks, increasing efficiency, and improving the overall deployment experience. It enables teams to focus on more critical tasks and be confident that newly enrolled devices are correctly configured. For more information on using Fleet, please refer to the [Fleet documentation](https://fleetdm.com/docs) and [guides](https://fleetdm.com/guides).
+
+<meta name="articleTitle" value="Configuring default teams for macOS, iOS, and iPadOS devices in Fleet">
+<meta name="authorFullName" value="JD Strong">
+<meta name="authorGitHubUsername" value="spokanemac">
+<meta name="category" value="guides">
+<meta name="publishedOn" value="2024-09-12">
+<meta name="description" value="This guide will walk you through configuring default teams for devices using the Fleet web UI.">
diff --git a/docs/Using Fleet/MDM-custom-OS-settings.md b/articles/custom-os-settings.md
similarity index 84%
rename from docs/Using Fleet/MDM-custom-OS-settings.md
rename to articles/custom-os-settings.md
index bcc30c022a..aadafc1f84 100644
--- a/docs/Using Fleet/MDM-custom-OS-settings.md	
+++ b/articles/custom-os-settings.md
@@ -1,6 +1,6 @@
 # Custom OS settings
 
-In Fleet you can enforce OS settings on your your macOS, iOS, iPadOS, and Windows hosts using configuration profiles.
+In Fleet you can enforce OS settings like security restrictions, screen lock, Wi-Fi etc., on your your macOS, iOS, iPadOS, and Windows hosts using configuration or device profiles.
 
 ## Enforce OS settings
 
@@ -36,7 +36,9 @@ In the top box, with "Verified," "Verifying," "Pending," and "Failed" statuses,
 
 In the list of hosts, click on an individual host and click the **OS settings** item to see the status for a specific setting.
 
-<meta name="pageOrderInSection" value="1505">
-<meta name="title" value="Custom OS settings">
+<meta name="category" value="guides">
+<meta name="authorGitHubUsername" value="noahtalerman">
+<meta name="authorFullName" value="Noah Talerman">
+<meta name="publishedOn" value="2024-07-27">
+<meta name="articleTitle" value="Custom OS settings">
 <meta name="description" value="Learn how to enforce custom settings on macOS and Window hosts using Fleet's configuration profiles.">
-<meta name="navSection" value="Device management">
diff --git a/articles/debunk-the-cross-platform-myth.md b/articles/debunk-the-cross-platform-myth.md
new file mode 100644
index 0000000000..80d81c919c
--- /dev/null
+++ b/articles/debunk-the-cross-platform-myth.md
@@ -0,0 +1,59 @@
+# Debunk the cross-platform myth
+
+Conventional wisdom holds that cross-platform device management is a nightmare. It’s no surprise—most solutions out there are cobbled together with bolted-on features that never quite mesh. If you’ve tried managing a mixed fleet of macOS, Windows, and Linux devices, you might have some scars to show for it. But here’s the thing: it doesn’t have to be that way. Fleet is built differently, and it’s time to debunk the myth that cross-platform management has to suck.
+
+## Cross-platform pain points
+
+The skepticism around cross-platform device management is real, and for good reason. Many IT teams have been burned by solutions that promise seamless management across different operating systems but deliver only frustration and complexity. Solutions that often leave a trail of disappointed admins in their wake, often forcing you to manage the tools more than the devices. Fleet flips that script by letting you interact directly with each operating system’s native features. Whether Apple’s macOS, Microsoft’s Windows, or various Linux distributions, Fleet provides a consistent management experience without forcing you to “talk Windows” to your Macs or vice versa.
+
+
+## Managing every OS like it’s your favorite
+
+Fleet introduces familiar concepts like custom attributes and dynamic grouping but adapts them to work with the nuances of each operating system. This means you can manage your macOS, Windows, and Linux devices without juggling multiple management platforms or dealing with convoluted workarounds. Everything is streamlined in one open-source platform, giving you direct access to the data and events from each OS.
+
+By working directly with native operating system features, Fleet ensures you don’t lose low-level control or compromise on capabilities. Instead of managing multiple MDM solutions, you can focus on managing your devices—regardless of OS.
+
+For example:
+
+* **Operating systems**: You can enforce OS updates with Declarative Device Management (DDM), Nudge, and Windows Update from one console.
+* **Automated enrollment**: Drop-ship devices to your end users with Apple Business Manager or Autopilot and let them set up their own accounts. No IT help is needed.
+* **Config management**: Manage settings with configuration profiles for Apple and device profiles for Windows. Use a canary team to test changes before they go live.
+* **App management**: Automatically keep applications and plugins secure and up-to-date. Install the software end users need or let them install it themselves via self-service.
+* **Scripts and events**: Easily manage and version control your custom script library. Execute shell and PowerShell scripts when computers drift from the baseline.
+* **Keep up with Apple**: Fleet's team and community stay current on the latest features and releases from all supported platform vendors, not just Apple.
+
+## Switching platforms is disruptive
+
+It’s understandable to be cautious about adopting a new management solution, especially if you’re concerned about the time and effort involved in switching. However, Fleet is designed with ease of transition in mind. Our platform integrates seamlessly with your existing tools and workflows, minimizing disruption. Plus, with our comprehensive documentation and responsive community support, you’ll have everything you need to get up and running quickly. Fleet’s flexible deployment options let you start small and scale at your pace, ensuring a smooth, controlled migration.
+
+![Migrate to Fleet dialog](../website/assets/images/articles/debunk-the-cross-platform-myth-600x521@2x.png "Migrate to Fleet dialog")
+
+## One platform, many possibilities
+
+Fleet isn’t just about making cross-platform management tolerable—it’s about making it genuinely effective. With Fleet, you can enforce OS updates, automate device enrollment, manage configurations, and keep applications secure, all from one place. You can also deploy Fleet yourself at any time; it’s 100% source-available, meaning you can look at the source code for how any part of it works.
+
+And because Fleet is open-source, it’s designed with flexibility and transparency in mind. You can tailor it to fit your organization’s needs, whether you’re managing a few hundred devices or tens of thousands.
+
+<blockquote purpose="quote">
+
+Mad props to how easy making a deploy pkg of the agent was. I wish everyone made stuff that easy.
+
+</blockquote>
+
+_Wes Whetstone, Staff CPE at Stripe_
+
+
+## The takeaway
+
+Cross-platform management doesn’t have to be the headache it’s been in the past. Fleet is here to simplify how you manage your devices, no matter what mix of operating systems you’re dealing with. It’s time to let go of the myth that managing different platforms means managing different tools. With Fleet, you can have everything you need in one place—without the anxiety.
+
+Ready to get started?
+
+Visit our [start page](https://fleetdm.com/start) to begin your journey.
+
+<meta name="category" value="announcements">
+<meta name="authorFullName" value="Mike McNeil">
+<meta name="authorGitHubUsername" value="mikermcneil">
+<meta name="publishedOn" value="2024-08-27">
+<meta name="articleTitle" value="Debunk the cross-platform myth">
+<meta name="description" value="Debunk the cross-platform myth with MDM">
diff --git a/articles/deploy-fleet-on-cloudgov.md b/articles/deploy-fleet-on-cloudgov.md
index c075ab6c9b..18f0c238a8 100644
--- a/articles/deploy-fleet-on-cloudgov.md
+++ b/articles/deploy-fleet-on-cloudgov.md
@@ -1,7 +1,5 @@
 # Deploy Fleet on Cloud.gov (Cloud Foundry)
 
-> **This article was archived on May 16, 2024.** Check out [Deploy Fleet](https://fleetdm.com/docs/deploy/deploy-fleet) for the most up to date deployment method.
-
 ![Deploy Fleet on Cloud.gov](../website/assets/images/articles/deploy-fleet-on-cloudgov-800x450@2x.png)
 
 Cloud.gov is a [FEDRAMP moderate Platform-as-a-Service
diff --git a/articles/deploy-security-agents.md b/articles/deploy-security-agents.md
new file mode 100644
index 0000000000..20d6cd28ab
--- /dev/null
+++ b/articles/deploy-security-agents.md
@@ -0,0 +1,97 @@
+# Deploy security agents
+
+![Deploy security agents](../website/assets/images/articles/deploy-security-agents-1600x900@2x.png)
+
+Fleet [v4.50.0](https://github.com/fleetdm/fleet/releases/tag/fleet-v4.50.0) introduced the ability to upload and deploy security agents to your hosts. Beyond a [bootstrap package](https://fleetdm.com/docs/using-fleet/mdm-macos-setup-experience#bootstrap-package) at enrollment, deploying security agents allows you to specify and verify device configuration using a pre-enrollment osquery query and customization of the install and post-install scripts, allowing for key and license deployment and configuration.  This guide will walk you through the steps to upload, configure, and install a security agent to hosts in your fleet.
+
+## Prerequisites
+
+* Fleet [v4.50.0](https://github.com/fleetdm/fleet/releases/tag/fleet-v4.50.0).
+* `fleetd` 1.25.0 deployed via MDM or built with the `--scripts-enabled` flag.
+* An S3 bucket [configured](https://fleetdm.com/docs/configuration/fleet-server-configuration#s-3-software-installers-bucket) to store the installers.
+* Increase any load balancer timeouts to at least 5 minutes for the following endpoints:
+    * [Add software](https://fleetdm.com/docs/rest-api/rest-api#add-software).
+    * [Batch-apply software](https://fleetdm.com/docs/rest-api/rest-api#add-software).
+
+## Step-by-step instructions
+
+### Access security agent installers
+
+To access and manage security agents in Fleet:
+
+* **Navigate to the Software page**: Click on the "Software" tab in the main navigation menu.
+* **Select a team**: Click on the dropdown at the top left of the page.
+* **Find your software**: using the filters on the top of the table, you can choose between:
+    * “Available for install” filters software that can be installed on your hosts.
+    * “Self-service” filters software that end users can install from Fleet Desktop.
+* **Select security agent installer**: Click on a software package to view details and access additional actions for the agent installer.
+
+### Add a security agent to a team
+
+* **Navigate to the Software page**: Click on the "Software" tab in the main navigation menu.
+* **Select a team**: Select a team or the "No team" team to add a security agent.
+
+> Security agents cannot be added to "All teams"
+
+* Click the “Add Software” button in the top right corner, and a modal will appear.
+* Choose a file to upload. `.pkg`, `.msi`, `.exe`, or `.deb` files are supported.
+* After selecting a file, a default install script will be pre-filled. If the security agent requires a custom installation process, this script can be edited.
+* To allow users to install the software from Fleet Desktop, check the “Self-service” checkbox.
+* To customize the conditions, click on “Advanced options”:
+    * **Pre-install condition**: A pre-install condition is a valid osquery SQL statement that will be evaluated on the host before installing the software. If provided, the installation will proceed only if the query returns any value.
+    * **Post-install script** A post-install script will run after the installation is complete, allowing you to configure the security agent right after installation. If this script returns a non-zero exit code, the installation will fail, and `fleetd` will attempt to uninstall the software.
+
+### Install a security agent on a host
+
+After an installer is added to a team, it can be installed on hosts via the UI.
+
+* **Navigate to the Hosts page**: Click on the "Hosts" tab in the main navigation menu.
+* **Navigate to the Host details page**: Click the host you want to install the security agent.
+* **Navigate to the Host software tab**: In the host details, search for the tab named “Software”
+* **Find your security agent**: Use the search bar and filters to search for your security agent.
+* **Install the security agent on the host**: In the leftmost row of the table, click on “Actions” > “Install.”
+* **Track installation status**: by either
+    * Checking the “Install status” in the host software table.
+    * Navigate to the “Details” tab on the host details page and check the activity log.
+
+### Edit a security agent
+
+Security agent installers can’t be edited via the UI. To modify an installer, remove it from the UI and add a new one.
+
+### Remove a security agent from a team
+
+* **Navigate to the Software page**: Click on the "Software" tab in the main navigation menu.
+* **Select a team**: Select a team or the "No team" team to add a security agent.
+* **Find your software**: using the filters on the top of the table, you can choose between:
+    * “Available for install” filters software can be installed on your hosts.
+    * “Self-service” filters software that users can install from Fleet Desktop.
+* **Select security agent installer**: Click on a software package to view details.
+* **Remove security agent installer**: From the Actions menu, select "Delete." Click the "Delete" button on the modal.
+
+> Removing a security agent from a team will not uninstall the agent from the existing host(s).
+
+### Manage security agents with the REST API
+
+Fleet also provides a REST API for managing software programmatically. The API allows you to add, update, retrieve, list, and delete software. Detailed documentation on Fleet's [REST API is available](https://fleetdm.com/docs/rest-api/rest-api#software).
+
+### Manage security agents with GitOps
+
+Installers for security agents can be managed via `fleetctl` using [GitOps](https://fleetdm.com/docs/using-fleet/gitops).
+
+Please refer to the documentation specific to [managing software with GitOps](https://fleetdm.com/docs/using-fleet/gitops#software). For a real-world example, [see how we manage software at Fleet](https://github.com/fleetdm/fleet/tree/main/it-and-security/teams).
+
+
+## Conclusion
+
+Deploying security agents with Fleet is straightforward and ensures your hosts are protected with the latest security measures. This guide has shown you how to access, add, and install security agents, as well as manage them using the REST API and `fleetctl`. Following these steps can effectively equip your fleet with the necessary security tools.
+
+See Fleet's [documentation](https://fleetdm.com/docs/using-fleet) and additional [guides](https://fleetdm.com/guides) for more details on advanced setups, software features, and vulnerability detection.
+
+
+<meta name="articleTitle" value="Deploy security agents">
+<meta name="authorFullName" value="Roberto Dip">
+<meta name="authorGitHubUsername" value="roperzh">
+<meta name="category" value="guides">
+<meta name="publishedOn" value="2024-08-05">
+<meta name="articleImageUrl" value="../website/assets/images/articles/deploy-security-agents-1600x900@2x.png">
+<meta name="description" value="This guide will walk you through adding software to Fleet.">
diff --git a/articles/discovering-chrome-ai-using-fleet.md b/articles/discovering-chrome-ai-using-fleet.md
new file mode 100644
index 0000000000..3c39b370b3
--- /dev/null
+++ b/articles/discovering-chrome-ai-using-fleet.md
@@ -0,0 +1,69 @@
+# Discovering Chrome AI using Fleet
+
+![Discovering Chrome AI using Fleet](../website/assets/images/articles/discovering-chrome-ai-using-fleet-1600x900@2x.jpg)
+
+# Discovering AI in Chrome with Fleet
+
+Staying ahead of technological innovations is crucial for individuals and organizations. Google Chrome, one of the most widely used web browsers, continually evolves to incorporate new features, including artificial intelligence (AI). This article will guide you through detecting if AI capabilities have been enabled in Chrome on macOS using Fleet.
+
+## Introduction to Chrome AI innovations
+
+Google Chrome has integrated AI to enhance user experience by providing intelligent suggestions, improving search results, and offering in-browser assistance. Visit the [Chrome AI Innovations page](https://www.google.com/chrome/ai-innovations/) for more information.
+
+## Using Fleet to discover AI features in Chrome
+
+Fleet, a comprehensive device management and security tool, allows organizations to monitor installed software configurations and enabled features on endpoints and servers. Investigating this data enables Fleet admins to build SQL queries for detection.
+
+### Step 1: Understanding Chrome's preferences JSON file
+
+On macOS, Chrome stores user settings and configurations in a JSON file at the following path:
+
+```
+/Users/<user>/Library/Application Support/Google/Chrome/Default/Preferences
+```
+
+### Step 2: Identifying AI-related settings
+
+Chrome AI-related preferences are stored in the `optimization_guide` section of the Chrome Preferences file. The `tab_organization_setting_state` key / value field will signify if AI features are enabled.
+
+`jq` is a lightweight and powerful command-line tool for parsing, filtering, and manipulating JSON data. It can extract and parse information from JSON files at specific key / value fields.
+
+In this case, `jq` is used to locate and read the value of the `tab_organization_setting_state` key within the Chrome Preferences file. This knowledge allows an admin to craft a Fleet query for reporting the state of the Chrome AI settings.
+
+- If enabled, the setting will return `1`.
+
+![Chrome settings UI with Chrome AI enabled](../website/assets/images/articles/discovering-chrome-ai-using-fleet-1-1472x370@2x.png)
+
+```
+% jq '.optimization_guide.tab_organization_setting_state'  /Users/<user>/Library/Application\ Support/Google/Chrome/Default/Preferences                                      
+1
+```
+
+- If disabled, the setting will return `2`.
+
+![Chrome settings UI with Chrome AI disabled](../website/assets/images/articles/discovering-chrome-ai-using-fleet-2-1474x276@2x.png)
+
+```
+% jq '.optimization_guide.tab_organization_setting_state'  /Users/<user>/Library/Application\ Support/Google/Chrome/Default/Preferences                                      
+2
+```
+
+### Step 3: Query the JSON file with Fleet
+
+To detect Chrome AI features in Fleet, use a SQL query like the following:
+
+```
+SELECT fullkey,path FROM parse_json WHERE path LIKE '/Users/%/Library/Application Support/Google/Chrome/Default/Preferences' AND fullkey='optimization_guide/tab_organization_setting_state';
+```
+
+### Conclusion
+
+Fleet's powerful querying abilities allow you to monitor features like these across all of your devices.
+
+<meta name="articleTitle" value="Discovering Chrome AI using Fleet">
+<meta name="authorFullName" value="Brock Walters">
+<meta name="authorGitHubUsername" value="nonpunctual">
+<meta name="category" value="guides">
+<meta name="publishedOn" value="2024-09-06">
+<meta name="articleImageUrl" value="../website/assets/images/articles/discovering-chrome-ai-using-fleet-1600x900@2x.jpg">
+<meta name="description" value="Use Fleet to detect and monitor settings enabled in Google Chrome by querying Chrome's preferences JSON file.">
diff --git a/docs/Using Fleet/downgrading-fleet.md b/articles/downgrade-fleet.md
similarity index 87%
rename from docs/Using Fleet/downgrading-fleet.md
rename to articles/downgrade-fleet.md
index 34f8fd04ff..0874e27c66 100644
--- a/docs/Using Fleet/downgrading-fleet.md	
+++ b/articles/downgrade-fleet.md
@@ -1,4 +1,4 @@
-# Downgrading from Fleet Premium
+# Downgrade from Fleet Premium
 
 Follow these steps to downgrade your Fleet instance from Fleet Premium.
 
@@ -34,8 +34,9 @@ Follow these steps to downgrade your Fleet instance from Fleet Premium.
 1. Remove your license key from your Fleet configuration. Documentation on where the license key is located in your configuration is [here](https://fleetdm.com/docs/deploying/configuration#license).
 2. Restart your Fleet server.
 
-
-
-<meta name="title" value="Downgrading Fleet">
-<meta name="navSection" value="Dig deeper">
-<meta name="pageOrderInSection" value="2000">
\ No newline at end of file
+<meta name="category" value="guides">
+<meta name="authorGitHubUsername" value="eashaw">
+<meta name="authorFullName" value="Eric Shaw">
+<meta name="publishedOn" value="2024-01-09">
+<meta name="articleTitle" value="Downgrade from Fleet Premium">
+<meta name="description" value="Learn how to downgrade from Fleet Premium.">
\ No newline at end of file
diff --git a/docs/Using Fleet/MDM-disk-encryption.md b/articles/enforce-disk-encryption.md
similarity index 76%
rename from docs/Using Fleet/MDM-disk-encryption.md
rename to articles/enforce-disk-encryption.md
index 8d8278763f..8dd2b6419f 100644
--- a/docs/Using Fleet/MDM-disk-encryption.md	
+++ b/articles/enforce-disk-encryption.md
@@ -1,4 +1,4 @@
-# Disk encryption
+# Enforce disk encryption
 
 _Available in Fleet Premium_
 
@@ -8,7 +8,9 @@ In Fleet, you can enforce disk encryption for your macOS and Windows hosts.
 
 When disk encryption is enforced, hosts’ disk encryption keys will be stored in Fleet.
 
-For Windows hosts, disk encryption is enforced on the C: volume (default system/OS drive).
+For macOS hosts that automatically enroll, disk encryption is enforced during Setup Assistant.
+
+For Windows, disk encryption is enforced on the C: volume (default system/OS drive).
 
 ## Enforce disk encryption
 
@@ -54,15 +56,13 @@ How to view the disk encryption key:
 
 ## Migrate macOS hosts
 
-When migrating macOS hosts another MDM solution, in order to complete the process of encrypting the hard drive and escrowing the key in Fleet, your end users must take action. 
+When migrating macOS hosts from another MDM solution, in order to complete the process of encrypting the hard drive and escrowing the key in Fleet, your end users must log out or restart their device.
 
-If the host already had disk encryption turned on, the user will need to input their password. 
+Share [these guided instructions](https://fleetdm.com/guides/mdm-migration#how-to-turn-on-disk-encryption) with your end users.
 
-If the host did not already have disk encryption turned on, the user will need to log out or restart their computer.
-
-Share [these guided instructions](./MDM-migration-guide.md#how-to-turn-on-disk-encryption) with your end users.
-
-<meta name="pageOrderInSection" value="1504">
-<meta name="title" value="Disk encryption">
+<meta name="category" value="guides">
+<meta name="authorGitHubUsername" value="noahtalerman">
+<meta name="authorFullName" value="Noah Talerman">
+<meta name="publishedOn" value="2024-08-14">
+<meta name="articleTitle" value="Enforce disk encryption">
 <meta name="description" value="Learn how to enforce disk encryption on macOS and Windows hosts and manage encryption keys with Fleet Premium.">
-<meta name="navSection" value="Device management">
diff --git a/docs/Using Fleet/MDM-OS-updates.md b/articles/enforce-os-updates.md
similarity index 56%
rename from docs/Using Fleet/MDM-OS-updates.md
rename to articles/enforce-os-updates.md
index 6986593c76..de3fdbc83d 100644
--- a/docs/Using Fleet/MDM-OS-updates.md	
+++ b/articles/enforce-os-updates.md
@@ -1,18 +1,14 @@
-# OS updates
+# Enforce OS updates
 
 _Available in Fleet Premium_
 
-In Fleet you can enforce OS updates on your macOS and Windows hosts remotely.
-
-## Enforce OS updates
-
-You can enforce OS updates using the Fleet UI, Fleet API, or [Fleet's GitOps workflow](https://github.com/fleetdm/fleet-gitops).
+In Fleet, you can enforce OS updates on your macOS, Windows, iOS, and iPadOS hosts remotely using the Fleet UI, Fleet API, or [Fleet's GitOps workflow](https://github.com/fleetdm/fleet-gitops).
 
 Fleet UI:
 
 1. Head to the **Controls** > **OS updates** tab.
 
-2. To enforce OS updates for macOS, select **macOS** and set a **Minimum version** and **Deadline**.
+2. To enforce OS updates for macOS, iOS, or iPadOS, select the platform and set a **Minimum version** and **Deadline**.
 
 3. For Windows, select **Windows** and set a **Deadline** and **Grace period**.
 
@@ -22,21 +18,22 @@ Fleet API: API documentation is [here](https://fleetdm.com/docs/rest-api/rest-ap
 
 ### macOS
 
-When a minimum version is enforced, the end users see a native macOS notification (DDM) once per day. Users can choose to update ahead of the deadline or schedule it for that night. 24 hours before the deadline, the notification appears hourly and ignores Do Not Disturb. One hour before the deadline, the notification appears every 30 minutes, and then every 10 minutes.   
+When a minimum version is enforced, the end users see a native macOS notification (DDM) once per day. Users can choose to update ahead of the deadline or schedule it for that night. 24 hours before the deadline, the notification appears hourly and ignores Do Not Disturb. One hour before the deadline, the notification appears every 30 minutes and then every 10 minutes.   
 
 If the host was turned off when the deadline passed, the update will be scheduled an hour after it’s turned on.
 
-### macOS (below version 14.0)
+For macOS devices that use Automated Device Enrollment (ADE), if the device is below the specified minimum version, it will be required to update to the latest [available version](#available-macos-ios-and-ipados-versions) during ADE before device setup and enrollment can proceed.
 
-End users are encouraged to update macOS (via [Nudge](https://github.com/macadmins/nudge)).
+### iOS and iPadOS
 
-![Nudge window](https://raw.githubusercontent.com/fleetdm/fleet/main/docs/images/nudge-window.png)
+End users will see a notification in their Notification Center after the deadline when a minimum version is enforced. They can’t use their iPhone or iPad until the OS update is installed.
 
-|                                      | > 1 day before deadline | < 1 day before deadline | Past deadline         |
-| ------------------------------------ | ----------------------- | ----------------------- | --------------------- |
-| Nudge window frequency               | Once a day at 8pm GMT   | Once every 2 hours      | Immediately on login  |
-| End user can defer                   | ✅                      | ✅                      | ❌                    |
-| Nudge window is dismissible          | ✅                      | ✅                      | ❌                    |
+For iOS and iPadOS devices that use Automated Device Enrollment (ADE), if the device is below the specified
+minimum version, it will be required to update to the latest [available version](#available-macos-ios-and-ipados-versions) during ADE before device setup and enrollment can proceed.
+
+### Available macOS, iOS, and iPadOS versions
+
+The Apple Software Lookup Service (available at [https://gdmf.apple.com/v2/pmv](https://gdmf.apple.com/v2/pmv)) is the official resource for obtaining a list of publicly available updates, upgrades, and Rapid Security Responses. Make sure to use versions available in GDMF; otherwise, the update will not be scheduled.
 
 ### Windows
 
@@ -50,7 +47,21 @@ If an end user was on vacation when the deadline passed, the end user is given a
 
 Fleet enforces OS updates for quality and feature updates. Read more about the types of Windows OS updates in the Microsoft documentation [here](https://learn.microsoft.com/en-us/windows/deployment/update/get-started-updates-channels-tools#types-of-updates).
 
-<meta name="pageOrderInSection" value="1503">
-<meta name="title" value="OS updates">
-<meta name="description" value="Learn how to manage OS updates on macOS and Windows devices.">
-<meta name="navSection" value="Device management">
+### macOS (below version 14.0)
+
+End users are encouraged to update macOS (via [Nudge](https://github.com/macadmins/nudge)).
+
+![Nudge window](https://raw.githubusercontent.com/fleetdm/fleet/main/docs/images/nudge-window.png)
+
+|                                      | > 1 day before deadline | < 1 day before deadline | Past deadline         |
+| ------------------------------------ | ----------------------- | ----------------------- | --------------------- |
+| Nudge window frequency               | Once a day at 8pm GMT   | Once every 2 hours      | Immediately on login  |
+| End user can defer                   | ✅                      | ✅                      | ❌                    |
+| Nudge window is dismissible          | ✅                      | ✅                      | ❌                    |
+
+<meta name="category" value="guides">
+<meta name="authorGitHubUsername" value="noahtalerman">
+<meta name="authorFullName" value="Noah Talerman">
+<meta name="publishedOn" value="2024-08-10">
+<meta name="articleTitle" value="Enforce OS updates">
+<meta name="description" value="Learn how to manage OS updates on macOS, Windows, iOS, and iPadOS devices.">
diff --git a/docs/Using Fleet/enroll-hosts.md b/articles/enroll-hosts.md
similarity index 96%
rename from docs/Using Fleet/enroll-hosts.md
rename to articles/enroll-hosts.md
index 6112eec51e..0635855596 100644
--- a/docs/Using Fleet/enroll-hosts.md	
+++ b/articles/enroll-hosts.md
@@ -1,7 +1,5 @@
 # Enroll hosts
 
-## Introduction
-
 Fleet gathers information from an [osquery](https://github.com/osquery/osquery) agent installed on each of your hosts. The recommended way to install osquery is using fleetd.
 
 You can enroll macOS, Windows or Linux hosts via the [CLI](#cli) or [UI](#ui). To learn how to enroll Chromebooks, see [Enroll Chromebooks](#enroll-chromebooks).
@@ -14,9 +12,9 @@ Fleet supports the [latest version of osquery](https://github.com/osquery/osquer
 
 > You must have `fleetctl` installed. [Learn how to install `fleetctl`](https://fleetdm.com/docs/using-fleet/fleetctl-cli#installing-fleetctl).
 
-The `fleetctl package` command is used to generate Fleet's agent (fleetd).
+The `fleetctl package` command is used to generate Fleet's agent (fleetd) install package..
 
-The `--type` flag is used to specify the fleetd installer type:
+The `--type` flag is used to specify the fleetd installer type. Note that Windows can only generate an MSI package:
 - macOS: .pkg
 - Windows: .msi
 - Linux: .deb or .rpm
@@ -39,7 +37,7 @@ To generate Fleet's agent (fleetd) in Fleet UI:
 
 1. Go to the **Hosts** page, and select **Add hosts**.
 2. Select the tab for your desired platform (e.g. macOS).
-3. A CLI command with all necessary flags will be generated. Copy and run the command with [fleetctl](https://fleetdm.com/docs/using-fleet/fleetctl-cli) installed.
+3. A CLI command with all necessary flags to generate an install package will be generated. Copy and run the command with [fleetctl](https://fleetdm.com/docs/using-fleet/fleetctl-cli) installed.
 
 ### Enroll host to a specific team
 
@@ -54,7 +52,7 @@ You can use your software management tool of choice to distribute Fleet's agent
 
 ### Fleet Desktop
 
-[Fleet Desktop](./Fleet-desktop.md) is a menu bar icon available on macOS, Windows, and Linux that gives your end users visibility into the security posture of their machine.
+[Fleet Desktop](https://fleetdm.com/guides/fleet-desktop) is a menu bar icon available on macOS, Windows, and Linux that gives your end users visibility into the security posture of their machine.
 
 You can include Fleet Desktop in Fleet's agent (fleetd) by including `--fleet-desktop` in the `fleetctl package` command.
 
@@ -379,6 +377,9 @@ but can result in a large volume of error logs. In fleetd v1.15.1, we added an e
 Applying the environmental variable `"FLEETD_SILENCE_ENROLL_ERROR"=1` on a host will silence fleetd enrollment errors if a `--fleet-url` is not present.
 This variable is read at launch and will require a restart of the Orbit service if it is not set before installing `fleetd` v1.15.1.
 
-<meta name="pageOrderInSection" value="500">
+<meta name="category" value="guides">
+<meta name="authorGitHubUsername" value="noahtalerman">
+<meta name="authorFullName" value="Noah Talerman">
+<meta name="publishedOn" value="2024-08-08">
+<meta name="articleTitle" value="Enroll hosts">
 <meta name="description" value="Learn how to enroll hosts to Fleet.">
-<meta name="navSection" value="The basics">
diff --git a/articles/filtering-software-by-vulnerability.md b/articles/filtering-software-by-vulnerability.md
new file mode 100644
index 0000000000..8c8326bbc6
--- /dev/null
+++ b/articles/filtering-software-by-vulnerability.md
@@ -0,0 +1,44 @@
+# Filtering software by vulnerability in Fleet
+
+![Filtering software by vulnerability in Fleet](../website/assets/images/articles/discovering-geacon-using-fleet-1600x900@2x.jpg)
+
+## Introduction
+
+Fleet has introduced a powerful new feature that allows you to filter software by its associated vulnerabilities, helping you prioritize patches more effectively. Whether you're managing hundreds or thousands of software titles, this feature makes it easier to identify and address the most critical vulnerabilities in your environment.
+
+This filtering capability is particularly useful in environments where patch management is critical to your security posture. By filtering software based on vulnerability severity and known exploits, you can first ensure that the most critical issues are addressed, enhancing your overall security strategy.
+
+## Prerequisites
+
+* Fleet version 4.56 or later
+* Premium users have access to advanced filters by severity level and known exploited vulnerabilities
+
+### Filtering Software by Vulnerability
+
+1. **Navigate to the Software page**: In your Fleet dashboard, go to the **Software** tab. This will display a list of all the software detected in your environment.
+
+2. **Add filters**: Click on the **Add Filters** button. This will open options for filtering the software list based on specific criteria.
+
+3. **Choose severity level**: From the dropdown menu, select the **Severity level** of vulnerabilities you're interested in. This allows you to focus on software with the highest severity of vulnerabilities, such as "Critical" or "High."
+
+4. **Toggle "Has known exploit"**: You can refine your filter by toggling the **Has known exploit** option. This will filter the software list to show only those with vulnerabilities that have known exploits, enabling you to prioritize these for patching.
+
+5. **Review filtered results**: Once you've applied your filters, the software list will update to show only the software that meets your criteria. This filtered view will help you prioritize which software needs immediate attention in your patching strategy.
+
+### Using the REST API to filter software for vulnerabilities
+
+Fleet provides a REST API to filter software for vulnerabilities, allowing you to integrate this functionality into your automated workflows. Learn more about Fleet's [REST API](https://fleetdm.com/docs/rest-api/rest-api#vulnerabilities).
+
+## Conclusion
+
+The new software filtering feature in Fleet makes it easier than ever to manage vulnerabilities in your software environment. You can better protect your organization from potential threats by prioritizing patches based on severity and known exploits. Explore the API capabilities to integrate this feature into your broader security workflows.
+
+For more tips and detailed guides, don’t forget to check out the Fleet [documentation](https://fleetdm.com/docs/get-started/why-fleet).
+
+<meta name="articleTitle" value="Filtering software by vulnerability in Fleet">
+<meta name="authorFullName" value="Tim Lee">
+<meta name="authorGitHubUsername" value="mostlikelee">
+<meta name="category" value="guides">
+<meta name="publishedOn" value="2024-08-30">
+<meta name="articleImageUrl" value="../website/assets/images/articles/discovering-geacon-using-fleet-1600x900@2x.jpg">
+<meta name="description" value="Filter software by vulnerability in Fleet to prioritize critical patches and enhance your organization's security posture.">
diff --git a/articles/fleet-4.55.0.md b/articles/fleet-4.55.0.md
new file mode 100644
index 0000000000..309e0e70df
--- /dev/null
+++ b/articles/fleet-4.55.0.md
@@ -0,0 +1,132 @@
+# Fleet 4.55.0 | MySQL 8, arm64 support, FileVault improvements, VPP support.
+
+![Fleet 4.55.0](../website/assets/images/articles/fleet-4.55.0-1600x900@2x.png)
+
+Fleet 4.55.0 is live. Check out the full [changelog](https://github.com/fleetdm/fleet/releases/tag/fleet-v4.55.0) or continue reading to get the highlights.
+For upgrade instructions, see our [upgrade guide](https://fleetdm.com/docs/deploying/upgrading-fleet) in the Fleet docs.
+
+## Highlights
+
+* MySQL 8 support, MySQL 5.7 sunsets
+* FileVault key rotation with Escrow Buddy
+* FileVault enforcement at enrollment
+* Arm64 support
+* VPP app support for macOS
+* "No team" software support
+
+### MySQL 8 support, MySQL 5.7 sunsets
+
+Fleet has updated its database compatibility by adding support for MySQL 8, while simultaneously dropping support for MySQL 5.7. This change aligns Fleet with the latest advancements in database technology, offering enhanced performance, security, and features available in MySQL 8. Organizations using Fleet are encouraged to upgrade their database systems to MySQL 8 to take full advantage of these improvements. By focusing on the latest supported versions, Fleet ensures that its platform remains robust, secure, and well-equipped to handle the demands of modern IT environments while phasing out older versions that may not provide the same level of performance or security.
+
+### FileVault key rotation with Escrow Buddy
+
+Fleet now includes support for FileVault key rotation using [Escrow Buddy](https://github.com/macadmins/escrow-buddy), a tool developed by the Netflix Client Systems Engineering team for the MacAdmins community to securely manage and rotate FileVault recovery keys on macOS devices. This feature allows IT administrators to automate the process of rotating FileVault keys, ensuring that encrypted macOS hosts remain secure while maintaining access control. By integrating with Escrow Buddy, Fleet enables seamless key management, reducing the administrative burden of manually rotating keys and enhancing the overall security posture of macOS environments. This update reflects Fleet's commitment to providing robust security tools that integrate with trusted community resources, ensuring organizations can efficiently manage device encryption and recovery processes.
+
+### FileVault enforcement at enrollment
+
+Fleet now supports enforcing FileVault encryption during the enrollment process for macOS devices, ensuring that all newly enrolled Macs are automatically encrypted. This feature enhances security by mandating that FileVault is enabled as part of the initial device setup, reducing the risk of unencrypted data on managed endpoints. By integrating FileVault enforcement into the enrollment workflow, Fleet helps organizations maintain a consistent security posture across their macOS fleet, ensuring compliance with internal policies and regulatory requirements. This update underscores Fleet's commitment to providing comprehensive security management tools that protect sensitive data and simplify the administration of macOS devices.
+
+### Arm64 support
+
+Fleet now includes support for Linux hosts running on the arm64 architecture. This update enables organizations to integrate a broader range of devices into their Fleet management system, ensuring comprehensive oversight and control across diverse hardware environments. By supporting arm64 Linux hosts, Fleet caters to the growing use of ARM-based systems in various sectors, allowing IT administrators to manage these devices with the same level of detail and efficiency as traditional x86-based hosts. This aligns with Fleet's commitment to providing versatile and inclusive device management solutions, empowering users to maintain a unified and efficient IT infrastructure.
+
+### VPP app support for macOS
+
+Fleet now supports installing Volume Purchase Program (VPP) apps from the Apple App Store on macOS devices. This feature enables IT administrators to deploy and manage apps purchased through Apple's VPP directly to macOS hosts, streamlining the process of distributing essential software across the organization. By integrating VPP app installations into Fleet, organizations can ensure that licensed applications are efficiently deployed to the appropriate devices, improving software management and compliance. This update enhances Fleet's capabilities in managing macOS environments, offering a more seamless and centralized approach to app distribution for enterprise and educational settings.
+
+### "No team" software support
+
+Fleet now supports adding software to the "No team" team, providing greater flexibility in managing software across an organization's devices. This feature allows administrators to deploy and manage software that applies universally without being restricted to specific teams. By adding software to the "No team" team, IT teams can ensure that essential tools and applications are available across all devices, regardless of their team assignment. This update simplifies the management of widely used software and enhances the ability to maintain consistency and compliance across the entire fleet. It reflects Fleet's commitment to offering versatile solutions that cater to diverse organizational needs and streamline device management processes.
+
+## Changes
+
+**NOTE:** Beginning with v4.55.0, Fleet no longer supports MySQL 5.7 because it has reached [end of life](https://mattermost.com/blog/mysql-5-7-reached-eol-upgrade-to-mysql-8-x-today/#:~:text=In%20October%202023%2C%20MySQL%205.7,to%20upgrade%20to%20MySQL%208.). The minimum version supported is MySQL 8.0.36.
+
+### Endpoint Operations
+
+- Added support for generating `fleetd` packages for Linux ARM64.
+- Added new `fleetctl package` --arch flag.
+- Updated `fleetctl package` command to remove the `--version` flag. The version of the package can be controlled by `--orbit-channel` flag.
+- Updated maintenance window descriptions to update regularly to match the failing policy description/resolution.
+- Updated maintenance windows using Google Calendar so that calendar events are now recreated within 30 seconds if deleted or moved to the past.
+  - Fleet server watches for potential changes for up to 1 week after original event time. If event is moved forward more than 1 week, then after 1 week Fleet server will check for event changes once every 30 minutes.
+  - **NOTE:** These near real-time updates may add additional load to the Google Calendar API, so it is recommended to use API usage alerts or other monitoring methods.
+
+### Device Management
+
+- Integrated [Escrow Buddy](https://github.com/macadmins/escrow-buddy) to add enforcement of FileVault during the MacOS Setup Assistant process for hosts that are 
+enrolled into teams (or no team) with disk encryption turned on. Thank you homebysix and team!
+- Added OS updates support to iOS/iPadOS devices.
+- Added iOS and iPadOS device details refetch triggered with the existing `POST /api/latest/fleet/hosts/:id/refetch` endpoint.
+- Added iOS and iPadOS user-installed apps to Fleet.
+- Added iOS and iPadOS apps to be installed using Apple's VPP (Volume Purchase Program) to Fleet.
+- Added support for VPP to GitOps.
+- Added the `POST /mdm/apple/vpp_token`, `DELETE /mdm/apple/vpp_token` and `GET /vpp` endpoints and related functionality.
+- Added new `GET /software/app_store_apps` and `POST /software/app_store_apps` endpoints and associated functionality.
+- Added the associated VPP apps to the `GET /software/titles` and `GET /software/titles/:id` endpoints.
+- Added the associated VPP apps to the `GET /hosts/:id/software` and `GET /device/:token/software` endpoints.
+- Added support to delete a VPP app from a team in `DELETE /software/titles/:software_title_id/available_for_install`.
+- Added `exclude_software` query parameter to "Get host by identifier" API.
+- Added ability to add/remove/disable apps with VPP in the Fleet UI.
+- Added a warning banner to the UI if the uploaded VPP token is about to expire/has expired.
+- Added UI updates for VPP feature on host software and my device pages.
+- Added global activity support for VPP-related activities.
+- Added UI features for managing VPP apps for iPadOS and iOS hosts.
+- Updated profile activities to include iOS and iPadOS.
+- Updated Fleet UI to show OS version compliance on host details page.
+- Added support for "No teams" on all software pages including adding software installers.
+- Added DB migration to support VPP software features.
+- Added DB migration to migrate older team configurations to the new version that includes both installers and App Store apps.
+- Linux lock/unlock scripts now make use of pam_nologin to keep AD users locked out.
+- Installed software list now includes Linux .deb packages that are 'on hold'.
+- Added a special-case to properly name the Notion .exe Windows installer the same as how it will be reported by osquery post-install.
+- Increased threshold to renew Apple SCEP certificates for MDM enrollments to 180 days.
+
+### Vulnerability Management
+
+- Fixed CVEs identified as 'Rejected' in NVD not matching against software.
+- Fixed false negative vulnerabilities with IntelliJ IDEA CE and PyCharm CE installed via Homebrew.
+
+### Bug fixes and improvements
+
+- Dropped support for MySQL 5.7 and raised minimum required to MySQL 8.0.36.
+- Updated software pre-install to use new GitOps format for query.
+- Updated UI tooltips for pending OS settings.
+- Added a migration to migrate older team configurations to the new version that includes both installers and App Store apps.
+- Fixed a styling issue in the controls > OS settings > disk encryption table.
+- Fixed a bug in `fleetctl preview` that was causing it to fail if Docker was installed without support for the deprecated `docker-compose` CLI.
+- Fixed an issue where the app-wide warning banners were not showing on the initial page load.
+- Fixed a bug where the hosts page would sometimes allow excess pagination.
+- Fixed a bug where software install results could not be retrieved for deleted hosts in the activity feed.
+- Fixed path that was incorrect for the download software installer package endpoint `GET /software/titles/:software_title_id/package`.
+- Fixed a bug that set `last_enrolled_at` during orbit re-enrollment, which caused osquery enroll failures when `FLEET_OSQUERY_ENROLL_COOLDOWN` is set.
+- Fixed the "Available for install" filter in the host's software page so that installers that were requested to be installed on the host (regardless of installation status) also show up in the list.
+- Fixed a bug where Fleet google calendar events generated by Fleet <= 4.53.0 were not correctly processed by 4.54.0.
+- Fixed a bug in `fleetctl preview` that was causing it to fail if Docker was installed without support for the deprecated `docker-compose` CLI.
+- Fixed a bug where software install results could not be retrieved for deleted hosts in the activity feed.
+- Fixed a bug where a software installer (a package or a VPP app) that has been installed on a host still shows up as "Available for install" and can still be requested to be installed after the host is transferred to a different team without that installer (or after the installer is deleted).
+- Fixed the "Available for install" filter in the host's software page so that installers that were requested to be installed on the host (regardless of installation status) also show up in the list.
+
+## Fleet 4.54.1 (Jul 24, 2024)
+
+### Bug fixes
+- Fixed a startup bug by performing an early restart of orbit if an agent options setting has changed.
+- Implemented a small refactor of orbit subsystems.
+- Removed the `--version` flag from the `fleetctl package` command. The version of the package can now be controlled by the `--orbit-channel` flag.
+- Fixed a bug that set `last_enrolled_at` during orbit re-enrollment, which caused osquery enroll failures when `FLEET_OSQUERY_ENROLL_COOLDOWN` is set .
+- In `fleetctl package` command, removed the `--version` flag. The version of the package can be controlled by `--orbit-channel` flag.
+- Fixed a bug where Fleet google calendar events generated by Fleet <= 4.53.0 were not correctly processed by 4.54.0.
+- Re-enabled cached logins after windows Unlock.
+
+
+
+## Ready to upgrade?
+
+Visit our [Upgrade guide](https://fleetdm.com/docs/deploying/upgrading-fleet) in the Fleet docs for instructions on updating to Fleet 4.55.0.
+
+<meta name="category" value="releases">
+<meta name="authorFullName" value="JD Strong">
+<meta name="authorGitHubUsername" value="spokanemac">
+<meta name="publishedOn" value="2024-08-09">
+<meta name="articleTitle" value="Fleet 4.55.0 | MySQL 8, arm64 support, FileVault improvements, VPP support.">
+<meta name="articleImageUrl" value="../website/assets/images/articles/fleet-4.55.0-1600x900@2x.png">
diff --git a/articles/fleet-4.56.0.md b/articles/fleet-4.56.0.md
new file mode 100644
index 0000000000..14089ad9d6
--- /dev/null
+++ b/articles/fleet-4.56.0.md
@@ -0,0 +1,153 @@
+# Fleet 4.56.0 | Enhanced MDM migration, Exact CVE Search, and Self-Service VPP Apps.
+
+![Fleet 4.56.0](../website/assets/images/articles/fleet-4.56.0-1600x900@2x.png)
+
+Fleet 4.56.0 is live. Check out the full [changelog](https://github.com/fleetdm/fleet/releases/tag/fleet-v4.56.0) or continue reading to get the highlights.
+For upgrade instructions, see our [upgrade guide](https://fleetdm.com/docs/deploying/upgrading-fleet) in the Fleet docs.
+
+## Highlights
+* Improved end-user MDM migration
+* Enforce minimum OS version for MDM enrollment
+* Exact match CVE search
+* Software vulnerabilities severity filter
+* Self-service VPP apps
+* Multiple ABM and VPP support
+
+
+### Improved end-user MDM migration
+
+Fleet has improved the end-user MDM migration workflow on macOS by enabling the migration of hosts manually enrolled in a third-party MDM over to Fleet MDM using the Fleet Desktop application. Previously, this capability was limited to hosts enrolled through Apple's Automated Device Enrollment (ADE), but with this update, manually enrolled hosts can now be seamlessly migrated to Fleet MDM. This feature is specifically available for macOS Sonoma devices (macOS 14 or greater). It makes the migration process more flexible and accessible for organizations looking to centralize their MDM management under Fleet. This enhancement simplifies the transition to Fleet MDM for a broader range of macOS devices, ensuring that all hosts can be managed consistently and securely.
+
+
+### Enforce minimum OS version for MDM enrollment
+
+Fleet now enforces a minimum operating system (OS) requirement for macOS devices before they can be enrolled into Fleet's MDM. This feature ensures that only devices running a specified minimum macOS version can be enrolled, helping organizations maintain a consistent security and compliance baseline across their fleet. By setting a minimum OS requirement, Fleet prevents older, potentially less secure macOS versions from being managed under its MDM, thereby reducing vulnerabilities and ensuring all enrolled devices meet the organization's standards. This update enhances Fleet's ability to enforce security policies from the outset, ensuring that all devices in the fleet are up-to-date and capable of supporting the latest security and management features.
+
+
+### Exact match CVE search
+
+Fleet has enhanced its CVE (Common Vulnerabilities and Exposures) search functionality by introducing exact match searching, allowing users to quickly and accurately find specific vulnerabilities across their fleet. This improvement ensures that security teams can pinpoint the exact CVE they are investigating without sifting through irrelevant results, streamlining the vulnerability management process. Additionally, Fleet provides better context in cases where no results are found, helping users understand why a particular CVE might not be present in their environment. This update improves the overall user experience in vulnerability management, making it easier to maintain security and compliance across all managed devices.
+
+
+### Software vulnerabilities severity filter
+
+Fleet has introduced improved filtering capabilities for vulnerable software, allowing users to filter vulnerabilities by severity level. This enhancement enables security teams to prioritize their response efforts by focusing on the most critical vulnerabilities, ensuring that the highest-risk issues are promptly addressed. By providing a straightforward and efficient way to filter vulnerable software based on severity, Fleet helps organizations streamline their vulnerability management processes, reducing the risk of security incidents. This update aligns with Fleet's commitment to providing powerful tools that enhance the efficiency and effectiveness of security operations across all managed devices.
+
+
+### Self-Service Apple App Store apps
+
+Fleet enables organizations to assign and install Apple App Store apps purchased through the Volume Purchase Program (VPP) directly via Self-Service using Fleet Desktop. This new feature allows IT administrators to make VPP-purchased apps available to end users seamlessly and flexibly. By integrating VPP app distribution into the Fleet Desktop Self-Service portal, organizations can streamline the deployment of essential software across their macOS devices, ensuring that users have easy access to the tools they need while maintaining control over software distribution. This update enhances the overall user experience and operational efficiency, empowering end users to install approved applications with minimal IT intervention.
+
+
+### Multiple Apple Business Manager and VPP support
+
+Fleet now enables administrators to add and manage multiple Apple Business Manager (ABM) and Volume Purchase Program (VPP) tokens within a single Fleet instance. This feature is designed for both Managed Service Providers (MSPs) and large enterprises, allowing them to create separate automatic enrollment and App Store app workflows for different clients or divisions, each with their own ABM and VPP tokens. Whether you’re managing devices for multiple customers or supporting large organizations with distinct divisions, this update simplifies the process of handling macOS, iOS, and iPadOS devices. With support for multiple ABM and VPP connections, Fleet streamlines software and device management across varied environments, providing a scalable solution for both MSPs and enterprises looking to centralize control while maintaining flexibility for different user groups.
+
+
+## Changes
+
+**NOTE:** Beginning with Fleet v4.55.0, Fleet no longer supports MySQL 5.7 because it has reached [end of life](https://mattermost.com/blog/mysql-5-7-reached-eol-upgrade-to-mysql-8-x-today/#:~:text=In%20October%202023%2C%20MySQL%205.7,to%20upgrade%20to%20MySQL%208.). The minimum version supported is MySQL 8.0.36.
+
+## Fleet 4.56.0 (Sep 7, 2024)
+
+### Endpoint operations
+
+- Added index to `query_results` DB table to speed up finding last query timestamp for a given query and host.
+- Added a link in the UI to the error message when a CSR can't be downloaded due to missing private key.
+- Added a disabled overlay to the Other Workflows modal on the policy page.
+- Improved performance of live queries to accommodate for higher volumes when utilizing zero-trust workflows.
+- Improved `fleetctl` gitops error message when trying to change team name to a team that already exists.
+
+### Device management
+
+- Added server support for multiple VPP tokens.
+- Added new endpoints and updated existing endpoints for managing multiple Apple Business Manager tokens.
+- Added support for S3 to store MDM bootstrap packages (uses the same bucket configuration as for software installers).
+- Added support to UI for self service VPP software.
+- Added backend and gitops support for self service VPP.
+- Added ability for MDM migrations if the host is manually enrolled to a 3rd party MDM.
+- Added an offline screen to the macOS MDM migration flow.
+- Added new ABM page to Fleet UI.
+- Added new VPP page to the fleet UI
+- Added support to track the Apple Business Manager "terms expired" API error per token, as well as a global flag that gets set as soon as one token has its terms expired.
+- Updated the instructions on "My device" for MDM migrations on pre-Sonoma macOS hosts.
+- Updated to allow multiple teams to be assigned to the same VPP Token.
+- Updated process so that deleting installed software or VPP app now makes it available for re-installation.
+- Updated to enforce minimum OS version settings during Apple Automated Device Enrollment (ADE).
+- Updated ABM ingestion so that deleted iOS/iPadOS host will continue to report to Fleet as long as host is in Apple Business Manager (ABM).
+- Updated so that refetching an offline iOS/iPadOS host will not add new MDM commands to the queue if previous refetch has not completed yet.
+- Updated UI so that downloading a software installer package now shows the browser's built-in progress bar.
+- Updated relevant documentation to include references to multiple ABM and VPP tokens.
+- Consolidated Automatic Enrollment and VPP settings under the MDM settings integration page.
+- Cleared apps associated with a VPP token if it's moved off of a team.
+
+### Vulnerability management
+
+- Added ALAS bulletins as vulnerability source for Amazon Linux (instead of OVAL for Amazon Linux 2, and adds support for Amazon Linux 1, 2022, and 2023).
+- Added matching rules for July and August Microsoft 365 security updates (https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates).
+- Added the following filters to `/software/titles` and `/software/versions` API endpoints: `exploit: bool`, `min_cvss_score: float`, `max_cvss_score: float`.
+- Updated software titles/versions tables to allow for filtering by vulnerabilities including severity and known exploit.
+- Updated to use empty CVE description when the NVD CVE feed doesn't include description entries (instead of panicking).
+- Updated matching software that is not installed by Fleet so that it shows up as 'Available for install' on host details page.
+- Updated base images of `fleetdm/fleetctl`, `fleetdm/bomutils` and `fleetdm/wix` to fix critical vulnerabilities found by Trivy.
+- Updated vulnerability scanning to use `macos` SW target for CPEs of homebrew packages.
+- Updated vulnerability scanning to not ignore software with non-ASCII en dash and em dash characters.
+- Updated `GET /api/v1/fleet/vulnerabilities/{cve}` endpoint to add validation of CVE format, and a 204 response. The 204 response indicates that the vulnerability is known to Fleet but not present on any hosts.
+- Updated the UI to add new empty states for searching vulnerabilities: invalid CVE format searched, a known CVE serached but not present on hosts, not a known CVE searched, exploited vulnerability empty state, operating systems empty state, new icons.
+
+### Bug fixes and improvements
+
+- Added support for MySQL 8.4.2 LTS.
+- Updated Go to go1.22.6.
+- Updated Fleet server to now accept arguments via stdin. This is useful for passing secrets that you don't want to expose as env vars, in the command line, or in the config file.
+- Updated text for "Turn on MDM" banners in UI.
+- Updated ABM host tooltip copy on the manage host page to clarify when host vitals will be available to view.
+- Updated copy on auotmatic enrollment modal on my device page.
+- Updated host details activities tooltip and empty state copy to reflect recently added capabilities.
+- Updated Fleet Free so users see a Premium feature message when clicking to add software.
+- Updated usage reporting to report statistics on new AI features, maintenance window, and `fleetd`.
+- Fixed bug where configuration profile was still showing the old label name after the name was updated.
+- Fixed a bug when a cached prepared statement gets deleted in the MySQL server itself without Fleet knowing.
+- Fixed a bug where the wrong API path was used to download a software installer.
+- Fixed the failing_host_count so it is never 0. This count is normally updated once an hour during cleanups_then_aggregation cron job.
+- Fixed CVE-2024-4030 in Vulncheck feed incorrectly targeting non-Windows hosts.
+- Fixed a bug where the "Self-service" filter for the list of software and the list of host's software did not take App Store apps into account.
+- Fixed a bug where the "My device" page in Fleet Desktop did not show the self-service software tab when App Store apps were available as self-install.
+- Fixed a bug where a software installer (a package or a VPP app) that has been installed on a host still shows up as "Available for install" and can still be requested to be installed after the host is transferred to a different team without that installer (or after the installer is deleted).
+- Fixed the "Available for install" filter in the host's software page so that installers that were requested to be installed on the host (regardless of installation status) also show up in the list.
+- Fixed UI popup messages bleeding off viewport in some cases.
+- Fixed an issue with the scheduling of cron jobs at startup if the job has never run, which caused it to be delayed.
+- Fixed UI to display the label names in case-insensitive alphabetical order.
+
+## Fleet 4.55.2 (Sep 05, 2024)
+
+### Bug fixes
+
+* Removed validation of APNS certificate from server startup. This was no longer necessary because we now allow for APNS certificates to be renewed in the UI.
+* Fixed logic to properly catch and log APNs errors.
+
+## Fleet 4.55.1 (Aug 14, 2024)
+
+### Bug fixes
+
+* Added a disabled overlay to the Other Workflows modal on the policy page.
+* Updated text for "Turn on MDM" banners in UI.
+* Fixed a bug when a cached prepared statement got deleted in the MySQL server itself without Fleet knowing.
+* Continued with an empty CVE description when the NVD CVE feed didn't include description entries (instead of panicking).
+* Scheduled maintenance events are now scheduled over calendar events marked "Free" (not busy) in Google Calendar.
+* Fixed a bug where the wrong API path was used to download a software installer.
+* Improved fleetctl gitops error message when trying to change team name to a team that already exists.
+* Updated ABM (Apple Business Manager) host tooltip copy on the manage host page to clarify when host vitals will be available to view.
+* Added index to query_results DB table to speed up finding the last query timestamp for a given query and host.
+* Displayed the label names in case-insensitive alphabetical order in the fleet UI.
+
+## Ready to upgrade?
+
+Visit our [Upgrade guide](https://fleetdm.com/docs/deploying/upgrading-fleet) in the Fleet docs for instructions on updating to Fleet 4.56.0.
+
+<meta name="category" value="releases">
+<meta name="authorFullName" value="JD Strong">
+<meta name="authorGitHubUsername" value="spokanemac">
+<meta name="publishedOn" value="2024-09-07">
+<meta name="articleTitle" value="Fleet 4.56.0 | Enhanced MDM migration, Exact CVE Search, and Self-Service VPP Apps.">
+<meta name="articleImageUrl" value="../website/assets/images/articles/fleet-4.56.0-1600x900@2x.png">
diff --git a/docs/Using Fleet/Fleet-desktop.md b/articles/fleet-desktop.md
similarity index 84%
rename from docs/Using Fleet/Fleet-desktop.md
rename to articles/fleet-desktop.md
index b4696943db..c0b1b0e574 100644
--- a/docs/Using Fleet/Fleet-desktop.md	
+++ b/articles/fleet-desktop.md
@@ -1,12 +1,7 @@
 # Fleet Desktop
-- [Installing Fleet Desktop](#installing-fleet-desktop)
-- [Upgrading Fleet Desktop](#upgrading-fleet-desktop)
-- [Custom Transparency Link](#custom-transparency-link)
-- [Securing Fleet Desktop](#securing-fleet-desktop)
 
-Fleet Desktop is a menu bar icon available on macOS, Windows, and Linux.
+Fleet Desktop is a menu bar icon available on macOS, Windows, and Linux that gives your end users visibility into the security posture of their machine. This unlocks two key benefits:
 
-At its core, Fleet Desktop gives your end users visibility into the security posture of their machine. This unlocks two key benefits:
 * Self-remediation: end users can see which policies they are failing and resolution steps, reducing the need for IT and security teams to intervene
 * Scope transparency: end users can see what the Fleet agent can do on their machines, eliminating ambiguity between end users and their IT and security teams
 
@@ -16,10 +11,10 @@ At its core, Fleet Desktop gives your end users visibility into the security pos
    <iframe src="https://www.youtube.com/embed/cI2vDG3PbVo" allowfullscreen></iframe>
 </div>
 
-## Installing Fleet Desktop
+## Install Fleet Desktop
 For information on how to install Fleet Desktop, visit: [Adding Hosts](https://fleetdm.com/docs/using-fleet/adding-hosts#fleet-desktop).
 
-## Upgrading Fleet Desktop
+## Upgrade Fleet Desktop
 Once installed, Fleet Desktop will be automatically updated via Fleetd. To learn more, visit: [Self-managed agent updates](https://fleetdm.com/docs/deploying/fleetctl-agent-updates#self-managed-agent-updates).
 
 ## Custom transparency link
@@ -32,7 +27,7 @@ On the settings page, go to "Organization Settings" and select "Fleet Desktop."
 
 For information on how to set the custom transparency link via a YAML configuration file, see the [configuration files](https://fleetdm.com/docs/configuration/fleet-server-configuration#fleet-desktop-settings) documentation.
 
-## Securing Fleet Desktop
+## Secure Fleet Desktop
 
 Requests sent by Fleet Desktop and the web page that opens when clicking on the "My Device" tray item use a [Random (Version 4) UUID](https://www.rfc-editor.org/rfc/rfc4122.html#section-4.4) token to uniquely identify each host.
 
@@ -57,7 +52,9 @@ As a consequence, Fleet Desktop will issue a new token if the current token is:
 
 This change is imperceptible to users, as clicking on the "My device" tray item always uses a valid token. If a user visits an address with an expired token, they will get a message instructing them to click on the tray item again.
 
-<meta name="title" value="Fleet Desktop">
-<meta name="pageOrderInSection" value="450">
+<meta name="category" value="guides">
+<meta name="authorGitHubUsername" value="zhumo">
+<meta name="authorFullName" value="Mo Zhu">
+<meta name="publishedOn" value="2024-04-19">
+<meta name="articleTitle" value="Fleet Desktop">
 <meta name="description" value="Learn about Fleet Desktop's features for self-remediation and transparency.">
-<meta name="navSection" value="The basics">
diff --git a/articles/fleet-in-your-calendar-introducing-maintenance-windows.md b/articles/fleet-in-your-calendar-introducing-maintenance-windows.md
index 534b993835..79ef934847 100644
--- a/articles/fleet-in-your-calendar-introducing-maintenance-windows.md
+++ b/articles/fleet-in-your-calendar-introducing-maintenance-windows.md
@@ -21,7 +21,7 @@ Fleet provides AI-generated explanations directly in the calendar events, detail
 ## _Maintenance windows_ include:
 
 * **Personalized scheduling:** Updates are timed based on individual calendar events, so interventions happen when they are least intrusive.
-* **Automatic rescheduling:** If a scheduled update becomes impractical—due to changes in your calendar, for example—Fleet automatically finds a new appropriate time.
+* **Rescheduling flexibility:** If a scheduled update becomes impractical for any reason, users have the option to manually move the maintenance window to a more suitable time. We suggest rescheduling within one week to ensure timely updates.
 * **Enhanced compliance:** With auto-scheduled maintenance windows, compliance with security protocols is maintained effortlessly, ensuring all devices are up to date without manual intervention.
 
 _Maintenance windows_ is a direct response to common challenges faced in workplace productivity, particularly unplanned disruptions from essential updates. Fleet aims to support smoother, more efficient work environments by incorporating user feedback and addressing these long-standing issues.
diff --git a/docs/Using Fleet/Usage-statistics.md b/articles/fleet-usage-statistics.md
similarity index 88%
rename from docs/Using Fleet/Usage-statistics.md
rename to articles/fleet-usage-statistics.md
index 28413ee174..1db24222de 100644
--- a/docs/Using Fleet/Usage-statistics.md	
+++ b/articles/fleet-usage-statistics.md
@@ -1,7 +1,9 @@
-# Usage statistics
+# Fleet usage statistics
 
 Fleet Device Management Inc. periodically collects information about your instance.
 
+> To disable usage statistics, [see here](#disable-usage-statistics).
+
 ## What is included in usage statistics in Fleet?
 
 Below is the JSON payload that is sent to Fleet Device Management Inc:
@@ -34,6 +36,11 @@ Below is the JSON payload that is sent to Fleet Device Management Inc:
   "numHostSoftwareInstalledPaths": 999,
   "numSoftwareCPEs": 999,
   "numSoftwareCVEs": 999,
+  "numHostsNotResponding": 9,
+  "aiFeaturesDisabled": true,
+  "maintenanceWindowsEnabled": true,
+  "maintenanceWindowsConfigured": true,
+  "numHostsFleetDesktopEnabled": 999,
   "hostsEnrolledByOperatingSystem": {
     "darwin": [
       {
@@ -101,8 +108,7 @@ Below is the JSON payload that is sent to Fleet Device Management Inc:
       ]
     },
     ...
-  ],
-  "numHostsNotResponding": 9
+  ]
 }
 ```
 
@@ -134,6 +140,9 @@ To disable usage statistics:
 
 3. Uncheck the "Enable usage statistics" checkbox and then select "Update settings."
 
-<meta name="pageOrderInSection" value="1100">
+<meta name="category" value="guides">
+<meta name="authorGitHubUsername" value="noahtalerman">
+<meta name="authorFullName" value="Noah Talerman">
+<meta name="publishedOn" value="2024-08-13">
+<meta name="articleTitle" value="Fleet usage statistics">
 <meta name="description" value="Learn about Fleet's usage statistics and what information is collected.">
-<meta name="navSection" value="Dig deeper">
diff --git a/docs/Using Fleet/fleetctl-CLI.md b/articles/fleetctl.md
similarity index 92%
rename from docs/Using Fleet/fleetctl-CLI.md
rename to articles/fleetctl.md
index 32b4c6724c..caa234f845 100644
--- a/docs/Using Fleet/fleetctl-CLI.md	
+++ b/articles/fleetctl.md
@@ -1,6 +1,6 @@
-# fleetctl CLI
+# fleetctl
 
-fleetctl (pronounced "Fleet control") is a CLI tool for managing Fleet from the command line. fleetctl enables a GitOps workflow with Fleet.
+fleetctl (pronounced "Fleet control") is a command line interface (CLI) tool for managing Fleet from the command line. fleetctl enables a GitOps workflow with Fleet.
 
 fleetctl also provides a quick way to work with all the data exposed by Fleet without having to use the Fleet UI or work directly with the Fleet API.
 
@@ -32,6 +32,8 @@ npm install -g fleetctl@latest
 
 Much of the functionality available in the Fleet UI is also available in `fleetctl`. You can run queries, add and remove users, generate Fleet's agent (fleetd) to add new hosts, get information about existing hosts, and more!
 
+> Note: Unless a logging infrastructure is configured on your Fleet server, osquery-related logs will be stored locally on each device. Read more [here](https://fleetdm.com/guides/log-destinations)
+
 To see the available commands you can run:
 
 ```sh
@@ -197,6 +199,9 @@ This will generate a `tar.gz` file with:
 - A file containing a set of all the errors that happened in the server during the interval of time defined by the [logging_error_retention_period](https://fleetdm.com/docs/deploying/configuration#logging-error-retention-period) configuration.
 - Files containing database-specific information.
 
-<meta name="pageOrderInSection" value="300">
+<meta name="category" value="guides">
+<meta name="authorGitHubUsername" value="noahtalerman">
+<meta name="authorFullName" value="Noah Talerman">
+<meta name="publishedOn" value="2024-07-04">
+<meta name="articleTitle" value="fleetctl">
 <meta name="description" value="Read about fleetctl, a CLI tool for managing Fleet and osquery configurations, running queries, generating Fleet's agent (fleetd) and more.">
-<meta name="navSection" value="The basics">
diff --git a/docs/Using Fleet/update-agents.md b/articles/fleetd-updates.md
similarity index 95%
rename from docs/Using Fleet/update-agents.md
rename to articles/fleetd-updates.md
index 93b61c0052..d5693eba93 100644
--- a/docs/Using Fleet/update-agents.md	
+++ b/articles/fleetd-updates.md
@@ -1,7 +1,6 @@
-# Self-managed agent updates 
+# Fleetd updates 
 
-The fleetd agent will periodically check the public Fleet update repository and update Orbit, Fleet Desktop, and/or osquery 
-if it detects a later version.
+The fleetd agent will periodically check the public Fleet update repository and update Orbit, Fleet Desktop, and/or osquery if it detects a later version.
 
 To override this behavior, users can set a channel for each component or disable updates altogether. Visit [Adding Hosts](https://fleetdm.com/docs/using-fleet/adding-hosts#fleet-desktop) to learn more.
 Alternatively, users with a Fleet Premium subscription can self-manage an update server.
@@ -160,6 +159,9 @@ fleetctl updates rotate targets
 
 After the key(s) have been rotated, publish the repository in the same fashion as any other update.
 
-<meta name="pageOrderInSection" value="400">
+<meta name="category" value="guides">
+<meta name="authorGitHubUsername" value="noahtalerman">
+<meta name="authorFullName" value="Noah Talerman">
+<meta name="publishedOn" value="2024-04-30">
+<meta name="articleTitle" value="Fleetd updates">
 <meta name="description" value="Information on how to manage and secure Fleet agent updates.">
-<meta name="navSection" value="Dig deeper">
diff --git a/articles/install-vpp-apps-on-macos-using-fleet.md b/articles/install-vpp-apps-on-macos-using-fleet.md
new file mode 100644
index 0000000000..d5f0da0137
--- /dev/null
+++ b/articles/install-vpp-apps-on-macos-using-fleet.md
@@ -0,0 +1,114 @@
+# Install App Store apps (VPP) on macOS, iOS, and iPadOS using Fleet
+
+![Install VPP apps on macOS using Fleet](../website/assets/images/articles/install-vpp-apps-on-macos-using-fleet-1600x900@2x.png)
+
+
+Fleet Premium supports the ability to add Apple App Store applications to your software library using the Volume Purchasing Program (VPP) and then install those apps on macOS, iOS, or iPadOS hosts. This guide will walk you through using this feature to add apps from your Apple Business Manager account to Fleet and install those apps on your hosts.
+
+The Volume Purchasing Program is an Apple initiative that allows organizations to purchase and distribute apps and books in bulk. This program is particularly beneficial for organizations that need to deploy multiple apps to many devices. Key benefits of VPP include:
+* **Bulk purchasing**: Purchase multiple licenses for an app in one transaction, often with volume discounts.
+* **Centralized management**: Manage and distribute purchased apps from a central location.
+* **Licensing flexibility**: Reassign app licenses as needed, ensuring efficient use of resources.
+* **Streamlined deployment**: Use Fleet to automate the installation and configuration of purchased apps on enrolled devices.
+* **Self-Service (macOS only)**: Allow users to assign licenses to their own devices as needed.
+
+By integrating VPP with Fleet, organizations can seamlessly add apps to their software library and deploy them across macOS, iOS, and iPadOS hosts, ensuring that all devices have the necessary applications installed efficiently and effectively.
+
+## Prerequisites
+* **MDM features**: to use the VPP integration, you must first enable MDM features in Fleet. See the [MDM setup guide](https://fleetdm.com/docs/using-fleet/mdm-setup) for instructions on enabling MDM features.
+* **Teams**: Apps can only be added to a specific Team. You can manage teams by selecting your avatar in the top navigation and then **Settings > Teams**. (Note: Apps can also be added to the 'No Team' team, which contains hosts not assigned to any other team.) You can control which team uses which VPP token by assigning teams to the VPP token. Each token may have multiple teams assigned to it, but each team may be assigned to only 1 token.
+
+> As of Fleet 4.55.0, there is a [known issue](https://github.com/fleetdm/fleet/issues/20686) that uninstalled or deleted VPP apps will continue to show a status of `installed`.
+
+## Accessing the VPP configuration
+
+1. **Navigate to the MDM integration settings page**: Click your avatar on the far right of the main navigation menu, and then **Settings > Integrations > "Mobile device management (MDM)"**
+
+2. **Add your VPP token**: Scroll to the "Volume Purchasing Program (VPP)" section. Click "Add VPP", and then click "Add VPP" again on the following page. Follow the directions on the modal to get your VPP token from Apple Business Manager, and then click the "Upload" button at the bottom to upload it to Fleet.
+
+3. **Edit the team assignment for the new token**: Find the token in the table of VPP tokens. Click the "Actions" dropdown, and then click "Edit teams". Use the picker to select which team(s) this VPP token should be assigned to.
+
+## Purchasing apps
+
+To add apps to Fleet, you must first purchase them through Apple Business Manager, even if they are free. This ensures that all apps are appropriately licensed and available for distribution via the Volume Purchasing Program (VPP). For detailed instructions on selecting and buying content, please refer to Apple’s documentation on [purchasing apps through Apple Business Manager](https://support.apple.com/guide/apple-business-manager/select-and-buy-content-axmc21817890/web).
+
+## Add an app to Fleet
+
+1. **Navigate to the Software page**: Click on the "Software" tab in the main navigation menu.
+
+2. **Select your team**: Click on the "All teams" dropdown in the top left of the page and select your desired team.
+
+3. **Open the "Add software" modal**: Click on the "Add software" button in the top right of the page.
+
+4. **View your available apps**: Click on the "App Store (VPP)" tab in the "Add software" modal. The modal will list the apps that you have purchased through VPP but still need to add to Fleet.
+
+5. **Add an app**: Select an app from the list. You may optionally check the "Self-Service" box at the bottom left of the modal if you wish for the software to be available for user-initiated installs. Finally, click the "Add software" button in the bottom right of the modal. The app should appear in the software list for the selected team.
+
+## Remove an app from Fleet
+
+1. **Navigate to the Software page**: Click "Software" in the main navigation menu.
+
+2. **Find the app you want to remove**: Search for the app using the search bar in the top right corner of the table.
+
+3. **Access the app's details page**: Click on the app's name in the table.
+
+4. **Remove the app**: Click on the "Actions" dropdown on the right side of the page. Click "Delete," then click "Delete" on the confirmation modal. Deleting an app will not uninstall the app from the hosts on which it was previously installed.
+
+## Installing apps on macOS, iOS, and iPadOS hosts
+
+1. **Add the host to the relevant team.**
+
+2. **Go to the host's detail page**: Click the "Hosts" tab in the main navigation menu. Filter the hosts by the team, and click the host's name to see its details page.
+
+3. **Find the app**: Click the "Software" tab on the host details page. Search for the software you added in the software table's search bar. Instead of searching, you can also filter software by clicking the **All software** dropdown and selecting **Available for install.**
+
+4. **Install the app**: Click the "Actions" dropdown on the far right of the app's entry in the
+   table. Click "Install" to trigger an install. This action will send an MDM command to the host
+   instructing it to install the app. If the host is offline, the upcoming install will show up in
+   the **Details** -> **Activity** -> **Upcoming** tab of this page. After the app is installed and
+   the host details are refetched, the app will show up as **Installed** in the **Software** tab.
+
+## Installing apps on macOS using self-service
+
+1. **Open Fleet from the host**: On the host that will be installing an application through self-service, click on the Fleet Desktop tray icon, then click **My Device**. This will open the browser to the device's page on Fleet.
+
+2. **Navigate to the self-service tab**: Click on the **Self-Service** tab under the device's details.
+
+3. **Locate the app and click install**: Scroll through the list of software to find the app you would like to install, then click the **Install** button underneath it.
+
+## Renewing an expired or expiring VPP token
+
+When one of your uploaded VPP tokens has expired or is within 30 days of expiring, you will see a warning
+banner at the top of page reminding you to renew your token. You can do this with the following steps:
+
+1. **Navigate to the MDM integration settings page**: Click your avatar on the far right of the main navigation menu, and then **Settings > Integrations > "Mobile device management (MDM)"** Scroll to the "Volume Purchasing Program (VPP)" section, and click "Edit".
+
+2. **Renew the token**: Find the VPP token that you want to renew in the table. Token status is indicated in the "Renew date" column: tokens less than 30 days from expiring will have a yellow indicator, and expired tokens will have a red indicator. Click the "Actions" dropdown for the token and then click "Renew". Follow the instructions in the modal to download a new token from Apple Business Manager and then upload the new token to Fleet.
+
+## Deleting a VPP token
+
+To remove VPP tokens from Fleet:
+
+1. **Navigate to the MDM integration settings page**: Click your avatar on the far right of the main navigation menu, and then **Settings > Integrations > "Mobile device management (MDM)"** Scroll to the "Volume Purchasing Program (VPP)" section, and click "Edit". 
+
+2. **Delete the token**: Find the VPP token that you want to delete in the table. Click the "Actions" dropdown for that token, and then click "Delete". Click "Delete" in the confirmation modal to finish deleting the token.
+
+## Managing apps with GitOps
+
+To manage App Store apps using Fleet's best practice GitOps, check out the `software` key in the GitOps reference documentation [here](https://fleetdm.com/docs/using-fleet/gitops#software).
+
+## REST API
+
+Fleet also provides a REST API for managing apps programmatically. You can add, install, and delete apps via this API and manage your organization’s VPP tokens. Learn more about Fleet's [REST API](https://fleetdm.com/docs/rest-api/rest-api).
+
+## Conclusion
+
+This feature extends Fleet's capabilities for managing macOS, iOS, and iPadOS hosts. Whether you manage your hosts' software via uploaded installers or via the App Store VPP integration, Fleet provides you with the tools you need to manage your hosts effectively.
+
+<meta name="articleTitle" value="Install VPP apps on macOS, iOS, and iPadOS using Fleet">
+<meta name="authorFullName" value="Jahziel Villasana-Espinoza">
+<meta name="authorGitHubUsername" value="jahzielv">
+<meta name="category" value="guides">
+<meta name="publishedOn" value="2024-08-12">
+<meta name="articleImageUrl" value="../website/assets/images/articles/install-vpp-apps-on-macos-using-fleet-1600x900@2x.png">
+<meta name="description" value="This guide will walk you through installing VPP apps on macOS, iOS, and iPadOS using Fleet.">
diff --git a/docs/Using Fleet/Log-destinations.md b/articles/log-destinations.md
similarity index 92%
rename from docs/Using Fleet/Log-destinations.md
rename to articles/log-destinations.md
index fb153f2589..ddec0c9b0c 100644
--- a/docs/Using Fleet/Log-destinations.md	
+++ b/articles/log-destinations.md
@@ -1,19 +1,5 @@
 # Log destinations
 
-- [Log destinations](#log-destinations)
-  - [Amazon Kinesis Data Firehose](#amazon-kinesis-data-firehose)
-  - [Snowflake](#snowflake)
-  - [Splunk](#splunk)
-  - [Amazon Kinesis Data Streams](#amazon-kinesis-data-streams)
-  - [AWS Lambda](#aws-lambda)
-  - [Google Cloud Pub/Sub](#google-cloud-pubsub)
-  - [Apache Kafka](#apache-kafka)
-  - [Stdout](#stdout)
-  - [Filesystem](#filesystem)
-  - [Sending logs outside of Fleet](#sending-logs-outside-of-fleet)
-
-This document provides a list of the supported log destinations in Fleet.
-
 Log destinations can be used in Fleet to log:
 - Osquery [status logs](https://osquery.readthedocs.io/en/stable/deployment/logging/#status-logs).
 
@@ -23,11 +9,27 @@ Log destinations can be used in Fleet to log:
 
 
 To configure each log destination, you must set the correct logging configuration options in Fleet.
+
 Check out the reference documentation for:
   - [Osquery status logging configuration options](https://fleetdm.com/docs/deploying/configuration#osquery-status-log-plugin).
   - [Osquery result logging configuration options](https://fleetdm.com/docs/deploying/configuration#osquery-result-log-plugin).
   - [Activity audit logging configuration options](https://fleetdm.com/docs/deploying/configuration#activity_audit_log_plugin).
 
+This guide provides a list of the supported log destinations in Fleet.
+
+### In this guide:
+
+- [Amazon Kinesis Data Firehose](#amazon-kinesis-data-firehose)
+- [Snowflake](#snowflake)
+- [Splunk](#splunk)
+- [Amazon Kinesis Data Streams](#amazon-kinesis-data-streams)
+- [AWS Lambda](#aws-lambda)
+- [Google Cloud Pub/Sub](#google-cloud-pubsub)
+- [Apache Kafka](#apache-kafka)
+- [Stdout](#stdout)
+- [Filesystem](#filesystem)
+- [Sending logs outside of Fleet](#sending-logs-outside-of-fleet)
+
 ## Amazon Kinesis Data Firehose
 
 Logs are written to [Amazon Kinesis Data Firehose (Firehose)](https://aws.amazon.com/kinesis/data-firehose/).
@@ -145,6 +147,9 @@ See the [osquery logging documentation](https://osquery.readthedocs.io/en/stable
 
 If `--logger_plugin=tls` is used with osquery clients, the following configuration can be applied on the Fleet server for handling the incoming logs.
 
-<meta name="pageOrderInSection" value="600">
+<meta name="category" value="guides">
+<meta name="authorGitHubUsername" value="rachaelshaw">
+<meta name="authorFullName" value="Rachael Shaw">
+<meta name="publishedOn" value="2023-11-02">
+<meta name="articleTitle" value="Log destinations">
 <meta name="description" value="Learn about supported log destinations in Fleet, including Amazon Kinesis, AWS Lambda Snowflake, Splunk, and more.">
-<meta name="navSection" value="Security compliance">
diff --git a/articles/macos-mdm-setup.md b/articles/macos-mdm-setup.md
new file mode 100644
index 0000000000..bc91ee6a72
--- /dev/null
+++ b/articles/macos-mdm-setup.md
@@ -0,0 +1,65 @@
+# macOS MDM setup
+
+To turn on macOS, iOS, and iPadOS MDM features, follow the instructions on this page to connect Fleet to Apple Push Notification service (APNs).
+
+To use automatic enrollment (aka zero-touch) features on macOS, iOS, and iPadOS, follow instructions to connect Fleet with Apple Business Manager (ABM).
+
+To turn on Windows MDM features, head to this [Windows MDM setup article](https://fleetdm.com/guides/windows-mdm-setup).
+
+## Apple Push Notification service (APNs)
+
+Apple uses APNs to authenticate and manage interactions between Fleet and hosts.
+
+To connect Fleet to APNs or renew APNs, head to the **Settings > Integrations > Mobile device management (MDM)** page.
+
+> Apple requires that APNs certificates are renewed annually. 
+> - If your certificate expires, you will have to turn MDM off and back on for all macOS hosts.
+> - Be sure to use the same Apple ID from year-to-year. If you don't, you will have to turn MDM off and back on for all macOS hosts.
+
+## Apple Business Manager (ABM)
+
+> Available in Fleet Premium
+
+To connect Fleet to ABM, you have to add an ABM token to Fleet. To add an ABM token: 
+
+1. Navigate to the **Settings > Integrations > Mobile device management (MDM)** page.
+2. Under "Automatic enrollment", click "Add ABM", and then click "Add ABM" again on the next page. Follow the instructions in the modal and upload an ABM token to Fleet.
+
+When one of your uploaded ABM tokens has expired or is within 30 days of expiring, you will see a warning
+banner at the top of page reminding you to renew your token.
+
+To renew an ABM token:
+
+1. Navigate to the **Settings > Integrations > Mobile device management (MDM)** page.
+2. Under "Automatic enrollment", click "Edit", and then find the token that you want to renew. Token status is indicated in the "Renew date" column: tokens less than 30 days from expiring will have a yellow indicator, and expired tokens will have a red indicator. Click the "Actions" dropdown for the token and then click "Renew". Follow the instructions in the modal to download a new token from Apple Business Manager and then upload the new token to Fleet.
+
+After connecting Fleet to ABM, set Fleet to be the MDM for all Macs: 
+
+1. Log in to [Apple Business Manager](https://business.apple.com)
+2. Click your profile icon in the bottom left
+3. Click **Preferences**
+4. Click **MDM Server Assignment** and click **Edit** next to **Default Server Assignment**.
+5. Switch **Mac**, **iPhone**, and **iPad** to Fleet.
+
+macOS, iOS, and iPadOS hosts listed in ABM and associated to a Fleet instance with MDM enabled will sync to Fleet and appear in the Hosts view with the **MDM status** label set to "Pending".
+
+Hosts that automatically enroll will be assigned to a default team. You can configure the default team for macOS, iOS, and iPadOS hosts by:
+
+1. Navigating to the **Settings > Integrations > Mobile device management (MDM)** page and clicking "Edit" under "Automatic enrollment".
+2. Click on the "Actions" dropdown for the ABM token you want to update, and then click "Edit teams".
+3. Use the dropdowns in the modal to select the default team for each type of host, and click "Save" to save your selections.
+
+If no default team is set for a host platform (macOS, iOS, or iPadOS), then newly enrolled hosts of that platform will be placed in "No team". 
+
+> A host can be transferred to a new (not default) team before it enrolls. In the Fleet UI, you can do this under **Settings** > **Teams**.
+
+### Simple Certificate Enrollment Protocol (SCEP)
+
+Fleet uses SCEP certificates (1 year expiry) to authenticate the requests hosts make to Fleet. Fleet renews each host's SCEP certificates automatically every 180 days.
+
+<meta name="category" value="guides">
+<meta name="authorGitHubUsername" value="zhumo">
+<meta name="authorFullName" value="Mo Zhu">
+<meta name="publishedOn" value="2024-07-02">
+<meta name="articleTitle" value="macOS MDM setup">
+<meta name="description" value="Learn how to turn on MDM features in Fleet.">
diff --git a/docs/Using Fleet/MDM-macOS-setup-experience.md b/articles/macos-setup-experience.md
similarity index 91%
rename from docs/Using Fleet/MDM-macOS-setup-experience.md
rename to articles/macos-setup-experience.md
index 31dac0a131..6d7f9cc2ef 100644
--- a/docs/Using Fleet/MDM-macOS-setup-experience.md	
+++ b/articles/macos-setup-experience.md
@@ -2,7 +2,7 @@
 
 _Available in Fleet Premium_
 
-In Fleet, you can customize the out-of-the-box macOS setup experience for your end users:
+In Fleet, you can customize the out-of-the-box macOS Setup Assistant with Remote Management and Automated Device Enrollment (ADE) for end users:
 
 * Require end users to authenticate with your identity provider (IdP) and agree to an end user license agreement (EULA) before they can use their new Mac.
 
@@ -12,7 +12,7 @@ In Fleet, you can customize the out-of-the-box macOS setup experience for your e
 
 In addition to the customization above, Fleet automatically installs the fleetd agent during out-of-the-box macOS setup. This agent is responsible for reporting host vitals to Fleet and presenting Fleet Desktop to the end user.
 
-macOS setup features require connecting Fleet to Apple Business Manager (ABM). Learn how [here](./mdm-setup.md#apple-business-manager-abm).
+macOS setup features require connecting Fleet to Apple Business Manager (ABM). Learn how [here](https://fleetdm.com/guides/macos-mdm-setup#apple-business-manager-abm).
 
 ## End user authentication and EULA
 
@@ -20,7 +20,7 @@ Using Fleet, you can require end users to authenticate with your identity provid
 
 ### End user authentication
 
-To require end user authentication, first [configure single sign-on (SSO)](../Deploy/single-sign-on-sso.md). Next, enable end user authentication by heading to to **Controls > Setup experience End user authentication** or use [Fleet's GitOps workflow](https://github.com/fleetdm/fleet-gitops).
+To require end user authentication, first [configure single sign-on (SSO)](https://fleetdm.com/docs/deploy/single-sign-on-sso). Next, enable end user authentication by heading to to **Controls > Setup experience End user authentication** or use [Fleet's GitOps workflow](https://github.com/fleetdm/fleet-gitops).
 
 If you've already configured SSO in Fleet, create a new SAML app in your IdP. In your new app, use `https://<your_fleet_url>/api/v1/fleet/mdm/sso/callback` for the SSO URL.
 
@@ -155,13 +155,15 @@ Testing requires a test Mac that is present in your Apple Business Manager (ABM)
 
 2. In Fleet, navigate to the Hosts page and find your Mac. Make sure that the host's **MDM status** is set to "Pending."
 
-  > New Macs purchased through Apple Business Manager appear in Fleet with MDM status set to "Pending." Learn more about these hosts [here](./mdm-setup.md#pending-hosts).
+  > New Macs purchased through Apple Business Manager appear in Fleet with MDM status set to "Pending." Learn more about these hosts [here](https://fleetdm.com/guides/macos-mdm-setup#apple-business-manager-abm).
 
 3. Transfer this host to the "Workstations (canary)" team by selecting the checkbox to the left of the host and selecting **Transfer** at the top of the table. In the modal, choose the Workstations (canary) team and select **Transfer**.
 
 4. Boot up your test Mac and complete the custom out-of-the-box setup experience.
 
-<meta name="pageOrderInSection" value="1506">
-<meta name="title" value="macOS setup experience">
+<meta name="category" value="guides">
+<meta name="authorGitHubUsername" value="noahtalerman">
+<meta name="authorFullName" value="Noah Talerman">
+<meta name="publishedOn" value="2024-07-03">
+<meta name="articleTitle" value="macOS setup experience">
 <meta name="description" value="Customize your macOS setup experience with Fleet Premium by managing user authentication, Setup Assistant panes, and installing bootstrap packages.">
-<meta name="navSection" value="Device management">
diff --git a/docs/Using Fleet/MDM-commands.md b/articles/mdm-commands.md
similarity index 70%
rename from docs/Using Fleet/MDM-commands.md
rename to articles/mdm-commands.md
index c541c7799d..b1e5918c5e 100644
--- a/docs/Using Fleet/MDM-commands.md	
+++ b/articles/mdm-commands.md
@@ -1,4 +1,4 @@
-# Commands
+# MDM commands
 
 In Fleet you can run MDM commands to take action on your macOS, iOS, iPadOS, and Windows hosts, like restarting the host, remotely.
 
@@ -83,19 +83,11 @@ You can view a list of the 1,000 latest commands:
 1. Run `fleetctl get mdm-commands`
 2. View the list of latest commands, most recent first, along with the timestamp, targeted hostname, command type, execution status and command ID.
 
-The command ID can be used to view command results as documented in [step 4 of the previous section](#step-4-view-the-commands-results). 
+The command ID can be used to view command results as documented in [step 4 of the previous section](#step-4-view-the-commands-results).
 
-The possible statuses for macOS, iOS, and iPadOS hosts are the following:
-
-* Pending: the command has yet to run on the host. The host will run the command the next time it comes online.
-* NotNow: the host responded with "NotNow" status via the MDM protocol: the host received the command, but couldn’t execute it. The host will try to run the command the next time it comes online.
-* Acknowledged: the host responded with "Acknowledged" status via the MDM protocol: the host processed the command successfully.
-* Error: the host responded with "Error" status via the MDM protocol: an error occurred. Run the `fleetctl get mdm-command-results --id=<insert-command-id` to view the error.
-* CommandFormatError: the host responded with "CommandFormatError" status via the MDM protocol: a protocol error occurred, which can result from a malformed command. Run the `fleetctl get mdm-command-results --id=<insert-command-id` to view the error.
-
-The possible statuses for Windows hosts are documented in Microsoft's documentation [here](https://learn.microsoft.com/en-us/windows/client-management/oma-dm-protocol-support#syncml-response-status-codes).
-
-<meta name="pageOrderInSection" value="1507">
-<meta name="title" value="Commands">
+<meta name="category" value="guides">
+<meta name="authorGitHubUsername" value="noahtalerman">
+<meta name="authorFullName" value="Noah Talerman">
+<meta name="publishedOn" value="2024-06-12">
+<meta name="articleTitle" value="MDM commands">
 <meta name="description" value="Learn how to run custom MDM commands on hosts using Fleet.">
-<meta name="navSection" value="Device management">
diff --git a/articles/mdm-migration.md b/articles/mdm-migration.md
new file mode 100644
index 0000000000..b28f6febd0
--- /dev/null
+++ b/articles/mdm-migration.md
@@ -0,0 +1,123 @@
+# MDM migration
+
+This guide provides instructions for migrating devices from your current MDM solution to Fleet.
+
+> For seamless MDM migration, [view this guide](https://fleetdm.com/guides/seamless-mdm-migration).
+
+## Requirements
+
+- A [deployed Fleet instance](https://fleetdm.com/docs/deploy/deploy-fleet)
+- Fleet is connected to Apple Push Notification service (APNs) and Apple Business Manager (ABM). [See macOS MDM setup](https://fleetdm.com/guides/macos-mdm-setup)
+
+## Migrate hosts
+
+To migrate hosts, we will do the following steps:
+
+1. Enroll hosts to Fleet
+2. Assign hosts in Apple Business Manager (ABM) to Fleet
+3. Choose migration workflow and migrate hosts
+
+### Step 1: enroll hosts to Fleet
+
+1. First, enroll your hosts to Fleet by installing Fleet's agent (fleetd). Learn how [here](https://fleetdm.com/guides/enroll-hosts).
+2. Ensure your end users have access to an admin account on their Mac. End users won't be able to migrate on their own if they have a standard account.
+
+### Step 2: assign hosts in Apple Business Manager (ABM) to Fleet
+
+1. In ABM, unassign your hosts from your current MDM solution by selecting **Devices** and then selecting **All Devices**. Then, select **Edit** next to **Edit MDM Server**, select **Unassign from the current MDM**, and select **Continue**.
+
+2. Assign these hosts to Fleet: select **Devices** and then select **All Devices**. Then, select **Edit** next to **Edit MDM Server**, select **Assign to the following MDM:**, select your Fleet server in the dropdown, and select **Continue**.
+
+### Step 3: choose migration workflow and migrate hosts
+
+There are two migration workflows in Fleet: default and end user.
+
+The default migration workflow requires that the IT admin unenrolls hosts from the old MDM solution before the end user can complete migration. This will result in a gap in MDM coverage until the end user completes migration.
+
+The end user migration workflow allows the user to kick off migration by unenrolling from the old MDM solution on their own. Once the user is unenrolled, they're prompted to turn on MDM features in Fleet, reducing the gap in MDM coverage.
+
+#### Default workflow
+
+End user experience:
+
+- After a host is unenrolled from your current MDM solution, the end user will be prompted with Apple's **Remote Management** full-screen popup if the host is assigned to Fleet in ABM.
+<img width="1400" alt="macOS Remote Management popup" src="https://github.com/user-attachments/assets/084946a5-1658-4d8c-852d-3cf5f5d58655">
+- If the host is not assigned to Fleet in ABM (manual enrollment), the end user will be given the option to download the MDM enrollment profile on their **My device page**.
+<img width="1600" alt="Fleet icon in menu bar" src="https://raw.githubusercontent.com/fleetdm/fleet/main/website/assets/images/articles/fleet-desktop-says-hello-world-cover-1600x900@2x.jpg">
+<img width="1400" alt="My device page - turn on MDM" src="https://user-images.githubusercontent.com/5359586/229950406-98343bf7-9653-4117-a8f5-c03359ba0d86.png">
+
+Configuration:
+
+- To kick off the default workflow, unenroll the hosts to be migrated in your current MDM solution. MacOS does not allow a host to be connected to multiple MDM solutions at once.
+
+#### End user workflow
+
+> Available in Fleet Premium
+
+End user experience:
+
+- To watch an animation of the end user experience during the migration workflow, head to **Settings > Integrations > Mobile device management (MDM)** in the Fleet UI, and scroll down to the **End user migration workflow** section.
+
+Configuration:
+
+- In Fleet, you can configure the end user workflow using the Fleet UI, Fleet API, or Fleet's GitOps workflow.
+
+- After configuring the end user workflow, instruct your end users to select the Fleet icon in their menu bar, select **Migrate to Fleet** and follow the on-screen instructions to migrate to Fleet.
+
+- Fleet UI:
+1. Select the avatar on the right side of the top navigation and select **Settings > Integrations > Mobile device management (MDM)**.
+2. Scroll down to the **End user migration workflow** section and select the toggle to enable the workflow.
+3. Under **Mode**, choose a mode, enter the webhook URL for your automation tool (e.g., Tines) under **Webhook URL**, and select **Save**.
+4. During the end user migration workflow, an end user's device will have its selected system theme (light or dark) applied. If your logo is not easy to see on both light and dark backgrounds, you can optionally set a logo for each theme:
+Head to **Settings** > **Organization settings** > **Organization info**, add URLs to your logos in the **Organization avatar URL (for dark backgrounds)** and **Organization avatar URL (for light backgrounds)** fields, and select **Save**.
+- Fleet API: API documentation is [here](https://fleetdm.com/docs/rest-api/rest-api#mdm-macos-migration)
+- GitOps:
+  - To manage macOS MDM migration configuration using Fleet's best practice GitOps, check out the `macos_migration` key in the [GitOps reference documentation](https://fleetdm.com/docs/configuration/yaml-files#macos-migration).
+  - To manage your organization's logo for dark and light backgrounds using Fleet's best practice GitOps, check out the `org_info` key in the [GitOps reference documentation](https://fleetdm.com/docs/configuration/yaml-files#org-info).
+
+## Check migration progress
+
+To see a report of which hosts have successfully migrated to Fleet, have MDM features off, or are still enrolled to your old MDM solution head to the **Dashboard** page by clicking the icon on the left side of the top navigation bar.
+
+Then, scroll down to the **Mobile device management (MDM)** section of the Dashboard. You'll see a breakdown of which hosts have successfully migrated to Fleet, which have MDM features disabled, and which are still enrolled in the previous MDM solution.
+
+## FileVault recovery keys
+
+_Available in Fleet Premium_
+
+When migrating from a previous MDM, end users must restart or log out of their device to escrow FileVault keys to Fleet. The **My device** page in Fleet Desktop will present users with instructions on how to reset their key.
+
+To start, enforce FileVault disk encryption and escrow recovery keys in Fleet. Learn how [here](https://fleetdm.com/guides/enforce-disk-encryption).
+
+After turning on disk encryption in Fleet, share [these guided instructions](#how-to-turn-on-disk-encryption) with your end users.
+
+### How to turn on disk encryption
+
+1. Select the Fleet icon in your menu bar and select **My device**.
+
+![Fleet icon in menu bar](https://raw.githubusercontent.com/fleetdm/fleet/main/website/assets/images/articles/fleet-desktop-says-hello-world-cover-1600x900@2x.jpg)
+
+2. On your **My device** page, follow the disk encryption instructions in the yellow banner.
+  - If you don’t see the yellow banner, select the purple **Refetch** button at the top of the page.
+  - If you still don't see the yellow banner after a couple minutes or if the **My device** page presents you with an error, please contact your IT administrator.
+
+<img width="1399" alt="My device page - turn on disk encryption" src="https://user-images.githubusercontent.com/5359586/229950451-cfcd2314-a993-48db-aecf-11aac576d297.png">
+
+## Activation Lock
+
+In Fleet, the [Activation Lock](https://support.apple.com/en-us/HT208987) feature is disabled by default for automatically enrolled (ADE) hosts.
+
+In 2024, Apple added the ability to manage activation lock in Apple Business Manager (ABM). For devices that are owned by the business and available in ABM, you can [turn off activation lock remotely](https://support.apple.com/en-ca/guide/apple-business-manager/axm812df1dd8/web).
+
+If a device is not available in ABM and has Activation Lock enabled, we recommend asking the end user to follow these instructions to disable Activation Lock before migrating the device to Fleet: https://support.apple.com/en-us/HT208987.
+
+If the Activation Lock is enabled, you will need the Activation Lock bypass code to wipe and reuse the Mac successfully.
+
+However, Activation Lock bypass codes can only be retrieved from the Mac up to 30 days after the device is enrolled. This means that when migrating from your old MDM solution, it’s likely that you’ll be unable to retrieve the Activation Lock bypass code.
+
+<meta name="category" value="guides">
+<meta name="authorGitHubUsername" value="zhumo">
+<meta name="authorFullName" value="Mo Zhu">
+<meta name="publishedOn" value="2024-08-14">
+<meta name="articleTitle" value="MDM migration">
+<meta name="description" value="Instructions for migrating hosts away from an old MDM solution to Fleet.">
diff --git a/articles/osquery-evented-tables-overview.md b/articles/osquery-evented-tables-overview.md
index 883f0bc8ab..f1316a85f1 100644
--- a/articles/osquery-evented-tables-overview.md
+++ b/articles/osquery-evented-tables-overview.md
@@ -121,7 +121,7 @@ On macOS, there are two utilities that enable osquery process auditing: [OpenBSM
 To use the `es_process_events` tables, use the flag `--disable_endpointsecurity=false`. See the [EndpointSecurity instructions](https://osquery.readthedocs.io/en/latest/deployment/process-auditing/#auditing-processes-with-endpointsecurity) for more information. To use `process_events` and `socket_events` with OpenBSM, see the [OpenBSM instructions](https://osquery.readthedocs.io/en/latest/deployment/process-auditing/#auditing-processes-with-openbsm). 
 
 #### Windows
-Currently, osquery does not support process auditing for Windows. To learn more about process auditing on Windows, visit [Microsoft's security auditing overview](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/security-auditing-overview). Fleet is tracking work to build process auditing for Windows in osquery. [Stay up to date on GitHub](https://github.com/fleetdm/fleet/issues/7732).
+Fleet supports auditing process events on Windows via the `process_etw_events` table. To learn more about process auditing on Windows, visit [Microsoft's security auditing overview](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/security-auditing-overview). Fleet is tracking work to add file auditing for Windows in osquery. [Stay up to date on GitHub](https://github.com/fleetdm/fleet/issues/20946).
 
 ### YARA scanning
 [YARA](https://virustotal.github.io/yara/) is a malware research and detection tool available on Linux and macOS that allows users to create descriptions of malware families based on patterns of text or binary code. Each potential piece of malware is matched against a YARA rule and triggers if the specified conditions are met. 
diff --git a/docs/Using Fleet/Osquery-process.md b/articles/osquery-watchdog.md
similarity index 90%
rename from docs/Using Fleet/Osquery-process.md
rename to articles/osquery-watchdog.md
index 68efcd81da..5fb0bd980b 100644
--- a/docs/Using Fleet/Osquery-process.md	
+++ b/articles/osquery-watchdog.md
@@ -1,4 +1,4 @@
-# Osquery children processes
+# Osquery watchdog
 
 Osquery will run a watcher process to keep track of any child process and any managed extensions. What follows is a description of what happens during the watcher REPL and under what circumstances the child process and/or managed extensions are terminated.
 
@@ -25,6 +25,9 @@ If the managed extension is `Non-existent` (either because it was `Non-existent`
 
 Lastly, we check the state of the watcher process itself. If it is deemed unhealthy because of resource contention, then the osquery process is shut down.
 
-<meta name="pageOrderInSection" value="700">
+<meta name="category" value="guides">
+<meta name="authorGitHubUsername" value="juan-fdz-hawa">
+<meta name="authorFullName" value="Juan Fernandes">
+<meta name="publishedOn" value="2023-07-28">
+<meta name="articleTitle" value="Osquery watchdog">
 <meta name="description" value="Learn about how osquery process manages child processes and managed extensions in Fleet.">
-<meta name="navSection" value="Osquery management">
\ No newline at end of file
diff --git a/docs/Using Fleet/Puppet-module.md b/articles/puppet-module.md
similarity index 96%
rename from docs/Using Fleet/Puppet-module.md
rename to articles/puppet-module.md
index 30db545834..bf6a442bc1 100644
--- a/docs/Using Fleet/Puppet-module.md	
+++ b/articles/puppet-module.md
@@ -151,7 +151,9 @@ if $err != '' {
 
 The above example includes the XML payload for the `EnableRemoteDesktop` MDM command. Learn more about creating the payload for other custom commands [here](./MDM-commands.md).
 
-<meta name="pageOrderInSection" value="1510">
-<meta name="title" value="Puppet module">
+<meta name="category" value="guides">
+<meta name="authorGitHubUsername" value="noahtalerman">
+<meta name="authorFullName" value="Noah Talerman">
+<meta name="publishedOn" value="2024-05-24">
+<meta name="articleTitle" value="Puppet module">
 <meta name="description" value="Learn how to use Fleet's Puppet module to automatically assign custom configuration profiles on your macOS hosts.">
-<meta name="navSection" value="Device management">
diff --git a/docs/Using Fleet/Fleet-UI.md b/articles/queries.md
similarity index 73%
rename from docs/Using Fleet/Fleet-UI.md
rename to articles/queries.md
index 3ccd10d5e4..0379bca004 100644
--- a/docs/Using Fleet/Fleet-UI.md	
+++ b/articles/queries.md
@@ -1,19 +1,25 @@
-# Fleet UI
-- [Creating a query](#create-a-query)
-- [Running a query](#run-a-query)
-- [Scheduling a query](#schedule-a-query)
-- [Update agent options](#update-agent-options)
+# Queries
+
+Queries in Fleet allow you to ask questions to help you manage, monitor, and identify threats on your devices. This guide will walk you through how to create, schedule, and run a query.
+
+> Note: Unless a logging infrastructure is configured on your Fleet server, osquery-related logs will be stored locally on each device. Read more [here](https://fleetdm.com/guides/log-destinations)
+
+> New users may find it helpful to start with Fleet's policies. You can find policies and queries from the community in Fleet's [query library](https://fleetdm.com/queries). To learn more about policies, see [What are Fleet policies?](https://fleetdm.com/securing/what-are-fleet-policies) and [Understanding the intricacies of Fleet policies](https://fleetdm.com/guides/understanding-the-intricacies-of-fleet-policies).
+
+### In this guide:
+
+- [Create a query](#create-a-query)
+- [Run a query](#run-a-query)
+- [Schedule a query](#schedule-a-query)
 
 <div purpose="embedded-content">
    <iframe src="https://www.youtube.com/embed/1VNvg3_drow" allowfullscreen></iframe>
 </div>
 
+
+
 ## Create a query
 
-Queries in Fleet allow you to ask a multitude of questions to help you manage, monitor, and identify threats on your devices. 
-
-If you're unsure of what to ask, head to Fleet's [query library](https://fleetdm.com/queries). There you'll find common queries that have been tested by members of our community.
-
 How to create a query:
 
 1. In the top navigation, select **Queries**.
@@ -63,16 +69,10 @@ By default, queries that run on a schedule will only target platforms compatible
 
 > Note: When viewing a specific [team](https://fleetdm.com/docs/using-fleet/segment-hosts) in Fleet Premium, only queries that belong to the selected team will be listed. When configuring query automations for all hosts, only global queries will be listed.
 
-## Update agent options
 
-<!-- Heading is kept so that the link from the Fleet UI still works -->
-<span id="configuring-agent-options" name="configuring-agent-options"></span>
-
-> This content was relocated on 31st August 2023. 
-
-See "[Agent configuration](https://fleetdm.com/docs/configuration/agent-configuration)" to learn how to simultaneously update agent options from the Fleet UI or fleetctl command line tool.
-
-<meta name="title" value="Fleet UI">
-<meta name="pageOrderInSection" value="200">
+<meta name="category" value="guides">
+<meta name="authorGitHubUsername" value="noahtalerman">
+<meta name="authorFullName" value="Noah Talerman">
+<meta name="publishedOn" value="2024-08-09">
+<meta name="articleTitle" value="Queries">
 <meta name="description" value="Learn how to create, run, and schedule queries, as well as update agent options in the Fleet user interface.">
-<meta name="navSection" value="The basics">
diff --git a/docs/Using Fleet/manage-access.md b/articles/role-based-access.md
similarity index 97%
rename from docs/Using Fleet/manage-access.md
rename to articles/role-based-access.md
index b472b33539..95fc712c52 100644
--- a/docs/Using Fleet/manage-access.md	
+++ b/articles/role-based-access.md
@@ -1,4 +1,4 @@
-# Manage access
+# Role-based access
 
 Users have different abilities depending on the access level they have.
 
@@ -83,7 +83,7 @@ GitOps is an API-only and write-only role that can be used on CI/CD pipelines.
 | View Apple business manager (BM) information                                                                                               |          |            |            | ✅    |         |
 | Generate Apple mobile device management (MDM) certificate signing request (CSR)                                                            |          |            |            | ✅    |         |
 | View disk encryption key for macOS and Windows hosts                                                                                       | ✅       | ✅         | ✅         | ✅    |         |
-| Edit OS updates for macOS and Windows hosts                                                                                                |          |            | ✅         | ✅    | ✅      |
+| Edit OS updates for macOS, Windows, iOS, and iPadOS hosts                                                                                                |          |            | ✅         | ✅    | ✅      |
 | Create, edit, resend and delete configuration profiles for macOS and Windows hosts                                                                  |          |            | ✅         | ✅    | ✅      |
 | Execute MDM commands on macOS and Windows hosts\**                                                                                         |          |            | ✅         | ✅    |         |
 | View results of MDM commands executed on macOS and Windows hosts\**                                                                        | ✅       | ✅         | ✅         | ✅    |         |
@@ -154,7 +154,7 @@ Users with access to multiple teams can be assigned different roles for each tea
 | Edit agent options                                    |               |                |                 | ✅         | ✅          |
 | Initiate [file carving](https://fleetdm.com/docs/using-fleet/rest-api#file-carving)                                              |               |                | ✅              | ✅         |             |
 | View disk encryption key for macOS hosts                                                                                         | ✅            | ✅             | ✅              | ✅         |             |
-| Edit OS updates for macOS and Windows hosts                                                                                                |          |            | ✅         | ✅    | ✅      |
+| Edit OS updates for macOS, Windows, iOS, and iPadOS hosts                                                                                                |          |            | ✅         | ✅    | ✅      |
 | Create, edit, resend and delete configuration profiles for macOS and Windows hosts                                                        |               |                | ✅              | ✅         | ✅          |
 | Execute MDM commands on macOS and Windows hosts*                                                                                 |               |                | ✅              | ✅         |             |
 | View results of MDM commands executed on macOS and Windows hosts*                                                                | ✅            | ✅             | ✅              | ✅         |             |
@@ -175,6 +175,9 @@ Users with access to multiple teams can be assigned different roles for each tea
 
 \** Team-level users only see global query results for hosts on teams where they have access.
 
-<meta name="pageOrderInSection" value="900">
+<meta name="category" value="guides">
+<meta name="authorGitHubUsername" value="noahtalerman">
+<meta name="authorFullName" value="Noah Talerman">
+<meta name="publishedOn" value="2024-08-10">
+<meta name="articleTitle" value="Role-based access">
 <meta name="description" value="Learn about the different roles and permissions in Fleet.">
-<meta name="navSection" value="The basics">
diff --git a/docs/Using Fleet/Scripts.md b/articles/scripts.md
similarity index 88%
rename from docs/Using Fleet/Scripts.md
rename to articles/scripts.md
index 7adb2c057d..754fdf4da9 100644
--- a/docs/Using Fleet/Scripts.md	
+++ b/articles/scripts.md
@@ -19,7 +19,7 @@ If you don't use MDM features, to enable scripts, we'll deploy a fleetd agent wi
 
 2. Deploy fleetd to your hosts. If your hosts already have fleetd installed, you can deploy the new fleetd on-top of the old installation.
 
-Learn more about generating a fleetd agent and deploying it [here](./enroll-hosts.md).
+Learn more about generating a fleetd agent and deploying it [here](https://fleetdm.com/guides/enroll-hosts).
 
 ## Execute a script
 
@@ -45,7 +45,9 @@ fleetctl CLI:
 fleetctl run-script --script-path=/path/to/script --host=hostname
 ```
 
-<meta name="pageOrderInSection" value="1508">
-<meta name="title" value="Scripts">
+<meta name="category" value="guides">
+<meta name="authorGitHubUsername" value="noahtalerman">
+<meta name="authorFullName" value="Noah Talerman">
+<meta name="publishedOn" value="2024-06-04">
+<meta name="articleTitle" value="Scripts">
 <meta name="description" value="Learn how to execute a custom script on macOS, Windows, and Linux hosts in Fleet.">
-<meta name="navSection" value="Device management">
diff --git a/articles/seamless-mdm-migration.md b/articles/seamless-mdm-migration.md
new file mode 100644
index 0000000000..9abf3c516c
--- /dev/null
+++ b/articles/seamless-mdm-migration.md
@@ -0,0 +1,133 @@
+# Seamless MDM migrations to Fleet
+
+![Seamless MDM migrations to Fleet](../website/assets/images/articles/seamless-mdm-migration-1600x900@2x.png)
+
+Migrating macOS devices between Mobile Device Management (MDM) solutions is often fraught with challenges, including potential gaps in device management, user disruption, and compliance issues. Traditional MDM migrations typically require end-user interaction and leave devices unmanaged for a period, leading to problems like Wi-Fi disconnections due to certificate profile removal and incomplete migrations. These challenges can force organizations to stay with outdated MDM solutions that no longer meet their needs. But there’s a better way.
+
+Seamless MDM migrations are now possible, allowing organizations to transition their macOS devices to Fleet without any downtime or end-user involvement. By leveraging Fleet, you can ensure that your devices remain fully managed and compliant throughout the migration process. This means no more gaps in management, no user disruptions, and a smoother path to a more modern and effective MDM solution.
+
+This guide will walk you through the entire process of migrating your MDM deployment to Fleet. You’ll start by understanding the specific requirements for a seamless migration, followed by configuring Fleet with the necessary certificates and database records. The guide will then take you through the process of installing Fleet’s agent (`fleetd`) on your devices, updating DNS records to redirect devices to the Fleet server, and finally, decommissioning your old MDM server.
+
+Throughout the guide, you’ll find practical advice and best practices to ensure a smooth transition with minimal risk. By the end, you’ll be equipped with the knowledge and tools to execute a seamless MDM migration to Fleet, ensuring that your organization’s devices are securely managed without the typical headaches associated with a traditional MDM switch.
+
+## Requirements
+
+Note: Deployments that do not meet these seamless migration requirements can still migrate with the [standard MDM migration process](https://fleetdm.com/docs/using-fleet/mdm-migration-guide).
+
+* Customer controls the DNS used in the MDM server enrollment (eg. devices are enrolled to `*.customerowneddomain.com`, not `*.mdmvendor.com`).
+* Customer has access to the Apple Push Notification Service (APNS) certificate/key and SCEP certificate/key, or access to the MDM server database to extract these values.
+
+These requirements are easily met in self-hosted open-source MDM solutions and may be met with commercial solutions when the customer is self-hosting or otherwise controls the DNS.
+
+Seamless migration may still be possible with control of DNS along with a copy of the original Certificate Signing Request (CSR) for the APNS certificate. If you are in this situation, please reach out to the Fleet team.
+
+### Why?
+
+Apple allows changing most values in profiles delivered by MDM, but the `ServerURL`, `CheckinURL`, and `PushTopic` cannot be changed without re-enrollment (and user actions). Control of DNS and the certificates allows the MDM to be swapped out without changing these.
+
+## High-level process
+
+1. Configure Fleet with the APNS & SCEP certificates/keys, path redirects, and SCEP renewal.
+2. Import database records letting Fleet know about the devices to be migrated.
+3. Configure controls (profiles, updates, etc.) in Fleet.
+4. Install `fleetd` on the devices (through the existing MDM).
+5. Update DNS records to point devices to the Fleet server.
+6. Decommission the old server.
+
+It is recommended to follow the entire process on a staging/test MDM instance and devices, then repeat for the production instance and devices.
+
+[![Before migration](https://mermaid.ink/img/pako:eNpVUctuwjAQ_BVrT62URIaEvFRxqNKeSivBrZiDiTeJpdhGxqFQBN9eA23VXvY1o9lZ7RFqIxBKCMOQaSddjyV5xMZYJEq2ljtpNNNXtOnNR91x68jLnOntsPbwpiOK128LUuFO1sg0IUqoupeo3XJWzcitXDGNWjD9i5EwJHMzOBRkfSDV64I8rO2U3HlChHuuNj1GtVH3YTg1vfBTpm95-bSXWyd1Sy7qC7Q7tKu_wufzmTQ9orsY9mn5fIk_TAhAoVVcCn_z8WKXgetQIYPSlwIbPvSOAdMnT-WDM4uDrqF0dsAAho3gDivJ_eUKyob3Wz_dcP1uzL8eyiPsoRzTOBrHySim2SQtaBbAAco4S6NxTmmeZcUoLiZJfArg8ypAo5SOKC3iNM-LNMmTJAAU0hk7u32pNrqRrXdmzdB23xtPX3Gkloc?type=png)](https://mermaid.live/edit#pako:eNpVUctuwjAQ_BVrT62URIaEvFRxqNKeSivBrZiDiTeJpdhGxqFQBN9eA23VXvY1o9lZ7RFqIxBKCMOQaSddjyV5xMZYJEq2ljtpNNNXtOnNR91x68jLnOntsPbwpiOK128LUuFO1sg0IUqoupeo3XJWzcitXDGNWjD9i5EwJHMzOBRkfSDV64I8rO2U3HlChHuuNj1GtVH3YTg1vfBTpm95-bSXWyd1Sy7qC7Q7tKu_wufzmTQ9orsY9mn5fIk_TAhAoVVcCn_z8WKXgetQIYPSlwIbPvSOAdMnT-WDM4uDrqF0dsAAho3gDivJ_eUKyob3Wz_dcP1uzL8eyiPsoRzTOBrHySim2SQtaBbAAco4S6NxTmmeZcUoLiZJfArg8ypAo5SOKC3iNM-LNMmTJAAU0hk7u32pNrqRrXdmzdB23xtPX3Gkloc)
+
+[![After migration](https://mermaid.ink/img/pako:eNpVUcFuwjAM_ZXIu2xSW7XQdaWakCYxTmOT4DayQ0jcNqJJUEgZDMG3L6Vs2g5JbL9n-9k5AjcCoYAwDKl20jVYkKfSoSVKVpY5aTTVF7BszCevmXXkZU71tl15eFMTxfjbgkxwJzlSTYgSijcStVvOJjPSmx9UoxZUm0Z4ePm8l1sndUU6xgLtDq1n_CaS8_lMeurfaBiSuWkdCrI6kMnrgjyu7JjcekKEe6Y2DUbcqLswHJcNousE-2c57e6fLhCAQquYFH7kYyeXgqtRIYXCm42sakch6AHB7Hrmt9NhJWu2eI2vGF9X1rR-okvWzXQ6pUD1yVdnrTOLg-ZQONtiAO1GMIcTyfyyFBR9Gdgw_W7MPx-KI-yhSPI8GgzTJE2T-GGU5UkABygGeRz5k8SDJL8fpGmcnQL4ulSIo8zH49Ewy_NRluZpGgAK6Yyd9R_LjS5l5aV5xVV9bXn6BriRpdY?type=png)](https://mermaid.live/edit#pako:eNpVUcFuwjAM_ZXIu2xSW7XQdaWakCYxTmOT4DayQ0jcNqJJUEgZDMG3L6Vs2g5JbL9n-9k5AjcCoYAwDKl20jVYkKfSoSVKVpY5aTTVF7BszCevmXXkZU71tl15eFMTxfjbgkxwJzlSTYgSijcStVvOJjPSmx9UoxZUm0Z4ePm8l1sndUU6xgLtDq1n_CaS8_lMeurfaBiSuWkdCrI6kMnrgjyu7JjcekKEe6Y2DUbcqLswHJcNousE-2c57e6fLhCAQquYFH7kYyeXgqtRIYXCm42sakch6AHB7Hrmt9NhJWu2eI2vGF9X1rR-okvWzXQ6pUD1yVdnrTOLg-ZQONtiAO1GMIcTyfyyFBR9Gdgw_W7MPx-KI-yhSPI8GgzTJE2T-GGU5UkABygGeRz5k8SDJL8fpGmcnQL4ulSIo8zH49Ewy_NRluZpGgAK6Yyd9R_LjS5l5aV5xVV9bXn6BriRpdY)
+
+### 1. Configure Fleet
+
+The Fleet server must be configured with the APNS & SCEP certificates/keys copied from the existing server. This is done via manual modification of the Fleet database and configurations. The Fleet team will perform this configuration on Fleet Cloud instances and can advise how to do it on self-hosted Fleet instances.
+
+In most cases, the paths (portion of the URL after the domain name) used in the enrollment profile `ServerURL`, `CheckInURL` and SCEP URL will differ from those used by Fleet. The Fleet Server load balancer must be configured to redirect the MDM client via HTTP 3xx redirects.
+
+[Apple's documentation](https://developer.apple.com/documentation/devicemanagement/implementing_device_management/sending_mdm_commands_to_a_device?language=objc) states:
+
+> MDM follows HTTP 3xx redirections without user interaction. However, it doesn’t save the URL given by HTTP 301 (Moved Permanently) redirections. Each transaction begins at the URL the MDM payload specifies.
+
+Therefore, redirects must remain as long as migrated devices are enrolled.
+
+For a typical MicroMDM to Fleet migration, the following redirects are used:
+
+| From (MicroMDM path) | To (Fleet path) |
+| -------------------- | --------------- |
+| /mdm/checkin         | /mdm/apple/mdm  |
+| /mdm/connect         | /mdm/apple/mdm  |
+| /scep                | /mdm/apple/scep |
+
+SCEP certificate renewals need special handling for migrated devices. This is configured (by, or with guidance from the Fleet team) in the server using the [`FLEET_SILENT_MIGRATION_ENROLLMENT_PROFILE` environment variable](https://github.com/fleetdm/fleet/pull/20063). When configured, migrated devices receive an enrollment profile with matching keys when SCEP renewal comes due (migrated devices reject the typical profile Fleet sends because it includes the new server URL).
+
+### 2. Import database records
+
+The Fleet server is made aware of the devices that will be migrated by inserting records into the database. The Fleet team will perform this operation in Fleet Cloud and can advise for self-hosted instances.
+
+For MicroMDM, a [migration script](https://github.com/fleetdm/fleet/pull/18151) has been made that will generate the necessary SQL statements from the MicroMDM database.
+
+For other MDM solutions, please work with the Fleet team to generate the appropriate records.
+
+### 3. Configure controls
+
+Next, configure the controls that will be applied to migrated devices. Use the Teams features in Fleet Premium to apply different configurations to different devices.
+
+In particular,
+
+* [Configuration profiles](https://fleetdm.com/docs/using-fleet/mdm-custom-os-settings#custom-os-settings)
+* [OS updates](https://fleetdm.com/docs/using-fleet/mdm-os-updates)
+* [Disk encryption](https://fleetdm.com/docs/using-fleet/mdm-disk-encryption)
+
+When the device checks in after migration, Fleet will send the full set of configuration profiles configured for that device's team. Any profiles with identifiers matching existing profiles on the device will be updated in place.
+
+Fleet will not send commands to remove profiles that have not been configured in Fleet. Either remove these profiles before migration in the existing MDM before migration or use `fleetctl` or the Fleet API to send an MDM command to remove any undesired profiles.
+
+OS update configurations will apply automatically after the device is migrated.
+
+As of Fleet 4.55, disk encryption keys will automatically be re-escrowed after migration the next time the user logs into their device.
+
+### 4. Install `fleetd`
+
+Install `fleetd` on the devices to migrate. Devices with `fleetd` installed will begin to show up in the Fleet UI (with profiles in a "Pending" state).
+
+Generate `.pkg` packages following the [standard enrollment documentation](https://fleetdm.com/docs/using-fleet/enroll-hosts). Install the package using the existing MDM or any other management tool.
+
+Devices are automatically assigned to Teams in Fleet based on the package they are provided, so be sure to distribute packages that assign devices to teams with the relevant configurations.
+
+### 5. Update DNS
+
+Devices are now communicating with the Fleet server via the `fleetd` agent. They have not yet migrated MDM servers.
+
+Ensure the Fleet server load balancer can terminate HTTPS using the existing server hostname. This typically involves issuing a certificate [with AWS ACM](https://docs.aws.amazon.com/acm/latest/userguide/gs-acm-request-public.html). In Fleet Cloud, the Fleet team will ask the customer team to update a DNS record for verification so that AWS can issue the certificate.
+
+Now the customer updates DNS to point the existing domain to the Fleet server load balancer. This typically involves setting a `CNAME` record with the hostname of the load balancer (eg. `mdm.example.com -> fleet-cloud-alb-1723349272.us-east-2.elb.amazonaws.com`).
+
+Devices will begin checking in with the Fleet server and receiving new configurations.
+
+### 6. Decommission the old server
+
+At this point, the migration is complete. The old server can be decommissioned.
+
+Keep a database backup of the old server on hand in case it is ever needed for reference or recovery.
+
+## Gradual migration
+
+In the process described, when we update DNS all of the devices are migrated immediately. To minimize risk, it is often desired to gradually migrate devices.
+
+Fleet has created a [migration proxy](https://github.com/fleetdm/fleet/tree/main/tools/mdm/migration/mdmproxy) that can be used to gradually migrate specific devices and/or a percentage of devices. This allows a staged migration with progressively more devices migrated.
+
+## Conclusion
+
+Seamless MDM migrations on macOS are not just possible but are a significant step forward in maintaining a secure and compliant environment without disrupting end users. By following this guide, you can transition from your existing MDM solution to Fleet smoothly, keeping your devices managed and secure throughout the process. If you encounter any challenges, the Fleet team is ready to assist you, ensuring your migration is successful.
+
+For organizations ready to take control of their MDM strategy, this seamless migration process is an opportunity to upgrade to a modern, flexible, and secure management solution. We encourage you to reach out for support or further explore the robust features Fleet offers to enhance your device management capabilities.
+
+<meta name="category" value="guides">
+<meta name="authorFullName" value="Zach Wasserman">
+<meta name="authorGitHubUsername" value="zwass">
+<meta name="publishedOn" value="2024-08-08">
+<meta name="articleTitle" value="Seamless MDM migrations to Fleet">
+<meta name="articleImageUrl" value="../website/assets/images/articles/seamless-mdm-migration-1600x900@2x.png">
+<meta name="description" value="This guide provides a process for seamlessly migrating macOS devices from an existing MDM solution to Fleet.">
diff --git a/articles/software-self-service.md b/articles/software-self-service.md
new file mode 100644
index 0000000000..f82a27f8c8
--- /dev/null
+++ b/articles/software-self-service.md
@@ -0,0 +1,80 @@
+# Software self-service
+
+![Software self-service](../website/assets/images/articles/software-self-service-1600x900@2x.png)
+
+Fleet’s self-service software feature empowers end users by allowing them to independently install approved software packages from a curated list through the Fleet Desktop “My device” page. This not only reduces the administrative burden on IT teams but also enhances user productivity and satisfaction. In this guide, we will walk you through the process of uploading, editing, and managing self-service software packages in Fleet, enabling seamless software distribution and management.
+
+## Prerequisites
+
+* Fleet Premium is required for software self-service.
+
+> Software packages can be added to a specific team or to the "No team" category. The "No team" category is the default assignment for hosts that are not part of any specific team.
+
+## Step-by-Step Instructions
+
+### Adding a self-service software package
+
+1. **Navigate to the Software page**: Click “Software” in the main navigation menu.
+2. **Select a team**: Click the dropdown in the upper left corner of the page and click on the team to which you want to add the software package.
+3. **Open the “Add software” modal**: Click the “Add software” button in the upper right corner of the page.
+4. **Select a software package to upload**: Click “Choose file” in the “Add software” modal and select a software package from your computer.
+5. **Advanced options**: If desired, click “Advanced options” to add a pre-install condition or post-install script to your software package.
+    * **Pre-install condition**: This is an osquery query that results in true. For example, you might require a specific software title to exist before installing additional extensions.
+    * **Post-install script**: This might be used to apply a license key, perform configuration tasks, or execute cleanup tasks after the software installation.
+6. **Make the software package self-service**: Check the “Self-service” checkbox to mark the software package as self-service.
+7. **Finish the upload**: Click the “Add software” button to finish the upload process.
+
+### Editing a self-service software package
+
+1. **Navigate to the software details page for the software package**: Click “Software” in the main navigation menu.
+2. **Select a team**: Click the dropdown in the upper left corner of the page and click on the team to which you added the software package.
+3. **Filter by self-service**: To make it easier to find your software package, click on the dropdown to the left of the search bar and select “Self-service”. This will filter the results in the table to only show self-service software packages. If you still don’t see your software package, you can page through the results or search for your software package’s name in the search bar.
+4. **Open the details page**: Click on the software package’s name. 
+5. **Open the actions dropdown**: Click on the “Actions” dropdown on the far right of the page. From here, you can download the software package, delete the software package, or click “Advanced options” to see the options you configured when adding the software package. 
+
+### Downloading a self-service software package
+
+1. **Navigate to the software details page for the software package**: Click “Software” in the main navigation menu.
+2. **Select a team**: Click the dropdown in the upper left corner of the page and click on the team to which you added the software package.
+3. **Filter by self-service**: Click on the dropdown to the left of the search bar and select “Self-service” and page through the results or search for your software package’s name in the search bar.
+4. **Download the software package**:
+* **Option 1**: Click on the down-arrow next to the software package name in the list of self-service software packages to start an immediate download.
+* **Option 2**: Click on the software package’s name to open the details page. Click on the “Actions” dropdown on the far right of the page, and then click on “Download” to download the software package to your computer.
+
+### Deleting a self-service software package
+
+1. **Navigate to the software details page for the software package**: Click “Software” in the main navigation menu.
+2. **Select a team**: Click the dropdown in the upper left corner of the page and click on the team to which you added the software package.
+3. **Filter by self-service**: Click on the dropdown to the left of the search bar and select “Self-service” and page through the results or search for your software package’s name in the search bar.
+4. **Open the details page**: Click on the software package’s name.
+5. **Open the actions dropdown**: Click on the “Actions” dropdown on the far right of the page.
+6. **Delete the software package**: Click on “Delete” to remove the software package from Fleet. Confirm the deletion if prompted.
+
+### Installing self-service software packages
+
+To install the self-service software package on the host:
+
+1. **Navigate to the “Self-service” tab**: Click on the Fleet Desktop icon in the OS menu bar. Click “Self-service”. This will point your default web browser to the list of self-service software packages in the “My device” page.
+2. **Install the self-service software package**: Click the “Install” button for the software package you want to install.
+
+### Using the REST API for self-service software packages
+
+Fleet provides a REST API for managing software packages, including self-service software packages.  Learn more about Fleet's [REST API](https://fleetdm.com/docs/rest-api/rest-api#software).
+
+### Managing self-service software packages with GitOps
+
+To manage self-service software packages using Fleet's best practice GitOps, check out the `software` key in the [GitOps reference documentation](https://fleetdm.com/docs/using-fleet/gitops#software).
+
+> Note: with GitOps enabled, software packages uploaded using the web UI will not persist.
+
+## Conclusion
+
+Fleet’s self-service software feature not only simplifies software management for IT administrators but also empowers end users by giving them access to necessary software on demand. This feature ensures that your hosts remain secure while improving overall user experience. For further information and advanced management techniques, refer to Fleet's [REST API](https://fleetdm.com/docs/rest-api/rest-api#software) and [GitOps](https://fleetdm.com/docs/using-fleet/gitops#software) documentation. 
+
+<meta name="articleTitle" value="Software self-service">
+<meta name="authorFullName" value="Jahziel Villasana-Espinoza">
+<meta name="authorGitHubUsername" value="jahzielv">
+<meta name="category" value="guides">
+<meta name="publishedOn" value="2024-08-06">
+<meta name="articleImageUrl" value="../website/assets/images/articles/software-self-service-1600x900@2x.png">
+<meta name="description" value="This guide will walk you through adding apps to Fleet for user self-service.">
diff --git a/docs/01-Using-Fleet/standard-query-library/README.md b/articles/standard-query-library.md
similarity index 87%
rename from docs/01-Using-Fleet/standard-query-library/README.md
rename to articles/standard-query-library.md
index fc3f3bfdc1..7bbdd52bf2 100644
--- a/docs/01-Using-Fleet/standard-query-library/README.md
+++ b/articles/standard-query-library.md
@@ -47,4 +47,9 @@ Listed below are great resources that contain additional queries.
 - Osquery (https://github.com/osquery/osquery/tree/master/packs)
 - Palantir osquery configuration (https://github.com/palantir/osquery-configuration/tree/master/Fleet)
 
-<meta name="navSection" value="The basics">
+<meta name="category" value="guides">
+<meta name="authorGitHubUsername" value="noahtalerman">
+<meta name="authorFullName" value="Noah Talerman">
+<meta name="publishedOn" value="2024-04-04">
+<meta name="articleTitle" value="Standard query library">
+<meta name="description" value="Learn how to use and contribute to Fleet's standard query library.">
diff --git a/articles/tales-from-fleet-security-securing-the-startup.md b/articles/tales-from-fleet-security-securing-the-startup.md
index 09b0ac4fd6..6a8423dfc9 100644
--- a/articles/tales-from-fleet-security-securing-the-startup.md
+++ b/articles/tales-from-fleet-security-securing-the-startup.md
@@ -43,7 +43,7 @@ I thought using Apple’s Automated Device Enrollment (or Device Enrollment Prog
 
 Technically, I was not wrong, but there are non-technical challenges.
 
-1. The requirements to establish a DEP account vary by country. In the US, for example, it requires a [DUNS](https://en.wikipedia.org/wiki/Data_Universal_Numbering_System) number. Getting a DUNS number is simple for US companies, but what is not easy is to fulfill similar requirements in every country where you would like to use DEP. We could not register for DEP in Canada. We have people in many other countries with a similar situation.
+1. The requirements to establish a ADE account vary by country. In the US, for example, it requires a [DUNS](https://en.wikipedia.org/wiki/Data_Universal_Numbering_System) number. Getting a DUNS number is simple for US companies, but what is not easy is to fulfill similar requirements in every country where you would like to use ADE. We could not register for ADE in Canada. We have people in many other countries with a similar situation.
 2. The delays for obtaining hardware are very long. When planning endpoint deployment strategies, we must consider this, as supply chain issues will not disappear soon.
 3. The benchmarks made by the Center for Internet Security (CIS) are excellent but are incredibly long (700+ pages) and written for experts. We wanted to be transparent about why we configured company devices a certain way and explain it so everyone could understand without Googling for hours.
 
@@ -55,9 +55,9 @@ Google should offer more granularity than on/off for third-party cookies, such a
 
 ## Solutions
 
-### DEP in other countries
+### ADE in other countries
 
-First, we enrolled in DEP in the US. Once we had our customer numbers and Mobile Device Management (MDM) system linked up, we were ready to buy laptops in the US that would get configured out of the box. Then, we found a workaround for Canada. If you add Apple’s Reseller ID to [Apple Business Manager](https://business.apple.com/), you can order computers over the phone and have them linked to your business account. The Reseller ID part is critical. I learned that the hard way, by receiving a laptop ordered like this to find it not part of DEP. Fortunately, it was easy for me to [add it to DEP manually](https://support.apple.com/en-ca/guide/apple-configurator/welcome/ios).
+First, we enrolled in ADE in the US. Once we had our customer numbers and Mobile Device Management (MDM) system linked up, we were ready to buy laptops in the US that would get configured out of the box. Then, we found a workaround for Canada. If you add Apple’s Reseller ID to [Apple Business Manager](https://business.apple.com/), you can order computers over the phone and have them linked to your business account. The Reseller ID part is critical. I learned that the hard way, by receiving a laptop ordered like this to find it not part of ADE. Fortunately, it was easy for me to [add it to ADE manually](https://support.apple.com/en-ca/guide/apple-configurator/welcome/ios).
 
 We will keep trying the same approach in every country where we need Macs, though we know it will not be possible everywhere. We will either obtain equipment from a nearby country or rely on manual MDM enrollment by end-users for those countries.
 
@@ -76,7 +76,7 @@ Using the [CIS Benchmark for macOS 12](https://www.cisecurity.org/benchmark/appl
 
 ### Effort
 
-Implementing our own security baseline, configuring our MDM and DEP required a couple of days of effort, mostly because I insisted on reviewing all of the CIS Benchmark to be certain I didn’t miss something important. Having everything published in our handbook required additional effort, but if you were to use our baseline, you could get started very quickly. The main thing that will slow you down is getting onboarded to DEP, and receiving your first laptop ordered!
+Implementing our own security baseline, configuring our MDM and ADE required a couple of days of effort, mostly because I insisted on reviewing all of the CIS Benchmark to be certain I didn’t miss something important. Having everything published in our handbook required additional effort, but if you were to use our baseline, you could get started very quickly. The main thing that will slow you down is getting onboarded to ADE, and receiving your first laptop ordered!
 
 ## What's next?
 
diff --git a/articles/tales-from-fleet-security-soc2.md b/articles/tales-from-fleet-security-soc2.md
index c5b6d8aaaa..641583270a 100644
--- a/articles/tales-from-fleet-security-soc2.md
+++ b/articles/tales-from-fleet-security-soc2.md
@@ -43,7 +43,7 @@ One of the essential things about SOC 2 is having the right security policies. T
 
 Writing policies from scratch can seem daunting. Many compliance automation products have templates you can use to get started, but there are excellent free and open resources online.
 
-As you can see, our policies are in our [handbook](https://fleetdm.com/handbook/business-operations/security-policies#information-security-policy-and-acceptable-use-policy), and we created most of them using this [free set of templates](https://github.com/JupiterOne/security-policy-templates) published by JupiterOne under Creative Commons licensing.
+As you can see, our policies are in our [handbook](https://fleetdm.com/handbook/digital-experience/security-policies#information-security-policy-and-acceptable-use-policy), and we created most of them using this [free set of templates](https://github.com/JupiterOne/security-policy-templates) published by JupiterOne under Creative Commons licensing.
 
 We kept our policies as basic as possible to make sure everything in them is valuable and achievable. Having policies that state you must do the impossible is a surefire way of getting in trouble! The templates we used contained many processes and procedures as well. We used the policies and will eventually document more of our procedures in our handbook.
 
diff --git a/docs/Using Fleet/segment-hosts.md b/articles/teams.md
similarity index 87%
rename from docs/Using Fleet/segment-hosts.md
rename to articles/teams.md
index 548bb1c4cd..ea688bc08b 100644
--- a/docs/Using Fleet/segment-hosts.md	
+++ b/articles/teams.md
@@ -1,8 +1,8 @@
-# Segment hosts
+# Teams
 
 _Available in Fleet Premium_
 
-In Fleet, you can group hosts together in a "team" in Fleet. This way, you can apply queries, policies, scripts, and more that are tailored to the hosts' risk/compliance needs.
+In Fleet, you can group hosts together in a "team" in Fleet. This way, you can apply queries, policies, scripts, and more that are tailored to a host's risk/compliance needs.
 
 A host can only belong to one team. 
 
@@ -30,10 +30,13 @@ You can add hosts to a new team in Fleet by either enrolling the host with a tea
 
 ## Advanced
 
-You can automatically enroll hosts to a specific team in Fleet by installing a fleetd with a team enroll secret. Learn more [here](./enroll-hosts.md#enroll-host-to-a-specific-team).
+You can automatically enroll hosts to a specific team in Fleet by installing a fleetd with a team enroll secret. Learn more [here](https://fleetdm.com/guides/enroll-hosts#enroll-host-to-a-specific-team).
 
 Changing the host's enroll secret after enrollment will not cause the host to be transferred to a different team.
 
-<meta name="pageOrderInSection" value="1000">
+<meta name="category" value="guides">
+<meta name="authorGitHubUsername" value="noahtalerman">
+<meta name="authorFullName" value="Noah Talerman">
+<meta name="publishedOn" value="2024-07-11">
+<meta name="articleTitle" value="Teams">
 <meta name="description" value="Learn how to group hosts in Fleet to apply specific queries, policies, and agent options using teams.">
-<meta name="navSection" value="The basics">
diff --git a/docs/Using Fleet/Vulnerability-Processing.md b/articles/vulnerability-processing.md
similarity index 54%
rename from docs/Using Fleet/Vulnerability-Processing.md
rename to articles/vulnerability-processing.md
index 2e675e5735..610bd51347 100644
--- a/docs/Using Fleet/Vulnerability-Processing.md	
+++ b/articles/vulnerability-processing.md
@@ -1,7 +1,5 @@
 # Vulnerability processing
 
-## Introduction
-
 Vulnerability processing in Fleet detects vulnerabilities (CVEs) for the software installed on your hosts. 
 
 To see what software is covered, check out the [Coverage section](#coverage).
@@ -16,18 +14,27 @@ To see what software is covered, check out the [Coverage section](#coverage).
 
 Fleet detects vulnerabilities for these software types:
 
-| Type                | macOS                                      | Windows                                          | Linux            |
-| ------------------- | ------------------------------------------ | ------------------------------------------------ | ---------------- |
-| Apps                | ✅                                         | ✅                                               | ❌               |
-| Browser plugins     | Chrome extensions, Firefox extensions      | Chrome extensions, Firefox extensions            | ❌               |
-| Packages            | Python, Homebrew  | Python, Atom, Chocolatey | Packages defined in the [OVAL definitions](https://github.com/fleetdm/nvd/blob/master/oval_sources.json), except for vulnerabilities involving configuration files. Supported distributions: <ul><li>Ubuntu</li><li>RHEL based distros (Red Hat, CentOS, Fedora, and Amazon Linux)</li></ul> |
-| IDE extensions      | VS Code extensions | VS Code extensions | VS Code extensions |
+| Type                | macOS                                      | Windows                                          | Linux                                                                                                                                                                                                                                                                                                                                                  |
+| ------------------- | ------------------------------------------ | ------------------------------------------------ |--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| Apps                | ✅                                         | ✅                                               | ❌                                                                                                                                                                                                                                                                                                                                                      |
+| Browser plugins     | Chrome extensions, Firefox extensions      | Chrome extensions, Firefox extensions            | ❌                                                                                                                                                                                                                                                                                                                                                      |
+| Packages            | Python, Homebrew  | Python, Atom, Chocolatey | <p>For Ubuntu, Debian, RHEL (including CentOS), and Fedora: packages defined in the [OVAL definitions](https://github.com/fleetdm/nvd/blob/master/oval_sources.json), except for vulnerabilities involving configuration files.</p><p>For Amazon Linux, packages maintained by Amazon by checking [ALAS advisories](https://alas.aws.amazon.com/).</p> |
+| IDE extensions      | VS Code extensions | VS Code extensions | VS Code extensions                                                                                                                                                                                                                                                                                                                                     |
 
 As of right now, only app names with all ASCII characters are supported. Apps with names featuring non-ASCII characters, such as Cyrillic, will not generate matches.
 
 For Ubuntu Linux, kernel vulnerabilities with known variants (ie. `-generic`) are detected using OVAL. Custom kernels (unknown variants) are detected using NVD.
 
-### Advanced configuration
+## Sources
+
+Fleet combines multiple sources to get accurate and up-to-date CVE information:
+- [National Vulnerability Database](https://nvd.nist.gov/developers/vulnerabilities) CVE feeds
+- [VulnCheck](https://vulncheck.com/) CVE feeds
+- [Mac Office release notes](https://learn.microsoft.com/en-us/officeupdates/release-notes-office-for-mac) for Office for Mac
+- [Microsoft MSRC Security Bulletins](https://msrc.microsoft.com/update-guide) for Windows OS vulnerabilities
+- [OVAL definitions](https://github.com/fleetdm/nvd/blob/master/oval_sources.json) for Linux software
+
+## Advanced configuration
 
 Fleet runs vulnerability downloading and processing via internal scheduled cron job. This internal mechanism is very useful
 for frictionless deployments and is well suited for most use cases. However, in larger deployments,
@@ -63,6 +70,9 @@ command.
 fleet vuln_processing
 ```
 
-<meta name="pageOrderInSection" value="1300">
+<meta name="category" value="guides">
+<meta name="authorGitHubUsername" value="noahtalerman">
+<meta name="authorFullName" value="Noah Talerman">
+<meta name="publishedOn" value="2024-07-12">
+<meta name="articleTitle" value="Vulnerability processing">
 <meta name="description" value="Find out how Fleet detects vulnerabilities and what software it covers.">
-<meta name="navSection" value="Vuln management">
diff --git a/articles/windows-mdm-setup.md b/articles/windows-mdm-setup.md
index 1fb36f3bf6..87188e11ee 100644
--- a/articles/windows-mdm-setup.md
+++ b/articles/windows-mdm-setup.md
@@ -10,7 +10,7 @@ To use automatic enrollment (aka zero-touch) features on Windows, follow instruc
 
 ### Step 1: Generate your certificate and key
 
-Fleet uses a certificate and key pair to authenticate and manage interactions between Fleet and Windows host.
+Fleet uses a certificate and key pair to authenticate and manage interactions between the Fleet server and a Windows host.
 
 How to generate a certificate and key:
 
diff --git a/assets/images/iPadOS-install-profile.png b/assets/images/iPadOS-install-profile.png
new file mode 100644
index 0000000000..c398038517
Binary files /dev/null and b/assets/images/iPadOS-install-profile.png differ
diff --git a/assets/images/iPadOS-profile-downloaded.png b/assets/images/iPadOS-profile-downloaded.png
new file mode 100644
index 0000000000..f21b12615f
Binary files /dev/null and b/assets/images/iPadOS-profile-downloaded.png differ
diff --git a/assets/images/ios-install-profile.png b/assets/images/ios-install-profile.png
new file mode 100644
index 0000000000..8266c55201
Binary files /dev/null and b/assets/images/ios-install-profile.png differ
diff --git a/assets/images/ios-profile-downloaded.png b/assets/images/ios-profile-downloaded.png
new file mode 100644
index 0000000000..7941a65815
Binary files /dev/null and b/assets/images/ios-profile-downloaded.png differ
diff --git a/changes/13157-fv-escrow b/changes/13157-fv-escrow
deleted file mode 100644
index e6804a05ec..0000000000
--- a/changes/13157-fv-escrow
+++ /dev/null
@@ -1 +0,0 @@
-* `fleetd` now uses Escrow Buddy to rotate FileVault keys. Internal API endpoints documented in the API for contributors have been modified and/or removed.
diff --git a/changes/16866-ade-force-filevault b/changes/16866-ade-force-filevault
deleted file mode 100644
index 4486357bf5..0000000000
--- a/changes/16866-ade-force-filevault
+++ /dev/null
@@ -1,2 +0,0 @@
-- Adds enforcement of FileVault during the MacOS Setup Assistant process for hosts that are enrolled
-into teams (or no team) with disk encryption turned on.
\ No newline at end of file
diff --git a/changes/17249-mysql-8 b/changes/17249-mysql-8
deleted file mode 100644
index b3948968cf..0000000000
--- a/changes/17249-mysql-8
+++ /dev/null
@@ -1,2 +0,0 @@
-* Drop support for MySQL 5.7
-* Minimum requirements raised to MySQL 8.0
diff --git a/changes/17558-validation-errs b/changes/17558-validation-errs
new file mode 100644
index 0000000000..115c9bf14e
--- /dev/null
+++ b/changes/17558-validation-errs
@@ -0,0 +1,2 @@
+- Adds validation of Setup Assistant profiles on profile upload, giving users immediate feedback on
+the validity of the profile.
\ No newline at end of file
diff --git a/changes/1845-linux-arm64 b/changes/1845-linux-arm64
deleted file mode 100644
index 6ebb53ff63..0000000000
--- a/changes/1845-linux-arm64
+++ /dev/null
@@ -1,2 +0,0 @@
-* Added support for generating fleetd packages for Linux ARM64
-* fleetctl: New `fleetctl package` --arch flag
diff --git a/changes/18897-shoe-zeroes b/changes/18897-shoe-zeroes
new file mode 100644
index 0000000000..7faddd522d
--- /dev/null
+++ b/changes/18897-shoe-zeroes
@@ -0,0 +1 @@
+Added "0 items" description on empty software tables for UI consistency
diff --git a/changes/18913-ignore-rejected-cves b/changes/18913-ignore-rejected-cves
deleted file mode 100644
index 1fabe60f9f..0000000000
--- a/changes/18913-ignore-rejected-cves
+++ /dev/null
@@ -1 +0,0 @@
-CVEs identified as 'Rejected' in NVD will no longer match against software
\ No newline at end of file
diff --git a/changes/19280-maintenance-window-descriptions b/changes/19280-maintenance-window-descriptions
deleted file mode 100644
index 90848dcffe..0000000000
--- a/changes/19280-maintenance-window-descriptions
+++ /dev/null
@@ -1 +0,0 @@
-Maintenance window descriptions are now updated regularly to match the failing policy description/resolution.
diff --git a/changes/19352-calendar-real-time b/changes/19352-calendar-real-time
deleted file mode 100644
index d96cf1fa11..0000000000
--- a/changes/19352-calendar-real-time
+++ /dev/null
@@ -1,3 +0,0 @@
-- In maintenance windows using Google Calendar, calendar event is now recreated within 30 seconds if deleted or moved to the past.
-  - Fleet server watches for potential changes for up to 1 week after original event time. If event is moved forward more than 1 week, then after 1 week Fleet server will check for event changes once every 30 minutes.
-  - These near real-time updates may add additional load to the Google Calendar API, so it is recommended to use API usage alerts or other monitoring methods.
diff --git a/changes/19442-ubuntu-python-packages b/changes/19442-ubuntu-python-packages
new file mode 100644
index 0000000000..0be7e95616
--- /dev/null
+++ b/changes/19442-ubuntu-python-packages
@@ -0,0 +1 @@
+- Addressing Ubuntu python package false positive vulnerabilities by removing duplicate entries for ubuntu python packages installed by dpkg and renaming remaining pip installed packages to match OVAL definitions.
\ No newline at end of file
diff --git a/changes/19447-ios-ipados-software b/changes/19447-ios-ipados-software
deleted file mode 100644
index 26acad5131..0000000000
--- a/changes/19447-ios-ipados-software
+++ /dev/null
@@ -1,3 +0,0 @@
-- iOS and iPadOS device details refetch can now be triggered with the existing `POST /api/latest/fleet/hosts/:id/refetch` endpoint.
-- iOS and iPadOS user-installed apps can be viewed in Fleet
-- iOS and iPadOS apps can be installed using Apple's VPP (Volume Purchase Program)
diff --git a/changes/19550-software-no-teams b/changes/19550-software-no-teams
deleted file mode 100644
index 933665cd22..0000000000
--- a/changes/19550-software-no-teams
+++ /dev/null
@@ -1 +0,0 @@
-- adds support for No teams on all software pages including adding software installers
\ No newline at end of file
diff --git a/changes/19551-policy-software-automations b/changes/19551-policy-software-automations
new file mode 100644
index 0000000000..4b88cb4c1f
--- /dev/null
+++ b/changes/19551-policy-software-automations
@@ -0,0 +1 @@
+* Implement features allowing automatic installation of software on hosts that fail policies.
diff --git a/changes/19646-ui-profiles-pending-tooltip b/changes/19646-ui-profiles-pending-tooltip
deleted file mode 100644
index 824ba143c9..0000000000
--- a/changes/19646-ui-profiles-pending-tooltip
+++ /dev/null
@@ -1 +0,0 @@
-- Updated UI tooltips for pending OS settings.
diff --git a/changes/19684-renew-scep-180 b/changes/19684-renew-scep-180
deleted file mode 100644
index 131c08ff51..0000000000
--- a/changes/19684-renew-scep-180
+++ /dev/null
@@ -1 +0,0 @@
-* Increase threshold to renew Apple SCEP certificates for MDM enrollments to 180 days.
diff --git a/changes/19808-prof b/changes/19808-prof
new file mode 100644
index 0000000000..71d19f8c4b
--- /dev/null
+++ b/changes/19808-prof
@@ -0,0 +1 @@
+* Fixed bugs on enrollment profiles when the organization name contains invalid XML characters.
diff --git a/changes/19853-homebrew-intellij b/changes/19853-homebrew-intellij
deleted file mode 100644
index 713d4ae142..0000000000
--- a/changes/19853-homebrew-intellij
+++ /dev/null
@@ -1 +0,0 @@
-Fixed false negative vulnerabilities with IntelliJ IDEA CE and PyCharm CE installed via Homebrew.
diff --git a/changes/19864-vpp-token-crud b/changes/19864-vpp-token-crud
deleted file mode 100644
index ee4a92e80f..0000000000
--- a/changes/19864-vpp-token-crud
+++ /dev/null
@@ -1,2 +0,0 @@
-- Adds the functionality for the `POST /mdm/apple/vpp_token`, `DELETE /mdm/apple/vpp_token` and 
-`GET /vpp` endpoints.
\ No newline at end of file
diff --git a/changes/19865-db-schema b/changes/19865-db-schema
deleted file mode 100644
index ede5f90ed0..0000000000
--- a/changes/19865-db-schema
+++ /dev/null
@@ -1 +0,0 @@
-- Adds DB updates to support the VPP software feature.
\ No newline at end of file
diff --git a/changes/19867-get-avail-apps b/changes/19867-get-avail-apps
deleted file mode 100644
index 4ace068f95..0000000000
--- a/changes/19867-get-avail-apps
+++ /dev/null
@@ -1 +0,0 @@
-- Adds functionality for the `GET /software/app_store_apps` and `POST /software/app_store_apps` endpoints.
\ No newline at end of file
diff --git a/changes/19868-vpp-install-command b/changes/19868-vpp-install-command
deleted file mode 100644
index 337b5d5010..0000000000
--- a/changes/19868-vpp-install-command
+++ /dev/null
@@ -1 +0,0 @@
-- Adds functionality for installing App Store apps to the VPP feature.
\ No newline at end of file
diff --git a/changes/19870-vpp-activities-backend b/changes/19870-vpp-activities-backend
deleted file mode 100644
index 115f92e1fd..0000000000
--- a/changes/19870-vpp-activities-backend
+++ /dev/null
@@ -1 +0,0 @@
-- Adds global activity support for VPP related activities.
\ No newline at end of file
diff --git a/changes/19871-gitops-vpp-config b/changes/19871-gitops-vpp-config
deleted file mode 100644
index e9a02e0fa7..0000000000
--- a/changes/19871-gitops-vpp-config
+++ /dev/null
@@ -1 +0,0 @@
-* Add support for VPP to gitops config
diff --git a/changes/19880-include-vpp-apps-in-software-titles-endpoints b/changes/19880-include-vpp-apps-in-software-titles-endpoints
deleted file mode 100644
index 9503cdef99..0000000000
--- a/changes/19880-include-vpp-apps-in-software-titles-endpoints
+++ /dev/null
@@ -1,2 +0,0 @@
-* Added the associated VPP apps to the `GET /software/titles` and `GET /software/titles/:id` endpoints.
-* Added the associated VPP apps to the `GET /hosts/:id/software` and `GET /device/:token/software` endpoints.
diff --git a/changes/20042-remove-package-version b/changes/20042-remove-package-version
deleted file mode 100644
index a4a5801417..0000000000
--- a/changes/20042-remove-package-version
+++ /dev/null
@@ -1 +0,0 @@
-In `fleetctl package` command, removed the `--version` flag. The version of the package can be controlled by `--orbit-channel` flag.
diff --git a/changes/20100-os-version-compliance b/changes/20100-os-version-compliance
deleted file mode 100644
index f14334f97f..0000000000
--- a/changes/20100-os-version-compliance
+++ /dev/null
@@ -1 +0,0 @@
-- Fleet UI: Show OS version compliance on Host Details page
diff --git a/changes/20271-deleted-host-software-installs b/changes/20271-deleted-host-software-installs
deleted file mode 100644
index 674b8a823f..0000000000
--- a/changes/20271-deleted-host-software-installs
+++ /dev/null
@@ -1 +0,0 @@
-- Fig bug where software install results could not be retrieved for deleted hosts in the activity feed
diff --git a/changes/20278-vpp-batch-api b/changes/20278-vpp-batch-api
deleted file mode 100644
index e5cbbf7eca..0000000000
--- a/changes/20278-vpp-batch-api
+++ /dev/null
@@ -1 +0,0 @@
-- GitOps supports VPP app associations
diff --git a/changes/20320-uninstall-packages b/changes/20320-uninstall-packages
new file mode 100644
index 0000000000..89ab892841
--- /dev/null
+++ b/changes/20320-uninstall-packages
@@ -0,0 +1 @@
+* Implement the ability to use Fleet to uninstall packages from hosts.
\ No newline at end of file
diff --git a/changes/20370-linux-nologin b/changes/20370-linux-nologin
deleted file mode 100644
index 236418c963..0000000000
--- a/changes/20370-linux-nologin
+++ /dev/null
@@ -1 +0,0 @@
-- Linux lock/unlock scripts now make use of pam_nologin to keep AD users locked out
diff --git a/changes/20397-do-not-set-last_enrolled_at-when-enrolling-orbit b/changes/20397-do-not-set-last_enrolled_at-when-enrolling-orbit
deleted file mode 100644
index c8f305c4d1..0000000000
--- a/changes/20397-do-not-set-last_enrolled_at-when-enrolling-orbit
+++ /dev/null
@@ -1 +0,0 @@
-* Fixed a bug that set `last_enrolled_at` during orbit re-enrollment, which caused osquery enroll failures when `FLEET_OSQUERY_ENROLL_COOLDOWN` is set .
diff --git a/changes/20404-edit-software b/changes/20404-edit-software
new file mode 100644
index 0000000000..ec65b392b4
--- /dev/null
+++ b/changes/20404-edit-software
@@ -0,0 +1 @@
+* Software installer packages, self-service flag, scripts, pre-install query, and self-service availability can now be edited in-place rather than needing to be deleted and re-added.
diff --git a/changes/20440-Notion-exe-installer-name b/changes/20440-Notion-exe-installer-name
deleted file mode 100644
index bc3996cc5d..0000000000
--- a/changes/20440-Notion-exe-installer-name
+++ /dev/null
@@ -1 +0,0 @@
-* Added a special-case to properly name the Notion .exe Windows installer the same as how it will be reported by osquery post-install.
diff --git a/changes/20467-vpp-ipadios-ui b/changes/20467-vpp-ipadios-ui
deleted file mode 100644
index 2cc84e31cd..0000000000
--- a/changes/20467-vpp-ipadios-ui
+++ /dev/null
@@ -1 +0,0 @@
-* Add UI features for managing Apple VPP apps for iPadOS and iOS hosts
\ No newline at end of file
diff --git a/changes/20469-backend-ios-ipados-os-updates b/changes/20469-backend-ios-ipados-os-updates
deleted file mode 100644
index 075cca4876..0000000000
--- a/changes/20469-backend-ios-ipados-os-updates
+++ /dev/null
@@ -1 +0,0 @@
-* Adding OS updates support to iOS/iPadOS devices.
diff --git a/changes/20515-delete-vpp-app b/changes/20515-delete-vpp-app
deleted file mode 100644
index 49599edf94..0000000000
--- a/changes/20515-delete-vpp-app
+++ /dev/null
@@ -1,2 +0,0 @@
-* Added support to delete a VPP app from a team in `DELETE /software/titles/:software_title_id/available_for_install`.
-* Fixed path that was incorrect for the download software installer package endpoint `GET /software/titles/:software_title_id/package`.
diff --git a/changes/20535-sw-table-loading b/changes/20535-sw-table-loading
new file mode 100644
index 0000000000..d144ce782c
--- /dev/null
+++ b/changes/20535-sw-table-loading
@@ -0,0 +1 @@
+* Improve loading state for DataTables when no data is present yet
\ No newline at end of file
diff --git a/changes/20575-fix-profile-activities-to-include-ios-ipados b/changes/20575-fix-profile-activities-to-include-ios-ipados
deleted file mode 100644
index bf089bf489..0000000000
--- a/changes/20575-fix-profile-activities-to-include-ios-ipados
+++ /dev/null
@@ -1 +0,0 @@
-- Update profile activities to include iOS and iPadOS
diff --git a/changes/20604-hosts-page-pagination b/changes/20604-hosts-page-pagination
deleted file mode 100644
index c1f68d5f94..0000000000
--- a/changes/20604-hosts-page-pagination
+++ /dev/null
@@ -1 +0,0 @@
-* Fix a bug where hosts page would sometimes allow excess pagination
\ No newline at end of file
diff --git a/changes/20618-nil-tz-not-handled b/changes/20618-nil-tz-not-handled
deleted file mode 100644
index cbb5d0bd99..0000000000
--- a/changes/20618-nil-tz-not-handled
+++ /dev/null
@@ -1,2 +0,0 @@
-* Fix a bug where Fleet google calendar events generated by Fleet <= 4.53.0 were not correctly
-  processed by 4.54.0
\ No newline at end of file
diff --git a/changes/20683-less-columns-smaller-width b/changes/20683-less-columns-smaller-width
new file mode 100644
index 0000000000..c2e03aedde
--- /dev/null
+++ b/changes/20683-less-columns-smaller-width
@@ -0,0 +1 @@
+- UI cleanup: Host details about section condenses information into fewer columns at smaller widths
diff --git a/changes/20747-gitops-software-query b/changes/20747-gitops-software-query
deleted file mode 100644
index 100efc17f3..0000000000
--- a/changes/20747-gitops-software-query
+++ /dev/null
@@ -1 +0,0 @@
-- Use new gitops format for software pre install query
diff --git a/changes/20751-detect-held-linux-packages-as-installed b/changes/20751-detect-held-linux-packages-as-installed
deleted file mode 100644
index 6aa524ce80..0000000000
--- a/changes/20751-detect-held-linux-packages-as-installed
+++ /dev/null
@@ -1 +0,0 @@
-Linux .deb packages 'on hold' are now included in the installed software list.
diff --git a/changes/20757-profiles-batch-activity b/changes/20757-profiles-batch-activity
new file mode 100644
index 0000000000..6b110b87c7
--- /dev/null
+++ b/changes/20757-profiles-batch-activity
@@ -0,0 +1 @@
+API endpoint `/api/v1/fleet/mdm/profiles/batch` will now not log an activity for profile types that did not change in the database (Apple configuration profiles, Windows configuration profiles, or Apple declarations).
diff --git a/changes/20764-fix-cron-with-duplicate-host-uuid-windows-mdm b/changes/20764-fix-cron-with-duplicate-host-uuid-windows-mdm
new file mode 100644
index 0000000000..df19c08bc8
--- /dev/null
+++ b/changes/20764-fix-cron-with-duplicate-host-uuid-windows-mdm
@@ -0,0 +1 @@
+* Fixed an issue where cron profiles delivery fails if a Windows VM is enrolled twice with the same `host_uuid` / `mdm_device_id`.
diff --git a/changes/20828-better-appid-error b/changes/20828-better-appid-error
new file mode 100644
index 0000000000..540c8fcbfa
--- /dev/null
+++ b/changes/20828-better-appid-error
@@ -0,0 +1 @@
+- Improve clarity of gitops VPP app ID type errors
diff --git a/changes/20846-vuln-virtual-box b/changes/20846-vuln-virtual-box
new file mode 100644
index 0000000000..225dd0be22
--- /dev/null
+++ b/changes/20846-vuln-virtual-box
@@ -0,0 +1 @@
+- resolved an issue where virtual box for macOS wasn't matching against the vm_virtualbox NVD product name
\ No newline at end of file
diff --git a/changes/20865-fix-chrome-icon b/changes/20865-fix-chrome-icon
new file mode 100644
index 0000000000..9ac53c39cc
--- /dev/null
+++ b/changes/20865-fix-chrome-icon
@@ -0,0 +1 @@
+- show proper software icon for chrome packages
diff --git a/changes/20868-turn-off-mdm b/changes/20868-turn-off-mdm
new file mode 100644
index 0000000000..bfcd35d315
--- /dev/null
+++ b/changes/20868-turn-off-mdm
@@ -0,0 +1 @@
+- Improves the UX of turning off MDM on an offline host (endpoint doesn't error anymore)
\ No newline at end of file
diff --git a/changes/20895-policy-software-install-gitops b/changes/20895-policy-software-install-gitops
new file mode 100644
index 0000000000..774f6a4bfe
--- /dev/null
+++ b/changes/20895-policy-software-install-gitops
@@ -0,0 +1 @@
+* Added support for configuring policy installers via GitOps.
diff --git a/changes/20959-query-host-flow-fix-observer b/changes/20959-query-host-flow-fix-observer
new file mode 100644
index 0000000000..f1db67c3e9
--- /dev/null
+++ b/changes/20959-query-host-flow-fix-observer
@@ -0,0 +1 @@
+- Fix UI flow for observers to easily query hosts from the host details page
diff --git a/changes/21019-ota-enrollment b/changes/21019-ota-enrollment
new file mode 100644
index 0000000000..b43db060a7
--- /dev/null
+++ b/changes/21019-ota-enrollment
@@ -0,0 +1 @@
+* Implement protocol support for OTA enrollment and automatic team assignment for hosts.
diff --git a/changes/21264-fix-reserved-team-names b/changes/21264-fix-reserved-team-names
new file mode 100644
index 0000000000..6363b81869
--- /dev/null
+++ b/changes/21264-fix-reserved-team-names
@@ -0,0 +1,2 @@
+- Prevents teams with the name "All teams" or "No team" from being created (these are reserved team
+  names in Fleet).
\ No newline at end of file
diff --git a/changes/21315-vpp-premium-license b/changes/21315-vpp-premium-license
new file mode 100644
index 0000000000..2fd081703e
--- /dev/null
+++ b/changes/21315-vpp-premium-license
@@ -0,0 +1 @@
+- Verify user has premium license before uploading VPP tokens
diff --git a/changes/21402-improve-windows-mdm-enabled-error-message b/changes/21402-improve-windows-mdm-enabled-error-message
new file mode 100644
index 0000000000..36dc6082f6
--- /dev/null
+++ b/changes/21402-improve-windows-mdm-enabled-error-message
@@ -0,0 +1 @@
+- Improve gitops error message about enabling windows MDM
diff --git a/changes/21404-minio-false-positive b/changes/21404-minio-false-positive
new file mode 100644
index 0000000000..57b4245e45
--- /dev/null
+++ b/changes/21404-minio-false-positive
@@ -0,0 +1 @@
+- resolved issue where minio was reporting false positive vulnerabilities due to a mismatch in version strings 
\ No newline at end of file
diff --git a/changes/21412-remove-node-key-from-server-logs b/changes/21412-remove-node-key-from-server-logs
new file mode 100644
index 0000000000..c6555bd5bc
--- /dev/null
+++ b/changes/21412-remove-node-key-from-server-logs
@@ -0,0 +1 @@
+* Removed invalid node keys from server logs.
diff --git a/changes/21428-policy-automatic-install-software b/changes/21428-policy-automatic-install-software
new file mode 100644
index 0000000000..e61dc2a9ea
--- /dev/null
+++ b/changes/21428-policy-automatic-install-software
@@ -0,0 +1 @@
+* Added automatic installation of software packages using policy automations.
diff --git a/changes/21428-prevent-install-when-already-pending b/changes/21428-prevent-install-when-already-pending
new file mode 100644
index 0000000000..d01006d6f9
--- /dev/null
+++ b/changes/21428-prevent-install-when-already-pending
@@ -0,0 +1 @@
+* Added validation to `POST /api/_version_/fleet/hosts/{host_id}/software/install/{software_title_id}` to prevent installing on a host that already has a pending installation for that software title.
diff --git a/changes/21462-host-vulnerability-filter b/changes/21462-host-vulnerability-filter
new file mode 100644
index 0000000000..e55fb8c836
--- /dev/null
+++ b/changes/21462-host-vulnerability-filter
@@ -0,0 +1 @@
+- fixed issue where the vulnerability filter was returning software not vulnerable for the currently selected host
\ No newline at end of file
diff --git a/changes/21467-policies-for-no-team b/changes/21467-policies-for-no-team
new file mode 100644
index 0000000000..4613cd39ed
--- /dev/null
+++ b/changes/21467-policies-for-no-team
@@ -0,0 +1 @@
+* Added support for policies in "No team" that run on hosts that belong to "No team".
diff --git a/changes/21468-no-teams-policies b/changes/21468-no-teams-policies
new file mode 100644
index 0000000000..d11adda1b8
--- /dev/null
+++ b/changes/21468-no-teams-policies
@@ -0,0 +1 @@
+* Enable 'No teams' funcitonality for the policies page and associated workflows.
\ No newline at end of file
diff --git a/changes/21557-ota-profile-endpoint b/changes/21557-ota-profile-endpoint
new file mode 100644
index 0000000000..4acf2bbcf5
--- /dev/null
+++ b/changes/21557-ota-profile-endpoint
@@ -0,0 +1 @@
+- Adds an endpoint for getting an OTA MDM profile for enrolling iOS and iPadOS hosts.
\ No newline at end of file
diff --git a/changes/21559-add-end-user-enrolment-page b/changes/21559-add-end-user-enrolment-page
new file mode 100644
index 0000000000..427f1c5beb
--- /dev/null
+++ b/changes/21559-add-end-user-enrolment-page
@@ -0,0 +1 @@
+- add feature for end users to enroll their device into fleet mdm
diff --git a/changes/21612-edit-software-gitops b/changes/21612-edit-software-gitops
new file mode 100644
index 0000000000..9a157286d4
--- /dev/null
+++ b/changes/21612-edit-software-gitops
@@ -0,0 +1 @@
+* Reset install counts and cancel pending installs/uninstalls when GitOps installer updates change package contents
diff --git a/changes/21683-apns-cert-validation-on-start b/changes/21683-apns-cert-validation-on-start
new file mode 100644
index 0000000000..9f17143599
--- /dev/null
+++ b/changes/21683-apns-cert-validation-on-start
@@ -0,0 +1,2 @@
+- Removed validation of APNS certificate from server startup. This was no longer necessary because
+  we now allow for APNS certificates to be renewed in the UI.
diff --git a/changes/21779-git-false-negative b/changes/21779-git-false-negative
new file mode 100644
index 0000000000..080dfe1a4e
--- /dev/null
+++ b/changes/21779-git-false-negative
@@ -0,0 +1 @@
+- fixed a false negative vulnerability for git
\ No newline at end of file
diff --git a/changes/21796-fix-vpp-self-service-checkbox b/changes/21796-fix-vpp-self-service-checkbox
new file mode 100644
index 0000000000..6ec7e46db9
--- /dev/null
+++ b/changes/21796-fix-vpp-self-service-checkbox
@@ -0,0 +1 @@
+- Fixed self-service checkbox appearing when iOS or iPadOS app is selected.
diff --git a/changes/21813-email-err b/changes/21813-email-err
new file mode 100644
index 0000000000..a9d25ecc21
--- /dev/null
+++ b/changes/21813-email-err
@@ -0,0 +1,2 @@
+- Fixed regression: we now check if the email used to get a signed CSR is invalid (i.e. is an email
+  from a free email provider).
\ No newline at end of file
diff --git a/changes/21866-startup-expired-abm-cert b/changes/21866-startup-expired-abm-cert
new file mode 100644
index 0000000000..f9e74bb641
--- /dev/null
+++ b/changes/21866-startup-expired-abm-cert
@@ -0,0 +1,2 @@
+- Fixed issue where Fleet server could start when expired ABM cerfificate was provided as server
+  config options.
diff --git a/changes/21890-vpp-token-error b/changes/21890-vpp-token-error
new file mode 100644
index 0000000000..da03734eca
--- /dev/null
+++ b/changes/21890-vpp-token-error
@@ -0,0 +1 @@
+- Improve messaging for VPP token constraint errors
diff --git a/changes/21891-mdm-profile-fails b/changes/21891-mdm-profile-fails
new file mode 100644
index 0000000000..a01bac1649
--- /dev/null
+++ b/changes/21891-mdm-profile-fails
@@ -0,0 +1,2 @@
+- Fixes a bug where a profile wouldn't be removed from a host if it was deleted or if the host was
+  moved to another team before the profile was installed on the host.
\ No newline at end of file
diff --git a/changes/21976-update-macos-target-version-tooltip b/changes/21976-update-macos-target-version-tooltip
new file mode 100644
index 0000000000..5ae1a5ffdf
--- /dev/null
+++ b/changes/21976-update-macos-target-version-tooltip
@@ -0,0 +1 @@
+- update the macos target minimum version tooltip
diff --git a/changes/22069-gitops-async-software-batch b/changes/22069-gitops-async-software-batch
new file mode 100644
index 0000000000..35f0652fe2
--- /dev/null
+++ b/changes/22069-gitops-async-software-batch
@@ -0,0 +1 @@
+* Modified `POST /api/latest/fleet/software/batch` endpoint to be asynchronous and added a new endpoint `GET /api/latest/fleet/software/batch/{request_uuid}` to retrieve the result of the batch upload.
diff --git a/changes/22097-mdm-migration-guide b/changes/22097-mdm-migration-guide
new file mode 100644
index 0000000000..0177cf49b6
--- /dev/null
+++ b/changes/22097-mdm-migration-guide
@@ -0,0 +1 @@
+- Updates the guide for MDM migration to include the new UX in fleetd.
\ No newline at end of file
diff --git a/changes/22106-fix-software-package-name b/changes/22106-fix-software-package-name
new file mode 100644
index 0000000000..3cd87a328e
--- /dev/null
+++ b/changes/22106-fix-software-package-name
@@ -0,0 +1 @@
+- Fixed UI design bug where software package file name was not displayed as expected.
diff --git a/changes/22136-software-status-no-teams-hosts-page b/changes/22136-software-status-no-teams-hosts-page
new file mode 100644
index 0000000000..6ede268471
--- /dev/null
+++ b/changes/22136-software-status-no-teams-hosts-page
@@ -0,0 +1 @@
+* Support the software status filter for 'No teams' on the hosts page
\ No newline at end of file
diff --git a/changes/22158-scep b/changes/22158-scep
new file mode 100644
index 0000000000..ab75574680
--- /dev/null
+++ b/changes/22158-scep
@@ -0,0 +1 @@
+* Allow custom SCEP CA certificates with any kind of extendedKeyUsage attributes. 
diff --git a/changes/7476-fix-ui-overflow-os-settings-table b/changes/7476-fix-ui-overflow-os-settings-table
new file mode 100644
index 0000000000..6c95925de8
--- /dev/null
+++ b/changes/7476-fix-ui-overflow-os-settings-table
@@ -0,0 +1 @@
+- fixes UI overflow issues with OS settings table data
diff --git a/changes/api-get-host-by-identifier-exclude-software b/changes/api-get-host-by-identifier-exclude-software
deleted file mode 100644
index aa2aa5404a..0000000000
--- a/changes/api-get-host-by-identifier-exclude-software
+++ /dev/null
@@ -1 +0,0 @@
-- add exclude_software query paramter to "Get host by identifier" API
\ No newline at end of file
diff --git a/changes/apns-errors b/changes/apns-errors
new file mode 100644
index 0000000000..6de48617a1
--- /dev/null
+++ b/changes/apns-errors
@@ -0,0 +1 @@
+* Fixed logic to properly catch and log APNs errors.
diff --git a/changes/hosts-can-access-any-software b/changes/hosts-can-access-any-software
new file mode 100644
index 0000000000..0fbcae035a
--- /dev/null
+++ b/changes/hosts-can-access-any-software
@@ -0,0 +1 @@
+- Hosts can no longer access installers that aren't directly assigned to it
diff --git a/changes/issue-19691-add-vpp-token-expiry-banner b/changes/issue-19691-add-vpp-token-expiry-banner
deleted file mode 100644
index d4f14c98c6..0000000000
--- a/changes/issue-19691-add-vpp-token-expiry-banner
+++ /dev/null
@@ -1 +0,0 @@
-- add a warning banner to the UI if the uploaded VPP token is about to expire/has expired.
diff --git a/changes/issue-19866-add-remove-disable-vpp-in-ui b/changes/issue-19866-add-remove-disable-vpp-in-ui
deleted file mode 100644
index 09000dbff2..0000000000
--- a/changes/issue-19866-add-remove-disable-vpp-in-ui
+++ /dev/null
@@ -1 +0,0 @@
-- add ability to add/remove/disable vpp in the fleet UI.
diff --git a/changes/issue-19869-vpp-ui-on-software-pages b/changes/issue-19869-vpp-ui-on-software-pages
deleted file mode 100644
index 74f71d41c9..0000000000
--- a/changes/issue-19869-vpp-ui-on-software-pages
+++ /dev/null
@@ -1 +0,0 @@
-- add UI to support the apple vpp feature on the software pages.
diff --git a/changes/issue-20612-ui-updates-host-software-device-user-pages-for-vpp b/changes/issue-20612-ui-updates-host-software-device-user-pages-for-vpp
deleted file mode 100644
index 01e6073b2d..0000000000
--- a/changes/issue-20612-ui-updates-host-software-device-user-pages-for-vpp
+++ /dev/null
@@ -1 +0,0 @@
-- add UI updates for VPP feature on host software and my device pages.
diff --git a/changes/issue-20784-fix-app-wide-banner-showing b/changes/issue-20784-fix-app-wide-banner-showing
deleted file mode 100644
index 9720e4b20b..0000000000
--- a/changes/issue-20784-fix-app-wide-banner-showing
+++ /dev/null
@@ -1 +0,0 @@
-- fix an issue where the app-wide warning banners were not showing on the initial page load
diff --git a/changes/update-go1.23.1 b/changes/update-go1.23.1
new file mode 100644
index 0000000000..22a59cdc40
--- /dev/null
+++ b/changes/update-go1.23.1
@@ -0,0 +1 @@
+* Updated Go to go1.23.1
diff --git a/charts/fleet/Chart.yaml b/charts/fleet/Chart.yaml
index 6921cfc2f0..adc22108c2 100644
--- a/charts/fleet/Chart.yaml
+++ b/charts/fleet/Chart.yaml
@@ -8,7 +8,7 @@ version: v6.2.0
 home: https://github.com/fleetdm/fleet
 sources:
   - https://github.com/fleetdm/fleet.git
-appVersion: v4.54.1
+appVersion: v4.56.0
 dependencies:
   - name: mysql
     condition: mysql.enabled
diff --git a/charts/fleet/templates/_helpers.tpl b/charts/fleet/templates/_helpers.tpl
index f6c41ef3fb..fd0cfffbf9 100644
--- a/charts/fleet/templates/_helpers.tpl
+++ b/charts/fleet/templates/_helpers.tpl
@@ -23,6 +23,11 @@ If release name contains chart name it will be used as a full name.
 {{- end }}
 {{- end }}
 
+{{- define "fleet.servicename" -}}
+{{- $fullName := include "fleet.fullname" . -}}
+{{- printf "%s-service" $fullName }}
+{{- end }}
+
 {{/*
 Create chart name and version as used by the chart label.
 */}}
diff --git a/charts/fleet/templates/ingress.yaml b/charts/fleet/templates/ingress.yaml
index 0a7326d995..1a3e758a29 100644
--- a/charts/fleet/templates/ingress.yaml
+++ b/charts/fleet/templates/ingress.yaml
@@ -1,5 +1,6 @@
 {{- if .Values.ingress.enabled -}}
 {{- $fullName := include "fleet.fullname" . -}}
+{{- $serviceName := include "fleet.servicename" . -}}
 {{- $svcPort := ternary .Values.fleet.listenPort .Values.fleet.servicePort (eq .Values.fleet.servicePort nil) -}}
 {{- if and .Values.ingress.className (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) }}
   {{- if not (hasKey .Values.ingress.annotations "kubernetes.io/ingress.class") }}
@@ -49,11 +50,11 @@ spec:
             backend:
               {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }}
               service:
-                name: {{ $fullName }}
+                name: {{ $serviceName }}
                 port:
                   number: {{ $svcPort }}
               {{- else }}
-              serviceName: {{ $fullName }}
+              serviceName: {{ $serviceName }}
               servicePort: {{ $svcPort }}
               {{- end }}
           {{- end }}
diff --git a/charts/fleet/templates/job-migration.yaml b/charts/fleet/templates/job-migration.yaml
index 8226e3d29a..135dac9a63 100644
--- a/charts/fleet/templates/job-migration.yaml
+++ b/charts/fleet/templates/job-migration.yaml
@@ -18,6 +18,7 @@ metadata:
     "helm.sh/hook-delete-policy": hook-succeeded
     {{- end }}
 spec:
+  ttlSecondsAfterFinished: 100
   template:
     metadata:
 {{- with .Values.podAnnotations }}
diff --git a/charts/fleet/templates/service.yaml b/charts/fleet/templates/service.yaml
index 1a22e48fc0..fa1c13a94d 100644
--- a/charts/fleet/templates/service.yaml
+++ b/charts/fleet/templates/service.yaml
@@ -1,3 +1,4 @@
+{{- $serviceName := include "fleet.servicename" . -}}
 apiVersion: v1
 kind: Service
 metadata:
@@ -6,7 +7,7 @@ metadata:
     chart: fleet
     heritage: {{ .Release.Service }}
     release: {{ .Release.Name }}
-  name: fleet
+  name: {{ $serviceName }}
   namespace: {{ .Release.Namespace }}
 spec:
   {{- if .Values.gke.ingress.useGKEIngress }}
diff --git a/charts/fleet/values.yaml b/charts/fleet/values.yaml
index 0f8e570d09..040a539a83 100644
--- a/charts/fleet/values.yaml
+++ b/charts/fleet/values.yaml
@@ -3,7 +3,7 @@
 hostName: fleet.localhost
 replicas: 3 # The number of Fleet instances to deploy
 imageRepository: fleetdm/fleet
-imageTag: v4.54.1 # Version of Fleet to deploy
+imageTag: v4.56.0 # Version of Fleet to deploy
 podAnnotations: {} # Additional annotations to add to the Fleet pod
 serviceAccountAnnotations: {} # Additional annotations to add to the Fleet service account
 resources:
@@ -212,7 +212,7 @@ environments:
   # The following environment variable is required if you are using
   # Fleet's macOS MDM features.  In a production environment, it is recommended that
   # you store this private key in a secret and use envsFrom to reference the secret below.
-  # To more information: https://fleetdm.com/docs/using-fleet/fleet-server-configuration#server-private-key
+  # For more information, check out the docs: https://fleetdm.com/docs/configuration/fleet-server-configuration#server-private-key
   FLEET_SERVER_PRIVATE_KEY: ""
 
 ## Section: Environment Variables from Secrets/CMs
diff --git a/cmd/fleet/cron.go b/cmd/fleet/cron.go
index 0cdcd66277..3b42a53567 100644
--- a/cmd/fleet/cron.go
+++ b/cmd/fleet/cron.go
@@ -11,6 +11,7 @@ import (
 	"strings"
 	"time"
 
+	eeservice "github.com/fleetdm/fleet/v4/ee/server/service"
 	eewebhooks "github.com/fleetdm/fleet/v4/ee/server/webhooks"
 	"github.com/fleetdm/fleet/v4/server"
 	"github.com/fleetdm/fleet/v4/server/config"
@@ -28,6 +29,7 @@ import (
 	"github.com/fleetdm/fleet/v4/server/service/externalsvc"
 	"github.com/fleetdm/fleet/v4/server/service/schedule"
 	"github.com/fleetdm/fleet/v4/server/vulnerabilities/customcve"
+	"github.com/fleetdm/fleet/v4/server/vulnerabilities/goval_dictionary"
 	"github.com/fleetdm/fleet/v4/server/vulnerabilities/macoffice"
 	"github.com/fleetdm/fleet/v4/server/vulnerabilities/msrc"
 	"github.com/fleetdm/fleet/v4/server/vulnerabilities/nvd"
@@ -37,7 +39,6 @@ import (
 	"github.com/fleetdm/fleet/v4/server/worker"
 	kitlog "github.com/go-kit/log"
 	"github.com/go-kit/log/level"
-	"github.com/google/uuid"
 	"github.com/hashicorp/go-multierror"
 )
 
@@ -159,6 +160,7 @@ func scanVulnerabilities(
 
 	nvdVulns := checkNVDVulnerabilities(ctx, ds, logger, vulnPath, config, vulnAutomationEnabled != "")
 	ovalVulns := checkOvalVulnerabilities(ctx, ds, logger, vulnPath, config, vulnAutomationEnabled != "")
+	govalDictVulns := checkGovalDictionaryVulnerabilities(ctx, ds, logger, vulnPath, config, vulnAutomationEnabled != "")
 	macOfficeVulns := checkMacOfficeVulnerabilities(ctx, ds, logger, vulnPath, config, vulnAutomationEnabled != "")
 	customVulns := checkCustomVulnerabilities(ctx, ds, logger, config, vulnAutomationEnabled != "")
 
@@ -173,6 +175,7 @@ func scanVulnerabilities(
 	vulns = append(vulns, nvdVulns...)
 	vulns = append(vulns, ovalVulns...)
 	vulns = append(vulns, macOfficeVulns...)
+	vulns = append(vulns, govalDictVulns...)
 	vulns = append(vulns, customVulns...)
 
 	meta, err := ds.ListCVEs(ctx, config.RecentVulnerabilityMaxAge)
@@ -345,6 +348,11 @@ func checkOvalVulnerabilities(
 	for _, version := range versions.OSVersions {
 		start := time.Now()
 		r, err := oval.Analyze(ctx, ds, version, vulnPath, collectVulns)
+		if err != nil && errors.Is(err, oval.ErrUnsupportedPlatform) {
+			level.Debug(logger).Log("msg", "oval-analysis-unsupported", "platform", version.Name)
+			continue
+		}
+
 		elapsed := time.Since(start)
 		level.Debug(logger).Log(
 			"msg", "oval-analysis-done",
@@ -360,6 +368,57 @@ func checkOvalVulnerabilities(
 	return results
 }
 
+func checkGovalDictionaryVulnerabilities(
+	ctx context.Context,
+	ds fleet.Datastore,
+	logger kitlog.Logger,
+	vulnPath string,
+	config *config.VulnerabilitiesConfig,
+	collectVulns bool,
+) []fleet.SoftwareVulnerability {
+	var results []fleet.SoftwareVulnerability
+
+	// Get Platforms
+	versions, err := ds.OSVersions(ctx, nil, nil, nil, nil)
+	if err != nil {
+		errHandler(ctx, logger, "listing platforms for goval_dictionary pulls", err)
+		return nil
+	}
+
+	if !config.DisableDataSync {
+		// Sync on disk goval_dictionary sqlite with current OS Versions.
+		downloaded, err := goval_dictionary.Refresh(versions, vulnPath, logger)
+		if err != nil {
+			errHandler(ctx, logger, "updating goval_dictionary databases", err)
+		}
+		for _, d := range downloaded {
+			level.Debug(logger).Log("goval_dictionary-sync-downloaded", d)
+		}
+	}
+
+	// Analyze all supported os versions using the synced goval_dictionary definitions.
+	for _, version := range versions.OSVersions {
+		start := time.Now()
+		r, err := goval_dictionary.Analyze(ctx, ds, version, vulnPath, collectVulns, logger)
+		if err != nil && errors.Is(err, goval_dictionary.ErrUnsupportedPlatform) {
+			level.Debug(logger).Log("msg", "goval_dictionary-analysis-unsupported", "platform", version.Name)
+			continue
+		}
+		elapsed := time.Since(start)
+		level.Debug(logger).Log(
+			"msg", "goval_dictionary-analysis-done",
+			"platform", version.Name,
+			"elapsed", elapsed,
+			"found new", len(r))
+		results = append(results, r...)
+		if err != nil {
+			errHandler(ctx, logger, "analyzing goval_dictionary definitions", err)
+		}
+	}
+
+	return results
+}
+
 func checkNVDVulnerabilities(
 	ctx context.Context,
 	ds fleet.Datastore,
@@ -625,7 +684,11 @@ func newWorkerIntegrationsSchedule(
 		Log:       logger,
 		Commander: commander,
 	}
-	w.Register(jira, zendesk, macosSetupAsst, appleMDM)
+	dbMigrate := &worker.DBMigration{
+		Datastore: ds,
+		Log:       logger,
+	}
+	w.Register(jira, zendesk, macosSetupAsst, appleMDM, dbMigrate)
 
 	// Read app config a first time before starting, to clear up any failer client
 	// configuration if we're not on a fleet-owned server. Technically, the ServerURL
@@ -735,6 +798,7 @@ func newCleanupsAndAggregationSchedule(
 	config *config.FleetConfig,
 	commander *apple_mdm.MDMAppleCommander,
 	softwareInstallStore fleet.SoftwareInstallerStore,
+	bootstrapPackageStore fleet.MDMBootstrapPackageStore,
 ) (*schedule.Schedule, error) {
 	const (
 		name            = string(fleet.CronCleanupsThenAggregation)
@@ -882,7 +946,19 @@ func newCleanupsAndAggregationSchedule(
 			return ds.CleanupActivitiesAndAssociatedData(ctx, maxCount, appConfig.ActivityExpirySettings.ActivityExpiryWindow)
 		}),
 		schedule.WithJob("cleanup_unused_software_installers", func(ctx context.Context) error {
-			return ds.CleanupUnusedSoftwareInstallers(ctx, softwareInstallStore)
+			// remove only those unused created more than a minute ago to avoid a
+			// race where we delete those created after the mysql query to get those
+			// in use.
+			return ds.CleanupUnusedSoftwareInstallers(ctx, softwareInstallStore, time.Now().Add(-time.Minute))
+		}),
+		schedule.WithJob("cleanup_unused_bootstrap_packages", func(ctx context.Context) error {
+			// remove only those unused created more than a minute ago to avoid a
+			// race where we delete those created after the mysql query to get those
+			// in use.
+			return ds.CleanupUnusedBootstrapPackages(ctx, bootstrapPackageStore, time.Now().Add(-time.Minute))
+		}),
+		schedule.WithJob("cleanup_host_mdm_commands", func(ctx context.Context) error {
+			return ds.CleanupHostMDMCommands(ctx)
 		}),
 	)
 
@@ -936,7 +1012,6 @@ func verifyDiskEncryptionKeys(
 	logger kitlog.Logger,
 	ds fleet.Datastore,
 ) error {
-
 	appCfg, err := ds.AppConfig(ctx)
 	if err != nil {
 		logger.Log("err", "unable to get app config", "details", err)
@@ -1050,31 +1125,59 @@ func newAppleMDMDEPProfileAssigner(
 ) (*schedule.Schedule, error) {
 	const name = string(fleet.CronAppleMDMDEPProfileAssigner)
 	logger = kitlog.With(logger, "cron", name, "component", "nanodep-syncer")
-	var fleetSyncer *apple_mdm.DEPService
 	s := schedule.New(
 		ctx, name, instanceID, periodicity, ds, ds,
 		schedule.WithLogger(logger),
-		schedule.WithJob("dep_syncer", func(ctx context.Context) error {
-			appCfg, err := ds.AppConfig(ctx)
-			if err != nil {
-				return ctxerr.Wrap(ctx, err, "retrieving app config")
-			}
-
-			if !appCfg.MDM.AppleBMEnabledAndConfigured {
-				return nil
-			}
-
-			if fleetSyncer == nil {
-				fleetSyncer = apple_mdm.NewDEPService(ds, depStorage, logger)
-			}
-
-			return fleetSyncer.RunAssigner(ctx)
-		}),
+		schedule.WithJob("dep_syncer", appleMDMDEPSyncerJob(ds, depStorage, logger)),
 	)
 
 	return s, nil
 }
 
+func appleMDMDEPSyncerJob(
+	ds fleet.Datastore,
+	depStorage *mysql.NanoDEPStorage,
+	logger kitlog.Logger,
+) func(context.Context) error {
+	var fleetSyncer *apple_mdm.DEPService
+	return func(ctx context.Context) error {
+		appCfg, err := ds.AppConfig(ctx)
+		if err != nil {
+			return ctxerr.Wrap(ctx, err, "retrieving app config")
+		}
+
+		if !appCfg.MDM.AppleBMEnabledAndConfigured {
+			return nil
+		}
+
+		// As part of the DB migration of the single ABM token to the multi-ABM
+		// token world (where the token was migrated from mdm_config_assets to
+		// abm_tokens), we need to complete migration of the existing token as
+		// during the DB migration we didn't have the organization name, apple id
+		// and renewal date.
+		incompleteToken, err := ds.GetABMTokenByOrgName(ctx, "")
+		if err != nil && !fleet.IsNotFound(err) {
+			return ctxerr.Wrap(ctx, err, "retrieving migrated ABM token")
+		}
+		if incompleteToken != nil {
+			logger.Log("msg", "migrated ABM token found, updating its metadata")
+			if err := apple_mdm.SetABMTokenMetadata(ctx, incompleteToken, depStorage, ds, logger); err != nil {
+				return ctxerr.Wrap(ctx, err, "updating migrated ABM token metadata")
+			}
+			if err := ds.SaveABMToken(ctx, incompleteToken); err != nil {
+				return ctxerr.Wrap(ctx, err, "saving updated migrated ABM token")
+			}
+			logger.Log("msg", "completed migration of existing ABM token")
+		}
+
+		if fleetSyncer == nil {
+			fleetSyncer = apple_mdm.NewDEPService(ds, depStorage, logger)
+		}
+
+		return fleetSyncer.RunAssigner(ctx)
+	}
+}
+
 func newMDMProfileManager(
 	ctx context.Context,
 	instanceID string,
@@ -1115,17 +1218,16 @@ func newMDMAPNsPusher(
 	commander *apple_mdm.MDMAppleCommander,
 	logger kitlog.Logger,
 ) (*schedule.Schedule, error) {
-
 	const name = string(fleet.CronAppleMDMAPNsPusher)
 
-	var interval = 1 * time.Minute
+	interval := 1 * time.Minute
 	if intervalEnv := os.Getenv("FLEET_DEV_CUSTOM_APNS_PUSHER_INTERVAL"); intervalEnv != "" {
 		var err error
 		interval, err = time.ParseDuration(intervalEnv)
 		if err != nil {
-			return nil, ctxerr.Wrap(ctx, err, "invalid duration provided in env var FLEET_DEV_CUSTOM_APNS_PUSHER_INTERVAL")
+			level.Warn(logger).Log("msg", "invalid duration provided for FLEET_DEV_CUSTOM_APNS_PUSHER_INTERVAL, using default interval")
+			interval = 1 * time.Minute
 		}
-
 	}
 
 	logger = kitlog.With(logger, "cron", name)
@@ -1285,37 +1387,34 @@ func newIPhoneIPadRefetcher(
 		ctx, name, instanceID, periodicity, ds, ds,
 		schedule.WithLogger(logger),
 		schedule.WithJob("cron_iphone_ipad_refetcher", func(ctx context.Context) error {
-			appCfg, err := ds.AppConfig(ctx)
-			if err != nil {
-				return ctxerr.Wrap(ctx, err, "fetching app config")
-			}
-
-			if !appCfg.MDM.EnabledAndConfigured {
-				level.Debug(logger).Log("msg", "apple mdm is not configured, skipping run")
-				return nil
-			}
-
-			start := time.Now()
-			uuids, err := ds.ListIOSAndIPadOSToRefetch(ctx, 1*time.Hour)
-			if err != nil {
-				return ctxerr.Wrap(ctx, err, "list ios and ipad devices to refetch")
-			}
-			if len(uuids) == 0 {
-				return nil
-			}
-			logger.Log("msg", "sending commands to refetch", "count", len(uuids), "lookup-duration", time.Since(start))
-			commandUUID := fleet.RefetchCommandUUIDPrefix + uuid.NewString()
-			err = commander.InstalledApplicationList(ctx, uuids, fleet.RefetchAppsCommandUUIDPrefix+commandUUID)
-			if err != nil {
-				return ctxerr.Wrap(ctx, err, "send InstalledApplicationList commands to ios and ipados devices")
-			}
-			// DeviceInformation is last because the refetch response clears the refetch_requested flag
-			if err := commander.DeviceInformation(ctx, uuids, fleet.RefetchCommandUUIDPrefix+commandUUID); err != nil {
-				return ctxerr.Wrap(ctx, err, "send DeviceInformation commands to ios and ipados devices")
-			}
-			return nil
+			return apple_mdm.IOSiPadOSRefetch(ctx, ds, commander, logger)
 		}),
 	)
 
 	return s, nil
 }
+
+// cronUninstallSoftwareMigration will update uninstall scripts for software.
+// Once all customers are using on Fleet 4.57 or later, this job can be removed.
+func cronUninstallSoftwareMigration(
+	ctx context.Context,
+	instanceID string,
+	ds fleet.Datastore,
+	softwareInstallStore fleet.SoftwareInstallerStore,
+	logger kitlog.Logger,
+) (*schedule.Schedule, error) {
+	const (
+		name            = string(fleet.CronUninstallSoftwareMigration)
+		defaultInterval = 24 * time.Hour
+	)
+	logger = kitlog.With(logger, "cron", name, "component", name)
+	s := schedule.New(
+		ctx, name, instanceID, defaultInterval, ds, ds,
+		schedule.WithLogger(logger),
+		schedule.WithRunOnce(true),
+		schedule.WithJob(name, func(ctx context.Context) error {
+			return eeservice.UninstallSoftwareMigration(ctx, ds, softwareInstallStore, logger)
+		}),
+	)
+	return s, nil
+}
diff --git a/cmd/fleet/cron_test.go b/cmd/fleet/cron_test.go
index dd31dd2bec..789b38c405 100644
--- a/cmd/fleet/cron_test.go
+++ b/cmd/fleet/cron_test.go
@@ -2,13 +2,24 @@ package main
 
 import (
 	"context"
+	"database/sql"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
 	"testing"
 
 	"github.com/stretchr/testify/require"
 
+	"github.com/fleetdm/fleet/v4/server/datastore/mysql"
+	"github.com/fleetdm/fleet/v4/server/fleet"
 	apple_mdm "github.com/fleetdm/fleet/v4/server/mdm/apple"
+	nanodep_client "github.com/fleetdm/fleet/v4/server/mdm/nanodep/client"
+	"github.com/fleetdm/fleet/v4/server/mdm/nanodep/godep"
 	"github.com/fleetdm/fleet/v4/server/mock"
 	mdmmock "github.com/fleetdm/fleet/v4/server/mock/mdm"
+	"github.com/fleetdm/fleet/v4/server/test"
+	"github.com/go-kit/log"
 	kitlog "github.com/go-kit/log"
 )
 
@@ -23,3 +34,93 @@ func TestNewMDMProfileManagerWithoutConfig(t *testing.T) {
 	require.NotNil(t, sch)
 	require.NoError(t, err)
 }
+
+func TestMigrateABMTokenDuringDEPCronJob(t *testing.T) {
+	ctx := context.Background()
+	ds := mysql.CreateMySQLDS(t)
+
+	depStorage, err := ds.NewMDMAppleDEPStorage()
+	require.NoError(t, err)
+	// to avoid issues with syncer, use that constant as org name for now
+	const tokenOrgName = "fleet"
+
+	// insert an ABM token as if it had been migrated by the DB migration script
+	tok := mysql.SetTestABMAssets(t, ds, "")
+	// tok, err := ds.InsertABMToken(ctx, &fleet.ABMToken{EncryptedToken: abmToken, RenewAt: time.Date(2000, 1, 1, 0, 0, 0, 0, time.UTC)})
+	// require.NoError(t, err)
+	require.Empty(t, tok.OrganizationName)
+
+	// start a server that will mock the Apple DEP API
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		encoder := json.NewEncoder(w)
+		switch r.URL.Path {
+		case "/session":
+			_, _ = w.Write([]byte(`{"auth_session_token": "session123"}`))
+		case "/account":
+			_, _ = w.Write([]byte(fmt.Sprintf(`{"admin_id": "admin123", "org_name": "%s"}`, tokenOrgName)))
+		case "/profile":
+			err := encoder.Encode(godep.ProfileResponse{ProfileUUID: "profile123"})
+			require.NoError(t, err)
+		case "/server/devices":
+			err := encoder.Encode(godep.DeviceResponse{Devices: nil})
+			require.NoError(t, err)
+		case "/devices/sync":
+			err := encoder.Encode(godep.DeviceResponse{Devices: nil})
+			require.NoError(t, err)
+		default:
+			t.Errorf("unexpected request to %s", r.URL.Path)
+		}
+	}))
+	t.Cleanup(srv.Close)
+
+	err = depStorage.StoreConfig(ctx, tokenOrgName, &nanodep_client.Config{BaseURL: srv.URL})
+	require.NoError(t, err)
+	err = depStorage.StoreConfig(ctx, apple_mdm.UnsavedABMTokenOrgName, &nanodep_client.Config{BaseURL: srv.URL})
+	require.NoError(t, err)
+
+	logger := log.NewNopLogger()
+	syncFn := appleMDMDEPSyncerJob(ds, depStorage, logger)
+	err = syncFn(ctx)
+	require.NoError(t, err)
+
+	// token has been updated with its org name/apple id
+	tok, err = ds.GetABMTokenByOrgName(ctx, tokenOrgName)
+	require.NoError(t, err)
+	require.Equal(t, tokenOrgName, tok.OrganizationName)
+	require.Equal(t, "admin123", tok.AppleID)
+	require.Nil(t, tok.MacOSDefaultTeamID)
+	require.Nil(t, tok.IOSDefaultTeamID)
+	require.Nil(t, tok.IPadOSDefaultTeamID)
+
+	// empty-name token does not exist anymore
+	_, err = ds.GetABMTokenByOrgName(ctx, "")
+	require.Error(t, err)
+	var nfe fleet.NotFoundError
+	require.ErrorAs(t, err, &nfe)
+
+	// the default profile was created
+	defProf, err := ds.GetMDMAppleEnrollmentProfileByType(ctx, fleet.MDMAppleEnrollmentTypeAutomatic)
+	require.NoError(t, err)
+	require.NotNil(t, defProf)
+	require.NotEmpty(t, defProf.Token)
+
+	// no profile UUID was assigned for no-team (because there are no hosts right now)
+	_, _, err = ds.GetMDMAppleDefaultSetupAssistant(ctx, nil, "")
+	require.Error(t, err)
+	require.ErrorAs(t, err, &nfe)
+
+	// no teams, so no team-specific custom setup assistants
+	teams, err := ds.ListTeams(ctx, fleet.TeamFilter{User: test.UserAdmin}, fleet.ListOptions{})
+	require.NoError(t, err)
+	require.Empty(t, teams)
+
+	// no no-team custom setup assistant
+	_, err = ds.GetMDMAppleSetupAssistant(ctx, nil)
+	require.ErrorIs(t, err, sql.ErrNoRows)
+
+	// no host got created
+	hosts, err := ds.ListHosts(ctx, fleet.TeamFilter{User: test.UserAdmin}, fleet.HostListOptions{})
+	require.NoError(t, err)
+	require.Empty(t, hosts)
+}
diff --git a/cmd/fleet/main.go b/cmd/fleet/main.go
index eff64d3562..b39cbc2ee9 100644
--- a/cmd/fleet/main.go
+++ b/cmd/fleet/main.go
@@ -2,11 +2,14 @@ package main
 
 import (
 	"fmt"
+	"io"
 	"math/rand"
 	"os"
 	"time"
 
+	"github.com/briandowns/spinner"
 	"github.com/fleetdm/fleet/v4/server/config"
+	"github.com/fleetdm/fleet/v4/server/shellquote"
 	kitlog "github.com/go-kit/log"
 	"github.com/go-kit/log/level"
 	_ "github.com/go-sql-driver/mysql"
@@ -29,6 +32,35 @@ func main() {
 	rootCmd.AddCommand(createConfigDumpCmd(configManager))
 	rootCmd.AddCommand(createVersionCmd(configManager))
 
+	// See if the program is being piped data on stdin.
+	fi, err := os.Stdin.Stat()
+	if err != nil {
+		initFatal(err, "getting stdin stats")
+	}
+	if fi.Mode()&os.ModeNamedPipe != 0 {
+		_, _ = fmt.Fprintln(os.Stderr, "Reading additional arguments from stdin...")
+		// See charsets at https://godoc.org/github.com/briandowns/spinner#pkg-variables
+		s := spinner.New(spinner.CharSets[24], 200*time.Millisecond)
+		s.Writer = os.Stderr
+		s.Start()
+
+		data, err := io.ReadAll(os.Stdin)
+		if err != nil {
+			initFatal(err, "reading from stdin")
+		}
+
+		// Split the string into arguments like a shell would.
+		extraArgs, err := shellquote.Split(string(data))
+		if err != nil {
+			initFatal(err, "splitting arguments from stdin")
+		}
+
+		// Add the new args to the existing args
+		os.Args = append(os.Args, extraArgs...)
+
+		s.Stop()
+	}
+
 	if err := rootCmd.Execute(); err != nil {
 		initFatal(err, "running root command")
 	}
diff --git a/cmd/fleet/serve.go b/cmd/fleet/serve.go
index 5c8a3db664..eda0660a73 100644
--- a/cmd/fleet/serve.go
+++ b/cmd/fleet/serve.go
@@ -22,7 +22,6 @@ import (
 	"github.com/e-dard/netbug"
 	"github.com/fleetdm/fleet/v4/ee/server/licensing"
 	eeservice "github.com/fleetdm/fleet/v4/ee/server/service"
-	"github.com/fleetdm/fleet/v4/pkg/certificate"
 	"github.com/fleetdm/fleet/v4/pkg/scripts"
 	"github.com/fleetdm/fleet/v4/server"
 	configpkg "github.com/fleetdm/fleet/v4/server/config"
@@ -50,6 +49,7 @@ import (
 	"github.com/fleetdm/fleet/v4/server/pubsub"
 	"github.com/fleetdm/fleet/v4/server/service"
 	"github.com/fleetdm/fleet/v4/server/service/async"
+	"github.com/fleetdm/fleet/v4/server/service/redis_key_value"
 	"github.com/fleetdm/fleet/v4/server/service/redis_lock"
 	"github.com/fleetdm/fleet/v4/server/service/redis_policy_set"
 	"github.com/fleetdm/fleet/v4/server/sso"
@@ -75,7 +75,10 @@ import (
 
 var allowedURLPrefixRegexp = regexp.MustCompile("^(?:/[a-zA-Z0-9_.~-]+)+$")
 
-const softwareInstallerUploadTimeout = 4 * time.Minute
+const (
+	softwareInstallerUploadTimeout = 4 * time.Minute
+	liveQueryMemCacheDuration      = 1 * time.Second
+)
 
 type initializer interface {
 	// Initialize is used to populate a datastore with
@@ -125,6 +128,10 @@ the way that the Fleet server works.
 
 			logger := initLogger(config)
 
+			if dev {
+				createTestBucketForInstallers(&config, logger)
+			}
+
 			// Init tracing
 			if config.Logging.TracingEnabled {
 				ctx := context.Background()
@@ -346,7 +353,7 @@ the way that the Fleet server works.
 			resultStore := pubsub.NewRedisQueryResults(redisPool, config.Redis.DuplicateResults,
 				log.With(logger, "component", "query-results"),
 			)
-			liveQueryStore := live_query.NewRedisLiveQuery(redisPool)
+			liveQueryStore := live_query.NewRedisLiveQuery(redisPool, logger, liveQueryMemCacheDuration)
 			ssoSessionStore := sso.NewSessionStore(redisPool)
 
 			// Set common configuration for all logging.
@@ -493,97 +500,6 @@ the way that the Fleet server works.
 				mdmPushService = nanomdm_pushsvc.New(mdmStorage, mdmStorage, pushProviderFactory, nanoMDMLogger)
 			}
 
-			// validate Apple APNs/SCEP config
-			if config.MDM.IsAppleAPNsSet() || config.MDM.IsAppleSCEPSet() {
-				if !config.MDM.IsAppleAPNsSet() {
-					initFatal(errors.New("Apple APNs MDM configuration must be provided when Apple SCEP is provided"), "validate Apple MDM")
-				} else if !config.MDM.IsAppleSCEPSet() {
-					initFatal(errors.New("Apple SCEP MDM configuration must be provided when Apple APNs is provided"), "validate Apple MDM")
-				}
-
-				if len(config.Server.PrivateKey) == 0 {
-					initFatal(errors.New("inserting APNs and SCEP assets"), "missing required private key. Learn how to configure the private key here: https://fleetdm.com/learn-more-about/fleet-server-private-key")
-				}
-
-				apnsCert, apnsCertPEM, apnsKeyPEM, err := config.MDM.AppleAPNs()
-				if err != nil {
-					initFatal(err, "validate Apple APNs certificate and key")
-				}
-
-				_, appleSCEPCertPEM, appleSCEPKeyPEM, err := config.MDM.AppleSCEP()
-				if err != nil {
-					initFatal(err, "validate Apple SCEP certificate and key")
-				}
-
-				const (
-					apnsConnectionTimeout = 10 * time.Second
-					apnsConnectionURL     = "https://api.sandbox.push.apple.com"
-				)
-
-				// check that the Apple APNs certificate is valid to connect to the API
-				ctx, cancel := context.WithTimeout(context.Background(), apnsConnectionTimeout)
-				if err := certificate.ValidateClientAuthTLSConnection(ctx, apnsCert, apnsConnectionURL); err != nil {
-					initFatal(err, "validate authentication with Apple APNs certificate")
-				}
-				cancel()
-
-				err = ds.InsertMDMConfigAssets(context.Background(), []fleet.MDMConfigAsset{
-					{Name: fleet.MDMAssetAPNSCert, Value: apnsCertPEM},
-					{Name: fleet.MDMAssetAPNSKey, Value: apnsKeyPEM},
-					{Name: fleet.MDMAssetCACert, Value: appleSCEPCertPEM},
-					{Name: fleet.MDMAssetCAKey, Value: appleSCEPKeyPEM},
-				})
-				if err != nil {
-					// duplicate key errors mean that we already
-					// have a value for those keys in the
-					// database, fail to initalize on other
-					// cases.
-					if !mysql.IsDuplicate(err) {
-						initFatal(err, "inserting MDM APNs and SCEP assets")
-					}
-
-					level.Warn(logger).Log("msg", "Your server already has stored SCEP and APNs certificates. Fleet will ignore any certificates provided via environment variables when this happens.")
-				}
-			}
-
-			// validate Apple BM config
-			if config.MDM.IsAppleBMSet() {
-				if !license.IsPremium() {
-					initFatal(errors.New("Apple Business Manager configuration is only available in Fleet Premium"), "validate Apple BM")
-				}
-
-				if len(config.Server.PrivateKey) == 0 {
-					initFatal(errors.New("inserting MDM ABM assets"), "missing required private key. Learn how to configure the private key here: https://fleetdm.com/learn-more-about/fleet-server-private-key")
-				}
-
-				appleBM, err := config.MDM.AppleBM()
-				if err != nil {
-					initFatal(err, "validate Apple BM token, certificate and key")
-				}
-
-				err = ds.InsertMDMConfigAssets(context.Background(), []fleet.MDMConfigAsset{
-					{Name: fleet.MDMAssetABMKey, Value: appleBM.KeyPEM},
-					{Name: fleet.MDMAssetABMCert, Value: appleBM.CertPEM},
-					{Name: fleet.MDMAssetABMToken, Value: appleBM.EncryptedToken},
-				})
-				if err != nil {
-					// duplicate key errors mean that we already
-					// have a value for those keys in the
-					// database, fail to initalize on other
-					// cases.
-					if !mysql.IsDuplicate(err) {
-						initFatal(err, "inserting MDM ABM assets")
-					}
-
-					level.Warn(logger).Log("msg", "Your server already has stored ABM certificates and token. Fleet will ignore any certificates provided via environment variables when this happens.")
-				}
-			}
-
-			appCfg, err := ds.AppConfig(context.Background())
-			if err != nil {
-				initFatal(err, "loading app config")
-			}
-
 			checkMDMAssets := func(names []fleet.MDMAssetName) (bool, error) {
 				_, err = ds.GetAllMDMConfigAssetsByName(context.Background(), names)
 				if err != nil {
@@ -595,6 +511,131 @@ the way that the Fleet server works.
 				return true, nil
 			}
 
+			// reconcile Apple Business Manager configuration environment variables with the database
+			if config.MDM.IsAppleAPNsSet() || config.MDM.IsAppleSCEPSet() {
+				if len(config.Server.PrivateKey) == 0 {
+					initFatal(errors.New("inserting MDM APNs and SCEP assets"), "missing required private key. Learn how to configure the private key here: https://fleetdm.com/learn-more-about/fleet-server-private-key")
+				}
+
+				// first we'll check if the APNs and SCEP assets are already in the database and
+				// only insert config values if they're not already present in the database
+				toInsert := make(map[fleet.MDMAssetName]struct{}, 4)
+
+				// check DB for APNs assets
+				found, err := checkMDMAssets([]fleet.MDMAssetName{fleet.MDMAssetAPNSCert, fleet.MDMAssetAPNSKey})
+				switch {
+				case err != nil:
+					initFatal(err, "reading APNs assets from database")
+				case !found:
+					toInsert[fleet.MDMAssetAPNSCert] = struct{}{}
+					toInsert[fleet.MDMAssetAPNSKey] = struct{}{}
+				default:
+					level.Warn(logger).Log("msg", "Your server already has stored APNs certificates. Fleet will ignore any certificates provided via environment variables when this happens.")
+				}
+
+				// check DB for SCEP assets
+				found, err = checkMDMAssets([]fleet.MDMAssetName{fleet.MDMAssetCACert, fleet.MDMAssetCAKey})
+				switch {
+				case err != nil:
+					initFatal(err, "reading SCEP assets from database")
+				case !found:
+					toInsert[fleet.MDMAssetCACert] = struct{}{}
+					toInsert[fleet.MDMAssetCAKey] = struct{}{}
+				default:
+					level.Warn(logger).Log("msg", "Your server already has stored SCEP certificates. Fleet will ignore any certificates provided via environment variables when this happens.")
+				}
+
+				if len(toInsert) > 0 {
+					if !config.MDM.IsAppleAPNsSet() {
+						initFatal(errors.New("Apple APNs MDM configuration must be provided when Apple SCEP is provided"), "validate Apple MDM")
+					} else if !config.MDM.IsAppleSCEPSet() {
+						initFatal(errors.New("Apple SCEP MDM configuration must be provided when Apple APNs is provided"), "validate Apple MDM")
+					}
+
+					// parse the APNs and SCEP assets from the config
+					_, apnsCertPEM, apnsKeyPEM, err := config.MDM.AppleAPNs()
+					if err != nil {
+						initFatal(err, "parse Apple APNs certificate and key from config")
+					}
+					_, appleSCEPCertPEM, appleSCEPKeyPEM, err := config.MDM.AppleSCEP()
+					if err != nil {
+						initFatal(err, "load Apple SCEP certificate and key from config")
+					}
+
+					var args []fleet.MDMConfigAsset
+					for name := range toInsert {
+						switch name {
+						case fleet.MDMAssetAPNSCert:
+							args = append(args, fleet.MDMConfigAsset{Name: name, Value: apnsCertPEM})
+						case fleet.MDMAssetAPNSKey:
+							args = append(args, fleet.MDMConfigAsset{Name: name, Value: apnsKeyPEM})
+						case fleet.MDMAssetCACert:
+							args = append(args, fleet.MDMConfigAsset{Name: name, Value: appleSCEPCertPEM})
+						case fleet.MDMAssetCAKey:
+							args = append(args, fleet.MDMConfigAsset{Name: name, Value: appleSCEPKeyPEM})
+						}
+					}
+
+					if err := ds.InsertMDMConfigAssets(context.Background(), args); err != nil {
+						if mysql.IsDuplicate(err) {
+							// we already checked for existing assets so we should never have a duplicate key error here; we'll add a debug log just in case
+							level.Debug(logger).Log("msg", "unexpected duplicate key error inserting MDM APNs and SCEP assets")
+						} else {
+							initFatal(err, "inserting MDM APNs and SCEP assets")
+						}
+					}
+				}
+			}
+
+			// reconcile Apple Business Manager configuration environment variables with the database
+			if config.MDM.IsAppleBMSet() {
+				if len(config.Server.PrivateKey) == 0 {
+					initFatal(errors.New("inserting MDM ABM assets"), "missing required private key. Learn how to configure the private key here: https://fleetdm.com/learn-more-about/fleet-server-private-key")
+				}
+
+				appleBM, err := config.MDM.AppleBM()
+				if err != nil {
+					initFatal(err, "parse Apple BM token, certificate and key from config")
+				}
+
+				toInsert := make([]fleet.MDMConfigAsset, 0, 2)
+
+				found, err := checkMDMAssets([]fleet.MDMAssetName{fleet.MDMAssetABMKey, fleet.MDMAssetABMCert})
+				switch {
+				case err != nil:
+					initFatal(err, "reading ABM assets from database")
+				case !found:
+					toInsert = append(toInsert, fleet.MDMConfigAsset{Name: fleet.MDMAssetABMKey, Value: appleBM.KeyPEM}, fleet.MDMConfigAsset{Name: fleet.MDMAssetABMCert, Value: appleBM.CertPEM})
+				default:
+					level.Warn(logger).Log("msg", "Your server already has stored ABM certificates and token. Fleet will ignore any certificates provided via environment variables when this happens.")
+				}
+
+				if len(toInsert) > 0 {
+					err := ds.InsertMDMConfigAssets(context.Background(), toInsert)
+					switch {
+					case err != nil && mysql.IsDuplicate(err):
+						// we already checked for existing assets so we should never have a duplicate key error here; we'll add a debug log just in case
+						level.Debug(logger).Log("msg", "unexpected duplicate key error inserting ABM assets")
+					case err != nil:
+						initFatal(err, "inserting ABM assets")
+					default:
+						// insert the ABM token without any metdata; it'll be picked by the
+						// apple_mdm_dep_profile_assigner cron and backfilled
+						if _, err := ds.InsertABMToken(context.Background(), &fleet.ABMToken{
+							EncryptedToken: appleBM.EncryptedToken,
+							RenewAt:        time.Date(2000, time.January, 1, 0, 0, 0, 0, time.UTC), // 2000-01-01 is our "zero value" for time
+						}); err != nil {
+							initFatal(err, "save ABM token")
+						}
+					}
+				}
+			}
+
+			appCfg, err := ds.AppConfig(context.Background())
+			if err != nil {
+				initFatal(err, "loading app config")
+			}
+
 			appCfg.MDM.EnabledAndConfigured = false
 			appCfg.MDM.AppleBMEnabledAndConfigured = false
 			if len(config.Server.PrivateKey) > 0 {
@@ -605,17 +646,32 @@ the way that the Fleet server works.
 					fleet.MDMAssetAPNSCert,
 				})
 				if err != nil {
-					initFatal(err, "validating MDM assets from database")
+					initFatal(err, "loading MDM assets from database")
 				}
 
-				appCfg.MDM.AppleBMEnabledAndConfigured, err = checkMDMAssets([]fleet.MDMAssetName{
+				var appleBMCerts bool
+				appleBMCerts, err = checkMDMAssets([]fleet.MDMAssetName{
 					fleet.MDMAssetABMCert,
 					fleet.MDMAssetABMKey,
-					fleet.MDMAssetABMToken,
 				})
 				if err != nil {
-					initFatal(err, "validating MDM ABM assets from database")
+					initFatal(err, "loading MDM ABM assets from database")
 				}
+				if appleBMCerts {
+					// the ABM certs are there, check if a token exists and if so, apple
+					// BM is enabled and configured.
+					count, err := ds.GetABMTokenCount(context.Background())
+					if err != nil {
+						initFatal(err, "loading MDM ABM token from database")
+					}
+					appCfg.MDM.AppleBMEnabledAndConfigured = count > 0
+				}
+			}
+			if appCfg.MDM.EnabledAndConfigured {
+				level.Info(logger).Log("msg", "Apple MDM enabled")
+			}
+			if appCfg.MDM.AppleBMEnabledAndConfigured {
+				level.Info(logger).Log("msg", "Apple Business Manager enabled")
 			}
 
 			// register the Microsoft MDM services
@@ -692,6 +748,7 @@ the way that the Fleet server works.
 			}
 
 			var softwareInstallStore fleet.SoftwareInstallerStore
+			var bootstrapPackageStore fleet.MDMBootstrapPackageStore
 			var distributedLock fleet.Lock
 			if license.IsPremium() {
 				profileMatcher := apple_mdm.NewProfileMatcher(redisPool)
@@ -705,6 +762,13 @@ the way that the Fleet server works.
 					}
 					softwareInstallStore = store
 					level.Info(logger).Log("msg", "using S3 software installer store", "bucket", config.S3.SoftwareInstallersBucket)
+
+					bstore, err := s3.NewBootstrapPackageStore(config.S3)
+					if err != nil {
+						initFatal(err, "initializing S3 bootstrap package store")
+					}
+					bootstrapPackageStore = bstore
+					level.Info(logger).Log("msg", "using S3 bootstrap package store", "bucket", config.S3.SoftwareInstallersBucket)
 				} else {
 					installerDir := os.TempDir()
 					if dir := os.Getenv("FLEET_SOFTWARE_INSTALLER_STORE_DIR"); dir != "" {
@@ -733,7 +797,9 @@ the way that the Fleet server works.
 					ssoSessionStore,
 					profileMatcher,
 					softwareInstallStore,
+					bootstrapPackageStore,
 					distributedLock,
+					redis_key_value.New(redisPool),
 				)
 				if err != nil {
 					initFatal(err, "initial Fleet Premium service")
@@ -773,6 +839,16 @@ the way that the Fleet server works.
 				}
 			}()
 
+			if softwareInstallStore != nil {
+				if err := cronSchedules.StartCronSchedule(
+					func() (fleet.CronSchedule, error) {
+						return cronUninstallSoftwareMigration(ctx, instanceID, ds, softwareInstallStore, logger)
+					},
+				); err != nil {
+					initFatal(err, fmt.Sprintf("failed to register %s", fleet.CronUninstallSoftwareMigration))
+				}
+			}
+
 			if config.Server.FrequentCleanupsEnabled {
 				if err := cronSchedules.StartCronSchedule(
 					func() (fleet.CronSchedule, error) {
@@ -787,7 +863,7 @@ the way that the Fleet server works.
 				func() (fleet.CronSchedule, error) {
 					commander := apple_mdm.NewMDMAppleCommander(mdmStorage, mdmPushService)
 					return newCleanupsAndAggregationSchedule(
-						ctx, instanceID, ds, logger, redisWrapperDS, &config, commander, softwareInstallStore,
+						ctx, instanceID, ds, logger, redisWrapperDS, &config, commander, softwareInstallStore, bootstrapPackageStore,
 					)
 				},
 			); err != nil {
@@ -936,7 +1012,7 @@ the way that the Fleet server works.
 				KeyPrefix: "ratelimit::",
 			}
 
-			var apiHandler, frontendHandler http.Handler
+			var apiHandler, frontendHandler, endUserEnrollOTAHandler http.Handler
 			{
 				frontendHandler = service.PrometheusMetricsHandler(
 					"get_frontend",
@@ -954,8 +1030,10 @@ the way that the Fleet server works.
 				if setupRequired {
 					apiHandler = service.WithSetup(svc, logger, apiHandler)
 					frontendHandler = service.RedirectLoginToSetup(svc, logger, frontendHandler, config.Server.URLPrefix)
+					endUserEnrollOTAHandler = service.RedirectLoginToSetup(svc, logger, frontendHandler, config.Server.URLPrefix)
 				} else {
 					frontendHandler = service.RedirectSetupToLogin(svc, logger, frontendHandler, config.Server.URLPrefix)
+					endUserEnrollOTAHandler = service.ServeEndUserEnrollOTA(config.Server.URLPrefix, logger)
 				}
 
 			}
@@ -1090,6 +1168,7 @@ the way that the Fleet server works.
 				}
 				apiHandler.ServeHTTP(rw, req)
 			})
+			rootMux.Handle("/enroll", endUserEnrollOTAHandler)
 			rootMux.Handle("/", frontendHandler)
 
 			debugHandler := &debugMux{
@@ -1131,7 +1210,11 @@ the way that the Fleet server works.
 				rootMux = prefixMux
 			}
 
-			liveQueryRestPeriod := 90 * time.Second // default (see #1798)
+			// NOTE(lucas): It seems we missed updating this value from 90s (see #1798) to 25s after we
+			// decided to make the synchronous live query API to take up to 25 seconds.
+			// Not changing this to not break any long running requests (like when uploading software
+			// packages via GitOps).
+			liveQueryRestPeriod := 90 * time.Second
 			if v := os.Getenv("FLEET_LIVE_QUERY_REST_PERIOD"); v != "" {
 				duration, err := time.ParseDuration(v)
 				if err != nil {
@@ -1374,3 +1457,18 @@ var _ push.Pusher = nopPusher{}
 func (n nopPusher) Push(context.Context, []string) (map[string]*push.Response, error) {
 	return nil, nil
 }
+
+func createTestBucketForInstallers(config *configpkg.FleetConfig, logger log.Logger) {
+	store, err := s3.NewSoftwareInstallerStore(config.S3)
+	if err != nil {
+		initFatal(err, "initializing S3 software installer store")
+	}
+	if err := store.CreateTestBucket(config.S3.SoftwareInstallersBucket); err != nil {
+		// Don't panic, allow devs to run Fleet without minio/S3 dependency.
+		level.Info(logger).Log(
+			"err", err,
+			"msg", "failed to create test bucket",
+			"name", config.S3.SoftwareInstallersBucket,
+		)
+	}
+}
diff --git a/cmd/fleet/serve_test.go b/cmd/fleet/serve_test.go
index 41e7d3885a..e472566f3e 100644
--- a/cmd/fleet/serve_test.go
+++ b/cmd/fleet/serve_test.go
@@ -30,9 +30,9 @@ import (
 	"github.com/go-kit/log"
 	kitlog "github.com/go-kit/log"
 	"github.com/go-kit/log/level"
+	"github.com/smallstep/pkcs7"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"go.mozilla.org/pkcs7"
 )
 
 // safeStore is a wrapper around mock.Store to allow for concurrent calling to
@@ -116,6 +116,10 @@ func TestMaybeSendStatistics(t *testing.T) {
 			HostsEnrolledByOsqueryVersion: []fleet.HostsCountByOsqueryVersion{},
 			StoredErrors:                  []byte(`[]`),
 			Organization:                  "Fleet",
+			AIFeaturesDisabled:            true,
+			MaintenanceWindowsEnabled:     true,
+			MaintenanceWindowsConfigured:  true,
+			NumHostsFleetDesktopEnabled:   1984,
 		}, true, nil
 	}
 	recorded := false
@@ -134,7 +138,7 @@ func TestMaybeSendStatistics(t *testing.T) {
 	require.NoError(t, err)
 	assert.True(t, recorded)
 	require.True(t, cleanedup)
-	assert.Equal(t, `{"anonymousIdentifier":"ident","fleetVersion":"1.2.3","licenseTier":"premium","organization":"Fleet","numHostsEnrolled":999,"numUsers":99,"numSoftwareVersions":100,"numHostSoftwares":101,"numSoftwareTitles":102,"numHostSoftwareInstalledPaths":103,"numSoftwareCPEs":104,"numSoftwareCVEs":105,"numTeams":9,"numPolicies":0,"numLabels":3,"softwareInventoryEnabled":true,"vulnDetectionEnabled":true,"systemUsersEnabled":true,"hostsStatusWebHookEnabled":true,"mdmMacOsEnabled":false,"hostExpiryEnabled":false,"mdmWindowsEnabled":false,"liveQueryDisabled":false,"numWeeklyActiveUsers":111,"numWeeklyPolicyViolationDaysActual":0,"numWeeklyPolicyViolationDaysPossible":0,"hostsEnrolledByOperatingSystem":{"linux":[{"version":"1.2.3","numEnrolled":22}]},"hostsEnrolledByOrbitVersion":[],"hostsEnrolledByOsqueryVersion":[],"storedErrors":[],"numHostsNotResponding":0}`, requestBody)
+	assert.Equal(t, `{"anonymousIdentifier":"ident","fleetVersion":"1.2.3","licenseTier":"premium","organization":"Fleet","numHostsEnrolled":999,"numUsers":99,"numSoftwareVersions":100,"numHostSoftwares":101,"numSoftwareTitles":102,"numHostSoftwareInstalledPaths":103,"numSoftwareCPEs":104,"numSoftwareCVEs":105,"numTeams":9,"numPolicies":0,"numLabels":3,"softwareInventoryEnabled":true,"vulnDetectionEnabled":true,"systemUsersEnabled":true,"hostsStatusWebHookEnabled":true,"mdmMacOsEnabled":false,"hostExpiryEnabled":false,"mdmWindowsEnabled":false,"liveQueryDisabled":false,"numWeeklyActiveUsers":111,"numWeeklyPolicyViolationDaysActual":0,"numWeeklyPolicyViolationDaysPossible":0,"hostsEnrolledByOperatingSystem":{"linux":[{"version":"1.2.3","numEnrolled":22}]},"hostsEnrolledByOrbitVersion":[],"hostsEnrolledByOsqueryVersion":[],"storedErrors":[],"numHostsNotResponding":0,"aiFeaturesDisabled":true,"maintenanceWindowsEnabled":true,"maintenanceWindowsConfigured":true,"numHostsFleetDesktopEnabled":1984}`, requestBody)
 }
 
 func TestMaybeSendStatisticsSkipsSendingIfNotNeeded(t *testing.T) {
@@ -294,6 +298,7 @@ func TestAutomationsSchedule(t *testing.T) {
 }
 
 func TestCronVulnerabilitiesCreatesDatabasesPath(t *testing.T) {
+	t.Parallel()
 	ctx, cancelFunc := context.WithCancel(context.Background())
 	defer cancelFunc()
 
diff --git a/cmd/fleetctl/apply.go b/cmd/fleetctl/apply.go
index 751c74709f..b201f5dc94 100644
--- a/cmd/fleetctl/apply.go
+++ b/cmd/fleetctl/apply.go
@@ -90,7 +90,7 @@ func applyCommand() *cli.Command {
 				opts.TeamForPolicies = policiesTeamName
 			}
 			baseDir := filepath.Dir(flFilename)
-			_, err = fleetClient.ApplyGroup(c.Context, specs, baseDir, logf, opts)
+			_, _, err = fleetClient.ApplyGroup(c.Context, specs, baseDir, logf, nil, opts)
 			if err != nil {
 				return err
 			}
diff --git a/cmd/fleetctl/apply_test.go b/cmd/fleetctl/apply_test.go
index 3cd8eb03dd..f35b39dc84 100644
--- a/cmd/fleetctl/apply_test.go
+++ b/cmd/fleetctl/apply_test.go
@@ -23,9 +23,11 @@ import (
 	"github.com/fleetdm/fleet/v4/server/config"
 	"github.com/fleetdm/fleet/v4/server/fleet"
 	apple_mdm "github.com/fleetdm/fleet/v4/server/mdm/apple"
+	nanodep_client "github.com/fleetdm/fleet/v4/server/mdm/nanodep/client"
 	"github.com/fleetdm/fleet/v4/server/mdm/nanodep/tokenpki"
 	"github.com/fleetdm/fleet/v4/server/mock"
 	mdmmock "github.com/fleetdm/fleet/v4/server/mock/mdm"
+	nanodep_mock "github.com/fleetdm/fleet/v4/server/mock/nanodep"
 	"github.com/fleetdm/fleet/v4/server/ptr"
 	"github.com/fleetdm/fleet/v4/server/service"
 	"github.com/google/uuid"
@@ -167,12 +169,15 @@ func TestApplyTeamSpecs(t *testing.T) {
 		return nil
 	}
 
-	ds.BatchSetMDMProfilesFunc = func(ctx context.Context, tmID *uint, macProfiles []*fleet.MDMAppleConfigProfile, winProfiles []*fleet.MDMWindowsConfigProfile, macDecls []*fleet.MDMAppleDeclaration) error {
-		return nil
+	ds.BatchSetMDMProfilesFunc = func(ctx context.Context, tmID *uint, macProfiles []*fleet.MDMAppleConfigProfile,
+		winProfiles []*fleet.MDMWindowsConfigProfile, macDecls []*fleet.MDMAppleDeclaration,
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 
-	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hostIDs, teamIDs []uint, profileUUIDs, hostUUIDs []string) error {
-		return nil
+	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hostIDs, teamIDs []uint, profileUUIDs, hostUUIDs []string,
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 
 	ds.NewActivityFunc = func(
@@ -586,6 +591,10 @@ func TestApplyAppConfig(t *testing.T) {
 		return userRoleSpecList, nil
 	}
 
+	ds.SaveABMTokenFunc = func(ctx context.Context, tok *fleet.ABMToken) error {
+		return nil
+	}
+
 	ds.NewActivityFunc = func(
 		ctx context.Context, user *fleet.User, activity fleet.ActivityDetails, details []byte, createdAt time.Time,
 	) error {
@@ -623,8 +632,9 @@ func TestApplyAppConfig(t *testing.T) {
 		return nil
 	}
 
-	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hostIDs, teamIDs []uint, profileUUIDs, hostUUIDs []string) error {
-		return nil
+	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hostIDs, teamIDs []uint, profileUUIDs, hostUUIDs []string,
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 
 	ds.LabelIDsByNameFunc = func(ctx context.Context, labels []string) (map[string]uint, error) {
@@ -640,6 +650,12 @@ func TestApplyAppConfig(t *testing.T) {
 	ds.DeleteMDMAppleDeclarationByNameFunc = func(ctx context.Context, teamID *uint, name string) error {
 		return nil
 	}
+	ds.ListABMTokensFunc = func(ctx context.Context) ([]*fleet.ABMToken, error) {
+		return []*fleet.ABMToken{{OrganizationName: "Fleet Device Management Inc."}}, nil
+	}
+	ds.TeamsSummaryFunc = func(ctx context.Context) ([]*fleet.TeamSummary, error) {
+		return []*fleet.TeamSummary{{Name: "team1", ID: 1}}, nil
+	}
 
 	name := writeTmpYml(t, `---
 apiVersion: v1
@@ -659,8 +675,8 @@ spec:
 `)
 
 	newMDMSettings := fleet.MDM{
-		AppleBMDefaultTeam:  "team1",
-		AppleBMTermsExpired: false,
+		DeprecatedAppleBMDefaultTeam: "team1",
+		AppleBMTermsExpired:          false,
 		MacOSUpdates: fleet.AppleOSUpdateSettings{
 			MinimumVersion: optjson.SetString("12.1.1"),
 			Deadline:       optjson.SetString("2011-02-01"),
@@ -714,8 +730,8 @@ spec:
 `)
 
 	newMDMSettings = fleet.MDM{
-		AppleBMDefaultTeam:  "team1",
-		AppleBMTermsExpired: false,
+		DeprecatedAppleBMDefaultTeam: "team1",
+		AppleBMTermsExpired:          false,
 		MacOSUpdates: fleet.AppleOSUpdateSettings{
 			MinimumVersion: optjson.SetString("12.1.1"),
 			Deadline:       optjson.SetString("2011-02-01"),
@@ -1157,6 +1173,9 @@ func TestApplyAsGitOps(t *testing.T) {
 	testCertPEM := tokenpki.PEMCertificate(testCert.Raw)
 	testKeyPEM := tokenpki.PEMRSAPrivateKey(testKey)
 	fleetCfg := config.TestConfig()
+	// Mock Apple DEP API
+	depStorage := SetupMockDEPStorageAndMockDEPServer(t)
+
 	config.SetTestMDMConfig(t, &fleetCfg, testCertPEM, testKeyPEM, "../../server/service/testdata")
 
 	_, ds := runServerWithMockedDS(t, &service.TestServerOpts{
@@ -1164,6 +1183,7 @@ func TestApplyAsGitOps(t *testing.T) {
 		MDMStorage:  enqueuer,
 		MDMPusher:   mockPusher{},
 		FleetConfig: &fleetCfg,
+		DEPStorage:  depStorage,
 	})
 
 	gitOps := &fleet.User{
@@ -1240,11 +1260,14 @@ func TestApplyAsGitOps(t *testing.T) {
 		teamEnrollSecrets = secrets
 		return nil
 	}
-	ds.BatchSetMDMProfilesFunc = func(ctx context.Context, tmID *uint, macProfiles []*fleet.MDMAppleConfigProfile, winProfiles []*fleet.MDMWindowsConfigProfile, macDecls []*fleet.MDMAppleDeclaration) error {
-		return nil
+	ds.BatchSetMDMProfilesFunc = func(ctx context.Context, tmID *uint, macProfiles []*fleet.MDMAppleConfigProfile,
+		winProfiles []*fleet.MDMWindowsConfigProfile, macDecls []*fleet.MDMAppleDeclaration,
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
-	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hostIDs, teamIDs []uint, profileUUIDs, hostUUIDs []string) error {
-		return nil
+	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hostIDs, teamIDs []uint, profileUUIDs, hostUUIDs []string,
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 	ds.GetMDMAppleSetupAssistantFunc = func(ctx context.Context, teamID *uint) (*fleet.MDMAppleSetupAssistant, error) {
 		return nil, &notFoundError{}
@@ -1258,7 +1281,7 @@ func TestApplyAsGitOps(t *testing.T) {
 	ds.GetMDMAppleBootstrapPackageMetaFunc = func(ctx context.Context, teamID uint) (*fleet.MDMAppleBootstrapPackage, error) {
 		return nil, &notFoundError{}
 	}
-	ds.InsertMDMAppleBootstrapPackageFunc = func(ctx context.Context, bp *fleet.MDMAppleBootstrapPackage) error {
+	ds.InsertMDMAppleBootstrapPackageFunc = func(ctx context.Context, bp *fleet.MDMAppleBootstrapPackage, pkgStore fleet.MDMBootstrapPackageStore) error {
 		return nil
 	}
 	ds.SetOrUpdateMDMWindowsConfigProfileFunc = func(ctx context.Context, cp fleet.MDMWindowsConfigProfile) error {
@@ -1279,6 +1302,20 @@ func TestApplyAsGitOps(t *testing.T) {
 		return nil
 	}
 
+	ds.GetMDMAppleEnrollmentProfileByTypeFunc = func(ctx context.Context, typ fleet.MDMAppleEnrollmentType) (*fleet.MDMAppleEnrollmentProfile, error) {
+		return &fleet.MDMAppleEnrollmentProfile{Token: "foobar"}, nil
+	}
+	ds.CountABMTokensWithTermsExpiredFunc = func(ctx context.Context) (int, error) {
+		return 0, nil
+	}
+
+	ds.GetABMTokenOrgNamesAssociatedWithTeamFunc = func(ctx context.Context, teamID *uint) ([]string, error) {
+		return []string{"foobar"}, nil
+	}
+	ds.ListABMTokensFunc = func(ctx context.Context) ([]*fleet.ABMToken, error) {
+		return []*fleet.ABMToken{{ID: 1}}, nil
+	}
+
 	// Apply global config.
 	name := writeTmpYml(t, `---
 apiVersion: v1
@@ -1615,6 +1652,34 @@ spec:
 	assert.Equal(t, "select * from app_schemes;", appliedQueries[0].Query)
 }
 
+func SetupMockDEPStorageAndMockDEPServer(t *testing.T) *nanodep_mock.Storage {
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch {
+		case strings.Contains(r.URL.Path, "/server/devices"):
+			_, err := w.Write([]byte("{}"))
+			require.NoError(t, err)
+		case strings.Contains(r.URL.Path, "/session"):
+			_, err := w.Write([]byte(`{"auth_session_token": "yoo"}`))
+			require.NoError(t, err)
+		case strings.Contains(r.URL.Path, "/profile"):
+			_, err := w.Write([]byte(`{"profile_uuid": "profile123"}`))
+			require.NoError(t, err)
+		}
+	}))
+	depStorage := &nanodep_mock.Storage{}
+	depStorage.RetrieveConfigFunc = func(context.Context, string) (*nanodep_client.Config, error) {
+		return &nanodep_client.Config{
+			BaseURL: ts.URL,
+		}, nil
+	}
+	depStorage.RetrieveAuthTokensFunc = func(ctx context.Context, name string) (*nanodep_client.OAuth1Tokens, error) {
+		return &nanodep_client.OAuth1Tokens{}, nil
+	}
+	t.Cleanup(func() { ts.Close() })
+
+	return depStorage
+}
+
 func TestApplyEnrollSecrets(t *testing.T) {
 	_, ds := runServerWithMockedDS(t)
 
@@ -1868,7 +1933,8 @@ func TestApplyMacosSetup(t *testing.T) {
 			tier = fleet.TierPremium
 		}
 		license := &fleet.LicenseInfo{Tier: tier, Expiration: time.Now().Add(24 * time.Hour)}
-		_, ds := runServerWithMockedDS(t, &service.TestServerOpts{License: license})
+		depStorage := SetupMockDEPStorageAndMockDEPServer(t)
+		_, ds := runServerWithMockedDS(t, &service.TestServerOpts{License: license, DEPStorage: depStorage})
 
 		tm1 := &fleet.Team{ID: 1, Name: "tm1"}
 		teamsByName := map[string]*fleet.Team{
@@ -2001,7 +2067,7 @@ func TestApplyMacosSetup(t *testing.T) {
 			}
 			return nil, &notFoundError{}
 		}
-		ds.InsertMDMAppleBootstrapPackageFunc = func(ctx context.Context, bp *fleet.MDMAppleBootstrapPackage) error {
+		ds.InsertMDMAppleBootstrapPackageFunc = func(ctx context.Context, bp *fleet.MDMAppleBootstrapPackage, pkgStore fleet.MDMBootstrapPackageStore) error {
 			return nil
 		}
 		ds.DeleteMDMAppleBootstrapPackageFunc = func(ctx context.Context, teamID uint) error {
@@ -2010,6 +2076,21 @@ func TestApplyMacosSetup(t *testing.T) {
 		ds.GetMDMAppleBootstrapPackageMetaFunc = func(ctx context.Context, teamID uint) (*fleet.MDMAppleBootstrapPackage, error) {
 			return nil, nil
 		}
+
+		ds.GetMDMAppleEnrollmentProfileByTypeFunc = func(ctx context.Context, typ fleet.MDMAppleEnrollmentType) (*fleet.MDMAppleEnrollmentProfile, error) {
+			return &fleet.MDMAppleEnrollmentProfile{Token: "foobar"}, nil
+		}
+		ds.CountABMTokensWithTermsExpiredFunc = func(ctx context.Context) (int, error) {
+			return 0, nil
+		}
+
+		ds.GetABMTokenOrgNamesAssociatedWithTeamFunc = func(ctx context.Context, teamID *uint) ([]string, error) {
+			return []string{"foobar"}, nil
+		}
+		ds.ListABMTokensFunc = func(ctx context.Context) ([]*fleet.ABMToken, error) {
+			return []*fleet.ABMToken{{ID: 1}}, nil
+		}
+
 		return ds
 	}
 
@@ -2387,7 +2468,7 @@ spec:
 			t.Run(c.pkgName, func(t *testing.T) {
 				srv, pkgLen := serveMDMBootstrapPackage(t, filepath.Join("../../server/service/testdata/bootstrap-packages", c.pkgName), c.pkgName)
 				ds := setupServer(t, true)
-				ds.InsertMDMAppleBootstrapPackageFunc = func(ctx context.Context, bp *fleet.MDMAppleBootstrapPackage) error {
+				ds.InsertMDMAppleBootstrapPackageFunc = func(ctx context.Context, bp *fleet.MDMAppleBootstrapPackage, pkgStore fleet.MDMBootstrapPackageStore) error {
 					require.Equal(t, len(bp.Bytes), pkgLen)
 					return nil
 				}
@@ -2446,7 +2527,7 @@ spec:
 		defer srv.Close()
 
 		ds := setupServer(t, true)
-		ds.InsertMDMAppleBootstrapPackageFunc = func(ctx context.Context, bp *fleet.MDMAppleBootstrapPackage) error {
+		ds.InsertMDMAppleBootstrapPackageFunc = func(ctx context.Context, bp *fleet.MDMAppleBootstrapPackage, pkgStore fleet.MDMBootstrapPackageStore) error {
 			mockStore.Lock()
 			defer mockStore.Unlock()
 			require.Equal(t, pkgName, bp.Name)
@@ -2599,6 +2680,7 @@ spec:
 }
 
 func TestApplySpecs(t *testing.T) {
+	t.Parallel()
 	// create a macos setup json file (content not important)
 	macSetupFile := writeTmpJSON(t, map[string]any{})
 
diff --git a/cmd/fleetctl/get_test.go b/cmd/fleetctl/get_test.go
index db5a00c9b2..f39ff1cd55 100644
--- a/cmd/fleetctl/get_test.go
+++ b/cmd/fleetctl/get_test.go
@@ -2060,8 +2060,13 @@ func TestGetAppleBM(t *testing.T) {
 		assert.Contains(t, err.Error(), expected)
 	})
 
-	t.Run("premium license", func(t *testing.T) {
-		runServerWithMockedDS(t, &service.TestServerOpts{License: &fleet.LicenseInfo{Tier: fleet.TierPremium}, DEPStorage: depStorage})
+	t.Run("premium license, single token", func(t *testing.T) {
+		_, ds := runServerWithMockedDS(t, &service.TestServerOpts{License: &fleet.LicenseInfo{Tier: fleet.TierPremium}, DEPStorage: depStorage})
+		ds.ListABMTokensFunc = func(ctx context.Context) ([]*fleet.ABMToken, error) {
+			return []*fleet.ABMToken{
+				{ID: 1},
+			}, nil
+		}
 
 		out := runAppForTest(t, []string{"get", "mdm_apple_bm"})
 		assert.Contains(t, out, "Apple ID:")
@@ -2070,6 +2075,29 @@ func TestGetAppleBM(t *testing.T) {
 		assert.Contains(t, out, "Renew date:")
 		assert.Contains(t, out, "Default team:")
 	})
+
+	t.Run("premium license, no token", func(t *testing.T) {
+		_, ds := runServerWithMockedDS(t, &service.TestServerOpts{License: &fleet.LicenseInfo{Tier: fleet.TierPremium}, DEPStorage: depStorage})
+		ds.ListABMTokensFunc = func(ctx context.Context) ([]*fleet.ABMToken, error) {
+			return nil, nil
+		}
+
+		out := runAppForTest(t, []string{"get", "mdm_apple_bm"})
+		assert.Contains(t, out, "No Apple Business Manager server token found.")
+	})
+
+	t.Run("premium license, multiple tokens", func(t *testing.T) {
+		_, ds := runServerWithMockedDS(t, &service.TestServerOpts{License: &fleet.LicenseInfo{Tier: fleet.TierPremium}, DEPStorage: depStorage})
+		ds.ListABMTokensFunc = func(ctx context.Context) ([]*fleet.ABMToken, error) {
+			return []*fleet.ABMToken{
+				{ID: 1},
+				{ID: 2},
+			}, nil
+		}
+
+		_, err := runAppNoChecks([]string{"get", "mdm_apple_bm"})
+		assert.ErrorContains(t, err, "This API endpoint has been deprecated. Please use the new GET /abm_tokens API endpoint")
+	})
 }
 
 func TestGetCarves(t *testing.T) {
@@ -2269,11 +2297,14 @@ func TestGetTeamsYAMLAndApply(t *testing.T) {
 		}
 		return nil, fmt.Errorf("team not found: %s", name)
 	}
-	ds.BatchSetMDMProfilesFunc = func(ctx context.Context, tmID *uint, macProfiles []*fleet.MDMAppleConfigProfile, winProfiles []*fleet.MDMWindowsConfigProfile, macDecls []*fleet.MDMAppleDeclaration) error {
-		return nil
+	ds.BatchSetMDMProfilesFunc = func(ctx context.Context, tmID *uint, macProfiles []*fleet.MDMAppleConfigProfile,
+		winProfiles []*fleet.MDMWindowsConfigProfile, macDecls []*fleet.MDMAppleDeclaration,
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
-	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hostIDs, teamIDs []uint, profileUUIDs, uuids []string) error {
-		return nil
+	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hostIDs, teamIDs []uint, profileUUIDs, uuids []string,
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 	ds.BatchSetScriptsFunc = func(ctx context.Context, tmID *uint, scripts []*fleet.Script) error {
 		return nil
diff --git a/cmd/fleetctl/gitops.go b/cmd/fleetctl/gitops.go
index c56016eca3..a7db6be73d 100644
--- a/cmd/fleetctl/gitops.go
+++ b/cmd/fleetctl/gitops.go
@@ -77,12 +77,35 @@ func gitopsCommand() *cli.Command {
 			if appConfig.License == nil {
 				return errors.New("no license struct found in app config")
 			}
+			logf := func(format string, a ...interface{}) {
+				_, _ = fmt.Fprintf(c.App.Writer, format, a...)
+			}
 
-			var appleBMDefaultTeam string
-			var appleBMDefaultTeamFound bool
+			// We need to extract the controls from no-team.yml to be able to apply them when applying the global app config.
+			var (
+				noTeamControls spec.Controls
+				noTeamPresent  bool
+			)
+			for _, flFilename := range flFilenames.Value() {
+				if filepath.Base(flFilename) == "no-team.yml" {
+					baseDir := filepath.Dir(flFilename)
+					config, err := spec.GitOpsFromFile(flFilename, baseDir, appConfig, func(format string, a ...interface{}) {})
+					if err != nil {
+						return err
+					}
+					noTeamControls = config.Controls
+					noTeamPresent = true
+					break
+				}
+			}
+
+			var originalABMConfig []any
+			var originalVPPConfig []any
 			var teamNames []string
 			var firstFileMustBeGlobal *bool
 			var teamDryRunAssumptions *fleet.TeamSpecsDryRunAssumptions
+			var abmTeams, vppTeams []string
+			var hasMissingABMTeam, hasMissingVPPTeam, usesLegacyABMConfig bool
 			if totalFilenames > 1 {
 				firstFileMustBeGlobal = ptr.Bool(true)
 			}
@@ -90,7 +113,7 @@ func gitopsCommand() *cli.Command {
 			secrets := make(map[string]struct{})
 			for _, flFilename := range flFilenames.Value() {
 				baseDir := filepath.Dir(flFilename)
-				config, err := spec.GitOpsFromFile(flFilename, baseDir)
+				config, err := spec.GitOpsFromFile(flFilename, baseDir, appConfig, logf)
 				if err != nil {
 					return err
 				}
@@ -106,16 +129,74 @@ func gitopsCommand() *cli.Command {
 					}
 					firstFileMustBeGlobal = ptr.Bool(false)
 				}
-				if isGlobalConfig && totalFilenames > 1 {
-					// Check if Apple BM default team already exists
-					appleBMDefaultTeam, appleBMDefaultTeamFound, err = checkAppleBMDefaultTeam(config, fleetClient)
+
+				if isGlobalConfig {
+					if noTeamControls.Set() && config.Controls.Set() {
+						return errors.New("'controls' cannot be set on both global config and on no-team.yml")
+					}
+					if !noTeamControls.Defined && !config.Controls.Defined {
+						if appConfig.License.IsPremium() {
+							return errors.New("'controls' must be set on global config or no-team.yml")
+						}
+						return errors.New("'controls' must be set on global config")
+					}
+					if !config.Controls.Set() {
+						config.Controls = noTeamControls
+					}
+				}
+
+				// Special handling for tokens is required because they link to teams (by
+				// name.) Because teams can be created/deleted during the same gitops run, we
+				// grab some information to help us determine allowed/restricted actions and
+				// when to perform the associations.
+				if isGlobalConfig && totalFilenames > 1 && !(totalFilenames == 2 && noTeamPresent) {
+					abmTeams, hasMissingABMTeam, usesLegacyABMConfig, err = checkABMTeamAssignments(config, fleetClient)
 					if err != nil {
 						return err
 					}
+
+					vppTeams, hasMissingVPPTeam, err = checkVPPTeamAssignments(config, fleetClient)
+					if err != nil {
+						return err
+					}
+
+					// if one of the teams assigned to an ABM token doesn't exist yet, we need to
+					// submit the configs without the ABM default team set. We'll set those
+					// separately later when the teams are already created.
+					if hasMissingABMTeam {
+						if mdm, ok := config.OrgSettings["mdm"]; ok {
+							if mdmMap, ok := mdm.(map[string]any); ok {
+								if appleBM, ok := mdmMap["apple_business_manager"]; ok {
+									if bmSettings, ok := appleBM.([]any); ok {
+										originalABMConfig = bmSettings
+									}
+								}
+
+								// If team is not found, we need to remove the AppleBMDefaultTeam from
+								// the global config, and then apply it after teams are processed
+								mdmMap["apple_business_manager"] = nil
+								mdmMap["apple_bm_default_team"] = ""
+							}
+						}
+					}
+
+					if hasMissingVPPTeam {
+						if mdm, ok := config.OrgSettings["mdm"]; ok {
+							if mdmMap, ok := mdm.(map[string]any); ok {
+								if vpp, ok := mdmMap["volume_purchasing_program"]; ok {
+									if vppSettings, ok := vpp.([]any); ok {
+										originalVPPConfig = vppSettings
+									}
+								}
+
+								// If team is not found, we need to remove the VPP config from
+								// the global config, and then apply it after teams are processed
+								mdmMap["volume_purchasing_program"] = nil
+							}
+						}
+					}
 				}
-				logf := func(format string, a ...interface{}) {
-					_, _ = fmt.Fprintf(c.App.Writer, format, a...)
-				}
+
 				if flDryRun {
 					incomingSecrets := fleetClient.GetGitOpsSecrets(config)
 					for _, secret := range incomingSecrets {
@@ -125,6 +206,7 @@ func gitopsCommand() *cli.Command {
 						secrets[secret] = struct{}{}
 					}
 				}
+
 				assumptions, err := fleetClient.DoGitOps(c.Context, config, flFilename, logf, flDryRun, teamDryRunAssumptions, appConfig)
 				if err != nil {
 					return err
@@ -135,10 +217,15 @@ func gitopsCommand() *cli.Command {
 					teamDryRunAssumptions = assumptions
 				}
 			}
-			if appleBMDefaultTeam != "" && !appleBMDefaultTeamFound {
-				// If the Apple BM default team did not exist earlier, check again and apply it if needed
-				err = applyAppleBMDefaultTeamIfNeeded(c, teamNames, appleBMDefaultTeam, flDryRun, fleetClient)
-				if err != nil {
+
+			// if there were assignments to tokens, and some of the teams were missing at that time, submit a separate patch request to set them now.
+			if len(abmTeams) > 0 && hasMissingABMTeam {
+				if err = applyABMTokenAssignmentIfNeeded(c, teamNames, abmTeams, originalABMConfig, usesLegacyABMConfig, flDryRun, fleetClient); err != nil {
+					return err
+				}
+			}
+			if len(vppTeams) > 0 && hasMissingVPPTeam {
+				if err = applyVPPTokenAssignmentIfNeeded(c, teamNames, vppTeams, originalVPPConfig, flDryRun, fleetClient); err != nil {
 					return err
 				}
 			}
@@ -149,8 +236,14 @@ func gitopsCommand() *cli.Command {
 				}
 				for _, team := range teams {
 					if !slices.Contains(teamNames, team.Name) {
-						if appleBMDefaultTeam == team.Name {
-							return fmt.Errorf("apple_bm_default_team %s cannot be deleted", appleBMDefaultTeam)
+						if slices.Contains(abmTeams, team.Name) {
+							if usesLegacyABMConfig {
+								return fmt.Errorf("apple_bm_default_team %s cannot be deleted", team.Name)
+							}
+							return fmt.Errorf("apple_business_manager team %s cannot be deleted", team.Name)
+						}
+						if slices.Contains(vppTeams, team.Name) {
+							return fmt.Errorf("volume_purchasing_program team %s cannot be deleted", team.Name)
 						}
 						if flDryRun {
 							_, _ = fmt.Fprintf(c.App.Writer, "[!] would delete team %s\n", team.Name)
@@ -174,54 +267,194 @@ func gitopsCommand() *cli.Command {
 	}
 }
 
-func checkAppleBMDefaultTeam(config *spec.GitOps, fleetClient *service.Client) (
-	appleBMDefaultTeam string, appleBMDefaultTeamFound bool, err error,
+// checkABMTeamAssignments validates the spec, and finds if:
+//
+// 1. The user is using the legacy apple_bm_default_team config.
+// 2. All teams assigned to ABM tokens already exist.
+// 3. Performs validations according to the spec for both the new and the
+// deprecated key used for this setting.
+func checkABMTeamAssignments(config *spec.GitOps, fleetClient *service.Client) (
+	abmTeams []string, missingTeam bool, usesLegacyConfig bool, err error,
 ) {
 	if mdm, ok := config.OrgSettings["mdm"]; ok {
-		if mdmMap, ok := mdm.(map[string]interface{}); ok {
-			if appleBMDT, ok := mdmMap["apple_bm_default_team"]; ok {
-				if appleBMDefaultTeam, ok = appleBMDT.(string); ok {
-					teams, err := fleetClient.ListTeams("")
-					if err != nil {
-						return "", false, err
-					}
-					// Normalize AppleBMDefaultTeam for Unicode support
+		if mdmMap, ok := mdm.(map[string]any); ok {
+			appleBMDT, hasLegacyConfig := mdmMap["apple_bm_default_team"]
+			appleBM, hasNewConfig := mdmMap["apple_business_manager"]
+
+			if hasLegacyConfig && hasNewConfig {
+				return nil, false, false, errors.New(fleet.AppleABMDefaultTeamDeprecatedMessage)
+			}
+
+			if !hasLegacyConfig && !hasNewConfig {
+				return nil, false, false, nil
+			}
+
+			teams, err := fleetClient.ListTeams("")
+			if err != nil {
+				return nil, false, false, err
+			}
+			teamNames := map[string]struct{}{}
+			for _, tm := range teams {
+				teamNames[tm.Name] = struct{}{}
+			}
+
+			if hasLegacyConfig {
+				if appleBMDefaultTeam, ok := appleBMDT.(string); ok {
+					// normalize for Unicode support
 					appleBMDefaultTeam = norm.NFC.String(appleBMDefaultTeam)
-					for _, team := range teams {
-						if team.Name == appleBMDefaultTeam {
-							appleBMDefaultTeamFound = true
-							break
-						}
+					abmTeams = append(abmTeams, appleBMDefaultTeam)
+					usesLegacyConfig = true
+					if _, ok = teamNames[appleBMDefaultTeam]; !ok {
+						missingTeam = true
 					}
-					if !appleBMDefaultTeamFound {
-						// If team is not found, we need to remove the AppleBMDefaultTeam from the global config, and then apply it after teams are processed
-						mdmMap["apple_bm_default_team"] = ""
+				}
+			}
+
+			if hasNewConfig {
+				if settingMap, ok := appleBM.([]any); ok {
+					for _, item := range settingMap {
+						if cfg, ok := item.(map[string]any); ok {
+							for _, teamConfigKey := range []string{"macos_team", "ios_team", "ipados_team"} {
+								if team, ok := cfg[teamConfigKey].(string); ok && team != "" {
+									// normalize for Unicode support
+									team = norm.NFC.String(team)
+									abmTeams = append(abmTeams, team)
+									if _, ok := teamNames[team]; !ok {
+										missingTeam = true
+									}
+								}
+							}
+						}
 					}
 				}
 			}
 		}
 	}
-	return appleBMDefaultTeam, appleBMDefaultTeamFound, nil
+
+	return abmTeams, missingTeam, usesLegacyConfig, nil
 }
 
-func applyAppleBMDefaultTeamIfNeeded(
-	ctx *cli.Context, teamNames []string, appleBMDefaultTeam string, flDryRun bool, fleetClient *service.Client,
+func applyABMTokenAssignmentIfNeeded(
+	ctx *cli.Context,
+	teamNames []string,
+	abmTeamNames []string,
+	originalMDMConfig []any,
+	usesLegacyConfig bool,
+	flDryRun bool,
+	fleetClient *service.Client,
 ) error {
-	if !slices.Contains(teamNames, appleBMDefaultTeam) {
-		return fmt.Errorf("apple_bm_default_team %s not found in team configs", appleBMDefaultTeam)
+	if usesLegacyConfig && len(abmTeamNames) > 1 {
+		return errors.New(fleet.AppleABMDefaultTeamDeprecatedMessage)
 	}
-	appConfigUpdate := map[string]map[string]interface{}{
-		"mdm": {
-			"apple_bm_default_team": appleBMDefaultTeam,
-		},
+
+	if usesLegacyConfig && len(abmTeamNames) == 0 {
+		return errors.New("using legacy config without any ABM teams defined")
 	}
-	if flDryRun {
-		_, _ = fmt.Fprintf(ctx.App.Writer, "[!] would apply apple_bm_default_team %s\n", appleBMDefaultTeam)
-	} else {
-		_, _ = fmt.Fprintf(ctx.App.Writer, "[+] applying apple_bm_default_team %s\n", appleBMDefaultTeam)
-		if err := fleetClient.ApplyAppConfig(appConfigUpdate, fleet.ApplySpecOptions{}); err != nil {
-			return fmt.Errorf("applying fleet config: %w", err)
+
+	var appConfigUpdate map[string]map[string]any
+	if usesLegacyConfig {
+		appleBMDefaultTeam := abmTeamNames[0]
+		if !slices.Contains(teamNames, appleBMDefaultTeam) {
+			return fmt.Errorf("apple_bm_default_team team %q not found in team configs", appleBMDefaultTeam)
 		}
+		appConfigUpdate = map[string]map[string]any{
+			"mdm": {
+				"apple_bm_default_team": appleBMDefaultTeam,
+			},
+		}
+	} else {
+		for _, abmTeam := range abmTeamNames {
+			if !slices.Contains(teamNames, abmTeam) {
+				return fmt.Errorf("apple_business_manager team %q not found in team configs", abmTeam)
+			}
+		}
+
+		appConfigUpdate = map[string]map[string]any{
+			"mdm": {
+				"apple_business_manager": originalMDMConfig,
+			},
+		}
+	}
+
+	if flDryRun {
+		_, _ = fmt.Fprint(ctx.App.Writer, "[!] would apply ABM teams\n")
+		return nil
+	}
+	_, _ = fmt.Fprintf(ctx.App.Writer, "[+] applying ABM teams\n")
+	if err := fleetClient.ApplyAppConfig(appConfigUpdate, fleet.ApplySpecOptions{}); err != nil {
+		return fmt.Errorf("applying fleet config: %w", err)
+	}
+	return nil
+}
+
+func checkVPPTeamAssignments(config *spec.GitOps, fleetClient *service.Client) (
+	vppTeams []string, missingTeam bool, err error,
+) {
+	if mdm, ok := config.OrgSettings["mdm"]; ok {
+		if mdmMap, ok := mdm.(map[string]any); ok {
+			teams, err := fleetClient.ListTeams("")
+			if err != nil {
+				return nil, false, err
+			}
+			teamNames := map[string]struct{}{}
+			for _, tm := range teams {
+				teamNames[tm.Name] = struct{}{}
+			}
+
+			if vpp, ok := mdmMap["volume_purchasing_program"]; ok {
+				if vppInterfaces, ok := vpp.([]any); ok {
+					for _, item := range vppInterfaces {
+						if itemMap, ok := item.(map[string]any); ok {
+							if teams, ok := itemMap["teams"].([]any); ok {
+								for _, team := range teams {
+									if teamStr, ok := team.(string); ok {
+										// normalize for Unicode support
+										normalizedTeam := norm.NFC.String(teamStr)
+										vppTeams = append(vppTeams, normalizedTeam)
+										if _, ok := teamNames[normalizedTeam]; !ok {
+											missingTeam = true
+										}
+									}
+								}
+							}
+						}
+					}
+				}
+			}
+		}
+	}
+
+	return vppTeams, missingTeam, nil
+}
+
+func applyVPPTokenAssignmentIfNeeded(
+	ctx *cli.Context,
+	teamNames []string,
+	vppTeamNames []string,
+	originalVPPConfig []any,
+	flDryRun bool,
+	fleetClient *service.Client,
+) error {
+	var appConfigUpdate map[string]map[string]any
+	for _, vppTeam := range vppTeamNames {
+		if !fleet.IsReservedTeamName(vppTeam) && !slices.Contains(teamNames, vppTeam) {
+			return fmt.Errorf("volume_purchasing_program team %s not found in team configs", vppTeam)
+		}
+	}
+
+	appConfigUpdate = map[string]map[string]any{
+		"mdm": {
+			"volume_purchasing_program": originalVPPConfig,
+		},
+	}
+
+	if flDryRun {
+		_, _ = fmt.Fprint(ctx.App.Writer, "[!] would apply volume_purchasing_program teams\n")
+		return nil
+	}
+	_, _ = fmt.Fprintf(ctx.App.Writer, "[+] applying volume_purchasing_program teams\n")
+	if err := fleetClient.ApplyAppConfig(appConfigUpdate, fleet.ApplySpecOptions{}); err != nil {
+		return fmt.Errorf("applying fleet config for volume_purchasing_program teams: %w", err)
 	}
 	return nil
 }
diff --git a/cmd/fleetctl/gitops_enterprise_integration_test.go b/cmd/fleetctl/gitops_enterprise_integration_test.go
index ab3f8bf835..235d89dca8 100644
--- a/cmd/fleetctl/gitops_enterprise_integration_test.go
+++ b/cmd/fleetctl/gitops_enterprise_integration_test.go
@@ -23,7 +23,7 @@ import (
 	"github.com/stretchr/testify/suite"
 )
 
-func TestEnterpriseIntegrationsGitops(t *testing.T) {
+func TestIntegrationsEnterpriseGitops(t *testing.T) {
 	testingSuite := new(enterpriseIntegrationGitopsTestSuite)
 	testingSuite.suite = &testingSuite.Suite
 	suite.Run(t, testingSuite)
@@ -176,6 +176,7 @@ contexts:
 		fmt.Sprintf(
 			`
 controls:
+software:
 queries:
 policies:
 agent_options:
@@ -186,6 +187,9 @@ team_settings:
 		),
 	)
 	require.NoError(t, err)
+
+	test.CreateInsertGlobalVPPToken(t, s.ds)
+
 	// Apply the team to be deleted
 	_ = runAppForTest(t, []string{"gitops", "--config", fleetctlConfig.Name(), "-f", deletedTeamFile.Name()})
 
@@ -230,5 +234,4 @@ team_settings:
 	for _, fileName := range teamFileNames {
 		_ = runAppForTest(t, []string{"gitops", "--config", fleetctlConfig.Name(), "-f", fileName})
 	}
-
 }
diff --git a/cmd/fleetctl/gitops_test.go b/cmd/fleetctl/gitops_test.go
index 826dd43374..1a054482f6 100644
--- a/cmd/fleetctl/gitops_test.go
+++ b/cmd/fleetctl/gitops_test.go
@@ -2,8 +2,6 @@ package main
 
 import (
 	"context"
-	"crypto/rand"
-	"encoding/base64"
 	"encoding/json"
 	"fmt"
 	"net/http"
@@ -12,9 +10,11 @@ import (
 	"path/filepath"
 	"slices"
 	"strings"
+	"sync"
 	"testing"
 	"time"
 
+	"github.com/fleetdm/fleet/v4/pkg/file"
 	"github.com/fleetdm/fleet/v4/server/config"
 	"github.com/fleetdm/fleet/v4/server/datastore/mysql"
 	"github.com/fleetdm/fleet/v4/server/fleet"
@@ -25,6 +25,7 @@ import (
 	mdmmock "github.com/fleetdm/fleet/v4/server/mock/mdm"
 	"github.com/fleetdm/fleet/v4/server/ptr"
 	"github.com/fleetdm/fleet/v4/server/service"
+	"github.com/fleetdm/fleet/v4/server/test"
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -36,13 +37,13 @@ const (
 	orgName        = "GitOps Test"
 )
 
-func TestFilenameValidation(t *testing.T) {
+func TestGitOpsFilenameValidation(t *testing.T) {
 	filename := strings.Repeat("a", filenameMaxLength+1)
 	_, err := runAppNoChecks([]string{"gitops", "-f", filename})
 	assert.ErrorContains(t, err, "file name must be less than")
 }
 
-func TestBasicGlobalFreeGitOps(t *testing.T) {
+func TestGitOpsBasicGlobalFree(t *testing.T) {
 	// Cannot run t.Parallel() because it sets environment variables
 
 	_, ds := runServerWithMockedDS(t)
@@ -50,13 +51,13 @@ func TestBasicGlobalFreeGitOps(t *testing.T) {
 	ds.BatchSetMDMProfilesFunc = func(
 		ctx context.Context, tmID *uint, macProfiles []*fleet.MDMAppleConfigProfile, winProfiles []*fleet.MDMWindowsConfigProfile,
 		macDecls []*fleet.MDMAppleDeclaration,
-	) error {
-		return nil
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 	ds.BulkSetPendingMDMHostProfilesFunc = func(
 		ctx context.Context, hostIDs []uint, teamIDs []uint, profileUUIDs []string, hostUUIDs []string,
-	) error {
-		return nil
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 	ds.BatchSetScriptsFunc = func(ctx context.Context, tmID *uint, scripts []*fleet.Script) error { return nil }
 	ds.NewActivityFunc = func(
@@ -142,6 +143,28 @@ org_settings:
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "organization name must be present")
 
+	// Missing controls.
+	tmpFile2, err := os.CreateTemp(t.TempDir(), "*.yml")
+	require.NoError(t, err)
+	_, err = tmpFile2.WriteString(
+		`
+queries:
+policies:
+agent_options:
+org_settings:
+  server_settings:
+    server_url: https://example.com
+  org_info:
+    contact_url: https://example.com/contact
+    org_name: Foobar
+  secrets:
+`,
+	)
+	require.NoError(t, err)
+	_, err = runAppNoChecks([]string{"gitops", "-f", tmpFile2.Name()})
+	require.Error(t, err)
+	assert.Equal(t, `'controls' must be set on global config`, err.Error())
+
 	// Dry run
 	t.Setenv("ORG_NAME", orgName)
 	_ = runAppForTest(t, []string{"gitops", "-f", tmpFile.Name(), "--dry-run"})
@@ -154,26 +177,27 @@ org_settings:
 	assert.Empty(t, enrolledSecrets)
 }
 
-func TestBasicGlobalPremiumGitOps(t *testing.T) {
+func TestGitOpsBasicGlobalPremium(t *testing.T) {
 	// Cannot run t.Parallel() because it sets environment variables
 
 	license := &fleet.LicenseInfo{Tier: fleet.TierPremium, Expiration: time.Now().Add(24 * time.Hour)}
 	_, ds := runServerWithMockedDS(
 		t, &service.TestServerOpts{
-			License: license,
+			License:       license,
+			KeyValueStore: newMemKeyValueStore(),
 		},
 	)
 
 	ds.BatchSetMDMProfilesFunc = func(
 		ctx context.Context, tmID *uint, macProfiles []*fleet.MDMAppleConfigProfile, winProfiles []*fleet.MDMWindowsConfigProfile,
 		macDecls []*fleet.MDMAppleDeclaration,
-	) error {
-		return nil
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 	ds.BulkSetPendingMDMHostProfilesFunc = func(
 		ctx context.Context, hostIDs []uint, teamIDs []uint, profileUUIDs []string, hostUUIDs []string,
-	) error {
-		return nil
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 	ds.BatchSetScriptsFunc = func(ctx context.Context, tmID *uint, scripts []*fleet.Script) error { return nil }
 	ds.NewActivityFunc = func(
@@ -207,6 +231,12 @@ func TestBasicGlobalPremiumGitOps(t *testing.T) {
 	ds.NewJobFunc = func(ctx context.Context, job *fleet.Job) (*fleet.Job, error) {
 		return &fleet.Job{}, nil
 	}
+	ds.BatchSetSoftwareInstallersFunc = func(ctx context.Context, teamID *uint, installers []*fleet.UploadSoftwareInstallerPayload) error {
+		return nil
+	}
+	ds.GetSoftwareInstallersFunc = func(ctx context.Context, tmID uint) ([]fleet.SoftwarePackageResponse, error) {
+		return nil, nil
+	}
 
 	tmpFile, err := os.CreateTemp(t.TempDir(), "*.yml")
 	require.NoError(t, err)
@@ -238,6 +268,7 @@ org_settings:
     org_logo_url_light_background: ""
     org_name: ${ORG_NAME}
   secrets:
+software:
 `,
 	)
 	require.NoError(t, err)
@@ -254,18 +285,19 @@ org_settings:
 	assert.Empty(t, enrolledSecrets)
 }
 
-func TestBasicTeamGitOps(t *testing.T) {
+func TestGitOpsBasicTeam(t *testing.T) {
 	// Cannot run t.Parallel() because it sets environment variables
 	license := &fleet.LicenseInfo{Tier: fleet.TierPremium, Expiration: time.Now().Add(24 * time.Hour)}
 	_, ds := runServerWithMockedDS(
 		t, &service.TestServerOpts{
-			License: license,
+			License:       license,
+			KeyValueStore: newMemKeyValueStore(),
 		},
 	)
 
 	const secret = "TestSecret"
 
-	ds.SetTeamVPPAppsFunc = func(ctx context.Context, teamID *uint, adamIDs []fleet.VPPAppID) error {
+	ds.SetTeamVPPAppsFunc = func(ctx context.Context, teamID *uint, adamIDs []fleet.VPPAppTeam) error {
 		return nil
 	}
 	ds.BatchInsertVPPAppsFunc = func(ctx context.Context, apps []*fleet.VPPApp) error {
@@ -274,13 +306,13 @@ func TestBasicTeamGitOps(t *testing.T) {
 	ds.BatchSetScriptsFunc = func(ctx context.Context, tmID *uint, scripts []*fleet.Script) error { return nil }
 	ds.BatchSetMDMProfilesFunc = func(
 		ctx context.Context, tmID *uint, macProfiles []*fleet.MDMAppleConfigProfile, winProfiles []*fleet.MDMWindowsConfigProfile, macDecls []*fleet.MDMAppleDeclaration,
-	) error {
-		return nil
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 	ds.BulkSetPendingMDMHostProfilesFunc = func(
 		ctx context.Context, hostIDs []uint, teamIDs []uint, profileUUIDs []string, hostUUIDs []string,
-	) error {
-		return nil
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 	ds.NewActivityFunc = func(
 		ctx context.Context, user *fleet.User, activity fleet.ActivityDetails, details []byte, createdAt time.Time,
@@ -350,6 +382,9 @@ func TestBasicTeamGitOps(t *testing.T) {
 	ds.BatchSetSoftwareInstallersFunc = func(ctx context.Context, teamID *uint, installers []*fleet.UploadSoftwareInstallerPayload) error {
 		return nil
 	}
+	ds.GetSoftwareInstallersFunc = func(ctx context.Context, tmID uint) ([]fleet.SoftwarePackageResponse, error) {
+		return nil, nil
+	}
 	ds.ApplyEnrollSecretsFunc = func(ctx context.Context, teamID *uint, secrets []*fleet.EnrollSecret) error {
 		enrolledTeamSecrets = secrets
 		return nil
@@ -360,6 +395,9 @@ func TestBasicTeamGitOps(t *testing.T) {
 	ds.NewJobFunc = func(ctx context.Context, job *fleet.Job) (*fleet.Job, error) {
 		return &fleet.Job{}, nil
 	}
+	ds.ListSoftwareTitlesFunc = func(ctx context.Context, opt fleet.SoftwareTitleListOptions, tmFilter fleet.TeamFilter) ([]fleet.SoftwareTitleListResult, int, *fleet.PaginationMetadata, error) {
+		return nil, 0, nil, nil
+	}
 
 	tmpFile, err := os.CreateTemp(t.TempDir(), "*.yml")
 	require.NoError(t, err)
@@ -381,6 +419,7 @@ agent_options:
 name: ${TEST_TEAM_NAME}
 team_settings:
   secrets: ${TEST_SECRET}
+software:
 `,
 	)
 	require.NoError(t, err)
@@ -391,6 +430,26 @@ team_settings:
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "'name' is required")
 
+	// Invalid name for "No team" file (dry and real).
+	t.Setenv("TEST_TEAM_NAME", "no TEam")
+	_, err = runAppNoChecks([]string{"gitops", "-f", tmpFile.Name(), "--dry-run"})
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), fmt.Sprintf("file %q for 'No team' must be named 'no-team.yml'", tmpFile.Name()))
+	t.Setenv("TEST_TEAM_NAME", "no TEam")
+	_, err = runAppNoChecks([]string{"gitops", "-f", tmpFile.Name()})
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), fmt.Sprintf("file %q for 'No team' must be named 'no-team.yml'", tmpFile.Name()))
+
+	t.Setenv("TEST_TEAM_NAME", "All teams")
+	_, err = runAppNoChecks([]string{"gitops", "-f", tmpFile.Name(), "--dry-run"})
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), `"All teams" is a reserved team name`)
+
+	t.Setenv("TEST_TEAM_NAME", "All TEAMS")
+	_, err = runAppNoChecks([]string{"gitops", "-f", tmpFile.Name()})
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), `"All teams" is a reserved team name`)
+
 	// Dry run
 	t.Setenv("TEST_TEAM_NAME", teamName)
 	_ = runAppForTest(t, []string{"gitops", "-f", tmpFile.Name(), "--dry-run"})
@@ -413,7 +472,7 @@ team_settings:
 	assert.Equal(t, secret, enrolledTeamSecrets[0].Secret)
 }
 
-func TestFullGlobalGitOps(t *testing.T) {
+func TestGitOpsFullGlobal(t *testing.T) {
 	// Cannot run t.Parallel() because it sets environment variables
 	// mdm test configuration must be set so that activating windows MDM works.
 	testCert, testKey, err := apple_mdm.NewSCEPCACertKey()
@@ -446,13 +505,14 @@ func TestFullGlobalGitOps(t *testing.T) {
 	var appliedWinProfiles []*fleet.MDMWindowsConfigProfile
 	ds.BatchSetMDMProfilesFunc = func(
 		ctx context.Context, tmID *uint, macProfiles []*fleet.MDMAppleConfigProfile, winProfiles []*fleet.MDMWindowsConfigProfile, macDecls []*fleet.MDMAppleDeclaration,
-	) error {
+	) (updates fleet.MDMProfilesUpdates, err error) {
 		appliedMacProfiles = macProfiles
 		appliedWinProfiles = winProfiles
-		return nil
+		return fleet.MDMProfilesUpdates{}, nil
 	}
-	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hostIDs, teamIDs []uint, profileUUIDs, hostUUIDs []string) error {
-		return nil
+	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hostIDs, teamIDs []uint, profileUUIDs, hostUUIDs []string,
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 	ds.NewJobFunc = func(ctx context.Context, job *fleet.Job) (*fleet.Job, error) {
 		return job, nil
@@ -537,16 +597,10 @@ func TestFullGlobalGitOps(t *testing.T) {
 	)
 	t.Setenv("FLEET_SERVER_URL", fleetServerURL)
 	t.Setenv("ORG_NAME", orgName)
-	t.Setenv("APPLE_BM_DEFAULT_TEAM", teamName)
+	t.Setenv("SOFTWARE_INSTALLER_URL", fleetServerURL)
 	file := "./testdata/gitops/global_config_no_paths.yml"
 
-	// Dry run should fail because Apple BM Default Team does not exist and premium license is not set
-	_, err = runAppNoChecks([]string{"gitops", "-f", file, "--dry-run"})
-	require.Error(t, err)
-	assert.True(t, strings.Contains(err.Error(), "missing or invalid license"))
-
 	// Dry run
-	t.Setenv("APPLE_BM_DEFAULT_TEAM", "")
 	_ = runAppForTest(t, []string{"gitops", "-f", file, "--dry-run"})
 	assert.Equal(t, fleet.AppConfig{}, *savedAppConfig, "AppConfig should be empty")
 	assert.Len(t, enrolledSecrets, 0)
@@ -579,7 +633,7 @@ func TestFullGlobalGitOps(t *testing.T) {
 	assert.Equal(t, "https://activities_webhook_url", savedAppConfig.WebhookSettings.ActivitiesWebhook.DestinationURL)
 }
 
-func TestFullTeamGitOps(t *testing.T) {
+func TestGitOpsFullTeam(t *testing.T) {
 	// Cannot run t.Parallel() because it sets environment variables
 	license := &fleet.LicenseInfo{Tier: fleet.TierPremium, Expiration: time.Now().Add(24 * time.Hour)}
 
@@ -599,6 +653,7 @@ func TestFullTeamGitOps(t *testing.T) {
 			MDMPusher:        mockPusher{},
 			FleetConfig:      &fleetCfg,
 			NoCacheDatastore: true,
+			KeyValueStore:    newMemKeyValueStore(),
 		},
 	)
 
@@ -627,13 +682,14 @@ func TestFullTeamGitOps(t *testing.T) {
 	var appliedWinProfiles []*fleet.MDMWindowsConfigProfile
 	ds.BatchSetMDMProfilesFunc = func(
 		ctx context.Context, tmID *uint, macProfiles []*fleet.MDMAppleConfigProfile, winProfiles []*fleet.MDMWindowsConfigProfile, macDecls []*fleet.MDMAppleDeclaration,
-	) error {
+	) (updates fleet.MDMProfilesUpdates, err error) {
 		appliedMacProfiles = macProfiles
 		appliedWinProfiles = winProfiles
-		return nil
+		return fleet.MDMProfilesUpdates{}, nil
 	}
-	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hostIDs, teamIDs []uint, profileUUIDs, hostUUIDs []string) error {
-		return nil
+	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hostIDs, teamIDs []uint, profileUUIDs, hostUUIDs []string,
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 	ds.NewJobFunc = func(ctx context.Context, job *fleet.Job) (*fleet.Job, error) {
 		return job, nil
@@ -659,6 +715,9 @@ func TestFullTeamGitOps(t *testing.T) {
 	// Team
 	var savedTeam *fleet.Team
 	ds.TeamByNameFunc = func(ctx context.Context, name string) (*fleet.Team, error) {
+		if name == "Conflict" {
+			return &fleet.Team{}, nil
+		}
 		if savedTeam != nil && savedTeam.Name == name {
 			return savedTeam, nil
 		}
@@ -754,10 +813,15 @@ func TestFullTeamGitOps(t *testing.T) {
 		appliedQueries = queries
 		return nil
 	}
+	var appliedSoftwareInstallers []*fleet.UploadSoftwareInstallerPayload
 	ds.BatchSetSoftwareInstallersFunc = func(ctx context.Context, teamID *uint, installers []*fleet.UploadSoftwareInstallerPayload) error {
+		appliedSoftwareInstallers = installers
 		return nil
 	}
-	ds.SetTeamVPPAppsFunc = func(ctx context.Context, teamID *uint, adamIDs []fleet.VPPAppID) error {
+	ds.GetSoftwareInstallersFunc = func(ctx context.Context, tmID uint) ([]fleet.SoftwarePackageResponse, error) {
+		return nil, nil
+	}
+	ds.SetTeamVPPAppsFunc = func(ctx context.Context, teamID *uint, adamIDs []fleet.VPPAppTeam) error {
 		return nil
 	}
 	ds.BatchInsertVPPAppsFunc = func(ctx context.Context, apps []*fleet.VPPApp) error {
@@ -767,6 +831,9 @@ func TestFullTeamGitOps(t *testing.T) {
 		enrolledSecrets = secrets
 		return nil
 	}
+	ds.ListSoftwareTitlesFunc = func(ctx context.Context, opt fleet.SoftwareTitleListOptions, tmFilter fleet.TeamFilter) ([]fleet.SoftwareTitleListResult, int, *fleet.PaginationMetadata, error) {
+		return nil, 0, nil, nil
+	}
 
 	startSoftwareInstallerServer(t)
 
@@ -774,8 +841,8 @@ func TestFullTeamGitOps(t *testing.T) {
 
 	// Dry run
 	const baseFilename = "team_config_no_paths.yml"
-	file := "./testdata/gitops/" + baseFilename
-	_ = runAppForTest(t, []string{"gitops", "-f", file, "--dry-run"})
+	gitopsFile := "./testdata/gitops/" + baseFilename
+	_ = runAppForTest(t, []string{"gitops", "-f", gitopsFile, "--dry-run"})
 	assert.Nil(t, savedTeam)
 	assert.Len(t, enrolledSecrets, 0)
 	assert.Len(t, appliedPolicySpecs, 0)
@@ -783,13 +850,14 @@ func TestFullTeamGitOps(t *testing.T) {
 	assert.Len(t, appliedScripts, 0)
 	assert.Len(t, appliedMacProfiles, 0)
 	assert.Len(t, appliedWinProfiles, 0)
+	assert.Empty(t, appliedSoftwareInstallers)
 
 	// Real run
 	// Setting global calendar config
 	appConfig.Integrations = fleet.Integrations{
 		GoogleCalendar: []*fleet.GoogleCalendarIntegration{{}},
 	}
-	_ = runAppForTest(t, []string{"gitops", "-f", file})
+	_ = runAppForTest(t, []string{"gitops", "-f", gitopsFile})
 	require.NotNil(t, savedTeam)
 	assert.Equal(t, teamName, savedTeam.Name)
 	assert.Contains(t, string(*savedTeam.Config.AgentOptions), "distributed_denylist_duration")
@@ -809,17 +877,30 @@ func TestFullTeamGitOps(t *testing.T) {
 	require.NotNil(t, savedTeam.Config.Integrations.GoogleCalendar)
 	assert.True(t, savedTeam.Config.Integrations.GoogleCalendar.Enable)
 	assert.Equal(t, baseFilename, *savedTeam.Filename)
+	require.Len(t, appliedSoftwareInstallers, 2)
+	packageID := `"ruby"`
+	uninstallScriptProcessed := strings.ReplaceAll(file.GetUninstallScript("deb"), "$PACKAGE_ID", packageID)
+	assert.ElementsMatch(t, []string{fmt.Sprintf("echo 'uninstall' %s\n", packageID), uninstallScriptProcessed},
+		[]string{appliedSoftwareInstallers[0].UninstallScript, appliedSoftwareInstallers[1].UninstallScript})
 
 	// Change team name
 	newTeamName := "New Team Name"
 	t.Setenv("TEST_TEAM_NAME", newTeamName)
-	_ = runAppForTest(t, []string{"gitops", "-f", file, "--dry-run"})
-	_ = runAppForTest(t, []string{"gitops", "-f", file})
+	_ = runAppForTest(t, []string{"gitops", "-f", gitopsFile, "--dry-run"})
+	_ = runAppForTest(t, []string{"gitops", "-f", gitopsFile})
 	require.NotNil(t, savedTeam)
 	assert.Equal(t, newTeamName, savedTeam.Name)
 	assert.Equal(t, baseFilename, *savedTeam.Filename)
 
+	// Try to change team name again, but this time the new name conflicts with an existing team
+	t.Setenv("TEST_TEAM_NAME", "Conflict")
+	_, err = runAppNoChecks([]string{"gitops", "-f", gitopsFile, "--dry-run"})
+	assert.ErrorContains(t, err, "team name already exists")
+	_, err = runAppNoChecks([]string{"gitops", "-f", gitopsFile})
+	assert.ErrorContains(t, err, "team name already exists")
+
 	// Now clear the settings
+	t.Setenv("TEST_TEAM_NAME", newTeamName)
 	tmpFile, err := os.CreateTemp(t.TempDir(), "*.yml")
 	require.NoError(t, err)
 	secret := "TestSecret"
@@ -834,6 +915,7 @@ agent_options:
 name: ${TEST_TEAM_NAME}
 team_settings:
   secrets: [{"secret":"${TEST_SECRET}"}]
+software:
 `,
 	)
 	require.NoError(t, err)
@@ -863,12 +945,13 @@ team_settings:
 	assert.Equal(t, filepath.Base(tmpFile.Name()), *savedTeam.Filename)
 }
 
-func TestBasicGlobalAndTeamGitOps(t *testing.T) {
+func TestGitOpsBasicGlobalAndTeam(t *testing.T) {
 	// Cannot run t.Parallel() because it sets environment variables
 	license := &fleet.LicenseInfo{Tier: fleet.TierPremium, Expiration: time.Now().Add(24 * time.Hour)}
 	_, ds := runServerWithMockedDS(
 		t, &service.TestServerOpts{
-			License: license,
+			License:       license,
+			KeyValueStore: newMemKeyValueStore(),
 		},
 	)
 
@@ -882,7 +965,7 @@ func TestBasicGlobalAndTeamGitOps(t *testing.T) {
 		return nil
 	}
 
-	ds.SetTeamVPPAppsFunc = func(ctx context.Context, teamID *uint, adamIDs []fleet.VPPAppID) error {
+	ds.SetTeamVPPAppsFunc = func(ctx context.Context, teamID *uint, adamIDs []fleet.VPPAppTeam) error {
 		return nil
 	}
 	ds.BatchInsertVPPAppsFunc = func(ctx context.Context, apps []*fleet.VPPApp) error {
@@ -917,10 +1000,10 @@ func TestBasicGlobalAndTeamGitOps(t *testing.T) {
 	ds.BatchSetMDMProfilesFunc = func(
 		ctx context.Context, tmID *uint, macProfiles []*fleet.MDMAppleConfigProfile, winProfiles []*fleet.MDMWindowsConfigProfile,
 		macDecls []*fleet.MDMAppleDeclaration,
-	) error {
+	) (updates fleet.MDMProfilesUpdates, err error) {
 		assert.Empty(t, macProfiles)
 		assert.Empty(t, winProfiles)
-		return nil
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 	ds.BatchSetScriptsFunc = func(ctx context.Context, tmID *uint, scripts []*fleet.Script) error {
 		assert.Empty(t, scripts)
@@ -928,9 +1011,9 @@ func TestBasicGlobalAndTeamGitOps(t *testing.T) {
 	}
 	ds.BulkSetPendingMDMHostProfilesFunc = func(
 		ctx context.Context, hostIDs []uint, teamIDs []uint, profileUUIDs []string, hostUUIDs []string,
-	) error {
+	) (updates fleet.MDMProfilesUpdates, err error) {
 		assert.Empty(t, profileUUIDs)
-		return nil
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 	ds.DeleteMDMAppleDeclarationByNameFunc = func(ctx context.Context, teamID *uint, name string) error {
 		return nil
@@ -989,6 +1072,12 @@ func TestBasicGlobalAndTeamGitOps(t *testing.T) {
 	ds.BatchSetSoftwareInstallersFunc = func(ctx context.Context, teamID *uint, installers []*fleet.UploadSoftwareInstallerPayload) error {
 		return nil
 	}
+	ds.GetSoftwareInstallersFunc = func(ctx context.Context, tmID uint) ([]fleet.SoftwarePackageResponse, error) {
+		return nil, nil
+	}
+	ds.ListSoftwareTitlesFunc = func(ctx context.Context, opt fleet.SoftwareTitleListOptions, tmFilter fleet.TeamFilter) ([]fleet.SoftwareTitleListResult, int, *fleet.PaginationMetadata, error) {
+		return nil, 0, nil, nil
+	}
 
 	globalFile, err := os.CreateTemp(t.TempDir(), "*.yml")
 	require.NoError(t, err)
@@ -1011,6 +1100,7 @@ org_settings:
     org_logo_url_light_background: ""
     org_name: ${ORG_NAME}
   secrets: [{"secret":"globalSecret"}]
+software:
 `,
 	)
 	require.NoError(t, err)
@@ -1030,6 +1120,7 @@ agent_options:
 name: ${TEST_TEAM_NAME}
 team_settings:
   secrets: [{"secret":"${TEST_SECRET}"}]
+software:
 `,
 	)
 	require.NoError(t, err)
@@ -1045,6 +1136,7 @@ agent_options:
 name: ${TEST_TEAM_NAME}
 team_settings:
   secrets: [{"secret":"${TEST_SECRET}"},{"secret":"globalSecret"}]
+software:
 `,
 	)
 	require.NoError(t, err)
@@ -1119,10 +1211,367 @@ team_settings:
 	assert.True(t, ds.DeleteTeamFuncInvoked)
 }
 
-func TestFullGlobalAndTeamGitOps(t *testing.T) {
+func TestGitOpsBasicGlobalAndNoTeam(t *testing.T) {
+	// Cannot run t.Parallel() because runServerWithMockedDS sets the FLEET_SERVER_ADDRESS
+	// environment variable.
+
+	license := &fleet.LicenseInfo{Tier: fleet.TierPremium, Expiration: time.Now().Add(24 * time.Hour)}
+	_, ds := runServerWithMockedDS(
+		t, &service.TestServerOpts{
+			License:       license,
+			KeyValueStore: newMemKeyValueStore(),
+		},
+	)
+	// Mock appConfig
+	savedAppConfig := &fleet.AppConfig{}
+	ds.AppConfigFunc = func(ctx context.Context) (*fleet.AppConfig, error) {
+		return &fleet.AppConfig{}, nil
+	}
+	ds.SaveAppConfigFunc = func(ctx context.Context, config *fleet.AppConfig) error {
+		savedAppConfig = config
+		return nil
+	}
+	ds.SetTeamVPPAppsFunc = func(ctx context.Context, teamID *uint, adamIDs []fleet.VPPAppTeam) error {
+		return nil
+	}
+	ds.BatchInsertVPPAppsFunc = func(ctx context.Context, apps []*fleet.VPPApp) error {
+		return nil
+	}
+
+	const (
+		fleetServerURL = "https://fleet.example.com"
+		orgName        = "GitOps Test"
+		secret         = "TestSecret"
+	)
+	var enrolledSecrets []*fleet.EnrollSecret
+	var enrolledTeamSecrets []*fleet.EnrollSecret
+	var savedTeam *fleet.Team
+	team := &fleet.Team{
+		ID:        1,
+		CreatedAt: time.Now(),
+		Name:      teamName,
+	}
+
+	ds.IsEnrollSecretAvailableFunc = func(ctx context.Context, secret string, new bool, teamID *uint) (bool, error) {
+		return true, nil
+	}
+	ds.ApplyEnrollSecretsFunc = func(ctx context.Context, teamID *uint, secrets []*fleet.EnrollSecret) error {
+		if teamID == nil {
+			enrolledSecrets = secrets
+		} else {
+			enrolledTeamSecrets = secrets
+		}
+		return nil
+	}
+	ds.BatchSetMDMProfilesFunc = func(
+		ctx context.Context, tmID *uint, macProfiles []*fleet.MDMAppleConfigProfile, winProfiles []*fleet.MDMWindowsConfigProfile,
+		macDecls []*fleet.MDMAppleDeclaration,
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		assert.Empty(t, macProfiles)
+		assert.Empty(t, winProfiles)
+		return fleet.MDMProfilesUpdates{}, nil
+	}
+	ds.BatchSetScriptsFunc = func(ctx context.Context, tmID *uint, scripts []*fleet.Script) error {
+		assert.Empty(t, scripts)
+		return nil
+	}
+	ds.BulkSetPendingMDMHostProfilesFunc = func(
+		ctx context.Context, hostIDs []uint, teamIDs []uint, profileUUIDs []string, hostUUIDs []string,
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		assert.Empty(t, profileUUIDs)
+		return fleet.MDMProfilesUpdates{}, nil
+	}
+	ds.DeleteMDMAppleDeclarationByNameFunc = func(ctx context.Context, teamID *uint, name string) error {
+		return nil
+	}
+	ds.LabelIDsByNameFunc = func(ctx context.Context, labels []string) (map[string]uint, error) {
+		require.ElementsMatch(t, labels, []string{fleet.BuiltinLabelMacOS14Plus})
+		return map[string]uint{fleet.BuiltinLabelMacOS14Plus: 1}, nil
+	}
+	ds.ListGlobalPoliciesFunc = func(ctx context.Context, opts fleet.ListOptions) ([]*fleet.Policy, error) { return nil, nil }
+	ds.ListTeamPoliciesFunc = func(
+		ctx context.Context, teamID uint, opts fleet.ListOptions, iopts fleet.ListOptions,
+	) (teamPolicies []*fleet.Policy, inheritedPolicies []*fleet.Policy, err error) {
+		return nil, nil, nil
+	}
+	ds.ListTeamsFunc = func(ctx context.Context, filter fleet.TeamFilter, opt fleet.ListOptions) ([]*fleet.Team, error) {
+		return nil, nil
+	}
+	ds.ListQueriesFunc = func(ctx context.Context, opts fleet.ListQueryOptions) ([]*fleet.Query, error) { return nil, nil }
+	ds.NewActivityFunc = func(
+		ctx context.Context, user *fleet.User, activity fleet.ActivityDetails, details []byte, createdAt time.Time,
+	) error {
+		return nil
+	}
+	ds.NewJobFunc = func(ctx context.Context, job *fleet.Job) (*fleet.Job, error) {
+		job.ID = 1
+		return job, nil
+	}
+	ds.TeamFunc = func(ctx context.Context, tid uint) (*fleet.Team, error) {
+		if tid == team.ID {
+			return savedTeam, nil
+		}
+		return nil, nil
+	}
+	ds.TeamByNameFunc = func(ctx context.Context, name string) (*fleet.Team, error) {
+		if name == teamName && savedTeam != nil {
+			return savedTeam, nil
+		}
+		return nil, &notFoundError{}
+	}
+	ds.TeamByFilenameFunc = func(ctx context.Context, filename string) (*fleet.Team, error) {
+		if savedTeam != nil && *savedTeam.Filename == filename {
+			return savedTeam, nil
+		}
+		return nil, &notFoundError{}
+	}
+	ds.NewTeamFunc = func(ctx context.Context, newTeam *fleet.Team) (*fleet.Team, error) {
+		newTeam.ID = team.ID
+		savedTeam = newTeam
+		enrolledTeamSecrets = newTeam.Secrets
+		return newTeam, nil
+	}
+	ds.SaveTeamFunc = func(ctx context.Context, team *fleet.Team) (*fleet.Team, error) {
+		savedTeam = team
+		return team, nil
+	}
+	ds.BatchSetSoftwareInstallersFunc = func(ctx context.Context, teamID *uint, installers []*fleet.UploadSoftwareInstallerPayload) error {
+		return nil
+	}
+	ds.GetSoftwareInstallersFunc = func(ctx context.Context, tmID uint) ([]fleet.SoftwarePackageResponse, error) {
+		return nil, nil
+	}
+	ds.ListSoftwareTitlesFunc = func(ctx context.Context, opt fleet.SoftwareTitleListOptions, tmFilter fleet.TeamFilter) ([]fleet.SoftwareTitleListResult, int, *fleet.PaginationMetadata, error) {
+		return nil, 0, nil, nil
+	}
+
+	globalFileBasic, err := os.CreateTemp(t.TempDir(), "*.yml")
+	require.NoError(t, err)
+
+	_, err = globalFileBasic.WriteString(fmt.Sprintf(
+		`
+controls:
+queries:
+policies:
+agent_options:
+org_settings:
+  server_settings:
+    server_url: %s
+  org_info:
+    contact_url: https://example.com/contact
+    org_logo_url: ""
+    org_logo_url_light_background: ""
+    org_name: %s
+  secrets: [{"secret":"globalSecret"}]
+software:
+`, fleetServerURL, orgName),
+	)
+	require.NoError(t, err)
+
+	globalFileWithSoftware, err := os.CreateTemp(t.TempDir(), "*.yml")
+	require.NoError(t, err)
+	_, err = globalFileWithSoftware.WriteString(fmt.Sprintf(
+		`
+controls:
+queries:
+policies:
+agent_options:
+org_settings:
+  server_settings:
+    server_url: %s
+  org_info:
+    contact_url: https://example.com/contact
+    org_logo_url: ""
+    org_logo_url_light_background: ""
+    org_name: %s
+  secrets: [{"secret":"globalSecret"}]
+software:
+  packages:
+    - url: https://example.com
+`, fleetServerURL, orgName),
+	)
+	require.NoError(t, err)
+
+	globalFileWithControls, err := os.CreateTemp(t.TempDir(), "*.yml")
+	require.NoError(t, err)
+	_, err = globalFileWithControls.WriteString(fmt.Sprintf(
+		`
+controls:
+  ios_updates:
+    deadline: "2022-02-02"
+    minimum_version: "17.6"
+queries:
+policies:
+agent_options:
+org_settings:
+  server_settings:
+    server_url: %s
+  org_info:
+    contact_url: https://example.com/contact
+    org_logo_url: ""
+    org_logo_url_light_background: ""
+    org_name: %s
+  secrets: [{"secret":"globalSecret"}]
+software:
+`, fleetServerURL, orgName),
+	)
+	require.NoError(t, err)
+
+	globalFileWithoutControlsAndSoftwareKeys, err := os.CreateTemp(t.TempDir(), "*.yml")
+	require.NoError(t, err)
+	_, err = globalFileWithoutControlsAndSoftwareKeys.WriteString(fmt.Sprintf(
+		`
+queries:
+policies:
+agent_options:
+org_settings:
+  server_settings:
+    server_url: %s
+  org_info:
+    contact_url: https://example.com/contact
+    org_logo_url: ""
+    org_logo_url_light_background: ""
+    org_name: %s
+  secrets: [{"secret":"globalSecret"}]
+`, fleetServerURL, orgName),
+	)
+	require.NoError(t, err)
+
+	teamFile, err := os.CreateTemp(t.TempDir(), "*.yml")
+	require.NoError(t, err)
+	_, err = teamFile.WriteString(fmt.Sprintf(`
+controls:
+queries:
+policies:
+agent_options:
+name: %s
+team_settings:
+  secrets: [{"secret":"%s"}]
+software:
+`, teamName, secret),
+	)
+	require.NoError(t, err)
+
+	noTeamFilePath := filepath.Join(t.TempDir(), "no-team.yml")
+	noTeamFile, err := os.Create(noTeamFilePath)
+	require.NoError(t, err)
+	_, err = noTeamFile.WriteString(`
+controls:
+policies:
+name: No team
+software:
+`)
+	require.NoError(t, err)
+
+	noTeamFilePathPoliciesCalendarPath := filepath.Join(t.TempDir(), "no-team.yml")
+	noTeamFilePathPoliciesCalendar, err := os.Create(noTeamFilePathPoliciesCalendarPath)
+	require.NoError(t, err)
+	_, err = noTeamFilePathPoliciesCalendar.WriteString(`
+controls:
+policies:
+  - name: Foobar
+    query: SELECT 1 FROM osquery_info WHERE start_time < 0;
+    calendar_events_enabled: true
+name: No team
+software:
+`)
+	require.NoError(t, err)
+
+	noTeamFilePathWithControls := filepath.Join(t.TempDir(), "no-team.yml")
+	noTeamFileWithControls, err := os.Create(noTeamFilePathWithControls)
+	require.NoError(t, err)
+	_, err = noTeamFileWithControls.WriteString(`
+controls:
+  ipados_updates:
+    deadline: "2023-03-03"
+    minimum_version: "18.0"
+policies:
+name: No team
+software:
+`)
+	require.NoError(t, err)
+
+	noTeamFilePathWithoutControls := filepath.Join(t.TempDir(), "no-team.yml")
+	noTeamFileWithoutControls, err := os.Create(noTeamFilePathWithoutControls)
+	require.NoError(t, err)
+	_, err = noTeamFileWithoutControls.WriteString(`
+policies:
+name: No team
+software:
+`)
+	require.NoError(t, err)
+
+	// Dry run, global defines software, should fail.
+	_, err = runAppNoChecks([]string{"gitops", "-f", globalFileWithSoftware.Name(), "-f", teamFile.Name(), "-f", noTeamFile.Name(), "--dry-run"})
+	require.Error(t, err)
+	assert.True(t, strings.Contains(err.Error(), "'software' cannot be set on global file"))
+	// Real run, global defines software, should fail.
+	_, err = runAppNoChecks([]string{"gitops", "-f", globalFileWithSoftware.Name(), "-f", teamFile.Name(), "-f", noTeamFile.Name()})
+	require.Error(t, err)
+	assert.True(t, strings.Contains(err.Error(), "'software' cannot be set on global file"))
+
+	// Dry run, both global and no-team.yml define controls.
+	_, err = runAppNoChecks([]string{"gitops", "-f", globalFileWithControls.Name(), "-f", teamFile.Name(), "-f", noTeamFileWithControls.Name(), "--dry-run"})
+	require.Error(t, err)
+	assert.True(t, strings.Contains(err.Error(), "'controls' cannot be set on both global config and on no-team.yml"))
+	// Real run, both global and no-team.yml define controls.
+	_, err = runAppNoChecks([]string{"gitops", "-f", globalFileWithControls.Name(), "-f", teamFile.Name(), "-f", noTeamFileWithControls.Name()})
+	require.Error(t, err)
+	assert.True(t, strings.Contains(err.Error(), "'controls' cannot be set on both global config and on no-team.yml"))
+
+	// Dry run, both global and no-team.yml defines policy with calendar events enabled.
+	_, err = runAppNoChecks([]string{"gitops", "-f", globalFileWithControls.Name(), "-f", teamFile.Name(), "-f", noTeamFilePathPoliciesCalendar.Name(), "--dry-run"})
+	require.Error(t, err)
+	assert.True(t, strings.Contains(err.Error(), "calendar events are not supported on \"No team\" policies: \"Foobar\""), err.Error())
+	// Real run, both global and no-team.yml define controls.
+	_, err = runAppNoChecks([]string{"gitops", "-f", globalFileWithControls.Name(), "-f", teamFile.Name(), "-f", noTeamFilePathPoliciesCalendar.Name()})
+	require.Error(t, err)
+	assert.True(t, strings.Contains(err.Error(), "calendar events are not supported on \"No team\" policies: \"Foobar\""), err.Error())
+
+	// Dry run, controls should be defined somewhere, either in no-team.yml or global.
+	_, err = runAppNoChecks([]string{"gitops", "-f", globalFileWithoutControlsAndSoftwareKeys.Name(), "-f", teamFile.Name(), "-f", noTeamFileWithoutControls.Name(), "--dry-run"})
+	require.Error(t, err)
+	assert.True(t, strings.Contains(err.Error(), "'controls' must be set on global config or no-team.yml"))
+	// Real run, both global and no-team.yml define controls.
+	_, err = runAppNoChecks([]string{"gitops", "-f", globalFileWithoutControlsAndSoftwareKeys.Name(), "-f", teamFile.Name(), "-f", noTeamFileWithoutControls.Name()})
+	require.Error(t, err)
+	assert.True(t, strings.Contains(err.Error(), "'controls' must be set on global config or no-team.yml"))
+
+	// Dry run, global file without controls and software keys.
+	_ = runAppForTest(t, []string{"gitops", "-f", globalFileWithoutControlsAndSoftwareKeys.Name(), "-f", teamFile.Name(), "-f", noTeamFile.Name(), "--dry-run"})
+	assert.Equal(t, fleet.AppConfig{}, *savedAppConfig, "AppConfig should be empty")
+
+	// Real run, global file without controls and software keys.
+	_ = runAppForTest(t, []string{"gitops", "-f", globalFileWithoutControlsAndSoftwareKeys.Name(), "-f", teamFile.Name(), "-f", noTeamFile.Name()})
+	assert.Equal(t, orgName, savedAppConfig.OrgInfo.OrgName)
+	assert.Equal(t, fleetServerURL, savedAppConfig.ServerSettings.ServerURL)
+	assert.Len(t, enrolledSecrets, 1)
+	require.NotNil(t, savedTeam)
+	assert.Equal(t, teamName, savedTeam.Name)
+	require.Len(t, enrolledTeamSecrets, 1)
+	assert.Equal(t, secret, enrolledTeamSecrets[0].Secret)
+
+	// Restore to test below.
+	savedAppConfig = &fleet.AppConfig{}
+
+	// Dry run
+	_ = runAppForTest(t, []string{"gitops", "-f", globalFileBasic.Name(), "-f", teamFile.Name(), "-f", noTeamFile.Name(), "--dry-run"})
+	assert.Equal(t, fleet.AppConfig{}, *savedAppConfig, "AppConfig should be empty")
+	// Real run
+	_ = runAppForTest(t, []string{"gitops", "-f", globalFileBasic.Name(), "-f", teamFile.Name(), "-f", noTeamFile.Name()})
+	assert.Equal(t, orgName, savedAppConfig.OrgInfo.OrgName)
+	assert.Equal(t, fleetServerURL, savedAppConfig.ServerSettings.ServerURL)
+	assert.Len(t, enrolledSecrets, 1)
+	require.NotNil(t, savedTeam)
+	assert.Equal(t, teamName, savedTeam.Name)
+	require.Len(t, enrolledTeamSecrets, 1)
+	assert.Equal(t, secret, enrolledTeamSecrets[0].Secret)
+}
+
+func TestGitOpsFullGlobalAndTeam(t *testing.T) {
 	// Cannot run t.Parallel() because it sets environment variables
 	// mdm test configuration must be set so that activating windows MDM works.
-	ds, savedAppConfigPtr, savedTeamPtr := setupFullGitOpsPremiumServer(t)
+	ds, savedAppConfigPtr, savedTeams := setupFullGitOpsPremiumServer(t)
 	startSoftwareInstallerServer(t)
 
 	var enrolledSecrets []*fleet.EnrollSecret
@@ -1150,9 +1599,9 @@ func TestFullGlobalAndTeamGitOps(t *testing.T) {
 	}
 	ds.NewTeamFunc = func(ctx context.Context, team *fleet.Team) (*fleet.Team, error) {
 		team.ID = 1
-		*savedTeamPtr = team
 		enrolledTeamSecrets = team.Secrets
-		return *savedTeamPtr, nil
+		savedTeams[team.Name] = &team
+		return team, nil
 	}
 
 	apnsCert, apnsKey, err := mysql.GenerateTestCertBytes()
@@ -1171,7 +1620,7 @@ func TestFullGlobalAndTeamGitOps(t *testing.T) {
 		}, nil
 	}
 
-	ds.SetTeamVPPAppsFunc = func(ctx context.Context, teamID *uint, adamIDs []fleet.VPPAppID) error {
+	ds.SetTeamVPPAppsFunc = func(ctx context.Context, teamID *uint, adamIDs []fleet.VPPAppTeam) error {
 		return nil
 	}
 	ds.BatchInsertVPPAppsFunc = func(ctx context.Context, apps []*fleet.VPPApp) error {
@@ -1181,11 +1630,6 @@ func TestFullGlobalAndTeamGitOps(t *testing.T) {
 	globalFile := "./testdata/gitops/global_config_no_paths.yml"
 	teamFile := "./testdata/gitops/team_config_no_paths.yml"
 
-	// Dry run on global file should fail because Apple BM Default Team does not exist (and has not been provided)
-	_, err = runAppNoChecks([]string{"gitops", "-f", globalFile, "--dry-run"})
-	require.Error(t, err)
-	assert.True(t, strings.Contains(err.Error(), "team name not found"))
-
 	// Dry run
 	_ = runAppForTest(t, []string{"gitops", "-f", globalFile, "-f", teamFile, "--dry-run", "--delete-other-teams"})
 	assert.False(t, ds.SaveAppConfigFuncInvoked)
@@ -1199,30 +1643,31 @@ func TestFullGlobalAndTeamGitOps(t *testing.T) {
 	assert.Equal(t, orgName, (*savedAppConfigPtr).OrgInfo.OrgName)
 	assert.Equal(t, fleetServerURL, (*savedAppConfigPtr).ServerSettings.ServerURL)
 	assert.Len(t, enrolledSecrets, 2)
-	require.NotNil(t, *savedTeamPtr)
-	assert.Equal(t, teamName, (*savedTeamPtr).Name)
+	require.NotNil(t, *savedTeams[teamName])
+	assert.Equal(t, teamName, (*savedTeams[teamName]).Name)
 	require.Len(t, enrolledTeamSecrets, 2)
 }
 
-func TestTeamSofwareInstallersGitOps(t *testing.T) {
+func TestGitOpsTeamSofwareInstallers(t *testing.T) {
 	startSoftwareInstallerServer(t)
 
 	cases := []struct {
 		file    string
 		wantErr string
 	}{
-		{"testdata/gitops/team_software_installer_not_found.yml", "Please make sure that URLs are publicy accessible to the internet."},
+		{"testdata/gitops/team_software_installer_not_found.yml", "Please make sure that URLs are reachable from your Fleet server."},
 		{"testdata/gitops/team_software_installer_unsupported.yml", "The file should be .pkg, .msi, .exe or .deb."},
-		{"testdata/gitops/team_software_installer_too_large.yml", "The maximum file size is 500 MB"},
+		{"testdata/gitops/team_software_installer_too_large.yml", "The maximum file size is 500 MiB"},
 		{"testdata/gitops/team_software_installer_valid.yml", ""},
 		{"testdata/gitops/team_software_installer_valid_apply.yml", ""},
 		{"testdata/gitops/team_software_installer_pre_condition_multiple_queries.yml", "should have only one query."},
 		{"testdata/gitops/team_software_installer_pre_condition_multiple_queries_apply.yml", "should have only one query."},
 		{"testdata/gitops/team_software_installer_pre_condition_not_found.yml", "no such file or directory"},
 		{"testdata/gitops/team_software_installer_install_not_found.yml", "no such file or directory"},
+		{"testdata/gitops/team_software_installer_uninstall_not_found.yml", "no such file or directory"},
 		{"testdata/gitops/team_software_installer_post_install_not_found.yml", "no such file or directory"},
 		{"testdata/gitops/team_software_installer_no_url.yml", "software URL is required"},
-		{"testdata/gitops/team_software_installer_invalid_self_service_value.yml", "cannot unmarshal string into Go struct field TeamSpecSoftware.packages of type bool"},
+		{"testdata/gitops/team_software_installer_invalid_self_service_value.yml", "\"packages.self_service\" must be a bool, found string"},
 	}
 	for _, c := range cases {
 		t.Run(filepath.Base(c.file), func(t *testing.T) {
@@ -1238,7 +1683,7 @@ func TestTeamSofwareInstallersGitOps(t *testing.T) {
 	}
 }
 
-func TestTeamSoftwareInstallersGitopsQueryEnv(t *testing.T) {
+func TestGitOpsTeamSoftwareInstallersQueryEnv(t *testing.T) {
 	startSoftwareInstallerServer(t)
 	ds, _, _ := setupFullGitOpsPremiumServer(t)
 
@@ -1250,12 +1695,56 @@ func TestTeamSoftwareInstallersGitopsQueryEnv(t *testing.T) {
 		}
 		return nil
 	}
+	ds.GetSoftwareInstallersFunc = func(ctx context.Context, tmID uint) ([]fleet.SoftwarePackageResponse, error) {
+		return nil, nil
+	}
 
 	_, err := runAppNoChecks([]string{"gitops", "-f", "testdata/gitops/team_software_installer_valid_env_query.yml"})
 	require.NoError(t, err)
 }
 
-func TestTeamVPPAppsGitOps(t *testing.T) {
+func TestGitOpsNoTeamSoftwareInstallers(t *testing.T) {
+	startSoftwareInstallerServer(t)
+
+	cases := []struct {
+		noTeamFile string
+		wantErr    string
+	}{
+		{"testdata/gitops/no_team_software_installer_not_found.yml", "Please make sure that URLs are reachable from your Fleet server."},
+		{"testdata/gitops/no_team_software_installer_unsupported.yml", "The file should be .pkg, .msi, .exe or .deb."},
+		{"testdata/gitops/no_team_software_installer_too_large.yml", "The maximum file size is 500 MiB"},
+		{"testdata/gitops/no_team_software_installer_valid.yml", ""},
+		{"testdata/gitops/no_team_software_installer_pre_condition_multiple_queries.yml", "should have only one query."},
+		{"testdata/gitops/no_team_software_installer_pre_condition_not_found.yml", "no such file or directory"},
+		{"testdata/gitops/no_team_software_installer_install_not_found.yml", "no such file or directory"},
+		{"testdata/gitops/no_team_software_installer_uninstall_not_found.yml", "no such file or directory"},
+		{"testdata/gitops/no_team_software_installer_post_install_not_found.yml", "no such file or directory"},
+		{"testdata/gitops/no_team_software_installer_no_url.yml", "software URL is required"},
+		{"testdata/gitops/no_team_software_installer_invalid_self_service_value.yml", "\"packages.self_service\" must be a bool, found string"},
+	}
+	for _, c := range cases {
+		t.Run(filepath.Base(c.noTeamFile), func(t *testing.T) {
+			setupFullGitOpsPremiumServer(t)
+
+			t.Setenv("APPLE_BM_DEFAULT_TEAM", "")
+			globalFile := "./testdata/gitops/global_config_no_paths.yml"
+			dstPath := filepath.Join(filepath.Dir(c.noTeamFile), "no-team.yml")
+			t.Cleanup(func() {
+				os.Remove(dstPath)
+			})
+			err := file.Copy(c.noTeamFile, dstPath, 0o755)
+			require.NoError(t, err)
+			_, err = runAppNoChecks([]string{"gitops", "-f", globalFile, "-f", dstPath})
+			if c.wantErr == "" {
+				require.NoError(t, err)
+			} else {
+				require.ErrorContains(t, err, c.wantErr)
+			}
+		})
+	}
+}
+
+func TestGitOpsTeamVPPApps(t *testing.T) {
 	config := &appleVPPConfigSrvConf{
 		Assets: []vpp.Asset{
 			{
@@ -1305,34 +1794,37 @@ func TestTeamVPPAppsGitOps(t *testing.T) {
 		tokenExpiration time.Time
 	}{
 		{"testdata/gitops/team_vpp_valid_app.yml", "", time.Now().Add(24 * time.Hour)},
-		{"testdata/gitops/team_vpp_valid_app.yml", "", time.Now().Add(24 * time.Hour)},
+		{"testdata/gitops/team_vpp_valid_app_self_service.yml", "", time.Now().Add(24 * time.Hour)},
 		{"testdata/gitops/team_vpp_valid_empty.yml", "", time.Now().Add(24 * time.Hour)},
 		{"testdata/gitops/team_vpp_valid_empty.yml", "", time.Now().Add(-24 * time.Hour)},
 		{"testdata/gitops/team_vpp_valid_app.yml", "VPP token expired", time.Now().Add(-24 * time.Hour)},
 		{"testdata/gitops/team_vpp_invalid_app.yml", "app not available on vpp account", time.Now().Add(24 * time.Hour)},
+		{"testdata/gitops/team_vpp_incorrect_type.yml", "\"app_store_apps.app_store_id\" must be a string, found number", time.Now().Add(24 * time.Hour)},
+		{"testdata/gitops/team_vpp_empty_adamid.yml", "software app store id required", time.Now().Add(24 * time.Hour)},
 	}
 
 	for _, c := range cases {
 		t.Run(filepath.Base(c.file), func(t *testing.T) {
 			ds, _, _ := setupFullGitOpsPremiumServer(t)
-			token, err := createVPPDataToken(c.tokenExpiration, "fleet", "ca")
+			token, err := test.CreateVPPTokenEncoded(c.tokenExpiration, "fleet", "ca")
 			require.NoError(t, err)
 
-			ds.SetTeamVPPAppsFunc = func(ctx context.Context, teamID *uint, adamIDs []fleet.VPPAppID) error {
+			ds.SetTeamVPPAppsFunc = func(ctx context.Context, teamID *uint, adamIDs []fleet.VPPAppTeam) error {
 				return nil
 			}
 			ds.BatchInsertVPPAppsFunc = func(ctx context.Context, apps []*fleet.VPPApp) error {
 				return nil
 			}
 
-			ds.GetAllMDMConfigAssetsByNameFunc = func(ctx context.Context, assetNames []fleet.MDMAssetName) (map[fleet.MDMAssetName]fleet.MDMConfigAsset, error) {
-				asset := map[fleet.MDMAssetName]fleet.MDMConfigAsset{
-					fleet.MDMAssetVPPToken: {
-						Name:  fleet.MDMAssetVPPToken,
-						Value: token,
-					},
-				}
-				return asset, nil
+			ds.GetVPPTokenByTeamIDFunc = func(ctx context.Context, teamID *uint) (*fleet.VPPTokenDB, error) {
+				return &fleet.VPPTokenDB{
+					ID:        1,
+					OrgName:   "Fleet",
+					Location:  "Earth",
+					RenewDate: c.tokenExpiration,
+					Token:     string(token),
+					Teams:     nil,
+				}, nil
 			}
 
 			_, err = runAppNoChecks([]string{"gitops", "-f", c.file})
@@ -1345,35 +1837,7 @@ func TestTeamVPPAppsGitOps(t *testing.T) {
 	}
 }
 
-func createVPPDataToken(expiration time.Time, orgName, location string) ([]byte, error) {
-	var randBytes [32]byte
-	_, err := rand.Read(randBytes[:])
-	if err != nil {
-		return nil, fmt.Errorf("generating random bytes: %w", err)
-	}
-	token := base64.StdEncoding.EncodeToString(randBytes[:])
-	raw := fleet.VPPTokenRaw{
-		OrgName: orgName,
-		Token:   token,
-		ExpDate: expiration.Format("2006-01-02T15:04:05Z0700"),
-	}
-	rawJson, err := json.Marshal(raw)
-	if err != nil {
-		return nil, fmt.Errorf("marshalling vpp raw token: %w", err)
-	}
-
-	base64Token := base64.StdEncoding.EncodeToString(rawJson)
-
-	dataToken := fleet.VPPTokenData{Token: base64Token, Location: location}
-	dataTokenJson, err := json.Marshal(dataToken)
-	if err != nil {
-		return nil, fmt.Errorf("marshalling vpp data token: %w", err)
-	}
-
-	return dataTokenJson, nil
-}
-
-func TestCustomSettingsGitOps(t *testing.T) {
+func TestGitOpsCustomSettings(t *testing.T) {
 	cases := []struct {
 		file    string
 		wantErr string
@@ -1409,7 +1873,7 @@ func TestCustomSettingsGitOps(t *testing.T) {
 				}
 				return ret, nil
 			}
-			ds.SetTeamVPPAppsFunc = func(ctx context.Context, teamID *uint, adamIDs []fleet.VPPAppID) error {
+			ds.SetTeamVPPAppsFunc = func(ctx context.Context, teamID *uint, adamIDs []fleet.VPPAppTeam) error {
 				return nil
 			}
 			ds.BatchInsertVPPAppsFunc = func(ctx context.Context, apps []*fleet.VPPApp) error {
@@ -1594,7 +2058,7 @@ func startVPPApplyServer(t *testing.T, config *appleVPPConfigSrvConf) {
 	t.Cleanup(srv.Close)
 }
 
-func setupFullGitOpsPremiumServer(t *testing.T) (*mock.Store, **fleet.AppConfig, **fleet.Team) {
+func setupFullGitOpsPremiumServer(t *testing.T) (*mock.Store, **fleet.AppConfig, map[string]**fleet.Team) {
 	testCert, testKey, err := apple_mdm.NewSCEPCACertKey()
 	require.NoError(t, err)
 	testCertPEM := tokenpki.PEMCertificate(testCert.Raw)
@@ -1610,6 +2074,7 @@ func setupFullGitOpsPremiumServer(t *testing.T) (*mock.Store, **fleet.AppConfig,
 			FleetConfig:      &fleetCfg,
 			License:          license,
 			NoCacheDatastore: true,
+			KeyValueStore:    newMemKeyValueStore(),
 		},
 	)
 
@@ -1628,14 +2093,14 @@ func setupFullGitOpsPremiumServer(t *testing.T) (*mock.Store, **fleet.AppConfig,
 		savedAppConfig = &appConfigCopy
 		return nil
 	}
-	ds.SetTeamVPPAppsFunc = func(ctx context.Context, teamID *uint, adamIDs []fleet.VPPAppID) error {
+	ds.SetTeamVPPAppsFunc = func(ctx context.Context, teamID *uint, adamIDs []fleet.VPPAppTeam) error {
 		return nil
 	}
 	ds.BatchInsertVPPAppsFunc = func(ctx context.Context, apps []*fleet.VPPApp) error {
 		return nil
 	}
 
-	var savedTeam *fleet.Team
+	savedTeams := map[string]**fleet.Team{}
 
 	ds.ApplyEnrollSecretsFunc = func(ctx context.Context, teamID *uint, secrets []*fleet.EnrollSecret) error {
 		return nil
@@ -1651,14 +2116,14 @@ func setupFullGitOpsPremiumServer(t *testing.T) (*mock.Store, **fleet.AppConfig,
 	ds.BatchSetMDMProfilesFunc = func(
 		ctx context.Context, tmID *uint, macProfiles []*fleet.MDMAppleConfigProfile, winProfiles []*fleet.MDMWindowsConfigProfile,
 		macDecls []*fleet.MDMAppleDeclaration,
-	) error {
-		return nil
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 	ds.BatchSetScriptsFunc = func(ctx context.Context, tmID *uint, scripts []*fleet.Script) error { return nil }
 	ds.BulkSetPendingMDMHostProfilesFunc = func(
 		ctx context.Context, hostIDs []uint, teamIDs []uint, profileUUIDs []string, hostUUIDs []string,
-	) error {
-		return nil
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 	ds.DeleteMDMAppleDeclarationByNameFunc = func(ctx context.Context, teamID *uint, name string) error {
 		return nil
@@ -1677,8 +2142,12 @@ func setupFullGitOpsPremiumServer(t *testing.T) (*mock.Store, **fleet.AppConfig,
 		return nil, nil, nil
 	}
 	ds.ListTeamsFunc = func(ctx context.Context, filter fleet.TeamFilter, opt fleet.ListOptions) ([]*fleet.Team, error) {
-		if savedTeam != nil {
-			return []*fleet.Team{savedTeam}, nil
+		if savedTeams != nil {
+			var result []*fleet.Team
+			for _, t := range savedTeams {
+				result = append(result, *t)
+			}
+			return result, nil
 		}
 		return nil, nil
 	}
@@ -1696,33 +2165,39 @@ func setupFullGitOpsPremiumServer(t *testing.T) (*mock.Store, **fleet.AppConfig,
 		return job, nil
 	}
 	ds.NewTeamFunc = func(ctx context.Context, team *fleet.Team) (*fleet.Team, error) {
-		team.ID = 1
-		savedTeam = team
-		return savedTeam, nil
+		team.ID = uint(len(savedTeams) + 1)
+		savedTeams[team.Name] = &team
+		return team, nil
 	}
 	ds.QueryByNameFunc = func(ctx context.Context, teamID *uint, name string) (*fleet.Query, error) {
 		return nil, &notFoundError{}
 	}
 	ds.TeamFunc = func(ctx context.Context, tid uint) (*fleet.Team, error) {
-		if savedTeam != nil && tid == savedTeam.ID {
-			return savedTeam, nil
+		for _, tm := range savedTeams {
+			if (*tm).ID == tid {
+				return *tm, nil
+			}
 		}
 		return nil, &notFoundError{}
 	}
 	ds.TeamByNameFunc = func(ctx context.Context, name string) (*fleet.Team, error) {
-		if savedTeam != nil && name == teamName {
-			return savedTeam, nil
+		for _, tm := range savedTeams {
+			if (*tm).Name == name {
+				return *tm, nil
+			}
 		}
 		return nil, &notFoundError{}
 	}
 	ds.TeamByFilenameFunc = func(ctx context.Context, filename string) (*fleet.Team, error) {
-		if savedTeam != nil && *savedTeam.Filename == filename {
-			return savedTeam, nil
+		for _, tm := range savedTeams {
+			if *(*tm).Filename == filename {
+				return *tm, nil
+			}
 		}
 		return nil, &notFoundError{}
 	}
 	ds.SaveTeamFunc = func(ctx context.Context, team *fleet.Team) (*fleet.Team, error) {
-		savedTeam = team
+		savedTeams[team.Name] = &team
 		return team, nil
 	}
 	ds.SetOrUpdateMDMAppleDeclarationFunc = func(ctx context.Context, declaration *fleet.MDMAppleDeclaration) (
@@ -1734,11 +2209,734 @@ func setupFullGitOpsPremiumServer(t *testing.T) (*mock.Store, **fleet.AppConfig,
 	ds.BatchSetSoftwareInstallersFunc = func(ctx context.Context, teamID *uint, installers []*fleet.UploadSoftwareInstallerPayload) error {
 		return nil
 	}
+	ds.GetSoftwareInstallersFunc = func(ctx context.Context, tmID uint) ([]fleet.SoftwarePackageResponse, error) {
+		return nil, nil
+	}
+
+	ds.InsertVPPTokenFunc = func(ctx context.Context, tok *fleet.VPPTokenData) (*fleet.VPPTokenDB, error) {
+		return &fleet.VPPTokenDB{}, nil
+	}
+	ds.GetVPPTokenFunc = func(ctx context.Context, tokenID uint) (*fleet.VPPTokenDB, error) {
+		return &fleet.VPPTokenDB{}, err
+	}
+	ds.GetVPPTokenByTeamIDFunc = func(ctx context.Context, teamID *uint) (*fleet.VPPTokenDB, error) {
+		return &fleet.VPPTokenDB{}, nil
+	}
+	ds.ListVPPTokensFunc = func(ctx context.Context) ([]*fleet.VPPTokenDB, error) {
+		return nil, nil
+	}
+	ds.UpdateVPPTokenTeamsFunc = func(ctx context.Context, id uint, teams []uint) (*fleet.VPPTokenDB, error) {
+		return &fleet.VPPTokenDB{}, nil
+	}
+	ds.ListABMTokensFunc = func(ctx context.Context) ([]*fleet.ABMToken, error) {
+		return []*fleet.ABMToken{{OrganizationName: "Fleet Device Management Inc."}}, nil
+	}
+	ds.ListSoftwareTitlesFunc = func(ctx context.Context, opt fleet.SoftwareTitleListOptions, tmFilter fleet.TeamFilter) ([]fleet.SoftwareTitleListResult, int, *fleet.PaginationMetadata, error) {
+		return nil, 0, nil, nil
+	}
 
 	t.Setenv("FLEET_SERVER_URL", fleetServerURL)
 	t.Setenv("ORG_NAME", orgName)
 	t.Setenv("TEST_TEAM_NAME", teamName)
 	t.Setenv("APPLE_BM_DEFAULT_TEAM", teamName)
 
-	return ds, &savedAppConfig, &savedTeam
+	return ds, &savedAppConfig, savedTeams
+}
+
+func TestGitOpsABM(t *testing.T) {
+	global := func(mdm string) string {
+		return fmt.Sprintf(`
+controls:
+queries:
+policies:
+agent_options:
+software:
+org_settings:
+  server_settings:
+    server_url: "https://foo.example.com"
+  org_info:
+    org_name: GitOps Test
+  secrets:
+    - secret: "global"
+  mdm:
+    %s
+ `, mdm)
+	}
+
+	team := func(name string) string {
+		return fmt.Sprintf(`
+name: %s
+team_settings:
+  secrets:
+    - secret: "%s-secret"
+agent_options:
+controls:
+policies:
+queries:
+software:
+`, name, name)
+	}
+
+	workstations := team("💻 Workstations")
+	iosTeam := team("📱🏢 Company-owned iPhones")
+	ipadTeam := team("🔳🏢 Company-owned iPads")
+
+	cases := []struct {
+		name             string
+		cfgs             []string
+		dryRunAssertion  func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error)
+		realRunAssertion func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error)
+		tokens           []*fleet.ABMToken
+	}{
+		{
+			name: "backwards compat",
+			cfgs: []string{
+				global("apple_bm_default_team: 💻 Workstations"),
+				workstations,
+			},
+			tokens: []*fleet.ABMToken{{OrganizationName: "Fleet Device Management Inc."}},
+			dryRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+				assert.NoError(t, err)
+				assert.Empty(t, appCfg.MDM.AppleBusinessManager.Value)
+				assert.Empty(t, appCfg.MDM.DeprecatedAppleBMDefaultTeam)
+				assert.Contains(t, out, "[!] gitops dry run succeeded")
+			},
+			realRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+				assert.NoError(t, err)
+				assert.Empty(t, appCfg.MDM.AppleBusinessManager.Value)
+				assert.Equal(t, appCfg.MDM.DeprecatedAppleBMDefaultTeam, "💻 Workstations")
+				assert.Contains(t, out, "[!] gitops succeeded")
+			},
+		},
+		//	{
+		//		name: "deprecated config with two tokens in the db fails",
+		//		cfgs: []string{
+		//			global("apple_bm_default_team: 💻 Workstations"),
+		//			workstations,
+		//		},
+		//		tokens: []*fleet.ABMToken{{OrganizationName: "Fleet Device Management Inc."}, {OrganizationName: "Second Token LLC"}},
+		//		dryRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+		//			require.ErrorContains(t, err, "mdm.apple_bm_default_team has been deprecated")
+		//			assert.Empty(t, appCfg.MDM.AppleBussinessManager.Value)
+		//			assert.Empty(t, appCfg.MDM.DeprecatedAppleBMDefaultTeam)
+		//			assert.NotContains(t, out, "[!] gitops dry run succeeded")
+		//		},
+		//		realRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+		//			require.ErrorContains(t, err, "mdm.apple_bm_default_team has been deprecated")
+		//			assert.Empty(t, appCfg.MDM.AppleBussinessManager.Value)
+		//			assert.Empty(t, appCfg.MDM.DeprecatedAppleBMDefaultTeam)
+		//			assert.NotContains(t, out, "[!] gitops dry run succeeded")
+		//		},
+		//	},
+		{
+			name: "new key all valid",
+			cfgs: []string{
+				global(`
+                                  apple_business_manager:
+                                    - organization_name: Fleet Device Management Inc.
+                                      macos_team: "💻 Workstations"
+                                      ios_team: "📱🏢 Company-owned iPhones"
+                                      ipados_team: "🔳🏢 Company-owned iPads"`),
+				workstations,
+				iosTeam,
+				ipadTeam,
+			},
+			dryRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+				assert.NoError(t, err)
+				assert.Empty(t, appCfg.MDM.AppleBusinessManager.Value)
+				assert.Empty(t, appCfg.MDM.DeprecatedAppleBMDefaultTeam)
+				assert.Contains(t, out, "[!] gitops dry run succeeded")
+			},
+			realRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+				assert.NoError(t, err)
+				assert.Empty(t, appCfg.MDM.DeprecatedAppleBMDefaultTeam)
+				assert.ElementsMatch(
+					t,
+					appCfg.MDM.AppleBusinessManager.Value,
+					[]fleet.MDMAppleABMAssignmentInfo{
+						{
+							OrganizationName: "Fleet Device Management Inc.",
+							MacOSTeam:        "💻 Workstations",
+							IOSTeam:          "📱🏢 Company-owned iPhones",
+							IpadOSTeam:       "🔳🏢 Company-owned iPads",
+						},
+					},
+				)
+				assert.Contains(t, out, "[!] gitops succeeded")
+			},
+		},
+		{
+			name: "new key multiple elements",
+			cfgs: []string{
+				global(`
+                                  apple_business_manager:
+                                    - organization_name: Foo Inc.
+                                      macos_team: "💻 Workstations"
+                                      ios_team: "📱🏢 Company-owned iPhones"
+                                      ipados_team: "🔳🏢 Company-owned iPads"
+                                    - organization_name: Fleet Device Management Inc.
+                                      macos_team: "💻 Workstations"
+                                      ios_team: "📱🏢 Company-owned iPhones"
+                                      ipados_team: "🔳🏢 Company-owned iPads"`),
+				workstations,
+				iosTeam,
+				ipadTeam,
+			},
+			dryRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+				assert.NoError(t, err)
+				assert.Empty(t, appCfg.MDM.AppleBusinessManager.Value)
+				assert.Empty(t, appCfg.MDM.DeprecatedAppleBMDefaultTeam)
+				assert.Contains(t, out, "[!] gitops dry run succeeded")
+			},
+			realRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+				assert.NoError(t, err)
+				assert.Empty(t, appCfg.MDM.DeprecatedAppleBMDefaultTeam)
+				assert.ElementsMatch(
+					t,
+					appCfg.MDM.AppleBusinessManager.Value,
+					[]fleet.MDMAppleABMAssignmentInfo{
+						{
+							OrganizationName: "Fleet Device Management Inc.",
+							MacOSTeam:        "💻 Workstations",
+							IOSTeam:          "📱🏢 Company-owned iPhones",
+							IpadOSTeam:       "🔳🏢 Company-owned iPads",
+						},
+						{
+							OrganizationName: "Foo Inc.",
+							MacOSTeam:        "💻 Workstations",
+							IOSTeam:          "📱🏢 Company-owned iPhones",
+							IpadOSTeam:       "🔳🏢 Company-owned iPads",
+						},
+					},
+				)
+				assert.Contains(t, out, "[!] gitops succeeded")
+			},
+		},
+		{
+			name: "both keys errors",
+			cfgs: []string{
+				global(`
+                                  apple_bm_default_team: "💻 Workstations"
+                                  apple_business_manager:
+                                    - organization_name: Fleet Device Management Inc.
+                                      macos_team: "💻 Workstations"
+                                      ios_team: "📱🏢 Company-owned iPhones"
+                                      ipados_team: "🔳🏢 Company-owned iPads"`),
+				workstations,
+				iosTeam,
+				ipadTeam,
+			},
+			dryRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+				require.ErrorContains(t, err, "mdm.apple_bm_default_team has been deprecated")
+				assert.NotContains(t, out, "[!] gitops dry run succeeded")
+			},
+			realRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+				require.ErrorContains(t, err, "mdm.apple_bm_default_team has been deprecated")
+				assert.NotContains(t, out, "[!] gitops succeeded")
+			},
+		},
+		{
+			name: "using an undefined team errors",
+			cfgs: []string{
+				global(`
+                                  apple_business_manager:
+                                    - organization_name: Fleet Device Management Inc.
+                                      macos_team: "💻 Workstations"
+                                      ios_team: "📱🏢 Company-owned iPhones"
+                                      ipados_team: "🔳🏢 Company-owned iPads"`),
+				workstations,
+			},
+			dryRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+				assert.ErrorContains(t, err, "apple_business_manager team \"📱🏢 Company-owned iPhones\" not found in team configs")
+			},
+			realRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+				assert.ErrorContains(t, err, "apple_business_manager team \"📱🏢 Company-owned iPhones\" not found in team configs")
+			},
+		},
+		{
+			name: "no team is supported",
+			cfgs: []string{
+				global(`
+                                  apple_business_manager:
+                                    - organization_name: Fleet Device Management Inc.
+                                      macos_team: "No team"
+                                      ios_team: "No team"
+                                      ipados_team: "No team"`),
+			},
+			dryRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+				assert.NoError(t, err)
+				assert.Empty(t, appCfg.MDM.AppleBusinessManager.Value)
+				assert.Empty(t, appCfg.MDM.DeprecatedAppleBMDefaultTeam)
+				assert.Contains(t, out, "[!] gitops dry run succeeded")
+			},
+			realRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+				assert.NoError(t, err)
+				assert.Empty(t, appCfg.MDM.DeprecatedAppleBMDefaultTeam)
+				assert.ElementsMatch(
+					t,
+					appCfg.MDM.AppleBusinessManager.Value,
+					[]fleet.MDMAppleABMAssignmentInfo{
+						{
+							OrganizationName: "Fleet Device Management Inc.",
+							MacOSTeam:        "No team",
+							IOSTeam:          "No team",
+							IpadOSTeam:       "No team",
+						},
+					},
+				)
+				assert.Contains(t, out, "[!] gitops succeeded")
+			},
+		},
+		{
+			name: "not provided teams defaults to no team",
+			cfgs: []string{
+				global(`
+                                  apple_business_manager:
+                                    - organization_name: Fleet Device Management Inc.
+                                      macos_team: "No team"
+                                      ios_team: ""`),
+			},
+			dryRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+				assert.NoError(t, err)
+				assert.Empty(t, appCfg.MDM.AppleBusinessManager.Value)
+				assert.Empty(t, appCfg.MDM.DeprecatedAppleBMDefaultTeam)
+				assert.Contains(t, out, "[!] gitops dry run succeeded")
+			},
+			realRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+				assert.NoError(t, err)
+				assert.Empty(t, appCfg.MDM.DeprecatedAppleBMDefaultTeam)
+				assert.ElementsMatch(
+					t,
+					appCfg.MDM.AppleBusinessManager.Value,
+					[]fleet.MDMAppleABMAssignmentInfo{
+						{
+							OrganizationName: "Fleet Device Management Inc.",
+							MacOSTeam:        "No team",
+							IOSTeam:          "",
+							IpadOSTeam:       "",
+						},
+					},
+				)
+				assert.Contains(t, out, "[!] gitops succeeded")
+			},
+		},
+		{
+			name: "non existent org name fails",
+			cfgs: []string{
+				global(`
+                                  apple_business_manager:
+                                    - organization_name: Does not exist
+                                      macos_team: "No team"`),
+			},
+			tokens: []*fleet.ABMToken{{OrganizationName: "Fleet Device Management Inc."}},
+			dryRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+				assert.ErrorContains(t, err, "token with organization name Does not exist doesn't exist")
+				assert.Empty(t, appCfg.MDM.AppleBusinessManager.Value)
+				assert.Empty(t, appCfg.MDM.DeprecatedAppleBMDefaultTeam)
+				assert.NotContains(t, out, "[!] gitops dry run succeeded")
+			},
+			realRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+				assert.ErrorContains(t, err, "token with organization name Does not exist doesn't exist")
+				assert.Empty(t, appCfg.MDM.AppleBusinessManager.Value)
+				assert.Empty(t, appCfg.MDM.DeprecatedAppleBMDefaultTeam)
+				assert.NotContains(t, out, "[!] gitops dry run succeeded")
+			},
+		},
+	}
+
+	for _, tt := range cases {
+		t.Run(tt.name, func(t *testing.T) {
+			ds, savedAppConfigPtr, savedTeams := setupFullGitOpsPremiumServer(t)
+
+			ds.ListABMTokensFunc = func(ctx context.Context) ([]*fleet.ABMToken, error) {
+				if len(tt.tokens) > 0 {
+					return tt.tokens, nil
+				}
+				return []*fleet.ABMToken{{OrganizationName: "Fleet Device Management Inc."}, {OrganizationName: "Foo Inc."}}, nil
+			}
+
+			ds.TeamsSummaryFunc = func(ctx context.Context) ([]*fleet.TeamSummary, error) {
+				var res []*fleet.TeamSummary
+				for _, tm := range savedTeams {
+					res = append(res, &fleet.TeamSummary{Name: (*tm).Name, ID: (*tm).ID})
+				}
+				return res, nil
+			}
+
+			ds.SaveABMTokenFunc = func(ctx context.Context, tok *fleet.ABMToken) error {
+				return nil
+			}
+
+			args := []string{"gitops"}
+			for _, cfg := range tt.cfgs {
+				if cfg != "" {
+					tmpFile, err := os.CreateTemp(t.TempDir(), "*.yml")
+					require.NoError(t, err)
+					_, err = tmpFile.WriteString(cfg)
+					require.NoError(t, err)
+					args = append(args, "-f", tmpFile.Name())
+				}
+			}
+
+			// Dry run
+			out, err := runAppNoChecks(append(args, "--dry-run"))
+			tt.dryRunAssertion(t, *savedAppConfigPtr, ds, out.String(), err)
+			if t.Failed() {
+				t.FailNow()
+			}
+
+			// Real run
+			out, err = runAppNoChecks(args)
+			tt.realRunAssertion(t, *savedAppConfigPtr, ds, out.String(), err)
+
+			// Second real run, now that all the teams are saved
+			out, err = runAppNoChecks(args)
+			tt.realRunAssertion(t, *savedAppConfigPtr, ds, out.String(), err)
+		})
+	}
+}
+
+func TestGitOpsVPP(t *testing.T) {
+	global := func(mdm string) string {
+		return fmt.Sprintf(`
+controls:
+queries:
+policies:
+agent_options:
+software:
+org_settings:
+  server_settings:
+    server_url: "https://foo.example.com"
+  org_info:
+    org_name: GitOps Test
+  secrets:
+    - secret: "global"
+  mdm:
+    %s
+ `, mdm)
+	}
+
+	team := func(name string) string {
+		return fmt.Sprintf(`
+name: %s
+team_settings:
+  secrets:
+    - secret: "%s-secret"
+agent_options:
+controls:
+policies:
+queries:
+software:
+`, name, name)
+	}
+
+	workstations := team("💻 Workstations")
+	iosTeam := team("📱🏢 Company-owned iPhones")
+	ipadTeam := team("🔳🏢 Company-owned iPads")
+
+	cases := []struct {
+		name             string
+		cfgs             []string
+		dryRunAssertion  func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error)
+		realRunAssertion func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error)
+	}{
+		{
+			name: "new key all valid",
+			cfgs: []string{
+				global(`
+                                  volume_purchasing_program:
+                                    - location: Fleet Device Management Inc.
+                                      teams:
+                                        - "💻 Workstations"
+                                        - "📱🏢 Company-owned iPhones"
+                                        - "🔳🏢 Company-owned iPads"`),
+				workstations,
+				iosTeam,
+				ipadTeam,
+			},
+			dryRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+				assert.NoError(t, err)
+				assert.Empty(t, appCfg.MDM.VolumePurchasingProgram.Value)
+				assert.Contains(t, out, "[!] gitops dry run succeeded")
+			},
+			realRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+				assert.NoError(t, err)
+				assert.ElementsMatch(
+					t,
+					appCfg.MDM.VolumePurchasingProgram.Value,
+					[]fleet.MDMAppleVolumePurchasingProgramInfo{
+						{
+							Location: "Fleet Device Management Inc.",
+							Teams: []string{
+								"💻 Workstations",
+								"📱🏢 Company-owned iPhones",
+								"🔳🏢 Company-owned iPads",
+							},
+						},
+					},
+				)
+				assert.Contains(t, out, "[!] gitops succeeded")
+			},
+		},
+		{
+			name: "new key multiple elements",
+			cfgs: []string{
+				global(`
+                                  volume_purchasing_program:
+                                    - location: Acme Inc.
+                                      teams:
+                                        - "💻 Workstations"
+                                    - location: Fleet Device Management Inc.
+                                      teams:
+                                        - "📱🏢 Company-owned iPhones"
+                                        - "🔳🏢 Company-owned iPads"`),
+				workstations,
+				iosTeam,
+				ipadTeam,
+			},
+			dryRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+				assert.NoError(t, err)
+				assert.Empty(t, appCfg.MDM.VolumePurchasingProgram.Value)
+				assert.Contains(t, out, "[!] gitops dry run succeeded")
+			},
+			realRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+				assert.NoError(t, err)
+				assert.ElementsMatch(
+					t,
+					appCfg.MDM.VolumePurchasingProgram.Value,
+					[]fleet.MDMAppleVolumePurchasingProgramInfo{
+						{
+							Location: "Acme Inc.",
+							Teams: []string{
+								"💻 Workstations",
+							},
+						},
+						{
+							Location: "Fleet Device Management Inc.",
+							Teams: []string{
+								"📱🏢 Company-owned iPhones",
+								"🔳🏢 Company-owned iPads",
+							},
+						},
+					},
+				)
+				assert.Contains(t, out, "[!] gitops succeeded")
+			},
+		},
+		{
+			name: "using an undefined team errors",
+			cfgs: []string{
+				global(`
+                                  volume_purchasing_program:
+                                    - location: Fleet Device Management Inc.
+                                      teams:
+                                        - "💻 Workstations"
+                                        - "📱🏢 Company-owned iPhones"
+                                        - "🔳🏢 Company-owned iPads"`),
+				workstations,
+				ipadTeam,
+			},
+			dryRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+				assert.ErrorContains(t, err, "volume_purchasing_program team 📱🏢 Company-owned iPhones not found in team configs")
+			},
+			realRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+				assert.ErrorContains(t, err, "volume_purchasing_program team 📱🏢 Company-owned iPhones not found in team configs")
+			},
+		},
+		{
+			name: "no team is supported",
+			cfgs: []string{
+				global(`
+                                  volume_purchasing_program:
+                                    - location: Fleet Device Management Inc.
+                                      teams:
+                                        - "💻 Workstations"
+                                        - "📱🏢 Company-owned iPhones"
+                                        - "No team"`),
+				workstations,
+				iosTeam,
+			},
+			dryRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+				assert.NoError(t, err)
+				assert.Empty(t, appCfg.MDM.VolumePurchasingProgram.Value)
+				assert.Contains(t, out, "[!] gitops dry run succeeded")
+			},
+			realRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+				assert.NoError(t, err)
+				assert.ElementsMatch(
+					t,
+					appCfg.MDM.VolumePurchasingProgram.Value,
+					[]fleet.MDMAppleVolumePurchasingProgramInfo{
+						{
+							Location: "Fleet Device Management Inc.",
+							Teams: []string{
+								"💻 Workstations",
+								"📱🏢 Company-owned iPhones",
+								"No team",
+							},
+						},
+					},
+				)
+				assert.Contains(t, out, "[!] gitops succeeded")
+			},
+		},
+		{
+			name: "all teams is supported",
+			cfgs: []string{
+				global(`
+                        volume_purchasing_program:
+                          - location: Fleet Device Management Inc.
+                            teams:
+                              - "All teams"`),
+				workstations,
+				iosTeam,
+			},
+			dryRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+				assert.NoError(t, err)
+				assert.Empty(t, appCfg.MDM.VolumePurchasingProgram.Value)
+				assert.Contains(t, out, "[!] gitops dry run succeeded")
+			},
+			realRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+				assert.NoError(t, err)
+				assert.ElementsMatch(
+					t,
+					appCfg.MDM.VolumePurchasingProgram.Value,
+					[]fleet.MDMAppleVolumePurchasingProgramInfo{
+						{
+							Location: "Fleet Device Management Inc.",
+							Teams: []string{
+								"All teams",
+							},
+						},
+					},
+				)
+				assert.Contains(t, out, "[!] gitops succeeded")
+			},
+		},
+		{
+			name: "not provided teams defaults to no team",
+			cfgs: []string{
+				global(`
+                                  volume_purchasing_program:
+                                    - location: Fleet Device Management Inc.
+                                      teams:`),
+				workstations,
+				ipadTeam,
+			},
+			dryRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+				assert.NoError(t, err)
+				assert.Empty(t, appCfg.MDM.VolumePurchasingProgram.Value)
+				assert.Contains(t, out, "[!] gitops dry run succeeded")
+			},
+			realRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+				assert.NoError(t, err)
+				assert.ElementsMatch(
+					t,
+					appCfg.MDM.VolumePurchasingProgram.Value,
+					[]fleet.MDMAppleVolumePurchasingProgramInfo{
+						{
+							Location: "Fleet Device Management Inc.",
+							Teams:    nil,
+						},
+					},
+				)
+				assert.Contains(t, out, "[!] gitops succeeded")
+			},
+		},
+		{
+			name: "non existent location fails",
+			cfgs: []string{
+				global(`
+                                  volume_purchasing_program:
+                                    - location: Does not exist
+                                      teams:`),
+				workstations,
+				ipadTeam,
+			},
+			dryRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+				assert.ErrorContains(t, err, "token with location Does not exist doesn't exist")
+				assert.Empty(t, appCfg.MDM.VolumePurchasingProgram.Value)
+				assert.NotContains(t, out, "[!] gitops dry run succeeded")
+			},
+			realRunAssertion: func(t *testing.T, appCfg *fleet.AppConfig, ds fleet.Datastore, out string, err error) {
+				assert.ErrorContains(t, err, "token with location Does not exist doesn't exist")
+				assert.Empty(t, appCfg.MDM.VolumePurchasingProgram.Value)
+				assert.NotContains(t, out, "[!] gitops dry run succeeded")
+			},
+		},
+	}
+
+	for _, tt := range cases {
+		t.Run(tt.name, func(t *testing.T) {
+			ds, savedAppConfigPtr, savedTeams := setupFullGitOpsPremiumServer(t)
+
+			ds.ListVPPTokensFunc = func(ctx context.Context) ([]*fleet.VPPTokenDB, error) {
+				return []*fleet.VPPTokenDB{{Location: "Fleet Device Management Inc."}, {Location: "Acme Inc."}}, nil
+			}
+
+			ds.ListABMTokensFunc = func(ctx context.Context) ([]*fleet.ABMToken, error) {
+				return []*fleet.ABMToken{{OrganizationName: "Fleet Device Management Inc."}, {OrganizationName: "Foo Inc."}}, nil
+			}
+
+			ds.TeamsSummaryFunc = func(ctx context.Context) ([]*fleet.TeamSummary, error) {
+				var res []*fleet.TeamSummary
+				for _, tm := range savedTeams {
+					res = append(res, &fleet.TeamSummary{Name: (*tm).Name, ID: (*tm).ID})
+				}
+				return res, nil
+			}
+
+			ds.SaveABMTokenFunc = func(ctx context.Context, tok *fleet.ABMToken) error {
+				return nil
+			}
+
+			args := []string{"gitops"}
+			for _, cfg := range tt.cfgs {
+				if cfg != "" {
+					tmpFile, err := os.CreateTemp(t.TempDir(), "*.yml")
+					require.NoError(t, err)
+					_, err = tmpFile.WriteString(cfg)
+					require.NoError(t, err)
+					args = append(args, "-f", tmpFile.Name())
+				}
+			}
+
+			// Dry run
+			out, err := runAppNoChecks(append(args, "--dry-run"))
+			tt.dryRunAssertion(t, *savedAppConfigPtr, ds, out.String(), err)
+			if t.Failed() {
+				t.FailNow()
+			}
+
+			// Real run
+			out, err = runAppNoChecks(args)
+			tt.realRunAssertion(t, *savedAppConfigPtr, ds, out.String(), err)
+
+			// Second real run, now that all the teams are saved
+			out, err = runAppNoChecks(args)
+			tt.realRunAssertion(t, *savedAppConfigPtr, ds, out.String(), err)
+		})
+	}
+}
+
+type memKeyValueStore struct {
+	m sync.Map
+}
+
+func newMemKeyValueStore() *memKeyValueStore {
+	return &memKeyValueStore{}
+}
+
+func (m *memKeyValueStore) Set(ctx context.Context, key string, value string, expireTime time.Duration) error {
+	m.m.Store(key, value)
+	return nil
+}
+
+func (m *memKeyValueStore) Get(ctx context.Context, key string) (*string, error) {
+	v, ok := m.m.Load(key)
+	if !ok {
+		return nil, nil
+	}
+	vAsString := v.(string)
+	return &vAsString, nil
 }
diff --git a/cmd/fleetctl/hosts_test.go b/cmd/fleetctl/hosts_test.go
index a24fc79cbe..6220d6d75c 100644
--- a/cmd/fleetctl/hosts_test.go
+++ b/cmd/fleetctl/hosts_test.go
@@ -43,8 +43,9 @@ func TestHostsTransferByHosts(t *testing.T) {
 		return nil
 	}
 
-	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hostIDs, teamIDs []uint, profileUUIDs, uuids []string) error {
-		return nil
+	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hostIDs, teamIDs []uint, profileUUIDs, uuids []string,
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 
 	ds.ListMDMAppleDEPSerialsInHostIDsFunc = func(ctx context.Context, hostIDs []uint) ([]string, error) {
@@ -114,8 +115,9 @@ func TestHostsTransferByLabel(t *testing.T) {
 		return nil
 	}
 
-	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hostIDs, teamIDs []uint, profileUUIDs, uuids []string) error {
-		return nil
+	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hostIDs, teamIDs []uint, profileUUIDs, uuids []string,
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 
 	ds.ListMDMAppleDEPSerialsInHostIDsFunc = func(ctx context.Context, hostIDs []uint) ([]string, error) {
@@ -184,8 +186,9 @@ func TestHostsTransferByStatus(t *testing.T) {
 		return nil
 	}
 
-	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hostIDs, teamIDs []uint, profileUUIDs, uuids []string) error {
-		return nil
+	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hostIDs, teamIDs []uint, profileUUIDs, uuids []string,
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 
 	ds.ListMDMAppleDEPSerialsInHostIDsFunc = func(ctx context.Context, hostIDs []uint) ([]string, error) {
@@ -243,8 +246,9 @@ func TestHostsTransferByStatusAndSearchQuery(t *testing.T) {
 		return nil
 	}
 
-	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hostIDs, teamIDs []uint, profileUUIDs, uuids []string) error {
-		return nil
+	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hostIDs, teamIDs []uint, profileUUIDs, uuids []string,
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 
 	ds.ListMDMAppleDEPSerialsInHostIDsFunc = func(ctx context.Context, hostIDs []uint) ([]string, error) {
diff --git a/cmd/fleetctl/preview.go b/cmd/fleetctl/preview.go
index a48734871c..ef06f3c8cc 100644
--- a/cmd/fleetctl/preview.go
+++ b/cmd/fleetctl/preview.go
@@ -74,7 +74,7 @@ func (d dockerCompose) Command(arg ...string) *exec.Cmd {
 
 func newDockerCompose() (dockerCompose, error) {
 	// first, check if `docker compose` is available
-	if err := exec.Command("docker compose").Run(); err == nil {
+	if err := exec.Command("docker", "compose").Run(); err == nil {
 		return dockerCompose{dockerComposeV2}, nil
 	}
 
@@ -387,7 +387,7 @@ Use the stop and reset subcommands to manage the server and dependencies once st
 			}
 			// this only applies standard queries, the base directory is not used,
 			// so pass in the current working directory.
-			_, err = client.ApplyGroup(c.Context, specs, ".", logf, fleet.ApplyClientSpecOptions{})
+			_, _, err = client.ApplyGroup(c.Context, specs, ".", logf, nil, fleet.ApplyClientSpecOptions{})
 			if err != nil {
 				return err
 			}
diff --git a/cmd/fleetctl/preview_test.go b/cmd/fleetctl/preview_test.go
index 76c68eb190..c3a75a73e1 100644
--- a/cmd/fleetctl/preview_test.go
+++ b/cmd/fleetctl/preview_test.go
@@ -12,7 +12,7 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-func TestPreview(t *testing.T) {
+func TestIntegrationsPreview(t *testing.T) {
 	nettest.Run(t)
 
 	t.Setenv("FLEET_SERVER_ADDRESS", "https://localhost:8412")
@@ -74,6 +74,7 @@ func gitRootPath(t *testing.T) string {
 }
 
 func TestDockerCompose(t *testing.T) {
+	t.Parallel()
 	t.Run("returns the right command according to the version", func(t *testing.T) {
 		v1 := dockerCompose{dockerComposeV1}
 		cmd1 := v1.Command("up")
diff --git a/cmd/fleetctl/testdata/expectedGetConfigAppConfigJson.json b/cmd/fleetctl/testdata/expectedGetConfigAppConfigJson.json
index 399e880a93..ece537e7b9 100644
--- a/cmd/fleetctl/testdata/expectedGetConfigAppConfigJson.json
+++ b/cmd/fleetctl/testdata/expectedGetConfigAppConfigJson.json
@@ -96,7 +96,8 @@
 			"apple_bm_terms_expired": false,
 			"apple_bm_enabled_and_configured": false,
 			"enabled_and_configured": false,
-			"apple_bm_default_team": "",
+			"apple_business_manager": null,
+			"volume_purchasing_program": null,
 			"windows_enabled_and_configured": false,
 			"enable_disk_encryption": false,
 			"macos_updates": {
diff --git a/cmd/fleetctl/testdata/expectedGetConfigAppConfigYaml.yml b/cmd/fleetctl/testdata/expectedGetConfigAppConfigYaml.yml
index b76d40bd52..5f19ffcb8a 100644
--- a/cmd/fleetctl/testdata/expectedGetConfigAppConfigYaml.yml
+++ b/cmd/fleetctl/testdata/expectedGetConfigAppConfigYaml.yml
@@ -21,7 +21,8 @@ spec:
     apple_bm_terms_expired: false
     apple_bm_enabled_and_configured: false
     enabled_and_configured: false
-    apple_bm_default_team: ""
+    apple_business_manager: null
+    volume_purchasing_program: null
     windows_enabled_and_configured: false
     enable_disk_encryption: false
     macos_migration:
diff --git a/cmd/fleetctl/testdata/expectedGetConfigIncludeServerConfigJson.json b/cmd/fleetctl/testdata/expectedGetConfigIncludeServerConfigJson.json
index 76a89e6493..9fa625b676 100644
--- a/cmd/fleetctl/testdata/expectedGetConfigIncludeServerConfigJson.json
+++ b/cmd/fleetctl/testdata/expectedGetConfigIncludeServerConfigJson.json
@@ -46,7 +46,8 @@
 			"enable_software_inventory": false
 		},
 		"mdm": {
-			"apple_bm_default_team": "",
+			"apple_business_manager": null,
+			"volume_purchasing_program": null,
 			"apple_bm_terms_expired": false,
 			"apple_bm_enabled_and_configured": false,
 			"enabled_and_configured": false,
diff --git a/cmd/fleetctl/testdata/expectedGetConfigIncludeServerConfigYaml.yml b/cmd/fleetctl/testdata/expectedGetConfigIncludeServerConfigYaml.yml
index f6ca79a4eb..b28ab395b3 100644
--- a/cmd/fleetctl/testdata/expectedGetConfigIncludeServerConfigYaml.yml
+++ b/cmd/fleetctl/testdata/expectedGetConfigIncludeServerConfigYaml.yml
@@ -18,7 +18,8 @@ spec:
     jira: null
     zendesk: null
   mdm:
-    apple_bm_default_team: ""
+    apple_business_manager: null
+    volume_purchasing_program: null
     apple_bm_enabled_and_configured: false
     apple_bm_terms_expired: false
     enabled_and_configured: false
diff --git a/cmd/fleetctl/testdata/gitops/global_config_no_paths.yml b/cmd/fleetctl/testdata/gitops/global_config_no_paths.yml
index 76936e3ad5..894841a933 100644
--- a/cmd/fleetctl/testdata/gitops/global_config_no_paths.yml
+++ b/cmd/fleetctl/testdata/gitops/global_config_no_paths.yml
@@ -146,7 +146,6 @@ org_settings:
                         "private_key": "google_calendar_private_key",
       }
   mdm:
-    apple_bm_default_team: $APPLE_BM_DEFAULT_TEAM
     end_user_authentication:
       entity_id: ""
       idp_name: ""
@@ -187,3 +186,4 @@ org_settings:
   secrets: # These secrets are used to enroll hosts to the "All teams" team
     - secret: SampleSecret123
     - secret: ABC
+software:
diff --git a/cmd/fleetctl/testdata/gitops/global_macos_custom_settings_valid_deprecated.yml b/cmd/fleetctl/testdata/gitops/global_macos_custom_settings_valid_deprecated.yml
index 177c1c80cf..b098442585 100644
--- a/cmd/fleetctl/testdata/gitops/global_macos_custom_settings_valid_deprecated.yml
+++ b/cmd/fleetctl/testdata/gitops/global_macos_custom_settings_valid_deprecated.yml
@@ -91,3 +91,4 @@ org_settings:
     databases_path: ""
   secrets:
     - secret: ABC
+software:
\ No newline at end of file
diff --git a/cmd/fleetctl/testdata/gitops/global_macos_windows_custom_settings_valid.yml b/cmd/fleetctl/testdata/gitops/global_macos_windows_custom_settings_valid.yml
index da75847cd5..e6231bf030 100644
--- a/cmd/fleetctl/testdata/gitops/global_macos_windows_custom_settings_valid.yml
+++ b/cmd/fleetctl/testdata/gitops/global_macos_windows_custom_settings_valid.yml
@@ -97,3 +97,4 @@ org_settings:
     databases_path: ""
   secrets: 
     - secret: ABC
+software:
diff --git a/cmd/fleetctl/testdata/gitops/global_windows_custom_settings_invalid_label_mix.yml b/cmd/fleetctl/testdata/gitops/global_windows_custom_settings_invalid_label_mix.yml
index 9d2ac6e69f..1a100de6f3 100644
--- a/cmd/fleetctl/testdata/gitops/global_windows_custom_settings_invalid_label_mix.yml
+++ b/cmd/fleetctl/testdata/gitops/global_windows_custom_settings_invalid_label_mix.yml
@@ -93,3 +93,4 @@ org_settings:
     databases_path: ""
   secrets:
     - secret: ABC
+software:
\ No newline at end of file
diff --git a/cmd/fleetctl/testdata/gitops/global_windows_custom_settings_unknown_label.yml b/cmd/fleetctl/testdata/gitops/global_windows_custom_settings_unknown_label.yml
index ba1d06f784..5208ba7248 100644
--- a/cmd/fleetctl/testdata/gitops/global_windows_custom_settings_unknown_label.yml
+++ b/cmd/fleetctl/testdata/gitops/global_windows_custom_settings_unknown_label.yml
@@ -91,3 +91,4 @@ org_settings:
     databases_path: ""
   secrets:
     - secret: ABC
+software:
\ No newline at end of file
diff --git a/cmd/fleetctl/testdata/gitops/lib/uninstall_ruby.sh b/cmd/fleetctl/testdata/gitops/lib/uninstall_ruby.sh
new file mode 100644
index 0000000000..c6c41b5e01
--- /dev/null
+++ b/cmd/fleetctl/testdata/gitops/lib/uninstall_ruby.sh
@@ -0,0 +1 @@
+echo 'uninstall' ${PACKAGE_ID}
diff --git a/cmd/fleetctl/testdata/gitops/no_team_software_installer_install_not_found.yml b/cmd/fleetctl/testdata/gitops/no_team_software_installer_install_not_found.yml
new file mode 100644
index 0000000000..58bae27ae9
--- /dev/null
+++ b/cmd/fleetctl/testdata/gitops/no_team_software_installer_install_not_found.yml
@@ -0,0 +1,8 @@
+name: No team
+controls:
+policies:
+software:
+  packages:
+    - url: ${SOFTWARE_INSTALLER_URL}/ruby.deb
+      install_script:
+        path: lib/notfound.sh
diff --git a/cmd/fleetctl/testdata/gitops/no_team_software_installer_invalid_self_service_value.yml b/cmd/fleetctl/testdata/gitops/no_team_software_installer_invalid_self_service_value.yml
new file mode 100644
index 0000000000..b333e7816e
--- /dev/null
+++ b/cmd/fleetctl/testdata/gitops/no_team_software_installer_invalid_self_service_value.yml
@@ -0,0 +1,7 @@
+name: No team
+controls:
+policies:
+software:
+  packages:
+    - url: ${SOFTWARE_INSTALLER_URL}/invalidtype.txt
+      self_service: "not a boolean"
diff --git a/cmd/fleetctl/testdata/gitops/no_team_software_installer_no_url.yml b/cmd/fleetctl/testdata/gitops/no_team_software_installer_no_url.yml
new file mode 100644
index 0000000000..d897af7b43
--- /dev/null
+++ b/cmd/fleetctl/testdata/gitops/no_team_software_installer_no_url.yml
@@ -0,0 +1,11 @@
+name: No TEAM
+controls:
+policies:
+software:
+  packages:
+    - install_script:
+        path: lib/install_ruby.sh
+      pre_install_query:
+        path: lib/query_ruby.yml
+      post_install_script:
+        path: lib/post_install_ruby.sh
diff --git a/cmd/fleetctl/testdata/gitops/no_team_software_installer_not_found.yml b/cmd/fleetctl/testdata/gitops/no_team_software_installer_not_found.yml
new file mode 100644
index 0000000000..590458e78b
--- /dev/null
+++ b/cmd/fleetctl/testdata/gitops/no_team_software_installer_not_found.yml
@@ -0,0 +1,6 @@
+name: No team
+controls:
+policies:
+software:
+  packages:
+    - url: ${SOFTWARE_INSTALLER_URL}/notfound.deb
diff --git a/cmd/fleetctl/testdata/gitops/no_team_software_installer_post_install_not_found.yml b/cmd/fleetctl/testdata/gitops/no_team_software_installer_post_install_not_found.yml
new file mode 100644
index 0000000000..12b2598d59
--- /dev/null
+++ b/cmd/fleetctl/testdata/gitops/no_team_software_installer_post_install_not_found.yml
@@ -0,0 +1,10 @@
+name: No team
+controls:
+policies:
+software:
+  packages:
+    - url: ${SOFTWARE_INSTALLER_URL}/ruby.deb
+      install_script:
+        path: lib/install_ruby.sh
+      post_install_script:
+        path: lib/notfound.sh
diff --git a/cmd/fleetctl/testdata/gitops/no_team_software_installer_pre_condition_multiple_queries.yml b/cmd/fleetctl/testdata/gitops/no_team_software_installer_pre_condition_multiple_queries.yml
new file mode 100644
index 0000000000..15ddcb438c
--- /dev/null
+++ b/cmd/fleetctl/testdata/gitops/no_team_software_installer_pre_condition_multiple_queries.yml
@@ -0,0 +1,12 @@
+name: No team
+controls:
+policies:
+software:
+  packages:
+    - url: ${SOFTWARE_INSTALLER_URL}/ruby.deb
+      install_script:
+        path: lib/install_ruby.sh
+      pre_install_query:
+        path: lib/query_multiple.yml
+      post_install_script:
+        path: lib/post_install_ruby.sh
diff --git a/cmd/fleetctl/testdata/gitops/no_team_software_installer_pre_condition_not_found.yml b/cmd/fleetctl/testdata/gitops/no_team_software_installer_pre_condition_not_found.yml
new file mode 100644
index 0000000000..48e6ff42e5
--- /dev/null
+++ b/cmd/fleetctl/testdata/gitops/no_team_software_installer_pre_condition_not_found.yml
@@ -0,0 +1,10 @@
+name: No team
+controls:
+policies:
+software:
+  packages:
+    - url: ${SOFTWARE_INSTALLER_URL}/ruby.deb
+      install_script:
+        path: lib/install_ruby.sh
+      pre_install_query:
+        path: lib/notfound.yml
diff --git a/cmd/fleetctl/testdata/gitops/no_team_software_installer_too_large.yml b/cmd/fleetctl/testdata/gitops/no_team_software_installer_too_large.yml
new file mode 100644
index 0000000000..23ba8dbe80
--- /dev/null
+++ b/cmd/fleetctl/testdata/gitops/no_team_software_installer_too_large.yml
@@ -0,0 +1,6 @@
+name: No team
+controls:
+policies:
+software:
+  packages:
+    - url: ${SOFTWARE_INSTALLER_URL}/toolarge.deb
diff --git a/cmd/fleetctl/testdata/gitops/no_team_software_installer_uninstall_not_found.yml b/cmd/fleetctl/testdata/gitops/no_team_software_installer_uninstall_not_found.yml
new file mode 100644
index 0000000000..c5c8838267
--- /dev/null
+++ b/cmd/fleetctl/testdata/gitops/no_team_software_installer_uninstall_not_found.yml
@@ -0,0 +1,8 @@
+name: No team
+controls:
+policies:
+software:
+  packages:
+    - url: ${SOFTWARE_INSTALLER_URL}/ruby.deb
+      uninstall_script:
+        path: lib/notfound.sh
diff --git a/cmd/fleetctl/testdata/gitops/no_team_software_installer_unsupported.yml b/cmd/fleetctl/testdata/gitops/no_team_software_installer_unsupported.yml
new file mode 100644
index 0000000000..ace876a8d5
--- /dev/null
+++ b/cmd/fleetctl/testdata/gitops/no_team_software_installer_unsupported.yml
@@ -0,0 +1,6 @@
+name: "No team"
+controls:
+policies:
+software:
+  packages:
+    - url: ${SOFTWARE_INSTALLER_URL}/invalidtype.txt
diff --git a/cmd/fleetctl/testdata/gitops/no_team_software_installer_valid.yml b/cmd/fleetctl/testdata/gitops/no_team_software_installer_valid.yml
new file mode 100644
index 0000000000..4599698d1d
--- /dev/null
+++ b/cmd/fleetctl/testdata/gitops/no_team_software_installer_valid.yml
@@ -0,0 +1,16 @@
+name: No team
+controls:
+policies:
+software:
+  packages:
+    - url: ${SOFTWARE_INSTALLER_URL}/ruby.deb
+      install_script:
+        path: lib/install_ruby.sh
+      pre_install_query:
+        path: lib/query_ruby.yml
+      post_install_script:
+        path: lib/post_install_ruby.sh
+      uninstall_script:
+        path: lib/uninstall_ruby.sh
+    - url: ${SOFTWARE_INSTALLER_URL}/other.deb
+      self_service: true
diff --git a/cmd/fleetctl/testdata/gitops/team_config_no_paths.yml b/cmd/fleetctl/testdata/gitops/team_config_no_paths.yml
index 785ba5d215..e671d17d29 100644
--- a/cmd/fleetctl/testdata/gitops/team_config_no_paths.yml
+++ b/cmd/fleetctl/testdata/gitops/team_config_no_paths.yml
@@ -124,5 +124,7 @@ software:
         path: lib/query_ruby.yml
       post_install_script:
         path: lib/post_install_ruby.sh
+      uninstall_script:
+        path: lib/uninstall_ruby.sh
     - url: ${SOFTWARE_INSTALLER_URL}/other.deb
       self_service: true
diff --git a/cmd/fleetctl/testdata/gitops/team_software_installer_uninstall_not_found.yml b/cmd/fleetctl/testdata/gitops/team_software_installer_uninstall_not_found.yml
new file mode 100644
index 0000000000..1fc9903d6b
--- /dev/null
+++ b/cmd/fleetctl/testdata/gitops/team_software_installer_uninstall_not_found.yml
@@ -0,0 +1,19 @@
+name: "${TEST_TEAM_NAME}"
+team_settings:
+  secrets:
+    - secret: "ABC"
+  features:
+    enable_host_users: true
+    enable_software_inventory: true
+  host_expiry_settings:
+    host_expiry_enabled: true
+    host_expiry_window: 30
+agent_options:
+controls:
+policies:
+queries:
+software:
+  packages:
+    - url: ${SOFTWARE_INSTALLER_URL}/ruby.deb
+      uninstall_script:
+        path: lib/notfound.sh
diff --git a/cmd/fleetctl/testdata/gitops/team_software_installer_valid.yml b/cmd/fleetctl/testdata/gitops/team_software_installer_valid.yml
index e894112249..0733758ced 100644
--- a/cmd/fleetctl/testdata/gitops/team_software_installer_valid.yml
+++ b/cmd/fleetctl/testdata/gitops/team_software_installer_valid.yml
@@ -21,5 +21,7 @@ software:
         path: lib/query_ruby.yml
       post_install_script:
         path: lib/post_install_ruby.sh
+      uninstall_script:
+        path: lib/uninstall_ruby.sh
     - url: ${SOFTWARE_INSTALLER_URL}/other.deb
       self_service: true
diff --git a/cmd/fleetctl/testdata/gitops/team_vpp_empty_adamid.yml b/cmd/fleetctl/testdata/gitops/team_vpp_empty_adamid.yml
new file mode 100644
index 0000000000..675618c609
--- /dev/null
+++ b/cmd/fleetctl/testdata/gitops/team_vpp_empty_adamid.yml
@@ -0,0 +1,17 @@
+name: "${TEST_TEAM_NAME}"
+team_settings:
+  secrets:
+    - secret: "ABC"
+  features:
+    enable_host_users: true
+    enable_software_inventory: true
+  host_expiry_settings:
+    host_expiry_enabled: true
+    host_expiry_window: 30
+agent_options:
+controls:
+policies:
+queries:
+software:
+  app_store_apps:
+    - app_store_id:
diff --git a/cmd/fleetctl/testdata/gitops/team_vpp_incorrect_type.yml b/cmd/fleetctl/testdata/gitops/team_vpp_incorrect_type.yml
new file mode 100644
index 0000000000..74e7b17806
--- /dev/null
+++ b/cmd/fleetctl/testdata/gitops/team_vpp_incorrect_type.yml
@@ -0,0 +1,17 @@
+name: "${TEST_TEAM_NAME}"
+team_settings:
+  secrets:
+    - secret: "ABC"
+  features:
+    enable_host_users: true
+    enable_software_inventory: true
+  host_expiry_settings:
+    host_expiry_enabled: true
+    host_expiry_window: 30
+agent_options:
+controls:
+policies:
+queries:
+software:
+  app_store_apps:
+    - app_store_id: 1
diff --git a/cmd/fleetctl/testdata/gitops/team_vpp_valid_app_self_service.yml b/cmd/fleetctl/testdata/gitops/team_vpp_valid_app_self_service.yml
new file mode 100644
index 0000000000..a2daad396e
--- /dev/null
+++ b/cmd/fleetctl/testdata/gitops/team_vpp_valid_app_self_service.yml
@@ -0,0 +1,18 @@
+name: "${TEST_TEAM_NAME}"
+team_settings:
+  secrets:
+    - secret: "ABC"
+  features:
+    enable_host_users: true
+    enable_software_inventory: true
+  host_expiry_settings:
+    host_expiry_enabled: true
+    host_expiry_window: 30
+agent_options:
+controls:
+policies:
+queries:
+software:
+  app_store_apps:
+    - app_store_id: "1"
+      self_service: true
diff --git a/cmd/fleetctl/testdata/macosSetupExpectedAppConfigEmpty.yml b/cmd/fleetctl/testdata/macosSetupExpectedAppConfigEmpty.yml
index fc886f7658..02adaad3ac 100644
--- a/cmd/fleetctl/testdata/macosSetupExpectedAppConfigEmpty.yml
+++ b/cmd/fleetctl/testdata/macosSetupExpectedAppConfigEmpty.yml
@@ -18,7 +18,8 @@ spec:
     jira: null
     zendesk: null
   mdm:
-    apple_bm_default_team: ""
+    apple_business_manager:
+    volume_purchasing_program:
     apple_bm_enabled_and_configured: false
     apple_bm_terms_expired: false
     enabled_and_configured: true
diff --git a/cmd/fleetctl/testdata/macosSetupExpectedAppConfigSet.yml b/cmd/fleetctl/testdata/macosSetupExpectedAppConfigSet.yml
index 5a57cc2500..2dd2f93adf 100644
--- a/cmd/fleetctl/testdata/macosSetupExpectedAppConfigSet.yml
+++ b/cmd/fleetctl/testdata/macosSetupExpectedAppConfigSet.yml
@@ -18,7 +18,8 @@ spec:
     jira: null
     zendesk: null
   mdm:
-    apple_bm_default_team: ""
+    apple_business_manager:
+    volume_purchasing_program:
     apple_bm_enabled_and_configured: false
     apple_bm_terms_expired: false
     enabled_and_configured: true
diff --git a/cmd/fleetctl/testing_utils.go b/cmd/fleetctl/testing_utils.go
index 7a278ebc3c..918a12b94e 100644
--- a/cmd/fleetctl/testing_utils.go
+++ b/cmd/fleetctl/testing_utils.go
@@ -127,24 +127,24 @@ func runServerWithMockedDS(t *testing.T, opts ...*service.TestServerOpts) (*http
 	require.NoError(t, err)
 	ds.GetAllMDMConfigAssetsHashesFunc = func(ctx context.Context, assetNames []fleet.MDMAssetName) (map[fleet.MDMAssetName]string, error) {
 		return map[fleet.MDMAssetName]string{
-			fleet.MDMAssetABMCert:  "abmcert",
-			fleet.MDMAssetABMKey:   "abmkey",
-			fleet.MDMAssetABMToken: "abmtoken",
-			fleet.MDMAssetAPNSCert: "apnscert",
-			fleet.MDMAssetAPNSKey:  "apnskey",
-			fleet.MDMAssetCACert:   "scepcert",
-			fleet.MDMAssetCAKey:    "scepkey",
+			fleet.MDMAssetABMCert:            "abmcert",
+			fleet.MDMAssetABMKey:             "abmkey",
+			fleet.MDMAssetABMTokenDeprecated: "abmtoken",
+			fleet.MDMAssetAPNSCert:           "apnscert",
+			fleet.MDMAssetAPNSKey:            "apnskey",
+			fleet.MDMAssetCACert:             "scepcert",
+			fleet.MDMAssetCAKey:              "scepkey",
 		}, nil
 	}
 	ds.GetAllMDMConfigAssetsByNameFunc = func(ctx context.Context, assetNames []fleet.MDMAssetName) (map[fleet.MDMAssetName]fleet.MDMConfigAsset, error) {
 		return map[fleet.MDMAssetName]fleet.MDMConfigAsset{
-			fleet.MDMAssetABMCert:  {Name: fleet.MDMAssetABMCert, Value: certPEM},
-			fleet.MDMAssetABMKey:   {Name: fleet.MDMAssetABMKey, Value: keyPEM},
-			fleet.MDMAssetABMToken: {Name: fleet.MDMAssetABMToken, Value: tokenBytes},
-			fleet.MDMAssetAPNSCert: {Name: fleet.MDMAssetAPNSCert, Value: apnsCert},
-			fleet.MDMAssetAPNSKey:  {Name: fleet.MDMAssetAPNSKey, Value: apnsKey},
-			fleet.MDMAssetCACert:   {Name: fleet.MDMAssetCACert, Value: certPEM},
-			fleet.MDMAssetCAKey:    {Name: fleet.MDMAssetCAKey, Value: keyPEM},
+			fleet.MDMAssetABMCert:            {Name: fleet.MDMAssetABMCert, Value: certPEM},
+			fleet.MDMAssetABMKey:             {Name: fleet.MDMAssetABMKey, Value: keyPEM},
+			fleet.MDMAssetABMTokenDeprecated: {Name: fleet.MDMAssetABMTokenDeprecated, Value: tokenBytes},
+			fleet.MDMAssetAPNSCert:           {Name: fleet.MDMAssetAPNSCert, Value: apnsCert},
+			fleet.MDMAssetAPNSKey:            {Name: fleet.MDMAssetAPNSKey, Value: apnsKey},
+			fleet.MDMAssetCACert:             {Name: fleet.MDMAssetCACert, Value: certPEM},
+			fleet.MDMAssetCAKey:              {Name: fleet.MDMAssetCAKey, Value: keyPEM},
 		}, nil
 	}
 
diff --git a/cmd/fleetctl/vulnerability_data_stream_test.go b/cmd/fleetctl/vulnerability_data_stream_test.go
index 0e61949eea..d1316a3251 100644
--- a/cmd/fleetctl/vulnerability_data_stream_test.go
+++ b/cmd/fleetctl/vulnerability_data_stream_test.go
@@ -11,7 +11,7 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-func TestVulnerabilityDataStream(t *testing.T) {
+func TestIntegrationsVulnerabilityDataStream(t *testing.T) {
 	nettest.Run(t)
 
 	runAppCheckErr(t, []string{"vulnerability-data-stream"}, "No directory provided")
diff --git a/cmd/osquery-perf/README.md b/cmd/osquery-perf/README.md
index 1641283d59..eb179dd13c 100644
--- a/cmd/osquery-perf/README.md
+++ b/cmd/osquery-perf/README.md
@@ -111,3 +111,11 @@ Example of running the agent with MDM. Note that `enroll_secret` is not needed f
 ```
 go run agent.go --os_templates ipad_13.18,iphone_14.6 --host_count 10 --mdm_scep_challenge 0d53306e-6d7a-9d14-a372-f9e53f9d62db
 ```
+
+## Installing software
+
+The agent can install software for "macos", "ubuntu", and "windows" OSs when running with orbit agent. The following options control the installation behavior:
+
+- `--software_installer_pre_install_fail_prob`: default 0.05, `select 1` always passes and `select 0` always fails
+- `--software_installer_install_fail_prob`: default 0.05, `exit 0` always passes and `exit 1` always fails
+- `--software_installer_post_install_fail_prob`: default 0.05, `exit 0` always passes and `exit 1` always fails
diff --git a/cmd/osquery-perf/agent.go b/cmd/osquery-perf/agent.go
index 04851dfc41..10e8ee21b0 100644
--- a/cmd/osquery-perf/agent.go
+++ b/cmd/osquery-perf/agent.go
@@ -25,6 +25,8 @@ import (
 	"text/template"
 	"time"
 
+	"github.com/fleetdm/fleet/v4/cmd/osquery-perf/installer_cache"
+	"github.com/fleetdm/fleet/v4/pkg/file"
 	"github.com/fleetdm/fleet/v4/pkg/mdm/mdmtest"
 	"github.com/fleetdm/fleet/v4/server/fleet"
 	apple_mdm "github.com/fleetdm/fleet/v4/server/mdm/apple"
@@ -54,6 +56,8 @@ var (
 	vsCodeExtensionsVulnerableSoftware []fleet.Software
 	windowsSoftware                    []map[string]string
 	ubuntuSoftware                     []map[string]string
+
+	installerMetadataCache installer_cache.Metadata
 )
 
 func loadMacOSVulnerableSoftware() {
@@ -490,6 +494,11 @@ type agent struct {
 	softwareQueryFailureProb         float64
 	softwareVSCodeExtensionsFailProb float64
 
+	softwareInstaller softwareInstaller
+
+	// Software installed on the host via Fleet. Key is the software name + version + bundle identifier.
+	installedSoftware sync.Map
+
 	//
 	// The following are exported to be used by the templates.
 	//
@@ -544,6 +553,12 @@ type softwareExtraEntityCount struct {
 	uniqueSoftwareUninstallCount int
 	uniqueSoftwareUninstallProb  float64
 }
+type softwareInstaller struct {
+	preInstallFailureProb  float64
+	installFailureProb     float64
+	postInstallFailureProb float64
+	mu                     *sync.Mutex
+}
 
 func newAgent(
 	agentIndex int,
@@ -552,6 +567,7 @@ func newAgent(
 	configInterval, logInterval, queryInterval, mdmCheckInInterval time.Duration,
 	softwareQueryFailureProb float64,
 	softwareVSCodeExtensionsQueryFailureProb float64,
+	softwareInstaller softwareInstaller,
 	softwareCount softwareEntityCount,
 	softwareVSCodeExtensionsCount softwareExtraEntityCount,
 	userCount entityCount,
@@ -642,6 +658,7 @@ func newAgent(
 
 		softwareQueryFailureProb:         softwareQueryFailureProb,
 		softwareVSCodeExtensionsFailProb: softwareVSCodeExtensionsQueryFailureProb,
+		softwareInstaller:                softwareInstaller,
 
 		macMDMClient: macMDMClient,
 		winMDMClient: winMDMClient,
@@ -967,6 +984,11 @@ func (a *agent) runOrbitLoop() {
 				// that will simulate executing them.
 				go a.execScripts(cfg.Notifications.PendingScriptExecutionIDs, orbitClient)
 			}
+			if len(cfg.Notifications.PendingSoftwareInstallerIDs) > 0 {
+				// there are pending software installations on this host, start a
+				// goroutine that will download the software
+				go a.installSoftware(cfg.Notifications.PendingSoftwareInstallerIDs, orbitClient)
+			}
 			if cfg.Notifications.NeedsProgrammaticWindowsMDMEnrollment &&
 				!a.mdmEnrolled() &&
 				a.winMDMClient != nil &&
@@ -1242,6 +1264,130 @@ func (a *agent) execScripts(execIDs []string, orbitClient *service.OrbitClient)
 	}
 }
 
+func (a *agent) installSoftware(installerIDs []string, orbitClient *service.OrbitClient) {
+	// Only allow one software install to happen at a time.
+	if a.softwareInstaller.mu.TryLock() {
+		defer a.softwareInstaller.mu.Unlock()
+		for _, installerID := range installerIDs {
+			a.installSoftwareItem(installerID, orbitClient)
+		}
+	}
+}
+
+func (a *agent) installSoftwareItem(installerID string, orbitClient *service.OrbitClient) {
+	payload := &fleet.HostSoftwareInstallResultPayload{}
+	payload.InstallUUID = installerID
+	installer, err := orbitClient.GetInstallerDetails(installerID)
+	if err != nil {
+		log.Println("get installer details:", err)
+		return
+	}
+	failed := false
+	if installer.PreInstallCondition != "" {
+		time.Sleep(time.Duration(rand.Intn(1000)) * time.Millisecond)
+		if installer.PreInstallCondition == "select 1" {
+			// Always pass
+			payload.PreInstallConditionOutput = ptr.String("1")
+		} else if installer.PreInstallCondition == "select 0" ||
+			a.softwareInstaller.preInstallFailureProb > 0.0 && rand.Float64() <= a.softwareInstaller.preInstallFailureProb {
+			// Fail
+			payload.PreInstallConditionOutput = ptr.String("")
+			failed = true
+		} else {
+			payload.PreInstallConditionOutput = ptr.String("1")
+		}
+	}
+
+	var meta *file.InstallerMetadata
+	if !failed {
+		var cacheMiss bool
+		// Download the file if needed to get its metadata
+		meta, cacheMiss, err = installerMetadataCache.Get(installer.InstallerID, orbitClient)
+		if err != nil {
+			return
+		}
+
+		if !cacheMiss {
+			// If we didn't download and analyze the file, we do a download and don't save the result
+			err = orbitClient.DownloadAndDiscardSoftwareInstaller(installer.InstallerID)
+			if err != nil {
+				log.Println("download and discard software installer:", err)
+				return
+			}
+		}
+
+		time.Sleep(time.Duration(rand.Intn(30)) * time.Second)
+		if installer.InstallScript == "exit 0" {
+			// Always pass
+			payload.InstallScriptExitCode = ptr.Int(0)
+			payload.InstallScriptOutput = ptr.String("Installed on osquery-perf (always pass)")
+		} else if installer.InstallScript == "exit 1" {
+			payload.InstallScriptExitCode = ptr.Int(1)
+			payload.InstallScriptOutput = ptr.String("Installed on osquery-perf (always fail)")
+			failed = true
+		} else if a.softwareInstaller.installFailureProb > 0.0 && rand.Float64() <= a.softwareInstaller.installFailureProb {
+			payload.InstallScriptExitCode = ptr.Int(1)
+			payload.InstallScriptOutput = ptr.String("Installed on osquery-perf (fail)")
+			failed = true
+		} else {
+			payload.InstallScriptExitCode = ptr.Int(0)
+			payload.InstallScriptOutput = ptr.String("Installed on osquery-perf (pass)")
+		}
+	}
+	if !failed {
+		if meta.Name == "" {
+			log.Printf("WARNING: installer metadata is missing a name for installer:%d\n", installer.InstallerID)
+		} else {
+			key := meta.Name + "+" + meta.Version + "+" + meta.BundleIdentifier
+			if _, ok := a.installedSoftware.Load(key); !ok {
+				source := ""
+				switch a.os {
+				case "macos":
+					source = "apps"
+				case "windows":
+					source = "programs"
+				case "ubuntu":
+					source = "deb_packages"
+				default:
+					log.Printf("unknown OS to software installer: %s", a.os)
+					return
+				}
+				a.installedSoftware.Store(key, map[string]string{
+					"name":              meta.Name,
+					"version":           meta.Version,
+					"bundle_identifier": meta.BundleIdentifier,
+					"source":            source,
+					"installed_path":    os.DevNull,
+				})
+			}
+		}
+
+		if installer.PostInstallScript != "" {
+			time.Sleep(time.Duration(rand.Intn(1000)) * time.Millisecond)
+			if installer.PostInstallScript == "exit 0" {
+				// Always pass
+				payload.PostInstallScriptExitCode = ptr.Int(0)
+				payload.PostInstallScriptOutput = ptr.String("PostInstall on osquery-perf (always pass)")
+			} else if installer.PostInstallScript == "exit 1" {
+				payload.PostInstallScriptExitCode = ptr.Int(1)
+				payload.PostInstallScriptOutput = ptr.String("PostInstall on osquery-perf (always fail)")
+			} else if a.softwareInstaller.postInstallFailureProb > 0.0 && rand.Float64() <= a.softwareInstaller.postInstallFailureProb {
+				payload.PostInstallScriptExitCode = ptr.Int(1)
+				payload.PostInstallScriptOutput = ptr.String("PostInstall on osquery-perf (fail)")
+			} else {
+				payload.PostInstallScriptExitCode = ptr.Int(0)
+				payload.PostInstallScriptOutput = ptr.String("PostInstall on osquery-perf (pass)")
+			}
+		}
+	}
+
+	err = orbitClient.SaveInstallerResult(payload)
+	if err != nil {
+		log.Println("save installer result:", err)
+		return
+	}
+}
+
 func (a *agent) waitingDo(fn func() *http.Request) *http.Response {
 	response, err := http.DefaultClient.Do(fn())
 	for err != nil || response.StatusCode != http.StatusOK {
@@ -1525,6 +1671,10 @@ func (a *agent) softwareMacOS() []map[string]string {
 	}
 	software := append(commonSoftware, uniqueSoftware...)
 	software = append(software, randomVulnerableSoftware...)
+	a.installedSoftware.Range(func(key, value interface{}) bool {
+		software = append(software, value.(map[string]string))
+		return true
+	})
 	rand.Shuffle(len(software), func(i, j int) {
 		software[i], software[j] = software[j], software[i]
 	})
@@ -2023,6 +2173,10 @@ func (a *agent) processQuery(name, query string) (
 		}
 		if ss == fleet.StatusOK {
 			results = windowsSoftware
+			a.installedSoftware.Range(func(key, value interface{}) bool {
+				results = append(results, value.(map[string]string))
+				return true
+			})
 		}
 		return true, results, &ss, nil, nil
 	case name == hostDetailQueryPrefix+"software_linux":
@@ -2034,6 +2188,10 @@ func (a *agent) processQuery(name, query string) (
 			switch a.os {
 			case "ubuntu":
 				results = ubuntuSoftware
+				a.installedSoftware.Range(func(key, value interface{}) bool {
+					results = append(results, value.(map[string]string))
+					return true
+				})
 			}
 		}
 		return true, results, &ss, nil, nil
@@ -2351,7 +2509,7 @@ func main() {
 		// osquery-perf will send log requests with results only if there are scheduled queries configured AND it's their time to run.
 		logInterval         = flag.Duration("logger_tls_period", 10*time.Second, "Interval for scheduled queries log requests")
 		queryInterval       = flag.Duration("query_interval", 10*time.Second, "Interval for distributed query requests")
-		mdmCheckInInterval  = flag.Duration("mdm_check_in_interval", 10*time.Second, "Interval for performing MDM check-ins (applies to both macOS and Windows)")
+		mdmCheckInInterval  = flag.Duration("mdm_check_in_interval", 1*time.Minute, "Interval for performing MDM check-ins (applies to both macOS and Windows)")
 		onlyAlreadyEnrolled = flag.Bool("only_already_enrolled", false, "Only start agents that are already enrolled")
 		nodeKeyFile         = flag.String("node_key_file", "", "File with node keys to use")
 
@@ -2361,6 +2519,13 @@ func main() {
 		softwareQueryFailureProb                 = flag.Float64("software_query_fail_prob", 0.5, "Probability of the software query failing")
 		softwareVSCodeExtensionsQueryFailureProb = flag.Float64("software_vscode_extensions_query_fail_prob", 0.0, "Probability of the software vscode_extensions query failing")
 
+		softwareInstallerPreInstallFailureProb = flag.Float64("software_installer_pre_install_fail_prob", 0.05,
+			"Probability of the pre-install query failing")
+		softwareInstallerInstallFailureProb = flag.Float64("software_installer_install_fail_prob", 0.05,
+			"Probability of the install script failing")
+		softwareInstallerPostInstallFailureProb = flag.Float64("software_installer_post_install_fail_prob", 0.05,
+			"Probability of the post-install script failing")
+
 		commonSoftwareCount                          = flag.Int("common_software_count", 10, "Number of common installed applications reported to fleet")
 		commonVSCodeExtensionsSoftwareCount          = flag.Int("common_vscode_extensions_software_count", 5, "Number of common vscode_extensions installed applications reported to fleet")
 		commonSoftwareUninstallCount                 = flag.Int("common_software_uninstall_count", 1, "Number of common software to uninstall")
@@ -2527,6 +2692,12 @@ func main() {
 			*mdmCheckInInterval,
 			*softwareQueryFailureProb,
 			*softwareVSCodeExtensionsQueryFailureProb,
+			softwareInstaller{
+				preInstallFailureProb:  *softwareInstallerPreInstallFailureProb,
+				installFailureProb:     *softwareInstallerInstallFailureProb,
+				postInstallFailureProb: *softwareInstallerPostInstallFailureProb,
+				mu:                     new(sync.Mutex),
+			},
 			softwareEntityCount{
 				entityCount: entityCount{
 					common: *commonSoftwareCount,
diff --git a/cmd/osquery-perf/installer_cache/installer-cache.go b/cmd/osquery-perf/installer_cache/installer-cache.go
new file mode 100644
index 0000000000..57994de5f6
--- /dev/null
+++ b/cmd/osquery-perf/installer_cache/installer-cache.go
@@ -0,0 +1,66 @@
+package installer_cache
+
+import (
+	"log"
+	"os"
+	"sync"
+
+	"github.com/fleetdm/fleet/v4/pkg/file"
+	"github.com/fleetdm/fleet/v4/server/service"
+)
+
+// Metadata holds the metadata for software installers.
+// To extract the metadata, we must download the file. Once the file has been downloaded once and analyzed,
+// the other agents can use the cache to get the appropriate metadata.
+type Metadata struct {
+	mu    sync.Mutex
+	cache map[uint]*file.InstallerMetadata
+}
+
+func (c *Metadata) Get(key uint, orbitClient *service.OrbitClient) (meta *file.InstallerMetadata,
+	cacheMiss bool, err error) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	if c.cache == nil {
+		c.cache = make(map[uint]*file.InstallerMetadata, 1)
+	}
+
+	meta, ok := c.cache[key]
+	if !ok {
+		var err error
+		meta, err = populateMetadata(orbitClient, key)
+		if err != nil {
+			return nil, false, err
+		}
+		c.cache[key] = meta
+		cacheMiss = true
+	}
+	return meta, cacheMiss, nil
+}
+
+func populateMetadata(orbitClient *service.OrbitClient, installerID uint) (*file.InstallerMetadata, error) {
+	tmpDir, err := os.MkdirTemp("", "")
+	if err != nil {
+		log.Println("create temp dir:", err)
+		return nil, err
+	}
+	defer os.RemoveAll(tmpDir)
+	path, err := orbitClient.DownloadSoftwareInstaller(installerID, tmpDir)
+	if err != nil {
+		log.Println("download software installer:", err)
+		return nil, err
+	}
+	// Figure out what we're actually installing here and add it to software inventory
+	f, err := os.Open(path)
+	if err != nil {
+		log.Println("open installer:", err)
+		return nil, err
+	}
+	defer f.Close()
+	item, err := file.ExtractInstallerMetadata(f)
+	if err != nil {
+		log.Println("extract installer metadata:", err)
+		return nil, err
+	}
+	return item, nil
+}
diff --git a/cmd/osquery-perf/macos_13.6.2.tmpl b/cmd/osquery-perf/macos_13.6.2.tmpl
index 8f59d00e9e..83ee06cc5f 100644
--- a/cmd/osquery-perf/macos_13.6.2.tmpl
+++ b/cmd/osquery-perf/macos_13.6.2.tmpl
@@ -173,6 +173,10 @@
 {{- end }}
 {{- end }}
 
+{{ define "fleet_detail_query_mdm_config_profiles_darwin" -}}
+[]
+{{- end }}
+
 {{/* all hosts */}}
 {{ define "fleet_label_query_6" -}}
 [
diff --git a/cmd/osquery-perf/macos_14.1.2.tmpl b/cmd/osquery-perf/macos_14.1.2.tmpl
index 8aa29e1c4a..4c768d34c1 100644
--- a/cmd/osquery-perf/macos_14.1.2.tmpl
+++ b/cmd/osquery-perf/macos_14.1.2.tmpl
@@ -174,6 +174,10 @@
 {{- end }}
 {{- end }}
 
+{{ define "fleet_detail_query_mdm_config_profiles_darwin" -}}
+[]
+{{- end }}
+
 {{/* all hosts */}}
 {{ define "fleet_label_query_6" -}}
 [
diff --git a/codecov.yml b/codecov.yml
index d0a398457d..cac1d5c0d1 100644
--- a/codecov.yml
+++ b/codecov.yml
@@ -22,3 +22,7 @@ flag_management:
     - name: frontend
       paths:
         - frontend/
+
+ignore:
+  - "server/mock"
+  - "server/fleet/activities.go" # mostly contains code for documentation -- not interesting for tests
diff --git a/docker-compose.yml b/docker-compose.yml
index 437e5ddc71..6a393010e0 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -167,12 +167,6 @@ services:
     volumes:
       - data-minio:/data
 
-  toxiproxy:
-    image: shopify/toxiproxy
-    ports:
-      - "22220:22220"
-      - "8474:8474"
-
 volumes:
   mysql-persistent-volume:
   data-minio:
diff --git a/docs/Configuration/fleet-server-configuration.md b/docs/Configuration/fleet-server-configuration.md
index 76e25658d6..89fa9072ee 100644
--- a/docs/Configuration/fleet-server-configuration.md
+++ b/docs/Configuration/fleet-server-configuration.md
@@ -4,65 +4,16 @@ Fleet server configuration options update the internals of the Fleet server (MyS
 
 Only self-managed users and customers can modify this configuration. If you're a managed-cloud customer, please reach out to Fleet about modifying the configuration.
 
+## Configuration options
+
 You can specify configuration options in the following formats:
 
 1. YAML file
 2. Environment variables
 3. Command-line flags
 
-All duration-based settings accept valid time units of `s`, `m`, `h`.
-
-## YAML file
-
-```sh
-echo '
-
-mysql:
-  address: 127.0.0.1:3306
-  database: fleet
-  username: root
-  password: toor
-redis:
-  address: 127.0.0.1:6379
-server:
-  cert: /tmp/server.cert
-  key: /tmp/server.key
-logging:
-  json: true
-' > /tmp/fleet.yml
-fleet serve --config /tmp/fleet.yml
-```
-
-## Environment variables
-
-```sh
-FLEET_MYSQL_ADDRESS=127.0.0.1:3306 \
-FLEET_MYSQL_DATABASE=fleet \
-FLEET_MYSQL_USERNAME=root \
-FLEET_MYSQL_PASSWORD=toor \
-FLEET_REDIS_ADDRESS=127.0.0.1:6379 \
-FLEET_SERVER_CERT=/tmp/server.cert \
-FLEET_SERVER_KEY=/tmp/server.key \
-FLEET_LOGGING_JSON=true \
-/usr/bin/fleet serve
-```
-
-## Command-line flags
-
-```sh
-/usr/bin/fleet serve \
---mysql_address=127.0.0.1:3306 \
---mysql_database=fleet \
---mysql_username=root \
---mysql_password=toor \
---redis_address=127.0.0.1:6379 \
---server_cert=/tmp/server.cert \
---server_key=/tmp/server.key \
---logging_json
-```
-
-
-## Configuration options
+- All duration-based settings accept valid time units of `s`, `m`, `h`.
+- Command-line flags can also be piped in via stdin.
 
 #### MySQL
 
@@ -2203,7 +2154,7 @@ for the email address specified in the Source parameter of SendRawEmail.
 
 ##### s3_software_installers_bucket
 
-Name of the S3 bucket for storing software.
+Name of the S3 bucket for storing software and bootstrap package.
 
 - Default value: none
 - Environment variable: `FLEET_S3_SOFTWARE_INSTALLERS_BUCKET`
@@ -2891,7 +2842,7 @@ packaging:
     region: us-east-1
 ```
 
-## Mobile device management (MDM)
+#### Mobile device management (MDM)
 
 > The [`server_private_key` configuration option](#server_private_key) is required for macOS MDM features.
 
@@ -2962,11 +2913,6 @@ The content of the Windows WSTEP identity key. An RSA private key, PEM-encoded.
       -----END RSA PRIVATE KEY-----
   ```
 
-
-## Managing osquery configurations
-
-We recommend that you use an infrastructure configuration management tool to manage these osquery configurations consistently across your environment. If you're unsure about what configuration management tools your organization uses, contact your company's system administrators. If you are evaluating new solutions for this problem, the founders of Fleet have successfully managed configurations in large production environments using [Chef](https://www.chef.io/chef/) and [Puppet](https://puppet.com/).
-
 <h2 id="running-with-systemd">Running with systemd</h2>
 
 This content was moved to [Systemd](http://fleetdm.com/docs/deploy/system-d) on Sept 6th, 2023.
diff --git a/docs/Using Fleet/GitOps.md b/docs/Configuration/yaml-files.md
similarity index 74%
rename from docs/Using Fleet/GitOps.md
rename to docs/Configuration/yaml-files.md
index ce2680bda6..7599fd259f 100644
--- a/docs/Using Fleet/GitOps.md	
+++ b/docs/Configuration/yaml-files.md
@@ -1,4 +1,4 @@
-# GitOps
+# YAML files
 
 Use Fleet's best practice GitOps workflow to manage your computers as code.
 
@@ -6,14 +6,16 @@ To learn how to set up a GitOps workflow see the [Fleet GitOps repo](https://git
 
 ## File structure
 
-- `default.yml`- File where you define the queries, policies, controls, and agent options for all hosts. If you're using Fleet Premium, this file updates queries and policies that run on all hosts ("All teams"). Controls and agent options are defined for hosts on "No team."
-- `teams/` - Folder where you define your teams in Fleet. These `teams/team-name.yml` files define the controls, queries, policies, and agent options for hosts assigned to the specified team. Teams are available in Fleet Premium.
+- `default.yml` - File where you define the queries, policies and agent options for all hosts. If you're using Fleet Premium, this file updates queries and policies that run on all hosts ("All teams"). 
+- `teams/no-team.yml` - File where you define the policies, controls, and software for hosts on "No team". Available in Fleet Premium. 
+- `teams/` - Folder where you define your teams in Fleet. These `teams/team-name.yml` files define the controls, queries, policies, software, and agent options for hosts assigned to the specified team. Available in Fleet Premium.
 - `lib/` - Folder where you define policies, queries, configuration profiles, scripts, and agent options. These files can be referenced in top level keys in the `default.yml` file and the files in the `teams/` folder.
 - `.github/workflows/workflow.yml` - The GitHub workflow file where you can add [environment variables](https://docs.github.com/en/actions/learn-github-actions/variables#defining-environment-variables-for-a-single-workflow).
 
-The following files are responsible for running the GitHub action. Most users don't need to edit these files.
+The following files are responsible for running the GitHub action or GitLab CI/CD. Most users don't need to edit these files.
 - `gitops.sh` - The bash script that applies the latest configuration to Fleet. This script is used in the GitHub action file.
 - `.github/gitops-action/action.yml` - The GitHub action that runs `gitops.sh`. This action is used in the GitHub workflow file. It can also be used in other workflows.
+- `.gitlab-ci.yml` - The GitLab CI/CD file that applies the latest configuration to Fleet.
 
 ## Configuration options
 
@@ -24,8 +26,7 @@ name: # Only teams/team-name.yml. To edit a team's name, change `name` but don't
 policies:
 queries:
 agent_options:
-controls:
-software:
+controls: # Can be defined in teams/no-team.yml too.
 org_settings: # Only default.yml
 team_settings: # Only teams/team-name.yml
 ```
@@ -40,6 +41,8 @@ team_settings: # Only teams/team-name.yml
 ### policies
 
 Polcies can be specified inline in your `default.yml` file or `teams/team-name.yml` files. They can also be specified in separate files in your `lib/` folder.
+Policies defined in `default.yml` run on **all** hosts.
+Policies defined in `teams/no-team.yml` run on hosts that belong to "No team".
 
 #### Options
 
@@ -81,9 +84,16 @@ policies:
   platform: darwin
   critical: false
   calendar_event_enabled: false
+- name: Firefox on Linux installed and up to date
+  platform: linux
+  description: "This policy checks that Firefox is installed and up to date."
+  resolution: "Install Firefox version 129.0.2 or higher."
+  query: "SELECT 1 FROM deb_packages WHERE name = 'firefox' AND version_compare(version, '129.0.2') >= 0;"
+  install_software:
+    package_path: "../lib/linux-firefox.deb.package.yml"
 ```
 
-`default.yml` or `teams/team-name.yml`
+`default.yml`, `teams/team-name.yml`, or `teams/no-team.yml`
 
 ```yaml
 policies:
@@ -210,6 +220,8 @@ queries:
 
 The `controls` section allows you to configure scripts and device management (MDM) features in Fleet.
 
+Controls for hosts that are in "No team" can be defined in `default.yml` or in `teams/no-team.yml` (but not in both files).
+
 - `scripts` is a list of paths to macOS, Windows, or Linux scripts.
 - `windows_enabled_and_configured` specifies whether or not to turn on Windows MDM features (default: `false`). Can only be configured for all teams (`default.yml`).
 - `enable_disk_encryption` specifies whether or not to enforce disk encryption on macOS and Windows hosts (default: `false`).
@@ -262,6 +274,16 @@ controls:
 - `deadline_days` (default: null)
 - `grace_period_days` (default: null)
 
+#### ios_updates
+
+- `deadline` specifies the deadline in the form of `YYYY-MM-DD`. The exact deadline time is at 04:00:00 (UTC-8) (default: `""`).
+- `minimum_version` specifies the minimum required iOS version (default: `""`).
+
+#### ipados_updates
+
+- `deadline` specifies the deadline in the form of `YYYY-MM-DD`. The exact deadline time is at 04:00:00 (UTC-8) (default: `""`).
+- `minimum_version` specifies the minimum required iPadOS version (default: `""`).
+
 #### macos_settings and windows_settings
 
 - `macos_settings.custom_settings` is a list of paths to macOS configuration profiles (.mobileconfig) or declaration profiles (.json).
@@ -273,14 +295,16 @@ Use `labels_include_all` to only apply (scope) profiles to hosts that have all t
 
 #### macos_setup
 
-The `macos_setup` section lets you control the [end user migration workflow](https://fleetdm.com/docs/using-fleet/mdm-migration-guide#end-user-workflow) for macOS hosts that automatically enrolled to your old MDM solution.
+The `macos_setup` section lets you control the out-of-the-box macOS [setup experience](https://fleetdm.com/guides/macos-setup-experience) for hosts that use Automated Device Enrollment (ADE).
 
 - `bootstrap_package` is the URL to a bootstap package. Fleet will download the bootstrap package (default: `""`).
 - `enable_end_user_authentication` specifies whether or not to require end user authentication when the user first sets up their macOS host. 
-- `macos_setup_assistant` is a path to a custom automatic enrollment (DEP) profile (.json).
+- `macos_setup_assistant` is a path to a custom automatic enrollment (ADE) profile (.json).
 
 #### macos_migration
 
+The `macos_migration` section lets you control the [end user migration workflow](https://fleetdm.com/docs/using-fleet/mdm-migration-guide#end-user-workflow) for macOS hosts that enrolled to your old MDM solution.
+
 - `enable` specifies whether or not to enable end user migration workflow (default: `false`)
 - `mode` specifies whether the end user initiates migration (`voluntary`) or they're nudged every 15-20 minutes to migrate (`forced`) (default: `""`).
 - `webhook_url` is the URL that Fleet sends a webhook to when the end user selects **Start**. Receive this webhook using your automation tool (ex. Tines) to unenroll your end users from your old MDM solution.
@@ -289,12 +313,18 @@ Can only be configure for all teams (`default.yml`).
 
 ### software
 
+> **Experimental feature**. This feature is undergoing rapid improvement, which may result in breaking changes to the API or configuration surface. It is not recommended for use in automated workflows.
+
 The `software` section allows you to configure packages and Apple App Store apps that you want to install on your hosts.
+Software for hosts that belong to "No team" have to be defined in `teams/no-team.yml`.
+Software can also be specified in separate files in your `lib/` folder.
 
 - `packages` is a list of software packages (.pkg, .msi, .exe, or .deb) and software specific options.
 - `app_store_apps` is a list of Apple App Store apps.
 
-##### Example
+#### Example
+
+##### Inline
 
 ```yaml
 software:
@@ -309,10 +339,10 @@ software:
       self_service: true
     - url: https://github.com/organinzation/repository/package-2.msi
   app_store_apps:
-   - app_store_id: 1091189122
+   - app_store_id: '1091189122'
 ```
 
-#### packages
+##### packages
 
 - `url` specifies the URL at which the software is located. Fleet will download the software and upload it to S3 (default: `""`).
 - `install_script.path` specifies the command Fleet will run on hosts to install software. The [default script](https://github.com/fleetdm/fleet/tree/main/pkg/file/scripts) is dependent on the software type (i.e. .pkg).
@@ -320,9 +350,40 @@ software:
 - `post_install_script.path` is the script Fleet will run on hosts after intalling software (default: `""`).
 - `self_service` specifies whether or not end users can install from **Fleet Desktop > Self-service**.
 
-#### app_store_apps
+##### app_store_apps
 
-- `app_store_id` is the ID of the Apple App Store app. You can find this at the end of the app's App Store URL. For example, "Bear - Markdown Notes" URL is "https://apps.apple.com/us/app/bear-markdown-notes/id1016366447" and the `app_store_id` is `1016366447` (default: `0`).
+- `app_store_id` is the ID of the Apple App Store app. You can find this at the end of the app's App Store URL. For example, "Bear - Markdown Notes" URL is "https://apps.apple.com/us/app/bear-markdown-notes/id1016366447" and the `app_store_id` is `1016366447`.
+
+> Make sure to include only the ID itself, and not the `id` prefix shown in the URL. The ID must be wrapped in quotes as shown in the example so that it is processed as a string. 
+
+##### Separate file
+
+`lib/software-name.package.yml`:
+
+```yaml
+url: https://dl.tailscale.com/stable/tailscale-setup-1.72.0.exe
+install_script:
+  path: ../lib/software/tailscale-install-script.ps1
+self_service: true
+```
+
+`lib/software/tailscale-install-script.ps1`
+
+```yaml
+$exeFilePath = "${env:INSTALLER_PATH}"
+$installProcess = Start-Process $exeFilePath `
+  -ArgumentList "/quiet /norestart" `
+    -PassThru -Verb RunAs -Wait
+```
+
+`default.yml`, `teams/team-name.yml`, or `teams/no-team.yml`
+
+```yaml
+software:
+  packages:
+    - path: ../lib/software-name.package.yml
+# path is relative to default.yml or teams/team-name.yml
+```
 
 ### org_settings and team_settings
 
@@ -569,21 +630,74 @@ Can only be configured for all teams (`org_settings`).
 
 #### mdm
 
-The `mdm` section lets you enable MDM features in Fleet.
+##### apple_business_manager
 
-- `apple_bm_default_team` - is name of the team that macOS hosts in Apple Business Manager automatically enroll to when they're first set up. If empty, hosts will enroll to "No team" (default: `""`).
+- `organization_name` is the organization name associated with the Apple Business Manager account.
+- `macos_team` is the team where macOS hosts are automatically added when they appear in Apple Business Manager.
+- `ios_team` is the the team where iOS hosts are automatically added when they appear in Apple Business Manager.
+- `ipados_team` is the team where iPadOS hosts are automatically added when they appear in Apple Business Manager.
 
 ##### Example
 
 ```yaml
 org_settings:
   mdm:
-    apple_bm_default_team: "Workstations" # Available in Fleet Premium
+    apple_business_manager: # Available in Fleet Premium
+    - organization_name: Fleet Device Management Inc.
+      macos_team: "💻 Workstations" 
+      ios_team: "📱🏢 Company-owned iPhones"
+      ipados_team: "🔳🏢 Company-owned iPads"
+```
+
+> Apple Business Manager settings can only be configured for all teams (`org_settings`).
+
+##### volume_purchasing_program
+
+- `location` is the name of the location in the Apple Business Manager account.
+- `teams` is a list of team names. If you choose specific teams, App Store apps in this VPP account will only be available to install on hosts in these teams. If not specified, App Store apps are available to install on hosts in all teams.
+
+##### Example
+
+```yaml
+org_settings:
+  mdm:
+    volume_purchasing_program: # Available in Fleet Premium
+    - location: Fleet Device Management Inc.
+      teams: 
+      - "💻 Workstations" 
+      - "💻🐣 Workstations (canary)"
+      - "📱🏢 Company-owned iPhones"
+      - "🔳🏢 Company-owned iPads"
 ```
 
 Can only be configured for all teams (`org_settings`).
 
-<meta name="title" value="GitOps">
+##### end_user_authentication
+
+The `end_user_authentication` section lets you define the identity provider (IdP) settings used for end user authentication during Automated Device Enrollment (ADE). Learn more about end user authentication in Fleet [here](https://fleetdm.com/guides/macos-setup-experience#end-user-authentication-and-eula).
+
+Once the IdP settings are configured, you can use the [`controls.macos_setup.enable_end_user_authentication`](#macos_setup) key to control the end user experience during ADE.
+
+- `idp_name` is the human-friendly name for the identity provider that will provide single sign-on authentication (default: `""`).
+- `entity_id` is the entity ID: a Uniform Resource Identifier (URI) that you use to identify Fleet when configuring the identity provider. It must exactly match the Entity ID field used in identity provider configuration (default: `""`).
+- `metadata` is the metadata (in XML format) provided by the identity provider. (default: `""`)
+- `metadata_url` is the URL that references the identity provider metadata. Only one of  `metadata` or `metadata_url` is required (default: `""`).
+
+Can only be configured for all teams (`org_settings`).
+
+##### end_user_authentication
+
+The `end_user_authentication` section lets you define the identity provider (IdP) settings used for end user authentication during Automated Device Enrollment (ADE). Learn more about end user authentication in Fleet [here](https://fleetdm.com/guides/macos-setup-experience#end-user-authentication-and-eula).
+
+Once the IdP settings are configured, you can use the [`controls.macos_setup.enable_end_user_authentication`](#macos_setup) key to control the end user experience during ADE.
+
+- `idp_name` is the human-friendly name for the identity provider that will provide single sign-on authentication (default: `""`).
+- `entity_id` is the entity ID: a Uniform Resource Identifier (URI) that you use to identify Fleet when configuring the identity provider. It must exactly match the Entity ID field used in identity provider configuration (default: `""`).
+- `metadata` is the metadata (in XML format) provided by the identity provider. (default: `""`)
+- `metadata_url` is the URL that references the identity provider metadata. Only one of  `metadata` or `metadata_url` is required (default: `""`).
+
+Can only be configured for all teams (`org_settings`).
+
+<meta name="title" value="YAML files">
 <meta name="description" value="Reference documentation for Fleet's GitOps workflow. See examples and configuration options.">
 <meta name="pageOrderInSection" value="1500">
-<meta name="navSection" value="The basics">
diff --git a/docs/Contributing/API-for-contributors.md b/docs/Contributing/API-for-contributors.md
index 170ff1c8ea..0b830dbc07 100644
--- a/docs/Contributing/API-for-contributors.md
+++ b/docs/Contributing/API-for-contributors.md
@@ -11,9 +11,9 @@
 - [Scripts](#scripts)
 - [Software](#software)
 
-This document includes the internal Fleet API routes that are helpful when developing or contributing to Fleet.
+> These endpoints are used by the Fleet UI, Fleet Desktop, and `fleetctl` clients and frequently change to reflect current functionality.
 
-These endpoints are used by the Fleet UI, Fleet Desktop, and `fleetctl` clients and will frequently change to reflect current functionality.
+This document includes the internal Fleet API routes that are helpful when developing or contributing to Fleet.
 
 If you are interested in gathering information from Fleet in a production environment, please see the [public Fleet REST API documentation](https://fleetdm.com/docs/using-fleet/rest-api).
 
@@ -531,15 +531,26 @@ The MDM endpoints exist to support the related command-line interface sub-comman
 - [Generate Apple Business Manager public key (ADE)](#generate-apple-business-manager-public-key-ade)
 - [Request Certificate Signing Request (CSR)](#request-certificate-signing-request-csr)
 - [Upload APNS certificate](#upload-apns-certificate)
-- [Upload ABM Token](#upload-abm-token)
+- [Add ABM token](#add-abm-token)
 - [Turn off Apple MDM](#turn-off-apple-mdm)
-- [Disable automatic enrollment (ADE)](#disable-automatic-enrollment-ade)
+- [Update ABM token's teams](#update-abm-tokens-teams)
+- [Renew ABM token](#renew-abm-token)
+- [Delete ABM token](#delete-abm-token)
+- [Add VPP token](#add-VPP-token)
+- [Update VPP token's teams](#update-vpp-tokens-teams)
+- [Renew VPP token](#renew-vpp-token)
+- [Delete VPP token](#delete-vpp-token)
 - [Batch-apply MDM custom settings](#batch-apply-mdm-custom-settings)
 - [Initiate SSO during DEP enrollment](#initiate-sso-during-dep-enrollment)
 - [Complete SSO during DEP enrollment](#complete-sso-during-dep-enrollment)
+- [Over the air enrollment](#over-the-air-enrollment)
 - [Preassign profiles to devices](#preassign-profiles-to-devices)
 - [Match preassigned profiles](#match-preassigned-profiles)
 - [Get FileVault statistics](#get-filevault-statistics)
+- [Upload VPP content token](#upload-vpp-content-token)
+- [Disable VPP](#disable-vpp)
+- [Get an over the air (OTA) enrollment profile](#get-an-over-the-air-ota-enrollment-profile)
+
 
 ### Generate Apple Business Manager public key (ADE)
 
@@ -617,9 +628,9 @@ Content-Type: application/octet-stream
 
 `Status: 200`
 
-### Upload ABM Token
+### Add ABM token
 
-`POST /api/v1/fleet/mdm/apple/abm_token`
+`POST /api/v1/fleet/abm_tokens`
 
 #### Parameters
 
@@ -629,7 +640,7 @@ Content-Type: application/octet-stream
 
 #### Example
 
-`POST /api/v1/fleet/mdm/apple/abm_token`
+`POST /api/v1/fleet/abm_tokens`
 
 ##### Request header
 
@@ -650,11 +661,23 @@ Content-Type: application/octet-stream
 --------------------------f02md47480und42y
 ```
 
-
 ##### Default response
 
 `Status: 200`
 
+```json
+"abm_token": {
+  "id": 1,
+  "apple_id": "apple@example.com",
+  "org_name": "Fleet Device Management Inc.",
+  "mdm_server_url": "https://example.com/mdm/apple/mdm",
+  "renew_date": "2024-10-20T00:00:00Z",
+  "terms_expired": false,
+  "macos_team": null,
+  "ios_team": null,
+  "ipados_team": null
+}
+```
 
 ### Turn off Apple MDM
 
@@ -668,19 +691,265 @@ Content-Type: application/octet-stream
 
 `Status: 204`
 
+### Update ABM token's teams
 
-### Disable automatic enrollment (ADE)
+`PATCH /api/v1/fleet/abm_tokens/:id/teams`
 
-`DELETE /api/v1/fleet/mdm/apple/abm_token`
+#### Parameters
+
+| Name | Type | In | Description |
+| ---- | ---- | -- | ----------- |
+| id | integer | path | *Required* The ABM token's ID |
+| macos_team_id | integer | body | macOS hosts are automatically added to this team in Fleet when they appear in Apple Business Manager. If not specified, defaults to "No team" |
+| ios_team_id | integer | body | iOS hosts are automatically added to this team in Fleet when they appear in Apple Business Manager. If not specified, defaults to "No team" |
+| ipados_team_id | integer | body | iPadOS hosts are automatically added to this team in Fleet when they appear in Apple Business Manager. If not specified, defaults to "No team" |
 
 #### Example
 
-`DELETE /api/v1/fleet/mdm/apple/abm_token`
+`PATCH /api/v1/fleet/abm_tokens/1/teams`
+
+##### Request body
+
+```json
+{
+  "macos_team_id": 1,
+  "ios_team_id": 2,
+  "ipados_team_id": 3
+}
+```
+
+##### Default response
+
+`Status: 200`
+
+```json
+"abm_token": {
+  "id": 1,
+  "apple_id": "apple@example.com",
+  "org_name": "Fleet Device Management Inc.",
+  "mdm_server_url": "https://example.com/mdm/apple/mdm",
+  "renew_date": "2024-11-29T00:00:00Z",
+  "terms_expired": false,
+  "macos_team": 1,
+  "ios_team": 2,
+  "ipados_team": 3
+}
+```
+
+### Renew ABM token
+
+`PATCH /api/v1/fleet/abm_tokens/:id/renew`
+
+#### Parameters
+
+| Name | Type | In | Description |
+| ---- | ---- | -- | ----------- |
+| id | integer | path | *Required* The ABM token's ID |
+
+#### Example
+
+`PATCH /api/v1/fleet/abm_tokens/1/renew`
+
+##### Request header
+
+```http
+Content-Length: 850
+Content-Type: multipart/form-data; boundary=------------------------f02md47480und42y
+```
+
+##### Request body
+
+```http
+--------------------------f02md47480und42y
+Content-Disposition: form-data; name="token"; filename="server_token_abm.p7m"
+Content-Type: application/octet-stream
+
+<TOKEN_DATA>
+
+--------------------------f02md47480und42y
+```
+
+##### Default response
+
+`Status: 200`
+
+```json
+"abm_token": {
+  "id": 1,
+  "apple_id": "apple@example.com",
+  "org_name": "Fleet Device Management Inc.",
+  "mdm_server_url": "https://example.com/mdm/apple/mdm",
+  "renew_date": "2025-10-20T00:00:00Z",
+  "terms_expired": false,
+  "macos_team": null,
+  "ios_team": null,
+  "ipados_team": null
+}
+```
+
+### Delete ABM token
+
+`DELETE /api/v1/fleet/abm_tokens/:id`
+
+#### Parameters
+
+| Name | Type | In | Description |
+| ---- | ---- | -- | ----------- |
+| id | integer | path | *Required* The ABM token's ID |
+
+#### Example
+
+`DELETE /api/v1/fleet/abm_tokens/1`
 
 ##### Default response
 
 `Status: 204`
 
+### Add VPP token
+
+`POST /api/v1/fleet/vpp_tokens`
+
+#### Parameters
+
+| Name | Type | In | Description |
+| ---- | ---- | -- | ----------- |
+| token | file | form | *Required* The file containing the content token (.vpptoken) from Apple Business Manager |
+
+#### Example
+
+`POST /api/v1/fleet/vpp_tokens`
+
+##### Request header
+
+```http
+Content-Length: 850
+Content-Type: multipart/form-data; boundary=------------------------f02md47480und42y
+```
+
+##### Request body
+
+```http
+--------------------------f02md47480und42y
+Content-Disposition: form-data; name="token"; filename="sToken_for_Acme.vpptoken"
+Content-Type: application/octet-stream
+<TOKEN_DATA>
+--------------------------f02md47480und42y
+```
+
+##### Default response
+
+`Status: 200`
+
+```json
+"vpp_token": {
+  "id": 1,
+  "org_name": "Fleet Device Management Inc.",
+  "location": "https://example.com/mdm/apple/mdm",
+  "renew_date": "2024-10-20T00:00:00Z",
+  "terms_expired": false,
+  "teams": null
+}
+```
+
+### Update VPP token's teams
+
+`PATCH /api/v1/fleet/vpp_tokens/:id/teams`
+
+#### Parameters
+
+| Name | Type | In | Description |
+| ---- | ---- | -- | ----------- |
+| id | integer | path | *Required* The ABM token's ID |
+| team_ids | list | body | If you choose specific teams, App Store apps in this VPP account will only be available to install on hosts in these teams. If not specified, defaults to all teams. |
+
+#### Example
+
+`PATCH /api/v1/fleet/vpp_tokens/1/teams`
+
+##### Request body
+
+```json
+{
+  "team_ids": [1, 2, 3]
+}
+```
+
+##### Default response
+
+`Status: 200`
+
+```json
+"vpp_token": {
+  "id": 1,
+  "org_name": "Fleet Device Management Inc.",
+  "location": "https://example.com/mdm/apple/mdm",
+  "renew_date": "2024-10-20T00:00:00Z",
+  "terms_expired": false,
+  "teams": [1, 2, 3]
+}
+```
+
+### Renew VPP token
+
+`PATCH /api/v1/fleet/vpp_tokens/:id/renew`
+
+#### Parameters
+
+| Name | Type | In | Description |
+| ---- | ---- | -- | ----------- |
+| id | integer | path | *Required* The VPP token's ID |
+
+##### Request header
+
+```http
+Content-Length: 850
+Content-Type: multipart/form-data; boundary=------------------------f02md47480und42y
+```
+
+##### Request body
+
+```http
+--------------------------f02md47480und42y
+Content-Disposition: form-data; name="token"; filename="sToken_for_Acme.vpptoken"
+Content-Type: application/octet-stream
+
+<TOKEN_DATA>
+
+--------------------------f02md47480und42y
+```
+
+##### Default response
+
+`Status: 200`
+
+```json
+"vpp_token": {
+  "id": 1,
+  "org_name": "Fleet Device Management Inc.",
+  "location": "https://example.com/mdm/apple/mdm",
+  "renew_date": "2025-10-20T00:00:00Z",
+  "terms_expired": false,
+  "teams": [1, 2, 3]
+}
+```
+
+### Delete VPP token
+
+`DELETE /api/v1/fleet/vpp_token/:id`
+
+#### Parameters
+
+| Name | Type | In | Description |
+| ---- | ---- | -- | ----------- |
+| id | integer | path | *Required* The VPP token's ID |
+
+#### Example
+
+`DELETE /api/v1/fleet/vpp_tokens/1`
+
+##### Default response
+
+`Status: 204`
 
 ### Batch-apply MDM custom settings
 
@@ -762,6 +1031,34 @@ If the credentials are valid, the server redirects the client to the Fleet UI. T
 - `profile_token` is a token that can be used to download an enrollment profile (.mobileconfig).
 - `eula_token` (optional) if an EULA was uploaded, this contains a token that can be used to view the EULA document.
 
+### Over the air enrollment
+
+This endpoint handles over the air (OTA) MDM enrollments
+
+`POST /api/v1/fleet/ota_enrollment`
+
+#### Parameters
+
+| Name                | Type   | In   | Description                                                                                                                                                                                                                                                                                        |
+| ------------------- | ------ | ---- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| enroll_secret       | string | url  | **Required** Assigns the host to a team with a matching enroll secret                                                                                                                                                                                                                 |
+| XML device response | XML    | body | **Required**. The XML response from the device. Fields are documented [here](https://developer.apple.com/library/archive/documentation/NetworkingInternet/Conceptual/iPhoneOTAConfiguration/ConfigurationProfileExamples/ConfigurationProfileExamples.html#//apple_ref/doc/uid/TP40009505-CH4-SW7) |
+
+> Note: enroll secrets can contain special characters. Ensure any special characters are [properly escaped](https://developer.mozilla.org/en-US/docs/Glossary/Percent-encoding).
+
+#### Example
+
+`POST /api/v1/fleet/ota_enrollment?enroll_secret=0Z6IuKpKU4y7xl%2BZcrp2gPcMi1kKNs3p`
+
+##### Default response
+
+`Status: 200`
+
+Per [the spec](https://developer.apple.com/library/archive/documentation/NetworkingInternet/Conceptual/iPhoneOTAConfiguration/Introduction/Introduction.html#//apple_ref/doc/uid/TP40009505-CH1-SW1), the response is different depending on the signature of the XML device response:
+
+- If the body is signed with a certificate that can be validated by our root SCEP certificate, it returns an enrollment profile.
+- Otherwise, it returns a SCEP payload.
+
 ### Preassign profiles to devices
 
 _Available in Fleet Premium_
@@ -868,6 +1165,55 @@ This endpoint uses the profiles stored by the [Preassign profiles to devices](#p
 
 `Status: 204`
 
+### Upload VPP content token
+
+`POST /api/v1/fleet/mdm/apple/vpp_token`
+
+#### Parameters
+
+| Name | Type | In | Description |
+| ---- | ---- | -- | ----------- |
+| token | file | form | *Required* The file containing the content token (.vpptoken) from Apple Business Manager |
+
+#### Example
+
+`POST /api/v1/fleet/mdm/apple/vpp_token`
+
+##### Request header
+
+```http
+Content-Length: 850
+Content-Type: multipart/form-data; boundary=------------------------f02md47480und42y
+```
+
+##### Request body
+
+```http
+--------------------------f02md47480und42y
+Content-Disposition: form-data; name="token"; filename="sToken_for_Acme.vpptoken"
+Content-Type: application/octet-stream
+<TOKEN_DATA>
+--------------------------f02md47480und42y
+```
+
+##### Default response
+
+`Status: 200`
+
+
+### Disable VPP
+
+`DELETE /api/v1/fleet/mdm/apple/vpp_token`
+
+#### Example
+
+`DELETE /api/v1/fleet/mdm/apple/vpp_token`
+
+##### Default response
+
+`Status: 204`
+
+
 ## Get or apply configuration files
 
 These API routes are used by the `fleetctl` CLI tool. Users can manage Fleet with `fleetctl` and [configuration files in YAML syntax](https://fleetdm.com/docs/using-fleet/configuration-files/).
@@ -1137,12 +1483,14 @@ NOTE: when updating a policy, team and platform will be ignored.
       "name": "new policy",
       "description": "This will be a new policy because a policy with the name 'new policy' doesn't exist in Fleet.",
       "query": "SELECT * FROM osquery_info",
+      "team": "No team",
       "resolution": "some resolution steps here",
       "critical": false
     },
     {
       "name": "Is FileVault enabled on macOS devices?",
       "query": "SELECT 1 FROM disk_encryption WHERE user_uuid IS NOT “” AND filevault_status = ‘on’ LIMIT 1;",
+      "team": "Workstations",
       "description": "Checks to make sure that the FileVault feature is enabled on macOS devices.",
       "resolution": "Choose Apple menu > System Preferences, then click Security & Privacy. Click the FileVault tab. Click the Lock icon, then enter an administrator name and password. Click Turn On FileVault.",
       "platform": "darwin",
@@ -1381,7 +1729,9 @@ If the `name` is not already associated with an existing team, this API route cr
 | mdm.windows_settings                        | object | body  | The Windows-specific MDM settings.                                                                                                                                                                                                    |
 | mdm.windows_settings.custom_settings        | list   | body  | The list of objects consists of a `path` to XML files and `labels_include_all` or `labels_exclude_any` list of label names.                                                                                                                                                         |
 | scripts                                   | list   | body  | A list of script files to add to this team so they can be executed at a later time.                                                                                                                                                 |
-| software                                   | list   | body  | An array of software objects. Each object consists of:`url`- URL to the software package (PKG, MSI, EXE or DEB),`install_script` - command that Fleet runs to install software, `pre_install_query` - condition query that determines if the install will proceed, `post_install_script` - script that runs after software install, and `self_service` boolean.   |
+| software                                   | object   | body  | The team's software that will be available for install.  |
+| software.packages                          | list   | body  | An array of objects. Each object consists of:`url`- URL to the software package (PKG, MSI, EXE or DEB),`install_script` - command that Fleet runs to install software, `pre_install_query` - condition query that determines if the install will proceed, `post_install_script` - script that runs after software install, and `self_service` boolean.   |
+| software.app_store_apps                   | list   | body  | An array objects. Each object consists of `app_store_id` - ID of the App Store app formatted as a string (in quotes) rather than a number. |
 | mdm.macos_settings.enable_disk_encryption | bool   | body  | Whether disk encryption should be enabled for hosts that belong to this team.                                                                                                                                                       |
 | force                                     | bool   | query | Force apply the spec even if there are (ignorable) validation errors. Those are unknown keys and agent options-related validations.                                                                                                 |
 | dry_run                                   | bool   | query | Validate the provided JSON for unknown keys and invalid value types and return any validation errors, but do not apply the changes.                                                                                                 |
@@ -1462,14 +1812,21 @@ If the `name` is not already associated with an existing team, this API route cr
         }
       },
       "scripts": ["path/to/script.sh"],
-      "software": [
-        {
-          "url": "https://cdn.zoom.us/prod/5.16.10.26186/x64/ZoomInstallerFull.msi",
-          "pre_install_query": "SELECT 1 FROM macos_profiles WHERE uuid='c9f4f0d5-8426-4eb8-b61b-27c543c9d3db';",
-          "post_install_script": "sudo /Applications/Falcon.app/Contents/Resources/falconctl license 0123456789ABCDEFGHIJKLMNOPQRSTUV-WX",
-          "self_service": true
-        }
-      ]
+      "software": { 
+        "packages": [
+          {
+            "url": "https://cdn.zoom.us/prod/5.16.10.26186/x64/ZoomInstallerFull.msi",
+            "pre_install_query": "SELECT 1 FROM macos_profiles WHERE uuid='c9f4f0d5-8426-4eb8-b61b-27c543c9d3db';",
+            "post_install_script": "sudo /Applications/Falcon.app/Contents/Resources/falconctl license 0123456789ABCDEFGHIJKLMNOPQRSTUV-WX",
+            "self_service": true,
+          }
+        ],
+        "app_store_apps": [
+          {
+            "app_store_id": "12464567",
+          }
+        ]
+      }  
     }
   ]
 }
@@ -2481,6 +2838,7 @@ Gets all information required by Fleet Desktop, this includes things like the nu
 ```json
 {
   "failing_policies_count": 3,
+  "self_service": true,
   "notifications": {
     "needs_mdm_migration": true,
     "renew_enrollment_profile": false,
@@ -2540,35 +2898,58 @@ Lists the software installed on the current device.
     {
       "id": 121,
       "name": "Google Chrome.app",
+      "software_package": {
+        "name": "GoogleChrome.pkg"
+        "version": "125.12.2"
+        "self_service": true,
+     	"last_install": {
+          "install_uuid": "8bbb8ac2-b254-4387-8cba-4d8a0407368b",
+      	  "installed_at": "2024-05-15T15:23:57Z"
+        },
+      },
+      "app_store_app": null,
       "source": "apps",
       "status": "failed",
-      "last_install": {
-        "install_uuid": "8bbb8ac2-b254-4387-8cba-4d8a0407368b",
-        "installed_at": "2024-05-15T15:23:57Z"
-      },
       "installed_versions": [
-        { 
+        {
           "version": "121.0",
           "last_opened_at": "2024-04-01T23:03:07Z",
           "vulnerabilities": ["CVE-2023-1234","CVE-2023-4321","CVE-2023-7654"],
           "installed_paths": ["/Applications/Google Chrome.app"]
         }
-      ]
+      ],
+       "software_package": {
+        "name": "google-chrome-124-0-6367-207.pkg",
+        "version": "121.0",
+        "self_service": true,
+        "icon_url": null,
+        "last_install": null
+      },
+      "app_store_app": null
     },
     {
       "id": 143,
       "name": "Firefox.app",
+      "software_package": null,
+      "app_store_app": null,
       "source": "apps",
       "status": null,
-      "last_install": null,
       "installed_versions": [
-        { 
+        {
           "version": "125.6",
           "last_opened_at": "2024-04-01T23:03:07Z",
           "vulnerabilities": ["CVE-2023-1234","CVE-2023-4321","CVE-2023-7654"],
           "installed_paths": ["/Applications/Firefox.app"]
         }
-      ]
+      ],
+      "software_package": null,
+      "app_store_app": {
+        "app_store_id": "12345",
+        "version": "125.6",
+        "self_service": false,
+        "icon_url": "https://example.com/logo-light.jpg",
+        "last_install": null
+      },
     }
   ],
   "meta": {
@@ -2917,7 +3298,7 @@ If the Fleet instance is provided required parameters to complete setup.
 
 ## Scripts
 
-### Batch-apply scripts 
+### Batch-apply scripts
 
 _Available in Fleet Premium_
 
@@ -2946,7 +3327,7 @@ If both `team_id` and `team_name` parameters are included, this endpoint will re
 
 ## Software
 
-### Batch-apply software 
+### Batch-apply software
 
 _Available in Fleet Premium._
 
@@ -2956,10 +3337,12 @@ _Available in Fleet Premium._
 
 | Name      | Type   | In    | Description                                                                                                                                                           |
 | --------- | ------ | ----- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| team_id   | number | query | The ID of the team to add the software package to. Only one team identifier (`team_id` or `team_name`) can be included in the request, omit this parameter if using `team_name`. |
-| team_name | string | query | The name of the team to add the software package to. Only one team identifier (`team_id` or `team_name`) can be included in the request, omit this parameter if using `team_id`. |
+| team_id   | number | query | The ID of the team to add the software package to. Only one team identifier (`team_id` or `team_name`) can be included in the request, omit this parameter if using `team_name`. Ommitting these parameters will add software to 'No Team'. |
+| team_name | string | query | The name of the team to add the software package to. Only one team identifier (`team_id` or `team_name`) can be included in the request, omit this parameter if using `team_id`. Ommitting these parameters will add software to 'No Team'. |
 | dry_run   | bool   | query | If `true`, will validate the provided software packages and return any validation errors, but will not apply the changes.                                                                         |
-| software  | list   | body  | An array of software objects. Each object consists of:`url`- URL to the software package (PKG, MSI, EXE or DEB),`install_script` - command that Fleet runs to install software, `pre_install_query` - condition query that determines if the install will proceed, and `post_install_script` - script that runs after software install.   |
+| software  | object   | body  | The team's software that will be available for install.  |
+| software.packages   | list   | body  | An array of objects. Each object consists of:`url`- URL to the software package (PKG, MSI, EXE or DEB),`install_script` - command that Fleet runs to install software, `pre_install_query` - condition query that determines if the install will proceed, `post_install_script` - script that runs after software install, and `uninstall_script` - command that Fleet runs to uninstall software. |
+| software.app_store_apps | list   | body  | An array objects. Each object consists of `app_store_id` - ID of the App Store app. |
 
 If both `team_id` and `team_name` parameters are included, this endpoint will respond with an error. If no `team_name` or `team_id` is provided, the scripts will be applied for **all hosts**.
 
@@ -2969,6 +3352,62 @@ If both `team_id` and `team_name` parameters are included, this endpoint will re
 
 ##### Default response
 
+`Status: 200`
+
+```json
+{
+  "packages": [
+    {
+      "team_id": 3,
+      "software_title_id": 6690,
+      "url": "https://dl.tailscale.com/stable/tailscale-setup-1.72.0.exe"
+    },
+    {
+      "team_id": 3,
+      "software_title_id": 10412,
+      "url": "https://ftp.mozilla.org/pub/firefox/releases/129.0.2/win64/en-US/Firefox%20Setup%20129.0.2.msi"
+    }
+  ]
+}
+```
+
+### Batch-apply VPP apps
+
+_Available in Fleet Premium._
+
+`POST /api/latest/fleet/software/app_store_apps/batch`
+
+#### Parameters
+
+| Name      | Type   | In    | Description                                                                                                                                                           |
+| --------- | ------ | ----- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| team_name | string | query | The name of the team to add the software package to. Ommitting this parameter will add software to 'No Team'. |
+| dry_run   | bool   | query | If `true`, will validate the provided VPP apps and return any validation errors, but will not apply the changes.                                                                         |
+| app_store_apps | list   | body  | An array of objects. Each object contains `app_store_id` and `self_service`. |
+| app_store_apps.app_store_id | string   | body  | ID of the App Store app. |
+| app_store_apps.self_service | boolean   | body  | Whether the VPP app is "Self-service" or not. |
+
+#### Example
+
+`POST /api/latest/fleet/software/app_store_apps/batch`
+```json
+{
+  "team_name": "Foobar",
+  "app_store_apps": {
+    {
+      "app_store_id": "597799333",
+      "self_service": false,
+    },
+    {
+      "app_store_id": "497799835",
+      "self_service": true,
+    }
+  }
+}
+```
+
+##### Default response
+
 `Status: 204`
 
  ### Run live script
@@ -3010,3 +3449,130 @@ Run a live script and get results back (5 minute timeout). Live scripts only run
   "exit_code": 0
 }
 ```
+
+### Get token to download package
+
+_Available in Fleet Premium._
+
+`POST /api/v1/fleet/software/titles/:software_title_id/package/token?alt=media`
+
+The returned token is a one-time use token that expires after 10 minutes.
+
+#### Parameters
+
+| Name              | Type    | In    | Description                                                      |
+|-------------------|---------|-------|------------------------------------------------------------------|
+| software_title_id | integer | path  | **Required**. The ID of the software title for software package. |
+| team_id           | integer | query | **Required**. The team ID containing the software package.       |
+| alt               | integer | query | **Required**. Must be specified and set to "media".              |
+
+#### Example
+
+`POST /api/v1/fleet/software/titles/123/package/token?alt=media&team_id=2`
+
+##### Default response
+
+`Status: 200`
+
+```json
+{
+  "token": "e905e33e-07fe-4f82-889c-4848ed7eecb7"
+}
+```
+
+### Download package using a token
+
+_Available in Fleet Premium._
+
+`GET /api/v1/fleet/software/titles/:software_title_id/package/token/:token?alt=media`
+
+#### Parameters
+
+| Name              | Type    | In   | Description                                                              |
+|-------------------|---------|------|--------------------------------------------------------------------------|
+| software_title_id | integer | path | **Required**. The ID of the software title to download software package. |
+| token             | string  | path | **Required**. The token to download the software package.                |
+
+#### Example
+
+`GET /api/v1/fleet/software/titles/123/package/token/e905e33e-07fe-4f82-889c-4848ed7eecb7`
+
+##### Default response
+
+`Status: 200`
+
+```http
+Status: 200
+Content-Type: application/octet-stream
+Content-Disposition: attachment
+Content-Length: <length>
+Body: <blob>
+```
+
+### Get an over the air (OTA) enrollment profile
+
+`GET /api/v1/fleet/enrollment_profiles/ota`
+
+The returned value is a signed `.mobileconfig` OTA profile.
+
+#### Parameters
+
+| Name              | Type    | In    | Description                                                                      |
+|-------------------|---------|-------|----------------------------------------------------------------------------------|
+| enroll_secret     | string  | query | **Required**. The enroll secret of the team this host will be assigned to.       |
+
+#### Example
+
+`GET /api/v1/fleet/enrollment_profiles/ota?enroll_secret=foobar`
+
+##### Default response
+
+`Status: 200`
+
+**Note** To confirm success, it is important for clients to match content length with the response
+header (this is done automatically by most clients, including the browser) rather than relying
+solely on the response status code returned by this endpoint.
+
+##### Example response headers
+
+```http
+  Content-Length: 542
+  Content-Type: application/x-apple-aspen-config; charset=urf-8
+  Content-Disposition: attachment;filename="fleet-mdm-enrollment-profile.mobileconfig"
+  X-Content-Type-Options: nosniff
+```
+
+###### Example response body
+
+```xml
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple Inc//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+  <dict>
+    <key>PayloadContent</key>
+    <dict>
+      <key>URL</key>
+      <string>https://foo.example.com/api/fleet/ota_enrollment?enroll_secret=foobar</string>
+      <key>DeviceAttributes</key>
+      <array>
+        <string>UDID</string>
+        <string>VERSION</string>
+        <string>PRODUCT</string>
+	<string>SERIAL</string>
+      </array>
+    </dict>
+    <key>PayloadOrganization</key>
+    <string>Acme Inc.</string>
+    <key>PayloadDisplayName</key>
+    <string>Acme Inc. enrollment</string>
+    <key>PayloadVersion</key>
+    <integer>1</integer>
+    <key>PayloadUUID</key>
+    <string>fdb376e5-b5bb-4d8c-829e-e90865f990c9</string>
+    <key>PayloadIdentifier</key>
+    <string>com.fleetdm.fleet.mdm.apple.ota</string>
+    <key>PayloadType</key>
+    <string>Profile Service</string>
+  </dict>
+</plist>
+```
diff --git a/docs/Using Fleet/Audit-logs.md b/docs/Contributing/Audit-logs.md
similarity index 94%
rename from docs/Using Fleet/Audit-logs.md
rename to docs/Contributing/Audit-logs.md
index 2ddd3bc055..25062d463f 100644
--- a/docs/Using Fleet/Audit-logs.md	
+++ b/docs/Contributing/Audit-logs.md
@@ -1170,6 +1170,29 @@ This activity contains the following fields:
 }
 ```
 
+## uninstalled_software
+
+Generated when a software is uninstalled on a host.
+
+This activity contains the following fields:
+- "host_id": ID of the host.
+- "host_display_name": Display name of the host.
+- "software_title": Name of the software.
+- "script_execution_id": ID of the software uninstall script.
+- "status": Status of the software uninstallation.
+
+#### Example
+
+```json
+{
+  "host_id": 1,
+  "host_display_name": "Anna's MacBook Pro",
+  "software_title": "Falcon.app",
+  "script_execution_id": "ece8d99d-4313-446a-9af2-e152cd1bad1e",
+  "status": "uninstalled"
+}
+```
+
 ## added_software
 
 Generated when a software installer is uploaded to Fleet.
@@ -1193,6 +1216,29 @@ This activity contains the following fields:
 }
 ```
 
+## edited_software
+
+Generated when a software installer is updated in Fleet.
+
+This activity contains the following fields:
+- "software_title": Name of the software.
+- "software_package": Filename of the installer as of this update (including if unchanged).
+- "team_name": Name of the team on which this software was updated. `null` if it was updated on no team.
+- "team_id": The ID of the team on which this software was updated. `null` if it was updated on no team.
+- "self_service": Whether the software is available for installation by the end user.
+
+#### Example
+
+```json
+{
+  "software_title": "Falcon.app",
+  "software_package": "FalconSensor-6.44.pkg",
+  "team_name": "Workstations",
+  "team_id": 123,
+  "self_service": true
+}
+```
+
 ## deleted_software
 
 Generated when a software installer is deleted from Fleet.
@@ -1218,15 +1264,33 @@ This activity contains the following fields:
 
 ## enabled_vpp
 
-Generated when the VPP feature is enabled in Fleet.
+Generated when VPP features are enabled in Fleet.
 
+This activity contains the following fields:
+- "location": Location associated with the VPP content token for the enabled VPP features.
 
+#### Example
+
+```json
+{
+  "location": "Acme Inc."
+}
+```
 
 ## disabled_vpp
 
-Generated when the VPP feature is disabled in Fleet.
+Generated when VPP features are disabled in Fleet.
 
+This activity contains the following fields:
+- "location": Location associated with the VPP content token for the disabled VPP features.
 
+#### Example
+
+```json
+{
+  "location": "Acme Inc."
+}
+```
 
 ## added_app_store_app
 
@@ -1236,6 +1300,7 @@ This activity contains the following fields:
 - "software_title": Name of the App Store app.
 - "app_store_id": ID of the app on the Apple App Store.
 - "platform": Platform of the app (`darwin`, `ios`, or `ipados`).
+- "self_service": App installation can be initiated by device owner.
 - "team_name": Name of the team to which this App Store app was added, or `null` if it was added to no team.
 - "team_id": ID of the team to which this App Store app was added, or `null`if it was added to no team.
 
@@ -1246,6 +1311,7 @@ This activity contains the following fields:
   "software_title": "Logic Pro",
   "app_store_id": "1234567",
   "platform": "darwin",
+  "self_service": false,
   "team_name": "Workstations",
   "team_id": 1
 }
@@ -1280,6 +1346,7 @@ Generated when an App Store app is installed on a device.
 
 This activity contains the following fields:
 - host_id: ID of the host on which the app was installed.
+- self_service: App installation was initiated by device owner.
 - host_display_name: Display name of the host.
 - software_title: Name of the App Store app.
 - app_store_id: ID of the app on the Apple App Store.
@@ -1290,6 +1357,7 @@ This activity contains the following fields:
 ```json
 {
   "host_id": 42,
+  "self_service": true,
   "host_display_name": "Anna's MacBook Pro",
   "software_title": "Logic Pro",
   "app_store_id": "1234567",
diff --git a/docs/Contributing/File-carving.md b/docs/Contributing/File-carving.md
index 4daad97fb0..b283f11f4c 100644
--- a/docs/Contributing/File-carving.md
+++ b/docs/Contributing/File-carving.md
@@ -77,7 +77,7 @@ The same is not true if S3 is used as the storage backend. In that scenario, it
 
 ### Alternative carving backends
 
-#### Minio
+#### MinIO
 
 Configure the following:
 - `FLEET_S3_ENDPOINT_URL=minio_host:port`
@@ -87,6 +87,11 @@ Configure the following:
 - `FLEET_S3_FORCE_S3_PATH_STYLE=true`
 - `FLEET_S3_REGION=minio` or any non-empty string otherwise Fleet will attempt to derive the region.
 
+If you're testing file carving locally with the docker-compose environment, the `--dev` flag on Fleet server will
+automatically point carves to the local MinIO container and write to the `carves-dev` bucket without needing to set
+additional configuration. Note that this bucket is *not* created automatically when bringing MinIO up; you'll need to
+log in via `http://localhost:9001` with credentials `minio` / `minio123!` to create the bucket.
+
 ### Troubleshooting
 
 #### Check carve status in osquery
diff --git a/docs/Contributing/Simulate-slow-network.md b/docs/Contributing/Simulate-slow-network.md
index 3b342a0f3a..6fa02d6f83 100644
--- a/docs/Contributing/Simulate-slow-network.md
+++ b/docs/Contributing/Simulate-slow-network.md
@@ -7,6 +7,17 @@ The guide assumes you'll build and run the Fleet server locally with the `make f
 
 (Has been tested on macOS only.)
 
+## 0. Edit docker-compose.yml
+
+Add the following service to the main `docker-compose.yml`:
+```yml
+  toxiproxy:
+    image: shopify/toxiproxy
+    ports:
+      - "22220:22220"
+      - "8474:8474"
+```
+
 ## 1. Start services
 
 ```sh
@@ -44,4 +55,4 @@ curl -s -XPOST -d '{"type" : "latency", "attributes" : {"latency" : 1000, "jitte
 ```
 
 <meta name="pageOrderInSection" value="1400">
-<meta name="description" value="A guide for simulating slow connections from a local Fleet server to a Redis or MySQL database">
\ No newline at end of file
+<meta name="description" value="A guide for simulating slow connections from a local Fleet server to a Redis or MySQL database">
diff --git a/docs/Contributing/Testing-and-local-development.md b/docs/Contributing/Testing-and-local-development.md
index a3445e3ccd..45c5a93fe0 100644
--- a/docs/Contributing/Testing-and-local-development.md
+++ b/docs/Contributing/Testing-and-local-development.md
@@ -81,6 +81,14 @@ REDIS_TEST=1 MYSQL_TEST=1 make test
 
 The integration tests in the `server/service` package can generate a lot of logs mixed with the test results output. To make it easier to identify a failing test in this package, you can set the `FLEET_INTEGRATION_TESTS_DISABLE_LOG=1` environment variable so that logging is disabled.
 
+The MDM integration tests are run with a random selection of software installer storage backends (local filesystem or S3/minio), and similar for the bootstrap packages storage (DB or S3/minio). You can force usage of the S3 backend by setting `FLEET_INTEGRATION_TESTS_SOFTWARE_INSTALLER_STORE=s3`. Note that `MINIO_STORAGE_TEST=1` must also be set for the S3 backend to be used.
+
+When the S3 backend is used, this line will be printed in the tests' output (as this could be relevant to understand and debug the test failure):
+
+```
+    integration_mdm_test.go:196: >>> using S3/minio software installer store
+```
+
 Note that on a Linux system, the Redis tests will include running in cluster mode, so the docker Redis Cluster setup must be running. This implies starting the docker dependencies as follows:
 
 ```sh
@@ -481,7 +489,9 @@ FLEET_SERVER_SANDBOX_ENABLED=1 FLEET_PACKAGING_GLOBAL_ENROLL_SECRET=xyz  ./build
 Be sure to replace the `FLEET_PACKAGING_GLOBAL_ENROLL_SECRET` value above with the global enroll
 secret from the `fleetctl package` command used to build the installers.
 
-MinIO also offers a web interface at http://localhost:9001. Credentials are `minio` / `minio123!`.
+MinIO also offers a web interface at http://localhost:9001. Credentials are `minio` / `minio123!`. When starting the
+Fleet server up with `--dev` the server will look for installers in the `software-installers-dev` MinIO bucket. You can
+create this bucket via the MinIO web UI (it is *not* created by default when setting up the docker-compose environment).
 
 ## Telemetry
 
diff --git a/docs/Using Fleet/Understanding-host-vitals.md b/docs/Contributing/Understanding-host-vitals.md
similarity index 100%
rename from docs/Using Fleet/Understanding-host-vitals.md
rename to docs/Contributing/Understanding-host-vitals.md
diff --git a/docs/Contributing/Vulnerability-processing.md b/docs/Contributing/Vulnerability-processing.md
index 6f7db26328..7a159bc000 100644
--- a/docs/Contributing/Vulnerability-processing.md
+++ b/docs/Contributing/Vulnerability-processing.md
@@ -35,7 +35,7 @@ be able write a query to retrieve all CVEs).
 - Fleet combines two sources to get accurate and up-to-date CVE information:
   - [National Vulnerability Database](https://nvd.nist.gov/developers/vulnerabilities)'s CVE feeds.
   - [VulnCheck](https://vulncheck.com/)
-- To reduce the load and complexity of processing these datasets, Fleet uses two Github repositories (https://github.com/fleetdm/nvd and https://github.com/fleetdm/vulndb) that fetch, pre-process and expose the resulting dataset as Github releases.
+- To reduce the load and complexity of processing these datasets, Fleet uses two Github repositories (https://github.com/fleetdm/nvd and https://github.com/fleetdm/vulnerabilities) that fetch, pre-process and expose the resulting dataset as Github releases.
 - The Fleet servers then download these Github releases and run vulnerability processing using the downloaded datasets and the software information fetched from hosts.
 
 ```mermaid
@@ -78,16 +78,17 @@ information and what vulnerabilities were patched with the release, we then exam
 macOS apps and if an Office app is found we compare its version with the release notes metadata
 and report back any vulnerabilities to which the software is susceptible.
 
-### Linux hosts
+### Linux hosts (via OVAL)
 
 First, we determine what Linux distributions are part of your fleet (keep in mind that there will
-be a small delay between the time a new Linux hosts is added and the time the host is 'detected'). We then
-use
-that information to determine what OVAL definitions need to be downloaded and parsed - you can find
-a list of all the OVAL definitions we use
-[here](https://github.com/fleetdm/nvd/blob/master/oval_sources.json). OVAL definitions will be
+be a small delay between the time a new Linux host is added and the time the host is "detected"). We then
+use that information to determine what OVAL definitions need to be downloaded and parsed - you can find
+a list of all the OVAL definitions we use [here](https://github.com/fleetdm/nvd/blob/master/oval_sources.json). OVAL definitions will be
 refreshed on a daily basis.
 
+*NOTE:* Amazon Linux 2 is included in the OVAL mapping but vulnerabilities are no longer pulled via that file
+as of 4.56.0 due to false positives (Amazon backports fixes and releases updates independent of RHEL).
+
 Finally, we look at the software inventory of each host and execute the assertions contained in the
 corresponding OVAL file - any match is reported using the same channels as with Windows/Mac OS vulnerabilities
 
@@ -104,6 +105,20 @@ available in the OVAL feed, it uses the NVD feed to look for vulnerabilities mat
 CPE pattern:
 `cpe:2.3:o:linux:linux_kernel:*;*:*:*:*:*:*:*:*`
 
+### Amazon Linux hosts (via goval-dictionary)
+
+Amazon Linux uses [ALAS](https://alas.aws.amazon.com/) rather than OVAL files to provide vulnerability info. The
+[goval-dictionary](https://github.com/vulsio/goval-dictionary) tool supports fetching those bulletins into database
+formats including sqlite. The database contains mappings of CVEs to package releases where that CVE was fixed. We run
+this tool for each Amazon Linux version as part of the release process in https://github.com/fleetdm/vulnerabilities.
+
+As part of the (default hourly) vulnerabilities check run, we download the sqlite files for relevant OS versions (keep in
+mind that there will be a small delay between the time a new Linux host is added and the time the host is "detected"),
+then for each host check if each package on that host is mentioned in the database. For each package found, we report
+a vulnerability when the installed version of the package is older than the version where the vulnerability was fixed.
+
+ALAS does *not* use CPE lookups.
+
 ## Performance
 
 ### Windows/Mac OS
@@ -127,9 +142,9 @@ For example, when running a development instance of Fleet on an Apple Macbook Pr
 The CPU and memory usages are in burst once every hour (or the configured periodicity) on the
 instance that does the processing. RAM spikes are expected to not exceed the 2GBs.
 
-### Linux
+### Linux (OVAL)
 
-As with Windows/Mac OS, vulnerability detection for Linux is performed in a single Fleet instance. The
+As with Windows/Mac OS, vulnerability detection for Linux is performed on a single Fleet server. The
 files downloaded will vary depending on what distributions are on your fleet. The list of all the
 OVAL files we use can be found [here](https://github.com/fleetdm/nvd/blob/master/oval_sources.json).
 
@@ -151,6 +166,19 @@ The performance will be a function of three variables:
 That said, the performance characteristic should be linear (if scanning 200 hosts take
 ~20 seconds, then scanning 2000 hosts should take ~200 seconds).
 
+### Linux (goval-dictionary)
+
+As with OVAL, vulnerability detection for Linux via goval-dictionary is performed on a single Fleet server.
+Fleet will download one xz'd sqlite file per supported (see oval_platform.go -> IsGovalDictionarySupported) OS/version
+combination every time vulnerability scanning is run. OS version identifiers are constructed the same way
+as for OVAL, so Amazon Linux 2 becomes `amzn_02` and Amazon Linux 2023 becomes `amzn_2023`. sqlite databases are
+preprocessed as part of our vulnerabilities feed build, so are used as-is after download/extraction; the largest
+database is currently for Amazon Linux 2, at ~10 MiB. Filename format on disk is
+`fleet_goval_dictionary_platform.sqlite3`, corresponding to `platform.sqlite3` in the `vulnerabilities` repo releases.
+
+Like OVAL, execution time currently scales with the size of the database, the number of hosts to scan, and the number
+of packages installed. Scanning 2000 hosts will take about 10x longer than scanning 200 hosts.
+
 ## Detection pipeline
 
 There are several steps that go into the vulnerability detection process. In this section we'll dive into what they are and how it works.
@@ -184,7 +212,7 @@ The whole pipeline exists to compensate for these differences, and it can be div
       process2-->interval
   ```
 
-  ### Windows/Mac OS
+### Windows/Mac OS
 
   ```mermaid
   graph TD;
@@ -194,7 +222,7 @@ The whole pipeline exists to compensate for these differences, and it can be div
     cveDownload-->cveMap[CVE detection]
   ```
 
-  ### Linux
+### Linux (OVAL)
 
   ```mermaid
   graph TD;
@@ -206,6 +234,14 @@ The whole pipeline exists to compensate for these differences, and it can be div
     parse --> execute
   ```
 
+### Linux (goval-dictionary)
+
+  ```mermaid
+  graph TD;
+    process[Process Linux hosts] --> download(Download vulnerability databases from Fleet)
+    download --> execute(Match vulnerabilities to software older than fixed versions)
+  ```
+
 ### Ingesting software lists from hosts
 
 The ingestion of software varies per platform. We run a `UNION` of several queries in each:
diff --git a/docs/Contributing/fleetctl-apply.md b/docs/Contributing/fleetctl-apply.md
index a502a1f516..dac4b25630 100644
--- a/docs/Contributing/fleetctl-apply.md
+++ b/docs/Contributing/fleetctl-apply.md
@@ -338,7 +338,8 @@ List of saved scripts that can be run on hosts that are part of the team.
 
 - Default value: none
 - Config file format:
-  ```yaml
+
+```yaml
 apiVersion: v1
 kind: team
 spec:
@@ -347,7 +348,7 @@ spec:
     scripts:
       - path/to/script1.sh
       - path/to/script2.sh
-  ```
+```
 
 ## Organization settings
 
diff --git a/docs/Deploy/Reference-Architectures.md b/docs/Deploy/Reference-Architectures.md
index 06a7d8dd5a..eecc179c36 100644
--- a/docs/Deploy/Reference-Architectures.md
+++ b/docs/Deploy/Reference-Architectures.md
@@ -2,10 +2,10 @@
 
 ## The Fleet binary
 
-The Fleet application contains two single static binaries which provide web based administration, REST API, and CLI interface to Fleet.
+The Fleet application contains two single static binaries which provide web based administration, a REST API, and a [CLI interface](https://fleetdm.com/guides/fleetctl).
 
 The `fleet` binary contains:
-- The Fleet TLS web server (no external webserver is required but it supports a proxy if desired)
+- The [Fleet TLS web server](https://fleetdm.com/docs/configuration/fleet-server-configuration) (no external webserver is required but it supports a proxy if desired)
 - The Fleet web interface
 - The Fleet application management [REST API](https://fleetdm.com/docs/using-fleet/rest-api)
 - The Fleet osquery API endpoints
@@ -24,15 +24,15 @@ Fleet currently has three infrastructure dependencies: MySQL, Redis, and a TLS c
 ### MySQL
 
 Fleet uses MySQL extensively as its main database. Many cloud providers (such as [AWS](https://aws.amazon.com/rds/mysql/) and [GCP](https://cloud.google.com/sql/)) host reliable MySQL services which you may consider for this purpose. A well-supported MySQL [Docker image](https://hub.docker.com/_/mysql/) also exists if you would rather run MySQL in a container. 
-For more information on how to configure the `fleet` binary to use the correct MySQL instance, see the [Configuration](https://fleetdm.com/docs/deploying/configuration) document.
+For more information on how to configure the `fleet` binary to use the correct MySQL instance, see the [MySQL configuration](https://fleetdm.com/docs/configuration/fleet-server-configuration#mysql) documentation.
 
-Fleet requires at least MySQL version 8.0, and is tested using the InnoDB storage engine. 
+Fleet requires at least MySQL version 8.0.36, and is tested using the InnoDB storage engine [with versions 8.0.36 and 8.4.2](https://github.com/fleetdm/fleet/blob/main/.github/workflows/test-go.yaml#L47).
 
 There are many "drop-in replacements" for MySQL available. If you'd like to experiment with some bleeding-edge technology and use Fleet with one of these alternative database servers, we think that's awesome! Please be aware they are not officially supported and that it is very important to set up a dev environment to thoroughly test new releases. 
 
 ### Redis
 
-Fleet uses Redis to ingest and queue the results of distributed queries, cache data, etc. Many cloud providers (such as [AWS](https://aws.amazon.com/elasticache/) and [GCP](https://console.cloud.google.com/launcher/details/click-to-deploy-images/redis)) host reliable Redis services which you may consider for this purpose. A well supported Redis [Docker image](https://hub.docker.com/_/redis/) also exists if you would rather run Redis in a container. For more information on how to configure the `fleet` binary to use the correct Redis instance, see the [Configuration](https://fleetdm.com/docs/deploying/configuration) document.
+Fleet uses Redis to ingest and queue the results of distributed queries, cache data, etc. Many cloud providers (such as [AWS](https://aws.amazon.com/elasticache/) and [GCP](https://console.cloud.google.com/launcher/details/click-to-deploy-images/redis)) host reliable Redis services which you may consider for this purpose. A well supported Redis [Docker image](https://hub.docker.com/_/redis/) also exists if you would rather run Redis in a container. For more information on how to configure the `fleet` binary to use the correct Redis instance, see the [Redis configuration](https://fleetdm.com/docs/configuration/fleet-server-configuration#redis) documentation.
 
 ## Systemd
 
@@ -150,7 +150,7 @@ In some cases adding a read replica can increase database performance for specif
 
 #### Traffic load balancing
 Load balancing enables distributing request traffic over many instances of the backend application. Using AWS Application
-Load Balancer can also [offload SSL termination](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/create-https-listener.html), freeing Fleet to spend the majority of it's allocated compute dedicated 
+Load Balancer can also [offload SSL termination](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/create-https-listener.html), freeing Fleet to spend the majority of its allocated compute dedicated 
 to its core functionality. More details about ALB can be found [here](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/introduction.html).
 
 _**Note if using [terraform reference architecture](https://github.com/fleetdm/fleet/tree/main/infrastructure/dogfood/terraform/aws#terraform) all configurations can dynamically scale based on load(cpu/memory) and all configurations
@@ -167,10 +167,11 @@ assume On-Demand pricing (savings are available through Reserved Instances). Cal
 | --------------- | ------------- | --- |
 | 1 Fargate task  | 512 CPU Units | 4GB |
 
-| Dependencies | Version                 | Instance type | Nodes |
-| ------------ | ----------------------- | ------------- | ----- |
-| Redis        | 6                       | t4g.small     | 3     |
-| MySQL        | 8.0.mysql_aurora.3.04.2 | db.t4g.medium | 2     |
+| Dependencies | Version                 | Instance type   | Nodes |
+| ------------ | ----------------------- | --------------- | ----- |
+| Redis        | 6                       | cache.t4g.small | 3     |
+| MySQL        | 8.0.mysql_aurora.3.04.2 | db.t4g.medium   | 2     |
+
 
 ###### [Up to 25000 hosts](https://calculator.aws/#/estimate?id=d735758715f059118dbce8dc42f3ff2410adc621)
 
@@ -178,10 +179,10 @@ assume On-Demand pricing (savings are available through Reserved Instances). Cal
 | --------------- | -------------- | --- |
 | 10 Fargate task | 1024 CPU Units | 4GB |
 
-| Dependencies | Version                 | Instance type | Nodes |
-| ------------ | ----------------------- | ------------- | ----- |
-| Redis        | 6                       | m6g.large     | 3     |
-| MySQL        | 8.0.mysql_aurora.3.04.2 | db.r6g.large  | 2     |
+| Dependencies | Version                 | Instance type   | Nodes |
+| ------------ | ----------------------- | --------------- | ----- |
+| Redis        | 6                       | cache.m6g.large | 3     |
+| MySQL        | 8.0.mysql_aurora.3.04.2 | db.r6g.large    | 2     |
 
 
 ###### [Up to 150000 hosts](https://calculator.aws/#/estimate?id=689fea65efff361ee070b15044a01224b8d26621)
@@ -190,10 +191,11 @@ assume On-Demand pricing (savings are available through Reserved Instances). Cal
 | --------------- | -------------- | --- |
 | 20 Fargate task | 1024 CPU Units | 4GB |
 
-| Dependencies | Version                 | Instance type  | Nodes |
-| ------------ | ----------------------- | -------------- | ----- |
-| Redis        | 6                       | m6g.large      | 3     |
-| MySQL        | 8.0.mysql_aurora.3.04.2 | db.r6g.4xlarge | 2     |
+| Dependencies | Version                 | Instance type   | Nodes |
+| ------------ | ----------------------- | --------------- | ----- |
+| Redis        | 6                       | cache.m6g.large | 3     |
+| MySQL        | 8.0.mysql_aurora.3.04.2 | db.r6g.4xlarge  | 2     |
+
 
 ###### [Up to 300000 hosts](https://calculator.aws/#/estimate?id=19b667fde567df0d64d9fae632d4885d7fdc726a)
 
@@ -203,7 +205,7 @@ assume On-Demand pricing (savings are available through Reserved Instances). Cal
 
 | Dependencies | Version                 | Instance type   | Nodes |
 | ------------ | ----------------------- | --------------- | ----- |
-| Redis        | 6                       | m6g.large       | 3     |
+| Redis        | 6                       | cache.m6g.large | 3     |
 | MySQL        | 8.0.mysql_aurora.3.04.2 | db.r6g.16xlarge | 2     |
 
 AWS reference architecture can be found [here](https://github.com/fleetdm/fleet/tree/main/terraform/example). This configuration includes:
diff --git a/docs/Deploy/deploy-fleet.md b/docs/Deploy/deploy-fleet.md
index c0e80f4b2e..5f1355b80b 100644
--- a/docs/Deploy/deploy-fleet.md
+++ b/docs/Deploy/deploy-fleet.md
@@ -43,11 +43,11 @@ Render is a cloud hosting service that makes it easy to get up and running fast,
     </a>
 </div>
 
-1. Click "Deploy to Render" to open the Fleet Blueprint on Render. You will be prompted to create or log in to your Render account with associated payment information.
+1. Click "Deploy to Render" to open the Fleet Blueprint on Render. Ensure that the Redis instance is manually set to the same region as your other resources. You will be prompted to create or log in to your Render account with associated payment information.
 
 2. Give the Blueprint a unique name like `yourcompany-fleet`.
 
-3. Click "**Apply.**" Render will provision your services, which should take less than five minutes. 
+3. Click "**Deploy Blueprint.**" Render will provision your services, which should take less than five minutes. 
 
 4. Click the "**Dashboard**" tab in Render when provisioning is complete to see your new services. 
 
diff --git a/docs/Get started/FAQ.md b/docs/Get started/FAQ.md
index fdcd1ab596..6e4fb060f4 100644
--- a/docs/Get started/FAQ.md	
+++ b/docs/Get started/FAQ.md	
@@ -45,6 +45,60 @@ When you collect data with Fleet, the [performance impact](https://fleetdm.com/r
 
 You can test changes on a small subset of hosts first, then roll them out to the rest of your organization.
 
+## What browsers does Fleet supported?
+
+Fleet supports the latest, stable releases of all major browsers and platforms.
+
+We test each browser on Windows whenever possible, because our engineering team primarily uses macOS.
+
+**Note:** This information also applies to [fleetdm.com](https://www.fleetdm.com).
+
+### Desktop
+
+- Chrome
+- Firefox
+- Edge
+- Safari (macOS only)
+
+### Mobile
+
+- Mobile Safari on iOS
+- Mobile Chrome on Android
+
+### Note
+> - Mobile web is not yet supported in the Fleet product.
+> - The Fleet user interface [may not be fully supported](https://github.com/fleetdm/fleet/issues/969) in Google Chrome when the browser is running on ChromeOS.
+
+## What host operating systems does Fleet support?
+
+Fleet supports the following operating system versions on hosts. 
+
+| OS      | Supported version(s)                    |
+| :------ | :-------------------------------------  |
+| macOS   | 13+ (Ventura)                           |
+| Windows | Pro and Enterprise 10+, Server 2012+    |
+| Linux   | CentOS 7.1+,  Ubuntu 20.04+, Fedora 38+ |
+| ChromeOS | 112.0.5615.134+                        |
+
+While Fleet may still function partially or fully with OS versions older than those above, Fleet does not actively test against unsupported versions and does not pursue bugs on them. 
+
+## Some notes on compatibility
+
+### Tables
+Not all osquery tables are available for every OS. Please check out the [osquery schema](https://fleetdm.com/tables) for detailed information. 
+
+If a table is not available for your host, Fleet will generally handle things behind the scenes for you.
+
+### Linux
+
+Fleet Desktop is supported on Ubuntu and Fedora. 
+
+Fedora requires a [gnome extension](https://extensions.gnome.org/extension/615/appindicator-support/) and Google Chrome for Fleet Desktop.
+
+On Ubuntu, Fleet Desktop currently supports Xorg as X11 server, Wayland is currently not supported. Ubuntu 24.04 comes with Wayland enabled by default. To use X11 instead of Wayland you can set `WaylandEnable=false` in `/etc/gdm3/custom.conf` and reboot.
+
+The `fleetctl package` command is not supported on DISA-STIG distribution.
+
 ## Is Fleet MIT licensed?
 
 Different portions of the Fleet software are licensed differently, as noted in the [LICENSE](https://github.com/fleetdm/fleet/blob/main/LICENSE) file. The majority of Fleet is MIT licensed. Paid features require a license key.
@@ -71,7 +125,7 @@ Different portions of the Fleet software are licensed differently, as noted in t
 
 ## How do I contact Fleet for support?
 
-A lot of questions can be answered [in the documentation](https://fleetdm.com/docs).
+A lot of questions can be answered [in the documentation](https://fleetdm.com/docs) or [guides](https://fleetdm.com/guides).
 
 To get help from the community, visit https://fleetdm.com/support.
 
@@ -614,7 +668,7 @@ Yes! Please sign up for the [Fleet Cloud Beta](https://kqphpqst851.typeform.com/
 
 ### What MySQL versions are supported?
 
-Fleet is tested with MySQL 8.0.36. Newer versions of MySQL 8 typically work well. AWS Aurora requires at least version 2.10.0. Please avoid using MariaDB or other MySQL variants that are not officially supported. Compatibility issues have been identified with MySQL variants, and these may not be addressed in future Fleet releases.
+Fleet is tested with MySQL 8.0.36 and 8.4.2. Newer versions of MySQL 8 typically work well. AWS Aurora requires at least version 3.07.0. Please avoid using MariaDB or other MySQL variants that are not officially supported. Compatibility issues have been identified with MySQL variants, and these may not be addressed in future Fleet releases.
 
 ### What are the MySQL user requirements?
 
@@ -677,7 +731,7 @@ If you would like to use Fleet's MDM features, the following endpoints need to b
 
 ### What is the minimum version of MySQL required by Fleet?
 
-Fleet requires at least MySQL version 8.0.
+Fleet requires at least MySQL version 8.0.36, and is tested [with versions 8.0.36 and 8.4.2](https://github.com/fleetdm/fleet/blob/main/.github/workflows/test-go.yaml#L47)
 
 ### How do I migrate from Fleet Free to Fleet Premium?
 
diff --git a/docs/Get started/tutorials-and-guides.md b/docs/Get started/tutorials-and-guides.md
index 0b1584f6a3..f83de79f27 100644
--- a/docs/Get started/tutorials-and-guides.md	
+++ b/docs/Get started/tutorials-and-guides.md	
@@ -1,71 +1,29 @@
 # Tutorials and guides
 
-A collection of guides to help you get up and running with Fleet.
+A collection of guides to help you with Fleet.
 
-## Deployment guides
-
-- [Deploy Fleet on Render](http://fleetdm.com/deploy/deploying-fleet-on-render)
-
-- [Deploy Fleet on AWS](http://fleetdm.com/deploy/deploying-fleet-on-aws-with-terraform)
-
-- [Deploy Fleet on Hetzner Cloud](http://fleetdm.com/deploy/deploy-fleet-on-hetzner-cloud)
-
-- [Deploy Fleet on AWS ECS](https://fleetdm.com/docs/deploy/deploy-fleet-on-aws-ecs)
-
-- [Deploy Fleet on CentOS](https://fleetdm.com/docs/deploy/deploy-fleet-on-centos)
-
-- [Deploy Fleet on Cloud.gov](https://fleetdm.com/docs/deploy/cloudgov)
-
-- [Deploy Fleet on Kubernetes](https://fleetdm.com/docs/deploy/deploy-fleet-on-kubernetes)
-
-## How-to guides
-
-- [Querying process_file_events on CentOS 7](https://fleetdm.com/guides/querying-process-file-events-table-on-centos-7)
-
-- [Using GitHub Actions to apply configuration profiles with Fleet](https://fleetdm.com/guides/using-github-actions-to-apply-configuration-profiles-with-fleet)
-
-- [Building an effective dashboard with Fleet's REST API, Flask, and Plotly: A step-by-step guide](https://fleetdm.com/guides/building-an-effective-dashboard-with-fleet-rest-api-flask-and-plotly)
-
-- [Discovering Geacon using Fleet](https://fleetdm.com/guides/discovering-geacon-using-fleet)
-
-- [Using Fleet and Okta Workflows to generate a daily OS report](https://fleetdm.com/guides/using-fleet-and-okta-workflows-to-generate-a-daily-os-report)
-
-- [Using Fleet and Tines together](https://fleetdm.com/guides/using-fleet-and-tines-together)
-
-- [How to use Fleet for zero trust attestation](https://fleetdm.com/guides/zero-trust-attestation-with-fleet)
-
-- [How to use osquery evented tables](https://fleetdm.com/guides/osquery-evented-tables-overview)
-
-- [Enrolling a DigitalOcean Droplet on a Fleet instance](https://fleetdm.com/guides/enrolling-a-digital-ocean-droplet-on-a-fleet-instance)
-
-- [Osquery: a tool to easily ask questions about operating systems](https://fleetdm.com/guides/osquery-a-tool-to-easily-ask-questions-about-operating-systems)
-
-- [How to install osquery and enroll Linux devices into Fleet](https://fleetdm.com/guides/how-to-install-osquery-and-enroll-linux-devices-into-fleet)
-
-- [How to install osquery and enroll Windows devices into Fleet](https://fleetdm.com/guides/how-to-install-osquery-and-enroll-windows-devices-into-fleet)
-
-- [Delivering data to Snowflake from Fleet and osquery.](https://fleetdm.com/guides/delivering-data-to-snowflake-from-fleet-and-osquery)
-
-- [How to install osquery and enroll macOS devices into Fleet](https://fleetdm.com/guides/how-to-install-osquery-and-enroll-macos-devices-into-fleet)
-
-- [How to uninstall osquery](https://fleetdm.com/guides/how-to-uninstall-osquery)
-
-- [Converting unix timestamps with osquery](https://fleetdm.com/guides/converting-unix-timestamps-with-osquery)
-
-- [Correlate network connections with community ID in osquery.](https://fleetdm.com/guides/correlate-network-connections-with-community-id-in-osquery)
-
-- [Using Elasticsearch and Kibana to visualize osquery performance](https://fleetdm.com/guides/using-elasticsearch-and-kibana-to-visualize-osquery-performance)
-
-- [Fleet quick tips — identify systems where the ProcDump EULA has been accepted](https://fleetdm.com/guides/fleet-quick-tips-querying-procdump-eula-has-been-accepted)
-
-- [Locate device assets in the event of an emergency.](https://fleetdm.com/guides/locate-assets-with-osquery)
-
-- [Osquery: Consider joining against the users table](https://fleetdm.com/guides/osquery-consider-joining-against-the-users-table)
-
-- [Import and export queries in Fleet](https://fleetdm.com/guides/import-and-export-queries-in-fleet)
-
-- [Generate process trees with osquery](https://fleetdm.com/guides/generate-process-trees-with-osquery)
+- [How to install osquery and enroll macOS devices into Fleet](https://fleetdm.com/guides/how-to-install-osquery-and-enroll-macos-devices-into-fleet)  
+- [How to install osquery and enroll Linux devices into Fleet](https://fleetdm.com/guides/how-to-install-osquery-and-enroll-linux-devices-into-fleet)  
+- [How to install osquery and enroll Windows devices into Fleet](https://fleetdm.com/guides/how-to-install-osquery-and-enroll-windows-devices-into-fleet)  
+- [Sysadmin diaries: restoring fleetd](https://fleetdm.com/guides/sysadmin-diaries-restoring-fleetd)  
+- [How to uninstall osquery](https://fleetdm.com/guides/how-to-uninstall-osquery)  
+- [Sysadmin diaries: device enrollment](https://fleetdm.com/guides/sysadmin-diaries-device-enrollment)  
+- [Sysadmin diaries: passcode profiles](https://fleetdm.com/guides/sysadmin-diaries-passcode-profiles)  
+- [Sysadmin diaries: lost device](https://fleetdm.com/guides/sysadmin-diaries-lost-device)  
+- [Windows MDM setup](https://fleetdm.com/guides/windows-mdm-setup)  
+- [Using GitHub Actions to apply configuration profiles with Fleet](https://fleetdm.com/guides/using-github-actions-to-apply-configuration-profiles-with-fleet)  
+- [Managing labels in Fleet](https://fleetdm.com/guides/managing-labels-in-fleet)  
+- [What are Fleet policies?](https://fleetdm.com/securing/what-are-fleet-policies)  
+- [Understanding the intricacies of Fleet policies](https://fleetdm.com/guides/understanding-the-intricacies-of-fleet-policies)  
+- [Sysadmin diaries: exporting policies](https://fleetdm.com/guides/sysadmin-diaries-exporting-policies)  
+- [Locate device assets in the event of an emergency](https://fleetdm.com/guides/locate-assets-with-osquery)  
+- [Osquery: Consider joining against the users table](https://fleetdm.com/guides/osquery-consider-joining-against-the-users-table)  
+- [Using Fleet and Okta Workflows to generate a daily OS report](https://fleetdm.com/guides/using-fleet-and-okta-workflows-to-generate-a-daily-os-report)  
+- [How to configure logging destinations](https://fleetdm.com/guides/how-to-configure-logging-destinations)  
+- [Import and export queries in Fleet](https://fleetdm.com/guides/import-and-export-queries-in-fleet)  
+- [Certificates in fleetd](https://fleetdm.com/guides/certificates-in-fleetd)
 
+<a style="text-decoration: none;" href="https://fleetdm.com/guides"><animated-arrow-button>See all guides</animated-arrow-button></a>
 
 <meta name="description" value="Links to deployment tutorials and guides for using Fleet.">
 <meta name="pageOrderInSection" value="300">
diff --git a/docs/REST API/rest-api.md b/docs/REST API/rest-api.md
index e07c86e33f..d7b8b8f172 100644
--- a/docs/REST API/rest-api.md	
+++ b/docs/REST API/rest-api.md	
@@ -484,6 +484,22 @@ for pagination. For a comprehensive list of activity types and detailed informat
 ```json
 {
   "activities": [
+    {
+      "created_at": "2023-07-27T14:35:08Z",
+      "id": 25,
+      "actor_full_name": "Anna Chao",
+      "actor_id": 3,
+      "actor_gravatar": "",
+      "actor_email": "",
+      "type": "uninstalled_software",
+      "details": {
+        "host_id": 1,
+        "host_display_name": "Marko's MacBook Pro",
+        "software_title": "Adobe Acrobat.app",
+        "script_execution_id": "eeeddb94-52d3-4071-8b18-7322cd382abb",
+        "status": "failed"
+      }
+    },
     {
       "created_at": "2021-07-30T13:41:07Z",
       "id": 24,
@@ -878,15 +894,20 @@ None.
     "additional_queries": null
   },
   "mdm": {
-    "apple_bm_default_team": "",
-    "apple_bm_terms_expired": false,
-    "enabled_and_configured": true,
     "windows_enabled_and_configured": true,
     "enable_disk_encryption": true,
     "macos_updates": {
       "minimum_version": "12.3.1",
       "deadline": "2022-01-01"
     },
+    "ios_updates": {
+      "minimum_version": "17.0.1",
+      "deadline": "2024-08-01"
+    },
+    "ipados_updates": {
+      "minimum_version": "17.0.1",
+      "deadline": "2024-08-01"
+    },
     "windows_updates": {
       "deadline_days": 5,
       "grace_period_days": 1
@@ -1068,23 +1089,23 @@ Modifies the Fleet's configuration with the supplied information.
 
 #### Parameters
 
-| Name                              | Type    | In    | Description   |
-| ---------------------             | ------- | ----  | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| org_info          | object  | body  | See [org_info](#org-info). |
-| server_settings         | object  | body    | See [server_settings](#server-settings). |
-| smtp_settings         | object  | body    | See [smtp_settings](#smtp-settings). |
-| sso_settings         | object  | body    | See [sso_settings](#sso-settings). |
-| host_expiry_settings         | object  | body    | See [host_expiry_settings](#host-expiry-settings). |
-| activity_expiry_settings         | object  | body    | See [activity_expiry_settings](#activity-expiry-settings). |
-| agent_options                     | objects | body  | The agent_options spec that is applied to all hosts. In Fleet 4.0.0 the `api/v1/fleet/spec/osquery_options` endpoints were removed.                                                    |
-| fleet_desktop         | object  | body    | See [fleet_desktop](#fleet-desktop). |
-| webhook_settings      | object  | body    | See [webhook_settings](#webhook-settings). |
-| integrations                      | object  | body  | Includes `jira`, `zendesk`, and `google_calendar` arrays. See [integrations](#integrations) for details. |
-| mdm      | object  | body    | See [mdm](#mdm). |
-| features          | object  | body    | See [features](#features). |
-| scripts                           | list    | body  | A list of script files to add so they can be executed at a later time.                                                                                                                                                 |
-| force                             | boolean | query | Whether to force-apply the agent options even if there are validation errors.                                                                                                 |
-| dry_run                           | boolean | query | Whether to validate the configuration and return any validation errors **without** applying changes.                                                                         |
+| Name                     | Type    | In    | Description   |
+| -----------------------  | ------- | ----  | ------------------------------------------------------------------------------------------------------------------------------------ |
+| org_info                 | object  | body  | See [org_info](#org-info).                                                                                                           |
+| server_settings          | object  | body  | See [server_settings](#server-settings).                                                                                             |
+| smtp_settings            | object  | body  | See [smtp_settings](#smtp-settings).                                                                                                 |
+| sso_settings             | object  | body  | See [sso_settings](#sso-settings).                                                                                                   |
+| host_expiry_settings     | object  | body  | See [host_expiry_settings](#host-expiry-settings).                                                                                   |
+| activity_expiry_settings | object  | body  | See [activity_expiry_settings](#activity-expiry-settings).                                                                           |
+| agent_options            | objects | body  | The agent_options spec that is applied to all hosts. In Fleet 4.0.0 the `api/v1/fleet/spec/osquery_options` endpoints were removed.  |
+| fleet_desktop            | object  | body  | See [fleet_desktop](#fleet-desktop).                                                                                                 |
+| webhook_settings         | object  | body  | See [webhook_settings](#webhook-settings).                                                                                           |
+| integrations             | object  | body  | Includes `jira`, `zendesk`, and `google_calendar` arrays. See [integrations](#integrations) for details.                             |
+| mdm                      | object  | body  | See [mdm](#mdm).                                                                                                                     |
+| features                 | object  | body  | See [features](#features).                                                                                                           |
+| scripts                  | array   | body  | A list of script files to add so they can be executed at a later time.                                                               |
+| force                    | boolean | query | Whether to force-apply the agent options even if there are validation errors.                                                        |
+| dry_run                  | boolean | query | Whether to validate the configuration and return any validation errors **without** applying changes.                                 |
 
 
 #### Example
@@ -1162,9 +1183,6 @@ Modifies the Fleet's configuration with the supplied information.
     "expiration": "0001-01-01T00:00:00Z"
   },
   "mdm": {
-    "apple_bm_default_team": "",
-    "apple_bm_terms_expired": false,
-    "apple_bm_enabled_and_configured": false,
     "enabled_and_configured": false,
     "windows_enabled_and_configured": false,
     "enable_disk_encryption": true,
@@ -1172,6 +1190,14 @@ Modifies the Fleet's configuration with the supplied information.
       "minimum_version": "12.3.1",
       "deadline": "2022-01-01"
     },
+    "ios_updates": {
+      "minimum_version": "17.0.1",
+      "deadline": "2024-08-01"
+    },
+    "ipados_updates": {
+      "minimum_version": "17.0.1",
+      "deadline": "2024-08-01"
+    },
     "windows_updates": {
       "deadline_days": 5,
       "grace_period_days": 1
@@ -1310,11 +1336,11 @@ Modifies the Fleet's configuration with the supplied information.
 #### org_info
 
 | Name                              | Type    | Description   |
-| ---------------------             | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| org_name                          | string  | The organization name.                                                                                                                                     |
-| org_logo_url                      | string  | The URL for the organization logo.                                                                                                                         |
-| org_logo_url_light_background     | string  | The URL for the organization logo displayed in Fleet on top of light backgrounds.                                                                          |
-| contact_url                       | string  | A URL that can be used by end users to contact the organization.                                                                                          |
+| ---------------------             | ------- | ----------------------------------------------------------------------------------- |
+| org_name                          | string  | The organization name.                                                              |
+| org_logo_url                      | string  | The URL for the organization logo.                                                  |
+| org_logo_url_light_background     | string  | The URL for the organization logo displayed in Fleet on top of light backgrounds.   |
+| contact_url                       | string  | A URL that can be used by end users to contact the organization.                    |
 
 <br/>
 
@@ -1334,12 +1360,12 @@ Modifies the Fleet's configuration with the supplied information.
 #### server_settings
 
 | Name                              | Type    | Description   |
-| ---------------------             | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| server_url                        | string  | The Fleet server URL.                                                       |
-| enable_analytics                  | boolean | Whether to send anonymous usage statistics. Always enabled for Fleet Premium customers.                                                                             |
-| live_query_disabled               | boolean | Whether the live query capabilities are disabled.                                                                                                                   |
-| query_reports_disabled            | boolean | Whether query report capabilities are disabled.                                                                                                                   |
-| ai_features_disabled              | boolean | Whether AI features are disabled. |
+| ---------------------             | ------- | ------------------------------------------------------------------------------------------- |
+| server_url                        | string  | The Fleet server URL.                                                                       |
+| enable_analytics                  | boolean | Whether to send anonymous usage statistics. Always enabled for Fleet Premium customers.     |
+| live_query_disabled               | boolean | Whether the live query capabilities are disabled.                                           |
+| query_reports_disabled            | boolean | Whether query report capabilities are disabled.                                             |
+| ai_features_disabled              | boolean | Whether AI features are disabled.                                                           |
 | query_report_cap                  | integer | The maximum number of results to store per query report before the report is clipped. If increasing this cap, we recommend enabling reports for one query at time and monitoring your infrastructure. (Default: `1000`) |
 
 <br/>
@@ -1361,7 +1387,7 @@ Modifies the Fleet's configuration with the supplied information.
 #### smtp_settings
 
 | Name                              | Type    | Description   |
-| ---------------------             | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| ---------------------             | ------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | enable_smtp                       | boolean | Whether SMTP is enabled for the Fleet app.                                                                                                                            |
 | sender_address                    | string  | The sender email address for the Fleet app. An invitation email is an example of the emails that may use this sender address                                          |
 | server                            | string  | The SMTP server for the Fleet app.                                                                                                                                    |
@@ -1401,13 +1427,13 @@ Modifies the Fleet's configuration with the supplied information.
 #### sso_settings
 
 | Name                              | Type    | Description   |
-| ---------------------             | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| ---------------------             | ------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | enable_sso                        | boolean | Whether or not SSO is enabled for the Fleet application. If this value is true, you must also include most of the SSO settings parameters below.                       |
-| entity_id                         | string  | The required entity ID is a URI that you use to identify Fleet when configuring the identity provider.                                                                 |
+| entity_id                         | string  | The required entity ID is a URI that you use to identify Fleet when configuring the identity provider. Must be 5 or more characters.                                   |
 | issuer_uri                        | string  | The URI you provide here must exactly match the Entity ID field used in the identity provider configuration.                                                           |
 | idp_image_url                     | string  | An optional link to an image such as a logo for the identity provider.                                                                                                 |
-| metadata_url                      | string  | A URL that references the identity provider metadata. If available from the identity provider, this is the preferred means of providing metadata.                      |
-| metadata                            | string  |  Metadata provided by the identity provider. Either `metadata` or a `metadata_url` must be provided. |
+| metadata_url                      | string  | A URL that references the identity provider metadata. If available from the identity provider, this is the preferred means of providing metadata. Must be either https or http |
+| metadata                          | string  |  Metadata provided by the identity provider. Either `metadata` or a `metadata_url` must be provided.                                                                   |
 | enable_sso_idp_login              | boolean | Determines whether Identity Provider (IdP) initiated login for Single sign-on (SSO) is enabled for the Fleet application.                                              |
 | enable_jit_provisioning           | boolean | _Available in Fleet Premium._ When enabled, allows [just-in-time user provisioning](https://fleetdm.com/docs/deploy/single-sign-on-sso#just-in-time-jit-user-provisioning). |
 
@@ -1434,9 +1460,9 @@ Modifies the Fleet's configuration with the supplied information.
 #### host_expiry_settings
 
 | Name                              | Type    | Description   |
-| ---------------------             | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| ---------------------             | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | host_expiry_enabled               | boolean | When enabled, allows automatic cleanup of hosts that have not communicated with Fleet in some number of days.                                                  |
-| host_expiry_window                | integer | If a host has not communicated with Fleet in the specified number of days, it will be removed.                                                                 |
+| host_expiry_window                | integer | If a host has not communicated with Fleet in the specified number of days, it will be removed. Must be greater than 0 if host_expiry_enabled is set to true.   |
 
 <br/>
 
@@ -1454,9 +1480,9 @@ Modifies the Fleet's configuration with the supplied information.
 #### activity_expiry_settings
 
 | Name                              | Type    | Description   |
-| ---------------------             | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| activity_expiry_enabled           | boolean | When enabled, allows automatic cleanup of activities (and associated live query data) older than the specified number of days.                                                          |
-| activity_expiry_window            | integer | The number of days to retain activity records, if activity expiry is enabled.   |
+| ---------------------             | ------- | --------------------------------------------------------------------------------------------------------------------------------- |
+| activity_expiry_enabled           | boolean | When enabled, allows automatic cleanup of activities (and associated live query data) older than the specified number of days.    |
+| activity_expiry_window            | integer | The number of days to retain activity records, if activity expiry is enabled.                                                     |
 
 <br/>
 
@@ -1476,8 +1502,8 @@ Modifies the Fleet's configuration with the supplied information.
 _Available in Fleet Premium._
 
 | Name                              | Type    | Description   |
-| ---------------------             | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| transparency_url                  | string  | The URL used to display transparency information to users of Fleet Desktop.                                                      |
+| ---------------------             | ------- | -------------------------------------------------------------------------------- |
+| transparency_url                  | string  | The URL used to display transparency information to users of Fleet Desktop.      |
 
 <br/>
 
@@ -1500,12 +1526,12 @@ _Available in Fleet Premium._
 + [`webhook_settings.activities_webhook`](#webhook-settings-activities-webhook)
 -->
 
-| Name                              | Type    | Description   |
-| ---------------------             | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| host_status_webhook             | list  | See [`webhook_settings.host_status_webhook`](#webhook-settings-host-status-webhook). |
-| failing_policies_webhook             | list  | See [`webhook_settings.failing_policies_webhook`](#webhook-settings-failing-policies-webhook). |
-| vulnerabilities_webhook             | list  | See [`webhook_settings.vulnerabilities_webhook`](#webhook-settings-vulnerabilities-webhook). |
-| activities_webhook             | list  | See [`webhook_settings.activities_webhook`](#webhook-settings-activities-webhook). |
+| Name                              | Type  | Description   |
+| ---------------------             | ----- | ---------------------------------------------------------------------------------------------- |
+| host_status_webhook               | array | See [`webhook_settings.host_status_webhook`](#webhook-settings-host-status-webhook).           |
+| failing_policies_webhook          | array | See [`webhook_settings.failing_policies_webhook`](#webhook-settings-failing-policies-webhook). |
+| vulnerabilities_webhook           | array | See [`webhook_settings.vulnerabilities_webhook`](#webhook-settings-vulnerabilities-webhook).   |
+| activities_webhook                | array | See [`webhook_settings.activities_webhook`](#webhook-settings-activities-webhook).             |
 
 <br/>
 
@@ -1514,11 +1540,11 @@ _Available in Fleet Premium._
 `webhook_settings.host_status_webhook` is an object with the following structure:
 
 | Name                              | Type    | Description   |
-| ---------------------             | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| enable_host_status_webhook        | boolean | Whether or not the host status webhook is enabled.                                                                 |
-| destination_url                   | string  | The URL to deliver the webhook request to.                                                     |
-| host_percentage                   | integer | The minimum percentage of hosts that must fail to check in to Fleet in order to trigger the webhook request.                                                              |
-| days_count                        | integer | The minimum number of days that the configured `host_percentage` must fail to check in to Fleet in order to trigger the webhook request.                                |
+| ---------------------             | ------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
+| enable_host_status_webhook        | boolean | Whether or not the host status webhook is enabled.                                                                                          |
+| destination_url                   | string  | The URL to deliver the webhook request to.                                                                                                  |
+| host_percentage                   | integer | The minimum percentage of hosts that must fail to check in to Fleet in order to trigger the webhook request.                                |
+| days_count                        | integer | The minimum number of days that the configured `host_percentage` must fail to check in to Fleet in order to trigger the webhook request.    |
 
 <br/>
 
@@ -1527,9 +1553,9 @@ _Available in Fleet Premium._
 `webhook_settings.failing_policies_webhook` is an object with the following structure:
 
 | Name                              | Type    | Description   |
-| ---------------------             | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| enable_failing_policies_webhook   | boolean | Whether or not the failing policies webhook is enabled. |
-| destination_url                   | string  | The URL to deliver the webhook requests to.                                                     |
+| ---------------------             | ------- | ------------------------------------------------------------------------------------------------------------------- |
+| enable_failing_policies_webhook   | boolean | Whether or not the failing policies webhook is enabled.                                                             |
+| destination_url                   | string  | The URL to deliver the webhook requests to.                                                                         |
 | policy_ids                        | array   | List of policy IDs to enable failing policies webhook.                                                              |
 | host_batch_size                   | integer | Maximum number of hosts to batch on failing policy webhook requests. The default, 0, means no batching (all hosts failing a policy are sent on one request). |
 
@@ -1540,9 +1566,9 @@ _Available in Fleet Premium._
 `webhook_settings.vulnerabilities_webhook` is an object with the following structure:
 
 | Name                              | Type    | Description   |
-| ---------------------             | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| enable_vulnerabilities_webhook    | boolean | Whether or not the vulnerabilities webhook is enabled. |
-| destination_url                   | string  | The URL to deliver the webhook requests to.                                                     |
+| ---------------------             | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| enable_vulnerabilities_webhook    | boolean | Whether or not the vulnerabilities webhook is enabled.                                                                                                  |
+| destination_url                   | string  | The URL to deliver the webhook requests to.                                                                                                             |
 | host_batch_size                   | integer | Maximum number of hosts to batch on vulnerabilities webhook requests. The default, 0, means no batching (all vulnerable hosts are sent on one request). |
 
 <br/>
@@ -1552,9 +1578,9 @@ _Available in Fleet Premium._
 `webhook_settings.activities_webhook` is an object with the following structure:
 
 | Name                              | Type    | Description   |
-| ---------------------             | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| enable_activities_webhook         | boolean | Whether or not the activity feed webhook is enabled. |
-| destination_url                   | string  | The URL to deliver the webhook requests to.                                                     |
+| ---------------------             | ------- | --------------------------------------------------------- |
+| enable_activities_webhook         | boolean | Whether or not the activity feed webhook is enabled.      |
+| destination_url                   | string  | The URL to deliver the webhook requests to.               |
 
 <br/>
 
@@ -1596,11 +1622,11 @@ _Available in Fleet Premium._
 + [`integrations.google_calendar`](#integrations-google-calendar)
 -->
 
-| Name                              | Type    | Description   |
-| ---------------------             | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| jira             | list  | See [`integrations.jira`](#integrations-jira). |
-| zendesk             | list  | See [`integrations.zendesk`](#integrations-zendesk). |
-| google_calendar             | list  | See [`integrations.google_calendar`](#integrations-google-calendar). |
+| Name                  | Type  | Description   |
+| --------------------- | ----- | -------------------------------------------------------------------- |
+| jira                  | array | See [`integrations.jira`](#integrations-jira).                       |
+| zendesk               | array | See [`integrations.zendesk`](#integrations-zendesk).                 |
+| google_calendar       | array | See [`integrations.google_calendar`](#integrations-google-calendar). |
 
 
 > Note that when making changes to the `integrations` object, all integrations must be provided (not just the one being modified). This is because the endpoint will consider missing integrations as deleted.
@@ -1642,8 +1668,8 @@ _Available in Fleet Premium._
 `integrations.google_calendar` is an array of objects with the following structure:
 
 | Name                              | Type    | Description   |
-| ---------------------             | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| domain                            | string  | The domain for the Google Workspace service account to be used for this calendar integration. |
+| ---------------------             | ------- | --------------------------------------------------------------------------------------------------------------------- |
+| domain                            | string  | The domain for the Google Workspace service account to be used for this calendar integration.                         |
 | api_key_json                      | object  | The private key JSON downloaded when generating the service account API key to be used for this calendar integration. |
 
 <br/>
@@ -1678,10 +1704,12 @@ _Available in Fleet Premium._
 
 | Name                              | Type    | Description   |
 | ---------------------             | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| apple_bm_default_team             | string  | _Available in Fleet Premium._ The default team to use with Apple Business Manager. |
 | windows_enabled_and_configured    | boolean | Enables Windows MDM support. |
 | enable_disk_encryption            | boolean | _Available in Fleet Premium._ Hosts that belong to no team will have disk encryption enabled if set to true. |
 | macos_updates         | object  | See [`mdm.macos_updates`](#mdm-macos-updates). |
+| ios_updates         | object  | See [`mdm.ios_updates`](#mdm-ios-updates). |
+| ipados_updates         | object  | See [`mdm.ipados_updates`](#mdm-ipados-updates). |
+| windows_updates         | object  | See [`mdm.window_updates`](#mdm-windows-updates). |
 | macos_migration         | object  | See [`mdm.macos_migration`](#mdm-macos-migration). |
 | macos_setup         | object  | See [`mdm.macos_setup`](#mdm-macos-setup). |
 | macos_settings         | object  | See [`mdm.macos_settings`](#mdm-macos-settings). |
@@ -1702,6 +1730,32 @@ _Available in Fleet Premium._
 
 <br/>
 
+##### mdm.ios_updates
+
+_Available in Fleet Premium._
+
+`mdm.ios_updates` is an object with the following structure:
+
+| Name                              | Type    | Description   |
+| ---------------------             | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| minimum_version                   | string  | Hosts that belong to no team and are enrolled into Fleet's MDM will be nudged until their iOS is at or above this version. |
+| deadline                          | string  | Hosts that belong to no team and are enrolled into Fleet's MDM won't be able to dismiss the Nudge window once this deadline is past. |
+
+<br/>
+
+##### mdm.ipados_updates
+
+_Available in Fleet Premium._
+
+`mdm.ipados_updates` is an object with the following structure:
+
+| Name                              | Type    | Description   |
+| ---------------------             | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| minimum_version                   | string  | Hosts that belong to no team and are enrolled into Fleet's MDM will be nudged until their iPadOS is at or above this version. |
+| deadline                          | string  | Hosts that belong to no team and are enrolled into Fleet's MDM won't be able to dismiss the Nudge window once this deadline is past. |
+
+<br/>
+
 ##### mdm.windows_updates
 
 _Available in Fleet Premium._
@@ -1747,7 +1801,7 @@ _Available in Fleet Premium._
 
 | Name                              | Type    | Description   |
 | ---------------------             | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| custom_settings                   | list    | macOS hosts that belong to no team will have custom profiles applied. |
+| custom_settings                   | array   | macOS hosts that belong to no team will have custom profiles applied. |
 
 <br/>
 
@@ -1757,7 +1811,7 @@ _Available in Fleet Premium._
 
 | Name                              | Type    | Description   |
 | ---------------------             | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| custom_settings                   | list    | Windows hosts that belong to no team will have custom profiles applied. |
+| custom_settings                   | array   | Windows hosts that belong to no team will have custom profiles applied. |
 
 <br/>
 
@@ -1766,7 +1820,6 @@ _Available in Fleet Premium._
 ```json
 {
   "mdm": {
-    "apple_bm_default_team": "",
     "windows_enabled_and_configured": false,
     "enable_disk_encryption": true,
     "macos_updates": {
@@ -2054,7 +2107,7 @@ Delete all of a team's existing enroll secrets
 | email       | string  | body | **Required.** The email of the invited user. This email will receive the invitation link.                                                             |
 | name        | string  | body | **Required.** The name of the invited user.                                                                                                           |
 | sso_enabled | boolean | body | **Required.** Whether or not SSO will be enabled for the invited user.                                                                                |
-| teams       | list    | body | _Available in Fleet Premium_. A list of the teams the user is a member of. Each item includes the team's ID and the user's role in the specified team. |
+| teams       | array   | body | _Available in Fleet Premium_. A list of the teams the user is a member of. Each item includes the team's ID and the user's role in the specified team. |
 
 #### Example
 
@@ -2254,7 +2307,7 @@ Verify the specified invite.
 | email       | string  | body | The email of the invited user. Updates on the email won't resend the invitation.                                                             |
 | name        | string  | body | The name of the invited user.                                                                                                           |
 | sso_enabled | boolean | body | Whether or not SSO will be enabled for the invited user.                                                                                |
-| teams       | list    | body | _Available in Fleet Premium_. A list of the teams the user is a member of. Each item includes the team's ID and the user's role in the specified team. |
+| teams       | array   | body | _Available in Fleet Premium_. A list of the teams the user is a member of. Each item includes the team's ID and the user's role in the specified team. |
 
 #### Example
 
@@ -2378,7 +2431,6 @@ None.
 - [Get host OS version](#get-host-os-version)
 - [Get host's scripts](#get-hosts-scripts)
 - [Get host's software](#get-hosts-software)
-- [Install software](#install-software)
 - [Get hosts report in CSV](#get-hosts-report-in-csv)
 - [Get host's disk encryption key](#get-hosts-disk-encryption-key)
 - [Lock host](#lock-host)
@@ -2445,6 +2497,7 @@ the `software` table.
 | mdm_id                  | integer | query | The ID of the _mobile device management_ (MDM) solution to filter hosts by (that is, filter hosts that use a specific MDM provider and URL).                                                                                                                                                                                                |
 | mdm_name                | string  | query | The name of the _mobile device management_ (MDM) solution to filter hosts by (that is, filter hosts that use a specific MDM provider).                                                                                                                                                                                                |
 | mdm_enrollment_status   | string  | query | The _mobile device management_ (MDM) enrollment status to filter hosts by. Valid options are 'manual', 'automatic', 'enrolled', 'pending', or 'unenrolled'.                                                                                                                                                                                                             |
+| connected_to_fleet   | boolean  | query | Filter hosts that are talking to this Fleet server for MDM features. In rare cases, hosts can be enrolled to one Fleet server but talk to a different Fleet server for MDM features. In this case, the value would be `false`. Always `false` for Linux hosts.                                                                                                                           |
 | macos_settings          | string  | query | Filters the hosts by the status of the _mobile device management_ (MDM) profiles applied to hosts. Valid options are 'verified', 'verifying', 'pending', or 'failed'. **Note: If this filter is used in Fleet Premium without a team ID filter, the results include only hosts that are not assigned to any team.**                                                                                                                                                                                                             |
 | munki_issue_id          | integer | query | The ID of the _munki issue_ (a Munki-reported error or warning message) to filter hosts by (that is, filter hosts that are affected by that corresponding error or warning message).                                                                                                                                                        |
 | low_disk_space          | integer | query | _Available in Fleet Premium_. Filters the hosts to only include hosts with less GB of disk space available than this value. Must be a number between 1-100.                                                                                                                                                                                  |
@@ -3055,10 +3108,11 @@ Returns the information of the specified host.
       "timezone": "America/New_York"
     },
     "mdm": {
-      "encryption_key_available": false,
-      "enrollment_status": null,
-      "name": "",
-      "server_url": null,
+      "encryption_key_available": true,
+      "enrollment_status": "On (manual)",
+      "name": "Fleet",
+      "connected_to_fleet": true,
+      "server_url": "https://acme.com/mdm/apple/mdm",
       "device_status": "unlocked",
       "pending_action": "",
       "macos_settings": {
@@ -3474,10 +3528,11 @@ This is the API route used by the **My device** page in Fleet desktop to display
       }
     ],
     "mdm": {
-      "encryption_key_available": false,
-      "enrollment_status": null,
-      "name": "",
-      "server_url": null,
+      "encryption_key_available": true,
+      "enrollment_status": "On (manual)",
+      "name": "Fleet",
+      "connected_to_fleet": true,
+      "server_url": "https://acme.com/mdm/apple/mdm",
       "macos_settings": {
         "disk_encryption": null,
         "action_required": null
@@ -3504,6 +3559,7 @@ This is the API route used by the **My device** page in Fleet desktop to display
       ]
     }
   },
+  "self_service": true,
   "org_logo_url": "https://example.com/logo.jpg",
   "license": {
     "tier": "free",
@@ -3651,7 +3707,7 @@ _Available in Fleet Premium_
 
 | Name    | Type    | In   | Description                                                                                                                                                                                                                                                                                                                        |
 | ------- | ------- | ---- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| ids     | list    | body | A list of the host IDs you'd like to delete. If `ids` is specified, `filters` cannot be specified.                                                                                                                                                                                                                                                           |
+| ids     | array   | body | A list of the host IDs you'd like to delete. If `ids` is specified, `filters` cannot be specified.                                                                                                                                                                                                                                                           |
 | filters | object  | body | Contains any of the following four properties: `query` for search query keywords. Searchable fields include `hostname`, `hardware_serial`, `uuid`, and `ipv4`. `status` to indicate the status of the hosts to return. Can either be `new`, `online`, `offline`, `mia` or `missing`. `label_id` to indicate the selected label. `team_id` to indicate the selected team. If `filters` is specified, `id` cannot be specified. `label_id` and `status` cannot be used at the same time. |
 
 Either ids or filters are required.
@@ -4106,139 +4162,6 @@ Resends a configuration profile for the specified host.
 
 `Status: 202`
 
-
-### List host OS versions
-
-Retrieves the aggregated host OS versions information.
-
-`GET /api/v1/fleet/os_versions`
-
-#### Parameters
-
-| Name                | Type     | In    | Description                                                                                                                          |
-| ---      | ---      | ---   | ---                                                                                                                                  |
-| team_id             | integer | query | _Available in Fleet Premium_. Filters response data to the specified team.  |
-| platform            | string   | query | Filters the hosts to the specified platform |
-| os_name     | string | query | The name of the operating system to filter hosts by. `os_version` must also be specified with `os_name`                                                 |
-| os_version    | string | query | The version of the operating system to filter hosts by. `os_name` must also be specified with `os_version`                                                 |
-| page                    | integer | query | Page number of the results to fetch.                                                                                                                                       |
-| per_page                | integer | query | Results per page.                                                                                                                                                          |
-| order_key               | string  | query | What to order results by. Allowed fields are: `hosts_count`. Default is `hosts_count` (descending).      |
-| order_direction | string | query | **Requires `order_key`**. The direction of the order given the order key. Options include `asc` and `desc`. Default is `asc`. |
-
-
-##### Default response
-
-`Status: 200`
-
-```json
-{
-  "count": 1
-  "counts_updated_at": "2023-12-06T22:17:30Z",
-  "os_versions": [
-    {
-      "os_version_id": 123,
-      "hosts_count": 21,
-      "name": "Microsoft Windows 11 Pro 23H2 10.0.22621.1234",
-      "name_only": "Microsoft Windows 11 Pro 23H2",
-      "version": "10.0.22621.1234",
-      "platform": "windows",
-      "generated_cpes": [],
-      "vulnerabilities": [
-        {
-          "cve": "CVE-2022-30190",
-          "details_link": "https://nvd.nist.gov/vuln/detail/CVE-2022-30190",
-          "cvss_score": 7.8,// Available in Fleet Premium
-          "epss_probability": 0.9729,// Available in Fleet Premium
-          "cisa_known_exploit": false,// Available in Fleet Premium
-          "cve_published": "2022-06-01T00:15:00Z",// Available in Fleet Premium
-          "cve_description": "Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability.",// Available in Fleet Premium
-          "resolved_in_version": ""// Available in Fleet Premium
-        }
-      ]
-    }
-  ],
-  "meta": {
-    "has_next_results": false,
-    "has_previous_results": false
-  }
-}
-```
-
-OS vulnerability data is currently available for Windows and macOS. For other platforms, `vulnerabilities` will be an empty array:
-
-```json
-{
-  "hosts_count": 1,
-  "name": "CentOS Linux 7.9.2009",
-  "name_only": "CentOS",
-  "version": "7.9.2009",
-  "platform": "rhel",
-  "generated_cpes": [],
-  "vulnerabilities": []
-}
-```
-
-### Get host OS version
-
-Retrieves information about the specified OS version.
-
-`GET /api/v1/fleet/os_versions/:id`
-
-#### Parameters
-
-| Name | Type | In | Description |
-| ---- | ---- | -- | ----------- |
-| id   | integer | path | **Required.** The OS version's ID. |
-
-##### Default response
-
-`Status: 200`
-
-```json
-{
-  "counts_updated_at": "2023-12-06T22:17:30Z",
-  "os_version": {
-    "id": 123,
-    "hosts_count": 21,
-    "name": "Microsoft Windows 11 Pro 23H2 10.0.22621.1234",
-    "name_only": "Microsoft Windows 11 Pro 23H2",
-    "version": "10.0.22621.1234",
-    "platform": "windows",
-    "generated_cpes": [],
-    "vulnerabilities": [
-      {
-        "cve": "CVE-2022-30190",
-        "details_link": "https://nvd.nist.gov/vuln/detail/CVE-2022-30190",
-        "created_at": "2024-07-01T00:15:00Z",
-        "cvss_score": 7.8,// Available in Fleet Premium
-        "epss_probability": 0.9729,// Available in Fleet Premium
-        "cisa_known_exploit": false,// Available in Fleet Premium
-        "cve_published": "2022-06-01T00:15:00Z",// Available in Fleet Premium
-        "cve_description": "Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability.",// Available in Fleet Premium
-        "resolved_in_version": ""// Available in Fleet Premium
-      }
-    ]
-  }
-}
-```
-
-OS vulnerability data is currently available for Windows and macOS. For other platforms, `vulnerabilities` will be an empty array:
-
-```json
-{
-  "id": 321,
-  "hosts_count": 1,
-  "name": "CentOS Linux 7.9.2009",
-  "name_only": "CentOS",
-  "version": "7.9.2009",
-  "platform": "rhel",
-  "generated_cpes": [],
-  "vulnerabilities": []
-}
-```
-
-
 ### Get host's scripts
 
 `GET /api/v1/fleet/hosts/:id/scripts`
@@ -4260,46 +4183,45 @@ OS vulnerability data is currently available for Windows and macOS. For other pl
 `Status: 200`
 
 ```json
-  "scripts": [
-    {
-      "script_id": 3,
-      "name": "remove-zoom-artifacts.sh",
-      "last_execution": {
-        "execution_id": "e797d6c6-3aae-11ee-be56-0242ac120002",
-        "executed_at": "2021-12-15T15:23:57Z",
-        "status": "error"
-      }
-    },
-    {
-      "script_id": 5,
-      "name": "set-timezone.sh",
-      "last_execution": {
-        "id": "e797d6c6-3aae-11ee-be56-0242ac120002",
-        "executed_at": "2021-12-15T15:23:57Z",
-        "status": "pending"
-      }
-    },
-    {
-      "script_id": 8,
-      "name": "uninstall-zoom.sh",
-      "last_execution": {
-        "id": "e797d6c6-3aae-11ee-be56-0242ac120002",
-        "executed_at": "2021-12-15T15:23:57Z",
-        "status": "ran"
-      }
+"scripts": [
+  {
+    "script_id": 3,
+    "name": "remove-zoom-artifacts.sh",
+    "last_execution": {
+      "execution_id": "e797d6c6-3aae-11ee-be56-0242ac120002",
+      "executed_at": "2021-12-15T15:23:57Z",
+      "status": "error"
+    }
+  },
+  {
+    "script_id": 5,
+    "name": "set-timezone.sh",
+    "last_execution": {
+      "id": "e797d6c6-3aae-11ee-be56-0242ac120002",
+      "executed_at": "2021-12-15T15:23:57Z",
+      "status": "pending"
+    }
+  },
+  {
+    "script_id": 8,
+    "name": "uninstall-zoom.sh",
+    "last_execution": {
+      "id": "e797d6c6-3aae-11ee-be56-0242ac120002",
+      "executed_at": "2021-12-15T15:23:57Z",
+      "status": "ran"
     }
-  ],
-  "meta": {
-    "has_next_results": false,
-    "has_previous_results": false
   }
+],
+"meta": {
+  "has_next_results": false,
+  "has_previous_results": false
 }
 
 ```
 
 ### Get host's software
 
-> The **new keys/values added in the app management features are experimental** and may change. You can find the upcoming breaking changes [here](https://github.com/fleetdm/fleet/pull/19291/files#diff-7246bc304b15c8865ed8eaa205e9c244d0a0314e4bae60cf553dc06147c38b64L4304-L4311).
+> **Experimental feature**. This feature is undergoing rapid improvement, which may result in breaking changes to the API or configuration surface. It is not recommended for use in automated workflows.
 
 `GET /api/v1/fleet/hosts/:id/software`
 
@@ -4309,6 +4231,7 @@ OS vulnerability data is currently available for Windows and macOS. For other pl
 | ---- | ------- | ---- | ---------------------------- |
 | id   | integer | path | **Required**. The host's ID. |
 | query   | string | query | Search query keywords. Searchable fields include `name`. |
+| available_for_install | boolean | query | If `true` or `1`, only list software that is available for install (added by the user). Default is `false`.  
 | page | integer | query | Page number of the results to fetch.|
 | per_page | integer | query | Results per page.|
 
@@ -4327,14 +4250,18 @@ OS vulnerability data is currently available for Windows and macOS. For other pl
     {
       "id": 121,
       "name": "Google Chrome.app",
-      "package_available_for_install": "GoogleChrome.pkg",
-      "self_service": true,
+      "software_package": {
+        "name": "GoogleChrome.pkg",
+        "version": "125.12.0.3",
+        "self_service": true,
+        "last_install": {
+          "install_uuid": "8bbb8ac2-b254-4387-8cba-4d8a0407368b",
+          "installed_at": "2024-05-15T15:23:57Z"
+        }
+      },
+      "app_store_app": null
       "source": "apps",
       "status": "failed",
-      "last_install": {
-        "install_uuid": "8bbb8ac2-b254-4387-8cba-4d8a0407368b",
-        "installed_at": "2024-05-15T15:23:57Z"
-      },
       "installed_versions": [
         {
           "version": "121.0",
@@ -4347,32 +4274,42 @@ OS vulnerability data is currently available for Windows and macOS. For other pl
     {
       "id": 134,
       "name": "Falcon.app",
-      "package_available_for_install": "FalconSensor-6.44.pkg",
-      "self_service": false,
+      "software_package": {
+        "name": "FalconSensor-6.44.pkg"
+        "self_service": false,
+        "last_install": null
+        "last_install": null,
+        "last_uninstall": {
+          "script_execution_id": "ed579e73-0f41-46c8-aaf4-3c1e5880ed27",
+          "uninstalled_at": "2024-05-15T15:23:57Z"
+        }
+      },
+      "app_store_app": null    
       "source": "",
       "status": null,
-      "last_install": null,
+      "status": "pending_uninstall",
       "installed_versions": [],
     },
     {
       "id": 147,
-      "name": "Firefox.app",
+      "name": "Logic Pro",
+      "software_package": null
+      "app_store_app": {
+        "app_store_id": "1091189122"
+        "version": "2.04",
+        "last_install": {
+          "command_uuid": "0aa14ae5-58fe-491a-ac9a-e4ee2b3aac40",
+          "installed_at": "2024-05-15T15:23:57Z"
+        },
+      },
       "source": "apps",
-      "bundle_identifier": "org.mozilla.firefox",
-      "status": null,
-      "last_install": null,
+      "status": "installed",
       "installed_versions": [
         {
           "version": "118.0",
           "last_opened_at": "2024-04-01T23:03:07Z",
           "vulnerabilities": ["CVE-2023-1234"],
-          "installed_paths": ["/Applications/Firefox.app"]
-        },
-        {
-          "version": "119.0",
-          "last_opened_at": "2024-04-01T23:03:07Z",
-          "vulnerabilities": ["CVE-2023-4321","CVE-2023-7654"],
-          "installed_paths": ["/Downloads/Firefox.app"]
+          "installed_paths": ["/Applications/Logic Pro.app"]
         }
       ]
     },
@@ -4384,29 +4321,6 @@ OS vulnerability data is currently available for Windows and macOS. For other pl
 }
 ```
 
-### Install software
-
-_Available in Fleet Premium._
-
-Install software on a macOS, Windows, or Linux (Ubuntu) host. Software title must have `software_package` added to be installed.
-
-`POST /api/v1/fleet/hosts/:id/software/install/:software_title_id`
-
-#### Parameters
-
-| Name              | Type       | In   | Description                                      |
-| ---------         | ---------- | ---- | --------------------------------------------     |
-| id                | integer    | path | **Required**. The host's ID.                     |
-| software_title_id | integer    | path | **Required**. The software title's ID.           |
-
-#### Example
-
-`POST /api/v1/fleet/hosts/123/software/install/3435`
-
-##### Default response
-
-`Status: 202`
-
 ### Get hosts report in CSV
 
 Returns the list of hosts corresponding to the search criteria in CSV format, ready for download when
@@ -4423,8 +4337,8 @@ requested by a web browser.
 | order_key               | string  | query | What to order results by. Can be any column in the hosts table.                                                                                                                                                                                                                                                                             |
 | order_direction         | string  | query | **Requires `order_key`**. The direction of the order given the order key. Options include 'asc' and 'desc'. Default is 'asc'.                                                                                                                                                                                                               |
 | status                  | string  | query | Indicates the status of the hosts to return. Can either be 'new', 'online', 'offline', 'mia' or 'missing'.                                                                                                                                                                                                                                  |
-| query                   | string  | query | Search query keywords. Searchable fields include `hostname`, `hardware_serial`, `uuid`, `ipv4` and the hosts' email addresses (only searched if the query looks like an email address, i.e. contains an `@`, no space, etc.).                                                                                                                |
-| team_id                 | integer | query | _Available in Fleet Premium_. Filters the hosts to only include hosts in the specified team.                                                                                                                                                                                                                                                 |
+| query                   | string  | query | Search query keywords. Searchable fields include `hostname`, `hardware_serial`, `uuid`, `ipv4` and the hosts' email addresses (only searched if the query looks like an email address, i.e. contains an `@`, no space, etc.).                                                                                                               |
+| team_id                 | integer | query | _Available in Fleet Premium_. Filters the hosts to only include hosts in the specified team.                                                                                                                                                                                                                                                |
 | policy_id               | integer | query | The ID of the policy to filter hosts by.                                                                                                                                                                                                                                                                                                    |
 | policy_response         | string  | query | **Requires `policy_id`**. Valid options are 'passing' or 'failing'. **Note: If `policy_id` is specified _without_ including `policy_response`, this will also return hosts where the policy is not configured to run or failed to run.** |
 | software_version_id     | integer | query | The ID of the software version to filter hosts by.                                                                                                            |
@@ -4434,11 +4348,11 @@ requested by a web browser.
 | os_version              | string  | query | The version of the operating system to filter hosts by. `os_name` must also be specified with `os_version`                                                                                                                                                                                                                                  |
 | vulnerability           | string  | query | The cve to filter hosts by (including "cve-" prefix, case-insensitive).                                                                                                                                                                                                                                                                     |
 | mdm_id                  | integer | query | The ID of the _mobile device management_ (MDM) solution to filter hosts by (that is, filter hosts that use a specific MDM provider and URL).                                                                                                                                                                                                |
-| mdm_name                | string  | query | The name of the _mobile device management_ (MDM) solution to filter hosts by (that is, filter hosts that use a specific MDM provider).                                                                                                                                                                                                |
-| mdm_enrollment_status   | string  | query | The _mobile device management_ (MDM) enrollment status to filter hosts by. Valid options are 'manual', 'automatic', 'enrolled', 'pending', or 'unenrolled'.                                                                                                                                                                                                             |
+| mdm_name                | string  | query | The name of the _mobile device management_ (MDM) solution to filter hosts by (that is, filter hosts that use a specific MDM provider).                                                                                                                                                                                                      |
+| mdm_enrollment_status   | string  | query | The _mobile device management_ (MDM) enrollment status to filter hosts by. Valid options are 'manual', 'automatic', 'enrolled', 'pending', or 'unenrolled'.                                                                                                                                                                                 |
 | macos_settings          | string  | query | Filters the hosts by the status of the _mobile device management_ (MDM) profiles applied to hosts. Valid options are 'verified', 'verifying', 'pending', or 'failed'. **Note: If this filter is used in Fleet Premium without a team ID filter, the results include only hosts that are not assigned to any team.**                                                                                                                                                                                                             |
 | munki_issue_id          | integer | query | The ID of the _munki issue_ (a Munki-reported error or warning message) to filter hosts by (that is, filter hosts that are affected by that corresponding error or warning message).                                                                                                                                                        |
-| low_disk_space          | integer | query | _Available in Fleet Premium_. Filters the hosts to only include hosts with less GB of disk space available than this value. Must be a number between 1-100.                                                                                                                                                                                  |
+| low_disk_space          | integer | query | _Available in Fleet Premium_. Filters the hosts to only include hosts with less GB of disk space available than this value. Must be a number between 1-100.                                                                                                                                                                                 |
 | label_id                | integer | query | A valid label ID. Can only be used in combination with `order_key`, `order_direction`, `status`, `query` and `team_id`.                                                                                                                                                                                                                     |
 | bootstrap_package       | string | query | _Available in Fleet Premium_. Filters the hosts by the status of the MDM bootstrap package on the host. Valid options are 'installed', 'pending', or 'failed'. **Note: If this filter is used in Fleet Premium without a team ID filter, the results include only hosts that are not assigned to any team.** |
 | disable_failing_policies | boolean | query | If `true`, hosts will return failing policies as 0 (returned as the `issues` column) regardless of whether there are any that failed for the host. This is meant to be used when increased performance is needed in exchange for the extra information.      |
@@ -4654,6 +4568,38 @@ To wipe a macOS, iOS, iPadOS, or Windows host, the host must have MDM turned on.
 ```json
 {
   "activities": [
+    {
+      "created_at": "2023-07-27T14:35:08Z",
+      "actor_id": 1,
+      "actor_full_name": "Anna Chao",
+      "id": 4,
+      "actor_gravatar": "",
+      "actor_email": "",
+      "type": "uninstalled_software",
+      "details": {
+        "host_id": 1,
+        "host_display_name": "Marko’s MacBook Pro",
+        "software_title": "Adobe Acrobat.app",
+        "script_execution_id": "ecf22dba-07dc-40a9-b122-5480e948b756",
+        "status": "failed"
+      }
+    }, 
+    {
+      "created_at": "2023-07-27T14:35:08Z",
+      "actor_id": 1,
+      "actor_full_name": "Anna Chao",
+      "id": 3,
+      "actor_gravatar": "",
+      "actor_email": "",
+      "type": "uninstalled_software",
+      "details": {
+        "host_id": 1,
+        "host_display_name": "Marko’s MacBook Pro",
+        "software_title": "Adobe Acrobat.app",
+        "script_execution_id": "ecf22dba-07dc-40a9-b122-5480e948b756",
+        "status": "uninstalled"
+      }
+    },
     {
       "created_at": "2023-07-27T14:35:08Z",
       "id": 2,
@@ -4716,8 +4662,25 @@ To wipe a macOS, iOS, iPadOS, or Windows host, the host must have MDM turned on.
 
 ```json
 {
-  "count": 2,
+  "count": 3,
   "activities": [
+    {
+      "created_at": "2023-07-27T14:35:08Z",
+      "actor_id": 1,
+      "actor_full_name": "Anna Chao",
+      "uuid": "cc081637-fdf9-4d44-929f-96dfaec00f67",
+      "actor_gravatar": "",
+      "actor_email": "",
+      "type": "uninstalled_software",
+      "fleet_initiated_activity": false,
+      "details": {
+        "host_id": 1,
+        "host_display_name": "Marko's MacBook Pro",
+        "software_title": "Adobe Acrobat.app",
+        "script_execution_id": "ecf22dba-07dc-40a9-b122-5480e948b756",
+        "status": "pending_uninstall",
+      }
+    },
     {
       "created_at": "2023-07-27T14:35:08Z",
       "uuid": "d6cffa75-b5b5-41ef-9230-15073c8a88cf",
@@ -4766,9 +4729,9 @@ Adds manual labels to a host.
 
 #### Parameters
 
-| Name | Type    | In   | Description                  |
-| ---- | ------- | ---- | ---------------------------- |
-| labels   | list | body | The list of label names to add to the host. |
+| Name   | Type    | In   | Description                  |
+| ------ | ------- | ---- | ---------------------------- |
+| labels | array   | body | The list of label names to add to the host. |
 
 
 #### Example
@@ -4795,9 +4758,9 @@ Removes manual labels from a host.
 
 #### Parameters
 
-| Name | Type    | In   | Description                  |
-| ---- | ------- | ---- | ---------------------------- |
-| labels   | list | body | The list of label names to delete from the host. |
+| Name   | Type    | In   | Description                  |
+| ------ | ------- | ---- | ---------------------------- |
+| labels | array   | body | The list of label names to delete from the host. |
 
 
 #### Example
@@ -4829,8 +4792,8 @@ The live query will stop if the targeted host is offline, or if the query times
 
 | Name      | Type  | In   | Description                                                                                                                                                        |
 |-----------|-------|------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| id       | integer  | path | **Required**. The target host ID. |
-| query            | string   | body | **Required**. The query SQL. |
+| id        | integer  | path | **Required**. The target host ID. |
+| query     | string   | body | **Required**. The query SQL. |
 
 
 #### Example
@@ -5392,8 +5355,8 @@ Add a configuration profile to enforce custom settings on macOS and Windows host
 | ------------------------- | -------- | ---- | ------------------------------------------------------------------------------------------------------------- |
 | profile                   | file     | form | **Required.** The .mobileconfig and JSON for macOS or XML for Windows file containing the profile. |
 | team_id                   | string   | form | _Available in Fleet Premium_. The team ID for the profile. If specified, the profile is applied to only hosts that are assigned to the specified team. If not specified, the profile is applied to only to hosts that are not assigned to any team. |
-| labels_include_all        | array     | form | _Available in Fleet Premium_. Profile will only be applied to hosts that have all of these labels. |
-| labels_exclude_any | array | form | _Available in Fleet Premium_. Profile will be applied to hosts that don’t have any of these labels. |
+| labels_include_all        | array     | form | _Available in Fleet Premium_. Profile will only be applied to hosts that have all of these labels. Only one of either `labels_include_all` or `labels_exclude_any` can be included in the request. |
+| labels_exclude_any | array | form | _Available in Fleet Premium_. Profile will be applied to hosts that don’t have any of these labels. Only one of either `labels_include_all` or `labels_exclude_any` can be included in the request. |
 
 #### Example
 
@@ -5510,7 +5473,8 @@ List all configuration profiles for macOS and Windows hosts enrolled to Fleet's
       "checksum": "dGVzdAo=",
       "labels_exclude_any": [
        {
-        "name": "Label name 1"
+        "name": "Label name 1",
+        "id": 1
        }
       ]
     },
@@ -5524,11 +5488,12 @@ List all configuration profiles for macOS and Windows hosts enrolled to Fleet's
       "checksum": "aCLemVr)",
       "labels_include_all": [
         {
-          "name": "Label name 1",
-          "broken": true
+          "name": "Label name 2",
+          "broken": true,
         },
         {
-          "name": "Label name 2"
+          "name": "Label name 3",
+          "id": 3
         }
       ]
     }
@@ -5576,10 +5541,12 @@ If one or more assigned labels are deleted the profile is considered broken (`br
   "labels_include_all": [
     {
       "name": "Label name 1",
+      "id": 1
       "broken": true
     },
     {
       "name": "Label name 2",
+      "id": 2
     }
   ]
 }
@@ -6213,12 +6180,12 @@ Body: <blob>
 
 ## Commands
 
-- [Run custom MDM command](#run-custom-mdm-command)
-- [Get custom MDM command results](#get-custom-mdm-command-results)
-- [List custom MDM commands](#list-custom-mdm-commands)
+- [Run MDM command](#run-mdm-command)
+- [Get MDM command results](#get-mdm-command-results)
+- [List MDM commands](#list-mdm-commands)
 
 
-### Run custom MDM command
+### Run MDM command
 
 > `POST /api/v1/fleet/mdm/apple/enqueue` API endpoint is deprecated as of Fleet 4.40. It is maintained for backward compatibility. Please use the new API endpoint below. See old API endpoint docs [here](https://github.com/fleetdm/fleet/blob/fleet-v4.39.0/docs/REST%20API/rest-api.md#run-custom-mdm-command).
 
@@ -6251,12 +6218,22 @@ Note that the `EraseDevice` and `DeviceLock` commands are _available in Fleet Pr
 ```
 
 
-### Get custom MDM command results
+### Get MDM command results
 
 > `GET /api/v1/fleet/mdm/apple/commandresults` API endpoint is deprecated as of Fleet 4.40. It is maintained for backward compatibility. Please use the new API endpoint below. See old API endpoint docs [here](https://github.com/fleetdm/fleet/blob/fleet-v4.39.0/docs/REST%20API/rest-api.md#get-custom-mdm-command-results).
 
 This endpoint returns the results for a specific custom MDM command.
 
+In the reponse, the possible `status` values for macOS, iOS, and iPadOS hosts are the following:
+
+* Pending: the command has yet to run on the host. The host will run the command the next time it comes online.
+* NotNow: the host responded with "NotNow" status via the MDM protocol: the host received the command, but couldn’t execute it. The host will try to run the command the next time it comes online.
+* Acknowledged: the host responded with "Acknowledged" status via the MDM protocol: the host processed the command successfully.
+* Error: the host responded with "Error" status via the MDM protocol: an error occurred. Run the `fleetctl get mdm-command-results --id=<insert-command-id` to view the error.
+* CommandFormatError: the host responded with "CommandFormatError" status via the MDM protocol: a protocol error occurred, which can result from a malformed command. Run the `fleetctl get mdm-command-results --id=<insert-command-id` to view the error.
+
+The possible `status` values for Windows hosts are documented in Microsoft's documentation [here](https://learn.microsoft.com/en-us/windows/client-management/oma-dm-protocol-support#syncml-response-status-codes).
+
 `GET /api/v1/fleet/commands/results`
 
 #### Parameters
@@ -6292,8 +6269,7 @@ This endpoint returns the results for a specific custom MDM command.
 
 > Note: If the server has not yet received a result for a command, it will return an empty object (`{}`).
 
-
-### List custom MDM commands
+### List MDM commands
 
 > `GET /api/v1/fleet/mdm/apple/commands` API endpoint is deprecated as of Fleet 4.40. It is maintained for backward compatibility. Please use the new API endpoint below. See old API endpoint docs [here](https://github.com/fleetdm/fleet/blob/fleet-v4.39.0/docs/REST%20API/rest-api.md#list-custom-mdm-commands).
 
@@ -6348,7 +6324,8 @@ This endpoint returns the list of custom MDM commands that have been executed.
 ## Integrations
 
 - [Get Apple Push Notification service (APNs)](#get-apple-push-notification-service-apns)
-- [Get Apple Business Manager (ABM)](#get-apple-business-manager-abm)
+- [List Apple Business Manager (ABM) tokens](#list-apple-business-manager-abm-tokens)
+- [List Volume Purchasing Program (VPP) tokens](#list-volume-purchasing-program-vpp-tokens)
 
 ### Get Apple Push Notification service (APNs)
 
@@ -6375,11 +6352,11 @@ None.
 }
 ```
 
-### Get Apple Business Manager (ABM)
+### List Apple Business Manager (ABM) tokens
 
 _Available in Fleet Premium_
 
-`GET /api/v1/fleet/abm`
+`GET /api/v1/fleet/abm_tokens`
 
 #### Parameters
 
@@ -6387,7 +6364,95 @@ None.
 
 #### Example
 
-`GET /api/v1/fleet/abm`
+`GET /api/v1/fleet/abm_tokens`
+
+##### Default response
+
+`Status: 200`
+
+```json
+"abm_tokens": [
+  {
+    "id": 1,
+    "apple_id": "apple@example.com",
+    "org_name": "Fleet Device Management Inc.",
+    "mdm_server_url": "https://example.com/mdm/apple/mdm",
+    "renew_date": "2023-11-29T00:00:00Z",
+    "terms_expired": false,
+    "macos_team": {
+      "name": "💻 Workstations",
+      "id" 1
+    },
+    "ios_team": {
+      "name": "📱🏢 Company-owned iPhones",
+      "id": 2
+    },
+    "ipados_team": {
+      "name": "🔳🏢 Company-owned iPads",
+      "id": 3
+    }
+  }
+]
+```
+
+### List Volume Purchasing Program (VPP) tokens
+
+_Available in Fleet Premium_
+
+`GET /api/v1/fleet/vpp_tokens`
+
+#### Parameters
+
+None.
+
+#### Example
+
+`GET /api/v1/fleet/vpp_tokens`
+
+##### Default response
+
+`Status: 200`
+
+```json
+"vpp_tokens": [
+  {
+    "id": 1,
+    "org_name": "Fleet Device Management Inc.",
+    "location": "https://example.com/mdm/apple/mdm",
+    "renew_date": "2023-11-29T00:00:00Z",
+    "teams": [
+      {
+        "name": "💻 Workstations",
+        "id": 1
+      },
+      {
+        "name": "💻🐣 Workstations (canary)",
+        "id": 2
+      },
+      {
+        "name": "📱🏢 Company-owned iPhones",
+        "id": 3
+      },
+      {
+        "name": "🔳🏢 Company-owned iPads",
+        "id" 4
+      }
+    ],
+  }
+]
+```
+
+Get Volume Purchasing Program (VPP)
+
+> **Experimental feature**. This feature is undergoing rapid improvement, which may result in breaking changes to the API or configuration surface. It is not recommended for use in automated workflows.
+
+_Available in Fleet Premium_
+
+`GET /api/v1/fleet/vpp`
+
+#### Example
+
+`GET /api/v1/fleet/vpp`
 
 ##### Default response
 
@@ -6395,11 +6460,9 @@ None.
 
 ```json
 {
-  "apple_id": "apple@example.com",
-  "org_name": "Fleet Device Management",
-  "mdm_server_url": "https://example.com/mdm/apple/mdm",
+  "org_name": "Acme Inc.",
   "renew_date": "2023-11-29T00:00:00Z",
-  "default_team": ""
+  "location": "Acme Inc. Main Address"
 }
 ```
 
@@ -6623,7 +6686,7 @@ For example, a policy might ask “Is Gatekeeper enabled on macOS devices?“ Th
 
 | Name     | Type    | In   | Description                                       |
 | -------- | ------- | ---- | ------------------------------------------------- |
-| ids      | list    | body | **Required.** The IDs of the policies to delete.  |
+| ids      | array   | body | **Required.** The IDs of the policies to delete.  |
 
 #### Example
 
@@ -6717,8 +6780,8 @@ Triggers [automations](https://fleetdm.com/docs/using-fleet/automations#policy-a
 
 | Name        | Type     | In   | Description                                              |
 | ----------  | -------- | ---- | -------------------------------------------------------- |
-| policy_ids  | list     | body | Filters to only run policy automations for the specified policies. |
-| team_ids    | list     | body | _Available in Fleet Premium_. Filters to only run policy automations for hosts in the specified teams. |
+| policy_ids  | array    | body | Filters to only run policy automations for the specified policies. |
+| team_ids    | array    | body | _Available in Fleet Premium_. Filters to only run policy automations for hosts in the specified teams. |
 
 
 #### Example
@@ -6820,6 +6883,29 @@ Team policies work the same as policies, but at the team level.
       "failing_host_count": 0,
       "host_count_updated_at": "2023-12-20T15:23:57Z",
       "calendar_events_enabled": false
+    },
+    {
+      "id": 3,
+      "name": "macOS - install/update Adobe Acrobat",
+      "query": "SELECT 1 FROM apps WHERE name = \"Adobe Acrobat.app\" AND bundle_short_version != \"24.002.21005\";",
+      "description": "Checks if the hard disk is encrypted on Windows devices",
+      "critical": false,
+      "author_id": 43,
+      "author_name": "Alice",
+      "author_email": "alice@example.com",
+      "team_id": 1,
+      "resolution": "Resolution steps",
+      "platform": "darwin",
+      "created_at": "2021-12-16T14:37:37Z",
+      "updated_at": "2021-12-16T16:39:00Z",
+      "passing_host_count": 2300,
+      "failing_host_count": 3,
+      "host_count_updated_at": "2023-12-20T15:23:57Z",
+      "calendar_events_enabled": false,
+      "install_software": {
+        "name": "Adobe Acrobat.app",
+        "software_title_id": 1234
+      }
     }
   ],
   "inherited_policies": [
@@ -7001,6 +7087,7 @@ The semantics for creating a team policy are the same as for global policies, se
 | resolution  | string  | body | The resolution steps for the policy. |
 | platform    | string  | body | Comma-separated target platforms, currently supported values are "windows", "linux", "darwin". The default, an empty string means target all platforms. |
 | critical    | boolean | body | _Available in Fleet Premium_. Mark policy as critical/high impact. |
+| software_title_id  | integer | body | _Available in Fleet Premium_. ID of software title to install if the policy fails. |
 
 Either `query` or `query_id` must be provided.
 
@@ -7044,7 +7131,11 @@ Either `query` or `query_id` must be provided.
     "passing_host_count": 0,
     "failing_host_count": 0,
     "host_count_updated_at": null,
-    "calendar_events_enabled": false
+    "calendar_events_enabled": false,
+    "install_software": {
+      "name": "Adobe Acrobat.app",
+      "software_title_id": 1234
+    }
   }
 }
 ```
@@ -7058,7 +7149,7 @@ Either `query` or `query_id` must be provided.
 | Name     | Type    | In   | Description                                       |
 | -------- | ------- | ---- | ------------------------------------------------- |
 | team_id  | integer | path  | **Required.** Defines what team ID to operate on                |
-| ids      | list    | body | **Required.** The IDs of the policies to delete.  |
+| ids      | array   | body | **Required.** The IDs of the policies to delete.  |
 
 #### Example
 
@@ -7099,6 +7190,7 @@ Either `query` or `query_id` must be provided.
 | platform    | string  | body | Comma-separated target platforms, currently supported values are "windows", "linux", "darwin". The default, an empty string means target all platforms. |
 | critical    | boolean | body | _Available in Fleet Premium_. Mark policy as critical/high impact. |
 | calendar_events_enabled    | boolean | body | _Available in Fleet Premium_. Whether to trigger calendar events when policy is failing. |
+| software_title_id  | integer | body | _Available in Fleet Premium_. ID of software title to install if the policy fails. |
 
 #### Example
 
@@ -7140,7 +7232,11 @@ Either `query` or `query_id` must be provided.
     "passing_host_count": 0,
     "failing_host_count": 0,
     "host_count_updated_at": null,
-    "calendar_events_enabled": true
+    "calendar_events_enabled": true,
+    "install_software": {
+      "name": "Adobe Acrobat.app",
+      "software_title_id": 1234
+    }
   }
 }
 ```
@@ -7495,14 +7591,14 @@ Creates a global query or team query.
 | name                            | string  | body | **Required**. The name of the query.                                                                                                                   |
 | query                           | string  | body | **Required**. The query in SQL syntax.                                                                                                                 |
 | description                     | string  | body | The query's description.                                                                                                                               |
-| observer_can_run                | bool    | body | Whether or not users with the `observer` role can run the query. In Fleet 4.0.0, 3 user roles were introduced (`admin`, `maintainer`, and `observer`). This field is only relevant for the `observer` role. The `observer_plus` role can run any query and is not limited by this flag (`observer_plus` role was added in Fleet 4.30.0). |
+| observer_can_run                | boolean | body | Whether or not users with the `observer` role can run the query. In Fleet 4.0.0, 3 user roles were introduced (`admin`, `maintainer`, and `observer`). This field is only relevant for the `observer` role. The `observer_plus` role can run any query and is not limited by this flag (`observer_plus` role was added in Fleet 4.30.0). |
 | team_id                         | integer | body | _Available in Fleet Premium_. The parent team to which the new query should be added. If omitted, the query will be global.                                           |
-| interval                       | integer | body | The amount of time, in seconds, the query waits before running. Can be set to `0` to never run. Default: 0.       |
+| interval                        | integer | body | The amount of time, in seconds, the query waits before running. Can be set to `0` to never run. Default: 0.       |
 | platform                        | string  | body | The OS platforms where this query will run (other platforms ignored). Comma-separated string. If omitted, runs on all compatible platforms.                        |
 | min_osquery_version             | string  | body | The minimum required osqueryd version installed on a host. If omitted, all osqueryd versions are acceptable.                                                                          |
 | automations_enabled             | boolean | body | Whether to send data to the configured log destination according to the query's `interval`. |
-| logging             | string  | body | The type of log output for this query. Valid values: `"snapshot"`(default), `"differential"`, or `"differential_ignore_removals"`.                        |
-| discard_data        | bool    | body | Whether to skip saving the latest query results for each host. Default: `false`. |
+| logging                         | string  | body | The type of log output for this query. Valid values: `"snapshot"`(default), `"differential"`, or `"differential_ignore_removals"`.                        |
+| discard_data                    | boolean | body | Whether to skip saving the latest query results for each host. Default: `false`. |
 
 
 #### Example
@@ -7569,13 +7665,13 @@ Modifies the query specified by ID.
 | name                        | string  | body | The name of the query.                                                                                                                                 |
 | query                       | string  | body | The query in SQL syntax.                                                                                                                               |
 | description                 | string  | body | The query's description.                                                                                                                               |
-| observer_can_run            | bool    | body | Whether or not users with the `observer` role can run the query. In Fleet 4.0.0, 3 user roles were introduced (`admin`, `maintainer`, and `observer`). This field is only relevant for the `observer` role. The `observer_plus` role can run any query and is not limited by this flag (`observer_plus` role was added in Fleet 4.30.0). |
+| observer_can_run            | boolean | body | Whether or not users with the `observer` role can run the query. In Fleet 4.0.0, 3 user roles were introduced (`admin`, `maintainer`, and `observer`). This field is only relevant for the `observer` role. The `observer_plus` role can run any query and is not limited by this flag (`observer_plus` role was added in Fleet 4.30.0). |
 | interval                   | integer | body | The amount of time, in seconds, the query waits before running. Can be set to `0` to never run. Default: 0.       |
 | platform                    | string  | body | The OS platforms where this query will run (other platforms ignored). Comma-separated string. If set to "", runs on all compatible platforms.                    |
 | min_osquery_version             | string  | body | The minimum required osqueryd version installed on a host. If omitted, all osqueryd versions are acceptable.                                                                          |
 | automations_enabled             | boolean | body | Whether to send data to the configured log destination according to the query's `interval`. |
 | logging             | string  | body | The type of log output for this query. Valid values: `"snapshot"`(default), `"differential"`, or `"differential_ignore_removals"`.                        |
-| discard_data        | bool    | body | Whether to skip saving the latest query results for each host. |
+| discard_data        | boolean  | body | Whether to skip saving the latest query results for each host. |
 
 > Note that any of the following conditions will cause the existing query report to be deleted:
 > - Updating the `query` (SQL) field
@@ -7679,9 +7775,9 @@ Deletes the queries specified by ID. Returns the count of queries successfully d
 
 #### Parameters
 
-| Name | Type | In   | Description                           |
-| ---- | ---- | ---- | ------------------------------------- |
-| ids  | list | body | **Required.** The IDs of the queries. |
+| Name | Type  | In   | Description                           |
+| ---- | ----- | ---- | ------------------------------------- |
+| ids  | array | body | **Required.** The IDs of the queries. |
 
 #### Example
 
@@ -8308,12 +8404,15 @@ Gets the result of a script that was executed.
   "host_timeout": false,
   "host_id": 1,
   "execution_id": "e797d6c6-3aae-11ee-be56-0242ac120002",
-  "runtime": 20
+  "runtime": 20,
+  "created_at": "2024-09-11T20:30:24Z"
 }
 ```
 
 > Note: `exit_code` can be `null` if Fleet hasn't heard back from the host yet.
 
+> Note: `created_at` is the creation timestamp of the script execution request.
+
 ### Add script
 
 Uploads a script, making it available to run on hosts assigned to the specified team (or no team).
@@ -8538,176 +8637,29 @@ Deletes the session specified by ID. When the user associated with the session n
 
 ## Software
 
-- [Add software](#add-software)
-- [Download software](#download-software)
-- [Delete software](#delete-software)
-- [Get installation result](#get-installation-result)
 - [List software](#list-software)
 - [List software versions](#list-software-versions)
+- [List operating systems](#list-operating-systems)
 - [Get software](#get-software)
 - [Get software version](#get-software-version)
-
-### Add software
-
-_Available in Fleet Premium._
-
-Add a software package to install on macOS, Windows, and Linux (Ubuntu) hosts.
-
-
-`POST /api/v1/fleet/software/package`
-
-#### Parameters
-
-| Name            | Type    | In   | Description                                      |
-| ----            | ------- | ---- | --------------------------------------------     |
-| software        | file    | form | **Required**. Installer package file. Supported packages are PKG, MSI, EXE, and DEB.   |
-| team_id         | integer | form | **Required**. The team ID. Adds a software package to the specified team. |
-| install_script  | string | form | Command that Fleet runs to install software. If not specified Fleet runs [default install command](https://github.com/fleetdm/fleet/tree/f71a1f183cc6736205510580c8366153ea083a8d/pkg/file/scripts) for each package type. |
-| pre_install_query  | string | form | Query that is pre-install condition. If the query doesn't return any result, Fleet won't proceed to install. |
-| post_install_script | string | form | The contents of the script to run after install. If the specified script fails (exit code non-zero) software install will be marked as failed and rolled back. |
-| self_service | boolean | form | Self-service software is optional and can be installed by the end user. |
-
-#### Example
-
-`POST /api/v1/fleet/software/package`
-
-##### Request header
-
-```http
-Content-Length: 8500
-Content-Type: multipart/form-data; boundary=------------------------d8c247122f594ba0
-```
-
-##### Request body
-
-```http
---------------------------d8c247122f594ba0
-Content-Disposition: form-data; name="team_id"
-1
---------------------------d8c247122f594ba0
-Content-Disposition: form-data; name="self_service"
-true
---------------------------d8c247122f594ba0
-Content-Disposition: form-data; name="install_script"
-sudo installer -pkg /temp/FalconSensor-6.44.pkg -target /
---------------------------d8c247122f594ba0
-Content-Disposition: form-data; name="pre_install_query"
-SELECT 1 FROM macos_profiles WHERE uuid='c9f4f0d5-8426-4eb8-b61b-27c543c9d3db';
---------------------------d8c247122f594ba0
-Content-Disposition: form-data; name="post_install_script"
-sudo /Applications/Falcon.app/Contents/Resources/falconctl license 0123456789ABCDEFGHIJKLMNOPQRSTUV-WX
---------------------------d8c247122f594ba0
-Content-Disposition: form-data; name="software"; filename="FalconSensor-6.44.pkg"
-Content-Type: application/octet-stream
-<BINARY_DATA>
---------------------------d8c247122f594ba0
-```
-
-##### Default response
-
-`Status: 200`
-
-
-### Download software
-
-_Available in Fleet Premium._
-
-Download a software package.
-
-`GET /api/v1/fleet/software/titles/:software_title_id/package/?alt=media`
-
-#### Parameters
-
-| Name            | Type    | In   | Description                                      |
-| ----            | ------- | ---- | --------------------------------------------     |
-| software_title_id   | integer | path | **Required**. The ID of the software title to download software package.|
-| team_id | integer | query | **Required**. The team ID. Downloads a software package added to the specified team. |
-| alt             | integer | query | **Required**. If specified and set to "media", downloads the specified software package. |
-
-#### Example
-
-`GET /api/v1/fleet/software/titles/123/package?alt=media?team_id=2`
-
-##### Default response
-
-`Status: 200`
-
-```http
-Status: 200
-Content-Type: application/octet-stream
-Content-Disposition: attachment
-Content-Length: <length>
-Body: <blob>
-```
-
-### Delete software
-
-> This **endpoint, added in the app management feature, is experimental** may change. You can find the upcoming breaking changes [here](https://github.com/fleetdm/fleet/pull/19291/files#diff-7246bc304b15c8865ed8eaa205e9c244d0a0314e4bae60cf553dc06147c38b64L8661-R8698).
-
-_Available in Fleet Premium._
-
-Delete a software package.
-
-`DELETE /api/v1/fleet/software/titles/:software_title_id/package`
-
-#### Parameters
-
-| Name            | Type    | In   | Description                                      |
-| ----            | ------- | ---- | --------------------------------------------     |
-| software_title_id  | integer | path | **Required**. The ID of the software title for the software package to delete. |
-| team_id | integer | query | **Required**. The team ID. Deletes a software package added to the specified team. |
-
-#### Example
-
-`DELETE /api/v1/fleet/software/titles/24/package?team_id=2`
-
-##### Default response
-
-`Status: 204`
-
-### Get installation results
-
-_Available in Fleet Premium._
-
-`GET /api/v1/fleet/software/install/results/:install_uuid`
-
-Get the results of a software installation.
-
-| Name            | Type    | In   | Description                                      |
-| ----            | ------- | ---- | --------------------------------------------     |
-| install_uuid | string | path | **Required**. The software installation UUID.|
-
-#### Example
-
-`GET /api/v1/fleet/software/install/results/b15ce221-e22e-4c6a-afe7-5b3400a017da`
-
-##### Default response
-
-`Status: 200`
-
-```json
- {
-   "install_uuid": "b15ce221-e22e-4c6a-afe7-5b3400a017da",
-   "software_title": "Falcon.app",
-   "software_title_id": 8353,
-   "software_package": "FalconSensor-6.44.pkg",
-   "host_id": 123,
-   "host_display_name": "Marko's MacBook Pro",
-   "status": "failed",
-   "output": "Installing software...\nError: The operation can’t be completed because the item “Falcon” is in use.",
-   "pre_install_query_output": "Query returned result\nSuccess",
-   "post_install_script_output": "Running script...\nExit code: 1 (Failed)\nRolling back software install...\nSuccess"
- }
-```
+- [Get operating system version](#get-operating-system-version)
+- [Add package](#add-package)
+- [List App Store apps](#list-app-store-apps)
+- [Add App Store app](#add-app-store-app)
+- [Add Fleet library app](#add-fleet-library-app)
+- [Install package or App Store app](#install-package-or-app-store-app)
+- [Get package install result](#get-package-install-result)
+- [Download package](#download-package)
+- [Delete package or App Store app](#delete-package-or-app-store-app)
 
 ### List software
 
-> The **new keys/values added in the app management feature are experimental** and may change. You can find the upcoming breaking changes [here](https://github.com/fleetdm/fleet/pull/19291/files#diff-7246bc304b15c8865ed8eaa205e9c244d0a0314e4bae60cf553dc06147c38b64L8749-R8791).
-
 Get a list of all software.
 
 `GET /api/v1/fleet/software/titles`
 
+> **Experimental feature**. This feature is undergoing rapid improvement, which may result in breaking changes to the API or configuration surface. It is not recommended for use in automated workflows.
+
 #### Parameters
 
 | Name                    | Type    | In    | Description                                                                                                                                                                |
@@ -8717,10 +8669,13 @@ Get a list of all software.
 | order_key               | string  | query | What to order results by. Allowed fields are `name` and `hosts_count`. Default is `hosts_count` (descending).                                                              |
 | order_direction         | string  | query | **Requires `order_key`**. The direction of the order given the order key. Options include `asc` and `desc`. Default is `asc`.                                              |
 | query                   | string  | query | Search query keywords. Searchable fields include `title` and `cve`.                                                                                                        |
-| team_id                 | integer | query | _Available in Fleet Premium_. Filters the software to only include the software installed on the hosts that are assigned to the specified team.                            |
-| vulnerable              | bool    | query | If true or 1, only list software that has detected vulnerabilities. Default is `false`.                                                                                    |
-| available_for_install   | bool    | query | If `true` or `1`, only list software that is available for install (added by the user). Default is `false`.                                                                |
-| self_service    | bool    | query | If `true` or `1`, only lists self-service software. Default is `false`.  |
+| team_id                 | integer | query | _Available in Fleet Premium_. Filters the software to only include the software installed on the hosts that are assigned to the specified team. Use `0` to filter by hosts assigned to "No team".                            |
+| vulnerable              | boolean | query | If true or 1, only list software that has detected vulnerabilities. Default is `false`.                                                                                    |
+| available_for_install   | boolean | query | If `true` or `1`, only list software that is available for install (added by the user). Default is `false`.                                                                |
+| self_service            | boolean | query | If `true` or `1`, only lists self-service software. Default is `false`.  |
+| min_cvss_score | integer | query | _Available in Fleet Premium_. Filters to include only software with vulnerabilities that have a CVSS version 3.x base score higher than the specified value.   |
+| max_cvss_score | integer | query | _Available in Fleet Premium_. Filters to only include software with vulnerabilities that have a CVSS version 3.x base score lower than what's specified.   |
+| exploit | boolean | query | _Available in Fleet Premium_. If `true`, filters to only include software with vulnerabilities that have been actively exploited in the wild (`cisa_known_exploit: true`). Default is `false`.  |
 
 #### Example
 
@@ -8738,8 +8693,12 @@ Get a list of all software.
     {
       "id": 12,
       "name": "Firefox.app",
-      "software_package": "FirefoxInstall.pkg",
-      "self_service": true,
+      "software_package": {
+        "name": "FirefoxInsall.pkg",
+        "version": "125.6",
+        "self_service": true
+      },
+      "app_store_app": null,
       "versions_count": 3,
       "source": "apps",
       "browser": "",
@@ -8766,7 +8725,7 @@ Get a list of all software.
       "id": 22,
       "name": "Google Chrome.app",
       "software_package": null,
-      "self_service": false,
+      "app_store_app": null,
       "versions_count": 5,
       "source": "apps",
       "browser": "",
@@ -8798,7 +8757,7 @@ Get a list of all software.
       "id": 32,
       "name": "1Password – Password Manager",
       "software_package": null,
-      "self_service": false,
+      "app_store_app": null,
       "versions_count": 1,
       "source": "chrome_extensions",
       "browser": "chrome",
@@ -8834,8 +8793,11 @@ Get a list of all software versions.
 | order_key               | string  | query | What to order results by. Allowed fields are `name`, `hosts_count`, `cve_published`, `cvss_score`, `epss_probability` and `cisa_known_exploit`. Default is `hosts_count` (descending).      |
 | order_direction         | string  | query | **Requires `order_key`**. The direction of the order given the order key. Options include `asc` and `desc`. Default is `asc`.                                              |
 | query                   | string  | query | Search query keywords. Searchable fields include `name`, `version`, and `cve`.                                                                                             |
-| team_id                 | integer | query | _Available in Fleet Premium_. Filters the software to only include the software installed on the hosts that are assigned to the specified team.                             |
-| vulnerable              | bool    | query | If true or 1, only list software that has detected vulnerabilities. Default is `false`.                                                                                    |
+| team_id                 | integer | query | _Available in Fleet Premium_. Filters the software to only include the software installed on the hosts that are assigned to the specified team. Use `0` to filter by hosts assigned to "No team".                             |
+| vulnerable              | boolean    | query | If true or 1, only list software that has detected vulnerabilities. Default is `false`.                                                                                    |
+| min_cvss_score | integer | query | _Available in Fleet Premium_. Filters to include only software with vulnerabilities that have a CVSS version 3.x base score higher than the specified value.   |
+| max_cvss_score | integer | query | _Available in Fleet Premium_. Filters to only include software with vulnerabilities that have a CVSS version 3.x base score lower than what's specified.   |
+| exploit | boolean | query | _Available in Fleet Premium_. If `true`, filters to only include software with vulnerabilities that have been actively exploited in the wild (`cisa_known_exploit: true`). Default is `false`.  |
 
 #### Example
 
@@ -8893,8 +8855,82 @@ Get a list of all software versions.
 }
 ```
 
+### List operating systems
+
+Returns a list of all operating systems.
+
+`GET /api/v1/fleet/os_versions`
+
+#### Parameters
+
+| Name                | Type     | In    | Description                                                                                                                          |
+| ---      | ---      | ---   | ---                                                                                                                                  |
+| team_id             | integer | query | _Available in Fleet Premium_. Filters response data to the specified team. Use `0` to filter by hosts assigned to "No team".  |
+| platform            | string   | query | Filters the hosts to the specified platform |
+| os_name     | string | query | The name of the operating system to filter hosts by. `os_version` must also be specified with `os_name`                                                 |
+| os_version    | string | query | The version of the operating system to filter hosts by. `os_name` must also be specified with `os_version`                                                 |
+| page                    | integer | query | Page number of the results to fetch.                                                                                                                                       |
+| per_page                | integer | query | Results per page.                                                                                                                                                          |
+| order_key               | string  | query | What to order results by. Allowed fields are: `hosts_count`. Default is `hosts_count` (descending).      |
+| order_direction | string | query | **Requires `order_key`**. The direction of the order given the order key. Options include `asc` and `desc`. Default is `asc`. |
+
+
+##### Default response
+
+`Status: 200`
+
+```json
+{
+  "count": 1
+  "counts_updated_at": "2023-12-06T22:17:30Z",
+  "os_versions": [
+    {
+      "os_version_id": 123,
+      "hosts_count": 21,
+      "name": "Microsoft Windows 11 Pro 23H2 10.0.22621.1234",
+      "name_only": "Microsoft Windows 11 Pro 23H2",
+      "version": "10.0.22621.1234",
+      "platform": "windows",
+      "generated_cpes": [],
+      "vulnerabilities": [
+        {
+          "cve": "CVE-2022-30190",
+          "details_link": "https://nvd.nist.gov/vuln/detail/CVE-2022-30190",
+          "cvss_score": 7.8,// Available in Fleet Premium
+          "epss_probability": 0.9729,// Available in Fleet Premium
+          "cisa_known_exploit": false,// Available in Fleet Premium
+          "cve_published": "2022-06-01T00:15:00Z",// Available in Fleet Premium
+          "cve_description": "Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability.",// Available in Fleet Premium
+          "resolved_in_version": ""// Available in Fleet Premium
+        }
+      ]
+    }
+  ],
+  "meta": {
+    "has_next_results": false,
+    "has_previous_results": false
+  }
+}
+```
+
+OS vulnerability data is currently available for Windows and macOS. For other platforms, `vulnerabilities` will be an empty array:
+
+```json
+{
+  "hosts_count": 1,
+  "name": "CentOS Linux 7.9.2009",
+  "name_only": "CentOS",
+  "version": "7.9.2009",
+  "platform": "rhel",
+  "generated_cpes": [],
+  "vulnerabilities": []
+}
+```
+
 ### Get software
 
+> **Experimental feature**. This feature is undergoing rapid improvement, which may result in breaking changes to the API or configuration surface. It is not recommended for use in automated workflows.
+
 Returns information about the specified software. By default, `versions` are sorted in descending order by the `hosts_count` field.
 
 `GET /api/v1/fleet/software/titles/:id`
@@ -8904,7 +8940,7 @@ Returns information about the specified software. By default, `versions` are sor
 | Name | Type | In | Description |
 | ---- | ---- | -- | ----------- |
 | id   | integer | path | **Required.** The software title's ID. |
-| team_id             | integer | query | _Available in Fleet Premium_. Filters response data to the specified team.  |
+| team_id             | integer | query | _Available in Fleet Premium_. Filters response data to the specified team. Use `0` to filter by hosts assigned to "No team".  |
 
 #### Example
 
@@ -8919,22 +8955,27 @@ Returns information about the specified software. By default, `versions` are sor
   "software_title": {
     "id": 12,
     "name": "Firefox.app",
+    "bundle_identifier": "org.mozilla.firefox",
     "software_package": {
       "name": "FalconSensor-6.44.pkg",
       "version": "6.44",
       "installer_id": 23,
       "team_id": 3,
       "uploaded_at": "2024-04-01T14:22:58Z",
-      "install_script": "sudo installer -pkg /temp/FalconSensor-6.44.pkg -target /",
+      "install_script": "sudo installer -pkg '$INSTALLER_PATH' -target /",
       "pre_install_query": "SELECT 1 FROM macos_profiles WHERE uuid='c9f4f0d5-8426-4eb8-b61b-27c543c9d3db';",
       "post_install_script": "sudo /Applications/Falcon.app/Contents/Resources/falconctl license 0123456789ABCDEFGHIJKLMNOPQRSTUV-WX",
+      "uninstall_script": "/Library/CS/falconctl uninstall",
       "self_service": true,
       "status": {
         "installed": 3,
-        "pending": 1,
-        "failed": 2,
+        "pending_install": 1,
+        "failed_install": 0,
+        "pending_uninstall": 2,
+        "failed_uninstall": 1
       }
     },
+    "app_store_app": null,
     "source": "apps",
     "browser": "",
     "hosts_count": 48,
@@ -8962,6 +9003,47 @@ Returns information about the specified software. By default, `versions` are sor
 }
 ```
 
+#### Example (App Store app)
+
+`GET /api/v1/fleet/software/titles/15`
+
+##### Default response
+
+`Status: 200`
+
+```json
+{
+  "software_title": {
+    "id": 15,
+    "name": "Logic Pro",
+    "bundle_identifier": "com.apple.logic10",
+    "software_package": null,
+    "app_store_app": {
+      "name": "Logic Pro",
+      "app_store_id": "1091189122",
+      "latest_version": "2.04",
+      "icon_url": "https://is1-ssl.mzstatic.com/image/thumb/Purple211/v4/f1/65/1e/a4844ccd-486d-455f-bb31-67336fe46b14/AppIcon-1x_U007emarketing-0-7-0-85-220-0.png/512x512bb.jpg",
+      "status": {
+        "installed": 3,
+        "pending": 1,
+        "failed": 2,
+      }
+    },
+    "source": "apps",
+    "browser": "",
+    "hosts_count": 48,
+    "versions": [
+      {
+        "id": 123,
+        "version": "2.04",
+        "vulnerabilities": [],
+        "hosts_count": 24
+      }
+    ]
+  }
+}
+```
+
 ### Get software version
 
 Returns information about the specified software version.
@@ -8973,7 +9055,7 @@ Returns information about the specified software version.
 | Name | Type | In | Description |
 | ---- | ---- | -- | ----------- |
 | id   | integer | path | **Required.** The software version's ID. |
-| team_id             | integer | query | _Available in Fleet Premium_. Filters response data to the specified team.  |
+| team_id             | integer | query | _Available in Fleet Premium_. Filters response data to the specified team. Use `0` to filter by hosts assigned to "No team".  |
 
 #### Example
 
@@ -9019,8 +9101,441 @@ Returns information about the specified software version.
 }
 ```
 
-## Vulnerabilities
+### Get operating system version
 
+Retrieves information about the specified operating system (OS) version.
+
+`GET /api/v1/fleet/os_versions/:id`
+
+#### Parameters
+
+| Name | Type | In | Description |
+| ---- | ---- | -- | ----------- |
+| id   | integer | path | **Required.** The OS version's ID. |
+| team_id             | integer | query | _Available in Fleet Premium_. Filters response data to the specified team. Use `0` to filter by hosts assigned to "No team".  |
+
+##### Default response
+
+`Status: 200`
+
+```json
+{
+  "counts_updated_at": "2023-12-06T22:17:30Z",
+  "os_version": {
+    "id": 123,
+    "hosts_count": 21,
+    "name": "Microsoft Windows 11 Pro 23H2 10.0.22621.1234",
+    "name_only": "Microsoft Windows 11 Pro 23H2",
+    "version": "10.0.22621.1234",
+    "platform": "windows",
+    "generated_cpes": [],
+    "vulnerabilities": [
+      {
+        "cve": "CVE-2022-30190",
+        "details_link": "https://nvd.nist.gov/vuln/detail/CVE-2022-30190",
+        "created_at": "2024-07-01T00:15:00Z",
+        "cvss_score": 7.8,// Available in Fleet Premium
+        "epss_probability": 0.9729,// Available in Fleet Premium
+        "cisa_known_exploit": false,// Available in Fleet Premium
+        "cve_published": "2022-06-01T00:15:00Z",// Available in Fleet Premium
+        "cve_description": "Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability.",// Available in Fleet Premium
+        "resolved_in_version": ""// Available in Fleet Premium
+      }
+    ]
+  }
+}
+```
+
+OS vulnerability data is currently available for Windows and macOS. For other platforms, `vulnerabilities` will be an empty array:
+
+```json
+{
+  "id": 321,
+  "hosts_count": 1,
+  "name": "CentOS Linux 7.9.2009",
+  "name_only": "CentOS",
+  "version": "7.9.2009",
+  "platform": "rhel",
+  "generated_cpes": [],
+  "vulnerabilities": []
+}
+```
+
+### Add package
+
+> **Experimental feature**. This feature is undergoing rapid improvement, which may result in breaking changes to the API or configuration surface. It is not recommended for use in automated workflows.
+
+_Available in Fleet Premium._
+
+Add a package (.pkg, .msi, .exe, .deb) to install on macOS, Windows, or Linux (Ubuntu) hosts.
+
+
+`POST /api/v1/fleet/software/package`
+
+#### Parameters
+
+| Name            | Type    | In   | Description                                      |
+| ----            | ------- | ---- | --------------------------------------------     |
+| software        | file    | form | **Required**. Installer package file. Supported packages are PKG, MSI, EXE, and DEB.   |
+| team_id         | integer | form | **Required**. The team ID. Adds a software package to the specified team. |
+| install_script  | string | form | Script that Fleet runs to install software. If not specified Fleet runs [default install script](https://github.com/fleetdm/fleet/tree/f71a1f183cc6736205510580c8366153ea083a8d/pkg/file/scripts) for each package type. |
+| pre_install_query  | string | form | Query that is pre-install condition. If the query doesn't return any result, Fleet won't proceed to install. |
+| post_install_script | string | form | The contents of the script to run after install. If the specified script fails (exit code non-zero) software install will be marked as failed and rolled back. |
+| self_service | boolean | form | Self-service software is optional and can be installed by the end user. |
+
+#### Example
+
+`POST /api/v1/fleet/software/package`
+
+##### Request header
+
+```http
+Content-Length: 8500
+Content-Type: multipart/form-data; boundary=------------------------d8c247122f594ba0
+```
+
+##### Request body
+
+```http
+--------------------------d8c247122f594ba0
+Content-Disposition: form-data; name="team_id"
+1
+--------------------------d8c247122f594ba0
+Content-Disposition: form-data; name="self_service"
+true
+--------------------------d8c247122f594ba0
+Content-Disposition: form-data; name="install_script"
+sudo installer -pkg /temp/FalconSensor-6.44.pkg -target /
+--------------------------d8c247122f594ba0
+Content-Disposition: form-data; name="pre_install_query"
+SELECT 1 FROM macos_profiles WHERE uuid='c9f4f0d5-8426-4eb8-b61b-27c543c9d3db';
+--------------------------d8c247122f594ba0
+Content-Disposition: form-data; name="post_install_script"
+sudo /Applications/Falcon.app/Contents/Resources/falconctl license 0123456789ABCDEFGHIJKLMNOPQRSTUV-WX
+--------------------------d8c247122f594ba0
+Content-Disposition: form-data; name="software"; filename="FalconSensor-6.44.pkg"
+Content-Type: application/octet-stream
+<BINARY_DATA>
+--------------------------d8c247122f594ba0
+```
+
+##### Default response
+
+`Status: 200`
+
+### Modify package
+
+_Available in Fleet Premium._
+
+Update a package to install on macOS, Windows, or Linux (Ubuntu) hosts.
+
+`PATCH /api/v1/fleet/software/titles/:title_id/package`
+
+#### Parameters
+
+| Name            | Type    | In   | Description                                      |
+| ----            | ------- | ---- | --------------------------------------------     |
+| software        | file    | form | Installer package file. Supported packages are PKG, MSI, EXE, and DEB.   |
+| team_id         | integer | form | **Required**. The team ID. Updates a software package in the specified team. |
+| install_script  | string | form | Command that Fleet runs to install software. If not specified Fleet runs the [default install command](https://github.com/fleetdm/fleet/tree/f71a1f183cc6736205510580c8366153ea083a8d/pkg/file/scripts) for each package type. |
+| pre_install_query  | string | form | Query that is pre-install condition. If the query doesn't return any result, the package will not be installed. |
+| post_install_script | string | form | The contents of the script to run after install. If the specified script fails (exit code non-zero) software install will be marked as failed and rolled back. |
+| self_service | boolean | form | Whether this is optional self-service software that can be installed by the end user. |
+
+> Changes to the installer package will reset installation counts. Changes to any field other than `self_service` will cancel pending installs for the old package.
+#### Example
+
+`PATCH /api/v1/fleet/software/titles/1/package`
+
+##### Request header
+
+```http
+Content-Length: 8500
+Content-Type: multipart/form-data; boundary=------------------------d8c247122f594ba0
+```
+
+##### Request body
+
+```http
+--------------------------d8c247122f594ba0
+Content-Disposition: form-data; name="team_id"
+1
+--------------------------d8c247122f594ba0
+Content-Disposition: form-data; name="self_service"
+true
+--------------------------d8c247122f594ba0
+Content-Disposition: form-data; name="install_script"
+sudo installer -pkg /temp/FalconSensor-6.44.pkg -target /
+--------------------------d8c247122f594ba0
+Content-Disposition: form-data; name="pre_install_query"
+SELECT 1 FROM macos_profiles WHERE uuid='c9f4f0d5-8426-4eb8-b61b-27c543c9d3db';
+--------------------------d8c247122f594ba0
+Content-Disposition: form-data; name="post_install_script"
+sudo /Applications/Falcon.app/Contents/Resources/falconctl license 0123456789ABCDEFGHIJKLMNOPQRSTUV-WX
+--------------------------d8c247122f594ba0
+Content-Disposition: form-data; name="software"; filename="FalconSensor-6.44.pkg"
+Content-Type: application/octet-stream
+<BINARY_DATA>
+--------------------------d8c247122f594ba0
+```
+
+##### Default response
+
+`Status: 200`
+
+```json
+{
+  "software_package": {
+    "name": "FalconSensor-6.44.pkg",
+    "version": "6.44",
+    "installer_id": 23,
+    "team_id": 3,
+    "uploaded_at": "2024-04-01T14:22:58Z",
+    "install_script": "sudo installer -pkg /temp/FalconSensor-6.44.pkg -target /",
+    "pre_install_query": "SELECT 1 FROM macos_profiles WHERE uuid='c9f4f0d5-8426-4eb8-b61b-27c543c9d3db';",
+    "post_install_script": "sudo /Applications/Falcon.app/Contents/Resources/falconctl license 0123456789ABCDEFGHIJKLMNOPQRSTUV-WX",
+    "self_service": true,
+    "status": {
+      "installed": 0,
+      "pending": 0,
+      "failed": 0
+    }
+  }
+}
+```
+
+### List App Store apps
+
+> **Experimental feature**. This feature is undergoing rapid improvement, which may result in breaking changes to the API or configuration surface. It is not recommended for use in automated workflows.
+
+Returns the list of Apple App Store (VPP) that can be added to the specified team. If an app is already added to the team, it's excluded from the list.
+
+`GET /api/v1/fleet/software/app_store_apps`
+
+#### Parameters
+
+| Name    | Type | In | Description |
+| ------- | ---- | -- | ----------- |
+| team_id | integer | query | **Required**. The team ID. |
+
+#### Example
+
+`GET /api/v1/fleet/software/app_store_apps/?team_id=3`
+
+##### Default response
+
+`Status: 200`
+
+```json
+{
+  "app_store_apps": [
+    {
+      "name": "Xcode",
+      "icon_url": "https://is1-ssl.mzstatic.com/image/thumb/Purple211/v4/f1/65/1e/a4844ccd-486d-455f-bb31-67336fe46b14/AppIcon-1x_U007emarketing-0-7-0-85-220-0.png/512x512bb.jpg",
+      "latest_version": "15.4",
+      "app_store_id": "497799835",
+      "platform": "darwin"
+    },
+    {
+      "name": "Logic Pro",
+      "icon_url": "https://is1-ssl.mzstatic.com/image/thumb/Purple211/v4/f1/65/1e/a4844ccd-486d-455f-bb31-67336fe46b14/AppIcon-1x_U007emarketing-0-7-0-85-220-0.png/512x512bb.jpg",
+      "latest_version": "2.04",
+      "app_store_id": "634148309",
+      "platform": "ios"
+    },
+    {
+      "name": "Logic Pro",
+      "icon_url": "https://is1-ssl.mzstatic.com/image/thumb/Purple211/v4/f1/65/1e/a4844ccd-486d-455f-bb31-67336fe46b14/AppIcon-1x_U007emarketing-0-7-0-85-220-0.png/512x512bb.jpg",
+      "latest_version": "2.04",
+      "app_store_id": "634148309",
+      "platform": "ipados"
+    },
+  ]
+}
+```
+
+### Add App Store app
+
+> **Experimental feature**. This feature is undergoing rapid improvement, which may result in breaking changes to the API or configuration surface. It is not recommended for use in automated workflows.
+
+_Available in Fleet Premium._
+
+Add App Store (VPP) app purchased in Apple Business Manager.
+
+`POST /api/v1/fleet/software/app_store_apps`
+
+#### Parameters
+
+| Name | Type | In | Description |
+| ---- | ---- | -- | ----------- |
+| app_store_id   | string | body | **Required.** The ID of App Store app. |
+| team_id       | integer | body | **Required**. The team ID. Adds VPP software to the specified team.  |
+| platform | string | body | The platform of the app (`darwin`, `ios`, or `ipados`). Default is `darwin`. |
+
+#### Example
+
+`POST /api/v1/fleet/software/app_store_apps?team_id=3`
+
+##### Request body
+
+```json
+{
+  "app_store_id": "497799835",
+  "team_id": 2,
+  "platform": "ipados"
+}
+```
+
+##### Default response
+
+`Status: 200`
+
+### Download package
+
+> **Experimental feature**. This feature is undergoing rapid improvement, which may result in breaking changes to the API or configuration surface. It is not recommended for use in automated workflows.
+
+_Available in Fleet Premium._
+
+`GET /api/v1/fleet/software/titles/:software_title_id/package?alt=media`
+
+#### Parameters
+
+| Name            | Type    | In   | Description                                      |
+| ----            | ------- | ---- | --------------------------------------------     |
+| software_title_id   | integer | path | **Required**. The ID of the software title to download software package.|
+| team_id | integer | query | **Required**. The team ID. Downloads a software package added to the specified team. |
+| alt             | integer | query | **Required**. If specified and set to "media", downloads the specified software package. |
+
+#### Example
+
+`GET /api/v1/fleet/software/titles/123/package?alt=media?team_id=2`
+
+##### Default response
+
+`Status: 200`
+
+```http
+Status: 200
+Content-Type: application/octet-stream
+Content-Disposition: attachment
+Content-Length: <length>
+Body: <blob>
+```
+
+### Install package or App Store app
+
+> **Experimental feature**. This feature is undergoing rapid improvement, which may result in breaking changes to the API or configuration surface. It is not recommended for use in automated workflows.
+
+_Available in Fleet Premium._
+
+Install software (package or App Store app) on a macOS, iOS, iPadOS, Windows, or Linux (Ubuntu) host. Software title must have a `software_package` or `app_store_app` added to be installed.
+
+`POST /api/v1/fleet/hosts/:id/software/:software_title_id/install`
+
+#### Parameters
+
+| Name              | Type       | In   | Description                                      |
+| ---------         | ---------- | ---- | --------------------------------------------     |
+| id                | integer    | path | **Required**. The host's ID.                     |
+| software_title_id | integer    | path | **Required**. The software title's ID.           |
+
+#### Example
+
+`POST /api/v1/fleet/hosts/123/software/3435/install`
+
+##### Default response
+
+`Status: 202`
+
+### Uninstall package
+
+> **Experimental feature**. This feature is undergoing rapid improvement, which may result in breaking changes to the API or configuration surface. It is not recommended for use in automated workflows.
+_Available in Fleet Premium._
+
+Uninstall software (package) on a macOS, Windows, or Linux (Ubuntu) host. Software title must have a `software_package` added to be uninstalled.
+
+`POST /api/v1/fleet/hosts/:id/software/:software_title_id/uninstall`
+
+#### Parameters
+
+| Name              | Type       | In   | Description                                      |
+| ---------         | ---------- | ---- | --------------------------------------------     |
+| id                | integer    | path | **Required**. The host's ID.                     |
+| software_title_id | integer    | path | **Required**. The software title's ID.           |
+
+#### Example
+
+`POST /api/v1/fleet/hosts/123/software/3435/uninstall`
+
+##### Default response
+
+`Status: 202`
+
+### Get package install result
+
+> **Experimental feature**. This feature is undergoing rapid improvement, which may result in breaking changes to the API or configuration surface. It is not recommended for use in automated workflows.
+
+_Available in Fleet Premium._
+
+`GET /api/v1/fleet/software/install/:install_uuid/results`
+
+Get the results of a software package install. 
+
+To get the results of an App Store app install, use the [List MDM commands](#list-mdm-commands) and [Get MDM command results](#get-mdm-command-results) API enpoints. Fleet uses an MDM command to install App Store apps.
+
+| Name            | Type    | In   | Description                                      |
+| ----            | ------- | ---- | --------------------------------------------     |
+| install_uuid | string | path | **Required**. The software installation UUID.|
+
+#### Example
+
+`GET /api/v1/fleet/software/install/b15ce221-e22e-4c6a-afe7-5b3400a017da/results`
+
+##### Default response
+
+`Status: 200`
+
+```json
+ {
+   "install_uuid": "b15ce221-e22e-4c6a-afe7-5b3400a017da",
+   "software_title": "Falcon.app",
+   "software_title_id": 8353,
+   "software_package": "FalconSensor-6.44.pkg",
+   "host_id": 123,
+   "host_display_name": "Marko's MacBook Pro",
+   "status": "failed",
+   "output": "Installing software...\nError: The operation can’t be completed because the item “Falcon” is in use.",
+   "pre_install_query_output": "Query returned result\nSuccess",
+   "post_install_script_output": "Running script...\nExit code: 1 (Failed)\nRolling back software install...\nSuccess"
+ }
+```
+
+### Delete package or App Store app
+
+> **Experimental feature**. This feature is undergoing rapid improvement, which may result in breaking changes to the API or configuration surface. It is not recommended for use in automated workflows.
+
+_Available in Fleet Premium._
+
+Deletes software that's available for install (package or App Store app).
+
+`DELETE /api/v1/fleet/software/titles/:software_title_id/available_for_install`
+
+#### Parameters
+
+| Name            | Type    | In   | Description                                      |
+| ----            | ------- | ---- | --------------------------------------------     |
+| software_title_id              | integer | path | **Required**. The ID of the software title to delete software available for install. |
+| team_id | integer | query | **Required**. The team ID. Deletes a software package added to the specified team. |
+
+#### Example
+
+`DELETE /api/v1/fleet/software/titles/24/available_for_install?team_id=2`
+
+##### Default response
+
+`Status: 204`
+
+## Vulnerabilities
 
 - [List vulnerabilities](#list-vulnerabilities)
 - [Get vulnerability](#get-vulnerability)
@@ -9035,7 +9550,7 @@ Retrieves a list of all CVEs affecting software and/or OS versions.
 
 | Name                | Type     | In    | Description                                                                                                                          |
 | ---      | ---      | ---   | ---                                                                                                                                  |
-| team_id             | integer | query | _Available in Fleet Premium_. Filters only include vulnerabilities affecting the specified team.  |
+| team_id             | integer | query | _Available in Fleet Premium_. Filters only include vulnerabilities affecting the specified team. Use `0` to filter by hosts assigned to "No team".  |
 | page                    | integer | query | Page number of the results to fetch.                                                                                                                                       |
 | per_page                | integer | query | Results per page.                                                                                                                                                          |
 | order_key               | string  | query | What to order results by. Allowed fields are: `cve`, `cvss_score`, `epss_probability`, `cve_published`, `created_at`, and `host_count`. Default is `created_at` (descending).      |
@@ -9044,7 +9559,6 @@ Retrieves a list of all CVEs affecting software and/or OS versions.
 | exploit | boolean | query | _Available in Fleet Premium_. If `true`, filters to only include vulnerabilities that have been actively exploited in the wild (`cisa_known_exploit: true`). Otherwise, includes vulnerabilities with any `cisa_known_exploit` value.  |
 
 
-
 ##### Default response
 
 `Status: 200`
@@ -9079,12 +9593,14 @@ Retrieves a list of all CVEs affecting software and/or OS versions.
 
 Retrieve details about a vulnerability and its affected software and OS versions.
 
+If no vulnerable OS versions or software were found, but Fleet is aware of the vulnerability, a 204 status code is returned.
+
 #### Parameters
 
-| Name     | Type     | In    | Description                                                                                     |
-| ---      | ---      | ---   | ---                                                                                             |
-| cve      | string  | path | The cve to get information about (including "cve-" prefix, case-insensitive).                       |
-| team_id             | integer | query | _Available in Fleet Premium_. Filters response data to the specified team.  |
+| Name    | Type    | In    | Description                                                                                                                  |
+|---------|---------|-------|------------------------------------------------------------------------------------------------------------------------------|
+| cve     | string  | path  | The cve to get information about (format must be CVE-YYYY-<4 or more digits>, case-insensitive).                             |
+| team_id | integer | query | _Available in Fleet Premium_. Filters response data to the specified team. Use `0` to filter by hosts assigned to "No team". |
 
 `GET /api/v1/fleet/vulnerabilities/:cve`
 
@@ -9115,7 +9631,7 @@ Retrieve details about a vulnerability and its affected software and OS versions
       "name": "macOS 14.1.2",
       "name_only": "macOS",
       "version": "14.1.2",
-      "platform": "darwin",
+
       "resolved_in_version": "14.2",
       "generated_cpes": [
         "cpe:2.3:o:apple:macos:*:*:*:*:*:14.2:*:*",
@@ -9597,8 +10113,8 @@ _Available in Fleet Premium_
 | ------------------------------------------------------- | ------- | ---- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | id                                                      | integer | path | **Required.** The desired team's ID.                                                                                                                                                                      |
 | name                                                    | string  | body | The team's name.                                                                                                                                                                                          |
-| host_ids                                                | list    | body | A list of hosts that belong to the team.                                                                                                                                                                  |
-| user_ids                                                | list    | body | A list of users on the team.                                                                                                                                                             |
+| host_ids                                                | array    | body | A list of hosts that belong to the team.                                                                                                                                                                  |
+| user_ids                                                | array    | body | A list of users on the team.                                                                                                                                                             |
 | webhook_settings                                        | object  | body | Webhook settings contains for the team.                                                                                                                                                                   |
 | &nbsp;&nbsp;failing_policies_webhook                    | object  | body | Failing policies webhook settings.                                                                                                                                                                        |
 | &nbsp;&nbsp;&nbsp;&nbsp;enable_failing_policies_webhook | boolean | body | Whether or not the failing policies webhook is enabled.                                                                                                                                                   |
@@ -9623,14 +10139,20 @@ _Available in Fleet Premium_
 | &nbsp;&nbsp;macos_updates                               | object  | body | macOS updates settings.                                                                                                                                                                                   |
 | &nbsp;&nbsp;&nbsp;&nbsp;minimum_version                 | string  | body | Hosts that belong to this team and are enrolled into Fleet's MDM will be nudged until their macOS is at or above this version.                                                                            |
 | &nbsp;&nbsp;&nbsp;&nbsp;deadline                        | string  | body | Hosts that belong to this team and are enrolled into Fleet's MDM won't be able to dismiss the Nudge window once this deadline is past.                                                                    |
+| &nbsp;&nbsp;ios_updates                               | object  | body | iOS updates settings.                                                                                                                                                                                   |
+| &nbsp;&nbsp;&nbsp;&nbsp;minimum_version                 | string  | body | Hosts that belong to this team and are enrolled into Fleet's MDM will be nudged until their iOS is at or above this version.                                                                            |
+| &nbsp;&nbsp;&nbsp;&nbsp;deadline                        | string  | body | Hosts that belong to this team and are enrolled into Fleet's MDM won't be able to dismiss the Nudge window once this deadline is past.                                                                    |
+| &nbsp;&nbsp;ipados_updates                               | object  | body | iPadOS updates settings.                                                                                                                                                                                   |
+| &nbsp;&nbsp;&nbsp;&nbsp;minimum_version                 | string  | body | Hosts that belong to this team and are enrolled into Fleet's MDM will be nudged until their iPadOS is at or above this version.                                                                            |
+| &nbsp;&nbsp;&nbsp;&nbsp;deadline                        | string  | body | Hosts that belong to this team and are enrolled into Fleet's MDM won't be able to dismiss the Nudge window once this deadline is past.                                                                    |
 | &nbsp;&nbsp;windows_updates                             | object  | body | Windows updates settings.                                                                                                                                                                                   |
 | &nbsp;&nbsp;&nbsp;&nbsp;deadline_days                   | integer | body | Hosts that belong to this team and are enrolled into Fleet's MDM will have this number of days before updates are installed on Windows.                                                                   |
 | &nbsp;&nbsp;&nbsp;&nbsp;grace_period_days               | integer | body | Hosts that belong to this team and are enrolled into Fleet's MDM will have this number of days before Windows restarts to install updates.                                                                    |
 | &nbsp;&nbsp;macos_settings                              | object  | body | macOS-specific settings.                                                                                                                                                                                  |
-| &nbsp;&nbsp;&nbsp;&nbsp;custom_settings                 | list    | body | The list of objects where each object includes .mobileconfig or JSON file (configuration profile) and label name to apply to macOS hosts that belong to this team and are members of the specified label.                                                                                                                                        |
+| &nbsp;&nbsp;&nbsp;&nbsp;custom_settings                 | array    | body | The list of objects where each object includes .mobileconfig or JSON file (configuration profile) and label name to apply to macOS hosts that belong to this team and are members of the specified label.                                                                                                                                        |
 | &nbsp;&nbsp;&nbsp;&nbsp;enable_disk_encryption          | boolean | body | Hosts that belong to this team and are enrolled into Fleet's MDM will have disk encryption enabled if set to true.                                                                                        |
 | &nbsp;&nbsp;windows_settings                            | object  | body | Windows-specific settings.                                                                                                                                                                                |
-| &nbsp;&nbsp;&nbsp;&nbsp;custom_settings                 | list    | body | The list of objects where each object includes XML file (configuration profile) and label name to apply to Windows hosts that belong to this team and are members of the specified label.                                                                                                                               |
+| &nbsp;&nbsp;&nbsp;&nbsp;custom_settings                 | array    | body | The list of objects where each object includes XML file (configuration profile) and label name to apply to Windows hosts that belong to this team and are members of the specified label.                                                                                                                               |
 | &nbsp;&nbsp;macos_setup                                 | object  | body | Setup for automatic MDM enrollment of macOS hosts.                                                                                                                                                      |
 | &nbsp;&nbsp;&nbsp;&nbsp;enable_end_user_authentication  | boolean | body | If set to true, end user authentication will be required during automatic MDM enrollment of new macOS hosts. Settings for your IdP provider must also be [configured](https://fleetdm.com/docs/using-fleet/mdm-macos-setup-experience#end-user-authentication-and-eula).                                                                                      |
 | integrations                                            | object  | body | Integration settings for this team.                                                                                                                                                                   |
@@ -9850,8 +10372,8 @@ _Available in Fleet Premium_
 | Name                             | Type    | In    | Description                                                                                                                                                  |
 | ---                              | ---     | ---   | ---                                                                                                                                                          |
 | id                               | integer | path  | **Required.** The desired team's ID.                                                                                                                         |
-| force                            | bool    | query | Force apply the options even if there are validation errors.                                                                                                 |
-| dry_run                          | bool    | query | Validate the options and return any validation errors, but do not apply the changes.                                                                         |
+| force                            | boolean | query | Force apply the options even if there are validation errors.                                                                                                 |
+| dry_run                          | boolean | query | Validate the options and return any validation errors, but do not apply the changes.                                                                         |
 | _JSON data_                      | object  | body  | The JSON to use as agent options for this team. See [Agent options](https://fleetdm.com/docs/using-fleet/configuration-files#agent-options) for details.                              |
 
 #### Example
@@ -9962,9 +10484,9 @@ Transforms a host name into a host id. For example, the Fleet UI use this endpoi
 
 #### Parameters
 
-| Name | Type  | In   | Description                              |
-| ---- | ----- | ---- | ---------------------------------------- |
-| list | array | body | **Required** list of items to translate. |
+| Name  | Type  | In   | Description                              |
+| ----- | ----- | ---- | ---------------------------------------- |
+| array | array | body | **Required** list of items to translate. |
 
 #### Example
 
diff --git a/docs/Using Fleet/Learn-how-to-use-Fleet.md b/docs/Using Fleet/Learn-how-to-use-Fleet.md
deleted file mode 100644
index fceea3f7db..0000000000
--- a/docs/Using Fleet/Learn-how-to-use-Fleet.md	
+++ /dev/null
@@ -1,58 +0,0 @@
-# Learn how to use Fleet
-
-- [How to add your device to Fleet](#how-to-add-your-device-to-fleet)
-- [How to ask questions about your device](#how-to-ask-questions-about-your-device)
-
-### Overview
-
-In this guide, we'll cover the following concepts:
-- How to add your device to Fleet
-- How to ask questions about your device
-
-### How to add your device to Fleet
-
-Once you log into Fleet, you are presented with the **Home** page.
-
-To add your device: 
-
-1. Select **Add hosts**. In Fleet, devices are referred to as "hosts."
-2. Select your device's platform.
-3. Select **Download** to download Fleet's agent (fleetd). The download may take several seconds.
-4. Open fleetd and follow the installation steps.
-
-> It may take several seconds for Fleet osquery to send your device's data to Fleet.
-
-In the background, Fleet ran several checks to assess the security hygiene of your device.
-
-> In Fleet, these checks are referred to as "policies."
-
-### How to ask questions about your device
-
-With Fleet, you can ask a multitude of questions to help you manage, monitor, and identify threats on your devices, but if you are just starting out, and unsure of what to ask, Fleet comes baked in with a [query library](https://fleetdm.com/queries) of common questions.
-
-So, let's start by asking the following question about your device:
-
-* What operating system is installed on my device and what is its version?
-
-This question can easily be answered by running this simple query: "Get operating system information." 
-
-To run this query on your device:
-
-1. Select **Queries** in the top navigation.
-2. Select **Create new query** (or browse your organization's queries for "operating system information" in the search bar).
-3. Type the query you would like to run, `SELECT * FROM os_version;`.
-4. Select **Run query**, then select **All hosts** (your device may be the only host added to Fleet), and finally select **Run** to execute the query.
-
-The query may take several seconds to complete, because Fleet has to wait for the Fleet's agent (fleetd) to respond with results. Only online hosts will respond with results to a live query.
-
-> Fleet's query response time is inherently variable because of osquery's heartbeat response time. This helps prevent performance issues on hosts.
-
-When the query has finished, you should see several columns in the "Results" table:
-
-- The "name" column answers: "What operating system is installed on my device?" 
-
-- The "version" column answers: "What version of the installed operating system is on my device?"
-
-<meta name="pageOrderInSection" value="100">
-<meta name="description" value="Get started with using Fleet by learning how to enroll your device into a Fleet instance and run queries to ask questions about it.">
-<meta name="navSection" value="hidden">
\ No newline at end of file
diff --git a/docs/Using Fleet/MDM-migration-guide.md b/docs/Using Fleet/MDM-migration-guide.md
deleted file mode 100644
index 68e55a7c81..0000000000
--- a/docs/Using Fleet/MDM-migration-guide.md	
+++ /dev/null
@@ -1,214 +0,0 @@
-# Migration guide
-
-This section provides instructions for migrating your hosts away from your old MDM solution to Fleet.
-
-## Requirements
-
-1. A [deployed Fleet instance](../Deploying/Introduction.md)
-2. [Fleet connected to Apple](./mdm-setup.md)
-
-## Migrate manually enrolled hosts
-
-1. [Enroll](./Adding-hosts.md) your hosts to Fleet with [Fleetd and Fleet Desktop](https://fleetdm.com/docs/using-fleet/adding-hosts#including-fleet-desktop) 
-2. Ensure your end users have access to an admin account on their Mac. End users won't be able to migrate on their own if they have a standard account.
-3. In your old MDM solution, unenroll the hosts to be migrated. MacOS does not allow multiple MDMs to be installed at once.
-4. Send [these guided instructions](#how-to-turn-on-mdm) to your end users to complete the final few steps via Fleet Desktop.
-    * Note that there will be a gap in MDM coverage between when the host is unenrolled from the old MDM and when the host turns on MDM in Fleet.
-
-### End user experience
-
-1. On their **My device** page, once an end user's device is unenrolled from the old MDM solution, the end user will be given the option to manually download the MDM enrollment profile.
-   
-2. Once downloaded, the user will receive a system notification that the Device Enrollment profile needs to be installed in their **System Settings > Profiles** section. 
-   
-3. After installation, the MDM enrollment profile can be removed by the end user at any time.
-
-### How to turn on MDM
-
-1. Select the Fleet icon in your menu bar and select **My device**.
-
-![Fleet icon in menu bar](https://raw.githubusercontent.com/fleetdm/fleet/main/website/assets/images/articles/fleet-desktop-says-hello-world-cover-1600x900@2x.jpg)
-
-2. On your **My device** page, select the **Turn on MDM** button in the yellow banner and follow the instructions. 
-  - If you don’t see the yellow banner or the **Turn on MDM** button, select the purple **Refetch** button at the top of the page. 
-  - If you still don't see the **Turn on MDM** button or the **My device** page presents you with an error, please contact your IT administrator.
-
-<img width="1400" alt="My device page - turn on MDM" src="https://user-images.githubusercontent.com/5359586/229950406-98343bf7-9653-4117-a8f5-c03359ba0d86.png">
-
-## Migrate automatically enrolled (DEP) hosts
-
-> Automatic enrollment is available in Fleet Premium or Ultimate
-
-To migrate automatically enrolled hosts, we will do the following steps:
-
-1. Prepare to migrate hosts
-2. Choose migration workflow and migrate hosts
-
-### Step 1: prepare to migrate hosts
-
-1. Connect Fleet to Apple Business Manager (ABM). Learn how [here](./mdm-setup.md#apple-business-manager-abm).
-2. [Enroll](./Adding-hosts.md) your hosts to Fleet with [Fleetd and Fleet Desktop](https://fleetdm.com/docs/using-fleet/adding-hosts#including-fleet-desktop) 
-3. Ensure your end users have access to an admin account on their Mac. End users won't be able to migrate on their own if they have a standard account.
-4. Migrate your hosts to Fleet in ABM:
-    1. In ABM, unassign the existing hosts' MDM server from the old MDM solution: In ABM, select **Devices** and then select **All Devices**. Then, select **Edit** next to **Edit MDM Server**, select **Unassign from the current MDM**, and select **Continue**.
-    2. In ABM, assign these hosts' MDM server to Fleet: In ABM, select **Devices** and then select **All Devices**. Then, select **Edit** next to **Edit MDM Server**, select **Assign to the following MDM:**, select your Fleet server in the dropdown, and select **Continue**.
-
-### Step 2: choose migration workflow and migrate hosts
-
-There are two migration workflows in Fleet: default and end user.
-
-The default migration workflow requires that the IT admin unenrolls hosts from the old MDM solution before the end user can complete migration. This will result in a gap in MDM coverage until the end user completes migration.
-
-The end user migration workflow allows the end user to kick-off migration by unenrolling from the old MDM solution on their own. Once the user is unenrolled, they're prompted to turn on MDM features in Fleet. This reduces the gap in MDM coverage.
-
-Configuring the end user migration workflow requires a few additional steps.
-
-#### Default workflow
-
-1. In your old MDM solution, unenroll the hosts to be migrated. MacOS does not allow multiple MDMs to be installed at once.
-
-2. Send [these guided instructions](#how-to-turn-on-mdm-default) to your end users to complete the final few steps via Fleet Desktop.
-    * Note that there will be a gap in MDM coverage between when the host is unenrolled from the old MDM and when the host turns on MDM in Fleet.
-
-##### End user experience
-
-1. The end user will receive a "Device Enrollment: &lt;organization&gt; can automatically configure your Mac." system notification within the macOS Notifications Center. 
-   
-2. After the end user clicks on the system notification, macOS will open the **System Setting > Profiles** and ask the user to "Allow Device Enrollment: &lt;organization&gt; can automatically configure your Mac based on settings provided by your System Administrator."
-  
-3. If the end user does not install the profile, the system notification will continue to prompt the end user until the setting has been allowed.
-   
-4. Once this setting has been approved, the MDM enrollment profile cannot be removed by the end user.
-
-##### How to turn on MDM (default)
-
-1. Select the Fleet icon in your menu bar and select **My device**.
-
-![Fleet icon in menu bar](https://raw.githubusercontent.com/fleetdm/fleet/main/website/assets/images/articles/fleet-desktop-says-hello-world-cover-1600x900@2x.jpg)
-
-2. On your **My device** page, select the **Turn on MDM** button in the yellow banner and follow the instructions. 
-    * If you don’t see the yellow banner or the **Turn on MDM** button, select the purple **Refetch** button at the top of the page. 
-    * If you still don't see the **Turn on MDM** button or the **My device** page presents you with an error, please contact your IT administrator.
-
-<img width="1400" alt="My device page - turn on MDM" src="https://user-images.githubusercontent.com/5359586/229950406-98343bf7-9653-4117-a8f5-c03359ba0d86.png">
-
-#### End user workflow
-
-> Available in Fleet Premium or Ultimate
-
-The end user migration workflow is supported for automatically enrolled (DEP) hosts.
-
-To watch a GIF that walks through the end user experience during the migration workflow, in the Fleet UI, head to **Settings > Integrations > Mobile device management (MDM)**, and scroll down to the **End user migration workflow** section.
-
-In Fleet, you can configure the end user workflow using the Fleet UI or fleetctl command-line tool.
-
-Fleet UI:
-
-1. Select the avatar on the right side of the top navigation and select **Settings > Integrations > Mobile device management (MDM)**.
-
-2. Scroll down to the **End user migration workflow** section and select the toggle to enable the workflow.
-
-3. Under **Mode** choose a mode and enter the webhook URL for you automation tool (ex. Tines) under **Webhook URL** and select **Save**.
-
-4. During the end user migration workflow, an end user's device will have their selected system theme (light or dark) applied. If your logo is not easy to see on both light and dark backgrounds, you can optionally set a logo for each theme:
-Head to **Settings** > **Organization settings** >
-**Organization info**, add URLs to your logos in the **Organization avatar URL (for dark backgrounds)** and **Organization avatar URL (for light backgrounds)** fields, and select **Save**.
-
-fleetctl CLI:
-
-1. Create `fleet-config.yaml` file or add to your existing `config` YAML file:
-
-```yaml
-apiVersion: v1
-kind: config
-spec:
-  mdm:
-    macos_migration:
-      enable: true
-      mode: "voluntary"
-      webhook_url: "https://example.com"
-  ...
-```
-
-2. Fill in the above keys under the `mdm.macos_migration` key. 
-
-To learn about each option, in the Fleet UI, select the avatar on the right side of the top navigation, select **Settings > Integrations > Mobile device management (MDM)**, and scroll down to the **End user migration workflow** section.
-
-3. During the end user migration workflow, the window will show the Fleet logo on top of a dark and light background (appearance configured by end user).
-
-If want to add a your organization's logo, you can optionally set a logo for each background:
-
-```yaml
-apiVersion: v1
-kind: config
-spec:
-  org_info:
-    org_logo_url: https://fleetdm.com/images/press-kit/fleet-blue-logo.png
-    org_logo_url_light_background: https://fleetdm.com/images/press-kit/fleet-white-logo.png
-  ...
-```
-
-Add URLs to your logos that are visible on a dark background and light background in the `org_logo_url` and `org_logo_url_light_background` keys respectively. If you only set a logo for one, the Fleet logo will be used for the other.
-
-4. Run the fleetctl `apply -f fleet-config.yml` command to add your configuration.
-
-5. Confirm that your configuration was saved by running `fleetctl get config`.
-
-6. Send [these guided instructions](#how-to-turn-on-mdm-end-user) to your end users to complete the final few steps via Fleet Desktop.
-
-##### How to turn on MDM (end user)
-
-1. Select the Fleet icon in your menu bar and select **Migrate to Fleet**.
-
-2. Select **Start** in the **Migrate to Fleet** popup. 
-
-2. On your **My device** page, select the **Turn on MDM** button in the yellow banner and follow the instructions. 
-    * If you don’t see the yellow banner or the **Turn on MDM** button, select the purple **Refetch** button at the top of the page. 
-    * If you still don't see the **Turn on MDM** button or the **My device** page presents you with an error, please contact your IT administrator.
-
-## Check migration progress
-
-To see a report of which hosts have successfully migrated to Fleet, have MDM features off, or are still enrolled to your old MDM solution head to the **Dashboard** page by clicking the icon on the left side of the top navigation bar. 
-
-Then, scroll down to the **Mobile device management (MDM)** section.
-
-## FileVault recovery keys
-
-_Available in Fleet Premium_
-
-When migrating from a previous MDM, end users need to take action to escrow FileVault keys to Fleet. The **My device** page in Fleet Desktop will present users with instructions to reset their key. 
-
-To start, enforce FileVault (disk encryption) and escrow in Fleet. Learn how [here](./MDM-disk-encryption.md). 
-
-After turning on disk encryption in Fleet, share [these guided instructions](#how-to-turn-on-disk-encryption) with your end users.
-
-If your old MDM solution did not enforce disk encryption, the end user will need to restart or log out of the host.
-
-If your old MDM solution did enforce disk encryption, the end user will need to reset their disk encryption key by following the prompt on the My device page and inputting their password. 
-
-## Activation Lock Bypass codes
-
-In Fleet, the [Activation Lock](https://support.apple.com/en-us/HT208987) feature is disabled by default for automatically enrolled (DEP) hosts.
-
-If a host under the old MDM solution has Activation Lock enabled, we recommend asking the end user to follow these instructions to disable Activation Lock before migrating this host to Fleet: https://support.apple.com/en-us/HT208987.
-
-This is because if the Activation Lock is enabled, you will need the Activation Lock bypass code to successfully wipe and reuse the Mac.
-
-However, Activation Lock bypass codes can only be retrieved from the Mac up to 30 days after the device is enrolled. This means that when migrating from your old MDM solution, it’s likely that you’ll be unable to retrieve the Activation Lock bypass code.
-   
-### How to turn on disk encryption
-
-1. Select the Fleet icon in your menu bar and select **My device**.
-
-![Fleet icon in menu bar](https://raw.githubusercontent.com/fleetdm/fleet/main/website/assets/images/articles/fleet-desktop-says-hello-world-cover-1600x900@2x.jpg)
-
-2. On your **My device** page, follow the disk encryption instructions in the yellow banner. 
-  - If you don’t see the yellow banner, select the purple **Refetch** button at the top of the page. 
-  - If you still don't see the yellow banner after a couple minutes or if the **My device** page presents you with an error, please contact your IT administrator.
-
-<img width="1399" alt="My device page - turn on disk encryption" src="https://user-images.githubusercontent.com/5359586/229950451-cfcd2314-a993-48db-aecf-11aac576d297.png">
-
-<meta name="pageOrderInSection" value="1502">
-<meta name="title" value="Migration guide">
-<meta name="description" value="Instructions for migrating hosts away from an old MDM solution to Fleet.">
-<meta name="navSection" value="Device management">
diff --git a/docs/Using Fleet/MDM-setup.md b/docs/Using Fleet/MDM-setup.md
deleted file mode 100644
index c56ddeb5d6..0000000000
--- a/docs/Using Fleet/MDM-setup.md	
+++ /dev/null
@@ -1,42 +0,0 @@
-# Setup
-
-To turn on macOS, iOS, and iPadOS MDM features, follow the instructions on this page to connect Fleet to Apple Push Notification service (APNs).
-
-To use automatic enrollment (aka zero-touch) features on macOS, iOS, and iPadOS, follow instructions to connect Fleet with Apple Business Manager (ABM).
-
-To turn on Windows MDM features, head to this [Windows MDM setup article](https://fleetdm.com/guides/windows-mdm-setup). 
-
-## Apple Push Notification service (APNs)
-
-Apple uses APNs to authenticate and manage interactions between Fleet and hosts.
-
-To connect Fleet to APNs or renew APNs, head to the **Settings > Integrations > Mobile device management (MDM)** page.
-
-> Apple requires that APNs certificates are renewed annually. 
-> - If your certificate expires, you will have to turn MDM off and back on for all macOS hosts.
-> - Be sure to use the same Apple ID from year-to-year. If you don't, you will have to turn MDM off and back on for all macOS hosts.
-
-## Apple Business Manager (ABM)
-
-> Available in Fleet Premium
-
-To connect Fleet to ABM or renew ABM, head to the **Settings > Integrations > Automatic enrollment > Apple Business Manager** page.
-
-After connecting Fleet to ABM, set Fleet to be the MDM for all Macs: 
-
-1. Log in to [Apple Business Manager](https://business.apple.com)
-2. Click your profile icon in the bottom left
-3. Click **Preferences**
-4. Click **MDM Server Assignment** and click **Edit** next to **Default Server Assignment**.
-5. Switch **Mac**, **iPhone**, and **iPad** to Fleet.
-
-New or wiped macOS, iOS, and iPadOS hosts that are in ABM, before they've been set up, appear in Fleet with **MDM status** set to "Pending".
-
-All macOS hosts that automatically enroll will be assigned to the default team. If no default team is set, then the host will be placed in "No team". 
-
-> A host can be transferred to a new (not default) team before it enrolls. In the Fleet UI, you can do this under **Settings** > **Teams**.
-
-<meta name="pageOrderInSection" value="1500">
-<meta name="title" value="Setup">
-<meta name="description" value="Learn how to turn on MDM features in Fleet.">
-<meta name="navSection" value="Device management">
diff --git a/docs/Using Fleet/Supported-browsers.md b/docs/Using Fleet/Supported-browsers.md
deleted file mode 100644
index 0ed5a0dc0e..0000000000
--- a/docs/Using Fleet/Supported-browsers.md	
+++ /dev/null
@@ -1,28 +0,0 @@
-
-# Supported browsers
-
-Fleet supports the latest, stable releases of all major browsers and platforms.
-
-We test each browser on Windows whenever possible, because our engineering team primarily uses macOS.
-
-**Note:** This information also applies to [fleetdm.com](https://www.fleetdm.com).
-
-### Desktop
-
-- Chrome
-- Firefox
-- Edge
-- Safari (macOS only)
-
-### Mobile
-
-- Mobile Safari on iOS
-- Mobile Chrome on Android
-
-### Note
-> - Mobile web is not yet supported in the Fleet product.
-> - The Fleet user interface [may not be fully supported](https://github.com/fleetdm/fleet/issues/969) in Google Chrome when the browser is running on ChromeOS
-
-<meta name="pageOrderInSection" value="1200">
-<meta name="description" value="Learn what browser versions are compatible with Fleet.">
-<meta name="navSection" value="The basics">
diff --git a/docs/Using Fleet/Supported-host-operating-systems.md b/docs/Using Fleet/Supported-host-operating-systems.md
deleted file mode 100644
index ff8cd5480c..0000000000
--- a/docs/Using Fleet/Supported-host-operating-systems.md	
+++ /dev/null
@@ -1,37 +0,0 @@
-# Supported host operating systems
-
-Fleet supports the following operating system versions on hosts. 
-
-| OS      | Supported version(s)                    |
-| :------ | :-------------------------------------  |
-| macOS   | 13+ (Ventura)                           |
-| Windows | Pro and Enterprise 10+, Server 2012+    |
-| Linux   | CentOS 7.1+,  Ubuntu 20.04+, Fedora 38+ |
-| ChromeOS | 112.0.5615.134+                        |
-
-While Fleet may still function partially or fully with OS versions older than those above, Fleet does not actively test against unsupported versions and does not pursue bugs on them. 
-
-## Some notes on compatibility
-
-### Tables
-Not all osquery tables are available for every OS. Please check out the [osquery schema](https://fleetdm.com/tables) for detailed information. 
-
-If a table is not available for your host, Fleet will generally handle things behind the scenes for you. 
-
-### M1 Macs
-Fleet's agent (fleetd) generated for MacOS by `fleetctl package` does not include native support for M1 Macs. Some values returned may reflect the information returned by Rosetta rather than the system. For example, a CPU will show up as `i486`. 
-
-### Linux
-
-> Ubuntu Linux:
-> Fleet Desktop currently supports Xorg as X11 server, Wayland is currently not supported.
-> Ubuntu 24.04 comes with Wayland enabled by default. To use X11 instead of Wayland you can set
-> `WaylandEnable=false` in `/etc/gdm3/custom.conf` and reboot.
-
-> Fedora, CentOS 8 and 9 require a [gnome extension](https://extensions.gnome.org/extension/615/appindicator-support/) and Google Chrome for Fleet Desktop.
-
-> The `fleetctl package` command is not supported on DISA-STIG distribution.
-
-<meta name="pageOrderInSection" value="1200">
-<meta name="description" value="This page contains information about operating systems that are compatible with Fleet's agent (fleetd).">
-<meta name="navSection" value="The basics">
diff --git a/docs/files/2024-06-14-fleet-penetration-test.pdf b/docs/files/2024-06-14-fleet-penetration-test.pdf
new file mode 100644
index 0000000000..1be4c46541
Binary files /dev/null and b/docs/files/2024-06-14-fleet-penetration-test.pdf differ
diff --git a/ee/bulk-operations-dashboard/.editorconfig b/ee/bulk-operations-dashboard/.editorconfig
new file mode 100644
index 0000000000..6d7fa7039c
--- /dev/null
+++ b/ee/bulk-operations-dashboard/.editorconfig
@@ -0,0 +1,31 @@
+################################################
+#   ╔═╗╔╦╗╦╔╦╗╔═╗╦═╗┌─┐┌─┐┌┐┌┌─┐┬┌─┐
+#   ║╣  ║║║ ║ ║ ║╠╦╝│  │ ││││├┤ ││ ┬
+#  o╚═╝═╩╝╩ ╩ ╚═╝╩╚═└─┘└─┘┘└┘└  ┴└─┘
+#
+# > Formatting conventions for your Sails app.
+#
+# This file (`.editorconfig`) exists to help
+# maintain consistent formatting throughout the
+# files in your Sails app.
+#
+# For the sake of convention, the Sails team's
+# preferred settings are included here out of the
+# box.  You can also change this file to fit your
+# team's preferences (for example, if all of the
+# developers on your team have a strong preference
+# for tabs over spaces),
+#
+# To review what each of these options mean, see:
+# http://editorconfig.org/
+#
+################################################
+root = true
+
+[*]
+indent_style = space
+indent_size = 2
+end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true
diff --git a/ee/bulk-operations-dashboard/.eslintignore b/ee/bulk-operations-dashboard/.eslintignore
new file mode 100644
index 0000000000..f190c2ae4f
--- /dev/null
+++ b/ee/bulk-operations-dashboard/.eslintignore
@@ -0,0 +1,3 @@
+assets/dependencies/**/*.js
+views/**/*.ejs
+
diff --git a/ee/bulk-operations-dashboard/.eslintrc b/ee/bulk-operations-dashboard/.eslintrc
new file mode 100644
index 0000000000..37e02b3724
--- /dev/null
+++ b/ee/bulk-operations-dashboard/.eslintrc
@@ -0,0 +1,92 @@
+{
+  //   ╔═╗╔═╗╦  ╦╔╗╔╔╦╗┬─┐┌─┐
+  //   ║╣ ╚═╗║  ║║║║ ║ ├┬┘│
+  //  o╚═╝╚═╝╩═╝╩╝╚╝ ╩ ┴└─└─┘
+  // A set of basic code conventions designed to encourage quality and consistency
+  // across your Sails app's code base.  These rules are checked against
+  // automatically any time you run `npm test`.
+  // 
+  // > An additional eslintrc override file is included in the `assets/` folder
+  // > right out of the box.  This is specifically to allow for variations in acceptable
+  // > global variables between front-end JavaScript code designed to run in the browser
+  // > vs. backend code designed to run in a Node.js/Sails process.
+  //
+  // > Note: If you're using mocha, you'll want to add an extra override file to your
+  // > `test/` folder so that eslint will tolerate mocha-specific globals like `before`
+  // > and `describe`.
+  // Designed for ESLint v4.
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+  // For more information about any of the rules below, check out the relevant
+  // reference page on eslint.org.  For example, to get details on "no-sequences",
+  // you would visit `http://eslint.org/docs/rules/no-sequences`.  If you're unsure
+  // or could use some advice, come by https://sailsjs.com/support.
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+  "env": {
+    "node": true
+  },
+
+  "parserOptions": {
+    "ecmaVersion": 2018
+  },
+
+  "globals": {
+    // If "no-undef" is enabled below, be sure to list all global variables that
+    // are used in this app's backend code (including the globalIds of models):
+    // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+    "Promise": true,
+    "sails": true,
+    "_": true,
+
+    // Models:
+    "User": true,
+    "UndeployedProfile": true,
+    "UndeployedScript": true
+    
+    // …and any others.
+    // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+  },
+
+  "rules": {
+    "block-scoped-var":             ["error"],
+    "callback-return":              ["error", ["done", "proceed", "next", "onwards", "callback", "cb"]],
+    "camelcase":                    ["warn", {"properties":"always"}],
+    "comma-style":                  ["warn", "last"],
+    "curly":                        ["warn"],
+    "eqeqeq":                       ["error", "always"],
+    "eol-last":                     ["warn"],
+    "handle-callback-err":          ["error"],
+    "indent":                       ["warn", 2, {
+      "SwitchCase": 1,
+      "MemberExpression": "off",
+      "FunctionDeclaration": {"body":1, "parameters":"off"},
+      "FunctionExpression": {"body":1, "parameters":"off"},
+      "CallExpression": {"arguments":"off"},
+      "ArrayExpression": 1,
+      "ObjectExpression": 1,
+      "ignoredNodes": ["ConditionalExpression"]
+    }],
+    "linebreak-style":              ["error", "unix"],
+    "no-dupe-keys":                 ["error"],
+    "no-duplicate-case":            ["error"],
+    "no-extra-semi":                ["warn"],
+    "no-labels":                    ["error"],
+    "no-mixed-spaces-and-tabs":     [2, "smart-tabs"],
+    "no-redeclare":                 ["warn"],
+    "no-return-assign":             ["error", "always"],
+    "no-sequences":                 ["error"],
+    "no-trailing-spaces":           ["warn"],
+    "no-undef":                     ["error"],
+    "no-unexpected-multiline":      ["warn"],
+    "no-unreachable":               ["warn"],
+    "no-unused-vars":               ["warn", {"caughtErrors":"all", "caughtErrorsIgnorePattern": "^unused($|[A-Z].*$)", "argsIgnorePattern": "^unused($|[A-Z].*$)", "varsIgnorePattern": "^unused($|[A-Z].*$)" }],
+    "no-use-before-define":         ["error", {"functions":false}],
+    "one-var":                      ["warn", "never"],
+    "prefer-arrow-callback":        ["warn", {"allowNamedFunctions":true}],
+    "quotes":                       ["warn", "single", {"avoidEscape":false, "allowTemplateLiterals":true}],
+    "semi":                         ["warn", "always"],
+    "semi-spacing":                 ["warn", {"before":false, "after":true}],
+    "semi-style":                   ["warn", "last"]
+  }
+
+}
diff --git a/ee/bulk-operations-dashboard/.gitignore b/ee/bulk-operations-dashboard/.gitignore
new file mode 100644
index 0000000000..a1ddb80e79
--- /dev/null
+++ b/ee/bulk-operations-dashboard/.gitignore
@@ -0,0 +1,134 @@
+################################################
+#   ┌─┐┬┌┬┐╦╔═╗╔╗╔╔═╗╦═╗╔═╗
+#   │ ┬│ │ ║║ ╦║║║║ ║╠╦╝║╣
+#  o└─┘┴ ┴ ╩╚═╝╝╚╝╚═╝╩╚═╚═╝
+#
+# > Files to exclude from your app's repo.
+#
+# This file (`.gitignore`) is only relevant if
+# you are using git.
+#
+# It exists to signify to git that certain files
+# and/or directories should be ignored for the
+# purposes of version control.
+#
+# This keeps tmp files and sensitive credentials
+# from being uploaded to  your repository.  And
+# it allows you to configure your app for your
+# machine without accidentally committing settings
+# which will smash the local settings of other
+# developers on your team.
+#
+# Some reasonable defaults are included below,
+# but, of course, you should modify/extend/prune
+# to fit your needs!
+#
+################################################
+
+
+################################################
+# Local Configuration
+#
+# Explicitly ignore files which contain:
+#
+# 1. Sensitive information you'd rather not push to
+#    your git repository.
+#    e.g., your personal API keys or passwords.
+#
+# 2. Developer-specific configuration
+#    Basically, anything that would be annoying
+#    to have to change every time you do a
+#    `git pull` on your laptop.
+#    e.g. your local development database, or
+#    the S3 bucket you're using for file uploads
+#    during development.
+#
+################################################
+
+config/local.js
+
+
+################################################
+# Dependencies
+#
+#
+# When releasing a production app, you _could_
+# hypothetically include your node_modules folder
+# in your git repo, but during development, it
+# is always best to exclude it, since different
+# developers may be working on different kernels,
+# where dependencies would need to be recompiled
+# anyway.
+#
+# Most of the time, the node_modules folder can
+# be excluded from your code repository, even
+# in production, thanks to features like the
+# package-lock.json file / NPM shrinkwrap.
+#
+# But no matter what, since this is a Sails app,
+# you should always push up the package-lock.json
+# or shrinkwrap file to your repository, to avoid
+# accidentally pulling in upgraded dependencies
+# and breaking your code.
+#
+# That said, if you are having trouble with
+# dependencies, (particularly when using
+# `npm link`) this can be pretty discouraging.
+# But rather than just adding the lockfile to
+# your .gitignore, try this first:
+# ```
+#     rm -rf node_modules
+#     rm package-lock.json
+#     npm install
+# ```
+#
+# [?] For more tips/advice, come by and say hi
+#     over at https://sailsjs.com/support
+#
+################################################
+
+node_modules
+
+
+################################################
+#
+# > Do you use bower?
+# > re: the bower_components dir, see this:
+# > http://addyosmani.com/blog/checking-in-front-end-dependencies/
+# > (credit Addy Osmani, @addyosmani)
+#
+################################################
+
+
+################################################
+# Temporary files generated by Sails/Waterline.
+################################################
+
+.tmp
+
+
+################################################
+# Miscellaneous
+#
+# Common files generated by text editors,
+# operating systems, file systems, dbs, etc.
+################################################
+
+*~
+*#
+.DS_STORE
+.netbeans
+nbproject
+.idea
+*.iml
+.vscode
+.node_history
+dump.rdb
+
+npm-debug.log
+lib-cov
+*.seed
+*.log
+*.out
+*.pid
+
diff --git a/ee/bulk-operations-dashboard/.htmlhintrc b/ee/bulk-operations-dashboard/.htmlhintrc
new file mode 100644
index 0000000000..c9b2ee72b6
--- /dev/null
+++ b/ee/bulk-operations-dashboard/.htmlhintrc
@@ -0,0 +1,27 @@
+{
+  "alt-require": true,
+  "attr-lowercase": ["viewBox"],
+  "attr-no-duplication": true,
+  "attr-unsafe-chars": true,
+  "attr-value-double-quotes": true,
+  "attr-value-not-empty": false,
+  "csslint": false,
+  "doctype-first": false,
+  "doctype-html5": true,
+  "head-script-disabled": false,
+  "href-abs-or-rel": false,
+  "id-class-ad-disabled": true,
+  "id-class-value": false,
+  "id-unique": true,
+  "inline-script-disabled": true,
+  "inline-style-disabled": false,
+  "jshint": false,
+  "space-tab-mixed-disabled": "space",
+  "spec-char-escape": false,
+  "src-not-empty": true,
+  "style-disabled": false,
+  "tag-pair": true,
+  "tag-self-close": false,
+  "tagname-lowercase": true,
+  "title-require": false
+}
diff --git a/ee/bulk-operations-dashboard/.lesshintrc b/ee/bulk-operations-dashboard/.lesshintrc
new file mode 100644
index 0000000000..6dcb60f278
--- /dev/null
+++ b/ee/bulk-operations-dashboard/.lesshintrc
@@ -0,0 +1,46 @@
+{
+  //   ╦  ╔═╗╔═╗╔═╗╦ ╦╦╔╗╔╔╦╗┬─┐┌─┐
+  //   ║  ║╣ ╚═╗╚═╗╠═╣║║║║ ║ ├┬┘│
+  //  o╩═╝╚═╝╚═╝╚═╝╩ ╩╩╝╚╝ ╩ ┴└─└─┘
+  // Configuration designed for the lesshint linter.  Describes a loose set of LESS
+  // conventions that help avoid typos, unexpected failed builds, and hard-to-debug
+  // selector and CSS rule issues.
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+  // For more information about any of the rules below, check out the reference page
+  // of all rules at https://github.com/lesshint/lesshint/blob/v6.3.6/lib/linters/README.md
+  // If you're unsure or could use some advice, come by https://sailsjs.com/support.
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+  "singleLinePerSelector": false,
+  "singleLinePerProperty": false,
+  "zeroUnit": false,
+  "idSelector": false,
+  "propertyOrdering": false,
+  "spaceAroundBang": false,
+  "fileExtensions": [".less", ".css"],
+  "excludedFiles": ["vendor.less"],
+  "importPath": false,
+  "borderZero": false,
+  "hexLength": false,
+  "hexNotation": false,
+  "newlineAfterBlock": false,
+  "spaceBeforeBrace": {
+    "style": "one_space"
+  },
+  "spaceAfterPropertyName": false,
+  "spaceAfterPropertyColon": {
+    "enabled": true,
+    "style": "one_space"
+  },
+  "maxCharPerLine": false,
+  "emptyRule": false,
+  "importantRule": true,
+  "qualifyingElement": false
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+  // ^^ This last one is only disabled because the lesshint parser seems to have
+  // a hard time distinguishing between things like `div.bar` and `&.bar`.
+  // In this case, the ampersand has a distinct meaning, and it does not refer
+  // to an element.  (It's referring to the case where that class is matched at
+  // the parent level, rather than talking about a descendant.)
+  // https://github.com/lesshint/lesshint/blob/v6.3.6/lib/linters/README.md#qualifyingelement
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+}
diff --git a/ee/bulk-operations-dashboard/.npmrc b/ee/bulk-operations-dashboard/.npmrc
new file mode 100644
index 0000000000..43601ce8db
--- /dev/null
+++ b/ee/bulk-operations-dashboard/.npmrc
@@ -0,0 +1,11 @@
+######################
+#   ╔╗╔╔═╗╔╦╗┬─┐┌─┐  #
+#   ║║║╠═╝║║║├┬┘│    #
+#  o╝╚╝╩  ╩ ╩┴└─└─┘  #
+######################
+
+# Hide NPM log output unless it is related to an error of some kind:
+loglevel=error
+
+# Make "npm audit" an opt-in thing for subsequent installs within this app:
+audit=false
diff --git a/ee/bulk-operations-dashboard/.sailsrc b/ee/bulk-operations-dashboard/.sailsrc
new file mode 100644
index 0000000000..782d995af6
--- /dev/null
+++ b/ee/bulk-operations-dashboard/.sailsrc
@@ -0,0 +1,12 @@
+{
+  "hooks": {
+    "sockets": false
+  },
+  "generators": {
+    "modules": {}
+  },
+  "_generatedWith": {
+    "sails": "1.5.11",
+    "sails-generate": "2.0.11"
+  }
+}
diff --git a/ee/bulk-operations-dashboard/Dockerfile b/ee/bulk-operations-dashboard/Dockerfile
new file mode 100644
index 0000000000..c68b6f335a
--- /dev/null
+++ b/ee/bulk-operations-dashboard/Dockerfile
@@ -0,0 +1,26 @@
+# Use the official Node.js 14 image as a base
+FROM node:20@sha256:e06aae17c40c7a6b5296ca6f942a02e6737ae61bbbf3e2158624bb0f887991b5
+
+# Set the working directory in the container
+WORKDIR /usr/src/app
+
+# Copy the package.json
+COPY package.json ./
+
+# Install vulnerability dashboard dependencies
+RUN npm install
+
+# Copy the vulnerability dashboard into the container
+COPY . .
+
+# Copy the entrypoint script into the container
+COPY entrypoint.sh /usr/src/app/entrypoint.sh
+
+# Make sure the entrypoint script is executable
+RUN chmod +x /usr/src/app/entrypoint.sh
+
+# Expose the port the vulnerability dashboard runs on
+EXPOSE 1337
+
+# Set the entrypoint script as the entry point
+ENTRYPOINT ["/usr/src/app/entrypoint.sh"]
diff --git a/ee/bulk-operations-dashboard/Gruntfile.js b/ee/bulk-operations-dashboard/Gruntfile.js
new file mode 100644
index 0000000000..e3b2847338
--- /dev/null
+++ b/ee/bulk-operations-dashboard/Gruntfile.js
@@ -0,0 +1,23 @@
+/**
+ * Gruntfile
+ *
+ * This Node script is executed when you run `grunt`-- and also when
+ * you run `sails lift` (provided the grunt hook is installed and
+ * hasn't been disabled).
+ *
+ * WARNING:
+ * Unless you know what you're doing, you shouldn't change this file.
+ * Check out the `tasks/` directory instead.
+ *
+ * For more information see:
+ *   https://sailsjs.com/anatomy/Gruntfile.js
+ */
+module.exports = function(grunt) {
+
+  var loadGruntTasks = require('sails-hook-grunt/accessible/load-grunt-tasks');
+
+  // Load Grunt task configurations (from `tasks/config/`) and Grunt
+  // task registrations (from `tasks/register/`).
+  loadGruntTasks(__dirname, grunt);
+
+};
diff --git a/ee/bulk-operations-dashboard/README.md b/ee/bulk-operations-dashboard/README.md
new file mode 100644
index 0000000000..678396b623
--- /dev/null
+++ b/ee/bulk-operations-dashboard/README.md
@@ -0,0 +1,49 @@
+# Bulk operations dashboard
+
+
+A dashboard to easily manage profiles and scripts across multiple teams on a Fleet instance.
+
+
+## Dependencies
+
+- A datastore, this app was built using Postgres, but you can use a database of your choice.
+
+- A Redis database - For session storage.
+
+
+## Configuration
+
+This app has two required custom configuration values:
+
+- `sails.config.custom.fleetBaseUrl`: The full URL of your Fleet instance. (e.g., https://fleet.example.com)
+
+- `sails.config.custom.fleetApiToken`: An API token for an API-only user on your Fleet instance.
+
+
+
+## Running the bulk operations dashboard with Docker.
+
+To run a local bulk operations dashboard with docker, you can follow these instructions.
+
+1. Clone this repo
+2. Update the following ENV variables `ee/bulk-operations-dashboard/docker-compose.yml` file:
+
+  1. `sails_custom__fleetBaseUrl`: The full URL of your Fleet instance. (e.g., https://fleet.example.com)
+
+  2. `sails_custom__fleetApiToken`: An API token for an API-only user on your Fleet instance.
+
+  >You can read about how to create an API-only user and get it's token [here](https://fleetdm.com/docs/using-fleet/fleetctl-cli#create-api-only-user)
+
+3. Open the `ee/bulk-operations-dashboard/` folder in your terminal.
+
+4. Run `docker compose up --build` to build the bulk operations dashboard's Docker image.
+
+  > The first time the bulk operations dashboard starts it will Initalize the database aby running the `config/bootstrap.js` script before the server starts.
+
+5. Once the container is done building, the bulk operations dashboard will be available at http://localhost:1337
+
+  > You can login with the default admin login:
+  >
+  >- Email address: `admin@example.com`
+  >
+  >- Password: `abc123`
diff --git a/ee/bulk-operations-dashboard/api/controllers/account/logout.js b/ee/bulk-operations-dashboard/api/controllers/account/logout.js
new file mode 100644
index 0000000000..61e50d8c19
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/controllers/account/logout.js
@@ -0,0 +1,55 @@
+module.exports = {
+
+
+  friendlyName: 'Logout',
+
+
+  description: 'Log out of this app.',
+
+
+  extendedDescription:
+`This action deletes the \`req.session.userId\` key from the session of the requesting user agent.
+Actual garbage collection of session data depends on this app's session store, and
+potentially also on the [TTL configuration](https://sailsjs.com/docs/reference/configuration/sails-config-session)
+you provided for it.
+
+Note that this action does not check to see whether or not the requesting user was
+actually logged in.  (If they weren't, then this action is just a no-op.)`,
+
+
+  exits: {
+
+    success: {
+      description: 'The requesting user agent has been successfully logged out.'
+    },
+
+    redirect: {
+      description: 'The requesting user agent looks to be a web browser.',
+      extendedDescription: 'After logging out from a web browser, the user is redirected away.',
+      responseType: 'redirect'
+    }
+
+  },
+
+
+  fn: async function () {
+
+    // Clear the `userId` property from this session.
+    delete this.req.session.userId;
+
+    // Broadcast a message that we can display in other open tabs.
+    if (sails.hooks.sockets) {
+      await sails.helpers.broadcastSessionChange(this.req);
+    }
+
+    // Then finish up, sending an appropriate response.
+    // > Under the covers, this persists the now-logged-out session back
+    // > to the underlying session store.
+    if (!this.req.wantsJSON) {
+      throw {redirect: '/login'};
+    }
+
+  }
+
+
+};
diff --git a/ee/bulk-operations-dashboard/api/controllers/account/update-billing-card.js b/ee/bulk-operations-dashboard/api/controllers/account/update-billing-card.js
new file mode 100644
index 0000000000..7cbeac5bab
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/controllers/account/update-billing-card.js
@@ -0,0 +1,79 @@
+module.exports = {
+
+
+  friendlyName: 'Update billing card',
+
+
+  description: 'Update the credit card for the logged-in user.',
+
+
+  inputs: {
+
+    stripeToken: {
+      type: 'string',
+      example: 'tok_199k3qEXw14QdSnRwmsK99MH',
+      description: 'The single-use Stripe Checkout token identifier representing the user\'s payment source (i.e. credit card.)',
+      extendedDescription: 'Omit this (or use "") to remove this user\'s payment source.',
+      whereToGet: {
+        description: 'This Stripe.js token is provided to the front-end (client-side) code after completing a Stripe Checkout or Stripe Elements flow.'
+      }
+    },
+
+    billingCardLast4: {
+      type: 'string',
+      example: '4242',
+      description: 'Omit if removing card info.',
+      whereToGet: { description: 'Credit card info is provided by Stripe after completing the checkout flow.' }
+    },
+
+    billingCardBrand: {
+      type: 'string',
+      example: 'visa',
+      description: 'Omit if removing card info.',
+      whereToGet: { description: 'Credit card info is provided by Stripe after completing the checkout flow.' }
+    },
+
+    billingCardExpMonth: {
+      type: 'string',
+      example: '08',
+      description: 'Omit if removing card info.',
+      whereToGet: { description: 'Credit card info is provided by Stripe after completing the checkout flow.' }
+    },
+
+    billingCardExpYear: {
+      type: 'string',
+      example: '2023',
+      description: 'Omit if removing card info.',
+      whereToGet: { description: 'Credit card info is provided by Stripe after completing the checkout flow.' }
+    },
+
+  },
+
+
+  fn: async function ({stripeToken, billingCardLast4, billingCardBrand, billingCardExpMonth, billingCardExpYear}) {
+
+    // Add, update, or remove the default payment source for the logged-in user's
+    // customer entry in Stripe.
+    var stripeCustomerId = await sails.helpers.stripe.saveBillingInfo.with({
+      stripeCustomerId: this.req.me.stripeCustomerId,
+      token: stripeToken || '',
+    }).timeout(5000).retry();
+
+    // Update (or clear) the card info we have stored for this user in our database.
+    // > Remember, never store complete card numbers-- only the last 4 digits + expiration!
+    // > Storing (or even receiving) complete, unencrypted card numbers would require PCI
+    // > compliance in the U.S.
+    await User.updateOne({ id: this.req.me.id })
+    .set({
+      stripeCustomerId,
+      hasBillingCard: stripeToken ? true : false,
+      billingCardBrand: stripeToken ? billingCardBrand : '',
+      billingCardLast4: stripeToken ? billingCardLast4 : '',
+      billingCardExpMonth: stripeToken ? billingCardExpMonth : '',
+      billingCardExpYear: stripeToken ? billingCardExpYear : ''
+    });
+
+  }
+
+
+};
diff --git a/ee/bulk-operations-dashboard/api/controllers/account/update-password.js b/ee/bulk-operations-dashboard/api/controllers/account/update-password.js
new file mode 100644
index 0000000000..00a53a38d6
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/controllers/account/update-password.js
@@ -0,0 +1,35 @@
+module.exports = {
+
+
+  friendlyName: 'Update password',
+
+
+  description: 'Update the password for the logged-in user.',
+
+
+  inputs: {
+
+    password: {
+      description: 'The new, unencrypted password.',
+      example: 'abc123v2',
+      required: true
+    }
+
+  },
+
+
+  fn: async function ({password}) {
+
+    // Hash the new password.
+    var hashed = await sails.helpers.passwords.hashPassword(password);
+
+    // Update the record for the logged-in user.
+    await User.updateOne({ id: this.req.me.id })
+    .set({
+      password: hashed
+    });
+
+  }
+
+
+};
diff --git a/ee/bulk-operations-dashboard/api/controllers/account/update-profile.js b/ee/bulk-operations-dashboard/api/controllers/account/update-profile.js
new file mode 100644
index 0000000000..afc5fd1b54
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/controllers/account/update-profile.js
@@ -0,0 +1,160 @@
+module.exports = {
+
+
+  friendlyName: 'Update profile',
+
+
+  description: 'Update the profile for the logged-in user.',
+
+
+  inputs: {
+
+    fullName: {
+      type: 'string'
+    },
+
+    emailAddress: {
+      type: 'string'
+    },
+
+  },
+
+
+  exits: {
+
+    emailAlreadyInUse: {
+      statusCode: 409,
+      description: 'The provided email address is already in use.',
+    },
+
+  },
+
+
+  fn: async function ({fullName, emailAddress}) {
+
+    var newEmailAddress = emailAddress;
+    if (newEmailAddress !== undefined) {
+      newEmailAddress = newEmailAddress.toLowerCase();
+    }
+
+    // Determine if this request wants to change the current user's email address,
+    // revert her pending email address change, modify her pending email address
+    // change, or if the email address won't be affected at all.
+    var desiredEmailEffect;// ('change-immediately', 'begin-change', 'cancel-pending-change', 'modify-pending-change', or '')
+    if (
+      newEmailAddress === undefined ||
+      (this.req.me.emailStatus !== 'change-requested' && newEmailAddress === this.req.me.emailAddress) ||
+      (this.req.me.emailStatus === 'change-requested' && newEmailAddress === this.req.me.emailChangeCandidate)
+    ) {
+      desiredEmailEffect = '';
+    } else if (this.req.me.emailStatus === 'change-requested' && newEmailAddress === this.req.me.emailAddress) {
+      desiredEmailEffect = 'cancel-pending-change';
+    } else if (this.req.me.emailStatus === 'change-requested' && newEmailAddress !== this.req.me.emailAddress) {
+      desiredEmailEffect = 'modify-pending-change';
+    } else if (!sails.config.custom.verifyEmailAddresses || this.req.me.emailStatus === 'unconfirmed') {
+      desiredEmailEffect = 'change-immediately';
+    } else {
+      desiredEmailEffect = 'begin-change';
+    }
+
+
+    // If the email address is changing, make sure it is not already being used.
+    if (_.contains(['begin-change', 'change-immediately', 'modify-pending-change'], desiredEmailEffect)) {
+      let conflictingUser = await User.findOne({
+        or: [
+          { emailAddress: newEmailAddress },
+          { emailChangeCandidate: newEmailAddress }
+        ]
+      });
+      if (conflictingUser) {
+        throw 'emailAlreadyInUse';
+      }
+    }
+
+
+    // Start building the values to set in the db.
+    // (We always set the fullName if provided.)
+    var valuesToSet = {
+      fullName,
+    };
+
+    switch (desiredEmailEffect) {
+
+      // Change now
+      case 'change-immediately':
+        _.extend(valuesToSet, {
+          emailAddress: newEmailAddress,
+          emailChangeCandidate: '',
+          emailProofToken: '',
+          emailProofTokenExpiresAt: 0,
+          emailStatus: this.req.me.emailStatus === 'unconfirmed' ? 'unconfirmed' : 'confirmed'
+        });
+        break;
+
+      // Begin new email change, or modify a pending email change
+      case 'begin-change':
+      case 'modify-pending-change':
+        _.extend(valuesToSet, {
+          emailChangeCandidate: newEmailAddress,
+          emailProofToken: await sails.helpers.strings.random('url-friendly'),
+          emailProofTokenExpiresAt: Date.now() + sails.config.custom.emailProofTokenTTL,
+          emailStatus: 'change-requested'
+        });
+        break;
+
+      // Cancel pending email change
+      case 'cancel-pending-change':
+        _.extend(valuesToSet, {
+          emailChangeCandidate: '',
+          emailProofToken: '',
+          emailProofTokenExpiresAt: 0,
+          emailStatus: 'confirmed'
+        });
+        break;
+
+      // Otherwise, do nothing re: email
+    }
+
+    // Save to the db
+    await User.updateOne({id: this.req.me.id })
+    .set(valuesToSet);
+
+    // If this is an immediate change, and billing features are enabled,
+    // then also update the billing email for this user's linked customer entry
+    // in the Stripe API to make sure they receive email receipts.
+    // > Note: If there was not already a Stripe customer entry for this user,
+    // > then one will be set up implicitly, so we'll need to persist it to our
+    // > database.  (This could happen if Stripe credentials were not configured
+    // > at the time this user was originally created.)
+    if(desiredEmailEffect === 'change-immediately' && sails.config.custom.enableBillingFeatures) {
+      let didNotAlreadyHaveCustomerId = (! this.req.me.stripeCustomerId);
+      let stripeCustomerId = await sails.helpers.stripe.saveBillingInfo.with({
+        stripeCustomerId: this.req.me.stripeCustomerId,
+        emailAddress: newEmailAddress
+      }).timeout(5000).retry();
+      if (didNotAlreadyHaveCustomerId){
+        await User.updateOne({ id: this.req.me.id })
+        .set({
+          stripeCustomerId
+        });
+      }
+    }
+
+    // If an email address change was requested, and re-confirmation is required,
+    // send the "confirm account" email.
+    if (desiredEmailEffect === 'begin-change' || desiredEmailEffect === 'modify-pending-change') {
+      await sails.helpers.sendTemplateEmail.with({
+        to: newEmailAddress,
+        subject: 'Your account has been updated',
+        template: 'email-verify-new-email',
+        templateData: {
+          fullName: fullName||this.req.me.fullName,
+          token: valuesToSet.emailProofToken
+        }
+      });
+    }
+
+  }
+
+
+};
diff --git a/ee/bulk-operations-dashboard/api/controllers/account/view-account-overview.js b/ee/bulk-operations-dashboard/api/controllers/account/view-account-overview.js
new file mode 100644
index 0000000000..f5841f9981
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/controllers/account/view-account-overview.js
@@ -0,0 +1,30 @@
+module.exports = {
+
+
+  friendlyName: 'View account overview',
+
+
+  description: 'Display "Account Overview" page.',
+
+
+  exits: {
+
+    success: {
+      viewTemplatePath: 'pages/account/account-overview',
+    }
+
+  },
+
+
+  fn: async function () {
+
+    // If billing features are enabled, include our configured Stripe.js
+    // public key in the view locals.  Otherwise, leave it as undefined.
+    return {
+      stripePublishableKey: sails.config.custom.enableBillingFeatures? sails.config.custom.stripePublishableKey : undefined,
+    };
+
+  }
+
+
+};
diff --git a/ee/bulk-operations-dashboard/api/controllers/account/view-edit-password.js b/ee/bulk-operations-dashboard/api/controllers/account/view-edit-password.js
new file mode 100644
index 0000000000..208a1d6a3f
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/controllers/account/view-edit-password.js
@@ -0,0 +1,26 @@
+module.exports = {
+
+
+  friendlyName: 'View edit password',
+
+
+  description: 'Display "Edit password" page.',
+
+
+  exits: {
+
+    success: {
+      viewTemplatePath: 'pages/account/edit-password'
+    }
+
+  },
+
+
+  fn: async function () {
+
+    return {};
+
+  }
+
+
+};
diff --git a/ee/bulk-operations-dashboard/api/controllers/account/view-edit-profile.js b/ee/bulk-operations-dashboard/api/controllers/account/view-edit-profile.js
new file mode 100644
index 0000000000..baea0f7c20
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/controllers/account/view-edit-profile.js
@@ -0,0 +1,26 @@
+module.exports = {
+
+
+  friendlyName: 'View edit profile',
+
+
+  description: 'Display "Edit profile" page.',
+
+
+  exits: {
+
+    success: {
+      viewTemplatePath: 'pages/account/edit-profile',
+    }
+
+  },
+
+
+  fn: async function () {
+
+    return {};
+
+  }
+
+
+};
diff --git a/ee/bulk-operations-dashboard/api/controllers/entrance/confirm-email.js b/ee/bulk-operations-dashboard/api/controllers/entrance/confirm-email.js
new file mode 100644
index 0000000000..01afe04cd9
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/controllers/entrance/confirm-email.js
@@ -0,0 +1,160 @@
+module.exports = {
+
+
+  friendlyName: 'Confirm email',
+
+
+  description:
+`Confirm a new user's email address, or an existing user's request for an email address change,
+then redirect to either a special landing page (for newly-signed up users), or the account page
+(for existing users who just changed their email address).`,
+
+
+  inputs: {
+
+    token: {
+      description: 'The confirmation token from the email.',
+      example: '4-32fad81jdaf$329'
+    }
+
+  },
+
+
+  exits: {
+
+    success: {
+      description: 'Email address confirmed and requesting user logged in.'
+    },
+
+    redirect: {
+      description: 'Email address confirmed and requesting user logged in.  Since this looks like a browser, redirecting...',
+      responseType: 'redirect'
+    },
+
+    invalidOrExpiredToken: {
+      responseType: 'expired',
+      description: 'The provided token is expired, invalid, or already used up.',
+    },
+
+    emailAddressNoLongerAvailable: {
+      statusCode: 409,
+      viewTemplatePath: '500',
+      description: 'The email address is no longer available.',
+      extendedDescription: 'This is an edge case that is not always anticipated by websites and APIs.  Since it is pretty rare, the 500 server error page is used as a simple catch-all.  If this becomes important in the future, this could easily be expanded into a custom error page or resolution flow.  But for context: this behavior of showing the 500 server error page mimics how popular apps like Slack behave under the same circumstances.',
+    }
+
+  },
+
+
+  fn: async function ({token}) {
+
+    // If no token was provided, this is automatically invalid.
+    if (!token) {
+      throw 'invalidOrExpiredToken';
+    }
+
+    // Get the user with the matching email token.
+    var user = await User.findOne({ emailProofToken: token });
+
+    // If no such user exists, or their token is expired, bail.
+    if (!user || user.emailProofTokenExpiresAt <= Date.now()) {
+      throw 'invalidOrExpiredToken';
+    }
+
+    if (user.emailStatus === 'unconfirmed') {
+      //  ┌─┐┌─┐┌┐┌┌─┐┬┬─┐┌┬┐┬┌┐┌┌─┐  ╔═╗╦╦═╗╔═╗╔╦╗ ╔╦╗╦╔╦╗╔═╗  ╦ ╦╔═╗╔═╗╦═╗  ┌─┐┌┬┐┌─┐┬┬
+      //  │  │ ││││├┤ │├┬┘││││││││ ┬  ╠╣ ║╠╦╝╚═╗ ║───║ ║║║║║╣   ║ ║╚═╗║╣ ╠╦╝  ├┤ │││├─┤││
+      //  └─┘└─┘┘└┘└  ┴┴└─┴ ┴┴┘└┘└─┘  ╚  ╩╩╚═╚═╝ ╩   ╩ ╩╩ ╩╚═╝  ╚═╝╚═╝╚═╝╩╚═  └─┘┴ ┴┴ ┴┴┴─┘
+      // If this is a new user confirming their email for the first time,
+      // then just update the state of their user record in the database,
+      // store their user id in the session (just in case they aren't logged
+      // in already), and then redirect them to the "email confirmed" page.
+      await User.updateOne({ id: user.id }).set({
+        emailStatus: 'confirmed',
+        emailProofToken: '',
+        emailProofTokenExpiresAt: 0
+      });
+      this.req.session.userId = user.id;
+
+      // In case there was an existing session, broadcast a message that we can
+      // display in other open tabs.
+      if (sails.hooks.sockets) {
+        await sails.helpers.broadcastSessionChange(this.req);
+      }
+
+      if (this.req.wantsJSON) {
+        return;
+      } else {
+        throw { redirect: '/email/confirmed' };
+      }
+
+    } else if (user.emailStatus === 'change-requested') {
+      //  ┌─┐┌─┐┌┐┌┌─┐┬┬─┐┌┬┐┬┌┐┌┌─┐  ╔═╗╦ ╦╔═╗╔╗╔╔═╗╔═╗╔╦╗  ┌─┐┌┬┐┌─┐┬┬
+      //  │  │ ││││├┤ │├┬┘││││││││ ┬  ║  ╠═╣╠═╣║║║║ ╦║╣  ║║  ├┤ │││├─┤││
+      //  └─┘└─┘┘└┘└  ┴┴└─┴ ┴┴┘└┘└─┘  ╚═╝╩ ╩╩ ╩╝╚╝╚═╝╚═╝═╩╝  └─┘┴ ┴┴ ┴┴┴─┘
+      if (!user.emailChangeCandidate){
+        throw new Error(`Consistency violation: Could not update Stripe customer because this user record's emailChangeCandidate ("${user.emailChangeCandidate}") is missing.  (This should never happen.)`);
+      }
+
+      // Last line of defense: since email change candidates are not protected
+      // by a uniqueness constraint in the database, it's important that we make
+      // sure no one else managed to grab this email in the mean time since we
+      // last checked its availability. (This is a relatively rare edge case--
+      // see exit description.)
+      if (await User.count({ emailAddress: user.emailChangeCandidate }) > 0) {
+        throw 'emailAddressNoLongerAvailable';
+      }
+
+      // If billing features are enabled, also update the billing email for this
+      // user's linked customer entry in the Stripe API to make sure they receive
+      // email receipts.
+      // > Note: If there was not already a Stripe customer entry for this user,
+      // > then one will be set up implicitly, so we'll need to persist it to our
+      // > database.  (This could happen if Stripe credentials were not configured
+      // > at the time this user was originally created.)
+      if(sails.config.custom.enableBillingFeatures) {
+        let didNotAlreadyHaveCustomerId = (! user.stripeCustomerId);
+        let stripeCustomerId = await sails.helpers.stripe.saveBillingInfo.with({
+          stripeCustomerId: user.stripeCustomerId,
+          emailAddress: user.emailChangeCandidate
+        }).timeout(5000).retry();
+        if (didNotAlreadyHaveCustomerId){
+          await User.updateOne({ id: user.id }).set({
+            stripeCustomerId
+          });
+        }
+      }
+
+      // Finally update the user in the database, store their id in the session
+      // (just in case they aren't logged in already), then redirect them to
+      // their "my account" page so they can see their updated email address.
+      await User.updateOne({ id: user.id })
+      .set({
+        emailStatus: 'confirmed',
+        emailProofToken: '',
+        emailProofTokenExpiresAt: 0,
+        emailAddress: user.emailChangeCandidate,
+        emailChangeCandidate: '',
+      });
+      this.req.session.userId = user.id;
+
+      // In case there was an existing session, broadcast a message that we can
+      // display in other open tabs.
+      if (sails.hooks.sockets) {
+        await sails.helpers.broadcastSessionChange(this.req);
+      }
+
+      if (this.req.wantsJSON) {
+        return;
+      } else {
+        throw { redirect: '/account' };
+      }
+
+    } else {
+      throw new Error(`Consistency violation: User ${user.id} has an email proof token, but somehow also has an emailStatus of "${user.emailStatus}"!  (This should never happen.)`);
+    }
+
+  }
+
+
+};
diff --git a/ee/bulk-operations-dashboard/api/controllers/entrance/login.js b/ee/bulk-operations-dashboard/api/controllers/entrance/login.js
new file mode 100644
index 0000000000..a95aabf84c
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/controllers/entrance/login.js
@@ -0,0 +1,119 @@
+module.exports = {
+
+
+  friendlyName: 'Login',
+
+
+  description: 'Log in using the provided email and password combination.',
+
+
+  extendedDescription:
+`This action attempts to look up the user record in the database with the
+specified email address.  Then, if such a user exists, it uses
+bcrypt to compare the hashed password from the database with the provided
+password attempt.`,
+
+
+  inputs: {
+
+    emailAddress: {
+      description: 'The email to try in this attempt, e.g. "irl@example.com".',
+      type: 'string',
+      required: true
+    },
+
+    password: {
+      description: 'The unencrypted password to try in this attempt, e.g. "passwordlol".',
+      type: 'string',
+      required: true
+    },
+
+    rememberMe: {
+      description: 'Whether to extend the lifetime of the user\'s session.',
+      extendedDescription:
+`Note that this is NOT SUPPORTED when using virtual requests (e.g. sending
+requests over WebSockets instead of HTTP).`,
+      type: 'boolean'
+    }
+
+  },
+
+
+  exits: {
+
+    success: {
+      description: 'The requesting user agent has been successfully logged in.',
+      extendedDescription:
+`Under the covers, this stores the id of the logged-in user in the session
+as the \`userId\` key.  The next time this user agent sends a request, assuming
+it includes a cookie (like a web browser), Sails will automatically make this
+user id available as req.session.userId in the corresponding action.  (Also note
+that, thanks to the included "custom" hook, when a relevant request is received
+from a logged-in user, that user's entire record from the database will be fetched
+and exposed as \`req.me\`.)`
+    },
+
+    badCombo: {
+      description: `The provided email and password combination does not
+      match any user in the database.`,
+      responseType: 'unauthorized'
+      // ^This uses the custom `unauthorized` response located in `api/responses/unauthorized.js`.
+      // To customize the generic "unauthorized" response across this entire app, change that file
+      // (see api/responses/unauthorized).
+      //
+      // To customize the response for _only this_ action, replace `responseType` with
+      // something else.  For example, you might set `statusCode: 498` and change the
+      // implementation below accordingly (see http://sailsjs.com/docs/concepts/controllers).
+    }
+
+  },
+
+
+  fn: async function ({emailAddress, password, rememberMe}) {
+
+    // Look up by the email address.
+    // (note that we lowercase it to ensure the lookup is always case-insensitive,
+    // regardless of which database we're using)
+    var userRecord = await User.findOne({
+      emailAddress: emailAddress.toLowerCase(),
+    });
+
+    // If there was no matching user, respond thru the "badCombo" exit.
+    if(!userRecord) {
+      throw 'badCombo';
+    }
+
+    // If the password doesn't match, then also exit thru "badCombo".
+    await sails.helpers.passwords.checkPassword(password, userRecord.password)
+    .intercept('incorrect', 'badCombo');
+
+    // If "Remember Me" was enabled, then keep the session alive for
+    // a longer amount of time.  (This causes an updated "Set Cookie"
+    // response header to be sent as the result of this request -- thus
+    // we must be dealing with a traditional HTTP request in order for
+    // this to work.)
+    if (rememberMe) {
+      if (this.req.isSocket) {
+        sails.log.warn(
+          'Received `rememberMe: true` from a virtual request, but it was ignored\n'+
+          'because a browser\'s session cookie cannot be reset over sockets.\n'+
+          'Please use a traditional HTTP request instead.'
+        );
+      } else {
+        this.req.session.cookie.maxAge = sails.config.custom.rememberMeCookieMaxAge;
+      }
+    }//fi
+
+    // Modify the active session instance.
+    // (This will be persisted when the response is sent.)
+    this.req.session.userId = userRecord.id;
+
+    // In case there was an existing session (e.g. if we allow users to go to the login page
+    // when they're already logged in), broadcast a message that we can display in other open tabs.
+    if (sails.hooks.sockets) {
+      await sails.helpers.broadcastSessionChange(this.req);
+    }
+
+  }
+
+};
diff --git a/ee/bulk-operations-dashboard/api/controllers/entrance/send-password-recovery-email.js b/ee/bulk-operations-dashboard/api/controllers/entrance/send-password-recovery-email.js
new file mode 100644
index 0000000000..21d8f0efa2
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/controllers/entrance/send-password-recovery-email.js
@@ -0,0 +1,66 @@
+module.exports = {
+
+
+  friendlyName: 'Send password recovery email',
+
+
+  description: 'Send a password recovery notification to the user with the specified email address.',
+
+
+  inputs: {
+
+    emailAddress: {
+      description: 'The email address of the alleged user who wants to recover their password.',
+      example: 'rydahl@example.com',
+      type: 'string',
+      required: true
+    }
+
+  },
+
+
+  exits: {
+
+    success: {
+      description: 'The email address might have matched a user in the database.  (If so, a recovery email was sent.)'
+    },
+
+  },
+
+
+  fn: async function ({emailAddress}) {
+
+    // Find the record for this user.
+    // (Even if no such user exists, pretend it worked to discourage sniffing.)
+    var userRecord = await User.findOne({ emailAddress });
+    if (!userRecord) {
+      return;
+    }//•
+
+    // Come up with a pseudorandom, probabilistically-unique token for use
+    // in our password recovery email.
+    var token = await sails.helpers.strings.random('url-friendly');
+
+    // Store the token on the user record
+    // (This allows us to look up the user when the link from the email is clicked.)
+    await User.updateOne({ id: userRecord.id })
+    .set({
+      passwordResetToken: token,
+      passwordResetTokenExpiresAt: Date.now() + sails.config.custom.passwordResetTokenTTL,
+    });
+
+    // Send recovery email
+    await sails.helpers.sendTemplateEmail.with({
+      to: emailAddress,
+      subject: 'Password reset instructions',
+      template: 'email-reset-password',
+      templateData: {
+        fullName: userRecord.fullName,
+        token: token
+      }
+    });
+
+  }
+
+
+};
diff --git a/ee/bulk-operations-dashboard/api/controllers/entrance/signup.js b/ee/bulk-operations-dashboard/api/controllers/entrance/signup.js
new file mode 100644
index 0000000000..e1fd133c59
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/controllers/entrance/signup.js
@@ -0,0 +1,127 @@
+module.exports = {
+
+
+  friendlyName: 'Signup',
+
+
+  description: 'Sign up for a new user account.',
+
+
+  extendedDescription:
+`This creates a new user record in the database, signs in the requesting user agent
+by modifying its [session](https://sailsjs.com/documentation/concepts/sessions), and
+(if emailing with Mailgun is enabled) sends an account verification email.
+
+If a verification email is sent, the new user's account is put in an "unconfirmed" state
+until they confirm they are using a legitimate email address (by clicking the link in
+the account verification message.)`,
+
+
+  inputs: {
+
+    emailAddress: {
+      required: true,
+      type: 'string',
+      isEmail: true,
+      description: 'The email address for the new account, e.g. m@example.com.',
+      extendedDescription: 'Must be a valid email address.',
+    },
+
+    password: {
+      required: true,
+      type: 'string',
+      maxLength: 200,
+      example: 'passwordlol',
+      description: 'The unencrypted password to use for the new account.'
+    },
+
+    fullName:  {
+      required: true,
+      type: 'string',
+      example: 'Frida Kahlo de Rivera',
+      description: 'The user\'s full name.',
+    }
+
+  },
+
+
+  exits: {
+
+    success: {
+      description: 'New user account was created successfully.'
+    },
+
+    invalid: {
+      responseType: 'badRequest',
+      description: 'The provided fullName, password and/or email address are invalid.',
+      extendedDescription: 'If this request was sent from a graphical user interface, the request '+
+      'parameters should have been validated/coerced _before_ they were sent.'
+    },
+
+    emailAlreadyInUse: {
+      statusCode: 409,
+      description: 'The provided email address is already in use.',
+    },
+
+  },
+
+
+  fn: async function ({emailAddress, password, fullName}) {
+
+    var newEmailAddress = emailAddress.toLowerCase();
+
+    // Build up data for the new user record and save it to the database.
+    // (Also use `fetch` to retrieve the new ID so that we can use it below.)
+    var newUserRecord = await User.create(_.extend({
+      fullName,
+      emailAddress: newEmailAddress,
+      password: await sails.helpers.passwords.hashPassword(password),
+      tosAcceptedByIp: this.req.ip
+    }, sails.config.custom.verifyEmailAddresses? {
+      emailProofToken: await sails.helpers.strings.random('url-friendly'),
+      emailProofTokenExpiresAt: Date.now() + sails.config.custom.emailProofTokenTTL,
+      emailStatus: 'unconfirmed'
+    }:{}))
+    .intercept('E_UNIQUE', 'emailAlreadyInUse')
+    .intercept({name: 'UsageError'}, 'invalid')
+    .fetch();
+
+    // If billing feaures are enabled, save a new customer entry in the Stripe API.
+    // Then persist the Stripe customer id in the database.
+    if (sails.config.custom.enableBillingFeatures) {
+      let stripeCustomerId = await sails.helpers.stripe.saveBillingInfo.with({
+        emailAddress: newEmailAddress
+      }).timeout(5000).retry();
+      await User.updateOne({id: newUserRecord.id})
+      .set({
+        stripeCustomerId
+      });
+    }
+
+    // Store the user's new id in their session.
+    this.req.session.userId = newUserRecord.id;
+
+    // In case there was an existing session (e.g. if we allow users to go to the signup page
+    // when they're already logged in), broadcast a message that we can display in other open tabs.
+    if (sails.hooks.sockets) {
+      await sails.helpers.broadcastSessionChange(this.req);
+    }
+
+    if (sails.config.custom.verifyEmailAddresses) {
+      // Send "confirm account" email
+      await sails.helpers.sendTemplateEmail.with({
+        to: newEmailAddress,
+        subject: 'Please confirm your account',
+        template: 'email-verify-account',
+        templateData: {
+          fullName,
+          token: newUserRecord.emailProofToken
+        }
+      });
+    } else {
+      sails.log.info('Skipping new account email verification... (since `verifyEmailAddresses` is disabled)');
+    }
+
+  }
+
+};
diff --git a/ee/bulk-operations-dashboard/api/controllers/entrance/update-password-and-login.js b/ee/bulk-operations-dashboard/api/controllers/entrance/update-password-and-login.js
new file mode 100644
index 0000000000..51a75b8746
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/controllers/entrance/update-password-and-login.js
@@ -0,0 +1,80 @@
+module.exports = {
+
+
+  friendlyName: 'Update password and login',
+
+
+  description: 'Finish the password recovery flow by setting the new password and '+
+  'logging in the requesting user, based on the authenticity of their token.',
+
+
+  inputs: {
+
+    password: {
+      description: 'The new, unencrypted password.',
+      example: 'abc123v2',
+      required: true
+    },
+
+    token: {
+      description: 'The password token that was generated by the `sendPasswordRecoveryEmail` endpoint.',
+      example: 'gwa8gs8hgw9h2g9hg29hgwh9asdgh9q34$$$$$asdgasdggds',
+      required: true
+    }
+
+  },
+
+
+  exits: {
+
+    success: {
+      description: 'Password successfully updated, and requesting user agent is now logged in.'
+    },
+
+    invalidToken: {
+      description: 'The provided password token is invalid, expired, or has already been used.',
+      responseType: 'expired'
+    }
+
+  },
+
+
+  fn: async function ({password, token}) {
+
+    if(!token) {
+      throw 'invalidToken';
+    }
+
+    // Look up the user with this reset token.
+    var userRecord = await User.findOne({ passwordResetToken: token });
+
+    // If no such user exists, or their token is expired, bail.
+    if (!userRecord || userRecord.passwordResetTokenExpiresAt <= Date.now()) {
+      throw 'invalidToken';
+    }
+
+    // Hash the new password.
+    var hashed = await sails.helpers.passwords.hashPassword(password);
+
+    // Store the user's new password and clear their reset token so it can't be used again.
+    await User.updateOne({ id: userRecord.id })
+    .set({
+      password: hashed,
+      passwordResetToken: '',
+      passwordResetTokenExpiresAt: 0
+    });
+
+    // Log the user in.
+    // (This will be persisted when the response is sent.)
+    this.req.session.userId = userRecord.id;
+
+    // In case there was an existing session, broadcast a message that we can
+    // display in other open tabs.
+    if (sails.hooks.sockets) {
+      await sails.helpers.broadcastSessionChange(this.req);
+    }
+
+  }
+
+
+};
diff --git a/ee/bulk-operations-dashboard/api/controllers/entrance/view-confirmed-email.js b/ee/bulk-operations-dashboard/api/controllers/entrance/view-confirmed-email.js
new file mode 100644
index 0000000000..0602f10e99
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/controllers/entrance/view-confirmed-email.js
@@ -0,0 +1,27 @@
+module.exports = {
+
+
+  friendlyName: 'View confirmed email',
+
+
+  description: 'Display "Confirmed email" page.',
+
+
+  exits: {
+
+    success: {
+      viewTemplatePath: 'pages/entrance/confirmed-email'
+    }
+
+  },
+
+
+  fn: async function () {
+
+    // Respond with view.
+    return {};
+
+  }
+
+
+};
diff --git a/ee/bulk-operations-dashboard/api/controllers/entrance/view-forgot-password.js b/ee/bulk-operations-dashboard/api/controllers/entrance/view-forgot-password.js
new file mode 100644
index 0000000000..e6b5404c9f
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/controllers/entrance/view-forgot-password.js
@@ -0,0 +1,36 @@
+module.exports = {
+
+
+  friendlyName: 'View forgot password',
+
+
+  description: 'Display "Forgot password" page.',
+
+
+  exits: {
+
+    success: {
+      viewTemplatePath: 'pages/entrance/forgot-password',
+    },
+
+    redirect: {
+      description: 'The requesting user is already logged in.',
+      extendedDescription: 'Logged-in users should change their password in "Account settings."',
+      responseType: 'redirect',
+    }
+
+  },
+
+
+  fn: async function () {
+
+    if (this.req.me) {
+      throw {redirect: '/'};
+    }
+
+    return {};
+
+  }
+
+
+};
diff --git a/ee/bulk-operations-dashboard/api/controllers/entrance/view-login.js b/ee/bulk-operations-dashboard/api/controllers/entrance/view-login.js
new file mode 100644
index 0000000000..1d1c590b53
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/controllers/entrance/view-login.js
@@ -0,0 +1,35 @@
+module.exports = {
+
+
+  friendlyName: 'View login',
+
+
+  description: 'Display "Login" page.',
+
+
+  exits: {
+
+    success: {
+      viewTemplatePath: 'pages/entrance/login',
+    },
+
+    redirect: {
+      description: 'The requesting user is already logged in.',
+      responseType: 'redirect'
+    }
+
+  },
+
+
+  fn: async function () {
+
+    if (this.req.me) {
+      throw {redirect: '/'};
+    }
+
+    return {};
+
+  }
+
+
+};
diff --git a/ee/bulk-operations-dashboard/api/controllers/entrance/view-new-password.js b/ee/bulk-operations-dashboard/api/controllers/entrance/view-new-password.js
new file mode 100644
index 0000000000..4532fa5fef
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/controllers/entrance/view-new-password.js
@@ -0,0 +1,57 @@
+module.exports = {
+
+
+  friendlyName: 'View new password',
+
+
+  description: 'Display "New password" page.',
+
+
+  inputs: {
+
+    token: {
+      description: 'The password reset token from the email.',
+      example: '4-32fad81jdaf$329'
+    }
+
+  },
+
+
+  exits: {
+
+    success: {
+      viewTemplatePath: 'pages/entrance/new-password'
+    },
+
+    invalidOrExpiredToken: {
+      responseType: 'expired',
+      description: 'The provided token is expired, invalid, or has already been used.',
+    }
+
+  },
+
+
+  fn: async function ({token}) {
+
+    // If password reset token is missing, display an error page explaining that the link is bad.
+    if (!token) {
+      sails.log.warn('Attempting to view new password (recovery) page, but no reset password token included in request!  Displaying error page...');
+      throw 'invalidOrExpiredToken';
+    }//•
+
+    // Look up the user with this reset token.
+    var userRecord = await User.findOne({ passwordResetToken: token });
+    // If no such user exists, or their token is expired, display an error page explaining that the link is bad.
+    if (!userRecord || userRecord.passwordResetTokenExpiresAt <= Date.now()) {
+      throw 'invalidOrExpiredToken';
+    }
+
+    // Grab token and include it in view locals
+    return {
+      token,
+    };
+
+  }
+
+
+};
diff --git a/ee/bulk-operations-dashboard/api/controllers/entrance/view-signup.js b/ee/bulk-operations-dashboard/api/controllers/entrance/view-signup.js
new file mode 100644
index 0000000000..be43753770
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/controllers/entrance/view-signup.js
@@ -0,0 +1,35 @@
+module.exports = {
+
+
+  friendlyName: 'View signup',
+
+
+  description: 'Display "Signup" page.',
+
+
+  exits: {
+
+    success: {
+      viewTemplatePath: 'pages/entrance/signup',
+    },
+
+    redirect: {
+      description: 'The requesting user is already logged in.',
+      responseType: 'redirect'
+    }
+
+  },
+
+
+  fn: async function () {
+
+    if (this.req.me) {
+      throw {redirect: '/'};
+    }
+
+    return {};
+
+  }
+
+
+};
diff --git a/ee/bulk-operations-dashboard/api/controllers/get-profiles.js b/ee/bulk-operations-dashboard/api/controllers/get-profiles.js
new file mode 100644
index 0000000000..7326fea9ae
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/controllers/get-profiles.js
@@ -0,0 +1,113 @@
+module.exports = {
+
+
+  friendlyName: 'Get profiles',
+
+
+  description: 'Builds and returns an array of deployed configuration profiles on the Fleet instance and undeployed profiles stored in the dashboard\'s datastore.',
+
+  exits: {
+    success: {
+      outputType: [{}],
+    }
+  },
+
+
+  fn: async function () {
+    // Get all teams on the Fleet instance.
+    let teamsResponseData = await sails.helpers.http.get.with({
+      url: '/api/v1/fleet/teams',
+      baseUrl: sails.config.custom.fleetBaseUrl,
+      headers: {
+        Authorization: `Bearer ${sails.config.custom.fleetApiToken}`
+      }
+    })
+    .timeout(120000)
+    .retry(['requestFailed', {name: 'TimeoutError'}]);
+
+    let allTeams = teamsResponseData.teams;
+
+    let teams = [];
+    for(let team of allTeams) {
+      teams.push({
+        fleetApid: team.id,
+        teamName: team.name,
+      });
+    }
+    // Add the "team" for hosts with no team
+    teams.push({
+      fleetApid: 0,
+      teamName: 'No team',
+    });
+
+
+    let allProfiles = [];
+    let teamApids = _.pluck(allTeams, 'id');
+    // Get all of the configuration profiles on the Fleet instance.
+    for(let teamApid of teamApids){
+      let configurationProfilesResponseData = await sails.helpers.http.get.with({
+        url: `/api/v1/fleet/configuration_profiles?team_id=${teamApid}`,
+        baseUrl: sails.config.custom.fleetBaseUrl,
+        headers: {
+          Authorization: `Bearer ${sails.config.custom.fleetApiToken}`
+        }
+      })
+      .timeout(120000)
+      .retry(['requestFailed', {name: 'TimeoutError'}]);
+      let profilesForThisTeam = configurationProfilesResponseData.profiles;
+      allProfiles = allProfiles.concat(profilesForThisTeam);
+    }
+
+    // Add the configurations profiles that are assigned to the "no team" team.
+    let noTeamConfigurationProfilesResponseData = await sails.helpers.http.get.with({
+      url: '/api/v1/fleet/configuration_profiles',
+      baseUrl: sails.config.custom.fleetBaseUrl,
+      headers: {
+        Authorization: `Bearer ${sails.config.custom.fleetApiToken}`
+      }
+    })
+    .timeout(120000)
+    .retry(['requestFailed', {name: 'TimeoutError'}]);
+    let profilesForThisTeam = noTeamConfigurationProfilesResponseData.profiles;
+    allProfiles = allProfiles.concat(profilesForThisTeam);
+
+    // console.log(allProfiles);
+
+    let profilesOnThisFleetInstance = [];
+    // Group configuration profiles by their identifier.
+    let allProfilesByIdentifier = _.groupBy(allProfiles, 'identifier');
+    for(let profileIdentifier in allProfilesByIdentifier) {
+      // Iterate through the arrays of profiles with the same unique identifier.
+      let teamsForThisProfile = [];
+      // Add the profile's UUID and information about the team this profile is assigned to the teams array for profiles.
+      for(let profile of allProfilesByIdentifier[profileIdentifier]){
+        let informationAboutThisProfile = {
+          uuid: profile.profile_uuid,
+          fleetApid: profile.team_id,
+          teamName: _.find(teams, {fleetApid: profile.team_id}).teamName,
+        };
+        teamsForThisProfile.push(informationAboutThisProfile);
+      }
+      let profile = allProfilesByIdentifier[profileIdentifier][0];// Grab the first profile returned in the api repsonse to build our profile configuration.
+      let profileInformation = {
+        name: profile.name,
+        identifier: profileIdentifier,
+        platform: profile.platform,
+        createdAt: new Date(profile.created_at).getTime(),
+        teams: teamsForThisProfile
+      };
+      profilesOnThisFleetInstance.push(profileInformation);
+    }
+    // Get the undeployed profiles from the app's database.
+    let undeployedProfiles = await UndeployedProfile.find();
+    profilesOnThisFleetInstance = _.union(profilesOnThisFleetInstance, undeployedProfiles);
+
+    // Sort profiles by their name.
+    profilesOnThisFleetInstance = _.sortByOrder(profilesOnThisFleetInstance, 'name', 'asc');
+
+    return profilesOnThisFleetInstance;
+
+  }
+
+
+};
diff --git a/ee/bulk-operations-dashboard/api/controllers/get-scripts.js b/ee/bulk-operations-dashboard/api/controllers/get-scripts.js
new file mode 100644
index 0000000000..1900b9b700
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/controllers/get-scripts.js
@@ -0,0 +1,120 @@
+module.exports = {
+
+
+  friendlyName: 'Get scripts',
+
+
+  description: 'Builds and returns an array of deployed scripts on the Fleet instance and undeployed scripts stored in the dashboard\'s datastore',
+
+
+  exits: {
+    success: {
+      outputType: [{}],
+    }
+  },
+
+
+  fn: async function () {
+    // Get all teams on the Fleet instance.
+    let teamsResponseData = await sails.helpers.http.get.with({
+      url: '/api/v1/fleet/teams',
+      baseUrl: sails.config.custom.fleetBaseUrl,
+      headers: {
+        Authorization: `Bearer ${sails.config.custom.fleetApiToken}`
+      }
+    })
+    .timeout(120000)
+    .retry(['requestFailed', {name: 'TimeoutError'}]);
+
+    let allTeams = teamsResponseData.teams;
+
+    let teamApids = _.pluck(allTeams, 'id');
+    let teams = [];
+    for(let team of allTeams) {
+      teams.push({
+        fleetApid: team.id,
+        teamName: team.name,
+      });
+    }
+    // Add the "team" for hosts with no team
+    teams.push({
+      fleetApid: 0,
+      teamName: 'No team',
+    });
+
+
+    let allScripts = [];
+    // Get all of the scripts on a Fleet instance.
+    for(let teamApid of teamApids){
+      let scriptsResponseData = await sails.helpers.http.get.with({
+        url: `/api/v1/fleet/scripts?team_id=${teamApid}`,
+        baseUrl: sails.config.custom.fleetBaseUrl,
+        headers: {
+          Authorization: `Bearer ${sails.config.custom.fleetApiToken}`
+        }
+      })
+      .timeout(120000)
+      .retry(['requestFailed', {name: 'TimeoutError'}]);
+      let scriptsForThisTeam = scriptsResponseData.scripts;
+      if(scriptsForThisTeam !== null) {
+        allScripts = allScripts.concat(scriptsForThisTeam);
+      }
+    }
+
+    // Grab all of the configuration scripts on the Fleet instance.
+    let noTeamConfigurationScriptsResponseData = await sails.helpers.http.get.with({
+      url: '/api/v1/fleet/scripts',
+      baseUrl: sails.config.custom.fleetBaseUrl,
+      headers: {
+        Authorization: `Bearer ${sails.config.custom.fleetApiToken}`
+      }
+    })
+    .timeout(120000)
+    .retry(['requestFailed', {name: 'TimeoutError'}]);
+    let scriptsForThisTeam = noTeamConfigurationScriptsResponseData.scripts;
+
+    if(scriptsForThisTeam !== null){
+      allScripts = allScripts.concat(scriptsForThisTeam);
+    }
+
+    // If there are no scripts on the Fleet instance, return an empty array and the teams information.
+    if(allScripts === [ null ]){
+      return {scripts: [], teams};
+    }
+    let scriptsOnThisFleetInstance = [];
+
+    let allScriptsByIdentifier = _.groupBy(allScripts, 'name');
+    for(let scriptIdentifier in allScriptsByIdentifier) {
+      if(scriptIdentifier === null){
+        continue;
+      }
+      let teamsForThisProfile = [];
+      for(let script of allScriptsByIdentifier[scriptIdentifier]){
+        let informationAboutThisScript = {
+          scriptFleetApid: script.id,
+          fleetApid: script.team_id ? script.team_id : 0,
+          teamName: script.team_id ? _.find(teams, {fleetApid: script.team_id}).teamName : 'No team',
+        };
+        teamsForThisProfile.push(informationAboutThisScript);
+      }
+      let script = allScriptsByIdentifier[scriptIdentifier][0];// Grab the first script returned in the api repsonse to build our script configuration.
+      let scriptInformation = {
+        name: script.name,
+        identifier: scriptIdentifier,
+        platform: _.endsWith(script.name, 'sh') ? 'macOS & Linux' : 'Windows',
+        createdAt: new Date(script.created_at).getTime(),
+        teams: teamsForThisProfile
+      };
+      scriptsOnThisFleetInstance.push(scriptInformation);
+    }
+    // Get the undeployed scripts from the app's database.
+    let undeployedScripts = await UndeployedScript.find();
+    scriptsOnThisFleetInstance = _.union(scriptsOnThisFleetInstance, undeployedScripts);
+    // Sort scripts by their name.
+    scriptsOnThisFleetInstance = _.sortByOrder(scriptsOnThisFleetInstance, 'name', 'asc');
+    return scriptsOnThisFleetInstance;
+
+  }
+
+
+};
diff --git a/ee/bulk-operations-dashboard/api/controllers/legal/view-privacy.js b/ee/bulk-operations-dashboard/api/controllers/legal/view-privacy.js
new file mode 100644
index 0000000000..6960be873f
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/controllers/legal/view-privacy.js
@@ -0,0 +1,27 @@
+module.exports = {
+
+
+  friendlyName: 'View privacy',
+
+
+  description: 'Display "Privacy policy" page.',
+
+
+  exits: {
+
+    success: {
+      viewTemplatePath: 'pages/legal/privacy'
+    }
+
+  },
+
+
+  fn: async function () {
+
+    // All done.
+    return;
+
+  }
+
+
+};
diff --git a/ee/bulk-operations-dashboard/api/controllers/legal/view-terms.js b/ee/bulk-operations-dashboard/api/controllers/legal/view-terms.js
new file mode 100644
index 0000000000..643f04408a
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/controllers/legal/view-terms.js
@@ -0,0 +1,27 @@
+module.exports = {
+
+
+  friendlyName: 'View terms',
+
+
+  description: 'Display "Legal terms" page.',
+
+
+  exits: {
+
+    success: {
+      viewTemplatePath: 'pages/legal/terms'
+    }
+
+  },
+
+
+  fn: async function () {
+
+    // All done.
+    return;
+
+  }
+
+
+};
diff --git a/ee/bulk-operations-dashboard/api/controllers/profiles/delete-profile.js b/ee/bulk-operations-dashboard/api/controllers/profiles/delete-profile.js
new file mode 100644
index 0000000000..3a97405869
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/controllers/profiles/delete-profile.js
@@ -0,0 +1,46 @@
+module.exports = {
+
+
+  friendlyName: 'Delete profile',
+
+
+  description: '',
+
+
+  inputs: {
+    profile: {
+      type: {},
+      description: 'The configuration profile that will be deleted.',
+      required: true,
+    }
+  },
+
+
+  exits: {
+
+  },
+
+
+  fn: async function ({profile}) {
+    // If the provided profile does not have a teams array and has an ID, it is an undeployed profile that will be deleted.
+    if(profile.id && !profile.teams){
+      await UndeployedProfile.destroy({id: profile.id});
+    } else {// Otherwise, this is a deployed profile, and we'll use information from the teams array to remove the profile.
+      for(let team of profile.teams){
+        await sails.helpers.http.sendHttpRequest.with({
+          method: 'DELETE',
+          baseUrl: sails.config.custom.fleetBaseUrl,
+          url: `/api/v1/fleet/configuration_profiles/${team.uuid}`,
+          headers: {
+            Authorization: `Bearer ${sails.config.custom.fleetApiToken}`,
+          }
+        });
+      }
+    }
+    // All done.
+    return;
+
+  }
+
+
+};
diff --git a/ee/bulk-operations-dashboard/api/controllers/profiles/download-profile.js b/ee/bulk-operations-dashboard/api/controllers/profiles/download-profile.js
new file mode 100644
index 0000000000..ebbf569d52
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/controllers/profiles/download-profile.js
@@ -0,0 +1,78 @@
+module.exports = {
+
+
+  friendlyName: 'Download profile',
+
+
+  description: 'Download profile file (returning a stream).',
+
+
+  inputs: {
+    id: {
+      type: 'number',
+      description: 'The database ID of the undeployed profile to download.'
+    },
+    uuid: {
+      type: 'string',
+      description: 'The uuid of a profile on a team.'
+    },
+  },
+
+
+  exits: {
+    success: {
+      outputFriendlyName: 'File',
+      outputDescription: 'The streaming bytes of the file.',
+      outputType: 'ref'
+    },
+
+    notFound: {
+      description: 'No profile exists with the specified ID or UUID.',
+      responseType: 'notFound'
+    },
+  },
+
+
+  fn: async function ({id, uuid}) {
+    if(!uuid && !id){
+      return this.res.badRequest();
+    }
+    let datePrefix = new Date().toISOString();
+    datePrefix = datePrefix.split('T')[0] +'_';
+    let profileContents;
+    let filename;
+    let download;
+    if(id){
+      let profileToDownload = await UndeployedProfile.findOne({id: id});
+
+      filename = datePrefix + profileToDownload.name + profileToDownload.profileType;
+      profileContents = profileToDownload.profileContents;
+      if(profileToDownload.profileType === '.mobileconfig'){
+        this.res.type('application/x-apple-aspen-config');
+      } else {
+        this.res.type('application/octet-stream');
+      }
+      download = profileContents;
+    } else {
+      let profileDownloadResponse = await sails.helpers.http.sendHttpRequest.with({
+        method: 'GET',
+        url: `${sails.config.custom.fleetBaseUrl}/api/v1/fleet/configuration_profiles/${uuid}?alt=media`,
+        headers: {
+          Authorization: `Bearer ${sails.config.custom.fleetApiToken}`
+        }
+      });
+      let contentDispositionHeader = profileDownloadResponse.headers['content-disposition'];
+      let filenameMatch = contentDispositionHeader.replace(/^attachment;filename="(.+?)"$/, '$1');
+      filename = filenameMatch;
+      let contentType = profileDownloadResponse.headers['content-type'];
+      download = profileDownloadResponse.body;
+      this.res.type(contentType);
+    }
+    this.res.attachment(filename);
+    // All done.
+    return download;
+
+  }
+
+
+};
diff --git a/ee/bulk-operations-dashboard/api/controllers/profiles/edit-profile.js b/ee/bulk-operations-dashboard/api/controllers/profiles/edit-profile.js
new file mode 100644
index 0000000000..bede01b44f
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/controllers/profiles/edit-profile.js
@@ -0,0 +1,204 @@
+module.exports = {
+
+
+  friendlyName: 'Edit profile',
+
+
+  description: 'Edits the teams a profile is assigned to and/or replaces the file on the Fleet instance if the new file\'s profile identifier matches',
+
+  files: ['newProfile'],
+
+  inputs: {
+    profile: {
+      type: {},
+      description: 'The configuration profile that is being editted',
+      required: true,
+    },
+    newTeamIds: {
+      type: ['string'],
+      description: 'An array of teams that this profile will be deployed on or Undefined if the profile is being removed from a team.'
+    },
+    newProfile: {
+      type: 'ref',
+      description: 'A file that will be replacing the profile.'
+    },
+  },
+
+
+  exits: {
+    payloadIdentifierDoesNotMatch: {
+      statusCode: 409,
+      description: 'The new profiles bundle indentifer does not match the existing profile',
+    }
+  },
+
+
+
+  fn: async function ({profile, newTeamIds, newProfile}) {
+    if(newProfile.isNoop){
+      newProfile.noMoreFiles();
+      newProfile = undefined;
+    }
+    //  ╔═╗╔═╗╔╦╗  ╔═╗╦═╗╔═╗╔═╗╦╦  ╔═╗
+    //  ║ ╦║╣  ║   ╠═╝╠╦╝║ ║╠╣ ║║  ║╣
+    //  ╚═╝╚═╝ ╩   ╩  ╩╚═╚═╝╚  ╩╩═╝╚═╝
+    let profileContents; // The raw text contents of a profile file.
+    let filename;
+    let extension;
+    // If there is not a new profile, and the profile is deployed (has teams array === deployed), download the profile to be able to add it to other teams.
+    if(!newProfile && profile.teams){
+      // console.log('Existing deployed profile!');
+      let profileUuid = profile.teams[0].uuid;
+      let profileDownloadResponse = await sails.helpers.http.sendHttpRequest.with({
+        method: 'GET',
+        url: `${sails.config.custom.fleetBaseUrl}/api/v1/fleet/configuration_profiles/${profileUuid}?alt=media`,
+        headers: {
+          Authorization: `Bearer ${sails.config.custom.fleetApiToken}`
+        }
+      });
+      let contentDispositionHeader = profileDownloadResponse.headers['content-disposition'];
+      let filenameMatch = contentDispositionHeader.match(/filename="(.+?)"/);
+      filename = filenameMatch[1];
+      extension = '.'+filename.split('.').pop();
+      profileContents = profileDownloadResponse.body;
+    } else if(newProfile) {// Otherwise, if there is a new profile file uploaded, check that the payload identifier maches the existing profile on the Fleet instance.
+      // console.log('Replacing an existing(/undeployed) profile!');
+      let file = await sails.reservoir(newProfile);
+      profileContents = file[0].contentBytes;
+      let profileFileName = file[0].name;
+      filename = profileFileName.replace(/^\d{4}-\d{2}-\d{2}_/, '').replace(/\.[^/.]+$/, '');
+      extension = '.'+profileFileName.split('.').pop();
+      let profilePlatform = 'darwin';
+      if(_.endsWith(profileFileName, '.xml')) {
+        profilePlatform = 'windows';
+      }
+      if(newTeamIds && profile.teams && profilePlatform === 'darwin'){
+        let existingProfileInfo = await sails.helpers.http.get.with({
+          url: `${sails.config.custom.fleetBaseUrl}/api/v1/fleet/configuration_profiles/${profile.teams[0].uuid}?alt=media`,
+          headers: {
+            Authorization: `Bearer ${sails.config.custom.fleetApiToken}`
+          }
+        });
+        let newProfileBundleIdentifier = profileContents.match(/<key>PayloadIdentifier<\/key>\s*<string>(.*?)<\/string>/)[1];
+        let existingProfileBundleIdentifier = existingProfileInfo.match(/<key>PayloadIdentifier<\/key>\s*<string>(.*?)<\/string>/)[1];
+        // Note: We're using the _.startsWith method to check that the identifier is the same. The identifiers returned by the Fleet instance are
+        if(existingProfileBundleIdentifier !== newProfileBundleIdentifier){
+          throw 'payloadIdentifierDoesNotMatch';
+        }
+      }
+    } else if (!newProfile && !profile.teams){// Undeployed profiles are stored in the app's database.
+      // console.log('editing an undeployed profile!');
+      profileContents = profile.profileContents;
+      filename = profile.name;
+      extension = profile.profileType;
+    }
+    //  ╔═╗╔═╗╔═╗╦╔═╗╔╗╔  ╔═╗╦═╗╔═╗╔═╗╦╦  ╔═╗
+    //  ╠═╣╚═╗╚═╗║║ ╦║║║  ╠═╝╠╦╝║ ║╠╣ ║║  ║╣
+    //  ╩ ╩╚═╝╚═╝╩╚═╝╝╚╝  ╩  ╩╚═╚═╝╚  ╩╩═╝╚═╝
+    if(!newProfile){
+      // If we're changing the teams for an existing profile, we'll remove this profile from any team not included in the newTeamIds array.
+      let currentProfileTeamIds = _.pluck(profile.teams, 'fleetApid');
+      let addedTeams = _.difference(newTeamIds, currentProfileTeamIds);
+      let removedTeams = _.difference(currentProfileTeamIds, newTeamIds);
+      let removedTeamsInfo = _.filter(profile.teams, (team)=>{
+        return removedTeams.includes(team.fleetApid);
+      });
+      for(let team of removedTeamsInfo){
+        // console.log(`removing ${profile.name} from team id ${team.teamName}`);
+        await sails.helpers.http.sendHttpRequest.with({
+          method: 'DELETE',
+          baseUrl: sails.config.custom.fleetBaseUrl,
+          url: `/api/v1/fleet/configuration_profiles/${team.uuid}`,
+          headers: {
+            Authorization: `Bearer ${sails.config.custom.fleetApiToken}`,
+          }
+        });
+      }
+      for(let teamApid of addedTeams){
+        // console.log(`Adding ${profile.name} to team id ${teamApid}`);
+        await sails.helpers.http.sendHttpRequest.with({
+          method: 'POST',
+          baseUrl: sails.config.custom.fleetBaseUrl,
+          url: `/api/v1/fleet/configuration_profiles?team_id=${teamApid}`,
+          enctype: 'multipart/form-data',
+          body: {
+            team_id: teamApid,// eslint-disable-line camelcase
+            profile: {
+              options: {
+                filename: filename + extension,
+                contentType: 'application/octet-stream'
+              },
+              value: profileContents,
+            }
+          },
+          headers: {
+            Authorization: `Bearer ${sails.config.custom.fleetApiToken}`,
+          },
+        });
+      }// After every added team
+    } else {
+      if(profile.teams) {
+        // If there is a new profile uploaded, we will need to delete the old profiles, and add the new profile.
+        for(let team of profile.teams) {
+          // console.log(`removing ${profile.name} from team id ${team.teamName}`);
+          await sails.helpers.http.sendHttpRequest.with({
+            method: 'DELETE',
+            baseUrl: sails.config.custom.fleetBaseUrl,
+            url: `/api/v1/fleet/configuration_profiles/${team.uuid}`,
+            headers: {
+              Authorization: `Bearer ${sails.config.custom.fleetApiToken}`,
+            }
+          });
+        }
+      }
+      for(let teamApid of newTeamIds){
+        // console.log(`Adding ${profile.name} to team id ${teamApid}`);
+        await sails.helpers.http.sendHttpRequest.with({
+          method: 'POST',
+          baseUrl: sails.config.custom.fleetBaseUrl,
+          url: `/api/v1/fleet/configuration_profiles?team_id=${teamApid}`,
+          enctype: 'multipart/form-data',
+          body: {
+            team_id: teamApid,// eslint-disable-line camelcase
+            profile: {
+              options: {
+                filename: filename + extension,
+                contentType: 'application/octet-stream'
+              },
+              value: profileContents,
+            }
+          },
+          headers: {
+            Authorization: `Bearer ${sails.config.custom.fleetApiToken}`,
+          },
+        });
+      }// After every added team
+
+    }
+    // If this profile has an ID, then it is a database record, and we will delete it if it has been deployed to a team.
+    if(profile.id && newTeamIds.length > 0){
+      // console.log('Undeployed profile has been deployed. deleting DB record!');
+      await UndeployedProfile.destroy({id: profile.id});
+    } else if(!profile.id && newTeamIds.length === 0){
+      // If this is not a database record of a profile, and the profile is being undeployed from all teams, we'll create a databse record for it.
+      // console.log('Creating database record for a (now) undeployed profile!');
+      await UndeployedProfile.create({
+        name: profile.name,
+        platform: extension === '.xml' ? 'windows' : 'darwin',
+        profileContents,
+        profileType: extension,
+      });
+    } else if(profile.id && newProfile){
+      // If there is a new profile that is replacing a database record, update the profileContents in the database.
+      // console.log('Updating existing undeployed profile!');
+      await UndeployedProfile.updateOne({id: profile.id}).set({
+        profileContents,
+      });
+    }
+    // All done.
+    return;
+
+  }
+
+
+};
diff --git a/ee/bulk-operations-dashboard/api/controllers/profiles/upload-profile.js b/ee/bulk-operations-dashboard/api/controllers/profiles/upload-profile.js
new file mode 100644
index 0000000000..19c847bf62
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/controllers/profiles/upload-profile.js
@@ -0,0 +1,120 @@
+module.exports = {
+
+
+  friendlyName: 'Upload profile',
+
+
+  description: '',
+
+  files: ['newProfile'],
+
+  inputs: {
+    newProfile: {
+      type: 'ref',
+      description: 'An Upstream with an incoming file upload.',
+      required: true,
+    },
+    teams: {
+      type: ['string'],
+      description: 'An array of team IDs that this profile will be added to'
+    }
+  },
+
+
+  exits: {
+    success: {
+      outputDescription: 'The new profile has been uploaded',
+      outputType: {},
+    },
+
+    noFileAttached: {
+      description: 'No file was attached.',
+      responseType: 'badRequest'
+    },
+
+    tooBig: {
+      description: 'The file is too big.',
+      responseType: 'badRequest'
+    },
+
+  },
+
+
+  fn: async function ({newProfile, teams}) {
+    let util = require('util');
+    let profile = await sails.reservoir(newProfile)
+    .intercept('E_EXCEEDS_UPLOAD_LIMIT', 'tooBig')
+    .intercept((err)=>new Error('The configuration profile upload failed. '+util.inspect(err)));
+    if(!profile) {
+      throw 'noFileAttached';
+    }
+    let profileContents = profile[0].contentBytes;
+    let profileFileName = profile[0].name;
+    let datelessExtensionlessFilename = profileFileName.replace(/^\d{4}-\d{2}-\d{2}_/, '').replace(/\.[^/.]+$/, '');
+    let extension = '.'+profileFileName.split('.').pop();
+    let profilePlatform = 'darwin';
+    if(_.endsWith(profileFileName, '.xml')) {
+      profilePlatform = 'windows';
+    }
+
+    let profileToReturn;
+    let newProfileInfo = {
+      name: datelessExtensionlessFilename,
+      platform: profilePlatform,
+      profileType: extension,
+      createdAt: Date.now(),
+    };
+    if(!teams) {
+      newProfileInfo.profileContents = profileContents;
+      profileToReturn = await UndeployedProfile.create(newProfileInfo).fetch();
+    } else {
+      let newTeams = [];
+      for(let teamApid of teams){
+        let newProfileResponse = await sails.helpers.http.sendHttpRequest.with({
+          method: 'POST',
+          baseUrl: sails.config.custom.fleetBaseUrl,
+          url: `/api/v1/fleet/configuration_profiles?team_id=${teamApid}`,
+          enctype: 'multipart/form-data',
+          body: {
+            team_id: teamApid,// eslint-disable-line camelcase
+            profile: {
+              options: {
+                filename: profileFileName,
+                contentType: 'application/octet-stream'
+              },
+              value: profileContents,
+            }
+          },
+          headers: {
+            Authorization: `Bearer ${sails.config.custom.fleetApiToken}`,
+          },
+        });
+        let parsedJsonResponse = JSON.parse(newProfileResponse.body);
+        let uuidForThisProfile = parsedJsonResponse.profile_uuid;
+        // send a request to the Fleet instance to get the bundleId of the new profile.
+        await sails.helpers.http.get.with({
+          baseUrl: sails.config.custom.fleetBaseUrl,
+          url: `/api/v1/fleet/configuration_profiles/${uuidForThisProfile}`,
+          headers: {
+            Authorization: `Bearer ${sails.config.custom.fleetApiToken}`,
+          }
+        });
+        newTeams.push({
+          fleetApid: teamApid,
+          uuid: JSON.parse(newProfileResponse.body).profile_uuid
+        });
+      }
+      newProfileInfo.teams = newTeams;
+      profileToReturn = newProfileInfo;
+    }
+
+
+
+
+    // All done.
+    return profileToReturn;
+
+  }
+
+
+};
diff --git a/ee/bulk-operations-dashboard/api/controllers/profiles/view-profiles.js b/ee/bulk-operations-dashboard/api/controllers/profiles/view-profiles.js
new file mode 100644
index 0000000000..9ebe807932
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/controllers/profiles/view-profiles.js
@@ -0,0 +1,114 @@
+module.exports = {
+
+
+  friendlyName: 'View profiles',
+
+
+  description: 'Display "Profiles" page.',
+
+
+  exits: {
+
+    success: {
+      viewTemplatePath: 'pages/profiles'
+    }
+
+  },
+
+
+  fn: async function () {
+
+    // Get all teams on the Fleet instance.
+    let teamsResponseData = await sails.helpers.http.get.with({
+      url: '/api/v1/fleet/teams',
+      baseUrl: sails.config.custom.fleetBaseUrl,
+      headers: {
+        Authorization: `Bearer ${sails.config.custom.fleetApiToken}`
+      }
+    })
+    .timeout(120000)
+    .retry(['requestFailed', {name: 'TimeoutError'}]);
+
+    let allTeams = teamsResponseData.teams;
+
+    let teams = [];
+    for(let team of allTeams) {
+      teams.push({
+        fleetApid: team.id,
+        teamName: team.name,
+      });
+    }
+    // Add the "team" for hosts with no team
+    teams.push({
+      fleetApid: 0,
+      teamName: 'No team',
+    });
+
+
+    let allProfiles = [];
+    let teamApids = _.pluck(allTeams, 'id');
+    // Get all of the configuration profiles on the Fleet instance.
+    for(let teamApid of teamApids){
+      let configurationProfilesResponseData = await sails.helpers.http.get.with({
+        url: `/api/v1/fleet/configuration_profiles?team_id=${teamApid}`,
+        baseUrl: sails.config.custom.fleetBaseUrl,
+        headers: {
+          Authorization: `Bearer ${sails.config.custom.fleetApiToken}`
+        }
+      })
+      .timeout(120000)
+      .retry(['requestFailed', {name: 'TimeoutError'}]);
+      let profilesForThisTeam = configurationProfilesResponseData.profiles;
+      allProfiles = allProfiles.concat(profilesForThisTeam);
+    }
+    // Add the configurations profiles that are assigned to the "no team" team.
+    let noTeamConfigurationProfilesResponseData = await sails.helpers.http.get.with({
+      url: '/api/v1/fleet/configuration_profiles',
+      baseUrl: sails.config.custom.fleetBaseUrl,
+      headers: {
+        Authorization: `Bearer ${sails.config.custom.fleetApiToken}`
+      }
+    })
+    .timeout(120000)
+    .retry(['requestFailed', {name: 'TimeoutError'}]);
+    let profilesForThisTeam = noTeamConfigurationProfilesResponseData.profiles;
+    allProfiles = allProfiles.concat(profilesForThisTeam);
+    let profilesInformation = [];
+    // Group configuration profiles by their identifier.
+    let allProfilesByIdentifier = _.groupBy(allProfiles, 'identifier');
+    for(let profileIdentifier in allProfilesByIdentifier) {
+      // Iterate through the arrays of profiles with the same unique identifier.
+      let teamsForThisProfile = [];
+      // Add the profile's UUID and information about the team this profile is assigned to the teams array for profiles.
+      for(let profile of allProfilesByIdentifier[profileIdentifier]) {
+        let informationAboutThisProfile = {
+          uuid: profile.profile_uuid,
+          fleetApid: profile.team_id,
+          teamName: _.find(teams, {fleetApid: profile.team_id}).teamName,
+        };
+        teamsForThisProfile.push(informationAboutThisProfile);
+      }
+      let profile = allProfilesByIdentifier[profileIdentifier][0];// Grab the first profile returned in the api repsonse to build our profile configuration.
+      let profileInformation = {
+        name: profile.name,
+        identifier: profileIdentifier,
+        platform: profile.platform,
+        createdAt: new Date(profile.created_at).getTime(),
+        teams: teamsForThisProfile
+      };
+      profilesInformation.push(profileInformation);
+    }
+    // Get the undeployed profiles from the app's database.
+    let undeployedProfiles = await UndeployedProfile.find();
+    profilesInformation = _.union(profilesInformation, undeployedProfiles);
+
+    // Sort profiles by their name.
+    profilesInformation = _.sortByOrder(profilesInformation, 'name', 'asc');
+
+    // Respond with view.
+    return {profiles: profilesInformation, teams};
+
+  }
+
+
+};
diff --git a/ee/bulk-operations-dashboard/api/controllers/scripts/delete-script.js b/ee/bulk-operations-dashboard/api/controllers/scripts/delete-script.js
new file mode 100644
index 0000000000..f7c38c1664
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/controllers/scripts/delete-script.js
@@ -0,0 +1,46 @@
+module.exports = {
+
+
+  friendlyName: 'Delete script',
+
+
+  description: '',
+
+
+  inputs: {
+    script: {
+      type: {},
+      description: 'The script that will be deleted.',
+      required: true,
+    }
+  },
+
+
+  exits: {
+
+  },
+
+
+  fn: async function ({script}) {
+    // If the provided script does not have a teams array and has an ID, it is an undeployed script that will be deleted.
+    if(script.id && !script.teams){
+      await UndeployedScript.destroy({id: script.id});
+    } else {
+      for(let teamScript of script.teams){
+        await sails.helpers.http.sendHttpRequest.with({
+          method: 'DELETE',
+          baseUrl: sails.config.custom.fleetBaseUrl,
+          url: `/api/v1/fleet/scripts/${teamScript.scriptFleetApid}`,
+          headers: {
+            Authorization: `Bearer ${sails.config.custom.fleetApiToken}`,
+          }
+        });
+      }
+    }
+    // All done.
+    return;
+
+  }
+
+
+};
diff --git a/ee/bulk-operations-dashboard/api/controllers/scripts/download-script.js b/ee/bulk-operations-dashboard/api/controllers/scripts/download-script.js
new file mode 100644
index 0000000000..4c9b7bc809
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/controllers/scripts/download-script.js
@@ -0,0 +1,76 @@
+module.exports = {
+
+
+  friendlyName: 'Download script',
+
+
+  description: 'Download script file (returning a stream).',
+
+
+  inputs: {
+    fleetApid: {
+      type: 'number',
+      description: 'The Fleet API ID of the script to download.',
+    },
+    id: {
+      type: 'number',
+      description: 'The database ID of the undeployed script to download'
+    }
+  },
+
+
+  exits: {
+    success: {
+      outputFriendlyName: 'File',
+      outputDescription: 'The streaming bytes of the file.',
+      outputType: 'ref'
+    },
+
+    notFound: {
+      description: 'No script exists with the specified ID or UUID.',
+      responseType: 'notFound'
+    },
+  },
+
+
+  fn: async function ({fleetApid, id}) {
+    if(!fleetApid && !id){
+      return this.res.badRequest();
+    }
+    let filename;
+    let download;
+    if(id){
+      let datePrefix = new Date().toISOString();
+      datePrefix = datePrefix.split('T')[0] +'_';
+      let scriptToDownload = await UndeployedScript.findOne({id: id});
+      filename = datePrefix + scriptToDownload.name;
+      let scriptContents = scriptToDownload.scriptContents;
+      if(scriptToDownload.scriptType === '.sh'){
+        this.res.type('application/x-apple-aspen-config');
+      } else {
+        this.res.type('application/octet-stream');
+      }
+      download = scriptContents;
+    } else {
+      let scriptDownloadResponse = await sails.helpers.http.sendHttpRequest.with({
+        method: 'GET',
+        url: `${sails.config.custom.fleetBaseUrl}/api/v1/fleet/scripts/${fleetApid}?alt=media`,
+        headers: {
+          Authorization: `Bearer ${sails.config.custom.fleetApiToken}`
+        }
+      });
+      let contentDispositionHeader = scriptDownloadResponse.headers['content-disposition'];
+      let filenameMatch = contentDispositionHeader.replace(/^attachment;filename="(.+?)"$/, '$1');
+      filename = filenameMatch;
+      let contentType = scriptDownloadResponse.headers['content-type'];
+      download = scriptDownloadResponse.body;
+      this.res.type(contentType);
+    }
+    this.res.attachment(filename);
+    // All done.
+    return download;
+
+  }
+
+
+};
diff --git a/ee/bulk-operations-dashboard/api/controllers/scripts/edit-script.js b/ee/bulk-operations-dashboard/api/controllers/scripts/edit-script.js
new file mode 100644
index 0000000000..ec8d30f182
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/controllers/scripts/edit-script.js
@@ -0,0 +1,197 @@
+module.exports = {
+
+
+  friendlyName: 'Edit script',
+
+
+  description: '',
+
+  files: ['newScript'],
+
+  inputs: {
+    script: {
+      type: {},
+      description: 'The script that is being editted',
+      required: true,
+    },
+    newTeamIds: {
+      type: ['ref'],
+      description: 'An array of teams that this script will be added to.'
+    },
+    newScript: {
+      type: 'ref',
+      description: 'A file that will be replacing the script.'
+    },
+  },
+
+
+  exits: {
+    scriptNameDoesNotMatch: {
+      description: 'The provided replacement script\'s filename does not match the name of the script on the Fleet instance.',
+      statusCode: 400,
+    },
+  },
+
+
+  fn: async function ({script, newTeamIds, newScript}) {
+    if(newScript.isNoop){
+      newScript.noMoreFiles();
+      newScript = undefined;
+    }
+    let scriptContents; // The raw text contents of a script file.
+    let filename;
+    let extension;
+    // If there is not a new script, and the script is deployed (has teams array === deployed), download the script to be able to add it to other teams.
+    if(!newScript && script.teams){
+      let scriptFleetApid = script.teams[0].scriptFleetApid;
+      let scriptDownloadResponse = await sails.helpers.http.sendHttpRequest.with({
+        method: 'GET',
+        url: `${sails.config.custom.fleetBaseUrl}/api/v1/fleet/scripts/${scriptFleetApid}?alt=media`,
+        headers: {
+          Authorization: `Bearer ${sails.config.custom.fleetApiToken}`
+        }
+      });
+      let contentDispositionHeader = scriptDownloadResponse.headers['content-disposition'];
+      let filenameMatch = contentDispositionHeader.match(/filename="(.+?)"/);
+      filename = filenameMatch[1];
+      extension = '.'+filename.split('.').pop();
+      filename = filename.replace(/^\d{4}-\d{2}-\d{2}[_|\s]?/, '');
+      scriptContents = scriptDownloadResponse.body;
+    } else if(newScript) {
+      let file = await sails.reservoir(newScript);
+      scriptContents = file[0].contentBytes;
+      let scriptFilename = file[0].name;
+      filename = scriptFilename.replace(/^\d{4}-\d{2}-\d{2}[_|\s]?/, '').replace(/\.[^/.]+$/, '');
+      extension = '.'+scriptFilename.split('.').pop();
+      if(script.name !== filename+extension){
+        throw 'scriptNameDoesNotMatch';
+      }
+    } else if (!newScript && !script.teams){// Undeployed profiles are stored in the app's database.
+      // console.log('editing an undeployed profile!');
+      scriptContents = script.scriptContents;
+      filename = script.name;
+      extension = script.scriptType;
+    }
+
+    if(!newScript){
+      let currentScriptTeamIds = _.pluck(script.teams, 'fleetApid');
+      let addedTeams = _.difference(newTeamIds, currentScriptTeamIds);
+      let removedTeams = _.difference(currentScriptTeamIds, newTeamIds);
+      let removedTeamsInfo = _.filter(script.teams, (team)=>{
+        return removedTeams.includes(team.fleetApid);
+      });
+      for(let script of removedTeamsInfo){
+        await sails.helpers.http.sendHttpRequest.with({
+          method: 'DELETE',
+          baseUrl: sails.config.custom.fleetBaseUrl,
+          url: `/api/v1/fleet/scripts/${script.scriptFleetApid}`,
+          headers: {
+            Authorization: `Bearer ${sails.config.custom.fleetApiToken}`,
+          }
+        });
+      }
+      for(let teamApid of addedTeams){
+        // Build a request body for the team.
+        let requestBodyForThisTeam = {
+          script: {
+            options: {
+              filename: filename,
+              contentType: 'application/octet-stream'
+            },
+            value: scriptContents,
+          }
+        };
+        let addScriptUrl;
+        // If the script is being added to the "no team" team, then we need to include the team ID of the no team team in the request URL
+        if(Number(teamApid) === 0){
+          addScriptUrl = `/api/v1/fleet/scripts?team_id=${teamApid}`;
+        } else {
+          // Otherwise, the team_id needs to be included in the request's formData.
+          addScriptUrl = `/api/v1/fleet/scripts`;
+          requestBodyForThisTeam.team_id = Number(teamApid);// eslint-disable-line camelcase
+        }
+        await sails.helpers.http.sendHttpRequest.with({
+          method: 'POST',
+          baseUrl: sails.config.custom.fleetBaseUrl,
+          url: addScriptUrl,
+          enctype: 'multipart/form-data',
+          body: requestBodyForThisTeam,
+          headers: {
+            Authorization: `Bearer ${sails.config.custom.fleetApiToken}`,
+          },
+        });
+      }
+    } else {
+      if(script.teams) {
+        for(let scriptId of script.teams){
+          await sails.helpers.http.sendHttpRequest.with({
+            method: 'DELETE',
+            baseUrl: sails.config.custom.fleetBaseUrl,
+            url: `/api/v1/fleet/scripts/${scriptId.scriptFleetApid}`,
+            headers: {
+              Authorization: `Bearer ${sails.config.custom.fleetApiToken}`,
+            }
+          });
+        }
+      }
+      for(let teamApid of newTeamIds){
+        // Build a request body for the team.
+        let requestBodyForThisTeam = {
+          script: {
+            options: {
+              filename: filename,
+              contentType: 'application/octet-stream'
+            },
+            value: scriptContents,
+          }
+        };
+        let addScriptUrl;
+        // If the script is being added to the "no team" team, then we need to include the team ID of the no team team in the request URL
+        if(Number(teamApid) === 0){
+          addScriptUrl = `/api/v1/fleet/scripts?team_id=${teamApid}`;
+        } else {
+          // Otherwise, the team_id needs to be included in the request's formData.
+          addScriptUrl = `/api/v1/fleet/scripts`;
+          requestBodyForThisTeam.team_id = Number(teamApid);// eslint-disable-line camelcase
+        }
+        await sails.helpers.http.sendHttpRequest.with({
+          method: 'POST',
+          baseUrl: sails.config.custom.fleetBaseUrl,
+          url: addScriptUrl,
+          enctype: 'multipart/form-data',
+          body: requestBodyForThisTeam,
+          headers: {
+            Authorization: `Bearer ${sails.config.custom.fleetApiToken}`,
+          },
+        });
+      }
+    }
+
+    // If this profile has an ID, then it is a database record, and we will delete it if it has been deployed to a team.
+    if(script.id && newTeamIds.length > 0){
+      // console.log('Undeployed script has been deployed. deleting DB record!');
+      await UndeployedScript.destroy({id: script.id});
+    } else if(!script.id && newTeamIds.length === 0){
+      // If this is not a database record of a script, and the script is being undeployed from all teams, we'll create a databse record for it.
+      // console.log('Creating database record for a (now) undeployed script!');
+      await UndeployedScript.create({
+        name: script.name,
+        platform: extension === '.ps1' ? 'Windows' : 'macOS & Linux',
+        scriptContents,
+        scriptType: extension,
+      });
+    } else if(script.id && newScript){
+      // If there is a new script that is replacing a database record, update the scriptContents in the database.
+      // console.log('Updating existing undeployed script!');
+      await UndeployedScript.updateOne({id: script.id}).set({
+        scriptContents,
+      });
+    }
+
+    // All done.
+    return;
+
+  }
+
+
+};
diff --git a/ee/bulk-operations-dashboard/api/controllers/scripts/upload-script.js b/ee/bulk-operations-dashboard/api/controllers/scripts/upload-script.js
new file mode 100644
index 0000000000..55265f2fa2
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/controllers/scripts/upload-script.js
@@ -0,0 +1,118 @@
+module.exports = {
+
+
+  friendlyName: 'Upload script',
+
+
+  description: 'Uploads a script to the connected Fleet instance',
+
+  files: ['newScript'],
+
+  inputs: {
+
+    newScript: {
+      type: 'ref',
+      description: 'An Upstream with an incoming file upload.',
+      required: true,
+    },
+
+    teams: {
+      type: ['string'],
+      description: 'An array of team IDs that this profile will be added to'
+    }
+  },
+
+
+  exits: {
+    success: {
+      outputDescription: 'The new script has been uploaded',
+      outputType: {},
+    },
+
+    scriptWithThisNameAlreadyExists: {
+      description: 'A script with this name already exists on the Fleet Instance',
+      statusCode: 409,
+    },
+
+    noFileAttached: {
+      description: 'No file was attached.',
+      responseType: 'badRequest'
+    },
+
+    tooBig: {
+      description: 'The file is too big.',
+      responseType: 'badRequest'
+    },
+  },
+
+
+  fn: async function ({newScript, teams}) {
+
+    let util = require('util');
+    let script = await sails.reservoir(newScript)
+    .intercept('E_EXCEEDS_UPLOAD_LIMIT', 'tooBig')
+    .intercept((err)=>new Error('The script upload failed. '+util.inspect(err)));
+    if(!script) {
+      throw 'noFileAttached';
+    }
+    // Get the file contents and filename.
+    let scriptContents = script[0].contentBytes;
+    let scriptFilename = script[0].name;
+    // Strip out any automatically added date prefixes from uploaded scripts.
+    let datelessExtensionlessFilename = scriptFilename.replace(/^\d{4}-\d{2}-\d{2}\s/, '').replace(/\.[^/.]+$/, '');
+    let extension = '.'+scriptFilename.split('.').pop();
+    // Build a dictonary of information about this script to return to the scripts page.
+    let newScriptInfo = {
+      name: datelessExtensionlessFilename,
+      platform: _.endsWith(scriptFilename, '.ps1') ? 'Windows' : 'macOS & Linux',
+      scriptType: extension,
+      createdAt: Date.now()
+    };
+    if(!teams) {
+      newScriptInfo.scriptContents = scriptContents;
+      await UndeployedScript.create(newScriptInfo).fetch();
+    } else {
+      // Send a request to add the script for every team ID in the array of teams.
+      for(let teamApid of teams){
+        // Build a request body for the team.
+        let requestBodyForThisTeam = {
+          script: {
+            options: {
+              filename: datelessExtensionlessFilename + extension,
+              contentType: 'application/octet-stream'
+            },
+            value: scriptContents,
+          }
+        };
+        let addScriptUrl;
+        // If the script is being added to the "no team" team, then we need to include the team ID of the no team team in the request URL
+        if(Number(teamApid) === 0){
+          addScriptUrl = `/api/v1/fleet/scripts?team_id=${teamApid}`;
+        } else {
+          // Otherwise, the team_id needs to be included in the request's formData.
+          addScriptUrl = `/api/v1/fleet/scripts`;
+          requestBodyForThisTeam.team_id = Number(teamApid);// eslint-disable-line camelcase
+        }
+        // Send a PSOT request to add the script.
+        await sails.helpers.http.sendHttpRequest.with({
+          method: 'POST',
+          baseUrl: sails.config.custom.fleetBaseUrl,
+          url:addScriptUrl,
+          enctype: 'multipart/form-data',
+          body: requestBodyForThisTeam,
+          headers: {
+            Authorization: `Bearer ${sails.config.custom.fleetApiToken}`,
+          },
+        })
+        .intercept({raw: {statusCode: 409}}, ()=>{
+          return 'scriptWithThisNameAlreadyExists';
+        });
+      }
+    }
+    // All done.
+    return newScriptInfo;
+
+  }
+
+
+};
diff --git a/ee/bulk-operations-dashboard/api/controllers/scripts/view-scripts.js b/ee/bulk-operations-dashboard/api/controllers/scripts/view-scripts.js
new file mode 100644
index 0000000000..02fabebdd2
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/controllers/scripts/view-scripts.js
@@ -0,0 +1,124 @@
+module.exports = {
+
+
+  friendlyName: 'View scripts',
+
+
+  description: 'Display "Scripts" page.',
+
+
+  exits: {
+
+    success: {
+      viewTemplatePath: 'pages/scripts'
+    }
+
+  },
+
+
+  fn: async function () {
+    let teamsResponseData = await sails.helpers.http.get.with({
+      url: '/api/v1/fleet/teams',
+      baseUrl: sails.config.custom.fleetBaseUrl,
+      headers: {
+        Authorization: `Bearer ${sails.config.custom.fleetApiToken}`
+      }
+    })
+    .timeout(120000)
+    .retry(['requestFailed', {name: 'TimeoutError'}]);
+
+    let allTeams = teamsResponseData.teams;
+
+    let teamApids = _.pluck(allTeams, 'id');
+    let teams = [];
+    for(let team of allTeams) {
+      teams.push({
+        fleetApid: team.id,
+        teamName: team.name,
+      });
+    }
+    // Add the "team" for hosts with no team
+    teams.push({
+      fleetApid: 0,
+      teamName: 'No team',
+    });
+
+    let allScripts = [];
+
+    for(let teamApid of teamApids){
+      let scriptsResponseData = await sails.helpers.http.get.with({
+        url: `/api/v1/fleet/scripts?team_id=${teamApid}`,
+        baseUrl: sails.config.custom.fleetBaseUrl,
+        headers: {
+          Authorization: `Bearer ${sails.config.custom.fleetApiToken}`
+        }
+      })
+      .timeout(120000)
+      .retry(['requestFailed', {name: 'TimeoutError'}]);
+      let scriptsForThisTeam = scriptsResponseData.scripts;
+      if(scriptsForThisTeam !== null) {
+        allScripts = allScripts.concat(scriptsForThisTeam);
+      }
+    }
+
+    // Grab all of the configuration scripts on the Fleet instance.
+    let noTeamConfigurationScriptsResponseData = await sails.helpers.http.get.with({
+      url: '/api/v1/fleet/scripts',
+      baseUrl: sails.config.custom.fleetBaseUrl,
+      headers: {
+        Authorization: `Bearer ${sails.config.custom.fleetApiToken}`
+      }
+    })
+    .timeout(120000)
+    .retry(['requestFailed', {name: 'TimeoutError'}]);
+    let scriptsForThisTeam = noTeamConfigurationScriptsResponseData.scripts;
+
+    if(scriptsForThisTeam !== null){
+      allScripts = allScripts.concat(scriptsForThisTeam);
+    }
+
+    if(allScripts === [ null ]){
+      return {scripts: [], teams};
+    }
+    let scriptsOnThisFleetInstance = [];
+
+    let allScriptsByIdentifier = _.groupBy(allScripts, 'name');
+    for(let scriptIdentifier in allScriptsByIdentifier) {
+      if(scriptIdentifier === null){
+        continue;
+      }
+      let teamsForThisProfile = [];
+      // console.log(teamsForThisProfile);
+      // let platforms = _.uniq(_.pluck(allScriptsByIdentifier[scriptIdentifier], 'platform'));
+      for(let script of allScriptsByIdentifier[scriptIdentifier]){
+        let informationAboutThisScript = {
+          scriptFleetApid: script.id,
+          fleetApid: script.team_id ? script.team_id : 0,
+          teamName: script.team_id ? _.find(teams, {fleetApid: script.team_id}).teamName : 'No team',
+        };
+        teamsForThisProfile.push(informationAboutThisScript);
+      }
+      let script = allScriptsByIdentifier[scriptIdentifier][0];// Grab the first script returned in the api repsonse to build our script configuration.
+      let scriptInformation = {
+        name: script.name,
+        identifier: scriptIdentifier,
+        platform: _.endsWith(script.name, 'sh') ? 'macOS & Linux' : 'Windows',
+        createdAt: new Date(script.created_at).getTime(),
+        teams: teamsForThisProfile
+      };
+      scriptsOnThisFleetInstance.push(scriptInformation);
+    }
+    // Get the undeployed scripts from the app's database.
+    let undeployedScripts = await UndeployedScript.find();
+    scriptsOnThisFleetInstance = _.union(scriptsOnThisFleetInstance, undeployedScripts);
+
+    // Sort the scripts by name.
+    scriptsOnThisFleetInstance = _.sortByOrder(scriptsOnThisFleetInstance, 'name', 'asc');
+    // Respond with view.
+    return {scripts: scriptsOnThisFleetInstance, teams};
+
+
+  }
+
+
+};
diff --git a/ee/bulk-operations-dashboard/api/helpers/broadcast-session-change.js b/ee/bulk-operations-dashboard/api/helpers/broadcast-session-change.js
new file mode 100644
index 0000000000..f4aa836b3c
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/helpers/broadcast-session-change.js
@@ -0,0 +1,45 @@
+module.exports = {
+
+
+  friendlyName: 'Broadcast session change',
+
+
+  description: 'Broadcast a socket notification indicating a change in login status.',
+
+
+  inputs: {
+
+    req: {
+      type: 'ref',
+      required: true,
+    },
+
+  },
+
+
+  exits: {
+
+    success: {
+      description: 'All done.',
+    },
+
+  },
+
+
+  fn: async function ({ req }) {
+
+    // If there's no sessionID, we don't need to broadcase a message about the old session.
+    if(!req.sessionID) {
+      return;
+    }
+
+    let roomName = `session${_.deburr(req.sessionID)}`;
+    let messageText = `You have signed out or signed into a different session in another tab or window. Reload the page to refresh your session.`;
+    sails.sockets.broadcast(roomName, 'session', { notificationText: messageText }, req);
+
+
+  }
+
+
+};
+
diff --git a/ee/bulk-operations-dashboard/api/helpers/redact-user.js b/ee/bulk-operations-dashboard/api/helpers/redact-user.js
new file mode 100644
index 0000000000..28d9a7c44f
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/helpers/redact-user.js
@@ -0,0 +1,33 @@
+module.exports = {
+
+
+  friendlyName: 'Redact user',
+
+
+  description: 'Destructively remove properties from the provided User record to prepare it for publication.',
+
+
+  sync: true,
+
+
+  inputs: {
+
+    user: {
+      type: 'ref',
+      readOnly: false
+    }
+
+  },
+
+
+  fn: function ({ user }) {
+    for (let [attrName, attrDef] of Object.entries(User.attributes)) {
+      if (attrDef.protect) {
+        delete user[attrName];
+      }//fi
+    }//∞
+  }
+
+
+};
+
diff --git a/ee/bulk-operations-dashboard/api/helpers/send-template-email.js b/ee/bulk-operations-dashboard/api/helpers/send-template-email.js
new file mode 100644
index 0000000000..f03b447462
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/helpers/send-template-email.js
@@ -0,0 +1,282 @@
+module.exports = {
+
+
+  friendlyName: 'Send template email',
+
+
+  description: 'Send an email using a template.',
+
+
+  extendedDescription: 'To ease testing and development, if the provided "to" email address ends in "@example.com", '+
+    'then the email message will be written to the terminal instead of actually being sent.'+
+    '(Thanks [@simonratner](https://github.com/simonratner)!)',
+
+
+  inputs: {
+
+
+    template: {
+      description: 'The relative path to an EJS template within our `views/emails/` folder -- WITHOUT the file extension.',
+      extendedDescription: 'Use strings like "foo" or "foo/bar", but NEVER "foo/bar.ejs" or "/foo/bar".  For example, '+
+        '"internal/email-contact-form" would send an email using the "views/emails/internal/email-contact-form.ejs" template.',
+      example: 'email-reset-password',
+      type: 'string',
+      required: true
+    },
+
+    templateData: {
+      description: 'A dictionary of data which will be accessible in the EJS template.',
+      extendedDescription: 'Each key will be a local variable accessible in the template.  For instance, if you supply '+
+        'a dictionary with a \`friends\` key, and \`friends\` is an array like \`[{name:"Chandra"}, {name:"Mary"}]\`),'+
+        'then you will be able to access \`friends\` from the template:\n'+
+        '\`\`\`\n'+
+        '<ul>\n'+
+         '<% for (friend of friends){ %><li><%= friend.name %></li><% }); %>\n'+
+        '</ul>\n'+
+        '\`\`\`'+
+        '\n'+
+        'This is EJS, so use \`<%= %>\` to inject the HTML-escaped content of a variable, \`<%= %>\` to skip HTML-escaping '+
+        'and inject the data as-is, or \`<% %>\` to execute some JavaScript code such as an \`if\` statement or \`for\` loop.',
+      type: {},
+      defaultsTo: {}
+    },
+
+    to: {
+      description: 'The email address of the primary recipient.',
+      extendedDescription: 'If this is any address ending in "@example.com", then don\'t actually deliver the message. '+
+        'Instead, just log it to the console.',
+      example: 'nola.thacker@example.com',
+      required: true,
+      isEmail: true,
+    },
+
+    toName: {
+      description: 'Name of the primary recipient as displayed in their inbox.',
+      example: 'Nola Thacker',
+    },
+
+    subject: {
+      description: 'The subject of the email.',
+      example: 'Hello there.',
+      defaultsTo: ''
+    },
+
+    from: {
+      description: 'An override for the default "from" email that\'s been configured.',
+      example: 'anne.martin@example.com',
+      isEmail: true,
+    },
+
+    fromName: {
+      description: 'An override for the default "from" name.',
+      example: 'Anne Martin',
+    },
+
+    layout: {
+      description: 'Set to `false` to disable layouts altogether, or provide the path (relative '+
+        'from `views/layouts/`) to an override email layout.',
+      defaultsTo: 'layout-email',
+      custom: (layout)=>layout===false || _.isString(layout)
+    },
+
+    ensureAck: {
+      description: 'Whether to wait for acknowledgement (to hear back) that the email was successfully sent (or at least queued for sending) before returning.',
+      extendedDescription: 'Otherwise by default, this returns immediately and delivers the request to deliver this email in the background.',
+      type: 'boolean',
+      defaultsTo: false
+    },
+
+    bcc: {
+      description: 'The email addresses of recipients secretly copied on the email.',
+      example: ['jahnna.n.malcolm@example.com'],
+    },
+
+    attachments: {
+      description: 'Attachments to include in the email, with the file content encoded as base64.',
+      whereToGet: {
+        description: 'If you have `sails-hook-uploads` installed, you can use `sails.reservoir` to get an attachment into the expected format.',
+      },
+      example: [
+        {
+          contentBytes: 'iVBORw0KGgoAA…',
+          name: 'sails.png',
+          type: 'image/png',
+        }
+      ],
+      defaultsTo: [],
+    },
+
+  },
+
+
+  exits: {
+
+    success: {
+      outputFriendlyName: 'Email delivery report',
+      outputDescription: 'A dictionary of information about what went down.',
+      outputType: {
+        loggedInsteadOfSending: 'boolean'
+      }
+    }
+
+  },
+
+
+  fn: async function({template, templateData, to, toName, subject, from, fromName, layout, ensureAck, bcc, attachments}) {
+
+    var path = require('path');
+    var url = require('url');
+    var util = require('util');
+
+
+    if (!_.startsWith(path.basename(template), 'email-')) {
+      sails.log.warn(
+        'The "template" that was passed in to `sendTemplateEmail()` does not begin with '+
+        '"email-" -- but by convention, all email template files in `views/emails/` should '+
+        'be namespaced in this way.  (This makes it easier to look up email templates by '+
+        'filename; e.g. when using CMD/CTRL+P in Sublime Text.)\n'+
+        'Continuing regardless...'
+      );
+    }
+
+    if (_.startsWith(template, 'views/') || _.startsWith(template, 'emails/')) {
+      throw new Error(
+        'The "template" that was passed in to `sendTemplateEmail()` was prefixed with\n'+
+        '`emails/` or `views/` -- but that part is supposed to be omitted.  Instead, please\n'+
+        'just specify the path to the desired email template relative from `views/emails/`.\n'+
+        'For example:\n'+
+        '  template: \'email-reset-password\'\n'+
+        'Or:\n'+
+        '  template: \'admin/email-contact-form\'\n'+
+        ' [?] If you\'re unsure or need advice, see https://sailsjs.com/support'
+      );
+    }//•
+
+    // Determine appropriate email layout and template to use.
+    var emailTemplatePath = path.join('emails/', template);
+    var emailTemplateLayout;
+    if (layout) {
+      emailTemplateLayout = path.relative(path.dirname(emailTemplatePath), path.resolve('layouts/', layout));
+    } else {
+      emailTemplateLayout = false;
+    }
+
+    // Compile HTML template.
+    // > Note that we set the layout, provide access to core `url` package (for
+    // > building links and image srcs, etc.), and also provide access to core
+    // > `util` package (for dumping debug data in internal emails).
+    var htmlEmailContents = await sails.renderView(
+      emailTemplatePath,
+      _.extend({layout: emailTemplateLayout, url, util }, templateData)
+    )
+    .intercept((err)=>{
+      err.message =
+      'Could not compile view template.\n'+
+      '(Usually, this means the provided data is invalid, or missing a piece.)\n'+
+      'Details:\n'+
+      err.message;
+      return err;
+    });
+
+    // Sometimes only log info to the console about the email that WOULD have been sent.
+    // Specifically, if the "To" email address is anything "@example.com".
+    //
+    // > This is used below when determining whether to actually send the email,
+    // > for convenience during development, but also for safety.  (For example,
+    // > a special-cased version of "user@example.com" is used by Trend Micro Mars
+    // > scanner to "check apks for malware".)
+    var isToAddressConsideredFake = Boolean(to.match(/@example\.com$/i));
+
+    // If that's the case, or if we're in the "test" environment, then log
+    // the email instead of sending it:
+    var dontActuallySend = (
+      sails.config.environment === 'test' || isToAddressConsideredFake
+    );
+    if (dontActuallySend) {
+      sails.log(
+        'Skipped sending email, either because the "To" email address ended in "@example.com"\n'+
+        'or because the current \`sails.config.environment\` is set to "test".\n'+
+        '\n'+
+        'But anyway, here is what WOULD have been sent:\n'+
+        '-=-=-=-=-=-=-=-=-=-=-=-=-= Email log =-=-=-=-=-=-=-=-=-=-=-=-=-\n'+
+        'To: '+to+'\n'+
+        'Subject: '+subject+'\n'+
+        '\n'+
+        'Body:\n'+
+        htmlEmailContents+'\n'+
+        '-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-'
+      );
+    } else {
+      // Otherwise, we'll check that all required Mailgun credentials are set up
+      // and, if so, continue to actually send the email.
+
+      if (!sails.config.custom.sendgridSecret) {
+        throw new Error(
+          'Cannot deliver email to "'+to+'" because:\n'+
+          (()=>{
+            let problems = [];
+            if (!sails.config.custom.sendgridSecret) {
+              problems.push(' • Sendgrid secret is missing from this app\'s configuration (`sails.config.custom.sendgridSecret`)');
+            }
+            return problems.join('\n');
+          })()+
+          '\n'+
+          'To resolve these configuration issues, add the missing config variables to\n'+
+          '\`config/custom.js\`-- or in staging/production, set them up as system\n'+
+          'environment vars.  (If you don\'t have a Sendgrid secret, you can\n'+
+          'sign up for free at https://sendgrid.com to receive credentials.)\n'+
+          '\n'+
+          '> Note that, for convenience during development, there is another alternative:\n'+
+          '> In lieu of setting up real Sendgrid credentials, you can "fake" email\n'+
+          '> delivery by using any email address that ends in "@example.com".  This will\n'+
+          '> write automated emails to your logs rather than actually sending them.\n'+
+          '> (To simulate clicking on a link from an email, just copy and paste the link\n'+
+          '> from the terminal output into your browser.)\n'+
+          '\n'+
+          '[?] If you\'re unsure, visit https://sailsjs.com/support'
+        );
+      }
+
+      var subjectLinePrefix = sails.config.environment === 'production' ? '' : sails.config.environment === 'staging' ? '[FROM STAGING] ' : '[FROM LOCALHOST] ';
+      var messageData = {
+        htmlMessage: htmlEmailContents,
+        to: to,
+        toName: toName,
+        bcc: bcc,
+        subject: subjectLinePrefix+subject,
+        from: from,
+        fromName: fromName,
+        attachments
+      };
+
+      var deferred = sails.helpers.sendgrid.sendHtmlEmail.with(messageData);
+      if (ensureAck) {
+        await deferred;
+      } else {
+        // FUTURE: take advantage of .background() here instead (when available)
+        deferred.exec((err)=>{
+          if (err) {
+            sails.log.error(
+              'Background instruction failed:  Could not deliver email:\n'+
+              util.inspect({template, templateData, to, toName, subject, from, fromName, layout, ensureAck, bcc, attachments},{depth:null})+'\n',
+              'Error details:\n'+
+              util.inspect(err)
+            );
+          } else {
+            sails.log.info(
+              'Background instruction complete:  Email sent via email delivery service (or at least queued):\n'+
+              util.inspect({to, toName, subject, from, fromName, bcc},{depth:null})
+            );
+          }
+        });//_∏_
+      }//fi
+    }//fi
+
+    // All done!
+    return {
+      loggedInsteadOfSending: dontActuallySend,
+    };
+
+  }
+
+};
diff --git a/ee/bulk-operations-dashboard/api/hooks/custom/index.js b/ee/bulk-operations-dashboard/api/hooks/custom/index.js
new file mode 100644
index 0000000000..be391d7097
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/hooks/custom/index.js
@@ -0,0 +1,275 @@
+/**
+ * @description :: The conventional "custom" hook.  Extends this app with custom server-start-time and request-time logic.
+ * @docs        :: https://sailsjs.com/docs/concepts/extending-sails/hooks
+ */
+
+module.exports = function defineCustomHook(sails) {
+
+  return {
+
+    /**
+     * Runs when a Sails app loads/lifts.
+     */
+    initialize: async function () {
+
+      sails.log.info('Initializing project hook... (`api/hooks/custom/`)');
+
+      // Check Stripe/Sendgrid configuration (for billing and emails).
+      var IMPORTANT_STRIPE_CONFIG = ['stripeSecret', 'stripePublishableKey'];
+      var IMPORTANT_SENDGRID_CONFIG = ['sendgridSecret', 'internalEmailAddress'];
+      var isMissingStripeConfig = _.difference(IMPORTANT_STRIPE_CONFIG, Object.keys(sails.config.custom)).length > 0;
+      var isMissingSendgridConfig = _.difference(IMPORTANT_SENDGRID_CONFIG, Object.keys(sails.config.custom)).length > 0;
+
+      if (isMissingStripeConfig || isMissingSendgridConfig) {
+
+        let missingFeatureText = isMissingStripeConfig && isMissingSendgridConfig ? 'billing and email' : isMissingStripeConfig ? 'billing' : 'email';
+        let suffix = '';
+        if (_.contains(['silly'], sails.config.log.level)) {
+          suffix =
+`
+> Tip: To exclude sensitive credentials from source control, use:
+> • config/local.js (for local development)
+> • environment variables (for production)
+>
+> If you want to check them in to source control, use:
+> • config/custom.js  (for development)
+> • config/env/staging.js  (for staging)
+> • config/env/production.js  (for production)
+>
+> (See https://sailsjs.com/docs/concepts/configuration for help configuring Sails.)
+`;
+        }
+
+        let problems = [];
+        if (sails.config.custom.stripeSecret === undefined) {
+          problems.push('No `sails.config.custom.stripeSecret` was configured.');
+        }
+        if (sails.config.custom.stripePublishableKey === undefined) {
+          problems.push('No `sails.config.custom.stripePublishableKey` was configured.');
+        }
+        if (sails.config.custom.sendgridSecret === undefined) {
+          problems.push('No `sails.config.custom.sendgridSecret` was configured.');
+        }
+        if (sails.config.custom.internalEmailAddress === undefined) {
+          problems.push('No `sails.config.custom.internalEmailAddress` was configured.');
+        }
+
+
+        if (sails.config.custom.fleetBaseUrl === undefined) {
+          throw new Error('Missing config vairable! Please set sails.config.custom.fleetBaseUrl to be the URL of your Fleet instance.');
+        }
+        if (sails.config.custom.fleetApiToken === undefined) {
+          throw new Error('Missing config vairable! Please set sails.config.custom.fleetApiToken to be a token for your Fleet instance.');
+        }
+
+
+        if (_.endsWith(sails.config.custom.fleetBaseUrl, '/')) {
+          sails.config.custom.fleetBaseUrl = _.trimRight(sails.config.custom.fleetBaseUrl, '/');
+          sails.log.warn('Warning: The provided sails.config.custom.fleetBaseUrl has a trailing slash. To make sure all auto-generated URLs work as expected, this trailing slash has been removed for you.');
+        }
+        if (!_.startsWith(sails.config.custom.fleetBaseUrl, 'https://')) {
+          sails.log.warn('Warning: The provided sails.config.custom.fleetBaseUrl is missing a protocol (https://). To make sure all auto-generated URLs work as expected, the protocol has been added to the fleetBaseUrl.');
+          sails.config.custom.fleetBaseUrl = 'https://'+sails.config.custom.fleetBaseUrl;
+        }
+
+        sails.log.verbose(
+`Some optional settings have not been configured yet:
+---------------------------------------------------------------------
+${problems.join('\n')}
+
+Until this is addressed, this app's ${missingFeatureText} features
+will be disabled and/or hidden in the UI.
+
+ [?] If you're unsure or need advice, come by https://sailsjs.com/support
+---------------------------------------------------------------------${suffix}`);
+      }//fi
+
+      // Set an additional config keys based on whether Stripe config is available.
+      // This will determine whether or not to enable various billing features.
+      sails.config.custom.enableBillingFeatures = !isMissingStripeConfig;
+
+      // After "sails-hook-organics" finishes initializing, configure Stripe
+      // and Sendgrid packs with any available credentials.
+      sails.after('hook:organics:loaded', ()=>{
+
+        sails.helpers.stripe.configure({
+          secret: sails.config.custom.stripeSecret
+        });
+
+        sails.helpers.sendgrid.configure({
+          secret: sails.config.custom.sendgridSecret,
+          from: sails.config.custom.fromEmailAddress,
+          fromName: sails.config.custom.fromName,
+        });
+
+      });//_∏_
+
+      // ... Any other app-specific setup code that needs to run on lift,
+      // even in production, goes here ...
+
+    },
+
+
+    routes: {
+
+      /**
+       * Runs before every matching route.
+       *
+       * @param {Ref} req
+       * @param {Ref} res
+       * @param {Function} next
+       */
+      before: {
+        '/*': {
+          skipAssets: true,
+          fn: async function(req, res, next){
+
+            var url = require('url');
+
+            // First, if this is a GET request (and thus potentially a view),
+            // attach a couple of guaranteed locals.
+            if (req.method === 'GET') {
+
+              // The  `_environment` local lets us do a little workaround to make Vue.js
+              // run in "production mode" without unnecessarily involving complexities
+              // with webpack et al.)
+              if (res.locals._environment !== undefined) {
+                throw new Error('Cannot attach Sails environment as the view local `_environment`, because this view local already exists!  (Is it being attached somewhere else?)');
+              }
+              res.locals._environment = sails.config.environment;
+
+              // The `me` local is set explicitly to `undefined` here just to avoid having to
+              // do `typeof me !== 'undefined'` checks in our views/layouts/partials.
+              // > Note that, depending on the request, this may or may not be set to the
+              // > logged-in user record further below.
+              if (res.locals.me !== undefined) {
+                throw new Error('Cannot attach view local `me`, because this view local already exists!  (Is it being attached somewhere else?)');
+              }
+              res.locals.me = undefined;
+            }//fi
+
+            // Next, if we're running in our actual "production" or "staging" Sails
+            // environment, check if this is a GET request via some other host,
+            // for example a subdomain like `webhooks.` or `click.`.  If so, we'll
+            // automatically go ahead and redirect to the corresponding path under
+            // our base URL, which is environment-specific.
+            // > Note that we DO NOT redirect virtual socket requests and we DO NOT
+            // > redirect non-GET requests (because it can confuse some 3rd party
+            // > platforms that send webhook requests.)  We also DO NOT redirect
+            // > requests in other environments to allow for flexibility during
+            // > development (e.g. so you can preview an app running locally on
+            // > your laptop using a local IP address or a tool like ngrok, in
+            // > case you want to run it on a real, physical mobile/IoT device)
+            var configuredBaseHostname;
+            try {
+              configuredBaseHostname = url.parse(sails.config.custom.baseUrl).host;
+            } catch (unusedErr) { /*…*/}
+            if ((sails.config.environment === 'staging' || sails.config.environment === 'production') && !req.isSocket && req.method === 'GET' && req.hostname !== configuredBaseHostname) {
+              sails.log.info('Redirecting GET request from `'+req.hostname+'` to configured expected host (`'+configuredBaseHostname+'`)...');
+              return res.redirect(sails.config.custom.baseUrl+req.url);
+            }//•
+
+            // Prevent the browser from caching logged-in users' pages.
+            // (including w/ the Chrome back button)
+            // > • https://mixmax.com/blog/chrome-back-button-cache-no-store
+            // > • https://madhatted.com/2013/6/16/you-do-not-understand-browser-history
+            //
+            // This also prevents an issue where webpages may be cached by browsers, and thus
+            // reference an old bundle file (e.g. dist/production.min.js or dist/production.min.css),
+            // which might have a different hash encoded in its filename.  This way, by preventing caching
+            // of the webpage itself, the HTML is always fresh, and thus always trying to load the latest,
+            // correct bundle files.
+            res.setHeader('Cache-Control', 'no-cache, no-store');
+
+            // No session? Proceed as usual.
+            // (e.g. request for a static asset)
+            if (!req.session) { return next(); }
+
+            // Not logged in? Proceed as usual.
+            if (!req.session.userId) { return next(); }
+
+            // Otherwise, look up the logged-in user.
+            var loggedInUser = await User.findOne({
+              id: req.session.userId
+            });
+
+            // If the logged-in user has gone missing, log a warning,
+            // wipe the user id from the requesting user agent's session,
+            // and then send the "unauthorized" response.
+            if (!loggedInUser) {
+              sails.log.warn('Somehow, the user record for the logged-in user (`'+req.session.userId+'`) has gone missing....');
+              delete req.session.userId;
+              return res.unauthorized();
+            }
+
+            // Add additional information for convenience when building top-level navigation.
+            // (i.e. whether to display "Dashboard", "My Account", etc.)
+            if (!loggedInUser.password || loggedInUser.emailStatus === 'unconfirmed') {
+              loggedInUser.dontDisplayAccountLinkInNav = true;
+            }
+
+            // Expose the user record as an extra property on the request object (`req.me`).
+            // > Note that we make sure `req.me` doesn't already exist first.
+            if (req.me !== undefined) {
+              throw new Error('Cannot attach logged-in user as `req.me` because this property already exists!  (Is it being attached somewhere else?)');
+            }
+            req.me = loggedInUser;
+
+            // If our "lastSeenAt" attribute for this user is at least a few seconds old, then set it
+            // to the current timestamp.
+            //
+            // (Note: As an optimization, this is run behind the scenes to avoid adding needless latency.)
+            var MS_TO_BUFFER = 60*1000;
+            var now = Date.now();
+            if (loggedInUser.lastSeenAt < now - MS_TO_BUFFER) {
+              User.updateOne({id: loggedInUser.id})
+              .set({ lastSeenAt: now })
+              .exec((err)=>{
+                if (err) {
+                  sails.log.error('Background task failed: Could not update user (`'+loggedInUser.id+'`) with a new `lastSeenAt` timestamp.  Error details: '+err.stack);
+                  return;
+                }//•
+                sails.log.verbose('Updated the `lastSeenAt` timestamp for user `'+loggedInUser.id+'`.');
+                // Nothing else to do here.
+              });//_∏_  (Meanwhile...)
+            }//fi
+
+
+            // If this is a GET request, then also expose an extra view local (`<%= me %>`).
+            // > Note that we make sure a local named `me` doesn't already exist first.
+            // > Also note that we strip off any properties that correspond with protected attributes.
+            if (req.method === 'GET') {
+              if (res.locals.me !== undefined) {
+                throw new Error('Cannot attach logged-in user as the view local `me`, because this view local already exists!  (Is it being attached somewhere else?)');
+              }
+
+              // Exclude any fields corresponding with attributes that have `protect: true`.
+              var sanitizedUser = _.extend({}, loggedInUser);
+              sails.helpers.redactUser(sanitizedUser);
+
+              // If there is still a "password" in sanitized user data, then delete it just to be safe.
+              // (But also log a warning so this isn't hopelessly confusing.)
+              if (sanitizedUser.password) {
+                sails.log.warn('The logged in user record has a `password` property, but it was still there after pruning off all properties that match `protect: true` attributes in the User model.  So, just to be safe, removing the `password` property anyway...');
+                delete sanitizedUser.password;
+              }//fi
+
+              res.locals.me = sanitizedUser;
+
+              // Include information on the locals as to whether billing features
+              // are enabled for this app, and whether email verification is required.
+              res.locals.isBillingEnabled = sails.config.custom.enableBillingFeatures;
+              res.locals.isEmailVerificationRequired = sails.config.custom.verifyEmailAddresses;
+
+            }//fi
+
+            return next();
+          }
+        }
+      }
+    }
+
+
+  };
+
+};
diff --git a/ee/bulk-operations-dashboard/api/models/UndeployedProfile.js b/ee/bulk-operations-dashboard/api/models/UndeployedProfile.js
new file mode 100644
index 0000000000..2d13a1993f
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/models/UndeployedProfile.js
@@ -0,0 +1,61 @@
+/**
+ * UndeployedProfile.js
+ *
+ * @description :: A model definition represents a database table/collection.
+ * @docs        :: https://sailsjs.com/docs/concepts/models-and-orm/models
+ */
+
+module.exports = {
+
+  attributes: {
+
+    //  ╔═╗╦═╗╦╔╦╗╦╔╦╗╦╦  ╦╔═╗╔═╗
+    //  ╠═╝╠╦╝║║║║║ ║ ║╚╗╔╝║╣ ╚═╗
+    //  ╩  ╩╚═╩╩ ╩╩ ╩ ╩ ╚╝ ╚═╝╚═╝
+    name: {
+      type: 'string',
+      required: true,
+      description: 'The name of the configuration profile on the Fleet instance.',
+    },
+
+    platform: {
+      type: 'string',
+      description: 'The type of operating system this profile is for.',
+      required: true,
+      isIn: [
+        'darwin',
+        'windows'
+      ]
+    },
+
+    profileType: {
+      type: 'string',
+      description: 'The file extension of the configuration profile.',
+      required: true,
+      isIn: [
+        '.mobileconfig',
+        '.xml',
+        '.json',
+      ],
+    },
+
+    profileContents: {
+      type: 'string',
+      required: true,
+      description: 'The contents of the configuration profile.',
+    },
+
+
+    //  ╔═╗╔╦╗╔╗ ╔═╗╔╦╗╔═╗
+    //  ║╣ ║║║╠╩╗║╣  ║║╚═╗
+    //  ╚═╝╩ ╩╚═╝╚═╝═╩╝╚═╝
+
+
+    //  ╔═╗╔═╗╔═╗╔═╗╔═╗╦╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
+    //  ╠═╣╚═╗╚═╗║ ║║  ║╠═╣ ║ ║║ ║║║║╚═╗
+    //  ╩ ╩╚═╝╚═╝╚═╝╚═╝╩╩ ╩ ╩ ╩╚═╝╝╚╝╚═╝
+
+  },
+
+};
+
diff --git a/ee/bulk-operations-dashboard/api/models/UndeployedScript.js b/ee/bulk-operations-dashboard/api/models/UndeployedScript.js
new file mode 100644
index 0000000000..2ce07c2158
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/models/UndeployedScript.js
@@ -0,0 +1,60 @@
+/**
+ * UndeployedScript.js
+ *
+ * @description :: A model definition represents a database table/collection.
+ * @docs        :: https://sailsjs.com/docs/concepts/models-and-orm/models
+ */
+
+module.exports = {
+
+  attributes: {
+
+    //  ╔═╗╦═╗╦╔╦╗╦╔╦╗╦╦  ╦╔═╗╔═╗
+    //  ╠═╝╠╦╝║║║║║ ║ ║╚╗╔╝║╣ ╚═╗
+    //  ╩  ╩╚═╩╩ ╩╩ ╩ ╩ ╚╝ ╚═╝╚═╝
+    name: {
+      type: 'string',
+      required: true,
+      description: 'The name of the script on the Fleet instance.',
+    },
+
+    platform: {
+      type: 'string',
+      description: 'The type of operating system this script is for.',
+      required: true,
+      isIn: [
+        'macOS & Linux',
+        'Windows'
+      ],
+    },
+
+    scriptType: {
+      type: 'string',
+      description: 'The file extension of the script.',
+      required: true,
+      isIn: [
+        '.sh',
+        '.ps1',
+      ],
+    },
+
+    scriptContents: {
+      type: 'string',
+      required: true,
+      description: 'The contents of the script stored as a string.',
+    },
+
+
+    //  ╔═╗╔╦╗╔╗ ╔═╗╔╦╗╔═╗
+    //  ║╣ ║║║╠╩╗║╣  ║║╚═╗
+    //  ╚═╝╩ ╩╚═╝╚═╝═╩╝╚═╝
+
+
+    //  ╔═╗╔═╗╔═╗╔═╗╔═╗╦╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
+    //  ╠═╣╚═╗╚═╗║ ║║  ║╠═╣ ║ ║║ ║║║║╚═╗
+    //  ╩ ╩╚═╝╚═╝╚═╝╚═╝╩╩ ╩ ╩ ╩╚═╝╝╚╝╚═╝
+
+  },
+
+};
+
diff --git a/ee/bulk-operations-dashboard/api/models/User.js b/ee/bulk-operations-dashboard/api/models/User.js
new file mode 100644
index 0000000000..983627db7a
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/models/User.js
@@ -0,0 +1,171 @@
+/**
+ * User.js
+ *
+ * A user who can log in to this application.
+ */
+
+module.exports = {
+
+  attributes: {
+
+    //  ╔═╗╦═╗╦╔╦╗╦╔╦╗╦╦  ╦╔═╗╔═╗
+    //  ╠═╝╠╦╝║║║║║ ║ ║╚╗╔╝║╣ ╚═╗
+    //  ╩  ╩╚═╩╩ ╩╩ ╩ ╩ ╚╝ ╚═╝╚═╝
+
+    emailAddress: {
+      type: 'string',
+      required: true,
+      unique: true,
+      isEmail: true,
+      maxLength: 200,
+      example: 'mary.sue@example.com'
+    },
+
+    emailStatus: {
+      type: 'string',
+      isIn: ['unconfirmed', 'change-requested', 'confirmed'],
+      defaultsTo: 'confirmed',
+      description: 'The confirmation status of the user\'s email address.',
+      extendedDescription:
+`Users might be created as "unconfirmed" (e.g. normal signup) or as "confirmed" (e.g. hard-coded
+admin users).  When the email verification feature is enabled, new users created via the
+signup form have \`emailStatus: 'unconfirmed'\` until they click the link in the confirmation email.
+Similarly, when an existing user changes their email address, they switch to the "change-requested"
+email status until they click the link in the confirmation email.`
+    },
+
+    emailChangeCandidate: {
+      type: 'string',
+      isEmail: true,
+      description: 'A still-unconfirmed email address that this user wants to change to (if relevant).'
+    },
+
+    password: {
+      type: 'string',
+      required: true,
+      description: 'Securely hashed representation of the user\'s login password.',
+      protect: true,
+      example: '2$28a8eabna301089103-13948134nad'
+    },
+
+    fullName: {
+      type: 'string',
+      required: true,
+      description: 'Full representation of the user\'s name.',
+      maxLength: 120,
+      example: 'Mary Sue van der McHenst'
+    },
+
+    isSuperAdmin: {
+      type: 'boolean',
+      description: 'Whether this user is a "super admin" with extra permissions, etc.',
+      extendedDescription:
+`Super admins might have extra permissions, see a different default home page when they log in,
+or even have a completely different feature set from normal users.  In this app, the \`isSuperAdmin\`
+flag is just here as a simple way to represent two different kinds of users.  Usually, it's a good idea
+to keep the data model as simple as possible, only adding attributes when you actually need them for
+features being built right now.
+
+For example, a "super admin" user for a small to medium-sized e-commerce website might be able to
+change prices, deactivate seasonal categories, add new offerings, and view live orders as they come in.
+On the other hand, for an e-commerce website like Walmart.com that has undergone years of development
+by a large team, those administrative features might be split across a few different roles.
+
+So, while this \`isSuperAdmin\` demarcation might not be the right approach forever, it's a good place to start.`
+    },
+
+    passwordResetToken: {
+      type: 'string',
+      description: 'A unique token used to verify the user\'s identity when recovering a password.  Expires after 1 use, or after a set amount of time has elapsed.'
+    },
+
+    passwordResetTokenExpiresAt: {
+      type: 'number',
+      description: 'A JS timestamp (epoch ms) representing the moment when this user\'s `passwordResetToken` will expire (or 0 if the user currently has no such token).',
+      example: 1502844074211
+    },
+
+    emailProofToken: {
+      type: 'string',
+      description: 'A pseudorandom, probabilistically-unique token for use in our account verification emails.'
+    },
+
+    emailProofTokenExpiresAt: {
+      type: 'number',
+      description: 'A JS timestamp (epoch ms) representing the moment when this user\'s `emailProofToken` will expire (or 0 if the user currently has no such token).',
+      example: 1502844074211
+    },
+
+    stripeCustomerId: {
+      type: 'string',
+      protect: true,
+      description: 'The id of the customer entry in Stripe associated with this user (or empty string if this user is not linked to a Stripe customer -- e.g. if billing features are not enabled).',
+      extendedDescription:
+`Just because this value is set doesn't necessarily mean that this user has a billing card.
+It just means they have a customer entry in Stripe, which might or might not have a billing card.`
+    },
+
+    hasBillingCard: {
+      type: 'boolean',
+      description: 'Whether this user has a default billing card hooked up as their payment method.',
+      extendedDescription:
+`More specifically, this indcates whether this user record's linked customer entry in Stripe has
+a default payment source (i.e. credit card).  Note that a user have a \`stripeCustomerId\`
+without necessarily having a billing card.`
+    },
+
+    billingCardBrand: {
+      type: 'string',
+      example: 'Visa',
+      description: 'The brand of this user\'s default billing card (or empty string if no billing card is set up).',
+      extendedDescription: 'To ensure PCI compliance, this data comes from Stripe, where it reflects the user\'s default payment source.'
+    },
+
+    billingCardLast4: {
+      type: 'string',
+      example: '4242',
+      description: 'The last four digits of the card number for this user\'s default billing card (or empty string if no billing card is set up).',
+      extendedDescription: 'To ensure PCI compliance, this data comes from Stripe, where it reflects the user\'s default payment source.'
+    },
+
+    billingCardExpMonth: {
+      type: 'string',
+      example: '08',
+      description: 'The two-digit expiration month from this user\'s default billing card, formatted as MM (or empty string if no billing card is set up).',
+      extendedDescription: 'To ensure PCI compliance, this data comes from Stripe, where it reflects the user\'s default payment source.'
+    },
+
+    billingCardExpYear: {
+      type: 'string',
+      example: '2023',
+      description: 'The four-digit expiration year from this user\'s default billing card, formatted as YYYY (or empty string if no credit card is set up).',
+      extendedDescription: 'To ensure PCI compliance, this data comes from Stripe, where it reflects the user\'s default payment source.'
+    },
+
+    tosAcceptedByIp: {
+      type: 'string',
+      description: 'The IP (ipv4) address of the request that accepted the terms of service.',
+      extendedDescription: 'Useful for certain types of businesses and regulatory requirements (KYC, etc.)',
+      moreInfoUrl: 'https://en.wikipedia.org/wiki/Know_your_customer'
+    },
+
+    lastSeenAt: {
+      type: 'number',
+      description: 'A JS timestamp (epoch ms) representing the moment at which this user most recently interacted with the backend while logged in (or 0 if they have not interacted with the backend at all yet).',
+      example: 1502844074211
+    },
+
+    //  ╔═╗╔╦╗╔╗ ╔═╗╔╦╗╔═╗
+    //  ║╣ ║║║╠╩╗║╣  ║║╚═╗
+    //  ╚═╝╩ ╩╚═╝╚═╝═╩╝╚═╝
+    // n/a
+
+    //  ╔═╗╔═╗╔═╗╔═╗╔═╗╦╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
+    //  ╠═╣╚═╗╚═╗║ ║║  ║╠═╣ ║ ║║ ║║║║╚═╗
+    //  ╩ ╩╚═╝╚═╝╚═╝╚═╝╩╩ ╩ ╩ ╩╚═╝╝╚╝╚═╝
+    // n/a
+
+  },
+
+
+};
diff --git a/ee/bulk-operations-dashboard/api/policies/is-logged-in.js b/ee/bulk-operations-dashboard/api/policies/is-logged-in.js
new file mode 100644
index 0000000000..0c03b1a689
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/policies/is-logged-in.js
@@ -0,0 +1,26 @@
+/**
+ * is-logged-in
+ *
+ * A simple policy that allows any request from an authenticated user.
+ *
+ * For more about how to use policies, see:
+ *   https://sailsjs.com/config/policies
+ *   https://sailsjs.com/docs/concepts/policies
+ *   https://sailsjs.com/docs/concepts/policies/access-control-and-permissions
+ */
+module.exports = async function (req, res, proceed) {
+
+  // If `req.me` is set, then we know that this request originated
+  // from a logged-in user.  So we can safely proceed to the next policy--
+  // or, if this is the last policy, the relevant action.
+  // > For more about where `req.me` comes from, check out this app's
+  // > custom hook (`api/hooks/custom/index.js`).
+  if (req.me) {
+    return proceed();
+  }
+
+  //--•
+  // Otherwise, this request did not come from a logged-in user.
+  return res.unauthorized();
+
+};
diff --git a/ee/bulk-operations-dashboard/api/policies/is-super-admin.js b/ee/bulk-operations-dashboard/api/policies/is-super-admin.js
new file mode 100644
index 0000000000..09c473aa9d
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/policies/is-super-admin.js
@@ -0,0 +1,28 @@
+/**
+ * is-super-admin
+ *
+ * A simple policy that blocks requests from non-super-admins.
+ *
+ * For more about how to use policies, see:
+ *   https://sailsjs.com/config/policies
+ *   https://sailsjs.com/docs/concepts/policies
+ *   https://sailsjs.com/docs/concepts/policies/access-control-and-permissions
+ */
+module.exports = async function (req, res, proceed) {
+
+  // First, check whether the request comes from a logged-in user.
+  // > For more about where `req.me` comes from, check out this app's
+  // > custom hook (`api/hooks/custom/index.js`).
+  if (!req.me) {
+    return res.unauthorized();
+  }//•
+
+  // Then check that this user is a "super admin".
+  if (!req.me.isSuperAdmin) {
+    return res.forbidden();
+  }//•
+
+  // IWMIH, we've got ourselves a "super admin".
+  return proceed();
+
+};
diff --git a/ee/bulk-operations-dashboard/api/responses/expired.js b/ee/bulk-operations-dashboard/api/responses/expired.js
new file mode 100644
index 0000000000..c71239adbf
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/responses/expired.js
@@ -0,0 +1,37 @@
+/**
+ * expired.js
+ *
+ * A custom response that content-negotiates the current request to either:
+ *  • serve an HTML error page about the specified token being invalid or expired
+ *  • or send back 498 (Token Expired/Invalid) with no response body.
+ *
+ * Example usage:
+ * ```
+ *     return res.expired();
+ * ```
+ *
+ * Or with actions2:
+ * ```
+ *     exits: {
+ *       badToken: {
+ *         description: 'Provided token was expired, invalid, or already used up.',
+ *         responseType: 'expired'
+ *       }
+ *     }
+ * ```
+ */
+module.exports = function expired() {
+
+  var req = this.req;
+  var res = this.res;
+
+  sails.log.verbose('Ran custom response: res.expired()');
+
+  if (req.wantsJSON) {
+    return res.status(498).send('Token Expired/Invalid');
+  }
+  else {
+    return res.status(498).view('498');
+  }
+
+};
diff --git a/ee/bulk-operations-dashboard/api/responses/unauthorized.js b/ee/bulk-operations-dashboard/api/responses/unauthorized.js
new file mode 100644
index 0000000000..650cb992f2
--- /dev/null
+++ b/ee/bulk-operations-dashboard/api/responses/unauthorized.js
@@ -0,0 +1,43 @@
+/**
+ * unauthorized.js
+ *
+ * A custom response that content-negotiates the current request to either:
+ *  • log out the current user and redirect them to the login page
+ *  • or send back 401 (Unauthorized) with no response body.
+ *
+ * Example usage:
+ * ```
+ *     return res.unauthorized();
+ * ```
+ *
+ * Or with actions2:
+ * ```
+ *     exits: {
+ *       badCombo: {
+ *         description: 'That email address and password combination is not recognized.',
+ *         responseType: 'unauthorized'
+ *       }
+ *     }
+ * ```
+ */
+module.exports = function unauthorized() {
+
+  var req = this.req;
+  var res = this.res;
+
+  sails.log.verbose('Ran custom response: res.unauthorized()');
+
+  if (req.wantsJSON) {
+    return res.sendStatus(401);
+  }
+  // Or log them out (if necessary) and then redirect to the login page.
+  else {
+
+    if (req.session.userId) {
+      delete req.session.userId;
+    }
+
+    return res.redirect('/login');
+  }
+
+};
diff --git a/ee/bulk-operations-dashboard/app.js b/ee/bulk-operations-dashboard/app.js
new file mode 100644
index 0000000000..f2c5f4eba8
--- /dev/null
+++ b/ee/bulk-operations-dashboard/app.js
@@ -0,0 +1,54 @@
+/**
+ * app.js
+ *
+ * Use `app.js` to run your app without `sails lift`.
+ * To start the server, run: `node app.js`.
+ *
+ * This is handy in situations where the sails CLI is not relevant or useful,
+ * such as when you deploy to a server, or a PaaS like Heroku.
+ *
+ * For example:
+ *   => `node app.js`
+ *   => `npm start`
+ *   => `forever start app.js`
+ *   => `node debug app.js`
+ *
+ * The same command-line arguments and env vars are supported, e.g.:
+ * `NODE_ENV=production node app.js --port=80 --verbose`
+ *
+ * For more information see:
+ *   https://sailsjs.com/anatomy/app.js
+ */
+
+
+// Ensure we're in the project directory, so cwd-relative paths work as expected
+// no matter where we actually lift from.
+// > Note: This is not required in order to lift, but it is a convenient default.
+process.chdir(__dirname);
+
+
+
+// Attempt to import `sails` dependency, as well as `rc` (for loading `.sailsrc` files).
+var sails;
+var rc;
+try {
+  sails = require('sails');
+  rc = require('sails/accessible/rc');
+} catch (err) {
+  console.error('Encountered an error when attempting to require(\'sails\'):');
+  console.error(err.stack);
+  console.error('--');
+  console.error('To run an app using `node app.js`, you need to have Sails installed');
+  console.error('locally (`./node_modules/sails`).  To do that, just make sure you\'re');
+  console.error('in the same directory as your app and run `npm install`.');
+  console.error();
+  console.error('If Sails is installed globally (i.e. `npm install -g sails`) you can');
+  console.error('also run this app with `sails lift`.  Running with `sails lift` will');
+  console.error('not run this file (`app.js`), but it will do exactly the same thing.');
+  console.error('(It even uses your app directory\'s local Sails install, if possible.)');
+  return;
+}//-•
+
+
+// Start server
+sails.lift(rc('sails'));
diff --git a/ee/bulk-operations-dashboard/assets/.eslintrc b/ee/bulk-operations-dashboard/assets/.eslintrc
new file mode 100644
index 0000000000..28cf2eb151
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/.eslintrc
@@ -0,0 +1,63 @@
+{
+  //   ╔═╗╔═╗╦  ╦╔╗╔╔╦╗┬─┐┌─┐  ┌─┐┬  ┬┌─┐┬─┐┬─┐┬┌┬┐┌─┐
+  //   ║╣ ╚═╗║  ║║║║ ║ ├┬┘│    │ │└┐┌┘├┤ ├┬┘├┬┘│ ││├┤
+  //  o╚═╝╚═╝╩═╝╩╝╚╝ ╩ ┴└─└─┘  └─┘ └┘ └─┘┴└─┴└─┴─┴┘└─┘
+  //  ┌─  ┌─┐┌─┐┬─┐  ┌┐ ┬─┐┌─┐┬ ┬┌─┐┌─┐┬─┐   ┬┌─┐  ┌─┐┌─┐┌─┐┌─┐┌┬┐┌─┐  ─┐
+  //  │   ├┤ │ │├┬┘  ├┴┐├┬┘│ ││││└─┐├┤ ├┬┘   │└─┐  ├─┤└─┐└─┐├┤  │ └─┐   │
+  //  └─  └  └─┘┴└─  └─┘┴└─└─┘└┴┘└─┘└─┘┴└─  └┘└─┘  ┴ ┴└─┘└─┘└─┘ ┴ └─┘  ─┘
+  // > An .eslintrc configuration override for use in the `assets/` directory.
+  //
+  // This extends the top-level .eslintrc file, primarily to change the set of
+  // supported globals, as well as any other relevant settings.  (Since JavaScript
+  // code in the `assets/` folder is intended for the browser habitat, a different
+  // set of globals is supported.  For example, instead of Node.js/Sails globals
+  // like `sails` and `process`, you have access to browser globals like `window`.)
+  //
+  // (See .eslintrc in the root directory of this Sails app for more context.)
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+  "extends": [
+    "../.eslintrc"
+  ],
+
+  "env": {
+    "browser": true,
+    "node": false
+  },
+
+  "parserOptions": {
+    "ecmaVersion": 8
+    //^ If you are not using a transpiler like Babel, change this to `5`.
+  },
+
+  "globals": {
+
+    // Allow any window globals you're relying on here; e.g.
+    // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+    "SAILS_LOCALS": true,
+    "io": true,
+    "Cloud": true,
+    "parasails": true,
+    "$": true,
+    "_": true,
+    "bowser": true,
+    "StripeCheckout": true,
+    "Stripe": true,
+    "Vue": true,
+    "VueRouter": true,
+    "moment": true,
+    // "google": true,
+    // ...etc.
+    // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+    // Make sure backend globals aren't indadvertently tolerated in our client-side JS:
+    // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+    "sails": false,
+    "User": false,
+    "UndeployedProfile": false,
+    "UndeployedScript": false
+    // ...and any other backend globals (e.g. `"Organization": false`)
+    // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+  }
+
+}
diff --git a/ee/bulk-operations-dashboard/assets/dependencies/bootstrap-4/bootstrap-4.bundle.js b/ee/bulk-operations-dashboard/assets/dependencies/bootstrap-4/bootstrap-4.bundle.js
new file mode 100644
index 0000000000..e8b832da6b
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/dependencies/bootstrap-4/bootstrap-4.bundle.js
@@ -0,0 +1,6461 @@
+/*!
+  * Bootstrap v4.1.3 (https://getbootstrap.com/)
+  * Copyright 2011-2018 The Bootstrap Authors (https://github.com/twbs/bootstrap/graphs/contributors)
+  * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE)
+  */
+(function (global, factory) {
+  typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports, require('jquery')) :
+  typeof define === 'function' && define.amd ? define(['exports', 'jquery'], factory) :
+  (factory((global.bootstrap = {}),global.jQuery));
+}(this, (function (exports,$) { 'use strict';
+
+  $ = $ && $.hasOwnProperty('default') ? $['default'] : $;
+
+  function _defineProperties(target, props) {
+    for (var i = 0; i < props.length; i++) {
+      var descriptor = props[i];
+      descriptor.enumerable = descriptor.enumerable || false;
+      descriptor.configurable = true;
+      if ("value" in descriptor) descriptor.writable = true;
+      Object.defineProperty(target, descriptor.key, descriptor);
+    }
+  }
+
+  function _createClass(Constructor, protoProps, staticProps) {
+    if (protoProps) _defineProperties(Constructor.prototype, protoProps);
+    if (staticProps) _defineProperties(Constructor, staticProps);
+    return Constructor;
+  }
+
+  function _defineProperty(obj, key, value) {
+    if (key in obj) {
+      Object.defineProperty(obj, key, {
+        value: value,
+        enumerable: true,
+        configurable: true,
+        writable: true
+      });
+    } else {
+      obj[key] = value;
+    }
+
+    return obj;
+  }
+
+  function _objectSpread(target) {
+    for (var i = 1; i < arguments.length; i++) {
+      var source = arguments[i] != null ? arguments[i] : {};
+      var ownKeys = Object.keys(source);
+
+      if (typeof Object.getOwnPropertySymbols === 'function') {
+        ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function (sym) {
+          return Object.getOwnPropertyDescriptor(source, sym).enumerable;
+        }));
+      }
+
+      ownKeys.forEach(function (key) {
+        _defineProperty(target, key, source[key]);
+      });
+    }
+
+    return target;
+  }
+
+  function _inheritsLoose(subClass, superClass) {
+    subClass.prototype = Object.create(superClass.prototype);
+    subClass.prototype.constructor = subClass;
+    subClass.__proto__ = superClass;
+  }
+
+  /**
+   * --------------------------------------------------------------------------
+   * Bootstrap (v4.1.3): util.js
+   * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE)
+   * --------------------------------------------------------------------------
+   */
+
+  var Util = function ($$$1) {
+    /**
+     * ------------------------------------------------------------------------
+     * Private TransitionEnd Helpers
+     * ------------------------------------------------------------------------
+     */
+    var TRANSITION_END = 'transitionend';
+    var MAX_UID = 1000000;
+    var MILLISECONDS_MULTIPLIER = 1000; // Shoutout AngusCroll (https://goo.gl/pxwQGp)
+
+    function toType(obj) {
+      return {}.toString.call(obj).match(/\s([a-z]+)/i)[1].toLowerCase();
+    }
+
+    function getSpecialTransitionEndEvent() {
+      return {
+        bindType: TRANSITION_END,
+        delegateType: TRANSITION_END,
+        handle: function handle(event) {
+          if ($$$1(event.target).is(this)) {
+            return event.handleObj.handler.apply(this, arguments); // eslint-disable-line prefer-rest-params
+          }
+
+          return undefined; // eslint-disable-line no-undefined
+        }
+      };
+    }
+
+    function transitionEndEmulator(duration) {
+      var _this = this;
+
+      var called = false;
+      $$$1(this).one(Util.TRANSITION_END, function () {
+        called = true;
+      });
+      setTimeout(function () {
+        if (!called) {
+          Util.triggerTransitionEnd(_this);
+        }
+      }, duration);
+      return this;
+    }
+
+    function setTransitionEndSupport() {
+      $$$1.fn.emulateTransitionEnd = transitionEndEmulator;
+      $$$1.event.special[Util.TRANSITION_END] = getSpecialTransitionEndEvent();
+    }
+    /**
+     * --------------------------------------------------------------------------
+     * Public Util Api
+     * --------------------------------------------------------------------------
+     */
+
+
+    var Util = {
+      TRANSITION_END: 'bsTransitionEnd',
+      getUID: function getUID(prefix) {
+        do {
+          // eslint-disable-next-line no-bitwise
+          prefix += ~~(Math.random() * MAX_UID); // "~~" acts like a faster Math.floor() here
+        } while (document.getElementById(prefix));
+
+        return prefix;
+      },
+      getSelectorFromElement: function getSelectorFromElement(element) {
+        var selector = element.getAttribute('data-target');
+
+        if (!selector || selector === '#') {
+          selector = element.getAttribute('href') || '';
+        }
+
+        try {
+          return document.querySelector(selector) ? selector : null;
+        } catch (err) {
+          return null;
+        }
+      },
+      getTransitionDurationFromElement: function getTransitionDurationFromElement(element) {
+        if (!element) {
+          return 0;
+        } // Get transition-duration of the element
+
+
+        var transitionDuration = $$$1(element).css('transition-duration');
+        var floatTransitionDuration = parseFloat(transitionDuration); // Return 0 if element or transition duration is not found
+
+        if (!floatTransitionDuration) {
+          return 0;
+        } // If multiple durations are defined, take the first
+
+
+        transitionDuration = transitionDuration.split(',')[0];
+        return parseFloat(transitionDuration) * MILLISECONDS_MULTIPLIER;
+      },
+      reflow: function reflow(element) {
+        return element.offsetHeight;
+      },
+      triggerTransitionEnd: function triggerTransitionEnd(element) {
+        $$$1(element).trigger(TRANSITION_END);
+      },
+      // TODO: Remove in v5
+      supportsTransitionEnd: function supportsTransitionEnd() {
+        return Boolean(TRANSITION_END);
+      },
+      isElement: function isElement(obj) {
+        return (obj[0] || obj).nodeType;
+      },
+      typeCheckConfig: function typeCheckConfig(componentName, config, configTypes) {
+        for (var property in configTypes) {
+          if (Object.prototype.hasOwnProperty.call(configTypes, property)) {
+            var expectedTypes = configTypes[property];
+            var value = config[property];
+            var valueType = value && Util.isElement(value) ? 'element' : toType(value);
+
+            if (!new RegExp(expectedTypes).test(valueType)) {
+              throw new Error(componentName.toUpperCase() + ": " + ("Option \"" + property + "\" provided type \"" + valueType + "\" ") + ("but expected type \"" + expectedTypes + "\"."));
+            }
+          }
+        }
+      }
+    };
+    setTransitionEndSupport();
+    return Util;
+  }($);
+
+  /**
+   * --------------------------------------------------------------------------
+   * Bootstrap (v4.1.3): alert.js
+   * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE)
+   * --------------------------------------------------------------------------
+   */
+
+  var Alert = function ($$$1) {
+    /**
+     * ------------------------------------------------------------------------
+     * Constants
+     * ------------------------------------------------------------------------
+     */
+    var NAME = 'alert';
+    var VERSION = '4.1.3';
+    var DATA_KEY = 'bs.alert';
+    var EVENT_KEY = "." + DATA_KEY;
+    var DATA_API_KEY = '.data-api';
+    var JQUERY_NO_CONFLICT = $$$1.fn[NAME];
+    var Selector = {
+      DISMISS: '[data-dismiss="alert"]'
+    };
+    var Event = {
+      CLOSE: "close" + EVENT_KEY,
+      CLOSED: "closed" + EVENT_KEY,
+      CLICK_DATA_API: "click" + EVENT_KEY + DATA_API_KEY
+    };
+    var ClassName = {
+      ALERT: 'alert',
+      FADE: 'fade',
+      SHOW: 'show'
+      /**
+       * ------------------------------------------------------------------------
+       * Class Definition
+       * ------------------------------------------------------------------------
+       */
+
+    };
+
+    var Alert =
+    /*#__PURE__*/
+    function () {
+      function Alert(element) {
+        this._element = element;
+      } // Getters
+
+
+      var _proto = Alert.prototype;
+
+      // Public
+      _proto.close = function close(element) {
+        var rootElement = this._element;
+
+        if (element) {
+          rootElement = this._getRootElement(element);
+        }
+
+        var customEvent = this._triggerCloseEvent(rootElement);
+
+        if (customEvent.isDefaultPrevented()) {
+          return;
+        }
+
+        this._removeElement(rootElement);
+      };
+
+      _proto.dispose = function dispose() {
+        $$$1.removeData(this._element, DATA_KEY);
+        this._element = null;
+      }; // Private
+
+
+      _proto._getRootElement = function _getRootElement(element) {
+        var selector = Util.getSelectorFromElement(element);
+        var parent = false;
+
+        if (selector) {
+          parent = document.querySelector(selector);
+        }
+
+        if (!parent) {
+          parent = $$$1(element).closest("." + ClassName.ALERT)[0];
+        }
+
+        return parent;
+      };
+
+      _proto._triggerCloseEvent = function _triggerCloseEvent(element) {
+        var closeEvent = $$$1.Event(Event.CLOSE);
+        $$$1(element).trigger(closeEvent);
+        return closeEvent;
+      };
+
+      _proto._removeElement = function _removeElement(element) {
+        var _this = this;
+
+        $$$1(element).removeClass(ClassName.SHOW);
+
+        if (!$$$1(element).hasClass(ClassName.FADE)) {
+          this._destroyElement(element);
+
+          return;
+        }
+
+        var transitionDuration = Util.getTransitionDurationFromElement(element);
+        $$$1(element).one(Util.TRANSITION_END, function (event) {
+          return _this._destroyElement(element, event);
+        }).emulateTransitionEnd(transitionDuration);
+      };
+
+      _proto._destroyElement = function _destroyElement(element) {
+        $$$1(element).detach().trigger(Event.CLOSED).remove();
+      }; // Static
+
+
+      Alert._jQueryInterface = function _jQueryInterface(config) {
+        return this.each(function () {
+          var $element = $$$1(this);
+          var data = $element.data(DATA_KEY);
+
+          if (!data) {
+            data = new Alert(this);
+            $element.data(DATA_KEY, data);
+          }
+
+          if (config === 'close') {
+            data[config](this);
+          }
+        });
+      };
+
+      Alert._handleDismiss = function _handleDismiss(alertInstance) {
+        return function (event) {
+          if (event) {
+            event.preventDefault();
+          }
+
+          alertInstance.close(this);
+        };
+      };
+
+      _createClass(Alert, null, [{
+        key: "VERSION",
+        get: function get() {
+          return VERSION;
+        }
+      }]);
+
+      return Alert;
+    }();
+    /**
+     * ------------------------------------------------------------------------
+     * Data Api implementation
+     * ------------------------------------------------------------------------
+     */
+
+
+    $$$1(document).on(Event.CLICK_DATA_API, Selector.DISMISS, Alert._handleDismiss(new Alert()));
+    /**
+     * ------------------------------------------------------------------------
+     * jQuery
+     * ------------------------------------------------------------------------
+     */
+
+    $$$1.fn[NAME] = Alert._jQueryInterface;
+    $$$1.fn[NAME].Constructor = Alert;
+
+    $$$1.fn[NAME].noConflict = function () {
+      $$$1.fn[NAME] = JQUERY_NO_CONFLICT;
+      return Alert._jQueryInterface;
+    };
+
+    return Alert;
+  }($);
+
+  /**
+   * --------------------------------------------------------------------------
+   * Bootstrap (v4.1.3): button.js
+   * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE)
+   * --------------------------------------------------------------------------
+   */
+
+  var Button = function ($$$1) {
+    /**
+     * ------------------------------------------------------------------------
+     * Constants
+     * ------------------------------------------------------------------------
+     */
+    var NAME = 'button';
+    var VERSION = '4.1.3';
+    var DATA_KEY = 'bs.button';
+    var EVENT_KEY = "." + DATA_KEY;
+    var DATA_API_KEY = '.data-api';
+    var JQUERY_NO_CONFLICT = $$$1.fn[NAME];
+    var ClassName = {
+      ACTIVE: 'active',
+      BUTTON: 'btn',
+      FOCUS: 'focus'
+    };
+    var Selector = {
+      DATA_TOGGLE_CARROT: '[data-toggle^="button"]',
+      DATA_TOGGLE: '[data-toggle="buttons"]',
+      INPUT: 'input',
+      ACTIVE: '.active',
+      BUTTON: '.btn'
+    };
+    var Event = {
+      CLICK_DATA_API: "click" + EVENT_KEY + DATA_API_KEY,
+      FOCUS_BLUR_DATA_API: "focus" + EVENT_KEY + DATA_API_KEY + " " + ("blur" + EVENT_KEY + DATA_API_KEY)
+      /**
+       * ------------------------------------------------------------------------
+       * Class Definition
+       * ------------------------------------------------------------------------
+       */
+
+    };
+
+    var Button =
+    /*#__PURE__*/
+    function () {
+      function Button(element) {
+        this._element = element;
+      } // Getters
+
+
+      var _proto = Button.prototype;
+
+      // Public
+      _proto.toggle = function toggle() {
+        var triggerChangeEvent = true;
+        var addAriaPressed = true;
+        var rootElement = $$$1(this._element).closest(Selector.DATA_TOGGLE)[0];
+
+        if (rootElement) {
+          var input = this._element.querySelector(Selector.INPUT);
+
+          if (input) {
+            if (input.type === 'radio') {
+              if (input.checked && this._element.classList.contains(ClassName.ACTIVE)) {
+                triggerChangeEvent = false;
+              } else {
+                var activeElement = rootElement.querySelector(Selector.ACTIVE);
+
+                if (activeElement) {
+                  $$$1(activeElement).removeClass(ClassName.ACTIVE);
+                }
+              }
+            }
+
+            if (triggerChangeEvent) {
+              if (input.hasAttribute('disabled') || rootElement.hasAttribute('disabled') || input.classList.contains('disabled') || rootElement.classList.contains('disabled')) {
+                return;
+              }
+
+              input.checked = !this._element.classList.contains(ClassName.ACTIVE);
+              $$$1(input).trigger('change');
+            }
+
+            input.focus();
+            addAriaPressed = false;
+          }
+        }
+
+        if (addAriaPressed) {
+          this._element.setAttribute('aria-pressed', !this._element.classList.contains(ClassName.ACTIVE));
+        }
+
+        if (triggerChangeEvent) {
+          $$$1(this._element).toggleClass(ClassName.ACTIVE);
+        }
+      };
+
+      _proto.dispose = function dispose() {
+        $$$1.removeData(this._element, DATA_KEY);
+        this._element = null;
+      }; // Static
+
+
+      Button._jQueryInterface = function _jQueryInterface(config) {
+        return this.each(function () {
+          var data = $$$1(this).data(DATA_KEY);
+
+          if (!data) {
+            data = new Button(this);
+            $$$1(this).data(DATA_KEY, data);
+          }
+
+          if (config === 'toggle') {
+            data[config]();
+          }
+        });
+      };
+
+      _createClass(Button, null, [{
+        key: "VERSION",
+        get: function get() {
+          return VERSION;
+        }
+      }]);
+
+      return Button;
+    }();
+    /**
+     * ------------------------------------------------------------------------
+     * Data Api implementation
+     * ------------------------------------------------------------------------
+     */
+
+
+    $$$1(document).on(Event.CLICK_DATA_API, Selector.DATA_TOGGLE_CARROT, function (event) {
+      event.preventDefault();
+      var button = event.target;
+
+      if (!$$$1(button).hasClass(ClassName.BUTTON)) {
+        button = $$$1(button).closest(Selector.BUTTON);
+      }
+
+      Button._jQueryInterface.call($$$1(button), 'toggle');
+    }).on(Event.FOCUS_BLUR_DATA_API, Selector.DATA_TOGGLE_CARROT, function (event) {
+      var button = $$$1(event.target).closest(Selector.BUTTON)[0];
+      $$$1(button).toggleClass(ClassName.FOCUS, /^focus(in)?$/.test(event.type));
+    });
+    /**
+     * ------------------------------------------------------------------------
+     * jQuery
+     * ------------------------------------------------------------------------
+     */
+
+    $$$1.fn[NAME] = Button._jQueryInterface;
+    $$$1.fn[NAME].Constructor = Button;
+
+    $$$1.fn[NAME].noConflict = function () {
+      $$$1.fn[NAME] = JQUERY_NO_CONFLICT;
+      return Button._jQueryInterface;
+    };
+
+    return Button;
+  }($);
+
+  /**
+   * --------------------------------------------------------------------------
+   * Bootstrap (v4.1.3): carousel.js
+   * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE)
+   * --------------------------------------------------------------------------
+   */
+
+  var Carousel = function ($$$1) {
+    /**
+     * ------------------------------------------------------------------------
+     * Constants
+     * ------------------------------------------------------------------------
+     */
+    var NAME = 'carousel';
+    var VERSION = '4.1.3';
+    var DATA_KEY = 'bs.carousel';
+    var EVENT_KEY = "." + DATA_KEY;
+    var DATA_API_KEY = '.data-api';
+    var JQUERY_NO_CONFLICT = $$$1.fn[NAME];
+    var ARROW_LEFT_KEYCODE = 37; // KeyboardEvent.which value for left arrow key
+
+    var ARROW_RIGHT_KEYCODE = 39; // KeyboardEvent.which value for right arrow key
+
+    var TOUCHEVENT_COMPAT_WAIT = 500; // Time for mouse compat events to fire after touch
+
+    var Default = {
+      interval: 5000,
+      keyboard: true,
+      slide: false,
+      pause: 'hover',
+      wrap: true
+    };
+    var DefaultType = {
+      interval: '(number|boolean)',
+      keyboard: 'boolean',
+      slide: '(boolean|string)',
+      pause: '(string|boolean)',
+      wrap: 'boolean'
+    };
+    var Direction = {
+      NEXT: 'next',
+      PREV: 'prev',
+      LEFT: 'left',
+      RIGHT: 'right'
+    };
+    var Event = {
+      SLIDE: "slide" + EVENT_KEY,
+      SLID: "slid" + EVENT_KEY,
+      KEYDOWN: "keydown" + EVENT_KEY,
+      MOUSEENTER: "mouseenter" + EVENT_KEY,
+      MOUSELEAVE: "mouseleave" + EVENT_KEY,
+      TOUCHEND: "touchend" + EVENT_KEY,
+      LOAD_DATA_API: "load" + EVENT_KEY + DATA_API_KEY,
+      CLICK_DATA_API: "click" + EVENT_KEY + DATA_API_KEY
+    };
+    var ClassName = {
+      CAROUSEL: 'carousel',
+      ACTIVE: 'active',
+      SLIDE: 'slide',
+      RIGHT: 'carousel-item-right',
+      LEFT: 'carousel-item-left',
+      NEXT: 'carousel-item-next',
+      PREV: 'carousel-item-prev',
+      ITEM: 'carousel-item'
+    };
+    var Selector = {
+      ACTIVE: '.active',
+      ACTIVE_ITEM: '.active.carousel-item',
+      ITEM: '.carousel-item',
+      NEXT_PREV: '.carousel-item-next, .carousel-item-prev',
+      INDICATORS: '.carousel-indicators',
+      DATA_SLIDE: '[data-slide], [data-slide-to]',
+      DATA_RIDE: '[data-ride="carousel"]'
+      /**
+       * ------------------------------------------------------------------------
+       * Class Definition
+       * ------------------------------------------------------------------------
+       */
+
+    };
+
+    var Carousel =
+    /*#__PURE__*/
+    function () {
+      function Carousel(element, config) {
+        this._items = null;
+        this._interval = null;
+        this._activeElement = null;
+        this._isPaused = false;
+        this._isSliding = false;
+        this.touchTimeout = null;
+        this._config = this._getConfig(config);
+        this._element = $$$1(element)[0];
+        this._indicatorsElement = this._element.querySelector(Selector.INDICATORS);
+
+        this._addEventListeners();
+      } // Getters
+
+
+      var _proto = Carousel.prototype;
+
+      // Public
+      _proto.next = function next() {
+        if (!this._isSliding) {
+          this._slide(Direction.NEXT);
+        }
+      };
+
+      _proto.nextWhenVisible = function nextWhenVisible() {
+        // Don't call next when the page isn't visible
+        // or the carousel or its parent isn't visible
+        if (!document.hidden && $$$1(this._element).is(':visible') && $$$1(this._element).css('visibility') !== 'hidden') {
+          this.next();
+        }
+      };
+
+      _proto.prev = function prev() {
+        if (!this._isSliding) {
+          this._slide(Direction.PREV);
+        }
+      };
+
+      _proto.pause = function pause(event) {
+        if (!event) {
+          this._isPaused = true;
+        }
+
+        if (this._element.querySelector(Selector.NEXT_PREV)) {
+          Util.triggerTransitionEnd(this._element);
+          this.cycle(true);
+        }
+
+        clearInterval(this._interval);
+        this._interval = null;
+      };
+
+      _proto.cycle = function cycle(event) {
+        if (!event) {
+          this._isPaused = false;
+        }
+
+        if (this._interval) {
+          clearInterval(this._interval);
+          this._interval = null;
+        }
+
+        if (this._config.interval && !this._isPaused) {
+          this._interval = setInterval((document.visibilityState ? this.nextWhenVisible : this.next).bind(this), this._config.interval);
+        }
+      };
+
+      _proto.to = function to(index) {
+        var _this = this;
+
+        this._activeElement = this._element.querySelector(Selector.ACTIVE_ITEM);
+
+        var activeIndex = this._getItemIndex(this._activeElement);
+
+        if (index > this._items.length - 1 || index < 0) {
+          return;
+        }
+
+        if (this._isSliding) {
+          $$$1(this._element).one(Event.SLID, function () {
+            return _this.to(index);
+          });
+          return;
+        }
+
+        if (activeIndex === index) {
+          this.pause();
+          this.cycle();
+          return;
+        }
+
+        var direction = index > activeIndex ? Direction.NEXT : Direction.PREV;
+
+        this._slide(direction, this._items[index]);
+      };
+
+      _proto.dispose = function dispose() {
+        $$$1(this._element).off(EVENT_KEY);
+        $$$1.removeData(this._element, DATA_KEY);
+        this._items = null;
+        this._config = null;
+        this._element = null;
+        this._interval = null;
+        this._isPaused = null;
+        this._isSliding = null;
+        this._activeElement = null;
+        this._indicatorsElement = null;
+      }; // Private
+
+
+      _proto._getConfig = function _getConfig(config) {
+        config = _objectSpread({}, Default, config);
+        Util.typeCheckConfig(NAME, config, DefaultType);
+        return config;
+      };
+
+      _proto._addEventListeners = function _addEventListeners() {
+        var _this2 = this;
+
+        if (this._config.keyboard) {
+          $$$1(this._element).on(Event.KEYDOWN, function (event) {
+            return _this2._keydown(event);
+          });
+        }
+
+        if (this._config.pause === 'hover') {
+          $$$1(this._element).on(Event.MOUSEENTER, function (event) {
+            return _this2.pause(event);
+          }).on(Event.MOUSELEAVE, function (event) {
+            return _this2.cycle(event);
+          });
+
+          if ('ontouchstart' in document.documentElement) {
+            // If it's a touch-enabled device, mouseenter/leave are fired as
+            // part of the mouse compatibility events on first tap - the carousel
+            // would stop cycling until user tapped out of it;
+            // here, we listen for touchend, explicitly pause the carousel
+            // (as if it's the second time we tap on it, mouseenter compat event
+            // is NOT fired) and after a timeout (to allow for mouse compatibility
+            // events to fire) we explicitly restart cycling
+            $$$1(this._element).on(Event.TOUCHEND, function () {
+              _this2.pause();
+
+              if (_this2.touchTimeout) {
+                clearTimeout(_this2.touchTimeout);
+              }
+
+              _this2.touchTimeout = setTimeout(function (event) {
+                return _this2.cycle(event);
+              }, TOUCHEVENT_COMPAT_WAIT + _this2._config.interval);
+            });
+          }
+        }
+      };
+
+      _proto._keydown = function _keydown(event) {
+        if (/input|textarea/i.test(event.target.tagName)) {
+          return;
+        }
+
+        switch (event.which) {
+          case ARROW_LEFT_KEYCODE:
+            event.preventDefault();
+            this.prev();
+            break;
+
+          case ARROW_RIGHT_KEYCODE:
+            event.preventDefault();
+            this.next();
+            break;
+
+          default:
+        }
+      };
+
+      _proto._getItemIndex = function _getItemIndex(element) {
+        this._items = element && element.parentNode ? [].slice.call(element.parentNode.querySelectorAll(Selector.ITEM)) : [];
+        return this._items.indexOf(element);
+      };
+
+      _proto._getItemByDirection = function _getItemByDirection(direction, activeElement) {
+        var isNextDirection = direction === Direction.NEXT;
+        var isPrevDirection = direction === Direction.PREV;
+
+        var activeIndex = this._getItemIndex(activeElement);
+
+        var lastItemIndex = this._items.length - 1;
+        var isGoingToWrap = isPrevDirection && activeIndex === 0 || isNextDirection && activeIndex === lastItemIndex;
+
+        if (isGoingToWrap && !this._config.wrap) {
+          return activeElement;
+        }
+
+        var delta = direction === Direction.PREV ? -1 : 1;
+        var itemIndex = (activeIndex + delta) % this._items.length;
+        return itemIndex === -1 ? this._items[this._items.length - 1] : this._items[itemIndex];
+      };
+
+      _proto._triggerSlideEvent = function _triggerSlideEvent(relatedTarget, eventDirectionName) {
+        var targetIndex = this._getItemIndex(relatedTarget);
+
+        var fromIndex = this._getItemIndex(this._element.querySelector(Selector.ACTIVE_ITEM));
+
+        var slideEvent = $$$1.Event(Event.SLIDE, {
+          relatedTarget: relatedTarget,
+          direction: eventDirectionName,
+          from: fromIndex,
+          to: targetIndex
+        });
+        $$$1(this._element).trigger(slideEvent);
+        return slideEvent;
+      };
+
+      _proto._setActiveIndicatorElement = function _setActiveIndicatorElement(element) {
+        if (this._indicatorsElement) {
+          var indicators = [].slice.call(this._indicatorsElement.querySelectorAll(Selector.ACTIVE));
+          $$$1(indicators).removeClass(ClassName.ACTIVE);
+
+          var nextIndicator = this._indicatorsElement.children[this._getItemIndex(element)];
+
+          if (nextIndicator) {
+            $$$1(nextIndicator).addClass(ClassName.ACTIVE);
+          }
+        }
+      };
+
+      _proto._slide = function _slide(direction, element) {
+        var _this3 = this;
+
+        var activeElement = this._element.querySelector(Selector.ACTIVE_ITEM);
+
+        var activeElementIndex = this._getItemIndex(activeElement);
+
+        var nextElement = element || activeElement && this._getItemByDirection(direction, activeElement);
+
+        var nextElementIndex = this._getItemIndex(nextElement);
+
+        var isCycling = Boolean(this._interval);
+        var directionalClassName;
+        var orderClassName;
+        var eventDirectionName;
+
+        if (direction === Direction.NEXT) {
+          directionalClassName = ClassName.LEFT;
+          orderClassName = ClassName.NEXT;
+          eventDirectionName = Direction.LEFT;
+        } else {
+          directionalClassName = ClassName.RIGHT;
+          orderClassName = ClassName.PREV;
+          eventDirectionName = Direction.RIGHT;
+        }
+
+        if (nextElement && $$$1(nextElement).hasClass(ClassName.ACTIVE)) {
+          this._isSliding = false;
+          return;
+        }
+
+        var slideEvent = this._triggerSlideEvent(nextElement, eventDirectionName);
+
+        if (slideEvent.isDefaultPrevented()) {
+          return;
+        }
+
+        if (!activeElement || !nextElement) {
+          // Some weirdness is happening, so we bail
+          return;
+        }
+
+        this._isSliding = true;
+
+        if (isCycling) {
+          this.pause();
+        }
+
+        this._setActiveIndicatorElement(nextElement);
+
+        var slidEvent = $$$1.Event(Event.SLID, {
+          relatedTarget: nextElement,
+          direction: eventDirectionName,
+          from: activeElementIndex,
+          to: nextElementIndex
+        });
+
+        if ($$$1(this._element).hasClass(ClassName.SLIDE)) {
+          $$$1(nextElement).addClass(orderClassName);
+          Util.reflow(nextElement);
+          $$$1(activeElement).addClass(directionalClassName);
+          $$$1(nextElement).addClass(directionalClassName);
+          var transitionDuration = Util.getTransitionDurationFromElement(activeElement);
+          $$$1(activeElement).one(Util.TRANSITION_END, function () {
+            $$$1(nextElement).removeClass(directionalClassName + " " + orderClassName).addClass(ClassName.ACTIVE);
+            $$$1(activeElement).removeClass(ClassName.ACTIVE + " " + orderClassName + " " + directionalClassName);
+            _this3._isSliding = false;
+            setTimeout(function () {
+              return $$$1(_this3._element).trigger(slidEvent);
+            }, 0);
+          }).emulateTransitionEnd(transitionDuration);
+        } else {
+          $$$1(activeElement).removeClass(ClassName.ACTIVE);
+          $$$1(nextElement).addClass(ClassName.ACTIVE);
+          this._isSliding = false;
+          $$$1(this._element).trigger(slidEvent);
+        }
+
+        if (isCycling) {
+          this.cycle();
+        }
+      }; // Static
+
+
+      Carousel._jQueryInterface = function _jQueryInterface(config) {
+        return this.each(function () {
+          var data = $$$1(this).data(DATA_KEY);
+
+          var _config = _objectSpread({}, Default, $$$1(this).data());
+
+          if (typeof config === 'object') {
+            _config = _objectSpread({}, _config, config);
+          }
+
+          var action = typeof config === 'string' ? config : _config.slide;
+
+          if (!data) {
+            data = new Carousel(this, _config);
+            $$$1(this).data(DATA_KEY, data);
+          }
+
+          if (typeof config === 'number') {
+            data.to(config);
+          } else if (typeof action === 'string') {
+            if (typeof data[action] === 'undefined') {
+              throw new TypeError("No method named \"" + action + "\"");
+            }
+
+            data[action]();
+          } else if (_config.interval) {
+            data.pause();
+            data.cycle();
+          }
+        });
+      };
+
+      Carousel._dataApiClickHandler = function _dataApiClickHandler(event) {
+        var selector = Util.getSelectorFromElement(this);
+
+        if (!selector) {
+          return;
+        }
+
+        var target = $$$1(selector)[0];
+
+        if (!target || !$$$1(target).hasClass(ClassName.CAROUSEL)) {
+          return;
+        }
+
+        var config = _objectSpread({}, $$$1(target).data(), $$$1(this).data());
+
+        var slideIndex = this.getAttribute('data-slide-to');
+
+        if (slideIndex) {
+          config.interval = false;
+        }
+
+        Carousel._jQueryInterface.call($$$1(target), config);
+
+        if (slideIndex) {
+          $$$1(target).data(DATA_KEY).to(slideIndex);
+        }
+
+        event.preventDefault();
+      };
+
+      _createClass(Carousel, null, [{
+        key: "VERSION",
+        get: function get() {
+          return VERSION;
+        }
+      }, {
+        key: "Default",
+        get: function get() {
+          return Default;
+        }
+      }]);
+
+      return Carousel;
+    }();
+    /**
+     * ------------------------------------------------------------------------
+     * Data Api implementation
+     * ------------------------------------------------------------------------
+     */
+
+
+    $$$1(document).on(Event.CLICK_DATA_API, Selector.DATA_SLIDE, Carousel._dataApiClickHandler);
+    $$$1(window).on(Event.LOAD_DATA_API, function () {
+      var carousels = [].slice.call(document.querySelectorAll(Selector.DATA_RIDE));
+
+      for (var i = 0, len = carousels.length; i < len; i++) {
+        var $carousel = $$$1(carousels[i]);
+
+        Carousel._jQueryInterface.call($carousel, $carousel.data());
+      }
+    });
+    /**
+     * ------------------------------------------------------------------------
+     * jQuery
+     * ------------------------------------------------------------------------
+     */
+
+    $$$1.fn[NAME] = Carousel._jQueryInterface;
+    $$$1.fn[NAME].Constructor = Carousel;
+
+    $$$1.fn[NAME].noConflict = function () {
+      $$$1.fn[NAME] = JQUERY_NO_CONFLICT;
+      return Carousel._jQueryInterface;
+    };
+
+    return Carousel;
+  }($);
+
+  /**
+   * --------------------------------------------------------------------------
+   * Bootstrap (v4.1.3): collapse.js
+   * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE)
+   * --------------------------------------------------------------------------
+   */
+
+  var Collapse = function ($$$1) {
+    /**
+     * ------------------------------------------------------------------------
+     * Constants
+     * ------------------------------------------------------------------------
+     */
+    var NAME = 'collapse';
+    var VERSION = '4.1.3';
+    var DATA_KEY = 'bs.collapse';
+    var EVENT_KEY = "." + DATA_KEY;
+    var DATA_API_KEY = '.data-api';
+    var JQUERY_NO_CONFLICT = $$$1.fn[NAME];
+    var Default = {
+      toggle: true,
+      parent: ''
+    };
+    var DefaultType = {
+      toggle: 'boolean',
+      parent: '(string|element)'
+    };
+    var Event = {
+      SHOW: "show" + EVENT_KEY,
+      SHOWN: "shown" + EVENT_KEY,
+      HIDE: "hide" + EVENT_KEY,
+      HIDDEN: "hidden" + EVENT_KEY,
+      CLICK_DATA_API: "click" + EVENT_KEY + DATA_API_KEY
+    };
+    var ClassName = {
+      SHOW: 'show',
+      COLLAPSE: 'collapse',
+      COLLAPSING: 'collapsing',
+      COLLAPSED: 'collapsed'
+    };
+    var Dimension = {
+      WIDTH: 'width',
+      HEIGHT: 'height'
+    };
+    var Selector = {
+      ACTIVES: '.show, .collapsing',
+      DATA_TOGGLE: '[data-toggle="collapse"]'
+      /**
+       * ------------------------------------------------------------------------
+       * Class Definition
+       * ------------------------------------------------------------------------
+       */
+
+    };
+
+    var Collapse =
+    /*#__PURE__*/
+    function () {
+      function Collapse(element, config) {
+        this._isTransitioning = false;
+        this._element = element;
+        this._config = this._getConfig(config);
+        this._triggerArray = $$$1.makeArray(document.querySelectorAll("[data-toggle=\"collapse\"][href=\"#" + element.id + "\"]," + ("[data-toggle=\"collapse\"][data-target=\"#" + element.id + "\"]")));
+        var toggleList = [].slice.call(document.querySelectorAll(Selector.DATA_TOGGLE));
+
+        for (var i = 0, len = toggleList.length; i < len; i++) {
+          var elem = toggleList[i];
+          var selector = Util.getSelectorFromElement(elem);
+          var filterElement = [].slice.call(document.querySelectorAll(selector)).filter(function (foundElem) {
+            return foundElem === element;
+          });
+
+          if (selector !== null && filterElement.length > 0) {
+            this._selector = selector;
+
+            this._triggerArray.push(elem);
+          }
+        }
+
+        this._parent = this._config.parent ? this._getParent() : null;
+
+        if (!this._config.parent) {
+          this._addAriaAndCollapsedClass(this._element, this._triggerArray);
+        }
+
+        if (this._config.toggle) {
+          this.toggle();
+        }
+      } // Getters
+
+
+      var _proto = Collapse.prototype;
+
+      // Public
+      _proto.toggle = function toggle() {
+        if ($$$1(this._element).hasClass(ClassName.SHOW)) {
+          this.hide();
+        } else {
+          this.show();
+        }
+      };
+
+      _proto.show = function show() {
+        var _this = this;
+
+        if (this._isTransitioning || $$$1(this._element).hasClass(ClassName.SHOW)) {
+          return;
+        }
+
+        var actives;
+        var activesData;
+
+        if (this._parent) {
+          actives = [].slice.call(this._parent.querySelectorAll(Selector.ACTIVES)).filter(function (elem) {
+            return elem.getAttribute('data-parent') === _this._config.parent;
+          });
+
+          if (actives.length === 0) {
+            actives = null;
+          }
+        }
+
+        if (actives) {
+          activesData = $$$1(actives).not(this._selector).data(DATA_KEY);
+
+          if (activesData && activesData._isTransitioning) {
+            return;
+          }
+        }
+
+        var startEvent = $$$1.Event(Event.SHOW);
+        $$$1(this._element).trigger(startEvent);
+
+        if (startEvent.isDefaultPrevented()) {
+          return;
+        }
+
+        if (actives) {
+          Collapse._jQueryInterface.call($$$1(actives).not(this._selector), 'hide');
+
+          if (!activesData) {
+            $$$1(actives).data(DATA_KEY, null);
+          }
+        }
+
+        var dimension = this._getDimension();
+
+        $$$1(this._element).removeClass(ClassName.COLLAPSE).addClass(ClassName.COLLAPSING);
+        this._element.style[dimension] = 0;
+
+        if (this._triggerArray.length) {
+          $$$1(this._triggerArray).removeClass(ClassName.COLLAPSED).attr('aria-expanded', true);
+        }
+
+        this.setTransitioning(true);
+
+        var complete = function complete() {
+          $$$1(_this._element).removeClass(ClassName.COLLAPSING).addClass(ClassName.COLLAPSE).addClass(ClassName.SHOW);
+          _this._element.style[dimension] = '';
+
+          _this.setTransitioning(false);
+
+          $$$1(_this._element).trigger(Event.SHOWN);
+        };
+
+        var capitalizedDimension = dimension[0].toUpperCase() + dimension.slice(1);
+        var scrollSize = "scroll" + capitalizedDimension;
+        var transitionDuration = Util.getTransitionDurationFromElement(this._element);
+        $$$1(this._element).one(Util.TRANSITION_END, complete).emulateTransitionEnd(transitionDuration);
+        this._element.style[dimension] = this._element[scrollSize] + "px";
+      };
+
+      _proto.hide = function hide() {
+        var _this2 = this;
+
+        if (this._isTransitioning || !$$$1(this._element).hasClass(ClassName.SHOW)) {
+          return;
+        }
+
+        var startEvent = $$$1.Event(Event.HIDE);
+        $$$1(this._element).trigger(startEvent);
+
+        if (startEvent.isDefaultPrevented()) {
+          return;
+        }
+
+        var dimension = this._getDimension();
+
+        this._element.style[dimension] = this._element.getBoundingClientRect()[dimension] + "px";
+        Util.reflow(this._element);
+        $$$1(this._element).addClass(ClassName.COLLAPSING).removeClass(ClassName.COLLAPSE).removeClass(ClassName.SHOW);
+        var triggerArrayLength = this._triggerArray.length;
+
+        if (triggerArrayLength > 0) {
+          for (var i = 0; i < triggerArrayLength; i++) {
+            var trigger = this._triggerArray[i];
+            var selector = Util.getSelectorFromElement(trigger);
+
+            if (selector !== null) {
+              var $elem = $$$1([].slice.call(document.querySelectorAll(selector)));
+
+              if (!$elem.hasClass(ClassName.SHOW)) {
+                $$$1(trigger).addClass(ClassName.COLLAPSED).attr('aria-expanded', false);
+              }
+            }
+          }
+        }
+
+        this.setTransitioning(true);
+
+        var complete = function complete() {
+          _this2.setTransitioning(false);
+
+          $$$1(_this2._element).removeClass(ClassName.COLLAPSING).addClass(ClassName.COLLAPSE).trigger(Event.HIDDEN);
+        };
+
+        this._element.style[dimension] = '';
+        var transitionDuration = Util.getTransitionDurationFromElement(this._element);
+        $$$1(this._element).one(Util.TRANSITION_END, complete).emulateTransitionEnd(transitionDuration);
+      };
+
+      _proto.setTransitioning = function setTransitioning(isTransitioning) {
+        this._isTransitioning = isTransitioning;
+      };
+
+      _proto.dispose = function dispose() {
+        $$$1.removeData(this._element, DATA_KEY);
+        this._config = null;
+        this._parent = null;
+        this._element = null;
+        this._triggerArray = null;
+        this._isTransitioning = null;
+      }; // Private
+
+
+      _proto._getConfig = function _getConfig(config) {
+        config = _objectSpread({}, Default, config);
+        config.toggle = Boolean(config.toggle); // Coerce string values
+
+        Util.typeCheckConfig(NAME, config, DefaultType);
+        return config;
+      };
+
+      _proto._getDimension = function _getDimension() {
+        var hasWidth = $$$1(this._element).hasClass(Dimension.WIDTH);
+        return hasWidth ? Dimension.WIDTH : Dimension.HEIGHT;
+      };
+
+      _proto._getParent = function _getParent() {
+        var _this3 = this;
+
+        var parent = null;
+
+        if (Util.isElement(this._config.parent)) {
+          parent = this._config.parent; // It's a jQuery object
+
+          if (typeof this._config.parent.jquery !== 'undefined') {
+            parent = this._config.parent[0];
+          }
+        } else {
+          parent = document.querySelector(this._config.parent);
+        }
+
+        var selector = "[data-toggle=\"collapse\"][data-parent=\"" + this._config.parent + "\"]";
+        var children = [].slice.call(parent.querySelectorAll(selector));
+        $$$1(children).each(function (i, element) {
+          _this3._addAriaAndCollapsedClass(Collapse._getTargetFromElement(element), [element]);
+        });
+        return parent;
+      };
+
+      _proto._addAriaAndCollapsedClass = function _addAriaAndCollapsedClass(element, triggerArray) {
+        if (element) {
+          var isOpen = $$$1(element).hasClass(ClassName.SHOW);
+
+          if (triggerArray.length) {
+            $$$1(triggerArray).toggleClass(ClassName.COLLAPSED, !isOpen).attr('aria-expanded', isOpen);
+          }
+        }
+      }; // Static
+
+
+      Collapse._getTargetFromElement = function _getTargetFromElement(element) {
+        var selector = Util.getSelectorFromElement(element);
+        return selector ? document.querySelector(selector) : null;
+      };
+
+      Collapse._jQueryInterface = function _jQueryInterface(config) {
+        return this.each(function () {
+          var $this = $$$1(this);
+          var data = $this.data(DATA_KEY);
+
+          var _config = _objectSpread({}, Default, $this.data(), typeof config === 'object' && config ? config : {});
+
+          if (!data && _config.toggle && /show|hide/.test(config)) {
+            _config.toggle = false;
+          }
+
+          if (!data) {
+            data = new Collapse(this, _config);
+            $this.data(DATA_KEY, data);
+          }
+
+          if (typeof config === 'string') {
+            if (typeof data[config] === 'undefined') {
+              throw new TypeError("No method named \"" + config + "\"");
+            }
+
+            data[config]();
+          }
+        });
+      };
+
+      _createClass(Collapse, null, [{
+        key: "VERSION",
+        get: function get() {
+          return VERSION;
+        }
+      }, {
+        key: "Default",
+        get: function get() {
+          return Default;
+        }
+      }]);
+
+      return Collapse;
+    }();
+    /**
+     * ------------------------------------------------------------------------
+     * Data Api implementation
+     * ------------------------------------------------------------------------
+     */
+
+
+    $$$1(document).on(Event.CLICK_DATA_API, Selector.DATA_TOGGLE, function (event) {
+      // preventDefault only for <a> elements (which change the URL) not inside the collapsible element
+      if (event.currentTarget.tagName === 'A') {
+        event.preventDefault();
+      }
+
+      var $trigger = $$$1(this);
+      var selector = Util.getSelectorFromElement(this);
+      var selectors = [].slice.call(document.querySelectorAll(selector));
+      $$$1(selectors).each(function () {
+        var $target = $$$1(this);
+        var data = $target.data(DATA_KEY);
+        var config = data ? 'toggle' : $trigger.data();
+
+        Collapse._jQueryInterface.call($target, config);
+      });
+    });
+    /**
+     * ------------------------------------------------------------------------
+     * jQuery
+     * ------------------------------------------------------------------------
+     */
+
+    $$$1.fn[NAME] = Collapse._jQueryInterface;
+    $$$1.fn[NAME].Constructor = Collapse;
+
+    $$$1.fn[NAME].noConflict = function () {
+      $$$1.fn[NAME] = JQUERY_NO_CONFLICT;
+      return Collapse._jQueryInterface;
+    };
+
+    return Collapse;
+  }($);
+
+  /**!
+   * @fileOverview Kickass library to create and place poppers near their reference elements.
+   * @version 1.14.3
+   * @license
+   * Copyright (c) 2016 Federico Zivolo and contributors
+   *
+   * Permission is hereby granted, free of charge, to any person obtaining a copy
+   * of this software and associated documentation files (the "Software"), to deal
+   * in the Software without restriction, including without limitation the rights
+   * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+   * copies of the Software, and to permit persons to whom the Software is
+   * furnished to do so, subject to the following conditions:
+   *
+   * The above copyright notice and this permission notice shall be included in all
+   * copies or substantial portions of the Software.
+   *
+   * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+   * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+   * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+   * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+   * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+   * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+   * SOFTWARE.
+   */
+  var isBrowser = typeof window !== 'undefined' && typeof document !== 'undefined';
+
+  var longerTimeoutBrowsers = ['Edge', 'Trident', 'Firefox'];
+  var timeoutDuration = 0;
+  for (var i = 0; i < longerTimeoutBrowsers.length; i += 1) {
+    if (isBrowser && navigator.userAgent.indexOf(longerTimeoutBrowsers[i]) >= 0) {
+      timeoutDuration = 1;
+      break;
+    }
+  }
+
+  function microtaskDebounce(fn) {
+    var called = false;
+    return function () {
+      if (called) {
+        return;
+      }
+      called = true;
+      window.Promise.resolve().then(function () {
+        called = false;
+        fn();
+      });
+    };
+  }
+
+  function taskDebounce(fn) {
+    var scheduled = false;
+    return function () {
+      if (!scheduled) {
+        scheduled = true;
+        setTimeout(function () {
+          scheduled = false;
+          fn();
+        }, timeoutDuration);
+      }
+    };
+  }
+
+  var supportsMicroTasks = isBrowser && window.Promise;
+
+  /**
+  * Create a debounced version of a method, that's asynchronously deferred
+  * but called in the minimum time possible.
+  *
+  * @method
+  * @memberof Popper.Utils
+  * @argument {Function} fn
+  * @returns {Function}
+  */
+  var debounce = supportsMicroTasks ? microtaskDebounce : taskDebounce;
+
+  /**
+   * Check if the given variable is a function
+   * @method
+   * @memberof Popper.Utils
+   * @argument {Any} functionToCheck - variable to check
+   * @returns {Boolean} answer to: is a function?
+   */
+  function isFunction(functionToCheck) {
+    var getType = {};
+    return functionToCheck && getType.toString.call(functionToCheck) === '[object Function]';
+  }
+
+  /**
+   * Get CSS computed property of the given element
+   * @method
+   * @memberof Popper.Utils
+   * @argument {Eement} element
+   * @argument {String} property
+   */
+  function getStyleComputedProperty(element, property) {
+    if (element.nodeType !== 1) {
+      return [];
+    }
+    // NOTE: 1 DOM access here
+    var css = getComputedStyle(element, null);
+    return property ? css[property] : css;
+  }
+
+  /**
+   * Returns the parentNode or the host of the element
+   * @method
+   * @memberof Popper.Utils
+   * @argument {Element} element
+   * @returns {Element} parent
+   */
+  function getParentNode(element) {
+    if (element.nodeName === 'HTML') {
+      return element;
+    }
+    return element.parentNode || element.host;
+  }
+
+  /**
+   * Returns the scrolling parent of the given element
+   * @method
+   * @memberof Popper.Utils
+   * @argument {Element} element
+   * @returns {Element} scroll parent
+   */
+  function getScrollParent(element) {
+    // Return body, `getScroll` will take care to get the correct `scrollTop` from it
+    if (!element) {
+      return document.body;
+    }
+
+    switch (element.nodeName) {
+      case 'HTML':
+      case 'BODY':
+        return element.ownerDocument.body;
+      case '#document':
+        return element.body;
+    }
+
+    // Firefox want us to check `-x` and `-y` variations as well
+
+    var _getStyleComputedProp = getStyleComputedProperty(element),
+        overflow = _getStyleComputedProp.overflow,
+        overflowX = _getStyleComputedProp.overflowX,
+        overflowY = _getStyleComputedProp.overflowY;
+
+    if (/(auto|scroll|overlay)/.test(overflow + overflowY + overflowX)) {
+      return element;
+    }
+
+    return getScrollParent(getParentNode(element));
+  }
+
+  var isIE11 = isBrowser && !!(window.MSInputMethodContext && document.documentMode);
+  var isIE10 = isBrowser && /MSIE 10/.test(navigator.userAgent);
+
+  /**
+   * Determines if the browser is Internet Explorer
+   * @method
+   * @memberof Popper.Utils
+   * @param {Number} version to check
+   * @returns {Boolean} isIE
+   */
+  function isIE(version) {
+    if (version === 11) {
+      return isIE11;
+    }
+    if (version === 10) {
+      return isIE10;
+    }
+    return isIE11 || isIE10;
+  }
+
+  /**
+   * Returns the offset parent of the given element
+   * @method
+   * @memberof Popper.Utils
+   * @argument {Element} element
+   * @returns {Element} offset parent
+   */
+  function getOffsetParent(element) {
+    if (!element) {
+      return document.documentElement;
+    }
+
+    var noOffsetParent = isIE(10) ? document.body : null;
+
+    // NOTE: 1 DOM access here
+    var offsetParent = element.offsetParent;
+    // Skip hidden elements which don't have an offsetParent
+    while (offsetParent === noOffsetParent && element.nextElementSibling) {
+      offsetParent = (element = element.nextElementSibling).offsetParent;
+    }
+
+    var nodeName = offsetParent && offsetParent.nodeName;
+
+    if (!nodeName || nodeName === 'BODY' || nodeName === 'HTML') {
+      return element ? element.ownerDocument.documentElement : document.documentElement;
+    }
+
+    // .offsetParent will return the closest TD or TABLE in case
+    // no offsetParent is present, I hate this job...
+    if (['TD', 'TABLE'].indexOf(offsetParent.nodeName) !== -1 && getStyleComputedProperty(offsetParent, 'position') === 'static') {
+      return getOffsetParent(offsetParent);
+    }
+
+    return offsetParent;
+  }
+
+  function isOffsetContainer(element) {
+    var nodeName = element.nodeName;
+
+    if (nodeName === 'BODY') {
+      return false;
+    }
+    return nodeName === 'HTML' || getOffsetParent(element.firstElementChild) === element;
+  }
+
+  /**
+   * Finds the root node (document, shadowDOM root) of the given element
+   * @method
+   * @memberof Popper.Utils
+   * @argument {Element} node
+   * @returns {Element} root node
+   */
+  function getRoot(node) {
+    if (node.parentNode !== null) {
+      return getRoot(node.parentNode);
+    }
+
+    return node;
+  }
+
+  /**
+   * Finds the offset parent common to the two provided nodes
+   * @method
+   * @memberof Popper.Utils
+   * @argument {Element} element1
+   * @argument {Element} element2
+   * @returns {Element} common offset parent
+   */
+  function findCommonOffsetParent(element1, element2) {
+    // This check is needed to avoid errors in case one of the elements isn't defined for any reason
+    if (!element1 || !element1.nodeType || !element2 || !element2.nodeType) {
+      return document.documentElement;
+    }
+
+    // Here we make sure to give as "start" the element that comes first in the DOM
+    var order = element1.compareDocumentPosition(element2) & Node.DOCUMENT_POSITION_FOLLOWING;
+    var start = order ? element1 : element2;
+    var end = order ? element2 : element1;
+
+    // Get common ancestor container
+    var range = document.createRange();
+    range.setStart(start, 0);
+    range.setEnd(end, 0);
+    var commonAncestorContainer = range.commonAncestorContainer;
+
+    // Both nodes are inside #document
+
+    if (element1 !== commonAncestorContainer && element2 !== commonAncestorContainer || start.contains(end)) {
+      if (isOffsetContainer(commonAncestorContainer)) {
+        return commonAncestorContainer;
+      }
+
+      return getOffsetParent(commonAncestorContainer);
+    }
+
+    // one of the nodes is inside shadowDOM, find which one
+    var element1root = getRoot(element1);
+    if (element1root.host) {
+      return findCommonOffsetParent(element1root.host, element2);
+    } else {
+      return findCommonOffsetParent(element1, getRoot(element2).host);
+    }
+  }
+
+  /**
+   * Gets the scroll value of the given element in the given side (top and left)
+   * @method
+   * @memberof Popper.Utils
+   * @argument {Element} element
+   * @argument {String} side `top` or `left`
+   * @returns {number} amount of scrolled pixels
+   */
+  function getScroll(element) {
+    var side = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : 'top';
+
+    var upperSide = side === 'top' ? 'scrollTop' : 'scrollLeft';
+    var nodeName = element.nodeName;
+
+    if (nodeName === 'BODY' || nodeName === 'HTML') {
+      var html = element.ownerDocument.documentElement;
+      var scrollingElement = element.ownerDocument.scrollingElement || html;
+      return scrollingElement[upperSide];
+    }
+
+    return element[upperSide];
+  }
+
+  /*
+   * Sum or subtract the element scroll values (left and top) from a given rect object
+   * @method
+   * @memberof Popper.Utils
+   * @param {Object} rect - Rect object you want to change
+   * @param {HTMLElement} element - The element from the function reads the scroll values
+   * @param {Boolean} subtract - set to true if you want to subtract the scroll values
+   * @return {Object} rect - The modifier rect object
+   */
+  function includeScroll(rect, element) {
+    var subtract = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : false;
+
+    var scrollTop = getScroll(element, 'top');
+    var scrollLeft = getScroll(element, 'left');
+    var modifier = subtract ? -1 : 1;
+    rect.top += scrollTop * modifier;
+    rect.bottom += scrollTop * modifier;
+    rect.left += scrollLeft * modifier;
+    rect.right += scrollLeft * modifier;
+    return rect;
+  }
+
+  /*
+   * Helper to detect borders of a given element
+   * @method
+   * @memberof Popper.Utils
+   * @param {CSSStyleDeclaration} styles
+   * Result of `getStyleComputedProperty` on the given element
+   * @param {String} axis - `x` or `y`
+   * @return {number} borders - The borders size of the given axis
+   */
+
+  function getBordersSize(styles, axis) {
+    var sideA = axis === 'x' ? 'Left' : 'Top';
+    var sideB = sideA === 'Left' ? 'Right' : 'Bottom';
+
+    return parseFloat(styles['border' + sideA + 'Width'], 10) + parseFloat(styles['border' + sideB + 'Width'], 10);
+  }
+
+  function getSize(axis, body, html, computedStyle) {
+    return Math.max(body['offset' + axis], body['scroll' + axis], html['client' + axis], html['offset' + axis], html['scroll' + axis], isIE(10) ? html['offset' + axis] + computedStyle['margin' + (axis === 'Height' ? 'Top' : 'Left')] + computedStyle['margin' + (axis === 'Height' ? 'Bottom' : 'Right')] : 0);
+  }
+
+  function getWindowSizes() {
+    var body = document.body;
+    var html = document.documentElement;
+    var computedStyle = isIE(10) && getComputedStyle(html);
+
+    return {
+      height: getSize('Height', body, html, computedStyle),
+      width: getSize('Width', body, html, computedStyle)
+    };
+  }
+
+  var classCallCheck = function (instance, Constructor) {
+    if (!(instance instanceof Constructor)) {
+      throw new TypeError("Cannot call a class as a function");
+    }
+  };
+
+  var createClass = function () {
+    function defineProperties(target, props) {
+      for (var i = 0; i < props.length; i++) {
+        var descriptor = props[i];
+        descriptor.enumerable = descriptor.enumerable || false;
+        descriptor.configurable = true;
+        if ("value" in descriptor) descriptor.writable = true;
+        Object.defineProperty(target, descriptor.key, descriptor);
+      }
+    }
+
+    return function (Constructor, protoProps, staticProps) {
+      if (protoProps) defineProperties(Constructor.prototype, protoProps);
+      if (staticProps) defineProperties(Constructor, staticProps);
+      return Constructor;
+    };
+  }();
+
+
+
+
+
+  var defineProperty = function (obj, key, value) {
+    if (key in obj) {
+      Object.defineProperty(obj, key, {
+        value: value,
+        enumerable: true,
+        configurable: true,
+        writable: true
+      });
+    } else {
+      obj[key] = value;
+    }
+
+    return obj;
+  };
+
+  var _extends = Object.assign || function (target) {
+    for (var i = 1; i < arguments.length; i++) {
+      var source = arguments[i];
+
+      for (var key in source) {
+        if (Object.prototype.hasOwnProperty.call(source, key)) {
+          target[key] = source[key];
+        }
+      }
+    }
+
+    return target;
+  };
+
+  /**
+   * Given element offsets, generate an output similar to getBoundingClientRect
+   * @method
+   * @memberof Popper.Utils
+   * @argument {Object} offsets
+   * @returns {Object} ClientRect like output
+   */
+  function getClientRect(offsets) {
+    return _extends({}, offsets, {
+      right: offsets.left + offsets.width,
+      bottom: offsets.top + offsets.height
+    });
+  }
+
+  /**
+   * Get bounding client rect of given element
+   * @method
+   * @memberof Popper.Utils
+   * @param {HTMLElement} element
+   * @return {Object} client rect
+   */
+  function getBoundingClientRect(element) {
+    var rect = {};
+
+    // IE10 10 FIX: Please, don't ask, the element isn't
+    // considered in DOM in some circumstances...
+    // This isn't reproducible in IE10 compatibility mode of IE11
+    try {
+      if (isIE(10)) {
+        rect = element.getBoundingClientRect();
+        var scrollTop = getScroll(element, 'top');
+        var scrollLeft = getScroll(element, 'left');
+        rect.top += scrollTop;
+        rect.left += scrollLeft;
+        rect.bottom += scrollTop;
+        rect.right += scrollLeft;
+      } else {
+        rect = element.getBoundingClientRect();
+      }
+    } catch (e) {}
+
+    var result = {
+      left: rect.left,
+      top: rect.top,
+      width: rect.right - rect.left,
+      height: rect.bottom - rect.top
+    };
+
+    // subtract scrollbar size from sizes
+    var sizes = element.nodeName === 'HTML' ? getWindowSizes() : {};
+    var width = sizes.width || element.clientWidth || result.right - result.left;
+    var height = sizes.height || element.clientHeight || result.bottom - result.top;
+
+    var horizScrollbar = element.offsetWidth - width;
+    var vertScrollbar = element.offsetHeight - height;
+
+    // if an hypothetical scrollbar is detected, we must be sure it's not a `border`
+    // we make this check conditional for performance reasons
+    if (horizScrollbar || vertScrollbar) {
+      var styles = getStyleComputedProperty(element);
+      horizScrollbar -= getBordersSize(styles, 'x');
+      vertScrollbar -= getBordersSize(styles, 'y');
+
+      result.width -= horizScrollbar;
+      result.height -= vertScrollbar;
+    }
+
+    return getClientRect(result);
+  }
+
+  function getOffsetRectRelativeToArbitraryNode(children, parent) {
+    var fixedPosition = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : false;
+
+    var isIE10 = isIE(10);
+    var isHTML = parent.nodeName === 'HTML';
+    var childrenRect = getBoundingClientRect(children);
+    var parentRect = getBoundingClientRect(parent);
+    var scrollParent = getScrollParent(children);
+
+    var styles = getStyleComputedProperty(parent);
+    var borderTopWidth = parseFloat(styles.borderTopWidth, 10);
+    var borderLeftWidth = parseFloat(styles.borderLeftWidth, 10);
+
+    // In cases where the parent is fixed, we must ignore negative scroll in offset calc
+    if (fixedPosition && parent.nodeName === 'HTML') {
+      parentRect.top = Math.max(parentRect.top, 0);
+      parentRect.left = Math.max(parentRect.left, 0);
+    }
+    var offsets = getClientRect({
+      top: childrenRect.top - parentRect.top - borderTopWidth,
+      left: childrenRect.left - parentRect.left - borderLeftWidth,
+      width: childrenRect.width,
+      height: childrenRect.height
+    });
+    offsets.marginTop = 0;
+    offsets.marginLeft = 0;
+
+    // Subtract margins of documentElement in case it's being used as parent
+    // we do this only on HTML because it's the only element that behaves
+    // differently when margins are applied to it. The margins are included in
+    // the box of the documentElement, in the other cases not.
+    if (!isIE10 && isHTML) {
+      var marginTop = parseFloat(styles.marginTop, 10);
+      var marginLeft = parseFloat(styles.marginLeft, 10);
+
+      offsets.top -= borderTopWidth - marginTop;
+      offsets.bottom -= borderTopWidth - marginTop;
+      offsets.left -= borderLeftWidth - marginLeft;
+      offsets.right -= borderLeftWidth - marginLeft;
+
+      // Attach marginTop and marginLeft because in some circumstances we may need them
+      offsets.marginTop = marginTop;
+      offsets.marginLeft = marginLeft;
+    }
+
+    if (isIE10 && !fixedPosition ? parent.contains(scrollParent) : parent === scrollParent && scrollParent.nodeName !== 'BODY') {
+      offsets = includeScroll(offsets, parent);
+    }
+
+    return offsets;
+  }
+
+  function getViewportOffsetRectRelativeToArtbitraryNode(element) {
+    var excludeScroll = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : false;
+
+    var html = element.ownerDocument.documentElement;
+    var relativeOffset = getOffsetRectRelativeToArbitraryNode(element, html);
+    var width = Math.max(html.clientWidth, window.innerWidth || 0);
+    var height = Math.max(html.clientHeight, window.innerHeight || 0);
+
+    var scrollTop = !excludeScroll ? getScroll(html) : 0;
+    var scrollLeft = !excludeScroll ? getScroll(html, 'left') : 0;
+
+    var offset = {
+      top: scrollTop - relativeOffset.top + relativeOffset.marginTop,
+      left: scrollLeft - relativeOffset.left + relativeOffset.marginLeft,
+      width: width,
+      height: height
+    };
+
+    return getClientRect(offset);
+  }
+
+  /**
+   * Check if the given element is fixed or is inside a fixed parent
+   * @method
+   * @memberof Popper.Utils
+   * @argument {Element} element
+   * @argument {Element} customContainer
+   * @returns {Boolean} answer to "isFixed?"
+   */
+  function isFixed(element) {
+    var nodeName = element.nodeName;
+    if (nodeName === 'BODY' || nodeName === 'HTML') {
+      return false;
+    }
+    if (getStyleComputedProperty(element, 'position') === 'fixed') {
+      return true;
+    }
+    return isFixed(getParentNode(element));
+  }
+
+  /**
+   * Finds the first parent of an element that has a transformed property defined
+   * @method
+   * @memberof Popper.Utils
+   * @argument {Element} element
+   * @returns {Element} first transformed parent or documentElement
+   */
+
+  function getFixedPositionOffsetParent(element) {
+    // This check is needed to avoid errors in case one of the elements isn't defined for any reason
+    if (!element || !element.parentElement || isIE()) {
+      return document.documentElement;
+    }
+    var el = element.parentElement;
+    while (el && getStyleComputedProperty(el, 'transform') === 'none') {
+      el = el.parentElement;
+    }
+    return el || document.documentElement;
+  }
+
+  /**
+   * Computed the boundaries limits and return them
+   * @method
+   * @memberof Popper.Utils
+   * @param {HTMLElement} popper
+   * @param {HTMLElement} reference
+   * @param {number} padding
+   * @param {HTMLElement} boundariesElement - Element used to define the boundaries
+   * @param {Boolean} fixedPosition - Is in fixed position mode
+   * @returns {Object} Coordinates of the boundaries
+   */
+  function getBoundaries(popper, reference, padding, boundariesElement) {
+    var fixedPosition = arguments.length > 4 && arguments[4] !== undefined ? arguments[4] : false;
+
+    // NOTE: 1 DOM access here
+
+    var boundaries = { top: 0, left: 0 };
+    var offsetParent = fixedPosition ? getFixedPositionOffsetParent(popper) : findCommonOffsetParent(popper, reference);
+
+    // Handle viewport case
+    if (boundariesElement === 'viewport') {
+      boundaries = getViewportOffsetRectRelativeToArtbitraryNode(offsetParent, fixedPosition);
+    } else {
+      // Handle other cases based on DOM element used as boundaries
+      var boundariesNode = void 0;
+      if (boundariesElement === 'scrollParent') {
+        boundariesNode = getScrollParent(getParentNode(reference));
+        if (boundariesNode.nodeName === 'BODY') {
+          boundariesNode = popper.ownerDocument.documentElement;
+        }
+      } else if (boundariesElement === 'window') {
+        boundariesNode = popper.ownerDocument.documentElement;
+      } else {
+        boundariesNode = boundariesElement;
+      }
+
+      var offsets = getOffsetRectRelativeToArbitraryNode(boundariesNode, offsetParent, fixedPosition);
+
+      // In case of HTML, we need a different computation
+      if (boundariesNode.nodeName === 'HTML' && !isFixed(offsetParent)) {
+        var _getWindowSizes = getWindowSizes(),
+            height = _getWindowSizes.height,
+            width = _getWindowSizes.width;
+
+        boundaries.top += offsets.top - offsets.marginTop;
+        boundaries.bottom = height + offsets.top;
+        boundaries.left += offsets.left - offsets.marginLeft;
+        boundaries.right = width + offsets.left;
+      } else {
+        // for all the other DOM elements, this one is good
+        boundaries = offsets;
+      }
+    }
+
+    // Add paddings
+    boundaries.left += padding;
+    boundaries.top += padding;
+    boundaries.right -= padding;
+    boundaries.bottom -= padding;
+
+    return boundaries;
+  }
+
+  function getArea(_ref) {
+    var width = _ref.width,
+        height = _ref.height;
+
+    return width * height;
+  }
+
+  /**
+   * Utility used to transform the `auto` placement to the placement with more
+   * available space.
+   * @method
+   * @memberof Popper.Utils
+   * @argument {Object} data - The data object generated by update method
+   * @argument {Object} options - Modifiers configuration and options
+   * @returns {Object} The data object, properly modified
+   */
+  function computeAutoPlacement(placement, refRect, popper, reference, boundariesElement) {
+    var padding = arguments.length > 5 && arguments[5] !== undefined ? arguments[5] : 0;
+
+    if (placement.indexOf('auto') === -1) {
+      return placement;
+    }
+
+    var boundaries = getBoundaries(popper, reference, padding, boundariesElement);
+
+    var rects = {
+      top: {
+        width: boundaries.width,
+        height: refRect.top - boundaries.top
+      },
+      right: {
+        width: boundaries.right - refRect.right,
+        height: boundaries.height
+      },
+      bottom: {
+        width: boundaries.width,
+        height: boundaries.bottom - refRect.bottom
+      },
+      left: {
+        width: refRect.left - boundaries.left,
+        height: boundaries.height
+      }
+    };
+
+    var sortedAreas = Object.keys(rects).map(function (key) {
+      return _extends({
+        key: key
+      }, rects[key], {
+        area: getArea(rects[key])
+      });
+    }).sort(function (a, b) {
+      return b.area - a.area;
+    });
+
+    var filteredAreas = sortedAreas.filter(function (_ref2) {
+      var width = _ref2.width,
+          height = _ref2.height;
+      return width >= popper.clientWidth && height >= popper.clientHeight;
+    });
+
+    var computedPlacement = filteredAreas.length > 0 ? filteredAreas[0].key : sortedAreas[0].key;
+
+    var variation = placement.split('-')[1];
+
+    return computedPlacement + (variation ? '-' + variation : '');
+  }
+
+  /**
+   * Get offsets to the reference element
+   * @method
+   * @memberof Popper.Utils
+   * @param {Object} state
+   * @param {Element} popper - the popper element
+   * @param {Element} reference - the reference element (the popper will be relative to this)
+   * @param {Element} fixedPosition - is in fixed position mode
+   * @returns {Object} An object containing the offsets which will be applied to the popper
+   */
+  function getReferenceOffsets(state, popper, reference) {
+    var fixedPosition = arguments.length > 3 && arguments[3] !== undefined ? arguments[3] : null;
+
+    var commonOffsetParent = fixedPosition ? getFixedPositionOffsetParent(popper) : findCommonOffsetParent(popper, reference);
+    return getOffsetRectRelativeToArbitraryNode(reference, commonOffsetParent, fixedPosition);
+  }
+
+  /**
+   * Get the outer sizes of the given element (offset size + margins)
+   * @method
+   * @memberof Popper.Utils
+   * @argument {Element} element
+   * @returns {Object} object containing width and height properties
+   */
+  function getOuterSizes(element) {
+    var styles = getComputedStyle(element);
+    var x = parseFloat(styles.marginTop) + parseFloat(styles.marginBottom);
+    var y = parseFloat(styles.marginLeft) + parseFloat(styles.marginRight);
+    var result = {
+      width: element.offsetWidth + y,
+      height: element.offsetHeight + x
+    };
+    return result;
+  }
+
+  /**
+   * Get the opposite placement of the given one
+   * @method
+   * @memberof Popper.Utils
+   * @argument {String} placement
+   * @returns {String} flipped placement
+   */
+  function getOppositePlacement(placement) {
+    var hash = { left: 'right', right: 'left', bottom: 'top', top: 'bottom' };
+    return placement.replace(/left|right|bottom|top/g, function (matched) {
+      return hash[matched];
+    });
+  }
+
+  /**
+   * Get offsets to the popper
+   * @method
+   * @memberof Popper.Utils
+   * @param {Object} position - CSS position the Popper will get applied
+   * @param {HTMLElement} popper - the popper element
+   * @param {Object} referenceOffsets - the reference offsets (the popper will be relative to this)
+   * @param {String} placement - one of the valid placement options
+   * @returns {Object} popperOffsets - An object containing the offsets which will be applied to the popper
+   */
+  function getPopperOffsets(popper, referenceOffsets, placement) {
+    placement = placement.split('-')[0];
+
+    // Get popper node sizes
+    var popperRect = getOuterSizes(popper);
+
+    // Add position, width and height to our offsets object
+    var popperOffsets = {
+      width: popperRect.width,
+      height: popperRect.height
+    };
+
+    // depending by the popper placement we have to compute its offsets slightly differently
+    var isHoriz = ['right', 'left'].indexOf(placement) !== -1;
+    var mainSide = isHoriz ? 'top' : 'left';
+    var secondarySide = isHoriz ? 'left' : 'top';
+    var measurement = isHoriz ? 'height' : 'width';
+    var secondaryMeasurement = !isHoriz ? 'height' : 'width';
+
+    popperOffsets[mainSide] = referenceOffsets[mainSide] + referenceOffsets[measurement] / 2 - popperRect[measurement] / 2;
+    if (placement === secondarySide) {
+      popperOffsets[secondarySide] = referenceOffsets[secondarySide] - popperRect[secondaryMeasurement];
+    } else {
+      popperOffsets[secondarySide] = referenceOffsets[getOppositePlacement(secondarySide)];
+    }
+
+    return popperOffsets;
+  }
+
+  /**
+   * Mimics the `find` method of Array
+   * @method
+   * @memberof Popper.Utils
+   * @argument {Array} arr
+   * @argument prop
+   * @argument value
+   * @returns index or -1
+   */
+  function find(arr, check) {
+    // use native find if supported
+    if (Array.prototype.find) {
+      return arr.find(check);
+    }
+
+    // use `filter` to obtain the same behavior of `find`
+    return arr.filter(check)[0];
+  }
+
+  /**
+   * Return the index of the matching object
+   * @method
+   * @memberof Popper.Utils
+   * @argument {Array} arr
+   * @argument prop
+   * @argument value
+   * @returns index or -1
+   */
+  function findIndex(arr, prop, value) {
+    // use native findIndex if supported
+    if (Array.prototype.findIndex) {
+      return arr.findIndex(function (cur) {
+        return cur[prop] === value;
+      });
+    }
+
+    // use `find` + `indexOf` if `findIndex` isn't supported
+    var match = find(arr, function (obj) {
+      return obj[prop] === value;
+    });
+    return arr.indexOf(match);
+  }
+
+  /**
+   * Loop trough the list of modifiers and run them in order,
+   * each of them will then edit the data object.
+   * @method
+   * @memberof Popper.Utils
+   * @param {dataObject} data
+   * @param {Array} modifiers
+   * @param {String} ends - Optional modifier name used as stopper
+   * @returns {dataObject}
+   */
+  function runModifiers(modifiers, data, ends) {
+    var modifiersToRun = ends === undefined ? modifiers : modifiers.slice(0, findIndex(modifiers, 'name', ends));
+
+    modifiersToRun.forEach(function (modifier) {
+      if (modifier['function']) {
+        // eslint-disable-line dot-notation
+        console.warn('`modifier.function` is deprecated, use `modifier.fn`!');
+      }
+      var fn = modifier['function'] || modifier.fn; // eslint-disable-line dot-notation
+      if (modifier.enabled && isFunction(fn)) {
+        // Add properties to offsets to make them a complete clientRect object
+        // we do this before each modifier to make sure the previous one doesn't
+        // mess with these values
+        data.offsets.popper = getClientRect(data.offsets.popper);
+        data.offsets.reference = getClientRect(data.offsets.reference);
+
+        data = fn(data, modifier);
+      }
+    });
+
+    return data;
+  }
+
+  /**
+   * Updates the position of the popper, computing the new offsets and applying
+   * the new style.<br />
+   * Prefer `scheduleUpdate` over `update` because of performance reasons.
+   * @method
+   * @memberof Popper
+   */
+  function update() {
+    // if popper is destroyed, don't perform any further update
+    if (this.state.isDestroyed) {
+      return;
+    }
+
+    var data = {
+      instance: this,
+      styles: {},
+      arrowStyles: {},
+      attributes: {},
+      flipped: false,
+      offsets: {}
+    };
+
+    // compute reference element offsets
+    data.offsets.reference = getReferenceOffsets(this.state, this.popper, this.reference, this.options.positionFixed);
+
+    // compute auto placement, store placement inside the data object,
+    // modifiers will be able to edit `placement` if needed
+    // and refer to originalPlacement to know the original value
+    data.placement = computeAutoPlacement(this.options.placement, data.offsets.reference, this.popper, this.reference, this.options.modifiers.flip.boundariesElement, this.options.modifiers.flip.padding);
+
+    // store the computed placement inside `originalPlacement`
+    data.originalPlacement = data.placement;
+
+    data.positionFixed = this.options.positionFixed;
+
+    // compute the popper offsets
+    data.offsets.popper = getPopperOffsets(this.popper, data.offsets.reference, data.placement);
+
+    data.offsets.popper.position = this.options.positionFixed ? 'fixed' : 'absolute';
+
+    // run the modifiers
+    data = runModifiers(this.modifiers, data);
+
+    // the first `update` will call `onCreate` callback
+    // the other ones will call `onUpdate` callback
+    if (!this.state.isCreated) {
+      this.state.isCreated = true;
+      this.options.onCreate(data);
+    } else {
+      this.options.onUpdate(data);
+    }
+  }
+
+  /**
+   * Helper used to know if the given modifier is enabled.
+   * @method
+   * @memberof Popper.Utils
+   * @returns {Boolean}
+   */
+  function isModifierEnabled(modifiers, modifierName) {
+    return modifiers.some(function (_ref) {
+      var name = _ref.name,
+          enabled = _ref.enabled;
+      return enabled && name === modifierName;
+    });
+  }
+
+  /**
+   * Get the prefixed supported property name
+   * @method
+   * @memberof Popper.Utils
+   * @argument {String} property (camelCase)
+   * @returns {String} prefixed property (camelCase or PascalCase, depending on the vendor prefix)
+   */
+  function getSupportedPropertyName(property) {
+    var prefixes = [false, 'ms', 'Webkit', 'Moz', 'O'];
+    var upperProp = property.charAt(0).toUpperCase() + property.slice(1);
+
+    for (var i = 0; i < prefixes.length; i++) {
+      var prefix = prefixes[i];
+      var toCheck = prefix ? '' + prefix + upperProp : property;
+      if (typeof document.body.style[toCheck] !== 'undefined') {
+        return toCheck;
+      }
+    }
+    return null;
+  }
+
+  /**
+   * Destroy the popper
+   * @method
+   * @memberof Popper
+   */
+  function destroy() {
+    this.state.isDestroyed = true;
+
+    // touch DOM only if `applyStyle` modifier is enabled
+    if (isModifierEnabled(this.modifiers, 'applyStyle')) {
+      this.popper.removeAttribute('x-placement');
+      this.popper.style.position = '';
+      this.popper.style.top = '';
+      this.popper.style.left = '';
+      this.popper.style.right = '';
+      this.popper.style.bottom = '';
+      this.popper.style.willChange = '';
+      this.popper.style[getSupportedPropertyName('transform')] = '';
+    }
+
+    this.disableEventListeners();
+
+    // remove the popper if user explicity asked for the deletion on destroy
+    // do not use `remove` because IE11 doesn't support it
+    if (this.options.removeOnDestroy) {
+      this.popper.parentNode.removeChild(this.popper);
+    }
+    return this;
+  }
+
+  /**
+   * Get the window associated with the element
+   * @argument {Element} element
+   * @returns {Window}
+   */
+  function getWindow(element) {
+    var ownerDocument = element.ownerDocument;
+    return ownerDocument ? ownerDocument.defaultView : window;
+  }
+
+  function attachToScrollParents(scrollParent, event, callback, scrollParents) {
+    var isBody = scrollParent.nodeName === 'BODY';
+    var target = isBody ? scrollParent.ownerDocument.defaultView : scrollParent;
+    target.addEventListener(event, callback, { passive: true });
+
+    if (!isBody) {
+      attachToScrollParents(getScrollParent(target.parentNode), event, callback, scrollParents);
+    }
+    scrollParents.push(target);
+  }
+
+  /**
+   * Setup needed event listeners used to update the popper position
+   * @method
+   * @memberof Popper.Utils
+   * @private
+   */
+  function setupEventListeners(reference, options, state, updateBound) {
+    // Resize event listener on window
+    state.updateBound = updateBound;
+    getWindow(reference).addEventListener('resize', state.updateBound, { passive: true });
+
+    // Scroll event listener on scroll parents
+    var scrollElement = getScrollParent(reference);
+    attachToScrollParents(scrollElement, 'scroll', state.updateBound, state.scrollParents);
+    state.scrollElement = scrollElement;
+    state.eventsEnabled = true;
+
+    return state;
+  }
+
+  /**
+   * It will add resize/scroll events and start recalculating
+   * position of the popper element when they are triggered.
+   * @method
+   * @memberof Popper
+   */
+  function enableEventListeners() {
+    if (!this.state.eventsEnabled) {
+      this.state = setupEventListeners(this.reference, this.options, this.state, this.scheduleUpdate);
+    }
+  }
+
+  /**
+   * Remove event listeners used to update the popper position
+   * @method
+   * @memberof Popper.Utils
+   * @private
+   */
+  function removeEventListeners(reference, state) {
+    // Remove resize event listener on window
+    getWindow(reference).removeEventListener('resize', state.updateBound);
+
+    // Remove scroll event listener on scroll parents
+    state.scrollParents.forEach(function (target) {
+      target.removeEventListener('scroll', state.updateBound);
+    });
+
+    // Reset state
+    state.updateBound = null;
+    state.scrollParents = [];
+    state.scrollElement = null;
+    state.eventsEnabled = false;
+    return state;
+  }
+
+  /**
+   * It will remove resize/scroll events and won't recalculate popper position
+   * when they are triggered. It also won't trigger onUpdate callback anymore,
+   * unless you call `update` method manually.
+   * @method
+   * @memberof Popper
+   */
+  function disableEventListeners() {
+    if (this.state.eventsEnabled) {
+      cancelAnimationFrame(this.scheduleUpdate);
+      this.state = removeEventListeners(this.reference, this.state);
+    }
+  }
+
+  /**
+   * Tells if a given input is a number
+   * @method
+   * @memberof Popper.Utils
+   * @param {*} input to check
+   * @return {Boolean}
+   */
+  function isNumeric(n) {
+    return n !== '' && !isNaN(parseFloat(n)) && isFinite(n);
+  }
+
+  /**
+   * Set the style to the given popper
+   * @method
+   * @memberof Popper.Utils
+   * @argument {Element} element - Element to apply the style to
+   * @argument {Object} styles
+   * Object with a list of properties and values which will be applied to the element
+   */
+  function setStyles(element, styles) {
+    Object.keys(styles).forEach(function (prop) {
+      var unit = '';
+      // add unit if the value is numeric and is one of the following
+      if (['width', 'height', 'top', 'right', 'bottom', 'left'].indexOf(prop) !== -1 && isNumeric(styles[prop])) {
+        unit = 'px';
+      }
+      element.style[prop] = styles[prop] + unit;
+    });
+  }
+
+  /**
+   * Set the attributes to the given popper
+   * @method
+   * @memberof Popper.Utils
+   * @argument {Element} element - Element to apply the attributes to
+   * @argument {Object} styles
+   * Object with a list of properties and values which will be applied to the element
+   */
+  function setAttributes(element, attributes) {
+    Object.keys(attributes).forEach(function (prop) {
+      var value = attributes[prop];
+      if (value !== false) {
+        element.setAttribute(prop, attributes[prop]);
+      } else {
+        element.removeAttribute(prop);
+      }
+    });
+  }
+
+  /**
+   * @function
+   * @memberof Modifiers
+   * @argument {Object} data - The data object generated by `update` method
+   * @argument {Object} data.styles - List of style properties - values to apply to popper element
+   * @argument {Object} data.attributes - List of attribute properties - values to apply to popper element
+   * @argument {Object} options - Modifiers configuration and options
+   * @returns {Object} The same data object
+   */
+  function applyStyle(data) {
+    // any property present in `data.styles` will be applied to the popper,
+    // in this way we can make the 3rd party modifiers add custom styles to it
+    // Be aware, modifiers could override the properties defined in the previous
+    // lines of this modifier!
+    setStyles(data.instance.popper, data.styles);
+
+    // any property present in `data.attributes` will be applied to the popper,
+    // they will be set as HTML attributes of the element
+    setAttributes(data.instance.popper, data.attributes);
+
+    // if arrowElement is defined and arrowStyles has some properties
+    if (data.arrowElement && Object.keys(data.arrowStyles).length) {
+      setStyles(data.arrowElement, data.arrowStyles);
+    }
+
+    return data;
+  }
+
+  /**
+   * Set the x-placement attribute before everything else because it could be used
+   * to add margins to the popper margins needs to be calculated to get the
+   * correct popper offsets.
+   * @method
+   * @memberof Popper.modifiers
+   * @param {HTMLElement} reference - The reference element used to position the popper
+   * @param {HTMLElement} popper - The HTML element used as popper
+   * @param {Object} options - Popper.js options
+   */
+  function applyStyleOnLoad(reference, popper, options, modifierOptions, state) {
+    // compute reference element offsets
+    var referenceOffsets = getReferenceOffsets(state, popper, reference, options.positionFixed);
+
+    // compute auto placement, store placement inside the data object,
+    // modifiers will be able to edit `placement` if needed
+    // and refer to originalPlacement to know the original value
+    var placement = computeAutoPlacement(options.placement, referenceOffsets, popper, reference, options.modifiers.flip.boundariesElement, options.modifiers.flip.padding);
+
+    popper.setAttribute('x-placement', placement);
+
+    // Apply `position` to popper before anything else because
+    // without the position applied we can't guarantee correct computations
+    setStyles(popper, { position: options.positionFixed ? 'fixed' : 'absolute' });
+
+    return options;
+  }
+
+  /**
+   * @function
+   * @memberof Modifiers
+   * @argument {Object} data - The data object generated by `update` method
+   * @argument {Object} options - Modifiers configuration and options
+   * @returns {Object} The data object, properly modified
+   */
+  function computeStyle(data, options) {
+    var x = options.x,
+        y = options.y;
+    var popper = data.offsets.popper;
+
+    // Remove this legacy support in Popper.js v2
+
+    var legacyGpuAccelerationOption = find(data.instance.modifiers, function (modifier) {
+      return modifier.name === 'applyStyle';
+    }).gpuAcceleration;
+    if (legacyGpuAccelerationOption !== undefined) {
+      console.warn('WARNING: `gpuAcceleration` option moved to `computeStyle` modifier and will not be supported in future versions of Popper.js!');
+    }
+    var gpuAcceleration = legacyGpuAccelerationOption !== undefined ? legacyGpuAccelerationOption : options.gpuAcceleration;
+
+    var offsetParent = getOffsetParent(data.instance.popper);
+    var offsetParentRect = getBoundingClientRect(offsetParent);
+
+    // Styles
+    var styles = {
+      position: popper.position
+    };
+
+    // Avoid blurry text by using full pixel integers.
+    // For pixel-perfect positioning, top/bottom prefers rounded
+    // values, while left/right prefers floored values.
+    var offsets = {
+      left: Math.floor(popper.left),
+      top: Math.round(popper.top),
+      bottom: Math.round(popper.bottom),
+      right: Math.floor(popper.right)
+    };
+
+    var sideA = x === 'bottom' ? 'top' : 'bottom';
+    var sideB = y === 'right' ? 'left' : 'right';
+
+    // if gpuAcceleration is set to `true` and transform is supported,
+    //  we use `translate3d` to apply the position to the popper we
+    // automatically use the supported prefixed version if needed
+    var prefixedProperty = getSupportedPropertyName('transform');
+
+    // now, let's make a step back and look at this code closely (wtf?)
+    // If the content of the popper grows once it's been positioned, it
+    // may happen that the popper gets misplaced because of the new content
+    // overflowing its reference element
+    // To avoid this problem, we provide two options (x and y), which allow
+    // the consumer to define the offset origin.
+    // If we position a popper on top of a reference element, we can set
+    // `x` to `top` to make the popper grow towards its top instead of
+    // its bottom.
+    var left = void 0,
+        top = void 0;
+    if (sideA === 'bottom') {
+      top = -offsetParentRect.height + offsets.bottom;
+    } else {
+      top = offsets.top;
+    }
+    if (sideB === 'right') {
+      left = -offsetParentRect.width + offsets.right;
+    } else {
+      left = offsets.left;
+    }
+    if (gpuAcceleration && prefixedProperty) {
+      styles[prefixedProperty] = 'translate3d(' + left + 'px, ' + top + 'px, 0)';
+      styles[sideA] = 0;
+      styles[sideB] = 0;
+      styles.willChange = 'transform';
+    } else {
+      // othwerise, we use the standard `top`, `left`, `bottom` and `right` properties
+      var invertTop = sideA === 'bottom' ? -1 : 1;
+      var invertLeft = sideB === 'right' ? -1 : 1;
+      styles[sideA] = top * invertTop;
+      styles[sideB] = left * invertLeft;
+      styles.willChange = sideA + ', ' + sideB;
+    }
+
+    // Attributes
+    var attributes = {
+      'x-placement': data.placement
+    };
+
+    // Update `data` attributes, styles and arrowStyles
+    data.attributes = _extends({}, attributes, data.attributes);
+    data.styles = _extends({}, styles, data.styles);
+    data.arrowStyles = _extends({}, data.offsets.arrow, data.arrowStyles);
+
+    return data;
+  }
+
+  /**
+   * Helper used to know if the given modifier depends from another one.<br />
+   * It checks if the needed modifier is listed and enabled.
+   * @method
+   * @memberof Popper.Utils
+   * @param {Array} modifiers - list of modifiers
+   * @param {String} requestingName - name of requesting modifier
+   * @param {String} requestedName - name of requested modifier
+   * @returns {Boolean}
+   */
+  function isModifierRequired(modifiers, requestingName, requestedName) {
+    var requesting = find(modifiers, function (_ref) {
+      var name = _ref.name;
+      return name === requestingName;
+    });
+
+    var isRequired = !!requesting && modifiers.some(function (modifier) {
+      return modifier.name === requestedName && modifier.enabled && modifier.order < requesting.order;
+    });
+
+    if (!isRequired) {
+      var _requesting = '`' + requestingName + '`';
+      var requested = '`' + requestedName + '`';
+      console.warn(requested + ' modifier is required by ' + _requesting + ' modifier in order to work, be sure to include it before ' + _requesting + '!');
+    }
+    return isRequired;
+  }
+
+  /**
+   * @function
+   * @memberof Modifiers
+   * @argument {Object} data - The data object generated by update method
+   * @argument {Object} options - Modifiers configuration and options
+   * @returns {Object} The data object, properly modified
+   */
+  function arrow(data, options) {
+    var _data$offsets$arrow;
+
+    // arrow depends on keepTogether in order to work
+    if (!isModifierRequired(data.instance.modifiers, 'arrow', 'keepTogether')) {
+      return data;
+    }
+
+    var arrowElement = options.element;
+
+    // if arrowElement is a string, suppose it's a CSS selector
+    if (typeof arrowElement === 'string') {
+      arrowElement = data.instance.popper.querySelector(arrowElement);
+
+      // if arrowElement is not found, don't run the modifier
+      if (!arrowElement) {
+        return data;
+      }
+    } else {
+      // if the arrowElement isn't a query selector we must check that the
+      // provided DOM node is child of its popper node
+      if (!data.instance.popper.contains(arrowElement)) {
+        console.warn('WARNING: `arrow.element` must be child of its popper element!');
+        return data;
+      }
+    }
+
+    var placement = data.placement.split('-')[0];
+    var _data$offsets = data.offsets,
+        popper = _data$offsets.popper,
+        reference = _data$offsets.reference;
+
+    var isVertical = ['left', 'right'].indexOf(placement) !== -1;
+
+    var len = isVertical ? 'height' : 'width';
+    var sideCapitalized = isVertical ? 'Top' : 'Left';
+    var side = sideCapitalized.toLowerCase();
+    var altSide = isVertical ? 'left' : 'top';
+    var opSide = isVertical ? 'bottom' : 'right';
+    var arrowElementSize = getOuterSizes(arrowElement)[len];
+
+    //
+    // extends keepTogether behavior making sure the popper and its
+    // reference have enough pixels in conjuction
+    //
+
+    // top/left side
+    if (reference[opSide] - arrowElementSize < popper[side]) {
+      data.offsets.popper[side] -= popper[side] - (reference[opSide] - arrowElementSize);
+    }
+    // bottom/right side
+    if (reference[side] + arrowElementSize > popper[opSide]) {
+      data.offsets.popper[side] += reference[side] + arrowElementSize - popper[opSide];
+    }
+    data.offsets.popper = getClientRect(data.offsets.popper);
+
+    // compute center of the popper
+    var center = reference[side] + reference[len] / 2 - arrowElementSize / 2;
+
+    // Compute the sideValue using the updated popper offsets
+    // take popper margin in account because we don't have this info available
+    var css = getStyleComputedProperty(data.instance.popper);
+    var popperMarginSide = parseFloat(css['margin' + sideCapitalized], 10);
+    var popperBorderSide = parseFloat(css['border' + sideCapitalized + 'Width'], 10);
+    var sideValue = center - data.offsets.popper[side] - popperMarginSide - popperBorderSide;
+
+    // prevent arrowElement from being placed not contiguously to its popper
+    sideValue = Math.max(Math.min(popper[len] - arrowElementSize, sideValue), 0);
+
+    data.arrowElement = arrowElement;
+    data.offsets.arrow = (_data$offsets$arrow = {}, defineProperty(_data$offsets$arrow, side, Math.round(sideValue)), defineProperty(_data$offsets$arrow, altSide, ''), _data$offsets$arrow);
+
+    return data;
+  }
+
+  /**
+   * Get the opposite placement variation of the given one
+   * @method
+   * @memberof Popper.Utils
+   * @argument {String} placement variation
+   * @returns {String} flipped placement variation
+   */
+  function getOppositeVariation(variation) {
+    if (variation === 'end') {
+      return 'start';
+    } else if (variation === 'start') {
+      return 'end';
+    }
+    return variation;
+  }
+
+  /**
+   * List of accepted placements to use as values of the `placement` option.<br />
+   * Valid placements are:
+   * - `auto`
+   * - `top`
+   * - `right`
+   * - `bottom`
+   * - `left`
+   *
+   * Each placement can have a variation from this list:
+   * - `-start`
+   * - `-end`
+   *
+   * Variations are interpreted easily if you think of them as the left to right
+   * written languages. Horizontally (`top` and `bottom`), `start` is left and `end`
+   * is right.<br />
+   * Vertically (`left` and `right`), `start` is top and `end` is bottom.
+   *
+   * Some valid examples are:
+   * - `top-end` (on top of reference, right aligned)
+   * - `right-start` (on right of reference, top aligned)
+   * - `bottom` (on bottom, centered)
+   * - `auto-right` (on the side with more space available, alignment depends by placement)
+   *
+   * @static
+   * @type {Array}
+   * @enum {String}
+   * @readonly
+   * @method placements
+   * @memberof Popper
+   */
+  var placements = ['auto-start', 'auto', 'auto-end', 'top-start', 'top', 'top-end', 'right-start', 'right', 'right-end', 'bottom-end', 'bottom', 'bottom-start', 'left-end', 'left', 'left-start'];
+
+  // Get rid of `auto` `auto-start` and `auto-end`
+  var validPlacements = placements.slice(3);
+
+  /**
+   * Given an initial placement, returns all the subsequent placements
+   * clockwise (or counter-clockwise).
+   *
+   * @method
+   * @memberof Popper.Utils
+   * @argument {String} placement - A valid placement (it accepts variations)
+   * @argument {Boolean} counter - Set to true to walk the placements counterclockwise
+   * @returns {Array} placements including their variations
+   */
+  function clockwise(placement) {
+    var counter = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : false;
+
+    var index = validPlacements.indexOf(placement);
+    var arr = validPlacements.slice(index + 1).concat(validPlacements.slice(0, index));
+    return counter ? arr.reverse() : arr;
+  }
+
+  var BEHAVIORS = {
+    FLIP: 'flip',
+    CLOCKWISE: 'clockwise',
+    COUNTERCLOCKWISE: 'counterclockwise'
+  };
+
+  /**
+   * @function
+   * @memberof Modifiers
+   * @argument {Object} data - The data object generated by update method
+   * @argument {Object} options - Modifiers configuration and options
+   * @returns {Object} The data object, properly modified
+   */
+  function flip(data, options) {
+    // if `inner` modifier is enabled, we can't use the `flip` modifier
+    if (isModifierEnabled(data.instance.modifiers, 'inner')) {
+      return data;
+    }
+
+    if (data.flipped && data.placement === data.originalPlacement) {
+      // seems like flip is trying to loop, probably there's not enough space on any of the flippable sides
+      return data;
+    }
+
+    var boundaries = getBoundaries(data.instance.popper, data.instance.reference, options.padding, options.boundariesElement, data.positionFixed);
+
+    var placement = data.placement.split('-')[0];
+    var placementOpposite = getOppositePlacement(placement);
+    var variation = data.placement.split('-')[1] || '';
+
+    var flipOrder = [];
+
+    switch (options.behavior) {
+      case BEHAVIORS.FLIP:
+        flipOrder = [placement, placementOpposite];
+        break;
+      case BEHAVIORS.CLOCKWISE:
+        flipOrder = clockwise(placement);
+        break;
+      case BEHAVIORS.COUNTERCLOCKWISE:
+        flipOrder = clockwise(placement, true);
+        break;
+      default:
+        flipOrder = options.behavior;
+    }
+
+    flipOrder.forEach(function (step, index) {
+      if (placement !== step || flipOrder.length === index + 1) {
+        return data;
+      }
+
+      placement = data.placement.split('-')[0];
+      placementOpposite = getOppositePlacement(placement);
+
+      var popperOffsets = data.offsets.popper;
+      var refOffsets = data.offsets.reference;
+
+      // using floor because the reference offsets may contain decimals we are not going to consider here
+      var floor = Math.floor;
+      var overlapsRef = placement === 'left' && floor(popperOffsets.right) > floor(refOffsets.left) || placement === 'right' && floor(popperOffsets.left) < floor(refOffsets.right) || placement === 'top' && floor(popperOffsets.bottom) > floor(refOffsets.top) || placement === 'bottom' && floor(popperOffsets.top) < floor(refOffsets.bottom);
+
+      var overflowsLeft = floor(popperOffsets.left) < floor(boundaries.left);
+      var overflowsRight = floor(popperOffsets.right) > floor(boundaries.right);
+      var overflowsTop = floor(popperOffsets.top) < floor(boundaries.top);
+      var overflowsBottom = floor(popperOffsets.bottom) > floor(boundaries.bottom);
+
+      var overflowsBoundaries = placement === 'left' && overflowsLeft || placement === 'right' && overflowsRight || placement === 'top' && overflowsTop || placement === 'bottom' && overflowsBottom;
+
+      // flip the variation if required
+      var isVertical = ['top', 'bottom'].indexOf(placement) !== -1;
+      var flippedVariation = !!options.flipVariations && (isVertical && variation === 'start' && overflowsLeft || isVertical && variation === 'end' && overflowsRight || !isVertical && variation === 'start' && overflowsTop || !isVertical && variation === 'end' && overflowsBottom);
+
+      if (overlapsRef || overflowsBoundaries || flippedVariation) {
+        // this boolean to detect any flip loop
+        data.flipped = true;
+
+        if (overlapsRef || overflowsBoundaries) {
+          placement = flipOrder[index + 1];
+        }
+
+        if (flippedVariation) {
+          variation = getOppositeVariation(variation);
+        }
+
+        data.placement = placement + (variation ? '-' + variation : '');
+
+        // this object contains `position`, we want to preserve it along with
+        // any additional property we may add in the future
+        data.offsets.popper = _extends({}, data.offsets.popper, getPopperOffsets(data.instance.popper, data.offsets.reference, data.placement));
+
+        data = runModifiers(data.instance.modifiers, data, 'flip');
+      }
+    });
+    return data;
+  }
+
+  /**
+   * @function
+   * @memberof Modifiers
+   * @argument {Object} data - The data object generated by update method
+   * @argument {Object} options - Modifiers configuration and options
+   * @returns {Object} The data object, properly modified
+   */
+  function keepTogether(data) {
+    var _data$offsets = data.offsets,
+        popper = _data$offsets.popper,
+        reference = _data$offsets.reference;
+
+    var placement = data.placement.split('-')[0];
+    var floor = Math.floor;
+    var isVertical = ['top', 'bottom'].indexOf(placement) !== -1;
+    var side = isVertical ? 'right' : 'bottom';
+    var opSide = isVertical ? 'left' : 'top';
+    var measurement = isVertical ? 'width' : 'height';
+
+    if (popper[side] < floor(reference[opSide])) {
+      data.offsets.popper[opSide] = floor(reference[opSide]) - popper[measurement];
+    }
+    if (popper[opSide] > floor(reference[side])) {
+      data.offsets.popper[opSide] = floor(reference[side]);
+    }
+
+    return data;
+  }
+
+  /**
+   * Converts a string containing value + unit into a px value number
+   * @function
+   * @memberof {modifiers~offset}
+   * @private
+   * @argument {String} str - Value + unit string
+   * @argument {String} measurement - `height` or `width`
+   * @argument {Object} popperOffsets
+   * @argument {Object} referenceOffsets
+   * @returns {Number|String}
+   * Value in pixels, or original string if no values were extracted
+   */
+  function toValue(str, measurement, popperOffsets, referenceOffsets) {
+    // separate value from unit
+    var split = str.match(/((?:\-|\+)?\d*\.?\d*)(.*)/);
+    var value = +split[1];
+    var unit = split[2];
+
+    // If it's not a number it's an operator, I guess
+    if (!value) {
+      return str;
+    }
+
+    if (unit.indexOf('%') === 0) {
+      var element = void 0;
+      switch (unit) {
+        case '%p':
+          element = popperOffsets;
+          break;
+        case '%':
+        case '%r':
+        default:
+          element = referenceOffsets;
+      }
+
+      var rect = getClientRect(element);
+      return rect[measurement] / 100 * value;
+    } else if (unit === 'vh' || unit === 'vw') {
+      // if is a vh or vw, we calculate the size based on the viewport
+      var size = void 0;
+      if (unit === 'vh') {
+        size = Math.max(document.documentElement.clientHeight, window.innerHeight || 0);
+      } else {
+        size = Math.max(document.documentElement.clientWidth, window.innerWidth || 0);
+      }
+      return size / 100 * value;
+    } else {
+      // if is an explicit pixel unit, we get rid of the unit and keep the value
+      // if is an implicit unit, it's px, and we return just the value
+      return value;
+    }
+  }
+
+  /**
+   * Parse an `offset` string to extrapolate `x` and `y` numeric offsets.
+   * @function
+   * @memberof {modifiers~offset}
+   * @private
+   * @argument {String} offset
+   * @argument {Object} popperOffsets
+   * @argument {Object} referenceOffsets
+   * @argument {String} basePlacement
+   * @returns {Array} a two cells array with x and y offsets in numbers
+   */
+  function parseOffset(offset, popperOffsets, referenceOffsets, basePlacement) {
+    var offsets = [0, 0];
+
+    // Use height if placement is left or right and index is 0 otherwise use width
+    // in this way the first offset will use an axis and the second one
+    // will use the other one
+    var useHeight = ['right', 'left'].indexOf(basePlacement) !== -1;
+
+    // Split the offset string to obtain a list of values and operands
+    // The regex addresses values with the plus or minus sign in front (+10, -20, etc)
+    var fragments = offset.split(/(\+|\-)/).map(function (frag) {
+      return frag.trim();
+    });
+
+    // Detect if the offset string contains a pair of values or a single one
+    // they could be separated by comma or space
+    var divider = fragments.indexOf(find(fragments, function (frag) {
+      return frag.search(/,|\s/) !== -1;
+    }));
+
+    if (fragments[divider] && fragments[divider].indexOf(',') === -1) {
+      console.warn('Offsets separated by white space(s) are deprecated, use a comma (,) instead.');
+    }
+
+    // If divider is found, we divide the list of values and operands to divide
+    // them by ofset X and Y.
+    var splitRegex = /\s*,\s*|\s+/;
+    var ops = divider !== -1 ? [fragments.slice(0, divider).concat([fragments[divider].split(splitRegex)[0]]), [fragments[divider].split(splitRegex)[1]].concat(fragments.slice(divider + 1))] : [fragments];
+
+    // Convert the values with units to absolute pixels to allow our computations
+    ops = ops.map(function (op, index) {
+      // Most of the units rely on the orientation of the popper
+      var measurement = (index === 1 ? !useHeight : useHeight) ? 'height' : 'width';
+      var mergeWithPrevious = false;
+      return op
+      // This aggregates any `+` or `-` sign that aren't considered operators
+      // e.g.: 10 + +5 => [10, +, +5]
+      .reduce(function (a, b) {
+        if (a[a.length - 1] === '' && ['+', '-'].indexOf(b) !== -1) {
+          a[a.length - 1] = b;
+          mergeWithPrevious = true;
+          return a;
+        } else if (mergeWithPrevious) {
+          a[a.length - 1] += b;
+          mergeWithPrevious = false;
+          return a;
+        } else {
+          return a.concat(b);
+        }
+      }, [])
+      // Here we convert the string values into number values (in px)
+      .map(function (str) {
+        return toValue(str, measurement, popperOffsets, referenceOffsets);
+      });
+    });
+
+    // Loop trough the offsets arrays and execute the operations
+    ops.forEach(function (op, index) {
+      op.forEach(function (frag, index2) {
+        if (isNumeric(frag)) {
+          offsets[index] += frag * (op[index2 - 1] === '-' ? -1 : 1);
+        }
+      });
+    });
+    return offsets;
+  }
+
+  /**
+   * @function
+   * @memberof Modifiers
+   * @argument {Object} data - The data object generated by update method
+   * @argument {Object} options - Modifiers configuration and options
+   * @argument {Number|String} options.offset=0
+   * The offset value as described in the modifier description
+   * @returns {Object} The data object, properly modified
+   */
+  function offset(data, _ref) {
+    var offset = _ref.offset;
+    var placement = data.placement,
+        _data$offsets = data.offsets,
+        popper = _data$offsets.popper,
+        reference = _data$offsets.reference;
+
+    var basePlacement = placement.split('-')[0];
+
+    var offsets = void 0;
+    if (isNumeric(+offset)) {
+      offsets = [+offset, 0];
+    } else {
+      offsets = parseOffset(offset, popper, reference, basePlacement);
+    }
+
+    if (basePlacement === 'left') {
+      popper.top += offsets[0];
+      popper.left -= offsets[1];
+    } else if (basePlacement === 'right') {
+      popper.top += offsets[0];
+      popper.left += offsets[1];
+    } else if (basePlacement === 'top') {
+      popper.left += offsets[0];
+      popper.top -= offsets[1];
+    } else if (basePlacement === 'bottom') {
+      popper.left += offsets[0];
+      popper.top += offsets[1];
+    }
+
+    data.popper = popper;
+    return data;
+  }
+
+  /**
+   * @function
+   * @memberof Modifiers
+   * @argument {Object} data - The data object generated by `update` method
+   * @argument {Object} options - Modifiers configuration and options
+   * @returns {Object} The data object, properly modified
+   */
+  function preventOverflow(data, options) {
+    var boundariesElement = options.boundariesElement || getOffsetParent(data.instance.popper);
+
+    // If offsetParent is the reference element, we really want to
+    // go one step up and use the next offsetParent as reference to
+    // avoid to make this modifier completely useless and look like broken
+    if (data.instance.reference === boundariesElement) {
+      boundariesElement = getOffsetParent(boundariesElement);
+    }
+
+    // NOTE: DOM access here
+    // resets the popper's position so that the document size can be calculated excluding
+    // the size of the popper element itself
+    var transformProp = getSupportedPropertyName('transform');
+    var popperStyles = data.instance.popper.style; // assignment to help minification
+    var top = popperStyles.top,
+        left = popperStyles.left,
+        transform = popperStyles[transformProp];
+
+    popperStyles.top = '';
+    popperStyles.left = '';
+    popperStyles[transformProp] = '';
+
+    var boundaries = getBoundaries(data.instance.popper, data.instance.reference, options.padding, boundariesElement, data.positionFixed);
+
+    // NOTE: DOM access here
+    // restores the original style properties after the offsets have been computed
+    popperStyles.top = top;
+    popperStyles.left = left;
+    popperStyles[transformProp] = transform;
+
+    options.boundaries = boundaries;
+
+    var order = options.priority;
+    var popper = data.offsets.popper;
+
+    var check = {
+      primary: function primary(placement) {
+        var value = popper[placement];
+        if (popper[placement] < boundaries[placement] && !options.escapeWithReference) {
+          value = Math.max(popper[placement], boundaries[placement]);
+        }
+        return defineProperty({}, placement, value);
+      },
+      secondary: function secondary(placement) {
+        var mainSide = placement === 'right' ? 'left' : 'top';
+        var value = popper[mainSide];
+        if (popper[placement] > boundaries[placement] && !options.escapeWithReference) {
+          value = Math.min(popper[mainSide], boundaries[placement] - (placement === 'right' ? popper.width : popper.height));
+        }
+        return defineProperty({}, mainSide, value);
+      }
+    };
+
+    order.forEach(function (placement) {
+      var side = ['left', 'top'].indexOf(placement) !== -1 ? 'primary' : 'secondary';
+      popper = _extends({}, popper, check[side](placement));
+    });
+
+    data.offsets.popper = popper;
+
+    return data;
+  }
+
+  /**
+   * @function
+   * @memberof Modifiers
+   * @argument {Object} data - The data object generated by `update` method
+   * @argument {Object} options - Modifiers configuration and options
+   * @returns {Object} The data object, properly modified
+   */
+  function shift(data) {
+    var placement = data.placement;
+    var basePlacement = placement.split('-')[0];
+    var shiftvariation = placement.split('-')[1];
+
+    // if shift shiftvariation is specified, run the modifier
+    if (shiftvariation) {
+      var _data$offsets = data.offsets,
+          reference = _data$offsets.reference,
+          popper = _data$offsets.popper;
+
+      var isVertical = ['bottom', 'top'].indexOf(basePlacement) !== -1;
+      var side = isVertical ? 'left' : 'top';
+      var measurement = isVertical ? 'width' : 'height';
+
+      var shiftOffsets = {
+        start: defineProperty({}, side, reference[side]),
+        end: defineProperty({}, side, reference[side] + reference[measurement] - popper[measurement])
+      };
+
+      data.offsets.popper = _extends({}, popper, shiftOffsets[shiftvariation]);
+    }
+
+    return data;
+  }
+
+  /**
+   * @function
+   * @memberof Modifiers
+   * @argument {Object} data - The data object generated by update method
+   * @argument {Object} options - Modifiers configuration and options
+   * @returns {Object} The data object, properly modified
+   */
+  function hide(data) {
+    if (!isModifierRequired(data.instance.modifiers, 'hide', 'preventOverflow')) {
+      return data;
+    }
+
+    var refRect = data.offsets.reference;
+    var bound = find(data.instance.modifiers, function (modifier) {
+      return modifier.name === 'preventOverflow';
+    }).boundaries;
+
+    if (refRect.bottom < bound.top || refRect.left > bound.right || refRect.top > bound.bottom || refRect.right < bound.left) {
+      // Avoid unnecessary DOM access if visibility hasn't changed
+      if (data.hide === true) {
+        return data;
+      }
+
+      data.hide = true;
+      data.attributes['x-out-of-boundaries'] = '';
+    } else {
+      // Avoid unnecessary DOM access if visibility hasn't changed
+      if (data.hide === false) {
+        return data;
+      }
+
+      data.hide = false;
+      data.attributes['x-out-of-boundaries'] = false;
+    }
+
+    return data;
+  }
+
+  /**
+   * @function
+   * @memberof Modifiers
+   * @argument {Object} data - The data object generated by `update` method
+   * @argument {Object} options - Modifiers configuration and options
+   * @returns {Object} The data object, properly modified
+   */
+  function inner(data) {
+    var placement = data.placement;
+    var basePlacement = placement.split('-')[0];
+    var _data$offsets = data.offsets,
+        popper = _data$offsets.popper,
+        reference = _data$offsets.reference;
+
+    var isHoriz = ['left', 'right'].indexOf(basePlacement) !== -1;
+
+    var subtractLength = ['top', 'left'].indexOf(basePlacement) === -1;
+
+    popper[isHoriz ? 'left' : 'top'] = reference[basePlacement] - (subtractLength ? popper[isHoriz ? 'width' : 'height'] : 0);
+
+    data.placement = getOppositePlacement(placement);
+    data.offsets.popper = getClientRect(popper);
+
+    return data;
+  }
+
+  /**
+   * Modifier function, each modifier can have a function of this type assigned
+   * to its `fn` property.<br />
+   * These functions will be called on each update, this means that you must
+   * make sure they are performant enough to avoid performance bottlenecks.
+   *
+   * @function ModifierFn
+   * @argument {dataObject} data - The data object generated by `update` method
+   * @argument {Object} options - Modifiers configuration and options
+   * @returns {dataObject} The data object, properly modified
+   */
+
+  /**
+   * Modifiers are plugins used to alter the behavior of your poppers.<br />
+   * Popper.js uses a set of 9 modifiers to provide all the basic functionalities
+   * needed by the library.
+   *
+   * Usually you don't want to override the `order`, `fn` and `onLoad` props.
+   * All the other properties are configurations that could be tweaked.
+   * @namespace modifiers
+   */
+  var modifiers = {
+    /**
+     * Modifier used to shift the popper on the start or end of its reference
+     * element.<br />
+     * It will read the variation of the `placement` property.<br />
+     * It can be one either `-end` or `-start`.
+     * @memberof modifiers
+     * @inner
+     */
+    shift: {
+      /** @prop {number} order=100 - Index used to define the order of execution */
+      order: 100,
+      /** @prop {Boolean} enabled=true - Whether the modifier is enabled or not */
+      enabled: true,
+      /** @prop {ModifierFn} */
+      fn: shift
+    },
+
+    /**
+     * The `offset` modifier can shift your popper on both its axis.
+     *
+     * It accepts the following units:
+     * - `px` or unitless, interpreted as pixels
+     * - `%` or `%r`, percentage relative to the length of the reference element
+     * - `%p`, percentage relative to the length of the popper element
+     * - `vw`, CSS viewport width unit
+     * - `vh`, CSS viewport height unit
+     *
+     * For length is intended the main axis relative to the placement of the popper.<br />
+     * This means that if the placement is `top` or `bottom`, the length will be the
+     * `width`. In case of `left` or `right`, it will be the height.
+     *
+     * You can provide a single value (as `Number` or `String`), or a pair of values
+     * as `String` divided by a comma or one (or more) white spaces.<br />
+     * The latter is a deprecated method because it leads to confusion and will be
+     * removed in v2.<br />
+     * Additionally, it accepts additions and subtractions between different units.
+     * Note that multiplications and divisions aren't supported.
+     *
+     * Valid examples are:
+     * ```
+     * 10
+     * '10%'
+     * '10, 10'
+     * '10%, 10'
+     * '10 + 10%'
+     * '10 - 5vh + 3%'
+     * '-10px + 5vh, 5px - 6%'
+     * ```
+     * > **NB**: If you desire to apply offsets to your poppers in a way that may make them overlap
+     * > with their reference element, unfortunately, you will have to disable the `flip` modifier.
+     * > More on this [reading this issue](https://github.com/FezVrasta/popper.js/issues/373)
+     *
+     * @memberof modifiers
+     * @inner
+     */
+    offset: {
+      /** @prop {number} order=200 - Index used to define the order of execution */
+      order: 200,
+      /** @prop {Boolean} enabled=true - Whether the modifier is enabled or not */
+      enabled: true,
+      /** @prop {ModifierFn} */
+      fn: offset,
+      /** @prop {Number|String} offset=0
+       * The offset value as described in the modifier description
+       */
+      offset: 0
+    },
+
+    /**
+     * Modifier used to prevent the popper from being positioned outside the boundary.
+     *
+     * An scenario exists where the reference itself is not within the boundaries.<br />
+     * We can say it has "escaped the boundaries" — or just "escaped".<br />
+     * In this case we need to decide whether the popper should either:
+     *
+     * - detach from the reference and remain "trapped" in the boundaries, or
+     * - if it should ignore the boundary and "escape with its reference"
+     *
+     * When `escapeWithReference` is set to`true` and reference is completely
+     * outside its boundaries, the popper will overflow (or completely leave)
+     * the boundaries in order to remain attached to the edge of the reference.
+     *
+     * @memberof modifiers
+     * @inner
+     */
+    preventOverflow: {
+      /** @prop {number} order=300 - Index used to define the order of execution */
+      order: 300,
+      /** @prop {Boolean} enabled=true - Whether the modifier is enabled or not */
+      enabled: true,
+      /** @prop {ModifierFn} */
+      fn: preventOverflow,
+      /**
+       * @prop {Array} [priority=['left','right','top','bottom']]
+       * Popper will try to prevent overflow following these priorities by default,
+       * then, it could overflow on the left and on top of the `boundariesElement`
+       */
+      priority: ['left', 'right', 'top', 'bottom'],
+      /**
+       * @prop {number} padding=5
+       * Amount of pixel used to define a minimum distance between the boundaries
+       * and the popper this makes sure the popper has always a little padding
+       * between the edges of its container
+       */
+      padding: 5,
+      /**
+       * @prop {String|HTMLElement} boundariesElement='scrollParent'
+       * Boundaries used by the modifier, can be `scrollParent`, `window`,
+       * `viewport` or any DOM element.
+       */
+      boundariesElement: 'scrollParent'
+    },
+
+    /**
+     * Modifier used to make sure the reference and its popper stay near eachothers
+     * without leaving any gap between the two. Expecially useful when the arrow is
+     * enabled and you want to assure it to point to its reference element.
+     * It cares only about the first axis, you can still have poppers with margin
+     * between the popper and its reference element.
+     * @memberof modifiers
+     * @inner
+     */
+    keepTogether: {
+      /** @prop {number} order=400 - Index used to define the order of execution */
+      order: 400,
+      /** @prop {Boolean} enabled=true - Whether the modifier is enabled or not */
+      enabled: true,
+      /** @prop {ModifierFn} */
+      fn: keepTogether
+    },
+
+    /**
+     * This modifier is used to move the `arrowElement` of the popper to make
+     * sure it is positioned between the reference element and its popper element.
+     * It will read the outer size of the `arrowElement` node to detect how many
+     * pixels of conjuction are needed.
+     *
+     * It has no effect if no `arrowElement` is provided.
+     * @memberof modifiers
+     * @inner
+     */
+    arrow: {
+      /** @prop {number} order=500 - Index used to define the order of execution */
+      order: 500,
+      /** @prop {Boolean} enabled=true - Whether the modifier is enabled or not */
+      enabled: true,
+      /** @prop {ModifierFn} */
+      fn: arrow,
+      /** @prop {String|HTMLElement} element='[x-arrow]' - Selector or node used as arrow */
+      element: '[x-arrow]'
+    },
+
+    /**
+     * Modifier used to flip the popper's placement when it starts to overlap its
+     * reference element.
+     *
+     * Requires the `preventOverflow` modifier before it in order to work.
+     *
+     * **NOTE:** this modifier will interrupt the current update cycle and will
+     * restart it if it detects the need to flip the placement.
+     * @memberof modifiers
+     * @inner
+     */
+    flip: {
+      /** @prop {number} order=600 - Index used to define the order of execution */
+      order: 600,
+      /** @prop {Boolean} enabled=true - Whether the modifier is enabled or not */
+      enabled: true,
+      /** @prop {ModifierFn} */
+      fn: flip,
+      /**
+       * @prop {String|Array} behavior='flip'
+       * The behavior used to change the popper's placement. It can be one of
+       * `flip`, `clockwise`, `counterclockwise` or an array with a list of valid
+       * placements (with optional variations).
+       */
+      behavior: 'flip',
+      /**
+       * @prop {number} padding=5
+       * The popper will flip if it hits the edges of the `boundariesElement`
+       */
+      padding: 5,
+      /**
+       * @prop {String|HTMLElement} boundariesElement='viewport'
+       * The element which will define the boundaries of the popper position,
+       * the popper will never be placed outside of the defined boundaries
+       * (except if keepTogether is enabled)
+       */
+      boundariesElement: 'viewport'
+    },
+
+    /**
+     * Modifier used to make the popper flow toward the inner of the reference element.
+     * By default, when this modifier is disabled, the popper will be placed outside
+     * the reference element.
+     * @memberof modifiers
+     * @inner
+     */
+    inner: {
+      /** @prop {number} order=700 - Index used to define the order of execution */
+      order: 700,
+      /** @prop {Boolean} enabled=false - Whether the modifier is enabled or not */
+      enabled: false,
+      /** @prop {ModifierFn} */
+      fn: inner
+    },
+
+    /**
+     * Modifier used to hide the popper when its reference element is outside of the
+     * popper boundaries. It will set a `x-out-of-boundaries` attribute which can
+     * be used to hide with a CSS selector the popper when its reference is
+     * out of boundaries.
+     *
+     * Requires the `preventOverflow` modifier before it in order to work.
+     * @memberof modifiers
+     * @inner
+     */
+    hide: {
+      /** @prop {number} order=800 - Index used to define the order of execution */
+      order: 800,
+      /** @prop {Boolean} enabled=true - Whether the modifier is enabled or not */
+      enabled: true,
+      /** @prop {ModifierFn} */
+      fn: hide
+    },
+
+    /**
+     * Computes the style that will be applied to the popper element to gets
+     * properly positioned.
+     *
+     * Note that this modifier will not touch the DOM, it just prepares the styles
+     * so that `applyStyle` modifier can apply it. This separation is useful
+     * in case you need to replace `applyStyle` with a custom implementation.
+     *
+     * This modifier has `850` as `order` value to maintain backward compatibility
+     * with previous versions of Popper.js. Expect the modifiers ordering method
+     * to change in future major versions of the library.
+     *
+     * @memberof modifiers
+     * @inner
+     */
+    computeStyle: {
+      /** @prop {number} order=850 - Index used to define the order of execution */
+      order: 850,
+      /** @prop {Boolean} enabled=true - Whether the modifier is enabled or not */
+      enabled: true,
+      /** @prop {ModifierFn} */
+      fn: computeStyle,
+      /**
+       * @prop {Boolean} gpuAcceleration=true
+       * If true, it uses the CSS 3d transformation to position the popper.
+       * Otherwise, it will use the `top` and `left` properties.
+       */
+      gpuAcceleration: true,
+      /**
+       * @prop {string} [x='bottom']
+       * Where to anchor the X axis (`bottom` or `top`). AKA X offset origin.
+       * Change this if your popper should grow in a direction different from `bottom`
+       */
+      x: 'bottom',
+      /**
+       * @prop {string} [x='left']
+       * Where to anchor the Y axis (`left` or `right`). AKA Y offset origin.
+       * Change this if your popper should grow in a direction different from `right`
+       */
+      y: 'right'
+    },
+
+    /**
+     * Applies the computed styles to the popper element.
+     *
+     * All the DOM manipulations are limited to this modifier. This is useful in case
+     * you want to integrate Popper.js inside a framework or view library and you
+     * want to delegate all the DOM manipulations to it.
+     *
+     * Note that if you disable this modifier, you must make sure the popper element
+     * has its position set to `absolute` before Popper.js can do its work!
+     *
+     * Just disable this modifier and define you own to achieve the desired effect.
+     *
+     * @memberof modifiers
+     * @inner
+     */
+    applyStyle: {
+      /** @prop {number} order=900 - Index used to define the order of execution */
+      order: 900,
+      /** @prop {Boolean} enabled=true - Whether the modifier is enabled or not */
+      enabled: true,
+      /** @prop {ModifierFn} */
+      fn: applyStyle,
+      /** @prop {Function} */
+      onLoad: applyStyleOnLoad,
+      /**
+       * @deprecated since version 1.10.0, the property moved to `computeStyle` modifier
+       * @prop {Boolean} gpuAcceleration=true
+       * If true, it uses the CSS 3d transformation to position the popper.
+       * Otherwise, it will use the `top` and `left` properties.
+       */
+      gpuAcceleration: undefined
+    }
+  };
+
+  /**
+   * The `dataObject` is an object containing all the informations used by Popper.js
+   * this object get passed to modifiers and to the `onCreate` and `onUpdate` callbacks.
+   * @name dataObject
+   * @property {Object} data.instance The Popper.js instance
+   * @property {String} data.placement Placement applied to popper
+   * @property {String} data.originalPlacement Placement originally defined on init
+   * @property {Boolean} data.flipped True if popper has been flipped by flip modifier
+   * @property {Boolean} data.hide True if the reference element is out of boundaries, useful to know when to hide the popper.
+   * @property {HTMLElement} data.arrowElement Node used as arrow by arrow modifier
+   * @property {Object} data.styles Any CSS property defined here will be applied to the popper, it expects the JavaScript nomenclature (eg. `marginBottom`)
+   * @property {Object} data.arrowStyles Any CSS property defined here will be applied to the popper arrow, it expects the JavaScript nomenclature (eg. `marginBottom`)
+   * @property {Object} data.boundaries Offsets of the popper boundaries
+   * @property {Object} data.offsets The measurements of popper, reference and arrow elements.
+   * @property {Object} data.offsets.popper `top`, `left`, `width`, `height` values
+   * @property {Object} data.offsets.reference `top`, `left`, `width`, `height` values
+   * @property {Object} data.offsets.arrow] `top` and `left` offsets, only one of them will be different from 0
+   */
+
+  /**
+   * Default options provided to Popper.js constructor.<br />
+   * These can be overriden using the `options` argument of Popper.js.<br />
+   * To override an option, simply pass as 3rd argument an object with the same
+   * structure of this object, example:
+   * ```
+   * new Popper(ref, pop, {
+   *   modifiers: {
+   *     preventOverflow: { enabled: false }
+   *   }
+   * })
+   * ```
+   * @type {Object}
+   * @static
+   * @memberof Popper
+   */
+  var Defaults = {
+    /**
+     * Popper's placement
+     * @prop {Popper.placements} placement='bottom'
+     */
+    placement: 'bottom',
+
+    /**
+     * Set this to true if you want popper to position it self in 'fixed' mode
+     * @prop {Boolean} positionFixed=false
+     */
+    positionFixed: false,
+
+    /**
+     * Whether events (resize, scroll) are initially enabled
+     * @prop {Boolean} eventsEnabled=true
+     */
+    eventsEnabled: true,
+
+    /**
+     * Set to true if you want to automatically remove the popper when
+     * you call the `destroy` method.
+     * @prop {Boolean} removeOnDestroy=false
+     */
+    removeOnDestroy: false,
+
+    /**
+     * Callback called when the popper is created.<br />
+     * By default, is set to no-op.<br />
+     * Access Popper.js instance with `data.instance`.
+     * @prop {onCreate}
+     */
+    onCreate: function onCreate() {},
+
+    /**
+     * Callback called when the popper is updated, this callback is not called
+     * on the initialization/creation of the popper, but only on subsequent
+     * updates.<br />
+     * By default, is set to no-op.<br />
+     * Access Popper.js instance with `data.instance`.
+     * @prop {onUpdate}
+     */
+    onUpdate: function onUpdate() {},
+
+    /**
+     * List of modifiers used to modify the offsets before they are applied to the popper.
+     * They provide most of the functionalities of Popper.js
+     * @prop {modifiers}
+     */
+    modifiers: modifiers
+  };
+
+  /**
+   * @callback onCreate
+   * @param {dataObject} data
+   */
+
+  /**
+   * @callback onUpdate
+   * @param {dataObject} data
+   */
+
+  // Utils
+  // Methods
+  var Popper = function () {
+    /**
+     * Create a new Popper.js instance
+     * @class Popper
+     * @param {HTMLElement|referenceObject} reference - The reference element used to position the popper
+     * @param {HTMLElement} popper - The HTML element used as popper.
+     * @param {Object} options - Your custom options to override the ones defined in [Defaults](#defaults)
+     * @return {Object} instance - The generated Popper.js instance
+     */
+    function Popper(reference, popper) {
+      var _this = this;
+
+      var options = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : {};
+      classCallCheck(this, Popper);
+
+      this.scheduleUpdate = function () {
+        return requestAnimationFrame(_this.update);
+      };
+
+      // make update() debounced, so that it only runs at most once-per-tick
+      this.update = debounce(this.update.bind(this));
+
+      // with {} we create a new object with the options inside it
+      this.options = _extends({}, Popper.Defaults, options);
+
+      // init state
+      this.state = {
+        isDestroyed: false,
+        isCreated: false,
+        scrollParents: []
+      };
+
+      // get reference and popper elements (allow jQuery wrappers)
+      this.reference = reference && reference.jquery ? reference[0] : reference;
+      this.popper = popper && popper.jquery ? popper[0] : popper;
+
+      // Deep merge modifiers options
+      this.options.modifiers = {};
+      Object.keys(_extends({}, Popper.Defaults.modifiers, options.modifiers)).forEach(function (name) {
+        _this.options.modifiers[name] = _extends({}, Popper.Defaults.modifiers[name] || {}, options.modifiers ? options.modifiers[name] : {});
+      });
+
+      // Refactoring modifiers' list (Object => Array)
+      this.modifiers = Object.keys(this.options.modifiers).map(function (name) {
+        return _extends({
+          name: name
+        }, _this.options.modifiers[name]);
+      })
+      // sort the modifiers by order
+      .sort(function (a, b) {
+        return a.order - b.order;
+      });
+
+      // modifiers have the ability to execute arbitrary code when Popper.js get inited
+      // such code is executed in the same order of its modifier
+      // they could add new properties to their options configuration
+      // BE AWARE: don't add options to `options.modifiers.name` but to `modifierOptions`!
+      this.modifiers.forEach(function (modifierOptions) {
+        if (modifierOptions.enabled && isFunction(modifierOptions.onLoad)) {
+          modifierOptions.onLoad(_this.reference, _this.popper, _this.options, modifierOptions, _this.state);
+        }
+      });
+
+      // fire the first update to position the popper in the right place
+      this.update();
+
+      var eventsEnabled = this.options.eventsEnabled;
+      if (eventsEnabled) {
+        // setup event listeners, they will take care of update the position in specific situations
+        this.enableEventListeners();
+      }
+
+      this.state.eventsEnabled = eventsEnabled;
+    }
+
+    // We can't use class properties because they don't get listed in the
+    // class prototype and break stuff like Sinon stubs
+
+
+    createClass(Popper, [{
+      key: 'update',
+      value: function update$$1() {
+        return update.call(this);
+      }
+    }, {
+      key: 'destroy',
+      value: function destroy$$1() {
+        return destroy.call(this);
+      }
+    }, {
+      key: 'enableEventListeners',
+      value: function enableEventListeners$$1() {
+        return enableEventListeners.call(this);
+      }
+    }, {
+      key: 'disableEventListeners',
+      value: function disableEventListeners$$1() {
+        return disableEventListeners.call(this);
+      }
+
+      /**
+       * Schedule an update, it will run on the next UI update available
+       * @method scheduleUpdate
+       * @memberof Popper
+       */
+
+
+      /**
+       * Collection of utilities useful when writing custom modifiers.
+       * Starting from version 1.7, this method is available only if you
+       * include `popper-utils.js` before `popper.js`.
+       *
+       * **DEPRECATION**: This way to access PopperUtils is deprecated
+       * and will be removed in v2! Use the PopperUtils module directly instead.
+       * Due to the high instability of the methods contained in Utils, we can't
+       * guarantee them to follow semver. Use them at your own risk!
+       * @static
+       * @private
+       * @type {Object}
+       * @deprecated since version 1.8
+       * @member Utils
+       * @memberof Popper
+       */
+
+    }]);
+    return Popper;
+  }();
+
+  /**
+   * The `referenceObject` is an object that provides an interface compatible with Popper.js
+   * and lets you use it as replacement of a real DOM node.<br />
+   * You can use this method to position a popper relatively to a set of coordinates
+   * in case you don't have a DOM node to use as reference.
+   *
+   * ```
+   * new Popper(referenceObject, popperNode);
+   * ```
+   *
+   * NB: This feature isn't supported in Internet Explorer 10
+   * @name referenceObject
+   * @property {Function} data.getBoundingClientRect
+   * A function that returns a set of coordinates compatible with the native `getBoundingClientRect` method.
+   * @property {number} data.clientWidth
+   * An ES6 getter that will return the width of the virtual reference element.
+   * @property {number} data.clientHeight
+   * An ES6 getter that will return the height of the virtual reference element.
+   */
+
+
+  Popper.Utils = (typeof window !== 'undefined' ? window : global).PopperUtils;
+  Popper.placements = placements;
+  Popper.Defaults = Defaults;
+
+  /**
+   * --------------------------------------------------------------------------
+   * Bootstrap (v4.1.3): dropdown.js
+   * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE)
+   * --------------------------------------------------------------------------
+   */
+
+  var Dropdown = function ($$$1) {
+    /**
+     * ------------------------------------------------------------------------
+     * Constants
+     * ------------------------------------------------------------------------
+     */
+    var NAME = 'dropdown';
+    var VERSION = '4.1.3';
+    var DATA_KEY = 'bs.dropdown';
+    var EVENT_KEY = "." + DATA_KEY;
+    var DATA_API_KEY = '.data-api';
+    var JQUERY_NO_CONFLICT = $$$1.fn[NAME];
+    var ESCAPE_KEYCODE = 27; // KeyboardEvent.which value for Escape (Esc) key
+
+    var SPACE_KEYCODE = 32; // KeyboardEvent.which value for space key
+
+    var TAB_KEYCODE = 9; // KeyboardEvent.which value for tab key
+
+    var ARROW_UP_KEYCODE = 38; // KeyboardEvent.which value for up arrow key
+
+    var ARROW_DOWN_KEYCODE = 40; // KeyboardEvent.which value for down arrow key
+
+    var RIGHT_MOUSE_BUTTON_WHICH = 3; // MouseEvent.which value for the right button (assuming a right-handed mouse)
+
+    var REGEXP_KEYDOWN = new RegExp(ARROW_UP_KEYCODE + "|" + ARROW_DOWN_KEYCODE + "|" + ESCAPE_KEYCODE);
+    var Event = {
+      HIDE: "hide" + EVENT_KEY,
+      HIDDEN: "hidden" + EVENT_KEY,
+      SHOW: "show" + EVENT_KEY,
+      SHOWN: "shown" + EVENT_KEY,
+      CLICK: "click" + EVENT_KEY,
+      CLICK_DATA_API: "click" + EVENT_KEY + DATA_API_KEY,
+      KEYDOWN_DATA_API: "keydown" + EVENT_KEY + DATA_API_KEY,
+      KEYUP_DATA_API: "keyup" + EVENT_KEY + DATA_API_KEY
+    };
+    var ClassName = {
+      DISABLED: 'disabled',
+      SHOW: 'show',
+      DROPUP: 'dropup',
+      DROPRIGHT: 'dropright',
+      DROPLEFT: 'dropleft',
+      MENURIGHT: 'dropdown-menu-right',
+      MENULEFT: 'dropdown-menu-left',
+      POSITION_STATIC: 'position-static'
+    };
+    var Selector = {
+      DATA_TOGGLE: '[data-toggle="dropdown"]',
+      FORM_CHILD: '.dropdown form',
+      MENU: '.dropdown-menu',
+      NAVBAR_NAV: '.navbar-nav',
+      VISIBLE_ITEMS: '.dropdown-menu .dropdown-item:not(.disabled):not(:disabled)'
+    };
+    var AttachmentMap = {
+      TOP: 'top-start',
+      TOPEND: 'top-end',
+      BOTTOM: 'bottom-start',
+      BOTTOMEND: 'bottom-end',
+      RIGHT: 'right-start',
+      RIGHTEND: 'right-end',
+      LEFT: 'left-start',
+      LEFTEND: 'left-end'
+    };
+    var Default = {
+      offset: 0,
+      flip: true,
+      boundary: 'scrollParent',
+      reference: 'toggle',
+      display: 'dynamic'
+    };
+    var DefaultType = {
+      offset: '(number|string|function)',
+      flip: 'boolean',
+      boundary: '(string|element)',
+      reference: '(string|element)',
+      display: 'string'
+      /**
+       * ------------------------------------------------------------------------
+       * Class Definition
+       * ------------------------------------------------------------------------
+       */
+
+    };
+
+    var Dropdown =
+    /*#__PURE__*/
+    function () {
+      function Dropdown(element, config) {
+        this._element = element;
+        this._popper = null;
+        this._config = this._getConfig(config);
+        this._menu = this._getMenuElement();
+        this._inNavbar = this._detectNavbar();
+
+        this._addEventListeners();
+      } // Getters
+
+
+      var _proto = Dropdown.prototype;
+
+      // Public
+      _proto.toggle = function toggle() {
+        if (this._element.disabled || $$$1(this._element).hasClass(ClassName.DISABLED)) {
+          return;
+        }
+
+        var parent = Dropdown._getParentFromElement(this._element);
+
+        var isActive = $$$1(this._menu).hasClass(ClassName.SHOW);
+
+        Dropdown._clearMenus();
+
+        if (isActive) {
+          return;
+        }
+
+        var relatedTarget = {
+          relatedTarget: this._element
+        };
+        var showEvent = $$$1.Event(Event.SHOW, relatedTarget);
+        $$$1(parent).trigger(showEvent);
+
+        if (showEvent.isDefaultPrevented()) {
+          return;
+        } // Disable totally Popper.js for Dropdown in Navbar
+
+
+        if (!this._inNavbar) {
+          /**
+           * Check for Popper dependency
+           * Popper - https://popper.js.org
+           */
+          if (typeof Popper === 'undefined') {
+            throw new TypeError('Bootstrap dropdown require Popper.js (https://popper.js.org)');
+          }
+
+          var referenceElement = this._element;
+
+          if (this._config.reference === 'parent') {
+            referenceElement = parent;
+          } else if (Util.isElement(this._config.reference)) {
+            referenceElement = this._config.reference; // Check if it's jQuery element
+
+            if (typeof this._config.reference.jquery !== 'undefined') {
+              referenceElement = this._config.reference[0];
+            }
+          } // If boundary is not `scrollParent`, then set position to `static`
+          // to allow the menu to "escape" the scroll parent's boundaries
+          // https://github.com/twbs/bootstrap/issues/24251
+
+
+          if (this._config.boundary !== 'scrollParent') {
+            $$$1(parent).addClass(ClassName.POSITION_STATIC);
+          }
+
+          this._popper = new Popper(referenceElement, this._menu, this._getPopperConfig());
+        } // If this is a touch-enabled device we add extra
+        // empty mouseover listeners to the body's immediate children;
+        // only needed because of broken event delegation on iOS
+        // https://www.quirksmode.org/blog/archives/2014/02/mouse_event_bub.html
+
+
+        if ('ontouchstart' in document.documentElement && $$$1(parent).closest(Selector.NAVBAR_NAV).length === 0) {
+          $$$1(document.body).children().on('mouseover', null, $$$1.noop);
+        }
+
+        this._element.focus();
+
+        this._element.setAttribute('aria-expanded', true);
+
+        $$$1(this._menu).toggleClass(ClassName.SHOW);
+        $$$1(parent).toggleClass(ClassName.SHOW).trigger($$$1.Event(Event.SHOWN, relatedTarget));
+      };
+
+      _proto.dispose = function dispose() {
+        $$$1.removeData(this._element, DATA_KEY);
+        $$$1(this._element).off(EVENT_KEY);
+        this._element = null;
+        this._menu = null;
+
+        if (this._popper !== null) {
+          this._popper.destroy();
+
+          this._popper = null;
+        }
+      };
+
+      _proto.update = function update() {
+        this._inNavbar = this._detectNavbar();
+
+        if (this._popper !== null) {
+          this._popper.scheduleUpdate();
+        }
+      }; // Private
+
+
+      _proto._addEventListeners = function _addEventListeners() {
+        var _this = this;
+
+        $$$1(this._element).on(Event.CLICK, function (event) {
+          event.preventDefault();
+          event.stopPropagation();
+
+          _this.toggle();
+        });
+      };
+
+      _proto._getConfig = function _getConfig(config) {
+        config = _objectSpread({}, this.constructor.Default, $$$1(this._element).data(), config);
+        Util.typeCheckConfig(NAME, config, this.constructor.DefaultType);
+        return config;
+      };
+
+      _proto._getMenuElement = function _getMenuElement() {
+        if (!this._menu) {
+          var parent = Dropdown._getParentFromElement(this._element);
+
+          if (parent) {
+            this._menu = parent.querySelector(Selector.MENU);
+          }
+        }
+
+        return this._menu;
+      };
+
+      _proto._getPlacement = function _getPlacement() {
+        var $parentDropdown = $$$1(this._element.parentNode);
+        var placement = AttachmentMap.BOTTOM; // Handle dropup
+
+        if ($parentDropdown.hasClass(ClassName.DROPUP)) {
+          placement = AttachmentMap.TOP;
+
+          if ($$$1(this._menu).hasClass(ClassName.MENURIGHT)) {
+            placement = AttachmentMap.TOPEND;
+          }
+        } else if ($parentDropdown.hasClass(ClassName.DROPRIGHT)) {
+          placement = AttachmentMap.RIGHT;
+        } else if ($parentDropdown.hasClass(ClassName.DROPLEFT)) {
+          placement = AttachmentMap.LEFT;
+        } else if ($$$1(this._menu).hasClass(ClassName.MENURIGHT)) {
+          placement = AttachmentMap.BOTTOMEND;
+        }
+
+        return placement;
+      };
+
+      _proto._detectNavbar = function _detectNavbar() {
+        return $$$1(this._element).closest('.navbar').length > 0;
+      };
+
+      _proto._getPopperConfig = function _getPopperConfig() {
+        var _this2 = this;
+
+        var offsetConf = {};
+
+        if (typeof this._config.offset === 'function') {
+          offsetConf.fn = function (data) {
+            data.offsets = _objectSpread({}, data.offsets, _this2._config.offset(data.offsets) || {});
+            return data;
+          };
+        } else {
+          offsetConf.offset = this._config.offset;
+        }
+
+        var popperConfig = {
+          placement: this._getPlacement(),
+          modifiers: {
+            offset: offsetConf,
+            flip: {
+              enabled: this._config.flip
+            },
+            preventOverflow: {
+              boundariesElement: this._config.boundary
+            }
+          } // Disable Popper.js if we have a static display
+
+        };
+
+        if (this._config.display === 'static') {
+          popperConfig.modifiers.applyStyle = {
+            enabled: false
+          };
+        }
+
+        return popperConfig;
+      }; // Static
+
+
+      Dropdown._jQueryInterface = function _jQueryInterface(config) {
+        return this.each(function () {
+          var data = $$$1(this).data(DATA_KEY);
+
+          var _config = typeof config === 'object' ? config : null;
+
+          if (!data) {
+            data = new Dropdown(this, _config);
+            $$$1(this).data(DATA_KEY, data);
+          }
+
+          if (typeof config === 'string') {
+            if (typeof data[config] === 'undefined') {
+              throw new TypeError("No method named \"" + config + "\"");
+            }
+
+            data[config]();
+          }
+        });
+      };
+
+      Dropdown._clearMenus = function _clearMenus(event) {
+        if (event && (event.which === RIGHT_MOUSE_BUTTON_WHICH || event.type === 'keyup' && event.which !== TAB_KEYCODE)) {
+          return;
+        }
+
+        var toggles = [].slice.call(document.querySelectorAll(Selector.DATA_TOGGLE));
+
+        for (var i = 0, len = toggles.length; i < len; i++) {
+          var parent = Dropdown._getParentFromElement(toggles[i]);
+
+          var context = $$$1(toggles[i]).data(DATA_KEY);
+          var relatedTarget = {
+            relatedTarget: toggles[i]
+          };
+
+          if (event && event.type === 'click') {
+            relatedTarget.clickEvent = event;
+          }
+
+          if (!context) {
+            continue;
+          }
+
+          var dropdownMenu = context._menu;
+
+          if (!$$$1(parent).hasClass(ClassName.SHOW)) {
+            continue;
+          }
+
+          if (event && (event.type === 'click' && /input|textarea/i.test(event.target.tagName) || event.type === 'keyup' && event.which === TAB_KEYCODE) && $$$1.contains(parent, event.target)) {
+            continue;
+          }
+
+          var hideEvent = $$$1.Event(Event.HIDE, relatedTarget);
+          $$$1(parent).trigger(hideEvent);
+
+          if (hideEvent.isDefaultPrevented()) {
+            continue;
+          } // If this is a touch-enabled device we remove the extra
+          // empty mouseover listeners we added for iOS support
+
+
+          if ('ontouchstart' in document.documentElement) {
+            $$$1(document.body).children().off('mouseover', null, $$$1.noop);
+          }
+
+          toggles[i].setAttribute('aria-expanded', 'false');
+          $$$1(dropdownMenu).removeClass(ClassName.SHOW);
+          $$$1(parent).removeClass(ClassName.SHOW).trigger($$$1.Event(Event.HIDDEN, relatedTarget));
+        }
+      };
+
+      Dropdown._getParentFromElement = function _getParentFromElement(element) {
+        var parent;
+        var selector = Util.getSelectorFromElement(element);
+
+        if (selector) {
+          parent = document.querySelector(selector);
+        }
+
+        return parent || element.parentNode;
+      }; // eslint-disable-next-line complexity
+
+
+      Dropdown._dataApiKeydownHandler = function _dataApiKeydownHandler(event) {
+        // If not input/textarea:
+        //  - And not a key in REGEXP_KEYDOWN => not a dropdown command
+        // If input/textarea:
+        //  - If space key => not a dropdown command
+        //  - If key is other than escape
+        //    - If key is not up or down => not a dropdown command
+        //    - If trigger inside the menu => not a dropdown command
+        if (/input|textarea/i.test(event.target.tagName) ? event.which === SPACE_KEYCODE || event.which !== ESCAPE_KEYCODE && (event.which !== ARROW_DOWN_KEYCODE && event.which !== ARROW_UP_KEYCODE || $$$1(event.target).closest(Selector.MENU).length) : !REGEXP_KEYDOWN.test(event.which)) {
+          return;
+        }
+
+        event.preventDefault();
+        event.stopPropagation();
+
+        if (this.disabled || $$$1(this).hasClass(ClassName.DISABLED)) {
+          return;
+        }
+
+        var parent = Dropdown._getParentFromElement(this);
+
+        var isActive = $$$1(parent).hasClass(ClassName.SHOW);
+
+        if (!isActive && (event.which !== ESCAPE_KEYCODE || event.which !== SPACE_KEYCODE) || isActive && (event.which === ESCAPE_KEYCODE || event.which === SPACE_KEYCODE)) {
+          if (event.which === ESCAPE_KEYCODE) {
+            var toggle = parent.querySelector(Selector.DATA_TOGGLE);
+            $$$1(toggle).trigger('focus');
+          }
+
+          $$$1(this).trigger('click');
+          return;
+        }
+
+        var items = [].slice.call(parent.querySelectorAll(Selector.VISIBLE_ITEMS));
+
+        if (items.length === 0) {
+          return;
+        }
+
+        var index = items.indexOf(event.target);
+
+        if (event.which === ARROW_UP_KEYCODE && index > 0) {
+          // Up
+          index--;
+        }
+
+        if (event.which === ARROW_DOWN_KEYCODE && index < items.length - 1) {
+          // Down
+          index++;
+        }
+
+        if (index < 0) {
+          index = 0;
+        }
+
+        items[index].focus();
+      };
+
+      _createClass(Dropdown, null, [{
+        key: "VERSION",
+        get: function get() {
+          return VERSION;
+        }
+      }, {
+        key: "Default",
+        get: function get() {
+          return Default;
+        }
+      }, {
+        key: "DefaultType",
+        get: function get() {
+          return DefaultType;
+        }
+      }]);
+
+      return Dropdown;
+    }();
+    /**
+     * ------------------------------------------------------------------------
+     * Data Api implementation
+     * ------------------------------------------------------------------------
+     */
+
+
+    $$$1(document).on(Event.KEYDOWN_DATA_API, Selector.DATA_TOGGLE, Dropdown._dataApiKeydownHandler).on(Event.KEYDOWN_DATA_API, Selector.MENU, Dropdown._dataApiKeydownHandler).on(Event.CLICK_DATA_API + " " + Event.KEYUP_DATA_API, Dropdown._clearMenus).on(Event.CLICK_DATA_API, Selector.DATA_TOGGLE, function (event) {
+      event.preventDefault();
+      event.stopPropagation();
+
+      Dropdown._jQueryInterface.call($$$1(this), 'toggle');
+    }).on(Event.CLICK_DATA_API, Selector.FORM_CHILD, function (e) {
+      e.stopPropagation();
+    });
+    /**
+     * ------------------------------------------------------------------------
+     * jQuery
+     * ------------------------------------------------------------------------
+     */
+
+    $$$1.fn[NAME] = Dropdown._jQueryInterface;
+    $$$1.fn[NAME].Constructor = Dropdown;
+
+    $$$1.fn[NAME].noConflict = function () {
+      $$$1.fn[NAME] = JQUERY_NO_CONFLICT;
+      return Dropdown._jQueryInterface;
+    };
+
+    return Dropdown;
+  }($, Popper);
+
+  /**
+   * --------------------------------------------------------------------------
+   * Bootstrap (v4.1.3): modal.js
+   * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE)
+   * --------------------------------------------------------------------------
+   */
+
+  var Modal = function ($$$1) {
+    /**
+     * ------------------------------------------------------------------------
+     * Constants
+     * ------------------------------------------------------------------------
+     */
+    var NAME = 'modal';
+    var VERSION = '4.1.3';
+    var DATA_KEY = 'bs.modal';
+    var EVENT_KEY = "." + DATA_KEY;
+    var DATA_API_KEY = '.data-api';
+    var JQUERY_NO_CONFLICT = $$$1.fn[NAME];
+    var ESCAPE_KEYCODE = 27; // KeyboardEvent.which value for Escape (Esc) key
+
+    var Default = {
+      backdrop: true,
+      keyboard: true,
+      focus: true,
+      show: true
+    };
+    var DefaultType = {
+      backdrop: '(boolean|string)',
+      keyboard: 'boolean',
+      focus: 'boolean',
+      show: 'boolean'
+    };
+    var Event = {
+      HIDE: "hide" + EVENT_KEY,
+      HIDDEN: "hidden" + EVENT_KEY,
+      SHOW: "show" + EVENT_KEY,
+      SHOWN: "shown" + EVENT_KEY,
+      FOCUSIN: "focusin" + EVENT_KEY,
+      RESIZE: "resize" + EVENT_KEY,
+      CLICK_DISMISS: "click.dismiss" + EVENT_KEY,
+      KEYDOWN_DISMISS: "keydown.dismiss" + EVENT_KEY,
+      MOUSEUP_DISMISS: "mouseup.dismiss" + EVENT_KEY,
+      MOUSEDOWN_DISMISS: "mousedown.dismiss" + EVENT_KEY,
+      CLICK_DATA_API: "click" + EVENT_KEY + DATA_API_KEY
+    };
+    var ClassName = {
+      SCROLLBAR_MEASURER: 'modal-scrollbar-measure',
+      BACKDROP: 'modal-backdrop',
+      OPEN: 'modal-open',
+      FADE: 'fade',
+      SHOW: 'show'
+    };
+    var Selector = {
+      DIALOG: '.modal-dialog',
+      DATA_TOGGLE: '[data-toggle="modal"]',
+      DATA_DISMISS: '[data-dismiss="modal"]',
+      FIXED_CONTENT: '.fixed-top, .fixed-bottom, .is-fixed, .sticky-top',
+      STICKY_CONTENT: '.sticky-top'
+      /**
+       * ------------------------------------------------------------------------
+       * Class Definition
+       * ------------------------------------------------------------------------
+       */
+
+    };
+
+    var Modal =
+    /*#__PURE__*/
+    function () {
+      function Modal(element, config) {
+        this._config = this._getConfig(config);
+        this._element = element;
+        this._dialog = element.querySelector(Selector.DIALOG);
+        this._backdrop = null;
+        this._isShown = false;
+        this._isBodyOverflowing = false;
+        this._ignoreBackdropClick = false;
+        this._scrollbarWidth = 0;
+      } // Getters
+
+
+      var _proto = Modal.prototype;
+
+      // Public
+      _proto.toggle = function toggle(relatedTarget) {
+        return this._isShown ? this.hide() : this.show(relatedTarget);
+      };
+
+      _proto.show = function show(relatedTarget) {
+        var _this = this;
+
+        if (this._isTransitioning || this._isShown) {
+          return;
+        }
+
+        if ($$$1(this._element).hasClass(ClassName.FADE)) {
+          this._isTransitioning = true;
+        }
+
+        var showEvent = $$$1.Event(Event.SHOW, {
+          relatedTarget: relatedTarget
+        });
+        $$$1(this._element).trigger(showEvent);
+
+        if (this._isShown || showEvent.isDefaultPrevented()) {
+          return;
+        }
+
+        this._isShown = true;
+
+        this._checkScrollbar();
+
+        this._setScrollbar();
+
+        this._adjustDialog();
+
+        $$$1(document.body).addClass(ClassName.OPEN);
+
+        this._setEscapeEvent();
+
+        this._setResizeEvent();
+
+        $$$1(this._element).on(Event.CLICK_DISMISS, Selector.DATA_DISMISS, function (event) {
+          return _this.hide(event);
+        });
+        $$$1(this._dialog).on(Event.MOUSEDOWN_DISMISS, function () {
+          $$$1(_this._element).one(Event.MOUSEUP_DISMISS, function (event) {
+            if ($$$1(event.target).is(_this._element)) {
+              _this._ignoreBackdropClick = true;
+            }
+          });
+        });
+
+        this._showBackdrop(function () {
+          return _this._showElement(relatedTarget);
+        });
+      };
+
+      _proto.hide = function hide(event) {
+        var _this2 = this;
+
+        if (event) {
+          event.preventDefault();
+        }
+
+        if (this._isTransitioning || !this._isShown) {
+          return;
+        }
+
+        var hideEvent = $$$1.Event(Event.HIDE);
+        $$$1(this._element).trigger(hideEvent);
+
+        if (!this._isShown || hideEvent.isDefaultPrevented()) {
+          return;
+        }
+
+        this._isShown = false;
+        var transition = $$$1(this._element).hasClass(ClassName.FADE);
+
+        if (transition) {
+          this._isTransitioning = true;
+        }
+
+        this._setEscapeEvent();
+
+        this._setResizeEvent();
+
+        $$$1(document).off(Event.FOCUSIN);
+        $$$1(this._element).removeClass(ClassName.SHOW);
+        $$$1(this._element).off(Event.CLICK_DISMISS);
+        $$$1(this._dialog).off(Event.MOUSEDOWN_DISMISS);
+
+        if (transition) {
+          var transitionDuration = Util.getTransitionDurationFromElement(this._element);
+          $$$1(this._element).one(Util.TRANSITION_END, function (event) {
+            return _this2._hideModal(event);
+          }).emulateTransitionEnd(transitionDuration);
+        } else {
+          this._hideModal();
+        }
+      };
+
+      _proto.dispose = function dispose() {
+        $$$1.removeData(this._element, DATA_KEY);
+        $$$1(window, document, this._element, this._backdrop).off(EVENT_KEY);
+        this._config = null;
+        this._element = null;
+        this._dialog = null;
+        this._backdrop = null;
+        this._isShown = null;
+        this._isBodyOverflowing = null;
+        this._ignoreBackdropClick = null;
+        this._scrollbarWidth = null;
+      };
+
+      _proto.handleUpdate = function handleUpdate() {
+        this._adjustDialog();
+      }; // Private
+
+
+      _proto._getConfig = function _getConfig(config) {
+        config = _objectSpread({}, Default, config);
+        Util.typeCheckConfig(NAME, config, DefaultType);
+        return config;
+      };
+
+      _proto._showElement = function _showElement(relatedTarget) {
+        var _this3 = this;
+
+        var transition = $$$1(this._element).hasClass(ClassName.FADE);
+
+        if (!this._element.parentNode || this._element.parentNode.nodeType !== Node.ELEMENT_NODE) {
+          // Don't move modal's DOM position
+          document.body.appendChild(this._element);
+        }
+
+        this._element.style.display = 'block';
+
+        this._element.removeAttribute('aria-hidden');
+
+        this._element.scrollTop = 0;
+
+        if (transition) {
+          Util.reflow(this._element);
+        }
+
+        $$$1(this._element).addClass(ClassName.SHOW);
+
+        if (this._config.focus) {
+          this._enforceFocus();
+        }
+
+        var shownEvent = $$$1.Event(Event.SHOWN, {
+          relatedTarget: relatedTarget
+        });
+
+        var transitionComplete = function transitionComplete() {
+          if (_this3._config.focus) {
+            _this3._element.focus();
+          }
+
+          _this3._isTransitioning = false;
+          $$$1(_this3._element).trigger(shownEvent);
+        };
+
+        if (transition) {
+          var transitionDuration = Util.getTransitionDurationFromElement(this._element);
+          $$$1(this._dialog).one(Util.TRANSITION_END, transitionComplete).emulateTransitionEnd(transitionDuration);
+        } else {
+          transitionComplete();
+        }
+      };
+
+      _proto._enforceFocus = function _enforceFocus() {
+        var _this4 = this;
+
+        $$$1(document).off(Event.FOCUSIN) // Guard against infinite focus loop
+        .on(Event.FOCUSIN, function (event) {
+          if (document !== event.target && _this4._element !== event.target && $$$1(_this4._element).has(event.target).length === 0) {
+            _this4._element.focus();
+          }
+        });
+      };
+
+      _proto._setEscapeEvent = function _setEscapeEvent() {
+        var _this5 = this;
+
+        if (this._isShown && this._config.keyboard) {
+          $$$1(this._element).on(Event.KEYDOWN_DISMISS, function (event) {
+            if (event.which === ESCAPE_KEYCODE) {
+              event.preventDefault();
+
+              _this5.hide();
+            }
+          });
+        } else if (!this._isShown) {
+          $$$1(this._element).off(Event.KEYDOWN_DISMISS);
+        }
+      };
+
+      _proto._setResizeEvent = function _setResizeEvent() {
+        var _this6 = this;
+
+        if (this._isShown) {
+          $$$1(window).on(Event.RESIZE, function (event) {
+            return _this6.handleUpdate(event);
+          });
+        } else {
+          $$$1(window).off(Event.RESIZE);
+        }
+      };
+
+      _proto._hideModal = function _hideModal() {
+        var _this7 = this;
+
+        this._element.style.display = 'none';
+
+        this._element.setAttribute('aria-hidden', true);
+
+        this._isTransitioning = false;
+
+        this._showBackdrop(function () {
+          $$$1(document.body).removeClass(ClassName.OPEN);
+
+          _this7._resetAdjustments();
+
+          _this7._resetScrollbar();
+
+          $$$1(_this7._element).trigger(Event.HIDDEN);
+        });
+      };
+
+      _proto._removeBackdrop = function _removeBackdrop() {
+        if (this._backdrop) {
+          $$$1(this._backdrop).remove();
+          this._backdrop = null;
+        }
+      };
+
+      _proto._showBackdrop = function _showBackdrop(callback) {
+        var _this8 = this;
+
+        var animate = $$$1(this._element).hasClass(ClassName.FADE) ? ClassName.FADE : '';
+
+        if (this._isShown && this._config.backdrop) {
+          this._backdrop = document.createElement('div');
+          this._backdrop.className = ClassName.BACKDROP;
+
+          if (animate) {
+            this._backdrop.classList.add(animate);
+          }
+
+          $$$1(this._backdrop).appendTo(document.body);
+          $$$1(this._element).on(Event.CLICK_DISMISS, function (event) {
+            if (_this8._ignoreBackdropClick) {
+              _this8._ignoreBackdropClick = false;
+              return;
+            }
+
+            if (event.target !== event.currentTarget) {
+              return;
+            }
+
+            if (_this8._config.backdrop === 'static') {
+              _this8._element.focus();
+            } else {
+              _this8.hide();
+            }
+          });
+
+          if (animate) {
+            Util.reflow(this._backdrop);
+          }
+
+          $$$1(this._backdrop).addClass(ClassName.SHOW);
+
+          if (!callback) {
+            return;
+          }
+
+          if (!animate) {
+            callback();
+            return;
+          }
+
+          var backdropTransitionDuration = Util.getTransitionDurationFromElement(this._backdrop);
+          $$$1(this._backdrop).one(Util.TRANSITION_END, callback).emulateTransitionEnd(backdropTransitionDuration);
+        } else if (!this._isShown && this._backdrop) {
+          $$$1(this._backdrop).removeClass(ClassName.SHOW);
+
+          var callbackRemove = function callbackRemove() {
+            _this8._removeBackdrop();
+
+            if (callback) {
+              callback();
+            }
+          };
+
+          if ($$$1(this._element).hasClass(ClassName.FADE)) {
+            var _backdropTransitionDuration = Util.getTransitionDurationFromElement(this._backdrop);
+
+            $$$1(this._backdrop).one(Util.TRANSITION_END, callbackRemove).emulateTransitionEnd(_backdropTransitionDuration);
+          } else {
+            callbackRemove();
+          }
+        } else if (callback) {
+          callback();
+        }
+      }; // ----------------------------------------------------------------------
+      // the following methods are used to handle overflowing modals
+      // todo (fat): these should probably be refactored out of modal.js
+      // ----------------------------------------------------------------------
+
+
+      _proto._adjustDialog = function _adjustDialog() {
+        var isModalOverflowing = this._element.scrollHeight > document.documentElement.clientHeight;
+
+        if (!this._isBodyOverflowing && isModalOverflowing) {
+          this._element.style.paddingLeft = this._scrollbarWidth + "px";
+        }
+
+        if (this._isBodyOverflowing && !isModalOverflowing) {
+          this._element.style.paddingRight = this._scrollbarWidth + "px";
+        }
+      };
+
+      _proto._resetAdjustments = function _resetAdjustments() {
+        this._element.style.paddingLeft = '';
+        this._element.style.paddingRight = '';
+      };
+
+      _proto._checkScrollbar = function _checkScrollbar() {
+        var rect = document.body.getBoundingClientRect();
+        this._isBodyOverflowing = rect.left + rect.right < window.innerWidth;
+        this._scrollbarWidth = this._getScrollbarWidth();
+      };
+
+      _proto._setScrollbar = function _setScrollbar() {
+        var _this9 = this;
+
+        if (this._isBodyOverflowing) {
+          // Note: DOMNode.style.paddingRight returns the actual value or '' if not set
+          //   while $(DOMNode).css('padding-right') returns the calculated value or 0 if not set
+          var fixedContent = [].slice.call(document.querySelectorAll(Selector.FIXED_CONTENT));
+          var stickyContent = [].slice.call(document.querySelectorAll(Selector.STICKY_CONTENT)); // Adjust fixed content padding
+
+          $$$1(fixedContent).each(function (index, element) {
+            var actualPadding = element.style.paddingRight;
+            var calculatedPadding = $$$1(element).css('padding-right');
+            $$$1(element).data('padding-right', actualPadding).css('padding-right', parseFloat(calculatedPadding) + _this9._scrollbarWidth + "px");
+          }); // Adjust sticky content margin
+
+          $$$1(stickyContent).each(function (index, element) {
+            var actualMargin = element.style.marginRight;
+            var calculatedMargin = $$$1(element).css('margin-right');
+            $$$1(element).data('margin-right', actualMargin).css('margin-right', parseFloat(calculatedMargin) - _this9._scrollbarWidth + "px");
+          }); // Adjust body padding
+
+          var actualPadding = document.body.style.paddingRight;
+          var calculatedPadding = $$$1(document.body).css('padding-right');
+          $$$1(document.body).data('padding-right', actualPadding).css('padding-right', parseFloat(calculatedPadding) + this._scrollbarWidth + "px");
+        }
+      };
+
+      _proto._resetScrollbar = function _resetScrollbar() {
+        // Restore fixed content padding
+        var fixedContent = [].slice.call(document.querySelectorAll(Selector.FIXED_CONTENT));
+        $$$1(fixedContent).each(function (index, element) {
+          var padding = $$$1(element).data('padding-right');
+          $$$1(element).removeData('padding-right');
+          element.style.paddingRight = padding ? padding : '';
+        }); // Restore sticky content
+
+        var elements = [].slice.call(document.querySelectorAll("" + Selector.STICKY_CONTENT));
+        $$$1(elements).each(function (index, element) {
+          var margin = $$$1(element).data('margin-right');
+
+          if (typeof margin !== 'undefined') {
+            $$$1(element).css('margin-right', margin).removeData('margin-right');
+          }
+        }); // Restore body padding
+
+        var padding = $$$1(document.body).data('padding-right');
+        $$$1(document.body).removeData('padding-right');
+        document.body.style.paddingRight = padding ? padding : '';
+      };
+
+      _proto._getScrollbarWidth = function _getScrollbarWidth() {
+        // thx d.walsh
+        var scrollDiv = document.createElement('div');
+        scrollDiv.className = ClassName.SCROLLBAR_MEASURER;
+        document.body.appendChild(scrollDiv);
+        var scrollbarWidth = scrollDiv.getBoundingClientRect().width - scrollDiv.clientWidth;
+        document.body.removeChild(scrollDiv);
+        return scrollbarWidth;
+      }; // Static
+
+
+      Modal._jQueryInterface = function _jQueryInterface(config, relatedTarget) {
+        return this.each(function () {
+          var data = $$$1(this).data(DATA_KEY);
+
+          var _config = _objectSpread({}, Default, $$$1(this).data(), typeof config === 'object' && config ? config : {});
+
+          if (!data) {
+            data = new Modal(this, _config);
+            $$$1(this).data(DATA_KEY, data);
+          }
+
+          if (typeof config === 'string') {
+            if (typeof data[config] === 'undefined') {
+              throw new TypeError("No method named \"" + config + "\"");
+            }
+
+            data[config](relatedTarget);
+          } else if (_config.show) {
+            data.show(relatedTarget);
+          }
+        });
+      };
+
+      _createClass(Modal, null, [{
+        key: "VERSION",
+        get: function get() {
+          return VERSION;
+        }
+      }, {
+        key: "Default",
+        get: function get() {
+          return Default;
+        }
+      }]);
+
+      return Modal;
+    }();
+    /**
+     * ------------------------------------------------------------------------
+     * Data Api implementation
+     * ------------------------------------------------------------------------
+     */
+
+
+    $$$1(document).on(Event.CLICK_DATA_API, Selector.DATA_TOGGLE, function (event) {
+      var _this10 = this;
+
+      var target;
+      var selector = Util.getSelectorFromElement(this);
+
+      if (selector) {
+        target = document.querySelector(selector);
+      }
+
+      var config = $$$1(target).data(DATA_KEY) ? 'toggle' : _objectSpread({}, $$$1(target).data(), $$$1(this).data());
+
+      if (this.tagName === 'A' || this.tagName === 'AREA') {
+        event.preventDefault();
+      }
+
+      var $target = $$$1(target).one(Event.SHOW, function (showEvent) {
+        if (showEvent.isDefaultPrevented()) {
+          // Only register focus restorer if modal will actually get shown
+          return;
+        }
+
+        $target.one(Event.HIDDEN, function () {
+          if ($$$1(_this10).is(':visible')) {
+            _this10.focus();
+          }
+        });
+      });
+
+      Modal._jQueryInterface.call($$$1(target), config, this);
+    });
+    /**
+     * ------------------------------------------------------------------------
+     * jQuery
+     * ------------------------------------------------------------------------
+     */
+
+    $$$1.fn[NAME] = Modal._jQueryInterface;
+    $$$1.fn[NAME].Constructor = Modal;
+
+    $$$1.fn[NAME].noConflict = function () {
+      $$$1.fn[NAME] = JQUERY_NO_CONFLICT;
+      return Modal._jQueryInterface;
+    };
+
+    return Modal;
+  }($);
+
+  /**
+   * --------------------------------------------------------------------------
+   * Bootstrap (v4.1.3): tooltip.js
+   * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE)
+   * --------------------------------------------------------------------------
+   */
+
+  var Tooltip = function ($$$1) {
+    /**
+     * ------------------------------------------------------------------------
+     * Constants
+     * ------------------------------------------------------------------------
+     */
+    var NAME = 'tooltip';
+    var VERSION = '4.1.3';
+    var DATA_KEY = 'bs.tooltip';
+    var EVENT_KEY = "." + DATA_KEY;
+    var JQUERY_NO_CONFLICT = $$$1.fn[NAME];
+    var CLASS_PREFIX = 'bs-tooltip';
+    var BSCLS_PREFIX_REGEX = new RegExp("(^|\\s)" + CLASS_PREFIX + "\\S+", 'g');
+    var DefaultType = {
+      animation: 'boolean',
+      template: 'string',
+      title: '(string|element|function)',
+      trigger: 'string',
+      delay: '(number|object)',
+      html: 'boolean',
+      selector: '(string|boolean)',
+      placement: '(string|function)',
+      offset: '(number|string)',
+      container: '(string|element|boolean)',
+      fallbackPlacement: '(string|array)',
+      boundary: '(string|element)'
+    };
+    var AttachmentMap = {
+      AUTO: 'auto',
+      TOP: 'top',
+      RIGHT: 'right',
+      BOTTOM: 'bottom',
+      LEFT: 'left'
+    };
+    var Default = {
+      animation: true,
+      template: '<div class="tooltip" role="tooltip">' + '<div class="arrow"></div>' + '<div class="tooltip-inner"></div></div>',
+      trigger: 'hover focus',
+      title: '',
+      delay: 0,
+      html: false,
+      selector: false,
+      placement: 'top',
+      offset: 0,
+      container: false,
+      fallbackPlacement: 'flip',
+      boundary: 'scrollParent'
+    };
+    var HoverState = {
+      SHOW: 'show',
+      OUT: 'out'
+    };
+    var Event = {
+      HIDE: "hide" + EVENT_KEY,
+      HIDDEN: "hidden" + EVENT_KEY,
+      SHOW: "show" + EVENT_KEY,
+      SHOWN: "shown" + EVENT_KEY,
+      INSERTED: "inserted" + EVENT_KEY,
+      CLICK: "click" + EVENT_KEY,
+      FOCUSIN: "focusin" + EVENT_KEY,
+      FOCUSOUT: "focusout" + EVENT_KEY,
+      MOUSEENTER: "mouseenter" + EVENT_KEY,
+      MOUSELEAVE: "mouseleave" + EVENT_KEY
+    };
+    var ClassName = {
+      FADE: 'fade',
+      SHOW: 'show'
+    };
+    var Selector = {
+      TOOLTIP: '.tooltip',
+      TOOLTIP_INNER: '.tooltip-inner',
+      ARROW: '.arrow'
+    };
+    var Trigger = {
+      HOVER: 'hover',
+      FOCUS: 'focus',
+      CLICK: 'click',
+      MANUAL: 'manual'
+      /**
+       * ------------------------------------------------------------------------
+       * Class Definition
+       * ------------------------------------------------------------------------
+       */
+
+    };
+
+    var Tooltip =
+    /*#__PURE__*/
+    function () {
+      function Tooltip(element, config) {
+        /**
+         * Check for Popper dependency
+         * Popper - https://popper.js.org
+         */
+        if (typeof Popper === 'undefined') {
+          throw new TypeError('Bootstrap tooltips require Popper.js (https://popper.js.org)');
+        } // private
+
+
+        this._isEnabled = true;
+        this._timeout = 0;
+        this._hoverState = '';
+        this._activeTrigger = {};
+        this._popper = null; // Protected
+
+        this.element = element;
+        this.config = this._getConfig(config);
+        this.tip = null;
+
+        this._setListeners();
+      } // Getters
+
+
+      var _proto = Tooltip.prototype;
+
+      // Public
+      _proto.enable = function enable() {
+        this._isEnabled = true;
+      };
+
+      _proto.disable = function disable() {
+        this._isEnabled = false;
+      };
+
+      _proto.toggleEnabled = function toggleEnabled() {
+        this._isEnabled = !this._isEnabled;
+      };
+
+      _proto.toggle = function toggle(event) {
+        if (!this._isEnabled) {
+          return;
+        }
+
+        if (event) {
+          var dataKey = this.constructor.DATA_KEY;
+          var context = $$$1(event.currentTarget).data(dataKey);
+
+          if (!context) {
+            context = new this.constructor(event.currentTarget, this._getDelegateConfig());
+            $$$1(event.currentTarget).data(dataKey, context);
+          }
+
+          context._activeTrigger.click = !context._activeTrigger.click;
+
+          if (context._isWithActiveTrigger()) {
+            context._enter(null, context);
+          } else {
+            context._leave(null, context);
+          }
+        } else {
+          if ($$$1(this.getTipElement()).hasClass(ClassName.SHOW)) {
+            this._leave(null, this);
+
+            return;
+          }
+
+          this._enter(null, this);
+        }
+      };
+
+      _proto.dispose = function dispose() {
+        clearTimeout(this._timeout);
+        $$$1.removeData(this.element, this.constructor.DATA_KEY);
+        $$$1(this.element).off(this.constructor.EVENT_KEY);
+        $$$1(this.element).closest('.modal').off('hide.bs.modal');
+
+        if (this.tip) {
+          $$$1(this.tip).remove();
+        }
+
+        this._isEnabled = null;
+        this._timeout = null;
+        this._hoverState = null;
+        this._activeTrigger = null;
+
+        if (this._popper !== null) {
+          this._popper.destroy();
+        }
+
+        this._popper = null;
+        this.element = null;
+        this.config = null;
+        this.tip = null;
+      };
+
+      _proto.show = function show() {
+        var _this = this;
+
+        if ($$$1(this.element).css('display') === 'none') {
+          throw new Error('Please use show on visible elements');
+        }
+
+        var showEvent = $$$1.Event(this.constructor.Event.SHOW);
+
+        if (this.isWithContent() && this._isEnabled) {
+          $$$1(this.element).trigger(showEvent);
+          var isInTheDom = $$$1.contains(this.element.ownerDocument.documentElement, this.element);
+
+          if (showEvent.isDefaultPrevented() || !isInTheDom) {
+            return;
+          }
+
+          var tip = this.getTipElement();
+          var tipId = Util.getUID(this.constructor.NAME);
+          tip.setAttribute('id', tipId);
+          this.element.setAttribute('aria-describedby', tipId);
+          this.setContent();
+
+          if (this.config.animation) {
+            $$$1(tip).addClass(ClassName.FADE);
+          }
+
+          var placement = typeof this.config.placement === 'function' ? this.config.placement.call(this, tip, this.element) : this.config.placement;
+
+          var attachment = this._getAttachment(placement);
+
+          this.addAttachmentClass(attachment);
+          var container = this.config.container === false ? document.body : $$$1(document).find(this.config.container);
+          $$$1(tip).data(this.constructor.DATA_KEY, this);
+
+          if (!$$$1.contains(this.element.ownerDocument.documentElement, this.tip)) {
+            $$$1(tip).appendTo(container);
+          }
+
+          $$$1(this.element).trigger(this.constructor.Event.INSERTED);
+          this._popper = new Popper(this.element, tip, {
+            placement: attachment,
+            modifiers: {
+              offset: {
+                offset: this.config.offset
+              },
+              flip: {
+                behavior: this.config.fallbackPlacement
+              },
+              arrow: {
+                element: Selector.ARROW
+              },
+              preventOverflow: {
+                boundariesElement: this.config.boundary
+              }
+            },
+            onCreate: function onCreate(data) {
+              if (data.originalPlacement !== data.placement) {
+                _this._handlePopperPlacementChange(data);
+              }
+            },
+            onUpdate: function onUpdate(data) {
+              _this._handlePopperPlacementChange(data);
+            }
+          });
+          $$$1(tip).addClass(ClassName.SHOW); // If this is a touch-enabled device we add extra
+          // empty mouseover listeners to the body's immediate children;
+          // only needed because of broken event delegation on iOS
+          // https://www.quirksmode.org/blog/archives/2014/02/mouse_event_bub.html
+
+          if ('ontouchstart' in document.documentElement) {
+            $$$1(document.body).children().on('mouseover', null, $$$1.noop);
+          }
+
+          var complete = function complete() {
+            if (_this.config.animation) {
+              _this._fixTransition();
+            }
+
+            var prevHoverState = _this._hoverState;
+            _this._hoverState = null;
+            $$$1(_this.element).trigger(_this.constructor.Event.SHOWN);
+
+            if (prevHoverState === HoverState.OUT) {
+              _this._leave(null, _this);
+            }
+          };
+
+          if ($$$1(this.tip).hasClass(ClassName.FADE)) {
+            var transitionDuration = Util.getTransitionDurationFromElement(this.tip);
+            $$$1(this.tip).one(Util.TRANSITION_END, complete).emulateTransitionEnd(transitionDuration);
+          } else {
+            complete();
+          }
+        }
+      };
+
+      _proto.hide = function hide(callback) {
+        var _this2 = this;
+
+        var tip = this.getTipElement();
+        var hideEvent = $$$1.Event(this.constructor.Event.HIDE);
+
+        var complete = function complete() {
+          if (_this2._hoverState !== HoverState.SHOW && tip.parentNode) {
+            tip.parentNode.removeChild(tip);
+          }
+
+          _this2._cleanTipClass();
+
+          _this2.element.removeAttribute('aria-describedby');
+
+          $$$1(_this2.element).trigger(_this2.constructor.Event.HIDDEN);
+
+          if (_this2._popper !== null) {
+            _this2._popper.destroy();
+          }
+
+          if (callback) {
+            callback();
+          }
+        };
+
+        $$$1(this.element).trigger(hideEvent);
+
+        if (hideEvent.isDefaultPrevented()) {
+          return;
+        }
+
+        $$$1(tip).removeClass(ClassName.SHOW); // If this is a touch-enabled device we remove the extra
+        // empty mouseover listeners we added for iOS support
+
+        if ('ontouchstart' in document.documentElement) {
+          $$$1(document.body).children().off('mouseover', null, $$$1.noop);
+        }
+
+        this._activeTrigger[Trigger.CLICK] = false;
+        this._activeTrigger[Trigger.FOCUS] = false;
+        this._activeTrigger[Trigger.HOVER] = false;
+
+        if ($$$1(this.tip).hasClass(ClassName.FADE)) {
+          var transitionDuration = Util.getTransitionDurationFromElement(tip);
+          $$$1(tip).one(Util.TRANSITION_END, complete).emulateTransitionEnd(transitionDuration);
+        } else {
+          complete();
+        }
+
+        this._hoverState = '';
+      };
+
+      _proto.update = function update() {
+        if (this._popper !== null) {
+          this._popper.scheduleUpdate();
+        }
+      }; // Protected
+
+
+      _proto.isWithContent = function isWithContent() {
+        return Boolean(this.getTitle());
+      };
+
+      _proto.addAttachmentClass = function addAttachmentClass(attachment) {
+        $$$1(this.getTipElement()).addClass(CLASS_PREFIX + "-" + attachment);
+      };
+
+      _proto.getTipElement = function getTipElement() {
+        this.tip = this.tip || $$$1(this.config.template)[0];
+        return this.tip;
+      };
+
+      _proto.setContent = function setContent() {
+        var tip = this.getTipElement();
+        this.setElementContent($$$1(tip.querySelectorAll(Selector.TOOLTIP_INNER)), this.getTitle());
+        $$$1(tip).removeClass(ClassName.FADE + " " + ClassName.SHOW);
+      };
+
+      _proto.setElementContent = function setElementContent($element, content) {
+        var html = this.config.html;
+
+        if (typeof content === 'object' && (content.nodeType || content.jquery)) {
+          // Content is a DOM node or a jQuery
+          if (html) {
+            if (!$$$1(content).parent().is($element)) {
+              $element.empty().append(content);
+            }
+          } else {
+            $element.text($$$1(content).text());
+          }
+        } else {
+          $element[html ? 'html' : 'text'](content);
+        }
+      };
+
+      _proto.getTitle = function getTitle() {
+        var title = this.element.getAttribute('data-original-title');
+
+        if (!title) {
+          title = typeof this.config.title === 'function' ? this.config.title.call(this.element) : this.config.title;
+        }
+
+        return title;
+      }; // Private
+
+
+      _proto._getAttachment = function _getAttachment(placement) {
+        return AttachmentMap[placement.toUpperCase()];
+      };
+
+      _proto._setListeners = function _setListeners() {
+        var _this3 = this;
+
+        var triggers = this.config.trigger.split(' ');
+        triggers.forEach(function (trigger) {
+          if (trigger === 'click') {
+            $$$1(_this3.element).on(_this3.constructor.Event.CLICK, _this3.config.selector, function (event) {
+              return _this3.toggle(event);
+            });
+          } else if (trigger !== Trigger.MANUAL) {
+            var eventIn = trigger === Trigger.HOVER ? _this3.constructor.Event.MOUSEENTER : _this3.constructor.Event.FOCUSIN;
+            var eventOut = trigger === Trigger.HOVER ? _this3.constructor.Event.MOUSELEAVE : _this3.constructor.Event.FOCUSOUT;
+            $$$1(_this3.element).on(eventIn, _this3.config.selector, function (event) {
+              return _this3._enter(event);
+            }).on(eventOut, _this3.config.selector, function (event) {
+              return _this3._leave(event);
+            });
+          }
+
+          $$$1(_this3.element).closest('.modal').on('hide.bs.modal', function () {
+            return _this3.hide();
+          });
+        });
+
+        if (this.config.selector) {
+          this.config = _objectSpread({}, this.config, {
+            trigger: 'manual',
+            selector: ''
+          });
+        } else {
+          this._fixTitle();
+        }
+      };
+
+      _proto._fixTitle = function _fixTitle() {
+        var titleType = typeof this.element.getAttribute('data-original-title');
+
+        if (this.element.getAttribute('title') || titleType !== 'string') {
+          this.element.setAttribute('data-original-title', this.element.getAttribute('title') || '');
+          this.element.setAttribute('title', '');
+        }
+      };
+
+      _proto._enter = function _enter(event, context) {
+        var dataKey = this.constructor.DATA_KEY;
+        context = context || $$$1(event.currentTarget).data(dataKey);
+
+        if (!context) {
+          context = new this.constructor(event.currentTarget, this._getDelegateConfig());
+          $$$1(event.currentTarget).data(dataKey, context);
+        }
+
+        if (event) {
+          context._activeTrigger[event.type === 'focusin' ? Trigger.FOCUS : Trigger.HOVER] = true;
+        }
+
+        if ($$$1(context.getTipElement()).hasClass(ClassName.SHOW) || context._hoverState === HoverState.SHOW) {
+          context._hoverState = HoverState.SHOW;
+          return;
+        }
+
+        clearTimeout(context._timeout);
+        context._hoverState = HoverState.SHOW;
+
+        if (!context.config.delay || !context.config.delay.show) {
+          context.show();
+          return;
+        }
+
+        context._timeout = setTimeout(function () {
+          if (context._hoverState === HoverState.SHOW) {
+            context.show();
+          }
+        }, context.config.delay.show);
+      };
+
+      _proto._leave = function _leave(event, context) {
+        var dataKey = this.constructor.DATA_KEY;
+        context = context || $$$1(event.currentTarget).data(dataKey);
+
+        if (!context) {
+          context = new this.constructor(event.currentTarget, this._getDelegateConfig());
+          $$$1(event.currentTarget).data(dataKey, context);
+        }
+
+        if (event) {
+          context._activeTrigger[event.type === 'focusout' ? Trigger.FOCUS : Trigger.HOVER] = false;
+        }
+
+        if (context._isWithActiveTrigger()) {
+          return;
+        }
+
+        clearTimeout(context._timeout);
+        context._hoverState = HoverState.OUT;
+
+        if (!context.config.delay || !context.config.delay.hide) {
+          context.hide();
+          return;
+        }
+
+        context._timeout = setTimeout(function () {
+          if (context._hoverState === HoverState.OUT) {
+            context.hide();
+          }
+        }, context.config.delay.hide);
+      };
+
+      _proto._isWithActiveTrigger = function _isWithActiveTrigger() {
+        for (var trigger in this._activeTrigger) {
+          if (this._activeTrigger[trigger]) {
+            return true;
+          }
+        }
+
+        return false;
+      };
+
+      _proto._getConfig = function _getConfig(config) {
+        config = _objectSpread({}, this.constructor.Default, $$$1(this.element).data(), typeof config === 'object' && config ? config : {});
+
+        if (typeof config.delay === 'number') {
+          config.delay = {
+            show: config.delay,
+            hide: config.delay
+          };
+        }
+
+        if (typeof config.title === 'number') {
+          config.title = config.title.toString();
+        }
+
+        if (typeof config.content === 'number') {
+          config.content = config.content.toString();
+        }
+
+        Util.typeCheckConfig(NAME, config, this.constructor.DefaultType);
+        return config;
+      };
+
+      _proto._getDelegateConfig = function _getDelegateConfig() {
+        var config = {};
+
+        if (this.config) {
+          for (var key in this.config) {
+            if (this.constructor.Default[key] !== this.config[key]) {
+              config[key] = this.config[key];
+            }
+          }
+        }
+
+        return config;
+      };
+
+      _proto._cleanTipClass = function _cleanTipClass() {
+        var $tip = $$$1(this.getTipElement());
+        var tabClass = $tip.attr('class').match(BSCLS_PREFIX_REGEX);
+
+        if (tabClass !== null && tabClass.length) {
+          $tip.removeClass(tabClass.join(''));
+        }
+      };
+
+      _proto._handlePopperPlacementChange = function _handlePopperPlacementChange(popperData) {
+        var popperInstance = popperData.instance;
+        this.tip = popperInstance.popper;
+
+        this._cleanTipClass();
+
+        this.addAttachmentClass(this._getAttachment(popperData.placement));
+      };
+
+      _proto._fixTransition = function _fixTransition() {
+        var tip = this.getTipElement();
+        var initConfigAnimation = this.config.animation;
+
+        if (tip.getAttribute('x-placement') !== null) {
+          return;
+        }
+
+        $$$1(tip).removeClass(ClassName.FADE);
+        this.config.animation = false;
+        this.hide();
+        this.show();
+        this.config.animation = initConfigAnimation;
+      }; // Static
+
+
+      Tooltip._jQueryInterface = function _jQueryInterface(config) {
+        return this.each(function () {
+          var data = $$$1(this).data(DATA_KEY);
+
+          var _config = typeof config === 'object' && config;
+
+          if (!data && /dispose|hide/.test(config)) {
+            return;
+          }
+
+          if (!data) {
+            data = new Tooltip(this, _config);
+            $$$1(this).data(DATA_KEY, data);
+          }
+
+          if (typeof config === 'string') {
+            if (typeof data[config] === 'undefined') {
+              throw new TypeError("No method named \"" + config + "\"");
+            }
+
+            data[config]();
+          }
+        });
+      };
+
+      _createClass(Tooltip, null, [{
+        key: "VERSION",
+        get: function get() {
+          return VERSION;
+        }
+      }, {
+        key: "Default",
+        get: function get() {
+          return Default;
+        }
+      }, {
+        key: "NAME",
+        get: function get() {
+          return NAME;
+        }
+      }, {
+        key: "DATA_KEY",
+        get: function get() {
+          return DATA_KEY;
+        }
+      }, {
+        key: "Event",
+        get: function get() {
+          return Event;
+        }
+      }, {
+        key: "EVENT_KEY",
+        get: function get() {
+          return EVENT_KEY;
+        }
+      }, {
+        key: "DefaultType",
+        get: function get() {
+          return DefaultType;
+        }
+      }]);
+
+      return Tooltip;
+    }();
+    /**
+     * ------------------------------------------------------------------------
+     * jQuery
+     * ------------------------------------------------------------------------
+     */
+
+
+    $$$1.fn[NAME] = Tooltip._jQueryInterface;
+    $$$1.fn[NAME].Constructor = Tooltip;
+
+    $$$1.fn[NAME].noConflict = function () {
+      $$$1.fn[NAME] = JQUERY_NO_CONFLICT;
+      return Tooltip._jQueryInterface;
+    };
+
+    return Tooltip;
+  }($, Popper);
+
+  /**
+   * --------------------------------------------------------------------------
+   * Bootstrap (v4.1.3): popover.js
+   * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE)
+   * --------------------------------------------------------------------------
+   */
+
+  var Popover = function ($$$1) {
+    /**
+     * ------------------------------------------------------------------------
+     * Constants
+     * ------------------------------------------------------------------------
+     */
+    var NAME = 'popover';
+    var VERSION = '4.1.3';
+    var DATA_KEY = 'bs.popover';
+    var EVENT_KEY = "." + DATA_KEY;
+    var JQUERY_NO_CONFLICT = $$$1.fn[NAME];
+    var CLASS_PREFIX = 'bs-popover';
+    var BSCLS_PREFIX_REGEX = new RegExp("(^|\\s)" + CLASS_PREFIX + "\\S+", 'g');
+
+    var Default = _objectSpread({}, Tooltip.Default, {
+      placement: 'right',
+      trigger: 'click',
+      content: '',
+      template: '<div class="popover" role="tooltip">' + '<div class="arrow"></div>' + '<h3 class="popover-header"></h3>' + '<div class="popover-body"></div></div>'
+    });
+
+    var DefaultType = _objectSpread({}, Tooltip.DefaultType, {
+      content: '(string|element|function)'
+    });
+
+    var ClassName = {
+      FADE: 'fade',
+      SHOW: 'show'
+    };
+    var Selector = {
+      TITLE: '.popover-header',
+      CONTENT: '.popover-body'
+    };
+    var Event = {
+      HIDE: "hide" + EVENT_KEY,
+      HIDDEN: "hidden" + EVENT_KEY,
+      SHOW: "show" + EVENT_KEY,
+      SHOWN: "shown" + EVENT_KEY,
+      INSERTED: "inserted" + EVENT_KEY,
+      CLICK: "click" + EVENT_KEY,
+      FOCUSIN: "focusin" + EVENT_KEY,
+      FOCUSOUT: "focusout" + EVENT_KEY,
+      MOUSEENTER: "mouseenter" + EVENT_KEY,
+      MOUSELEAVE: "mouseleave" + EVENT_KEY
+      /**
+       * ------------------------------------------------------------------------
+       * Class Definition
+       * ------------------------------------------------------------------------
+       */
+
+    };
+
+    var Popover =
+    /*#__PURE__*/
+    function (_Tooltip) {
+      _inheritsLoose(Popover, _Tooltip);
+
+      function Popover() {
+        return _Tooltip.apply(this, arguments) || this;
+      }
+
+      var _proto = Popover.prototype;
+
+      // Overrides
+      _proto.isWithContent = function isWithContent() {
+        return this.getTitle() || this._getContent();
+      };
+
+      _proto.addAttachmentClass = function addAttachmentClass(attachment) {
+        $$$1(this.getTipElement()).addClass(CLASS_PREFIX + "-" + attachment);
+      };
+
+      _proto.getTipElement = function getTipElement() {
+        this.tip = this.tip || $$$1(this.config.template)[0];
+        return this.tip;
+      };
+
+      _proto.setContent = function setContent() {
+        var $tip = $$$1(this.getTipElement()); // We use append for html objects to maintain js events
+
+        this.setElementContent($tip.find(Selector.TITLE), this.getTitle());
+
+        var content = this._getContent();
+
+        if (typeof content === 'function') {
+          content = content.call(this.element);
+        }
+
+        this.setElementContent($tip.find(Selector.CONTENT), content);
+        $tip.removeClass(ClassName.FADE + " " + ClassName.SHOW);
+      }; // Private
+
+
+      _proto._getContent = function _getContent() {
+        return this.element.getAttribute('data-content') || this.config.content;
+      };
+
+      _proto._cleanTipClass = function _cleanTipClass() {
+        var $tip = $$$1(this.getTipElement());
+        var tabClass = $tip.attr('class').match(BSCLS_PREFIX_REGEX);
+
+        if (tabClass !== null && tabClass.length > 0) {
+          $tip.removeClass(tabClass.join(''));
+        }
+      }; // Static
+
+
+      Popover._jQueryInterface = function _jQueryInterface(config) {
+        return this.each(function () {
+          var data = $$$1(this).data(DATA_KEY);
+
+          var _config = typeof config === 'object' ? config : null;
+
+          if (!data && /destroy|hide/.test(config)) {
+            return;
+          }
+
+          if (!data) {
+            data = new Popover(this, _config);
+            $$$1(this).data(DATA_KEY, data);
+          }
+
+          if (typeof config === 'string') {
+            if (typeof data[config] === 'undefined') {
+              throw new TypeError("No method named \"" + config + "\"");
+            }
+
+            data[config]();
+          }
+        });
+      };
+
+      _createClass(Popover, null, [{
+        key: "VERSION",
+        // Getters
+        get: function get() {
+          return VERSION;
+        }
+      }, {
+        key: "Default",
+        get: function get() {
+          return Default;
+        }
+      }, {
+        key: "NAME",
+        get: function get() {
+          return NAME;
+        }
+      }, {
+        key: "DATA_KEY",
+        get: function get() {
+          return DATA_KEY;
+        }
+      }, {
+        key: "Event",
+        get: function get() {
+          return Event;
+        }
+      }, {
+        key: "EVENT_KEY",
+        get: function get() {
+          return EVENT_KEY;
+        }
+      }, {
+        key: "DefaultType",
+        get: function get() {
+          return DefaultType;
+        }
+      }]);
+
+      return Popover;
+    }(Tooltip);
+    /**
+     * ------------------------------------------------------------------------
+     * jQuery
+     * ------------------------------------------------------------------------
+     */
+
+
+    $$$1.fn[NAME] = Popover._jQueryInterface;
+    $$$1.fn[NAME].Constructor = Popover;
+
+    $$$1.fn[NAME].noConflict = function () {
+      $$$1.fn[NAME] = JQUERY_NO_CONFLICT;
+      return Popover._jQueryInterface;
+    };
+
+    return Popover;
+  }($);
+
+  /**
+   * --------------------------------------------------------------------------
+   * Bootstrap (v4.1.3): scrollspy.js
+   * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE)
+   * --------------------------------------------------------------------------
+   */
+
+  var ScrollSpy = function ($$$1) {
+    /**
+     * ------------------------------------------------------------------------
+     * Constants
+     * ------------------------------------------------------------------------
+     */
+    var NAME = 'scrollspy';
+    var VERSION = '4.1.3';
+    var DATA_KEY = 'bs.scrollspy';
+    var EVENT_KEY = "." + DATA_KEY;
+    var DATA_API_KEY = '.data-api';
+    var JQUERY_NO_CONFLICT = $$$1.fn[NAME];
+    var Default = {
+      offset: 10,
+      method: 'auto',
+      target: ''
+    };
+    var DefaultType = {
+      offset: 'number',
+      method: 'string',
+      target: '(string|element)'
+    };
+    var Event = {
+      ACTIVATE: "activate" + EVENT_KEY,
+      SCROLL: "scroll" + EVENT_KEY,
+      LOAD_DATA_API: "load" + EVENT_KEY + DATA_API_KEY
+    };
+    var ClassName = {
+      DROPDOWN_ITEM: 'dropdown-item',
+      DROPDOWN_MENU: 'dropdown-menu',
+      ACTIVE: 'active'
+    };
+    var Selector = {
+      DATA_SPY: '[data-spy="scroll"]',
+      ACTIVE: '.active',
+      NAV_LIST_GROUP: '.nav, .list-group',
+      NAV_LINKS: '.nav-link',
+      NAV_ITEMS: '.nav-item',
+      LIST_ITEMS: '.list-group-item',
+      DROPDOWN: '.dropdown',
+      DROPDOWN_ITEMS: '.dropdown-item',
+      DROPDOWN_TOGGLE: '.dropdown-toggle'
+    };
+    var OffsetMethod = {
+      OFFSET: 'offset',
+      POSITION: 'position'
+      /**
+       * ------------------------------------------------------------------------
+       * Class Definition
+       * ------------------------------------------------------------------------
+       */
+
+    };
+
+    var ScrollSpy =
+    /*#__PURE__*/
+    function () {
+      function ScrollSpy(element, config) {
+        var _this = this;
+
+        this._element = element;
+        this._scrollElement = element.tagName === 'BODY' ? window : element;
+        this._config = this._getConfig(config);
+        this._selector = this._config.target + " " + Selector.NAV_LINKS + "," + (this._config.target + " " + Selector.LIST_ITEMS + ",") + (this._config.target + " " + Selector.DROPDOWN_ITEMS);
+        this._offsets = [];
+        this._targets = [];
+        this._activeTarget = null;
+        this._scrollHeight = 0;
+        $$$1(this._scrollElement).on(Event.SCROLL, function (event) {
+          return _this._process(event);
+        });
+        this.refresh();
+
+        this._process();
+      } // Getters
+
+
+      var _proto = ScrollSpy.prototype;
+
+      // Public
+      _proto.refresh = function refresh() {
+        var _this2 = this;
+
+        var autoMethod = this._scrollElement === this._scrollElement.window ? OffsetMethod.OFFSET : OffsetMethod.POSITION;
+        var offsetMethod = this._config.method === 'auto' ? autoMethod : this._config.method;
+        var offsetBase = offsetMethod === OffsetMethod.POSITION ? this._getScrollTop() : 0;
+        this._offsets = [];
+        this._targets = [];
+        this._scrollHeight = this._getScrollHeight();
+        var targets = [].slice.call(document.querySelectorAll(this._selector));
+        targets.map(function (element) {
+          var target;
+          var targetSelector = Util.getSelectorFromElement(element);
+
+          if (targetSelector) {
+            target = document.querySelector(targetSelector);
+          }
+
+          if (target) {
+            var targetBCR = target.getBoundingClientRect();
+
+            if (targetBCR.width || targetBCR.height) {
+              // TODO (fat): remove sketch reliance on jQuery position/offset
+              return [$$$1(target)[offsetMethod]().top + offsetBase, targetSelector];
+            }
+          }
+
+          return null;
+        }).filter(function (item) {
+          return item;
+        }).sort(function (a, b) {
+          return a[0] - b[0];
+        }).forEach(function (item) {
+          _this2._offsets.push(item[0]);
+
+          _this2._targets.push(item[1]);
+        });
+      };
+
+      _proto.dispose = function dispose() {
+        $$$1.removeData(this._element, DATA_KEY);
+        $$$1(this._scrollElement).off(EVENT_KEY);
+        this._element = null;
+        this._scrollElement = null;
+        this._config = null;
+        this._selector = null;
+        this._offsets = null;
+        this._targets = null;
+        this._activeTarget = null;
+        this._scrollHeight = null;
+      }; // Private
+
+
+      _proto._getConfig = function _getConfig(config) {
+        config = _objectSpread({}, Default, typeof config === 'object' && config ? config : {});
+
+        if (typeof config.target !== 'string') {
+          var id = $$$1(config.target).attr('id');
+
+          if (!id) {
+            id = Util.getUID(NAME);
+            $$$1(config.target).attr('id', id);
+          }
+
+          config.target = "#" + id;
+        }
+
+        Util.typeCheckConfig(NAME, config, DefaultType);
+        return config;
+      };
+
+      _proto._getScrollTop = function _getScrollTop() {
+        return this._scrollElement === window ? this._scrollElement.pageYOffset : this._scrollElement.scrollTop;
+      };
+
+      _proto._getScrollHeight = function _getScrollHeight() {
+        return this._scrollElement.scrollHeight || Math.max(document.body.scrollHeight, document.documentElement.scrollHeight);
+      };
+
+      _proto._getOffsetHeight = function _getOffsetHeight() {
+        return this._scrollElement === window ? window.innerHeight : this._scrollElement.getBoundingClientRect().height;
+      };
+
+      _proto._process = function _process() {
+        var scrollTop = this._getScrollTop() + this._config.offset;
+
+        var scrollHeight = this._getScrollHeight();
+
+        var maxScroll = this._config.offset + scrollHeight - this._getOffsetHeight();
+
+        if (this._scrollHeight !== scrollHeight) {
+          this.refresh();
+        }
+
+        if (scrollTop >= maxScroll) {
+          var target = this._targets[this._targets.length - 1];
+
+          if (this._activeTarget !== target) {
+            this._activate(target);
+          }
+
+          return;
+        }
+
+        if (this._activeTarget && scrollTop < this._offsets[0] && this._offsets[0] > 0) {
+          this._activeTarget = null;
+
+          this._clear();
+
+          return;
+        }
+
+        var offsetLength = this._offsets.length;
+
+        for (var i = offsetLength; i--;) {
+          var isActiveTarget = this._activeTarget !== this._targets[i] && scrollTop >= this._offsets[i] && (typeof this._offsets[i + 1] === 'undefined' || scrollTop < this._offsets[i + 1]);
+
+          if (isActiveTarget) {
+            this._activate(this._targets[i]);
+          }
+        }
+      };
+
+      _proto._activate = function _activate(target) {
+        this._activeTarget = target;
+
+        this._clear();
+
+        var queries = this._selector.split(','); // eslint-disable-next-line arrow-body-style
+
+
+        queries = queries.map(function (selector) {
+          return selector + "[data-target=\"" + target + "\"]," + (selector + "[href=\"" + target + "\"]");
+        });
+        var $link = $$$1([].slice.call(document.querySelectorAll(queries.join(','))));
+
+        if ($link.hasClass(ClassName.DROPDOWN_ITEM)) {
+          $link.closest(Selector.DROPDOWN).find(Selector.DROPDOWN_TOGGLE).addClass(ClassName.ACTIVE);
+          $link.addClass(ClassName.ACTIVE);
+        } else {
+          // Set triggered link as active
+          $link.addClass(ClassName.ACTIVE); // Set triggered links parents as active
+          // With both <ul> and <nav> markup a parent is the previous sibling of any nav ancestor
+
+          $link.parents(Selector.NAV_LIST_GROUP).prev(Selector.NAV_LINKS + ", " + Selector.LIST_ITEMS).addClass(ClassName.ACTIVE); // Handle special case when .nav-link is inside .nav-item
+
+          $link.parents(Selector.NAV_LIST_GROUP).prev(Selector.NAV_ITEMS).children(Selector.NAV_LINKS).addClass(ClassName.ACTIVE);
+        }
+
+        $$$1(this._scrollElement).trigger(Event.ACTIVATE, {
+          relatedTarget: target
+        });
+      };
+
+      _proto._clear = function _clear() {
+        var nodes = [].slice.call(document.querySelectorAll(this._selector));
+        $$$1(nodes).filter(Selector.ACTIVE).removeClass(ClassName.ACTIVE);
+      }; // Static
+
+
+      ScrollSpy._jQueryInterface = function _jQueryInterface(config) {
+        return this.each(function () {
+          var data = $$$1(this).data(DATA_KEY);
+
+          var _config = typeof config === 'object' && config;
+
+          if (!data) {
+            data = new ScrollSpy(this, _config);
+            $$$1(this).data(DATA_KEY, data);
+          }
+
+          if (typeof config === 'string') {
+            if (typeof data[config] === 'undefined') {
+              throw new TypeError("No method named \"" + config + "\"");
+            }
+
+            data[config]();
+          }
+        });
+      };
+
+      _createClass(ScrollSpy, null, [{
+        key: "VERSION",
+        get: function get() {
+          return VERSION;
+        }
+      }, {
+        key: "Default",
+        get: function get() {
+          return Default;
+        }
+      }]);
+
+      return ScrollSpy;
+    }();
+    /**
+     * ------------------------------------------------------------------------
+     * Data Api implementation
+     * ------------------------------------------------------------------------
+     */
+
+
+    $$$1(window).on(Event.LOAD_DATA_API, function () {
+      var scrollSpys = [].slice.call(document.querySelectorAll(Selector.DATA_SPY));
+      var scrollSpysLength = scrollSpys.length;
+
+      for (var i = scrollSpysLength; i--;) {
+        var $spy = $$$1(scrollSpys[i]);
+
+        ScrollSpy._jQueryInterface.call($spy, $spy.data());
+      }
+    });
+    /**
+     * ------------------------------------------------------------------------
+     * jQuery
+     * ------------------------------------------------------------------------
+     */
+
+    $$$1.fn[NAME] = ScrollSpy._jQueryInterface;
+    $$$1.fn[NAME].Constructor = ScrollSpy;
+
+    $$$1.fn[NAME].noConflict = function () {
+      $$$1.fn[NAME] = JQUERY_NO_CONFLICT;
+      return ScrollSpy._jQueryInterface;
+    };
+
+    return ScrollSpy;
+  }($);
+
+  /**
+   * --------------------------------------------------------------------------
+   * Bootstrap (v4.1.3): tab.js
+   * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE)
+   * --------------------------------------------------------------------------
+   */
+
+  var Tab = function ($$$1) {
+    /**
+     * ------------------------------------------------------------------------
+     * Constants
+     * ------------------------------------------------------------------------
+     */
+    var NAME = 'tab';
+    var VERSION = '4.1.3';
+    var DATA_KEY = 'bs.tab';
+    var EVENT_KEY = "." + DATA_KEY;
+    var DATA_API_KEY = '.data-api';
+    var JQUERY_NO_CONFLICT = $$$1.fn[NAME];
+    var Event = {
+      HIDE: "hide" + EVENT_KEY,
+      HIDDEN: "hidden" + EVENT_KEY,
+      SHOW: "show" + EVENT_KEY,
+      SHOWN: "shown" + EVENT_KEY,
+      CLICK_DATA_API: "click" + EVENT_KEY + DATA_API_KEY
+    };
+    var ClassName = {
+      DROPDOWN_MENU: 'dropdown-menu',
+      ACTIVE: 'active',
+      DISABLED: 'disabled',
+      FADE: 'fade',
+      SHOW: 'show'
+    };
+    var Selector = {
+      DROPDOWN: '.dropdown',
+      NAV_LIST_GROUP: '.nav, .list-group',
+      ACTIVE: '.active',
+      ACTIVE_UL: '> li > .active',
+      DATA_TOGGLE: '[data-toggle="tab"], [data-toggle="pill"], [data-toggle="list"]',
+      DROPDOWN_TOGGLE: '.dropdown-toggle',
+      DROPDOWN_ACTIVE_CHILD: '> .dropdown-menu .active'
+      /**
+       * ------------------------------------------------------------------------
+       * Class Definition
+       * ------------------------------------------------------------------------
+       */
+
+    };
+
+    var Tab =
+    /*#__PURE__*/
+    function () {
+      function Tab(element) {
+        this._element = element;
+      } // Getters
+
+
+      var _proto = Tab.prototype;
+
+      // Public
+      _proto.show = function show() {
+        var _this = this;
+
+        if (this._element.parentNode && this._element.parentNode.nodeType === Node.ELEMENT_NODE && $$$1(this._element).hasClass(ClassName.ACTIVE) || $$$1(this._element).hasClass(ClassName.DISABLED)) {
+          return;
+        }
+
+        var target;
+        var previous;
+        var listElement = $$$1(this._element).closest(Selector.NAV_LIST_GROUP)[0];
+        var selector = Util.getSelectorFromElement(this._element);
+
+        if (listElement) {
+          var itemSelector = listElement.nodeName === 'UL' ? Selector.ACTIVE_UL : Selector.ACTIVE;
+          previous = $$$1.makeArray($$$1(listElement).find(itemSelector));
+          previous = previous[previous.length - 1];
+        }
+
+        var hideEvent = $$$1.Event(Event.HIDE, {
+          relatedTarget: this._element
+        });
+        var showEvent = $$$1.Event(Event.SHOW, {
+          relatedTarget: previous
+        });
+
+        if (previous) {
+          $$$1(previous).trigger(hideEvent);
+        }
+
+        $$$1(this._element).trigger(showEvent);
+
+        if (showEvent.isDefaultPrevented() || hideEvent.isDefaultPrevented()) {
+          return;
+        }
+
+        if (selector) {
+          target = document.querySelector(selector);
+        }
+
+        this._activate(this._element, listElement);
+
+        var complete = function complete() {
+          var hiddenEvent = $$$1.Event(Event.HIDDEN, {
+            relatedTarget: _this._element
+          });
+          var shownEvent = $$$1.Event(Event.SHOWN, {
+            relatedTarget: previous
+          });
+          $$$1(previous).trigger(hiddenEvent);
+          $$$1(_this._element).trigger(shownEvent);
+        };
+
+        if (target) {
+          this._activate(target, target.parentNode, complete);
+        } else {
+          complete();
+        }
+      };
+
+      _proto.dispose = function dispose() {
+        $$$1.removeData(this._element, DATA_KEY);
+        this._element = null;
+      }; // Private
+
+
+      _proto._activate = function _activate(element, container, callback) {
+        var _this2 = this;
+
+        var activeElements;
+
+        if (container.nodeName === 'UL') {
+          activeElements = $$$1(container).find(Selector.ACTIVE_UL);
+        } else {
+          activeElements = $$$1(container).children(Selector.ACTIVE);
+        }
+
+        var active = activeElements[0];
+        var isTransitioning = callback && active && $$$1(active).hasClass(ClassName.FADE);
+
+        var complete = function complete() {
+          return _this2._transitionComplete(element, active, callback);
+        };
+
+        if (active && isTransitioning) {
+          var transitionDuration = Util.getTransitionDurationFromElement(active);
+          $$$1(active).one(Util.TRANSITION_END, complete).emulateTransitionEnd(transitionDuration);
+        } else {
+          complete();
+        }
+      };
+
+      _proto._transitionComplete = function _transitionComplete(element, active, callback) {
+        if (active) {
+          $$$1(active).removeClass(ClassName.SHOW + " " + ClassName.ACTIVE);
+          var dropdownChild = $$$1(active.parentNode).find(Selector.DROPDOWN_ACTIVE_CHILD)[0];
+
+          if (dropdownChild) {
+            $$$1(dropdownChild).removeClass(ClassName.ACTIVE);
+          }
+
+          if (active.getAttribute('role') === 'tab') {
+            active.setAttribute('aria-selected', false);
+          }
+        }
+
+        $$$1(element).addClass(ClassName.ACTIVE);
+
+        if (element.getAttribute('role') === 'tab') {
+          element.setAttribute('aria-selected', true);
+        }
+
+        Util.reflow(element);
+        $$$1(element).addClass(ClassName.SHOW);
+
+        if (element.parentNode && $$$1(element.parentNode).hasClass(ClassName.DROPDOWN_MENU)) {
+          var dropdownElement = $$$1(element).closest(Selector.DROPDOWN)[0];
+
+          if (dropdownElement) {
+            var dropdownToggleList = [].slice.call(dropdownElement.querySelectorAll(Selector.DROPDOWN_TOGGLE));
+            $$$1(dropdownToggleList).addClass(ClassName.ACTIVE);
+          }
+
+          element.setAttribute('aria-expanded', true);
+        }
+
+        if (callback) {
+          callback();
+        }
+      }; // Static
+
+
+      Tab._jQueryInterface = function _jQueryInterface(config) {
+        return this.each(function () {
+          var $this = $$$1(this);
+          var data = $this.data(DATA_KEY);
+
+          if (!data) {
+            data = new Tab(this);
+            $this.data(DATA_KEY, data);
+          }
+
+          if (typeof config === 'string') {
+            if (typeof data[config] === 'undefined') {
+              throw new TypeError("No method named \"" + config + "\"");
+            }
+
+            data[config]();
+          }
+        });
+      };
+
+      _createClass(Tab, null, [{
+        key: "VERSION",
+        get: function get() {
+          return VERSION;
+        }
+      }]);
+
+      return Tab;
+    }();
+    /**
+     * ------------------------------------------------------------------------
+     * Data Api implementation
+     * ------------------------------------------------------------------------
+     */
+
+
+    $$$1(document).on(Event.CLICK_DATA_API, Selector.DATA_TOGGLE, function (event) {
+      event.preventDefault();
+
+      Tab._jQueryInterface.call($$$1(this), 'show');
+    });
+    /**
+     * ------------------------------------------------------------------------
+     * jQuery
+     * ------------------------------------------------------------------------
+     */
+
+    $$$1.fn[NAME] = Tab._jQueryInterface;
+    $$$1.fn[NAME].Constructor = Tab;
+
+    $$$1.fn[NAME].noConflict = function () {
+      $$$1.fn[NAME] = JQUERY_NO_CONFLICT;
+      return Tab._jQueryInterface;
+    };
+
+    return Tab;
+  }($);
+
+  /**
+   * --------------------------------------------------------------------------
+   * Bootstrap (v4.1.3): index.js
+   * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE)
+   * --------------------------------------------------------------------------
+   */
+
+  (function ($$$1) {
+    if (typeof $$$1 === 'undefined') {
+      throw new TypeError('Bootstrap\'s JavaScript requires jQuery. jQuery must be included before Bootstrap\'s JavaScript.');
+    }
+
+    var version = $$$1.fn.jquery.split(' ')[0].split('.');
+    var minMajor = 1;
+    var ltMajor = 2;
+    var minMinor = 9;
+    var minPatch = 1;
+    var maxMajor = 4;
+
+    if (version[0] < ltMajor && version[1] < minMinor || version[0] === minMajor && version[1] === minMinor && version[2] < minPatch || version[0] >= maxMajor) {
+      throw new Error('Bootstrap\'s JavaScript requires at least jQuery v1.9.1 but less than v4.0.0');
+    }
+  })($);
+
+  exports.Util = Util;
+  exports.Alert = Alert;
+  exports.Button = Button;
+  exports.Carousel = Carousel;
+  exports.Collapse = Collapse;
+  exports.Dropdown = Dropdown;
+  exports.Modal = Modal;
+  exports.Popover = Popover;
+  exports.Scrollspy = ScrollSpy;
+  exports.Tab = Tab;
+  exports.Tooltip = Tooltip;
+
+  Object.defineProperty(exports, '__esModule', { value: true });
+
+})));
+//# sourceMappingURL=bootstrap.bundle.js.map
diff --git a/ee/bulk-operations-dashboard/assets/dependencies/bootstrap-4/bootstrap-4.css b/ee/bulk-operations-dashboard/assets/dependencies/bootstrap-4/bootstrap-4.css
new file mode 100644
index 0000000000..943532db55
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/dependencies/bootstrap-4/bootstrap-4.css
@@ -0,0 +1,9030 @@
+/*!
+ * Bootstrap v4.1.3 (https://getbootstrap.com/)
+ * Copyright 2011-2018 The Bootstrap Authors
+ * Copyright 2011-2018 Twitter, Inc.
+ * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE)
+ */
+:root {
+  --blue: #007bff;
+  --indigo: #6610f2;
+  --purple: #6f42c1;
+  --pink: #e83e8c;
+  --red: #dc3545;
+  --orange: #fd7e14;
+  --yellow: #ffc107;
+  --green: #28a745;
+  --teal: #20c997;
+  --cyan: #17a2b8;
+  --white: #fff;
+  --gray: #6c757d;
+  --gray-dark: #343a40;
+  --primary: #007bff;
+  --secondary: #6c757d;
+  --success: #28a745;
+  --info: #17a2b8;
+  --warning: #ffc107;
+  --danger: #dc3545;
+  --light: #f8f9fa;
+  --dark: #343a40;
+  --breakpoint-xs: 0;
+  --breakpoint-sm: 576px;
+  --breakpoint-md: 768px;
+  --breakpoint-lg: 992px;
+  --breakpoint-xl: 1200px;
+  --font-family-sans-serif: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji";
+  --font-family-monospace: SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", "Courier New", monospace;
+}
+
+*,
+*::before,
+*::after {
+  box-sizing: border-box;
+}
+
+html {
+  font-family: sans-serif;
+  line-height: 1.15;
+  -webkit-text-size-adjust: 100%;
+  -ms-text-size-adjust: 100%;
+  -ms-overflow-style: scrollbar;
+  -webkit-tap-highlight-color: rgba(0, 0, 0, 0);
+}
+
+@-ms-viewport {
+  width: device-width;
+}
+
+article, aside, figcaption, figure, footer, header, hgroup, main, nav, section {
+  display: block;
+}
+
+body {
+  margin: 0;
+  font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji";
+  font-size: 1rem;
+  font-weight: 400;
+  line-height: 1.5;
+  color: #212529;
+  text-align: left;
+  background-color: #fff;
+}
+
+[tabindex="-1"]:focus {
+  outline: 0 !important;
+}
+
+hr {
+  box-sizing: content-box;
+  height: 0;
+  overflow: visible;
+}
+
+h1, h2, h3, h4, h5, h6 {
+  margin-top: 0;
+  margin-bottom: 0.5rem;
+}
+
+p {
+  margin-top: 0;
+  margin-bottom: 1rem;
+}
+
+abbr[title],
+abbr[data-original-title] {
+  text-decoration: underline;
+  -webkit-text-decoration: underline dotted;
+  text-decoration: underline dotted;
+  cursor: help;
+  border-bottom: 0;
+}
+
+address {
+  margin-bottom: 1rem;
+  font-style: normal;
+  line-height: inherit;
+}
+
+ol,
+ul,
+dl {
+  margin-top: 0;
+  margin-bottom: 1rem;
+}
+
+ol ol,
+ul ul,
+ol ul,
+ul ol {
+  margin-bottom: 0;
+}
+
+dt {
+  font-weight: 700;
+}
+
+dd {
+  margin-bottom: .5rem;
+  margin-left: 0;
+}
+
+blockquote {
+  margin: 0 0 1rem;
+}
+
+dfn {
+  font-style: italic;
+}
+
+b,
+strong {
+  font-weight: bolder;
+}
+
+small {
+  font-size: 80%;
+}
+
+sub,
+sup {
+  position: relative;
+  font-size: 75%;
+  line-height: 0;
+  vertical-align: baseline;
+}
+
+sub {
+  bottom: -.25em;
+}
+
+sup {
+  top: -.5em;
+}
+
+a {
+  color: #007bff;
+  text-decoration: none;
+  background-color: transparent;
+  -webkit-text-decoration-skip: objects;
+}
+
+a:hover {
+  color: #0056b3;
+  text-decoration: underline;
+}
+
+a:not([href]):not([tabindex]) {
+  color: inherit;
+  text-decoration: none;
+}
+
+a:not([href]):not([tabindex]):hover, a:not([href]):not([tabindex]):focus {
+  color: inherit;
+  text-decoration: none;
+}
+
+a:not([href]):not([tabindex]):focus {
+  outline: 0;
+}
+
+pre,
+code,
+kbd,
+samp {
+  font-family: SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", "Courier New", monospace;
+  font-size: 1em;
+}
+
+pre {
+  margin-top: 0;
+  margin-bottom: 1rem;
+  overflow: auto;
+  -ms-overflow-style: scrollbar;
+}
+
+figure {
+  margin: 0 0 1rem;
+}
+
+img {
+  vertical-align: middle;
+  border-style: none;
+}
+
+svg {
+  overflow: hidden;
+  vertical-align: middle;
+}
+
+table {
+  border-collapse: collapse;
+}
+
+caption {
+  padding-top: 0.75rem;
+  padding-bottom: 0.75rem;
+  color: #6c757d;
+  text-align: left;
+  caption-side: bottom;
+}
+
+th {
+  text-align: inherit;
+}
+
+label {
+  display: inline-block;
+  margin-bottom: 0.5rem;
+}
+
+button {
+  border-radius: 0;
+}
+
+button:focus {
+  outline: 1px dotted;
+  outline: 5px auto -webkit-focus-ring-color;
+}
+
+input,
+button,
+select,
+optgroup,
+textarea {
+  margin: 0;
+  font-family: inherit;
+  font-size: inherit;
+  line-height: inherit;
+}
+
+button,
+input {
+  overflow: visible;
+}
+
+button,
+select {
+  text-transform: none;
+}
+
+button,
+html [type="button"],
+[type="reset"],
+[type="submit"] {
+  -webkit-appearance: button;
+}
+
+button::-moz-focus-inner,
+[type="button"]::-moz-focus-inner,
+[type="reset"]::-moz-focus-inner,
+[type="submit"]::-moz-focus-inner {
+  padding: 0;
+  border-style: none;
+}
+
+input[type="radio"],
+input[type="checkbox"] {
+  box-sizing: border-box;
+  padding: 0;
+}
+
+input[type="date"],
+input[type="time"],
+input[type="datetime-local"],
+input[type="month"] {
+  -webkit-appearance: listbox;
+}
+
+textarea {
+  overflow: auto;
+  resize: vertical;
+}
+
+fieldset {
+  min-width: 0;
+  padding: 0;
+  margin: 0;
+  border: 0;
+}
+
+legend {
+  display: block;
+  width: 100%;
+  max-width: 100%;
+  padding: 0;
+  margin-bottom: .5rem;
+  font-size: 1.5rem;
+  line-height: inherit;
+  color: inherit;
+  white-space: normal;
+}
+
+progress {
+  vertical-align: baseline;
+}
+
+[type="number"]::-webkit-inner-spin-button,
+[type="number"]::-webkit-outer-spin-button {
+  height: auto;
+}
+
+[type="search"] {
+  outline-offset: -2px;
+  -webkit-appearance: none;
+}
+
+[type="search"]::-webkit-search-cancel-button,
+[type="search"]::-webkit-search-decoration {
+  -webkit-appearance: none;
+}
+
+::-webkit-file-upload-button {
+  font: inherit;
+  -webkit-appearance: button;
+}
+
+output {
+  display: inline-block;
+}
+
+summary {
+  display: list-item;
+  cursor: pointer;
+}
+
+template {
+  display: none;
+}
+
+[hidden] {
+  display: none !important;
+}
+
+h1, h2, h3, h4, h5, h6,
+.h1, .h2, .h3, .h4, .h5, .h6 {
+  margin-bottom: 0.5rem;
+  font-family: inherit;
+  font-weight: 500;
+  line-height: 1.2;
+  color: inherit;
+}
+
+h1, .h1 {
+  font-size: 2.5rem;
+}
+
+h2, .h2 {
+  font-size: 2rem;
+}
+
+h3, .h3 {
+  font-size: 1.75rem;
+}
+
+h4, .h4 {
+  font-size: 1.5rem;
+}
+
+h5, .h5 {
+  font-size: 1.25rem;
+}
+
+h6, .h6 {
+  font-size: 1rem;
+}
+
+.lead {
+  font-size: 1.25rem;
+  font-weight: 300;
+}
+
+.display-1 {
+  font-size: 6rem;
+  font-weight: 300;
+  line-height: 1.2;
+}
+
+.display-2 {
+  font-size: 5.5rem;
+  font-weight: 300;
+  line-height: 1.2;
+}
+
+.display-3 {
+  font-size: 4.5rem;
+  font-weight: 300;
+  line-height: 1.2;
+}
+
+.display-4 {
+  font-size: 3.5rem;
+  font-weight: 300;
+  line-height: 1.2;
+}
+
+hr {
+  margin-top: 1rem;
+  margin-bottom: 1rem;
+  border: 0;
+  border-top: 1px solid rgba(0, 0, 0, 0.1);
+}
+
+small,
+.small {
+  font-size: 80%;
+  font-weight: 400;
+}
+
+mark,
+.mark {
+  padding: 0.2em;
+  background-color: #fcf8e3;
+}
+
+.list-unstyled {
+  padding-left: 0;
+  list-style: none;
+}
+
+.list-inline {
+  padding-left: 0;
+  list-style: none;
+}
+
+.list-inline-item {
+  display: inline-block;
+}
+
+.list-inline-item:not(:last-child) {
+  margin-right: 0.5rem;
+}
+
+.initialism {
+  font-size: 90%;
+  text-transform: uppercase;
+}
+
+.blockquote {
+  margin-bottom: 1rem;
+  font-size: 1.25rem;
+}
+
+.blockquote-footer {
+  display: block;
+  font-size: 80%;
+  color: #6c757d;
+}
+
+.blockquote-footer::before {
+  content: "\2014 \00A0";
+}
+
+.img-fluid {
+  max-width: 100%;
+  height: auto;
+}
+
+.img-thumbnail {
+  padding: 0.25rem;
+  background-color: #fff;
+  border: 1px solid #dee2e6;
+  border-radius: 0.25rem;
+  max-width: 100%;
+  height: auto;
+}
+
+.figure {
+  display: inline-block;
+}
+
+.figure-img {
+  margin-bottom: 0.5rem;
+  line-height: 1;
+}
+
+.figure-caption {
+  font-size: 90%;
+  color: #6c757d;
+}
+
+code {
+  font-size: 87.5%;
+  color: #e83e8c;
+  word-break: break-word;
+}
+
+a > code {
+  color: inherit;
+}
+
+kbd {
+  padding: 0.2rem 0.4rem;
+  font-size: 87.5%;
+  color: #fff;
+  background-color: #212529;
+  border-radius: 0.2rem;
+}
+
+kbd kbd {
+  padding: 0;
+  font-size: 100%;
+  font-weight: 700;
+}
+
+pre {
+  display: block;
+  font-size: 87.5%;
+  color: #212529;
+}
+
+pre code {
+  font-size: inherit;
+  color: inherit;
+  word-break: normal;
+}
+
+.pre-scrollable {
+  max-height: 340px;
+  overflow-y: scroll;
+}
+
+.container {
+  width: 100%;
+  padding-right: 15px;
+  padding-left: 15px;
+  margin-right: auto;
+  margin-left: auto;
+}
+
+@media (min-width: 576px) {
+  .container {
+    max-width: 540px;
+  }
+}
+
+@media (min-width: 768px) {
+  .container {
+    max-width: 720px;
+  }
+}
+
+@media (min-width: 992px) {
+  .container {
+    max-width: 960px;
+  }
+}
+
+@media (min-width: 1200px) {
+  .container {
+    max-width: 1140px;
+  }
+}
+
+.container-fluid {
+  width: 100%;
+  padding-right: 15px;
+  padding-left: 15px;
+  margin-right: auto;
+  margin-left: auto;
+}
+
+.row {
+  display: -ms-flexbox;
+  display: flex;
+  -ms-flex-wrap: wrap;
+  flex-wrap: wrap;
+  margin-right: -15px;
+  margin-left: -15px;
+}
+
+.no-gutters {
+  margin-right: 0;
+  margin-left: 0;
+}
+
+.no-gutters > .col,
+.no-gutters > [class*="col-"] {
+  padding-right: 0;
+  padding-left: 0;
+}
+
+.col-1, .col-2, .col-3, .col-4, .col-5, .col-6, .col-7, .col-8, .col-9, .col-10, .col-11, .col-12, .col,
+.col-auto, .col-sm-1, .col-sm-2, .col-sm-3, .col-sm-4, .col-sm-5, .col-sm-6, .col-sm-7, .col-sm-8, .col-sm-9, .col-sm-10, .col-sm-11, .col-sm-12, .col-sm,
+.col-sm-auto, .col-md-1, .col-md-2, .col-md-3, .col-md-4, .col-md-5, .col-md-6, .col-md-7, .col-md-8, .col-md-9, .col-md-10, .col-md-11, .col-md-12, .col-md,
+.col-md-auto, .col-lg-1, .col-lg-2, .col-lg-3, .col-lg-4, .col-lg-5, .col-lg-6, .col-lg-7, .col-lg-8, .col-lg-9, .col-lg-10, .col-lg-11, .col-lg-12, .col-lg,
+.col-lg-auto, .col-xl-1, .col-xl-2, .col-xl-3, .col-xl-4, .col-xl-5, .col-xl-6, .col-xl-7, .col-xl-8, .col-xl-9, .col-xl-10, .col-xl-11, .col-xl-12, .col-xl,
+.col-xl-auto {
+  position: relative;
+  width: 100%;
+  min-height: 1px;
+  padding-right: 15px;
+  padding-left: 15px;
+}
+
+.col {
+  -ms-flex-preferred-size: 0;
+  flex-basis: 0;
+  -ms-flex-positive: 1;
+  flex-grow: 1;
+  max-width: 100%;
+}
+
+.col-auto {
+  -ms-flex: 0 0 auto;
+  flex: 0 0 auto;
+  width: auto;
+  max-width: none;
+}
+
+.col-1 {
+  -ms-flex: 0 0 8.333333%;
+  flex: 0 0 8.333333%;
+  max-width: 8.333333%;
+}
+
+.col-2 {
+  -ms-flex: 0 0 16.666667%;
+  flex: 0 0 16.666667%;
+  max-width: 16.666667%;
+}
+
+.col-3 {
+  -ms-flex: 0 0 25%;
+  flex: 0 0 25%;
+  max-width: 25%;
+}
+
+.col-4 {
+  -ms-flex: 0 0 33.333333%;
+  flex: 0 0 33.333333%;
+  max-width: 33.333333%;
+}
+
+.col-5 {
+  -ms-flex: 0 0 41.666667%;
+  flex: 0 0 41.666667%;
+  max-width: 41.666667%;
+}
+
+.col-6 {
+  -ms-flex: 0 0 50%;
+  flex: 0 0 50%;
+  max-width: 50%;
+}
+
+.col-7 {
+  -ms-flex: 0 0 58.333333%;
+  flex: 0 0 58.333333%;
+  max-width: 58.333333%;
+}
+
+.col-8 {
+  -ms-flex: 0 0 66.666667%;
+  flex: 0 0 66.666667%;
+  max-width: 66.666667%;
+}
+
+.col-9 {
+  -ms-flex: 0 0 75%;
+  flex: 0 0 75%;
+  max-width: 75%;
+}
+
+.col-10 {
+  -ms-flex: 0 0 83.333333%;
+  flex: 0 0 83.333333%;
+  max-width: 83.333333%;
+}
+
+.col-11 {
+  -ms-flex: 0 0 91.666667%;
+  flex: 0 0 91.666667%;
+  max-width: 91.666667%;
+}
+
+.col-12 {
+  -ms-flex: 0 0 100%;
+  flex: 0 0 100%;
+  max-width: 100%;
+}
+
+.order-first {
+  -ms-flex-order: -1;
+  order: -1;
+}
+
+.order-last {
+  -ms-flex-order: 13;
+  order: 13;
+}
+
+.order-0 {
+  -ms-flex-order: 0;
+  order: 0;
+}
+
+.order-1 {
+  -ms-flex-order: 1;
+  order: 1;
+}
+
+.order-2 {
+  -ms-flex-order: 2;
+  order: 2;
+}
+
+.order-3 {
+  -ms-flex-order: 3;
+  order: 3;
+}
+
+.order-4 {
+  -ms-flex-order: 4;
+  order: 4;
+}
+
+.order-5 {
+  -ms-flex-order: 5;
+  order: 5;
+}
+
+.order-6 {
+  -ms-flex-order: 6;
+  order: 6;
+}
+
+.order-7 {
+  -ms-flex-order: 7;
+  order: 7;
+}
+
+.order-8 {
+  -ms-flex-order: 8;
+  order: 8;
+}
+
+.order-9 {
+  -ms-flex-order: 9;
+  order: 9;
+}
+
+.order-10 {
+  -ms-flex-order: 10;
+  order: 10;
+}
+
+.order-11 {
+  -ms-flex-order: 11;
+  order: 11;
+}
+
+.order-12 {
+  -ms-flex-order: 12;
+  order: 12;
+}
+
+.offset-1 {
+  margin-left: 8.333333%;
+}
+
+.offset-2 {
+  margin-left: 16.666667%;
+}
+
+.offset-3 {
+  margin-left: 25%;
+}
+
+.offset-4 {
+  margin-left: 33.333333%;
+}
+
+.offset-5 {
+  margin-left: 41.666667%;
+}
+
+.offset-6 {
+  margin-left: 50%;
+}
+
+.offset-7 {
+  margin-left: 58.333333%;
+}
+
+.offset-8 {
+  margin-left: 66.666667%;
+}
+
+.offset-9 {
+  margin-left: 75%;
+}
+
+.offset-10 {
+  margin-left: 83.333333%;
+}
+
+.offset-11 {
+  margin-left: 91.666667%;
+}
+
+@media (min-width: 576px) {
+  .col-sm {
+    -ms-flex-preferred-size: 0;
+    flex-basis: 0;
+    -ms-flex-positive: 1;
+    flex-grow: 1;
+    max-width: 100%;
+  }
+  .col-sm-auto {
+    -ms-flex: 0 0 auto;
+    flex: 0 0 auto;
+    width: auto;
+    max-width: none;
+  }
+  .col-sm-1 {
+    -ms-flex: 0 0 8.333333%;
+    flex: 0 0 8.333333%;
+    max-width: 8.333333%;
+  }
+  .col-sm-2 {
+    -ms-flex: 0 0 16.666667%;
+    flex: 0 0 16.666667%;
+    max-width: 16.666667%;
+  }
+  .col-sm-3 {
+    -ms-flex: 0 0 25%;
+    flex: 0 0 25%;
+    max-width: 25%;
+  }
+  .col-sm-4 {
+    -ms-flex: 0 0 33.333333%;
+    flex: 0 0 33.333333%;
+    max-width: 33.333333%;
+  }
+  .col-sm-5 {
+    -ms-flex: 0 0 41.666667%;
+    flex: 0 0 41.666667%;
+    max-width: 41.666667%;
+  }
+  .col-sm-6 {
+    -ms-flex: 0 0 50%;
+    flex: 0 0 50%;
+    max-width: 50%;
+  }
+  .col-sm-7 {
+    -ms-flex: 0 0 58.333333%;
+    flex: 0 0 58.333333%;
+    max-width: 58.333333%;
+  }
+  .col-sm-8 {
+    -ms-flex: 0 0 66.666667%;
+    flex: 0 0 66.666667%;
+    max-width: 66.666667%;
+  }
+  .col-sm-9 {
+    -ms-flex: 0 0 75%;
+    flex: 0 0 75%;
+    max-width: 75%;
+  }
+  .col-sm-10 {
+    -ms-flex: 0 0 83.333333%;
+    flex: 0 0 83.333333%;
+    max-width: 83.333333%;
+  }
+  .col-sm-11 {
+    -ms-flex: 0 0 91.666667%;
+    flex: 0 0 91.666667%;
+    max-width: 91.666667%;
+  }
+  .col-sm-12 {
+    -ms-flex: 0 0 100%;
+    flex: 0 0 100%;
+    max-width: 100%;
+  }
+  .order-sm-first {
+    -ms-flex-order: -1;
+    order: -1;
+  }
+  .order-sm-last {
+    -ms-flex-order: 13;
+    order: 13;
+  }
+  .order-sm-0 {
+    -ms-flex-order: 0;
+    order: 0;
+  }
+  .order-sm-1 {
+    -ms-flex-order: 1;
+    order: 1;
+  }
+  .order-sm-2 {
+    -ms-flex-order: 2;
+    order: 2;
+  }
+  .order-sm-3 {
+    -ms-flex-order: 3;
+    order: 3;
+  }
+  .order-sm-4 {
+    -ms-flex-order: 4;
+    order: 4;
+  }
+  .order-sm-5 {
+    -ms-flex-order: 5;
+    order: 5;
+  }
+  .order-sm-6 {
+    -ms-flex-order: 6;
+    order: 6;
+  }
+  .order-sm-7 {
+    -ms-flex-order: 7;
+    order: 7;
+  }
+  .order-sm-8 {
+    -ms-flex-order: 8;
+    order: 8;
+  }
+  .order-sm-9 {
+    -ms-flex-order: 9;
+    order: 9;
+  }
+  .order-sm-10 {
+    -ms-flex-order: 10;
+    order: 10;
+  }
+  .order-sm-11 {
+    -ms-flex-order: 11;
+    order: 11;
+  }
+  .order-sm-12 {
+    -ms-flex-order: 12;
+    order: 12;
+  }
+  .offset-sm-0 {
+    margin-left: 0;
+  }
+  .offset-sm-1 {
+    margin-left: 8.333333%;
+  }
+  .offset-sm-2 {
+    margin-left: 16.666667%;
+  }
+  .offset-sm-3 {
+    margin-left: 25%;
+  }
+  .offset-sm-4 {
+    margin-left: 33.333333%;
+  }
+  .offset-sm-5 {
+    margin-left: 41.666667%;
+  }
+  .offset-sm-6 {
+    margin-left: 50%;
+  }
+  .offset-sm-7 {
+    margin-left: 58.333333%;
+  }
+  .offset-sm-8 {
+    margin-left: 66.666667%;
+  }
+  .offset-sm-9 {
+    margin-left: 75%;
+  }
+  .offset-sm-10 {
+    margin-left: 83.333333%;
+  }
+  .offset-sm-11 {
+    margin-left: 91.666667%;
+  }
+}
+
+@media (min-width: 768px) {
+  .col-md {
+    -ms-flex-preferred-size: 0;
+    flex-basis: 0;
+    -ms-flex-positive: 1;
+    flex-grow: 1;
+    max-width: 100%;
+  }
+  .col-md-auto {
+    -ms-flex: 0 0 auto;
+    flex: 0 0 auto;
+    width: auto;
+    max-width: none;
+  }
+  .col-md-1 {
+    -ms-flex: 0 0 8.333333%;
+    flex: 0 0 8.333333%;
+    max-width: 8.333333%;
+  }
+  .col-md-2 {
+    -ms-flex: 0 0 16.666667%;
+    flex: 0 0 16.666667%;
+    max-width: 16.666667%;
+  }
+  .col-md-3 {
+    -ms-flex: 0 0 25%;
+    flex: 0 0 25%;
+    max-width: 25%;
+  }
+  .col-md-4 {
+    -ms-flex: 0 0 33.333333%;
+    flex: 0 0 33.333333%;
+    max-width: 33.333333%;
+  }
+  .col-md-5 {
+    -ms-flex: 0 0 41.666667%;
+    flex: 0 0 41.666667%;
+    max-width: 41.666667%;
+  }
+  .col-md-6 {
+    -ms-flex: 0 0 50%;
+    flex: 0 0 50%;
+    max-width: 50%;
+  }
+  .col-md-7 {
+    -ms-flex: 0 0 58.333333%;
+    flex: 0 0 58.333333%;
+    max-width: 58.333333%;
+  }
+  .col-md-8 {
+    -ms-flex: 0 0 66.666667%;
+    flex: 0 0 66.666667%;
+    max-width: 66.666667%;
+  }
+  .col-md-9 {
+    -ms-flex: 0 0 75%;
+    flex: 0 0 75%;
+    max-width: 75%;
+  }
+  .col-md-10 {
+    -ms-flex: 0 0 83.333333%;
+    flex: 0 0 83.333333%;
+    max-width: 83.333333%;
+  }
+  .col-md-11 {
+    -ms-flex: 0 0 91.666667%;
+    flex: 0 0 91.666667%;
+    max-width: 91.666667%;
+  }
+  .col-md-12 {
+    -ms-flex: 0 0 100%;
+    flex: 0 0 100%;
+    max-width: 100%;
+  }
+  .order-md-first {
+    -ms-flex-order: -1;
+    order: -1;
+  }
+  .order-md-last {
+    -ms-flex-order: 13;
+    order: 13;
+  }
+  .order-md-0 {
+    -ms-flex-order: 0;
+    order: 0;
+  }
+  .order-md-1 {
+    -ms-flex-order: 1;
+    order: 1;
+  }
+  .order-md-2 {
+    -ms-flex-order: 2;
+    order: 2;
+  }
+  .order-md-3 {
+    -ms-flex-order: 3;
+    order: 3;
+  }
+  .order-md-4 {
+    -ms-flex-order: 4;
+    order: 4;
+  }
+  .order-md-5 {
+    -ms-flex-order: 5;
+    order: 5;
+  }
+  .order-md-6 {
+    -ms-flex-order: 6;
+    order: 6;
+  }
+  .order-md-7 {
+    -ms-flex-order: 7;
+    order: 7;
+  }
+  .order-md-8 {
+    -ms-flex-order: 8;
+    order: 8;
+  }
+  .order-md-9 {
+    -ms-flex-order: 9;
+    order: 9;
+  }
+  .order-md-10 {
+    -ms-flex-order: 10;
+    order: 10;
+  }
+  .order-md-11 {
+    -ms-flex-order: 11;
+    order: 11;
+  }
+  .order-md-12 {
+    -ms-flex-order: 12;
+    order: 12;
+  }
+  .offset-md-0 {
+    margin-left: 0;
+  }
+  .offset-md-1 {
+    margin-left: 8.333333%;
+  }
+  .offset-md-2 {
+    margin-left: 16.666667%;
+  }
+  .offset-md-3 {
+    margin-left: 25%;
+  }
+  .offset-md-4 {
+    margin-left: 33.333333%;
+  }
+  .offset-md-5 {
+    margin-left: 41.666667%;
+  }
+  .offset-md-6 {
+    margin-left: 50%;
+  }
+  .offset-md-7 {
+    margin-left: 58.333333%;
+  }
+  .offset-md-8 {
+    margin-left: 66.666667%;
+  }
+  .offset-md-9 {
+    margin-left: 75%;
+  }
+  .offset-md-10 {
+    margin-left: 83.333333%;
+  }
+  .offset-md-11 {
+    margin-left: 91.666667%;
+  }
+}
+
+@media (min-width: 992px) {
+  .col-lg {
+    -ms-flex-preferred-size: 0;
+    flex-basis: 0;
+    -ms-flex-positive: 1;
+    flex-grow: 1;
+    max-width: 100%;
+  }
+  .col-lg-auto {
+    -ms-flex: 0 0 auto;
+    flex: 0 0 auto;
+    width: auto;
+    max-width: none;
+  }
+  .col-lg-1 {
+    -ms-flex: 0 0 8.333333%;
+    flex: 0 0 8.333333%;
+    max-width: 8.333333%;
+  }
+  .col-lg-2 {
+    -ms-flex: 0 0 16.666667%;
+    flex: 0 0 16.666667%;
+    max-width: 16.666667%;
+  }
+  .col-lg-3 {
+    -ms-flex: 0 0 25%;
+    flex: 0 0 25%;
+    max-width: 25%;
+  }
+  .col-lg-4 {
+    -ms-flex: 0 0 33.333333%;
+    flex: 0 0 33.333333%;
+    max-width: 33.333333%;
+  }
+  .col-lg-5 {
+    -ms-flex: 0 0 41.666667%;
+    flex: 0 0 41.666667%;
+    max-width: 41.666667%;
+  }
+  .col-lg-6 {
+    -ms-flex: 0 0 50%;
+    flex: 0 0 50%;
+    max-width: 50%;
+  }
+  .col-lg-7 {
+    -ms-flex: 0 0 58.333333%;
+    flex: 0 0 58.333333%;
+    max-width: 58.333333%;
+  }
+  .col-lg-8 {
+    -ms-flex: 0 0 66.666667%;
+    flex: 0 0 66.666667%;
+    max-width: 66.666667%;
+  }
+  .col-lg-9 {
+    -ms-flex: 0 0 75%;
+    flex: 0 0 75%;
+    max-width: 75%;
+  }
+  .col-lg-10 {
+    -ms-flex: 0 0 83.333333%;
+    flex: 0 0 83.333333%;
+    max-width: 83.333333%;
+  }
+  .col-lg-11 {
+    -ms-flex: 0 0 91.666667%;
+    flex: 0 0 91.666667%;
+    max-width: 91.666667%;
+  }
+  .col-lg-12 {
+    -ms-flex: 0 0 100%;
+    flex: 0 0 100%;
+    max-width: 100%;
+  }
+  .order-lg-first {
+    -ms-flex-order: -1;
+    order: -1;
+  }
+  .order-lg-last {
+    -ms-flex-order: 13;
+    order: 13;
+  }
+  .order-lg-0 {
+    -ms-flex-order: 0;
+    order: 0;
+  }
+  .order-lg-1 {
+    -ms-flex-order: 1;
+    order: 1;
+  }
+  .order-lg-2 {
+    -ms-flex-order: 2;
+    order: 2;
+  }
+  .order-lg-3 {
+    -ms-flex-order: 3;
+    order: 3;
+  }
+  .order-lg-4 {
+    -ms-flex-order: 4;
+    order: 4;
+  }
+  .order-lg-5 {
+    -ms-flex-order: 5;
+    order: 5;
+  }
+  .order-lg-6 {
+    -ms-flex-order: 6;
+    order: 6;
+  }
+  .order-lg-7 {
+    -ms-flex-order: 7;
+    order: 7;
+  }
+  .order-lg-8 {
+    -ms-flex-order: 8;
+    order: 8;
+  }
+  .order-lg-9 {
+    -ms-flex-order: 9;
+    order: 9;
+  }
+  .order-lg-10 {
+    -ms-flex-order: 10;
+    order: 10;
+  }
+  .order-lg-11 {
+    -ms-flex-order: 11;
+    order: 11;
+  }
+  .order-lg-12 {
+    -ms-flex-order: 12;
+    order: 12;
+  }
+  .offset-lg-0 {
+    margin-left: 0;
+  }
+  .offset-lg-1 {
+    margin-left: 8.333333%;
+  }
+  .offset-lg-2 {
+    margin-left: 16.666667%;
+  }
+  .offset-lg-3 {
+    margin-left: 25%;
+  }
+  .offset-lg-4 {
+    margin-left: 33.333333%;
+  }
+  .offset-lg-5 {
+    margin-left: 41.666667%;
+  }
+  .offset-lg-6 {
+    margin-left: 50%;
+  }
+  .offset-lg-7 {
+    margin-left: 58.333333%;
+  }
+  .offset-lg-8 {
+    margin-left: 66.666667%;
+  }
+  .offset-lg-9 {
+    margin-left: 75%;
+  }
+  .offset-lg-10 {
+    margin-left: 83.333333%;
+  }
+  .offset-lg-11 {
+    margin-left: 91.666667%;
+  }
+}
+
+@media (min-width: 1200px) {
+  .col-xl {
+    -ms-flex-preferred-size: 0;
+    flex-basis: 0;
+    -ms-flex-positive: 1;
+    flex-grow: 1;
+    max-width: 100%;
+  }
+  .col-xl-auto {
+    -ms-flex: 0 0 auto;
+    flex: 0 0 auto;
+    width: auto;
+    max-width: none;
+  }
+  .col-xl-1 {
+    -ms-flex: 0 0 8.333333%;
+    flex: 0 0 8.333333%;
+    max-width: 8.333333%;
+  }
+  .col-xl-2 {
+    -ms-flex: 0 0 16.666667%;
+    flex: 0 0 16.666667%;
+    max-width: 16.666667%;
+  }
+  .col-xl-3 {
+    -ms-flex: 0 0 25%;
+    flex: 0 0 25%;
+    max-width: 25%;
+  }
+  .col-xl-4 {
+    -ms-flex: 0 0 33.333333%;
+    flex: 0 0 33.333333%;
+    max-width: 33.333333%;
+  }
+  .col-xl-5 {
+    -ms-flex: 0 0 41.666667%;
+    flex: 0 0 41.666667%;
+    max-width: 41.666667%;
+  }
+  .col-xl-6 {
+    -ms-flex: 0 0 50%;
+    flex: 0 0 50%;
+    max-width: 50%;
+  }
+  .col-xl-7 {
+    -ms-flex: 0 0 58.333333%;
+    flex: 0 0 58.333333%;
+    max-width: 58.333333%;
+  }
+  .col-xl-8 {
+    -ms-flex: 0 0 66.666667%;
+    flex: 0 0 66.666667%;
+    max-width: 66.666667%;
+  }
+  .col-xl-9 {
+    -ms-flex: 0 0 75%;
+    flex: 0 0 75%;
+    max-width: 75%;
+  }
+  .col-xl-10 {
+    -ms-flex: 0 0 83.333333%;
+    flex: 0 0 83.333333%;
+    max-width: 83.333333%;
+  }
+  .col-xl-11 {
+    -ms-flex: 0 0 91.666667%;
+    flex: 0 0 91.666667%;
+    max-width: 91.666667%;
+  }
+  .col-xl-12 {
+    -ms-flex: 0 0 100%;
+    flex: 0 0 100%;
+    max-width: 100%;
+  }
+  .order-xl-first {
+    -ms-flex-order: -1;
+    order: -1;
+  }
+  .order-xl-last {
+    -ms-flex-order: 13;
+    order: 13;
+  }
+  .order-xl-0 {
+    -ms-flex-order: 0;
+    order: 0;
+  }
+  .order-xl-1 {
+    -ms-flex-order: 1;
+    order: 1;
+  }
+  .order-xl-2 {
+    -ms-flex-order: 2;
+    order: 2;
+  }
+  .order-xl-3 {
+    -ms-flex-order: 3;
+    order: 3;
+  }
+  .order-xl-4 {
+    -ms-flex-order: 4;
+    order: 4;
+  }
+  .order-xl-5 {
+    -ms-flex-order: 5;
+    order: 5;
+  }
+  .order-xl-6 {
+    -ms-flex-order: 6;
+    order: 6;
+  }
+  .order-xl-7 {
+    -ms-flex-order: 7;
+    order: 7;
+  }
+  .order-xl-8 {
+    -ms-flex-order: 8;
+    order: 8;
+  }
+  .order-xl-9 {
+    -ms-flex-order: 9;
+    order: 9;
+  }
+  .order-xl-10 {
+    -ms-flex-order: 10;
+    order: 10;
+  }
+  .order-xl-11 {
+    -ms-flex-order: 11;
+    order: 11;
+  }
+  .order-xl-12 {
+    -ms-flex-order: 12;
+    order: 12;
+  }
+  .offset-xl-0 {
+    margin-left: 0;
+  }
+  .offset-xl-1 {
+    margin-left: 8.333333%;
+  }
+  .offset-xl-2 {
+    margin-left: 16.666667%;
+  }
+  .offset-xl-3 {
+    margin-left: 25%;
+  }
+  .offset-xl-4 {
+    margin-left: 33.333333%;
+  }
+  .offset-xl-5 {
+    margin-left: 41.666667%;
+  }
+  .offset-xl-6 {
+    margin-left: 50%;
+  }
+  .offset-xl-7 {
+    margin-left: 58.333333%;
+  }
+  .offset-xl-8 {
+    margin-left: 66.666667%;
+  }
+  .offset-xl-9 {
+    margin-left: 75%;
+  }
+  .offset-xl-10 {
+    margin-left: 83.333333%;
+  }
+  .offset-xl-11 {
+    margin-left: 91.666667%;
+  }
+}
+
+.table {
+  width: 100%;
+  margin-bottom: 1rem;
+  background-color: transparent;
+}
+
+.table th,
+.table td {
+  padding: 0.75rem;
+  vertical-align: top;
+  border-top: 1px solid #dee2e6;
+}
+
+.table thead th {
+  vertical-align: bottom;
+  border-bottom: 2px solid #dee2e6;
+}
+
+.table tbody + tbody {
+  border-top: 2px solid #dee2e6;
+}
+
+.table .table {
+  background-color: #fff;
+}
+
+.table-sm th,
+.table-sm td {
+  padding: 0.3rem;
+}
+
+.table-bordered {
+  border: 1px solid #dee2e6;
+}
+
+.table-bordered th,
+.table-bordered td {
+  border: 1px solid #dee2e6;
+}
+
+.table-bordered thead th,
+.table-bordered thead td {
+  border-bottom-width: 2px;
+}
+
+.table-borderless th,
+.table-borderless td,
+.table-borderless thead th,
+.table-borderless tbody + tbody {
+  border: 0;
+}
+
+.table-striped tbody tr:nth-of-type(odd) {
+  background-color: rgba(0, 0, 0, 0.05);
+}
+
+.table-hover tbody tr:hover {
+  background-color: rgba(0, 0, 0, 0.075);
+}
+
+.table-primary,
+.table-primary > th,
+.table-primary > td {
+  background-color: #b8daff;
+}
+
+.table-hover .table-primary:hover {
+  background-color: #9fcdff;
+}
+
+.table-hover .table-primary:hover > td,
+.table-hover .table-primary:hover > th {
+  background-color: #9fcdff;
+}
+
+.table-secondary,
+.table-secondary > th,
+.table-secondary > td {
+  background-color: #d6d8db;
+}
+
+.table-hover .table-secondary:hover {
+  background-color: #c8cbcf;
+}
+
+.table-hover .table-secondary:hover > td,
+.table-hover .table-secondary:hover > th {
+  background-color: #c8cbcf;
+}
+
+.table-success,
+.table-success > th,
+.table-success > td {
+  background-color: #c3e6cb;
+}
+
+.table-hover .table-success:hover {
+  background-color: #b1dfbb;
+}
+
+.table-hover .table-success:hover > td,
+.table-hover .table-success:hover > th {
+  background-color: #b1dfbb;
+}
+
+.table-info,
+.table-info > th,
+.table-info > td {
+  background-color: #bee5eb;
+}
+
+.table-hover .table-info:hover {
+  background-color: #abdde5;
+}
+
+.table-hover .table-info:hover > td,
+.table-hover .table-info:hover > th {
+  background-color: #abdde5;
+}
+
+.table-warning,
+.table-warning > th,
+.table-warning > td {
+  background-color: #ffeeba;
+}
+
+.table-hover .table-warning:hover {
+  background-color: #ffe8a1;
+}
+
+.table-hover .table-warning:hover > td,
+.table-hover .table-warning:hover > th {
+  background-color: #ffe8a1;
+}
+
+.table-danger,
+.table-danger > th,
+.table-danger > td {
+  background-color: #f5c6cb;
+}
+
+.table-hover .table-danger:hover {
+  background-color: #f1b0b7;
+}
+
+.table-hover .table-danger:hover > td,
+.table-hover .table-danger:hover > th {
+  background-color: #f1b0b7;
+}
+
+.table-light,
+.table-light > th,
+.table-light > td {
+  background-color: #fdfdfe;
+}
+
+.table-hover .table-light:hover {
+  background-color: #ececf6;
+}
+
+.table-hover .table-light:hover > td,
+.table-hover .table-light:hover > th {
+  background-color: #ececf6;
+}
+
+.table-dark,
+.table-dark > th,
+.table-dark > td {
+  background-color: #c6c8ca;
+}
+
+.table-hover .table-dark:hover {
+  background-color: #b9bbbe;
+}
+
+.table-hover .table-dark:hover > td,
+.table-hover .table-dark:hover > th {
+  background-color: #b9bbbe;
+}
+
+.table-active,
+.table-active > th,
+.table-active > td {
+  background-color: rgba(0, 0, 0, 0.075);
+}
+
+.table-hover .table-active:hover {
+  background-color: rgba(0, 0, 0, 0.075);
+}
+
+.table-hover .table-active:hover > td,
+.table-hover .table-active:hover > th {
+  background-color: rgba(0, 0, 0, 0.075);
+}
+
+.table .thead-dark th {
+  color: #fff;
+  background-color: #212529;
+  border-color: #32383e;
+}
+
+.table .thead-light th {
+  color: #495057;
+  background-color: #e9ecef;
+  border-color: #dee2e6;
+}
+
+.table-dark {
+  color: #fff;
+  background-color: #212529;
+}
+
+.table-dark th,
+.table-dark td,
+.table-dark thead th {
+  border-color: #32383e;
+}
+
+.table-dark.table-bordered {
+  border: 0;
+}
+
+.table-dark.table-striped tbody tr:nth-of-type(odd) {
+  background-color: rgba(255, 255, 255, 0.05);
+}
+
+.table-dark.table-hover tbody tr:hover {
+  background-color: rgba(255, 255, 255, 0.075);
+}
+
+@media (max-width: 575.98px) {
+  .table-responsive-sm {
+    display: block;
+    width: 100%;
+    overflow-x: auto;
+    -webkit-overflow-scrolling: touch;
+    -ms-overflow-style: -ms-autohiding-scrollbar;
+  }
+  .table-responsive-sm > .table-bordered {
+    border: 0;
+  }
+}
+
+@media (max-width: 767.98px) {
+  .table-responsive-md {
+    display: block;
+    width: 100%;
+    overflow-x: auto;
+    -webkit-overflow-scrolling: touch;
+    -ms-overflow-style: -ms-autohiding-scrollbar;
+  }
+  .table-responsive-md > .table-bordered {
+    border: 0;
+  }
+}
+
+@media (max-width: 991.98px) {
+  .table-responsive-lg {
+    display: block;
+    width: 100%;
+    overflow-x: auto;
+    -webkit-overflow-scrolling: touch;
+    -ms-overflow-style: -ms-autohiding-scrollbar;
+  }
+  .table-responsive-lg > .table-bordered {
+    border: 0;
+  }
+}
+
+@media (max-width: 1199.98px) {
+  .table-responsive-xl {
+    display: block;
+    width: 100%;
+    overflow-x: auto;
+    -webkit-overflow-scrolling: touch;
+    -ms-overflow-style: -ms-autohiding-scrollbar;
+  }
+  .table-responsive-xl > .table-bordered {
+    border: 0;
+  }
+}
+
+.table-responsive {
+  display: block;
+  width: 100%;
+  overflow-x: auto;
+  -webkit-overflow-scrolling: touch;
+  -ms-overflow-style: -ms-autohiding-scrollbar;
+}
+
+.table-responsive > .table-bordered {
+  border: 0;
+}
+
+.form-control {
+  display: block;
+  width: 100%;
+  height: calc(2.25rem + 2px);
+  padding: 0.375rem 0.75rem;
+  font-size: 1rem;
+  line-height: 1.5;
+  color: #495057;
+  background-color: #fff;
+  background-clip: padding-box;
+  border: 1px solid #ced4da;
+  border-radius: 0.25rem;
+  transition: border-color 0.15s ease-in-out, box-shadow 0.15s ease-in-out;
+}
+
+@media screen and (prefers-reduced-motion: reduce) {
+  .form-control {
+    transition: none;
+  }
+}
+
+.form-control::-ms-expand {
+  background-color: transparent;
+  border: 0;
+}
+
+.form-control:focus {
+  color: #495057;
+  background-color: #fff;
+  border-color: #80bdff;
+  outline: 0;
+  box-shadow: 0 0 0 0.2rem rgba(0, 123, 255, 0.25);
+}
+
+.form-control::-webkit-input-placeholder {
+  color: #6c757d;
+  opacity: 1;
+}
+
+.form-control::-moz-placeholder {
+  color: #6c757d;
+  opacity: 1;
+}
+
+.form-control:-ms-input-placeholder {
+  color: #6c757d;
+  opacity: 1;
+}
+
+.form-control::-ms-input-placeholder {
+  color: #6c757d;
+  opacity: 1;
+}
+
+.form-control::placeholder {
+  color: #6c757d;
+  opacity: 1;
+}
+
+.form-control:disabled, .form-control[readonly] {
+  background-color: #e9ecef;
+  opacity: 1;
+}
+
+select.form-control:focus::-ms-value {
+  color: #495057;
+  background-color: #fff;
+}
+
+.form-control-file,
+.form-control-range {
+  display: block;
+  width: 100%;
+}
+
+.col-form-label {
+  padding-top: calc(0.375rem + 1px);
+  padding-bottom: calc(0.375rem + 1px);
+  margin-bottom: 0;
+  font-size: inherit;
+  line-height: 1.5;
+}
+
+.col-form-label-lg {
+  padding-top: calc(0.5rem + 1px);
+  padding-bottom: calc(0.5rem + 1px);
+  font-size: 1.25rem;
+  line-height: 1.5;
+}
+
+.col-form-label-sm {
+  padding-top: calc(0.25rem + 1px);
+  padding-bottom: calc(0.25rem + 1px);
+  font-size: 0.875rem;
+  line-height: 1.5;
+}
+
+.form-control-plaintext {
+  display: block;
+  width: 100%;
+  padding-top: 0.375rem;
+  padding-bottom: 0.375rem;
+  margin-bottom: 0;
+  line-height: 1.5;
+  color: #212529;
+  background-color: transparent;
+  border: solid transparent;
+  border-width: 1px 0;
+}
+
+.form-control-plaintext.form-control-sm, .form-control-plaintext.form-control-lg {
+  padding-right: 0;
+  padding-left: 0;
+}
+
+.form-control-sm {
+  height: calc(1.8125rem + 2px);
+  padding: 0.25rem 0.5rem;
+  font-size: 0.875rem;
+  line-height: 1.5;
+  border-radius: 0.2rem;
+}
+
+.form-control-lg {
+  height: calc(2.875rem + 2px);
+  padding: 0.5rem 1rem;
+  font-size: 1.25rem;
+  line-height: 1.5;
+  border-radius: 0.3rem;
+}
+
+select.form-control[size], select.form-control[multiple] {
+  height: auto;
+}
+
+textarea.form-control {
+  height: auto;
+}
+
+.form-group {
+  margin-bottom: 1rem;
+}
+
+.form-text {
+  display: block;
+  margin-top: 0.25rem;
+}
+
+.form-row {
+  display: -ms-flexbox;
+  display: flex;
+  -ms-flex-wrap: wrap;
+  flex-wrap: wrap;
+  margin-right: -5px;
+  margin-left: -5px;
+}
+
+.form-row > .col,
+.form-row > [class*="col-"] {
+  padding-right: 5px;
+  padding-left: 5px;
+}
+
+.form-check {
+  position: relative;
+  display: block;
+  padding-left: 1.25rem;
+}
+
+.form-check-input {
+  position: absolute;
+  margin-top: 0.3rem;
+  margin-left: -1.25rem;
+}
+
+.form-check-input:disabled ~ .form-check-label {
+  color: #6c757d;
+}
+
+.form-check-label {
+  margin-bottom: 0;
+}
+
+.form-check-inline {
+  display: -ms-inline-flexbox;
+  display: inline-flex;
+  -ms-flex-align: center;
+  align-items: center;
+  padding-left: 0;
+  margin-right: 0.75rem;
+}
+
+.form-check-inline .form-check-input {
+  position: static;
+  margin-top: 0;
+  margin-right: 0.3125rem;
+  margin-left: 0;
+}
+
+.valid-feedback {
+  display: none;
+  width: 100%;
+  margin-top: 0.25rem;
+  font-size: 80%;
+  color: #28a745;
+}
+
+.valid-tooltip {
+  position: absolute;
+  top: 100%;
+  z-index: 5;
+  display: none;
+  max-width: 100%;
+  padding: 0.25rem 0.5rem;
+  margin-top: .1rem;
+  font-size: 0.875rem;
+  line-height: 1.5;
+  color: #fff;
+  background-color: rgba(40, 167, 69, 0.9);
+  border-radius: 0.25rem;
+}
+
+.was-validated .form-control:valid, .form-control.is-valid, .was-validated
+.custom-select:valid,
+.custom-select.is-valid {
+  border-color: #28a745;
+}
+
+.was-validated .form-control:valid:focus, .form-control.is-valid:focus, .was-validated
+.custom-select:valid:focus,
+.custom-select.is-valid:focus {
+  border-color: #28a745;
+  box-shadow: 0 0 0 0.2rem rgba(40, 167, 69, 0.25);
+}
+
+.was-validated .form-control:valid ~ .valid-feedback,
+.was-validated .form-control:valid ~ .valid-tooltip, .form-control.is-valid ~ .valid-feedback,
+.form-control.is-valid ~ .valid-tooltip, .was-validated
+.custom-select:valid ~ .valid-feedback,
+.was-validated
+.custom-select:valid ~ .valid-tooltip,
+.custom-select.is-valid ~ .valid-feedback,
+.custom-select.is-valid ~ .valid-tooltip {
+  display: block;
+}
+
+.was-validated .form-control-file:valid ~ .valid-feedback,
+.was-validated .form-control-file:valid ~ .valid-tooltip, .form-control-file.is-valid ~ .valid-feedback,
+.form-control-file.is-valid ~ .valid-tooltip {
+  display: block;
+}
+
+.was-validated .form-check-input:valid ~ .form-check-label, .form-check-input.is-valid ~ .form-check-label {
+  color: #28a745;
+}
+
+.was-validated .form-check-input:valid ~ .valid-feedback,
+.was-validated .form-check-input:valid ~ .valid-tooltip, .form-check-input.is-valid ~ .valid-feedback,
+.form-check-input.is-valid ~ .valid-tooltip {
+  display: block;
+}
+
+.was-validated .custom-control-input:valid ~ .custom-control-label, .custom-control-input.is-valid ~ .custom-control-label {
+  color: #28a745;
+}
+
+.was-validated .custom-control-input:valid ~ .custom-control-label::before, .custom-control-input.is-valid ~ .custom-control-label::before {
+  background-color: #71dd8a;
+}
+
+.was-validated .custom-control-input:valid ~ .valid-feedback,
+.was-validated .custom-control-input:valid ~ .valid-tooltip, .custom-control-input.is-valid ~ .valid-feedback,
+.custom-control-input.is-valid ~ .valid-tooltip {
+  display: block;
+}
+
+.was-validated .custom-control-input:valid:checked ~ .custom-control-label::before, .custom-control-input.is-valid:checked ~ .custom-control-label::before {
+  background-color: #34ce57;
+}
+
+.was-validated .custom-control-input:valid:focus ~ .custom-control-label::before, .custom-control-input.is-valid:focus ~ .custom-control-label::before {
+  box-shadow: 0 0 0 1px #fff, 0 0 0 0.2rem rgba(40, 167, 69, 0.25);
+}
+
+.was-validated .custom-file-input:valid ~ .custom-file-label, .custom-file-input.is-valid ~ .custom-file-label {
+  border-color: #28a745;
+}
+
+.was-validated .custom-file-input:valid ~ .custom-file-label::after, .custom-file-input.is-valid ~ .custom-file-label::after {
+  border-color: inherit;
+}
+
+.was-validated .custom-file-input:valid ~ .valid-feedback,
+.was-validated .custom-file-input:valid ~ .valid-tooltip, .custom-file-input.is-valid ~ .valid-feedback,
+.custom-file-input.is-valid ~ .valid-tooltip {
+  display: block;
+}
+
+.was-validated .custom-file-input:valid:focus ~ .custom-file-label, .custom-file-input.is-valid:focus ~ .custom-file-label {
+  box-shadow: 0 0 0 0.2rem rgba(40, 167, 69, 0.25);
+}
+
+.invalid-feedback {
+  display: none;
+  width: 100%;
+  margin-top: 0.25rem;
+  font-size: 80%;
+  color: #dc3545;
+}
+
+.invalid-tooltip {
+  position: absolute;
+  top: 100%;
+  z-index: 5;
+  display: none;
+  max-width: 100%;
+  padding: 0.25rem 0.5rem;
+  margin-top: .1rem;
+  font-size: 0.875rem;
+  line-height: 1.5;
+  color: #fff;
+  background-color: rgba(220, 53, 69, 0.9);
+  border-radius: 0.25rem;
+}
+
+.was-validated .form-control:invalid, .form-control.is-invalid, .was-validated
+.custom-select:invalid,
+.custom-select.is-invalid {
+  border-color: #dc3545;
+}
+
+.was-validated .form-control:invalid:focus, .form-control.is-invalid:focus, .was-validated
+.custom-select:invalid:focus,
+.custom-select.is-invalid:focus {
+  border-color: #dc3545;
+  box-shadow: 0 0 0 0.2rem rgba(220, 53, 69, 0.25);
+}
+
+.was-validated .form-control:invalid ~ .invalid-feedback,
+.was-validated .form-control:invalid ~ .invalid-tooltip, .form-control.is-invalid ~ .invalid-feedback,
+.form-control.is-invalid ~ .invalid-tooltip, .was-validated
+.custom-select:invalid ~ .invalid-feedback,
+.was-validated
+.custom-select:invalid ~ .invalid-tooltip,
+.custom-select.is-invalid ~ .invalid-feedback,
+.custom-select.is-invalid ~ .invalid-tooltip {
+  display: block;
+}
+
+.was-validated .form-control-file:invalid ~ .invalid-feedback,
+.was-validated .form-control-file:invalid ~ .invalid-tooltip, .form-control-file.is-invalid ~ .invalid-feedback,
+.form-control-file.is-invalid ~ .invalid-tooltip {
+  display: block;
+}
+
+.was-validated .form-check-input:invalid ~ .form-check-label, .form-check-input.is-invalid ~ .form-check-label {
+  color: #dc3545;
+}
+
+.was-validated .form-check-input:invalid ~ .invalid-feedback,
+.was-validated .form-check-input:invalid ~ .invalid-tooltip, .form-check-input.is-invalid ~ .invalid-feedback,
+.form-check-input.is-invalid ~ .invalid-tooltip {
+  display: block;
+}
+
+.was-validated .custom-control-input:invalid ~ .custom-control-label, .custom-control-input.is-invalid ~ .custom-control-label {
+  color: #dc3545;
+}
+
+.was-validated .custom-control-input:invalid ~ .custom-control-label::before, .custom-control-input.is-invalid ~ .custom-control-label::before {
+  background-color: #efa2a9;
+}
+
+.was-validated .custom-control-input:invalid ~ .invalid-feedback,
+.was-validated .custom-control-input:invalid ~ .invalid-tooltip, .custom-control-input.is-invalid ~ .invalid-feedback,
+.custom-control-input.is-invalid ~ .invalid-tooltip {
+  display: block;
+}
+
+.was-validated .custom-control-input:invalid:checked ~ .custom-control-label::before, .custom-control-input.is-invalid:checked ~ .custom-control-label::before {
+  background-color: #e4606d;
+}
+
+.was-validated .custom-control-input:invalid:focus ~ .custom-control-label::before, .custom-control-input.is-invalid:focus ~ .custom-control-label::before {
+  box-shadow: 0 0 0 1px #fff, 0 0 0 0.2rem rgba(220, 53, 69, 0.25);
+}
+
+.was-validated .custom-file-input:invalid ~ .custom-file-label, .custom-file-input.is-invalid ~ .custom-file-label {
+  border-color: #dc3545;
+}
+
+.was-validated .custom-file-input:invalid ~ .custom-file-label::after, .custom-file-input.is-invalid ~ .custom-file-label::after {
+  border-color: inherit;
+}
+
+.was-validated .custom-file-input:invalid ~ .invalid-feedback,
+.was-validated .custom-file-input:invalid ~ .invalid-tooltip, .custom-file-input.is-invalid ~ .invalid-feedback,
+.custom-file-input.is-invalid ~ .invalid-tooltip {
+  display: block;
+}
+
+.was-validated .custom-file-input:invalid:focus ~ .custom-file-label, .custom-file-input.is-invalid:focus ~ .custom-file-label {
+  box-shadow: 0 0 0 0.2rem rgba(220, 53, 69, 0.25);
+}
+
+.form-inline {
+  display: -ms-flexbox;
+  display: flex;
+  -ms-flex-flow: row wrap;
+  flex-flow: row wrap;
+  -ms-flex-align: center;
+  align-items: center;
+}
+
+.form-inline .form-check {
+  width: 100%;
+}
+
+@media (min-width: 576px) {
+  .form-inline label {
+    display: -ms-flexbox;
+    display: flex;
+    -ms-flex-align: center;
+    align-items: center;
+    -ms-flex-pack: center;
+    justify-content: center;
+    margin-bottom: 0;
+  }
+  .form-inline .form-group {
+    display: -ms-flexbox;
+    display: flex;
+    -ms-flex: 0 0 auto;
+    flex: 0 0 auto;
+    -ms-flex-flow: row wrap;
+    flex-flow: row wrap;
+    -ms-flex-align: center;
+    align-items: center;
+    margin-bottom: 0;
+  }
+  .form-inline .form-control {
+    display: inline-block;
+    width: auto;
+    vertical-align: middle;
+  }
+  .form-inline .form-control-plaintext {
+    display: inline-block;
+  }
+  .form-inline .input-group,
+  .form-inline .custom-select {
+    width: auto;
+  }
+  .form-inline .form-check {
+    display: -ms-flexbox;
+    display: flex;
+    -ms-flex-align: center;
+    align-items: center;
+    -ms-flex-pack: center;
+    justify-content: center;
+    width: auto;
+    padding-left: 0;
+  }
+  .form-inline .form-check-input {
+    position: relative;
+    margin-top: 0;
+    margin-right: 0.25rem;
+    margin-left: 0;
+  }
+  .form-inline .custom-control {
+    -ms-flex-align: center;
+    align-items: center;
+    -ms-flex-pack: center;
+    justify-content: center;
+  }
+  .form-inline .custom-control-label {
+    margin-bottom: 0;
+  }
+}
+
+.btn {
+  display: inline-block;
+  font-weight: 400;
+  text-align: center;
+  white-space: nowrap;
+  vertical-align: middle;
+  -webkit-user-select: none;
+  -moz-user-select: none;
+  -ms-user-select: none;
+  user-select: none;
+  border: 1px solid transparent;
+  padding: 0.375rem 0.75rem;
+  font-size: 1rem;
+  line-height: 1.5;
+  border-radius: 0.25rem;
+  transition: color 0.15s ease-in-out, background-color 0.15s ease-in-out, border-color 0.15s ease-in-out, box-shadow 0.15s ease-in-out;
+}
+
+@media screen and (prefers-reduced-motion: reduce) {
+  .btn {
+    transition: none;
+  }
+}
+
+.btn:hover, .btn:focus {
+  text-decoration: none;
+}
+
+.btn:focus, .btn.focus {
+  outline: 0;
+  box-shadow: 0 0 0 0.2rem rgba(0, 123, 255, 0.25);
+}
+
+.btn.disabled, .btn:disabled {
+  opacity: 0.65;
+}
+
+.btn:not(:disabled):not(.disabled) {
+  cursor: pointer;
+}
+
+a.btn.disabled,
+fieldset:disabled a.btn {
+  pointer-events: none;
+}
+
+.btn-primary {
+  color: #fff;
+  background-color: #007bff;
+  border-color: #007bff;
+}
+
+.btn-primary:hover {
+  color: #fff;
+  background-color: #0069d9;
+  border-color: #0062cc;
+}
+
+.btn-primary:focus, .btn-primary.focus {
+  box-shadow: 0 0 0 0.2rem rgba(0, 123, 255, 0.5);
+}
+
+.btn-primary.disabled, .btn-primary:disabled {
+  color: #fff;
+  background-color: #007bff;
+  border-color: #007bff;
+}
+
+.btn-primary:not(:disabled):not(.disabled):active, .btn-primary:not(:disabled):not(.disabled).active,
+.show > .btn-primary.dropdown-toggle {
+  color: #fff;
+  background-color: #0062cc;
+  border-color: #005cbf;
+}
+
+.btn-primary:not(:disabled):not(.disabled):active:focus, .btn-primary:not(:disabled):not(.disabled).active:focus,
+.show > .btn-primary.dropdown-toggle:focus {
+  box-shadow: 0 0 0 0.2rem rgba(0, 123, 255, 0.5);
+}
+
+.btn-secondary {
+  color: #fff;
+  background-color: #6c757d;
+  border-color: #6c757d;
+}
+
+.btn-secondary:hover {
+  color: #fff;
+  background-color: #5a6268;
+  border-color: #545b62;
+}
+
+.btn-secondary:focus, .btn-secondary.focus {
+  box-shadow: 0 0 0 0.2rem rgba(108, 117, 125, 0.5);
+}
+
+.btn-secondary.disabled, .btn-secondary:disabled {
+  color: #fff;
+  background-color: #6c757d;
+  border-color: #6c757d;
+}
+
+.btn-secondary:not(:disabled):not(.disabled):active, .btn-secondary:not(:disabled):not(.disabled).active,
+.show > .btn-secondary.dropdown-toggle {
+  color: #fff;
+  background-color: #545b62;
+  border-color: #4e555b;
+}
+
+.btn-secondary:not(:disabled):not(.disabled):active:focus, .btn-secondary:not(:disabled):not(.disabled).active:focus,
+.show > .btn-secondary.dropdown-toggle:focus {
+  box-shadow: 0 0 0 0.2rem rgba(108, 117, 125, 0.5);
+}
+
+.btn-success {
+  color: #fff;
+  background-color: #28a745;
+  border-color: #28a745;
+}
+
+.btn-success:hover {
+  color: #fff;
+  background-color: #218838;
+  border-color: #1e7e34;
+}
+
+.btn-success:focus, .btn-success.focus {
+  box-shadow: 0 0 0 0.2rem rgba(40, 167, 69, 0.5);
+}
+
+.btn-success.disabled, .btn-success:disabled {
+  color: #fff;
+  background-color: #28a745;
+  border-color: #28a745;
+}
+
+.btn-success:not(:disabled):not(.disabled):active, .btn-success:not(:disabled):not(.disabled).active,
+.show > .btn-success.dropdown-toggle {
+  color: #fff;
+  background-color: #1e7e34;
+  border-color: #1c7430;
+}
+
+.btn-success:not(:disabled):not(.disabled):active:focus, .btn-success:not(:disabled):not(.disabled).active:focus,
+.show > .btn-success.dropdown-toggle:focus {
+  box-shadow: 0 0 0 0.2rem rgba(40, 167, 69, 0.5);
+}
+
+.btn-info {
+  color: #fff;
+  background-color: #17a2b8;
+  border-color: #17a2b8;
+}
+
+.btn-info:hover {
+  color: #fff;
+  background-color: #138496;
+  border-color: #117a8b;
+}
+
+.btn-info:focus, .btn-info.focus {
+  box-shadow: 0 0 0 0.2rem rgba(23, 162, 184, 0.5);
+}
+
+.btn-info.disabled, .btn-info:disabled {
+  color: #fff;
+  background-color: #17a2b8;
+  border-color: #17a2b8;
+}
+
+.btn-info:not(:disabled):not(.disabled):active, .btn-info:not(:disabled):not(.disabled).active,
+.show > .btn-info.dropdown-toggle {
+  color: #fff;
+  background-color: #117a8b;
+  border-color: #10707f;
+}
+
+.btn-info:not(:disabled):not(.disabled):active:focus, .btn-info:not(:disabled):not(.disabled).active:focus,
+.show > .btn-info.dropdown-toggle:focus {
+  box-shadow: 0 0 0 0.2rem rgba(23, 162, 184, 0.5);
+}
+
+.btn-warning {
+  color: #212529;
+  background-color: #ffc107;
+  border-color: #ffc107;
+}
+
+.btn-warning:hover {
+  color: #212529;
+  background-color: #e0a800;
+  border-color: #d39e00;
+}
+
+.btn-warning:focus, .btn-warning.focus {
+  box-shadow: 0 0 0 0.2rem rgba(255, 193, 7, 0.5);
+}
+
+.btn-warning.disabled, .btn-warning:disabled {
+  color: #212529;
+  background-color: #ffc107;
+  border-color: #ffc107;
+}
+
+.btn-warning:not(:disabled):not(.disabled):active, .btn-warning:not(:disabled):not(.disabled).active,
+.show > .btn-warning.dropdown-toggle {
+  color: #212529;
+  background-color: #d39e00;
+  border-color: #c69500;
+}
+
+.btn-warning:not(:disabled):not(.disabled):active:focus, .btn-warning:not(:disabled):not(.disabled).active:focus,
+.show > .btn-warning.dropdown-toggle:focus {
+  box-shadow: 0 0 0 0.2rem rgba(255, 193, 7, 0.5);
+}
+
+.btn-danger {
+  color: #fff;
+  background-color: #dc3545;
+  border-color: #dc3545;
+}
+
+.btn-danger:hover {
+  color: #fff;
+  background-color: #c82333;
+  border-color: #bd2130;
+}
+
+.btn-danger:focus, .btn-danger.focus {
+  box-shadow: 0 0 0 0.2rem rgba(220, 53, 69, 0.5);
+}
+
+.btn-danger.disabled, .btn-danger:disabled {
+  color: #fff;
+  background-color: #dc3545;
+  border-color: #dc3545;
+}
+
+.btn-danger:not(:disabled):not(.disabled):active, .btn-danger:not(:disabled):not(.disabled).active,
+.show > .btn-danger.dropdown-toggle {
+  color: #fff;
+  background-color: #bd2130;
+  border-color: #b21f2d;
+}
+
+.btn-danger:not(:disabled):not(.disabled):active:focus, .btn-danger:not(:disabled):not(.disabled).active:focus,
+.show > .btn-danger.dropdown-toggle:focus {
+  box-shadow: 0 0 0 0.2rem rgba(220, 53, 69, 0.5);
+}
+
+.btn-light {
+  color: #212529;
+  background-color: #f8f9fa;
+  border-color: #f8f9fa;
+}
+
+.btn-light:hover {
+  color: #212529;
+  background-color: #e2e6ea;
+  border-color: #dae0e5;
+}
+
+.btn-light:focus, .btn-light.focus {
+  box-shadow: 0 0 0 0.2rem rgba(248, 249, 250, 0.5);
+}
+
+.btn-light.disabled, .btn-light:disabled {
+  color: #212529;
+  background-color: #f8f9fa;
+  border-color: #f8f9fa;
+}
+
+.btn-light:not(:disabled):not(.disabled):active, .btn-light:not(:disabled):not(.disabled).active,
+.show > .btn-light.dropdown-toggle {
+  color: #212529;
+  background-color: #dae0e5;
+  border-color: #d3d9df;
+}
+
+.btn-light:not(:disabled):not(.disabled):active:focus, .btn-light:not(:disabled):not(.disabled).active:focus,
+.show > .btn-light.dropdown-toggle:focus {
+  box-shadow: 0 0 0 0.2rem rgba(248, 249, 250, 0.5);
+}
+
+.btn-dark {
+  color: #fff;
+  background-color: #343a40;
+  border-color: #343a40;
+}
+
+.btn-dark:hover {
+  color: #fff;
+  background-color: #23272b;
+  border-color: #1d2124;
+}
+
+.btn-dark:focus, .btn-dark.focus {
+  box-shadow: 0 0 0 0.2rem rgba(52, 58, 64, 0.5);
+}
+
+.btn-dark.disabled, .btn-dark:disabled {
+  color: #fff;
+  background-color: #343a40;
+  border-color: #343a40;
+}
+
+.btn-dark:not(:disabled):not(.disabled):active, .btn-dark:not(:disabled):not(.disabled).active,
+.show > .btn-dark.dropdown-toggle {
+  color: #fff;
+  background-color: #1d2124;
+  border-color: #171a1d;
+}
+
+.btn-dark:not(:disabled):not(.disabled):active:focus, .btn-dark:not(:disabled):not(.disabled).active:focus,
+.show > .btn-dark.dropdown-toggle:focus {
+  box-shadow: 0 0 0 0.2rem rgba(52, 58, 64, 0.5);
+}
+
+.btn-outline-primary {
+  color: #007bff;
+  background-color: transparent;
+  background-image: none;
+  border-color: #007bff;
+}
+
+.btn-outline-primary:hover {
+  color: #fff;
+  background-color: #007bff;
+  border-color: #007bff;
+}
+
+.btn-outline-primary:focus, .btn-outline-primary.focus {
+  box-shadow: 0 0 0 0.2rem rgba(0, 123, 255, 0.5);
+}
+
+.btn-outline-primary.disabled, .btn-outline-primary:disabled {
+  color: #007bff;
+  background-color: transparent;
+}
+
+.btn-outline-primary:not(:disabled):not(.disabled):active, .btn-outline-primary:not(:disabled):not(.disabled).active,
+.show > .btn-outline-primary.dropdown-toggle {
+  color: #fff;
+  background-color: #007bff;
+  border-color: #007bff;
+}
+
+.btn-outline-primary:not(:disabled):not(.disabled):active:focus, .btn-outline-primary:not(:disabled):not(.disabled).active:focus,
+.show > .btn-outline-primary.dropdown-toggle:focus {
+  box-shadow: 0 0 0 0.2rem rgba(0, 123, 255, 0.5);
+}
+
+.btn-outline-secondary {
+  color: #6c757d;
+  background-color: transparent;
+  background-image: none;
+  border-color: #6c757d;
+}
+
+.btn-outline-secondary:hover {
+  color: #fff;
+  background-color: #6c757d;
+  border-color: #6c757d;
+}
+
+.btn-outline-secondary:focus, .btn-outline-secondary.focus {
+  box-shadow: 0 0 0 0.2rem rgba(108, 117, 125, 0.5);
+}
+
+.btn-outline-secondary.disabled, .btn-outline-secondary:disabled {
+  color: #6c757d;
+  background-color: transparent;
+}
+
+.btn-outline-secondary:not(:disabled):not(.disabled):active, .btn-outline-secondary:not(:disabled):not(.disabled).active,
+.show > .btn-outline-secondary.dropdown-toggle {
+  color: #fff;
+  background-color: #6c757d;
+  border-color: #6c757d;
+}
+
+.btn-outline-secondary:not(:disabled):not(.disabled):active:focus, .btn-outline-secondary:not(:disabled):not(.disabled).active:focus,
+.show > .btn-outline-secondary.dropdown-toggle:focus {
+  box-shadow: 0 0 0 0.2rem rgba(108, 117, 125, 0.5);
+}
+
+.btn-outline-success {
+  color: #28a745;
+  background-color: transparent;
+  background-image: none;
+  border-color: #28a745;
+}
+
+.btn-outline-success:hover {
+  color: #fff;
+  background-color: #28a745;
+  border-color: #28a745;
+}
+
+.btn-outline-success:focus, .btn-outline-success.focus {
+  box-shadow: 0 0 0 0.2rem rgba(40, 167, 69, 0.5);
+}
+
+.btn-outline-success.disabled, .btn-outline-success:disabled {
+  color: #28a745;
+  background-color: transparent;
+}
+
+.btn-outline-success:not(:disabled):not(.disabled):active, .btn-outline-success:not(:disabled):not(.disabled).active,
+.show > .btn-outline-success.dropdown-toggle {
+  color: #fff;
+  background-color: #28a745;
+  border-color: #28a745;
+}
+
+.btn-outline-success:not(:disabled):not(.disabled):active:focus, .btn-outline-success:not(:disabled):not(.disabled).active:focus,
+.show > .btn-outline-success.dropdown-toggle:focus {
+  box-shadow: 0 0 0 0.2rem rgba(40, 167, 69, 0.5);
+}
+
+.btn-outline-info {
+  color: #17a2b8;
+  background-color: transparent;
+  background-image: none;
+  border-color: #17a2b8;
+}
+
+.btn-outline-info:hover {
+  color: #fff;
+  background-color: #17a2b8;
+  border-color: #17a2b8;
+}
+
+.btn-outline-info:focus, .btn-outline-info.focus {
+  box-shadow: 0 0 0 0.2rem rgba(23, 162, 184, 0.5);
+}
+
+.btn-outline-info.disabled, .btn-outline-info:disabled {
+  color: #17a2b8;
+  background-color: transparent;
+}
+
+.btn-outline-info:not(:disabled):not(.disabled):active, .btn-outline-info:not(:disabled):not(.disabled).active,
+.show > .btn-outline-info.dropdown-toggle {
+  color: #fff;
+  background-color: #17a2b8;
+  border-color: #17a2b8;
+}
+
+.btn-outline-info:not(:disabled):not(.disabled):active:focus, .btn-outline-info:not(:disabled):not(.disabled).active:focus,
+.show > .btn-outline-info.dropdown-toggle:focus {
+  box-shadow: 0 0 0 0.2rem rgba(23, 162, 184, 0.5);
+}
+
+.btn-outline-warning {
+  color: #ffc107;
+  background-color: transparent;
+  background-image: none;
+  border-color: #ffc107;
+}
+
+.btn-outline-warning:hover {
+  color: #212529;
+  background-color: #ffc107;
+  border-color: #ffc107;
+}
+
+.btn-outline-warning:focus, .btn-outline-warning.focus {
+  box-shadow: 0 0 0 0.2rem rgba(255, 193, 7, 0.5);
+}
+
+.btn-outline-warning.disabled, .btn-outline-warning:disabled {
+  color: #ffc107;
+  background-color: transparent;
+}
+
+.btn-outline-warning:not(:disabled):not(.disabled):active, .btn-outline-warning:not(:disabled):not(.disabled).active,
+.show > .btn-outline-warning.dropdown-toggle {
+  color: #212529;
+  background-color: #ffc107;
+  border-color: #ffc107;
+}
+
+.btn-outline-warning:not(:disabled):not(.disabled):active:focus, .btn-outline-warning:not(:disabled):not(.disabled).active:focus,
+.show > .btn-outline-warning.dropdown-toggle:focus {
+  box-shadow: 0 0 0 0.2rem rgba(255, 193, 7, 0.5);
+}
+
+.btn-outline-danger {
+  color: #dc3545;
+  background-color: transparent;
+  background-image: none;
+  border-color: #dc3545;
+}
+
+.btn-outline-danger:hover {
+  color: #fff;
+  background-color: #dc3545;
+  border-color: #dc3545;
+}
+
+.btn-outline-danger:focus, .btn-outline-danger.focus {
+  box-shadow: 0 0 0 0.2rem rgba(220, 53, 69, 0.5);
+}
+
+.btn-outline-danger.disabled, .btn-outline-danger:disabled {
+  color: #dc3545;
+  background-color: transparent;
+}
+
+.btn-outline-danger:not(:disabled):not(.disabled):active, .btn-outline-danger:not(:disabled):not(.disabled).active,
+.show > .btn-outline-danger.dropdown-toggle {
+  color: #fff;
+  background-color: #dc3545;
+  border-color: #dc3545;
+}
+
+.btn-outline-danger:not(:disabled):not(.disabled):active:focus, .btn-outline-danger:not(:disabled):not(.disabled).active:focus,
+.show > .btn-outline-danger.dropdown-toggle:focus {
+  box-shadow: 0 0 0 0.2rem rgba(220, 53, 69, 0.5);
+}
+
+.btn-outline-light {
+  color: #f8f9fa;
+  background-color: transparent;
+  background-image: none;
+  border-color: #f8f9fa;
+}
+
+.btn-outline-light:hover {
+  color: #212529;
+  background-color: #f8f9fa;
+  border-color: #f8f9fa;
+}
+
+.btn-outline-light:focus, .btn-outline-light.focus {
+  box-shadow: 0 0 0 0.2rem rgba(248, 249, 250, 0.5);
+}
+
+.btn-outline-light.disabled, .btn-outline-light:disabled {
+  color: #f8f9fa;
+  background-color: transparent;
+}
+
+.btn-outline-light:not(:disabled):not(.disabled):active, .btn-outline-light:not(:disabled):not(.disabled).active,
+.show > .btn-outline-light.dropdown-toggle {
+  color: #212529;
+  background-color: #f8f9fa;
+  border-color: #f8f9fa;
+}
+
+.btn-outline-light:not(:disabled):not(.disabled):active:focus, .btn-outline-light:not(:disabled):not(.disabled).active:focus,
+.show > .btn-outline-light.dropdown-toggle:focus {
+  box-shadow: 0 0 0 0.2rem rgba(248, 249, 250, 0.5);
+}
+
+.btn-outline-dark {
+  color: #343a40;
+  background-color: transparent;
+  background-image: none;
+  border-color: #343a40;
+}
+
+.btn-outline-dark:hover {
+  color: #fff;
+  background-color: #343a40;
+  border-color: #343a40;
+}
+
+.btn-outline-dark:focus, .btn-outline-dark.focus {
+  box-shadow: 0 0 0 0.2rem rgba(52, 58, 64, 0.5);
+}
+
+.btn-outline-dark.disabled, .btn-outline-dark:disabled {
+  color: #343a40;
+  background-color: transparent;
+}
+
+.btn-outline-dark:not(:disabled):not(.disabled):active, .btn-outline-dark:not(:disabled):not(.disabled).active,
+.show > .btn-outline-dark.dropdown-toggle {
+  color: #fff;
+  background-color: #343a40;
+  border-color: #343a40;
+}
+
+.btn-outline-dark:not(:disabled):not(.disabled):active:focus, .btn-outline-dark:not(:disabled):not(.disabled).active:focus,
+.show > .btn-outline-dark.dropdown-toggle:focus {
+  box-shadow: 0 0 0 0.2rem rgba(52, 58, 64, 0.5);
+}
+
+.btn-link {
+  font-weight: 400;
+  color: #007bff;
+  background-color: transparent;
+}
+
+.btn-link:hover {
+  color: #0056b3;
+  text-decoration: underline;
+  background-color: transparent;
+  border-color: transparent;
+}
+
+.btn-link:focus, .btn-link.focus {
+  text-decoration: underline;
+  border-color: transparent;
+  box-shadow: none;
+}
+
+.btn-link:disabled, .btn-link.disabled {
+  color: #6c757d;
+  pointer-events: none;
+}
+
+.btn-lg, .btn-group-lg > .btn {
+  padding: 0.5rem 1rem;
+  font-size: 1.25rem;
+  line-height: 1.5;
+  border-radius: 0.3rem;
+}
+
+.btn-sm, .btn-group-sm > .btn {
+  padding: 0.25rem 0.5rem;
+  font-size: 0.875rem;
+  line-height: 1.5;
+  border-radius: 0.2rem;
+}
+
+.btn-block {
+  display: block;
+  width: 100%;
+}
+
+.btn-block + .btn-block {
+  margin-top: 0.5rem;
+}
+
+input[type="submit"].btn-block,
+input[type="reset"].btn-block,
+input[type="button"].btn-block {
+  width: 100%;
+}
+
+.fade {
+  transition: opacity 0.15s linear;
+}
+
+@media screen and (prefers-reduced-motion: reduce) {
+  .fade {
+    transition: none;
+  }
+}
+
+.fade:not(.show) {
+  opacity: 0;
+}
+
+.collapse:not(.show) {
+  display: none;
+}
+
+.collapsing {
+  position: relative;
+  height: 0;
+  overflow: hidden;
+  transition: height 0.35s ease;
+}
+
+@media screen and (prefers-reduced-motion: reduce) {
+  .collapsing {
+    transition: none;
+  }
+}
+
+.dropup,
+.dropright,
+.dropdown,
+.dropleft {
+  position: relative;
+}
+
+.dropdown-toggle::after {
+  display: inline-block;
+  width: 0;
+  height: 0;
+  margin-left: 0.255em;
+  vertical-align: 0.255em;
+  content: "";
+  border-top: 0.3em solid;
+  border-right: 0.3em solid transparent;
+  border-bottom: 0;
+  border-left: 0.3em solid transparent;
+}
+
+.dropdown-toggle:empty::after {
+  margin-left: 0;
+}
+
+.dropdown-menu {
+  position: absolute;
+  top: 100%;
+  left: 0;
+  z-index: 1000;
+  display: none;
+  float: left;
+  min-width: 10rem;
+  padding: 0.5rem 0;
+  margin: 0.125rem 0 0;
+  font-size: 1rem;
+  color: #212529;
+  text-align: left;
+  list-style: none;
+  background-color: #fff;
+  background-clip: padding-box;
+  border: 1px solid rgba(0, 0, 0, 0.15);
+  border-radius: 0.25rem;
+}
+
+.dropdown-menu-right {
+  right: 0;
+  left: auto;
+}
+
+.dropup .dropdown-menu {
+  top: auto;
+  bottom: 100%;
+  margin-top: 0;
+  margin-bottom: 0.125rem;
+}
+
+.dropup .dropdown-toggle::after {
+  display: inline-block;
+  width: 0;
+  height: 0;
+  margin-left: 0.255em;
+  vertical-align: 0.255em;
+  content: "";
+  border-top: 0;
+  border-right: 0.3em solid transparent;
+  border-bottom: 0.3em solid;
+  border-left: 0.3em solid transparent;
+}
+
+.dropup .dropdown-toggle:empty::after {
+  margin-left: 0;
+}
+
+.dropright .dropdown-menu {
+  top: 0;
+  right: auto;
+  left: 100%;
+  margin-top: 0;
+  margin-left: 0.125rem;
+}
+
+.dropright .dropdown-toggle::after {
+  display: inline-block;
+  width: 0;
+  height: 0;
+  margin-left: 0.255em;
+  vertical-align: 0.255em;
+  content: "";
+  border-top: 0.3em solid transparent;
+  border-right: 0;
+  border-bottom: 0.3em solid transparent;
+  border-left: 0.3em solid;
+}
+
+.dropright .dropdown-toggle:empty::after {
+  margin-left: 0;
+}
+
+.dropright .dropdown-toggle::after {
+  vertical-align: 0;
+}
+
+.dropleft .dropdown-menu {
+  top: 0;
+  right: 100%;
+  left: auto;
+  margin-top: 0;
+  margin-right: 0.125rem;
+}
+
+.dropleft .dropdown-toggle::after {
+  display: inline-block;
+  width: 0;
+  height: 0;
+  margin-left: 0.255em;
+  vertical-align: 0.255em;
+  content: "";
+}
+
+.dropleft .dropdown-toggle::after {
+  display: none;
+}
+
+.dropleft .dropdown-toggle::before {
+  display: inline-block;
+  width: 0;
+  height: 0;
+  margin-right: 0.255em;
+  vertical-align: 0.255em;
+  content: "";
+  border-top: 0.3em solid transparent;
+  border-right: 0.3em solid;
+  border-bottom: 0.3em solid transparent;
+}
+
+.dropleft .dropdown-toggle:empty::after {
+  margin-left: 0;
+}
+
+.dropleft .dropdown-toggle::before {
+  vertical-align: 0;
+}
+
+.dropdown-menu[x-placement^="top"], .dropdown-menu[x-placement^="right"], .dropdown-menu[x-placement^="bottom"], .dropdown-menu[x-placement^="left"] {
+  right: auto;
+  bottom: auto;
+}
+
+.dropdown-divider {
+  height: 0;
+  margin: 0.5rem 0;
+  overflow: hidden;
+  border-top: 1px solid #e9ecef;
+}
+
+.dropdown-item {
+  display: block;
+  width: 100%;
+  padding: 0.25rem 1.5rem;
+  clear: both;
+  font-weight: 400;
+  color: #212529;
+  text-align: inherit;
+  white-space: nowrap;
+  background-color: transparent;
+  border: 0;
+}
+
+.dropdown-item:hover, .dropdown-item:focus {
+  color: #16181b;
+  text-decoration: none;
+  background-color: #f8f9fa;
+}
+
+.dropdown-item.active, .dropdown-item:active {
+  color: #fff;
+  text-decoration: none;
+  background-color: #007bff;
+}
+
+.dropdown-item.disabled, .dropdown-item:disabled {
+  color: #6c757d;
+  background-color: transparent;
+}
+
+.dropdown-menu.show {
+  display: block;
+}
+
+.dropdown-header {
+  display: block;
+  padding: 0.5rem 1.5rem;
+  margin-bottom: 0;
+  font-size: 0.875rem;
+  color: #6c757d;
+  white-space: nowrap;
+}
+
+.dropdown-item-text {
+  display: block;
+  padding: 0.25rem 1.5rem;
+  color: #212529;
+}
+
+.btn-group,
+.btn-group-vertical {
+  position: relative;
+  display: -ms-inline-flexbox;
+  display: inline-flex;
+  vertical-align: middle;
+}
+
+.btn-group > .btn,
+.btn-group-vertical > .btn {
+  position: relative;
+  -ms-flex: 0 1 auto;
+  flex: 0 1 auto;
+}
+
+.btn-group > .btn:hover,
+.btn-group-vertical > .btn:hover {
+  z-index: 1;
+}
+
+.btn-group > .btn:focus, .btn-group > .btn:active, .btn-group > .btn.active,
+.btn-group-vertical > .btn:focus,
+.btn-group-vertical > .btn:active,
+.btn-group-vertical > .btn.active {
+  z-index: 1;
+}
+
+.btn-group .btn + .btn,
+.btn-group .btn + .btn-group,
+.btn-group .btn-group + .btn,
+.btn-group .btn-group + .btn-group,
+.btn-group-vertical .btn + .btn,
+.btn-group-vertical .btn + .btn-group,
+.btn-group-vertical .btn-group + .btn,
+.btn-group-vertical .btn-group + .btn-group {
+  margin-left: -1px;
+}
+
+.btn-toolbar {
+  display: -ms-flexbox;
+  display: flex;
+  -ms-flex-wrap: wrap;
+  flex-wrap: wrap;
+  -ms-flex-pack: start;
+  justify-content: flex-start;
+}
+
+.btn-toolbar .input-group {
+  width: auto;
+}
+
+.btn-group > .btn:first-child {
+  margin-left: 0;
+}
+
+.btn-group > .btn:not(:last-child):not(.dropdown-toggle),
+.btn-group > .btn-group:not(:last-child) > .btn {
+  border-top-right-radius: 0;
+  border-bottom-right-radius: 0;
+}
+
+.btn-group > .btn:not(:first-child),
+.btn-group > .btn-group:not(:first-child) > .btn {
+  border-top-left-radius: 0;
+  border-bottom-left-radius: 0;
+}
+
+.dropdown-toggle-split {
+  padding-right: 0.5625rem;
+  padding-left: 0.5625rem;
+}
+
+.dropdown-toggle-split::after,
+.dropup .dropdown-toggle-split::after,
+.dropright .dropdown-toggle-split::after {
+  margin-left: 0;
+}
+
+.dropleft .dropdown-toggle-split::before {
+  margin-right: 0;
+}
+
+.btn-sm + .dropdown-toggle-split, .btn-group-sm > .btn + .dropdown-toggle-split {
+  padding-right: 0.375rem;
+  padding-left: 0.375rem;
+}
+
+.btn-lg + .dropdown-toggle-split, .btn-group-lg > .btn + .dropdown-toggle-split {
+  padding-right: 0.75rem;
+  padding-left: 0.75rem;
+}
+
+.btn-group-vertical {
+  -ms-flex-direction: column;
+  flex-direction: column;
+  -ms-flex-align: start;
+  align-items: flex-start;
+  -ms-flex-pack: center;
+  justify-content: center;
+}
+
+.btn-group-vertical .btn,
+.btn-group-vertical .btn-group {
+  width: 100%;
+}
+
+.btn-group-vertical > .btn + .btn,
+.btn-group-vertical > .btn + .btn-group,
+.btn-group-vertical > .btn-group + .btn,
+.btn-group-vertical > .btn-group + .btn-group {
+  margin-top: -1px;
+  margin-left: 0;
+}
+
+.btn-group-vertical > .btn:not(:last-child):not(.dropdown-toggle),
+.btn-group-vertical > .btn-group:not(:last-child) > .btn {
+  border-bottom-right-radius: 0;
+  border-bottom-left-radius: 0;
+}
+
+.btn-group-vertical > .btn:not(:first-child),
+.btn-group-vertical > .btn-group:not(:first-child) > .btn {
+  border-top-left-radius: 0;
+  border-top-right-radius: 0;
+}
+
+.btn-group-toggle > .btn,
+.btn-group-toggle > .btn-group > .btn {
+  margin-bottom: 0;
+}
+
+.btn-group-toggle > .btn input[type="radio"],
+.btn-group-toggle > .btn input[type="checkbox"],
+.btn-group-toggle > .btn-group > .btn input[type="radio"],
+.btn-group-toggle > .btn-group > .btn input[type="checkbox"] {
+  position: absolute;
+  clip: rect(0, 0, 0, 0);
+  pointer-events: none;
+}
+
+.input-group {
+  position: relative;
+  display: -ms-flexbox;
+  display: flex;
+  -ms-flex-wrap: wrap;
+  flex-wrap: wrap;
+  -ms-flex-align: stretch;
+  align-items: stretch;
+  width: 100%;
+}
+
+.input-group > .form-control,
+.input-group > .custom-select,
+.input-group > .custom-file {
+  position: relative;
+  -ms-flex: 1 1 auto;
+  flex: 1 1 auto;
+  width: 1%;
+  margin-bottom: 0;
+}
+
+.input-group > .form-control + .form-control,
+.input-group > .form-control + .custom-select,
+.input-group > .form-control + .custom-file,
+.input-group > .custom-select + .form-control,
+.input-group > .custom-select + .custom-select,
+.input-group > .custom-select + .custom-file,
+.input-group > .custom-file + .form-control,
+.input-group > .custom-file + .custom-select,
+.input-group > .custom-file + .custom-file {
+  margin-left: -1px;
+}
+
+.input-group > .form-control:focus,
+.input-group > .custom-select:focus,
+.input-group > .custom-file .custom-file-input:focus ~ .custom-file-label {
+  z-index: 3;
+}
+
+.input-group > .custom-file .custom-file-input:focus {
+  z-index: 4;
+}
+
+.input-group > .form-control:not(:last-child),
+.input-group > .custom-select:not(:last-child) {
+  border-top-right-radius: 0;
+  border-bottom-right-radius: 0;
+}
+
+.input-group > .form-control:not(:first-child),
+.input-group > .custom-select:not(:first-child) {
+  border-top-left-radius: 0;
+  border-bottom-left-radius: 0;
+}
+
+.input-group > .custom-file {
+  display: -ms-flexbox;
+  display: flex;
+  -ms-flex-align: center;
+  align-items: center;
+}
+
+.input-group > .custom-file:not(:last-child) .custom-file-label,
+.input-group > .custom-file:not(:last-child) .custom-file-label::after {
+  border-top-right-radius: 0;
+  border-bottom-right-radius: 0;
+}
+
+.input-group > .custom-file:not(:first-child) .custom-file-label {
+  border-top-left-radius: 0;
+  border-bottom-left-radius: 0;
+}
+
+.input-group-prepend,
+.input-group-append {
+  display: -ms-flexbox;
+  display: flex;
+}
+
+.input-group-prepend .btn,
+.input-group-append .btn {
+  position: relative;
+  z-index: 2;
+}
+
+.input-group-prepend .btn + .btn,
+.input-group-prepend .btn + .input-group-text,
+.input-group-prepend .input-group-text + .input-group-text,
+.input-group-prepend .input-group-text + .btn,
+.input-group-append .btn + .btn,
+.input-group-append .btn + .input-group-text,
+.input-group-append .input-group-text + .input-group-text,
+.input-group-append .input-group-text + .btn {
+  margin-left: -1px;
+}
+
+.input-group-prepend {
+  margin-right: -1px;
+}
+
+.input-group-append {
+  margin-left: -1px;
+}
+
+.input-group-text {
+  display: -ms-flexbox;
+  display: flex;
+  -ms-flex-align: center;
+  align-items: center;
+  padding: 0.375rem 0.75rem;
+  margin-bottom: 0;
+  font-size: 1rem;
+  font-weight: 400;
+  line-height: 1.5;
+  color: #495057;
+  text-align: center;
+  white-space: nowrap;
+  background-color: #e9ecef;
+  border: 1px solid #ced4da;
+  border-radius: 0.25rem;
+}
+
+.input-group-text input[type="radio"],
+.input-group-text input[type="checkbox"] {
+  margin-top: 0;
+}
+
+.input-group-lg > .form-control,
+.input-group-lg > .input-group-prepend > .input-group-text,
+.input-group-lg > .input-group-append > .input-group-text,
+.input-group-lg > .input-group-prepend > .btn,
+.input-group-lg > .input-group-append > .btn {
+  height: calc(2.875rem + 2px);
+  padding: 0.5rem 1rem;
+  font-size: 1.25rem;
+  line-height: 1.5;
+  border-radius: 0.3rem;
+}
+
+.input-group-sm > .form-control,
+.input-group-sm > .input-group-prepend > .input-group-text,
+.input-group-sm > .input-group-append > .input-group-text,
+.input-group-sm > .input-group-prepend > .btn,
+.input-group-sm > .input-group-append > .btn {
+  height: calc(1.8125rem + 2px);
+  padding: 0.25rem 0.5rem;
+  font-size: 0.875rem;
+  line-height: 1.5;
+  border-radius: 0.2rem;
+}
+
+.input-group > .input-group-prepend > .btn,
+.input-group > .input-group-prepend > .input-group-text,
+.input-group > .input-group-append:not(:last-child) > .btn,
+.input-group > .input-group-append:not(:last-child) > .input-group-text,
+.input-group > .input-group-append:last-child > .btn:not(:last-child):not(.dropdown-toggle),
+.input-group > .input-group-append:last-child > .input-group-text:not(:last-child) {
+  border-top-right-radius: 0;
+  border-bottom-right-radius: 0;
+}
+
+.input-group > .input-group-append > .btn,
+.input-group > .input-group-append > .input-group-text,
+.input-group > .input-group-prepend:not(:first-child) > .btn,
+.input-group > .input-group-prepend:not(:first-child) > .input-group-text,
+.input-group > .input-group-prepend:first-child > .btn:not(:first-child),
+.input-group > .input-group-prepend:first-child > .input-group-text:not(:first-child) {
+  border-top-left-radius: 0;
+  border-bottom-left-radius: 0;
+}
+
+.custom-control {
+  position: relative;
+  display: block;
+  min-height: 1.5rem;
+  padding-left: 1.5rem;
+}
+
+.custom-control-inline {
+  display: -ms-inline-flexbox;
+  display: inline-flex;
+  margin-right: 1rem;
+}
+
+.custom-control-input {
+  position: absolute;
+  z-index: -1;
+  opacity: 0;
+}
+
+.custom-control-input:checked ~ .custom-control-label::before {
+  color: #fff;
+  background-color: #007bff;
+}
+
+.custom-control-input:focus ~ .custom-control-label::before {
+  box-shadow: 0 0 0 1px #fff, 0 0 0 0.2rem rgba(0, 123, 255, 0.25);
+}
+
+.custom-control-input:active ~ .custom-control-label::before {
+  color: #fff;
+  background-color: #b3d7ff;
+}
+
+.custom-control-input:disabled ~ .custom-control-label {
+  color: #6c757d;
+}
+
+.custom-control-input:disabled ~ .custom-control-label::before {
+  background-color: #e9ecef;
+}
+
+.custom-control-label {
+  position: relative;
+  margin-bottom: 0;
+}
+
+.custom-control-label::before {
+  position: absolute;
+  top: 0.25rem;
+  left: -1.5rem;
+  display: block;
+  width: 1rem;
+  height: 1rem;
+  pointer-events: none;
+  content: "";
+  -webkit-user-select: none;
+  -moz-user-select: none;
+  -ms-user-select: none;
+  user-select: none;
+  background-color: #dee2e6;
+}
+
+.custom-control-label::after {
+  position: absolute;
+  top: 0.25rem;
+  left: -1.5rem;
+  display: block;
+  width: 1rem;
+  height: 1rem;
+  content: "";
+  background-repeat: no-repeat;
+  background-position: center center;
+  background-size: 50% 50%;
+}
+
+.custom-checkbox .custom-control-label::before {
+  border-radius: 0.25rem;
+}
+
+.custom-checkbox .custom-control-input:checked ~ .custom-control-label::before {
+  background-color: #007bff;
+}
+
+.custom-checkbox .custom-control-input:checked ~ .custom-control-label::after {
+  background-image: url("data:image/svg+xml;charset=utf8,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 8 8'%3E%3Cpath fill='%23fff' d='M6.564.75l-3.59 3.612-1.538-1.55L0 4.26 2.974 7.25 8 2.193z'/%3E%3C/svg%3E");
+}
+
+.custom-checkbox .custom-control-input:indeterminate ~ .custom-control-label::before {
+  background-color: #007bff;
+}
+
+.custom-checkbox .custom-control-input:indeterminate ~ .custom-control-label::after {
+  background-image: url("data:image/svg+xml;charset=utf8,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 4 4'%3E%3Cpath stroke='%23fff' d='M0 2h4'/%3E%3C/svg%3E");
+}
+
+.custom-checkbox .custom-control-input:disabled:checked ~ .custom-control-label::before {
+  background-color: rgba(0, 123, 255, 0.5);
+}
+
+.custom-checkbox .custom-control-input:disabled:indeterminate ~ .custom-control-label::before {
+  background-color: rgba(0, 123, 255, 0.5);
+}
+
+.custom-radio .custom-control-label::before {
+  border-radius: 50%;
+}
+
+.custom-radio .custom-control-input:checked ~ .custom-control-label::before {
+  background-color: #007bff;
+}
+
+.custom-radio .custom-control-input:checked ~ .custom-control-label::after {
+  background-image: url("data:image/svg+xml;charset=utf8,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='-4 -4 8 8'%3E%3Ccircle r='3' fill='%23fff'/%3E%3C/svg%3E");
+}
+
+.custom-radio .custom-control-input:disabled:checked ~ .custom-control-label::before {
+  background-color: rgba(0, 123, 255, 0.5);
+}
+
+.custom-select {
+  display: inline-block;
+  width: 100%;
+  height: calc(2.25rem + 2px);
+  padding: 0.375rem 1.75rem 0.375rem 0.75rem;
+  line-height: 1.5;
+  color: #495057;
+  vertical-align: middle;
+  background: #fff url("data:image/svg+xml;charset=utf8,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 4 5'%3E%3Cpath fill='%23343a40' d='M2 0L0 2h4zm0 5L0 3h4z'/%3E%3C/svg%3E") no-repeat right 0.75rem center;
+  background-size: 8px 10px;
+  border: 1px solid #ced4da;
+  border-radius: 0.25rem;
+  -webkit-appearance: none;
+  -moz-appearance: none;
+  appearance: none;
+}
+
+.custom-select:focus {
+  border-color: #80bdff;
+  outline: 0;
+  box-shadow: 0 0 0 0.2rem rgba(128, 189, 255, 0.5);
+}
+
+.custom-select:focus::-ms-value {
+  color: #495057;
+  background-color: #fff;
+}
+
+.custom-select[multiple], .custom-select[size]:not([size="1"]) {
+  height: auto;
+  padding-right: 0.75rem;
+  background-image: none;
+}
+
+.custom-select:disabled {
+  color: #6c757d;
+  background-color: #e9ecef;
+}
+
+.custom-select::-ms-expand {
+  opacity: 0;
+}
+
+.custom-select-sm {
+  height: calc(1.8125rem + 2px);
+  padding-top: 0.375rem;
+  padding-bottom: 0.375rem;
+  font-size: 75%;
+}
+
+.custom-select-lg {
+  height: calc(2.875rem + 2px);
+  padding-top: 0.375rem;
+  padding-bottom: 0.375rem;
+  font-size: 125%;
+}
+
+.custom-file {
+  position: relative;
+  display: inline-block;
+  width: 100%;
+  height: calc(2.25rem + 2px);
+  margin-bottom: 0;
+}
+
+.custom-file-input {
+  position: relative;
+  z-index: 2;
+  width: 100%;
+  height: calc(2.25rem + 2px);
+  margin: 0;
+  opacity: 0;
+}
+
+.custom-file-input:focus ~ .custom-file-label {
+  border-color: #80bdff;
+  box-shadow: 0 0 0 0.2rem rgba(0, 123, 255, 0.25);
+}
+
+.custom-file-input:focus ~ .custom-file-label::after {
+  border-color: #80bdff;
+}
+
+.custom-file-input:disabled ~ .custom-file-label {
+  background-color: #e9ecef;
+}
+
+.custom-file-input:lang(en) ~ .custom-file-label::after {
+  content: "Browse";
+}
+
+.custom-file-label {
+  position: absolute;
+  top: 0;
+  right: 0;
+  left: 0;
+  z-index: 1;
+  height: calc(2.25rem + 2px);
+  padding: 0.375rem 0.75rem;
+  line-height: 1.5;
+  color: #495057;
+  background-color: #fff;
+  border: 1px solid #ced4da;
+  border-radius: 0.25rem;
+}
+
+.custom-file-label::after {
+  position: absolute;
+  top: 0;
+  right: 0;
+  bottom: 0;
+  z-index: 3;
+  display: block;
+  height: 2.25rem;
+  padding: 0.375rem 0.75rem;
+  line-height: 1.5;
+  color: #495057;
+  content: "Browse";
+  background-color: #e9ecef;
+  border-left: 1px solid #ced4da;
+  border-radius: 0 0.25rem 0.25rem 0;
+}
+
+.custom-range {
+  width: 100%;
+  padding-left: 0;
+  background-color: transparent;
+  -webkit-appearance: none;
+  -moz-appearance: none;
+  appearance: none;
+}
+
+.custom-range:focus {
+  outline: none;
+}
+
+.custom-range:focus::-webkit-slider-thumb {
+  box-shadow: 0 0 0 1px #fff, 0 0 0 0.2rem rgba(0, 123, 255, 0.25);
+}
+
+.custom-range:focus::-moz-range-thumb {
+  box-shadow: 0 0 0 1px #fff, 0 0 0 0.2rem rgba(0, 123, 255, 0.25);
+}
+
+.custom-range:focus::-ms-thumb {
+  box-shadow: 0 0 0 1px #fff, 0 0 0 0.2rem rgba(0, 123, 255, 0.25);
+}
+
+.custom-range::-moz-focus-outer {
+  border: 0;
+}
+
+.custom-range::-webkit-slider-thumb {
+  width: 1rem;
+  height: 1rem;
+  margin-top: -0.25rem;
+  background-color: #007bff;
+  border: 0;
+  border-radius: 1rem;
+  transition: background-color 0.15s ease-in-out, border-color 0.15s ease-in-out, box-shadow 0.15s ease-in-out;
+  -webkit-appearance: none;
+  appearance: none;
+}
+
+@media screen and (prefers-reduced-motion: reduce) {
+  .custom-range::-webkit-slider-thumb {
+    transition: none;
+  }
+}
+
+.custom-range::-webkit-slider-thumb:active {
+  background-color: #b3d7ff;
+}
+
+.custom-range::-webkit-slider-runnable-track {
+  width: 100%;
+  height: 0.5rem;
+  color: transparent;
+  cursor: pointer;
+  background-color: #dee2e6;
+  border-color: transparent;
+  border-radius: 1rem;
+}
+
+.custom-range::-moz-range-thumb {
+  width: 1rem;
+  height: 1rem;
+  background-color: #007bff;
+  border: 0;
+  border-radius: 1rem;
+  transition: background-color 0.15s ease-in-out, border-color 0.15s ease-in-out, box-shadow 0.15s ease-in-out;
+  -moz-appearance: none;
+  appearance: none;
+}
+
+@media screen and (prefers-reduced-motion: reduce) {
+  .custom-range::-moz-range-thumb {
+    transition: none;
+  }
+}
+
+.custom-range::-moz-range-thumb:active {
+  background-color: #b3d7ff;
+}
+
+.custom-range::-moz-range-track {
+  width: 100%;
+  height: 0.5rem;
+  color: transparent;
+  cursor: pointer;
+  background-color: #dee2e6;
+  border-color: transparent;
+  border-radius: 1rem;
+}
+
+.custom-range::-ms-thumb {
+  width: 1rem;
+  height: 1rem;
+  margin-top: 0;
+  margin-right: 0.2rem;
+  margin-left: 0.2rem;
+  background-color: #007bff;
+  border: 0;
+  border-radius: 1rem;
+  transition: background-color 0.15s ease-in-out, border-color 0.15s ease-in-out, box-shadow 0.15s ease-in-out;
+  appearance: none;
+}
+
+@media screen and (prefers-reduced-motion: reduce) {
+  .custom-range::-ms-thumb {
+    transition: none;
+  }
+}
+
+.custom-range::-ms-thumb:active {
+  background-color: #b3d7ff;
+}
+
+.custom-range::-ms-track {
+  width: 100%;
+  height: 0.5rem;
+  color: transparent;
+  cursor: pointer;
+  background-color: transparent;
+  border-color: transparent;
+  border-width: 0.5rem;
+}
+
+.custom-range::-ms-fill-lower {
+  background-color: #dee2e6;
+  border-radius: 1rem;
+}
+
+.custom-range::-ms-fill-upper {
+  margin-right: 15px;
+  background-color: #dee2e6;
+  border-radius: 1rem;
+}
+
+.custom-control-label::before,
+.custom-file-label,
+.custom-select {
+  transition: background-color 0.15s ease-in-out, border-color 0.15s ease-in-out, box-shadow 0.15s ease-in-out;
+}
+
+@media screen and (prefers-reduced-motion: reduce) {
+  .custom-control-label::before,
+  .custom-file-label,
+  .custom-select {
+    transition: none;
+  }
+}
+
+.nav {
+  display: -ms-flexbox;
+  display: flex;
+  -ms-flex-wrap: wrap;
+  flex-wrap: wrap;
+  padding-left: 0;
+  margin-bottom: 0;
+  list-style: none;
+}
+
+.nav-link {
+  display: block;
+  padding: 0.5rem 1rem;
+}
+
+.nav-link:hover, .nav-link:focus {
+  text-decoration: none;
+}
+
+.nav-link.disabled {
+  color: #6c757d;
+}
+
+.nav-tabs {
+  border-bottom: 1px solid #dee2e6;
+}
+
+.nav-tabs .nav-item {
+  margin-bottom: -1px;
+}
+
+.nav-tabs .nav-link {
+  border: 1px solid transparent;
+  border-top-left-radius: 0.25rem;
+  border-top-right-radius: 0.25rem;
+}
+
+.nav-tabs .nav-link:hover, .nav-tabs .nav-link:focus {
+  border-color: #e9ecef #e9ecef #dee2e6;
+}
+
+.nav-tabs .nav-link.disabled {
+  color: #6c757d;
+  background-color: transparent;
+  border-color: transparent;
+}
+
+.nav-tabs .nav-link.active,
+.nav-tabs .nav-item.show .nav-link {
+  color: #495057;
+  background-color: #fff;
+  border-color: #dee2e6 #dee2e6 #fff;
+}
+
+.nav-tabs .dropdown-menu {
+  margin-top: -1px;
+  border-top-left-radius: 0;
+  border-top-right-radius: 0;
+}
+
+.nav-pills .nav-link {
+  border-radius: 0.25rem;
+}
+
+.nav-pills .nav-link.active,
+.nav-pills .show > .nav-link {
+  color: #fff;
+  background-color: #007bff;
+}
+
+.nav-fill .nav-item {
+  -ms-flex: 1 1 auto;
+  flex: 1 1 auto;
+  text-align: center;
+}
+
+.nav-justified .nav-item {
+  -ms-flex-preferred-size: 0;
+  flex-basis: 0;
+  -ms-flex-positive: 1;
+  flex-grow: 1;
+  text-align: center;
+}
+
+.tab-content > .tab-pane {
+  display: none;
+}
+
+.tab-content > .active {
+  display: block;
+}
+
+.navbar {
+  position: relative;
+  display: -ms-flexbox;
+  display: flex;
+  -ms-flex-wrap: wrap;
+  flex-wrap: wrap;
+  -ms-flex-align: center;
+  align-items: center;
+  -ms-flex-pack: justify;
+  justify-content: space-between;
+  padding: 0.5rem 1rem;
+}
+
+.navbar > .container,
+.navbar > .container-fluid {
+  display: -ms-flexbox;
+  display: flex;
+  -ms-flex-wrap: wrap;
+  flex-wrap: wrap;
+  -ms-flex-align: center;
+  align-items: center;
+  -ms-flex-pack: justify;
+  justify-content: space-between;
+}
+
+.navbar-brand {
+  display: inline-block;
+  padding-top: 0.3125rem;
+  padding-bottom: 0.3125rem;
+  margin-right: 1rem;
+  font-size: 1.25rem;
+  line-height: inherit;
+  white-space: nowrap;
+}
+
+.navbar-brand:hover, .navbar-brand:focus {
+  text-decoration: none;
+}
+
+.navbar-nav {
+  display: -ms-flexbox;
+  display: flex;
+  -ms-flex-direction: column;
+  flex-direction: column;
+  padding-left: 0;
+  margin-bottom: 0;
+  list-style: none;
+}
+
+.navbar-nav .nav-link {
+  padding-right: 0;
+  padding-left: 0;
+}
+
+.navbar-nav .dropdown-menu {
+  position: static;
+  float: none;
+}
+
+.navbar-text {
+  display: inline-block;
+  padding-top: 0.5rem;
+  padding-bottom: 0.5rem;
+}
+
+.navbar-collapse {
+  -ms-flex-preferred-size: 100%;
+  flex-basis: 100%;
+  -ms-flex-positive: 1;
+  flex-grow: 1;
+  -ms-flex-align: center;
+  align-items: center;
+}
+
+.navbar-toggler {
+  padding: 0.25rem 0.75rem;
+  font-size: 1.25rem;
+  line-height: 1;
+  background-color: transparent;
+  border: 1px solid transparent;
+  border-radius: 0.25rem;
+}
+
+.navbar-toggler:hover, .navbar-toggler:focus {
+  text-decoration: none;
+}
+
+.navbar-toggler:not(:disabled):not(.disabled) {
+  cursor: pointer;
+}
+
+.navbar-toggler-icon {
+  display: inline-block;
+  width: 1.5em;
+  height: 1.5em;
+  vertical-align: middle;
+  content: "";
+  background: no-repeat center center;
+  background-size: 100% 100%;
+}
+
+@media (max-width: 575.98px) {
+  .navbar-expand-sm > .container,
+  .navbar-expand-sm > .container-fluid {
+    padding-right: 0;
+    padding-left: 0;
+  }
+}
+
+@media (min-width: 576px) {
+  .navbar-expand-sm {
+    -ms-flex-flow: row nowrap;
+    flex-flow: row nowrap;
+    -ms-flex-pack: start;
+    justify-content: flex-start;
+  }
+  .navbar-expand-sm .navbar-nav {
+    -ms-flex-direction: row;
+    flex-direction: row;
+  }
+  .navbar-expand-sm .navbar-nav .dropdown-menu {
+    position: absolute;
+  }
+  .navbar-expand-sm .navbar-nav .nav-link {
+    padding-right: 0.5rem;
+    padding-left: 0.5rem;
+  }
+  .navbar-expand-sm > .container,
+  .navbar-expand-sm > .container-fluid {
+    -ms-flex-wrap: nowrap;
+    flex-wrap: nowrap;
+  }
+  .navbar-expand-sm .navbar-collapse {
+    display: -ms-flexbox !important;
+    display: flex !important;
+    -ms-flex-preferred-size: auto;
+    flex-basis: auto;
+  }
+  .navbar-expand-sm .navbar-toggler {
+    display: none;
+  }
+}
+
+@media (max-width: 767.98px) {
+  .navbar-expand-md > .container,
+  .navbar-expand-md > .container-fluid {
+    padding-right: 0;
+    padding-left: 0;
+  }
+}
+
+@media (min-width: 768px) {
+  .navbar-expand-md {
+    -ms-flex-flow: row nowrap;
+    flex-flow: row nowrap;
+    -ms-flex-pack: start;
+    justify-content: flex-start;
+  }
+  .navbar-expand-md .navbar-nav {
+    -ms-flex-direction: row;
+    flex-direction: row;
+  }
+  .navbar-expand-md .navbar-nav .dropdown-menu {
+    position: absolute;
+  }
+  .navbar-expand-md .navbar-nav .nav-link {
+    padding-right: 0.5rem;
+    padding-left: 0.5rem;
+  }
+  .navbar-expand-md > .container,
+  .navbar-expand-md > .container-fluid {
+    -ms-flex-wrap: nowrap;
+    flex-wrap: nowrap;
+  }
+  .navbar-expand-md .navbar-collapse {
+    display: -ms-flexbox !important;
+    display: flex !important;
+    -ms-flex-preferred-size: auto;
+    flex-basis: auto;
+  }
+  .navbar-expand-md .navbar-toggler {
+    display: none;
+  }
+}
+
+@media (max-width: 991.98px) {
+  .navbar-expand-lg > .container,
+  .navbar-expand-lg > .container-fluid {
+    padding-right: 0;
+    padding-left: 0;
+  }
+}
+
+@media (min-width: 992px) {
+  .navbar-expand-lg {
+    -ms-flex-flow: row nowrap;
+    flex-flow: row nowrap;
+    -ms-flex-pack: start;
+    justify-content: flex-start;
+  }
+  .navbar-expand-lg .navbar-nav {
+    -ms-flex-direction: row;
+    flex-direction: row;
+  }
+  .navbar-expand-lg .navbar-nav .dropdown-menu {
+    position: absolute;
+  }
+  .navbar-expand-lg .navbar-nav .nav-link {
+    padding-right: 0.5rem;
+    padding-left: 0.5rem;
+  }
+  .navbar-expand-lg > .container,
+  .navbar-expand-lg > .container-fluid {
+    -ms-flex-wrap: nowrap;
+    flex-wrap: nowrap;
+  }
+  .navbar-expand-lg .navbar-collapse {
+    display: -ms-flexbox !important;
+    display: flex !important;
+    -ms-flex-preferred-size: auto;
+    flex-basis: auto;
+  }
+  .navbar-expand-lg .navbar-toggler {
+    display: none;
+  }
+}
+
+@media (max-width: 1199.98px) {
+  .navbar-expand-xl > .container,
+  .navbar-expand-xl > .container-fluid {
+    padding-right: 0;
+    padding-left: 0;
+  }
+}
+
+@media (min-width: 1200px) {
+  .navbar-expand-xl {
+    -ms-flex-flow: row nowrap;
+    flex-flow: row nowrap;
+    -ms-flex-pack: start;
+    justify-content: flex-start;
+  }
+  .navbar-expand-xl .navbar-nav {
+    -ms-flex-direction: row;
+    flex-direction: row;
+  }
+  .navbar-expand-xl .navbar-nav .dropdown-menu {
+    position: absolute;
+  }
+  .navbar-expand-xl .navbar-nav .nav-link {
+    padding-right: 0.5rem;
+    padding-left: 0.5rem;
+  }
+  .navbar-expand-xl > .container,
+  .navbar-expand-xl > .container-fluid {
+    -ms-flex-wrap: nowrap;
+    flex-wrap: nowrap;
+  }
+  .navbar-expand-xl .navbar-collapse {
+    display: -ms-flexbox !important;
+    display: flex !important;
+    -ms-flex-preferred-size: auto;
+    flex-basis: auto;
+  }
+  .navbar-expand-xl .navbar-toggler {
+    display: none;
+  }
+}
+
+.navbar-expand {
+  -ms-flex-flow: row nowrap;
+  flex-flow: row nowrap;
+  -ms-flex-pack: start;
+  justify-content: flex-start;
+}
+
+.navbar-expand > .container,
+.navbar-expand > .container-fluid {
+  padding-right: 0;
+  padding-left: 0;
+}
+
+.navbar-expand .navbar-nav {
+  -ms-flex-direction: row;
+  flex-direction: row;
+}
+
+.navbar-expand .navbar-nav .dropdown-menu {
+  position: absolute;
+}
+
+.navbar-expand .navbar-nav .nav-link {
+  padding-right: 0.5rem;
+  padding-left: 0.5rem;
+}
+
+.navbar-expand > .container,
+.navbar-expand > .container-fluid {
+  -ms-flex-wrap: nowrap;
+  flex-wrap: nowrap;
+}
+
+.navbar-expand .navbar-collapse {
+  display: -ms-flexbox !important;
+  display: flex !important;
+  -ms-flex-preferred-size: auto;
+  flex-basis: auto;
+}
+
+.navbar-expand .navbar-toggler {
+  display: none;
+}
+
+.navbar-light .navbar-brand {
+  color: rgba(0, 0, 0, 0.9);
+}
+
+.navbar-light .navbar-brand:hover, .navbar-light .navbar-brand:focus {
+  color: rgba(0, 0, 0, 0.9);
+}
+
+.navbar-light .navbar-nav .nav-link {
+  color: rgba(0, 0, 0, 0.5);
+}
+
+.navbar-light .navbar-nav .nav-link:hover, .navbar-light .navbar-nav .nav-link:focus {
+  color: rgba(0, 0, 0, 0.7);
+}
+
+.navbar-light .navbar-nav .nav-link.disabled {
+  color: rgba(0, 0, 0, 0.3);
+}
+
+.navbar-light .navbar-nav .show > .nav-link,
+.navbar-light .navbar-nav .active > .nav-link,
+.navbar-light .navbar-nav .nav-link.show,
+.navbar-light .navbar-nav .nav-link.active {
+  color: rgba(0, 0, 0, 0.9);
+}
+
+.navbar-light .navbar-toggler {
+  color: rgba(0, 0, 0, 0.5);
+  border-color: rgba(0, 0, 0, 0.1);
+}
+
+.navbar-light .navbar-toggler-icon {
+  background-image: url("data:image/svg+xml;charset=utf8,%3Csvg viewBox='0 0 30 30' xmlns='http://www.w3.org/2000/svg'%3E%3Cpath stroke='rgba(0, 0, 0, 0.5)' stroke-width='2' stroke-linecap='round' stroke-miterlimit='10' d='M4 7h22M4 15h22M4 23h22'/%3E%3C/svg%3E");
+}
+
+.navbar-light .navbar-text {
+  color: rgba(0, 0, 0, 0.5);
+}
+
+.navbar-light .navbar-text a {
+  color: rgba(0, 0, 0, 0.9);
+}
+
+.navbar-light .navbar-text a:hover, .navbar-light .navbar-text a:focus {
+  color: rgba(0, 0, 0, 0.9);
+}
+
+.navbar-dark .navbar-brand {
+  color: #fff;
+}
+
+.navbar-dark .navbar-brand:hover, .navbar-dark .navbar-brand:focus {
+  color: #fff;
+}
+
+.navbar-dark .navbar-nav .nav-link {
+  color: rgba(255, 255, 255, 0.5);
+}
+
+.navbar-dark .navbar-nav .nav-link:hover, .navbar-dark .navbar-nav .nav-link:focus {
+  color: rgba(255, 255, 255, 0.75);
+}
+
+.navbar-dark .navbar-nav .nav-link.disabled {
+  color: rgba(255, 255, 255, 0.25);
+}
+
+.navbar-dark .navbar-nav .show > .nav-link,
+.navbar-dark .navbar-nav .active > .nav-link,
+.navbar-dark .navbar-nav .nav-link.show,
+.navbar-dark .navbar-nav .nav-link.active {
+  color: #fff;
+}
+
+.navbar-dark .navbar-toggler {
+  color: rgba(255, 255, 255, 0.5);
+  border-color: rgba(255, 255, 255, 0.1);
+}
+
+.navbar-dark .navbar-toggler-icon {
+  background-image: url("data:image/svg+xml;charset=utf8,%3Csvg viewBox='0 0 30 30' xmlns='http://www.w3.org/2000/svg'%3E%3Cpath stroke='rgba(255, 255, 255, 0.5)' stroke-width='2' stroke-linecap='round' stroke-miterlimit='10' d='M4 7h22M4 15h22M4 23h22'/%3E%3C/svg%3E");
+}
+
+.navbar-dark .navbar-text {
+  color: rgba(255, 255, 255, 0.5);
+}
+
+.navbar-dark .navbar-text a {
+  color: #fff;
+}
+
+.navbar-dark .navbar-text a:hover, .navbar-dark .navbar-text a:focus {
+  color: #fff;
+}
+
+.card {
+  position: relative;
+  display: -ms-flexbox;
+  display: flex;
+  -ms-flex-direction: column;
+  flex-direction: column;
+  min-width: 0;
+  word-wrap: break-word;
+  background-color: #fff;
+  background-clip: border-box;
+  border: 1px solid rgba(0, 0, 0, 0.125);
+  border-radius: 0.25rem;
+}
+
+.card > hr {
+  margin-right: 0;
+  margin-left: 0;
+}
+
+.card > .list-group:first-child .list-group-item:first-child {
+  border-top-left-radius: 0.25rem;
+  border-top-right-radius: 0.25rem;
+}
+
+.card > .list-group:last-child .list-group-item:last-child {
+  border-bottom-right-radius: 0.25rem;
+  border-bottom-left-radius: 0.25rem;
+}
+
+.card-body {
+  -ms-flex: 1 1 auto;
+  flex: 1 1 auto;
+  padding: 1.25rem;
+}
+
+.card-title {
+  margin-bottom: 0.75rem;
+}
+
+.card-subtitle {
+  margin-top: -0.375rem;
+  margin-bottom: 0;
+}
+
+.card-text:last-child {
+  margin-bottom: 0;
+}
+
+.card-link:hover {
+  text-decoration: none;
+}
+
+.card-link + .card-link {
+  margin-left: 1.25rem;
+}
+
+.card-header {
+  padding: 0.75rem 1.25rem;
+  margin-bottom: 0;
+  background-color: rgba(0, 0, 0, 0.03);
+  border-bottom: 1px solid rgba(0, 0, 0, 0.125);
+}
+
+.card-header:first-child {
+  border-radius: calc(0.25rem - 1px) calc(0.25rem - 1px) 0 0;
+}
+
+.card-header + .list-group .list-group-item:first-child {
+  border-top: 0;
+}
+
+.card-footer {
+  padding: 0.75rem 1.25rem;
+  background-color: rgba(0, 0, 0, 0.03);
+  border-top: 1px solid rgba(0, 0, 0, 0.125);
+}
+
+.card-footer:last-child {
+  border-radius: 0 0 calc(0.25rem - 1px) calc(0.25rem - 1px);
+}
+
+.card-header-tabs {
+  margin-right: -0.625rem;
+  margin-bottom: -0.75rem;
+  margin-left: -0.625rem;
+  border-bottom: 0;
+}
+
+.card-header-pills {
+  margin-right: -0.625rem;
+  margin-left: -0.625rem;
+}
+
+.card-img-overlay {
+  position: absolute;
+  top: 0;
+  right: 0;
+  bottom: 0;
+  left: 0;
+  padding: 1.25rem;
+}
+
+.card-img {
+  width: 100%;
+  border-radius: calc(0.25rem - 1px);
+}
+
+.card-img-top {
+  width: 100%;
+  border-top-left-radius: calc(0.25rem - 1px);
+  border-top-right-radius: calc(0.25rem - 1px);
+}
+
+.card-img-bottom {
+  width: 100%;
+  border-bottom-right-radius: calc(0.25rem - 1px);
+  border-bottom-left-radius: calc(0.25rem - 1px);
+}
+
+.card-deck {
+  display: -ms-flexbox;
+  display: flex;
+  -ms-flex-direction: column;
+  flex-direction: column;
+}
+
+.card-deck .card {
+  margin-bottom: 15px;
+}
+
+@media (min-width: 576px) {
+  .card-deck {
+    -ms-flex-flow: row wrap;
+    flex-flow: row wrap;
+    margin-right: -15px;
+    margin-left: -15px;
+  }
+  .card-deck .card {
+    display: -ms-flexbox;
+    display: flex;
+    -ms-flex: 1 0 0%;
+    flex: 1 0 0%;
+    -ms-flex-direction: column;
+    flex-direction: column;
+    margin-right: 15px;
+    margin-bottom: 0;
+    margin-left: 15px;
+  }
+}
+
+.card-group {
+  display: -ms-flexbox;
+  display: flex;
+  -ms-flex-direction: column;
+  flex-direction: column;
+}
+
+.card-group > .card {
+  margin-bottom: 15px;
+}
+
+@media (min-width: 576px) {
+  .card-group {
+    -ms-flex-flow: row wrap;
+    flex-flow: row wrap;
+  }
+  .card-group > .card {
+    -ms-flex: 1 0 0%;
+    flex: 1 0 0%;
+    margin-bottom: 0;
+  }
+  .card-group > .card + .card {
+    margin-left: 0;
+    border-left: 0;
+  }
+  .card-group > .card:first-child {
+    border-top-right-radius: 0;
+    border-bottom-right-radius: 0;
+  }
+  .card-group > .card:first-child .card-img-top,
+  .card-group > .card:first-child .card-header {
+    border-top-right-radius: 0;
+  }
+  .card-group > .card:first-child .card-img-bottom,
+  .card-group > .card:first-child .card-footer {
+    border-bottom-right-radius: 0;
+  }
+  .card-group > .card:last-child {
+    border-top-left-radius: 0;
+    border-bottom-left-radius: 0;
+  }
+  .card-group > .card:last-child .card-img-top,
+  .card-group > .card:last-child .card-header {
+    border-top-left-radius: 0;
+  }
+  .card-group > .card:last-child .card-img-bottom,
+  .card-group > .card:last-child .card-footer {
+    border-bottom-left-radius: 0;
+  }
+  .card-group > .card:only-child {
+    border-radius: 0.25rem;
+  }
+  .card-group > .card:only-child .card-img-top,
+  .card-group > .card:only-child .card-header {
+    border-top-left-radius: 0.25rem;
+    border-top-right-radius: 0.25rem;
+  }
+  .card-group > .card:only-child .card-img-bottom,
+  .card-group > .card:only-child .card-footer {
+    border-bottom-right-radius: 0.25rem;
+    border-bottom-left-radius: 0.25rem;
+  }
+  .card-group > .card:not(:first-child):not(:last-child):not(:only-child) {
+    border-radius: 0;
+  }
+  .card-group > .card:not(:first-child):not(:last-child):not(:only-child) .card-img-top,
+  .card-group > .card:not(:first-child):not(:last-child):not(:only-child) .card-img-bottom,
+  .card-group > .card:not(:first-child):not(:last-child):not(:only-child) .card-header,
+  .card-group > .card:not(:first-child):not(:last-child):not(:only-child) .card-footer {
+    border-radius: 0;
+  }
+}
+
+.card-columns .card {
+  margin-bottom: 0.75rem;
+}
+
+@media (min-width: 576px) {
+  .card-columns {
+    -webkit-column-count: 3;
+    -moz-column-count: 3;
+    column-count: 3;
+    -webkit-column-gap: 1.25rem;
+    -moz-column-gap: 1.25rem;
+    column-gap: 1.25rem;
+    orphans: 1;
+    widows: 1;
+  }
+  .card-columns .card {
+    display: inline-block;
+    width: 100%;
+  }
+}
+
+.accordion .card:not(:first-of-type):not(:last-of-type) {
+  border-bottom: 0;
+  border-radius: 0;
+}
+
+.accordion .card:not(:first-of-type) .card-header:first-child {
+  border-radius: 0;
+}
+
+.accordion .card:first-of-type {
+  border-bottom: 0;
+  border-bottom-right-radius: 0;
+  border-bottom-left-radius: 0;
+}
+
+.accordion .card:last-of-type {
+  border-top-left-radius: 0;
+  border-top-right-radius: 0;
+}
+
+.breadcrumb {
+  display: -ms-flexbox;
+  display: flex;
+  -ms-flex-wrap: wrap;
+  flex-wrap: wrap;
+  padding: 0.75rem 1rem;
+  margin-bottom: 1rem;
+  list-style: none;
+  background-color: #e9ecef;
+  border-radius: 0.25rem;
+}
+
+.breadcrumb-item + .breadcrumb-item {
+  padding-left: 0.5rem;
+}
+
+.breadcrumb-item + .breadcrumb-item::before {
+  display: inline-block;
+  padding-right: 0.5rem;
+  color: #6c757d;
+  content: "/";
+}
+
+.breadcrumb-item + .breadcrumb-item:hover::before {
+  text-decoration: underline;
+}
+
+.breadcrumb-item + .breadcrumb-item:hover::before {
+  text-decoration: none;
+}
+
+.breadcrumb-item.active {
+  color: #6c757d;
+}
+
+.pagination {
+  display: -ms-flexbox;
+  display: flex;
+  padding-left: 0;
+  list-style: none;
+  border-radius: 0.25rem;
+}
+
+.page-link {
+  position: relative;
+  display: block;
+  padding: 0.5rem 0.75rem;
+  margin-left: -1px;
+  line-height: 1.25;
+  color: #007bff;
+  background-color: #fff;
+  border: 1px solid #dee2e6;
+}
+
+.page-link:hover {
+  z-index: 2;
+  color: #0056b3;
+  text-decoration: none;
+  background-color: #e9ecef;
+  border-color: #dee2e6;
+}
+
+.page-link:focus {
+  z-index: 2;
+  outline: 0;
+  box-shadow: 0 0 0 0.2rem rgba(0, 123, 255, 0.25);
+}
+
+.page-link:not(:disabled):not(.disabled) {
+  cursor: pointer;
+}
+
+.page-item:first-child .page-link {
+  margin-left: 0;
+  border-top-left-radius: 0.25rem;
+  border-bottom-left-radius: 0.25rem;
+}
+
+.page-item:last-child .page-link {
+  border-top-right-radius: 0.25rem;
+  border-bottom-right-radius: 0.25rem;
+}
+
+.page-item.active .page-link {
+  z-index: 1;
+  color: #fff;
+  background-color: #007bff;
+  border-color: #007bff;
+}
+
+.page-item.disabled .page-link {
+  color: #6c757d;
+  pointer-events: none;
+  cursor: auto;
+  background-color: #fff;
+  border-color: #dee2e6;
+}
+
+.pagination-lg .page-link {
+  padding: 0.75rem 1.5rem;
+  font-size: 1.25rem;
+  line-height: 1.5;
+}
+
+.pagination-lg .page-item:first-child .page-link {
+  border-top-left-radius: 0.3rem;
+  border-bottom-left-radius: 0.3rem;
+}
+
+.pagination-lg .page-item:last-child .page-link {
+  border-top-right-radius: 0.3rem;
+  border-bottom-right-radius: 0.3rem;
+}
+
+.pagination-sm .page-link {
+  padding: 0.25rem 0.5rem;
+  font-size: 0.875rem;
+  line-height: 1.5;
+}
+
+.pagination-sm .page-item:first-child .page-link {
+  border-top-left-radius: 0.2rem;
+  border-bottom-left-radius: 0.2rem;
+}
+
+.pagination-sm .page-item:last-child .page-link {
+  border-top-right-radius: 0.2rem;
+  border-bottom-right-radius: 0.2rem;
+}
+
+.badge {
+  display: inline-block;
+  padding: 0.25em 0.4em;
+  font-size: 75%;
+  font-weight: 700;
+  line-height: 1;
+  text-align: center;
+  white-space: nowrap;
+  vertical-align: baseline;
+  border-radius: 0.25rem;
+}
+
+.badge:empty {
+  display: none;
+}
+
+.btn .badge {
+  position: relative;
+  top: -1px;
+}
+
+.badge-pill {
+  padding-right: 0.6em;
+  padding-left: 0.6em;
+  border-radius: 10rem;
+}
+
+.badge-primary {
+  color: #fff;
+  background-color: #007bff;
+}
+
+.badge-primary[href]:hover, .badge-primary[href]:focus {
+  color: #fff;
+  text-decoration: none;
+  background-color: #0062cc;
+}
+
+.badge-secondary {
+  color: #fff;
+  background-color: #6c757d;
+}
+
+.badge-secondary[href]:hover, .badge-secondary[href]:focus {
+  color: #fff;
+  text-decoration: none;
+  background-color: #545b62;
+}
+
+.badge-success {
+  color: #fff;
+  background-color: #28a745;
+}
+
+.badge-success[href]:hover, .badge-success[href]:focus {
+  color: #fff;
+  text-decoration: none;
+  background-color: #1e7e34;
+}
+
+.badge-info {
+  color: #fff;
+  background-color: #17a2b8;
+}
+
+.badge-info[href]:hover, .badge-info[href]:focus {
+  color: #fff;
+  text-decoration: none;
+  background-color: #117a8b;
+}
+
+.badge-warning {
+  color: #212529;
+  background-color: #ffc107;
+}
+
+.badge-warning[href]:hover, .badge-warning[href]:focus {
+  color: #212529;
+  text-decoration: none;
+  background-color: #d39e00;
+}
+
+.badge-danger {
+  color: #fff;
+  background-color: #dc3545;
+}
+
+.badge-danger[href]:hover, .badge-danger[href]:focus {
+  color: #fff;
+  text-decoration: none;
+  background-color: #bd2130;
+}
+
+.badge-light {
+  color: #212529;
+  background-color: #f8f9fa;
+}
+
+.badge-light[href]:hover, .badge-light[href]:focus {
+  color: #212529;
+  text-decoration: none;
+  background-color: #dae0e5;
+}
+
+.badge-dark {
+  color: #fff;
+  background-color: #343a40;
+}
+
+.badge-dark[href]:hover, .badge-dark[href]:focus {
+  color: #fff;
+  text-decoration: none;
+  background-color: #1d2124;
+}
+
+.jumbotron {
+  padding: 2rem 1rem;
+  margin-bottom: 2rem;
+  background-color: #e9ecef;
+  border-radius: 0.3rem;
+}
+
+@media (min-width: 576px) {
+  .jumbotron {
+    padding: 4rem 2rem;
+  }
+}
+
+.jumbotron-fluid {
+  padding-right: 0;
+  padding-left: 0;
+  border-radius: 0;
+}
+
+.alert {
+  position: relative;
+  padding: 0.75rem 1.25rem;
+  margin-bottom: 1rem;
+  border: 1px solid transparent;
+  border-radius: 0.25rem;
+}
+
+.alert-heading {
+  color: inherit;
+}
+
+.alert-link {
+  font-weight: 700;
+}
+
+.alert-dismissible {
+  padding-right: 4rem;
+}
+
+.alert-dismissible .close {
+  position: absolute;
+  top: 0;
+  right: 0;
+  padding: 0.75rem 1.25rem;
+  color: inherit;
+}
+
+.alert-primary {
+  color: #004085;
+  background-color: #cce5ff;
+  border-color: #b8daff;
+}
+
+.alert-primary hr {
+  border-top-color: #9fcdff;
+}
+
+.alert-primary .alert-link {
+  color: #002752;
+}
+
+.alert-secondary {
+  color: #383d41;
+  background-color: #e2e3e5;
+  border-color: #d6d8db;
+}
+
+.alert-secondary hr {
+  border-top-color: #c8cbcf;
+}
+
+.alert-secondary .alert-link {
+  color: #202326;
+}
+
+.alert-success {
+  color: #155724;
+  background-color: #d4edda;
+  border-color: #c3e6cb;
+}
+
+.alert-success hr {
+  border-top-color: #b1dfbb;
+}
+
+.alert-success .alert-link {
+  color: #0b2e13;
+}
+
+.alert-info {
+  color: #0c5460;
+  background-color: #d1ecf1;
+  border-color: #bee5eb;
+}
+
+.alert-info hr {
+  border-top-color: #abdde5;
+}
+
+.alert-info .alert-link {
+  color: #062c33;
+}
+
+.alert-warning {
+  color: #856404;
+  background-color: #fff3cd;
+  border-color: #ffeeba;
+}
+
+.alert-warning hr {
+  border-top-color: #ffe8a1;
+}
+
+.alert-warning .alert-link {
+  color: #533f03;
+}
+
+.alert-danger {
+  color: #721c24;
+  background-color: #f8d7da;
+  border-color: #f5c6cb;
+}
+
+.alert-danger hr {
+  border-top-color: #f1b0b7;
+}
+
+.alert-danger .alert-link {
+  color: #491217;
+}
+
+.alert-light {
+  color: #818182;
+  background-color: #fefefe;
+  border-color: #fdfdfe;
+}
+
+.alert-light hr {
+  border-top-color: #ececf6;
+}
+
+.alert-light .alert-link {
+  color: #686868;
+}
+
+.alert-dark {
+  color: #1b1e21;
+  background-color: #d6d8d9;
+  border-color: #c6c8ca;
+}
+
+.alert-dark hr {
+  border-top-color: #b9bbbe;
+}
+
+.alert-dark .alert-link {
+  color: #040505;
+}
+
+@-webkit-keyframes progress-bar-stripes {
+  from {
+    background-position: 1rem 0;
+  }
+  to {
+    background-position: 0 0;
+  }
+}
+
+@keyframes progress-bar-stripes {
+  from {
+    background-position: 1rem 0;
+  }
+  to {
+    background-position: 0 0;
+  }
+}
+
+.progress {
+  display: -ms-flexbox;
+  display: flex;
+  height: 1rem;
+  overflow: hidden;
+  font-size: 0.75rem;
+  background-color: #e9ecef;
+  border-radius: 0.25rem;
+}
+
+.progress-bar {
+  display: -ms-flexbox;
+  display: flex;
+  -ms-flex-direction: column;
+  flex-direction: column;
+  -ms-flex-pack: center;
+  justify-content: center;
+  color: #fff;
+  text-align: center;
+  white-space: nowrap;
+  background-color: #007bff;
+  transition: width 0.6s ease;
+}
+
+@media screen and (prefers-reduced-motion: reduce) {
+  .progress-bar {
+    transition: none;
+  }
+}
+
+.progress-bar-striped {
+  background-image: linear-gradient(45deg, rgba(255, 255, 255, 0.15) 25%, transparent 25%, transparent 50%, rgba(255, 255, 255, 0.15) 50%, rgba(255, 255, 255, 0.15) 75%, transparent 75%, transparent);
+  background-size: 1rem 1rem;
+}
+
+.progress-bar-animated {
+  -webkit-animation: progress-bar-stripes 1s linear infinite;
+  animation: progress-bar-stripes 1s linear infinite;
+}
+
+.media {
+  display: -ms-flexbox;
+  display: flex;
+  -ms-flex-align: start;
+  align-items: flex-start;
+}
+
+.media-body {
+  -ms-flex: 1;
+  flex: 1;
+}
+
+.list-group {
+  display: -ms-flexbox;
+  display: flex;
+  -ms-flex-direction: column;
+  flex-direction: column;
+  padding-left: 0;
+  margin-bottom: 0;
+}
+
+.list-group-item-action {
+  width: 100%;
+  color: #495057;
+  text-align: inherit;
+}
+
+.list-group-item-action:hover, .list-group-item-action:focus {
+  color: #495057;
+  text-decoration: none;
+  background-color: #f8f9fa;
+}
+
+.list-group-item-action:active {
+  color: #212529;
+  background-color: #e9ecef;
+}
+
+.list-group-item {
+  position: relative;
+  display: block;
+  padding: 0.75rem 1.25rem;
+  margin-bottom: -1px;
+  background-color: #fff;
+  border: 1px solid rgba(0, 0, 0, 0.125);
+}
+
+.list-group-item:first-child {
+  border-top-left-radius: 0.25rem;
+  border-top-right-radius: 0.25rem;
+}
+
+.list-group-item:last-child {
+  margin-bottom: 0;
+  border-bottom-right-radius: 0.25rem;
+  border-bottom-left-radius: 0.25rem;
+}
+
+.list-group-item:hover, .list-group-item:focus {
+  z-index: 1;
+  text-decoration: none;
+}
+
+.list-group-item.disabled, .list-group-item:disabled {
+  color: #6c757d;
+  background-color: #fff;
+}
+
+.list-group-item.active {
+  z-index: 2;
+  color: #fff;
+  background-color: #007bff;
+  border-color: #007bff;
+}
+
+.list-group-flush .list-group-item {
+  border-right: 0;
+  border-left: 0;
+  border-radius: 0;
+}
+
+.list-group-flush:first-child .list-group-item:first-child {
+  border-top: 0;
+}
+
+.list-group-flush:last-child .list-group-item:last-child {
+  border-bottom: 0;
+}
+
+.list-group-item-primary {
+  color: #004085;
+  background-color: #b8daff;
+}
+
+.list-group-item-primary.list-group-item-action:hover, .list-group-item-primary.list-group-item-action:focus {
+  color: #004085;
+  background-color: #9fcdff;
+}
+
+.list-group-item-primary.list-group-item-action.active {
+  color: #fff;
+  background-color: #004085;
+  border-color: #004085;
+}
+
+.list-group-item-secondary {
+  color: #383d41;
+  background-color: #d6d8db;
+}
+
+.list-group-item-secondary.list-group-item-action:hover, .list-group-item-secondary.list-group-item-action:focus {
+  color: #383d41;
+  background-color: #c8cbcf;
+}
+
+.list-group-item-secondary.list-group-item-action.active {
+  color: #fff;
+  background-color: #383d41;
+  border-color: #383d41;
+}
+
+.list-group-item-success {
+  color: #155724;
+  background-color: #c3e6cb;
+}
+
+.list-group-item-success.list-group-item-action:hover, .list-group-item-success.list-group-item-action:focus {
+  color: #155724;
+  background-color: #b1dfbb;
+}
+
+.list-group-item-success.list-group-item-action.active {
+  color: #fff;
+  background-color: #155724;
+  border-color: #155724;
+}
+
+.list-group-item-info {
+  color: #0c5460;
+  background-color: #bee5eb;
+}
+
+.list-group-item-info.list-group-item-action:hover, .list-group-item-info.list-group-item-action:focus {
+  color: #0c5460;
+  background-color: #abdde5;
+}
+
+.list-group-item-info.list-group-item-action.active {
+  color: #fff;
+  background-color: #0c5460;
+  border-color: #0c5460;
+}
+
+.list-group-item-warning {
+  color: #856404;
+  background-color: #ffeeba;
+}
+
+.list-group-item-warning.list-group-item-action:hover, .list-group-item-warning.list-group-item-action:focus {
+  color: #856404;
+  background-color: #ffe8a1;
+}
+
+.list-group-item-warning.list-group-item-action.active {
+  color: #fff;
+  background-color: #856404;
+  border-color: #856404;
+}
+
+.list-group-item-danger {
+  color: #721c24;
+  background-color: #f5c6cb;
+}
+
+.list-group-item-danger.list-group-item-action:hover, .list-group-item-danger.list-group-item-action:focus {
+  color: #721c24;
+  background-color: #f1b0b7;
+}
+
+.list-group-item-danger.list-group-item-action.active {
+  color: #fff;
+  background-color: #721c24;
+  border-color: #721c24;
+}
+
+.list-group-item-light {
+  color: #818182;
+  background-color: #fdfdfe;
+}
+
+.list-group-item-light.list-group-item-action:hover, .list-group-item-light.list-group-item-action:focus {
+  color: #818182;
+  background-color: #ececf6;
+}
+
+.list-group-item-light.list-group-item-action.active {
+  color: #fff;
+  background-color: #818182;
+  border-color: #818182;
+}
+
+.list-group-item-dark {
+  color: #1b1e21;
+  background-color: #c6c8ca;
+}
+
+.list-group-item-dark.list-group-item-action:hover, .list-group-item-dark.list-group-item-action:focus {
+  color: #1b1e21;
+  background-color: #b9bbbe;
+}
+
+.list-group-item-dark.list-group-item-action.active {
+  color: #fff;
+  background-color: #1b1e21;
+  border-color: #1b1e21;
+}
+
+.close {
+  float: right;
+  font-size: 1.5rem;
+  font-weight: 700;
+  line-height: 1;
+  color: #000;
+  text-shadow: 0 1px 0 #fff;
+  opacity: .5;
+}
+
+.close:not(:disabled):not(.disabled) {
+  cursor: pointer;
+}
+
+.close:not(:disabled):not(.disabled):hover, .close:not(:disabled):not(.disabled):focus {
+  color: #000;
+  text-decoration: none;
+  opacity: .75;
+}
+
+button.close {
+  padding: 0;
+  background-color: transparent;
+  border: 0;
+  -webkit-appearance: none;
+}
+
+.modal-open {
+  overflow: hidden;
+}
+
+.modal-open .modal {
+  overflow-x: hidden;
+  overflow-y: auto;
+}
+
+.modal {
+  position: fixed;
+  top: 0;
+  right: 0;
+  bottom: 0;
+  left: 0;
+  z-index: 1050;
+  display: none;
+  overflow: hidden;
+  outline: 0;
+}
+
+.modal-dialog {
+  position: relative;
+  width: auto;
+  margin: 0.5rem;
+  pointer-events: none;
+}
+
+.modal.fade .modal-dialog {
+  transition: -webkit-transform 0.3s ease-out;
+  transition: transform 0.3s ease-out;
+  transition: transform 0.3s ease-out, -webkit-transform 0.3s ease-out;
+  -webkit-transform: translate(0, -25%);
+  transform: translate(0, -25%);
+}
+
+@media screen and (prefers-reduced-motion: reduce) {
+  .modal.fade .modal-dialog {
+    transition: none;
+  }
+}
+
+.modal.show .modal-dialog {
+  -webkit-transform: translate(0, 0);
+  transform: translate(0, 0);
+}
+
+.modal-dialog-centered {
+  display: -ms-flexbox;
+  display: flex;
+  -ms-flex-align: center;
+  align-items: center;
+  min-height: calc(100% - (0.5rem * 2));
+}
+
+.modal-dialog-centered::before {
+  display: block;
+  height: calc(100vh - (0.5rem * 2));
+  content: "";
+}
+
+.modal-content {
+  position: relative;
+  display: -ms-flexbox;
+  display: flex;
+  -ms-flex-direction: column;
+  flex-direction: column;
+  width: 100%;
+  pointer-events: auto;
+  background-color: #fff;
+  background-clip: padding-box;
+  border: 1px solid rgba(0, 0, 0, 0.2);
+  border-radius: 0.3rem;
+  outline: 0;
+}
+
+.modal-backdrop {
+  position: fixed;
+  top: 0;
+  right: 0;
+  bottom: 0;
+  left: 0;
+  z-index: 1040;
+  background-color: #000;
+}
+
+.modal-backdrop.fade {
+  opacity: 0;
+}
+
+.modal-backdrop.show {
+  opacity: 0.5;
+}
+
+.modal-header {
+  display: -ms-flexbox;
+  display: flex;
+  -ms-flex-align: start;
+  align-items: flex-start;
+  -ms-flex-pack: justify;
+  justify-content: space-between;
+  padding: 1rem;
+  border-bottom: 1px solid #e9ecef;
+  border-top-left-radius: 0.3rem;
+  border-top-right-radius: 0.3rem;
+}
+
+.modal-header .close {
+  padding: 1rem;
+  margin: -1rem -1rem -1rem auto;
+}
+
+.modal-title {
+  margin-bottom: 0;
+  line-height: 1.5;
+}
+
+.modal-body {
+  position: relative;
+  -ms-flex: 1 1 auto;
+  flex: 1 1 auto;
+  padding: 1rem;
+}
+
+.modal-footer {
+  display: -ms-flexbox;
+  display: flex;
+  -ms-flex-align: center;
+  align-items: center;
+  -ms-flex-pack: end;
+  justify-content: flex-end;
+  padding: 1rem;
+  border-top: 1px solid #e9ecef;
+}
+
+.modal-footer > :not(:first-child) {
+  margin-left: .25rem;
+}
+
+.modal-footer > :not(:last-child) {
+  margin-right: .25rem;
+}
+
+.modal-scrollbar-measure {
+  position: absolute;
+  top: -9999px;
+  width: 50px;
+  height: 50px;
+  overflow: scroll;
+}
+
+@media (min-width: 576px) {
+  .modal-dialog {
+    max-width: 500px;
+    margin: 1.75rem auto;
+  }
+  .modal-dialog-centered {
+    min-height: calc(100% - (1.75rem * 2));
+  }
+  .modal-dialog-centered::before {
+    height: calc(100vh - (1.75rem * 2));
+  }
+  .modal-sm {
+    max-width: 300px;
+  }
+}
+
+@media (min-width: 992px) {
+  .modal-lg {
+    max-width: 800px;
+  }
+}
+
+.tooltip {
+  position: absolute;
+  z-index: 1070;
+  display: block;
+  margin: 0;
+  font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji";
+  font-style: normal;
+  font-weight: 400;
+  line-height: 1.5;
+  text-align: left;
+  text-align: start;
+  text-decoration: none;
+  text-shadow: none;
+  text-transform: none;
+  letter-spacing: normal;
+  word-break: normal;
+  word-spacing: normal;
+  white-space: normal;
+  line-break: auto;
+  font-size: 0.875rem;
+  word-wrap: break-word;
+  opacity: 0;
+}
+
+.tooltip.show {
+  opacity: 0.9;
+}
+
+.tooltip .arrow {
+  position: absolute;
+  display: block;
+  width: 0.8rem;
+  height: 0.4rem;
+}
+
+.tooltip .arrow::before {
+  position: absolute;
+  content: "";
+  border-color: transparent;
+  border-style: solid;
+}
+
+.bs-tooltip-top, .bs-tooltip-auto[x-placement^="top"] {
+  padding: 0.4rem 0;
+}
+
+.bs-tooltip-top .arrow, .bs-tooltip-auto[x-placement^="top"] .arrow {
+  bottom: 0;
+}
+
+.bs-tooltip-top .arrow::before, .bs-tooltip-auto[x-placement^="top"] .arrow::before {
+  top: 0;
+  border-width: 0.4rem 0.4rem 0;
+  border-top-color: #000;
+}
+
+.bs-tooltip-right, .bs-tooltip-auto[x-placement^="right"] {
+  padding: 0 0.4rem;
+}
+
+.bs-tooltip-right .arrow, .bs-tooltip-auto[x-placement^="right"] .arrow {
+  left: 0;
+  width: 0.4rem;
+  height: 0.8rem;
+}
+
+.bs-tooltip-right .arrow::before, .bs-tooltip-auto[x-placement^="right"] .arrow::before {
+  right: 0;
+  border-width: 0.4rem 0.4rem 0.4rem 0;
+  border-right-color: #000;
+}
+
+.bs-tooltip-bottom, .bs-tooltip-auto[x-placement^="bottom"] {
+  padding: 0.4rem 0;
+}
+
+.bs-tooltip-bottom .arrow, .bs-tooltip-auto[x-placement^="bottom"] .arrow {
+  top: 0;
+}
+
+.bs-tooltip-bottom .arrow::before, .bs-tooltip-auto[x-placement^="bottom"] .arrow::before {
+  bottom: 0;
+  border-width: 0 0.4rem 0.4rem;
+  border-bottom-color: #000;
+}
+
+.bs-tooltip-left, .bs-tooltip-auto[x-placement^="left"] {
+  padding: 0 0.4rem;
+}
+
+.bs-tooltip-left .arrow, .bs-tooltip-auto[x-placement^="left"] .arrow {
+  right: 0;
+  width: 0.4rem;
+  height: 0.8rem;
+}
+
+.bs-tooltip-left .arrow::before, .bs-tooltip-auto[x-placement^="left"] .arrow::before {
+  left: 0;
+  border-width: 0.4rem 0 0.4rem 0.4rem;
+  border-left-color: #000;
+}
+
+.tooltip-inner {
+  max-width: 200px;
+  padding: 0.25rem 0.5rem;
+  color: #fff;
+  text-align: center;
+  background-color: #000;
+  border-radius: 0.25rem;
+}
+
+.popover {
+  position: absolute;
+  top: 0;
+  left: 0;
+  z-index: 1060;
+  display: block;
+  max-width: 276px;
+  font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol", "Noto Color Emoji";
+  font-style: normal;
+  font-weight: 400;
+  line-height: 1.5;
+  text-align: left;
+  text-align: start;
+  text-decoration: none;
+  text-shadow: none;
+  text-transform: none;
+  letter-spacing: normal;
+  word-break: normal;
+  word-spacing: normal;
+  white-space: normal;
+  line-break: auto;
+  font-size: 0.875rem;
+  word-wrap: break-word;
+  background-color: #fff;
+  background-clip: padding-box;
+  border: 1px solid rgba(0, 0, 0, 0.2);
+  border-radius: 0.3rem;
+}
+
+.popover .arrow {
+  position: absolute;
+  display: block;
+  width: 1rem;
+  height: 0.5rem;
+  margin: 0 0.3rem;
+}
+
+.popover .arrow::before, .popover .arrow::after {
+  position: absolute;
+  display: block;
+  content: "";
+  border-color: transparent;
+  border-style: solid;
+}
+
+.bs-popover-top, .bs-popover-auto[x-placement^="top"] {
+  margin-bottom: 0.5rem;
+}
+
+.bs-popover-top .arrow, .bs-popover-auto[x-placement^="top"] .arrow {
+  bottom: calc((0.5rem + 1px) * -1);
+}
+
+.bs-popover-top .arrow::before, .bs-popover-auto[x-placement^="top"] .arrow::before,
+.bs-popover-top .arrow::after,
+.bs-popover-auto[x-placement^="top"] .arrow::after {
+  border-width: 0.5rem 0.5rem 0;
+}
+
+.bs-popover-top .arrow::before, .bs-popover-auto[x-placement^="top"] .arrow::before {
+  bottom: 0;
+  border-top-color: rgba(0, 0, 0, 0.25);
+}
+
+
+.bs-popover-top .arrow::after,
+.bs-popover-auto[x-placement^="top"] .arrow::after {
+  bottom: 1px;
+  border-top-color: #fff;
+}
+
+.bs-popover-right, .bs-popover-auto[x-placement^="right"] {
+  margin-left: 0.5rem;
+}
+
+.bs-popover-right .arrow, .bs-popover-auto[x-placement^="right"] .arrow {
+  left: calc((0.5rem + 1px) * -1);
+  width: 0.5rem;
+  height: 1rem;
+  margin: 0.3rem 0;
+}
+
+.bs-popover-right .arrow::before, .bs-popover-auto[x-placement^="right"] .arrow::before,
+.bs-popover-right .arrow::after,
+.bs-popover-auto[x-placement^="right"] .arrow::after {
+  border-width: 0.5rem 0.5rem 0.5rem 0;
+}
+
+.bs-popover-right .arrow::before, .bs-popover-auto[x-placement^="right"] .arrow::before {
+  left: 0;
+  border-right-color: rgba(0, 0, 0, 0.25);
+}
+
+
+.bs-popover-right .arrow::after,
+.bs-popover-auto[x-placement^="right"] .arrow::after {
+  left: 1px;
+  border-right-color: #fff;
+}
+
+.bs-popover-bottom, .bs-popover-auto[x-placement^="bottom"] {
+  margin-top: 0.5rem;
+}
+
+.bs-popover-bottom .arrow, .bs-popover-auto[x-placement^="bottom"] .arrow {
+  top: calc((0.5rem + 1px) * -1);
+}
+
+.bs-popover-bottom .arrow::before, .bs-popover-auto[x-placement^="bottom"] .arrow::before,
+.bs-popover-bottom .arrow::after,
+.bs-popover-auto[x-placement^="bottom"] .arrow::after {
+  border-width: 0 0.5rem 0.5rem 0.5rem;
+}
+
+.bs-popover-bottom .arrow::before, .bs-popover-auto[x-placement^="bottom"] .arrow::before {
+  top: 0;
+  border-bottom-color: rgba(0, 0, 0, 0.25);
+}
+
+
+.bs-popover-bottom .arrow::after,
+.bs-popover-auto[x-placement^="bottom"] .arrow::after {
+  top: 1px;
+  border-bottom-color: #fff;
+}
+
+.bs-popover-bottom .popover-header::before, .bs-popover-auto[x-placement^="bottom"] .popover-header::before {
+  position: absolute;
+  top: 0;
+  left: 50%;
+  display: block;
+  width: 1rem;
+  margin-left: -0.5rem;
+  content: "";
+  border-bottom: 1px solid #f7f7f7;
+}
+
+.bs-popover-left, .bs-popover-auto[x-placement^="left"] {
+  margin-right: 0.5rem;
+}
+
+.bs-popover-left .arrow, .bs-popover-auto[x-placement^="left"] .arrow {
+  right: calc((0.5rem + 1px) * -1);
+  width: 0.5rem;
+  height: 1rem;
+  margin: 0.3rem 0;
+}
+
+.bs-popover-left .arrow::before, .bs-popover-auto[x-placement^="left"] .arrow::before,
+.bs-popover-left .arrow::after,
+.bs-popover-auto[x-placement^="left"] .arrow::after {
+  border-width: 0.5rem 0 0.5rem 0.5rem;
+}
+
+.bs-popover-left .arrow::before, .bs-popover-auto[x-placement^="left"] .arrow::before {
+  right: 0;
+  border-left-color: rgba(0, 0, 0, 0.25);
+}
+
+
+.bs-popover-left .arrow::after,
+.bs-popover-auto[x-placement^="left"] .arrow::after {
+  right: 1px;
+  border-left-color: #fff;
+}
+
+.popover-header {
+  padding: 0.5rem 0.75rem;
+  margin-bottom: 0;
+  font-size: 1rem;
+  color: inherit;
+  background-color: #f7f7f7;
+  border-bottom: 1px solid #ebebeb;
+  border-top-left-radius: calc(0.3rem - 1px);
+  border-top-right-radius: calc(0.3rem - 1px);
+}
+
+.popover-header:empty {
+  display: none;
+}
+
+.popover-body {
+  padding: 0.5rem 0.75rem;
+  color: #212529;
+}
+
+.carousel {
+  position: relative;
+}
+
+.carousel-inner {
+  position: relative;
+  width: 100%;
+  overflow: hidden;
+}
+
+.carousel-item {
+  position: relative;
+  display: none;
+  -ms-flex-align: center;
+  align-items: center;
+  width: 100%;
+  -webkit-backface-visibility: hidden;
+  backface-visibility: hidden;
+  -webkit-perspective: 1000px;
+  perspective: 1000px;
+}
+
+.carousel-item.active,
+.carousel-item-next,
+.carousel-item-prev {
+  display: block;
+  transition: -webkit-transform 0.6s ease;
+  transition: transform 0.6s ease;
+  transition: transform 0.6s ease, -webkit-transform 0.6s ease;
+}
+
+@media screen and (prefers-reduced-motion: reduce) {
+  .carousel-item.active,
+  .carousel-item-next,
+  .carousel-item-prev {
+    transition: none;
+  }
+}
+
+.carousel-item-next,
+.carousel-item-prev {
+  position: absolute;
+  top: 0;
+}
+
+.carousel-item-next.carousel-item-left,
+.carousel-item-prev.carousel-item-right {
+  -webkit-transform: translateX(0);
+  transform: translateX(0);
+}
+
+@supports ((-webkit-transform-style: preserve-3d) or (transform-style: preserve-3d)) {
+  .carousel-item-next.carousel-item-left,
+  .carousel-item-prev.carousel-item-right {
+    -webkit-transform: translate3d(0, 0, 0);
+    transform: translate3d(0, 0, 0);
+  }
+}
+
+.carousel-item-next,
+.active.carousel-item-right {
+  -webkit-transform: translateX(100%);
+  transform: translateX(100%);
+}
+
+@supports ((-webkit-transform-style: preserve-3d) or (transform-style: preserve-3d)) {
+  .carousel-item-next,
+  .active.carousel-item-right {
+    -webkit-transform: translate3d(100%, 0, 0);
+    transform: translate3d(100%, 0, 0);
+  }
+}
+
+.carousel-item-prev,
+.active.carousel-item-left {
+  -webkit-transform: translateX(-100%);
+  transform: translateX(-100%);
+}
+
+@supports ((-webkit-transform-style: preserve-3d) or (transform-style: preserve-3d)) {
+  .carousel-item-prev,
+  .active.carousel-item-left {
+    -webkit-transform: translate3d(-100%, 0, 0);
+    transform: translate3d(-100%, 0, 0);
+  }
+}
+
+.carousel-fade .carousel-item {
+  opacity: 0;
+  transition-duration: .6s;
+  transition-property: opacity;
+}
+
+.carousel-fade .carousel-item.active,
+.carousel-fade .carousel-item-next.carousel-item-left,
+.carousel-fade .carousel-item-prev.carousel-item-right {
+  opacity: 1;
+}
+
+.carousel-fade .active.carousel-item-left,
+.carousel-fade .active.carousel-item-right {
+  opacity: 0;
+}
+
+.carousel-fade .carousel-item-next,
+.carousel-fade .carousel-item-prev,
+.carousel-fade .carousel-item.active,
+.carousel-fade .active.carousel-item-left,
+.carousel-fade .active.carousel-item-prev {
+  -webkit-transform: translateX(0);
+  transform: translateX(0);
+}
+
+@supports ((-webkit-transform-style: preserve-3d) or (transform-style: preserve-3d)) {
+  .carousel-fade .carousel-item-next,
+  .carousel-fade .carousel-item-prev,
+  .carousel-fade .carousel-item.active,
+  .carousel-fade .active.carousel-item-left,
+  .carousel-fade .active.carousel-item-prev {
+    -webkit-transform: translate3d(0, 0, 0);
+    transform: translate3d(0, 0, 0);
+  }
+}
+
+.carousel-control-prev,
+.carousel-control-next {
+  position: absolute;
+  top: 0;
+  bottom: 0;
+  display: -ms-flexbox;
+  display: flex;
+  -ms-flex-align: center;
+  align-items: center;
+  -ms-flex-pack: center;
+  justify-content: center;
+  width: 15%;
+  color: #fff;
+  text-align: center;
+  opacity: 0.5;
+}
+
+.carousel-control-prev:hover, .carousel-control-prev:focus,
+.carousel-control-next:hover,
+.carousel-control-next:focus {
+  color: #fff;
+  text-decoration: none;
+  outline: 0;
+  opacity: .9;
+}
+
+.carousel-control-prev {
+  left: 0;
+}
+
+.carousel-control-next {
+  right: 0;
+}
+
+.carousel-control-prev-icon,
+.carousel-control-next-icon {
+  display: inline-block;
+  width: 20px;
+  height: 20px;
+  background: transparent no-repeat center center;
+  background-size: 100% 100%;
+}
+
+.carousel-control-prev-icon {
+  background-image: url("data:image/svg+xml;charset=utf8,%3Csvg xmlns='http://www.w3.org/2000/svg' fill='%23fff' viewBox='0 0 8 8'%3E%3Cpath d='M5.25 0l-4 4 4 4 1.5-1.5-2.5-2.5 2.5-2.5-1.5-1.5z'/%3E%3C/svg%3E");
+}
+
+.carousel-control-next-icon {
+  background-image: url("data:image/svg+xml;charset=utf8,%3Csvg xmlns='http://www.w3.org/2000/svg' fill='%23fff' viewBox='0 0 8 8'%3E%3Cpath d='M2.75 0l-1.5 1.5 2.5 2.5-2.5 2.5 1.5 1.5 4-4-4-4z'/%3E%3C/svg%3E");
+}
+
+.carousel-indicators {
+  position: absolute;
+  right: 0;
+  bottom: 10px;
+  left: 0;
+  z-index: 15;
+  display: -ms-flexbox;
+  display: flex;
+  -ms-flex-pack: center;
+  justify-content: center;
+  padding-left: 0;
+  margin-right: 15%;
+  margin-left: 15%;
+  list-style: none;
+}
+
+.carousel-indicators li {
+  position: relative;
+  -ms-flex: 0 1 auto;
+  flex: 0 1 auto;
+  width: 30px;
+  height: 3px;
+  margin-right: 3px;
+  margin-left: 3px;
+  text-indent: -999px;
+  cursor: pointer;
+  background-color: rgba(255, 255, 255, 0.5);
+}
+
+.carousel-indicators li::before {
+  position: absolute;
+  top: -10px;
+  left: 0;
+  display: inline-block;
+  width: 100%;
+  height: 10px;
+  content: "";
+}
+
+.carousel-indicators li::after {
+  position: absolute;
+  bottom: -10px;
+  left: 0;
+  display: inline-block;
+  width: 100%;
+  height: 10px;
+  content: "";
+}
+
+.carousel-indicators .active {
+  background-color: #fff;
+}
+
+.carousel-caption {
+  position: absolute;
+  right: 15%;
+  bottom: 20px;
+  left: 15%;
+  z-index: 10;
+  padding-top: 20px;
+  padding-bottom: 20px;
+  color: #fff;
+  text-align: center;
+}
+
+.align-baseline {
+  vertical-align: baseline !important;
+}
+
+.align-top {
+  vertical-align: top !important;
+}
+
+.align-middle {
+  vertical-align: middle !important;
+}
+
+.align-bottom {
+  vertical-align: bottom !important;
+}
+
+.align-text-bottom {
+  vertical-align: text-bottom !important;
+}
+
+.align-text-top {
+  vertical-align: text-top !important;
+}
+
+.bg-primary {
+  background-color: #007bff !important;
+}
+
+a.bg-primary:hover, a.bg-primary:focus,
+button.bg-primary:hover,
+button.bg-primary:focus {
+  background-color: #0062cc !important;
+}
+
+.bg-secondary {
+  background-color: #6c757d !important;
+}
+
+a.bg-secondary:hover, a.bg-secondary:focus,
+button.bg-secondary:hover,
+button.bg-secondary:focus {
+  background-color: #545b62 !important;
+}
+
+.bg-success {
+  background-color: #28a745 !important;
+}
+
+a.bg-success:hover, a.bg-success:focus,
+button.bg-success:hover,
+button.bg-success:focus {
+  background-color: #1e7e34 !important;
+}
+
+.bg-info {
+  background-color: #17a2b8 !important;
+}
+
+a.bg-info:hover, a.bg-info:focus,
+button.bg-info:hover,
+button.bg-info:focus {
+  background-color: #117a8b !important;
+}
+
+.bg-warning {
+  background-color: #ffc107 !important;
+}
+
+a.bg-warning:hover, a.bg-warning:focus,
+button.bg-warning:hover,
+button.bg-warning:focus {
+  background-color: #d39e00 !important;
+}
+
+.bg-danger {
+  background-color: #dc3545 !important;
+}
+
+a.bg-danger:hover, a.bg-danger:focus,
+button.bg-danger:hover,
+button.bg-danger:focus {
+  background-color: #bd2130 !important;
+}
+
+.bg-light {
+  background-color: #f8f9fa !important;
+}
+
+a.bg-light:hover, a.bg-light:focus,
+button.bg-light:hover,
+button.bg-light:focus {
+  background-color: #dae0e5 !important;
+}
+
+.bg-dark {
+  background-color: #343a40 !important;
+}
+
+a.bg-dark:hover, a.bg-dark:focus,
+button.bg-dark:hover,
+button.bg-dark:focus {
+  background-color: #1d2124 !important;
+}
+
+.bg-white {
+  background-color: #fff !important;
+}
+
+.bg-transparent {
+  background-color: transparent !important;
+}
+
+.border {
+  border: 1px solid #dee2e6 !important;
+}
+
+.border-top {
+  border-top: 1px solid #dee2e6 !important;
+}
+
+.border-right {
+  border-right: 1px solid #dee2e6 !important;
+}
+
+.border-bottom {
+  border-bottom: 1px solid #dee2e6 !important;
+}
+
+.border-left {
+  border-left: 1px solid #dee2e6 !important;
+}
+
+.border-0 {
+  border: 0 !important;
+}
+
+.border-top-0 {
+  border-top: 0 !important;
+}
+
+.border-right-0 {
+  border-right: 0 !important;
+}
+
+.border-bottom-0 {
+  border-bottom: 0 !important;
+}
+
+.border-left-0 {
+  border-left: 0 !important;
+}
+
+.border-primary {
+  border-color: #007bff !important;
+}
+
+.border-secondary {
+  border-color: #6c757d !important;
+}
+
+.border-success {
+  border-color: #28a745 !important;
+}
+
+.border-info {
+  border-color: #17a2b8 !important;
+}
+
+.border-warning {
+  border-color: #ffc107 !important;
+}
+
+.border-danger {
+  border-color: #dc3545 !important;
+}
+
+.border-light {
+  border-color: #f8f9fa !important;
+}
+
+.border-dark {
+  border-color: #343a40 !important;
+}
+
+.border-white {
+  border-color: #fff !important;
+}
+
+.rounded {
+  border-radius: 0.25rem !important;
+}
+
+.rounded-top {
+  border-top-left-radius: 0.25rem !important;
+  border-top-right-radius: 0.25rem !important;
+}
+
+.rounded-right {
+  border-top-right-radius: 0.25rem !important;
+  border-bottom-right-radius: 0.25rem !important;
+}
+
+.rounded-bottom {
+  border-bottom-right-radius: 0.25rem !important;
+  border-bottom-left-radius: 0.25rem !important;
+}
+
+.rounded-left {
+  border-top-left-radius: 0.25rem !important;
+  border-bottom-left-radius: 0.25rem !important;
+}
+
+.rounded-circle {
+  border-radius: 50% !important;
+}
+
+.rounded-0 {
+  border-radius: 0 !important;
+}
+
+.clearfix::after {
+  display: block;
+  clear: both;
+  content: "";
+}
+
+.d-none {
+  display: none !important;
+}
+
+.d-inline {
+  display: inline !important;
+}
+
+.d-inline-block {
+  display: inline-block !important;
+}
+
+.d-block {
+  display: block !important;
+}
+
+.d-table {
+  display: table !important;
+}
+
+.d-table-row {
+  display: table-row !important;
+}
+
+.d-table-cell {
+  display: table-cell !important;
+}
+
+.d-flex {
+  display: -ms-flexbox !important;
+  display: flex !important;
+}
+
+.d-inline-flex {
+  display: -ms-inline-flexbox !important;
+  display: inline-flex !important;
+}
+
+@media (min-width: 576px) {
+  .d-sm-none {
+    display: none !important;
+  }
+  .d-sm-inline {
+    display: inline !important;
+  }
+  .d-sm-inline-block {
+    display: inline-block !important;
+  }
+  .d-sm-block {
+    display: block !important;
+  }
+  .d-sm-table {
+    display: table !important;
+  }
+  .d-sm-table-row {
+    display: table-row !important;
+  }
+  .d-sm-table-cell {
+    display: table-cell !important;
+  }
+  .d-sm-flex {
+    display: -ms-flexbox !important;
+    display: flex !important;
+  }
+  .d-sm-inline-flex {
+    display: -ms-inline-flexbox !important;
+    display: inline-flex !important;
+  }
+}
+
+@media (min-width: 768px) {
+  .d-md-none {
+    display: none !important;
+  }
+  .d-md-inline {
+    display: inline !important;
+  }
+  .d-md-inline-block {
+    display: inline-block !important;
+  }
+  .d-md-block {
+    display: block !important;
+  }
+  .d-md-table {
+    display: table !important;
+  }
+  .d-md-table-row {
+    display: table-row !important;
+  }
+  .d-md-table-cell {
+    display: table-cell !important;
+  }
+  .d-md-flex {
+    display: -ms-flexbox !important;
+    display: flex !important;
+  }
+  .d-md-inline-flex {
+    display: -ms-inline-flexbox !important;
+    display: inline-flex !important;
+  }
+}
+
+@media (min-width: 992px) {
+  .d-lg-none {
+    display: none !important;
+  }
+  .d-lg-inline {
+    display: inline !important;
+  }
+  .d-lg-inline-block {
+    display: inline-block !important;
+  }
+  .d-lg-block {
+    display: block !important;
+  }
+  .d-lg-table {
+    display: table !important;
+  }
+  .d-lg-table-row {
+    display: table-row !important;
+  }
+  .d-lg-table-cell {
+    display: table-cell !important;
+  }
+  .d-lg-flex {
+    display: -ms-flexbox !important;
+    display: flex !important;
+  }
+  .d-lg-inline-flex {
+    display: -ms-inline-flexbox !important;
+    display: inline-flex !important;
+  }
+}
+
+@media (min-width: 1200px) {
+  .d-xl-none {
+    display: none !important;
+  }
+  .d-xl-inline {
+    display: inline !important;
+  }
+  .d-xl-inline-block {
+    display: inline-block !important;
+  }
+  .d-xl-block {
+    display: block !important;
+  }
+  .d-xl-table {
+    display: table !important;
+  }
+  .d-xl-table-row {
+    display: table-row !important;
+  }
+  .d-xl-table-cell {
+    display: table-cell !important;
+  }
+  .d-xl-flex {
+    display: -ms-flexbox !important;
+    display: flex !important;
+  }
+  .d-xl-inline-flex {
+    display: -ms-inline-flexbox !important;
+    display: inline-flex !important;
+  }
+}
+
+@media print {
+  .d-print-none {
+    display: none !important;
+  }
+  .d-print-inline {
+    display: inline !important;
+  }
+  .d-print-inline-block {
+    display: inline-block !important;
+  }
+  .d-print-block {
+    display: block !important;
+  }
+  .d-print-table {
+    display: table !important;
+  }
+  .d-print-table-row {
+    display: table-row !important;
+  }
+  .d-print-table-cell {
+    display: table-cell !important;
+  }
+  .d-print-flex {
+    display: -ms-flexbox !important;
+    display: flex !important;
+  }
+  .d-print-inline-flex {
+    display: -ms-inline-flexbox !important;
+    display: inline-flex !important;
+  }
+}
+
+.embed-responsive {
+  position: relative;
+  display: block;
+  width: 100%;
+  padding: 0;
+  overflow: hidden;
+}
+
+.embed-responsive::before {
+  display: block;
+  content: "";
+}
+
+.embed-responsive .embed-responsive-item,
+.embed-responsive iframe,
+.embed-responsive embed,
+.embed-responsive object,
+.embed-responsive video {
+  position: absolute;
+  top: 0;
+  bottom: 0;
+  left: 0;
+  width: 100%;
+  height: 100%;
+  border: 0;
+}
+
+.embed-responsive-21by9::before {
+  padding-top: 42.857143%;
+}
+
+.embed-responsive-16by9::before {
+  padding-top: 56.25%;
+}
+
+.embed-responsive-4by3::before {
+  padding-top: 75%;
+}
+
+.embed-responsive-1by1::before {
+  padding-top: 100%;
+}
+
+.flex-row {
+  -ms-flex-direction: row !important;
+  flex-direction: row !important;
+}
+
+.flex-column {
+  -ms-flex-direction: column !important;
+  flex-direction: column !important;
+}
+
+.flex-row-reverse {
+  -ms-flex-direction: row-reverse !important;
+  flex-direction: row-reverse !important;
+}
+
+.flex-column-reverse {
+  -ms-flex-direction: column-reverse !important;
+  flex-direction: column-reverse !important;
+}
+
+.flex-wrap {
+  -ms-flex-wrap: wrap !important;
+  flex-wrap: wrap !important;
+}
+
+.flex-nowrap {
+  -ms-flex-wrap: nowrap !important;
+  flex-wrap: nowrap !important;
+}
+
+.flex-wrap-reverse {
+  -ms-flex-wrap: wrap-reverse !important;
+  flex-wrap: wrap-reverse !important;
+}
+
+.flex-fill {
+  -ms-flex: 1 1 auto !important;
+  flex: 1 1 auto !important;
+}
+
+.flex-grow-0 {
+  -ms-flex-positive: 0 !important;
+  flex-grow: 0 !important;
+}
+
+.flex-grow-1 {
+  -ms-flex-positive: 1 !important;
+  flex-grow: 1 !important;
+}
+
+.flex-shrink-0 {
+  -ms-flex-negative: 0 !important;
+  flex-shrink: 0 !important;
+}
+
+.flex-shrink-1 {
+  -ms-flex-negative: 1 !important;
+  flex-shrink: 1 !important;
+}
+
+.justify-content-start {
+  -ms-flex-pack: start !important;
+  justify-content: flex-start !important;
+}
+
+.justify-content-end {
+  -ms-flex-pack: end !important;
+  justify-content: flex-end !important;
+}
+
+.justify-content-center {
+  -ms-flex-pack: center !important;
+  justify-content: center !important;
+}
+
+.justify-content-between {
+  -ms-flex-pack: justify !important;
+  justify-content: space-between !important;
+}
+
+.justify-content-around {
+  -ms-flex-pack: distribute !important;
+  justify-content: space-around !important;
+}
+
+.align-items-start {
+  -ms-flex-align: start !important;
+  align-items: flex-start !important;
+}
+
+.align-items-end {
+  -ms-flex-align: end !important;
+  align-items: flex-end !important;
+}
+
+.align-items-center {
+  -ms-flex-align: center !important;
+  align-items: center !important;
+}
+
+.align-items-baseline {
+  -ms-flex-align: baseline !important;
+  align-items: baseline !important;
+}
+
+.align-items-stretch {
+  -ms-flex-align: stretch !important;
+  align-items: stretch !important;
+}
+
+.align-content-start {
+  -ms-flex-line-pack: start !important;
+  align-content: flex-start !important;
+}
+
+.align-content-end {
+  -ms-flex-line-pack: end !important;
+  align-content: flex-end !important;
+}
+
+.align-content-center {
+  -ms-flex-line-pack: center !important;
+  align-content: center !important;
+}
+
+.align-content-between {
+  -ms-flex-line-pack: justify !important;
+  align-content: space-between !important;
+}
+
+.align-content-around {
+  -ms-flex-line-pack: distribute !important;
+  align-content: space-around !important;
+}
+
+.align-content-stretch {
+  -ms-flex-line-pack: stretch !important;
+  align-content: stretch !important;
+}
+
+.align-self-auto {
+  -ms-flex-item-align: auto !important;
+  align-self: auto !important;
+}
+
+.align-self-start {
+  -ms-flex-item-align: start !important;
+  align-self: flex-start !important;
+}
+
+.align-self-end {
+  -ms-flex-item-align: end !important;
+  align-self: flex-end !important;
+}
+
+.align-self-center {
+  -ms-flex-item-align: center !important;
+  align-self: center !important;
+}
+
+.align-self-baseline {
+  -ms-flex-item-align: baseline !important;
+  align-self: baseline !important;
+}
+
+.align-self-stretch {
+  -ms-flex-item-align: stretch !important;
+  align-self: stretch !important;
+}
+
+@media (min-width: 576px) {
+  .flex-sm-row {
+    -ms-flex-direction: row !important;
+    flex-direction: row !important;
+  }
+  .flex-sm-column {
+    -ms-flex-direction: column !important;
+    flex-direction: column !important;
+  }
+  .flex-sm-row-reverse {
+    -ms-flex-direction: row-reverse !important;
+    flex-direction: row-reverse !important;
+  }
+  .flex-sm-column-reverse {
+    -ms-flex-direction: column-reverse !important;
+    flex-direction: column-reverse !important;
+  }
+  .flex-sm-wrap {
+    -ms-flex-wrap: wrap !important;
+    flex-wrap: wrap !important;
+  }
+  .flex-sm-nowrap {
+    -ms-flex-wrap: nowrap !important;
+    flex-wrap: nowrap !important;
+  }
+  .flex-sm-wrap-reverse {
+    -ms-flex-wrap: wrap-reverse !important;
+    flex-wrap: wrap-reverse !important;
+  }
+  .flex-sm-fill {
+    -ms-flex: 1 1 auto !important;
+    flex: 1 1 auto !important;
+  }
+  .flex-sm-grow-0 {
+    -ms-flex-positive: 0 !important;
+    flex-grow: 0 !important;
+  }
+  .flex-sm-grow-1 {
+    -ms-flex-positive: 1 !important;
+    flex-grow: 1 !important;
+  }
+  .flex-sm-shrink-0 {
+    -ms-flex-negative: 0 !important;
+    flex-shrink: 0 !important;
+  }
+  .flex-sm-shrink-1 {
+    -ms-flex-negative: 1 !important;
+    flex-shrink: 1 !important;
+  }
+  .justify-content-sm-start {
+    -ms-flex-pack: start !important;
+    justify-content: flex-start !important;
+  }
+  .justify-content-sm-end {
+    -ms-flex-pack: end !important;
+    justify-content: flex-end !important;
+  }
+  .justify-content-sm-center {
+    -ms-flex-pack: center !important;
+    justify-content: center !important;
+  }
+  .justify-content-sm-between {
+    -ms-flex-pack: justify !important;
+    justify-content: space-between !important;
+  }
+  .justify-content-sm-around {
+    -ms-flex-pack: distribute !important;
+    justify-content: space-around !important;
+  }
+  .align-items-sm-start {
+    -ms-flex-align: start !important;
+    align-items: flex-start !important;
+  }
+  .align-items-sm-end {
+    -ms-flex-align: end !important;
+    align-items: flex-end !important;
+  }
+  .align-items-sm-center {
+    -ms-flex-align: center !important;
+    align-items: center !important;
+  }
+  .align-items-sm-baseline {
+    -ms-flex-align: baseline !important;
+    align-items: baseline !important;
+  }
+  .align-items-sm-stretch {
+    -ms-flex-align: stretch !important;
+    align-items: stretch !important;
+  }
+  .align-content-sm-start {
+    -ms-flex-line-pack: start !important;
+    align-content: flex-start !important;
+  }
+  .align-content-sm-end {
+    -ms-flex-line-pack: end !important;
+    align-content: flex-end !important;
+  }
+  .align-content-sm-center {
+    -ms-flex-line-pack: center !important;
+    align-content: center !important;
+  }
+  .align-content-sm-between {
+    -ms-flex-line-pack: justify !important;
+    align-content: space-between !important;
+  }
+  .align-content-sm-around {
+    -ms-flex-line-pack: distribute !important;
+    align-content: space-around !important;
+  }
+  .align-content-sm-stretch {
+    -ms-flex-line-pack: stretch !important;
+    align-content: stretch !important;
+  }
+  .align-self-sm-auto {
+    -ms-flex-item-align: auto !important;
+    align-self: auto !important;
+  }
+  .align-self-sm-start {
+    -ms-flex-item-align: start !important;
+    align-self: flex-start !important;
+  }
+  .align-self-sm-end {
+    -ms-flex-item-align: end !important;
+    align-self: flex-end !important;
+  }
+  .align-self-sm-center {
+    -ms-flex-item-align: center !important;
+    align-self: center !important;
+  }
+  .align-self-sm-baseline {
+    -ms-flex-item-align: baseline !important;
+    align-self: baseline !important;
+  }
+  .align-self-sm-stretch {
+    -ms-flex-item-align: stretch !important;
+    align-self: stretch !important;
+  }
+}
+
+@media (min-width: 768px) {
+  .flex-md-row {
+    -ms-flex-direction: row !important;
+    flex-direction: row !important;
+  }
+  .flex-md-column {
+    -ms-flex-direction: column !important;
+    flex-direction: column !important;
+  }
+  .flex-md-row-reverse {
+    -ms-flex-direction: row-reverse !important;
+    flex-direction: row-reverse !important;
+  }
+  .flex-md-column-reverse {
+    -ms-flex-direction: column-reverse !important;
+    flex-direction: column-reverse !important;
+  }
+  .flex-md-wrap {
+    -ms-flex-wrap: wrap !important;
+    flex-wrap: wrap !important;
+  }
+  .flex-md-nowrap {
+    -ms-flex-wrap: nowrap !important;
+    flex-wrap: nowrap !important;
+  }
+  .flex-md-wrap-reverse {
+    -ms-flex-wrap: wrap-reverse !important;
+    flex-wrap: wrap-reverse !important;
+  }
+  .flex-md-fill {
+    -ms-flex: 1 1 auto !important;
+    flex: 1 1 auto !important;
+  }
+  .flex-md-grow-0 {
+    -ms-flex-positive: 0 !important;
+    flex-grow: 0 !important;
+  }
+  .flex-md-grow-1 {
+    -ms-flex-positive: 1 !important;
+    flex-grow: 1 !important;
+  }
+  .flex-md-shrink-0 {
+    -ms-flex-negative: 0 !important;
+    flex-shrink: 0 !important;
+  }
+  .flex-md-shrink-1 {
+    -ms-flex-negative: 1 !important;
+    flex-shrink: 1 !important;
+  }
+  .justify-content-md-start {
+    -ms-flex-pack: start !important;
+    justify-content: flex-start !important;
+  }
+  .justify-content-md-end {
+    -ms-flex-pack: end !important;
+    justify-content: flex-end !important;
+  }
+  .justify-content-md-center {
+    -ms-flex-pack: center !important;
+    justify-content: center !important;
+  }
+  .justify-content-md-between {
+    -ms-flex-pack: justify !important;
+    justify-content: space-between !important;
+  }
+  .justify-content-md-around {
+    -ms-flex-pack: distribute !important;
+    justify-content: space-around !important;
+  }
+  .align-items-md-start {
+    -ms-flex-align: start !important;
+    align-items: flex-start !important;
+  }
+  .align-items-md-end {
+    -ms-flex-align: end !important;
+    align-items: flex-end !important;
+  }
+  .align-items-md-center {
+    -ms-flex-align: center !important;
+    align-items: center !important;
+  }
+  .align-items-md-baseline {
+    -ms-flex-align: baseline !important;
+    align-items: baseline !important;
+  }
+  .align-items-md-stretch {
+    -ms-flex-align: stretch !important;
+    align-items: stretch !important;
+  }
+  .align-content-md-start {
+    -ms-flex-line-pack: start !important;
+    align-content: flex-start !important;
+  }
+  .align-content-md-end {
+    -ms-flex-line-pack: end !important;
+    align-content: flex-end !important;
+  }
+  .align-content-md-center {
+    -ms-flex-line-pack: center !important;
+    align-content: center !important;
+  }
+  .align-content-md-between {
+    -ms-flex-line-pack: justify !important;
+    align-content: space-between !important;
+  }
+  .align-content-md-around {
+    -ms-flex-line-pack: distribute !important;
+    align-content: space-around !important;
+  }
+  .align-content-md-stretch {
+    -ms-flex-line-pack: stretch !important;
+    align-content: stretch !important;
+  }
+  .align-self-md-auto {
+    -ms-flex-item-align: auto !important;
+    align-self: auto !important;
+  }
+  .align-self-md-start {
+    -ms-flex-item-align: start !important;
+    align-self: flex-start !important;
+  }
+  .align-self-md-end {
+    -ms-flex-item-align: end !important;
+    align-self: flex-end !important;
+  }
+  .align-self-md-center {
+    -ms-flex-item-align: center !important;
+    align-self: center !important;
+  }
+  .align-self-md-baseline {
+    -ms-flex-item-align: baseline !important;
+    align-self: baseline !important;
+  }
+  .align-self-md-stretch {
+    -ms-flex-item-align: stretch !important;
+    align-self: stretch !important;
+  }
+}
+
+@media (min-width: 992px) {
+  .flex-lg-row {
+    -ms-flex-direction: row !important;
+    flex-direction: row !important;
+  }
+  .flex-lg-column {
+    -ms-flex-direction: column !important;
+    flex-direction: column !important;
+  }
+  .flex-lg-row-reverse {
+    -ms-flex-direction: row-reverse !important;
+    flex-direction: row-reverse !important;
+  }
+  .flex-lg-column-reverse {
+    -ms-flex-direction: column-reverse !important;
+    flex-direction: column-reverse !important;
+  }
+  .flex-lg-wrap {
+    -ms-flex-wrap: wrap !important;
+    flex-wrap: wrap !important;
+  }
+  .flex-lg-nowrap {
+    -ms-flex-wrap: nowrap !important;
+    flex-wrap: nowrap !important;
+  }
+  .flex-lg-wrap-reverse {
+    -ms-flex-wrap: wrap-reverse !important;
+    flex-wrap: wrap-reverse !important;
+  }
+  .flex-lg-fill {
+    -ms-flex: 1 1 auto !important;
+    flex: 1 1 auto !important;
+  }
+  .flex-lg-grow-0 {
+    -ms-flex-positive: 0 !important;
+    flex-grow: 0 !important;
+  }
+  .flex-lg-grow-1 {
+    -ms-flex-positive: 1 !important;
+    flex-grow: 1 !important;
+  }
+  .flex-lg-shrink-0 {
+    -ms-flex-negative: 0 !important;
+    flex-shrink: 0 !important;
+  }
+  .flex-lg-shrink-1 {
+    -ms-flex-negative: 1 !important;
+    flex-shrink: 1 !important;
+  }
+  .justify-content-lg-start {
+    -ms-flex-pack: start !important;
+    justify-content: flex-start !important;
+  }
+  .justify-content-lg-end {
+    -ms-flex-pack: end !important;
+    justify-content: flex-end !important;
+  }
+  .justify-content-lg-center {
+    -ms-flex-pack: center !important;
+    justify-content: center !important;
+  }
+  .justify-content-lg-between {
+    -ms-flex-pack: justify !important;
+    justify-content: space-between !important;
+  }
+  .justify-content-lg-around {
+    -ms-flex-pack: distribute !important;
+    justify-content: space-around !important;
+  }
+  .align-items-lg-start {
+    -ms-flex-align: start !important;
+    align-items: flex-start !important;
+  }
+  .align-items-lg-end {
+    -ms-flex-align: end !important;
+    align-items: flex-end !important;
+  }
+  .align-items-lg-center {
+    -ms-flex-align: center !important;
+    align-items: center !important;
+  }
+  .align-items-lg-baseline {
+    -ms-flex-align: baseline !important;
+    align-items: baseline !important;
+  }
+  .align-items-lg-stretch {
+    -ms-flex-align: stretch !important;
+    align-items: stretch !important;
+  }
+  .align-content-lg-start {
+    -ms-flex-line-pack: start !important;
+    align-content: flex-start !important;
+  }
+  .align-content-lg-end {
+    -ms-flex-line-pack: end !important;
+    align-content: flex-end !important;
+  }
+  .align-content-lg-center {
+    -ms-flex-line-pack: center !important;
+    align-content: center !important;
+  }
+  .align-content-lg-between {
+    -ms-flex-line-pack: justify !important;
+    align-content: space-between !important;
+  }
+  .align-content-lg-around {
+    -ms-flex-line-pack: distribute !important;
+    align-content: space-around !important;
+  }
+  .align-content-lg-stretch {
+    -ms-flex-line-pack: stretch !important;
+    align-content: stretch !important;
+  }
+  .align-self-lg-auto {
+    -ms-flex-item-align: auto !important;
+    align-self: auto !important;
+  }
+  .align-self-lg-start {
+    -ms-flex-item-align: start !important;
+    align-self: flex-start !important;
+  }
+  .align-self-lg-end {
+    -ms-flex-item-align: end !important;
+    align-self: flex-end !important;
+  }
+  .align-self-lg-center {
+    -ms-flex-item-align: center !important;
+    align-self: center !important;
+  }
+  .align-self-lg-baseline {
+    -ms-flex-item-align: baseline !important;
+    align-self: baseline !important;
+  }
+  .align-self-lg-stretch {
+    -ms-flex-item-align: stretch !important;
+    align-self: stretch !important;
+  }
+}
+
+@media (min-width: 1200px) {
+  .flex-xl-row {
+    -ms-flex-direction: row !important;
+    flex-direction: row !important;
+  }
+  .flex-xl-column {
+    -ms-flex-direction: column !important;
+    flex-direction: column !important;
+  }
+  .flex-xl-row-reverse {
+    -ms-flex-direction: row-reverse !important;
+    flex-direction: row-reverse !important;
+  }
+  .flex-xl-column-reverse {
+    -ms-flex-direction: column-reverse !important;
+    flex-direction: column-reverse !important;
+  }
+  .flex-xl-wrap {
+    -ms-flex-wrap: wrap !important;
+    flex-wrap: wrap !important;
+  }
+  .flex-xl-nowrap {
+    -ms-flex-wrap: nowrap !important;
+    flex-wrap: nowrap !important;
+  }
+  .flex-xl-wrap-reverse {
+    -ms-flex-wrap: wrap-reverse !important;
+    flex-wrap: wrap-reverse !important;
+  }
+  .flex-xl-fill {
+    -ms-flex: 1 1 auto !important;
+    flex: 1 1 auto !important;
+  }
+  .flex-xl-grow-0 {
+    -ms-flex-positive: 0 !important;
+    flex-grow: 0 !important;
+  }
+  .flex-xl-grow-1 {
+    -ms-flex-positive: 1 !important;
+    flex-grow: 1 !important;
+  }
+  .flex-xl-shrink-0 {
+    -ms-flex-negative: 0 !important;
+    flex-shrink: 0 !important;
+  }
+  .flex-xl-shrink-1 {
+    -ms-flex-negative: 1 !important;
+    flex-shrink: 1 !important;
+  }
+  .justify-content-xl-start {
+    -ms-flex-pack: start !important;
+    justify-content: flex-start !important;
+  }
+  .justify-content-xl-end {
+    -ms-flex-pack: end !important;
+    justify-content: flex-end !important;
+  }
+  .justify-content-xl-center {
+    -ms-flex-pack: center !important;
+    justify-content: center !important;
+  }
+  .justify-content-xl-between {
+    -ms-flex-pack: justify !important;
+    justify-content: space-between !important;
+  }
+  .justify-content-xl-around {
+    -ms-flex-pack: distribute !important;
+    justify-content: space-around !important;
+  }
+  .align-items-xl-start {
+    -ms-flex-align: start !important;
+    align-items: flex-start !important;
+  }
+  .align-items-xl-end {
+    -ms-flex-align: end !important;
+    align-items: flex-end !important;
+  }
+  .align-items-xl-center {
+    -ms-flex-align: center !important;
+    align-items: center !important;
+  }
+  .align-items-xl-baseline {
+    -ms-flex-align: baseline !important;
+    align-items: baseline !important;
+  }
+  .align-items-xl-stretch {
+    -ms-flex-align: stretch !important;
+    align-items: stretch !important;
+  }
+  .align-content-xl-start {
+    -ms-flex-line-pack: start !important;
+    align-content: flex-start !important;
+  }
+  .align-content-xl-end {
+    -ms-flex-line-pack: end !important;
+    align-content: flex-end !important;
+  }
+  .align-content-xl-center {
+    -ms-flex-line-pack: center !important;
+    align-content: center !important;
+  }
+  .align-content-xl-between {
+    -ms-flex-line-pack: justify !important;
+    align-content: space-between !important;
+  }
+  .align-content-xl-around {
+    -ms-flex-line-pack: distribute !important;
+    align-content: space-around !important;
+  }
+  .align-content-xl-stretch {
+    -ms-flex-line-pack: stretch !important;
+    align-content: stretch !important;
+  }
+  .align-self-xl-auto {
+    -ms-flex-item-align: auto !important;
+    align-self: auto !important;
+  }
+  .align-self-xl-start {
+    -ms-flex-item-align: start !important;
+    align-self: flex-start !important;
+  }
+  .align-self-xl-end {
+    -ms-flex-item-align: end !important;
+    align-self: flex-end !important;
+  }
+  .align-self-xl-center {
+    -ms-flex-item-align: center !important;
+    align-self: center !important;
+  }
+  .align-self-xl-baseline {
+    -ms-flex-item-align: baseline !important;
+    align-self: baseline !important;
+  }
+  .align-self-xl-stretch {
+    -ms-flex-item-align: stretch !important;
+    align-self: stretch !important;
+  }
+}
+
+.float-left {
+  float: left !important;
+}
+
+.float-right {
+  float: right !important;
+}
+
+.float-none {
+  float: none !important;
+}
+
+@media (min-width: 576px) {
+  .float-sm-left {
+    float: left !important;
+  }
+  .float-sm-right {
+    float: right !important;
+  }
+  .float-sm-none {
+    float: none !important;
+  }
+}
+
+@media (min-width: 768px) {
+  .float-md-left {
+    float: left !important;
+  }
+  .float-md-right {
+    float: right !important;
+  }
+  .float-md-none {
+    float: none !important;
+  }
+}
+
+@media (min-width: 992px) {
+  .float-lg-left {
+    float: left !important;
+  }
+  .float-lg-right {
+    float: right !important;
+  }
+  .float-lg-none {
+    float: none !important;
+  }
+}
+
+@media (min-width: 1200px) {
+  .float-xl-left {
+    float: left !important;
+  }
+  .float-xl-right {
+    float: right !important;
+  }
+  .float-xl-none {
+    float: none !important;
+  }
+}
+
+.position-static {
+  position: static !important;
+}
+
+.position-relative {
+  position: relative !important;
+}
+
+.position-absolute {
+  position: absolute !important;
+}
+
+.position-fixed {
+  position: fixed !important;
+}
+
+.position-sticky {
+  position: -webkit-sticky !important;
+  position: sticky !important;
+}
+
+.fixed-top {
+  position: fixed;
+  top: 0;
+  right: 0;
+  left: 0;
+  z-index: 1030;
+}
+
+.fixed-bottom {
+  position: fixed;
+  right: 0;
+  bottom: 0;
+  left: 0;
+  z-index: 1030;
+}
+
+@supports ((position: -webkit-sticky) or (position: sticky)) {
+  .sticky-top {
+    position: -webkit-sticky;
+    position: sticky;
+    top: 0;
+    z-index: 1020;
+  }
+}
+
+.sr-only {
+  position: absolute;
+  width: 1px;
+  height: 1px;
+  padding: 0;
+  overflow: hidden;
+  clip: rect(0, 0, 0, 0);
+  white-space: nowrap;
+  border: 0;
+}
+
+.sr-only-focusable:active, .sr-only-focusable:focus {
+  position: static;
+  width: auto;
+  height: auto;
+  overflow: visible;
+  clip: auto;
+  white-space: normal;
+}
+
+.shadow-sm {
+  box-shadow: 0 0.125rem 0.25rem rgba(0, 0, 0, 0.075) !important;
+}
+
+.shadow {
+  box-shadow: 0 0.5rem 1rem rgba(0, 0, 0, 0.15) !important;
+}
+
+.shadow-lg {
+  box-shadow: 0 1rem 3rem rgba(0, 0, 0, 0.175) !important;
+}
+
+.shadow-none {
+  box-shadow: none !important;
+}
+
+.w-25 {
+  width: 25% !important;
+}
+
+.w-50 {
+  width: 50% !important;
+}
+
+.w-75 {
+  width: 75% !important;
+}
+
+.w-100 {
+  width: 100% !important;
+}
+
+.w-auto {
+  width: auto !important;
+}
+
+.h-25 {
+  height: 25% !important;
+}
+
+.h-50 {
+  height: 50% !important;
+}
+
+.h-75 {
+  height: 75% !important;
+}
+
+.h-100 {
+  height: 100% !important;
+}
+
+.h-auto {
+  height: auto !important;
+}
+
+.mw-100 {
+  max-width: 100% !important;
+}
+
+.mh-100 {
+  max-height: 100% !important;
+}
+
+.m-0 {
+  margin: 0 !important;
+}
+
+.mt-0,
+.my-0 {
+  margin-top: 0 !important;
+}
+
+.mr-0,
+.mx-0 {
+  margin-right: 0 !important;
+}
+
+.mb-0,
+.my-0 {
+  margin-bottom: 0 !important;
+}
+
+.ml-0,
+.mx-0 {
+  margin-left: 0 !important;
+}
+
+.m-1 {
+  margin: 0.25rem !important;
+}
+
+.mt-1,
+.my-1 {
+  margin-top: 0.25rem !important;
+}
+
+.mr-1,
+.mx-1 {
+  margin-right: 0.25rem !important;
+}
+
+.mb-1,
+.my-1 {
+  margin-bottom: 0.25rem !important;
+}
+
+.ml-1,
+.mx-1 {
+  margin-left: 0.25rem !important;
+}
+
+.m-2 {
+  margin: 0.5rem !important;
+}
+
+.mt-2,
+.my-2 {
+  margin-top: 0.5rem !important;
+}
+
+.mr-2,
+.mx-2 {
+  margin-right: 0.5rem !important;
+}
+
+.mb-2,
+.my-2 {
+  margin-bottom: 0.5rem !important;
+}
+
+.ml-2,
+.mx-2 {
+  margin-left: 0.5rem !important;
+}
+
+.m-3 {
+  margin: 1rem !important;
+}
+
+.mt-3,
+.my-3 {
+  margin-top: 1rem !important;
+}
+
+.mr-3,
+.mx-3 {
+  margin-right: 1rem !important;
+}
+
+.mb-3,
+.my-3 {
+  margin-bottom: 1rem !important;
+}
+
+.ml-3,
+.mx-3 {
+  margin-left: 1rem !important;
+}
+
+.m-4 {
+  margin: 1.5rem !important;
+}
+
+.mt-4,
+.my-4 {
+  margin-top: 1.5rem !important;
+}
+
+.mr-4,
+.mx-4 {
+  margin-right: 1.5rem !important;
+}
+
+.mb-4,
+.my-4 {
+  margin-bottom: 1.5rem !important;
+}
+
+.ml-4,
+.mx-4 {
+  margin-left: 1.5rem !important;
+}
+
+.m-5 {
+  margin: 3rem !important;
+}
+
+.mt-5,
+.my-5 {
+  margin-top: 3rem !important;
+}
+
+.mr-5,
+.mx-5 {
+  margin-right: 3rem !important;
+}
+
+.mb-5,
+.my-5 {
+  margin-bottom: 3rem !important;
+}
+
+.ml-5,
+.mx-5 {
+  margin-left: 3rem !important;
+}
+
+.p-0 {
+  padding: 0 !important;
+}
+
+.pt-0,
+.py-0 {
+  padding-top: 0 !important;
+}
+
+.pr-0,
+.px-0 {
+  padding-right: 0 !important;
+}
+
+.pb-0,
+.py-0 {
+  padding-bottom: 0 !important;
+}
+
+.pl-0,
+.px-0 {
+  padding-left: 0 !important;
+}
+
+.p-1 {
+  padding: 0.25rem !important;
+}
+
+.pt-1,
+.py-1 {
+  padding-top: 0.25rem !important;
+}
+
+.pr-1,
+.px-1 {
+  padding-right: 0.25rem !important;
+}
+
+.pb-1,
+.py-1 {
+  padding-bottom: 0.25rem !important;
+}
+
+.pl-1,
+.px-1 {
+  padding-left: 0.25rem !important;
+}
+
+.p-2 {
+  padding: 0.5rem !important;
+}
+
+.pt-2,
+.py-2 {
+  padding-top: 0.5rem !important;
+}
+
+.pr-2,
+.px-2 {
+  padding-right: 0.5rem !important;
+}
+
+.pb-2,
+.py-2 {
+  padding-bottom: 0.5rem !important;
+}
+
+.pl-2,
+.px-2 {
+  padding-left: 0.5rem !important;
+}
+
+.p-3 {
+  padding: 1rem !important;
+}
+
+.pt-3,
+.py-3 {
+  padding-top: 1rem !important;
+}
+
+.pr-3,
+.px-3 {
+  padding-right: 1rem !important;
+}
+
+.pb-3,
+.py-3 {
+  padding-bottom: 1rem !important;
+}
+
+.pl-3,
+.px-3 {
+  padding-left: 1rem !important;
+}
+
+.p-4 {
+  padding: 1.5rem !important;
+}
+
+.pt-4,
+.py-4 {
+  padding-top: 1.5rem !important;
+}
+
+.pr-4,
+.px-4 {
+  padding-right: 1.5rem !important;
+}
+
+.pb-4,
+.py-4 {
+  padding-bottom: 1.5rem !important;
+}
+
+.pl-4,
+.px-4 {
+  padding-left: 1.5rem !important;
+}
+
+.p-5 {
+  padding: 3rem !important;
+}
+
+.pt-5,
+.py-5 {
+  padding-top: 3rem !important;
+}
+
+.pr-5,
+.px-5 {
+  padding-right: 3rem !important;
+}
+
+.pb-5,
+.py-5 {
+  padding-bottom: 3rem !important;
+}
+
+.pl-5,
+.px-5 {
+  padding-left: 3rem !important;
+}
+
+.m-auto {
+  margin: auto !important;
+}
+
+.mt-auto,
+.my-auto {
+  margin-top: auto !important;
+}
+
+.mr-auto,
+.mx-auto {
+  margin-right: auto !important;
+}
+
+.mb-auto,
+.my-auto {
+  margin-bottom: auto !important;
+}
+
+.ml-auto,
+.mx-auto {
+  margin-left: auto !important;
+}
+
+@media (min-width: 576px) {
+  .m-sm-0 {
+    margin: 0 !important;
+  }
+  .mt-sm-0,
+  .my-sm-0 {
+    margin-top: 0 !important;
+  }
+  .mr-sm-0,
+  .mx-sm-0 {
+    margin-right: 0 !important;
+  }
+  .mb-sm-0,
+  .my-sm-0 {
+    margin-bottom: 0 !important;
+  }
+  .ml-sm-0,
+  .mx-sm-0 {
+    margin-left: 0 !important;
+  }
+  .m-sm-1 {
+    margin: 0.25rem !important;
+  }
+  .mt-sm-1,
+  .my-sm-1 {
+    margin-top: 0.25rem !important;
+  }
+  .mr-sm-1,
+  .mx-sm-1 {
+    margin-right: 0.25rem !important;
+  }
+  .mb-sm-1,
+  .my-sm-1 {
+    margin-bottom: 0.25rem !important;
+  }
+  .ml-sm-1,
+  .mx-sm-1 {
+    margin-left: 0.25rem !important;
+  }
+  .m-sm-2 {
+    margin: 0.5rem !important;
+  }
+  .mt-sm-2,
+  .my-sm-2 {
+    margin-top: 0.5rem !important;
+  }
+  .mr-sm-2,
+  .mx-sm-2 {
+    margin-right: 0.5rem !important;
+  }
+  .mb-sm-2,
+  .my-sm-2 {
+    margin-bottom: 0.5rem !important;
+  }
+  .ml-sm-2,
+  .mx-sm-2 {
+    margin-left: 0.5rem !important;
+  }
+  .m-sm-3 {
+    margin: 1rem !important;
+  }
+  .mt-sm-3,
+  .my-sm-3 {
+    margin-top: 1rem !important;
+  }
+  .mr-sm-3,
+  .mx-sm-3 {
+    margin-right: 1rem !important;
+  }
+  .mb-sm-3,
+  .my-sm-3 {
+    margin-bottom: 1rem !important;
+  }
+  .ml-sm-3,
+  .mx-sm-3 {
+    margin-left: 1rem !important;
+  }
+  .m-sm-4 {
+    margin: 1.5rem !important;
+  }
+  .mt-sm-4,
+  .my-sm-4 {
+    margin-top: 1.5rem !important;
+  }
+  .mr-sm-4,
+  .mx-sm-4 {
+    margin-right: 1.5rem !important;
+  }
+  .mb-sm-4,
+  .my-sm-4 {
+    margin-bottom: 1.5rem !important;
+  }
+  .ml-sm-4,
+  .mx-sm-4 {
+    margin-left: 1.5rem !important;
+  }
+  .m-sm-5 {
+    margin: 3rem !important;
+  }
+  .mt-sm-5,
+  .my-sm-5 {
+    margin-top: 3rem !important;
+  }
+  .mr-sm-5,
+  .mx-sm-5 {
+    margin-right: 3rem !important;
+  }
+  .mb-sm-5,
+  .my-sm-5 {
+    margin-bottom: 3rem !important;
+  }
+  .ml-sm-5,
+  .mx-sm-5 {
+    margin-left: 3rem !important;
+  }
+  .p-sm-0 {
+    padding: 0 !important;
+  }
+  .pt-sm-0,
+  .py-sm-0 {
+    padding-top: 0 !important;
+  }
+  .pr-sm-0,
+  .px-sm-0 {
+    padding-right: 0 !important;
+  }
+  .pb-sm-0,
+  .py-sm-0 {
+    padding-bottom: 0 !important;
+  }
+  .pl-sm-0,
+  .px-sm-0 {
+    padding-left: 0 !important;
+  }
+  .p-sm-1 {
+    padding: 0.25rem !important;
+  }
+  .pt-sm-1,
+  .py-sm-1 {
+    padding-top: 0.25rem !important;
+  }
+  .pr-sm-1,
+  .px-sm-1 {
+    padding-right: 0.25rem !important;
+  }
+  .pb-sm-1,
+  .py-sm-1 {
+    padding-bottom: 0.25rem !important;
+  }
+  .pl-sm-1,
+  .px-sm-1 {
+    padding-left: 0.25rem !important;
+  }
+  .p-sm-2 {
+    padding: 0.5rem !important;
+  }
+  .pt-sm-2,
+  .py-sm-2 {
+    padding-top: 0.5rem !important;
+  }
+  .pr-sm-2,
+  .px-sm-2 {
+    padding-right: 0.5rem !important;
+  }
+  .pb-sm-2,
+  .py-sm-2 {
+    padding-bottom: 0.5rem !important;
+  }
+  .pl-sm-2,
+  .px-sm-2 {
+    padding-left: 0.5rem !important;
+  }
+  .p-sm-3 {
+    padding: 1rem !important;
+  }
+  .pt-sm-3,
+  .py-sm-3 {
+    padding-top: 1rem !important;
+  }
+  .pr-sm-3,
+  .px-sm-3 {
+    padding-right: 1rem !important;
+  }
+  .pb-sm-3,
+  .py-sm-3 {
+    padding-bottom: 1rem !important;
+  }
+  .pl-sm-3,
+  .px-sm-3 {
+    padding-left: 1rem !important;
+  }
+  .p-sm-4 {
+    padding: 1.5rem !important;
+  }
+  .pt-sm-4,
+  .py-sm-4 {
+    padding-top: 1.5rem !important;
+  }
+  .pr-sm-4,
+  .px-sm-4 {
+    padding-right: 1.5rem !important;
+  }
+  .pb-sm-4,
+  .py-sm-4 {
+    padding-bottom: 1.5rem !important;
+  }
+  .pl-sm-4,
+  .px-sm-4 {
+    padding-left: 1.5rem !important;
+  }
+  .p-sm-5 {
+    padding: 3rem !important;
+  }
+  .pt-sm-5,
+  .py-sm-5 {
+    padding-top: 3rem !important;
+  }
+  .pr-sm-5,
+  .px-sm-5 {
+    padding-right: 3rem !important;
+  }
+  .pb-sm-5,
+  .py-sm-5 {
+    padding-bottom: 3rem !important;
+  }
+  .pl-sm-5,
+  .px-sm-5 {
+    padding-left: 3rem !important;
+  }
+  .m-sm-auto {
+    margin: auto !important;
+  }
+  .mt-sm-auto,
+  .my-sm-auto {
+    margin-top: auto !important;
+  }
+  .mr-sm-auto,
+  .mx-sm-auto {
+    margin-right: auto !important;
+  }
+  .mb-sm-auto,
+  .my-sm-auto {
+    margin-bottom: auto !important;
+  }
+  .ml-sm-auto,
+  .mx-sm-auto {
+    margin-left: auto !important;
+  }
+}
+
+@media (min-width: 768px) {
+  .m-md-0 {
+    margin: 0 !important;
+  }
+  .mt-md-0,
+  .my-md-0 {
+    margin-top: 0 !important;
+  }
+  .mr-md-0,
+  .mx-md-0 {
+    margin-right: 0 !important;
+  }
+  .mb-md-0,
+  .my-md-0 {
+    margin-bottom: 0 !important;
+  }
+  .ml-md-0,
+  .mx-md-0 {
+    margin-left: 0 !important;
+  }
+  .m-md-1 {
+    margin: 0.25rem !important;
+  }
+  .mt-md-1,
+  .my-md-1 {
+    margin-top: 0.25rem !important;
+  }
+  .mr-md-1,
+  .mx-md-1 {
+    margin-right: 0.25rem !important;
+  }
+  .mb-md-1,
+  .my-md-1 {
+    margin-bottom: 0.25rem !important;
+  }
+  .ml-md-1,
+  .mx-md-1 {
+    margin-left: 0.25rem !important;
+  }
+  .m-md-2 {
+    margin: 0.5rem !important;
+  }
+  .mt-md-2,
+  .my-md-2 {
+    margin-top: 0.5rem !important;
+  }
+  .mr-md-2,
+  .mx-md-2 {
+    margin-right: 0.5rem !important;
+  }
+  .mb-md-2,
+  .my-md-2 {
+    margin-bottom: 0.5rem !important;
+  }
+  .ml-md-2,
+  .mx-md-2 {
+    margin-left: 0.5rem !important;
+  }
+  .m-md-3 {
+    margin: 1rem !important;
+  }
+  .mt-md-3,
+  .my-md-3 {
+    margin-top: 1rem !important;
+  }
+  .mr-md-3,
+  .mx-md-3 {
+    margin-right: 1rem !important;
+  }
+  .mb-md-3,
+  .my-md-3 {
+    margin-bottom: 1rem !important;
+  }
+  .ml-md-3,
+  .mx-md-3 {
+    margin-left: 1rem !important;
+  }
+  .m-md-4 {
+    margin: 1.5rem !important;
+  }
+  .mt-md-4,
+  .my-md-4 {
+    margin-top: 1.5rem !important;
+  }
+  .mr-md-4,
+  .mx-md-4 {
+    margin-right: 1.5rem !important;
+  }
+  .mb-md-4,
+  .my-md-4 {
+    margin-bottom: 1.5rem !important;
+  }
+  .ml-md-4,
+  .mx-md-4 {
+    margin-left: 1.5rem !important;
+  }
+  .m-md-5 {
+    margin: 3rem !important;
+  }
+  .mt-md-5,
+  .my-md-5 {
+    margin-top: 3rem !important;
+  }
+  .mr-md-5,
+  .mx-md-5 {
+    margin-right: 3rem !important;
+  }
+  .mb-md-5,
+  .my-md-5 {
+    margin-bottom: 3rem !important;
+  }
+  .ml-md-5,
+  .mx-md-5 {
+    margin-left: 3rem !important;
+  }
+  .p-md-0 {
+    padding: 0 !important;
+  }
+  .pt-md-0,
+  .py-md-0 {
+    padding-top: 0 !important;
+  }
+  .pr-md-0,
+  .px-md-0 {
+    padding-right: 0 !important;
+  }
+  .pb-md-0,
+  .py-md-0 {
+    padding-bottom: 0 !important;
+  }
+  .pl-md-0,
+  .px-md-0 {
+    padding-left: 0 !important;
+  }
+  .p-md-1 {
+    padding: 0.25rem !important;
+  }
+  .pt-md-1,
+  .py-md-1 {
+    padding-top: 0.25rem !important;
+  }
+  .pr-md-1,
+  .px-md-1 {
+    padding-right: 0.25rem !important;
+  }
+  .pb-md-1,
+  .py-md-1 {
+    padding-bottom: 0.25rem !important;
+  }
+  .pl-md-1,
+  .px-md-1 {
+    padding-left: 0.25rem !important;
+  }
+  .p-md-2 {
+    padding: 0.5rem !important;
+  }
+  .pt-md-2,
+  .py-md-2 {
+    padding-top: 0.5rem !important;
+  }
+  .pr-md-2,
+  .px-md-2 {
+    padding-right: 0.5rem !important;
+  }
+  .pb-md-2,
+  .py-md-2 {
+    padding-bottom: 0.5rem !important;
+  }
+  .pl-md-2,
+  .px-md-2 {
+    padding-left: 0.5rem !important;
+  }
+  .p-md-3 {
+    padding: 1rem !important;
+  }
+  .pt-md-3,
+  .py-md-3 {
+    padding-top: 1rem !important;
+  }
+  .pr-md-3,
+  .px-md-3 {
+    padding-right: 1rem !important;
+  }
+  .pb-md-3,
+  .py-md-3 {
+    padding-bottom: 1rem !important;
+  }
+  .pl-md-3,
+  .px-md-3 {
+    padding-left: 1rem !important;
+  }
+  .p-md-4 {
+    padding: 1.5rem !important;
+  }
+  .pt-md-4,
+  .py-md-4 {
+    padding-top: 1.5rem !important;
+  }
+  .pr-md-4,
+  .px-md-4 {
+    padding-right: 1.5rem !important;
+  }
+  .pb-md-4,
+  .py-md-4 {
+    padding-bottom: 1.5rem !important;
+  }
+  .pl-md-4,
+  .px-md-4 {
+    padding-left: 1.5rem !important;
+  }
+  .p-md-5 {
+    padding: 3rem !important;
+  }
+  .pt-md-5,
+  .py-md-5 {
+    padding-top: 3rem !important;
+  }
+  .pr-md-5,
+  .px-md-5 {
+    padding-right: 3rem !important;
+  }
+  .pb-md-5,
+  .py-md-5 {
+    padding-bottom: 3rem !important;
+  }
+  .pl-md-5,
+  .px-md-5 {
+    padding-left: 3rem !important;
+  }
+  .m-md-auto {
+    margin: auto !important;
+  }
+  .mt-md-auto,
+  .my-md-auto {
+    margin-top: auto !important;
+  }
+  .mr-md-auto,
+  .mx-md-auto {
+    margin-right: auto !important;
+  }
+  .mb-md-auto,
+  .my-md-auto {
+    margin-bottom: auto !important;
+  }
+  .ml-md-auto,
+  .mx-md-auto {
+    margin-left: auto !important;
+  }
+}
+
+@media (min-width: 992px) {
+  .m-lg-0 {
+    margin: 0 !important;
+  }
+  .mt-lg-0,
+  .my-lg-0 {
+    margin-top: 0 !important;
+  }
+  .mr-lg-0,
+  .mx-lg-0 {
+    margin-right: 0 !important;
+  }
+  .mb-lg-0,
+  .my-lg-0 {
+    margin-bottom: 0 !important;
+  }
+  .ml-lg-0,
+  .mx-lg-0 {
+    margin-left: 0 !important;
+  }
+  .m-lg-1 {
+    margin: 0.25rem !important;
+  }
+  .mt-lg-1,
+  .my-lg-1 {
+    margin-top: 0.25rem !important;
+  }
+  .mr-lg-1,
+  .mx-lg-1 {
+    margin-right: 0.25rem !important;
+  }
+  .mb-lg-1,
+  .my-lg-1 {
+    margin-bottom: 0.25rem !important;
+  }
+  .ml-lg-1,
+  .mx-lg-1 {
+    margin-left: 0.25rem !important;
+  }
+  .m-lg-2 {
+    margin: 0.5rem !important;
+  }
+  .mt-lg-2,
+  .my-lg-2 {
+    margin-top: 0.5rem !important;
+  }
+  .mr-lg-2,
+  .mx-lg-2 {
+    margin-right: 0.5rem !important;
+  }
+  .mb-lg-2,
+  .my-lg-2 {
+    margin-bottom: 0.5rem !important;
+  }
+  .ml-lg-2,
+  .mx-lg-2 {
+    margin-left: 0.5rem !important;
+  }
+  .m-lg-3 {
+    margin: 1rem !important;
+  }
+  .mt-lg-3,
+  .my-lg-3 {
+    margin-top: 1rem !important;
+  }
+  .mr-lg-3,
+  .mx-lg-3 {
+    margin-right: 1rem !important;
+  }
+  .mb-lg-3,
+  .my-lg-3 {
+    margin-bottom: 1rem !important;
+  }
+  .ml-lg-3,
+  .mx-lg-3 {
+    margin-left: 1rem !important;
+  }
+  .m-lg-4 {
+    margin: 1.5rem !important;
+  }
+  .mt-lg-4,
+  .my-lg-4 {
+    margin-top: 1.5rem !important;
+  }
+  .mr-lg-4,
+  .mx-lg-4 {
+    margin-right: 1.5rem !important;
+  }
+  .mb-lg-4,
+  .my-lg-4 {
+    margin-bottom: 1.5rem !important;
+  }
+  .ml-lg-4,
+  .mx-lg-4 {
+    margin-left: 1.5rem !important;
+  }
+  .m-lg-5 {
+    margin: 3rem !important;
+  }
+  .mt-lg-5,
+  .my-lg-5 {
+    margin-top: 3rem !important;
+  }
+  .mr-lg-5,
+  .mx-lg-5 {
+    margin-right: 3rem !important;
+  }
+  .mb-lg-5,
+  .my-lg-5 {
+    margin-bottom: 3rem !important;
+  }
+  .ml-lg-5,
+  .mx-lg-5 {
+    margin-left: 3rem !important;
+  }
+  .p-lg-0 {
+    padding: 0 !important;
+  }
+  .pt-lg-0,
+  .py-lg-0 {
+    padding-top: 0 !important;
+  }
+  .pr-lg-0,
+  .px-lg-0 {
+    padding-right: 0 !important;
+  }
+  .pb-lg-0,
+  .py-lg-0 {
+    padding-bottom: 0 !important;
+  }
+  .pl-lg-0,
+  .px-lg-0 {
+    padding-left: 0 !important;
+  }
+  .p-lg-1 {
+    padding: 0.25rem !important;
+  }
+  .pt-lg-1,
+  .py-lg-1 {
+    padding-top: 0.25rem !important;
+  }
+  .pr-lg-1,
+  .px-lg-1 {
+    padding-right: 0.25rem !important;
+  }
+  .pb-lg-1,
+  .py-lg-1 {
+    padding-bottom: 0.25rem !important;
+  }
+  .pl-lg-1,
+  .px-lg-1 {
+    padding-left: 0.25rem !important;
+  }
+  .p-lg-2 {
+    padding: 0.5rem !important;
+  }
+  .pt-lg-2,
+  .py-lg-2 {
+    padding-top: 0.5rem !important;
+  }
+  .pr-lg-2,
+  .px-lg-2 {
+    padding-right: 0.5rem !important;
+  }
+  .pb-lg-2,
+  .py-lg-2 {
+    padding-bottom: 0.5rem !important;
+  }
+  .pl-lg-2,
+  .px-lg-2 {
+    padding-left: 0.5rem !important;
+  }
+  .p-lg-3 {
+    padding: 1rem !important;
+  }
+  .pt-lg-3,
+  .py-lg-3 {
+    padding-top: 1rem !important;
+  }
+  .pr-lg-3,
+  .px-lg-3 {
+    padding-right: 1rem !important;
+  }
+  .pb-lg-3,
+  .py-lg-3 {
+    padding-bottom: 1rem !important;
+  }
+  .pl-lg-3,
+  .px-lg-3 {
+    padding-left: 1rem !important;
+  }
+  .p-lg-4 {
+    padding: 1.5rem !important;
+  }
+  .pt-lg-4,
+  .py-lg-4 {
+    padding-top: 1.5rem !important;
+  }
+  .pr-lg-4,
+  .px-lg-4 {
+    padding-right: 1.5rem !important;
+  }
+  .pb-lg-4,
+  .py-lg-4 {
+    padding-bottom: 1.5rem !important;
+  }
+  .pl-lg-4,
+  .px-lg-4 {
+    padding-left: 1.5rem !important;
+  }
+  .p-lg-5 {
+    padding: 3rem !important;
+  }
+  .pt-lg-5,
+  .py-lg-5 {
+    padding-top: 3rem !important;
+  }
+  .pr-lg-5,
+  .px-lg-5 {
+    padding-right: 3rem !important;
+  }
+  .pb-lg-5,
+  .py-lg-5 {
+    padding-bottom: 3rem !important;
+  }
+  .pl-lg-5,
+  .px-lg-5 {
+    padding-left: 3rem !important;
+  }
+  .m-lg-auto {
+    margin: auto !important;
+  }
+  .mt-lg-auto,
+  .my-lg-auto {
+    margin-top: auto !important;
+  }
+  .mr-lg-auto,
+  .mx-lg-auto {
+    margin-right: auto !important;
+  }
+  .mb-lg-auto,
+  .my-lg-auto {
+    margin-bottom: auto !important;
+  }
+  .ml-lg-auto,
+  .mx-lg-auto {
+    margin-left: auto !important;
+  }
+}
+
+@media (min-width: 1200px) {
+  .m-xl-0 {
+    margin: 0 !important;
+  }
+  .mt-xl-0,
+  .my-xl-0 {
+    margin-top: 0 !important;
+  }
+  .mr-xl-0,
+  .mx-xl-0 {
+    margin-right: 0 !important;
+  }
+  .mb-xl-0,
+  .my-xl-0 {
+    margin-bottom: 0 !important;
+  }
+  .ml-xl-0,
+  .mx-xl-0 {
+    margin-left: 0 !important;
+  }
+  .m-xl-1 {
+    margin: 0.25rem !important;
+  }
+  .mt-xl-1,
+  .my-xl-1 {
+    margin-top: 0.25rem !important;
+  }
+  .mr-xl-1,
+  .mx-xl-1 {
+    margin-right: 0.25rem !important;
+  }
+  .mb-xl-1,
+  .my-xl-1 {
+    margin-bottom: 0.25rem !important;
+  }
+  .ml-xl-1,
+  .mx-xl-1 {
+    margin-left: 0.25rem !important;
+  }
+  .m-xl-2 {
+    margin: 0.5rem !important;
+  }
+  .mt-xl-2,
+  .my-xl-2 {
+    margin-top: 0.5rem !important;
+  }
+  .mr-xl-2,
+  .mx-xl-2 {
+    margin-right: 0.5rem !important;
+  }
+  .mb-xl-2,
+  .my-xl-2 {
+    margin-bottom: 0.5rem !important;
+  }
+  .ml-xl-2,
+  .mx-xl-2 {
+    margin-left: 0.5rem !important;
+  }
+  .m-xl-3 {
+    margin: 1rem !important;
+  }
+  .mt-xl-3,
+  .my-xl-3 {
+    margin-top: 1rem !important;
+  }
+  .mr-xl-3,
+  .mx-xl-3 {
+    margin-right: 1rem !important;
+  }
+  .mb-xl-3,
+  .my-xl-3 {
+    margin-bottom: 1rem !important;
+  }
+  .ml-xl-3,
+  .mx-xl-3 {
+    margin-left: 1rem !important;
+  }
+  .m-xl-4 {
+    margin: 1.5rem !important;
+  }
+  .mt-xl-4,
+  .my-xl-4 {
+    margin-top: 1.5rem !important;
+  }
+  .mr-xl-4,
+  .mx-xl-4 {
+    margin-right: 1.5rem !important;
+  }
+  .mb-xl-4,
+  .my-xl-4 {
+    margin-bottom: 1.5rem !important;
+  }
+  .ml-xl-4,
+  .mx-xl-4 {
+    margin-left: 1.5rem !important;
+  }
+  .m-xl-5 {
+    margin: 3rem !important;
+  }
+  .mt-xl-5,
+  .my-xl-5 {
+    margin-top: 3rem !important;
+  }
+  .mr-xl-5,
+  .mx-xl-5 {
+    margin-right: 3rem !important;
+  }
+  .mb-xl-5,
+  .my-xl-5 {
+    margin-bottom: 3rem !important;
+  }
+  .ml-xl-5,
+  .mx-xl-5 {
+    margin-left: 3rem !important;
+  }
+  .p-xl-0 {
+    padding: 0 !important;
+  }
+  .pt-xl-0,
+  .py-xl-0 {
+    padding-top: 0 !important;
+  }
+  .pr-xl-0,
+  .px-xl-0 {
+    padding-right: 0 !important;
+  }
+  .pb-xl-0,
+  .py-xl-0 {
+    padding-bottom: 0 !important;
+  }
+  .pl-xl-0,
+  .px-xl-0 {
+    padding-left: 0 !important;
+  }
+  .p-xl-1 {
+    padding: 0.25rem !important;
+  }
+  .pt-xl-1,
+  .py-xl-1 {
+    padding-top: 0.25rem !important;
+  }
+  .pr-xl-1,
+  .px-xl-1 {
+    padding-right: 0.25rem !important;
+  }
+  .pb-xl-1,
+  .py-xl-1 {
+    padding-bottom: 0.25rem !important;
+  }
+  .pl-xl-1,
+  .px-xl-1 {
+    padding-left: 0.25rem !important;
+  }
+  .p-xl-2 {
+    padding: 0.5rem !important;
+  }
+  .pt-xl-2,
+  .py-xl-2 {
+    padding-top: 0.5rem !important;
+  }
+  .pr-xl-2,
+  .px-xl-2 {
+    padding-right: 0.5rem !important;
+  }
+  .pb-xl-2,
+  .py-xl-2 {
+    padding-bottom: 0.5rem !important;
+  }
+  .pl-xl-2,
+  .px-xl-2 {
+    padding-left: 0.5rem !important;
+  }
+  .p-xl-3 {
+    padding: 1rem !important;
+  }
+  .pt-xl-3,
+  .py-xl-3 {
+    padding-top: 1rem !important;
+  }
+  .pr-xl-3,
+  .px-xl-3 {
+    padding-right: 1rem !important;
+  }
+  .pb-xl-3,
+  .py-xl-3 {
+    padding-bottom: 1rem !important;
+  }
+  .pl-xl-3,
+  .px-xl-3 {
+    padding-left: 1rem !important;
+  }
+  .p-xl-4 {
+    padding: 1.5rem !important;
+  }
+  .pt-xl-4,
+  .py-xl-4 {
+    padding-top: 1.5rem !important;
+  }
+  .pr-xl-4,
+  .px-xl-4 {
+    padding-right: 1.5rem !important;
+  }
+  .pb-xl-4,
+  .py-xl-4 {
+    padding-bottom: 1.5rem !important;
+  }
+  .pl-xl-4,
+  .px-xl-4 {
+    padding-left: 1.5rem !important;
+  }
+  .p-xl-5 {
+    padding: 3rem !important;
+  }
+  .pt-xl-5,
+  .py-xl-5 {
+    padding-top: 3rem !important;
+  }
+  .pr-xl-5,
+  .px-xl-5 {
+    padding-right: 3rem !important;
+  }
+  .pb-xl-5,
+  .py-xl-5 {
+    padding-bottom: 3rem !important;
+  }
+  .pl-xl-5,
+  .px-xl-5 {
+    padding-left: 3rem !important;
+  }
+  .m-xl-auto {
+    margin: auto !important;
+  }
+  .mt-xl-auto,
+  .my-xl-auto {
+    margin-top: auto !important;
+  }
+  .mr-xl-auto,
+  .mx-xl-auto {
+    margin-right: auto !important;
+  }
+  .mb-xl-auto,
+  .my-xl-auto {
+    margin-bottom: auto !important;
+  }
+  .ml-xl-auto,
+  .mx-xl-auto {
+    margin-left: auto !important;
+  }
+}
+
+.text-monospace {
+  font-family: SFMono-Regular, Menlo, Monaco, Consolas, "Liberation Mono", "Courier New", monospace;
+}
+
+.text-justify {
+  text-align: justify !important;
+}
+
+.text-nowrap {
+  white-space: nowrap !important;
+}
+
+.text-truncate {
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+.text-left {
+  text-align: left !important;
+}
+
+.text-right {
+  text-align: right !important;
+}
+
+.text-center {
+  text-align: center !important;
+}
+
+@media (min-width: 576px) {
+  .text-sm-left {
+    text-align: left !important;
+  }
+  .text-sm-right {
+    text-align: right !important;
+  }
+  .text-sm-center {
+    text-align: center !important;
+  }
+}
+
+@media (min-width: 768px) {
+  .text-md-left {
+    text-align: left !important;
+  }
+  .text-md-right {
+    text-align: right !important;
+  }
+  .text-md-center {
+    text-align: center !important;
+  }
+}
+
+@media (min-width: 992px) {
+  .text-lg-left {
+    text-align: left !important;
+  }
+  .text-lg-right {
+    text-align: right !important;
+  }
+  .text-lg-center {
+    text-align: center !important;
+  }
+}
+
+@media (min-width: 1200px) {
+  .text-xl-left {
+    text-align: left !important;
+  }
+  .text-xl-right {
+    text-align: right !important;
+  }
+  .text-xl-center {
+    text-align: center !important;
+  }
+}
+
+.text-lowercase {
+  text-transform: lowercase !important;
+}
+
+.text-uppercase {
+  text-transform: uppercase !important;
+}
+
+.text-capitalize {
+  text-transform: capitalize !important;
+}
+
+.font-weight-light {
+  font-weight: 300 !important;
+}
+
+.font-weight-normal {
+  font-weight: 400 !important;
+}
+
+.font-weight-bold {
+  font-weight: 700 !important;
+}
+
+.font-italic {
+  font-style: italic !important;
+}
+
+.text-white {
+  color: #fff !important;
+}
+
+.text-primary {
+  color: #007bff !important;
+}
+
+a.text-primary:hover, a.text-primary:focus {
+  color: #0062cc !important;
+}
+
+.text-secondary {
+  color: #6c757d !important;
+}
+
+a.text-secondary:hover, a.text-secondary:focus {
+  color: #545b62 !important;
+}
+
+.text-success {
+  color: #28a745 !important;
+}
+
+a.text-success:hover, a.text-success:focus {
+  color: #1e7e34 !important;
+}
+
+.text-info {
+  color: #17a2b8 !important;
+}
+
+a.text-info:hover, a.text-info:focus {
+  color: #117a8b !important;
+}
+
+.text-warning {
+  color: #ffc107 !important;
+}
+
+a.text-warning:hover, a.text-warning:focus {
+  color: #d39e00 !important;
+}
+
+.text-danger {
+  color: #dc3545 !important;
+}
+
+a.text-danger:hover, a.text-danger:focus {
+  color: #bd2130 !important;
+}
+
+.text-light {
+  color: #f8f9fa !important;
+}
+
+a.text-light:hover, a.text-light:focus {
+  color: #dae0e5 !important;
+}
+
+.text-dark {
+  color: #343a40 !important;
+}
+
+a.text-dark:hover, a.text-dark:focus {
+  color: #1d2124 !important;
+}
+
+.text-body {
+  color: #212529 !important;
+}
+
+.text-muted {
+  color: #6c757d !important;
+}
+
+.text-black-50 {
+  color: rgba(0, 0, 0, 0.5) !important;
+}
+
+.text-white-50 {
+  color: rgba(255, 255, 255, 0.5) !important;
+}
+
+.text-hide {
+  font: 0/0 a;
+  color: transparent;
+  text-shadow: none;
+  background-color: transparent;
+  border: 0;
+}
+
+.visible {
+  visibility: visible !important;
+}
+
+.invisible {
+  visibility: hidden !important;
+}
+
+@media print {
+  *,
+  *::before,
+  *::after {
+    text-shadow: none !important;
+    box-shadow: none !important;
+  }
+  a:not(.btn) {
+    text-decoration: underline;
+  }
+  abbr[title]::after {
+    content: " (" attr(title) ")";
+  }
+  pre {
+    white-space: pre-wrap !important;
+  }
+  pre,
+  blockquote {
+    border: 1px solid #adb5bd;
+    page-break-inside: avoid;
+  }
+  thead {
+    display: table-header-group;
+  }
+  tr,
+  img {
+    page-break-inside: avoid;
+  }
+  p,
+  h2,
+  h3 {
+    orphans: 3;
+    widows: 3;
+  }
+  h2,
+  h3 {
+    page-break-after: avoid;
+  }
+  @page {
+    size: a3;
+  }
+  body {
+    min-width: 992px !important;
+  }
+  .container {
+    min-width: 992px !important;
+  }
+  .navbar {
+    display: none;
+  }
+  .badge {
+    border: 1px solid #000;
+  }
+  .table {
+    border-collapse: collapse !important;
+  }
+  .table td,
+  .table th {
+    background-color: #fff !important;
+  }
+  .table-bordered th,
+  .table-bordered td {
+    border: 1px solid #dee2e6 !important;
+  }
+  .table-dark {
+    color: inherit;
+  }
+  .table-dark th,
+  .table-dark td,
+  .table-dark thead th,
+  .table-dark tbody + tbody {
+    border-color: #dee2e6;
+  }
+  .table .thead-dark th {
+    color: inherit;
+    border-color: #dee2e6;
+  }
+}
+/*# sourceMappingURL=bootstrap.css.map */
\ No newline at end of file
diff --git a/ee/bulk-operations-dashboard/assets/dependencies/cloud.js b/ee/bulk-operations-dashboard/assets/dependencies/cloud.js
new file mode 100644
index 0000000000..2f0e10c4c6
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/dependencies/cloud.js
@@ -0,0 +1,1987 @@
+/**
+ * cloud.js
+ * (high-level AJAX library)
+ *
+ * > This is now part of `parasails`.  It was branched from the old "Cloud SDK"
+ * > library at its v1.0.1 -- but from that point on, its versioning has been
+ * > tied to the version of parasails it's bundled in.  (All future development
+ * > of Cloud SDK will be as part of parasails.)
+ *
+ * Copyright (c) 2014-present, Mike McNeil
+ * MIT License
+ *
+ * - https://twitter.com/mikermcneil
+ * - https://sailsjs.com/about
+ * - https://sailsjs.com/support
+ * - https://www.npmjs.com/package/parasails
+ *
+ * ---------------------------------------------------------------------------------------------
+ * ## Basic Usage
+ *
+ * Step 1:
+ *
+ * ```
+ * Cloud.setup({  doSomething: 'POST /api/v1/somethings/:id/do'  });
+ * ```
+ * ^^Note that this can also be compiled automatically from your Sails app's routes using a script.
+ *
+ * Step 2:
+ *
+ * ```
+ * var result = await Cloud.doSomething(8);
+ * ```
+ *
+ * Or:
+ * ```
+ * var result = await Cloud.doSomething.with({id: 8, foo: ['bar', 'baz']});
+ * ```
+ * ---------------------------------------------------------------------------------------------
+ */
+(function(factory, exposeUMD){
+  exposeUMD(this, factory);
+})(function (_, io, $, SAILS_LOCALS, location, File, FileList, FormData){
+
+  //  ██████╗ ██████╗ ██╗██╗   ██╗ █████╗ ████████╗███████╗
+  //  ██╔══██╗██╔══██╗██║██║   ██║██╔══██╗╚══██╔══╝██╔════╝
+  //  ██████╔╝██████╔╝██║██║   ██║███████║   ██║   █████╗
+  //  ██╔═══╝ ██╔══██╗██║╚██╗ ██╔╝██╔══██║   ██║   ██╔══╝
+  //  ██║     ██║  ██║██║ ╚████╔╝ ██║  ██║   ██║   ███████╗
+  //  ╚═╝     ╚═╝  ╚═╝╚═╝  ╚═══╝  ╚═╝  ╚═╝   ╚═╝   ╚══════╝
+  //
+  //  ██╗   ██╗████████╗██╗██╗     ███████╗
+  //  ██║   ██║╚══██╔══╝██║██║     ██╔════╝
+  //  ██║   ██║   ██║   ██║██║     ███████╗
+  //  ██║   ██║   ██║   ██║██║     ╚════██║
+  //  ╚██████╔╝   ██║   ██║███████╗███████║
+  //   ╚═════╝    ╚═╝   ╚═╝╚══════╝╚══════╝
+  // Module utilities (private)
+
+
+  /**
+   * @param  {Ref} that
+   *
+   * @throws {Error} If that is not a File instance, a FileList instance, an
+   *                 array of File instances, a special File wrapper, or an
+   *                 array of special File wrappers.  (Note that, if an array is
+   *                 provided, this function will only return true if the array
+   *                 consists of ≥1 item.)
+   */
+  function _representsOneOrMoreFiles(that) {
+    // FUTURE: add support for Blobs
+    return (
+      _.isObject(that) &&
+      (
+        (File? that instanceof File : false)||
+        (FileList? that instanceof FileList : false)||
+        (_.isArray(that) && that.length > 0 && _.all(that, function(item) { return File? _.isObject(item) && item instanceof File : false; }))||
+        (File? _.isObject(that) && _.isObject(that.file) && that.file instanceof File : false)||
+        (_.isArray(that) && that.length > 0 && _.all(that, function(item) { return File? _.isObject(item) && _.isObject(item.file) && item.file instanceof File : false; }))
+      )
+    );
+  }//ƒ
+
+
+  /**
+   * @param  {String} negotiationRule
+   *
+   * @throws {Error} If rule is invalid or absent
+   */
+  function _verifyErrorNegotiationRule(negotiationRule) {
+
+    // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+    // FUTURE: add support for parley/flaverr/bluebird/lodash-style dictionary negotiation rules
+    // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+    if (_.isNumber(negotiationRule) && Math.floor(negotiationRule) === negotiationRule) {
+      if (negotiationRule > 599 || negotiationRule < 0) {
+        throw new Error('Invalid error negotiation rule: `'+negotiationRule+'`.  If a status code is provided, it must be between zero and 599.');
+      }
+    }
+    else if (_.isString(negotiationRule) && negotiationRule) {
+      // Ok, we'll assume it's fine
+    }
+    else {
+      var suffix = '';
+      if (negotiationRule === undefined || _.isFunction(negotiationRule)) {
+        suffix = '  Looking to tolerate or intercept **EVERY** error?  This usually isn\'t a good idea, because, just like some try/catch usage patterns, it could mean swallowing errors unexpectedly, which can make debugging a nightmare.';
+      }
+      throw new Error('Invalid error negotiation rule: `'+negotiationRule+'`.  Please pass in a valid intercept rule string.  An intercept rule is either (A) the name of an exit or (B) a whole number representing the status code like `404` or `200`.'+suffix);
+    }
+
+  }
+
+
+
+
+
+  //  ███████╗██╗  ██╗██████╗  ██████╗ ██████╗ ████████╗███████╗
+  //  ██╔════╝╚██╗██╔╝██╔══██╗██╔═══██╗██╔══██╗╚══██╔══╝██╔════╝
+  //  █████╗   ╚███╔╝ ██████╔╝██║   ██║██████╔╝   ██║   ███████╗
+  //  ██╔══╝   ██╔██╗ ██╔═══╝ ██║   ██║██╔══██╗   ██║   ╚════██║
+  //  ███████╗██╔╝ ██╗██║     ╚██████╔╝██║  ██║   ██║   ███████║
+  //  ╚══════╝╚═╝  ╚═╝╚═╝      ╚═════╝ ╚═╝  ╚═╝   ╚═╝   ╚══════╝
+  // Module exports:
+
+  /**
+   * Cloud (SDK)
+   *
+   * After setup, this dictionary will have a method for each declared endpoint.
+   * Each key will be a function which sends an HTTP or socket request to a
+   * particular endpoint.
+   *
+   * ### Setup
+   *
+   * ```
+   * Cloud.setup({
+   *   apiBaseUrl: 'https://example.com',
+   *   usageOpts: {
+   *     arginStyle: 'serial'
+   *   },
+   *   methods: {
+   *     doSomething: 'PUT /api/v1/projects/:id',
+   *     // ...
+   *   }
+   * });
+   * ```
+   *
+   * > Note that you should avoid having an endpoint method named "setup", for obvious reasons.
+   * > (Technically, it should work anyway though.  But yeah, no reason to tempt the fates.)
+   *
+   * ### Basic Usage
+   *
+   * ```
+   * var user = await Cloud.findOneUser(3);
+   * ```
+   *
+   * ```
+   * var user = await Cloud.findOneUser.with({ id: 3 });
+   * ```
+   *
+   * ```
+   * Cloud.doSomething.with({
+   *   someParam: ['things', 3235, null, true, false, {}, []]
+   *   someOtherParam: 2523,
+   *   etc: 'more things'
+   * }).exec(function (err, responseBody, responseObjLikeJqXHR) {
+   *   if (err) {
+   *     // ...
+   *     return;
+   *   }
+   *
+   *   // ...
+   * });
+   * ```
+   *
+   * ### Negotiating Errors
+   * ```
+   * Cloud.signup.with({...})
+   * .switch({
+   *   error: function (err) { ... },
+   *   usernameAlreadyInUse: function (recommendedAlternativeUsernames) { ... },
+   *   emailAddressAlreadyInUse: function () { ... },
+   *   success: function () { ... }
+   * });
+   * ```
+   *
+   * ### Using WebSockets
+   * ```
+   * Cloud.doSomething.with({...})
+   * .protocol('jQuery')
+   * .exec(...);
+   * ```
+   *
+   * ```
+   * Cloud.doSomething.with({...})
+   * .protocol('io.socket')
+   * .exec(...);
+   * ```
+   *
+   * ##### Providing a particular jQuery or SailsSocket instance
+   *
+   * ```
+   * Cloud.doSomething.with({...})
+   * .protocol(io.socket)
+   * .exec(...);
+   * ```
+   *
+   * ```
+   * Cloud.doSomething.with({...})
+   * .protocol($)
+   * .exec(...);
+   * ```
+   *
+   * ### Using Custom Headers
+   * ```
+   * Cloud.doSomething.with({...})
+   * .headers({
+   *   'X-Auth': 'whatever'
+   * })
+   * .exec(...);
+   * ```
+   *
+   * ### CSRF Protection
+   *
+   * It `SAILS_LOCALS._csrf` is defined, then it will be sent
+   * as the "x-csrf-token" header for all Cloud.* requests, automatically.
+   *
+   */
+
+  var Cloud = {};
+
+
+  // FUTURE:  Cloud.getUrlFor()
+  // (similar to https://sailsjs.com/documentation/reference/application/sails-get-url-for)
+  // (but would def need to provide a way of providing values for URL pattern variables like `:id`)
+
+
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+  // FUTURE: finish this when time allows   (might be better to have it work by attaching dedicated
+  // nav methods rather than a generic nav method though)
+  // ```
+  // // A mapping of names of view actions to URL
+  // // > provided to `.setup()`, for use in .navigate()
+  // var _navigableUrlsByViewActionName;
+  //
+  //
+  // /**
+  //  * Cloud.navigate()
+  //  *
+  //  * Call this function to navigate to a different web page.
+  //  * (Be sure and call it *before* trying to use any of the endpoint methods!)
+  //  *
+  //  * @param  {String} destination
+  //  *         A URL or the name of a view action.
+  //  */
+  // Cloud.navigate = function(destination) {
+
+  //   var doesBeginWithSlash = _.isString(destination) && destination.match(/^\//);
+  //   var doesBeginWithHttp = _.isString(destination) && destination.match(/^http/);
+  //   var isProbablyTheNameOfAViewAction = _.isString(destination) && destination.match(/^view/);
+  //   if (!_.isString(destination) || !(doesBeginWithSlash || doesBeginWithHttp || isProbablyTheNameOfAViewAction)) {
+  //     throw new Error('Bad usage: Cloud.navigate() should be called with a URL or the name of a view action.');
+  //   }
+
+  //   if (!_navigableUrlsByViewActionName) {
+  //     throw new Error('Cannot navigate to a view action because Cloud.setup() has not been called yet-- please do that first (or if that\'s not possible, just navigate directly to the URL)');
+  //   }
+
+  // };
+  // ```
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+
+  /**
+   * Cloud.setup()
+   *
+   * Call this function once, when the page loads.
+   * (Be sure and call it *before* trying to use any of the endpoint methods!)
+   *
+   * @param  {Dictionary} options
+   *         @required {Dictionary} methods
+   *         @optional {Dictionary} links
+   *         @optional {Dictionary} apiBaseUrl
+   */
+  Cloud.setup = function(options) {
+
+    options = options || {};
+
+    if (!_.isObject(options.methods) || _.isArray(options.methods) || _.isFunction(options.methods)) {
+      throw new Error('Cannot .setup() Cloud SDK: `methods` must be provided as a dictionary of addresses and definitions.');
+    }//•
+
+    // Determine the proper API base URL
+    if (!options.apiBaseUrl) {
+      if (location) {
+        options.apiBaseUrl = location.protocol+'//'+location.hostname+(location.port ? ':'+location.port: '');
+      }
+      else {
+        throw new Error('Cannot .setup() Cloud SDK: Since a location cannot be determined, `apiBaseUrl` must be provided as a string (e.g. "https://example.com").');
+      }
+    }//fi
+
+    // Apply the base URL for the benefit of WebSockets (if relevant):
+    if (io) {
+      io.sails.url = options.apiBaseUrl;
+    }//fi
+
+    // The name of the default protocol.
+    var DEFAULT_PROTOCOL_NAME = 'jQuery';
+
+    // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+    // FUTURE: finish this when time allows   (would be better to have it work by attaching dedicated
+    // nav methods rather than a generic nav method though)
+    // ```
+    // // Save a reference to the mapping of navigable URLs by view action name (if provided).
+    // _navigableUrlsByViewActionName = options.links || {};
+    // ```
+    // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+    if (options.methods.on) {
+      throw new Error('Cannot .setup() Cloud SDK: `.on()` is reserved.  It cannot be used as the name for a method.');
+    }
+    if (options.methods.off) {
+      throw new Error('Cannot .setup() Cloud SDK: `.off()` is reserved.  It cannot be used as the name for a method.');
+    }
+
+    // Interpret methods
+    var methods = _.reduce(options.methods, function(memo, appLevelSdkEndpointDef, methodName) {
+
+      if (methodName === 'setup') {
+        console.warn('"setup" is a confusing name for a cloud action (it conflicts with a built-in feature of this SDK itself).  Would "initialize()" work instead?  (Continuing this time...)');
+      }
+
+      // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+      // FUTURE: finish this when time allows   (would be better to have it work by attaching dedicated
+      // nav methods rather than a generic nav method though)
+      // ```
+      // if (methodName === 'navigate') {
+      //   console.warn('"navigate" is a confusing name for a cloud action (it conflicts with a built-in feature of this SDK itself).  Would "travel()" work instead?  (Continuing this time...)');
+      // }
+      // ```
+      // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+      // Validate the endpoint definition.
+      ////////////////////////////////////////////////////////////////////////////////////////////////
+      var _verbToCheck;
+      var _urlToCheck;
+      if (typeof appLevelSdkEndpointDef === 'function') {
+        // We can't really check functions, so we just let it through.
+      }
+      else {
+        if (appLevelSdkEndpointDef && typeof appLevelSdkEndpointDef === 'object') {
+          // Must have `verb` and `url` properties.
+          _verbToCheck = appLevelSdkEndpointDef.verb;
+          _urlToCheck = appLevelSdkEndpointDef.url;
+        }
+        else if (typeof appLevelSdkEndpointDef === 'string') {
+          // Must be able to parse `verb` and `url`.
+          _verbToCheck = appLevelSdkEndpointDef.replace(/^\s*([^\/\s]+)\s*\/.*$/, '$1');
+          _urlToCheck = appLevelSdkEndpointDef.replace(/^\s*[^\/\s]+\s*\/(.*)$/, '/$1');
+        }
+        else {
+          throw new Error('CloudSDK endpoint (`'+methodName+'`) is invalid:  Endpoints should be defined as either (1) a string like "GET /foo", (2) a dictionary containing a `verb` and a `url`, or (3) a function that returns a dictionary like that.');
+        }
+
+        // --•
+
+        // `verb` must be valid.
+        if (typeof _verbToCheck !== 'string' || _verbToCheck === '') {
+          throw new Error('CloudSDK endpoint (`'+methodName+'`) is invalid:  An endpoint\'s `verb` should be defined as a non-empty string.');
+        }
+
+        // `url` must be valid.
+        if (typeof _urlToCheck !== 'string' || _urlToCheck === '') {
+          throw new Error('CloudSDK endpoint (`'+methodName+'`) is invalid:  An endpoint\'s `url` should be defined as a non-empty string.');
+        }
+      }
+
+
+      // Build the actual method that will be called at runtime:
+      ////////////////////////////////////////////////////////////////////////
+      var _helpCallCloudMethod = function (argins) {
+
+        //+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++//
+        // There are 3 ways to define an SDK wrapper for a cloud endpoint.
+        //+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++//
+        var requestInfo = {
+          // • the HTTP verb (aka HTTP "method" -- we're just using "verb" for clarity)
+          verb: undefined,
+          // • the path part of the URL
+          url: undefined,
+          // • a dictionary of request data
+          //   (depending on the circumstances, these params will be encoded directly
+          //   into either the url path, the querystring, or the request body)
+          params: undefined,
+          // • a dictionary of custom request headers
+          headers: undefined,
+          // • the protocol name (e.g. "jQuery" or "io.socket")
+          protocolName: undefined,
+          // • the protocol instance (e.g. actual reference to `$` or `io.socket`)
+          protocolInstance: undefined,
+          // • an array of conditional lifecycle instructions from userland .intercept() / .tolerate() calls, if any are configured
+          lifecycleInstructions: [],
+        };
+
+
+
+        //  ██████╗ ██╗   ██╗██╗██╗     ██████╗     ██████╗ ███████╗███████╗███████╗██████╗ ██████╗ ███████╗██████╗
+        //  ██╔══██╗██║   ██║██║██║     ██╔══██╗    ██╔══██╗██╔════╝██╔════╝██╔════╝██╔══██╗██╔══██╗██╔════╝██╔══██╗
+        //  ██████╔╝██║   ██║██║██║     ██║  ██║    ██║  ██║█████╗  █████╗  █████╗  ██████╔╝██████╔╝█████╗  ██║  ██║
+        //  ██╔══██╗██║   ██║██║██║     ██║  ██║    ██║  ██║██╔══╝  ██╔══╝  ██╔══╝  ██╔══██╗██╔══██╗██╔══╝  ██║  ██║
+        //  ██████╔╝╚██████╔╝██║███████╗██████╔╝    ██████╔╝███████╗██║     ███████╗██║  ██║██║  ██║███████╗██████╔╝
+        //  ╚═════╝  ╚═════╝ ╚═╝╚══════╝╚═════╝     ╚═════╝ ╚══════╝╚═╝     ╚══════╝╚═╝  ╚═╝╚═╝  ╚═╝╚══════╝╚═════╝
+        //
+        //   ██████╗ ██████╗      ██╗███████╗ ██████╗████████╗
+        //  ██╔═══██╗██╔══██╗     ██║██╔════╝██╔════╝╚══██╔══╝
+        //  ██║   ██║██████╔╝     ██║█████╗  ██║        ██║
+        //  ██║   ██║██╔══██╗██   ██║██╔══╝  ██║        ██║
+        //  ╚██████╔╝██████╔╝╚█████╔╝███████╗╚██████╗   ██║
+        //   ╚═════╝ ╚═════╝  ╚════╝ ╚══════╝ ╚═════╝   ╚═╝
+        //
+
+        // Used for avoiding accidentally creating multiple promises when
+        // using .then() or .catch().
+        var _promise;
+
+        // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+        // FUTURE: add support for omens so we get better stack traces, particularly
+        // when running this in a Node.js environment.
+        // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+        // Return a dictionary of functions (to allow for "deferred object" usage.)
+        var deferred = {
+
+          // Allow request headers to be configured.
+          /////////////////////////////////////////////////////////////////////////////
+          headers: function (_customRequestHeaders){
+            if (!_.isObject(_customRequestHeaders)) {
+              throw new Error('Invalid request headers: Must be specified as a dictionary, where each key has a string value.');
+            }
+            requestInfo.headers = _.extend(requestInfo.headers||{}, _customRequestHeaders);
+
+            return deferred;
+          },
+
+          // Allow the protocol to be configured on a per-request basis.
+          /////////////////////////////////////////////////////////////////////////////
+          protocol: function (_protocolNameOrInstance){
+            if (typeof _protocolNameOrInstance === 'string') {
+              switch (_protocolNameOrInstance) {
+                case 'jQuery':
+                  requestInfo.protocolName = 'jQuery';
+                  if ($ === undefined) {
+                    throw new Error('Could not access jQuery: `$` is undefined.');
+                  }
+                  else {
+                    requestInfo.protocolInstance = $;
+                  }
+                  break;
+
+                case 'io.socket':
+                  requestInfo.protocolName = 'io.socket';
+                  if (typeof io === 'undefined') {
+                    throw new Error('Could not access `io.socket`: `io` is undefined.');
+                  }
+                  else if (typeof io !== 'function') {
+                    throw new Error('Could not access `io.socket`: `io` is invalid:' + io);
+                  }
+                  else if (typeof io.socket === 'undefined') {
+                    throw new Error('Could not access `io.socket`: `io` does not have a `socket` property.  Make sure `sails.io.js` is being injected in a <script> tag!');
+                  }
+                  else {
+                    requestInfo.protocolInstance = io.socket;
+                  }
+                  break;
+
+                default:
+                  throw new Error('Unrecognized protocol: `'+_protocolNameOrInstance+'`. Use "jQuery" or "io.socket".');
+              }
+            }
+            else if (_.isObject(_protocolNameOrInstance) || _.isFunction(_protocolNameOrInstance)) {
+              if (_protocolNameOrInstance.name === 'jQuery') {
+                requestInfo.protocolName = 'jQuery';
+                requestInfo.protocolInstance = _protocolNameOrInstance;
+              }
+              else if (_protocolNameOrInstance.constructor.name === 'SailsSocket') {
+                requestInfo.protocolName = 'io.socket';
+                requestInfo.protocolInstance = _protocolNameOrInstance;
+              }
+              else if (_protocolNameOrInstance.toString() === '[Package: machinepack-http]' || _protocolNameOrInstance.toString() === '[Package: sails.helpers.http]') {
+                requestInfo.protocolName = 'machinepack-http';
+                requestInfo.protocolInstance = _protocolNameOrInstance;
+              }
+              // FUTURE: maybe native browser "fetch"?
+              // FUTURE: maybe native Node "http"?
+              else {
+                throw new Error('Unrecognized instance provided to `.protocol()`: `'+_protocolNameOrInstance+'`');
+              }
+            }
+            else {
+              throw new Error('Unrecognized protocol: `'+_protocolNameOrInstance+'`. Use "jQuery" or "io.socket".');
+            }
+
+            return deferred;
+
+          },//</ implementation of `.protocol()`>
+
+
+          // Allow intercepting the response before resolution/rejection occurs.
+          // (This is basically an "after receiving response" lifecycle callback.)
+          /////////////////////////////////////////////////////////////////////////////
+          intercept: function (negotiationRule, handler) {
+
+            _verifyErrorNegotiationRule(negotiationRule);
+
+            if (!_.isFunction(handler)) {
+              throw new Error('Invalid 2nd argument to `.intercept()`.  Expecting a handler function.');
+            }
+
+            // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+            // FUTURE: Add a best-effort check to make sure there is no pre-existing rule
+            // that matches this one (i.e. already previously registered using .tolerate()
+            // or .intercept())
+            // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+            requestInfo.lifecycleInstructions.push({
+              type: 'intercept',
+              rule: negotiationRule,
+              handler: handler
+            });
+
+            return deferred;
+
+          },
+
+          // Allow explicitly tolerating certain kinds of responses before resolution/rejection occurs.
+          // (This causes control flow convergence by using `.intercept()` + throwing a special value)
+          /////////////////////////////////////////////////////////////////////////////
+          tolerate: function (_negotiationRuleMaybe, _handlerMaybe) {
+
+            var handler;
+            var negotiationRule;
+            if (_handlerMaybe === undefined && _.isFunction(_negotiationRuleMaybe)) {
+              handler = _negotiationRuleMaybe;
+            }
+            else {
+              negotiationRule = _negotiationRuleMaybe;
+              handler = _handlerMaybe;
+            }
+
+            if (negotiationRule !== undefined) {
+              _verifyErrorNegotiationRule(negotiationRule);
+            }
+
+            if (handler !== undefined && !_.isFunction(handler)) {
+              throw new Error('Invalid 2nd argument. to `.tolerate()`.  Expecting a handler function.');
+            }
+
+            // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+            // FUTURE: Add a best-effort check to make sure there is no pre-existing rule
+            // that matches this one (i.e. already previously registered using .tolerate()
+            // or .intercept())
+            // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+            requestInfo.lifecycleInstructions.push({
+              type: 'tolerate',
+              rule: negotiationRule,
+              handler: handler?
+                handler
+                :
+                function(){ return; }
+            });
+
+            return deferred;
+
+          },
+
+          // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+          // Looking for the EarlyReturnSignal stuff?
+          //
+          // See https://stackoverflow.com/a/43402123/486547 and specifically also
+          // https://stackoverflow.com/questions/29499582/how-to-properly-break-out-of-a-promise-chain#comment80446341_43402123
+          // (there may be a way to do this more elegantly without requiring the calling
+          // code environment to be aware of our special Errors-- but it's not worth it
+          // as-is.  Too much black magic!)
+          //
+          // > More notes & background leading up to this:
+          // > https://gist.github.com/mikermcneil/c1bc2d57f5bedae810295e5ed8c5f935
+          // >
+          // > (Also check out the commit history of the original `caviar` repo.)
+          // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+          then: function (){
+            // console.log('in implementation of `then()`...');
+            var promise = deferred.toPromise();
+            // console.log('obj:',promise);
+            return promise.then.apply(promise, arguments);
+          },
+
+          // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+          // FUTURE: use parley for all this instead, if we can find a way to keep it
+          // from being too enormous when browserified
+          // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+          toPromise: function (){
+            if (typeof Promise === 'undefined') { throw new Error('Cannot use this approach: `Promise` constructor not available in current environment.'); }
+
+            if (_promise) {
+              // console.log('using catched promise...');
+              return _promise;
+            }
+            // console.log('instantiating new promise!');
+
+            _promise = new Promise(function(resolve, reject){// eslint-disable-line no-undef
+              try {
+                deferred.exec(function(err, resultMaybe) {
+                  if (err){
+                    // console.log('calling reject..');
+                    return reject(err);
+                  }
+                  // console.log('calling resolve..');
+                  return resolve(resultMaybe);
+                });//_∏_
+              } catch (err) {
+                // console.log('EXEC THREW ERROR!',err);
+                // console.log('CALLED REJECT IN NATIVE CATCH BLOCK!');
+                reject(err);
+              }
+            });//_∏_
+
+            return _promise;
+          },
+
+
+          // Allow the AJAX request to actually be sent.
+          /////////////////////////////////////////////////////////////////////////////
+          exec: function (exitCallbacks){
+
+            if (exitCallbacks) {
+              if (!_.isObject(exitCallbacks) && !_.isFunction(exitCallbacks)) {
+                throw new Error('If specified, the argument passed to `.exec()` must be a dictionary containing a `success` and `error` callback.  Alternatively, you can use a Node.js-style callback.');
+              }
+              else if (_.isObject(exitCallbacks) && exitCallbacks.success && !_.isFunction(exitCallbacks.success)) {
+                throw new Error('If specified, `success` callback must be a function.');
+              }
+              else if (_.isObject(exitCallbacks) && exitCallbacks.error && !_.isFunction(exitCallbacks.error)) {
+                throw new Error('If specified, `error` callback must be a function.');
+              }
+            }
+
+            // Just in case, build an error instance beforehand.
+            // (This ensures it has a good stack trace.)
+            var errorInstance = new Error('Endpoint (`'+methodName+'`) responded with an error (or the request failed).');
+
+            // Give the error a special `name` property to ease negotiation
+            // (vs. other unrelated things like typos in argins)
+            errorInstance.name = 'CloudError';
+
+            // If present, use CSRF token from `SAILS_LOCALS` as the `x-csrf-token`
+            // request header for all non-GET requests.
+            // (Unless of course there's another x-csrf-token header already specified.)
+            if (_.isObject(SAILS_LOCALS) && typeof SAILS_LOCALS._csrf !== 'undefined') {
+              if (_.isUndefined(requestInfo.headers)) {
+                requestInfo.headers = {};
+              }// >-
+              if (!requestInfo.headers['x-csrf-token']) {
+                requestInfo.headers['x-csrf-token'] = SAILS_LOCALS._csrf;
+              }
+            }//fi
+
+            // Finally, use the appropriate protocol to actually send the request and
+            // send back the response to the code that called this `Cloud.*()` method.
+            (function _makeAjaxCallWithAppropriateProtocol(proceed){
+
+              // First, tease apart text params and file params.
+              var textParamsByFieldName = requestInfo.params;
+
+              // Check for file uploads.
+              //
+              // If `FormData` constructor is available, check to see if any
+              // of the param values are File/FileList instances, or arrays of
+              // File instances, or special File wrappers, or arrays of special
+              // File wrappers. If they are, then remove them from a shallow
+              // clone of the params dictionary, and set them up separately.
+              // (The files will be attached to the request _after_ the text
+              // parameters.)
+              var uploadsByFieldName = {};
+              if (FormData && textParamsByFieldName) {
+                textParamsByFieldName = _.extend({}, textParamsByFieldName);
+                _.each(textParamsByFieldName, function(value, fieldName){
+                  if (_representsOneOrMoreFiles(value)) {
+                    uploadsByFieldName[fieldName] = value;
+                    delete textParamsByFieldName[fieldName];
+                  }
+                });//∞
+              }//fi
+
+              // Don't allow file uploads for GET requests,
+              // or if the FormData constructor is somehow missing.
+              if (_.keys(uploadsByFieldName).length > 0) {
+                if (requestInfo.verb.match(/get/i)) {
+                  throw new Error(
+                    'Detected File or FileList instance(s) provided for parameter(s):  '+
+                    _.keys(uploadsByFieldName)+'\n'+
+                    'But this is a nullipotent ('+requestInfo.verb.toUpperCase()+') '+
+                    'request, which does not support file uploads.'
+                  );
+                }//•
+                if (!FormData) {
+                  throw new Error(
+                    'Detected File or FileList instance(s) provided for parameter(s):  '+
+                    _.keys(uploadsByFieldName)+'\n'+
+                    'But the native FormData constructor does not exist!'
+                  );
+                }
+              }//fi
+
+              switch (requestInfo.protocolName) {
+
+                //  ▄▄███▄▄·    █████╗      ██╗ █████╗ ██╗  ██╗ ██╗██╗
+                //  ██╔════╝   ██╔══██╗     ██║██╔══██╗╚██╗██╔╝██╔╝╚██╗
+                //  ███████╗   ███████║     ██║███████║ ╚███╔╝ ██║  ██║
+                //  ╚════██║   ██╔══██║██   ██║██╔══██║ ██╔██╗ ██║  ██║
+                //  ███████║██╗██║  ██║╚█████╔╝██║  ██║██╔╝ ██╗╚██╗██╔╝
+                //  ╚═▀▀▀══╝╚═╝╚═╝  ╚═╝ ╚════╝ ╚═╝  ╚═╝╚═╝  ╚═╝ ╚═╝╚═╝
+                case 'jQuery': return (function _doAjaxWithJQuery(){
+
+                  var thisJQuery = requestInfo.protocolInstance;
+
+                  // Build options for $.ajax().
+                  var ajaxOpts = {
+                    url: requestInfo.url,
+                    method: requestInfo.verb
+                  };
+                  // If GET request, encode params in querystring.
+                  if (requestInfo.verb.match(/get/i)) {
+                    ajaxOpts.data = textParamsByFieldName;
+                  }
+                  // Else if there are files, attach them properly,
+                  // alongside the other stuff in the form -- either
+                  // in the body or as querystring parameters, depending
+                  // on what kind of data they are.
+                  //
+                  // > Note that we include text params **FIRST**,
+                  // > in order to support order-aware body parsers
+                  // > that rely on pessimistic upstream awareness,
+                  // > optimizing uploads and preventing DDoS attacks.
+                  // >
+                  // > Also note that we skip text params and file fields w/
+                  // > `undefined` values for consistency w/ Sails conventions.
+                  //
+                  // > Finally, one last thing to consider:
+                  // > If a value is NOT something that needs special encoding
+                  // > to accurately capture its meaning and data type (e.g. if
+                  // > it is a string), then we simply attach it to the body as
+                  // > form data.  But otherwise, we have to do something fancy
+                  // > to get it to be losslessly encoded for use in backend code.
+                  else if (_.keys(uploadsByFieldName).length > 0){
+                    ajaxOpts.processData = false;
+                    ajaxOpts.contentType = false;
+                    ajaxOpts.data = new FormData();
+                    _.each(textParamsByFieldName, function(value, fieldName){
+                      if (value === undefined) { return; }//•
+                      if (_.isString(value)) {
+                        ajaxOpts.data.append(fieldName, value);
+                      } else {
+                        // Use the "X-JSON-MPU-Params" header to signal to the
+                        // server that this text param is encoded as stringified
+                        // JSON, even though the request's content type would
+                        // suggest otherwise (because it's multipart/form-data
+                        // in order to handle file uploads).
+                        //
+                        // > This is "the new way" of solving this problem.
+                        // > For more info about "the old way" of "solving" this
+                        // > that didn't really work for everything (i.e. doing
+                        // > a recursive dive over the value and attempting to
+                        // > losslessly encode it in the URL query string), see:
+                        // > https://github.com/mikermcneil/parasails/commit/28732b1ed55eb4697de4bf4c559f0319cf773041
+                        requestInfo.headers = requestInfo.headers||{};
+                        if (requestInfo.headers['X-JSON-MPU-Params']) {
+                          requestInfo.headers['X-JSON-MPU-Params'] += ','+fieldName;
+                        } else {
+                          requestInfo.headers['X-JSON-MPU-Params'] = fieldName;
+                        }
+
+                        // FUTURE: do a deep-crawl to sanitize prior to stringification (as alluded to below) -- i.e. to strip undefined array items, etc
+                        var stringifiedValue;
+                        try {
+                          stringifiedValue = JSON.stringify(value);
+                        } catch (unusedErr) {
+                          var errMsgPrefix = 'Could not encode value provided for '+fieldName+' because the value is (or contains) ';
+                          var errMsgSuffix = '.  In a request that contains one or more file uploads, any additional text parameter values need to be encoded in such a way that they can be losslessly parsed by the Sails framework.\n [?] Unsure?  Reach out at https://sailsjs.com/support';
+                          throw new Error(errMsgPrefix+'data that cannot be stringified as JSON (usually, this means it contains circular references-- i.e. its properties or array items are actually references to itself, or each other)'+errMsgSuffix);
+                        }
+                        ajaxOpts.data.append(fieldName, stringifiedValue);
+                      }
+                    });//∞
+
+                    _.each(uploadsByFieldName, function(fileOrFileList, fieldName){
+                      if (fileOrFileList === undefined) { return; }
+                      if (!_representsOneOrMoreFiles(fileOrFileList)) {
+                        throw new Error('Cannot upload as "'+fieldName+'" because the provided value is not a File instance, an array of File instances, a dictionary like `{file: someFileInstance, name: \'filename-override.png\'}`, or an array of such wrapper dictionaries.  Instead, got: '+fileOrFileList+'\n\nNote that this can sometimes occur due to problems with code minification (e.g. uglify configuration).');
+                      }
+                      // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+                      // FUTURE: throw usage error if wrapper (i.e. with `.file`) has a `.name`, override,
+                      // but it isn't a valid string  (i.e. truthy, decent chars, & not too long)
+                      // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+                      if (_.isArray(fileOrFileList) || (_.isObject(fileOrFileList) && _.isObject(fileOrFileList.constructor) && fileOrFileList.constructor.name === 'FileList')) {
+                        for (var i = 0; i < fileOrFileList.length; i++) {
+                          if (fileOrFileList[i] instanceof File) {
+                            ajaxOpts.data.append(fieldName, fileOrFileList[i], fileOrFileList[i].name);
+                          } else {
+                            ajaxOpts.data.append(fieldName, fileOrFileList[i].file, fileOrFileList[i].name||fileOrFileList[i].file.name);
+                          }
+                        }//∞
+                      }
+                      else {
+                        if (fileOrFileList instanceof File) {
+                          ajaxOpts.data.append(fieldName, fileOrFileList, fileOrFileList.name);
+                        } else {
+                          ajaxOpts.data.append(fieldName, fileOrFileList.file, fileOrFileList.name||fileOrFileList.file.name);
+                        }
+                      }
+                    });//∞
+                  }
+                  // Otherwise, attach params as a JSON-encoded request body.
+                  else {
+                    // If any of our text params are arrays, then before stringifying,
+                    // make a shallow clone and strip out any `undefined` values
+                    // that exist as items at the top level of the array.  (This
+                    // prevents them from automatically being changed into `null`
+                    // by JSON.stringify().)
+                    // > (This behavior is a breaking change that was introduced
+                    // > in parasails@0.9.0)
+                    // - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+                    // > FUTURE: Instead, do a deep crawl and mimic the behavior of RTTC:
+                    // > https://github.com/node-machine/rttc/blob/8a84191dc786e872a6c28b24566539573b2a2c4d/lib/helpers/rebuild-recursive.js#L77-L90
+                    // > ^^That'll take care of several other common edge cases that
+                    // > are handled in a kinda strange way by JSON.stringify(),
+                    // > including `NaN`, etc.
+                    // - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+                    var sanitizedTPBFN = _.mapValues(textParamsByFieldName, function(value) {
+                      var sanitizedValue;
+                      if (_.isArray(value)) {
+                        sanitizedValue = _.clone(value);
+                        _.remove(sanitizedValue, function(item){
+                          return item === undefined;
+                        });//∞
+                      } else {
+                        sanitizedValue = value;
+                      }
+                      return sanitizedValue;
+                    });
+                    ajaxOpts.data = JSON.stringify(sanitizedTPBFN);
+                    ajaxOpts.processData = false;
+                    ajaxOpts.contentType = 'application/json; charset=UTF-8';
+                  }
+
+                  // Attach headers so they'll be included in our $.ajax() call.
+                  if (requestInfo.headers !== undefined) {
+                    ajaxOpts.headers = requestInfo.headers;
+                  }
+
+                  // Dealing with jqXHR:
+                  //
+                  // To get status code:
+                  // console.log(jqXHR.statusCode);
+                  //
+                  // To get header(s):
+                  // console.log(jqXHR.getResponseHeader('foo'));
+                  // - or -
+                  // console.log(jqXHR.getAllResponseHeaders());
+                  // ^^^ but this one gives it to you as a string.
+                  // ^^
+                  // WARNING: if using a cross-domain request w/ CORS, this (^^^^^)
+                  // header grabbing may not work properly on some versions of firefox.  More details:
+                  // http://stackoverflow.com/questions/5614735/jqxhr-getallresponseheaders-wont-return-all-headers
+
+                  thisJQuery.ajax(_.extend(ajaxOpts, {
+                    error: function (jqXHR) {
+
+                      return proceed(undefined, {
+                        body: jqXHR.responseJSON === undefined ? jqXHR.responseText : jqXHR.responseJSON,
+                        statusCode: jqXHR.status,
+                        headers: _.reduce(jqXHR.getAllResponseHeaders().split(/\n/), function (memo, pair) {
+                          var splitPair = pair.split(/:/);
+                          var headerName = splitPair[0];
+                          if (headerName === '') { return memo; }
+
+                          // Note that we trim leading AND trailing whitespace.
+                          var headerVal = splitPair.slice(1).join('').replace(/^\s*/, '').replace(/\s*$/, '');
+                          memo[headerName] = headerVal;
+                          // Also add an alias using the all-lowercased version of the header name
+                          // (if it's different)
+                          var allLowercaseHeaderName = headerName.toLowerCase();
+                          if (allLowercaseHeaderName !== headerName) {
+                            memo[allLowercaseHeaderName] = headerVal;
+                          }
+                          return memo;
+                        }, {})
+                      });
+                    },
+                    success: function (unused0, unused1, jqXHR) {
+                      return proceed(undefined, {
+                        body: jqXHR.responseJSON === undefined ? jqXHR.responseText : jqXHR.responseJSON,
+                        statusCode: jqXHR.status,
+                        headers: _.reduce(jqXHR.getAllResponseHeaders().split(/\n/), function (memo, pair) {
+                          var splitPair = pair.split(/:/);
+                          var headerName = splitPair[0];
+                          if (headerName === '') { return memo; }
+
+                          // Note that we trim leading AND trailing whitespace.
+                          var headerVal = splitPair.slice(1).join('').replace(/^\s*/, '').replace(/\s*$/, '');
+                          memo[headerName] = headerVal;
+                          // Also add an alias using the all-lowercased version of the header name
+                          // (if it's different)
+                          var allLowercaseHeaderName = headerName.toLowerCase();
+                          if (allLowercaseHeaderName !== headerName) {
+                            memo[allLowercaseHeaderName] = headerVal;
+                          }
+                          return memo;
+                        }, {})
+                      });
+                    }
+                  }));//</ thisJQuery.ajax + _.extend() >
+                })();//</self-calling function :: _doAjaxWithJQuery>
+
+
+                //  ██╗ ██████╗    ███████╗ ██████╗  ██████╗██╗  ██╗███████╗████████╗       ██╗██╗
+                //  ██║██╔═══██╗   ██╔════╝██╔═══██╗██╔════╝██║ ██╔╝██╔════╝╚══██╔══╝▄ ██╗▄██╔╝╚██╗
+                //  ██║██║   ██║   ███████╗██║   ██║██║     █████╔╝ █████╗     ██║    ████╗██║  ██║
+                //  ██║██║   ██║   ╚════██║██║   ██║██║     ██╔═██╗ ██╔══╝     ██║   ▀╚██╔▀██║  ██║
+                //  ██║╚██████╔╝██╗███████║╚██████╔╝╚██████╗██║  ██╗███████╗   ██║██╗  ╚═╝ ╚██╗██╔╝
+                //  ╚═╝ ╚═════╝ ╚═╝╚══════╝ ╚═════╝  ╚═════╝╚═╝  ╚═╝╚══════╝   ╚═╝╚═╝       ╚═╝╚═╝
+                //
+                case 'io.socket': return (function _doAjaxWithSocket(){
+
+                  var socket = requestInfo.protocolInstance;
+
+                  // Check to be sure that none of the parameter values are
+                  // attempted file uploads.
+                  if (File && requestInfo.params) {
+                    _.each(requestInfo.params, function(value, fieldName){
+                      if (_representsOneOrMoreFiles(value)) {
+                        throw new Error('Detected File-like data provided for the "'+fieldName+'" parameter -- but file uploads are not currently supported using WebSockets / Socket.io.  Please call this method using a different request protocol (e.g. `protocol: \'jQuery\'`)');
+                      }
+                    });
+                  }//fi
+
+                  // Determine if the socket has been disconnected, or if it
+                  // has NEVER BEEN connected and is not CURRENTLY TRYING to
+                  // connect.
+                  var disconnectedOrWasNeverConnectedAndUnlikelyToTry =
+                    // =>
+                    // If the socket is connected, cool, no problem.
+                    !socket.isConnected() &&
+                    // =>
+                    // If the socket is at least _attempting_ to connect, we'll go ahead
+                    // and let it try to do it's thing (i.e. queue and replay)
+                    !socket.isConnecting() &&
+                    // =>
+                    // If the socket hasn't even had the _chance_ to begin connecting
+                    // (because the one-tick auto-connect timer hasn't fired yet),
+                    // then we'll give it that chance.
+                    !socket.mightBeAboutToAutoConnect();
+
+
+                  // If none of the above were true, then emulate a normal
+                  // offline AJAX response from jQuery.
+                  if (disconnectedOrWasNeverConnectedAndUnlikelyToTry) {
+                    return proceed(undefined, {
+                      body: null,
+                      statusCode: 0,
+                      headers: {}
+                    });
+                  }
+                  // Otherwise the socket is either connected, in the process of connecting,
+                  // or in an indeterminate state where it has _never_ connected but _might_
+                  // still connect (see above for details).
+                  //
+                  // In any of these cases, thanks largely to queuing, it is safe to continue
+                  // onwards, and to send the request!
+                  socket.request({
+                    method: requestInfo.verb,
+                    url: requestInfo.url,
+                    data: requestInfo.params,
+                    headers: requestInfo.headers
+                  }, function (unused, jwres) {
+                    return proceed(undefined, {
+                      body: jwres.body,
+                      statusCode: jwres.statusCode,
+                      headers: jwres.headers
+                    });
+                  });//</ socket.request() >
+                })();//</self-calling function :: _doAjaxWithSocket>
+
+
+                //  ███╗   ███╗██████╗       ██╗  ██╗████████╗████████╗██████╗
+                //  ████╗ ████║██╔══██╗      ██║  ██║╚══██╔══╝╚══██╔══╝██╔══██╗
+                //  ██╔████╔██║██████╔╝█████╗███████║   ██║      ██║   ██████╔╝
+                //  ██║╚██╔╝██║██╔═══╝ ╚════╝██╔══██║   ██║      ██║   ██╔═══╝
+                //  ██║ ╚═╝ ██║██║           ██║  ██║   ██║      ██║   ██║
+                //  ╚═╝     ╚═╝╚═╝           ╚═╝  ╚═╝   ╚═╝      ╚═╝   ╚═╝
+                case 'machinepack-http': return (function _doAjaxWithMpHttp(){
+
+                  // If there are request parameters, check to be sure
+                  // that none of the parameter values are File instances.
+                  if (requestInfo.params) {
+                    _.each(requestInfo.params, function(value, fieldName){
+                      if (_representsOneOrMoreFiles(value)) {
+                        throw new Error('Detected File-like data provided for the "'+fieldName+'" parameter -- but file uploads are not currently supported in Cloud SDK when using "machinepack-http".  Please call this method using a different request protocol.');
+                      }
+                    });//∞
+                  }//fi
+
+                  var mpHttpOpts = {
+                    url: requestInfo.url,
+                    method: requestInfo.verb
+                  };
+                  // If GET request, encode params in querystring.
+                  if (requestInfo.verb.match(/get/i)) {
+                    mpHttpOpts.qs = textParamsByFieldName;
+                  }
+                  // Otherwise, attach params as the request body.
+                  // (it will be JSON-encoded automatically by default)
+                  else {
+                    mpHttpOpts.body = textParamsByFieldName;
+                  }
+
+                  if (typeof requestInfo.headers !== 'undefined') {
+                    mpHttpOpts.headers = requestInfo.headers;
+                  }
+
+                  requestInfo.protocolInstance.sendHttpRequest.with(mpHttpOpts)
+                  .switch({
+                    error: function (err) {
+                      return proceed(err);
+                    },
+                    requestFailed: function(err) {
+                      return proceed(undefined, {
+                        body: err.message,
+                        statusCode: 0,
+                        headers: {}
+                      });
+                    },
+                    non200Response: function(serverResponse) {
+                      return proceed(undefined, serverResponse);
+                    },
+                    success: function (serverResponse){
+
+                      // If there is no response body (i.e. `body` is `""`),
+                      // then we'll interpret that as `null` and return that as
+                      // our response data.
+                      if (serverResponse.body === '') {
+                        serverResponse.body = null;
+                      }
+
+                      // --•
+                      // Otherwise, attempt to parse the response body as JSON.
+                      try {
+                        serverResponse.body = JSON.parse(serverResponse.body);
+                      } catch (err) {//eslint-disable-line no-unused-vars
+                        // If the raw response body string cannot be parsed as JSON,
+                        // then interpret it as a string by leaving the raw body as-is.
+                      }
+
+                      return proceed(undefined, serverResponse);
+                    }
+                  });//_∏_
+                })();//</self-calling function :: _doAjaxWithMpHttp>
+
+                default:
+                  throw new Error('Consistency violation: Unexpected protocol name received (`'+requestInfo.protocolName+'`)-- but it should have already been checked!');
+
+              }//</switch(protocol)>
+            })(function afterwards(err, responseInfo){
+              if (err) {
+                throw new Error('Consistency violation: Unexpected error in CloudSDK. Details: '+err.stack);
+              }
+
+
+              // Note that the response info dictionary is intended to be
+              // a transport-agnostic way of representing a server response.
+              // (similar to jQuery AJAX response objects / jqXHR / jwRes):
+
+              // --------------------------------------------------------------------
+              // AVAILABLE AT THIS POINT:
+              // • responseInfo.statusCode
+              // • responseInfo.body
+              // • responseInfo.headers
+              // --------------------------------------------------------------------
+              // ATTACHED BELOW:
+              // • responseInfo.data        << for compatibility
+              // • responseInfo.exit        << either `success`, `error`, or the code name of some other exit.
+              // • responseInfo.code        << (alias for "exit")
+              // --------------------------------------------------------------------
+
+              // To get exit info:
+              // console.log(responseInfo.headers['X-Exit']);
+              // console.log(responseInfo.headers['X-Exit-FriendlyName']);
+              // console.log(responseInfo.headers['X-Exit-Description']);
+              // console.log(responseInfo.headers['X-Exit-Extended-Description']);
+              // console.log(responseInfo.headers['X-Exit-Output-Friendly-Name']);
+              // console.log(responseInfo.headers['X-Exit-Output-Description']);
+
+
+
+              // COMPATIBILITY:
+              // Stick `data` property on responseInfo so it feels familiar
+              // e.g. like `res.data` in angular 1
+              // (This is mainly for backwards compatibility, and can probably
+              // be removed at some point.)
+              if (!_.isUndefined(responseInfo.body)) {
+                responseInfo.data = responseInfo.body;
+              }
+
+              // Determine the appropriate callback to call.
+              //
+              // We also stick on `exit` property for convenience
+              // by sniffing the X-Exit header.  We default to `error`
+              // or `success`, depending on whether an Error instance
+              // was passed through as the `error` property.
+              var xExitResponseHeaderValue = responseInfo.headers['x-exit'] || responseInfo.headers['X-Exit'];
+              // ^This "either-or-ing" is likely necessary because of different jQuery versions.
+
+              if (xExitResponseHeaderValue === '_offline') {
+                console.warn('Unconventional exit detected:  `_offline` is a reserved exit name for use on the front-end, and should not be used willy nilly.  Instead, please come up with a different exit name for this scenario.');
+              }//fi
+
+
+              // If the user's computer is offline or the server is down, etc...
+              // > If `statusCode` is 0, then the user is probably offline.
+              // > Or maybe our server is down omg.
+              // > Or it could be that a cross-origin request was blocked.
+              if (responseInfo.statusCode === 0) {
+                responseInfo.exit = '_offline';
+                // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+                // FUTURE: Instead of "_offline", support more granular/accurate
+                // built-in exits like:
+                // • '_failedCrossOriginRequest'
+                // • '_serverDown'
+                // • '_clientOffline'
+                //
+                // ^^In the future, if we want to get really fancy,
+                // we could try sending a ping to another CORS-enabled
+                // endpoint to see whether it's us or them.  Not sure
+                // how we'd figure out if it's a failed cross-origin
+                // request though...
+                // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+              }
+              // If the server responded with a specific error...
+              else if (xExitResponseHeaderValue){
+                responseInfo.exit = xExitResponseHeaderValue;
+              }
+              // If the server responded with some other misc. error...
+              else if (responseInfo.statusCode < 200 || responseInfo.statusCode >= 300) {
+                responseInfo.exit = 'error';
+              }
+              // Otherwise, we'll consider it a success!
+              else {
+                responseInfo.exit = 'success';
+              }
+
+              // Set up `code` as alias for `exit`, for consistency.
+              responseInfo.code = responseInfo.exit;
+
+
+
+              // Now before proceeding further, check lifecycleInstructions for a match (if there are any configured).
+              // > NOTE: We only ever run one of these handlers for any given response!
+              var matchingLifecycleInstruction = _.find(requestInfo.lifecycleInstructions, function(lifecycleInstruction) {
+
+                if (lifecycleInstruction.rule === undefined) {
+                  if (responseInfo.exit === 'success' || (responseInfo.statusCode >= 200 && responseInfo.statusCode < 300)) {
+                    return false;
+                  }
+                  else {
+                    return true;
+                  }
+                }
+                else if (responseInfo.statusCode === lifecycleInstruction.rule) {
+                  return true;
+                }
+                else if (responseInfo.exit === lifecycleInstruction.rule) {
+                  return true;
+                }
+                // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+                // FUTURE: add support for bluebird style dictionary rules
+                // (see flaverr.taste at https://npmjs.com/package/flaverr)
+                // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+              });//∞
+
+
+              // If there was a match, then run this intercept/toleration's handler function.
+              (function _runInterceptOrTolerationMaybe(proceed){
+
+                if (!matchingLifecycleInstruction) {
+                  return proceed();
+                }//•
+
+                var resultFromHandler;
+
+                if (matchingLifecycleInstruction.handler.constructor.name === 'AsyncFunction') {
+                  return proceed(new Error('`async` functions are not *yet* fully supported in intercept/tolerate'));
+                  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+                  // FUTURE: add support for this, beginning with something like the
+                  // following incomplete implementation:
+                  //
+                  // ```
+                  // var interceptPromise;
+                  // try {
+                  //   interceptPromise = matchingLifecycleInstruction.handler();
+                  // } catch (err) {
+                  //   if (err === false) { return proceed(undefined, true); }//« special case (`throw false`)
+                  //   else { return proceed(err); }
+                  // }
+                  //
+                  // interceptPromise.then(function(_resultFromHandler){
+                  //   resultFromHandler = _resultFromHandler;
+                  //   proceed(undefined, resultFromHandler);
+                  // });
+                  // interceptPromise.catch(function(err) {
+                  //   /* eslint-disable callback-return */
+                  //   if (err === false) { proceed(undefined, true); }//« special case (`throw false`)
+                  //   else { proceed(err); }
+                  //   /* eslint-enable callback-return */
+                  // });
+                  // ```
+                  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+                }
+                else {
+                  try {
+                    // FUTURE: do this addition of properties earlier:
+                    errorInstance.exit = responseInfo.exit;
+                    errorInstance.code = responseInfo.exit;
+                    errorInstance.responseInfo = responseInfo;
+
+                    resultFromHandler = matchingLifecycleInstruction.handler(errorInstance);
+                  } catch (err) {
+                    if (err === false) { return proceed(undefined, true); }//« special case (`throw false`)
+                    else { return proceed(err); }
+                  }
+
+                  return proceed(undefined, resultFromHandler);
+                }
+
+              })(function(err, resultFromInterceptOrTolerate) {
+
+                if (err) {
+                  throw new Error('The provided custom intercept/tolerate logic threw an unexpected, uncaught error: '+err.stack);
+                  // FUTURE: better error handling for this case ^^
+                }//•
+
+
+                if (matchingLifecycleInstruction) {
+                  if (responseInfo.exit === 'success' || (responseInfo.statusCode >= 200 && responseInfo.statusCode < 300)) {
+                    throw new Error('Unexpected intercept/tolerate logic matched a 2xx/success response, but these methods should only be used for exceptions!');
+                    // FUTURE: better error handling for this case ^^
+                  }
+                }
+
+                // If a matching `.tolerate()` was encountered, then consider this successful no matter what.
+                var tolerateAsIfSuccess = (matchingLifecycleInstruction && matchingLifecycleInstruction.type === 'tolerate');
+
+
+                // If a matching `.intercept()` was encountered, then consider whatever the intercept handler
+                // returned to be our new Error.
+                if (matchingLifecycleInstruction && matchingLifecycleInstruction.type === 'intercept') {
+                  if (!_.isError(resultFromInterceptOrTolerate)) {
+                    throw new Error('Unexpected value returned from .intercept() handler.  Expected an Error instance but instead, got: '+resultFromInterceptOrTolerate);
+                    // FUTURE: better error handling for this case ^^
+                  }
+                  errorInstance = resultFromInterceptOrTolerate;
+                }
+
+
+                // If no custom error callback was specified, but we don't know
+                // how to handle an error below, then we'll simply throw a fatal
+                // error (this can be caught by `window.onerror` et. al. in order
+                // to trigger a fatal error message, e.g. using a devoted user
+                // interface component as a global error bus.)
+                //
+                // This string is used as a prefix for the various error messages
+                // that can occur this way throughout the code below.
+                var UNHANDLED_ERR_PREFIX_MSG =
+                (
+                  (responseInfo.statusCode===0)?
+                  'Unable to send request... are the client and server both online?'
+                  :'Received unhandled '+responseInfo.statusCode+' error from server.'
+                )+'  '+
+                '(See `responseInfo` property of this error for details).  '+
+                'Note that you can negotiate any error using its `exit` or `responseInfo.statusCode` properties.\n'+
+                '--\n';
+
+                //  ┌─┐┌─┐┌┐┌┌─┐┬─┐┬┌─┐   ┌─┐─┐ ┬┌─┐┌─┐  ┌─┐┌─┐┬  ┬  ┌┐ ┌─┐┌─┐┬┌─  ┌─┐┬ ┬┌┐┌┌─┐┌┬┐┬┌─┐┌┐┌
+                //  │ ┬├┤ │││├┤ ├┬┘││     ├┤ ┌┴┬┘├┤ │    │  ├─┤│  │  ├┴┐├─┤│  ├┴┐  ├┤ │ │││││   │ ││ ││││
+                //  └─┘└─┘┘└┘└─┘┴└─┴└─┘  o└─┘┴ └─└─┘└─┘  └─┘┴ ┴┴─┘┴─┘└─┘┴ ┴└─┘┴ ┴  └  └─┘┘└┘└─┘ ┴ ┴└─┘┘└┘
+                // If a generic callback was provided...
+                if (_.isFunction(exitCallbacks)) {
+                  if (tolerateAsIfSuccess) {
+                    return exitCallbacks(undefined, resultFromInterceptOrTolerate, responseInfo);
+                  }
+                  else if (responseInfo.exit === 'success' || (responseInfo.statusCode >= 200 && responseInfo.statusCode < 300)) {
+                    return exitCallbacks(undefined, responseInfo.body, responseInfo);
+                  }
+                  else {
+                    errorInstance.stack += '\n'+
+                    '\n'+
+                    'Error Summary:\n'+
+                    '(see `.responseInfo` for more details)\n'+
+                    '·-------------·----------------------------------------·\n'+
+                    '|    Protocol | '+(requestInfo.protocolName==='jQuery'?'http(s)://   (jQuery)':requestInfo.protocolName==='io.socket'?'ws(s)://   (io.socket)':requestInfo.protocolName)+'\n'+
+                    '|     Address | '+requestInfo.verb.toUpperCase()+' '+requestInfo.url+'\n'+
+                    '|        Exit | '+responseInfo.exit+'\n'+
+                    '| Status Code | '+responseInfo.statusCode+'\n'+
+                    '·-------------·----------------------------------------·';
+                    if (responseInfo.body !== undefined) {
+                      errorInstance.stack += '\n\nResponse Body:\n'+responseInfo.body;
+                    }
+                    errorInstance.responseInfo = responseInfo;
+                    errorInstance.exit = responseInfo.exit;
+                    errorInstance.code = responseInfo.exit;
+                    return exitCallbacks(errorInstance, responseInfo.body!==undefined?responseInfo.body:errorInstance, responseInfo);
+                  }
+                }//‡
+                //  ┌─┐┬ ┬┬┌┬┐┌─┐┬ ┬┌┐ ┌─┐┌─┐┬┌─  ┌┬┐┬┌─┐┌┬┐┬┌─┐┌┐┌┌─┐┬─┐┬ ┬
+                //  └─┐││││ │ │  ├─┤├┴┐├─┤│  ├┴┐   ││││   │ ││ ││││├─┤├┬┘└┬┘
+                //  └─┘└┴┘┴ ┴ └─┘┴ ┴└─┘┴ ┴└─┘┴ ┴  ─┴┘┴└─┘ ┴ ┴└─┘┘└┘┴ ┴┴└─ ┴
+                // If a dictionary of callbacks was provided...
+                else if (_.isObject(exitCallbacks)) {
+
+                  // If this isn't the error exit, and a callback exists for it...
+                  if (responseInfo.exit !== 'error' && exitCallbacks[responseInfo.exit]) {
+
+                    // If there's a response body, pass it to the callback.
+                    if (responseInfo.body !== undefined) {
+                      return exitCallbacks[responseInfo.exit](tolerateAsIfSuccess ? resultFromInterceptOrTolerate : responseInfo.body, responseInfo);
+                    }
+                    // Otherwise, there's no response body.
+                    // So if this is a "success" response, or any 2xx response,
+                    // then don't pass a first arg to the callback.
+                    else if (tolerateAsIfSuccess || responseInfo.exit === 'success' || (responseInfo.statusCode >= 200 && responseInfo.statusCode < 300)) {
+                      return exitCallbacks['success'](tolerateAsIfSuccess ? resultFromInterceptOrTolerate : undefined, responseInfo);
+                    }
+                    // Otherwise, pass an error instance as the first arg of the callback.
+                    else {
+                      errorInstance.stack += '\n'+
+                      '\n'+
+                      'Error Summary:\n'+
+                      '(see `.responseInfo` for more details)\n'+
+                      '·-------------·----------------------------------------·\n'+
+                      '|    Protocol | '+(requestInfo.protocolName==='jQuery'?'http(s)://   (jQuery)':requestInfo.protocolName==='io.socket'?'ws(s)://   (io.socket)':requestInfo.protocolName)+'\n'+
+                      '|     Address | '+requestInfo.verb.toUpperCase()+' '+requestInfo.url+'\n'+
+                      '|        Exit | '+responseInfo.exit+'\n'+
+                      '| Status Code | '+responseInfo.statusCode+'\n'+
+                      '·-------------·----------------------------------------·';
+                      if (responseInfo.body !== undefined) {
+                        errorInstance.stack += '\n\nResponse Body:\n'+responseInfo.body;
+                      }
+                      errorInstance.responseInfo = responseInfo;
+                      errorInstance.exit = responseInfo.exit;
+                      errorInstance.code = responseInfo.exit;
+                      return exitCallbacks[responseInfo.exit](errorInstance, responseInfo);
+                    }
+                  }
+                  // Otherwise, if this is a "success" response, or any 2xx response, then...
+                  else if (tolerateAsIfSuccess || responseInfo.exit === 'success' || (responseInfo.statusCode >= 200 && responseInfo.statusCode < 300)) {
+                    if (exitCallbacks['success']) {
+                      // Either forward to the "success" callback (if there is one)
+                      return exitCallbacks['success'](tolerateAsIfSuccess ? resultFromInterceptOrTolerate : responseInfo.body, responseInfo);
+                    }
+                    else {
+                      // or otherwise do nothing.
+                    }
+                  }
+                  // Otherwise call the error callback.
+                  else if (exitCallbacks['error']) {
+                    errorInstance.stack += '\n'+
+                    '\n'+
+                    'Error Summary:\n'+
+                    '(see `.responseInfo` for more details)\n'+
+                    '·-------------·----------------------------------------·\n'+
+                    '|    Protocol | '+(requestInfo.protocolName==='jQuery'?'http(s)://   (jQuery)':requestInfo.protocolName==='io.socket'?'ws(s)://   (io.socket)':requestInfo.protocolName)+'\n'+
+                    '|     Address | '+requestInfo.verb.toUpperCase()+' '+requestInfo.url+'\n'+
+                    '|        Exit | '+responseInfo.exit+'\n'+
+                    '| Status Code | '+responseInfo.statusCode+'\n'+
+                    '·-------------·----------------------------------------·';
+                    if (responseInfo.body !== undefined) {
+                      errorInstance.stack += '\n\nResponse Body:\n'+responseInfo.body;
+                    }
+                    errorInstance.responseInfo = responseInfo;
+                    errorInstance.exit = responseInfo.exit;
+                    errorInstance.code = responseInfo.code;
+                    return exitCallbacks['error'](errorInstance, responseInfo);
+                  }
+                  // Or if there isn't an error callback, just throw.
+                  else {
+                    errorInstance.stack += '\n'+
+                    '\n'+
+                    'Error Summary:\n'+
+                    '(see `.responseInfo` for more details)\n'+
+                    '·-------------·----------------------------------------·\n'+
+                    '|    Protocol | '+(requestInfo.protocolName==='jQuery'?'http(s)://   (jQuery)':requestInfo.protocolName==='io.socket'?'ws(s)://   (io.socket)':requestInfo.protocolName)+'\n'+
+                    '|     Address | '+requestInfo.verb.toUpperCase()+' '+requestInfo.url+'\n'+
+                    '|        Exit | '+responseInfo.exit+'\n'+
+                    '| Status Code | '+responseInfo.statusCode+'\n'+
+                    '·-------------·----------------------------------------·';
+                    if (responseInfo.body !== undefined) {
+                      errorInstance.stack += '\n\nResponse Body:\n'+responseInfo.body;
+                    }
+                    errorInstance.stack = UNHANDLED_ERR_PREFIX_MSG + errorInstance.stack;
+                    errorInstance.responseInfo = responseInfo;
+                    throw errorInstance;
+                  }
+                }//‡
+                //  ┌┐┌┌─┐  ┌─┐┌─┐┬  ┬  ┌┐ ┌─┐┌─┐┬┌─  ┌─┐┌─┐  ┌─┐┌┐┌┬ ┬  ┬┌─┬┌┐┌┌┬┐
+                //  ││││ │  │  ├─┤│  │  ├┴┐├─┤│  ├┴┐  │ │├┤   ├─┤│││└┬┘  ├┴┐││││ ││
+                //  ┘└┘└─┘  └─┘┴ ┴┴─┘┴─┘└─┘┴ ┴└─┘┴ ┴  └─┘└    ┴ ┴┘└┘ ┴   ┴ ┴┴┘└┘─┴┘
+                // If _no callbacks of any kind_ were provided...
+                else if (_.isUndefined(exitCallbacks)) {
+
+                  // If this was successful, then do nothing.
+                  if (tolerateAsIfSuccess || responseInfo.exit === 'success' || (responseInfo.statusCode >= 200 && responseInfo.statusCode < 300)) {
+                    return;
+                  }
+                  // Otherwise, throw.
+                  else {
+                    errorInstance.stack += '\n'+
+                    '\n'+
+                    'Error Summary:\n'+
+                    '(see `.responseInfo` for more details)\n'+
+                    '·-------------·----------------------------------------·\n'+
+                    '|    Protocol | '+(requestInfo.protocolName==='jQuery'?'http(s)://   (jQuery)':requestInfo.protocolName==='io.socket'?'ws(s)://   (io.socket)':requestInfo.protocolName)+'\n'+
+                    '|     Address | '+requestInfo.verb.toUpperCase()+' '+requestInfo.url+'\n'+
+                    '|        Exit | '+responseInfo.exit+'\n'+
+                    '| Status Code | '+responseInfo.statusCode+'\n'+
+                    '·-------------·----------------------------------------·';
+                    if (responseInfo.body !== undefined) {
+                      errorInstance.stack += '\n\nResponse Body:\n'+responseInfo.body;
+                    }
+                    errorInstance.stack = UNHANDLED_ERR_PREFIX_MSG + errorInstance.stack;
+                    errorInstance.responseInfo = responseInfo;
+                    throw errorInstance;
+                  }
+                }//‡
+                else {
+                  throw new Error('Invalid usage of Cloud.*() method.  Provide either a dictionary of callbacks, a single callback function, or NOTHING to `.exec()`.');
+                }
+
+              });//_∏_  </cb from † _runInterceptOrTolerationMaybe()>
+
+            });//_∏_  </cb from † _makeAjaxCallWithAppropriateProtocol()>
+
+            // --
+            // > Note that we don't return anything at all here.
+            // > (That's to ensure userland code doesn't attempt any further chaining or `await`ing.)
+
+          },//</definition of `.exec()` >
+
+          switch: function (){
+            deferred.exec.apply(deferred, arguments);
+            // --
+            // > Note that we don't return anything at all here.
+            // > (That's to ensure userland code doesn't attempt any further chaining or `await`ing.)
+          },
+
+          // FUTURE: use parley for this instead, if available
+          log: function (){
+
+            console.log('Running with `.log()`...');
+
+            this.exec(function(err, result) {
+              if (err) {
+                console.error();
+                console.error('- - - - - - - - - - - - - - - - - - - - - - - -');
+                console.error('An error occurred:');
+                console.error();
+                console.error(err);
+                console.error('- - - - - - - - - - - - - - - - - - - - - - - -');
+                console.error();
+                return;
+              }//-•
+
+              console.log();
+              if (_.isUndefined(result)) {
+                console.log('- - - - - - - - - - - - - - - - - - - - - - - -');
+                console.log('Finished successfully.');
+                console.log();
+                console.log('(There was no result.)');
+                console.log('- - - - - - - - - - - - - - - - - - - - - - - -');
+              }
+              else {
+                console.log('- - - - - - - - - - - - - - - - - - - - - - - -');
+                console.log('Finished successfully.');
+                console.log();
+                console.log('Result:');
+                console.log();
+                console.log(result);
+                console.log('- - - - - - - - - - - - - - - - - - - - - - - -');
+              }
+              console.log();
+
+            });//_∏_
+
+            // --
+            // > Note that we don't return anything at all here.
+            // > (That's to ensure userland code doesn't attempt any further chaining or `await`ing.)
+          }
+
+        };// </define deferred object>
+
+
+
+        //  ███╗   ███╗███████╗██████╗  ██████╗ ███████╗    ██████╗ ███████╗███████╗ █████╗ ██╗   ██╗██╗  ████████╗███████╗
+        //  ████╗ ████║██╔════╝██╔══██╗██╔════╝ ██╔════╝    ██╔══██╗██╔════╝██╔════╝██╔══██╗██║   ██║██║  ╚══██╔══╝██╔════╝
+        //  ██╔████╔██║█████╗  ██████╔╝██║  ███╗█████╗      ██║  ██║█████╗  █████╗  ███████║██║   ██║██║     ██║   ███████╗
+        //  ██║╚██╔╝██║██╔══╝  ██╔══██╗██║   ██║██╔══╝      ██║  ██║██╔══╝  ██╔══╝  ██╔══██║██║   ██║██║     ██║   ╚════██║
+        //  ██║ ╚═╝ ██║███████╗██║  ██║╚██████╔╝███████╗    ██████╔╝███████╗██║     ██║  ██║╚██████╔╝███████╗██║   ███████║
+        //  ╚═╝     ╚═╝╚══════╝╚═╝  ╚═╝ ╚═════╝ ╚══════╝    ╚═════╝ ╚══════╝╚═╝     ╚═╝  ╚═╝ ╚═════╝ ╚══════╝╚═╝   ╚══════╝
+        //
+        //  ███████╗██████╗  ██████╗ ███╗   ███╗    ███████╗███╗   ██╗██████╗ ██████╗  ██████╗ ██╗███╗   ██╗████████╗
+        //  ██╔════╝██╔══██╗██╔═══██╗████╗ ████║    ██╔════╝████╗  ██║██╔══██╗██╔══██╗██╔═══██╗██║████╗  ██║╚══██╔══╝
+        //  █████╗  ██████╔╝██║   ██║██╔████╔██║    █████╗  ██╔██╗ ██║██║  ██║██████╔╝██║   ██║██║██╔██╗ ██║   ██║
+        //  ██╔══╝  ██╔══██╗██║   ██║██║╚██╔╝██║    ██╔══╝  ██║╚██╗██║██║  ██║██╔═══╝ ██║   ██║██║██║╚██╗██║   ██║
+        //  ██║     ██║  ██║╚██████╔╝██║ ╚═╝ ██║    ███████╗██║ ╚████║██████╔╝██║     ╚██████╔╝██║██║ ╚████║   ██║
+        //  ╚═╝     ╚═╝  ╚═╝ ╚═════╝ ╚═╝     ╚═╝    ╚══════╝╚═╝  ╚═══╝╚═════╝ ╚═╝      ╚═════╝ ╚═╝╚═╝  ╚═══╝   ╚═╝
+        //
+        //  ██████╗ ███████╗███████╗██╗███╗   ██╗██╗████████╗██╗ ██████╗ ███╗   ██╗
+        //  ██╔══██╗██╔════╝██╔════╝██║████╗  ██║██║╚══██╔══╝██║██╔═══██╗████╗  ██║
+        //  ██║  ██║█████╗  █████╗  ██║██╔██╗ ██║██║   ██║   ██║██║   ██║██╔██╗ ██║
+        //  ██║  ██║██╔══╝  ██╔══╝  ██║██║╚██╗██║██║   ██║   ██║██║   ██║██║╚██╗██║
+        //  ██████╔╝███████╗██║     ██║██║ ╚████║██║   ██║   ██║╚██████╔╝██║ ╚████║
+        //  ╚═════╝ ╚══════╝╚═╝     ╚═╝╚═╝  ╚═══╝╚═╝   ╚═╝   ╚═╝ ╚═════╝ ╚═╝  ╚═══╝
+        //
+        // Now set up the endpoint definition.
+        //////////////////////////////////////////////////////////////////////
+
+
+        // If a function was supplied, call it and use the dictionary
+        // it returns as our request info.
+        //////////////////////////////////////////////////////////////////////
+        // e.g. function (argins){
+        //   return {
+        //     verb: 'post',
+        //     url: '/foo/bar',
+        //     params: {
+        //       whatever: 'you want' + ' in here maybe using '+argins.whatever
+        //     },
+        //     headers: {}
+        //   }
+        // }
+        if (typeof appLevelSdkEndpointDef === 'function') {
+          var returnedFromEndpointDefFn = appLevelSdkEndpointDef.apply(this, argins);
+          if (typeof returnedFromEndpointDefFn !== 'object') {
+            throw new Error('Consistency violation: Function for CloudSDK endpoint (`'+methodName+'`) returned an invalid result.  The return value of the specified function is not a dictionary!  If a function is supplied for an endpoint definition, it must return a dictionary containing a `verb` and a `url`.  The returned dictionary may also contain dynamic, per-request header & parameter values.');
+          }
+
+          if (!_.isUndefined(returnedFromEndpointDefFn.headers)) {
+            deferred = deferred.headers(returnedFromEndpointDefFn.headers);
+          }
+          else if (options.headers) {
+            deferred = deferred.headers(options.headers);
+          }
+
+          if (!_.isUndefined(returnedFromEndpointDefFn.protocol)) {
+            deferred = deferred.protocol(returnedFromEndpointDefFn.protocol);
+          }
+          else if (options.protocol) {
+            deferred.protocol(options.protocol);
+          }
+          else { deferred.protocol(DEFAULT_PROTOCOL_NAME); }
+
+          requestInfo.verb = returnedFromEndpointDefFn.verb;
+          requestInfo.url = returnedFromEndpointDefFn.url;
+          requestInfo.params = argins;
+        }
+
+        // If a dictionary was supplied, use that as our request info.
+        //////////////////////////////////////////////////////////////////////
+        // e.g. {
+        //   verb: 'post',
+        //   url: '/foo/bar',
+        //   protocol: 'io.socket',//optional, defaults to 'jQuery'
+        //   headers: {'x-auth': 'foo'},//optional, defaults to undefined
+        // }
+        else if (appLevelSdkEndpointDef && typeof appLevelSdkEndpointDef === 'object') {
+          if (!_.isUndefined(appLevelSdkEndpointDef.headers)) {
+            deferred.headers(appLevelSdkEndpointDef.headers);
+          }
+          else if (options.headers) {
+            deferred = deferred.headers(options.headers);
+          }
+
+          if (!_.isUndefined(appLevelSdkEndpointDef.protocol)) {
+            deferred.protocol(appLevelSdkEndpointDef.protocol);
+          }
+          else if (options.protocol) {
+            deferred.protocol(options.protocol);
+          }
+          else { deferred.protocol(DEFAULT_PROTOCOL_NAME); }
+
+          requestInfo.verb = appLevelSdkEndpointDef.verb;
+          requestInfo.url = appLevelSdkEndpointDef.url;
+          requestInfo.params = argins;
+        }
+
+        // If a string was supplied, expand and use that as our request info.
+        //////////////////////////////////////////////////////////////////////
+        // e.g. "POST /api/v1/lawnmowers/foo/inputs/bar"
+        else if (typeof appLevelSdkEndpointDef === 'string') {
+
+          if (options.headers) {
+            deferred = deferred.headers(options.headers);
+          }
+
+          // Set up default protocol.
+          if (options.protocol) {
+            deferred.protocol(options.protocol);
+          }
+          else { deferred.protocol(DEFAULT_PROTOCOL_NAME); }
+
+          // And then fold in the other pieces of request info.
+          requestInfo.verb = appLevelSdkEndpointDef.replace(/^\s*([^\/\s]+)\s*\/.*$/, '$1');
+          requestInfo.url = appLevelSdkEndpointDef.replace(/^\s*[^\/\s]+\s*\/(.*)$/, '/$1');
+          requestInfo.params = argins;
+        }
+
+        else {
+          throw new Error('Consistency violation: Something happened to CloudSDK endpoint (`'+methodName+'`).  This was not noticed initially when building up CloudSDK endpoints, but this endpoint is now invalid.  Endpoints should be defined as either (1) a string like "GET /foo", (2) a dictionary containing a `verb` and a `url`, or (3) a function that returns a dictionary like that.');
+        }
+
+
+        // Now template in URL pattern vars from the runtime request args.
+        /////////////////////////////////////////////////////////////////////////////
+
+        // Find keys in `params` which are route parameters
+        // (e.g. referenced by the endpoint URL)
+        // > Note that we're not actually interested in the return value
+        // > from this first `.replace()` here.
+        var routeParameters = {};
+        requestInfo.url.replace(/(\:[^\/\:\.\?]+\??)/g, function ($all, $1){
+          var routeParamName = $1.replace(/^\:/, '').replace(/\??$/, '');
+
+          // Optional:
+          if ($1.match(/\?$/)) {
+            if (requestInfo.params && requestInfo.params[routeParamName]) {
+              routeParameters[routeParamName] = requestInfo.params[routeParamName];
+            }
+          }
+          // Mandatory:
+          else {
+            if (!requestInfo.params || requestInfo.params[routeParamName] === undefined) {
+              throw new Error('Missing required param: `'+routeParamName+'`');
+            }
+            routeParameters[routeParamName] = requestInfo.params[routeParamName];
+          }
+        });//∞
+
+        // Then create a shallow copy of `requestInfo.params` without the route path
+        // parameters in it, and reattach that as `requestInfo.params`.
+        // (This prevents accidentally smashing argins and causing unintended
+        // consequences in userland code.)
+        requestInfo.params = _.omit(requestInfo.params, _.keys(routeParameters));
+
+        // Now stick the route parameters into the destination url
+        requestInfo.url = requestInfo.url.replace(/(\:[^\/\:\.\?]+\??)/g, function ($all, $1){
+          var routeParamName = $1.replace(/^\:/, '').replace(/\??$/, '');
+          if (routeParameters[routeParamName] === undefined) { return ''; }
+          return routeParameters[routeParamName];
+        });
+
+
+        // Prepend the API base URL to `requestInfo.url`.
+        /////////////////////////////////////////////////////////////////////////////
+        requestInfo.url = options.apiBaseUrl + requestInfo.url;
+
+
+        // Ensure verb exists, and then lower-case it.
+        /////////////////////////////////////////////////////////////////////////////
+        if (!requestInfo.verb) { throw new Error('CloudSDK endpoint (`'+methodName+'`) is invalid: No HTTP verb specified.  Please specify an HTTP verb (e.g. `GET`, `POST`, etc.)'); }
+        requestInfo.verb = (requestInfo.verb || 'get').toLowerCase();
+
+
+        // Attach the `requestInfo` as a property on the Deferred object itself, for easier integration
+        // with 3rd-party tools (e.g. autocomplete)
+        deferred.requestInfo = requestInfo;
+
+        // Return the deferred object.
+        return deferred;
+
+      };//ƒ  </ _helpCallCloudMethod >
+
+      // Primary definition of this Cloud.* method()
+      memo[methodName] = function () {
+
+        // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+        // FUTURE: If no `args` configured, then check route params (url pattern
+        // variables).  If there are any, attempt to use their names... maybe?
+        // Could actually be MORE confusing though-- needs to be played with.
+        //
+        // UPDATE: OK probably best not to do this actually.
+        // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+        if (!appLevelSdkEndpointDef.args && arguments.length > 0) {
+          throw new Error(
+            'Cannot call this Cloud.*() method with serial usage because Cloud SDK is not aware of the appropriate parameter names!  Please pass in named parameter values using .with({…}) instead--or if you\'re the implementor of the corresponding Sails action, change it on the backend and regenerate the SDK so that this method is configured with an `args` array.\n'+
+            ' [?] If you\'re unsure, visit https://sailsjs.com/support for help.'
+          );
+        }
+
+        // Parse arguments into argins
+        var argins = _.reduce(arguments, function(argins, argin, i){
+
+          if (!(appLevelSdkEndpointDef.args[i])) {
+            throw new Error('Invalid usage with serial arguments: Received unexpected '+(i===0?'first':i===1?'second':i===2?'third':(i+1)+'th')+' argument.');
+          }
+
+          // Reject special notation.
+          // > Remember, if we made it to this point, we know it's valid b/c it's already been checked.
+          if (appLevelSdkEndpointDef.args[i] === '{*}') {
+            if (argin !== undefined && (!_.isObject(argin) || _.isArray(argin) || _.isFunction(argin))) {
+              throw new Error('Invalid usage with serial arguments: If provided, expected '+(i===0?'first':i===1?'second':i===2?'third':(i+1)+'th')+' argument to be a dictionary (plain JavaScript object, like `{}`).  But instead, got: '+argin+'');
+            } else if (argin !== undefined && _.intersection(_.keys(argins), _.keys(argin)).length > 0) {
+              throw new Error('Invalid usage with serial arguments: If provided, expected '+(i===0?'first':i===1?'second':i===2?'third':(i+1)+'th')+' argument to have keys which DO NOT overlap with other already-configured argins!  But in reality, it contained conflicting keys: '+_.intersection(_.keys(argins), _.keys(argin))+'');
+            }
+            _.extend(argins, argin);
+          } else {
+            // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+            // Note: For design considerations & historical context, see:
+            // • https://github.com/node-machine/machine/commit/fa3829fa637a267793be4a7fb573e008581c4656
+            // • https://github.com/node-machine/spec/pull/2/files#diff-eba3c42d87dad8fb42b4080df85facec
+            // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+            // FUTURE: Support declaring variadic usage
+            // https://github.com/node-machine/spec/pull/2/files#diff-eba3c42d87dad8fb42b4080df85facecR58
+            // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+            // FUTURE: Support declaring spread arguments
+            // https://github.com/node-machine/spec/pull/2/files#diff-eba3c42d87dad8fb42b4080df85facecR66
+            // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+            // Otherwise interpret this as the code name of an input
+            argins[appLevelSdkEndpointDef.args[i]] = argin;
+          }
+
+          return argins;
+
+        }, {});//= (∞)
+
+        return _helpCallCloudMethod(argins);
+
+      };//ƒ
+
+      // Escape hatch that always allows using named parameters.
+      memo[methodName].with = function (argins) {
+        return _helpCallCloudMethod(argins);
+      };//ƒ
+
+      return memo;
+    }, {});//</ _.reduce() :: each defined endpoint method >
+
+    // Remove the `.setup()` method, now that it's been called.
+    delete Cloud.setup;
+
+    // Now attach the configured endpoint methods
+    _.extend(Cloud, methods);
+
+    /**
+     * Cloud.on()
+     *
+     * Listen for a particular kind of socket events, and trigger a function
+     * any time one of them is received.
+     *
+     * > This is almost identical to `io.socket.on()`, except that:
+     * > •     Cloud.on()  supports passing in a dictionary in lieu of
+     * >       a function for its second argument.  If provided, this dictionary
+     * >       will be used as a mini-router based around the conventional "verb"
+     * >       property in relevant incoming socket messages.  In addition, if the
+     * >       special, reserved "*" key is registered as a catchall function,
+     * >       it will be used to handle any messages w/ a verb that doesn't match
+     * >       any of the other verbs, or that are missing a "verb" altogether
+     * >       (i.e. to allow for custom error handling-- otherwise, a built-in error
+     * >       is thrown.)  If a socket message arrives with `verb: '*'`, while
+     * >       kinda weird, it is still routed as expected.
+     *
+     * @param  {String} socketEventName
+     * @param  {Function|Dictionary} handleSocketMsg
+     *
+     * @returns {Function}  (the actual handler function that was bound, for potential use later with `Cloud.off()`)
+     */
+    Cloud.on = function(socketEventName, handleSocketMsg) {
+      if (!socketEventName || !_.isString(socketEventName)) { throw new Error('Invalid usage for `Cloud.on()`: Must pass in a valid first argument (a string; the name of the socket event to listen for -- i.e. the variety of incoming WebSocket messages to receive and handle).'); }
+      if (!handleSocketMsg) { throw new Error('Invalid usage for `Cloud.on()`: Must pass in a second argument (the function to run every time this WebSocket event is received).'); }
+
+      if (!io || !io.socket) { throw new Error('Could not bind a cloud event listener with `Cloud.on()`: WebSocket support is not currently available (`io.socket` is not available).  Make sure `sails.io.js` is being injected in a <script> tag!'); }
+
+      var actualHandler;
+      if (_.isObject(handleSocketMsg) && !_.isArray(handleSocketMsg) && !_.isFunction(handleSocketMsg)) {
+        // Further negotiate based on "verb", if configured to do so.
+        actualHandler = function(msg) {
+          var handlerToRun;
+          if (_.contains(_.keys(handleSocketMsg), msg.verb)) {
+            handlerToRun = handleSocketMsg[msg.verb];
+          } else if (handleSocketMsg['*']) {
+            handlerToRun = handleSocketMsg['*'];
+          } else {
+            throw new Error('Unhandled "'+socketEventName+'" cloud event:  Received an incoming WebSocket message with an unrecognized "verb" property: "'+msg.verb+'".  If this was deliberate, register another key in the call to `Cloud.on(\''+socketEventName+'\', {…, '+msg.verb+': (msg)=>{…} })` to recognize this new sub-category of cloud event and handle it accordingly.  Otherwise, if you\'d like to silently ignore messages with other "verb"s (or no "verb" at all), then pass a function in to Cloud.on(), instead of a dictionary -- or register a "*" key as a catchall, and make its function a no-op.');
+          }
+
+          try {
+            handlerToRun(msg);
+          } catch (err) {
+            if (!_.isObject(err)) { throw err; }
+            err.message = 'An uncaught error was thrown while handling an incoming WebSocket message (a "'+socketEventName+'" cloud event).  '+ err.message;
+            throw err;
+          }
+        };//ƒ
+
+      } else if (_.isFunction(handleSocketMsg)) {
+        // Otherwise, just run the handler function.
+        actualHandler = handleSocketMsg;
+      } else {
+        throw new Error('Invalid usage for `Cloud.on()`: Second argument must either be a function (the function to run every time this socket event is received) or a dictionary of functions that will be negotiated and routed to based on the incoming message\'s conventional "verb" property (e.g. `{ "bankWireReceived": (msg)=>{…}, "destroyed": (msg)=>{…}, "*": (msg)=>{…} }`.');
+      }
+
+      io.socket.on(socketEventName, actualHandler);//œ
+
+      return actualHandler;
+    };//</ .on() >
+
+    /**
+     * Cloud.off()
+     *
+     * Stop listening to ANY AND ALL WEBSOCKET MESSAGES of a particular kind; or
+     * to WebSocket messages from a specific handler function.
+     *
+     * > This is almost identical to `io.socket.off()`, except that it ALWAYS
+     * > applies to all future socket messages that arrive under the given event
+     * > name.
+     *
+     * @param  {String} socketEventName
+     * @param  {Function?} specificHandler
+     */
+    Cloud.off = function(socketEventName, specificHandler) {
+      if (!socketEventName || !_.isString(socketEventName)) { throw new Error('Invalid usage for `Cloud.off()`: Must pass in a first argument (a string; the name of the socket event to stop listening for -- i.e. the variety of incoming WebSocket messages to reject and ignore).'); }
+      if (specificHandler !== undefined && !_.isFunction(specificHandler)) { throw new Error('Invalid usage for `Cloud.off()`: If a second argument is provided, it should be a function  (the specific handler you want to stop running every time a matching WebSocket message is received).'); }
+
+      if (!io || !io.socket) { throw new Error('Could not stop listening to cloud events with `Cloud.off()`: WebSocket support is not currently available (`io.socket` is not available).  Make sure `sails.io.js` is being injected in a <script> tag!'); }
+
+      io.socket.off(socketEventName, specificHandler);
+    };//</ .off() >
+
+  };//ƒ   </ .setup() >
+
+  return Cloud;
+
+}, function(global, factory) {
+  var _;
+  var io;
+  var $;
+  var SAILS_LOCALS;
+  var location;
+  var File;
+  var FileList;
+  var FormData;
+
+  // First, handle optional deps that are gleaned from the global state:
+  // > Note: Instead of throwing, we ignore invalid globals.
+  // > (Remember the bug w/ the File global that happened in Socket.io
+  // > back in ~2015!)
+  // =====================================================================
+  if (global.location !== undefined) {
+    if (global.location && typeof global.location === 'object' && (global.location.constructor.name === 'Location' || global.location.constructor.toString() === '[object Location]' || (_.isObject(global.location) && global.location.href))) {
+      location = global.location;
+    }
+  }//fi
+  if (global.File !== undefined) {
+    if (global.File && typeof global.File === 'function' && global.File.name === 'File') {
+      File = global.File;
+    }
+  }//fi
+  if (global.FileList !== undefined) {
+    if (global.FileList && typeof global.FileList === 'function' && global.FileList.name === 'FileList') {
+      FileList = global.FileList;
+    }
+  }//fi
+  if (global.FormData !== undefined) {
+    if (global.FormData && typeof global.FormData === 'function' && global.FormData.name === 'FormData') {
+      FormData = global.FormData;
+    }
+  }//fi
+
+  // Then, load the rest of the deps:
+  // =====================================================================
+
+  //˙°˚°·.
+  //‡CJS  ˚°˚°·˛
+  if (typeof exports === 'object' && typeof module !== 'undefined') {
+    var _require = require;// eslint-disable-line no-undef
+    var _module = module;// eslint-disable-line no-undef
+    // required deps:
+    if (typeof _ === 'undefined') {
+      try {
+        _ = _require('@sailshq/lodash');
+      } catch (e) { if (e.code === 'MODULE_NOT_FOUND') {/* ok */} else { throw e; } }
+    }//fi
+    if (typeof _ === 'undefined') {
+      try {
+        _ = _require('lodash');
+      } catch (e) { if (e.code === 'MODULE_NOT_FOUND') {/* ok */} else { throw e; } }
+    }//fi
+
+    // optional deps:
+    try { $ = _require('jquery'); } catch (e) { if (e.code === 'MODULE_NOT_FOUND') {/* ok */} else { throw e; } }
+    try {
+
+      io = _require('socket.io-client');
+      var sailsIO = _require('sails.io.js');
+
+      // Instantiate the library (and start auto-connecting)
+      io = sailsIO(io);
+
+      // Disable logging
+      io.sails.environment = 'production';
+
+      // Note that, if there is no location global, then after one tick,
+      // if `io.sails.url` has still not been set, weird errors will emerge.
+      // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+      // FUTURE: figure out a way to provide a better err msg about this--
+      // i.e. specifically the case where `.setup()` isn't called within one tick.
+      // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+    } catch (err) {
+      if (err.code === 'MODULE_NOT_FOUND') {
+        // that's ok-- just make sure and unwind any vars that might have
+        // gotten partially set up, since we attempted to require more than
+        // one thing above (and e.g. the second `require()` might have failed)
+        io = undefined;
+      } else {
+        throw err;
+      }
+    }
+
+    SAILS_LOCALS = undefined;
+
+    // export:
+    _module.exports = factory(_, io, $, SAILS_LOCALS, location, File, FileList, FormData);
+  }
+  //˙°˚°·
+  //‡AMD ˚¸
+  else if(typeof define === 'function' && define.amd) {// eslint-disable-line no-undef
+    throw new Error('Global `define()` function detected, but built-in AMD support in `cloud.js` is not currently recommended.  To resolve this, modify `cloud.js`.');
+    // var _define = define;// eslint-disable-line no-undef
+    // _define(['_', 'sails.io.js', '$', 'SAILS_LOCALS', 'location', 'file', …, …], factory);
+  }
+  //˙°˚˙°·
+  //‡NUDE ˚°·˛
+  else {
+    // required deps:
+    if (!global._) { throw new Error('`_` global does not exist on the page yet. (If you\'re using Sails, please check dependency loading order in pipeline.js and make sure the Lodash library is getting brought in before `cloud`.)'); }
+    _ = global._;
+    // optional deps:
+    if (global.io !== undefined) {
+      if (typeof global.io !== 'function') {
+        throw new Error('Could not access `io.socket`: The `io` global is invalid at the moment:' + global.io + '\n(If you\'re using Sails, please check dependency loading order in pipeline.js and make sure the sails.io.js library is getting brought in before `cloud`.)');
+      }
+      else if (typeof global.io.socket === 'undefined') {
+        throw new Error('Could not access `io.socket`: `io` does not have a `socket` property.  Make sure `sails.io.js` is being injected in a <script> tag!');
+      }
+      else {
+        io = global.io;
+      }
+    }//fi
+    if (global.$ !== undefined) {
+      if (typeof global.$ !== 'function') {
+        throw new Error('The `$` global is not valid at the moment:' + global.$ + '\n(If you\'re using Sails, please check dependency loading order in pipeline.js and make sure the jQuery library is getting brought in before `cloud`.)');
+      }
+      else {
+        $ = global.$;
+      }
+    }//fi
+    if (global.SAILS_LOCALS !== undefined) {
+      if (!_.isObject(global.SAILS_LOCALS)) {
+        throw new Error('The `SAILS_LOCALS` global is not valid at the moment:' + global.SAILS_LOCALS + '\n(Please check and make sure you are using `<%- exposeLocalsToBrowser() %>` in your server-side view *before* the rest of your scripts.)');
+      }
+      else {
+        SAILS_LOCALS = global.SAILS_LOCALS;
+      }
+    }//fi
+
+    // export:
+    if (global.Cloud) { throw new Error('Cannot expose global variable: Conflicting global (`cloud`) already exists!'); }
+    global.Cloud = factory(_, io, $, SAILS_LOCALS, location, File, FileList, FormData);
+  }
+});//…)
diff --git a/ee/bulk-operations-dashboard/assets/dependencies/fontawesome.css b/ee/bulk-operations-dashboard/assets/dependencies/fontawesome.css
new file mode 100644
index 0000000000..76b0daa04b
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/dependencies/fontawesome.css
@@ -0,0 +1,2337 @@
+/*!
+ *  Font Awesome 4.7.0 by @davegandy - http://fontawesome.io - @fontawesome
+ *  License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License)
+ */
+/* FONT PATH
+ * -------------------------- */
+@font-face {
+  font-family: 'FontAwesome';
+  src: url('/fonts/fontawesome-webfont.eot?v=4.7.0');
+  src: url('/fonts/fontawesome-webfont.eot?#iefix&v=4.7.0') format('embedded-opentype'), url('/fonts/fontawesome-webfont.woff2?v=4.7.0') format('woff2'), url('/fonts/fontawesome-webfont.woff?v=4.7.0') format('woff'), url('/fonts/fontawesome-webfont.ttf?v=4.7.0') format('truetype'), url('/fonts/fontawesome-webfont.svg?v=4.7.0#fontawesomeregular') format('svg');
+  font-weight: normal;
+  font-style: normal;
+}
+.fa {
+  display: inline-block;
+  font: normal normal normal 14px/1 FontAwesome;
+  font-size: inherit;
+  text-rendering: auto;
+  -webkit-font-smoothing: antialiased;
+  -moz-osx-font-smoothing: grayscale;
+}
+/* makes the font 33% larger relative to the icon container */
+.fa-lg {
+  font-size: 1.33333333em;
+  line-height: 0.75em;
+  vertical-align: -15%;
+}
+.fa-2x {
+  font-size: 2em;
+}
+.fa-3x {
+  font-size: 3em;
+}
+.fa-4x {
+  font-size: 4em;
+}
+.fa-5x {
+  font-size: 5em;
+}
+.fa-fw {
+  width: 1.28571429em;
+  text-align: center;
+}
+.fa-ul {
+  padding-left: 0;
+  margin-left: 2.14285714em;
+  list-style-type: none;
+}
+.fa-ul > li {
+  position: relative;
+}
+.fa-li {
+  position: absolute;
+  left: -2.14285714em;
+  width: 2.14285714em;
+  top: 0.14285714em;
+  text-align: center;
+}
+.fa-li.fa-lg {
+  left: -1.85714286em;
+}
+.fa-border {
+  padding: .2em .25em .15em;
+  border: solid 0.08em #eeeeee;
+  border-radius: .1em;
+}
+.fa-pull-left {
+  float: left;
+}
+.fa-pull-right {
+  float: right;
+}
+.fa.fa-pull-left {
+  margin-right: .3em;
+}
+.fa.fa-pull-right {
+  margin-left: .3em;
+}
+/* Deprecated as of 4.4.0 */
+.pull-right {
+  float: right;
+}
+.pull-left {
+  float: left;
+}
+.fa.pull-left {
+  margin-right: .3em;
+}
+.fa.pull-right {
+  margin-left: .3em;
+}
+.fa-spin {
+  -webkit-animation: fa-spin 2s infinite linear;
+  animation: fa-spin 2s infinite linear;
+}
+.fa-pulse {
+  -webkit-animation: fa-spin 1s infinite steps(8);
+  animation: fa-spin 1s infinite steps(8);
+}
+@-webkit-keyframes fa-spin {
+  0% {
+    -webkit-transform: rotate(0deg);
+    transform: rotate(0deg);
+  }
+  100% {
+    -webkit-transform: rotate(359deg);
+    transform: rotate(359deg);
+  }
+}
+@keyframes fa-spin {
+  0% {
+    -webkit-transform: rotate(0deg);
+    transform: rotate(0deg);
+  }
+  100% {
+    -webkit-transform: rotate(359deg);
+    transform: rotate(359deg);
+  }
+}
+.fa-rotate-90 {
+  -ms-filter: "progid:DXImageTransform.Microsoft.BasicImage(rotation=1)";
+  -webkit-transform: rotate(90deg);
+  -ms-transform: rotate(90deg);
+  transform: rotate(90deg);
+}
+.fa-rotate-180 {
+  -ms-filter: "progid:DXImageTransform.Microsoft.BasicImage(rotation=2)";
+  -webkit-transform: rotate(180deg);
+  -ms-transform: rotate(180deg);
+  transform: rotate(180deg);
+}
+.fa-rotate-270 {
+  -ms-filter: "progid:DXImageTransform.Microsoft.BasicImage(rotation=3)";
+  -webkit-transform: rotate(270deg);
+  -ms-transform: rotate(270deg);
+  transform: rotate(270deg);
+}
+.fa-flip-horizontal {
+  -ms-filter: "progid:DXImageTransform.Microsoft.BasicImage(rotation=0, mirror=1)";
+  -webkit-transform: scale(-1, 1);
+  -ms-transform: scale(-1, 1);
+  transform: scale(-1, 1);
+}
+.fa-flip-vertical {
+  -ms-filter: "progid:DXImageTransform.Microsoft.BasicImage(rotation=2, mirror=1)";
+  -webkit-transform: scale(1, -1);
+  -ms-transform: scale(1, -1);
+  transform: scale(1, -1);
+}
+:root .fa-rotate-90,
+:root .fa-rotate-180,
+:root .fa-rotate-270,
+:root .fa-flip-horizontal,
+:root .fa-flip-vertical {
+  filter: none;
+}
+.fa-stack {
+  position: relative;
+  display: inline-block;
+  width: 2em;
+  height: 2em;
+  line-height: 2em;
+  vertical-align: middle;
+}
+.fa-stack-1x,
+.fa-stack-2x {
+  position: absolute;
+  left: 0;
+  width: 100%;
+  text-align: center;
+}
+.fa-stack-1x {
+  line-height: inherit;
+}
+.fa-stack-2x {
+  font-size: 2em;
+}
+.fa-inverse {
+  color: #ffffff;
+}
+/* Font Awesome uses the Unicode Private Use Area (PUA) to ensure screen
+   readers do not read off random characters that represent icons */
+.fa-glass:before {
+  content: "\f000";
+}
+.fa-music:before {
+  content: "\f001";
+}
+.fa-search:before {
+  content: "\f002";
+}
+.fa-envelope-o:before {
+  content: "\f003";
+}
+.fa-heart:before {
+  content: "\f004";
+}
+.fa-star:before {
+  content: "\f005";
+}
+.fa-star-o:before {
+  content: "\f006";
+}
+.fa-user:before {
+  content: "\f007";
+}
+.fa-film:before {
+  content: "\f008";
+}
+.fa-th-large:before {
+  content: "\f009";
+}
+.fa-th:before {
+  content: "\f00a";
+}
+.fa-th-list:before {
+  content: "\f00b";
+}
+.fa-check:before {
+  content: "\f00c";
+}
+.fa-remove:before,
+.fa-close:before,
+.fa-times:before {
+  content: "\f00d";
+}
+.fa-search-plus:before {
+  content: "\f00e";
+}
+.fa-search-minus:before {
+  content: "\f010";
+}
+.fa-power-off:before {
+  content: "\f011";
+}
+.fa-signal:before {
+  content: "\f012";
+}
+.fa-gear:before,
+.fa-cog:before {
+  content: "\f013";
+}
+.fa-trash-o:before {
+  content: "\f014";
+}
+.fa-home:before {
+  content: "\f015";
+}
+.fa-file-o:before {
+  content: "\f016";
+}
+.fa-clock-o:before {
+  content: "\f017";
+}
+.fa-road:before {
+  content: "\f018";
+}
+.fa-download:before {
+  content: "\f019";
+}
+.fa-arrow-circle-o-down:before {
+  content: "\f01a";
+}
+.fa-arrow-circle-o-up:before {
+  content: "\f01b";
+}
+.fa-inbox:before {
+  content: "\f01c";
+}
+.fa-play-circle-o:before {
+  content: "\f01d";
+}
+.fa-rotate-right:before,
+.fa-repeat:before {
+  content: "\f01e";
+}
+.fa-refresh:before {
+  content: "\f021";
+}
+.fa-list-alt:before {
+  content: "\f022";
+}
+.fa-lock:before {
+  content: "\f023";
+}
+.fa-flag:before {
+  content: "\f024";
+}
+.fa-headphones:before {
+  content: "\f025";
+}
+.fa-volume-off:before {
+  content: "\f026";
+}
+.fa-volume-down:before {
+  content: "\f027";
+}
+.fa-volume-up:before {
+  content: "\f028";
+}
+.fa-qrcode:before {
+  content: "\f029";
+}
+.fa-barcode:before {
+  content: "\f02a";
+}
+.fa-tag:before {
+  content: "\f02b";
+}
+.fa-tags:before {
+  content: "\f02c";
+}
+.fa-book:before {
+  content: "\f02d";
+}
+.fa-bookmark:before {
+  content: "\f02e";
+}
+.fa-print:before {
+  content: "\f02f";
+}
+.fa-camera:before {
+  content: "\f030";
+}
+.fa-font:before {
+  content: "\f031";
+}
+.fa-bold:before {
+  content: "\f032";
+}
+.fa-italic:before {
+  content: "\f033";
+}
+.fa-text-height:before {
+  content: "\f034";
+}
+.fa-text-width:before {
+  content: "\f035";
+}
+.fa-align-left:before {
+  content: "\f036";
+}
+.fa-align-center:before {
+  content: "\f037";
+}
+.fa-align-right:before {
+  content: "\f038";
+}
+.fa-align-justify:before {
+  content: "\f039";
+}
+.fa-list:before {
+  content: "\f03a";
+}
+.fa-dedent:before,
+.fa-outdent:before {
+  content: "\f03b";
+}
+.fa-indent:before {
+  content: "\f03c";
+}
+.fa-video-camera:before {
+  content: "\f03d";
+}
+.fa-photo:before,
+.fa-image:before,
+.fa-picture-o:before {
+  content: "\f03e";
+}
+.fa-pencil:before {
+  content: "\f040";
+}
+.fa-map-marker:before {
+  content: "\f041";
+}
+.fa-adjust:before {
+  content: "\f042";
+}
+.fa-tint:before {
+  content: "\f043";
+}
+.fa-edit:before,
+.fa-pencil-square-o:before {
+  content: "\f044";
+}
+.fa-share-square-o:before {
+  content: "\f045";
+}
+.fa-check-square-o:before {
+  content: "\f046";
+}
+.fa-arrows:before {
+  content: "\f047";
+}
+.fa-step-backward:before {
+  content: "\f048";
+}
+.fa-fast-backward:before {
+  content: "\f049";
+}
+.fa-backward:before {
+  content: "\f04a";
+}
+.fa-play:before {
+  content: "\f04b";
+}
+.fa-pause:before {
+  content: "\f04c";
+}
+.fa-stop:before {
+  content: "\f04d";
+}
+.fa-forward:before {
+  content: "\f04e";
+}
+.fa-fast-forward:before {
+  content: "\f050";
+}
+.fa-step-forward:before {
+  content: "\f051";
+}
+.fa-eject:before {
+  content: "\f052";
+}
+.fa-chevron-left:before {
+  content: "\f053";
+}
+.fa-chevron-right:before {
+  content: "\f054";
+}
+.fa-plus-circle:before {
+  content: "\f055";
+}
+.fa-minus-circle:before {
+  content: "\f056";
+}
+.fa-times-circle:before {
+  content: "\f057";
+}
+.fa-check-circle:before {
+  content: "\f058";
+}
+.fa-question-circle:before {
+  content: "\f059";
+}
+.fa-info-circle:before {
+  content: "\f05a";
+}
+.fa-crosshairs:before {
+  content: "\f05b";
+}
+.fa-times-circle-o:before {
+  content: "\f05c";
+}
+.fa-check-circle-o:before {
+  content: "\f05d";
+}
+.fa-ban:before {
+  content: "\f05e";
+}
+.fa-arrow-left:before {
+  content: "\f060";
+}
+.fa-arrow-right:before {
+  content: "\f061";
+}
+.fa-arrow-up:before {
+  content: "\f062";
+}
+.fa-arrow-down:before {
+  content: "\f063";
+}
+.fa-mail-forward:before,
+.fa-share:before {
+  content: "\f064";
+}
+.fa-expand:before {
+  content: "\f065";
+}
+.fa-compress:before {
+  content: "\f066";
+}
+.fa-plus:before {
+  content: "\f067";
+}
+.fa-minus:before {
+  content: "\f068";
+}
+.fa-asterisk:before {
+  content: "\f069";
+}
+.fa-exclamation-circle:before {
+  content: "\f06a";
+}
+.fa-gift:before {
+  content: "\f06b";
+}
+.fa-leaf:before {
+  content: "\f06c";
+}
+.fa-fire:before {
+  content: "\f06d";
+}
+.fa-eye:before {
+  content: "\f06e";
+}
+.fa-eye-slash:before {
+  content: "\f070";
+}
+.fa-warning:before,
+.fa-exclamation-triangle:before {
+  content: "\f071";
+}
+.fa-plane:before {
+  content: "\f072";
+}
+.fa-calendar:before {
+  content: "\f073";
+}
+.fa-random:before {
+  content: "\f074";
+}
+.fa-comment:before {
+  content: "\f075";
+}
+.fa-magnet:before {
+  content: "\f076";
+}
+.fa-chevron-up:before {
+  content: "\f077";
+}
+.fa-chevron-down:before {
+  content: "\f078";
+}
+.fa-retweet:before {
+  content: "\f079";
+}
+.fa-shopping-cart:before {
+  content: "\f07a";
+}
+.fa-folder:before {
+  content: "\f07b";
+}
+.fa-folder-open:before {
+  content: "\f07c";
+}
+.fa-arrows-v:before {
+  content: "\f07d";
+}
+.fa-arrows-h:before {
+  content: "\f07e";
+}
+.fa-bar-chart-o:before,
+.fa-bar-chart:before {
+  content: "\f080";
+}
+.fa-twitter-square:before {
+  content: "\f081";
+}
+.fa-facebook-square:before {
+  content: "\f082";
+}
+.fa-camera-retro:before {
+  content: "\f083";
+}
+.fa-key:before {
+  content: "\f084";
+}
+.fa-gears:before,
+.fa-cogs:before {
+  content: "\f085";
+}
+.fa-comments:before {
+  content: "\f086";
+}
+.fa-thumbs-o-up:before {
+  content: "\f087";
+}
+.fa-thumbs-o-down:before {
+  content: "\f088";
+}
+.fa-star-half:before {
+  content: "\f089";
+}
+.fa-heart-o:before {
+  content: "\f08a";
+}
+.fa-sign-out:before {
+  content: "\f08b";
+}
+.fa-linkedin-square:before {
+  content: "\f08c";
+}
+.fa-thumb-tack:before {
+  content: "\f08d";
+}
+.fa-external-link:before {
+  content: "\f08e";
+}
+.fa-sign-in:before {
+  content: "\f090";
+}
+.fa-trophy:before {
+  content: "\f091";
+}
+.fa-github-square:before {
+  content: "\f092";
+}
+.fa-upload:before {
+  content: "\f093";
+}
+.fa-lemon-o:before {
+  content: "\f094";
+}
+.fa-phone:before {
+  content: "\f095";
+}
+.fa-square-o:before {
+  content: "\f096";
+}
+.fa-bookmark-o:before {
+  content: "\f097";
+}
+.fa-phone-square:before {
+  content: "\f098";
+}
+.fa-twitter:before {
+  content: "\f099";
+}
+.fa-facebook-f:before,
+.fa-facebook:before {
+  content: "\f09a";
+}
+.fa-github:before {
+  content: "\f09b";
+}
+.fa-unlock:before {
+  content: "\f09c";
+}
+.fa-credit-card:before {
+  content: "\f09d";
+}
+.fa-feed:before,
+.fa-rss:before {
+  content: "\f09e";
+}
+.fa-hdd-o:before {
+  content: "\f0a0";
+}
+.fa-bullhorn:before {
+  content: "\f0a1";
+}
+.fa-bell:before {
+  content: "\f0f3";
+}
+.fa-certificate:before {
+  content: "\f0a3";
+}
+.fa-hand-o-right:before {
+  content: "\f0a4";
+}
+.fa-hand-o-left:before {
+  content: "\f0a5";
+}
+.fa-hand-o-up:before {
+  content: "\f0a6";
+}
+.fa-hand-o-down:before {
+  content: "\f0a7";
+}
+.fa-arrow-circle-left:before {
+  content: "\f0a8";
+}
+.fa-arrow-circle-right:before {
+  content: "\f0a9";
+}
+.fa-arrow-circle-up:before {
+  content: "\f0aa";
+}
+.fa-arrow-circle-down:before {
+  content: "\f0ab";
+}
+.fa-globe:before {
+  content: "\f0ac";
+}
+.fa-wrench:before {
+  content: "\f0ad";
+}
+.fa-tasks:before {
+  content: "\f0ae";
+}
+.fa-filter:before {
+  content: "\f0b0";
+}
+.fa-briefcase:before {
+  content: "\f0b1";
+}
+.fa-arrows-alt:before {
+  content: "\f0b2";
+}
+.fa-group:before,
+.fa-users:before {
+  content: "\f0c0";
+}
+.fa-chain:before,
+.fa-link:before {
+  content: "\f0c1";
+}
+.fa-cloud:before {
+  content: "\f0c2";
+}
+.fa-flask:before {
+  content: "\f0c3";
+}
+.fa-cut:before,
+.fa-scissors:before {
+  content: "\f0c4";
+}
+.fa-copy:before,
+.fa-files-o:before {
+  content: "\f0c5";
+}
+.fa-paperclip:before {
+  content: "\f0c6";
+}
+.fa-save:before,
+.fa-floppy-o:before {
+  content: "\f0c7";
+}
+.fa-square:before {
+  content: "\f0c8";
+}
+.fa-navicon:before,
+.fa-reorder:before,
+.fa-bars:before {
+  content: "\f0c9";
+}
+.fa-list-ul:before {
+  content: "\f0ca";
+}
+.fa-list-ol:before {
+  content: "\f0cb";
+}
+.fa-strikethrough:before {
+  content: "\f0cc";
+}
+.fa-underline:before {
+  content: "\f0cd";
+}
+.fa-table:before {
+  content: "\f0ce";
+}
+.fa-magic:before {
+  content: "\f0d0";
+}
+.fa-truck:before {
+  content: "\f0d1";
+}
+.fa-pinterest:before {
+  content: "\f0d2";
+}
+.fa-pinterest-square:before {
+  content: "\f0d3";
+}
+.fa-google-plus-square:before {
+  content: "\f0d4";
+}
+.fa-google-plus:before {
+  content: "\f0d5";
+}
+.fa-money:before {
+  content: "\f0d6";
+}
+.fa-caret-down:before {
+  content: "\f0d7";
+}
+.fa-caret-up:before {
+  content: "\f0d8";
+}
+.fa-caret-left:before {
+  content: "\f0d9";
+}
+.fa-caret-right:before {
+  content: "\f0da";
+}
+.fa-columns:before {
+  content: "\f0db";
+}
+.fa-unsorted:before,
+.fa-sort:before {
+  content: "\f0dc";
+}
+.fa-sort-down:before,
+.fa-sort-desc:before {
+  content: "\f0dd";
+}
+.fa-sort-up:before,
+.fa-sort-asc:before {
+  content: "\f0de";
+}
+.fa-envelope:before {
+  content: "\f0e0";
+}
+.fa-linkedin:before {
+  content: "\f0e1";
+}
+.fa-rotate-left:before,
+.fa-undo:before {
+  content: "\f0e2";
+}
+.fa-legal:before,
+.fa-gavel:before {
+  content: "\f0e3";
+}
+.fa-dashboard:before,
+.fa-tachometer:before {
+  content: "\f0e4";
+}
+.fa-comment-o:before {
+  content: "\f0e5";
+}
+.fa-comments-o:before {
+  content: "\f0e6";
+}
+.fa-flash:before,
+.fa-bolt:before {
+  content: "\f0e7";
+}
+.fa-sitemap:before {
+  content: "\f0e8";
+}
+.fa-umbrella:before {
+  content: "\f0e9";
+}
+.fa-paste:before,
+.fa-clipboard:before {
+  content: "\f0ea";
+}
+.fa-lightbulb-o:before {
+  content: "\f0eb";
+}
+.fa-exchange:before {
+  content: "\f0ec";
+}
+.fa-cloud-download:before {
+  content: "\f0ed";
+}
+.fa-cloud-upload:before {
+  content: "\f0ee";
+}
+.fa-user-md:before {
+  content: "\f0f0";
+}
+.fa-stethoscope:before {
+  content: "\f0f1";
+}
+.fa-suitcase:before {
+  content: "\f0f2";
+}
+.fa-bell-o:before {
+  content: "\f0a2";
+}
+.fa-coffee:before {
+  content: "\f0f4";
+}
+.fa-cutlery:before {
+  content: "\f0f5";
+}
+.fa-file-text-o:before {
+  content: "\f0f6";
+}
+.fa-building-o:before {
+  content: "\f0f7";
+}
+.fa-hospital-o:before {
+  content: "\f0f8";
+}
+.fa-ambulance:before {
+  content: "\f0f9";
+}
+.fa-medkit:before {
+  content: "\f0fa";
+}
+.fa-fighter-jet:before {
+  content: "\f0fb";
+}
+.fa-beer:before {
+  content: "\f0fc";
+}
+.fa-h-square:before {
+  content: "\f0fd";
+}
+.fa-plus-square:before {
+  content: "\f0fe";
+}
+.fa-angle-double-left:before {
+  content: "\f100";
+}
+.fa-angle-double-right:before {
+  content: "\f101";
+}
+.fa-angle-double-up:before {
+  content: "\f102";
+}
+.fa-angle-double-down:before {
+  content: "\f103";
+}
+.fa-angle-left:before {
+  content: "\f104";
+}
+.fa-angle-right:before {
+  content: "\f105";
+}
+.fa-angle-up:before {
+  content: "\f106";
+}
+.fa-angle-down:before {
+  content: "\f107";
+}
+.fa-desktop:before {
+  content: "\f108";
+}
+.fa-laptop:before {
+  content: "\f109";
+}
+.fa-tablet:before {
+  content: "\f10a";
+}
+.fa-mobile-phone:before,
+.fa-mobile:before {
+  content: "\f10b";
+}
+.fa-circle-o:before {
+  content: "\f10c";
+}
+.fa-quote-left:before {
+  content: "\f10d";
+}
+.fa-quote-right:before {
+  content: "\f10e";
+}
+.fa-spinner:before {
+  content: "\f110";
+}
+.fa-circle:before {
+  content: "\f111";
+}
+.fa-mail-reply:before,
+.fa-reply:before {
+  content: "\f112";
+}
+.fa-github-alt:before {
+  content: "\f113";
+}
+.fa-folder-o:before {
+  content: "\f114";
+}
+.fa-folder-open-o:before {
+  content: "\f115";
+}
+.fa-smile-o:before {
+  content: "\f118";
+}
+.fa-frown-o:before {
+  content: "\f119";
+}
+.fa-meh-o:before {
+  content: "\f11a";
+}
+.fa-gamepad:before {
+  content: "\f11b";
+}
+.fa-keyboard-o:before {
+  content: "\f11c";
+}
+.fa-flag-o:before {
+  content: "\f11d";
+}
+.fa-flag-checkered:before {
+  content: "\f11e";
+}
+.fa-terminal:before {
+  content: "\f120";
+}
+.fa-code:before {
+  content: "\f121";
+}
+.fa-mail-reply-all:before,
+.fa-reply-all:before {
+  content: "\f122";
+}
+.fa-star-half-empty:before,
+.fa-star-half-full:before,
+.fa-star-half-o:before {
+  content: "\f123";
+}
+.fa-location-arrow:before {
+  content: "\f124";
+}
+.fa-crop:before {
+  content: "\f125";
+}
+.fa-code-fork:before {
+  content: "\f126";
+}
+.fa-unlink:before,
+.fa-chain-broken:before {
+  content: "\f127";
+}
+.fa-question:before {
+  content: "\f128";
+}
+.fa-info:before {
+  content: "\f129";
+}
+.fa-exclamation:before {
+  content: "\f12a";
+}
+.fa-superscript:before {
+  content: "\f12b";
+}
+.fa-subscript:before {
+  content: "\f12c";
+}
+.fa-eraser:before {
+  content: "\f12d";
+}
+.fa-puzzle-piece:before {
+  content: "\f12e";
+}
+.fa-microphone:before {
+  content: "\f130";
+}
+.fa-microphone-slash:before {
+  content: "\f131";
+}
+.fa-shield:before {
+  content: "\f132";
+}
+.fa-calendar-o:before {
+  content: "\f133";
+}
+.fa-fire-extinguisher:before {
+  content: "\f134";
+}
+.fa-rocket:before {
+  content: "\f135";
+}
+.fa-maxcdn:before {
+  content: "\f136";
+}
+.fa-chevron-circle-left:before {
+  content: "\f137";
+}
+.fa-chevron-circle-right:before {
+  content: "\f138";
+}
+.fa-chevron-circle-up:before {
+  content: "\f139";
+}
+.fa-chevron-circle-down:before {
+  content: "\f13a";
+}
+.fa-html5:before {
+  content: "\f13b";
+}
+.fa-css3:before {
+  content: "\f13c";
+}
+.fa-anchor:before {
+  content: "\f13d";
+}
+.fa-unlock-alt:before {
+  content: "\f13e";
+}
+.fa-bullseye:before {
+  content: "\f140";
+}
+.fa-ellipsis-h:before {
+  content: "\f141";
+}
+.fa-ellipsis-v:before {
+  content: "\f142";
+}
+.fa-rss-square:before {
+  content: "\f143";
+}
+.fa-play-circle:before {
+  content: "\f144";
+}
+.fa-ticket:before {
+  content: "\f145";
+}
+.fa-minus-square:before {
+  content: "\f146";
+}
+.fa-minus-square-o:before {
+  content: "\f147";
+}
+.fa-level-up:before {
+  content: "\f148";
+}
+.fa-level-down:before {
+  content: "\f149";
+}
+.fa-check-square:before {
+  content: "\f14a";
+}
+.fa-pencil-square:before {
+  content: "\f14b";
+}
+.fa-external-link-square:before {
+  content: "\f14c";
+}
+.fa-share-square:before {
+  content: "\f14d";
+}
+.fa-compass:before {
+  content: "\f14e";
+}
+.fa-toggle-down:before,
+.fa-caret-square-o-down:before {
+  content: "\f150";
+}
+.fa-toggle-up:before,
+.fa-caret-square-o-up:before {
+  content: "\f151";
+}
+.fa-toggle-right:before,
+.fa-caret-square-o-right:before {
+  content: "\f152";
+}
+.fa-euro:before,
+.fa-eur:before {
+  content: "\f153";
+}
+.fa-gbp:before {
+  content: "\f154";
+}
+.fa-dollar:before,
+.fa-usd:before {
+  content: "\f155";
+}
+.fa-rupee:before,
+.fa-inr:before {
+  content: "\f156";
+}
+.fa-cny:before,
+.fa-rmb:before,
+.fa-yen:before,
+.fa-jpy:before {
+  content: "\f157";
+}
+.fa-ruble:before,
+.fa-rouble:before,
+.fa-rub:before {
+  content: "\f158";
+}
+.fa-won:before,
+.fa-krw:before {
+  content: "\f159";
+}
+.fa-bitcoin:before,
+.fa-btc:before {
+  content: "\f15a";
+}
+.fa-file:before {
+  content: "\f15b";
+}
+.fa-file-text:before {
+  content: "\f15c";
+}
+.fa-sort-alpha-asc:before {
+  content: "\f15d";
+}
+.fa-sort-alpha-desc:before {
+  content: "\f15e";
+}
+.fa-sort-amount-asc:before {
+  content: "\f160";
+}
+.fa-sort-amount-desc:before {
+  content: "\f161";
+}
+.fa-sort-numeric-asc:before {
+  content: "\f162";
+}
+.fa-sort-numeric-desc:before {
+  content: "\f163";
+}
+.fa-thumbs-up:before {
+  content: "\f164";
+}
+.fa-thumbs-down:before {
+  content: "\f165";
+}
+.fa-youtube-square:before {
+  content: "\f166";
+}
+.fa-youtube:before {
+  content: "\f167";
+}
+.fa-xing:before {
+  content: "\f168";
+}
+.fa-xing-square:before {
+  content: "\f169";
+}
+.fa-youtube-play:before {
+  content: "\f16a";
+}
+.fa-dropbox:before {
+  content: "\f16b";
+}
+.fa-stack-overflow:before {
+  content: "\f16c";
+}
+.fa-instagram:before {
+  content: "\f16d";
+}
+.fa-flickr:before {
+  content: "\f16e";
+}
+.fa-adn:before {
+  content: "\f170";
+}
+.fa-bitbucket:before {
+  content: "\f171";
+}
+.fa-bitbucket-square:before {
+  content: "\f172";
+}
+.fa-tumblr:before {
+  content: "\f173";
+}
+.fa-tumblr-square:before {
+  content: "\f174";
+}
+.fa-long-arrow-down:before {
+  content: "\f175";
+}
+.fa-long-arrow-up:before {
+  content: "\f176";
+}
+.fa-long-arrow-left:before {
+  content: "\f177";
+}
+.fa-long-arrow-right:before {
+  content: "\f178";
+}
+.fa-apple:before {
+  content: "\f179";
+}
+.fa-windows:before {
+  content: "\f17a";
+}
+.fa-android:before {
+  content: "\f17b";
+}
+.fa-linux:before {
+  content: "\f17c";
+}
+.fa-dribbble:before {
+  content: "\f17d";
+}
+.fa-skype:before {
+  content: "\f17e";
+}
+.fa-foursquare:before {
+  content: "\f180";
+}
+.fa-trello:before {
+  content: "\f181";
+}
+.fa-female:before {
+  content: "\f182";
+}
+.fa-male:before {
+  content: "\f183";
+}
+.fa-gittip:before,
+.fa-gratipay:before {
+  content: "\f184";
+}
+.fa-sun-o:before {
+  content: "\f185";
+}
+.fa-moon-o:before {
+  content: "\f186";
+}
+.fa-archive:before {
+  content: "\f187";
+}
+.fa-bug:before {
+  content: "\f188";
+}
+.fa-vk:before {
+  content: "\f189";
+}
+.fa-weibo:before {
+  content: "\f18a";
+}
+.fa-renren:before {
+  content: "\f18b";
+}
+.fa-pagelines:before {
+  content: "\f18c";
+}
+.fa-stack-exchange:before {
+  content: "\f18d";
+}
+.fa-arrow-circle-o-right:before {
+  content: "\f18e";
+}
+.fa-arrow-circle-o-left:before {
+  content: "\f190";
+}
+.fa-toggle-left:before,
+.fa-caret-square-o-left:before {
+  content: "\f191";
+}
+.fa-dot-circle-o:before {
+  content: "\f192";
+}
+.fa-wheelchair:before {
+  content: "\f193";
+}
+.fa-vimeo-square:before {
+  content: "\f194";
+}
+.fa-turkish-lira:before,
+.fa-try:before {
+  content: "\f195";
+}
+.fa-plus-square-o:before {
+  content: "\f196";
+}
+.fa-space-shuttle:before {
+  content: "\f197";
+}
+.fa-slack:before {
+  content: "\f198";
+}
+.fa-envelope-square:before {
+  content: "\f199";
+}
+.fa-wordpress:before {
+  content: "\f19a";
+}
+.fa-openid:before {
+  content: "\f19b";
+}
+.fa-institution:before,
+.fa-bank:before,
+.fa-university:before {
+  content: "\f19c";
+}
+.fa-mortar-board:before,
+.fa-graduation-cap:before {
+  content: "\f19d";
+}
+.fa-yahoo:before {
+  content: "\f19e";
+}
+.fa-google:before {
+  content: "\f1a0";
+}
+.fa-reddit:before {
+  content: "\f1a1";
+}
+.fa-reddit-square:before {
+  content: "\f1a2";
+}
+.fa-stumbleupon-circle:before {
+  content: "\f1a3";
+}
+.fa-stumbleupon:before {
+  content: "\f1a4";
+}
+.fa-delicious:before {
+  content: "\f1a5";
+}
+.fa-digg:before {
+  content: "\f1a6";
+}
+.fa-pied-piper-pp:before {
+  content: "\f1a7";
+}
+.fa-pied-piper-alt:before {
+  content: "\f1a8";
+}
+.fa-drupal:before {
+  content: "\f1a9";
+}
+.fa-joomla:before {
+  content: "\f1aa";
+}
+.fa-language:before {
+  content: "\f1ab";
+}
+.fa-fax:before {
+  content: "\f1ac";
+}
+.fa-building:before {
+  content: "\f1ad";
+}
+.fa-child:before {
+  content: "\f1ae";
+}
+.fa-paw:before {
+  content: "\f1b0";
+}
+.fa-spoon:before {
+  content: "\f1b1";
+}
+.fa-cube:before {
+  content: "\f1b2";
+}
+.fa-cubes:before {
+  content: "\f1b3";
+}
+.fa-behance:before {
+  content: "\f1b4";
+}
+.fa-behance-square:before {
+  content: "\f1b5";
+}
+.fa-steam:before {
+  content: "\f1b6";
+}
+.fa-steam-square:before {
+  content: "\f1b7";
+}
+.fa-recycle:before {
+  content: "\f1b8";
+}
+.fa-automobile:before,
+.fa-car:before {
+  content: "\f1b9";
+}
+.fa-cab:before,
+.fa-taxi:before {
+  content: "\f1ba";
+}
+.fa-tree:before {
+  content: "\f1bb";
+}
+.fa-spotify:before {
+  content: "\f1bc";
+}
+.fa-deviantart:before {
+  content: "\f1bd";
+}
+.fa-soundcloud:before {
+  content: "\f1be";
+}
+.fa-database:before {
+  content: "\f1c0";
+}
+.fa-file-pdf-o:before {
+  content: "\f1c1";
+}
+.fa-file-word-o:before {
+  content: "\f1c2";
+}
+.fa-file-excel-o:before {
+  content: "\f1c3";
+}
+.fa-file-powerpoint-o:before {
+  content: "\f1c4";
+}
+.fa-file-photo-o:before,
+.fa-file-picture-o:before,
+.fa-file-image-o:before {
+  content: "\f1c5";
+}
+.fa-file-zip-o:before,
+.fa-file-archive-o:before {
+  content: "\f1c6";
+}
+.fa-file-sound-o:before,
+.fa-file-audio-o:before {
+  content: "\f1c7";
+}
+.fa-file-movie-o:before,
+.fa-file-video-o:before {
+  content: "\f1c8";
+}
+.fa-file-code-o:before {
+  content: "\f1c9";
+}
+.fa-vine:before {
+  content: "\f1ca";
+}
+.fa-codepen:before {
+  content: "\f1cb";
+}
+.fa-jsfiddle:before {
+  content: "\f1cc";
+}
+.fa-life-bouy:before,
+.fa-life-buoy:before,
+.fa-life-saver:before,
+.fa-support:before,
+.fa-life-ring:before {
+  content: "\f1cd";
+}
+.fa-circle-o-notch:before {
+  content: "\f1ce";
+}
+.fa-ra:before,
+.fa-resistance:before,
+.fa-rebel:before {
+  content: "\f1d0";
+}
+.fa-ge:before,
+.fa-empire:before {
+  content: "\f1d1";
+}
+.fa-git-square:before {
+  content: "\f1d2";
+}
+.fa-git:before {
+  content: "\f1d3";
+}
+.fa-y-combinator-square:before,
+.fa-yc-square:before,
+.fa-hacker-news:before {
+  content: "\f1d4";
+}
+.fa-tencent-weibo:before {
+  content: "\f1d5";
+}
+.fa-qq:before {
+  content: "\f1d6";
+}
+.fa-wechat:before,
+.fa-weixin:before {
+  content: "\f1d7";
+}
+.fa-send:before,
+.fa-paper-plane:before {
+  content: "\f1d8";
+}
+.fa-send-o:before,
+.fa-paper-plane-o:before {
+  content: "\f1d9";
+}
+.fa-history:before {
+  content: "\f1da";
+}
+.fa-circle-thin:before {
+  content: "\f1db";
+}
+.fa-header:before {
+  content: "\f1dc";
+}
+.fa-paragraph:before {
+  content: "\f1dd";
+}
+.fa-sliders:before {
+  content: "\f1de";
+}
+.fa-share-alt:before {
+  content: "\f1e0";
+}
+.fa-share-alt-square:before {
+  content: "\f1e1";
+}
+.fa-bomb:before {
+  content: "\f1e2";
+}
+.fa-soccer-ball-o:before,
+.fa-futbol-o:before {
+  content: "\f1e3";
+}
+.fa-tty:before {
+  content: "\f1e4";
+}
+.fa-binoculars:before {
+  content: "\f1e5";
+}
+.fa-plug:before {
+  content: "\f1e6";
+}
+.fa-slideshare:before {
+  content: "\f1e7";
+}
+.fa-twitch:before {
+  content: "\f1e8";
+}
+.fa-yelp:before {
+  content: "\f1e9";
+}
+.fa-newspaper-o:before {
+  content: "\f1ea";
+}
+.fa-wifi:before {
+  content: "\f1eb";
+}
+.fa-calculator:before {
+  content: "\f1ec";
+}
+.fa-paypal:before {
+  content: "\f1ed";
+}
+.fa-google-wallet:before {
+  content: "\f1ee";
+}
+.fa-cc-visa:before {
+  content: "\f1f0";
+}
+.fa-cc-mastercard:before {
+  content: "\f1f1";
+}
+.fa-cc-discover:before {
+  content: "\f1f2";
+}
+.fa-cc-amex:before {
+  content: "\f1f3";
+}
+.fa-cc-paypal:before {
+  content: "\f1f4";
+}
+.fa-cc-stripe:before {
+  content: "\f1f5";
+}
+.fa-bell-slash:before {
+  content: "\f1f6";
+}
+.fa-bell-slash-o:before {
+  content: "\f1f7";
+}
+.fa-trash:before {
+  content: "\f1f8";
+}
+.fa-copyright:before {
+  content: "\f1f9";
+}
+.fa-at:before {
+  content: "\f1fa";
+}
+.fa-eyedropper:before {
+  content: "\f1fb";
+}
+.fa-paint-brush:before {
+  content: "\f1fc";
+}
+.fa-birthday-cake:before {
+  content: "\f1fd";
+}
+.fa-area-chart:before {
+  content: "\f1fe";
+}
+.fa-pie-chart:before {
+  content: "\f200";
+}
+.fa-line-chart:before {
+  content: "\f201";
+}
+.fa-lastfm:before {
+  content: "\f202";
+}
+.fa-lastfm-square:before {
+  content: "\f203";
+}
+.fa-toggle-off:before {
+  content: "\f204";
+}
+.fa-toggle-on:before {
+  content: "\f205";
+}
+.fa-bicycle:before {
+  content: "\f206";
+}
+.fa-bus:before {
+  content: "\f207";
+}
+.fa-ioxhost:before {
+  content: "\f208";
+}
+.fa-angellist:before {
+  content: "\f209";
+}
+.fa-cc:before {
+  content: "\f20a";
+}
+.fa-shekel:before,
+.fa-sheqel:before,
+.fa-ils:before {
+  content: "\f20b";
+}
+.fa-meanpath:before {
+  content: "\f20c";
+}
+.fa-buysellads:before {
+  content: "\f20d";
+}
+.fa-connectdevelop:before {
+  content: "\f20e";
+}
+.fa-dashcube:before {
+  content: "\f210";
+}
+.fa-forumbee:before {
+  content: "\f211";
+}
+.fa-leanpub:before {
+  content: "\f212";
+}
+.fa-sellsy:before {
+  content: "\f213";
+}
+.fa-shirtsinbulk:before {
+  content: "\f214";
+}
+.fa-simplybuilt:before {
+  content: "\f215";
+}
+.fa-skyatlas:before {
+  content: "\f216";
+}
+.fa-cart-plus:before {
+  content: "\f217";
+}
+.fa-cart-arrow-down:before {
+  content: "\f218";
+}
+.fa-diamond:before {
+  content: "\f219";
+}
+.fa-ship:before {
+  content: "\f21a";
+}
+.fa-user-secret:before {
+  content: "\f21b";
+}
+.fa-motorcycle:before {
+  content: "\f21c";
+}
+.fa-street-view:before {
+  content: "\f21d";
+}
+.fa-heartbeat:before {
+  content: "\f21e";
+}
+.fa-venus:before {
+  content: "\f221";
+}
+.fa-mars:before {
+  content: "\f222";
+}
+.fa-mercury:before {
+  content: "\f223";
+}
+.fa-intersex:before,
+.fa-transgender:before {
+  content: "\f224";
+}
+.fa-transgender-alt:before {
+  content: "\f225";
+}
+.fa-venus-double:before {
+  content: "\f226";
+}
+.fa-mars-double:before {
+  content: "\f227";
+}
+.fa-venus-mars:before {
+  content: "\f228";
+}
+.fa-mars-stroke:before {
+  content: "\f229";
+}
+.fa-mars-stroke-v:before {
+  content: "\f22a";
+}
+.fa-mars-stroke-h:before {
+  content: "\f22b";
+}
+.fa-neuter:before {
+  content: "\f22c";
+}
+.fa-genderless:before {
+  content: "\f22d";
+}
+.fa-facebook-official:before {
+  content: "\f230";
+}
+.fa-pinterest-p:before {
+  content: "\f231";
+}
+.fa-whatsapp:before {
+  content: "\f232";
+}
+.fa-server:before {
+  content: "\f233";
+}
+.fa-user-plus:before {
+  content: "\f234";
+}
+.fa-user-times:before {
+  content: "\f235";
+}
+.fa-hotel:before,
+.fa-bed:before {
+  content: "\f236";
+}
+.fa-viacoin:before {
+  content: "\f237";
+}
+.fa-train:before {
+  content: "\f238";
+}
+.fa-subway:before {
+  content: "\f239";
+}
+.fa-medium:before {
+  content: "\f23a";
+}
+.fa-yc:before,
+.fa-y-combinator:before {
+  content: "\f23b";
+}
+.fa-optin-monster:before {
+  content: "\f23c";
+}
+.fa-opencart:before {
+  content: "\f23d";
+}
+.fa-expeditedssl:before {
+  content: "\f23e";
+}
+.fa-battery-4:before,
+.fa-battery:before,
+.fa-battery-full:before {
+  content: "\f240";
+}
+.fa-battery-3:before,
+.fa-battery-three-quarters:before {
+  content: "\f241";
+}
+.fa-battery-2:before,
+.fa-battery-half:before {
+  content: "\f242";
+}
+.fa-battery-1:before,
+.fa-battery-quarter:before {
+  content: "\f243";
+}
+.fa-battery-0:before,
+.fa-battery-empty:before {
+  content: "\f244";
+}
+.fa-mouse-pointer:before {
+  content: "\f245";
+}
+.fa-i-cursor:before {
+  content: "\f246";
+}
+.fa-object-group:before {
+  content: "\f247";
+}
+.fa-object-ungroup:before {
+  content: "\f248";
+}
+.fa-sticky-note:before {
+  content: "\f249";
+}
+.fa-sticky-note-o:before {
+  content: "\f24a";
+}
+.fa-cc-jcb:before {
+  content: "\f24b";
+}
+.fa-cc-diners-club:before {
+  content: "\f24c";
+}
+.fa-clone:before {
+  content: "\f24d";
+}
+.fa-balance-scale:before {
+  content: "\f24e";
+}
+.fa-hourglass-o:before {
+  content: "\f250";
+}
+.fa-hourglass-1:before,
+.fa-hourglass-start:before {
+  content: "\f251";
+}
+.fa-hourglass-2:before,
+.fa-hourglass-half:before {
+  content: "\f252";
+}
+.fa-hourglass-3:before,
+.fa-hourglass-end:before {
+  content: "\f253";
+}
+.fa-hourglass:before {
+  content: "\f254";
+}
+.fa-hand-grab-o:before,
+.fa-hand-rock-o:before {
+  content: "\f255";
+}
+.fa-hand-stop-o:before,
+.fa-hand-paper-o:before {
+  content: "\f256";
+}
+.fa-hand-scissors-o:before {
+  content: "\f257";
+}
+.fa-hand-lizard-o:before {
+  content: "\f258";
+}
+.fa-hand-spock-o:before {
+  content: "\f259";
+}
+.fa-hand-pointer-o:before {
+  content: "\f25a";
+}
+.fa-hand-peace-o:before {
+  content: "\f25b";
+}
+.fa-trademark:before {
+  content: "\f25c";
+}
+.fa-registered:before {
+  content: "\f25d";
+}
+.fa-creative-commons:before {
+  content: "\f25e";
+}
+.fa-gg:before {
+  content: "\f260";
+}
+.fa-gg-circle:before {
+  content: "\f261";
+}
+.fa-tripadvisor:before {
+  content: "\f262";
+}
+.fa-odnoklassniki:before {
+  content: "\f263";
+}
+.fa-odnoklassniki-square:before {
+  content: "\f264";
+}
+.fa-get-pocket:before {
+  content: "\f265";
+}
+.fa-wikipedia-w:before {
+  content: "\f266";
+}
+.fa-safari:before {
+  content: "\f267";
+}
+.fa-chrome:before {
+  content: "\f268";
+}
+.fa-firefox:before {
+  content: "\f269";
+}
+.fa-opera:before {
+  content: "\f26a";
+}
+.fa-internet-explorer:before {
+  content: "\f26b";
+}
+.fa-tv:before,
+.fa-television:before {
+  content: "\f26c";
+}
+.fa-contao:before {
+  content: "\f26d";
+}
+.fa-500px:before {
+  content: "\f26e";
+}
+.fa-amazon:before {
+  content: "\f270";
+}
+.fa-calendar-plus-o:before {
+  content: "\f271";
+}
+.fa-calendar-minus-o:before {
+  content: "\f272";
+}
+.fa-calendar-times-o:before {
+  content: "\f273";
+}
+.fa-calendar-check-o:before {
+  content: "\f274";
+}
+.fa-industry:before {
+  content: "\f275";
+}
+.fa-map-pin:before {
+  content: "\f276";
+}
+.fa-map-signs:before {
+  content: "\f277";
+}
+.fa-map-o:before {
+  content: "\f278";
+}
+.fa-map:before {
+  content: "\f279";
+}
+.fa-commenting:before {
+  content: "\f27a";
+}
+.fa-commenting-o:before {
+  content: "\f27b";
+}
+.fa-houzz:before {
+  content: "\f27c";
+}
+.fa-vimeo:before {
+  content: "\f27d";
+}
+.fa-black-tie:before {
+  content: "\f27e";
+}
+.fa-fonticons:before {
+  content: "\f280";
+}
+.fa-reddit-alien:before {
+  content: "\f281";
+}
+.fa-edge:before {
+  content: "\f282";
+}
+.fa-credit-card-alt:before {
+  content: "\f283";
+}
+.fa-codiepie:before {
+  content: "\f284";
+}
+.fa-modx:before {
+  content: "\f285";
+}
+.fa-fort-awesome:before {
+  content: "\f286";
+}
+.fa-usb:before {
+  content: "\f287";
+}
+.fa-product-hunt:before {
+  content: "\f288";
+}
+.fa-mixcloud:before {
+  content: "\f289";
+}
+.fa-scribd:before {
+  content: "\f28a";
+}
+.fa-pause-circle:before {
+  content: "\f28b";
+}
+.fa-pause-circle-o:before {
+  content: "\f28c";
+}
+.fa-stop-circle:before {
+  content: "\f28d";
+}
+.fa-stop-circle-o:before {
+  content: "\f28e";
+}
+.fa-shopping-bag:before {
+  content: "\f290";
+}
+.fa-shopping-basket:before {
+  content: "\f291";
+}
+.fa-hashtag:before {
+  content: "\f292";
+}
+.fa-bluetooth:before {
+  content: "\f293";
+}
+.fa-bluetooth-b:before {
+  content: "\f294";
+}
+.fa-percent:before {
+  content: "\f295";
+}
+.fa-gitlab:before {
+  content: "\f296";
+}
+.fa-wpbeginner:before {
+  content: "\f297";
+}
+.fa-wpforms:before {
+  content: "\f298";
+}
+.fa-envira:before {
+  content: "\f299";
+}
+.fa-universal-access:before {
+  content: "\f29a";
+}
+.fa-wheelchair-alt:before {
+  content: "\f29b";
+}
+.fa-question-circle-o:before {
+  content: "\f29c";
+}
+.fa-blind:before {
+  content: "\f29d";
+}
+.fa-audio-description:before {
+  content: "\f29e";
+}
+.fa-volume-control-phone:before {
+  content: "\f2a0";
+}
+.fa-braille:before {
+  content: "\f2a1";
+}
+.fa-assistive-listening-systems:before {
+  content: "\f2a2";
+}
+.fa-asl-interpreting:before,
+.fa-american-sign-language-interpreting:before {
+  content: "\f2a3";
+}
+.fa-deafness:before,
+.fa-hard-of-hearing:before,
+.fa-deaf:before {
+  content: "\f2a4";
+}
+.fa-glide:before {
+  content: "\f2a5";
+}
+.fa-glide-g:before {
+  content: "\f2a6";
+}
+.fa-signing:before,
+.fa-sign-language:before {
+  content: "\f2a7";
+}
+.fa-low-vision:before {
+  content: "\f2a8";
+}
+.fa-viadeo:before {
+  content: "\f2a9";
+}
+.fa-viadeo-square:before {
+  content: "\f2aa";
+}
+.fa-snapchat:before {
+  content: "\f2ab";
+}
+.fa-snapchat-ghost:before {
+  content: "\f2ac";
+}
+.fa-snapchat-square:before {
+  content: "\f2ad";
+}
+.fa-pied-piper:before {
+  content: "\f2ae";
+}
+.fa-first-order:before {
+  content: "\f2b0";
+}
+.fa-yoast:before {
+  content: "\f2b1";
+}
+.fa-themeisle:before {
+  content: "\f2b2";
+}
+.fa-google-plus-circle:before,
+.fa-google-plus-official:before {
+  content: "\f2b3";
+}
+.fa-fa:before,
+.fa-font-awesome:before {
+  content: "\f2b4";
+}
+.fa-handshake-o:before {
+  content: "\f2b5";
+}
+.fa-envelope-open:before {
+  content: "\f2b6";
+}
+.fa-envelope-open-o:before {
+  content: "\f2b7";
+}
+.fa-linode:before {
+  content: "\f2b8";
+}
+.fa-address-book:before {
+  content: "\f2b9";
+}
+.fa-address-book-o:before {
+  content: "\f2ba";
+}
+.fa-vcard:before,
+.fa-address-card:before {
+  content: "\f2bb";
+}
+.fa-vcard-o:before,
+.fa-address-card-o:before {
+  content: "\f2bc";
+}
+.fa-user-circle:before {
+  content: "\f2bd";
+}
+.fa-user-circle-o:before {
+  content: "\f2be";
+}
+.fa-user-o:before {
+  content: "\f2c0";
+}
+.fa-id-badge:before {
+  content: "\f2c1";
+}
+.fa-drivers-license:before,
+.fa-id-card:before {
+  content: "\f2c2";
+}
+.fa-drivers-license-o:before,
+.fa-id-card-o:before {
+  content: "\f2c3";
+}
+.fa-quora:before {
+  content: "\f2c4";
+}
+.fa-free-code-camp:before {
+  content: "\f2c5";
+}
+.fa-telegram:before {
+  content: "\f2c6";
+}
+.fa-thermometer-4:before,
+.fa-thermometer:before,
+.fa-thermometer-full:before {
+  content: "\f2c7";
+}
+.fa-thermometer-3:before,
+.fa-thermometer-three-quarters:before {
+  content: "\f2c8";
+}
+.fa-thermometer-2:before,
+.fa-thermometer-half:before {
+  content: "\f2c9";
+}
+.fa-thermometer-1:before,
+.fa-thermometer-quarter:before {
+  content: "\f2ca";
+}
+.fa-thermometer-0:before,
+.fa-thermometer-empty:before {
+  content: "\f2cb";
+}
+.fa-shower:before {
+  content: "\f2cc";
+}
+.fa-bathtub:before,
+.fa-s15:before,
+.fa-bath:before {
+  content: "\f2cd";
+}
+.fa-podcast:before {
+  content: "\f2ce";
+}
+.fa-window-maximize:before {
+  content: "\f2d0";
+}
+.fa-window-minimize:before {
+  content: "\f2d1";
+}
+.fa-window-restore:before {
+  content: "\f2d2";
+}
+.fa-times-rectangle:before,
+.fa-window-close:before {
+  content: "\f2d3";
+}
+.fa-times-rectangle-o:before,
+.fa-window-close-o:before {
+  content: "\f2d4";
+}
+.fa-bandcamp:before {
+  content: "\f2d5";
+}
+.fa-grav:before {
+  content: "\f2d6";
+}
+.fa-etsy:before {
+  content: "\f2d7";
+}
+.fa-imdb:before {
+  content: "\f2d8";
+}
+.fa-ravelry:before {
+  content: "\f2d9";
+}
+.fa-eercast:before {
+  content: "\f2da";
+}
+.fa-microchip:before {
+  content: "\f2db";
+}
+.fa-snowflake-o:before {
+  content: "\f2dc";
+}
+.fa-superpowers:before {
+  content: "\f2dd";
+}
+.fa-wpexplorer:before {
+  content: "\f2de";
+}
+.fa-meetup:before {
+  content: "\f2e0";
+}
+.sr-only {
+  position: absolute;
+  width: 1px;
+  height: 1px;
+  padding: 0;
+  margin: -1px;
+  overflow: hidden;
+  clip: rect(0, 0, 0, 0);
+  border: 0;
+}
+.sr-only-focusable:active,
+.sr-only-focusable:focus {
+  position: static;
+  width: auto;
+  height: auto;
+  margin: 0;
+  overflow: visible;
+  clip: auto;
+}
diff --git a/ee/bulk-operations-dashboard/assets/dependencies/jquery.min.js b/ee/bulk-operations-dashboard/assets/dependencies/jquery.min.js
new file mode 100644
index 0000000000..644d35e274
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/dependencies/jquery.min.js
@@ -0,0 +1,4 @@
+/*! jQuery v3.2.1 | (c) JS Foundation and other contributors | jquery.org/license */
+!function(a,b){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){"use strict";var c=[],d=a.document,e=Object.getPrototypeOf,f=c.slice,g=c.concat,h=c.push,i=c.indexOf,j={},k=j.toString,l=j.hasOwnProperty,m=l.toString,n=m.call(Object),o={};function p(a,b){b=b||d;var c=b.createElement("script");c.text=a,b.head.appendChild(c).parentNode.removeChild(c)}var q="3.2.1",r=function(a,b){return new r.fn.init(a,b)},s=/^[\s\uFEFF\xA0]+|[\s\uFEFF\xA0]+$/g,t=/^-ms-/,u=/-([a-z])/g,v=function(a,b){return b.toUpperCase()};r.fn=r.prototype={jquery:q,constructor:r,length:0,toArray:function(){return f.call(this)},get:function(a){return null==a?f.call(this):a<0?this[a+this.length]:this[a]},pushStack:function(a){var b=r.merge(this.constructor(),a);return b.prevObject=this,b},each:function(a){return r.each(this,a)},map:function(a){return this.pushStack(r.map(this,function(b,c){return a.call(b,c,b)}))},slice:function(){return this.pushStack(f.apply(this,arguments))},first:function(){return this.eq(0)},last:function(){return this.eq(-1)},eq:function(a){var b=this.length,c=+a+(a<0?b:0);return this.pushStack(c>=0&&c<b?[this[c]]:[])},end:function(){return this.prevObject||this.constructor()},push:h,sort:c.sort,splice:c.splice},r.extend=r.fn.extend=function(){var a,b,c,d,e,f,g=arguments[0]||{},h=1,i=arguments.length,j=!1;for("boolean"==typeof g&&(j=g,g=arguments[h]||{},h++),"object"==typeof g||r.isFunction(g)||(g={}),h===i&&(g=this,h--);h<i;h++)if(null!=(a=arguments[h]))for(b in a)c=g[b],d=a[b],g!==d&&(j&&d&&(r.isPlainObject(d)||(e=Array.isArray(d)))?(e?(e=!1,f=c&&Array.isArray(c)?c:[]):f=c&&r.isPlainObject(c)?c:{},g[b]=r.extend(j,f,d)):void 0!==d&&(g[b]=d));return g},r.extend({expando:"jQuery"+(q+Math.random()).replace(/\D/g,""),isReady:!0,error:function(a){throw new Error(a)},noop:function(){},isFunction:function(a){return"function"===r.type(a)},isWindow:function(a){return null!=a&&a===a.window},isNumeric:function(a){var b=r.type(a);return("number"===b||"string"===b)&&!isNaN(a-parseFloat(a))},isPlainObject:function(a){var b,c;return!(!a||"[object Object]"!==k.call(a))&&(!(b=e(a))||(c=l.call(b,"constructor")&&b.constructor,"function"==typeof c&&m.call(c)===n))},isEmptyObject:function(a){var b;for(b in a)return!1;return!0},type:function(a){return null==a?a+"":"object"==typeof a||"function"==typeof a?j[k.call(a)]||"object":typeof a},globalEval:function(a){p(a)},camelCase:function(a){return a.replace(t,"ms-").replace(u,v)},each:function(a,b){var c,d=0;if(w(a)){for(c=a.length;d<c;d++)if(b.call(a[d],d,a[d])===!1)break}else for(d in a)if(b.call(a[d],d,a[d])===!1)break;return a},trim:function(a){return null==a?"":(a+"").replace(s,"")},makeArray:function(a,b){var c=b||[];return null!=a&&(w(Object(a))?r.merge(c,"string"==typeof a?[a]:a):h.call(c,a)),c},inArray:function(a,b,c){return null==b?-1:i.call(b,a,c)},merge:function(a,b){for(var c=+b.length,d=0,e=a.length;d<c;d++)a[e++]=b[d];return a.length=e,a},grep:function(a,b,c){for(var d,e=[],f=0,g=a.length,h=!c;f<g;f++)d=!b(a[f],f),d!==h&&e.push(a[f]);return e},map:function(a,b,c){var d,e,f=0,h=[];if(w(a))for(d=a.length;f<d;f++)e=b(a[f],f,c),null!=e&&h.push(e);else for(f in a)e=b(a[f],f,c),null!=e&&h.push(e);return g.apply([],h)},guid:1,proxy:function(a,b){var c,d,e;if("string"==typeof b&&(c=a[b],b=a,a=c),r.isFunction(a))return d=f.call(arguments,2),e=function(){return a.apply(b||this,d.concat(f.call(arguments)))},e.guid=a.guid=a.guid||r.guid++,e},now:Date.now,support:o}),"function"==typeof Symbol&&(r.fn[Symbol.iterator]=c[Symbol.iterator]),r.each("Boolean Number String Function Array Date RegExp Object Error Symbol".split(" "),function(a,b){j["[object "+b+"]"]=b.toLowerCase()});function w(a){var b=!!a&&"length"in a&&a.length,c=r.type(a);return"function"!==c&&!r.isWindow(a)&&("array"===c||0===b||"number"==typeof b&&b>0&&b-1 in a)}var x=function(a){var b,c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u="sizzle"+1*new Date,v=a.document,w=0,x=0,y=ha(),z=ha(),A=ha(),B=function(a,b){return a===b&&(l=!0),0},C={}.hasOwnProperty,D=[],E=D.pop,F=D.push,G=D.push,H=D.slice,I=function(a,b){for(var c=0,d=a.length;c<d;c++)if(a[c]===b)return c;return-1},J="checked|selected|async|autofocus|autoplay|controls|defer|disabled|hidden|ismap|loop|multiple|open|readonly|required|scoped",K="[\\x20\\t\\r\\n\\f]",L="(?:\\\\.|[\\w-]|[^\0-\\xa0])+",M="\\["+K+"*("+L+")(?:"+K+"*([*^$|!~]?=)"+K+"*(?:'((?:\\\\.|[^\\\\'])*)'|\"((?:\\\\.|[^\\\\\"])*)\"|("+L+"))|)"+K+"*\\]",N=":("+L+")(?:\\((('((?:\\\\.|[^\\\\'])*)'|\"((?:\\\\.|[^\\\\\"])*)\")|((?:\\\\.|[^\\\\()[\\]]|"+M+")*)|.*)\\)|)",O=new RegExp(K+"+","g"),P=new RegExp("^"+K+"+|((?:^|[^\\\\])(?:\\\\.)*)"+K+"+$","g"),Q=new RegExp("^"+K+"*,"+K+"*"),R=new RegExp("^"+K+"*([>+~]|"+K+")"+K+"*"),S=new RegExp("="+K+"*([^\\]'\"]*?)"+K+"*\\]","g"),T=new RegExp(N),U=new RegExp("^"+L+"$"),V={ID:new RegExp("^#("+L+")"),CLASS:new RegExp("^\\.("+L+")"),TAG:new RegExp("^("+L+"|[*])"),ATTR:new RegExp("^"+M),PSEUDO:new RegExp("^"+N),CHILD:new RegExp("^:(only|first|last|nth|nth-last)-(child|of-type)(?:\\("+K+"*(even|odd|(([+-]|)(\\d*)n|)"+K+"*(?:([+-]|)"+K+"*(\\d+)|))"+K+"*\\)|)","i"),bool:new RegExp("^(?:"+J+")$","i"),needsContext:new RegExp("^"+K+"*[>+~]|:(even|odd|eq|gt|lt|nth|first|last)(?:\\("+K+"*((?:-\\d)?\\d*)"+K+"*\\)|)(?=[^-]|$)","i")},W=/^(?:input|select|textarea|button)$/i,X=/^h\d$/i,Y=/^[^{]+\{\s*\[native \w/,Z=/^(?:#([\w-]+)|(\w+)|\.([\w-]+))$/,$=/[+~]/,_=new RegExp("\\\\([\\da-f]{1,6}"+K+"?|("+K+")|.)","ig"),aa=function(a,b,c){var d="0x"+b-65536;return d!==d||c?b:d<0?String.fromCharCode(d+65536):String.fromCharCode(d>>10|55296,1023&d|56320)},ba=/([\0-\x1f\x7f]|^-?\d)|^-$|[^\0-\x1f\x7f-\uFFFF\w-]/g,ca=function(a,b){return b?"\0"===a?"\ufffd":a.slice(0,-1)+"\\"+a.charCodeAt(a.length-1).toString(16)+" ":"\\"+a},da=function(){m()},ea=ta(function(a){return a.disabled===!0&&("form"in a||"label"in a)},{dir:"parentNode",next:"legend"});try{G.apply(D=H.call(v.childNodes),v.childNodes),D[v.childNodes.length].nodeType}catch(fa){G={apply:D.length?function(a,b){F.apply(a,H.call(b))}:function(a,b){var c=a.length,d=0;while(a[c++]=b[d++]);a.length=c-1}}}function ga(a,b,d,e){var f,h,j,k,l,o,r,s=b&&b.ownerDocument,w=b?b.nodeType:9;if(d=d||[],"string"!=typeof a||!a||1!==w&&9!==w&&11!==w)return d;if(!e&&((b?b.ownerDocument||b:v)!==n&&m(b),b=b||n,p)){if(11!==w&&(l=Z.exec(a)))if(f=l[1]){if(9===w){if(!(j=b.getElementById(f)))return d;if(j.id===f)return d.push(j),d}else if(s&&(j=s.getElementById(f))&&t(b,j)&&j.id===f)return d.push(j),d}else{if(l[2])return G.apply(d,b.getElementsByTagName(a)),d;if((f=l[3])&&c.getElementsByClassName&&b.getElementsByClassName)return G.apply(d,b.getElementsByClassName(f)),d}if(c.qsa&&!A[a+" "]&&(!q||!q.test(a))){if(1!==w)s=b,r=a;else if("object"!==b.nodeName.toLowerCase()){(k=b.getAttribute("id"))?k=k.replace(ba,ca):b.setAttribute("id",k=u),o=g(a),h=o.length;while(h--)o[h]="#"+k+" "+sa(o[h]);r=o.join(","),s=$.test(a)&&qa(b.parentNode)||b}if(r)try{return G.apply(d,s.querySelectorAll(r)),d}catch(x){}finally{k===u&&b.removeAttribute("id")}}}return i(a.replace(P,"$1"),b,d,e)}function ha(){var a=[];function b(c,e){return a.push(c+" ")>d.cacheLength&&delete b[a.shift()],b[c+" "]=e}return b}function ia(a){return a[u]=!0,a}function ja(a){var b=n.createElement("fieldset");try{return!!a(b)}catch(c){return!1}finally{b.parentNode&&b.parentNode.removeChild(b),b=null}}function ka(a,b){var c=a.split("|"),e=c.length;while(e--)d.attrHandle[c[e]]=b}function la(a,b){var c=b&&a,d=c&&1===a.nodeType&&1===b.nodeType&&a.sourceIndex-b.sourceIndex;if(d)return d;if(c)while(c=c.nextSibling)if(c===b)return-1;return a?1:-1}function ma(a){return function(b){var c=b.nodeName.toLowerCase();return"input"===c&&b.type===a}}function na(a){return function(b){var c=b.nodeName.toLowerCase();return("input"===c||"button"===c)&&b.type===a}}function oa(a){return function(b){return"form"in b?b.parentNode&&b.disabled===!1?"label"in b?"label"in b.parentNode?b.parentNode.disabled===a:b.disabled===a:b.isDisabled===a||b.isDisabled!==!a&&ea(b)===a:b.disabled===a:"label"in b&&b.disabled===a}}function pa(a){return ia(function(b){return b=+b,ia(function(c,d){var e,f=a([],c.length,b),g=f.length;while(g--)c[e=f[g]]&&(c[e]=!(d[e]=c[e]))})})}function qa(a){return a&&"undefined"!=typeof a.getElementsByTagName&&a}c=ga.support={},f=ga.isXML=function(a){var b=a&&(a.ownerDocument||a).documentElement;return!!b&&"HTML"!==b.nodeName},m=ga.setDocument=function(a){var b,e,g=a?a.ownerDocument||a:v;return g!==n&&9===g.nodeType&&g.documentElement?(n=g,o=n.documentElement,p=!f(n),v!==n&&(e=n.defaultView)&&e.top!==e&&(e.addEventListener?e.addEventListener("unload",da,!1):e.attachEvent&&e.attachEvent("onunload",da)),c.attributes=ja(function(a){return a.className="i",!a.getAttribute("className")}),c.getElementsByTagName=ja(function(a){return a.appendChild(n.createComment("")),!a.getElementsByTagName("*").length}),c.getElementsByClassName=Y.test(n.getElementsByClassName),c.getById=ja(function(a){return o.appendChild(a).id=u,!n.getElementsByName||!n.getElementsByName(u).length}),c.getById?(d.filter.ID=function(a){var b=a.replace(_,aa);return function(a){return a.getAttribute("id")===b}},d.find.ID=function(a,b){if("undefined"!=typeof b.getElementById&&p){var c=b.getElementById(a);return c?[c]:[]}}):(d.filter.ID=function(a){var b=a.replace(_,aa);return function(a){var c="undefined"!=typeof a.getAttributeNode&&a.getAttributeNode("id");return c&&c.value===b}},d.find.ID=function(a,b){if("undefined"!=typeof b.getElementById&&p){var c,d,e,f=b.getElementById(a);if(f){if(c=f.getAttributeNode("id"),c&&c.value===a)return[f];e=b.getElementsByName(a),d=0;while(f=e[d++])if(c=f.getAttributeNode("id"),c&&c.value===a)return[f]}return[]}}),d.find.TAG=c.getElementsByTagName?function(a,b){return"undefined"!=typeof b.getElementsByTagName?b.getElementsByTagName(a):c.qsa?b.querySelectorAll(a):void 0}:function(a,b){var c,d=[],e=0,f=b.getElementsByTagName(a);if("*"===a){while(c=f[e++])1===c.nodeType&&d.push(c);return d}return f},d.find.CLASS=c.getElementsByClassName&&function(a,b){if("undefined"!=typeof b.getElementsByClassName&&p)return b.getElementsByClassName(a)},r=[],q=[],(c.qsa=Y.test(n.querySelectorAll))&&(ja(function(a){o.appendChild(a).innerHTML="<a id='"+u+"'></a><select id='"+u+"-\r\\' msallowcapture=''><option selected=''></option></select>",a.querySelectorAll("[msallowcapture^='']").length&&q.push("[*^$]="+K+"*(?:''|\"\")"),a.querySelectorAll("[selected]").length||q.push("\\["+K+"*(?:value|"+J+")"),a.querySelectorAll("[id~="+u+"-]").length||q.push("~="),a.querySelectorAll(":checked").length||q.push(":checked"),a.querySelectorAll("a#"+u+"+*").length||q.push(".#.+[+~]")}),ja(function(a){a.innerHTML="<a href='' disabled='disabled'></a><select disabled='disabled'><option/></select>";var b=n.createElement("input");b.setAttribute("type","hidden"),a.appendChild(b).setAttribute("name","D"),a.querySelectorAll("[name=d]").length&&q.push("name"+K+"*[*^$|!~]?="),2!==a.querySelectorAll(":enabled").length&&q.push(":enabled",":disabled"),o.appendChild(a).disabled=!0,2!==a.querySelectorAll(":disabled").length&&q.push(":enabled",":disabled"),a.querySelectorAll("*,:x"),q.push(",.*:")})),(c.matchesSelector=Y.test(s=o.matches||o.webkitMatchesSelector||o.mozMatchesSelector||o.oMatchesSelector||o.msMatchesSelector))&&ja(function(a){c.disconnectedMatch=s.call(a,"*"),s.call(a,"[s!='']:x"),r.push("!=",N)}),q=q.length&&new RegExp(q.join("|")),r=r.length&&new RegExp(r.join("|")),b=Y.test(o.compareDocumentPosition),t=b||Y.test(o.contains)?function(a,b){var c=9===a.nodeType?a.documentElement:a,d=b&&b.parentNode;return a===d||!(!d||1!==d.nodeType||!(c.contains?c.contains(d):a.compareDocumentPosition&&16&a.compareDocumentPosition(d)))}:function(a,b){if(b)while(b=b.parentNode)if(b===a)return!0;return!1},B=b?function(a,b){if(a===b)return l=!0,0;var d=!a.compareDocumentPosition-!b.compareDocumentPosition;return d?d:(d=(a.ownerDocument||a)===(b.ownerDocument||b)?a.compareDocumentPosition(b):1,1&d||!c.sortDetached&&b.compareDocumentPosition(a)===d?a===n||a.ownerDocument===v&&t(v,a)?-1:b===n||b.ownerDocument===v&&t(v,b)?1:k?I(k,a)-I(k,b):0:4&d?-1:1)}:function(a,b){if(a===b)return l=!0,0;var c,d=0,e=a.parentNode,f=b.parentNode,g=[a],h=[b];if(!e||!f)return a===n?-1:b===n?1:e?-1:f?1:k?I(k,a)-I(k,b):0;if(e===f)return la(a,b);c=a;while(c=c.parentNode)g.unshift(c);c=b;while(c=c.parentNode)h.unshift(c);while(g[d]===h[d])d++;return d?la(g[d],h[d]):g[d]===v?-1:h[d]===v?1:0},n):n},ga.matches=function(a,b){return ga(a,null,null,b)},ga.matchesSelector=function(a,b){if((a.ownerDocument||a)!==n&&m(a),b=b.replace(S,"='$1']"),c.matchesSelector&&p&&!A[b+" "]&&(!r||!r.test(b))&&(!q||!q.test(b)))try{var d=s.call(a,b);if(d||c.disconnectedMatch||a.document&&11!==a.document.nodeType)return d}catch(e){}return ga(b,n,null,[a]).length>0},ga.contains=function(a,b){return(a.ownerDocument||a)!==n&&m(a),t(a,b)},ga.attr=function(a,b){(a.ownerDocument||a)!==n&&m(a);var e=d.attrHandle[b.toLowerCase()],f=e&&C.call(d.attrHandle,b.toLowerCase())?e(a,b,!p):void 0;return void 0!==f?f:c.attributes||!p?a.getAttribute(b):(f=a.getAttributeNode(b))&&f.specified?f.value:null},ga.escape=function(a){return(a+"").replace(ba,ca)},ga.error=function(a){throw new Error("Syntax error, unrecognized expression: "+a)},ga.uniqueSort=function(a){var b,d=[],e=0,f=0;if(l=!c.detectDuplicates,k=!c.sortStable&&a.slice(0),a.sort(B),l){while(b=a[f++])b===a[f]&&(e=d.push(f));while(e--)a.splice(d[e],1)}return k=null,a},e=ga.getText=function(a){var b,c="",d=0,f=a.nodeType;if(f){if(1===f||9===f||11===f){if("string"==typeof a.textContent)return a.textContent;for(a=a.firstChild;a;a=a.nextSibling)c+=e(a)}else if(3===f||4===f)return a.nodeValue}else while(b=a[d++])c+=e(b);return c},d=ga.selectors={cacheLength:50,createPseudo:ia,match:V,attrHandle:{},find:{},relative:{">":{dir:"parentNode",first:!0}," ":{dir:"parentNode"},"+":{dir:"previousSibling",first:!0},"~":{dir:"previousSibling"}},preFilter:{ATTR:function(a){return a[1]=a[1].replace(_,aa),a[3]=(a[3]||a[4]||a[5]||"").replace(_,aa),"~="===a[2]&&(a[3]=" "+a[3]+" "),a.slice(0,4)},CHILD:function(a){return a[1]=a[1].toLowerCase(),"nth"===a[1].slice(0,3)?(a[3]||ga.error(a[0]),a[4]=+(a[4]?a[5]+(a[6]||1):2*("even"===a[3]||"odd"===a[3])),a[5]=+(a[7]+a[8]||"odd"===a[3])):a[3]&&ga.error(a[0]),a},PSEUDO:function(a){var b,c=!a[6]&&a[2];return V.CHILD.test(a[0])?null:(a[3]?a[2]=a[4]||a[5]||"":c&&T.test(c)&&(b=g(c,!0))&&(b=c.indexOf(")",c.length-b)-c.length)&&(a[0]=a[0].slice(0,b),a[2]=c.slice(0,b)),a.slice(0,3))}},filter:{TAG:function(a){var b=a.replace(_,aa).toLowerCase();return"*"===a?function(){return!0}:function(a){return a.nodeName&&a.nodeName.toLowerCase()===b}},CLASS:function(a){var b=y[a+" "];return b||(b=new RegExp("(^|"+K+")"+a+"("+K+"|$)"))&&y(a,function(a){return b.test("string"==typeof a.className&&a.className||"undefined"!=typeof a.getAttribute&&a.getAttribute("class")||"")})},ATTR:function(a,b,c){return function(d){var e=ga.attr(d,a);return null==e?"!="===b:!b||(e+="","="===b?e===c:"!="===b?e!==c:"^="===b?c&&0===e.indexOf(c):"*="===b?c&&e.indexOf(c)>-1:"$="===b?c&&e.slice(-c.length)===c:"~="===b?(" "+e.replace(O," ")+" ").indexOf(c)>-1:"|="===b&&(e===c||e.slice(0,c.length+1)===c+"-"))}},CHILD:function(a,b,c,d,e){var f="nth"!==a.slice(0,3),g="last"!==a.slice(-4),h="of-type"===b;return 1===d&&0===e?function(a){return!!a.parentNode}:function(b,c,i){var j,k,l,m,n,o,p=f!==g?"nextSibling":"previousSibling",q=b.parentNode,r=h&&b.nodeName.toLowerCase(),s=!i&&!h,t=!1;if(q){if(f){while(p){m=b;while(m=m[p])if(h?m.nodeName.toLowerCase()===r:1===m.nodeType)return!1;o=p="only"===a&&!o&&"nextSibling"}return!0}if(o=[g?q.firstChild:q.lastChild],g&&s){m=q,l=m[u]||(m[u]={}),k=l[m.uniqueID]||(l[m.uniqueID]={}),j=k[a]||[],n=j[0]===w&&j[1],t=n&&j[2],m=n&&q.childNodes[n];while(m=++n&&m&&m[p]||(t=n=0)||o.pop())if(1===m.nodeType&&++t&&m===b){k[a]=[w,n,t];break}}else if(s&&(m=b,l=m[u]||(m[u]={}),k=l[m.uniqueID]||(l[m.uniqueID]={}),j=k[a]||[],n=j[0]===w&&j[1],t=n),t===!1)while(m=++n&&m&&m[p]||(t=n=0)||o.pop())if((h?m.nodeName.toLowerCase()===r:1===m.nodeType)&&++t&&(s&&(l=m[u]||(m[u]={}),k=l[m.uniqueID]||(l[m.uniqueID]={}),k[a]=[w,t]),m===b))break;return t-=e,t===d||t%d===0&&t/d>=0}}},PSEUDO:function(a,b){var c,e=d.pseudos[a]||d.setFilters[a.toLowerCase()]||ga.error("unsupported pseudo: "+a);return e[u]?e(b):e.length>1?(c=[a,a,"",b],d.setFilters.hasOwnProperty(a.toLowerCase())?ia(function(a,c){var d,f=e(a,b),g=f.length;while(g--)d=I(a,f[g]),a[d]=!(c[d]=f[g])}):function(a){return e(a,0,c)}):e}},pseudos:{not:ia(function(a){var b=[],c=[],d=h(a.replace(P,"$1"));return d[u]?ia(function(a,b,c,e){var f,g=d(a,null,e,[]),h=a.length;while(h--)(f=g[h])&&(a[h]=!(b[h]=f))}):function(a,e,f){return b[0]=a,d(b,null,f,c),b[0]=null,!c.pop()}}),has:ia(function(a){return function(b){return ga(a,b).length>0}}),contains:ia(function(a){return a=a.replace(_,aa),function(b){return(b.textContent||b.innerText||e(b)).indexOf(a)>-1}}),lang:ia(function(a){return U.test(a||"")||ga.error("unsupported lang: "+a),a=a.replace(_,aa).toLowerCase(),function(b){var c;do if(c=p?b.lang:b.getAttribute("xml:lang")||b.getAttribute("lang"))return c=c.toLowerCase(),c===a||0===c.indexOf(a+"-");while((b=b.parentNode)&&1===b.nodeType);return!1}}),target:function(b){var c=a.location&&a.location.hash;return c&&c.slice(1)===b.id},root:function(a){return a===o},focus:function(a){return a===n.activeElement&&(!n.hasFocus||n.hasFocus())&&!!(a.type||a.href||~a.tabIndex)},enabled:oa(!1),disabled:oa(!0),checked:function(a){var b=a.nodeName.toLowerCase();return"input"===b&&!!a.checked||"option"===b&&!!a.selected},selected:function(a){return a.parentNode&&a.parentNode.selectedIndex,a.selected===!0},empty:function(a){for(a=a.firstChild;a;a=a.nextSibling)if(a.nodeType<6)return!1;return!0},parent:function(a){return!d.pseudos.empty(a)},header:function(a){return X.test(a.nodeName)},input:function(a){return W.test(a.nodeName)},button:function(a){var b=a.nodeName.toLowerCase();return"input"===b&&"button"===a.type||"button"===b},text:function(a){var b;return"input"===a.nodeName.toLowerCase()&&"text"===a.type&&(null==(b=a.getAttribute("type"))||"text"===b.toLowerCase())},first:pa(function(){return[0]}),last:pa(function(a,b){return[b-1]}),eq:pa(function(a,b,c){return[c<0?c+b:c]}),even:pa(function(a,b){for(var c=0;c<b;c+=2)a.push(c);return a}),odd:pa(function(a,b){for(var c=1;c<b;c+=2)a.push(c);return a}),lt:pa(function(a,b,c){for(var d=c<0?c+b:c;--d>=0;)a.push(d);return a}),gt:pa(function(a,b,c){for(var d=c<0?c+b:c;++d<b;)a.push(d);return a})}},d.pseudos.nth=d.pseudos.eq;for(b in{radio:!0,checkbox:!0,file:!0,password:!0,image:!0})d.pseudos[b]=ma(b);for(b in{submit:!0,reset:!0})d.pseudos[b]=na(b);function ra(){}ra.prototype=d.filters=d.pseudos,d.setFilters=new ra,g=ga.tokenize=function(a,b){var c,e,f,g,h,i,j,k=z[a+" "];if(k)return b?0:k.slice(0);h=a,i=[],j=d.preFilter;while(h){c&&!(e=Q.exec(h))||(e&&(h=h.slice(e[0].length)||h),i.push(f=[])),c=!1,(e=R.exec(h))&&(c=e.shift(),f.push({value:c,type:e[0].replace(P," ")}),h=h.slice(c.length));for(g in d.filter)!(e=V[g].exec(h))||j[g]&&!(e=j[g](e))||(c=e.shift(),f.push({value:c,type:g,matches:e}),h=h.slice(c.length));if(!c)break}return b?h.length:h?ga.error(a):z(a,i).slice(0)};function sa(a){for(var b=0,c=a.length,d="";b<c;b++)d+=a[b].value;return d}function ta(a,b,c){var d=b.dir,e=b.next,f=e||d,g=c&&"parentNode"===f,h=x++;return b.first?function(b,c,e){while(b=b[d])if(1===b.nodeType||g)return a(b,c,e);return!1}:function(b,c,i){var j,k,l,m=[w,h];if(i){while(b=b[d])if((1===b.nodeType||g)&&a(b,c,i))return!0}else while(b=b[d])if(1===b.nodeType||g)if(l=b[u]||(b[u]={}),k=l[b.uniqueID]||(l[b.uniqueID]={}),e&&e===b.nodeName.toLowerCase())b=b[d]||b;else{if((j=k[f])&&j[0]===w&&j[1]===h)return m[2]=j[2];if(k[f]=m,m[2]=a(b,c,i))return!0}return!1}}function ua(a){return a.length>1?function(b,c,d){var e=a.length;while(e--)if(!a[e](b,c,d))return!1;return!0}:a[0]}function va(a,b,c){for(var d=0,e=b.length;d<e;d++)ga(a,b[d],c);return c}function wa(a,b,c,d,e){for(var f,g=[],h=0,i=a.length,j=null!=b;h<i;h++)(f=a[h])&&(c&&!c(f,d,e)||(g.push(f),j&&b.push(h)));return g}function xa(a,b,c,d,e,f){return d&&!d[u]&&(d=xa(d)),e&&!e[u]&&(e=xa(e,f)),ia(function(f,g,h,i){var j,k,l,m=[],n=[],o=g.length,p=f||va(b||"*",h.nodeType?[h]:h,[]),q=!a||!f&&b?p:wa(p,m,a,h,i),r=c?e||(f?a:o||d)?[]:g:q;if(c&&c(q,r,h,i),d){j=wa(r,n),d(j,[],h,i),k=j.length;while(k--)(l=j[k])&&(r[n[k]]=!(q[n[k]]=l))}if(f){if(e||a){if(e){j=[],k=r.length;while(k--)(l=r[k])&&j.push(q[k]=l);e(null,r=[],j,i)}k=r.length;while(k--)(l=r[k])&&(j=e?I(f,l):m[k])>-1&&(f[j]=!(g[j]=l))}}else r=wa(r===g?r.splice(o,r.length):r),e?e(null,g,r,i):G.apply(g,r)})}function ya(a){for(var b,c,e,f=a.length,g=d.relative[a[0].type],h=g||d.relative[" "],i=g?1:0,k=ta(function(a){return a===b},h,!0),l=ta(function(a){return I(b,a)>-1},h,!0),m=[function(a,c,d){var e=!g&&(d||c!==j)||((b=c).nodeType?k(a,c,d):l(a,c,d));return b=null,e}];i<f;i++)if(c=d.relative[a[i].type])m=[ta(ua(m),c)];else{if(c=d.filter[a[i].type].apply(null,a[i].matches),c[u]){for(e=++i;e<f;e++)if(d.relative[a[e].type])break;return xa(i>1&&ua(m),i>1&&sa(a.slice(0,i-1).concat({value:" "===a[i-2].type?"*":""})).replace(P,"$1"),c,i<e&&ya(a.slice(i,e)),e<f&&ya(a=a.slice(e)),e<f&&sa(a))}m.push(c)}return ua(m)}function za(a,b){var c=b.length>0,e=a.length>0,f=function(f,g,h,i,k){var l,o,q,r=0,s="0",t=f&&[],u=[],v=j,x=f||e&&d.find.TAG("*",k),y=w+=null==v?1:Math.random()||.1,z=x.length;for(k&&(j=g===n||g||k);s!==z&&null!=(l=x[s]);s++){if(e&&l){o=0,g||l.ownerDocument===n||(m(l),h=!p);while(q=a[o++])if(q(l,g||n,h)){i.push(l);break}k&&(w=y)}c&&((l=!q&&l)&&r--,f&&t.push(l))}if(r+=s,c&&s!==r){o=0;while(q=b[o++])q(t,u,g,h);if(f){if(r>0)while(s--)t[s]||u[s]||(u[s]=E.call(i));u=wa(u)}G.apply(i,u),k&&!f&&u.length>0&&r+b.length>1&&ga.uniqueSort(i)}return k&&(w=y,j=v),t};return c?ia(f):f}return h=ga.compile=function(a,b){var c,d=[],e=[],f=A[a+" "];if(!f){b||(b=g(a)),c=b.length;while(c--)f=ya(b[c]),f[u]?d.push(f):e.push(f);f=A(a,za(e,d)),f.selector=a}return f},i=ga.select=function(a,b,c,e){var f,i,j,k,l,m="function"==typeof a&&a,n=!e&&g(a=m.selector||a);if(c=c||[],1===n.length){if(i=n[0]=n[0].slice(0),i.length>2&&"ID"===(j=i[0]).type&&9===b.nodeType&&p&&d.relative[i[1].type]){if(b=(d.find.ID(j.matches[0].replace(_,aa),b)||[])[0],!b)return c;m&&(b=b.parentNode),a=a.slice(i.shift().value.length)}f=V.needsContext.test(a)?0:i.length;while(f--){if(j=i[f],d.relative[k=j.type])break;if((l=d.find[k])&&(e=l(j.matches[0].replace(_,aa),$.test(i[0].type)&&qa(b.parentNode)||b))){if(i.splice(f,1),a=e.length&&sa(i),!a)return G.apply(c,e),c;break}}}return(m||h(a,n))(e,b,!p,c,!b||$.test(a)&&qa(b.parentNode)||b),c},c.sortStable=u.split("").sort(B).join("")===u,c.detectDuplicates=!!l,m(),c.sortDetached=ja(function(a){return 1&a.compareDocumentPosition(n.createElement("fieldset"))}),ja(function(a){return a.innerHTML="<a href='#'></a>","#"===a.firstChild.getAttribute("href")})||ka("type|href|height|width",function(a,b,c){if(!c)return a.getAttribute(b,"type"===b.toLowerCase()?1:2)}),c.attributes&&ja(function(a){return a.innerHTML="<input/>",a.firstChild.setAttribute("value",""),""===a.firstChild.getAttribute("value")})||ka("value",function(a,b,c){if(!c&&"input"===a.nodeName.toLowerCase())return a.defaultValue}),ja(function(a){return null==a.getAttribute("disabled")})||ka(J,function(a,b,c){var d;if(!c)return a[b]===!0?b.toLowerCase():(d=a.getAttributeNode(b))&&d.specified?d.value:null}),ga}(a);r.find=x,r.expr=x.selectors,r.expr[":"]=r.expr.pseudos,r.uniqueSort=r.unique=x.uniqueSort,r.text=x.getText,r.isXMLDoc=x.isXML,r.contains=x.contains,r.escapeSelector=x.escape;var y=function(a,b,c){var d=[],e=void 0!==c;while((a=a[b])&&9!==a.nodeType)if(1===a.nodeType){if(e&&r(a).is(c))break;d.push(a)}return d},z=function(a,b){for(var c=[];a;a=a.nextSibling)1===a.nodeType&&a!==b&&c.push(a);return c},A=r.expr.match.needsContext;function B(a,b){return a.nodeName&&a.nodeName.toLowerCase()===b.toLowerCase()}var C=/^<([a-z][^\/\0>:\x20\t\r\n\f]*)[\x20\t\r\n\f]*\/?>(?:<\/\1>|)$/i,D=/^.[^:#\[\.,]*$/;function E(a,b,c){return r.isFunction(b)?r.grep(a,function(a,d){return!!b.call(a,d,a)!==c}):b.nodeType?r.grep(a,function(a){return a===b!==c}):"string"!=typeof b?r.grep(a,function(a){return i.call(b,a)>-1!==c}):D.test(b)?r.filter(b,a,c):(b=r.filter(b,a),r.grep(a,function(a){return i.call(b,a)>-1!==c&&1===a.nodeType}))}r.filter=function(a,b,c){var d=b[0];return c&&(a=":not("+a+")"),1===b.length&&1===d.nodeType?r.find.matchesSelector(d,a)?[d]:[]:r.find.matches(a,r.grep(b,function(a){return 1===a.nodeType}))},r.fn.extend({find:function(a){var b,c,d=this.length,e=this;if("string"!=typeof a)return this.pushStack(r(a).filter(function(){for(b=0;b<d;b++)if(r.contains(e[b],this))return!0}));for(c=this.pushStack([]),b=0;b<d;b++)r.find(a,e[b],c);return d>1?r.uniqueSort(c):c},filter:function(a){return this.pushStack(E(this,a||[],!1))},not:function(a){return this.pushStack(E(this,a||[],!0))},is:function(a){return!!E(this,"string"==typeof a&&A.test(a)?r(a):a||[],!1).length}});var F,G=/^(?:\s*(<[\w\W]+>)[^>]*|#([\w-]+))$/,H=r.fn.init=function(a,b,c){var e,f;if(!a)return this;if(c=c||F,"string"==typeof a){if(e="<"===a[0]&&">"===a[a.length-1]&&a.length>=3?[null,a,null]:G.exec(a),!e||!e[1]&&b)return!b||b.jquery?(b||c).find(a):this.constructor(b).find(a);if(e[1]){if(b=b instanceof r?b[0]:b,r.merge(this,r.parseHTML(e[1],b&&b.nodeType?b.ownerDocument||b:d,!0)),C.test(e[1])&&r.isPlainObject(b))for(e in b)r.isFunction(this[e])?this[e](b[e]):this.attr(e,b[e]);return this}return f=d.getElementById(e[2]),f&&(this[0]=f,this.length=1),this}return a.nodeType?(this[0]=a,this.length=1,this):r.isFunction(a)?void 0!==c.ready?c.ready(a):a(r):r.makeArray(a,this)};H.prototype=r.fn,F=r(d);var I=/^(?:parents|prev(?:Until|All))/,J={children:!0,contents:!0,next:!0,prev:!0};r.fn.extend({has:function(a){var b=r(a,this),c=b.length;return this.filter(function(){for(var a=0;a<c;a++)if(r.contains(this,b[a]))return!0})},closest:function(a,b){var c,d=0,e=this.length,f=[],g="string"!=typeof a&&r(a);if(!A.test(a))for(;d<e;d++)for(c=this[d];c&&c!==b;c=c.parentNode)if(c.nodeType<11&&(g?g.index(c)>-1:1===c.nodeType&&r.find.matchesSelector(c,a))){f.push(c);break}return this.pushStack(f.length>1?r.uniqueSort(f):f)},index:function(a){return a?"string"==typeof a?i.call(r(a),this[0]):i.call(this,a.jquery?a[0]:a):this[0]&&this[0].parentNode?this.first().prevAll().length:-1},add:function(a,b){return this.pushStack(r.uniqueSort(r.merge(this.get(),r(a,b))))},addBack:function(a){return this.add(null==a?this.prevObject:this.prevObject.filter(a))}});function K(a,b){while((a=a[b])&&1!==a.nodeType);return a}r.each({parent:function(a){var b=a.parentNode;return b&&11!==b.nodeType?b:null},parents:function(a){return y(a,"parentNode")},parentsUntil:function(a,b,c){return y(a,"parentNode",c)},next:function(a){return K(a,"nextSibling")},prev:function(a){return K(a,"previousSibling")},nextAll:function(a){return y(a,"nextSibling")},prevAll:function(a){return y(a,"previousSibling")},nextUntil:function(a,b,c){return y(a,"nextSibling",c)},prevUntil:function(a,b,c){return y(a,"previousSibling",c)},siblings:function(a){return z((a.parentNode||{}).firstChild,a)},children:function(a){return z(a.firstChild)},contents:function(a){return B(a,"iframe")?a.contentDocument:(B(a,"template")&&(a=a.content||a),r.merge([],a.childNodes))}},function(a,b){r.fn[a]=function(c,d){var e=r.map(this,b,c);return"Until"!==a.slice(-5)&&(d=c),d&&"string"==typeof d&&(e=r.filter(d,e)),this.length>1&&(J[a]||r.uniqueSort(e),I.test(a)&&e.reverse()),this.pushStack(e)}});var L=/[^\x20\t\r\n\f]+/g;function M(a){var b={};return r.each(a.match(L)||[],function(a,c){b[c]=!0}),b}r.Callbacks=function(a){a="string"==typeof a?M(a):r.extend({},a);var b,c,d,e,f=[],g=[],h=-1,i=function(){for(e=e||a.once,d=b=!0;g.length;h=-1){c=g.shift();while(++h<f.length)f[h].apply(c[0],c[1])===!1&&a.stopOnFalse&&(h=f.length,c=!1)}a.memory||(c=!1),b=!1,e&&(f=c?[]:"")},j={add:function(){return f&&(c&&!b&&(h=f.length-1,g.push(c)),function d(b){r.each(b,function(b,c){r.isFunction(c)?a.unique&&j.has(c)||f.push(c):c&&c.length&&"string"!==r.type(c)&&d(c)})}(arguments),c&&!b&&i()),this},remove:function(){return r.each(arguments,function(a,b){var c;while((c=r.inArray(b,f,c))>-1)f.splice(c,1),c<=h&&h--}),this},has:function(a){return a?r.inArray(a,f)>-1:f.length>0},empty:function(){return f&&(f=[]),this},disable:function(){return e=g=[],f=c="",this},disabled:function(){return!f},lock:function(){return e=g=[],c||b||(f=c=""),this},locked:function(){return!!e},fireWith:function(a,c){return e||(c=c||[],c=[a,c.slice?c.slice():c],g.push(c),b||i()),this},fire:function(){return j.fireWith(this,arguments),this},fired:function(){return!!d}};return j};function N(a){return a}function O(a){throw a}function P(a,b,c,d){var e;try{a&&r.isFunction(e=a.promise)?e.call(a).done(b).fail(c):a&&r.isFunction(e=a.then)?e.call(a,b,c):b.apply(void 0,[a].slice(d))}catch(a){c.apply(void 0,[a])}}r.extend({Deferred:function(b){var c=[["notify","progress",r.Callbacks("memory"),r.Callbacks("memory"),2],["resolve","done",r.Callbacks("once memory"),r.Callbacks("once memory"),0,"resolved"],["reject","fail",r.Callbacks("once memory"),r.Callbacks("once memory"),1,"rejected"]],d="pending",e={state:function(){return d},always:function(){return f.done(arguments).fail(arguments),this},"catch":function(a){return e.then(null,a)},pipe:function(){var a=arguments;return r.Deferred(function(b){r.each(c,function(c,d){var e=r.isFunction(a[d[4]])&&a[d[4]];f[d[1]](function(){var a=e&&e.apply(this,arguments);a&&r.isFunction(a.promise)?a.promise().progress(b.notify).done(b.resolve).fail(b.reject):b[d[0]+"With"](this,e?[a]:arguments)})}),a=null}).promise()},then:function(b,d,e){var f=0;function g(b,c,d,e){return function(){var h=this,i=arguments,j=function(){var a,j;if(!(b<f)){if(a=d.apply(h,i),a===c.promise())throw new TypeError("Thenable self-resolution");j=a&&("object"==typeof a||"function"==typeof a)&&a.then,r.isFunction(j)?e?j.call(a,g(f,c,N,e),g(f,c,O,e)):(f++,j.call(a,g(f,c,N,e),g(f,c,O,e),g(f,c,N,c.notifyWith))):(d!==N&&(h=void 0,i=[a]),(e||c.resolveWith)(h,i))}},k=e?j:function(){try{j()}catch(a){r.Deferred.exceptionHook&&r.Deferred.exceptionHook(a,k.stackTrace),b+1>=f&&(d!==O&&(h=void 0,i=[a]),c.rejectWith(h,i))}};b?k():(r.Deferred.getStackHook&&(k.stackTrace=r.Deferred.getStackHook()),a.setTimeout(k))}}return r.Deferred(function(a){c[0][3].add(g(0,a,r.isFunction(e)?e:N,a.notifyWith)),c[1][3].add(g(0,a,r.isFunction(b)?b:N)),c[2][3].add(g(0,a,r.isFunction(d)?d:O))}).promise()},promise:function(a){return null!=a?r.extend(a,e):e}},f={};return r.each(c,function(a,b){var g=b[2],h=b[5];e[b[1]]=g.add,h&&g.add(function(){d=h},c[3-a][2].disable,c[0][2].lock),g.add(b[3].fire),f[b[0]]=function(){return f[b[0]+"With"](this===f?void 0:this,arguments),this},f[b[0]+"With"]=g.fireWith}),e.promise(f),b&&b.call(f,f),f},when:function(a){var b=arguments.length,c=b,d=Array(c),e=f.call(arguments),g=r.Deferred(),h=function(a){return function(c){d[a]=this,e[a]=arguments.length>1?f.call(arguments):c,--b||g.resolveWith(d,e)}};if(b<=1&&(P(a,g.done(h(c)).resolve,g.reject,!b),"pending"===g.state()||r.isFunction(e[c]&&e[c].then)))return g.then();while(c--)P(e[c],h(c),g.reject);return g.promise()}});var Q=/^(Eval|Internal|Range|Reference|Syntax|Type|URI)Error$/;r.Deferred.exceptionHook=function(b,c){a.console&&a.console.warn&&b&&Q.test(b.name)&&a.console.warn("jQuery.Deferred exception: "+b.message,b.stack,c)},r.readyException=function(b){a.setTimeout(function(){throw b})};var R=r.Deferred();r.fn.ready=function(a){return R.then(a)["catch"](function(a){r.readyException(a)}),this},r.extend({isReady:!1,readyWait:1,ready:function(a){(a===!0?--r.readyWait:r.isReady)||(r.isReady=!0,a!==!0&&--r.readyWait>0||R.resolveWith(d,[r]))}}),r.ready.then=R.then;function S(){d.removeEventListener("DOMContentLoaded",S),
+a.removeEventListener("load",S),r.ready()}"complete"===d.readyState||"loading"!==d.readyState&&!d.documentElement.doScroll?a.setTimeout(r.ready):(d.addEventListener("DOMContentLoaded",S),a.addEventListener("load",S));var T=function(a,b,c,d,e,f,g){var h=0,i=a.length,j=null==c;if("object"===r.type(c)){e=!0;for(h in c)T(a,b,h,c[h],!0,f,g)}else if(void 0!==d&&(e=!0,r.isFunction(d)||(g=!0),j&&(g?(b.call(a,d),b=null):(j=b,b=function(a,b,c){return j.call(r(a),c)})),b))for(;h<i;h++)b(a[h],c,g?d:d.call(a[h],h,b(a[h],c)));return e?a:j?b.call(a):i?b(a[0],c):f},U=function(a){return 1===a.nodeType||9===a.nodeType||!+a.nodeType};function V(){this.expando=r.expando+V.uid++}V.uid=1,V.prototype={cache:function(a){var b=a[this.expando];return b||(b={},U(a)&&(a.nodeType?a[this.expando]=b:Object.defineProperty(a,this.expando,{value:b,configurable:!0}))),b},set:function(a,b,c){var d,e=this.cache(a);if("string"==typeof b)e[r.camelCase(b)]=c;else for(d in b)e[r.camelCase(d)]=b[d];return e},get:function(a,b){return void 0===b?this.cache(a):a[this.expando]&&a[this.expando][r.camelCase(b)]},access:function(a,b,c){return void 0===b||b&&"string"==typeof b&&void 0===c?this.get(a,b):(this.set(a,b,c),void 0!==c?c:b)},remove:function(a,b){var c,d=a[this.expando];if(void 0!==d){if(void 0!==b){Array.isArray(b)?b=b.map(r.camelCase):(b=r.camelCase(b),b=b in d?[b]:b.match(L)||[]),c=b.length;while(c--)delete d[b[c]]}(void 0===b||r.isEmptyObject(d))&&(a.nodeType?a[this.expando]=void 0:delete a[this.expando])}},hasData:function(a){var b=a[this.expando];return void 0!==b&&!r.isEmptyObject(b)}};var W=new V,X=new V,Y=/^(?:\{[\w\W]*\}|\[[\w\W]*\])$/,Z=/[A-Z]/g;function $(a){return"true"===a||"false"!==a&&("null"===a?null:a===+a+""?+a:Y.test(a)?JSON.parse(a):a)}function _(a,b,c){var d;if(void 0===c&&1===a.nodeType)if(d="data-"+b.replace(Z,"-$&").toLowerCase(),c=a.getAttribute(d),"string"==typeof c){try{c=$(c)}catch(e){}X.set(a,b,c)}else c=void 0;return c}r.extend({hasData:function(a){return X.hasData(a)||W.hasData(a)},data:function(a,b,c){return X.access(a,b,c)},removeData:function(a,b){X.remove(a,b)},_data:function(a,b,c){return W.access(a,b,c)},_removeData:function(a,b){W.remove(a,b)}}),r.fn.extend({data:function(a,b){var c,d,e,f=this[0],g=f&&f.attributes;if(void 0===a){if(this.length&&(e=X.get(f),1===f.nodeType&&!W.get(f,"hasDataAttrs"))){c=g.length;while(c--)g[c]&&(d=g[c].name,0===d.indexOf("data-")&&(d=r.camelCase(d.slice(5)),_(f,d,e[d])));W.set(f,"hasDataAttrs",!0)}return e}return"object"==typeof a?this.each(function(){X.set(this,a)}):T(this,function(b){var c;if(f&&void 0===b){if(c=X.get(f,a),void 0!==c)return c;if(c=_(f,a),void 0!==c)return c}else this.each(function(){X.set(this,a,b)})},null,b,arguments.length>1,null,!0)},removeData:function(a){return this.each(function(){X.remove(this,a)})}}),r.extend({queue:function(a,b,c){var d;if(a)return b=(b||"fx")+"queue",d=W.get(a,b),c&&(!d||Array.isArray(c)?d=W.access(a,b,r.makeArray(c)):d.push(c)),d||[]},dequeue:function(a,b){b=b||"fx";var c=r.queue(a,b),d=c.length,e=c.shift(),f=r._queueHooks(a,b),g=function(){r.dequeue(a,b)};"inprogress"===e&&(e=c.shift(),d--),e&&("fx"===b&&c.unshift("inprogress"),delete f.stop,e.call(a,g,f)),!d&&f&&f.empty.fire()},_queueHooks:function(a,b){var c=b+"queueHooks";return W.get(a,c)||W.access(a,c,{empty:r.Callbacks("once memory").add(function(){W.remove(a,[b+"queue",c])})})}}),r.fn.extend({queue:function(a,b){var c=2;return"string"!=typeof a&&(b=a,a="fx",c--),arguments.length<c?r.queue(this[0],a):void 0===b?this:this.each(function(){var c=r.queue(this,a,b);r._queueHooks(this,a),"fx"===a&&"inprogress"!==c[0]&&r.dequeue(this,a)})},dequeue:function(a){return this.each(function(){r.dequeue(this,a)})},clearQueue:function(a){return this.queue(a||"fx",[])},promise:function(a,b){var c,d=1,e=r.Deferred(),f=this,g=this.length,h=function(){--d||e.resolveWith(f,[f])};"string"!=typeof a&&(b=a,a=void 0),a=a||"fx";while(g--)c=W.get(f[g],a+"queueHooks"),c&&c.empty&&(d++,c.empty.add(h));return h(),e.promise(b)}});var aa=/[+-]?(?:\d*\.|)\d+(?:[eE][+-]?\d+|)/.source,ba=new RegExp("^(?:([+-])=|)("+aa+")([a-z%]*)$","i"),ca=["Top","Right","Bottom","Left"],da=function(a,b){return a=b||a,"none"===a.style.display||""===a.style.display&&r.contains(a.ownerDocument,a)&&"none"===r.css(a,"display")},ea=function(a,b,c,d){var e,f,g={};for(f in b)g[f]=a.style[f],a.style[f]=b[f];e=c.apply(a,d||[]);for(f in b)a.style[f]=g[f];return e};function fa(a,b,c,d){var e,f=1,g=20,h=d?function(){return d.cur()}:function(){return r.css(a,b,"")},i=h(),j=c&&c[3]||(r.cssNumber[b]?"":"px"),k=(r.cssNumber[b]||"px"!==j&&+i)&&ba.exec(r.css(a,b));if(k&&k[3]!==j){j=j||k[3],c=c||[],k=+i||1;do f=f||".5",k/=f,r.style(a,b,k+j);while(f!==(f=h()/i)&&1!==f&&--g)}return c&&(k=+k||+i||0,e=c[1]?k+(c[1]+1)*c[2]:+c[2],d&&(d.unit=j,d.start=k,d.end=e)),e}var ga={};function ha(a){var b,c=a.ownerDocument,d=a.nodeName,e=ga[d];return e?e:(b=c.body.appendChild(c.createElement(d)),e=r.css(b,"display"),b.parentNode.removeChild(b),"none"===e&&(e="block"),ga[d]=e,e)}function ia(a,b){for(var c,d,e=[],f=0,g=a.length;f<g;f++)d=a[f],d.style&&(c=d.style.display,b?("none"===c&&(e[f]=W.get(d,"display")||null,e[f]||(d.style.display="")),""===d.style.display&&da(d)&&(e[f]=ha(d))):"none"!==c&&(e[f]="none",W.set(d,"display",c)));for(f=0;f<g;f++)null!=e[f]&&(a[f].style.display=e[f]);return a}r.fn.extend({show:function(){return ia(this,!0)},hide:function(){return ia(this)},toggle:function(a){return"boolean"==typeof a?a?this.show():this.hide():this.each(function(){da(this)?r(this).show():r(this).hide()})}});var ja=/^(?:checkbox|radio)$/i,ka=/<([a-z][^\/\0>\x20\t\r\n\f]+)/i,la=/^$|\/(?:java|ecma)script/i,ma={option:[1,"<select multiple='multiple'>","</select>"],thead:[1,"<table>","</table>"],col:[2,"<table><colgroup>","</colgroup></table>"],tr:[2,"<table><tbody>","</tbody></table>"],td:[3,"<table><tbody><tr>","</tr></tbody></table>"],_default:[0,"",""]};ma.optgroup=ma.option,ma.tbody=ma.tfoot=ma.colgroup=ma.caption=ma.thead,ma.th=ma.td;function na(a,b){var c;return c="undefined"!=typeof a.getElementsByTagName?a.getElementsByTagName(b||"*"):"undefined"!=typeof a.querySelectorAll?a.querySelectorAll(b||"*"):[],void 0===b||b&&B(a,b)?r.merge([a],c):c}function oa(a,b){for(var c=0,d=a.length;c<d;c++)W.set(a[c],"globalEval",!b||W.get(b[c],"globalEval"))}var pa=/<|&#?\w+;/;function qa(a,b,c,d,e){for(var f,g,h,i,j,k,l=b.createDocumentFragment(),m=[],n=0,o=a.length;n<o;n++)if(f=a[n],f||0===f)if("object"===r.type(f))r.merge(m,f.nodeType?[f]:f);else if(pa.test(f)){g=g||l.appendChild(b.createElement("div")),h=(ka.exec(f)||["",""])[1].toLowerCase(),i=ma[h]||ma._default,g.innerHTML=i[1]+r.htmlPrefilter(f)+i[2],k=i[0];while(k--)g=g.lastChild;r.merge(m,g.childNodes),g=l.firstChild,g.textContent=""}else m.push(b.createTextNode(f));l.textContent="",n=0;while(f=m[n++])if(d&&r.inArray(f,d)>-1)e&&e.push(f);else if(j=r.contains(f.ownerDocument,f),g=na(l.appendChild(f),"script"),j&&oa(g),c){k=0;while(f=g[k++])la.test(f.type||"")&&c.push(f)}return l}!function(){var a=d.createDocumentFragment(),b=a.appendChild(d.createElement("div")),c=d.createElement("input");c.setAttribute("type","radio"),c.setAttribute("checked","checked"),c.setAttribute("name","t"),b.appendChild(c),o.checkClone=b.cloneNode(!0).cloneNode(!0).lastChild.checked,b.innerHTML="<textarea>x</textarea>",o.noCloneChecked=!!b.cloneNode(!0).lastChild.defaultValue}();var ra=d.documentElement,sa=/^key/,ta=/^(?:mouse|pointer|contextmenu|drag|drop)|click/,ua=/^([^.]*)(?:\.(.+)|)/;function va(){return!0}function wa(){return!1}function xa(){try{return d.activeElement}catch(a){}}function ya(a,b,c,d,e,f){var g,h;if("object"==typeof b){"string"!=typeof c&&(d=d||c,c=void 0);for(h in b)ya(a,h,c,d,b[h],f);return a}if(null==d&&null==e?(e=c,d=c=void 0):null==e&&("string"==typeof c?(e=d,d=void 0):(e=d,d=c,c=void 0)),e===!1)e=wa;else if(!e)return a;return 1===f&&(g=e,e=function(a){return r().off(a),g.apply(this,arguments)},e.guid=g.guid||(g.guid=r.guid++)),a.each(function(){r.event.add(this,b,e,d,c)})}r.event={global:{},add:function(a,b,c,d,e){var f,g,h,i,j,k,l,m,n,o,p,q=W.get(a);if(q){c.handler&&(f=c,c=f.handler,e=f.selector),e&&r.find.matchesSelector(ra,e),c.guid||(c.guid=r.guid++),(i=q.events)||(i=q.events={}),(g=q.handle)||(g=q.handle=function(b){return"undefined"!=typeof r&&r.event.triggered!==b.type?r.event.dispatch.apply(a,arguments):void 0}),b=(b||"").match(L)||[""],j=b.length;while(j--)h=ua.exec(b[j])||[],n=p=h[1],o=(h[2]||"").split(".").sort(),n&&(l=r.event.special[n]||{},n=(e?l.delegateType:l.bindType)||n,l=r.event.special[n]||{},k=r.extend({type:n,origType:p,data:d,handler:c,guid:c.guid,selector:e,needsContext:e&&r.expr.match.needsContext.test(e),namespace:o.join(".")},f),(m=i[n])||(m=i[n]=[],m.delegateCount=0,l.setup&&l.setup.call(a,d,o,g)!==!1||a.addEventListener&&a.addEventListener(n,g)),l.add&&(l.add.call(a,k),k.handler.guid||(k.handler.guid=c.guid)),e?m.splice(m.delegateCount++,0,k):m.push(k),r.event.global[n]=!0)}},remove:function(a,b,c,d,e){var f,g,h,i,j,k,l,m,n,o,p,q=W.hasData(a)&&W.get(a);if(q&&(i=q.events)){b=(b||"").match(L)||[""],j=b.length;while(j--)if(h=ua.exec(b[j])||[],n=p=h[1],o=(h[2]||"").split(".").sort(),n){l=r.event.special[n]||{},n=(d?l.delegateType:l.bindType)||n,m=i[n]||[],h=h[2]&&new RegExp("(^|\\.)"+o.join("\\.(?:.*\\.|)")+"(\\.|$)"),g=f=m.length;while(f--)k=m[f],!e&&p!==k.origType||c&&c.guid!==k.guid||h&&!h.test(k.namespace)||d&&d!==k.selector&&("**"!==d||!k.selector)||(m.splice(f,1),k.selector&&m.delegateCount--,l.remove&&l.remove.call(a,k));g&&!m.length&&(l.teardown&&l.teardown.call(a,o,q.handle)!==!1||r.removeEvent(a,n,q.handle),delete i[n])}else for(n in i)r.event.remove(a,n+b[j],c,d,!0);r.isEmptyObject(i)&&W.remove(a,"handle events")}},dispatch:function(a){var b=r.event.fix(a),c,d,e,f,g,h,i=new Array(arguments.length),j=(W.get(this,"events")||{})[b.type]||[],k=r.event.special[b.type]||{};for(i[0]=b,c=1;c<arguments.length;c++)i[c]=arguments[c];if(b.delegateTarget=this,!k.preDispatch||k.preDispatch.call(this,b)!==!1){h=r.event.handlers.call(this,b,j),c=0;while((f=h[c++])&&!b.isPropagationStopped()){b.currentTarget=f.elem,d=0;while((g=f.handlers[d++])&&!b.isImmediatePropagationStopped())b.rnamespace&&!b.rnamespace.test(g.namespace)||(b.handleObj=g,b.data=g.data,e=((r.event.special[g.origType]||{}).handle||g.handler).apply(f.elem,i),void 0!==e&&(b.result=e)===!1&&(b.preventDefault(),b.stopPropagation()))}return k.postDispatch&&k.postDispatch.call(this,b),b.result}},handlers:function(a,b){var c,d,e,f,g,h=[],i=b.delegateCount,j=a.target;if(i&&j.nodeType&&!("click"===a.type&&a.button>=1))for(;j!==this;j=j.parentNode||this)if(1===j.nodeType&&("click"!==a.type||j.disabled!==!0)){for(f=[],g={},c=0;c<i;c++)d=b[c],e=d.selector+" ",void 0===g[e]&&(g[e]=d.needsContext?r(e,this).index(j)>-1:r.find(e,this,null,[j]).length),g[e]&&f.push(d);f.length&&h.push({elem:j,handlers:f})}return j=this,i<b.length&&h.push({elem:j,handlers:b.slice(i)}),h},addProp:function(a,b){Object.defineProperty(r.Event.prototype,a,{enumerable:!0,configurable:!0,get:r.isFunction(b)?function(){if(this.originalEvent)return b(this.originalEvent)}:function(){if(this.originalEvent)return this.originalEvent[a]},set:function(b){Object.defineProperty(this,a,{enumerable:!0,configurable:!0,writable:!0,value:b})}})},fix:function(a){return a[r.expando]?a:new r.Event(a)},special:{load:{noBubble:!0},focus:{trigger:function(){if(this!==xa()&&this.focus)return this.focus(),!1},delegateType:"focusin"},blur:{trigger:function(){if(this===xa()&&this.blur)return this.blur(),!1},delegateType:"focusout"},click:{trigger:function(){if("checkbox"===this.type&&this.click&&B(this,"input"))return this.click(),!1},_default:function(a){return B(a.target,"a")}},beforeunload:{postDispatch:function(a){void 0!==a.result&&a.originalEvent&&(a.originalEvent.returnValue=a.result)}}}},r.removeEvent=function(a,b,c){a.removeEventListener&&a.removeEventListener(b,c)},r.Event=function(a,b){return this instanceof r.Event?(a&&a.type?(this.originalEvent=a,this.type=a.type,this.isDefaultPrevented=a.defaultPrevented||void 0===a.defaultPrevented&&a.returnValue===!1?va:wa,this.target=a.target&&3===a.target.nodeType?a.target.parentNode:a.target,this.currentTarget=a.currentTarget,this.relatedTarget=a.relatedTarget):this.type=a,b&&r.extend(this,b),this.timeStamp=a&&a.timeStamp||r.now(),void(this[r.expando]=!0)):new r.Event(a,b)},r.Event.prototype={constructor:r.Event,isDefaultPrevented:wa,isPropagationStopped:wa,isImmediatePropagationStopped:wa,isSimulated:!1,preventDefault:function(){var a=this.originalEvent;this.isDefaultPrevented=va,a&&!this.isSimulated&&a.preventDefault()},stopPropagation:function(){var a=this.originalEvent;this.isPropagationStopped=va,a&&!this.isSimulated&&a.stopPropagation()},stopImmediatePropagation:function(){var a=this.originalEvent;this.isImmediatePropagationStopped=va,a&&!this.isSimulated&&a.stopImmediatePropagation(),this.stopPropagation()}},r.each({altKey:!0,bubbles:!0,cancelable:!0,changedTouches:!0,ctrlKey:!0,detail:!0,eventPhase:!0,metaKey:!0,pageX:!0,pageY:!0,shiftKey:!0,view:!0,"char":!0,charCode:!0,key:!0,keyCode:!0,button:!0,buttons:!0,clientX:!0,clientY:!0,offsetX:!0,offsetY:!0,pointerId:!0,pointerType:!0,screenX:!0,screenY:!0,targetTouches:!0,toElement:!0,touches:!0,which:function(a){var b=a.button;return null==a.which&&sa.test(a.type)?null!=a.charCode?a.charCode:a.keyCode:!a.which&&void 0!==b&&ta.test(a.type)?1&b?1:2&b?3:4&b?2:0:a.which}},r.event.addProp),r.each({mouseenter:"mouseover",mouseleave:"mouseout",pointerenter:"pointerover",pointerleave:"pointerout"},function(a,b){r.event.special[a]={delegateType:b,bindType:b,handle:function(a){var c,d=this,e=a.relatedTarget,f=a.handleObj;return e&&(e===d||r.contains(d,e))||(a.type=f.origType,c=f.handler.apply(this,arguments),a.type=b),c}}}),r.fn.extend({on:function(a,b,c,d){return ya(this,a,b,c,d)},one:function(a,b,c,d){return ya(this,a,b,c,d,1)},off:function(a,b,c){var d,e;if(a&&a.preventDefault&&a.handleObj)return d=a.handleObj,r(a.delegateTarget).off(d.namespace?d.origType+"."+d.namespace:d.origType,d.selector,d.handler),this;if("object"==typeof a){for(e in a)this.off(e,b,a[e]);return this}return b!==!1&&"function"!=typeof b||(c=b,b=void 0),c===!1&&(c=wa),this.each(function(){r.event.remove(this,a,c,b)})}});var za=/<(?!area|br|col|embed|hr|img|input|link|meta|param)(([a-z][^\/\0>\x20\t\r\n\f]*)[^>]*)\/>/gi,Aa=/<script|<style|<link/i,Ba=/checked\s*(?:[^=]|=\s*.checked.)/i,Ca=/^true\/(.*)/,Da=/^\s*<!(?:\[CDATA\[|--)|(?:\]\]|--)>\s*$/g;function Ea(a,b){return B(a,"table")&&B(11!==b.nodeType?b:b.firstChild,"tr")?r(">tbody",a)[0]||a:a}function Fa(a){return a.type=(null!==a.getAttribute("type"))+"/"+a.type,a}function Ga(a){var b=Ca.exec(a.type);return b?a.type=b[1]:a.removeAttribute("type"),a}function Ha(a,b){var c,d,e,f,g,h,i,j;if(1===b.nodeType){if(W.hasData(a)&&(f=W.access(a),g=W.set(b,f),j=f.events)){delete g.handle,g.events={};for(e in j)for(c=0,d=j[e].length;c<d;c++)r.event.add(b,e,j[e][c])}X.hasData(a)&&(h=X.access(a),i=r.extend({},h),X.set(b,i))}}function Ia(a,b){var c=b.nodeName.toLowerCase();"input"===c&&ja.test(a.type)?b.checked=a.checked:"input"!==c&&"textarea"!==c||(b.defaultValue=a.defaultValue)}function Ja(a,b,c,d){b=g.apply([],b);var e,f,h,i,j,k,l=0,m=a.length,n=m-1,q=b[0],s=r.isFunction(q);if(s||m>1&&"string"==typeof q&&!o.checkClone&&Ba.test(q))return a.each(function(e){var f=a.eq(e);s&&(b[0]=q.call(this,e,f.html())),Ja(f,b,c,d)});if(m&&(e=qa(b,a[0].ownerDocument,!1,a,d),f=e.firstChild,1===e.childNodes.length&&(e=f),f||d)){for(h=r.map(na(e,"script"),Fa),i=h.length;l<m;l++)j=e,l!==n&&(j=r.clone(j,!0,!0),i&&r.merge(h,na(j,"script"))),c.call(a[l],j,l);if(i)for(k=h[h.length-1].ownerDocument,r.map(h,Ga),l=0;l<i;l++)j=h[l],la.test(j.type||"")&&!W.access(j,"globalEval")&&r.contains(k,j)&&(j.src?r._evalUrl&&r._evalUrl(j.src):p(j.textContent.replace(Da,""),k))}return a}function Ka(a,b,c){for(var d,e=b?r.filter(b,a):a,f=0;null!=(d=e[f]);f++)c||1!==d.nodeType||r.cleanData(na(d)),d.parentNode&&(c&&r.contains(d.ownerDocument,d)&&oa(na(d,"script")),d.parentNode.removeChild(d));return a}r.extend({htmlPrefilter:function(a){return a.replace(za,"<$1></$2>")},clone:function(a,b,c){var d,e,f,g,h=a.cloneNode(!0),i=r.contains(a.ownerDocument,a);if(!(o.noCloneChecked||1!==a.nodeType&&11!==a.nodeType||r.isXMLDoc(a)))for(g=na(h),f=na(a),d=0,e=f.length;d<e;d++)Ia(f[d],g[d]);if(b)if(c)for(f=f||na(a),g=g||na(h),d=0,e=f.length;d<e;d++)Ha(f[d],g[d]);else Ha(a,h);return g=na(h,"script"),g.length>0&&oa(g,!i&&na(a,"script")),h},cleanData:function(a){for(var b,c,d,e=r.event.special,f=0;void 0!==(c=a[f]);f++)if(U(c)){if(b=c[W.expando]){if(b.events)for(d in b.events)e[d]?r.event.remove(c,d):r.removeEvent(c,d,b.handle);c[W.expando]=void 0}c[X.expando]&&(c[X.expando]=void 0)}}}),r.fn.extend({detach:function(a){return Ka(this,a,!0)},remove:function(a){return Ka(this,a)},text:function(a){return T(this,function(a){return void 0===a?r.text(this):this.empty().each(function(){1!==this.nodeType&&11!==this.nodeType&&9!==this.nodeType||(this.textContent=a)})},null,a,arguments.length)},append:function(){return Ja(this,arguments,function(a){if(1===this.nodeType||11===this.nodeType||9===this.nodeType){var b=Ea(this,a);b.appendChild(a)}})},prepend:function(){return Ja(this,arguments,function(a){if(1===this.nodeType||11===this.nodeType||9===this.nodeType){var b=Ea(this,a);b.insertBefore(a,b.firstChild)}})},before:function(){return Ja(this,arguments,function(a){this.parentNode&&this.parentNode.insertBefore(a,this)})},after:function(){return Ja(this,arguments,function(a){this.parentNode&&this.parentNode.insertBefore(a,this.nextSibling)})},empty:function(){for(var a,b=0;null!=(a=this[b]);b++)1===a.nodeType&&(r.cleanData(na(a,!1)),a.textContent="");return this},clone:function(a,b){return a=null!=a&&a,b=null==b?a:b,this.map(function(){return r.clone(this,a,b)})},html:function(a){return T(this,function(a){var b=this[0]||{},c=0,d=this.length;if(void 0===a&&1===b.nodeType)return b.innerHTML;if("string"==typeof a&&!Aa.test(a)&&!ma[(ka.exec(a)||["",""])[1].toLowerCase()]){a=r.htmlPrefilter(a);try{for(;c<d;c++)b=this[c]||{},1===b.nodeType&&(r.cleanData(na(b,!1)),b.innerHTML=a);b=0}catch(e){}}b&&this.empty().append(a)},null,a,arguments.length)},replaceWith:function(){var a=[];return Ja(this,arguments,function(b){var c=this.parentNode;r.inArray(this,a)<0&&(r.cleanData(na(this)),c&&c.replaceChild(b,this))},a)}}),r.each({appendTo:"append",prependTo:"prepend",insertBefore:"before",insertAfter:"after",replaceAll:"replaceWith"},function(a,b){r.fn[a]=function(a){for(var c,d=[],e=r(a),f=e.length-1,g=0;g<=f;g++)c=g===f?this:this.clone(!0),r(e[g])[b](c),h.apply(d,c.get());return this.pushStack(d)}});var La=/^margin/,Ma=new RegExp("^("+aa+")(?!px)[a-z%]+$","i"),Na=function(b){var c=b.ownerDocument.defaultView;return c&&c.opener||(c=a),c.getComputedStyle(b)};!function(){function b(){if(i){i.style.cssText="box-sizing:border-box;position:relative;display:block;margin:auto;border:1px;padding:1px;top:1%;width:50%",i.innerHTML="",ra.appendChild(h);var b=a.getComputedStyle(i);c="1%"!==b.top,g="2px"===b.marginLeft,e="4px"===b.width,i.style.marginRight="50%",f="4px"===b.marginRight,ra.removeChild(h),i=null}}var c,e,f,g,h=d.createElement("div"),i=d.createElement("div");i.style&&(i.style.backgroundClip="content-box",i.cloneNode(!0).style.backgroundClip="",o.clearCloneStyle="content-box"===i.style.backgroundClip,h.style.cssText="border:0;width:8px;height:0;top:0;left:-9999px;padding:0;margin-top:1px;position:absolute",h.appendChild(i),r.extend(o,{pixelPosition:function(){return b(),c},boxSizingReliable:function(){return b(),e},pixelMarginRight:function(){return b(),f},reliableMarginLeft:function(){return b(),g}}))}();function Oa(a,b,c){var d,e,f,g,h=a.style;return c=c||Na(a),c&&(g=c.getPropertyValue(b)||c[b],""!==g||r.contains(a.ownerDocument,a)||(g=r.style(a,b)),!o.pixelMarginRight()&&Ma.test(g)&&La.test(b)&&(d=h.width,e=h.minWidth,f=h.maxWidth,h.minWidth=h.maxWidth=h.width=g,g=c.width,h.width=d,h.minWidth=e,h.maxWidth=f)),void 0!==g?g+"":g}function Pa(a,b){return{get:function(){return a()?void delete this.get:(this.get=b).apply(this,arguments)}}}var Qa=/^(none|table(?!-c[ea]).+)/,Ra=/^--/,Sa={position:"absolute",visibility:"hidden",display:"block"},Ta={letterSpacing:"0",fontWeight:"400"},Ua=["Webkit","Moz","ms"],Va=d.createElement("div").style;function Wa(a){if(a in Va)return a;var b=a[0].toUpperCase()+a.slice(1),c=Ua.length;while(c--)if(a=Ua[c]+b,a in Va)return a}function Xa(a){var b=r.cssProps[a];return b||(b=r.cssProps[a]=Wa(a)||a),b}function Ya(a,b,c){var d=ba.exec(b);return d?Math.max(0,d[2]-(c||0))+(d[3]||"px"):b}function Za(a,b,c,d,e){var f,g=0;for(f=c===(d?"border":"content")?4:"width"===b?1:0;f<4;f+=2)"margin"===c&&(g+=r.css(a,c+ca[f],!0,e)),d?("content"===c&&(g-=r.css(a,"padding"+ca[f],!0,e)),"margin"!==c&&(g-=r.css(a,"border"+ca[f]+"Width",!0,e))):(g+=r.css(a,"padding"+ca[f],!0,e),"padding"!==c&&(g+=r.css(a,"border"+ca[f]+"Width",!0,e)));return g}function $a(a,b,c){var d,e=Na(a),f=Oa(a,b,e),g="border-box"===r.css(a,"boxSizing",!1,e);return Ma.test(f)?f:(d=g&&(o.boxSizingReliable()||f===a.style[b]),"auto"===f&&(f=a["offset"+b[0].toUpperCase()+b.slice(1)]),f=parseFloat(f)||0,f+Za(a,b,c||(g?"border":"content"),d,e)+"px")}r.extend({cssHooks:{opacity:{get:function(a,b){if(b){var c=Oa(a,"opacity");return""===c?"1":c}}}},cssNumber:{animationIterationCount:!0,columnCount:!0,fillOpacity:!0,flexGrow:!0,flexShrink:!0,fontWeight:!0,lineHeight:!0,opacity:!0,order:!0,orphans:!0,widows:!0,zIndex:!0,zoom:!0},cssProps:{"float":"cssFloat"},style:function(a,b,c,d){if(a&&3!==a.nodeType&&8!==a.nodeType&&a.style){var e,f,g,h=r.camelCase(b),i=Ra.test(b),j=a.style;return i||(b=Xa(h)),g=r.cssHooks[b]||r.cssHooks[h],void 0===c?g&&"get"in g&&void 0!==(e=g.get(a,!1,d))?e:j[b]:(f=typeof c,"string"===f&&(e=ba.exec(c))&&e[1]&&(c=fa(a,b,e),f="number"),null!=c&&c===c&&("number"===f&&(c+=e&&e[3]||(r.cssNumber[h]?"":"px")),o.clearCloneStyle||""!==c||0!==b.indexOf("background")||(j[b]="inherit"),g&&"set"in g&&void 0===(c=g.set(a,c,d))||(i?j.setProperty(b,c):j[b]=c)),void 0)}},css:function(a,b,c,d){var e,f,g,h=r.camelCase(b),i=Ra.test(b);return i||(b=Xa(h)),g=r.cssHooks[b]||r.cssHooks[h],g&&"get"in g&&(e=g.get(a,!0,c)),void 0===e&&(e=Oa(a,b,d)),"normal"===e&&b in Ta&&(e=Ta[b]),""===c||c?(f=parseFloat(e),c===!0||isFinite(f)?f||0:e):e}}),r.each(["height","width"],function(a,b){r.cssHooks[b]={get:function(a,c,d){if(c)return!Qa.test(r.css(a,"display"))||a.getClientRects().length&&a.getBoundingClientRect().width?$a(a,b,d):ea(a,Sa,function(){return $a(a,b,d)})},set:function(a,c,d){var e,f=d&&Na(a),g=d&&Za(a,b,d,"border-box"===r.css(a,"boxSizing",!1,f),f);return g&&(e=ba.exec(c))&&"px"!==(e[3]||"px")&&(a.style[b]=c,c=r.css(a,b)),Ya(a,c,g)}}}),r.cssHooks.marginLeft=Pa(o.reliableMarginLeft,function(a,b){if(b)return(parseFloat(Oa(a,"marginLeft"))||a.getBoundingClientRect().left-ea(a,{marginLeft:0},function(){return a.getBoundingClientRect().left}))+"px"}),r.each({margin:"",padding:"",border:"Width"},function(a,b){r.cssHooks[a+b]={expand:function(c){for(var d=0,e={},f="string"==typeof c?c.split(" "):[c];d<4;d++)e[a+ca[d]+b]=f[d]||f[d-2]||f[0];return e}},La.test(a)||(r.cssHooks[a+b].set=Ya)}),r.fn.extend({css:function(a,b){return T(this,function(a,b,c){var d,e,f={},g=0;if(Array.isArray(b)){for(d=Na(a),e=b.length;g<e;g++)f[b[g]]=r.css(a,b[g],!1,d);return f}return void 0!==c?r.style(a,b,c):r.css(a,b)},a,b,arguments.length>1)}});function _a(a,b,c,d,e){return new _a.prototype.init(a,b,c,d,e)}r.Tween=_a,_a.prototype={constructor:_a,init:function(a,b,c,d,e,f){this.elem=a,this.prop=c,this.easing=e||r.easing._default,this.options=b,this.start=this.now=this.cur(),this.end=d,this.unit=f||(r.cssNumber[c]?"":"px")},cur:function(){var a=_a.propHooks[this.prop];return a&&a.get?a.get(this):_a.propHooks._default.get(this)},run:function(a){var b,c=_a.propHooks[this.prop];return this.options.duration?this.pos=b=r.easing[this.easing](a,this.options.duration*a,0,1,this.options.duration):this.pos=b=a,this.now=(this.end-this.start)*b+this.start,this.options.step&&this.options.step.call(this.elem,this.now,this),c&&c.set?c.set(this):_a.propHooks._default.set(this),this}},_a.prototype.init.prototype=_a.prototype,_a.propHooks={_default:{get:function(a){var b;return 1!==a.elem.nodeType||null!=a.elem[a.prop]&&null==a.elem.style[a.prop]?a.elem[a.prop]:(b=r.css(a.elem,a.prop,""),b&&"auto"!==b?b:0)},set:function(a){r.fx.step[a.prop]?r.fx.step[a.prop](a):1!==a.elem.nodeType||null==a.elem.style[r.cssProps[a.prop]]&&!r.cssHooks[a.prop]?a.elem[a.prop]=a.now:r.style(a.elem,a.prop,a.now+a.unit)}}},_a.propHooks.scrollTop=_a.propHooks.scrollLeft={set:function(a){a.elem.nodeType&&a.elem.parentNode&&(a.elem[a.prop]=a.now)}},r.easing={linear:function(a){return a},swing:function(a){return.5-Math.cos(a*Math.PI)/2},_default:"swing"},r.fx=_a.prototype.init,r.fx.step={};var ab,bb,cb=/^(?:toggle|show|hide)$/,db=/queueHooks$/;function eb(){bb&&(d.hidden===!1&&a.requestAnimationFrame?a.requestAnimationFrame(eb):a.setTimeout(eb,r.fx.interval),r.fx.tick())}function fb(){return a.setTimeout(function(){ab=void 0}),ab=r.now()}function gb(a,b){var c,d=0,e={height:a};for(b=b?1:0;d<4;d+=2-b)c=ca[d],e["margin"+c]=e["padding"+c]=a;return b&&(e.opacity=e.width=a),e}function hb(a,b,c){for(var d,e=(kb.tweeners[b]||[]).concat(kb.tweeners["*"]),f=0,g=e.length;f<g;f++)if(d=e[f].call(c,b,a))return d}function ib(a,b,c){var d,e,f,g,h,i,j,k,l="width"in b||"height"in b,m=this,n={},o=a.style,p=a.nodeType&&da(a),q=W.get(a,"fxshow");c.queue||(g=r._queueHooks(a,"fx"),null==g.unqueued&&(g.unqueued=0,h=g.empty.fire,g.empty.fire=function(){g.unqueued||h()}),g.unqueued++,m.always(function(){m.always(function(){g.unqueued--,r.queue(a,"fx").length||g.empty.fire()})}));for(d in b)if(e=b[d],cb.test(e)){if(delete b[d],f=f||"toggle"===e,e===(p?"hide":"show")){if("show"!==e||!q||void 0===q[d])continue;p=!0}n[d]=q&&q[d]||r.style(a,d)}if(i=!r.isEmptyObject(b),i||!r.isEmptyObject(n)){l&&1===a.nodeType&&(c.overflow=[o.overflow,o.overflowX,o.overflowY],j=q&&q.display,null==j&&(j=W.get(a,"display")),k=r.css(a,"display"),"none"===k&&(j?k=j:(ia([a],!0),j=a.style.display||j,k=r.css(a,"display"),ia([a]))),("inline"===k||"inline-block"===k&&null!=j)&&"none"===r.css(a,"float")&&(i||(m.done(function(){o.display=j}),null==j&&(k=o.display,j="none"===k?"":k)),o.display="inline-block")),c.overflow&&(o.overflow="hidden",m.always(function(){o.overflow=c.overflow[0],o.overflowX=c.overflow[1],o.overflowY=c.overflow[2]})),i=!1;for(d in n)i||(q?"hidden"in q&&(p=q.hidden):q=W.access(a,"fxshow",{display:j}),f&&(q.hidden=!p),p&&ia([a],!0),m.done(function(){p||ia([a]),W.remove(a,"fxshow");for(d in n)r.style(a,d,n[d])})),i=hb(p?q[d]:0,d,m),d in q||(q[d]=i.start,p&&(i.end=i.start,i.start=0))}}function jb(a,b){var c,d,e,f,g;for(c in a)if(d=r.camelCase(c),e=b[d],f=a[c],Array.isArray(f)&&(e=f[1],f=a[c]=f[0]),c!==d&&(a[d]=f,delete a[c]),g=r.cssHooks[d],g&&"expand"in g){f=g.expand(f),delete a[d];for(c in f)c in a||(a[c]=f[c],b[c]=e)}else b[d]=e}function kb(a,b,c){var d,e,f=0,g=kb.prefilters.length,h=r.Deferred().always(function(){delete i.elem}),i=function(){if(e)return!1;for(var b=ab||fb(),c=Math.max(0,j.startTime+j.duration-b),d=c/j.duration||0,f=1-d,g=0,i=j.tweens.length;g<i;g++)j.tweens[g].run(f);return h.notifyWith(a,[j,f,c]),f<1&&i?c:(i||h.notifyWith(a,[j,1,0]),h.resolveWith(a,[j]),!1)},j=h.promise({elem:a,props:r.extend({},b),opts:r.extend(!0,{specialEasing:{},easing:r.easing._default},c),originalProperties:b,originalOptions:c,startTime:ab||fb(),duration:c.duration,tweens:[],createTween:function(b,c){var d=r.Tween(a,j.opts,b,c,j.opts.specialEasing[b]||j.opts.easing);return j.tweens.push(d),d},stop:function(b){var c=0,d=b?j.tweens.length:0;if(e)return this;for(e=!0;c<d;c++)j.tweens[c].run(1);return b?(h.notifyWith(a,[j,1,0]),h.resolveWith(a,[j,b])):h.rejectWith(a,[j,b]),this}}),k=j.props;for(jb(k,j.opts.specialEasing);f<g;f++)if(d=kb.prefilters[f].call(j,a,k,j.opts))return r.isFunction(d.stop)&&(r._queueHooks(j.elem,j.opts.queue).stop=r.proxy(d.stop,d)),d;return r.map(k,hb,j),r.isFunction(j.opts.start)&&j.opts.start.call(a,j),j.progress(j.opts.progress).done(j.opts.done,j.opts.complete).fail(j.opts.fail).always(j.opts.always),r.fx.timer(r.extend(i,{elem:a,anim:j,queue:j.opts.queue})),j}r.Animation=r.extend(kb,{tweeners:{"*":[function(a,b){var c=this.createTween(a,b);return fa(c.elem,a,ba.exec(b),c),c}]},tweener:function(a,b){r.isFunction(a)?(b=a,a=["*"]):a=a.match(L);for(var c,d=0,e=a.length;d<e;d++)c=a[d],kb.tweeners[c]=kb.tweeners[c]||[],kb.tweeners[c].unshift(b)},prefilters:[ib],prefilter:function(a,b){b?kb.prefilters.unshift(a):kb.prefilters.push(a)}}),r.speed=function(a,b,c){var d=a&&"object"==typeof a?r.extend({},a):{complete:c||!c&&b||r.isFunction(a)&&a,duration:a,easing:c&&b||b&&!r.isFunction(b)&&b};return r.fx.off?d.duration=0:"number"!=typeof d.duration&&(d.duration in r.fx.speeds?d.duration=r.fx.speeds[d.duration]:d.duration=r.fx.speeds._default),null!=d.queue&&d.queue!==!0||(d.queue="fx"),d.old=d.complete,d.complete=function(){r.isFunction(d.old)&&d.old.call(this),d.queue&&r.dequeue(this,d.queue)},d},r.fn.extend({fadeTo:function(a,b,c,d){return this.filter(da).css("opacity",0).show().end().animate({opacity:b},a,c,d)},animate:function(a,b,c,d){var e=r.isEmptyObject(a),f=r.speed(b,c,d),g=function(){var b=kb(this,r.extend({},a),f);(e||W.get(this,"finish"))&&b.stop(!0)};return g.finish=g,e||f.queue===!1?this.each(g):this.queue(f.queue,g)},stop:function(a,b,c){var d=function(a){var b=a.stop;delete a.stop,b(c)};return"string"!=typeof a&&(c=b,b=a,a=void 0),b&&a!==!1&&this.queue(a||"fx",[]),this.each(function(){var b=!0,e=null!=a&&a+"queueHooks",f=r.timers,g=W.get(this);if(e)g[e]&&g[e].stop&&d(g[e]);else for(e in g)g[e]&&g[e].stop&&db.test(e)&&d(g[e]);for(e=f.length;e--;)f[e].elem!==this||null!=a&&f[e].queue!==a||(f[e].anim.stop(c),b=!1,f.splice(e,1));!b&&c||r.dequeue(this,a)})},finish:function(a){return a!==!1&&(a=a||"fx"),this.each(function(){var b,c=W.get(this),d=c[a+"queue"],e=c[a+"queueHooks"],f=r.timers,g=d?d.length:0;for(c.finish=!0,r.queue(this,a,[]),e&&e.stop&&e.stop.call(this,!0),b=f.length;b--;)f[b].elem===this&&f[b].queue===a&&(f[b].anim.stop(!0),f.splice(b,1));for(b=0;b<g;b++)d[b]&&d[b].finish&&d[b].finish.call(this);delete c.finish})}}),r.each(["toggle","show","hide"],function(a,b){var c=r.fn[b];r.fn[b]=function(a,d,e){return null==a||"boolean"==typeof a?c.apply(this,arguments):this.animate(gb(b,!0),a,d,e)}}),r.each({slideDown:gb("show"),slideUp:gb("hide"),slideToggle:gb("toggle"),fadeIn:{opacity:"show"},fadeOut:{opacity:"hide"},fadeToggle:{opacity:"toggle"}},function(a,b){r.fn[a]=function(a,c,d){return this.animate(b,a,c,d)}}),r.timers=[],r.fx.tick=function(){var a,b=0,c=r.timers;for(ab=r.now();b<c.length;b++)a=c[b],a()||c[b]!==a||c.splice(b--,1);c.length||r.fx.stop(),ab=void 0},r.fx.timer=function(a){r.timers.push(a),r.fx.start()},r.fx.interval=13,r.fx.start=function(){bb||(bb=!0,eb())},r.fx.stop=function(){bb=null},r.fx.speeds={slow:600,fast:200,_default:400},r.fn.delay=function(b,c){return b=r.fx?r.fx.speeds[b]||b:b,c=c||"fx",this.queue(c,function(c,d){var e=a.setTimeout(c,b);d.stop=function(){a.clearTimeout(e)}})},function(){var a=d.createElement("input"),b=d.createElement("select"),c=b.appendChild(d.createElement("option"));a.type="checkbox",o.checkOn=""!==a.value,o.optSelected=c.selected,a=d.createElement("input"),a.value="t",a.type="radio",o.radioValue="t"===a.value}();var lb,mb=r.expr.attrHandle;r.fn.extend({attr:function(a,b){return T(this,r.attr,a,b,arguments.length>1)},removeAttr:function(a){return this.each(function(){r.removeAttr(this,a)})}}),r.extend({attr:function(a,b,c){var d,e,f=a.nodeType;if(3!==f&&8!==f&&2!==f)return"undefined"==typeof a.getAttribute?r.prop(a,b,c):(1===f&&r.isXMLDoc(a)||(e=r.attrHooks[b.toLowerCase()]||(r.expr.match.bool.test(b)?lb:void 0)),void 0!==c?null===c?void r.removeAttr(a,b):e&&"set"in e&&void 0!==(d=e.set(a,c,b))?d:(a.setAttribute(b,c+""),c):e&&"get"in e&&null!==(d=e.get(a,b))?d:(d=r.find.attr(a,b),
+null==d?void 0:d))},attrHooks:{type:{set:function(a,b){if(!o.radioValue&&"radio"===b&&B(a,"input")){var c=a.value;return a.setAttribute("type",b),c&&(a.value=c),b}}}},removeAttr:function(a,b){var c,d=0,e=b&&b.match(L);if(e&&1===a.nodeType)while(c=e[d++])a.removeAttribute(c)}}),lb={set:function(a,b,c){return b===!1?r.removeAttr(a,c):a.setAttribute(c,c),c}},r.each(r.expr.match.bool.source.match(/\w+/g),function(a,b){var c=mb[b]||r.find.attr;mb[b]=function(a,b,d){var e,f,g=b.toLowerCase();return d||(f=mb[g],mb[g]=e,e=null!=c(a,b,d)?g:null,mb[g]=f),e}});var nb=/^(?:input|select|textarea|button)$/i,ob=/^(?:a|area)$/i;r.fn.extend({prop:function(a,b){return T(this,r.prop,a,b,arguments.length>1)},removeProp:function(a){return this.each(function(){delete this[r.propFix[a]||a]})}}),r.extend({prop:function(a,b,c){var d,e,f=a.nodeType;if(3!==f&&8!==f&&2!==f)return 1===f&&r.isXMLDoc(a)||(b=r.propFix[b]||b,e=r.propHooks[b]),void 0!==c?e&&"set"in e&&void 0!==(d=e.set(a,c,b))?d:a[b]=c:e&&"get"in e&&null!==(d=e.get(a,b))?d:a[b]},propHooks:{tabIndex:{get:function(a){var b=r.find.attr(a,"tabindex");return b?parseInt(b,10):nb.test(a.nodeName)||ob.test(a.nodeName)&&a.href?0:-1}}},propFix:{"for":"htmlFor","class":"className"}}),o.optSelected||(r.propHooks.selected={get:function(a){var b=a.parentNode;return b&&b.parentNode&&b.parentNode.selectedIndex,null},set:function(a){var b=a.parentNode;b&&(b.selectedIndex,b.parentNode&&b.parentNode.selectedIndex)}}),r.each(["tabIndex","readOnly","maxLength","cellSpacing","cellPadding","rowSpan","colSpan","useMap","frameBorder","contentEditable"],function(){r.propFix[this.toLowerCase()]=this});function pb(a){var b=a.match(L)||[];return b.join(" ")}function qb(a){return a.getAttribute&&a.getAttribute("class")||""}r.fn.extend({addClass:function(a){var b,c,d,e,f,g,h,i=0;if(r.isFunction(a))return this.each(function(b){r(this).addClass(a.call(this,b,qb(this)))});if("string"==typeof a&&a){b=a.match(L)||[];while(c=this[i++])if(e=qb(c),d=1===c.nodeType&&" "+pb(e)+" "){g=0;while(f=b[g++])d.indexOf(" "+f+" ")<0&&(d+=f+" ");h=pb(d),e!==h&&c.setAttribute("class",h)}}return this},removeClass:function(a){var b,c,d,e,f,g,h,i=0;if(r.isFunction(a))return this.each(function(b){r(this).removeClass(a.call(this,b,qb(this)))});if(!arguments.length)return this.attr("class","");if("string"==typeof a&&a){b=a.match(L)||[];while(c=this[i++])if(e=qb(c),d=1===c.nodeType&&" "+pb(e)+" "){g=0;while(f=b[g++])while(d.indexOf(" "+f+" ")>-1)d=d.replace(" "+f+" "," ");h=pb(d),e!==h&&c.setAttribute("class",h)}}return this},toggleClass:function(a,b){var c=typeof a;return"boolean"==typeof b&&"string"===c?b?this.addClass(a):this.removeClass(a):r.isFunction(a)?this.each(function(c){r(this).toggleClass(a.call(this,c,qb(this),b),b)}):this.each(function(){var b,d,e,f;if("string"===c){d=0,e=r(this),f=a.match(L)||[];while(b=f[d++])e.hasClass(b)?e.removeClass(b):e.addClass(b)}else void 0!==a&&"boolean"!==c||(b=qb(this),b&&W.set(this,"__className__",b),this.setAttribute&&this.setAttribute("class",b||a===!1?"":W.get(this,"__className__")||""))})},hasClass:function(a){var b,c,d=0;b=" "+a+" ";while(c=this[d++])if(1===c.nodeType&&(" "+pb(qb(c))+" ").indexOf(b)>-1)return!0;return!1}});var rb=/\r/g;r.fn.extend({val:function(a){var b,c,d,e=this[0];{if(arguments.length)return d=r.isFunction(a),this.each(function(c){var e;1===this.nodeType&&(e=d?a.call(this,c,r(this).val()):a,null==e?e="":"number"==typeof e?e+="":Array.isArray(e)&&(e=r.map(e,function(a){return null==a?"":a+""})),b=r.valHooks[this.type]||r.valHooks[this.nodeName.toLowerCase()],b&&"set"in b&&void 0!==b.set(this,e,"value")||(this.value=e))});if(e)return b=r.valHooks[e.type]||r.valHooks[e.nodeName.toLowerCase()],b&&"get"in b&&void 0!==(c=b.get(e,"value"))?c:(c=e.value,"string"==typeof c?c.replace(rb,""):null==c?"":c)}}}),r.extend({valHooks:{option:{get:function(a){var b=r.find.attr(a,"value");return null!=b?b:pb(r.text(a))}},select:{get:function(a){var b,c,d,e=a.options,f=a.selectedIndex,g="select-one"===a.type,h=g?null:[],i=g?f+1:e.length;for(d=f<0?i:g?f:0;d<i;d++)if(c=e[d],(c.selected||d===f)&&!c.disabled&&(!c.parentNode.disabled||!B(c.parentNode,"optgroup"))){if(b=r(c).val(),g)return b;h.push(b)}return h},set:function(a,b){var c,d,e=a.options,f=r.makeArray(b),g=e.length;while(g--)d=e[g],(d.selected=r.inArray(r.valHooks.option.get(d),f)>-1)&&(c=!0);return c||(a.selectedIndex=-1),f}}}}),r.each(["radio","checkbox"],function(){r.valHooks[this]={set:function(a,b){if(Array.isArray(b))return a.checked=r.inArray(r(a).val(),b)>-1}},o.checkOn||(r.valHooks[this].get=function(a){return null===a.getAttribute("value")?"on":a.value})});var sb=/^(?:focusinfocus|focusoutblur)$/;r.extend(r.event,{trigger:function(b,c,e,f){var g,h,i,j,k,m,n,o=[e||d],p=l.call(b,"type")?b.type:b,q=l.call(b,"namespace")?b.namespace.split("."):[];if(h=i=e=e||d,3!==e.nodeType&&8!==e.nodeType&&!sb.test(p+r.event.triggered)&&(p.indexOf(".")>-1&&(q=p.split("."),p=q.shift(),q.sort()),k=p.indexOf(":")<0&&"on"+p,b=b[r.expando]?b:new r.Event(p,"object"==typeof b&&b),b.isTrigger=f?2:3,b.namespace=q.join("."),b.rnamespace=b.namespace?new RegExp("(^|\\.)"+q.join("\\.(?:.*\\.|)")+"(\\.|$)"):null,b.result=void 0,b.target||(b.target=e),c=null==c?[b]:r.makeArray(c,[b]),n=r.event.special[p]||{},f||!n.trigger||n.trigger.apply(e,c)!==!1)){if(!f&&!n.noBubble&&!r.isWindow(e)){for(j=n.delegateType||p,sb.test(j+p)||(h=h.parentNode);h;h=h.parentNode)o.push(h),i=h;i===(e.ownerDocument||d)&&o.push(i.defaultView||i.parentWindow||a)}g=0;while((h=o[g++])&&!b.isPropagationStopped())b.type=g>1?j:n.bindType||p,m=(W.get(h,"events")||{})[b.type]&&W.get(h,"handle"),m&&m.apply(h,c),m=k&&h[k],m&&m.apply&&U(h)&&(b.result=m.apply(h,c),b.result===!1&&b.preventDefault());return b.type=p,f||b.isDefaultPrevented()||n._default&&n._default.apply(o.pop(),c)!==!1||!U(e)||k&&r.isFunction(e[p])&&!r.isWindow(e)&&(i=e[k],i&&(e[k]=null),r.event.triggered=p,e[p](),r.event.triggered=void 0,i&&(e[k]=i)),b.result}},simulate:function(a,b,c){var d=r.extend(new r.Event,c,{type:a,isSimulated:!0});r.event.trigger(d,null,b)}}),r.fn.extend({trigger:function(a,b){return this.each(function(){r.event.trigger(a,b,this)})},triggerHandler:function(a,b){var c=this[0];if(c)return r.event.trigger(a,b,c,!0)}}),r.each("blur focus focusin focusout resize scroll click dblclick mousedown mouseup mousemove mouseover mouseout mouseenter mouseleave change select submit keydown keypress keyup contextmenu".split(" "),function(a,b){r.fn[b]=function(a,c){return arguments.length>0?this.on(b,null,a,c):this.trigger(b)}}),r.fn.extend({hover:function(a,b){return this.mouseenter(a).mouseleave(b||a)}}),o.focusin="onfocusin"in a,o.focusin||r.each({focus:"focusin",blur:"focusout"},function(a,b){var c=function(a){r.event.simulate(b,a.target,r.event.fix(a))};r.event.special[b]={setup:function(){var d=this.ownerDocument||this,e=W.access(d,b);e||d.addEventListener(a,c,!0),W.access(d,b,(e||0)+1)},teardown:function(){var d=this.ownerDocument||this,e=W.access(d,b)-1;e?W.access(d,b,e):(d.removeEventListener(a,c,!0),W.remove(d,b))}}});var tb=a.location,ub=r.now(),vb=/\?/;r.parseXML=function(b){var c;if(!b||"string"!=typeof b)return null;try{c=(new a.DOMParser).parseFromString(b,"text/xml")}catch(d){c=void 0}return c&&!c.getElementsByTagName("parsererror").length||r.error("Invalid XML: "+b),c};var wb=/\[\]$/,xb=/\r?\n/g,yb=/^(?:submit|button|image|reset|file)$/i,zb=/^(?:input|select|textarea|keygen)/i;function Ab(a,b,c,d){var e;if(Array.isArray(b))r.each(b,function(b,e){c||wb.test(a)?d(a,e):Ab(a+"["+("object"==typeof e&&null!=e?b:"")+"]",e,c,d)});else if(c||"object"!==r.type(b))d(a,b);else for(e in b)Ab(a+"["+e+"]",b[e],c,d)}r.param=function(a,b){var c,d=[],e=function(a,b){var c=r.isFunction(b)?b():b;d[d.length]=encodeURIComponent(a)+"="+encodeURIComponent(null==c?"":c)};if(Array.isArray(a)||a.jquery&&!r.isPlainObject(a))r.each(a,function(){e(this.name,this.value)});else for(c in a)Ab(c,a[c],b,e);return d.join("&")},r.fn.extend({serialize:function(){return r.param(this.serializeArray())},serializeArray:function(){return this.map(function(){var a=r.prop(this,"elements");return a?r.makeArray(a):this}).filter(function(){var a=this.type;return this.name&&!r(this).is(":disabled")&&zb.test(this.nodeName)&&!yb.test(a)&&(this.checked||!ja.test(a))}).map(function(a,b){var c=r(this).val();return null==c?null:Array.isArray(c)?r.map(c,function(a){return{name:b.name,value:a.replace(xb,"\r\n")}}):{name:b.name,value:c.replace(xb,"\r\n")}}).get()}});var Bb=/%20/g,Cb=/#.*$/,Db=/([?&])_=[^&]*/,Eb=/^(.*?):[ \t]*([^\r\n]*)$/gm,Fb=/^(?:about|app|app-storage|.+-extension|file|res|widget):$/,Gb=/^(?:GET|HEAD)$/,Hb=/^\/\//,Ib={},Jb={},Kb="*/".concat("*"),Lb=d.createElement("a");Lb.href=tb.href;function Mb(a){return function(b,c){"string"!=typeof b&&(c=b,b="*");var d,e=0,f=b.toLowerCase().match(L)||[];if(r.isFunction(c))while(d=f[e++])"+"===d[0]?(d=d.slice(1)||"*",(a[d]=a[d]||[]).unshift(c)):(a[d]=a[d]||[]).push(c)}}function Nb(a,b,c,d){var e={},f=a===Jb;function g(h){var i;return e[h]=!0,r.each(a[h]||[],function(a,h){var j=h(b,c,d);return"string"!=typeof j||f||e[j]?f?!(i=j):void 0:(b.dataTypes.unshift(j),g(j),!1)}),i}return g(b.dataTypes[0])||!e["*"]&&g("*")}function Ob(a,b){var c,d,e=r.ajaxSettings.flatOptions||{};for(c in b)void 0!==b[c]&&((e[c]?a:d||(d={}))[c]=b[c]);return d&&r.extend(!0,a,d),a}function Pb(a,b,c){var d,e,f,g,h=a.contents,i=a.dataTypes;while("*"===i[0])i.shift(),void 0===d&&(d=a.mimeType||b.getResponseHeader("Content-Type"));if(d)for(e in h)if(h[e]&&h[e].test(d)){i.unshift(e);break}if(i[0]in c)f=i[0];else{for(e in c){if(!i[0]||a.converters[e+" "+i[0]]){f=e;break}g||(g=e)}f=f||g}if(f)return f!==i[0]&&i.unshift(f),c[f]}function Qb(a,b,c,d){var e,f,g,h,i,j={},k=a.dataTypes.slice();if(k[1])for(g in a.converters)j[g.toLowerCase()]=a.converters[g];f=k.shift();while(f)if(a.responseFields[f]&&(c[a.responseFields[f]]=b),!i&&d&&a.dataFilter&&(b=a.dataFilter(b,a.dataType)),i=f,f=k.shift())if("*"===f)f=i;else if("*"!==i&&i!==f){if(g=j[i+" "+f]||j["* "+f],!g)for(e in j)if(h=e.split(" "),h[1]===f&&(g=j[i+" "+h[0]]||j["* "+h[0]])){g===!0?g=j[e]:j[e]!==!0&&(f=h[0],k.unshift(h[1]));break}if(g!==!0)if(g&&a["throws"])b=g(b);else try{b=g(b)}catch(l){return{state:"parsererror",error:g?l:"No conversion from "+i+" to "+f}}}return{state:"success",data:b}}r.extend({active:0,lastModified:{},etag:{},ajaxSettings:{url:tb.href,type:"GET",isLocal:Fb.test(tb.protocol),global:!0,processData:!0,async:!0,contentType:"application/x-www-form-urlencoded; charset=UTF-8",accepts:{"*":Kb,text:"text/plain",html:"text/html",xml:"application/xml, text/xml",json:"application/json, text/javascript"},contents:{xml:/\bxml\b/,html:/\bhtml/,json:/\bjson\b/},responseFields:{xml:"responseXML",text:"responseText",json:"responseJSON"},converters:{"* text":String,"text html":!0,"text json":JSON.parse,"text xml":r.parseXML},flatOptions:{url:!0,context:!0}},ajaxSetup:function(a,b){return b?Ob(Ob(a,r.ajaxSettings),b):Ob(r.ajaxSettings,a)},ajaxPrefilter:Mb(Ib),ajaxTransport:Mb(Jb),ajax:function(b,c){"object"==typeof b&&(c=b,b=void 0),c=c||{};var e,f,g,h,i,j,k,l,m,n,o=r.ajaxSetup({},c),p=o.context||o,q=o.context&&(p.nodeType||p.jquery)?r(p):r.event,s=r.Deferred(),t=r.Callbacks("once memory"),u=o.statusCode||{},v={},w={},x="canceled",y={readyState:0,getResponseHeader:function(a){var b;if(k){if(!h){h={};while(b=Eb.exec(g))h[b[1].toLowerCase()]=b[2]}b=h[a.toLowerCase()]}return null==b?null:b},getAllResponseHeaders:function(){return k?g:null},setRequestHeader:function(a,b){return null==k&&(a=w[a.toLowerCase()]=w[a.toLowerCase()]||a,v[a]=b),this},overrideMimeType:function(a){return null==k&&(o.mimeType=a),this},statusCode:function(a){var b;if(a)if(k)y.always(a[y.status]);else for(b in a)u[b]=[u[b],a[b]];return this},abort:function(a){var b=a||x;return e&&e.abort(b),A(0,b),this}};if(s.promise(y),o.url=((b||o.url||tb.href)+"").replace(Hb,tb.protocol+"//"),o.type=c.method||c.type||o.method||o.type,o.dataTypes=(o.dataType||"*").toLowerCase().match(L)||[""],null==o.crossDomain){j=d.createElement("a");try{j.href=o.url,j.href=j.href,o.crossDomain=Lb.protocol+"//"+Lb.host!=j.protocol+"//"+j.host}catch(z){o.crossDomain=!0}}if(o.data&&o.processData&&"string"!=typeof o.data&&(o.data=r.param(o.data,o.traditional)),Nb(Ib,o,c,y),k)return y;l=r.event&&o.global,l&&0===r.active++&&r.event.trigger("ajaxStart"),o.type=o.type.toUpperCase(),o.hasContent=!Gb.test(o.type),f=o.url.replace(Cb,""),o.hasContent?o.data&&o.processData&&0===(o.contentType||"").indexOf("application/x-www-form-urlencoded")&&(o.data=o.data.replace(Bb,"+")):(n=o.url.slice(f.length),o.data&&(f+=(vb.test(f)?"&":"?")+o.data,delete o.data),o.cache===!1&&(f=f.replace(Db,"$1"),n=(vb.test(f)?"&":"?")+"_="+ub++ +n),o.url=f+n),o.ifModified&&(r.lastModified[f]&&y.setRequestHeader("If-Modified-Since",r.lastModified[f]),r.etag[f]&&y.setRequestHeader("If-None-Match",r.etag[f])),(o.data&&o.hasContent&&o.contentType!==!1||c.contentType)&&y.setRequestHeader("Content-Type",o.contentType),y.setRequestHeader("Accept",o.dataTypes[0]&&o.accepts[o.dataTypes[0]]?o.accepts[o.dataTypes[0]]+("*"!==o.dataTypes[0]?", "+Kb+"; q=0.01":""):o.accepts["*"]);for(m in o.headers)y.setRequestHeader(m,o.headers[m]);if(o.beforeSend&&(o.beforeSend.call(p,y,o)===!1||k))return y.abort();if(x="abort",t.add(o.complete),y.done(o.success),y.fail(o.error),e=Nb(Jb,o,c,y)){if(y.readyState=1,l&&q.trigger("ajaxSend",[y,o]),k)return y;o.async&&o.timeout>0&&(i=a.setTimeout(function(){y.abort("timeout")},o.timeout));try{k=!1,e.send(v,A)}catch(z){if(k)throw z;A(-1,z)}}else A(-1,"No Transport");function A(b,c,d,h){var j,m,n,v,w,x=c;k||(k=!0,i&&a.clearTimeout(i),e=void 0,g=h||"",y.readyState=b>0?4:0,j=b>=200&&b<300||304===b,d&&(v=Pb(o,y,d)),v=Qb(o,v,y,j),j?(o.ifModified&&(w=y.getResponseHeader("Last-Modified"),w&&(r.lastModified[f]=w),w=y.getResponseHeader("etag"),w&&(r.etag[f]=w)),204===b||"HEAD"===o.type?x="nocontent":304===b?x="notmodified":(x=v.state,m=v.data,n=v.error,j=!n)):(n=x,!b&&x||(x="error",b<0&&(b=0))),y.status=b,y.statusText=(c||x)+"",j?s.resolveWith(p,[m,x,y]):s.rejectWith(p,[y,x,n]),y.statusCode(u),u=void 0,l&&q.trigger(j?"ajaxSuccess":"ajaxError",[y,o,j?m:n]),t.fireWith(p,[y,x]),l&&(q.trigger("ajaxComplete",[y,o]),--r.active||r.event.trigger("ajaxStop")))}return y},getJSON:function(a,b,c){return r.get(a,b,c,"json")},getScript:function(a,b){return r.get(a,void 0,b,"script")}}),r.each(["get","post"],function(a,b){r[b]=function(a,c,d,e){return r.isFunction(c)&&(e=e||d,d=c,c=void 0),r.ajax(r.extend({url:a,type:b,dataType:e,data:c,success:d},r.isPlainObject(a)&&a))}}),r._evalUrl=function(a){return r.ajax({url:a,type:"GET",dataType:"script",cache:!0,async:!1,global:!1,"throws":!0})},r.fn.extend({wrapAll:function(a){var b;return this[0]&&(r.isFunction(a)&&(a=a.call(this[0])),b=r(a,this[0].ownerDocument).eq(0).clone(!0),this[0].parentNode&&b.insertBefore(this[0]),b.map(function(){var a=this;while(a.firstElementChild)a=a.firstElementChild;return a}).append(this)),this},wrapInner:function(a){return r.isFunction(a)?this.each(function(b){r(this).wrapInner(a.call(this,b))}):this.each(function(){var b=r(this),c=b.contents();c.length?c.wrapAll(a):b.append(a)})},wrap:function(a){var b=r.isFunction(a);return this.each(function(c){r(this).wrapAll(b?a.call(this,c):a)})},unwrap:function(a){return this.parent(a).not("body").each(function(){r(this).replaceWith(this.childNodes)}),this}}),r.expr.pseudos.hidden=function(a){return!r.expr.pseudos.visible(a)},r.expr.pseudos.visible=function(a){return!!(a.offsetWidth||a.offsetHeight||a.getClientRects().length)},r.ajaxSettings.xhr=function(){try{return new a.XMLHttpRequest}catch(b){}};var Rb={0:200,1223:204},Sb=r.ajaxSettings.xhr();o.cors=!!Sb&&"withCredentials"in Sb,o.ajax=Sb=!!Sb,r.ajaxTransport(function(b){var c,d;if(o.cors||Sb&&!b.crossDomain)return{send:function(e,f){var g,h=b.xhr();if(h.open(b.type,b.url,b.async,b.username,b.password),b.xhrFields)for(g in b.xhrFields)h[g]=b.xhrFields[g];b.mimeType&&h.overrideMimeType&&h.overrideMimeType(b.mimeType),b.crossDomain||e["X-Requested-With"]||(e["X-Requested-With"]="XMLHttpRequest");for(g in e)h.setRequestHeader(g,e[g]);c=function(a){return function(){c&&(c=d=h.onload=h.onerror=h.onabort=h.onreadystatechange=null,"abort"===a?h.abort():"error"===a?"number"!=typeof h.status?f(0,"error"):f(h.status,h.statusText):f(Rb[h.status]||h.status,h.statusText,"text"!==(h.responseType||"text")||"string"!=typeof h.responseText?{binary:h.response}:{text:h.responseText},h.getAllResponseHeaders()))}},h.onload=c(),d=h.onerror=c("error"),void 0!==h.onabort?h.onabort=d:h.onreadystatechange=function(){4===h.readyState&&a.setTimeout(function(){c&&d()})},c=c("abort");try{h.send(b.hasContent&&b.data||null)}catch(i){if(c)throw i}},abort:function(){c&&c()}}}),r.ajaxPrefilter(function(a){a.crossDomain&&(a.contents.script=!1)}),r.ajaxSetup({accepts:{script:"text/javascript, application/javascript, application/ecmascript, application/x-ecmascript"},contents:{script:/\b(?:java|ecma)script\b/},converters:{"text script":function(a){return r.globalEval(a),a}}}),r.ajaxPrefilter("script",function(a){void 0===a.cache&&(a.cache=!1),a.crossDomain&&(a.type="GET")}),r.ajaxTransport("script",function(a){if(a.crossDomain){var b,c;return{send:function(e,f){b=r("<script>").prop({charset:a.scriptCharset,src:a.url}).on("load error",c=function(a){b.remove(),c=null,a&&f("error"===a.type?404:200,a.type)}),d.head.appendChild(b[0])},abort:function(){c&&c()}}}});var Tb=[],Ub=/(=)\?(?=&|$)|\?\?/;r.ajaxSetup({jsonp:"callback",jsonpCallback:function(){var a=Tb.pop()||r.expando+"_"+ub++;return this[a]=!0,a}}),r.ajaxPrefilter("json jsonp",function(b,c,d){var e,f,g,h=b.jsonp!==!1&&(Ub.test(b.url)?"url":"string"==typeof b.data&&0===(b.contentType||"").indexOf("application/x-www-form-urlencoded")&&Ub.test(b.data)&&"data");if(h||"jsonp"===b.dataTypes[0])return e=b.jsonpCallback=r.isFunction(b.jsonpCallback)?b.jsonpCallback():b.jsonpCallback,h?b[h]=b[h].replace(Ub,"$1"+e):b.jsonp!==!1&&(b.url+=(vb.test(b.url)?"&":"?")+b.jsonp+"="+e),b.converters["script json"]=function(){return g||r.error(e+" was not called"),g[0]},b.dataTypes[0]="json",f=a[e],a[e]=function(){g=arguments},d.always(function(){void 0===f?r(a).removeProp(e):a[e]=f,b[e]&&(b.jsonpCallback=c.jsonpCallback,Tb.push(e)),g&&r.isFunction(f)&&f(g[0]),g=f=void 0}),"script"}),o.createHTMLDocument=function(){var a=d.implementation.createHTMLDocument("").body;return a.innerHTML="<form></form><form></form>",2===a.childNodes.length}(),r.parseHTML=function(a,b,c){if("string"!=typeof a)return[];"boolean"==typeof b&&(c=b,b=!1);var e,f,g;return b||(o.createHTMLDocument?(b=d.implementation.createHTMLDocument(""),e=b.createElement("base"),e.href=d.location.href,b.head.appendChild(e)):b=d),f=C.exec(a),g=!c&&[],f?[b.createElement(f[1])]:(f=qa([a],b,g),g&&g.length&&r(g).remove(),r.merge([],f.childNodes))},r.fn.load=function(a,b,c){var d,e,f,g=this,h=a.indexOf(" ");return h>-1&&(d=pb(a.slice(h)),a=a.slice(0,h)),r.isFunction(b)?(c=b,b=void 0):b&&"object"==typeof b&&(e="POST"),g.length>0&&r.ajax({url:a,type:e||"GET",dataType:"html",data:b}).done(function(a){f=arguments,g.html(d?r("<div>").append(r.parseHTML(a)).find(d):a)}).always(c&&function(a,b){g.each(function(){c.apply(this,f||[a.responseText,b,a])})}),this},r.each(["ajaxStart","ajaxStop","ajaxComplete","ajaxError","ajaxSuccess","ajaxSend"],function(a,b){r.fn[b]=function(a){return this.on(b,a)}}),r.expr.pseudos.animated=function(a){return r.grep(r.timers,function(b){return a===b.elem}).length},r.offset={setOffset:function(a,b,c){var d,e,f,g,h,i,j,k=r.css(a,"position"),l=r(a),m={};"static"===k&&(a.style.position="relative"),h=l.offset(),f=r.css(a,"top"),i=r.css(a,"left"),j=("absolute"===k||"fixed"===k)&&(f+i).indexOf("auto")>-1,j?(d=l.position(),g=d.top,e=d.left):(g=parseFloat(f)||0,e=parseFloat(i)||0),r.isFunction(b)&&(b=b.call(a,c,r.extend({},h))),null!=b.top&&(m.top=b.top-h.top+g),null!=b.left&&(m.left=b.left-h.left+e),"using"in b?b.using.call(a,m):l.css(m)}},r.fn.extend({offset:function(a){if(arguments.length)return void 0===a?this:this.each(function(b){r.offset.setOffset(this,a,b)});var b,c,d,e,f=this[0];if(f)return f.getClientRects().length?(d=f.getBoundingClientRect(),b=f.ownerDocument,c=b.documentElement,e=b.defaultView,{top:d.top+e.pageYOffset-c.clientTop,left:d.left+e.pageXOffset-c.clientLeft}):{top:0,left:0}},position:function(){if(this[0]){var a,b,c=this[0],d={top:0,left:0};return"fixed"===r.css(c,"position")?b=c.getBoundingClientRect():(a=this.offsetParent(),b=this.offset(),B(a[0],"html")||(d=a.offset()),d={top:d.top+r.css(a[0],"borderTopWidth",!0),left:d.left+r.css(a[0],"borderLeftWidth",!0)}),{top:b.top-d.top-r.css(c,"marginTop",!0),left:b.left-d.left-r.css(c,"marginLeft",!0)}}},offsetParent:function(){return this.map(function(){var a=this.offsetParent;while(a&&"static"===r.css(a,"position"))a=a.offsetParent;return a||ra})}}),r.each({scrollLeft:"pageXOffset",scrollTop:"pageYOffset"},function(a,b){var c="pageYOffset"===b;r.fn[a]=function(d){return T(this,function(a,d,e){var f;return r.isWindow(a)?f=a:9===a.nodeType&&(f=a.defaultView),void 0===e?f?f[b]:a[d]:void(f?f.scrollTo(c?f.pageXOffset:e,c?e:f.pageYOffset):a[d]=e)},a,d,arguments.length)}}),r.each(["top","left"],function(a,b){r.cssHooks[b]=Pa(o.pixelPosition,function(a,c){if(c)return c=Oa(a,b),Ma.test(c)?r(a).position()[b]+"px":c})}),r.each({Height:"height",Width:"width"},function(a,b){r.each({padding:"inner"+a,content:b,"":"outer"+a},function(c,d){r.fn[d]=function(e,f){var g=arguments.length&&(c||"boolean"!=typeof e),h=c||(e===!0||f===!0?"margin":"border");return T(this,function(b,c,e){var f;return r.isWindow(b)?0===d.indexOf("outer")?b["inner"+a]:b.document.documentElement["client"+a]:9===b.nodeType?(f=b.documentElement,Math.max(b.body["scroll"+a],f["scroll"+a],b.body["offset"+a],f["offset"+a],f["client"+a])):void 0===e?r.css(b,c,h):r.style(b,c,e,h)},b,g?e:void 0,g)}})}),r.fn.extend({bind:function(a,b,c){return this.on(a,null,b,c)},unbind:function(a,b){return this.off(a,null,b)},delegate:function(a,b,c,d){return this.on(b,a,c,d)},undelegate:function(a,b,c){return 1===arguments.length?this.off(a,"**"):this.off(b,a||"**",c)}}),r.holdReady=function(a){a?r.readyWait++:r.ready(!0)},r.isArray=Array.isArray,r.parseJSON=JSON.parse,r.nodeName=B,"function"==typeof define&&define.amd&&define("jquery",[],function(){return r});var Vb=a.jQuery,Wb=a.$;return r.noConflict=function(b){return a.$===r&&(a.$=Wb),b&&a.jQuery===r&&(a.jQuery=Vb),r},b||(a.jQuery=a.$=r),r});
diff --git a/ee/bulk-operations-dashboard/assets/dependencies/lodash.js b/ee/bulk-operations-dashboard/assets/dependencies/lodash.js
new file mode 100644
index 0000000000..e9c36347a0
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/dependencies/lodash.js
@@ -0,0 +1,12596 @@
+/////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+// For info about this version of lodash, see https://npmjs.com/package/@sailshq/lodash
+/////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+
+/////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+// Originally from https://github.com/lodash/lodash/blob/3.10.1/lodash.src.js
+/////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+//
+// Patches:
+//
+// ### Wed Nov 2, 2016
+// I added a hotfix based on https://github.com/lodash/lodash/commit/95bc54a3ddc7a25f5e134f5b376a0d1d96118f49
+// in order to solve https://github.com/lodash/lodash/issues/2768.
+// -@mikermcneil
+//
+/////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+
+/**
+ * @license
+ * lodash 3.10.2 <https://github.com/sailshq/lodash>
+ * A fork of Lodash 3.10.1 <https://lodash.com/> with minor patches made by Mike McNeil.
+ * Copyright 2012-2015 The Dojo Foundation <http://dojofoundation.org/>
+ * Based on Underscore.js 1.8.3 <http://underscorejs.org/LICENSE>
+ * Copyright 2009-2015 Jeremy Ashkenas, DocumentCloud and Investigative Reporters & Editors
+ * Available under MIT license <https://lodash.com/license>
+ */
+;(function() {
+
+  /** Used as a safe reference for `undefined` in pre-ES5 environments. */
+  var undefined;
+
+  /** Used as the semantic version number. */
+  var VERSION = '3.10.2';
+
+  /** Used to compose bitmasks for wrapper metadata. */
+  var BIND_FLAG = 1,
+      BIND_KEY_FLAG = 2,
+      CURRY_BOUND_FLAG = 4,
+      CURRY_FLAG = 8,
+      CURRY_RIGHT_FLAG = 16,
+      PARTIAL_FLAG = 32,
+      PARTIAL_RIGHT_FLAG = 64,
+      ARY_FLAG = 128,
+      REARG_FLAG = 256;
+
+  /** Used as default options for `_.trunc`. */
+  var DEFAULT_TRUNC_LENGTH = 30,
+      DEFAULT_TRUNC_OMISSION = '...';
+
+  /** Used to detect when a function becomes hot. */
+  var HOT_COUNT = 150,
+      HOT_SPAN = 16;
+
+  /** Used as the size to enable large array optimizations. */
+  var LARGE_ARRAY_SIZE = 200;
+
+  /** Used to indicate the type of lazy iteratees. */
+  var LAZY_FILTER_FLAG = 1,
+      LAZY_MAP_FLAG = 2;
+
+  /** Used as the `TypeError` message for "Functions" methods. */
+  var FUNC_ERROR_TEXT = 'Expected a function';
+
+  /** Used as the internal argument placeholder. */
+  var PLACEHOLDER = '__lodash_placeholder__';
+
+  /** `Object#toString` result references. */
+  var argsTag = '[object Arguments]',
+      arrayTag = '[object Array]',
+      // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+      // Patched from https://github.com/lodash/lodash/blob/95bc54a3ddc7a25f5e134f5b376a0d1d96118f49/lodash.js#L86-L108
+      asyncTag = '[object AsyncFunction]',
+      genTag = '[object GeneratorFunction]',
+      proxyTag = '[object Proxy]',
+      // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+      boolTag = '[object Boolean]',
+      dateTag = '[object Date]',
+      errorTag = '[object Error]',
+      funcTag = '[object Function]',
+      mapTag = '[object Map]',
+      numberTag = '[object Number]',
+      objectTag = '[object Object]',
+      regexpTag = '[object RegExp]',
+      setTag = '[object Set]',
+      stringTag = '[object String]',
+      weakMapTag = '[object WeakMap]';
+
+  var arrayBufferTag = '[object ArrayBuffer]',
+      float32Tag = '[object Float32Array]',
+      float64Tag = '[object Float64Array]',
+      int8Tag = '[object Int8Array]',
+      int16Tag = '[object Int16Array]',
+      int32Tag = '[object Int32Array]',
+      uint8Tag = '[object Uint8Array]',
+      uint8ClampedTag = '[object Uint8ClampedArray]',
+      uint16Tag = '[object Uint16Array]',
+      uint32Tag = '[object Uint32Array]';
+
+  /** Used to match empty string literals in compiled template source. */
+  var reEmptyStringLeading = /\b__p \+= '';/g,
+      reEmptyStringMiddle = /\b(__p \+=) '' \+/g,
+      reEmptyStringTrailing = /(__e\(.*?\)|\b__t\)) \+\n'';/g;
+
+  /** Used to match HTML entities and HTML characters. */
+  var reEscapedHtml = /&(?:amp|lt|gt|quot|#39|#96);/g,
+      reUnescapedHtml = /[&<>"'`]/g,
+      reHasEscapedHtml = RegExp(reEscapedHtml.source),
+      reHasUnescapedHtml = RegExp(reUnescapedHtml.source);
+
+  /** Used to match template delimiters. */
+  var reEscape = /<%-([\s\S]+?)%>/g,
+      reEvaluate = /<%([\s\S]+?)%>/g,
+      reInterpolate = /<%=([\s\S]+?)%>/g;
+
+  /** Used to match property names within property paths. */
+  var reIsDeepProp = /\.|\[(?:[^[\]]*|(["'])(?:(?!\1)[^\n\\]|\\.)*?\1)\]/,
+      reIsPlainProp = /^\w*$/,
+      rePropName = /[^.[\]]+|\[(?:(-?\d+(?:\.\d+)?)|(["'])((?:(?!\2)[^\n\\]|\\.)*?)\2)\]/g;
+
+  /**
+   * Used to match `RegExp` [syntax characters](http://ecma-international.org/ecma-262/6.0/#sec-patterns)
+   * and those outlined by [`EscapeRegExpPattern`](http://ecma-international.org/ecma-262/6.0/#sec-escaperegexppattern).
+   */
+  var reRegExpChars = /^[:!,]|[\\^$.*+?()[\]{}|\/]|(^[0-9a-fA-Fnrtuvx])|([\n\r\u2028\u2029])/g,
+      reHasRegExpChars = RegExp(reRegExpChars.source);
+
+  /** Used to match [combining diacritical marks](https://en.wikipedia.org/wiki/Combining_Diacritical_Marks). */
+  var reComboMark = /[\u0300-\u036f\ufe20-\ufe23]/g;
+
+  /** Used to match backslashes in property paths. */
+  var reEscapeChar = /\\(\\)?/g;
+
+  /** Used to match [ES template delimiters](http://ecma-international.org/ecma-262/6.0/#sec-template-literal-lexical-components). */
+  var reEsTemplate = /\$\{([^\\}]*(?:\\.[^\\}]*)*)\}/g;
+
+  /** Used to match `RegExp` flags from their coerced string values. */
+  var reFlags = /\w*$/;
+
+  /** Used to detect hexadecimal string values. */
+  var reHasHexPrefix = /^0[xX]/;
+
+  /** Used to detect host constructors (Safari > 5). */
+  var reIsHostCtor = /^\[object .+?Constructor\]$/;
+
+  /** Used to detect unsigned integer values. */
+  var reIsUint = /^\d+$/;
+
+  /** Used to match latin-1 supplementary letters (excluding mathematical operators). */
+  var reLatin1 = /[\xc0-\xd6\xd8-\xde\xdf-\xf6\xf8-\xff]/g;
+
+  /** Used to ensure capturing order of template delimiters. */
+  var reNoMatch = /($^)/;
+
+  /** Used to match unescaped characters in compiled string literals. */
+  var reUnescapedString = /['\n\r\u2028\u2029\\]/g;
+
+  /** Used to match words to create compound words. */
+  var reWords = (function() {
+    var upper = '[A-Z\\xc0-\\xd6\\xd8-\\xde]',
+        lower = '[a-z\\xdf-\\xf6\\xf8-\\xff]+';
+
+    return RegExp(upper + '+(?=' + upper + lower + ')|' + upper + '?' + lower + '|' + upper + '+|[0-9]+', 'g');
+  }());
+
+  /** Used to assign default `context` object properties. */
+  var contextProps = [
+    'Array', 'ArrayBuffer', 'Date', 'Error', 'Float32Array', 'Float64Array',
+    'Function', 'Int8Array', 'Int16Array', 'Int32Array', 'Math', 'Number',
+    'Object', 'RegExp', 'Set', 'String', '_', 'clearTimeout', 'isFinite',
+    'parseFloat', 'parseInt', 'setTimeout', 'TypeError', 'Uint8Array',
+    'Uint8ClampedArray', 'Uint16Array', 'Uint32Array', 'WeakMap'
+  ];
+
+  /** Used to fix the JScript `[[DontEnum]]` bug. */
+  var shadowProps = [
+    'constructor', 'hasOwnProperty', 'isPrototypeOf', 'propertyIsEnumerable',
+    'toLocaleString', 'toString', 'valueOf'
+  ];
+
+  /** Used to make template sourceURLs easier to identify. */
+  var templateCounter = -1;
+
+  /** Used to identify `toStringTag` values of typed arrays. */
+  var typedArrayTags = {};
+  typedArrayTags[float32Tag] = typedArrayTags[float64Tag] =
+  typedArrayTags[int8Tag] = typedArrayTags[int16Tag] =
+  typedArrayTags[int32Tag] = typedArrayTags[uint8Tag] =
+  typedArrayTags[uint8ClampedTag] = typedArrayTags[uint16Tag] =
+  typedArrayTags[uint32Tag] = true;
+  typedArrayTags[argsTag] = typedArrayTags[arrayTag] =
+  typedArrayTags[arrayBufferTag] = typedArrayTags[boolTag] =
+  typedArrayTags[dateTag] = typedArrayTags[errorTag] =
+  typedArrayTags[funcTag] = typedArrayTags[mapTag] =
+  typedArrayTags[numberTag] = typedArrayTags[objectTag] =
+  typedArrayTags[regexpTag] = typedArrayTags[setTag] =
+  typedArrayTags[stringTag] = typedArrayTags[weakMapTag] = false;
+
+  /** Used to identify `toStringTag` values supported by `_.clone`. */
+  var cloneableTags = {};
+  cloneableTags[argsTag] = cloneableTags[arrayTag] =
+  cloneableTags[arrayBufferTag] = cloneableTags[boolTag] =
+  cloneableTags[dateTag] = cloneableTags[float32Tag] =
+  cloneableTags[float64Tag] = cloneableTags[int8Tag] =
+  cloneableTags[int16Tag] = cloneableTags[int32Tag] =
+  cloneableTags[numberTag] = cloneableTags[objectTag] =
+  cloneableTags[regexpTag] = cloneableTags[stringTag] =
+  cloneableTags[uint8Tag] = cloneableTags[uint8ClampedTag] =
+  cloneableTags[uint16Tag] = cloneableTags[uint32Tag] = true;
+  cloneableTags[errorTag] = cloneableTags[funcTag] =
+  cloneableTags[mapTag] = cloneableTags[setTag] =
+  cloneableTags[weakMapTag] = false;
+
+  /** Used to map latin-1 supplementary letters to basic latin letters. */
+  var deburredLetters = {
+    '\xc0': 'A',  '\xc1': 'A', '\xc2': 'A', '\xc3': 'A', '\xc4': 'A', '\xc5': 'A',
+    '\xe0': 'a',  '\xe1': 'a', '\xe2': 'a', '\xe3': 'a', '\xe4': 'a', '\xe5': 'a',
+    '\xc7': 'C',  '\xe7': 'c',
+    '\xd0': 'D',  '\xf0': 'd',
+    '\xc8': 'E',  '\xc9': 'E', '\xca': 'E', '\xcb': 'E',
+    '\xe8': 'e',  '\xe9': 'e', '\xea': 'e', '\xeb': 'e',
+    '\xcC': 'I',  '\xcd': 'I', '\xce': 'I', '\xcf': 'I',
+    '\xeC': 'i',  '\xed': 'i', '\xee': 'i', '\xef': 'i',
+    '\xd1': 'N',  '\xf1': 'n',
+    '\xd2': 'O',  '\xd3': 'O', '\xd4': 'O', '\xd5': 'O', '\xd6': 'O', '\xd8': 'O',
+    '\xf2': 'o',  '\xf3': 'o', '\xf4': 'o', '\xf5': 'o', '\xf6': 'o', '\xf8': 'o',
+    '\xd9': 'U',  '\xda': 'U', '\xdb': 'U', '\xdc': 'U',
+    '\xf9': 'u',  '\xfa': 'u', '\xfb': 'u', '\xfc': 'u',
+    '\xdd': 'Y',  '\xfd': 'y', '\xff': 'y',
+    '\xc6': 'Ae', '\xe6': 'ae',
+    '\xde': 'Th', '\xfe': 'th',
+    '\xdf': 'ss'
+  };
+
+  /** Used to map characters to HTML entities. */
+  var htmlEscapes = {
+    '&': '&amp;',
+    '<': '&lt;',
+    '>': '&gt;',
+    '"': '&quot;',
+    "'": '&#39;',
+    '`': '&#96;'
+  };
+
+  /** Used to map HTML entities to characters. */
+  var htmlUnescapes = {
+    '&amp;': '&',
+    '&lt;': '<',
+    '&gt;': '>',
+    '&quot;': '"',
+    '&#39;': "'",
+    '&#96;': '`'
+  };
+
+  /** Used to determine if values are of the language type `Object`. */
+  var objectTypes = {
+    'function': true,
+    'object': true
+  };
+
+  /** Used to escape characters for inclusion in compiled regexes. */
+  var regexpEscapes = {
+    '0': 'x30', '1': 'x31', '2': 'x32', '3': 'x33', '4': 'x34',
+    '5': 'x35', '6': 'x36', '7': 'x37', '8': 'x38', '9': 'x39',
+    'A': 'x41', 'B': 'x42', 'C': 'x43', 'D': 'x44', 'E': 'x45', 'F': 'x46',
+    'a': 'x61', 'b': 'x62', 'c': 'x63', 'd': 'x64', 'e': 'x65', 'f': 'x66',
+    'n': 'x6e', 'r': 'x72', 't': 'x74', 'u': 'x75', 'v': 'x76', 'x': 'x78'
+  };
+
+  /** Used to escape characters for inclusion in compiled string literals. */
+  var stringEscapes = {
+    '\\': '\\',
+    "'": "'",
+    '\n': 'n',
+    '\r': 'r',
+    '\u2028': 'u2028',
+    '\u2029': 'u2029'
+  };
+
+  /** Detect free variable `exports`. */
+  var freeExports = objectTypes[typeof exports] && exports && !exports.nodeType && exports;
+
+  /** Detect free variable `module`. */
+  var freeModule = objectTypes[typeof module] && module && !module.nodeType && module;
+
+  /** Detect free variable `global` from Node.js. */
+  var freeGlobal = freeExports && freeModule && typeof global == 'object' && global && global.Object && global;
+
+  /** Detect free variable `self`. */
+  var freeSelf = objectTypes[typeof self] && self && self.Object && self;
+
+  /** Detect free variable `window`. */
+  var freeWindow = objectTypes[typeof window] && window && window.Object && window;
+
+  /** Detect the popular CommonJS extension `module.exports`. */
+  var moduleExports = freeModule && freeModule.exports === freeExports && freeExports;
+
+  /**
+   * Used as a reference to the global object.
+   *
+   * The `this` value is used if it's the global object to avoid Greasemonkey's
+   * restricted `window` object, otherwise the `window` object is used.
+   */
+  var root = freeGlobal || ((freeWindow !== (this && this.window)) && freeWindow) || freeSelf || this;
+
+  /*--------------------------------------------------------------------------*/
+
+  /**
+   * The base implementation of `compareAscending` which compares values and
+   * sorts them in ascending order without guaranteeing a stable sort.
+   *
+   * @private
+   * @param {*} value The value to compare.
+   * @param {*} other The other value to compare.
+   * @returns {number} Returns the sort order indicator for `value`.
+   */
+  function baseCompareAscending(value, other) {
+    if (value !== other) {
+      var valIsNull = value === null,
+          valIsUndef = value === undefined,
+          valIsReflexive = value === value;
+
+      var othIsNull = other === null,
+          othIsUndef = other === undefined,
+          othIsReflexive = other === other;
+
+      if ((value > other && !othIsNull) || !valIsReflexive ||
+          (valIsNull && !othIsUndef && othIsReflexive) ||
+          (valIsUndef && othIsReflexive)) {
+        return 1;
+      }
+      if ((value < other && !valIsNull) || !othIsReflexive ||
+          (othIsNull && !valIsUndef && valIsReflexive) ||
+          (othIsUndef && valIsReflexive)) {
+        return -1;
+      }
+    }
+    return 0;
+  }
+
+  /**
+   * The base implementation of `_.findIndex` and `_.findLastIndex` without
+   * support for callback shorthands and `this` binding.
+   *
+   * @private
+   * @param {Array} array The array to search.
+   * @param {Function} predicate The function invoked per iteration.
+   * @param {boolean} [fromRight] Specify iterating from right to left.
+   * @returns {number} Returns the index of the matched value, else `-1`.
+   */
+  function baseFindIndex(array, predicate, fromRight) {
+    var length = array.length,
+        index = fromRight ? length : -1;
+
+    while ((fromRight ? index-- : ++index < length)) {
+      if (predicate(array[index], index, array)) {
+        return index;
+      }
+    }
+    return -1;
+  }
+
+  /**
+   * The base implementation of `_.indexOf` without support for binary searches.
+   *
+   * @private
+   * @param {Array} array The array to search.
+   * @param {*} value The value to search for.
+   * @param {number} fromIndex The index to search from.
+   * @returns {number} Returns the index of the matched value, else `-1`.
+   */
+  function baseIndexOf(array, value, fromIndex) {
+    if (value !== value) {
+      return indexOfNaN(array, fromIndex);
+    }
+    var index = fromIndex - 1,
+        length = array.length;
+
+    while (++index < length) {
+      if (array[index] === value) {
+        return index;
+      }
+    }
+    return -1;
+  }
+
+  /**
+   * The base implementation of `_.isFunction` without support for environments
+   * with incorrect `typeof` results.
+   *
+   * @private
+   * @param {*} value The value to check.
+   * @returns {boolean} Returns `true` if `value` is correctly classified, else `false`.
+   */
+  function baseIsFunction(value) {
+    // Avoid a Chakra JIT bug in compatibility modes of IE 11.
+    // See https://github.com/jashkenas/underscore/issues/1621 for more details.
+    return typeof value == 'function' || false;
+  }
+
+  /**
+   * Converts `value` to a string if it's not one. An empty string is returned
+   * for `null` or `undefined` values.
+   *
+   * @private
+   * @param {*} value The value to process.
+   * @returns {string} Returns the string.
+   */
+  function baseToString(value) {
+    return value == null ? '' : (value + '');
+  }
+
+  /**
+   * Used by `_.trim` and `_.trimLeft` to get the index of the first character
+   * of `string` that is not found in `chars`.
+   *
+   * @private
+   * @param {string} string The string to inspect.
+   * @param {string} chars The characters to find.
+   * @returns {number} Returns the index of the first character not found in `chars`.
+   */
+  function charsLeftIndex(string, chars) {
+    var index = -1,
+        length = string.length;
+
+    while (++index < length && chars.indexOf(string.charAt(index)) > -1) {}
+    return index;
+  }
+
+  /**
+   * Used by `_.trim` and `_.trimRight` to get the index of the last character
+   * of `string` that is not found in `chars`.
+   *
+   * @private
+   * @param {string} string The string to inspect.
+   * @param {string} chars The characters to find.
+   * @returns {number} Returns the index of the last character not found in `chars`.
+   */
+  function charsRightIndex(string, chars) {
+    var index = string.length;
+
+    while (index-- && chars.indexOf(string.charAt(index)) > -1) {}
+    return index;
+  }
+
+  /**
+   * Used by `_.sortBy` to compare transformed elements of a collection and stable
+   * sort them in ascending order.
+   *
+   * @private
+   * @param {Object} object The object to compare.
+   * @param {Object} other The other object to compare.
+   * @returns {number} Returns the sort order indicator for `object`.
+   */
+  function compareAscending(object, other) {
+    return baseCompareAscending(object.criteria, other.criteria) || (object.index - other.index);
+  }
+
+  /**
+   * Used by `_.sortByOrder` to compare multiple properties of a value to another
+   * and stable sort them.
+   *
+   * If `orders` is unspecified, all valuess are sorted in ascending order. Otherwise,
+   * a value is sorted in ascending order if its corresponding order is "asc", and
+   * descending if "desc".
+   *
+   * @private
+   * @param {Object} object The object to compare.
+   * @param {Object} other The other object to compare.
+   * @param {boolean[]} orders The order to sort by for each property.
+   * @returns {number} Returns the sort order indicator for `object`.
+   */
+  function compareMultiple(object, other, orders) {
+    var index = -1,
+        objCriteria = object.criteria,
+        othCriteria = other.criteria,
+        length = objCriteria.length,
+        ordersLength = orders.length;
+
+    while (++index < length) {
+      var result = baseCompareAscending(objCriteria[index], othCriteria[index]);
+      if (result) {
+        if (index >= ordersLength) {
+          return result;
+        }
+        var order = orders[index];
+        return result * ((order === 'asc' || order === true) ? 1 : -1);
+      }
+    }
+    // Fixes an `Array#sort` bug in the JS engine embedded in Adobe applications
+    // that causes it, under certain circumstances, to provide the same value for
+    // `object` and `other`. See https://github.com/jashkenas/underscore/pull/1247
+    // for more details.
+    //
+    // This also ensures a stable sort in V8 and other engines.
+    // See https://code.google.com/p/v8/issues/detail?id=90 for more details.
+    return object.index - other.index;
+  }
+
+  /**
+   * Used by `_.deburr` to convert latin-1 supplementary letters to basic latin letters.
+   *
+   * @private
+   * @param {string} letter The matched letter to deburr.
+   * @returns {string} Returns the deburred letter.
+   */
+  function deburrLetter(letter) {
+    return deburredLetters[letter];
+  }
+
+  /**
+   * Used by `_.escape` to convert characters to HTML entities.
+   *
+   * @private
+   * @param {string} chr The matched character to escape.
+   * @returns {string} Returns the escaped character.
+   */
+  function escapeHtmlChar(chr) {
+    return htmlEscapes[chr];
+  }
+
+  /**
+   * Used by `_.escapeRegExp` to escape characters for inclusion in compiled regexes.
+   *
+   * @private
+   * @param {string} chr The matched character to escape.
+   * @param {string} leadingChar The capture group for a leading character.
+   * @param {string} whitespaceChar The capture group for a whitespace character.
+   * @returns {string} Returns the escaped character.
+   */
+  function escapeRegExpChar(chr, leadingChar, whitespaceChar) {
+    if (leadingChar) {
+      chr = regexpEscapes[chr];
+    } else if (whitespaceChar) {
+      chr = stringEscapes[chr];
+    }
+    return '\\' + chr;
+  }
+
+  /**
+   * Used by `_.template` to escape characters for inclusion in compiled string literals.
+   *
+   * @private
+   * @param {string} chr The matched character to escape.
+   * @returns {string} Returns the escaped character.
+   */
+  function escapeStringChar(chr) {
+    return '\\' + stringEscapes[chr];
+  }
+
+  /**
+   * Gets the index at which the first occurrence of `NaN` is found in `array`.
+   *
+   * @private
+   * @param {Array} array The array to search.
+   * @param {number} fromIndex The index to search from.
+   * @param {boolean} [fromRight] Specify iterating from right to left.
+   * @returns {number} Returns the index of the matched `NaN`, else `-1`.
+   */
+  function indexOfNaN(array, fromIndex, fromRight) {
+    var length = array.length,
+        index = fromIndex + (fromRight ? 0 : -1);
+
+    while ((fromRight ? index-- : ++index < length)) {
+      var other = array[index];
+      if (other !== other) {
+        return index;
+      }
+    }
+    return -1;
+  }
+
+  /**
+   * Checks if `value` is a host object in IE < 9.
+   *
+   * @private
+   * @param {*} value The value to check.
+   * @returns {boolean} Returns `true` if `value` is a host object, else `false`.
+   */
+  var isHostObject = (function() {
+    try {
+      Object({ 'toString': 0 } + '');
+    } catch(e) {
+      return function() { return false; };
+    }
+    return function(value) {
+      // IE < 9 presents many host objects as `Object` objects that can coerce
+      // to strings despite having improperly defined `toString` methods.
+      return typeof value.toString != 'function' && typeof (value + '') == 'string';
+    };
+  }());
+
+  /**
+   * Checks if `value` is object-like.
+   *
+   * @private
+   * @param {*} value The value to check.
+   * @returns {boolean} Returns `true` if `value` is object-like, else `false`.
+   */
+  function isObjectLike(value) {
+    return !!value && typeof value == 'object';
+  }
+
+  /**
+   * Used by `trimmedLeftIndex` and `trimmedRightIndex` to determine if a
+   * character code is whitespace.
+   *
+   * @private
+   * @param {number} charCode The character code to inspect.
+   * @returns {boolean} Returns `true` if `charCode` is whitespace, else `false`.
+   */
+  function isSpace(charCode) {
+    return ((charCode <= 160 && (charCode >= 9 && charCode <= 13) || charCode == 32 || charCode == 160) || charCode == 5760 || charCode == 6158 ||
+      (charCode >= 8192 && (charCode <= 8202 || charCode == 8232 || charCode == 8233 || charCode == 8239 || charCode == 8287 || charCode == 12288 || charCode == 65279)));
+  }
+
+  /**
+   * Replaces all `placeholder` elements in `array` with an internal placeholder
+   * and returns an array of their indexes.
+   *
+   * @private
+   * @param {Array} array The array to modify.
+   * @param {*} placeholder The placeholder to replace.
+   * @returns {Array} Returns the new array of placeholder indexes.
+   */
+  function replaceHolders(array, placeholder) {
+    var index = -1,
+        length = array.length,
+        resIndex = -1,
+        result = [];
+
+    while (++index < length) {
+      if (array[index] === placeholder) {
+        array[index] = PLACEHOLDER;
+        result[++resIndex] = index;
+      }
+    }
+    return result;
+  }
+
+  /**
+   * An implementation of `_.uniq` optimized for sorted arrays without support
+   * for callback shorthands and `this` binding.
+   *
+   * @private
+   * @param {Array} array The array to inspect.
+   * @param {Function} [iteratee] The function invoked per iteration.
+   * @returns {Array} Returns the new duplicate free array.
+   */
+  function sortedUniq(array, iteratee) {
+    var seen,
+        index = -1,
+        length = array.length,
+        resIndex = -1,
+        result = [];
+
+    while (++index < length) {
+      var value = array[index],
+          computed = iteratee ? iteratee(value, index, array) : value;
+
+      if (!index || seen !== computed) {
+        seen = computed;
+        result[++resIndex] = value;
+      }
+    }
+    return result;
+  }
+
+  /**
+   * Used by `_.trim` and `_.trimLeft` to get the index of the first non-whitespace
+   * character of `string`.
+   *
+   * @private
+   * @param {string} string The string to inspect.
+   * @returns {number} Returns the index of the first non-whitespace character.
+   */
+  function trimmedLeftIndex(string) {
+    var index = -1,
+        length = string.length;
+
+    while (++index < length && isSpace(string.charCodeAt(index))) {}
+    return index;
+  }
+
+  /**
+   * Used by `_.trim` and `_.trimRight` to get the index of the last non-whitespace
+   * character of `string`.
+   *
+   * @private
+   * @param {string} string The string to inspect.
+   * @returns {number} Returns the index of the last non-whitespace character.
+   */
+  function trimmedRightIndex(string) {
+    var index = string.length;
+
+    while (index-- && isSpace(string.charCodeAt(index))) {}
+    return index;
+  }
+
+  /**
+   * Used by `_.unescape` to convert HTML entities to characters.
+   *
+   * @private
+   * @param {string} chr The matched character to unescape.
+   * @returns {string} Returns the unescaped character.
+   */
+  function unescapeHtmlChar(chr) {
+    return htmlUnescapes[chr];
+  }
+
+  /*--------------------------------------------------------------------------*/
+
+  /**
+   * Create a new pristine `lodash` function using the given `context` object.
+   *
+   * @static
+   * @memberOf _
+   * @category Utility
+   * @param {Object} [context=root] The context object.
+   * @returns {Function} Returns a new `lodash` function.
+   * @example
+   *
+   * _.mixin({ 'foo': _.constant('foo') });
+   *
+   * var lodash = _.runInContext();
+   * lodash.mixin({ 'bar': lodash.constant('bar') });
+   *
+   * _.isFunction(_.foo);
+   * // => true
+   * _.isFunction(_.bar);
+   * // => false
+   *
+   * lodash.isFunction(lodash.foo);
+   * // => false
+   * lodash.isFunction(lodash.bar);
+   * // => true
+   *
+   * // using `context` to mock `Date#getTime` use in `_.now`
+   * var mock = _.runInContext({
+   *   'Date': function() {
+   *     return { 'getTime': getTimeMock };
+   *   }
+   * });
+   *
+   * // or creating a suped-up `defer` in Node.js
+   * var defer = _.runInContext({ 'setTimeout': setImmediate }).defer;
+   */
+  function runInContext(context) {
+    // Avoid issues with some ES3 environments that attempt to use values, named
+    // after built-in constructors like `Object`, for the creation of literals.
+    // ES5 clears this up by stating that literals must use built-in constructors.
+    // See https://es5.github.io/#x11.1.5 for more details.
+    context = context ? _.defaults(root.Object(), context, _.pick(root, contextProps)) : root;
+
+    /** Native constructor references. */
+    var Array = context.Array,
+        Date = context.Date,
+        Error = context.Error,
+        Function = context.Function,
+        Math = context.Math,
+        Number = context.Number,
+        Object = context.Object,
+        RegExp = context.RegExp,
+        String = context.String,
+        TypeError = context.TypeError;
+
+    /** Used for native method references. */
+    var arrayProto = Array.prototype,
+        errorProto = Error.prototype,
+        objectProto = Object.prototype,
+        stringProto = String.prototype;
+
+    /** Used to resolve the decompiled source of functions. */
+    var fnToString = Function.prototype.toString;
+
+    /** Used to check objects for own properties. */
+    var hasOwnProperty = objectProto.hasOwnProperty;
+
+    /** Used to generate unique IDs. */
+    var idCounter = 0;
+
+    /**
+     * Used to resolve the [`toStringTag`](http://ecma-international.org/ecma-262/6.0/#sec-object.prototype.tostring)
+     * of values.
+     */
+    var objToString = objectProto.toString;
+
+    /** Used to restore the original `_` reference in `_.noConflict`. */
+    var oldDash = root._;
+
+    /** Used to detect if a method is native. */
+    var reIsNative = RegExp('^' +
+      fnToString.call(hasOwnProperty).replace(/[\\^$.*+?()[\]{}|]/g, '\\$&')
+      .replace(/hasOwnProperty|(function).*?(?=\\\()| for .+?(?=\\\])/g, '$1.*?') + '$'
+    );
+
+    /** Native method references. */
+    var ArrayBuffer = context.ArrayBuffer,
+        clearTimeout = context.clearTimeout,
+        parseFloat = context.parseFloat,
+        pow = Math.pow,
+        propertyIsEnumerable = objectProto.propertyIsEnumerable,
+        Set = getNative(context, 'Set'),
+        setTimeout = context.setTimeout,
+        splice = arrayProto.splice,
+        Uint8Array = context.Uint8Array,
+        WeakMap = getNative(context, 'WeakMap');
+
+    /* Native method references for those with the same name as other `lodash` methods. */
+    var nativeCeil = Math.ceil,
+        nativeCreate = getNative(Object, 'create'),
+        nativeFloor = Math.floor,
+        nativeIsArray = getNative(Array, 'isArray'),
+        nativeIsFinite = context.isFinite,
+        nativeKeys = getNative(Object, 'keys'),
+        nativeMax = Math.max,
+        nativeMin = Math.min,
+        nativeNow = getNative(Date, 'now'),
+        nativeParseInt = context.parseInt,
+        nativeRandom = Math.random;
+
+    /** Used as references for `-Infinity` and `Infinity`. */
+    var NEGATIVE_INFINITY = Number.NEGATIVE_INFINITY,
+        POSITIVE_INFINITY = Number.POSITIVE_INFINITY;
+
+    /** Used as references for the maximum length and index of an array. */
+    var MAX_ARRAY_LENGTH = 4294967295,
+        MAX_ARRAY_INDEX = MAX_ARRAY_LENGTH - 1,
+        HALF_MAX_ARRAY_LENGTH = MAX_ARRAY_LENGTH >>> 1;
+
+    /**
+     * Used as the [maximum length](http://ecma-international.org/ecma-262/6.0/#sec-number.max_safe_integer)
+     * of an array-like value.
+     */
+    var MAX_SAFE_INTEGER = 9007199254740991;
+
+    /** Used to store function metadata. */
+    var metaMap = WeakMap && new WeakMap;
+
+    /** Used to lookup unminified function names. */
+    var realNames = {};
+
+    /** Used to lookup a type array constructors by `toStringTag`. */
+    var ctorByTag = {};
+    ctorByTag[float32Tag] = context.Float32Array;
+    ctorByTag[float64Tag] = context.Float64Array;
+    ctorByTag[int8Tag] = context.Int8Array;
+    ctorByTag[int16Tag] = context.Int16Array;
+    ctorByTag[int32Tag] = context.Int32Array;
+    ctorByTag[uint8Tag] = Uint8Array;
+    ctorByTag[uint8ClampedTag] = context.Uint8ClampedArray;
+    ctorByTag[uint16Tag] = context.Uint16Array;
+    ctorByTag[uint32Tag] = context.Uint32Array;
+
+    /** Used to avoid iterating over non-enumerable properties in IE < 9. */
+    var nonEnumProps = {};
+    nonEnumProps[arrayTag] = nonEnumProps[dateTag] = nonEnumProps[numberTag] = { 'constructor': true, 'toLocaleString': true, 'toString': true, 'valueOf': true };
+    nonEnumProps[boolTag] = nonEnumProps[stringTag] = { 'constructor': true, 'toString': true, 'valueOf': true };
+    nonEnumProps[errorTag] = nonEnumProps[funcTag] = nonEnumProps[regexpTag] = { 'constructor': true, 'toString': true };
+    nonEnumProps[objectTag] = { 'constructor': true };
+
+    arrayEach(shadowProps, function(key) {
+      for (var tag in nonEnumProps) {
+        if (hasOwnProperty.call(nonEnumProps, tag)) {
+          var props = nonEnumProps[tag];
+          props[key] = hasOwnProperty.call(props, key);
+        }
+      }
+    });
+
+    /*------------------------------------------------------------------------*/
+
+    /**
+     * Creates a `lodash` object which wraps `value` to enable implicit chaining.
+     * Methods that operate on and return arrays, collections, and functions can
+     * be chained together. Methods that retrieve a single value or may return a
+     * primitive value will automatically end the chain returning the unwrapped
+     * value. Explicit chaining may be enabled using `_.chain`. The execution of
+     * chained methods is lazy, that is, execution is deferred until `_#value`
+     * is implicitly or explicitly called.
+     *
+     * Lazy evaluation allows several methods to support shortcut fusion. Shortcut
+     * fusion is an optimization strategy which merge iteratee calls; this can help
+     * to avoid the creation of intermediate data structures and greatly reduce the
+     * number of iteratee executions.
+     *
+     * Chaining is supported in custom builds as long as the `_#value` method is
+     * directly or indirectly included in the build.
+     *
+     * In addition to lodash methods, wrappers have `Array` and `String` methods.
+     *
+     * The wrapper `Array` methods are:
+     * `concat`, `join`, `pop`, `push`, `reverse`, `shift`, `slice`, `sort`,
+     * `splice`, and `unshift`
+     *
+     * The wrapper `String` methods are:
+     * `replace` and `split`
+     *
+     * The wrapper methods that support shortcut fusion are:
+     * `compact`, `drop`, `dropRight`, `dropRightWhile`, `dropWhile`, `filter`,
+     * `first`, `initial`, `last`, `map`, `pluck`, `reject`, `rest`, `reverse`,
+     * `slice`, `take`, `takeRight`, `takeRightWhile`, `takeWhile`, `toArray`,
+     * and `where`
+     *
+     * The chainable wrapper methods are:
+     * `after`, `ary`, `assign`, `at`, `before`, `bind`, `bindAll`, `bindKey`,
+     * `callback`, `chain`, `chunk`, `commit`, `compact`, `concat`, `constant`,
+     * `countBy`, `create`, `curry`, `debounce`, `defaults`, `defaultsDeep`,
+     * `defer`, `delay`, `difference`, `drop`, `dropRight`, `dropRightWhile`,
+     * `dropWhile`, `fill`, `filter`, `flatten`, `flattenDeep`, `flow`, `flowRight`,
+     * `forEach`, `forEachRight`, `forIn`, `forInRight`, `forOwn`, `forOwnRight`,
+     * `functions`, `groupBy`, `indexBy`, `initial`, `intersection`, `invert`,
+     * `invoke`, `keys`, `keysIn`, `map`, `mapKeys`, `mapValues`, `matches`,
+     * `matchesProperty`, `memoize`, `merge`, `method`, `methodOf`, `mixin`,
+     * `modArgs`, `negate`, `omit`, `once`, `pairs`, `partial`, `partialRight`,
+     * `partition`, `pick`, `plant`, `pluck`, `property`, `propertyOf`, `pull`,
+     * `pullAt`, `push`, `range`, `rearg`, `reject`, `remove`, `rest`, `restParam`,
+     * `reverse`, `set`, `shuffle`, `slice`, `sort`, `sortBy`, `sortByAll`,
+     * `sortByOrder`, `splice`, `spread`, `take`, `takeRight`, `takeRightWhile`,
+     * `takeWhile`, `tap`, `throttle`, `thru`, `times`, `toArray`, `toPlainObject`,
+     * `transform`, `union`, `uniq`, `unshift`, `unzip`, `unzipWith`, `values`,
+     * `valuesIn`, `where`, `without`, `wrap`, `xor`, `zip`, `zipObject`, `zipWith`
+     *
+     * The wrapper methods that are **not** chainable by default are:
+     * `add`, `attempt`, `camelCase`, `capitalize`, `ceil`, `clone`, `cloneDeep`,
+     * `deburr`, `endsWith`, `escape`, `escapeRegExp`, `every`, `find`, `findIndex`,
+     * `findKey`, `findLast`, `findLastIndex`, `findLastKey`, `findWhere`, `first`,
+     * `floor`, `get`, `gt`, `gte`, `has`, `identity`, `includes`, `indexOf`,
+     * `inRange`, `isArguments`, `isArray`, `isBoolean`, `isDate`, `isElement`,
+     * `isEmpty`, `isEqual`, `isError`, `isFinite` `isFunction`, `isMatch`,
+     * `isNative`, `isNaN`, `isNull`, `isNumber`, `isObject`, `isPlainObject`,
+     * `isRegExp`, `isString`, `isUndefined`, `isTypedArray`, `join`, `kebabCase`,
+     * `last`, `lastIndexOf`, `lt`, `lte`, `max`, `min`, `noConflict`, `noop`,
+     * `now`, `pad`, `padLeft`, `padRight`, `parseInt`, `pop`, `random`, `reduce`,
+     * `reduceRight`, `repeat`, `result`, `round`, `runInContext`, `shift`, `size`,
+     * `snakeCase`, `some`, `sortedIndex`, `sortedLastIndex`, `startCase`,
+     * `startsWith`, `sum`, `template`, `trim`, `trimLeft`, `trimRight`, `trunc`,
+     * `unescape`, `uniqueId`, `value`, and `words`
+     *
+     * The wrapper method `sample` will return a wrapped value when `n` is provided,
+     * otherwise an unwrapped value is returned.
+     *
+     * @name _
+     * @constructor
+     * @category Chain
+     * @param {*} value The value to wrap in a `lodash` instance.
+     * @returns {Object} Returns the new `lodash` wrapper instance.
+     * @example
+     *
+     * var wrapped = _([1, 2, 3]);
+     *
+     * // returns an unwrapped value
+     * wrapped.reduce(function(total, n) {
+     *   return total + n;
+     * });
+     * // => 6
+     *
+     * // returns a wrapped value
+     * var squares = wrapped.map(function(n) {
+     *   return n * n;
+     * });
+     *
+     * _.isArray(squares);
+     * // => false
+     *
+     * _.isArray(squares.value());
+     * // => true
+     */
+    function lodash(value) {
+      if (isObjectLike(value) && !isArray(value) && !(value instanceof LazyWrapper)) {
+        if (value instanceof LodashWrapper) {
+          return value;
+        }
+        if (hasOwnProperty.call(value, '__chain__') && hasOwnProperty.call(value, '__wrapped__')) {
+          return wrapperClone(value);
+        }
+      }
+      return new LodashWrapper(value);
+    }
+
+    /**
+     * The function whose prototype all chaining wrappers inherit from.
+     *
+     * @private
+     */
+    function baseLodash() {
+      // No operation performed.
+    }
+
+    /**
+     * The base constructor for creating `lodash` wrapper objects.
+     *
+     * @private
+     * @param {*} value The value to wrap.
+     * @param {boolean} [chainAll] Enable chaining for all wrapper methods.
+     * @param {Array} [actions=[]] Actions to peform to resolve the unwrapped value.
+     */
+    function LodashWrapper(value, chainAll, actions) {
+      this.__wrapped__ = value;
+      this.__actions__ = actions || [];
+      this.__chain__ = !!chainAll;
+    }
+
+    /**
+     * An object environment feature flags.
+     *
+     * @static
+     * @memberOf _
+     * @type Object
+     */
+    var support = lodash.support = {};
+
+    (function(x) {
+      var Ctor = function() { this.x = x; },
+          object = { '0': x, 'length': x },
+          props = [];
+
+      Ctor.prototype = { 'valueOf': x, 'y': x };
+      for (var key in new Ctor) { props.push(key); }
+
+      /**
+       * Detect if `name` or `message` properties of `Error.prototype` are
+       * enumerable by default (IE < 9, Safari < 5.1).
+       *
+       * @memberOf _.support
+       * @type boolean
+       */
+      support.enumErrorProps = propertyIsEnumerable.call(errorProto, 'message') ||
+        propertyIsEnumerable.call(errorProto, 'name');
+
+      /**
+       * Detect if `prototype` properties are enumerable by default.
+       *
+       * Firefox < 3.6, Opera > 9.50 - Opera < 11.60, and Safari < 5.1
+       * (if the prototype or a property on the prototype has been set)
+       * incorrectly set the `[[Enumerable]]` value of a function's `prototype`
+       * property to `true`.
+       *
+       * @memberOf _.support
+       * @type boolean
+       */
+      support.enumPrototypes = propertyIsEnumerable.call(Ctor, 'prototype');
+
+      /**
+       * Detect if properties shadowing those on `Object.prototype` are non-enumerable.
+       *
+       * In IE < 9 an object's own properties, shadowing non-enumerable ones,
+       * are made non-enumerable as well (a.k.a the JScript `[[DontEnum]]` bug).
+       *
+       * @memberOf _.support
+       * @type boolean
+       */
+      support.nonEnumShadows = !/valueOf/.test(props);
+
+      /**
+       * Detect if own properties are iterated after inherited properties (IE < 9).
+       *
+       * @memberOf _.support
+       * @type boolean
+       */
+      support.ownLast = props[0] != 'x';
+
+      /**
+       * Detect if `Array#shift` and `Array#splice` augment array-like objects
+       * correctly.
+       *
+       * Firefox < 10, compatibility modes of IE 8, and IE < 9 have buggy Array
+       * `shift()` and `splice()` functions that fail to remove the last element,
+       * `value[0]`, of array-like objects even though the "length" property is
+       * set to `0`. The `shift()` method is buggy in compatibility modes of IE 8,
+       * while `splice()` is buggy regardless of mode in IE < 9.
+       *
+       * @memberOf _.support
+       * @type boolean
+       */
+      support.spliceObjects = (splice.call(object, 0, 1), !object[0]);
+
+      /**
+       * Detect lack of support for accessing string characters by index.
+       *
+       * IE < 8 can't access characters by index. IE 8 can only access characters
+       * by index on string literals, not string objects.
+       *
+       * @memberOf _.support
+       * @type boolean
+       */
+      support.unindexedChars = ('x'[0] + Object('x')[0]) != 'xx';
+    }(1, 0));
+
+    /**
+     * By default, the template delimiters used by lodash are like those in
+     * embedded Ruby (ERB). Change the following template settings to use
+     * alternative delimiters.
+     *
+     * @static
+     * @memberOf _
+     * @type Object
+     */
+    lodash.templateSettings = {
+
+      /**
+       * Used to detect `data` property values to be HTML-escaped.
+       *
+       * @memberOf _.templateSettings
+       * @type RegExp
+       */
+      'escape': reEscape,
+
+      /**
+       * Used to detect code to be evaluated.
+       *
+       * @memberOf _.templateSettings
+       * @type RegExp
+       */
+      'evaluate': reEvaluate,
+
+      /**
+       * Used to detect `data` property values to inject.
+       *
+       * @memberOf _.templateSettings
+       * @type RegExp
+       */
+      'interpolate': reInterpolate,
+
+      /**
+       * Used to reference the data object in the template text.
+       *
+       * @memberOf _.templateSettings
+       * @type string
+       */
+      'variable': '',
+
+      /**
+       * Used to import variables into the compiled template.
+       *
+       * @memberOf _.templateSettings
+       * @type Object
+       */
+      'imports': {
+
+        /**
+         * A reference to the `lodash` function.
+         *
+         * @memberOf _.templateSettings.imports
+         * @type Function
+         */
+        '_': lodash
+      }
+    };
+
+    /*------------------------------------------------------------------------*/
+
+    /**
+     * Creates a lazy wrapper object which wraps `value` to enable lazy evaluation.
+     *
+     * @private
+     * @param {*} value The value to wrap.
+     */
+    function LazyWrapper(value) {
+      this.__wrapped__ = value;
+      this.__actions__ = [];
+      this.__dir__ = 1;
+      this.__filtered__ = false;
+      this.__iteratees__ = [];
+      this.__takeCount__ = POSITIVE_INFINITY;
+      this.__views__ = [];
+    }
+
+    /**
+     * Creates a clone of the lazy wrapper object.
+     *
+     * @private
+     * @name clone
+     * @memberOf LazyWrapper
+     * @returns {Object} Returns the cloned `LazyWrapper` object.
+     */
+    function lazyClone() {
+      var result = new LazyWrapper(this.__wrapped__);
+      result.__actions__ = arrayCopy(this.__actions__);
+      result.__dir__ = this.__dir__;
+      result.__filtered__ = this.__filtered__;
+      result.__iteratees__ = arrayCopy(this.__iteratees__);
+      result.__takeCount__ = this.__takeCount__;
+      result.__views__ = arrayCopy(this.__views__);
+      return result;
+    }
+
+    /**
+     * Reverses the direction of lazy iteration.
+     *
+     * @private
+     * @name reverse
+     * @memberOf LazyWrapper
+     * @returns {Object} Returns the new reversed `LazyWrapper` object.
+     */
+    function lazyReverse() {
+      if (this.__filtered__) {
+        var result = new LazyWrapper(this);
+        result.__dir__ = -1;
+        result.__filtered__ = true;
+      } else {
+        result = this.clone();
+        result.__dir__ *= -1;
+      }
+      return result;
+    }
+
+    /**
+     * Extracts the unwrapped value from its lazy wrapper.
+     *
+     * @private
+     * @name value
+     * @memberOf LazyWrapper
+     * @returns {*} Returns the unwrapped value.
+     */
+    function lazyValue() {
+      var array = this.__wrapped__.value(),
+          dir = this.__dir__,
+          isArr = isArray(array),
+          isRight = dir < 0,
+          arrLength = isArr ? array.length : 0,
+          view = getView(0, arrLength, this.__views__),
+          start = view.start,
+          end = view.end,
+          length = end - start,
+          index = isRight ? end : (start - 1),
+          iteratees = this.__iteratees__,
+          iterLength = iteratees.length,
+          resIndex = 0,
+          takeCount = nativeMin(length, this.__takeCount__);
+
+      if (!isArr || arrLength < LARGE_ARRAY_SIZE || (arrLength == length && takeCount == length)) {
+        return baseWrapperValue(array, this.__actions__);
+      }
+      var result = [];
+
+      outer:
+      while (length-- && resIndex < takeCount) {
+        index += dir;
+
+        var iterIndex = -1,
+            value = array[index];
+
+        while (++iterIndex < iterLength) {
+          var data = iteratees[iterIndex],
+              iteratee = data.iteratee,
+              type = data.type,
+              computed = iteratee(value);
+
+          if (type == LAZY_MAP_FLAG) {
+            value = computed;
+          } else if (!computed) {
+            if (type == LAZY_FILTER_FLAG) {
+              continue outer;
+            } else {
+              break outer;
+            }
+          }
+        }
+        result[resIndex++] = value;
+      }
+      return result;
+    }
+
+    /*------------------------------------------------------------------------*/
+
+    /**
+     * Creates a cache object to store key/value pairs.
+     *
+     * @private
+     * @static
+     * @name Cache
+     * @memberOf _.memoize
+     */
+    function MapCache() {
+      this.__data__ = {};
+    }
+
+    /**
+     * Removes `key` and its value from the cache.
+     *
+     * @private
+     * @name delete
+     * @memberOf _.memoize.Cache
+     * @param {string} key The key of the value to remove.
+     * @returns {boolean} Returns `true` if the thing was removed successfully, else `false`.
+     */
+    function mapDelete(key) {
+      return this.has(key) && delete this.__data__[key];
+    }
+
+    /**
+     * Gets the cached value for `key`.
+     *
+     * @private
+     * @name get
+     * @memberOf _.memoize.Cache
+     * @param {string} key The key of the value to get.
+     * @returns {*} Returns the cached value.
+     */
+    function mapGet(key) {
+      return key == '__proto__' ? undefined : this.__data__[key];
+    }
+
+    /**
+     * Checks if a cached value for `key` exists.
+     *
+     * @private
+     * @name has
+     * @memberOf _.memoize.Cache
+     * @param {string} key The key of the thing to check.
+     * @returns {boolean} Returns `true` if an thing for `key` exists, else `false`.
+     */
+    function mapHas(key) {
+      return key != '__proto__' && hasOwnProperty.call(this.__data__, key);
+    }
+
+    /**
+     * Sets `value` to `key` of the cache.
+     *
+     * @private
+     * @name set
+     * @memberOf _.memoize.Cache
+     * @param {string} key The key of the value to cache.
+     * @param {*} value The value to cache.
+     * @returns {Object} Returns the cache object.
+     */
+    function mapSet(key, value) {
+      if (key != '__proto__') {
+        this.__data__[key] = value;
+      }
+      return this;
+    }
+
+    /*------------------------------------------------------------------------*/
+
+    /**
+     *
+     * Creates a cache object to store unique values.
+     *
+     * @private
+     * @param {Array} [values] The values to cache.
+     */
+    function SetCache(values) {
+      var length = values ? values.length : 0;
+
+      this.data = { 'hash': nativeCreate(null), 'set': new Set };
+      while (length--) {
+        this.push(values[length]);
+      }
+    }
+
+    /**
+     * Checks if `value` is in `cache` mimicking the return signature of
+     * `_.indexOf` by returning `0` if the value is found, else `-1`.
+     *
+     * @private
+     * @param {Object} cache The cache to search.
+     * @param {*} value The value to search for.
+     * @returns {number} Returns `0` if `value` is found, else `-1`.
+     */
+    function cacheIndexOf(cache, value) {
+      var data = cache.data,
+          result = (typeof value == 'string' || isObject(value)) ? data.set.has(value) : data.hash[value];
+
+      return result ? 0 : -1;
+    }
+
+    /**
+     * Adds `value` to the cache.
+     *
+     * @private
+     * @name push
+     * @memberOf SetCache
+     * @param {*} value The value to cache.
+     */
+    function cachePush(value) {
+      var data = this.data;
+      if (typeof value == 'string' || isObject(value)) {
+        data.set.add(value);
+      } else {
+        data.hash[value] = true;
+      }
+    }
+
+    /*------------------------------------------------------------------------*/
+
+    /**
+     * Creates a new array joining `array` with `other`.
+     *
+     * @private
+     * @param {Array} array The array to join.
+     * @param {Array} other The other array to join.
+     * @returns {Array} Returns the new concatenated array.
+     */
+    function arrayConcat(array, other) {
+      var index = -1,
+          length = array.length,
+          othIndex = -1,
+          othLength = other.length,
+          result = Array(length + othLength);
+
+      while (++index < length) {
+        result[index] = array[index];
+      }
+      while (++othIndex < othLength) {
+        result[index++] = other[othIndex];
+      }
+      return result;
+    }
+
+    /**
+     * Copies the values of `source` to `array`.
+     *
+     * @private
+     * @param {Array} source The array to copy values from.
+     * @param {Array} [array=[]] The array to copy values to.
+     * @returns {Array} Returns `array`.
+     */
+    function arrayCopy(source, array) {
+      var index = -1,
+          length = source.length;
+
+      array || (array = Array(length));
+      while (++index < length) {
+        array[index] = source[index];
+      }
+      return array;
+    }
+
+    /**
+     * A specialized version of `_.forEach` for arrays without support for callback
+     * shorthands and `this` binding.
+     *
+     * @private
+     * @param {Array} array The array to iterate over.
+     * @param {Function} iteratee The function invoked per iteration.
+     * @returns {Array} Returns `array`.
+     */
+    function arrayEach(array, iteratee) {
+      var index = -1,
+          length = array.length;
+
+      while (++index < length) {
+        if (iteratee(array[index], index, array) === false) {
+          break;
+        }
+      }
+      return array;
+    }
+
+    /**
+     * A specialized version of `_.forEachRight` for arrays without support for
+     * callback shorthands and `this` binding.
+     *
+     * @private
+     * @param {Array} array The array to iterate over.
+     * @param {Function} iteratee The function invoked per iteration.
+     * @returns {Array} Returns `array`.
+     */
+    function arrayEachRight(array, iteratee) {
+      var length = array.length;
+
+      while (length--) {
+        if (iteratee(array[length], length, array) === false) {
+          break;
+        }
+      }
+      return array;
+    }
+
+    /**
+     * A specialized version of `_.every` for arrays without support for callback
+     * shorthands and `this` binding.
+     *
+     * @private
+     * @param {Array} array The array to iterate over.
+     * @param {Function} predicate The function invoked per iteration.
+     * @returns {boolean} Returns `true` if all elements pass the predicate check,
+     *  else `false`.
+     */
+    function arrayEvery(array, predicate) {
+      var index = -1,
+          length = array.length;
+
+      while (++index < length) {
+        if (!predicate(array[index], index, array)) {
+          return false;
+        }
+      }
+      return true;
+    }
+
+    /**
+     * A specialized version of `baseExtremum` for arrays which invokes `iteratee`
+     * with one argument: (value).
+     *
+     * @private
+     * @param {Array} array The array to iterate over.
+     * @param {Function} iteratee The function invoked per iteration.
+     * @param {Function} comparator The function used to compare values.
+     * @param {*} exValue The initial extremum value.
+     * @returns {*} Returns the extremum value.
+     */
+    function arrayExtremum(array, iteratee, comparator, exValue) {
+      var index = -1,
+          length = array.length,
+          computed = exValue,
+          result = computed;
+
+      while (++index < length) {
+        var value = array[index],
+            current = +iteratee(value);
+
+        if (comparator(current, computed)) {
+          computed = current;
+          result = value;
+        }
+      }
+      return result;
+    }
+
+    /**
+     * A specialized version of `_.filter` for arrays without support for callback
+     * shorthands and `this` binding.
+     *
+     * @private
+     * @param {Array} array The array to iterate over.
+     * @param {Function} predicate The function invoked per iteration.
+     * @returns {Array} Returns the new filtered array.
+     */
+    function arrayFilter(array, predicate) {
+      var index = -1,
+          length = array.length,
+          resIndex = -1,
+          result = [];
+
+      while (++index < length) {
+        var value = array[index];
+        if (predicate(value, index, array)) {
+          result[++resIndex] = value;
+        }
+      }
+      return result;
+    }
+
+    /**
+     * A specialized version of `_.map` for arrays without support for callback
+     * shorthands and `this` binding.
+     *
+     * @private
+     * @param {Array} array The array to iterate over.
+     * @param {Function} iteratee The function invoked per iteration.
+     * @returns {Array} Returns the new mapped array.
+     */
+    function arrayMap(array, iteratee) {
+      var index = -1,
+          length = array.length,
+          result = Array(length);
+
+      while (++index < length) {
+        result[index] = iteratee(array[index], index, array);
+      }
+      return result;
+    }
+
+    /**
+     * Appends the elements of `values` to `array`.
+     *
+     * @private
+     * @param {Array} array The array to modify.
+     * @param {Array} values The values to append.
+     * @returns {Array} Returns `array`.
+     */
+    function arrayPush(array, values) {
+      var index = -1,
+          length = values.length,
+          offset = array.length;
+
+      while (++index < length) {
+        array[offset + index] = values[index];
+      }
+      return array;
+    }
+
+    /**
+     * A specialized version of `_.reduce` for arrays without support for callback
+     * shorthands and `this` binding.
+     *
+     * @private
+     * @param {Array} array The array to iterate over.
+     * @param {Function} iteratee The function invoked per iteration.
+     * @param {*} [accumulator] The initial value.
+     * @param {boolean} [initFromArray] Specify using the first element of `array`
+     *  as the initial value.
+     * @returns {*} Returns the accumulated value.
+     */
+    function arrayReduce(array, iteratee, accumulator, initFromArray) {
+      var index = -1,
+          length = array.length;
+
+      if (initFromArray && length) {
+        accumulator = array[++index];
+      }
+      while (++index < length) {
+        accumulator = iteratee(accumulator, array[index], index, array);
+      }
+      return accumulator;
+    }
+
+    /**
+     * A specialized version of `_.reduceRight` for arrays without support for
+     * callback shorthands and `this` binding.
+     *
+     * @private
+     * @param {Array} array The array to iterate over.
+     * @param {Function} iteratee The function invoked per iteration.
+     * @param {*} [accumulator] The initial value.
+     * @param {boolean} [initFromArray] Specify using the last element of `array`
+     *  as the initial value.
+     * @returns {*} Returns the accumulated value.
+     */
+    function arrayReduceRight(array, iteratee, accumulator, initFromArray) {
+      var length = array.length;
+      if (initFromArray && length) {
+        accumulator = array[--length];
+      }
+      while (length--) {
+        accumulator = iteratee(accumulator, array[length], length, array);
+      }
+      return accumulator;
+    }
+
+    /**
+     * A specialized version of `_.some` for arrays without support for callback
+     * shorthands and `this` binding.
+     *
+     * @private
+     * @param {Array} array The array to iterate over.
+     * @param {Function} predicate The function invoked per iteration.
+     * @returns {boolean} Returns `true` if any element passes the predicate check,
+     *  else `false`.
+     */
+    function arraySome(array, predicate) {
+      var index = -1,
+          length = array.length;
+
+      while (++index < length) {
+        if (predicate(array[index], index, array)) {
+          return true;
+        }
+      }
+      return false;
+    }
+
+    /**
+     * A specialized version of `_.sum` for arrays without support for callback
+     * shorthands and `this` binding..
+     *
+     * @private
+     * @param {Array} array The array to iterate over.
+     * @param {Function} iteratee The function invoked per iteration.
+     * @returns {number} Returns the sum.
+     */
+    function arraySum(array, iteratee) {
+      var length = array.length,
+          result = 0;
+
+      while (length--) {
+        result += +iteratee(array[length]) || 0;
+      }
+      return result;
+    }
+
+    /**
+     * Used by `_.defaults` to customize its `_.assign` use.
+     *
+     * @private
+     * @param {*} objectValue The destination object property value.
+     * @param {*} sourceValue The source object property value.
+     * @returns {*} Returns the value to assign to the destination object.
+     */
+    function assignDefaults(objectValue, sourceValue) {
+      return objectValue === undefined ? sourceValue : objectValue;
+    }
+
+    /**
+     * Used by `_.template` to customize its `_.assign` use.
+     *
+     * **Note:** This function is like `assignDefaults` except that it ignores
+     * inherited property values when checking if a property is `undefined`.
+     *
+     * @private
+     * @param {*} objectValue The destination object property value.
+     * @param {*} sourceValue The source object property value.
+     * @param {string} key The key associated with the object and source values.
+     * @param {Object} object The destination object.
+     * @returns {*} Returns the value to assign to the destination object.
+     */
+    function assignOwnDefaults(objectValue, sourceValue, key, object) {
+      return (objectValue === undefined || !hasOwnProperty.call(object, key))
+        ? sourceValue
+        : objectValue;
+    }
+
+    /**
+     * A specialized version of `_.assign` for customizing assigned values without
+     * support for argument juggling, multiple sources, and `this` binding `customizer`
+     * functions.
+     *
+     * @private
+     * @param {Object} object The destination object.
+     * @param {Object} source The source object.
+     * @param {Function} customizer The function to customize assigned values.
+     * @returns {Object} Returns `object`.
+     */
+    function assignWith(object, source, customizer) {
+      var index = -1,
+          props = keys(source),
+          length = props.length;
+
+      while (++index < length) {
+        var key = props[index],
+            value = object[key],
+            result = customizer(value, source[key], key, object, source);
+
+        if ((result === result ? (result !== value) : (value === value)) ||
+            (value === undefined && !(key in object))) {
+          object[key] = result;
+        }
+      }
+      return object;
+    }
+
+    /**
+     * The base implementation of `_.assign` without support for argument juggling,
+     * multiple sources, and `customizer` functions.
+     *
+     * @private
+     * @param {Object} object The destination object.
+     * @param {Object} source The source object.
+     * @returns {Object} Returns `object`.
+     */
+    function baseAssign(object, source) {
+      return source == null
+        ? object
+        : baseCopy(source, keys(source), object);
+    }
+
+    /**
+     * The base implementation of `_.at` without support for string collections
+     * and individual key arguments.
+     *
+     * @private
+     * @param {Array|Object} collection The collection to iterate over.
+     * @param {number[]|string[]} props The property names or indexes of elements to pick.
+     * @returns {Array} Returns the new array of picked elements.
+     */
+    function baseAt(collection, props) {
+      var index = -1,
+          isNil = collection == null,
+          isArr = !isNil && isArrayLike(collection),
+          length = isArr ? collection.length : 0,
+          propsLength = props.length,
+          result = Array(propsLength);
+
+      while(++index < propsLength) {
+        var key = props[index];
+        if (isArr) {
+          result[index] = isIndex(key, length) ? collection[key] : undefined;
+        } else {
+          result[index] = isNil ? undefined : collection[key];
+        }
+      }
+      return result;
+    }
+
+    /**
+     * Copies properties of `source` to `object`.
+     *
+     * @private
+     * @param {Object} source The object to copy properties from.
+     * @param {Array} props The property names to copy.
+     * @param {Object} [object={}] The object to copy properties to.
+     * @returns {Object} Returns `object`.
+     */
+    function baseCopy(source, props, object) {
+      object || (object = {});
+
+      var index = -1,
+          length = props.length;
+
+      while (++index < length) {
+        var key = props[index];
+        object[key] = source[key];
+      }
+      return object;
+    }
+
+    /**
+     * The base implementation of `_.callback` which supports specifying the
+     * number of arguments to provide to `func`.
+     *
+     * @private
+     * @param {*} [func=_.identity] The value to convert to a callback.
+     * @param {*} [thisArg] The `this` binding of `func`.
+     * @param {number} [argCount] The number of arguments to provide to `func`.
+     * @returns {Function} Returns the callback.
+     */
+    function baseCallback(func, thisArg, argCount) {
+      var type = typeof func;
+      if (type == 'function') {
+        return thisArg === undefined
+          ? func
+          : bindCallback(func, thisArg, argCount);
+      }
+      if (func == null) {
+        return identity;
+      }
+      if (type == 'object') {
+        return baseMatches(func);
+      }
+      return thisArg === undefined
+        ? property(func)
+        : baseMatchesProperty(func, thisArg);
+    }
+
+    /**
+     * The base implementation of `_.clone` without support for argument juggling
+     * and `this` binding `customizer` functions.
+     *
+     * @private
+     * @param {*} value The value to clone.
+     * @param {boolean} [isDeep] Specify a deep clone.
+     * @param {Function} [customizer] The function to customize cloning values.
+     * @param {string} [key] The key of `value`.
+     * @param {Object} [object] The object `value` belongs to.
+     * @param {Array} [stackA=[]] Tracks traversed source objects.
+     * @param {Array} [stackB=[]] Associates clones with source counterparts.
+     * @returns {*} Returns the cloned value.
+     */
+    function baseClone(value, isDeep, customizer, key, object, stackA, stackB) {
+      var result;
+      if (customizer) {
+        result = object ? customizer(value, key, object) : customizer(value);
+      }
+      if (result !== undefined) {
+        return result;
+      }
+      if (!isObject(value)) {
+        return value;
+      }
+      var isArr = isArray(value);
+      if (isArr) {
+        result = initCloneArray(value);
+        if (!isDeep) {
+          return arrayCopy(value, result);
+        }
+      } else {
+        var tag = objToString.call(value),
+            isFunc = tag == funcTag;
+
+        if (tag == objectTag || tag == argsTag || (isFunc && !object)) {
+          if (isHostObject(value)) {
+            return object ? value : {};
+          }
+          result = initCloneObject(isFunc ? {} : value);
+          if (!isDeep) {
+            return baseAssign(result, value);
+          }
+        } else {
+          return cloneableTags[tag]
+            ? initCloneByTag(value, tag, isDeep)
+            : (object ? value : {});
+        }
+      }
+      // Check for circular references and return its corresponding clone.
+      stackA || (stackA = []);
+      stackB || (stackB = []);
+
+      var length = stackA.length;
+      while (length--) {
+        if (stackA[length] == value) {
+          return stackB[length];
+        }
+      }
+      // Add the source value to the stack of traversed objects and associate it with its clone.
+      stackA.push(value);
+      stackB.push(result);
+
+      // Recursively populate clone (susceptible to call stack limits).
+      (isArr ? arrayEach : baseForOwn)(value, function(subValue, key) {
+        result[key] = baseClone(subValue, isDeep, customizer, key, value, stackA, stackB);
+      });
+      return result;
+    }
+
+    /**
+     * The base implementation of `_.create` without support for assigning
+     * properties to the created object.
+     *
+     * @private
+     * @param {Object} prototype The object to inherit from.
+     * @returns {Object} Returns the new object.
+     */
+    var baseCreate = (function() {
+      function object() {}
+      return function(prototype) {
+        if (isObject(prototype)) {
+          object.prototype = prototype;
+          var result = new object;
+          object.prototype = undefined;
+        }
+        return result || {};
+      };
+    }());
+
+    /**
+     * The base implementation of `_.delay` and `_.defer` which accepts an index
+     * of where to slice the arguments to provide to `func`.
+     *
+     * @private
+     * @param {Function} func The function to delay.
+     * @param {number} wait The number of milliseconds to delay invocation.
+     * @param {Object} args The arguments provide to `func`.
+     * @returns {number} Returns the timer id.
+     */
+    function baseDelay(func, wait, args) {
+      if (typeof func != 'function') {
+        throw new TypeError(FUNC_ERROR_TEXT);
+      }
+      return setTimeout(function() { func.apply(undefined, args); }, wait);
+    }
+
+    /**
+     * The base implementation of `_.difference` which accepts a single array
+     * of values to exclude.
+     *
+     * @private
+     * @param {Array} array The array to inspect.
+     * @param {Array} values The values to exclude.
+     * @returns {Array} Returns the new array of filtered values.
+     */
+    function baseDifference(array, values) {
+      var length = array ? array.length : 0,
+          result = [];
+
+      if (!length) {
+        return result;
+      }
+      var index = -1,
+          indexOf = getIndexOf(),
+          isCommon = indexOf === baseIndexOf,
+          cache = (isCommon && values.length >= LARGE_ARRAY_SIZE) ? createCache(values) : null,
+          valuesLength = values.length;
+
+      if (cache) {
+        indexOf = cacheIndexOf;
+        isCommon = false;
+        values = cache;
+      }
+      outer:
+      while (++index < length) {
+        var value = array[index];
+
+        if (isCommon && value === value) {
+          var valuesIndex = valuesLength;
+          while (valuesIndex--) {
+            if (values[valuesIndex] === value) {
+              continue outer;
+            }
+          }
+          result.push(value);
+        }
+        else if (indexOf(values, value, 0) < 0) {
+          result.push(value);
+        }
+      }
+      return result;
+    }
+
+    /**
+     * The base implementation of `_.forEach` without support for callback
+     * shorthands and `this` binding.
+     *
+     * @private
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {Function} iteratee The function invoked per iteration.
+     * @returns {Array|Object|string} Returns `collection`.
+     */
+    var baseEach = createBaseEach(baseForOwn);
+
+    /**
+     * The base implementation of `_.forEachRight` without support for callback
+     * shorthands and `this` binding.
+     *
+     * @private
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {Function} iteratee The function invoked per iteration.
+     * @returns {Array|Object|string} Returns `collection`.
+     */
+    var baseEachRight = createBaseEach(baseForOwnRight, true);
+
+    /**
+     * The base implementation of `_.every` without support for callback
+     * shorthands and `this` binding.
+     *
+     * @private
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {Function} predicate The function invoked per iteration.
+     * @returns {boolean} Returns `true` if all elements pass the predicate check,
+     *  else `false`
+     */
+    function baseEvery(collection, predicate) {
+      var result = true;
+      baseEach(collection, function(value, index, collection) {
+        result = !!predicate(value, index, collection);
+        return result;
+      });
+      return result;
+    }
+
+    /**
+     * Gets the extremum value of `collection` invoking `iteratee` for each value
+     * in `collection` to generate the criterion by which the value is ranked.
+     * The `iteratee` is invoked with three arguments: (value, index|key, collection).
+     *
+     * @private
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {Function} iteratee The function invoked per iteration.
+     * @param {Function} comparator The function used to compare values.
+     * @param {*} exValue The initial extremum value.
+     * @returns {*} Returns the extremum value.
+     */
+    function baseExtremum(collection, iteratee, comparator, exValue) {
+      var computed = exValue,
+          result = computed;
+
+      baseEach(collection, function(value, index, collection) {
+        var current = +iteratee(value, index, collection);
+        if (comparator(current, computed) || (current === exValue && current === result)) {
+          computed = current;
+          result = value;
+        }
+      });
+      return result;
+    }
+
+    /**
+     * The base implementation of `_.fill` without an iteratee call guard.
+     *
+     * @private
+     * @param {Array} array The array to fill.
+     * @param {*} value The value to fill `array` with.
+     * @param {number} [start=0] The start position.
+     * @param {number} [end=array.length] The end position.
+     * @returns {Array} Returns `array`.
+     */
+    function baseFill(array, value, start, end) {
+      var length = array.length;
+
+      start = start == null ? 0 : (+start || 0);
+      if (start < 0) {
+        start = -start > length ? 0 : (length + start);
+      }
+      end = (end === undefined || end > length) ? length : (+end || 0);
+      if (end < 0) {
+        end += length;
+      }
+      length = start > end ? 0 : (end >>> 0);
+      start >>>= 0;
+
+      while (start < length) {
+        array[start++] = value;
+      }
+      return array;
+    }
+
+    /**
+     * The base implementation of `_.filter` without support for callback
+     * shorthands and `this` binding.
+     *
+     * @private
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {Function} predicate The function invoked per iteration.
+     * @returns {Array} Returns the new filtered array.
+     */
+    function baseFilter(collection, predicate) {
+      var result = [];
+      baseEach(collection, function(value, index, collection) {
+        if (predicate(value, index, collection)) {
+          result.push(value);
+        }
+      });
+      return result;
+    }
+
+    /**
+     * The base implementation of `_.find`, `_.findLast`, `_.findKey`, and `_.findLastKey`,
+     * without support for callback shorthands and `this` binding, which iterates
+     * over `collection` using the provided `eachFunc`.
+     *
+     * @private
+     * @param {Array|Object|string} collection The collection to search.
+     * @param {Function} predicate The function invoked per iteration.
+     * @param {Function} eachFunc The function to iterate over `collection`.
+     * @param {boolean} [retKey] Specify returning the key of the found element
+     *  instead of the element itself.
+     * @returns {*} Returns the found element or its key, else `undefined`.
+     */
+    function baseFind(collection, predicate, eachFunc, retKey) {
+      var result;
+      eachFunc(collection, function(value, key, collection) {
+        if (predicate(value, key, collection)) {
+          result = retKey ? key : value;
+          return false;
+        }
+      });
+      return result;
+    }
+
+    /**
+     * The base implementation of `_.flatten` with added support for restricting
+     * flattening and specifying the start index.
+     *
+     * @private
+     * @param {Array} array The array to flatten.
+     * @param {boolean} [isDeep] Specify a deep flatten.
+     * @param {boolean} [isStrict] Restrict flattening to arrays-like objects.
+     * @param {Array} [result=[]] The initial result value.
+     * @returns {Array} Returns the new flattened array.
+     */
+    function baseFlatten(array, isDeep, isStrict, result) {
+      result || (result = []);
+
+      var index = -1,
+          length = array.length;
+
+      while (++index < length) {
+        var value = array[index];
+        if (isObjectLike(value) && isArrayLike(value) &&
+            (isStrict || isArray(value) || isArguments(value))) {
+          if (isDeep) {
+            // Recursively flatten arrays (susceptible to call stack limits).
+            baseFlatten(value, isDeep, isStrict, result);
+          } else {
+            arrayPush(result, value);
+          }
+        } else if (!isStrict) {
+          result[result.length] = value;
+        }
+      }
+      return result;
+    }
+
+    /**
+     * The base implementation of `baseForIn` and `baseForOwn` which iterates
+     * over `object` properties returned by `keysFunc` invoking `iteratee` for
+     * each property. Iteratee functions may exit iteration early by explicitly
+     * returning `false`.
+     *
+     * @private
+     * @param {Object} object The object to iterate over.
+     * @param {Function} iteratee The function invoked per iteration.
+     * @param {Function} keysFunc The function to get the keys of `object`.
+     * @returns {Object} Returns `object`.
+     */
+    var baseFor = createBaseFor();
+
+    /**
+     * This function is like `baseFor` except that it iterates over properties
+     * in the opposite order.
+     *
+     * @private
+     * @param {Object} object The object to iterate over.
+     * @param {Function} iteratee The function invoked per iteration.
+     * @param {Function} keysFunc The function to get the keys of `object`.
+     * @returns {Object} Returns `object`.
+     */
+    var baseForRight = createBaseFor(true);
+
+    /**
+     * The base implementation of `_.forIn` without support for callback
+     * shorthands and `this` binding.
+     *
+     * @private
+     * @param {Object} object The object to iterate over.
+     * @param {Function} iteratee The function invoked per iteration.
+     * @returns {Object} Returns `object`.
+     */
+    function baseForIn(object, iteratee) {
+      return baseFor(object, iteratee, keysIn);
+    }
+
+    /**
+     * The base implementation of `_.forOwn` without support for callback
+     * shorthands and `this` binding.
+     *
+     * @private
+     * @param {Object} object The object to iterate over.
+     * @param {Function} iteratee The function invoked per iteration.
+     * @returns {Object} Returns `object`.
+     */
+    function baseForOwn(object, iteratee) {
+      return baseFor(object, iteratee, keys);
+    }
+
+    /**
+     * The base implementation of `_.forOwnRight` without support for callback
+     * shorthands and `this` binding.
+     *
+     * @private
+     * @param {Object} object The object to iterate over.
+     * @param {Function} iteratee The function invoked per iteration.
+     * @returns {Object} Returns `object`.
+     */
+    function baseForOwnRight(object, iteratee) {
+      return baseForRight(object, iteratee, keys);
+    }
+
+    /**
+     * The base implementation of `_.functions` which creates an array of
+     * `object` function property names filtered from those provided.
+     *
+     * @private
+     * @param {Object} object The object to inspect.
+     * @param {Array} props The property names to filter.
+     * @returns {Array} Returns the new array of filtered property names.
+     */
+    function baseFunctions(object, props) {
+      var index = -1,
+          length = props.length,
+          resIndex = -1,
+          result = [];
+
+      while (++index < length) {
+        var key = props[index];
+        if (isFunction(object[key])) {
+          result[++resIndex] = key;
+        }
+      }
+      return result;
+    }
+
+    /**
+     * The base implementation of `get` without support for string paths
+     * and default values.
+     *
+     * @private
+     * @param {Object} object The object to query.
+     * @param {Array} path The path of the property to get.
+     * @param {string} [pathKey] The key representation of path.
+     * @returns {*} Returns the resolved value.
+     */
+    function baseGet(object, path, pathKey) {
+      if (object == null) {
+        return;
+      }
+      object = toObject(object);
+      if (pathKey !== undefined && pathKey in object) {
+        path = [pathKey];
+      }
+      var index = 0,
+          length = path.length;
+
+      while (object != null && index < length) {
+        object = toObject(object)[path[index++]];
+      }
+      return (index && index == length) ? object : undefined;
+    }
+
+    /**
+     * The base implementation of `_.isEqual` without support for `this` binding
+     * `customizer` functions.
+     *
+     * @private
+     * @param {*} value The value to compare.
+     * @param {*} other The other value to compare.
+     * @param {Function} [customizer] The function to customize comparing values.
+     * @param {boolean} [isLoose] Specify performing partial comparisons.
+     * @param {Array} [stackA] Tracks traversed `value` objects.
+     * @param {Array} [stackB] Tracks traversed `other` objects.
+     * @returns {boolean} Returns `true` if the values are equivalent, else `false`.
+     */
+    function baseIsEqual(value, other, customizer, isLoose, stackA, stackB) {
+      if (value === other) {
+        return true;
+      }
+      if (value == null || other == null || (!isObject(value) && !isObjectLike(other))) {
+        return value !== value && other !== other;
+      }
+      return baseIsEqualDeep(value, other, baseIsEqual, customizer, isLoose, stackA, stackB);
+    }
+
+    /**
+     * A specialized version of `baseIsEqual` for arrays and objects which performs
+     * deep comparisons and tracks traversed objects enabling objects with circular
+     * references to be compared.
+     *
+     * @private
+     * @param {Object} object The object to compare.
+     * @param {Object} other The other object to compare.
+     * @param {Function} equalFunc The function to determine equivalents of values.
+     * @param {Function} [customizer] The function to customize comparing objects.
+     * @param {boolean} [isLoose] Specify performing partial comparisons.
+     * @param {Array} [stackA=[]] Tracks traversed `value` objects.
+     * @param {Array} [stackB=[]] Tracks traversed `other` objects.
+     * @returns {boolean} Returns `true` if the objects are equivalent, else `false`.
+     */
+    function baseIsEqualDeep(object, other, equalFunc, customizer, isLoose, stackA, stackB) {
+      var objIsArr = isArray(object),
+          othIsArr = isArray(other),
+          objTag = arrayTag,
+          othTag = arrayTag;
+
+      if (!objIsArr) {
+        objTag = objToString.call(object);
+        if (objTag == argsTag) {
+          objTag = objectTag;
+        } else if (objTag != objectTag) {
+          objIsArr = isTypedArray(object);
+        }
+      }
+      if (!othIsArr) {
+        othTag = objToString.call(other);
+        if (othTag == argsTag) {
+          othTag = objectTag;
+        } else if (othTag != objectTag) {
+          othIsArr = isTypedArray(other);
+        }
+      }
+      var objIsObj = objTag == objectTag && !isHostObject(object),
+          othIsObj = othTag == objectTag && !isHostObject(other),
+          isSameTag = objTag == othTag;
+
+      if (isSameTag && !(objIsArr || objIsObj)) {
+        return equalByTag(object, other, objTag);
+      }
+      if (!isLoose) {
+        var objIsWrapped = objIsObj && hasOwnProperty.call(object, '__wrapped__'),
+            othIsWrapped = othIsObj && hasOwnProperty.call(other, '__wrapped__');
+
+        if (objIsWrapped || othIsWrapped) {
+          return equalFunc(objIsWrapped ? object.value() : object, othIsWrapped ? other.value() : other, customizer, isLoose, stackA, stackB);
+        }
+      }
+      if (!isSameTag) {
+        return false;
+      }
+      // Assume cyclic values are equal.
+      // For more information on detecting circular references see https://es5.github.io/#JO.
+      stackA || (stackA = []);
+      stackB || (stackB = []);
+
+      var length = stackA.length;
+      while (length--) {
+        if (stackA[length] == object) {
+          return stackB[length] == other;
+        }
+      }
+      // Add `object` and `other` to the stack of traversed objects.
+      stackA.push(object);
+      stackB.push(other);
+
+      var result = (objIsArr ? equalArrays : equalObjects)(object, other, equalFunc, customizer, isLoose, stackA, stackB);
+
+      stackA.pop();
+      stackB.pop();
+
+      return result;
+    }
+
+    /**
+     * The base implementation of `_.isMatch` without support for callback
+     * shorthands and `this` binding.
+     *
+     * @private
+     * @param {Object} object The object to inspect.
+     * @param {Array} matchData The propery names, values, and compare flags to match.
+     * @param {Function} [customizer] The function to customize comparing objects.
+     * @returns {boolean} Returns `true` if `object` is a match, else `false`.
+     */
+    function baseIsMatch(object, matchData, customizer) {
+      var index = matchData.length,
+          length = index,
+          noCustomizer = !customizer;
+
+      if (object == null) {
+        return !length;
+      }
+      object = toObject(object);
+      while (index--) {
+        var data = matchData[index];
+        if ((noCustomizer && data[2])
+              ? data[1] !== object[data[0]]
+              : !(data[0] in object)
+            ) {
+          return false;
+        }
+      }
+      while (++index < length) {
+        data = matchData[index];
+        var key = data[0],
+            objValue = object[key],
+            srcValue = data[1];
+
+        if (noCustomizer && data[2]) {
+          if (objValue === undefined && !(key in object)) {
+            return false;
+          }
+        } else {
+          var result = customizer ? customizer(objValue, srcValue, key) : undefined;
+          if (!(result === undefined ? baseIsEqual(srcValue, objValue, customizer, true) : result)) {
+            return false;
+          }
+        }
+      }
+      return true;
+    }
+
+    /**
+     * The base implementation of `_.map` without support for callback shorthands
+     * and `this` binding.
+     *
+     * @private
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {Function} iteratee The function invoked per iteration.
+     * @returns {Array} Returns the new mapped array.
+     */
+    function baseMap(collection, iteratee) {
+      var index = -1,
+          result = isArrayLike(collection) ? Array(collection.length) : [];
+
+      baseEach(collection, function(value, key, collection) {
+        result[++index] = iteratee(value, key, collection);
+      });
+      return result;
+    }
+
+    /**
+     * The base implementation of `_.matches` which does not clone `source`.
+     *
+     * @private
+     * @param {Object} source The object of property values to match.
+     * @returns {Function} Returns the new function.
+     */
+    function baseMatches(source) {
+      var matchData = getMatchData(source);
+      if (matchData.length == 1 && matchData[0][2]) {
+        var key = matchData[0][0],
+            value = matchData[0][1];
+
+        return function(object) {
+          if (object == null) {
+            return false;
+          }
+          object = toObject(object);
+          return object[key] === value && (value !== undefined || (key in object));
+        };
+      }
+      return function(object) {
+        return baseIsMatch(object, matchData);
+      };
+    }
+
+    /**
+     * The base implementation of `_.matchesProperty` which does not clone `srcValue`.
+     *
+     * @private
+     * @param {string} path The path of the property to get.
+     * @param {*} srcValue The value to compare.
+     * @returns {Function} Returns the new function.
+     */
+    function baseMatchesProperty(path, srcValue) {
+      var isArr = isArray(path),
+          isCommon = isKey(path) && isStrictComparable(srcValue),
+          pathKey = (path + '');
+
+      path = toPath(path);
+      return function(object) {
+        if (object == null) {
+          return false;
+        }
+        var key = pathKey;
+        object = toObject(object);
+        if ((isArr || !isCommon) && !(key in object)) {
+          object = path.length == 1 ? object : baseGet(object, baseSlice(path, 0, -1));
+          if (object == null) {
+            return false;
+          }
+          key = last(path);
+          object = toObject(object);
+        }
+        return object[key] === srcValue
+          ? (srcValue !== undefined || (key in object))
+          : baseIsEqual(srcValue, object[key], undefined, true);
+      };
+    }
+
+    /**
+     * The base implementation of `_.merge` without support for argument juggling,
+     * multiple sources, and `this` binding `customizer` functions.
+     *
+     * @private
+     * @param {Object} object The destination object.
+     * @param {Object} source The source object.
+     * @param {Function} [customizer] The function to customize merged values.
+     * @param {Array} [stackA=[]] Tracks traversed source objects.
+     * @param {Array} [stackB=[]] Associates values with source counterparts.
+     * @returns {Object} Returns `object`.
+     */
+    function baseMerge(object, source, customizer, stackA, stackB) {
+      if (!isObject(object)) {
+        return object;
+      }
+      var isSrcArr = isArrayLike(source) && (isArray(source) || isTypedArray(source)),
+          props = isSrcArr ? undefined : keys(source);
+
+      arrayEach(props || source, function(srcValue, key) {
+        if (props) {
+          key = srcValue;
+          srcValue = source[key];
+        }
+        if (isObjectLike(srcValue)) {
+          stackA || (stackA = []);
+          stackB || (stackB = []);
+          baseMergeDeep(object, source, key, baseMerge, customizer, stackA, stackB);
+        }
+        else {
+          var value = object[key],
+              result = customizer ? customizer(value, srcValue, key, object, source) : undefined,
+              isCommon = result === undefined;
+
+          if (isCommon) {
+            result = srcValue;
+          }
+          if ((result !== undefined || (isSrcArr && !(key in object))) &&
+              (isCommon || (result === result ? (result !== value) : (value === value)))) {
+            object[key] = result;
+          }
+        }
+      });
+      return object;
+    }
+
+    /**
+     * A specialized version of `baseMerge` for arrays and objects which performs
+     * deep merges and tracks traversed objects enabling objects with circular
+     * references to be merged.
+     *
+     * @private
+     * @param {Object} object The destination object.
+     * @param {Object} source The source object.
+     * @param {string} key The key of the value to merge.
+     * @param {Function} mergeFunc The function to merge values.
+     * @param {Function} [customizer] The function to customize merged values.
+     * @param {Array} [stackA=[]] Tracks traversed source objects.
+     * @param {Array} [stackB=[]] Associates values with source counterparts.
+     * @returns {boolean} Returns `true` if the objects are equivalent, else `false`.
+     */
+    function baseMergeDeep(object, source, key, mergeFunc, customizer, stackA, stackB) {
+      var length = stackA.length,
+          srcValue = source[key];
+
+      while (length--) {
+        if (stackA[length] == srcValue) {
+          object[key] = stackB[length];
+          return;
+        }
+      }
+      var value = object[key],
+          result = customizer ? customizer(value, srcValue, key, object, source) : undefined,
+          isCommon = result === undefined;
+
+      if (isCommon) {
+        result = srcValue;
+        if (isArrayLike(srcValue) && (isArray(srcValue) || isTypedArray(srcValue))) {
+          result = isArray(value)
+            ? value
+            : (isArrayLike(value) ? arrayCopy(value) : []);
+        }
+        else if (isPlainObject(srcValue) || isArguments(srcValue)) {
+          result = isArguments(value)
+            ? toPlainObject(value)
+            : (isPlainObject(value) ? value : {});
+        }
+        else {
+          isCommon = false;
+        }
+      }
+      // Add the source value to the stack of traversed objects and associate
+      // it with its merged value.
+      stackA.push(srcValue);
+      stackB.push(result);
+
+      if (isCommon) {
+        // Recursively merge objects and arrays (susceptible to call stack limits).
+        object[key] = mergeFunc(result, srcValue, customizer, stackA, stackB);
+      } else if (result === result ? (result !== value) : (value === value)) {
+        object[key] = result;
+      }
+    }
+
+    /**
+     * The base implementation of `_.property` without support for deep paths.
+     *
+     * @private
+     * @param {string} key The key of the property to get.
+     * @returns {Function} Returns the new function.
+     */
+    function baseProperty(key) {
+      return function(object) {
+        return object == null ? undefined : toObject(object)[key];
+      };
+    }
+
+    /**
+     * A specialized version of `baseProperty` which supports deep paths.
+     *
+     * @private
+     * @param {Array|string} path The path of the property to get.
+     * @returns {Function} Returns the new function.
+     */
+    function basePropertyDeep(path) {
+      var pathKey = (path + '');
+      path = toPath(path);
+      return function(object) {
+        return baseGet(object, path, pathKey);
+      };
+    }
+
+    /**
+     * The base implementation of `_.pullAt` without support for individual
+     * index arguments and capturing the removed elements.
+     *
+     * @private
+     * @param {Array} array The array to modify.
+     * @param {number[]} indexes The indexes of elements to remove.
+     * @returns {Array} Returns `array`.
+     */
+    function basePullAt(array, indexes) {
+      var length = array ? indexes.length : 0;
+      while (length--) {
+        var index = indexes[length];
+        if (index != previous && isIndex(index)) {
+          var previous = index;
+          splice.call(array, index, 1);
+        }
+      }
+      return array;
+    }
+
+    /**
+     * The base implementation of `_.random` without support for argument juggling
+     * and returning floating-point numbers.
+     *
+     * @private
+     * @param {number} min The minimum possible value.
+     * @param {number} max The maximum possible value.
+     * @returns {number} Returns the random number.
+     */
+    function baseRandom(min, max) {
+      return min + nativeFloor(nativeRandom() * (max - min + 1));
+    }
+
+    /**
+     * The base implementation of `_.reduce` and `_.reduceRight` without support
+     * for callback shorthands and `this` binding, which iterates over `collection`
+     * using the provided `eachFunc`.
+     *
+     * @private
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {Function} iteratee The function invoked per iteration.
+     * @param {*} accumulator The initial value.
+     * @param {boolean} initFromCollection Specify using the first or last element
+     *  of `collection` as the initial value.
+     * @param {Function} eachFunc The function to iterate over `collection`.
+     * @returns {*} Returns the accumulated value.
+     */
+    function baseReduce(collection, iteratee, accumulator, initFromCollection, eachFunc) {
+      eachFunc(collection, function(value, index, collection) {
+        accumulator = initFromCollection
+          ? (initFromCollection = false, value)
+          : iteratee(accumulator, value, index, collection);
+      });
+      return accumulator;
+    }
+
+    /**
+     * The base implementation of `setData` without support for hot loop detection.
+     *
+     * @private
+     * @param {Function} func The function to associate metadata with.
+     * @param {*} data The metadata.
+     * @returns {Function} Returns `func`.
+     */
+    var baseSetData = !metaMap ? identity : function(func, data) {
+      metaMap.set(func, data);
+      return func;
+    };
+
+    /**
+     * The base implementation of `_.slice` without an iteratee call guard.
+     *
+     * @private
+     * @param {Array} array The array to slice.
+     * @param {number} [start=0] The start position.
+     * @param {number} [end=array.length] The end position.
+     * @returns {Array} Returns the slice of `array`.
+     */
+    function baseSlice(array, start, end) {
+      var index = -1,
+          length = array.length;
+
+      start = start == null ? 0 : (+start || 0);
+      if (start < 0) {
+        start = -start > length ? 0 : (length + start);
+      }
+      end = (end === undefined || end > length) ? length : (+end || 0);
+      if (end < 0) {
+        end += length;
+      }
+      length = start > end ? 0 : ((end - start) >>> 0);
+      start >>>= 0;
+
+      var result = Array(length);
+      while (++index < length) {
+        result[index] = array[index + start];
+      }
+      return result;
+    }
+
+    /**
+     * The base implementation of `_.some` without support for callback shorthands
+     * and `this` binding.
+     *
+     * @private
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {Function} predicate The function invoked per iteration.
+     * @returns {boolean} Returns `true` if any element passes the predicate check,
+     *  else `false`.
+     */
+    function baseSome(collection, predicate) {
+      var result;
+
+      baseEach(collection, function(value, index, collection) {
+        result = predicate(value, index, collection);
+        return !result;
+      });
+      return !!result;
+    }
+
+    /**
+     * The base implementation of `_.sortBy` which uses `comparer` to define
+     * the sort order of `array` and replaces criteria objects with their
+     * corresponding values.
+     *
+     * @private
+     * @param {Array} array The array to sort.
+     * @param {Function} comparer The function to define sort order.
+     * @returns {Array} Returns `array`.
+     */
+    function baseSortBy(array, comparer) {
+      var length = array.length;
+
+      array.sort(comparer);
+      while (length--) {
+        array[length] = array[length].value;
+      }
+      return array;
+    }
+
+    /**
+     * The base implementation of `_.sortByOrder` without param guards.
+     *
+     * @private
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {Function[]|Object[]|string[]} iteratees The iteratees to sort by.
+     * @param {boolean[]} orders The sort orders of `iteratees`.
+     * @returns {Array} Returns the new sorted array.
+     */
+    function baseSortByOrder(collection, iteratees, orders) {
+      var callback = getCallback(),
+          index = -1;
+
+      iteratees = arrayMap(iteratees, function(iteratee) { return callback(iteratee); });
+
+      var result = baseMap(collection, function(value) {
+        var criteria = arrayMap(iteratees, function(iteratee) { return iteratee(value); });
+        return { 'criteria': criteria, 'index': ++index, 'value': value };
+      });
+
+      return baseSortBy(result, function(object, other) {
+        return compareMultiple(object, other, orders);
+      });
+    }
+
+    /**
+     * The base implementation of `_.sum` without support for callback shorthands
+     * and `this` binding.
+     *
+     * @private
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {Function} iteratee The function invoked per iteration.
+     * @returns {number} Returns the sum.
+     */
+    function baseSum(collection, iteratee) {
+      var result = 0;
+      baseEach(collection, function(value, index, collection) {
+        result += +iteratee(value, index, collection) || 0;
+      });
+      return result;
+    }
+
+    /**
+     * The base implementation of `_.uniq` without support for callback shorthands
+     * and `this` binding.
+     *
+     * @private
+     * @param {Array} array The array to inspect.
+     * @param {Function} [iteratee] The function invoked per iteration.
+     * @returns {Array} Returns the new duplicate free array.
+     */
+    function baseUniq(array, iteratee) {
+      var index = -1,
+          indexOf = getIndexOf(),
+          length = array.length,
+          isCommon = indexOf === baseIndexOf,
+          isLarge = isCommon && length >= LARGE_ARRAY_SIZE,
+          seen = isLarge ? createCache() : null,
+          result = [];
+
+      if (seen) {
+        indexOf = cacheIndexOf;
+        isCommon = false;
+      } else {
+        isLarge = false;
+        seen = iteratee ? [] : result;
+      }
+      outer:
+      while (++index < length) {
+        var value = array[index],
+            computed = iteratee ? iteratee(value, index, array) : value;
+
+        if (isCommon && value === value) {
+          var seenIndex = seen.length;
+          while (seenIndex--) {
+            if (seen[seenIndex] === computed) {
+              continue outer;
+            }
+          }
+          if (iteratee) {
+            seen.push(computed);
+          }
+          result.push(value);
+        }
+        else if (indexOf(seen, computed, 0) < 0) {
+          if (iteratee || isLarge) {
+            seen.push(computed);
+          }
+          result.push(value);
+        }
+      }
+      return result;
+    }
+
+    /**
+     * The base implementation of `_.values` and `_.valuesIn` which creates an
+     * array of `object` property values corresponding to the property names
+     * of `props`.
+     *
+     * @private
+     * @param {Object} object The object to query.
+     * @param {Array} props The property names to get values for.
+     * @returns {Object} Returns the array of property values.
+     */
+    function baseValues(object, props) {
+      var index = -1,
+          length = props.length,
+          result = Array(length);
+
+      while (++index < length) {
+        result[index] = object[props[index]];
+      }
+      return result;
+    }
+
+    /**
+     * The base implementation of `_.dropRightWhile`, `_.dropWhile`, `_.takeRightWhile`,
+     * and `_.takeWhile` without support for callback shorthands and `this` binding.
+     *
+     * @private
+     * @param {Array} array The array to query.
+     * @param {Function} predicate The function invoked per iteration.
+     * @param {boolean} [isDrop] Specify dropping elements instead of taking them.
+     * @param {boolean} [fromRight] Specify iterating from right to left.
+     * @returns {Array} Returns the slice of `array`.
+     */
+    function baseWhile(array, predicate, isDrop, fromRight) {
+      var length = array.length,
+          index = fromRight ? length : -1;
+
+      while ((fromRight ? index-- : ++index < length) && predicate(array[index], index, array)) {}
+      return isDrop
+        ? baseSlice(array, (fromRight ? 0 : index), (fromRight ? index + 1 : length))
+        : baseSlice(array, (fromRight ? index + 1 : 0), (fromRight ? length : index));
+    }
+
+    /**
+     * The base implementation of `wrapperValue` which returns the result of
+     * performing a sequence of actions on the unwrapped `value`, where each
+     * successive action is supplied the return value of the previous.
+     *
+     * @private
+     * @param {*} value The unwrapped value.
+     * @param {Array} actions Actions to peform to resolve the unwrapped value.
+     * @returns {*} Returns the resolved value.
+     */
+    function baseWrapperValue(value, actions) {
+      var result = value;
+      if (result instanceof LazyWrapper) {
+        result = result.value();
+      }
+      var index = -1,
+          length = actions.length;
+
+      while (++index < length) {
+        var action = actions[index];
+        result = action.func.apply(action.thisArg, arrayPush([result], action.args));
+      }
+      return result;
+    }
+
+    /**
+     * Performs a binary search of `array` to determine the index at which `value`
+     * should be inserted into `array` in order to maintain its sort order.
+     *
+     * @private
+     * @param {Array} array The sorted array to inspect.
+     * @param {*} value The value to evaluate.
+     * @param {boolean} [retHighest] Specify returning the highest qualified index.
+     * @returns {number} Returns the index at which `value` should be inserted
+     *  into `array`.
+     */
+    function binaryIndex(array, value, retHighest) {
+      var low = 0,
+          high = array ? array.length : low;
+
+      if (typeof value == 'number' && value === value && high <= HALF_MAX_ARRAY_LENGTH) {
+        while (low < high) {
+          var mid = (low + high) >>> 1,
+              computed = array[mid];
+
+          if ((retHighest ? (computed <= value) : (computed < value)) && computed !== null) {
+            low = mid + 1;
+          } else {
+            high = mid;
+          }
+        }
+        return high;
+      }
+      return binaryIndexBy(array, value, identity, retHighest);
+    }
+
+    /**
+     * This function is like `binaryIndex` except that it invokes `iteratee` for
+     * `value` and each element of `array` to compute their sort ranking. The
+     * iteratee is invoked with one argument; (value).
+     *
+     * @private
+     * @param {Array} array The sorted array to inspect.
+     * @param {*} value The value to evaluate.
+     * @param {Function} iteratee The function invoked per iteration.
+     * @param {boolean} [retHighest] Specify returning the highest qualified index.
+     * @returns {number} Returns the index at which `value` should be inserted
+     *  into `array`.
+     */
+    function binaryIndexBy(array, value, iteratee, retHighest) {
+      value = iteratee(value);
+
+      var low = 0,
+          high = array ? array.length : 0,
+          valIsNaN = value !== value,
+          valIsNull = value === null,
+          valIsUndef = value === undefined;
+
+      while (low < high) {
+        var mid = nativeFloor((low + high) / 2),
+            computed = iteratee(array[mid]),
+            isDef = computed !== undefined,
+            isReflexive = computed === computed;
+
+        if (valIsNaN) {
+          var setLow = isReflexive || retHighest;
+        } else if (valIsNull) {
+          setLow = isReflexive && isDef && (retHighest || computed != null);
+        } else if (valIsUndef) {
+          setLow = isReflexive && (retHighest || isDef);
+        } else if (computed == null) {
+          setLow = false;
+        } else {
+          setLow = retHighest ? (computed <= value) : (computed < value);
+        }
+        if (setLow) {
+          low = mid + 1;
+        } else {
+          high = mid;
+        }
+      }
+      return nativeMin(high, MAX_ARRAY_INDEX);
+    }
+
+    /**
+     * A specialized version of `baseCallback` which only supports `this` binding
+     * and specifying the number of arguments to provide to `func`.
+     *
+     * @private
+     * @param {Function} func The function to bind.
+     * @param {*} thisArg The `this` binding of `func`.
+     * @param {number} [argCount] The number of arguments to provide to `func`.
+     * @returns {Function} Returns the callback.
+     */
+    function bindCallback(func, thisArg, argCount) {
+      if (typeof func != 'function') {
+        return identity;
+      }
+      if (thisArg === undefined) {
+        return func;
+      }
+      switch (argCount) {
+        case 1: return function(value) {
+          return func.call(thisArg, value);
+        };
+        case 3: return function(value, index, collection) {
+          return func.call(thisArg, value, index, collection);
+        };
+        case 4: return function(accumulator, value, index, collection) {
+          return func.call(thisArg, accumulator, value, index, collection);
+        };
+        case 5: return function(value, other, key, object, source) {
+          return func.call(thisArg, value, other, key, object, source);
+        };
+      }
+      return function() {
+        return func.apply(thisArg, arguments);
+      };
+    }
+
+    /**
+     * Creates a clone of the given array buffer.
+     *
+     * @private
+     * @param {ArrayBuffer} buffer The array buffer to clone.
+     * @returns {ArrayBuffer} Returns the cloned array buffer.
+     */
+    function bufferClone(buffer) {
+      var result = new ArrayBuffer(buffer.byteLength),
+          view = new Uint8Array(result);
+
+      view.set(new Uint8Array(buffer));
+      return result;
+    }
+
+    /**
+     * Creates an array that is the composition of partially applied arguments,
+     * placeholders, and provided arguments into a single array of arguments.
+     *
+     * @private
+     * @param {Array|Object} args The provided arguments.
+     * @param {Array} partials The arguments to prepend to those provided.
+     * @param {Array} holders The `partials` placeholder indexes.
+     * @returns {Array} Returns the new array of composed arguments.
+     */
+    function composeArgs(args, partials, holders) {
+      var holdersLength = holders.length,
+          argsIndex = -1,
+          argsLength = nativeMax(args.length - holdersLength, 0),
+          leftIndex = -1,
+          leftLength = partials.length,
+          result = Array(leftLength + argsLength);
+
+      while (++leftIndex < leftLength) {
+        result[leftIndex] = partials[leftIndex];
+      }
+      while (++argsIndex < holdersLength) {
+        result[holders[argsIndex]] = args[argsIndex];
+      }
+      while (argsLength--) {
+        result[leftIndex++] = args[argsIndex++];
+      }
+      return result;
+    }
+
+    /**
+     * This function is like `composeArgs` except that the arguments composition
+     * is tailored for `_.partialRight`.
+     *
+     * @private
+     * @param {Array|Object} args The provided arguments.
+     * @param {Array} partials The arguments to append to those provided.
+     * @param {Array} holders The `partials` placeholder indexes.
+     * @returns {Array} Returns the new array of composed arguments.
+     */
+    function composeArgsRight(args, partials, holders) {
+      var holdersIndex = -1,
+          holdersLength = holders.length,
+          argsIndex = -1,
+          argsLength = nativeMax(args.length - holdersLength, 0),
+          rightIndex = -1,
+          rightLength = partials.length,
+          result = Array(argsLength + rightLength);
+
+      while (++argsIndex < argsLength) {
+        result[argsIndex] = args[argsIndex];
+      }
+      var offset = argsIndex;
+      while (++rightIndex < rightLength) {
+        result[offset + rightIndex] = partials[rightIndex];
+      }
+      while (++holdersIndex < holdersLength) {
+        result[offset + holders[holdersIndex]] = args[argsIndex++];
+      }
+      return result;
+    }
+
+    /**
+     * Creates a `_.countBy`, `_.groupBy`, `_.indexBy`, or `_.partition` function.
+     *
+     * @private
+     * @param {Function} setter The function to set keys and values of the accumulator object.
+     * @param {Function} [initializer] The function to initialize the accumulator object.
+     * @returns {Function} Returns the new aggregator function.
+     */
+    function createAggregator(setter, initializer) {
+      return function(collection, iteratee, thisArg) {
+        var result = initializer ? initializer() : {};
+        iteratee = getCallback(iteratee, thisArg, 3);
+
+        if (isArray(collection)) {
+          var index = -1,
+              length = collection.length;
+
+          while (++index < length) {
+            var value = collection[index];
+            setter(result, value, iteratee(value, index, collection), collection);
+          }
+        } else {
+          baseEach(collection, function(value, key, collection) {
+            setter(result, value, iteratee(value, key, collection), collection);
+          });
+        }
+        return result;
+      };
+    }
+
+    /**
+     * Creates a `_.assign`, `_.defaults`, or `_.merge` function.
+     *
+     * @private
+     * @param {Function} assigner The function to assign values.
+     * @returns {Function} Returns the new assigner function.
+     */
+    function createAssigner(assigner) {
+      return restParam(function(object, sources) {
+        var index = -1,
+            length = object == null ? 0 : sources.length,
+            customizer = length > 2 ? sources[length - 2] : undefined,
+            guard = length > 2 ? sources[2] : undefined,
+            thisArg = length > 1 ? sources[length - 1] : undefined;
+
+        if (typeof customizer == 'function') {
+          customizer = bindCallback(customizer, thisArg, 5);
+          length -= 2;
+        } else {
+          customizer = typeof thisArg == 'function' ? thisArg : undefined;
+          length -= (customizer ? 1 : 0);
+        }
+        if (guard && isIterateeCall(sources[0], sources[1], guard)) {
+          customizer = length < 3 ? undefined : customizer;
+          length = 1;
+        }
+        while (++index < length) {
+          var source = sources[index];
+          if (source) {
+            assigner(object, source, customizer);
+          }
+        }
+        return object;
+      });
+    }
+
+    /**
+     * Creates a `baseEach` or `baseEachRight` function.
+     *
+     * @private
+     * @param {Function} eachFunc The function to iterate over a collection.
+     * @param {boolean} [fromRight] Specify iterating from right to left.
+     * @returns {Function} Returns the new base function.
+     */
+    function createBaseEach(eachFunc, fromRight) {
+      return function(collection, iteratee) {
+        var length = collection ? getLength(collection) : 0;
+        if (!isLength(length)) {
+          return eachFunc(collection, iteratee);
+        }
+        var index = fromRight ? length : -1,
+            iterable = toObject(collection);
+
+        while ((fromRight ? index-- : ++index < length)) {
+          if (iteratee(iterable[index], index, iterable) === false) {
+            break;
+          }
+        }
+        return collection;
+      };
+    }
+
+    /**
+     * Creates a base function for `_.forIn` or `_.forInRight`.
+     *
+     * @private
+     * @param {boolean} [fromRight] Specify iterating from right to left.
+     * @returns {Function} Returns the new base function.
+     */
+    function createBaseFor(fromRight) {
+      return function(object, iteratee, keysFunc) {
+        var iterable = toObject(object),
+            props = keysFunc(object),
+            length = props.length,
+            index = fromRight ? length : -1;
+
+        while ((fromRight ? index-- : ++index < length)) {
+          var key = props[index];
+          if (iteratee(iterable[key], key, iterable) === false) {
+            break;
+          }
+        }
+        return object;
+      };
+    }
+
+    /**
+     * Creates a function that wraps `func` and invokes it with the `this`
+     * binding of `thisArg`.
+     *
+     * @private
+     * @param {Function} func The function to bind.
+     * @param {*} [thisArg] The `this` binding of `func`.
+     * @returns {Function} Returns the new bound function.
+     */
+    function createBindWrapper(func, thisArg) {
+      var Ctor = createCtorWrapper(func);
+
+      function wrapper() {
+        var fn = (this && this !== root && this instanceof wrapper) ? Ctor : func;
+        return fn.apply(thisArg, arguments);
+      }
+      return wrapper;
+    }
+
+    /**
+     * Creates a `Set` cache object to optimize linear searches of large arrays.
+     *
+     * @private
+     * @param {Array} [values] The values to cache.
+     * @returns {null|Object} Returns the new cache object if `Set` is supported, else `null`.
+     */
+    function createCache(values) {
+      return (nativeCreate && Set) ? new SetCache(values) : null;
+    }
+
+    /**
+     * Creates a function that produces compound words out of the words in a
+     * given string.
+     *
+     * @private
+     * @param {Function} callback The function to combine each word.
+     * @returns {Function} Returns the new compounder function.
+     */
+    function createCompounder(callback) {
+      return function(string) {
+        var index = -1,
+            array = words(deburr(string)),
+            length = array.length,
+            result = '';
+
+        while (++index < length) {
+          result = callback(result, array[index], index);
+        }
+        return result;
+      };
+    }
+
+    /**
+     * Creates a function that produces an instance of `Ctor` regardless of
+     * whether it was invoked as part of a `new` expression or by `call` or `apply`.
+     *
+     * @private
+     * @param {Function} Ctor The constructor to wrap.
+     * @returns {Function} Returns the new wrapped function.
+     */
+    function createCtorWrapper(Ctor) {
+      return function() {
+        // Use a `switch` statement to work with class constructors.
+        // See http://ecma-international.org/ecma-262/6.0/#sec-ecmascript-function-objects-call-thisargument-argumentslist
+        // for more details.
+        var args = arguments;
+        switch (args.length) {
+          case 0: return new Ctor;
+          case 1: return new Ctor(args[0]);
+          case 2: return new Ctor(args[0], args[1]);
+          case 3: return new Ctor(args[0], args[1], args[2]);
+          case 4: return new Ctor(args[0], args[1], args[2], args[3]);
+          case 5: return new Ctor(args[0], args[1], args[2], args[3], args[4]);
+          case 6: return new Ctor(args[0], args[1], args[2], args[3], args[4], args[5]);
+          case 7: return new Ctor(args[0], args[1], args[2], args[3], args[4], args[5], args[6]);
+        }
+        var thisBinding = baseCreate(Ctor.prototype),
+            result = Ctor.apply(thisBinding, args);
+
+        // Mimic the constructor's `return` behavior.
+        // See https://es5.github.io/#x13.2.2 for more details.
+        return isObject(result) ? result : thisBinding;
+      };
+    }
+
+    /**
+     * Creates a `_.curry` or `_.curryRight` function.
+     *
+     * @private
+     * @param {boolean} flag The curry bit flag.
+     * @returns {Function} Returns the new curry function.
+     */
+    function createCurry(flag) {
+      function curryFunc(func, arity, guard) {
+        if (guard && isIterateeCall(func, arity, guard)) {
+          arity = undefined;
+        }
+        var result = createWrapper(func, flag, undefined, undefined, undefined, undefined, undefined, arity);
+        result.placeholder = curryFunc.placeholder;
+        return result;
+      }
+      return curryFunc;
+    }
+
+    /**
+     * Creates a `_.defaults` or `_.defaultsDeep` function.
+     *
+     * @private
+     * @param {Function} assigner The function to assign values.
+     * @param {Function} customizer The function to customize assigned values.
+     * @returns {Function} Returns the new defaults function.
+     */
+    function createDefaults(assigner, customizer) {
+      return restParam(function(args) {
+        var object = args[0];
+        if (object == null) {
+          return object;
+        }
+        args.push(customizer);
+        return assigner.apply(undefined, args);
+      });
+    }
+
+    /**
+     * Creates a `_.max` or `_.min` function.
+     *
+     * @private
+     * @param {Function} comparator The function used to compare values.
+     * @param {*} exValue The initial extremum value.
+     * @returns {Function} Returns the new extremum function.
+     */
+    function createExtremum(comparator, exValue) {
+      return function(collection, iteratee, thisArg) {
+        if (thisArg && isIterateeCall(collection, iteratee, thisArg)) {
+          iteratee = undefined;
+        }
+        iteratee = getCallback(iteratee, thisArg, 3);
+        if (iteratee.length == 1) {
+          collection = isArray(collection) ? collection : toIterable(collection);
+          var result = arrayExtremum(collection, iteratee, comparator, exValue);
+          if (!(collection.length && result === exValue)) {
+            return result;
+          }
+        }
+        return baseExtremum(collection, iteratee, comparator, exValue);
+      };
+    }
+
+    /**
+     * Creates a `_.find` or `_.findLast` function.
+     *
+     * @private
+     * @param {Function} eachFunc The function to iterate over a collection.
+     * @param {boolean} [fromRight] Specify iterating from right to left.
+     * @returns {Function} Returns the new find function.
+     */
+    function createFind(eachFunc, fromRight) {
+      return function(collection, predicate, thisArg) {
+        predicate = getCallback(predicate, thisArg, 3);
+        if (isArray(collection)) {
+          var index = baseFindIndex(collection, predicate, fromRight);
+          return index > -1 ? collection[index] : undefined;
+        }
+        return baseFind(collection, predicate, eachFunc);
+      };
+    }
+
+    /**
+     * Creates a `_.findIndex` or `_.findLastIndex` function.
+     *
+     * @private
+     * @param {boolean} [fromRight] Specify iterating from right to left.
+     * @returns {Function} Returns the new find function.
+     */
+    function createFindIndex(fromRight) {
+      return function(array, predicate, thisArg) {
+        if (!(array && array.length)) {
+          return -1;
+        }
+        predicate = getCallback(predicate, thisArg, 3);
+        return baseFindIndex(array, predicate, fromRight);
+      };
+    }
+
+    /**
+     * Creates a `_.findKey` or `_.findLastKey` function.
+     *
+     * @private
+     * @param {Function} objectFunc The function to iterate over an object.
+     * @returns {Function} Returns the new find function.
+     */
+    function createFindKey(objectFunc) {
+      return function(object, predicate, thisArg) {
+        predicate = getCallback(predicate, thisArg, 3);
+        return baseFind(object, predicate, objectFunc, true);
+      };
+    }
+
+    /**
+     * Creates a `_.flow` or `_.flowRight` function.
+     *
+     * @private
+     * @param {boolean} [fromRight] Specify iterating from right to left.
+     * @returns {Function} Returns the new flow function.
+     */
+    function createFlow(fromRight) {
+      return function() {
+        var wrapper,
+            length = arguments.length,
+            index = fromRight ? length : -1,
+            leftIndex = 0,
+            funcs = Array(length);
+
+        while ((fromRight ? index-- : ++index < length)) {
+          var func = funcs[leftIndex++] = arguments[index];
+          if (typeof func != 'function') {
+            throw new TypeError(FUNC_ERROR_TEXT);
+          }
+          if (!wrapper && LodashWrapper.prototype.thru && getFuncName(func) == 'wrapper') {
+            wrapper = new LodashWrapper([], true);
+          }
+        }
+        index = wrapper ? -1 : length;
+        while (++index < length) {
+          func = funcs[index];
+
+          var funcName = getFuncName(func),
+              data = funcName == 'wrapper' ? getData(func) : undefined;
+
+          if (data && isLaziable(data[0]) && data[1] == (ARY_FLAG | CURRY_FLAG | PARTIAL_FLAG | REARG_FLAG) && !data[4].length && data[9] == 1) {
+            wrapper = wrapper[getFuncName(data[0])].apply(wrapper, data[3]);
+          } else {
+            wrapper = (func.length == 1 && isLaziable(func)) ? wrapper[funcName]() : wrapper.thru(func);
+          }
+        }
+        return function() {
+          var args = arguments,
+              value = args[0];
+
+          if (wrapper && args.length == 1 && isArray(value) && value.length >= LARGE_ARRAY_SIZE) {
+            return wrapper.plant(value).value();
+          }
+          var index = 0,
+              result = length ? funcs[index].apply(this, args) : value;
+
+          while (++index < length) {
+            result = funcs[index].call(this, result);
+          }
+          return result;
+        };
+      };
+    }
+
+    /**
+     * Creates a function for `_.forEach` or `_.forEachRight`.
+     *
+     * @private
+     * @param {Function} arrayFunc The function to iterate over an array.
+     * @param {Function} eachFunc The function to iterate over a collection.
+     * @returns {Function} Returns the new each function.
+     */
+    function createForEach(arrayFunc, eachFunc) {
+      return function(collection, iteratee, thisArg) {
+        return (typeof iteratee == 'function' && thisArg === undefined && isArray(collection))
+          ? arrayFunc(collection, iteratee)
+          : eachFunc(collection, bindCallback(iteratee, thisArg, 3));
+      };
+    }
+
+    /**
+     * Creates a function for `_.forIn` or `_.forInRight`.
+     *
+     * @private
+     * @param {Function} objectFunc The function to iterate over an object.
+     * @returns {Function} Returns the new each function.
+     */
+    function createForIn(objectFunc) {
+      return function(object, iteratee, thisArg) {
+        if (typeof iteratee != 'function' || thisArg !== undefined) {
+          iteratee = bindCallback(iteratee, thisArg, 3);
+        }
+        return objectFunc(object, iteratee, keysIn);
+      };
+    }
+
+    /**
+     * Creates a function for `_.forOwn` or `_.forOwnRight`.
+     *
+     * @private
+     * @param {Function} objectFunc The function to iterate over an object.
+     * @returns {Function} Returns the new each function.
+     */
+    function createForOwn(objectFunc) {
+      return function(object, iteratee, thisArg) {
+        if (typeof iteratee != 'function' || thisArg !== undefined) {
+          iteratee = bindCallback(iteratee, thisArg, 3);
+        }
+        return objectFunc(object, iteratee);
+      };
+    }
+
+    /**
+     * Creates a function for `_.mapKeys` or `_.mapValues`.
+     *
+     * @private
+     * @param {boolean} [isMapKeys] Specify mapping keys instead of values.
+     * @returns {Function} Returns the new map function.
+     */
+    function createObjectMapper(isMapKeys) {
+      return function(object, iteratee, thisArg) {
+        var result = {};
+        iteratee = getCallback(iteratee, thisArg, 3);
+
+        baseForOwn(object, function(value, key, object) {
+          var mapped = iteratee(value, key, object);
+          key = isMapKeys ? mapped : key;
+          value = isMapKeys ? value : mapped;
+          result[key] = value;
+        });
+        return result;
+      };
+    }
+
+    /**
+     * Creates a function for `_.padLeft` or `_.padRight`.
+     *
+     * @private
+     * @param {boolean} [fromRight] Specify padding from the right.
+     * @returns {Function} Returns the new pad function.
+     */
+    function createPadDir(fromRight) {
+      return function(string, length, chars) {
+        string = baseToString(string);
+        return (fromRight ? string : '') + createPadding(string, length, chars) + (fromRight ? '' : string);
+      };
+    }
+
+    /**
+     * Creates a `_.partial` or `_.partialRight` function.
+     *
+     * @private
+     * @param {boolean} flag The partial bit flag.
+     * @returns {Function} Returns the new partial function.
+     */
+    function createPartial(flag) {
+      var partialFunc = restParam(function(func, partials) {
+        var holders = replaceHolders(partials, partialFunc.placeholder);
+        return createWrapper(func, flag, undefined, partials, holders);
+      });
+      return partialFunc;
+    }
+
+    /**
+     * Creates a function for `_.reduce` or `_.reduceRight`.
+     *
+     * @private
+     * @param {Function} arrayFunc The function to iterate over an array.
+     * @param {Function} eachFunc The function to iterate over a collection.
+     * @returns {Function} Returns the new each function.
+     */
+    function createReduce(arrayFunc, eachFunc) {
+      return function(collection, iteratee, accumulator, thisArg) {
+        var initFromArray = arguments.length < 3;
+        return (typeof iteratee == 'function' && thisArg === undefined && isArray(collection))
+          ? arrayFunc(collection, iteratee, accumulator, initFromArray)
+          : baseReduce(collection, getCallback(iteratee, thisArg, 4), accumulator, initFromArray, eachFunc);
+      };
+    }
+
+    /**
+     * Creates a function that wraps `func` and invokes it with optional `this`
+     * binding of, partial application, and currying.
+     *
+     * @private
+     * @param {Function|string} func The function or method name to reference.
+     * @param {number} bitmask The bitmask of flags. See `createWrapper` for more details.
+     * @param {*} [thisArg] The `this` binding of `func`.
+     * @param {Array} [partials] The arguments to prepend to those provided to the new function.
+     * @param {Array} [holders] The `partials` placeholder indexes.
+     * @param {Array} [partialsRight] The arguments to append to those provided to the new function.
+     * @param {Array} [holdersRight] The `partialsRight` placeholder indexes.
+     * @param {Array} [argPos] The argument positions of the new function.
+     * @param {number} [ary] The arity cap of `func`.
+     * @param {number} [arity] The arity of `func`.
+     * @returns {Function} Returns the new wrapped function.
+     */
+    function createHybridWrapper(func, bitmask, thisArg, partials, holders, partialsRight, holdersRight, argPos, ary, arity) {
+      var isAry = bitmask & ARY_FLAG,
+          isBind = bitmask & BIND_FLAG,
+          isBindKey = bitmask & BIND_KEY_FLAG,
+          isCurry = bitmask & CURRY_FLAG,
+          isCurryBound = bitmask & CURRY_BOUND_FLAG,
+          isCurryRight = bitmask & CURRY_RIGHT_FLAG,
+          Ctor = isBindKey ? undefined : createCtorWrapper(func);
+
+      function wrapper() {
+        // Avoid `arguments` object use disqualifying optimizations by
+        // converting it to an array before providing it to other functions.
+        var length = arguments.length,
+            index = length,
+            args = Array(length);
+
+        while (index--) {
+          args[index] = arguments[index];
+        }
+        if (partials) {
+          args = composeArgs(args, partials, holders);
+        }
+        if (partialsRight) {
+          args = composeArgsRight(args, partialsRight, holdersRight);
+        }
+        if (isCurry || isCurryRight) {
+          var placeholder = wrapper.placeholder,
+              argsHolders = replaceHolders(args, placeholder);
+
+          length -= argsHolders.length;
+          if (length < arity) {
+            var newArgPos = argPos ? arrayCopy(argPos) : undefined,
+                newArity = nativeMax(arity - length, 0),
+                newsHolders = isCurry ? argsHolders : undefined,
+                newHoldersRight = isCurry ? undefined : argsHolders,
+                newPartials = isCurry ? args : undefined,
+                newPartialsRight = isCurry ? undefined : args;
+
+            bitmask |= (isCurry ? PARTIAL_FLAG : PARTIAL_RIGHT_FLAG);
+            bitmask &= ~(isCurry ? PARTIAL_RIGHT_FLAG : PARTIAL_FLAG);
+
+            if (!isCurryBound) {
+              bitmask &= ~(BIND_FLAG | BIND_KEY_FLAG);
+            }
+            var newData = [func, bitmask, thisArg, newPartials, newsHolders, newPartialsRight, newHoldersRight, newArgPos, ary, newArity],
+                result = createHybridWrapper.apply(undefined, newData);
+
+            if (isLaziable(func)) {
+              setData(result, newData);
+            }
+            result.placeholder = placeholder;
+            return result;
+          }
+        }
+        var thisBinding = isBind ? thisArg : this,
+            fn = isBindKey ? thisBinding[func] : func;
+
+        if (argPos) {
+          args = reorder(args, argPos);
+        }
+        if (isAry && ary < args.length) {
+          args.length = ary;
+        }
+        if (this && this !== root && this instanceof wrapper) {
+          fn = Ctor || createCtorWrapper(func);
+        }
+        return fn.apply(thisBinding, args);
+      }
+      return wrapper;
+    }
+
+    /**
+     * Creates the padding required for `string` based on the given `length`.
+     * The `chars` string is truncated if the number of characters exceeds `length`.
+     *
+     * @private
+     * @param {string} string The string to create padding for.
+     * @param {number} [length=0] The padding length.
+     * @param {string} [chars=' '] The string used as padding.
+     * @returns {string} Returns the pad for `string`.
+     */
+    function createPadding(string, length, chars) {
+      var strLength = string.length;
+      length = +length;
+
+      if (strLength >= length || !nativeIsFinite(length)) {
+        return '';
+      }
+      var padLength = length - strLength;
+      chars = chars == null ? ' ' : (chars + '');
+      return repeat(chars, nativeCeil(padLength / chars.length)).slice(0, padLength);
+    }
+
+    /**
+     * Creates a function that wraps `func` and invokes it with the optional `this`
+     * binding of `thisArg` and the `partials` prepended to those provided to
+     * the wrapper.
+     *
+     * @private
+     * @param {Function} func The function to partially apply arguments to.
+     * @param {number} bitmask The bitmask of flags. See `createWrapper` for more details.
+     * @param {*} thisArg The `this` binding of `func`.
+     * @param {Array} partials The arguments to prepend to those provided to the new function.
+     * @returns {Function} Returns the new bound function.
+     */
+    function createPartialWrapper(func, bitmask, thisArg, partials) {
+      var isBind = bitmask & BIND_FLAG,
+          Ctor = createCtorWrapper(func);
+
+      function wrapper() {
+        // Avoid `arguments` object use disqualifying optimizations by
+        // converting it to an array before providing it `func`.
+        var argsIndex = -1,
+            argsLength = arguments.length,
+            leftIndex = -1,
+            leftLength = partials.length,
+            args = Array(leftLength + argsLength);
+
+        while (++leftIndex < leftLength) {
+          args[leftIndex] = partials[leftIndex];
+        }
+        while (argsLength--) {
+          args[leftIndex++] = arguments[++argsIndex];
+        }
+        var fn = (this && this !== root && this instanceof wrapper) ? Ctor : func;
+        return fn.apply(isBind ? thisArg : this, args);
+      }
+      return wrapper;
+    }
+
+    /**
+     * Creates a `_.ceil`, `_.floor`, or `_.round` function.
+     *
+     * @private
+     * @param {string} methodName The name of the `Math` method to use when rounding.
+     * @returns {Function} Returns the new round function.
+     */
+    function createRound(methodName) {
+      var func = Math[methodName];
+      return function(number, precision) {
+        precision = precision === undefined ? 0 : (+precision || 0);
+        if (precision) {
+          precision = pow(10, precision);
+          return func(number * precision) / precision;
+        }
+        return func(number);
+      };
+    }
+
+    /**
+     * Creates a `_.sortedIndex` or `_.sortedLastIndex` function.
+     *
+     * @private
+     * @param {boolean} [retHighest] Specify returning the highest qualified index.
+     * @returns {Function} Returns the new index function.
+     */
+    function createSortedIndex(retHighest) {
+      return function(array, value, iteratee, thisArg) {
+        var callback = getCallback(iteratee);
+        return (iteratee == null && callback === baseCallback)
+          ? binaryIndex(array, value, retHighest)
+          : binaryIndexBy(array, value, callback(iteratee, thisArg, 1), retHighest);
+      };
+    }
+
+    /**
+     * Creates a function that either curries or invokes `func` with optional
+     * `this` binding and partially applied arguments.
+     *
+     * @private
+     * @param {Function|string} func The function or method name to reference.
+     * @param {number} bitmask The bitmask of flags.
+     *  The bitmask may be composed of the following flags:
+     *     1 - `_.bind`
+     *     2 - `_.bindKey`
+     *     4 - `_.curry` or `_.curryRight` of a bound function
+     *     8 - `_.curry`
+     *    16 - `_.curryRight`
+     *    32 - `_.partial`
+     *    64 - `_.partialRight`
+     *   128 - `_.rearg`
+     *   256 - `_.ary`
+     * @param {*} [thisArg] The `this` binding of `func`.
+     * @param {Array} [partials] The arguments to be partially applied.
+     * @param {Array} [holders] The `partials` placeholder indexes.
+     * @param {Array} [argPos] The argument positions of the new function.
+     * @param {number} [ary] The arity cap of `func`.
+     * @param {number} [arity] The arity of `func`.
+     * @returns {Function} Returns the new wrapped function.
+     */
+    function createWrapper(func, bitmask, thisArg, partials, holders, argPos, ary, arity) {
+      var isBindKey = bitmask & BIND_KEY_FLAG;
+      if (!isBindKey && typeof func != 'function') {
+        throw new TypeError(FUNC_ERROR_TEXT);
+      }
+      var length = partials ? partials.length : 0;
+      if (!length) {
+        bitmask &= ~(PARTIAL_FLAG | PARTIAL_RIGHT_FLAG);
+        partials = holders = undefined;
+      }
+      length -= (holders ? holders.length : 0);
+      if (bitmask & PARTIAL_RIGHT_FLAG) {
+        var partialsRight = partials,
+            holdersRight = holders;
+
+        partials = holders = undefined;
+      }
+      var data = isBindKey ? undefined : getData(func),
+          newData = [func, bitmask, thisArg, partials, holders, partialsRight, holdersRight, argPos, ary, arity];
+
+      if (data) {
+        mergeData(newData, data);
+        bitmask = newData[1];
+        arity = newData[9];
+      }
+      newData[9] = arity == null
+        ? (isBindKey ? 0 : func.length)
+        : (nativeMax(arity - length, 0) || 0);
+
+      if (bitmask == BIND_FLAG) {
+        var result = createBindWrapper(newData[0], newData[2]);
+      } else if ((bitmask == PARTIAL_FLAG || bitmask == (BIND_FLAG | PARTIAL_FLAG)) && !newData[4].length) {
+        result = createPartialWrapper.apply(undefined, newData);
+      } else {
+        result = createHybridWrapper.apply(undefined, newData);
+      }
+      var setter = data ? baseSetData : setData;
+      return setter(result, newData);
+    }
+
+    /**
+     * A specialized version of `baseIsEqualDeep` for arrays with support for
+     * partial deep comparisons.
+     *
+     * @private
+     * @param {Array} array The array to compare.
+     * @param {Array} other The other array to compare.
+     * @param {Function} equalFunc The function to determine equivalents of values.
+     * @param {Function} [customizer] The function to customize comparing arrays.
+     * @param {boolean} [isLoose] Specify performing partial comparisons.
+     * @param {Array} [stackA] Tracks traversed `value` objects.
+     * @param {Array} [stackB] Tracks traversed `other` objects.
+     * @returns {boolean} Returns `true` if the arrays are equivalent, else `false`.
+     */
+    function equalArrays(array, other, equalFunc, customizer, isLoose, stackA, stackB) {
+      var index = -1,
+          arrLength = array.length,
+          othLength = other.length;
+
+      if (arrLength != othLength && !(isLoose && othLength > arrLength)) {
+        return false;
+      }
+      // Ignore non-index properties.
+      while (++index < arrLength) {
+        var arrValue = array[index],
+            othValue = other[index],
+            result = customizer ? customizer(isLoose ? othValue : arrValue, isLoose ? arrValue : othValue, index) : undefined;
+
+        if (result !== undefined) {
+          if (result) {
+            continue;
+          }
+          return false;
+        }
+        // Recursively compare arrays (susceptible to call stack limits).
+        if (isLoose) {
+          if (!arraySome(other, function(othValue) {
+                return arrValue === othValue || equalFunc(arrValue, othValue, customizer, isLoose, stackA, stackB);
+              })) {
+            return false;
+          }
+        } else if (!(arrValue === othValue || equalFunc(arrValue, othValue, customizer, isLoose, stackA, stackB))) {
+          return false;
+        }
+      }
+      return true;
+    }
+
+    /**
+     * A specialized version of `baseIsEqualDeep` for comparing objects of
+     * the same `toStringTag`.
+     *
+     * **Note:** This function only supports comparing values with tags of
+     * `Boolean`, `Date`, `Error`, `Number`, `RegExp`, or `String`.
+     *
+     * @private
+     * @param {Object} object The object to compare.
+     * @param {Object} other The other object to compare.
+     * @param {string} tag The `toStringTag` of the objects to compare.
+     * @returns {boolean} Returns `true` if the objects are equivalent, else `false`.
+     */
+    function equalByTag(object, other, tag) {
+      switch (tag) {
+        case boolTag:
+        case dateTag:
+          // Coerce dates and booleans to numbers, dates to milliseconds and booleans
+          // to `1` or `0` treating invalid dates coerced to `NaN` as not equal.
+          return +object == +other;
+
+        case errorTag:
+          return object.name == other.name && object.message == other.message;
+
+        case numberTag:
+          // Treat `NaN` vs. `NaN` as equal.
+          return (object != +object)
+            ? other != +other
+            : object == +other;
+
+        case regexpTag:
+        case stringTag:
+          // Coerce regexes to strings and treat strings primitives and string
+          // objects as equal. See https://es5.github.io/#x15.10.6.4 for more details.
+          return object == (other + '');
+      }
+      return false;
+    }
+
+    /**
+     * A specialized version of `baseIsEqualDeep` for objects with support for
+     * partial deep comparisons.
+     *
+     * @private
+     * @param {Object} object The object to compare.
+     * @param {Object} other The other object to compare.
+     * @param {Function} equalFunc The function to determine equivalents of values.
+     * @param {Function} [customizer] The function to customize comparing values.
+     * @param {boolean} [isLoose] Specify performing partial comparisons.
+     * @param {Array} [stackA] Tracks traversed `value` objects.
+     * @param {Array} [stackB] Tracks traversed `other` objects.
+     * @returns {boolean} Returns `true` if the objects are equivalent, else `false`.
+     */
+    function equalObjects(object, other, equalFunc, customizer, isLoose, stackA, stackB) {
+      var objProps = keys(object),
+          objLength = objProps.length,
+          othProps = keys(other),
+          othLength = othProps.length;
+
+      if (objLength != othLength && !isLoose) {
+        return false;
+      }
+      var index = objLength;
+      while (index--) {
+        var key = objProps[index];
+        if (!(isLoose ? key in other : hasOwnProperty.call(other, key))) {
+          return false;
+        }
+      }
+      var skipCtor = isLoose;
+      while (++index < objLength) {
+        key = objProps[index];
+        var objValue = object[key],
+            othValue = other[key],
+            result = customizer ? customizer(isLoose ? othValue : objValue, isLoose? objValue : othValue, key) : undefined;
+
+        // Recursively compare objects (susceptible to call stack limits).
+        if (!(result === undefined ? equalFunc(objValue, othValue, customizer, isLoose, stackA, stackB) : result)) {
+          return false;
+        }
+        skipCtor || (skipCtor = key == 'constructor');
+      }
+      if (!skipCtor) {
+        var objCtor = object.constructor,
+            othCtor = other.constructor;
+
+        // Non `Object` object instances with different constructors are not equal.
+        if (objCtor != othCtor &&
+            ('constructor' in object && 'constructor' in other) &&
+            !(typeof objCtor == 'function' && objCtor instanceof objCtor &&
+              typeof othCtor == 'function' && othCtor instanceof othCtor)) {
+          return false;
+        }
+      }
+      return true;
+    }
+
+    /**
+     * Gets the appropriate "callback" function. If the `_.callback` method is
+     * customized this function returns the custom method, otherwise it returns
+     * the `baseCallback` function. If arguments are provided the chosen function
+     * is invoked with them and its result is returned.
+     *
+     * @private
+     * @returns {Function} Returns the chosen function or its result.
+     */
+    function getCallback(func, thisArg, argCount) {
+      var result = lodash.callback || callback;
+      result = result === callback ? baseCallback : result;
+      return argCount ? result(func, thisArg, argCount) : result;
+    }
+
+    /**
+     * Gets metadata for `func`.
+     *
+     * @private
+     * @param {Function} func The function to query.
+     * @returns {*} Returns the metadata for `func`.
+     */
+    var getData = !metaMap ? noop : function(func) {
+      return metaMap.get(func);
+    };
+
+    /**
+     * Gets the name of `func`.
+     *
+     * @private
+     * @param {Function} func The function to query.
+     * @returns {string} Returns the function name.
+     */
+    function getFuncName(func) {
+      var result = (func.name + ''),
+          array = realNames[result],
+          length = array ? array.length : 0;
+
+      while (length--) {
+        var data = array[length],
+            otherFunc = data.func;
+        if (otherFunc == null || otherFunc == func) {
+          return data.name;
+        }
+      }
+      return result;
+    }
+
+    /**
+     * Gets the appropriate "indexOf" function. If the `_.indexOf` method is
+     * customized this function returns the custom method, otherwise it returns
+     * the `baseIndexOf` function. If arguments are provided the chosen function
+     * is invoked with them and its result is returned.
+     *
+     * @private
+     * @returns {Function|number} Returns the chosen function or its result.
+     */
+    function getIndexOf(collection, target, fromIndex) {
+      var result = lodash.indexOf || indexOf;
+      result = result === indexOf ? baseIndexOf : result;
+      return collection ? result(collection, target, fromIndex) : result;
+    }
+
+    /**
+     * Gets the "length" property value of `object`.
+     *
+     * **Note:** This function is used to avoid a [JIT bug](https://bugs.webkit.org/show_bug.cgi?id=142792)
+     * that affects Safari on at least iOS 8.1-8.3 ARM64.
+     *
+     * @private
+     * @param {Object} object The object to query.
+     * @returns {*} Returns the "length" value.
+     */
+    var getLength = baseProperty('length');
+
+    /**
+     * Gets the propery names, values, and compare flags of `object`.
+     *
+     * @private
+     * @param {Object} object The object to query.
+     * @returns {Array} Returns the match data of `object`.
+     */
+    function getMatchData(object) {
+      var result = pairs(object),
+          length = result.length;
+
+      while (length--) {
+        result[length][2] = isStrictComparable(result[length][1]);
+      }
+      return result;
+    }
+
+    /**
+     * Gets the native function at `key` of `object`.
+     *
+     * @private
+     * @param {Object} object The object to query.
+     * @param {string} key The key of the method to get.
+     * @returns {*} Returns the function if it's native, else `undefined`.
+     */
+    function getNative(object, key) {
+      var value = object == null ? undefined : object[key];
+      return isNative(value) ? value : undefined;
+    }
+
+    /**
+     * Gets the view, applying any `transforms` to the `start` and `end` positions.
+     *
+     * @private
+     * @param {number} start The start of the view.
+     * @param {number} end The end of the view.
+     * @param {Array} transforms The transformations to apply to the view.
+     * @returns {Object} Returns an object containing the `start` and `end`
+     *  positions of the view.
+     */
+    function getView(start, end, transforms) {
+      var index = -1,
+          length = transforms.length;
+
+      while (++index < length) {
+        var data = transforms[index],
+            size = data.size;
+
+        switch (data.type) {
+          case 'drop':      start += size; break;
+          case 'dropRight': end -= size; break;
+          case 'take':      end = nativeMin(end, start + size); break;
+          case 'takeRight': start = nativeMax(start, end - size); break;
+        }
+      }
+      return { 'start': start, 'end': end };
+    }
+
+    /**
+     * Initializes an array clone.
+     *
+     * @private
+     * @param {Array} array The array to clone.
+     * @returns {Array} Returns the initialized clone.
+     */
+    function initCloneArray(array) {
+      var length = array.length,
+          result = new array.constructor(length);
+
+      // Add array properties assigned by `RegExp#exec`.
+      if (length && typeof array[0] == 'string' && hasOwnProperty.call(array, 'index')) {
+        result.index = array.index;
+        result.input = array.input;
+      }
+      return result;
+    }
+
+    /**
+     * Initializes an object clone.
+     *
+     * @private
+     * @param {Object} object The object to clone.
+     * @returns {Object} Returns the initialized clone.
+     */
+    function initCloneObject(object) {
+      var Ctor = object.constructor;
+      if (!(typeof Ctor == 'function' && Ctor instanceof Ctor)) {
+        Ctor = Object;
+      }
+      return new Ctor;
+    }
+
+    /**
+     * Initializes an object clone based on its `toStringTag`.
+     *
+     * **Note:** This function only supports cloning values with tags of
+     * `Boolean`, `Date`, `Error`, `Number`, `RegExp`, or `String`.
+     *
+     * @private
+     * @param {Object} object The object to clone.
+     * @param {string} tag The `toStringTag` of the object to clone.
+     * @param {boolean} [isDeep] Specify a deep clone.
+     * @returns {Object} Returns the initialized clone.
+     */
+    function initCloneByTag(object, tag, isDeep) {
+      var Ctor = object.constructor;
+      switch (tag) {
+        case arrayBufferTag:
+          return bufferClone(object);
+
+        case boolTag:
+        case dateTag:
+          return new Ctor(+object);
+
+        case float32Tag: case float64Tag:
+        case int8Tag: case int16Tag: case int32Tag:
+        case uint8Tag: case uint8ClampedTag: case uint16Tag: case uint32Tag:
+          // Safari 5 mobile incorrectly has `Object` as the constructor of typed arrays.
+          if (Ctor instanceof Ctor) {
+            Ctor = ctorByTag[tag];
+          }
+          var buffer = object.buffer;
+          return new Ctor(isDeep ? bufferClone(buffer) : buffer, object.byteOffset, object.length);
+
+        case numberTag:
+        case stringTag:
+          return new Ctor(object);
+
+        case regexpTag:
+          var result = new Ctor(object.source, reFlags.exec(object));
+          result.lastIndex = object.lastIndex;
+      }
+      return result;
+    }
+
+    /**
+     * Invokes the method at `path` on `object`.
+     *
+     * @private
+     * @param {Object} object The object to query.
+     * @param {Array|string} path The path of the method to invoke.
+     * @param {Array} args The arguments to invoke the method with.
+     * @returns {*} Returns the result of the invoked method.
+     */
+    function invokePath(object, path, args) {
+      if (object != null && !isKey(path, object)) {
+        path = toPath(path);
+        object = path.length == 1 ? object : baseGet(object, baseSlice(path, 0, -1));
+        path = last(path);
+      }
+      var func = object == null ? object : object[path];
+      return func == null ? undefined : func.apply(object, args);
+    }
+
+    /**
+     * Checks if `value` is array-like.
+     *
+     * @private
+     * @param {*} value The value to check.
+     * @returns {boolean} Returns `true` if `value` is array-like, else `false`.
+     */
+    function isArrayLike(value) {
+      return value != null && isLength(getLength(value));
+    }
+
+    /**
+     * Checks if `value` is a valid array-like index.
+     *
+     * @private
+     * @param {*} value The value to check.
+     * @param {number} [length=MAX_SAFE_INTEGER] The upper bounds of a valid index.
+     * @returns {boolean} Returns `true` if `value` is a valid index, else `false`.
+     */
+    function isIndex(value, length) {
+      value = (typeof value == 'number' || reIsUint.test(value)) ? +value : -1;
+      length = length == null ? MAX_SAFE_INTEGER : length;
+      return value > -1 && value % 1 == 0 && value < length;
+    }
+
+    /**
+     * Checks if the provided arguments are from an iteratee call.
+     *
+     * @private
+     * @param {*} value The potential iteratee value argument.
+     * @param {*} index The potential iteratee index or key argument.
+     * @param {*} object The potential iteratee object argument.
+     * @returns {boolean} Returns `true` if the arguments are from an iteratee call, else `false`.
+     */
+    function isIterateeCall(value, index, object) {
+      if (!isObject(object)) {
+        return false;
+      }
+      var type = typeof index;
+      if (type == 'number'
+          ? (isArrayLike(object) && isIndex(index, object.length))
+          : (type == 'string' && index in object)) {
+        var other = object[index];
+        return value === value ? (value === other) : (other !== other);
+      }
+      return false;
+    }
+
+    /**
+     * Checks if `value` is a property name and not a property path.
+     *
+     * @private
+     * @param {*} value The value to check.
+     * @param {Object} [object] The object to query keys on.
+     * @returns {boolean} Returns `true` if `value` is a property name, else `false`.
+     */
+    function isKey(value, object) {
+      var type = typeof value;
+      if ((type == 'string' && reIsPlainProp.test(value)) || type == 'number') {
+        return true;
+      }
+      if (isArray(value)) {
+        return false;
+      }
+      var result = !reIsDeepProp.test(value);
+      return result || (object != null && value in toObject(object));
+    }
+
+    /**
+     * Checks if `func` has a lazy counterpart.
+     *
+     * @private
+     * @param {Function} func The function to check.
+     * @returns {boolean} Returns `true` if `func` has a lazy counterpart, else `false`.
+     */
+    function isLaziable(func) {
+      var funcName = getFuncName(func),
+          other = lodash[funcName];
+
+      if (typeof other != 'function' || !(funcName in LazyWrapper.prototype)) {
+        return false;
+      }
+      if (func === other) {
+        return true;
+      }
+      var data = getData(other);
+      return !!data && func === data[0];
+    }
+
+    /**
+     * Checks if `value` is a valid array-like length.
+     *
+     * **Note:** This function is based on [`ToLength`](http://ecma-international.org/ecma-262/6.0/#sec-tolength).
+     *
+     * @private
+     * @param {*} value The value to check.
+     * @returns {boolean} Returns `true` if `value` is a valid length, else `false`.
+     */
+    function isLength(value) {
+      return typeof value == 'number' && value > -1 && value % 1 == 0 && value <= MAX_SAFE_INTEGER;
+    }
+
+    /**
+     * Checks if `value` is suitable for strict equality comparisons, i.e. `===`.
+     *
+     * @private
+     * @param {*} value The value to check.
+     * @returns {boolean} Returns `true` if `value` if suitable for strict
+     *  equality comparisons, else `false`.
+     */
+    function isStrictComparable(value) {
+      return value === value && !isObject(value);
+    }
+
+    /**
+     * Merges the function metadata of `source` into `data`.
+     *
+     * Merging metadata reduces the number of wrappers required to invoke a function.
+     * This is possible because methods like `_.bind`, `_.curry`, and `_.partial`
+     * may be applied regardless of execution order. Methods like `_.ary` and `_.rearg`
+     * augment function arguments, making the order in which they are executed important,
+     * preventing the merging of metadata. However, we make an exception for a safe
+     * common case where curried functions have `_.ary` and or `_.rearg` applied.
+     *
+     * @private
+     * @param {Array} data The destination metadata.
+     * @param {Array} source The source metadata.
+     * @returns {Array} Returns `data`.
+     */
+    function mergeData(data, source) {
+      var bitmask = data[1],
+          srcBitmask = source[1],
+          newBitmask = bitmask | srcBitmask,
+          isCommon = newBitmask < ARY_FLAG;
+
+      var isCombo =
+        (srcBitmask == ARY_FLAG && bitmask == CURRY_FLAG) ||
+        (srcBitmask == ARY_FLAG && bitmask == REARG_FLAG && data[7].length <= source[8]) ||
+        (srcBitmask == (ARY_FLAG | REARG_FLAG) && bitmask == CURRY_FLAG);
+
+      // Exit early if metadata can't be merged.
+      if (!(isCommon || isCombo)) {
+        return data;
+      }
+      // Use source `thisArg` if available.
+      if (srcBitmask & BIND_FLAG) {
+        data[2] = source[2];
+        // Set when currying a bound function.
+        newBitmask |= (bitmask & BIND_FLAG) ? 0 : CURRY_BOUND_FLAG;
+      }
+      // Compose partial arguments.
+      var value = source[3];
+      if (value) {
+        var partials = data[3];
+        data[3] = partials ? composeArgs(partials, value, source[4]) : arrayCopy(value);
+        data[4] = partials ? replaceHolders(data[3], PLACEHOLDER) : arrayCopy(source[4]);
+      }
+      // Compose partial right arguments.
+      value = source[5];
+      if (value) {
+        partials = data[5];
+        data[5] = partials ? composeArgsRight(partials, value, source[6]) : arrayCopy(value);
+        data[6] = partials ? replaceHolders(data[5], PLACEHOLDER) : arrayCopy(source[6]);
+      }
+      // Use source `argPos` if available.
+      value = source[7];
+      if (value) {
+        data[7] = arrayCopy(value);
+      }
+      // Use source `ary` if it's smaller.
+      if (srcBitmask & ARY_FLAG) {
+        data[8] = data[8] == null ? source[8] : nativeMin(data[8], source[8]);
+      }
+      // Use source `arity` if one is not provided.
+      if (data[9] == null) {
+        data[9] = source[9];
+      }
+      // Use source `func` and merge bitmasks.
+      data[0] = source[0];
+      data[1] = newBitmask;
+
+      return data;
+    }
+
+    /**
+     * Used by `_.defaultsDeep` to customize its `_.merge` use.
+     *
+     * @private
+     * @param {*} objectValue The destination object property value.
+     * @param {*} sourceValue The source object property value.
+     * @returns {*} Returns the value to assign to the destination object.
+     */
+    function mergeDefaults(objectValue, sourceValue) {
+      return objectValue === undefined ? sourceValue : merge(objectValue, sourceValue, mergeDefaults);
+    }
+
+    /**
+     * A specialized version of `_.pick` which picks `object` properties specified
+     * by `props`.
+     *
+     * @private
+     * @param {Object} object The source object.
+     * @param {string[]} props The property names to pick.
+     * @returns {Object} Returns the new object.
+     */
+    function pickByArray(object, props) {
+      object = toObject(object);
+
+      var index = -1,
+          length = props.length,
+          result = {};
+
+      while (++index < length) {
+        var key = props[index];
+        if (key in object) {
+          result[key] = object[key];
+        }
+      }
+      return result;
+    }
+
+    /**
+     * A specialized version of `_.pick` which picks `object` properties `predicate`
+     * returns truthy for.
+     *
+     * @private
+     * @param {Object} object The source object.
+     * @param {Function} predicate The function invoked per iteration.
+     * @returns {Object} Returns the new object.
+     */
+    function pickByCallback(object, predicate) {
+      var result = {};
+      baseForIn(object, function(value, key, object) {
+        if (predicate(value, key, object)) {
+          result[key] = value;
+        }
+      });
+      return result;
+    }
+
+    /**
+     * Reorder `array` according to the specified indexes where the element at
+     * the first index is assigned as the first element, the element at
+     * the second index is assigned as the second element, and so on.
+     *
+     * @private
+     * @param {Array} array The array to reorder.
+     * @param {Array} indexes The arranged array indexes.
+     * @returns {Array} Returns `array`.
+     */
+    function reorder(array, indexes) {
+      var arrLength = array.length,
+          length = nativeMin(indexes.length, arrLength),
+          oldArray = arrayCopy(array);
+
+      while (length--) {
+        var index = indexes[length];
+        array[length] = isIndex(index, arrLength) ? oldArray[index] : undefined;
+      }
+      return array;
+    }
+
+    /**
+     * Sets metadata for `func`.
+     *
+     * **Note:** If this function becomes hot, i.e. is invoked a lot in a short
+     * period of time, it will trip its breaker and transition to an identity function
+     * to avoid garbage collection pauses in V8. See [V8 issue 2070](https://code.google.com/p/v8/issues/detail?id=2070)
+     * for more details.
+     *
+     * @private
+     * @param {Function} func The function to associate metadata with.
+     * @param {*} data The metadata.
+     * @returns {Function} Returns `func`.
+     */
+    var setData = (function() {
+      var count = 0,
+          lastCalled = 0;
+
+      return function(key, value) {
+        var stamp = now(),
+            remaining = HOT_SPAN - (stamp - lastCalled);
+
+        lastCalled = stamp;
+        if (remaining > 0) {
+          if (++count >= HOT_COUNT) {
+            return key;
+          }
+        } else {
+          count = 0;
+        }
+        return baseSetData(key, value);
+      };
+    }());
+
+    /**
+     * A fallback implementation of `Object.keys` which creates an array of the
+     * own enumerable property names of `object`.
+     *
+     * @private
+     * @param {Object} object The object to query.
+     * @returns {Array} Returns the array of property names.
+     */
+    function shimKeys(object) {
+      var props = keysIn(object),
+          propsLength = props.length,
+          length = propsLength && object.length;
+
+      var allowIndexes = !!length && isLength(length) &&
+        (isArray(object) || isArguments(object) || isString(object));
+
+      var index = -1,
+          result = [];
+
+      while (++index < propsLength) {
+        var key = props[index];
+        if ((allowIndexes && isIndex(key, length)) || hasOwnProperty.call(object, key)) {
+          result.push(key);
+        }
+      }
+      return result;
+    }
+
+    /**
+     * Converts `value` to an array-like object if it's not one.
+     *
+     * @private
+     * @param {*} value The value to process.
+     * @returns {Array|Object} Returns the array-like object.
+     */
+    function toIterable(value) {
+      if (value == null) {
+        return [];
+      }
+      if (!isArrayLike(value)) {
+        return values(value);
+      }
+      if (lodash.support.unindexedChars && isString(value)) {
+        return value.split('');
+      }
+      return isObject(value) ? value : Object(value);
+    }
+
+    /**
+     * Converts `value` to an object if it's not one.
+     *
+     * @private
+     * @param {*} value The value to process.
+     * @returns {Object} Returns the object.
+     */
+    function toObject(value) {
+      if (lodash.support.unindexedChars && isString(value)) {
+        var index = -1,
+            length = value.length,
+            result = Object(value);
+
+        while (++index < length) {
+          result[index] = value.charAt(index);
+        }
+        return result;
+      }
+      return isObject(value) ? value : Object(value);
+    }
+
+    /**
+     * Converts `value` to property path array if it's not one.
+     *
+     * @private
+     * @param {*} value The value to process.
+     * @returns {Array} Returns the property path array.
+     */
+    function toPath(value) {
+      if (isArray(value)) {
+        return value;
+      }
+      var result = [];
+      baseToString(value).replace(rePropName, function(match, number, quote, string) {
+        result.push(quote ? string.replace(reEscapeChar, '$1') : (number || match));
+      });
+      return result;
+    }
+
+    /**
+     * Creates a clone of `wrapper`.
+     *
+     * @private
+     * @param {Object} wrapper The wrapper to clone.
+     * @returns {Object} Returns the cloned wrapper.
+     */
+    function wrapperClone(wrapper) {
+      return wrapper instanceof LazyWrapper
+        ? wrapper.clone()
+        : new LodashWrapper(wrapper.__wrapped__, wrapper.__chain__, arrayCopy(wrapper.__actions__));
+    }
+
+    /*------------------------------------------------------------------------*/
+
+    /**
+     * Creates an array of elements split into groups the length of `size`.
+     * If `collection` can't be split evenly, the final chunk will be the remaining
+     * elements.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {Array} array The array to process.
+     * @param {number} [size=1] The length of each chunk.
+     * @param- {Object} [guard] Enables use as a callback for functions like `_.map`.
+     * @returns {Array} Returns the new array containing chunks.
+     * @example
+     *
+     * _.chunk(['a', 'b', 'c', 'd'], 2);
+     * // => [['a', 'b'], ['c', 'd']]
+     *
+     * _.chunk(['a', 'b', 'c', 'd'], 3);
+     * // => [['a', 'b', 'c'], ['d']]
+     */
+    function chunk(array, size, guard) {
+      if (guard ? isIterateeCall(array, size, guard) : size == null) {
+        size = 1;
+      } else {
+        size = nativeMax(nativeFloor(size) || 1, 1);
+      }
+      var index = 0,
+          length = array ? array.length : 0,
+          resIndex = -1,
+          result = Array(nativeCeil(length / size));
+
+      while (index < length) {
+        result[++resIndex] = baseSlice(array, index, (index += size));
+      }
+      return result;
+    }
+
+    /**
+     * Creates an array with all falsey values removed. The values `false`, `null`,
+     * `0`, `""`, `undefined`, and `NaN` are falsey.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {Array} array The array to compact.
+     * @returns {Array} Returns the new array of filtered values.
+     * @example
+     *
+     * _.compact([0, 1, false, 2, '', 3]);
+     * // => [1, 2, 3]
+     */
+    function compact(array) {
+      var index = -1,
+          length = array ? array.length : 0,
+          resIndex = -1,
+          result = [];
+
+      while (++index < length) {
+        var value = array[index];
+        if (value) {
+          result[++resIndex] = value;
+        }
+      }
+      return result;
+    }
+
+    /**
+     * Creates an array of unique `array` values not included in the other
+     * provided arrays using [`SameValueZero`](http://ecma-international.org/ecma-262/6.0/#sec-samevaluezero)
+     * for equality comparisons.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {Array} array The array to inspect.
+     * @param {...Array} [values] The arrays of values to exclude.
+     * @returns {Array} Returns the new array of filtered values.
+     * @example
+     *
+     * _.difference([1, 2, 3], [4, 2]);
+     * // => [1, 3]
+     */
+    var difference = restParam(function(array, values) {
+      return (isObjectLike(array) && isArrayLike(array))
+        ? baseDifference(array, baseFlatten(values, false, true))
+        : [];
+    });
+
+    /**
+     * Creates a slice of `array` with `n` elements dropped from the beginning.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {Array} array The array to query.
+     * @param {number} [n=1] The number of elements to drop.
+     * @param- {Object} [guard] Enables use as a callback for functions like `_.map`.
+     * @returns {Array} Returns the slice of `array`.
+     * @example
+     *
+     * _.drop([1, 2, 3]);
+     * // => [2, 3]
+     *
+     * _.drop([1, 2, 3], 2);
+     * // => [3]
+     *
+     * _.drop([1, 2, 3], 5);
+     * // => []
+     *
+     * _.drop([1, 2, 3], 0);
+     * // => [1, 2, 3]
+     */
+    function drop(array, n, guard) {
+      var length = array ? array.length : 0;
+      if (!length) {
+        return [];
+      }
+      if (guard ? isIterateeCall(array, n, guard) : n == null) {
+        n = 1;
+      }
+      return baseSlice(array, n < 0 ? 0 : n);
+    }
+
+    /**
+     * Creates a slice of `array` with `n` elements dropped from the end.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {Array} array The array to query.
+     * @param {number} [n=1] The number of elements to drop.
+     * @param- {Object} [guard] Enables use as a callback for functions like `_.map`.
+     * @returns {Array} Returns the slice of `array`.
+     * @example
+     *
+     * _.dropRight([1, 2, 3]);
+     * // => [1, 2]
+     *
+     * _.dropRight([1, 2, 3], 2);
+     * // => [1]
+     *
+     * _.dropRight([1, 2, 3], 5);
+     * // => []
+     *
+     * _.dropRight([1, 2, 3], 0);
+     * // => [1, 2, 3]
+     */
+    function dropRight(array, n, guard) {
+      var length = array ? array.length : 0;
+      if (!length) {
+        return [];
+      }
+      if (guard ? isIterateeCall(array, n, guard) : n == null) {
+        n = 1;
+      }
+      n = length - (+n || 0);
+      return baseSlice(array, 0, n < 0 ? 0 : n);
+    }
+
+    /**
+     * Creates a slice of `array` excluding elements dropped from the end.
+     * Elements are dropped until `predicate` returns falsey. The predicate is
+     * bound to `thisArg` and invoked with three arguments: (value, index, array).
+     *
+     * If a property name is provided for `predicate` the created `_.property`
+     * style callback returns the property value of the given element.
+     *
+     * If a value is also provided for `thisArg` the created `_.matchesProperty`
+     * style callback returns `true` for elements that have a matching property
+     * value, else `false`.
+     *
+     * If an object is provided for `predicate` the created `_.matches` style
+     * callback returns `true` for elements that match the properties of the given
+     * object, else `false`.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {Array} array The array to query.
+     * @param {Function|Object|string} [predicate=_.identity] The function invoked
+     *  per iteration.
+     * @param {*} [thisArg] The `this` binding of `predicate`.
+     * @returns {Array} Returns the slice of `array`.
+     * @example
+     *
+     * _.dropRightWhile([1, 2, 3], function(n) {
+     *   return n > 1;
+     * });
+     * // => [1]
+     *
+     * var users = [
+     *   { 'user': 'barney',  'active': true },
+     *   { 'user': 'fred',    'active': false },
+     *   { 'user': 'pebbles', 'active': false }
+     * ];
+     *
+     * // using the `_.matches` callback shorthand
+     * _.pluck(_.dropRightWhile(users, { 'user': 'pebbles', 'active': false }), 'user');
+     * // => ['barney', 'fred']
+     *
+     * // using the `_.matchesProperty` callback shorthand
+     * _.pluck(_.dropRightWhile(users, 'active', false), 'user');
+     * // => ['barney']
+     *
+     * // using the `_.property` callback shorthand
+     * _.pluck(_.dropRightWhile(users, 'active'), 'user');
+     * // => ['barney', 'fred', 'pebbles']
+     */
+    function dropRightWhile(array, predicate, thisArg) {
+      return (array && array.length)
+        ? baseWhile(array, getCallback(predicate, thisArg, 3), true, true)
+        : [];
+    }
+
+    /**
+     * Creates a slice of `array` excluding elements dropped from the beginning.
+     * Elements are dropped until `predicate` returns falsey. The predicate is
+     * bound to `thisArg` and invoked with three arguments: (value, index, array).
+     *
+     * If a property name is provided for `predicate` the created `_.property`
+     * style callback returns the property value of the given element.
+     *
+     * If a value is also provided for `thisArg` the created `_.matchesProperty`
+     * style callback returns `true` for elements that have a matching property
+     * value, else `false`.
+     *
+     * If an object is provided for `predicate` the created `_.matches` style
+     * callback returns `true` for elements that have the properties of the given
+     * object, else `false`.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {Array} array The array to query.
+     * @param {Function|Object|string} [predicate=_.identity] The function invoked
+     *  per iteration.
+     * @param {*} [thisArg] The `this` binding of `predicate`.
+     * @returns {Array} Returns the slice of `array`.
+     * @example
+     *
+     * _.dropWhile([1, 2, 3], function(n) {
+     *   return n < 3;
+     * });
+     * // => [3]
+     *
+     * var users = [
+     *   { 'user': 'barney',  'active': false },
+     *   { 'user': 'fred',    'active': false },
+     *   { 'user': 'pebbles', 'active': true }
+     * ];
+     *
+     * // using the `_.matches` callback shorthand
+     * _.pluck(_.dropWhile(users, { 'user': 'barney', 'active': false }), 'user');
+     * // => ['fred', 'pebbles']
+     *
+     * // using the `_.matchesProperty` callback shorthand
+     * _.pluck(_.dropWhile(users, 'active', false), 'user');
+     * // => ['pebbles']
+     *
+     * // using the `_.property` callback shorthand
+     * _.pluck(_.dropWhile(users, 'active'), 'user');
+     * // => ['barney', 'fred', 'pebbles']
+     */
+    function dropWhile(array, predicate, thisArg) {
+      return (array && array.length)
+        ? baseWhile(array, getCallback(predicate, thisArg, 3), true)
+        : [];
+    }
+
+    /**
+     * Fills elements of `array` with `value` from `start` up to, but not
+     * including, `end`.
+     *
+     * **Note:** This method mutates `array`.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {Array} array The array to fill.
+     * @param {*} value The value to fill `array` with.
+     * @param {number} [start=0] The start position.
+     * @param {number} [end=array.length] The end position.
+     * @returns {Array} Returns `array`.
+     * @example
+     *
+     * var array = [1, 2, 3];
+     *
+     * _.fill(array, 'a');
+     * console.log(array);
+     * // => ['a', 'a', 'a']
+     *
+     * _.fill(Array(3), 2);
+     * // => [2, 2, 2]
+     *
+     * _.fill([4, 6, 8], '*', 1, 2);
+     * // => [4, '*', 8]
+     */
+    function fill(array, value, start, end) {
+      var length = array ? array.length : 0;
+      if (!length) {
+        return [];
+      }
+      if (start && typeof start != 'number' && isIterateeCall(array, value, start)) {
+        start = 0;
+        end = length;
+      }
+      return baseFill(array, value, start, end);
+    }
+
+    /**
+     * This method is like `_.find` except that it returns the index of the first
+     * element `predicate` returns truthy for instead of the element itself.
+     *
+     * If a property name is provided for `predicate` the created `_.property`
+     * style callback returns the property value of the given element.
+     *
+     * If a value is also provided for `thisArg` the created `_.matchesProperty`
+     * style callback returns `true` for elements that have a matching property
+     * value, else `false`.
+     *
+     * If an object is provided for `predicate` the created `_.matches` style
+     * callback returns `true` for elements that have the properties of the given
+     * object, else `false`.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {Array} array The array to search.
+     * @param {Function|Object|string} [predicate=_.identity] The function invoked
+     *  per iteration.
+     * @param {*} [thisArg] The `this` binding of `predicate`.
+     * @returns {number} Returns the index of the found element, else `-1`.
+     * @example
+     *
+     * var users = [
+     *   { 'user': 'barney',  'active': false },
+     *   { 'user': 'fred',    'active': false },
+     *   { 'user': 'pebbles', 'active': true }
+     * ];
+     *
+     * _.findIndex(users, function(chr) {
+     *   return chr.user == 'barney';
+     * });
+     * // => 0
+     *
+     * // using the `_.matches` callback shorthand
+     * _.findIndex(users, { 'user': 'fred', 'active': false });
+     * // => 1
+     *
+     * // using the `_.matchesProperty` callback shorthand
+     * _.findIndex(users, 'active', false);
+     * // => 0
+     *
+     * // using the `_.property` callback shorthand
+     * _.findIndex(users, 'active');
+     * // => 2
+     */
+    var findIndex = createFindIndex();
+
+    /**
+     * This method is like `_.findIndex` except that it iterates over elements
+     * of `collection` from right to left.
+     *
+     * If a property name is provided for `predicate` the created `_.property`
+     * style callback returns the property value of the given element.
+     *
+     * If a value is also provided for `thisArg` the created `_.matchesProperty`
+     * style callback returns `true` for elements that have a matching property
+     * value, else `false`.
+     *
+     * If an object is provided for `predicate` the created `_.matches` style
+     * callback returns `true` for elements that have the properties of the given
+     * object, else `false`.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {Array} array The array to search.
+     * @param {Function|Object|string} [predicate=_.identity] The function invoked
+     *  per iteration.
+     * @param {*} [thisArg] The `this` binding of `predicate`.
+     * @returns {number} Returns the index of the found element, else `-1`.
+     * @example
+     *
+     * var users = [
+     *   { 'user': 'barney',  'active': true },
+     *   { 'user': 'fred',    'active': false },
+     *   { 'user': 'pebbles', 'active': false }
+     * ];
+     *
+     * _.findLastIndex(users, function(chr) {
+     *   return chr.user == 'pebbles';
+     * });
+     * // => 2
+     *
+     * // using the `_.matches` callback shorthand
+     * _.findLastIndex(users, { 'user': 'barney', 'active': true });
+     * // => 0
+     *
+     * // using the `_.matchesProperty` callback shorthand
+     * _.findLastIndex(users, 'active', false);
+     * // => 2
+     *
+     * // using the `_.property` callback shorthand
+     * _.findLastIndex(users, 'active');
+     * // => 0
+     */
+    var findLastIndex = createFindIndex(true);
+
+    /**
+     * Gets the first element of `array`.
+     *
+     * @static
+     * @memberOf _
+     * @alias head
+     * @category Array
+     * @param {Array} array The array to query.
+     * @returns {*} Returns the first element of `array`.
+     * @example
+     *
+     * _.first([1, 2, 3]);
+     * // => 1
+     *
+     * _.first([]);
+     * // => undefined
+     */
+    function first(array) {
+      return array ? array[0] : undefined;
+    }
+
+    /**
+     * Flattens a nested array. If `isDeep` is `true` the array is recursively
+     * flattened, otherwise it's only flattened a single level.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {Array} array The array to flatten.
+     * @param {boolean} [isDeep] Specify a deep flatten.
+     * @param- {Object} [guard] Enables use as a callback for functions like `_.map`.
+     * @returns {Array} Returns the new flattened array.
+     * @example
+     *
+     * _.flatten([1, [2, 3, [4]]]);
+     * // => [1, 2, 3, [4]]
+     *
+     * // using `isDeep`
+     * _.flatten([1, [2, 3, [4]]], true);
+     * // => [1, 2, 3, 4]
+     */
+    function flatten(array, isDeep, guard) {
+      var length = array ? array.length : 0;
+      if (guard && isIterateeCall(array, isDeep, guard)) {
+        isDeep = false;
+      }
+      return length ? baseFlatten(array, isDeep) : [];
+    }
+
+    /**
+     * Recursively flattens a nested array.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {Array} array The array to recursively flatten.
+     * @returns {Array} Returns the new flattened array.
+     * @example
+     *
+     * _.flattenDeep([1, [2, 3, [4]]]);
+     * // => [1, 2, 3, 4]
+     */
+    function flattenDeep(array) {
+      var length = array ? array.length : 0;
+      return length ? baseFlatten(array, true) : [];
+    }
+
+    /**
+     * Gets the index at which the first occurrence of `value` is found in `array`
+     * using [`SameValueZero`](http://ecma-international.org/ecma-262/6.0/#sec-samevaluezero)
+     * for equality comparisons. If `fromIndex` is negative, it's used as the offset
+     * from the end of `array`. If `array` is sorted providing `true` for `fromIndex`
+     * performs a faster binary search.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {Array} array The array to search.
+     * @param {*} value The value to search for.
+     * @param {boolean|number} [fromIndex=0] The index to search from or `true`
+     *  to perform a binary search on a sorted array.
+     * @returns {number} Returns the index of the matched value, else `-1`.
+     * @example
+     *
+     * _.indexOf([1, 2, 1, 2], 2);
+     * // => 1
+     *
+     * // using `fromIndex`
+     * _.indexOf([1, 2, 1, 2], 2, 2);
+     * // => 3
+     *
+     * // performing a binary search
+     * _.indexOf([1, 1, 2, 2], 2, true);
+     * // => 2
+     */
+    function indexOf(array, value, fromIndex) {
+      var length = array ? array.length : 0;
+      if (!length) {
+        return -1;
+      }
+      if (typeof fromIndex == 'number') {
+        fromIndex = fromIndex < 0 ? nativeMax(length + fromIndex, 0) : fromIndex;
+      } else if (fromIndex) {
+        var index = binaryIndex(array, value);
+        if (index < length &&
+            (value === value ? (value === array[index]) : (array[index] !== array[index]))) {
+          return index;
+        }
+        return -1;
+      }
+      return baseIndexOf(array, value, fromIndex || 0);
+    }
+
+    /**
+     * Gets all but the last element of `array`.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {Array} array The array to query.
+     * @returns {Array} Returns the slice of `array`.
+     * @example
+     *
+     * _.initial([1, 2, 3]);
+     * // => [1, 2]
+     */
+    function initial(array) {
+      return dropRight(array, 1);
+    }
+
+    /**
+     * Creates an array of unique values that are included in all of the provided
+     * arrays using [`SameValueZero`](http://ecma-international.org/ecma-262/6.0/#sec-samevaluezero)
+     * for equality comparisons.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {...Array} [arrays] The arrays to inspect.
+     * @returns {Array} Returns the new array of shared values.
+     * @example
+     * _.intersection([1, 2], [4, 2], [2, 1]);
+     * // => [2]
+     */
+    var intersection = restParam(function(arrays) {
+      var othLength = arrays.length,
+          othIndex = othLength,
+          caches = Array(length),
+          indexOf = getIndexOf(),
+          isCommon = indexOf === baseIndexOf,
+          result = [];
+
+      while (othIndex--) {
+        var value = arrays[othIndex] = isArrayLike(value = arrays[othIndex]) ? value : [];
+        caches[othIndex] = (isCommon && value.length >= 120) ? createCache(othIndex && value) : null;
+      }
+      var array = arrays[0],
+          index = -1,
+          length = array ? array.length : 0,
+          seen = caches[0];
+
+      outer:
+      while (++index < length) {
+        value = array[index];
+        if ((seen ? cacheIndexOf(seen, value) : indexOf(result, value, 0)) < 0) {
+          var othIndex = othLength;
+          while (--othIndex) {
+            var cache = caches[othIndex];
+            if ((cache ? cacheIndexOf(cache, value) : indexOf(arrays[othIndex], value, 0)) < 0) {
+              continue outer;
+            }
+          }
+          if (seen) {
+            seen.push(value);
+          }
+          result.push(value);
+        }
+      }
+      return result;
+    });
+
+    /**
+     * Gets the last element of `array`.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {Array} array The array to query.
+     * @returns {*} Returns the last element of `array`.
+     * @example
+     *
+     * _.last([1, 2, 3]);
+     * // => 3
+     */
+    function last(array) {
+      var length = array ? array.length : 0;
+      return length ? array[length - 1] : undefined;
+    }
+
+    /**
+     * This method is like `_.indexOf` except that it iterates over elements of
+     * `array` from right to left.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {Array} array The array to search.
+     * @param {*} value The value to search for.
+     * @param {boolean|number} [fromIndex=array.length-1] The index to search from
+     *  or `true` to perform a binary search on a sorted array.
+     * @returns {number} Returns the index of the matched value, else `-1`.
+     * @example
+     *
+     * _.lastIndexOf([1, 2, 1, 2], 2);
+     * // => 3
+     *
+     * // using `fromIndex`
+     * _.lastIndexOf([1, 2, 1, 2], 2, 2);
+     * // => 1
+     *
+     * // performing a binary search
+     * _.lastIndexOf([1, 1, 2, 2], 2, true);
+     * // => 3
+     */
+    function lastIndexOf(array, value, fromIndex) {
+      var length = array ? array.length : 0;
+      if (!length) {
+        return -1;
+      }
+      var index = length;
+      if (typeof fromIndex == 'number') {
+        index = (fromIndex < 0 ? nativeMax(length + fromIndex, 0) : nativeMin(fromIndex || 0, length - 1)) + 1;
+      } else if (fromIndex) {
+        index = binaryIndex(array, value, true) - 1;
+        var other = array[index];
+        if (value === value ? (value === other) : (other !== other)) {
+          return index;
+        }
+        return -1;
+      }
+      if (value !== value) {
+        return indexOfNaN(array, index, true);
+      }
+      while (index--) {
+        if (array[index] === value) {
+          return index;
+        }
+      }
+      return -1;
+    }
+
+    /**
+     * Removes all provided values from `array` using
+     * [`SameValueZero`](http://ecma-international.org/ecma-262/6.0/#sec-samevaluezero)
+     * for equality comparisons.
+     *
+     * **Note:** Unlike `_.without`, this method mutates `array`.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {Array} array The array to modify.
+     * @param {...*} [values] The values to remove.
+     * @returns {Array} Returns `array`.
+     * @example
+     *
+     * var array = [1, 2, 3, 1, 2, 3];
+     *
+     * _.pull(array, 2, 3);
+     * console.log(array);
+     * // => [1, 1]
+     */
+    function pull() {
+      var args = arguments,
+          array = args[0];
+
+      if (!(array && array.length)) {
+        return array;
+      }
+      var index = 0,
+          indexOf = getIndexOf(),
+          length = args.length;
+
+      while (++index < length) {
+        var fromIndex = 0,
+            value = args[index];
+
+        while ((fromIndex = indexOf(array, value, fromIndex)) > -1) {
+          splice.call(array, fromIndex, 1);
+        }
+      }
+      return array;
+    }
+
+    /**
+     * Removes elements from `array` corresponding to the given indexes and returns
+     * an array of the removed elements. Indexes may be specified as an array of
+     * indexes or as individual arguments.
+     *
+     * **Note:** Unlike `_.at`, this method mutates `array`.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {Array} array The array to modify.
+     * @param {...(number|number[])} [indexes] The indexes of elements to remove,
+     *  specified as individual indexes or arrays of indexes.
+     * @returns {Array} Returns the new array of removed elements.
+     * @example
+     *
+     * var array = [5, 10, 15, 20];
+     * var evens = _.pullAt(array, 1, 3);
+     *
+     * console.log(array);
+     * // => [5, 15]
+     *
+     * console.log(evens);
+     * // => [10, 20]
+     */
+    var pullAt = restParam(function(array, indexes) {
+      indexes = baseFlatten(indexes);
+
+      var result = baseAt(array, indexes);
+      basePullAt(array, indexes.sort(baseCompareAscending));
+      return result;
+    });
+
+    /**
+     * Removes all elements from `array` that `predicate` returns truthy for
+     * and returns an array of the removed elements. The predicate is bound to
+     * `thisArg` and invoked with three arguments: (value, index, array).
+     *
+     * If a property name is provided for `predicate` the created `_.property`
+     * style callback returns the property value of the given element.
+     *
+     * If a value is also provided for `thisArg` the created `_.matchesProperty`
+     * style callback returns `true` for elements that have a matching property
+     * value, else `false`.
+     *
+     * If an object is provided for `predicate` the created `_.matches` style
+     * callback returns `true` for elements that have the properties of the given
+     * object, else `false`.
+     *
+     * **Note:** Unlike `_.filter`, this method mutates `array`.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {Array} array The array to modify.
+     * @param {Function|Object|string} [predicate=_.identity] The function invoked
+     *  per iteration.
+     * @param {*} [thisArg] The `this` binding of `predicate`.
+     * @returns {Array} Returns the new array of removed elements.
+     * @example
+     *
+     * var array = [1, 2, 3, 4];
+     * var evens = _.remove(array, function(n) {
+     *   return n % 2 == 0;
+     * });
+     *
+     * console.log(array);
+     * // => [1, 3]
+     *
+     * console.log(evens);
+     * // => [2, 4]
+     */
+    function remove(array, predicate, thisArg) {
+      var result = [];
+      if (!(array && array.length)) {
+        return result;
+      }
+      var index = -1,
+          indexes = [],
+          length = array.length;
+
+      predicate = getCallback(predicate, thisArg, 3);
+      while (++index < length) {
+        var value = array[index];
+        if (predicate(value, index, array)) {
+          result.push(value);
+          indexes.push(index);
+        }
+      }
+      basePullAt(array, indexes);
+      return result;
+    }
+
+    /**
+     * Gets all but the first element of `array`.
+     *
+     * @static
+     * @memberOf _
+     * @alias tail
+     * @category Array
+     * @param {Array} array The array to query.
+     * @returns {Array} Returns the slice of `array`.
+     * @example
+     *
+     * _.rest([1, 2, 3]);
+     * // => [2, 3]
+     */
+    function rest(array) {
+      return drop(array, 1);
+    }
+
+    /**
+     * Creates a slice of `array` from `start` up to, but not including, `end`.
+     *
+     * **Note:** This method is used instead of `Array#slice` to support node
+     * lists in IE < 9 and to ensure dense arrays are returned.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {Array} array The array to slice.
+     * @param {number} [start=0] The start position.
+     * @param {number} [end=array.length] The end position.
+     * @returns {Array} Returns the slice of `array`.
+     */
+    function slice(array, start, end) {
+      var length = array ? array.length : 0;
+      if (!length) {
+        return [];
+      }
+      if (end && typeof end != 'number' && isIterateeCall(array, start, end)) {
+        start = 0;
+        end = length;
+      }
+      return baseSlice(array, start, end);
+    }
+
+    /**
+     * Uses a binary search to determine the lowest index at which `value` should
+     * be inserted into `array` in order to maintain its sort order. If an iteratee
+     * function is provided it's invoked for `value` and each element of `array`
+     * to compute their sort ranking. The iteratee is bound to `thisArg` and
+     * invoked with one argument; (value).
+     *
+     * If a property name is provided for `iteratee` the created `_.property`
+     * style callback returns the property value of the given element.
+     *
+     * If a value is also provided for `thisArg` the created `_.matchesProperty`
+     * style callback returns `true` for elements that have a matching property
+     * value, else `false`.
+     *
+     * If an object is provided for `iteratee` the created `_.matches` style
+     * callback returns `true` for elements that have the properties of the given
+     * object, else `false`.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {Array} array The sorted array to inspect.
+     * @param {*} value The value to evaluate.
+     * @param {Function|Object|string} [iteratee=_.identity] The function invoked
+     *  per iteration.
+     * @param {*} [thisArg] The `this` binding of `iteratee`.
+     * @returns {number} Returns the index at which `value` should be inserted
+     *  into `array`.
+     * @example
+     *
+     * _.sortedIndex([30, 50], 40);
+     * // => 1
+     *
+     * _.sortedIndex([4, 4, 5, 5], 5);
+     * // => 2
+     *
+     * var dict = { 'data': { 'thirty': 30, 'forty': 40, 'fifty': 50 } };
+     *
+     * // using an iteratee function
+     * _.sortedIndex(['thirty', 'fifty'], 'forty', function(word) {
+     *   return this.data[word];
+     * }, dict);
+     * // => 1
+     *
+     * // using the `_.property` callback shorthand
+     * _.sortedIndex([{ 'x': 30 }, { 'x': 50 }], { 'x': 40 }, 'x');
+     * // => 1
+     */
+    var sortedIndex = createSortedIndex();
+
+    /**
+     * This method is like `_.sortedIndex` except that it returns the highest
+     * index at which `value` should be inserted into `array` in order to
+     * maintain its sort order.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {Array} array The sorted array to inspect.
+     * @param {*} value The value to evaluate.
+     * @param {Function|Object|string} [iteratee=_.identity] The function invoked
+     *  per iteration.
+     * @param {*} [thisArg] The `this` binding of `iteratee`.
+     * @returns {number} Returns the index at which `value` should be inserted
+     *  into `array`.
+     * @example
+     *
+     * _.sortedLastIndex([4, 4, 5, 5], 5);
+     * // => 4
+     */
+    var sortedLastIndex = createSortedIndex(true);
+
+    /**
+     * Creates a slice of `array` with `n` elements taken from the beginning.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {Array} array The array to query.
+     * @param {number} [n=1] The number of elements to take.
+     * @param- {Object} [guard] Enables use as a callback for functions like `_.map`.
+     * @returns {Array} Returns the slice of `array`.
+     * @example
+     *
+     * _.take([1, 2, 3]);
+     * // => [1]
+     *
+     * _.take([1, 2, 3], 2);
+     * // => [1, 2]
+     *
+     * _.take([1, 2, 3], 5);
+     * // => [1, 2, 3]
+     *
+     * _.take([1, 2, 3], 0);
+     * // => []
+     */
+    function take(array, n, guard) {
+      var length = array ? array.length : 0;
+      if (!length) {
+        return [];
+      }
+      if (guard ? isIterateeCall(array, n, guard) : n == null) {
+        n = 1;
+      }
+      return baseSlice(array, 0, n < 0 ? 0 : n);
+    }
+
+    /**
+     * Creates a slice of `array` with `n` elements taken from the end.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {Array} array The array to query.
+     * @param {number} [n=1] The number of elements to take.
+     * @param- {Object} [guard] Enables use as a callback for functions like `_.map`.
+     * @returns {Array} Returns the slice of `array`.
+     * @example
+     *
+     * _.takeRight([1, 2, 3]);
+     * // => [3]
+     *
+     * _.takeRight([1, 2, 3], 2);
+     * // => [2, 3]
+     *
+     * _.takeRight([1, 2, 3], 5);
+     * // => [1, 2, 3]
+     *
+     * _.takeRight([1, 2, 3], 0);
+     * // => []
+     */
+    function takeRight(array, n, guard) {
+      var length = array ? array.length : 0;
+      if (!length) {
+        return [];
+      }
+      if (guard ? isIterateeCall(array, n, guard) : n == null) {
+        n = 1;
+      }
+      n = length - (+n || 0);
+      return baseSlice(array, n < 0 ? 0 : n);
+    }
+
+    /**
+     * Creates a slice of `array` with elements taken from the end. Elements are
+     * taken until `predicate` returns falsey. The predicate is bound to `thisArg`
+     * and invoked with three arguments: (value, index, array).
+     *
+     * If a property name is provided for `predicate` the created `_.property`
+     * style callback returns the property value of the given element.
+     *
+     * If a value is also provided for `thisArg` the created `_.matchesProperty`
+     * style callback returns `true` for elements that have a matching property
+     * value, else `false`.
+     *
+     * If an object is provided for `predicate` the created `_.matches` style
+     * callback returns `true` for elements that have the properties of the given
+     * object, else `false`.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {Array} array The array to query.
+     * @param {Function|Object|string} [predicate=_.identity] The function invoked
+     *  per iteration.
+     * @param {*} [thisArg] The `this` binding of `predicate`.
+     * @returns {Array} Returns the slice of `array`.
+     * @example
+     *
+     * _.takeRightWhile([1, 2, 3], function(n) {
+     *   return n > 1;
+     * });
+     * // => [2, 3]
+     *
+     * var users = [
+     *   { 'user': 'barney',  'active': true },
+     *   { 'user': 'fred',    'active': false },
+     *   { 'user': 'pebbles', 'active': false }
+     * ];
+     *
+     * // using the `_.matches` callback shorthand
+     * _.pluck(_.takeRightWhile(users, { 'user': 'pebbles', 'active': false }), 'user');
+     * // => ['pebbles']
+     *
+     * // using the `_.matchesProperty` callback shorthand
+     * _.pluck(_.takeRightWhile(users, 'active', false), 'user');
+     * // => ['fred', 'pebbles']
+     *
+     * // using the `_.property` callback shorthand
+     * _.pluck(_.takeRightWhile(users, 'active'), 'user');
+     * // => []
+     */
+    function takeRightWhile(array, predicate, thisArg) {
+      return (array && array.length)
+        ? baseWhile(array, getCallback(predicate, thisArg, 3), false, true)
+        : [];
+    }
+
+    /**
+     * Creates a slice of `array` with elements taken from the beginning. Elements
+     * are taken until `predicate` returns falsey. The predicate is bound to
+     * `thisArg` and invoked with three arguments: (value, index, array).
+     *
+     * If a property name is provided for `predicate` the created `_.property`
+     * style callback returns the property value of the given element.
+     *
+     * If a value is also provided for `thisArg` the created `_.matchesProperty`
+     * style callback returns `true` for elements that have a matching property
+     * value, else `false`.
+     *
+     * If an object is provided for `predicate` the created `_.matches` style
+     * callback returns `true` for elements that have the properties of the given
+     * object, else `false`.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {Array} array The array to query.
+     * @param {Function|Object|string} [predicate=_.identity] The function invoked
+     *  per iteration.
+     * @param {*} [thisArg] The `this` binding of `predicate`.
+     * @returns {Array} Returns the slice of `array`.
+     * @example
+     *
+     * _.takeWhile([1, 2, 3], function(n) {
+     *   return n < 3;
+     * });
+     * // => [1, 2]
+     *
+     * var users = [
+     *   { 'user': 'barney',  'active': false },
+     *   { 'user': 'fred',    'active': false},
+     *   { 'user': 'pebbles', 'active': true }
+     * ];
+     *
+     * // using the `_.matches` callback shorthand
+     * _.pluck(_.takeWhile(users, { 'user': 'barney', 'active': false }), 'user');
+     * // => ['barney']
+     *
+     * // using the `_.matchesProperty` callback shorthand
+     * _.pluck(_.takeWhile(users, 'active', false), 'user');
+     * // => ['barney', 'fred']
+     *
+     * // using the `_.property` callback shorthand
+     * _.pluck(_.takeWhile(users, 'active'), 'user');
+     * // => []
+     */
+    function takeWhile(array, predicate, thisArg) {
+      return (array && array.length)
+        ? baseWhile(array, getCallback(predicate, thisArg, 3))
+        : [];
+    }
+
+    /**
+     * Creates an array of unique values, in order, from all of the provided arrays
+     * using [`SameValueZero`](http://ecma-international.org/ecma-262/6.0/#sec-samevaluezero)
+     * for equality comparisons.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {...Array} [arrays] The arrays to inspect.
+     * @returns {Array} Returns the new array of combined values.
+     * @example
+     *
+     * _.union([1, 2], [4, 2], [2, 1]);
+     * // => [1, 2, 4]
+     */
+    var union = restParam(function(arrays) {
+      return baseUniq(baseFlatten(arrays, false, true));
+    });
+
+    /**
+     * Creates a duplicate-free version of an array, using
+     * [`SameValueZero`](http://ecma-international.org/ecma-262/6.0/#sec-samevaluezero)
+     * for equality comparisons, in which only the first occurence of each element
+     * is kept. Providing `true` for `isSorted` performs a faster search algorithm
+     * for sorted arrays. If an iteratee function is provided it's invoked for
+     * each element in the array to generate the criterion by which uniqueness
+     * is computed. The `iteratee` is bound to `thisArg` and invoked with three
+     * arguments: (value, index, array).
+     *
+     * If a property name is provided for `iteratee` the created `_.property`
+     * style callback returns the property value of the given element.
+     *
+     * If a value is also provided for `thisArg` the created `_.matchesProperty`
+     * style callback returns `true` for elements that have a matching property
+     * value, else `false`.
+     *
+     * If an object is provided for `iteratee` the created `_.matches` style
+     * callback returns `true` for elements that have the properties of the given
+     * object, else `false`.
+     *
+     * @static
+     * @memberOf _
+     * @alias unique
+     * @category Array
+     * @param {Array} array The array to inspect.
+     * @param {boolean} [isSorted] Specify the array is sorted.
+     * @param {Function|Object|string} [iteratee] The function invoked per iteration.
+     * @param {*} [thisArg] The `this` binding of `iteratee`.
+     * @returns {Array} Returns the new duplicate-value-free array.
+     * @example
+     *
+     * _.uniq([2, 1, 2]);
+     * // => [2, 1]
+     *
+     * // using `isSorted`
+     * _.uniq([1, 1, 2], true);
+     * // => [1, 2]
+     *
+     * // using an iteratee function
+     * _.uniq([1, 2.5, 1.5, 2], function(n) {
+     *   return this.floor(n);
+     * }, Math);
+     * // => [1, 2.5]
+     *
+     * // using the `_.property` callback shorthand
+     * _.uniq([{ 'x': 1 }, { 'x': 2 }, { 'x': 1 }], 'x');
+     * // => [{ 'x': 1 }, { 'x': 2 }]
+     */
+    function uniq(array, isSorted, iteratee, thisArg) {
+      var length = array ? array.length : 0;
+      if (!length) {
+        return [];
+      }
+      if (isSorted != null && typeof isSorted != 'boolean') {
+        thisArg = iteratee;
+        iteratee = isIterateeCall(array, isSorted, thisArg) ? undefined : isSorted;
+        isSorted = false;
+      }
+      var callback = getCallback();
+      if (!(iteratee == null && callback === baseCallback)) {
+        iteratee = callback(iteratee, thisArg, 3);
+      }
+      return (isSorted && getIndexOf() === baseIndexOf)
+        ? sortedUniq(array, iteratee)
+        : baseUniq(array, iteratee);
+    }
+
+    /**
+     * This method is like `_.zip` except that it accepts an array of grouped
+     * elements and creates an array regrouping the elements to their pre-zip
+     * configuration.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {Array} array The array of grouped elements to process.
+     * @returns {Array} Returns the new array of regrouped elements.
+     * @example
+     *
+     * var zipped = _.zip(['fred', 'barney'], [30, 40], [true, false]);
+     * // => [['fred', 30, true], ['barney', 40, false]]
+     *
+     * _.unzip(zipped);
+     * // => [['fred', 'barney'], [30, 40], [true, false]]
+     */
+    function unzip(array) {
+      if (!(array && array.length)) {
+        return [];
+      }
+      var index = -1,
+          length = 0;
+
+      array = arrayFilter(array, function(group) {
+        if (isArrayLike(group)) {
+          length = nativeMax(group.length, length);
+          return true;
+        }
+      });
+      var result = Array(length);
+      while (++index < length) {
+        result[index] = arrayMap(array, baseProperty(index));
+      }
+      return result;
+    }
+
+    /**
+     * This method is like `_.unzip` except that it accepts an iteratee to specify
+     * how regrouped values should be combined. The `iteratee` is bound to `thisArg`
+     * and invoked with four arguments: (accumulator, value, index, group).
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {Array} array The array of grouped elements to process.
+     * @param {Function} [iteratee] The function to combine regrouped values.
+     * @param {*} [thisArg] The `this` binding of `iteratee`.
+     * @returns {Array} Returns the new array of regrouped elements.
+     * @example
+     *
+     * var zipped = _.zip([1, 2], [10, 20], [100, 200]);
+     * // => [[1, 10, 100], [2, 20, 200]]
+     *
+     * _.unzipWith(zipped, _.add);
+     * // => [3, 30, 300]
+     */
+    function unzipWith(array, iteratee, thisArg) {
+      var length = array ? array.length : 0;
+      if (!length) {
+        return [];
+      }
+      var result = unzip(array);
+      if (iteratee == null) {
+        return result;
+      }
+      iteratee = bindCallback(iteratee, thisArg, 4);
+      return arrayMap(result, function(group) {
+        return arrayReduce(group, iteratee, undefined, true);
+      });
+    }
+
+    /**
+     * Creates an array excluding all provided values using
+     * [`SameValueZero`](http://ecma-international.org/ecma-262/6.0/#sec-samevaluezero)
+     * for equality comparisons.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {Array} array The array to filter.
+     * @param {...*} [values] The values to exclude.
+     * @returns {Array} Returns the new array of filtered values.
+     * @example
+     *
+     * _.without([1, 2, 1, 3], 1, 2);
+     * // => [3]
+     */
+    var without = restParam(function(array, values) {
+      return isArrayLike(array)
+        ? baseDifference(array, values)
+        : [];
+    });
+
+    /**
+     * Creates an array of unique values that is the [symmetric difference](https://en.wikipedia.org/wiki/Symmetric_difference)
+     * of the provided arrays.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {...Array} [arrays] The arrays to inspect.
+     * @returns {Array} Returns the new array of values.
+     * @example
+     *
+     * _.xor([1, 2], [4, 2]);
+     * // => [1, 4]
+     */
+    function xor() {
+      var index = -1,
+          length = arguments.length;
+
+      while (++index < length) {
+        var array = arguments[index];
+        if (isArrayLike(array)) {
+          var result = result
+            ? arrayPush(baseDifference(result, array), baseDifference(array, result))
+            : array;
+        }
+      }
+      return result ? baseUniq(result) : [];
+    }
+
+    /**
+     * Creates an array of grouped elements, the first of which contains the first
+     * elements of the given arrays, the second of which contains the second elements
+     * of the given arrays, and so on.
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {...Array} [arrays] The arrays to process.
+     * @returns {Array} Returns the new array of grouped elements.
+     * @example
+     *
+     * _.zip(['fred', 'barney'], [30, 40], [true, false]);
+     * // => [['fred', 30, true], ['barney', 40, false]]
+     */
+    var zip = restParam(unzip);
+
+    /**
+     * The inverse of `_.pairs`; this method returns an object composed from arrays
+     * of property names and values. Provide either a single two dimensional array,
+     * e.g. `[[key1, value1], [key2, value2]]` or two arrays, one of property names
+     * and one of corresponding values.
+     *
+     * @static
+     * @memberOf _
+     * @alias object
+     * @category Array
+     * @param {Array} props The property names.
+     * @param {Array} [values=[]] The property values.
+     * @returns {Object} Returns the new object.
+     * @example
+     *
+     * _.zipObject([['fred', 30], ['barney', 40]]);
+     * // => { 'fred': 30, 'barney': 40 }
+     *
+     * _.zipObject(['fred', 'barney'], [30, 40]);
+     * // => { 'fred': 30, 'barney': 40 }
+     */
+    function zipObject(props, values) {
+      var index = -1,
+          length = props ? props.length : 0,
+          result = {};
+
+      if (length && !values && !isArray(props[0])) {
+        values = [];
+      }
+      while (++index < length) {
+        var key = props[index];
+        if (values) {
+          result[key] = values[index];
+        } else if (key) {
+          result[key[0]] = key[1];
+        }
+      }
+      return result;
+    }
+
+    /**
+     * This method is like `_.zip` except that it accepts an iteratee to specify
+     * how grouped values should be combined. The `iteratee` is bound to `thisArg`
+     * and invoked with four arguments: (accumulator, value, index, group).
+     *
+     * @static
+     * @memberOf _
+     * @category Array
+     * @param {...Array} [arrays] The arrays to process.
+     * @param {Function} [iteratee] The function to combine grouped values.
+     * @param {*} [thisArg] The `this` binding of `iteratee`.
+     * @returns {Array} Returns the new array of grouped elements.
+     * @example
+     *
+     * _.zipWith([1, 2], [10, 20], [100, 200], _.add);
+     * // => [111, 222]
+     */
+    var zipWith = restParam(function(arrays) {
+      var length = arrays.length,
+          iteratee = length > 2 ? arrays[length - 2] : undefined,
+          thisArg = length > 1 ? arrays[length - 1] : undefined;
+
+      if (length > 2 && typeof iteratee == 'function') {
+        length -= 2;
+      } else {
+        iteratee = (length > 1 && typeof thisArg == 'function') ? (--length, thisArg) : undefined;
+        thisArg = undefined;
+      }
+      arrays.length = length;
+      return unzipWith(arrays, iteratee, thisArg);
+    });
+
+    /*------------------------------------------------------------------------*/
+
+    /**
+     * Creates a `lodash` object that wraps `value` with explicit method
+     * chaining enabled.
+     *
+     * @static
+     * @memberOf _
+     * @category Chain
+     * @param {*} value The value to wrap.
+     * @returns {Object} Returns the new `lodash` wrapper instance.
+     * @example
+     *
+     * var users = [
+     *   { 'user': 'barney',  'age': 36 },
+     *   { 'user': 'fred',    'age': 40 },
+     *   { 'user': 'pebbles', 'age': 1 }
+     * ];
+     *
+     * var youngest = _.chain(users)
+     *   .sortBy('age')
+     *   .map(function(chr) {
+     *     return chr.user + ' is ' + chr.age;
+     *   })
+     *   .first()
+     *   .value();
+     * // => 'pebbles is 1'
+     */
+    function chain(value) {
+      var result = lodash(value);
+      result.__chain__ = true;
+      return result;
+    }
+
+    /**
+     * This method invokes `interceptor` and returns `value`. The interceptor is
+     * bound to `thisArg` and invoked with one argument; (value). The purpose of
+     * this method is to "tap into" a method chain in order to perform operations
+     * on intermediate results within the chain.
+     *
+     * @static
+     * @memberOf _
+     * @category Chain
+     * @param {*} value The value to provide to `interceptor`.
+     * @param {Function} interceptor The function to invoke.
+     * @param {*} [thisArg] The `this` binding of `interceptor`.
+     * @returns {*} Returns `value`.
+     * @example
+     *
+     * _([1, 2, 3])
+     *  .tap(function(array) {
+     *    array.pop();
+     *  })
+     *  .reverse()
+     *  .value();
+     * // => [2, 1]
+     */
+    function tap(value, interceptor, thisArg) {
+      interceptor.call(thisArg, value);
+      return value;
+    }
+
+    /**
+     * This method is like `_.tap` except that it returns the result of `interceptor`.
+     *
+     * @static
+     * @memberOf _
+     * @category Chain
+     * @param {*} value The value to provide to `interceptor`.
+     * @param {Function} interceptor The function to invoke.
+     * @param {*} [thisArg] The `this` binding of `interceptor`.
+     * @returns {*} Returns the result of `interceptor`.
+     * @example
+     *
+     * _('  abc  ')
+     *  .chain()
+     *  .trim()
+     *  .thru(function(value) {
+     *    return [value];
+     *  })
+     *  .value();
+     * // => ['abc']
+     */
+    function thru(value, interceptor, thisArg) {
+      return interceptor.call(thisArg, value);
+    }
+
+    /**
+     * Enables explicit method chaining on the wrapper object.
+     *
+     * @name chain
+     * @memberOf _
+     * @category Chain
+     * @returns {Object} Returns the new `lodash` wrapper instance.
+     * @example
+     *
+     * var users = [
+     *   { 'user': 'barney', 'age': 36 },
+     *   { 'user': 'fred',   'age': 40 }
+     * ];
+     *
+     * // without explicit chaining
+     * _(users).first();
+     * // => { 'user': 'barney', 'age': 36 }
+     *
+     * // with explicit chaining
+     * _(users).chain()
+     *   .first()
+     *   .pick('user')
+     *   .value();
+     * // => { 'user': 'barney' }
+     */
+    function wrapperChain() {
+      return chain(this);
+    }
+
+    /**
+     * Executes the chained sequence and returns the wrapped result.
+     *
+     * @name commit
+     * @memberOf _
+     * @category Chain
+     * @returns {Object} Returns the new `lodash` wrapper instance.
+     * @example
+     *
+     * var array = [1, 2];
+     * var wrapped = _(array).push(3);
+     *
+     * console.log(array);
+     * // => [1, 2]
+     *
+     * wrapped = wrapped.commit();
+     * console.log(array);
+     * // => [1, 2, 3]
+     *
+     * wrapped.last();
+     * // => 3
+     *
+     * console.log(array);
+     * // => [1, 2, 3]
+     */
+    function wrapperCommit() {
+      return new LodashWrapper(this.value(), this.__chain__);
+    }
+
+    /**
+     * Creates a new array joining a wrapped array with any additional arrays
+     * and/or values.
+     *
+     * @name concat
+     * @memberOf _
+     * @category Chain
+     * @param {...*} [values] The values to concatenate.
+     * @returns {Array} Returns the new concatenated array.
+     * @example
+     *
+     * var array = [1];
+     * var wrapped = _(array).concat(2, [3], [[4]]);
+     *
+     * console.log(wrapped.value());
+     * // => [1, 2, 3, [4]]
+     *
+     * console.log(array);
+     * // => [1]
+     */
+    var wrapperConcat = restParam(function(values) {
+      values = baseFlatten(values);
+      return this.thru(function(array) {
+        return arrayConcat(isArray(array) ? array : [toObject(array)], values);
+      });
+    });
+
+    /**
+     * Creates a clone of the chained sequence planting `value` as the wrapped value.
+     *
+     * @name plant
+     * @memberOf _
+     * @category Chain
+     * @returns {Object} Returns the new `lodash` wrapper instance.
+     * @example
+     *
+     * var array = [1, 2];
+     * var wrapped = _(array).map(function(value) {
+     *   return Math.pow(value, 2);
+     * });
+     *
+     * var other = [3, 4];
+     * var otherWrapped = wrapped.plant(other);
+     *
+     * otherWrapped.value();
+     * // => [9, 16]
+     *
+     * wrapped.value();
+     * // => [1, 4]
+     */
+    function wrapperPlant(value) {
+      var result,
+          parent = this;
+
+      while (parent instanceof baseLodash) {
+        var clone = wrapperClone(parent);
+        if (result) {
+          previous.__wrapped__ = clone;
+        } else {
+          result = clone;
+        }
+        var previous = clone;
+        parent = parent.__wrapped__;
+      }
+      previous.__wrapped__ = value;
+      return result;
+    }
+
+    /**
+     * Reverses the wrapped array so the first element becomes the last, the
+     * second element becomes the second to last, and so on.
+     *
+     * **Note:** This method mutates the wrapped array.
+     *
+     * @name reverse
+     * @memberOf _
+     * @category Chain
+     * @returns {Object} Returns the new reversed `lodash` wrapper instance.
+     * @example
+     *
+     * var array = [1, 2, 3];
+     *
+     * _(array).reverse().value()
+     * // => [3, 2, 1]
+     *
+     * console.log(array);
+     * // => [3, 2, 1]
+     */
+    function wrapperReverse() {
+      var value = this.__wrapped__;
+
+      var interceptor = function(value) {
+        return value.reverse();
+      };
+      if (value instanceof LazyWrapper) {
+        var wrapped = value;
+        if (this.__actions__.length) {
+          wrapped = new LazyWrapper(this);
+        }
+        wrapped = wrapped.reverse();
+        wrapped.__actions__.push({ 'func': thru, 'args': [interceptor], 'thisArg': undefined });
+        return new LodashWrapper(wrapped, this.__chain__);
+      }
+      return this.thru(interceptor);
+    }
+
+    /**
+     * Produces the result of coercing the unwrapped value to a string.
+     *
+     * @name toString
+     * @memberOf _
+     * @category Chain
+     * @returns {string} Returns the coerced string value.
+     * @example
+     *
+     * _([1, 2, 3]).toString();
+     * // => '1,2,3'
+     */
+    function wrapperToString() {
+      return (this.value() + '');
+    }
+
+    /**
+     * Executes the chained sequence to extract the unwrapped value.
+     *
+     * @name value
+     * @memberOf _
+     * @alias run, toJSON, valueOf
+     * @category Chain
+     * @returns {*} Returns the resolved unwrapped value.
+     * @example
+     *
+     * _([1, 2, 3]).value();
+     * // => [1, 2, 3]
+     */
+    function wrapperValue() {
+      return baseWrapperValue(this.__wrapped__, this.__actions__);
+    }
+
+    /*------------------------------------------------------------------------*/
+
+    /**
+     * Creates an array of elements corresponding to the given keys, or indexes,
+     * of `collection`. Keys may be specified as individual arguments or as arrays
+     * of keys.
+     *
+     * @static
+     * @memberOf _
+     * @category Collection
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {...(number|number[]|string|string[])} [props] The property names
+     *  or indexes of elements to pick, specified individually or in arrays.
+     * @returns {Array} Returns the new array of picked elements.
+     * @example
+     *
+     * _.at(['a', 'b', 'c'], [0, 2]);
+     * // => ['a', 'c']
+     *
+     * _.at(['barney', 'fred', 'pebbles'], 0, 2);
+     * // => ['barney', 'pebbles']
+     */
+    var at = restParam(function(collection, props) {
+      if (isArrayLike(collection)) {
+        collection = toIterable(collection);
+      }
+      return baseAt(collection, baseFlatten(props));
+    });
+
+    /**
+     * Creates an object composed of keys generated from the results of running
+     * each element of `collection` through `iteratee`. The corresponding value
+     * of each key is the number of times the key was returned by `iteratee`.
+     * The `iteratee` is bound to `thisArg` and invoked with three arguments:
+     * (value, index|key, collection).
+     *
+     * If a property name is provided for `iteratee` the created `_.property`
+     * style callback returns the property value of the given element.
+     *
+     * If a value is also provided for `thisArg` the created `_.matchesProperty`
+     * style callback returns `true` for elements that have a matching property
+     * value, else `false`.
+     *
+     * If an object is provided for `iteratee` the created `_.matches` style
+     * callback returns `true` for elements that have the properties of the given
+     * object, else `false`.
+     *
+     * @static
+     * @memberOf _
+     * @category Collection
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {Function|Object|string} [iteratee=_.identity] The function invoked
+     *  per iteration.
+     * @param {*} [thisArg] The `this` binding of `iteratee`.
+     * @returns {Object} Returns the composed aggregate object.
+     * @example
+     *
+     * _.countBy([4.3, 6.1, 6.4], function(n) {
+     *   return Math.floor(n);
+     * });
+     * // => { '4': 1, '6': 2 }
+     *
+     * _.countBy([4.3, 6.1, 6.4], function(n) {
+     *   return this.floor(n);
+     * }, Math);
+     * // => { '4': 1, '6': 2 }
+     *
+     * _.countBy(['one', 'two', 'three'], 'length');
+     * // => { '3': 2, '5': 1 }
+     */
+    var countBy = createAggregator(function(result, value, key) {
+      hasOwnProperty.call(result, key) ? ++result[key] : (result[key] = 1);
+    });
+
+    /**
+     * Checks if `predicate` returns truthy for **all** elements of `collection`.
+     * The predicate is bound to `thisArg` and invoked with three arguments:
+     * (value, index|key, collection).
+     *
+     * If a property name is provided for `predicate` the created `_.property`
+     * style callback returns the property value of the given element.
+     *
+     * If a value is also provided for `thisArg` the created `_.matchesProperty`
+     * style callback returns `true` for elements that have a matching property
+     * value, else `false`.
+     *
+     * If an object is provided for `predicate` the created `_.matches` style
+     * callback returns `true` for elements that have the properties of the given
+     * object, else `false`.
+     *
+     * @static
+     * @memberOf _
+     * @alias all
+     * @category Collection
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {Function|Object|string} [predicate=_.identity] The function invoked
+     *  per iteration.
+     * @param {*} [thisArg] The `this` binding of `predicate`.
+     * @returns {boolean} Returns `true` if all elements pass the predicate check,
+     *  else `false`.
+     * @example
+     *
+     * _.every([true, 1, null, 'yes'], Boolean);
+     * // => false
+     *
+     * var users = [
+     *   { 'user': 'barney', 'active': false },
+     *   { 'user': 'fred',   'active': false }
+     * ];
+     *
+     * // using the `_.matches` callback shorthand
+     * _.every(users, { 'user': 'barney', 'active': false });
+     * // => false
+     *
+     * // using the `_.matchesProperty` callback shorthand
+     * _.every(users, 'active', false);
+     * // => true
+     *
+     * // using the `_.property` callback shorthand
+     * _.every(users, 'active');
+     * // => false
+     */
+    function every(collection, predicate, thisArg) {
+      var func = isArray(collection) ? arrayEvery : baseEvery;
+      if (thisArg && isIterateeCall(collection, predicate, thisArg)) {
+        predicate = undefined;
+      }
+      if (typeof predicate != 'function' || thisArg !== undefined) {
+        predicate = getCallback(predicate, thisArg, 3);
+      }
+      return func(collection, predicate);
+    }
+
+    /**
+     * Iterates over elements of `collection`, returning an array of all elements
+     * `predicate` returns truthy for. The predicate is bound to `thisArg` and
+     * invoked with three arguments: (value, index|key, collection).
+     *
+     * If a property name is provided for `predicate` the created `_.property`
+     * style callback returns the property value of the given element.
+     *
+     * If a value is also provided for `thisArg` the created `_.matchesProperty`
+     * style callback returns `true` for elements that have a matching property
+     * value, else `false`.
+     *
+     * If an object is provided for `predicate` the created `_.matches` style
+     * callback returns `true` for elements that have the properties of the given
+     * object, else `false`.
+     *
+     * @static
+     * @memberOf _
+     * @alias select
+     * @category Collection
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {Function|Object|string} [predicate=_.identity] The function invoked
+     *  per iteration.
+     * @param {*} [thisArg] The `this` binding of `predicate`.
+     * @returns {Array} Returns the new filtered array.
+     * @example
+     *
+     * _.filter([4, 5, 6], function(n) {
+     *   return n % 2 == 0;
+     * });
+     * // => [4, 6]
+     *
+     * var users = [
+     *   { 'user': 'barney', 'age': 36, 'active': true },
+     *   { 'user': 'fred',   'age': 40, 'active': false }
+     * ];
+     *
+     * // using the `_.matches` callback shorthand
+     * _.pluck(_.filter(users, { 'age': 36, 'active': true }), 'user');
+     * // => ['barney']
+     *
+     * // using the `_.matchesProperty` callback shorthand
+     * _.pluck(_.filter(users, 'active', false), 'user');
+     * // => ['fred']
+     *
+     * // using the `_.property` callback shorthand
+     * _.pluck(_.filter(users, 'active'), 'user');
+     * // => ['barney']
+     */
+    function filter(collection, predicate, thisArg) {
+      var func = isArray(collection) ? arrayFilter : baseFilter;
+      predicate = getCallback(predicate, thisArg, 3);
+      return func(collection, predicate);
+    }
+
+    /**
+     * Iterates over elements of `collection`, returning the first element
+     * `predicate` returns truthy for. The predicate is bound to `thisArg` and
+     * invoked with three arguments: (value, index|key, collection).
+     *
+     * If a property name is provided for `predicate` the created `_.property`
+     * style callback returns the property value of the given element.
+     *
+     * If a value is also provided for `thisArg` the created `_.matchesProperty`
+     * style callback returns `true` for elements that have a matching property
+     * value, else `false`.
+     *
+     * If an object is provided for `predicate` the created `_.matches` style
+     * callback returns `true` for elements that have the properties of the given
+     * object, else `false`.
+     *
+     * @static
+     * @memberOf _
+     * @alias detect
+     * @category Collection
+     * @param {Array|Object|string} collection The collection to search.
+     * @param {Function|Object|string} [predicate=_.identity] The function invoked
+     *  per iteration.
+     * @param {*} [thisArg] The `this` binding of `predicate`.
+     * @returns {*} Returns the matched element, else `undefined`.
+     * @example
+     *
+     * var users = [
+     *   { 'user': 'barney',  'age': 36, 'active': true },
+     *   { 'user': 'fred',    'age': 40, 'active': false },
+     *   { 'user': 'pebbles', 'age': 1,  'active': true }
+     * ];
+     *
+     * _.result(_.find(users, function(chr) {
+     *   return chr.age < 40;
+     * }), 'user');
+     * // => 'barney'
+     *
+     * // using the `_.matches` callback shorthand
+     * _.result(_.find(users, { 'age': 1, 'active': true }), 'user');
+     * // => 'pebbles'
+     *
+     * // using the `_.matchesProperty` callback shorthand
+     * _.result(_.find(users, 'active', false), 'user');
+     * // => 'fred'
+     *
+     * // using the `_.property` callback shorthand
+     * _.result(_.find(users, 'active'), 'user');
+     * // => 'barney'
+     */
+    var find = createFind(baseEach);
+
+    /**
+     * This method is like `_.find` except that it iterates over elements of
+     * `collection` from right to left.
+     *
+     * @static
+     * @memberOf _
+     * @category Collection
+     * @param {Array|Object|string} collection The collection to search.
+     * @param {Function|Object|string} [predicate=_.identity] The function invoked
+     *  per iteration.
+     * @param {*} [thisArg] The `this` binding of `predicate`.
+     * @returns {*} Returns the matched element, else `undefined`.
+     * @example
+     *
+     * _.findLast([1, 2, 3, 4], function(n) {
+     *   return n % 2 == 1;
+     * });
+     * // => 3
+     */
+    var findLast = createFind(baseEachRight, true);
+
+    /**
+     * Performs a deep comparison between each element in `collection` and the
+     * source object, returning the first element that has equivalent property
+     * values.
+     *
+     * **Note:** This method supports comparing arrays, booleans, `Date` objects,
+     * numbers, `Object` objects, regexes, and strings. Objects are compared by
+     * their own, not inherited, enumerable properties. For comparing a single
+     * own or inherited property value see `_.matchesProperty`.
+     *
+     * @static
+     * @memberOf _
+     * @category Collection
+     * @param {Array|Object|string} collection The collection to search.
+     * @param {Object} source The object of property values to match.
+     * @returns {*} Returns the matched element, else `undefined`.
+     * @example
+     *
+     * var users = [
+     *   { 'user': 'barney', 'age': 36, 'active': true },
+     *   { 'user': 'fred',   'age': 40, 'active': false }
+     * ];
+     *
+     * _.result(_.findWhere(users, { 'age': 36, 'active': true }), 'user');
+     * // => 'barney'
+     *
+     * _.result(_.findWhere(users, { 'age': 40, 'active': false }), 'user');
+     * // => 'fred'
+     */
+    function findWhere(collection, source) {
+      return find(collection, baseMatches(source));
+    }
+
+    /**
+     * Iterates over elements of `collection` invoking `iteratee` for each element.
+     * The `iteratee` is bound to `thisArg` and invoked with three arguments:
+     * (value, index|key, collection). Iteratee functions may exit iteration early
+     * by explicitly returning `false`.
+     *
+     * **Note:** As with other "Collections" methods, objects with a "length" property
+     * are iterated like arrays. To avoid this behavior `_.forIn` or `_.forOwn`
+     * may be used for object iteration.
+     *
+     * @static
+     * @memberOf _
+     * @alias each
+     * @category Collection
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {Function} [iteratee=_.identity] The function invoked per iteration.
+     * @param {*} [thisArg] The `this` binding of `iteratee`.
+     * @returns {Array|Object|string} Returns `collection`.
+     * @example
+     *
+     * _([1, 2]).forEach(function(n) {
+     *   console.log(n);
+     * }).value();
+     * // => logs each value from left to right and returns the array
+     *
+     * _.forEach({ 'a': 1, 'b': 2 }, function(n, key) {
+     *   console.log(n, key);
+     * });
+     * // => logs each value-key pair and returns the object (iteration order is not guaranteed)
+     */
+    var forEach = createForEach(arrayEach, baseEach);
+
+    /**
+     * This method is like `_.forEach` except that it iterates over elements of
+     * `collection` from right to left.
+     *
+     * @static
+     * @memberOf _
+     * @alias eachRight
+     * @category Collection
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {Function} [iteratee=_.identity] The function invoked per iteration.
+     * @param {*} [thisArg] The `this` binding of `iteratee`.
+     * @returns {Array|Object|string} Returns `collection`.
+     * @example
+     *
+     * _([1, 2]).forEachRight(function(n) {
+     *   console.log(n);
+     * }).value();
+     * // => logs each value from right to left and returns the array
+     */
+    var forEachRight = createForEach(arrayEachRight, baseEachRight);
+
+    /**
+     * Creates an object composed of keys generated from the results of running
+     * each element of `collection` through `iteratee`. The corresponding value
+     * of each key is an array of the elements responsible for generating the key.
+     * The `iteratee` is bound to `thisArg` and invoked with three arguments:
+     * (value, index|key, collection).
+     *
+     * If a property name is provided for `iteratee` the created `_.property`
+     * style callback returns the property value of the given element.
+     *
+     * If a value is also provided for `thisArg` the created `_.matchesProperty`
+     * style callback returns `true` for elements that have a matching property
+     * value, else `false`.
+     *
+     * If an object is provided for `iteratee` the created `_.matches` style
+     * callback returns `true` for elements that have the properties of the given
+     * object, else `false`.
+     *
+     * @static
+     * @memberOf _
+     * @category Collection
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {Function|Object|string} [iteratee=_.identity] The function invoked
+     *  per iteration.
+     * @param {*} [thisArg] The `this` binding of `iteratee`.
+     * @returns {Object} Returns the composed aggregate object.
+     * @example
+     *
+     * _.groupBy([4.2, 6.1, 6.4], function(n) {
+     *   return Math.floor(n);
+     * });
+     * // => { '4': [4.2], '6': [6.1, 6.4] }
+     *
+     * _.groupBy([4.2, 6.1, 6.4], function(n) {
+     *   return this.floor(n);
+     * }, Math);
+     * // => { '4': [4.2], '6': [6.1, 6.4] }
+     *
+     * // using the `_.property` callback shorthand
+     * _.groupBy(['one', 'two', 'three'], 'length');
+     * // => { '3': ['one', 'two'], '5': ['three'] }
+     */
+    var groupBy = createAggregator(function(result, value, key) {
+      if (hasOwnProperty.call(result, key)) {
+        result[key].push(value);
+      } else {
+        result[key] = [value];
+      }
+    });
+
+    /**
+     * Checks if `target` is in `collection` using
+     * [`SameValueZero`](http://ecma-international.org/ecma-262/6.0/#sec-samevaluezero)
+     * for equality comparisons. If `fromIndex` is negative, it's used as the offset
+     * from the end of `collection`.
+     *
+     * @static
+     * @memberOf _
+     * @alias contains, include
+     * @category Collection
+     * @param {Array|Object|string} collection The collection to search.
+     * @param {*} target The value to search for.
+     * @param {number} [fromIndex=0] The index to search from.
+     * @param- {Object} [guard] Enables use as a callback for functions like `_.reduce`.
+     * @returns {boolean} Returns `true` if a matching element is found, else `false`.
+     * @example
+     *
+     * _.includes([1, 2, 3], 1);
+     * // => true
+     *
+     * _.includes([1, 2, 3], 1, 2);
+     * // => false
+     *
+     * _.includes({ 'user': 'fred', 'age': 40 }, 'fred');
+     * // => true
+     *
+     * _.includes('pebbles', 'eb');
+     * // => true
+     */
+    function includes(collection, target, fromIndex, guard) {
+      var length = collection ? getLength(collection) : 0;
+      if (!isLength(length)) {
+        collection = values(collection);
+        length = collection.length;
+      }
+      if (typeof fromIndex != 'number' || (guard && isIterateeCall(target, fromIndex, guard))) {
+        fromIndex = 0;
+      } else {
+        fromIndex = fromIndex < 0 ? nativeMax(length + fromIndex, 0) : (fromIndex || 0);
+      }
+      return (typeof collection == 'string' || !isArray(collection) && isString(collection))
+        ? (fromIndex <= length && collection.indexOf(target, fromIndex) > -1)
+        : (!!length && getIndexOf(collection, target, fromIndex) > -1);
+    }
+
+    /**
+     * Creates an object composed of keys generated from the results of running
+     * each element of `collection` through `iteratee`. The corresponding value
+     * of each key is the last element responsible for generating the key. The
+     * iteratee function is bound to `thisArg` and invoked with three arguments:
+     * (value, index|key, collection).
+     *
+     * If a property name is provided for `iteratee` the created `_.property`
+     * style callback returns the property value of the given element.
+     *
+     * If a value is also provided for `thisArg` the created `_.matchesProperty`
+     * style callback returns `true` for elements that have a matching property
+     * value, else `false`.
+     *
+     * If an object is provided for `iteratee` the created `_.matches` style
+     * callback returns `true` for elements that have the properties of the given
+     * object, else `false`.
+     *
+     * @static
+     * @memberOf _
+     * @category Collection
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {Function|Object|string} [iteratee=_.identity] The function invoked
+     *  per iteration.
+     * @param {*} [thisArg] The `this` binding of `iteratee`.
+     * @returns {Object} Returns the composed aggregate object.
+     * @example
+     *
+     * var keyData = [
+     *   { 'dir': 'left', 'code': 97 },
+     *   { 'dir': 'right', 'code': 100 }
+     * ];
+     *
+     * _.indexBy(keyData, 'dir');
+     * // => { 'left': { 'dir': 'left', 'code': 97 }, 'right': { 'dir': 'right', 'code': 100 } }
+     *
+     * _.indexBy(keyData, function(object) {
+     *   return String.fromCharCode(object.code);
+     * });
+     * // => { 'a': { 'dir': 'left', 'code': 97 }, 'd': { 'dir': 'right', 'code': 100 } }
+     *
+     * _.indexBy(keyData, function(object) {
+     *   return this.fromCharCode(object.code);
+     * }, String);
+     * // => { 'a': { 'dir': 'left', 'code': 97 }, 'd': { 'dir': 'right', 'code': 100 } }
+     */
+    var indexBy = createAggregator(function(result, value, key) {
+      result[key] = value;
+    });
+
+    /**
+     * Invokes the method at `path` of each element in `collection`, returning
+     * an array of the results of each invoked method. Any additional arguments
+     * are provided to each invoked method. If `methodName` is a function it's
+     * invoked for, and `this` bound to, each element in `collection`.
+     *
+     * @static
+     * @memberOf _
+     * @category Collection
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {Array|Function|string} path The path of the method to invoke or
+     *  the function invoked per iteration.
+     * @param {...*} [args] The arguments to invoke the method with.
+     * @returns {Array} Returns the array of results.
+     * @example
+     *
+     * _.invoke([[5, 1, 7], [3, 2, 1]], 'sort');
+     * // => [[1, 5, 7], [1, 2, 3]]
+     *
+     * _.invoke([123, 456], String.prototype.split, '');
+     * // => [['1', '2', '3'], ['4', '5', '6']]
+     */
+    var invoke = restParam(function(collection, path, args) {
+      var index = -1,
+          isFunc = typeof path == 'function',
+          isProp = isKey(path),
+          result = isArrayLike(collection) ? Array(collection.length) : [];
+
+      baseEach(collection, function(value) {
+        var func = isFunc ? path : ((isProp && value != null) ? value[path] : undefined);
+        result[++index] = func ? func.apply(value, args) : invokePath(value, path, args);
+      });
+      return result;
+    });
+
+    /**
+     * Creates an array of values by running each element in `collection` through
+     * `iteratee`. The `iteratee` is bound to `thisArg` and invoked with three
+     * arguments: (value, index|key, collection).
+     *
+     * If a property name is provided for `iteratee` the created `_.property`
+     * style callback returns the property value of the given element.
+     *
+     * If a value is also provided for `thisArg` the created `_.matchesProperty`
+     * style callback returns `true` for elements that have a matching property
+     * value, else `false`.
+     *
+     * If an object is provided for `iteratee` the created `_.matches` style
+     * callback returns `true` for elements that have the properties of the given
+     * object, else `false`.
+     *
+     * Many lodash methods are guarded to work as iteratees for methods like
+     * `_.every`, `_.filter`, `_.map`, `_.mapValues`, `_.reject`, and `_.some`.
+     *
+     * The guarded methods are:
+     * `ary`, `callback`, `chunk`, `clone`, `create`, `curry`, `curryRight`,
+     * `drop`, `dropRight`, `every`, `fill`, `flatten`, `invert`, `max`, `min`,
+     * `parseInt`, `slice`, `sortBy`, `take`, `takeRight`, `template`, `trim`,
+     * `trimLeft`, `trimRight`, `trunc`, `random`, `range`, `sample`, `some`,
+     * `sum`, `uniq`, and `words`
+     *
+     * @static
+     * @memberOf _
+     * @alias collect
+     * @category Collection
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {Function|Object|string} [iteratee=_.identity] The function invoked
+     *  per iteration.
+     * @param {*} [thisArg] The `this` binding of `iteratee`.
+     * @returns {Array} Returns the new mapped array.
+     * @example
+     *
+     * function timesThree(n) {
+     *   return n * 3;
+     * }
+     *
+     * _.map([1, 2], timesThree);
+     * // => [3, 6]
+     *
+     * _.map({ 'a': 1, 'b': 2 }, timesThree);
+     * // => [3, 6] (iteration order is not guaranteed)
+     *
+     * var users = [
+     *   { 'user': 'barney' },
+     *   { 'user': 'fred' }
+     * ];
+     *
+     * // using the `_.property` callback shorthand
+     * _.map(users, 'user');
+     * // => ['barney', 'fred']
+     */
+    function map(collection, iteratee, thisArg) {
+      var func = isArray(collection) ? arrayMap : baseMap;
+      iteratee = getCallback(iteratee, thisArg, 3);
+      return func(collection, iteratee);
+    }
+
+    /**
+     * Creates an array of elements split into two groups, the first of which
+     * contains elements `predicate` returns truthy for, while the second of which
+     * contains elements `predicate` returns falsey for. The predicate is bound
+     * to `thisArg` and invoked with three arguments: (value, index|key, collection).
+     *
+     * If a property name is provided for `predicate` the created `_.property`
+     * style callback returns the property value of the given element.
+     *
+     * If a value is also provided for `thisArg` the created `_.matchesProperty`
+     * style callback returns `true` for elements that have a matching property
+     * value, else `false`.
+     *
+     * If an object is provided for `predicate` the created `_.matches` style
+     * callback returns `true` for elements that have the properties of the given
+     * object, else `false`.
+     *
+     * @static
+     * @memberOf _
+     * @category Collection
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {Function|Object|string} [predicate=_.identity] The function invoked
+     *  per iteration.
+     * @param {*} [thisArg] The `this` binding of `predicate`.
+     * @returns {Array} Returns the array of grouped elements.
+     * @example
+     *
+     * _.partition([1, 2, 3], function(n) {
+     *   return n % 2;
+     * });
+     * // => [[1, 3], [2]]
+     *
+     * _.partition([1.2, 2.3, 3.4], function(n) {
+     *   return this.floor(n) % 2;
+     * }, Math);
+     * // => [[1.2, 3.4], [2.3]]
+     *
+     * var users = [
+     *   { 'user': 'barney',  'age': 36, 'active': false },
+     *   { 'user': 'fred',    'age': 40, 'active': true },
+     *   { 'user': 'pebbles', 'age': 1,  'active': false }
+     * ];
+     *
+     * var mapper = function(array) {
+     *   return _.pluck(array, 'user');
+     * };
+     *
+     * // using the `_.matches` callback shorthand
+     * _.map(_.partition(users, { 'age': 1, 'active': false }), mapper);
+     * // => [['pebbles'], ['barney', 'fred']]
+     *
+     * // using the `_.matchesProperty` callback shorthand
+     * _.map(_.partition(users, 'active', false), mapper);
+     * // => [['barney', 'pebbles'], ['fred']]
+     *
+     * // using the `_.property` callback shorthand
+     * _.map(_.partition(users, 'active'), mapper);
+     * // => [['fred'], ['barney', 'pebbles']]
+     */
+    var partition = createAggregator(function(result, value, key) {
+      result[key ? 0 : 1].push(value);
+    }, function() { return [[], []]; });
+
+    /**
+     * Gets the property value of `path` from all elements in `collection`.
+     *
+     * @static
+     * @memberOf _
+     * @category Collection
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {Array|string} path The path of the property to pluck.
+     * @returns {Array} Returns the property values.
+     * @example
+     *
+     * var users = [
+     *   { 'user': 'barney', 'age': 36 },
+     *   { 'user': 'fred',   'age': 40 }
+     * ];
+     *
+     * _.pluck(users, 'user');
+     * // => ['barney', 'fred']
+     *
+     * var userIndex = _.indexBy(users, 'user');
+     * _.pluck(userIndex, 'age');
+     * // => [36, 40] (iteration order is not guaranteed)
+     */
+    function pluck(collection, path) {
+      return map(collection, property(path));
+    }
+
+    /**
+     * Reduces `collection` to a value which is the accumulated result of running
+     * each element in `collection` through `iteratee`, where each successive
+     * invocation is supplied the return value of the previous. If `accumulator`
+     * is not provided the first element of `collection` is used as the initial
+     * value. The `iteratee` is bound to `thisArg` and invoked with four arguments:
+     * (accumulator, value, index|key, collection).
+     *
+     * Many lodash methods are guarded to work as iteratees for methods like
+     * `_.reduce`, `_.reduceRight`, and `_.transform`.
+     *
+     * The guarded methods are:
+     * `assign`, `defaults`, `defaultsDeep`, `includes`, `merge`, `sortByAll`,
+     * and `sortByOrder`
+     *
+     * @static
+     * @memberOf _
+     * @alias foldl, inject
+     * @category Collection
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {Function} [iteratee=_.identity] The function invoked per iteration.
+     * @param {*} [accumulator] The initial value.
+     * @param {*} [thisArg] The `this` binding of `iteratee`.
+     * @returns {*} Returns the accumulated value.
+     * @example
+     *
+     * _.reduce([1, 2], function(total, n) {
+     *   return total + n;
+     * });
+     * // => 3
+     *
+     * _.reduce({ 'a': 1, 'b': 2 }, function(result, n, key) {
+     *   result[key] = n * 3;
+     *   return result;
+     * }, {});
+     * // => { 'a': 3, 'b': 6 } (iteration order is not guaranteed)
+     */
+    var reduce = createReduce(arrayReduce, baseEach);
+
+    /**
+     * This method is like `_.reduce` except that it iterates over elements of
+     * `collection` from right to left.
+     *
+     * @static
+     * @memberOf _
+     * @alias foldr
+     * @category Collection
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {Function} [iteratee=_.identity] The function invoked per iteration.
+     * @param {*} [accumulator] The initial value.
+     * @param {*} [thisArg] The `this` binding of `iteratee`.
+     * @returns {*} Returns the accumulated value.
+     * @example
+     *
+     * var array = [[0, 1], [2, 3], [4, 5]];
+     *
+     * _.reduceRight(array, function(flattened, other) {
+     *   return flattened.concat(other);
+     * }, []);
+     * // => [4, 5, 2, 3, 0, 1]
+     */
+    var reduceRight = createReduce(arrayReduceRight, baseEachRight);
+
+    /**
+     * The opposite of `_.filter`; this method returns the elements of `collection`
+     * that `predicate` does **not** return truthy for.
+     *
+     * @static
+     * @memberOf _
+     * @category Collection
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {Function|Object|string} [predicate=_.identity] The function invoked
+     *  per iteration.
+     * @param {*} [thisArg] The `this` binding of `predicate`.
+     * @returns {Array} Returns the new filtered array.
+     * @example
+     *
+     * _.reject([1, 2, 3, 4], function(n) {
+     *   return n % 2 == 0;
+     * });
+     * // => [1, 3]
+     *
+     * var users = [
+     *   { 'user': 'barney', 'age': 36, 'active': false },
+     *   { 'user': 'fred',   'age': 40, 'active': true }
+     * ];
+     *
+     * // using the `_.matches` callback shorthand
+     * _.pluck(_.reject(users, { 'age': 40, 'active': true }), 'user');
+     * // => ['barney']
+     *
+     * // using the `_.matchesProperty` callback shorthand
+     * _.pluck(_.reject(users, 'active', false), 'user');
+     * // => ['fred']
+     *
+     * // using the `_.property` callback shorthand
+     * _.pluck(_.reject(users, 'active'), 'user');
+     * // => ['barney']
+     */
+    function reject(collection, predicate, thisArg) {
+      var func = isArray(collection) ? arrayFilter : baseFilter;
+      predicate = getCallback(predicate, thisArg, 3);
+      return func(collection, function(value, index, collection) {
+        return !predicate(value, index, collection);
+      });
+    }
+
+    /**
+     * Gets a random element or `n` random elements from a collection.
+     *
+     * @static
+     * @memberOf _
+     * @category Collection
+     * @param {Array|Object|string} collection The collection to sample.
+     * @param {number} [n] The number of elements to sample.
+     * @param- {Object} [guard] Enables use as a callback for functions like `_.map`.
+     * @returns {*} Returns the random sample(s).
+     * @example
+     *
+     * _.sample([1, 2, 3, 4]);
+     * // => 2
+     *
+     * _.sample([1, 2, 3, 4], 2);
+     * // => [3, 1]
+     */
+    function sample(collection, n, guard) {
+      if (guard ? isIterateeCall(collection, n, guard) : n == null) {
+        collection = toIterable(collection);
+        var length = collection.length;
+        return length > 0 ? collection[baseRandom(0, length - 1)] : undefined;
+      }
+      var index = -1,
+          result = toArray(collection),
+          length = result.length,
+          lastIndex = length - 1;
+
+      n = nativeMin(n < 0 ? 0 : (+n || 0), length);
+      while (++index < n) {
+        var rand = baseRandom(index, lastIndex),
+            value = result[rand];
+
+        result[rand] = result[index];
+        result[index] = value;
+      }
+      result.length = n;
+      return result;
+    }
+
+    /**
+     * Creates an array of shuffled values, using a version of the
+     * [Fisher-Yates shuffle](https://en.wikipedia.org/wiki/Fisher-Yates_shuffle).
+     *
+     * @static
+     * @memberOf _
+     * @category Collection
+     * @param {Array|Object|string} collection The collection to shuffle.
+     * @returns {Array} Returns the new shuffled array.
+     * @example
+     *
+     * _.shuffle([1, 2, 3, 4]);
+     * // => [4, 1, 3, 2]
+     */
+    function shuffle(collection) {
+      return sample(collection, POSITIVE_INFINITY);
+    }
+
+    /**
+     * Gets the size of `collection` by returning its length for array-like
+     * values or the number of own enumerable properties for objects.
+     *
+     * @static
+     * @memberOf _
+     * @category Collection
+     * @param {Array|Object|string} collection The collection to inspect.
+     * @returns {number} Returns the size of `collection`.
+     * @example
+     *
+     * _.size([1, 2, 3]);
+     * // => 3
+     *
+     * _.size({ 'a': 1, 'b': 2 });
+     * // => 2
+     *
+     * _.size('pebbles');
+     * // => 7
+     */
+    function size(collection) {
+      var length = collection ? getLength(collection) : 0;
+      return isLength(length) ? length : keys(collection).length;
+    }
+
+    /**
+     * Checks if `predicate` returns truthy for **any** element of `collection`.
+     * The function returns as soon as it finds a passing value and does not iterate
+     * over the entire collection. The predicate is bound to `thisArg` and invoked
+     * with three arguments: (value, index|key, collection).
+     *
+     * If a property name is provided for `predicate` the created `_.property`
+     * style callback returns the property value of the given element.
+     *
+     * If a value is also provided for `thisArg` the created `_.matchesProperty`
+     * style callback returns `true` for elements that have a matching property
+     * value, else `false`.
+     *
+     * If an object is provided for `predicate` the created `_.matches` style
+     * callback returns `true` for elements that have the properties of the given
+     * object, else `false`.
+     *
+     * @static
+     * @memberOf _
+     * @alias any
+     * @category Collection
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {Function|Object|string} [predicate=_.identity] The function invoked
+     *  per iteration.
+     * @param {*} [thisArg] The `this` binding of `predicate`.
+     * @returns {boolean} Returns `true` if any element passes the predicate check,
+     *  else `false`.
+     * @example
+     *
+     * _.some([null, 0, 'yes', false], Boolean);
+     * // => true
+     *
+     * var users = [
+     *   { 'user': 'barney', 'active': true },
+     *   { 'user': 'fred',   'active': false }
+     * ];
+     *
+     * // using the `_.matches` callback shorthand
+     * _.some(users, { 'user': 'barney', 'active': false });
+     * // => false
+     *
+     * // using the `_.matchesProperty` callback shorthand
+     * _.some(users, 'active', false);
+     * // => true
+     *
+     * // using the `_.property` callback shorthand
+     * _.some(users, 'active');
+     * // => true
+     */
+    function some(collection, predicate, thisArg) {
+      var func = isArray(collection) ? arraySome : baseSome;
+      if (thisArg && isIterateeCall(collection, predicate, thisArg)) {
+        predicate = undefined;
+      }
+      if (typeof predicate != 'function' || thisArg !== undefined) {
+        predicate = getCallback(predicate, thisArg, 3);
+      }
+      return func(collection, predicate);
+    }
+
+    /**
+     * Creates an array of elements, sorted in ascending order by the results of
+     * running each element in a collection through `iteratee`. This method performs
+     * a stable sort, that is, it preserves the original sort order of equal elements.
+     * The `iteratee` is bound to `thisArg` and invoked with three arguments:
+     * (value, index|key, collection).
+     *
+     * If a property name is provided for `iteratee` the created `_.property`
+     * style callback returns the property value of the given element.
+     *
+     * If a value is also provided for `thisArg` the created `_.matchesProperty`
+     * style callback returns `true` for elements that have a matching property
+     * value, else `false`.
+     *
+     * If an object is provided for `iteratee` the created `_.matches` style
+     * callback returns `true` for elements that have the properties of the given
+     * object, else `false`.
+     *
+     * @static
+     * @memberOf _
+     * @category Collection
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {Function|Object|string} [iteratee=_.identity] The function invoked
+     *  per iteration.
+     * @param {*} [thisArg] The `this` binding of `iteratee`.
+     * @returns {Array} Returns the new sorted array.
+     * @example
+     *
+     * _.sortBy([1, 2, 3], function(n) {
+     *   return Math.sin(n);
+     * });
+     * // => [3, 1, 2]
+     *
+     * _.sortBy([1, 2, 3], function(n) {
+     *   return this.sin(n);
+     * }, Math);
+     * // => [3, 1, 2]
+     *
+     * var users = [
+     *   { 'user': 'fred' },
+     *   { 'user': 'pebbles' },
+     *   { 'user': 'barney' }
+     * ];
+     *
+     * // using the `_.property` callback shorthand
+     * _.pluck(_.sortBy(users, 'user'), 'user');
+     * // => ['barney', 'fred', 'pebbles']
+     */
+    function sortBy(collection, iteratee, thisArg) {
+      if (collection == null) {
+        return [];
+      }
+      if (thisArg && isIterateeCall(collection, iteratee, thisArg)) {
+        iteratee = undefined;
+      }
+      var index = -1;
+      iteratee = getCallback(iteratee, thisArg, 3);
+
+      var result = baseMap(collection, function(value, key, collection) {
+        return { 'criteria': iteratee(value, key, collection), 'index': ++index, 'value': value };
+      });
+      return baseSortBy(result, compareAscending);
+    }
+
+    /**
+     * This method is like `_.sortBy` except that it can sort by multiple iteratees
+     * or property names.
+     *
+     * If a property name is provided for an iteratee the created `_.property`
+     * style callback returns the property value of the given element.
+     *
+     * If an object is provided for an iteratee the created `_.matches` style
+     * callback returns `true` for elements that have the properties of the given
+     * object, else `false`.
+     *
+     * @static
+     * @memberOf _
+     * @category Collection
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {...(Function|Function[]|Object|Object[]|string|string[])} iteratees
+     *  The iteratees to sort by, specified as individual values or arrays of values.
+     * @returns {Array} Returns the new sorted array.
+     * @example
+     *
+     * var users = [
+     *   { 'user': 'fred',   'age': 48 },
+     *   { 'user': 'barney', 'age': 36 },
+     *   { 'user': 'fred',   'age': 42 },
+     *   { 'user': 'barney', 'age': 34 }
+     * ];
+     *
+     * _.map(_.sortByAll(users, ['user', 'age']), _.values);
+     * // => [['barney', 34], ['barney', 36], ['fred', 42], ['fred', 48]]
+     *
+     * _.map(_.sortByAll(users, 'user', function(chr) {
+     *   return Math.floor(chr.age / 10);
+     * }), _.values);
+     * // => [['barney', 36], ['barney', 34], ['fred', 48], ['fred', 42]]
+     */
+    var sortByAll = restParam(function(collection, iteratees) {
+      if (collection == null) {
+        return [];
+      }
+      var guard = iteratees[2];
+      if (guard && isIterateeCall(iteratees[0], iteratees[1], guard)) {
+        iteratees.length = 1;
+      }
+      return baseSortByOrder(collection, baseFlatten(iteratees), []);
+    });
+
+    /**
+     * This method is like `_.sortByAll` except that it allows specifying the
+     * sort orders of the iteratees to sort by. If `orders` is unspecified, all
+     * values are sorted in ascending order. Otherwise, a value is sorted in
+     * ascending order if its corresponding order is "asc", and descending if "desc".
+     *
+     * If a property name is provided for an iteratee the created `_.property`
+     * style callback returns the property value of the given element.
+     *
+     * If an object is provided for an iteratee the created `_.matches` style
+     * callback returns `true` for elements that have the properties of the given
+     * object, else `false`.
+     *
+     * @static
+     * @memberOf _
+     * @category Collection
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {Function[]|Object[]|string[]} iteratees The iteratees to sort by.
+     * @param {boolean[]} [orders] The sort orders of `iteratees`.
+     * @param- {Object} [guard] Enables use as a callback for functions like `_.reduce`.
+     * @returns {Array} Returns the new sorted array.
+     * @example
+     *
+     * var users = [
+     *   { 'user': 'fred',   'age': 48 },
+     *   { 'user': 'barney', 'age': 34 },
+     *   { 'user': 'fred',   'age': 42 },
+     *   { 'user': 'barney', 'age': 36 }
+     * ];
+     *
+     * // sort by `user` in ascending order and by `age` in descending order
+     * _.map(_.sortByOrder(users, ['user', 'age'], ['asc', 'desc']), _.values);
+     * // => [['barney', 36], ['barney', 34], ['fred', 48], ['fred', 42]]
+     */
+    function sortByOrder(collection, iteratees, orders, guard) {
+      if (collection == null) {
+        return [];
+      }
+      if (guard && isIterateeCall(iteratees, orders, guard)) {
+        orders = undefined;
+      }
+      if (!isArray(iteratees)) {
+        iteratees = iteratees == null ? [] : [iteratees];
+      }
+      if (!isArray(orders)) {
+        orders = orders == null ? [] : [orders];
+      }
+      return baseSortByOrder(collection, iteratees, orders);
+    }
+
+    /**
+     * Performs a deep comparison between each element in `collection` and the
+     * source object, returning an array of all elements that have equivalent
+     * property values.
+     *
+     * **Note:** This method supports comparing arrays, booleans, `Date` objects,
+     * numbers, `Object` objects, regexes, and strings. Objects are compared by
+     * their own, not inherited, enumerable properties. For comparing a single
+     * own or inherited property value see `_.matchesProperty`.
+     *
+     * @static
+     * @memberOf _
+     * @category Collection
+     * @param {Array|Object|string} collection The collection to search.
+     * @param {Object} source The object of property values to match.
+     * @returns {Array} Returns the new filtered array.
+     * @example
+     *
+     * var users = [
+     *   { 'user': 'barney', 'age': 36, 'active': false, 'pets': ['hoppy'] },
+     *   { 'user': 'fred',   'age': 40, 'active': true, 'pets': ['baby puss', 'dino'] }
+     * ];
+     *
+     * _.pluck(_.where(users, { 'age': 36, 'active': false }), 'user');
+     * // => ['barney']
+     *
+     * _.pluck(_.where(users, { 'pets': ['dino'] }), 'user');
+     * // => ['fred']
+     */
+    function where(collection, source) {
+      return filter(collection, baseMatches(source));
+    }
+
+    /*------------------------------------------------------------------------*/
+
+    /**
+     * Gets the number of milliseconds that have elapsed since the Unix epoch
+     * (1 January 1970 00:00:00 UTC).
+     *
+     * @static
+     * @memberOf _
+     * @category Date
+     * @example
+     *
+     * _.defer(function(stamp) {
+     *   console.log(_.now() - stamp);
+     * }, _.now());
+     * // => logs the number of milliseconds it took for the deferred function to be invoked
+     */
+    var now = nativeNow || function() {
+      return new Date().getTime();
+    };
+
+    /*------------------------------------------------------------------------*/
+
+    /**
+     * The opposite of `_.before`; this method creates a function that invokes
+     * `func` once it's called `n` or more times.
+     *
+     * @static
+     * @memberOf _
+     * @category Function
+     * @param {number} n The number of calls before `func` is invoked.
+     * @param {Function} func The function to restrict.
+     * @returns {Function} Returns the new restricted function.
+     * @example
+     *
+     * var saves = ['profile', 'settings'];
+     *
+     * var done = _.after(saves.length, function() {
+     *   console.log('done saving!');
+     * });
+     *
+     * _.forEach(saves, function(type) {
+     *   asyncSave({ 'type': type, 'complete': done });
+     * });
+     * // => logs 'done saving!' after the two async saves have completed
+     */
+    function after(n, func) {
+      if (typeof func != 'function') {
+        if (typeof n == 'function') {
+          var temp = n;
+          n = func;
+          func = temp;
+        } else {
+          throw new TypeError(FUNC_ERROR_TEXT);
+        }
+      }
+      n = nativeIsFinite(n = +n) ? n : 0;
+      return function() {
+        if (--n < 1) {
+          return func.apply(this, arguments);
+        }
+      };
+    }
+
+    /**
+     * Creates a function that accepts up to `n` arguments ignoring any
+     * additional arguments.
+     *
+     * @static
+     * @memberOf _
+     * @category Function
+     * @param {Function} func The function to cap arguments for.
+     * @param {number} [n=func.length] The arity cap.
+     * @param- {Object} [guard] Enables use as a callback for functions like `_.map`.
+     * @returns {Function} Returns the new function.
+     * @example
+     *
+     * _.map(['6', '8', '10'], _.ary(parseInt, 1));
+     * // => [6, 8, 10]
+     */
+    function ary(func, n, guard) {
+      if (guard && isIterateeCall(func, n, guard)) {
+        n = undefined;
+      }
+      n = (func && n == null) ? func.length : nativeMax(+n || 0, 0);
+      return createWrapper(func, ARY_FLAG, undefined, undefined, undefined, undefined, n);
+    }
+
+    /**
+     * Creates a function that invokes `func`, with the `this` binding and arguments
+     * of the created function, while it's called less than `n` times. Subsequent
+     * calls to the created function return the result of the last `func` invocation.
+     *
+     * @static
+     * @memberOf _
+     * @category Function
+     * @param {number} n The number of calls at which `func` is no longer invoked.
+     * @param {Function} func The function to restrict.
+     * @returns {Function} Returns the new restricted function.
+     * @example
+     *
+     * jQuery('#add').on('click', _.before(5, addContactToList));
+     * // => allows adding up to 4 contacts to the list
+     */
+    function before(n, func) {
+      var result;
+      if (typeof func != 'function') {
+        if (typeof n == 'function') {
+          var temp = n;
+          n = func;
+          func = temp;
+        } else {
+          throw new TypeError(FUNC_ERROR_TEXT);
+        }
+      }
+      return function() {
+        if (--n > 0) {
+          result = func.apply(this, arguments);
+        }
+        if (n <= 1) {
+          func = undefined;
+        }
+        return result;
+      };
+    }
+
+    /**
+     * Creates a function that invokes `func` with the `this` binding of `thisArg`
+     * and prepends any additional `_.bind` arguments to those provided to the
+     * bound function.
+     *
+     * The `_.bind.placeholder` value, which defaults to `_` in monolithic builds,
+     * may be used as a placeholder for partially applied arguments.
+     *
+     * **Note:** Unlike native `Function#bind` this method does not set the "length"
+     * property of bound functions.
+     *
+     * @static
+     * @memberOf _
+     * @category Function
+     * @param {Function} func The function to bind.
+     * @param {*} thisArg The `this` binding of `func`.
+     * @param {...*} [partials] The arguments to be partially applied.
+     * @returns {Function} Returns the new bound function.
+     * @example
+     *
+     * var greet = function(greeting, punctuation) {
+     *   return greeting + ' ' + this.user + punctuation;
+     * };
+     *
+     * var object = { 'user': 'fred' };
+     *
+     * var bound = _.bind(greet, object, 'hi');
+     * bound('!');
+     * // => 'hi fred!'
+     *
+     * // using placeholders
+     * var bound = _.bind(greet, object, _, '!');
+     * bound('hi');
+     * // => 'hi fred!'
+     */
+    var bind = restParam(function(func, thisArg, partials) {
+      var bitmask = BIND_FLAG;
+      if (partials.length) {
+        var holders = replaceHolders(partials, bind.placeholder);
+        bitmask |= PARTIAL_FLAG;
+      }
+      return createWrapper(func, bitmask, thisArg, partials, holders);
+    });
+
+    /**
+     * Binds methods of an object to the object itself, overwriting the existing
+     * method. Method names may be specified as individual arguments or as arrays
+     * of method names. If no method names are provided all enumerable function
+     * properties, own and inherited, of `object` are bound.
+     *
+     * **Note:** This method does not set the "length" property of bound functions.
+     *
+     * @static
+     * @memberOf _
+     * @category Function
+     * @param {Object} object The object to bind and assign the bound methods to.
+     * @param {...(string|string[])} [methodNames] The object method names to bind,
+     *  specified as individual method names or arrays of method names.
+     * @returns {Object} Returns `object`.
+     * @example
+     *
+     * var view = {
+     *   'label': 'docs',
+     *   'onClick': function() {
+     *     console.log('clicked ' + this.label);
+     *   }
+     * };
+     *
+     * _.bindAll(view);
+     * jQuery('#docs').on('click', view.onClick);
+     * // => logs 'clicked docs' when the element is clicked
+     */
+    var bindAll = restParam(function(object, methodNames) {
+      methodNames = methodNames.length ? baseFlatten(methodNames) : functions(object);
+
+      var index = -1,
+          length = methodNames.length;
+
+      while (++index < length) {
+        var key = methodNames[index];
+        object[key] = createWrapper(object[key], BIND_FLAG, object);
+      }
+      return object;
+    });
+
+    /**
+     * Creates a function that invokes the method at `object[key]` and prepends
+     * any additional `_.bindKey` arguments to those provided to the bound function.
+     *
+     * This method differs from `_.bind` by allowing bound functions to reference
+     * methods that may be redefined or don't yet exist.
+     * See [Peter Michaux's article](http://peter.michaux.ca/articles/lazy-function-definition-pattern)
+     * for more details.
+     *
+     * The `_.bindKey.placeholder` value, which defaults to `_` in monolithic
+     * builds, may be used as a placeholder for partially applied arguments.
+     *
+     * @static
+     * @memberOf _
+     * @category Function
+     * @param {Object} object The object the method belongs to.
+     * @param {string} key The key of the method.
+     * @param {...*} [partials] The arguments to be partially applied.
+     * @returns {Function} Returns the new bound function.
+     * @example
+     *
+     * var object = {
+     *   'user': 'fred',
+     *   'greet': function(greeting, punctuation) {
+     *     return greeting + ' ' + this.user + punctuation;
+     *   }
+     * };
+     *
+     * var bound = _.bindKey(object, 'greet', 'hi');
+     * bound('!');
+     * // => 'hi fred!'
+     *
+     * object.greet = function(greeting, punctuation) {
+     *   return greeting + 'ya ' + this.user + punctuation;
+     * };
+     *
+     * bound('!');
+     * // => 'hiya fred!'
+     *
+     * // using placeholders
+     * var bound = _.bindKey(object, 'greet', _, '!');
+     * bound('hi');
+     * // => 'hiya fred!'
+     */
+    var bindKey = restParam(function(object, key, partials) {
+      var bitmask = BIND_FLAG | BIND_KEY_FLAG;
+      if (partials.length) {
+        var holders = replaceHolders(partials, bindKey.placeholder);
+        bitmask |= PARTIAL_FLAG;
+      }
+      return createWrapper(key, bitmask, object, partials, holders);
+    });
+
+    /**
+     * Creates a function that accepts one or more arguments of `func` that when
+     * called either invokes `func` returning its result, if all `func` arguments
+     * have been provided, or returns a function that accepts one or more of the
+     * remaining `func` arguments, and so on. The arity of `func` may be specified
+     * if `func.length` is not sufficient.
+     *
+     * The `_.curry.placeholder` value, which defaults to `_` in monolithic builds,
+     * may be used as a placeholder for provided arguments.
+     *
+     * **Note:** This method does not set the "length" property of curried functions.
+     *
+     * @static
+     * @memberOf _
+     * @category Function
+     * @param {Function} func The function to curry.
+     * @param {number} [arity=func.length] The arity of `func`.
+     * @param- {Object} [guard] Enables use as a callback for functions like `_.map`.
+     * @returns {Function} Returns the new curried function.
+     * @example
+     *
+     * var abc = function(a, b, c) {
+     *   return [a, b, c];
+     * };
+     *
+     * var curried = _.curry(abc);
+     *
+     * curried(1)(2)(3);
+     * // => [1, 2, 3]
+     *
+     * curried(1, 2)(3);
+     * // => [1, 2, 3]
+     *
+     * curried(1, 2, 3);
+     * // => [1, 2, 3]
+     *
+     * // using placeholders
+     * curried(1)(_, 3)(2);
+     * // => [1, 2, 3]
+     */
+    var curry = createCurry(CURRY_FLAG);
+
+    /**
+     * This method is like `_.curry` except that arguments are applied to `func`
+     * in the manner of `_.partialRight` instead of `_.partial`.
+     *
+     * The `_.curryRight.placeholder` value, which defaults to `_` in monolithic
+     * builds, may be used as a placeholder for provided arguments.
+     *
+     * **Note:** This method does not set the "length" property of curried functions.
+     *
+     * @static
+     * @memberOf _
+     * @category Function
+     * @param {Function} func The function to curry.
+     * @param {number} [arity=func.length] The arity of `func`.
+     * @param- {Object} [guard] Enables use as a callback for functions like `_.map`.
+     * @returns {Function} Returns the new curried function.
+     * @example
+     *
+     * var abc = function(a, b, c) {
+     *   return [a, b, c];
+     * };
+     *
+     * var curried = _.curryRight(abc);
+     *
+     * curried(3)(2)(1);
+     * // => [1, 2, 3]
+     *
+     * curried(2, 3)(1);
+     * // => [1, 2, 3]
+     *
+     * curried(1, 2, 3);
+     * // => [1, 2, 3]
+     *
+     * // using placeholders
+     * curried(3)(1, _)(2);
+     * // => [1, 2, 3]
+     */
+    var curryRight = createCurry(CURRY_RIGHT_FLAG);
+
+    /**
+     * Creates a debounced function that delays invoking `func` until after `wait`
+     * milliseconds have elapsed since the last time the debounced function was
+     * invoked. The debounced function comes with a `cancel` method to cancel
+     * delayed invocations. Provide an options object to indicate that `func`
+     * should be invoked on the leading and/or trailing edge of the `wait` timeout.
+     * Subsequent calls to the debounced function return the result of the last
+     * `func` invocation.
+     *
+     * **Note:** If `leading` and `trailing` options are `true`, `func` is invoked
+     * on the trailing edge of the timeout only if the the debounced function is
+     * invoked more than once during the `wait` timeout.
+     *
+     * See [David Corbacho's article](http://drupalmotion.com/article/debounce-and-throttle-visual-explanation)
+     * for details over the differences between `_.debounce` and `_.throttle`.
+     *
+     * @static
+     * @memberOf _
+     * @category Function
+     * @param {Function} func The function to debounce.
+     * @param {number} [wait=0] The number of milliseconds to delay.
+     * @param {Object} [options] The options object.
+     * @param {boolean} [options.leading=false] Specify invoking on the leading
+     *  edge of the timeout.
+     * @param {number} [options.maxWait] The maximum time `func` is allowed to be
+     *  delayed before it's invoked.
+     * @param {boolean} [options.trailing=true] Specify invoking on the trailing
+     *  edge of the timeout.
+     * @returns {Function} Returns the new debounced function.
+     * @example
+     *
+     * // avoid costly calculations while the window size is in flux
+     * jQuery(window).on('resize', _.debounce(calculateLayout, 150));
+     *
+     * // invoke `sendMail` when the click event is fired, debouncing subsequent calls
+     * jQuery('#postbox').on('click', _.debounce(sendMail, 300, {
+     *   'leading': true,
+     *   'trailing': false
+     * }));
+     *
+     * // ensure `batchLog` is invoked once after 1 second of debounced calls
+     * var source = new EventSource('/stream');
+     * jQuery(source).on('message', _.debounce(batchLog, 250, {
+     *   'maxWait': 1000
+     * }));
+     *
+     * // cancel a debounced call
+     * var upcomingChanges = _.debounce(batchLog, 1000);
+     * Object.observe(models.todo, upcomingChanges);
+     *
+     * Object.observe(models, function(changes) {
+     *   if (_.find(changes, { 'user': 'todo', 'type': 'delete'})) {
+     *     upcomingChanges.cancel();
+     *   }
+     * }, ['delete']);
+     *
+     * // ...at some point `models.todo` is changed
+     * models.todo.completed = true;
+     *
+     * // ...before 1 second has passed `models.todo` is deleted
+     * // which cancels the debounced `upcomingChanges` call
+     * delete models.todo;
+     */
+    function debounce(func, wait, options) {
+      var args,
+          maxTimeoutId,
+          result,
+          stamp,
+          thisArg,
+          timeoutId,
+          trailingCall,
+          lastCalled = 0,
+          maxWait = false,
+          trailing = true;
+
+      if (typeof func != 'function') {
+        throw new TypeError(FUNC_ERROR_TEXT);
+      }
+      wait = wait < 0 ? 0 : (+wait || 0);
+      if (options === true) {
+        var leading = true;
+        trailing = false;
+      } else if (isObject(options)) {
+        leading = !!options.leading;
+        maxWait = 'maxWait' in options && nativeMax(+options.maxWait || 0, wait);
+        trailing = 'trailing' in options ? !!options.trailing : trailing;
+      }
+
+      function cancel() {
+        if (timeoutId) {
+          clearTimeout(timeoutId);
+        }
+        if (maxTimeoutId) {
+          clearTimeout(maxTimeoutId);
+        }
+        lastCalled = 0;
+        maxTimeoutId = timeoutId = trailingCall = undefined;
+      }
+
+      function complete(isCalled, id) {
+        if (id) {
+          clearTimeout(id);
+        }
+        maxTimeoutId = timeoutId = trailingCall = undefined;
+        if (isCalled) {
+          lastCalled = now();
+          result = func.apply(thisArg, args);
+          if (!timeoutId && !maxTimeoutId) {
+            args = thisArg = undefined;
+          }
+        }
+      }
+
+      function delayed() {
+        var remaining = wait - (now() - stamp);
+        if (remaining <= 0 || remaining > wait) {
+          complete(trailingCall, maxTimeoutId);
+        } else {
+          timeoutId = setTimeout(delayed, remaining);
+        }
+      }
+
+      function maxDelayed() {
+        complete(trailing, timeoutId);
+      }
+
+      function debounced() {
+        args = arguments;
+        stamp = now();
+        thisArg = this;
+        trailingCall = trailing && (timeoutId || !leading);
+
+        if (maxWait === false) {
+          var leadingCall = leading && !timeoutId;
+        } else {
+          if (!maxTimeoutId && !leading) {
+            lastCalled = stamp;
+          }
+          var remaining = maxWait - (stamp - lastCalled),
+              isCalled = remaining <= 0 || remaining > maxWait;
+
+          if (isCalled) {
+            if (maxTimeoutId) {
+              maxTimeoutId = clearTimeout(maxTimeoutId);
+            }
+            lastCalled = stamp;
+            result = func.apply(thisArg, args);
+          }
+          else if (!maxTimeoutId) {
+            maxTimeoutId = setTimeout(maxDelayed, remaining);
+          }
+        }
+        if (isCalled && timeoutId) {
+          timeoutId = clearTimeout(timeoutId);
+        }
+        else if (!timeoutId && wait !== maxWait) {
+          timeoutId = setTimeout(delayed, wait);
+        }
+        if (leadingCall) {
+          isCalled = true;
+          result = func.apply(thisArg, args);
+        }
+        if (isCalled && !timeoutId && !maxTimeoutId) {
+          args = thisArg = undefined;
+        }
+        return result;
+      }
+      debounced.cancel = cancel;
+      return debounced;
+    }
+
+    /**
+     * Defers invoking the `func` until the current call stack has cleared. Any
+     * additional arguments are provided to `func` when it's invoked.
+     *
+     * @static
+     * @memberOf _
+     * @category Function
+     * @param {Function} func The function to defer.
+     * @param {...*} [args] The arguments to invoke the function with.
+     * @returns {number} Returns the timer id.
+     * @example
+     *
+     * _.defer(function(text) {
+     *   console.log(text);
+     * }, 'deferred');
+     * // logs 'deferred' after one or more milliseconds
+     */
+    var defer = restParam(function(func, args) {
+      return baseDelay(func, 1, args);
+    });
+
+    /**
+     * Invokes `func` after `wait` milliseconds. Any additional arguments are
+     * provided to `func` when it's invoked.
+     *
+     * @static
+     * @memberOf _
+     * @category Function
+     * @param {Function} func The function to delay.
+     * @param {number} wait The number of milliseconds to delay invocation.
+     * @param {...*} [args] The arguments to invoke the function with.
+     * @returns {number} Returns the timer id.
+     * @example
+     *
+     * _.delay(function(text) {
+     *   console.log(text);
+     * }, 1000, 'later');
+     * // => logs 'later' after one second
+     */
+    var delay = restParam(function(func, wait, args) {
+      return baseDelay(func, wait, args);
+    });
+
+    /**
+     * Creates a function that returns the result of invoking the provided
+     * functions with the `this` binding of the created function, where each
+     * successive invocation is supplied the return value of the previous.
+     *
+     * @static
+     * @memberOf _
+     * @category Function
+     * @param {...Function} [funcs] Functions to invoke.
+     * @returns {Function} Returns the new function.
+     * @example
+     *
+     * function square(n) {
+     *   return n * n;
+     * }
+     *
+     * var addSquare = _.flow(_.add, square);
+     * addSquare(1, 2);
+     * // => 9
+     */
+    var flow = createFlow();
+
+    /**
+     * This method is like `_.flow` except that it creates a function that
+     * invokes the provided functions from right to left.
+     *
+     * @static
+     * @memberOf _
+     * @alias backflow, compose
+     * @category Function
+     * @param {...Function} [funcs] Functions to invoke.
+     * @returns {Function} Returns the new function.
+     * @example
+     *
+     * function square(n) {
+     *   return n * n;
+     * }
+     *
+     * var addSquare = _.flowRight(square, _.add);
+     * addSquare(1, 2);
+     * // => 9
+     */
+    var flowRight = createFlow(true);
+
+    /**
+     * Creates a function that memoizes the result of `func`. If `resolver` is
+     * provided it determines the cache key for storing the result based on the
+     * arguments provided to the memoized function. By default, the first argument
+     * provided to the memoized function is coerced to a string and used as the
+     * cache key. The `func` is invoked with the `this` binding of the memoized
+     * function.
+     *
+     * **Note:** The cache is exposed as the `cache` property on the memoized
+     * function. Its creation may be customized by replacing the `_.memoize.Cache`
+     * constructor with one whose instances implement the [`Map`](http://ecma-international.org/ecma-262/6.0/#sec-properties-of-the-map-prototype-object)
+     * method interface of `get`, `has`, and `set`.
+     *
+     * @static
+     * @memberOf _
+     * @category Function
+     * @param {Function} func The function to have its output memoized.
+     * @param {Function} [resolver] The function to resolve the cache key.
+     * @returns {Function} Returns the new memoizing function.
+     * @example
+     *
+     * var upperCase = _.memoize(function(string) {
+     *   return string.toUpperCase();
+     * });
+     *
+     * upperCase('fred');
+     * // => 'FRED'
+     *
+     * // modifying the result cache
+     * upperCase.cache.set('fred', 'BARNEY');
+     * upperCase('fred');
+     * // => 'BARNEY'
+     *
+     * // replacing `_.memoize.Cache`
+     * var object = { 'user': 'fred' };
+     * var other = { 'user': 'barney' };
+     * var identity = _.memoize(_.identity);
+     *
+     * identity(object);
+     * // => { 'user': 'fred' }
+     * identity(other);
+     * // => { 'user': 'fred' }
+     *
+     * _.memoize.Cache = WeakMap;
+     * var identity = _.memoize(_.identity);
+     *
+     * identity(object);
+     * // => { 'user': 'fred' }
+     * identity(other);
+     * // => { 'user': 'barney' }
+     */
+    function memoize(func, resolver) {
+      if (typeof func != 'function' || (resolver && typeof resolver != 'function')) {
+        throw new TypeError(FUNC_ERROR_TEXT);
+      }
+      var memoized = function() {
+        var args = arguments,
+            key = resolver ? resolver.apply(this, args) : args[0],
+            cache = memoized.cache;
+
+        if (cache.has(key)) {
+          return cache.get(key);
+        }
+        var result = func.apply(this, args);
+        memoized.cache = cache.set(key, result);
+        return result;
+      };
+      memoized.cache = new memoize.Cache;
+      return memoized;
+    }
+
+    /**
+     * Creates a function that runs each argument through a corresponding
+     * transform function.
+     *
+     * @static
+     * @memberOf _
+     * @category Function
+     * @param {Function} func The function to wrap.
+     * @param {...(Function|Function[])} [transforms] The functions to transform
+     * arguments, specified as individual functions or arrays of functions.
+     * @returns {Function} Returns the new function.
+     * @example
+     *
+     * function doubled(n) {
+     *   return n * 2;
+     * }
+     *
+     * function square(n) {
+     *   return n * n;
+     * }
+     *
+     * var modded = _.modArgs(function(x, y) {
+     *   return [x, y];
+     * }, square, doubled);
+     *
+     * modded(1, 2);
+     * // => [1, 4]
+     *
+     * modded(5, 10);
+     * // => [25, 20]
+     */
+    var modArgs = restParam(function(func, transforms) {
+      transforms = baseFlatten(transforms);
+      if (typeof func != 'function' || !arrayEvery(transforms, baseIsFunction)) {
+        throw new TypeError(FUNC_ERROR_TEXT);
+      }
+      var length = transforms.length;
+      return restParam(function(args) {
+        var index = nativeMin(args.length, length);
+        while (index--) {
+          args[index] = transforms[index](args[index]);
+        }
+        return func.apply(this, args);
+      });
+    });
+
+    /**
+     * Creates a function that negates the result of the predicate `func`. The
+     * `func` predicate is invoked with the `this` binding and arguments of the
+     * created function.
+     *
+     * @static
+     * @memberOf _
+     * @category Function
+     * @param {Function} predicate The predicate to negate.
+     * @returns {Function} Returns the new function.
+     * @example
+     *
+     * function isEven(n) {
+     *   return n % 2 == 0;
+     * }
+     *
+     * _.filter([1, 2, 3, 4, 5, 6], _.negate(isEven));
+     * // => [1, 3, 5]
+     */
+    function negate(predicate) {
+      if (typeof predicate != 'function') {
+        throw new TypeError(FUNC_ERROR_TEXT);
+      }
+      return function() {
+        return !predicate.apply(this, arguments);
+      };
+    }
+
+    /**
+     * Creates a function that is restricted to invoking `func` once. Repeat calls
+     * to the function return the value of the first call. The `func` is invoked
+     * with the `this` binding and arguments of the created function.
+     *
+     * @static
+     * @memberOf _
+     * @category Function
+     * @param {Function} func The function to restrict.
+     * @returns {Function} Returns the new restricted function.
+     * @example
+     *
+     * var initialize = _.once(createApplication);
+     * initialize();
+     * initialize();
+     * // `initialize` invokes `createApplication` once
+     */
+    function once(func) {
+      return before(2, func);
+    }
+
+    /**
+     * Creates a function that invokes `func` with `partial` arguments prepended
+     * to those provided to the new function. This method is like `_.bind` except
+     * it does **not** alter the `this` binding.
+     *
+     * The `_.partial.placeholder` value, which defaults to `_` in monolithic
+     * builds, may be used as a placeholder for partially applied arguments.
+     *
+     * **Note:** This method does not set the "length" property of partially
+     * applied functions.
+     *
+     * @static
+     * @memberOf _
+     * @category Function
+     * @param {Function} func The function to partially apply arguments to.
+     * @param {...*} [partials] The arguments to be partially applied.
+     * @returns {Function} Returns the new partially applied function.
+     * @example
+     *
+     * var greet = function(greeting, name) {
+     *   return greeting + ' ' + name;
+     * };
+     *
+     * var sayHelloTo = _.partial(greet, 'hello');
+     * sayHelloTo('fred');
+     * // => 'hello fred'
+     *
+     * // using placeholders
+     * var greetFred = _.partial(greet, _, 'fred');
+     * greetFred('hi');
+     * // => 'hi fred'
+     */
+    var partial = createPartial(PARTIAL_FLAG);
+
+    /**
+     * This method is like `_.partial` except that partially applied arguments
+     * are appended to those provided to the new function.
+     *
+     * The `_.partialRight.placeholder` value, which defaults to `_` in monolithic
+     * builds, may be used as a placeholder for partially applied arguments.
+     *
+     * **Note:** This method does not set the "length" property of partially
+     * applied functions.
+     *
+     * @static
+     * @memberOf _
+     * @category Function
+     * @param {Function} func The function to partially apply arguments to.
+     * @param {...*} [partials] The arguments to be partially applied.
+     * @returns {Function} Returns the new partially applied function.
+     * @example
+     *
+     * var greet = function(greeting, name) {
+     *   return greeting + ' ' + name;
+     * };
+     *
+     * var greetFred = _.partialRight(greet, 'fred');
+     * greetFred('hi');
+     * // => 'hi fred'
+     *
+     * // using placeholders
+     * var sayHelloTo = _.partialRight(greet, 'hello', _);
+     * sayHelloTo('fred');
+     * // => 'hello fred'
+     */
+    var partialRight = createPartial(PARTIAL_RIGHT_FLAG);
+
+    /**
+     * Creates a function that invokes `func` with arguments arranged according
+     * to the specified indexes where the argument value at the first index is
+     * provided as the first argument, the argument value at the second index is
+     * provided as the second argument, and so on.
+     *
+     * @static
+     * @memberOf _
+     * @category Function
+     * @param {Function} func The function to rearrange arguments for.
+     * @param {...(number|number[])} indexes The arranged argument indexes,
+     *  specified as individual indexes or arrays of indexes.
+     * @returns {Function} Returns the new function.
+     * @example
+     *
+     * var rearged = _.rearg(function(a, b, c) {
+     *   return [a, b, c];
+     * }, 2, 0, 1);
+     *
+     * rearged('b', 'c', 'a')
+     * // => ['a', 'b', 'c']
+     *
+     * var map = _.rearg(_.map, [1, 0]);
+     * map(function(n) {
+     *   return n * 3;
+     * }, [1, 2, 3]);
+     * // => [3, 6, 9]
+     */
+    var rearg = restParam(function(func, indexes) {
+      return createWrapper(func, REARG_FLAG, undefined, undefined, undefined, baseFlatten(indexes));
+    });
+
+    /**
+     * Creates a function that invokes `func` with the `this` binding of the
+     * created function and arguments from `start` and beyond provided as an array.
+     *
+     * **Note:** This method is based on the [rest parameter](https://developer.mozilla.org/Web/JavaScript/Reference/Functions/rest_parameters).
+     *
+     * @static
+     * @memberOf _
+     * @category Function
+     * @param {Function} func The function to apply a rest parameter to.
+     * @param {number} [start=func.length-1] The start position of the rest parameter.
+     * @returns {Function} Returns the new function.
+     * @example
+     *
+     * var say = _.restParam(function(what, names) {
+     *   return what + ' ' + _.initial(names).join(', ') +
+     *     (_.size(names) > 1 ? ', & ' : '') + _.last(names);
+     * });
+     *
+     * say('hello', 'fred', 'barney', 'pebbles');
+     * // => 'hello fred, barney, & pebbles'
+     */
+    function restParam(func, start) {
+      if (typeof func != 'function') {
+        throw new TypeError(FUNC_ERROR_TEXT);
+      }
+      start = nativeMax(start === undefined ? (func.length - 1) : (+start || 0), 0);
+      return function() {
+        var args = arguments,
+            index = -1,
+            length = nativeMax(args.length - start, 0),
+            rest = Array(length);
+
+        while (++index < length) {
+          rest[index] = args[start + index];
+        }
+        switch (start) {
+          case 0: return func.call(this, rest);
+          case 1: return func.call(this, args[0], rest);
+          case 2: return func.call(this, args[0], args[1], rest);
+        }
+        var otherArgs = Array(start + 1);
+        index = -1;
+        while (++index < start) {
+          otherArgs[index] = args[index];
+        }
+        otherArgs[start] = rest;
+        return func.apply(this, otherArgs);
+      };
+    }
+
+    /**
+     * Creates a function that invokes `func` with the `this` binding of the created
+     * function and an array of arguments much like [`Function#apply`](https://es5.github.io/#x15.3.4.3).
+     *
+     * **Note:** This method is based on the [spread operator](https://developer.mozilla.org/Web/JavaScript/Reference/Operators/Spread_operator).
+     *
+     * @static
+     * @memberOf _
+     * @category Function
+     * @param {Function} func The function to spread arguments over.
+     * @returns {Function} Returns the new function.
+     * @example
+     *
+     * var say = _.spread(function(who, what) {
+     *   return who + ' says ' + what;
+     * });
+     *
+     * say(['fred', 'hello']);
+     * // => 'fred says hello'
+     *
+     * // with a Promise
+     * var numbers = Promise.all([
+     *   Promise.resolve(40),
+     *   Promise.resolve(36)
+     * ]);
+     *
+     * numbers.then(_.spread(function(x, y) {
+     *   return x + y;
+     * }));
+     * // => a Promise of 76
+     */
+    function spread(func) {
+      if (typeof func != 'function') {
+        throw new TypeError(FUNC_ERROR_TEXT);
+      }
+      return function(array) {
+        return func.apply(this, array);
+      };
+    }
+
+    /**
+     * Creates a throttled function that only invokes `func` at most once per
+     * every `wait` milliseconds. The throttled function comes with a `cancel`
+     * method to cancel delayed invocations. Provide an options object to indicate
+     * that `func` should be invoked on the leading and/or trailing edge of the
+     * `wait` timeout. Subsequent calls to the throttled function return the
+     * result of the last `func` call.
+     *
+     * **Note:** If `leading` and `trailing` options are `true`, `func` is invoked
+     * on the trailing edge of the timeout only if the the throttled function is
+     * invoked more than once during the `wait` timeout.
+     *
+     * See [David Corbacho's article](http://drupalmotion.com/article/debounce-and-throttle-visual-explanation)
+     * for details over the differences between `_.throttle` and `_.debounce`.
+     *
+     * @static
+     * @memberOf _
+     * @category Function
+     * @param {Function} func The function to throttle.
+     * @param {number} [wait=0] The number of milliseconds to throttle invocations to.
+     * @param {Object} [options] The options object.
+     * @param {boolean} [options.leading=true] Specify invoking on the leading
+     *  edge of the timeout.
+     * @param {boolean} [options.trailing=true] Specify invoking on the trailing
+     *  edge of the timeout.
+     * @returns {Function} Returns the new throttled function.
+     * @example
+     *
+     * // avoid excessively updating the position while scrolling
+     * jQuery(window).on('scroll', _.throttle(updatePosition, 100));
+     *
+     * // invoke `renewToken` when the click event is fired, but not more than once every 5 minutes
+     * jQuery('.interactive').on('click', _.throttle(renewToken, 300000, {
+     *   'trailing': false
+     * }));
+     *
+     * // cancel a trailing throttled call
+     * jQuery(window).on('popstate', throttled.cancel);
+     */
+    function throttle(func, wait, options) {
+      var leading = true,
+          trailing = true;
+
+      if (typeof func != 'function') {
+        throw new TypeError(FUNC_ERROR_TEXT);
+      }
+      if (options === false) {
+        leading = false;
+      } else if (isObject(options)) {
+        leading = 'leading' in options ? !!options.leading : leading;
+        trailing = 'trailing' in options ? !!options.trailing : trailing;
+      }
+      return debounce(func, wait, { 'leading': leading, 'maxWait': +wait, 'trailing': trailing });
+    }
+
+    /**
+     * Creates a function that provides `value` to the wrapper function as its
+     * first argument. Any additional arguments provided to the function are
+     * appended to those provided to the wrapper function. The wrapper is invoked
+     * with the `this` binding of the created function.
+     *
+     * @static
+     * @memberOf _
+     * @category Function
+     * @param {*} value The value to wrap.
+     * @param {Function} wrapper The wrapper function.
+     * @returns {Function} Returns the new function.
+     * @example
+     *
+     * var p = _.wrap(_.escape, function(func, text) {
+     *   return '<p>' + func(text) + '</p>';
+     * });
+     *
+     * p('fred, barney, & pebbles');
+     * // => '<p>fred, barney, &amp; pebbles</p>'
+     */
+    function wrap(value, wrapper) {
+      wrapper = wrapper == null ? identity : wrapper;
+      return createWrapper(wrapper, PARTIAL_FLAG, undefined, [value], []);
+    }
+
+    /*------------------------------------------------------------------------*/
+
+    /**
+     * Creates a clone of `value`. If `isDeep` is `true` nested objects are cloned,
+     * otherwise they are assigned by reference. If `customizer` is provided it's
+     * invoked to produce the cloned values. If `customizer` returns `undefined`
+     * cloning is handled by the method instead. The `customizer` is bound to
+     * `thisArg` and invoked with up to three argument; (value [, index|key, object]).
+     *
+     * **Note:** This method is loosely based on the
+     * [structured clone algorithm](http://www.w3.org/TR/html5/infrastructure.html#internal-structured-cloning-algorithm).
+     * The enumerable properties of `arguments` objects and objects created by
+     * constructors other than `Object` are cloned to plain `Object` objects. An
+     * empty object is returned for uncloneable values such as functions, DOM nodes,
+     * Maps, Sets, and WeakMaps.
+     *
+     * @static
+     * @memberOf _
+     * @category Lang
+     * @param {*} value The value to clone.
+     * @param {boolean} [isDeep] Specify a deep clone.
+     * @param {Function} [customizer] The function to customize cloning values.
+     * @param {*} [thisArg] The `this` binding of `customizer`.
+     * @returns {*} Returns the cloned value.
+     * @example
+     *
+     * var users = [
+     *   { 'user': 'barney' },
+     *   { 'user': 'fred' }
+     * ];
+     *
+     * var shallow = _.clone(users);
+     * shallow[0] === users[0];
+     * // => true
+     *
+     * var deep = _.clone(users, true);
+     * deep[0] === users[0];
+     * // => false
+     *
+     * // using a customizer callback
+     * var el = _.clone(document.body, function(value) {
+     *   if (_.isElement(value)) {
+     *     return value.cloneNode(false);
+     *   }
+     * });
+     *
+     * el === document.body
+     * // => false
+     * el.nodeName
+     * // => BODY
+     * el.childNodes.length;
+     * // => 0
+     */
+    function clone(value, isDeep, customizer, thisArg) {
+      if (isDeep && typeof isDeep != 'boolean' && isIterateeCall(value, isDeep, customizer)) {
+        isDeep = false;
+      }
+      else if (typeof isDeep == 'function') {
+        thisArg = customizer;
+        customizer = isDeep;
+        isDeep = false;
+      }
+      return typeof customizer == 'function'
+        ? baseClone(value, isDeep, bindCallback(customizer, thisArg, 3))
+        : baseClone(value, isDeep);
+    }
+
+    /**
+     * Creates a deep clone of `value`. If `customizer` is provided it's invoked
+     * to produce the cloned values. If `customizer` returns `undefined` cloning
+     * is handled by the method instead. The `customizer` is bound to `thisArg`
+     * and invoked with up to three argument; (value [, index|key, object]).
+     *
+     * **Note:** This method is loosely based on the
+     * [structured clone algorithm](http://www.w3.org/TR/html5/infrastructure.html#internal-structured-cloning-algorithm).
+     * The enumerable properties of `arguments` objects and objects created by
+     * constructors other than `Object` are cloned to plain `Object` objects. An
+     * empty object is returned for uncloneable values such as functions, DOM nodes,
+     * Maps, Sets, and WeakMaps.
+     *
+     * @static
+     * @memberOf _
+     * @category Lang
+     * @param {*} value The value to deep clone.
+     * @param {Function} [customizer] The function to customize cloning values.
+     * @param {*} [thisArg] The `this` binding of `customizer`.
+     * @returns {*} Returns the deep cloned value.
+     * @example
+     *
+     * var users = [
+     *   { 'user': 'barney' },
+     *   { 'user': 'fred' }
+     * ];
+     *
+     * var deep = _.cloneDeep(users);
+     * deep[0] === users[0];
+     * // => false
+     *
+     * // using a customizer callback
+     * var el = _.cloneDeep(document.body, function(value) {
+     *   if (_.isElement(value)) {
+     *     return value.cloneNode(true);
+     *   }
+     * });
+     *
+     * el === document.body
+     * // => false
+     * el.nodeName
+     * // => BODY
+     * el.childNodes.length;
+     * // => 20
+     */
+    function cloneDeep(value, customizer, thisArg) {
+      return typeof customizer == 'function'
+        ? baseClone(value, true, bindCallback(customizer, thisArg, 3))
+        : baseClone(value, true);
+    }
+
+    /**
+     * Checks if `value` is greater than `other`.
+     *
+     * @static
+     * @memberOf _
+     * @category Lang
+     * @param {*} value The value to compare.
+     * @param {*} other The other value to compare.
+     * @returns {boolean} Returns `true` if `value` is greater than `other`, else `false`.
+     * @example
+     *
+     * _.gt(3, 1);
+     * // => true
+     *
+     * _.gt(3, 3);
+     * // => false
+     *
+     * _.gt(1, 3);
+     * // => false
+     */
+    function gt(value, other) {
+      return value > other;
+    }
+
+    /**
+     * Checks if `value` is greater than or equal to `other`.
+     *
+     * @static
+     * @memberOf _
+     * @category Lang
+     * @param {*} value The value to compare.
+     * @param {*} other The other value to compare.
+     * @returns {boolean} Returns `true` if `value` is greater than or equal to `other`, else `false`.
+     * @example
+     *
+     * _.gte(3, 1);
+     * // => true
+     *
+     * _.gte(3, 3);
+     * // => true
+     *
+     * _.gte(1, 3);
+     * // => false
+     */
+    function gte(value, other) {
+      return value >= other;
+    }
+
+    /**
+     * Checks if `value` is classified as an `arguments` object.
+     *
+     * @static
+     * @memberOf _
+     * @category Lang
+     * @param {*} value The value to check.
+     * @returns {boolean} Returns `true` if `value` is correctly classified, else `false`.
+     * @example
+     *
+     * _.isArguments(function() { return arguments; }());
+     * // => true
+     *
+     * _.isArguments([1, 2, 3]);
+     * // => false
+     */
+    function isArguments(value) {
+      return isObjectLike(value) && isArrayLike(value) &&
+        hasOwnProperty.call(value, 'callee') && !propertyIsEnumerable.call(value, 'callee');
+    }
+
+    /**
+     * Checks if `value` is classified as an `Array` object.
+     *
+     * @static
+     * @memberOf _
+     * @category Lang
+     * @param {*} value The value to check.
+     * @returns {boolean} Returns `true` if `value` is correctly classified, else `false`.
+     * @example
+     *
+     * _.isArray([1, 2, 3]);
+     * // => true
+     *
+     * _.isArray(function() { return arguments; }());
+     * // => false
+     */
+    var isArray = nativeIsArray || function(value) {
+      return isObjectLike(value) && isLength(value.length) && objToString.call(value) == arrayTag;
+    };
+
+    /**
+     * Checks if `value` is classified as a boolean primitive or object.
+     *
+     * @static
+     * @memberOf _
+     * @category Lang
+     * @param {*} value The value to check.
+     * @returns {boolean} Returns `true` if `value` is correctly classified, else `false`.
+     * @example
+     *
+     * _.isBoolean(false);
+     * // => true
+     *
+     * _.isBoolean(null);
+     * // => false
+     */
+    function isBoolean(value) {
+      return value === true || value === false || (isObjectLike(value) && objToString.call(value) == boolTag);
+    }
+
+    /**
+     * Checks if `value` is classified as a `Date` object.
+     *
+     * @static
+     * @memberOf _
+     * @category Lang
+     * @param {*} value The value to check.
+     * @returns {boolean} Returns `true` if `value` is correctly classified, else `false`.
+     * @example
+     *
+     * _.isDate(new Date);
+     * // => true
+     *
+     * _.isDate('Mon April 23 2012');
+     * // => false
+     */
+    function isDate(value) {
+      return isObjectLike(value) && objToString.call(value) == dateTag;
+    }
+
+    /**
+     * Checks if `value` is a DOM element.
+     *
+     * @static
+     * @memberOf _
+     * @category Lang
+     * @param {*} value The value to check.
+     * @returns {boolean} Returns `true` if `value` is a DOM element, else `false`.
+     * @example
+     *
+     * _.isElement(document.body);
+     * // => true
+     *
+     * _.isElement('<body>');
+     * // => false
+     */
+    function isElement(value) {
+      return !!value && value.nodeType === 1 && isObjectLike(value) && !isPlainObject(value);
+    }
+
+    /**
+     * Checks if `value` is empty. A value is considered empty unless it's an
+     * `arguments` object, array, string, or jQuery-like collection with a length
+     * greater than `0` or an object with own enumerable properties.
+     *
+     * @static
+     * @memberOf _
+     * @category Lang
+     * @param {Array|Object|string} value The value to inspect.
+     * @returns {boolean} Returns `true` if `value` is empty, else `false`.
+     * @example
+     *
+     * _.isEmpty(null);
+     * // => true
+     *
+     * _.isEmpty(true);
+     * // => true
+     *
+     * _.isEmpty(1);
+     * // => true
+     *
+     * _.isEmpty([1, 2, 3]);
+     * // => false
+     *
+     * _.isEmpty({ 'a': 1 });
+     * // => false
+     */
+    function isEmpty(value) {
+      if (value == null) {
+        return true;
+      }
+      if (isArrayLike(value) && (isArray(value) || isString(value) || isArguments(value) ||
+          (isObjectLike(value) && isFunction(value.splice)))) {
+        return !value.length;
+      }
+      return !keys(value).length;
+    }
+
+    /**
+     * Performs a deep comparison between two values to determine if they are
+     * equivalent. If `customizer` is provided it's invoked to compare values.
+     * If `customizer` returns `undefined` comparisons are handled by the method
+     * instead. The `customizer` is bound to `thisArg` and invoked with up to
+     * three arguments: (value, other [, index|key]).
+     *
+     * **Note:** This method supports comparing arrays, booleans, `Date` objects,
+     * numbers, `Object` objects, regexes, and strings. Objects are compared by
+     * their own, not inherited, enumerable properties. Functions and DOM nodes
+     * are **not** supported. Provide a customizer function to extend support
+     * for comparing other values.
+     *
+     * @static
+     * @memberOf _
+     * @alias eq
+     * @category Lang
+     * @param {*} value The value to compare.
+     * @param {*} other The other value to compare.
+     * @param {Function} [customizer] The function to customize value comparisons.
+     * @param {*} [thisArg] The `this` binding of `customizer`.
+     * @returns {boolean} Returns `true` if the values are equivalent, else `false`.
+     * @example
+     *
+     * var object = { 'user': 'fred' };
+     * var other = { 'user': 'fred' };
+     *
+     * object == other;
+     * // => false
+     *
+     * _.isEqual(object, other);
+     * // => true
+     *
+     * // using a customizer callback
+     * var array = ['hello', 'goodbye'];
+     * var other = ['hi', 'goodbye'];
+     *
+     * _.isEqual(array, other, function(value, other) {
+     *   if (_.every([value, other], RegExp.prototype.test, /^h(?:i|ello)$/)) {
+     *     return true;
+     *   }
+     * });
+     * // => true
+     */
+    function isEqual(value, other, customizer, thisArg) {
+      customizer = typeof customizer == 'function' ? bindCallback(customizer, thisArg, 3) : undefined;
+      var result = customizer ? customizer(value, other) : undefined;
+      return  result === undefined ? baseIsEqual(value, other, customizer) : !!result;
+    }
+
+    /**
+     * Checks if `value` is an `Error`, `EvalError`, `RangeError`, `ReferenceError`,
+     * `SyntaxError`, `TypeError`, or `URIError` object.
+     *
+     * @static
+     * @memberOf _
+     * @category Lang
+     * @param {*} value The value to check.
+     * @returns {boolean} Returns `true` if `value` is an error object, else `false`.
+     * @example
+     *
+     * _.isError(new Error);
+     * // => true
+     *
+     * _.isError(Error);
+     * // => false
+     */
+    function isError(value) {
+      return isObjectLike(value) && typeof value.message == 'string' && objToString.call(value) == errorTag;
+    }
+
+    /**
+     * Checks if `value` is a finite primitive number.
+     *
+     * **Note:** This method is based on [`Number.isFinite`](http://ecma-international.org/ecma-262/6.0/#sec-number.isfinite).
+     *
+     * @static
+     * @memberOf _
+     * @category Lang
+     * @param {*} value The value to check.
+     * @returns {boolean} Returns `true` if `value` is a finite number, else `false`.
+     * @example
+     *
+     * _.isFinite(10);
+     * // => true
+     *
+     * _.isFinite('10');
+     * // => false
+     *
+     * _.isFinite(true);
+     * // => false
+     *
+     * _.isFinite(Object(10));
+     * // => false
+     *
+     * _.isFinite(Infinity);
+     * // => false
+     */
+    function isFinite(value) {
+      return typeof value == 'number' && nativeIsFinite(value);
+    }
+
+    /**
+     * Checks if `value` is classified as a `Function` object.
+     *
+     * @static
+     * @memberOf _
+     * @category Lang
+     * @param {*} value The value to check.
+     * @returns {boolean} Returns `true` if `value` is correctly classified, else `false`.
+     * @example
+     *
+     * _.isFunction(_);
+     * // => true
+     *
+     * _.isFunction(/abc/);
+     * // => false
+     */
+    function isFunction(value) {
+      if (!isObject(value)) {
+        return false;
+      }//--•
+
+      // The use of `Object#toString` avoids issues with the `typeof` operator
+      // in older versions of Chrome and Safari which return 'function' for regexes
+      // and Safari 8 which returns 'object' for typed array constructors.
+      var tag = objToString.call(value);
+
+      // Return true if this looks like a function, an "async function", a "generator", or a "proxy".
+      return tag == funcTag || tag == genTag || tag == asyncTag || tag == proxyTag;
+
+      // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+      // ^^^^
+      // PATCHED FROM https://github.com/lodash/lodash/commit/95bc54a3ddc7a25f5e134f5b376a0d1d96118f49
+      // Note that, in Lodash 4, this looks like:
+      // ```
+      // return tag == funcTag || tag == genTag || tag == asyncTag || tag == proxyTag;
+      // ```
+      // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+    }
+
+    /**
+     * Checks if `value` is the [language type](https://es5.github.io/#x8) of `Object`.
+     * (e.g. arrays, functions, objects, regexes, `new Number(0)`, and `new String('')`)
+     *
+     * @static
+     * @memberOf _
+     * @category Lang
+     * @param {*} value The value to check.
+     * @returns {boolean} Returns `true` if `value` is an object, else `false`.
+     * @example
+     *
+     * _.isObject({});
+     * // => true
+     *
+     * _.isObject([1, 2, 3]);
+     * // => true
+     *
+     * _.isObject(1);
+     * // => false
+     */
+    function isObject(value) {
+      // Avoid a V8 JIT bug in Chrome 19-20.
+      // See https://code.google.com/p/v8/issues/detail?id=2291 for more details.
+      var type = typeof value;
+      return !!value && (type == 'object' || type == 'function');
+    }
+
+    /**
+     * Performs a deep comparison between `object` and `source` to determine if
+     * `object` contains equivalent property values. If `customizer` is provided
+     * it's invoked to compare values. If `customizer` returns `undefined`
+     * comparisons are handled by the method instead. The `customizer` is bound
+     * to `thisArg` and invoked with three arguments: (value, other, index|key).
+     *
+     * **Note:** This method supports comparing properties of arrays, booleans,
+     * `Date` objects, numbers, `Object` objects, regexes, and strings. Functions
+     * and DOM nodes are **not** supported. Provide a customizer function to extend
+     * support for comparing other values.
+     *
+     * @static
+     * @memberOf _
+     * @category Lang
+     * @param {Object} object The object to inspect.
+     * @param {Object} source The object of property values to match.
+     * @param {Function} [customizer] The function to customize value comparisons.
+     * @param {*} [thisArg] The `this` binding of `customizer`.
+     * @returns {boolean} Returns `true` if `object` is a match, else `false`.
+     * @example
+     *
+     * var object = { 'user': 'fred', 'age': 40 };
+     *
+     * _.isMatch(object, { 'age': 40 });
+     * // => true
+     *
+     * _.isMatch(object, { 'age': 36 });
+     * // => false
+     *
+     * // using a customizer callback
+     * var object = { 'greeting': 'hello' };
+     * var source = { 'greeting': 'hi' };
+     *
+     * _.isMatch(object, source, function(value, other) {
+     *   return _.every([value, other], RegExp.prototype.test, /^h(?:i|ello)$/) || undefined;
+     * });
+     * // => true
+     */
+    function isMatch(object, source, customizer, thisArg) {
+      customizer = typeof customizer == 'function' ? bindCallback(customizer, thisArg, 3) : undefined;
+      return baseIsMatch(object, getMatchData(source), customizer);
+    }
+
+    /**
+     * Checks if `value` is `NaN`.
+     *
+     * **Note:** This method is not the same as [`isNaN`](https://es5.github.io/#x15.1.2.4)
+     * which returns `true` for `undefined` and other non-numeric values.
+     *
+     * @static
+     * @memberOf _
+     * @category Lang
+     * @param {*} value The value to check.
+     * @returns {boolean} Returns `true` if `value` is `NaN`, else `false`.
+     * @example
+     *
+     * _.isNaN(NaN);
+     * // => true
+     *
+     * _.isNaN(new Number(NaN));
+     * // => true
+     *
+     * isNaN(undefined);
+     * // => true
+     *
+     * _.isNaN(undefined);
+     * // => false
+     */
+    function isNaN(value) {
+      // An `NaN` primitive is the only value that is not equal to itself.
+      // Perform the `toStringTag` check first to avoid errors with some host objects in IE.
+      return isNumber(value) && value != +value;
+    }
+
+    /**
+     * Checks if `value` is a native function.
+     *
+     * @static
+     * @memberOf _
+     * @category Lang
+     * @param {*} value The value to check.
+     * @returns {boolean} Returns `true` if `value` is a native function, else `false`.
+     * @example
+     *
+     * _.isNative(Array.prototype.push);
+     * // => true
+     *
+     * _.isNative(_);
+     * // => false
+     */
+    function isNative(value) {
+      if (value == null) {
+        return false;
+      }
+      if (isFunction(value)) {
+        return reIsNative.test(fnToString.call(value));
+      }
+      return isObjectLike(value) && (isHostObject(value) ? reIsNative : reIsHostCtor).test(value);
+    }
+
+    /**
+     * Checks if `value` is `null`.
+     *
+     * @static
+     * @memberOf _
+     * @category Lang
+     * @param {*} value The value to check.
+     * @returns {boolean} Returns `true` if `value` is `null`, else `false`.
+     * @example
+     *
+     * _.isNull(null);
+     * // => true
+     *
+     * _.isNull(void 0);
+     * // => false
+     */
+    function isNull(value) {
+      return value === null;
+    }
+
+    /**
+     * Checks if `value` is classified as a `Number` primitive or object.
+     *
+     * **Note:** To exclude `Infinity`, `-Infinity`, and `NaN`, which are classified
+     * as numbers, use the `_.isFinite` method.
+     *
+     * @static
+     * @memberOf _
+     * @category Lang
+     * @param {*} value The value to check.
+     * @returns {boolean} Returns `true` if `value` is correctly classified, else `false`.
+     * @example
+     *
+     * _.isNumber(8.4);
+     * // => true
+     *
+     * _.isNumber(NaN);
+     * // => true
+     *
+     * _.isNumber('8.4');
+     * // => false
+     */
+    function isNumber(value) {
+      return typeof value == 'number' || (isObjectLike(value) && objToString.call(value) == numberTag);
+    }
+
+    /**
+     * Checks if `value` is a plain object, that is, an object created by the
+     * `Object` constructor or one with a `[[Prototype]]` of `null`.
+     *
+     * **Note:** This method assumes objects created by the `Object` constructor
+     * have no inherited enumerable properties.
+     *
+     * @static
+     * @memberOf _
+     * @category Lang
+     * @param {*} value The value to check.
+     * @returns {boolean} Returns `true` if `value` is a plain object, else `false`.
+     * @example
+     *
+     * function Foo() {
+     *   this.a = 1;
+     * }
+     *
+     * _.isPlainObject(new Foo);
+     * // => false
+     *
+     * _.isPlainObject([1, 2, 3]);
+     * // => false
+     *
+     * _.isPlainObject({ 'x': 0, 'y': 0 });
+     * // => true
+     *
+     * _.isPlainObject(Object.create(null));
+     * // => true
+     */
+    function isPlainObject(value) {
+      var Ctor;
+
+      // Exit early for non `Object` objects.
+      if (!(isObjectLike(value) && objToString.call(value) == objectTag && !isHostObject(value) && !isArguments(value)) ||
+          (!hasOwnProperty.call(value, 'constructor') && (Ctor = value.constructor, typeof Ctor == 'function' && !(Ctor instanceof Ctor)))) {
+        return false;
+      }
+      // IE < 9 iterates inherited properties before own properties. If the first
+      // iterated property is an object's own property then there are no inherited
+      // enumerable properties.
+      var result;
+      if (lodash.support.ownLast) {
+        baseForIn(value, function(subValue, key, object) {
+          result = hasOwnProperty.call(object, key);
+          return false;
+        });
+        return result !== false;
+      }
+      // In most environments an object's own properties are iterated before
+      // its inherited properties. If the last iterated property is an object's
+      // own property then there are no inherited enumerable properties.
+      baseForIn(value, function(subValue, key) {
+        result = key;
+      });
+      return result === undefined || hasOwnProperty.call(value, result);
+    }
+
+    /**
+     * Checks if `value` is classified as a `RegExp` object.
+     *
+     * @static
+     * @memberOf _
+     * @category Lang
+     * @param {*} value The value to check.
+     * @returns {boolean} Returns `true` if `value` is correctly classified, else `false`.
+     * @example
+     *
+     * _.isRegExp(/abc/);
+     * // => true
+     *
+     * _.isRegExp('/abc/');
+     * // => false
+     */
+    function isRegExp(value) {
+      return isObject(value) && objToString.call(value) == regexpTag;
+    }
+
+    /**
+     * Checks if `value` is classified as a `String` primitive or object.
+     *
+     * @static
+     * @memberOf _
+     * @category Lang
+     * @param {*} value The value to check.
+     * @returns {boolean} Returns `true` if `value` is correctly classified, else `false`.
+     * @example
+     *
+     * _.isString('abc');
+     * // => true
+     *
+     * _.isString(1);
+     * // => false
+     */
+    function isString(value) {
+      return typeof value == 'string' || (isObjectLike(value) && objToString.call(value) == stringTag);
+    }
+
+    /**
+     * Checks if `value` is classified as a typed array.
+     *
+     * @static
+     * @memberOf _
+     * @category Lang
+     * @param {*} value The value to check.
+     * @returns {boolean} Returns `true` if `value` is correctly classified, else `false`.
+     * @example
+     *
+     * _.isTypedArray(new Uint8Array);
+     * // => true
+     *
+     * _.isTypedArray([]);
+     * // => false
+     */
+    function isTypedArray(value) {
+      return isObjectLike(value) && isLength(value.length) && !!typedArrayTags[objToString.call(value)];
+    }
+
+    /**
+     * Checks if `value` is `undefined`.
+     *
+     * @static
+     * @memberOf _
+     * @category Lang
+     * @param {*} value The value to check.
+     * @returns {boolean} Returns `true` if `value` is `undefined`, else `false`.
+     * @example
+     *
+     * _.isUndefined(void 0);
+     * // => true
+     *
+     * _.isUndefined(null);
+     * // => false
+     */
+    function isUndefined(value) {
+      return value === undefined;
+    }
+
+    /**
+     * Checks if `value` is less than `other`.
+     *
+     * @static
+     * @memberOf _
+     * @category Lang
+     * @param {*} value The value to compare.
+     * @param {*} other The other value to compare.
+     * @returns {boolean} Returns `true` if `value` is less than `other`, else `false`.
+     * @example
+     *
+     * _.lt(1, 3);
+     * // => true
+     *
+     * _.lt(3, 3);
+     * // => false
+     *
+     * _.lt(3, 1);
+     * // => false
+     */
+    function lt(value, other) {
+      return value < other;
+    }
+
+    /**
+     * Checks if `value` is less than or equal to `other`.
+     *
+     * @static
+     * @memberOf _
+     * @category Lang
+     * @param {*} value The value to compare.
+     * @param {*} other The other value to compare.
+     * @returns {boolean} Returns `true` if `value` is less than or equal to `other`, else `false`.
+     * @example
+     *
+     * _.lte(1, 3);
+     * // => true
+     *
+     * _.lte(3, 3);
+     * // => true
+     *
+     * _.lte(3, 1);
+     * // => false
+     */
+    function lte(value, other) {
+      return value <= other;
+    }
+
+    /**
+     * Converts `value` to an array.
+     *
+     * @static
+     * @memberOf _
+     * @category Lang
+     * @param {*} value The value to convert.
+     * @returns {Array} Returns the converted array.
+     * @example
+     *
+     * (function() {
+     *   return _.toArray(arguments).slice(1);
+     * }(1, 2, 3));
+     * // => [2, 3]
+     */
+    function toArray(value) {
+      var length = value ? getLength(value) : 0;
+      if (!isLength(length)) {
+        return values(value);
+      }
+      if (!length) {
+        return [];
+      }
+      return (lodash.support.unindexedChars && isString(value))
+        ? value.split('')
+        : arrayCopy(value);
+    }
+
+    /**
+     * Converts `value` to a plain object flattening inherited enumerable
+     * properties of `value` to own properties of the plain object.
+     *
+     * @static
+     * @memberOf _
+     * @category Lang
+     * @param {*} value The value to convert.
+     * @returns {Object} Returns the converted plain object.
+     * @example
+     *
+     * function Foo() {
+     *   this.b = 2;
+     * }
+     *
+     * Foo.prototype.c = 3;
+     *
+     * _.assign({ 'a': 1 }, new Foo);
+     * // => { 'a': 1, 'b': 2 }
+     *
+     * _.assign({ 'a': 1 }, _.toPlainObject(new Foo));
+     * // => { 'a': 1, 'b': 2, 'c': 3 }
+     */
+    function toPlainObject(value) {
+      return baseCopy(value, keysIn(value));
+    }
+
+    /*------------------------------------------------------------------------*/
+
+    /**
+     * Recursively merges own enumerable properties of the source object(s), that
+     * don't resolve to `undefined` into the destination object. Subsequent sources
+     * overwrite property assignments of previous sources. If `customizer` is
+     * provided it's invoked to produce the merged values of the destination and
+     * source properties. If `customizer` returns `undefined` merging is handled
+     * by the method instead. The `customizer` is bound to `thisArg` and invoked
+     * with five arguments: (objectValue, sourceValue, key, object, source).
+     *
+     * @static
+     * @memberOf _
+     * @category Object
+     * @param {Object} object The destination object.
+     * @param {...Object} [sources] The source objects.
+     * @param {Function} [customizer] The function to customize assigned values.
+     * @param {*} [thisArg] The `this` binding of `customizer`.
+     * @returns {Object} Returns `object`.
+     * @example
+     *
+     * var users = {
+     *   'data': [{ 'user': 'barney' }, { 'user': 'fred' }]
+     * };
+     *
+     * var ages = {
+     *   'data': [{ 'age': 36 }, { 'age': 40 }]
+     * };
+     *
+     * _.merge(users, ages);
+     * // => { 'data': [{ 'user': 'barney', 'age': 36 }, { 'user': 'fred', 'age': 40 }] }
+     *
+     * // using a customizer callback
+     * var object = {
+     *   'fruits': ['apple'],
+     *   'vegetables': ['beet']
+     * };
+     *
+     * var other = {
+     *   'fruits': ['banana'],
+     *   'vegetables': ['carrot']
+     * };
+     *
+     * _.merge(object, other, function(a, b) {
+     *   if (_.isArray(a)) {
+     *     return a.concat(b);
+     *   }
+     * });
+     * // => { 'fruits': ['apple', 'banana'], 'vegetables': ['beet', 'carrot'] }
+     */
+    var merge = createAssigner(baseMerge);
+
+    /**
+     * Assigns own enumerable properties of source object(s) to the destination
+     * object. Subsequent sources overwrite property assignments of previous sources.
+     * If `customizer` is provided it's invoked to produce the assigned values.
+     * The `customizer` is bound to `thisArg` and invoked with five arguments:
+     * (objectValue, sourceValue, key, object, source).
+     *
+     * **Note:** This method mutates `object` and is based on
+     * [`Object.assign`](http://ecma-international.org/ecma-262/6.0/#sec-object.assign).
+     *
+     * @static
+     * @memberOf _
+     * @alias extend
+     * @category Object
+     * @param {Object} object The destination object.
+     * @param {...Object} [sources] The source objects.
+     * @param {Function} [customizer] The function to customize assigned values.
+     * @param {*} [thisArg] The `this` binding of `customizer`.
+     * @returns {Object} Returns `object`.
+     * @example
+     *
+     * _.assign({ 'user': 'barney' }, { 'age': 40 }, { 'user': 'fred' });
+     * // => { 'user': 'fred', 'age': 40 }
+     *
+     * // using a customizer callback
+     * var defaults = _.partialRight(_.assign, function(value, other) {
+     *   return _.isUndefined(value) ? other : value;
+     * });
+     *
+     * defaults({ 'user': 'barney' }, { 'age': 36 }, { 'user': 'fred' });
+     * // => { 'user': 'barney', 'age': 36 }
+     */
+    var assign = createAssigner(function(object, source, customizer) {
+      return customizer
+        ? assignWith(object, source, customizer)
+        : baseAssign(object, source);
+    });
+
+    /**
+     * Creates an object that inherits from the given `prototype` object. If a
+     * `properties` object is provided its own enumerable properties are assigned
+     * to the created object.
+     *
+     * @static
+     * @memberOf _
+     * @category Object
+     * @param {Object} prototype The object to inherit from.
+     * @param {Object} [properties] The properties to assign to the object.
+     * @param- {Object} [guard] Enables use as a callback for functions like `_.map`.
+     * @returns {Object} Returns the new object.
+     * @example
+     *
+     * function Shape() {
+     *   this.x = 0;
+     *   this.y = 0;
+     * }
+     *
+     * function Circle() {
+     *   Shape.call(this);
+     * }
+     *
+     * Circle.prototype = _.create(Shape.prototype, {
+     *   'constructor': Circle
+     * });
+     *
+     * var circle = new Circle;
+     * circle instanceof Circle;
+     * // => true
+     *
+     * circle instanceof Shape;
+     * // => true
+     */
+    function create(prototype, properties, guard) {
+      var result = baseCreate(prototype);
+      if (guard && isIterateeCall(prototype, properties, guard)) {
+        properties = undefined;
+      }
+      return properties ? baseAssign(result, properties) : result;
+    }
+
+    /**
+     * Assigns own enumerable properties of source object(s) to the destination
+     * object for all destination properties that resolve to `undefined`. Once a
+     * property is set, additional values of the same property are ignored.
+     *
+     * **Note:** This method mutates `object`.
+     *
+     * @static
+     * @memberOf _
+     * @category Object
+     * @param {Object} object The destination object.
+     * @param {...Object} [sources] The source objects.
+     * @returns {Object} Returns `object`.
+     * @example
+     *
+     * _.defaults({ 'user': 'barney' }, { 'age': 36 }, { 'user': 'fred' });
+     * // => { 'user': 'barney', 'age': 36 }
+     */
+    var defaults = createDefaults(assign, assignDefaults);
+
+    /**
+     * This method is like `_.defaults` except that it recursively assigns
+     * default properties.
+     *
+     * **Note:** This method mutates `object`.
+     *
+     * @static
+     * @memberOf _
+     * @category Object
+     * @param {Object} object The destination object.
+     * @param {...Object} [sources] The source objects.
+     * @returns {Object} Returns `object`.
+     * @example
+     *
+     * _.defaultsDeep({ 'user': { 'name': 'barney' } }, { 'user': { 'name': 'fred', 'age': 36 } });
+     * // => { 'user': { 'name': 'barney', 'age': 36 } }
+     *
+     */
+    var defaultsDeep = createDefaults(merge, mergeDefaults);
+
+    /**
+     * This method is like `_.find` except that it returns the key of the first
+     * element `predicate` returns truthy for instead of the element itself.
+     *
+     * If a property name is provided for `predicate` the created `_.property`
+     * style callback returns the property value of the given element.
+     *
+     * If a value is also provided for `thisArg` the created `_.matchesProperty`
+     * style callback returns `true` for elements that have a matching property
+     * value, else `false`.
+     *
+     * If an object is provided for `predicate` the created `_.matches` style
+     * callback returns `true` for elements that have the properties of the given
+     * object, else `false`.
+     *
+     * @static
+     * @memberOf _
+     * @category Object
+     * @param {Object} object The object to search.
+     * @param {Function|Object|string} [predicate=_.identity] The function invoked
+     *  per iteration.
+     * @param {*} [thisArg] The `this` binding of `predicate`.
+     * @returns {string|undefined} Returns the key of the matched element, else `undefined`.
+     * @example
+     *
+     * var users = {
+     *   'barney':  { 'age': 36, 'active': true },
+     *   'fred':    { 'age': 40, 'active': false },
+     *   'pebbles': { 'age': 1,  'active': true }
+     * };
+     *
+     * _.findKey(users, function(chr) {
+     *   return chr.age < 40;
+     * });
+     * // => 'barney' (iteration order is not guaranteed)
+     *
+     * // using the `_.matches` callback shorthand
+     * _.findKey(users, { 'age': 1, 'active': true });
+     * // => 'pebbles'
+     *
+     * // using the `_.matchesProperty` callback shorthand
+     * _.findKey(users, 'active', false);
+     * // => 'fred'
+     *
+     * // using the `_.property` callback shorthand
+     * _.findKey(users, 'active');
+     * // => 'barney'
+     */
+    var findKey = createFindKey(baseForOwn);
+
+    /**
+     * This method is like `_.findKey` except that it iterates over elements of
+     * a collection in the opposite order.
+     *
+     * If a property name is provided for `predicate` the created `_.property`
+     * style callback returns the property value of the given element.
+     *
+     * If a value is also provided for `thisArg` the created `_.matchesProperty`
+     * style callback returns `true` for elements that have a matching property
+     * value, else `false`.
+     *
+     * If an object is provided for `predicate` the created `_.matches` style
+     * callback returns `true` for elements that have the properties of the given
+     * object, else `false`.
+     *
+     * @static
+     * @memberOf _
+     * @category Object
+     * @param {Object} object The object to search.
+     * @param {Function|Object|string} [predicate=_.identity] The function invoked
+     *  per iteration.
+     * @param {*} [thisArg] The `this` binding of `predicate`.
+     * @returns {string|undefined} Returns the key of the matched element, else `undefined`.
+     * @example
+     *
+     * var users = {
+     *   'barney':  { 'age': 36, 'active': true },
+     *   'fred':    { 'age': 40, 'active': false },
+     *   'pebbles': { 'age': 1,  'active': true }
+     * };
+     *
+     * _.findLastKey(users, function(chr) {
+     *   return chr.age < 40;
+     * });
+     * // => returns `pebbles` assuming `_.findKey` returns `barney`
+     *
+     * // using the `_.matches` callback shorthand
+     * _.findLastKey(users, { 'age': 36, 'active': true });
+     * // => 'barney'
+     *
+     * // using the `_.matchesProperty` callback shorthand
+     * _.findLastKey(users, 'active', false);
+     * // => 'fred'
+     *
+     * // using the `_.property` callback shorthand
+     * _.findLastKey(users, 'active');
+     * // => 'pebbles'
+     */
+    var findLastKey = createFindKey(baseForOwnRight);
+
+    /**
+     * Iterates over own and inherited enumerable properties of an object invoking
+     * `iteratee` for each property. The `iteratee` is bound to `thisArg` and invoked
+     * with three arguments: (value, key, object). Iteratee functions may exit
+     * iteration early by explicitly returning `false`.
+     *
+     * @static
+     * @memberOf _
+     * @category Object
+     * @param {Object} object The object to iterate over.
+     * @param {Function} [iteratee=_.identity] The function invoked per iteration.
+     * @param {*} [thisArg] The `this` binding of `iteratee`.
+     * @returns {Object} Returns `object`.
+     * @example
+     *
+     * function Foo() {
+     *   this.a = 1;
+     *   this.b = 2;
+     * }
+     *
+     * Foo.prototype.c = 3;
+     *
+     * _.forIn(new Foo, function(value, key) {
+     *   console.log(key);
+     * });
+     * // => logs 'a', 'b', and 'c' (iteration order is not guaranteed)
+     */
+    var forIn = createForIn(baseFor);
+
+    /**
+     * This method is like `_.forIn` except that it iterates over properties of
+     * `object` in the opposite order.
+     *
+     * @static
+     * @memberOf _
+     * @category Object
+     * @param {Object} object The object to iterate over.
+     * @param {Function} [iteratee=_.identity] The function invoked per iteration.
+     * @param {*} [thisArg] The `this` binding of `iteratee`.
+     * @returns {Object} Returns `object`.
+     * @example
+     *
+     * function Foo() {
+     *   this.a = 1;
+     *   this.b = 2;
+     * }
+     *
+     * Foo.prototype.c = 3;
+     *
+     * _.forInRight(new Foo, function(value, key) {
+     *   console.log(key);
+     * });
+     * // => logs 'c', 'b', and 'a' assuming `_.forIn ` logs 'a', 'b', and 'c'
+     */
+    var forInRight = createForIn(baseForRight);
+
+    /**
+     * Iterates over own enumerable properties of an object invoking `iteratee`
+     * for each property. The `iteratee` is bound to `thisArg` and invoked with
+     * three arguments: (value, key, object). Iteratee functions may exit iteration
+     * early by explicitly returning `false`.
+     *
+     * @static
+     * @memberOf _
+     * @category Object
+     * @param {Object} object The object to iterate over.
+     * @param {Function} [iteratee=_.identity] The function invoked per iteration.
+     * @param {*} [thisArg] The `this` binding of `iteratee`.
+     * @returns {Object} Returns `object`.
+     * @example
+     *
+     * function Foo() {
+     *   this.a = 1;
+     *   this.b = 2;
+     * }
+     *
+     * Foo.prototype.c = 3;
+     *
+     * _.forOwn(new Foo, function(value, key) {
+     *   console.log(key);
+     * });
+     * // => logs 'a' and 'b' (iteration order is not guaranteed)
+     */
+    var forOwn = createForOwn(baseForOwn);
+
+    /**
+     * This method is like `_.forOwn` except that it iterates over properties of
+     * `object` in the opposite order.
+     *
+     * @static
+     * @memberOf _
+     * @category Object
+     * @param {Object} object The object to iterate over.
+     * @param {Function} [iteratee=_.identity] The function invoked per iteration.
+     * @param {*} [thisArg] The `this` binding of `iteratee`.
+     * @returns {Object} Returns `object`.
+     * @example
+     *
+     * function Foo() {
+     *   this.a = 1;
+     *   this.b = 2;
+     * }
+     *
+     * Foo.prototype.c = 3;
+     *
+     * _.forOwnRight(new Foo, function(value, key) {
+     *   console.log(key);
+     * });
+     * // => logs 'b' and 'a' assuming `_.forOwn` logs 'a' and 'b'
+     */
+    var forOwnRight = createForOwn(baseForOwnRight);
+
+    /**
+     * Creates an array of function property names from all enumerable properties,
+     * own and inherited, of `object`.
+     *
+     * @static
+     * @memberOf _
+     * @alias methods
+     * @category Object
+     * @param {Object} object The object to inspect.
+     * @returns {Array} Returns the new array of property names.
+     * @example
+     *
+     * _.functions(_);
+     * // => ['after', 'ary', 'assign', ...]
+     */
+    function functions(object) {
+      return baseFunctions(object, keysIn(object));
+    }
+
+    /**
+     * Gets the property value at `path` of `object`. If the resolved value is
+     * `undefined` the `defaultValue` is used in its place.
+     *
+     * @static
+     * @memberOf _
+     * @category Object
+     * @param {Object} object The object to query.
+     * @param {Array|string} path The path of the property to get.
+     * @param {*} [defaultValue] The value returned if the resolved value is `undefined`.
+     * @returns {*} Returns the resolved value.
+     * @example
+     *
+     * var object = { 'a': [{ 'b': { 'c': 3 } }] };
+     *
+     * _.get(object, 'a[0].b.c');
+     * // => 3
+     *
+     * _.get(object, ['a', '0', 'b', 'c']);
+     * // => 3
+     *
+     * _.get(object, 'a.b.c', 'default');
+     * // => 'default'
+     */
+    function get(object, path, defaultValue) {
+      var result = object == null ? undefined : baseGet(object, toPath(path), (path + ''));
+      return result === undefined ? defaultValue : result;
+    }
+
+    /**
+     * Checks if `path` is a direct property.
+     *
+     * @static
+     * @memberOf _
+     * @category Object
+     * @param {Object} object The object to query.
+     * @param {Array|string} path The path to check.
+     * @returns {boolean} Returns `true` if `path` is a direct property, else `false`.
+     * @example
+     *
+     * var object = { 'a': { 'b': { 'c': 3 } } };
+     *
+     * _.has(object, 'a');
+     * // => true
+     *
+     * _.has(object, 'a.b.c');
+     * // => true
+     *
+     * _.has(object, ['a', 'b', 'c']);
+     * // => true
+     */
+    function has(object, path) {
+      if (object == null) {
+        return false;
+      }
+      var result = hasOwnProperty.call(object, path);
+      if (!result && !isKey(path)) {
+        path = toPath(path);
+        object = path.length == 1 ? object : baseGet(object, baseSlice(path, 0, -1));
+        if (object == null) {
+          return false;
+        }
+        path = last(path);
+        result = hasOwnProperty.call(object, path);
+      }
+      return result || (isLength(object.length) && isIndex(path, object.length) &&
+        (isArray(object) || isArguments(object) || isString(object)));
+    }
+
+    /**
+     * Creates an object composed of the inverted keys and values of `object`.
+     * If `object` contains duplicate values, subsequent values overwrite property
+     * assignments of previous values unless `multiValue` is `true`.
+     *
+     * @static
+     * @memberOf _
+     * @category Object
+     * @param {Object} object The object to invert.
+     * @param {boolean} [multiValue] Allow multiple values per key.
+     * @param- {Object} [guard] Enables use as a callback for functions like `_.map`.
+     * @returns {Object} Returns the new inverted object.
+     * @example
+     *
+     * var object = { 'a': 1, 'b': 2, 'c': 1 };
+     *
+     * _.invert(object);
+     * // => { '1': 'c', '2': 'b' }
+     *
+     * // with `multiValue`
+     * _.invert(object, true);
+     * // => { '1': ['a', 'c'], '2': ['b'] }
+     */
+    function invert(object, multiValue, guard) {
+      if (guard && isIterateeCall(object, multiValue, guard)) {
+        multiValue = undefined;
+      }
+      var index = -1,
+          props = keys(object),
+          length = props.length,
+          result = {};
+
+      while (++index < length) {
+        var key = props[index],
+            value = object[key];
+
+        if (multiValue) {
+          if (hasOwnProperty.call(result, value)) {
+            result[value].push(key);
+          } else {
+            result[value] = [key];
+          }
+        }
+        else {
+          result[value] = key;
+        }
+      }
+      return result;
+    }
+
+    /**
+     * Creates an array of the own enumerable property names of `object`.
+     *
+     * **Note:** Non-object values are coerced to objects. See the
+     * [ES spec](http://ecma-international.org/ecma-262/6.0/#sec-object.keys)
+     * for more details.
+     *
+     * @static
+     * @memberOf _
+     * @category Object
+     * @param {Object} object The object to query.
+     * @returns {Array} Returns the array of property names.
+     * @example
+     *
+     * function Foo() {
+     *   this.a = 1;
+     *   this.b = 2;
+     * }
+     *
+     * Foo.prototype.c = 3;
+     *
+     * _.keys(new Foo);
+     * // => ['a', 'b'] (iteration order is not guaranteed)
+     *
+     * _.keys('hi');
+     * // => ['0', '1']
+     */
+    var keys = !nativeKeys ? shimKeys : function(object) {
+      var Ctor = object == null ? undefined : object.constructor;
+      if ((typeof Ctor == 'function' && Ctor.prototype === object) ||
+          (typeof object == 'function' ? lodash.support.enumPrototypes : isArrayLike(object))) {
+        return shimKeys(object);
+      }
+      return isObject(object) ? nativeKeys(object) : [];
+    };
+
+    /**
+     * Creates an array of the own and inherited enumerable property names of `object`.
+     *
+     * **Note:** Non-object values are coerced to objects.
+     *
+     * @static
+     * @memberOf _
+     * @category Object
+     * @param {Object} object The object to query.
+     * @returns {Array} Returns the array of property names.
+     * @example
+     *
+     * function Foo() {
+     *   this.a = 1;
+     *   this.b = 2;
+     * }
+     *
+     * Foo.prototype.c = 3;
+     *
+     * _.keysIn(new Foo);
+     * // => ['a', 'b', 'c'] (iteration order is not guaranteed)
+     */
+    function keysIn(object) {
+      if (object == null) {
+        return [];
+      }
+      if (!isObject(object)) {
+        object = Object(object);
+      }
+      var length = object.length,
+          support = lodash.support;
+
+      length = (length && isLength(length) &&
+        (isArray(object) || isArguments(object) || isString(object)) && length) || 0;
+
+      var Ctor = object.constructor,
+          index = -1,
+          proto = (isFunction(Ctor) && Ctor.prototype) || objectProto,
+          isProto = proto === object,
+          result = Array(length),
+          skipIndexes = length > 0,
+          skipErrorProps = support.enumErrorProps && (object === errorProto || object instanceof Error),
+          skipProto = support.enumPrototypes && isFunction(object);
+
+      while (++index < length) {
+        result[index] = (index + '');
+      }
+      // lodash skips the `constructor` property when it infers it's iterating
+      // over a `prototype` object because IE < 9 can't set the `[[Enumerable]]`
+      // attribute of an existing property and the `constructor` property of a
+      // prototype defaults to non-enumerable.
+      for (var key in object) {
+        if (!(skipProto && key == 'prototype') &&
+            !(skipErrorProps && (key == 'message' || key == 'name')) &&
+            !(skipIndexes && isIndex(key, length)) &&
+            !(key == 'constructor' && (isProto || !hasOwnProperty.call(object, key)))) {
+          result.push(key);
+        }
+      }
+      if (support.nonEnumShadows && object !== objectProto) {
+        var tag = object === stringProto ? stringTag : (object === errorProto ? errorTag : objToString.call(object)),
+            nonEnums = nonEnumProps[tag] || nonEnumProps[objectTag];
+
+        if (tag == objectTag) {
+          proto = objectProto;
+        }
+        length = shadowProps.length;
+        while (length--) {
+          key = shadowProps[length];
+          var nonEnum = nonEnums[key];
+          if (!(isProto && nonEnum) &&
+              (nonEnum ? hasOwnProperty.call(object, key) : object[key] !== proto[key])) {
+            result.push(key);
+          }
+        }
+      }
+      return result;
+    }
+
+    /**
+     * The opposite of `_.mapValues`; this method creates an object with the
+     * same values as `object` and keys generated by running each own enumerable
+     * property of `object` through `iteratee`.
+     *
+     * @static
+     * @memberOf _
+     * @category Object
+     * @param {Object} object The object to iterate over.
+     * @param {Function|Object|string} [iteratee=_.identity] The function invoked
+     *  per iteration.
+     * @param {*} [thisArg] The `this` binding of `iteratee`.
+     * @returns {Object} Returns the new mapped object.
+     * @example
+     *
+     * _.mapKeys({ 'a': 1, 'b': 2 }, function(value, key) {
+     *   return key + value;
+     * });
+     * // => { 'a1': 1, 'b2': 2 }
+     */
+    var mapKeys = createObjectMapper(true);
+
+    /**
+     * Creates an object with the same keys as `object` and values generated by
+     * running each own enumerable property of `object` through `iteratee`. The
+     * iteratee function is bound to `thisArg` and invoked with three arguments:
+     * (value, key, object).
+     *
+     * If a property name is provided for `iteratee` the created `_.property`
+     * style callback returns the property value of the given element.
+     *
+     * If a value is also provided for `thisArg` the created `_.matchesProperty`
+     * style callback returns `true` for elements that have a matching property
+     * value, else `false`.
+     *
+     * If an object is provided for `iteratee` the created `_.matches` style
+     * callback returns `true` for elements that have the properties of the given
+     * object, else `false`.
+     *
+     * @static
+     * @memberOf _
+     * @category Object
+     * @param {Object} object The object to iterate over.
+     * @param {Function|Object|string} [iteratee=_.identity] The function invoked
+     *  per iteration.
+     * @param {*} [thisArg] The `this` binding of `iteratee`.
+     * @returns {Object} Returns the new mapped object.
+     * @example
+     *
+     * _.mapValues({ 'a': 1, 'b': 2 }, function(n) {
+     *   return n * 3;
+     * });
+     * // => { 'a': 3, 'b': 6 }
+     *
+     * var users = {
+     *   'fred':    { 'user': 'fred',    'age': 40 },
+     *   'pebbles': { 'user': 'pebbles', 'age': 1 }
+     * };
+     *
+     * // using the `_.property` callback shorthand
+     * _.mapValues(users, 'age');
+     * // => { 'fred': 40, 'pebbles': 1 } (iteration order is not guaranteed)
+     */
+    var mapValues = createObjectMapper();
+
+    /**
+     * The opposite of `_.pick`; this method creates an object composed of the
+     * own and inherited enumerable properties of `object` that are not omitted.
+     *
+     * @static
+     * @memberOf _
+     * @category Object
+     * @param {Object} object The source object.
+     * @param {Function|...(string|string[])} [predicate] The function invoked per
+     *  iteration or property names to omit, specified as individual property
+     *  names or arrays of property names.
+     * @param {*} [thisArg] The `this` binding of `predicate`.
+     * @returns {Object} Returns the new object.
+     * @example
+     *
+     * var object = { 'user': 'fred', 'age': 40 };
+     *
+     * _.omit(object, 'age');
+     * // => { 'user': 'fred' }
+     *
+     * _.omit(object, _.isNumber);
+     * // => { 'user': 'fred' }
+     */
+    var omit = restParam(function(object, props) {
+      if (object == null) {
+        return {};
+      }
+      if (typeof props[0] != 'function') {
+        var props = arrayMap(baseFlatten(props), String);
+        return pickByArray(object, baseDifference(keysIn(object), props));
+      }
+      var predicate = bindCallback(props[0], props[1], 3);
+      return pickByCallback(object, function(value, key, object) {
+        return !predicate(value, key, object);
+      });
+    });
+
+    /**
+     * Creates a two dimensional array of the key-value pairs for `object`,
+     * e.g. `[[key1, value1], [key2, value2]]`.
+     *
+     * @static
+     * @memberOf _
+     * @category Object
+     * @param {Object} object The object to query.
+     * @returns {Array} Returns the new array of key-value pairs.
+     * @example
+     *
+     * _.pairs({ 'barney': 36, 'fred': 40 });
+     * // => [['barney', 36], ['fred', 40]] (iteration order is not guaranteed)
+     */
+    function pairs(object) {
+      object = toObject(object);
+
+      var index = -1,
+          props = keys(object),
+          length = props.length,
+          result = Array(length);
+
+      while (++index < length) {
+        var key = props[index];
+        result[index] = [key, object[key]];
+      }
+      return result;
+    }
+
+    /**
+     * Creates an object composed of the picked `object` properties. Property
+     * names may be specified as individual arguments or as arrays of property
+     * names. If `predicate` is provided it's invoked for each property of `object`
+     * picking the properties `predicate` returns truthy for. The predicate is
+     * bound to `thisArg` and invoked with three arguments: (value, key, object).
+     *
+     * @static
+     * @memberOf _
+     * @category Object
+     * @param {Object} object The source object.
+     * @param {Function|...(string|string[])} [predicate] The function invoked per
+     *  iteration or property names to pick, specified as individual property
+     *  names or arrays of property names.
+     * @param {*} [thisArg] The `this` binding of `predicate`.
+     * @returns {Object} Returns the new object.
+     * @example
+     *
+     * var object = { 'user': 'fred', 'age': 40 };
+     *
+     * _.pick(object, 'user');
+     * // => { 'user': 'fred' }
+     *
+     * _.pick(object, _.isString);
+     * // => { 'user': 'fred' }
+     */
+    var pick = restParam(function(object, props) {
+      if (object == null) {
+        return {};
+      }
+      return typeof props[0] == 'function'
+        ? pickByCallback(object, bindCallback(props[0], props[1], 3))
+        : pickByArray(object, baseFlatten(props));
+    });
+
+    /**
+     * This method is like `_.get` except that if the resolved value is a function
+     * it's invoked with the `this` binding of its parent object and its result
+     * is returned.
+     *
+     * @static
+     * @memberOf _
+     * @category Object
+     * @param {Object} object The object to query.
+     * @param {Array|string} path The path of the property to resolve.
+     * @param {*} [defaultValue] The value returned if the resolved value is `undefined`.
+     * @returns {*} Returns the resolved value.
+     * @example
+     *
+     * var object = { 'a': [{ 'b': { 'c1': 3, 'c2': _.constant(4) } }] };
+     *
+     * _.result(object, 'a[0].b.c1');
+     * // => 3
+     *
+     * _.result(object, 'a[0].b.c2');
+     * // => 4
+     *
+     * _.result(object, 'a.b.c', 'default');
+     * // => 'default'
+     *
+     * _.result(object, 'a.b.c', _.constant('default'));
+     * // => 'default'
+     */
+    function result(object, path, defaultValue) {
+      var result = object == null ? undefined : toObject(object)[path];
+      if (result === undefined) {
+        if (object != null && !isKey(path, object)) {
+          path = toPath(path);
+          object = path.length == 1 ? object : baseGet(object, baseSlice(path, 0, -1));
+          result = object == null ? undefined : toObject(object)[last(path)];
+        }
+        result = result === undefined ? defaultValue : result;
+      }
+      return isFunction(result) ? result.call(object) : result;
+    }
+
+    /**
+     * Sets the property value of `path` on `object`. If a portion of `path`
+     * does not exist it's created.
+     *
+     * @static
+     * @memberOf _
+     * @category Object
+     * @param {Object} object The object to augment.
+     * @param {Array|string} path The path of the property to set.
+     * @param {*} value The value to set.
+     * @returns {Object} Returns `object`.
+     * @example
+     *
+     * var object = { 'a': [{ 'b': { 'c': 3 } }] };
+     *
+     * _.set(object, 'a[0].b.c', 4);
+     * console.log(object.a[0].b.c);
+     * // => 4
+     *
+     * _.set(object, 'x[0].y.z', 5);
+     * console.log(object.x[0].y.z);
+     * // => 5
+     */
+    function set(object, path, value) {
+      if (object == null) {
+        return object;
+      }
+      var pathKey = (path + '');
+      path = (object[pathKey] != null || isKey(path, object)) ? [pathKey] : toPath(path);
+
+      var index = -1,
+          length = path.length,
+          lastIndex = length - 1,
+          nested = object;
+
+      while (nested != null && ++index < length) {
+        var key = path[index];
+        if (isObject(nested)) {
+          if (index == lastIndex) {
+            nested[key] = value;
+          } else if (nested[key] == null) {
+            nested[key] = isIndex(path[index + 1]) ? [] : {};
+          }
+        }
+        nested = nested[key];
+      }
+      return object;
+    }
+
+    /**
+     * An alternative to `_.reduce`; this method transforms `object` to a new
+     * `accumulator` object which is the result of running each of its own enumerable
+     * properties through `iteratee`, with each invocation potentially mutating
+     * the `accumulator` object. The `iteratee` is bound to `thisArg` and invoked
+     * with four arguments: (accumulator, value, key, object). Iteratee functions
+     * may exit iteration early by explicitly returning `false`.
+     *
+     * @static
+     * @memberOf _
+     * @category Object
+     * @param {Array|Object} object The object to iterate over.
+     * @param {Function} [iteratee=_.identity] The function invoked per iteration.
+     * @param {*} [accumulator] The custom accumulator value.
+     * @param {*} [thisArg] The `this` binding of `iteratee`.
+     * @returns {*} Returns the accumulated value.
+     * @example
+     *
+     * _.transform([2, 3, 4], function(result, n) {
+     *   result.push(n *= n);
+     *   return n % 2 == 0;
+     * });
+     * // => [4, 9]
+     *
+     * _.transform({ 'a': 1, 'b': 2 }, function(result, n, key) {
+     *   result[key] = n * 3;
+     * });
+     * // => { 'a': 3, 'b': 6 }
+     */
+    function transform(object, iteratee, accumulator, thisArg) {
+      var isArr = isArray(object) || isTypedArray(object);
+      iteratee = getCallback(iteratee, thisArg, 4);
+
+      if (accumulator == null) {
+        if (isArr || isObject(object)) {
+          var Ctor = object.constructor;
+          if (isArr) {
+            accumulator = isArray(object) ? new Ctor : [];
+          } else {
+            accumulator = baseCreate(isFunction(Ctor) ? Ctor.prototype : undefined);
+          }
+        } else {
+          accumulator = {};
+        }
+      }
+      (isArr ? arrayEach : baseForOwn)(object, function(value, index, object) {
+        return iteratee(accumulator, value, index, object);
+      });
+      return accumulator;
+    }
+
+    /**
+     * Creates an array of the own enumerable property values of `object`.
+     *
+     * **Note:** Non-object values are coerced to objects.
+     *
+     * @static
+     * @memberOf _
+     * @category Object
+     * @param {Object} object The object to query.
+     * @returns {Array} Returns the array of property values.
+     * @example
+     *
+     * function Foo() {
+     *   this.a = 1;
+     *   this.b = 2;
+     * }
+     *
+     * Foo.prototype.c = 3;
+     *
+     * _.values(new Foo);
+     * // => [1, 2] (iteration order is not guaranteed)
+     *
+     * _.values('hi');
+     * // => ['h', 'i']
+     */
+    function values(object) {
+      return baseValues(object, keys(object));
+    }
+
+    /**
+     * Creates an array of the own and inherited enumerable property values
+     * of `object`.
+     *
+     * **Note:** Non-object values are coerced to objects.
+     *
+     * @static
+     * @memberOf _
+     * @category Object
+     * @param {Object} object The object to query.
+     * @returns {Array} Returns the array of property values.
+     * @example
+     *
+     * function Foo() {
+     *   this.a = 1;
+     *   this.b = 2;
+     * }
+     *
+     * Foo.prototype.c = 3;
+     *
+     * _.valuesIn(new Foo);
+     * // => [1, 2, 3] (iteration order is not guaranteed)
+     */
+    function valuesIn(object) {
+      return baseValues(object, keysIn(object));
+    }
+
+    /*------------------------------------------------------------------------*/
+
+    /**
+     * Checks if `n` is between `start` and up to but not including, `end`. If
+     * `end` is not specified it's set to `start` with `start` then set to `0`.
+     *
+     * @static
+     * @memberOf _
+     * @category Number
+     * @param {number} n The number to check.
+     * @param {number} [start=0] The start of the range.
+     * @param {number} end The end of the range.
+     * @returns {boolean} Returns `true` if `n` is in the range, else `false`.
+     * @example
+     *
+     * _.inRange(3, 2, 4);
+     * // => true
+     *
+     * _.inRange(4, 8);
+     * // => true
+     *
+     * _.inRange(4, 2);
+     * // => false
+     *
+     * _.inRange(2, 2);
+     * // => false
+     *
+     * _.inRange(1.2, 2);
+     * // => true
+     *
+     * _.inRange(5.2, 4);
+     * // => false
+     */
+    function inRange(value, start, end) {
+      start = +start || 0;
+      if (end === undefined) {
+        end = start;
+        start = 0;
+      } else {
+        end = +end || 0;
+      }
+      return value >= nativeMin(start, end) && value < nativeMax(start, end);
+    }
+
+    /**
+     * Produces a random number between `min` and `max` (inclusive). If only one
+     * argument is provided a number between `0` and the given number is returned.
+     * If `floating` is `true`, or either `min` or `max` are floats, a floating-point
+     * number is returned instead of an integer.
+     *
+     * @static
+     * @memberOf _
+     * @category Number
+     * @param {number} [min=0] The minimum possible value.
+     * @param {number} [max=1] The maximum possible value.
+     * @param {boolean} [floating] Specify returning a floating-point number.
+     * @returns {number} Returns the random number.
+     * @example
+     *
+     * _.random(0, 5);
+     * // => an integer between 0 and 5
+     *
+     * _.random(5);
+     * // => also an integer between 0 and 5
+     *
+     * _.random(5, true);
+     * // => a floating-point number between 0 and 5
+     *
+     * _.random(1.2, 5.2);
+     * // => a floating-point number between 1.2 and 5.2
+     */
+    function random(min, max, floating) {
+      if (floating && isIterateeCall(min, max, floating)) {
+        max = floating = undefined;
+      }
+      var noMin = min == null,
+          noMax = max == null;
+
+      if (floating == null) {
+        if (noMax && typeof min == 'boolean') {
+          floating = min;
+          min = 1;
+        }
+        else if (typeof max == 'boolean') {
+          floating = max;
+          noMax = true;
+        }
+      }
+      if (noMin && noMax) {
+        max = 1;
+        noMax = false;
+      }
+      min = +min || 0;
+      if (noMax) {
+        max = min;
+        min = 0;
+      } else {
+        max = +max || 0;
+      }
+      if (floating || min % 1 || max % 1) {
+        var rand = nativeRandom();
+        return nativeMin(min + (rand * (max - min + parseFloat('1e-' + ((rand + '').length - 1)))), max);
+      }
+      return baseRandom(min, max);
+    }
+
+    /*------------------------------------------------------------------------*/
+
+    /**
+     * Converts `string` to [camel case](https://en.wikipedia.org/wiki/CamelCase).
+     *
+     * @static
+     * @memberOf _
+     * @category String
+     * @param {string} [string=''] The string to convert.
+     * @returns {string} Returns the camel cased string.
+     * @example
+     *
+     * _.camelCase('Foo Bar');
+     * // => 'fooBar'
+     *
+     * _.camelCase('--foo-bar');
+     * // => 'fooBar'
+     *
+     * _.camelCase('__foo_bar__');
+     * // => 'fooBar'
+     */
+    var camelCase = createCompounder(function(result, word, index) {
+      word = word.toLowerCase();
+      return result + (index ? (word.charAt(0).toUpperCase() + word.slice(1)) : word);
+    });
+
+    /**
+     * Capitalizes the first character of `string`.
+     *
+     * @static
+     * @memberOf _
+     * @category String
+     * @param {string} [string=''] The string to capitalize.
+     * @returns {string} Returns the capitalized string.
+     * @example
+     *
+     * _.capitalize('fred');
+     * // => 'Fred'
+     */
+    function capitalize(string) {
+      string = baseToString(string);
+      return string && (string.charAt(0).toUpperCase() + string.slice(1));
+    }
+
+    /**
+     * Deburrs `string` by converting [latin-1 supplementary letters](https://en.wikipedia.org/wiki/Latin-1_Supplement_(Unicode_block)#Character_table)
+     * to basic latin letters and removing [combining diacritical marks](https://en.wikipedia.org/wiki/Combining_Diacritical_Marks).
+     *
+     * @static
+     * @memberOf _
+     * @category String
+     * @param {string} [string=''] The string to deburr.
+     * @returns {string} Returns the deburred string.
+     * @example
+     *
+     * _.deburr('déjà vu');
+     * // => 'deja vu'
+     */
+    function deburr(string) {
+      string = baseToString(string);
+      return string && string.replace(reLatin1, deburrLetter).replace(reComboMark, '');
+    }
+
+    /**
+     * Checks if `string` ends with the given target string.
+     *
+     * @static
+     * @memberOf _
+     * @category String
+     * @param {string} [string=''] The string to search.
+     * @param {string} [target] The string to search for.
+     * @param {number} [position=string.length] The position to search from.
+     * @returns {boolean} Returns `true` if `string` ends with `target`, else `false`.
+     * @example
+     *
+     * _.endsWith('abc', 'c');
+     * // => true
+     *
+     * _.endsWith('abc', 'b');
+     * // => false
+     *
+     * _.endsWith('abc', 'b', 2);
+     * // => true
+     */
+    function endsWith(string, target, position) {
+      string = baseToString(string);
+      target = (target + '');
+
+      var length = string.length;
+      position = position === undefined
+        ? length
+        : nativeMin(position < 0 ? 0 : (+position || 0), length);
+
+      position -= target.length;
+      return position >= 0 && string.indexOf(target, position) == position;
+    }
+
+    /**
+     * Converts the characters "&", "<", ">", '"', "'", and "\`", in `string` to
+     * their corresponding HTML entities.
+     *
+     * **Note:** No other characters are escaped. To escape additional characters
+     * use a third-party library like [_he_](https://mths.be/he).
+     *
+     * Though the ">" character is escaped for symmetry, characters like
+     * ">" and "/" don't need escaping in HTML and have no special meaning
+     * unless they're part of a tag or unquoted attribute value.
+     * See [Mathias Bynens's article](https://mathiasbynens.be/notes/ambiguous-ampersands)
+     * (under "semi-related fun fact") for more details.
+     *
+     * Backticks are escaped because in Internet Explorer < 9, they can break out
+     * of attribute values or HTML comments. See [#59](https://html5sec.org/#59),
+     * [#102](https://html5sec.org/#102), [#108](https://html5sec.org/#108), and
+     * [#133](https://html5sec.org/#133) of the [HTML5 Security Cheatsheet](https://html5sec.org/)
+     * for more details.
+     *
+     * When working with HTML you should always [quote attribute values](http://wonko.com/post/html-escaping)
+     * to reduce XSS vectors.
+     *
+     * @static
+     * @memberOf _
+     * @category String
+     * @param {string} [string=''] The string to escape.
+     * @returns {string} Returns the escaped string.
+     * @example
+     *
+     * _.escape('fred, barney, & pebbles');
+     * // => 'fred, barney, &amp; pebbles'
+     */
+    function escape(string) {
+      // Reset `lastIndex` because in IE < 9 `String#replace` does not.
+      string = baseToString(string);
+      return (string && reHasUnescapedHtml.test(string))
+        ? string.replace(reUnescapedHtml, escapeHtmlChar)
+        : string;
+    }
+
+    /**
+     * Escapes the `RegExp` special characters "\", "/", "^", "$", ".", "|", "?",
+     * "*", "+", "(", ")", "[", "]", "{" and "}" in `string`.
+     *
+     * @static
+     * @memberOf _
+     * @category String
+     * @param {string} [string=''] The string to escape.
+     * @returns {string} Returns the escaped string.
+     * @example
+     *
+     * _.escapeRegExp('[lodash](https://lodash.com/)');
+     * // => '\[lodash\]\(https:\/\/lodash\.com\/\)'
+     */
+    function escapeRegExp(string) {
+      string = baseToString(string);
+      return (string && reHasRegExpChars.test(string))
+        ? string.replace(reRegExpChars, escapeRegExpChar)
+        : (string || '(?:)');
+    }
+
+    /**
+     * Converts `string` to [kebab case](https://en.wikipedia.org/wiki/Letter_case#Special_case_styles).
+     *
+     * @static
+     * @memberOf _
+     * @category String
+     * @param {string} [string=''] The string to convert.
+     * @returns {string} Returns the kebab cased string.
+     * @example
+     *
+     * _.kebabCase('Foo Bar');
+     * // => 'foo-bar'
+     *
+     * _.kebabCase('fooBar');
+     * // => 'foo-bar'
+     *
+     * _.kebabCase('__foo_bar__');
+     * // => 'foo-bar'
+     */
+    var kebabCase = createCompounder(function(result, word, index) {
+      return result + (index ? '-' : '') + word.toLowerCase();
+    });
+
+    /**
+     * Pads `string` on the left and right sides if it's shorter than `length`.
+     * Padding characters are truncated if they can't be evenly divided by `length`.
+     *
+     * @static
+     * @memberOf _
+     * @category String
+     * @param {string} [string=''] The string to pad.
+     * @param {number} [length=0] The padding length.
+     * @param {string} [chars=' '] The string used as padding.
+     * @returns {string} Returns the padded string.
+     * @example
+     *
+     * _.pad('abc', 8);
+     * // => '  abc   '
+     *
+     * _.pad('abc', 8, '_-');
+     * // => '_-abc_-_'
+     *
+     * _.pad('abc', 3);
+     * // => 'abc'
+     */
+    function pad(string, length, chars) {
+      string = baseToString(string);
+      length = +length;
+
+      var strLength = string.length;
+      if (strLength >= length || !nativeIsFinite(length)) {
+        return string;
+      }
+      var mid = (length - strLength) / 2,
+          leftLength = nativeFloor(mid),
+          rightLength = nativeCeil(mid);
+
+      chars = createPadding('', rightLength, chars);
+      return chars.slice(0, leftLength) + string + chars;
+    }
+
+    /**
+     * Pads `string` on the left side if it's shorter than `length`. Padding
+     * characters are truncated if they exceed `length`.
+     *
+     * @static
+     * @memberOf _
+     * @category String
+     * @param {string} [string=''] The string to pad.
+     * @param {number} [length=0] The padding length.
+     * @param {string} [chars=' '] The string used as padding.
+     * @returns {string} Returns the padded string.
+     * @example
+     *
+     * _.padLeft('abc', 6);
+     * // => '   abc'
+     *
+     * _.padLeft('abc', 6, '_-');
+     * // => '_-_abc'
+     *
+     * _.padLeft('abc', 3);
+     * // => 'abc'
+     */
+    var padLeft = createPadDir();
+
+    /**
+     * Pads `string` on the right side if it's shorter than `length`. Padding
+     * characters are truncated if they exceed `length`.
+     *
+     * @static
+     * @memberOf _
+     * @category String
+     * @param {string} [string=''] The string to pad.
+     * @param {number} [length=0] The padding length.
+     * @param {string} [chars=' '] The string used as padding.
+     * @returns {string} Returns the padded string.
+     * @example
+     *
+     * _.padRight('abc', 6);
+     * // => 'abc   '
+     *
+     * _.padRight('abc', 6, '_-');
+     * // => 'abc_-_'
+     *
+     * _.padRight('abc', 3);
+     * // => 'abc'
+     */
+    var padRight = createPadDir(true);
+
+    /**
+     * Converts `string` to an integer of the specified radix. If `radix` is
+     * `undefined` or `0`, a `radix` of `10` is used unless `value` is a hexadecimal,
+     * in which case a `radix` of `16` is used.
+     *
+     * **Note:** This method aligns with the [ES5 implementation](https://es5.github.io/#E)
+     * of `parseInt`.
+     *
+     * @static
+     * @memberOf _
+     * @category String
+     * @param {string} string The string to convert.
+     * @param {number} [radix] The radix to interpret `value` by.
+     * @param- {Object} [guard] Enables use as a callback for functions like `_.map`.
+     * @returns {number} Returns the converted integer.
+     * @example
+     *
+     * _.parseInt('08');
+     * // => 8
+     *
+     * _.map(['6', '08', '10'], _.parseInt);
+     * // => [6, 8, 10]
+     */
+    function parseInt(string, radix, guard) {
+      // Firefox < 21 and Opera < 15 follow ES3 for `parseInt`.
+      // Chrome fails to trim leading <BOM> whitespace characters.
+      // See https://code.google.com/p/v8/issues/detail?id=3109 for more details.
+      if (guard ? isIterateeCall(string, radix, guard) : radix == null) {
+        radix = 0;
+      } else if (radix) {
+        radix = +radix;
+      }
+      string = trim(string);
+      return nativeParseInt(string, radix || (reHasHexPrefix.test(string) ? 16 : 10));
+    }
+
+    /**
+     * Repeats the given string `n` times.
+     *
+     * @static
+     * @memberOf _
+     * @category String
+     * @param {string} [string=''] The string to repeat.
+     * @param {number} [n=0] The number of times to repeat the string.
+     * @returns {string} Returns the repeated string.
+     * @example
+     *
+     * _.repeat('*', 3);
+     * // => '***'
+     *
+     * _.repeat('abc', 2);
+     * // => 'abcabc'
+     *
+     * _.repeat('abc', 0);
+     * // => ''
+     */
+    function repeat(string, n) {
+      var result = '';
+      string = baseToString(string);
+      n = +n;
+      if (n < 1 || !string || !nativeIsFinite(n)) {
+        return result;
+      }
+      // Leverage the exponentiation by squaring algorithm for a faster repeat.
+      // See https://en.wikipedia.org/wiki/Exponentiation_by_squaring for more details.
+      do {
+        if (n % 2) {
+          result += string;
+        }
+        n = nativeFloor(n / 2);
+        string += string;
+      } while (n);
+
+      return result;
+    }
+
+    /**
+     * Converts `string` to [snake case](https://en.wikipedia.org/wiki/Snake_case).
+     *
+     * @static
+     * @memberOf _
+     * @category String
+     * @param {string} [string=''] The string to convert.
+     * @returns {string} Returns the snake cased string.
+     * @example
+     *
+     * _.snakeCase('Foo Bar');
+     * // => 'foo_bar'
+     *
+     * _.snakeCase('fooBar');
+     * // => 'foo_bar'
+     *
+     * _.snakeCase('--foo-bar');
+     * // => 'foo_bar'
+     */
+    var snakeCase = createCompounder(function(result, word, index) {
+      return result + (index ? '_' : '') + word.toLowerCase();
+    });
+
+    /**
+     * Converts `string` to [start case](https://en.wikipedia.org/wiki/Letter_case#Stylistic_or_specialised_usage).
+     *
+     * @static
+     * @memberOf _
+     * @category String
+     * @param {string} [string=''] The string to convert.
+     * @returns {string} Returns the start cased string.
+     * @example
+     *
+     * _.startCase('--foo-bar');
+     * // => 'Foo Bar'
+     *
+     * _.startCase('fooBar');
+     * // => 'Foo Bar'
+     *
+     * _.startCase('__foo_bar__');
+     * // => 'Foo Bar'
+     */
+    var startCase = createCompounder(function(result, word, index) {
+      return result + (index ? ' ' : '') + (word.charAt(0).toUpperCase() + word.slice(1));
+    });
+
+    /**
+     * Checks if `string` starts with the given target string.
+     *
+     * @static
+     * @memberOf _
+     * @category String
+     * @param {string} [string=''] The string to search.
+     * @param {string} [target] The string to search for.
+     * @param {number} [position=0] The position to search from.
+     * @returns {boolean} Returns `true` if `string` starts with `target`, else `false`.
+     * @example
+     *
+     * _.startsWith('abc', 'a');
+     * // => true
+     *
+     * _.startsWith('abc', 'b');
+     * // => false
+     *
+     * _.startsWith('abc', 'b', 1);
+     * // => true
+     */
+    function startsWith(string, target, position) {
+      string = baseToString(string);
+      position = position == null
+        ? 0
+        : nativeMin(position < 0 ? 0 : (+position || 0), string.length);
+
+      return string.lastIndexOf(target, position) == position;
+    }
+
+    /**
+     * Creates a compiled template function that can interpolate data properties
+     * in "interpolate" delimiters, HTML-escape interpolated data properties in
+     * "escape" delimiters, and execute JavaScript in "evaluate" delimiters. Data
+     * properties may be accessed as free variables in the template. If a setting
+     * object is provided it takes precedence over `_.templateSettings` values.
+     *
+     * **Note:** In the development build `_.template` utilizes
+     * [sourceURLs](http://www.html5rocks.com/en/tutorials/developertools/sourcemaps/#toc-sourceurl)
+     * for easier debugging.
+     *
+     * For more information on precompiling templates see
+     * [lodash's custom builds documentation](https://lodash.com/custom-builds).
+     *
+     * For more information on Chrome extension sandboxes see
+     * [Chrome's extensions documentation](https://developer.chrome.com/extensions/sandboxingEval).
+     *
+     * @static
+     * @memberOf _
+     * @category String
+     * @param {string} [string=''] The template string.
+     * @param {Object} [options] The options object.
+     * @param {RegExp} [options.escape] The HTML "escape" delimiter.
+     * @param {RegExp} [options.evaluate] The "evaluate" delimiter.
+     * @param {Object} [options.imports] An object to import into the template as free variables.
+     * @param {RegExp} [options.interpolate] The "interpolate" delimiter.
+     * @param {string} [options.sourceURL] The sourceURL of the template's compiled source.
+     * @param {string} [options.variable] The data object variable name.
+     * @param- {Object} [otherOptions] Enables the legacy `options` param signature.
+     * @returns {Function} Returns the compiled template function.
+     * @example
+     *
+     * // using the "interpolate" delimiter to create a compiled template
+     * var compiled = _.template('hello <%= user %>!');
+     * compiled({ 'user': 'fred' });
+     * // => 'hello fred!'
+     *
+     * // using the HTML "escape" delimiter to escape data property values
+     * var compiled = _.template('<b><%- value %></b>');
+     * compiled({ 'value': '<script>' });
+     * // => '<b>&lt;script&gt;</b>'
+     *
+     * // using the "evaluate" delimiter to execute JavaScript and generate HTML
+     * var compiled = _.template('<% _.forEach(users, function(user) { %><li><%- user %></li><% }); %>');
+     * compiled({ 'users': ['fred', 'barney'] });
+     * // => '<li>fred</li><li>barney</li>'
+     *
+     * // using the internal `print` function in "evaluate" delimiters
+     * var compiled = _.template('<% print("hello " + user); %>!');
+     * compiled({ 'user': 'barney' });
+     * // => 'hello barney!'
+     *
+     * // using the ES delimiter as an alternative to the default "interpolate" delimiter
+     * var compiled = _.template('hello ${ user }!');
+     * compiled({ 'user': 'pebbles' });
+     * // => 'hello pebbles!'
+     *
+     * // using custom template delimiters
+     * _.templateSettings.interpolate = /{{([\s\S]+?)}}/g;
+     * var compiled = _.template('hello {{ user }}!');
+     * compiled({ 'user': 'mustache' });
+     * // => 'hello mustache!'
+     *
+     * // using backslashes to treat delimiters as plain text
+     * var compiled = _.template('<%= "\\<%- value %\\>" %>');
+     * compiled({ 'value': 'ignored' });
+     * // => '<%- value %>'
+     *
+     * // using the `imports` option to import `jQuery` as `jq`
+     * var text = '<% jq.each(users, function(user) { %><li><%- user %></li><% }); %>';
+     * var compiled = _.template(text, { 'imports': { 'jq': jQuery } });
+     * compiled({ 'users': ['fred', 'barney'] });
+     * // => '<li>fred</li><li>barney</li>'
+     *
+     * // using the `sourceURL` option to specify a custom sourceURL for the template
+     * var compiled = _.template('hello <%= user %>!', { 'sourceURL': '/basic/greeting.jst' });
+     * compiled(data);
+     * // => find the source of "greeting.jst" under the Sources tab or Resources panel of the web inspector
+     *
+     * // using the `variable` option to ensure a with-statement isn't used in the compiled template
+     * var compiled = _.template('hi <%= data.user %>!', { 'variable': 'data' });
+     * compiled.source;
+     * // => function(data) {
+     * //   var __t, __p = '';
+     * //   __p += 'hi ' + ((__t = ( data.user )) == null ? '' : __t) + '!';
+     * //   return __p;
+     * // }
+     *
+     * // using the `source` property to inline compiled templates for meaningful
+     * // line numbers in error messages and a stack trace
+     * fs.writeFileSync(path.join(cwd, 'jst.js'), '\
+     *   var JST = {\
+     *     "main": ' + _.template(mainText).source + '\
+     *   };\
+     * ');
+     */
+    function template(string, options, otherOptions) {
+      // Based on John Resig's `tmpl` implementation (http://ejohn.org/blog/javascript-micro-templating/)
+      // and Laura Doktorova's doT.js (https://github.com/olado/doT).
+      var settings = lodash.templateSettings;
+
+      if (otherOptions && isIterateeCall(string, options, otherOptions)) {
+        options = otherOptions = undefined;
+      }
+      string = baseToString(string);
+      options = assignWith(baseAssign({}, otherOptions || options), settings, assignOwnDefaults);
+
+      var imports = assignWith(baseAssign({}, options.imports), settings.imports, assignOwnDefaults),
+          importsKeys = keys(imports),
+          importsValues = baseValues(imports, importsKeys);
+
+      var isEscaping,
+          isEvaluating,
+          index = 0,
+          interpolate = options.interpolate || reNoMatch,
+          source = "__p += '";
+
+      // Compile the regexp to match each delimiter.
+      var reDelimiters = RegExp(
+        (options.escape || reNoMatch).source + '|' +
+        interpolate.source + '|' +
+        (interpolate === reInterpolate ? reEsTemplate : reNoMatch).source + '|' +
+        (options.evaluate || reNoMatch).source + '|$'
+      , 'g');
+
+      // Use a sourceURL for easier debugging.
+      var sourceURL = '//# sourceURL=' +
+        ('sourceURL' in options
+          ? options.sourceURL
+          : ('lodash.templateSources[' + (++templateCounter) + ']')
+        ) + '\n';
+
+      string.replace(reDelimiters, function(match, escapeValue, interpolateValue, esTemplateValue, evaluateValue, offset) {
+        interpolateValue || (interpolateValue = esTemplateValue);
+
+        // Escape characters that can't be included in string literals.
+        source += string.slice(index, offset).replace(reUnescapedString, escapeStringChar);
+
+        // Replace delimiters with snippets.
+        if (escapeValue) {
+          isEscaping = true;
+          source += "' +\n__e(" + escapeValue + ") +\n'";
+        }
+        if (evaluateValue) {
+          isEvaluating = true;
+          source += "';\n" + evaluateValue + ";\n__p += '";
+        }
+        if (interpolateValue) {
+          source += "' +\n((__t = (" + interpolateValue + ")) == null ? '' : __t) +\n'";
+        }
+        index = offset + match.length;
+
+        // The JS engine embedded in Adobe products requires returning the `match`
+        // string in order to produce the correct `offset` value.
+        return match;
+      });
+
+      source += "';\n";
+
+      // If `variable` is not specified wrap a with-statement around the generated
+      // code to add the data object to the top of the scope chain.
+      var variable = options.variable;
+      if (!variable) {
+        source = 'with (obj) {\n' + source + '\n}\n';
+      }
+      // Cleanup code by stripping empty strings.
+      source = (isEvaluating ? source.replace(reEmptyStringLeading, '') : source)
+        .replace(reEmptyStringMiddle, '$1')
+        .replace(reEmptyStringTrailing, '$1;');
+
+      // Frame code as the function body.
+      source = 'function(' + (variable || 'obj') + ') {\n' +
+        (variable
+          ? ''
+          : 'obj || (obj = {});\n'
+        ) +
+        "var __t, __p = ''" +
+        (isEscaping
+           ? ', __e = _.escape'
+           : ''
+        ) +
+        (isEvaluating
+          ? ', __j = Array.prototype.join;\n' +
+            "function print() { __p += __j.call(arguments, '') }\n"
+          : ';\n'
+        ) +
+        source +
+        'return __p\n}';
+
+      var result = attempt(function() {
+        return Function(importsKeys, sourceURL + 'return ' + source).apply(undefined, importsValues);
+      });
+
+      // Provide the compiled function's source by its `toString` method or
+      // the `source` property as a convenience for inlining compiled templates.
+      result.source = source;
+      if (isError(result)) {
+        throw result;
+      }
+      return result;
+    }
+
+    /**
+     * Removes leading and trailing whitespace or specified characters from `string`.
+     *
+     * @static
+     * @memberOf _
+     * @category String
+     * @param {string} [string=''] The string to trim.
+     * @param {string} [chars=whitespace] The characters to trim.
+     * @param- {Object} [guard] Enables use as a callback for functions like `_.map`.
+     * @returns {string} Returns the trimmed string.
+     * @example
+     *
+     * _.trim('  abc  ');
+     * // => 'abc'
+     *
+     * _.trim('-_-abc-_-', '_-');
+     * // => 'abc'
+     *
+     * _.map(['  foo  ', '  bar  '], _.trim);
+     * // => ['foo', 'bar']
+     */
+    function trim(string, chars, guard) {
+      var value = string;
+      string = baseToString(string);
+      if (!string) {
+        return string;
+      }
+      if (guard ? isIterateeCall(value, chars, guard) : chars == null) {
+        return string.slice(trimmedLeftIndex(string), trimmedRightIndex(string) + 1);
+      }
+      chars = (chars + '');
+      return string.slice(charsLeftIndex(string, chars), charsRightIndex(string, chars) + 1);
+    }
+
+    /**
+     * Removes leading whitespace or specified characters from `string`.
+     *
+     * @static
+     * @memberOf _
+     * @category String
+     * @param {string} [string=''] The string to trim.
+     * @param {string} [chars=whitespace] The characters to trim.
+     * @param- {Object} [guard] Enables use as a callback for functions like `_.map`.
+     * @returns {string} Returns the trimmed string.
+     * @example
+     *
+     * _.trimLeft('  abc  ');
+     * // => 'abc  '
+     *
+     * _.trimLeft('-_-abc-_-', '_-');
+     * // => 'abc-_-'
+     */
+    function trimLeft(string, chars, guard) {
+      var value = string;
+      string = baseToString(string);
+      if (!string) {
+        return string;
+      }
+      if (guard ? isIterateeCall(value, chars, guard) : chars == null) {
+        return string.slice(trimmedLeftIndex(string));
+      }
+      return string.slice(charsLeftIndex(string, (chars + '')));
+    }
+
+    /**
+     * Removes trailing whitespace or specified characters from `string`.
+     *
+     * @static
+     * @memberOf _
+     * @category String
+     * @param {string} [string=''] The string to trim.
+     * @param {string} [chars=whitespace] The characters to trim.
+     * @param- {Object} [guard] Enables use as a callback for functions like `_.map`.
+     * @returns {string} Returns the trimmed string.
+     * @example
+     *
+     * _.trimRight('  abc  ');
+     * // => '  abc'
+     *
+     * _.trimRight('-_-abc-_-', '_-');
+     * // => '-_-abc'
+     */
+    function trimRight(string, chars, guard) {
+      var value = string;
+      string = baseToString(string);
+      if (!string) {
+        return string;
+      }
+      if (guard ? isIterateeCall(value, chars, guard) : chars == null) {
+        return string.slice(0, trimmedRightIndex(string) + 1);
+      }
+      return string.slice(0, charsRightIndex(string, (chars + '')) + 1);
+    }
+
+    /**
+     * Truncates `string` if it's longer than the given maximum string length.
+     * The last characters of the truncated string are replaced with the omission
+     * string which defaults to "...".
+     *
+     * @static
+     * @memberOf _
+     * @category String
+     * @param {string} [string=''] The string to truncate.
+     * @param {Object|number} [options] The options object or maximum string length.
+     * @param {number} [options.length=30] The maximum string length.
+     * @param {string} [options.omission='...'] The string to indicate text is omitted.
+     * @param {RegExp|string} [options.separator] The separator pattern to truncate to.
+     * @param- {Object} [guard] Enables use as a callback for functions like `_.map`.
+     * @returns {string} Returns the truncated string.
+     * @example
+     *
+     * _.trunc('hi-diddly-ho there, neighborino');
+     * // => 'hi-diddly-ho there, neighbo...'
+     *
+     * _.trunc('hi-diddly-ho there, neighborino', 24);
+     * // => 'hi-diddly-ho there, n...'
+     *
+     * _.trunc('hi-diddly-ho there, neighborino', {
+     *   'length': 24,
+     *   'separator': ' '
+     * });
+     * // => 'hi-diddly-ho there,...'
+     *
+     * _.trunc('hi-diddly-ho there, neighborino', {
+     *   'length': 24,
+     *   'separator': /,? +/
+     * });
+     * // => 'hi-diddly-ho there...'
+     *
+     * _.trunc('hi-diddly-ho there, neighborino', {
+     *   'omission': ' [...]'
+     * });
+     * // => 'hi-diddly-ho there, neig [...]'
+     */
+    function trunc(string, options, guard) {
+      if (guard && isIterateeCall(string, options, guard)) {
+        options = undefined;
+      }
+      var length = DEFAULT_TRUNC_LENGTH,
+          omission = DEFAULT_TRUNC_OMISSION;
+
+      if (options != null) {
+        if (isObject(options)) {
+          var separator = 'separator' in options ? options.separator : separator;
+          length = 'length' in options ? (+options.length || 0) : length;
+          omission = 'omission' in options ? baseToString(options.omission) : omission;
+        } else {
+          length = +options || 0;
+        }
+      }
+      string = baseToString(string);
+      if (length >= string.length) {
+        return string;
+      }
+      var end = length - omission.length;
+      if (end < 1) {
+        return omission;
+      }
+      var result = string.slice(0, end);
+      if (separator == null) {
+        return result + omission;
+      }
+      if (isRegExp(separator)) {
+        if (string.slice(end).search(separator)) {
+          var match,
+              newEnd,
+              substring = string.slice(0, end);
+
+          if (!separator.global) {
+            separator = RegExp(separator.source, (reFlags.exec(separator) || '') + 'g');
+          }
+          separator.lastIndex = 0;
+          while ((match = separator.exec(substring))) {
+            newEnd = match.index;
+          }
+          result = result.slice(0, newEnd == null ? end : newEnd);
+        }
+      } else if (string.indexOf(separator, end) != end) {
+        var index = result.lastIndexOf(separator);
+        if (index > -1) {
+          result = result.slice(0, index);
+        }
+      }
+      return result + omission;
+    }
+
+    /**
+     * The inverse of `_.escape`; this method converts the HTML entities
+     * `&amp;`, `&lt;`, `&gt;`, `&quot;`, `&#39;`, and `&#96;` in `string` to their
+     * corresponding characters.
+     *
+     * **Note:** No other HTML entities are unescaped. To unescape additional HTML
+     * entities use a third-party library like [_he_](https://mths.be/he).
+     *
+     * @static
+     * @memberOf _
+     * @category String
+     * @param {string} [string=''] The string to unescape.
+     * @returns {string} Returns the unescaped string.
+     * @example
+     *
+     * _.unescape('fred, barney, &amp; pebbles');
+     * // => 'fred, barney, & pebbles'
+     */
+    function unescape(string) {
+      string = baseToString(string);
+      return (string && reHasEscapedHtml.test(string))
+        ? string.replace(reEscapedHtml, unescapeHtmlChar)
+        : string;
+    }
+
+    /**
+     * Splits `string` into an array of its words.
+     *
+     * @static
+     * @memberOf _
+     * @category String
+     * @param {string} [string=''] The string to inspect.
+     * @param {RegExp|string} [pattern] The pattern to match words.
+     * @param- {Object} [guard] Enables use as a callback for functions like `_.map`.
+     * @returns {Array} Returns the words of `string`.
+     * @example
+     *
+     * _.words('fred, barney, & pebbles');
+     * // => ['fred', 'barney', 'pebbles']
+     *
+     * _.words('fred, barney, & pebbles', /[^, ]+/g);
+     * // => ['fred', 'barney', '&', 'pebbles']
+     */
+    function words(string, pattern, guard) {
+      if (guard && isIterateeCall(string, pattern, guard)) {
+        pattern = undefined;
+      }
+      string = baseToString(string);
+      return string.match(pattern || reWords) || [];
+    }
+
+    /*------------------------------------------------------------------------*/
+
+    /**
+     * Attempts to invoke `func`, returning either the result or the caught error
+     * object. Any additional arguments are provided to `func` when it's invoked.
+     *
+     * @static
+     * @memberOf _
+     * @category Utility
+     * @param {Function} func The function to attempt.
+     * @returns {*} Returns the `func` result or error object.
+     * @example
+     *
+     * // avoid throwing errors for invalid selectors
+     * var elements = _.attempt(function(selector) {
+     *   return document.querySelectorAll(selector);
+     * }, '>_>');
+     *
+     * if (_.isError(elements)) {
+     *   elements = [];
+     * }
+     */
+    var attempt = restParam(function(func, args) {
+      try {
+        return func.apply(undefined, args);
+      } catch(e) {
+        return isError(e) ? e : new Error(e);
+      }
+    });
+
+    /**
+     * Creates a function that invokes `func` with the `this` binding of `thisArg`
+     * and arguments of the created function. If `func` is a property name the
+     * created callback returns the property value for a given element. If `func`
+     * is an object the created callback returns `true` for elements that contain
+     * the equivalent object properties, otherwise it returns `false`.
+     *
+     * @static
+     * @memberOf _
+     * @alias iteratee
+     * @category Utility
+     * @param {*} [func=_.identity] The value to convert to a callback.
+     * @param {*} [thisArg] The `this` binding of `func`.
+     * @param- {Object} [guard] Enables use as a callback for functions like `_.map`.
+     * @returns {Function} Returns the callback.
+     * @example
+     *
+     * var users = [
+     *   { 'user': 'barney', 'age': 36 },
+     *   { 'user': 'fred',   'age': 40 }
+     * ];
+     *
+     * // wrap to create custom callback shorthands
+     * _.callback = _.wrap(_.callback, function(callback, func, thisArg) {
+     *   var match = /^(.+?)__([gl]t)(.+)$/.exec(func);
+     *   if (!match) {
+     *     return callback(func, thisArg);
+     *   }
+     *   return function(object) {
+     *     return match[2] == 'gt'
+     *       ? object[match[1]] > match[3]
+     *       : object[match[1]] < match[3];
+     *   };
+     * });
+     *
+     * _.filter(users, 'age__gt36');
+     * // => [{ 'user': 'fred', 'age': 40 }]
+     */
+    function callback(func, thisArg, guard) {
+      if (guard && isIterateeCall(func, thisArg, guard)) {
+        thisArg = undefined;
+      }
+      return isObjectLike(func)
+        ? matches(func)
+        : baseCallback(func, thisArg);
+    }
+
+    /**
+     * Creates a function that returns `value`.
+     *
+     * @static
+     * @memberOf _
+     * @category Utility
+     * @param {*} value The value to return from the new function.
+     * @returns {Function} Returns the new function.
+     * @example
+     *
+     * var object = { 'user': 'fred' };
+     * var getter = _.constant(object);
+     *
+     * getter() === object;
+     * // => true
+     */
+    function constant(value) {
+      return function() {
+        return value;
+      };
+    }
+
+    /**
+     * This method returns the first argument provided to it.
+     *
+     * @static
+     * @memberOf _
+     * @category Utility
+     * @param {*} value Any value.
+     * @returns {*} Returns `value`.
+     * @example
+     *
+     * var object = { 'user': 'fred' };
+     *
+     * _.identity(object) === object;
+     * // => true
+     */
+    function identity(value) {
+      return value;
+    }
+
+    /**
+     * Creates a function that performs a deep comparison between a given object
+     * and `source`, returning `true` if the given object has equivalent property
+     * values, else `false`.
+     *
+     * **Note:** This method supports comparing arrays, booleans, `Date` objects,
+     * numbers, `Object` objects, regexes, and strings. Objects are compared by
+     * their own, not inherited, enumerable properties. For comparing a single
+     * own or inherited property value see `_.matchesProperty`.
+     *
+     * @static
+     * @memberOf _
+     * @category Utility
+     * @param {Object} source The object of property values to match.
+     * @returns {Function} Returns the new function.
+     * @example
+     *
+     * var users = [
+     *   { 'user': 'barney', 'age': 36, 'active': true },
+     *   { 'user': 'fred',   'age': 40, 'active': false }
+     * ];
+     *
+     * _.filter(users, _.matches({ 'age': 40, 'active': false }));
+     * // => [{ 'user': 'fred', 'age': 40, 'active': false }]
+     */
+    function matches(source) {
+      return baseMatches(baseClone(source, true));
+    }
+
+    /**
+     * Creates a function that compares the property value of `path` on a given
+     * object to `value`.
+     *
+     * **Note:** This method supports comparing arrays, booleans, `Date` objects,
+     * numbers, `Object` objects, regexes, and strings. Objects are compared by
+     * their own, not inherited, enumerable properties.
+     *
+     * @static
+     * @memberOf _
+     * @category Utility
+     * @param {Array|string} path The path of the property to get.
+     * @param {*} srcValue The value to match.
+     * @returns {Function} Returns the new function.
+     * @example
+     *
+     * var users = [
+     *   { 'user': 'barney' },
+     *   { 'user': 'fred' }
+     * ];
+     *
+     * _.find(users, _.matchesProperty('user', 'fred'));
+     * // => { 'user': 'fred' }
+     */
+    function matchesProperty(path, srcValue) {
+      return baseMatchesProperty(path, baseClone(srcValue, true));
+    }
+
+    /**
+     * Creates a function that invokes the method at `path` on a given object.
+     * Any additional arguments are provided to the invoked method.
+     *
+     * @static
+     * @memberOf _
+     * @category Utility
+     * @param {Array|string} path The path of the method to invoke.
+     * @param {...*} [args] The arguments to invoke the method with.
+     * @returns {Function} Returns the new function.
+     * @example
+     *
+     * var objects = [
+     *   { 'a': { 'b': { 'c': _.constant(2) } } },
+     *   { 'a': { 'b': { 'c': _.constant(1) } } }
+     * ];
+     *
+     * _.map(objects, _.method('a.b.c'));
+     * // => [2, 1]
+     *
+     * _.invoke(_.sortBy(objects, _.method(['a', 'b', 'c'])), 'a.b.c');
+     * // => [1, 2]
+     */
+    var method = restParam(function(path, args) {
+      return function(object) {
+        return invokePath(object, path, args);
+      };
+    });
+
+    /**
+     * The opposite of `_.method`; this method creates a function that invokes
+     * the method at a given path on `object`. Any additional arguments are
+     * provided to the invoked method.
+     *
+     * @static
+     * @memberOf _
+     * @category Utility
+     * @param {Object} object The object to query.
+     * @param {...*} [args] The arguments to invoke the method with.
+     * @returns {Function} Returns the new function.
+     * @example
+     *
+     * var array = _.times(3, _.constant),
+     *     object = { 'a': array, 'b': array, 'c': array };
+     *
+     * _.map(['a[2]', 'c[0]'], _.methodOf(object));
+     * // => [2, 0]
+     *
+     * _.map([['a', '2'], ['c', '0']], _.methodOf(object));
+     * // => [2, 0]
+     */
+    var methodOf = restParam(function(object, args) {
+      return function(path) {
+        return invokePath(object, path, args);
+      };
+    });
+
+    /**
+     * Adds all own enumerable function properties of a source object to the
+     * destination object. If `object` is a function then methods are added to
+     * its prototype as well.
+     *
+     * **Note:** Use `_.runInContext` to create a pristine `lodash` function to
+     * avoid conflicts caused by modifying the original.
+     *
+     * @static
+     * @memberOf _
+     * @category Utility
+     * @param {Function|Object} [object=lodash] The destination object.
+     * @param {Object} source The object of functions to add.
+     * @param {Object} [options] The options object.
+     * @param {boolean} [options.chain=true] Specify whether the functions added
+     *  are chainable.
+     * @returns {Function|Object} Returns `object`.
+     * @example
+     *
+     * function vowels(string) {
+     *   return _.filter(string, function(v) {
+     *     return /[aeiou]/i.test(v);
+     *   });
+     * }
+     *
+     * _.mixin({ 'vowels': vowels });
+     * _.vowels('fred');
+     * // => ['e']
+     *
+     * _('fred').vowels().value();
+     * // => ['e']
+     *
+     * _.mixin({ 'vowels': vowels }, { 'chain': false });
+     * _('fred').vowels();
+     * // => ['e']
+     */
+    function mixin(object, source, options) {
+      if (options == null) {
+        var isObj = isObject(source),
+            props = isObj ? keys(source) : undefined,
+            methodNames = (props && props.length) ? baseFunctions(source, props) : undefined;
+
+        if (!(methodNames ? methodNames.length : isObj)) {
+          methodNames = false;
+          options = source;
+          source = object;
+          object = this;
+        }
+      }
+      if (!methodNames) {
+        methodNames = baseFunctions(source, keys(source));
+      }
+      var chain = true,
+          index = -1,
+          isFunc = isFunction(object),
+          length = methodNames.length;
+
+      if (options === false) {
+        chain = false;
+      } else if (isObject(options) && 'chain' in options) {
+        chain = options.chain;
+      }
+      while (++index < length) {
+        var methodName = methodNames[index],
+            func = source[methodName];
+
+        object[methodName] = func;
+        if (isFunc) {
+          object.prototype[methodName] = (function(func) {
+            return function() {
+              var chainAll = this.__chain__;
+              if (chain || chainAll) {
+                var result = object(this.__wrapped__),
+                    actions = result.__actions__ = arrayCopy(this.__actions__);
+
+                actions.push({ 'func': func, 'args': arguments, 'thisArg': object });
+                result.__chain__ = chainAll;
+                return result;
+              }
+              return func.apply(object, arrayPush([this.value()], arguments));
+            };
+          }(func));
+        }
+      }
+      return object;
+    }
+
+    /**
+     * Reverts the `_` variable to its previous value and returns a reference to
+     * the `lodash` function.
+     *
+     * @static
+     * @memberOf _
+     * @category Utility
+     * @returns {Function} Returns the `lodash` function.
+     * @example
+     *
+     * var lodash = _.noConflict();
+     */
+    function noConflict() {
+      root._ = oldDash;
+      return this;
+    }
+
+    /**
+     * A no-operation function that returns `undefined` regardless of the
+     * arguments it receives.
+     *
+     * @static
+     * @memberOf _
+     * @category Utility
+     * @example
+     *
+     * var object = { 'user': 'fred' };
+     *
+     * _.noop(object) === undefined;
+     * // => true
+     */
+    function noop() {
+      // No operation performed.
+    }
+
+    /**
+     * Creates a function that returns the property value at `path` on a
+     * given object.
+     *
+     * @static
+     * @memberOf _
+     * @category Utility
+     * @param {Array|string} path The path of the property to get.
+     * @returns {Function} Returns the new function.
+     * @example
+     *
+     * var objects = [
+     *   { 'a': { 'b': { 'c': 2 } } },
+     *   { 'a': { 'b': { 'c': 1 } } }
+     * ];
+     *
+     * _.map(objects, _.property('a.b.c'));
+     * // => [2, 1]
+     *
+     * _.pluck(_.sortBy(objects, _.property(['a', 'b', 'c'])), 'a.b.c');
+     * // => [1, 2]
+     */
+    function property(path) {
+      return isKey(path) ? baseProperty(path) : basePropertyDeep(path);
+    }
+
+    /**
+     * The opposite of `_.property`; this method creates a function that returns
+     * the property value at a given path on `object`.
+     *
+     * @static
+     * @memberOf _
+     * @category Utility
+     * @param {Object} object The object to query.
+     * @returns {Function} Returns the new function.
+     * @example
+     *
+     * var array = [0, 1, 2],
+     *     object = { 'a': array, 'b': array, 'c': array };
+     *
+     * _.map(['a[2]', 'c[0]'], _.propertyOf(object));
+     * // => [2, 0]
+     *
+     * _.map([['a', '2'], ['c', '0']], _.propertyOf(object));
+     * // => [2, 0]
+     */
+    function propertyOf(object) {
+      return function(path) {
+        return baseGet(object, toPath(path), (path + ''));
+      };
+    }
+
+    /**
+     * Creates an array of numbers (positive and/or negative) progressing from
+     * `start` up to, but not including, `end`. If `end` is not specified it's
+     * set to `start` with `start` then set to `0`. If `end` is less than `start`
+     * a zero-length range is created unless a negative `step` is specified.
+     *
+     * @static
+     * @memberOf _
+     * @category Utility
+     * @param {number} [start=0] The start of the range.
+     * @param {number} end The end of the range.
+     * @param {number} [step=1] The value to increment or decrement by.
+     * @returns {Array} Returns the new array of numbers.
+     * @example
+     *
+     * _.range(4);
+     * // => [0, 1, 2, 3]
+     *
+     * _.range(1, 5);
+     * // => [1, 2, 3, 4]
+     *
+     * _.range(0, 20, 5);
+     * // => [0, 5, 10, 15]
+     *
+     * _.range(0, -4, -1);
+     * // => [0, -1, -2, -3]
+     *
+     * _.range(1, 4, 0);
+     * // => [1, 1, 1]
+     *
+     * _.range(0);
+     * // => []
+     */
+    function range(start, end, step) {
+      if (step && isIterateeCall(start, end, step)) {
+        end = step = undefined;
+      }
+      start = +start || 0;
+      step = step == null ? 1 : (+step || 0);
+
+      if (end == null) {
+        end = start;
+        start = 0;
+      } else {
+        end = +end || 0;
+      }
+      // Use `Array(length)` so engines like Chakra and V8 avoid slower modes.
+      // See https://youtu.be/XAqIpGU8ZZk#t=17m25s for more details.
+      var index = -1,
+          length = nativeMax(nativeCeil((end - start) / (step || 1)), 0),
+          result = Array(length);
+
+      while (++index < length) {
+        result[index] = start;
+        start += step;
+      }
+      return result;
+    }
+
+    /**
+     * Invokes the iteratee function `n` times, returning an array of the results
+     * of each invocation. The `iteratee` is bound to `thisArg` and invoked with
+     * one argument; (index).
+     *
+     * @static
+     * @memberOf _
+     * @category Utility
+     * @param {number} n The number of times to invoke `iteratee`.
+     * @param {Function} [iteratee=_.identity] The function invoked per iteration.
+     * @param {*} [thisArg] The `this` binding of `iteratee`.
+     * @returns {Array} Returns the array of results.
+     * @example
+     *
+     * var diceRolls = _.times(3, _.partial(_.random, 1, 6, false));
+     * // => [3, 6, 4]
+     *
+     * _.times(3, function(n) {
+     *   mage.castSpell(n);
+     * });
+     * // => invokes `mage.castSpell(n)` three times with `n` of `0`, `1`, and `2`
+     *
+     * _.times(3, function(n) {
+     *   this.cast(n);
+     * }, mage);
+     * // => also invokes `mage.castSpell(n)` three times
+     */
+    function times(n, iteratee, thisArg) {
+      n = nativeFloor(n);
+
+      // Exit early to avoid a JSC JIT bug in Safari 8
+      // where `Array(0)` is treated as `Array(1)`.
+      if (n < 1 || !nativeIsFinite(n)) {
+        return [];
+      }
+      var index = -1,
+          result = Array(nativeMin(n, MAX_ARRAY_LENGTH));
+
+      iteratee = bindCallback(iteratee, thisArg, 1);
+      while (++index < n) {
+        if (index < MAX_ARRAY_LENGTH) {
+          result[index] = iteratee(index);
+        } else {
+          iteratee(index);
+        }
+      }
+      return result;
+    }
+
+    /**
+     * Generates a unique ID. If `prefix` is provided the ID is appended to it.
+     *
+     * @static
+     * @memberOf _
+     * @category Utility
+     * @param {string} [prefix] The value to prefix the ID with.
+     * @returns {string} Returns the unique ID.
+     * @example
+     *
+     * _.uniqueId('contact_');
+     * // => 'contact_104'
+     *
+     * _.uniqueId();
+     * // => '105'
+     */
+    function uniqueId(prefix) {
+      var id = ++idCounter;
+      return baseToString(prefix) + id;
+    }
+
+    /*------------------------------------------------------------------------*/
+
+    /**
+     * Adds two numbers.
+     *
+     * @static
+     * @memberOf _
+     * @category Math
+     * @param {number} augend The first number to add.
+     * @param {number} addend The second number to add.
+     * @returns {number} Returns the sum.
+     * @example
+     *
+     * _.add(6, 4);
+     * // => 10
+     */
+    function add(augend, addend) {
+      return (+augend || 0) + (+addend || 0);
+    }
+
+    /**
+     * Calculates `n` rounded up to `precision`.
+     *
+     * @static
+     * @memberOf _
+     * @category Math
+     * @param {number} n The number to round up.
+     * @param {number} [precision=0] The precision to round up to.
+     * @returns {number} Returns the rounded up number.
+     * @example
+     *
+     * _.ceil(4.006);
+     * // => 5
+     *
+     * _.ceil(6.004, 2);
+     * // => 6.01
+     *
+     * _.ceil(6040, -2);
+     * // => 6100
+     */
+    var ceil = createRound('ceil');
+
+    /**
+     * Calculates `n` rounded down to `precision`.
+     *
+     * @static
+     * @memberOf _
+     * @category Math
+     * @param {number} n The number to round down.
+     * @param {number} [precision=0] The precision to round down to.
+     * @returns {number} Returns the rounded down number.
+     * @example
+     *
+     * _.floor(4.006);
+     * // => 4
+     *
+     * _.floor(0.046, 2);
+     * // => 0.04
+     *
+     * _.floor(4060, -2);
+     * // => 4000
+     */
+    var floor = createRound('floor');
+
+    /**
+     * Gets the maximum value of `collection`. If `collection` is empty or falsey
+     * `-Infinity` is returned. If an iteratee function is provided it's invoked
+     * for each value in `collection` to generate the criterion by which the value
+     * is ranked. The `iteratee` is bound to `thisArg` and invoked with three
+     * arguments: (value, index, collection).
+     *
+     * If a property name is provided for `iteratee` the created `_.property`
+     * style callback returns the property value of the given element.
+     *
+     * If a value is also provided for `thisArg` the created `_.matchesProperty`
+     * style callback returns `true` for elements that have a matching property
+     * value, else `false`.
+     *
+     * If an object is provided for `iteratee` the created `_.matches` style
+     * callback returns `true` for elements that have the properties of the given
+     * object, else `false`.
+     *
+     * @static
+     * @memberOf _
+     * @category Math
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {Function|Object|string} [iteratee] The function invoked per iteration.
+     * @param {*} [thisArg] The `this` binding of `iteratee`.
+     * @returns {*} Returns the maximum value.
+     * @example
+     *
+     * _.max([4, 2, 8, 6]);
+     * // => 8
+     *
+     * _.max([]);
+     * // => -Infinity
+     *
+     * var users = [
+     *   { 'user': 'barney', 'age': 36 },
+     *   { 'user': 'fred',   'age': 40 }
+     * ];
+     *
+     * _.max(users, function(chr) {
+     *   return chr.age;
+     * });
+     * // => { 'user': 'fred', 'age': 40 }
+     *
+     * // using the `_.property` callback shorthand
+     * _.max(users, 'age');
+     * // => { 'user': 'fred', 'age': 40 }
+     */
+    var max = createExtremum(gt, NEGATIVE_INFINITY);
+
+    /**
+     * Gets the minimum value of `collection`. If `collection` is empty or falsey
+     * `Infinity` is returned. If an iteratee function is provided it's invoked
+     * for each value in `collection` to generate the criterion by which the value
+     * is ranked. The `iteratee` is bound to `thisArg` and invoked with three
+     * arguments: (value, index, collection).
+     *
+     * If a property name is provided for `iteratee` the created `_.property`
+     * style callback returns the property value of the given element.
+     *
+     * If a value is also provided for `thisArg` the created `_.matchesProperty`
+     * style callback returns `true` for elements that have a matching property
+     * value, else `false`.
+     *
+     * If an object is provided for `iteratee` the created `_.matches` style
+     * callback returns `true` for elements that have the properties of the given
+     * object, else `false`.
+     *
+     * @static
+     * @memberOf _
+     * @category Math
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {Function|Object|string} [iteratee] The function invoked per iteration.
+     * @param {*} [thisArg] The `this` binding of `iteratee`.
+     * @returns {*} Returns the minimum value.
+     * @example
+     *
+     * _.min([4, 2, 8, 6]);
+     * // => 2
+     *
+     * _.min([]);
+     * // => Infinity
+     *
+     * var users = [
+     *   { 'user': 'barney', 'age': 36 },
+     *   { 'user': 'fred',   'age': 40 }
+     * ];
+     *
+     * _.min(users, function(chr) {
+     *   return chr.age;
+     * });
+     * // => { 'user': 'barney', 'age': 36 }
+     *
+     * // using the `_.property` callback shorthand
+     * _.min(users, 'age');
+     * // => { 'user': 'barney', 'age': 36 }
+     */
+    var min = createExtremum(lt, POSITIVE_INFINITY);
+
+    /**
+     * Calculates `n` rounded to `precision`.
+     *
+     * @static
+     * @memberOf _
+     * @category Math
+     * @param {number} n The number to round.
+     * @param {number} [precision=0] The precision to round to.
+     * @returns {number} Returns the rounded number.
+     * @example
+     *
+     * _.round(4.006);
+     * // => 4
+     *
+     * _.round(4.006, 2);
+     * // => 4.01
+     *
+     * _.round(4060, -2);
+     * // => 4100
+     */
+    var round = createRound('round');
+
+    /**
+     * Gets the sum of the values in `collection`.
+     *
+     * @static
+     * @memberOf _
+     * @category Math
+     * @param {Array|Object|string} collection The collection to iterate over.
+     * @param {Function|Object|string} [iteratee] The function invoked per iteration.
+     * @param {*} [thisArg] The `this` binding of `iteratee`.
+     * @returns {number} Returns the sum.
+     * @example
+     *
+     * _.sum([4, 6]);
+     * // => 10
+     *
+     * _.sum({ 'a': 4, 'b': 6 });
+     * // => 10
+     *
+     * var objects = [
+     *   { 'n': 4 },
+     *   { 'n': 6 }
+     * ];
+     *
+     * _.sum(objects, function(object) {
+     *   return object.n;
+     * });
+     * // => 10
+     *
+     * // using the `_.property` callback shorthand
+     * _.sum(objects, 'n');
+     * // => 10
+     */
+    function sum(collection, iteratee, thisArg) {
+      if (thisArg && isIterateeCall(collection, iteratee, thisArg)) {
+        iteratee = undefined;
+      }
+      iteratee = getCallback(iteratee, thisArg, 3);
+      return iteratee.length == 1
+        ? arraySum(isArray(collection) ? collection : toIterable(collection), iteratee)
+        : baseSum(collection, iteratee);
+    }
+
+    /*------------------------------------------------------------------------*/
+
+    // Ensure wrappers are instances of `baseLodash`.
+    lodash.prototype = baseLodash.prototype;
+
+    LodashWrapper.prototype = baseCreate(baseLodash.prototype);
+    LodashWrapper.prototype.constructor = LodashWrapper;
+
+    LazyWrapper.prototype = baseCreate(baseLodash.prototype);
+    LazyWrapper.prototype.constructor = LazyWrapper;
+
+    // Add functions to the `Map` cache.
+    MapCache.prototype['delete'] = mapDelete;
+    MapCache.prototype.get = mapGet;
+    MapCache.prototype.has = mapHas;
+    MapCache.prototype.set = mapSet;
+
+    // Add functions to the `Set` cache.
+    SetCache.prototype.push = cachePush;
+
+    // Assign cache to `_.memoize`.
+    memoize.Cache = MapCache;
+
+    // Add functions that return wrapped values when chaining.
+    lodash.after = after;
+    lodash.ary = ary;
+    lodash.assign = assign;
+    lodash.at = at;
+    lodash.before = before;
+    lodash.bind = bind;
+    lodash.bindAll = bindAll;
+    lodash.bindKey = bindKey;
+    lodash.callback = callback;
+    lodash.chain = chain;
+    lodash.chunk = chunk;
+    lodash.compact = compact;
+    lodash.constant = constant;
+    lodash.countBy = countBy;
+    lodash.create = create;
+    lodash.curry = curry;
+    lodash.curryRight = curryRight;
+    lodash.debounce = debounce;
+    lodash.defaults = defaults;
+    lodash.defaultsDeep = defaultsDeep;
+    lodash.defer = defer;
+    lodash.delay = delay;
+    lodash.difference = difference;
+    lodash.drop = drop;
+    lodash.dropRight = dropRight;
+    lodash.dropRightWhile = dropRightWhile;
+    lodash.dropWhile = dropWhile;
+    lodash.fill = fill;
+    lodash.filter = filter;
+    lodash.flatten = flatten;
+    lodash.flattenDeep = flattenDeep;
+    lodash.flow = flow;
+    lodash.flowRight = flowRight;
+    lodash.forEach = forEach;
+    lodash.forEachRight = forEachRight;
+    lodash.forIn = forIn;
+    lodash.forInRight = forInRight;
+    lodash.forOwn = forOwn;
+    lodash.forOwnRight = forOwnRight;
+    lodash.functions = functions;
+    lodash.groupBy = groupBy;
+    lodash.indexBy = indexBy;
+    lodash.initial = initial;
+    lodash.intersection = intersection;
+    lodash.invert = invert;
+    lodash.invoke = invoke;
+    lodash.keys = keys;
+    lodash.keysIn = keysIn;
+    lodash.map = map;
+    lodash.mapKeys = mapKeys;
+    lodash.mapValues = mapValues;
+    lodash.matches = matches;
+    lodash.matchesProperty = matchesProperty;
+    lodash.memoize = memoize;
+    lodash.merge = merge;
+    lodash.method = method;
+    lodash.methodOf = methodOf;
+    lodash.mixin = mixin;
+    lodash.modArgs = modArgs;
+    lodash.negate = negate;
+    lodash.omit = omit;
+    lodash.once = once;
+    lodash.pairs = pairs;
+    lodash.partial = partial;
+    lodash.partialRight = partialRight;
+    lodash.partition = partition;
+    lodash.pick = pick;
+    lodash.pluck = pluck;
+    lodash.property = property;
+    lodash.propertyOf = propertyOf;
+    lodash.pull = pull;
+    lodash.pullAt = pullAt;
+    lodash.range = range;
+    lodash.rearg = rearg;
+    lodash.reject = reject;
+    lodash.remove = remove;
+    lodash.rest = rest;
+    lodash.restParam = restParam;
+    lodash.set = set;
+    lodash.shuffle = shuffle;
+    lodash.slice = slice;
+    lodash.sortBy = sortBy;
+    lodash.sortByAll = sortByAll;
+    lodash.sortByOrder = sortByOrder;
+    lodash.spread = spread;
+    lodash.take = take;
+    lodash.takeRight = takeRight;
+    lodash.takeRightWhile = takeRightWhile;
+    lodash.takeWhile = takeWhile;
+    lodash.tap = tap;
+    lodash.throttle = throttle;
+    lodash.thru = thru;
+    lodash.times = times;
+    lodash.toArray = toArray;
+    lodash.toPlainObject = toPlainObject;
+    lodash.transform = transform;
+    lodash.union = union;
+    lodash.uniq = uniq;
+    lodash.unzip = unzip;
+    lodash.unzipWith = unzipWith;
+    lodash.values = values;
+    lodash.valuesIn = valuesIn;
+    lodash.where = where;
+    lodash.without = without;
+    lodash.wrap = wrap;
+    lodash.xor = xor;
+    lodash.zip = zip;
+    lodash.zipObject = zipObject;
+    lodash.zipWith = zipWith;
+
+    // Add aliases.
+    lodash.backflow = flowRight;
+    lodash.collect = map;
+    lodash.compose = flowRight;
+    lodash.each = forEach;
+    lodash.eachRight = forEachRight;
+    lodash.extend = assign;
+    lodash.iteratee = callback;
+    lodash.methods = functions;
+    lodash.object = zipObject;
+    lodash.select = filter;
+    lodash.tail = rest;
+    lodash.unique = uniq;
+
+    // Add functions to `lodash.prototype`.
+    mixin(lodash, lodash);
+
+    /*------------------------------------------------------------------------*/
+
+    // Add functions that return unwrapped values when chaining.
+    lodash.add = add;
+    lodash.attempt = attempt;
+    lodash.camelCase = camelCase;
+    lodash.capitalize = capitalize;
+    lodash.ceil = ceil;
+    lodash.clone = clone;
+    lodash.cloneDeep = cloneDeep;
+    lodash.deburr = deburr;
+    lodash.endsWith = endsWith;
+    lodash.escape = escape;
+    lodash.escapeRegExp = escapeRegExp;
+    lodash.every = every;
+    lodash.find = find;
+    lodash.findIndex = findIndex;
+    lodash.findKey = findKey;
+    lodash.findLast = findLast;
+    lodash.findLastIndex = findLastIndex;
+    lodash.findLastKey = findLastKey;
+    lodash.findWhere = findWhere;
+    lodash.first = first;
+    lodash.floor = floor;
+    lodash.get = get;
+    lodash.gt = gt;
+    lodash.gte = gte;
+    lodash.has = has;
+    lodash.identity = identity;
+    lodash.includes = includes;
+    lodash.indexOf = indexOf;
+    lodash.inRange = inRange;
+    lodash.isArguments = isArguments;
+    lodash.isArray = isArray;
+    lodash.isBoolean = isBoolean;
+    lodash.isDate = isDate;
+    lodash.isElement = isElement;
+    lodash.isEmpty = isEmpty;
+    lodash.isEqual = isEqual;
+    lodash.isError = isError;
+    lodash.isFinite = isFinite;
+    lodash.isFunction = isFunction;
+    lodash.isMatch = isMatch;
+    lodash.isNaN = isNaN;
+    lodash.isNative = isNative;
+    lodash.isNull = isNull;
+    lodash.isNumber = isNumber;
+    lodash.isObject = isObject;
+    lodash.isPlainObject = isPlainObject;
+    lodash.isRegExp = isRegExp;
+    lodash.isString = isString;
+    lodash.isTypedArray = isTypedArray;
+    lodash.isUndefined = isUndefined;
+    lodash.kebabCase = kebabCase;
+    lodash.last = last;
+    lodash.lastIndexOf = lastIndexOf;
+    lodash.lt = lt;
+    lodash.lte = lte;
+    lodash.max = max;
+    lodash.min = min;
+    lodash.noConflict = noConflict;
+    lodash.noop = noop;
+    lodash.now = now;
+    lodash.pad = pad;
+    lodash.padLeft = padLeft;
+    lodash.padRight = padRight;
+    lodash.parseInt = parseInt;
+    lodash.random = random;
+    lodash.reduce = reduce;
+    lodash.reduceRight = reduceRight;
+    lodash.repeat = repeat;
+    lodash.result = result;
+    lodash.round = round;
+    lodash.runInContext = runInContext;
+    lodash.size = size;
+    lodash.snakeCase = snakeCase;
+    lodash.some = some;
+    lodash.sortedIndex = sortedIndex;
+    lodash.sortedLastIndex = sortedLastIndex;
+    lodash.startCase = startCase;
+    lodash.startsWith = startsWith;
+    lodash.sum = sum;
+    lodash.template = template;
+    lodash.trim = trim;
+    lodash.trimLeft = trimLeft;
+    lodash.trimRight = trimRight;
+    lodash.trunc = trunc;
+    lodash.unescape = unescape;
+    lodash.uniqueId = uniqueId;
+    lodash.words = words;
+
+    // Add aliases.
+    lodash.all = every;
+    lodash.any = some;
+    lodash.contains = includes;
+    lodash.eq = isEqual;
+    lodash.detect = find;
+    lodash.foldl = reduce;
+    lodash.foldr = reduceRight;
+    lodash.head = first;
+    lodash.include = includes;
+    lodash.inject = reduce;
+
+    mixin(lodash, (function() {
+      var source = {};
+      baseForOwn(lodash, function(func, methodName) {
+        if (!lodash.prototype[methodName]) {
+          source[methodName] = func;
+        }
+      });
+      return source;
+    }()), false);
+
+    /*------------------------------------------------------------------------*/
+
+    // Add functions capable of returning wrapped and unwrapped values when chaining.
+    lodash.sample = sample;
+
+    lodash.prototype.sample = function(n) {
+      if (!this.__chain__ && n == null) {
+        return sample(this.value());
+      }
+      return this.thru(function(value) {
+        return sample(value, n);
+      });
+    };
+
+    /*------------------------------------------------------------------------*/
+
+    /**
+     * The semantic version number.
+     *
+     * @static
+     * @memberOf _
+     * @type string
+     */
+    lodash.VERSION = VERSION;
+
+    // Assign default placeholders.
+    arrayEach(['bind', 'bindKey', 'curry', 'curryRight', 'partial', 'partialRight'], function(methodName) {
+      lodash[methodName].placeholder = lodash;
+    });
+
+    // Add `LazyWrapper` methods for `_.drop` and `_.take` variants.
+    arrayEach(['drop', 'take'], function(methodName, index) {
+      LazyWrapper.prototype[methodName] = function(n) {
+        var filtered = this.__filtered__;
+        if (filtered && !index) {
+          return new LazyWrapper(this);
+        }
+        n = n == null ? 1 : nativeMax(nativeFloor(n) || 0, 0);
+
+        var result = this.clone();
+        if (filtered) {
+          result.__takeCount__ = nativeMin(result.__takeCount__, n);
+        } else {
+          result.__views__.push({ 'size': n, 'type': methodName + (result.__dir__ < 0 ? 'Right' : '') });
+        }
+        return result;
+      };
+
+      LazyWrapper.prototype[methodName + 'Right'] = function(n) {
+        return this.reverse()[methodName](n).reverse();
+      };
+    });
+
+    // Add `LazyWrapper` methods that accept an `iteratee` value.
+    arrayEach(['filter', 'map', 'takeWhile'], function(methodName, index) {
+      var type = index + 1,
+          isFilter = type != LAZY_MAP_FLAG;
+
+      LazyWrapper.prototype[methodName] = function(iteratee, thisArg) {
+        var result = this.clone();
+        result.__iteratees__.push({ 'iteratee': getCallback(iteratee, thisArg, 1), 'type': type });
+        result.__filtered__ = result.__filtered__ || isFilter;
+        return result;
+      };
+    });
+
+    // Add `LazyWrapper` methods for `_.first` and `_.last`.
+    arrayEach(['first', 'last'], function(methodName, index) {
+      var takeName = 'take' + (index ? 'Right' : '');
+
+      LazyWrapper.prototype[methodName] = function() {
+        return this[takeName](1).value()[0];
+      };
+    });
+
+    // Add `LazyWrapper` methods for `_.initial` and `_.rest`.
+    arrayEach(['initial', 'rest'], function(methodName, index) {
+      var dropName = 'drop' + (index ? '' : 'Right');
+
+      LazyWrapper.prototype[methodName] = function() {
+        return this.__filtered__ ? new LazyWrapper(this) : this[dropName](1);
+      };
+    });
+
+    // Add `LazyWrapper` methods for `_.pluck` and `_.where`.
+    arrayEach(['pluck', 'where'], function(methodName, index) {
+      var operationName = index ? 'filter' : 'map',
+          createCallback = index ? baseMatches : property;
+
+      LazyWrapper.prototype[methodName] = function(value) {
+        return this[operationName](createCallback(value));
+      };
+    });
+
+    LazyWrapper.prototype.compact = function() {
+      return this.filter(identity);
+    };
+
+    LazyWrapper.prototype.reject = function(predicate, thisArg) {
+      predicate = getCallback(predicate, thisArg, 1);
+      return this.filter(function(value) {
+        return !predicate(value);
+      });
+    };
+
+    LazyWrapper.prototype.slice = function(start, end) {
+      start = start == null ? 0 : (+start || 0);
+
+      var result = this;
+      if (result.__filtered__ && (start > 0 || end < 0)) {
+        return new LazyWrapper(result);
+      }
+      if (start < 0) {
+        result = result.takeRight(-start);
+      } else if (start) {
+        result = result.drop(start);
+      }
+      if (end !== undefined) {
+        end = (+end || 0);
+        result = end < 0 ? result.dropRight(-end) : result.take(end - start);
+      }
+      return result;
+    };
+
+    LazyWrapper.prototype.takeRightWhile = function(predicate, thisArg) {
+      return this.reverse().takeWhile(predicate, thisArg).reverse();
+    };
+
+    LazyWrapper.prototype.toArray = function() {
+      return this.take(POSITIVE_INFINITY);
+    };
+
+    // Add `LazyWrapper` methods to `lodash.prototype`.
+    baseForOwn(LazyWrapper.prototype, function(func, methodName) {
+      var checkIteratee = /^(?:filter|map|reject)|While$/.test(methodName),
+          retUnwrapped = /^(?:first|last)$/.test(methodName),
+          lodashFunc = lodash[retUnwrapped ? ('take' + (methodName == 'last' ? 'Right' : '')) : methodName];
+
+      if (!lodashFunc) {
+        return;
+      }
+      lodash.prototype[methodName] = function() {
+        var args = retUnwrapped ? [1] : arguments,
+            chainAll = this.__chain__,
+            value = this.__wrapped__,
+            isHybrid = !!this.__actions__.length,
+            isLazy = value instanceof LazyWrapper,
+            iteratee = args[0],
+            useLazy = isLazy || isArray(value);
+
+        if (useLazy && checkIteratee && typeof iteratee == 'function' && iteratee.length != 1) {
+          // Avoid lazy use if the iteratee has a "length" value other than `1`.
+          isLazy = useLazy = false;
+        }
+        var interceptor = function(value) {
+          return (retUnwrapped && chainAll)
+            ? lodashFunc(value, 1)[0]
+            : lodashFunc.apply(undefined, arrayPush([value], args));
+        };
+
+        var action = { 'func': thru, 'args': [interceptor], 'thisArg': undefined },
+            onlyLazy = isLazy && !isHybrid;
+
+        if (retUnwrapped && !chainAll) {
+          if (onlyLazy) {
+            value = value.clone();
+            value.__actions__.push(action);
+            return func.call(value);
+          }
+          return lodashFunc.call(undefined, this.value())[0];
+        }
+        if (!retUnwrapped && useLazy) {
+          value = onlyLazy ? value : new LazyWrapper(this);
+          var result = func.apply(value, args);
+          result.__actions__.push(action);
+          return new LodashWrapper(result, chainAll);
+        }
+        return this.thru(interceptor);
+      };
+    });
+
+    // Add `Array` and `String` methods to `lodash.prototype`.
+    arrayEach(['join', 'pop', 'push', 'replace', 'shift', 'sort', 'splice', 'split', 'unshift'], function(methodName) {
+      var protoFunc = (/^(?:replace|split)$/.test(methodName) ? stringProto : arrayProto)[methodName],
+          chainName = /^(?:push|sort|unshift)$/.test(methodName) ? 'tap' : 'thru',
+          fixObjects = !support.spliceObjects && /^(?:pop|shift|splice)$/.test(methodName),
+          retUnwrapped = /^(?:join|pop|replace|shift)$/.test(methodName);
+
+      // Avoid array-like object bugs with `Array#shift` and `Array#splice` in
+      // IE < 9, Firefox < 10, and RingoJS.
+      var func = !fixObjects ? protoFunc : function() {
+        var result = protoFunc.apply(this, arguments);
+        if (this.length === 0) {
+          delete this[0];
+        }
+        return result;
+      };
+
+      lodash.prototype[methodName] = function() {
+        var args = arguments;
+        if (retUnwrapped && !this.__chain__) {
+          return func.apply(this.value(), args);
+        }
+        return this[chainName](function(value) {
+          return func.apply(value, args);
+        });
+      };
+    });
+
+    // Map minified function names to their real names.
+    baseForOwn(LazyWrapper.prototype, function(func, methodName) {
+      var lodashFunc = lodash[methodName];
+      if (lodashFunc) {
+        var key = (lodashFunc.name + ''),
+            names = realNames[key] || (realNames[key] = []);
+
+        names.push({ 'name': methodName, 'func': lodashFunc });
+      }
+    });
+
+    realNames[createHybridWrapper(undefined, BIND_KEY_FLAG).name] = [{ 'name': 'wrapper', 'func': undefined }];
+
+    // Add functions to the lazy wrapper.
+    LazyWrapper.prototype.clone = lazyClone;
+    LazyWrapper.prototype.reverse = lazyReverse;
+    LazyWrapper.prototype.value = lazyValue;
+
+    // Add chaining functions to the `lodash` wrapper.
+    lodash.prototype.chain = wrapperChain;
+    lodash.prototype.commit = wrapperCommit;
+    lodash.prototype.concat = wrapperConcat;
+    lodash.prototype.plant = wrapperPlant;
+    lodash.prototype.reverse = wrapperReverse;
+    lodash.prototype.toString = wrapperToString;
+    lodash.prototype.run = lodash.prototype.toJSON = lodash.prototype.valueOf = lodash.prototype.value = wrapperValue;
+
+    // Add function aliases to the `lodash` wrapper.
+    lodash.prototype.collect = lodash.prototype.map;
+    lodash.prototype.head = lodash.prototype.first;
+    lodash.prototype.select = lodash.prototype.filter;
+    lodash.prototype.tail = lodash.prototype.rest;
+
+    return lodash;
+  }
+
+  /*--------------------------------------------------------------------------*/
+
+  // Export lodash.
+  var _ = runInContext();
+
+  // Some AMD build optimizers like r.js check for condition patterns like the following:
+  if (typeof define == 'function' && typeof define.amd == 'object' && define.amd) {
+    // Expose lodash to the global object when an AMD loader is present to avoid
+    // errors in cases where lodash is loaded by a script tag and not intended
+    // as an AMD module. See http://requirejs.org/docs/errors.html#mismatch for
+    // more details.
+    root._ = _;
+
+    // Define as an anonymous module so, through path mapping, it can be
+    // referenced as the "underscore" module.
+    define(function() {
+      return _;
+    });
+  }
+  // Check for `exports` after `define` in case a build optimizer adds an `exports` object.
+  else if (freeExports && freeModule) {
+    // Export for Node.js or RingoJS.
+    if (moduleExports) {
+      (freeModule.exports = _)._ = _;
+    }
+    // Export for Rhino with CommonJS support.
+    else {
+      freeExports._ = _;
+    }
+  }
+  else {
+    // Export for a browser or Rhino.
+    root._ = _;
+  }
+}.call(this));
diff --git a/ee/bulk-operations-dashboard/assets/dependencies/moment.js b/ee/bulk-operations-dashboard/assets/dependencies/moment.js
new file mode 100644
index 0000000000..9428c66bb9
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/dependencies/moment.js
@@ -0,0 +1,4535 @@
+//! moment.js
+//! version : 2.20.1
+//! authors : Tim Wood, Iskren Chernev, Moment.js contributors
+//! license : MIT
+//! momentjs.com
+
+;(function (global, factory) {
+    typeof exports === 'object' && typeof module !== 'undefined' ? module.exports = factory() :
+    typeof define === 'function' && define.amd ? define(factory) :
+    global.moment = factory()
+}(this, (function () { 'use strict';
+
+var hookCallback;
+
+function hooks () {
+    return hookCallback.apply(null, arguments);
+}
+
+// This is done to register the method called with moment()
+// without creating circular dependencies.
+function setHookCallback (callback) {
+    hookCallback = callback;
+}
+
+function isArray(input) {
+    return input instanceof Array || Object.prototype.toString.call(input) === '[object Array]';
+}
+
+function isObject(input) {
+    // IE8 will treat undefined and null as object if it wasn't for
+    // input != null
+    return input != null && Object.prototype.toString.call(input) === '[object Object]';
+}
+
+function isObjectEmpty(obj) {
+    if (Object.getOwnPropertyNames) {
+        return (Object.getOwnPropertyNames(obj).length === 0);
+    } else {
+        var k;
+        for (k in obj) {
+            if (obj.hasOwnProperty(k)) {
+                return false;
+            }
+        }
+        return true;
+    }
+}
+
+function isUndefined(input) {
+    return input === void 0;
+}
+
+function isNumber(input) {
+    return typeof input === 'number' || Object.prototype.toString.call(input) === '[object Number]';
+}
+
+function isDate(input) {
+    return input instanceof Date || Object.prototype.toString.call(input) === '[object Date]';
+}
+
+function map(arr, fn) {
+    var res = [], i;
+    for (i = 0; i < arr.length; ++i) {
+        res.push(fn(arr[i], i));
+    }
+    return res;
+}
+
+function hasOwnProp(a, b) {
+    return Object.prototype.hasOwnProperty.call(a, b);
+}
+
+function extend(a, b) {
+    for (var i in b) {
+        if (hasOwnProp(b, i)) {
+            a[i] = b[i];
+        }
+    }
+
+    if (hasOwnProp(b, 'toString')) {
+        a.toString = b.toString;
+    }
+
+    if (hasOwnProp(b, 'valueOf')) {
+        a.valueOf = b.valueOf;
+    }
+
+    return a;
+}
+
+function createUTC (input, format, locale, strict) {
+    return createLocalOrUTC(input, format, locale, strict, true).utc();
+}
+
+function defaultParsingFlags() {
+    // We need to deep clone this object.
+    return {
+        empty           : false,
+        unusedTokens    : [],
+        unusedInput     : [],
+        overflow        : -2,
+        charsLeftOver   : 0,
+        nullInput       : false,
+        invalidMonth    : null,
+        invalidFormat   : false,
+        userInvalidated : false,
+        iso             : false,
+        parsedDateParts : [],
+        meridiem        : null,
+        rfc2822         : false,
+        weekdayMismatch : false
+    };
+}
+
+function getParsingFlags(m) {
+    if (m._pf == null) {
+        m._pf = defaultParsingFlags();
+    }
+    return m._pf;
+}
+
+var some;
+if (Array.prototype.some) {
+    some = Array.prototype.some;
+} else {
+    some = function (fun) {
+        var t = Object(this);
+        var len = t.length >>> 0;
+
+        for (var i = 0; i < len; i++) {
+            if (i in t && fun.call(this, t[i], i, t)) {
+                return true;
+            }
+        }
+
+        return false;
+    };
+}
+
+function isValid(m) {
+    if (m._isValid == null) {
+        var flags = getParsingFlags(m);
+        var parsedParts = some.call(flags.parsedDateParts, function (i) {
+            return i != null;
+        });
+        var isNowValid = !isNaN(m._d.getTime()) &&
+            flags.overflow < 0 &&
+            !flags.empty &&
+            !flags.invalidMonth &&
+            !flags.invalidWeekday &&
+            !flags.weekdayMismatch &&
+            !flags.nullInput &&
+            !flags.invalidFormat &&
+            !flags.userInvalidated &&
+            (!flags.meridiem || (flags.meridiem && parsedParts));
+
+        if (m._strict) {
+            isNowValid = isNowValid &&
+                flags.charsLeftOver === 0 &&
+                flags.unusedTokens.length === 0 &&
+                flags.bigHour === undefined;
+        }
+
+        if (Object.isFrozen == null || !Object.isFrozen(m)) {
+            m._isValid = isNowValid;
+        }
+        else {
+            return isNowValid;
+        }
+    }
+    return m._isValid;
+}
+
+function createInvalid (flags) {
+    var m = createUTC(NaN);
+    if (flags != null) {
+        extend(getParsingFlags(m), flags);
+    }
+    else {
+        getParsingFlags(m).userInvalidated = true;
+    }
+
+    return m;
+}
+
+// Plugins that add properties should also add the key here (null value),
+// so we can properly clone ourselves.
+var momentProperties = hooks.momentProperties = [];
+
+function copyConfig(to, from) {
+    var i, prop, val;
+
+    if (!isUndefined(from._isAMomentObject)) {
+        to._isAMomentObject = from._isAMomentObject;
+    }
+    if (!isUndefined(from._i)) {
+        to._i = from._i;
+    }
+    if (!isUndefined(from._f)) {
+        to._f = from._f;
+    }
+    if (!isUndefined(from._l)) {
+        to._l = from._l;
+    }
+    if (!isUndefined(from._strict)) {
+        to._strict = from._strict;
+    }
+    if (!isUndefined(from._tzm)) {
+        to._tzm = from._tzm;
+    }
+    if (!isUndefined(from._isUTC)) {
+        to._isUTC = from._isUTC;
+    }
+    if (!isUndefined(from._offset)) {
+        to._offset = from._offset;
+    }
+    if (!isUndefined(from._pf)) {
+        to._pf = getParsingFlags(from);
+    }
+    if (!isUndefined(from._locale)) {
+        to._locale = from._locale;
+    }
+
+    if (momentProperties.length > 0) {
+        for (i = 0; i < momentProperties.length; i++) {
+            prop = momentProperties[i];
+            val = from[prop];
+            if (!isUndefined(val)) {
+                to[prop] = val;
+            }
+        }
+    }
+
+    return to;
+}
+
+var updateInProgress = false;
+
+// Moment prototype object
+function Moment(config) {
+    copyConfig(this, config);
+    this._d = new Date(config._d != null ? config._d.getTime() : NaN);
+    if (!this.isValid()) {
+        this._d = new Date(NaN);
+    }
+    // Prevent infinite loop in case updateOffset creates new moment
+    // objects.
+    if (updateInProgress === false) {
+        updateInProgress = true;
+        hooks.updateOffset(this);
+        updateInProgress = false;
+    }
+}
+
+function isMoment (obj) {
+    return obj instanceof Moment || (obj != null && obj._isAMomentObject != null);
+}
+
+function absFloor (number) {
+    if (number < 0) {
+        // -0 -> 0
+        return Math.ceil(number) || 0;
+    } else {
+        return Math.floor(number);
+    }
+}
+
+function toInt(argumentForCoercion) {
+    var coercedNumber = +argumentForCoercion,
+        value = 0;
+
+    if (coercedNumber !== 0 && isFinite(coercedNumber)) {
+        value = absFloor(coercedNumber);
+    }
+
+    return value;
+}
+
+// compare two arrays, return the number of differences
+function compareArrays(array1, array2, dontConvert) {
+    var len = Math.min(array1.length, array2.length),
+        lengthDiff = Math.abs(array1.length - array2.length),
+        diffs = 0,
+        i;
+    for (i = 0; i < len; i++) {
+        if ((dontConvert && array1[i] !== array2[i]) ||
+            (!dontConvert && toInt(array1[i]) !== toInt(array2[i]))) {
+            diffs++;
+        }
+    }
+    return diffs + lengthDiff;
+}
+
+function warn(msg) {
+    if (hooks.suppressDeprecationWarnings === false &&
+            (typeof console !==  'undefined') && console.warn) {
+        console.warn('Deprecation warning: ' + msg);
+    }
+}
+
+function deprecate(msg, fn) {
+    var firstTime = true;
+
+    return extend(function () {
+        if (hooks.deprecationHandler != null) {
+            hooks.deprecationHandler(null, msg);
+        }
+        if (firstTime) {
+            var args = [];
+            var arg;
+            for (var i = 0; i < arguments.length; i++) {
+                arg = '';
+                if (typeof arguments[i] === 'object') {
+                    arg += '\n[' + i + '] ';
+                    for (var key in arguments[0]) {
+                        arg += key + ': ' + arguments[0][key] + ', ';
+                    }
+                    arg = arg.slice(0, -2); // Remove trailing comma and space
+                } else {
+                    arg = arguments[i];
+                }
+                args.push(arg);
+            }
+            warn(msg + '\nArguments: ' + Array.prototype.slice.call(args).join('') + '\n' + (new Error()).stack);
+            firstTime = false;
+        }
+        return fn.apply(this, arguments);
+    }, fn);
+}
+
+var deprecations = {};
+
+function deprecateSimple(name, msg) {
+    if (hooks.deprecationHandler != null) {
+        hooks.deprecationHandler(name, msg);
+    }
+    if (!deprecations[name]) {
+        warn(msg);
+        deprecations[name] = true;
+    }
+}
+
+hooks.suppressDeprecationWarnings = false;
+hooks.deprecationHandler = null;
+
+function isFunction(input) {
+    return input instanceof Function || Object.prototype.toString.call(input) === '[object Function]';
+}
+
+function set (config) {
+    var prop, i;
+    for (i in config) {
+        prop = config[i];
+        if (isFunction(prop)) {
+            this[i] = prop;
+        } else {
+            this['_' + i] = prop;
+        }
+    }
+    this._config = config;
+    // Lenient ordinal parsing accepts just a number in addition to
+    // number + (possibly) stuff coming from _dayOfMonthOrdinalParse.
+    // TODO: Remove "ordinalParse" fallback in next major release.
+    this._dayOfMonthOrdinalParseLenient = new RegExp(
+        (this._dayOfMonthOrdinalParse.source || this._ordinalParse.source) +
+            '|' + (/\d{1,2}/).source);
+}
+
+function mergeConfigs(parentConfig, childConfig) {
+    var res = extend({}, parentConfig), prop;
+    for (prop in childConfig) {
+        if (hasOwnProp(childConfig, prop)) {
+            if (isObject(parentConfig[prop]) && isObject(childConfig[prop])) {
+                res[prop] = {};
+                extend(res[prop], parentConfig[prop]);
+                extend(res[prop], childConfig[prop]);
+            } else if (childConfig[prop] != null) {
+                res[prop] = childConfig[prop];
+            } else {
+                delete res[prop];
+            }
+        }
+    }
+    for (prop in parentConfig) {
+        if (hasOwnProp(parentConfig, prop) &&
+                !hasOwnProp(childConfig, prop) &&
+                isObject(parentConfig[prop])) {
+            // make sure changes to properties don't modify parent config
+            res[prop] = extend({}, res[prop]);
+        }
+    }
+    return res;
+}
+
+function Locale(config) {
+    if (config != null) {
+        this.set(config);
+    }
+}
+
+var keys;
+
+if (Object.keys) {
+    keys = Object.keys;
+} else {
+    keys = function (obj) {
+        var i, res = [];
+        for (i in obj) {
+            if (hasOwnProp(obj, i)) {
+                res.push(i);
+            }
+        }
+        return res;
+    };
+}
+
+var defaultCalendar = {
+    sameDay : '[Today at] LT',
+    nextDay : '[Tomorrow at] LT',
+    nextWeek : 'dddd [at] LT',
+    lastDay : '[Yesterday at] LT',
+    lastWeek : '[Last] dddd [at] LT',
+    sameElse : 'L'
+};
+
+function calendar (key, mom, now) {
+    var output = this._calendar[key] || this._calendar['sameElse'];
+    return isFunction(output) ? output.call(mom, now) : output;
+}
+
+var defaultLongDateFormat = {
+    LTS  : 'h:mm:ss A',
+    LT   : 'h:mm A',
+    L    : 'MM/DD/YYYY',
+    LL   : 'MMMM D, YYYY',
+    LLL  : 'MMMM D, YYYY h:mm A',
+    LLLL : 'dddd, MMMM D, YYYY h:mm A'
+};
+
+function longDateFormat (key) {
+    var format = this._longDateFormat[key],
+        formatUpper = this._longDateFormat[key.toUpperCase()];
+
+    if (format || !formatUpper) {
+        return format;
+    }
+
+    this._longDateFormat[key] = formatUpper.replace(/MMMM|MM|DD|dddd/g, function (val) {
+        return val.slice(1);
+    });
+
+    return this._longDateFormat[key];
+}
+
+var defaultInvalidDate = 'Invalid date';
+
+function invalidDate () {
+    return this._invalidDate;
+}
+
+var defaultOrdinal = '%d';
+var defaultDayOfMonthOrdinalParse = /\d{1,2}/;
+
+function ordinal (number) {
+    return this._ordinal.replace('%d', number);
+}
+
+var defaultRelativeTime = {
+    future : 'in %s',
+    past   : '%s ago',
+    s  : 'a few seconds',
+    ss : '%d seconds',
+    m  : 'a minute',
+    mm : '%d minutes',
+    h  : 'an hour',
+    hh : '%d hours',
+    d  : 'a day',
+    dd : '%d days',
+    M  : 'a month',
+    MM : '%d months',
+    y  : 'a year',
+    yy : '%d years'
+};
+
+function relativeTime (number, withoutSuffix, string, isFuture) {
+    var output = this._relativeTime[string];
+    return (isFunction(output)) ?
+        output(number, withoutSuffix, string, isFuture) :
+        output.replace(/%d/i, number);
+}
+
+function pastFuture (diff, output) {
+    var format = this._relativeTime[diff > 0 ? 'future' : 'past'];
+    return isFunction(format) ? format(output) : format.replace(/%s/i, output);
+}
+
+var aliases = {};
+
+function addUnitAlias (unit, shorthand) {
+    var lowerCase = unit.toLowerCase();
+    aliases[lowerCase] = aliases[lowerCase + 's'] = aliases[shorthand] = unit;
+}
+
+function normalizeUnits(units) {
+    return typeof units === 'string' ? aliases[units] || aliases[units.toLowerCase()] : undefined;
+}
+
+function normalizeObjectUnits(inputObject) {
+    var normalizedInput = {},
+        normalizedProp,
+        prop;
+
+    for (prop in inputObject) {
+        if (hasOwnProp(inputObject, prop)) {
+            normalizedProp = normalizeUnits(prop);
+            if (normalizedProp) {
+                normalizedInput[normalizedProp] = inputObject[prop];
+            }
+        }
+    }
+
+    return normalizedInput;
+}
+
+var priorities = {};
+
+function addUnitPriority(unit, priority) {
+    priorities[unit] = priority;
+}
+
+function getPrioritizedUnits(unitsObj) {
+    var units = [];
+    for (var u in unitsObj) {
+        units.push({unit: u, priority: priorities[u]});
+    }
+    units.sort(function (a, b) {
+        return a.priority - b.priority;
+    });
+    return units;
+}
+
+function zeroFill(number, targetLength, forceSign) {
+    var absNumber = '' + Math.abs(number),
+        zerosToFill = targetLength - absNumber.length,
+        sign = number >= 0;
+    return (sign ? (forceSign ? '+' : '') : '-') +
+        Math.pow(10, Math.max(0, zerosToFill)).toString().substr(1) + absNumber;
+}
+
+var formattingTokens = /(\[[^\[]*\])|(\\)?([Hh]mm(ss)?|Mo|MM?M?M?|Do|DDDo|DD?D?D?|ddd?d?|do?|w[o|w]?|W[o|W]?|Qo?|YYYYYY|YYYYY|YYYY|YY|gg(ggg?)?|GG(GGG?)?|e|E|a|A|hh?|HH?|kk?|mm?|ss?|S{1,9}|x|X|zz?|ZZ?|.)/g;
+
+var localFormattingTokens = /(\[[^\[]*\])|(\\)?(LTS|LT|LL?L?L?|l{1,4})/g;
+
+var formatFunctions = {};
+
+var formatTokenFunctions = {};
+
+// token:    'M'
+// padded:   ['MM', 2]
+// ordinal:  'Mo'
+// callback: function () { this.month() + 1 }
+function addFormatToken (token, padded, ordinal, callback) {
+    var func = callback;
+    if (typeof callback === 'string') {
+        func = function () {
+            return this[callback]();
+        };
+    }
+    if (token) {
+        formatTokenFunctions[token] = func;
+    }
+    if (padded) {
+        formatTokenFunctions[padded[0]] = function () {
+            return zeroFill(func.apply(this, arguments), padded[1], padded[2]);
+        };
+    }
+    if (ordinal) {
+        formatTokenFunctions[ordinal] = function () {
+            return this.localeData().ordinal(func.apply(this, arguments), token);
+        };
+    }
+}
+
+function removeFormattingTokens(input) {
+    if (input.match(/\[[\s\S]/)) {
+        return input.replace(/^\[|\]$/g, '');
+    }
+    return input.replace(/\\/g, '');
+}
+
+function makeFormatFunction(format) {
+    var array = format.match(formattingTokens), i, length;
+
+    for (i = 0, length = array.length; i < length; i++) {
+        if (formatTokenFunctions[array[i]]) {
+            array[i] = formatTokenFunctions[array[i]];
+        } else {
+            array[i] = removeFormattingTokens(array[i]);
+        }
+    }
+
+    return function (mom) {
+        var output = '', i;
+        for (i = 0; i < length; i++) {
+            output += isFunction(array[i]) ? array[i].call(mom, format) : array[i];
+        }
+        return output;
+    };
+}
+
+// format date using native date object
+function formatMoment(m, format) {
+    if (!m.isValid()) {
+        return m.localeData().invalidDate();
+    }
+
+    format = expandFormat(format, m.localeData());
+    formatFunctions[format] = formatFunctions[format] || makeFormatFunction(format);
+
+    return formatFunctions[format](m);
+}
+
+function expandFormat(format, locale) {
+    var i = 5;
+
+    function replaceLongDateFormatTokens(input) {
+        return locale.longDateFormat(input) || input;
+    }
+
+    localFormattingTokens.lastIndex = 0;
+    while (i >= 0 && localFormattingTokens.test(format)) {
+        format = format.replace(localFormattingTokens, replaceLongDateFormatTokens);
+        localFormattingTokens.lastIndex = 0;
+        i -= 1;
+    }
+
+    return format;
+}
+
+var match1         = /\d/;            //       0 - 9
+var match2         = /\d\d/;          //      00 - 99
+var match3         = /\d{3}/;         //     000 - 999
+var match4         = /\d{4}/;         //    0000 - 9999
+var match6         = /[+-]?\d{6}/;    // -999999 - 999999
+var match1to2      = /\d\d?/;         //       0 - 99
+var match3to4      = /\d\d\d\d?/;     //     999 - 9999
+var match5to6      = /\d\d\d\d\d\d?/; //   99999 - 999999
+var match1to3      = /\d{1,3}/;       //       0 - 999
+var match1to4      = /\d{1,4}/;       //       0 - 9999
+var match1to6      = /[+-]?\d{1,6}/;  // -999999 - 999999
+
+var matchUnsigned  = /\d+/;           //       0 - inf
+var matchSigned    = /[+-]?\d+/;      //    -inf - inf
+
+var matchOffset    = /Z|[+-]\d\d:?\d\d/gi; // +00:00 -00:00 +0000 -0000 or Z
+var matchShortOffset = /Z|[+-]\d\d(?::?\d\d)?/gi; // +00 -00 +00:00 -00:00 +0000 -0000 or Z
+
+var matchTimestamp = /[+-]?\d+(\.\d{1,3})?/; // 123456789 123456789.123
+
+// any word (or two) characters or numbers including two/three word month in arabic.
+// includes scottish gaelic two word and hyphenated months
+var matchWord = /[0-9]{0,256}['a-z\u00A0-\u05FF\u0700-\uD7FF\uF900-\uFDCF\uFDF0-\uFF07\uFF10-\uFFEF]{1,256}|[\u0600-\u06FF\/]{1,256}(\s*?[\u0600-\u06FF]{1,256}){1,2}/i;
+
+
+var regexes = {};
+
+function addRegexToken (token, regex, strictRegex) {
+    regexes[token] = isFunction(regex) ? regex : function (isStrict, localeData) {
+        return (isStrict && strictRegex) ? strictRegex : regex;
+    };
+}
+
+function getParseRegexForToken (token, config) {
+    if (!hasOwnProp(regexes, token)) {
+        return new RegExp(unescapeFormat(token));
+    }
+
+    return regexes[token](config._strict, config._locale);
+}
+
+// Code from http://stackoverflow.com/questions/3561493/is-there-a-regexp-escape-function-in-javascript
+function unescapeFormat(s) {
+    return regexEscape(s.replace('\\', '').replace(/\\(\[)|\\(\])|\[([^\]\[]*)\]|\\(.)/g, function (matched, p1, p2, p3, p4) {
+        return p1 || p2 || p3 || p4;
+    }));
+}
+
+function regexEscape(s) {
+    return s.replace(/[-\/\\^$*+?.()|[\]{}]/g, '\\$&');
+}
+
+var tokens = {};
+
+function addParseToken (token, callback) {
+    var i, func = callback;
+    if (typeof token === 'string') {
+        token = [token];
+    }
+    if (isNumber(callback)) {
+        func = function (input, array) {
+            array[callback] = toInt(input);
+        };
+    }
+    for (i = 0; i < token.length; i++) {
+        tokens[token[i]] = func;
+    }
+}
+
+function addWeekParseToken (token, callback) {
+    addParseToken(token, function (input, array, config, token) {
+        config._w = config._w || {};
+        callback(input, config._w, config, token);
+    });
+}
+
+function addTimeToArrayFromToken(token, input, config) {
+    if (input != null && hasOwnProp(tokens, token)) {
+        tokens[token](input, config._a, config, token);
+    }
+}
+
+var YEAR = 0;
+var MONTH = 1;
+var DATE = 2;
+var HOUR = 3;
+var MINUTE = 4;
+var SECOND = 5;
+var MILLISECOND = 6;
+var WEEK = 7;
+var WEEKDAY = 8;
+
+// FORMATTING
+
+addFormatToken('Y', 0, 0, function () {
+    var y = this.year();
+    return y <= 9999 ? '' + y : '+' + y;
+});
+
+addFormatToken(0, ['YY', 2], 0, function () {
+    return this.year() % 100;
+});
+
+addFormatToken(0, ['YYYY',   4],       0, 'year');
+addFormatToken(0, ['YYYYY',  5],       0, 'year');
+addFormatToken(0, ['YYYYYY', 6, true], 0, 'year');
+
+// ALIASES
+
+addUnitAlias('year', 'y');
+
+// PRIORITIES
+
+addUnitPriority('year', 1);
+
+// PARSING
+
+addRegexToken('Y',      matchSigned);
+addRegexToken('YY',     match1to2, match2);
+addRegexToken('YYYY',   match1to4, match4);
+addRegexToken('YYYYY',  match1to6, match6);
+addRegexToken('YYYYYY', match1to6, match6);
+
+addParseToken(['YYYYY', 'YYYYYY'], YEAR);
+addParseToken('YYYY', function (input, array) {
+    array[YEAR] = input.length === 2 ? hooks.parseTwoDigitYear(input) : toInt(input);
+});
+addParseToken('YY', function (input, array) {
+    array[YEAR] = hooks.parseTwoDigitYear(input);
+});
+addParseToken('Y', function (input, array) {
+    array[YEAR] = parseInt(input, 10);
+});
+
+// HELPERS
+
+function daysInYear(year) {
+    return isLeapYear(year) ? 366 : 365;
+}
+
+function isLeapYear(year) {
+    return (year % 4 === 0 && year % 100 !== 0) || year % 400 === 0;
+}
+
+// HOOKS
+
+hooks.parseTwoDigitYear = function (input) {
+    return toInt(input) + (toInt(input) > 68 ? 1900 : 2000);
+};
+
+// MOMENTS
+
+var getSetYear = makeGetSet('FullYear', true);
+
+function getIsLeapYear () {
+    return isLeapYear(this.year());
+}
+
+function makeGetSet (unit, keepTime) {
+    return function (value) {
+        if (value != null) {
+            set$1(this, unit, value);
+            hooks.updateOffset(this, keepTime);
+            return this;
+        } else {
+            return get(this, unit);
+        }
+    };
+}
+
+function get (mom, unit) {
+    return mom.isValid() ?
+        mom._d['get' + (mom._isUTC ? 'UTC' : '') + unit]() : NaN;
+}
+
+function set$1 (mom, unit, value) {
+    if (mom.isValid() && !isNaN(value)) {
+        if (unit === 'FullYear' && isLeapYear(mom.year()) && mom.month() === 1 && mom.date() === 29) {
+            mom._d['set' + (mom._isUTC ? 'UTC' : '') + unit](value, mom.month(), daysInMonth(value, mom.month()));
+        }
+        else {
+            mom._d['set' + (mom._isUTC ? 'UTC' : '') + unit](value);
+        }
+    }
+}
+
+// MOMENTS
+
+function stringGet (units) {
+    units = normalizeUnits(units);
+    if (isFunction(this[units])) {
+        return this[units]();
+    }
+    return this;
+}
+
+
+function stringSet (units, value) {
+    if (typeof units === 'object') {
+        units = normalizeObjectUnits(units);
+        var prioritized = getPrioritizedUnits(units);
+        for (var i = 0; i < prioritized.length; i++) {
+            this[prioritized[i].unit](units[prioritized[i].unit]);
+        }
+    } else {
+        units = normalizeUnits(units);
+        if (isFunction(this[units])) {
+            return this[units](value);
+        }
+    }
+    return this;
+}
+
+function mod(n, x) {
+    return ((n % x) + x) % x;
+}
+
+var indexOf;
+
+if (Array.prototype.indexOf) {
+    indexOf = Array.prototype.indexOf;
+} else {
+    indexOf = function (o) {
+        // I know
+        var i;
+        for (i = 0; i < this.length; ++i) {
+            if (this[i] === o) {
+                return i;
+            }
+        }
+        return -1;
+    };
+}
+
+function daysInMonth(year, month) {
+    if (isNaN(year) || isNaN(month)) {
+        return NaN;
+    }
+    var modMonth = mod(month, 12);
+    year += (month - modMonth) / 12;
+    return modMonth === 1 ? (isLeapYear(year) ? 29 : 28) : (31 - modMonth % 7 % 2);
+}
+
+// FORMATTING
+
+addFormatToken('M', ['MM', 2], 'Mo', function () {
+    return this.month() + 1;
+});
+
+addFormatToken('MMM', 0, 0, function (format) {
+    return this.localeData().monthsShort(this, format);
+});
+
+addFormatToken('MMMM', 0, 0, function (format) {
+    return this.localeData().months(this, format);
+});
+
+// ALIASES
+
+addUnitAlias('month', 'M');
+
+// PRIORITY
+
+addUnitPriority('month', 8);
+
+// PARSING
+
+addRegexToken('M',    match1to2);
+addRegexToken('MM',   match1to2, match2);
+addRegexToken('MMM',  function (isStrict, locale) {
+    return locale.monthsShortRegex(isStrict);
+});
+addRegexToken('MMMM', function (isStrict, locale) {
+    return locale.monthsRegex(isStrict);
+});
+
+addParseToken(['M', 'MM'], function (input, array) {
+    array[MONTH] = toInt(input) - 1;
+});
+
+addParseToken(['MMM', 'MMMM'], function (input, array, config, token) {
+    var month = config._locale.monthsParse(input, token, config._strict);
+    // if we didn't find a month name, mark the date as invalid.
+    if (month != null) {
+        array[MONTH] = month;
+    } else {
+        getParsingFlags(config).invalidMonth = input;
+    }
+});
+
+// LOCALES
+
+var MONTHS_IN_FORMAT = /D[oD]?(\[[^\[\]]*\]|\s)+MMMM?/;
+var defaultLocaleMonths = 'January_February_March_April_May_June_July_August_September_October_November_December'.split('_');
+function localeMonths (m, format) {
+    if (!m) {
+        return isArray(this._months) ? this._months :
+            this._months['standalone'];
+    }
+    return isArray(this._months) ? this._months[m.month()] :
+        this._months[(this._months.isFormat || MONTHS_IN_FORMAT).test(format) ? 'format' : 'standalone'][m.month()];
+}
+
+var defaultLocaleMonthsShort = 'Jan_Feb_Mar_Apr_May_Jun_Jul_Aug_Sep_Oct_Nov_Dec'.split('_');
+function localeMonthsShort (m, format) {
+    if (!m) {
+        return isArray(this._monthsShort) ? this._monthsShort :
+            this._monthsShort['standalone'];
+    }
+    return isArray(this._monthsShort) ? this._monthsShort[m.month()] :
+        this._monthsShort[MONTHS_IN_FORMAT.test(format) ? 'format' : 'standalone'][m.month()];
+}
+
+function handleStrictParse(monthName, format, strict) {
+    var i, ii, mom, llc = monthName.toLocaleLowerCase();
+    if (!this._monthsParse) {
+        // this is not used
+        this._monthsParse = [];
+        this._longMonthsParse = [];
+        this._shortMonthsParse = [];
+        for (i = 0; i < 12; ++i) {
+            mom = createUTC([2000, i]);
+            this._shortMonthsParse[i] = this.monthsShort(mom, '').toLocaleLowerCase();
+            this._longMonthsParse[i] = this.months(mom, '').toLocaleLowerCase();
+        }
+    }
+
+    if (strict) {
+        if (format === 'MMM') {
+            ii = indexOf.call(this._shortMonthsParse, llc);
+            return ii !== -1 ? ii : null;
+        } else {
+            ii = indexOf.call(this._longMonthsParse, llc);
+            return ii !== -1 ? ii : null;
+        }
+    } else {
+        if (format === 'MMM') {
+            ii = indexOf.call(this._shortMonthsParse, llc);
+            if (ii !== -1) {
+                return ii;
+            }
+            ii = indexOf.call(this._longMonthsParse, llc);
+            return ii !== -1 ? ii : null;
+        } else {
+            ii = indexOf.call(this._longMonthsParse, llc);
+            if (ii !== -1) {
+                return ii;
+            }
+            ii = indexOf.call(this._shortMonthsParse, llc);
+            return ii !== -1 ? ii : null;
+        }
+    }
+}
+
+function localeMonthsParse (monthName, format, strict) {
+    var i, mom, regex;
+
+    if (this._monthsParseExact) {
+        return handleStrictParse.call(this, monthName, format, strict);
+    }
+
+    if (!this._monthsParse) {
+        this._monthsParse = [];
+        this._longMonthsParse = [];
+        this._shortMonthsParse = [];
+    }
+
+    // TODO: add sorting
+    // Sorting makes sure if one month (or abbr) is a prefix of another
+    // see sorting in computeMonthsParse
+    for (i = 0; i < 12; i++) {
+        // make the regex if we don't have it already
+        mom = createUTC([2000, i]);
+        if (strict && !this._longMonthsParse[i]) {
+            this._longMonthsParse[i] = new RegExp('^' + this.months(mom, '').replace('.', '') + '$', 'i');
+            this._shortMonthsParse[i] = new RegExp('^' + this.monthsShort(mom, '').replace('.', '') + '$', 'i');
+        }
+        if (!strict && !this._monthsParse[i]) {
+            regex = '^' + this.months(mom, '') + '|^' + this.monthsShort(mom, '');
+            this._monthsParse[i] = new RegExp(regex.replace('.', ''), 'i');
+        }
+        // test the regex
+        if (strict && format === 'MMMM' && this._longMonthsParse[i].test(monthName)) {
+            return i;
+        } else if (strict && format === 'MMM' && this._shortMonthsParse[i].test(monthName)) {
+            return i;
+        } else if (!strict && this._monthsParse[i].test(monthName)) {
+            return i;
+        }
+    }
+}
+
+// MOMENTS
+
+function setMonth (mom, value) {
+    var dayOfMonth;
+
+    if (!mom.isValid()) {
+        // No op
+        return mom;
+    }
+
+    if (typeof value === 'string') {
+        if (/^\d+$/.test(value)) {
+            value = toInt(value);
+        } else {
+            value = mom.localeData().monthsParse(value);
+            // TODO: Another silent failure?
+            if (!isNumber(value)) {
+                return mom;
+            }
+        }
+    }
+
+    dayOfMonth = Math.min(mom.date(), daysInMonth(mom.year(), value));
+    mom._d['set' + (mom._isUTC ? 'UTC' : '') + 'Month'](value, dayOfMonth);
+    return mom;
+}
+
+function getSetMonth (value) {
+    if (value != null) {
+        setMonth(this, value);
+        hooks.updateOffset(this, true);
+        return this;
+    } else {
+        return get(this, 'Month');
+    }
+}
+
+function getDaysInMonth () {
+    return daysInMonth(this.year(), this.month());
+}
+
+var defaultMonthsShortRegex = matchWord;
+function monthsShortRegex (isStrict) {
+    if (this._monthsParseExact) {
+        if (!hasOwnProp(this, '_monthsRegex')) {
+            computeMonthsParse.call(this);
+        }
+        if (isStrict) {
+            return this._monthsShortStrictRegex;
+        } else {
+            return this._monthsShortRegex;
+        }
+    } else {
+        if (!hasOwnProp(this, '_monthsShortRegex')) {
+            this._monthsShortRegex = defaultMonthsShortRegex;
+        }
+        return this._monthsShortStrictRegex && isStrict ?
+            this._monthsShortStrictRegex : this._monthsShortRegex;
+    }
+}
+
+var defaultMonthsRegex = matchWord;
+function monthsRegex (isStrict) {
+    if (this._monthsParseExact) {
+        if (!hasOwnProp(this, '_monthsRegex')) {
+            computeMonthsParse.call(this);
+        }
+        if (isStrict) {
+            return this._monthsStrictRegex;
+        } else {
+            return this._monthsRegex;
+        }
+    } else {
+        if (!hasOwnProp(this, '_monthsRegex')) {
+            this._monthsRegex = defaultMonthsRegex;
+        }
+        return this._monthsStrictRegex && isStrict ?
+            this._monthsStrictRegex : this._monthsRegex;
+    }
+}
+
+function computeMonthsParse () {
+    function cmpLenRev(a, b) {
+        return b.length - a.length;
+    }
+
+    var shortPieces = [], longPieces = [], mixedPieces = [],
+        i, mom;
+    for (i = 0; i < 12; i++) {
+        // make the regex if we don't have it already
+        mom = createUTC([2000, i]);
+        shortPieces.push(this.monthsShort(mom, ''));
+        longPieces.push(this.months(mom, ''));
+        mixedPieces.push(this.months(mom, ''));
+        mixedPieces.push(this.monthsShort(mom, ''));
+    }
+    // Sorting makes sure if one month (or abbr) is a prefix of another it
+    // will match the longer piece.
+    shortPieces.sort(cmpLenRev);
+    longPieces.sort(cmpLenRev);
+    mixedPieces.sort(cmpLenRev);
+    for (i = 0; i < 12; i++) {
+        shortPieces[i] = regexEscape(shortPieces[i]);
+        longPieces[i] = regexEscape(longPieces[i]);
+    }
+    for (i = 0; i < 24; i++) {
+        mixedPieces[i] = regexEscape(mixedPieces[i]);
+    }
+
+    this._monthsRegex = new RegExp('^(' + mixedPieces.join('|') + ')', 'i');
+    this._monthsShortRegex = this._monthsRegex;
+    this._monthsStrictRegex = new RegExp('^(' + longPieces.join('|') + ')', 'i');
+    this._monthsShortStrictRegex = new RegExp('^(' + shortPieces.join('|') + ')', 'i');
+}
+
+function createDate (y, m, d, h, M, s, ms) {
+    // can't just apply() to create a date:
+    // https://stackoverflow.com/q/181348
+    var date = new Date(y, m, d, h, M, s, ms);
+
+    // the date constructor remaps years 0-99 to 1900-1999
+    if (y < 100 && y >= 0 && isFinite(date.getFullYear())) {
+        date.setFullYear(y);
+    }
+    return date;
+}
+
+function createUTCDate (y) {
+    var date = new Date(Date.UTC.apply(null, arguments));
+
+    // the Date.UTC function remaps years 0-99 to 1900-1999
+    if (y < 100 && y >= 0 && isFinite(date.getUTCFullYear())) {
+        date.setUTCFullYear(y);
+    }
+    return date;
+}
+
+// start-of-first-week - start-of-year
+function firstWeekOffset(year, dow, doy) {
+    var // first-week day -- which january is always in the first week (4 for iso, 1 for other)
+        fwd = 7 + dow - doy,
+        // first-week day local weekday -- which local weekday is fwd
+        fwdlw = (7 + createUTCDate(year, 0, fwd).getUTCDay() - dow) % 7;
+
+    return -fwdlw + fwd - 1;
+}
+
+// https://en.wikipedia.org/wiki/ISO_week_date#Calculating_a_date_given_the_year.2C_week_number_and_weekday
+function dayOfYearFromWeeks(year, week, weekday, dow, doy) {
+    var localWeekday = (7 + weekday - dow) % 7,
+        weekOffset = firstWeekOffset(year, dow, doy),
+        dayOfYear = 1 + 7 * (week - 1) + localWeekday + weekOffset,
+        resYear, resDayOfYear;
+
+    if (dayOfYear <= 0) {
+        resYear = year - 1;
+        resDayOfYear = daysInYear(resYear) + dayOfYear;
+    } else if (dayOfYear > daysInYear(year)) {
+        resYear = year + 1;
+        resDayOfYear = dayOfYear - daysInYear(year);
+    } else {
+        resYear = year;
+        resDayOfYear = dayOfYear;
+    }
+
+    return {
+        year: resYear,
+        dayOfYear: resDayOfYear
+    };
+}
+
+function weekOfYear(mom, dow, doy) {
+    var weekOffset = firstWeekOffset(mom.year(), dow, doy),
+        week = Math.floor((mom.dayOfYear() - weekOffset - 1) / 7) + 1,
+        resWeek, resYear;
+
+    if (week < 1) {
+        resYear = mom.year() - 1;
+        resWeek = week + weeksInYear(resYear, dow, doy);
+    } else if (week > weeksInYear(mom.year(), dow, doy)) {
+        resWeek = week - weeksInYear(mom.year(), dow, doy);
+        resYear = mom.year() + 1;
+    } else {
+        resYear = mom.year();
+        resWeek = week;
+    }
+
+    return {
+        week: resWeek,
+        year: resYear
+    };
+}
+
+function weeksInYear(year, dow, doy) {
+    var weekOffset = firstWeekOffset(year, dow, doy),
+        weekOffsetNext = firstWeekOffset(year + 1, dow, doy);
+    return (daysInYear(year) - weekOffset + weekOffsetNext) / 7;
+}
+
+// FORMATTING
+
+addFormatToken('w', ['ww', 2], 'wo', 'week');
+addFormatToken('W', ['WW', 2], 'Wo', 'isoWeek');
+
+// ALIASES
+
+addUnitAlias('week', 'w');
+addUnitAlias('isoWeek', 'W');
+
+// PRIORITIES
+
+addUnitPriority('week', 5);
+addUnitPriority('isoWeek', 5);
+
+// PARSING
+
+addRegexToken('w',  match1to2);
+addRegexToken('ww', match1to2, match2);
+addRegexToken('W',  match1to2);
+addRegexToken('WW', match1to2, match2);
+
+addWeekParseToken(['w', 'ww', 'W', 'WW'], function (input, week, config, token) {
+    week[token.substr(0, 1)] = toInt(input);
+});
+
+// HELPERS
+
+// LOCALES
+
+function localeWeek (mom) {
+    return weekOfYear(mom, this._week.dow, this._week.doy).week;
+}
+
+var defaultLocaleWeek = {
+    dow : 0, // Sunday is the first day of the week.
+    doy : 6  // The week that contains Jan 1st is the first week of the year.
+};
+
+function localeFirstDayOfWeek () {
+    return this._week.dow;
+}
+
+function localeFirstDayOfYear () {
+    return this._week.doy;
+}
+
+// MOMENTS
+
+function getSetWeek (input) {
+    var week = this.localeData().week(this);
+    return input == null ? week : this.add((input - week) * 7, 'd');
+}
+
+function getSetISOWeek (input) {
+    var week = weekOfYear(this, 1, 4).week;
+    return input == null ? week : this.add((input - week) * 7, 'd');
+}
+
+// FORMATTING
+
+addFormatToken('d', 0, 'do', 'day');
+
+addFormatToken('dd', 0, 0, function (format) {
+    return this.localeData().weekdaysMin(this, format);
+});
+
+addFormatToken('ddd', 0, 0, function (format) {
+    return this.localeData().weekdaysShort(this, format);
+});
+
+addFormatToken('dddd', 0, 0, function (format) {
+    return this.localeData().weekdays(this, format);
+});
+
+addFormatToken('e', 0, 0, 'weekday');
+addFormatToken('E', 0, 0, 'isoWeekday');
+
+// ALIASES
+
+addUnitAlias('day', 'd');
+addUnitAlias('weekday', 'e');
+addUnitAlias('isoWeekday', 'E');
+
+// PRIORITY
+addUnitPriority('day', 11);
+addUnitPriority('weekday', 11);
+addUnitPriority('isoWeekday', 11);
+
+// PARSING
+
+addRegexToken('d',    match1to2);
+addRegexToken('e',    match1to2);
+addRegexToken('E',    match1to2);
+addRegexToken('dd',   function (isStrict, locale) {
+    return locale.weekdaysMinRegex(isStrict);
+});
+addRegexToken('ddd',   function (isStrict, locale) {
+    return locale.weekdaysShortRegex(isStrict);
+});
+addRegexToken('dddd',   function (isStrict, locale) {
+    return locale.weekdaysRegex(isStrict);
+});
+
+addWeekParseToken(['dd', 'ddd', 'dddd'], function (input, week, config, token) {
+    var weekday = config._locale.weekdaysParse(input, token, config._strict);
+    // if we didn't get a weekday name, mark the date as invalid
+    if (weekday != null) {
+        week.d = weekday;
+    } else {
+        getParsingFlags(config).invalidWeekday = input;
+    }
+});
+
+addWeekParseToken(['d', 'e', 'E'], function (input, week, config, token) {
+    week[token] = toInt(input);
+});
+
+// HELPERS
+
+function parseWeekday(input, locale) {
+    if (typeof input !== 'string') {
+        return input;
+    }
+
+    if (!isNaN(input)) {
+        return parseInt(input, 10);
+    }
+
+    input = locale.weekdaysParse(input);
+    if (typeof input === 'number') {
+        return input;
+    }
+
+    return null;
+}
+
+function parseIsoWeekday(input, locale) {
+    if (typeof input === 'string') {
+        return locale.weekdaysParse(input) % 7 || 7;
+    }
+    return isNaN(input) ? null : input;
+}
+
+// LOCALES
+
+var defaultLocaleWeekdays = 'Sunday_Monday_Tuesday_Wednesday_Thursday_Friday_Saturday'.split('_');
+function localeWeekdays (m, format) {
+    if (!m) {
+        return isArray(this._weekdays) ? this._weekdays :
+            this._weekdays['standalone'];
+    }
+    return isArray(this._weekdays) ? this._weekdays[m.day()] :
+        this._weekdays[this._weekdays.isFormat.test(format) ? 'format' : 'standalone'][m.day()];
+}
+
+var defaultLocaleWeekdaysShort = 'Sun_Mon_Tue_Wed_Thu_Fri_Sat'.split('_');
+function localeWeekdaysShort (m) {
+    return (m) ? this._weekdaysShort[m.day()] : this._weekdaysShort;
+}
+
+var defaultLocaleWeekdaysMin = 'Su_Mo_Tu_We_Th_Fr_Sa'.split('_');
+function localeWeekdaysMin (m) {
+    return (m) ? this._weekdaysMin[m.day()] : this._weekdaysMin;
+}
+
+function handleStrictParse$1(weekdayName, format, strict) {
+    var i, ii, mom, llc = weekdayName.toLocaleLowerCase();
+    if (!this._weekdaysParse) {
+        this._weekdaysParse = [];
+        this._shortWeekdaysParse = [];
+        this._minWeekdaysParse = [];
+
+        for (i = 0; i < 7; ++i) {
+            mom = createUTC([2000, 1]).day(i);
+            this._minWeekdaysParse[i] = this.weekdaysMin(mom, '').toLocaleLowerCase();
+            this._shortWeekdaysParse[i] = this.weekdaysShort(mom, '').toLocaleLowerCase();
+            this._weekdaysParse[i] = this.weekdays(mom, '').toLocaleLowerCase();
+        }
+    }
+
+    if (strict) {
+        if (format === 'dddd') {
+            ii = indexOf.call(this._weekdaysParse, llc);
+            return ii !== -1 ? ii : null;
+        } else if (format === 'ddd') {
+            ii = indexOf.call(this._shortWeekdaysParse, llc);
+            return ii !== -1 ? ii : null;
+        } else {
+            ii = indexOf.call(this._minWeekdaysParse, llc);
+            return ii !== -1 ? ii : null;
+        }
+    } else {
+        if (format === 'dddd') {
+            ii = indexOf.call(this._weekdaysParse, llc);
+            if (ii !== -1) {
+                return ii;
+            }
+            ii = indexOf.call(this._shortWeekdaysParse, llc);
+            if (ii !== -1) {
+                return ii;
+            }
+            ii = indexOf.call(this._minWeekdaysParse, llc);
+            return ii !== -1 ? ii : null;
+        } else if (format === 'ddd') {
+            ii = indexOf.call(this._shortWeekdaysParse, llc);
+            if (ii !== -1) {
+                return ii;
+            }
+            ii = indexOf.call(this._weekdaysParse, llc);
+            if (ii !== -1) {
+                return ii;
+            }
+            ii = indexOf.call(this._minWeekdaysParse, llc);
+            return ii !== -1 ? ii : null;
+        } else {
+            ii = indexOf.call(this._minWeekdaysParse, llc);
+            if (ii !== -1) {
+                return ii;
+            }
+            ii = indexOf.call(this._weekdaysParse, llc);
+            if (ii !== -1) {
+                return ii;
+            }
+            ii = indexOf.call(this._shortWeekdaysParse, llc);
+            return ii !== -1 ? ii : null;
+        }
+    }
+}
+
+function localeWeekdaysParse (weekdayName, format, strict) {
+    var i, mom, regex;
+
+    if (this._weekdaysParseExact) {
+        return handleStrictParse$1.call(this, weekdayName, format, strict);
+    }
+
+    if (!this._weekdaysParse) {
+        this._weekdaysParse = [];
+        this._minWeekdaysParse = [];
+        this._shortWeekdaysParse = [];
+        this._fullWeekdaysParse = [];
+    }
+
+    for (i = 0; i < 7; i++) {
+        // make the regex if we don't have it already
+
+        mom = createUTC([2000, 1]).day(i);
+        if (strict && !this._fullWeekdaysParse[i]) {
+            this._fullWeekdaysParse[i] = new RegExp('^' + this.weekdays(mom, '').replace('.', '\.?') + '$', 'i');
+            this._shortWeekdaysParse[i] = new RegExp('^' + this.weekdaysShort(mom, '').replace('.', '\.?') + '$', 'i');
+            this._minWeekdaysParse[i] = new RegExp('^' + this.weekdaysMin(mom, '').replace('.', '\.?') + '$', 'i');
+        }
+        if (!this._weekdaysParse[i]) {
+            regex = '^' + this.weekdays(mom, '') + '|^' + this.weekdaysShort(mom, '') + '|^' + this.weekdaysMin(mom, '');
+            this._weekdaysParse[i] = new RegExp(regex.replace('.', ''), 'i');
+        }
+        // test the regex
+        if (strict && format === 'dddd' && this._fullWeekdaysParse[i].test(weekdayName)) {
+            return i;
+        } else if (strict && format === 'ddd' && this._shortWeekdaysParse[i].test(weekdayName)) {
+            return i;
+        } else if (strict && format === 'dd' && this._minWeekdaysParse[i].test(weekdayName)) {
+            return i;
+        } else if (!strict && this._weekdaysParse[i].test(weekdayName)) {
+            return i;
+        }
+    }
+}
+
+// MOMENTS
+
+function getSetDayOfWeek (input) {
+    if (!this.isValid()) {
+        return input != null ? this : NaN;
+    }
+    var day = this._isUTC ? this._d.getUTCDay() : this._d.getDay();
+    if (input != null) {
+        input = parseWeekday(input, this.localeData());
+        return this.add(input - day, 'd');
+    } else {
+        return day;
+    }
+}
+
+function getSetLocaleDayOfWeek (input) {
+    if (!this.isValid()) {
+        return input != null ? this : NaN;
+    }
+    var weekday = (this.day() + 7 - this.localeData()._week.dow) % 7;
+    return input == null ? weekday : this.add(input - weekday, 'd');
+}
+
+function getSetISODayOfWeek (input) {
+    if (!this.isValid()) {
+        return input != null ? this : NaN;
+    }
+
+    // behaves the same as moment#day except
+    // as a getter, returns 7 instead of 0 (1-7 range instead of 0-6)
+    // as a setter, sunday should belong to the previous week.
+
+    if (input != null) {
+        var weekday = parseIsoWeekday(input, this.localeData());
+        return this.day(this.day() % 7 ? weekday : weekday - 7);
+    } else {
+        return this.day() || 7;
+    }
+}
+
+var defaultWeekdaysRegex = matchWord;
+function weekdaysRegex (isStrict) {
+    if (this._weekdaysParseExact) {
+        if (!hasOwnProp(this, '_weekdaysRegex')) {
+            computeWeekdaysParse.call(this);
+        }
+        if (isStrict) {
+            return this._weekdaysStrictRegex;
+        } else {
+            return this._weekdaysRegex;
+        }
+    } else {
+        if (!hasOwnProp(this, '_weekdaysRegex')) {
+            this._weekdaysRegex = defaultWeekdaysRegex;
+        }
+        return this._weekdaysStrictRegex && isStrict ?
+            this._weekdaysStrictRegex : this._weekdaysRegex;
+    }
+}
+
+var defaultWeekdaysShortRegex = matchWord;
+function weekdaysShortRegex (isStrict) {
+    if (this._weekdaysParseExact) {
+        if (!hasOwnProp(this, '_weekdaysRegex')) {
+            computeWeekdaysParse.call(this);
+        }
+        if (isStrict) {
+            return this._weekdaysShortStrictRegex;
+        } else {
+            return this._weekdaysShortRegex;
+        }
+    } else {
+        if (!hasOwnProp(this, '_weekdaysShortRegex')) {
+            this._weekdaysShortRegex = defaultWeekdaysShortRegex;
+        }
+        return this._weekdaysShortStrictRegex && isStrict ?
+            this._weekdaysShortStrictRegex : this._weekdaysShortRegex;
+    }
+}
+
+var defaultWeekdaysMinRegex = matchWord;
+function weekdaysMinRegex (isStrict) {
+    if (this._weekdaysParseExact) {
+        if (!hasOwnProp(this, '_weekdaysRegex')) {
+            computeWeekdaysParse.call(this);
+        }
+        if (isStrict) {
+            return this._weekdaysMinStrictRegex;
+        } else {
+            return this._weekdaysMinRegex;
+        }
+    } else {
+        if (!hasOwnProp(this, '_weekdaysMinRegex')) {
+            this._weekdaysMinRegex = defaultWeekdaysMinRegex;
+        }
+        return this._weekdaysMinStrictRegex && isStrict ?
+            this._weekdaysMinStrictRegex : this._weekdaysMinRegex;
+    }
+}
+
+
+function computeWeekdaysParse () {
+    function cmpLenRev(a, b) {
+        return b.length - a.length;
+    }
+
+    var minPieces = [], shortPieces = [], longPieces = [], mixedPieces = [],
+        i, mom, minp, shortp, longp;
+    for (i = 0; i < 7; i++) {
+        // make the regex if we don't have it already
+        mom = createUTC([2000, 1]).day(i);
+        minp = this.weekdaysMin(mom, '');
+        shortp = this.weekdaysShort(mom, '');
+        longp = this.weekdays(mom, '');
+        minPieces.push(minp);
+        shortPieces.push(shortp);
+        longPieces.push(longp);
+        mixedPieces.push(minp);
+        mixedPieces.push(shortp);
+        mixedPieces.push(longp);
+    }
+    // Sorting makes sure if one weekday (or abbr) is a prefix of another it
+    // will match the longer piece.
+    minPieces.sort(cmpLenRev);
+    shortPieces.sort(cmpLenRev);
+    longPieces.sort(cmpLenRev);
+    mixedPieces.sort(cmpLenRev);
+    for (i = 0; i < 7; i++) {
+        shortPieces[i] = regexEscape(shortPieces[i]);
+        longPieces[i] = regexEscape(longPieces[i]);
+        mixedPieces[i] = regexEscape(mixedPieces[i]);
+    }
+
+    this._weekdaysRegex = new RegExp('^(' + mixedPieces.join('|') + ')', 'i');
+    this._weekdaysShortRegex = this._weekdaysRegex;
+    this._weekdaysMinRegex = this._weekdaysRegex;
+
+    this._weekdaysStrictRegex = new RegExp('^(' + longPieces.join('|') + ')', 'i');
+    this._weekdaysShortStrictRegex = new RegExp('^(' + shortPieces.join('|') + ')', 'i');
+    this._weekdaysMinStrictRegex = new RegExp('^(' + minPieces.join('|') + ')', 'i');
+}
+
+// FORMATTING
+
+function hFormat() {
+    return this.hours() % 12 || 12;
+}
+
+function kFormat() {
+    return this.hours() || 24;
+}
+
+addFormatToken('H', ['HH', 2], 0, 'hour');
+addFormatToken('h', ['hh', 2], 0, hFormat);
+addFormatToken('k', ['kk', 2], 0, kFormat);
+
+addFormatToken('hmm', 0, 0, function () {
+    return '' + hFormat.apply(this) + zeroFill(this.minutes(), 2);
+});
+
+addFormatToken('hmmss', 0, 0, function () {
+    return '' + hFormat.apply(this) + zeroFill(this.minutes(), 2) +
+        zeroFill(this.seconds(), 2);
+});
+
+addFormatToken('Hmm', 0, 0, function () {
+    return '' + this.hours() + zeroFill(this.minutes(), 2);
+});
+
+addFormatToken('Hmmss', 0, 0, function () {
+    return '' + this.hours() + zeroFill(this.minutes(), 2) +
+        zeroFill(this.seconds(), 2);
+});
+
+function meridiem (token, lowercase) {
+    addFormatToken(token, 0, 0, function () {
+        return this.localeData().meridiem(this.hours(), this.minutes(), lowercase);
+    });
+}
+
+meridiem('a', true);
+meridiem('A', false);
+
+// ALIASES
+
+addUnitAlias('hour', 'h');
+
+// PRIORITY
+addUnitPriority('hour', 13);
+
+// PARSING
+
+function matchMeridiem (isStrict, locale) {
+    return locale._meridiemParse;
+}
+
+addRegexToken('a',  matchMeridiem);
+addRegexToken('A',  matchMeridiem);
+addRegexToken('H',  match1to2);
+addRegexToken('h',  match1to2);
+addRegexToken('k',  match1to2);
+addRegexToken('HH', match1to2, match2);
+addRegexToken('hh', match1to2, match2);
+addRegexToken('kk', match1to2, match2);
+
+addRegexToken('hmm', match3to4);
+addRegexToken('hmmss', match5to6);
+addRegexToken('Hmm', match3to4);
+addRegexToken('Hmmss', match5to6);
+
+addParseToken(['H', 'HH'], HOUR);
+addParseToken(['k', 'kk'], function (input, array, config) {
+    var kInput = toInt(input);
+    array[HOUR] = kInput === 24 ? 0 : kInput;
+});
+addParseToken(['a', 'A'], function (input, array, config) {
+    config._isPm = config._locale.isPM(input);
+    config._meridiem = input;
+});
+addParseToken(['h', 'hh'], function (input, array, config) {
+    array[HOUR] = toInt(input);
+    getParsingFlags(config).bigHour = true;
+});
+addParseToken('hmm', function (input, array, config) {
+    var pos = input.length - 2;
+    array[HOUR] = toInt(input.substr(0, pos));
+    array[MINUTE] = toInt(input.substr(pos));
+    getParsingFlags(config).bigHour = true;
+});
+addParseToken('hmmss', function (input, array, config) {
+    var pos1 = input.length - 4;
+    var pos2 = input.length - 2;
+    array[HOUR] = toInt(input.substr(0, pos1));
+    array[MINUTE] = toInt(input.substr(pos1, 2));
+    array[SECOND] = toInt(input.substr(pos2));
+    getParsingFlags(config).bigHour = true;
+});
+addParseToken('Hmm', function (input, array, config) {
+    var pos = input.length - 2;
+    array[HOUR] = toInt(input.substr(0, pos));
+    array[MINUTE] = toInt(input.substr(pos));
+});
+addParseToken('Hmmss', function (input, array, config) {
+    var pos1 = input.length - 4;
+    var pos2 = input.length - 2;
+    array[HOUR] = toInt(input.substr(0, pos1));
+    array[MINUTE] = toInt(input.substr(pos1, 2));
+    array[SECOND] = toInt(input.substr(pos2));
+});
+
+// LOCALES
+
+function localeIsPM (input) {
+    // IE8 Quirks Mode & IE7 Standards Mode do not allow accessing strings like arrays
+    // Using charAt should be more compatible.
+    return ((input + '').toLowerCase().charAt(0) === 'p');
+}
+
+var defaultLocaleMeridiemParse = /[ap]\.?m?\.?/i;
+function localeMeridiem (hours, minutes, isLower) {
+    if (hours > 11) {
+        return isLower ? 'pm' : 'PM';
+    } else {
+        return isLower ? 'am' : 'AM';
+    }
+}
+
+
+// MOMENTS
+
+// Setting the hour should keep the time, because the user explicitly
+// specified which hour he wants. So trying to maintain the same hour (in
+// a new timezone) makes sense. Adding/subtracting hours does not follow
+// this rule.
+var getSetHour = makeGetSet('Hours', true);
+
+// months
+// week
+// weekdays
+// meridiem
+var baseConfig = {
+    calendar: defaultCalendar,
+    longDateFormat: defaultLongDateFormat,
+    invalidDate: defaultInvalidDate,
+    ordinal: defaultOrdinal,
+    dayOfMonthOrdinalParse: defaultDayOfMonthOrdinalParse,
+    relativeTime: defaultRelativeTime,
+
+    months: defaultLocaleMonths,
+    monthsShort: defaultLocaleMonthsShort,
+
+    week: defaultLocaleWeek,
+
+    weekdays: defaultLocaleWeekdays,
+    weekdaysMin: defaultLocaleWeekdaysMin,
+    weekdaysShort: defaultLocaleWeekdaysShort,
+
+    meridiemParse: defaultLocaleMeridiemParse
+};
+
+// internal storage for locale config files
+var locales = {};
+var localeFamilies = {};
+var globalLocale;
+
+function normalizeLocale(key) {
+    return key ? key.toLowerCase().replace('_', '-') : key;
+}
+
+// pick the locale from the array
+// try ['en-au', 'en-gb'] as 'en-au', 'en-gb', 'en', as in move through the list trying each
+// substring from most specific to least, but move to the next array item if it's a more specific variant than the current root
+function chooseLocale(names) {
+    var i = 0, j, next, locale, split;
+
+    while (i < names.length) {
+        split = normalizeLocale(names[i]).split('-');
+        j = split.length;
+        next = normalizeLocale(names[i + 1]);
+        next = next ? next.split('-') : null;
+        while (j > 0) {
+            locale = loadLocale(split.slice(0, j).join('-'));
+            if (locale) {
+                return locale;
+            }
+            if (next && next.length >= j && compareArrays(split, next, true) >= j - 1) {
+                //the next array item is better than a shallower substring of this one
+                break;
+            }
+            j--;
+        }
+        i++;
+    }
+    return null;
+}
+
+function loadLocale(name) {
+    var oldLocale = null;
+    // TODO: Find a better way to register and load all the locales in Node
+    if (!locales[name] && (typeof module !== 'undefined') &&
+            module && module.exports) {
+        try {
+            oldLocale = globalLocale._abbr;
+            var aliasedRequire = require;
+            aliasedRequire('./locale/' + name);
+            getSetGlobalLocale(oldLocale);
+        } catch (e) {}
+    }
+    return locales[name];
+}
+
+// This function will load locale and then set the global locale.  If
+// no arguments are passed in, it will simply return the current global
+// locale key.
+function getSetGlobalLocale (key, values) {
+    var data;
+    if (key) {
+        if (isUndefined(values)) {
+            data = getLocale(key);
+        }
+        else {
+            data = defineLocale(key, values);
+        }
+
+        if (data) {
+            // moment.duration._locale = moment._locale = data;
+            globalLocale = data;
+        }
+    }
+
+    return globalLocale._abbr;
+}
+
+function defineLocale (name, config) {
+    if (config !== null) {
+        var parentConfig = baseConfig;
+        config.abbr = name;
+        if (locales[name] != null) {
+            deprecateSimple('defineLocaleOverride',
+                    'use moment.updateLocale(localeName, config) to change ' +
+                    'an existing locale. moment.defineLocale(localeName, ' +
+                    'config) should only be used for creating a new locale ' +
+                    'See http://momentjs.com/guides/#/warnings/define-locale/ for more info.');
+            parentConfig = locales[name]._config;
+        } else if (config.parentLocale != null) {
+            if (locales[config.parentLocale] != null) {
+                parentConfig = locales[config.parentLocale]._config;
+            } else {
+                if (!localeFamilies[config.parentLocale]) {
+                    localeFamilies[config.parentLocale] = [];
+                }
+                localeFamilies[config.parentLocale].push({
+                    name: name,
+                    config: config
+                });
+                return null;
+            }
+        }
+        locales[name] = new Locale(mergeConfigs(parentConfig, config));
+
+        if (localeFamilies[name]) {
+            localeFamilies[name].forEach(function (x) {
+                defineLocale(x.name, x.config);
+            });
+        }
+
+        // backwards compat for now: also set the locale
+        // make sure we set the locale AFTER all child locales have been
+        // created, so we won't end up with the child locale set.
+        getSetGlobalLocale(name);
+
+
+        return locales[name];
+    } else {
+        // useful for testing
+        delete locales[name];
+        return null;
+    }
+}
+
+function updateLocale(name, config) {
+    if (config != null) {
+        var locale, tmpLocale, parentConfig = baseConfig;
+        // MERGE
+        tmpLocale = loadLocale(name);
+        if (tmpLocale != null) {
+            parentConfig = tmpLocale._config;
+        }
+        config = mergeConfigs(parentConfig, config);
+        locale = new Locale(config);
+        locale.parentLocale = locales[name];
+        locales[name] = locale;
+
+        // backwards compat for now: also set the locale
+        getSetGlobalLocale(name);
+    } else {
+        // pass null for config to unupdate, useful for tests
+        if (locales[name] != null) {
+            if (locales[name].parentLocale != null) {
+                locales[name] = locales[name].parentLocale;
+            } else if (locales[name] != null) {
+                delete locales[name];
+            }
+        }
+    }
+    return locales[name];
+}
+
+// returns locale data
+function getLocale (key) {
+    var locale;
+
+    if (key && key._locale && key._locale._abbr) {
+        key = key._locale._abbr;
+    }
+
+    if (!key) {
+        return globalLocale;
+    }
+
+    if (!isArray(key)) {
+        //short-circuit everything else
+        locale = loadLocale(key);
+        if (locale) {
+            return locale;
+        }
+        key = [key];
+    }
+
+    return chooseLocale(key);
+}
+
+function listLocales() {
+    return keys(locales);
+}
+
+function checkOverflow (m) {
+    var overflow;
+    var a = m._a;
+
+    if (a && getParsingFlags(m).overflow === -2) {
+        overflow =
+            a[MONTH]       < 0 || a[MONTH]       > 11  ? MONTH :
+            a[DATE]        < 1 || a[DATE]        > daysInMonth(a[YEAR], a[MONTH]) ? DATE :
+            a[HOUR]        < 0 || a[HOUR]        > 24 || (a[HOUR] === 24 && (a[MINUTE] !== 0 || a[SECOND] !== 0 || a[MILLISECOND] !== 0)) ? HOUR :
+            a[MINUTE]      < 0 || a[MINUTE]      > 59  ? MINUTE :
+            a[SECOND]      < 0 || a[SECOND]      > 59  ? SECOND :
+            a[MILLISECOND] < 0 || a[MILLISECOND] > 999 ? MILLISECOND :
+            -1;
+
+        if (getParsingFlags(m)._overflowDayOfYear && (overflow < YEAR || overflow > DATE)) {
+            overflow = DATE;
+        }
+        if (getParsingFlags(m)._overflowWeeks && overflow === -1) {
+            overflow = WEEK;
+        }
+        if (getParsingFlags(m)._overflowWeekday && overflow === -1) {
+            overflow = WEEKDAY;
+        }
+
+        getParsingFlags(m).overflow = overflow;
+    }
+
+    return m;
+}
+
+// Pick the first defined of two or three arguments.
+function defaults(a, b, c) {
+    if (a != null) {
+        return a;
+    }
+    if (b != null) {
+        return b;
+    }
+    return c;
+}
+
+function currentDateArray(config) {
+    // hooks is actually the exported moment object
+    var nowValue = new Date(hooks.now());
+    if (config._useUTC) {
+        return [nowValue.getUTCFullYear(), nowValue.getUTCMonth(), nowValue.getUTCDate()];
+    }
+    return [nowValue.getFullYear(), nowValue.getMonth(), nowValue.getDate()];
+}
+
+// convert an array to a date.
+// the array should mirror the parameters below
+// note: all values past the year are optional and will default to the lowest possible value.
+// [year, month, day , hour, minute, second, millisecond]
+function configFromArray (config) {
+    var i, date, input = [], currentDate, expectedWeekday, yearToUse;
+
+    if (config._d) {
+        return;
+    }
+
+    currentDate = currentDateArray(config);
+
+    //compute day of the year from weeks and weekdays
+    if (config._w && config._a[DATE] == null && config._a[MONTH] == null) {
+        dayOfYearFromWeekInfo(config);
+    }
+
+    //if the day of the year is set, figure out what it is
+    if (config._dayOfYear != null) {
+        yearToUse = defaults(config._a[YEAR], currentDate[YEAR]);
+
+        if (config._dayOfYear > daysInYear(yearToUse) || config._dayOfYear === 0) {
+            getParsingFlags(config)._overflowDayOfYear = true;
+        }
+
+        date = createUTCDate(yearToUse, 0, config._dayOfYear);
+        config._a[MONTH] = date.getUTCMonth();
+        config._a[DATE] = date.getUTCDate();
+    }
+
+    // Default to current date.
+    // * if no year, month, day of month are given, default to today
+    // * if day of month is given, default month and year
+    // * if month is given, default only year
+    // * if year is given, don't default anything
+    for (i = 0; i < 3 && config._a[i] == null; ++i) {
+        config._a[i] = input[i] = currentDate[i];
+    }
+
+    // Zero out whatever was not defaulted, including time
+    for (; i < 7; i++) {
+        config._a[i] = input[i] = (config._a[i] == null) ? (i === 2 ? 1 : 0) : config._a[i];
+    }
+
+    // Check for 24:00:00.000
+    if (config._a[HOUR] === 24 &&
+            config._a[MINUTE] === 0 &&
+            config._a[SECOND] === 0 &&
+            config._a[MILLISECOND] === 0) {
+        config._nextDay = true;
+        config._a[HOUR] = 0;
+    }
+
+    config._d = (config._useUTC ? createUTCDate : createDate).apply(null, input);
+    expectedWeekday = config._useUTC ? config._d.getUTCDay() : config._d.getDay();
+
+    // Apply timezone offset from input. The actual utcOffset can be changed
+    // with parseZone.
+    if (config._tzm != null) {
+        config._d.setUTCMinutes(config._d.getUTCMinutes() - config._tzm);
+    }
+
+    if (config._nextDay) {
+        config._a[HOUR] = 24;
+    }
+
+    // check for mismatching day of week
+    if (config._w && typeof config._w.d !== 'undefined' && config._w.d !== expectedWeekday) {
+        getParsingFlags(config).weekdayMismatch = true;
+    }
+}
+
+function dayOfYearFromWeekInfo(config) {
+    var w, weekYear, week, weekday, dow, doy, temp, weekdayOverflow;
+
+    w = config._w;
+    if (w.GG != null || w.W != null || w.E != null) {
+        dow = 1;
+        doy = 4;
+
+        // TODO: We need to take the current isoWeekYear, but that depends on
+        // how we interpret now (local, utc, fixed offset). So create
+        // a now version of current config (take local/utc/offset flags, and
+        // create now).
+        weekYear = defaults(w.GG, config._a[YEAR], weekOfYear(createLocal(), 1, 4).year);
+        week = defaults(w.W, 1);
+        weekday = defaults(w.E, 1);
+        if (weekday < 1 || weekday > 7) {
+            weekdayOverflow = true;
+        }
+    } else {
+        dow = config._locale._week.dow;
+        doy = config._locale._week.doy;
+
+        var curWeek = weekOfYear(createLocal(), dow, doy);
+
+        weekYear = defaults(w.gg, config._a[YEAR], curWeek.year);
+
+        // Default to current week.
+        week = defaults(w.w, curWeek.week);
+
+        if (w.d != null) {
+            // weekday -- low day numbers are considered next week
+            weekday = w.d;
+            if (weekday < 0 || weekday > 6) {
+                weekdayOverflow = true;
+            }
+        } else if (w.e != null) {
+            // local weekday -- counting starts from begining of week
+            weekday = w.e + dow;
+            if (w.e < 0 || w.e > 6) {
+                weekdayOverflow = true;
+            }
+        } else {
+            // default to begining of week
+            weekday = dow;
+        }
+    }
+    if (week < 1 || week > weeksInYear(weekYear, dow, doy)) {
+        getParsingFlags(config)._overflowWeeks = true;
+    } else if (weekdayOverflow != null) {
+        getParsingFlags(config)._overflowWeekday = true;
+    } else {
+        temp = dayOfYearFromWeeks(weekYear, week, weekday, dow, doy);
+        config._a[YEAR] = temp.year;
+        config._dayOfYear = temp.dayOfYear;
+    }
+}
+
+// iso 8601 regex
+// 0000-00-00 0000-W00 or 0000-W00-0 + T + 00 or 00:00 or 00:00:00 or 00:00:00.000 + +00:00 or +0000 or +00)
+var extendedIsoRegex = /^\s*((?:[+-]\d{6}|\d{4})-(?:\d\d-\d\d|W\d\d-\d|W\d\d|\d\d\d|\d\d))(?:(T| )(\d\d(?::\d\d(?::\d\d(?:[.,]\d+)?)?)?)([\+\-]\d\d(?::?\d\d)?|\s*Z)?)?$/;
+var basicIsoRegex = /^\s*((?:[+-]\d{6}|\d{4})(?:\d\d\d\d|W\d\d\d|W\d\d|\d\d\d|\d\d))(?:(T| )(\d\d(?:\d\d(?:\d\d(?:[.,]\d+)?)?)?)([\+\-]\d\d(?::?\d\d)?|\s*Z)?)?$/;
+
+var tzRegex = /Z|[+-]\d\d(?::?\d\d)?/;
+
+var isoDates = [
+    ['YYYYYY-MM-DD', /[+-]\d{6}-\d\d-\d\d/],
+    ['YYYY-MM-DD', /\d{4}-\d\d-\d\d/],
+    ['GGGG-[W]WW-E', /\d{4}-W\d\d-\d/],
+    ['GGGG-[W]WW', /\d{4}-W\d\d/, false],
+    ['YYYY-DDD', /\d{4}-\d{3}/],
+    ['YYYY-MM', /\d{4}-\d\d/, false],
+    ['YYYYYYMMDD', /[+-]\d{10}/],
+    ['YYYYMMDD', /\d{8}/],
+    // YYYYMM is NOT allowed by the standard
+    ['GGGG[W]WWE', /\d{4}W\d{3}/],
+    ['GGGG[W]WW', /\d{4}W\d{2}/, false],
+    ['YYYYDDD', /\d{7}/]
+];
+
+// iso time formats and regexes
+var isoTimes = [
+    ['HH:mm:ss.SSSS', /\d\d:\d\d:\d\d\.\d+/],
+    ['HH:mm:ss,SSSS', /\d\d:\d\d:\d\d,\d+/],
+    ['HH:mm:ss', /\d\d:\d\d:\d\d/],
+    ['HH:mm', /\d\d:\d\d/],
+    ['HHmmss.SSSS', /\d\d\d\d\d\d\.\d+/],
+    ['HHmmss,SSSS', /\d\d\d\d\d\d,\d+/],
+    ['HHmmss', /\d\d\d\d\d\d/],
+    ['HHmm', /\d\d\d\d/],
+    ['HH', /\d\d/]
+];
+
+var aspNetJsonRegex = /^\/?Date\((\-?\d+)/i;
+
+// date from iso format
+function configFromISO(config) {
+    var i, l,
+        string = config._i,
+        match = extendedIsoRegex.exec(string) || basicIsoRegex.exec(string),
+        allowTime, dateFormat, timeFormat, tzFormat;
+
+    if (match) {
+        getParsingFlags(config).iso = true;
+
+        for (i = 0, l = isoDates.length; i < l; i++) {
+            if (isoDates[i][1].exec(match[1])) {
+                dateFormat = isoDates[i][0];
+                allowTime = isoDates[i][2] !== false;
+                break;
+            }
+        }
+        if (dateFormat == null) {
+            config._isValid = false;
+            return;
+        }
+        if (match[3]) {
+            for (i = 0, l = isoTimes.length; i < l; i++) {
+                if (isoTimes[i][1].exec(match[3])) {
+                    // match[2] should be 'T' or space
+                    timeFormat = (match[2] || ' ') + isoTimes[i][0];
+                    break;
+                }
+            }
+            if (timeFormat == null) {
+                config._isValid = false;
+                return;
+            }
+        }
+        if (!allowTime && timeFormat != null) {
+            config._isValid = false;
+            return;
+        }
+        if (match[4]) {
+            if (tzRegex.exec(match[4])) {
+                tzFormat = 'Z';
+            } else {
+                config._isValid = false;
+                return;
+            }
+        }
+        config._f = dateFormat + (timeFormat || '') + (tzFormat || '');
+        configFromStringAndFormat(config);
+    } else {
+        config._isValid = false;
+    }
+}
+
+// RFC 2822 regex: For details see https://tools.ietf.org/html/rfc2822#section-3.3
+var rfc2822 = /^(?:(Mon|Tue|Wed|Thu|Fri|Sat|Sun),?\s)?(\d{1,2})\s(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)\s(\d{2,4})\s(\d\d):(\d\d)(?::(\d\d))?\s(?:(UT|GMT|[ECMP][SD]T)|([Zz])|([+-]\d{4}))$/;
+
+function extractFromRFC2822Strings(yearStr, monthStr, dayStr, hourStr, minuteStr, secondStr) {
+    var result = [
+        untruncateYear(yearStr),
+        defaultLocaleMonthsShort.indexOf(monthStr),
+        parseInt(dayStr, 10),
+        parseInt(hourStr, 10),
+        parseInt(minuteStr, 10)
+    ];
+
+    if (secondStr) {
+        result.push(parseInt(secondStr, 10));
+    }
+
+    return result;
+}
+
+function untruncateYear(yearStr) {
+    var year = parseInt(yearStr, 10);
+    if (year <= 49) {
+        return 2000 + year;
+    } else if (year <= 999) {
+        return 1900 + year;
+    }
+    return year;
+}
+
+function preprocessRFC2822(s) {
+    // Remove comments and folding whitespace and replace multiple-spaces with a single space
+    return s.replace(/\([^)]*\)|[\n\t]/g, ' ').replace(/(\s\s+)/g, ' ').trim();
+}
+
+function checkWeekday(weekdayStr, parsedInput, config) {
+    if (weekdayStr) {
+        // TODO: Replace the vanilla JS Date object with an indepentent day-of-week check.
+        var weekdayProvided = defaultLocaleWeekdaysShort.indexOf(weekdayStr),
+            weekdayActual = new Date(parsedInput[0], parsedInput[1], parsedInput[2]).getDay();
+        if (weekdayProvided !== weekdayActual) {
+            getParsingFlags(config).weekdayMismatch = true;
+            config._isValid = false;
+            return false;
+        }
+    }
+    return true;
+}
+
+var obsOffsets = {
+    UT: 0,
+    GMT: 0,
+    EDT: -4 * 60,
+    EST: -5 * 60,
+    CDT: -5 * 60,
+    CST: -6 * 60,
+    MDT: -6 * 60,
+    MST: -7 * 60,
+    PDT: -7 * 60,
+    PST: -8 * 60
+};
+
+function calculateOffset(obsOffset, militaryOffset, numOffset) {
+    if (obsOffset) {
+        return obsOffsets[obsOffset];
+    } else if (militaryOffset) {
+        // the only allowed military tz is Z
+        return 0;
+    } else {
+        var hm = parseInt(numOffset, 10);
+        var m = hm % 100, h = (hm - m) / 100;
+        return h * 60 + m;
+    }
+}
+
+// date and time from ref 2822 format
+function configFromRFC2822(config) {
+    var match = rfc2822.exec(preprocessRFC2822(config._i));
+    if (match) {
+        var parsedArray = extractFromRFC2822Strings(match[4], match[3], match[2], match[5], match[6], match[7]);
+        if (!checkWeekday(match[1], parsedArray, config)) {
+            return;
+        }
+
+        config._a = parsedArray;
+        config._tzm = calculateOffset(match[8], match[9], match[10]);
+
+        config._d = createUTCDate.apply(null, config._a);
+        config._d.setUTCMinutes(config._d.getUTCMinutes() - config._tzm);
+
+        getParsingFlags(config).rfc2822 = true;
+    } else {
+        config._isValid = false;
+    }
+}
+
+// date from iso format or fallback
+function configFromString(config) {
+    var matched = aspNetJsonRegex.exec(config._i);
+
+    if (matched !== null) {
+        config._d = new Date(+matched[1]);
+        return;
+    }
+
+    configFromISO(config);
+    if (config._isValid === false) {
+        delete config._isValid;
+    } else {
+        return;
+    }
+
+    configFromRFC2822(config);
+    if (config._isValid === false) {
+        delete config._isValid;
+    } else {
+        return;
+    }
+
+    // Final attempt, use Input Fallback
+    hooks.createFromInputFallback(config);
+}
+
+hooks.createFromInputFallback = deprecate(
+    'value provided is not in a recognized RFC2822 or ISO format. moment construction falls back to js Date(), ' +
+    'which is not reliable across all browsers and versions. Non RFC2822/ISO date formats are ' +
+    'discouraged and will be removed in an upcoming major release. Please refer to ' +
+    'http://momentjs.com/guides/#/warnings/js-date/ for more info.',
+    function (config) {
+        config._d = new Date(config._i + (config._useUTC ? ' UTC' : ''));
+    }
+);
+
+// constant that refers to the ISO standard
+hooks.ISO_8601 = function () {};
+
+// constant that refers to the RFC 2822 form
+hooks.RFC_2822 = function () {};
+
+// date from string and format string
+function configFromStringAndFormat(config) {
+    // TODO: Move this to another part of the creation flow to prevent circular deps
+    if (config._f === hooks.ISO_8601) {
+        configFromISO(config);
+        return;
+    }
+    if (config._f === hooks.RFC_2822) {
+        configFromRFC2822(config);
+        return;
+    }
+    config._a = [];
+    getParsingFlags(config).empty = true;
+
+    // This array is used to make a Date, either with `new Date` or `Date.UTC`
+    var string = '' + config._i,
+        i, parsedInput, tokens, token, skipped,
+        stringLength = string.length,
+        totalParsedInputLength = 0;
+
+    tokens = expandFormat(config._f, config._locale).match(formattingTokens) || [];
+
+    for (i = 0; i < tokens.length; i++) {
+        token = tokens[i];
+        parsedInput = (string.match(getParseRegexForToken(token, config)) || [])[0];
+        // console.log('token', token, 'parsedInput', parsedInput,
+        //         'regex', getParseRegexForToken(token, config));
+        if (parsedInput) {
+            skipped = string.substr(0, string.indexOf(parsedInput));
+            if (skipped.length > 0) {
+                getParsingFlags(config).unusedInput.push(skipped);
+            }
+            string = string.slice(string.indexOf(parsedInput) + parsedInput.length);
+            totalParsedInputLength += parsedInput.length;
+        }
+        // don't parse if it's not a known token
+        if (formatTokenFunctions[token]) {
+            if (parsedInput) {
+                getParsingFlags(config).empty = false;
+            }
+            else {
+                getParsingFlags(config).unusedTokens.push(token);
+            }
+            addTimeToArrayFromToken(token, parsedInput, config);
+        }
+        else if (config._strict && !parsedInput) {
+            getParsingFlags(config).unusedTokens.push(token);
+        }
+    }
+
+    // add remaining unparsed input length to the string
+    getParsingFlags(config).charsLeftOver = stringLength - totalParsedInputLength;
+    if (string.length > 0) {
+        getParsingFlags(config).unusedInput.push(string);
+    }
+
+    // clear _12h flag if hour is <= 12
+    if (config._a[HOUR] <= 12 &&
+        getParsingFlags(config).bigHour === true &&
+        config._a[HOUR] > 0) {
+        getParsingFlags(config).bigHour = undefined;
+    }
+
+    getParsingFlags(config).parsedDateParts = config._a.slice(0);
+    getParsingFlags(config).meridiem = config._meridiem;
+    // handle meridiem
+    config._a[HOUR] = meridiemFixWrap(config._locale, config._a[HOUR], config._meridiem);
+
+    configFromArray(config);
+    checkOverflow(config);
+}
+
+
+function meridiemFixWrap (locale, hour, meridiem) {
+    var isPm;
+
+    if (meridiem == null) {
+        // nothing to do
+        return hour;
+    }
+    if (locale.meridiemHour != null) {
+        return locale.meridiemHour(hour, meridiem);
+    } else if (locale.isPM != null) {
+        // Fallback
+        isPm = locale.isPM(meridiem);
+        if (isPm && hour < 12) {
+            hour += 12;
+        }
+        if (!isPm && hour === 12) {
+            hour = 0;
+        }
+        return hour;
+    } else {
+        // this is not supposed to happen
+        return hour;
+    }
+}
+
+// date from string and array of format strings
+function configFromStringAndArray(config) {
+    var tempConfig,
+        bestMoment,
+
+        scoreToBeat,
+        i,
+        currentScore;
+
+    if (config._f.length === 0) {
+        getParsingFlags(config).invalidFormat = true;
+        config._d = new Date(NaN);
+        return;
+    }
+
+    for (i = 0; i < config._f.length; i++) {
+        currentScore = 0;
+        tempConfig = copyConfig({}, config);
+        if (config._useUTC != null) {
+            tempConfig._useUTC = config._useUTC;
+        }
+        tempConfig._f = config._f[i];
+        configFromStringAndFormat(tempConfig);
+
+        if (!isValid(tempConfig)) {
+            continue;
+        }
+
+        // if there is any input that was not parsed add a penalty for that format
+        currentScore += getParsingFlags(tempConfig).charsLeftOver;
+
+        //or tokens
+        currentScore += getParsingFlags(tempConfig).unusedTokens.length * 10;
+
+        getParsingFlags(tempConfig).score = currentScore;
+
+        if (scoreToBeat == null || currentScore < scoreToBeat) {
+            scoreToBeat = currentScore;
+            bestMoment = tempConfig;
+        }
+    }
+
+    extend(config, bestMoment || tempConfig);
+}
+
+function configFromObject(config) {
+    if (config._d) {
+        return;
+    }
+
+    var i = normalizeObjectUnits(config._i);
+    config._a = map([i.year, i.month, i.day || i.date, i.hour, i.minute, i.second, i.millisecond], function (obj) {
+        return obj && parseInt(obj, 10);
+    });
+
+    configFromArray(config);
+}
+
+function createFromConfig (config) {
+    var res = new Moment(checkOverflow(prepareConfig(config)));
+    if (res._nextDay) {
+        // Adding is smart enough around DST
+        res.add(1, 'd');
+        res._nextDay = undefined;
+    }
+
+    return res;
+}
+
+function prepareConfig (config) {
+    var input = config._i,
+        format = config._f;
+
+    config._locale = config._locale || getLocale(config._l);
+
+    if (input === null || (format === undefined && input === '')) {
+        return createInvalid({nullInput: true});
+    }
+
+    if (typeof input === 'string') {
+        config._i = input = config._locale.preparse(input);
+    }
+
+    if (isMoment(input)) {
+        return new Moment(checkOverflow(input));
+    } else if (isDate(input)) {
+        config._d = input;
+    } else if (isArray(format)) {
+        configFromStringAndArray(config);
+    } else if (format) {
+        configFromStringAndFormat(config);
+    }  else {
+        configFromInput(config);
+    }
+
+    if (!isValid(config)) {
+        config._d = null;
+    }
+
+    return config;
+}
+
+function configFromInput(config) {
+    var input = config._i;
+    if (isUndefined(input)) {
+        config._d = new Date(hooks.now());
+    } else if (isDate(input)) {
+        config._d = new Date(input.valueOf());
+    } else if (typeof input === 'string') {
+        configFromString(config);
+    } else if (isArray(input)) {
+        config._a = map(input.slice(0), function (obj) {
+            return parseInt(obj, 10);
+        });
+        configFromArray(config);
+    } else if (isObject(input)) {
+        configFromObject(config);
+    } else if (isNumber(input)) {
+        // from milliseconds
+        config._d = new Date(input);
+    } else {
+        hooks.createFromInputFallback(config);
+    }
+}
+
+function createLocalOrUTC (input, format, locale, strict, isUTC) {
+    var c = {};
+
+    if (locale === true || locale === false) {
+        strict = locale;
+        locale = undefined;
+    }
+
+    if ((isObject(input) && isObjectEmpty(input)) ||
+            (isArray(input) && input.length === 0)) {
+        input = undefined;
+    }
+    // object construction must be done this way.
+    // https://github.com/moment/moment/issues/1423
+    c._isAMomentObject = true;
+    c._useUTC = c._isUTC = isUTC;
+    c._l = locale;
+    c._i = input;
+    c._f = format;
+    c._strict = strict;
+
+    return createFromConfig(c);
+}
+
+function createLocal (input, format, locale, strict) {
+    return createLocalOrUTC(input, format, locale, strict, false);
+}
+
+var prototypeMin = deprecate(
+    'moment().min is deprecated, use moment.max instead. http://momentjs.com/guides/#/warnings/min-max/',
+    function () {
+        var other = createLocal.apply(null, arguments);
+        if (this.isValid() && other.isValid()) {
+            return other < this ? this : other;
+        } else {
+            return createInvalid();
+        }
+    }
+);
+
+var prototypeMax = deprecate(
+    'moment().max is deprecated, use moment.min instead. http://momentjs.com/guides/#/warnings/min-max/',
+    function () {
+        var other = createLocal.apply(null, arguments);
+        if (this.isValid() && other.isValid()) {
+            return other > this ? this : other;
+        } else {
+            return createInvalid();
+        }
+    }
+);
+
+// Pick a moment m from moments so that m[fn](other) is true for all
+// other. This relies on the function fn to be transitive.
+//
+// moments should either be an array of moment objects or an array, whose
+// first element is an array of moment objects.
+function pickBy(fn, moments) {
+    var res, i;
+    if (moments.length === 1 && isArray(moments[0])) {
+        moments = moments[0];
+    }
+    if (!moments.length) {
+        return createLocal();
+    }
+    res = moments[0];
+    for (i = 1; i < moments.length; ++i) {
+        if (!moments[i].isValid() || moments[i][fn](res)) {
+            res = moments[i];
+        }
+    }
+    return res;
+}
+
+// TODO: Use [].sort instead?
+function min () {
+    var args = [].slice.call(arguments, 0);
+
+    return pickBy('isBefore', args);
+}
+
+function max () {
+    var args = [].slice.call(arguments, 0);
+
+    return pickBy('isAfter', args);
+}
+
+var now = function () {
+    return Date.now ? Date.now() : +(new Date());
+};
+
+var ordering = ['year', 'quarter', 'month', 'week', 'day', 'hour', 'minute', 'second', 'millisecond'];
+
+function isDurationValid(m) {
+    for (var key in m) {
+        if (!(indexOf.call(ordering, key) !== -1 && (m[key] == null || !isNaN(m[key])))) {
+            return false;
+        }
+    }
+
+    var unitHasDecimal = false;
+    for (var i = 0; i < ordering.length; ++i) {
+        if (m[ordering[i]]) {
+            if (unitHasDecimal) {
+                return false; // only allow non-integers for smallest unit
+            }
+            if (parseFloat(m[ordering[i]]) !== toInt(m[ordering[i]])) {
+                unitHasDecimal = true;
+            }
+        }
+    }
+
+    return true;
+}
+
+function isValid$1() {
+    return this._isValid;
+}
+
+function createInvalid$1() {
+    return createDuration(NaN);
+}
+
+function Duration (duration) {
+    var normalizedInput = normalizeObjectUnits(duration),
+        years = normalizedInput.year || 0,
+        quarters = normalizedInput.quarter || 0,
+        months = normalizedInput.month || 0,
+        weeks = normalizedInput.week || 0,
+        days = normalizedInput.day || 0,
+        hours = normalizedInput.hour || 0,
+        minutes = normalizedInput.minute || 0,
+        seconds = normalizedInput.second || 0,
+        milliseconds = normalizedInput.millisecond || 0;
+
+    this._isValid = isDurationValid(normalizedInput);
+
+    // representation for dateAddRemove
+    this._milliseconds = +milliseconds +
+        seconds * 1e3 + // 1000
+        minutes * 6e4 + // 1000 * 60
+        hours * 1000 * 60 * 60; //using 1000 * 60 * 60 instead of 36e5 to avoid floating point rounding errors https://github.com/moment/moment/issues/2978
+    // Because of dateAddRemove treats 24 hours as different from a
+    // day when working around DST, we need to store them separately
+    this._days = +days +
+        weeks * 7;
+    // It is impossible to translate months into days without knowing
+    // which months you are are talking about, so we have to store
+    // it separately.
+    this._months = +months +
+        quarters * 3 +
+        years * 12;
+
+    this._data = {};
+
+    this._locale = getLocale();
+
+    this._bubble();
+}
+
+function isDuration (obj) {
+    return obj instanceof Duration;
+}
+
+function absRound (number) {
+    if (number < 0) {
+        return Math.round(-1 * number) * -1;
+    } else {
+        return Math.round(number);
+    }
+}
+
+// FORMATTING
+
+function offset (token, separator) {
+    addFormatToken(token, 0, 0, function () {
+        var offset = this.utcOffset();
+        var sign = '+';
+        if (offset < 0) {
+            offset = -offset;
+            sign = '-';
+        }
+        return sign + zeroFill(~~(offset / 60), 2) + separator + zeroFill(~~(offset) % 60, 2);
+    });
+}
+
+offset('Z', ':');
+offset('ZZ', '');
+
+// PARSING
+
+addRegexToken('Z',  matchShortOffset);
+addRegexToken('ZZ', matchShortOffset);
+addParseToken(['Z', 'ZZ'], function (input, array, config) {
+    config._useUTC = true;
+    config._tzm = offsetFromString(matchShortOffset, input);
+});
+
+// HELPERS
+
+// timezone chunker
+// '+10:00' > ['10',  '00']
+// '-1530'  > ['-15', '30']
+var chunkOffset = /([\+\-]|\d\d)/gi;
+
+function offsetFromString(matcher, string) {
+    var matches = (string || '').match(matcher);
+
+    if (matches === null) {
+        return null;
+    }
+
+    var chunk   = matches[matches.length - 1] || [];
+    var parts   = (chunk + '').match(chunkOffset) || ['-', 0, 0];
+    var minutes = +(parts[1] * 60) + toInt(parts[2]);
+
+    return minutes === 0 ?
+      0 :
+      parts[0] === '+' ? minutes : -minutes;
+}
+
+// Return a moment from input, that is local/utc/zone equivalent to model.
+function cloneWithOffset(input, model) {
+    var res, diff;
+    if (model._isUTC) {
+        res = model.clone();
+        diff = (isMoment(input) || isDate(input) ? input.valueOf() : createLocal(input).valueOf()) - res.valueOf();
+        // Use low-level api, because this fn is low-level api.
+        res._d.setTime(res._d.valueOf() + diff);
+        hooks.updateOffset(res, false);
+        return res;
+    } else {
+        return createLocal(input).local();
+    }
+}
+
+function getDateOffset (m) {
+    // On Firefox.24 Date#getTimezoneOffset returns a floating point.
+    // https://github.com/moment/moment/pull/1871
+    return -Math.round(m._d.getTimezoneOffset() / 15) * 15;
+}
+
+// HOOKS
+
+// This function will be called whenever a moment is mutated.
+// It is intended to keep the offset in sync with the timezone.
+hooks.updateOffset = function () {};
+
+// MOMENTS
+
+// keepLocalTime = true means only change the timezone, without
+// affecting the local hour. So 5:31:26 +0300 --[utcOffset(2, true)]-->
+// 5:31:26 +0200 It is possible that 5:31:26 doesn't exist with offset
+// +0200, so we adjust the time as needed, to be valid.
+//
+// Keeping the time actually adds/subtracts (one hour)
+// from the actual represented time. That is why we call updateOffset
+// a second time. In case it wants us to change the offset again
+// _changeInProgress == true case, then we have to adjust, because
+// there is no such time in the given timezone.
+function getSetOffset (input, keepLocalTime, keepMinutes) {
+    var offset = this._offset || 0,
+        localAdjust;
+    if (!this.isValid()) {
+        return input != null ? this : NaN;
+    }
+    if (input != null) {
+        if (typeof input === 'string') {
+            input = offsetFromString(matchShortOffset, input);
+            if (input === null) {
+                return this;
+            }
+        } else if (Math.abs(input) < 16 && !keepMinutes) {
+            input = input * 60;
+        }
+        if (!this._isUTC && keepLocalTime) {
+            localAdjust = getDateOffset(this);
+        }
+        this._offset = input;
+        this._isUTC = true;
+        if (localAdjust != null) {
+            this.add(localAdjust, 'm');
+        }
+        if (offset !== input) {
+            if (!keepLocalTime || this._changeInProgress) {
+                addSubtract(this, createDuration(input - offset, 'm'), 1, false);
+            } else if (!this._changeInProgress) {
+                this._changeInProgress = true;
+                hooks.updateOffset(this, true);
+                this._changeInProgress = null;
+            }
+        }
+        return this;
+    } else {
+        return this._isUTC ? offset : getDateOffset(this);
+    }
+}
+
+function getSetZone (input, keepLocalTime) {
+    if (input != null) {
+        if (typeof input !== 'string') {
+            input = -input;
+        }
+
+        this.utcOffset(input, keepLocalTime);
+
+        return this;
+    } else {
+        return -this.utcOffset();
+    }
+}
+
+function setOffsetToUTC (keepLocalTime) {
+    return this.utcOffset(0, keepLocalTime);
+}
+
+function setOffsetToLocal (keepLocalTime) {
+    if (this._isUTC) {
+        this.utcOffset(0, keepLocalTime);
+        this._isUTC = false;
+
+        if (keepLocalTime) {
+            this.subtract(getDateOffset(this), 'm');
+        }
+    }
+    return this;
+}
+
+function setOffsetToParsedOffset () {
+    if (this._tzm != null) {
+        this.utcOffset(this._tzm, false, true);
+    } else if (typeof this._i === 'string') {
+        var tZone = offsetFromString(matchOffset, this._i);
+        if (tZone != null) {
+            this.utcOffset(tZone);
+        }
+        else {
+            this.utcOffset(0, true);
+        }
+    }
+    return this;
+}
+
+function hasAlignedHourOffset (input) {
+    if (!this.isValid()) {
+        return false;
+    }
+    input = input ? createLocal(input).utcOffset() : 0;
+
+    return (this.utcOffset() - input) % 60 === 0;
+}
+
+function isDaylightSavingTime () {
+    return (
+        this.utcOffset() > this.clone().month(0).utcOffset() ||
+        this.utcOffset() > this.clone().month(5).utcOffset()
+    );
+}
+
+function isDaylightSavingTimeShifted () {
+    if (!isUndefined(this._isDSTShifted)) {
+        return this._isDSTShifted;
+    }
+
+    var c = {};
+
+    copyConfig(c, this);
+    c = prepareConfig(c);
+
+    if (c._a) {
+        var other = c._isUTC ? createUTC(c._a) : createLocal(c._a);
+        this._isDSTShifted = this.isValid() &&
+            compareArrays(c._a, other.toArray()) > 0;
+    } else {
+        this._isDSTShifted = false;
+    }
+
+    return this._isDSTShifted;
+}
+
+function isLocal () {
+    return this.isValid() ? !this._isUTC : false;
+}
+
+function isUtcOffset () {
+    return this.isValid() ? this._isUTC : false;
+}
+
+function isUtc () {
+    return this.isValid() ? this._isUTC && this._offset === 0 : false;
+}
+
+// ASP.NET json date format regex
+var aspNetRegex = /^(\-|\+)?(?:(\d*)[. ])?(\d+)\:(\d+)(?:\:(\d+)(\.\d*)?)?$/;
+
+// from http://docs.closure-library.googlecode.com/git/closure_goog_date_date.js.source.html
+// somewhat more in line with 4.4.3.2 2004 spec, but allows decimal anywhere
+// and further modified to allow for strings containing both week and day
+var isoRegex = /^(-|\+)?P(?:([-+]?[0-9,.]*)Y)?(?:([-+]?[0-9,.]*)M)?(?:([-+]?[0-9,.]*)W)?(?:([-+]?[0-9,.]*)D)?(?:T(?:([-+]?[0-9,.]*)H)?(?:([-+]?[0-9,.]*)M)?(?:([-+]?[0-9,.]*)S)?)?$/;
+
+function createDuration (input, key) {
+    var duration = input,
+        // matching against regexp is expensive, do it on demand
+        match = null,
+        sign,
+        ret,
+        diffRes;
+
+    if (isDuration(input)) {
+        duration = {
+            ms : input._milliseconds,
+            d  : input._days,
+            M  : input._months
+        };
+    } else if (isNumber(input)) {
+        duration = {};
+        if (key) {
+            duration[key] = input;
+        } else {
+            duration.milliseconds = input;
+        }
+    } else if (!!(match = aspNetRegex.exec(input))) {
+        sign = (match[1] === '-') ? -1 : 1;
+        duration = {
+            y  : 0,
+            d  : toInt(match[DATE])                         * sign,
+            h  : toInt(match[HOUR])                         * sign,
+            m  : toInt(match[MINUTE])                       * sign,
+            s  : toInt(match[SECOND])                       * sign,
+            ms : toInt(absRound(match[MILLISECOND] * 1000)) * sign // the millisecond decimal point is included in the match
+        };
+    } else if (!!(match = isoRegex.exec(input))) {
+        sign = (match[1] === '-') ? -1 : (match[1] === '+') ? 1 : 1;
+        duration = {
+            y : parseIso(match[2], sign),
+            M : parseIso(match[3], sign),
+            w : parseIso(match[4], sign),
+            d : parseIso(match[5], sign),
+            h : parseIso(match[6], sign),
+            m : parseIso(match[7], sign),
+            s : parseIso(match[8], sign)
+        };
+    } else if (duration == null) {// checks for null or undefined
+        duration = {};
+    } else if (typeof duration === 'object' && ('from' in duration || 'to' in duration)) {
+        diffRes = momentsDifference(createLocal(duration.from), createLocal(duration.to));
+
+        duration = {};
+        duration.ms = diffRes.milliseconds;
+        duration.M = diffRes.months;
+    }
+
+    ret = new Duration(duration);
+
+    if (isDuration(input) && hasOwnProp(input, '_locale')) {
+        ret._locale = input._locale;
+    }
+
+    return ret;
+}
+
+createDuration.fn = Duration.prototype;
+createDuration.invalid = createInvalid$1;
+
+function parseIso (inp, sign) {
+    // We'd normally use ~~inp for this, but unfortunately it also
+    // converts floats to ints.
+    // inp may be undefined, so careful calling replace on it.
+    var res = inp && parseFloat(inp.replace(',', '.'));
+    // apply sign while we're at it
+    return (isNaN(res) ? 0 : res) * sign;
+}
+
+function positiveMomentsDifference(base, other) {
+    var res = {milliseconds: 0, months: 0};
+
+    res.months = other.month() - base.month() +
+        (other.year() - base.year()) * 12;
+    if (base.clone().add(res.months, 'M').isAfter(other)) {
+        --res.months;
+    }
+
+    res.milliseconds = +other - +(base.clone().add(res.months, 'M'));
+
+    return res;
+}
+
+function momentsDifference(base, other) {
+    var res;
+    if (!(base.isValid() && other.isValid())) {
+        return {milliseconds: 0, months: 0};
+    }
+
+    other = cloneWithOffset(other, base);
+    if (base.isBefore(other)) {
+        res = positiveMomentsDifference(base, other);
+    } else {
+        res = positiveMomentsDifference(other, base);
+        res.milliseconds = -res.milliseconds;
+        res.months = -res.months;
+    }
+
+    return res;
+}
+
+// TODO: remove 'name' arg after deprecation is removed
+function createAdder(direction, name) {
+    return function (val, period) {
+        var dur, tmp;
+        //invert the arguments, but complain about it
+        if (period !== null && !isNaN(+period)) {
+            deprecateSimple(name, 'moment().' + name  + '(period, number) is deprecated. Please use moment().' + name + '(number, period). ' +
+            'See http://momentjs.com/guides/#/warnings/add-inverted-param/ for more info.');
+            tmp = val; val = period; period = tmp;
+        }
+
+        val = typeof val === 'string' ? +val : val;
+        dur = createDuration(val, period);
+        addSubtract(this, dur, direction);
+        return this;
+    };
+}
+
+function addSubtract (mom, duration, isAdding, updateOffset) {
+    var milliseconds = duration._milliseconds,
+        days = absRound(duration._days),
+        months = absRound(duration._months);
+
+    if (!mom.isValid()) {
+        // No op
+        return;
+    }
+
+    updateOffset = updateOffset == null ? true : updateOffset;
+
+    if (months) {
+        setMonth(mom, get(mom, 'Month') + months * isAdding);
+    }
+    if (days) {
+        set$1(mom, 'Date', get(mom, 'Date') + days * isAdding);
+    }
+    if (milliseconds) {
+        mom._d.setTime(mom._d.valueOf() + milliseconds * isAdding);
+    }
+    if (updateOffset) {
+        hooks.updateOffset(mom, days || months);
+    }
+}
+
+var add      = createAdder(1, 'add');
+var subtract = createAdder(-1, 'subtract');
+
+function getCalendarFormat(myMoment, now) {
+    var diff = myMoment.diff(now, 'days', true);
+    return diff < -6 ? 'sameElse' :
+            diff < -1 ? 'lastWeek' :
+            diff < 0 ? 'lastDay' :
+            diff < 1 ? 'sameDay' :
+            diff < 2 ? 'nextDay' :
+            diff < 7 ? 'nextWeek' : 'sameElse';
+}
+
+function calendar$1 (time, formats) {
+    // We want to compare the start of today, vs this.
+    // Getting start-of-today depends on whether we're local/utc/offset or not.
+    var now = time || createLocal(),
+        sod = cloneWithOffset(now, this).startOf('day'),
+        format = hooks.calendarFormat(this, sod) || 'sameElse';
+
+    var output = formats && (isFunction(formats[format]) ? formats[format].call(this, now) : formats[format]);
+
+    return this.format(output || this.localeData().calendar(format, this, createLocal(now)));
+}
+
+function clone () {
+    return new Moment(this);
+}
+
+function isAfter (input, units) {
+    var localInput = isMoment(input) ? input : createLocal(input);
+    if (!(this.isValid() && localInput.isValid())) {
+        return false;
+    }
+    units = normalizeUnits(!isUndefined(units) ? units : 'millisecond');
+    if (units === 'millisecond') {
+        return this.valueOf() > localInput.valueOf();
+    } else {
+        return localInput.valueOf() < this.clone().startOf(units).valueOf();
+    }
+}
+
+function isBefore (input, units) {
+    var localInput = isMoment(input) ? input : createLocal(input);
+    if (!(this.isValid() && localInput.isValid())) {
+        return false;
+    }
+    units = normalizeUnits(!isUndefined(units) ? units : 'millisecond');
+    if (units === 'millisecond') {
+        return this.valueOf() < localInput.valueOf();
+    } else {
+        return this.clone().endOf(units).valueOf() < localInput.valueOf();
+    }
+}
+
+function isBetween (from, to, units, inclusivity) {
+    inclusivity = inclusivity || '()';
+    return (inclusivity[0] === '(' ? this.isAfter(from, units) : !this.isBefore(from, units)) &&
+        (inclusivity[1] === ')' ? this.isBefore(to, units) : !this.isAfter(to, units));
+}
+
+function isSame (input, units) {
+    var localInput = isMoment(input) ? input : createLocal(input),
+        inputMs;
+    if (!(this.isValid() && localInput.isValid())) {
+        return false;
+    }
+    units = normalizeUnits(units || 'millisecond');
+    if (units === 'millisecond') {
+        return this.valueOf() === localInput.valueOf();
+    } else {
+        inputMs = localInput.valueOf();
+        return this.clone().startOf(units).valueOf() <= inputMs && inputMs <= this.clone().endOf(units).valueOf();
+    }
+}
+
+function isSameOrAfter (input, units) {
+    return this.isSame(input, units) || this.isAfter(input,units);
+}
+
+function isSameOrBefore (input, units) {
+    return this.isSame(input, units) || this.isBefore(input,units);
+}
+
+function diff (input, units, asFloat) {
+    var that,
+        zoneDelta,
+        delta, output;
+
+    if (!this.isValid()) {
+        return NaN;
+    }
+
+    that = cloneWithOffset(input, this);
+
+    if (!that.isValid()) {
+        return NaN;
+    }
+
+    zoneDelta = (that.utcOffset() - this.utcOffset()) * 6e4;
+
+    units = normalizeUnits(units);
+
+    switch (units) {
+        case 'year': output = monthDiff(this, that) / 12; break;
+        case 'month': output = monthDiff(this, that); break;
+        case 'quarter': output = monthDiff(this, that) / 3; break;
+        case 'second': output = (this - that) / 1e3; break; // 1000
+        case 'minute': output = (this - that) / 6e4; break; // 1000 * 60
+        case 'hour': output = (this - that) / 36e5; break; // 1000 * 60 * 60
+        case 'day': output = (this - that - zoneDelta) / 864e5; break; // 1000 * 60 * 60 * 24, negate dst
+        case 'week': output = (this - that - zoneDelta) / 6048e5; break; // 1000 * 60 * 60 * 24 * 7, negate dst
+        default: output = this - that;
+    }
+
+    return asFloat ? output : absFloor(output);
+}
+
+function monthDiff (a, b) {
+    // difference in months
+    var wholeMonthDiff = ((b.year() - a.year()) * 12) + (b.month() - a.month()),
+        // b is in (anchor - 1 month, anchor + 1 month)
+        anchor = a.clone().add(wholeMonthDiff, 'months'),
+        anchor2, adjust;
+
+    if (b - anchor < 0) {
+        anchor2 = a.clone().add(wholeMonthDiff - 1, 'months');
+        // linear across the month
+        adjust = (b - anchor) / (anchor - anchor2);
+    } else {
+        anchor2 = a.clone().add(wholeMonthDiff + 1, 'months');
+        // linear across the month
+        adjust = (b - anchor) / (anchor2 - anchor);
+    }
+
+    //check for negative zero, return zero if negative zero
+    return -(wholeMonthDiff + adjust) || 0;
+}
+
+hooks.defaultFormat = 'YYYY-MM-DDTHH:mm:ssZ';
+hooks.defaultFormatUtc = 'YYYY-MM-DDTHH:mm:ss[Z]';
+
+function toString () {
+    return this.clone().locale('en').format('ddd MMM DD YYYY HH:mm:ss [GMT]ZZ');
+}
+
+function toISOString(keepOffset) {
+    if (!this.isValid()) {
+        return null;
+    }
+    var utc = keepOffset !== true;
+    var m = utc ? this.clone().utc() : this;
+    if (m.year() < 0 || m.year() > 9999) {
+        return formatMoment(m, utc ? 'YYYYYY-MM-DD[T]HH:mm:ss.SSS[Z]' : 'YYYYYY-MM-DD[T]HH:mm:ss.SSSZ');
+    }
+    if (isFunction(Date.prototype.toISOString)) {
+        // native implementation is ~50x faster, use it when we can
+        if (utc) {
+            return this.toDate().toISOString();
+        } else {
+            return new Date(this._d.valueOf()).toISOString().replace('Z', formatMoment(m, 'Z'));
+        }
+    }
+    return formatMoment(m, utc ? 'YYYY-MM-DD[T]HH:mm:ss.SSS[Z]' : 'YYYY-MM-DD[T]HH:mm:ss.SSSZ');
+}
+
+/**
+ * Return a human readable representation of a moment that can
+ * also be evaluated to get a new moment which is the same
+ *
+ * @link https://nodejs.org/dist/latest/docs/api/util.html#util_custom_inspect_function_on_objects
+ */
+function inspect () {
+    if (!this.isValid()) {
+        return 'moment.invalid(/* ' + this._i + ' */)';
+    }
+    var func = 'moment';
+    var zone = '';
+    if (!this.isLocal()) {
+        func = this.utcOffset() === 0 ? 'moment.utc' : 'moment.parseZone';
+        zone = 'Z';
+    }
+    var prefix = '[' + func + '("]';
+    var year = (0 <= this.year() && this.year() <= 9999) ? 'YYYY' : 'YYYYYY';
+    var datetime = '-MM-DD[T]HH:mm:ss.SSS';
+    var suffix = zone + '[")]';
+
+    return this.format(prefix + year + datetime + suffix);
+}
+
+function format (inputString) {
+    if (!inputString) {
+        inputString = this.isUtc() ? hooks.defaultFormatUtc : hooks.defaultFormat;
+    }
+    var output = formatMoment(this, inputString);
+    return this.localeData().postformat(output);
+}
+
+function from (time, withoutSuffix) {
+    if (this.isValid() &&
+            ((isMoment(time) && time.isValid()) ||
+             createLocal(time).isValid())) {
+        return createDuration({to: this, from: time}).locale(this.locale()).humanize(!withoutSuffix);
+    } else {
+        return this.localeData().invalidDate();
+    }
+}
+
+function fromNow (withoutSuffix) {
+    return this.from(createLocal(), withoutSuffix);
+}
+
+function to (time, withoutSuffix) {
+    if (this.isValid() &&
+            ((isMoment(time) && time.isValid()) ||
+             createLocal(time).isValid())) {
+        return createDuration({from: this, to: time}).locale(this.locale()).humanize(!withoutSuffix);
+    } else {
+        return this.localeData().invalidDate();
+    }
+}
+
+function toNow (withoutSuffix) {
+    return this.to(createLocal(), withoutSuffix);
+}
+
+// If passed a locale key, it will set the locale for this
+// instance.  Otherwise, it will return the locale configuration
+// variables for this instance.
+function locale (key) {
+    var newLocaleData;
+
+    if (key === undefined) {
+        return this._locale._abbr;
+    } else {
+        newLocaleData = getLocale(key);
+        if (newLocaleData != null) {
+            this._locale = newLocaleData;
+        }
+        return this;
+    }
+}
+
+var lang = deprecate(
+    'moment().lang() is deprecated. Instead, use moment().localeData() to get the language configuration. Use moment().locale() to change languages.',
+    function (key) {
+        if (key === undefined) {
+            return this.localeData();
+        } else {
+            return this.locale(key);
+        }
+    }
+);
+
+function localeData () {
+    return this._locale;
+}
+
+function startOf (units) {
+    units = normalizeUnits(units);
+    // the following switch intentionally omits break keywords
+    // to utilize falling through the cases.
+    switch (units) {
+        case 'year':
+            this.month(0);
+            /* falls through */
+        case 'quarter':
+        case 'month':
+            this.date(1);
+            /* falls through */
+        case 'week':
+        case 'isoWeek':
+        case 'day':
+        case 'date':
+            this.hours(0);
+            /* falls through */
+        case 'hour':
+            this.minutes(0);
+            /* falls through */
+        case 'minute':
+            this.seconds(0);
+            /* falls through */
+        case 'second':
+            this.milliseconds(0);
+    }
+
+    // weeks are a special case
+    if (units === 'week') {
+        this.weekday(0);
+    }
+    if (units === 'isoWeek') {
+        this.isoWeekday(1);
+    }
+
+    // quarters are also special
+    if (units === 'quarter') {
+        this.month(Math.floor(this.month() / 3) * 3);
+    }
+
+    return this;
+}
+
+function endOf (units) {
+    units = normalizeUnits(units);
+    if (units === undefined || units === 'millisecond') {
+        return this;
+    }
+
+    // 'date' is an alias for 'day', so it should be considered as such.
+    if (units === 'date') {
+        units = 'day';
+    }
+
+    return this.startOf(units).add(1, (units === 'isoWeek' ? 'week' : units)).subtract(1, 'ms');
+}
+
+function valueOf () {
+    return this._d.valueOf() - ((this._offset || 0) * 60000);
+}
+
+function unix () {
+    return Math.floor(this.valueOf() / 1000);
+}
+
+function toDate () {
+    return new Date(this.valueOf());
+}
+
+function toArray () {
+    var m = this;
+    return [m.year(), m.month(), m.date(), m.hour(), m.minute(), m.second(), m.millisecond()];
+}
+
+function toObject () {
+    var m = this;
+    return {
+        years: m.year(),
+        months: m.month(),
+        date: m.date(),
+        hours: m.hours(),
+        minutes: m.minutes(),
+        seconds: m.seconds(),
+        milliseconds: m.milliseconds()
+    };
+}
+
+function toJSON () {
+    // new Date(NaN).toJSON() === null
+    return this.isValid() ? this.toISOString() : null;
+}
+
+function isValid$2 () {
+    return isValid(this);
+}
+
+function parsingFlags () {
+    return extend({}, getParsingFlags(this));
+}
+
+function invalidAt () {
+    return getParsingFlags(this).overflow;
+}
+
+function creationData() {
+    return {
+        input: this._i,
+        format: this._f,
+        locale: this._locale,
+        isUTC: this._isUTC,
+        strict: this._strict
+    };
+}
+
+// FORMATTING
+
+addFormatToken(0, ['gg', 2], 0, function () {
+    return this.weekYear() % 100;
+});
+
+addFormatToken(0, ['GG', 2], 0, function () {
+    return this.isoWeekYear() % 100;
+});
+
+function addWeekYearFormatToken (token, getter) {
+    addFormatToken(0, [token, token.length], 0, getter);
+}
+
+addWeekYearFormatToken('gggg',     'weekYear');
+addWeekYearFormatToken('ggggg',    'weekYear');
+addWeekYearFormatToken('GGGG',  'isoWeekYear');
+addWeekYearFormatToken('GGGGG', 'isoWeekYear');
+
+// ALIASES
+
+addUnitAlias('weekYear', 'gg');
+addUnitAlias('isoWeekYear', 'GG');
+
+// PRIORITY
+
+addUnitPriority('weekYear', 1);
+addUnitPriority('isoWeekYear', 1);
+
+
+// PARSING
+
+addRegexToken('G',      matchSigned);
+addRegexToken('g',      matchSigned);
+addRegexToken('GG',     match1to2, match2);
+addRegexToken('gg',     match1to2, match2);
+addRegexToken('GGGG',   match1to4, match4);
+addRegexToken('gggg',   match1to4, match4);
+addRegexToken('GGGGG',  match1to6, match6);
+addRegexToken('ggggg',  match1to6, match6);
+
+addWeekParseToken(['gggg', 'ggggg', 'GGGG', 'GGGGG'], function (input, week, config, token) {
+    week[token.substr(0, 2)] = toInt(input);
+});
+
+addWeekParseToken(['gg', 'GG'], function (input, week, config, token) {
+    week[token] = hooks.parseTwoDigitYear(input);
+});
+
+// MOMENTS
+
+function getSetWeekYear (input) {
+    return getSetWeekYearHelper.call(this,
+            input,
+            this.week(),
+            this.weekday(),
+            this.localeData()._week.dow,
+            this.localeData()._week.doy);
+}
+
+function getSetISOWeekYear (input) {
+    return getSetWeekYearHelper.call(this,
+            input, this.isoWeek(), this.isoWeekday(), 1, 4);
+}
+
+function getISOWeeksInYear () {
+    return weeksInYear(this.year(), 1, 4);
+}
+
+function getWeeksInYear () {
+    var weekInfo = this.localeData()._week;
+    return weeksInYear(this.year(), weekInfo.dow, weekInfo.doy);
+}
+
+function getSetWeekYearHelper(input, week, weekday, dow, doy) {
+    var weeksTarget;
+    if (input == null) {
+        return weekOfYear(this, dow, doy).year;
+    } else {
+        weeksTarget = weeksInYear(input, dow, doy);
+        if (week > weeksTarget) {
+            week = weeksTarget;
+        }
+        return setWeekAll.call(this, input, week, weekday, dow, doy);
+    }
+}
+
+function setWeekAll(weekYear, week, weekday, dow, doy) {
+    var dayOfYearData = dayOfYearFromWeeks(weekYear, week, weekday, dow, doy),
+        date = createUTCDate(dayOfYearData.year, 0, dayOfYearData.dayOfYear);
+
+    this.year(date.getUTCFullYear());
+    this.month(date.getUTCMonth());
+    this.date(date.getUTCDate());
+    return this;
+}
+
+// FORMATTING
+
+addFormatToken('Q', 0, 'Qo', 'quarter');
+
+// ALIASES
+
+addUnitAlias('quarter', 'Q');
+
+// PRIORITY
+
+addUnitPriority('quarter', 7);
+
+// PARSING
+
+addRegexToken('Q', match1);
+addParseToken('Q', function (input, array) {
+    array[MONTH] = (toInt(input) - 1) * 3;
+});
+
+// MOMENTS
+
+function getSetQuarter (input) {
+    return input == null ? Math.ceil((this.month() + 1) / 3) : this.month((input - 1) * 3 + this.month() % 3);
+}
+
+// FORMATTING
+
+addFormatToken('D', ['DD', 2], 'Do', 'date');
+
+// ALIASES
+
+addUnitAlias('date', 'D');
+
+// PRIOROITY
+addUnitPriority('date', 9);
+
+// PARSING
+
+addRegexToken('D',  match1to2);
+addRegexToken('DD', match1to2, match2);
+addRegexToken('Do', function (isStrict, locale) {
+    // TODO: Remove "ordinalParse" fallback in next major release.
+    return isStrict ?
+      (locale._dayOfMonthOrdinalParse || locale._ordinalParse) :
+      locale._dayOfMonthOrdinalParseLenient;
+});
+
+addParseToken(['D', 'DD'], DATE);
+addParseToken('Do', function (input, array) {
+    array[DATE] = toInt(input.match(match1to2)[0]);
+});
+
+// MOMENTS
+
+var getSetDayOfMonth = makeGetSet('Date', true);
+
+// FORMATTING
+
+addFormatToken('DDD', ['DDDD', 3], 'DDDo', 'dayOfYear');
+
+// ALIASES
+
+addUnitAlias('dayOfYear', 'DDD');
+
+// PRIORITY
+addUnitPriority('dayOfYear', 4);
+
+// PARSING
+
+addRegexToken('DDD',  match1to3);
+addRegexToken('DDDD', match3);
+addParseToken(['DDD', 'DDDD'], function (input, array, config) {
+    config._dayOfYear = toInt(input);
+});
+
+// HELPERS
+
+// MOMENTS
+
+function getSetDayOfYear (input) {
+    var dayOfYear = Math.round((this.clone().startOf('day') - this.clone().startOf('year')) / 864e5) + 1;
+    return input == null ? dayOfYear : this.add((input - dayOfYear), 'd');
+}
+
+// FORMATTING
+
+addFormatToken('m', ['mm', 2], 0, 'minute');
+
+// ALIASES
+
+addUnitAlias('minute', 'm');
+
+// PRIORITY
+
+addUnitPriority('minute', 14);
+
+// PARSING
+
+addRegexToken('m',  match1to2);
+addRegexToken('mm', match1to2, match2);
+addParseToken(['m', 'mm'], MINUTE);
+
+// MOMENTS
+
+var getSetMinute = makeGetSet('Minutes', false);
+
+// FORMATTING
+
+addFormatToken('s', ['ss', 2], 0, 'second');
+
+// ALIASES
+
+addUnitAlias('second', 's');
+
+// PRIORITY
+
+addUnitPriority('second', 15);
+
+// PARSING
+
+addRegexToken('s',  match1to2);
+addRegexToken('ss', match1to2, match2);
+addParseToken(['s', 'ss'], SECOND);
+
+// MOMENTS
+
+var getSetSecond = makeGetSet('Seconds', false);
+
+// FORMATTING
+
+addFormatToken('S', 0, 0, function () {
+    return ~~(this.millisecond() / 100);
+});
+
+addFormatToken(0, ['SS', 2], 0, function () {
+    return ~~(this.millisecond() / 10);
+});
+
+addFormatToken(0, ['SSS', 3], 0, 'millisecond');
+addFormatToken(0, ['SSSS', 4], 0, function () {
+    return this.millisecond() * 10;
+});
+addFormatToken(0, ['SSSSS', 5], 0, function () {
+    return this.millisecond() * 100;
+});
+addFormatToken(0, ['SSSSSS', 6], 0, function () {
+    return this.millisecond() * 1000;
+});
+addFormatToken(0, ['SSSSSSS', 7], 0, function () {
+    return this.millisecond() * 10000;
+});
+addFormatToken(0, ['SSSSSSSS', 8], 0, function () {
+    return this.millisecond() * 100000;
+});
+addFormatToken(0, ['SSSSSSSSS', 9], 0, function () {
+    return this.millisecond() * 1000000;
+});
+
+
+// ALIASES
+
+addUnitAlias('millisecond', 'ms');
+
+// PRIORITY
+
+addUnitPriority('millisecond', 16);
+
+// PARSING
+
+addRegexToken('S',    match1to3, match1);
+addRegexToken('SS',   match1to3, match2);
+addRegexToken('SSS',  match1to3, match3);
+
+var token;
+for (token = 'SSSS'; token.length <= 9; token += 'S') {
+    addRegexToken(token, matchUnsigned);
+}
+
+function parseMs(input, array) {
+    array[MILLISECOND] = toInt(('0.' + input) * 1000);
+}
+
+for (token = 'S'; token.length <= 9; token += 'S') {
+    addParseToken(token, parseMs);
+}
+// MOMENTS
+
+var getSetMillisecond = makeGetSet('Milliseconds', false);
+
+// FORMATTING
+
+addFormatToken('z',  0, 0, 'zoneAbbr');
+addFormatToken('zz', 0, 0, 'zoneName');
+
+// MOMENTS
+
+function getZoneAbbr () {
+    return this._isUTC ? 'UTC' : '';
+}
+
+function getZoneName () {
+    return this._isUTC ? 'Coordinated Universal Time' : '';
+}
+
+var proto = Moment.prototype;
+
+proto.add               = add;
+proto.calendar          = calendar$1;
+proto.clone             = clone;
+proto.diff              = diff;
+proto.endOf             = endOf;
+proto.format            = format;
+proto.from              = from;
+proto.fromNow           = fromNow;
+proto.to                = to;
+proto.toNow             = toNow;
+proto.get               = stringGet;
+proto.invalidAt         = invalidAt;
+proto.isAfter           = isAfter;
+proto.isBefore          = isBefore;
+proto.isBetween         = isBetween;
+proto.isSame            = isSame;
+proto.isSameOrAfter     = isSameOrAfter;
+proto.isSameOrBefore    = isSameOrBefore;
+proto.isValid           = isValid$2;
+proto.lang              = lang;
+proto.locale            = locale;
+proto.localeData        = localeData;
+proto.max               = prototypeMax;
+proto.min               = prototypeMin;
+proto.parsingFlags      = parsingFlags;
+proto.set               = stringSet;
+proto.startOf           = startOf;
+proto.subtract          = subtract;
+proto.toArray           = toArray;
+proto.toObject          = toObject;
+proto.toDate            = toDate;
+proto.toISOString       = toISOString;
+proto.inspect           = inspect;
+proto.toJSON            = toJSON;
+proto.toString          = toString;
+proto.unix              = unix;
+proto.valueOf           = valueOf;
+proto.creationData      = creationData;
+
+// Year
+proto.year       = getSetYear;
+proto.isLeapYear = getIsLeapYear;
+
+// Week Year
+proto.weekYear    = getSetWeekYear;
+proto.isoWeekYear = getSetISOWeekYear;
+
+// Quarter
+proto.quarter = proto.quarters = getSetQuarter;
+
+// Month
+proto.month       = getSetMonth;
+proto.daysInMonth = getDaysInMonth;
+
+// Week
+proto.week           = proto.weeks        = getSetWeek;
+proto.isoWeek        = proto.isoWeeks     = getSetISOWeek;
+proto.weeksInYear    = getWeeksInYear;
+proto.isoWeeksInYear = getISOWeeksInYear;
+
+// Day
+proto.date       = getSetDayOfMonth;
+proto.day        = proto.days             = getSetDayOfWeek;
+proto.weekday    = getSetLocaleDayOfWeek;
+proto.isoWeekday = getSetISODayOfWeek;
+proto.dayOfYear  = getSetDayOfYear;
+
+// Hour
+proto.hour = proto.hours = getSetHour;
+
+// Minute
+proto.minute = proto.minutes = getSetMinute;
+
+// Second
+proto.second = proto.seconds = getSetSecond;
+
+// Millisecond
+proto.millisecond = proto.milliseconds = getSetMillisecond;
+
+// Offset
+proto.utcOffset            = getSetOffset;
+proto.utc                  = setOffsetToUTC;
+proto.local                = setOffsetToLocal;
+proto.parseZone            = setOffsetToParsedOffset;
+proto.hasAlignedHourOffset = hasAlignedHourOffset;
+proto.isDST                = isDaylightSavingTime;
+proto.isLocal              = isLocal;
+proto.isUtcOffset          = isUtcOffset;
+proto.isUtc                = isUtc;
+proto.isUTC                = isUtc;
+
+// Timezone
+proto.zoneAbbr = getZoneAbbr;
+proto.zoneName = getZoneName;
+
+// Deprecations
+proto.dates  = deprecate('dates accessor is deprecated. Use date instead.', getSetDayOfMonth);
+proto.months = deprecate('months accessor is deprecated. Use month instead', getSetMonth);
+proto.years  = deprecate('years accessor is deprecated. Use year instead', getSetYear);
+proto.zone   = deprecate('moment().zone is deprecated, use moment().utcOffset instead. http://momentjs.com/guides/#/warnings/zone/', getSetZone);
+proto.isDSTShifted = deprecate('isDSTShifted is deprecated. See http://momentjs.com/guides/#/warnings/dst-shifted/ for more information', isDaylightSavingTimeShifted);
+
+function createUnix (input) {
+    return createLocal(input * 1000);
+}
+
+function createInZone () {
+    return createLocal.apply(null, arguments).parseZone();
+}
+
+function preParsePostFormat (string) {
+    return string;
+}
+
+var proto$1 = Locale.prototype;
+
+proto$1.calendar        = calendar;
+proto$1.longDateFormat  = longDateFormat;
+proto$1.invalidDate     = invalidDate;
+proto$1.ordinal         = ordinal;
+proto$1.preparse        = preParsePostFormat;
+proto$1.postformat      = preParsePostFormat;
+proto$1.relativeTime    = relativeTime;
+proto$1.pastFuture      = pastFuture;
+proto$1.set             = set;
+
+// Month
+proto$1.months            =        localeMonths;
+proto$1.monthsShort       =        localeMonthsShort;
+proto$1.monthsParse       =        localeMonthsParse;
+proto$1.monthsRegex       = monthsRegex;
+proto$1.monthsShortRegex  = monthsShortRegex;
+
+// Week
+proto$1.week = localeWeek;
+proto$1.firstDayOfYear = localeFirstDayOfYear;
+proto$1.firstDayOfWeek = localeFirstDayOfWeek;
+
+// Day of Week
+proto$1.weekdays       =        localeWeekdays;
+proto$1.weekdaysMin    =        localeWeekdaysMin;
+proto$1.weekdaysShort  =        localeWeekdaysShort;
+proto$1.weekdaysParse  =        localeWeekdaysParse;
+
+proto$1.weekdaysRegex       =        weekdaysRegex;
+proto$1.weekdaysShortRegex  =        weekdaysShortRegex;
+proto$1.weekdaysMinRegex    =        weekdaysMinRegex;
+
+// Hours
+proto$1.isPM = localeIsPM;
+proto$1.meridiem = localeMeridiem;
+
+function get$1 (format, index, field, setter) {
+    var locale = getLocale();
+    var utc = createUTC().set(setter, index);
+    return locale[field](utc, format);
+}
+
+function listMonthsImpl (format, index, field) {
+    if (isNumber(format)) {
+        index = format;
+        format = undefined;
+    }
+
+    format = format || '';
+
+    if (index != null) {
+        return get$1(format, index, field, 'month');
+    }
+
+    var i;
+    var out = [];
+    for (i = 0; i < 12; i++) {
+        out[i] = get$1(format, i, field, 'month');
+    }
+    return out;
+}
+
+// ()
+// (5)
+// (fmt, 5)
+// (fmt)
+// (true)
+// (true, 5)
+// (true, fmt, 5)
+// (true, fmt)
+function listWeekdaysImpl (localeSorted, format, index, field) {
+    if (typeof localeSorted === 'boolean') {
+        if (isNumber(format)) {
+            index = format;
+            format = undefined;
+        }
+
+        format = format || '';
+    } else {
+        format = localeSorted;
+        index = format;
+        localeSorted = false;
+
+        if (isNumber(format)) {
+            index = format;
+            format = undefined;
+        }
+
+        format = format || '';
+    }
+
+    var locale = getLocale(),
+        shift = localeSorted ? locale._week.dow : 0;
+
+    if (index != null) {
+        return get$1(format, (index + shift) % 7, field, 'day');
+    }
+
+    var i;
+    var out = [];
+    for (i = 0; i < 7; i++) {
+        out[i] = get$1(format, (i + shift) % 7, field, 'day');
+    }
+    return out;
+}
+
+function listMonths (format, index) {
+    return listMonthsImpl(format, index, 'months');
+}
+
+function listMonthsShort (format, index) {
+    return listMonthsImpl(format, index, 'monthsShort');
+}
+
+function listWeekdays (localeSorted, format, index) {
+    return listWeekdaysImpl(localeSorted, format, index, 'weekdays');
+}
+
+function listWeekdaysShort (localeSorted, format, index) {
+    return listWeekdaysImpl(localeSorted, format, index, 'weekdaysShort');
+}
+
+function listWeekdaysMin (localeSorted, format, index) {
+    return listWeekdaysImpl(localeSorted, format, index, 'weekdaysMin');
+}
+
+getSetGlobalLocale('en', {
+    dayOfMonthOrdinalParse: /\d{1,2}(th|st|nd|rd)/,
+    ordinal : function (number) {
+        var b = number % 10,
+            output = (toInt(number % 100 / 10) === 1) ? 'th' :
+            (b === 1) ? 'st' :
+            (b === 2) ? 'nd' :
+            (b === 3) ? 'rd' : 'th';
+        return number + output;
+    }
+});
+
+// Side effect imports
+hooks.lang = deprecate('moment.lang is deprecated. Use moment.locale instead.', getSetGlobalLocale);
+hooks.langData = deprecate('moment.langData is deprecated. Use moment.localeData instead.', getLocale);
+
+var mathAbs = Math.abs;
+
+function abs () {
+    var data           = this._data;
+
+    this._milliseconds = mathAbs(this._milliseconds);
+    this._days         = mathAbs(this._days);
+    this._months       = mathAbs(this._months);
+
+    data.milliseconds  = mathAbs(data.milliseconds);
+    data.seconds       = mathAbs(data.seconds);
+    data.minutes       = mathAbs(data.minutes);
+    data.hours         = mathAbs(data.hours);
+    data.months        = mathAbs(data.months);
+    data.years         = mathAbs(data.years);
+
+    return this;
+}
+
+function addSubtract$1 (duration, input, value, direction) {
+    var other = createDuration(input, value);
+
+    duration._milliseconds += direction * other._milliseconds;
+    duration._days         += direction * other._days;
+    duration._months       += direction * other._months;
+
+    return duration._bubble();
+}
+
+// supports only 2.0-style add(1, 's') or add(duration)
+function add$1 (input, value) {
+    return addSubtract$1(this, input, value, 1);
+}
+
+// supports only 2.0-style subtract(1, 's') or subtract(duration)
+function subtract$1 (input, value) {
+    return addSubtract$1(this, input, value, -1);
+}
+
+function absCeil (number) {
+    if (number < 0) {
+        return Math.floor(number);
+    } else {
+        return Math.ceil(number);
+    }
+}
+
+function bubble () {
+    var milliseconds = this._milliseconds;
+    var days         = this._days;
+    var months       = this._months;
+    var data         = this._data;
+    var seconds, minutes, hours, years, monthsFromDays;
+
+    // if we have a mix of positive and negative values, bubble down first
+    // check: https://github.com/moment/moment/issues/2166
+    if (!((milliseconds >= 0 && days >= 0 && months >= 0) ||
+            (milliseconds <= 0 && days <= 0 && months <= 0))) {
+        milliseconds += absCeil(monthsToDays(months) + days) * 864e5;
+        days = 0;
+        months = 0;
+    }
+
+    // The following code bubbles up values, see the tests for
+    // examples of what that means.
+    data.milliseconds = milliseconds % 1000;
+
+    seconds           = absFloor(milliseconds / 1000);
+    data.seconds      = seconds % 60;
+
+    minutes           = absFloor(seconds / 60);
+    data.minutes      = minutes % 60;
+
+    hours             = absFloor(minutes / 60);
+    data.hours        = hours % 24;
+
+    days += absFloor(hours / 24);
+
+    // convert days to months
+    monthsFromDays = absFloor(daysToMonths(days));
+    months += monthsFromDays;
+    days -= absCeil(monthsToDays(monthsFromDays));
+
+    // 12 months -> 1 year
+    years = absFloor(months / 12);
+    months %= 12;
+
+    data.days   = days;
+    data.months = months;
+    data.years  = years;
+
+    return this;
+}
+
+function daysToMonths (days) {
+    // 400 years have 146097 days (taking into account leap year rules)
+    // 400 years have 12 months === 4800
+    return days * 4800 / 146097;
+}
+
+function monthsToDays (months) {
+    // the reverse of daysToMonths
+    return months * 146097 / 4800;
+}
+
+function as (units) {
+    if (!this.isValid()) {
+        return NaN;
+    }
+    var days;
+    var months;
+    var milliseconds = this._milliseconds;
+
+    units = normalizeUnits(units);
+
+    if (units === 'month' || units === 'year') {
+        days   = this._days   + milliseconds / 864e5;
+        months = this._months + daysToMonths(days);
+        return units === 'month' ? months : months / 12;
+    } else {
+        // handle milliseconds separately because of floating point math errors (issue #1867)
+        days = this._days + Math.round(monthsToDays(this._months));
+        switch (units) {
+            case 'week'   : return days / 7     + milliseconds / 6048e5;
+            case 'day'    : return days         + milliseconds / 864e5;
+            case 'hour'   : return days * 24    + milliseconds / 36e5;
+            case 'minute' : return days * 1440  + milliseconds / 6e4;
+            case 'second' : return days * 86400 + milliseconds / 1000;
+            // Math.floor prevents floating point math errors here
+            case 'millisecond': return Math.floor(days * 864e5) + milliseconds;
+            default: throw new Error('Unknown unit ' + units);
+        }
+    }
+}
+
+// TODO: Use this.as('ms')?
+function valueOf$1 () {
+    if (!this.isValid()) {
+        return NaN;
+    }
+    return (
+        this._milliseconds +
+        this._days * 864e5 +
+        (this._months % 12) * 2592e6 +
+        toInt(this._months / 12) * 31536e6
+    );
+}
+
+function makeAs (alias) {
+    return function () {
+        return this.as(alias);
+    };
+}
+
+var asMilliseconds = makeAs('ms');
+var asSeconds      = makeAs('s');
+var asMinutes      = makeAs('m');
+var asHours        = makeAs('h');
+var asDays         = makeAs('d');
+var asWeeks        = makeAs('w');
+var asMonths       = makeAs('M');
+var asYears        = makeAs('y');
+
+function clone$1 () {
+    return createDuration(this);
+}
+
+function get$2 (units) {
+    units = normalizeUnits(units);
+    return this.isValid() ? this[units + 's']() : NaN;
+}
+
+function makeGetter(name) {
+    return function () {
+        return this.isValid() ? this._data[name] : NaN;
+    };
+}
+
+var milliseconds = makeGetter('milliseconds');
+var seconds      = makeGetter('seconds');
+var minutes      = makeGetter('minutes');
+var hours        = makeGetter('hours');
+var days         = makeGetter('days');
+var months       = makeGetter('months');
+var years        = makeGetter('years');
+
+function weeks () {
+    return absFloor(this.days() / 7);
+}
+
+var round = Math.round;
+var thresholds = {
+    ss: 44,         // a few seconds to seconds
+    s : 45,         // seconds to minute
+    m : 45,         // minutes to hour
+    h : 22,         // hours to day
+    d : 26,         // days to month
+    M : 11          // months to year
+};
+
+// helper function for moment.fn.from, moment.fn.fromNow, and moment.duration.fn.humanize
+function substituteTimeAgo(string, number, withoutSuffix, isFuture, locale) {
+    return locale.relativeTime(number || 1, !!withoutSuffix, string, isFuture);
+}
+
+function relativeTime$1 (posNegDuration, withoutSuffix, locale) {
+    var duration = createDuration(posNegDuration).abs();
+    var seconds  = round(duration.as('s'));
+    var minutes  = round(duration.as('m'));
+    var hours    = round(duration.as('h'));
+    var days     = round(duration.as('d'));
+    var months   = round(duration.as('M'));
+    var years    = round(duration.as('y'));
+
+    var a = seconds <= thresholds.ss && ['s', seconds]  ||
+            seconds < thresholds.s   && ['ss', seconds] ||
+            minutes <= 1             && ['m']           ||
+            minutes < thresholds.m   && ['mm', minutes] ||
+            hours   <= 1             && ['h']           ||
+            hours   < thresholds.h   && ['hh', hours]   ||
+            days    <= 1             && ['d']           ||
+            days    < thresholds.d   && ['dd', days]    ||
+            months  <= 1             && ['M']           ||
+            months  < thresholds.M   && ['MM', months]  ||
+            years   <= 1             && ['y']           || ['yy', years];
+
+    a[2] = withoutSuffix;
+    a[3] = +posNegDuration > 0;
+    a[4] = locale;
+    return substituteTimeAgo.apply(null, a);
+}
+
+// This function allows you to set the rounding function for relative time strings
+function getSetRelativeTimeRounding (roundingFunction) {
+    if (roundingFunction === undefined) {
+        return round;
+    }
+    if (typeof(roundingFunction) === 'function') {
+        round = roundingFunction;
+        return true;
+    }
+    return false;
+}
+
+// This function allows you to set a threshold for relative time strings
+function getSetRelativeTimeThreshold (threshold, limit) {
+    if (thresholds[threshold] === undefined) {
+        return false;
+    }
+    if (limit === undefined) {
+        return thresholds[threshold];
+    }
+    thresholds[threshold] = limit;
+    if (threshold === 's') {
+        thresholds.ss = limit - 1;
+    }
+    return true;
+}
+
+function humanize (withSuffix) {
+    if (!this.isValid()) {
+        return this.localeData().invalidDate();
+    }
+
+    var locale = this.localeData();
+    var output = relativeTime$1(this, !withSuffix, locale);
+
+    if (withSuffix) {
+        output = locale.pastFuture(+this, output);
+    }
+
+    return locale.postformat(output);
+}
+
+var abs$1 = Math.abs;
+
+function sign(x) {
+    return ((x > 0) - (x < 0)) || +x;
+}
+
+function toISOString$1() {
+    // for ISO strings we do not use the normal bubbling rules:
+    //  * milliseconds bubble up until they become hours
+    //  * days do not bubble at all
+    //  * months bubble up until they become years
+    // This is because there is no context-free conversion between hours and days
+    // (think of clock changes)
+    // and also not between days and months (28-31 days per month)
+    if (!this.isValid()) {
+        return this.localeData().invalidDate();
+    }
+
+    var seconds = abs$1(this._milliseconds) / 1000;
+    var days         = abs$1(this._days);
+    var months       = abs$1(this._months);
+    var minutes, hours, years;
+
+    // 3600 seconds -> 60 minutes -> 1 hour
+    minutes           = absFloor(seconds / 60);
+    hours             = absFloor(minutes / 60);
+    seconds %= 60;
+    minutes %= 60;
+
+    // 12 months -> 1 year
+    years  = absFloor(months / 12);
+    months %= 12;
+
+
+    // inspired by https://github.com/dordille/moment-isoduration/blob/master/moment.isoduration.js
+    var Y = years;
+    var M = months;
+    var D = days;
+    var h = hours;
+    var m = minutes;
+    var s = seconds ? seconds.toFixed(3).replace(/\.?0+$/, '') : '';
+    var total = this.asSeconds();
+
+    if (!total) {
+        // this is the same as C#'s (Noda) and python (isodate)...
+        // but not other JS (goog.date)
+        return 'P0D';
+    }
+
+    var totalSign = total < 0 ? '-' : '';
+    var ymSign = sign(this._months) !== sign(total) ? '-' : '';
+    var daysSign = sign(this._days) !== sign(total) ? '-' : '';
+    var hmsSign = sign(this._milliseconds) !== sign(total) ? '-' : '';
+
+    return totalSign + 'P' +
+        (Y ? ymSign + Y + 'Y' : '') +
+        (M ? ymSign + M + 'M' : '') +
+        (D ? daysSign + D + 'D' : '') +
+        ((h || m || s) ? 'T' : '') +
+        (h ? hmsSign + h + 'H' : '') +
+        (m ? hmsSign + m + 'M' : '') +
+        (s ? hmsSign + s + 'S' : '');
+}
+
+var proto$2 = Duration.prototype;
+
+proto$2.isValid        = isValid$1;
+proto$2.abs            = abs;
+proto$2.add            = add$1;
+proto$2.subtract       = subtract$1;
+proto$2.as             = as;
+proto$2.asMilliseconds = asMilliseconds;
+proto$2.asSeconds      = asSeconds;
+proto$2.asMinutes      = asMinutes;
+proto$2.asHours        = asHours;
+proto$2.asDays         = asDays;
+proto$2.asWeeks        = asWeeks;
+proto$2.asMonths       = asMonths;
+proto$2.asYears        = asYears;
+proto$2.valueOf        = valueOf$1;
+proto$2._bubble        = bubble;
+proto$2.clone          = clone$1;
+proto$2.get            = get$2;
+proto$2.milliseconds   = milliseconds;
+proto$2.seconds        = seconds;
+proto$2.minutes        = minutes;
+proto$2.hours          = hours;
+proto$2.days           = days;
+proto$2.weeks          = weeks;
+proto$2.months         = months;
+proto$2.years          = years;
+proto$2.humanize       = humanize;
+proto$2.toISOString    = toISOString$1;
+proto$2.toString       = toISOString$1;
+proto$2.toJSON         = toISOString$1;
+proto$2.locale         = locale;
+proto$2.localeData     = localeData;
+
+// Deprecations
+proto$2.toIsoString = deprecate('toIsoString() is deprecated. Please use toISOString() instead (notice the capitals)', toISOString$1);
+proto$2.lang = lang;
+
+// Side effect imports
+
+// FORMATTING
+
+addFormatToken('X', 0, 0, 'unix');
+addFormatToken('x', 0, 0, 'valueOf');
+
+// PARSING
+
+addRegexToken('x', matchSigned);
+addRegexToken('X', matchTimestamp);
+addParseToken('X', function (input, array, config) {
+    config._d = new Date(parseFloat(input, 10) * 1000);
+});
+addParseToken('x', function (input, array, config) {
+    config._d = new Date(toInt(input));
+});
+
+// Side effect imports
+
+
+hooks.version = '2.20.1';
+
+setHookCallback(createLocal);
+
+hooks.fn                    = proto;
+hooks.min                   = min;
+hooks.max                   = max;
+hooks.now                   = now;
+hooks.utc                   = createUTC;
+hooks.unix                  = createUnix;
+hooks.months                = listMonths;
+hooks.isDate                = isDate;
+hooks.locale                = getSetGlobalLocale;
+hooks.invalid               = createInvalid;
+hooks.duration              = createDuration;
+hooks.isMoment              = isMoment;
+hooks.weekdays              = listWeekdays;
+hooks.parseZone             = createInZone;
+hooks.localeData            = getLocale;
+hooks.isDuration            = isDuration;
+hooks.monthsShort           = listMonthsShort;
+hooks.weekdaysMin           = listWeekdaysMin;
+hooks.defineLocale          = defineLocale;
+hooks.updateLocale          = updateLocale;
+hooks.locales               = listLocales;
+hooks.weekdaysShort         = listWeekdaysShort;
+hooks.normalizeUnits        = normalizeUnits;
+hooks.relativeTimeRounding  = getSetRelativeTimeRounding;
+hooks.relativeTimeThreshold = getSetRelativeTimeThreshold;
+hooks.calendarFormat        = getCalendarFormat;
+hooks.prototype             = proto;
+
+// currently HTML5 input type only supports 24-hour formats
+hooks.HTML5_FMT = {
+    DATETIME_LOCAL: 'YYYY-MM-DDTHH:mm',             // <input type="datetime-local" />
+    DATETIME_LOCAL_SECONDS: 'YYYY-MM-DDTHH:mm:ss',  // <input type="datetime-local" step="1" />
+    DATETIME_LOCAL_MS: 'YYYY-MM-DDTHH:mm:ss.SSS',   // <input type="datetime-local" step="0.001" />
+    DATE: 'YYYY-MM-DD',                             // <input type="date" />
+    TIME: 'HH:mm',                                  // <input type="time" />
+    TIME_SECONDS: 'HH:mm:ss',                       // <input type="time" step="1" />
+    TIME_MS: 'HH:mm:ss.SSS',                        // <input type="time" step="0.001" />
+    WEEK: 'YYYY-[W]WW',                             // <input type="week" />
+    MONTH: 'YYYY-MM'                                // <input type="month" />
+};
+
+return hooks;
+
+})));
diff --git a/ee/bulk-operations-dashboard/assets/dependencies/parasails.js b/ee/bulk-operations-dashboard/assets/dependencies/parasails.js
new file mode 100644
index 0000000000..be2d801bdb
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/dependencies/parasails.js
@@ -0,0 +1,1221 @@
+/**
+ * parasails.js
+ * (lightweight structures for apps with more than one page)
+ *
+ * v0.9.3
+ *
+ * Copyright 2014-present, Mike McNeil (@mikermcneil)
+ * MIT License
+ *
+ * - https://sailsjs.com/about
+ * - https://sailsjs.com/support
+ * - https://www.npmjs.com/package/parasails
+ *
+ * > Parasails is a tiny (but opinionated) and pipeline-agnostic wrapper
+ * > around Vue.js and Lodash, with optional participation from jQuery, bowser,
+ * > and VueRouter.
+ */
+(function(factory, exposeUMD){
+  exposeUMD(this, factory);
+})(function (Vue, _, VueRouter, $, bowser){
+
+  //  ██████╗ ██████╗ ██╗██╗   ██╗ █████╗ ████████╗███████╗
+  //  ██╔══██╗██╔══██╗██║██║   ██║██╔══██╗╚══██╔══╝██╔════╝
+  //  ██████╔╝██████╔╝██║██║   ██║███████║   ██║   █████╗
+  //  ██╔═══╝ ██╔══██╗██║╚██╗ ██╔╝██╔══██║   ██║   ██╔══╝
+  //  ██║     ██║  ██║██║ ╚████╔╝ ██║  ██║   ██║   ███████╗
+  //  ╚═╝     ╚═╝  ╚═╝╚═╝  ╚═══╝  ╚═╝  ╚═╝   ╚═╝   ╚══════╝
+  //
+  //  ███████╗████████╗ █████╗ ████████╗███████╗
+  //  ██╔════╝╚══██╔══╝██╔══██╗╚══██╔══╝██╔════╝
+  //  ███████╗   ██║   ███████║   ██║   █████╗
+  //  ╚════██║   ██║   ██╔══██║   ██║   ██╔══╝
+  //  ███████║   ██║   ██║  ██║   ██║   ███████╗
+  //  ╚══════╝   ╚═╝   ╚═╝  ╚═╝   ╚═╝   ╚══════╝
+  //
+
+  /**
+   * Module state
+   */
+
+  // Keep track of whether or not a page script has already been loaded in the DOM.
+  var didAlreadyLoadPageScript;
+
+  // The variable we'll be exporting.
+  var parasails;
+
+
+  //  ██████╗ ██████╗ ██╗██╗   ██╗ █████╗ ████████╗███████╗
+  //  ██╔══██╗██╔══██╗██║██║   ██║██╔══██╗╚══██╔══╝██╔════╝
+  //  ██████╔╝██████╔╝██║██║   ██║███████║   ██║   █████╗
+  //  ██╔═══╝ ██╔══██╗██║╚██╗ ██╔╝██╔══██║   ██║   ██╔══╝
+  //  ██║     ██║  ██║██║ ╚████╔╝ ██║  ██║   ██║   ███████╗
+  //  ╚═╝     ╚═╝  ╚═╝╚═╝  ╚═══╝  ╚═╝  ╚═╝   ╚═╝   ╚══════╝
+  //
+  //  ██╗   ██╗████████╗██╗██╗     ███████╗
+  //  ██║   ██║╚══██╔══╝██║██║     ██╔════╝
+  //  ██║   ██║   ██║   ██║██║     ███████╗
+  //  ██║   ██║   ██║   ██║██║     ╚════██║
+  //  ╚██████╔╝   ██║   ██║███████╗███████║
+  //   ╚═════╝    ╚═╝   ╚═╝╚══════╝╚══════╝
+  //
+
+  /**
+   * Module utilities (private)
+   */
+
+  function _ensureGlobalCache(){
+    parasails._cache = parasails._cache || {};
+  }
+
+  function _exportOnGlobalCache(moduleName, moduleDefinition){
+    _ensureGlobalCache();
+    if (parasails._cache[moduleName]) { throw new Error('Something else (e.g. a utility or constant) has already been registered under that name (`'+moduleName+'`)'); }
+    parasails._cache[moduleName] = moduleDefinition;
+  }
+
+  function _exposeBonusMethods(def, currentModuleEntityNoun){
+    if (!currentModuleEntityNoun) { throw new Error('Consistency violation: Bad internal usage. '); }
+    if (def.methods && def.methods.$get) { throw new Error('This '+currentModuleEntityNoun+' contains `methods` with a `$get` key, but you\'re not allowed to override that'); }
+    if (def.methods && def.methods.$find) { throw new Error('This '+currentModuleEntityNoun+' contains `methods` with a `$find` key, but you\'re not allowed to override that'); }
+    if (def.methods && def.methods.$focus) { throw new Error('This '+currentModuleEntityNoun+' contains `methods` with a `$focus` key, but you\'re not allowed to override that'); }
+    if (def.methods && def.methods.forceRender) { throw new Error('This '+currentModuleEntityNoun+' contains `methods` with a `forceRender` key, but you\'re not allowed to override that'); }
+    if (def.methods && def.methods.$forceRender) { throw new Error('This '+currentModuleEntityNoun+' contains `methods` with a `$forceRender` key, but that\'s too confusing to let stand (did you mean "forceRender"?  Besides, that method cannot be overridden anyway)'); }
+    def.methods = def.methods || {};
+
+    // Attach misc. methods:
+    def.methods.forceRender = function (){
+      this.$forceUpdate();
+      var promise = this.$nextTick();
+      return promise;
+    };//ƒ
+
+
+    // Attach jQuery-powered methods:
+    if ($) {
+      def.methods.$get = function (){
+        var $rootEl = $(this.$el);
+        if ($rootEl.length !== 1) { throw new Error('Cannot use .$get() - something is wrong with this '+currentModuleEntityNoun+'\'s top-level DOM element.  (It probably has not mounted yet!)'); }
+        return $rootEl;
+      };
+      def.methods.$find = function (subSelector){
+        if (!subSelector) { throw new Error('Cannot use .$find() because no sub-selector was provided.\nExample usage:\n    var $emailFields = this.$find(\'[name="emailAddress"]\');'); }
+        var $rootEl = $(this.$el);
+        if ($rootEl.length !== 1) { throw new Error('Cannot use .$find() - something is wrong with this '+currentModuleEntityNoun+'\'s top-level DOM element.  (It probably has not mounted yet!)'); }
+        return $rootEl.find(subSelector);
+      };
+      def.methods.$focus = function (subSelector){
+        if (!subSelector) { throw new Error('Cannot use .$focus() because no sub-selector was provided.\nExample usage:\n    this.$focus(\'[name="emailAddress"]\');'); }
+        var $rootEl = $(this.$el);
+        if ($rootEl.length !== 1) { throw new Error('Cannot use .$focus() - something is wrong with this '+currentModuleEntityNoun+'\'s top-level DOM element.  (It probably has not mounted yet!)'); }
+        var $fieldToAutoFocus = $rootEl.find(subSelector);
+        if ($fieldToAutoFocus.length === 0) { throw new Error('Could not autofocus-- no such element exists within this '+currentModuleEntityNoun+'.'); }
+        // FUTURE: ^^ if that happens, try calling await this.forceRender() and then try again one more time before giving up
+        if ($fieldToAutoFocus.length > 1) { throw new Error('Could not autofocus `'+subSelector+'`-- too many elements matched!'); }
+        $fieldToAutoFocus.focus();
+      };
+    }
+    else {
+      def.methods.$get = function (){ throw new Error('Cannot use .$get() method because, at the time when this '+currentModuleEntityNoun+' was registered, jQuery (`$`) did not exist on the page yet.  (If you\'re using Sails, please check dependency loading order in pipeline.js and make sure jQuery is getting brought in before `parasails`.)'); };
+      def.methods.$find = function (){ throw new Error('Cannot use .$find() method because, at the time when this '+currentModuleEntityNoun+' was registered, jQuery (`$`) did not exist on the page yet.  (If you\'re using Sails, please check dependency loading order in pipeline.js and make sure jQuery is getting brought in before `parasails`.)'); };
+      def.methods.$focus = function (){ throw new Error('Cannot use .$focus() method because, at the time when this '+currentModuleEntityNoun+' was registered, jQuery (`$`) did not exist on the page yet.  (If you\'re using Sails, please check dependency loading order in pipeline.js and make sure jQuery is getting brought in before `parasails`.)'); };
+    }
+  }
+
+  function _wrapMethodsAndVerifyNoArrowFunctions(def, currentModuleEntityNoun){
+    if (!currentModuleEntityNoun) { throw new Error('Consistency violation: Bad internal usage. '); }
+
+    // Preliminary sanity check:
+    // Make sure top-level def doesn't have anything sketchy like "beforeMounted"
+    // or "beforeDestroyed", because those definitely aren't real things.
+    var RECOMMENDATIONS_BY_UNRECOGNIZED_KEY = {
+      beforeMounted: 'beforeMount',
+      beforeMounting: 'beforeMount',
+      beforeDestroyed: 'beforeDestroy',
+      beforeDestroying: 'beforeDestroy',
+      events: 'methods',
+      functions: 'methods',
+      state: 'data',
+      virtualPageRegExp: 'virtualPagesRegExp',
+      virtualPageRegEx: 'virtualPagesRegExp',
+      virtualPagesRegEx: 'virtualPagesRegExp',
+      virtualPage: 'virtualPages',
+      html5History: 'html5HistoryMode',
+      historyMode: 'html5HistoryMode',
+    };
+    // > Note that this determination of whether to show a more precise
+    // > "Did you mean?" error message is a case-_insensitive_ check.
+    var lowercasedRecommendationsByKey = _.reduce(RECOMMENDATIONS_BY_UNRECOGNIZED_KEY, function(memo, correctAlias, incorrectKey){
+      memo[incorrectKey.toLowerCase()] = correctAlias;
+      return memo;
+    }, {});
+    _.each(def, function (x, propertyName) {
+      if (x !== undefined) {
+        if (_.contains(_.keys(RECOMMENDATIONS_BY_UNRECOGNIZED_KEY), propertyName) || _.contains(_.keys(lowercasedRecommendationsByKey), propertyName.toLowerCase())) {
+          throw new Error('Detected unrecognized and potentially confusing key "'+propertyName+'" on the top level of '+currentModuleEntityNoun+' definition.  Did you mean "'+lowercasedRecommendationsByKey[propertyName.toLowerCase()]+'"?');
+        }
+      }
+    });//∞
+
+    // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+    // FUTURE: Maybe verify that neither beforeMount nor beforeDestroy are
+    // `async function`s.  (These must be synchronous!  And it's easy to forget.)
+    // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+    // In fact, in some cases, we'll go so far as to fail if we see any other
+    // unrecognized top-level keys too:
+    // > This is particularly useful for catching loose top-level properties
+    // > that were intended to be within `data` or `methods`, etc.)
+    if (currentModuleEntityNoun === 'page script' || currentModuleEntityNoun === 'component') {
+      // FUTURE: don't allow page script only things on components
+
+      var LEGAL_TOP_LVL_KEYS = [
+        // Everyday page script stuff:
+        'beforeMount',
+        'mounted',
+        'data',
+        'methods',
+
+        // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+        // FUTURE: Add `this.listen()` and `this.ignore()` -- see:
+        // https://github.com/mikermcneil/parasails/commit/5b948a1a8a0945b19ccea6da3e7354255d3dc0b6
+        // (and also 83c439dc1f3a0375e67066fffe9151581cbab639)
+        //
+        // Or better yet, just use a declarative approach instead and let
+        // binding/unbinding happen behind the scenes.  e.g.:
+        // ```
+        // cloudEvents: {
+        //   pet: (msg)=>{…},
+        //   user: (msg)=>{…},
+        //   organization: {
+        //     destroyed: (msg)=>{…},
+        //     updated: (msg)=>{…},
+        //     bankWireReceived: (msg)=>{…},
+        //     error: (msg)=>{…}
+        //   },
+        //   circus: {
+        //     admissionPaymentReceived: (msg)=>{…}
+        //   }
+        // }
+        // ```
+        // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+        // Extra component stuff:
+        'props',
+        'template',
+        'beforeDestroy',
+
+        // Client-side router stuff:
+        'router',
+        'virtualPages',
+        'html5HistoryMode',
+        'beforeNavigate',
+        'afterNavigate',
+        'virtualPagesRegExp',
+
+        // Misc. & relatively more uncommon Vue.js stuff
+        'watch',
+        'computed',
+        'propsData',
+        'components',
+        'filters',
+        'directives',
+        'el',
+        'render',
+        'renderError',
+        'comments',
+        'inheritAttrs',
+        'model',
+        'functional',
+        'delimiters',
+        'name',
+        'beforeCreate',
+        'created',
+        'beforeUpdate',
+        'updated',
+        'activated',
+        'deactivated',
+        'destroyed',
+        'errorCaptured',
+        'parent',
+        'mixins',
+        'extends',
+        'provide',
+        'inject'
+      ];
+      // FUTURE: change this to a case-insensitive check to do a better job helping
+      // out a user who is trying to use e.g. "beforemount", without a capital "M"
+      _.each(_.difference(_.keys(def), LEGAL_TOP_LVL_KEYS), function (propertyName) {
+        if (def[propertyName] !== undefined) {
+          throw new Error('Detected unrecognized key "'+propertyName+'" on the top level of '+currentModuleEntityNoun+' definition.  Did you perhaps intend for `'+propertyName+'` to be included as a nested key within `data` or `methods`?  Please check on that and try again.  If you\'re unsure, or you\'re deliberately attempting to use a Vue.js feature that relies on having a top-level property named `'+propertyName+'`, then please remove this check from the parasails.js library in your project, or drop by https://sailsjs.com/support for assistance.');
+        }
+      });//∞
+    }//fi
+
+    // Mix in overridable default filters
+    def.filters = def.filters || {};
+    if (!def.filters.currency) {
+      // FUTURE: mix in our go-to currency filter
+    }//fi
+    if (!def.filters.round) {
+      /**
+       * Usage:
+       * - `{{someValue | round}}`
+       * - `{{someValue | round(1)}}`
+       * - `{{someValue | round(2)}}`
+       * - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+       * @param  {Ref} value
+       * @param  {Number} accuracy
+       * @param  {Boolean} chopTrailingZeros
+       * @return {String}
+       * - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+       * > The following is a modified version of:
+       * > vue-round-filter@1.1.2
+       * > c. 2016, Damian Martyniak (ISC License)
+       * > https://github.com/rascada/vue-round-filter/blob/6529a384758b67ed54884b77e03dd73cc3dda215/index.js
+       * > Originally updated for explicitness, to ensure Vue ≥2.x compatibility,
+       * > and to change default usage to always preserve decimal accuracy.  It
+       * > could likely wind up with additional updates over time.
+       * > All edits are MIT licensed. Copyright (c) Mike McNeil, 2018-present
+       */
+      def.filters.round = function (value, accuracy, chopTrailingZeros) {
+        if (typeof value !== 'number') {
+          return ('' + value);
+        }//•
+        var result = value.toFixed(accuracy);
+        if (chopTrailingZeros) {
+          // (don't keep decimal accuracy, just chop off those trailing zeros)
+          return ('' + (+result));
+        } else {
+          // (keep decimal accuracy)
+          return ('' + result);
+        }
+      };//ƒ
+    }//fi
+
+    // Wrap and verify methods:
+    def.methods = def.methods || {};
+    _.each(_.keys(def.methods), function (methodName) {
+      if (!_.isFunction(def.methods[methodName])) {
+        throw new Error('Unexpected definition for Vue method `'+methodName+'`.  Expecting a function, but got "'+def.methods[methodName]+'"');
+      }
+
+      var isArrowFunction;
+      try {
+        var asString = def.methods[methodName].toString();
+        isArrowFunction = asString.match(/^\s*\(\s*/) || asString.match(/^\s*async\s*\(\s*/);
+      } catch (err) {
+        console.warn('Consistency violation: Encountered unexpected error when attempting to verify that Vue method `'+methodName+'` is not an arrow function.  (What browser is this?!)  Anyway, error details:', err);
+      }
+
+      if (isArrowFunction) {
+        throw new Error('Unexpected definition for Vue method `'+methodName+'`.  Vue methods cannot be specified as arrow functions, because then you wouldn\'t have access to `this` (i.e. the Vue vm instance).  Please use a function like `function(){…}` or `async function(){…}` instead.');
+      }
+
+      // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+      // FUTURE:
+      // Inject a wrapper function in order to provide more advanced / cleaner error handling.
+      // (especially for AsyncFunctions)
+      // ```
+      // var _originalMethod = def.methods[methodName];
+      // def.methods[methodName] = function(){
+      //
+      //   var rawResult;
+      //   var originalCtx = this;
+      //   (function(proceed){
+      //     if (_originalMethod.constructor.name === 'AsyncFunction') {
+      //       rawResult = _originalMethod.apply(originalCtx, arguments);
+      //       // The result of an AsyncFunction is always a promise:
+      //       rawResult.catch(function(err) {
+      //         proceed(err);
+      //       });//_∏_
+      //       rawResult.then(function(actualResult){
+      //         return proceed(undefined, actualResult);
+      //       });
+      //     }
+      //     else {
+      //       try {
+      //         rawResult = _originalMethod.apply(originalCtx, arguments);
+      //       } catch (err) { return proceed(err); }
+      //       return proceed(undefined, rawResult);
+      //     }
+      //   })(function(err, actualResult){//eslint-disable-line no-unused-vars
+      //     if (err) {
+      //       // FUTURE: perform more advanced error handling here
+      //       throw err;
+      //     }
+      //
+      //     // Otherwise do nothing.
+      //
+      //   });//_∏_  (†)
+      //
+      //   // For compatibility, return the raw result.
+      //   return rawResult;
+      //
+      // };//ƒ
+      // ```
+      // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+
+    });//∞
+  }
+
+
+  //   ██████╗ ██╗      ██████╗ ██████╗  █████╗ ██╗         ███████╗██╗   ██╗███████╗███╗   ██╗████████╗███████╗
+  //  ██╔════╝ ██║     ██╔═══██╗██╔══██╗██╔══██╗██║         ██╔════╝██║   ██║██╔════╝████╗  ██║╚══██╔══╝██╔════╝
+  //  ██║  ███╗██║     ██║   ██║██████╔╝███████║██║         █████╗  ██║   ██║█████╗  ██╔██╗ ██║   ██║   ███████╗
+  //  ██║   ██║██║     ██║   ██║██╔══██╗██╔══██║██║         ██╔══╝  ╚██╗ ██╔╝██╔══╝  ██║╚██╗██║   ██║   ╚════██║
+  //  ╚██████╔╝███████╗╚██████╔╝██████╔╝██║  ██║███████╗    ███████╗ ╚████╔╝ ███████╗██║ ╚████║   ██║   ███████║
+  //   ╚═════╝ ╚══════╝ ╚═════╝ ╚═════╝ ╚═╝  ╚═╝╚══════╝    ╚══════╝  ╚═══╝  ╚══════╝╚═╝  ╚═══╝   ╚═╝   ╚══════╝
+  //
+
+  ///////////////////////////////////////////////////////////////////////////////////////////
+  // Capture uncaught errors (and trigger a fatal error if appropriate)
+  //
+  // A global error handler, "catcher of the uncaught", first of its name, and
+  // bane to bugs.  This (normally-invisible) gutter lurks at the bottom of the
+  // screen, but then springs to life if any uncaught errors are detected.
+  //
+  // > Out of the box, this behavior is deactivated any time Sails is running in
+  // > in the "production" environment (`sails.config.environment !== 'production')
+  // > (e.g. your local development machine, your staging server).  In order to do
+  // > this, it checks `SAILS_LOCALS._environment`, a special variable set by the
+  // > boilerplate "custom" hook (included in all Sails apps using the "Web App"
+  // > template).  Note that this behavior is also disabled if `window.SAILS_LOCALS`
+  // > is not set (e.g. any pages where "exposeLocalsToBrowser" is not in use).
+  // > Finally, this behavior is also disabled if jQuery is not available.
+  //
+  // ---------------------------------------------------------------------------------------
+  // In the off change your app is using a tool like Bugsnag/Sentry/Rollbars in
+  // environments OTHER THAN PRODUCTION, and you'd like to disable this behavior,
+  // the following section of code can simply be removed.
+  // ---------------------------------------------------------------------------------------
+  ///////////////////////////////////////////////////////////////////////////////////////////
+  if ($ && typeof window !== 'undefined' && window.SAILS_LOCALS && window.SAILS_LOCALS._environment !== 'production') {
+
+    var _displayErrorOverlay = function(errorSummary){
+
+      if ($('#parasails-error-handler').length === 0) {
+        // Very first error:
+        $('<div id="parasails-error-handler">'+
+          '<div role="error-handler-content">'+
+            '<h1>Whoops</h1>'+
+            '<p>'+
+              '<span role="summary">An unexpected client-side error occurred.</span><br/>'+
+              '<pre>'+_.escape(_.trunc(errorSummary, {length: 350}))+'</pre>'+
+              '<span>Please check your browser\'s JavaScript console for further details.</span><br/>'+
+              '<small>This message will not be displayed in production.  '+
+              'If you\'re unsure, <a href="https://sailsjs.com/support">ask for help</a>.</small><br/>'+
+              '<small>'+_.escape(new Date())+'</small>'+
+            '</p>'+
+          '</div>'+
+        '</div>')
+        .css({
+          position: 'fixed',
+          bottom: '0',
+          height: '100%',
+          width: '100%',
+          'z-index': '9000',
+          display: 'table',
+          'background': 'radial-gradient(circle, rgba(0,0,0,0.98) 0%, rgba(35,8,8,0.87) 80%, rgba(20,5,5,0.85) 100%)',
+          // (Thanks cssgradient.io!)
+        })
+        .appendTo('body');
+
+        $('#parasails-error-handler [role="error-handler-content"]').css({
+          display: 'table-cell',
+          'vertical-align': 'middle',
+          'text-align': 'center'
+        });
+
+        $('#parasails-error-handler [role="error-handler-content"] *').css({
+          'font-family': '\'Consolas\', \'Courier\', \'courier\', serif',
+          color: 'white'
+        });
+
+        $('#parasails-error-handler [role="error-handler-content"] small').css({
+          color: '#cccccc'
+        });
+
+        $('#parasails-error-handler [role="error-handler-content"] pre').css({
+          color: '#ff5555',
+          display: 'block',
+          'background': '#112f1f',
+          'white-space': 'pre-wrap',
+          'padding': '10px',
+          'margin-left': 'auto',
+          'margin-right': 'auto',
+          'max-width': '500px',
+          'min-width': '280px',
+          'font-size': '11px'
+        });
+
+        $('#parasails-error-handler [role="error-handler-content"] a').css({
+          'text-decoration': 'underline',
+          color: '#cccccc'
+        });
+
+      } else {
+        // Subsequent errors:
+        $('#parasails-error-handler [role="summary"]')
+        .text('Multiple unexpected client-side errors occurred.');
+      }
+
+      // Returning `true` would suppress the actual uncaught error from
+      // showing up in the JavaScript console. But we don't want to play
+      // with fire for now.  Just getting access to this is enough.
+      // We allow the error to continue to be uncaught.
+      return false;
+    };//ƒ
+
+    // Bind top-level error handler on the window.
+    //
+    // This NEVER prevents the error from continuing to be uncaught- it's just here
+    // to ensure that if any JS errors occur, we notice them immediately, even if we
+    // don't have Chrome dev tools open.
+    //
+    // For more info about `window.onerror`, see:
+    // https://developer.mozilla.org/en-US/docs/Web/API/GlobalEventHandlers/onerror
+    var originalWindowOnError = window.onerror;
+    window.onerror = function(message, scriptSrc, lineNo, charNo, err) {
+      _displayErrorOverlay(err&&err.message? err.message : message);
+      if (_.isFunction(originalWindowOnError)) {
+        return originalWindowOnError(message, scriptSrc, lineNo, charNo, err);
+      }
+    };//œ   </ on uncaught error >
+
+    // Bind top-level uncaught promise rejection handler.
+    // > https://developer.mozilla.org/en-US/docs/Web/Events/unhandledrejection
+    // (Only works in desktop Chrome as of Oct 2018, but over time, this will
+    // hopefully get better.  In the mean time, doesn't hurt anything, and it's
+    // only for development anyway.)
+    window.addEventListener('unhandledrejection', function (event) {
+      _displayErrorOverlay(event&&event.reason? event.reason : event);
+    });//œ  </ on unhandled promise rejection >
+
+    // Configure Vue to share its beforeMount errors (and others) with us.
+    // > https://vuejs.org/v2/api/#errorHandler
+    Vue.config.errorHandler = function (err, unusedVm, errorSourceDisplayName) {
+      if (err && err.message) {
+        if (errorSourceDisplayName === 'render function') {
+          err.message = 'In the HTML template (during render): '+err.message;
+        } else {
+          err.message = 'In '+errorSourceDisplayName+': '+err.message;
+        }
+      } else {
+        var _originalNotActuallyErr = err;
+        err = new Error(_originalNotActuallyErr);
+        err.raw = _originalNotActuallyErr;
+      }
+      console.error(err);
+      _displayErrorOverlay(err);
+    };//ƒ
+
+    // Also those Vue warnings -- but we'll treat them like errors because
+    // we're serious about code quality.  (Plus, early detection of bugs
+    // and typos saves so much time down the road!)
+    // > `trace` is the component hierarchy trace
+    Vue.config.warnHandler = function (msg, unusedVm, unusedTrace) {
+      throw new Error(
+        msg + '\n\n'+
+        'Expand this error and check out the stack trace for more info.'
+      );
+    };//ƒ
+
+  }//fi
+
+  //  ███████╗██╗  ██╗██████╗  ██████╗ ██████╗ ████████╗███████╗
+  //  ██╔════╝╚██╗██╔╝██╔══██╗██╔═══██╗██╔══██╗╚══██╔══╝██╔════╝
+  //  █████╗   ╚███╔╝ ██████╔╝██║   ██║██████╔╝   ██║   ███████╗
+  //  ██╔══╝   ██╔██╗ ██╔═══╝ ██║   ██║██╔══██╗   ██║   ╚════██║
+  //  ███████╗██╔╝ ██╗██║     ╚██████╔╝██║  ██║   ██║   ███████║
+  //  ╚══════╝╚═╝  ╚═╝╚═╝      ╚═════╝ ╚═╝  ╚═╝   ╚═╝   ╚══════╝
+  //
+
+  /**
+   * Module exports
+   */
+
+  parasails = {};
+
+
+  /**
+   * parasails.util
+   *
+   * Direct references to all registered utility methods from userland.
+   *
+   * @type {Dictionary}
+   */
+
+  parasails.util = {};
+
+
+  /**
+   * registerUtility()
+   *
+   * Build a callable utility function, then attach it to the global namespace
+   * so that it can be accessed later via `.require()`.
+   *
+   * @param {String} utilityName
+   * @param {Function} def
+   */
+
+  parasails.registerUtility = function(utilityName, def){
+
+    // Usage
+    if (!utilityName) { throw new Error('1st argument (utility name) is required'); }
+    if (!def) { throw new Error('2nd argument (utility function definition) is required'); }
+    if (!_.isFunction(def)) { throw new Error('2nd argument (utility function definition) should be a function'); }
+
+    // Build callable utility
+    var callableUtility = def;
+    callableUtility.name = utilityName;
+
+    // Attach to global cache
+    _exportOnGlobalCache(utilityName, callableUtility);
+
+    // Also expose on `parasails.util`
+    parasails.util[utilityName] = callableUtility;
+
+  };
+
+
+  /**
+   * registerConstant()
+   *
+   * Attach a constant to the global namespace so that it can be accessed
+   * later via `.require()`.
+   *
+   * @param {String} constantName
+   * @param {Ref} value
+   */
+
+  parasails.registerConstant = function(constantName, value){
+
+    // Usage
+    if (!constantName) { throw new Error('1st argument (constant name) is required'); }
+    if (value === undefined) { throw new Error('2nd argument (the constant value) is required'); }
+
+    // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+    // FUTURE: deep-freeze constant, if supported
+    // (https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/freeze)
+    // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+    // Attach to global cache
+    _exportOnGlobalCache(constantName, value);
+
+  };
+
+
+
+  /**
+   * registerComponent()
+   *
+   * Define a Vue component.
+   *
+   * @param {String} componentName   [In camelCase]
+   * @param {Dictionary} def
+   *
+   * @returns {Ref}  [new vue component for this page]
+   */
+
+  parasails.registerComponent = function(componentName, def){
+
+    // Expose extra methods on component def, if jQuery is available.
+    _exposeBonusMethods(def, 'component');
+
+    // Make sure none of the specified Vue methods are defined with any naughty arrow functions.
+    _wrapMethodsAndVerifyNoArrowFunctions(def, 'component');
+
+    // Wrap the `mounted` LC in order to decorate the top-level element with
+    // a sniffable marker that can be unambiguously styled via a global selector
+    // in the corresponding stylesheet for the component.
+    var customMountedLC;
+    if (def.mounted) {
+      customMountedLC = def.mounted;
+    }//fi
+    def.mounted = function(){
+
+      // Attach `parasails-component="…"` DOM attribute to allow for painless
+      // selecting from an optional, corresponding per-component stylesheet.
+      this.$el.setAttribute('parasails-component', _.kebabCase(componentName));
+
+      // Then call the original, custom "mounted" function, if there was one.
+      if (customMountedLC) {
+        customMountedLC.apply(this, []);
+      }
+    };//ƒ
+
+    // Attach `goto` method, for convenience.
+    if (def.methods && def.methods.goto) { throw new Error('Component definition contains `methods` with a `goto` key-- but you\'re not allowed to override that'); }
+    if (def.methods && def.methods.gotoAndReplaceHistory) { throw new Error('Component definition contains `methods` with a `gotoAndReplaceHistory` key-- but you\'re not allowed to override that'); }
+    def.methods = def.methods || {};
+    def.methods.goto = function (rootRelativeUrl){
+      // If the Bowser browser detection library is installed
+      // (https://github.com/lancedikson/bowser/releases), check whether
+      // we're in Edge or IE, in which case we'll add some special handling
+      // for an edge case in `onbeforeunload` behavior.
+      var isIEOrEdgeBrowser = bowser && (bowser.name === 'Internet Explorer' || bowser.name === 'Microsoft Edge');
+      if(!isIEOrEdgeBrowser) {
+        window.location = rootRelativeUrl;
+      } else {
+        try {
+          // IE/Edge prefers "window.location.href"
+          window.location.href = rootRelativeUrl;
+        } catch(unusedErr) {
+          // More helpful error message for unavoidable error during onbeforeunload edge case in IE/Edge
+          throw new Error('`goto` failed in Edge or IE! If navigation was cancelled in `beforeunload`, you can probably ignore this message (see https://stackoverflow.com/questions/1509643/unknown-exception-when-cancelling-page-unload-with-location-href/1510074#1510074).');
+        }
+      }
+    };
+    def.methods.gotoAndReplaceHistory = function (rootRelativeUrl){
+      window.location.replace(rootRelativeUrl);
+    };
+
+    // Finally, register as a global Vue component.
+    Vue.component(componentName, def);
+
+  };
+
+
+  /**
+   * require()
+   *
+   * Require a utility function or constant from the global namespace.
+   *
+   * @param {String} moduleName
+   * @returns {Ref}  [e.g. the callable utility function, or the value of the constant]
+   * @throws {Error} if no such module has been registered
+   */
+
+  parasails.require = function(moduleName) {
+
+    // Usage
+    if (!moduleName) { throw new Error('1st argument (module name -- i.e. the name of a utility or constant) is required'); }
+
+    // Fetch from global cache
+    _ensureGlobalCache();
+    if (parasails._cache[moduleName] === undefined) {
+      var err = new Error('No utility or constant is registered under that name (`'+moduleName+'`)');
+      err.name = 'RequireError';
+      err.code = 'MODULE_NOT_FOUND';
+      throw err;
+    }
+    return parasails._cache[moduleName];
+
+  };
+
+
+  /**
+   * registerPage()
+   *
+   * Define a page script, if applicable for the current contents of the DOM.
+   *
+   * @param {String} pageName
+   * @param {Dictionary} def
+   *
+   * @returns {Ref}  [new vue app thing for this page]
+   */
+
+  parasails.registerPage = function(pageName, def){
+
+    // Usage
+    if (!pageName) { throw new Error('1st argument (page name) is required'); }
+    if (!def) { throw new Error('2nd argument (page script definition) is required'); }
+
+    // Don't look for a matching DOM element (by "id") within anything that has `parasails-has-no-page-script`
+    // FUTURE: Move this check a bit further below, probably without defining the variable, and just add another avast (aka early return)
+    var isWithinIgnoredElements;
+    if ($) {
+      // Note that, luckily, this works even without waiting for the DOM to be ready according to jQuery.  (i.e. $(()=>{ … }))
+      isWithinIgnoredElements = (
+        $('#'+pageName).parents().filter('[parasails-has-no-page-script]')
+      ).length >= 1;
+    } else {
+      // For simplicity, this check is skipped if jQuery is not available.
+      // FUTURE: Implement with vanilla JS here
+      isWithinIgnoredElements = false;
+    }
+
+    // Only actually build+load this page script if it is relevant for the current contents of the DOM.
+    if (!window.document.getElementById(pageName) || isWithinIgnoredElements) { return; }
+
+    // Spinlock
+    if (didAlreadyLoadPageScript) { throw new Error('Cannot load page script (`'+pageName+') because a page script has already been loaded on this page.'); }
+    didAlreadyLoadPageScript = true;
+
+    // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+    // FUTURE: Maybe set `parasails._mountedPage = pageName;` and use that in the `goto` method of components to still
+    // do the check for a virtualPageRegExp and allow it to conditionaly do a "soft" client-side navigation to avoid page
+    // reload. (Remember: There's only ever one registered page script mounted in the DOM when you're using parasails.)
+    // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+    // Automatically set `el`
+    if (def.el) { throw new Error('Page script definition contains `el`, but you\'re not allowed to override that'); }
+    def.el = '#'+pageName;
+
+    // Expose extra methods, if jQuery is available.
+    _exposeBonusMethods(def, 'page script');
+
+    // Make sure none of the specified Vue methods are defined with any naughty arrow functions.
+    _wrapMethodsAndVerifyNoArrowFunctions(def, 'page script');
+
+    // If bowser and jQuery are both around, sniff the user agent and determine
+    // some additional information about the user agent device accessing the DOM.
+    var bowserSniffClasses = '';
+    var SNIFFER_CSS_CLASS_PREFIX = 'detected-';
+    if (bowser && $) {
+
+      if (bowser.tablet||bowser.mobile) {
+        bowserSniffClasses += ' '+SNIFFER_CSS_CLASS_PREFIX+'mobile';
+        // ^^Note: "detected-mobile" means ANY mobile OS/device (handset or tablet)
+        //  [?] https://github.com/lancedikson/bowser/tree/6bbdaf99f0b36cf3a7b8a14feb0aa60d86d7e0dd#device-flags
+        if (bowser.ios) {
+          bowserSniffClasses += ' '+SNIFFER_CSS_CLASS_PREFIX+'ios';
+        } else if (bowser.android) {
+          bowserSniffClasses += ' '+SNIFFER_CSS_CLASS_PREFIX+'android';
+        } else if (bowser.windowsphone) {
+          bowserSniffClasses += ' '+SNIFFER_CSS_CLASS_PREFIX+'windowsphone';
+        }
+
+        if (bowser.tablet) {
+          bowserSniffClasses += ' '+SNIFFER_CSS_CLASS_PREFIX+'tablet';
+        } else if (bowser.mobile) {
+          bowserSniffClasses += ' '+SNIFFER_CSS_CLASS_PREFIX+'handset';
+        }
+      }
+      else {
+        // Otherwise we're not on a mobile OS/browser/device.
+        // But we can at least get a bit more intell on what's up:
+        if (bowser.mac) {
+          bowserSniffClasses += ' '+SNIFFER_CSS_CLASS_PREFIX+'mac';
+        } else if (bowser.windows) {
+          bowserSniffClasses += ' '+SNIFFER_CSS_CLASS_PREFIX+'windows';
+        } else if (bowser.linux) {
+          bowserSniffClasses += ' '+SNIFFER_CSS_CLASS_PREFIX+'linux';
+        }
+      }
+    }//fi
+
+    // If we have jQuery available, then as soon as the DOM is ready, and if
+    // appropriate based on browser device sniffing, attach special classes to
+    // the <body> element.
+    if ($ && bowserSniffClasses) {
+      $(function(){
+        $('body').addClass(bowserSniffClasses);
+      });//_∏_
+    }//fi
+
+    // Wrap the `mounted` LC:
+    var customMountedLC;
+    if (def.mounted) {
+      customMountedLC = def.mounted;
+    }//fi
+    def.mounted = function(){
+
+      // Similar to above, attach special classes to the page script's top-level
+      // DOM element, now that it has been mounted (again, only if appropriate
+      // based on browser device sniffing, and only if jQuery is available.)
+      if ($ && bowserSniffClasses) {
+        this.$get().addClass(bowserSniffClasses);
+      }//fi
+
+      // Then call the original, custom "mounted" function, if there was one.
+      if (customMountedLC) {
+        customMountedLC.apply(this, []);
+        // ^FUTURE: consider whether it's worth dealing with the possibility
+        // of uncaught promise rejections here (b/c it might be an `async function`!)
+      }
+    };//ƒ
+
+    // Now, for convenience, automatically add built-in defaults to our `data`:
+    if (def.data && def.data.pageName) { throw new Error('Page script definition contains `data` with a `pageName` key, but you\'re not allowed to override that'); }
+    def.data = _.extend({
+      pageName: pageName,
+      _: _,
+    }, def.data||{});
+    if (bowser && !def.data.hasOwnProperty('bowser')) {
+      def.data.bowser = bowser;
+    }
+
+    // And, as of Parasails ≥0.9, automatically merge in the contents of SAILS_LOCALS, if present.
+    // > (this is so that you don't have to include boilerplate code inside beforeMount of page scripts
+    // > to merge in data from the server)
+    if (typeof window !== 'undefined' && _.isObject(window.SAILS_LOCALS) && !_.isArray(window.SAILS_LOCALS) && !_.isFunction(window.SAILS_LOCALS)) {
+      _.extend(def.data, window.SAILS_LOCALS);
+    }
+
+    // Attach `goto` method, for convenience.
+    if (def.methods && def.methods.goto) { throw new Error('Page script definition contains `methods` with a `goto` key-- but you\'re not allowed to override that'); }
+    if (def.methods && def.methods.gotoAndReplaceHistory) { throw new Error('Page script definition contains `methods` with a `gotoAndReplaceHistory` key-- but you\'re not allowed to override that'); }
+    def.methods = def.methods || {};
+    if (VueRouter) {
+      var _virtualPagesRegExp = def.virtualPagesRegExp;
+
+      // The following inline function definition exists purely to avoid
+      // duplication of code in `goto` and `gotoAndReplaceHistory` below:
+      var _goto = function($router, rootRelativeUrlOrOpts, replaceHistory) {
+        // FUTURE: add support for using '../' without reloading the page
+        // (even though it doesn't technicaly match the regexp)
+        if (!_virtualPagesRegExp || (_.isString(rootRelativeUrlOrOpts) && !rootRelativeUrlOrOpts.match(_virtualPagesRegExp))) {
+          if (replaceHistory) {
+            window.location.replace(rootRelativeUrlOrOpts);
+          } else {
+            window.location = rootRelativeUrlOrOpts;
+          }
+        } else {
+          if (replaceHistory) {
+            // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+            // FUTURE: also look into something like this for cleaner handling
+            // of back/forward navigation for things like permalinked modals:
+            // • https://stackoverflow.com/a/29227026/486547
+            //
+            // gotoAndReplaceHistory() works great for handling client-side
+            // redirects within an afterNavigate function, but it doesn't work
+            // great for removing stuff from the history stack.  Because that's
+            // impossible, tbh.  So to truly solve that, you need a much more
+            // opinionated solution (see above link & treeline2 for examples).
+            // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+            return $router.replace(rootRelativeUrlOrOpts);
+          } else {
+            return $router.push(rootRelativeUrlOrOpts);
+          }
+        }
+      };//ƒ
+      def.methods.goto = function (rootRelativeUrlOrOpts){
+        return _goto(this.$router, rootRelativeUrlOrOpts);
+      };//ƒ
+      def.methods.gotoAndReplaceHistory = function (rootRelativeUrlOrOpts){
+        return _goto(this.$router, rootRelativeUrlOrOpts, true);
+      };//ƒ
+    }
+    else {
+      def.methods.goto = function (){ throw new Error('Cannot use .goto() method because, at the time when this page script was registered, VueRouter did not exist on the page yet. (If you\'re using Sails, please check dependency loading order in pipeline.js and make sure VueRouter is getting brought in before `parasails`.)'); };
+      def.methods.gotoAndReplaceHistory = function (){ throw new Error('Cannot use .gotoAndReplaceHistory() method because, at the time when this page script was registered, VueRouter did not exist on the page yet. (If you\'re using Sails, please check dependency loading order in pipeline.js and make sure VueRouter is getting brought in before `parasails`.)'); };
+    }
+
+    // If virtualPages-related stuff was specified, check usage and tolerate shorthand.
+    if (def.virtualPages === undefined) {
+      if (def.virtualPagesRegExp) {
+        def.virtualPages = true;
+      }
+    } else if (_.isObject(def.virtualPages) && !_.isArray(def.virtualPages) && !_.isFunction(def.virtualPages)) {
+      throw new Error('This usage of `virtualPages` (as a dictionary) is no longer supported.  Instead, please use `virtualPages: true`.  [?] https://sailsjs.com/support');
+      // (^^ old implementation removed in https://github.com/mikermcneil/parasails/commit/20af5992097de788b58ae2cb517675f235798879)
+    } else if (!_.isBoolean(def.virtualPages)) {
+      throw new Error('Cannot use `virtualPages` because the specified value doesn\'t match any recognized meaning.  Please specify either `true` (for the default handling) or a dictionary of client-side routing rules.');
+    }//fi
+    if (def.virtualPages && def.router) { throw new Error('Cannot specify both `virtualPages` AND an actual Vue `router`!  Use one or the other.'); }
+    if (def.router && !VueRouter) { throw new Error('Cannot use `router`, because that depends on the Vue Router.  But `VueRouter` does not exist on the page yet.  (If you\'re using Sails, please check dependency loading order in pipeline.js and make sure the VueRouter plugin is getting brought in before `parasails`.)'); }
+    if (!def.virtualPages && def.html5HistoryMode !== undefined) { throw new Error('Cannot specify `html5HistoryMode` without also specifying `virtualPages`!'); }
+    if (!def.virtualPages && def.beforeEach !== undefined) { throw new Error('Cannot specify `beforeEach` without also specifying `virtualPages`!'); }
+    if ((def.beforeNavigate || def.afterNavigate) && def.virtualPages !== true) { throw new Error('Cannot specify `beforeNavigate` or `afterNavigate` unless you set `virtualPages: true`!'); }
+
+    // If `virtualPages: true` was specified, then use reasonable defaults:
+    //
+    // > Note: This assumes that, somewhere within the parent page's template, there is:
+    // > ```
+    // > <router-view></router-view>
+    // > ```
+    if (def.virtualPages === true) {
+      if (!VueRouter) { throw new Error('Cannot use `virtualPages`, because it depends on the Vue Router.  But `VueRouter` does not exist on the page yet.  (If you\'re using Sails, please check dependency loading order in pipeline.js and make sure the VueRouter plugin is getting brought in before `parasails`.)'); }
+      if (def.beforeEach !== undefined) { throw new Error('Cannot specify `virtualPages: true` AND `beforeEach` at the same time!'); }
+      if (!def.virtualPagesRegExp && def.html5HistoryMode === 'history') { throw new Error('If `html5HistoryMode: \'history\'` is specified, then virtualPagesRegExp must also be specified!'); }
+      if (def.virtualPagesRegExp && !_.isRegExp(def.virtualPagesRegExp)) { throw new Error('Invalid `virtualPagesRegExp`: If specified, this must be a regular expression -- e.g. `/^\/manage\/access\/?([^\/]+)?/`'); }
+      if (def.html5HistoryMode === undefined) {
+        if (def.virtualPagesRegExp) {
+          def.html5HistoryMode = 'history';
+        } else {
+          def.html5HistoryMode = 'hash';
+        }
+      } else if (def.html5HistoryMode !== 'history' && def.html5HistoryMode !== 'hash') { throw new Error('Invalid `html5HistoryMode`: If specified, this must be either "history" or "hash".'); }
+
+      // Check for <router-view> element
+      // (to provide a better error msg if it was omitted)
+      var customBeforeMountLC;
+      if (def.beforeMount) {
+        customBeforeMountLC = def.beforeMount;
+      }//fi
+      def.beforeMount = function(){
+
+        // Inject additional code to check for <router-view> element:
+        // console.log('this.$find(\'router-view\').length', this.$find('router-view').length);
+        if (this.$find('router-view').length === 0) {
+          throw new Error(
+            'Cannot mount this page with `virtualPages: true` because no '+
+            '<router-view> element exists in this page\'s HTML.\n'+
+            'Please be sure the HTML includes:\n'+
+            '\n'+
+            '```\n'+
+            '<router-view></router-view>\n'+
+            '```\n'
+          );
+        }//•
+
+        // Then call the original, custom "beforeMount" function, if there was one.
+        if (customBeforeMountLC) {
+          customBeforeMountLC.apply(this, []);
+        }
+      };//ƒ
+
+      if (def.methods._handleVirtualNavigation) {
+        throw new Error('Could not use `virtualPages: true`, because a conflicting `_handleVirtualNavigation` method is defined.  Please remove it, or do something else.');
+      }
+
+      // Set up local variables to refer to things in `def`, since it will be changing below.
+      var pathMatchingRegExp;
+      if (def.html5HistoryMode === 'history') {
+        pathMatchingRegExp = def.virtualPagesRegExp;
+      } else {
+        pathMatchingRegExp = /.*/;
+      }
+
+      var beforeNavigate = def.beforeNavigate;
+      var afterNavigate = def.afterNavigate;
+
+      // Now modify the definition's methods and remove all relevant top-level props understood
+      // by parasails (but not by Vue.js) to avoid creating any weird additional dependence on
+      // parasails features beyond the expected usage.
+      def.methods = _.extend(def.methods||{}, {
+        _handleVirtualNavigation: function(virtualPageSlug){
+
+          if (beforeNavigate) {
+            var resultFromBeforeNavigate = beforeNavigate.apply(this, [ virtualPageSlug ]);
+            if (resultFromBeforeNavigate === false) {
+              return false;
+            }//•
+          }
+
+          this.virtualPageSlug = virtualPageSlug;
+
+          // console.log('navigate!  Got:', arguments);
+          // console.log('Navigated. (Set `this.virtualPageSlug=\''+virtualPageSlug+'\'`)');
+
+          if (afterNavigate) {
+            afterNavigate.apply(this, [ virtualPageSlug ]);
+          }
+
+        }
+      });
+
+      // Automatically attach `virtualPageSlug` to `data`, for convenience.
+      if (def.data && def.data.virtualPageSlug !== undefined && !_.isString(def.data.virtualPageSlug)) {
+        throw new Error('Page script definition contains `data` with a `virtualPageSlug` key, but you\'re not allowed to set that yourself unless you use a string.  (And this is set to a non-string value: '+def.data.virtualPageSlug+')');
+      } else if (def.data && def.data.virtualPageSlug === undefined) {
+        def.data = _.extend({
+          virtualPageSlug: undefined
+        }, def.data||{});
+      }//fi
+
+      // Now we'll replace `virtualPages` in our def with the thing that VueRouter actually expects:
+      def = _.extend({
+        router: new VueRouter({
+          mode: def.html5HistoryMode,
+          routes: [
+            {
+              path: '*',
+              component: (function(){
+                var vueComponentDef = {
+                  render: function(){},
+                  beforeRouteUpdate: function (to,from,next){
+                    // this.$emit('navigate', to.path); <<old way
+                    var path = to.path;
+                    var matches = path.match(pathMatchingRegExp);
+                    if (!matches) {
+                      var err =new Error('Could not match current URL path (`'+path+'`) as a virtual page.  Please check the `virtualPagesRegExp` -- e.g. `/^\/foo\/bar\/?([^\/]+)?/`');
+                      err.code = 'E_DID_NOT_MATCH_REGEXP';
+                      throw err;
+                    }//•
+
+                    // console.log('this.$parent', this.$parent);
+                    this.$parent._handleVirtualNavigation(matches[1]||'');
+                    // this.$emit('navigate', {
+                    //   rawPath: path,
+                    //   virtualPageSlug: matches[1]||''
+                    // });
+                    return next();
+                  },
+                  mounted: function(){
+                    // this.$emit('navigate', this.$route.path); <<old way
+                    var path = this.$route.path;
+                    var matches = path.match(pathMatchingRegExp);
+                    if (!matches) {
+                      var err =new Error('Could not match current URL path (`'+path+'`) as a virtual page.  Please check the `virtualPagesRegExp` -- e.g. `/^\/foo\/bar\/?([^\/]+)?/`');
+                      err.code = 'E_DID_NOT_MATCH_REGEXP';
+                      throw err;
+                    }//•
+
+                    this.$parent._handleVirtualNavigation(matches[1]||'');
+                    // this.$emit('navigate', {
+                    //   rawPath: path,
+                    //   virtualPageSlug: matches[1]||''
+                    // });
+                  }
+                };
+                // Expose extra methods on virtual page script, if jQuery is available.
+                _exposeBonusMethods(vueComponentDef, 'virtual page');
+
+                // Make sure none of the specified Vue methods are defined with any naughty arrow functions.
+                _wrapMethodsAndVerifyNoArrowFunctions(vueComponentDef, 'virtual page');
+
+                return vueComponentDef;
+              })()
+            }
+          ],
+        })
+      }, _.omit(def, ['virtualPages', 'virtualPagesRegExp', 'html5HistoryMode', 'beforeNavigate', 'afterNavigate']));
+    }//fi  </ def has `virtualPages` enabled >
+
+    // Construct Vue instance for this page script.
+    var vm = new Vue(def);
+
+    return vm;
+
+  };//ƒ
+
+
+
+  /**
+   * parasails.util.isMobile()
+   *
+   * Detect whether this is being accessed from a mobile browser/OS, which might
+   * be a handset device (iPhone, etc.) OR a tablet device (iPad, etc.)
+   *
+   * > This relies on `bowser.mobile||bowser.tablet`.
+   *
+   * @returns {Boolean}
+   */
+  parasails.util.isMobile = function(){
+
+    // If `bowser` is not available, throw an error.
+    if(!bowser) {
+      throw new Error('Cannot detect mobile-ness, because `bowser` global does not exist on the page yet. '+
+        '(If you\'re using Sails, please check dependency loading order in pipeline.js and make sure '+
+        'the Bowser library is getting brought in before `parasails`. If you have not included Bowser '+
+        'in your project, you can find it at https://github.com/lancedikson/bowser/releases)');
+    }
+
+    return (!!bowser.mobile) || (!!bowser.tablet);
+
+  };//ƒ
+  // An extra alias, for convenience:
+  parasails.isMobile = parasails.util.isMobile;
+
+
+  /**
+   * parasails.util.isValidEmailAddress()
+   *
+   * Determine whether the given value is a valid email address.
+   *
+   * > This code is taken directly from validator.js / anchor.
+   * > It is implemented as a built-in, organic utility that may be overwritten
+   * > in userland if desired.
+   *
+   * @param {String} value
+   *
+   * @returns {Boolean}
+   */
+
+  parasails.util.isValidEmailAddress = function(value){
+    if (!value || typeof value !== 'string') { return false; }
+    /* eslint-disable */
+    return (function(){function _isByteLength(str,min,max){var len=encodeURI(str).split(/%..|./).length-1;return len>=min&&(typeof max==='undefined'||len<=max)}
+    var emailUserUtf8Part=/^[a-z\d!#\$%&'\*\+\-\/=\?\^_`{\|}~\u00A0-\uD7FF\uF900-\uFDCF\uFDF0-\uFFEF]+$/i;var quotedEmailUserUtf8=/^([\s\x01-\x08\x0b\x0c\x0e-\x1f\x7f\x21\x23-\x5b\x5d-\x7e\u00A0-\uD7FF\uF900-\uFDCF\uFDF0-\uFFEF]|(\\[\x01-\x09\x0b\x0c\x0d-\x7f\u00A0-\uD7FF\uF900-\uFDCF\uFDF0-\uFFEF]))*$/i;function _isFQDN(str){var options={require_tld:!0,allow_underscores:!1,allow_trailing_dot:!1};if(options.allow_trailing_dot&&str[str.length-1]==='.'){str=str.substring(0,str.length-1)}
+    var parts=str.split('.');if(options.require_tld){var tld=parts.pop();if(!parts.length||!/^([a-z\u00a1-\uffff]{2,}|xn[a-z0-9-]{2,})$/i.test(tld)){return!1}}
+    for(var part,i=0;i<parts.length;i++){part=parts[i];if(options.allow_underscores){if(part.indexOf('__')>=0){return!1}
+    part=part.replace(/_/g,'')}
+    if(!/^[a-z\u00a1-\uffff0-9-]+$/i.test(part)){return!1}
+    if(/[\uff01-\uff5e]/.test(part)){return!1}
+    if(part[0]==='-'||part[part.length-1]==='-'||part.indexOf('---')>=0){return!1}}
+    return!0};return function(str){var parts=str.split('@'),domain=parts.pop(),user=parts.join('@');var lower_domain=domain.toLowerCase();if(lower_domain==='gmail.com'||lower_domain==='googlemail.com'){user=user.replace(/\./g,'').toLowerCase()}
+    if(!_isByteLength(user,0,64)||!_isByteLength(domain,0,256)){return!1}
+    if(!_isFQDN(domain)){return!1}
+    if(user[0]==='"'){user=user.slice(1,user.length-1);return quotedEmailUserUtf8.test(user)}
+    var pattern=emailUserUtf8Part;var user_parts=user.split('.');for(var i=0;i<user_parts.length;i++){if(!pattern.test(user_parts[i])){return!1}}
+    return!0}})()(value);
+    /* eslint-enable */
+  };//ƒ
+
+
+  /**
+   * parasails.utils
+   *
+   * A permanent alias for `parasails.util`.
+   *
+   * (Everyone gets these mixed up.)
+   *
+   * @type {:Dictionary}
+   */
+
+  parasails.utils = parasails.util;
+
+
+
+  return parasails;
+
+}, function (global, factory) {
+  var Vue;
+  var _;
+  var VueRouter;
+  var $;
+  var bowser;
+
+  //˙°˚°·.
+  //‡CJS  ˚°˚°·˛
+  if (typeof exports === 'object' && typeof module !== 'undefined') {
+    var _require = require;// eslint-disable-line no-undef
+    var _module = module;// eslint-disable-line no-undef
+    // required deps:
+    Vue = _require('vue');
+    _ = _require('lodash');
+    // optional deps:
+    try { VueRouter = _require('vue-router'); } catch (e) { if (e.code === 'MODULE_NOT_FOUND') {/* ok */} else { throw e; } }
+    try { $ = _require('jquery'); } catch (e) { if (e.code === 'MODULE_NOT_FOUND') {/* ok */} else { throw e; } }
+    try { bowser = _require('bowser'); } catch (e) { if (e.code === 'MODULE_NOT_FOUND') {/* ok */} else { throw e; } }
+    // export:
+    _module.exports = factory(Vue, _, VueRouter, $, bowser);
+  }
+  //˙°˚°·
+  //‡AMD ˚¸
+  else if(typeof define === 'function' && define.amd) {// eslint-disable-line no-undef
+    // Register as an anonymous module.
+    define([], function () {// eslint-disable-line no-undef
+      // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+      // FUTURE: maybe use optional dep. loading here instead?
+      // e.g.  `function('vue', 'lodash', 'vue-router', 'jquery')`
+      // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+      // required deps:
+      if (!global.Vue) { throw new Error('`Vue` global does not exist on the page yet. (If you\'re using Sails, please check dependency loading order in pipeline.js and make sure the Vue.js library is getting brought in before `parasails`.)'); }
+      Vue = global.Vue;
+      if (!global._) { throw new Error('`_` global does not exist on the page yet. (If you\'re using Sails, please check dependency loading order in pipeline.js and make sure the Lodash library is getting brought in before `parasails`.)'); }
+      _ = global._;
+      // optional deps:
+      VueRouter = global.VueRouter || undefined;
+      $ = global.$ || global.jQuery || undefined;
+      bowser = global.bowser || undefined;
+
+      // So... there's not really a huge point to supporting AMD here--
+      // except that if you're using it in your project, it makes this
+      // module fit nicely with the others you're using.  And if you
+      // really hate globals, I guess there's that.
+      // ¯\_(ツ)_/¯
+      return factory(Vue, _, VueRouter, $, bowser);
+    });//ƒ
+  }
+  //˙°˚˙°·
+  //‡NUDE ˚°·˛
+  else {
+    // required deps:
+    if (!global.Vue) { throw new Error('`Vue` global does not exist on the page yet. (If you\'re using Sails, please check dependency loading order in pipeline.js and make sure the Vue.js library is getting brought in before `parasails`.)'); }
+    Vue = global.Vue;
+    if (!global._) { throw new Error('`_` global does not exist on the page yet. (If you\'re using Sails, please check dependency loading order in pipeline.js and make sure the Lodash library is getting brought in before `parasails`.)'); }
+    _ = global._;
+    // optional deps:
+    VueRouter = global.VueRouter || undefined;
+    $ = global.$ || global.jQuery || undefined;
+    bowser = global.bowser || undefined;
+    // export:
+    if (global.parasails) { throw new Error('Conflicting global (`parasails`) already exists!'); }
+    global.parasails = factory(Vue, _, VueRouter, $, bowser);
+  }
+});//…)
diff --git a/ee/bulk-operations-dashboard/assets/dependencies/sails.io.js b/ee/bulk-operations-dashboard/assets/dependencies/sails.io.js
new file mode 100644
index 0000000000..6c134c2214
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/dependencies/sails.io.js
@@ -0,0 +1,1739 @@
+/* eslint-disable */
+
+/**
+ * To use sails.io.js in an AMD environment (e.g. with require.js),
+ * replace this file with the sails.io.js file from the root of:
+ * https://github.com/balderdashy/sails.io.js
+ * and download a standalone copy of socket.io-client from:
+ * https://github.com/socketio/socket.io-client
+ * then follow the instructions at:
+ * https://github.com/balderdashy/sails.io.js#requirejsamd-usage
+ */
+
+// socket.io-client version 2.0.3
+// https://github.com/socketio/socket.io-client
+
+!function(a,b){"object"==typeof exports&&"object"==typeof module?module.exports=b():"function"==typeof define&&define.amd?define([],b):"object"==typeof exports?exports.io=b():a.io=b()}(this,function(){return function(a){function b(d){if(c[d])return c[d].exports;var e=c[d]={exports:{},id:d,loaded:!1};return a[d].call(e.exports,e,e.exports,b),e.loaded=!0,e.exports}var c={};return b.m=a,b.c=c,b.p="",b(0)}([function(a,b,c){"use strict";function d(a,b){"object"===("undefined"==typeof a?"undefined":e(a))&&(b=a,a=void 0),b=b||{};var c,d=f(a),g=d.source,k=d.id,l=d.path,m=j[k]&&l in j[k].nsps,n=b.forceNew||b["force new connection"]||!1===b.multiplex||m;return n?(i("ignoring socket cache for %s",g),c=h(g,b)):(j[k]||(i("new io instance for %s",g),j[k]=h(g,b)),c=j[k]),d.query&&!b.query&&(b.query=d.query),c.socket(d.path,b)}var e="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(a){return typeof a}:function(a){return a&&"function"==typeof Symbol&&a.constructor===Symbol&&a!==Symbol.prototype?"symbol":typeof a},f=c(1),g=c(7),h=c(13),i=c(3)("socket.io-client");a.exports=b=d;var j=b.managers={};b.protocol=g.protocol,b.connect=d,b.Manager=c(13),b.Socket=c(39)},function(a,b,c){(function(b){"use strict";function d(a,c){var d=a;c=c||b.location,null==a&&(a=c.protocol+"//"+c.host),"string"==typeof a&&("/"===a.charAt(0)&&(a="/"===a.charAt(1)?c.protocol+a:c.host+a),/^(https?|wss?):\/\//.test(a)||(f("protocol-less url %s",a),a="undefined"!=typeof c?c.protocol+"//"+a:"https://"+a),f("parse %s",a),d=e(a)),d.port||(/^(http|ws)$/.test(d.protocol)?d.port="80":/^(http|ws)s$/.test(d.protocol)&&(d.port="443")),d.path=d.path||"/";var g=d.host.indexOf(":")!==-1,h=g?"["+d.host+"]":d.host;return d.id=d.protocol+"://"+h+":"+d.port,d.href=d.protocol+"://"+h+(c&&c.port===d.port?"":":"+d.port),d}var e=c(2),f=c(3)("socket.io-client:url");a.exports=d}).call(b,function(){return this}())},function(a,b){var c=/^(?:(?![^:@]+:[^:@\/]*@)(http|https|ws|wss):\/\/)?((?:(([^:@]*)(?::([^:@]*))?)?@)?((?:[a-f0-9]{0,4}:){2,7}[a-f0-9]{0,4}|[^:\/?#]*)(?::(\d*))?)(((\/(?:[^?#](?![^?#\/]*\.[^?#\/.]+(?:[?#]|$)))*\/?)?([^?#\/]*))(?:\?([^#]*))?(?:#(.*))?)/,d=["source","protocol","authority","userInfo","user","password","host","port","relative","path","directory","file","query","anchor"];a.exports=function(a){var b=a,e=a.indexOf("["),f=a.indexOf("]");e!=-1&&f!=-1&&(a=a.substring(0,e)+a.substring(e,f).replace(/:/g,";")+a.substring(f,a.length));for(var g=c.exec(a||""),h={},i=14;i--;)h[d[i]]=g[i]||"";return e!=-1&&f!=-1&&(h.source=b,h.host=h.host.substring(1,h.host.length-1).replace(/;/g,":"),h.authority=h.authority.replace("[","").replace("]","").replace(/;/g,":"),h.ipv6uri=!0),h}},function(a,b,c){(function(d){function e(){return!("undefined"==typeof window||!window.process||"renderer"!==window.process.type)||"undefined"!=typeof document&&document.documentElement&&document.documentElement.style&&document.documentElement.style.WebkitAppearance||"undefined"!=typeof window&&window.console&&(window.console.firebug||window.console.exception&&window.console.table)||"undefined"!=typeof navigator&&navigator.userAgent&&navigator.userAgent.toLowerCase().match(/firefox\/(\d+)/)&&parseInt(RegExp.$1,10)>=31||"undefined"!=typeof navigator&&navigator.userAgent&&navigator.userAgent.toLowerCase().match(/applewebkit\/(\d+)/)}function f(a){var c=this.useColors;if(a[0]=(c?"%c":"")+this.namespace+(c?" %c":" ")+a[0]+(c?"%c ":" ")+"+"+b.humanize(this.diff),c){var d="color: "+this.color;a.splice(1,0,d,"color: inherit");var e=0,f=0;a[0].replace(/%[a-zA-Z%]/g,function(a){"%%"!==a&&(e++,"%c"===a&&(f=e))}),a.splice(f,0,d)}}function g(){return"object"==typeof console&&console.log&&Function.prototype.apply.call(console.log,console,arguments)}function h(a){try{null==a?b.storage.removeItem("debug"):b.storage.debug=a}catch(c){}}function i(){var a;try{a=b.storage.debug}catch(c){}return!a&&"undefined"!=typeof d&&"env"in d&&(a=d.env.DEBUG),a}function j(){try{return window.localStorage}catch(a){}}b=a.exports=c(5),b.log=g,b.formatArgs=f,b.save=h,b.load=i,b.useColors=e,b.storage="undefined"!=typeof chrome&&"undefined"!=typeof chrome.storage?chrome.storage.local:j(),b.colors=["lightseagreen","forestgreen","goldenrod","dodgerblue","darkorchid","crimson"],b.formatters.j=function(a){try{return JSON.stringify(a)}catch(b){return"[UnexpectedJSONParseError]: "+b.message}},b.enable(i())}).call(b,c(4))},function(a,b){function c(){throw new Error("setTimeout has not been defined")}function d(){throw new Error("clearTimeout has not been defined")}function e(a){if(k===setTimeout)return setTimeout(a,0);if((k===c||!k)&&setTimeout)return k=setTimeout,setTimeout(a,0);try{return k(a,0)}catch(b){try{return k.call(null,a,0)}catch(b){return k.call(this,a,0)}}}function f(a){if(l===clearTimeout)return clearTimeout(a);if((l===d||!l)&&clearTimeout)return l=clearTimeout,clearTimeout(a);try{return l(a)}catch(b){try{return l.call(null,a)}catch(b){return l.call(this,a)}}}function g(){p&&n&&(p=!1,n.length?o=n.concat(o):q=-1,o.length&&h())}function h(){if(!p){var a=e(g);p=!0;for(var b=o.length;b;){for(n=o,o=[];++q<b;)n&&n[q].run();q=-1,b=o.length}n=null,p=!1,f(a)}}function i(a,b){this.fun=a,this.array=b}function j(){}var k,l,m=a.exports={};!function(){try{k="function"==typeof setTimeout?setTimeout:c}catch(a){k=c}try{l="function"==typeof clearTimeout?clearTimeout:d}catch(a){l=d}}();var n,o=[],p=!1,q=-1;m.nextTick=function(a){var b=new Array(arguments.length-1);if(arguments.length>1)for(var c=1;c<arguments.length;c++)b[c-1]=arguments[c];o.push(new i(a,b)),1!==o.length||p||e(h)},i.prototype.run=function(){this.fun.apply(null,this.array)},m.title="browser",m.browser=!0,m.env={},m.argv=[],m.version="",m.versions={},m.on=j,m.addListener=j,m.once=j,m.off=j,m.removeListener=j,m.removeAllListeners=j,m.emit=j,m.prependListener=j,m.prependOnceListener=j,m.listeners=function(a){return[]},m.binding=function(a){throw new Error("process.binding is not supported")},m.cwd=function(){return"/"},m.chdir=function(a){throw new Error("process.chdir is not supported")},m.umask=function(){return 0}},function(a,b,c){function d(a){var c,d=0;for(c in a)d=(d<<5)-d+a.charCodeAt(c),d|=0;return b.colors[Math.abs(d)%b.colors.length]}function e(a){function c(){if(c.enabled){var a=c,d=+new Date,e=d-(j||d);a.diff=e,a.prev=j,a.curr=d,j=d;for(var f=new Array(arguments.length),g=0;g<f.length;g++)f[g]=arguments[g];f[0]=b.coerce(f[0]),"string"!=typeof f[0]&&f.unshift("%O");var h=0;f[0]=f[0].replace(/%([a-zA-Z%])/g,function(c,d){if("%%"===c)return c;h++;var e=b.formatters[d];if("function"==typeof e){var g=f[h];c=e.call(a,g),f.splice(h,1),h--}return c}),b.formatArgs.call(a,f);var i=c.log||b.log||console.log.bind(console);i.apply(a,f)}}return c.namespace=a,c.enabled=b.enabled(a),c.useColors=b.useColors(),c.color=d(a),"function"==typeof b.init&&b.init(c),c}function f(a){b.save(a),b.names=[],b.skips=[];for(var c=("string"==typeof a?a:"").split(/[\s,]+/),d=c.length,e=0;e<d;e++)c[e]&&(a=c[e].replace(/\*/g,".*?"),"-"===a[0]?b.skips.push(new RegExp("^"+a.substr(1)+"$")):b.names.push(new RegExp("^"+a+"$")))}function g(){b.enable("")}function h(a){var c,d;for(c=0,d=b.skips.length;c<d;c++)if(b.skips[c].test(a))return!1;for(c=0,d=b.names.length;c<d;c++)if(b.names[c].test(a))return!0;return!1}function i(a){return a instanceof Error?a.stack||a.message:a}b=a.exports=e.debug=e["default"]=e,b.coerce=i,b.disable=g,b.enable=f,b.enabled=h,b.humanize=c(6),b.names=[],b.skips=[],b.formatters={};var j},function(a,b){function c(a){if(a=String(a),!(a.length>100)){var b=/^((?:\d+)?\.?\d+) *(milliseconds?|msecs?|ms|seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|years?|yrs?|y)?$/i.exec(a);if(b){var c=parseFloat(b[1]),d=(b[2]||"ms").toLowerCase();switch(d){case"years":case"year":case"yrs":case"yr":case"y":return c*k;case"days":case"day":case"d":return c*j;case"hours":case"hour":case"hrs":case"hr":case"h":return c*i;case"minutes":case"minute":case"mins":case"min":case"m":return c*h;case"seconds":case"second":case"secs":case"sec":case"s":return c*g;case"milliseconds":case"millisecond":case"msecs":case"msec":case"ms":return c;default:return}}}}function d(a){return a>=j?Math.round(a/j)+"d":a>=i?Math.round(a/i)+"h":a>=h?Math.round(a/h)+"m":a>=g?Math.round(a/g)+"s":a+"ms"}function e(a){return f(a,j,"day")||f(a,i,"hour")||f(a,h,"minute")||f(a,g,"second")||a+" ms"}function f(a,b,c){if(!(a<b))return a<1.5*b?Math.floor(a/b)+" "+c:Math.ceil(a/b)+" "+c+"s"}var g=1e3,h=60*g,i=60*h,j=24*i,k=365.25*j;a.exports=function(a,b){b=b||{};var f=typeof a;if("string"===f&&a.length>0)return c(a);if("number"===f&&isNaN(a)===!1)return b["long"]?e(a):d(a);throw new Error("val is not a non-empty string or a valid number. val="+JSON.stringify(a))}},function(a,b,c){function d(){}function e(a){var c=""+a.type;return b.BINARY_EVENT!==a.type&&b.BINARY_ACK!==a.type||(c+=a.attachments+"-"),a.nsp&&"/"!==a.nsp&&(c+=a.nsp+","),null!=a.id&&(c+=a.id),null!=a.data&&(c+=JSON.stringify(a.data)),l("encoded %j as %s",a,c),c}function f(a,b){function c(a){var c=o.deconstructPacket(a),d=e(c.packet),f=c.buffers;f.unshift(d),b(f)}o.removeBlobs(a,c)}function g(){this.reconstructor=null}function h(a){var c=0,d={type:Number(a.charAt(0))};if(null==b.types[d.type])return k();if(b.BINARY_EVENT===d.type||b.BINARY_ACK===d.type){for(var e="";"-"!==a.charAt(++c)&&(e+=a.charAt(c),c!=a.length););if(e!=Number(e)||"-"!==a.charAt(c))throw new Error("Illegal attachments");d.attachments=Number(e)}if("/"===a.charAt(c+1))for(d.nsp="";++c;){var f=a.charAt(c);if(","===f)break;if(d.nsp+=f,c===a.length)break}else d.nsp="/";var g=a.charAt(c+1);if(""!==g&&Number(g)==g){for(d.id="";++c;){var f=a.charAt(c);if(null==f||Number(f)!=f){--c;break}if(d.id+=a.charAt(c),c===a.length)break}d.id=Number(d.id)}return a.charAt(++c)&&(d=i(d,a.substr(c))),l("decoded %s as %j",a,d),d}function i(a,b){try{a.data=JSON.parse(b)}catch(c){return k()}return a}function j(a){this.reconPack=a,this.buffers=[]}function k(){return{type:b.ERROR,data:"parser error"}}var l=c(3)("socket.io-parser"),m=c(8),n=c(9),o=c(11),p=c(12);b.protocol=4,b.types=["CONNECT","DISCONNECT","EVENT","ACK","ERROR","BINARY_EVENT","BINARY_ACK"],b.CONNECT=0,b.DISCONNECT=1,b.EVENT=2,b.ACK=3,b.ERROR=4,b.BINARY_EVENT=5,b.BINARY_ACK=6,b.Encoder=d,b.Decoder=g,d.prototype.encode=function(a,c){if(a.type!==b.EVENT&&a.type!==b.ACK||!n(a.data)||(a.type=a.type===b.EVENT?b.BINARY_EVENT:b.BINARY_ACK),l("encoding packet %j",a),b.BINARY_EVENT===a.type||b.BINARY_ACK===a.type)f(a,c);else{var d=e(a);c([d])}},m(g.prototype),g.prototype.add=function(a){var c;if("string"==typeof a)c=h(a),b.BINARY_EVENT===c.type||b.BINARY_ACK===c.type?(this.reconstructor=new j(c),0===this.reconstructor.reconPack.attachments&&this.emit("decoded",c)):this.emit("decoded",c);else{if(!p(a)&&!a.base64)throw new Error("Unknown type: "+a);if(!this.reconstructor)throw new Error("got binary data when not reconstructing a packet");c=this.reconstructor.takeBinaryData(a),c&&(this.reconstructor=null,this.emit("decoded",c))}},g.prototype.destroy=function(){this.reconstructor&&this.reconstructor.finishedReconstruction()},j.prototype.takeBinaryData=function(a){if(this.buffers.push(a),this.buffers.length===this.reconPack.attachments){var b=o.reconstructPacket(this.reconPack,this.buffers);return this.finishedReconstruction(),b}return null},j.prototype.finishedReconstruction=function(){this.reconPack=null,this.buffers=[]}},function(a,b,c){function d(a){if(a)return e(a)}function e(a){for(var b in d.prototype)a[b]=d.prototype[b];return a}a.exports=d,d.prototype.on=d.prototype.addEventListener=function(a,b){return this._callbacks=this._callbacks||{},(this._callbacks["$"+a]=this._callbacks["$"+a]||[]).push(b),this},d.prototype.once=function(a,b){function c(){this.off(a,c),b.apply(this,arguments)}return c.fn=b,this.on(a,c),this},d.prototype.off=d.prototype.removeListener=d.prototype.removeAllListeners=d.prototype.removeEventListener=function(a,b){if(this._callbacks=this._callbacks||{},0==arguments.length)return this._callbacks={},this;var c=this._callbacks["$"+a];if(!c)return this;if(1==arguments.length)return delete this._callbacks["$"+a],this;for(var d,e=0;e<c.length;e++)if(d=c[e],d===b||d.fn===b){c.splice(e,1);break}return this},d.prototype.emit=function(a){this._callbacks=this._callbacks||{};var b=[].slice.call(arguments,1),c=this._callbacks["$"+a];if(c){c=c.slice(0);for(var d=0,e=c.length;d<e;++d)c[d].apply(this,b)}return this},d.prototype.listeners=function(a){return this._callbacks=this._callbacks||{},this._callbacks["$"+a]||[]},d.prototype.hasListeners=function(a){return!!this.listeners(a).length}},function(a,b,c){(function(b){function d(a){if(!a||"object"!=typeof a)return!1;if(e(a)){for(var c=0,f=a.length;c<f;c++)if(d(a[c]))return!0;return!1}if("function"==typeof b.Buffer&&b.Buffer.isBuffer&&b.Buffer.isBuffer(a)||"function"==typeof b.ArrayBuffer&&a instanceof ArrayBuffer||g&&a instanceof Blob||h&&a instanceof File)return!0;if(a.toJSON&&"function"==typeof a.toJSON&&1===arguments.length)return d(a.toJSON(),!0);for(var i in a)if(Object.prototype.hasOwnProperty.call(a,i)&&d(a[i]))return!0;return!1}var e=c(10),f=Object.prototype.toString,g="function"==typeof b.Blob||"[object BlobConstructor]"===f.call(b.Blob),h="function"==typeof b.File||"[object FileConstructor]"===f.call(b.File);a.exports=d}).call(b,function(){return this}())},function(a,b){var c={}.toString;a.exports=Array.isArray||function(a){return"[object Array]"==c.call(a)}},function(a,b,c){(function(a){function d(a,b){if(!a)return a;if(g(a)){var c={_placeholder:!0,num:b.length};return b.push(a),c}if(f(a)){for(var e=new Array(a.length),h=0;h<a.length;h++)e[h]=d(a[h],b);return e}if("object"==typeof a&&!(a instanceof Date)){var e={};for(var i in a)e[i]=d(a[i],b);return e}return a}function e(a,b){if(!a)return a;if(a&&a._placeholder)return b[a.num];if(f(a))for(var c=0;c<a.length;c++)a[c]=e(a[c],b);else if("object"==typeof a)for(var d in a)a[d]=e(a[d],b);return a}var f=c(10),g=c(12),h=Object.prototype.toString,i="function"==typeof a.Blob||"[object BlobConstructor]"===h.call(a.Blob),j="function"==typeof a.File||"[object FileConstructor]"===h.call(a.File);b.deconstructPacket=function(a){var b=[],c=a.data,e=a;return e.data=d(c,b),e.attachments=b.length,{packet:e,buffers:b}},b.reconstructPacket=function(a,b){return a.data=e(a.data,b),a.attachments=void 0,a},b.removeBlobs=function(a,b){function c(a,h,k){if(!a)return a;if(i&&a instanceof Blob||j&&a instanceof File){d++;var l=new FileReader;l.onload=function(){k?k[h]=this.result:e=this.result,--d||b(e)},l.readAsArrayBuffer(a)}else if(f(a))for(var m=0;m<a.length;m++)c(a[m],m,a);else if("object"==typeof a&&!g(a))for(var n in a)c(a[n],n,a)}var d=0,e=a;c(e),d||b(e)}}).call(b,function(){return this}())},function(a,b){(function(b){function c(a){return b.Buffer&&b.Buffer.isBuffer(a)||b.ArrayBuffer&&a instanceof ArrayBuffer}a.exports=c}).call(b,function(){return this}())},function(a,b,c){"use strict";function d(a,b){if(!(this instanceof d))return new d(a,b);a&&"object"===("undefined"==typeof a?"undefined":e(a))&&(b=a,a=void 0),b=b||{},b.path=b.path||"/socket.io",this.nsps={},this.subs=[],this.opts=b,this.reconnection(b.reconnection!==!1),this.reconnectionAttempts(b.reconnectionAttempts||1/0),this.reconnectionDelay(b.reconnectionDelay||1e3),this.reconnectionDelayMax(b.reconnectionDelayMax||5e3),this.randomizationFactor(b.randomizationFactor||.5),this.backoff=new n({min:this.reconnectionDelay(),max:this.reconnectionDelayMax(),jitter:this.randomizationFactor()}),this.timeout(null==b.timeout?2e4:b.timeout),this.readyState="closed",this.uri=a,this.connecting=[],this.lastPing=null,this.encoding=!1,this.packetBuffer=[];var c=b.parser||i;this.encoder=new c.Encoder,this.decoder=new c.Decoder,this.autoConnect=b.autoConnect!==!1,this.autoConnect&&this.open()}var e="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(a){return typeof a}:function(a){return a&&"function"==typeof Symbol&&a.constructor===Symbol&&a!==Symbol.prototype?"symbol":typeof a},f=c(14),g=c(39),h=c(8),i=c(7),j=c(41),k=c(42),l=c(3)("socket.io-client:manager"),m=c(37),n=c(43),o=Object.prototype.hasOwnProperty;a.exports=d,d.prototype.emitAll=function(){this.emit.apply(this,arguments);for(var a in this.nsps)o.call(this.nsps,a)&&this.nsps[a].emit.apply(this.nsps[a],arguments)},d.prototype.updateSocketIds=function(){for(var a in this.nsps)o.call(this.nsps,a)&&(this.nsps[a].id=this.generateId(a))},d.prototype.generateId=function(a){return("/"===a?"":a+"#")+this.engine.id},h(d.prototype),d.prototype.reconnection=function(a){return arguments.length?(this._reconnection=!!a,this):this._reconnection},d.prototype.reconnectionAttempts=function(a){return arguments.length?(this._reconnectionAttempts=a,this):this._reconnectionAttempts},d.prototype.reconnectionDelay=function(a){return arguments.length?(this._reconnectionDelay=a,this.backoff&&this.backoff.setMin(a),this):this._reconnectionDelay},d.prototype.randomizationFactor=function(a){return arguments.length?(this._randomizationFactor=a,this.backoff&&this.backoff.setJitter(a),this):this._randomizationFactor},d.prototype.reconnectionDelayMax=function(a){return arguments.length?(this._reconnectionDelayMax=a,this.backoff&&this.backoff.setMax(a),this):this._reconnectionDelayMax},d.prototype.timeout=function(a){return arguments.length?(this._timeout=a,this):this._timeout},d.prototype.maybeReconnectOnOpen=function(){!this.reconnecting&&this._reconnection&&0===this.backoff.attempts&&this.reconnect()},d.prototype.open=d.prototype.connect=function(a,b){if(l("readyState %s",this.readyState),~this.readyState.indexOf("open"))return this;l("opening %s",this.uri),this.engine=f(this.uri,this.opts);var c=this.engine,d=this;this.readyState="opening",this.skipReconnect=!1;var e=j(c,"open",function(){d.onopen(),a&&a()}),g=j(c,"error",function(b){if(l("connect_error"),d.cleanup(),d.readyState="closed",d.emitAll("connect_error",b),a){var c=new Error("Connection error");c.data=b,a(c)}else d.maybeReconnectOnOpen()});if(!1!==this._timeout){var h=this._timeout;l("connect attempt will timeout after %d",h);var i=setTimeout(function(){l("connect attempt timed out after %d",h),e.destroy(),c.close(),c.emit("error","timeout"),d.emitAll("connect_timeout",h)},h);this.subs.push({destroy:function(){clearTimeout(i)}})}return this.subs.push(e),this.subs.push(g),this},d.prototype.onopen=function(){l("open"),this.cleanup(),this.readyState="open",this.emit("open");var a=this.engine;this.subs.push(j(a,"data",k(this,"ondata"))),this.subs.push(j(a,"ping",k(this,"onping"))),this.subs.push(j(a,"pong",k(this,"onpong"))),this.subs.push(j(a,"error",k(this,"onerror"))),this.subs.push(j(a,"close",k(this,"onclose"))),this.subs.push(j(this.decoder,"decoded",k(this,"ondecoded")))},d.prototype.onping=function(){this.lastPing=new Date,this.emitAll("ping")},d.prototype.onpong=function(){this.emitAll("pong",new Date-this.lastPing)},d.prototype.ondata=function(a){this.decoder.add(a)},d.prototype.ondecoded=function(a){this.emit("packet",a)},d.prototype.onerror=function(a){l("error",a),this.emitAll("error",a)},d.prototype.socket=function(a,b){function c(){~m(e.connecting,d)||e.connecting.push(d)}var d=this.nsps[a];if(!d){d=new g(this,a,b),this.nsps[a]=d;var e=this;d.on("connecting",c),d.on("connect",function(){d.id=e.generateId(a)}),this.autoConnect&&c()}return d},d.prototype.destroy=function(a){var b=m(this.connecting,a);~b&&this.connecting.splice(b,1),this.connecting.length||this.close()},d.prototype.packet=function(a){l("writing packet %j",a);var b=this;a.query&&0===a.type&&(a.nsp+="?"+a.query),b.encoding?b.packetBuffer.push(a):(b.encoding=!0,this.encoder.encode(a,function(c){for(var d=0;d<c.length;d++)b.engine.write(c[d],a.options);b.encoding=!1,b.processPacketQueue()}))},d.prototype.processPacketQueue=function(){if(this.packetBuffer.length>0&&!this.encoding){var a=this.packetBuffer.shift();this.packet(a)}},d.prototype.cleanup=function(){l("cleanup");for(var a=this.subs.length,b=0;b<a;b++){var c=this.subs.shift();c.destroy()}this.packetBuffer=[],this.encoding=!1,this.lastPing=null,this.decoder.destroy()},d.prototype.close=d.prototype.disconnect=function(){l("disconnect"),this.skipReconnect=!0,this.reconnecting=!1,"opening"===this.readyState&&this.cleanup(),this.backoff.reset(),this.readyState="closed",this.engine&&this.engine.close()},d.prototype.onclose=function(a){l("onclose"),this.cleanup(),this.backoff.reset(),this.readyState="closed",this.emit("close",a),this._reconnection&&!this.skipReconnect&&this.reconnect()},d.prototype.reconnect=function(){if(this.reconnecting||this.skipReconnect)return this;var a=this;if(this.backoff.attempts>=this._reconnectionAttempts)l("reconnect failed"),this.backoff.reset(),this.emitAll("reconnect_failed"),this.reconnecting=!1;else{var b=this.backoff.duration();l("will wait %dms before reconnect attempt",b),this.reconnecting=!0;var c=setTimeout(function(){a.skipReconnect||(l("attempting reconnect"),a.emitAll("reconnect_attempt",a.backoff.attempts),a.emitAll("reconnecting",a.backoff.attempts),a.skipReconnect||a.open(function(b){b?(l("reconnect attempt error"),a.reconnecting=!1,a.reconnect(),a.emitAll("reconnect_error",b.data)):(l("reconnect success"),a.onreconnect())}))},b);this.subs.push({destroy:function(){clearTimeout(c)}})}},d.prototype.onreconnect=function(){var a=this.backoff.attempts;this.reconnecting=!1,this.backoff.reset(),this.updateSocketIds(),this.emitAll("reconnect",a)}},function(a,b,c){a.exports=c(15)},function(a,b,c){a.exports=c(16),a.exports.parser=c(23)},function(a,b,c){(function(b){function d(a,c){if(!(this instanceof d))return new d(a,c);c=c||{},a&&"object"==typeof a&&(c=a,a=null),a?(a=k(a),c.hostname=a.host,c.secure="https"===a.protocol||"wss"===a.protocol,c.port=a.port,a.query&&(c.query=a.query)):c.host&&(c.hostname=k(c.host).host),this.secure=null!=c.secure?c.secure:b.location&&"https:"===location.protocol,c.hostname&&!c.port&&(c.port=this.secure?"443":"80"),this.agent=c.agent||!1,this.hostname=c.hostname||(b.location?location.hostname:"localhost"),this.port=c.port||(b.location&&location.port?location.port:this.secure?443:80),this.query=c.query||{},"string"==typeof this.query&&(this.query=m.decode(this.query)),this.upgrade=!1!==c.upgrade,this.path=(c.path||"/engine.io").replace(/\/$/,"")+"/",this.forceJSONP=!!c.forceJSONP,this.jsonp=!1!==c.jsonp,this.forceBase64=!!c.forceBase64,this.enablesXDR=!!c.enablesXDR,this.timestampParam=c.timestampParam||"t",this.timestampRequests=c.timestampRequests,this.transports=c.transports||["polling","websocket"],this.transportOptions=c.transportOptions||{},this.readyState="",this.writeBuffer=[],this.prevBufferLen=0,this.policyPort=c.policyPort||843,this.rememberUpgrade=c.rememberUpgrade||!1,this.binaryType=null,this.onlyBinaryUpgrades=c.onlyBinaryUpgrades,this.perMessageDeflate=!1!==c.perMessageDeflate&&(c.perMessageDeflate||{}),!0===this.perMessageDeflate&&(this.perMessageDeflate={}),this.perMessageDeflate&&null==this.perMessageDeflate.threshold&&(this.perMessageDeflate.threshold=1024),this.pfx=c.pfx||null,this.key=c.key||null,this.passphrase=c.passphrase||null,this.cert=c.cert||null,this.ca=c.ca||null,this.ciphers=c.ciphers||null,this.rejectUnauthorized=void 0===c.rejectUnauthorized||c.rejectUnauthorized,this.forceNode=!!c.forceNode;var e="object"==typeof b&&b;e.global===e&&(c.extraHeaders&&Object.keys(c.extraHeaders).length>0&&(this.extraHeaders=c.extraHeaders),c.localAddress&&(this.localAddress=c.localAddress)),this.id=null,this.upgrades=null,this.pingInterval=null,this.pingTimeout=null,this.pingIntervalTimer=null,this.pingTimeoutTimer=null,this.open()}function e(a){var b={};for(var c in a)a.hasOwnProperty(c)&&(b[c]=a[c]);return b}var f=c(17),g=c(8),h=c(3)("engine.io-client:socket"),i=c(37),j=c(23),k=c(2),l=c(38),m=c(31);a.exports=d,d.priorWebsocketSuccess=!1,g(d.prototype),d.protocol=j.protocol,d.Socket=d,d.Transport=c(22),d.transports=c(17),d.parser=c(23),d.prototype.createTransport=function(a){h('creating transport "%s"',a);var b=e(this.query);b.EIO=j.protocol,b.transport=a;var c=this.transportOptions[a]||{};this.id&&(b.sid=this.id);var d=new f[a]({query:b,socket:this,agent:c.agent||this.agent,hostname:c.hostname||this.hostname,port:c.port||this.port,secure:c.secure||this.secure,path:c.path||this.path,forceJSONP:c.forceJSONP||this.forceJSONP,jsonp:c.jsonp||this.jsonp,forceBase64:c.forceBase64||this.forceBase64,enablesXDR:c.enablesXDR||this.enablesXDR,timestampRequests:c.timestampRequests||this.timestampRequests,timestampParam:c.timestampParam||this.timestampParam,policyPort:c.policyPort||this.policyPort,pfx:c.pfx||this.pfx,key:c.key||this.key,passphrase:c.passphrase||this.passphrase,cert:c.cert||this.cert,ca:c.ca||this.ca,ciphers:c.ciphers||this.ciphers,rejectUnauthorized:c.rejectUnauthorized||this.rejectUnauthorized,perMessageDeflate:c.perMessageDeflate||this.perMessageDeflate,extraHeaders:c.extraHeaders||this.extraHeaders,forceNode:c.forceNode||this.forceNode,localAddress:c.localAddress||this.localAddress,requestTimeout:c.requestTimeout||this.requestTimeout,protocols:c.protocols||void 0});return d},d.prototype.open=function(){var a;if(this.rememberUpgrade&&d.priorWebsocketSuccess&&this.transports.indexOf("websocket")!==-1)a="websocket";else{if(0===this.transports.length){var b=this;return void setTimeout(function(){b.emit("error","No transports available")},0)}a=this.transports[0]}this.readyState="opening";try{a=this.createTransport(a)}catch(c){return this.transports.shift(),void this.open()}a.open(),this.setTransport(a)},d.prototype.setTransport=function(a){h("setting transport %s",a.name);var b=this;this.transport&&(h("clearing existing transport %s",this.transport.name),this.transport.removeAllListeners()),this.transport=a,a.on("drain",function(){b.onDrain()}).on("packet",function(a){b.onPacket(a)}).on("error",function(a){b.onError(a)}).on("close",function(){b.onClose("transport close")})},d.prototype.probe=function(a){function b(){if(m.onlyBinaryUpgrades){var b=!this.supportsBinary&&m.transport.supportsBinary;l=l||b}l||(h('probe transport "%s" opened',a),k.send([{type:"ping",data:"probe"}]),k.once("packet",function(b){if(!l)if("pong"===b.type&&"probe"===b.data){if(h('probe transport "%s" pong',a),m.upgrading=!0,m.emit("upgrading",k),!k)return;d.priorWebsocketSuccess="websocket"===k.name,h('pausing current transport "%s"',m.transport.name),m.transport.pause(function(){l||"closed"!==m.readyState&&(h("changing transport and sending upgrade packet"),j(),m.setTransport(k),k.send([{type:"upgrade"}]),m.emit("upgrade",k),k=null,m.upgrading=!1,m.flush())})}else{h('probe transport "%s" failed',a);var c=new Error("probe error");c.transport=k.name,m.emit("upgradeError",c)}}))}function c(){l||(l=!0,j(),k.close(),k=null)}function e(b){var d=new Error("probe error: "+b);d.transport=k.name,c(),h('probe transport "%s" failed because of error: %s',a,b),m.emit("upgradeError",d)}function f(){e("transport closed")}function g(){e("socket closed")}function i(a){k&&a.name!==k.name&&(h('"%s" works - aborting "%s"',a.name,k.name),c())}function j(){k.removeListener("open",b),k.removeListener("error",e),k.removeListener("close",f),m.removeListener("close",g),m.removeListener("upgrading",i)}h('probing transport "%s"',a);var k=this.createTransport(a,{probe:1}),l=!1,m=this;d.priorWebsocketSuccess=!1,k.once("open",b),k.once("error",e),k.once("close",f),this.once("close",g),this.once("upgrading",i),k.open()},d.prototype.onOpen=function(){if(h("socket open"),this.readyState="open",d.priorWebsocketSuccess="websocket"===this.transport.name,this.emit("open"),this.flush(),"open"===this.readyState&&this.upgrade&&this.transport.pause){h("starting upgrade probes");for(var a=0,b=this.upgrades.length;a<b;a++)this.probe(this.upgrades[a])}},d.prototype.onPacket=function(a){if("opening"===this.readyState||"open"===this.readyState||"closing"===this.readyState)switch(h('socket receive: type "%s", data "%s"',a.type,a.data),this.emit("packet",a),this.emit("heartbeat"),a.type){case"open":this.onHandshake(l(a.data));break;case"pong":this.setPing(),this.emit("pong");break;case"error":var b=new Error("server error");b.code=a.data,this.onError(b);break;case"message":this.emit("data",a.data),this.emit("message",a.data)}else h('packet received with socket readyState "%s"',this.readyState)},d.prototype.onHandshake=function(a){this.emit("handshake",a),this.id=a.sid,this.transport.query.sid=a.sid,this.upgrades=this.filterUpgrades(a.upgrades),this.pingInterval=a.pingInterval,this.pingTimeout=a.pingTimeout,this.onOpen(),"closed"!==this.readyState&&(this.setPing(),this.removeListener("heartbeat",this.onHeartbeat),this.on("heartbeat",this.onHeartbeat))},d.prototype.onHeartbeat=function(a){clearTimeout(this.pingTimeoutTimer);var b=this;b.pingTimeoutTimer=setTimeout(function(){"closed"!==b.readyState&&b.onClose("ping timeout")},a||b.pingInterval+b.pingTimeout)},d.prototype.setPing=function(){var a=this;clearTimeout(a.pingIntervalTimer),a.pingIntervalTimer=setTimeout(function(){h("writing ping packet - expecting pong within %sms",a.pingTimeout),a.ping(),a.onHeartbeat(a.pingTimeout)},a.pingInterval)},d.prototype.ping=function(){var a=this;this.sendPacket("ping",function(){a.emit("ping")})},d.prototype.onDrain=function(){this.writeBuffer.splice(0,this.prevBufferLen),this.prevBufferLen=0,0===this.writeBuffer.length?this.emit("drain"):this.flush()},d.prototype.flush=function(){"closed"!==this.readyState&&this.transport.writable&&!this.upgrading&&this.writeBuffer.length&&(h("flushing %d packets in socket",this.writeBuffer.length),this.transport.send(this.writeBuffer),this.prevBufferLen=this.writeBuffer.length,this.emit("flush"))},d.prototype.write=d.prototype.send=function(a,b,c){return this.sendPacket("message",a,b,c),this},d.prototype.sendPacket=function(a,b,c,d){if("function"==typeof b&&(d=b,b=void 0),"function"==typeof c&&(d=c,c=null),"closing"!==this.readyState&&"closed"!==this.readyState){c=c||{},c.compress=!1!==c.compress;var e={type:a,data:b,options:c};this.emit("packetCreate",e),this.writeBuffer.push(e),d&&this.once("flush",d),this.flush()}},d.prototype.close=function(){function a(){d.onClose("forced close"),h("socket closing - telling transport to close"),d.transport.close()}function b(){d.removeListener("upgrade",b),d.removeListener("upgradeError",b),a()}function c(){d.once("upgrade",b),d.once("upgradeError",b)}if("opening"===this.readyState||"open"===this.readyState){this.readyState="closing";var d=this;this.writeBuffer.length?this.once("drain",function(){this.upgrading?c():a()}):this.upgrading?c():a()}return this},d.prototype.onError=function(a){h("socket error %j",a),d.priorWebsocketSuccess=!1,this.emit("error",a),this.onClose("transport error",a)},d.prototype.onClose=function(a,b){if("opening"===this.readyState||"open"===this.readyState||"closing"===this.readyState){h('socket close with reason: "%s"',a);var c=this;clearTimeout(this.pingIntervalTimer),clearTimeout(this.pingTimeoutTimer),this.transport.removeAllListeners("close"),this.transport.close(),this.transport.removeAllListeners(),this.readyState="closed",this.id=null,this.emit("close",a,b),c.writeBuffer=[],c.prevBufferLen=0}},d.prototype.filterUpgrades=function(a){for(var b=[],c=0,d=a.length;c<d;c++)~i(this.transports,a[c])&&b.push(a[c]);return b}}).call(b,function(){return this}())},function(a,b,c){(function(a){function d(b){var c,d=!1,h=!1,i=!1!==b.jsonp;if(a.location){var j="https:"===location.protocol,k=location.port;k||(k=j?443:80),d=b.hostname!==location.hostname||k!==b.port,h=b.secure!==j}if(b.xdomain=d,b.xscheme=h,c=new e(b),"open"in c&&!b.forceJSONP)return new f(b);if(!i)throw new Error("JSONP disabled");return new g(b)}var e=c(18),f=c(20),g=c(34),h=c(35);b.polling=d,b.websocket=h}).call(b,function(){return this}())},function(a,b,c){(function(b){var d=c(19);a.exports=function(a){var c=a.xdomain,e=a.xscheme,f=a.enablesXDR;try{if("undefined"!=typeof XMLHttpRequest&&(!c||d))return new XMLHttpRequest}catch(g){}try{if("undefined"!=typeof XDomainRequest&&!e&&f)return new XDomainRequest}catch(g){}if(!c)try{
+return new(b[["Active"].concat("Object").join("X")])("Microsoft.XMLHTTP")}catch(g){}}}).call(b,function(){return this}())},function(a,b){try{a.exports="undefined"!=typeof XMLHttpRequest&&"withCredentials"in new XMLHttpRequest}catch(c){a.exports=!1}},function(a,b,c){(function(b){function d(){}function e(a){if(i.call(this,a),this.requestTimeout=a.requestTimeout,this.extraHeaders=a.extraHeaders,b.location){var c="https:"===location.protocol,d=location.port;d||(d=c?443:80),this.xd=a.hostname!==b.location.hostname||d!==a.port,this.xs=a.secure!==c}}function f(a){this.method=a.method||"GET",this.uri=a.uri,this.xd=!!a.xd,this.xs=!!a.xs,this.async=!1!==a.async,this.data=void 0!==a.data?a.data:null,this.agent=a.agent,this.isBinary=a.isBinary,this.supportsBinary=a.supportsBinary,this.enablesXDR=a.enablesXDR,this.requestTimeout=a.requestTimeout,this.pfx=a.pfx,this.key=a.key,this.passphrase=a.passphrase,this.cert=a.cert,this.ca=a.ca,this.ciphers=a.ciphers,this.rejectUnauthorized=a.rejectUnauthorized,this.extraHeaders=a.extraHeaders,this.create()}function g(){for(var a in f.requests)f.requests.hasOwnProperty(a)&&f.requests[a].abort()}var h=c(18),i=c(21),j=c(8),k=c(32),l=c(3)("engine.io-client:polling-xhr");a.exports=e,a.exports.Request=f,k(e,i),e.prototype.supportsBinary=!0,e.prototype.request=function(a){return a=a||{},a.uri=this.uri(),a.xd=this.xd,a.xs=this.xs,a.agent=this.agent||!1,a.supportsBinary=this.supportsBinary,a.enablesXDR=this.enablesXDR,a.pfx=this.pfx,a.key=this.key,a.passphrase=this.passphrase,a.cert=this.cert,a.ca=this.ca,a.ciphers=this.ciphers,a.rejectUnauthorized=this.rejectUnauthorized,a.requestTimeout=this.requestTimeout,a.extraHeaders=this.extraHeaders,new f(a)},e.prototype.doWrite=function(a,b){var c="string"!=typeof a&&void 0!==a,d=this.request({method:"POST",data:a,isBinary:c}),e=this;d.on("success",b),d.on("error",function(a){e.onError("xhr post error",a)}),this.sendXhr=d},e.prototype.doPoll=function(){l("xhr poll");var a=this.request(),b=this;a.on("data",function(a){b.onData(a)}),a.on("error",function(a){b.onError("xhr poll error",a)}),this.pollXhr=a},j(f.prototype),f.prototype.create=function(){var a={agent:this.agent,xdomain:this.xd,xscheme:this.xs,enablesXDR:this.enablesXDR};a.pfx=this.pfx,a.key=this.key,a.passphrase=this.passphrase,a.cert=this.cert,a.ca=this.ca,a.ciphers=this.ciphers,a.rejectUnauthorized=this.rejectUnauthorized;var c=this.xhr=new h(a),d=this;try{l("xhr open %s: %s",this.method,this.uri),c.open(this.method,this.uri,this.async);try{if(this.extraHeaders){c.setDisableHeaderCheck&&c.setDisableHeaderCheck(!0);for(var e in this.extraHeaders)this.extraHeaders.hasOwnProperty(e)&&c.setRequestHeader(e,this.extraHeaders[e])}}catch(g){}if("POST"===this.method)try{this.isBinary?c.setRequestHeader("Content-type","application/octet-stream"):c.setRequestHeader("Content-type","text/plain;charset=UTF-8")}catch(g){}try{c.setRequestHeader("Accept","*/*")}catch(g){}"withCredentials"in c&&(c.withCredentials=!0),this.requestTimeout&&(c.timeout=this.requestTimeout),this.hasXDR()?(c.onload=function(){d.onLoad()},c.onerror=function(){d.onError(c.responseText)}):c.onreadystatechange=function(){if(2===c.readyState){var a;try{a=c.getResponseHeader("Content-Type")}catch(b){}"application/octet-stream"===a&&(c.responseType="arraybuffer")}4===c.readyState&&(200===c.status||1223===c.status?d.onLoad():setTimeout(function(){d.onError(c.status)},0))},l("xhr data %s",this.data),c.send(this.data)}catch(g){return void setTimeout(function(){d.onError(g)},0)}b.document&&(this.index=f.requestsCount++,f.requests[this.index]=this)},f.prototype.onSuccess=function(){this.emit("success"),this.cleanup()},f.prototype.onData=function(a){this.emit("data",a),this.onSuccess()},f.prototype.onError=function(a){this.emit("error",a),this.cleanup(!0)},f.prototype.cleanup=function(a){if("undefined"!=typeof this.xhr&&null!==this.xhr){if(this.hasXDR()?this.xhr.onload=this.xhr.onerror=d:this.xhr.onreadystatechange=d,a)try{this.xhr.abort()}catch(c){}b.document&&delete f.requests[this.index],this.xhr=null}},f.prototype.onLoad=function(){var a;try{var b;try{b=this.xhr.getResponseHeader("Content-Type")}catch(c){}a="application/octet-stream"===b?this.xhr.response||this.xhr.responseText:this.xhr.responseText}catch(c){this.onError(c)}null!=a&&this.onData(a)},f.prototype.hasXDR=function(){return"undefined"!=typeof b.XDomainRequest&&!this.xs&&this.enablesXDR},f.prototype.abort=function(){this.cleanup()},f.requestsCount=0,f.requests={},b.document&&(b.attachEvent?b.attachEvent("onunload",g):b.addEventListener&&b.addEventListener("beforeunload",g,!1))}).call(b,function(){return this}())},function(a,b,c){function d(a){var b=a&&a.forceBase64;k&&!b||(this.supportsBinary=!1),e.call(this,a)}var e=c(22),f=c(31),g=c(23),h=c(32),i=c(33),j=c(3)("engine.io-client:polling");a.exports=d;var k=function(){var a=c(18),b=new a({xdomain:!1});return null!=b.responseType}();h(d,e),d.prototype.name="polling",d.prototype.doOpen=function(){this.poll()},d.prototype.pause=function(a){function b(){j("paused"),c.readyState="paused",a()}var c=this;if(this.readyState="pausing",this.polling||!this.writable){var d=0;this.polling&&(j("we are currently polling - waiting to pause"),d++,this.once("pollComplete",function(){j("pre-pause polling complete"),--d||b()})),this.writable||(j("we are currently writing - waiting to pause"),d++,this.once("drain",function(){j("pre-pause writing complete"),--d||b()}))}else b()},d.prototype.poll=function(){j("polling"),this.polling=!0,this.doPoll(),this.emit("poll")},d.prototype.onData=function(a){var b=this;j("polling got data %s",a);var c=function(a,c,d){return"opening"===b.readyState&&b.onOpen(),"close"===a.type?(b.onClose(),!1):void b.onPacket(a)};g.decodePayload(a,this.socket.binaryType,c),"closed"!==this.readyState&&(this.polling=!1,this.emit("pollComplete"),"open"===this.readyState?this.poll():j('ignoring poll - transport state "%s"',this.readyState))},d.prototype.doClose=function(){function a(){j("writing close packet"),b.write([{type:"close"}])}var b=this;"open"===this.readyState?(j("transport open - closing"),a()):(j("transport not open - deferring close"),this.once("open",a))},d.prototype.write=function(a){var b=this;this.writable=!1;var c=function(){b.writable=!0,b.emit("drain")};g.encodePayload(a,this.supportsBinary,function(a){b.doWrite(a,c)})},d.prototype.uri=function(){var a=this.query||{},b=this.secure?"https":"http",c="";!1!==this.timestampRequests&&(a[this.timestampParam]=i()),this.supportsBinary||a.sid||(a.b64=1),a=f.encode(a),this.port&&("https"===b&&443!==Number(this.port)||"http"===b&&80!==Number(this.port))&&(c=":"+this.port),a.length&&(a="?"+a);var d=this.hostname.indexOf(":")!==-1;return b+"://"+(d?"["+this.hostname+"]":this.hostname)+c+this.path+a}},function(a,b,c){function d(a){this.path=a.path,this.hostname=a.hostname,this.port=a.port,this.secure=a.secure,this.query=a.query,this.timestampParam=a.timestampParam,this.timestampRequests=a.timestampRequests,this.readyState="",this.agent=a.agent||!1,this.socket=a.socket,this.enablesXDR=a.enablesXDR,this.pfx=a.pfx,this.key=a.key,this.passphrase=a.passphrase,this.cert=a.cert,this.ca=a.ca,this.ciphers=a.ciphers,this.rejectUnauthorized=a.rejectUnauthorized,this.forceNode=a.forceNode,this.extraHeaders=a.extraHeaders,this.localAddress=a.localAddress}var e=c(23),f=c(8);a.exports=d,f(d.prototype),d.prototype.onError=function(a,b){var c=new Error(a);return c.type="TransportError",c.description=b,this.emit("error",c),this},d.prototype.open=function(){return"closed"!==this.readyState&&""!==this.readyState||(this.readyState="opening",this.doOpen()),this},d.prototype.close=function(){return"opening"!==this.readyState&&"open"!==this.readyState||(this.doClose(),this.onClose()),this},d.prototype.send=function(a){if("open"!==this.readyState)throw new Error("Transport not open");this.write(a)},d.prototype.onOpen=function(){this.readyState="open",this.writable=!0,this.emit("open")},d.prototype.onData=function(a){var b=e.decodePacket(a,this.socket.binaryType);this.onPacket(b)},d.prototype.onPacket=function(a){this.emit("packet",a)},d.prototype.onClose=function(){this.readyState="closed",this.emit("close")}},function(a,b,c){(function(a){function d(a,c){var d="b"+b.packets[a.type]+a.data.data;return c(d)}function e(a,c,d){if(!c)return b.encodeBase64Packet(a,d);var e=a.data,f=new Uint8Array(e),g=new Uint8Array(1+e.byteLength);g[0]=s[a.type];for(var h=0;h<f.length;h++)g[h+1]=f[h];return d(g.buffer)}function f(a,c,d){if(!c)return b.encodeBase64Packet(a,d);var e=new FileReader;return e.onload=function(){a.data=e.result,b.encodePacket(a,c,!0,d)},e.readAsArrayBuffer(a.data)}function g(a,c,d){if(!c)return b.encodeBase64Packet(a,d);if(r)return f(a,c,d);var e=new Uint8Array(1);e[0]=s[a.type];var g=new v([e.buffer,a.data]);return d(g)}function h(a){try{a=o.decode(a,{strict:!1})}catch(b){return!1}return a}function i(a,b,c){for(var d=new Array(a.length),e=n(a.length,c),f=function(a,c,e){b(c,function(b,c){d[a]=c,e(b,d)})},g=0;g<a.length;g++)f(g,a[g],e)}var j,k=c(24),l=c(9),m=c(25),n=c(26),o=c(27);a&&a.ArrayBuffer&&(j=c(29));var p="undefined"!=typeof navigator&&/Android/i.test(navigator.userAgent),q="undefined"!=typeof navigator&&/PhantomJS/i.test(navigator.userAgent),r=p||q;b.protocol=3;var s=b.packets={open:0,close:1,ping:2,pong:3,message:4,upgrade:5,noop:6},t=k(s),u={type:"error",data:"parser error"},v=c(30);b.encodePacket=function(b,c,f,h){"function"==typeof c&&(h=c,c=!1),"function"==typeof f&&(h=f,f=null);var i=void 0===b.data?void 0:b.data.buffer||b.data;if(a.ArrayBuffer&&i instanceof ArrayBuffer)return e(b,c,h);if(v&&i instanceof a.Blob)return g(b,c,h);if(i&&i.base64)return d(b,h);var j=s[b.type];return void 0!==b.data&&(j+=f?o.encode(String(b.data),{strict:!1}):String(b.data)),h(""+j)},b.encodeBase64Packet=function(c,d){var e="b"+b.packets[c.type];if(v&&c.data instanceof a.Blob){var f=new FileReader;return f.onload=function(){var a=f.result.split(",")[1];d(e+a)},f.readAsDataURL(c.data)}var g;try{g=String.fromCharCode.apply(null,new Uint8Array(c.data))}catch(h){for(var i=new Uint8Array(c.data),j=new Array(i.length),k=0;k<i.length;k++)j[k]=i[k];g=String.fromCharCode.apply(null,j)}return e+=a.btoa(g),d(e)},b.decodePacket=function(a,c,d){if(void 0===a)return u;if("string"==typeof a){if("b"===a.charAt(0))return b.decodeBase64Packet(a.substr(1),c);if(d&&(a=h(a),a===!1))return u;var e=a.charAt(0);return Number(e)==e&&t[e]?a.length>1?{type:t[e],data:a.substring(1)}:{type:t[e]}:u}var f=new Uint8Array(a),e=f[0],g=m(a,1);return v&&"blob"===c&&(g=new v([g])),{type:t[e],data:g}},b.decodeBase64Packet=function(a,b){var c=t[a.charAt(0)];if(!j)return{type:c,data:{base64:!0,data:a.substr(1)}};var d=j.decode(a.substr(1));return"blob"===b&&v&&(d=new v([d])),{type:c,data:d}},b.encodePayload=function(a,c,d){function e(a){return a.length+":"+a}function f(a,d){b.encodePacket(a,!!g&&c,!1,function(a){d(null,e(a))})}"function"==typeof c&&(d=c,c=null);var g=l(a);return c&&g?v&&!r?b.encodePayloadAsBlob(a,d):b.encodePayloadAsArrayBuffer(a,d):a.length?void i(a,f,function(a,b){return d(b.join(""))}):d("0:")},b.decodePayload=function(a,c,d){if("string"!=typeof a)return b.decodePayloadAsBinary(a,c,d);"function"==typeof c&&(d=c,c=null);var e;if(""===a)return d(u,0,1);for(var f,g,h="",i=0,j=a.length;i<j;i++){var k=a.charAt(i);if(":"===k){if(""===h||h!=(f=Number(h)))return d(u,0,1);if(g=a.substr(i+1,f),h!=g.length)return d(u,0,1);if(g.length){if(e=b.decodePacket(g,c,!1),u.type===e.type&&u.data===e.data)return d(u,0,1);var l=d(e,i+f,j);if(!1===l)return}i+=f,h=""}else h+=k}return""!==h?d(u,0,1):void 0},b.encodePayloadAsArrayBuffer=function(a,c){function d(a,c){b.encodePacket(a,!0,!0,function(a){return c(null,a)})}return a.length?void i(a,d,function(a,b){var d=b.reduce(function(a,b){var c;return c="string"==typeof b?b.length:b.byteLength,a+c.toString().length+c+2},0),e=new Uint8Array(d),f=0;return b.forEach(function(a){var b="string"==typeof a,c=a;if(b){for(var d=new Uint8Array(a.length),g=0;g<a.length;g++)d[g]=a.charCodeAt(g);c=d.buffer}b?e[f++]=0:e[f++]=1;for(var h=c.byteLength.toString(),g=0;g<h.length;g++)e[f++]=parseInt(h[g]);e[f++]=255;for(var d=new Uint8Array(c),g=0;g<d.length;g++)e[f++]=d[g]}),c(e.buffer)}):c(new ArrayBuffer(0))},b.encodePayloadAsBlob=function(a,c){function d(a,c){b.encodePacket(a,!0,!0,function(a){var b=new Uint8Array(1);if(b[0]=1,"string"==typeof a){for(var d=new Uint8Array(a.length),e=0;e<a.length;e++)d[e]=a.charCodeAt(e);a=d.buffer,b[0]=0}for(var f=a instanceof ArrayBuffer?a.byteLength:a.size,g=f.toString(),h=new Uint8Array(g.length+1),e=0;e<g.length;e++)h[e]=parseInt(g[e]);if(h[g.length]=255,v){var i=new v([b.buffer,h.buffer,a]);c(null,i)}})}i(a,d,function(a,b){return c(new v(b))})},b.decodePayloadAsBinary=function(a,c,d){"function"==typeof c&&(d=c,c=null);for(var e=a,f=[];e.byteLength>0;){for(var g=new Uint8Array(e),h=0===g[0],i="",j=1;255!==g[j];j++){if(i.length>310)return d(u,0,1);i+=g[j]}e=m(e,2+i.length),i=parseInt(i);var k=m(e,0,i);if(h)try{k=String.fromCharCode.apply(null,new Uint8Array(k))}catch(l){var n=new Uint8Array(k);k="";for(var j=0;j<n.length;j++)k+=String.fromCharCode(n[j])}f.push(k),e=m(e,i)}var o=f.length;f.forEach(function(a,e){d(b.decodePacket(a,c,!0),e,o)})}}).call(b,function(){return this}())},function(a,b){a.exports=Object.keys||function(a){var b=[],c=Object.prototype.hasOwnProperty;for(var d in a)c.call(a,d)&&b.push(d);return b}},function(a,b){a.exports=function(a,b,c){var d=a.byteLength;if(b=b||0,c=c||d,a.slice)return a.slice(b,c);if(b<0&&(b+=d),c<0&&(c+=d),c>d&&(c=d),b>=d||b>=c||0===d)return new ArrayBuffer(0);for(var e=new Uint8Array(a),f=new Uint8Array(c-b),g=b,h=0;g<c;g++,h++)f[h]=e[g];return f.buffer}},function(a,b){function c(a,b,c){function e(a,d){if(e.count<=0)throw new Error("after called too many times");--e.count,a?(f=!0,b(a),b=c):0!==e.count||f||b(null,d)}var f=!1;return c=c||d,e.count=a,0===a?b():e}function d(){}a.exports=c},function(a,b,c){var d;(function(a,e){!function(f){function g(a){for(var b,c,d=[],e=0,f=a.length;e<f;)b=a.charCodeAt(e++),b>=55296&&b<=56319&&e<f?(c=a.charCodeAt(e++),56320==(64512&c)?d.push(((1023&b)<<10)+(1023&c)+65536):(d.push(b),e--)):d.push(b);return d}function h(a){for(var b,c=a.length,d=-1,e="";++d<c;)b=a[d],b>65535&&(b-=65536,e+=u(b>>>10&1023|55296),b=56320|1023&b),e+=u(b);return e}function i(a,b){if(a>=55296&&a<=57343){if(b)throw Error("Lone surrogate U+"+a.toString(16).toUpperCase()+" is not a scalar value");return!1}return!0}function j(a,b){return u(a>>b&63|128)}function k(a,b){if(0==(4294967168&a))return u(a);var c="";return 0==(4294965248&a)?c=u(a>>6&31|192):0==(4294901760&a)?(i(a,b)||(a=65533),c=u(a>>12&15|224),c+=j(a,6)):0==(4292870144&a)&&(c=u(a>>18&7|240),c+=j(a,12),c+=j(a,6)),c+=u(63&a|128)}function l(a,b){b=b||{};for(var c,d=!1!==b.strict,e=g(a),f=e.length,h=-1,i="";++h<f;)c=e[h],i+=k(c,d);return i}function m(){if(t>=s)throw Error("Invalid byte index");var a=255&r[t];if(t++,128==(192&a))return 63&a;throw Error("Invalid continuation byte")}function n(a){var b,c,d,e,f;if(t>s)throw Error("Invalid byte index");if(t==s)return!1;if(b=255&r[t],t++,0==(128&b))return b;if(192==(224&b)){if(c=m(),f=(31&b)<<6|c,f>=128)return f;throw Error("Invalid continuation byte")}if(224==(240&b)){if(c=m(),d=m(),f=(15&b)<<12|c<<6|d,f>=2048)return i(f,a)?f:65533;throw Error("Invalid continuation byte")}if(240==(248&b)&&(c=m(),d=m(),e=m(),f=(7&b)<<18|c<<12|d<<6|e,f>=65536&&f<=1114111))return f;throw Error("Invalid UTF-8 detected")}function o(a,b){b=b||{};var c=!1!==b.strict;r=g(a),s=r.length,t=0;for(var d,e=[];(d=n(c))!==!1;)e.push(d);return h(e)}var p="object"==typeof b&&b,q=("object"==typeof a&&a&&a.exports==p&&a,"object"==typeof e&&e);q.global!==q&&q.window!==q||(f=q);var r,s,t,u=String.fromCharCode,v={version:"2.1.2",encode:l,decode:o};d=function(){return v}.call(b,c,b,a),!(void 0!==d&&(a.exports=d))}(this)}).call(b,c(28)(a),function(){return this}())},function(a,b){a.exports=function(a){return a.webpackPolyfill||(a.deprecate=function(){},a.paths=[],a.children=[],a.webpackPolyfill=1),a}},function(a,b){!function(){"use strict";for(var a="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/",c=new Uint8Array(256),d=0;d<a.length;d++)c[a.charCodeAt(d)]=d;b.encode=function(b){var c,d=new Uint8Array(b),e=d.length,f="";for(c=0;c<e;c+=3)f+=a[d[c]>>2],f+=a[(3&d[c])<<4|d[c+1]>>4],f+=a[(15&d[c+1])<<2|d[c+2]>>6],f+=a[63&d[c+2]];return e%3===2?f=f.substring(0,f.length-1)+"=":e%3===1&&(f=f.substring(0,f.length-2)+"=="),f},b.decode=function(a){var b,d,e,f,g,h=.75*a.length,i=a.length,j=0;"="===a[a.length-1]&&(h--,"="===a[a.length-2]&&h--);var k=new ArrayBuffer(h),l=new Uint8Array(k);for(b=0;b<i;b+=4)d=c[a.charCodeAt(b)],e=c[a.charCodeAt(b+1)],f=c[a.charCodeAt(b+2)],g=c[a.charCodeAt(b+3)],l[j++]=d<<2|e>>4,l[j++]=(15&e)<<4|f>>2,l[j++]=(3&f)<<6|63&g;return k}}()},function(a,b){(function(b){function c(a){for(var b=0;b<a.length;b++){var c=a[b];if(c.buffer instanceof ArrayBuffer){var d=c.buffer;if(c.byteLength!==d.byteLength){var e=new Uint8Array(c.byteLength);e.set(new Uint8Array(d,c.byteOffset,c.byteLength)),d=e.buffer}a[b]=d}}}function d(a,b){b=b||{};var d=new f;c(a);for(var e=0;e<a.length;e++)d.append(a[e]);return b.type?d.getBlob(b.type):d.getBlob()}function e(a,b){return c(a),new Blob(a,b||{})}var f=b.BlobBuilder||b.WebKitBlobBuilder||b.MSBlobBuilder||b.MozBlobBuilder,g=function(){try{var a=new Blob(["hi"]);return 2===a.size}catch(b){return!1}}(),h=g&&function(){try{var a=new Blob([new Uint8Array([1,2])]);return 2===a.size}catch(b){return!1}}(),i=f&&f.prototype.append&&f.prototype.getBlob;a.exports=function(){return g?h?b.Blob:e:i?d:void 0}()}).call(b,function(){return this}())},function(a,b){b.encode=function(a){var b="";for(var c in a)a.hasOwnProperty(c)&&(b.length&&(b+="&"),b+=encodeURIComponent(c)+"="+encodeURIComponent(a[c]));return b},b.decode=function(a){for(var b={},c=a.split("&"),d=0,e=c.length;d<e;d++){var f=c[d].split("=");b[decodeURIComponent(f[0])]=decodeURIComponent(f[1])}return b}},function(a,b){a.exports=function(a,b){var c=function(){};c.prototype=b.prototype,a.prototype=new c,a.prototype.constructor=a}},function(a,b){"use strict";function c(a){var b="";do b=g[a%h]+b,a=Math.floor(a/h);while(a>0);return b}function d(a){var b=0;for(k=0;k<a.length;k++)b=b*h+i[a.charAt(k)];return b}function e(){var a=c(+new Date);return a!==f?(j=0,f=a):a+"."+c(j++)}for(var f,g="0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz-_".split(""),h=64,i={},j=0,k=0;k<h;k++)i[g[k]]=k;e.encode=c,e.decode=d,a.exports=e},function(a,b,c){(function(b){function d(){}function e(a){f.call(this,a),this.query=this.query||{},h||(b.___eio||(b.___eio=[]),h=b.___eio),this.index=h.length;var c=this;h.push(function(a){c.onData(a)}),this.query.j=this.index,b.document&&b.addEventListener&&b.addEventListener("beforeunload",function(){c.script&&(c.script.onerror=d)},!1)}var f=c(21),g=c(32);a.exports=e;var h,i=/\n/g,j=/\\n/g;g(e,f),e.prototype.supportsBinary=!1,e.prototype.doClose=function(){this.script&&(this.script.parentNode.removeChild(this.script),this.script=null),this.form&&(this.form.parentNode.removeChild(this.form),this.form=null,this.iframe=null),f.prototype.doClose.call(this)},e.prototype.doPoll=function(){var a=this,b=document.createElement("script");this.script&&(this.script.parentNode.removeChild(this.script),this.script=null),b.async=!0,b.src=this.uri(),b.onerror=function(b){a.onError("jsonp poll error",b)};var c=document.getElementsByTagName("script")[0];c?c.parentNode.insertBefore(b,c):(document.head||document.body).appendChild(b),this.script=b;var d="undefined"!=typeof navigator&&/gecko/i.test(navigator.userAgent);d&&setTimeout(function(){var a=document.createElement("iframe");document.body.appendChild(a),document.body.removeChild(a)},100)},e.prototype.doWrite=function(a,b){function c(){d(),b()}function d(){if(e.iframe)try{e.form.removeChild(e.iframe)}catch(a){e.onError("jsonp polling iframe removal error",a)}try{var b='<iframe src="javascript:0" name="'+e.iframeId+'">';f=document.createElement(b)}catch(a){f=document.createElement("iframe"),f.name=e.iframeId,f.src="javascript:0"}f.id=e.iframeId,e.form.appendChild(f),e.iframe=f}var e=this;if(!this.form){var f,g=document.createElement("form"),h=document.createElement("textarea"),k=this.iframeId="eio_iframe_"+this.index;g.className="socketio",g.style.position="absolute",g.style.top="-1000px",g.style.left="-1000px",g.target=k,g.method="POST",g.setAttribute("accept-charset","utf-8"),h.name="d",g.appendChild(h),document.body.appendChild(g),this.form=g,this.area=h}this.form.action=this.uri(),d(),a=a.replace(j,"\\\n"),this.area.value=a.replace(i,"\\n");try{this.form.submit()}catch(l){}this.iframe.attachEvent?this.iframe.onreadystatechange=function(){"complete"===e.iframe.readyState&&c()}:this.iframe.onload=c}}).call(b,function(){return this}())},function(a,b,c){(function(b){function d(a){var b=a&&a.forceBase64;b&&(this.supportsBinary=!1),this.perMessageDeflate=a.perMessageDeflate,this.usingBrowserWebSocket=l&&!a.forceNode,this.protocols=a.protocols,this.usingBrowserWebSocket||(n=e),f.call(this,a)}var e,f=c(22),g=c(23),h=c(31),i=c(32),j=c(33),k=c(3)("engine.io-client:websocket"),l=b.WebSocket||b.MozWebSocket;if("undefined"==typeof window)try{e=c(36)}catch(m){}var n=l;n||"undefined"!=typeof window||(n=e),a.exports=d,i(d,f),d.prototype.name="websocket",d.prototype.supportsBinary=!0,d.prototype.doOpen=function(){if(this.check()){var a=this.uri(),b=this.protocols,c={agent:this.agent,perMessageDeflate:this.perMessageDeflate};c.pfx=this.pfx,c.key=this.key,c.passphrase=this.passphrase,c.cert=this.cert,c.ca=this.ca,c.ciphers=this.ciphers,c.rejectUnauthorized=this.rejectUnauthorized,this.extraHeaders&&(c.headers=this.extraHeaders),this.localAddress&&(c.localAddress=this.localAddress);try{this.ws=this.usingBrowserWebSocket?b?new n(a,b):new n(a):new n(a,b,c)}catch(d){return this.emit("error",d)}void 0===this.ws.binaryType&&(this.supportsBinary=!1),this.ws.supports&&this.ws.supports.binary?(this.supportsBinary=!0,this.ws.binaryType="nodebuffer"):this.ws.binaryType="arraybuffer",this.addEventListeners()}},d.prototype.addEventListeners=function(){var a=this;this.ws.onopen=function(){a.onOpen()},this.ws.onclose=function(){a.onClose()},this.ws.onmessage=function(b){a.onData(b.data)},this.ws.onerror=function(b){a.onError("websocket error",b)}},d.prototype.write=function(a){function c(){d.emit("flush"),setTimeout(function(){d.writable=!0,d.emit("drain")},0)}var d=this;this.writable=!1;for(var e=a.length,f=0,h=e;f<h;f++)!function(a){g.encodePacket(a,d.supportsBinary,function(f){if(!d.usingBrowserWebSocket){var g={};if(a.options&&(g.compress=a.options.compress),d.perMessageDeflate){var h="string"==typeof f?b.Buffer.byteLength(f):f.length;h<d.perMessageDeflate.threshold&&(g.compress=!1)}}try{d.usingBrowserWebSocket?d.ws.send(f):d.ws.send(f,g)}catch(i){k("websocket closed before onclose event")}--e||c()})}(a[f])},d.prototype.onClose=function(){f.prototype.onClose.call(this)},d.prototype.doClose=function(){"undefined"!=typeof this.ws&&this.ws.close()},d.prototype.uri=function(){var a=this.query||{},b=this.secure?"wss":"ws",c="";this.port&&("wss"===b&&443!==Number(this.port)||"ws"===b&&80!==Number(this.port))&&(c=":"+this.port),this.timestampRequests&&(a[this.timestampParam]=j()),this.supportsBinary||(a.b64=1),a=h.encode(a),a.length&&(a="?"+a);var d=this.hostname.indexOf(":")!==-1;return b+"://"+(d?"["+this.hostname+"]":this.hostname)+c+this.path+a},d.prototype.check=function(){return!(!n||"__initialize"in n&&this.name===d.prototype.name)}}).call(b,function(){return this}())},function(a,b){},function(a,b){var c=[].indexOf;a.exports=function(a,b){if(c)return a.indexOf(b);for(var d=0;d<a.length;++d)if(a[d]===b)return d;return-1}},function(a,b){(function(b){var c=/^[\],:{}\s]*$/,d=/\\(?:["\\\/bfnrt]|u[0-9a-fA-F]{4})/g,e=/"[^"\\\n\r]*"|true|false|null|-?\d+(?:\.\d*)?(?:[eE][+\-]?\d+)?/g,f=/(?:^|:|,)(?:\s*\[)+/g,g=/^\s+/,h=/\s+$/;a.exports=function(a){return"string"==typeof a&&a?(a=a.replace(g,"").replace(h,""),b.JSON&&JSON.parse?JSON.parse(a):c.test(a.replace(d,"@").replace(e,"]").replace(f,""))?new Function("return "+a)():void 0):null}}).call(b,function(){return this}())},function(a,b,c){"use strict";function d(a,b,c){this.io=a,this.nsp=b,this.json=this,this.ids=0,this.acks={},this.receiveBuffer=[],this.sendBuffer=[],this.connected=!1,this.disconnected=!0,c&&c.query&&(this.query=c.query),this.io.autoConnect&&this.open()}var e="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(a){return typeof a}:function(a){return a&&"function"==typeof Symbol&&a.constructor===Symbol&&a!==Symbol.prototype?"symbol":typeof a},f=c(7),g=c(8),h=c(40),i=c(41),j=c(42),k=c(3)("socket.io-client:socket"),l=c(31);a.exports=b=d;var m={connect:1,connect_error:1,connect_timeout:1,connecting:1,disconnect:1,error:1,reconnect:1,reconnect_attempt:1,reconnect_failed:1,reconnect_error:1,reconnecting:1,ping:1,pong:1},n=g.prototype.emit;g(d.prototype),d.prototype.subEvents=function(){if(!this.subs){var a=this.io;this.subs=[i(a,"open",j(this,"onopen")),i(a,"packet",j(this,"onpacket")),i(a,"close",j(this,"onclose"))]}},d.prototype.open=d.prototype.connect=function(){return this.connected?this:(this.subEvents(),this.io.open(),"open"===this.io.readyState&&this.onopen(),this.emit("connecting"),this)},d.prototype.send=function(){var a=h(arguments);return a.unshift("message"),this.emit.apply(this,a),this},d.prototype.emit=function(a){if(m.hasOwnProperty(a))return n.apply(this,arguments),this;var b=h(arguments),c={type:f.EVENT,data:b};return c.options={},c.options.compress=!this.flags||!1!==this.flags.compress,"function"==typeof b[b.length-1]&&(k("emitting packet with ack id %d",this.ids),this.acks[this.ids]=b.pop(),c.id=this.ids++),this.connected?this.packet(c):this.sendBuffer.push(c),delete this.flags,this},d.prototype.packet=function(a){a.nsp=this.nsp,this.io.packet(a)},d.prototype.onopen=function(){if(k("transport is open - connecting"),"/"!==this.nsp)if(this.query){var a="object"===e(this.query)?l.encode(this.query):this.query;k("sending connect packet with query %s",a),this.packet({type:f.CONNECT,query:a})}else this.packet({type:f.CONNECT})},d.prototype.onclose=function(a){k("close (%s)",a),this.connected=!1,this.disconnected=!0,delete this.id,this.emit("disconnect",a)},d.prototype.onpacket=function(a){if(a.nsp===this.nsp)switch(a.type){case f.CONNECT:this.onconnect();break;case f.EVENT:this.onevent(a);break;case f.BINARY_EVENT:this.onevent(a);break;case f.ACK:this.onack(a);break;case f.BINARY_ACK:this.onack(a);break;case f.DISCONNECT:this.ondisconnect();break;case f.ERROR:this.emit("error",a.data)}},d.prototype.onevent=function(a){var b=a.data||[];k("emitting event %j",b),null!=a.id&&(k("attaching ack callback to event"),b.push(this.ack(a.id))),this.connected?n.apply(this,b):this.receiveBuffer.push(b)},d.prototype.ack=function(a){var b=this,c=!1;return function(){if(!c){c=!0;var d=h(arguments);k("sending ack %j",d),b.packet({type:f.ACK,id:a,data:d})}}},d.prototype.onack=function(a){var b=this.acks[a.id];"function"==typeof b?(k("calling ack %s with %j",a.id,a.data),b.apply(this,a.data),delete this.acks[a.id]):k("bad ack %s",a.id)},d.prototype.onconnect=function(){this.connected=!0,this.disconnected=!1,this.emit("connect"),this.emitBuffered()},d.prototype.emitBuffered=function(){var a;for(a=0;a<this.receiveBuffer.length;a++)n.apply(this,this.receiveBuffer[a]);for(this.receiveBuffer=[],a=0;a<this.sendBuffer.length;a++)this.packet(this.sendBuffer[a]);this.sendBuffer=[]},d.prototype.ondisconnect=function(){k("server disconnect (%s)",this.nsp),this.destroy(),this.onclose("io server disconnect")},d.prototype.destroy=function(){if(this.subs){for(var a=0;a<this.subs.length;a++)this.subs[a].destroy();this.subs=null}this.io.destroy(this)},d.prototype.close=d.prototype.disconnect=function(){return this.connected&&(k("performing disconnect (%s)",this.nsp),this.packet({type:f.DISCONNECT})),this.destroy(),this.connected&&this.onclose("io client disconnect"),this},d.prototype.compress=function(a){return this.flags=this.flags||{},this.flags.compress=a,this}},function(a,b){function c(a,b){var c=[];b=b||0;for(var d=b||0;d<a.length;d++)c[d-b]=a[d];return c}a.exports=c},function(a,b){"use strict";function c(a,b,c){return a.on(b,c),{destroy:function(){a.removeListener(b,c)}}}a.exports=c},function(a,b){var c=[].slice;a.exports=function(a,b){if("string"==typeof b&&(b=a[b]),"function"!=typeof b)throw new Error("bind() requires a function");var d=c.call(arguments,2);return function(){return b.apply(a,d.concat(c.call(arguments)))}}},function(a,b){function c(a){a=a||{},this.ms=a.min||100,this.max=a.max||1e4,this.factor=a.factor||2,this.jitter=a.jitter>0&&a.jitter<=1?a.jitter:0,this.attempts=0}a.exports=c,c.prototype.duration=function(){var a=this.ms*Math.pow(this.factor,this.attempts++);if(this.jitter){var b=Math.random(),c=Math.floor(b*this.jitter*a);a=0==(1&Math.floor(10*b))?a-c:a+c}return 0|Math.min(a,this.max)},c.prototype.reset=function(){this.attempts=0},c.prototype.setMin=function(a){this.ms=a},c.prototype.setMax=function(a){this.max=a},c.prototype.setJitter=function(a){this.jitter=a}}])});;
+
+//////////////////////////////////////////////////////////////////////////////////////
+ //                                                                                //
+ //  ███████╗ █████╗ ██╗██╗     ███████╗   ██╗ ██████╗         ██╗███████╗         //
+ //  ██╔════╝██╔══██╗██║██║     ██╔════╝   ██║██╔═══██╗        ██║██╔════╝         //
+ //  ███████╗███████║██║██║     ███████╗   ██║██║   ██║        ██║███████╗         //
+ //  ╚════██║██╔══██║██║██║     ╚════██║   ██║██║   ██║   ██   ██║╚════██║         //
+ //  ███████║██║  ██║██║███████╗███████║██╗██║╚██████╔╝██╗╚█████╔╝███████║         //
+ //  ╚══════╝╚═╝  ╚═╝╚═╝╚══════╝╚══════╝╚═╝╚═╝ ╚═════╝ ╚═╝ ╚════╝ ╚══════╝         //
+ //                                                                                //
+ //   ╦╔═╗╦  ╦╔═╗╔═╗╔═╗╦═╗╦╔═╗╔╦╗  ╔═╗╦  ╦╔═╗╔╗╔╔╦╗  ╔═╗╔╦╗╦╔═                     //
+ //   ║╠═╣╚╗╔╝╠═╣╚═╗║  ╠╦╝║╠═╝ ║   ║  ║  ║║╣ ║║║ ║   ╚═╗ ║║╠╩╗                     //
+ //  ╚╝╩ ╩ ╚╝ ╩ ╩╚═╝╚═╝╩╚═╩╩   ╩   ╚═╝╩═╝╩╚═╝╝╚╝ ╩   ╚═╝═╩╝╩ ╩                     //
+ //  ┌─┐┌─┐┬─┐  ┌┐┌┌─┐┌┬┐┌─┐  ┬┌─┐  ┌─┐┌┐┌┌┬┐  ┌┬┐┬ ┬┌─┐  ┌┐ ┬─┐┌─┐┬ ┬┌─┐┌─┐┬─┐    //
+ //  ├┤ │ │├┬┘  ││││ │ ││├┤   │└─┐  ├─┤│││ ││   │ ├─┤├┤   ├┴┐├┬┘│ ││││└─┐├┤ ├┬┘    //
+ //  └  └─┘┴└─  ┘└┘└─┘─┴┘└─┘o└┘└─┘  ┴ ┴┘└┘─┴┘   ┴ ┴ ┴└─┘  └─┘┴└─└─┘└┴┘└─┘└─┘┴└─    //
+ //                                                                                //
+//////////////////////////////////////////////////////////////////////////////////////
+
+/**
+ * sails.io.js
+ * v1.2.1
+ * ------------------------------------------------------------------------
+ * JavaScript Client (SDK) for communicating with Sails.
+ *
+ * Note that this script is completely optional, but it is handy if you're
+ * using WebSockets from the browser to talk to your Sails server.
+ *
+ * For tips and documentation, visit:
+ * http://sailsjs.com/documentation/reference/web-sockets/socket-client
+ * ------------------------------------------------------------------------
+ *
+ * This file allows you to send and receive socket.io messages to & from Sails
+ * by simulating a REST client interface on top of socket.io. It models its API
+ * after the $.ajax pattern from jQuery you might already be familiar with.
+ *
+ * So if you're switching from using AJAX to sockets, instead of:
+ *    `$.post( url, [data], [cb] )`
+ *
+ * You would use:
+ *    `socket.post( url, [data], [cb] )`
+ */
+
+
+(function() {
+
+
+  //   ██████╗ ██████╗ ███╗   ██╗███████╗████████╗ █████╗ ███╗   ██╗████████╗███████╗
+  //  ██╔════╝██╔═══██╗████╗  ██║██╔════╝╚══██╔══╝██╔══██╗████╗  ██║╚══██╔══╝██╔════╝
+  //  ██║     ██║   ██║██╔██╗ ██║███████╗   ██║   ███████║██╔██╗ ██║   ██║   ███████╗
+  //  ██║     ██║   ██║██║╚██╗██║╚════██║   ██║   ██╔══██║██║╚██╗██║   ██║   ╚════██║
+  //  ╚██████╗╚██████╔╝██║ ╚████║███████║   ██║   ██║  ██║██║ ╚████║   ██║   ███████║
+  //   ╚═════╝ ╚═════╝ ╚═╝  ╚═══╝╚══════╝   ╚═╝   ╚═╝  ╚═╝╚═╝  ╚═══╝   ╚═╝   ╚══════╝
+  //
+
+
+  /**
+   * Constant containing the names of all available options
+   * for individual sockets.
+   *
+   * @type {Array}
+   */
+  var SOCKET_OPTIONS = [
+    'useCORSRouteToGetCookie',
+    'url',
+    'multiplex',
+    'transports',
+    'query',
+    'path',
+    'headers',
+    'initialConnectionHeaders',
+    'reconnection',
+    'reconnectionAttempts',
+    'reconnectionDelay',
+    'reconnectionDelayMax',
+    'rejectUnauthorized',
+    'randomizationFactor',
+    'timeout'
+  ];
+
+
+  /**
+   * Constant containing the names of properties on `io.sails` which
+   * may be configured using HTML attributes on the script tag which
+   * loaded this file.
+   *
+   * @type {Array}
+   *
+   * (this is unused if loading from node.js)
+   */
+  var CONFIGURABLE_VIA_HTML_ATTR = [
+    'autoConnect',
+    'reconnection',
+    'environment',
+    'headers',
+    'url',
+    'transports',
+    'path'
+  ];
+
+
+
+
+  /**
+   * Constant containing the names of querystring
+   * parameters sent when connecting any SailsSocket.
+   *
+   * @type {Dictionary}
+   */
+  var CONNECTION_METADATA_PARAMS = {
+    version: '__sails_io_sdk_version',
+    platform: '__sails_io_sdk_platform',
+    language: '__sails_io_sdk_language'
+  };
+
+
+  /**
+   * Constant containing metadata about the platform, language, and
+   * current version of this SDK.
+   *
+   * @type {Dictionary}
+   */
+  var SDK_INFO = {
+    version: '1.2.1', // <-- pulled automatically from package.json, do not change!
+    language: 'javascript',
+    platform: (function (){
+      if (typeof module === 'object' && typeof module.exports !== 'undefined') {
+        return 'node';
+      }
+      else {
+        return 'browser';
+      }
+    })()
+  };
+
+  // Build `versionString` (a querystring snippet) by
+  // combining SDK_INFO and CONNECTION_METADATA_PARAMS.
+  SDK_INFO.versionString =
+    CONNECTION_METADATA_PARAMS.version + '=' + SDK_INFO.version + '&' +
+    CONNECTION_METADATA_PARAMS.platform + '=' + SDK_INFO.platform + '&' +
+    CONNECTION_METADATA_PARAMS.language + '=' + SDK_INFO.language;
+
+
+
+
+  //   █████╗ ██████╗ ███████╗ ██████╗ ██████╗ ██████╗     ██╗  ██╗████████╗███╗   ███╗██╗
+  //  ██╔══██╗██╔══██╗██╔════╝██╔═══██╗██╔══██╗██╔══██╗    ██║  ██║╚══██╔══╝████╗ ████║██║
+  //  ███████║██████╔╝███████╗██║   ██║██████╔╝██████╔╝    ███████║   ██║   ██╔████╔██║██║
+  //  ██╔══██║██╔══██╗╚════██║██║   ██║██╔══██╗██╔══██╗    ██╔══██║   ██║   ██║╚██╔╝██║██║
+  //  ██║  ██║██████╔╝███████║╚██████╔╝██║  ██║██████╔╝    ██║  ██║   ██║   ██║ ╚═╝ ██║███████╗
+  //  ╚═╝  ╚═╝╚═════╝ ╚══════╝ ╚═════╝ ╚═╝  ╚═╝╚═════╝     ╚═╝  ╚═╝   ╚═╝   ╚═╝     ╚═╝╚══════╝
+  //
+  //   █████╗ ████████╗████████╗██████╗ ██╗██████╗ ██╗   ██╗████████╗███████╗███████╗
+  //  ██╔══██╗╚══██╔══╝╚══██╔══╝██╔══██╗██║██╔══██╗██║   ██║╚══██╔══╝██╔════╝██╔════╝
+  //  ███████║   ██║      ██║   ██████╔╝██║██████╔╝██║   ██║   ██║   █████╗  ███████╗
+  //  ██╔══██║   ██║      ██║   ██╔══██╗██║██╔══██╗██║   ██║   ██║   ██╔══╝  ╚════██║
+  //  ██║  ██║   ██║      ██║   ██║  ██║██║██████╔╝╚██████╔╝   ██║   ███████╗███████║
+  //  ╚═╝  ╚═╝   ╚═╝      ╚═╝   ╚═╝  ╚═╝╚═╝╚═════╝  ╚═════╝    ╚═╝   ╚══════╝╚══════╝
+  //
+  //  ███████╗██████╗  ██████╗ ███╗   ███╗      ██╗███████╗ ██████╗██████╗ ██╗██████╗ ████████╗██╗
+  //  ██╔════╝██╔══██╗██╔═══██╗████╗ ████║     ██╔╝██╔════╝██╔════╝██╔══██╗██║██╔══██╗╚══██╔══╝╚██╗
+  //  █████╗  ██████╔╝██║   ██║██╔████╔██║    ██╔╝ ███████╗██║     ██████╔╝██║██████╔╝   ██║    ╚██╗
+  //  ██╔══╝  ██╔══██╗██║   ██║██║╚██╔╝██║    ╚██╗ ╚════██║██║     ██╔══██╗██║██╔═══╝    ██║    ██╔╝
+  //  ██║     ██║  ██║╚██████╔╝██║ ╚═╝ ██║     ╚██╗███████║╚██████╗██║  ██║██║██║        ██║   ██╔╝
+  //  ╚═╝     ╚═╝  ╚═╝ ╚═════╝ ╚═╝     ╚═╝      ╚═╝╚══════╝ ╚═════╝╚═╝  ╚═╝╚═╝╚═╝        ╚═╝   ╚═╝
+  //
+  //
+  // If available, grab the DOM element for the script tag which imported this file.
+  // (skip this if this SDK is being used outside of the DOM, i.e. in a Node process)
+  //
+  // This is used below to parse client-side sails.io.js configuration encoded as
+  // HTML attributes, as well as grabbing hold of the URL from whence the SDK was fetched.
+  var thisScriptTag = (function() {
+    if (
+      typeof window !== 'object' ||
+      typeof window.document !== 'object' ||
+      typeof window.document.getElementsByTagName !== 'function'
+    ) {
+      return null;
+    }
+
+    // Return the URL of the last script loaded (i.e. this one)
+    // (this must run before nextTick; see http://stackoverflow.com/a/2976714/486547)
+    var allScriptsCurrentlyInDOM = window.document.getElementsByTagName('script');
+    return allScriptsCurrentlyInDOM[allScriptsCurrentlyInDOM.length - 1];
+  })();
+
+
+  // Variables to contain src URL and other script tag config (for use below).
+  var urlThisScriptWasFetchedFrom = '';
+  var scriptTagConfig = {};
+
+
+  if (thisScriptTag) {
+    // Save the URL that this script was fetched from.
+    urlThisScriptWasFetchedFrom = thisScriptTag.src;
+
+    // Now parse the most common client-side configuration settings
+    // from the script tag where they may be encoded as HTML attributes.
+    //
+    // Any configuration which may be provided as an HTML attribute may
+    // also be provided prefixed with `data-`.  This is for folks who
+    // need to support browsers that have issues with nonstandard
+    // HTML attributes (or if the idea of using nonstandard HTML attributes
+    // just creeps you out)
+    //
+    // If a `data-` prefixed attr is provided, it takes precedence.
+    // (this is so that if you are already using one of these HTML
+    //  attrs for some reason, you can keep it as-is and override
+    //  it using `data-`. If you are using the `data-` prefixed version
+    //  for some other purpose... well, in that case you'll just have to
+    //  configure programmatically using `io.sails` instead.)
+    CONFIGURABLE_VIA_HTML_ATTR.forEach(function (configKey){
+
+      scriptTagConfig[configKey] = (function (){
+
+        // Support 'data-' prefixed or normal attributes.
+        // (prefixed versions take precedence if provided)
+        var htmlAttrVal = thisScriptTag.getAttribute( 'data-'+configKey );
+        if (!htmlAttrVal) {
+          htmlAttrVal = thisScriptTag.getAttribute( configKey );
+        }
+
+        // The HTML attribute value should always be a string or `null`.
+        // We'll try to parse it as JSON and use that, but worst case fall back
+        // to the default situation of it being a string.
+        if (typeof htmlAttrVal === 'string') {
+          try { return JSON.parse(htmlAttrVal); } catch (e) { return htmlAttrVal; }
+        }
+        // If `null` was returned from getAttribute(), it means that the HTML attribute
+        // was not specified, so we treat it as undefined (which will cause the property
+        // to be removed below)
+        else if (htmlAttrVal === null) {
+          return undefined;
+        }
+        // Any other contingency shouldn't be possible:
+        // - if no quotes are used in the HTML attribute, it still comes in as a string.
+        // - if no RHS is provided for the attribute, it still comes in as "" (empty string)
+        // (but we still handle this with an explicit error just in case--for debugging and support purposes)
+        else throw new Error('sails.io.js :: Unexpected/invalid script tag configuration for `'+configKey+'`: `'+htmlAttrVal+'` (a `'+typeof htmlAttrVal+'`). Should be a string.');
+      })();
+
+      if (scriptTagConfig[configKey] === undefined){
+        delete scriptTagConfig[configKey];
+      }
+    });
+
+
+
+    // Now that they've been parsed, do an extremely lean version of
+    // logical type validation/coercion of provided values.
+    //////////////////////////////////////////////////////////////////
+
+    // `autoConnect`
+    if (typeof scriptTagConfig.autoConnect !== 'undefined') {
+      if (scriptTagConfig.autoConnect === '') {
+        // Special case for empty string.  It means `true` (see above).
+        scriptTagConfig.autoConnect = true;
+      }
+      else if (typeof scriptTagConfig.autoConnect !== 'boolean') {
+        throw new Error('sails.io.js :: Unexpected/invalid configuration for `autoConnect` provided in script tag: `'+scriptTagConfig.autoConnect+'` (a `'+typeof scriptTagConfig.autoConnect+'`). Should be a boolean.');
+      }
+    }
+
+
+    // `environment`
+    if (typeof scriptTagConfig.environment !== 'undefined') {
+      if (typeof scriptTagConfig.environment !== 'string') {
+        throw new Error('sails.io.js :: Unexpected/invalid configuration for `environment` provided in script tag: `'+scriptTagConfig.environment+'` (a `'+typeof scriptTagConfig.environment+'`). Should be a string.');
+      }
+    }
+
+
+    // `headers`
+    if (typeof scriptTagConfig.headers !== 'undefined') {
+      if (typeof scriptTagConfig.headers !== 'object' || Array.isArray(scriptTagConfig.headers)) {
+        throw new Error('sails.io.js :: Unexpected/invalid configuration for `headers` provided in script tag: `'+scriptTagConfig.headers+'` (a `'+typeof scriptTagConfig.headers+'`). Should be a JSON-compatible dictionary (i.e. `{}`).  Don\'t forget those double quotes (""), even on key names!  Use single quotes (\'\') to wrap the HTML attribute value; e.g. `headers=\'{"X-Auth": "foo"}\'`');
+      }
+    }
+
+
+    // `url`
+    if (typeof scriptTagConfig.url !== 'undefined') {
+      if (typeof scriptTagConfig.url !== 'string') {
+        throw new Error('sails.io.js :: Unexpected/invalid configuration for `url` provided in script tag: `'+scriptTagConfig.url+'` (a `'+typeof scriptTagConfig.url+'`). Should be a string.');
+      }
+    }
+
+    // OTHER `io.sails` options are NOT CURRENTLY SUPPORTED VIA HTML ATTRIBUTES.
+  }
+
+
+
+
+  // Grab a reference to the global socket.io client (if one is available).
+  // This is used via closure below to determine which `io` to use when the
+  // socket.io client instance (`io`) is augmented to become the Sails client
+  // SDK instance (still `io`).
+  var _existingGlobalSocketIO = (typeof io !== 'undefined') ? io : undefined;
+
+
+
+
+  //////////////////////////////////////////////////////////////
+  /////
+  ///// NOW FOR BUNCHES OF:
+  /////  - PRIVATE FUNCTION DEFINITIONS
+  /////  - CONSTRUCTORS
+  /////  - AND METHODS
+  /////
+  //////////////////////////////////////////////////////////////
+  //
+
+
+
+  //  ███████╗ █████╗ ██╗██╗     ███████╗      ██╗ ██████╗        ██████╗██╗     ██╗███████╗███╗   ██╗████████╗
+  //  ██╔════╝██╔══██╗██║██║     ██╔════╝      ██║██╔═══██╗      ██╔════╝██║     ██║██╔════╝████╗  ██║╚══██╔══╝
+  //  ███████╗███████║██║██║     ███████╗█████╗██║██║   ██║█████╗██║     ██║     ██║█████╗  ██╔██╗ ██║   ██║
+  //  ╚════██║██╔══██║██║██║     ╚════██║╚════╝██║██║   ██║╚════╝██║     ██║     ██║██╔══╝  ██║╚██╗██║   ██║
+  //  ███████║██║  ██║██║███████╗███████║      ██║╚██████╔╝      ╚██████╗███████╗██║███████╗██║ ╚████║   ██║
+  //  ╚══════╝╚═╝  ╚═╝╚═╝╚══════╝╚══════╝      ╚═╝ ╚═════╝        ╚═════╝╚══════╝╚═╝╚══════╝╚═╝  ╚═══╝   ╚═╝
+  //
+
+  /**
+   * SailsIOClient()
+   *
+   * Augment the provided Socket.io client object (`io`) with methods for
+   * talking and listening to one or more Sails backend(s).  If no `io` was
+   * provided (i.e. in a browser setting), then attempt to use the global.
+   *
+   * This absorbs implicit `io.sails` configuration, sets a timer for
+   * automatically connecting a socket (if `io.sails.autoConnect` is enabled)
+   * and returns the augmented `io`.
+   *
+   * Note:
+   * The automatically-connected socket is exposed as `io.socket`.  If this
+   * socket attempts to bind event listeners or send requests before it is
+   * connected, it will be queued up and replayed when the connection is
+   * successfully opened.
+   *
+   * @param {SocketIO} io
+   * @returns {SailsIOClient} [also called `io`]
+   */
+
+  function SailsIOClient(_providedSocketIO) {
+
+    // First, determine which `io` we're augmenting.
+    //
+    // Prefer the passed-in `io` instance, but fall back to the
+    // global one if we've got it.
+    var io;
+    if (_providedSocketIO) {
+      io = _providedSocketIO;
+    }
+    else {
+      io = _existingGlobalSocketIO;
+    }
+    // (note that for readability, we deliberately do not short circuit or use the tertiary operator above)
+
+
+    // If a socket.io client (`io`) is not available, none of this will work.
+    if (!io) {
+      // If node:
+      if (SDK_INFO.platform === 'node') {
+        throw new Error('No socket.io client available.  When requiring `sails.io.js` from Node.js, a socket.io client (`io`) must be passed in; e.g.:\n```\nvar io = require(\'sails.io.js\')( require(\'socket.io-client\') )\n```\n(see https://github.com/balderdashy/sails.io.js/tree/master/test for more examples)');
+      }
+      // Otherwise, this is a web browser:
+      else {
+        throw new Error('The Sails socket SDK depends on the socket.io client, but the socket.io global (`io`) was not available when `sails.io.js` loaded.  Normally, the socket.io client code is bundled with sails.io.js, so something is a little off.  Please check to be sure this version of `sails.io.js` has the minified Socket.io client at the top of the file.');
+      }
+    }
+
+    // If the chosen socket.io client (`io`) has ALREADY BEEN AUGMENTED by this SDK,
+    // (i.e. if it already has a `.sails` property) then throw an error.
+    if (io.sails) {
+      // If node:
+      if (SDK_INFO.platform === 'node') {
+        throw new Error('The provided socket.io client (`io`) has already been augmented into a Sails socket SDK instance (it has `io.sails`).');
+      }
+      // Otherwise, this is a web browser:
+      else {
+        throw new Error('The socket.io client (`io`) has already been augmented into a Sails socket SDK instance.  Usually, this means you are bringing `sails.io.js` onto the page more than once.');
+      }
+    }
+
+
+    /**
+     * A little logger for this library to use internally.
+     * Basically just a wrapper around `console.log` with
+     * support for feature-detection.
+     *
+     * @api private
+     * @factory
+     */
+    function LoggerFactory(options) {
+      options = options || {
+        prefix: true
+      };
+
+      // If `console.log` is not accessible, `log` is a noop.
+      if (
+        typeof console !== 'object' ||
+        typeof console.log !== 'function' ||
+        typeof console.log.bind !== 'function'
+      ) {
+        return function noop() {};
+      }
+
+      return function log() {
+        var args = Array.prototype.slice.call(arguments);
+
+        // All logs are disabled when `io.sails.environment = 'production'`.
+        if (io.sails.environment === 'production') return;
+
+        // Add prefix to log messages (unless disabled)
+        var PREFIX = '';
+        if (options.prefix) {
+          args.unshift(PREFIX);
+        }
+
+        // Call wrapped logger
+        console.log
+          .bind(console)
+          .apply(this, args);
+      };
+    }//</LoggerFactory>
+
+    // Create a private logger instance
+    var consolog = LoggerFactory();
+    consolog.noPrefix = LoggerFactory({
+      prefix: false
+    });
+
+
+
+    /**
+     * What is the `requestQueue`?
+     *
+     * The request queue is used to simplify app-level connection logic--
+     * i.e. so you don't have to wait for the socket to be connected
+     * to start trying to  synchronize data.
+     *
+     * @api private
+     * @param  {SailsSocket}  socket
+     */
+
+    function runRequestQueue (socket) {
+      var queue = socket.requestQueue;
+
+      if (!queue) return;
+      for (var i in queue) {
+
+        // Double-check that `queue[i]` will not
+        // inadvertently discover extra properties attached to the Object
+        // and/or Array prototype by other libraries/frameworks/tools.
+        // (e.g. Ember does this. See https://github.com/balderdashy/sails.io.js/pull/5)
+        var isSafeToDereference = ({}).hasOwnProperty.call(queue, i);
+        if (isSafeToDereference) {
+          // Get the arguments that were originally made to the "request" method
+          var requestArgs = queue[i];
+          // Call the request method again in the context of the socket, with the original args
+          socket.request.apply(socket, requestArgs);
+        }
+      }
+
+      // Now empty the queue to remove it as a source of additional complexity.
+      socket.requestQueue = null;
+    }
+
+
+
+    /**
+     * Send a JSONP request.
+     *
+     * @param  {Object}   opts [optional]
+     * @param  {Function} cb
+     * @return {XMLHttpRequest}
+     */
+
+    function jsonp(opts, cb) {
+      opts = opts || {};
+
+      if (typeof window === 'undefined') {
+        // FUTURE: refactor node usage to live in here
+        return cb();
+      }
+
+      var scriptEl = document.createElement('script');
+      window._sailsIoJSConnect = function(response) {
+        // In rare circumstances our script may have been vaporised.
+        // Remove it, but only if it still exists
+        // https://github.com/balderdashy/sails.io.js/issues/92
+        if (scriptEl && scriptEl.parentNode) {
+            scriptEl.parentNode.removeChild(scriptEl);
+        }
+
+        cb(response);
+      };
+      scriptEl.src = opts.url;
+      document.getElementsByTagName('head')[0].appendChild(scriptEl);
+
+    }
+
+
+
+
+    //       ██╗███████╗ ██████╗ ███╗   ██╗      ██╗    ██╗███████╗██████╗ ███████╗ ██████╗  ██████╗██╗  ██╗███████╗████████╗
+    //       ██║██╔════╝██╔═══██╗████╗  ██║      ██║    ██║██╔════╝██╔══██╗██╔════╝██╔═══██╗██╔════╝██║ ██╔╝██╔════╝╚══██╔══╝
+    //       ██║███████╗██║   ██║██╔██╗ ██║█████╗██║ █╗ ██║█████╗  ██████╔╝███████╗██║   ██║██║     █████╔╝ █████╗     ██║
+    //  ██   ██║╚════██║██║   ██║██║╚██╗██║╚════╝██║███╗██║██╔══╝  ██╔══██╗╚════██║██║   ██║██║     ██╔═██╗ ██╔══╝     ██║
+    //  ╚█████╔╝███████║╚██████╔╝██║ ╚████║      ╚███╔███╔╝███████╗██████╔╝███████║╚██████╔╝╚██████╗██║  ██╗███████╗   ██║
+    //   ╚════╝ ╚══════╝ ╚═════╝ ╚═╝  ╚═══╝       ╚══╝╚══╝ ╚══════╝╚═════╝ ╚══════╝ ╚═════╝  ╚═════╝╚═╝  ╚═╝╚══════╝   ╚═╝
+    //
+    //  ██████╗ ███████╗███████╗██████╗  ██████╗ ███╗   ██╗███████╗███████╗     ██╗     ██╗██╗    ██╗██████╗ ██╗
+    //  ██╔══██╗██╔════╝██╔════╝██╔══██╗██╔═══██╗████╗  ██║██╔════╝██╔════╝    ██╔╝     ██║██║    ██║██╔══██╗╚██╗
+    //  ██████╔╝█████╗  ███████╗██████╔╝██║   ██║██╔██╗ ██║███████╗█████╗      ██║      ██║██║ █╗ ██║██████╔╝ ██║
+    //  ██╔══██╗██╔══╝  ╚════██║██╔═══╝ ██║   ██║██║╚██╗██║╚════██║██╔══╝      ██║ ██   ██║██║███╗██║██╔══██╗ ██║
+    //  ██║  ██║███████╗███████║██║     ╚██████╔╝██║ ╚████║███████║███████╗    ╚██╗╚█████╔╝╚███╔███╔╝██║  ██║██╔╝
+    //  ╚═╝  ╚═╝╚══════╝╚══════╝╚═╝      ╚═════╝ ╚═╝  ╚═══╝╚══════╝╚══════╝     ╚═╝ ╚════╝  ╚══╝╚══╝ ╚═╝  ╚═╝╚═╝
+    //
+
+    /**
+     * The JWR (JSON WebSocket Response) received from a Sails server.
+     *
+     * @api public
+     * @param  {Object}  responseCtx
+     *         => :body
+     *         => :statusCode
+     *         => :headers
+     *
+     * @constructor
+     */
+
+    function JWR(responseCtx) {
+      this.body = responseCtx.body;
+      this.headers = responseCtx.headers || {};
+      this.statusCode = (typeof responseCtx.statusCode === 'undefined') ? 200 : responseCtx.statusCode;
+      // FUTURE: Replace this typeof short-circuit with an assertion (statusCode should always be set)
+
+      if (this.statusCode < 200 || this.statusCode >= 400) {
+        // Determine the appropriate error message.
+        var msg;
+        if (this.statusCode === 0) {
+          msg = 'The socket request failed.';
+        }
+        else {
+          msg = 'Server responded with a ' + this.statusCode + ' status code';
+          msg += ':\n```\n' + JSON.stringify(this.body, null, 2) + '\n```';
+          // (^^Note that we should always be able to rely on socket.io to give us
+          // non-circular data here, so we don't have to worry about wrapping the
+          // above in a try...catch)
+        }
+
+        // Now build and attach Error instance.
+        this.error = new Error(msg);
+      }
+    }
+    JWR.prototype.toString = function() {
+      return '[ResponseFromSails]' + '  -- ' +
+        'Status: ' + this.statusCode + '  -- ' +
+        'Headers: ' + this.headers + '  -- ' +
+        'Body: ' + this.body;
+    };
+    JWR.prototype.toPOJO = function() {
+      return {
+        body: this.body,
+        headers: this.headers,
+        statusCode: this.statusCode
+      };
+    };
+    JWR.prototype.pipe = function() {
+      // FUTURE: look at substack's stuff
+      return new Error('Client-side streaming support not implemented yet.');
+    };
+
+
+
+
+    //          ███████╗███╗   ███╗██╗████████╗███████╗██████╗  ██████╗ ███╗   ███╗ ██╗██╗
+    //          ██╔════╝████╗ ████║██║╚══██╔══╝██╔════╝██╔══██╗██╔═══██╗████╗ ████║██╔╝╚██╗
+    //          █████╗  ██╔████╔██║██║   ██║   █████╗  ██████╔╝██║   ██║██╔████╔██║██║  ██║
+    //          ██╔══╝  ██║╚██╔╝██║██║   ██║   ██╔══╝  ██╔══██╗██║   ██║██║╚██╔╝██║██║  ██║
+    //  ███████╗███████╗██║ ╚═╝ ██║██║   ██║   ██║     ██║  ██║╚██████╔╝██║ ╚═╝ ██║╚██╗██╔╝
+    //  ╚══════╝╚══════╝╚═╝     ╚═╝╚═╝   ╚═╝   ╚═╝     ╚═╝  ╚═╝ ╚═════╝ ╚═╝     ╚═╝ ╚═╝╚═╝
+    //
+
+    /**
+     * @api private
+     * @param  {SailsSocket} socket  [description]
+     * @param  {Object} requestCtx [description]
+     */
+
+    function _emitFrom(socket, requestCtx) {
+
+      if (!socket._raw) {
+        throw new Error('Failed to emit from socket- raw SIO socket is missing.');
+      }
+
+      // Since callback is embedded in requestCtx,
+      // retrieve it and delete the key before continuing.
+      var cb = requestCtx.cb;
+      delete requestCtx.cb;
+
+      // Name of the appropriate socket.io listener on the server
+      // ( === the request method or "verb", e.g. 'get', 'post', 'put', etc. )
+      var sailsEndpoint = requestCtx.method;
+
+      socket._raw.emit(sailsEndpoint, requestCtx, function serverResponded(responseCtx) {
+
+        // Send back (emulatedHTTPBody, jsonWebSocketResponse)
+        if (cb && !requestCtx.calledCb) {
+          cb(responseCtx.body, new JWR(responseCtx));
+          // Set flag indicating that callback was called, to avoid duplicate calls.
+          requestCtx.calledCb = true;
+          // Remove the callback from the list.
+          socket._responseCbs.splice(socket._responseCbs.indexOf(cb), 1);
+          // Remove the context from the list.
+          socket._requestCtxs.splice(socket._requestCtxs.indexOf(requestCtx), 1);
+        }
+      });
+    }
+
+
+
+
+
+
+
+    //  ███████╗ █████╗ ██╗██╗     ███████╗███████╗ ██████╗  ██████╗██╗  ██╗███████╗████████╗
+    //  ██╔════╝██╔══██╗██║██║     ██╔════╝██╔════╝██╔═══██╗██╔════╝██║ ██╔╝██╔════╝╚══██╔══╝
+    //  ███████╗███████║██║██║     ███████╗███████╗██║   ██║██║     █████╔╝ █████╗     ██║
+    //  ╚════██║██╔══██║██║██║     ╚════██║╚════██║██║   ██║██║     ██╔═██╗ ██╔══╝     ██║
+    //  ███████║██║  ██║██║███████╗███████║███████║╚██████╔╝╚██████╗██║  ██╗███████╗   ██║
+    //  ╚══════╝╚═╝  ╚═╝╚═╝╚══════╝╚══════╝╚══════╝ ╚═════╝  ╚═════╝╚═╝  ╚═╝╚══════╝   ╚═╝
+    //
+
+    /**
+     * SailsSocket
+     *
+     * A wrapper for an underlying Socket instance that communicates directly
+     * to the Socket.io server running inside of Sails.
+     *
+     * If no `socket` option is provied, SailsSocket will function as a mock. It will queue socket
+     * requests and event handler bindings, replaying them when the raw underlying socket actually
+     * connects. This is handy when we don't necessarily have the valid configuration to know
+     * WHICH SERVER to talk to yet, etc.  It is also used by `io.socket` for your convenience.
+     *
+     * @constructor
+     * @api private
+     *
+     * ----------------------------------------------------------------------
+     * Note: This constructor should not be used directly. To obtain a `SailsSocket`
+     * instance of your very own, run:
+     * ```
+     * var mySocket = io.sails.connect();
+     * ```
+     * ----------------------------------------------------------------------
+     */
+    function SailsSocket (opts){
+      var self = this;
+      opts = opts||{};
+
+      // Initialize private properties
+      self._isConnecting = false;
+      self._mightBeAboutToAutoConnect = false;
+
+      // Set up connection options so that they can only be changed when socket is disconnected.
+      var _opts = {};
+      SOCKET_OPTIONS.forEach(function(option) {
+        // Okay to change global headers while socket is connected
+        if (option == 'headers') {return;}
+        Object.defineProperty(self, option, {
+          get: function() {
+            if (option == 'url') {
+              return _opts[option] || (self._raw && self._raw.io && self._raw.io.uri);
+            }
+            return _opts[option];
+          },
+          set: function(value) {
+            // Don't allow value to be changed while socket is connected
+            if (self.isConnected() && io.sails.strict !== false && value != _opts[option]) {
+              throw new Error('Cannot change value of `' + option + '` while socket is connected.');
+            }
+            // If socket is attempting to reconnect, stop it.
+            if (self._raw && self._raw.io && self._raw.io.reconnecting && !self._raw.io.skipReconnect) {
+              self._raw.io.skipReconnect = true;
+              consolog('Stopping reconnect; use .reconnect() to connect socket after changing options.');
+            }
+            _opts[option] = value;
+          }
+        });
+      });
+
+      // Absorb opts into SailsSocket instance
+      // See http://sailsjs.com/documentation/reference/web-sockets/socket-client/sails-socket/properties
+      // for description of options
+      SOCKET_OPTIONS.forEach(function(option) {
+        self[option] = opts[option];
+      });
+
+      // Set up "eventQueue" to hold event handlers which have not been set on the actual raw socket yet.
+      self.eventQueue = {};
+
+      // Listen for special `parseError` event sent from sockets hook on the backend
+      // if an error occurs but a valid callback was not received from the client
+      // (i.e. so the server had no other way to send back the error information)
+      self.on('sails:parseError', function (err){
+        consolog('Sails encountered an error parsing a socket message sent from this client, and did not have access to a callback function to respond with.');
+        consolog('Error details:',err);
+      });
+
+      // FUTURE:
+      // Listen for a special private message on any connected that allows the server
+      // to set the environment (giving us 100% certainty that we guessed right)
+      // However, note that the `console.log`s called before and after connection
+      // are still forced to rely on our existing heuristics (to disable, tack #production
+      // onto the URL used to fetch this file.)
+
+    }//</SailsSocket>
+
+
+    /**
+     * `SailsSocket.prototype._connect()`
+     *
+     * Begin connecting this socket to the server.
+     *
+     * @api private
+     */
+    SailsSocket.prototype._connect = function (){
+      var self = this;
+
+      self._isConnecting = true;
+
+      // Apply `io.sails` config as defaults
+      // (now that at least one tick has elapsed)
+      // See http://sailsjs.com/documentation/reference/web-sockets/socket-client/sails-socket/properties
+      // for description of options and default values
+      SOCKET_OPTIONS.forEach(function(option) {
+        if ('undefined' == typeof self[option]) {
+          self[option] = io.sails[option];
+        }
+      });
+
+      // Headers that will be sent with the initial request to /socket.io (Node.js only)
+      self.extraHeaders = self.initialConnectionHeaders || {};
+
+      // For browser usage (currently works with "polling" transport only)
+      self.transportOptions = self.transportOptions || {};
+      self.transports.forEach(function(transport) {
+        self.transportOptions[transport] = self.transportOptions[transport] || {};
+        self.transportOptions[transport].extraHeaders = self.initialConnectionHeaders || {};
+      });
+
+      // Log a warning if non-Node.js platform attempts to use `initialConnectionHeaders` for anything other than `polling`.
+      if (self.initialConnectionHeaders && SDK_INFO.platform !== 'node' && self.transports.indexOf('polling') === -1 || self.transports.length > 1) {
+        if (typeof console === 'object' && typeof console.warn === 'function') {
+          console.warn('When running in browser, `initialConnectionHeaders` option is only available for the `polling` transport.');
+        }
+      }
+
+      // Ensure URL has no trailing slash
+      self.url = self.url ? self.url.replace(/(\/)$/, '') : undefined;
+
+      // Mix the current SDK version into the query string in
+      // the connection request to the server:
+      if (typeof self.query === 'string') {
+        // (If provided as a string, trim leading question mark,
+        // just in case one was provided.)
+        self.query = self.query.replace(/^\?/, '');
+        self.query += '&' + SDK_INFO.versionString;
+      }
+      else if (self.query && typeof self.query === 'object') {
+        throw new Error('`query` setting does not currently support configuration as a dictionary (`{}`).  Instead, it must be specified as a string like `foo=89&bar=hi`');
+      }
+      else if (!self.query) {
+        self.query = SDK_INFO.versionString;
+      }
+      else {
+        throw new Error('Unexpected data type provided for `query` setting: '+self.query);
+      }
+
+      // Determine whether this is a cross-origin socket by examining the
+      // hostname and port on the `window.location` object.  If it's cross-origin,
+      // we'll attempt to get a cookie for the domain so that a Sails session can
+      // be established.
+      var isXOrigin = (function (){
+
+        // If `window` doesn't exist (i.e. being used from Node.js), then
+        // we won't bother attempting to get a cookie.  If you're using sockets
+        // from Node.js and find you need to share a session between multiple
+        // socket connections, you'll need to make an HTTP request to the /__getcookie
+        // endpoint of the Sails server (or any endpoint that returns a set-cookie header)
+        // and then use the cookie value in the `initialConnectionHeaders` option to
+        // io.sails.connect()
+        if (typeof window === 'undefined' || typeof window.location === 'undefined') {
+          return false;
+        }
+
+        // If `self.url` (aka "target") is falsy, then we don't need to worry about it.
+        if (typeof self.url !== 'string') { return false; }
+
+        // Get information about the "target" (`self.url`)
+        var targetProtocol = (function (){
+          try {
+            targetProtocol = self.url.match(/^([a-z]+:\/\/)/i)[1].toLowerCase();
+          }
+          catch (e) {}
+          targetProtocol = targetProtocol || 'http://';
+          return targetProtocol;
+        })();
+        var isTargetSSL = !!self.url.match('^https');
+        var targetPort = (function (){
+          try {
+            return self.url.match(/^[a-z]+:\/\/[^:]*:([0-9]*)/i)[1];
+          }
+          catch (e){}
+          return isTargetSSL ? '443' : '80';
+        })();
+        var targetAfterProtocol = self.url.replace(/^([a-z]+:\/\/)/i, '');
+
+
+        // If target protocol is different than the actual protocol,
+        // then we'll consider this cross-origin.
+        if (targetProtocol.replace(/[:\/]/g, '') !== window.location.protocol.replace(/[:\/]/g,'')) {
+          return true;
+        }
+
+
+        // If target hostname is different than actual hostname, we'll consider this cross-origin.
+        var hasSameHostname = targetAfterProtocol.search(window.location.hostname) === 0;
+        if (!hasSameHostname) {
+          return true;
+        }
+
+        // If no actual port is explicitly set on the `window.location` object,
+        // we'll assume either 80 or 443.
+        var isLocationSSL = window.location.protocol.match(/https/i);
+        var locationPort = (window.location.port+'') || (isLocationSSL ? '443' : '80');
+
+        // Finally, if ports don't match, we'll consider this cross-origin.
+        if (targetPort !== locationPort) {
+          return true;
+        }
+
+        // Otherwise, it's the same origin.
+        return false;
+
+      })();
+
+
+      // Prepare to start connecting the socket
+      (function selfInvoking (cb){
+
+        // If this is an attempt at a cross-origin or cross-port
+        // socket connection via a browswe, send a JSONP request
+        // first to ensure that a valid cookie is available.
+        // This can be disabled by setting `io.sails.useCORSRouteToGetCookie`
+        // to false.
+        //
+        // Otherwise, skip the stuff below.
+        //
+        if (!(self.useCORSRouteToGetCookie && isXOrigin)) {
+          return cb();
+        }
+
+        // Figure out the x-origin CORS route
+        // (Sails provides a default)
+        var xOriginCookieURL = self.url;
+        if (typeof self.useCORSRouteToGetCookie === 'string') {
+          xOriginCookieURL += self.useCORSRouteToGetCookie;
+        }
+        else {
+          xOriginCookieURL += '/__getcookie';
+        }
+
+        // Make the AJAX request (CORS)
+        jsonp({
+          url: xOriginCookieURL,
+          method: 'GET'
+        }, cb);
+
+      })(function goAheadAndActuallyConnect() {
+
+        // Now that we're ready to connect, create a raw underlying Socket
+        // using Socket.io and save it as `_raw` (this will start it connecting)
+        self._raw = io(self.url, self);
+
+        // If the low-level transport throws an error _while connecting_, then set the _isConnecting flag
+        // to false (since we're no longer connecting with any chance of success anyway).
+        // Also, in this case (and in dev mode only) log a helpful message.
+        self._raw.io.engine.transport.on('error', function(err){
+          if (!self._isConnecting) { return; }
+
+          self._isConnecting = false;
+
+          // Track this timestamp for use in reconnection messages
+          // (only relevant if reconnection is enabled.)
+          self.connectionErrorTimestamp = (new Date()).getTime();
+
+          // Development-only message:
+          consolog('====================================');
+          consolog('The socket was unable to connect.');
+          consolog('The server may be offline, or the');
+          consolog('socket may have failed authorization');
+          consolog('based on its origin or other factors.');
+          consolog('You may want to check the values of');
+          consolog('`sails.config.sockets.onlyAllowOrigins`');
+          consolog('or (more rarely) `sails.config.sockets.beforeConnect`');
+          consolog('in your app.');
+          consolog('More info: https://sailsjs.com/config/sockets');
+          consolog('For help: https://sailsjs.com/support');
+          consolog('');
+          consolog('Technical details:');
+          consolog(err);
+          consolog('====================================');
+        });
+
+        // Replay event bindings from the eager socket
+        self.replay();
+
+
+        /**
+         * 'connect' event is triggered when the socket establishes a connection
+         *  successfully.
+         */
+        self.on('connect', function socketConnected() {
+          self._isConnecting = false;
+          consolog.noPrefix(
+            '\n' +
+            '\n' +
+            // '    |>    ' + '\n' +
+            // '  \\___/  '+️
+            // '\n'+
+             '  |>    Now connected to '+(self.url ? self.url : 'Sails')+'.' + '\n' +
+            '\\___/   For help, see: http://bit.ly/2q0QDpf' + '\n' +
+             '        (using sails.io.js '+io.sails.sdk.platform+' SDK @v'+io.sails.sdk.version+')'+ '\n' +
+            '         Connected at: '+(new Date())+'\n'+
+            '\n'+
+            '\n'+
+            // '\n'+
+            ''
+            // ' ⚓︎ (development mode)'
+            // 'e.g. to send a GET request to Sails via WebSockets, run:'+ '\n' +
+            // '`io.socket.get("/foo", function serverRespondedWith (body, jwr) { console.log(body); })`'+ '\n' +
+          );
+        });
+
+        self.on('disconnect', function() {
+
+          // Get a timestamp of when the disconnect was detected.
+          self.connectionLostTimestamp = (new Date()).getTime();
+
+          // Get a shallow clone of the internal array of response callbacks, in case any of the callbacks mutate it.
+          var responseCbs = [].concat(self._responseCbs || []);
+          // Wipe the internal array of response callbacks before executing them, in case a callback happens to add
+          // a new request to the queue.
+          self._responseCbs = [];
+
+          // Do the same for the internal request context list.
+          var requestCtxs = [].concat(self._requestCtxs || []);
+          self._requestCtxs = [];
+
+          // Loop through the callbacks for all in-progress requests, and call them each with an error indicating the disconnect.
+          if (responseCbs.length) {
+            responseCbs.forEach(function(responseCb) {
+              responseCb(new Error('The socket disconnected before the request completed.'), {
+                body: null,
+                statusCode: 0,
+                headers: {}
+              });
+            });
+          }
+
+          // If there is a list of request contexts, indicate that their callbacks have been
+          // called and then wipe the list.  This prevents errors in the edge case of a response
+          // somehow coming back after the socket reconnects.
+          if (requestCtxs.length) {
+            requestCtxs.forEach(function(requestCtx) {
+              requestCtx.calledCb = true;
+            });
+          }
+
+          consolog('====================================');
+          consolog('Socket was disconnected from Sails.');
+          consolog('Usually, this is due to one of the following reasons:' + '\n' +
+            ' -> the server ' + (self.url ? self.url + ' ' : '') + 'was taken down' + '\n' +
+            ' -> your browser lost internet connectivity');
+          consolog('====================================');
+        });
+
+        self.on('reconnecting', function(numAttempts) {
+          consolog(
+            '\n'+
+            '        Socket is trying to reconnect to '+(self.url ? self.url : 'Sails')+'...\n'+
+            '_-|>_-  (attempt #' + numAttempts + ')'+'\n'+
+            '\n'
+          );
+        });
+
+        self.on('reconnect', function(transport, numAttempts) {
+          if (!self._isConnecting) {
+            self.on('connect', runRequestQueue.bind(self, self));
+          }
+
+          var msSinceLastOffline;
+          var numSecsOffline;
+          if (self.connectionLostTimestamp){
+            msSinceLastOffline = ((new Date()).getTime() - self.connectionLostTimestamp);
+            numSecsOffline = (msSinceLastOffline / 1000);
+          }
+          else if (self.connectionErrorTimestamp) {
+            msSinceLastOffline = ((new Date()).getTime() - self.connectionErrorTimestamp);
+            numSecsOffline = (msSinceLastOffline / 1000);
+          }
+          else {
+            msSinceLastOffline = '???';
+            numSecsOffline = '???';
+          }
+
+          consolog(
+            '\n'+
+             '  |>    Socket reconnected successfully after'+'\n'+
+            '\\___/   being offline at least ' + numSecsOffline + ' seconds.'+'\n'+
+            '\n'
+          );
+        });
+
+        // 'error' event is triggered if connection can not be established.
+        // (usually because of a failed authorization, which is in turn
+        // usually due to a missing or invalid cookie)
+        self.on('error', function failedToConnect(err) {
+          self._isConnecting = false;
+          ////////////////////////////////////////////////////////////////////////////////////
+          // Note:
+          // In the future, we could provide a separate event for when a socket cannot connect
+          // due to a failed `beforeConnect` (aka "authorization" if you're old school).
+          // this could probably be implemented by emitting a special event from the server.
+          ////////////////////////////////////////////////////////////////////////////////////
+
+          consolog(
+            'Failed to connect socket (possibly due to failed `beforeConnect` on server)',
+            'Error:', err
+          );
+        });
+      });
+
+    };
+
+    /**
+     * Reconnect the underlying socket.
+     *
+     * @api public
+     */
+    SailsSocket.prototype.reconnect = function (){
+      if (this._isConnecting) {
+        throw new Error('Cannot connect- socket is already connecting');
+      }
+      if (this.isConnected()) {
+        throw new Error('Cannot connect- socket is already connected');
+      }
+      return this._connect();
+    };
+
+    /**
+     * Disconnect the underlying socket.
+     *
+     * @api public
+     */
+    SailsSocket.prototype.disconnect = function (){
+      this._isConnecting = false;
+      if (!this.isConnected()) {
+        throw new Error('Cannot disconnect- socket is already disconnected');
+      }
+      return this._raw.disconnect();
+    };
+
+
+
+    /**
+     * isConnected
+     *
+     * @return {Boolean} whether the socket is connected and able to
+     *                   communicate w/ the server.
+     */
+
+    SailsSocket.prototype.isConnected = function () {
+      if (!this._raw) {
+        return false;
+      }
+
+      return !!this._raw.connected;
+    };
+
+
+    /**
+     * isConnecting
+     *
+     * @return {Boolean} whether the socket is in the process of connecting
+     *                   to the server.
+     */
+
+    SailsSocket.prototype.isConnecting = function () {
+      return this._isConnecting;
+    };
+
+    /**
+     * isConnecting
+     *
+     * @return {Boolean} flag that is `true` after a SailsSocket instance is
+     *                   initialized but before one tick of the event loop
+     *                   has passed (so that it hasn't attempted to connect
+     *                   yet, if autoConnect ends up being configured `true`)
+     */
+    SailsSocket.prototype.mightBeAboutToAutoConnect = function() {
+      return this._mightBeAboutToAutoConnect;
+    };
+
+    /**
+     * [replay description]
+     * @return {[type]} [description]
+     */
+    SailsSocket.prototype.replay = function (){
+      var self = this;
+
+      // Pass events and a reference to the request queue
+      // off to the self._raw for consumption
+      for (var evName in self.eventQueue) {
+        for (var i in self.eventQueue[evName]) {
+          self._raw.on(evName, self.eventQueue[evName][i]);
+        }
+      }
+
+      // Bind a one-time function to run the request queue
+      // when the self._raw connects.
+      if ( !self.isConnected() ) {
+        self._raw.once('connect', runRequestQueue.bind(self, self));
+      }
+      // Or run it immediately if self._raw is already connected
+      else {
+        runRequestQueue(self);
+      }
+
+      return self;
+    };
+
+
+    /**
+     * Chainable method to bind an event to the socket.
+     *
+     * @param  {String}   evName [event name]
+     * @param  {Function} fn     [event handler function]
+     * @return {SailsSocket}
+     */
+    SailsSocket.prototype.on = function (evName, fn){
+
+      // Bind the event to the raw underlying socket if possible.
+      if (this._raw) {
+        this._raw.on(evName, fn);
+        return this;
+      }
+
+      // Otherwise queue the event binding.
+      if (!this.eventQueue[evName]) {
+        this.eventQueue[evName] = [fn];
+      }
+      else {
+        this.eventQueue[evName].push(fn);
+      }
+
+      return this;
+    };
+
+    /**
+     * Chainable method to unbind an event from the socket.
+     *
+     * @param  {String}   evName [event name]
+     * @param  {Function} fn     [event handler function]
+     * @return {SailsSocket}
+     */
+    SailsSocket.prototype.off = function (evName, fn){
+
+      // Bind the event to the raw underlying socket if possible.
+      if (this._raw) {
+        this._raw.off(evName, fn);
+        return this;
+      }
+
+      // Otherwise queue the event binding.
+      if (this.eventQueue[evName] && this.eventQueue[evName].indexOf(fn) > -1) {
+        this.eventQueue[evName].splice(this.eventQueue[evName].indexOf(fn), 1);
+      }
+
+      return this;
+    };
+
+
+    /**
+     * Chainable method to unbind all events from the socket.
+     *
+     * @return {SailsSocket}
+     */
+    SailsSocket.prototype.removeAllListeners = function (){
+
+      // Bind the event to the raw underlying socket if possible.
+      if (this._raw) {
+        this._raw.removeAllListeners();
+        return this;
+      }
+
+      // Otherwise queue the event binding.
+      this.eventQueue = {};
+
+      return this;
+    };
+
+    /**
+     * Simulate a GET request to sails
+     * e.g.
+     *    `socket.get('/user/3', Stats.populate)`
+     *
+     * @api public
+     * @param {String} url    ::    destination URL
+     * @param {Object} data   ::    parameters to send with the request [optional]
+     * @param {Function} cb   ::    callback function to call when finished [optional]
+     */
+
+    SailsSocket.prototype.get = function(url, data, cb) {
+
+      // `data` is optional
+      if (typeof data === 'function') {
+        cb = data;
+        data = {};
+      }
+
+      return this.request({
+        method: 'get',
+        params: data,
+        url: url
+      }, cb);
+    };
+
+
+
+    /**
+     * Simulate a POST request to sails
+     * e.g.
+     *    `socket.post('/event', newMeeting, $spinner.hide)`
+     *
+     * @api public
+     * @param {String} url    ::    destination URL
+     * @param {Object} data   ::    parameters to send with the request [optional]
+     * @param {Function} cb   ::    callback function to call when finished [optional]
+     */
+
+    SailsSocket.prototype.post = function(url, data, cb) {
+
+      // `data` is optional
+      if (typeof data === 'function') {
+        cb = data;
+        data = {};
+      }
+
+      return this.request({
+        method: 'post',
+        data: data,
+        url: url
+      }, cb);
+    };
+
+
+
+    /**
+     * Simulate a PUT request to sails
+     * e.g.
+     *    `socket.post('/event/3', changedFields, $spinner.hide)`
+     *
+     * @api public
+     * @param {String} url    ::    destination URL
+     * @param {Object} data   ::    parameters to send with the request [optional]
+     * @param {Function} cb   ::    callback function to call when finished [optional]
+     */
+
+    SailsSocket.prototype.put = function(url, data, cb) {
+
+      // `data` is optional
+      if (typeof data === 'function') {
+        cb = data;
+        data = {};
+      }
+
+      return this.request({
+        method: 'put',
+        params: data,
+        url: url
+      }, cb);
+    };
+
+
+    /**
+     * Simulate a PATCH request to sails
+     * e.g.
+     *    `socket.patch('/event/3', changedFields, $spinner.hide)`
+     *
+     * @api public
+     * @param {String} url    ::    destination URL
+     * @param {Object} data   ::    parameters to send with the request [optional]
+     * @param {Function} cb   ::    callback function to call when finished [optional]
+     */
+
+    SailsSocket.prototype.patch = function(url, data, cb) {
+
+      // `data` is optional
+      if (typeof data === 'function') {
+        cb = data;
+        data = {};
+      }
+
+      return this.request({
+        method: 'patch',
+        params: data,
+        url: url
+      }, cb);
+    };
+
+    /**
+     * Simulate a DELETE request to sails
+     * e.g.
+     *    `socket.delete('/event', $spinner.hide)`
+     *
+     * @api public
+     * @param {String} url    ::    destination URL
+     * @param {Object} data   ::    parameters to send with the request [optional]
+     * @param {Function} cb   ::    callback function to call when finished [optional]
+     */
+
+    SailsSocket.prototype['delete'] = function(url, data, cb) {
+
+      // `data` is optional
+      if (typeof data === 'function') {
+        cb = data;
+        data = {};
+      }
+
+      return this.request({
+        method: 'delete',
+        params: data,
+        url: url
+      }, cb);
+    };
+
+
+
+    /**
+     * Simulate an HTTP request to sails
+     * e.g.
+     * ```
+     * socket.request({
+     *   url:'/user',
+     *   params: {},
+     *   method: 'POST',
+     *   headers: {}
+     * }, function (responseBody, JWR) {
+     *   // ...
+     * });
+     * ```
+     *
+     * @api public
+     * @option {String} url    ::    destination URL
+     * @option {Object} params ::    parameters to send with the request [optional]
+     * @option {Object} headers::    headers to send with the request [optional]
+     * @option {Function} cb   ::    callback function to call when finished [optional]
+     * @option {String} method ::    HTTP request method [optional]
+     */
+
+    SailsSocket.prototype.request = function(options, cb) {
+
+      var usage =
+      'Usage:\n'+
+      'socket.request( options, [fnToCallWhenComplete] )\n\n'+
+      'options.url :: e.g. "/foo/bar"'+'\n'+
+      'options.method :: e.g. "get", "post", "put", or "delete", etc.'+'\n'+
+      'options.params :: e.g. { emailAddress: "mike@example.com" }'+'\n'+
+      'options.headers :: e.g. { "x-my-custom-header": "some string" }';
+      // Old usage:
+      // var usage = 'Usage:\n socket.'+(options.method||'request')+'('+
+      //   ' destinationURL, [dataToSend], [fnToCallWhenComplete] )';
+
+
+      // Validate options and callback
+      if (typeof cb !== 'undefined' && typeof cb !== 'function') {
+        throw new Error('Invalid callback function!\n' + usage);
+      }
+      if (typeof options !== 'object' || typeof options.url !== 'string') {
+        throw new Error('Invalid or missing URL!\n' + usage);
+      }
+      if (options.method && typeof options.method !== 'string') {
+        throw new Error('Invalid `method` provided (should be a string like "post" or "put")\n' + usage);
+      }
+      if (options.headers && typeof options.headers !== 'object') {
+        throw new Error('Invalid `headers` provided (should be a dictionary with string values)\n' + usage);
+      }
+      if (options.params && typeof options.params !== 'object') {
+        throw new Error('Invalid `params` provided (should be a dictionary with JSON-serializable values)\n' + usage);
+      }
+      if (options.data && typeof options.data !== 'object') {
+        throw new Error('Invalid `data` provided (should be a dictionary with JSON-serializable values)\n' + usage);
+      }
+
+      // Accept either `params` or `data` for backwards compatibility (but not both!)
+      if (options.data && options.params) {
+        throw new Error('Cannot specify both `params` and `data`!  They are aliases of each other.\n' + usage);
+      }
+      else if (options.data) {
+        options.params = options.data;
+        delete options.data;
+      }
+
+
+      // If this socket is not connected yet, queue up this request
+      // instead of sending it.
+      // (so it can be replayed when the socket comes online.)
+      if ( ! this.isConnected() ) {
+
+        // If no queue array exists for this socket yet, create it.
+        this.requestQueue = this.requestQueue || [];
+        this.requestQueue.push([options, cb]);
+        return;
+      }
+
+      // Otherwise, our socket is connected, so continue prepping
+      // the request.
+
+      // Default headers to an empty object
+      options.headers = options.headers || {};
+
+      // Build a simulated request object
+      // (and sanitize/marshal options along the way)
+      var requestCtx = {
+
+        method: (options.method || 'get').toLowerCase(),
+
+        headers: options.headers,
+
+        data: options.params || options.data || {},
+
+        // Remove trailing slashes and spaces to make packets smaller.
+        url: options.url.replace(/^(.+)\/*\s*$/, '$1'),
+
+        cb: cb
+      };
+
+      // Get a reference to the callback list, or create a new one.
+      this._responseCbs = this._responseCbs || [];
+
+      // Get a reference to the request context list, or create a new one.
+      this._requestCtxs = this._requestCtxs || [];
+
+      // Add this callback to the list.  If the socket disconnects, we'll call
+      // each cb in the list with an error and reset the list.  Otherwise the
+      // cb will be removed from the list when the server responds.
+      // Also add the request context to the list.  It will be removed once
+      // the response comes back, or if the socket disconnects.
+      if (cb) {
+        this._responseCbs.push(cb);
+        this._requestCtxs.push(requestCtx);
+      }
+
+      // Merge global headers in, if there are any.
+      if (this.headers && 'object' === typeof this.headers) {
+        for (var header in this.headers) {
+          if (!options.headers.hasOwnProperty(header)) {
+            options.headers[header] = this.headers[header];
+          }
+        }
+      }
+
+      // Send the request.
+      _emitFrom(this, requestCtx);
+    };
+
+
+
+    /**
+     * Socket.prototype._request
+     *
+     * Simulate HTTP over Socket.io.
+     *
+     * @api private
+     * @param  {[type]}   options [description]
+     * @param  {Function} cb      [description]
+     */
+    SailsSocket.prototype._request = function(options, cb) {
+      throw new Error('`_request()` was a private API deprecated as of v0.11 of the sails.io.js client. Use `.request()` instead.');
+    };
+
+
+
+
+
+
+
+    //  ██╗ ██████╗    ███████╗ █████╗ ██╗██╗     ███████╗
+    //  ██║██╔═══██╗   ██╔════╝██╔══██╗██║██║     ██╔════╝
+    //  ██║██║   ██║   ███████╗███████║██║██║     ███████╗
+    //  ██║██║   ██║   ╚════██║██╔══██║██║██║     ╚════██║
+    //  ██║╚██████╔╝██╗███████║██║  ██║██║███████╗███████║
+    //  ╚═╝ ╚═════╝ ╚═╝╚══════╝╚═╝  ╚═╝╚═╝╚══════╝╚══════╝
+    //
+    // Set an `io.sails` object that may be used for configuration before the
+    // first socket connects (i.e. to allow auto-connect behavior to be
+    // prevented by setting `io.sails.autoConnect` in an inline script
+    // directly after the script tag which loaded this file).
+
+
+    //  ┌─┐┌─┐┌┬┐  ┬ ┬┌─┐  ╔╦╗╔═╗╔═╗╔═╗╦ ╦╦ ╔╦╗╔═╗  ┌─┐┌─┐┬─┐  ┬┌─┐ ┌─┐┌─┐┬┬  ┌─┐
+    //  └─┐├┤  │   │ │├─┘   ║║║╣ ╠╣ ╠═╣║ ║║  ║ ╚═╗  ├┤ │ │├┬┘  ││ │ └─┐├─┤││  └─┐
+    //  └─┘└─┘ ┴   └─┘┴    ═╩╝╚═╝╚  ╩ ╩╚═╝╩═╝╩ ╚═╝  └  └─┘┴└─  ┴└─┘o└─┘┴ ┴┴┴─┘└─┘
+    io.sails = {
+
+      // Whether to automatically connect a socket and save it as `io.socket`.
+      autoConnect: true,
+
+      // Whether to automatically try to reconnect after connection is lost
+      reconnection: false,
+
+      // The route (path) to hit to get a x-origin (CORS) cookie
+      // (or true to use the default: '/__getcookie')
+      useCORSRouteToGetCookie: true,
+
+      // The environment we're running in.
+      // (logs are not displayed when this is set to 'production')
+      //
+      // Defaults to "development" unless this script was fetched from a URL
+      // that ends in `*.min.js` or '#production', or if the conventional
+      // `SAILS_LOCALS` global is set with an `_environment` of "production"
+      // or "staging".  (This setting may also be manually overridden.)
+      environment: (
+        urlThisScriptWasFetchedFrom.match(/(\#production|\.min\.js)/g) ||
+        (
+          typeof window === 'object' && window &&
+          typeof window.SAILS_LOCALS === 'object' && window.SAILS_LOCALS &&
+          (window.SAILS_LOCALS._environment === 'staging' || window.SAILS_LOCALS._environment === 'production')
+        )
+      )? 'production' : 'development',
+
+      // The version of this sails.io.js client SDK
+      sdk: SDK_INFO,
+
+      // Transports to use when communicating with the server, in the order they will be tried
+      transports: ['websocket']
+    };
+
+
+
+    //  ┌─┐─┐ ┬┌┬┐┌─┐┌┐┌┌┬┐  ┬┌─┐ ┌─┐┌─┐┬┬  ┌─┐  ┌┬┐┌─┐┌─┐┌─┐┬ ┬┬ ┌┬┐┌─┐
+    //  ├┤ ┌┴┬┘ │ ├┤ │││ ││  ││ │ └─┐├─┤││  └─┐   ││├┤ ├┤ ├─┤│ ││  │ └─┐
+    //  └─┘┴ └─ ┴ └─┘┘└┘─┴┘  ┴└─┘o└─┘┴ ┴┴┴─┘└─┘  ─┴┘└─┘└  ┴ ┴└─┘┴─┘┴ └─┘
+    //  ┬ ┬┬┌┬┐┬ ┬  ┌┬┐┬ ┬┌─┐  ╦ ╦╔╦╗╔╦╗╦    ╔═╗╔╦╗╔╦╗╦═╗╦╔╗ ╦ ╦╔╦╗╔═╗╔═╗
+    //  ││││ │ ├─┤   │ ├─┤├┤   ╠═╣ ║ ║║║║    ╠═╣ ║  ║ ╠╦╝║╠╩╗║ ║ ║ ║╣ ╚═╗
+    //  └┴┘┴ ┴ ┴ ┴   ┴ ┴ ┴└─┘  ╩ ╩ ╩ ╩ ╩╩═╝  ╩ ╩ ╩  ╩ ╩╚═╩╚═╝╚═╝ ╩ ╚═╝╚═╝
+    //  ┌─┐┬─┐┌─┐┌┬┐  ┌┬┐┬ ┬┌─┐  ┌─┐┌─┐┬─┐┬┌─┐┌┬┐  ┌┬┐┌─┐┌─┐
+    //  ├┤ ├┬┘│ ││││   │ ├─┤├┤   └─┐│  ├┬┘│├─┘ │    │ ├─┤│ ┬
+    //  └  ┴└─└─┘┴ ┴   ┴ ┴ ┴└─┘  └─┘└─┘┴└─┴┴   ┴    ┴ ┴ ┴└─┘
+    //
+    // Now fold in config provided as HTML attributes on the script tag:
+    // (note that if `io.sails.*` is changed after this script, those changes
+    //  will still take precedence)
+    CONFIGURABLE_VIA_HTML_ATTR.forEach(function (configKey){
+      if (typeof scriptTagConfig[configKey] !== 'undefined') {
+        io.sails[configKey] = scriptTagConfig[configKey];
+      }
+    });
+    //////////////////////////////////////////////////////////////////////////////
+    // Note that the new HTML attribute configuration style may eventually
+    // completely replace the original approach of setting `io.sails` properties,
+    // since the new strategy is easier to reason about.  Also, it would allow us
+    // to remove the timeout below someday.
+    //////////////////////////////////////////////////////////////////////////////
+
+
+
+
+    //  ┬┌─┐ ┌─┐┌─┐┬┬  ┌─┐ ╔═╗╔═╗╔╗╔╔╗╔╔═╗╔═╗╔╦╗  /  \
+    //  ││ │ └─┐├─┤││  └─┐ ║  ║ ║║║║║║║║╣ ║   ║  /   /
+    //  ┴└─┘o└─┘┴ ┴┴┴─┘└─┘o╚═╝╚═╝╝╚╝╝╚╝╚═╝╚═╝ ╩  \  /
+
+    /**
+     * Add `io.sails.connect` function as a wrapper for the built-in `io()` aka `io.connect()`
+     * method, returning a SailsSocket. This special function respects the configured io.sails
+     * connection URL, as well as sending other identifying information (most importantly, the
+     * current version of this SDK).
+     *
+     * @param  {String} url  [optional]
+     * @param  {Object} opts [optional]
+     * @return {Socket}
+     */
+    io.sails.connect = function(url, opts) {
+
+      // Make URL optional
+      if ('object' === typeof url) {
+        opts = url;
+        url = null;
+      }
+
+      // Default opts to empty object
+      opts = opts || {};
+
+      // If explicit connection url is specified, save it to options
+      opts.url = url || opts.url || undefined;
+
+      // Instantiate and return a new SailsSocket- and try to connect immediately.
+      var socket = new SailsSocket(opts);
+      socket._connect();
+      return socket;
+    };
+
+
+
+
+
+
+    //  ██╗ ██████╗    ███████╗ ██████╗  ██████╗██╗  ██╗███████╗████████╗
+    //  ██║██╔═══██╗   ██╔════╝██╔═══██╗██╔════╝██║ ██╔╝██╔════╝╚══██╔══╝
+    //  ██║██║   ██║   ███████╗██║   ██║██║     █████╔╝ █████╗     ██║
+    //  ██║██║   ██║   ╚════██║██║   ██║██║     ██╔═██╗ ██╔══╝     ██║
+    //  ██║╚██████╔╝██╗███████║╚██████╔╝╚██████╗██║  ██╗███████╗   ██║
+    //  ╚═╝ ╚═════╝ ╚═╝╚══════╝ ╚═════╝  ╚═════╝╚═╝  ╚═╝╚══════╝   ╚═╝
+    //
+    // io.socket
+    //
+    // The eager instance of Socket which will automatically try to connect
+    // using the host that this js file was served from.
+    //
+    // This can be disabled or configured by setting properties on `io.sails.*` within the
+    // first cycle of the event loop.
+    //
+
+
+    // Build `io.socket` so it exists
+    // (note that this DOES NOT start the connection process)
+    io.socket = new SailsSocket();
+    //
+    // This socket is not connected yet, and has not even _started_ connecting.
+    //
+    // But in the mean time, this eager socket will be queue events bound by the user
+    // before the first cycle of the event loop (using `.on()`), which will later
+    // be rebound on the raw underlying socket.
+
+
+    //  ┌─┐┌─┐┌┬┐  ┌─┐┬ ┬┌┬┐┌─┐   ┌─┐┌─┐┌┐┌┌┐┌┌─┐┌─┐┌┬┐  ┌┬┐┬┌┬┐┌─┐┬─┐
+    //  └─┐├┤  │   ├─┤│ │ │ │ │───│  │ │││││││├┤ │   │    │ ││││├┤ ├┬┘
+    //  └─┘└─┘ ┴   ┴ ┴└─┘ ┴ └─┘   └─┘└─┘┘└┘┘└┘└─┘└─┘ ┴    ┴ ┴┴ ┴└─┘┴└─
+    // If configured to do so, start auto-connecting after the first cycle of the event loop
+    // has completed (to allow time for this behavior to be configured/disabled
+    // by specifying properties on `io.sails`)
+
+    // Indicate that the autoConnect timer has started.
+    io.socket._mightBeAboutToAutoConnect = true;
+
+    setTimeout(function() {
+
+      // Indicate that the autoConect timer fired.
+      io.socket._mightBeAboutToAutoConnect = false;
+
+      // If autoConnect is disabled, delete the eager socket (io.socket) and bail out.
+      if (io.sails.autoConnect === false || io.sails.autoconnect === false) {
+        delete io.socket;
+        return;
+      }
+
+      // consolog('Eagerly auto-connecting socket to Sails... (requests will be queued in the mean-time)');
+      io.socket._connect();
+
+
+    }, 0); // </setTimeout>
+
+
+    // Return the `io` object.
+    return io;
+  } //</SailsIOClient>
+
+  //
+  /////////////////////////////////////////////////////////////////////////////////
+  ///// </bunches of private function definitions, constructors, and methods>
+  /////////////////////////////////////////////////////////////////////////////////
+
+
+
+
+  //  ███████╗██╗  ██╗██████╗  ██████╗ ███████╗███████╗    ███████╗██████╗ ██╗  ██╗
+  //  ██╔════╝╚██╗██╔╝██╔══██╗██╔═══██╗██╔════╝██╔════╝    ██╔════╝██╔══██╗██║ ██╔╝
+  //  █████╗   ╚███╔╝ ██████╔╝██║   ██║███████╗█████╗      ███████╗██║  ██║█████╔╝
+  //  ██╔══╝   ██╔██╗ ██╔═══╝ ██║   ██║╚════██║██╔══╝      ╚════██║██║  ██║██╔═██╗
+  //  ███████╗██╔╝ ██╗██║     ╚██████╔╝███████║███████╗    ███████║██████╔╝██║  ██╗
+  //  ╚══════╝╚═╝  ╚═╝╚═╝      ╚═════╝ ╚══════╝╚══════╝    ╚══════╝╚═════╝ ╚═╝  ╚═╝
+  //
+
+
+  // Add CommonJS support to allow this client SDK to be used from Node.js.
+  if (SDK_INFO.platform === 'node') {
+    module.exports = SailsIOClient;
+  }
+  // Add AMD support, registering this client SDK as an anonymous module.
+  else if (typeof define === 'function' && define.amd) {
+    define([], function() {
+      return SailsIOClient;
+    });
+  }
+  else {
+    // Otherwise, try to instantiate the client using the global `io`:
+    SailsIOClient();
+
+    // Note:
+    // If you are modifying this file manually to wrap an existing socket.io client
+    // (e.g. to prevent pollution of the global namespace), you can replace the global
+    // `io` with your own `io` instance above.
+  }
+
+})();
+;
+
+/* eslint-enable */
diff --git a/ee/bulk-operations-dashboard/assets/dependencies/vue-router.js b/ee/bulk-operations-dashboard/assets/dependencies/vue-router.js
new file mode 100644
index 0000000000..56c53972d3
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/dependencies/vue-router.js
@@ -0,0 +1,2513 @@
+/**
+  * vue-router v2.7.0
+  * (c) 2017 Evan You
+  * @license MIT
+  */
+(function (global, factory) {
+  typeof exports === 'object' && typeof module !== 'undefined' ? module.exports = factory() :
+  typeof define === 'function' && define.amd ? define(factory) :
+  (global.VueRouter = factory());
+}(this, (function () { 'use strict';
+
+/*  */
+
+function assert (condition, message) {
+  if (!condition) {
+    throw new Error(("[vue-router] " + message))
+  }
+}
+
+function warn (condition, message) {
+  if ("development" !== 'production' && !condition) {
+    typeof console !== 'undefined' && console.warn(("[vue-router] " + message));
+  }
+}
+
+function isError (err) {
+  return Object.prototype.toString.call(err).indexOf('Error') > -1
+}
+
+var View = {
+  name: 'router-view',
+  functional: true,
+  props: {
+    name: {
+      type: String,
+      default: 'default'
+    }
+  },
+  render: function render (_, ref) {
+    var props = ref.props;
+    var children = ref.children;
+    var parent = ref.parent;
+    var data = ref.data;
+
+    data.routerView = true;
+
+    // directly use parent context's createElement() function
+    // so that components rendered by router-view can resolve named slots
+    var h = parent.$createElement;
+    var name = props.name;
+    var route = parent.$route;
+    var cache = parent._routerViewCache || (parent._routerViewCache = {});
+
+    // determine current view depth, also check to see if the tree
+    // has been toggled inactive but kept-alive.
+    var depth = 0;
+    var inactive = false;
+    while (parent && parent._routerRoot !== parent) {
+      if (parent.$vnode && parent.$vnode.data.routerView) {
+        depth++;
+      }
+      if (parent._inactive) {
+        inactive = true;
+      }
+      parent = parent.$parent;
+    }
+    data.routerViewDepth = depth;
+
+    // render previous view if the tree is inactive and kept-alive
+    if (inactive) {
+      return h(cache[name], data, children)
+    }
+
+    var matched = route.matched[depth];
+    // render empty node if no matched route
+    if (!matched) {
+      cache[name] = null;
+      return h()
+    }
+
+    var component = cache[name] = matched.components[name];
+
+    // attach instance registration hook
+    // this will be called in the instance's injected lifecycle hooks
+    data.registerRouteInstance = function (vm, val) {
+      // val could be undefined for unregistration
+      var current = matched.instances[name];
+      if (
+        (val && current !== vm) ||
+        (!val && current === vm)
+      ) {
+        matched.instances[name] = val;
+      }
+    }
+
+    // also regiseter instance in prepatch hook
+    // in case the same component instance is reused across different routes
+    ;(data.hook || (data.hook = {})).prepatch = function (_, vnode) {
+      matched.instances[name] = vnode.componentInstance;
+    };
+
+    // resolve props
+    data.props = resolveProps(route, matched.props && matched.props[name]);
+
+    return h(component, data, children)
+  }
+};
+
+function resolveProps (route, config) {
+  switch (typeof config) {
+    case 'undefined':
+      return
+    case 'object':
+      return config
+    case 'function':
+      return config(route)
+    case 'boolean':
+      return config ? route.params : undefined
+    default:
+      {
+        warn(
+          false,
+          "props in \"" + (route.path) + "\" is a " + (typeof config) + ", " +
+          "expecting an object, function or boolean."
+        );
+      }
+  }
+}
+
+/*  */
+
+var encodeReserveRE = /[!'()*]/g;
+var encodeReserveReplacer = function (c) { return '%' + c.charCodeAt(0).toString(16); };
+var commaRE = /%2C/g;
+
+// fixed encodeURIComponent which is more conformant to RFC3986:
+// - escapes [!'()*]
+// - preserve commas
+var encode = function (str) { return encodeURIComponent(str)
+  .replace(encodeReserveRE, encodeReserveReplacer)
+  .replace(commaRE, ','); };
+
+var decode = decodeURIComponent;
+
+function resolveQuery (
+  query,
+  extraQuery,
+  _parseQuery
+) {
+  if ( extraQuery === void 0 ) extraQuery = {};
+
+  var parse = _parseQuery || parseQuery;
+  var parsedQuery;
+  try {
+    parsedQuery = parse(query || '');
+  } catch (e) {
+    "development" !== 'production' && warn(false, e.message);
+    parsedQuery = {};
+  }
+  for (var key in extraQuery) {
+    var val = extraQuery[key];
+    parsedQuery[key] = Array.isArray(val) ? val.slice() : val;
+  }
+  return parsedQuery
+}
+
+function parseQuery (query) {
+  var res = {};
+
+  query = query.trim().replace(/^(\?|#|&)/, '');
+
+  if (!query) {
+    return res
+  }
+
+  query.split('&').forEach(function (param) {
+    var parts = param.replace(/\+/g, ' ').split('=');
+    var key = decode(parts.shift());
+    var val = parts.length > 0
+      ? decode(parts.join('='))
+      : null;
+
+    if (res[key] === undefined) {
+      res[key] = val;
+    } else if (Array.isArray(res[key])) {
+      res[key].push(val);
+    } else {
+      res[key] = [res[key], val];
+    }
+  });
+
+  return res
+}
+
+function stringifyQuery (obj) {
+  var res = obj ? Object.keys(obj).map(function (key) {
+    var val = obj[key];
+
+    if (val === undefined) {
+      return ''
+    }
+
+    if (val === null) {
+      return encode(key)
+    }
+
+    if (Array.isArray(val)) {
+      var result = [];
+      val.forEach(function (val2) {
+        if (val2 === undefined) {
+          return
+        }
+        if (val2 === null) {
+          result.push(encode(key));
+        } else {
+          result.push(encode(key) + '=' + encode(val2));
+        }
+      });
+      return result.join('&')
+    }
+
+    return encode(key) + '=' + encode(val)
+  }).filter(function (x) { return x.length > 0; }).join('&') : null;
+  return res ? ("?" + res) : ''
+}
+
+/*  */
+
+
+var trailingSlashRE = /\/?$/;
+
+function createRoute (
+  record,
+  location,
+  redirectedFrom,
+  router
+) {
+  var stringifyQuery$$1 = router && router.options.stringifyQuery;
+  var route = {
+    name: location.name || (record && record.name),
+    meta: (record && record.meta) || {},
+    path: location.path || '/',
+    hash: location.hash || '',
+    query: location.query || {},
+    params: location.params || {},
+    fullPath: getFullPath(location, stringifyQuery$$1),
+    matched: record ? formatMatch(record) : []
+  };
+  if (redirectedFrom) {
+    route.redirectedFrom = getFullPath(redirectedFrom, stringifyQuery$$1);
+  }
+  return Object.freeze(route)
+}
+
+// the starting route that represents the initial state
+var START = createRoute(null, {
+  path: '/'
+});
+
+function formatMatch (record) {
+  var res = [];
+  while (record) {
+    res.unshift(record);
+    record = record.parent;
+  }
+  return res
+}
+
+function getFullPath (
+  ref,
+  _stringifyQuery
+) {
+  var path = ref.path;
+  var query = ref.query; if ( query === void 0 ) query = {};
+  var hash = ref.hash; if ( hash === void 0 ) hash = '';
+
+  var stringify = _stringifyQuery || stringifyQuery;
+  return (path || '/') + stringify(query) + hash
+}
+
+function isSameRoute (a, b) {
+  if (b === START) {
+    return a === b
+  } else if (!b) {
+    return false
+  } else if (a.path && b.path) {
+    return (
+      a.path.replace(trailingSlashRE, '') === b.path.replace(trailingSlashRE, '') &&
+      a.hash === b.hash &&
+      isObjectEqual(a.query, b.query)
+    )
+  } else if (a.name && b.name) {
+    return (
+      a.name === b.name &&
+      a.hash === b.hash &&
+      isObjectEqual(a.query, b.query) &&
+      isObjectEqual(a.params, b.params)
+    )
+  } else {
+    return false
+  }
+}
+
+function isObjectEqual (a, b) {
+  if ( a === void 0 ) a = {};
+  if ( b === void 0 ) b = {};
+
+  var aKeys = Object.keys(a);
+  var bKeys = Object.keys(b);
+  if (aKeys.length !== bKeys.length) {
+    return false
+  }
+  return aKeys.every(function (key) {
+    var aVal = a[key];
+    var bVal = b[key];
+    // check nested equality
+    if (typeof aVal === 'object' && typeof bVal === 'object') {
+      return isObjectEqual(aVal, bVal)
+    }
+    return String(aVal) === String(bVal)
+  })
+}
+
+function isIncludedRoute (current, target) {
+  return (
+    current.path.replace(trailingSlashRE, '/').indexOf(
+      target.path.replace(trailingSlashRE, '/')
+    ) === 0 &&
+    (!target.hash || current.hash === target.hash) &&
+    queryIncludes(current.query, target.query)
+  )
+}
+
+function queryIncludes (current, target) {
+  for (var key in target) {
+    if (!(key in current)) {
+      return false
+    }
+  }
+  return true
+}
+
+/*  */
+
+// work around weird flow bug
+var toTypes = [String, Object];
+var eventTypes = [String, Array];
+
+var Link = {
+  name: 'router-link',
+  props: {
+    to: {
+      type: toTypes,
+      required: true
+    },
+    tag: {
+      type: String,
+      default: 'a'
+    },
+    exact: Boolean,
+    append: Boolean,
+    replace: Boolean,
+    activeClass: String,
+    exactActiveClass: String,
+    event: {
+      type: eventTypes,
+      default: 'click'
+    }
+  },
+  render: function render (h) {
+    var this$1 = this;
+
+    var router = this.$router;
+    var current = this.$route;
+    var ref = router.resolve(this.to, current, this.append);
+    var location = ref.location;
+    var route = ref.route;
+    var href = ref.href;
+
+    var classes = {};
+    var globalActiveClass = router.options.linkActiveClass;
+    var globalExactActiveClass = router.options.linkExactActiveClass;
+    // Support global empty active class
+    var activeClassFallback = globalActiveClass == null
+            ? 'router-link-active'
+            : globalActiveClass;
+    var exactActiveClassFallback = globalExactActiveClass == null
+            ? 'router-link-exact-active'
+            : globalExactActiveClass;
+    var activeClass = this.activeClass == null
+            ? activeClassFallback
+            : this.activeClass;
+    var exactActiveClass = this.exactActiveClass == null
+            ? exactActiveClassFallback
+            : this.exactActiveClass;
+    var compareTarget = location.path
+      ? createRoute(null, location, null, router)
+      : route;
+
+    classes[exactActiveClass] = isSameRoute(current, compareTarget);
+    classes[activeClass] = this.exact
+      ? classes[exactActiveClass]
+      : isIncludedRoute(current, compareTarget);
+
+    var handler = function (e) {
+      if (guardEvent(e)) {
+        if (this$1.replace) {
+          router.replace(location);
+        } else {
+          router.push(location);
+        }
+      }
+    };
+
+    var on = { click: guardEvent };
+    if (Array.isArray(this.event)) {
+      this.event.forEach(function (e) { on[e] = handler; });
+    } else {
+      on[this.event] = handler;
+    }
+
+    var data = {
+      class: classes
+    };
+
+    if (this.tag === 'a') {
+      data.on = on;
+      data.attrs = { href: href };
+    } else {
+      // find the first <a> child and apply listener and href
+      var a = findAnchor(this.$slots.default);
+      if (a) {
+        // in case the <a> is a static node
+        a.isStatic = false;
+        var extend = _Vue.util.extend;
+        var aData = a.data = extend({}, a.data);
+        aData.on = on;
+        var aAttrs = a.data.attrs = extend({}, a.data.attrs);
+        aAttrs.href = href;
+      } else {
+        // doesn't have <a> child, apply listener to self
+        data.on = on;
+      }
+    }
+
+    return h(this.tag, data, this.$slots.default)
+  }
+};
+
+function guardEvent (e) {
+  // don't redirect with control keys
+  if (e.metaKey || e.altKey || e.ctrlKey || e.shiftKey) { return }
+  // don't redirect when preventDefault called
+  if (e.defaultPrevented) { return }
+  // don't redirect on right click
+  if (e.button !== undefined && e.button !== 0) { return }
+  // don't redirect if `target="_blank"`
+  if (e.currentTarget && e.currentTarget.getAttribute) {
+    var target = e.currentTarget.getAttribute('target');
+    if (/\b_blank\b/i.test(target)) { return }
+  }
+  // this may be a Weex event which doesn't have this method
+  if (e.preventDefault) {
+    e.preventDefault();
+  }
+  return true
+}
+
+function findAnchor (children) {
+  if (children) {
+    var child;
+    for (var i = 0; i < children.length; i++) {
+      child = children[i];
+      if (child.tag === 'a') {
+        return child
+      }
+      if (child.children && (child = findAnchor(child.children))) {
+        return child
+      }
+    }
+  }
+}
+
+var _Vue;
+
+function install (Vue) {
+  if (install.installed) { return }
+  install.installed = true;
+
+  _Vue = Vue;
+
+  var isDef = function (v) { return v !== undefined; };
+
+  var registerInstance = function (vm, callVal) {
+    var i = vm.$options._parentVnode;
+    if (isDef(i) && isDef(i = i.data) && isDef(i = i.registerRouteInstance)) {
+      i(vm, callVal);
+    }
+  };
+
+  Vue.mixin({
+    beforeCreate: function beforeCreate () {
+      if (isDef(this.$options.router)) {
+        this._routerRoot = this;
+        this._router = this.$options.router;
+        this._router.init(this);
+        Vue.util.defineReactive(this, '_route', this._router.history.current);
+      } else {
+        this._routerRoot = (this.$parent && this.$parent._routerRoot) || this;
+      }
+      registerInstance(this, this);
+    },
+    destroyed: function destroyed () {
+      registerInstance(this);
+    }
+  });
+
+  Object.defineProperty(Vue.prototype, '$router', {
+    get: function get () { return this._routerRoot._router }
+  });
+
+  Object.defineProperty(Vue.prototype, '$route', {
+    get: function get () { return this._routerRoot._route }
+  });
+
+  Vue.component('router-view', View);
+  Vue.component('router-link', Link);
+
+  var strats = Vue.config.optionMergeStrategies;
+  // use the same hook merging strategy for route hooks
+  strats.beforeRouteEnter = strats.beforeRouteLeave = strats.beforeRouteUpdate = strats.created;
+}
+
+/*  */
+
+var inBrowser = typeof window !== 'undefined';
+
+/*  */
+
+function resolvePath (
+  relative,
+  base,
+  append
+) {
+  var firstChar = relative.charAt(0);
+  if (firstChar === '/') {
+    return relative
+  }
+
+  if (firstChar === '?' || firstChar === '#') {
+    return base + relative
+  }
+
+  var stack = base.split('/');
+
+  // remove trailing segment if:
+  // - not appending
+  // - appending to trailing slash (last segment is empty)
+  if (!append || !stack[stack.length - 1]) {
+    stack.pop();
+  }
+
+  // resolve relative path
+  var segments = relative.replace(/^\//, '').split('/');
+  for (var i = 0; i < segments.length; i++) {
+    var segment = segments[i];
+    if (segment === '..') {
+      stack.pop();
+    } else if (segment !== '.') {
+      stack.push(segment);
+    }
+  }
+
+  // ensure leading slash
+  if (stack[0] !== '') {
+    stack.unshift('');
+  }
+
+  return stack.join('/')
+}
+
+function parsePath (path) {
+  var hash = '';
+  var query = '';
+
+  var hashIndex = path.indexOf('#');
+  if (hashIndex >= 0) {
+    hash = path.slice(hashIndex);
+    path = path.slice(0, hashIndex);
+  }
+
+  var queryIndex = path.indexOf('?');
+  if (queryIndex >= 0) {
+    query = path.slice(queryIndex + 1);
+    path = path.slice(0, queryIndex);
+  }
+
+  return {
+    path: path,
+    query: query,
+    hash: hash
+  }
+}
+
+function cleanPath (path) {
+  return path.replace(/\/\//g, '/')
+}
+
+var index$1 = Array.isArray || function (arr) {
+  return Object.prototype.toString.call(arr) == '[object Array]';
+};
+
+/**
+ * Expose `pathToRegexp`.
+ */
+var index = pathToRegexp;
+var parse_1 = parse;
+var compile_1 = compile;
+var tokensToFunction_1 = tokensToFunction;
+var tokensToRegExp_1 = tokensToRegExp;
+
+/**
+ * The main path matching regexp utility.
+ *
+ * @type {RegExp}
+ */
+var PATH_REGEXP = new RegExp([
+  // Match escaped characters that would otherwise appear in future matches.
+  // This allows the user to escape special characters that won't transform.
+  '(\\\\.)',
+  // Match Express-style parameters and un-named parameters with a prefix
+  // and optional suffixes. Matches appear as:
+  //
+  // "/:test(\\d+)?" => ["/", "test", "\d+", undefined, "?", undefined]
+  // "/route(\\d+)"  => [undefined, undefined, undefined, "\d+", undefined, undefined]
+  // "/*"            => ["/", undefined, undefined, undefined, undefined, "*"]
+  '([\\/.])?(?:(?:\\:(\\w+)(?:\\(((?:\\\\.|[^\\\\()])+)\\))?|\\(((?:\\\\.|[^\\\\()])+)\\))([+*?])?|(\\*))'
+].join('|'), 'g');
+
+/**
+ * Parse a string for the raw tokens.
+ *
+ * @param  {string}  str
+ * @param  {Object=} options
+ * @return {!Array}
+ */
+function parse (str, options) {
+  var tokens = [];
+  var key = 0;
+  var index = 0;
+  var path = '';
+  var defaultDelimiter = options && options.delimiter || '/';
+  var res;
+
+  while ((res = PATH_REGEXP.exec(str)) != null) {
+    var m = res[0];
+    var escaped = res[1];
+    var offset = res.index;
+    path += str.slice(index, offset);
+    index = offset + m.length;
+
+    // Ignore already escaped sequences.
+    if (escaped) {
+      path += escaped[1];
+      continue
+    }
+
+    var next = str[index];
+    var prefix = res[2];
+    var name = res[3];
+    var capture = res[4];
+    var group = res[5];
+    var modifier = res[6];
+    var asterisk = res[7];
+
+    // Push the current path onto the tokens.
+    if (path) {
+      tokens.push(path);
+      path = '';
+    }
+
+    var partial = prefix != null && next != null && next !== prefix;
+    var repeat = modifier === '+' || modifier === '*';
+    var optional = modifier === '?' || modifier === '*';
+    var delimiter = res[2] || defaultDelimiter;
+    var pattern = capture || group;
+
+    tokens.push({
+      name: name || key++,
+      prefix: prefix || '',
+      delimiter: delimiter,
+      optional: optional,
+      repeat: repeat,
+      partial: partial,
+      asterisk: !!asterisk,
+      pattern: pattern ? escapeGroup(pattern) : (asterisk ? '.*' : '[^' + escapeString(delimiter) + ']+?')
+    });
+  }
+
+  // Match any characters still remaining.
+  if (index < str.length) {
+    path += str.substr(index);
+  }
+
+  // If the path exists, push it onto the end.
+  if (path) {
+    tokens.push(path);
+  }
+
+  return tokens
+}
+
+/**
+ * Compile a string to a template function for the path.
+ *
+ * @param  {string}             str
+ * @param  {Object=}            options
+ * @return {!function(Object=, Object=)}
+ */
+function compile (str, options) {
+  return tokensToFunction(parse(str, options))
+}
+
+/**
+ * Prettier encoding of URI path segments.
+ *
+ * @param  {string}
+ * @return {string}
+ */
+function encodeURIComponentPretty (str) {
+  return encodeURI(str).replace(/[\/?#]/g, function (c) {
+    return '%' + c.charCodeAt(0).toString(16).toUpperCase()
+  })
+}
+
+/**
+ * Encode the asterisk parameter. Similar to `pretty`, but allows slashes.
+ *
+ * @param  {string}
+ * @return {string}
+ */
+function encodeAsterisk (str) {
+  return encodeURI(str).replace(/[?#]/g, function (c) {
+    return '%' + c.charCodeAt(0).toString(16).toUpperCase()
+  })
+}
+
+/**
+ * Expose a method for transforming tokens into the path function.
+ */
+function tokensToFunction (tokens) {
+  // Compile all the tokens into regexps.
+  var matches = new Array(tokens.length);
+
+  // Compile all the patterns before compilation.
+  for (var i = 0; i < tokens.length; i++) {
+    if (typeof tokens[i] === 'object') {
+      matches[i] = new RegExp('^(?:' + tokens[i].pattern + ')$');
+    }
+  }
+
+  return function (obj, opts) {
+    var path = '';
+    var data = obj || {};
+    var options = opts || {};
+    var encode = options.pretty ? encodeURIComponentPretty : encodeURIComponent;
+
+    for (var i = 0; i < tokens.length; i++) {
+      var token = tokens[i];
+
+      if (typeof token === 'string') {
+        path += token;
+
+        continue
+      }
+
+      var value = data[token.name];
+      var segment;
+
+      if (value == null) {
+        if (token.optional) {
+          // Prepend partial segment prefixes.
+          if (token.partial) {
+            path += token.prefix;
+          }
+
+          continue
+        } else {
+          throw new TypeError('Expected "' + token.name + '" to be defined')
+        }
+      }
+
+      if (index$1(value)) {
+        if (!token.repeat) {
+          throw new TypeError('Expected "' + token.name + '" to not repeat, but received `' + JSON.stringify(value) + '`')
+        }
+
+        if (value.length === 0) {
+          if (token.optional) {
+            continue
+          } else {
+            throw new TypeError('Expected "' + token.name + '" to not be empty')
+          }
+        }
+
+        for (var j = 0; j < value.length; j++) {
+          segment = encode(value[j]);
+
+          if (!matches[i].test(segment)) {
+            throw new TypeError('Expected all "' + token.name + '" to match "' + token.pattern + '", but received `' + JSON.stringify(segment) + '`')
+          }
+
+          path += (j === 0 ? token.prefix : token.delimiter) + segment;
+        }
+
+        continue
+      }
+
+      segment = token.asterisk ? encodeAsterisk(value) : encode(value);
+
+      if (!matches[i].test(segment)) {
+        throw new TypeError('Expected "' + token.name + '" to match "' + token.pattern + '", but received "' + segment + '"')
+      }
+
+      path += token.prefix + segment;
+    }
+
+    return path
+  }
+}
+
+/**
+ * Escape a regular expression string.
+ *
+ * @param  {string} str
+ * @return {string}
+ */
+function escapeString (str) {
+  return str.replace(/([.+*?=^!:${}()[\]|\/\\])/g, '\\$1')
+}
+
+/**
+ * Escape the capturing group by escaping special characters and meaning.
+ *
+ * @param  {string} group
+ * @return {string}
+ */
+function escapeGroup (group) {
+  return group.replace(/([=!:$\/()])/g, '\\$1')
+}
+
+/**
+ * Attach the keys as a property of the regexp.
+ *
+ * @param  {!RegExp} re
+ * @param  {Array}   keys
+ * @return {!RegExp}
+ */
+function attachKeys (re, keys) {
+  re.keys = keys;
+  return re
+}
+
+/**
+ * Get the flags for a regexp from the options.
+ *
+ * @param  {Object} options
+ * @return {string}
+ */
+function flags (options) {
+  return options.sensitive ? '' : 'i'
+}
+
+/**
+ * Pull out keys from a regexp.
+ *
+ * @param  {!RegExp} path
+ * @param  {!Array}  keys
+ * @return {!RegExp}
+ */
+function regexpToRegexp (path, keys) {
+  // Use a negative lookahead to match only capturing groups.
+  var groups = path.source.match(/\((?!\?)/g);
+
+  if (groups) {
+    for (var i = 0; i < groups.length; i++) {
+      keys.push({
+        name: i,
+        prefix: null,
+        delimiter: null,
+        optional: false,
+        repeat: false,
+        partial: false,
+        asterisk: false,
+        pattern: null
+      });
+    }
+  }
+
+  return attachKeys(path, keys)
+}
+
+/**
+ * Transform an array into a regexp.
+ *
+ * @param  {!Array}  path
+ * @param  {Array}   keys
+ * @param  {!Object} options
+ * @return {!RegExp}
+ */
+function arrayToRegexp (path, keys, options) {
+  var parts = [];
+
+  for (var i = 0; i < path.length; i++) {
+    parts.push(pathToRegexp(path[i], keys, options).source);
+  }
+
+  var regexp = new RegExp('(?:' + parts.join('|') + ')', flags(options));
+
+  return attachKeys(regexp, keys)
+}
+
+/**
+ * Create a path regexp from string input.
+ *
+ * @param  {string}  path
+ * @param  {!Array}  keys
+ * @param  {!Object} options
+ * @return {!RegExp}
+ */
+function stringToRegexp (path, keys, options) {
+  return tokensToRegExp(parse(path, options), keys, options)
+}
+
+/**
+ * Expose a function for taking tokens and returning a RegExp.
+ *
+ * @param  {!Array}          tokens
+ * @param  {(Array|Object)=} keys
+ * @param  {Object=}         options
+ * @return {!RegExp}
+ */
+function tokensToRegExp (tokens, keys, options) {
+  if (!index$1(keys)) {
+    options = /** @type {!Object} */ (keys || options);
+    keys = [];
+  }
+
+  options = options || {};
+
+  var strict = options.strict;
+  var end = options.end !== false;
+  var route = '';
+
+  // Iterate over the tokens and create our regexp string.
+  for (var i = 0; i < tokens.length; i++) {
+    var token = tokens[i];
+
+    if (typeof token === 'string') {
+      route += escapeString(token);
+    } else {
+      var prefix = escapeString(token.prefix);
+      var capture = '(?:' + token.pattern + ')';
+
+      keys.push(token);
+
+      if (token.repeat) {
+        capture += '(?:' + prefix + capture + ')*';
+      }
+
+      if (token.optional) {
+        if (!token.partial) {
+          capture = '(?:' + prefix + '(' + capture + '))?';
+        } else {
+          capture = prefix + '(' + capture + ')?';
+        }
+      } else {
+        capture = prefix + '(' + capture + ')';
+      }
+
+      route += capture;
+    }
+  }
+
+  var delimiter = escapeString(options.delimiter || '/');
+  var endsWithDelimiter = route.slice(-delimiter.length) === delimiter;
+
+  // In non-strict mode we allow a slash at the end of match. If the path to
+  // match already ends with a slash, we remove it for consistency. The slash
+  // is valid at the end of a path match, not in the middle. This is important
+  // in non-ending mode, where "/test/" shouldn't match "/test//route".
+  if (!strict) {
+    route = (endsWithDelimiter ? route.slice(0, -delimiter.length) : route) + '(?:' + delimiter + '(?=$))?';
+  }
+
+  if (end) {
+    route += '$';
+  } else {
+    // In non-ending mode, we need the capturing groups to match as much as
+    // possible by using a positive lookahead to the end or next path segment.
+    route += strict && endsWithDelimiter ? '' : '(?=' + delimiter + '|$)';
+  }
+
+  return attachKeys(new RegExp('^' + route, flags(options)), keys)
+}
+
+/**
+ * Normalize the given path string, returning a regular expression.
+ *
+ * An empty array can be passed in for the keys, which will hold the
+ * placeholder key descriptions. For example, using `/user/:id`, `keys` will
+ * contain `[{ name: 'id', delimiter: '/', optional: false, repeat: false }]`.
+ *
+ * @param  {(string|RegExp|Array)} path
+ * @param  {(Array|Object)=}       keys
+ * @param  {Object=}               options
+ * @return {!RegExp}
+ */
+function pathToRegexp (path, keys, options) {
+  if (!index$1(keys)) {
+    options = /** @type {!Object} */ (keys || options);
+    keys = [];
+  }
+
+  options = options || {};
+
+  if (path instanceof RegExp) {
+    return regexpToRegexp(path, /** @type {!Array} */ (keys))
+  }
+
+  if (index$1(path)) {
+    return arrayToRegexp(/** @type {!Array} */ (path), /** @type {!Array} */ (keys), options)
+  }
+
+  return stringToRegexp(/** @type {string} */ (path), /** @type {!Array} */ (keys), options)
+}
+
+index.parse = parse_1;
+index.compile = compile_1;
+index.tokensToFunction = tokensToFunction_1;
+index.tokensToRegExp = tokensToRegExp_1;
+
+/*  */
+
+var regexpCompileCache = Object.create(null);
+
+function fillParams (
+  path,
+  params,
+  routeMsg
+) {
+  try {
+    var filler =
+      regexpCompileCache[path] ||
+      (regexpCompileCache[path] = index.compile(path));
+    return filler(params || {}, { pretty: true })
+  } catch (e) {
+    {
+      warn(false, ("missing param for " + routeMsg + ": " + (e.message)));
+    }
+    return ''
+  }
+}
+
+/*  */
+
+function createRouteMap (
+  routes,
+  oldPathList,
+  oldPathMap,
+  oldNameMap
+) {
+  // the path list is used to control path matching priority
+  var pathList = oldPathList || [];
+  var pathMap = oldPathMap || Object.create(null);
+  var nameMap = oldNameMap || Object.create(null);
+
+  routes.forEach(function (route) {
+    addRouteRecord(pathList, pathMap, nameMap, route);
+  });
+
+  // ensure wildcard routes are always at the end
+  for (var i = 0, l = pathList.length; i < l; i++) {
+    if (pathList[i] === '*') {
+      pathList.push(pathList.splice(i, 1)[0]);
+      l--;
+      i--;
+    }
+  }
+
+  return {
+    pathList: pathList,
+    pathMap: pathMap,
+    nameMap: nameMap
+  }
+}
+
+function addRouteRecord (
+  pathList,
+  pathMap,
+  nameMap,
+  route,
+  parent,
+  matchAs
+) {
+  var path = route.path;
+  var name = route.name;
+  {
+    assert(path != null, "\"path\" is required in a route configuration.");
+    assert(
+      typeof route.component !== 'string',
+      "route config \"component\" for path: " + (String(path || name)) + " cannot be a " +
+      "string id. Use an actual component instead."
+    );
+  }
+
+  var normalizedPath = normalizePath(path, parent);
+  var pathToRegexpOptions = route.pathToRegexpOptions || {};
+
+  if (typeof route.caseSensitive === 'boolean') {
+    pathToRegexpOptions.sensitive = route.caseSensitive;
+  }
+
+  var record = {
+    path: normalizedPath,
+    regex: compileRouteRegex(normalizedPath, pathToRegexpOptions),
+    components: route.components || { default: route.component },
+    instances: {},
+    name: name,
+    parent: parent,
+    matchAs: matchAs,
+    redirect: route.redirect,
+    beforeEnter: route.beforeEnter,
+    meta: route.meta || {},
+    props: route.props == null
+      ? {}
+      : route.components
+        ? route.props
+        : { default: route.props }
+  };
+
+  if (route.children) {
+    // Warn if route is named, does not redirect and has a default child route.
+    // If users navigate to this route by name, the default child will
+    // not be rendered (GH Issue #629)
+    {
+      if (route.name && !route.redirect && route.children.some(function (child) { return /^\/?$/.test(child.path); })) {
+        warn(
+          false,
+          "Named Route '" + (route.name) + "' has a default child route. " +
+          "When navigating to this named route (:to=\"{name: '" + (route.name) + "'\"), " +
+          "the default child route will not be rendered. Remove the name from " +
+          "this route and use the name of the default child route for named " +
+          "links instead."
+        );
+      }
+    }
+    route.children.forEach(function (child) {
+      var childMatchAs = matchAs
+        ? cleanPath((matchAs + "/" + (child.path)))
+        : undefined;
+      addRouteRecord(pathList, pathMap, nameMap, child, record, childMatchAs);
+    });
+  }
+
+  if (route.alias !== undefined) {
+    var aliases = Array.isArray(route.alias)
+      ? route.alias
+      : [route.alias];
+
+    aliases.forEach(function (alias) {
+      var aliasRoute = {
+        path: alias,
+        children: route.children
+      };
+      addRouteRecord(
+        pathList,
+        pathMap,
+        nameMap,
+        aliasRoute,
+        parent,
+        record.path || '/' // matchAs
+      );
+    });
+  }
+
+  if (!pathMap[record.path]) {
+    pathList.push(record.path);
+    pathMap[record.path] = record;
+  }
+
+  if (name) {
+    if (!nameMap[name]) {
+      nameMap[name] = record;
+    } else if ("development" !== 'production' && !matchAs) {
+      warn(
+        false,
+        "Duplicate named routes definition: " +
+        "{ name: \"" + name + "\", path: \"" + (record.path) + "\" }"
+      );
+    }
+  }
+}
+
+function compileRouteRegex (path, pathToRegexpOptions) {
+  var regex = index(path, [], pathToRegexpOptions);
+  {
+    var keys = {};
+    regex.keys.forEach(function (key) {
+      warn(!keys[key.name], ("Duplicate param keys in route with path: \"" + path + "\""));
+      keys[key.name] = true;
+    });
+  }
+  return regex
+}
+
+function normalizePath (path, parent) {
+  path = path.replace(/\/$/, '');
+  if (path[0] === '/') { return path }
+  if (parent == null) { return path }
+  return cleanPath(((parent.path) + "/" + path))
+}
+
+/*  */
+
+
+function normalizeLocation (
+  raw,
+  current,
+  append,
+  router
+) {
+  var next = typeof raw === 'string' ? { path: raw } : raw;
+  // named target
+  if (next.name || next._normalized) {
+    return next
+  }
+
+  // relative params
+  if (!next.path && next.params && current) {
+    next = assign({}, next);
+    next._normalized = true;
+    var params = assign(assign({}, current.params), next.params);
+    if (current.name) {
+      next.name = current.name;
+      next.params = params;
+    } else if (current.matched.length) {
+      var rawPath = current.matched[current.matched.length - 1].path;
+      next.path = fillParams(rawPath, params, ("path " + (current.path)));
+    } else {
+      warn(false, "relative params navigation requires a current route.");
+    }
+    return next
+  }
+
+  var parsedPath = parsePath(next.path || '');
+  var basePath = (current && current.path) || '/';
+  var path = parsedPath.path
+    ? resolvePath(parsedPath.path, basePath, append || next.append)
+    : basePath;
+
+  var query = resolveQuery(
+    parsedPath.query,
+    next.query,
+    router && router.options.parseQuery
+  );
+
+  var hash = next.hash || parsedPath.hash;
+  if (hash && hash.charAt(0) !== '#') {
+    hash = "#" + hash;
+  }
+
+  return {
+    _normalized: true,
+    path: path,
+    query: query,
+    hash: hash
+  }
+}
+
+function assign (a, b) {
+  for (var key in b) {
+    a[key] = b[key];
+  }
+  return a
+}
+
+/*  */
+
+
+function createMatcher (
+  routes,
+  router
+) {
+  var ref = createRouteMap(routes);
+  var pathList = ref.pathList;
+  var pathMap = ref.pathMap;
+  var nameMap = ref.nameMap;
+
+  function addRoutes (routes) {
+    createRouteMap(routes, pathList, pathMap, nameMap);
+  }
+
+  function match (
+    raw,
+    currentRoute,
+    redirectedFrom
+  ) {
+    var location = normalizeLocation(raw, currentRoute, false, router);
+    var name = location.name;
+
+    if (name) {
+      var record = nameMap[name];
+      {
+        warn(record, ("Route with name '" + name + "' does not exist"));
+      }
+      if (!record) { return _createRoute(null, location) }
+      var paramNames = record.regex.keys
+        .filter(function (key) { return !key.optional; })
+        .map(function (key) { return key.name; });
+
+      if (typeof location.params !== 'object') {
+        location.params = {};
+      }
+
+      if (currentRoute && typeof currentRoute.params === 'object') {
+        for (var key in currentRoute.params) {
+          if (!(key in location.params) && paramNames.indexOf(key) > -1) {
+            location.params[key] = currentRoute.params[key];
+          }
+        }
+      }
+
+      if (record) {
+        location.path = fillParams(record.path, location.params, ("named route \"" + name + "\""));
+        return _createRoute(record, location, redirectedFrom)
+      }
+    } else if (location.path) {
+      location.params = {};
+      for (var i = 0; i < pathList.length; i++) {
+        var path = pathList[i];
+        var record$1 = pathMap[path];
+        if (matchRoute(record$1.regex, location.path, location.params)) {
+          return _createRoute(record$1, location, redirectedFrom)
+        }
+      }
+    }
+    // no match
+    return _createRoute(null, location)
+  }
+
+  function redirect (
+    record,
+    location
+  ) {
+    var originalRedirect = record.redirect;
+    var redirect = typeof originalRedirect === 'function'
+        ? originalRedirect(createRoute(record, location, null, router))
+        : originalRedirect;
+
+    if (typeof redirect === 'string') {
+      redirect = { path: redirect };
+    }
+
+    if (!redirect || typeof redirect !== 'object') {
+      {
+        warn(
+          false, ("invalid redirect option: " + (JSON.stringify(redirect)))
+        );
+      }
+      return _createRoute(null, location)
+    }
+
+    var re = redirect;
+    var name = re.name;
+    var path = re.path;
+    var query = location.query;
+    var hash = location.hash;
+    var params = location.params;
+    query = re.hasOwnProperty('query') ? re.query : query;
+    hash = re.hasOwnProperty('hash') ? re.hash : hash;
+    params = re.hasOwnProperty('params') ? re.params : params;
+
+    if (name) {
+      // resolved named direct
+      var targetRecord = nameMap[name];
+      {
+        assert(targetRecord, ("redirect failed: named route \"" + name + "\" not found."));
+      }
+      return match({
+        _normalized: true,
+        name: name,
+        query: query,
+        hash: hash,
+        params: params
+      }, undefined, location)
+    } else if (path) {
+      // 1. resolve relative redirect
+      var rawPath = resolveRecordPath(path, record);
+      // 2. resolve params
+      var resolvedPath = fillParams(rawPath, params, ("redirect route with path \"" + rawPath + "\""));
+      // 3. rematch with existing query and hash
+      return match({
+        _normalized: true,
+        path: resolvedPath,
+        query: query,
+        hash: hash
+      }, undefined, location)
+    } else {
+      {
+        warn(false, ("invalid redirect option: " + (JSON.stringify(redirect))));
+      }
+      return _createRoute(null, location)
+    }
+  }
+
+  function alias (
+    record,
+    location,
+    matchAs
+  ) {
+    var aliasedPath = fillParams(matchAs, location.params, ("aliased route with path \"" + matchAs + "\""));
+    var aliasedMatch = match({
+      _normalized: true,
+      path: aliasedPath
+    });
+    if (aliasedMatch) {
+      var matched = aliasedMatch.matched;
+      var aliasedRecord = matched[matched.length - 1];
+      location.params = aliasedMatch.params;
+      return _createRoute(aliasedRecord, location)
+    }
+    return _createRoute(null, location)
+  }
+
+  function _createRoute (
+    record,
+    location,
+    redirectedFrom
+  ) {
+    if (record && record.redirect) {
+      return redirect(record, redirectedFrom || location)
+    }
+    if (record && record.matchAs) {
+      return alias(record, location, record.matchAs)
+    }
+    return createRoute(record, location, redirectedFrom, router)
+  }
+
+  return {
+    match: match,
+    addRoutes: addRoutes
+  }
+}
+
+function matchRoute (
+  regex,
+  path,
+  params
+) {
+  var m = path.match(regex);
+
+  if (!m) {
+    return false
+  } else if (!params) {
+    return true
+  }
+
+  for (var i = 1, len = m.length; i < len; ++i) {
+    var key = regex.keys[i - 1];
+    var val = typeof m[i] === 'string' ? decodeURIComponent(m[i]) : m[i];
+    if (key) {
+      params[key.name] = val;
+    }
+  }
+
+  return true
+}
+
+function resolveRecordPath (path, record) {
+  return resolvePath(path, record.parent ? record.parent.path : '/', true)
+}
+
+/*  */
+
+
+var positionStore = Object.create(null);
+
+function setupScroll () {
+  window.addEventListener('popstate', function (e) {
+    saveScrollPosition();
+    if (e.state && e.state.key) {
+      setStateKey(e.state.key);
+    }
+  });
+}
+
+function handleScroll (
+  router,
+  to,
+  from,
+  isPop
+) {
+  if (!router.app) {
+    return
+  }
+
+  var behavior = router.options.scrollBehavior;
+  if (!behavior) {
+    return
+  }
+
+  {
+    assert(typeof behavior === 'function', "scrollBehavior must be a function");
+  }
+
+  // wait until re-render finishes before scrolling
+  router.app.$nextTick(function () {
+    var position = getScrollPosition();
+    var shouldScroll = behavior(to, from, isPop ? position : null);
+    if (!shouldScroll) {
+      return
+    }
+    var isObject = typeof shouldScroll === 'object';
+    if (isObject && typeof shouldScroll.selector === 'string') {
+      var el = document.querySelector(shouldScroll.selector);
+      if (el) {
+        var offset = shouldScroll.offset && typeof shouldScroll.offset === 'object' ? shouldScroll.offset : {};
+        offset = normalizeOffset(offset);
+        position = getElementPosition(el, offset);
+      } else if (isValidPosition(shouldScroll)) {
+        position = normalizePosition(shouldScroll);
+      }
+    } else if (isObject && isValidPosition(shouldScroll)) {
+      position = normalizePosition(shouldScroll);
+    }
+
+    if (position) {
+      window.scrollTo(position.x, position.y);
+    }
+  });
+}
+
+function saveScrollPosition () {
+  var key = getStateKey();
+  if (key) {
+    positionStore[key] = {
+      x: window.pageXOffset,
+      y: window.pageYOffset
+    };
+  }
+}
+
+function getScrollPosition () {
+  var key = getStateKey();
+  if (key) {
+    return positionStore[key]
+  }
+}
+
+function getElementPosition (el, offset) {
+  var docEl = document.documentElement;
+  var docRect = docEl.getBoundingClientRect();
+  var elRect = el.getBoundingClientRect();
+  return {
+    x: elRect.left - docRect.left - offset.x,
+    y: elRect.top - docRect.top - offset.y
+  }
+}
+
+function isValidPosition (obj) {
+  return isNumber(obj.x) || isNumber(obj.y)
+}
+
+function normalizePosition (obj) {
+  return {
+    x: isNumber(obj.x) ? obj.x : window.pageXOffset,
+    y: isNumber(obj.y) ? obj.y : window.pageYOffset
+  }
+}
+
+function normalizeOffset (obj) {
+  return {
+    x: isNumber(obj.x) ? obj.x : 0,
+    y: isNumber(obj.y) ? obj.y : 0
+  }
+}
+
+function isNumber (v) {
+  return typeof v === 'number'
+}
+
+/*  */
+
+var supportsPushState = inBrowser && (function () {
+  var ua = window.navigator.userAgent;
+
+  if (
+    (ua.indexOf('Android 2.') !== -1 || ua.indexOf('Android 4.0') !== -1) &&
+    ua.indexOf('Mobile Safari') !== -1 &&
+    ua.indexOf('Chrome') === -1 &&
+    ua.indexOf('Windows Phone') === -1
+  ) {
+    return false
+  }
+
+  return window.history && 'pushState' in window.history
+})();
+
+// use User Timing api (if present) for more accurate key precision
+var Time = inBrowser && window.performance && window.performance.now
+  ? window.performance
+  : Date;
+
+var _key = genKey();
+
+function genKey () {
+  return Time.now().toFixed(3)
+}
+
+function getStateKey () {
+  return _key
+}
+
+function setStateKey (key) {
+  _key = key;
+}
+
+function pushState (url, replace) {
+  saveScrollPosition();
+  // try...catch the pushState call to get around Safari
+  // DOM Exception 18 where it limits to 100 pushState calls
+  var history = window.history;
+  try {
+    if (replace) {
+      history.replaceState({ key: _key }, '', url);
+    } else {
+      _key = genKey();
+      history.pushState({ key: _key }, '', url);
+    }
+  } catch (e) {
+    window.location[replace ? 'replace' : 'assign'](url);
+  }
+}
+
+function replaceState (url) {
+  pushState(url, true);
+}
+
+/*  */
+
+function runQueue (queue, fn, cb) {
+  var step = function (index) {
+    if (index >= queue.length) {
+      cb();
+    } else {
+      if (queue[index]) {
+        fn(queue[index], function () {
+          step(index + 1);
+        });
+      } else {
+        step(index + 1);
+      }
+    }
+  };
+  step(0);
+}
+
+/*  */
+
+function resolveAsyncComponents (matched) {
+  return function (to, from, next) {
+    var hasAsync = false;
+    var pending = 0;
+    var error = null;
+
+    flatMapComponents(matched, function (def, _, match, key) {
+      // if it's a function and doesn't have cid attached,
+      // assume it's an async component resolve function.
+      // we are not using Vue's default async resolving mechanism because
+      // we want to halt the navigation until the incoming component has been
+      // resolved.
+      if (typeof def === 'function' && def.cid === undefined) {
+        hasAsync = true;
+        pending++;
+
+        var resolve = once(function (resolvedDef) {
+          if (resolvedDef.__esModule && resolvedDef.default) {
+            resolvedDef = resolvedDef.default;
+          }
+          // save resolved on async factory in case it's used elsewhere
+          def.resolved = typeof resolvedDef === 'function'
+            ? resolvedDef
+            : _Vue.extend(resolvedDef);
+          match.components[key] = resolvedDef;
+          pending--;
+          if (pending <= 0) {
+            next();
+          }
+        });
+
+        var reject = once(function (reason) {
+          var msg = "Failed to resolve async component " + key + ": " + reason;
+          "development" !== 'production' && warn(false, msg);
+          if (!error) {
+            error = isError(reason)
+              ? reason
+              : new Error(msg);
+            next(error);
+          }
+        });
+
+        var res;
+        try {
+          res = def(resolve, reject);
+        } catch (e) {
+          reject(e);
+        }
+        if (res) {
+          if (typeof res.then === 'function') {
+            res.then(resolve, reject);
+          } else {
+            // new syntax in Vue 2.3
+            var comp = res.component;
+            if (comp && typeof comp.then === 'function') {
+              comp.then(resolve, reject);
+            }
+          }
+        }
+      }
+    });
+
+    if (!hasAsync) { next(); }
+  }
+}
+
+function flatMapComponents (
+  matched,
+  fn
+) {
+  return flatten(matched.map(function (m) {
+    return Object.keys(m.components).map(function (key) { return fn(
+      m.components[key],
+      m.instances[key],
+      m, key
+    ); })
+  }))
+}
+
+function flatten (arr) {
+  return Array.prototype.concat.apply([], arr)
+}
+
+// in Webpack 2, require.ensure now also returns a Promise
+// so the resolve/reject functions may get called an extra time
+// if the user uses an arrow function shorthand that happens to
+// return that Promise.
+function once (fn) {
+  var called = false;
+  return function () {
+    var args = [], len = arguments.length;
+    while ( len-- ) args[ len ] = arguments[ len ];
+
+    if (called) { return }
+    called = true;
+    return fn.apply(this, args)
+  }
+}
+
+/*  */
+
+var History = function History (router, base) {
+  this.router = router;
+  this.base = normalizeBase(base);
+  // start with a route object that stands for "nowhere"
+  this.current = START;
+  this.pending = null;
+  this.ready = false;
+  this.readyCbs = [];
+  this.readyErrorCbs = [];
+  this.errorCbs = [];
+};
+
+History.prototype.listen = function listen (cb) {
+  this.cb = cb;
+};
+
+History.prototype.onReady = function onReady (cb, errorCb) {
+  if (this.ready) {
+    cb();
+  } else {
+    this.readyCbs.push(cb);
+    if (errorCb) {
+      this.readyErrorCbs.push(errorCb);
+    }
+  }
+};
+
+History.prototype.onError = function onError (errorCb) {
+  this.errorCbs.push(errorCb);
+};
+
+History.prototype.transitionTo = function transitionTo (location, onComplete, onAbort) {
+    var this$1 = this;
+
+  var route = this.router.match(location, this.current);
+  this.confirmTransition(route, function () {
+    this$1.updateRoute(route);
+    onComplete && onComplete(route);
+    this$1.ensureURL();
+
+    // fire ready cbs once
+    if (!this$1.ready) {
+      this$1.ready = true;
+      this$1.readyCbs.forEach(function (cb) { cb(route); });
+    }
+  }, function (err) {
+    if (onAbort) {
+      onAbort(err);
+    }
+    if (err && !this$1.ready) {
+      this$1.ready = true;
+      this$1.readyErrorCbs.forEach(function (cb) { cb(err); });
+    }
+  });
+};
+
+History.prototype.confirmTransition = function confirmTransition (route, onComplete, onAbort) {
+    var this$1 = this;
+
+  var current = this.current;
+  var abort = function (err) {
+    if (isError(err)) {
+      if (this$1.errorCbs.length) {
+        this$1.errorCbs.forEach(function (cb) { cb(err); });
+      } else {
+        warn(false, 'uncaught error during route navigation:');
+        console.error(err);
+      }
+    }
+    onAbort && onAbort(err);
+  };
+  if (
+    isSameRoute(route, current) &&
+    // in the case the route map has been dynamically appended to
+    route.matched.length === current.matched.length
+  ) {
+    this.ensureURL();
+    return abort()
+  }
+
+  var ref = resolveQueue(this.current.matched, route.matched);
+    var updated = ref.updated;
+    var deactivated = ref.deactivated;
+    var activated = ref.activated;
+
+  var queue = [].concat(
+    // in-component leave guards
+    extractLeaveGuards(deactivated),
+    // global before hooks
+    this.router.beforeHooks,
+    // in-component update hooks
+    extractUpdateHooks(updated),
+    // in-config enter guards
+    activated.map(function (m) { return m.beforeEnter; }),
+    // async components
+    resolveAsyncComponents(activated)
+  );
+
+  this.pending = route;
+  var iterator = function (hook, next) {
+    if (this$1.pending !== route) {
+      return abort()
+    }
+    try {
+      hook(route, current, function (to) {
+        if (to === false || isError(to)) {
+          // next(false) -> abort navigation, ensure current URL
+          this$1.ensureURL(true);
+          abort(to);
+        } else if (
+          typeof to === 'string' ||
+          (typeof to === 'object' && (
+            typeof to.path === 'string' ||
+            typeof to.name === 'string'
+          ))
+        ) {
+          // next('/') or next({ path: '/' }) -> redirect
+          abort();
+          if (typeof to === 'object' && to.replace) {
+            this$1.replace(to);
+          } else {
+            this$1.push(to);
+          }
+        } else {
+          // confirm transition and pass on the value
+          next(to);
+        }
+      });
+    } catch (e) {
+      abort(e);
+    }
+  };
+
+  runQueue(queue, iterator, function () {
+    var postEnterCbs = [];
+    var isValid = function () { return this$1.current === route; };
+    // wait until async components are resolved before
+    // extracting in-component enter guards
+    var enterGuards = extractEnterGuards(activated, postEnterCbs, isValid);
+    var queue = enterGuards.concat(this$1.router.resolveHooks);
+    runQueue(queue, iterator, function () {
+      if (this$1.pending !== route) {
+        return abort()
+      }
+      this$1.pending = null;
+      onComplete(route);
+      if (this$1.router.app) {
+        this$1.router.app.$nextTick(function () {
+          postEnterCbs.forEach(function (cb) { cb(); });
+        });
+      }
+    });
+  });
+};
+
+History.prototype.updateRoute = function updateRoute (route) {
+  var prev = this.current;
+  this.current = route;
+  this.cb && this.cb(route);
+  this.router.afterHooks.forEach(function (hook) {
+    hook && hook(route, prev);
+  });
+};
+
+function normalizeBase (base) {
+  if (!base) {
+    if (inBrowser) {
+      // respect <base> tag
+      var baseEl = document.querySelector('base');
+      base = (baseEl && baseEl.getAttribute('href')) || '/';
+      // strip full URL origin
+      base = base.replace(/^https?:\/\/[^\/]+/, '');
+    } else {
+      base = '/';
+    }
+  }
+  // make sure there's the starting slash
+  if (base.charAt(0) !== '/') {
+    base = '/' + base;
+  }
+  // remove trailing slash
+  return base.replace(/\/$/, '')
+}
+
+function resolveQueue (
+  current,
+  next
+) {
+  var i;
+  var max = Math.max(current.length, next.length);
+  for (i = 0; i < max; i++) {
+    if (current[i] !== next[i]) {
+      break
+    }
+  }
+  return {
+    updated: next.slice(0, i),
+    activated: next.slice(i),
+    deactivated: current.slice(i)
+  }
+}
+
+function extractGuards (
+  records,
+  name,
+  bind,
+  reverse
+) {
+  var guards = flatMapComponents(records, function (def, instance, match, key) {
+    var guard = extractGuard(def, name);
+    if (guard) {
+      return Array.isArray(guard)
+        ? guard.map(function (guard) { return bind(guard, instance, match, key); })
+        : bind(guard, instance, match, key)
+    }
+  });
+  return flatten(reverse ? guards.reverse() : guards)
+}
+
+function extractGuard (
+  def,
+  key
+) {
+  if (typeof def !== 'function') {
+    // extend now so that global mixins are applied.
+    def = _Vue.extend(def);
+  }
+  return def.options[key]
+}
+
+function extractLeaveGuards (deactivated) {
+  return extractGuards(deactivated, 'beforeRouteLeave', bindGuard, true)
+}
+
+function extractUpdateHooks (updated) {
+  return extractGuards(updated, 'beforeRouteUpdate', bindGuard)
+}
+
+function bindGuard (guard, instance) {
+  if (instance) {
+    return function boundRouteGuard () {
+      return guard.apply(instance, arguments)
+    }
+  }
+}
+
+function extractEnterGuards (
+  activated,
+  cbs,
+  isValid
+) {
+  return extractGuards(activated, 'beforeRouteEnter', function (guard, _, match, key) {
+    return bindEnterGuard(guard, match, key, cbs, isValid)
+  })
+}
+
+function bindEnterGuard (
+  guard,
+  match,
+  key,
+  cbs,
+  isValid
+) {
+  return function routeEnterGuard (to, from, next) {
+    return guard(to, from, function (cb) {
+      next(cb);
+      if (typeof cb === 'function') {
+        cbs.push(function () {
+          // #750
+          // if a router-view is wrapped with an out-in transition,
+          // the instance may not have been registered at this time.
+          // we will need to poll for registration until current route
+          // is no longer valid.
+          poll(cb, match.instances, key, isValid);
+        });
+      }
+    })
+  }
+}
+
+function poll (
+  cb, // somehow flow cannot infer this is a function
+  instances,
+  key,
+  isValid
+) {
+  if (instances[key]) {
+    cb(instances[key]);
+  } else if (isValid()) {
+    setTimeout(function () {
+      poll(cb, instances, key, isValid);
+    }, 16);
+  }
+}
+
+/*  */
+
+
+var HTML5History = (function (History$$1) {
+  function HTML5History (router, base) {
+    var this$1 = this;
+
+    History$$1.call(this, router, base);
+
+    var expectScroll = router.options.scrollBehavior;
+
+    if (expectScroll) {
+      setupScroll();
+    }
+
+    window.addEventListener('popstate', function (e) {
+      var current = this$1.current;
+      this$1.transitionTo(getLocation(this$1.base), function (route) {
+        if (expectScroll) {
+          handleScroll(router, route, current, true);
+        }
+      });
+    });
+  }
+
+  if ( History$$1 ) HTML5History.__proto__ = History$$1;
+  HTML5History.prototype = Object.create( History$$1 && History$$1.prototype );
+  HTML5History.prototype.constructor = HTML5History;
+
+  HTML5History.prototype.go = function go (n) {
+    window.history.go(n);
+  };
+
+  HTML5History.prototype.push = function push (location, onComplete, onAbort) {
+    var this$1 = this;
+
+    var ref = this;
+    var fromRoute = ref.current;
+    this.transitionTo(location, function (route) {
+      pushState(cleanPath(this$1.base + route.fullPath));
+      handleScroll(this$1.router, route, fromRoute, false);
+      onComplete && onComplete(route);
+    }, onAbort);
+  };
+
+  HTML5History.prototype.replace = function replace (location, onComplete, onAbort) {
+    var this$1 = this;
+
+    var ref = this;
+    var fromRoute = ref.current;
+    this.transitionTo(location, function (route) {
+      replaceState(cleanPath(this$1.base + route.fullPath));
+      handleScroll(this$1.router, route, fromRoute, false);
+      onComplete && onComplete(route);
+    }, onAbort);
+  };
+
+  HTML5History.prototype.ensureURL = function ensureURL (push) {
+    if (getLocation(this.base) !== this.current.fullPath) {
+      var current = cleanPath(this.base + this.current.fullPath);
+      push ? pushState(current) : replaceState(current);
+    }
+  };
+
+  HTML5History.prototype.getCurrentLocation = function getCurrentLocation () {
+    return getLocation(this.base)
+  };
+
+  return HTML5History;
+}(History));
+
+function getLocation (base) {
+  var path = window.location.pathname;
+  if (base && path.indexOf(base) === 0) {
+    path = path.slice(base.length);
+  }
+  return (path || '/') + window.location.search + window.location.hash
+}
+
+/*  */
+
+
+var HashHistory = (function (History$$1) {
+  function HashHistory (router, base, fallback) {
+    History$$1.call(this, router, base);
+    // check history fallback deeplinking
+    if (fallback && checkFallback(this.base)) {
+      return
+    }
+    ensureSlash();
+  }
+
+  if ( History$$1 ) HashHistory.__proto__ = History$$1;
+  HashHistory.prototype = Object.create( History$$1 && History$$1.prototype );
+  HashHistory.prototype.constructor = HashHistory;
+
+  // this is delayed until the app mounts
+  // to avoid the hashchange listener being fired too early
+  HashHistory.prototype.setupListeners = function setupListeners () {
+    var this$1 = this;
+
+    window.addEventListener('hashchange', function () {
+      if (!ensureSlash()) {
+        return
+      }
+      this$1.transitionTo(getHash(), function (route) {
+        replaceHash(route.fullPath);
+      });
+    });
+  };
+
+  HashHistory.prototype.push = function push (location, onComplete, onAbort) {
+    this.transitionTo(location, function (route) {
+      pushHash(route.fullPath);
+      onComplete && onComplete(route);
+    }, onAbort);
+  };
+
+  HashHistory.prototype.replace = function replace (location, onComplete, onAbort) {
+    this.transitionTo(location, function (route) {
+      replaceHash(route.fullPath);
+      onComplete && onComplete(route);
+    }, onAbort);
+  };
+
+  HashHistory.prototype.go = function go (n) {
+    window.history.go(n);
+  };
+
+  HashHistory.prototype.ensureURL = function ensureURL (push) {
+    var current = this.current.fullPath;
+    if (getHash() !== current) {
+      push ? pushHash(current) : replaceHash(current);
+    }
+  };
+
+  HashHistory.prototype.getCurrentLocation = function getCurrentLocation () {
+    return getHash()
+  };
+
+  return HashHistory;
+}(History));
+
+function checkFallback (base) {
+  var location = getLocation(base);
+  if (!/^\/#/.test(location)) {
+    window.location.replace(
+      cleanPath(base + '/#' + location)
+    );
+    return true
+  }
+}
+
+function ensureSlash () {
+  var path = getHash();
+  if (path.charAt(0) === '/') {
+    return true
+  }
+  replaceHash('/' + path);
+  return false
+}
+
+function getHash () {
+  // We can't use window.location.hash here because it's not
+  // consistent across browsers - Firefox will pre-decode it!
+  var href = window.location.href;
+  var index = href.indexOf('#');
+  return index === -1 ? '' : href.slice(index + 1)
+}
+
+function pushHash (path) {
+  window.location.hash = path;
+}
+
+function replaceHash (path) {
+  var href = window.location.href;
+  var i = href.indexOf('#');
+  var base = i >= 0 ? href.slice(0, i) : href;
+  window.location.replace((base + "#" + path));
+}
+
+/*  */
+
+
+var AbstractHistory = (function (History$$1) {
+  function AbstractHistory (router, base) {
+    History$$1.call(this, router, base);
+    this.stack = [];
+    this.index = -1;
+  }
+
+  if ( History$$1 ) AbstractHistory.__proto__ = History$$1;
+  AbstractHistory.prototype = Object.create( History$$1 && History$$1.prototype );
+  AbstractHistory.prototype.constructor = AbstractHistory;
+
+  AbstractHistory.prototype.push = function push (location, onComplete, onAbort) {
+    var this$1 = this;
+
+    this.transitionTo(location, function (route) {
+      this$1.stack = this$1.stack.slice(0, this$1.index + 1).concat(route);
+      this$1.index++;
+      onComplete && onComplete(route);
+    }, onAbort);
+  };
+
+  AbstractHistory.prototype.replace = function replace (location, onComplete, onAbort) {
+    var this$1 = this;
+
+    this.transitionTo(location, function (route) {
+      this$1.stack = this$1.stack.slice(0, this$1.index).concat(route);
+      onComplete && onComplete(route);
+    }, onAbort);
+  };
+
+  AbstractHistory.prototype.go = function go (n) {
+    var this$1 = this;
+
+    var targetIndex = this.index + n;
+    if (targetIndex < 0 || targetIndex >= this.stack.length) {
+      return
+    }
+    var route = this.stack[targetIndex];
+    this.confirmTransition(route, function () {
+      this$1.index = targetIndex;
+      this$1.updateRoute(route);
+    });
+  };
+
+  AbstractHistory.prototype.getCurrentLocation = function getCurrentLocation () {
+    var current = this.stack[this.stack.length - 1];
+    return current ? current.fullPath : '/'
+  };
+
+  AbstractHistory.prototype.ensureURL = function ensureURL () {
+    // noop
+  };
+
+  return AbstractHistory;
+}(History));
+
+/*  */
+
+var VueRouter = function VueRouter (options) {
+  if ( options === void 0 ) options = {};
+
+  this.app = null;
+  this.apps = [];
+  this.options = options;
+  this.beforeHooks = [];
+  this.resolveHooks = [];
+  this.afterHooks = [];
+  this.matcher = createMatcher(options.routes || [], this);
+
+  var mode = options.mode || 'hash';
+  this.fallback = mode === 'history' && !supportsPushState && options.fallback !== false;
+  if (this.fallback) {
+    mode = 'hash';
+  }
+  if (!inBrowser) {
+    mode = 'abstract';
+  }
+  this.mode = mode;
+
+  switch (mode) {
+    case 'history':
+      this.history = new HTML5History(this, options.base);
+      break
+    case 'hash':
+      this.history = new HashHistory(this, options.base, this.fallback);
+      break
+    case 'abstract':
+      this.history = new AbstractHistory(this, options.base);
+      break
+    default:
+      {
+        assert(false, ("invalid mode: " + mode));
+      }
+  }
+};
+
+var prototypeAccessors = { currentRoute: {} };
+
+VueRouter.prototype.match = function match (
+  raw,
+  current,
+  redirectedFrom
+) {
+  return this.matcher.match(raw, current, redirectedFrom)
+};
+
+prototypeAccessors.currentRoute.get = function () {
+  return this.history && this.history.current
+};
+
+VueRouter.prototype.init = function init (app /* Vue component instance */) {
+    var this$1 = this;
+
+  "development" !== 'production' && assert(
+    install.installed,
+    "not installed. Make sure to call `Vue.use(VueRouter)` " +
+    "before creating root instance."
+  );
+
+  this.apps.push(app);
+
+  // main app already initialized.
+  if (this.app) {
+    return
+  }
+
+  this.app = app;
+
+  var history = this.history;
+
+  if (history instanceof HTML5History) {
+    history.transitionTo(history.getCurrentLocation());
+  } else if (history instanceof HashHistory) {
+    var setupHashListener = function () {
+      history.setupListeners();
+    };
+    history.transitionTo(
+      history.getCurrentLocation(),
+      setupHashListener,
+      setupHashListener
+    );
+  }
+
+  history.listen(function (route) {
+    this$1.apps.forEach(function (app) {
+      app._route = route;
+    });
+  });
+};
+
+VueRouter.prototype.beforeEach = function beforeEach (fn) {
+  return registerHook(this.beforeHooks, fn)
+};
+
+VueRouter.prototype.beforeResolve = function beforeResolve (fn) {
+  return registerHook(this.resolveHooks, fn)
+};
+
+VueRouter.prototype.afterEach = function afterEach (fn) {
+  return registerHook(this.afterHooks, fn)
+};
+
+VueRouter.prototype.onReady = function onReady (cb, errorCb) {
+  this.history.onReady(cb, errorCb);
+};
+
+VueRouter.prototype.onError = function onError (errorCb) {
+  this.history.onError(errorCb);
+};
+
+VueRouter.prototype.push = function push (location, onComplete, onAbort) {
+  this.history.push(location, onComplete, onAbort);
+};
+
+VueRouter.prototype.replace = function replace (location, onComplete, onAbort) {
+  this.history.replace(location, onComplete, onAbort);
+};
+
+VueRouter.prototype.go = function go (n) {
+  this.history.go(n);
+};
+
+VueRouter.prototype.back = function back () {
+  this.go(-1);
+};
+
+VueRouter.prototype.forward = function forward () {
+  this.go(1);
+};
+
+VueRouter.prototype.getMatchedComponents = function getMatchedComponents (to) {
+  var route = to
+    ? to.matched
+      ? to
+      : this.resolve(to).route
+    : this.currentRoute;
+  if (!route) {
+    return []
+  }
+  return [].concat.apply([], route.matched.map(function (m) {
+    return Object.keys(m.components).map(function (key) {
+      return m.components[key]
+    })
+  }))
+};
+
+VueRouter.prototype.resolve = function resolve (
+  to,
+  current,
+  append
+) {
+  var location = normalizeLocation(
+    to,
+    current || this.history.current,
+    append,
+    this
+  );
+  var route = this.match(location, current);
+  var fullPath = route.redirectedFrom || route.fullPath;
+  var base = this.history.base;
+  var href = createHref(base, fullPath, this.mode);
+  return {
+    location: location,
+    route: route,
+    href: href,
+    // for backwards compat
+    normalizedTo: location,
+    resolved: route
+  }
+};
+
+VueRouter.prototype.addRoutes = function addRoutes (routes) {
+  this.matcher.addRoutes(routes);
+  if (this.history.current !== START) {
+    this.history.transitionTo(this.history.getCurrentLocation());
+  }
+};
+
+Object.defineProperties( VueRouter.prototype, prototypeAccessors );
+
+function registerHook (list, fn) {
+  list.push(fn);
+  return function () {
+    var i = list.indexOf(fn);
+    if (i > -1) { list.splice(i, 1); }
+  }
+}
+
+function createHref (base, fullPath, mode) {
+  var path = mode === 'hash' ? '#' + fullPath : fullPath;
+  return base ? cleanPath(base + '/' + path) : path
+}
+
+VueRouter.install = install;
+VueRouter.version = '2.7.0';
+
+if (inBrowser && window.Vue) {
+  window.Vue.use(VueRouter);
+}
+
+return VueRouter;
+
+})));
diff --git a/ee/bulk-operations-dashboard/assets/dependencies/vue.js b/ee/bulk-operations-dashboard/assets/dependencies/vue.js
new file mode 100644
index 0000000000..ca93c9893d
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/dependencies/vue.js
@@ -0,0 +1,10979 @@
+/*!
+ * Vue.js v2.5.17
+ * (c) 2014-2018 Evan You
+ * Released under the MIT License.
+ *
+ * > w/ slight modifications for easier default handling of dev vs. prod logging
+ * > Modifications (c) 2018-present Mike McNeil, MIT License)
+ * > (To see modifications in isolation, run a diff versus vanilla Vue.js)
+ */
+(function (global, factory) {
+  //------------------------------------------------------------
+  //  ██╗    ██╗ █████╗ ██████╗ ███╗   ██╗██╗███╗   ██╗ ██████╗
+  //  ██║    ██║██╔══██╗██╔══██╗████╗  ██║██║████╗  ██║██╔════╝
+  //  ██║ █╗ ██║███████║██████╔╝██╔██╗ ██║██║██╔██╗ ██║██║  ███╗
+  //  ██║███╗██║██╔══██║██╔══██╗██║╚██╗██║██║██║╚██╗██║██║   ██║
+  //  ╚███╔███╔╝██║  ██║██║  ██║██║ ╚████║██║██║ ╚████║╚██████╔╝
+  //   ╚══╝╚══╝ ╚═╝  ╚═╝╚═╝  ╚═╝╚═╝  ╚═══╝╚═╝╚═╝  ╚═══╝ ╚═════╝
+  //
+  // For convenience, this version of Vue.js has been modified
+  // to use a runtime check when determining whether it is being
+  // run in development or production mode, and thus whether or not
+  // to display the "Development Mode" console warning.
+  //
+  // To determine this, we use the `SAILS_LOCALS` global;
+  // specifically its _environment property.  If we don't have
+  // `SAILS_LOCALS` at all, we'll just assume this is running in
+  // production or staging.  This avoids logging unnecessary
+  // warnings and log messages to the browser inspector in the
+  // production environment (e.g. on the 404 page).
+  //
+  // > Read more here:
+  // > https://vuejs.org/v2/guide/installation.html#Development-vs-Production-Mode
+  //------------------------------------------------------------
+  var IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE = (
+    global &&
+    global.SAILS_LOCALS &&
+    typeof global.SAILS_LOCALS === 'object' &&
+    (global.SAILS_LOCALS._environment === 'staging' || global.SAILS_LOCALS._environment === 'production')
+  );
+  if(!global || !global.SAILS_LOCALS) {
+    IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE = true;
+  }
+  //------------------------------------------------------------
+  typeof exports === 'object' && typeof module !== 'undefined' ? module.exports = factory() :
+  typeof define === 'function' && define.amd ? define(factory) :
+  (global.Vue = factory(IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE));
+}(this, (function (IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE) { 'use strict';
+
+/*  */
+
+var emptyObject = Object.freeze({});
+
+// these helpers produces better vm code in JS engines due to their
+// explicitness and function inlining
+function isUndef (v) {
+  return v === undefined || v === null
+}
+
+function isDef (v) {
+  return v !== undefined && v !== null
+}
+
+function isTrue (v) {
+  return v === true
+}
+
+function isFalse (v) {
+  return v === false
+}
+
+/**
+ * Check if value is primitive
+ */
+function isPrimitive (value) {
+  return (
+    typeof value === 'string' ||
+    typeof value === 'number' ||
+    // $flow-disable-line
+    typeof value === 'symbol' ||
+    typeof value === 'boolean'
+  )
+}
+
+/**
+ * Quick object check - this is primarily used to tell
+ * Objects from primitive values when we know the value
+ * is a JSON-compliant type.
+ */
+function isObject (obj) {
+  return obj !== null && typeof obj === 'object'
+}
+
+/**
+ * Get the raw type string of a value e.g. [object Object]
+ */
+var _toString = Object.prototype.toString;
+
+function toRawType (value) {
+  return _toString.call(value).slice(8, -1)
+}
+
+/**
+ * Strict object type check. Only returns true
+ * for plain JavaScript objects.
+ */
+function isPlainObject (obj) {
+  return _toString.call(obj) === '[object Object]'
+}
+
+function isRegExp (v) {
+  return _toString.call(v) === '[object RegExp]'
+}
+
+/**
+ * Check if val is a valid array index.
+ */
+function isValidArrayIndex (val) {
+  var n = parseFloat(String(val));
+  return n >= 0 && Math.floor(n) === n && isFinite(val)
+}
+
+/**
+ * Convert a value to a string that is actually rendered.
+ */
+function toString (val) {
+  return val == null
+    ? ''
+    : typeof val === 'object'
+      ? JSON.stringify(val, null, 2)
+      : String(val)
+}
+
+/**
+ * Convert a input value to a number for persistence.
+ * If the conversion fails, return original string.
+ */
+function toNumber (val) {
+  var n = parseFloat(val);
+  return isNaN(n) ? val : n
+}
+
+/**
+ * Make a map and return a function for checking if a key
+ * is in that map.
+ */
+function makeMap (
+  str,
+  expectsLowerCase
+) {
+  var map = Object.create(null);
+  var list = str.split(',');
+  for (var i = 0; i < list.length; i++) {
+    map[list[i]] = true;
+  }
+  return expectsLowerCase
+    ? function (val) { return map[val.toLowerCase()]; }
+    : function (val) { return map[val]; }
+}
+
+/**
+ * Check if a tag is a built-in tag.
+ */
+var isBuiltInTag = makeMap('slot,component', true);
+
+/**
+ * Check if a attribute is a reserved attribute.
+ */
+var isReservedAttribute = makeMap('key,ref,slot,slot-scope,is');
+
+/**
+ * Remove an item from an array
+ */
+function remove (arr, item) {
+  if (arr.length) {
+    var index = arr.indexOf(item);
+    if (index > -1) {
+      return arr.splice(index, 1)
+    }
+  }
+}
+
+/**
+ * Check whether the object has the property.
+ */
+var hasOwnProperty = Object.prototype.hasOwnProperty;
+function hasOwn (obj, key) {
+  return hasOwnProperty.call(obj, key)
+}
+
+/**
+ * Create a cached version of a pure function.
+ */
+function cached (fn) {
+  var cache = Object.create(null);
+  return (function cachedFn (str) {
+    var hit = cache[str];
+    return hit || (cache[str] = fn(str))
+  })
+}
+
+/**
+ * Camelize a hyphen-delimited string.
+ */
+var camelizeRE = /-(\w)/g;
+var camelize = cached(function (str) {
+  return str.replace(camelizeRE, function (_, c) { return c ? c.toUpperCase() : ''; })
+});
+
+/**
+ * Capitalize a string.
+ */
+var capitalize = cached(function (str) {
+  return str.charAt(0).toUpperCase() + str.slice(1)
+});
+
+/**
+ * Hyphenate a camelCase string.
+ */
+var hyphenateRE = /\B([A-Z])/g;
+var hyphenate = cached(function (str) {
+  return str.replace(hyphenateRE, '-$1').toLowerCase()
+});
+
+/**
+ * Simple bind polyfill for environments that do not support it... e.g.
+ * PhantomJS 1.x. Technically we don't need this anymore since native bind is
+ * now more performant in most browsers, but removing it would be breaking for
+ * code that was able to run in PhantomJS 1.x, so this must be kept for
+ * backwards compatibility.
+ */
+
+/* istanbul ignore next */
+function polyfillBind (fn, ctx) {
+  function boundFn (a) {
+    var l = arguments.length;
+    return l
+      ? l > 1
+        ? fn.apply(ctx, arguments)
+        : fn.call(ctx, a)
+      : fn.call(ctx)
+  }
+
+  boundFn._length = fn.length;
+  return boundFn
+}
+
+function nativeBind (fn, ctx) {
+  return fn.bind(ctx)
+}
+
+var bind = Function.prototype.bind
+  ? nativeBind
+  : polyfillBind;
+
+/**
+ * Convert an Array-like object to a real Array.
+ */
+function toArray (list, start) {
+  start = start || 0;
+  var i = list.length - start;
+  var ret = new Array(i);
+  while (i--) {
+    ret[i] = list[i + start];
+  }
+  return ret
+}
+
+/**
+ * Mix properties into target object.
+ */
+function extend (to, _from) {
+  for (var key in _from) {
+    to[key] = _from[key];
+  }
+  return to
+}
+
+/**
+ * Merge an Array of Objects into a single Object.
+ */
+function toObject (arr) {
+  var res = {};
+  for (var i = 0; i < arr.length; i++) {
+    if (arr[i]) {
+      extend(res, arr[i]);
+    }
+  }
+  return res
+}
+
+/**
+ * Perform no operation.
+ * Stubbing args to make Flow happy without leaving useless transpiled code
+ * with ...rest (https://flow.org/blog/2017/05/07/Strict-Function-Call-Arity/)
+ */
+function noop (a, b, c) {}
+
+/**
+ * Always return false.
+ */
+var no = function (a, b, c) { return false; };
+
+/**
+ * Return same value
+ */
+var identity = function (_) { return _; };
+
+/**
+ * Generate a static keys string from compiler modules.
+ */
+function genStaticKeys (modules) {
+  return modules.reduce(function (keys, m) {
+    return keys.concat(m.staticKeys || [])
+  }, []).join(',')
+}
+
+/**
+ * Check if two values are loosely equal - that is,
+ * if they are plain objects, do they have the same shape?
+ */
+function looseEqual (a, b) {
+  if (a === b) { return true }
+  var isObjectA = isObject(a);
+  var isObjectB = isObject(b);
+  if (isObjectA && isObjectB) {
+    try {
+      var isArrayA = Array.isArray(a);
+      var isArrayB = Array.isArray(b);
+      if (isArrayA && isArrayB) {
+        return a.length === b.length && a.every(function (e, i) {
+          return looseEqual(e, b[i])
+        })
+      } else if (!isArrayA && !isArrayB) {
+        var keysA = Object.keys(a);
+        var keysB = Object.keys(b);
+        return keysA.length === keysB.length && keysA.every(function (key) {
+          return looseEqual(a[key], b[key])
+        })
+      } else {
+        /* istanbul ignore next */
+        return false
+      }
+    } catch (e) {
+      /* istanbul ignore next */
+      return false
+    }
+  } else if (!isObjectA && !isObjectB) {
+    return String(a) === String(b)
+  } else {
+    return false
+  }
+}
+
+function looseIndexOf (arr, val) {
+  for (var i = 0; i < arr.length; i++) {
+    if (looseEqual(arr[i], val)) { return i }
+  }
+  return -1
+}
+
+/**
+ * Ensure a function is called only once.
+ */
+function once (fn) {
+  var called = false;
+  return function () {
+    if (!called) {
+      called = true;
+      fn.apply(this, arguments);
+    }
+  }
+}
+
+var SSR_ATTR = 'data-server-rendered';
+
+var ASSET_TYPES = [
+  'component',
+  'directive',
+  'filter'
+];
+
+var LIFECYCLE_HOOKS = [
+  'beforeCreate',
+  'created',
+  'beforeMount',
+  'mounted',
+  'beforeUpdate',
+  'updated',
+  'beforeDestroy',
+  'destroyed',
+  'activated',
+  'deactivated',
+  'errorCaptured'
+];
+
+/*  */
+
+var config = ({
+  /**
+   * Option merge strategies (used in core/util/options)
+   */
+  // $flow-disable-line
+  optionMergeStrategies: Object.create(null),
+
+  /**
+   * Whether to suppress warnings.
+   */
+  silent: false,
+
+  /**
+   * Show production mode tip message on boot?
+   */
+  productionTip: !IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE,
+
+  /**
+   * Whether to enable devtools
+   */
+  devtools: !IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE,
+
+  /**
+   * Whether to record perf
+   */
+  performance: false,
+
+  /**
+   * Error handler for watcher errors
+   */
+  errorHandler: null,
+
+  /**
+   * Warn handler for watcher warns
+   */
+  warnHandler: null,
+
+  /**
+   * Ignore certain custom elements
+   */
+  ignoredElements: [],
+
+  /**
+   * Custom user key aliases for v-on
+   */
+  // $flow-disable-line
+  keyCodes: Object.create(null),
+
+  /**
+   * Check if a tag is reserved so that it cannot be registered as a
+   * component. This is platform-dependent and may be overwritten.
+   */
+  isReservedTag: no,
+
+  /**
+   * Check if an attribute is reserved so that it cannot be used as a component
+   * prop. This is platform-dependent and may be overwritten.
+   */
+  isReservedAttr: no,
+
+  /**
+   * Check if a tag is an unknown element.
+   * Platform-dependent.
+   */
+  isUnknownElement: no,
+
+  /**
+   * Get the namespace of an element
+   */
+  getTagNamespace: noop,
+
+  /**
+   * Parse the real tag name for the specific platform.
+   */
+  parsePlatformTagName: identity,
+
+  /**
+   * Check if an attribute must be bound using property, e.g. value
+   * Platform-dependent.
+   */
+  mustUseProp: no,
+
+  /**
+   * Exposed for legacy reasons
+   */
+  _lifecycleHooks: LIFECYCLE_HOOKS
+})
+
+/*  */
+
+/**
+ * Check if a string starts with $ or _
+ */
+function isReserved (str) {
+  var c = (str + '').charCodeAt(0);
+  return c === 0x24 || c === 0x5F
+}
+
+/**
+ * Define a property.
+ */
+function def (obj, key, val, enumerable) {
+  Object.defineProperty(obj, key, {
+    value: val,
+    enumerable: !!enumerable,
+    writable: true,
+    configurable: true
+  });
+}
+
+/**
+ * Parse simple path.
+ */
+var bailRE = /[^\w.$]/;
+function parsePath (path) {
+  if (bailRE.test(path)) {
+    return
+  }
+  var segments = path.split('.');
+  return function (obj) {
+    for (var i = 0; i < segments.length; i++) {
+      if (!obj) { return }
+      obj = obj[segments[i]];
+    }
+    return obj
+  }
+}
+
+/*  */
+
+// can we use __proto__?
+var hasProto = '__proto__' in {};
+
+// Browser environment sniffing
+var inBrowser = typeof window !== 'undefined';
+var inWeex = typeof WXEnvironment !== 'undefined' && !!WXEnvironment.platform;
+var weexPlatform = inWeex && WXEnvironment.platform.toLowerCase();
+var UA = inBrowser && window.navigator.userAgent.toLowerCase();
+var isIE = UA && /msie|trident/.test(UA);
+var isIE9 = UA && UA.indexOf('msie 9.0') > 0;
+var isEdge = UA && UA.indexOf('edge/') > 0;
+var isAndroid = (UA && UA.indexOf('android') > 0) || (weexPlatform === 'android');
+var isIOS = (UA && /iphone|ipad|ipod|ios/.test(UA)) || (weexPlatform === 'ios');
+var isChrome = UA && /chrome\/\d+/.test(UA) && !isEdge;
+
+// Firefox has a "watch" function on Object.prototype...
+var nativeWatch = ({}).watch;
+
+var supportsPassive = false;
+if (inBrowser) {
+  try {
+    var opts = {};
+    Object.defineProperty(opts, 'passive', ({
+      get: function get () {
+        /* istanbul ignore next */
+        supportsPassive = true;
+      }
+    })); // https://github.com/facebook/flow/issues/285
+    window.addEventListener('test-passive', null, opts);
+  } catch (e) {}
+}
+
+// this needs to be lazy-evaled because vue may be required before
+// vue-server-renderer can set VUE_ENV
+var _isServer;
+var isServerRendering = function () {
+  if (_isServer === undefined) {
+    /* istanbul ignore if */
+    if (!inBrowser && !inWeex && typeof global !== 'undefined') {
+      // detect presence of vue-server-renderer and avoid
+      // Webpack shimming the process
+      _isServer = global['process'].env.VUE_ENV === 'server';
+    } else {
+      _isServer = false;
+    }
+  }
+  return _isServer
+};
+
+// detect devtools
+var devtools = inBrowser && window.__VUE_DEVTOOLS_GLOBAL_HOOK__;
+
+/* istanbul ignore next */
+function isNative (Ctor) {
+  return typeof Ctor === 'function' && /native code/.test(Ctor.toString())
+}
+
+var hasSymbol =
+  typeof Symbol !== 'undefined' && isNative(Symbol) &&
+  typeof Reflect !== 'undefined' && isNative(Reflect.ownKeys);
+
+var _Set;
+/* istanbul ignore if */ // $flow-disable-line
+if (typeof Set !== 'undefined' && isNative(Set)) {
+  // use native Set when available.
+  _Set = Set;
+} else {
+  // a non-standard Set polyfill that only works with primitive keys.
+  _Set = (function () {
+    function Set () {
+      this.set = Object.create(null);
+    }
+    Set.prototype.has = function has (key) {
+      return this.set[key] === true
+    };
+    Set.prototype.add = function add (key) {
+      this.set[key] = true;
+    };
+    Set.prototype.clear = function clear () {
+      this.set = Object.create(null);
+    };
+
+    return Set;
+  }());
+}
+
+/*  */
+
+var warn = noop;
+var tip = noop;
+var generateComponentTrace = (noop); // work around flow check
+var formatComponentName = (noop);
+
+{
+  var hasConsole = typeof console !== 'undefined';
+  var classifyRE = /(?:^|[-_])(\w)/g;
+  var classify = function (str) { return str
+    .replace(classifyRE, function (c) { return c.toUpperCase(); })
+    .replace(/[-_]/g, ''); };
+
+  warn = function (msg, vm) {
+    var trace = vm ? generateComponentTrace(vm) : '';
+
+    if (config.warnHandler) {
+      config.warnHandler.call(null, msg, vm, trace);
+    } else if (hasConsole && (!config.silent)) {
+      console.error(("[Vue warn]: " + msg + trace));
+    }
+  };
+
+  tip = function (msg, vm) {
+    if (hasConsole && (!config.silent)) {
+      console.warn("[Vue tip]: " + msg + (
+        vm ? generateComponentTrace(vm) : ''
+      ));
+    }
+  };
+
+  formatComponentName = function (vm, includeFile) {
+    if (vm.$root === vm) {
+      return '<Root>'
+    }
+    var options = typeof vm === 'function' && vm.cid != null
+      ? vm.options
+      : vm._isVue
+        ? vm.$options || vm.constructor.options
+        : vm || {};
+    var name = options.name || options._componentTag;
+    var file = options.__file;
+    if (!name && file) {
+      var match = file.match(/([^/\\]+)\.vue$/);
+      name = match && match[1];
+    }
+
+    return (
+      (name ? ("<" + (classify(name)) + ">") : "<Anonymous>") +
+      (file && includeFile !== false ? (" at " + file) : '')
+    )
+  };
+
+  var repeat = function (str, n) {
+    var res = '';
+    while (n) {
+      if (n % 2 === 1) { res += str; }
+      if (n > 1) { str += str; }
+      n >>= 1;
+    }
+    return res
+  };
+
+  generateComponentTrace = function (vm) {
+    if (vm._isVue && vm.$parent) {
+      var tree = [];
+      var currentRecursiveSequence = 0;
+      while (vm) {
+        if (tree.length > 0) {
+          var last = tree[tree.length - 1];
+          if (last.constructor === vm.constructor) {
+            currentRecursiveSequence++;
+            vm = vm.$parent;
+            continue
+          } else if (currentRecursiveSequence > 0) {
+            tree[tree.length - 1] = [last, currentRecursiveSequence];
+            currentRecursiveSequence = 0;
+          }
+        }
+        tree.push(vm);
+        vm = vm.$parent;
+      }
+      return '\n\nfound in\n\n' + tree
+        .map(function (vm, i) { return ("" + (i === 0 ? '---> ' : repeat(' ', 5 + i * 2)) + (Array.isArray(vm)
+            ? ((formatComponentName(vm[0])) + "... (" + (vm[1]) + " recursive calls)")
+            : formatComponentName(vm))); })
+        .join('\n')
+    } else {
+      return ("\n\n(found in " + (formatComponentName(vm)) + ")")
+    }
+  };
+}
+
+/*  */
+
+
+var uid = 0;
+
+/**
+ * A dep is an observable that can have multiple
+ * directives subscribing to it.
+ */
+var Dep = function Dep () {
+  this.id = uid++;
+  this.subs = [];
+};
+
+Dep.prototype.addSub = function addSub (sub) {
+  this.subs.push(sub);
+};
+
+Dep.prototype.removeSub = function removeSub (sub) {
+  remove(this.subs, sub);
+};
+
+Dep.prototype.depend = function depend () {
+  if (Dep.target) {
+    Dep.target.addDep(this);
+  }
+};
+
+Dep.prototype.notify = function notify () {
+  // stabilize the subscriber list first
+  var subs = this.subs.slice();
+  for (var i = 0, l = subs.length; i < l; i++) {
+    subs[i].update();
+  }
+};
+
+// the current target watcher being evaluated.
+// this is globally unique because there could be only one
+// watcher being evaluated at any time.
+Dep.target = null;
+var targetStack = [];
+
+function pushTarget (_target) {
+  if (Dep.target) { targetStack.push(Dep.target); }
+  Dep.target = _target;
+}
+
+function popTarget () {
+  Dep.target = targetStack.pop();
+}
+
+/*  */
+
+var VNode = function VNode (
+  tag,
+  data,
+  children,
+  text,
+  elm,
+  context,
+  componentOptions,
+  asyncFactory
+) {
+  this.tag = tag;
+  this.data = data;
+  this.children = children;
+  this.text = text;
+  this.elm = elm;
+  this.ns = undefined;
+  this.context = context;
+  this.fnContext = undefined;
+  this.fnOptions = undefined;
+  this.fnScopeId = undefined;
+  this.key = data && data.key;
+  this.componentOptions = componentOptions;
+  this.componentInstance = undefined;
+  this.parent = undefined;
+  this.raw = false;
+  this.isStatic = false;
+  this.isRootInsert = true;
+  this.isComment = false;
+  this.isCloned = false;
+  this.isOnce = false;
+  this.asyncFactory = asyncFactory;
+  this.asyncMeta = undefined;
+  this.isAsyncPlaceholder = false;
+};
+
+var prototypeAccessors = { child: { configurable: true } };
+
+// DEPRECATED: alias for componentInstance for backwards compat.
+/* istanbul ignore next */
+prototypeAccessors.child.get = function () {
+  return this.componentInstance
+};
+
+Object.defineProperties( VNode.prototype, prototypeAccessors );
+
+var createEmptyVNode = function (text) {
+  if ( text === void 0 ) text = '';
+
+  var node = new VNode();
+  node.text = text;
+  node.isComment = true;
+  return node
+};
+
+function createTextVNode (val) {
+  return new VNode(undefined, undefined, undefined, String(val))
+}
+
+// optimized shallow clone
+// used for static nodes and slot nodes because they may be reused across
+// multiple renders, cloning them avoids errors when DOM manipulations rely
+// on their elm reference.
+function cloneVNode (vnode) {
+  var cloned = new VNode(
+    vnode.tag,
+    vnode.data,
+    vnode.children,
+    vnode.text,
+    vnode.elm,
+    vnode.context,
+    vnode.componentOptions,
+    vnode.asyncFactory
+  );
+  cloned.ns = vnode.ns;
+  cloned.isStatic = vnode.isStatic;
+  cloned.key = vnode.key;
+  cloned.isComment = vnode.isComment;
+  cloned.fnContext = vnode.fnContext;
+  cloned.fnOptions = vnode.fnOptions;
+  cloned.fnScopeId = vnode.fnScopeId;
+  cloned.isCloned = true;
+  return cloned
+}
+
+/*
+ * not type checking this file because flow doesn't play well with
+ * dynamically accessing methods on Array prototype
+ */
+
+var arrayProto = Array.prototype;
+var arrayMethods = Object.create(arrayProto);
+
+var methodsToPatch = [
+  'push',
+  'pop',
+  'shift',
+  'unshift',
+  'splice',
+  'sort',
+  'reverse'
+];
+
+/**
+ * Intercept mutating methods and emit events
+ */
+methodsToPatch.forEach(function (method) {
+  // cache original method
+  var original = arrayProto[method];
+  def(arrayMethods, method, function mutator () {
+    var args = [], len = arguments.length;
+    while ( len-- ) args[ len ] = arguments[ len ];
+
+    var result = original.apply(this, args);
+    var ob = this.__ob__;
+    var inserted;
+    switch (method) {
+      case 'push':
+      case 'unshift':
+        inserted = args;
+        break
+      case 'splice':
+        inserted = args.slice(2);
+        break
+    }
+    if (inserted) { ob.observeArray(inserted); }
+    // notify change
+    ob.dep.notify();
+    return result
+  });
+});
+
+/*  */
+
+var arrayKeys = Object.getOwnPropertyNames(arrayMethods);
+
+/**
+ * In some cases we may want to disable observation inside a component's
+ * update computation.
+ */
+var shouldObserve = true;
+
+function toggleObserving (value) {
+  shouldObserve = value;
+}
+
+/**
+ * Observer class that is attached to each observed
+ * object. Once attached, the observer converts the target
+ * object's property keys into getter/setters that
+ * collect dependencies and dispatch updates.
+ */
+var Observer = function Observer (value) {
+  this.value = value;
+  this.dep = new Dep();
+  this.vmCount = 0;
+  def(value, '__ob__', this);
+  if (Array.isArray(value)) {
+    var augment = hasProto
+      ? protoAugment
+      : copyAugment;
+    augment(value, arrayMethods, arrayKeys);
+    this.observeArray(value);
+  } else {
+    this.walk(value);
+  }
+};
+
+/**
+ * Walk through each property and convert them into
+ * getter/setters. This method should only be called when
+ * value type is Object.
+ */
+Observer.prototype.walk = function walk (obj) {
+  var keys = Object.keys(obj);
+  for (var i = 0; i < keys.length; i++) {
+    defineReactive(obj, keys[i]);
+  }
+};
+
+/**
+ * Observe a list of Array items.
+ */
+Observer.prototype.observeArray = function observeArray (items) {
+  for (var i = 0, l = items.length; i < l; i++) {
+    observe(items[i]);
+  }
+};
+
+// helpers
+
+/**
+ * Augment an target Object or Array by intercepting
+ * the prototype chain using __proto__
+ */
+function protoAugment (target, src, keys) {
+  /* eslint-disable no-proto */
+  target.__proto__ = src;
+  /* eslint-enable no-proto */
+}
+
+/**
+ * Augment an target Object or Array by defining
+ * hidden properties.
+ */
+/* istanbul ignore next */
+function copyAugment (target, src, keys) {
+  for (var i = 0, l = keys.length; i < l; i++) {
+    var key = keys[i];
+    def(target, key, src[key]);
+  }
+}
+
+/**
+ * Attempt to create an observer instance for a value,
+ * returns the new observer if successfully observed,
+ * or the existing observer if the value already has one.
+ */
+function observe (value, asRootData) {
+  if (!isObject(value) || value instanceof VNode) {
+    return
+  }
+  var ob;
+  if (hasOwn(value, '__ob__') && value.__ob__ instanceof Observer) {
+    ob = value.__ob__;
+  } else if (
+    shouldObserve &&
+    !isServerRendering() &&
+    (Array.isArray(value) || isPlainObject(value)) &&
+    Object.isExtensible(value) &&
+    !value._isVue
+  ) {
+    ob = new Observer(value);
+  }
+  if (asRootData && ob) {
+    ob.vmCount++;
+  }
+  return ob
+}
+
+/**
+ * Define a reactive property on an Object.
+ */
+function defineReactive (
+  obj,
+  key,
+  val,
+  customSetter,
+  shallow
+) {
+  var dep = new Dep();
+
+  var property = Object.getOwnPropertyDescriptor(obj, key);
+  if (property && property.configurable === false) {
+    return
+  }
+
+  // cater for pre-defined getter/setters
+  var getter = property && property.get;
+  if (!getter && arguments.length === 2) {
+    val = obj[key];
+  }
+  var setter = property && property.set;
+
+  var childOb = !shallow && observe(val);
+  Object.defineProperty(obj, key, {
+    enumerable: true,
+    configurable: true,
+    get: function reactiveGetter () {
+      var value = getter ? getter.call(obj) : val;
+      if (Dep.target) {
+        dep.depend();
+        if (childOb) {
+          childOb.dep.depend();
+          if (Array.isArray(value)) {
+            dependArray(value);
+          }
+        }
+      }
+      return value
+    },
+    set: function reactiveSetter (newVal) {
+      var value = getter ? getter.call(obj) : val;
+      /* eslint-disable no-self-compare */
+      if (newVal === value || (newVal !== newVal && value !== value)) {
+        return
+      }
+      /* eslint-enable no-self-compare */
+      if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && customSetter) {
+        customSetter();
+      }
+      if (setter) {
+        setter.call(obj, newVal);
+      } else {
+        val = newVal;
+      }
+      childOb = !shallow && observe(newVal);
+      dep.notify();
+    }
+  });
+}
+
+/**
+ * Set a property on an object. Adds the new property and
+ * triggers change notification if the property doesn't
+ * already exist.
+ */
+function set (target, key, val) {
+  if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE &&
+    (isUndef(target) || isPrimitive(target))
+  ) {
+    warn(("Cannot set reactive property on undefined, null, or primitive value: " + ((target))));
+  }
+  if (Array.isArray(target) && isValidArrayIndex(key)) {
+    target.length = Math.max(target.length, key);
+    target.splice(key, 1, val);
+    return val
+  }
+  if (key in target && !(key in Object.prototype)) {
+    target[key] = val;
+    return val
+  }
+  var ob = (target).__ob__;
+  if (target._isVue || (ob && ob.vmCount)) {
+    !IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && warn(
+      'Avoid adding reactive properties to a Vue instance or its root $data ' +
+      'at runtime - declare it upfront in the data option.'
+    );
+    return val
+  }
+  if (!ob) {
+    target[key] = val;
+    return val
+  }
+  defineReactive(ob.value, key, val);
+  ob.dep.notify();
+  return val
+}
+
+/**
+ * Delete a property and trigger change if necessary.
+ */
+function del (target, key) {
+  if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE &&
+    (isUndef(target) || isPrimitive(target))
+  ) {
+    warn(("Cannot delete reactive property on undefined, null, or primitive value: " + ((target))));
+  }
+  if (Array.isArray(target) && isValidArrayIndex(key)) {
+    target.splice(key, 1);
+    return
+  }
+  var ob = (target).__ob__;
+  if (target._isVue || (ob && ob.vmCount)) {
+    !IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && warn(
+      'Avoid deleting properties on a Vue instance or its root $data ' +
+      '- just set it to null.'
+    );
+    return
+  }
+  if (!hasOwn(target, key)) {
+    return
+  }
+  delete target[key];
+  if (!ob) {
+    return
+  }
+  ob.dep.notify();
+}
+
+/**
+ * Collect dependencies on array elements when the array is touched, since
+ * we cannot intercept array element access like property getters.
+ */
+function dependArray (value) {
+  for (var e = (void 0), i = 0, l = value.length; i < l; i++) {
+    e = value[i];
+    e && e.__ob__ && e.__ob__.dep.depend();
+    if (Array.isArray(e)) {
+      dependArray(e);
+    }
+  }
+}
+
+/*  */
+
+/**
+ * Option overwriting strategies are functions that handle
+ * how to merge a parent option value and a child option
+ * value into the final value.
+ */
+var strats = config.optionMergeStrategies;
+
+/**
+ * Options with restrictions
+ */
+{
+  strats.el = strats.propsData = function (parent, child, vm, key) {
+    if (!vm) {
+      warn(
+        "option \"" + key + "\" can only be used during instance " +
+        'creation with the `new` keyword.'
+      );
+    }
+    return defaultStrat(parent, child)
+  };
+}
+
+/**
+ * Helper that recursively merges two data objects together.
+ */
+function mergeData (to, from) {
+  if (!from) { return to }
+  var key, toVal, fromVal;
+  var keys = Object.keys(from);
+  for (var i = 0; i < keys.length; i++) {
+    key = keys[i];
+    toVal = to[key];
+    fromVal = from[key];
+    if (!hasOwn(to, key)) {
+      set(to, key, fromVal);
+    } else if (isPlainObject(toVal) && isPlainObject(fromVal)) {
+      mergeData(toVal, fromVal);
+    }
+  }
+  return to
+}
+
+/**
+ * Data
+ */
+function mergeDataOrFn (
+  parentVal,
+  childVal,
+  vm
+) {
+  if (!vm) {
+    // in a Vue.extend merge, both should be functions
+    if (!childVal) {
+      return parentVal
+    }
+    if (!parentVal) {
+      return childVal
+    }
+    // when parentVal & childVal are both present,
+    // we need to return a function that returns the
+    // merged result of both functions... no need to
+    // check if parentVal is a function here because
+    // it has to be a function to pass previous merges.
+    return function mergedDataFn () {
+      return mergeData(
+        typeof childVal === 'function' ? childVal.call(this, this) : childVal,
+        typeof parentVal === 'function' ? parentVal.call(this, this) : parentVal
+      )
+    }
+  } else {
+    return function mergedInstanceDataFn () {
+      // instance merge
+      var instanceData = typeof childVal === 'function'
+        ? childVal.call(vm, vm)
+        : childVal;
+      var defaultData = typeof parentVal === 'function'
+        ? parentVal.call(vm, vm)
+        : parentVal;
+      if (instanceData) {
+        return mergeData(instanceData, defaultData)
+      } else {
+        return defaultData
+      }
+    }
+  }
+}
+
+strats.data = function (
+  parentVal,
+  childVal,
+  vm
+) {
+  if (!vm) {
+    if (childVal && typeof childVal !== 'function') {
+      !IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && warn(
+        'The "data" option should be a function ' +
+        'that returns a per-instance value in component ' +
+        'definitions.',
+        vm
+      );
+
+      return parentVal
+    }
+    return mergeDataOrFn(parentVal, childVal)
+  }
+
+  return mergeDataOrFn(parentVal, childVal, vm)
+};
+
+/**
+ * Hooks and props are merged as arrays.
+ */
+function mergeHook (
+  parentVal,
+  childVal
+) {
+  return childVal
+    ? parentVal
+      ? parentVal.concat(childVal)
+      : Array.isArray(childVal)
+        ? childVal
+        : [childVal]
+    : parentVal
+}
+
+LIFECYCLE_HOOKS.forEach(function (hook) {
+  strats[hook] = mergeHook;
+});
+
+/**
+ * Assets
+ *
+ * When a vm is present (instance creation), we need to do
+ * a three-way merge between constructor options, instance
+ * options and parent options.
+ */
+function mergeAssets (
+  parentVal,
+  childVal,
+  vm,
+  key
+) {
+  var res = Object.create(parentVal || null);
+  if (childVal) {
+    !IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && assertObjectType(key, childVal, vm);
+    return extend(res, childVal)
+  } else {
+    return res
+  }
+}
+
+ASSET_TYPES.forEach(function (type) {
+  strats[type + 's'] = mergeAssets;
+});
+
+/**
+ * Watchers.
+ *
+ * Watchers hashes should not overwrite one
+ * another, so we merge them as arrays.
+ */
+strats.watch = function (
+  parentVal,
+  childVal,
+  vm,
+  key
+) {
+  // work around Firefox's Object.prototype.watch...
+  if (parentVal === nativeWatch) { parentVal = undefined; }
+  if (childVal === nativeWatch) { childVal = undefined; }
+  /* istanbul ignore if */
+  if (!childVal) { return Object.create(parentVal || null) }
+  {
+    assertObjectType(key, childVal, vm);
+  }
+  if (!parentVal) { return childVal }
+  var ret = {};
+  extend(ret, parentVal);
+  for (var key$1 in childVal) {
+    var parent = ret[key$1];
+    var child = childVal[key$1];
+    if (parent && !Array.isArray(parent)) {
+      parent = [parent];
+    }
+    ret[key$1] = parent
+      ? parent.concat(child)
+      : Array.isArray(child) ? child : [child];
+  }
+  return ret
+};
+
+/**
+ * Other object hashes.
+ */
+strats.props =
+strats.methods =
+strats.inject =
+strats.computed = function (
+  parentVal,
+  childVal,
+  vm,
+  key
+) {
+  if (childVal && !IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE) {
+    assertObjectType(key, childVal, vm);
+  }
+  if (!parentVal) { return childVal }
+  var ret = Object.create(null);
+  extend(ret, parentVal);
+  if (childVal) { extend(ret, childVal); }
+  return ret
+};
+strats.provide = mergeDataOrFn;
+
+/**
+ * Default strategy.
+ */
+var defaultStrat = function (parentVal, childVal) {
+  return childVal === undefined
+    ? parentVal
+    : childVal
+};
+
+/**
+ * Validate component names
+ */
+function checkComponents (options) {
+  for (var key in options.components) {
+    validateComponentName(key);
+  }
+}
+
+function validateComponentName (name) {
+  if (!/^[a-zA-Z][\w-]*$/.test(name)) {
+    warn(
+      'Invalid component name: "' + name + '". Component names ' +
+      'can only contain alphanumeric characters and the hyphen, ' +
+      'and must start with a letter.'
+    );
+  }
+  if (isBuiltInTag(name) || config.isReservedTag(name)) {
+    warn(
+      'Do not use built-in or reserved HTML elements as component ' +
+      'id: ' + name
+    );
+  }
+}
+
+/**
+ * Ensure all props option syntax are normalized into the
+ * Object-based format.
+ */
+function normalizeProps (options, vm) {
+  var props = options.props;
+  if (!props) { return }
+  var res = {};
+  var i, val, name;
+  if (Array.isArray(props)) {
+    i = props.length;
+    while (i--) {
+      val = props[i];
+      if (typeof val === 'string') {
+        name = camelize(val);
+        res[name] = { type: null };
+      } else {
+        warn('props must be strings when using array syntax.');
+      }
+    }
+  } else if (isPlainObject(props)) {
+    for (var key in props) {
+      val = props[key];
+      name = camelize(key);
+      res[name] = isPlainObject(val)
+        ? val
+        : { type: val };
+    }
+  } else {
+    warn(
+      "Invalid value for option \"props\": expected an Array or an Object, " +
+      "but got " + (toRawType(props)) + ".",
+      vm
+    );
+  }
+  options.props = res;
+}
+
+/**
+ * Normalize all injections into Object-based format
+ */
+function normalizeInject (options, vm) {
+  var inject = options.inject;
+  if (!inject) { return }
+  var normalized = options.inject = {};
+  if (Array.isArray(inject)) {
+    for (var i = 0; i < inject.length; i++) {
+      normalized[inject[i]] = { from: inject[i] };
+    }
+  } else if (isPlainObject(inject)) {
+    for (var key in inject) {
+      var val = inject[key];
+      normalized[key] = isPlainObject(val)
+        ? extend({ from: key }, val)
+        : { from: val };
+    }
+  } else {
+    warn(
+      "Invalid value for option \"inject\": expected an Array or an Object, " +
+      "but got " + (toRawType(inject)) + ".",
+      vm
+    );
+  }
+}
+
+/**
+ * Normalize raw function directives into object format.
+ */
+function normalizeDirectives (options) {
+  var dirs = options.directives;
+  if (dirs) {
+    for (var key in dirs) {
+      var def = dirs[key];
+      if (typeof def === 'function') {
+        dirs[key] = { bind: def, update: def };
+      }
+    }
+  }
+}
+
+function assertObjectType (name, value, vm) {
+  if (!isPlainObject(value)) {
+    warn(
+      "Invalid value for option \"" + name + "\": expected an Object, " +
+      "but got " + (toRawType(value)) + ".",
+      vm
+    );
+  }
+}
+
+/**
+ * Merge two option objects into a new one.
+ * Core utility used in both instantiation and inheritance.
+ */
+function mergeOptions (
+  parent,
+  child,
+  vm
+) {
+  {
+    checkComponents(child);
+  }
+
+  if (typeof child === 'function') {
+    child = child.options;
+  }
+
+  normalizeProps(child, vm);
+  normalizeInject(child, vm);
+  normalizeDirectives(child);
+  var extendsFrom = child.extends;
+  if (extendsFrom) {
+    parent = mergeOptions(parent, extendsFrom, vm);
+  }
+  if (child.mixins) {
+    for (var i = 0, l = child.mixins.length; i < l; i++) {
+      parent = mergeOptions(parent, child.mixins[i], vm);
+    }
+  }
+  var options = {};
+  var key;
+  for (key in parent) {
+    mergeField(key);
+  }
+  for (key in child) {
+    if (!hasOwn(parent, key)) {
+      mergeField(key);
+    }
+  }
+  function mergeField (key) {
+    var strat = strats[key] || defaultStrat;
+    options[key] = strat(parent[key], child[key], vm, key);
+  }
+  return options
+}
+
+/**
+ * Resolve an asset.
+ * This function is used because child instances need access
+ * to assets defined in its ancestor chain.
+ */
+function resolveAsset (
+  options,
+  type,
+  id,
+  warnMissing
+) {
+  /* istanbul ignore if */
+  if (typeof id !== 'string') {
+    return
+  }
+  var assets = options[type];
+  // check local registration variations first
+  if (hasOwn(assets, id)) { return assets[id] }
+  var camelizedId = camelize(id);
+  if (hasOwn(assets, camelizedId)) { return assets[camelizedId] }
+  var PascalCaseId = capitalize(camelizedId);
+  if (hasOwn(assets, PascalCaseId)) { return assets[PascalCaseId] }
+  // fallback to prototype chain
+  var res = assets[id] || assets[camelizedId] || assets[PascalCaseId];
+  if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && warnMissing && !res) {
+    warn(
+      'Failed to resolve ' + type.slice(0, -1) + ': ' + id,
+      options
+    );
+  }
+  return res
+}
+
+/*  */
+
+function validateProp (
+  key,
+  propOptions,
+  propsData,
+  vm
+) {
+  var prop = propOptions[key];
+  var absent = !hasOwn(propsData, key);
+  var value = propsData[key];
+  // boolean casting
+  var booleanIndex = getTypeIndex(Boolean, prop.type);
+  if (booleanIndex > -1) {
+    if (absent && !hasOwn(prop, 'default')) {
+      value = false;
+    } else if (value === '' || value === hyphenate(key)) {
+      // only cast empty string / same name to boolean if
+      // boolean has higher priority
+      var stringIndex = getTypeIndex(String, prop.type);
+      if (stringIndex < 0 || booleanIndex < stringIndex) {
+        value = true;
+      }
+    }
+  }
+  // check default value
+  if (value === undefined) {
+    value = getPropDefaultValue(vm, prop, key);
+    // since the default value is a fresh copy,
+    // make sure to observe it.
+    var prevShouldObserve = shouldObserve;
+    toggleObserving(true);
+    observe(value);
+    toggleObserving(prevShouldObserve);
+  }
+  {
+    assertProp(prop, key, value, vm, absent);
+  }
+  return value
+}
+
+/**
+ * Get the default value of a prop.
+ */
+function getPropDefaultValue (vm, prop, key) {
+  // no default, return undefined
+  if (!hasOwn(prop, 'default')) {
+    return undefined
+  }
+  var def = prop.default;
+  // warn against non-factory defaults for Object & Array
+  if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && isObject(def)) {
+    warn(
+      'Invalid default value for prop "' + key + '": ' +
+      'Props with type Object/Array must use a factory function ' +
+      'to return the default value.',
+      vm
+    );
+  }
+  // the raw prop value was also undefined from previous render,
+  // return previous default value to avoid unnecessary watcher trigger
+  if (vm && vm.$options.propsData &&
+    vm.$options.propsData[key] === undefined &&
+    vm._props[key] !== undefined
+  ) {
+    return vm._props[key]
+  }
+  // call factory function for non-Function types
+  // a value is Function if its prototype is function even across different execution context
+  return typeof def === 'function' && getType(prop.type) !== 'Function'
+    ? def.call(vm)
+    : def
+}
+
+/**
+ * Assert whether a prop is valid.
+ */
+function assertProp (
+  prop,
+  name,
+  value,
+  vm,
+  absent
+) {
+  if (prop.required && absent) {
+    warn(
+      'Missing required prop: "' + name + '"',
+      vm
+    );
+    return
+  }
+  if (value == null && !prop.required) {
+    return
+  }
+  var type = prop.type;
+  var valid = !type || type === true;
+  var expectedTypes = [];
+  if (type) {
+    if (!Array.isArray(type)) {
+      type = [type];
+    }
+    for (var i = 0; i < type.length && !valid; i++) {
+      var assertedType = assertType(value, type[i]);
+      expectedTypes.push(assertedType.expectedType || '');
+      valid = assertedType.valid;
+    }
+  }
+  if (!valid) {
+    warn(
+      "Invalid prop: type check failed for prop \"" + name + "\"." +
+      " Expected " + (expectedTypes.map(capitalize).join(', ')) +
+      ", got " + (toRawType(value)) + ".",
+      vm
+    );
+    return
+  }
+  var validator = prop.validator;
+  if (validator) {
+    if (!validator(value)) {
+      warn(
+        'Invalid prop: custom validator check failed for prop "' + name + '".',
+        vm
+      );
+    }
+  }
+}
+
+var simpleCheckRE = /^(String|Number|Boolean|Function|Symbol)$/;
+
+function assertType (value, type) {
+  var valid;
+  var expectedType = getType(type);
+  if (simpleCheckRE.test(expectedType)) {
+    var t = typeof value;
+    valid = t === expectedType.toLowerCase();
+    // for primitive wrapper objects
+    if (!valid && t === 'object') {
+      valid = value instanceof type;
+    }
+  } else if (expectedType === 'Object') {
+    valid = isPlainObject(value);
+  } else if (expectedType === 'Array') {
+    valid = Array.isArray(value);
+  } else {
+    valid = value instanceof type;
+  }
+  return {
+    valid: valid,
+    expectedType: expectedType
+  }
+}
+
+/**
+ * Use function string name to check built-in types,
+ * because a simple equality check will fail when running
+ * across different vms / iframes.
+ */
+function getType (fn) {
+  var match = fn && fn.toString().match(/^\s*function (\w+)/);
+  return match ? match[1] : ''
+}
+
+function isSameType (a, b) {
+  return getType(a) === getType(b)
+}
+
+function getTypeIndex (type, expectedTypes) {
+  if (!Array.isArray(expectedTypes)) {
+    return isSameType(expectedTypes, type) ? 0 : -1
+  }
+  for (var i = 0, len = expectedTypes.length; i < len; i++) {
+    if (isSameType(expectedTypes[i], type)) {
+      return i
+    }
+  }
+  return -1
+}
+
+/*  */
+
+function handleError (err, vm, info) {
+  if (vm) {
+    var cur = vm;
+    while ((cur = cur.$parent)) {
+      var hooks = cur.$options.errorCaptured;
+      if (hooks) {
+        for (var i = 0; i < hooks.length; i++) {
+          try {
+            var capture = hooks[i].call(cur, err, vm, info) === false;
+            if (capture) { return }
+          } catch (e) {
+            globalHandleError(e, cur, 'errorCaptured hook');
+          }
+        }
+      }
+    }
+  }
+  globalHandleError(err, vm, info);
+}
+
+function globalHandleError (err, vm, info) {
+  if (config.errorHandler) {
+    try {
+      return config.errorHandler.call(null, err, vm, info)
+    } catch (e) {
+      logError(e, null, 'config.errorHandler');
+    }
+  }
+  logError(err, vm, info);
+}
+
+function logError (err, vm, info) {
+  {
+    warn(("Error in " + info + ": \"" + (err.toString()) + "\""), vm);
+  }
+  /* istanbul ignore else */
+  if ((inBrowser || inWeex) && typeof console !== 'undefined') {
+    console.error(err);
+  } else {
+    throw err
+  }
+}
+
+/*  */
+/* globals MessageChannel */
+
+var callbacks = [];
+var pending = false;
+
+function flushCallbacks () {
+  pending = false;
+  var copies = callbacks.slice(0);
+  callbacks.length = 0;
+  for (var i = 0; i < copies.length; i++) {
+    copies[i]();
+  }
+}
+
+// Here we have async deferring wrappers using both microtasks and (macro) tasks.
+// In < 2.4 we used microtasks everywhere, but there are some scenarios where
+// microtasks have too high a priority and fire in between supposedly
+// sequential events (e.g. #4521, #6690) or even between bubbling of the same
+// event (#6566). However, using (macro) tasks everywhere also has subtle problems
+// when state is changed right before repaint (e.g. #6813, out-in transitions).
+// Here we use microtask by default, but expose a way to force (macro) task when
+// needed (e.g. in event handlers attached by v-on).
+var microTimerFunc;
+var macroTimerFunc;
+var useMacroTask = false;
+
+// Determine (macro) task defer implementation.
+// Technically setImmediate should be the ideal choice, but it's only available
+// in IE. The only polyfill that consistently queues the callback after all DOM
+// events triggered in the same loop is by using MessageChannel.
+/* istanbul ignore if */
+if (typeof setImmediate !== 'undefined' && isNative(setImmediate)) {
+  macroTimerFunc = function () {
+    setImmediate(flushCallbacks);
+  };
+} else if (typeof MessageChannel !== 'undefined' && (
+  isNative(MessageChannel) ||
+  // PhantomJS
+  MessageChannel.toString() === '[object MessageChannelConstructor]'
+)) {
+  var channel = new MessageChannel();
+  var port = channel.port2;
+  channel.port1.onmessage = flushCallbacks;
+  macroTimerFunc = function () {
+    port.postMessage(1);
+  };
+} else {
+  /* istanbul ignore next */
+  macroTimerFunc = function () {
+    setTimeout(flushCallbacks, 0);
+  };
+}
+
+// Determine microtask defer implementation.
+/* istanbul ignore next, $flow-disable-line */
+if (typeof Promise !== 'undefined' && isNative(Promise)) {
+  var p = Promise.resolve();
+  microTimerFunc = function () {
+    p.then(flushCallbacks);
+    // in problematic UIWebViews, Promise.then doesn't completely break, but
+    // it can get stuck in a weird state where callbacks are pushed into the
+    // microtask queue but the queue isn't being flushed, until the browser
+    // needs to do some other work, e.g. handle a timer. Therefore we can
+    // "force" the microtask queue to be flushed by adding an empty timer.
+    if (isIOS) { setTimeout(noop); }
+  };
+} else {
+  // fallback to macro
+  microTimerFunc = macroTimerFunc;
+}
+
+/**
+ * Wrap a function so that if any code inside triggers state change,
+ * the changes are queued using a (macro) task instead of a microtask.
+ */
+function withMacroTask (fn) {
+  return fn._withTask || (fn._withTask = function () {
+    useMacroTask = true;
+    var res = fn.apply(null, arguments);
+    useMacroTask = false;
+    return res
+  })
+}
+
+function nextTick (cb, ctx) {
+  var _resolve;
+  callbacks.push(function () {
+    if (cb) {
+      try {
+        cb.call(ctx);
+      } catch (e) {
+        handleError(e, ctx, 'nextTick');
+      }
+    } else if (_resolve) {
+      _resolve(ctx);
+    }
+  });
+  if (!pending) {
+    pending = true;
+    if (useMacroTask) {
+      macroTimerFunc();
+    } else {
+      microTimerFunc();
+    }
+  }
+  // $flow-disable-line
+  if (!cb && typeof Promise !== 'undefined') {
+    return new Promise(function (resolve) {
+      _resolve = resolve;
+    })
+  }
+}
+
+/*  */
+
+var mark;
+var measure;
+
+{
+  var perf = inBrowser && window.performance;
+  /* istanbul ignore if */
+  if (
+    perf &&
+    perf.mark &&
+    perf.measure &&
+    perf.clearMarks &&
+    perf.clearMeasures
+  ) {
+    mark = function (tag) { return perf.mark(tag); };
+    measure = function (name, startTag, endTag) {
+      perf.measure(name, startTag, endTag);
+      perf.clearMarks(startTag);
+      perf.clearMarks(endTag);
+      perf.clearMeasures(name);
+    };
+  }
+}
+
+/* not type checking this file because flow doesn't play well with Proxy */
+
+var initProxy;
+
+{
+  var allowedGlobals = makeMap(
+    'Infinity,undefined,NaN,isFinite,isNaN,' +
+    'parseFloat,parseInt,decodeURI,decodeURIComponent,encodeURI,encodeURIComponent,' +
+    'Math,Number,Date,Array,Object,Boolean,String,RegExp,Map,Set,JSON,Intl,' +
+    'require' // for Webpack/Browserify
+  );
+
+  var warnNonPresent = function (target, key) {
+    warn(
+      "Property or method \"" + key + "\" is not defined on the instance but " +
+      'referenced during render. Make sure that this property is reactive, ' +
+      'either in the data option, or for class-based components, by ' +
+      'initializing the property. ' +
+      'See: https://vuejs.org/v2/guide/reactivity.html#Declaring-Reactive-Properties.',
+      target
+    );
+  };
+
+  var hasProxy =
+    typeof Proxy !== 'undefined' && isNative(Proxy);
+
+  if (hasProxy) {
+    var isBuiltInModifier = makeMap('stop,prevent,self,ctrl,shift,alt,meta,exact');
+    config.keyCodes = new Proxy(config.keyCodes, {
+      set: function set (target, key, value) {
+        if (isBuiltInModifier(key)) {
+          warn(("Avoid overwriting built-in modifier in config.keyCodes: ." + key));
+          return false
+        } else {
+          target[key] = value;
+          return true
+        }
+      }
+    });
+  }
+
+  var hasHandler = {
+    has: function has (target, key) {
+      var has = key in target;
+      var isAllowed = allowedGlobals(key) || key.charAt(0) === '_';
+      if (!has && !isAllowed) {
+        warnNonPresent(target, key);
+      }
+      return has || !isAllowed
+    }
+  };
+
+  var getHandler = {
+    get: function get (target, key) {
+      if (typeof key === 'string' && !(key in target)) {
+        warnNonPresent(target, key);
+      }
+      return target[key]
+    }
+  };
+
+  initProxy = function initProxy (vm) {
+    if (hasProxy) {
+      // determine which proxy handler to use
+      var options = vm.$options;
+      var handlers = options.render && options.render._withStripped
+        ? getHandler
+        : hasHandler;
+      vm._renderProxy = new Proxy(vm, handlers);
+    } else {
+      vm._renderProxy = vm;
+    }
+  };
+}
+
+/*  */
+
+var seenObjects = new _Set();
+
+/**
+ * Recursively traverse an object to evoke all converted
+ * getters, so that every nested property inside the object
+ * is collected as a "deep" dependency.
+ */
+function traverse (val) {
+  _traverse(val, seenObjects);
+  seenObjects.clear();
+}
+
+function _traverse (val, seen) {
+  var i, keys;
+  var isA = Array.isArray(val);
+  if ((!isA && !isObject(val)) || Object.isFrozen(val) || val instanceof VNode) {
+    return
+  }
+  if (val.__ob__) {
+    var depId = val.__ob__.dep.id;
+    if (seen.has(depId)) {
+      return
+    }
+    seen.add(depId);
+  }
+  if (isA) {
+    i = val.length;
+    while (i--) { _traverse(val[i], seen); }
+  } else {
+    keys = Object.keys(val);
+    i = keys.length;
+    while (i--) { _traverse(val[keys[i]], seen); }
+  }
+}
+
+/*  */
+
+var normalizeEvent = cached(function (name) {
+  var passive = name.charAt(0) === '&';
+  name = passive ? name.slice(1) : name;
+  var once$$1 = name.charAt(0) === '~'; // Prefixed last, checked first
+  name = once$$1 ? name.slice(1) : name;
+  var capture = name.charAt(0) === '!';
+  name = capture ? name.slice(1) : name;
+  return {
+    name: name,
+    once: once$$1,
+    capture: capture,
+    passive: passive
+  }
+});
+
+function createFnInvoker (fns) {
+  function invoker () {
+    var arguments$1 = arguments;
+
+    var fns = invoker.fns;
+    if (Array.isArray(fns)) {
+      var cloned = fns.slice();
+      for (var i = 0; i < cloned.length; i++) {
+        cloned[i].apply(null, arguments$1);
+      }
+    } else {
+      // return handler return value for single handlers
+      return fns.apply(null, arguments)
+    }
+  }
+  invoker.fns = fns;
+  return invoker
+}
+
+function updateListeners (
+  on,
+  oldOn,
+  add,
+  remove$$1,
+  vm
+) {
+  var name, def, cur, old, event;
+  for (name in on) {
+    def = cur = on[name];
+    old = oldOn[name];
+    event = normalizeEvent(name);
+    /* istanbul ignore if */
+    if (isUndef(cur)) {
+      !IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && warn(
+        "Invalid handler for event \"" + (event.name) + "\": got " + String(cur),
+        vm
+      );
+    } else if (isUndef(old)) {
+      if (isUndef(cur.fns)) {
+        cur = on[name] = createFnInvoker(cur);
+      }
+      add(event.name, cur, event.once, event.capture, event.passive, event.params);
+    } else if (cur !== old) {
+      old.fns = cur;
+      on[name] = old;
+    }
+  }
+  for (name in oldOn) {
+    if (isUndef(on[name])) {
+      event = normalizeEvent(name);
+      remove$$1(event.name, oldOn[name], event.capture);
+    }
+  }
+}
+
+/*  */
+
+function mergeVNodeHook (def, hookKey, hook) {
+  if (def instanceof VNode) {
+    def = def.data.hook || (def.data.hook = {});
+  }
+  var invoker;
+  var oldHook = def[hookKey];
+
+  function wrappedHook () {
+    hook.apply(this, arguments);
+    // important: remove merged hook to ensure it's called only once
+    // and prevent memory leak
+    remove(invoker.fns, wrappedHook);
+  }
+
+  if (isUndef(oldHook)) {
+    // no existing hook
+    invoker = createFnInvoker([wrappedHook]);
+  } else {
+    /* istanbul ignore if */
+    if (isDef(oldHook.fns) && isTrue(oldHook.merged)) {
+      // already a merged invoker
+      invoker = oldHook;
+      invoker.fns.push(wrappedHook);
+    } else {
+      // existing plain hook
+      invoker = createFnInvoker([oldHook, wrappedHook]);
+    }
+  }
+
+  invoker.merged = true;
+  def[hookKey] = invoker;
+}
+
+/*  */
+
+function extractPropsFromVNodeData (
+  data,
+  Ctor,
+  tag
+) {
+  // we are only extracting raw values here.
+  // validation and default values are handled in the child
+  // component itself.
+  var propOptions = Ctor.options.props;
+  if (isUndef(propOptions)) {
+    return
+  }
+  var res = {};
+  var attrs = data.attrs;
+  var props = data.props;
+  if (isDef(attrs) || isDef(props)) {
+    for (var key in propOptions) {
+      var altKey = hyphenate(key);
+      {
+        var keyInLowerCase = key.toLowerCase();
+        if (
+          key !== keyInLowerCase &&
+          attrs && hasOwn(attrs, keyInLowerCase)
+        ) {
+          tip(
+            "Prop \"" + keyInLowerCase + "\" is passed to component " +
+            (formatComponentName(tag || Ctor)) + ", but the declared prop name is" +
+            " \"" + key + "\". " +
+            "Note that HTML attributes are case-insensitive and camelCased " +
+            "props need to use their kebab-case equivalents when using in-DOM " +
+            "templates. You should probably use \"" + altKey + "\" instead of \"" + key + "\"."
+          );
+        }
+      }
+      checkProp(res, props, key, altKey, true) ||
+      checkProp(res, attrs, key, altKey, false);
+    }
+  }
+  return res
+}
+
+function checkProp (
+  res,
+  hash,
+  key,
+  altKey,
+  preserve
+) {
+  if (isDef(hash)) {
+    if (hasOwn(hash, key)) {
+      res[key] = hash[key];
+      if (!preserve) {
+        delete hash[key];
+      }
+      return true
+    } else if (hasOwn(hash, altKey)) {
+      res[key] = hash[altKey];
+      if (!preserve) {
+        delete hash[altKey];
+      }
+      return true
+    }
+  }
+  return false
+}
+
+/*  */
+
+// The template compiler attempts to minimize the need for normalization by
+// statically analyzing the template at compile time.
+//
+// For plain HTML markup, normalization can be completely skipped because the
+// generated render function is guaranteed to return Array<VNode>. There are
+// two cases where extra normalization is needed:
+
+// 1. When the children contains components - because a functional component
+// may return an Array instead of a single root. In this case, just a simple
+// normalization is needed - if any child is an Array, we flatten the whole
+// thing with Array.prototype.concat. It is guaranteed to be only 1-level deep
+// because functional components already normalize their own children.
+function simpleNormalizeChildren (children) {
+  for (var i = 0; i < children.length; i++) {
+    if (Array.isArray(children[i])) {
+      return Array.prototype.concat.apply([], children)
+    }
+  }
+  return children
+}
+
+// 2. When the children contains constructs that always generated nested Arrays,
+// e.g. <template>, <slot>, v-for, or when the children is provided by user
+// with hand-written render functions / JSX. In such cases a full normalization
+// is needed to cater to all possible types of children values.
+function normalizeChildren (children) {
+  return isPrimitive(children)
+    ? [createTextVNode(children)]
+    : Array.isArray(children)
+      ? normalizeArrayChildren(children)
+      : undefined
+}
+
+function isTextNode (node) {
+  return isDef(node) && isDef(node.text) && isFalse(node.isComment)
+}
+
+function normalizeArrayChildren (children, nestedIndex) {
+  var res = [];
+  var i, c, lastIndex, last;
+  for (i = 0; i < children.length; i++) {
+    c = children[i];
+    if (isUndef(c) || typeof c === 'boolean') { continue }
+    lastIndex = res.length - 1;
+    last = res[lastIndex];
+    //  nested
+    if (Array.isArray(c)) {
+      if (c.length > 0) {
+        c = normalizeArrayChildren(c, ((nestedIndex || '') + "_" + i));
+        // merge adjacent text nodes
+        if (isTextNode(c[0]) && isTextNode(last)) {
+          res[lastIndex] = createTextVNode(last.text + (c[0]).text);
+          c.shift();
+        }
+        res.push.apply(res, c);
+      }
+    } else if (isPrimitive(c)) {
+      if (isTextNode(last)) {
+        // merge adjacent text nodes
+        // this is necessary for SSR hydration because text nodes are
+        // essentially merged when rendered to HTML strings
+        res[lastIndex] = createTextVNode(last.text + c);
+      } else if (c !== '') {
+        // convert primitive to vnode
+        res.push(createTextVNode(c));
+      }
+    } else {
+      if (isTextNode(c) && isTextNode(last)) {
+        // merge adjacent text nodes
+        res[lastIndex] = createTextVNode(last.text + c.text);
+      } else {
+        // default key for nested array children (likely generated by v-for)
+        if (isTrue(children._isVList) &&
+          isDef(c.tag) &&
+          isUndef(c.key) &&
+          isDef(nestedIndex)) {
+          c.key = "__vlist" + nestedIndex + "_" + i + "__";
+        }
+        res.push(c);
+      }
+    }
+  }
+  return res
+}
+
+/*  */
+
+function ensureCtor (comp, base) {
+  if (
+    comp.__esModule ||
+    (hasSymbol && comp[Symbol.toStringTag] === 'Module')
+  ) {
+    comp = comp.default;
+  }
+  return isObject(comp)
+    ? base.extend(comp)
+    : comp
+}
+
+function createAsyncPlaceholder (
+  factory,
+  data,
+  context,
+  children,
+  tag
+) {
+  var node = createEmptyVNode();
+  node.asyncFactory = factory;
+  node.asyncMeta = { data: data, context: context, children: children, tag: tag };
+  return node
+}
+
+function resolveAsyncComponent (
+  factory,
+  baseCtor,
+  context
+) {
+  if (isTrue(factory.error) && isDef(factory.errorComp)) {
+    return factory.errorComp
+  }
+
+  if (isDef(factory.resolved)) {
+    return factory.resolved
+  }
+
+  if (isTrue(factory.loading) && isDef(factory.loadingComp)) {
+    return factory.loadingComp
+  }
+
+  if (isDef(factory.contexts)) {
+    // already pending
+    factory.contexts.push(context);
+  } else {
+    var contexts = factory.contexts = [context];
+    var sync = true;
+
+    var forceRender = function () {
+      for (var i = 0, l = contexts.length; i < l; i++) {
+        contexts[i].$forceUpdate();
+      }
+    };
+
+    var resolve = once(function (res) {
+      // cache resolved
+      factory.resolved = ensureCtor(res, baseCtor);
+      // invoke callbacks only if this is not a synchronous resolve
+      // (async resolves are shimmed as synchronous during SSR)
+      if (!sync) {
+        forceRender();
+      }
+    });
+
+    var reject = once(function (reason) {
+      !IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && warn(
+        "Failed to resolve async component: " + (String(factory)) +
+        (reason ? ("\nReason: " + reason) : '')
+      );
+      if (isDef(factory.errorComp)) {
+        factory.error = true;
+        forceRender();
+      }
+    });
+
+    var res = factory(resolve, reject);
+
+    if (isObject(res)) {
+      if (typeof res.then === 'function') {
+        // () => Promise
+        if (isUndef(factory.resolved)) {
+          res.then(resolve, reject);
+        }
+      } else if (isDef(res.component) && typeof res.component.then === 'function') {
+        res.component.then(resolve, reject);
+
+        if (isDef(res.error)) {
+          factory.errorComp = ensureCtor(res.error, baseCtor);
+        }
+
+        if (isDef(res.loading)) {
+          factory.loadingComp = ensureCtor(res.loading, baseCtor);
+          if (res.delay === 0) {
+            factory.loading = true;
+          } else {
+            setTimeout(function () {
+              if (isUndef(factory.resolved) && isUndef(factory.error)) {
+                factory.loading = true;
+                forceRender();
+              }
+            }, res.delay || 200);
+          }
+        }
+
+        if (isDef(res.timeout)) {
+          setTimeout(function () {
+            if (isUndef(factory.resolved)) {
+              reject(
+                "timeout (" + (res.timeout) + "ms)"
+              );
+            }
+          }, res.timeout);
+        }
+      }
+    }
+
+    sync = false;
+    // return in case resolved synchronously
+    return factory.loading
+      ? factory.loadingComp
+      : factory.resolved
+  }
+}
+
+/*  */
+
+function isAsyncPlaceholder (node) {
+  return node.isComment && node.asyncFactory
+}
+
+/*  */
+
+function getFirstComponentChild (children) {
+  if (Array.isArray(children)) {
+    for (var i = 0; i < children.length; i++) {
+      var c = children[i];
+      if (isDef(c) && (isDef(c.componentOptions) || isAsyncPlaceholder(c))) {
+        return c
+      }
+    }
+  }
+}
+
+/*  */
+
+/*  */
+
+function initEvents (vm) {
+  vm._events = Object.create(null);
+  vm._hasHookEvent = false;
+  // init parent attached events
+  var listeners = vm.$options._parentListeners;
+  if (listeners) {
+    updateComponentListeners(vm, listeners);
+  }
+}
+
+var target;
+
+function add (event, fn, once) {
+  if (once) {
+    target.$once(event, fn);
+  } else {
+    target.$on(event, fn);
+  }
+}
+
+function remove$1 (event, fn) {
+  target.$off(event, fn);
+}
+
+function updateComponentListeners (
+  vm,
+  listeners,
+  oldListeners
+) {
+  target = vm;
+  updateListeners(listeners, oldListeners || {}, add, remove$1, vm);
+  target = undefined;
+}
+
+function eventsMixin (Vue) {
+  var hookRE = /^hook:/;
+  Vue.prototype.$on = function (event, fn) {
+    var this$1 = this;
+
+    var vm = this;
+    if (Array.isArray(event)) {
+      for (var i = 0, l = event.length; i < l; i++) {
+        this$1.$on(event[i], fn);
+      }
+    } else {
+      (vm._events[event] || (vm._events[event] = [])).push(fn);
+      // optimize hook:event cost by using a boolean flag marked at registration
+      // instead of a hash lookup
+      if (hookRE.test(event)) {
+        vm._hasHookEvent = true;
+      }
+    }
+    return vm
+  };
+
+  Vue.prototype.$once = function (event, fn) {
+    var vm = this;
+    function on () {
+      vm.$off(event, on);
+      fn.apply(vm, arguments);
+    }
+    on.fn = fn;
+    vm.$on(event, on);
+    return vm
+  };
+
+  Vue.prototype.$off = function (event, fn) {
+    var this$1 = this;
+
+    var vm = this;
+    // all
+    if (!arguments.length) {
+      vm._events = Object.create(null);
+      return vm
+    }
+    // array of events
+    if (Array.isArray(event)) {
+      for (var i = 0, l = event.length; i < l; i++) {
+        this$1.$off(event[i], fn);
+      }
+      return vm
+    }
+    // specific event
+    var cbs = vm._events[event];
+    if (!cbs) {
+      return vm
+    }
+    if (!fn) {
+      vm._events[event] = null;
+      return vm
+    }
+    if (fn) {
+      // specific handler
+      var cb;
+      var i$1 = cbs.length;
+      while (i$1--) {
+        cb = cbs[i$1];
+        if (cb === fn || cb.fn === fn) {
+          cbs.splice(i$1, 1);
+          break
+        }
+      }
+    }
+    return vm
+  };
+
+  Vue.prototype.$emit = function (event) {
+    var vm = this;
+    {
+      var lowerCaseEvent = event.toLowerCase();
+      if (lowerCaseEvent !== event && vm._events[lowerCaseEvent]) {
+        tip(
+          "Event \"" + lowerCaseEvent + "\" is emitted in component " +
+          (formatComponentName(vm)) + " but the handler is registered for \"" + event + "\". " +
+          "Note that HTML attributes are case-insensitive and you cannot use " +
+          "v-on to listen to camelCase events when using in-DOM templates. " +
+          "You should probably use \"" + (hyphenate(event)) + "\" instead of \"" + event + "\"."
+        );
+      }
+    }
+    var cbs = vm._events[event];
+    if (cbs) {
+      cbs = cbs.length > 1 ? toArray(cbs) : cbs;
+      var args = toArray(arguments, 1);
+      for (var i = 0, l = cbs.length; i < l; i++) {
+        try {
+          cbs[i].apply(vm, args);
+        } catch (e) {
+          handleError(e, vm, ("event handler for \"" + event + "\""));
+        }
+      }
+    }
+    return vm
+  };
+}
+
+/*  */
+
+
+
+/**
+ * Runtime helper for resolving raw children VNodes into a slot object.
+ */
+function resolveSlots (
+  children,
+  context
+) {
+  var slots = {};
+  if (!children) {
+    return slots
+  }
+  for (var i = 0, l = children.length; i < l; i++) {
+    var child = children[i];
+    var data = child.data;
+    // remove slot attribute if the node is resolved as a Vue slot node
+    if (data && data.attrs && data.attrs.slot) {
+      delete data.attrs.slot;
+    }
+    // named slots should only be respected if the vnode was rendered in the
+    // same context.
+    if ((child.context === context || child.fnContext === context) &&
+      data && data.slot != null
+    ) {
+      var name = data.slot;
+      var slot = (slots[name] || (slots[name] = []));
+      if (child.tag === 'template') {
+        slot.push.apply(slot, child.children || []);
+      } else {
+        slot.push(child);
+      }
+    } else {
+      (slots.default || (slots.default = [])).push(child);
+    }
+  }
+  // ignore slots that contains only whitespace
+  for (var name$1 in slots) {
+    if (slots[name$1].every(isWhitespace)) {
+      delete slots[name$1];
+    }
+  }
+  return slots
+}
+
+function isWhitespace (node) {
+  return (node.isComment && !node.asyncFactory) || node.text === ' '
+}
+
+function resolveScopedSlots (
+  fns, // see flow/vnode
+  res
+) {
+  res = res || {};
+  for (var i = 0; i < fns.length; i++) {
+    if (Array.isArray(fns[i])) {
+      resolveScopedSlots(fns[i], res);
+    } else {
+      res[fns[i].key] = fns[i].fn;
+    }
+  }
+  return res
+}
+
+/*  */
+
+var activeInstance = null;
+var isUpdatingChildComponent = false;
+
+function initLifecycle (vm) {
+  var options = vm.$options;
+
+  // locate first non-abstract parent
+  var parent = options.parent;
+  if (parent && !options.abstract) {
+    while (parent.$options.abstract && parent.$parent) {
+      parent = parent.$parent;
+    }
+    parent.$children.push(vm);
+  }
+
+  vm.$parent = parent;
+  vm.$root = parent ? parent.$root : vm;
+
+  vm.$children = [];
+  vm.$refs = {};
+
+  vm._watcher = null;
+  vm._inactive = null;
+  vm._directInactive = false;
+  vm._isMounted = false;
+  vm._isDestroyed = false;
+  vm._isBeingDestroyed = false;
+}
+
+function lifecycleMixin (Vue) {
+  Vue.prototype._update = function (vnode, hydrating) {
+    var vm = this;
+    if (vm._isMounted) {
+      callHook(vm, 'beforeUpdate');
+    }
+    var prevEl = vm.$el;
+    var prevVnode = vm._vnode;
+    var prevActiveInstance = activeInstance;
+    activeInstance = vm;
+    vm._vnode = vnode;
+    // Vue.prototype.__patch__ is injected in entry points
+    // based on the rendering backend used.
+    if (!prevVnode) {
+      // initial render
+      vm.$el = vm.__patch__(
+        vm.$el, vnode, hydrating, false /* removeOnly */,
+        vm.$options._parentElm,
+        vm.$options._refElm
+      );
+      // no need for the ref nodes after initial patch
+      // this prevents keeping a detached DOM tree in memory (#5851)
+      vm.$options._parentElm = vm.$options._refElm = null;
+    } else {
+      // updates
+      vm.$el = vm.__patch__(prevVnode, vnode);
+    }
+    activeInstance = prevActiveInstance;
+    // update __vue__ reference
+    if (prevEl) {
+      prevEl.__vue__ = null;
+    }
+    if (vm.$el) {
+      vm.$el.__vue__ = vm;
+    }
+    // if parent is an HOC, update its $el as well
+    if (vm.$vnode && vm.$parent && vm.$vnode === vm.$parent._vnode) {
+      vm.$parent.$el = vm.$el;
+    }
+    // updated hook is called by the scheduler to ensure that children are
+    // updated in a parent's updated hook.
+  };
+
+  Vue.prototype.$forceUpdate = function () {
+    var vm = this;
+    if (vm._watcher) {
+      vm._watcher.update();
+    }
+  };
+
+  Vue.prototype.$destroy = function () {
+    var vm = this;
+    if (vm._isBeingDestroyed) {
+      return
+    }
+    callHook(vm, 'beforeDestroy');
+    vm._isBeingDestroyed = true;
+    // remove self from parent
+    var parent = vm.$parent;
+    if (parent && !parent._isBeingDestroyed && !vm.$options.abstract) {
+      remove(parent.$children, vm);
+    }
+    // teardown watchers
+    if (vm._watcher) {
+      vm._watcher.teardown();
+    }
+    var i = vm._watchers.length;
+    while (i--) {
+      vm._watchers[i].teardown();
+    }
+    // remove reference from data ob
+    // frozen object may not have observer.
+    if (vm._data.__ob__) {
+      vm._data.__ob__.vmCount--;
+    }
+    // call the last hook...
+    vm._isDestroyed = true;
+    // invoke destroy hooks on current rendered tree
+    vm.__patch__(vm._vnode, null);
+    // fire destroyed hook
+    callHook(vm, 'destroyed');
+    // turn off all instance listeners.
+    vm.$off();
+    // remove __vue__ reference
+    if (vm.$el) {
+      vm.$el.__vue__ = null;
+    }
+    // release circular reference (#6759)
+    if (vm.$vnode) {
+      vm.$vnode.parent = null;
+    }
+  };
+}
+
+function mountComponent (
+  vm,
+  el,
+  hydrating
+) {
+  vm.$el = el;
+  if (!vm.$options.render) {
+    vm.$options.render = createEmptyVNode;
+    {
+      /* istanbul ignore if */
+      if ((vm.$options.template && vm.$options.template.charAt(0) !== '#') ||
+        vm.$options.el || el) {
+        warn(
+          'You are using the runtime-only build of Vue where the template ' +
+          'compiler is not available. Either pre-compile the templates into ' +
+          'render functions, or use the compiler-included build.',
+          vm
+        );
+      } else {
+        warn(
+          'Failed to mount component: template or render function not defined.',
+          vm
+        );
+      }
+    }
+  }
+  callHook(vm, 'beforeMount');
+
+  var updateComponent;
+  /* istanbul ignore if */
+  if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && config.performance && mark) {
+    updateComponent = function () {
+      var name = vm._name;
+      var id = vm._uid;
+      var startTag = "vue-perf-start:" + id;
+      var endTag = "vue-perf-end:" + id;
+
+      mark(startTag);
+      var vnode = vm._render();
+      mark(endTag);
+      measure(("vue " + name + " render"), startTag, endTag);
+
+      mark(startTag);
+      vm._update(vnode, hydrating);
+      mark(endTag);
+      measure(("vue " + name + " patch"), startTag, endTag);
+    };
+  } else {
+    updateComponent = function () {
+      vm._update(vm._render(), hydrating);
+    };
+  }
+
+  // we set this to vm._watcher inside the watcher's constructor
+  // since the watcher's initial patch may call $forceUpdate (e.g. inside child
+  // component's mounted hook), which relies on vm._watcher being already defined
+  new Watcher(vm, updateComponent, noop, null, true /* isRenderWatcher */);
+  hydrating = false;
+
+  // manually mounted instance, call mounted on self
+  // mounted is called for render-created child components in its inserted hook
+  if (vm.$vnode == null) {
+    vm._isMounted = true;
+    callHook(vm, 'mounted');
+  }
+  return vm
+}
+
+function updateChildComponent (
+  vm,
+  propsData,
+  listeners,
+  parentVnode,
+  renderChildren
+) {
+  {
+    isUpdatingChildComponent = true;
+  }
+
+  // determine whether component has slot children
+  // we need to do this before overwriting $options._renderChildren
+  var hasChildren = !!(
+    renderChildren ||               // has new static slots
+    vm.$options._renderChildren ||  // has old static slots
+    parentVnode.data.scopedSlots || // has new scoped slots
+    vm.$scopedSlots !== emptyObject // has old scoped slots
+  );
+
+  vm.$options._parentVnode = parentVnode;
+  vm.$vnode = parentVnode; // update vm's placeholder node without re-render
+
+  if (vm._vnode) { // update child tree's parent
+    vm._vnode.parent = parentVnode;
+  }
+  vm.$options._renderChildren = renderChildren;
+
+  // update $attrs and $listeners hash
+  // these are also reactive so they may trigger child update if the child
+  // used them during render
+  vm.$attrs = parentVnode.data.attrs || emptyObject;
+  vm.$listeners = listeners || emptyObject;
+
+  // update props
+  if (propsData && vm.$options.props) {
+    toggleObserving(false);
+    var props = vm._props;
+    var propKeys = vm.$options._propKeys || [];
+    for (var i = 0; i < propKeys.length; i++) {
+      var key = propKeys[i];
+      var propOptions = vm.$options.props; // wtf flow?
+      props[key] = validateProp(key, propOptions, propsData, vm);
+    }
+    toggleObserving(true);
+    // keep a copy of raw propsData
+    vm.$options.propsData = propsData;
+  }
+
+  // update listeners
+  listeners = listeners || emptyObject;
+  var oldListeners = vm.$options._parentListeners;
+  vm.$options._parentListeners = listeners;
+  updateComponentListeners(vm, listeners, oldListeners);
+
+  // resolve slots + force update if has children
+  if (hasChildren) {
+    vm.$slots = resolveSlots(renderChildren, parentVnode.context);
+    vm.$forceUpdate();
+  }
+
+  {
+    isUpdatingChildComponent = false;
+  }
+}
+
+function isInInactiveTree (vm) {
+  while (vm && (vm = vm.$parent)) {
+    if (vm._inactive) { return true }
+  }
+  return false
+}
+
+function activateChildComponent (vm, direct) {
+  if (direct) {
+    vm._directInactive = false;
+    if (isInInactiveTree(vm)) {
+      return
+    }
+  } else if (vm._directInactive) {
+    return
+  }
+  if (vm._inactive || vm._inactive === null) {
+    vm._inactive = false;
+    for (var i = 0; i < vm.$children.length; i++) {
+      activateChildComponent(vm.$children[i]);
+    }
+    callHook(vm, 'activated');
+  }
+}
+
+function deactivateChildComponent (vm, direct) {
+  if (direct) {
+    vm._directInactive = true;
+    if (isInInactiveTree(vm)) {
+      return
+    }
+  }
+  if (!vm._inactive) {
+    vm._inactive = true;
+    for (var i = 0; i < vm.$children.length; i++) {
+      deactivateChildComponent(vm.$children[i]);
+    }
+    callHook(vm, 'deactivated');
+  }
+}
+
+function callHook (vm, hook) {
+  // #7573 disable dep collection when invoking lifecycle hooks
+  pushTarget();
+  var handlers = vm.$options[hook];
+  if (handlers) {
+    for (var i = 0, j = handlers.length; i < j; i++) {
+      try {
+        handlers[i].call(vm);
+      } catch (e) {
+        handleError(e, vm, (hook + " hook"));
+      }
+    }
+  }
+  if (vm._hasHookEvent) {
+    vm.$emit('hook:' + hook);
+  }
+  popTarget();
+}
+
+/*  */
+
+
+var MAX_UPDATE_COUNT = 100;
+
+var queue = [];
+var activatedChildren = [];
+var has = {};
+var circular = {};
+var waiting = false;
+var flushing = false;
+var index = 0;
+
+/**
+ * Reset the scheduler's state.
+ */
+function resetSchedulerState () {
+  index = queue.length = activatedChildren.length = 0;
+  has = {};
+  {
+    circular = {};
+  }
+  waiting = flushing = false;
+}
+
+/**
+ * Flush both queues and run the watchers.
+ */
+function flushSchedulerQueue () {
+  flushing = true;
+  var watcher, id;
+
+  // Sort queue before flush.
+  // This ensures that:
+  // 1. Components are updated from parent to child. (because parent is always
+  //    created before the child)
+  // 2. A component's user watchers are run before its render watcher (because
+  //    user watchers are created before the render watcher)
+  // 3. If a component is destroyed during a parent component's watcher run,
+  //    its watchers can be skipped.
+  queue.sort(function (a, b) { return a.id - b.id; });
+
+  // do not cache length because more watchers might be pushed
+  // as we run existing watchers
+  for (index = 0; index < queue.length; index++) {
+    watcher = queue[index];
+    id = watcher.id;
+    has[id] = null;
+    watcher.run();
+    // in dev build, check and stop circular updates.
+    if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && has[id] != null) {
+      circular[id] = (circular[id] || 0) + 1;
+      if (circular[id] > MAX_UPDATE_COUNT) {
+        warn(
+          'You may have an infinite update loop ' + (
+            watcher.user
+              ? ("in watcher with expression \"" + (watcher.expression) + "\"")
+              : "in a component render function."
+          ),
+          watcher.vm
+        );
+        break
+      }
+    }
+  }
+
+  // keep copies of post queues before resetting state
+  var activatedQueue = activatedChildren.slice();
+  var updatedQueue = queue.slice();
+
+  resetSchedulerState();
+
+  // call component updated and activated hooks
+  callActivatedHooks(activatedQueue);
+  callUpdatedHooks(updatedQueue);
+
+  // devtool hook
+  /* istanbul ignore if */
+  if (devtools && config.devtools) {
+    devtools.emit('flush');
+  }
+}
+
+function callUpdatedHooks (queue) {
+  var i = queue.length;
+  while (i--) {
+    var watcher = queue[i];
+    var vm = watcher.vm;
+    if (vm._watcher === watcher && vm._isMounted) {
+      callHook(vm, 'updated');
+    }
+  }
+}
+
+/**
+ * Queue a kept-alive component that was activated during patch.
+ * The queue will be processed after the entire tree has been patched.
+ */
+function queueActivatedComponent (vm) {
+  // setting _inactive to false here so that a render function can
+  // rely on checking whether it's in an inactive tree (e.g. router-view)
+  vm._inactive = false;
+  activatedChildren.push(vm);
+}
+
+function callActivatedHooks (queue) {
+  for (var i = 0; i < queue.length; i++) {
+    queue[i]._inactive = true;
+    activateChildComponent(queue[i], true /* true */);
+  }
+}
+
+/**
+ * Push a watcher into the watcher queue.
+ * Jobs with duplicate IDs will be skipped unless it's
+ * pushed when the queue is being flushed.
+ */
+function queueWatcher (watcher) {
+  var id = watcher.id;
+  if (has[id] == null) {
+    has[id] = true;
+    if (!flushing) {
+      queue.push(watcher);
+    } else {
+      // if already flushing, splice the watcher based on its id
+      // if already past its id, it will be run next immediately.
+      var i = queue.length - 1;
+      while (i > index && queue[i].id > watcher.id) {
+        i--;
+      }
+      queue.splice(i + 1, 0, watcher);
+    }
+    // queue the flush
+    if (!waiting) {
+      waiting = true;
+      nextTick(flushSchedulerQueue);
+    }
+  }
+}
+
+/*  */
+
+var uid$1 = 0;
+
+/**
+ * A watcher parses an expression, collects dependencies,
+ * and fires callback when the expression value changes.
+ * This is used for both the $watch() api and directives.
+ */
+var Watcher = function Watcher (
+  vm,
+  expOrFn,
+  cb,
+  options,
+  isRenderWatcher
+) {
+  this.vm = vm;
+  if (isRenderWatcher) {
+    vm._watcher = this;
+  }
+  vm._watchers.push(this);
+  // options
+  if (options) {
+    this.deep = !!options.deep;
+    this.user = !!options.user;
+    this.lazy = !!options.lazy;
+    this.sync = !!options.sync;
+  } else {
+    this.deep = this.user = this.lazy = this.sync = false;
+  }
+  this.cb = cb;
+  this.id = ++uid$1; // uid for batching
+  this.active = true;
+  this.dirty = this.lazy; // for lazy watchers
+  this.deps = [];
+  this.newDeps = [];
+  this.depIds = new _Set();
+  this.newDepIds = new _Set();
+  this.expression = expOrFn.toString();
+  // parse expression for getter
+  if (typeof expOrFn === 'function') {
+    this.getter = expOrFn;
+  } else {
+    this.getter = parsePath(expOrFn);
+    if (!this.getter) {
+      this.getter = function () {};
+      !IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && warn(
+        "Failed watching path: \"" + expOrFn + "\" " +
+        'Watcher only accepts simple dot-delimited paths. ' +
+        'For full control, use a function instead.',
+        vm
+      );
+    }
+  }
+  this.value = this.lazy
+    ? undefined
+    : this.get();
+};
+
+/**
+ * Evaluate the getter, and re-collect dependencies.
+ */
+Watcher.prototype.get = function get () {
+  pushTarget(this);
+  var value;
+  var vm = this.vm;
+  try {
+    value = this.getter.call(vm, vm);
+  } catch (e) {
+    if (this.user) {
+      handleError(e, vm, ("getter for watcher \"" + (this.expression) + "\""));
+    } else {
+      throw e
+    }
+  } finally {
+    // "touch" every property so they are all tracked as
+    // dependencies for deep watching
+    if (this.deep) {
+      traverse(value);
+    }
+    popTarget();
+    this.cleanupDeps();
+  }
+  return value
+};
+
+/**
+ * Add a dependency to this directive.
+ */
+Watcher.prototype.addDep = function addDep (dep) {
+  var id = dep.id;
+  if (!this.newDepIds.has(id)) {
+    this.newDepIds.add(id);
+    this.newDeps.push(dep);
+    if (!this.depIds.has(id)) {
+      dep.addSub(this);
+    }
+  }
+};
+
+/**
+ * Clean up for dependency collection.
+ */
+Watcher.prototype.cleanupDeps = function cleanupDeps () {
+    var this$1 = this;
+
+  var i = this.deps.length;
+  while (i--) {
+    var dep = this$1.deps[i];
+    if (!this$1.newDepIds.has(dep.id)) {
+      dep.removeSub(this$1);
+    }
+  }
+  var tmp = this.depIds;
+  this.depIds = this.newDepIds;
+  this.newDepIds = tmp;
+  this.newDepIds.clear();
+  tmp = this.deps;
+  this.deps = this.newDeps;
+  this.newDeps = tmp;
+  this.newDeps.length = 0;
+};
+
+/**
+ * Subscriber interface.
+ * Will be called when a dependency changes.
+ */
+Watcher.prototype.update = function update () {
+  /* istanbul ignore else */
+  if (this.lazy) {
+    this.dirty = true;
+  } else if (this.sync) {
+    this.run();
+  } else {
+    queueWatcher(this);
+  }
+};
+
+/**
+ * Scheduler job interface.
+ * Will be called by the scheduler.
+ */
+Watcher.prototype.run = function run () {
+  if (this.active) {
+    var value = this.get();
+    if (
+      value !== this.value ||
+      // Deep watchers and watchers on Object/Arrays should fire even
+      // when the value is the same, because the value may
+      // have mutated.
+      isObject(value) ||
+      this.deep
+    ) {
+      // set new value
+      var oldValue = this.value;
+      this.value = value;
+      if (this.user) {
+        try {
+          this.cb.call(this.vm, value, oldValue);
+        } catch (e) {
+          handleError(e, this.vm, ("callback for watcher \"" + (this.expression) + "\""));
+        }
+      } else {
+        this.cb.call(this.vm, value, oldValue);
+      }
+    }
+  }
+};
+
+/**
+ * Evaluate the value of the watcher.
+ * This only gets called for lazy watchers.
+ */
+Watcher.prototype.evaluate = function evaluate () {
+  this.value = this.get();
+  this.dirty = false;
+};
+
+/**
+ * Depend on all deps collected by this watcher.
+ */
+Watcher.prototype.depend = function depend () {
+    var this$1 = this;
+
+  var i = this.deps.length;
+  while (i--) {
+    this$1.deps[i].depend();
+  }
+};
+
+/**
+ * Remove self from all dependencies' subscriber list.
+ */
+Watcher.prototype.teardown = function teardown () {
+    var this$1 = this;
+
+  if (this.active) {
+    // remove self from vm's watcher list
+    // this is a somewhat expensive operation so we skip it
+    // if the vm is being destroyed.
+    if (!this.vm._isBeingDestroyed) {
+      remove(this.vm._watchers, this);
+    }
+    var i = this.deps.length;
+    while (i--) {
+      this$1.deps[i].removeSub(this$1);
+    }
+    this.active = false;
+  }
+};
+
+/*  */
+
+var sharedPropertyDefinition = {
+  enumerable: true,
+  configurable: true,
+  get: noop,
+  set: noop
+};
+
+function proxy (target, sourceKey, key) {
+  sharedPropertyDefinition.get = function proxyGetter () {
+    return this[sourceKey][key]
+  };
+  sharedPropertyDefinition.set = function proxySetter (val) {
+    this[sourceKey][key] = val;
+  };
+  Object.defineProperty(target, key, sharedPropertyDefinition);
+}
+
+function initState (vm) {
+  vm._watchers = [];
+  var opts = vm.$options;
+  if (opts.props) { initProps(vm, opts.props); }
+  if (opts.methods) { initMethods(vm, opts.methods); }
+  if (opts.data) {
+    initData(vm);
+  } else {
+    observe(vm._data = {}, true /* asRootData */);
+  }
+  if (opts.computed) { initComputed(vm, opts.computed); }
+  if (opts.watch && opts.watch !== nativeWatch) {
+    initWatch(vm, opts.watch);
+  }
+}
+
+function initProps (vm, propsOptions) {
+  var propsData = vm.$options.propsData || {};
+  var props = vm._props = {};
+  // cache prop keys so that future props updates can iterate using Array
+  // instead of dynamic object key enumeration.
+  var keys = vm.$options._propKeys = [];
+  var isRoot = !vm.$parent;
+  // root instance props should be converted
+  if (!isRoot) {
+    toggleObserving(false);
+  }
+  var loop = function ( key ) {
+    keys.push(key);
+    var value = validateProp(key, propsOptions, propsData, vm);
+    /* istanbul ignore else */
+    {
+      var hyphenatedKey = hyphenate(key);
+      if (isReservedAttribute(hyphenatedKey) ||
+          config.isReservedAttr(hyphenatedKey)) {
+        warn(
+          ("\"" + hyphenatedKey + "\" is a reserved attribute and cannot be used as component prop."),
+          vm
+        );
+      }
+      defineReactive(props, key, value, function () {
+        if (vm.$parent && !isUpdatingChildComponent) {
+          warn(
+            "Avoid mutating a prop directly since the value will be " +
+            "overwritten whenever the parent component re-renders. " +
+            "Instead, use a data or computed property based on the prop's " +
+            "value. Prop being mutated: \"" + key + "\"",
+            vm
+          );
+        }
+      });
+    }
+    // static props are already proxied on the component's prototype
+    // during Vue.extend(). We only need to proxy props defined at
+    // instantiation here.
+    if (!(key in vm)) {
+      proxy(vm, "_props", key);
+    }
+  };
+
+  for (var key in propsOptions) loop( key );
+  toggleObserving(true);
+}
+
+function initData (vm) {
+  var data = vm.$options.data;
+  data = vm._data = typeof data === 'function'
+    ? getData(data, vm)
+    : data || {};
+  if (!isPlainObject(data)) {
+    data = {};
+    !IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && warn(
+      'data functions should return an object:\n' +
+      'https://vuejs.org/v2/guide/components.html#data-Must-Be-a-Function',
+      vm
+    );
+  }
+  // proxy data on instance
+  var keys = Object.keys(data);
+  var props = vm.$options.props;
+  var methods = vm.$options.methods;
+  var i = keys.length;
+  while (i--) {
+    var key = keys[i];
+    {
+      if (methods && hasOwn(methods, key)) {
+        warn(
+          ("Method \"" + key + "\" has already been defined as a data property."),
+          vm
+        );
+      }
+    }
+    if (props && hasOwn(props, key)) {
+      !IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && warn(
+        "The data property \"" + key + "\" is already declared as a prop. " +
+        "Use prop default value instead.",
+        vm
+      );
+    } else if (!isReserved(key)) {
+      proxy(vm, "_data", key);
+    }
+  }
+  // observe data
+  observe(data, true /* asRootData */);
+}
+
+function getData (data, vm) {
+  // #7573 disable dep collection when invoking data getters
+  pushTarget();
+  try {
+    return data.call(vm, vm)
+  } catch (e) {
+    handleError(e, vm, "data()");
+    return {}
+  } finally {
+    popTarget();
+  }
+}
+
+var computedWatcherOptions = { lazy: true };
+
+function initComputed (vm, computed) {
+  // $flow-disable-line
+  var watchers = vm._computedWatchers = Object.create(null);
+  // computed properties are just getters during SSR
+  var isSSR = isServerRendering();
+
+  for (var key in computed) {
+    var userDef = computed[key];
+    var getter = typeof userDef === 'function' ? userDef : userDef.get;
+    if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && getter == null) {
+      warn(
+        ("Getter is missing for computed property \"" + key + "\"."),
+        vm
+      );
+    }
+
+    if (!isSSR) {
+      // create internal watcher for the computed property.
+      watchers[key] = new Watcher(
+        vm,
+        getter || noop,
+        noop,
+        computedWatcherOptions
+      );
+    }
+
+    // component-defined computed properties are already defined on the
+    // component prototype. We only need to define computed properties defined
+    // at instantiation here.
+    if (!(key in vm)) {
+      defineComputed(vm, key, userDef);
+    } else {
+      if (key in vm.$data) {
+        warn(("The computed property \"" + key + "\" is already defined in data."), vm);
+      } else if (vm.$options.props && key in vm.$options.props) {
+        warn(("The computed property \"" + key + "\" is already defined as a prop."), vm);
+      }
+    }
+  }
+}
+
+function defineComputed (
+  target,
+  key,
+  userDef
+) {
+  var shouldCache = !isServerRendering();
+  if (typeof userDef === 'function') {
+    sharedPropertyDefinition.get = shouldCache
+      ? createComputedGetter(key)
+      : userDef;
+    sharedPropertyDefinition.set = noop;
+  } else {
+    sharedPropertyDefinition.get = userDef.get
+      ? shouldCache && userDef.cache !== false
+        ? createComputedGetter(key)
+        : userDef.get
+      : noop;
+    sharedPropertyDefinition.set = userDef.set
+      ? userDef.set
+      : noop;
+  }
+  if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE &&
+      sharedPropertyDefinition.set === noop) {
+    sharedPropertyDefinition.set = function () {
+      warn(
+        ("Computed property \"" + key + "\" was assigned to but it has no setter."),
+        this
+      );
+    };
+  }
+  Object.defineProperty(target, key, sharedPropertyDefinition);
+}
+
+function createComputedGetter (key) {
+  return function computedGetter () {
+    var watcher = this._computedWatchers && this._computedWatchers[key];
+    if (watcher) {
+      if (watcher.dirty) {
+        watcher.evaluate();
+      }
+      if (Dep.target) {
+        watcher.depend();
+      }
+      return watcher.value
+    }
+  }
+}
+
+function initMethods (vm, methods) {
+  var props = vm.$options.props;
+  for (var key in methods) {
+    {
+      if (methods[key] == null) {
+        warn(
+          "Method \"" + key + "\" has an undefined value in the component definition. " +
+          "Did you reference the function correctly?",
+          vm
+        );
+      }
+      if (props && hasOwn(props, key)) {
+        warn(
+          ("Method \"" + key + "\" has already been defined as a prop."),
+          vm
+        );
+      }
+      if ((key in vm) && isReserved(key)) {
+        warn(
+          "Method \"" + key + "\" conflicts with an existing Vue instance method. " +
+          "Avoid defining component methods that start with _ or $."
+        );
+      }
+    }
+    vm[key] = methods[key] == null ? noop : bind(methods[key], vm);
+  }
+}
+
+function initWatch (vm, watch) {
+  for (var key in watch) {
+    var handler = watch[key];
+    if (Array.isArray(handler)) {
+      for (var i = 0; i < handler.length; i++) {
+        createWatcher(vm, key, handler[i]);
+      }
+    } else {
+      createWatcher(vm, key, handler);
+    }
+  }
+}
+
+function createWatcher (
+  vm,
+  expOrFn,
+  handler,
+  options
+) {
+  if (isPlainObject(handler)) {
+    options = handler;
+    handler = handler.handler;
+  }
+  if (typeof handler === 'string') {
+    handler = vm[handler];
+  }
+  return vm.$watch(expOrFn, handler, options)
+}
+
+function stateMixin (Vue) {
+  // flow somehow has problems with directly declared definition object
+  // when using Object.defineProperty, so we have to procedurally build up
+  // the object here.
+  var dataDef = {};
+  dataDef.get = function () { return this._data };
+  var propsDef = {};
+  propsDef.get = function () { return this._props };
+  {
+    dataDef.set = function (newData) {
+      warn(
+        'Avoid replacing instance root $data. ' +
+        'Use nested data properties instead.',
+        this
+      );
+    };
+    propsDef.set = function () {
+      warn("$props is readonly.", this);
+    };
+  }
+  Object.defineProperty(Vue.prototype, '$data', dataDef);
+  Object.defineProperty(Vue.prototype, '$props', propsDef);
+
+  Vue.prototype.$set = set;
+  Vue.prototype.$delete = del;
+
+  Vue.prototype.$watch = function (
+    expOrFn,
+    cb,
+    options
+  ) {
+    var vm = this;
+    if (isPlainObject(cb)) {
+      return createWatcher(vm, expOrFn, cb, options)
+    }
+    options = options || {};
+    options.user = true;
+    var watcher = new Watcher(vm, expOrFn, cb, options);
+    if (options.immediate) {
+      cb.call(vm, watcher.value);
+    }
+    return function unwatchFn () {
+      watcher.teardown();
+    }
+  };
+}
+
+/*  */
+
+function initProvide (vm) {
+  var provide = vm.$options.provide;
+  if (provide) {
+    vm._provided = typeof provide === 'function'
+      ? provide.call(vm)
+      : provide;
+  }
+}
+
+function initInjections (vm) {
+  var result = resolveInject(vm.$options.inject, vm);
+  if (result) {
+    toggleObserving(false);
+    Object.keys(result).forEach(function (key) {
+      /* istanbul ignore else */
+      {
+        defineReactive(vm, key, result[key], function () {
+          warn(
+            "Avoid mutating an injected value directly since the changes will be " +
+            "overwritten whenever the provided component re-renders. " +
+            "injection being mutated: \"" + key + "\"",
+            vm
+          );
+        });
+      }
+    });
+    toggleObserving(true);
+  }
+}
+
+function resolveInject (inject, vm) {
+  if (inject) {
+    // inject is :any because flow is not smart enough to figure out cached
+    var result = Object.create(null);
+    var keys = hasSymbol
+      ? Reflect.ownKeys(inject).filter(function (key) {
+        /* istanbul ignore next */
+        return Object.getOwnPropertyDescriptor(inject, key).enumerable
+      })
+      : Object.keys(inject);
+
+    for (var i = 0; i < keys.length; i++) {
+      var key = keys[i];
+      var provideKey = inject[key].from;
+      var source = vm;
+      while (source) {
+        if (source._provided && hasOwn(source._provided, provideKey)) {
+          result[key] = source._provided[provideKey];
+          break
+        }
+        source = source.$parent;
+      }
+      if (!source) {
+        if ('default' in inject[key]) {
+          var provideDefault = inject[key].default;
+          result[key] = typeof provideDefault === 'function'
+            ? provideDefault.call(vm)
+            : provideDefault;
+        } else {
+          warn(("Injection \"" + key + "\" not found"), vm);
+        }
+      }
+    }
+    return result
+  }
+}
+
+/*  */
+
+/**
+ * Runtime helper for rendering v-for lists.
+ */
+function renderList (
+  val,
+  render
+) {
+  var ret, i, l, keys, key;
+  if (Array.isArray(val) || typeof val === 'string') {
+    ret = new Array(val.length);
+    for (i = 0, l = val.length; i < l; i++) {
+      ret[i] = render(val[i], i);
+    }
+  } else if (typeof val === 'number') {
+    ret = new Array(val);
+    for (i = 0; i < val; i++) {
+      ret[i] = render(i + 1, i);
+    }
+  } else if (isObject(val)) {
+    keys = Object.keys(val);
+    ret = new Array(keys.length);
+    for (i = 0, l = keys.length; i < l; i++) {
+      key = keys[i];
+      ret[i] = render(val[key], key, i);
+    }
+  }
+  if (isDef(ret)) {
+    (ret)._isVList = true;
+  }
+  return ret
+}
+
+/*  */
+
+/**
+ * Runtime helper for rendering <slot>
+ */
+function renderSlot (
+  name,
+  fallback,
+  props,
+  bindObject
+) {
+  var scopedSlotFn = this.$scopedSlots[name];
+  var nodes;
+  if (scopedSlotFn) { // scoped slot
+    props = props || {};
+    if (bindObject) {
+      if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && !isObject(bindObject)) {
+        warn(
+          'slot v-bind without argument expects an Object',
+          this
+        );
+      }
+      props = extend(extend({}, bindObject), props);
+    }
+    nodes = scopedSlotFn(props) || fallback;
+  } else {
+    var slotNodes = this.$slots[name];
+    // warn duplicate slot usage
+    if (slotNodes) {
+      if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && slotNodes._rendered) {
+        warn(
+          "Duplicate presence of slot \"" + name + "\" found in the same render tree " +
+          "- this will likely cause render errors.",
+          this
+        );
+      }
+      slotNodes._rendered = true;
+    }
+    nodes = slotNodes || fallback;
+  }
+
+  var target = props && props.slot;
+  if (target) {
+    return this.$createElement('template', { slot: target }, nodes)
+  } else {
+    return nodes
+  }
+}
+
+/*  */
+
+/**
+ * Runtime helper for resolving filters
+ */
+function resolveFilter (id) {
+  return resolveAsset(this.$options, 'filters', id, true) || identity
+}
+
+/*  */
+
+function isKeyNotMatch (expect, actual) {
+  if (Array.isArray(expect)) {
+    return expect.indexOf(actual) === -1
+  } else {
+    return expect !== actual
+  }
+}
+
+/**
+ * Runtime helper for checking keyCodes from config.
+ * exposed as Vue.prototype._k
+ * passing in eventKeyName as last argument separately for backwards compat
+ */
+function checkKeyCodes (
+  eventKeyCode,
+  key,
+  builtInKeyCode,
+  eventKeyName,
+  builtInKeyName
+) {
+  var mappedKeyCode = config.keyCodes[key] || builtInKeyCode;
+  if (builtInKeyName && eventKeyName && !config.keyCodes[key]) {
+    return isKeyNotMatch(builtInKeyName, eventKeyName)
+  } else if (mappedKeyCode) {
+    return isKeyNotMatch(mappedKeyCode, eventKeyCode)
+  } else if (eventKeyName) {
+    return hyphenate(eventKeyName) !== key
+  }
+}
+
+/*  */
+
+/**
+ * Runtime helper for merging v-bind="object" into a VNode's data.
+ */
+function bindObjectProps (
+  data,
+  tag,
+  value,
+  asProp,
+  isSync
+) {
+  if (value) {
+    if (!isObject(value)) {
+      !IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && warn(
+        'v-bind without argument expects an Object or Array value',
+        this
+      );
+    } else {
+      if (Array.isArray(value)) {
+        value = toObject(value);
+      }
+      var hash;
+      var loop = function ( key ) {
+        if (
+          key === 'class' ||
+          key === 'style' ||
+          isReservedAttribute(key)
+        ) {
+          hash = data;
+        } else {
+          var type = data.attrs && data.attrs.type;
+          hash = asProp || config.mustUseProp(tag, type, key)
+            ? data.domProps || (data.domProps = {})
+            : data.attrs || (data.attrs = {});
+        }
+        if (!(key in hash)) {
+          hash[key] = value[key];
+
+          if (isSync) {
+            var on = data.on || (data.on = {});
+            on[("update:" + key)] = function ($event) {
+              value[key] = $event;
+            };
+          }
+        }
+      };
+
+      for (var key in value) loop( key );
+    }
+  }
+  return data
+}
+
+/*  */
+
+/**
+ * Runtime helper for rendering static trees.
+ */
+function renderStatic (
+  index,
+  isInFor
+) {
+  var cached = this._staticTrees || (this._staticTrees = []);
+  var tree = cached[index];
+  // if has already-rendered static tree and not inside v-for,
+  // we can reuse the same tree.
+  if (tree && !isInFor) {
+    return tree
+  }
+  // otherwise, render a fresh tree.
+  tree = cached[index] = this.$options.staticRenderFns[index].call(
+    this._renderProxy,
+    null,
+    this // for render fns generated for functional component templates
+  );
+  markStatic(tree, ("__static__" + index), false);
+  return tree
+}
+
+/**
+ * Runtime helper for v-once.
+ * Effectively it means marking the node as static with a unique key.
+ */
+function markOnce (
+  tree,
+  index,
+  key
+) {
+  markStatic(tree, ("__once__" + index + (key ? ("_" + key) : "")), true);
+  return tree
+}
+
+function markStatic (
+  tree,
+  key,
+  isOnce
+) {
+  if (Array.isArray(tree)) {
+    for (var i = 0; i < tree.length; i++) {
+      if (tree[i] && typeof tree[i] !== 'string') {
+        markStaticNode(tree[i], (key + "_" + i), isOnce);
+      }
+    }
+  } else {
+    markStaticNode(tree, key, isOnce);
+  }
+}
+
+function markStaticNode (node, key, isOnce) {
+  node.isStatic = true;
+  node.key = key;
+  node.isOnce = isOnce;
+}
+
+/*  */
+
+function bindObjectListeners (data, value) {
+  if (value) {
+    if (!isPlainObject(value)) {
+      !IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && warn(
+        'v-on without argument expects an Object value',
+        this
+      );
+    } else {
+      var on = data.on = data.on ? extend({}, data.on) : {};
+      for (var key in value) {
+        var existing = on[key];
+        var ours = value[key];
+        on[key] = existing ? [].concat(existing, ours) : ours;
+      }
+    }
+  }
+  return data
+}
+
+/*  */
+
+function installRenderHelpers (target) {
+  target._o = markOnce;
+  target._n = toNumber;
+  target._s = toString;
+  target._l = renderList;
+  target._t = renderSlot;
+  target._q = looseEqual;
+  target._i = looseIndexOf;
+  target._m = renderStatic;
+  target._f = resolveFilter;
+  target._k = checkKeyCodes;
+  target._b = bindObjectProps;
+  target._v = createTextVNode;
+  target._e = createEmptyVNode;
+  target._u = resolveScopedSlots;
+  target._g = bindObjectListeners;
+}
+
+/*  */
+
+function FunctionalRenderContext (
+  data,
+  props,
+  children,
+  parent,
+  Ctor
+) {
+  var options = Ctor.options;
+  // ensure the createElement function in functional components
+  // gets a unique context - this is necessary for correct named slot check
+  var contextVm;
+  if (hasOwn(parent, '_uid')) {
+    contextVm = Object.create(parent);
+    // $flow-disable-line
+    contextVm._original = parent;
+  } else {
+    // the context vm passed in is a functional context as well.
+    // in this case we want to make sure we are able to get a hold to the
+    // real context instance.
+    contextVm = parent;
+    // $flow-disable-line
+    parent = parent._original;
+  }
+  var isCompiled = isTrue(options._compiled);
+  var needNormalization = !isCompiled;
+
+  this.data = data;
+  this.props = props;
+  this.children = children;
+  this.parent = parent;
+  this.listeners = data.on || emptyObject;
+  this.injections = resolveInject(options.inject, parent);
+  this.slots = function () { return resolveSlots(children, parent); };
+
+  // support for compiled functional template
+  if (isCompiled) {
+    // exposing $options for renderStatic()
+    this.$options = options;
+    // pre-resolve slots for renderSlot()
+    this.$slots = this.slots();
+    this.$scopedSlots = data.scopedSlots || emptyObject;
+  }
+
+  if (options._scopeId) {
+    this._c = function (a, b, c, d) {
+      var vnode = createElement(contextVm, a, b, c, d, needNormalization);
+      if (vnode && !Array.isArray(vnode)) {
+        vnode.fnScopeId = options._scopeId;
+        vnode.fnContext = parent;
+      }
+      return vnode
+    };
+  } else {
+    this._c = function (a, b, c, d) { return createElement(contextVm, a, b, c, d, needNormalization); };
+  }
+}
+
+installRenderHelpers(FunctionalRenderContext.prototype);
+
+function createFunctionalComponent (
+  Ctor,
+  propsData,
+  data,
+  contextVm,
+  children
+) {
+  var options = Ctor.options;
+  var props = {};
+  var propOptions = options.props;
+  if (isDef(propOptions)) {
+    for (var key in propOptions) {
+      props[key] = validateProp(key, propOptions, propsData || emptyObject);
+    }
+  } else {
+    if (isDef(data.attrs)) { mergeProps(props, data.attrs); }
+    if (isDef(data.props)) { mergeProps(props, data.props); }
+  }
+
+  var renderContext = new FunctionalRenderContext(
+    data,
+    props,
+    children,
+    contextVm,
+    Ctor
+  );
+
+  var vnode = options.render.call(null, renderContext._c, renderContext);
+
+  if (vnode instanceof VNode) {
+    return cloneAndMarkFunctionalResult(vnode, data, renderContext.parent, options)
+  } else if (Array.isArray(vnode)) {
+    var vnodes = normalizeChildren(vnode) || [];
+    var res = new Array(vnodes.length);
+    for (var i = 0; i < vnodes.length; i++) {
+      res[i] = cloneAndMarkFunctionalResult(vnodes[i], data, renderContext.parent, options);
+    }
+    return res
+  }
+}
+
+function cloneAndMarkFunctionalResult (vnode, data, contextVm, options) {
+  // #7817 clone node before setting fnContext, otherwise if the node is reused
+  // (e.g. it was from a cached normal slot) the fnContext causes named slots
+  // that should not be matched to match.
+  var clone = cloneVNode(vnode);
+  clone.fnContext = contextVm;
+  clone.fnOptions = options;
+  if (data.slot) {
+    (clone.data || (clone.data = {})).slot = data.slot;
+  }
+  return clone
+}
+
+function mergeProps (to, from) {
+  for (var key in from) {
+    to[camelize(key)] = from[key];
+  }
+}
+
+/*  */
+
+
+
+
+// Register the component hook to weex native render engine.
+// The hook will be triggered by native, not javascript.
+
+
+// Updates the state of the component to weex native render engine.
+
+/*  */
+
+// https://github.com/Hanks10100/weex-native-directive/tree/master/component
+
+// listening on native callback
+
+/*  */
+
+/*  */
+
+// inline hooks to be invoked on component VNodes during patch
+var componentVNodeHooks = {
+  init: function init (
+    vnode,
+    hydrating,
+    parentElm,
+    refElm
+  ) {
+    if (
+      vnode.componentInstance &&
+      !vnode.componentInstance._isDestroyed &&
+      vnode.data.keepAlive
+    ) {
+      // kept-alive components, treat as a patch
+      var mountedNode = vnode; // work around flow
+      componentVNodeHooks.prepatch(mountedNode, mountedNode);
+    } else {
+      var child = vnode.componentInstance = createComponentInstanceForVnode(
+        vnode,
+        activeInstance,
+        parentElm,
+        refElm
+      );
+      child.$mount(hydrating ? vnode.elm : undefined, hydrating);
+    }
+  },
+
+  prepatch: function prepatch (oldVnode, vnode) {
+    var options = vnode.componentOptions;
+    var child = vnode.componentInstance = oldVnode.componentInstance;
+    updateChildComponent(
+      child,
+      options.propsData, // updated props
+      options.listeners, // updated listeners
+      vnode, // new parent vnode
+      options.children // new children
+    );
+  },
+
+  insert: function insert (vnode) {
+    var context = vnode.context;
+    var componentInstance = vnode.componentInstance;
+    if (!componentInstance._isMounted) {
+      componentInstance._isMounted = true;
+      callHook(componentInstance, 'mounted');
+    }
+    if (vnode.data.keepAlive) {
+      if (context._isMounted) {
+        // vue-router#1212
+        // During updates, a kept-alive component's child components may
+        // change, so directly walking the tree here may call activated hooks
+        // on incorrect children. Instead we push them into a queue which will
+        // be processed after the whole patch process ended.
+        queueActivatedComponent(componentInstance);
+      } else {
+        activateChildComponent(componentInstance, true /* direct */);
+      }
+    }
+  },
+
+  destroy: function destroy (vnode) {
+    var componentInstance = vnode.componentInstance;
+    if (!componentInstance._isDestroyed) {
+      if (!vnode.data.keepAlive) {
+        componentInstance.$destroy();
+      } else {
+        deactivateChildComponent(componentInstance, true /* direct */);
+      }
+    }
+  }
+};
+
+var hooksToMerge = Object.keys(componentVNodeHooks);
+
+function createComponent (
+  Ctor,
+  data,
+  context,
+  children,
+  tag
+) {
+  if (isUndef(Ctor)) {
+    return
+  }
+
+  var baseCtor = context.$options._base;
+
+  // plain options object: turn it into a constructor
+  if (isObject(Ctor)) {
+    Ctor = baseCtor.extend(Ctor);
+  }
+
+  // if at this stage it's not a constructor or an async component factory,
+  // reject.
+  if (typeof Ctor !== 'function') {
+    {
+      warn(("Invalid Component definition: " + (String(Ctor))), context);
+    }
+    return
+  }
+
+  // async component
+  var asyncFactory;
+  if (isUndef(Ctor.cid)) {
+    asyncFactory = Ctor;
+    Ctor = resolveAsyncComponent(asyncFactory, baseCtor, context);
+    if (Ctor === undefined) {
+      // return a placeholder node for async component, which is rendered
+      // as a comment node but preserves all the raw information for the node.
+      // the information will be used for async server-rendering and hydration.
+      return createAsyncPlaceholder(
+        asyncFactory,
+        data,
+        context,
+        children,
+        tag
+      )
+    }
+  }
+
+  data = data || {};
+
+  // resolve constructor options in case global mixins are applied after
+  // component constructor creation
+  resolveConstructorOptions(Ctor);
+
+  // transform component v-model data into props & events
+  if (isDef(data.model)) {
+    transformModel(Ctor.options, data);
+  }
+
+  // extract props
+  var propsData = extractPropsFromVNodeData(data, Ctor, tag);
+
+  // functional component
+  if (isTrue(Ctor.options.functional)) {
+    return createFunctionalComponent(Ctor, propsData, data, context, children)
+  }
+
+  // extract listeners, since these needs to be treated as
+  // child component listeners instead of DOM listeners
+  var listeners = data.on;
+  // replace with listeners with .native modifier
+  // so it gets processed during parent component patch.
+  data.on = data.nativeOn;
+
+  if (isTrue(Ctor.options.abstract)) {
+    // abstract components do not keep anything
+    // other than props & listeners & slot
+
+    // work around flow
+    var slot = data.slot;
+    data = {};
+    if (slot) {
+      data.slot = slot;
+    }
+  }
+
+  // install component management hooks onto the placeholder node
+  installComponentHooks(data);
+
+  // return a placeholder vnode
+  var name = Ctor.options.name || tag;
+  var vnode = new VNode(
+    ("vue-component-" + (Ctor.cid) + (name ? ("-" + name) : '')),
+    data, undefined, undefined, undefined, context,
+    { Ctor: Ctor, propsData: propsData, listeners: listeners, tag: tag, children: children },
+    asyncFactory
+  );
+
+  // Weex specific: invoke recycle-list optimized @render function for
+  // extracting cell-slot template.
+  // https://github.com/Hanks10100/weex-native-directive/tree/master/component
+  /* istanbul ignore if */
+  return vnode
+}
+
+function createComponentInstanceForVnode (
+  vnode, // we know it's MountedComponentVNode but flow doesn't
+  parent, // activeInstance in lifecycle state
+  parentElm,
+  refElm
+) {
+  var options = {
+    _isComponent: true,
+    parent: parent,
+    _parentVnode: vnode,
+    _parentElm: parentElm || null,
+    _refElm: refElm || null
+  };
+  // check inline-template render functions
+  var inlineTemplate = vnode.data.inlineTemplate;
+  if (isDef(inlineTemplate)) {
+    options.render = inlineTemplate.render;
+    options.staticRenderFns = inlineTemplate.staticRenderFns;
+  }
+  return new vnode.componentOptions.Ctor(options)
+}
+
+function installComponentHooks (data) {
+  var hooks = data.hook || (data.hook = {});
+  for (var i = 0; i < hooksToMerge.length; i++) {
+    var key = hooksToMerge[i];
+    hooks[key] = componentVNodeHooks[key];
+  }
+}
+
+// transform component v-model info (value and callback) into
+// prop and event handler respectively.
+function transformModel (options, data) {
+  var prop = (options.model && options.model.prop) || 'value';
+  var event = (options.model && options.model.event) || 'input';(data.props || (data.props = {}))[prop] = data.model.value;
+  var on = data.on || (data.on = {});
+  if (isDef(on[event])) {
+    on[event] = [data.model.callback].concat(on[event]);
+  } else {
+    on[event] = data.model.callback;
+  }
+}
+
+/*  */
+
+var SIMPLE_NORMALIZE = 1;
+var ALWAYS_NORMALIZE = 2;
+
+// wrapper function for providing a more flexible interface
+// without getting yelled at by flow
+function createElement (
+  context,
+  tag,
+  data,
+  children,
+  normalizationType,
+  alwaysNormalize
+) {
+  if (Array.isArray(data) || isPrimitive(data)) {
+    normalizationType = children;
+    children = data;
+    data = undefined;
+  }
+  if (isTrue(alwaysNormalize)) {
+    normalizationType = ALWAYS_NORMALIZE;
+  }
+  return _createElement(context, tag, data, children, normalizationType)
+}
+
+function _createElement (
+  context,
+  tag,
+  data,
+  children,
+  normalizationType
+) {
+  if (isDef(data) && isDef((data).__ob__)) {
+    !IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && warn(
+      "Avoid using observed data object as vnode data: " + (JSON.stringify(data)) + "\n" +
+      'Always create fresh vnode data objects in each render!',
+      context
+    );
+    return createEmptyVNode()
+  }
+  // object syntax in v-bind
+  if (isDef(data) && isDef(data.is)) {
+    tag = data.is;
+  }
+  if (!tag) {
+    // in case of component :is set to falsy value
+    return createEmptyVNode()
+  }
+  // warn against non-primitive key
+  if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE &&
+    isDef(data) && isDef(data.key) && !isPrimitive(data.key)
+  ) {
+    {
+      warn(
+        'Avoid using non-primitive value as key, ' +
+        'use string/number value instead.',
+        context
+      );
+    }
+  }
+  // support single function children as default scoped slot
+  if (Array.isArray(children) &&
+    typeof children[0] === 'function'
+  ) {
+    data = data || {};
+    data.scopedSlots = { default: children[0] };
+    children.length = 0;
+  }
+  if (normalizationType === ALWAYS_NORMALIZE) {
+    children = normalizeChildren(children);
+  } else if (normalizationType === SIMPLE_NORMALIZE) {
+    children = simpleNormalizeChildren(children);
+  }
+  var vnode, ns;
+  if (typeof tag === 'string') {
+    var Ctor;
+    ns = (context.$vnode && context.$vnode.ns) || config.getTagNamespace(tag);
+    if (config.isReservedTag(tag)) {
+      // platform built-in elements
+      vnode = new VNode(
+        config.parsePlatformTagName(tag), data, children,
+        undefined, undefined, context
+      );
+    } else if (isDef(Ctor = resolveAsset(context.$options, 'components', tag))) {
+      // component
+      vnode = createComponent(Ctor, data, context, children, tag);
+    } else {
+      // unknown or unlisted namespaced elements
+      // check at runtime because it may get assigned a namespace when its
+      // parent normalizes children
+      vnode = new VNode(
+        tag, data, children,
+        undefined, undefined, context
+      );
+    }
+  } else {
+    // direct component options / constructor
+    vnode = createComponent(tag, data, context, children);
+  }
+  if (Array.isArray(vnode)) {
+    return vnode
+  } else if (isDef(vnode)) {
+    if (isDef(ns)) { applyNS(vnode, ns); }
+    if (isDef(data)) { registerDeepBindings(data); }
+    return vnode
+  } else {
+    return createEmptyVNode()
+  }
+}
+
+function applyNS (vnode, ns, force) {
+  vnode.ns = ns;
+  if (vnode.tag === 'foreignObject') {
+    // use default namespace inside foreignObject
+    ns = undefined;
+    force = true;
+  }
+  if (isDef(vnode.children)) {
+    for (var i = 0, l = vnode.children.length; i < l; i++) {
+      var child = vnode.children[i];
+      if (isDef(child.tag) && (
+        isUndef(child.ns) || (isTrue(force) && child.tag !== 'svg'))) {
+        applyNS(child, ns, force);
+      }
+    }
+  }
+}
+
+// ref #5318
+// necessary to ensure parent re-render when deep bindings like :style and
+// :class are used on slot nodes
+function registerDeepBindings (data) {
+  if (isObject(data.style)) {
+    traverse(data.style);
+  }
+  if (isObject(data.class)) {
+    traverse(data.class);
+  }
+}
+
+/*  */
+
+function initRender (vm) {
+  vm._vnode = null; // the root of the child tree
+  vm._staticTrees = null; // v-once cached trees
+  var options = vm.$options;
+  var parentVnode = vm.$vnode = options._parentVnode; // the placeholder node in parent tree
+  var renderContext = parentVnode && parentVnode.context;
+  vm.$slots = resolveSlots(options._renderChildren, renderContext);
+  vm.$scopedSlots = emptyObject;
+  // bind the createElement fn to this instance
+  // so that we get proper render context inside it.
+  // args order: tag, data, children, normalizationType, alwaysNormalize
+  // internal version is used by render functions compiled from templates
+  vm._c = function (a, b, c, d) { return createElement(vm, a, b, c, d, false); };
+  // normalization is always applied for the public version, used in
+  // user-written render functions.
+  vm.$createElement = function (a, b, c, d) { return createElement(vm, a, b, c, d, true); };
+
+  // $attrs & $listeners are exposed for easier HOC creation.
+  // they need to be reactive so that HOCs using them are always updated
+  var parentData = parentVnode && parentVnode.data;
+
+  /* istanbul ignore else */
+  {
+    defineReactive(vm, '$attrs', parentData && parentData.attrs || emptyObject, function () {
+      !isUpdatingChildComponent && warn("$attrs is readonly.", vm);
+    }, true);
+    defineReactive(vm, '$listeners', options._parentListeners || emptyObject, function () {
+      !isUpdatingChildComponent && warn("$listeners is readonly.", vm);
+    }, true);
+  }
+}
+
+function renderMixin (Vue) {
+  // install runtime convenience helpers
+  installRenderHelpers(Vue.prototype);
+
+  Vue.prototype.$nextTick = function (fn) {
+    return nextTick(fn, this)
+  };
+
+  Vue.prototype._render = function () {
+    var vm = this;
+    var ref = vm.$options;
+    var render = ref.render;
+    var _parentVnode = ref._parentVnode;
+
+    // reset _rendered flag on slots for duplicate slot check
+    {
+      for (var key in vm.$slots) {
+        // $flow-disable-line
+        vm.$slots[key]._rendered = false;
+      }
+    }
+
+    if (_parentVnode) {
+      vm.$scopedSlots = _parentVnode.data.scopedSlots || emptyObject;
+    }
+
+    // set parent vnode. this allows render functions to have access
+    // to the data on the placeholder node.
+    vm.$vnode = _parentVnode;
+    // render self
+    var vnode;
+    try {
+      vnode = render.call(vm._renderProxy, vm.$createElement);
+    } catch (e) {
+      handleError(e, vm, "render");
+      // return error render result,
+      // or previous vnode to prevent render error causing blank component
+      /* istanbul ignore else */
+      {
+        if (vm.$options.renderError) {
+          try {
+            vnode = vm.$options.renderError.call(vm._renderProxy, vm.$createElement, e);
+          } catch (e) {
+            handleError(e, vm, "renderError");
+            vnode = vm._vnode;
+          }
+        } else {
+          vnode = vm._vnode;
+        }
+      }
+    }
+    // return empty vnode in case the render function errored out
+    if (!(vnode instanceof VNode)) {
+      if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && Array.isArray(vnode)) {
+        warn(
+          'Multiple root nodes returned from render function. Render function ' +
+          'should return a single root node.',
+          vm
+        );
+      }
+      vnode = createEmptyVNode();
+    }
+    // set parent
+    vnode.parent = _parentVnode;
+    return vnode
+  };
+}
+
+/*  */
+
+var uid$3 = 0;
+
+function initMixin (Vue) {
+  Vue.prototype._init = function (options) {
+    var vm = this;
+    // a uid
+    vm._uid = uid$3++;
+
+    var startTag, endTag;
+    /* istanbul ignore if */
+    if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && config.performance && mark) {
+      startTag = "vue-perf-start:" + (vm._uid);
+      endTag = "vue-perf-end:" + (vm._uid);
+      mark(startTag);
+    }
+
+    // a flag to avoid this being observed
+    vm._isVue = true;
+    // merge options
+    if (options && options._isComponent) {
+      // optimize internal component instantiation
+      // since dynamic options merging is pretty slow, and none of the
+      // internal component options needs special treatment.
+      initInternalComponent(vm, options);
+    } else {
+      vm.$options = mergeOptions(
+        resolveConstructorOptions(vm.constructor),
+        options || {},
+        vm
+      );
+    }
+    /* istanbul ignore else */
+    {
+      initProxy(vm);
+    }
+    // expose real self
+    vm._self = vm;
+    initLifecycle(vm);
+    initEvents(vm);
+    initRender(vm);
+    callHook(vm, 'beforeCreate');
+    initInjections(vm); // resolve injections before data/props
+    initState(vm);
+    initProvide(vm); // resolve provide after data/props
+    callHook(vm, 'created');
+
+    /* istanbul ignore if */
+    if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && config.performance && mark) {
+      vm._name = formatComponentName(vm, false);
+      mark(endTag);
+      measure(("vue " + (vm._name) + " init"), startTag, endTag);
+    }
+
+    if (vm.$options.el) {
+      vm.$mount(vm.$options.el);
+    }
+  };
+}
+
+function initInternalComponent (vm, options) {
+  var opts = vm.$options = Object.create(vm.constructor.options);
+  // doing this because it's faster than dynamic enumeration.
+  var parentVnode = options._parentVnode;
+  opts.parent = options.parent;
+  opts._parentVnode = parentVnode;
+  opts._parentElm = options._parentElm;
+  opts._refElm = options._refElm;
+
+  var vnodeComponentOptions = parentVnode.componentOptions;
+  opts.propsData = vnodeComponentOptions.propsData;
+  opts._parentListeners = vnodeComponentOptions.listeners;
+  opts._renderChildren = vnodeComponentOptions.children;
+  opts._componentTag = vnodeComponentOptions.tag;
+
+  if (options.render) {
+    opts.render = options.render;
+    opts.staticRenderFns = options.staticRenderFns;
+  }
+}
+
+function resolveConstructorOptions (Ctor) {
+  var options = Ctor.options;
+  if (Ctor.super) {
+    var superOptions = resolveConstructorOptions(Ctor.super);
+    var cachedSuperOptions = Ctor.superOptions;
+    if (superOptions !== cachedSuperOptions) {
+      // super option changed,
+      // need to resolve new options.
+      Ctor.superOptions = superOptions;
+      // check if there are any late-modified/attached options (#4976)
+      var modifiedOptions = resolveModifiedOptions(Ctor);
+      // update base extend options
+      if (modifiedOptions) {
+        extend(Ctor.extendOptions, modifiedOptions);
+      }
+      options = Ctor.options = mergeOptions(superOptions, Ctor.extendOptions);
+      if (options.name) {
+        options.components[options.name] = Ctor;
+      }
+    }
+  }
+  return options
+}
+
+function resolveModifiedOptions (Ctor) {
+  var modified;
+  var latest = Ctor.options;
+  var extended = Ctor.extendOptions;
+  var sealed = Ctor.sealedOptions;
+  for (var key in latest) {
+    if (latest[key] !== sealed[key]) {
+      if (!modified) { modified = {}; }
+      modified[key] = dedupe(latest[key], extended[key], sealed[key]);
+    }
+  }
+  return modified
+}
+
+function dedupe (latest, extended, sealed) {
+  // compare latest and sealed to ensure lifecycle hooks won't be duplicated
+  // between merges
+  if (Array.isArray(latest)) {
+    var res = [];
+    sealed = Array.isArray(sealed) ? sealed : [sealed];
+    extended = Array.isArray(extended) ? extended : [extended];
+    for (var i = 0; i < latest.length; i++) {
+      // push original options and not sealed options to exclude duplicated options
+      if (extended.indexOf(latest[i]) >= 0 || sealed.indexOf(latest[i]) < 0) {
+        res.push(latest[i]);
+      }
+    }
+    return res
+  } else {
+    return latest
+  }
+}
+
+function Vue (options) {
+  if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE &&
+    !(this instanceof Vue)
+  ) {
+    warn('Vue is a constructor and should be called with the `new` keyword');
+  }
+  this._init(options);
+}
+
+initMixin(Vue);
+stateMixin(Vue);
+eventsMixin(Vue);
+lifecycleMixin(Vue);
+renderMixin(Vue);
+
+/*  */
+
+function initUse (Vue) {
+  Vue.use = function (plugin) {
+    var installedPlugins = (this._installedPlugins || (this._installedPlugins = []));
+    if (installedPlugins.indexOf(plugin) > -1) {
+      return this
+    }
+
+    // additional parameters
+    var args = toArray(arguments, 1);
+    args.unshift(this);
+    if (typeof plugin.install === 'function') {
+      plugin.install.apply(plugin, args);
+    } else if (typeof plugin === 'function') {
+      plugin.apply(null, args);
+    }
+    installedPlugins.push(plugin);
+    return this
+  };
+}
+
+/*  */
+
+function initMixin$1 (Vue) {
+  Vue.mixin = function (mixin) {
+    this.options = mergeOptions(this.options, mixin);
+    return this
+  };
+}
+
+/*  */
+
+function initExtend (Vue) {
+  /**
+   * Each instance constructor, including Vue, has a unique
+   * cid. This enables us to create wrapped "child
+   * constructors" for prototypal inheritance and cache them.
+   */
+  Vue.cid = 0;
+  var cid = 1;
+
+  /**
+   * Class inheritance
+   */
+  Vue.extend = function (extendOptions) {
+    extendOptions = extendOptions || {};
+    var Super = this;
+    var SuperId = Super.cid;
+    var cachedCtors = extendOptions._Ctor || (extendOptions._Ctor = {});
+    if (cachedCtors[SuperId]) {
+      return cachedCtors[SuperId]
+    }
+
+    var name = extendOptions.name || Super.options.name;
+    if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && name) {
+      validateComponentName(name);
+    }
+
+    var Sub = function VueComponent (options) {
+      this._init(options);
+    };
+    Sub.prototype = Object.create(Super.prototype);
+    Sub.prototype.constructor = Sub;
+    Sub.cid = cid++;
+    Sub.options = mergeOptions(
+      Super.options,
+      extendOptions
+    );
+    Sub['super'] = Super;
+
+    // For props and computed properties, we define the proxy getters on
+    // the Vue instances at extension time, on the extended prototype. This
+    // avoids Object.defineProperty calls for each instance created.
+    if (Sub.options.props) {
+      initProps$1(Sub);
+    }
+    if (Sub.options.computed) {
+      initComputed$1(Sub);
+    }
+
+    // allow further extension/mixin/plugin usage
+    Sub.extend = Super.extend;
+    Sub.mixin = Super.mixin;
+    Sub.use = Super.use;
+
+    // create asset registers, so extended classes
+    // can have their private assets too.
+    ASSET_TYPES.forEach(function (type) {
+      Sub[type] = Super[type];
+    });
+    // enable recursive self-lookup
+    if (name) {
+      Sub.options.components[name] = Sub;
+    }
+
+    // keep a reference to the super options at extension time.
+    // later at instantiation we can check if Super's options have
+    // been updated.
+    Sub.superOptions = Super.options;
+    Sub.extendOptions = extendOptions;
+    Sub.sealedOptions = extend({}, Sub.options);
+
+    // cache constructor
+    cachedCtors[SuperId] = Sub;
+    return Sub
+  };
+}
+
+function initProps$1 (Comp) {
+  var props = Comp.options.props;
+  for (var key in props) {
+    proxy(Comp.prototype, "_props", key);
+  }
+}
+
+function initComputed$1 (Comp) {
+  var computed = Comp.options.computed;
+  for (var key in computed) {
+    defineComputed(Comp.prototype, key, computed[key]);
+  }
+}
+
+/*  */
+
+function initAssetRegisters (Vue) {
+  /**
+   * Create asset registration methods.
+   */
+  ASSET_TYPES.forEach(function (type) {
+    Vue[type] = function (
+      id,
+      definition
+    ) {
+      if (!definition) {
+        return this.options[type + 's'][id]
+      } else {
+        /* istanbul ignore if */
+        if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && type === 'component') {
+          validateComponentName(id);
+        }
+        if (type === 'component' && isPlainObject(definition)) {
+          definition.name = definition.name || id;
+          definition = this.options._base.extend(definition);
+        }
+        if (type === 'directive' && typeof definition === 'function') {
+          definition = { bind: definition, update: definition };
+        }
+        this.options[type + 's'][id] = definition;
+        return definition
+      }
+    };
+  });
+}
+
+/*  */
+
+function getComponentName (opts) {
+  return opts && (opts.Ctor.options.name || opts.tag)
+}
+
+function matches (pattern, name) {
+  if (Array.isArray(pattern)) {
+    return pattern.indexOf(name) > -1
+  } else if (typeof pattern === 'string') {
+    return pattern.split(',').indexOf(name) > -1
+  } else if (isRegExp(pattern)) {
+    return pattern.test(name)
+  }
+  /* istanbul ignore next */
+  return false
+}
+
+function pruneCache (keepAliveInstance, filter) {
+  var cache = keepAliveInstance.cache;
+  var keys = keepAliveInstance.keys;
+  var _vnode = keepAliveInstance._vnode;
+  for (var key in cache) {
+    var cachedNode = cache[key];
+    if (cachedNode) {
+      var name = getComponentName(cachedNode.componentOptions);
+      if (name && !filter(name)) {
+        pruneCacheEntry(cache, key, keys, _vnode);
+      }
+    }
+  }
+}
+
+function pruneCacheEntry (
+  cache,
+  key,
+  keys,
+  current
+) {
+  var cached$$1 = cache[key];
+  if (cached$$1 && (!current || cached$$1.tag !== current.tag)) {
+    cached$$1.componentInstance.$destroy();
+  }
+  cache[key] = null;
+  remove(keys, key);
+}
+
+var patternTypes = [String, RegExp, Array];
+
+var KeepAlive = {
+  name: 'keep-alive',
+  abstract: true,
+
+  props: {
+    include: patternTypes,
+    exclude: patternTypes,
+    max: [String, Number]
+  },
+
+  created: function created () {
+    this.cache = Object.create(null);
+    this.keys = [];
+  },
+
+  destroyed: function destroyed () {
+    var this$1 = this;
+
+    for (var key in this$1.cache) {
+      pruneCacheEntry(this$1.cache, key, this$1.keys);
+    }
+  },
+
+  mounted: function mounted () {
+    var this$1 = this;
+
+    this.$watch('include', function (val) {
+      pruneCache(this$1, function (name) { return matches(val, name); });
+    });
+    this.$watch('exclude', function (val) {
+      pruneCache(this$1, function (name) { return !matches(val, name); });
+    });
+  },
+
+  render: function render () {
+    var slot = this.$slots.default;
+    var vnode = getFirstComponentChild(slot);
+    var componentOptions = vnode && vnode.componentOptions;
+    if (componentOptions) {
+      // check pattern
+      var name = getComponentName(componentOptions);
+      var ref = this;
+      var include = ref.include;
+      var exclude = ref.exclude;
+      if (
+        // not included
+        (include && (!name || !matches(include, name))) ||
+        // excluded
+        (exclude && name && matches(exclude, name))
+      ) {
+        return vnode
+      }
+
+      var ref$1 = this;
+      var cache = ref$1.cache;
+      var keys = ref$1.keys;
+      var key = vnode.key == null
+        // same constructor may get registered as different local components
+        // so cid alone is not enough (#3269)
+        ? componentOptions.Ctor.cid + (componentOptions.tag ? ("::" + (componentOptions.tag)) : '')
+        : vnode.key;
+      if (cache[key]) {
+        vnode.componentInstance = cache[key].componentInstance;
+        // make current key freshest
+        remove(keys, key);
+        keys.push(key);
+      } else {
+        cache[key] = vnode;
+        keys.push(key);
+        // prune oldest entry
+        if (this.max && keys.length > parseInt(this.max)) {
+          pruneCacheEntry(cache, keys[0], keys, this._vnode);
+        }
+      }
+
+      vnode.data.keepAlive = true;
+    }
+    return vnode || (slot && slot[0])
+  }
+}
+
+var builtInComponents = {
+  KeepAlive: KeepAlive
+}
+
+/*  */
+
+function initGlobalAPI (Vue) {
+  // config
+  var configDef = {};
+  configDef.get = function () { return config; };
+  {
+    configDef.set = function () {
+      warn(
+        'Do not replace the Vue.config object, set individual fields instead.'
+      );
+    };
+  }
+  Object.defineProperty(Vue, 'config', configDef);
+
+  // exposed util methods.
+  // NOTE: these are not considered part of the public API - avoid relying on
+  // them unless you are aware of the risk.
+  Vue.util = {
+    warn: warn,
+    extend: extend,
+    mergeOptions: mergeOptions,
+    defineReactive: defineReactive
+  };
+
+  Vue.set = set;
+  Vue.delete = del;
+  Vue.nextTick = nextTick;
+
+  Vue.options = Object.create(null);
+  ASSET_TYPES.forEach(function (type) {
+    Vue.options[type + 's'] = Object.create(null);
+  });
+
+  // this is used to identify the "base" constructor to extend all plain-object
+  // components with in Weex's multi-instance scenarios.
+  Vue.options._base = Vue;
+
+  extend(Vue.options.components, builtInComponents);
+
+  initUse(Vue);
+  initMixin$1(Vue);
+  initExtend(Vue);
+  initAssetRegisters(Vue);
+}
+
+initGlobalAPI(Vue);
+
+Object.defineProperty(Vue.prototype, '$isServer', {
+  get: isServerRendering
+});
+
+Object.defineProperty(Vue.prototype, '$ssrContext', {
+  get: function get () {
+    /* istanbul ignore next */
+    return this.$vnode && this.$vnode.ssrContext
+  }
+});
+
+// expose FunctionalRenderContext for ssr runtime helper installation
+Object.defineProperty(Vue, 'FunctionalRenderContext', {
+  value: FunctionalRenderContext
+});
+
+Vue.version = '2.5.17';
+
+/*  */
+
+// these are reserved for web because they are directly compiled away
+// during template compilation
+var isReservedAttr = makeMap('style,class');
+
+// attributes that should be using props for binding
+var acceptValue = makeMap('input,textarea,option,select,progress');
+var mustUseProp = function (tag, type, attr) {
+  return (
+    (attr === 'value' && acceptValue(tag)) && type !== 'button' ||
+    (attr === 'selected' && tag === 'option') ||
+    (attr === 'checked' && tag === 'input') ||
+    (attr === 'muted' && tag === 'video')
+  )
+};
+
+var isEnumeratedAttr = makeMap('contenteditable,draggable,spellcheck');
+
+var isBooleanAttr = makeMap(
+  'allowfullscreen,async,autofocus,autoplay,checked,compact,controls,declare,' +
+  'default,defaultchecked,defaultmuted,defaultselected,defer,disabled,' +
+  'enabled,formnovalidate,hidden,indeterminate,inert,ismap,itemscope,loop,multiple,' +
+  'muted,nohref,noresize,noshade,novalidate,nowrap,open,pauseonexit,readonly,' +
+  'required,reversed,scoped,seamless,selected,sortable,translate,' +
+  'truespeed,typemustmatch,visible'
+);
+
+var xlinkNS = 'http://www.w3.org/1999/xlink';
+
+var isXlink = function (name) {
+  return name.charAt(5) === ':' && name.slice(0, 5) === 'xlink'
+};
+
+var getXlinkProp = function (name) {
+  return isXlink(name) ? name.slice(6, name.length) : ''
+};
+
+var isFalsyAttrValue = function (val) {
+  return val == null || val === false
+};
+
+/*  */
+
+function genClassForVnode (vnode) {
+  var data = vnode.data;
+  var parentNode = vnode;
+  var childNode = vnode;
+  while (isDef(childNode.componentInstance)) {
+    childNode = childNode.componentInstance._vnode;
+    if (childNode && childNode.data) {
+      data = mergeClassData(childNode.data, data);
+    }
+  }
+  while (isDef(parentNode = parentNode.parent)) {
+    if (parentNode && parentNode.data) {
+      data = mergeClassData(data, parentNode.data);
+    }
+  }
+  return renderClass(data.staticClass, data.class)
+}
+
+function mergeClassData (child, parent) {
+  return {
+    staticClass: concat(child.staticClass, parent.staticClass),
+    class: isDef(child.class)
+      ? [child.class, parent.class]
+      : parent.class
+  }
+}
+
+function renderClass (
+  staticClass,
+  dynamicClass
+) {
+  if (isDef(staticClass) || isDef(dynamicClass)) {
+    return concat(staticClass, stringifyClass(dynamicClass))
+  }
+  /* istanbul ignore next */
+  return ''
+}
+
+function concat (a, b) {
+  return a ? b ? (a + ' ' + b) : a : (b || '')
+}
+
+function stringifyClass (value) {
+  if (Array.isArray(value)) {
+    return stringifyArray(value)
+  }
+  if (isObject(value)) {
+    return stringifyObject(value)
+  }
+  if (typeof value === 'string') {
+    return value
+  }
+  /* istanbul ignore next */
+  return ''
+}
+
+function stringifyArray (value) {
+  var res = '';
+  var stringified;
+  for (var i = 0, l = value.length; i < l; i++) {
+    if (isDef(stringified = stringifyClass(value[i])) && stringified !== '') {
+      if (res) { res += ' '; }
+      res += stringified;
+    }
+  }
+  return res
+}
+
+function stringifyObject (value) {
+  var res = '';
+  for (var key in value) {
+    if (value[key]) {
+      if (res) { res += ' '; }
+      res += key;
+    }
+  }
+  return res
+}
+
+/*  */
+
+var namespaceMap = {
+  svg: 'http://www.w3.org/2000/svg',
+  math: 'http://www.w3.org/1998/Math/MathML'
+};
+
+var isHTMLTag = makeMap(
+  'html,body,base,head,link,meta,style,title,' +
+  'address,article,aside,footer,header,h1,h2,h3,h4,h5,h6,hgroup,nav,section,' +
+  'div,dd,dl,dt,figcaption,figure,picture,hr,img,li,main,ol,p,pre,ul,' +
+  'a,b,abbr,bdi,bdo,br,cite,code,data,dfn,em,i,kbd,mark,q,rp,rt,rtc,ruby,' +
+  's,samp,small,span,strong,sub,sup,time,u,var,wbr,area,audio,map,track,video,' +
+  'embed,object,param,source,canvas,script,noscript,del,ins,' +
+  'caption,col,colgroup,table,thead,tbody,td,th,tr,' +
+  'button,datalist,fieldset,form,input,label,legend,meter,optgroup,option,' +
+  'output,progress,select,textarea,' +
+  'details,dialog,menu,menuitem,summary,' +
+  'content,element,shadow,template,blockquote,iframe,tfoot'
+);
+
+// this map is intentionally selective, only covering SVG elements that may
+// contain child elements.
+var isSVG = makeMap(
+  'svg,animate,circle,clippath,cursor,defs,desc,ellipse,filter,font-face,' +
+  'foreignObject,g,glyph,image,line,marker,mask,missing-glyph,path,pattern,' +
+  'polygon,polyline,rect,switch,symbol,text,textpath,tspan,use,view',
+  true
+);
+
+var isPreTag = function (tag) { return tag === 'pre'; };
+
+var isReservedTag = function (tag) {
+  return isHTMLTag(tag) || isSVG(tag)
+};
+
+function getTagNamespace (tag) {
+  if (isSVG(tag)) {
+    return 'svg'
+  }
+  // basic support for MathML
+  // note it doesn't support other MathML elements being component roots
+  if (tag === 'math') {
+    return 'math'
+  }
+}
+
+var unknownElementCache = Object.create(null);
+function isUnknownElement (tag) {
+  /* istanbul ignore if */
+  if (!inBrowser) {
+    return true
+  }
+  if (isReservedTag(tag)) {
+    return false
+  }
+  tag = tag.toLowerCase();
+  /* istanbul ignore if */
+  if (unknownElementCache[tag] != null) {
+    return unknownElementCache[tag]
+  }
+  var el = document.createElement(tag);
+  if (tag.indexOf('-') > -1) {
+    // http://stackoverflow.com/a/28210364/1070244
+    return (unknownElementCache[tag] = (
+      el.constructor === window.HTMLUnknownElement ||
+      el.constructor === window.HTMLElement
+    ))
+  } else {
+    return (unknownElementCache[tag] = /HTMLUnknownElement/.test(el.toString()))
+  }
+}
+
+var isTextInputType = makeMap('text,number,password,search,email,tel,url');
+
+/*  */
+
+/**
+ * Query an element selector if it's not an element already.
+ */
+function query (el) {
+  if (typeof el === 'string') {
+    var selected = document.querySelector(el);
+    if (!selected) {
+      !IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && warn(
+        'Cannot find element: ' + el
+      );
+      return document.createElement('div')
+    }
+    return selected
+  } else {
+    return el
+  }
+}
+
+/*  */
+
+function createElement$1 (tagName, vnode) {
+  var elm = document.createElement(tagName);
+  if (tagName !== 'select') {
+    return elm
+  }
+  // false or null will remove the attribute but undefined will not
+  if (vnode.data && vnode.data.attrs && vnode.data.attrs.multiple !== undefined) {
+    elm.setAttribute('multiple', 'multiple');
+  }
+  return elm
+}
+
+function createElementNS (namespace, tagName) {
+  return document.createElementNS(namespaceMap[namespace], tagName)
+}
+
+function createTextNode (text) {
+  return document.createTextNode(text)
+}
+
+function createComment (text) {
+  return document.createComment(text)
+}
+
+function insertBefore (parentNode, newNode, referenceNode) {
+  parentNode.insertBefore(newNode, referenceNode);
+}
+
+function removeChild (node, child) {
+  node.removeChild(child);
+}
+
+function appendChild (node, child) {
+  node.appendChild(child);
+}
+
+function parentNode (node) {
+  return node.parentNode
+}
+
+function nextSibling (node) {
+  return node.nextSibling
+}
+
+function tagName (node) {
+  return node.tagName
+}
+
+function setTextContent (node, text) {
+  node.textContent = text;
+}
+
+function setStyleScope (node, scopeId) {
+  node.setAttribute(scopeId, '');
+}
+
+
+var nodeOps = Object.freeze({
+  createElement: createElement$1,
+  createElementNS: createElementNS,
+  createTextNode: createTextNode,
+  createComment: createComment,
+  insertBefore: insertBefore,
+  removeChild: removeChild,
+  appendChild: appendChild,
+  parentNode: parentNode,
+  nextSibling: nextSibling,
+  tagName: tagName,
+  setTextContent: setTextContent,
+  setStyleScope: setStyleScope
+});
+
+/*  */
+
+var ref = {
+  create: function create (_, vnode) {
+    registerRef(vnode);
+  },
+  update: function update (oldVnode, vnode) {
+    if (oldVnode.data.ref !== vnode.data.ref) {
+      registerRef(oldVnode, true);
+      registerRef(vnode);
+    }
+  },
+  destroy: function destroy (vnode) {
+    registerRef(vnode, true);
+  }
+}
+
+function registerRef (vnode, isRemoval) {
+  var key = vnode.data.ref;
+  if (!isDef(key)) { return }
+
+  var vm = vnode.context;
+  var ref = vnode.componentInstance || vnode.elm;
+  var refs = vm.$refs;
+  if (isRemoval) {
+    if (Array.isArray(refs[key])) {
+      remove(refs[key], ref);
+    } else if (refs[key] === ref) {
+      refs[key] = undefined;
+    }
+  } else {
+    if (vnode.data.refInFor) {
+      if (!Array.isArray(refs[key])) {
+        refs[key] = [ref];
+      } else if (refs[key].indexOf(ref) < 0) {
+        // $flow-disable-line
+        refs[key].push(ref);
+      }
+    } else {
+      refs[key] = ref;
+    }
+  }
+}
+
+/**
+ * Virtual DOM patching algorithm based on Snabbdom by
+ * Simon Friis Vindum (@paldepind)
+ * Licensed under the MIT License
+ * https://github.com/paldepind/snabbdom/blob/master/LICENSE
+ *
+ * modified by Evan You (@yyx990803)
+ *
+ * Not type-checking this because this file is perf-critical and the cost
+ * of making flow understand it is not worth it.
+ */
+
+var emptyNode = new VNode('', {}, []);
+
+var hooks = ['create', 'activate', 'update', 'remove', 'destroy'];
+
+function sameVnode (a, b) {
+  return (
+    a.key === b.key && (
+      (
+        a.tag === b.tag &&
+        a.isComment === b.isComment &&
+        isDef(a.data) === isDef(b.data) &&
+        sameInputType(a, b)
+      ) || (
+        isTrue(a.isAsyncPlaceholder) &&
+        a.asyncFactory === b.asyncFactory &&
+        isUndef(b.asyncFactory.error)
+      )
+    )
+  )
+}
+
+function sameInputType (a, b) {
+  if (a.tag !== 'input') { return true }
+  var i;
+  var typeA = isDef(i = a.data) && isDef(i = i.attrs) && i.type;
+  var typeB = isDef(i = b.data) && isDef(i = i.attrs) && i.type;
+  return typeA === typeB || isTextInputType(typeA) && isTextInputType(typeB)
+}
+
+function createKeyToOldIdx (children, beginIdx, endIdx) {
+  var i, key;
+  var map = {};
+  for (i = beginIdx; i <= endIdx; ++i) {
+    key = children[i].key;
+    if (isDef(key)) { map[key] = i; }
+  }
+  return map
+}
+
+function createPatchFunction (backend) {
+  var i, j;
+  var cbs = {};
+
+  var modules = backend.modules;
+  var nodeOps = backend.nodeOps;
+
+  for (i = 0; i < hooks.length; ++i) {
+    cbs[hooks[i]] = [];
+    for (j = 0; j < modules.length; ++j) {
+      if (isDef(modules[j][hooks[i]])) {
+        cbs[hooks[i]].push(modules[j][hooks[i]]);
+      }
+    }
+  }
+
+  function emptyNodeAt (elm) {
+    return new VNode(nodeOps.tagName(elm).toLowerCase(), {}, [], undefined, elm)
+  }
+
+  function createRmCb (childElm, listeners) {
+    function remove () {
+      if (--remove.listeners === 0) {
+        removeNode(childElm);
+      }
+    }
+    remove.listeners = listeners;
+    return remove
+  }
+
+  function removeNode (el) {
+    var parent = nodeOps.parentNode(el);
+    // element may have already been removed due to v-html / v-text
+    if (isDef(parent)) {
+      nodeOps.removeChild(parent, el);
+    }
+  }
+
+  function isUnknownElement$$1 (vnode, inVPre) {
+    return (
+      !inVPre &&
+      !vnode.ns &&
+      !(
+        config.ignoredElements.length &&
+        config.ignoredElements.some(function (ignore) {
+          return isRegExp(ignore)
+            ? ignore.test(vnode.tag)
+            : ignore === vnode.tag
+        })
+      ) &&
+      config.isUnknownElement(vnode.tag)
+    )
+  }
+
+  var creatingElmInVPre = 0;
+
+  function createElm (
+    vnode,
+    insertedVnodeQueue,
+    parentElm,
+    refElm,
+    nested,
+    ownerArray,
+    index
+  ) {
+    if (isDef(vnode.elm) && isDef(ownerArray)) {
+      // This vnode was used in a previous render!
+      // now it's used as a new node, overwriting its elm would cause
+      // potential patch errors down the road when it's used as an insertion
+      // reference node. Instead, we clone the node on-demand before creating
+      // associated DOM element for it.
+      vnode = ownerArray[index] = cloneVNode(vnode);
+    }
+
+    vnode.isRootInsert = !nested; // for transition enter check
+    if (createComponent(vnode, insertedVnodeQueue, parentElm, refElm)) {
+      return
+    }
+
+    var data = vnode.data;
+    var children = vnode.children;
+    var tag = vnode.tag;
+    if (isDef(tag)) {
+      {
+        if (data && data.pre) {
+          creatingElmInVPre++;
+        }
+        if (isUnknownElement$$1(vnode, creatingElmInVPre)) {
+          warn(
+            'Unknown custom element: <' + tag + '> - did you ' +
+            'register the component correctly? For recursive components, ' +
+            'make sure to provide the "name" option.',
+            vnode.context
+          );
+        }
+      }
+
+      vnode.elm = vnode.ns
+        ? nodeOps.createElementNS(vnode.ns, tag)
+        : nodeOps.createElement(tag, vnode);
+      setScope(vnode);
+
+      /* istanbul ignore if */
+      {
+        createChildren(vnode, children, insertedVnodeQueue);
+        if (isDef(data)) {
+          invokeCreateHooks(vnode, insertedVnodeQueue);
+        }
+        insert(parentElm, vnode.elm, refElm);
+      }
+
+      if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && data && data.pre) {
+        creatingElmInVPre--;
+      }
+    } else if (isTrue(vnode.isComment)) {
+      vnode.elm = nodeOps.createComment(vnode.text);
+      insert(parentElm, vnode.elm, refElm);
+    } else {
+      vnode.elm = nodeOps.createTextNode(vnode.text);
+      insert(parentElm, vnode.elm, refElm);
+    }
+  }
+
+  function createComponent (vnode, insertedVnodeQueue, parentElm, refElm) {
+    var i = vnode.data;
+    if (isDef(i)) {
+      var isReactivated = isDef(vnode.componentInstance) && i.keepAlive;
+      if (isDef(i = i.hook) && isDef(i = i.init)) {
+        i(vnode, false /* hydrating */, parentElm, refElm);
+      }
+      // after calling the init hook, if the vnode is a child component
+      // it should've created a child instance and mounted it. the child
+      // component also has set the placeholder vnode's elm.
+      // in that case we can just return the element and be done.
+      if (isDef(vnode.componentInstance)) {
+        initComponent(vnode, insertedVnodeQueue);
+        if (isTrue(isReactivated)) {
+          reactivateComponent(vnode, insertedVnodeQueue, parentElm, refElm);
+        }
+        return true
+      }
+    }
+  }
+
+  function initComponent (vnode, insertedVnodeQueue) {
+    if (isDef(vnode.data.pendingInsert)) {
+      insertedVnodeQueue.push.apply(insertedVnodeQueue, vnode.data.pendingInsert);
+      vnode.data.pendingInsert = null;
+    }
+    vnode.elm = vnode.componentInstance.$el;
+    if (isPatchable(vnode)) {
+      invokeCreateHooks(vnode, insertedVnodeQueue);
+      setScope(vnode);
+    } else {
+      // empty component root.
+      // skip all element-related modules except for ref (#3455)
+      registerRef(vnode);
+      // make sure to invoke the insert hook
+      insertedVnodeQueue.push(vnode);
+    }
+  }
+
+  function reactivateComponent (vnode, insertedVnodeQueue, parentElm, refElm) {
+    var i;
+    // hack for #4339: a reactivated component with inner transition
+    // does not trigger because the inner node's created hooks are not called
+    // again. It's not ideal to involve module-specific logic in here but
+    // there doesn't seem to be a better way to do it.
+    var innerNode = vnode;
+    while (innerNode.componentInstance) {
+      innerNode = innerNode.componentInstance._vnode;
+      if (isDef(i = innerNode.data) && isDef(i = i.transition)) {
+        for (i = 0; i < cbs.activate.length; ++i) {
+          cbs.activate[i](emptyNode, innerNode);
+        }
+        insertedVnodeQueue.push(innerNode);
+        break
+      }
+    }
+    // unlike a newly created component,
+    // a reactivated keep-alive component doesn't insert itself
+    insert(parentElm, vnode.elm, refElm);
+  }
+
+  function insert (parent, elm, ref$$1) {
+    if (isDef(parent)) {
+      if (isDef(ref$$1)) {
+        if (ref$$1.parentNode === parent) {
+          nodeOps.insertBefore(parent, elm, ref$$1);
+        }
+      } else {
+        nodeOps.appendChild(parent, elm);
+      }
+    }
+  }
+
+  function createChildren (vnode, children, insertedVnodeQueue) {
+    if (Array.isArray(children)) {
+      {
+        checkDuplicateKeys(children);
+      }
+      for (var i = 0; i < children.length; ++i) {
+        createElm(children[i], insertedVnodeQueue, vnode.elm, null, true, children, i);
+      }
+    } else if (isPrimitive(vnode.text)) {
+      nodeOps.appendChild(vnode.elm, nodeOps.createTextNode(String(vnode.text)));
+    }
+  }
+
+  function isPatchable (vnode) {
+    while (vnode.componentInstance) {
+      vnode = vnode.componentInstance._vnode;
+    }
+    return isDef(vnode.tag)
+  }
+
+  function invokeCreateHooks (vnode, insertedVnodeQueue) {
+    for (var i$1 = 0; i$1 < cbs.create.length; ++i$1) {
+      cbs.create[i$1](emptyNode, vnode);
+    }
+    i = vnode.data.hook; // Reuse variable
+    if (isDef(i)) {
+      if (isDef(i.create)) { i.create(emptyNode, vnode); }
+      if (isDef(i.insert)) { insertedVnodeQueue.push(vnode); }
+    }
+  }
+
+  // set scope id attribute for scoped CSS.
+  // this is implemented as a special case to avoid the overhead
+  // of going through the normal attribute patching process.
+  function setScope (vnode) {
+    var i;
+    if (isDef(i = vnode.fnScopeId)) {
+      nodeOps.setStyleScope(vnode.elm, i);
+    } else {
+      var ancestor = vnode;
+      while (ancestor) {
+        if (isDef(i = ancestor.context) && isDef(i = i.$options._scopeId)) {
+          nodeOps.setStyleScope(vnode.elm, i);
+        }
+        ancestor = ancestor.parent;
+      }
+    }
+    // for slot content they should also get the scopeId from the host instance.
+    if (isDef(i = activeInstance) &&
+      i !== vnode.context &&
+      i !== vnode.fnContext &&
+      isDef(i = i.$options._scopeId)
+    ) {
+      nodeOps.setStyleScope(vnode.elm, i);
+    }
+  }
+
+  function addVnodes (parentElm, refElm, vnodes, startIdx, endIdx, insertedVnodeQueue) {
+    for (; startIdx <= endIdx; ++startIdx) {
+      createElm(vnodes[startIdx], insertedVnodeQueue, parentElm, refElm, false, vnodes, startIdx);
+    }
+  }
+
+  function invokeDestroyHook (vnode) {
+    var i, j;
+    var data = vnode.data;
+    if (isDef(data)) {
+      if (isDef(i = data.hook) && isDef(i = i.destroy)) { i(vnode); }
+      for (i = 0; i < cbs.destroy.length; ++i) { cbs.destroy[i](vnode); }
+    }
+    if (isDef(i = vnode.children)) {
+      for (j = 0; j < vnode.children.length; ++j) {
+        invokeDestroyHook(vnode.children[j]);
+      }
+    }
+  }
+
+  function removeVnodes (parentElm, vnodes, startIdx, endIdx) {
+    for (; startIdx <= endIdx; ++startIdx) {
+      var ch = vnodes[startIdx];
+      if (isDef(ch)) {
+        if (isDef(ch.tag)) {
+          removeAndInvokeRemoveHook(ch);
+          invokeDestroyHook(ch);
+        } else { // Text node
+          removeNode(ch.elm);
+        }
+      }
+    }
+  }
+
+  function removeAndInvokeRemoveHook (vnode, rm) {
+    if (isDef(rm) || isDef(vnode.data)) {
+      var i;
+      var listeners = cbs.remove.length + 1;
+      if (isDef(rm)) {
+        // we have a recursively passed down rm callback
+        // increase the listeners count
+        rm.listeners += listeners;
+      } else {
+        // directly removing
+        rm = createRmCb(vnode.elm, listeners);
+      }
+      // recursively invoke hooks on child component root node
+      if (isDef(i = vnode.componentInstance) && isDef(i = i._vnode) && isDef(i.data)) {
+        removeAndInvokeRemoveHook(i, rm);
+      }
+      for (i = 0; i < cbs.remove.length; ++i) {
+        cbs.remove[i](vnode, rm);
+      }
+      if (isDef(i = vnode.data.hook) && isDef(i = i.remove)) {
+        i(vnode, rm);
+      } else {
+        rm();
+      }
+    } else {
+      removeNode(vnode.elm);
+    }
+  }
+
+  function updateChildren (parentElm, oldCh, newCh, insertedVnodeQueue, removeOnly) {
+    var oldStartIdx = 0;
+    var newStartIdx = 0;
+    var oldEndIdx = oldCh.length - 1;
+    var oldStartVnode = oldCh[0];
+    var oldEndVnode = oldCh[oldEndIdx];
+    var newEndIdx = newCh.length - 1;
+    var newStartVnode = newCh[0];
+    var newEndVnode = newCh[newEndIdx];
+    var oldKeyToIdx, idxInOld, vnodeToMove, refElm;
+
+    // removeOnly is a special flag used only by <transition-group>
+    // to ensure removed elements stay in correct relative positions
+    // during leaving transitions
+    var canMove = !removeOnly;
+
+    {
+      checkDuplicateKeys(newCh);
+    }
+
+    while (oldStartIdx <= oldEndIdx && newStartIdx <= newEndIdx) {
+      if (isUndef(oldStartVnode)) {
+        oldStartVnode = oldCh[++oldStartIdx]; // Vnode has been moved left
+      } else if (isUndef(oldEndVnode)) {
+        oldEndVnode = oldCh[--oldEndIdx];
+      } else if (sameVnode(oldStartVnode, newStartVnode)) {
+        patchVnode(oldStartVnode, newStartVnode, insertedVnodeQueue);
+        oldStartVnode = oldCh[++oldStartIdx];
+        newStartVnode = newCh[++newStartIdx];
+      } else if (sameVnode(oldEndVnode, newEndVnode)) {
+        patchVnode(oldEndVnode, newEndVnode, insertedVnodeQueue);
+        oldEndVnode = oldCh[--oldEndIdx];
+        newEndVnode = newCh[--newEndIdx];
+      } else if (sameVnode(oldStartVnode, newEndVnode)) { // Vnode moved right
+        patchVnode(oldStartVnode, newEndVnode, insertedVnodeQueue);
+        canMove && nodeOps.insertBefore(parentElm, oldStartVnode.elm, nodeOps.nextSibling(oldEndVnode.elm));
+        oldStartVnode = oldCh[++oldStartIdx];
+        newEndVnode = newCh[--newEndIdx];
+      } else if (sameVnode(oldEndVnode, newStartVnode)) { // Vnode moved left
+        patchVnode(oldEndVnode, newStartVnode, insertedVnodeQueue);
+        canMove && nodeOps.insertBefore(parentElm, oldEndVnode.elm, oldStartVnode.elm);
+        oldEndVnode = oldCh[--oldEndIdx];
+        newStartVnode = newCh[++newStartIdx];
+      } else {
+        if (isUndef(oldKeyToIdx)) { oldKeyToIdx = createKeyToOldIdx(oldCh, oldStartIdx, oldEndIdx); }
+        idxInOld = isDef(newStartVnode.key)
+          ? oldKeyToIdx[newStartVnode.key]
+          : findIdxInOld(newStartVnode, oldCh, oldStartIdx, oldEndIdx);
+        if (isUndef(idxInOld)) { // New element
+          createElm(newStartVnode, insertedVnodeQueue, parentElm, oldStartVnode.elm, false, newCh, newStartIdx);
+        } else {
+          vnodeToMove = oldCh[idxInOld];
+          if (sameVnode(vnodeToMove, newStartVnode)) {
+            patchVnode(vnodeToMove, newStartVnode, insertedVnodeQueue);
+            oldCh[idxInOld] = undefined;
+            canMove && nodeOps.insertBefore(parentElm, vnodeToMove.elm, oldStartVnode.elm);
+          } else {
+            // same key but different element. treat as new element
+            createElm(newStartVnode, insertedVnodeQueue, parentElm, oldStartVnode.elm, false, newCh, newStartIdx);
+          }
+        }
+        newStartVnode = newCh[++newStartIdx];
+      }
+    }
+    if (oldStartIdx > oldEndIdx) {
+      refElm = isUndef(newCh[newEndIdx + 1]) ? null : newCh[newEndIdx + 1].elm;
+      addVnodes(parentElm, refElm, newCh, newStartIdx, newEndIdx, insertedVnodeQueue);
+    } else if (newStartIdx > newEndIdx) {
+      removeVnodes(parentElm, oldCh, oldStartIdx, oldEndIdx);
+    }
+  }
+
+  function checkDuplicateKeys (children) {
+    var seenKeys = {};
+    for (var i = 0; i < children.length; i++) {
+      var vnode = children[i];
+      var key = vnode.key;
+      if (isDef(key)) {
+        if (seenKeys[key]) {
+          warn(
+            ("Duplicate keys detected: '" + key + "'. This may cause an update error."),
+            vnode.context
+          );
+        } else {
+          seenKeys[key] = true;
+        }
+      }
+    }
+  }
+
+  function findIdxInOld (node, oldCh, start, end) {
+    for (var i = start; i < end; i++) {
+      var c = oldCh[i];
+      if (isDef(c) && sameVnode(node, c)) { return i }
+    }
+  }
+
+  function patchVnode (oldVnode, vnode, insertedVnodeQueue, removeOnly) {
+    if (oldVnode === vnode) {
+      return
+    }
+
+    var elm = vnode.elm = oldVnode.elm;
+
+    if (isTrue(oldVnode.isAsyncPlaceholder)) {
+      if (isDef(vnode.asyncFactory.resolved)) {
+        hydrate(oldVnode.elm, vnode, insertedVnodeQueue);
+      } else {
+        vnode.isAsyncPlaceholder = true;
+      }
+      return
+    }
+
+    // reuse element for static trees.
+    // note we only do this if the vnode is cloned -
+    // if the new node is not cloned it means the render functions have been
+    // reset by the hot-reload-api and we need to do a proper re-render.
+    if (isTrue(vnode.isStatic) &&
+      isTrue(oldVnode.isStatic) &&
+      vnode.key === oldVnode.key &&
+      (isTrue(vnode.isCloned) || isTrue(vnode.isOnce))
+    ) {
+      vnode.componentInstance = oldVnode.componentInstance;
+      return
+    }
+
+    var i;
+    var data = vnode.data;
+    if (isDef(data) && isDef(i = data.hook) && isDef(i = i.prepatch)) {
+      i(oldVnode, vnode);
+    }
+
+    var oldCh = oldVnode.children;
+    var ch = vnode.children;
+    if (isDef(data) && isPatchable(vnode)) {
+      for (i = 0; i < cbs.update.length; ++i) { cbs.update[i](oldVnode, vnode); }
+      if (isDef(i = data.hook) && isDef(i = i.update)) { i(oldVnode, vnode); }
+    }
+    if (isUndef(vnode.text)) {
+      if (isDef(oldCh) && isDef(ch)) {
+        if (oldCh !== ch) { updateChildren(elm, oldCh, ch, insertedVnodeQueue, removeOnly); }
+      } else if (isDef(ch)) {
+        if (isDef(oldVnode.text)) { nodeOps.setTextContent(elm, ''); }
+        addVnodes(elm, null, ch, 0, ch.length - 1, insertedVnodeQueue);
+      } else if (isDef(oldCh)) {
+        removeVnodes(elm, oldCh, 0, oldCh.length - 1);
+      } else if (isDef(oldVnode.text)) {
+        nodeOps.setTextContent(elm, '');
+      }
+    } else if (oldVnode.text !== vnode.text) {
+      nodeOps.setTextContent(elm, vnode.text);
+    }
+    if (isDef(data)) {
+      if (isDef(i = data.hook) && isDef(i = i.postpatch)) { i(oldVnode, vnode); }
+    }
+  }
+
+  function invokeInsertHook (vnode, queue, initial) {
+    // delay insert hooks for component root nodes, invoke them after the
+    // element is really inserted
+    if (isTrue(initial) && isDef(vnode.parent)) {
+      vnode.parent.data.pendingInsert = queue;
+    } else {
+      for (var i = 0; i < queue.length; ++i) {
+        queue[i].data.hook.insert(queue[i]);
+      }
+    }
+  }
+
+  var hydrationBailed = false;
+  // list of modules that can skip create hook during hydration because they
+  // are already rendered on the client or has no need for initialization
+  // Note: style is excluded because it relies on initial clone for future
+  // deep updates (#7063).
+  var isRenderedModule = makeMap('attrs,class,staticClass,staticStyle,key');
+
+  // Note: this is a browser-only function so we can assume elms are DOM nodes.
+  function hydrate (elm, vnode, insertedVnodeQueue, inVPre) {
+    var i;
+    var tag = vnode.tag;
+    var data = vnode.data;
+    var children = vnode.children;
+    inVPre = inVPre || (data && data.pre);
+    vnode.elm = elm;
+
+    if (isTrue(vnode.isComment) && isDef(vnode.asyncFactory)) {
+      vnode.isAsyncPlaceholder = true;
+      return true
+    }
+    // assert node match
+    {
+      if (!assertNodeMatch(elm, vnode, inVPre)) {
+        return false
+      }
+    }
+    if (isDef(data)) {
+      if (isDef(i = data.hook) && isDef(i = i.init)) { i(vnode, true /* hydrating */); }
+      if (isDef(i = vnode.componentInstance)) {
+        // child component. it should have hydrated its own tree.
+        initComponent(vnode, insertedVnodeQueue);
+        return true
+      }
+    }
+    if (isDef(tag)) {
+      if (isDef(children)) {
+        // empty element, allow client to pick up and populate children
+        if (!elm.hasChildNodes()) {
+          createChildren(vnode, children, insertedVnodeQueue);
+        } else {
+          // v-html and domProps: innerHTML
+          if (isDef(i = data) && isDef(i = i.domProps) && isDef(i = i.innerHTML)) {
+            if (i !== elm.innerHTML) {
+              /* istanbul ignore if */
+              if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE &&
+                typeof console !== 'undefined' &&
+                !hydrationBailed
+              ) {
+                hydrationBailed = true;
+                console.warn('Parent: ', elm);
+                console.warn('server innerHTML: ', i);
+                console.warn('client innerHTML: ', elm.innerHTML);
+              }
+              return false
+            }
+          } else {
+            // iterate and compare children lists
+            var childrenMatch = true;
+            var childNode = elm.firstChild;
+            for (var i$1 = 0; i$1 < children.length; i$1++) {
+              if (!childNode || !hydrate(childNode, children[i$1], insertedVnodeQueue, inVPre)) {
+                childrenMatch = false;
+                break
+              }
+              childNode = childNode.nextSibling;
+            }
+            // if childNode is not null, it means the actual childNodes list is
+            // longer than the virtual children list.
+            if (!childrenMatch || childNode) {
+              /* istanbul ignore if */
+              if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE &&
+                typeof console !== 'undefined' &&
+                !hydrationBailed
+              ) {
+                hydrationBailed = true;
+                console.warn('Parent: ', elm);
+                console.warn('Mismatching childNodes vs. VNodes: ', elm.childNodes, children);
+              }
+              return false
+            }
+          }
+        }
+      }
+      if (isDef(data)) {
+        var fullInvoke = false;
+        for (var key in data) {
+          if (!isRenderedModule(key)) {
+            fullInvoke = true;
+            invokeCreateHooks(vnode, insertedVnodeQueue);
+            break
+          }
+        }
+        if (!fullInvoke && data['class']) {
+          // ensure collecting deps for deep class bindings for future updates
+          traverse(data['class']);
+        }
+      }
+    } else if (elm.data !== vnode.text) {
+      elm.data = vnode.text;
+    }
+    return true
+  }
+
+  function assertNodeMatch (node, vnode, inVPre) {
+    if (isDef(vnode.tag)) {
+      return vnode.tag.indexOf('vue-component') === 0 || (
+        !isUnknownElement$$1(vnode, inVPre) &&
+        vnode.tag.toLowerCase() === (node.tagName && node.tagName.toLowerCase())
+      )
+    } else {
+      return node.nodeType === (vnode.isComment ? 8 : 3)
+    }
+  }
+
+  return function patch (oldVnode, vnode, hydrating, removeOnly, parentElm, refElm) {
+    if (isUndef(vnode)) {
+      if (isDef(oldVnode)) { invokeDestroyHook(oldVnode); }
+      return
+    }
+
+    var isInitialPatch = false;
+    var insertedVnodeQueue = [];
+
+    if (isUndef(oldVnode)) {
+      // empty mount (likely as component), create new root element
+      isInitialPatch = true;
+      createElm(vnode, insertedVnodeQueue, parentElm, refElm);
+    } else {
+      var isRealElement = isDef(oldVnode.nodeType);
+      if (!isRealElement && sameVnode(oldVnode, vnode)) {
+        // patch existing root node
+        patchVnode(oldVnode, vnode, insertedVnodeQueue, removeOnly);
+      } else {
+        if (isRealElement) {
+          // mounting to a real element
+          // check if this is server-rendered content and if we can perform
+          // a successful hydration.
+          if (oldVnode.nodeType === 1 && oldVnode.hasAttribute(SSR_ATTR)) {
+            oldVnode.removeAttribute(SSR_ATTR);
+            hydrating = true;
+          }
+          if (isTrue(hydrating)) {
+            if (hydrate(oldVnode, vnode, insertedVnodeQueue)) {
+              invokeInsertHook(vnode, insertedVnodeQueue, true);
+              return oldVnode
+            } else {
+              warn(
+                'The client-side rendered virtual DOM tree is not matching ' +
+                'server-rendered content. This is likely caused by incorrect ' +
+                'HTML markup, for example nesting block-level elements inside ' +
+                '<p>, or missing <tbody>. Bailing hydration and performing ' +
+                'full client-side render.'
+              );
+            }
+          }
+          // either not server-rendered, or hydration failed.
+          // create an empty node and replace it
+          oldVnode = emptyNodeAt(oldVnode);
+        }
+
+        // replacing existing element
+        var oldElm = oldVnode.elm;
+        var parentElm$1 = nodeOps.parentNode(oldElm);
+
+        // create new node
+        createElm(
+          vnode,
+          insertedVnodeQueue,
+          // extremely rare edge case: do not insert if old element is in a
+          // leaving transition. Only happens when combining transition +
+          // keep-alive + HOCs. (#4590)
+          oldElm._leaveCb ? null : parentElm$1,
+          nodeOps.nextSibling(oldElm)
+        );
+
+        // update parent placeholder node element, recursively
+        if (isDef(vnode.parent)) {
+          var ancestor = vnode.parent;
+          var patchable = isPatchable(vnode);
+          while (ancestor) {
+            for (var i = 0; i < cbs.destroy.length; ++i) {
+              cbs.destroy[i](ancestor);
+            }
+            ancestor.elm = vnode.elm;
+            if (patchable) {
+              for (var i$1 = 0; i$1 < cbs.create.length; ++i$1) {
+                cbs.create[i$1](emptyNode, ancestor);
+              }
+              // #6513
+              // invoke insert hooks that may have been merged by create hooks.
+              // e.g. for directives that uses the "inserted" hook.
+              var insert = ancestor.data.hook.insert;
+              if (insert.merged) {
+                // start at index 1 to avoid re-invoking component mounted hook
+                for (var i$2 = 1; i$2 < insert.fns.length; i$2++) {
+                  insert.fns[i$2]();
+                }
+              }
+            } else {
+              registerRef(ancestor);
+            }
+            ancestor = ancestor.parent;
+          }
+        }
+
+        // destroy old node
+        if (isDef(parentElm$1)) {
+          removeVnodes(parentElm$1, [oldVnode], 0, 0);
+        } else if (isDef(oldVnode.tag)) {
+          invokeDestroyHook(oldVnode);
+        }
+      }
+    }
+
+    invokeInsertHook(vnode, insertedVnodeQueue, isInitialPatch);
+    return vnode.elm
+  }
+}
+
+/*  */
+
+var directives = {
+  create: updateDirectives,
+  update: updateDirectives,
+  destroy: function unbindDirectives (vnode) {
+    updateDirectives(vnode, emptyNode);
+  }
+}
+
+function updateDirectives (oldVnode, vnode) {
+  if (oldVnode.data.directives || vnode.data.directives) {
+    _update(oldVnode, vnode);
+  }
+}
+
+function _update (oldVnode, vnode) {
+  var isCreate = oldVnode === emptyNode;
+  var isDestroy = vnode === emptyNode;
+  var oldDirs = normalizeDirectives$1(oldVnode.data.directives, oldVnode.context);
+  var newDirs = normalizeDirectives$1(vnode.data.directives, vnode.context);
+
+  var dirsWithInsert = [];
+  var dirsWithPostpatch = [];
+
+  var key, oldDir, dir;
+  for (key in newDirs) {
+    oldDir = oldDirs[key];
+    dir = newDirs[key];
+    if (!oldDir) {
+      // new directive, bind
+      callHook$1(dir, 'bind', vnode, oldVnode);
+      if (dir.def && dir.def.inserted) {
+        dirsWithInsert.push(dir);
+      }
+    } else {
+      // existing directive, update
+      dir.oldValue = oldDir.value;
+      callHook$1(dir, 'update', vnode, oldVnode);
+      if (dir.def && dir.def.componentUpdated) {
+        dirsWithPostpatch.push(dir);
+      }
+    }
+  }
+
+  if (dirsWithInsert.length) {
+    var callInsert = function () {
+      for (var i = 0; i < dirsWithInsert.length; i++) {
+        callHook$1(dirsWithInsert[i], 'inserted', vnode, oldVnode);
+      }
+    };
+    if (isCreate) {
+      mergeVNodeHook(vnode, 'insert', callInsert);
+    } else {
+      callInsert();
+    }
+  }
+
+  if (dirsWithPostpatch.length) {
+    mergeVNodeHook(vnode, 'postpatch', function () {
+      for (var i = 0; i < dirsWithPostpatch.length; i++) {
+        callHook$1(dirsWithPostpatch[i], 'componentUpdated', vnode, oldVnode);
+      }
+    });
+  }
+
+  if (!isCreate) {
+    for (key in oldDirs) {
+      if (!newDirs[key]) {
+        // no longer present, unbind
+        callHook$1(oldDirs[key], 'unbind', oldVnode, oldVnode, isDestroy);
+      }
+    }
+  }
+}
+
+var emptyModifiers = Object.create(null);
+
+function normalizeDirectives$1 (
+  dirs,
+  vm
+) {
+  var res = Object.create(null);
+  if (!dirs) {
+    // $flow-disable-line
+    return res
+  }
+  var i, dir;
+  for (i = 0; i < dirs.length; i++) {
+    dir = dirs[i];
+    if (!dir.modifiers) {
+      // $flow-disable-line
+      dir.modifiers = emptyModifiers;
+    }
+    res[getRawDirName(dir)] = dir;
+    dir.def = resolveAsset(vm.$options, 'directives', dir.name, true);
+  }
+  // $flow-disable-line
+  return res
+}
+
+function getRawDirName (dir) {
+  return dir.rawName || ((dir.name) + "." + (Object.keys(dir.modifiers || {}).join('.')))
+}
+
+function callHook$1 (dir, hook, vnode, oldVnode, isDestroy) {
+  var fn = dir.def && dir.def[hook];
+  if (fn) {
+    try {
+      fn(vnode.elm, dir, vnode, oldVnode, isDestroy);
+    } catch (e) {
+      handleError(e, vnode.context, ("directive " + (dir.name) + " " + hook + " hook"));
+    }
+  }
+}
+
+var baseModules = [
+  ref,
+  directives
+]
+
+/*  */
+
+function updateAttrs (oldVnode, vnode) {
+  var opts = vnode.componentOptions;
+  if (isDef(opts) && opts.Ctor.options.inheritAttrs === false) {
+    return
+  }
+  if (isUndef(oldVnode.data.attrs) && isUndef(vnode.data.attrs)) {
+    return
+  }
+  var key, cur, old;
+  var elm = vnode.elm;
+  var oldAttrs = oldVnode.data.attrs || {};
+  var attrs = vnode.data.attrs || {};
+  // clone observed objects, as the user probably wants to mutate it
+  if (isDef(attrs.__ob__)) {
+    attrs = vnode.data.attrs = extend({}, attrs);
+  }
+
+  for (key in attrs) {
+    cur = attrs[key];
+    old = oldAttrs[key];
+    if (old !== cur) {
+      setAttr(elm, key, cur);
+    }
+  }
+  // #4391: in IE9, setting type can reset value for input[type=radio]
+  // #6666: IE/Edge forces progress value down to 1 before setting a max
+  /* istanbul ignore if */
+  if ((isIE || isEdge) && attrs.value !== oldAttrs.value) {
+    setAttr(elm, 'value', attrs.value);
+  }
+  for (key in oldAttrs) {
+    if (isUndef(attrs[key])) {
+      if (isXlink(key)) {
+        elm.removeAttributeNS(xlinkNS, getXlinkProp(key));
+      } else if (!isEnumeratedAttr(key)) {
+        elm.removeAttribute(key);
+      }
+    }
+  }
+}
+
+function setAttr (el, key, value) {
+  if (el.tagName.indexOf('-') > -1) {
+    baseSetAttr(el, key, value);
+  } else if (isBooleanAttr(key)) {
+    // set attribute for blank value
+    // e.g. <option disabled>Select one</option>
+    if (isFalsyAttrValue(value)) {
+      el.removeAttribute(key);
+    } else {
+      // technically allowfullscreen is a boolean attribute for <iframe>,
+      // but Flash expects a value of "true" when used on <embed> tag
+      value = key === 'allowfullscreen' && el.tagName === 'EMBED'
+        ? 'true'
+        : key;
+      el.setAttribute(key, value);
+    }
+  } else if (isEnumeratedAttr(key)) {
+    el.setAttribute(key, isFalsyAttrValue(value) || value === 'false' ? 'false' : 'true');
+  } else if (isXlink(key)) {
+    if (isFalsyAttrValue(value)) {
+      el.removeAttributeNS(xlinkNS, getXlinkProp(key));
+    } else {
+      el.setAttributeNS(xlinkNS, key, value);
+    }
+  } else {
+    baseSetAttr(el, key, value);
+  }
+}
+
+function baseSetAttr (el, key, value) {
+  if (isFalsyAttrValue(value)) {
+    el.removeAttribute(key);
+  } else {
+    // #7138: IE10 & 11 fires input event when setting placeholder on
+    // <textarea>... block the first input event and remove the blocker
+    // immediately.
+    /* istanbul ignore if */
+    if (
+      isIE && !isIE9 &&
+      el.tagName === 'TEXTAREA' &&
+      key === 'placeholder' && !el.__ieph
+    ) {
+      var blocker = function (e) {
+        e.stopImmediatePropagation();
+        el.removeEventListener('input', blocker);
+      };
+      el.addEventListener('input', blocker);
+      // $flow-disable-line
+      el.__ieph = true; /* IE placeholder patched */
+    }
+    el.setAttribute(key, value);
+  }
+}
+
+var attrs = {
+  create: updateAttrs,
+  update: updateAttrs
+}
+
+/*  */
+
+function updateClass (oldVnode, vnode) {
+  var el = vnode.elm;
+  var data = vnode.data;
+  var oldData = oldVnode.data;
+  if (
+    isUndef(data.staticClass) &&
+    isUndef(data.class) && (
+      isUndef(oldData) || (
+        isUndef(oldData.staticClass) &&
+        isUndef(oldData.class)
+      )
+    )
+  ) {
+    return
+  }
+
+  var cls = genClassForVnode(vnode);
+
+  // handle transition classes
+  var transitionClass = el._transitionClasses;
+  if (isDef(transitionClass)) {
+    cls = concat(cls, stringifyClass(transitionClass));
+  }
+
+  // set the class
+  if (cls !== el._prevClass) {
+    el.setAttribute('class', cls);
+    el._prevClass = cls;
+  }
+}
+
+var klass = {
+  create: updateClass,
+  update: updateClass
+}
+
+/*  */
+
+var validDivisionCharRE = /[\w).+\-_$\]]/;
+
+function parseFilters (exp) {
+  var inSingle = false;
+  var inDouble = false;
+  var inTemplateString = false;
+  var inRegex = false;
+  var curly = 0;
+  var square = 0;
+  var paren = 0;
+  var lastFilterIndex = 0;
+  var c, prev, i, expression, filters;
+
+  for (i = 0; i < exp.length; i++) {
+    prev = c;
+    c = exp.charCodeAt(i);
+    if (inSingle) {
+      if (c === 0x27 && prev !== 0x5C) { inSingle = false; }
+    } else if (inDouble) {
+      if (c === 0x22 && prev !== 0x5C) { inDouble = false; }
+    } else if (inTemplateString) {
+      if (c === 0x60 && prev !== 0x5C) { inTemplateString = false; }
+    } else if (inRegex) {
+      if (c === 0x2f && prev !== 0x5C) { inRegex = false; }
+    } else if (
+      c === 0x7C && // pipe
+      exp.charCodeAt(i + 1) !== 0x7C &&
+      exp.charCodeAt(i - 1) !== 0x7C &&
+      !curly && !square && !paren
+    ) {
+      if (expression === undefined) {
+        // first filter, end of expression
+        lastFilterIndex = i + 1;
+        expression = exp.slice(0, i).trim();
+      } else {
+        pushFilter();
+      }
+    } else {
+      switch (c) {
+        case 0x22: inDouble = true; break         // "
+        case 0x27: inSingle = true; break         // '
+        case 0x60: inTemplateString = true; break // `
+        case 0x28: paren++; break                 // (
+        case 0x29: paren--; break                 // )
+        case 0x5B: square++; break                // [
+        case 0x5D: square--; break                // ]
+        case 0x7B: curly++; break                 // {
+        case 0x7D: curly--; break                 // }
+      }
+      if (c === 0x2f) { // /
+        var j = i - 1;
+        var p = (void 0);
+        // find first non-whitespace prev char
+        for (; j >= 0; j--) {
+          p = exp.charAt(j);
+          if (p !== ' ') { break }
+        }
+        if (!p || !validDivisionCharRE.test(p)) {
+          inRegex = true;
+        }
+      }
+    }
+  }
+
+  if (expression === undefined) {
+    expression = exp.slice(0, i).trim();
+  } else if (lastFilterIndex !== 0) {
+    pushFilter();
+  }
+
+  function pushFilter () {
+    (filters || (filters = [])).push(exp.slice(lastFilterIndex, i).trim());
+    lastFilterIndex = i + 1;
+  }
+
+  if (filters) {
+    for (i = 0; i < filters.length; i++) {
+      expression = wrapFilter(expression, filters[i]);
+    }
+  }
+
+  return expression
+}
+
+function wrapFilter (exp, filter) {
+  var i = filter.indexOf('(');
+  if (i < 0) {
+    // _f: resolveFilter
+    return ("_f(\"" + filter + "\")(" + exp + ")")
+  } else {
+    var name = filter.slice(0, i);
+    var args = filter.slice(i + 1);
+    return ("_f(\"" + name + "\")(" + exp + (args !== ')' ? ',' + args : args))
+  }
+}
+
+/*  */
+
+function baseWarn (msg) {
+  console.error(("[Vue compiler]: " + msg));
+}
+
+function pluckModuleFunction (
+  modules,
+  key
+) {
+  return modules
+    ? modules.map(function (m) { return m[key]; }).filter(function (_) { return _; })
+    : []
+}
+
+function addProp (el, name, value) {
+  (el.props || (el.props = [])).push({ name: name, value: value });
+  el.plain = false;
+}
+
+function addAttr (el, name, value) {
+  (el.attrs || (el.attrs = [])).push({ name: name, value: value });
+  el.plain = false;
+}
+
+// add a raw attr (use this in preTransforms)
+function addRawAttr (el, name, value) {
+  el.attrsMap[name] = value;
+  el.attrsList.push({ name: name, value: value });
+}
+
+function addDirective (
+  el,
+  name,
+  rawName,
+  value,
+  arg,
+  modifiers
+) {
+  (el.directives || (el.directives = [])).push({ name: name, rawName: rawName, value: value, arg: arg, modifiers: modifiers });
+  el.plain = false;
+}
+
+function addHandler (
+  el,
+  name,
+  value,
+  modifiers,
+  important,
+  warn
+) {
+  modifiers = modifiers || emptyObject;
+  // warn prevent and passive modifier
+  /* istanbul ignore if */
+  if (
+    !IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && warn &&
+    modifiers.prevent && modifiers.passive
+  ) {
+    warn(
+      'passive and prevent can\'t be used together. ' +
+      'Passive handler can\'t prevent default event.'
+    );
+  }
+
+  // check capture modifier
+  if (modifiers.capture) {
+    delete modifiers.capture;
+    name = '!' + name; // mark the event as captured
+  }
+  if (modifiers.once) {
+    delete modifiers.once;
+    name = '~' + name; // mark the event as once
+  }
+  /* istanbul ignore if */
+  if (modifiers.passive) {
+    delete modifiers.passive;
+    name = '&' + name; // mark the event as passive
+  }
+
+  // normalize click.right and click.middle since they don't actually fire
+  // this is technically browser-specific, but at least for now browsers are
+  // the only target envs that have right/middle clicks.
+  if (name === 'click') {
+    if (modifiers.right) {
+      name = 'contextmenu';
+      delete modifiers.right;
+    } else if (modifiers.middle) {
+      name = 'mouseup';
+    }
+  }
+
+  var events;
+  if (modifiers.native) {
+    delete modifiers.native;
+    events = el.nativeEvents || (el.nativeEvents = {});
+  } else {
+    events = el.events || (el.events = {});
+  }
+
+  var newHandler = {
+    value: value.trim()
+  };
+  if (modifiers !== emptyObject) {
+    newHandler.modifiers = modifiers;
+  }
+
+  var handlers = events[name];
+  /* istanbul ignore if */
+  if (Array.isArray(handlers)) {
+    important ? handlers.unshift(newHandler) : handlers.push(newHandler);
+  } else if (handlers) {
+    events[name] = important ? [newHandler, handlers] : [handlers, newHandler];
+  } else {
+    events[name] = newHandler;
+  }
+
+  el.plain = false;
+}
+
+function getBindingAttr (
+  el,
+  name,
+  getStatic
+) {
+  var dynamicValue =
+    getAndRemoveAttr(el, ':' + name) ||
+    getAndRemoveAttr(el, 'v-bind:' + name);
+  if (dynamicValue != null) {
+    return parseFilters(dynamicValue)
+  } else if (getStatic !== false) {
+    var staticValue = getAndRemoveAttr(el, name);
+    if (staticValue != null) {
+      return JSON.stringify(staticValue)
+    }
+  }
+}
+
+// note: this only removes the attr from the Array (attrsList) so that it
+// doesn't get processed by processAttrs.
+// By default it does NOT remove it from the map (attrsMap) because the map is
+// needed during codegen.
+function getAndRemoveAttr (
+  el,
+  name,
+  removeFromMap
+) {
+  var val;
+  if ((val = el.attrsMap[name]) != null) {
+    var list = el.attrsList;
+    for (var i = 0, l = list.length; i < l; i++) {
+      if (list[i].name === name) {
+        list.splice(i, 1);
+        break
+      }
+    }
+  }
+  if (removeFromMap) {
+    delete el.attrsMap[name];
+  }
+  return val
+}
+
+/*  */
+
+/**
+ * Cross-platform code generation for component v-model
+ */
+function genComponentModel (
+  el,
+  value,
+  modifiers
+) {
+  var ref = modifiers || {};
+  var number = ref.number;
+  var trim = ref.trim;
+
+  var baseValueExpression = '$$v';
+  var valueExpression = baseValueExpression;
+  if (trim) {
+    valueExpression =
+      "(typeof " + baseValueExpression + " === 'string'" +
+      "? " + baseValueExpression + ".trim()" +
+      ": " + baseValueExpression + ")";
+  }
+  if (number) {
+    valueExpression = "_n(" + valueExpression + ")";
+  }
+  var assignment = genAssignmentCode(value, valueExpression);
+
+  el.model = {
+    value: ("(" + value + ")"),
+    expression: ("\"" + value + "\""),
+    callback: ("function (" + baseValueExpression + ") {" + assignment + "}")
+  };
+}
+
+/**
+ * Cross-platform codegen helper for generating v-model value assignment code.
+ */
+function genAssignmentCode (
+  value,
+  assignment
+) {
+  var res = parseModel(value);
+  if (res.key === null) {
+    return (value + "=" + assignment)
+  } else {
+    return ("$set(" + (res.exp) + ", " + (res.key) + ", " + assignment + ")")
+  }
+}
+
+/**
+ * Parse a v-model expression into a base path and a final key segment.
+ * Handles both dot-path and possible square brackets.
+ *
+ * Possible cases:
+ *
+ * - test
+ * - test[key]
+ * - test[test1[key]]
+ * - test["a"][key]
+ * - xxx.test[a[a].test1[key]]
+ * - test.xxx.a["asa"][test1[key]]
+ *
+ */
+
+var len;
+var str;
+var chr;
+var index$1;
+var expressionPos;
+var expressionEndPos;
+
+
+
+function parseModel (val) {
+  // Fix https://github.com/vuejs/vue/pull/7730
+  // allow v-model="obj.val " (trailing whitespace)
+  val = val.trim();
+  len = val.length;
+
+  if (val.indexOf('[') < 0 || val.lastIndexOf(']') < len - 1) {
+    index$1 = val.lastIndexOf('.');
+    if (index$1 > -1) {
+      return {
+        exp: val.slice(0, index$1),
+        key: '"' + val.slice(index$1 + 1) + '"'
+      }
+    } else {
+      return {
+        exp: val,
+        key: null
+      }
+    }
+  }
+
+  str = val;
+  index$1 = expressionPos = expressionEndPos = 0;
+
+  while (!eof()) {
+    chr = next();
+    /* istanbul ignore if */
+    if (isStringStart(chr)) {
+      parseString(chr);
+    } else if (chr === 0x5B) {
+      parseBracket(chr);
+    }
+  }
+
+  return {
+    exp: val.slice(0, expressionPos),
+    key: val.slice(expressionPos + 1, expressionEndPos)
+  }
+}
+
+function next () {
+  return str.charCodeAt(++index$1)
+}
+
+function eof () {
+  return index$1 >= len
+}
+
+function isStringStart (chr) {
+  return chr === 0x22 || chr === 0x27
+}
+
+function parseBracket (chr) {
+  var inBracket = 1;
+  expressionPos = index$1;
+  while (!eof()) {
+    chr = next();
+    if (isStringStart(chr)) {
+      parseString(chr);
+      continue
+    }
+    if (chr === 0x5B) { inBracket++; }
+    if (chr === 0x5D) { inBracket--; }
+    if (inBracket === 0) {
+      expressionEndPos = index$1;
+      break
+    }
+  }
+}
+
+function parseString (chr) {
+  var stringQuote = chr;
+  while (!eof()) {
+    chr = next();
+    if (chr === stringQuote) {
+      break
+    }
+  }
+}
+
+/*  */
+
+var warn$1;
+
+// in some cases, the event used has to be determined at runtime
+// so we used some reserved tokens during compile.
+var RANGE_TOKEN = '__r';
+var CHECKBOX_RADIO_TOKEN = '__c';
+
+function model (
+  el,
+  dir,
+  _warn
+) {
+  warn$1 = _warn;
+  var value = dir.value;
+  var modifiers = dir.modifiers;
+  var tag = el.tag;
+  var type = el.attrsMap.type;
+
+  {
+    // inputs with type="file" are read only and setting the input's
+    // value will throw an error.
+    if (tag === 'input' && type === 'file') {
+      warn$1(
+        "<" + (el.tag) + " v-model=\"" + value + "\" type=\"file\">:\n" +
+        "File inputs are read only. Use a v-on:change listener instead."
+      );
+    }
+  }
+
+  if (el.component) {
+    genComponentModel(el, value, modifiers);
+    // component v-model doesn't need extra runtime
+    return false
+  } else if (tag === 'select') {
+    genSelect(el, value, modifiers);
+  } else if (tag === 'input' && type === 'checkbox') {
+    genCheckboxModel(el, value, modifiers);
+  } else if (tag === 'input' && type === 'radio') {
+    genRadioModel(el, value, modifiers);
+  } else if (tag === 'input' || tag === 'textarea') {
+    genDefaultModel(el, value, modifiers);
+  } else if (!config.isReservedTag(tag)) {
+    genComponentModel(el, value, modifiers);
+    // component v-model doesn't need extra runtime
+    return false
+  } else {
+    warn$1(
+      "<" + (el.tag) + " v-model=\"" + value + "\">: " +
+      "v-model is not supported on this element type. " +
+      'If you are working with contenteditable, it\'s recommended to ' +
+      'wrap a library dedicated for that purpose inside a custom component.'
+    );
+  }
+
+  // ensure runtime directive metadata
+  return true
+}
+
+function genCheckboxModel (
+  el,
+  value,
+  modifiers
+) {
+  var number = modifiers && modifiers.number;
+  var valueBinding = getBindingAttr(el, 'value') || 'null';
+  var trueValueBinding = getBindingAttr(el, 'true-value') || 'true';
+  var falseValueBinding = getBindingAttr(el, 'false-value') || 'false';
+  addProp(el, 'checked',
+    "Array.isArray(" + value + ")" +
+    "?_i(" + value + "," + valueBinding + ")>-1" + (
+      trueValueBinding === 'true'
+        ? (":(" + value + ")")
+        : (":_q(" + value + "," + trueValueBinding + ")")
+    )
+  );
+  addHandler(el, 'change',
+    "var $$a=" + value + "," +
+        '$$el=$event.target,' +
+        "$$c=$$el.checked?(" + trueValueBinding + "):(" + falseValueBinding + ");" +
+    'if(Array.isArray($$a)){' +
+      "var $$v=" + (number ? '_n(' + valueBinding + ')' : valueBinding) + "," +
+          '$$i=_i($$a,$$v);' +
+      "if($$el.checked){$$i<0&&(" + (genAssignmentCode(value, '$$a.concat([$$v])')) + ")}" +
+      "else{$$i>-1&&(" + (genAssignmentCode(value, '$$a.slice(0,$$i).concat($$a.slice($$i+1))')) + ")}" +
+    "}else{" + (genAssignmentCode(value, '$$c')) + "}",
+    null, true
+  );
+}
+
+function genRadioModel (
+  el,
+  value,
+  modifiers
+) {
+  var number = modifiers && modifiers.number;
+  var valueBinding = getBindingAttr(el, 'value') || 'null';
+  valueBinding = number ? ("_n(" + valueBinding + ")") : valueBinding;
+  addProp(el, 'checked', ("_q(" + value + "," + valueBinding + ")"));
+  addHandler(el, 'change', genAssignmentCode(value, valueBinding), null, true);
+}
+
+function genSelect (
+  el,
+  value,
+  modifiers
+) {
+  var number = modifiers && modifiers.number;
+  var selectedVal = "Array.prototype.filter" +
+    ".call($event.target.options,function(o){return o.selected})" +
+    ".map(function(o){var val = \"_value\" in o ? o._value : o.value;" +
+    "return " + (number ? '_n(val)' : 'val') + "})";
+
+  var assignment = '$event.target.multiple ? $$selectedVal : $$selectedVal[0]';
+  var code = "var $$selectedVal = " + selectedVal + ";";
+  code = code + " " + (genAssignmentCode(value, assignment));
+  addHandler(el, 'change', code, null, true);
+}
+
+function genDefaultModel (
+  el,
+  value,
+  modifiers
+) {
+  var type = el.attrsMap.type;
+
+  // warn if v-bind:value conflicts with v-model
+  // except for inputs with v-bind:type
+  {
+    var value$1 = el.attrsMap['v-bind:value'] || el.attrsMap[':value'];
+    var typeBinding = el.attrsMap['v-bind:type'] || el.attrsMap[':type'];
+    if (value$1 && !typeBinding) {
+      var binding = el.attrsMap['v-bind:value'] ? 'v-bind:value' : ':value';
+      warn$1(
+        binding + "=\"" + value$1 + "\" conflicts with v-model on the same element " +
+        'because the latter already expands to a value binding internally'
+      );
+    }
+  }
+
+  var ref = modifiers || {};
+  var lazy = ref.lazy;
+  var number = ref.number;
+  var trim = ref.trim;
+  var needCompositionGuard = !lazy && type !== 'range';
+  var event = lazy
+    ? 'change'
+    : type === 'range'
+      ? RANGE_TOKEN
+      : 'input';
+
+  var valueExpression = '$event.target.value';
+  if (trim) {
+    valueExpression = "$event.target.value.trim()";
+  }
+  if (number) {
+    valueExpression = "_n(" + valueExpression + ")";
+  }
+
+  var code = genAssignmentCode(value, valueExpression);
+  if (needCompositionGuard) {
+    code = "if($event.target.composing)return;" + code;
+  }
+
+  addProp(el, 'value', ("(" + value + ")"));
+  addHandler(el, event, code, null, true);
+  if (trim || number) {
+    addHandler(el, 'blur', '$forceUpdate()');
+  }
+}
+
+/*  */
+
+// normalize v-model event tokens that can only be determined at runtime.
+// it's important to place the event as the first in the array because
+// the whole point is ensuring the v-model callback gets called before
+// user-attached handlers.
+function normalizeEvents (on) {
+  /* istanbul ignore if */
+  if (isDef(on[RANGE_TOKEN])) {
+    // IE input[type=range] only supports `change` event
+    var event = isIE ? 'change' : 'input';
+    on[event] = [].concat(on[RANGE_TOKEN], on[event] || []);
+    delete on[RANGE_TOKEN];
+  }
+  // This was originally intended to fix #4521 but no longer necessary
+  // after 2.5. Keeping it for backwards compat with generated code from < 2.4
+  /* istanbul ignore if */
+  if (isDef(on[CHECKBOX_RADIO_TOKEN])) {
+    on.change = [].concat(on[CHECKBOX_RADIO_TOKEN], on.change || []);
+    delete on[CHECKBOX_RADIO_TOKEN];
+  }
+}
+
+var target$1;
+
+function createOnceHandler (handler, event, capture) {
+  var _target = target$1; // save current target element in closure
+  return function onceHandler () {
+    var res = handler.apply(null, arguments);
+    if (res !== null) {
+      remove$2(event, onceHandler, capture, _target);
+    }
+  }
+}
+
+function add$1 (
+  event,
+  handler,
+  once$$1,
+  capture,
+  passive
+) {
+  handler = withMacroTask(handler);
+  if (once$$1) { handler = createOnceHandler(handler, event, capture); }
+  target$1.addEventListener(
+    event,
+    handler,
+    supportsPassive
+      ? { capture: capture, passive: passive }
+      : capture
+  );
+}
+
+function remove$2 (
+  event,
+  handler,
+  capture,
+  _target
+) {
+  (_target || target$1).removeEventListener(
+    event,
+    handler._withTask || handler,
+    capture
+  );
+}
+
+function updateDOMListeners (oldVnode, vnode) {
+  if (isUndef(oldVnode.data.on) && isUndef(vnode.data.on)) {
+    return
+  }
+  var on = vnode.data.on || {};
+  var oldOn = oldVnode.data.on || {};
+  target$1 = vnode.elm;
+  normalizeEvents(on);
+  updateListeners(on, oldOn, add$1, remove$2, vnode.context);
+  target$1 = undefined;
+}
+
+var events = {
+  create: updateDOMListeners,
+  update: updateDOMListeners
+}
+
+/*  */
+
+function updateDOMProps (oldVnode, vnode) {
+  if (isUndef(oldVnode.data.domProps) && isUndef(vnode.data.domProps)) {
+    return
+  }
+  var key, cur;
+  var elm = vnode.elm;
+  var oldProps = oldVnode.data.domProps || {};
+  var props = vnode.data.domProps || {};
+  // clone observed objects, as the user probably wants to mutate it
+  if (isDef(props.__ob__)) {
+    props = vnode.data.domProps = extend({}, props);
+  }
+
+  for (key in oldProps) {
+    if (isUndef(props[key])) {
+      elm[key] = '';
+    }
+  }
+  for (key in props) {
+    cur = props[key];
+    // ignore children if the node has textContent or innerHTML,
+    // as these will throw away existing DOM nodes and cause removal errors
+    // on subsequent patches (#3360)
+    if (key === 'textContent' || key === 'innerHTML') {
+      if (vnode.children) { vnode.children.length = 0; }
+      if (cur === oldProps[key]) { continue }
+      // #6601 work around Chrome version <= 55 bug where single textNode
+      // replaced by innerHTML/textContent retains its parentNode property
+      if (elm.childNodes.length === 1) {
+        elm.removeChild(elm.childNodes[0]);
+      }
+    }
+
+    if (key === 'value') {
+      // store value as _value as well since
+      // non-string values will be stringified
+      elm._value = cur;
+      // avoid resetting cursor position when value is the same
+      var strCur = isUndef(cur) ? '' : String(cur);
+      if (shouldUpdateValue(elm, strCur)) {
+        elm.value = strCur;
+      }
+    } else {
+      elm[key] = cur;
+    }
+  }
+}
+
+// check platforms/web/util/attrs.js acceptValue
+
+
+function shouldUpdateValue (elm, checkVal) {
+  return (!elm.composing && (
+    elm.tagName === 'OPTION' ||
+    isNotInFocusAndDirty(elm, checkVal) ||
+    isDirtyWithModifiers(elm, checkVal)
+  ))
+}
+
+function isNotInFocusAndDirty (elm, checkVal) {
+  // return true when textbox (.number and .trim) loses focus and its value is
+  // not equal to the updated value
+  var notInFocus = true;
+  // #6157
+  // work around IE bug when accessing document.activeElement in an iframe
+  try { notInFocus = document.activeElement !== elm; } catch (e) {}
+  return notInFocus && elm.value !== checkVal
+}
+
+function isDirtyWithModifiers (elm, newVal) {
+  var value = elm.value;
+  var modifiers = elm._vModifiers; // injected by v-model runtime
+  if (isDef(modifiers)) {
+    if (modifiers.lazy) {
+      // inputs with lazy should only be updated when not in focus
+      return false
+    }
+    if (modifiers.number) {
+      return toNumber(value) !== toNumber(newVal)
+    }
+    if (modifiers.trim) {
+      return value.trim() !== newVal.trim()
+    }
+  }
+  return value !== newVal
+}
+
+var domProps = {
+  create: updateDOMProps,
+  update: updateDOMProps
+}
+
+/*  */
+
+var parseStyleText = cached(function (cssText) {
+  var res = {};
+  var listDelimiter = /;(?![^(]*\))/g;
+  var propertyDelimiter = /:(.+)/;
+  cssText.split(listDelimiter).forEach(function (item) {
+    if (item) {
+      var tmp = item.split(propertyDelimiter);
+      tmp.length > 1 && (res[tmp[0].trim()] = tmp[1].trim());
+    }
+  });
+  return res
+});
+
+// merge static and dynamic style data on the same vnode
+function normalizeStyleData (data) {
+  var style = normalizeStyleBinding(data.style);
+  // static style is pre-processed into an object during compilation
+  // and is always a fresh object, so it's safe to merge into it
+  return data.staticStyle
+    ? extend(data.staticStyle, style)
+    : style
+}
+
+// normalize possible array / string values into Object
+function normalizeStyleBinding (bindingStyle) {
+  if (Array.isArray(bindingStyle)) {
+    return toObject(bindingStyle)
+  }
+  if (typeof bindingStyle === 'string') {
+    return parseStyleText(bindingStyle)
+  }
+  return bindingStyle
+}
+
+/**
+ * parent component style should be after child's
+ * so that parent component's style could override it
+ */
+function getStyle (vnode, checkChild) {
+  var res = {};
+  var styleData;
+
+  if (checkChild) {
+    var childNode = vnode;
+    while (childNode.componentInstance) {
+      childNode = childNode.componentInstance._vnode;
+      if (
+        childNode && childNode.data &&
+        (styleData = normalizeStyleData(childNode.data))
+      ) {
+        extend(res, styleData);
+      }
+    }
+  }
+
+  if ((styleData = normalizeStyleData(vnode.data))) {
+    extend(res, styleData);
+  }
+
+  var parentNode = vnode;
+  while ((parentNode = parentNode.parent)) {
+    if (parentNode.data && (styleData = normalizeStyleData(parentNode.data))) {
+      extend(res, styleData);
+    }
+  }
+  return res
+}
+
+/*  */
+
+var cssVarRE = /^--/;
+var importantRE = /\s*!important$/;
+var setProp = function (el, name, val) {
+  /* istanbul ignore if */
+  if (cssVarRE.test(name)) {
+    el.style.setProperty(name, val);
+  } else if (importantRE.test(val)) {
+    el.style.setProperty(name, val.replace(importantRE, ''), 'important');
+  } else {
+    var normalizedName = normalize(name);
+    if (Array.isArray(val)) {
+      // Support values array created by autoprefixer, e.g.
+      // {display: ["-webkit-box", "-ms-flexbox", "flex"]}
+      // Set them one by one, and the browser will only set those it can recognize
+      for (var i = 0, len = val.length; i < len; i++) {
+        el.style[normalizedName] = val[i];
+      }
+    } else {
+      el.style[normalizedName] = val;
+    }
+  }
+};
+
+var vendorNames = ['Webkit', 'Moz', 'ms'];
+
+var emptyStyle;
+var normalize = cached(function (prop) {
+  emptyStyle = emptyStyle || document.createElement('div').style;
+  prop = camelize(prop);
+  if (prop !== 'filter' && (prop in emptyStyle)) {
+    return prop
+  }
+  var capName = prop.charAt(0).toUpperCase() + prop.slice(1);
+  for (var i = 0; i < vendorNames.length; i++) {
+    var name = vendorNames[i] + capName;
+    if (name in emptyStyle) {
+      return name
+    }
+  }
+});
+
+function updateStyle (oldVnode, vnode) {
+  var data = vnode.data;
+  var oldData = oldVnode.data;
+
+  if (isUndef(data.staticStyle) && isUndef(data.style) &&
+    isUndef(oldData.staticStyle) && isUndef(oldData.style)
+  ) {
+    return
+  }
+
+  var cur, name;
+  var el = vnode.elm;
+  var oldStaticStyle = oldData.staticStyle;
+  var oldStyleBinding = oldData.normalizedStyle || oldData.style || {};
+
+  // if static style exists, stylebinding already merged into it when doing normalizeStyleData
+  var oldStyle = oldStaticStyle || oldStyleBinding;
+
+  var style = normalizeStyleBinding(vnode.data.style) || {};
+
+  // store normalized style under a different key for next diff
+  // make sure to clone it if it's reactive, since the user likely wants
+  // to mutate it.
+  vnode.data.normalizedStyle = isDef(style.__ob__)
+    ? extend({}, style)
+    : style;
+
+  var newStyle = getStyle(vnode, true);
+
+  for (name in oldStyle) {
+    if (isUndef(newStyle[name])) {
+      setProp(el, name, '');
+    }
+  }
+  for (name in newStyle) {
+    cur = newStyle[name];
+    if (cur !== oldStyle[name]) {
+      // ie9 setting to null has no effect, must use empty string
+      setProp(el, name, cur == null ? '' : cur);
+    }
+  }
+}
+
+var style = {
+  create: updateStyle,
+  update: updateStyle
+}
+
+/*  */
+
+/**
+ * Add class with compatibility for SVG since classList is not supported on
+ * SVG elements in IE
+ */
+function addClass (el, cls) {
+  /* istanbul ignore if */
+  if (!cls || !(cls = cls.trim())) {
+    return
+  }
+
+  /* istanbul ignore else */
+  if (el.classList) {
+    if (cls.indexOf(' ') > -1) {
+      cls.split(/\s+/).forEach(function (c) { return el.classList.add(c); });
+    } else {
+      el.classList.add(cls);
+    }
+  } else {
+    var cur = " " + (el.getAttribute('class') || '') + " ";
+    if (cur.indexOf(' ' + cls + ' ') < 0) {
+      el.setAttribute('class', (cur + cls).trim());
+    }
+  }
+}
+
+/**
+ * Remove class with compatibility for SVG since classList is not supported on
+ * SVG elements in IE
+ */
+function removeClass (el, cls) {
+  /* istanbul ignore if */
+  if (!cls || !(cls = cls.trim())) {
+    return
+  }
+
+  /* istanbul ignore else */
+  if (el.classList) {
+    if (cls.indexOf(' ') > -1) {
+      cls.split(/\s+/).forEach(function (c) { return el.classList.remove(c); });
+    } else {
+      el.classList.remove(cls);
+    }
+    if (!el.classList.length) {
+      el.removeAttribute('class');
+    }
+  } else {
+    var cur = " " + (el.getAttribute('class') || '') + " ";
+    var tar = ' ' + cls + ' ';
+    while (cur.indexOf(tar) >= 0) {
+      cur = cur.replace(tar, ' ');
+    }
+    cur = cur.trim();
+    if (cur) {
+      el.setAttribute('class', cur);
+    } else {
+      el.removeAttribute('class');
+    }
+  }
+}
+
+/*  */
+
+function resolveTransition (def) {
+  if (!def) {
+    return
+  }
+  /* istanbul ignore else */
+  if (typeof def === 'object') {
+    var res = {};
+    if (def.css !== false) {
+      extend(res, autoCssTransition(def.name || 'v'));
+    }
+    extend(res, def);
+    return res
+  } else if (typeof def === 'string') {
+    return autoCssTransition(def)
+  }
+}
+
+var autoCssTransition = cached(function (name) {
+  return {
+    enterClass: (name + "-enter"),
+    enterToClass: (name + "-enter-to"),
+    enterActiveClass: (name + "-enter-active"),
+    leaveClass: (name + "-leave"),
+    leaveToClass: (name + "-leave-to"),
+    leaveActiveClass: (name + "-leave-active")
+  }
+});
+
+var hasTransition = inBrowser && !isIE9;
+var TRANSITION = 'transition';
+var ANIMATION = 'animation';
+
+// Transition property/event sniffing
+var transitionProp = 'transition';
+var transitionEndEvent = 'transitionend';
+var animationProp = 'animation';
+var animationEndEvent = 'animationend';
+if (hasTransition) {
+  /* istanbul ignore if */
+  if (window.ontransitionend === undefined &&
+    window.onwebkittransitionend !== undefined
+  ) {
+    transitionProp = 'WebkitTransition';
+    transitionEndEvent = 'webkitTransitionEnd';
+  }
+  if (window.onanimationend === undefined &&
+    window.onwebkitanimationend !== undefined
+  ) {
+    animationProp = 'WebkitAnimation';
+    animationEndEvent = 'webkitAnimationEnd';
+  }
+}
+
+// binding to window is necessary to make hot reload work in IE in strict mode
+var raf = inBrowser
+  ? window.requestAnimationFrame
+    ? window.requestAnimationFrame.bind(window)
+    : setTimeout
+  : /* istanbul ignore next */ function (fn) { return fn(); };
+
+function nextFrame (fn) {
+  raf(function () {
+    raf(fn);
+  });
+}
+
+function addTransitionClass (el, cls) {
+  var transitionClasses = el._transitionClasses || (el._transitionClasses = []);
+  if (transitionClasses.indexOf(cls) < 0) {
+    transitionClasses.push(cls);
+    addClass(el, cls);
+  }
+}
+
+function removeTransitionClass (el, cls) {
+  if (el._transitionClasses) {
+    remove(el._transitionClasses, cls);
+  }
+  removeClass(el, cls);
+}
+
+function whenTransitionEnds (
+  el,
+  expectedType,
+  cb
+) {
+  var ref = getTransitionInfo(el, expectedType);
+  var type = ref.type;
+  var timeout = ref.timeout;
+  var propCount = ref.propCount;
+  if (!type) { return cb() }
+  var event = type === TRANSITION ? transitionEndEvent : animationEndEvent;
+  var ended = 0;
+  var end = function () {
+    el.removeEventListener(event, onEnd);
+    cb();
+  };
+  var onEnd = function (e) {
+    if (e.target === el) {
+      if (++ended >= propCount) {
+        end();
+      }
+    }
+  };
+  setTimeout(function () {
+    if (ended < propCount) {
+      end();
+    }
+  }, timeout + 1);
+  el.addEventListener(event, onEnd);
+}
+
+var transformRE = /\b(transform|all)(,|$)/;
+
+function getTransitionInfo (el, expectedType) {
+  var styles = window.getComputedStyle(el);
+  var transitionDelays = styles[transitionProp + 'Delay'].split(', ');
+  var transitionDurations = styles[transitionProp + 'Duration'].split(', ');
+  var transitionTimeout = getTimeout(transitionDelays, transitionDurations);
+  var animationDelays = styles[animationProp + 'Delay'].split(', ');
+  var animationDurations = styles[animationProp + 'Duration'].split(', ');
+  var animationTimeout = getTimeout(animationDelays, animationDurations);
+
+  var type;
+  var timeout = 0;
+  var propCount = 0;
+  /* istanbul ignore if */
+  if (expectedType === TRANSITION) {
+    if (transitionTimeout > 0) {
+      type = TRANSITION;
+      timeout = transitionTimeout;
+      propCount = transitionDurations.length;
+    }
+  } else if (expectedType === ANIMATION) {
+    if (animationTimeout > 0) {
+      type = ANIMATION;
+      timeout = animationTimeout;
+      propCount = animationDurations.length;
+    }
+  } else {
+    timeout = Math.max(transitionTimeout, animationTimeout);
+    type = timeout > 0
+      ? transitionTimeout > animationTimeout
+        ? TRANSITION
+        : ANIMATION
+      : null;
+    propCount = type
+      ? type === TRANSITION
+        ? transitionDurations.length
+        : animationDurations.length
+      : 0;
+  }
+  var hasTransform =
+    type === TRANSITION &&
+    transformRE.test(styles[transitionProp + 'Property']);
+  return {
+    type: type,
+    timeout: timeout,
+    propCount: propCount,
+    hasTransform: hasTransform
+  }
+}
+
+function getTimeout (delays, durations) {
+  /* istanbul ignore next */
+  while (delays.length < durations.length) {
+    delays = delays.concat(delays);
+  }
+
+  return Math.max.apply(null, durations.map(function (d, i) {
+    return toMs(d) + toMs(delays[i])
+  }))
+}
+
+function toMs (s) {
+  return Number(s.slice(0, -1)) * 1000
+}
+
+/*  */
+
+function enter (vnode, toggleDisplay) {
+  var el = vnode.elm;
+
+  // call leave callback now
+  if (isDef(el._leaveCb)) {
+    el._leaveCb.cancelled = true;
+    el._leaveCb();
+  }
+
+  var data = resolveTransition(vnode.data.transition);
+  if (isUndef(data)) {
+    return
+  }
+
+  /* istanbul ignore if */
+  if (isDef(el._enterCb) || el.nodeType !== 1) {
+    return
+  }
+
+  var css = data.css;
+  var type = data.type;
+  var enterClass = data.enterClass;
+  var enterToClass = data.enterToClass;
+  var enterActiveClass = data.enterActiveClass;
+  var appearClass = data.appearClass;
+  var appearToClass = data.appearToClass;
+  var appearActiveClass = data.appearActiveClass;
+  var beforeEnter = data.beforeEnter;
+  var enter = data.enter;
+  var afterEnter = data.afterEnter;
+  var enterCancelled = data.enterCancelled;
+  var beforeAppear = data.beforeAppear;
+  var appear = data.appear;
+  var afterAppear = data.afterAppear;
+  var appearCancelled = data.appearCancelled;
+  var duration = data.duration;
+
+  // activeInstance will always be the <transition> component managing this
+  // transition. One edge case to check is when the <transition> is placed
+  // as the root node of a child component. In that case we need to check
+  // <transition>'s parent for appear check.
+  var context = activeInstance;
+  var transitionNode = activeInstance.$vnode;
+  while (transitionNode && transitionNode.parent) {
+    transitionNode = transitionNode.parent;
+    context = transitionNode.context;
+  }
+
+  var isAppear = !context._isMounted || !vnode.isRootInsert;
+
+  if (isAppear && !appear && appear !== '') {
+    return
+  }
+
+  var startClass = isAppear && appearClass
+    ? appearClass
+    : enterClass;
+  var activeClass = isAppear && appearActiveClass
+    ? appearActiveClass
+    : enterActiveClass;
+  var toClass = isAppear && appearToClass
+    ? appearToClass
+    : enterToClass;
+
+  var beforeEnterHook = isAppear
+    ? (beforeAppear || beforeEnter)
+    : beforeEnter;
+  var enterHook = isAppear
+    ? (typeof appear === 'function' ? appear : enter)
+    : enter;
+  var afterEnterHook = isAppear
+    ? (afterAppear || afterEnter)
+    : afterEnter;
+  var enterCancelledHook = isAppear
+    ? (appearCancelled || enterCancelled)
+    : enterCancelled;
+
+  var explicitEnterDuration = toNumber(
+    isObject(duration)
+      ? duration.enter
+      : duration
+  );
+
+  if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && explicitEnterDuration != null) {
+    checkDuration(explicitEnterDuration, 'enter', vnode);
+  }
+
+  var expectsCSS = css !== false && !isIE9;
+  var userWantsControl = getHookArgumentsLength(enterHook);
+
+  var cb = el._enterCb = once(function () {
+    if (expectsCSS) {
+      removeTransitionClass(el, toClass);
+      removeTransitionClass(el, activeClass);
+    }
+    if (cb.cancelled) {
+      if (expectsCSS) {
+        removeTransitionClass(el, startClass);
+      }
+      enterCancelledHook && enterCancelledHook(el);
+    } else {
+      afterEnterHook && afterEnterHook(el);
+    }
+    el._enterCb = null;
+  });
+
+  if (!vnode.data.show) {
+    // remove pending leave element on enter by injecting an insert hook
+    mergeVNodeHook(vnode, 'insert', function () {
+      var parent = el.parentNode;
+      var pendingNode = parent && parent._pending && parent._pending[vnode.key];
+      if (pendingNode &&
+        pendingNode.tag === vnode.tag &&
+        pendingNode.elm._leaveCb
+      ) {
+        pendingNode.elm._leaveCb();
+      }
+      enterHook && enterHook(el, cb);
+    });
+  }
+
+  // start enter transition
+  beforeEnterHook && beforeEnterHook(el);
+  if (expectsCSS) {
+    addTransitionClass(el, startClass);
+    addTransitionClass(el, activeClass);
+    nextFrame(function () {
+      removeTransitionClass(el, startClass);
+      if (!cb.cancelled) {
+        addTransitionClass(el, toClass);
+        if (!userWantsControl) {
+          if (isValidDuration(explicitEnterDuration)) {
+            setTimeout(cb, explicitEnterDuration);
+          } else {
+            whenTransitionEnds(el, type, cb);
+          }
+        }
+      }
+    });
+  }
+
+  if (vnode.data.show) {
+    toggleDisplay && toggleDisplay();
+    enterHook && enterHook(el, cb);
+  }
+
+  if (!expectsCSS && !userWantsControl) {
+    cb();
+  }
+}
+
+function leave (vnode, rm) {
+  var el = vnode.elm;
+
+  // call enter callback now
+  if (isDef(el._enterCb)) {
+    el._enterCb.cancelled = true;
+    el._enterCb();
+  }
+
+  var data = resolveTransition(vnode.data.transition);
+  if (isUndef(data) || el.nodeType !== 1) {
+    return rm()
+  }
+
+  /* istanbul ignore if */
+  if (isDef(el._leaveCb)) {
+    return
+  }
+
+  var css = data.css;
+  var type = data.type;
+  var leaveClass = data.leaveClass;
+  var leaveToClass = data.leaveToClass;
+  var leaveActiveClass = data.leaveActiveClass;
+  var beforeLeave = data.beforeLeave;
+  var leave = data.leave;
+  var afterLeave = data.afterLeave;
+  var leaveCancelled = data.leaveCancelled;
+  var delayLeave = data.delayLeave;
+  var duration = data.duration;
+
+  var expectsCSS = css !== false && !isIE9;
+  var userWantsControl = getHookArgumentsLength(leave);
+
+  var explicitLeaveDuration = toNumber(
+    isObject(duration)
+      ? duration.leave
+      : duration
+  );
+
+  if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && isDef(explicitLeaveDuration)) {
+    checkDuration(explicitLeaveDuration, 'leave', vnode);
+  }
+
+  var cb = el._leaveCb = once(function () {
+    if (el.parentNode && el.parentNode._pending) {
+      el.parentNode._pending[vnode.key] = null;
+    }
+    if (expectsCSS) {
+      removeTransitionClass(el, leaveToClass);
+      removeTransitionClass(el, leaveActiveClass);
+    }
+    if (cb.cancelled) {
+      if (expectsCSS) {
+        removeTransitionClass(el, leaveClass);
+      }
+      leaveCancelled && leaveCancelled(el);
+    } else {
+      rm();
+      afterLeave && afterLeave(el);
+    }
+    el._leaveCb = null;
+  });
+
+  if (delayLeave) {
+    delayLeave(performLeave);
+  } else {
+    performLeave();
+  }
+
+  function performLeave () {
+    // the delayed leave may have already been cancelled
+    if (cb.cancelled) {
+      return
+    }
+    // record leaving element
+    if (!vnode.data.show) {
+      (el.parentNode._pending || (el.parentNode._pending = {}))[(vnode.key)] = vnode;
+    }
+    beforeLeave && beforeLeave(el);
+    if (expectsCSS) {
+      addTransitionClass(el, leaveClass);
+      addTransitionClass(el, leaveActiveClass);
+      nextFrame(function () {
+        removeTransitionClass(el, leaveClass);
+        if (!cb.cancelled) {
+          addTransitionClass(el, leaveToClass);
+          if (!userWantsControl) {
+            if (isValidDuration(explicitLeaveDuration)) {
+              setTimeout(cb, explicitLeaveDuration);
+            } else {
+              whenTransitionEnds(el, type, cb);
+            }
+          }
+        }
+      });
+    }
+    leave && leave(el, cb);
+    if (!expectsCSS && !userWantsControl) {
+      cb();
+    }
+  }
+}
+
+// only used in dev mode
+function checkDuration (val, name, vnode) {
+  if (typeof val !== 'number') {
+    warn(
+      "<transition> explicit " + name + " duration is not a valid number - " +
+      "got " + (JSON.stringify(val)) + ".",
+      vnode.context
+    );
+  } else if (isNaN(val)) {
+    warn(
+      "<transition> explicit " + name + " duration is NaN - " +
+      'the duration expression might be incorrect.',
+      vnode.context
+    );
+  }
+}
+
+function isValidDuration (val) {
+  return typeof val === 'number' && !isNaN(val)
+}
+
+/**
+ * Normalize a transition hook's argument length. The hook may be:
+ * - a merged hook (invoker) with the original in .fns
+ * - a wrapped component method (check ._length)
+ * - a plain function (.length)
+ */
+function getHookArgumentsLength (fn) {
+  if (isUndef(fn)) {
+    return false
+  }
+  var invokerFns = fn.fns;
+  if (isDef(invokerFns)) {
+    // invoker
+    return getHookArgumentsLength(
+      Array.isArray(invokerFns)
+        ? invokerFns[0]
+        : invokerFns
+    )
+  } else {
+    return (fn._length || fn.length) > 1
+  }
+}
+
+function _enter (_, vnode) {
+  if (vnode.data.show !== true) {
+    enter(vnode);
+  }
+}
+
+var transition = inBrowser ? {
+  create: _enter,
+  activate: _enter,
+  remove: function remove$$1 (vnode, rm) {
+    /* istanbul ignore else */
+    if (vnode.data.show !== true) {
+      leave(vnode, rm);
+    } else {
+      rm();
+    }
+  }
+} : {}
+
+var platformModules = [
+  attrs,
+  klass,
+  events,
+  domProps,
+  style,
+  transition
+]
+
+/*  */
+
+// the directive module should be applied last, after all
+// built-in modules have been applied.
+var modules = platformModules.concat(baseModules);
+
+var patch = createPatchFunction({ nodeOps: nodeOps, modules: modules });
+
+/**
+ * Not type checking this file because flow doesn't like attaching
+ * properties to Elements.
+ */
+
+/* istanbul ignore if */
+if (isIE9) {
+  // http://www.matts411.com/post/internet-explorer-9-oninput/
+  document.addEventListener('selectionchange', function () {
+    var el = document.activeElement;
+    if (el && el.vmodel) {
+      trigger(el, 'input');
+    }
+  });
+}
+
+var directive = {
+  inserted: function inserted (el, binding, vnode, oldVnode) {
+    if (vnode.tag === 'select') {
+      // #6903
+      if (oldVnode.elm && !oldVnode.elm._vOptions) {
+        mergeVNodeHook(vnode, 'postpatch', function () {
+          directive.componentUpdated(el, binding, vnode);
+        });
+      } else {
+        setSelected(el, binding, vnode.context);
+      }
+      el._vOptions = [].map.call(el.options, getValue);
+    } else if (vnode.tag === 'textarea' || isTextInputType(el.type)) {
+      el._vModifiers = binding.modifiers;
+      if (!binding.modifiers.lazy) {
+        el.addEventListener('compositionstart', onCompositionStart);
+        el.addEventListener('compositionend', onCompositionEnd);
+        // Safari < 10.2 & UIWebView doesn't fire compositionend when
+        // switching focus before confirming composition choice
+        // this also fixes the issue where some browsers e.g. iOS Chrome
+        // fires "change" instead of "input" on autocomplete.
+        el.addEventListener('change', onCompositionEnd);
+        /* istanbul ignore if */
+        if (isIE9) {
+          el.vmodel = true;
+        }
+      }
+    }
+  },
+
+  componentUpdated: function componentUpdated (el, binding, vnode) {
+    if (vnode.tag === 'select') {
+      setSelected(el, binding, vnode.context);
+      // in case the options rendered by v-for have changed,
+      // it's possible that the value is out-of-sync with the rendered options.
+      // detect such cases and filter out values that no longer has a matching
+      // option in the DOM.
+      var prevOptions = el._vOptions;
+      var curOptions = el._vOptions = [].map.call(el.options, getValue);
+      if (curOptions.some(function (o, i) { return !looseEqual(o, prevOptions[i]); })) {
+        // trigger change event if
+        // no matching option found for at least one value
+        var needReset = el.multiple
+          ? binding.value.some(function (v) { return hasNoMatchingOption(v, curOptions); })
+          : binding.value !== binding.oldValue && hasNoMatchingOption(binding.value, curOptions);
+        if (needReset) {
+          trigger(el, 'change');
+        }
+      }
+    }
+  }
+};
+
+function setSelected (el, binding, vm) {
+  actuallySetSelected(el, binding, vm);
+  /* istanbul ignore if */
+  if (isIE || isEdge) {
+    setTimeout(function () {
+      actuallySetSelected(el, binding, vm);
+    }, 0);
+  }
+}
+
+function actuallySetSelected (el, binding, vm) {
+  var value = binding.value;
+  var isMultiple = el.multiple;
+  if (isMultiple && !Array.isArray(value)) {
+    !IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && warn(
+      "<select multiple v-model=\"" + (binding.expression) + "\"> " +
+      "expects an Array value for its binding, but got " + (Object.prototype.toString.call(value).slice(8, -1)),
+      vm
+    );
+    return
+  }
+  var selected, option;
+  for (var i = 0, l = el.options.length; i < l; i++) {
+    option = el.options[i];
+    if (isMultiple) {
+      selected = looseIndexOf(value, getValue(option)) > -1;
+      if (option.selected !== selected) {
+        option.selected = selected;
+      }
+    } else {
+      if (looseEqual(getValue(option), value)) {
+        if (el.selectedIndex !== i) {
+          el.selectedIndex = i;
+        }
+        return
+      }
+    }
+  }
+  if (!isMultiple) {
+    el.selectedIndex = -1;
+  }
+}
+
+function hasNoMatchingOption (value, options) {
+  return options.every(function (o) { return !looseEqual(o, value); })
+}
+
+function getValue (option) {
+  return '_value' in option
+    ? option._value
+    : option.value
+}
+
+function onCompositionStart (e) {
+  e.target.composing = true;
+}
+
+function onCompositionEnd (e) {
+  // prevent triggering an input event for no reason
+  if (!e.target.composing) { return }
+  e.target.composing = false;
+  trigger(e.target, 'input');
+}
+
+function trigger (el, type) {
+  var e = document.createEvent('HTMLEvents');
+  e.initEvent(type, true, true);
+  el.dispatchEvent(e);
+}
+
+/*  */
+
+// recursively search for possible transition defined inside the component root
+function locateNode (vnode) {
+  return vnode.componentInstance && (!vnode.data || !vnode.data.transition)
+    ? locateNode(vnode.componentInstance._vnode)
+    : vnode
+}
+
+var show = {
+  bind: function bind (el, ref, vnode) {
+    var value = ref.value;
+
+    vnode = locateNode(vnode);
+    var transition$$1 = vnode.data && vnode.data.transition;
+    var originalDisplay = el.__vOriginalDisplay =
+      el.style.display === 'none' ? '' : el.style.display;
+    if (value && transition$$1) {
+      vnode.data.show = true;
+      enter(vnode, function () {
+        el.style.display = originalDisplay;
+      });
+    } else {
+      el.style.display = value ? originalDisplay : 'none';
+    }
+  },
+
+  update: function update (el, ref, vnode) {
+    var value = ref.value;
+    var oldValue = ref.oldValue;
+
+    /* istanbul ignore if */
+    if (!value === !oldValue) { return }
+    vnode = locateNode(vnode);
+    var transition$$1 = vnode.data && vnode.data.transition;
+    if (transition$$1) {
+      vnode.data.show = true;
+      if (value) {
+        enter(vnode, function () {
+          el.style.display = el.__vOriginalDisplay;
+        });
+      } else {
+        leave(vnode, function () {
+          el.style.display = 'none';
+        });
+      }
+    } else {
+      el.style.display = value ? el.__vOriginalDisplay : 'none';
+    }
+  },
+
+  unbind: function unbind (
+    el,
+    binding,
+    vnode,
+    oldVnode,
+    isDestroy
+  ) {
+    if (!isDestroy) {
+      el.style.display = el.__vOriginalDisplay;
+    }
+  }
+}
+
+var platformDirectives = {
+  model: directive,
+  show: show
+}
+
+/*  */
+
+// Provides transition support for a single element/component.
+// supports transition mode (out-in / in-out)
+
+var transitionProps = {
+  name: String,
+  appear: Boolean,
+  css: Boolean,
+  mode: String,
+  type: String,
+  enterClass: String,
+  leaveClass: String,
+  enterToClass: String,
+  leaveToClass: String,
+  enterActiveClass: String,
+  leaveActiveClass: String,
+  appearClass: String,
+  appearActiveClass: String,
+  appearToClass: String,
+  duration: [Number, String, Object]
+};
+
+// in case the child is also an abstract component, e.g. <keep-alive>
+// we want to recursively retrieve the real component to be rendered
+function getRealChild (vnode) {
+  var compOptions = vnode && vnode.componentOptions;
+  if (compOptions && compOptions.Ctor.options.abstract) {
+    return getRealChild(getFirstComponentChild(compOptions.children))
+  } else {
+    return vnode
+  }
+}
+
+function extractTransitionData (comp) {
+  var data = {};
+  var options = comp.$options;
+  // props
+  for (var key in options.propsData) {
+    data[key] = comp[key];
+  }
+  // events.
+  // extract listeners and pass them directly to the transition methods
+  var listeners = options._parentListeners;
+  for (var key$1 in listeners) {
+    data[camelize(key$1)] = listeners[key$1];
+  }
+  return data
+}
+
+function placeholder (h, rawChild) {
+  if (/\d-keep-alive$/.test(rawChild.tag)) {
+    return h('keep-alive', {
+      props: rawChild.componentOptions.propsData
+    })
+  }
+}
+
+function hasParentTransition (vnode) {
+  while ((vnode = vnode.parent)) {
+    if (vnode.data.transition) {
+      return true
+    }
+  }
+}
+
+function isSameChild (child, oldChild) {
+  return oldChild.key === child.key && oldChild.tag === child.tag
+}
+
+var Transition = {
+  name: 'transition',
+  props: transitionProps,
+  abstract: true,
+
+  render: function render (h) {
+    var this$1 = this;
+
+    var children = this.$slots.default;
+    if (!children) {
+      return
+    }
+
+    // filter out text nodes (possible whitespaces)
+    children = children.filter(function (c) { return c.tag || isAsyncPlaceholder(c); });
+    /* istanbul ignore if */
+    if (!children.length) {
+      return
+    }
+
+    // warn multiple elements
+    if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && children.length > 1) {
+      warn(
+        '<transition> can only be used on a single element. Use ' +
+        '<transition-group> for lists.',
+        this.$parent
+      );
+    }
+
+    var mode = this.mode;
+
+    // warn invalid mode
+    if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE &&
+      mode && mode !== 'in-out' && mode !== 'out-in'
+    ) {
+      warn(
+        'invalid <transition> mode: ' + mode,
+        this.$parent
+      );
+    }
+
+    var rawChild = children[0];
+
+    // if this is a component root node and the component's
+    // parent container node also has transition, skip.
+    if (hasParentTransition(this.$vnode)) {
+      return rawChild
+    }
+
+    // apply transition data to child
+    // use getRealChild() to ignore abstract components e.g. keep-alive
+    var child = getRealChild(rawChild);
+    /* istanbul ignore if */
+    if (!child) {
+      return rawChild
+    }
+
+    if (this._leaving) {
+      return placeholder(h, rawChild)
+    }
+
+    // ensure a key that is unique to the vnode type and to this transition
+    // component instance. This key will be used to remove pending leaving nodes
+    // during entering.
+    var id = "__transition-" + (this._uid) + "-";
+    child.key = child.key == null
+      ? child.isComment
+        ? id + 'comment'
+        : id + child.tag
+      : isPrimitive(child.key)
+        ? (String(child.key).indexOf(id) === 0 ? child.key : id + child.key)
+        : child.key;
+
+    var data = (child.data || (child.data = {})).transition = extractTransitionData(this);
+    var oldRawChild = this._vnode;
+    var oldChild = getRealChild(oldRawChild);
+
+    // mark v-show
+    // so that the transition module can hand over the control to the directive
+    if (child.data.directives && child.data.directives.some(function (d) { return d.name === 'show'; })) {
+      child.data.show = true;
+    }
+
+    if (
+      oldChild &&
+      oldChild.data &&
+      !isSameChild(child, oldChild) &&
+      !isAsyncPlaceholder(oldChild) &&
+      // #6687 component root is a comment node
+      !(oldChild.componentInstance && oldChild.componentInstance._vnode.isComment)
+    ) {
+      // replace old child transition data with fresh one
+      // important for dynamic transitions!
+      var oldData = oldChild.data.transition = extend({}, data);
+      // handle transition mode
+      if (mode === 'out-in') {
+        // return placeholder node and queue update when leave finishes
+        this._leaving = true;
+        mergeVNodeHook(oldData, 'afterLeave', function () {
+          this$1._leaving = false;
+          this$1.$forceUpdate();
+        });
+        return placeholder(h, rawChild)
+      } else if (mode === 'in-out') {
+        if (isAsyncPlaceholder(child)) {
+          return oldRawChild
+        }
+        var delayedLeave;
+        var performLeave = function () { delayedLeave(); };
+        mergeVNodeHook(data, 'afterEnter', performLeave);
+        mergeVNodeHook(data, 'enterCancelled', performLeave);
+        mergeVNodeHook(oldData, 'delayLeave', function (leave) { delayedLeave = leave; });
+      }
+    }
+
+    return rawChild
+  }
+}
+
+/*  */
+
+// Provides transition support for list items.
+// supports move transitions using the FLIP technique.
+
+// Because the vdom's children update algorithm is "unstable" - i.e.
+// it doesn't guarantee the relative positioning of removed elements,
+// we force transition-group to update its children into two passes:
+// in the first pass, we remove all nodes that need to be removed,
+// triggering their leaving transition; in the second pass, we insert/move
+// into the final desired state. This way in the second pass removed
+// nodes will remain where they should be.
+
+var props = extend({
+  tag: String,
+  moveClass: String
+}, transitionProps);
+
+delete props.mode;
+
+var TransitionGroup = {
+  props: props,
+
+  render: function render (h) {
+    var tag = this.tag || this.$vnode.data.tag || 'span';
+    var map = Object.create(null);
+    var prevChildren = this.prevChildren = this.children;
+    var rawChildren = this.$slots.default || [];
+    var children = this.children = [];
+    var transitionData = extractTransitionData(this);
+
+    for (var i = 0; i < rawChildren.length; i++) {
+      var c = rawChildren[i];
+      if (c.tag) {
+        if (c.key != null && String(c.key).indexOf('__vlist') !== 0) {
+          children.push(c);
+          map[c.key] = c
+          ;(c.data || (c.data = {})).transition = transitionData;
+        } else {
+          var opts = c.componentOptions;
+          var name = opts ? (opts.Ctor.options.name || opts.tag || '') : c.tag;
+          warn(("<transition-group> children must be keyed: <" + name + ">"));
+        }
+      }
+    }
+
+    if (prevChildren) {
+      var kept = [];
+      var removed = [];
+      for (var i$1 = 0; i$1 < prevChildren.length; i$1++) {
+        var c$1 = prevChildren[i$1];
+        c$1.data.transition = transitionData;
+        c$1.data.pos = c$1.elm.getBoundingClientRect();
+        if (map[c$1.key]) {
+          kept.push(c$1);
+        } else {
+          removed.push(c$1);
+        }
+      }
+      this.kept = h(tag, null, kept);
+      this.removed = removed;
+    }
+
+    return h(tag, null, children)
+  },
+
+  beforeUpdate: function beforeUpdate () {
+    // force removing pass
+    this.__patch__(
+      this._vnode,
+      this.kept,
+      false, // hydrating
+      true // removeOnly (!important, avoids unnecessary moves)
+    );
+    this._vnode = this.kept;
+  },
+
+  updated: function updated () {
+    var children = this.prevChildren;
+    var moveClass = this.moveClass || ((this.name || 'v') + '-move');
+    if (!children.length || !this.hasMove(children[0].elm, moveClass)) {
+      return
+    }
+
+    // we divide the work into three loops to avoid mixing DOM reads and writes
+    // in each iteration - which helps prevent layout thrashing.
+    children.forEach(callPendingCbs);
+    children.forEach(recordPosition);
+    children.forEach(applyTranslation);
+
+    // force reflow to put everything in position
+    // assign to this to avoid being removed in tree-shaking
+    // $flow-disable-line
+    this._reflow = document.body.offsetHeight;
+
+    children.forEach(function (c) {
+      if (c.data.moved) {
+        var el = c.elm;
+        var s = el.style;
+        addTransitionClass(el, moveClass);
+        s.transform = s.WebkitTransform = s.transitionDuration = '';
+        el.addEventListener(transitionEndEvent, el._moveCb = function cb (e) {
+          if (!e || /transform$/.test(e.propertyName)) {
+            el.removeEventListener(transitionEndEvent, cb);
+            el._moveCb = null;
+            removeTransitionClass(el, moveClass);
+          }
+        });
+      }
+    });
+  },
+
+  methods: {
+    hasMove: function hasMove (el, moveClass) {
+      /* istanbul ignore if */
+      if (!hasTransition) {
+        return false
+      }
+      /* istanbul ignore if */
+      if (this._hasMove) {
+        return this._hasMove
+      }
+      // Detect whether an element with the move class applied has
+      // CSS transitions. Since the element may be inside an entering
+      // transition at this very moment, we make a clone of it and remove
+      // all other transition classes applied to ensure only the move class
+      // is applied.
+      var clone = el.cloneNode();
+      if (el._transitionClasses) {
+        el._transitionClasses.forEach(function (cls) { removeClass(clone, cls); });
+      }
+      addClass(clone, moveClass);
+      clone.style.display = 'none';
+      this.$el.appendChild(clone);
+      var info = getTransitionInfo(clone);
+      this.$el.removeChild(clone);
+      return (this._hasMove = info.hasTransform)
+    }
+  }
+}
+
+function callPendingCbs (c) {
+  /* istanbul ignore if */
+  if (c.elm._moveCb) {
+    c.elm._moveCb();
+  }
+  /* istanbul ignore if */
+  if (c.elm._enterCb) {
+    c.elm._enterCb();
+  }
+}
+
+function recordPosition (c) {
+  c.data.newPos = c.elm.getBoundingClientRect();
+}
+
+function applyTranslation (c) {
+  var oldPos = c.data.pos;
+  var newPos = c.data.newPos;
+  var dx = oldPos.left - newPos.left;
+  var dy = oldPos.top - newPos.top;
+  if (dx || dy) {
+    c.data.moved = true;
+    var s = c.elm.style;
+    s.transform = s.WebkitTransform = "translate(" + dx + "px," + dy + "px)";
+    s.transitionDuration = '0s';
+  }
+}
+
+var platformComponents = {
+  Transition: Transition,
+  TransitionGroup: TransitionGroup
+}
+
+/*  */
+
+// install platform specific utils
+Vue.config.mustUseProp = mustUseProp;
+Vue.config.isReservedTag = isReservedTag;
+Vue.config.isReservedAttr = isReservedAttr;
+Vue.config.getTagNamespace = getTagNamespace;
+Vue.config.isUnknownElement = isUnknownElement;
+
+// install platform runtime directives & components
+extend(Vue.options.directives, platformDirectives);
+extend(Vue.options.components, platformComponents);
+
+// install platform patch function
+Vue.prototype.__patch__ = inBrowser ? patch : noop;
+
+// public mount method
+Vue.prototype.$mount = function (
+  el,
+  hydrating
+) {
+  el = el && inBrowser ? query(el) : undefined;
+  return mountComponent(this, el, hydrating)
+};
+
+// devtools global hook
+/* istanbul ignore next */
+if (inBrowser) {
+  setTimeout(function () {
+    if (config.devtools) {
+      if (devtools) {
+        devtools.emit('init', Vue);
+      } else if (
+        !IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE &&
+        isChrome
+      ) {
+        // Silently ignore missing devtools extension.
+      }
+    }
+    if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE &&
+      config.productionTip !== false &&
+      typeof console !== 'undefined'
+    ) {
+      console[console.info ? 'info' : 'log'](
+        "You are running Sails + Vue.js in development mode.\n" +
+        "(To enable production mode for Vue.js, lift Sails in production.)\n" +
+        " [?] More tips at https://sailsjs.com/docs/concepts/deployment"
+      );
+    }
+  }, 0);
+}
+
+/*  */
+
+var defaultTagRE = /\{\{((?:.|\n)+?)\}\}/g;
+var regexEscapeRE = /[-.*+?^${}()|[\]\/\\]/g;
+
+var buildRegex = cached(function (delimiters) {
+  var open = delimiters[0].replace(regexEscapeRE, '\\$&');
+  var close = delimiters[1].replace(regexEscapeRE, '\\$&');
+  return new RegExp(open + '((?:.|\\n)+?)' + close, 'g')
+});
+
+
+
+function parseText (
+  text,
+  delimiters
+) {
+  var tagRE = delimiters ? buildRegex(delimiters) : defaultTagRE;
+  if (!tagRE.test(text)) {
+    return
+  }
+  var tokens = [];
+  var rawTokens = [];
+  var lastIndex = tagRE.lastIndex = 0;
+  var match, index, tokenValue;
+  while ((match = tagRE.exec(text))) {
+    index = match.index;
+    // push text token
+    if (index > lastIndex) {
+      rawTokens.push(tokenValue = text.slice(lastIndex, index));
+      tokens.push(JSON.stringify(tokenValue));
+    }
+    // tag token
+    var exp = parseFilters(match[1].trim());
+    tokens.push(("_s(" + exp + ")"));
+    rawTokens.push({ '@binding': exp });
+    lastIndex = index + match[0].length;
+  }
+  if (lastIndex < text.length) {
+    rawTokens.push(tokenValue = text.slice(lastIndex));
+    tokens.push(JSON.stringify(tokenValue));
+  }
+  return {
+    expression: tokens.join('+'),
+    tokens: rawTokens
+  }
+}
+
+/*  */
+
+function transformNode (el, options) {
+  var warn = options.warn || baseWarn;
+  var staticClass = getAndRemoveAttr(el, 'class');
+  if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && staticClass) {
+    var res = parseText(staticClass, options.delimiters);
+    if (res) {
+      warn(
+        "class=\"" + staticClass + "\": " +
+        'Interpolation inside attributes has been removed. ' +
+        'Use v-bind or the colon shorthand instead. For example, ' +
+        'instead of <div class="{{ val }}">, use <div :class="val">.'
+      );
+    }
+  }
+  if (staticClass) {
+    el.staticClass = JSON.stringify(staticClass);
+  }
+  var classBinding = getBindingAttr(el, 'class', false /* getStatic */);
+  if (classBinding) {
+    el.classBinding = classBinding;
+  }
+}
+
+function genData (el) {
+  var data = '';
+  if (el.staticClass) {
+    data += "staticClass:" + (el.staticClass) + ",";
+  }
+  if (el.classBinding) {
+    data += "class:" + (el.classBinding) + ",";
+  }
+  return data
+}
+
+var klass$1 = {
+  staticKeys: ['staticClass'],
+  transformNode: transformNode,
+  genData: genData
+}
+
+/*  */
+
+function transformNode$1 (el, options) {
+  var warn = options.warn || baseWarn;
+  var staticStyle = getAndRemoveAttr(el, 'style');
+  if (staticStyle) {
+    /* istanbul ignore if */
+    {
+      var res = parseText(staticStyle, options.delimiters);
+      if (res) {
+        warn(
+          "style=\"" + staticStyle + "\": " +
+          'Interpolation inside attributes has been removed. ' +
+          'Use v-bind or the colon shorthand instead. For example, ' +
+          'instead of <div style="{{ val }}">, use <div :style="val">.'
+        );
+      }
+    }
+    el.staticStyle = JSON.stringify(parseStyleText(staticStyle));
+  }
+
+  var styleBinding = getBindingAttr(el, 'style', false /* getStatic */);
+  if (styleBinding) {
+    el.styleBinding = styleBinding;
+  }
+}
+
+function genData$1 (el) {
+  var data = '';
+  if (el.staticStyle) {
+    data += "staticStyle:" + (el.staticStyle) + ",";
+  }
+  if (el.styleBinding) {
+    data += "style:(" + (el.styleBinding) + "),";
+  }
+  return data
+}
+
+var style$1 = {
+  staticKeys: ['staticStyle'],
+  transformNode: transformNode$1,
+  genData: genData$1
+}
+
+/*  */
+
+var decoder;
+
+var he = {
+  decode: function decode (html) {
+    decoder = decoder || document.createElement('div');
+    decoder.innerHTML = html;
+    return decoder.textContent
+  }
+}
+
+/*  */
+
+var isUnaryTag = makeMap(
+  'area,base,br,col,embed,frame,hr,img,input,isindex,keygen,' +
+  'link,meta,param,source,track,wbr'
+);
+
+// Elements that you can, intentionally, leave open
+// (and which close themselves)
+var canBeLeftOpenTag = makeMap(
+  'colgroup,dd,dt,li,options,p,td,tfoot,th,thead,tr,source'
+);
+
+// HTML5 tags https://html.spec.whatwg.org/multipage/indices.html#elements-3
+// Phrasing Content https://html.spec.whatwg.org/multipage/dom.html#phrasing-content
+var isNonPhrasingTag = makeMap(
+  'address,article,aside,base,blockquote,body,caption,col,colgroup,dd,' +
+  'details,dialog,div,dl,dt,fieldset,figcaption,figure,footer,form,' +
+  'h1,h2,h3,h4,h5,h6,head,header,hgroup,hr,html,legend,li,menuitem,meta,' +
+  'optgroup,option,param,rp,rt,source,style,summary,tbody,td,tfoot,th,thead,' +
+  'title,tr,track'
+);
+
+/**
+ * Not type-checking this file because it's mostly vendor code.
+ */
+
+/*!
+ * HTML Parser By John Resig (ejohn.org)
+ * Modified by Juriy "kangax" Zaytsev
+ * Original code by Erik Arvidsson, Mozilla Public License
+ * http://erik.eae.net/simplehtmlparser/simplehtmlparser.js
+ */
+
+// Regular Expressions for parsing tags and attributes
+var attribute = /^\s*([^\s"'<>\/=]+)(?:\s*(=)\s*(?:"([^"]*)"+|'([^']*)'+|([^\s"'=<>`]+)))?/;
+// could use https://www.w3.org/TR/1999/REC-xml-names-19990114/#NT-QName
+// but for Vue templates we can enforce a simple charset
+var ncname = '[a-zA-Z_][\\w\\-\\.]*';
+var qnameCapture = "((?:" + ncname + "\\:)?" + ncname + ")";
+var startTagOpen = new RegExp(("^<" + qnameCapture));
+var startTagClose = /^\s*(\/?)>/;
+var endTag = new RegExp(("^<\\/" + qnameCapture + "[^>]*>"));
+var doctype = /^<!DOCTYPE [^>]+>/i;
+// #7298: escape - to avoid being pased as HTML comment when inlined in page
+var comment = /^<!\--/;
+var conditionalComment = /^<!\[/;
+
+var IS_REGEX_CAPTURING_BROKEN = false;
+'x'.replace(/x(.)?/g, function (m, g) {
+  IS_REGEX_CAPTURING_BROKEN = g === '';
+});
+
+// Special Elements (can contain anything)
+var isPlainTextElement = makeMap('script,style,textarea', true);
+var reCache = {};
+
+var decodingMap = {
+  '&lt;': '<',
+  '&gt;': '>',
+  '&quot;': '"',
+  '&amp;': '&',
+  '&#10;': '\n',
+  '&#9;': '\t'
+};
+var encodedAttr = /&(?:lt|gt|quot|amp);/g;
+var encodedAttrWithNewLines = /&(?:lt|gt|quot|amp|#10|#9);/g;
+
+// #5992
+var isIgnoreNewlineTag = makeMap('pre,textarea', true);
+var shouldIgnoreFirstNewline = function (tag, html) { return tag && isIgnoreNewlineTag(tag) && html[0] === '\n'; };
+
+function decodeAttr (value, shouldDecodeNewlines) {
+  var re = shouldDecodeNewlines ? encodedAttrWithNewLines : encodedAttr;
+  return value.replace(re, function (match) { return decodingMap[match]; })
+}
+
+function parseHTML (html, options) {
+  var stack = [];
+  var expectHTML = options.expectHTML;
+  var isUnaryTag$$1 = options.isUnaryTag || no;
+  var canBeLeftOpenTag$$1 = options.canBeLeftOpenTag || no;
+  var index = 0;
+  var last, lastTag;
+  while (html) {
+    last = html;
+    // Make sure we're not in a plaintext content element like script/style
+    if (!lastTag || !isPlainTextElement(lastTag)) {
+      var textEnd = html.indexOf('<');
+      if (textEnd === 0) {
+        // Comment:
+        if (comment.test(html)) {
+          var commentEnd = html.indexOf('-->');
+
+          if (commentEnd >= 0) {
+            if (options.shouldKeepComment) {
+              options.comment(html.substring(4, commentEnd));
+            }
+            advance(commentEnd + 3);
+            continue
+          }
+        }
+
+        // http://en.wikipedia.org/wiki/Conditional_comment#Downlevel-revealed_conditional_comment
+        if (conditionalComment.test(html)) {
+          var conditionalEnd = html.indexOf(']>');
+
+          if (conditionalEnd >= 0) {
+            advance(conditionalEnd + 2);
+            continue
+          }
+        }
+
+        // Doctype:
+        var doctypeMatch = html.match(doctype);
+        if (doctypeMatch) {
+          advance(doctypeMatch[0].length);
+          continue
+        }
+
+        // End tag:
+        var endTagMatch = html.match(endTag);
+        if (endTagMatch) {
+          var curIndex = index;
+          advance(endTagMatch[0].length);
+          parseEndTag(endTagMatch[1], curIndex, index);
+          continue
+        }
+
+        // Start tag:
+        var startTagMatch = parseStartTag();
+        if (startTagMatch) {
+          handleStartTag(startTagMatch);
+          if (shouldIgnoreFirstNewline(lastTag, html)) {
+            advance(1);
+          }
+          continue
+        }
+      }
+
+      var text = (void 0), rest = (void 0), next = (void 0);
+      if (textEnd >= 0) {
+        rest = html.slice(textEnd);
+        while (
+          !endTag.test(rest) &&
+          !startTagOpen.test(rest) &&
+          !comment.test(rest) &&
+          !conditionalComment.test(rest)
+        ) {
+          // < in plain text, be forgiving and treat it as text
+          next = rest.indexOf('<', 1);
+          if (next < 0) { break }
+          textEnd += next;
+          rest = html.slice(textEnd);
+        }
+        text = html.substring(0, textEnd);
+        advance(textEnd);
+      }
+
+      if (textEnd < 0) {
+        text = html;
+        html = '';
+      }
+
+      if (options.chars && text) {
+        options.chars(text);
+      }
+    } else {
+      var endTagLength = 0;
+      var stackedTag = lastTag.toLowerCase();
+      var reStackedTag = reCache[stackedTag] || (reCache[stackedTag] = new RegExp('([\\s\\S]*?)(</' + stackedTag + '[^>]*>)', 'i'));
+      var rest$1 = html.replace(reStackedTag, function (all, text, endTag) {
+        endTagLength = endTag.length;
+        if (!isPlainTextElement(stackedTag) && stackedTag !== 'noscript') {
+          text = text
+            .replace(/<!\--([\s\S]*?)-->/g, '$1') // #7298
+            .replace(/<!\[CDATA\[([\s\S]*?)]]>/g, '$1');
+        }
+        if (shouldIgnoreFirstNewline(stackedTag, text)) {
+          text = text.slice(1);
+        }
+        if (options.chars) {
+          options.chars(text);
+        }
+        return ''
+      });
+      index += html.length - rest$1.length;
+      html = rest$1;
+      parseEndTag(stackedTag, index - endTagLength, index);
+    }
+
+    if (html === last) {
+      options.chars && options.chars(html);
+      if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && !stack.length && options.warn) {
+        options.warn(("Mal-formatted tag at end of template: \"" + html + "\""));
+      }
+      break
+    }
+  }
+
+  // Clean up any remaining tags
+  parseEndTag();
+
+  function advance (n) {
+    index += n;
+    html = html.substring(n);
+  }
+
+  function parseStartTag () {
+    var start = html.match(startTagOpen);
+    if (start) {
+      var match = {
+        tagName: start[1],
+        attrs: [],
+        start: index
+      };
+      advance(start[0].length);
+      var end, attr;
+      while (!(end = html.match(startTagClose)) && (attr = html.match(attribute))) {
+        advance(attr[0].length);
+        match.attrs.push(attr);
+      }
+      if (end) {
+        match.unarySlash = end[1];
+        advance(end[0].length);
+        match.end = index;
+        return match
+      }
+    }
+  }
+
+  function handleStartTag (match) {
+    var tagName = match.tagName;
+    var unarySlash = match.unarySlash;
+
+    if (expectHTML) {
+      if (lastTag === 'p' && isNonPhrasingTag(tagName)) {
+        parseEndTag(lastTag);
+      }
+      if (canBeLeftOpenTag$$1(tagName) && lastTag === tagName) {
+        parseEndTag(tagName);
+      }
+    }
+
+    var unary = isUnaryTag$$1(tagName) || !!unarySlash;
+
+    var l = match.attrs.length;
+    var attrs = new Array(l);
+    for (var i = 0; i < l; i++) {
+      var args = match.attrs[i];
+      // hackish work around FF bug https://bugzilla.mozilla.org/show_bug.cgi?id=369778
+      if (IS_REGEX_CAPTURING_BROKEN && args[0].indexOf('""') === -1) {
+        if (args[3] === '') { delete args[3]; }
+        if (args[4] === '') { delete args[4]; }
+        if (args[5] === '') { delete args[5]; }
+      }
+      var value = args[3] || args[4] || args[5] || '';
+      var shouldDecodeNewlines = tagName === 'a' && args[1] === 'href'
+        ? options.shouldDecodeNewlinesForHref
+        : options.shouldDecodeNewlines;
+      attrs[i] = {
+        name: args[1],
+        value: decodeAttr(value, shouldDecodeNewlines)
+      };
+    }
+
+    if (!unary) {
+      stack.push({ tag: tagName, lowerCasedTag: tagName.toLowerCase(), attrs: attrs });
+      lastTag = tagName;
+    }
+
+    if (options.start) {
+      options.start(tagName, attrs, unary, match.start, match.end);
+    }
+  }
+
+  function parseEndTag (tagName, start, end) {
+    var pos, lowerCasedTagName;
+    if (start == null) { start = index; }
+    if (end == null) { end = index; }
+
+    if (tagName) {
+      lowerCasedTagName = tagName.toLowerCase();
+    }
+
+    // Find the closest opened tag of the same type
+    if (tagName) {
+      for (pos = stack.length - 1; pos >= 0; pos--) {
+        if (stack[pos].lowerCasedTag === lowerCasedTagName) {
+          break
+        }
+      }
+    } else {
+      // If no tag name is provided, clean shop
+      pos = 0;
+    }
+
+    if (pos >= 0) {
+      // Close all the open elements, up the stack
+      for (var i = stack.length - 1; i >= pos; i--) {
+        if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE &&
+          (i > pos || !tagName) &&
+          options.warn
+        ) {
+          options.warn(
+            ("tag <" + (stack[i].tag) + "> has no matching end tag.")
+          );
+        }
+        if (options.end) {
+          options.end(stack[i].tag, start, end);
+        }
+      }
+
+      // Remove the open elements from the stack
+      stack.length = pos;
+      lastTag = pos && stack[pos - 1].tag;
+    } else if (lowerCasedTagName === 'br') {
+      if (options.start) {
+        options.start(tagName, [], true, start, end);
+      }
+    } else if (lowerCasedTagName === 'p') {
+      if (options.start) {
+        options.start(tagName, [], false, start, end);
+      }
+      if (options.end) {
+        options.end(tagName, start, end);
+      }
+    }
+  }
+}
+
+/*  */
+
+var onRE = /^@|^v-on:/;
+var dirRE = /^v-|^@|^:/;
+var forAliasRE = /([^]*?)\s+(?:in|of)\s+([^]*)/;
+var forIteratorRE = /,([^,\}\]]*)(?:,([^,\}\]]*))?$/;
+var stripParensRE = /^\(|\)$/g;
+
+var argRE = /:(.*)$/;
+var bindRE = /^:|^v-bind:/;
+var modifierRE = /\.[^.]+/g;
+
+var decodeHTMLCached = cached(he.decode);
+
+// configurable state
+var warn$2;
+var delimiters;
+var transforms;
+var preTransforms;
+var postTransforms;
+var platformIsPreTag;
+var platformMustUseProp;
+var platformGetTagNamespace;
+
+
+
+function createASTElement (
+  tag,
+  attrs,
+  parent
+) {
+  return {
+    type: 1,
+    tag: tag,
+    attrsList: attrs,
+    attrsMap: makeAttrsMap(attrs),
+    parent: parent,
+    children: []
+  }
+}
+
+/**
+ * Convert HTML string to AST.
+ */
+function parse (
+  template,
+  options
+) {
+  warn$2 = options.warn || baseWarn;
+
+  platformIsPreTag = options.isPreTag || no;
+  platformMustUseProp = options.mustUseProp || no;
+  platformGetTagNamespace = options.getTagNamespace || no;
+
+  transforms = pluckModuleFunction(options.modules, 'transformNode');
+  preTransforms = pluckModuleFunction(options.modules, 'preTransformNode');
+  postTransforms = pluckModuleFunction(options.modules, 'postTransformNode');
+
+  delimiters = options.delimiters;
+
+  var stack = [];
+  var preserveWhitespace = options.preserveWhitespace !== false;
+  var root;
+  var currentParent;
+  var inVPre = false;
+  var inPre = false;
+  var warned = false;
+
+  function warnOnce (msg) {
+    if (!warned) {
+      warned = true;
+      warn$2(msg);
+    }
+  }
+
+  function closeElement (element) {
+    // check pre state
+    if (element.pre) {
+      inVPre = false;
+    }
+    if (platformIsPreTag(element.tag)) {
+      inPre = false;
+    }
+    // apply post-transforms
+    for (var i = 0; i < postTransforms.length; i++) {
+      postTransforms[i](element, options);
+    }
+  }
+
+  parseHTML(template, {
+    warn: warn$2,
+    expectHTML: options.expectHTML,
+    isUnaryTag: options.isUnaryTag,
+    canBeLeftOpenTag: options.canBeLeftOpenTag,
+    shouldDecodeNewlines: options.shouldDecodeNewlines,
+    shouldDecodeNewlinesForHref: options.shouldDecodeNewlinesForHref,
+    shouldKeepComment: options.comments,
+    start: function start (tag, attrs, unary) {
+      // check namespace.
+      // inherit parent ns if there is one
+      var ns = (currentParent && currentParent.ns) || platformGetTagNamespace(tag);
+
+      // handle IE svg bug
+      /* istanbul ignore if */
+      if (isIE && ns === 'svg') {
+        attrs = guardIESVGBug(attrs);
+      }
+
+      var element = createASTElement(tag, attrs, currentParent);
+      if (ns) {
+        element.ns = ns;
+      }
+
+      if (isForbiddenTag(element) && !isServerRendering()) {
+        element.forbidden = true;
+        !IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && warn$2(
+          'Templates should only be responsible for mapping the state to the ' +
+          'UI. Avoid placing tags with side-effects in your templates, such as ' +
+          "<" + tag + ">" + ', as they will not be parsed.'
+        );
+      }
+
+      // apply pre-transforms
+      for (var i = 0; i < preTransforms.length; i++) {
+        element = preTransforms[i](element, options) || element;
+      }
+
+      if (!inVPre) {
+        processPre(element);
+        if (element.pre) {
+          inVPre = true;
+        }
+      }
+      if (platformIsPreTag(element.tag)) {
+        inPre = true;
+      }
+      if (inVPre) {
+        processRawAttrs(element);
+      } else if (!element.processed) {
+        // structural directives
+        processFor(element);
+        processIf(element);
+        processOnce(element);
+        // element-scope stuff
+        processElement(element, options);
+      }
+
+      function checkRootConstraints (el) {
+        {
+          if (el.tag === 'slot' || el.tag === 'template') {
+            warnOnce(
+              "Cannot use <" + (el.tag) + "> as component root element because it may " +
+              'contain multiple nodes.'
+            );
+          }
+          if (el.attrsMap.hasOwnProperty('v-for')) {
+            warnOnce(
+              'Cannot use v-for on stateful component root element because ' +
+              'it renders multiple elements.'
+            );
+          }
+        }
+      }
+
+      // tree management
+      if (!root) {
+        root = element;
+        checkRootConstraints(root);
+      } else if (!stack.length) {
+        // allow root elements with v-if, v-else-if and v-else
+        if (root.if && (element.elseif || element.else)) {
+          checkRootConstraints(element);
+          addIfCondition(root, {
+            exp: element.elseif,
+            block: element
+          });
+        } else {
+          warnOnce(
+            "Component template should contain exactly one root element. " +
+            "If you are using v-if on multiple elements, " +
+            "use v-else-if to chain them instead."
+          );
+        }
+      }
+      if (currentParent && !element.forbidden) {
+        if (element.elseif || element.else) {
+          processIfConditions(element, currentParent);
+        } else if (element.slotScope) { // scoped slot
+          currentParent.plain = false;
+          var name = element.slotTarget || '"default"';(currentParent.scopedSlots || (currentParent.scopedSlots = {}))[name] = element;
+        } else {
+          currentParent.children.push(element);
+          element.parent = currentParent;
+        }
+      }
+      if (!unary) {
+        currentParent = element;
+        stack.push(element);
+      } else {
+        closeElement(element);
+      }
+    },
+
+    end: function end () {
+      // remove trailing whitespace
+      var element = stack[stack.length - 1];
+      var lastNode = element.children[element.children.length - 1];
+      if (lastNode && lastNode.type === 3 && lastNode.text === ' ' && !inPre) {
+        element.children.pop();
+      }
+      // pop stack
+      stack.length -= 1;
+      currentParent = stack[stack.length - 1];
+      closeElement(element);
+    },
+
+    chars: function chars (text) {
+      if (!currentParent) {
+        {
+          if (text === template) {
+            warnOnce(
+              'Component template requires a root element, rather than just text.'
+            );
+          } else if ((text = text.trim())) {
+            warnOnce(
+              ("text \"" + text + "\" outside root element will be ignored.")
+            );
+          }
+        }
+        return
+      }
+      // IE textarea placeholder bug
+      /* istanbul ignore if */
+      if (isIE &&
+        currentParent.tag === 'textarea' &&
+        currentParent.attrsMap.placeholder === text
+      ) {
+        return
+      }
+      var children = currentParent.children;
+      text = inPre || text.trim()
+        ? isTextTag(currentParent) ? text : decodeHTMLCached(text)
+        // only preserve whitespace if its not right after a starting tag
+        : preserveWhitespace && children.length ? ' ' : '';
+      if (text) {
+        var res;
+        if (!inVPre && text !== ' ' && (res = parseText(text, delimiters))) {
+          children.push({
+            type: 2,
+            expression: res.expression,
+            tokens: res.tokens,
+            text: text
+          });
+        } else if (text !== ' ' || !children.length || children[children.length - 1].text !== ' ') {
+          children.push({
+            type: 3,
+            text: text
+          });
+        }
+      }
+    },
+    comment: function comment (text) {
+      currentParent.children.push({
+        type: 3,
+        text: text,
+        isComment: true
+      });
+    }
+  });
+  return root
+}
+
+function processPre (el) {
+  if (getAndRemoveAttr(el, 'v-pre') != null) {
+    el.pre = true;
+  }
+}
+
+function processRawAttrs (el) {
+  var l = el.attrsList.length;
+  if (l) {
+    var attrs = el.attrs = new Array(l);
+    for (var i = 0; i < l; i++) {
+      attrs[i] = {
+        name: el.attrsList[i].name,
+        value: JSON.stringify(el.attrsList[i].value)
+      };
+    }
+  } else if (!el.pre) {
+    // non root node in pre blocks with no attributes
+    el.plain = true;
+  }
+}
+
+function processElement (element, options) {
+  processKey(element);
+
+  // determine whether this is a plain element after
+  // removing structural attributes
+  element.plain = !element.key && !element.attrsList.length;
+
+  processRef(element);
+  processSlot(element);
+  processComponent(element);
+  for (var i = 0; i < transforms.length; i++) {
+    element = transforms[i](element, options) || element;
+  }
+  processAttrs(element);
+}
+
+function processKey (el) {
+  var exp = getBindingAttr(el, 'key');
+  if (exp) {
+    if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && el.tag === 'template') {
+      warn$2("<template> cannot be keyed. Place the key on real elements instead.");
+    }
+    el.key = exp;
+  }
+}
+
+function processRef (el) {
+  var ref = getBindingAttr(el, 'ref');
+  if (ref) {
+    el.ref = ref;
+    el.refInFor = checkInFor(el);
+  }
+}
+
+function processFor (el) {
+  var exp;
+  if ((exp = getAndRemoveAttr(el, 'v-for'))) {
+    var res = parseFor(exp);
+    if (res) {
+      extend(el, res);
+    } else {
+      warn$2(
+        ("Invalid v-for expression: " + exp)
+      );
+    }
+  }
+}
+
+
+
+function parseFor (exp) {
+  var inMatch = exp.match(forAliasRE);
+  if (!inMatch) { return }
+  var res = {};
+  res.for = inMatch[2].trim();
+  var alias = inMatch[1].trim().replace(stripParensRE, '');
+  var iteratorMatch = alias.match(forIteratorRE);
+  if (iteratorMatch) {
+    res.alias = alias.replace(forIteratorRE, '');
+    res.iterator1 = iteratorMatch[1].trim();
+    if (iteratorMatch[2]) {
+      res.iterator2 = iteratorMatch[2].trim();
+    }
+  } else {
+    res.alias = alias;
+  }
+  return res
+}
+
+function processIf (el) {
+  var exp = getAndRemoveAttr(el, 'v-if');
+  if (exp) {
+    el.if = exp;
+    addIfCondition(el, {
+      exp: exp,
+      block: el
+    });
+  } else {
+    if (getAndRemoveAttr(el, 'v-else') != null) {
+      el.else = true;
+    }
+    var elseif = getAndRemoveAttr(el, 'v-else-if');
+    if (elseif) {
+      el.elseif = elseif;
+    }
+  }
+}
+
+function processIfConditions (el, parent) {
+  var prev = findPrevElement(parent.children);
+  if (prev && prev.if) {
+    addIfCondition(prev, {
+      exp: el.elseif,
+      block: el
+    });
+  } else {
+    warn$2(
+      "v-" + (el.elseif ? ('else-if="' + el.elseif + '"') : 'else') + " " +
+      "used on element <" + (el.tag) + "> without corresponding v-if."
+    );
+  }
+}
+
+function findPrevElement (children) {
+  var i = children.length;
+  while (i--) {
+    if (children[i].type === 1) {
+      return children[i]
+    } else {
+      if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && children[i].text !== ' ') {
+        warn$2(
+          "text \"" + (children[i].text.trim()) + "\" between v-if and v-else(-if) " +
+          "will be ignored."
+        );
+      }
+      children.pop();
+    }
+  }
+}
+
+function addIfCondition (el, condition) {
+  if (!el.ifConditions) {
+    el.ifConditions = [];
+  }
+  el.ifConditions.push(condition);
+}
+
+function processOnce (el) {
+  var once$$1 = getAndRemoveAttr(el, 'v-once');
+  if (once$$1 != null) {
+    el.once = true;
+  }
+}
+
+function processSlot (el) {
+  if (el.tag === 'slot') {
+    el.slotName = getBindingAttr(el, 'name');
+    if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && el.key) {
+      warn$2(
+        "`key` does not work on <slot> because slots are abstract outlets " +
+        "and can possibly expand into multiple elements. " +
+        "Use the key on a wrapping element instead."
+      );
+    }
+  } else {
+    var slotScope;
+    if (el.tag === 'template') {
+      slotScope = getAndRemoveAttr(el, 'scope');
+      /* istanbul ignore if */
+      if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && slotScope) {
+        warn$2(
+          "the \"scope\" attribute for scoped slots have been deprecated and " +
+          "replaced by \"slot-scope\" since 2.5. The new \"slot-scope\" attribute " +
+          "can also be used on plain elements in addition to <template> to " +
+          "denote scoped slots.",
+          true
+        );
+      }
+      el.slotScope = slotScope || getAndRemoveAttr(el, 'slot-scope');
+    } else if ((slotScope = getAndRemoveAttr(el, 'slot-scope'))) {
+      /* istanbul ignore if */
+      if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && el.attrsMap['v-for']) {
+        warn$2(
+          "Ambiguous combined usage of slot-scope and v-for on <" + (el.tag) + "> " +
+          "(v-for takes higher priority). Use a wrapper <template> for the " +
+          "scoped slot to make it clearer.",
+          true
+        );
+      }
+      el.slotScope = slotScope;
+    }
+    var slotTarget = getBindingAttr(el, 'slot');
+    if (slotTarget) {
+      el.slotTarget = slotTarget === '""' ? '"default"' : slotTarget;
+      // preserve slot as an attribute for native shadow DOM compat
+      // only for non-scoped slots.
+      if (el.tag !== 'template' && !el.slotScope) {
+        addAttr(el, 'slot', slotTarget);
+      }
+    }
+  }
+}
+
+function processComponent (el) {
+  var binding;
+  if ((binding = getBindingAttr(el, 'is'))) {
+    el.component = binding;
+  }
+  if (getAndRemoveAttr(el, 'inline-template') != null) {
+    el.inlineTemplate = true;
+  }
+}
+
+function processAttrs (el) {
+  var list = el.attrsList;
+  var i, l, name, rawName, value, modifiers, isProp;
+  for (i = 0, l = list.length; i < l; i++) {
+    name = rawName = list[i].name;
+    value = list[i].value;
+    if (dirRE.test(name)) {
+      // mark element as dynamic
+      el.hasBindings = true;
+      // modifiers
+      modifiers = parseModifiers(name);
+      if (modifiers) {
+        name = name.replace(modifierRE, '');
+      }
+      if (bindRE.test(name)) { // v-bind
+        name = name.replace(bindRE, '');
+        value = parseFilters(value);
+        isProp = false;
+        if (modifiers) {
+          if (modifiers.prop) {
+            isProp = true;
+            name = camelize(name);
+            if (name === 'innerHtml') { name = 'innerHTML'; }
+          }
+          if (modifiers.camel) {
+            name = camelize(name);
+          }
+          if (modifiers.sync) {
+            addHandler(
+              el,
+              ("update:" + (camelize(name))),
+              genAssignmentCode(value, "$event")
+            );
+          }
+        }
+        if (isProp || (
+          !el.component && platformMustUseProp(el.tag, el.attrsMap.type, name)
+        )) {
+          addProp(el, name, value);
+        } else {
+          addAttr(el, name, value);
+        }
+      } else if (onRE.test(name)) { // v-on
+        name = name.replace(onRE, '');
+        addHandler(el, name, value, modifiers, false, warn$2);
+      } else { // normal directives
+        name = name.replace(dirRE, '');
+        // parse arg
+        var argMatch = name.match(argRE);
+        var arg = argMatch && argMatch[1];
+        if (arg) {
+          name = name.slice(0, -(arg.length + 1));
+        }
+        addDirective(el, name, rawName, value, arg, modifiers);
+        if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && name === 'model') {
+          checkForAliasModel(el, value);
+        }
+      }
+    } else {
+      // literal attribute
+      {
+        var res = parseText(value, delimiters);
+        if (res) {
+          warn$2(
+            name + "=\"" + value + "\": " +
+            'Interpolation inside attributes has been removed. ' +
+            'Use v-bind or the colon shorthand instead. For example, ' +
+            'instead of <div id="{{ val }}">, use <div :id="val">.'
+          );
+        }
+      }
+      addAttr(el, name, JSON.stringify(value));
+      // #6887 firefox doesn't update muted state if set via attribute
+      // even immediately after element creation
+      if (!el.component &&
+          name === 'muted' &&
+          platformMustUseProp(el.tag, el.attrsMap.type, name)) {
+        addProp(el, name, 'true');
+      }
+    }
+  }
+}
+
+function checkInFor (el) {
+  var parent = el;
+  while (parent) {
+    if (parent.for !== undefined) {
+      return true
+    }
+    parent = parent.parent;
+  }
+  return false
+}
+
+function parseModifiers (name) {
+  var match = name.match(modifierRE);
+  if (match) {
+    var ret = {};
+    match.forEach(function (m) { ret[m.slice(1)] = true; });
+    return ret
+  }
+}
+
+function makeAttrsMap (attrs) {
+  var map = {};
+  for (var i = 0, l = attrs.length; i < l; i++) {
+    if (
+      !IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE &&
+      map[attrs[i].name] && !isIE && !isEdge
+    ) {
+      warn$2('duplicate attribute: ' + attrs[i].name);
+    }
+    map[attrs[i].name] = attrs[i].value;
+  }
+  return map
+}
+
+// for script (e.g. type="x/template") or style, do not decode content
+function isTextTag (el) {
+  return el.tag === 'script' || el.tag === 'style'
+}
+
+function isForbiddenTag (el) {
+  return (
+    el.tag === 'style' ||
+    (el.tag === 'script' && (
+      !el.attrsMap.type ||
+      el.attrsMap.type === 'text/javascript'
+    ))
+  )
+}
+
+var ieNSBug = /^xmlns:NS\d+/;
+var ieNSPrefix = /^NS\d+:/;
+
+/* istanbul ignore next */
+function guardIESVGBug (attrs) {
+  var res = [];
+  for (var i = 0; i < attrs.length; i++) {
+    var attr = attrs[i];
+    if (!ieNSBug.test(attr.name)) {
+      attr.name = attr.name.replace(ieNSPrefix, '');
+      res.push(attr);
+    }
+  }
+  return res
+}
+
+function checkForAliasModel (el, value) {
+  var _el = el;
+  while (_el) {
+    if (_el.for && _el.alias === value) {
+      warn$2(
+        "<" + (el.tag) + " v-model=\"" + value + "\">: " +
+        "You are binding v-model directly to a v-for iteration alias. " +
+        "This will not be able to modify the v-for source array because " +
+        "writing to the alias is like modifying a function local variable. " +
+        "Consider using an array of objects and use v-model on an object property instead."
+      );
+    }
+    _el = _el.parent;
+  }
+}
+
+/*  */
+
+/**
+ * Expand input[v-model] with dyanmic type bindings into v-if-else chains
+ * Turn this:
+ *   <input v-model="data[type]" :type="type">
+ * into this:
+ *   <input v-if="type === 'checkbox'" type="checkbox" v-model="data[type]">
+ *   <input v-else-if="type === 'radio'" type="radio" v-model="data[type]">
+ *   <input v-else :type="type" v-model="data[type]">
+ */
+
+function preTransformNode (el, options) {
+  if (el.tag === 'input') {
+    var map = el.attrsMap;
+    if (!map['v-model']) {
+      return
+    }
+
+    var typeBinding;
+    if (map[':type'] || map['v-bind:type']) {
+      typeBinding = getBindingAttr(el, 'type');
+    }
+    if (!map.type && !typeBinding && map['v-bind']) {
+      typeBinding = "(" + (map['v-bind']) + ").type";
+    }
+
+    if (typeBinding) {
+      var ifCondition = getAndRemoveAttr(el, 'v-if', true);
+      var ifConditionExtra = ifCondition ? ("&&(" + ifCondition + ")") : "";
+      var hasElse = getAndRemoveAttr(el, 'v-else', true) != null;
+      var elseIfCondition = getAndRemoveAttr(el, 'v-else-if', true);
+      // 1. checkbox
+      var branch0 = cloneASTElement(el);
+      // process for on the main node
+      processFor(branch0);
+      addRawAttr(branch0, 'type', 'checkbox');
+      processElement(branch0, options);
+      branch0.processed = true; // prevent it from double-processed
+      branch0.if = "(" + typeBinding + ")==='checkbox'" + ifConditionExtra;
+      addIfCondition(branch0, {
+        exp: branch0.if,
+        block: branch0
+      });
+      // 2. add radio else-if condition
+      var branch1 = cloneASTElement(el);
+      getAndRemoveAttr(branch1, 'v-for', true);
+      addRawAttr(branch1, 'type', 'radio');
+      processElement(branch1, options);
+      addIfCondition(branch0, {
+        exp: "(" + typeBinding + ")==='radio'" + ifConditionExtra,
+        block: branch1
+      });
+      // 3. other
+      var branch2 = cloneASTElement(el);
+      getAndRemoveAttr(branch2, 'v-for', true);
+      addRawAttr(branch2, ':type', typeBinding);
+      processElement(branch2, options);
+      addIfCondition(branch0, {
+        exp: ifCondition,
+        block: branch2
+      });
+
+      if (hasElse) {
+        branch0.else = true;
+      } else if (elseIfCondition) {
+        branch0.elseif = elseIfCondition;
+      }
+
+      return branch0
+    }
+  }
+}
+
+function cloneASTElement (el) {
+  return createASTElement(el.tag, el.attrsList.slice(), el.parent)
+}
+
+var model$2 = {
+  preTransformNode: preTransformNode
+}
+
+var modules$1 = [
+  klass$1,
+  style$1,
+  model$2
+]
+
+/*  */
+
+function text (el, dir) {
+  if (dir.value) {
+    addProp(el, 'textContent', ("_s(" + (dir.value) + ")"));
+  }
+}
+
+/*  */
+
+function html (el, dir) {
+  if (dir.value) {
+    addProp(el, 'innerHTML', ("_s(" + (dir.value) + ")"));
+  }
+}
+
+var directives$1 = {
+  model: model,
+  text: text,
+  html: html
+}
+
+/*  */
+
+var baseOptions = {
+  expectHTML: true,
+  modules: modules$1,
+  directives: directives$1,
+  isPreTag: isPreTag,
+  isUnaryTag: isUnaryTag,
+  mustUseProp: mustUseProp,
+  canBeLeftOpenTag: canBeLeftOpenTag,
+  isReservedTag: isReservedTag,
+  getTagNamespace: getTagNamespace,
+  staticKeys: genStaticKeys(modules$1)
+};
+
+/*  */
+
+var isStaticKey;
+var isPlatformReservedTag;
+
+var genStaticKeysCached = cached(genStaticKeys$1);
+
+/**
+ * Goal of the optimizer: walk the generated template AST tree
+ * and detect sub-trees that are purely static, i.e. parts of
+ * the DOM that never needs to change.
+ *
+ * Once we detect these sub-trees, we can:
+ *
+ * 1. Hoist them into constants, so that we no longer need to
+ *    create fresh nodes for them on each re-render;
+ * 2. Completely skip them in the patching process.
+ */
+function optimize (root, options) {
+  if (!root) { return }
+  isStaticKey = genStaticKeysCached(options.staticKeys || '');
+  isPlatformReservedTag = options.isReservedTag || no;
+  // first pass: mark all non-static nodes.
+  markStatic$1(root);
+  // second pass: mark static roots.
+  markStaticRoots(root, false);
+}
+
+function genStaticKeys$1 (keys) {
+  return makeMap(
+    'type,tag,attrsList,attrsMap,plain,parent,children,attrs' +
+    (keys ? ',' + keys : '')
+  )
+}
+
+function markStatic$1 (node) {
+  node.static = isStatic(node);
+  if (node.type === 1) {
+    // do not make component slot content static. this avoids
+    // 1. components not able to mutate slot nodes
+    // 2. static slot content fails for hot-reloading
+    if (
+      !isPlatformReservedTag(node.tag) &&
+      node.tag !== 'slot' &&
+      node.attrsMap['inline-template'] == null
+    ) {
+      return
+    }
+    for (var i = 0, l = node.children.length; i < l; i++) {
+      var child = node.children[i];
+      markStatic$1(child);
+      if (!child.static) {
+        node.static = false;
+      }
+    }
+    if (node.ifConditions) {
+      for (var i$1 = 1, l$1 = node.ifConditions.length; i$1 < l$1; i$1++) {
+        var block = node.ifConditions[i$1].block;
+        markStatic$1(block);
+        if (!block.static) {
+          node.static = false;
+        }
+      }
+    }
+  }
+}
+
+function markStaticRoots (node, isInFor) {
+  if (node.type === 1) {
+    if (node.static || node.once) {
+      node.staticInFor = isInFor;
+    }
+    // For a node to qualify as a static root, it should have children that
+    // are not just static text. Otherwise the cost of hoisting out will
+    // outweigh the benefits and it's better off to just always render it fresh.
+    if (node.static && node.children.length && !(
+      node.children.length === 1 &&
+      node.children[0].type === 3
+    )) {
+      node.staticRoot = true;
+      return
+    } else {
+      node.staticRoot = false;
+    }
+    if (node.children) {
+      for (var i = 0, l = node.children.length; i < l; i++) {
+        markStaticRoots(node.children[i], isInFor || !!node.for);
+      }
+    }
+    if (node.ifConditions) {
+      for (var i$1 = 1, l$1 = node.ifConditions.length; i$1 < l$1; i$1++) {
+        markStaticRoots(node.ifConditions[i$1].block, isInFor);
+      }
+    }
+  }
+}
+
+function isStatic (node) {
+  if (node.type === 2) { // expression
+    return false
+  }
+  if (node.type === 3) { // text
+    return true
+  }
+  return !!(node.pre || (
+    !node.hasBindings && // no dynamic bindings
+    !node.if && !node.for && // not v-if or v-for or v-else
+    !isBuiltInTag(node.tag) && // not a built-in
+    isPlatformReservedTag(node.tag) && // not a component
+    !isDirectChildOfTemplateFor(node) &&
+    Object.keys(node).every(isStaticKey)
+  ))
+}
+
+function isDirectChildOfTemplateFor (node) {
+  while (node.parent) {
+    node = node.parent;
+    if (node.tag !== 'template') {
+      return false
+    }
+    if (node.for) {
+      return true
+    }
+  }
+  return false
+}
+
+/*  */
+
+var fnExpRE = /^([\w$_]+|\([^)]*?\))\s*=>|^function\s*\(/;
+var simplePathRE = /^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*|\['[^']*?']|\["[^"]*?"]|\[\d+]|\[[A-Za-z_$][\w$]*])*$/;
+
+// KeyboardEvent.keyCode aliases
+var keyCodes = {
+  esc: 27,
+  tab: 9,
+  enter: 13,
+  space: 32,
+  up: 38,
+  left: 37,
+  right: 39,
+  down: 40,
+  'delete': [8, 46]
+};
+
+// KeyboardEvent.key aliases
+var keyNames = {
+  esc: 'Escape',
+  tab: 'Tab',
+  enter: 'Enter',
+  space: ' ',
+  // #7806: IE11 uses key names without `Arrow` prefix for arrow keys.
+  up: ['Up', 'ArrowUp'],
+  left: ['Left', 'ArrowLeft'],
+  right: ['Right', 'ArrowRight'],
+  down: ['Down', 'ArrowDown'],
+  'delete': ['Backspace', 'Delete']
+};
+
+// #4868: modifiers that prevent the execution of the listener
+// need to explicitly return null so that we can determine whether to remove
+// the listener for .once
+var genGuard = function (condition) { return ("if(" + condition + ")return null;"); };
+
+var modifierCode = {
+  stop: '$event.stopPropagation();',
+  prevent: '$event.preventDefault();',
+  self: genGuard("$event.target !== $event.currentTarget"),
+  ctrl: genGuard("!$event.ctrlKey"),
+  shift: genGuard("!$event.shiftKey"),
+  alt: genGuard("!$event.altKey"),
+  meta: genGuard("!$event.metaKey"),
+  left: genGuard("'button' in $event && $event.button !== 0"),
+  middle: genGuard("'button' in $event && $event.button !== 1"),
+  right: genGuard("'button' in $event && $event.button !== 2")
+};
+
+function genHandlers (
+  events,
+  isNative,
+  warn
+) {
+  var res = isNative ? 'nativeOn:{' : 'on:{';
+  for (var name in events) {
+    res += "\"" + name + "\":" + (genHandler(name, events[name])) + ",";
+  }
+  return res.slice(0, -1) + '}'
+}
+
+function genHandler (
+  name,
+  handler
+) {
+  if (!handler) {
+    return 'function(){}'
+  }
+
+  if (Array.isArray(handler)) {
+    return ("[" + (handler.map(function (handler) { return genHandler(name, handler); }).join(',')) + "]")
+  }
+
+  var isMethodPath = simplePathRE.test(handler.value);
+  var isFunctionExpression = fnExpRE.test(handler.value);
+
+  if (!handler.modifiers) {
+    if (isMethodPath || isFunctionExpression) {
+      return handler.value
+    }
+    /* istanbul ignore if */
+    return ("function($event){" + (handler.value) + "}") // inline statement
+  } else {
+    var code = '';
+    var genModifierCode = '';
+    var keys = [];
+    for (var key in handler.modifiers) {
+      if (modifierCode[key]) {
+        genModifierCode += modifierCode[key];
+        // left/right
+        if (keyCodes[key]) {
+          keys.push(key);
+        }
+      } else if (key === 'exact') {
+        var modifiers = (handler.modifiers);
+        genModifierCode += genGuard(
+          ['ctrl', 'shift', 'alt', 'meta']
+            .filter(function (keyModifier) { return !modifiers[keyModifier]; })
+            .map(function (keyModifier) { return ("$event." + keyModifier + "Key"); })
+            .join('||')
+        );
+      } else {
+        keys.push(key);
+      }
+    }
+    if (keys.length) {
+      code += genKeyFilter(keys);
+    }
+    // Make sure modifiers like prevent and stop get executed after key filtering
+    if (genModifierCode) {
+      code += genModifierCode;
+    }
+    var handlerCode = isMethodPath
+      ? ("return " + (handler.value) + "($event)")
+      : isFunctionExpression
+        ? ("return (" + (handler.value) + ")($event)")
+        : handler.value;
+    /* istanbul ignore if */
+    return ("function($event){" + code + handlerCode + "}")
+  }
+}
+
+function genKeyFilter (keys) {
+  return ("if(!('button' in $event)&&" + (keys.map(genFilterCode).join('&&')) + ")return null;")
+}
+
+function genFilterCode (key) {
+  var keyVal = parseInt(key, 10);
+  if (keyVal) {
+    return ("$event.keyCode!==" + keyVal)
+  }
+  var keyCode = keyCodes[key];
+  var keyName = keyNames[key];
+  return (
+    "_k($event.keyCode," +
+    (JSON.stringify(key)) + "," +
+    (JSON.stringify(keyCode)) + "," +
+    "$event.key," +
+    "" + (JSON.stringify(keyName)) +
+    ")"
+  )
+}
+
+/*  */
+
+function on (el, dir) {
+  if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && dir.modifiers) {
+    warn("v-on without argument does not support modifiers.");
+  }
+  el.wrapListeners = function (code) { return ("_g(" + code + "," + (dir.value) + ")"); };
+}
+
+/*  */
+
+function bind$1 (el, dir) {
+  el.wrapData = function (code) {
+    return ("_b(" + code + ",'" + (el.tag) + "'," + (dir.value) + "," + (dir.modifiers && dir.modifiers.prop ? 'true' : 'false') + (dir.modifiers && dir.modifiers.sync ? ',true' : '') + ")")
+  };
+}
+
+/*  */
+
+var baseDirectives = {
+  on: on,
+  bind: bind$1,
+  cloak: noop
+}
+
+/*  */
+
+var CodegenState = function CodegenState (options) {
+  this.options = options;
+  this.warn = options.warn || baseWarn;
+  this.transforms = pluckModuleFunction(options.modules, 'transformCode');
+  this.dataGenFns = pluckModuleFunction(options.modules, 'genData');
+  this.directives = extend(extend({}, baseDirectives), options.directives);
+  var isReservedTag = options.isReservedTag || no;
+  this.maybeComponent = function (el) { return !isReservedTag(el.tag); };
+  this.onceId = 0;
+  this.staticRenderFns = [];
+};
+
+
+
+function generate (
+  ast,
+  options
+) {
+  var state = new CodegenState(options);
+  var code = ast ? genElement(ast, state) : '_c("div")';
+  return {
+    render: ("with(this){return " + code + "}"),
+    staticRenderFns: state.staticRenderFns
+  }
+}
+
+function genElement (el, state) {
+  if (el.staticRoot && !el.staticProcessed) {
+    return genStatic(el, state)
+  } else if (el.once && !el.onceProcessed) {
+    return genOnce(el, state)
+  } else if (el.for && !el.forProcessed) {
+    return genFor(el, state)
+  } else if (el.if && !el.ifProcessed) {
+    return genIf(el, state)
+  } else if (el.tag === 'template' && !el.slotTarget) {
+    return genChildren(el, state) || 'void 0'
+  } else if (el.tag === 'slot') {
+    return genSlot(el, state)
+  } else {
+    // component or element
+    var code;
+    if (el.component) {
+      code = genComponent(el.component, el, state);
+    } else {
+      var data = el.plain ? undefined : genData$2(el, state);
+
+      var children = el.inlineTemplate ? null : genChildren(el, state, true);
+      code = "_c('" + (el.tag) + "'" + (data ? ("," + data) : '') + (children ? ("," + children) : '') + ")";
+    }
+    // module transforms
+    for (var i = 0; i < state.transforms.length; i++) {
+      code = state.transforms[i](el, code);
+    }
+    return code
+  }
+}
+
+// hoist static sub-trees out
+function genStatic (el, state) {
+  el.staticProcessed = true;
+  state.staticRenderFns.push(("with(this){return " + (genElement(el, state)) + "}"));
+  return ("_m(" + (state.staticRenderFns.length - 1) + (el.staticInFor ? ',true' : '') + ")")
+}
+
+// v-once
+function genOnce (el, state) {
+  el.onceProcessed = true;
+  if (el.if && !el.ifProcessed) {
+    return genIf(el, state)
+  } else if (el.staticInFor) {
+    var key = '';
+    var parent = el.parent;
+    while (parent) {
+      if (parent.for) {
+        key = parent.key;
+        break
+      }
+      parent = parent.parent;
+    }
+    if (!key) {
+      !IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && state.warn(
+        "v-once can only be used inside v-for that is keyed. "
+      );
+      return genElement(el, state)
+    }
+    return ("_o(" + (genElement(el, state)) + "," + (state.onceId++) + "," + key + ")")
+  } else {
+    return genStatic(el, state)
+  }
+}
+
+function genIf (
+  el,
+  state,
+  altGen,
+  altEmpty
+) {
+  el.ifProcessed = true; // avoid recursion
+  return genIfConditions(el.ifConditions.slice(), state, altGen, altEmpty)
+}
+
+function genIfConditions (
+  conditions,
+  state,
+  altGen,
+  altEmpty
+) {
+  if (!conditions.length) {
+    return altEmpty || '_e()'
+  }
+
+  var condition = conditions.shift();
+  if (condition.exp) {
+    return ("(" + (condition.exp) + ")?" + (genTernaryExp(condition.block)) + ":" + (genIfConditions(conditions, state, altGen, altEmpty)))
+  } else {
+    return ("" + (genTernaryExp(condition.block)))
+  }
+
+  // v-if with v-once should generate code like (a)?_m(0):_m(1)
+  function genTernaryExp (el) {
+    return altGen
+      ? altGen(el, state)
+      : el.once
+        ? genOnce(el, state)
+        : genElement(el, state)
+  }
+}
+
+function genFor (
+  el,
+  state,
+  altGen,
+  altHelper
+) {
+  var exp = el.for;
+  var alias = el.alias;
+  var iterator1 = el.iterator1 ? ("," + (el.iterator1)) : '';
+  var iterator2 = el.iterator2 ? ("," + (el.iterator2)) : '';
+
+  if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE &&
+    state.maybeComponent(el) &&
+    el.tag !== 'slot' &&
+    el.tag !== 'template' &&
+    !el.key
+  ) {
+    state.warn(
+      "<" + (el.tag) + " v-for=\"" + alias + " in " + exp + "\">: component lists rendered with " +
+      "v-for should have explicit keys. " +
+      "See https://vuejs.org/guide/list.html#key for more info.",
+      true /* tip */
+    );
+  }
+
+  el.forProcessed = true; // avoid recursion
+  return (altHelper || '_l') + "((" + exp + ")," +
+    "function(" + alias + iterator1 + iterator2 + "){" +
+      "return " + ((altGen || genElement)(el, state)) +
+    '})'
+}
+
+function genData$2 (el, state) {
+  var data = '{';
+
+  // directives first.
+  // directives may mutate the el's other properties before they are generated.
+  var dirs = genDirectives(el, state);
+  if (dirs) { data += dirs + ','; }
+
+  // key
+  if (el.key) {
+    data += "key:" + (el.key) + ",";
+  }
+  // ref
+  if (el.ref) {
+    data += "ref:" + (el.ref) + ",";
+  }
+  if (el.refInFor) {
+    data += "refInFor:true,";
+  }
+  // pre
+  if (el.pre) {
+    data += "pre:true,";
+  }
+  // record original tag name for components using "is" attribute
+  if (el.component) {
+    data += "tag:\"" + (el.tag) + "\",";
+  }
+  // module data generation functions
+  for (var i = 0; i < state.dataGenFns.length; i++) {
+    data += state.dataGenFns[i](el);
+  }
+  // attributes
+  if (el.attrs) {
+    data += "attrs:{" + (genProps(el.attrs)) + "},";
+  }
+  // DOM props
+  if (el.props) {
+    data += "domProps:{" + (genProps(el.props)) + "},";
+  }
+  // event handlers
+  if (el.events) {
+    data += (genHandlers(el.events, false, state.warn)) + ",";
+  }
+  if (el.nativeEvents) {
+    data += (genHandlers(el.nativeEvents, true, state.warn)) + ",";
+  }
+  // slot target
+  // only for non-scoped slots
+  if (el.slotTarget && !el.slotScope) {
+    data += "slot:" + (el.slotTarget) + ",";
+  }
+  // scoped slots
+  if (el.scopedSlots) {
+    data += (genScopedSlots(el.scopedSlots, state)) + ",";
+  }
+  // component v-model
+  if (el.model) {
+    data += "model:{value:" + (el.model.value) + ",callback:" + (el.model.callback) + ",expression:" + (el.model.expression) + "},";
+  }
+  // inline-template
+  if (el.inlineTemplate) {
+    var inlineTemplate = genInlineTemplate(el, state);
+    if (inlineTemplate) {
+      data += inlineTemplate + ",";
+    }
+  }
+  data = data.replace(/,$/, '') + '}';
+  // v-bind data wrap
+  if (el.wrapData) {
+    data = el.wrapData(data);
+  }
+  // v-on data wrap
+  if (el.wrapListeners) {
+    data = el.wrapListeners(data);
+  }
+  return data
+}
+
+function genDirectives (el, state) {
+  var dirs = el.directives;
+  if (!dirs) { return }
+  var res = 'directives:[';
+  var hasRuntime = false;
+  var i, l, dir, needRuntime;
+  for (i = 0, l = dirs.length; i < l; i++) {
+    dir = dirs[i];
+    needRuntime = true;
+    var gen = state.directives[dir.name];
+    if (gen) {
+      // compile-time directive that manipulates AST.
+      // returns true if it also needs a runtime counterpart.
+      needRuntime = !!gen(el, dir, state.warn);
+    }
+    if (needRuntime) {
+      hasRuntime = true;
+      res += "{name:\"" + (dir.name) + "\",rawName:\"" + (dir.rawName) + "\"" + (dir.value ? (",value:(" + (dir.value) + "),expression:" + (JSON.stringify(dir.value))) : '') + (dir.arg ? (",arg:\"" + (dir.arg) + "\"") : '') + (dir.modifiers ? (",modifiers:" + (JSON.stringify(dir.modifiers))) : '') + "},";
+    }
+  }
+  if (hasRuntime) {
+    return res.slice(0, -1) + ']'
+  }
+}
+
+function genInlineTemplate (el, state) {
+  var ast = el.children[0];
+  if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && (
+    el.children.length !== 1 || ast.type !== 1
+  )) {
+    state.warn('Inline-template components must have exactly one child element.');
+  }
+  if (ast.type === 1) {
+    var inlineRenderFns = generate(ast, state.options);
+    return ("inlineTemplate:{render:function(){" + (inlineRenderFns.render) + "},staticRenderFns:[" + (inlineRenderFns.staticRenderFns.map(function (code) { return ("function(){" + code + "}"); }).join(',')) + "]}")
+  }
+}
+
+function genScopedSlots (
+  slots,
+  state
+) {
+  return ("scopedSlots:_u([" + (Object.keys(slots).map(function (key) {
+      return genScopedSlot(key, slots[key], state)
+    }).join(',')) + "])")
+}
+
+function genScopedSlot (
+  key,
+  el,
+  state
+) {
+  if (el.for && !el.forProcessed) {
+    return genForScopedSlot(key, el, state)
+  }
+  var fn = "function(" + (String(el.slotScope)) + "){" +
+    "return " + (el.tag === 'template'
+      ? el.if
+        ? ((el.if) + "?" + (genChildren(el, state) || 'undefined') + ":undefined")
+        : genChildren(el, state) || 'undefined'
+      : genElement(el, state)) + "}";
+  return ("{key:" + key + ",fn:" + fn + "}")
+}
+
+function genForScopedSlot (
+  key,
+  el,
+  state
+) {
+  var exp = el.for;
+  var alias = el.alias;
+  var iterator1 = el.iterator1 ? ("," + (el.iterator1)) : '';
+  var iterator2 = el.iterator2 ? ("," + (el.iterator2)) : '';
+  el.forProcessed = true; // avoid recursion
+  return "_l((" + exp + ")," +
+    "function(" + alias + iterator1 + iterator2 + "){" +
+      "return " + (genScopedSlot(key, el, state)) +
+    '})'
+}
+
+function genChildren (
+  el,
+  state,
+  checkSkip,
+  altGenElement,
+  altGenNode
+) {
+  var children = el.children;
+  if (children.length) {
+    var el$1 = children[0];
+    // optimize single v-for
+    if (children.length === 1 &&
+      el$1.for &&
+      el$1.tag !== 'template' &&
+      el$1.tag !== 'slot'
+    ) {
+      return (altGenElement || genElement)(el$1, state)
+    }
+    var normalizationType = checkSkip
+      ? getNormalizationType(children, state.maybeComponent)
+      : 0;
+    var gen = altGenNode || genNode;
+    return ("[" + (children.map(function (c) { return gen(c, state); }).join(',')) + "]" + (normalizationType ? ("," + normalizationType) : ''))
+  }
+}
+
+// determine the normalization needed for the children array.
+// 0: no normalization needed
+// 1: simple normalization needed (possible 1-level deep nested array)
+// 2: full normalization needed
+function getNormalizationType (
+  children,
+  maybeComponent
+) {
+  var res = 0;
+  for (var i = 0; i < children.length; i++) {
+    var el = children[i];
+    if (el.type !== 1) {
+      continue
+    }
+    if (needsNormalization(el) ||
+        (el.ifConditions && el.ifConditions.some(function (c) { return needsNormalization(c.block); }))) {
+      res = 2;
+      break
+    }
+    if (maybeComponent(el) ||
+        (el.ifConditions && el.ifConditions.some(function (c) { return maybeComponent(c.block); }))) {
+      res = 1;
+    }
+  }
+  return res
+}
+
+function needsNormalization (el) {
+  return el.for !== undefined || el.tag === 'template' || el.tag === 'slot'
+}
+
+function genNode (node, state) {
+  if (node.type === 1) {
+    return genElement(node, state)
+  } if (node.type === 3 && node.isComment) {
+    return genComment(node)
+  } else {
+    return genText(node)
+  }
+}
+
+function genText (text) {
+  return ("_v(" + (text.type === 2
+    ? text.expression // no need for () because already wrapped in _s()
+    : transformSpecialNewlines(JSON.stringify(text.text))) + ")")
+}
+
+function genComment (comment) {
+  return ("_e(" + (JSON.stringify(comment.text)) + ")")
+}
+
+function genSlot (el, state) {
+  var slotName = el.slotName || '"default"';
+  var children = genChildren(el, state);
+  var res = "_t(" + slotName + (children ? ("," + children) : '');
+  var attrs = el.attrs && ("{" + (el.attrs.map(function (a) { return ((camelize(a.name)) + ":" + (a.value)); }).join(',')) + "}");
+  var bind$$1 = el.attrsMap['v-bind'];
+  if ((attrs || bind$$1) && !children) {
+    res += ",null";
+  }
+  if (attrs) {
+    res += "," + attrs;
+  }
+  if (bind$$1) {
+    res += (attrs ? '' : ',null') + "," + bind$$1;
+  }
+  return res + ')'
+}
+
+// componentName is el.component, take it as argument to shun flow's pessimistic refinement
+function genComponent (
+  componentName,
+  el,
+  state
+) {
+  var children = el.inlineTemplate ? null : genChildren(el, state, true);
+  return ("_c(" + componentName + "," + (genData$2(el, state)) + (children ? ("," + children) : '') + ")")
+}
+
+function genProps (props) {
+  var res = '';
+  for (var i = 0; i < props.length; i++) {
+    var prop = props[i];
+    /* istanbul ignore if */
+    {
+      res += "\"" + (prop.name) + "\":" + (transformSpecialNewlines(prop.value)) + ",";
+    }
+  }
+  return res.slice(0, -1)
+}
+
+// #3895, #4268
+function transformSpecialNewlines (text) {
+  return text
+    .replace(/\u2028/g, '\\u2028')
+    .replace(/\u2029/g, '\\u2029')
+}
+
+/*  */
+
+// these keywords should not appear inside expressions, but operators like
+// typeof, instanceof and in are allowed
+var prohibitedKeywordRE = new RegExp('\\b' + (
+  'do,if,for,let,new,try,var,case,else,with,await,break,catch,class,const,' +
+  'super,throw,while,yield,delete,export,import,return,switch,default,' +
+  'extends,finally,continue,debugger,function,arguments'
+).split(',').join('\\b|\\b') + '\\b');
+
+// these unary operators should not be used as property/method names
+var unaryOperatorsRE = new RegExp('\\b' + (
+  'delete,typeof,void'
+).split(',').join('\\s*\\([^\\)]*\\)|\\b') + '\\s*\\([^\\)]*\\)');
+
+// strip strings in expressions
+var stripStringRE = /'(?:[^'\\]|\\.)*'|"(?:[^"\\]|\\.)*"|`(?:[^`\\]|\\.)*\$\{|\}(?:[^`\\]|\\.)*`|`(?:[^`\\]|\\.)*`/g;
+
+// detect problematic expressions in a template
+function detectErrors (ast) {
+  var errors = [];
+  if (ast) {
+    checkNode(ast, errors);
+  }
+  return errors
+}
+
+function checkNode (node, errors) {
+  if (node.type === 1) {
+    for (var name in node.attrsMap) {
+      if (dirRE.test(name)) {
+        var value = node.attrsMap[name];
+        if (value) {
+          if (name === 'v-for') {
+            checkFor(node, ("v-for=\"" + value + "\""), errors);
+          } else if (onRE.test(name)) {
+            checkEvent(value, (name + "=\"" + value + "\""), errors);
+          } else {
+            checkExpression(value, (name + "=\"" + value + "\""), errors);
+          }
+        }
+      }
+    }
+    if (node.children) {
+      for (var i = 0; i < node.children.length; i++) {
+        checkNode(node.children[i], errors);
+      }
+    }
+  } else if (node.type === 2) {
+    checkExpression(node.expression, node.text, errors);
+  }
+}
+
+function checkEvent (exp, text, errors) {
+  var stipped = exp.replace(stripStringRE, '');
+  var keywordMatch = stipped.match(unaryOperatorsRE);
+  if (keywordMatch && stipped.charAt(keywordMatch.index - 1) !== '$') {
+    errors.push(
+      "avoid using JavaScript unary operator as property name: " +
+      "\"" + (keywordMatch[0]) + "\" in expression " + (text.trim())
+    );
+  }
+  checkExpression(exp, text, errors);
+}
+
+function checkFor (node, text, errors) {
+  checkExpression(node.for || '', text, errors);
+  checkIdentifier(node.alias, 'v-for alias', text, errors);
+  checkIdentifier(node.iterator1, 'v-for iterator', text, errors);
+  checkIdentifier(node.iterator2, 'v-for iterator', text, errors);
+}
+
+function checkIdentifier (
+  ident,
+  type,
+  text,
+  errors
+) {
+  if (typeof ident === 'string') {
+    try {
+      new Function(("var " + ident + "=_"));
+    } catch (e) {
+      errors.push(("invalid " + type + " \"" + ident + "\" in expression: " + (text.trim())));
+    }
+  }
+}
+
+function checkExpression (exp, text, errors) {
+  try {
+    new Function(("return " + exp));
+  } catch (e) {
+    var keywordMatch = exp.replace(stripStringRE, '').match(prohibitedKeywordRE);
+    if (keywordMatch) {
+      errors.push(
+        "avoid using JavaScript keyword as property name: " +
+        "\"" + (keywordMatch[0]) + "\"\n  Raw expression: " + (text.trim())
+      );
+    } else {
+      errors.push(
+        "invalid expression: " + (e.message) + " in\n\n" +
+        "    " + exp + "\n\n" +
+        "  Raw expression: " + (text.trim()) + "\n"
+      );
+    }
+  }
+}
+
+/*  */
+
+function createFunction (code, errors) {
+  try {
+    return new Function(code)
+  } catch (err) {
+    errors.push({ err: err, code: code });
+    return noop
+  }
+}
+
+function createCompileToFunctionFn (compile) {
+  var cache = Object.create(null);
+
+  return function compileToFunctions (
+    template,
+    options,
+    vm
+  ) {
+    options = extend({}, options);
+    var warn$$1 = options.warn || warn;
+    delete options.warn;
+
+    /* istanbul ignore if */
+    {
+      // detect possible CSP restriction
+      try {
+        new Function('return 1');
+      } catch (e) {
+        if (e.toString().match(/unsafe-eval|CSP/)) {
+          warn$$1(
+            'It seems you are using the standalone build of Vue.js in an ' +
+            'environment with Content Security Policy that prohibits unsafe-eval. ' +
+            'The template compiler cannot work in this environment. Consider ' +
+            'relaxing the policy to allow unsafe-eval or pre-compiling your ' +
+            'templates into render functions.'
+          );
+        }
+      }
+    }
+
+    // check cache
+    var key = options.delimiters
+      ? String(options.delimiters) + template
+      : template;
+    if (cache[key]) {
+      return cache[key]
+    }
+
+    // compile
+    var compiled = compile(template, options);
+
+    // check compilation errors/tips
+    {
+      if (compiled.errors && compiled.errors.length) {
+        warn$$1(
+          "Error compiling template:\n\n" + template + "\n\n" +
+          compiled.errors.map(function (e) { return ("- " + e); }).join('\n') + '\n',
+          vm
+        );
+      }
+      if (compiled.tips && compiled.tips.length) {
+        compiled.tips.forEach(function (msg) { return tip(msg, vm); });
+      }
+    }
+
+    // turn code into functions
+    var res = {};
+    var fnGenErrors = [];
+    res.render = createFunction(compiled.render, fnGenErrors);
+    res.staticRenderFns = compiled.staticRenderFns.map(function (code) {
+      return createFunction(code, fnGenErrors)
+    });
+
+    // check function generation errors.
+    // this should only happen if there is a bug in the compiler itself.
+    // mostly for codegen development use
+    /* istanbul ignore if */
+    {
+      if ((!compiled.errors || !compiled.errors.length) && fnGenErrors.length) {
+        warn$$1(
+          "Failed to generate render function:\n\n" +
+          fnGenErrors.map(function (ref) {
+            var err = ref.err;
+            var code = ref.code;
+
+            return ((err.toString()) + " in\n\n" + code + "\n");
+        }).join('\n'),
+          vm
+        );
+      }
+    }
+
+    return (cache[key] = res)
+  }
+}
+
+/*  */
+
+function createCompilerCreator (baseCompile) {
+  return function createCompiler (baseOptions) {
+    function compile (
+      template,
+      options
+    ) {
+      var finalOptions = Object.create(baseOptions);
+      var errors = [];
+      var tips = [];
+      finalOptions.warn = function (msg, tip) {
+        (tip ? tips : errors).push(msg);
+      };
+
+      if (options) {
+        // merge custom modules
+        if (options.modules) {
+          finalOptions.modules =
+            (baseOptions.modules || []).concat(options.modules);
+        }
+        // merge custom directives
+        if (options.directives) {
+          finalOptions.directives = extend(
+            Object.create(baseOptions.directives || null),
+            options.directives
+          );
+        }
+        // copy other options
+        for (var key in options) {
+          if (key !== 'modules' && key !== 'directives') {
+            finalOptions[key] = options[key];
+          }
+        }
+      }
+
+      var compiled = baseCompile(template, finalOptions);
+      {
+        errors.push.apply(errors, detectErrors(compiled.ast));
+      }
+      compiled.errors = errors;
+      compiled.tips = tips;
+      return compiled
+    }
+
+    return {
+      compile: compile,
+      compileToFunctions: createCompileToFunctionFn(compile)
+    }
+  }
+}
+
+/*  */
+
+// `createCompilerCreator` allows creating compilers that use alternative
+// parser/optimizer/codegen, e.g the SSR optimizing compiler.
+// Here we just export a default compiler using the default parts.
+var createCompiler = createCompilerCreator(function baseCompile (
+  template,
+  options
+) {
+  var ast = parse(template.trim(), options);
+  if (options.optimize !== false) {
+    optimize(ast, options);
+  }
+  var code = generate(ast, options);
+  return {
+    ast: ast,
+    render: code.render,
+    staticRenderFns: code.staticRenderFns
+  }
+});
+
+/*  */
+
+var ref$1 = createCompiler(baseOptions);
+var compileToFunctions = ref$1.compileToFunctions;
+
+/*  */
+
+// check whether current browser encodes a char inside attribute values
+var div;
+function getShouldDecode (href) {
+  div = div || document.createElement('div');
+  div.innerHTML = href ? "<a href=\"\n\"/>" : "<div a=\"\n\"/>";
+  return div.innerHTML.indexOf('&#10;') > 0
+}
+
+// #3663: IE encodes newlines inside attribute values while other browsers don't
+var shouldDecodeNewlines = inBrowser ? getShouldDecode(false) : false;
+// #6828: chrome encodes content in a[href]
+var shouldDecodeNewlinesForHref = inBrowser ? getShouldDecode(true) : false;
+
+/*  */
+
+var idToTemplate = cached(function (id) {
+  var el = query(id);
+  return el && el.innerHTML
+});
+
+var mount = Vue.prototype.$mount;
+Vue.prototype.$mount = function (
+  el,
+  hydrating
+) {
+  el = el && query(el);
+
+  /* istanbul ignore if */
+  if (el === document.body || el === document.documentElement) {
+    !IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && warn(
+      "Do not mount Vue to <html> or <body> - mount to normal elements instead."
+    );
+    return this
+  }
+
+  var options = this.$options;
+  // resolve template/el and convert to render function
+  if (!options.render) {
+    var template = options.template;
+    if (template) {
+      if (typeof template === 'string') {
+        if (template.charAt(0) === '#') {
+          template = idToTemplate(template);
+          /* istanbul ignore if */
+          if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && !template) {
+            warn(
+              ("Template element not found or is empty: " + (options.template)),
+              this
+            );
+          }
+        }
+      } else if (template.nodeType) {
+        template = template.innerHTML;
+      } else {
+        {
+          warn('invalid template option:' + template, this);
+        }
+        return this
+      }
+    } else if (el) {
+      template = getOuterHTML(el);
+    }
+    if (template) {
+      /* istanbul ignore if */
+      if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && config.performance && mark) {
+        mark('compile');
+      }
+
+      var ref = compileToFunctions(template, {
+        shouldDecodeNewlines: shouldDecodeNewlines,
+        shouldDecodeNewlinesForHref: shouldDecodeNewlinesForHref,
+        delimiters: options.delimiters,
+        comments: options.comments
+      }, this);
+      var render = ref.render;
+      var staticRenderFns = ref.staticRenderFns;
+      options.render = render;
+      options.staticRenderFns = staticRenderFns;
+
+      /* istanbul ignore if */
+      if (!IS_VUE_RUNNING_IN_PRODUCTION_OR_STAGING_OR_ON_ERR_PAGE && config.performance && mark) {
+        mark('compile end');
+        measure(("vue " + (this._name) + " compile"), 'compile', 'compile end');
+      }
+    }
+  }
+  return mount.call(this, el, hydrating)
+};
+
+/**
+ * Get outerHTML of elements, taking care
+ * of SVG elements in IE as well.
+ */
+function getOuterHTML (el) {
+  if (el.outerHTML) {
+    return el.outerHTML
+  } else {
+    var container = document.createElement('div');
+    container.appendChild(el.cloneNode(true));
+    return container.innerHTML
+  }
+}
+
+Vue.compile = compileToFunctions;
+
+return Vue;
+
+})));
diff --git a/ee/bulk-operations-dashboard/assets/favicon.ico b/ee/bulk-operations-dashboard/assets/favicon.ico
new file mode 100644
index 0000000000..05c85b1f94
Binary files /dev/null and b/ee/bulk-operations-dashboard/assets/favicon.ico differ
diff --git a/ee/bulk-operations-dashboard/assets/fonts/fontawesome-webfont.eot b/ee/bulk-operations-dashboard/assets/fonts/fontawesome-webfont.eot
new file mode 100644
index 0000000000..e9f60ca953
Binary files /dev/null and b/ee/bulk-operations-dashboard/assets/fonts/fontawesome-webfont.eot differ
diff --git a/ee/bulk-operations-dashboard/assets/fonts/fontawesome-webfont.svg b/ee/bulk-operations-dashboard/assets/fonts/fontawesome-webfont.svg
new file mode 100644
index 0000000000..855c845e53
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/fonts/fontawesome-webfont.svg
@@ -0,0 +1,2671 @@
+<?xml version="1.0" standalone="no"?>
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd" >
+<svg>
+<metadata>
+Created by FontForge 20120731 at Mon Oct 24 17:37:40 2016
+ By ,,,
+Copyright Dave Gandy 2016. All rights reserved.
+</metadata>
+<defs>
+<font id="FontAwesome" horiz-adv-x="1536" >
+  <font-face 
+    font-family="FontAwesome"
+    font-weight="400"
+    font-stretch="normal"
+    units-per-em="1792"
+    panose-1="0 0 0 0 0 0 0 0 0 0"
+    ascent="1536"
+    descent="-256"
+    bbox="-1.02083 -256.962 2304.6 1537.02"
+    underline-thickness="0"
+    underline-position="0"
+    unicode-range="U+0020-F500"
+  />
+<missing-glyph horiz-adv-x="896" 
+d="M224 112h448v1312h-448v-1312zM112 0v1536h672v-1536h-672z" />
+    <glyph glyph-name=".notdef" horiz-adv-x="896" 
+d="M224 112h448v1312h-448v-1312zM112 0v1536h672v-1536h-672z" />
+    <glyph glyph-name=".null" horiz-adv-x="0" 
+ />
+    <glyph glyph-name="nonmarkingreturn" horiz-adv-x="597" 
+ />
+    <glyph glyph-name="space" unicode=" " horiz-adv-x="448" 
+ />
+    <glyph glyph-name="dieresis" unicode="&#xa8;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="copyright" unicode="&#xa9;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="registered" unicode="&#xae;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="acute" unicode="&#xb4;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="AE" unicode="&#xc6;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="Oslash" unicode="&#xd8;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="trademark" unicode="&#x2122;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="infinity" unicode="&#x221e;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="notequal" unicode="&#x2260;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="glass" unicode="&#xf000;" horiz-adv-x="1792" 
+d="M1699 1350q0 -35 -43 -78l-632 -632v-768h320q26 0 45 -19t19 -45t-19 -45t-45 -19h-896q-26 0 -45 19t-19 45t19 45t45 19h320v768l-632 632q-43 43 -43 78q0 23 18 36.5t38 17.5t43 4h1408q23 0 43 -4t38 -17.5t18 -36.5z" />
+    <glyph glyph-name="music" unicode="&#xf001;" 
+d="M1536 1312v-1120q0 -50 -34 -89t-86 -60.5t-103.5 -32t-96.5 -10.5t-96.5 10.5t-103.5 32t-86 60.5t-34 89t34 89t86 60.5t103.5 32t96.5 10.5q105 0 192 -39v537l-768 -237v-709q0 -50 -34 -89t-86 -60.5t-103.5 -32t-96.5 -10.5t-96.5 10.5t-103.5 32t-86 60.5t-34 89
+t34 89t86 60.5t103.5 32t96.5 10.5q105 0 192 -39v967q0 31 19 56.5t49 35.5l832 256q12 4 28 4q40 0 68 -28t28 -68z" />
+    <glyph glyph-name="search" unicode="&#xf002;" horiz-adv-x="1664" 
+d="M1152 704q0 185 -131.5 316.5t-316.5 131.5t-316.5 -131.5t-131.5 -316.5t131.5 -316.5t316.5 -131.5t316.5 131.5t131.5 316.5zM1664 -128q0 -52 -38 -90t-90 -38q-54 0 -90 38l-343 342q-179 -124 -399 -124q-143 0 -273.5 55.5t-225 150t-150 225t-55.5 273.5
+t55.5 273.5t150 225t225 150t273.5 55.5t273.5 -55.5t225 -150t150 -225t55.5 -273.5q0 -220 -124 -399l343 -343q37 -37 37 -90z" />
+    <glyph glyph-name="envelope" unicode="&#xf003;" horiz-adv-x="1792" 
+d="M1664 32v768q-32 -36 -69 -66q-268 -206 -426 -338q-51 -43 -83 -67t-86.5 -48.5t-102.5 -24.5h-1h-1q-48 0 -102.5 24.5t-86.5 48.5t-83 67q-158 132 -426 338q-37 30 -69 66v-768q0 -13 9.5 -22.5t22.5 -9.5h1472q13 0 22.5 9.5t9.5 22.5zM1664 1083v11v13.5t-0.5 13
+t-3 12.5t-5.5 9t-9 7.5t-14 2.5h-1472q-13 0 -22.5 -9.5t-9.5 -22.5q0 -168 147 -284q193 -152 401 -317q6 -5 35 -29.5t46 -37.5t44.5 -31.5t50.5 -27.5t43 -9h1h1q20 0 43 9t50.5 27.5t44.5 31.5t46 37.5t35 29.5q208 165 401 317q54 43 100.5 115.5t46.5 131.5z
+M1792 1120v-1088q0 -66 -47 -113t-113 -47h-1472q-66 0 -113 47t-47 113v1088q0 66 47 113t113 47h1472q66 0 113 -47t47 -113z" />
+    <glyph glyph-name="heart" unicode="&#xf004;" horiz-adv-x="1792" 
+d="M896 -128q-26 0 -44 18l-624 602q-10 8 -27.5 26t-55.5 65.5t-68 97.5t-53.5 121t-23.5 138q0 220 127 344t351 124q62 0 126.5 -21.5t120 -58t95.5 -68.5t76 -68q36 36 76 68t95.5 68.5t120 58t126.5 21.5q224 0 351 -124t127 -344q0 -221 -229 -450l-623 -600
+q-18 -18 -44 -18z" />
+    <glyph glyph-name="star" unicode="&#xf005;" horiz-adv-x="1664" 
+d="M1664 889q0 -22 -26 -48l-363 -354l86 -500q1 -7 1 -20q0 -21 -10.5 -35.5t-30.5 -14.5q-19 0 -40 12l-449 236l-449 -236q-22 -12 -40 -12q-21 0 -31.5 14.5t-10.5 35.5q0 6 2 20l86 500l-364 354q-25 27 -25 48q0 37 56 46l502 73l225 455q19 41 49 41t49 -41l225 -455
+l502 -73q56 -9 56 -46z" />
+    <glyph glyph-name="star_empty" unicode="&#xf006;" horiz-adv-x="1664" 
+d="M1137 532l306 297l-422 62l-189 382l-189 -382l-422 -62l306 -297l-73 -421l378 199l377 -199zM1664 889q0 -22 -26 -48l-363 -354l86 -500q1 -7 1 -20q0 -50 -41 -50q-19 0 -40 12l-449 236l-449 -236q-22 -12 -40 -12q-21 0 -31.5 14.5t-10.5 35.5q0 6 2 20l86 500
+l-364 354q-25 27 -25 48q0 37 56 46l502 73l225 455q19 41 49 41t49 -41l225 -455l502 -73q56 -9 56 -46z" />
+    <glyph glyph-name="user" unicode="&#xf007;" horiz-adv-x="1280" 
+d="M1280 137q0 -109 -62.5 -187t-150.5 -78h-854q-88 0 -150.5 78t-62.5 187q0 85 8.5 160.5t31.5 152t58.5 131t94 89t134.5 34.5q131 -128 313 -128t313 128q76 0 134.5 -34.5t94 -89t58.5 -131t31.5 -152t8.5 -160.5zM1024 1024q0 -159 -112.5 -271.5t-271.5 -112.5
+t-271.5 112.5t-112.5 271.5t112.5 271.5t271.5 112.5t271.5 -112.5t112.5 -271.5z" />
+    <glyph glyph-name="film" unicode="&#xf008;" horiz-adv-x="1920" 
+d="M384 -64v128q0 26 -19 45t-45 19h-128q-26 0 -45 -19t-19 -45v-128q0 -26 19 -45t45 -19h128q26 0 45 19t19 45zM384 320v128q0 26 -19 45t-45 19h-128q-26 0 -45 -19t-19 -45v-128q0 -26 19 -45t45 -19h128q26 0 45 19t19 45zM384 704v128q0 26 -19 45t-45 19h-128
+q-26 0 -45 -19t-19 -45v-128q0 -26 19 -45t45 -19h128q26 0 45 19t19 45zM1408 -64v512q0 26 -19 45t-45 19h-768q-26 0 -45 -19t-19 -45v-512q0 -26 19 -45t45 -19h768q26 0 45 19t19 45zM384 1088v128q0 26 -19 45t-45 19h-128q-26 0 -45 -19t-19 -45v-128q0 -26 19 -45
+t45 -19h128q26 0 45 19t19 45zM1792 -64v128q0 26 -19 45t-45 19h-128q-26 0 -45 -19t-19 -45v-128q0 -26 19 -45t45 -19h128q26 0 45 19t19 45zM1408 704v512q0 26 -19 45t-45 19h-768q-26 0 -45 -19t-19 -45v-512q0 -26 19 -45t45 -19h768q26 0 45 19t19 45zM1792 320v128
+q0 26 -19 45t-45 19h-128q-26 0 -45 -19t-19 -45v-128q0 -26 19 -45t45 -19h128q26 0 45 19t19 45zM1792 704v128q0 26 -19 45t-45 19h-128q-26 0 -45 -19t-19 -45v-128q0 -26 19 -45t45 -19h128q26 0 45 19t19 45zM1792 1088v128q0 26 -19 45t-45 19h-128q-26 0 -45 -19
+t-19 -45v-128q0 -26 19 -45t45 -19h128q26 0 45 19t19 45zM1920 1248v-1344q0 -66 -47 -113t-113 -47h-1600q-66 0 -113 47t-47 113v1344q0 66 47 113t113 47h1600q66 0 113 -47t47 -113z" />
+    <glyph glyph-name="th_large" unicode="&#xf009;" horiz-adv-x="1664" 
+d="M768 512v-384q0 -52 -38 -90t-90 -38h-512q-52 0 -90 38t-38 90v384q0 52 38 90t90 38h512q52 0 90 -38t38 -90zM768 1280v-384q0 -52 -38 -90t-90 -38h-512q-52 0 -90 38t-38 90v384q0 52 38 90t90 38h512q52 0 90 -38t38 -90zM1664 512v-384q0 -52 -38 -90t-90 -38
+h-512q-52 0 -90 38t-38 90v384q0 52 38 90t90 38h512q52 0 90 -38t38 -90zM1664 1280v-384q0 -52 -38 -90t-90 -38h-512q-52 0 -90 38t-38 90v384q0 52 38 90t90 38h512q52 0 90 -38t38 -90z" />
+    <glyph glyph-name="th" unicode="&#xf00a;" horiz-adv-x="1792" 
+d="M512 288v-192q0 -40 -28 -68t-68 -28h-320q-40 0 -68 28t-28 68v192q0 40 28 68t68 28h320q40 0 68 -28t28 -68zM512 800v-192q0 -40 -28 -68t-68 -28h-320q-40 0 -68 28t-28 68v192q0 40 28 68t68 28h320q40 0 68 -28t28 -68zM1152 288v-192q0 -40 -28 -68t-68 -28h-320
+q-40 0 -68 28t-28 68v192q0 40 28 68t68 28h320q40 0 68 -28t28 -68zM512 1312v-192q0 -40 -28 -68t-68 -28h-320q-40 0 -68 28t-28 68v192q0 40 28 68t68 28h320q40 0 68 -28t28 -68zM1152 800v-192q0 -40 -28 -68t-68 -28h-320q-40 0 -68 28t-28 68v192q0 40 28 68t68 28
+h320q40 0 68 -28t28 -68zM1792 288v-192q0 -40 -28 -68t-68 -28h-320q-40 0 -68 28t-28 68v192q0 40 28 68t68 28h320q40 0 68 -28t28 -68zM1152 1312v-192q0 -40 -28 -68t-68 -28h-320q-40 0 -68 28t-28 68v192q0 40 28 68t68 28h320q40 0 68 -28t28 -68zM1792 800v-192
+q0 -40 -28 -68t-68 -28h-320q-40 0 -68 28t-28 68v192q0 40 28 68t68 28h320q40 0 68 -28t28 -68zM1792 1312v-192q0 -40 -28 -68t-68 -28h-320q-40 0 -68 28t-28 68v192q0 40 28 68t68 28h320q40 0 68 -28t28 -68z" />
+    <glyph glyph-name="th_list" unicode="&#xf00b;" horiz-adv-x="1792" 
+d="M512 288v-192q0 -40 -28 -68t-68 -28h-320q-40 0 -68 28t-28 68v192q0 40 28 68t68 28h320q40 0 68 -28t28 -68zM512 800v-192q0 -40 -28 -68t-68 -28h-320q-40 0 -68 28t-28 68v192q0 40 28 68t68 28h320q40 0 68 -28t28 -68zM1792 288v-192q0 -40 -28 -68t-68 -28h-960
+q-40 0 -68 28t-28 68v192q0 40 28 68t68 28h960q40 0 68 -28t28 -68zM512 1312v-192q0 -40 -28 -68t-68 -28h-320q-40 0 -68 28t-28 68v192q0 40 28 68t68 28h320q40 0 68 -28t28 -68zM1792 800v-192q0 -40 -28 -68t-68 -28h-960q-40 0 -68 28t-28 68v192q0 40 28 68t68 28
+h960q40 0 68 -28t28 -68zM1792 1312v-192q0 -40 -28 -68t-68 -28h-960q-40 0 -68 28t-28 68v192q0 40 28 68t68 28h960q40 0 68 -28t28 -68z" />
+    <glyph glyph-name="ok" unicode="&#xf00c;" horiz-adv-x="1792" 
+d="M1671 970q0 -40 -28 -68l-724 -724l-136 -136q-28 -28 -68 -28t-68 28l-136 136l-362 362q-28 28 -28 68t28 68l136 136q28 28 68 28t68 -28l294 -295l656 657q28 28 68 28t68 -28l136 -136q28 -28 28 -68z" />
+    <glyph glyph-name="remove" unicode="&#xf00d;" horiz-adv-x="1408" 
+d="M1298 214q0 -40 -28 -68l-136 -136q-28 -28 -68 -28t-68 28l-294 294l-294 -294q-28 -28 -68 -28t-68 28l-136 136q-28 28 -28 68t28 68l294 294l-294 294q-28 28 -28 68t28 68l136 136q28 28 68 28t68 -28l294 -294l294 294q28 28 68 28t68 -28l136 -136q28 -28 28 -68
+t-28 -68l-294 -294l294 -294q28 -28 28 -68z" />
+    <glyph glyph-name="zoom_in" unicode="&#xf00e;" horiz-adv-x="1664" 
+d="M1024 736v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-224v-224q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v224h-224q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h224v224q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5v-224h224
+q13 0 22.5 -9.5t9.5 -22.5zM1152 704q0 185 -131.5 316.5t-316.5 131.5t-316.5 -131.5t-131.5 -316.5t131.5 -316.5t316.5 -131.5t316.5 131.5t131.5 316.5zM1664 -128q0 -53 -37.5 -90.5t-90.5 -37.5q-54 0 -90 38l-343 342q-179 -124 -399 -124q-143 0 -273.5 55.5
+t-225 150t-150 225t-55.5 273.5t55.5 273.5t150 225t225 150t273.5 55.5t273.5 -55.5t225 -150t150 -225t55.5 -273.5q0 -220 -124 -399l343 -343q37 -37 37 -90z" />
+    <glyph glyph-name="zoom_out" unicode="&#xf010;" horiz-adv-x="1664" 
+d="M1024 736v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-576q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h576q13 0 22.5 -9.5t9.5 -22.5zM1152 704q0 185 -131.5 316.5t-316.5 131.5t-316.5 -131.5t-131.5 -316.5t131.5 -316.5t316.5 -131.5t316.5 131.5t131.5 316.5z
+M1664 -128q0 -53 -37.5 -90.5t-90.5 -37.5q-54 0 -90 38l-343 342q-179 -124 -399 -124q-143 0 -273.5 55.5t-225 150t-150 225t-55.5 273.5t55.5 273.5t150 225t225 150t273.5 55.5t273.5 -55.5t225 -150t150 -225t55.5 -273.5q0 -220 -124 -399l343 -343q37 -37 37 -90z
+" />
+    <glyph glyph-name="off" unicode="&#xf011;" 
+d="M1536 640q0 -156 -61 -298t-164 -245t-245 -164t-298 -61t-298 61t-245 164t-164 245t-61 298q0 182 80.5 343t226.5 270q43 32 95.5 25t83.5 -50q32 -42 24.5 -94.5t-49.5 -84.5q-98 -74 -151.5 -181t-53.5 -228q0 -104 40.5 -198.5t109.5 -163.5t163.5 -109.5
+t198.5 -40.5t198.5 40.5t163.5 109.5t109.5 163.5t40.5 198.5q0 121 -53.5 228t-151.5 181q-42 32 -49.5 84.5t24.5 94.5q31 43 84 50t95 -25q146 -109 226.5 -270t80.5 -343zM896 1408v-640q0 -52 -38 -90t-90 -38t-90 38t-38 90v640q0 52 38 90t90 38t90 -38t38 -90z" />
+    <glyph glyph-name="signal" unicode="&#xf012;" horiz-adv-x="1792" 
+d="M256 96v-192q0 -14 -9 -23t-23 -9h-192q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h192q14 0 23 -9t9 -23zM640 224v-320q0 -14 -9 -23t-23 -9h-192q-14 0 -23 9t-9 23v320q0 14 9 23t23 9h192q14 0 23 -9t9 -23zM1024 480v-576q0 -14 -9 -23t-23 -9h-192q-14 0 -23 9t-9 23
+v576q0 14 9 23t23 9h192q14 0 23 -9t9 -23zM1408 864v-960q0 -14 -9 -23t-23 -9h-192q-14 0 -23 9t-9 23v960q0 14 9 23t23 9h192q14 0 23 -9t9 -23zM1792 1376v-1472q0 -14 -9 -23t-23 -9h-192q-14 0 -23 9t-9 23v1472q0 14 9 23t23 9h192q14 0 23 -9t9 -23z" />
+    <glyph glyph-name="cog" unicode="&#xf013;" 
+d="M1024 640q0 106 -75 181t-181 75t-181 -75t-75 -181t75 -181t181 -75t181 75t75 181zM1536 749v-222q0 -12 -8 -23t-20 -13l-185 -28q-19 -54 -39 -91q35 -50 107 -138q10 -12 10 -25t-9 -23q-27 -37 -99 -108t-94 -71q-12 0 -26 9l-138 108q-44 -23 -91 -38
+q-16 -136 -29 -186q-7 -28 -36 -28h-222q-14 0 -24.5 8.5t-11.5 21.5l-28 184q-49 16 -90 37l-141 -107q-10 -9 -25 -9q-14 0 -25 11q-126 114 -165 168q-7 10 -7 23q0 12 8 23q15 21 51 66.5t54 70.5q-27 50 -41 99l-183 27q-13 2 -21 12.5t-8 23.5v222q0 12 8 23t19 13
+l186 28q14 46 39 92q-40 57 -107 138q-10 12 -10 24q0 10 9 23q26 36 98.5 107.5t94.5 71.5q13 0 26 -10l138 -107q44 23 91 38q16 136 29 186q7 28 36 28h222q14 0 24.5 -8.5t11.5 -21.5l28 -184q49 -16 90 -37l142 107q9 9 24 9q13 0 25 -10q129 -119 165 -170q7 -8 7 -22
+q0 -12 -8 -23q-15 -21 -51 -66.5t-54 -70.5q26 -50 41 -98l183 -28q13 -2 21 -12.5t8 -23.5z" />
+    <glyph glyph-name="trash" unicode="&#xf014;" horiz-adv-x="1408" 
+d="M512 800v-576q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v576q0 14 9 23t23 9h64q14 0 23 -9t9 -23zM768 800v-576q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v576q0 14 9 23t23 9h64q14 0 23 -9t9 -23zM1024 800v-576q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v576
+q0 14 9 23t23 9h64q14 0 23 -9t9 -23zM1152 76v948h-896v-948q0 -22 7 -40.5t14.5 -27t10.5 -8.5h832q3 0 10.5 8.5t14.5 27t7 40.5zM480 1152h448l-48 117q-7 9 -17 11h-317q-10 -2 -17 -11zM1408 1120v-64q0 -14 -9 -23t-23 -9h-96v-948q0 -83 -47 -143.5t-113 -60.5h-832
+q-66 0 -113 58.5t-47 141.5v952h-96q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h309l70 167q15 37 54 63t79 26h320q40 0 79 -26t54 -63l70 -167h309q14 0 23 -9t9 -23z" />
+    <glyph glyph-name="home" unicode="&#xf015;" horiz-adv-x="1664" 
+d="M1408 544v-480q0 -26 -19 -45t-45 -19h-384v384h-256v-384h-384q-26 0 -45 19t-19 45v480q0 1 0.5 3t0.5 3l575 474l575 -474q1 -2 1 -6zM1631 613l-62 -74q-8 -9 -21 -11h-3q-13 0 -21 7l-692 577l-692 -577q-12 -8 -24 -7q-13 2 -21 11l-62 74q-8 10 -7 23.5t11 21.5
+l719 599q32 26 76 26t76 -26l244 -204v195q0 14 9 23t23 9h192q14 0 23 -9t9 -23v-408l219 -182q10 -8 11 -21.5t-7 -23.5z" />
+    <glyph glyph-name="file_alt" unicode="&#xf016;" 
+d="M1468 1156q28 -28 48 -76t20 -88v-1152q0 -40 -28 -68t-68 -28h-1344q-40 0 -68 28t-28 68v1600q0 40 28 68t68 28h896q40 0 88 -20t76 -48zM1024 1400v-376h376q-10 29 -22 41l-313 313q-12 12 -41 22zM1408 -128v1024h-416q-40 0 -68 28t-28 68v416h-768v-1536h1280z
+" />
+    <glyph glyph-name="time" unicode="&#xf017;" 
+d="M896 992v-448q0 -14 -9 -23t-23 -9h-320q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h224v352q0 14 9 23t23 9h64q14 0 23 -9t9 -23zM1312 640q0 148 -73 273t-198 198t-273 73t-273 -73t-198 -198t-73 -273t73 -273t198 -198t273 -73t273 73t198 198t73 273zM1536 640
+q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="road" unicode="&#xf018;" horiz-adv-x="1920" 
+d="M1111 540v4l-24 320q-1 13 -11 22.5t-23 9.5h-186q-13 0 -23 -9.5t-11 -22.5l-24 -320v-4q-1 -12 8 -20t21 -8h244q12 0 21 8t8 20zM1870 73q0 -73 -46 -73h-704q13 0 22 9.5t8 22.5l-20 256q-1 13 -11 22.5t-23 9.5h-272q-13 0 -23 -9.5t-11 -22.5l-20 -256
+q-1 -13 8 -22.5t22 -9.5h-704q-46 0 -46 73q0 54 26 116l417 1044q8 19 26 33t38 14h339q-13 0 -23 -9.5t-11 -22.5l-15 -192q-1 -14 8 -23t22 -9h166q13 0 22 9t8 23l-15 192q-1 13 -11 22.5t-23 9.5h339q20 0 38 -14t26 -33l417 -1044q26 -62 26 -116z" />
+    <glyph glyph-name="download_alt" unicode="&#xf019;" horiz-adv-x="1664" 
+d="M1280 192q0 26 -19 45t-45 19t-45 -19t-19 -45t19 -45t45 -19t45 19t19 45zM1536 192q0 26 -19 45t-45 19t-45 -19t-19 -45t19 -45t45 -19t45 19t19 45zM1664 416v-320q0 -40 -28 -68t-68 -28h-1472q-40 0 -68 28t-28 68v320q0 40 28 68t68 28h465l135 -136
+q58 -56 136 -56t136 56l136 136h464q40 0 68 -28t28 -68zM1339 985q17 -41 -14 -70l-448 -448q-18 -19 -45 -19t-45 19l-448 448q-31 29 -14 70q17 39 59 39h256v448q0 26 19 45t45 19h256q26 0 45 -19t19 -45v-448h256q42 0 59 -39z" />
+    <glyph glyph-name="download" unicode="&#xf01a;" 
+d="M1120 608q0 -12 -10 -24l-319 -319q-11 -9 -23 -9t-23 9l-320 320q-15 16 -7 35q8 20 30 20h192v352q0 14 9 23t23 9h192q14 0 23 -9t9 -23v-352h192q14 0 23 -9t9 -23zM768 1184q-148 0 -273 -73t-198 -198t-73 -273t73 -273t198 -198t273 -73t273 73t198 198t73 273
+t-73 273t-198 198t-273 73zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="upload" unicode="&#xf01b;" 
+d="M1118 660q-8 -20 -30 -20h-192v-352q0 -14 -9 -23t-23 -9h-192q-14 0 -23 9t-9 23v352h-192q-14 0 -23 9t-9 23q0 12 10 24l319 319q11 9 23 9t23 -9l320 -320q15 -16 7 -35zM768 1184q-148 0 -273 -73t-198 -198t-73 -273t73 -273t198 -198t273 -73t273 73t198 198
+t73 273t-73 273t-198 198t-273 73zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="inbox" unicode="&#xf01c;" 
+d="M1023 576h316q-1 3 -2.5 8.5t-2.5 7.5l-212 496h-708l-212 -496q-1 -3 -2.5 -8.5t-2.5 -7.5h316l95 -192h320zM1536 546v-482q0 -26 -19 -45t-45 -19h-1408q-26 0 -45 19t-19 45v482q0 62 25 123l238 552q10 25 36.5 42t52.5 17h832q26 0 52.5 -17t36.5 -42l238 -552
+q25 -61 25 -123z" />
+    <glyph glyph-name="play_circle" unicode="&#xf01d;" 
+d="M1184 640q0 -37 -32 -55l-544 -320q-15 -9 -32 -9q-16 0 -32 8q-32 19 -32 56v640q0 37 32 56q33 18 64 -1l544 -320q32 -18 32 -55zM1312 640q0 148 -73 273t-198 198t-273 73t-273 -73t-198 -198t-73 -273t73 -273t198 -198t273 -73t273 73t198 198t73 273zM1536 640
+q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="repeat" unicode="&#xf01e;" 
+d="M1536 1280v-448q0 -26 -19 -45t-45 -19h-448q-42 0 -59 40q-17 39 14 69l138 138q-148 137 -349 137q-104 0 -198.5 -40.5t-163.5 -109.5t-109.5 -163.5t-40.5 -198.5t40.5 -198.5t109.5 -163.5t163.5 -109.5t198.5 -40.5q119 0 225 52t179 147q7 10 23 12q15 0 25 -9
+l137 -138q9 -8 9.5 -20.5t-7.5 -22.5q-109 -132 -264 -204.5t-327 -72.5q-156 0 -298 61t-245 164t-164 245t-61 298t61 298t164 245t245 164t298 61q147 0 284.5 -55.5t244.5 -156.5l130 129q29 31 70 14q39 -17 39 -59z" />
+    <glyph glyph-name="refresh" unicode="&#xf021;" 
+d="M1511 480q0 -5 -1 -7q-64 -268 -268 -434.5t-478 -166.5q-146 0 -282.5 55t-243.5 157l-129 -129q-19 -19 -45 -19t-45 19t-19 45v448q0 26 19 45t45 19h448q26 0 45 -19t19 -45t-19 -45l-137 -137q71 -66 161 -102t187 -36q134 0 250 65t186 179q11 17 53 117
+q8 23 30 23h192q13 0 22.5 -9.5t9.5 -22.5zM1536 1280v-448q0 -26 -19 -45t-45 -19h-448q-26 0 -45 19t-19 45t19 45l138 138q-148 137 -349 137q-134 0 -250 -65t-186 -179q-11 -17 -53 -117q-8 -23 -30 -23h-199q-13 0 -22.5 9.5t-9.5 22.5v7q65 268 270 434.5t480 166.5
+q146 0 284 -55.5t245 -156.5l130 129q19 19 45 19t45 -19t19 -45z" />
+    <glyph glyph-name="list_alt" unicode="&#xf022;" horiz-adv-x="1792" 
+d="M384 352v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5zM384 608v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5z
+M384 864v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5zM1536 352v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-960q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h960q13 0 22.5 -9.5t9.5 -22.5z
+M1536 608v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-960q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h960q13 0 22.5 -9.5t9.5 -22.5zM1536 864v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-960q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h960q13 0 22.5 -9.5
+t9.5 -22.5zM1664 160v832q0 13 -9.5 22.5t-22.5 9.5h-1472q-13 0 -22.5 -9.5t-9.5 -22.5v-832q0 -13 9.5 -22.5t22.5 -9.5h1472q13 0 22.5 9.5t9.5 22.5zM1792 1248v-1088q0 -66 -47 -113t-113 -47h-1472q-66 0 -113 47t-47 113v1088q0 66 47 113t113 47h1472q66 0 113 -47
+t47 -113z" />
+    <glyph glyph-name="lock" unicode="&#xf023;" horiz-adv-x="1152" 
+d="M320 768h512v192q0 106 -75 181t-181 75t-181 -75t-75 -181v-192zM1152 672v-576q0 -40 -28 -68t-68 -28h-960q-40 0 -68 28t-28 68v576q0 40 28 68t68 28h32v192q0 184 132 316t316 132t316 -132t132 -316v-192h32q40 0 68 -28t28 -68z" />
+    <glyph glyph-name="flag" unicode="&#xf024;" horiz-adv-x="1792" 
+d="M320 1280q0 -72 -64 -110v-1266q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v1266q-64 38 -64 110q0 53 37.5 90.5t90.5 37.5t90.5 -37.5t37.5 -90.5zM1792 1216v-763q0 -25 -12.5 -38.5t-39.5 -27.5q-215 -116 -369 -116q-61 0 -123.5 22t-108.5 48
+t-115.5 48t-142.5 22q-192 0 -464 -146q-17 -9 -33 -9q-26 0 -45 19t-19 45v742q0 32 31 55q21 14 79 43q236 120 421 120q107 0 200 -29t219 -88q38 -19 88 -19q54 0 117.5 21t110 47t88 47t54.5 21q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="headphones" unicode="&#xf025;" horiz-adv-x="1664" 
+d="M1664 650q0 -166 -60 -314l-20 -49l-185 -33q-22 -83 -90.5 -136.5t-156.5 -53.5v-32q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v576q0 14 9 23t23 9h64q14 0 23 -9t9 -23v-32q71 0 130 -35.5t93 -95.5l68 12q29 95 29 193q0 148 -88 279t-236.5 209t-315.5 78
+t-315.5 -78t-236.5 -209t-88 -279q0 -98 29 -193l68 -12q34 60 93 95.5t130 35.5v32q0 14 9 23t23 9h64q14 0 23 -9t9 -23v-576q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v32q-88 0 -156.5 53.5t-90.5 136.5l-185 33l-20 49q-60 148 -60 314q0 151 67 291t179 242.5
+t266 163.5t320 61t320 -61t266 -163.5t179 -242.5t67 -291z" />
+    <glyph glyph-name="volume_off" unicode="&#xf026;" horiz-adv-x="768" 
+d="M768 1184v-1088q0 -26 -19 -45t-45 -19t-45 19l-333 333h-262q-26 0 -45 19t-19 45v384q0 26 19 45t45 19h262l333 333q19 19 45 19t45 -19t19 -45z" />
+    <glyph glyph-name="volume_down" unicode="&#xf027;" horiz-adv-x="1152" 
+d="M768 1184v-1088q0 -26 -19 -45t-45 -19t-45 19l-333 333h-262q-26 0 -45 19t-19 45v384q0 26 19 45t45 19h262l333 333q19 19 45 19t45 -19t19 -45zM1152 640q0 -76 -42.5 -141.5t-112.5 -93.5q-10 -5 -25 -5q-26 0 -45 18.5t-19 45.5q0 21 12 35.5t29 25t34 23t29 36
+t12 56.5t-12 56.5t-29 36t-34 23t-29 25t-12 35.5q0 27 19 45.5t45 18.5q15 0 25 -5q70 -27 112.5 -93t42.5 -142z" />
+    <glyph glyph-name="volume_up" unicode="&#xf028;" horiz-adv-x="1664" 
+d="M768 1184v-1088q0 -26 -19 -45t-45 -19t-45 19l-333 333h-262q-26 0 -45 19t-19 45v384q0 26 19 45t45 19h262l333 333q19 19 45 19t45 -19t19 -45zM1152 640q0 -76 -42.5 -141.5t-112.5 -93.5q-10 -5 -25 -5q-26 0 -45 18.5t-19 45.5q0 21 12 35.5t29 25t34 23t29 36
+t12 56.5t-12 56.5t-29 36t-34 23t-29 25t-12 35.5q0 27 19 45.5t45 18.5q15 0 25 -5q70 -27 112.5 -93t42.5 -142zM1408 640q0 -153 -85 -282.5t-225 -188.5q-13 -5 -25 -5q-27 0 -46 19t-19 45q0 39 39 59q56 29 76 44q74 54 115.5 135.5t41.5 173.5t-41.5 173.5
+t-115.5 135.5q-20 15 -76 44q-39 20 -39 59q0 26 19 45t45 19q13 0 26 -5q140 -59 225 -188.5t85 -282.5zM1664 640q0 -230 -127 -422.5t-338 -283.5q-13 -5 -26 -5q-26 0 -45 19t-19 45q0 36 39 59q7 4 22.5 10.5t22.5 10.5q46 25 82 51q123 91 192 227t69 289t-69 289
+t-192 227q-36 26 -82 51q-7 4 -22.5 10.5t-22.5 10.5q-39 23 -39 59q0 26 19 45t45 19q13 0 26 -5q211 -91 338 -283.5t127 -422.5z" />
+    <glyph glyph-name="qrcode" unicode="&#xf029;" horiz-adv-x="1408" 
+d="M384 384v-128h-128v128h128zM384 1152v-128h-128v128h128zM1152 1152v-128h-128v128h128zM128 129h384v383h-384v-383zM128 896h384v384h-384v-384zM896 896h384v384h-384v-384zM640 640v-640h-640v640h640zM1152 128v-128h-128v128h128zM1408 128v-128h-128v128h128z
+M1408 640v-384h-384v128h-128v-384h-128v640h384v-128h128v128h128zM640 1408v-640h-640v640h640zM1408 1408v-640h-640v640h640z" />
+    <glyph glyph-name="barcode" unicode="&#xf02a;" horiz-adv-x="1792" 
+d="M63 0h-63v1408h63v-1408zM126 1h-32v1407h32v-1407zM220 1h-31v1407h31v-1407zM377 1h-31v1407h31v-1407zM534 1h-62v1407h62v-1407zM660 1h-31v1407h31v-1407zM723 1h-31v1407h31v-1407zM786 1h-31v1407h31v-1407zM943 1h-63v1407h63v-1407zM1100 1h-63v1407h63v-1407z
+M1226 1h-63v1407h63v-1407zM1352 1h-63v1407h63v-1407zM1446 1h-63v1407h63v-1407zM1635 1h-94v1407h94v-1407zM1698 1h-32v1407h32v-1407zM1792 0h-63v1408h63v-1408z" />
+    <glyph glyph-name="tag" unicode="&#xf02b;" 
+d="M448 1088q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM1515 512q0 -53 -37 -90l-491 -492q-39 -37 -91 -37q-53 0 -90 37l-715 716q-38 37 -64.5 101t-26.5 117v416q0 52 38 90t90 38h416q53 0 117 -26.5t102 -64.5
+l715 -714q37 -39 37 -91z" />
+    <glyph glyph-name="tags" unicode="&#xf02c;" horiz-adv-x="1920" 
+d="M448 1088q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM1515 512q0 -53 -37 -90l-491 -492q-39 -37 -91 -37q-53 0 -90 37l-715 716q-38 37 -64.5 101t-26.5 117v416q0 52 38 90t90 38h416q53 0 117 -26.5t102 -64.5
+l715 -714q37 -39 37 -91zM1899 512q0 -53 -37 -90l-491 -492q-39 -37 -91 -37q-36 0 -59 14t-53 45l470 470q37 37 37 90q0 52 -37 91l-715 714q-38 38 -102 64.5t-117 26.5h224q53 0 117 -26.5t102 -64.5l715 -714q37 -39 37 -91z" />
+    <glyph glyph-name="book" unicode="&#xf02d;" horiz-adv-x="1664" 
+d="M1639 1058q40 -57 18 -129l-275 -906q-19 -64 -76.5 -107.5t-122.5 -43.5h-923q-77 0 -148.5 53.5t-99.5 131.5q-24 67 -2 127q0 4 3 27t4 37q1 8 -3 21.5t-3 19.5q2 11 8 21t16.5 23.5t16.5 23.5q23 38 45 91.5t30 91.5q3 10 0.5 30t-0.5 28q3 11 17 28t17 23
+q21 36 42 92t25 90q1 9 -2.5 32t0.5 28q4 13 22 30.5t22 22.5q19 26 42.5 84.5t27.5 96.5q1 8 -3 25.5t-2 26.5q2 8 9 18t18 23t17 21q8 12 16.5 30.5t15 35t16 36t19.5 32t26.5 23.5t36 11.5t47.5 -5.5l-1 -3q38 9 51 9h761q74 0 114 -56t18 -130l-274 -906
+q-36 -119 -71.5 -153.5t-128.5 -34.5h-869q-27 0 -38 -15q-11 -16 -1 -43q24 -70 144 -70h923q29 0 56 15.5t35 41.5l300 987q7 22 5 57q38 -15 59 -43zM575 1056q-4 -13 2 -22.5t20 -9.5h608q13 0 25.5 9.5t16.5 22.5l21 64q4 13 -2 22.5t-20 9.5h-608q-13 0 -25.5 -9.5
+t-16.5 -22.5zM492 800q-4 -13 2 -22.5t20 -9.5h608q13 0 25.5 9.5t16.5 22.5l21 64q4 13 -2 22.5t-20 9.5h-608q-13 0 -25.5 -9.5t-16.5 -22.5z" />
+    <glyph glyph-name="bookmark" unicode="&#xf02e;" horiz-adv-x="1280" 
+d="M1164 1408q23 0 44 -9q33 -13 52.5 -41t19.5 -62v-1289q0 -34 -19.5 -62t-52.5 -41q-19 -8 -44 -8q-48 0 -83 32l-441 424l-441 -424q-36 -33 -83 -33q-23 0 -44 9q-33 13 -52.5 41t-19.5 62v1289q0 34 19.5 62t52.5 41q21 9 44 9h1048z" />
+    <glyph glyph-name="print" unicode="&#xf02f;" horiz-adv-x="1664" 
+d="M384 0h896v256h-896v-256zM384 640h896v384h-160q-40 0 -68 28t-28 68v160h-640v-640zM1536 576q0 26 -19 45t-45 19t-45 -19t-19 -45t19 -45t45 -19t45 19t19 45zM1664 576v-416q0 -13 -9.5 -22.5t-22.5 -9.5h-224v-160q0 -40 -28 -68t-68 -28h-960q-40 0 -68 28t-28 68
+v160h-224q-13 0 -22.5 9.5t-9.5 22.5v416q0 79 56.5 135.5t135.5 56.5h64v544q0 40 28 68t68 28h672q40 0 88 -20t76 -48l152 -152q28 -28 48 -76t20 -88v-256h64q79 0 135.5 -56.5t56.5 -135.5z" />
+    <glyph glyph-name="camera" unicode="&#xf030;" horiz-adv-x="1920" 
+d="M960 864q119 0 203.5 -84.5t84.5 -203.5t-84.5 -203.5t-203.5 -84.5t-203.5 84.5t-84.5 203.5t84.5 203.5t203.5 84.5zM1664 1280q106 0 181 -75t75 -181v-896q0 -106 -75 -181t-181 -75h-1408q-106 0 -181 75t-75 181v896q0 106 75 181t181 75h224l51 136
+q19 49 69.5 84.5t103.5 35.5h512q53 0 103.5 -35.5t69.5 -84.5l51 -136h224zM960 128q185 0 316.5 131.5t131.5 316.5t-131.5 316.5t-316.5 131.5t-316.5 -131.5t-131.5 -316.5t131.5 -316.5t316.5 -131.5z" />
+    <glyph glyph-name="font" unicode="&#xf031;" horiz-adv-x="1664" 
+d="M725 977l-170 -450q33 0 136.5 -2t160.5 -2q19 0 57 2q-87 253 -184 452zM0 -128l2 79q23 7 56 12.5t57 10.5t49.5 14.5t44.5 29t31 50.5l237 616l280 724h75h53q8 -14 11 -21l205 -480q33 -78 106 -257.5t114 -274.5q15 -34 58 -144.5t72 -168.5q20 -45 35 -57
+q19 -15 88 -29.5t84 -20.5q6 -38 6 -57q0 -5 -0.5 -13.5t-0.5 -12.5q-63 0 -190 8t-191 8q-76 0 -215 -7t-178 -8q0 43 4 78l131 28q1 0 12.5 2.5t15.5 3.5t14.5 4.5t15 6.5t11 8t9 11t2.5 14q0 16 -31 96.5t-72 177.5t-42 100l-450 2q-26 -58 -76.5 -195.5t-50.5 -162.5
+q0 -22 14 -37.5t43.5 -24.5t48.5 -13.5t57 -8.5t41 -4q1 -19 1 -58q0 -9 -2 -27q-58 0 -174.5 10t-174.5 10q-8 0 -26.5 -4t-21.5 -4q-80 -14 -188 -14z" />
+    <glyph glyph-name="bold" unicode="&#xf032;" horiz-adv-x="1408" 
+d="M555 15q74 -32 140 -32q376 0 376 335q0 114 -41 180q-27 44 -61.5 74t-67.5 46.5t-80.5 25t-84 10.5t-94.5 2q-73 0 -101 -10q0 -53 -0.5 -159t-0.5 -158q0 -8 -1 -67.5t-0.5 -96.5t4.5 -83.5t12 -66.5zM541 761q42 -7 109 -7q82 0 143 13t110 44.5t74.5 89.5t25.5 142
+q0 70 -29 122.5t-79 82t-108 43.5t-124 14q-50 0 -130 -13q0 -50 4 -151t4 -152q0 -27 -0.5 -80t-0.5 -79q0 -46 1 -69zM0 -128l2 94q15 4 85 16t106 27q7 12 12.5 27t8.5 33.5t5.5 32.5t3 37.5t0.5 34v35.5v30q0 982 -22 1025q-4 8 -22 14.5t-44.5 11t-49.5 7t-48.5 4.5
+t-30.5 3l-4 83q98 2 340 11.5t373 9.5q23 0 68 -0.5t68 -0.5q70 0 136.5 -13t128.5 -42t108 -71t74 -104.5t28 -137.5q0 -52 -16.5 -95.5t-39 -72t-64.5 -57.5t-73 -45t-84 -40q154 -35 256.5 -134t102.5 -248q0 -100 -35 -179.5t-93.5 -130.5t-138 -85.5t-163.5 -48.5
+t-176 -14q-44 0 -132 3t-132 3q-106 0 -307 -11t-231 -12z" />
+    <glyph glyph-name="italic" unicode="&#xf033;" horiz-adv-x="1024" 
+d="M0 -126l17 85q22 7 61.5 16.5t72 19t59.5 23.5q28 35 41 101q1 7 62 289t114 543.5t52 296.5v25q-24 13 -54.5 18.5t-69.5 8t-58 5.5l19 103q33 -2 120 -6.5t149.5 -7t120.5 -2.5q48 0 98.5 2.5t121 7t98.5 6.5q-5 -39 -19 -89q-30 -10 -101.5 -28.5t-108.5 -33.5
+q-8 -19 -14 -42.5t-9 -40t-7.5 -45.5t-6.5 -42q-27 -148 -87.5 -419.5t-77.5 -355.5q-2 -9 -13 -58t-20 -90t-16 -83.5t-6 -57.5l1 -18q17 -4 185 -31q-3 -44 -16 -99q-11 0 -32.5 -1.5t-32.5 -1.5q-29 0 -87 10t-86 10q-138 2 -206 2q-51 0 -143 -9t-121 -11z" />
+    <glyph glyph-name="text_height" unicode="&#xf034;" horiz-adv-x="1792" 
+d="M1744 128q33 0 42 -18.5t-11 -44.5l-126 -162q-20 -26 -49 -26t-49 26l-126 162q-20 26 -11 44.5t42 18.5h80v1024h-80q-33 0 -42 18.5t11 44.5l126 162q20 26 49 26t49 -26l126 -162q20 -26 11 -44.5t-42 -18.5h-80v-1024h80zM81 1407l54 -27q12 -5 211 -5q44 0 132 2
+t132 2q36 0 107.5 -0.5t107.5 -0.5h293q6 0 21 -0.5t20.5 0t16 3t17.5 9t15 17.5l42 1q4 0 14 -0.5t14 -0.5q2 -112 2 -336q0 -80 -5 -109q-39 -14 -68 -18q-25 44 -54 128q-3 9 -11 48t-14.5 73.5t-7.5 35.5q-6 8 -12 12.5t-15.5 6t-13 2.5t-18 0.5t-16.5 -0.5
+q-17 0 -66.5 0.5t-74.5 0.5t-64 -2t-71 -6q-9 -81 -8 -136q0 -94 2 -388t2 -455q0 -16 -2.5 -71.5t0 -91.5t12.5 -69q40 -21 124 -42.5t120 -37.5q5 -40 5 -50q0 -14 -3 -29l-34 -1q-76 -2 -218 8t-207 10q-50 0 -151 -9t-152 -9q-3 51 -3 52v9q17 27 61.5 43t98.5 29t78 27
+q19 42 19 383q0 101 -3 303t-3 303v117q0 2 0.5 15.5t0.5 25t-1 25.5t-3 24t-5 14q-11 12 -162 12q-33 0 -93 -12t-80 -26q-19 -13 -34 -72.5t-31.5 -111t-42.5 -53.5q-42 26 -56 44v383z" />
+    <glyph glyph-name="text_width" unicode="&#xf035;" 
+d="M81 1407l54 -27q12 -5 211 -5q44 0 132 2t132 2q70 0 246.5 1t304.5 0.5t247 -4.5q33 -1 56 31l42 1q4 0 14 -0.5t14 -0.5q2 -112 2 -336q0 -80 -5 -109q-39 -14 -68 -18q-25 44 -54 128q-3 9 -11 47.5t-15 73.5t-7 36q-10 13 -27 19q-5 2 -66 2q-30 0 -93 1t-103 1
+t-94 -2t-96 -7q-9 -81 -8 -136l1 -152v52q0 -55 1 -154t1.5 -180t0.5 -153q0 -16 -2.5 -71.5t0 -91.5t12.5 -69q40 -21 124 -42.5t120 -37.5q5 -40 5 -50q0 -14 -3 -29l-34 -1q-76 -2 -218 8t-207 10q-50 0 -151 -9t-152 -9q-3 51 -3 52v9q17 27 61.5 43t98.5 29t78 27
+q7 16 11.5 74t6 145.5t1.5 155t-0.5 153.5t-0.5 89q0 7 -2.5 21.5t-2.5 22.5q0 7 0.5 44t1 73t0 76.5t-3 67.5t-6.5 32q-11 12 -162 12q-41 0 -163 -13.5t-138 -24.5q-19 -12 -34 -71.5t-31.5 -111.5t-42.5 -54q-42 26 -56 44v383zM1310 125q12 0 42 -19.5t57.5 -41.5
+t59.5 -49t36 -30q26 -21 26 -49t-26 -49q-4 -3 -36 -30t-59.5 -49t-57.5 -41.5t-42 -19.5q-13 0 -20.5 10.5t-10 28.5t-2.5 33.5t1.5 33t1.5 19.5h-1024q0 -2 1.5 -19.5t1.5 -33t-2.5 -33.5t-10 -28.5t-20.5 -10.5q-12 0 -42 19.5t-57.5 41.5t-59.5 49t-36 30q-26 21 -26 49
+t26 49q4 3 36 30t59.5 49t57.5 41.5t42 19.5q13 0 20.5 -10.5t10 -28.5t2.5 -33.5t-1.5 -33t-1.5 -19.5h1024q0 2 -1.5 19.5t-1.5 33t2.5 33.5t10 28.5t20.5 10.5z" />
+    <glyph glyph-name="align_left" unicode="&#xf036;" horiz-adv-x="1792" 
+d="M1792 192v-128q0 -26 -19 -45t-45 -19h-1664q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h1664q26 0 45 -19t19 -45zM1408 576v-128q0 -26 -19 -45t-45 -19h-1280q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h1280q26 0 45 -19t19 -45zM1664 960v-128q0 -26 -19 -45
+t-45 -19h-1536q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h1536q26 0 45 -19t19 -45zM1280 1344v-128q0 -26 -19 -45t-45 -19h-1152q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h1152q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="align_center" unicode="&#xf037;" horiz-adv-x="1792" 
+d="M1792 192v-128q0 -26 -19 -45t-45 -19h-1664q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h1664q26 0 45 -19t19 -45zM1408 576v-128q0 -26 -19 -45t-45 -19h-896q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h896q26 0 45 -19t19 -45zM1664 960v-128q0 -26 -19 -45t-45 -19
+h-1408q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h1408q26 0 45 -19t19 -45zM1280 1344v-128q0 -26 -19 -45t-45 -19h-640q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h640q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="align_right" unicode="&#xf038;" horiz-adv-x="1792" 
+d="M1792 192v-128q0 -26 -19 -45t-45 -19h-1664q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h1664q26 0 45 -19t19 -45zM1792 576v-128q0 -26 -19 -45t-45 -19h-1280q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h1280q26 0 45 -19t19 -45zM1792 960v-128q0 -26 -19 -45
+t-45 -19h-1536q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h1536q26 0 45 -19t19 -45zM1792 1344v-128q0 -26 -19 -45t-45 -19h-1152q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h1152q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="align_justify" unicode="&#xf039;" horiz-adv-x="1792" 
+d="M1792 192v-128q0 -26 -19 -45t-45 -19h-1664q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h1664q26 0 45 -19t19 -45zM1792 576v-128q0 -26 -19 -45t-45 -19h-1664q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h1664q26 0 45 -19t19 -45zM1792 960v-128q0 -26 -19 -45
+t-45 -19h-1664q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h1664q26 0 45 -19t19 -45zM1792 1344v-128q0 -26 -19 -45t-45 -19h-1664q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h1664q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="list" unicode="&#xf03a;" horiz-adv-x="1792" 
+d="M256 224v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-192q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5t22.5 9.5h192q13 0 22.5 -9.5t9.5 -22.5zM256 608v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-192q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5t22.5 9.5h192q13 0 22.5 -9.5
+t9.5 -22.5zM256 992v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-192q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5t22.5 9.5h192q13 0 22.5 -9.5t9.5 -22.5zM1792 224v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-1344q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5t22.5 9.5h1344
+q13 0 22.5 -9.5t9.5 -22.5zM256 1376v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-192q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5t22.5 9.5h192q13 0 22.5 -9.5t9.5 -22.5zM1792 608v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-1344q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5
+t22.5 9.5h1344q13 0 22.5 -9.5t9.5 -22.5zM1792 992v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-1344q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5t22.5 9.5h1344q13 0 22.5 -9.5t9.5 -22.5zM1792 1376v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-1344q-13 0 -22.5 9.5t-9.5 22.5v192
+q0 13 9.5 22.5t22.5 9.5h1344q13 0 22.5 -9.5t9.5 -22.5z" />
+    <glyph glyph-name="indent_left" unicode="&#xf03b;" horiz-adv-x="1792" 
+d="M384 992v-576q0 -13 -9.5 -22.5t-22.5 -9.5q-14 0 -23 9l-288 288q-9 9 -9 23t9 23l288 288q9 9 23 9q13 0 22.5 -9.5t9.5 -22.5zM1792 224v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-1728q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5t22.5 9.5h1728q13 0 22.5 -9.5
+t9.5 -22.5zM1792 608v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-1088q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5t22.5 9.5h1088q13 0 22.5 -9.5t9.5 -22.5zM1792 992v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-1088q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5t22.5 9.5h1088
+q13 0 22.5 -9.5t9.5 -22.5zM1792 1376v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-1728q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5t22.5 9.5h1728q13 0 22.5 -9.5t9.5 -22.5z" />
+    <glyph glyph-name="indent_right" unicode="&#xf03c;" horiz-adv-x="1792" 
+d="M352 704q0 -14 -9 -23l-288 -288q-9 -9 -23 -9q-13 0 -22.5 9.5t-9.5 22.5v576q0 13 9.5 22.5t22.5 9.5q14 0 23 -9l288 -288q9 -9 9 -23zM1792 224v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-1728q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5t22.5 9.5h1728q13 0 22.5 -9.5
+t9.5 -22.5zM1792 608v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-1088q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5t22.5 9.5h1088q13 0 22.5 -9.5t9.5 -22.5zM1792 992v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-1088q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5t22.5 9.5h1088
+q13 0 22.5 -9.5t9.5 -22.5zM1792 1376v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-1728q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5t22.5 9.5h1728q13 0 22.5 -9.5t9.5 -22.5z" />
+    <glyph glyph-name="facetime_video" unicode="&#xf03d;" horiz-adv-x="1792" 
+d="M1792 1184v-1088q0 -42 -39 -59q-13 -5 -25 -5q-27 0 -45 19l-403 403v-166q0 -119 -84.5 -203.5t-203.5 -84.5h-704q-119 0 -203.5 84.5t-84.5 203.5v704q0 119 84.5 203.5t203.5 84.5h704q119 0 203.5 -84.5t84.5 -203.5v-165l403 402q18 19 45 19q12 0 25 -5
+q39 -17 39 -59z" />
+    <glyph glyph-name="picture" unicode="&#xf03e;" horiz-adv-x="1920" 
+d="M640 960q0 -80 -56 -136t-136 -56t-136 56t-56 136t56 136t136 56t136 -56t56 -136zM1664 576v-448h-1408v192l320 320l160 -160l512 512zM1760 1280h-1600q-13 0 -22.5 -9.5t-9.5 -22.5v-1216q0 -13 9.5 -22.5t22.5 -9.5h1600q13 0 22.5 9.5t9.5 22.5v1216
+q0 13 -9.5 22.5t-22.5 9.5zM1920 1248v-1216q0 -66 -47 -113t-113 -47h-1600q-66 0 -113 47t-47 113v1216q0 66 47 113t113 47h1600q66 0 113 -47t47 -113z" />
+    <glyph glyph-name="pencil" unicode="&#xf040;" 
+d="M363 0l91 91l-235 235l-91 -91v-107h128v-128h107zM886 928q0 22 -22 22q-10 0 -17 -7l-542 -542q-7 -7 -7 -17q0 -22 22 -22q10 0 17 7l542 542q7 7 7 17zM832 1120l416 -416l-832 -832h-416v416zM1515 1024q0 -53 -37 -90l-166 -166l-416 416l166 165q36 38 90 38
+q53 0 91 -38l235 -234q37 -39 37 -91z" />
+    <glyph glyph-name="map_marker" unicode="&#xf041;" horiz-adv-x="1024" 
+d="M768 896q0 106 -75 181t-181 75t-181 -75t-75 -181t75 -181t181 -75t181 75t75 181zM1024 896q0 -109 -33 -179l-364 -774q-16 -33 -47.5 -52t-67.5 -19t-67.5 19t-46.5 52l-365 774q-33 70 -33 179q0 212 150 362t362 150t362 -150t150 -362z" />
+    <glyph glyph-name="adjust" unicode="&#xf042;" 
+d="M768 96v1088q-148 0 -273 -73t-198 -198t-73 -273t73 -273t198 -198t273 -73zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="tint" unicode="&#xf043;" horiz-adv-x="1024" 
+d="M512 384q0 36 -20 69q-1 1 -15.5 22.5t-25.5 38t-25 44t-21 50.5q-4 16 -21 16t-21 -16q-7 -23 -21 -50.5t-25 -44t-25.5 -38t-15.5 -22.5q-20 -33 -20 -69q0 -53 37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM1024 512q0 -212 -150 -362t-362 -150t-362 150t-150 362
+q0 145 81 275q6 9 62.5 90.5t101 151t99.5 178t83 201.5q9 30 34 47t51 17t51.5 -17t33.5 -47q28 -93 83 -201.5t99.5 -178t101 -151t62.5 -90.5q81 -127 81 -275z" />
+    <glyph glyph-name="edit" unicode="&#xf044;" horiz-adv-x="1792" 
+d="M888 352l116 116l-152 152l-116 -116v-56h96v-96h56zM1328 1072q-16 16 -33 -1l-350 -350q-17 -17 -1 -33t33 1l350 350q17 17 1 33zM1408 478v-190q0 -119 -84.5 -203.5t-203.5 -84.5h-832q-119 0 -203.5 84.5t-84.5 203.5v832q0 119 84.5 203.5t203.5 84.5h832
+q63 0 117 -25q15 -7 18 -23q3 -17 -9 -29l-49 -49q-14 -14 -32 -8q-23 6 -45 6h-832q-66 0 -113 -47t-47 -113v-832q0 -66 47 -113t113 -47h832q66 0 113 47t47 113v126q0 13 9 22l64 64q15 15 35 7t20 -29zM1312 1216l288 -288l-672 -672h-288v288zM1756 1084l-92 -92
+l-288 288l92 92q28 28 68 28t68 -28l152 -152q28 -28 28 -68t-28 -68z" />
+    <glyph glyph-name="share" unicode="&#xf045;" horiz-adv-x="1664" 
+d="M1408 547v-259q0 -119 -84.5 -203.5t-203.5 -84.5h-832q-119 0 -203.5 84.5t-84.5 203.5v832q0 119 84.5 203.5t203.5 84.5h255v0q13 0 22.5 -9.5t9.5 -22.5q0 -27 -26 -32q-77 -26 -133 -60q-10 -4 -16 -4h-112q-66 0 -113 -47t-47 -113v-832q0 -66 47 -113t113 -47h832
+q66 0 113 47t47 113v214q0 19 18 29q28 13 54 37q16 16 35 8q21 -9 21 -29zM1645 1043l-384 -384q-18 -19 -45 -19q-12 0 -25 5q-39 17 -39 59v192h-160q-323 0 -438 -131q-119 -137 -74 -473q3 -23 -20 -34q-8 -2 -12 -2q-16 0 -26 13q-10 14 -21 31t-39.5 68.5t-49.5 99.5
+t-38.5 114t-17.5 122q0 49 3.5 91t14 90t28 88t47 81.5t68.5 74t94.5 61.5t124.5 48.5t159.5 30.5t196.5 11h160v192q0 42 39 59q13 5 25 5q26 0 45 -19l384 -384q19 -19 19 -45t-19 -45z" />
+    <glyph glyph-name="check" unicode="&#xf046;" horiz-adv-x="1664" 
+d="M1408 606v-318q0 -119 -84.5 -203.5t-203.5 -84.5h-832q-119 0 -203.5 84.5t-84.5 203.5v832q0 119 84.5 203.5t203.5 84.5h832q63 0 117 -25q15 -7 18 -23q3 -17 -9 -29l-49 -49q-10 -10 -23 -10q-3 0 -9 2q-23 6 -45 6h-832q-66 0 -113 -47t-47 -113v-832
+q0 -66 47 -113t113 -47h832q66 0 113 47t47 113v254q0 13 9 22l64 64q10 10 23 10q6 0 12 -3q20 -8 20 -29zM1639 1095l-814 -814q-24 -24 -57 -24t-57 24l-430 430q-24 24 -24 57t24 57l110 110q24 24 57 24t57 -24l263 -263l647 647q24 24 57 24t57 -24l110 -110
+q24 -24 24 -57t-24 -57z" />
+    <glyph glyph-name="move" unicode="&#xf047;" horiz-adv-x="1792" 
+d="M1792 640q0 -26 -19 -45l-256 -256q-19 -19 -45 -19t-45 19t-19 45v128h-384v-384h128q26 0 45 -19t19 -45t-19 -45l-256 -256q-19 -19 -45 -19t-45 19l-256 256q-19 19 -19 45t19 45t45 19h128v384h-384v-128q0 -26 -19 -45t-45 -19t-45 19l-256 256q-19 19 -19 45
+t19 45l256 256q19 19 45 19t45 -19t19 -45v-128h384v384h-128q-26 0 -45 19t-19 45t19 45l256 256q19 19 45 19t45 -19l256 -256q19 -19 19 -45t-19 -45t-45 -19h-128v-384h384v128q0 26 19 45t45 19t45 -19l256 -256q19 -19 19 -45z" />
+    <glyph glyph-name="step_backward" unicode="&#xf048;" horiz-adv-x="1024" 
+d="M979 1395q19 19 32 13t13 -32v-1472q0 -26 -13 -32t-32 13l-710 710q-9 9 -13 19v-678q0 -26 -19 -45t-45 -19h-128q-26 0 -45 19t-19 45v1408q0 26 19 45t45 19h128q26 0 45 -19t19 -45v-678q4 10 13 19z" />
+    <glyph glyph-name="fast_backward" unicode="&#xf049;" horiz-adv-x="1792" 
+d="M1747 1395q19 19 32 13t13 -32v-1472q0 -26 -13 -32t-32 13l-710 710q-9 9 -13 19v-710q0 -26 -13 -32t-32 13l-710 710q-9 9 -13 19v-678q0 -26 -19 -45t-45 -19h-128q-26 0 -45 19t-19 45v1408q0 26 19 45t45 19h128q26 0 45 -19t19 -45v-678q4 10 13 19l710 710
+q19 19 32 13t13 -32v-710q4 10 13 19z" />
+    <glyph glyph-name="backward" unicode="&#xf04a;" horiz-adv-x="1664" 
+d="M1619 1395q19 19 32 13t13 -32v-1472q0 -26 -13 -32t-32 13l-710 710q-9 9 -13 19v-710q0 -26 -13 -32t-32 13l-710 710q-19 19 -19 45t19 45l710 710q19 19 32 13t13 -32v-710q4 10 13 19z" />
+    <glyph glyph-name="play" unicode="&#xf04b;" horiz-adv-x="1408" 
+d="M1384 609l-1328 -738q-23 -13 -39.5 -3t-16.5 36v1472q0 26 16.5 36t39.5 -3l1328 -738q23 -13 23 -31t-23 -31z" />
+    <glyph glyph-name="pause" unicode="&#xf04c;" 
+d="M1536 1344v-1408q0 -26 -19 -45t-45 -19h-512q-26 0 -45 19t-19 45v1408q0 26 19 45t45 19h512q26 0 45 -19t19 -45zM640 1344v-1408q0 -26 -19 -45t-45 -19h-512q-26 0 -45 19t-19 45v1408q0 26 19 45t45 19h512q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="stop" unicode="&#xf04d;" 
+d="M1536 1344v-1408q0 -26 -19 -45t-45 -19h-1408q-26 0 -45 19t-19 45v1408q0 26 19 45t45 19h1408q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="forward" unicode="&#xf04e;" horiz-adv-x="1664" 
+d="M45 -115q-19 -19 -32 -13t-13 32v1472q0 26 13 32t32 -13l710 -710q9 -9 13 -19v710q0 26 13 32t32 -13l710 -710q19 -19 19 -45t-19 -45l-710 -710q-19 -19 -32 -13t-13 32v710q-4 -10 -13 -19z" />
+    <glyph glyph-name="fast_forward" unicode="&#xf050;" horiz-adv-x="1792" 
+d="M45 -115q-19 -19 -32 -13t-13 32v1472q0 26 13 32t32 -13l710 -710q9 -9 13 -19v710q0 26 13 32t32 -13l710 -710q9 -9 13 -19v678q0 26 19 45t45 19h128q26 0 45 -19t19 -45v-1408q0 -26 -19 -45t-45 -19h-128q-26 0 -45 19t-19 45v678q-4 -10 -13 -19l-710 -710
+q-19 -19 -32 -13t-13 32v710q-4 -10 -13 -19z" />
+    <glyph glyph-name="step_forward" unicode="&#xf051;" horiz-adv-x="1024" 
+d="M45 -115q-19 -19 -32 -13t-13 32v1472q0 26 13 32t32 -13l710 -710q9 -9 13 -19v678q0 26 19 45t45 19h128q26 0 45 -19t19 -45v-1408q0 -26 -19 -45t-45 -19h-128q-26 0 -45 19t-19 45v678q-4 -10 -13 -19z" />
+    <glyph glyph-name="eject" unicode="&#xf052;" horiz-adv-x="1538" 
+d="M14 557l710 710q19 19 45 19t45 -19l710 -710q19 -19 13 -32t-32 -13h-1472q-26 0 -32 13t13 32zM1473 0h-1408q-26 0 -45 19t-19 45v256q0 26 19 45t45 19h1408q26 0 45 -19t19 -45v-256q0 -26 -19 -45t-45 -19z" />
+    <glyph glyph-name="chevron_left" unicode="&#xf053;" horiz-adv-x="1280" 
+d="M1171 1235l-531 -531l531 -531q19 -19 19 -45t-19 -45l-166 -166q-19 -19 -45 -19t-45 19l-742 742q-19 19 -19 45t19 45l742 742q19 19 45 19t45 -19l166 -166q19 -19 19 -45t-19 -45z" />
+    <glyph glyph-name="chevron_right" unicode="&#xf054;" horiz-adv-x="1280" 
+d="M1107 659l-742 -742q-19 -19 -45 -19t-45 19l-166 166q-19 19 -19 45t19 45l531 531l-531 531q-19 19 -19 45t19 45l166 166q19 19 45 19t45 -19l742 -742q19 -19 19 -45t-19 -45z" />
+    <glyph glyph-name="plus_sign" unicode="&#xf055;" 
+d="M1216 576v128q0 26 -19 45t-45 19h-256v256q0 26 -19 45t-45 19h-128q-26 0 -45 -19t-19 -45v-256h-256q-26 0 -45 -19t-19 -45v-128q0 -26 19 -45t45 -19h256v-256q0 -26 19 -45t45 -19h128q26 0 45 19t19 45v256h256q26 0 45 19t19 45zM1536 640q0 -209 -103 -385.5
+t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="minus_sign" unicode="&#xf056;" 
+d="M1216 576v128q0 26 -19 45t-45 19h-768q-26 0 -45 -19t-19 -45v-128q0 -26 19 -45t45 -19h768q26 0 45 19t19 45zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5
+t103 -385.5z" />
+    <glyph glyph-name="remove_sign" unicode="&#xf057;" 
+d="M1149 414q0 26 -19 45l-181 181l181 181q19 19 19 45q0 27 -19 46l-90 90q-19 19 -46 19q-26 0 -45 -19l-181 -181l-181 181q-19 19 -45 19q-27 0 -46 -19l-90 -90q-19 -19 -19 -46q0 -26 19 -45l181 -181l-181 -181q-19 -19 -19 -45q0 -27 19 -46l90 -90q19 -19 46 -19
+q26 0 45 19l181 181l181 -181q19 -19 45 -19q27 0 46 19l90 90q19 19 19 46zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="ok_sign" unicode="&#xf058;" 
+d="M1284 802q0 28 -18 46l-91 90q-19 19 -45 19t-45 -19l-408 -407l-226 226q-19 19 -45 19t-45 -19l-91 -90q-18 -18 -18 -46q0 -27 18 -45l362 -362q19 -19 45 -19q27 0 46 19l543 543q18 18 18 45zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103
+t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="question_sign" unicode="&#xf059;" 
+d="M896 160v192q0 14 -9 23t-23 9h-192q-14 0 -23 -9t-9 -23v-192q0 -14 9 -23t23 -9h192q14 0 23 9t9 23zM1152 832q0 88 -55.5 163t-138.5 116t-170 41q-243 0 -371 -213q-15 -24 8 -42l132 -100q7 -6 19 -6q16 0 25 12q53 68 86 92q34 24 86 24q48 0 85.5 -26t37.5 -59
+q0 -38 -20 -61t-68 -45q-63 -28 -115.5 -86.5t-52.5 -125.5v-36q0 -14 9 -23t23 -9h192q14 0 23 9t9 23q0 19 21.5 49.5t54.5 49.5q32 18 49 28.5t46 35t44.5 48t28 60.5t12.5 81zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5
+t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="info_sign" unicode="&#xf05a;" 
+d="M1024 160v160q0 14 -9 23t-23 9h-96v512q0 14 -9 23t-23 9h-320q-14 0 -23 -9t-9 -23v-160q0 -14 9 -23t23 -9h96v-320h-96q-14 0 -23 -9t-9 -23v-160q0 -14 9 -23t23 -9h448q14 0 23 9t9 23zM896 1056v160q0 14 -9 23t-23 9h-192q-14 0 -23 -9t-9 -23v-160q0 -14 9 -23
+t23 -9h192q14 0 23 9t9 23zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="screenshot" unicode="&#xf05b;" 
+d="M1197 512h-109q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h109q-32 108 -112.5 188.5t-188.5 112.5v-109q0 -26 -19 -45t-45 -19h-128q-26 0 -45 19t-19 45v109q-108 -32 -188.5 -112.5t-112.5 -188.5h109q26 0 45 -19t19 -45v-128q0 -26 -19 -45t-45 -19h-109
+q32 -108 112.5 -188.5t188.5 -112.5v109q0 26 19 45t45 19h128q26 0 45 -19t19 -45v-109q108 32 188.5 112.5t112.5 188.5zM1536 704v-128q0 -26 -19 -45t-45 -19h-143q-37 -161 -154.5 -278.5t-278.5 -154.5v-143q0 -26 -19 -45t-45 -19h-128q-26 0 -45 19t-19 45v143
+q-161 37 -278.5 154.5t-154.5 278.5h-143q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h143q37 161 154.5 278.5t278.5 154.5v143q0 26 19 45t45 19h128q26 0 45 -19t19 -45v-143q161 -37 278.5 -154.5t154.5 -278.5h143q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="remove_circle" unicode="&#xf05c;" 
+d="M1097 457l-146 -146q-10 -10 -23 -10t-23 10l-137 137l-137 -137q-10 -10 -23 -10t-23 10l-146 146q-10 10 -10 23t10 23l137 137l-137 137q-10 10 -10 23t10 23l146 146q10 10 23 10t23 -10l137 -137l137 137q10 10 23 10t23 -10l146 -146q10 -10 10 -23t-10 -23
+l-137 -137l137 -137q10 -10 10 -23t-10 -23zM1312 640q0 148 -73 273t-198 198t-273 73t-273 -73t-198 -198t-73 -273t73 -273t198 -198t273 -73t273 73t198 198t73 273zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5
+t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="ok_circle" unicode="&#xf05d;" 
+d="M1171 723l-422 -422q-19 -19 -45 -19t-45 19l-294 294q-19 19 -19 45t19 45l102 102q19 19 45 19t45 -19l147 -147l275 275q19 19 45 19t45 -19l102 -102q19 -19 19 -45t-19 -45zM1312 640q0 148 -73 273t-198 198t-273 73t-273 -73t-198 -198t-73 -273t73 -273t198 -198
+t273 -73t273 73t198 198t73 273zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="ban_circle" unicode="&#xf05e;" 
+d="M1312 643q0 161 -87 295l-754 -753q137 -89 297 -89q111 0 211.5 43.5t173.5 116.5t116 174.5t43 212.5zM313 344l755 754q-135 91 -300 91q-148 0 -273 -73t-198 -199t-73 -274q0 -162 89 -299zM1536 643q0 -157 -61 -300t-163.5 -246t-245 -164t-298.5 -61t-298.5 61
+t-245 164t-163.5 246t-61 300t61 299.5t163.5 245.5t245 164t298.5 61t298.5 -61t245 -164t163.5 -245.5t61 -299.5z" />
+    <glyph glyph-name="arrow_left" unicode="&#xf060;" 
+d="M1536 640v-128q0 -53 -32.5 -90.5t-84.5 -37.5h-704l293 -294q38 -36 38 -90t-38 -90l-75 -76q-37 -37 -90 -37q-52 0 -91 37l-651 652q-37 37 -37 90q0 52 37 91l651 650q38 38 91 38q52 0 90 -38l75 -74q38 -38 38 -91t-38 -91l-293 -293h704q52 0 84.5 -37.5
+t32.5 -90.5z" />
+    <glyph glyph-name="arrow_right" unicode="&#xf061;" 
+d="M1472 576q0 -54 -37 -91l-651 -651q-39 -37 -91 -37q-51 0 -90 37l-75 75q-38 38 -38 91t38 91l293 293h-704q-52 0 -84.5 37.5t-32.5 90.5v128q0 53 32.5 90.5t84.5 37.5h704l-293 294q-38 36 -38 90t38 90l75 75q38 38 90 38q53 0 91 -38l651 -651q37 -35 37 -90z" />
+    <glyph glyph-name="arrow_up" unicode="&#xf062;" horiz-adv-x="1664" 
+d="M1611 565q0 -51 -37 -90l-75 -75q-38 -38 -91 -38q-54 0 -90 38l-294 293v-704q0 -52 -37.5 -84.5t-90.5 -32.5h-128q-53 0 -90.5 32.5t-37.5 84.5v704l-294 -293q-36 -38 -90 -38t-90 38l-75 75q-38 38 -38 90q0 53 38 91l651 651q35 37 90 37q54 0 91 -37l651 -651
+q37 -39 37 -91z" />
+    <glyph glyph-name="arrow_down" unicode="&#xf063;" horiz-adv-x="1664" 
+d="M1611 704q0 -53 -37 -90l-651 -652q-39 -37 -91 -37q-53 0 -90 37l-651 652q-38 36 -38 90q0 53 38 91l74 75q39 37 91 37q53 0 90 -37l294 -294v704q0 52 38 90t90 38h128q52 0 90 -38t38 -90v-704l294 294q37 37 90 37q52 0 91 -37l75 -75q37 -39 37 -91z" />
+    <glyph glyph-name="share_alt" unicode="&#xf064;" horiz-adv-x="1792" 
+d="M1792 896q0 -26 -19 -45l-512 -512q-19 -19 -45 -19t-45 19t-19 45v256h-224q-98 0 -175.5 -6t-154 -21.5t-133 -42.5t-105.5 -69.5t-80 -101t-48.5 -138.5t-17.5 -181q0 -55 5 -123q0 -6 2.5 -23.5t2.5 -26.5q0 -15 -8.5 -25t-23.5 -10q-16 0 -28 17q-7 9 -13 22
+t-13.5 30t-10.5 24q-127 285 -127 451q0 199 53 333q162 403 875 403h224v256q0 26 19 45t45 19t45 -19l512 -512q19 -19 19 -45z" />
+    <glyph glyph-name="resize_full" unicode="&#xf065;" 
+d="M755 480q0 -13 -10 -23l-332 -332l144 -144q19 -19 19 -45t-19 -45t-45 -19h-448q-26 0 -45 19t-19 45v448q0 26 19 45t45 19t45 -19l144 -144l332 332q10 10 23 10t23 -10l114 -114q10 -10 10 -23zM1536 1344v-448q0 -26 -19 -45t-45 -19t-45 19l-144 144l-332 -332
+q-10 -10 -23 -10t-23 10l-114 114q-10 10 -10 23t10 23l332 332l-144 144q-19 19 -19 45t19 45t45 19h448q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="resize_small" unicode="&#xf066;" 
+d="M768 576v-448q0 -26 -19 -45t-45 -19t-45 19l-144 144l-332 -332q-10 -10 -23 -10t-23 10l-114 114q-10 10 -10 23t10 23l332 332l-144 144q-19 19 -19 45t19 45t45 19h448q26 0 45 -19t19 -45zM1523 1248q0 -13 -10 -23l-332 -332l144 -144q19 -19 19 -45t-19 -45
+t-45 -19h-448q-26 0 -45 19t-19 45v448q0 26 19 45t45 19t45 -19l144 -144l332 332q10 10 23 10t23 -10l114 -114q10 -10 10 -23z" />
+    <glyph glyph-name="plus" unicode="&#xf067;" horiz-adv-x="1408" 
+d="M1408 800v-192q0 -40 -28 -68t-68 -28h-416v-416q0 -40 -28 -68t-68 -28h-192q-40 0 -68 28t-28 68v416h-416q-40 0 -68 28t-28 68v192q0 40 28 68t68 28h416v416q0 40 28 68t68 28h192q40 0 68 -28t28 -68v-416h416q40 0 68 -28t28 -68z" />
+    <glyph glyph-name="minus" unicode="&#xf068;" horiz-adv-x="1408" 
+d="M1408 800v-192q0 -40 -28 -68t-68 -28h-1216q-40 0 -68 28t-28 68v192q0 40 28 68t68 28h1216q40 0 68 -28t28 -68z" />
+    <glyph glyph-name="asterisk" unicode="&#xf069;" horiz-adv-x="1664" 
+d="M1482 486q46 -26 59.5 -77.5t-12.5 -97.5l-64 -110q-26 -46 -77.5 -59.5t-97.5 12.5l-266 153v-307q0 -52 -38 -90t-90 -38h-128q-52 0 -90 38t-38 90v307l-266 -153q-46 -26 -97.5 -12.5t-77.5 59.5l-64 110q-26 46 -12.5 97.5t59.5 77.5l266 154l-266 154
+q-46 26 -59.5 77.5t12.5 97.5l64 110q26 46 77.5 59.5t97.5 -12.5l266 -153v307q0 52 38 90t90 38h128q52 0 90 -38t38 -90v-307l266 153q46 26 97.5 12.5t77.5 -59.5l64 -110q26 -46 12.5 -97.5t-59.5 -77.5l-266 -154z" />
+    <glyph glyph-name="exclamation_sign" unicode="&#xf06a;" 
+d="M768 1408q209 0 385.5 -103t279.5 -279.5t103 -385.5t-103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103zM896 161v190q0 14 -9 23.5t-22 9.5h-192q-13 0 -23 -10t-10 -23v-190q0 -13 10 -23t23 -10h192
+q13 0 22 9.5t9 23.5zM894 505l18 621q0 12 -10 18q-10 8 -24 8h-220q-14 0 -24 -8q-10 -6 -10 -18l17 -621q0 -10 10 -17.5t24 -7.5h185q14 0 23.5 7.5t10.5 17.5z" />
+    <glyph glyph-name="gift" unicode="&#xf06b;" 
+d="M928 180v56v468v192h-320v-192v-468v-56q0 -25 18 -38.5t46 -13.5h192q28 0 46 13.5t18 38.5zM472 1024h195l-126 161q-26 31 -69 31q-40 0 -68 -28t-28 -68t28 -68t68 -28zM1160 1120q0 40 -28 68t-68 28q-43 0 -69 -31l-125 -161h194q40 0 68 28t28 68zM1536 864v-320
+q0 -14 -9 -23t-23 -9h-96v-416q0 -40 -28 -68t-68 -28h-1088q-40 0 -68 28t-28 68v416h-96q-14 0 -23 9t-9 23v320q0 14 9 23t23 9h440q-93 0 -158.5 65.5t-65.5 158.5t65.5 158.5t158.5 65.5q107 0 168 -77l128 -165l128 165q61 77 168 77q93 0 158.5 -65.5t65.5 -158.5
+t-65.5 -158.5t-158.5 -65.5h440q14 0 23 -9t9 -23z" />
+    <glyph glyph-name="leaf" unicode="&#xf06c;" horiz-adv-x="1792" 
+d="M1280 832q0 26 -19 45t-45 19q-172 0 -318 -49.5t-259.5 -134t-235.5 -219.5q-19 -21 -19 -45q0 -26 19 -45t45 -19q24 0 45 19q27 24 74 71t67 66q137 124 268.5 176t313.5 52q26 0 45 19t19 45zM1792 1030q0 -95 -20 -193q-46 -224 -184.5 -383t-357.5 -268
+q-214 -108 -438 -108q-148 0 -286 47q-15 5 -88 42t-96 37q-16 0 -39.5 -32t-45 -70t-52.5 -70t-60 -32q-43 0 -63.5 17.5t-45.5 59.5q-2 4 -6 11t-5.5 10t-3 9.5t-1.5 13.5q0 35 31 73.5t68 65.5t68 56t31 48q0 4 -14 38t-16 44q-9 51 -9 104q0 115 43.5 220t119 184.5
+t170.5 139t204 95.5q55 18 145 25.5t179.5 9t178.5 6t163.5 24t113.5 56.5l29.5 29.5t29.5 28t27 20t36.5 16t43.5 4.5q39 0 70.5 -46t47.5 -112t24 -124t8 -96z" />
+    <glyph glyph-name="fire" unicode="&#xf06d;" horiz-adv-x="1408" 
+d="M1408 -160v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-1344q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h1344q13 0 22.5 -9.5t9.5 -22.5zM1152 896q0 -78 -24.5 -144t-64 -112.5t-87.5 -88t-96 -77.5t-87.5 -72t-64 -81.5t-24.5 -96.5q0 -96 67 -224l-4 1l1 -1
+q-90 41 -160 83t-138.5 100t-113.5 122.5t-72.5 150.5t-27.5 184q0 78 24.5 144t64 112.5t87.5 88t96 77.5t87.5 72t64 81.5t24.5 96.5q0 94 -66 224l3 -1l-1 1q90 -41 160 -83t138.5 -100t113.5 -122.5t72.5 -150.5t27.5 -184z" />
+    <glyph glyph-name="eye_open" unicode="&#xf06e;" horiz-adv-x="1792" 
+d="M1664 576q-152 236 -381 353q61 -104 61 -225q0 -185 -131.5 -316.5t-316.5 -131.5t-316.5 131.5t-131.5 316.5q0 121 61 225q-229 -117 -381 -353q133 -205 333.5 -326.5t434.5 -121.5t434.5 121.5t333.5 326.5zM944 960q0 20 -14 34t-34 14q-125 0 -214.5 -89.5
+t-89.5 -214.5q0 -20 14 -34t34 -14t34 14t14 34q0 86 61 147t147 61q20 0 34 14t14 34zM1792 576q0 -34 -20 -69q-140 -230 -376.5 -368.5t-499.5 -138.5t-499.5 139t-376.5 368q-20 35 -20 69t20 69q140 229 376.5 368t499.5 139t499.5 -139t376.5 -368q20 -35 20 -69z" />
+    <glyph glyph-name="eye_close" unicode="&#xf070;" horiz-adv-x="1792" 
+d="M555 201l78 141q-87 63 -136 159t-49 203q0 121 61 225q-229 -117 -381 -353q167 -258 427 -375zM944 960q0 20 -14 34t-34 14q-125 0 -214.5 -89.5t-89.5 -214.5q0 -20 14 -34t34 -14t34 14t14 34q0 86 61 147t147 61q20 0 34 14t14 34zM1307 1151q0 -7 -1 -9
+q-106 -189 -316 -567t-315 -566l-49 -89q-10 -16 -28 -16q-12 0 -134 70q-16 10 -16 28q0 12 44 87q-143 65 -263.5 173t-208.5 245q-20 31 -20 69t20 69q153 235 380 371t496 136q89 0 180 -17l54 97q10 16 28 16q5 0 18 -6t31 -15.5t33 -18.5t31.5 -18.5t19.5 -11.5
+q16 -10 16 -27zM1344 704q0 -139 -79 -253.5t-209 -164.5l280 502q8 -45 8 -84zM1792 576q0 -35 -20 -69q-39 -64 -109 -145q-150 -172 -347.5 -267t-419.5 -95l74 132q212 18 392.5 137t301.5 307q-115 179 -282 294l63 112q95 -64 182.5 -153t144.5 -184q20 -34 20 -69z
+" />
+    <glyph glyph-name="warning_sign" unicode="&#xf071;" horiz-adv-x="1792" 
+d="M1024 161v190q0 14 -9.5 23.5t-22.5 9.5h-192q-13 0 -22.5 -9.5t-9.5 -23.5v-190q0 -14 9.5 -23.5t22.5 -9.5h192q13 0 22.5 9.5t9.5 23.5zM1022 535l18 459q0 12 -10 19q-13 11 -24 11h-220q-11 0 -24 -11q-10 -7 -10 -21l17 -457q0 -10 10 -16.5t24 -6.5h185
+q14 0 23.5 6.5t10.5 16.5zM1008 1469l768 -1408q35 -63 -2 -126q-17 -29 -46.5 -46t-63.5 -17h-1536q-34 0 -63.5 17t-46.5 46q-37 63 -2 126l768 1408q17 31 47 49t65 18t65 -18t47 -49z" />
+    <glyph glyph-name="plane" unicode="&#xf072;" horiz-adv-x="1408" 
+d="M1376 1376q44 -52 12 -148t-108 -172l-161 -161l160 -696q5 -19 -12 -33l-128 -96q-7 -6 -19 -6q-4 0 -7 1q-15 3 -21 16l-279 508l-259 -259l53 -194q5 -17 -8 -31l-96 -96q-9 -9 -23 -9h-2q-15 2 -24 13l-189 252l-252 189q-11 7 -13 23q-1 13 9 25l96 97q9 9 23 9
+q6 0 8 -1l194 -53l259 259l-508 279q-14 8 -17 24q-2 16 9 27l128 128q14 13 30 8l665 -159l160 160q76 76 172 108t148 -12z" />
+    <glyph glyph-name="calendar" unicode="&#xf073;" horiz-adv-x="1664" 
+d="M128 -128h288v288h-288v-288zM480 -128h320v288h-320v-288zM128 224h288v320h-288v-320zM480 224h320v320h-320v-320zM128 608h288v288h-288v-288zM864 -128h320v288h-320v-288zM480 608h320v288h-320v-288zM1248 -128h288v288h-288v-288zM864 224h320v320h-320v-320z
+M512 1088v288q0 13 -9.5 22.5t-22.5 9.5h-64q-13 0 -22.5 -9.5t-9.5 -22.5v-288q0 -13 9.5 -22.5t22.5 -9.5h64q13 0 22.5 9.5t9.5 22.5zM1248 224h288v320h-288v-320zM864 608h320v288h-320v-288zM1248 608h288v288h-288v-288zM1280 1088v288q0 13 -9.5 22.5t-22.5 9.5h-64
+q-13 0 -22.5 -9.5t-9.5 -22.5v-288q0 -13 9.5 -22.5t22.5 -9.5h64q13 0 22.5 9.5t9.5 22.5zM1664 1152v-1280q0 -52 -38 -90t-90 -38h-1408q-52 0 -90 38t-38 90v1280q0 52 38 90t90 38h128v96q0 66 47 113t113 47h64q66 0 113 -47t47 -113v-96h384v96q0 66 47 113t113 47
+h64q66 0 113 -47t47 -113v-96h128q52 0 90 -38t38 -90z" />
+    <glyph glyph-name="random" unicode="&#xf074;" horiz-adv-x="1792" 
+d="M666 1055q-60 -92 -137 -273q-22 45 -37 72.5t-40.5 63.5t-51 56.5t-63 35t-81.5 14.5h-224q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h224q250 0 410 -225zM1792 256q0 -14 -9 -23l-320 -320q-9 -9 -23 -9q-13 0 -22.5 9.5t-9.5 22.5v192q-32 0 -85 -0.5t-81 -1t-73 1
+t-71 5t-64 10.5t-63 18.5t-58 28.5t-59 40t-55 53.5t-56 69.5q59 93 136 273q22 -45 37 -72.5t40.5 -63.5t51 -56.5t63 -35t81.5 -14.5h256v192q0 14 9 23t23 9q12 0 24 -10l319 -319q9 -9 9 -23zM1792 1152q0 -14 -9 -23l-320 -320q-9 -9 -23 -9q-13 0 -22.5 9.5t-9.5 22.5
+v192h-256q-48 0 -87 -15t-69 -45t-51 -61.5t-45 -77.5q-32 -62 -78 -171q-29 -66 -49.5 -111t-54 -105t-64 -100t-74 -83t-90 -68.5t-106.5 -42t-128 -16.5h-224q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h224q48 0 87 15t69 45t51 61.5t45 77.5q32 62 78 171q29 66 49.5 111
+t54 105t64 100t74 83t90 68.5t106.5 42t128 16.5h256v192q0 14 9 23t23 9q12 0 24 -10l319 -319q9 -9 9 -23z" />
+    <glyph glyph-name="comment" unicode="&#xf075;" horiz-adv-x="1792" 
+d="M1792 640q0 -174 -120 -321.5t-326 -233t-450 -85.5q-70 0 -145 8q-198 -175 -460 -242q-49 -14 -114 -22q-17 -2 -30.5 9t-17.5 29v1q-3 4 -0.5 12t2 10t4.5 9.5l6 9t7 8.5t8 9q7 8 31 34.5t34.5 38t31 39.5t32.5 51t27 59t26 76q-157 89 -247.5 220t-90.5 281
+q0 130 71 248.5t191 204.5t286 136.5t348 50.5q244 0 450 -85.5t326 -233t120 -321.5z" />
+    <glyph glyph-name="magnet" unicode="&#xf076;" 
+d="M1536 704v-128q0 -201 -98.5 -362t-274 -251.5t-395.5 -90.5t-395.5 90.5t-274 251.5t-98.5 362v128q0 26 19 45t45 19h384q26 0 45 -19t19 -45v-128q0 -52 23.5 -90t53.5 -57t71 -30t64 -13t44 -2t44 2t64 13t71 30t53.5 57t23.5 90v128q0 26 19 45t45 19h384
+q26 0 45 -19t19 -45zM512 1344v-384q0 -26 -19 -45t-45 -19h-384q-26 0 -45 19t-19 45v384q0 26 19 45t45 19h384q26 0 45 -19t19 -45zM1536 1344v-384q0 -26 -19 -45t-45 -19h-384q-26 0 -45 19t-19 45v384q0 26 19 45t45 19h384q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="chevron_up" unicode="&#xf077;" horiz-adv-x="1792" 
+d="M1683 205l-166 -165q-19 -19 -45 -19t-45 19l-531 531l-531 -531q-19 -19 -45 -19t-45 19l-166 165q-19 19 -19 45.5t19 45.5l742 741q19 19 45 19t45 -19l742 -741q19 -19 19 -45.5t-19 -45.5z" />
+    <glyph glyph-name="chevron_down" unicode="&#xf078;" horiz-adv-x="1792" 
+d="M1683 728l-742 -741q-19 -19 -45 -19t-45 19l-742 741q-19 19 -19 45.5t19 45.5l166 165q19 19 45 19t45 -19l531 -531l531 531q19 19 45 19t45 -19l166 -165q19 -19 19 -45.5t-19 -45.5z" />
+    <glyph glyph-name="retweet" unicode="&#xf079;" horiz-adv-x="1920" 
+d="M1280 32q0 -13 -9.5 -22.5t-22.5 -9.5h-960q-8 0 -13.5 2t-9 7t-5.5 8t-3 11.5t-1 11.5v13v11v160v416h-192q-26 0 -45 19t-19 45q0 24 15 41l320 384q19 22 49 22t49 -22l320 -384q15 -17 15 -41q0 -26 -19 -45t-45 -19h-192v-384h576q16 0 25 -11l160 -192q7 -10 7 -21
+zM1920 448q0 -24 -15 -41l-320 -384q-20 -23 -49 -23t-49 23l-320 384q-15 17 -15 41q0 26 19 45t45 19h192v384h-576q-16 0 -25 12l-160 192q-7 9 -7 20q0 13 9.5 22.5t22.5 9.5h960q8 0 13.5 -2t9 -7t5.5 -8t3 -11.5t1 -11.5v-13v-11v-160v-416h192q26 0 45 -19t19 -45z
+" />
+    <glyph glyph-name="shopping_cart" unicode="&#xf07a;" horiz-adv-x="1664" 
+d="M640 0q0 -52 -38 -90t-90 -38t-90 38t-38 90t38 90t90 38t90 -38t38 -90zM1536 0q0 -52 -38 -90t-90 -38t-90 38t-38 90t38 90t90 38t90 -38t38 -90zM1664 1088v-512q0 -24 -16.5 -42.5t-40.5 -21.5l-1044 -122q13 -60 13 -70q0 -16 -24 -64h920q26 0 45 -19t19 -45
+t-19 -45t-45 -19h-1024q-26 0 -45 19t-19 45q0 11 8 31.5t16 36t21.5 40t15.5 29.5l-177 823h-204q-26 0 -45 19t-19 45t19 45t45 19h256q16 0 28.5 -6.5t19.5 -15.5t13 -24.5t8 -26t5.5 -29.5t4.5 -26h1201q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="folder_close" unicode="&#xf07b;" horiz-adv-x="1664" 
+d="M1664 928v-704q0 -92 -66 -158t-158 -66h-1216q-92 0 -158 66t-66 158v960q0 92 66 158t158 66h320q92 0 158 -66t66 -158v-32h672q92 0 158 -66t66 -158z" />
+    <glyph glyph-name="folder_open" unicode="&#xf07c;" horiz-adv-x="1920" 
+d="M1879 584q0 -31 -31 -66l-336 -396q-43 -51 -120.5 -86.5t-143.5 -35.5h-1088q-34 0 -60.5 13t-26.5 43q0 31 31 66l336 396q43 51 120.5 86.5t143.5 35.5h1088q34 0 60.5 -13t26.5 -43zM1536 928v-160h-832q-94 0 -197 -47.5t-164 -119.5l-337 -396l-5 -6q0 4 -0.5 12.5
+t-0.5 12.5v960q0 92 66 158t158 66h320q92 0 158 -66t66 -158v-32h544q92 0 158 -66t66 -158z" />
+    <glyph glyph-name="resize_vertical" unicode="&#xf07d;" horiz-adv-x="768" 
+d="M704 1216q0 -26 -19 -45t-45 -19h-128v-1024h128q26 0 45 -19t19 -45t-19 -45l-256 -256q-19 -19 -45 -19t-45 19l-256 256q-19 19 -19 45t19 45t45 19h128v1024h-128q-26 0 -45 19t-19 45t19 45l256 256q19 19 45 19t45 -19l256 -256q19 -19 19 -45z" />
+    <glyph glyph-name="resize_horizontal" unicode="&#xf07e;" horiz-adv-x="1792" 
+d="M1792 640q0 -26 -19 -45l-256 -256q-19 -19 -45 -19t-45 19t-19 45v128h-1024v-128q0 -26 -19 -45t-45 -19t-45 19l-256 256q-19 19 -19 45t19 45l256 256q19 19 45 19t45 -19t19 -45v-128h1024v128q0 26 19 45t45 19t45 -19l256 -256q19 -19 19 -45z" />
+    <glyph glyph-name="bar_chart" unicode="&#xf080;" horiz-adv-x="2048" 
+d="M640 640v-512h-256v512h256zM1024 1152v-1024h-256v1024h256zM2048 0v-128h-2048v1536h128v-1408h1920zM1408 896v-768h-256v768h256zM1792 1280v-1152h-256v1152h256z" />
+    <glyph glyph-name="twitter_sign" unicode="&#xf081;" 
+d="M1280 926q-56 -25 -121 -34q68 40 93 117q-65 -38 -134 -51q-61 66 -153 66q-87 0 -148.5 -61.5t-61.5 -148.5q0 -29 5 -48q-129 7 -242 65t-192 155q-29 -50 -29 -106q0 -114 91 -175q-47 1 -100 26v-2q0 -75 50 -133.5t123 -72.5q-29 -8 -51 -8q-13 0 -39 4
+q21 -63 74.5 -104t121.5 -42q-116 -90 -261 -90q-26 0 -50 3q148 -94 322 -94q112 0 210 35.5t168 95t120.5 137t75 162t24.5 168.5q0 18 -1 27q63 45 105 109zM1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5
+t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="facebook_sign" unicode="&#xf082;" 
+d="M1248 1408q119 0 203.5 -84.5t84.5 -203.5v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-188v595h199l30 232h-229v148q0 56 23.5 84t91.5 28l122 1v207q-63 9 -178 9q-136 0 -217.5 -80t-81.5 -226v-171h-200v-232h200v-595h-532q-119 0 -203.5 84.5t-84.5 203.5v960
+q0 119 84.5 203.5t203.5 84.5h960z" />
+    <glyph glyph-name="camera_retro" unicode="&#xf083;" horiz-adv-x="1792" 
+d="M928 704q0 14 -9 23t-23 9q-66 0 -113 -47t-47 -113q0 -14 9 -23t23 -9t23 9t9 23q0 40 28 68t68 28q14 0 23 9t9 23zM1152 574q0 -106 -75 -181t-181 -75t-181 75t-75 181t75 181t181 75t181 -75t75 -181zM128 0h1536v128h-1536v-128zM1280 574q0 159 -112.5 271.5
+t-271.5 112.5t-271.5 -112.5t-112.5 -271.5t112.5 -271.5t271.5 -112.5t271.5 112.5t112.5 271.5zM256 1216h384v128h-384v-128zM128 1024h1536v118v138h-828l-64 -128h-644v-128zM1792 1280v-1280q0 -53 -37.5 -90.5t-90.5 -37.5h-1536q-53 0 -90.5 37.5t-37.5 90.5v1280
+q0 53 37.5 90.5t90.5 37.5h1536q53 0 90.5 -37.5t37.5 -90.5z" />
+    <glyph glyph-name="key" unicode="&#xf084;" horiz-adv-x="1792" 
+d="M832 1024q0 80 -56 136t-136 56t-136 -56t-56 -136q0 -42 19 -83q-41 19 -83 19q-80 0 -136 -56t-56 -136t56 -136t136 -56t136 56t56 136q0 42 -19 83q41 -19 83 -19q80 0 136 56t56 136zM1683 320q0 -17 -49 -66t-66 -49q-9 0 -28.5 16t-36.5 33t-38.5 40t-24.5 26
+l-96 -96l220 -220q28 -28 28 -68q0 -42 -39 -81t-81 -39q-40 0 -68 28l-671 671q-176 -131 -365 -131q-163 0 -265.5 102.5t-102.5 265.5q0 160 95 313t248 248t313 95q163 0 265.5 -102.5t102.5 -265.5q0 -189 -131 -365l355 -355l96 96q-3 3 -26 24.5t-40 38.5t-33 36.5
+t-16 28.5q0 17 49 66t66 49q13 0 23 -10q6 -6 46 -44.5t82 -79.5t86.5 -86t73 -78t28.5 -41z" />
+    <glyph glyph-name="cogs" unicode="&#xf085;" horiz-adv-x="1920" 
+d="M896 640q0 106 -75 181t-181 75t-181 -75t-75 -181t75 -181t181 -75t181 75t75 181zM1664 128q0 52 -38 90t-90 38t-90 -38t-38 -90q0 -53 37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM1664 1152q0 52 -38 90t-90 38t-90 -38t-38 -90q0 -53 37.5 -90.5t90.5 -37.5
+t90.5 37.5t37.5 90.5zM1280 731v-185q0 -10 -7 -19.5t-16 -10.5l-155 -24q-11 -35 -32 -76q34 -48 90 -115q7 -11 7 -20q0 -12 -7 -19q-23 -30 -82.5 -89.5t-78.5 -59.5q-11 0 -21 7l-115 90q-37 -19 -77 -31q-11 -108 -23 -155q-7 -24 -30 -24h-186q-11 0 -20 7.5t-10 17.5
+l-23 153q-34 10 -75 31l-118 -89q-7 -7 -20 -7q-11 0 -21 8q-144 133 -144 160q0 9 7 19q10 14 41 53t47 61q-23 44 -35 82l-152 24q-10 1 -17 9.5t-7 19.5v185q0 10 7 19.5t16 10.5l155 24q11 35 32 76q-34 48 -90 115q-7 11 -7 20q0 12 7 20q22 30 82 89t79 59q11 0 21 -7
+l115 -90q34 18 77 32q11 108 23 154q7 24 30 24h186q11 0 20 -7.5t10 -17.5l23 -153q34 -10 75 -31l118 89q8 7 20 7q11 0 21 -8q144 -133 144 -160q0 -8 -7 -19q-12 -16 -42 -54t-45 -60q23 -48 34 -82l152 -23q10 -2 17 -10.5t7 -19.5zM1920 198v-140q0 -16 -149 -31
+q-12 -27 -30 -52q51 -113 51 -138q0 -4 -4 -7q-122 -71 -124 -71q-8 0 -46 47t-52 68q-20 -2 -30 -2t-30 2q-14 -21 -52 -68t-46 -47q-2 0 -124 71q-4 3 -4 7q0 25 51 138q-18 25 -30 52q-149 15 -149 31v140q0 16 149 31q13 29 30 52q-51 113 -51 138q0 4 4 7q4 2 35 20
+t59 34t30 16q8 0 46 -46.5t52 -67.5q20 2 30 2t30 -2q51 71 92 112l6 2q4 0 124 -70q4 -3 4 -7q0 -25 -51 -138q17 -23 30 -52q149 -15 149 -31zM1920 1222v-140q0 -16 -149 -31q-12 -27 -30 -52q51 -113 51 -138q0 -4 -4 -7q-122 -71 -124 -71q-8 0 -46 47t-52 68
+q-20 -2 -30 -2t-30 2q-14 -21 -52 -68t-46 -47q-2 0 -124 71q-4 3 -4 7q0 25 51 138q-18 25 -30 52q-149 15 -149 31v140q0 16 149 31q13 29 30 52q-51 113 -51 138q0 4 4 7q4 2 35 20t59 34t30 16q8 0 46 -46.5t52 -67.5q20 2 30 2t30 -2q51 71 92 112l6 2q4 0 124 -70
+q4 -3 4 -7q0 -25 -51 -138q17 -23 30 -52q149 -15 149 -31z" />
+    <glyph glyph-name="comments" unicode="&#xf086;" horiz-adv-x="1792" 
+d="M1408 768q0 -139 -94 -257t-256.5 -186.5t-353.5 -68.5q-86 0 -176 16q-124 -88 -278 -128q-36 -9 -86 -16h-3q-11 0 -20.5 8t-11.5 21q-1 3 -1 6.5t0.5 6.5t2 6l2.5 5t3.5 5.5t4 5t4.5 5t4 4.5q5 6 23 25t26 29.5t22.5 29t25 38.5t20.5 44q-124 72 -195 177t-71 224
+q0 139 94 257t256.5 186.5t353.5 68.5t353.5 -68.5t256.5 -186.5t94 -257zM1792 512q0 -120 -71 -224.5t-195 -176.5q10 -24 20.5 -44t25 -38.5t22.5 -29t26 -29.5t23 -25q1 -1 4 -4.5t4.5 -5t4 -5t3.5 -5.5l2.5 -5t2 -6t0.5 -6.5t-1 -6.5q-3 -14 -13 -22t-22 -7
+q-50 7 -86 16q-154 40 -278 128q-90 -16 -176 -16q-271 0 -472 132q58 -4 88 -4q161 0 309 45t264 129q125 92 192 212t67 254q0 77 -23 152q129 -71 204 -178t75 -230z" />
+    <glyph glyph-name="thumbs_up_alt" unicode="&#xf087;" 
+d="M256 192q0 26 -19 45t-45 19t-45 -19t-19 -45t19 -45t45 -19t45 19t19 45zM1408 768q0 51 -39 89.5t-89 38.5h-352q0 58 48 159.5t48 160.5q0 98 -32 145t-128 47q-26 -26 -38 -85t-30.5 -125.5t-59.5 -109.5q-22 -23 -77 -91q-4 -5 -23 -30t-31.5 -41t-34.5 -42.5
+t-40 -44t-38.5 -35.5t-40 -27t-35.5 -9h-32v-640h32q13 0 31.5 -3t33 -6.5t38 -11t35 -11.5t35.5 -12.5t29 -10.5q211 -73 342 -73h121q192 0 192 167q0 26 -5 56q30 16 47.5 52.5t17.5 73.5t-18 69q53 50 53 119q0 25 -10 55.5t-25 47.5q32 1 53.5 47t21.5 81zM1536 769
+q0 -89 -49 -163q9 -33 9 -69q0 -77 -38 -144q3 -21 3 -43q0 -101 -60 -178q1 -139 -85 -219.5t-227 -80.5h-36h-93q-96 0 -189.5 22.5t-216.5 65.5q-116 40 -138 40h-288q-53 0 -90.5 37.5t-37.5 90.5v640q0 53 37.5 90.5t90.5 37.5h274q36 24 137 155q58 75 107 128
+q24 25 35.5 85.5t30.5 126.5t62 108q39 37 90 37q84 0 151 -32.5t102 -101.5t35 -186q0 -93 -48 -192h176q104 0 180 -76t76 -179z" />
+    <glyph glyph-name="thumbs_down_alt" unicode="&#xf088;" 
+d="M256 1088q0 26 -19 45t-45 19t-45 -19t-19 -45t19 -45t45 -19t45 19t19 45zM1408 512q0 35 -21.5 81t-53.5 47q15 17 25 47.5t10 55.5q0 69 -53 119q18 31 18 69q0 37 -17.5 73.5t-47.5 52.5q5 30 5 56q0 85 -49 126t-136 41h-128q-131 0 -342 -73q-5 -2 -29 -10.5
+t-35.5 -12.5t-35 -11.5t-38 -11t-33 -6.5t-31.5 -3h-32v-640h32q16 0 35.5 -9t40 -27t38.5 -35.5t40 -44t34.5 -42.5t31.5 -41t23 -30q55 -68 77 -91q41 -43 59.5 -109.5t30.5 -125.5t38 -85q96 0 128 47t32 145q0 59 -48 160.5t-48 159.5h352q50 0 89 38.5t39 89.5z
+M1536 511q0 -103 -76 -179t-180 -76h-176q48 -99 48 -192q0 -118 -35 -186q-35 -69 -102 -101.5t-151 -32.5q-51 0 -90 37q-34 33 -54 82t-25.5 90.5t-17.5 84.5t-31 64q-48 50 -107 127q-101 131 -137 155h-274q-53 0 -90.5 37.5t-37.5 90.5v640q0 53 37.5 90.5t90.5 37.5
+h288q22 0 138 40q128 44 223 66t200 22h112q140 0 226.5 -79t85.5 -216v-5q60 -77 60 -178q0 -22 -3 -43q38 -67 38 -144q0 -36 -9 -69q49 -73 49 -163z" />
+    <glyph glyph-name="star_half" unicode="&#xf089;" horiz-adv-x="896" 
+d="M832 1504v-1339l-449 -236q-22 -12 -40 -12q-21 0 -31.5 14.5t-10.5 35.5q0 6 2 20l86 500l-364 354q-25 27 -25 48q0 37 56 46l502 73l225 455q19 41 49 41z" />
+    <glyph glyph-name="heart_empty" unicode="&#xf08a;" horiz-adv-x="1792" 
+d="M1664 940q0 81 -21.5 143t-55 98.5t-81.5 59.5t-94 31t-98 8t-112 -25.5t-110.5 -64t-86.5 -72t-60 -61.5q-18 -22 -49 -22t-49 22q-24 28 -60 61.5t-86.5 72t-110.5 64t-112 25.5t-98 -8t-94 -31t-81.5 -59.5t-55 -98.5t-21.5 -143q0 -168 187 -355l581 -560l580 559
+q188 188 188 356zM1792 940q0 -221 -229 -450l-623 -600q-18 -18 -44 -18t-44 18l-624 602q-10 8 -27.5 26t-55.5 65.5t-68 97.5t-53.5 121t-23.5 138q0 220 127 344t351 124q62 0 126.5 -21.5t120 -58t95.5 -68.5t76 -68q36 36 76 68t95.5 68.5t120 58t126.5 21.5
+q224 0 351 -124t127 -344z" />
+    <glyph glyph-name="signout" unicode="&#xf08b;" horiz-adv-x="1664" 
+d="M640 96q0 -4 1 -20t0.5 -26.5t-3 -23.5t-10 -19.5t-20.5 -6.5h-320q-119 0 -203.5 84.5t-84.5 203.5v704q0 119 84.5 203.5t203.5 84.5h320q13 0 22.5 -9.5t9.5 -22.5q0 -4 1 -20t0.5 -26.5t-3 -23.5t-10 -19.5t-20.5 -6.5h-320q-66 0 -113 -47t-47 -113v-704
+q0 -66 47 -113t113 -47h288h11h13t11.5 -1t11.5 -3t8 -5.5t7 -9t2 -13.5zM1568 640q0 -26 -19 -45l-544 -544q-19 -19 -45 -19t-45 19t-19 45v288h-448q-26 0 -45 19t-19 45v384q0 26 19 45t45 19h448v288q0 26 19 45t45 19t45 -19l544 -544q19 -19 19 -45z" />
+    <glyph glyph-name="linkedin_sign" unicode="&#xf08c;" 
+d="M237 122h231v694h-231v-694zM483 1030q-1 52 -36 86t-93 34t-94.5 -34t-36.5 -86q0 -51 35.5 -85.5t92.5 -34.5h1q59 0 95 34.5t36 85.5zM1068 122h231v398q0 154 -73 233t-193 79q-136 0 -209 -117h2v101h-231q3 -66 0 -694h231v388q0 38 7 56q15 35 45 59.5t74 24.5
+q116 0 116 -157v-371zM1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="pushpin" unicode="&#xf08d;" horiz-adv-x="1152" 
+d="M480 672v448q0 14 -9 23t-23 9t-23 -9t-9 -23v-448q0 -14 9 -23t23 -9t23 9t9 23zM1152 320q0 -26 -19 -45t-45 -19h-429l-51 -483q-2 -12 -10.5 -20.5t-20.5 -8.5h-1q-27 0 -32 27l-76 485h-404q-26 0 -45 19t-19 45q0 123 78.5 221.5t177.5 98.5v512q-52 0 -90 38
+t-38 90t38 90t90 38h640q52 0 90 -38t38 -90t-38 -90t-90 -38v-512q99 0 177.5 -98.5t78.5 -221.5z" />
+    <glyph glyph-name="external_link" unicode="&#xf08e;" horiz-adv-x="1792" 
+d="M1408 608v-320q0 -119 -84.5 -203.5t-203.5 -84.5h-832q-119 0 -203.5 84.5t-84.5 203.5v832q0 119 84.5 203.5t203.5 84.5h704q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-704q-66 0 -113 -47t-47 -113v-832q0 -66 47 -113t113 -47h832q66 0 113 47t47 113v320
+q0 14 9 23t23 9h64q14 0 23 -9t9 -23zM1792 1472v-512q0 -26 -19 -45t-45 -19t-45 19l-176 176l-652 -652q-10 -10 -23 -10t-23 10l-114 114q-10 10 -10 23t10 23l652 652l-176 176q-19 19 -19 45t19 45t45 19h512q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="signin" unicode="&#xf090;" 
+d="M1184 640q0 -26 -19 -45l-544 -544q-19 -19 -45 -19t-45 19t-19 45v288h-448q-26 0 -45 19t-19 45v384q0 26 19 45t45 19h448v288q0 26 19 45t45 19t45 -19l544 -544q19 -19 19 -45zM1536 992v-704q0 -119 -84.5 -203.5t-203.5 -84.5h-320q-13 0 -22.5 9.5t-9.5 22.5
+q0 4 -1 20t-0.5 26.5t3 23.5t10 19.5t20.5 6.5h320q66 0 113 47t47 113v704q0 66 -47 113t-113 47h-288h-11h-13t-11.5 1t-11.5 3t-8 5.5t-7 9t-2 13.5q0 4 -1 20t-0.5 26.5t3 23.5t10 19.5t20.5 6.5h320q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="trophy" unicode="&#xf091;" horiz-adv-x="1664" 
+d="M458 653q-74 162 -74 371h-256v-96q0 -78 94.5 -162t235.5 -113zM1536 928v96h-256q0 -209 -74 -371q141 29 235.5 113t94.5 162zM1664 1056v-128q0 -71 -41.5 -143t-112 -130t-173 -97.5t-215.5 -44.5q-42 -54 -95 -95q-38 -34 -52.5 -72.5t-14.5 -89.5q0 -54 30.5 -91
+t97.5 -37q75 0 133.5 -45.5t58.5 -114.5v-64q0 -14 -9 -23t-23 -9h-832q-14 0 -23 9t-9 23v64q0 69 58.5 114.5t133.5 45.5q67 0 97.5 37t30.5 91q0 51 -14.5 89.5t-52.5 72.5q-53 41 -95 95q-113 5 -215.5 44.5t-173 97.5t-112 130t-41.5 143v128q0 40 28 68t68 28h288v96
+q0 66 47 113t113 47h576q66 0 113 -47t47 -113v-96h288q40 0 68 -28t28 -68z" />
+    <glyph glyph-name="github_sign" unicode="&#xf092;" 
+d="M519 336q4 6 -3 13q-9 7 -14 2q-4 -6 3 -13q9 -7 14 -2zM491 377q-5 7 -12 4q-6 -4 0 -12q7 -8 12 -5q6 4 0 13zM450 417q2 4 -5 8q-7 2 -8 -2q-3 -5 4 -8q8 -2 9 2zM471 394q2 1 1.5 4.5t-3.5 5.5q-6 7 -10 3t1 -11q6 -6 11 -2zM557 319q2 7 -9 11q-9 3 -13 -4
+q-2 -7 9 -11q9 -3 13 4zM599 316q0 8 -12 8q-10 0 -10 -8t11 -8t11 8zM638 323q-2 7 -13 5t-9 -9q2 -8 12 -6t10 10zM1280 640q0 212 -150 362t-362 150t-362 -150t-150 -362q0 -167 98 -300.5t252 -185.5q18 -3 26.5 5t8.5 20q0 52 -1 95q-6 -1 -15.5 -2.5t-35.5 -2t-48 4
+t-43.5 20t-29.5 41.5q-23 59 -57 74q-2 1 -4.5 3.5l-8 8t-7 9.5t4 7.5t19.5 3.5q6 0 15 -2t30 -15.5t33 -35.5q16 -28 37.5 -42t43.5 -14t38 3.5t30 9.5q7 47 33 69q-49 6 -86 18.5t-73 39t-55.5 76t-19.5 119.5q0 79 53 137q-24 62 5 136q19 6 54.5 -7.5t60.5 -29.5l26 -16
+q58 17 128 17t128 -17q11 7 28.5 18t55.5 26t57 9q29 -74 5 -136q53 -58 53 -137q0 -57 -14 -100.5t-35.5 -70t-53.5 -44.5t-62.5 -26t-68.5 -12q35 -31 35 -95q0 -40 -0.5 -89t-0.5 -51q0 -12 8.5 -20t26.5 -5q154 52 252 185.5t98 300.5zM1536 1120v-960
+q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="upload_alt" unicode="&#xf093;" horiz-adv-x="1664" 
+d="M1280 64q0 26 -19 45t-45 19t-45 -19t-19 -45t19 -45t45 -19t45 19t19 45zM1536 64q0 26 -19 45t-45 19t-45 -19t-19 -45t19 -45t45 -19t45 19t19 45zM1664 288v-320q0 -40 -28 -68t-68 -28h-1472q-40 0 -68 28t-28 68v320q0 40 28 68t68 28h427q21 -56 70.5 -92
+t110.5 -36h256q61 0 110.5 36t70.5 92h427q40 0 68 -28t28 -68zM1339 936q-17 -40 -59 -40h-256v-448q0 -26 -19 -45t-45 -19h-256q-26 0 -45 19t-19 45v448h-256q-42 0 -59 40q-17 39 14 69l448 448q18 19 45 19t45 -19l448 -448q31 -30 14 -69z" />
+    <glyph glyph-name="lemon" unicode="&#xf094;" 
+d="M1407 710q0 44 -7 113.5t-18 96.5q-12 30 -17 44t-9 36.5t-4 48.5q0 23 5 68.5t5 67.5q0 37 -10 55q-4 1 -13 1q-19 0 -58 -4.5t-59 -4.5q-60 0 -176 24t-175 24q-43 0 -94.5 -11.5t-85 -23.5t-89.5 -34q-137 -54 -202 -103q-96 -73 -159.5 -189.5t-88 -236t-24.5 -248.5
+q0 -40 12.5 -120t12.5 -121q0 -23 -11 -66.5t-11 -65.5t12 -36.5t34 -14.5q24 0 72.5 11t73.5 11q57 0 169.5 -15.5t169.5 -15.5q181 0 284 36q129 45 235.5 152.5t166 245.5t59.5 275zM1535 712q0 -165 -70 -327.5t-196 -288t-281 -180.5q-124 -44 -326 -44
+q-57 0 -170 14.5t-169 14.5q-24 0 -72.5 -14.5t-73.5 -14.5q-73 0 -123.5 55.5t-50.5 128.5q0 24 11 68t11 67q0 40 -12.5 120.5t-12.5 121.5q0 111 18 217.5t54.5 209.5t100.5 194t150 156q78 59 232 120q194 78 316 78q60 0 175.5 -24t173.5 -24q19 0 57 5t58 5
+q81 0 118 -50.5t37 -134.5q0 -23 -5 -68t-5 -68q0 -13 2 -25t3.5 -16.5t7.5 -20.5t8 -20q16 -40 25 -118.5t9 -136.5z" />
+    <glyph glyph-name="phone" unicode="&#xf095;" horiz-adv-x="1408" 
+d="M1408 296q0 -27 -10 -70.5t-21 -68.5q-21 -50 -122 -106q-94 -51 -186 -51q-27 0 -53 3.5t-57.5 12.5t-47 14.5t-55.5 20.5t-49 18q-98 35 -175 83q-127 79 -264 216t-216 264q-48 77 -83 175q-3 9 -18 49t-20.5 55.5t-14.5 47t-12.5 57.5t-3.5 53q0 92 51 186
+q56 101 106 122q25 11 68.5 21t70.5 10q14 0 21 -3q18 -6 53 -76q11 -19 30 -54t35 -63.5t31 -53.5q3 -4 17.5 -25t21.5 -35.5t7 -28.5q0 -20 -28.5 -50t-62 -55t-62 -53t-28.5 -46q0 -9 5 -22.5t8.5 -20.5t14 -24t11.5 -19q76 -137 174 -235t235 -174q2 -1 19 -11.5t24 -14
+t20.5 -8.5t22.5 -5q18 0 46 28.5t53 62t55 62t50 28.5q14 0 28.5 -7t35.5 -21.5t25 -17.5q25 -15 53.5 -31t63.5 -35t54 -30q70 -35 76 -53q3 -7 3 -21z" />
+    <glyph glyph-name="check_empty" unicode="&#xf096;" horiz-adv-x="1408" 
+d="M1120 1280h-832q-66 0 -113 -47t-47 -113v-832q0 -66 47 -113t113 -47h832q66 0 113 47t47 113v832q0 66 -47 113t-113 47zM1408 1120v-832q0 -119 -84.5 -203.5t-203.5 -84.5h-832q-119 0 -203.5 84.5t-84.5 203.5v832q0 119 84.5 203.5t203.5 84.5h832
+q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="bookmark_empty" unicode="&#xf097;" horiz-adv-x="1280" 
+d="M1152 1280h-1024v-1242l423 406l89 85l89 -85l423 -406v1242zM1164 1408q23 0 44 -9q33 -13 52.5 -41t19.5 -62v-1289q0 -34 -19.5 -62t-52.5 -41q-19 -8 -44 -8q-48 0 -83 32l-441 424l-441 -424q-36 -33 -83 -33q-23 0 -44 9q-33 13 -52.5 41t-19.5 62v1289
+q0 34 19.5 62t52.5 41q21 9 44 9h1048z" />
+    <glyph glyph-name="phone_sign" unicode="&#xf098;" 
+d="M1280 343q0 11 -2 16t-18 16.5t-40.5 25t-47.5 26.5t-45.5 25t-28.5 15q-5 3 -19 13t-25 15t-21 5q-15 0 -36.5 -20.5t-39.5 -45t-38.5 -45t-33.5 -20.5q-7 0 -16.5 3.5t-15.5 6.5t-17 9.5t-14 8.5q-99 55 -170 126.5t-127 170.5q-2 3 -8.5 14t-9.5 17t-6.5 15.5
+t-3.5 16.5q0 13 20.5 33.5t45 38.5t45 39.5t20.5 36.5q0 10 -5 21t-15 25t-13 19q-3 6 -15 28.5t-25 45.5t-26.5 47.5t-25 40.5t-16.5 18t-16 2q-48 0 -101 -22q-46 -21 -80 -94.5t-34 -130.5q0 -16 2.5 -34t5 -30.5t9 -33t10 -29.5t12.5 -33t11 -30q60 -164 216.5 -320.5
+t320.5 -216.5q6 -2 30 -11t33 -12.5t29.5 -10t33 -9t30.5 -5t34 -2.5q57 0 130.5 34t94.5 80q22 53 22 101zM1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z
+" />
+    <glyph glyph-name="twitter" unicode="&#xf099;" horiz-adv-x="1664" 
+d="M1620 1128q-67 -98 -162 -167q1 -14 1 -42q0 -130 -38 -259.5t-115.5 -248.5t-184.5 -210.5t-258 -146t-323 -54.5q-271 0 -496 145q35 -4 78 -4q225 0 401 138q-105 2 -188 64.5t-114 159.5q33 -5 61 -5q43 0 85 11q-112 23 -185.5 111.5t-73.5 205.5v4q68 -38 146 -41
+q-66 44 -105 115t-39 154q0 88 44 163q121 -149 294.5 -238.5t371.5 -99.5q-8 38 -8 74q0 134 94.5 228.5t228.5 94.5q140 0 236 -102q109 21 205 78q-37 -115 -142 -178q93 10 186 50z" />
+    <glyph glyph-name="facebook" unicode="&#xf09a;" horiz-adv-x="1024" 
+d="M959 1524v-264h-157q-86 0 -116 -36t-30 -108v-189h293l-39 -296h-254v-759h-306v759h-255v296h255v218q0 186 104 288.5t277 102.5q147 0 228 -12z" />
+    <glyph glyph-name="github" unicode="&#xf09b;" 
+d="M768 1408q209 0 385.5 -103t279.5 -279.5t103 -385.5q0 -251 -146.5 -451.5t-378.5 -277.5q-27 -5 -40 7t-13 30q0 3 0.5 76.5t0.5 134.5q0 97 -52 142q57 6 102.5 18t94 39t81 66.5t53 105t20.5 150.5q0 119 -79 206q37 91 -8 204q-28 9 -81 -11t-92 -44l-38 -24
+q-93 26 -192 26t-192 -26q-16 11 -42.5 27t-83.5 38.5t-85 13.5q-45 -113 -8 -204q-79 -87 -79 -206q0 -85 20.5 -150t52.5 -105t80.5 -67t94 -39t102.5 -18q-39 -36 -49 -103q-21 -10 -45 -15t-57 -5t-65.5 21.5t-55.5 62.5q-19 32 -48.5 52t-49.5 24l-20 3q-21 0 -29 -4.5
+t-5 -11.5t9 -14t13 -12l7 -5q22 -10 43.5 -38t31.5 -51l10 -23q13 -38 44 -61.5t67 -30t69.5 -7t55.5 3.5l23 4q0 -38 0.5 -88.5t0.5 -54.5q0 -18 -13 -30t-40 -7q-232 77 -378.5 277.5t-146.5 451.5q0 209 103 385.5t279.5 279.5t385.5 103zM291 305q3 7 -7 12
+q-10 3 -13 -2q-3 -7 7 -12q9 -6 13 2zM322 271q7 5 -2 16q-10 9 -16 3q-7 -5 2 -16q10 -10 16 -3zM352 226q9 7 0 19q-8 13 -17 6q-9 -5 0 -18t17 -7zM394 184q8 8 -4 19q-12 12 -20 3q-9 -8 4 -19q12 -12 20 -3zM451 159q3 11 -13 16q-15 4 -19 -7t13 -15q15 -6 19 6z
+M514 154q0 13 -17 11q-16 0 -16 -11q0 -13 17 -11q16 0 16 11zM572 164q-2 11 -18 9q-16 -3 -14 -15t18 -8t14 14z" />
+    <glyph glyph-name="unlock" unicode="&#xf09c;" horiz-adv-x="1664" 
+d="M1664 960v-256q0 -26 -19 -45t-45 -19h-64q-26 0 -45 19t-19 45v256q0 106 -75 181t-181 75t-181 -75t-75 -181v-192h96q40 0 68 -28t28 -68v-576q0 -40 -28 -68t-68 -28h-960q-40 0 -68 28t-28 68v576q0 40 28 68t68 28h672v192q0 185 131.5 316.5t316.5 131.5
+t316.5 -131.5t131.5 -316.5z" />
+    <glyph glyph-name="credit_card" unicode="&#xf09d;" horiz-adv-x="1920" 
+d="M1760 1408q66 0 113 -47t47 -113v-1216q0 -66 -47 -113t-113 -47h-1600q-66 0 -113 47t-47 113v1216q0 66 47 113t113 47h1600zM160 1280q-13 0 -22.5 -9.5t-9.5 -22.5v-224h1664v224q0 13 -9.5 22.5t-22.5 9.5h-1600zM1760 0q13 0 22.5 9.5t9.5 22.5v608h-1664v-608
+q0 -13 9.5 -22.5t22.5 -9.5h1600zM256 128v128h256v-128h-256zM640 128v128h384v-128h-384z" />
+    <glyph glyph-name="rss" unicode="&#xf09e;" horiz-adv-x="1408" 
+d="M384 192q0 -80 -56 -136t-136 -56t-136 56t-56 136t56 136t136 56t136 -56t56 -136zM896 69q2 -28 -17 -48q-18 -21 -47 -21h-135q-25 0 -43 16.5t-20 41.5q-22 229 -184.5 391.5t-391.5 184.5q-25 2 -41.5 20t-16.5 43v135q0 29 21 47q17 17 43 17h5q160 -13 306 -80.5
+t259 -181.5q114 -113 181.5 -259t80.5 -306zM1408 67q2 -27 -18 -47q-18 -20 -46 -20h-143q-26 0 -44.5 17.5t-19.5 42.5q-12 215 -101 408.5t-231.5 336t-336 231.5t-408.5 102q-25 1 -42.5 19.5t-17.5 43.5v143q0 28 20 46q18 18 44 18h3q262 -13 501.5 -120t425.5 -294
+q187 -186 294 -425.5t120 -501.5z" />
+    <glyph glyph-name="hdd" unicode="&#xf0a0;" 
+d="M1040 320q0 -33 -23.5 -56.5t-56.5 -23.5t-56.5 23.5t-23.5 56.5t23.5 56.5t56.5 23.5t56.5 -23.5t23.5 -56.5zM1296 320q0 -33 -23.5 -56.5t-56.5 -23.5t-56.5 23.5t-23.5 56.5t23.5 56.5t56.5 23.5t56.5 -23.5t23.5 -56.5zM1408 160v320q0 13 -9.5 22.5t-22.5 9.5
+h-1216q-13 0 -22.5 -9.5t-9.5 -22.5v-320q0 -13 9.5 -22.5t22.5 -9.5h1216q13 0 22.5 9.5t9.5 22.5zM178 640h1180l-157 482q-4 13 -16 21.5t-26 8.5h-782q-14 0 -26 -8.5t-16 -21.5zM1536 480v-320q0 -66 -47 -113t-113 -47h-1216q-66 0 -113 47t-47 113v320q0 25 16 75
+l197 606q17 53 63 86t101 33h782q55 0 101 -33t63 -86l197 -606q16 -50 16 -75z" />
+    <glyph glyph-name="bullhorn" unicode="&#xf0a1;" horiz-adv-x="1792" 
+d="M1664 896q53 0 90.5 -37.5t37.5 -90.5t-37.5 -90.5t-90.5 -37.5v-384q0 -52 -38 -90t-90 -38q-417 347 -812 380q-58 -19 -91 -66t-31 -100.5t40 -92.5q-20 -33 -23 -65.5t6 -58t33.5 -55t48 -50t61.5 -50.5q-29 -58 -111.5 -83t-168.5 -11.5t-132 55.5q-7 23 -29.5 87.5
+t-32 94.5t-23 89t-15 101t3.5 98.5t22 110.5h-122q-66 0 -113 47t-47 113v192q0 66 47 113t113 47h480q435 0 896 384q52 0 90 -38t38 -90v-384zM1536 292v954q-394 -302 -768 -343v-270q377 -42 768 -341z" />
+    <glyph glyph-name="bell" unicode="&#xf0a2;" horiz-adv-x="1792" 
+d="M912 -160q0 16 -16 16q-59 0 -101.5 42.5t-42.5 101.5q0 16 -16 16t-16 -16q0 -73 51.5 -124.5t124.5 -51.5q16 0 16 16zM246 128h1300q-266 300 -266 832q0 51 -24 105t-69 103t-121.5 80.5t-169.5 31.5t-169.5 -31.5t-121.5 -80.5t-69 -103t-24 -105q0 -532 -266 -832z
+M1728 128q0 -52 -38 -90t-90 -38h-448q0 -106 -75 -181t-181 -75t-181 75t-75 181h-448q-52 0 -90 38t-38 90q50 42 91 88t85 119.5t74.5 158.5t50 206t19.5 260q0 152 117 282.5t307 158.5q-8 19 -8 39q0 40 28 68t68 28t68 -28t28 -68q0 -20 -8 -39q190 -28 307 -158.5
+t117 -282.5q0 -139 19.5 -260t50 -206t74.5 -158.5t85 -119.5t91 -88z" />
+    <glyph glyph-name="certificate" unicode="&#xf0a3;" 
+d="M1376 640l138 -135q30 -28 20 -70q-12 -41 -52 -51l-188 -48l53 -186q12 -41 -19 -70q-29 -31 -70 -19l-186 53l-48 -188q-10 -40 -51 -52q-12 -2 -19 -2q-31 0 -51 22l-135 138l-135 -138q-28 -30 -70 -20q-41 11 -51 52l-48 188l-186 -53q-41 -12 -70 19q-31 29 -19 70
+l53 186l-188 48q-40 10 -52 51q-10 42 20 70l138 135l-138 135q-30 28 -20 70q12 41 52 51l188 48l-53 186q-12 41 19 70q29 31 70 19l186 -53l48 188q10 41 51 51q41 12 70 -19l135 -139l135 139q29 30 70 19q41 -10 51 -51l48 -188l186 53q41 12 70 -19q31 -29 19 -70
+l-53 -186l188 -48q40 -10 52 -51q10 -42 -20 -70z" />
+    <glyph glyph-name="hand_right" unicode="&#xf0a4;" horiz-adv-x="1792" 
+d="M256 192q0 26 -19 45t-45 19t-45 -19t-19 -45t19 -45t45 -19t45 19t19 45zM1664 768q0 51 -39 89.5t-89 38.5h-576q0 20 15 48.5t33 55t33 68t15 84.5q0 67 -44.5 97.5t-115.5 30.5q-24 0 -90 -139q-24 -44 -37 -65q-40 -64 -112 -145q-71 -81 -101 -106
+q-69 -57 -140 -57h-32v-640h32q72 0 167 -32t193.5 -64t179.5 -32q189 0 189 167q0 26 -5 56q30 16 47.5 52.5t17.5 73.5t-18 69q53 50 53 119q0 25 -10 55.5t-25 47.5h331q52 0 90 38t38 90zM1792 769q0 -105 -75.5 -181t-180.5 -76h-169q-4 -62 -37 -119q3 -21 3 -43
+q0 -101 -60 -178q1 -139 -85 -219.5t-227 -80.5q-133 0 -322 69q-164 59 -223 59h-288q-53 0 -90.5 37.5t-37.5 90.5v640q0 53 37.5 90.5t90.5 37.5h288q10 0 21.5 4.5t23.5 14t22.5 18t24 22.5t20.5 21.5t19 21.5t14 17q65 74 100 129q13 21 33 62t37 72t40.5 63t55 49.5
+t69.5 17.5q125 0 206.5 -67t81.5 -189q0 -68 -22 -128h374q104 0 180 -76t76 -179z" />
+    <glyph glyph-name="hand_left" unicode="&#xf0a5;" horiz-adv-x="1792" 
+d="M1376 128h32v640h-32q-35 0 -67.5 12t-62.5 37t-50 46t-49 54q-8 9 -12 14q-72 81 -112 145q-14 22 -38 68q-1 3 -10.5 22.5t-18.5 36t-20 35.5t-21.5 30.5t-18.5 11.5q-71 0 -115.5 -30.5t-44.5 -97.5q0 -43 15 -84.5t33 -68t33 -55t15 -48.5h-576q-50 0 -89 -38.5
+t-39 -89.5q0 -52 38 -90t90 -38h331q-15 -17 -25 -47.5t-10 -55.5q0 -69 53 -119q-18 -32 -18 -69t17.5 -73.5t47.5 -52.5q-4 -24 -4 -56q0 -85 48.5 -126t135.5 -41q84 0 183 32t194 64t167 32zM1664 192q0 26 -19 45t-45 19t-45 -19t-19 -45t19 -45t45 -19t45 19t19 45z
+M1792 768v-640q0 -53 -37.5 -90.5t-90.5 -37.5h-288q-59 0 -223 -59q-190 -69 -317 -69q-142 0 -230 77.5t-87 217.5l1 5q-61 76 -61 178q0 22 3 43q-33 57 -37 119h-169q-105 0 -180.5 76t-75.5 181q0 103 76 179t180 76h374q-22 60 -22 128q0 122 81.5 189t206.5 67
+q38 0 69.5 -17.5t55 -49.5t40.5 -63t37 -72t33 -62q35 -55 100 -129q2 -3 14 -17t19 -21.5t20.5 -21.5t24 -22.5t22.5 -18t23.5 -14t21.5 -4.5h288q53 0 90.5 -37.5t37.5 -90.5z" />
+    <glyph glyph-name="hand_up" unicode="&#xf0a6;" 
+d="M1280 -64q0 26 -19 45t-45 19t-45 -19t-19 -45t19 -45t45 -19t45 19t19 45zM1408 700q0 189 -167 189q-26 0 -56 -5q-16 30 -52.5 47.5t-73.5 17.5t-69 -18q-50 53 -119 53q-25 0 -55.5 -10t-47.5 -25v331q0 52 -38 90t-90 38q-51 0 -89.5 -39t-38.5 -89v-576
+q-20 0 -48.5 15t-55 33t-68 33t-84.5 15q-67 0 -97.5 -44.5t-30.5 -115.5q0 -24 139 -90q44 -24 65 -37q64 -40 145 -112q81 -71 106 -101q57 -69 57 -140v-32h640v32q0 72 32 167t64 193.5t32 179.5zM1536 705q0 -133 -69 -322q-59 -164 -59 -223v-288q0 -53 -37.5 -90.5
+t-90.5 -37.5h-640q-53 0 -90.5 37.5t-37.5 90.5v288q0 10 -4.5 21.5t-14 23.5t-18 22.5t-22.5 24t-21.5 20.5t-21.5 19t-17 14q-74 65 -129 100q-21 13 -62 33t-72 37t-63 40.5t-49.5 55t-17.5 69.5q0 125 67 206.5t189 81.5q68 0 128 -22v374q0 104 76 180t179 76
+q105 0 181 -75.5t76 -180.5v-169q62 -4 119 -37q21 3 43 3q101 0 178 -60q139 1 219.5 -85t80.5 -227z" />
+    <glyph glyph-name="hand_down" unicode="&#xf0a7;" 
+d="M1408 576q0 84 -32 183t-64 194t-32 167v32h-640v-32q0 -35 -12 -67.5t-37 -62.5t-46 -50t-54 -49q-9 -8 -14 -12q-81 -72 -145 -112q-22 -14 -68 -38q-3 -1 -22.5 -10.5t-36 -18.5t-35.5 -20t-30.5 -21.5t-11.5 -18.5q0 -71 30.5 -115.5t97.5 -44.5q43 0 84.5 15t68 33
+t55 33t48.5 15v-576q0 -50 38.5 -89t89.5 -39q52 0 90 38t38 90v331q46 -35 103 -35q69 0 119 53q32 -18 69 -18t73.5 17.5t52.5 47.5q24 -4 56 -4q85 0 126 48.5t41 135.5zM1280 1344q0 26 -19 45t-45 19t-45 -19t-19 -45t19 -45t45 -19t45 19t19 45zM1536 580
+q0 -142 -77.5 -230t-217.5 -87l-5 1q-76 -61 -178 -61q-22 0 -43 3q-54 -30 -119 -37v-169q0 -105 -76 -180.5t-181 -75.5q-103 0 -179 76t-76 180v374q-54 -22 -128 -22q-121 0 -188.5 81.5t-67.5 206.5q0 38 17.5 69.5t49.5 55t63 40.5t72 37t62 33q55 35 129 100
+q3 2 17 14t21.5 19t21.5 20.5t22.5 24t18 22.5t14 23.5t4.5 21.5v288q0 53 37.5 90.5t90.5 37.5h640q53 0 90.5 -37.5t37.5 -90.5v-288q0 -59 59 -223q69 -190 69 -317z" />
+    <glyph glyph-name="circle_arrow_left" unicode="&#xf0a8;" 
+d="M1280 576v128q0 26 -19 45t-45 19h-502l189 189q19 19 19 45t-19 45l-91 91q-18 18 -45 18t-45 -18l-362 -362l-91 -91q-18 -18 -18 -45t18 -45l91 -91l362 -362q18 -18 45 -18t45 18l91 91q18 18 18 45t-18 45l-189 189h502q26 0 45 19t19 45zM1536 640
+q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="circle_arrow_right" unicode="&#xf0a9;" 
+d="M1285 640q0 27 -18 45l-91 91l-362 362q-18 18 -45 18t-45 -18l-91 -91q-18 -18 -18 -45t18 -45l189 -189h-502q-26 0 -45 -19t-19 -45v-128q0 -26 19 -45t45 -19h502l-189 -189q-19 -19 -19 -45t19 -45l91 -91q18 -18 45 -18t45 18l362 362l91 91q18 18 18 45zM1536 640
+q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="circle_arrow_up" unicode="&#xf0aa;" 
+d="M1284 641q0 27 -18 45l-362 362l-91 91q-18 18 -45 18t-45 -18l-91 -91l-362 -362q-18 -18 -18 -45t18 -45l91 -91q18 -18 45 -18t45 18l189 189v-502q0 -26 19 -45t45 -19h128q26 0 45 19t19 45v502l189 -189q19 -19 45 -19t45 19l91 91q18 18 18 45zM1536 640
+q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="circle_arrow_down" unicode="&#xf0ab;" 
+d="M1284 639q0 27 -18 45l-91 91q-18 18 -45 18t-45 -18l-189 -189v502q0 26 -19 45t-45 19h-128q-26 0 -45 -19t-19 -45v-502l-189 189q-19 19 -45 19t-45 -19l-91 -91q-18 -18 -18 -45t18 -45l362 -362l91 -91q18 -18 45 -18t45 18l91 91l362 362q18 18 18 45zM1536 640
+q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="globe" unicode="&#xf0ac;" 
+d="M768 1408q209 0 385.5 -103t279.5 -279.5t103 -385.5t-103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103zM1042 887q-2 -1 -9.5 -9.5t-13.5 -9.5q2 0 4.5 5t5 11t3.5 7q6 7 22 15q14 6 52 12q34 8 51 -11
+q-2 2 9.5 13t14.5 12q3 2 15 4.5t15 7.5l2 22q-12 -1 -17.5 7t-6.5 21q0 -2 -6 -8q0 7 -4.5 8t-11.5 -1t-9 -1q-10 3 -15 7.5t-8 16.5t-4 15q-2 5 -9.5 11t-9.5 10q-1 2 -2.5 5.5t-3 6.5t-4 5.5t-5.5 2.5t-7 -5t-7.5 -10t-4.5 -5q-3 2 -6 1.5t-4.5 -1t-4.5 -3t-5 -3.5
+q-3 -2 -8.5 -3t-8.5 -2q15 5 -1 11q-10 4 -16 3q9 4 7.5 12t-8.5 14h5q-1 4 -8.5 8.5t-17.5 8.5t-13 6q-8 5 -34 9.5t-33 0.5q-5 -6 -4.5 -10.5t4 -14t3.5 -12.5q1 -6 -5.5 -13t-6.5 -12q0 -7 14 -15.5t10 -21.5q-3 -8 -16 -16t-16 -12q-5 -8 -1.5 -18.5t10.5 -16.5
+q2 -2 1.5 -4t-3.5 -4.5t-5.5 -4t-6.5 -3.5l-3 -2q-11 -5 -20.5 6t-13.5 26q-7 25 -16 30q-23 8 -29 -1q-5 13 -41 26q-25 9 -58 4q6 1 0 15q-7 15 -19 12q3 6 4 17.5t1 13.5q3 13 12 23q1 1 7 8.5t9.5 13.5t0.5 6q35 -4 50 11q5 5 11.5 17t10.5 17q9 6 14 5.5t14.5 -5.5
+t14.5 -5q14 -1 15.5 11t-7.5 20q12 -1 3 17q-4 7 -8 9q-12 4 -27 -5q-8 -4 2 -8q-1 1 -9.5 -10.5t-16.5 -17.5t-16 5q-1 1 -5.5 13.5t-9.5 13.5q-8 0 -16 -15q3 8 -11 15t-24 8q19 12 -8 27q-7 4 -20.5 5t-19.5 -4q-5 -7 -5.5 -11.5t5 -8t10.5 -5.5t11.5 -4t8.5 -3
+q14 -10 8 -14q-2 -1 -8.5 -3.5t-11.5 -4.5t-6 -4q-3 -4 0 -14t-2 -14q-5 5 -9 17.5t-7 16.5q7 -9 -25 -6l-10 1q-4 0 -16 -2t-20.5 -1t-13.5 8q-4 8 0 20q1 4 4 2q-4 3 -11 9.5t-10 8.5q-46 -15 -94 -41q6 -1 12 1q5 2 13 6.5t10 5.5q34 14 42 7l5 5q14 -16 20 -25
+q-7 4 -30 1q-20 -6 -22 -12q7 -12 5 -18q-4 3 -11.5 10t-14.5 11t-15 5q-16 0 -22 -1q-146 -80 -235 -222q7 -7 12 -8q4 -1 5 -9t2.5 -11t11.5 3q9 -8 3 -19q1 1 44 -27q19 -17 21 -21q3 -11 -10 -18q-1 2 -9 9t-9 4q-3 -5 0.5 -18.5t10.5 -12.5q-7 0 -9.5 -16t-2.5 -35.5
+t-1 -23.5l2 -1q-3 -12 5.5 -34.5t21.5 -19.5q-13 -3 20 -43q6 -8 8 -9q3 -2 12 -7.5t15 -10t10 -10.5q4 -5 10 -22.5t14 -23.5q-2 -6 9.5 -20t10.5 -23q-1 0 -2.5 -1t-2.5 -1q3 -7 15.5 -14t15.5 -13q1 -3 2 -10t3 -11t8 -2q2 20 -24 62q-15 25 -17 29q-3 5 -5.5 15.5
+t-4.5 14.5q2 0 6 -1.5t8.5 -3.5t7.5 -4t2 -3q-3 -7 2 -17.5t12 -18.5t17 -19t12 -13q6 -6 14 -19.5t0 -13.5q9 0 20 -10.5t17 -19.5q5 -8 8 -26t5 -24q2 -7 8.5 -13.5t12.5 -9.5l16 -8t13 -7q5 -2 18.5 -10.5t21.5 -11.5q10 -4 16 -4t14.5 2.5t13.5 3.5q15 2 29 -15t21 -21
+q36 -19 55 -11q-2 -1 0.5 -7.5t8 -15.5t9 -14.5t5.5 -8.5q5 -6 18 -15t18 -15q6 4 7 9q-3 -8 7 -20t18 -10q14 3 14 32q-31 -15 -49 18q0 1 -2.5 5.5t-4 8.5t-2.5 8.5t0 7.5t5 3q9 0 10 3.5t-2 12.5t-4 13q-1 8 -11 20t-12 15q-5 -9 -16 -8t-16 9q0 -1 -1.5 -5.5t-1.5 -6.5
+q-13 0 -15 1q1 3 2.5 17.5t3.5 22.5q1 4 5.5 12t7.5 14.5t4 12.5t-4.5 9.5t-17.5 2.5q-19 -1 -26 -20q-1 -3 -3 -10.5t-5 -11.5t-9 -7q-7 -3 -24 -2t-24 5q-13 8 -22.5 29t-9.5 37q0 10 2.5 26.5t3 25t-5.5 24.5q3 2 9 9.5t10 10.5q2 1 4.5 1.5t4.5 0t4 1.5t3 6q-1 1 -4 3
+q-3 3 -4 3q7 -3 28.5 1.5t27.5 -1.5q15 -11 22 2q0 1 -2.5 9.5t-0.5 13.5q5 -27 29 -9q3 -3 15.5 -5t17.5 -5q3 -2 7 -5.5t5.5 -4.5t5 0.5t8.5 6.5q10 -14 12 -24q11 -40 19 -44q7 -3 11 -2t4.5 9.5t0 14t-1.5 12.5l-1 8v18l-1 8q-15 3 -18.5 12t1.5 18.5t15 18.5q1 1 8 3.5
+t15.5 6.5t12.5 8q21 19 15 35q7 0 11 9q-1 0 -5 3t-7.5 5t-4.5 2q9 5 2 16q5 3 7.5 11t7.5 10q9 -12 21 -2q8 8 1 16q5 7 20.5 10.5t18.5 9.5q7 -2 8 2t1 12t3 12q4 5 15 9t13 5l17 11q3 4 0 4q18 -2 31 11q10 11 -6 20q3 6 -3 9.5t-15 5.5q3 1 11.5 0.5t10.5 1.5
+q15 10 -7 16q-17 5 -43 -12zM879 10q206 36 351 189q-3 3 -12.5 4.5t-12.5 3.5q-18 7 -24 8q1 7 -2.5 13t-8 9t-12.5 8t-11 7q-2 2 -7 6t-7 5.5t-7.5 4.5t-8.5 2t-10 -1l-3 -1q-3 -1 -5.5 -2.5t-5.5 -3t-4 -3t0 -2.5q-21 17 -36 22q-5 1 -11 5.5t-10.5 7t-10 1.5t-11.5 -7
+q-5 -5 -6 -15t-2 -13q-7 5 0 17.5t2 18.5q-3 6 -10.5 4.5t-12 -4.5t-11.5 -8.5t-9 -6.5t-8.5 -5.5t-8.5 -7.5q-3 -4 -6 -12t-5 -11q-2 4 -11.5 6.5t-9.5 5.5q2 -10 4 -35t5 -38q7 -31 -12 -48q-27 -25 -29 -40q-4 -22 12 -26q0 -7 -8 -20.5t-7 -21.5q0 -6 2 -16z" />
+    <glyph glyph-name="wrench" unicode="&#xf0ad;" horiz-adv-x="1664" 
+d="M384 64q0 26 -19 45t-45 19t-45 -19t-19 -45t19 -45t45 -19t45 19t19 45zM1028 484l-682 -682q-37 -37 -90 -37q-52 0 -91 37l-106 108q-38 36 -38 90q0 53 38 91l681 681q39 -98 114.5 -173.5t173.5 -114.5zM1662 919q0 -39 -23 -106q-47 -134 -164.5 -217.5
+t-258.5 -83.5q-185 0 -316.5 131.5t-131.5 316.5t131.5 316.5t316.5 131.5q58 0 121.5 -16.5t107.5 -46.5q16 -11 16 -28t-16 -28l-293 -169v-224l193 -107q5 3 79 48.5t135.5 81t70.5 35.5q15 0 23.5 -10t8.5 -25z" />
+    <glyph glyph-name="tasks" unicode="&#xf0ae;" horiz-adv-x="1792" 
+d="M1024 128h640v128h-640v-128zM640 640h1024v128h-1024v-128zM1280 1152h384v128h-384v-128zM1792 320v-256q0 -26 -19 -45t-45 -19h-1664q-26 0 -45 19t-19 45v256q0 26 19 45t45 19h1664q26 0 45 -19t19 -45zM1792 832v-256q0 -26 -19 -45t-45 -19h-1664q-26 0 -45 19
+t-19 45v256q0 26 19 45t45 19h1664q26 0 45 -19t19 -45zM1792 1344v-256q0 -26 -19 -45t-45 -19h-1664q-26 0 -45 19t-19 45v256q0 26 19 45t45 19h1664q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="filter" unicode="&#xf0b0;" horiz-adv-x="1408" 
+d="M1403 1241q17 -41 -14 -70l-493 -493v-742q0 -42 -39 -59q-13 -5 -25 -5q-27 0 -45 19l-256 256q-19 19 -19 45v486l-493 493q-31 29 -14 70q17 39 59 39h1280q42 0 59 -39z" />
+    <glyph glyph-name="briefcase" unicode="&#xf0b1;" horiz-adv-x="1792" 
+d="M640 1280h512v128h-512v-128zM1792 640v-480q0 -66 -47 -113t-113 -47h-1472q-66 0 -113 47t-47 113v480h672v-160q0 -26 19 -45t45 -19h320q26 0 45 19t19 45v160h672zM1024 640v-128h-256v128h256zM1792 1120v-384h-1792v384q0 66 47 113t113 47h352v160q0 40 28 68
+t68 28h576q40 0 68 -28t28 -68v-160h352q66 0 113 -47t47 -113z" />
+    <glyph glyph-name="fullscreen" unicode="&#xf0b2;" 
+d="M1283 995l-355 -355l355 -355l144 144q29 31 70 14q39 -17 39 -59v-448q0 -26 -19 -45t-45 -19h-448q-42 0 -59 40q-17 39 14 69l144 144l-355 355l-355 -355l144 -144q31 -30 14 -69q-17 -40 -59 -40h-448q-26 0 -45 19t-19 45v448q0 42 40 59q39 17 69 -14l144 -144
+l355 355l-355 355l-144 -144q-19 -19 -45 -19q-12 0 -24 5q-40 17 -40 59v448q0 26 19 45t45 19h448q42 0 59 -40q17 -39 -14 -69l-144 -144l355 -355l355 355l-144 144q-31 30 -14 69q17 40 59 40h448q26 0 45 -19t19 -45v-448q0 -42 -39 -59q-13 -5 -25 -5q-26 0 -45 19z
+" />
+    <glyph glyph-name="group" unicode="&#xf0c0;" horiz-adv-x="1920" 
+d="M593 640q-162 -5 -265 -128h-134q-82 0 -138 40.5t-56 118.5q0 353 124 353q6 0 43.5 -21t97.5 -42.5t119 -21.5q67 0 133 23q-5 -37 -5 -66q0 -139 81 -256zM1664 3q0 -120 -73 -189.5t-194 -69.5h-874q-121 0 -194 69.5t-73 189.5q0 53 3.5 103.5t14 109t26.5 108.5
+t43 97.5t62 81t85.5 53.5t111.5 20q10 0 43 -21.5t73 -48t107 -48t135 -21.5t135 21.5t107 48t73 48t43 21.5q61 0 111.5 -20t85.5 -53.5t62 -81t43 -97.5t26.5 -108.5t14 -109t3.5 -103.5zM640 1280q0 -106 -75 -181t-181 -75t-181 75t-75 181t75 181t181 75t181 -75
+t75 -181zM1344 896q0 -159 -112.5 -271.5t-271.5 -112.5t-271.5 112.5t-112.5 271.5t112.5 271.5t271.5 112.5t271.5 -112.5t112.5 -271.5zM1920 671q0 -78 -56 -118.5t-138 -40.5h-134q-103 123 -265 128q81 117 81 256q0 29 -5 66q66 -23 133 -23q59 0 119 21.5t97.5 42.5
+t43.5 21q124 0 124 -353zM1792 1280q0 -106 -75 -181t-181 -75t-181 75t-75 181t75 181t181 75t181 -75t75 -181z" />
+    <glyph glyph-name="link" unicode="&#xf0c1;" horiz-adv-x="1664" 
+d="M1456 320q0 40 -28 68l-208 208q-28 28 -68 28q-42 0 -72 -32q3 -3 19 -18.5t21.5 -21.5t15 -19t13 -25.5t3.5 -27.5q0 -40 -28 -68t-68 -28q-15 0 -27.5 3.5t-25.5 13t-19 15t-21.5 21.5t-18.5 19q-33 -31 -33 -73q0 -40 28 -68l206 -207q27 -27 68 -27q40 0 68 26
+l147 146q28 28 28 67zM753 1025q0 40 -28 68l-206 207q-28 28 -68 28q-39 0 -68 -27l-147 -146q-28 -28 -28 -67q0 -40 28 -68l208 -208q27 -27 68 -27q42 0 72 31q-3 3 -19 18.5t-21.5 21.5t-15 19t-13 25.5t-3.5 27.5q0 40 28 68t68 28q15 0 27.5 -3.5t25.5 -13t19 -15
+t21.5 -21.5t18.5 -19q33 31 33 73zM1648 320q0 -120 -85 -203l-147 -146q-83 -83 -203 -83q-121 0 -204 85l-206 207q-83 83 -83 203q0 123 88 209l-88 88q-86 -88 -208 -88q-120 0 -204 84l-208 208q-84 84 -84 204t85 203l147 146q83 83 203 83q121 0 204 -85l206 -207
+q83 -83 83 -203q0 -123 -88 -209l88 -88q86 88 208 88q120 0 204 -84l208 -208q84 -84 84 -204z" />
+    <glyph glyph-name="cloud" unicode="&#xf0c2;" horiz-adv-x="1920" 
+d="M1920 384q0 -159 -112.5 -271.5t-271.5 -112.5h-1088q-185 0 -316.5 131.5t-131.5 316.5q0 132 71 241.5t187 163.5q-2 28 -2 43q0 212 150 362t362 150q158 0 286.5 -88t187.5 -230q70 62 166 62q106 0 181 -75t75 -181q0 -75 -41 -138q129 -30 213 -134.5t84 -239.5z
+" />
+    <glyph glyph-name="beaker" unicode="&#xf0c3;" horiz-adv-x="1664" 
+d="M1527 88q56 -89 21.5 -152.5t-140.5 -63.5h-1152q-106 0 -140.5 63.5t21.5 152.5l503 793v399h-64q-26 0 -45 19t-19 45t19 45t45 19h512q26 0 45 -19t19 -45t-19 -45t-45 -19h-64v-399zM748 813l-272 -429h712l-272 429l-20 31v37v399h-128v-399v-37z" />
+    <glyph glyph-name="cut" unicode="&#xf0c4;" horiz-adv-x="1792" 
+d="M960 640q26 0 45 -19t19 -45t-19 -45t-45 -19t-45 19t-19 45t19 45t45 19zM1260 576l507 -398q28 -20 25 -56q-5 -35 -35 -51l-128 -64q-13 -7 -29 -7q-17 0 -31 8l-690 387l-110 -66q-8 -4 -12 -5q14 -49 10 -97q-7 -77 -56 -147.5t-132 -123.5q-132 -84 -277 -84
+q-136 0 -222 78q-90 84 -79 207q7 76 56 147t131 124q132 84 278 84q83 0 151 -31q9 13 22 22l122 73l-122 73q-13 9 -22 22q-68 -31 -151 -31q-146 0 -278 84q-82 53 -131 124t-56 147q-5 59 15.5 113t63.5 93q85 79 222 79q145 0 277 -84q83 -52 132 -123t56 -148
+q4 -48 -10 -97q4 -1 12 -5l110 -66l690 387q14 8 31 8q16 0 29 -7l128 -64q30 -16 35 -51q3 -36 -25 -56zM579 836q46 42 21 108t-106 117q-92 59 -192 59q-74 0 -113 -36q-46 -42 -21 -108t106 -117q92 -59 192 -59q74 0 113 36zM494 91q81 51 106 117t-21 108
+q-39 36 -113 36q-100 0 -192 -59q-81 -51 -106 -117t21 -108q39 -36 113 -36q100 0 192 59zM672 704l96 -58v11q0 36 33 56l14 8l-79 47l-26 -26q-3 -3 -10 -11t-12 -12q-2 -2 -4 -3.5t-3 -2.5zM896 480l96 -32l736 576l-128 64l-768 -431v-113l-160 -96l9 -8q2 -2 7 -6
+q4 -4 11 -12t11 -12l26 -26zM1600 64l128 64l-520 408l-177 -138q-2 -3 -13 -7z" />
+    <glyph glyph-name="copy" unicode="&#xf0c5;" horiz-adv-x="1792" 
+d="M1696 1152q40 0 68 -28t28 -68v-1216q0 -40 -28 -68t-68 -28h-960q-40 0 -68 28t-28 68v288h-544q-40 0 -68 28t-28 68v672q0 40 20 88t48 76l408 408q28 28 76 48t88 20h416q40 0 68 -28t28 -68v-328q68 40 128 40h416zM1152 939l-299 -299h299v299zM512 1323l-299 -299
+h299v299zM708 676l316 316v416h-384v-416q0 -40 -28 -68t-68 -28h-416v-640h512v256q0 40 20 88t48 76zM1664 -128v1152h-384v-416q0 -40 -28 -68t-68 -28h-416v-640h896z" />
+    <glyph glyph-name="paper_clip" unicode="&#xf0c6;" horiz-adv-x="1408" 
+d="M1404 151q0 -117 -79 -196t-196 -79q-135 0 -235 100l-777 776q-113 115 -113 271q0 159 110 270t269 111q158 0 273 -113l605 -606q10 -10 10 -22q0 -16 -30.5 -46.5t-46.5 -30.5q-13 0 -23 10l-606 607q-79 77 -181 77q-106 0 -179 -75t-73 -181q0 -105 76 -181
+l776 -777q63 -63 145 -63q64 0 106 42t42 106q0 82 -63 145l-581 581q-26 24 -60 24q-29 0 -48 -19t-19 -48q0 -32 25 -59l410 -410q10 -10 10 -22q0 -16 -31 -47t-47 -31q-12 0 -22 10l-410 410q-63 61 -63 149q0 82 57 139t139 57q88 0 149 -63l581 -581q100 -98 100 -235
+z" />
+    <glyph glyph-name="save" unicode="&#xf0c7;" 
+d="M384 0h768v384h-768v-384zM1280 0h128v896q0 14 -10 38.5t-20 34.5l-281 281q-10 10 -34 20t-39 10v-416q0 -40 -28 -68t-68 -28h-576q-40 0 -68 28t-28 68v416h-128v-1280h128v416q0 40 28 68t68 28h832q40 0 68 -28t28 -68v-416zM896 928v320q0 13 -9.5 22.5t-22.5 9.5
+h-192q-13 0 -22.5 -9.5t-9.5 -22.5v-320q0 -13 9.5 -22.5t22.5 -9.5h192q13 0 22.5 9.5t9.5 22.5zM1536 896v-928q0 -40 -28 -68t-68 -28h-1344q-40 0 -68 28t-28 68v1344q0 40 28 68t68 28h928q40 0 88 -20t76 -48l280 -280q28 -28 48 -76t20 -88z" />
+    <glyph glyph-name="sign_blank" unicode="&#xf0c8;" 
+d="M1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="reorder" unicode="&#xf0c9;" 
+d="M1536 192v-128q0 -26 -19 -45t-45 -19h-1408q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h1408q26 0 45 -19t19 -45zM1536 704v-128q0 -26 -19 -45t-45 -19h-1408q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h1408q26 0 45 -19t19 -45zM1536 1216v-128q0 -26 -19 -45
+t-45 -19h-1408q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h1408q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="ul" unicode="&#xf0ca;" horiz-adv-x="1792" 
+d="M384 128q0 -80 -56 -136t-136 -56t-136 56t-56 136t56 136t136 56t136 -56t56 -136zM384 640q0 -80 -56 -136t-136 -56t-136 56t-56 136t56 136t136 56t136 -56t56 -136zM1792 224v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-1216q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5
+t22.5 9.5h1216q13 0 22.5 -9.5t9.5 -22.5zM384 1152q0 -80 -56 -136t-136 -56t-136 56t-56 136t56 136t136 56t136 -56t56 -136zM1792 736v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-1216q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5t22.5 9.5h1216q13 0 22.5 -9.5t9.5 -22.5z
+M1792 1248v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-1216q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5t22.5 9.5h1216q13 0 22.5 -9.5t9.5 -22.5z" />
+    <glyph glyph-name="ol" unicode="&#xf0cb;" horiz-adv-x="1792" 
+d="M381 -84q0 -80 -54.5 -126t-135.5 -46q-106 0 -172 66l57 88q49 -45 106 -45q29 0 50.5 14.5t21.5 42.5q0 64 -105 56l-26 56q8 10 32.5 43.5t42.5 54t37 38.5v1q-16 0 -48.5 -1t-48.5 -1v-53h-106v152h333v-88l-95 -115q51 -12 81 -49t30 -88zM383 543v-159h-362
+q-6 36 -6 54q0 51 23.5 93t56.5 68t66 47.5t56.5 43.5t23.5 45q0 25 -14.5 38.5t-39.5 13.5q-46 0 -81 -58l-85 59q24 51 71.5 79.5t105.5 28.5q73 0 123 -41.5t50 -112.5q0 -50 -34 -91.5t-75 -64.5t-75.5 -50.5t-35.5 -52.5h127v60h105zM1792 224v-192q0 -13 -9.5 -22.5
+t-22.5 -9.5h-1216q-13 0 -22.5 9.5t-9.5 22.5v192q0 14 9 23t23 9h1216q13 0 22.5 -9.5t9.5 -22.5zM384 1123v-99h-335v99h107q0 41 0.5 121.5t0.5 121.5v12h-2q-8 -17 -50 -54l-71 76l136 127h106v-404h108zM1792 736v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-1216
+q-13 0 -22.5 9.5t-9.5 22.5v192q0 14 9 23t23 9h1216q13 0 22.5 -9.5t9.5 -22.5zM1792 1248v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-1216q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5t22.5 9.5h1216q13 0 22.5 -9.5t9.5 -22.5z" />
+    <glyph glyph-name="strikethrough" unicode="&#xf0cc;" horiz-adv-x="1792" 
+d="M1760 640q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-1728q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h1728zM483 704q-28 35 -51 80q-48 98 -48 188q0 181 134 309q133 127 393 127q50 0 167 -19q66 -12 177 -48q10 -38 21 -118q14 -123 14 -183q0 -18 -5 -45l-12 -3l-84 6
+l-14 2q-50 149 -103 205q-88 91 -210 91q-114 0 -182 -59q-67 -58 -67 -146q0 -73 66 -140t279 -129q69 -20 173 -66q58 -28 95 -52h-743zM990 448h411q7 -39 7 -92q0 -111 -41 -212q-23 -56 -71 -104q-37 -35 -109 -81q-80 -48 -153 -66q-80 -21 -203 -21q-114 0 -195 23
+l-140 40q-57 16 -72 28q-8 8 -8 22v13q0 108 -2 156q-1 30 0 68l2 37v44l102 2q15 -34 30 -71t22.5 -56t12.5 -27q35 -57 80 -94q43 -36 105 -57q59 -22 132 -22q64 0 139 27q77 26 122 86q47 61 47 129q0 84 -81 157q-34 29 -137 71z" />
+    <glyph glyph-name="underline" unicode="&#xf0cd;" 
+d="M48 1313q-37 2 -45 4l-3 88q13 1 40 1q60 0 112 -4q132 -7 166 -7q86 0 168 3q116 4 146 5q56 0 86 2l-1 -14l2 -64v-9q-60 -9 -124 -9q-60 0 -79 -25q-13 -14 -13 -132q0 -13 0.5 -32.5t0.5 -25.5l1 -229l14 -280q6 -124 51 -202q35 -59 96 -92q88 -47 177 -47
+q104 0 191 28q56 18 99 51q48 36 65 64q36 56 53 114q21 73 21 229q0 79 -3.5 128t-11 122.5t-13.5 159.5l-4 59q-5 67 -24 88q-34 35 -77 34l-100 -2l-14 3l2 86h84l205 -10q76 -3 196 10l18 -2q6 -38 6 -51q0 -7 -4 -31q-45 -12 -84 -13q-73 -11 -79 -17q-15 -15 -15 -41
+q0 -7 1.5 -27t1.5 -31q8 -19 22 -396q6 -195 -15 -304q-15 -76 -41 -122q-38 -65 -112 -123q-75 -57 -182 -89q-109 -33 -255 -33q-167 0 -284 46q-119 47 -179 122q-61 76 -83 195q-16 80 -16 237v333q0 188 -17 213q-25 36 -147 39zM1536 -96v64q0 14 -9 23t-23 9h-1472
+q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h1472q14 0 23 9t9 23z" />
+    <glyph glyph-name="table" unicode="&#xf0ce;" horiz-adv-x="1664" 
+d="M512 160v192q0 14 -9 23t-23 9h-320q-14 0 -23 -9t-9 -23v-192q0 -14 9 -23t23 -9h320q14 0 23 9t9 23zM512 544v192q0 14 -9 23t-23 9h-320q-14 0 -23 -9t-9 -23v-192q0 -14 9 -23t23 -9h320q14 0 23 9t9 23zM1024 160v192q0 14 -9 23t-23 9h-320q-14 0 -23 -9t-9 -23
+v-192q0 -14 9 -23t23 -9h320q14 0 23 9t9 23zM512 928v192q0 14 -9 23t-23 9h-320q-14 0 -23 -9t-9 -23v-192q0 -14 9 -23t23 -9h320q14 0 23 9t9 23zM1024 544v192q0 14 -9 23t-23 9h-320q-14 0 -23 -9t-9 -23v-192q0 -14 9 -23t23 -9h320q14 0 23 9t9 23zM1536 160v192
+q0 14 -9 23t-23 9h-320q-14 0 -23 -9t-9 -23v-192q0 -14 9 -23t23 -9h320q14 0 23 9t9 23zM1024 928v192q0 14 -9 23t-23 9h-320q-14 0 -23 -9t-9 -23v-192q0 -14 9 -23t23 -9h320q14 0 23 9t9 23zM1536 544v192q0 14 -9 23t-23 9h-320q-14 0 -23 -9t-9 -23v-192
+q0 -14 9 -23t23 -9h320q14 0 23 9t9 23zM1536 928v192q0 14 -9 23t-23 9h-320q-14 0 -23 -9t-9 -23v-192q0 -14 9 -23t23 -9h320q14 0 23 9t9 23zM1664 1248v-1088q0 -66 -47 -113t-113 -47h-1344q-66 0 -113 47t-47 113v1088q0 66 47 113t113 47h1344q66 0 113 -47t47 -113
+z" />
+    <glyph glyph-name="magic" unicode="&#xf0d0;" horiz-adv-x="1664" 
+d="M1190 955l293 293l-107 107l-293 -293zM1637 1248q0 -27 -18 -45l-1286 -1286q-18 -18 -45 -18t-45 18l-198 198q-18 18 -18 45t18 45l1286 1286q18 18 45 18t45 -18l198 -198q18 -18 18 -45zM286 1438l98 -30l-98 -30l-30 -98l-30 98l-98 30l98 30l30 98zM636 1276
+l196 -60l-196 -60l-60 -196l-60 196l-196 60l196 60l60 196zM1566 798l98 -30l-98 -30l-30 -98l-30 98l-98 30l98 30l30 98zM926 1438l98 -30l-98 -30l-30 -98l-30 98l-98 30l98 30l30 98z" />
+    <glyph glyph-name="truck" unicode="&#xf0d1;" horiz-adv-x="1792" 
+d="M640 128q0 52 -38 90t-90 38t-90 -38t-38 -90t38 -90t90 -38t90 38t38 90zM256 640h384v256h-158q-13 0 -22 -9l-195 -195q-9 -9 -9 -22v-30zM1536 128q0 52 -38 90t-90 38t-90 -38t-38 -90t38 -90t90 -38t90 38t38 90zM1792 1216v-1024q0 -15 -4 -26.5t-13.5 -18.5
+t-16.5 -11.5t-23.5 -6t-22.5 -2t-25.5 0t-22.5 0.5q0 -106 -75 -181t-181 -75t-181 75t-75 181h-384q0 -106 -75 -181t-181 -75t-181 75t-75 181h-64q-3 0 -22.5 -0.5t-25.5 0t-22.5 2t-23.5 6t-16.5 11.5t-13.5 18.5t-4 26.5q0 26 19 45t45 19v320q0 8 -0.5 35t0 38
+t2.5 34.5t6.5 37t14 30.5t22.5 30l198 198q19 19 50.5 32t58.5 13h160v192q0 26 19 45t45 19h1024q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="pinterest" unicode="&#xf0d2;" 
+d="M1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103q-111 0 -218 32q59 93 78 164q9 34 54 211q20 -39 73 -67.5t114 -28.5q121 0 216 68.5t147 188.5t52 270q0 114 -59.5 214t-172.5 163t-255 63q-105 0 -196 -29t-154.5 -77t-109 -110.5t-67 -129.5t-21.5 -134
+q0 -104 40 -183t117 -111q30 -12 38 20q2 7 8 31t8 30q6 23 -11 43q-51 61 -51 151q0 151 104.5 259.5t273.5 108.5q151 0 235.5 -82t84.5 -213q0 -170 -68.5 -289t-175.5 -119q-61 0 -98 43.5t-23 104.5q8 35 26.5 93.5t30 103t11.5 75.5q0 50 -27 83t-77 33
+q-62 0 -105 -57t-43 -142q0 -73 25 -122l-99 -418q-17 -70 -13 -177q-206 91 -333 281t-127 423q0 209 103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="pinterest_sign" unicode="&#xf0d3;" 
+d="M1248 1408q119 0 203.5 -84.5t84.5 -203.5v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-725q85 122 108 210q9 34 53 209q21 -39 73.5 -67t112.5 -28q181 0 295.5 147.5t114.5 373.5q0 84 -35 162.5t-96.5 139t-152.5 97t-197 36.5q-104 0 -194.5 -28.5t-153 -76.5
+t-107.5 -109.5t-66.5 -128t-21.5 -132.5q0 -102 39.5 -180t116.5 -110q13 -5 23.5 0t14.5 19q10 44 15 61q6 23 -11 42q-50 62 -50 150q0 150 103.5 256.5t270.5 106.5q149 0 232.5 -81t83.5 -210q0 -168 -67.5 -286t-173.5 -118q-60 0 -97 43.5t-23 103.5q8 34 26.5 92.5
+t29.5 102t11 74.5q0 49 -26.5 81.5t-75.5 32.5q-61 0 -103.5 -56.5t-42.5 -139.5q0 -72 24 -121l-98 -414q-24 -100 -7 -254h-183q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960z" />
+    <glyph glyph-name="google_plus_sign" unicode="&#xf0d4;" 
+d="M917 631q0 26 -6 64h-362v-132h217q-3 -24 -16.5 -50t-37.5 -53t-66.5 -44.5t-96.5 -17.5q-99 0 -169 71t-70 171t70 171t169 71q92 0 153 -59l104 101q-108 100 -257 100q-160 0 -272 -112.5t-112 -271.5t112 -271.5t272 -112.5q165 0 266.5 105t101.5 270zM1262 585
+h109v110h-109v110h-110v-110h-110v-110h110v-110h110v110zM1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="google_plus" unicode="&#xf0d5;" horiz-adv-x="2304" 
+d="M1437 623q0 -208 -87 -370.5t-248 -254t-369 -91.5q-149 0 -285 58t-234 156t-156 234t-58 285t58 285t156 234t234 156t285 58q286 0 491 -192l-199 -191q-117 113 -292 113q-123 0 -227.5 -62t-165.5 -168.5t-61 -232.5t61 -232.5t165.5 -168.5t227.5 -62
+q83 0 152.5 23t114.5 57.5t78.5 78.5t49 83t21.5 74h-416v252h692q12 -63 12 -122zM2304 745v-210h-209v-209h-210v209h-209v210h209v209h210v-209h209z" />
+    <glyph glyph-name="money" unicode="&#xf0d6;" horiz-adv-x="1920" 
+d="M768 384h384v96h-128v448h-114l-148 -137l77 -80q42 37 55 57h2v-288h-128v-96zM1280 640q0 -70 -21 -142t-59.5 -134t-101.5 -101t-138 -39t-138 39t-101.5 101t-59.5 134t-21 142t21 142t59.5 134t101.5 101t138 39t138 -39t101.5 -101t59.5 -134t21 -142zM1792 384
+v512q-106 0 -181 75t-75 181h-1152q0 -106 -75 -181t-181 -75v-512q106 0 181 -75t75 -181h1152q0 106 75 181t181 75zM1920 1216v-1152q0 -26 -19 -45t-45 -19h-1792q-26 0 -45 19t-19 45v1152q0 26 19 45t45 19h1792q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="caret_down" unicode="&#xf0d7;" horiz-adv-x="1024" 
+d="M1024 832q0 -26 -19 -45l-448 -448q-19 -19 -45 -19t-45 19l-448 448q-19 19 -19 45t19 45t45 19h896q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="caret_up" unicode="&#xf0d8;" horiz-adv-x="1024" 
+d="M1024 320q0 -26 -19 -45t-45 -19h-896q-26 0 -45 19t-19 45t19 45l448 448q19 19 45 19t45 -19l448 -448q19 -19 19 -45z" />
+    <glyph glyph-name="caret_left" unicode="&#xf0d9;" horiz-adv-x="640" 
+d="M640 1088v-896q0 -26 -19 -45t-45 -19t-45 19l-448 448q-19 19 -19 45t19 45l448 448q19 19 45 19t45 -19t19 -45z" />
+    <glyph glyph-name="caret_right" unicode="&#xf0da;" horiz-adv-x="640" 
+d="M576 640q0 -26 -19 -45l-448 -448q-19 -19 -45 -19t-45 19t-19 45v896q0 26 19 45t45 19t45 -19l448 -448q19 -19 19 -45z" />
+    <glyph glyph-name="columns" unicode="&#xf0db;" horiz-adv-x="1664" 
+d="M160 0h608v1152h-640v-1120q0 -13 9.5 -22.5t22.5 -9.5zM1536 32v1120h-640v-1152h608q13 0 22.5 9.5t9.5 22.5zM1664 1248v-1216q0 -66 -47 -113t-113 -47h-1344q-66 0 -113 47t-47 113v1216q0 66 47 113t113 47h1344q66 0 113 -47t47 -113z" />
+    <glyph glyph-name="sort" unicode="&#xf0dc;" horiz-adv-x="1024" 
+d="M1024 448q0 -26 -19 -45l-448 -448q-19 -19 -45 -19t-45 19l-448 448q-19 19 -19 45t19 45t45 19h896q26 0 45 -19t19 -45zM1024 832q0 -26 -19 -45t-45 -19h-896q-26 0 -45 19t-19 45t19 45l448 448q19 19 45 19t45 -19l448 -448q19 -19 19 -45z" />
+    <glyph glyph-name="sort_down" unicode="&#xf0dd;" horiz-adv-x="1024" 
+d="M1024 448q0 -26 -19 -45l-448 -448q-19 -19 -45 -19t-45 19l-448 448q-19 19 -19 45t19 45t45 19h896q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="sort_up" unicode="&#xf0de;" horiz-adv-x="1024" 
+d="M1024 832q0 -26 -19 -45t-45 -19h-896q-26 0 -45 19t-19 45t19 45l448 448q19 19 45 19t45 -19l448 -448q19 -19 19 -45z" />
+    <glyph glyph-name="envelope_alt" unicode="&#xf0e0;" horiz-adv-x="1792" 
+d="M1792 826v-794q0 -66 -47 -113t-113 -47h-1472q-66 0 -113 47t-47 113v794q44 -49 101 -87q362 -246 497 -345q57 -42 92.5 -65.5t94.5 -48t110 -24.5h1h1q51 0 110 24.5t94.5 48t92.5 65.5q170 123 498 345q57 39 100 87zM1792 1120q0 -79 -49 -151t-122 -123
+q-376 -261 -468 -325q-10 -7 -42.5 -30.5t-54 -38t-52 -32.5t-57.5 -27t-50 -9h-1h-1q-23 0 -50 9t-57.5 27t-52 32.5t-54 38t-42.5 30.5q-91 64 -262 182.5t-205 142.5q-62 42 -117 115.5t-55 136.5q0 78 41.5 130t118.5 52h1472q65 0 112.5 -47t47.5 -113z" />
+    <glyph glyph-name="linkedin" unicode="&#xf0e1;" 
+d="M349 911v-991h-330v991h330zM370 1217q1 -73 -50.5 -122t-135.5 -49h-2q-82 0 -132 49t-50 122q0 74 51.5 122.5t134.5 48.5t133 -48.5t51 -122.5zM1536 488v-568h-329v530q0 105 -40.5 164.5t-126.5 59.5q-63 0 -105.5 -34.5t-63.5 -85.5q-11 -30 -11 -81v-553h-329
+q2 399 2 647t-1 296l-1 48h329v-144h-2q20 32 41 56t56.5 52t87 43.5t114.5 15.5q171 0 275 -113.5t104 -332.5z" />
+    <glyph glyph-name="undo" unicode="&#xf0e2;" 
+d="M1536 640q0 -156 -61 -298t-164 -245t-245 -164t-298 -61q-172 0 -327 72.5t-264 204.5q-7 10 -6.5 22.5t8.5 20.5l137 138q10 9 25 9q16 -2 23 -12q73 -95 179 -147t225 -52q104 0 198.5 40.5t163.5 109.5t109.5 163.5t40.5 198.5t-40.5 198.5t-109.5 163.5
+t-163.5 109.5t-198.5 40.5q-98 0 -188 -35.5t-160 -101.5l137 -138q31 -30 14 -69q-17 -40 -59 -40h-448q-26 0 -45 19t-19 45v448q0 42 40 59q39 17 69 -14l130 -129q107 101 244.5 156.5t284.5 55.5q156 0 298 -61t245 -164t164 -245t61 -298z" />
+    <glyph glyph-name="legal" unicode="&#xf0e3;" horiz-adv-x="1792" 
+d="M1771 0q0 -53 -37 -90l-107 -108q-39 -37 -91 -37q-53 0 -90 37l-363 364q-38 36 -38 90q0 53 43 96l-256 256l-126 -126q-14 -14 -34 -14t-34 14q2 -2 12.5 -12t12.5 -13t10 -11.5t10 -13.5t6 -13.5t5.5 -16.5t1.5 -18q0 -38 -28 -68q-3 -3 -16.5 -18t-19 -20.5
+t-18.5 -16.5t-22 -15.5t-22 -9t-26 -4.5q-40 0 -68 28l-408 408q-28 28 -28 68q0 13 4.5 26t9 22t15.5 22t16.5 18.5t20.5 19t18 16.5q30 28 68 28q10 0 18 -1.5t16.5 -5.5t13.5 -6t13.5 -10t11.5 -10t13 -12.5t12 -12.5q-14 14 -14 34t14 34l348 348q14 14 34 14t34 -14
+q-2 2 -12.5 12t-12.5 13t-10 11.5t-10 13.5t-6 13.5t-5.5 16.5t-1.5 18q0 38 28 68q3 3 16.5 18t19 20.5t18.5 16.5t22 15.5t22 9t26 4.5q40 0 68 -28l408 -408q28 -28 28 -68q0 -13 -4.5 -26t-9 -22t-15.5 -22t-16.5 -18.5t-20.5 -19t-18 -16.5q-30 -28 -68 -28
+q-10 0 -18 1.5t-16.5 5.5t-13.5 6t-13.5 10t-11.5 10t-13 12.5t-12 12.5q14 -14 14 -34t-14 -34l-126 -126l256 -256q43 43 96 43q52 0 91 -37l363 -363q37 -39 37 -91z" />
+    <glyph glyph-name="dashboard" unicode="&#xf0e4;" horiz-adv-x="1792" 
+d="M384 384q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM576 832q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM1004 351l101 382q6 26 -7.5 48.5t-38.5 29.5
+t-48 -6.5t-30 -39.5l-101 -382q-60 -5 -107 -43.5t-63 -98.5q-20 -77 20 -146t117 -89t146 20t89 117q16 60 -6 117t-72 91zM1664 384q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM1024 1024q0 53 -37.5 90.5
+t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM1472 832q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM1792 384q0 -261 -141 -483q-19 -29 -54 -29h-1402q-35 0 -54 29
+q-141 221 -141 483q0 182 71 348t191 286t286 191t348 71t348 -71t286 -191t191 -286t71 -348z" />
+    <glyph glyph-name="comment_alt" unicode="&#xf0e5;" horiz-adv-x="1792" 
+d="M896 1152q-204 0 -381.5 -69.5t-282 -187.5t-104.5 -255q0 -112 71.5 -213.5t201.5 -175.5l87 -50l-27 -96q-24 -91 -70 -172q152 63 275 171l43 38l57 -6q69 -8 130 -8q204 0 381.5 69.5t282 187.5t104.5 255t-104.5 255t-282 187.5t-381.5 69.5zM1792 640
+q0 -174 -120 -321.5t-326 -233t-450 -85.5q-70 0 -145 8q-198 -175 -460 -242q-49 -14 -114 -22h-5q-15 0 -27 10.5t-16 27.5v1q-3 4 -0.5 12t2 10t4.5 9.5l6 9t7 8.5t8 9q7 8 31 34.5t34.5 38t31 39.5t32.5 51t27 59t26 76q-157 89 -247.5 220t-90.5 281q0 174 120 321.5
+t326 233t450 85.5t450 -85.5t326 -233t120 -321.5z" />
+    <glyph glyph-name="comments_alt" unicode="&#xf0e6;" horiz-adv-x="1792" 
+d="M704 1152q-153 0 -286 -52t-211.5 -141t-78.5 -191q0 -82 53 -158t149 -132l97 -56l-35 -84q34 20 62 39l44 31l53 -10q78 -14 153 -14q153 0 286 52t211.5 141t78.5 191t-78.5 191t-211.5 141t-286 52zM704 1280q191 0 353.5 -68.5t256.5 -186.5t94 -257t-94 -257
+t-256.5 -186.5t-353.5 -68.5q-86 0 -176 16q-124 -88 -278 -128q-36 -9 -86 -16h-3q-11 0 -20.5 8t-11.5 21q-1 3 -1 6.5t0.5 6.5t2 6l2.5 5t3.5 5.5t4 5t4.5 5t4 4.5q5 6 23 25t26 29.5t22.5 29t25 38.5t20.5 44q-124 72 -195 177t-71 224q0 139 94 257t256.5 186.5
+t353.5 68.5zM1526 111q10 -24 20.5 -44t25 -38.5t22.5 -29t26 -29.5t23 -25q1 -1 4 -4.5t4.5 -5t4 -5t3.5 -5.5l2.5 -5t2 -6t0.5 -6.5t-1 -6.5q-3 -14 -13 -22t-22 -7q-50 7 -86 16q-154 40 -278 128q-90 -16 -176 -16q-271 0 -472 132q58 -4 88 -4q161 0 309 45t264 129
+q125 92 192 212t67 254q0 77 -23 152q129 -71 204 -178t75 -230q0 -120 -71 -224.5t-195 -176.5z" />
+    <glyph glyph-name="bolt" unicode="&#xf0e7;" horiz-adv-x="896" 
+d="M885 970q18 -20 7 -44l-540 -1157q-13 -25 -42 -25q-4 0 -14 2q-17 5 -25.5 19t-4.5 30l197 808l-406 -101q-4 -1 -12 -1q-18 0 -31 11q-18 15 -13 39l201 825q4 14 16 23t28 9h328q19 0 32 -12.5t13 -29.5q0 -8 -5 -18l-171 -463l396 98q8 2 12 2q19 0 34 -15z" />
+    <glyph glyph-name="sitemap" unicode="&#xf0e8;" horiz-adv-x="1792" 
+d="M1792 288v-320q0 -40 -28 -68t-68 -28h-320q-40 0 -68 28t-28 68v320q0 40 28 68t68 28h96v192h-512v-192h96q40 0 68 -28t28 -68v-320q0 -40 -28 -68t-68 -28h-320q-40 0 -68 28t-28 68v320q0 40 28 68t68 28h96v192h-512v-192h96q40 0 68 -28t28 -68v-320
+q0 -40 -28 -68t-68 -28h-320q-40 0 -68 28t-28 68v320q0 40 28 68t68 28h96v192q0 52 38 90t90 38h512v192h-96q-40 0 -68 28t-28 68v320q0 40 28 68t68 28h320q40 0 68 -28t28 -68v-320q0 -40 -28 -68t-68 -28h-96v-192h512q52 0 90 -38t38 -90v-192h96q40 0 68 -28t28 -68
+z" />
+    <glyph glyph-name="umbrella" unicode="&#xf0e9;" horiz-adv-x="1664" 
+d="M896 708v-580q0 -104 -76 -180t-180 -76t-180 76t-76 180q0 26 19 45t45 19t45 -19t19 -45q0 -50 39 -89t89 -39t89 39t39 89v580q33 11 64 11t64 -11zM1664 681q0 -13 -9.5 -22.5t-22.5 -9.5q-11 0 -23 10q-49 46 -93 69t-102 23q-68 0 -128 -37t-103 -97
+q-7 -10 -17.5 -28t-14.5 -24q-11 -17 -28 -17q-18 0 -29 17q-4 6 -14.5 24t-17.5 28q-43 60 -102.5 97t-127.5 37t-127.5 -37t-102.5 -97q-7 -10 -17.5 -28t-14.5 -24q-11 -17 -29 -17q-17 0 -28 17q-4 6 -14.5 24t-17.5 28q-43 60 -103 97t-128 37q-58 0 -102 -23t-93 -69
+q-12 -10 -23 -10q-13 0 -22.5 9.5t-9.5 22.5q0 5 1 7q45 183 172.5 319.5t298 204.5t360.5 68q140 0 274.5 -40t246.5 -113.5t194.5 -187t115.5 -251.5q1 -2 1 -7zM896 1408v-98q-42 2 -64 2t-64 -2v98q0 26 19 45t45 19t45 -19t19 -45z" />
+    <glyph glyph-name="paste" unicode="&#xf0ea;" horiz-adv-x="1792" 
+d="M768 -128h896v640h-416q-40 0 -68 28t-28 68v416h-384v-1152zM1024 1312v64q0 13 -9.5 22.5t-22.5 9.5h-704q-13 0 -22.5 -9.5t-9.5 -22.5v-64q0 -13 9.5 -22.5t22.5 -9.5h704q13 0 22.5 9.5t9.5 22.5zM1280 640h299l-299 299v-299zM1792 512v-672q0 -40 -28 -68t-68 -28
+h-960q-40 0 -68 28t-28 68v160h-544q-40 0 -68 28t-28 68v1344q0 40 28 68t68 28h1088q40 0 68 -28t28 -68v-328q21 -13 36 -28l408 -408q28 -28 48 -76t20 -88z" />
+    <glyph glyph-name="light_bulb" unicode="&#xf0eb;" horiz-adv-x="1024" 
+d="M736 960q0 -13 -9.5 -22.5t-22.5 -9.5t-22.5 9.5t-9.5 22.5q0 46 -54 71t-106 25q-13 0 -22.5 9.5t-9.5 22.5t9.5 22.5t22.5 9.5q50 0 99.5 -16t87 -54t37.5 -90zM896 960q0 72 -34.5 134t-90 101.5t-123 62t-136.5 22.5t-136.5 -22.5t-123 -62t-90 -101.5t-34.5 -134
+q0 -101 68 -180q10 -11 30.5 -33t30.5 -33q128 -153 141 -298h228q13 145 141 298q10 11 30.5 33t30.5 33q68 79 68 180zM1024 960q0 -155 -103 -268q-45 -49 -74.5 -87t-59.5 -95.5t-34 -107.5q47 -28 47 -82q0 -37 -25 -64q25 -27 25 -64q0 -52 -45 -81q13 -23 13 -47
+q0 -46 -31.5 -71t-77.5 -25q-20 -44 -60 -70t-87 -26t-87 26t-60 70q-46 0 -77.5 25t-31.5 71q0 24 13 47q-45 29 -45 81q0 37 25 64q-25 27 -25 64q0 54 47 82q-4 50 -34 107.5t-59.5 95.5t-74.5 87q-103 113 -103 268q0 99 44.5 184.5t117 142t164 89t186.5 32.5
+t186.5 -32.5t164 -89t117 -142t44.5 -184.5z" />
+    <glyph glyph-name="exchange" unicode="&#xf0ec;" horiz-adv-x="1792" 
+d="M1792 352v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-1376v-192q0 -13 -9.5 -22.5t-22.5 -9.5q-12 0 -24 10l-319 320q-9 9 -9 22q0 14 9 23l320 320q9 9 23 9q13 0 22.5 -9.5t9.5 -22.5v-192h1376q13 0 22.5 -9.5t9.5 -22.5zM1792 896q0 -14 -9 -23l-320 -320q-9 -9 -23 -9
+q-13 0 -22.5 9.5t-9.5 22.5v192h-1376q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5t22.5 9.5h1376v192q0 14 9 23t23 9q12 0 24 -10l319 -319q9 -9 9 -23z" />
+    <glyph glyph-name="cloud_download" unicode="&#xf0ed;" horiz-adv-x="1920" 
+d="M1280 608q0 14 -9 23t-23 9h-224v352q0 13 -9.5 22.5t-22.5 9.5h-192q-13 0 -22.5 -9.5t-9.5 -22.5v-352h-224q-13 0 -22.5 -9.5t-9.5 -22.5q0 -14 9 -23l352 -352q9 -9 23 -9t23 9l351 351q10 12 10 24zM1920 384q0 -159 -112.5 -271.5t-271.5 -112.5h-1088
+q-185 0 -316.5 131.5t-131.5 316.5q0 130 70 240t188 165q-2 30 -2 43q0 212 150 362t362 150q156 0 285.5 -87t188.5 -231q71 62 166 62q106 0 181 -75t75 -181q0 -76 -41 -138q130 -31 213.5 -135.5t83.5 -238.5z" />
+    <glyph glyph-name="cloud_upload" unicode="&#xf0ee;" horiz-adv-x="1920" 
+d="M1280 672q0 14 -9 23l-352 352q-9 9 -23 9t-23 -9l-351 -351q-10 -12 -10 -24q0 -14 9 -23t23 -9h224v-352q0 -13 9.5 -22.5t22.5 -9.5h192q13 0 22.5 9.5t9.5 22.5v352h224q13 0 22.5 9.5t9.5 22.5zM1920 384q0 -159 -112.5 -271.5t-271.5 -112.5h-1088
+q-185 0 -316.5 131.5t-131.5 316.5q0 130 70 240t188 165q-2 30 -2 43q0 212 150 362t362 150q156 0 285.5 -87t188.5 -231q71 62 166 62q106 0 181 -75t75 -181q0 -76 -41 -138q130 -31 213.5 -135.5t83.5 -238.5z" />
+    <glyph glyph-name="user_md" unicode="&#xf0f0;" horiz-adv-x="1408" 
+d="M384 192q0 -26 -19 -45t-45 -19t-45 19t-19 45t19 45t45 19t45 -19t19 -45zM1408 131q0 -121 -73 -190t-194 -69h-874q-121 0 -194 69t-73 190q0 68 5.5 131t24 138t47.5 132.5t81 103t120 60.5q-22 -52 -22 -120v-203q-58 -20 -93 -70t-35 -111q0 -80 56 -136t136 -56
+t136 56t56 136q0 61 -35.5 111t-92.5 70v203q0 62 25 93q132 -104 295 -104t295 104q25 -31 25 -93v-64q-106 0 -181 -75t-75 -181v-89q-32 -29 -32 -71q0 -40 28 -68t68 -28t68 28t28 68q0 42 -32 71v89q0 52 38 90t90 38t90 -38t38 -90v-89q-32 -29 -32 -71q0 -40 28 -68
+t68 -28t68 28t28 68q0 42 -32 71v89q0 68 -34.5 127.5t-93.5 93.5q0 10 0.5 42.5t0 48t-2.5 41.5t-7 47t-13 40q68 -15 120 -60.5t81 -103t47.5 -132.5t24 -138t5.5 -131zM1088 1024q0 -159 -112.5 -271.5t-271.5 -112.5t-271.5 112.5t-112.5 271.5t112.5 271.5t271.5 112.5
+t271.5 -112.5t112.5 -271.5z" />
+    <glyph glyph-name="stethoscope" unicode="&#xf0f1;" horiz-adv-x="1408" 
+d="M1280 832q0 26 -19 45t-45 19t-45 -19t-19 -45t19 -45t45 -19t45 19t19 45zM1408 832q0 -62 -35.5 -111t-92.5 -70v-395q0 -159 -131.5 -271.5t-316.5 -112.5t-316.5 112.5t-131.5 271.5v132q-164 20 -274 128t-110 252v512q0 26 19 45t45 19q6 0 16 -2q17 30 47 48
+t65 18q53 0 90.5 -37.5t37.5 -90.5t-37.5 -90.5t-90.5 -37.5q-33 0 -64 18v-402q0 -106 94 -181t226 -75t226 75t94 181v402q-31 -18 -64 -18q-53 0 -90.5 37.5t-37.5 90.5t37.5 90.5t90.5 37.5q35 0 65 -18t47 -48q10 2 16 2q26 0 45 -19t19 -45v-512q0 -144 -110 -252
+t-274 -128v-132q0 -106 94 -181t226 -75t226 75t94 181v395q-57 21 -92.5 70t-35.5 111q0 80 56 136t136 56t136 -56t56 -136z" />
+    <glyph glyph-name="suitcase" unicode="&#xf0f2;" horiz-adv-x="1792" 
+d="M640 1152h512v128h-512v-128zM288 1152v-1280h-64q-92 0 -158 66t-66 158v832q0 92 66 158t158 66h64zM1408 1152v-1280h-1024v1280h128v160q0 40 28 68t68 28h576q40 0 68 -28t28 -68v-160h128zM1792 928v-832q0 -92 -66 -158t-158 -66h-64v1280h64q92 0 158 -66
+t66 -158z" />
+    <glyph glyph-name="bell_alt" unicode="&#xf0f3;" horiz-adv-x="1792" 
+d="M912 -160q0 16 -16 16q-59 0 -101.5 42.5t-42.5 101.5q0 16 -16 16t-16 -16q0 -73 51.5 -124.5t124.5 -51.5q16 0 16 16zM1728 128q0 -52 -38 -90t-90 -38h-448q0 -106 -75 -181t-181 -75t-181 75t-75 181h-448q-52 0 -90 38t-38 90q50 42 91 88t85 119.5t74.5 158.5
+t50 206t19.5 260q0 152 117 282.5t307 158.5q-8 19 -8 39q0 40 28 68t68 28t68 -28t28 -68q0 -20 -8 -39q190 -28 307 -158.5t117 -282.5q0 -139 19.5 -260t50 -206t74.5 -158.5t85 -119.5t91 -88z" />
+    <glyph glyph-name="coffee" unicode="&#xf0f4;" horiz-adv-x="1920" 
+d="M1664 896q0 80 -56 136t-136 56h-64v-384h64q80 0 136 56t56 136zM0 128h1792q0 -106 -75 -181t-181 -75h-1280q-106 0 -181 75t-75 181zM1856 896q0 -159 -112.5 -271.5t-271.5 -112.5h-64v-32q0 -92 -66 -158t-158 -66h-704q-92 0 -158 66t-66 158v736q0 26 19 45
+t45 19h1152q159 0 271.5 -112.5t112.5 -271.5z" />
+    <glyph glyph-name="food" unicode="&#xf0f5;" horiz-adv-x="1408" 
+d="M640 1472v-640q0 -61 -35.5 -111t-92.5 -70v-779q0 -52 -38 -90t-90 -38h-128q-52 0 -90 38t-38 90v779q-57 20 -92.5 70t-35.5 111v640q0 26 19 45t45 19t45 -19t19 -45v-416q0 -26 19 -45t45 -19t45 19t19 45v416q0 26 19 45t45 19t45 -19t19 -45v-416q0 -26 19 -45
+t45 -19t45 19t19 45v416q0 26 19 45t45 19t45 -19t19 -45zM1408 1472v-1600q0 -52 -38 -90t-90 -38h-128q-52 0 -90 38t-38 90v512h-224q-13 0 -22.5 9.5t-9.5 22.5v800q0 132 94 226t226 94h256q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="file_text_alt" unicode="&#xf0f6;" 
+d="M1468 1156q28 -28 48 -76t20 -88v-1152q0 -40 -28 -68t-68 -28h-1344q-40 0 -68 28t-28 68v1600q0 40 28 68t68 28h896q40 0 88 -20t76 -48zM1024 1400v-376h376q-10 29 -22 41l-313 313q-12 12 -41 22zM1408 -128v1024h-416q-40 0 -68 28t-28 68v416h-768v-1536h1280z
+M384 736q0 14 9 23t23 9h704q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-704q-14 0 -23 9t-9 23v64zM1120 512q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-704q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h704zM1120 256q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-704
+q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h704z" />
+    <glyph glyph-name="building" unicode="&#xf0f7;" horiz-adv-x="1408" 
+d="M384 224v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5zM384 480v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5z
+M640 480v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5zM384 736v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5z
+M1152 224v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5zM896 480v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5z
+M640 736v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5zM384 992v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5z
+M1152 480v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5zM896 736v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5z
+M640 992v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5zM384 1248v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5z
+M1152 736v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5zM896 992v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5z
+M640 1248v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5zM1152 992v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5z
+M896 1248v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5zM1152 1248v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5z
+M896 -128h384v1536h-1152v-1536h384v224q0 13 9.5 22.5t22.5 9.5h320q13 0 22.5 -9.5t9.5 -22.5v-224zM1408 1472v-1664q0 -26 -19 -45t-45 -19h-1280q-26 0 -45 19t-19 45v1664q0 26 19 45t45 19h1280q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="hospital" unicode="&#xf0f8;" horiz-adv-x="1408" 
+d="M384 224v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5zM384 480v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5z
+M640 480v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5zM384 736v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5z
+M1152 224v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5zM896 480v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5z
+M640 736v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5zM1152 480v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5z
+M896 736v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5zM1152 736v-64q0 -13 -9.5 -22.5t-22.5 -9.5h-64q-13 0 -22.5 9.5t-9.5 22.5v64q0 13 9.5 22.5t22.5 9.5h64q13 0 22.5 -9.5t9.5 -22.5z
+M896 -128h384v1152h-256v-32q0 -40 -28 -68t-68 -28h-448q-40 0 -68 28t-28 68v32h-256v-1152h384v224q0 13 9.5 22.5t22.5 9.5h320q13 0 22.5 -9.5t9.5 -22.5v-224zM896 1056v320q0 13 -9.5 22.5t-22.5 9.5h-64q-13 0 -22.5 -9.5t-9.5 -22.5v-96h-128v96q0 13 -9.5 22.5
+t-22.5 9.5h-64q-13 0 -22.5 -9.5t-9.5 -22.5v-320q0 -13 9.5 -22.5t22.5 -9.5h64q13 0 22.5 9.5t9.5 22.5v96h128v-96q0 -13 9.5 -22.5t22.5 -9.5h64q13 0 22.5 9.5t9.5 22.5zM1408 1088v-1280q0 -26 -19 -45t-45 -19h-1280q-26 0 -45 19t-19 45v1280q0 26 19 45t45 19h320
+v288q0 40 28 68t68 28h448q40 0 68 -28t28 -68v-288h320q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="ambulance" unicode="&#xf0f9;" horiz-adv-x="1920" 
+d="M640 128q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM256 640h384v256h-158q-14 -2 -22 -9l-195 -195q-7 -12 -9 -22v-30zM1536 128q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5
+t90.5 37.5t37.5 90.5zM1664 800v192q0 14 -9 23t-23 9h-224v224q0 14 -9 23t-23 9h-192q-14 0 -23 -9t-9 -23v-224h-224q-14 0 -23 -9t-9 -23v-192q0 -14 9 -23t23 -9h224v-224q0 -14 9 -23t23 -9h192q14 0 23 9t9 23v224h224q14 0 23 9t9 23zM1920 1344v-1152
+q0 -26 -19 -45t-45 -19h-192q0 -106 -75 -181t-181 -75t-181 75t-75 181h-384q0 -106 -75 -181t-181 -75t-181 75t-75 181h-128q-26 0 -45 19t-19 45t19 45t45 19v416q0 26 13 58t32 51l198 198q19 19 51 32t58 13h160v320q0 26 19 45t45 19h1152q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="medkit" unicode="&#xf0fa;" horiz-adv-x="1792" 
+d="M1280 416v192q0 14 -9 23t-23 9h-224v224q0 14 -9 23t-23 9h-192q-14 0 -23 -9t-9 -23v-224h-224q-14 0 -23 -9t-9 -23v-192q0 -14 9 -23t23 -9h224v-224q0 -14 9 -23t23 -9h192q14 0 23 9t9 23v224h224q14 0 23 9t9 23zM640 1152h512v128h-512v-128zM256 1152v-1280h-32
+q-92 0 -158 66t-66 158v832q0 92 66 158t158 66h32zM1440 1152v-1280h-1088v1280h160v160q0 40 28 68t68 28h576q40 0 68 -28t28 -68v-160h160zM1792 928v-832q0 -92 -66 -158t-158 -66h-32v1280h32q92 0 158 -66t66 -158z" />
+    <glyph glyph-name="fighter_jet" unicode="&#xf0fb;" horiz-adv-x="1920" 
+d="M1920 576q-1 -32 -288 -96l-352 -32l-224 -64h-64l-293 -352h69q26 0 45 -4.5t19 -11.5t-19 -11.5t-45 -4.5h-96h-160h-64v32h64v416h-160l-192 -224h-96l-32 32v192h32v32h128v8l-192 24v128l192 24v8h-128v32h-32v192l32 32h96l192 -224h160v416h-64v32h64h160h96
+q26 0 45 -4.5t19 -11.5t-19 -11.5t-45 -4.5h-69l293 -352h64l224 -64l352 -32q128 -28 200 -52t80 -34z" />
+    <glyph glyph-name="beer" unicode="&#xf0fc;" horiz-adv-x="1664" 
+d="M640 640v384h-256v-256q0 -53 37.5 -90.5t90.5 -37.5h128zM1664 192v-192h-1152v192l128 192h-128q-159 0 -271.5 112.5t-112.5 271.5v320l-64 64l32 128h480l32 128h960l32 -192l-64 -32v-800z" />
+    <glyph glyph-name="h_sign" unicode="&#xf0fd;" 
+d="M1280 192v896q0 26 -19 45t-45 19h-128q-26 0 -45 -19t-19 -45v-320h-512v320q0 26 -19 45t-45 19h-128q-26 0 -45 -19t-19 -45v-896q0 -26 19 -45t45 -19h128q26 0 45 19t19 45v320h512v-320q0 -26 19 -45t45 -19h128q26 0 45 19t19 45zM1536 1120v-960
+q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="f0fe" unicode="&#xf0fe;" 
+d="M1280 576v128q0 26 -19 45t-45 19h-320v320q0 26 -19 45t-45 19h-128q-26 0 -45 -19t-19 -45v-320h-320q-26 0 -45 -19t-19 -45v-128q0 -26 19 -45t45 -19h320v-320q0 -26 19 -45t45 -19h128q26 0 45 19t19 45v320h320q26 0 45 19t19 45zM1536 1120v-960
+q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="double_angle_left" unicode="&#xf100;" horiz-adv-x="1024" 
+d="M627 160q0 -13 -10 -23l-50 -50q-10 -10 -23 -10t-23 10l-466 466q-10 10 -10 23t10 23l466 466q10 10 23 10t23 -10l50 -50q10 -10 10 -23t-10 -23l-393 -393l393 -393q10 -10 10 -23zM1011 160q0 -13 -10 -23l-50 -50q-10 -10 -23 -10t-23 10l-466 466q-10 10 -10 23
+t10 23l466 466q10 10 23 10t23 -10l50 -50q10 -10 10 -23t-10 -23l-393 -393l393 -393q10 -10 10 -23z" />
+    <glyph glyph-name="double_angle_right" unicode="&#xf101;" horiz-adv-x="1024" 
+d="M595 576q0 -13 -10 -23l-466 -466q-10 -10 -23 -10t-23 10l-50 50q-10 10 -10 23t10 23l393 393l-393 393q-10 10 -10 23t10 23l50 50q10 10 23 10t23 -10l466 -466q10 -10 10 -23zM979 576q0 -13 -10 -23l-466 -466q-10 -10 -23 -10t-23 10l-50 50q-10 10 -10 23t10 23
+l393 393l-393 393q-10 10 -10 23t10 23l50 50q10 10 23 10t23 -10l466 -466q10 -10 10 -23z" />
+    <glyph glyph-name="double_angle_up" unicode="&#xf102;" horiz-adv-x="1152" 
+d="M1075 224q0 -13 -10 -23l-50 -50q-10 -10 -23 -10t-23 10l-393 393l-393 -393q-10 -10 -23 -10t-23 10l-50 50q-10 10 -10 23t10 23l466 466q10 10 23 10t23 -10l466 -466q10 -10 10 -23zM1075 608q0 -13 -10 -23l-50 -50q-10 -10 -23 -10t-23 10l-393 393l-393 -393
+q-10 -10 -23 -10t-23 10l-50 50q-10 10 -10 23t10 23l466 466q10 10 23 10t23 -10l466 -466q10 -10 10 -23z" />
+    <glyph glyph-name="double_angle_down" unicode="&#xf103;" horiz-adv-x="1152" 
+d="M1075 672q0 -13 -10 -23l-466 -466q-10 -10 -23 -10t-23 10l-466 466q-10 10 -10 23t10 23l50 50q10 10 23 10t23 -10l393 -393l393 393q10 10 23 10t23 -10l50 -50q10 -10 10 -23zM1075 1056q0 -13 -10 -23l-466 -466q-10 -10 -23 -10t-23 10l-466 466q-10 10 -10 23
+t10 23l50 50q10 10 23 10t23 -10l393 -393l393 393q10 10 23 10t23 -10l50 -50q10 -10 10 -23z" />
+    <glyph glyph-name="angle_left" unicode="&#xf104;" horiz-adv-x="640" 
+d="M627 992q0 -13 -10 -23l-393 -393l393 -393q10 -10 10 -23t-10 -23l-50 -50q-10 -10 -23 -10t-23 10l-466 466q-10 10 -10 23t10 23l466 466q10 10 23 10t23 -10l50 -50q10 -10 10 -23z" />
+    <glyph glyph-name="angle_right" unicode="&#xf105;" horiz-adv-x="640" 
+d="M595 576q0 -13 -10 -23l-466 -466q-10 -10 -23 -10t-23 10l-50 50q-10 10 -10 23t10 23l393 393l-393 393q-10 10 -10 23t10 23l50 50q10 10 23 10t23 -10l466 -466q10 -10 10 -23z" />
+    <glyph glyph-name="angle_up" unicode="&#xf106;" horiz-adv-x="1152" 
+d="M1075 352q0 -13 -10 -23l-50 -50q-10 -10 -23 -10t-23 10l-393 393l-393 -393q-10 -10 -23 -10t-23 10l-50 50q-10 10 -10 23t10 23l466 466q10 10 23 10t23 -10l466 -466q10 -10 10 -23z" />
+    <glyph glyph-name="angle_down" unicode="&#xf107;" horiz-adv-x="1152" 
+d="M1075 800q0 -13 -10 -23l-466 -466q-10 -10 -23 -10t-23 10l-466 466q-10 10 -10 23t10 23l50 50q10 10 23 10t23 -10l393 -393l393 393q10 10 23 10t23 -10l50 -50q10 -10 10 -23z" />
+    <glyph glyph-name="desktop" unicode="&#xf108;" horiz-adv-x="1920" 
+d="M1792 544v832q0 13 -9.5 22.5t-22.5 9.5h-1600q-13 0 -22.5 -9.5t-9.5 -22.5v-832q0 -13 9.5 -22.5t22.5 -9.5h1600q13 0 22.5 9.5t9.5 22.5zM1920 1376v-1088q0 -66 -47 -113t-113 -47h-544q0 -37 16 -77.5t32 -71t16 -43.5q0 -26 -19 -45t-45 -19h-512q-26 0 -45 19
+t-19 45q0 14 16 44t32 70t16 78h-544q-66 0 -113 47t-47 113v1088q0 66 47 113t113 47h1600q66 0 113 -47t47 -113z" />
+    <glyph glyph-name="laptop" unicode="&#xf109;" horiz-adv-x="1920" 
+d="M416 256q-66 0 -113 47t-47 113v704q0 66 47 113t113 47h1088q66 0 113 -47t47 -113v-704q0 -66 -47 -113t-113 -47h-1088zM384 1120v-704q0 -13 9.5 -22.5t22.5 -9.5h1088q13 0 22.5 9.5t9.5 22.5v704q0 13 -9.5 22.5t-22.5 9.5h-1088q-13 0 -22.5 -9.5t-9.5 -22.5z
+M1760 192h160v-96q0 -40 -47 -68t-113 -28h-1600q-66 0 -113 28t-47 68v96h160h1600zM1040 96q16 0 16 16t-16 16h-160q-16 0 -16 -16t16 -16h160z" />
+    <glyph glyph-name="tablet" unicode="&#xf10a;" horiz-adv-x="1152" 
+d="M640 128q0 26 -19 45t-45 19t-45 -19t-19 -45t19 -45t45 -19t45 19t19 45zM1024 288v960q0 13 -9.5 22.5t-22.5 9.5h-832q-13 0 -22.5 -9.5t-9.5 -22.5v-960q0 -13 9.5 -22.5t22.5 -9.5h832q13 0 22.5 9.5t9.5 22.5zM1152 1248v-1088q0 -66 -47 -113t-113 -47h-832
+q-66 0 -113 47t-47 113v1088q0 66 47 113t113 47h832q66 0 113 -47t47 -113z" />
+    <glyph glyph-name="mobile_phone" unicode="&#xf10b;" horiz-adv-x="768" 
+d="M464 128q0 33 -23.5 56.5t-56.5 23.5t-56.5 -23.5t-23.5 -56.5t23.5 -56.5t56.5 -23.5t56.5 23.5t23.5 56.5zM672 288v704q0 13 -9.5 22.5t-22.5 9.5h-512q-13 0 -22.5 -9.5t-9.5 -22.5v-704q0 -13 9.5 -22.5t22.5 -9.5h512q13 0 22.5 9.5t9.5 22.5zM480 1136
+q0 16 -16 16h-160q-16 0 -16 -16t16 -16h160q16 0 16 16zM768 1152v-1024q0 -52 -38 -90t-90 -38h-512q-52 0 -90 38t-38 90v1024q0 52 38 90t90 38h512q52 0 90 -38t38 -90z" />
+    <glyph glyph-name="circle_blank" unicode="&#xf10c;" 
+d="M768 1184q-148 0 -273 -73t-198 -198t-73 -273t73 -273t198 -198t273 -73t273 73t198 198t73 273t-73 273t-198 198t-273 73zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103
+t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="quote_left" unicode="&#xf10d;" horiz-adv-x="1664" 
+d="M768 576v-384q0 -80 -56 -136t-136 -56h-384q-80 0 -136 56t-56 136v704q0 104 40.5 198.5t109.5 163.5t163.5 109.5t198.5 40.5h64q26 0 45 -19t19 -45v-128q0 -26 -19 -45t-45 -19h-64q-106 0 -181 -75t-75 -181v-32q0 -40 28 -68t68 -28h224q80 0 136 -56t56 -136z
+M1664 576v-384q0 -80 -56 -136t-136 -56h-384q-80 0 -136 56t-56 136v704q0 104 40.5 198.5t109.5 163.5t163.5 109.5t198.5 40.5h64q26 0 45 -19t19 -45v-128q0 -26 -19 -45t-45 -19h-64q-106 0 -181 -75t-75 -181v-32q0 -40 28 -68t68 -28h224q80 0 136 -56t56 -136z" />
+    <glyph glyph-name="quote_right" unicode="&#xf10e;" horiz-adv-x="1664" 
+d="M768 1216v-704q0 -104 -40.5 -198.5t-109.5 -163.5t-163.5 -109.5t-198.5 -40.5h-64q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h64q106 0 181 75t75 181v32q0 40 -28 68t-68 28h-224q-80 0 -136 56t-56 136v384q0 80 56 136t136 56h384q80 0 136 -56t56 -136zM1664 1216
+v-704q0 -104 -40.5 -198.5t-109.5 -163.5t-163.5 -109.5t-198.5 -40.5h-64q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h64q106 0 181 75t75 181v32q0 40 -28 68t-68 28h-224q-80 0 -136 56t-56 136v384q0 80 56 136t136 56h384q80 0 136 -56t56 -136z" />
+    <glyph glyph-name="spinner" unicode="&#xf110;" horiz-adv-x="1792" 
+d="M526 142q0 -53 -37.5 -90.5t-90.5 -37.5q-52 0 -90 38t-38 90q0 53 37.5 90.5t90.5 37.5t90.5 -37.5t37.5 -90.5zM1024 -64q0 -53 -37.5 -90.5t-90.5 -37.5t-90.5 37.5t-37.5 90.5t37.5 90.5t90.5 37.5t90.5 -37.5t37.5 -90.5zM320 640q0 -53 -37.5 -90.5t-90.5 -37.5
+t-90.5 37.5t-37.5 90.5t37.5 90.5t90.5 37.5t90.5 -37.5t37.5 -90.5zM1522 142q0 -52 -38 -90t-90 -38q-53 0 -90.5 37.5t-37.5 90.5t37.5 90.5t90.5 37.5t90.5 -37.5t37.5 -90.5zM558 1138q0 -66 -47 -113t-113 -47t-113 47t-47 113t47 113t113 47t113 -47t47 -113z
+M1728 640q0 -53 -37.5 -90.5t-90.5 -37.5t-90.5 37.5t-37.5 90.5t37.5 90.5t90.5 37.5t90.5 -37.5t37.5 -90.5zM1088 1344q0 -80 -56 -136t-136 -56t-136 56t-56 136t56 136t136 56t136 -56t56 -136zM1618 1138q0 -93 -66 -158.5t-158 -65.5q-93 0 -158.5 65.5t-65.5 158.5
+q0 92 65.5 158t158.5 66q92 0 158 -66t66 -158z" />
+    <glyph glyph-name="circle" unicode="&#xf111;" 
+d="M1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="reply" unicode="&#xf112;" horiz-adv-x="1792" 
+d="M1792 416q0 -166 -127 -451q-3 -7 -10.5 -24t-13.5 -30t-13 -22q-12 -17 -28 -17q-15 0 -23.5 10t-8.5 25q0 9 2.5 26.5t2.5 23.5q5 68 5 123q0 101 -17.5 181t-48.5 138.5t-80 101t-105.5 69.5t-133 42.5t-154 21.5t-175.5 6h-224v-256q0 -26 -19 -45t-45 -19t-45 19
+l-512 512q-19 19 -19 45t19 45l512 512q19 19 45 19t45 -19t19 -45v-256h224q713 0 875 -403q53 -134 53 -333z" />
+    <glyph glyph-name="github_alt" unicode="&#xf113;" horiz-adv-x="1664" 
+d="M640 320q0 -40 -12.5 -82t-43 -76t-72.5 -34t-72.5 34t-43 76t-12.5 82t12.5 82t43 76t72.5 34t72.5 -34t43 -76t12.5 -82zM1280 320q0 -40 -12.5 -82t-43 -76t-72.5 -34t-72.5 34t-43 76t-12.5 82t12.5 82t43 76t72.5 34t72.5 -34t43 -76t12.5 -82zM1440 320
+q0 120 -69 204t-187 84q-41 0 -195 -21q-71 -11 -157 -11t-157 11q-152 21 -195 21q-118 0 -187 -84t-69 -204q0 -88 32 -153.5t81 -103t122 -60t140 -29.5t149 -7h168q82 0 149 7t140 29.5t122 60t81 103t32 153.5zM1664 496q0 -207 -61 -331q-38 -77 -105.5 -133t-141 -86
+t-170 -47.5t-171.5 -22t-167 -4.5q-78 0 -142 3t-147.5 12.5t-152.5 30t-137 51.5t-121 81t-86 115q-62 123 -62 331q0 237 136 396q-27 82 -27 170q0 116 51 218q108 0 190 -39.5t189 -123.5q147 35 309 35q148 0 280 -32q105 82 187 121t189 39q51 -102 51 -218
+q0 -87 -27 -168q136 -160 136 -398z" />
+    <glyph glyph-name="folder_close_alt" unicode="&#xf114;" horiz-adv-x="1664" 
+d="M1536 224v704q0 40 -28 68t-68 28h-704q-40 0 -68 28t-28 68v64q0 40 -28 68t-68 28h-320q-40 0 -68 -28t-28 -68v-960q0 -40 28 -68t68 -28h1216q40 0 68 28t28 68zM1664 928v-704q0 -92 -66 -158t-158 -66h-1216q-92 0 -158 66t-66 158v960q0 92 66 158t158 66h320
+q92 0 158 -66t66 -158v-32h672q92 0 158 -66t66 -158z" />
+    <glyph glyph-name="folder_open_alt" unicode="&#xf115;" horiz-adv-x="1920" 
+d="M1781 605q0 35 -53 35h-1088q-40 0 -85.5 -21.5t-71.5 -52.5l-294 -363q-18 -24 -18 -40q0 -35 53 -35h1088q40 0 86 22t71 53l294 363q18 22 18 39zM640 768h768v160q0 40 -28 68t-68 28h-576q-40 0 -68 28t-28 68v64q0 40 -28 68t-68 28h-320q-40 0 -68 -28t-28 -68
+v-853l256 315q44 53 116 87.5t140 34.5zM1909 605q0 -62 -46 -120l-295 -363q-43 -53 -116 -87.5t-140 -34.5h-1088q-92 0 -158 66t-66 158v960q0 92 66 158t158 66h320q92 0 158 -66t66 -158v-32h544q92 0 158 -66t66 -158v-160h192q54 0 99 -24.5t67 -70.5q15 -32 15 -68z
+" />
+    <glyph glyph-name="expand_alt" unicode="&#xf116;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="collapse_alt" unicode="&#xf117;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="smile" unicode="&#xf118;" 
+d="M1134 461q-37 -121 -138 -195t-228 -74t-228 74t-138 195q-8 25 4 48.5t38 31.5q25 8 48.5 -4t31.5 -38q25 -80 92.5 -129.5t151.5 -49.5t151.5 49.5t92.5 129.5q8 26 32 38t49 4t37 -31.5t4 -48.5zM640 896q0 -53 -37.5 -90.5t-90.5 -37.5t-90.5 37.5t-37.5 90.5
+t37.5 90.5t90.5 37.5t90.5 -37.5t37.5 -90.5zM1152 896q0 -53 -37.5 -90.5t-90.5 -37.5t-90.5 37.5t-37.5 90.5t37.5 90.5t90.5 37.5t90.5 -37.5t37.5 -90.5zM1408 640q0 130 -51 248.5t-136.5 204t-204 136.5t-248.5 51t-248.5 -51t-204 -136.5t-136.5 -204t-51 -248.5
+t51 -248.5t136.5 -204t204 -136.5t248.5 -51t248.5 51t204 136.5t136.5 204t51 248.5zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="frown" unicode="&#xf119;" 
+d="M1134 307q8 -25 -4 -48.5t-37 -31.5t-49 4t-32 38q-25 80 -92.5 129.5t-151.5 49.5t-151.5 -49.5t-92.5 -129.5q-8 -26 -31.5 -38t-48.5 -4q-26 8 -38 31.5t-4 48.5q37 121 138 195t228 74t228 -74t138 -195zM640 896q0 -53 -37.5 -90.5t-90.5 -37.5t-90.5 37.5
+t-37.5 90.5t37.5 90.5t90.5 37.5t90.5 -37.5t37.5 -90.5zM1152 896q0 -53 -37.5 -90.5t-90.5 -37.5t-90.5 37.5t-37.5 90.5t37.5 90.5t90.5 37.5t90.5 -37.5t37.5 -90.5zM1408 640q0 130 -51 248.5t-136.5 204t-204 136.5t-248.5 51t-248.5 -51t-204 -136.5t-136.5 -204
+t-51 -248.5t51 -248.5t136.5 -204t204 -136.5t248.5 -51t248.5 51t204 136.5t136.5 204t51 248.5zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="meh" unicode="&#xf11a;" 
+d="M1152 448q0 -26 -19 -45t-45 -19h-640q-26 0 -45 19t-19 45t19 45t45 19h640q26 0 45 -19t19 -45zM640 896q0 -53 -37.5 -90.5t-90.5 -37.5t-90.5 37.5t-37.5 90.5t37.5 90.5t90.5 37.5t90.5 -37.5t37.5 -90.5zM1152 896q0 -53 -37.5 -90.5t-90.5 -37.5t-90.5 37.5
+t-37.5 90.5t37.5 90.5t90.5 37.5t90.5 -37.5t37.5 -90.5zM1408 640q0 130 -51 248.5t-136.5 204t-204 136.5t-248.5 51t-248.5 -51t-204 -136.5t-136.5 -204t-51 -248.5t51 -248.5t136.5 -204t204 -136.5t248.5 -51t248.5 51t204 136.5t136.5 204t51 248.5zM1536 640
+q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="gamepad" unicode="&#xf11b;" horiz-adv-x="1920" 
+d="M832 448v128q0 14 -9 23t-23 9h-192v192q0 14 -9 23t-23 9h-128q-14 0 -23 -9t-9 -23v-192h-192q-14 0 -23 -9t-9 -23v-128q0 -14 9 -23t23 -9h192v-192q0 -14 9 -23t23 -9h128q14 0 23 9t9 23v192h192q14 0 23 9t9 23zM1408 384q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5
+t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM1664 640q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM1920 512q0 -212 -150 -362t-362 -150q-192 0 -338 128h-220q-146 -128 -338 -128q-212 0 -362 150
+t-150 362t150 362t362 150h896q212 0 362 -150t150 -362z" />
+    <glyph glyph-name="keyboard" unicode="&#xf11c;" horiz-adv-x="1920" 
+d="M384 368v-96q0 -16 -16 -16h-96q-16 0 -16 16v96q0 16 16 16h96q16 0 16 -16zM512 624v-96q0 -16 -16 -16h-224q-16 0 -16 16v96q0 16 16 16h224q16 0 16 -16zM384 880v-96q0 -16 -16 -16h-96q-16 0 -16 16v96q0 16 16 16h96q16 0 16 -16zM1408 368v-96q0 -16 -16 -16
+h-864q-16 0 -16 16v96q0 16 16 16h864q16 0 16 -16zM768 624v-96q0 -16 -16 -16h-96q-16 0 -16 16v96q0 16 16 16h96q16 0 16 -16zM640 880v-96q0 -16 -16 -16h-96q-16 0 -16 16v96q0 16 16 16h96q16 0 16 -16zM1024 624v-96q0 -16 -16 -16h-96q-16 0 -16 16v96q0 16 16 16
+h96q16 0 16 -16zM896 880v-96q0 -16 -16 -16h-96q-16 0 -16 16v96q0 16 16 16h96q16 0 16 -16zM1280 624v-96q0 -16 -16 -16h-96q-16 0 -16 16v96q0 16 16 16h96q16 0 16 -16zM1664 368v-96q0 -16 -16 -16h-96q-16 0 -16 16v96q0 16 16 16h96q16 0 16 -16zM1152 880v-96
+q0 -16 -16 -16h-96q-16 0 -16 16v96q0 16 16 16h96q16 0 16 -16zM1408 880v-96q0 -16 -16 -16h-96q-16 0 -16 16v96q0 16 16 16h96q16 0 16 -16zM1664 880v-352q0 -16 -16 -16h-224q-16 0 -16 16v96q0 16 16 16h112v240q0 16 16 16h96q16 0 16 -16zM1792 128v896h-1664v-896
+h1664zM1920 1024v-896q0 -53 -37.5 -90.5t-90.5 -37.5h-1664q-53 0 -90.5 37.5t-37.5 90.5v896q0 53 37.5 90.5t90.5 37.5h1664q53 0 90.5 -37.5t37.5 -90.5z" />
+    <glyph glyph-name="flag_alt" unicode="&#xf11d;" horiz-adv-x="1792" 
+d="M1664 491v616q-169 -91 -306 -91q-82 0 -145 32q-100 49 -184 76.5t-178 27.5q-173 0 -403 -127v-599q245 113 433 113q55 0 103.5 -7.5t98 -26t77 -31t82.5 -39.5l28 -14q44 -22 101 -22q120 0 293 92zM320 1280q0 -35 -17.5 -64t-46.5 -46v-1266q0 -14 -9 -23t-23 -9
+h-64q-14 0 -23 9t-9 23v1266q-29 17 -46.5 46t-17.5 64q0 53 37.5 90.5t90.5 37.5t90.5 -37.5t37.5 -90.5zM1792 1216v-763q0 -39 -35 -57q-10 -5 -17 -9q-218 -116 -369 -116q-88 0 -158 35l-28 14q-64 33 -99 48t-91 29t-114 14q-102 0 -235.5 -44t-228.5 -102
+q-15 -9 -33 -9q-16 0 -32 8q-32 19 -32 56v742q0 35 31 55q35 21 78.5 42.5t114 52t152.5 49.5t155 19q112 0 209 -31t209 -86q38 -19 89 -19q122 0 310 112q22 12 31 17q31 16 62 -2q31 -20 31 -55z" />
+    <glyph glyph-name="flag_checkered" unicode="&#xf11e;" horiz-adv-x="1792" 
+d="M832 536v192q-181 -16 -384 -117v-185q205 96 384 110zM832 954v197q-172 -8 -384 -126v-189q215 111 384 118zM1664 491v184q-235 -116 -384 -71v224q-20 6 -39 15q-5 3 -33 17t-34.5 17t-31.5 15t-34.5 15.5t-32.5 13t-36 12.5t-35 8.5t-39.5 7.5t-39.5 4t-44 2
+q-23 0 -49 -3v-222h19q102 0 192.5 -29t197.5 -82q19 -9 39 -15v-188q42 -17 91 -17q120 0 293 92zM1664 918v189q-169 -91 -306 -91q-45 0 -78 8v-196q148 -42 384 90zM320 1280q0 -35 -17.5 -64t-46.5 -46v-1266q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v1266
+q-29 17 -46.5 46t-17.5 64q0 53 37.5 90.5t90.5 37.5t90.5 -37.5t37.5 -90.5zM1792 1216v-763q0 -39 -35 -57q-10 -5 -17 -9q-218 -116 -369 -116q-88 0 -158 35l-28 14q-64 33 -99 48t-91 29t-114 14q-102 0 -235.5 -44t-228.5 -102q-15 -9 -33 -9q-16 0 -32 8
+q-32 19 -32 56v742q0 35 31 55q35 21 78.5 42.5t114 52t152.5 49.5t155 19q112 0 209 -31t209 -86q38 -19 89 -19q122 0 310 112q22 12 31 17q31 16 62 -2q31 -20 31 -55z" />
+    <glyph glyph-name="terminal" unicode="&#xf120;" horiz-adv-x="1664" 
+d="M585 553l-466 -466q-10 -10 -23 -10t-23 10l-50 50q-10 10 -10 23t10 23l393 393l-393 393q-10 10 -10 23t10 23l50 50q10 10 23 10t23 -10l466 -466q10 -10 10 -23t-10 -23zM1664 96v-64q0 -14 -9 -23t-23 -9h-960q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h960q14 0 23 -9
+t9 -23z" />
+    <glyph glyph-name="code" unicode="&#xf121;" horiz-adv-x="1920" 
+d="M617 137l-50 -50q-10 -10 -23 -10t-23 10l-466 466q-10 10 -10 23t10 23l466 466q10 10 23 10t23 -10l50 -50q10 -10 10 -23t-10 -23l-393 -393l393 -393q10 -10 10 -23t-10 -23zM1208 1204l-373 -1291q-4 -13 -15.5 -19.5t-23.5 -2.5l-62 17q-13 4 -19.5 15.5t-2.5 24.5
+l373 1291q4 13 15.5 19.5t23.5 2.5l62 -17q13 -4 19.5 -15.5t2.5 -24.5zM1865 553l-466 -466q-10 -10 -23 -10t-23 10l-50 50q-10 10 -10 23t10 23l393 393l-393 393q-10 10 -10 23t10 23l50 50q10 10 23 10t23 -10l466 -466q10 -10 10 -23t-10 -23z" />
+    <glyph glyph-name="reply_all" unicode="&#xf122;" horiz-adv-x="1792" 
+d="M640 454v-70q0 -42 -39 -59q-13 -5 -25 -5q-27 0 -45 19l-512 512q-19 19 -19 45t19 45l512 512q29 31 70 14q39 -17 39 -59v-69l-397 -398q-19 -19 -19 -45t19 -45zM1792 416q0 -58 -17 -133.5t-38.5 -138t-48 -125t-40.5 -90.5l-20 -40q-8 -17 -28 -17q-6 0 -9 1
+q-25 8 -23 34q43 400 -106 565q-64 71 -170.5 110.5t-267.5 52.5v-251q0 -42 -39 -59q-13 -5 -25 -5q-27 0 -45 19l-512 512q-19 19 -19 45t19 45l512 512q29 31 70 14q39 -17 39 -59v-262q411 -28 599 -221q169 -173 169 -509z" />
+    <glyph glyph-name="star_half_empty" unicode="&#xf123;" horiz-adv-x="1664" 
+d="M1186 579l257 250l-356 52l-66 10l-30 60l-159 322v-963l59 -31l318 -168l-60 355l-12 66zM1638 841l-363 -354l86 -500q5 -33 -6 -51.5t-34 -18.5q-17 0 -40 12l-449 236l-449 -236q-23 -12 -40 -12q-23 0 -34 18.5t-6 51.5l86 500l-364 354q-32 32 -23 59.5t54 34.5
+l502 73l225 455q20 41 49 41q28 0 49 -41l225 -455l502 -73q45 -7 54 -34.5t-24 -59.5z" />
+    <glyph glyph-name="location_arrow" unicode="&#xf124;" horiz-adv-x="1408" 
+d="M1401 1187l-640 -1280q-17 -35 -57 -35q-5 0 -15 2q-22 5 -35.5 22.5t-13.5 39.5v576h-576q-22 0 -39.5 13.5t-22.5 35.5t4 42t29 30l1280 640q13 7 29 7q27 0 45 -19q15 -14 18.5 -34.5t-6.5 -39.5z" />
+    <glyph glyph-name="crop" unicode="&#xf125;" horiz-adv-x="1664" 
+d="M557 256h595v595zM512 301l595 595h-595v-595zM1664 224v-192q0 -14 -9 -23t-23 -9h-224v-224q0 -14 -9 -23t-23 -9h-192q-14 0 -23 9t-9 23v224h-864q-14 0 -23 9t-9 23v864h-224q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h224v224q0 14 9 23t23 9h192q14 0 23 -9t9 -23
+v-224h851l246 247q10 9 23 9t23 -9q9 -10 9 -23t-9 -23l-247 -246v-851h224q14 0 23 -9t9 -23z" />
+    <glyph glyph-name="code_fork" unicode="&#xf126;" horiz-adv-x="1024" 
+d="M288 64q0 40 -28 68t-68 28t-68 -28t-28 -68t28 -68t68 -28t68 28t28 68zM288 1216q0 40 -28 68t-68 28t-68 -28t-28 -68t28 -68t68 -28t68 28t28 68zM928 1088q0 40 -28 68t-68 28t-68 -28t-28 -68t28 -68t68 -28t68 28t28 68zM1024 1088q0 -52 -26 -96.5t-70 -69.5
+q-2 -287 -226 -414q-67 -38 -203 -81q-128 -40 -169.5 -71t-41.5 -100v-26q44 -25 70 -69.5t26 -96.5q0 -80 -56 -136t-136 -56t-136 56t-56 136q0 52 26 96.5t70 69.5v820q-44 25 -70 69.5t-26 96.5q0 80 56 136t136 56t136 -56t56 -136q0 -52 -26 -96.5t-70 -69.5v-497
+q54 26 154 57q55 17 87.5 29.5t70.5 31t59 39.5t40.5 51t28 69.5t8.5 91.5q-44 25 -70 69.5t-26 96.5q0 80 56 136t136 56t136 -56t56 -136z" />
+    <glyph glyph-name="unlink" unicode="&#xf127;" horiz-adv-x="1664" 
+d="M439 265l-256 -256q-11 -9 -23 -9t-23 9q-9 10 -9 23t9 23l256 256q10 9 23 9t23 -9q9 -10 9 -23t-9 -23zM608 224v-320q0 -14 -9 -23t-23 -9t-23 9t-9 23v320q0 14 9 23t23 9t23 -9t9 -23zM384 448q0 -14 -9 -23t-23 -9h-320q-14 0 -23 9t-9 23t9 23t23 9h320
+q14 0 23 -9t9 -23zM1648 320q0 -120 -85 -203l-147 -146q-83 -83 -203 -83q-121 0 -204 85l-334 335q-21 21 -42 56l239 18l273 -274q27 -27 68 -27.5t68 26.5l147 146q28 28 28 67q0 40 -28 68l-274 275l18 239q35 -21 56 -42l336 -336q84 -86 84 -204zM1031 1044l-239 -18
+l-273 274q-28 28 -68 28q-39 0 -68 -27l-147 -146q-28 -28 -28 -67q0 -40 28 -68l274 -274l-18 -240q-35 21 -56 42l-336 336q-84 86 -84 204q0 120 85 203l147 146q83 83 203 83q121 0 204 -85l334 -335q21 -21 42 -56zM1664 960q0 -14 -9 -23t-23 -9h-320q-14 0 -23 9
+t-9 23t9 23t23 9h320q14 0 23 -9t9 -23zM1120 1504v-320q0 -14 -9 -23t-23 -9t-23 9t-9 23v320q0 14 9 23t23 9t23 -9t9 -23zM1527 1353l-256 -256q-11 -9 -23 -9t-23 9q-9 10 -9 23t9 23l256 256q10 9 23 9t23 -9q9 -10 9 -23t-9 -23z" />
+    <glyph glyph-name="question" unicode="&#xf128;" horiz-adv-x="1024" 
+d="M704 280v-240q0 -16 -12 -28t-28 -12h-240q-16 0 -28 12t-12 28v240q0 16 12 28t28 12h240q16 0 28 -12t12 -28zM1020 880q0 -54 -15.5 -101t-35 -76.5t-55 -59.5t-57.5 -43.5t-61 -35.5q-41 -23 -68.5 -65t-27.5 -67q0 -17 -12 -32.5t-28 -15.5h-240q-15 0 -25.5 18.5
+t-10.5 37.5v45q0 83 65 156.5t143 108.5q59 27 84 56t25 76q0 42 -46.5 74t-107.5 32q-65 0 -108 -29q-35 -25 -107 -115q-13 -16 -31 -16q-12 0 -25 8l-164 125q-13 10 -15.5 25t5.5 28q160 266 464 266q80 0 161 -31t146 -83t106 -127.5t41 -158.5z" />
+    <glyph glyph-name="_279" unicode="&#xf129;" horiz-adv-x="640" 
+d="M640 192v-128q0 -26 -19 -45t-45 -19h-512q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h64v384h-64q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h384q26 0 45 -19t19 -45v-576h64q26 0 45 -19t19 -45zM512 1344v-192q0 -26 -19 -45t-45 -19h-256q-26 0 -45 19t-19 45v192
+q0 26 19 45t45 19h256q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="exclamation" unicode="&#xf12a;" horiz-adv-x="640" 
+d="M512 288v-224q0 -26 -19 -45t-45 -19h-256q-26 0 -45 19t-19 45v224q0 26 19 45t45 19h256q26 0 45 -19t19 -45zM542 1344l-28 -768q-1 -26 -20.5 -45t-45.5 -19h-256q-26 0 -45.5 19t-20.5 45l-28 768q-1 26 17.5 45t44.5 19h320q26 0 44.5 -19t17.5 -45z" />
+    <glyph glyph-name="superscript" unicode="&#xf12b;" 
+d="M897 167v-167h-248l-159 252l-24 42q-8 9 -11 21h-3q-1 -3 -2.5 -6.5t-3.5 -8t-3 -6.5q-10 -20 -25 -44l-155 -250h-258v167h128l197 291l-185 272h-137v168h276l139 -228q2 -4 23 -42q8 -9 11 -21h3q3 9 11 21l25 42l140 228h257v-168h-125l-184 -267l204 -296h109z
+M1534 846v-206h-514l-3 27q-4 28 -4 46q0 64 26 117t65 86.5t84 65t84 54.5t65 54t26 64q0 38 -29.5 62.5t-70.5 24.5q-51 0 -97 -39q-14 -11 -36 -38l-105 92q26 37 63 66q83 65 188 65q110 0 178 -59.5t68 -158.5q0 -56 -24.5 -103t-62 -76.5t-81.5 -58.5t-82 -50.5
+t-65.5 -51.5t-30.5 -63h232v80h126z" />
+    <glyph glyph-name="subscript" unicode="&#xf12c;" 
+d="M897 167v-167h-248l-159 252l-24 42q-8 9 -11 21h-3q-1 -3 -2.5 -6.5t-3.5 -8t-3 -6.5q-10 -20 -25 -44l-155 -250h-258v167h128l197 291l-185 272h-137v168h276l139 -228q2 -4 23 -42q8 -9 11 -21h3q3 9 11 21l25 42l140 228h257v-168h-125l-184 -267l204 -296h109z
+M1536 -50v-206h-514l-4 27q-3 45 -3 46q0 64 26 117t65 86.5t84 65t84 54.5t65 54t26 64q0 38 -29.5 62.5t-70.5 24.5q-51 0 -97 -39q-14 -11 -36 -38l-105 92q26 37 63 66q80 65 188 65q110 0 178 -59.5t68 -158.5q0 -66 -34.5 -118.5t-84 -86t-99.5 -62.5t-87 -63t-41 -73
+h232v80h126z" />
+    <glyph glyph-name="_283" unicode="&#xf12d;" horiz-adv-x="1920" 
+d="M896 128l336 384h-768l-336 -384h768zM1909 1205q15 -34 9.5 -71.5t-30.5 -65.5l-896 -1024q-38 -44 -96 -44h-768q-38 0 -69.5 20.5t-47.5 54.5q-15 34 -9.5 71.5t30.5 65.5l896 1024q38 44 96 44h768q38 0 69.5 -20.5t47.5 -54.5z" />
+    <glyph glyph-name="puzzle_piece" unicode="&#xf12e;" horiz-adv-x="1664" 
+d="M1664 438q0 -81 -44.5 -135t-123.5 -54q-41 0 -77.5 17.5t-59 38t-56.5 38t-71 17.5q-110 0 -110 -124q0 -39 16 -115t15 -115v-5q-22 0 -33 -1q-34 -3 -97.5 -11.5t-115.5 -13.5t-98 -5q-61 0 -103 26.5t-42 83.5q0 37 17.5 71t38 56.5t38 59t17.5 77.5q0 79 -54 123.5
+t-135 44.5q-84 0 -143 -45.5t-59 -127.5q0 -43 15 -83t33.5 -64.5t33.5 -53t15 -50.5q0 -45 -46 -89q-37 -35 -117 -35q-95 0 -245 24q-9 2 -27.5 4t-27.5 4l-13 2q-1 0 -3 1q-2 0 -2 1v1024q2 -1 17.5 -3.5t34 -5t21.5 -3.5q150 -24 245 -24q80 0 117 35q46 44 46 89
+q0 22 -15 50.5t-33.5 53t-33.5 64.5t-15 83q0 82 59 127.5t144 45.5q80 0 134 -44.5t54 -123.5q0 -41 -17.5 -77.5t-38 -59t-38 -56.5t-17.5 -71q0 -57 42 -83.5t103 -26.5q64 0 180 15t163 17v-2q-1 -2 -3.5 -17.5t-5 -34t-3.5 -21.5q-24 -150 -24 -245q0 -80 35 -117
+q44 -46 89 -46q22 0 50.5 15t53 33.5t64.5 33.5t83 15q82 0 127.5 -59t45.5 -143z" />
+    <glyph glyph-name="microphone" unicode="&#xf130;" horiz-adv-x="1152" 
+d="M1152 832v-128q0 -221 -147.5 -384.5t-364.5 -187.5v-132h256q26 0 45 -19t19 -45t-19 -45t-45 -19h-640q-26 0 -45 19t-19 45t19 45t45 19h256v132q-217 24 -364.5 187.5t-147.5 384.5v128q0 26 19 45t45 19t45 -19t19 -45v-128q0 -185 131.5 -316.5t316.5 -131.5
+t316.5 131.5t131.5 316.5v128q0 26 19 45t45 19t45 -19t19 -45zM896 1216v-512q0 -132 -94 -226t-226 -94t-226 94t-94 226v512q0 132 94 226t226 94t226 -94t94 -226z" />
+    <glyph glyph-name="microphone_off" unicode="&#xf131;" horiz-adv-x="1408" 
+d="M271 591l-101 -101q-42 103 -42 214v128q0 26 19 45t45 19t45 -19t19 -45v-128q0 -53 15 -113zM1385 1193l-361 -361v-128q0 -132 -94 -226t-226 -94q-55 0 -109 19l-96 -96q97 -51 205 -51q185 0 316.5 131.5t131.5 316.5v128q0 26 19 45t45 19t45 -19t19 -45v-128
+q0 -221 -147.5 -384.5t-364.5 -187.5v-132h256q26 0 45 -19t19 -45t-19 -45t-45 -19h-640q-26 0 -45 19t-19 45t19 45t45 19h256v132q-125 13 -235 81l-254 -254q-10 -10 -23 -10t-23 10l-82 82q-10 10 -10 23t10 23l1234 1234q10 10 23 10t23 -10l82 -82q10 -10 10 -23
+t-10 -23zM1005 1325l-621 -621v512q0 132 94 226t226 94q102 0 184.5 -59t116.5 -152z" />
+    <glyph glyph-name="shield" unicode="&#xf132;" horiz-adv-x="1280" 
+d="M1088 576v640h-448v-1137q119 63 213 137q235 184 235 360zM1280 1344v-768q0 -86 -33.5 -170.5t-83 -150t-118 -127.5t-126.5 -103t-121 -77.5t-89.5 -49.5t-42.5 -20q-12 -6 -26 -6t-26 6q-16 7 -42.5 20t-89.5 49.5t-121 77.5t-126.5 103t-118 127.5t-83 150
+t-33.5 170.5v768q0 26 19 45t45 19h1152q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="calendar_empty" unicode="&#xf133;" horiz-adv-x="1664" 
+d="M128 -128h1408v1024h-1408v-1024zM512 1088v288q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-288q0 -14 9 -23t23 -9h64q14 0 23 9t9 23zM1280 1088v288q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-288q0 -14 9 -23t23 -9h64q14 0 23 9t9 23zM1664 1152v-1280
+q0 -52 -38 -90t-90 -38h-1408q-52 0 -90 38t-38 90v1280q0 52 38 90t90 38h128v96q0 66 47 113t113 47h64q66 0 113 -47t47 -113v-96h384v96q0 66 47 113t113 47h64q66 0 113 -47t47 -113v-96h128q52 0 90 -38t38 -90z" />
+    <glyph glyph-name="fire_extinguisher" unicode="&#xf134;" horiz-adv-x="1408" 
+d="M512 1344q0 26 -19 45t-45 19t-45 -19t-19 -45t19 -45t45 -19t45 19t19 45zM1408 1376v-320q0 -16 -12 -25q-8 -7 -20 -7q-4 0 -7 1l-448 96q-11 2 -18 11t-7 20h-256v-102q111 -23 183.5 -111t72.5 -203v-800q0 -26 -19 -45t-45 -19h-512q-26 0 -45 19t-19 45v800
+q0 106 62.5 190.5t161.5 114.5v111h-32q-59 0 -115 -23.5t-91.5 -53t-66 -66.5t-40.5 -53.5t-14 -24.5q-17 -35 -57 -35q-16 0 -29 7q-23 12 -31.5 37t3.5 49q5 10 14.5 26t37.5 53.5t60.5 70t85 67t108.5 52.5q-25 42 -25 86q0 66 47 113t113 47t113 -47t47 -113
+q0 -33 -14 -64h302q0 11 7 20t18 11l448 96q3 1 7 1q12 0 20 -7q12 -9 12 -25z" />
+    <glyph glyph-name="rocket" unicode="&#xf135;" horiz-adv-x="1664" 
+d="M1440 1088q0 40 -28 68t-68 28t-68 -28t-28 -68t28 -68t68 -28t68 28t28 68zM1664 1376q0 -249 -75.5 -430.5t-253.5 -360.5q-81 -80 -195 -176l-20 -379q-2 -16 -16 -26l-384 -224q-7 -4 -16 -4q-12 0 -23 9l-64 64q-13 14 -8 32l85 276l-281 281l-276 -85q-3 -1 -9 -1
+q-14 0 -23 9l-64 64q-17 19 -5 39l224 384q10 14 26 16l379 20q96 114 176 195q188 187 358 258t431 71q14 0 24 -9.5t10 -22.5z" />
+    <glyph glyph-name="maxcdn" unicode="&#xf136;" horiz-adv-x="1792" 
+d="M1745 763l-164 -763h-334l178 832q13 56 -15 88q-27 33 -83 33h-169l-204 -953h-334l204 953h-286l-204 -953h-334l204 953l-153 327h1276q101 0 189.5 -40.5t147.5 -113.5q60 -73 81 -168.5t0 -194.5z" />
+    <glyph glyph-name="chevron_sign_left" unicode="&#xf137;" 
+d="M909 141l102 102q19 19 19 45t-19 45l-307 307l307 307q19 19 19 45t-19 45l-102 102q-19 19 -45 19t-45 -19l-454 -454q-19 -19 -19 -45t19 -45l454 -454q19 -19 45 -19t45 19zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5
+t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="chevron_sign_right" unicode="&#xf138;" 
+d="M717 141l454 454q19 19 19 45t-19 45l-454 454q-19 19 -45 19t-45 -19l-102 -102q-19 -19 -19 -45t19 -45l307 -307l-307 -307q-19 -19 -19 -45t19 -45l102 -102q19 -19 45 -19t45 19zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5
+t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="chevron_sign_up" unicode="&#xf139;" 
+d="M1165 397l102 102q19 19 19 45t-19 45l-454 454q-19 19 -45 19t-45 -19l-454 -454q-19 -19 -19 -45t19 -45l102 -102q19 -19 45 -19t45 19l307 307l307 -307q19 -19 45 -19t45 19zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5
+t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="chevron_sign_down" unicode="&#xf13a;" 
+d="M813 237l454 454q19 19 19 45t-19 45l-102 102q-19 19 -45 19t-45 -19l-307 -307l-307 307q-19 19 -45 19t-45 -19l-102 -102q-19 -19 -19 -45t19 -45l454 -454q19 -19 45 -19t45 19zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5
+t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="html5" unicode="&#xf13b;" horiz-adv-x="1408" 
+d="M1130 939l16 175h-884l47 -534h612l-22 -228l-197 -53l-196 53l-13 140h-175l22 -278l362 -100h4v1l359 99l50 544h-644l-15 181h674zM0 1408h1408l-128 -1438l-578 -162l-574 162z" />
+    <glyph glyph-name="css3" unicode="&#xf13c;" horiz-adv-x="1792" 
+d="M275 1408h1505l-266 -1333l-804 -267l-698 267l71 356h297l-29 -147l422 -161l486 161l68 339h-1208l58 297h1209l38 191h-1208z" />
+    <glyph glyph-name="anchor" unicode="&#xf13d;" horiz-adv-x="1792" 
+d="M960 1280q0 26 -19 45t-45 19t-45 -19t-19 -45t19 -45t45 -19t45 19t19 45zM1792 352v-352q0 -22 -20 -30q-8 -2 -12 -2q-12 0 -23 9l-93 93q-119 -143 -318.5 -226.5t-429.5 -83.5t-429.5 83.5t-318.5 226.5l-93 -93q-9 -9 -23 -9q-4 0 -12 2q-20 8 -20 30v352
+q0 14 9 23t23 9h352q22 0 30 -20q8 -19 -7 -35l-100 -100q67 -91 189.5 -153.5t271.5 -82.5v647h-192q-26 0 -45 19t-19 45v128q0 26 19 45t45 19h192v163q-58 34 -93 92.5t-35 128.5q0 106 75 181t181 75t181 -75t75 -181q0 -70 -35 -128.5t-93 -92.5v-163h192q26 0 45 -19
+t19 -45v-128q0 -26 -19 -45t-45 -19h-192v-647q149 20 271.5 82.5t189.5 153.5l-100 100q-15 16 -7 35q8 20 30 20h352q14 0 23 -9t9 -23z" />
+    <glyph glyph-name="unlock_alt" unicode="&#xf13e;" horiz-adv-x="1152" 
+d="M1056 768q40 0 68 -28t28 -68v-576q0 -40 -28 -68t-68 -28h-960q-40 0 -68 28t-28 68v576q0 40 28 68t68 28h32v320q0 185 131.5 316.5t316.5 131.5t316.5 -131.5t131.5 -316.5q0 -26 -19 -45t-45 -19h-64q-26 0 -45 19t-19 45q0 106 -75 181t-181 75t-181 -75t-75 -181
+v-320h736z" />
+    <glyph glyph-name="bullseye" unicode="&#xf140;" 
+d="M1024 640q0 -106 -75 -181t-181 -75t-181 75t-75 181t75 181t181 75t181 -75t75 -181zM1152 640q0 159 -112.5 271.5t-271.5 112.5t-271.5 -112.5t-112.5 -271.5t112.5 -271.5t271.5 -112.5t271.5 112.5t112.5 271.5zM1280 640q0 -212 -150 -362t-362 -150t-362 150
+t-150 362t150 362t362 150t362 -150t150 -362zM1408 640q0 130 -51 248.5t-136.5 204t-204 136.5t-248.5 51t-248.5 -51t-204 -136.5t-136.5 -204t-51 -248.5t51 -248.5t136.5 -204t204 -136.5t248.5 -51t248.5 51t204 136.5t136.5 204t51 248.5zM1536 640
+q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="ellipsis_horizontal" unicode="&#xf141;" horiz-adv-x="1408" 
+d="M384 800v-192q0 -40 -28 -68t-68 -28h-192q-40 0 -68 28t-28 68v192q0 40 28 68t68 28h192q40 0 68 -28t28 -68zM896 800v-192q0 -40 -28 -68t-68 -28h-192q-40 0 -68 28t-28 68v192q0 40 28 68t68 28h192q40 0 68 -28t28 -68zM1408 800v-192q0 -40 -28 -68t-68 -28h-192
+q-40 0 -68 28t-28 68v192q0 40 28 68t68 28h192q40 0 68 -28t28 -68z" />
+    <glyph glyph-name="ellipsis_vertical" unicode="&#xf142;" horiz-adv-x="384" 
+d="M384 288v-192q0 -40 -28 -68t-68 -28h-192q-40 0 -68 28t-28 68v192q0 40 28 68t68 28h192q40 0 68 -28t28 -68zM384 800v-192q0 -40 -28 -68t-68 -28h-192q-40 0 -68 28t-28 68v192q0 40 28 68t68 28h192q40 0 68 -28t28 -68zM384 1312v-192q0 -40 -28 -68t-68 -28h-192
+q-40 0 -68 28t-28 68v192q0 40 28 68t68 28h192q40 0 68 -28t28 -68z" />
+    <glyph glyph-name="_303" unicode="&#xf143;" 
+d="M512 256q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM863 162q-13 233 -176.5 396.5t-396.5 176.5q-14 1 -24 -9t-10 -23v-128q0 -13 8.5 -22t21.5 -10q154 -11 264 -121t121 -264q1 -13 10 -21.5t22 -8.5h128
+q13 0 23 10t9 24zM1247 161q-5 154 -56 297.5t-139.5 260t-205 205t-260 139.5t-297.5 56q-14 1 -23 -9q-10 -10 -10 -23v-128q0 -13 9 -22t22 -10q204 -7 378 -111.5t278.5 -278.5t111.5 -378q1 -13 10 -22t22 -9h128q13 0 23 10q11 9 9 23zM1536 1120v-960
+q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="play_sign" unicode="&#xf144;" 
+d="M768 1408q209 0 385.5 -103t279.5 -279.5t103 -385.5t-103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103zM1152 585q32 18 32 55t-32 55l-544 320q-31 19 -64 1q-32 -19 -32 -56v-640q0 -37 32 -56
+q16 -8 32 -8q17 0 32 9z" />
+    <glyph glyph-name="ticket" unicode="&#xf145;" horiz-adv-x="1792" 
+d="M1024 1084l316 -316l-572 -572l-316 316zM813 105l618 618q19 19 19 45t-19 45l-362 362q-18 18 -45 18t-45 -18l-618 -618q-19 -19 -19 -45t19 -45l362 -362q18 -18 45 -18t45 18zM1702 742l-907 -908q-37 -37 -90.5 -37t-90.5 37l-126 126q56 56 56 136t-56 136
+t-136 56t-136 -56l-125 126q-37 37 -37 90.5t37 90.5l907 906q37 37 90.5 37t90.5 -37l125 -125q-56 -56 -56 -136t56 -136t136 -56t136 56l126 -125q37 -37 37 -90.5t-37 -90.5z" />
+    <glyph glyph-name="minus_sign_alt" unicode="&#xf146;" 
+d="M1280 576v128q0 26 -19 45t-45 19h-896q-26 0 -45 -19t-19 -45v-128q0 -26 19 -45t45 -19h896q26 0 45 19t19 45zM1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5
+t84.5 -203.5z" />
+    <glyph glyph-name="check_minus" unicode="&#xf147;" horiz-adv-x="1408" 
+d="M1152 736v-64q0 -14 -9 -23t-23 -9h-832q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h832q14 0 23 -9t9 -23zM1280 288v832q0 66 -47 113t-113 47h-832q-66 0 -113 -47t-47 -113v-832q0 -66 47 -113t113 -47h832q66 0 113 47t47 113zM1408 1120v-832q0 -119 -84.5 -203.5
+t-203.5 -84.5h-832q-119 0 -203.5 84.5t-84.5 203.5v832q0 119 84.5 203.5t203.5 84.5h832q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="level_up" unicode="&#xf148;" horiz-adv-x="1024" 
+d="M1018 933q-18 -37 -58 -37h-192v-864q0 -14 -9 -23t-23 -9h-704q-21 0 -29 18q-8 20 4 35l160 192q9 11 25 11h320v640h-192q-40 0 -58 37q-17 37 9 68l320 384q18 22 49 22t49 -22l320 -384q27 -32 9 -68z" />
+    <glyph glyph-name="level_down" unicode="&#xf149;" horiz-adv-x="1024" 
+d="M32 1280h704q13 0 22.5 -9.5t9.5 -23.5v-863h192q40 0 58 -37t-9 -69l-320 -384q-18 -22 -49 -22t-49 22l-320 384q-26 31 -9 69q18 37 58 37h192v640h-320q-14 0 -25 11l-160 192q-13 14 -4 34q9 19 29 19z" />
+    <glyph glyph-name="check_sign" unicode="&#xf14a;" 
+d="M685 237l614 614q19 19 19 45t-19 45l-102 102q-19 19 -45 19t-45 -19l-467 -467l-211 211q-19 19 -45 19t-45 -19l-102 -102q-19 -19 -19 -45t19 -45l358 -358q19 -19 45 -19t45 19zM1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5
+t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="edit_sign" unicode="&#xf14b;" 
+d="M404 428l152 -152l-52 -52h-56v96h-96v56zM818 818q14 -13 -3 -30l-291 -291q-17 -17 -30 -3q-14 13 3 30l291 291q17 17 30 3zM544 128l544 544l-288 288l-544 -544v-288h288zM1152 736l92 92q28 28 28 68t-28 68l-152 152q-28 28 -68 28t-68 -28l-92 -92zM1536 1120
+v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="_312" unicode="&#xf14c;" 
+d="M1280 608v480q0 26 -19 45t-45 19h-480q-42 0 -59 -39q-17 -41 14 -70l144 -144l-534 -534q-19 -19 -19 -45t19 -45l102 -102q19 -19 45 -19t45 19l534 534l144 -144q18 -19 45 -19q12 0 25 5q39 17 39 59zM1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960
+q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="share_sign" unicode="&#xf14d;" 
+d="M1005 435l352 352q19 19 19 45t-19 45l-352 352q-30 31 -69 14q-40 -17 -40 -59v-160q-119 0 -216 -19.5t-162.5 -51t-114 -79t-76.5 -95.5t-44.5 -109t-21.5 -111.5t-5 -110.5q0 -181 167 -404q11 -12 25 -12q7 0 13 3q22 9 19 33q-44 354 62 473q46 52 130 75.5
+t224 23.5v-160q0 -42 40 -59q12 -5 24 -5q26 0 45 19zM1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="compass" unicode="&#xf14e;" 
+d="M640 448l256 128l-256 128v-256zM1024 1039v-542l-512 -256v542zM1312 640q0 148 -73 273t-198 198t-273 73t-273 -73t-198 -198t-73 -273t73 -273t198 -198t273 -73t273 73t198 198t73 273zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103
+t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="collapse" unicode="&#xf150;" 
+d="M1145 861q18 -35 -5 -66l-320 -448q-19 -27 -52 -27t-52 27l-320 448q-23 31 -5 66q17 35 57 35h640q40 0 57 -35zM1280 160v960q0 13 -9.5 22.5t-22.5 9.5h-960q-13 0 -22.5 -9.5t-9.5 -22.5v-960q0 -13 9.5 -22.5t22.5 -9.5h960q13 0 22.5 9.5t9.5 22.5zM1536 1120
+v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="collapse_top" unicode="&#xf151;" 
+d="M1145 419q-17 -35 -57 -35h-640q-40 0 -57 35q-18 35 5 66l320 448q19 27 52 27t52 -27l320 -448q23 -31 5 -66zM1280 160v960q0 13 -9.5 22.5t-22.5 9.5h-960q-13 0 -22.5 -9.5t-9.5 -22.5v-960q0 -13 9.5 -22.5t22.5 -9.5h960q13 0 22.5 9.5t9.5 22.5zM1536 1120v-960
+q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="_317" unicode="&#xf152;" 
+d="M1088 640q0 -33 -27 -52l-448 -320q-31 -23 -66 -5q-35 17 -35 57v640q0 40 35 57q35 18 66 -5l448 -320q27 -19 27 -52zM1280 160v960q0 14 -9 23t-23 9h-960q-14 0 -23 -9t-9 -23v-960q0 -14 9 -23t23 -9h960q14 0 23 9t9 23zM1536 1120v-960q0 -119 -84.5 -203.5
+t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="eur" unicode="&#xf153;" horiz-adv-x="1024" 
+d="M976 229l35 -159q3 -12 -3 -22.5t-17 -14.5l-5 -1q-4 -2 -10.5 -3.5t-16 -4.5t-21.5 -5.5t-25.5 -5t-30 -5t-33.5 -4.5t-36.5 -3t-38.5 -1q-234 0 -409 130.5t-238 351.5h-95q-13 0 -22.5 9.5t-9.5 22.5v113q0 13 9.5 22.5t22.5 9.5h66q-2 57 1 105h-67q-14 0 -23 9
+t-9 23v114q0 14 9 23t23 9h98q67 210 243.5 338t400.5 128q102 0 194 -23q11 -3 20 -15q6 -11 3 -24l-43 -159q-3 -13 -14 -19.5t-24 -2.5l-4 1q-4 1 -11.5 2.5l-17.5 3.5t-22.5 3.5t-26 3t-29 2.5t-29.5 1q-126 0 -226 -64t-150 -176h468q16 0 25 -12q10 -12 7 -26
+l-24 -114q-5 -26 -32 -26h-488q-3 -37 0 -105h459q15 0 25 -12q9 -12 6 -27l-24 -112q-2 -11 -11 -18.5t-20 -7.5h-387q48 -117 149.5 -185.5t228.5 -68.5q18 0 36 1.5t33.5 3.5t29.5 4.5t24.5 5t18.5 4.5l12 3l5 2q13 5 26 -2q12 -7 15 -21z" />
+    <glyph glyph-name="gbp" unicode="&#xf154;" horiz-adv-x="1024" 
+d="M1020 399v-367q0 -14 -9 -23t-23 -9h-956q-14 0 -23 9t-9 23v150q0 13 9.5 22.5t22.5 9.5h97v383h-95q-14 0 -23 9.5t-9 22.5v131q0 14 9 23t23 9h95v223q0 171 123.5 282t314.5 111q185 0 335 -125q9 -8 10 -20.5t-7 -22.5l-103 -127q-9 -11 -22 -12q-13 -2 -23 7
+q-5 5 -26 19t-69 32t-93 18q-85 0 -137 -47t-52 -123v-215h305q13 0 22.5 -9t9.5 -23v-131q0 -13 -9.5 -22.5t-22.5 -9.5h-305v-379h414v181q0 13 9 22.5t23 9.5h162q14 0 23 -9.5t9 -22.5z" />
+    <glyph glyph-name="usd" unicode="&#xf155;" horiz-adv-x="1024" 
+d="M978 351q0 -153 -99.5 -263.5t-258.5 -136.5v-175q0 -14 -9 -23t-23 -9h-135q-13 0 -22.5 9.5t-9.5 22.5v175q-66 9 -127.5 31t-101.5 44.5t-74 48t-46.5 37.5t-17.5 18q-17 21 -2 41l103 135q7 10 23 12q15 2 24 -9l2 -2q113 -99 243 -125q37 -8 74 -8q81 0 142.5 43
+t61.5 122q0 28 -15 53t-33.5 42t-58.5 37.5t-66 32t-80 32.5q-39 16 -61.5 25t-61.5 26.5t-62.5 31t-56.5 35.5t-53.5 42.5t-43.5 49t-35.5 58t-21 66.5t-8.5 78q0 138 98 242t255 134v180q0 13 9.5 22.5t22.5 9.5h135q14 0 23 -9t9 -23v-176q57 -6 110.5 -23t87 -33.5
+t63.5 -37.5t39 -29t15 -14q17 -18 5 -38l-81 -146q-8 -15 -23 -16q-14 -3 -27 7q-3 3 -14.5 12t-39 26.5t-58.5 32t-74.5 26t-85.5 11.5q-95 0 -155 -43t-60 -111q0 -26 8.5 -48t29.5 -41.5t39.5 -33t56 -31t60.5 -27t70 -27.5q53 -20 81 -31.5t76 -35t75.5 -42.5t62 -50
+t53 -63.5t31.5 -76.5t13 -94z" />
+    <glyph glyph-name="inr" unicode="&#xf156;" horiz-adv-x="898" 
+d="M898 1066v-102q0 -14 -9 -23t-23 -9h-168q-23 -144 -129 -234t-276 -110q167 -178 459 -536q14 -16 4 -34q-8 -18 -29 -18h-195q-16 0 -25 12q-306 367 -498 571q-9 9 -9 22v127q0 13 9.5 22.5t22.5 9.5h112q132 0 212.5 43t102.5 125h-427q-14 0 -23 9t-9 23v102
+q0 14 9 23t23 9h413q-57 113 -268 113h-145q-13 0 -22.5 9.5t-9.5 22.5v133q0 14 9 23t23 9h832q14 0 23 -9t9 -23v-102q0 -14 -9 -23t-23 -9h-233q47 -61 64 -144h171q14 0 23 -9t9 -23z" />
+    <glyph glyph-name="jpy" unicode="&#xf157;" horiz-adv-x="1027" 
+d="M603 0h-172q-13 0 -22.5 9t-9.5 23v330h-288q-13 0 -22.5 9t-9.5 23v103q0 13 9.5 22.5t22.5 9.5h288v85h-288q-13 0 -22.5 9t-9.5 23v104q0 13 9.5 22.5t22.5 9.5h214l-321 578q-8 16 0 32q10 16 28 16h194q19 0 29 -18l215 -425q19 -38 56 -125q10 24 30.5 68t27.5 61
+l191 420q8 19 29 19h191q17 0 27 -16q9 -14 1 -31l-313 -579h215q13 0 22.5 -9.5t9.5 -22.5v-104q0 -14 -9.5 -23t-22.5 -9h-290v-85h290q13 0 22.5 -9.5t9.5 -22.5v-103q0 -14 -9.5 -23t-22.5 -9h-290v-330q0 -13 -9.5 -22.5t-22.5 -9.5z" />
+    <glyph glyph-name="rub" unicode="&#xf158;" horiz-adv-x="1280" 
+d="M1043 971q0 100 -65 162t-171 62h-320v-448h320q106 0 171 62t65 162zM1280 971q0 -193 -126.5 -315t-326.5 -122h-340v-118h505q14 0 23 -9t9 -23v-128q0 -14 -9 -23t-23 -9h-505v-192q0 -14 -9.5 -23t-22.5 -9h-167q-14 0 -23 9t-9 23v192h-224q-14 0 -23 9t-9 23v128
+q0 14 9 23t23 9h224v118h-224q-14 0 -23 9t-9 23v149q0 13 9 22.5t23 9.5h224v629q0 14 9 23t23 9h539q200 0 326.5 -122t126.5 -315z" />
+    <glyph glyph-name="krw" unicode="&#xf159;" horiz-adv-x="1792" 
+d="M514 341l81 299h-159l75 -300q1 -1 1 -3t1 -3q0 1 0.5 3.5t0.5 3.5zM630 768l35 128h-292l32 -128h225zM822 768h139l-35 128h-70zM1271 340l78 300h-162l81 -299q0 -1 0.5 -3.5t1.5 -3.5q0 1 0.5 3t0.5 3zM1382 768l33 128h-297l34 -128h230zM1792 736v-64q0 -14 -9 -23
+t-23 -9h-213l-164 -616q-7 -24 -31 -24h-159q-24 0 -31 24l-166 616h-209l-167 -616q-7 -24 -31 -24h-159q-11 0 -19.5 7t-10.5 17l-160 616h-208q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h175l-33 128h-142q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h109l-89 344q-5 15 5 28
+q10 12 26 12h137q26 0 31 -24l90 -360h359l97 360q7 24 31 24h126q24 0 31 -24l98 -360h365l93 360q5 24 31 24h137q16 0 26 -12q10 -13 5 -28l-91 -344h111q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-145l-34 -128h179q14 0 23 -9t9 -23z" />
+    <glyph glyph-name="btc" unicode="&#xf15a;" horiz-adv-x="1280" 
+d="M1167 896q18 -182 -131 -258q117 -28 175 -103t45 -214q-7 -71 -32.5 -125t-64.5 -89t-97 -58.5t-121.5 -34.5t-145.5 -15v-255h-154v251q-80 0 -122 1v-252h-154v255q-18 0 -54 0.5t-55 0.5h-200l31 183h111q50 0 58 51v402h16q-6 1 -16 1v287q-13 68 -89 68h-111v164
+l212 -1q64 0 97 1v252h154v-247q82 2 122 2v245h154v-252q79 -7 140 -22.5t113 -45t82.5 -78t36.5 -114.5zM952 351q0 36 -15 64t-37 46t-57.5 30.5t-65.5 18.5t-74 9t-69 3t-64.5 -1t-47.5 -1v-338q8 0 37 -0.5t48 -0.5t53 1.5t58.5 4t57 8.5t55.5 14t47.5 21t39.5 30
+t24.5 40t9.5 51zM881 827q0 33 -12.5 58.5t-30.5 42t-48 28t-55 16.5t-61.5 8t-58 2.5t-54 -1t-39.5 -0.5v-307q5 0 34.5 -0.5t46.5 0t50 2t55 5.5t51.5 11t48.5 18.5t37 27t27 38.5t9 51z" />
+    <glyph glyph-name="file" unicode="&#xf15b;" 
+d="M1024 1024v472q22 -14 36 -28l408 -408q14 -14 28 -36h-472zM896 992q0 -40 28 -68t68 -28h544v-1056q0 -40 -28 -68t-68 -28h-1344q-40 0 -68 28t-28 68v1600q0 40 28 68t68 28h800v-544z" />
+    <glyph glyph-name="file_text" unicode="&#xf15c;" 
+d="M1468 1060q14 -14 28 -36h-472v472q22 -14 36 -28zM992 896h544v-1056q0 -40 -28 -68t-68 -28h-1344q-40 0 -68 28t-28 68v1600q0 40 28 68t68 28h800v-544q0 -40 28 -68t68 -28zM1152 160v64q0 14 -9 23t-23 9h-704q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h704
+q14 0 23 9t9 23zM1152 416v64q0 14 -9 23t-23 9h-704q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h704q14 0 23 9t9 23zM1152 672v64q0 14 -9 23t-23 9h-704q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h704q14 0 23 9t9 23z" />
+    <glyph glyph-name="sort_by_alphabet" unicode="&#xf15d;" horiz-adv-x="1664" 
+d="M1191 1128h177l-72 218l-12 47q-2 16 -2 20h-4l-3 -20q0 -1 -3.5 -18t-7.5 -29zM736 96q0 -12 -10 -24l-319 -319q-10 -9 -23 -9q-12 0 -23 9l-320 320q-15 16 -7 35q8 20 30 20h192v1376q0 14 9 23t23 9h192q14 0 23 -9t9 -23v-1376h192q14 0 23 -9t9 -23zM1572 -23
+v-233h-584v90l369 529q12 18 21 27l11 9v3q-2 0 -6.5 -0.5t-7.5 -0.5q-12 -3 -30 -3h-232v-115h-120v229h567v-89l-369 -530q-6 -8 -21 -26l-11 -11v-2l14 2q9 2 30 2h248v119h121zM1661 874v-106h-288v106h75l-47 144h-243l-47 -144h75v-106h-287v106h70l230 662h162
+l230 -662h70z" />
+    <glyph glyph-name="_329" unicode="&#xf15e;" horiz-adv-x="1664" 
+d="M1191 104h177l-72 218l-12 47q-2 16 -2 20h-4l-3 -20q0 -1 -3.5 -18t-7.5 -29zM736 96q0 -12 -10 -24l-319 -319q-10 -9 -23 -9q-12 0 -23 9l-320 320q-15 16 -7 35q8 20 30 20h192v1376q0 14 9 23t23 9h192q14 0 23 -9t9 -23v-1376h192q14 0 23 -9t9 -23zM1661 -150
+v-106h-288v106h75l-47 144h-243l-47 -144h75v-106h-287v106h70l230 662h162l230 -662h70zM1572 1001v-233h-584v90l369 529q12 18 21 27l11 9v3q-2 0 -6.5 -0.5t-7.5 -0.5q-12 -3 -30 -3h-232v-115h-120v229h567v-89l-369 -530q-6 -8 -21 -26l-11 -10v-3l14 3q9 1 30 1h248
+v119h121z" />
+    <glyph glyph-name="sort_by_attributes" unicode="&#xf160;" horiz-adv-x="1792" 
+d="M736 96q0 -12 -10 -24l-319 -319q-10 -9 -23 -9q-12 0 -23 9l-320 320q-15 16 -7 35q8 20 30 20h192v1376q0 14 9 23t23 9h192q14 0 23 -9t9 -23v-1376h192q14 0 23 -9t9 -23zM1792 -32v-192q0 -14 -9 -23t-23 -9h-832q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h832
+q14 0 23 -9t9 -23zM1600 480v-192q0 -14 -9 -23t-23 -9h-640q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h640q14 0 23 -9t9 -23zM1408 992v-192q0 -14 -9 -23t-23 -9h-448q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h448q14 0 23 -9t9 -23zM1216 1504v-192q0 -14 -9 -23t-23 -9h-256
+q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h256q14 0 23 -9t9 -23z" />
+    <glyph glyph-name="sort_by_attributes_alt" unicode="&#xf161;" horiz-adv-x="1792" 
+d="M1216 -32v-192q0 -14 -9 -23t-23 -9h-256q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h256q14 0 23 -9t9 -23zM736 96q0 -12 -10 -24l-319 -319q-10 -9 -23 -9q-12 0 -23 9l-320 320q-15 16 -7 35q8 20 30 20h192v1376q0 14 9 23t23 9h192q14 0 23 -9t9 -23v-1376h192
+q14 0 23 -9t9 -23zM1408 480v-192q0 -14 -9 -23t-23 -9h-448q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h448q14 0 23 -9t9 -23zM1600 992v-192q0 -14 -9 -23t-23 -9h-640q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h640q14 0 23 -9t9 -23zM1792 1504v-192q0 -14 -9 -23t-23 -9h-832
+q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h832q14 0 23 -9t9 -23z" />
+    <glyph glyph-name="sort_by_order" unicode="&#xf162;" 
+d="M1346 223q0 63 -44 116t-103 53q-52 0 -83 -37t-31 -94t36.5 -95t104.5 -38q50 0 85 27t35 68zM736 96q0 -12 -10 -24l-319 -319q-10 -9 -23 -9q-12 0 -23 9l-320 320q-15 16 -7 35q8 20 30 20h192v1376q0 14 9 23t23 9h192q14 0 23 -9t9 -23v-1376h192q14 0 23 -9t9 -23
+zM1486 165q0 -62 -13 -121.5t-41 -114t-68 -95.5t-98.5 -65.5t-127.5 -24.5q-62 0 -108 16q-24 8 -42 15l39 113q15 -7 31 -11q37 -13 75 -13q84 0 134.5 58.5t66.5 145.5h-2q-21 -23 -61.5 -37t-84.5 -14q-106 0 -173 71.5t-67 172.5q0 105 72 178t181 73q123 0 205 -94.5
+t82 -252.5zM1456 882v-114h-469v114h167v432q0 7 0.5 19t0.5 17v16h-2l-7 -12q-8 -13 -26 -31l-62 -58l-82 86l192 185h123v-654h165z" />
+    <glyph glyph-name="sort_by_order_alt" unicode="&#xf163;" 
+d="M1346 1247q0 63 -44 116t-103 53q-52 0 -83 -37t-31 -94t36.5 -95t104.5 -38q50 0 85 27t35 68zM736 96q0 -12 -10 -24l-319 -319q-10 -9 -23 -9q-12 0 -23 9l-320 320q-15 16 -7 35q8 20 30 20h192v1376q0 14 9 23t23 9h192q14 0 23 -9t9 -23v-1376h192q14 0 23 -9
+t9 -23zM1456 -142v-114h-469v114h167v432q0 7 0.5 19t0.5 17v16h-2l-7 -12q-8 -13 -26 -31l-62 -58l-82 86l192 185h123v-654h165zM1486 1189q0 -62 -13 -121.5t-41 -114t-68 -95.5t-98.5 -65.5t-127.5 -24.5q-62 0 -108 16q-24 8 -42 15l39 113q15 -7 31 -11q37 -13 75 -13
+q84 0 134.5 58.5t66.5 145.5h-2q-21 -23 -61.5 -37t-84.5 -14q-106 0 -173 71.5t-67 172.5q0 105 72 178t181 73q123 0 205 -94.5t82 -252.5z" />
+    <glyph glyph-name="_334" unicode="&#xf164;" horiz-adv-x="1664" 
+d="M256 192q0 26 -19 45t-45 19q-27 0 -45.5 -19t-18.5 -45q0 -27 18.5 -45.5t45.5 -18.5q26 0 45 18.5t19 45.5zM416 704v-640q0 -26 -19 -45t-45 -19h-288q-26 0 -45 19t-19 45v640q0 26 19 45t45 19h288q26 0 45 -19t19 -45zM1600 704q0 -86 -55 -149q15 -44 15 -76
+q3 -76 -43 -137q17 -56 0 -117q-15 -57 -54 -94q9 -112 -49 -181q-64 -76 -197 -78h-36h-76h-17q-66 0 -144 15.5t-121.5 29t-120.5 39.5q-123 43 -158 44q-26 1 -45 19.5t-19 44.5v641q0 25 18 43.5t43 20.5q24 2 76 59t101 121q68 87 101 120q18 18 31 48t17.5 48.5
+t13.5 60.5q7 39 12.5 61t19.5 52t34 50q19 19 45 19q46 0 82.5 -10.5t60 -26t40 -40.5t24 -45t12 -50t5 -45t0.5 -39q0 -38 -9.5 -76t-19 -60t-27.5 -56q-3 -6 -10 -18t-11 -22t-8 -24h277q78 0 135 -57t57 -135z" />
+    <glyph glyph-name="_335" unicode="&#xf165;" horiz-adv-x="1664" 
+d="M256 960q0 -26 -19 -45t-45 -19q-27 0 -45.5 19t-18.5 45q0 27 18.5 45.5t45.5 18.5q26 0 45 -18.5t19 -45.5zM416 448v640q0 26 -19 45t-45 19h-288q-26 0 -45 -19t-19 -45v-640q0 -26 19 -45t45 -19h288q26 0 45 19t19 45zM1545 597q55 -61 55 -149q-1 -78 -57.5 -135
+t-134.5 -57h-277q4 -14 8 -24t11 -22t10 -18q18 -37 27 -57t19 -58.5t10 -76.5q0 -24 -0.5 -39t-5 -45t-12 -50t-24 -45t-40 -40.5t-60 -26t-82.5 -10.5q-26 0 -45 19q-20 20 -34 50t-19.5 52t-12.5 61q-9 42 -13.5 60.5t-17.5 48.5t-31 48q-33 33 -101 120q-49 64 -101 121
+t-76 59q-25 2 -43 20.5t-18 43.5v641q0 26 19 44.5t45 19.5q35 1 158 44q77 26 120.5 39.5t121.5 29t144 15.5h17h76h36q133 -2 197 -78q58 -69 49 -181q39 -37 54 -94q17 -61 0 -117q46 -61 43 -137q0 -32 -15 -76z" />
+    <glyph glyph-name="youtube_sign" unicode="&#xf166;" 
+d="M919 233v157q0 50 -29 50q-17 0 -33 -16v-224q16 -16 33 -16q29 0 29 49zM1103 355h66v34q0 51 -33 51t-33 -51v-34zM532 621v-70h-80v-423h-74v423h-78v70h232zM733 495v-367h-67v40q-39 -45 -76 -45q-33 0 -42 28q-6 17 -6 54v290h66v-270q0 -24 1 -26q1 -15 15 -15
+q20 0 42 31v280h67zM985 384v-146q0 -52 -7 -73q-12 -42 -53 -42q-35 0 -68 41v-36h-67v493h67v-161q32 40 68 40q41 0 53 -42q7 -21 7 -74zM1236 255v-9q0 -29 -2 -43q-3 -22 -15 -40q-27 -40 -80 -40q-52 0 -81 38q-21 27 -21 86v129q0 59 20 86q29 38 80 38t78 -38
+q21 -29 21 -86v-76h-133v-65q0 -51 34 -51q24 0 30 26q0 1 0.5 7t0.5 16.5v21.5h68zM785 1079v-156q0 -51 -32 -51t-32 51v156q0 52 32 52t32 -52zM1318 366q0 177 -19 260q-10 44 -43 73.5t-76 34.5q-136 15 -412 15q-275 0 -411 -15q-44 -5 -76.5 -34.5t-42.5 -73.5
+q-20 -87 -20 -260q0 -176 20 -260q10 -43 42.5 -73t75.5 -35q137 -15 412 -15t412 15q43 5 75.5 35t42.5 73q20 84 20 260zM563 1017l90 296h-75l-51 -195l-53 195h-78q7 -23 23 -69l24 -69q35 -103 46 -158v-201h74v201zM852 936v130q0 58 -21 87q-29 38 -78 38
+q-51 0 -78 -38q-21 -29 -21 -87v-130q0 -58 21 -87q27 -38 78 -38q49 0 78 38q21 27 21 87zM1033 816h67v370h-67v-283q-22 -31 -42 -31q-15 0 -16 16q-1 2 -1 26v272h-67v-293q0 -37 6 -55q11 -27 43 -27q36 0 77 45v-40zM1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5
+h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="youtube" unicode="&#xf167;" 
+d="M971 292v-211q0 -67 -39 -67q-23 0 -45 22v301q22 22 45 22q39 0 39 -67zM1309 291v-46h-90v46q0 68 45 68t45 -68zM343 509h107v94h-312v-94h105v-569h100v569zM631 -60h89v494h-89v-378q-30 -42 -57 -42q-18 0 -21 21q-1 3 -1 35v364h-89v-391q0 -49 8 -73
+q12 -37 58 -37q48 0 102 61v-54zM1060 88v197q0 73 -9 99q-17 56 -71 56q-50 0 -93 -54v217h-89v-663h89v48q45 -55 93 -55q54 0 71 55q9 27 9 100zM1398 98v13h-91q0 -51 -2 -61q-7 -36 -40 -36q-46 0 -46 69v87h179v103q0 79 -27 116q-39 51 -106 51q-68 0 -107 -51
+q-28 -37 -28 -116v-173q0 -79 29 -116q39 -51 108 -51q72 0 108 53q18 27 21 54q2 9 2 58zM790 1011v210q0 69 -43 69t-43 -69v-210q0 -70 43 -70t43 70zM1509 260q0 -234 -26 -350q-14 -59 -58 -99t-102 -46q-184 -21 -555 -21t-555 21q-58 6 -102.5 46t-57.5 99
+q-26 112 -26 350q0 234 26 350q14 59 58 99t103 47q183 20 554 20t555 -20q58 -7 102.5 -47t57.5 -99q26 -112 26 -350zM511 1536h102l-121 -399v-271h-100v271q-14 74 -61 212q-37 103 -65 187h106l71 -263zM881 1203v-175q0 -81 -28 -118q-38 -51 -106 -51q-67 0 -105 51
+q-28 38 -28 118v175q0 80 28 117q38 51 105 51q68 0 106 -51q28 -37 28 -117zM1216 1365v-499h-91v55q-53 -62 -103 -62q-46 0 -59 37q-8 24 -8 75v394h91v-367q0 -33 1 -35q3 -22 21 -22q27 0 57 43v381h91z" />
+    <glyph glyph-name="xing" unicode="&#xf168;" horiz-adv-x="1408" 
+d="M597 869q-10 -18 -257 -456q-27 -46 -65 -46h-239q-21 0 -31 17t0 36l253 448q1 0 0 1l-161 279q-12 22 -1 37q9 15 32 15h239q40 0 66 -45zM1403 1511q11 -16 0 -37l-528 -934v-1l336 -615q11 -20 1 -37q-10 -15 -32 -15h-239q-42 0 -66 45l-339 622q18 32 531 942
+q25 45 64 45h241q22 0 31 -15z" />
+    <glyph glyph-name="xing_sign" unicode="&#xf169;" 
+d="M685 771q0 1 -126 222q-21 34 -52 34h-184q-18 0 -26 -11q-7 -12 1 -29l125 -216v-1l-196 -346q-9 -14 0 -28q8 -13 24 -13h185q31 0 50 36zM1309 1268q-7 12 -24 12h-187q-30 0 -49 -35l-411 -729q1 -2 262 -481q20 -35 52 -35h184q18 0 25 12q8 13 -1 28l-260 476v1
+l409 723q8 16 0 28zM1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="youtube_play" unicode="&#xf16a;" horiz-adv-x="1792" 
+d="M711 408l484 250l-484 253v-503zM896 1270q168 0 324.5 -4.5t229.5 -9.5l73 -4q1 0 17 -1.5t23 -3t23.5 -4.5t28.5 -8t28 -13t31 -19.5t29 -26.5q6 -6 15.5 -18.5t29 -58.5t26.5 -101q8 -64 12.5 -136.5t5.5 -113.5v-40v-136q1 -145 -18 -290q-7 -55 -25 -99.5t-32 -61.5
+l-14 -17q-14 -15 -29 -26.5t-31 -19t-28 -12.5t-28.5 -8t-24 -4.5t-23 -3t-16.5 -1.5q-251 -19 -627 -19q-207 2 -359.5 6.5t-200.5 7.5l-49 4l-36 4q-36 5 -54.5 10t-51 21t-56.5 41q-6 6 -15.5 18.5t-29 58.5t-26.5 101q-8 64 -12.5 136.5t-5.5 113.5v40v136
+q-1 145 18 290q7 55 25 99.5t32 61.5l14 17q14 15 29 26.5t31 19.5t28 13t28.5 8t23.5 4.5t23 3t17 1.5q251 18 627 18z" />
+    <glyph glyph-name="dropbox" unicode="&#xf16b;" horiz-adv-x="1792" 
+d="M402 829l494 -305l-342 -285l-490 319zM1388 274v-108l-490 -293v-1l-1 1l-1 -1v1l-489 293v108l147 -96l342 284v2l1 -1l1 1v-2l343 -284zM554 1418l342 -285l-494 -304l-338 270zM1390 829l338 -271l-489 -319l-343 285zM1239 1418l489 -319l-338 -270l-494 304z" />
+    <glyph glyph-name="stackexchange" unicode="&#xf16c;" 
+d="M1289 -96h-1118v480h-160v-640h1438v640h-160v-480zM347 428l33 157l783 -165l-33 -156zM450 802l67 146l725 -339l-67 -145zM651 1158l102 123l614 -513l-102 -123zM1048 1536l477 -641l-128 -96l-477 641zM330 65v159h800v-159h-800z" />
+    <glyph glyph-name="instagram" unicode="&#xf16d;" 
+d="M1024 640q0 106 -75 181t-181 75t-181 -75t-75 -181t75 -181t181 -75t181 75t75 181zM1162 640q0 -164 -115 -279t-279 -115t-279 115t-115 279t115 279t279 115t279 -115t115 -279zM1270 1050q0 -38 -27 -65t-65 -27t-65 27t-27 65t27 65t65 27t65 -27t27 -65zM768 1270
+q-7 0 -76.5 0.5t-105.5 0t-96.5 -3t-103 -10t-71.5 -18.5q-50 -20 -88 -58t-58 -88q-11 -29 -18.5 -71.5t-10 -103t-3 -96.5t0 -105.5t0.5 -76.5t-0.5 -76.5t0 -105.5t3 -96.5t10 -103t18.5 -71.5q20 -50 58 -88t88 -58q29 -11 71.5 -18.5t103 -10t96.5 -3t105.5 0t76.5 0.5
+t76.5 -0.5t105.5 0t96.5 3t103 10t71.5 18.5q50 20 88 58t58 88q11 29 18.5 71.5t10 103t3 96.5t0 105.5t-0.5 76.5t0.5 76.5t0 105.5t-3 96.5t-10 103t-18.5 71.5q-20 50 -58 88t-88 58q-29 11 -71.5 18.5t-103 10t-96.5 3t-105.5 0t-76.5 -0.5zM1536 640q0 -229 -5 -317
+q-10 -208 -124 -322t-322 -124q-88 -5 -317 -5t-317 5q-208 10 -322 124t-124 322q-5 88 -5 317t5 317q10 208 124 322t322 124q88 5 317 5t317 -5q208 -10 322 -124t124 -322q5 -88 5 -317z" />
+    <glyph glyph-name="flickr" unicode="&#xf16e;" 
+d="M1248 1408q119 0 203.5 -84.5t84.5 -203.5v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960zM698 640q0 88 -62 150t-150 62t-150 -62t-62 -150t62 -150t150 -62t150 62t62 150zM1262 640q0 88 -62 150
+t-150 62t-150 -62t-62 -150t62 -150t150 -62t150 62t62 150z" />
+    <glyph glyph-name="adn" unicode="&#xf170;" 
+d="M768 914l201 -306h-402zM1133 384h94l-459 691l-459 -691h94l104 160h522zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="f171" unicode="&#xf171;" horiz-adv-x="1408" 
+d="M815 677q8 -63 -50.5 -101t-111.5 -6q-39 17 -53.5 58t-0.5 82t52 58q36 18 72.5 12t64 -35.5t27.5 -67.5zM926 698q-14 107 -113 164t-197 13q-63 -28 -100.5 -88.5t-34.5 -129.5q4 -91 77.5 -155t165.5 -56q91 8 152 84t50 168zM1165 1240q-20 27 -56 44.5t-58 22
+t-71 12.5q-291 47 -566 -2q-43 -7 -66 -12t-55 -22t-50 -43q30 -28 76 -45.5t73.5 -22t87.5 -11.5q228 -29 448 -1q63 8 89.5 12t72.5 21.5t75 46.5zM1222 205q-8 -26 -15.5 -76.5t-14 -84t-28.5 -70t-58 -56.5q-86 -48 -189.5 -71.5t-202 -22t-201.5 18.5q-46 8 -81.5 18
+t-76.5 27t-73 43.5t-52 61.5q-25 96 -57 292l6 16l18 9q223 -148 506.5 -148t507.5 148q21 -6 24 -23t-5 -45t-8 -37zM1403 1166q-26 -167 -111 -655q-5 -30 -27 -56t-43.5 -40t-54.5 -31q-252 -126 -610 -88q-248 27 -394 139q-15 12 -25.5 26.5t-17 35t-9 34t-6 39.5
+t-5.5 35q-9 50 -26.5 150t-28 161.5t-23.5 147.5t-22 158q3 26 17.5 48.5t31.5 37.5t45 30t46 22.5t48 18.5q125 46 313 64q379 37 676 -50q155 -46 215 -122q16 -20 16.5 -51t-5.5 -54z" />
+    <glyph glyph-name="bitbucket_sign" unicode="&#xf172;" 
+d="M848 666q0 43 -41 66t-77 1q-43 -20 -42.5 -72.5t43.5 -70.5q39 -23 81 4t36 72zM928 682q8 -66 -36 -121t-110 -61t-119 40t-56 113q-2 49 25.5 93t72.5 64q70 31 141.5 -10t81.5 -118zM1100 1073q-20 -21 -53.5 -34t-53 -16t-63.5 -8q-155 -20 -324 0q-44 6 -63 9.5
+t-52.5 16t-54.5 32.5q13 19 36 31t40 15.5t47 8.5q198 35 408 1q33 -5 51 -8.5t43 -16t39 -31.5zM1142 327q0 7 5.5 26.5t3 32t-17.5 16.5q-161 -106 -365 -106t-366 106l-12 -6l-5 -12q26 -154 41 -210q47 -81 204 -108q249 -46 428 53q34 19 49 51.5t22.5 85.5t12.5 71z
+M1272 1020q9 53 -8 75q-43 55 -155 88q-216 63 -487 36q-132 -12 -226 -46q-38 -15 -59.5 -25t-47 -34t-29.5 -54q8 -68 19 -138t29 -171t24 -137q1 -5 5 -31t7 -36t12 -27t22 -28q105 -80 284 -100q259 -28 440 63q24 13 39.5 23t31 29t19.5 40q48 267 80 473zM1536 1120
+v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="tumblr" unicode="&#xf173;" horiz-adv-x="1024" 
+d="M944 207l80 -237q-23 -35 -111 -66t-177 -32q-104 -2 -190.5 26t-142.5 74t-95 106t-55.5 120t-16.5 118v544h-168v215q72 26 129 69.5t91 90t58 102t34 99t15 88.5q1 5 4.5 8.5t7.5 3.5h244v-424h333v-252h-334v-518q0 -30 6.5 -56t22.5 -52.5t49.5 -41.5t81.5 -14
+q78 2 134 29z" />
+    <glyph glyph-name="tumblr_sign" unicode="&#xf174;" 
+d="M1136 75l-62 183q-44 -22 -103 -22q-36 -1 -62 10.5t-38.5 31.5t-17.5 40.5t-5 43.5v398h257v194h-256v326h-188q-8 0 -9 -10q-5 -44 -17.5 -87t-39 -95t-77 -95t-118.5 -68v-165h130v-418q0 -57 21.5 -115t65 -111t121 -85.5t176.5 -30.5q69 1 136.5 25t85.5 50z
+M1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="long_arrow_down" unicode="&#xf175;" horiz-adv-x="768" 
+d="M765 237q8 -19 -5 -35l-350 -384q-10 -10 -23 -10q-14 0 -24 10l-355 384q-13 16 -5 35q9 19 29 19h224v1248q0 14 9 23t23 9h192q14 0 23 -9t9 -23v-1248h224q21 0 29 -19z" />
+    <glyph glyph-name="long_arrow_up" unicode="&#xf176;" horiz-adv-x="768" 
+d="M765 1043q-9 -19 -29 -19h-224v-1248q0 -14 -9 -23t-23 -9h-192q-14 0 -23 9t-9 23v1248h-224q-21 0 -29 19t5 35l350 384q10 10 23 10q14 0 24 -10l355 -384q13 -16 5 -35z" />
+    <glyph glyph-name="long_arrow_left" unicode="&#xf177;" horiz-adv-x="1792" 
+d="M1792 736v-192q0 -14 -9 -23t-23 -9h-1248v-224q0 -21 -19 -29t-35 5l-384 350q-10 10 -10 23q0 14 10 24l384 354q16 14 35 6q19 -9 19 -29v-224h1248q14 0 23 -9t9 -23z" />
+    <glyph glyph-name="long_arrow_right" unicode="&#xf178;" horiz-adv-x="1792" 
+d="M1728 643q0 -14 -10 -24l-384 -354q-16 -14 -35 -6q-19 9 -19 29v224h-1248q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h1248v224q0 21 19 29t35 -5l384 -350q10 -10 10 -23z" />
+    <glyph glyph-name="apple" unicode="&#xf179;" horiz-adv-x="1408" 
+d="M1393 321q-39 -125 -123 -250q-129 -196 -257 -196q-49 0 -140 32q-86 32 -151 32q-61 0 -142 -33q-81 -34 -132 -34q-152 0 -301 259q-147 261 -147 503q0 228 113 374q113 144 284 144q72 0 177 -30q104 -30 138 -30q45 0 143 34q102 34 173 34q119 0 213 -65
+q52 -36 104 -100q-79 -67 -114 -118q-65 -94 -65 -207q0 -124 69 -223t158 -126zM1017 1494q0 -61 -29 -136q-30 -75 -93 -138q-54 -54 -108 -72q-37 -11 -104 -17q3 149 78 257q74 107 250 148q1 -3 2.5 -11t2.5 -11q0 -4 0.5 -10t0.5 -10z" />
+    <glyph glyph-name="windows" unicode="&#xf17a;" horiz-adv-x="1664" 
+d="M682 530v-651l-682 94v557h682zM682 1273v-659h-682v565zM1664 530v-786l-907 125v661h907zM1664 1408v-794h-907v669z" />
+    <glyph glyph-name="android" unicode="&#xf17b;" horiz-adv-x="1408" 
+d="M493 1053q16 0 27.5 11.5t11.5 27.5t-11.5 27.5t-27.5 11.5t-27 -11.5t-11 -27.5t11 -27.5t27 -11.5zM915 1053q16 0 27 11.5t11 27.5t-11 27.5t-27 11.5t-27.5 -11.5t-11.5 -27.5t11.5 -27.5t27.5 -11.5zM103 869q42 0 72 -30t30 -72v-430q0 -43 -29.5 -73t-72.5 -30
+t-73 30t-30 73v430q0 42 30 72t73 30zM1163 850v-666q0 -46 -32 -78t-77 -32h-75v-227q0 -43 -30 -73t-73 -30t-73 30t-30 73v227h-138v-227q0 -43 -30 -73t-73 -30q-42 0 -72 30t-30 73l-1 227h-74q-46 0 -78 32t-32 78v666h918zM931 1255q107 -55 171 -153.5t64 -215.5
+h-925q0 117 64 215.5t172 153.5l-71 131q-7 13 5 20q13 6 20 -6l72 -132q95 42 201 42t201 -42l72 132q7 12 20 6q12 -7 5 -20zM1408 767v-430q0 -43 -30 -73t-73 -30q-42 0 -72 30t-30 73v430q0 43 30 72.5t72 29.5q43 0 73 -29.5t30 -72.5z" />
+    <glyph glyph-name="linux" unicode="&#xf17c;" 
+d="M663 1125q-11 -1 -15.5 -10.5t-8.5 -9.5q-5 -1 -5 5q0 12 19 15h10zM750 1111q-4 -1 -11.5 6.5t-17.5 4.5q24 11 32 -2q3 -6 -3 -9zM399 684q-4 1 -6 -3t-4.5 -12.5t-5.5 -13.5t-10 -13q-10 -11 -1 -12q4 -1 12.5 7t12.5 18q1 3 2 7t2 6t1.5 4.5t0.5 4v3t-1 2.5t-3 2z
+M1254 325q0 18 -55 42q4 15 7.5 27.5t5 26t3 21.5t0.5 22.5t-1 19.5t-3.5 22t-4 20.5t-5 25t-5.5 26.5q-10 48 -47 103t-72 75q24 -20 57 -83q87 -162 54 -278q-11 -40 -50 -42q-31 -4 -38.5 18.5t-8 83.5t-11.5 107q-9 39 -19.5 69t-19.5 45.5t-15.5 24.5t-13 15t-7.5 7
+q-14 62 -31 103t-29.5 56t-23.5 33t-15 40q-4 21 6 53.5t4.5 49.5t-44.5 25q-15 3 -44.5 18t-35.5 16q-8 1 -11 26t8 51t36 27q37 3 51 -30t4 -58q-11 -19 -2 -26.5t30 -0.5q13 4 13 36v37q-5 30 -13.5 50t-21 30.5t-23.5 15t-27 7.5q-107 -8 -89 -134q0 -15 -1 -15
+q-9 9 -29.5 10.5t-33 -0.5t-15.5 5q1 57 -16 90t-45 34q-27 1 -41.5 -27.5t-16.5 -59.5q-1 -15 3.5 -37t13 -37.5t15.5 -13.5q10 3 16 14q4 9 -7 8q-7 0 -15.5 14.5t-9.5 33.5q-1 22 9 37t34 14q17 0 27 -21t9.5 -39t-1.5 -22q-22 -15 -31 -29q-8 -12 -27.5 -23.5
+t-20.5 -12.5q-13 -14 -15.5 -27t7.5 -18q14 -8 25 -19.5t16 -19t18.5 -13t35.5 -6.5q47 -2 102 15q2 1 23 7t34.5 10.5t29.5 13t21 17.5q9 14 20 8q5 -3 6.5 -8.5t-3 -12t-16.5 -9.5q-20 -6 -56.5 -21.5t-45.5 -19.5q-44 -19 -70 -23q-25 -5 -79 2q-10 2 -9 -2t17 -19
+q25 -23 67 -22q17 1 36 7t36 14t33.5 17.5t30 17t24.5 12t17.5 2.5t8.5 -11q0 -2 -1 -4.5t-4 -5t-6 -4.5t-8.5 -5t-9 -4.5t-10 -5t-9.5 -4.5q-28 -14 -67.5 -44t-66.5 -43t-49 -1q-21 11 -63 73q-22 31 -25 22q-1 -3 -1 -10q0 -25 -15 -56.5t-29.5 -55.5t-21 -58t11.5 -63
+q-23 -6 -62.5 -90t-47.5 -141q-2 -18 -1.5 -69t-5.5 -59q-8 -24 -29 -3q-32 31 -36 94q-2 28 4 56q4 19 -1 18q-2 -1 -4 -5q-36 -65 10 -166q5 -12 25 -28t24 -20q20 -23 104 -90.5t93 -76.5q16 -15 17.5 -38t-14 -43t-45.5 -23q8 -15 29 -44.5t28 -54t7 -70.5q46 24 7 92
+q-4 8 -10.5 16t-9.5 12t-2 6q3 5 13 9.5t20 -2.5q46 -52 166 -36q133 15 177 87q23 38 34 30q12 -6 10 -52q-1 -25 -23 -92q-9 -23 -6 -37.5t24 -15.5q3 19 14.5 77t13.5 90q2 21 -6.5 73.5t-7.5 97t23 70.5q15 18 51 18q1 37 34.5 53t72.5 10.5t60 -22.5zM626 1152
+q3 17 -2.5 30t-11.5 15q-9 2 -9 -7q2 -5 5 -6q10 0 7 -15q-3 -20 8 -20q3 0 3 3zM1045 955q-2 8 -6.5 11.5t-13 5t-14.5 5.5q-5 3 -9.5 8t-7 8t-5.5 6.5t-4 4t-4 -1.5q-14 -16 7 -43.5t39 -31.5q9 -1 14.5 8t3.5 20zM867 1168q0 11 -5 19.5t-11 12.5t-9 3q-6 0 -8 -2t0 -4
+t5 -3q14 -4 18 -31q0 -3 8 2q2 2 2 3zM921 1401q0 2 -2.5 5t-9 7t-9.5 6q-15 15 -24 15q-9 -1 -11.5 -7.5t-1 -13t-0.5 -12.5q-1 -4 -6 -10.5t-6 -9t3 -8.5q4 -3 8 0t11 9t15 9q1 1 9 1t15 2t9 7zM1486 60q20 -12 31 -24.5t12 -24t-2.5 -22.5t-15.5 -22t-23.5 -19.5
+t-30 -18.5t-31.5 -16.5t-32 -15.5t-27 -13q-38 -19 -85.5 -56t-75.5 -64q-17 -16 -68 -19.5t-89 14.5q-18 9 -29.5 23.5t-16.5 25.5t-22 19.5t-47 9.5q-44 1 -130 1q-19 0 -57 -1.5t-58 -2.5q-44 -1 -79.5 -15t-53.5 -30t-43.5 -28.5t-53.5 -11.5q-29 1 -111 31t-146 43
+q-19 4 -51 9.5t-50 9t-39.5 9.5t-33.5 14.5t-17 19.5q-10 23 7 66.5t18 54.5q1 16 -4 40t-10 42.5t-4.5 36.5t10.5 27q14 12 57 14t60 12q30 18 42 35t12 51q21 -73 -32 -106q-32 -20 -83 -15q-34 3 -43 -10q-13 -15 5 -57q2 -6 8 -18t8.5 -18t4.5 -17t1 -22q0 -15 -17 -49
+t-14 -48q3 -17 37 -26q20 -6 84.5 -18.5t99.5 -20.5q24 -6 74 -22t82.5 -23t55.5 -4q43 6 64.5 28t23 48t-7.5 58.5t-19 52t-20 36.5q-121 190 -169 242q-68 74 -113 40q-11 -9 -15 15q-3 16 -2 38q1 29 10 52t24 47t22 42q8 21 26.5 72t29.5 78t30 61t39 54
+q110 143 124 195q-12 112 -16 310q-2 90 24 151.5t106 104.5q39 21 104 21q53 1 106 -13.5t89 -41.5q57 -42 91.5 -121.5t29.5 -147.5q-5 -95 30 -214q34 -113 133 -218q55 -59 99.5 -163t59.5 -191q8 -49 5 -84.5t-12 -55.5t-20 -22q-10 -2 -23.5 -19t-27 -35.5
+t-40.5 -33.5t-61 -14q-18 1 -31.5 5t-22.5 13.5t-13.5 15.5t-11.5 20.5t-9 19.5q-22 37 -41 30t-28 -49t7 -97q20 -70 1 -195q-10 -65 18 -100.5t73 -33t85 35.5q59 49 89.5 66.5t103.5 42.5q53 18 77 36.5t18.5 34.5t-25 28.5t-51.5 23.5q-33 11 -49.5 48t-15 72.5
+t15.5 47.5q1 -31 8 -56.5t14.5 -40.5t20.5 -28.5t21 -19t21.5 -13t16.5 -9.5z" />
+    <glyph glyph-name="dribble" unicode="&#xf17d;" 
+d="M1024 36q-42 241 -140 498h-2l-2 -1q-16 -6 -43 -16.5t-101 -49t-137 -82t-131 -114.5t-103 -148l-15 11q184 -150 418 -150q132 0 256 52zM839 643q-21 49 -53 111q-311 -93 -673 -93q-1 -7 -1 -21q0 -124 44 -236.5t124 -201.5q50 89 123.5 166.5t142.5 124.5t130.5 81
+t99.5 48l37 13q4 1 13 3.5t13 4.5zM732 855q-120 213 -244 378q-138 -65 -234 -186t-128 -272q302 0 606 80zM1416 536q-210 60 -409 29q87 -239 128 -469q111 75 185 189.5t96 250.5zM611 1277q-1 0 -2 -1q1 1 2 1zM1201 1132q-185 164 -433 164q-76 0 -155 -19
+q131 -170 246 -382q69 26 130 60.5t96.5 61.5t65.5 57t37.5 40.5zM1424 647q-3 232 -149 410l-1 -1q-9 -12 -19 -24.5t-43.5 -44.5t-71 -60.5t-100 -65t-131.5 -64.5q25 -53 44 -95q2 -5 6.5 -17t7.5 -17q36 5 74.5 7t73.5 2t69 -1.5t64 -4t56.5 -5.5t48 -6.5t36.5 -6
+t25 -4.5zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="skype" unicode="&#xf17e;" 
+d="M1173 473q0 50 -19.5 91.5t-48.5 68.5t-73 49t-82.5 34t-87.5 23l-104 24q-30 7 -44 10.5t-35 11.5t-30 16t-16.5 21t-7.5 30q0 77 144 77q43 0 77 -12t54 -28.5t38 -33.5t40 -29t48 -12q47 0 75.5 32t28.5 77q0 55 -56 99.5t-142 67.5t-182 23q-68 0 -132 -15.5
+t-119.5 -47t-89 -87t-33.5 -128.5q0 -61 19 -106.5t56 -75.5t80 -48.5t103 -32.5l146 -36q90 -22 112 -36q32 -20 32 -60q0 -39 -40 -64.5t-105 -25.5q-51 0 -91.5 16t-65 38.5t-45.5 45t-46 38.5t-54 16q-50 0 -75.5 -30t-25.5 -75q0 -92 122 -157.5t291 -65.5
+q73 0 140 18.5t122.5 53.5t88.5 93.5t33 131.5zM1536 256q0 -159 -112.5 -271.5t-271.5 -112.5q-130 0 -234 80q-77 -16 -150 -16q-143 0 -273.5 55.5t-225 150t-150 225t-55.5 273.5q0 73 16 150q-80 104 -80 234q0 159 112.5 271.5t271.5 112.5q130 0 234 -80
+q77 16 150 16q143 0 273.5 -55.5t225 -150t150 -225t55.5 -273.5q0 -73 -16 -150q80 -104 80 -234z" />
+    <glyph glyph-name="foursquare" unicode="&#xf180;" horiz-adv-x="1280" 
+d="M1000 1102l37 194q5 23 -9 40t-35 17h-712q-23 0 -38.5 -17t-15.5 -37v-1101q0 -7 6 -1l291 352q23 26 38 33.5t48 7.5h239q22 0 37 14.5t18 29.5q24 130 37 191q4 21 -11.5 40t-36.5 19h-294q-29 0 -48 19t-19 48v42q0 29 19 47.5t48 18.5h346q18 0 35 13.5t20 29.5z
+M1227 1324q-15 -73 -53.5 -266.5t-69.5 -350t-35 -173.5q-6 -22 -9 -32.5t-14 -32.5t-24.5 -33t-38.5 -21t-58 -10h-271q-13 0 -22 -10q-8 -9 -426 -494q-22 -25 -58.5 -28.5t-48.5 5.5q-55 22 -55 98v1410q0 55 38 102.5t120 47.5h888q95 0 127 -53t10 -159zM1227 1324
+l-158 -790q4 17 35 173.5t69.5 350t53.5 266.5z" />
+    <glyph glyph-name="trello" unicode="&#xf181;" 
+d="M704 192v1024q0 14 -9 23t-23 9h-480q-14 0 -23 -9t-9 -23v-1024q0 -14 9 -23t23 -9h480q14 0 23 9t9 23zM1376 576v640q0 14 -9 23t-23 9h-480q-14 0 -23 -9t-9 -23v-640q0 -14 9 -23t23 -9h480q14 0 23 9t9 23zM1536 1344v-1408q0 -26 -19 -45t-45 -19h-1408
+q-26 0 -45 19t-19 45v1408q0 26 19 45t45 19h1408q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="female" unicode="&#xf182;" horiz-adv-x="1280" 
+d="M1280 480q0 -40 -28 -68t-68 -28q-51 0 -80 43l-227 341h-45v-132l247 -411q9 -15 9 -33q0 -26 -19 -45t-45 -19h-192v-272q0 -46 -33 -79t-79 -33h-160q-46 0 -79 33t-33 79v272h-192q-26 0 -45 19t-19 45q0 18 9 33l247 411v132h-45l-227 -341q-29 -43 -80 -43
+q-40 0 -68 28t-28 68q0 29 16 53l256 384q73 107 176 107h384q103 0 176 -107l256 -384q16 -24 16 -53zM864 1280q0 -93 -65.5 -158.5t-158.5 -65.5t-158.5 65.5t-65.5 158.5t65.5 158.5t158.5 65.5t158.5 -65.5t65.5 -158.5z" />
+    <glyph glyph-name="male" unicode="&#xf183;" horiz-adv-x="1024" 
+d="M1024 832v-416q0 -40 -28 -68t-68 -28t-68 28t-28 68v352h-64v-912q0 -46 -33 -79t-79 -33t-79 33t-33 79v464h-64v-464q0 -46 -33 -79t-79 -33t-79 33t-33 79v912h-64v-352q0 -40 -28 -68t-68 -28t-68 28t-28 68v416q0 80 56 136t136 56h640q80 0 136 -56t56 -136z
+M736 1280q0 -93 -65.5 -158.5t-158.5 -65.5t-158.5 65.5t-65.5 158.5t65.5 158.5t158.5 65.5t158.5 -65.5t65.5 -158.5z" />
+    <glyph glyph-name="gittip" unicode="&#xf184;" 
+d="M773 234l350 473q16 22 24.5 59t-6 85t-61.5 79q-40 26 -83 25.5t-73.5 -17.5t-54.5 -45q-36 -40 -96 -40q-59 0 -95 40q-24 28 -54.5 45t-73.5 17.5t-84 -25.5q-46 -31 -60.5 -79t-6 -85t24.5 -59zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103
+t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="sun" unicode="&#xf185;" horiz-adv-x="1792" 
+d="M1472 640q0 117 -45.5 223.5t-123 184t-184 123t-223.5 45.5t-223.5 -45.5t-184 -123t-123 -184t-45.5 -223.5t45.5 -223.5t123 -184t184 -123t223.5 -45.5t223.5 45.5t184 123t123 184t45.5 223.5zM1748 363q-4 -15 -20 -20l-292 -96v-306q0 -16 -13 -26q-15 -10 -29 -4
+l-292 94l-180 -248q-10 -13 -26 -13t-26 13l-180 248l-292 -94q-14 -6 -29 4q-13 10 -13 26v306l-292 96q-16 5 -20 20q-5 17 4 29l180 248l-180 248q-9 13 -4 29q4 15 20 20l292 96v306q0 16 13 26q15 10 29 4l292 -94l180 248q9 12 26 12t26 -12l180 -248l292 94
+q14 6 29 -4q13 -10 13 -26v-306l292 -96q16 -5 20 -20q5 -16 -4 -29l-180 -248l180 -248q9 -12 4 -29z" />
+    <glyph glyph-name="_366" unicode="&#xf186;" 
+d="M1262 233q-54 -9 -110 -9q-182 0 -337 90t-245 245t-90 337q0 192 104 357q-201 -60 -328.5 -229t-127.5 -384q0 -130 51 -248.5t136.5 -204t204 -136.5t248.5 -51q144 0 273.5 61.5t220.5 171.5zM1465 318q-94 -203 -283.5 -324.5t-413.5 -121.5q-156 0 -298 61
+t-245 164t-164 245t-61 298q0 153 57.5 292.5t156 241.5t235.5 164.5t290 68.5q44 2 61 -39q18 -41 -15 -72q-86 -78 -131.5 -181.5t-45.5 -218.5q0 -148 73 -273t198 -198t273 -73q118 0 228 51q41 18 72 -13q14 -14 17.5 -34t-4.5 -38z" />
+    <glyph glyph-name="archive" unicode="&#xf187;" horiz-adv-x="1792" 
+d="M1088 704q0 26 -19 45t-45 19h-256q-26 0 -45 -19t-19 -45t19 -45t45 -19h256q26 0 45 19t19 45zM1664 896v-960q0 -26 -19 -45t-45 -19h-1408q-26 0 -45 19t-19 45v960q0 26 19 45t45 19h1408q26 0 45 -19t19 -45zM1728 1344v-256q0 -26 -19 -45t-45 -19h-1536
+q-26 0 -45 19t-19 45v256q0 26 19 45t45 19h1536q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="bug" unicode="&#xf188;" horiz-adv-x="1664" 
+d="M1632 576q0 -26 -19 -45t-45 -19h-224q0 -171 -67 -290l208 -209q19 -19 19 -45t-19 -45q-18 -19 -45 -19t-45 19l-198 197q-5 -5 -15 -13t-42 -28.5t-65 -36.5t-82 -29t-97 -13v896h-128v-896q-51 0 -101.5 13.5t-87 33t-66 39t-43.5 32.5l-15 14l-183 -207
+q-20 -21 -48 -21q-24 0 -43 16q-19 18 -20.5 44.5t15.5 46.5l202 227q-58 114 -58 274h-224q-26 0 -45 19t-19 45t19 45t45 19h224v294l-173 173q-19 19 -19 45t19 45t45 19t45 -19l173 -173h844l173 173q19 19 45 19t45 -19t19 -45t-19 -45l-173 -173v-294h224q26 0 45 -19
+t19 -45zM1152 1152h-640q0 133 93.5 226.5t226.5 93.5t226.5 -93.5t93.5 -226.5z" />
+    <glyph glyph-name="vk" unicode="&#xf189;" horiz-adv-x="1920" 
+d="M1917 1016q23 -64 -150 -294q-24 -32 -65 -85q-40 -51 -55 -72t-30.5 -49.5t-12 -42t13 -34.5t32.5 -43t57 -53q4 -2 5 -4q141 -131 191 -221q3 -5 6.5 -12.5t7 -26.5t-0.5 -34t-25 -27.5t-59 -12.5l-256 -4q-24 -5 -56 5t-52 22l-20 12q-30 21 -70 64t-68.5 77.5t-61 58
+t-56.5 15.5q-3 -1 -8 -3.5t-17 -14.5t-21.5 -29.5t-17 -52t-6.5 -77.5q0 -15 -3.5 -27.5t-7.5 -18.5l-4 -5q-18 -19 -53 -22h-115q-71 -4 -146 16.5t-131.5 53t-103 66t-70.5 57.5l-25 24q-10 10 -27.5 30t-71.5 91t-106 151t-122.5 211t-130.5 272q-6 16 -6 27t3 16l4 6
+q15 19 57 19l274 2q12 -2 23 -6.5t16 -8.5l5 -3q16 -11 24 -32q20 -50 46 -103.5t41 -81.5l16 -29q29 -60 56 -104t48.5 -68.5t41.5 -38.5t34 -14t27 5q2 1 5 5t12 22t13.5 47t9.5 81t0 125q-2 40 -9 73t-14 46l-6 12q-25 34 -85 43q-13 2 5 24q16 19 38 30q53 26 239 24
+q82 -1 135 -13q20 -5 33.5 -13.5t20.5 -24t10.5 -32t3.5 -45.5t-1 -55t-2.5 -70.5t-1.5 -82.5q0 -11 -1 -42t-0.5 -48t3.5 -40.5t11.5 -39t22.5 -24.5q8 -2 17 -4t26 11t38 34.5t52 67t68 107.5q60 104 107 225q4 10 10 17.5t11 10.5l4 3l5 2.5t13 3t20 0.5l288 2
+q39 5 64 -2.5t31 -16.5z" />
+    <glyph glyph-name="weibo" unicode="&#xf18a;" horiz-adv-x="1792" 
+d="M675 252q21 34 11 69t-45 50q-34 14 -73 1t-60 -46q-22 -34 -13 -68.5t43 -50.5t74.5 -2.5t62.5 47.5zM769 373q8 13 3.5 26.5t-17.5 18.5q-14 5 -28.5 -0.5t-21.5 -18.5q-17 -31 13 -45q14 -5 29 0.5t22 18.5zM943 266q-45 -102 -158 -150t-224 -12
+q-107 34 -147.5 126.5t6.5 187.5q47 93 151.5 139t210.5 19q111 -29 158.5 -119.5t2.5 -190.5zM1255 426q-9 96 -89 170t-208.5 109t-274.5 21q-223 -23 -369.5 -141.5t-132.5 -264.5q9 -96 89 -170t208.5 -109t274.5 -21q223 23 369.5 141.5t132.5 264.5zM1563 422
+q0 -68 -37 -139.5t-109 -137t-168.5 -117.5t-226 -83t-270.5 -31t-275 33.5t-240.5 93t-171.5 151t-65 199.5q0 115 69.5 245t197.5 258q169 169 341.5 236t246.5 -7q65 -64 20 -209q-4 -14 -1 -20t10 -7t14.5 0.5t13.5 3.5l6 2q139 59 246 59t153 -61q45 -63 0 -178
+q-2 -13 -4.5 -20t4.5 -12.5t12 -7.5t17 -6q57 -18 103 -47t80 -81.5t34 -116.5zM1489 1046q42 -47 54.5 -108.5t-6.5 -117.5q-8 -23 -29.5 -34t-44.5 -4q-23 8 -34 29.5t-4 44.5q20 63 -24 111t-107 35q-24 -5 -45 8t-25 37q-5 24 8 44.5t37 25.5q60 13 119 -5.5t101 -65.5z
+M1670 1209q87 -96 112.5 -222.5t-13.5 -241.5q-9 -27 -34 -40t-52 -4t-40 34t-5 52q28 82 10 172t-80 158q-62 69 -148 95.5t-173 8.5q-28 -6 -52 9.5t-30 43.5t9.5 51.5t43.5 29.5q123 26 244 -11.5t208 -134.5z" />
+    <glyph glyph-name="renren" unicode="&#xf18b;" 
+d="M1133 -34q-171 -94 -368 -94q-196 0 -367 94q138 87 235.5 211t131.5 268q35 -144 132.5 -268t235.5 -211zM638 1394v-485q0 -252 -126.5 -459.5t-330.5 -306.5q-181 215 -181 495q0 187 83.5 349.5t229.5 269.5t325 137zM1536 638q0 -280 -181 -495
+q-204 99 -330.5 306.5t-126.5 459.5v485q179 -30 325 -137t229.5 -269.5t83.5 -349.5z" />
+    <glyph glyph-name="_372" unicode="&#xf18c;" horiz-adv-x="1408" 
+d="M1402 433q-32 -80 -76 -138t-91 -88.5t-99 -46.5t-101.5 -14.5t-96.5 8.5t-86.5 22t-69.5 27.5t-46 22.5l-17 10q-113 -228 -289.5 -359.5t-384.5 -132.5q-19 0 -32 13t-13 32t13 31.5t32 12.5q173 1 322.5 107.5t251.5 294.5q-36 -14 -72 -23t-83 -13t-91 2.5t-93 28.5
+t-92 59t-84.5 100t-74.5 146q114 47 214 57t167.5 -7.5t124.5 -56.5t88.5 -77t56.5 -82q53 131 79 291q-7 -1 -18 -2.5t-46.5 -2.5t-69.5 0.5t-81.5 10t-88.5 23t-84 42.5t-75 65t-54.5 94.5t-28.5 127.5q70 28 133.5 36.5t112.5 -1t92 -30t73.5 -50t56 -61t42 -63t27.5 -56
+t16 -39.5l4 -16q12 122 12 195q-8 6 -21.5 16t-49 44.5t-63.5 71.5t-54 93t-33 112.5t12 127t70 138.5q73 -25 127.5 -61.5t84.5 -76.5t48 -85t20.5 -89t-0.5 -85.5t-13 -76.5t-19 -62t-17 -42l-7 -15q1 -4 1 -50t-1 -72q3 7 10 18.5t30.5 43t50.5 58t71 55.5t91.5 44.5
+t112 14.5t132.5 -24q-2 -78 -21.5 -141.5t-50 -104.5t-69.5 -71.5t-81.5 -45.5t-84.5 -24t-80 -9.5t-67.5 1t-46.5 4.5l-17 3q-23 -147 -73 -283q6 7 18 18.5t49.5 41t77.5 52.5t99.5 42t117.5 20t129 -23.5t137 -77.5z" />
+    <glyph glyph-name="stack_exchange" unicode="&#xf18d;" horiz-adv-x="1280" 
+d="M1259 283v-66q0 -85 -57.5 -144.5t-138.5 -59.5h-57l-260 -269v269h-529q-81 0 -138.5 59.5t-57.5 144.5v66h1238zM1259 609v-255h-1238v255h1238zM1259 937v-255h-1238v255h1238zM1259 1077v-67h-1238v67q0 84 57.5 143.5t138.5 59.5h846q81 0 138.5 -59.5t57.5 -143.5z
+" />
+    <glyph glyph-name="_374" unicode="&#xf18e;" 
+d="M1152 640q0 -14 -9 -23l-320 -320q-9 -9 -23 -9q-13 0 -22.5 9.5t-9.5 22.5v192h-352q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5t22.5 9.5h352v192q0 14 9 23t23 9q12 0 24 -10l319 -319q9 -9 9 -23zM1312 640q0 148 -73 273t-198 198t-273 73t-273 -73t-198 -198
+t-73 -273t73 -273t198 -198t273 -73t273 73t198 198t73 273zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="arrow_circle_alt_left" unicode="&#xf190;" 
+d="M1152 736v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-352v-192q0 -14 -9 -23t-23 -9q-12 0 -24 10l-319 319q-9 9 -9 23t9 23l320 320q9 9 23 9q13 0 22.5 -9.5t9.5 -22.5v-192h352q13 0 22.5 -9.5t9.5 -22.5zM1312 640q0 148 -73 273t-198 198t-273 73t-273 -73t-198 -198
+t-73 -273t73 -273t198 -198t273 -73t273 73t198 198t73 273zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="_376" unicode="&#xf191;" 
+d="M1024 960v-640q0 -26 -19 -45t-45 -19q-20 0 -37 12l-448 320q-27 19 -27 52t27 52l448 320q17 12 37 12q26 0 45 -19t19 -45zM1280 160v960q0 13 -9.5 22.5t-22.5 9.5h-960q-13 0 -22.5 -9.5t-9.5 -22.5v-960q0 -13 9.5 -22.5t22.5 -9.5h960q13 0 22.5 9.5t9.5 22.5z
+M1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="dot_circle_alt" unicode="&#xf192;" 
+d="M1024 640q0 -106 -75 -181t-181 -75t-181 75t-75 181t75 181t181 75t181 -75t75 -181zM768 1184q-148 0 -273 -73t-198 -198t-73 -273t73 -273t198 -198t273 -73t273 73t198 198t73 273t-73 273t-198 198t-273 73zM1536 640q0 -209 -103 -385.5t-279.5 -279.5
+t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="_378" unicode="&#xf193;" horiz-adv-x="1664" 
+d="M1023 349l102 -204q-58 -179 -210 -290t-339 -111q-156 0 -288.5 77.5t-210 210t-77.5 288.5q0 181 104.5 330t274.5 211l17 -131q-122 -54 -195 -165.5t-73 -244.5q0 -185 131.5 -316.5t316.5 -131.5q126 0 232.5 65t165 175.5t49.5 236.5zM1571 249l58 -114l-256 -128
+q-13 -7 -29 -7q-40 0 -57 35l-239 477h-472q-24 0 -42.5 16.5t-21.5 40.5l-96 779q-2 17 6 42q14 51 57 82.5t97 31.5q66 0 113 -47t47 -113q0 -69 -52 -117.5t-120 -41.5l37 -289h423v-128h-407l16 -128h455q40 0 57 -35l228 -455z" />
+    <glyph glyph-name="vimeo_square" unicode="&#xf194;" 
+d="M1292 898q10 216 -161 222q-231 8 -312 -261q44 19 82 19q85 0 74 -96q-4 -57 -74 -167t-105 -110q-43 0 -82 169q-13 54 -45 255q-30 189 -160 177q-59 -7 -164 -100l-81 -72l-81 -72l52 -67q76 52 87 52q57 0 107 -179q15 -55 45 -164.5t45 -164.5q68 -179 164 -179
+q157 0 383 294q220 283 226 444zM1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="_380" unicode="&#xf195;" horiz-adv-x="1152" 
+d="M1152 704q0 -191 -94.5 -353t-256.5 -256.5t-353 -94.5h-160q-14 0 -23 9t-9 23v611l-215 -66q-3 -1 -9 -1q-10 0 -19 6q-13 10 -13 26v128q0 23 23 31l233 71v93l-215 -66q-3 -1 -9 -1q-10 0 -19 6q-13 10 -13 26v128q0 23 23 31l233 71v250q0 14 9 23t23 9h160
+q14 0 23 -9t9 -23v-181l375 116q15 5 28 -5t13 -26v-128q0 -23 -23 -31l-393 -121v-93l375 116q15 5 28 -5t13 -26v-128q0 -23 -23 -31l-393 -121v-487q188 13 318 151t130 328q0 14 9 23t23 9h160q14 0 23 -9t9 -23z" />
+    <glyph glyph-name="plus_square_o" unicode="&#xf196;" horiz-adv-x="1408" 
+d="M1152 736v-64q0 -14 -9 -23t-23 -9h-352v-352q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v352h-352q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h352v352q0 14 9 23t23 9h64q14 0 23 -9t9 -23v-352h352q14 0 23 -9t9 -23zM1280 288v832q0 66 -47 113t-113 47h-832
+q-66 0 -113 -47t-47 -113v-832q0 -66 47 -113t113 -47h832q66 0 113 47t47 113zM1408 1120v-832q0 -119 -84.5 -203.5t-203.5 -84.5h-832q-119 0 -203.5 84.5t-84.5 203.5v832q0 119 84.5 203.5t203.5 84.5h832q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="_382" unicode="&#xf197;" horiz-adv-x="2176" 
+d="M620 416q-110 -64 -268 -64h-128v64h-64q-13 0 -22.5 23.5t-9.5 56.5q0 24 7 49q-58 2 -96.5 10.5t-38.5 20.5t38.5 20.5t96.5 10.5q-7 25 -7 49q0 33 9.5 56.5t22.5 23.5h64v64h128q158 0 268 -64h1113q42 -7 106.5 -18t80.5 -14q89 -15 150 -40.5t83.5 -47.5t22.5 -40
+t-22.5 -40t-83.5 -47.5t-150 -40.5q-16 -3 -80.5 -14t-106.5 -18h-1113zM1739 668q53 -36 53 -92t-53 -92l81 -30q68 48 68 122t-68 122zM625 400h1015q-217 -38 -456 -80q-57 0 -113 -24t-83 -48l-28 -24l-288 -288q-26 -26 -70.5 -45t-89.5 -19h-96l-93 464h29
+q157 0 273 64zM352 816h-29l93 464h96q46 0 90 -19t70 -45l288 -288q4 -4 11 -10.5t30.5 -23t48.5 -29t61.5 -23t72.5 -10.5l456 -80h-1015q-116 64 -273 64z" />
+    <glyph glyph-name="_383" unicode="&#xf198;" horiz-adv-x="1664" 
+d="M1519 760q62 0 103.5 -40.5t41.5 -101.5q0 -97 -93 -130l-172 -59l56 -167q7 -21 7 -47q0 -59 -42 -102t-101 -43q-47 0 -85.5 27t-53.5 72l-55 165l-310 -106l55 -164q8 -24 8 -47q0 -59 -42 -102t-102 -43q-47 0 -85 27t-53 72l-55 163l-153 -53q-29 -9 -50 -9
+q-61 0 -101.5 40t-40.5 101q0 47 27.5 85t71.5 53l156 53l-105 313l-156 -54q-26 -8 -48 -8q-60 0 -101 40.5t-41 100.5q0 47 27.5 85t71.5 53l157 53l-53 159q-8 24 -8 47q0 60 42 102.5t102 42.5q47 0 85 -27t53 -72l54 -160l310 105l-54 160q-8 24 -8 47q0 59 42.5 102
+t101.5 43q47 0 85.5 -27.5t53.5 -71.5l53 -161l162 55q21 6 43 6q60 0 102.5 -39.5t42.5 -98.5q0 -45 -30 -81.5t-74 -51.5l-157 -54l105 -316l164 56q24 8 46 8zM725 498l310 105l-105 315l-310 -107z" />
+    <glyph glyph-name="_384" unicode="&#xf199;" 
+d="M1248 1408q119 0 203.5 -84.5t84.5 -203.5v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960zM1280 352v436q-31 -35 -64 -55q-34 -22 -132.5 -85t-151.5 -99q-98 -69 -164 -69v0v0q-66 0 -164 69
+q-47 32 -142 92.5t-142 92.5q-12 8 -33 27t-31 27v-436q0 -40 28 -68t68 -28h832q40 0 68 28t28 68zM1280 925q0 41 -27.5 70t-68.5 29h-832q-40 0 -68 -28t-28 -68q0 -37 30.5 -76.5t67.5 -64.5q47 -32 137.5 -89t129.5 -83q3 -2 17 -11.5t21 -14t21 -13t23.5 -13
+t21.5 -9.5t22.5 -7.5t20.5 -2.5t20.5 2.5t22.5 7.5t21.5 9.5t23.5 13t21 13t21 14t17 11.5l267 174q35 23 66.5 62.5t31.5 73.5z" />
+    <glyph glyph-name="_385" unicode="&#xf19a;" horiz-adv-x="1792" 
+d="M127 640q0 163 67 313l367 -1005q-196 95 -315 281t-119 411zM1415 679q0 -19 -2.5 -38.5t-10 -49.5t-11.5 -44t-17.5 -59t-17.5 -58l-76 -256l-278 826q46 3 88 8q19 2 26 18.5t-2.5 31t-28.5 13.5l-205 -10q-75 1 -202 10q-12 1 -20.5 -5t-11.5 -15t-1.5 -18.5t9 -16.5
+t19.5 -8l80 -8l120 -328l-168 -504l-280 832q46 3 88 8q19 2 26 18.5t-2.5 31t-28.5 13.5l-205 -10q-7 0 -23 0.5t-26 0.5q105 160 274.5 253.5t367.5 93.5q147 0 280.5 -53t238.5 -149h-10q-55 0 -92 -40.5t-37 -95.5q0 -12 2 -24t4 -21.5t8 -23t9 -21t12 -22.5t12.5 -21
+t14.5 -24t14 -23q63 -107 63 -212zM909 573l237 -647q1 -6 5 -11q-126 -44 -255 -44q-112 0 -217 32zM1570 1009q95 -174 95 -369q0 -209 -104 -385.5t-279 -278.5l235 678q59 169 59 276q0 42 -6 79zM896 1536q182 0 348 -71t286 -191t191 -286t71 -348t-71 -348t-191 -286
+t-286 -191t-348 -71t-348 71t-286 191t-191 286t-71 348t71 348t191 286t286 191t348 71zM896 -215q173 0 331.5 68t273 182.5t182.5 273t68 331.5t-68 331.5t-182.5 273t-273 182.5t-331.5 68t-331.5 -68t-273 -182.5t-182.5 -273t-68 -331.5t68 -331.5t182.5 -273
+t273 -182.5t331.5 -68z" />
+    <glyph glyph-name="_386" unicode="&#xf19b;" horiz-adv-x="1792" 
+d="M1086 1536v-1536l-272 -128q-228 20 -414 102t-293 208.5t-107 272.5q0 140 100.5 263.5t275 205.5t391.5 108v-172q-217 -38 -356.5 -150t-139.5 -255q0 -152 154.5 -267t388.5 -145v1360zM1755 954l37 -390l-525 114l147 83q-119 70 -280 99v172q277 -33 481 -157z" />
+    <glyph glyph-name="_387" unicode="&#xf19c;" horiz-adv-x="2048" 
+d="M960 1536l960 -384v-128h-128q0 -26 -20.5 -45t-48.5 -19h-1526q-28 0 -48.5 19t-20.5 45h-128v128zM256 896h256v-768h128v768h256v-768h128v768h256v-768h128v768h256v-768h59q28 0 48.5 -19t20.5 -45v-64h-1664v64q0 26 20.5 45t48.5 19h59v768zM1851 -64
+q28 0 48.5 -19t20.5 -45v-128h-1920v128q0 26 20.5 45t48.5 19h1782z" />
+    <glyph glyph-name="_388" unicode="&#xf19d;" horiz-adv-x="2304" 
+d="M1774 700l18 -316q4 -69 -82 -128t-235 -93.5t-323 -34.5t-323 34.5t-235 93.5t-82 128l18 316l574 -181q22 -7 48 -7t48 7zM2304 1024q0 -23 -22 -31l-1120 -352q-4 -1 -10 -1t-10 1l-652 206q-43 -34 -71 -111.5t-34 -178.5q63 -36 63 -109q0 -69 -58 -107l58 -433
+q2 -14 -8 -25q-9 -11 -24 -11h-192q-15 0 -24 11q-10 11 -8 25l58 433q-58 38 -58 107q0 73 65 111q11 207 98 330l-333 104q-22 8 -22 31t22 31l1120 352q4 1 10 1t10 -1l1120 -352q22 -8 22 -31z" />
+    <glyph glyph-name="_389" unicode="&#xf19e;" 
+d="M859 579l13 -707q-62 11 -105 11q-41 0 -105 -11l13 707q-40 69 -168.5 295.5t-216.5 374.5t-181 287q58 -15 108 -15q44 0 111 15q63 -111 133.5 -229.5t167 -276.5t138.5 -227q37 61 109.5 177.5t117.5 190t105 176t107 189.5q54 -14 107 -14q56 0 114 14v0
+q-28 -39 -60 -88.5t-49.5 -78.5t-56.5 -96t-49 -84q-146 -248 -353 -610z" />
+    <glyph glyph-name="uniF1A0" unicode="&#xf1a0;" 
+d="M768 750h725q12 -67 12 -128q0 -217 -91 -387.5t-259.5 -266.5t-386.5 -96q-157 0 -299 60.5t-245 163.5t-163.5 245t-60.5 299t60.5 299t163.5 245t245 163.5t299 60.5q300 0 515 -201l-209 -201q-123 119 -306 119q-129 0 -238.5 -65t-173.5 -176.5t-64 -243.5
+t64 -243.5t173.5 -176.5t238.5 -65q87 0 160 24t120 60t82 82t51.5 87t22.5 78h-436v264z" />
+    <glyph glyph-name="f1a1" unicode="&#xf1a1;" horiz-adv-x="1792" 
+d="M1095 369q16 -16 0 -31q-62 -62 -199 -62t-199 62q-16 15 0 31q6 6 15 6t15 -6q48 -49 169 -49q120 0 169 49q6 6 15 6t15 -6zM788 550q0 -37 -26 -63t-63 -26t-63.5 26t-26.5 63q0 38 26.5 64t63.5 26t63 -26.5t26 -63.5zM1183 550q0 -37 -26.5 -63t-63.5 -26t-63 26
+t-26 63t26 63.5t63 26.5t63.5 -26t26.5 -64zM1434 670q0 49 -35 84t-85 35t-86 -36q-130 90 -311 96l63 283l200 -45q0 -37 26 -63t63 -26t63.5 26.5t26.5 63.5t-26.5 63.5t-63.5 26.5q-54 0 -80 -50l-221 49q-19 5 -25 -16l-69 -312q-180 -7 -309 -97q-35 37 -87 37
+q-50 0 -85 -35t-35 -84q0 -35 18.5 -64t49.5 -44q-6 -27 -6 -56q0 -142 140 -243t337 -101q198 0 338 101t140 243q0 32 -7 57q30 15 48 43.5t18 63.5zM1792 640q0 -182 -71 -348t-191 -286t-286 -191t-348 -71t-348 71t-286 191t-191 286t-71 348t71 348t191 286t286 191
+t348 71t348 -71t286 -191t191 -286t71 -348z" />
+    <glyph glyph-name="_392" unicode="&#xf1a2;" 
+d="M939 407q13 -13 0 -26q-53 -53 -171 -53t-171 53q-13 13 0 26q5 6 13 6t13 -6q42 -42 145 -42t145 42q5 6 13 6t13 -6zM676 563q0 -31 -23 -54t-54 -23t-54 23t-23 54q0 32 22.5 54.5t54.5 22.5t54.5 -22.5t22.5 -54.5zM1014 563q0 -31 -23 -54t-54 -23t-54 23t-23 54
+q0 32 22.5 54.5t54.5 22.5t54.5 -22.5t22.5 -54.5zM1229 666q0 42 -30 72t-73 30q-42 0 -73 -31q-113 78 -267 82l54 243l171 -39q1 -32 23.5 -54t53.5 -22q32 0 54.5 22.5t22.5 54.5t-22.5 54.5t-54.5 22.5q-48 0 -69 -43l-189 42q-17 5 -21 -13l-60 -268q-154 -6 -265 -83
+q-30 32 -74 32q-43 0 -73 -30t-30 -72q0 -30 16 -55t42 -38q-5 -25 -5 -48q0 -122 120 -208.5t289 -86.5q170 0 290 86.5t120 208.5q0 25 -6 49q25 13 40.5 37.5t15.5 54.5zM1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960
+q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="_393" unicode="&#xf1a3;" 
+d="M866 697l90 27v62q0 79 -58 135t-138 56t-138 -55.5t-58 -134.5v-283q0 -20 -14 -33.5t-33 -13.5t-32.5 13.5t-13.5 33.5v120h-151v-122q0 -82 57.5 -139t139.5 -57q81 0 138.5 56.5t57.5 136.5v280q0 19 13.5 33t33.5 14q19 0 32.5 -14t13.5 -33v-54zM1199 502v122h-150
+v-126q0 -20 -13.5 -33.5t-33.5 -13.5q-19 0 -32.5 14t-13.5 33v123l-90 -26l-60 28v-123q0 -80 58 -137t139 -57t138.5 57t57.5 139zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103
+t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="f1a4" unicode="&#xf1a4;" horiz-adv-x="1920" 
+d="M1062 824v118q0 42 -30 72t-72 30t-72 -30t-30 -72v-612q0 -175 -126 -299t-303 -124q-178 0 -303.5 125.5t-125.5 303.5v266h328v-262q0 -43 30 -72.5t72 -29.5t72 29.5t30 72.5v620q0 171 126.5 292t301.5 121q176 0 302 -122t126 -294v-136l-195 -58zM1592 602h328
+v-266q0 -178 -125.5 -303.5t-303.5 -125.5q-177 0 -303 124.5t-126 300.5v268l131 -61l195 58v-270q0 -42 30 -71.5t72 -29.5t72 29.5t30 71.5v275z" />
+    <glyph glyph-name="_395" unicode="&#xf1a5;" 
+d="M1472 160v480h-704v704h-480q-93 0 -158.5 -65.5t-65.5 -158.5v-480h704v-704h480q93 0 158.5 65.5t65.5 158.5zM1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5
+t84.5 -203.5z" />
+    <glyph glyph-name="_396" unicode="&#xf1a6;" horiz-adv-x="2048" 
+d="M328 1254h204v-983h-532v697h328v286zM328 435v369h-123v-369h123zM614 968v-697h205v697h-205zM614 1254v-204h205v204h-205zM901 968h533v-942h-533v163h328v82h-328v697zM1229 435v369h-123v-369h123zM1516 968h532v-942h-532v163h327v82h-327v697zM1843 435v369h-123
+v-369h123z" />
+    <glyph glyph-name="_397" unicode="&#xf1a7;" 
+d="M1046 516q0 -64 -38 -109t-91 -45q-43 0 -70 15v277q28 17 70 17q53 0 91 -45.5t38 -109.5zM703 944q0 -64 -38 -109.5t-91 -45.5q-43 0 -70 15v277q28 17 70 17q53 0 91 -45t38 -109zM1265 513q0 134 -88 229t-213 95q-20 0 -39 -3q-23 -78 -78 -136q-87 -95 -211 -101
+v-636l211 41v206q51 -19 117 -19q125 0 213 95t88 229zM922 940q0 134 -88.5 229t-213.5 95q-74 0 -141 -36h-186v-840l211 41v206q55 -19 116 -19q125 0 213.5 95t88.5 229zM1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960
+q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="_398" unicode="&#xf1a8;" horiz-adv-x="2038" 
+d="M1222 607q75 3 143.5 -20.5t118 -58.5t101 -94.5t84 -108t75.5 -120.5q33 -56 78.5 -109t75.5 -80.5t99 -88.5q-48 -30 -108.5 -57.5t-138.5 -59t-114 -47.5q-44 37 -74 115t-43.5 164.5t-33 180.5t-42.5 168.5t-72.5 123t-122.5 48.5l-10 -2l-6 -4q4 -5 13 -14
+q6 -5 28 -23.5t25.5 -22t19 -18t18 -20.5t11.5 -21t10.5 -27.5t4.5 -31t4 -40.5l1 -33q1 -26 -2.5 -57.5t-7.5 -52t-12.5 -58.5t-11.5 -53q-35 1 -101 -9.5t-98 -10.5q-39 0 -72 10q-2 16 -2 47q0 74 3 96q2 13 31.5 41.5t57 59t26.5 51.5q-24 2 -43 -24
+q-36 -53 -111.5 -99.5t-136.5 -46.5q-25 0 -75.5 63t-106.5 139.5t-84 96.5q-6 4 -27 30q-482 -112 -513 -112q-16 0 -28 11t-12 27q0 15 8.5 26.5t22.5 14.5l486 106q-8 14 -8 25t5.5 17.5t16 11.5t20 7t23 4.5t18.5 4.5q4 1 15.5 7.5t17.5 6.5q15 0 28 -16t20 -33
+q163 37 172 37q17 0 29.5 -11t12.5 -28q0 -15 -8.5 -26t-23.5 -14l-182 -40l-1 -16q-1 -26 81.5 -117.5t104.5 -91.5q47 0 119 80t72 129q0 36 -23.5 53t-51 18.5t-51 11.5t-23.5 34q0 16 10 34l-68 19q43 44 43 117q0 26 -5 58q82 16 144 16q44 0 71.5 -1.5t48.5 -8.5
+t31 -13.5t20.5 -24.5t15.5 -33.5t17 -47.5t24 -60l50 25q-3 -40 -23 -60t-42.5 -21t-40 -6.5t-16.5 -20.5zM1282 842q-5 5 -13.5 15.5t-12 14.5t-10.5 11.5t-10 10.5l-8 8t-8.5 7.5t-8 5t-8.5 4.5q-7 3 -14.5 5t-20.5 2.5t-22 0.5h-32.5h-37.5q-126 0 -217 -43
+q16 30 36 46.5t54 29.5t65.5 36t46 36.5t50 55t43.5 50.5q12 -9 28 -31.5t32 -36.5t38 -13l12 1v-76l22 -1q247 95 371 190q28 21 50 39t42.5 37.5t33 31t29.5 34t24 31t24.5 37t23 38t27 47.5t29.5 53l7 9q-2 -53 -43 -139q-79 -165 -205 -264t-306 -142q-14 -3 -42 -7.5
+t-50 -9.5t-39 -14q3 -19 24.5 -46t21.5 -34q0 -11 -26 -30zM1061 -79q39 26 131.5 47.5t146.5 21.5q9 0 22.5 -15.5t28 -42.5t26 -50t24 -51t14.5 -33q-121 -45 -244 -45q-61 0 -125 11zM822 568l48 12l109 -177l-73 -48zM1323 51q3 -15 3 -16q0 -7 -17.5 -14.5t-46 -13
+t-54 -9.5t-53.5 -7.5t-32 -4.5l-7 43q21 2 60.5 8.5t72 10t60.5 3.5h14zM866 679l-96 -20l-6 17q10 1 32.5 7t34.5 6q19 0 35 -10zM1061 45h31l10 -83l-41 -12v95zM1950 1535v1v-1zM1950 1535l-1 -5l-2 -2l1 3zM1950 1535l1 1z" />
+    <glyph glyph-name="_399" unicode="&#xf1a9;" 
+d="M1167 -50q-5 19 -24 5q-30 -22 -87 -39t-131 -17q-129 0 -193 49q-5 4 -13 4q-11 0 -26 -12q-7 -6 -7.5 -16t7.5 -20q34 -32 87.5 -46t102.5 -12.5t99 4.5q41 4 84.5 20.5t65 30t28.5 20.5q12 12 7 29zM1128 65q-19 47 -39 61q-23 15 -76 15q-47 0 -71 -10
+q-29 -12 -78 -56q-26 -24 -12 -44q9 -8 17.5 -4.5t31.5 23.5q3 2 10.5 8.5t10.5 8.5t10 7t11.5 7t12.5 5t15 4.5t16.5 2.5t20.5 1q27 0 44.5 -7.5t23 -14.5t13.5 -22q10 -17 12.5 -20t12.5 1q23 12 14 34zM1483 346q0 22 -5 44.5t-16.5 45t-34 36.5t-52.5 14
+q-33 0 -97 -41.5t-129 -83.5t-101 -42q-27 -1 -63.5 19t-76 49t-83.5 58t-100 49t-111 19q-115 -1 -197 -78.5t-84 -178.5q-2 -112 74 -164q29 -20 62.5 -28.5t103.5 -8.5q57 0 132 32.5t134 71t120 70.5t93 31q26 -1 65 -31.5t71.5 -67t68 -67.5t55.5 -32q35 -3 58.5 14
+t55.5 63q28 41 42.5 101t14.5 106zM1536 506q0 -164 -62 -304.5t-166 -236t-242.5 -149.5t-290.5 -54t-293 57.5t-247.5 157t-170.5 241.5t-64 302q0 89 19.5 172.5t49 145.5t70.5 118.5t78.5 94t78.5 69.5t64.5 46.5t42.5 24.5q14 8 51 26.5t54.5 28.5t48 30t60.5 44
+q36 28 58 72.5t30 125.5q129 -155 186 -193q44 -29 130 -68t129 -66q21 -13 39 -25t60.5 -46.5t76 -70.5t75 -95t69 -122t47 -148.5t19.5 -177.5z" />
+    <glyph glyph-name="_400" unicode="&#xf1aa;" 
+d="M1070 463l-160 -160l-151 -152l-30 -30q-65 -64 -151.5 -87t-171.5 -2q-16 -70 -72 -115t-129 -45q-85 0 -145 60.5t-60 145.5q0 72 44.5 128t113.5 72q-22 86 1 173t88 152l12 12l151 -152l-11 -11q-37 -37 -37 -89t37 -90q37 -37 89 -37t89 37l30 30l151 152l161 160z
+M729 1145l12 -12l-152 -152l-12 12q-37 37 -89 37t-89 -37t-37 -89.5t37 -89.5l29 -29l152 -152l160 -160l-151 -152l-161 160l-151 152l-30 30q-68 67 -90 159.5t5 179.5q-70 15 -115 71t-45 129q0 85 60 145.5t145 60.5q76 0 133.5 -49t69.5 -123q84 20 169.5 -3.5
+t149.5 -87.5zM1536 78q0 -85 -60 -145.5t-145 -60.5q-74 0 -131 47t-71 118q-86 -28 -179.5 -6t-161.5 90l-11 12l151 152l12 -12q37 -37 89 -37t89 37t37 89t-37 89l-30 30l-152 152l-160 160l152 152l160 -160l152 -152l29 -30q64 -64 87.5 -150.5t2.5 -171.5
+q76 -11 126.5 -68.5t50.5 -134.5zM1534 1202q0 -77 -51 -135t-127 -69q26 -85 3 -176.5t-90 -158.5l-12 -12l-151 152l12 12q37 37 37 89t-37 89t-89 37t-89 -37l-30 -30l-152 -152l-160 -160l-152 152l161 160l152 152l29 30q67 67 159 89.5t178 -3.5q11 75 68.5 126
+t135.5 51q85 0 145 -60.5t60 -145.5z" />
+    <glyph glyph-name="f1ab" unicode="&#xf1ab;" 
+d="M654 458q-1 -3 -12.5 0.5t-31.5 11.5l-20 9q-44 20 -87 49q-7 5 -41 31.5t-38 28.5q-67 -103 -134 -181q-81 -95 -105 -110q-4 -2 -19.5 -4t-18.5 0q6 4 82 92q21 24 85.5 115t78.5 118q17 30 51 98.5t36 77.5q-8 1 -110 -33q-8 -2 -27.5 -7.5t-34.5 -9.5t-17 -5
+q-2 -2 -2 -10.5t-1 -9.5q-5 -10 -31 -15q-23 -7 -47 0q-18 4 -28 21q-4 6 -5 23q6 2 24.5 5t29.5 6q58 16 105 32q100 35 102 35q10 2 43 19.5t44 21.5q9 3 21.5 8t14.5 5.5t6 -0.5q2 -12 -1 -33q0 -2 -12.5 -27t-26.5 -53.5t-17 -33.5q-25 -50 -77 -131l64 -28
+q12 -6 74.5 -32t67.5 -28q4 -1 10.5 -25.5t4.5 -30.5zM449 944q3 -15 -4 -28q-12 -23 -50 -38q-30 -12 -60 -12q-26 3 -49 26q-14 15 -18 41l1 3q3 -3 19.5 -5t26.5 0t58 16q36 12 55 14q17 0 21 -17zM1147 815l63 -227l-139 42zM39 15l694 232v1032l-694 -233v-1031z
+M1280 332l102 -31l-181 657l-100 31l-216 -536l102 -31l45 110l211 -65zM777 1294l573 -184v380zM1088 -29l158 -13l-54 -160l-40 66q-130 -83 -276 -108q-58 -12 -91 -12h-84q-79 0 -199.5 39t-183.5 85q-8 7 -8 16q0 8 5 13.5t13 5.5q4 0 18 -7.5t30.5 -16.5t20.5 -11
+q73 -37 159.5 -61.5t157.5 -24.5q95 0 167 14.5t157 50.5q15 7 30.5 15.5t34 19t28.5 16.5zM1536 1050v-1079l-774 246q-14 -6 -375 -127.5t-368 -121.5q-13 0 -18 13q0 1 -1 3v1078q3 9 4 10q5 6 20 11q107 36 149 50v384l558 -198q2 0 160.5 55t316 108.5t161.5 53.5
+q20 0 20 -21v-418z" />
+    <glyph glyph-name="_402" unicode="&#xf1ac;" horiz-adv-x="1792" 
+d="M288 1152q66 0 113 -47t47 -113v-1088q0 -66 -47 -113t-113 -47h-128q-66 0 -113 47t-47 113v1088q0 66 47 113t113 47h128zM1664 989q58 -34 93 -93t35 -128v-768q0 -106 -75 -181t-181 -75h-864q-66 0 -113 47t-47 113v1536q0 40 28 68t68 28h672q40 0 88 -20t76 -48
+l152 -152q28 -28 48 -76t20 -88v-163zM928 0v128q0 14 -9 23t-23 9h-128q-14 0 -23 -9t-9 -23v-128q0 -14 9 -23t23 -9h128q14 0 23 9t9 23zM928 256v128q0 14 -9 23t-23 9h-128q-14 0 -23 -9t-9 -23v-128q0 -14 9 -23t23 -9h128q14 0 23 9t9 23zM928 512v128q0 14 -9 23
+t-23 9h-128q-14 0 -23 -9t-9 -23v-128q0 -14 9 -23t23 -9h128q14 0 23 9t9 23zM1184 0v128q0 14 -9 23t-23 9h-128q-14 0 -23 -9t-9 -23v-128q0 -14 9 -23t23 -9h128q14 0 23 9t9 23zM1184 256v128q0 14 -9 23t-23 9h-128q-14 0 -23 -9t-9 -23v-128q0 -14 9 -23t23 -9h128
+q14 0 23 9t9 23zM1184 512v128q0 14 -9 23t-23 9h-128q-14 0 -23 -9t-9 -23v-128q0 -14 9 -23t23 -9h128q14 0 23 9t9 23zM1440 0v128q0 14 -9 23t-23 9h-128q-14 0 -23 -9t-9 -23v-128q0 -14 9 -23t23 -9h128q14 0 23 9t9 23zM1440 256v128q0 14 -9 23t-23 9h-128
+q-14 0 -23 -9t-9 -23v-128q0 -14 9 -23t23 -9h128q14 0 23 9t9 23zM1440 512v128q0 14 -9 23t-23 9h-128q-14 0 -23 -9t-9 -23v-128q0 -14 9 -23t23 -9h128q14 0 23 9t9 23zM1536 896v256h-160q-40 0 -68 28t-28 68v160h-640v-512h896z" />
+    <glyph glyph-name="_403" unicode="&#xf1ad;" 
+d="M1344 1536q26 0 45 -19t19 -45v-1664q0 -26 -19 -45t-45 -19h-1280q-26 0 -45 19t-19 45v1664q0 26 19 45t45 19h1280zM512 1248v-64q0 -14 9 -23t23 -9h64q14 0 23 9t9 23v64q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23zM512 992v-64q0 -14 9 -23t23 -9h64q14 0 23 9
+t9 23v64q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23zM512 736v-64q0 -14 9 -23t23 -9h64q14 0 23 9t9 23v64q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23zM512 480v-64q0 -14 9 -23t23 -9h64q14 0 23 9t9 23v64q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23zM384 160v64
+q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h64q14 0 23 9t9 23zM384 416v64q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h64q14 0 23 9t9 23zM384 672v64q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h64
+q14 0 23 9t9 23zM384 928v64q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h64q14 0 23 9t9 23zM384 1184v64q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h64q14 0 23 9t9 23zM896 -96v192q0 14 -9 23t-23 9h-320q-14 0 -23 -9
+t-9 -23v-192q0 -14 9 -23t23 -9h320q14 0 23 9t9 23zM896 416v64q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h64q14 0 23 9t9 23zM896 672v64q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h64q14 0 23 9t9 23zM896 928v64
+q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h64q14 0 23 9t9 23zM896 1184v64q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h64q14 0 23 9t9 23zM1152 160v64q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h64
+q14 0 23 9t9 23zM1152 416v64q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h64q14 0 23 9t9 23zM1152 672v64q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h64q14 0 23 9t9 23zM1152 928v64q0 14 -9 23t-23 9h-64q-14 0 -23 -9
+t-9 -23v-64q0 -14 9 -23t23 -9h64q14 0 23 9t9 23zM1152 1184v64q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h64q14 0 23 9t9 23z" />
+    <glyph glyph-name="_404" unicode="&#xf1ae;" horiz-adv-x="1280" 
+d="M1188 988l-292 -292v-824q0 -46 -33 -79t-79 -33t-79 33t-33 79v384h-64v-384q0 -46 -33 -79t-79 -33t-79 33t-33 79v824l-292 292q-28 28 -28 68t28 68q29 28 68.5 28t67.5 -28l228 -228h368l228 228q28 28 68 28t68 -28q28 -29 28 -68.5t-28 -67.5zM864 1152
+q0 -93 -65.5 -158.5t-158.5 -65.5t-158.5 65.5t-65.5 158.5t65.5 158.5t158.5 65.5t158.5 -65.5t65.5 -158.5z" />
+    <glyph glyph-name="uniF1B1" unicode="&#xf1b0;" horiz-adv-x="1664" 
+d="M780 1064q0 -60 -19 -113.5t-63 -92.5t-105 -39q-76 0 -138 57.5t-92 135.5t-30 151q0 60 19 113.5t63 92.5t105 39q77 0 138.5 -57.5t91.5 -135t30 -151.5zM438 581q0 -80 -42 -139t-119 -59q-76 0 -141.5 55.5t-100.5 133.5t-35 152q0 80 42 139.5t119 59.5
+q76 0 141.5 -55.5t100.5 -134t35 -152.5zM832 608q118 0 255 -97.5t229 -237t92 -254.5q0 -46 -17 -76.5t-48.5 -45t-64.5 -20t-76 -5.5q-68 0 -187.5 45t-182.5 45q-66 0 -192.5 -44.5t-200.5 -44.5q-183 0 -183 146q0 86 56 191.5t139.5 192.5t187.5 146t193 59zM1071 819
+q-61 0 -105 39t-63 92.5t-19 113.5q0 74 30 151.5t91.5 135t138.5 57.5q61 0 105 -39t63 -92.5t19 -113.5q0 -73 -30 -151t-92 -135.5t-138 -57.5zM1503 923q77 0 119 -59.5t42 -139.5q0 -74 -35 -152t-100.5 -133.5t-141.5 -55.5q-77 0 -119 59t-42 139q0 74 35 152.5
+t100.5 134t141.5 55.5z" />
+    <glyph glyph-name="_406" unicode="&#xf1b1;" horiz-adv-x="768" 
+d="M704 1008q0 -145 -57 -243.5t-152 -135.5l45 -821q2 -26 -16 -45t-44 -19h-192q-26 0 -44 19t-16 45l45 821q-95 37 -152 135.5t-57 243.5q0 128 42.5 249.5t117.5 200t160 78.5t160 -78.5t117.5 -200t42.5 -249.5z" />
+    <glyph glyph-name="_407" unicode="&#xf1b2;" horiz-adv-x="1792" 
+d="M896 -93l640 349v636l-640 -233v-752zM832 772l698 254l-698 254l-698 -254zM1664 1024v-768q0 -35 -18 -65t-49 -47l-704 -384q-28 -16 -61 -16t-61 16l-704 384q-31 17 -49 47t-18 65v768q0 40 23 73t61 47l704 256q22 8 44 8t44 -8l704 -256q38 -14 61 -47t23 -73z
+" />
+    <glyph glyph-name="_408" unicode="&#xf1b3;" horiz-adv-x="2304" 
+d="M640 -96l384 192v314l-384 -164v-342zM576 358l404 173l-404 173l-404 -173zM1664 -96l384 192v314l-384 -164v-342zM1600 358l404 173l-404 173l-404 -173zM1152 651l384 165v266l-384 -164v-267zM1088 1030l441 189l-441 189l-441 -189zM2176 512v-416q0 -36 -19 -67
+t-52 -47l-448 -224q-25 -14 -57 -14t-57 14l-448 224q-4 2 -7 4q-2 -2 -7 -4l-448 -224q-25 -14 -57 -14t-57 14l-448 224q-33 16 -52 47t-19 67v416q0 38 21.5 70t56.5 48l434 186v400q0 38 21.5 70t56.5 48l448 192q23 10 50 10t50 -10l448 -192q35 -16 56.5 -48t21.5 -70
+v-400l434 -186q36 -16 57 -48t21 -70z" />
+    <glyph glyph-name="_409" unicode="&#xf1b4;" horiz-adv-x="2048" 
+d="M1848 1197h-511v-124h511v124zM1596 771q-90 0 -146 -52.5t-62 -142.5h408q-18 195 -200 195zM1612 186q63 0 122 32t76 87h221q-100 -307 -427 -307q-214 0 -340.5 132t-126.5 347q0 208 130.5 345.5t336.5 137.5q138 0 240.5 -68t153 -179t50.5 -248q0 -17 -2 -47h-658
+q0 -111 57.5 -171.5t166.5 -60.5zM277 236h296q205 0 205 167q0 180 -199 180h-302v-347zM277 773h281q78 0 123.5 36.5t45.5 113.5q0 144 -190 144h-260v-294zM0 1282h594q87 0 155 -14t126.5 -47.5t90 -96.5t31.5 -154q0 -181 -172 -263q114 -32 172 -115t58 -204
+q0 -75 -24.5 -136.5t-66 -103.5t-98.5 -71t-121 -42t-134 -13h-611v1260z" />
+    <glyph glyph-name="_410" unicode="&#xf1b5;" 
+d="M1248 1408q119 0 203.5 -84.5t84.5 -203.5v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960zM499 1041h-371v-787h382q117 0 197 57.5t80 170.5q0 158 -143 200q107 52 107 164q0 57 -19.5 96.5
+t-56.5 60.5t-79 29.5t-97 8.5zM477 723h-176v184h163q119 0 119 -90q0 -94 -106 -94zM486 388h-185v217h189q124 0 124 -113q0 -104 -128 -104zM1136 356q-68 0 -104 38t-36 107h411q1 10 1 30q0 132 -74.5 220.5t-203.5 88.5q-128 0 -210 -86t-82 -216q0 -135 79 -217
+t213 -82q205 0 267 191h-138q-11 -34 -47.5 -54t-75.5 -20zM1126 722q113 0 124 -122h-254q4 56 39 89t91 33zM964 988h319v-77h-319v77z" />
+    <glyph glyph-name="_411" unicode="&#xf1b6;" horiz-adv-x="1792" 
+d="M1582 954q0 -101 -71.5 -172.5t-172.5 -71.5t-172.5 71.5t-71.5 172.5t71.5 172.5t172.5 71.5t172.5 -71.5t71.5 -172.5zM812 212q0 104 -73 177t-177 73q-27 0 -54 -6l104 -42q77 -31 109.5 -106.5t1.5 -151.5q-31 -77 -107 -109t-152 -1q-21 8 -62 24.5t-61 24.5
+q32 -60 91 -96.5t130 -36.5q104 0 177 73t73 177zM1642 953q0 126 -89.5 215.5t-215.5 89.5q-127 0 -216.5 -89.5t-89.5 -215.5q0 -127 89.5 -216t216.5 -89q126 0 215.5 89t89.5 216zM1792 953q0 -189 -133.5 -322t-321.5 -133l-437 -319q-12 -129 -109 -218t-229 -89
+q-121 0 -214 76t-118 192l-230 92v429l389 -157q79 48 173 48q13 0 35 -2l284 407q2 187 135.5 319t320.5 132q188 0 321.5 -133.5t133.5 -321.5z" />
+    <glyph glyph-name="_412" unicode="&#xf1b7;" 
+d="M1242 889q0 80 -57 136.5t-137 56.5t-136.5 -57t-56.5 -136q0 -80 56.5 -136.5t136.5 -56.5t137 56.5t57 136.5zM632 301q0 -83 -58 -140.5t-140 -57.5q-56 0 -103 29t-72 77q52 -20 98 -40q60 -24 120 1.5t85 86.5q24 60 -1.5 120t-86.5 84l-82 33q22 5 42 5
+q82 0 140 -57.5t58 -140.5zM1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v153l172 -69q20 -92 93.5 -152t168.5 -60q104 0 181 70t87 173l345 252q150 0 255.5 105.5t105.5 254.5q0 150 -105.5 255.5t-255.5 105.5
+q-148 0 -253 -104.5t-107 -252.5l-225 -322q-9 1 -28 1q-75 0 -137 -37l-297 119v468q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5zM1289 887q0 -100 -71 -170.5t-171 -70.5t-170.5 70.5t-70.5 170.5t70.5 171t170.5 71q101 0 171.5 -70.5t70.5 -171.5z
+" />
+    <glyph glyph-name="_413" unicode="&#xf1b8;" horiz-adv-x="1792" 
+d="M836 367l-15 -368l-2 -22l-420 29q-36 3 -67 31.5t-47 65.5q-11 27 -14.5 55t4 65t12 55t21.5 64t19 53q78 -12 509 -28zM449 953l180 -379l-147 92q-63 -72 -111.5 -144.5t-72.5 -125t-39.5 -94.5t-18.5 -63l-4 -21l-190 357q-17 26 -18 56t6 47l8 18q35 63 114 188
+l-140 86zM1680 436l-188 -359q-12 -29 -36.5 -46.5t-43.5 -20.5l-18 -4q-71 -7 -219 -12l8 -164l-230 367l211 362l7 -173q170 -16 283 -5t170 33zM895 1360q-47 -63 -265 -435l-317 187l-19 12l225 356q20 31 60 45t80 10q24 -2 48.5 -12t42 -21t41.5 -33t36 -34.5
+t36 -39.5t32 -35zM1550 1053l212 -363q18 -37 12.5 -76t-27.5 -74q-13 -20 -33 -37t-38 -28t-48.5 -22t-47 -16t-51.5 -14t-46 -12q-34 72 -265 436l313 195zM1407 1279l142 83l-220 -373l-419 20l151 86q-34 89 -75 166t-75.5 123.5t-64.5 80t-47 46.5l-17 13l405 -1
+q31 3 58 -10.5t39 -28.5l11 -15q39 -61 112 -190z" />
+    <glyph glyph-name="_414" unicode="&#xf1b9;" horiz-adv-x="2048" 
+d="M480 448q0 66 -47 113t-113 47t-113 -47t-47 -113t47 -113t113 -47t113 47t47 113zM516 768h1016l-89 357q-2 8 -14 17.5t-21 9.5h-768q-9 0 -21 -9.5t-14 -17.5zM1888 448q0 66 -47 113t-113 47t-113 -47t-47 -113t47 -113t113 -47t113 47t47 113zM2048 544v-384
+q0 -14 -9 -23t-23 -9h-96v-128q0 -80 -56 -136t-136 -56t-136 56t-56 136v128h-1024v-128q0 -80 -56 -136t-136 -56t-136 56t-56 136v128h-96q-14 0 -23 9t-9 23v384q0 93 65.5 158.5t158.5 65.5h28l105 419q23 94 104 157.5t179 63.5h768q98 0 179 -63.5t104 -157.5
+l105 -419h28q93 0 158.5 -65.5t65.5 -158.5z" />
+    <glyph glyph-name="_415" unicode="&#xf1ba;" horiz-adv-x="2048" 
+d="M1824 640q93 0 158.5 -65.5t65.5 -158.5v-384q0 -14 -9 -23t-23 -9h-96v-64q0 -80 -56 -136t-136 -56t-136 56t-56 136v64h-1024v-64q0 -80 -56 -136t-136 -56t-136 56t-56 136v64h-96q-14 0 -23 9t-9 23v384q0 93 65.5 158.5t158.5 65.5h28l105 419q23 94 104 157.5
+t179 63.5h128v224q0 14 9 23t23 9h448q14 0 23 -9t9 -23v-224h128q98 0 179 -63.5t104 -157.5l105 -419h28zM320 160q66 0 113 47t47 113t-47 113t-113 47t-113 -47t-47 -113t47 -113t113 -47zM516 640h1016l-89 357q-2 8 -14 17.5t-21 9.5h-768q-9 0 -21 -9.5t-14 -17.5z
+M1728 160q66 0 113 47t47 113t-47 113t-113 47t-113 -47t-47 -113t47 -113t113 -47z" />
+    <glyph glyph-name="_416" unicode="&#xf1bb;" 
+d="M1504 64q0 -26 -19 -45t-45 -19h-462q1 -17 6 -87.5t5 -108.5q0 -25 -18 -42.5t-43 -17.5h-320q-25 0 -43 17.5t-18 42.5q0 38 5 108.5t6 87.5h-462q-26 0 -45 19t-19 45t19 45l402 403h-229q-26 0 -45 19t-19 45t19 45l402 403h-197q-26 0 -45 19t-19 45t19 45l384 384
+q19 19 45 19t45 -19l384 -384q19 -19 19 -45t-19 -45t-45 -19h-197l402 -403q19 -19 19 -45t-19 -45t-45 -19h-229l402 -403q19 -19 19 -45z" />
+    <glyph glyph-name="_417" unicode="&#xf1bc;" 
+d="M1127 326q0 32 -30 51q-193 115 -447 115q-133 0 -287 -34q-42 -9 -42 -52q0 -20 13.5 -34.5t35.5 -14.5q5 0 37 8q132 27 243 27q226 0 397 -103q19 -11 33 -11q19 0 33 13.5t14 34.5zM1223 541q0 40 -35 61q-237 141 -548 141q-153 0 -303 -42q-48 -13 -48 -64
+q0 -25 17.5 -42.5t42.5 -17.5q7 0 37 8q122 33 251 33q279 0 488 -124q24 -13 38 -13q25 0 42.5 17.5t17.5 42.5zM1331 789q0 47 -40 70q-126 73 -293 110.5t-343 37.5q-204 0 -364 -47q-23 -7 -38.5 -25.5t-15.5 -48.5q0 -31 20.5 -52t51.5 -21q11 0 40 8q133 37 307 37
+q159 0 309.5 -34t253.5 -95q21 -12 40 -12q29 0 50.5 20.5t21.5 51.5zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="_418" unicode="&#xf1bd;" horiz-adv-x="1024" 
+d="M1024 1233l-303 -582l24 -31h279v-415h-507l-44 -30l-142 -273l-30 -30h-301v303l303 583l-24 30h-279v415h507l44 30l142 273l30 30h301v-303z" />
+    <glyph glyph-name="_419" unicode="&#xf1be;" horiz-adv-x="2304" 
+d="M784 164l16 241l-16 523q-1 10 -7.5 17t-16.5 7q-9 0 -16 -7t-7 -17l-14 -523l14 -241q1 -10 7.5 -16.5t15.5 -6.5q22 0 24 23zM1080 193l11 211l-12 586q0 16 -13 24q-8 5 -16 5t-16 -5q-13 -8 -13 -24l-1 -6l-10 -579q0 -1 11 -236v-1q0 -10 6 -17q9 -11 23 -11
+q11 0 20 9q9 7 9 20zM35 533l20 -128l-20 -126q-2 -9 -9 -9t-9 9l-17 126l17 128q2 9 9 9t9 -9zM121 612l26 -207l-26 -203q-2 -9 -10 -9q-9 0 -9 10l-23 202l23 207q0 9 9 9q8 0 10 -9zM401 159zM213 650l25 -245l-25 -237q0 -11 -11 -11q-10 0 -12 11l-21 237l21 245
+q2 12 12 12q11 0 11 -12zM307 657l23 -252l-23 -244q-2 -13 -14 -13q-13 0 -13 13l-21 244l21 252q0 13 13 13q12 0 14 -13zM401 639l21 -234l-21 -246q-2 -16 -16 -16q-6 0 -10.5 4.5t-4.5 11.5l-20 246l20 234q0 6 4.5 10.5t10.5 4.5q14 0 16 -15zM784 164zM495 785
+l21 -380l-21 -246q0 -7 -5 -12.5t-12 -5.5q-16 0 -18 18l-18 246l18 380q2 18 18 18q7 0 12 -5.5t5 -12.5zM589 871l19 -468l-19 -244q0 -8 -5.5 -13.5t-13.5 -5.5q-18 0 -20 19l-16 244l16 468q2 19 20 19q8 0 13.5 -5.5t5.5 -13.5zM687 911l18 -506l-18 -242
+q-2 -21 -22 -21q-19 0 -21 21l-16 242l16 506q0 9 6.5 15.5t14.5 6.5q9 0 15 -6.5t7 -15.5zM1079 169v0v0v0zM881 915l15 -510l-15 -239q0 -10 -7.5 -17.5t-17.5 -7.5t-17 7t-8 18l-14 239l14 510q0 11 7.5 18t17.5 7t17.5 -7t7.5 -18zM980 896l14 -492l-14 -236
+q0 -11 -8 -19t-19 -8t-19 8t-9 19l-12 236l12 492q1 12 9 20t19 8t18.5 -8t8.5 -20zM1192 404l-14 -231v0q0 -13 -9 -22t-22 -9t-22 9t-10 22l-6 114l-6 117l12 636v3q2 15 12 24q9 7 20 7q8 0 15 -5q14 -8 16 -26zM2304 423q0 -117 -83 -199.5t-200 -82.5h-786
+q-13 2 -22 11t-9 22v899q0 23 28 33q85 34 181 34q195 0 338 -131.5t160 -323.5q53 22 110 22q117 0 200 -83t83 -201z" />
+    <glyph glyph-name="uniF1C0" unicode="&#xf1c0;" 
+d="M768 768q237 0 443 43t325 127v-170q0 -69 -103 -128t-280 -93.5t-385 -34.5t-385 34.5t-280 93.5t-103 128v170q119 -84 325 -127t443 -43zM768 0q237 0 443 43t325 127v-170q0 -69 -103 -128t-280 -93.5t-385 -34.5t-385 34.5t-280 93.5t-103 128v170q119 -84 325 -127
+t443 -43zM768 384q237 0 443 43t325 127v-170q0 -69 -103 -128t-280 -93.5t-385 -34.5t-385 34.5t-280 93.5t-103 128v170q119 -84 325 -127t443 -43zM768 1536q208 0 385 -34.5t280 -93.5t103 -128v-128q0 -69 -103 -128t-280 -93.5t-385 -34.5t-385 34.5t-280 93.5
+t-103 128v128q0 69 103 128t280 93.5t385 34.5z" />
+    <glyph glyph-name="uniF1C1" unicode="&#xf1c1;" 
+d="M1468 1156q28 -28 48 -76t20 -88v-1152q0 -40 -28 -68t-68 -28h-1344q-40 0 -68 28t-28 68v1600q0 40 28 68t68 28h896q40 0 88 -20t76 -48zM1024 1400v-376h376q-10 29 -22 41l-313 313q-12 12 -41 22zM1408 -128v1024h-416q-40 0 -68 28t-28 68v416h-768v-1536h1280z
+M894 465q33 -26 84 -56q59 7 117 7q147 0 177 -49q16 -22 2 -52q0 -1 -1 -2l-2 -2v-1q-6 -38 -71 -38q-48 0 -115 20t-130 53q-221 -24 -392 -83q-153 -262 -242 -262q-15 0 -28 7l-24 12q-1 1 -6 5q-10 10 -6 36q9 40 56 91.5t132 96.5q14 9 23 -6q2 -2 2 -4q52 85 107 197
+q68 136 104 262q-24 82 -30.5 159.5t6.5 127.5q11 40 42 40h21h1q23 0 35 -15q18 -21 9 -68q-2 -6 -4 -8q1 -3 1 -8v-30q-2 -123 -14 -192q55 -164 146 -238zM318 54q52 24 137 158q-51 -40 -87.5 -84t-49.5 -74zM716 974q-15 -42 -2 -132q1 7 7 44q0 3 7 43q1 4 4 8
+q-1 1 -1 2q-1 2 -1 3q-1 22 -13 36q0 -1 -1 -2v-2zM592 313q135 54 284 81q-2 1 -13 9.5t-16 13.5q-76 67 -127 176q-27 -86 -83 -197q-30 -56 -45 -83zM1238 329q-24 24 -140 24q76 -28 124 -28q14 0 18 1q0 1 -2 3z" />
+    <glyph glyph-name="_422" unicode="&#xf1c2;" 
+d="M1468 1156q28 -28 48 -76t20 -88v-1152q0 -40 -28 -68t-68 -28h-1344q-40 0 -68 28t-28 68v1600q0 40 28 68t68 28h896q40 0 88 -20t76 -48zM1024 1400v-376h376q-10 29 -22 41l-313 313q-12 12 -41 22zM1408 -128v1024h-416q-40 0 -68 28t-28 68v416h-768v-1536h1280z
+M233 768v-107h70l164 -661h159l128 485q7 20 10 46q2 16 2 24h4l3 -24q1 -3 3.5 -20t5.5 -26l128 -485h159l164 661h70v107h-300v-107h90l-99 -438q-5 -20 -7 -46l-2 -21h-4q0 3 -0.5 6.5t-1.5 8t-1 6.5q-1 5 -4 21t-5 25l-144 545h-114l-144 -545q-2 -9 -4.5 -24.5
+t-3.5 -21.5l-4 -21h-4l-2 21q-2 26 -7 46l-99 438h90v107h-300z" />
+    <glyph glyph-name="_423" unicode="&#xf1c3;" 
+d="M1468 1156q28 -28 48 -76t20 -88v-1152q0 -40 -28 -68t-68 -28h-1344q-40 0 -68 28t-28 68v1600q0 40 28 68t68 28h896q40 0 88 -20t76 -48zM1024 1400v-376h376q-10 29 -22 41l-313 313q-12 12 -41 22zM1408 -128v1024h-416q-40 0 -68 28t-28 68v416h-768v-1536h1280z
+M429 106v-106h281v106h-75l103 161q5 7 10 16.5t7.5 13.5t3.5 4h2q1 -4 5 -10q2 -4 4.5 -7.5t6 -8t6.5 -8.5l107 -161h-76v-106h291v106h-68l-192 273l195 282h67v107h-279v-107h74l-103 -159q-4 -7 -10 -16.5t-9 -13.5l-2 -3h-2q-1 4 -5 10q-6 11 -17 23l-106 159h76v107
+h-290v-107h68l189 -272l-194 -283h-68z" />
+    <glyph glyph-name="_424" unicode="&#xf1c4;" 
+d="M1468 1156q28 -28 48 -76t20 -88v-1152q0 -40 -28 -68t-68 -28h-1344q-40 0 -68 28t-28 68v1600q0 40 28 68t68 28h896q40 0 88 -20t76 -48zM1024 1400v-376h376q-10 29 -22 41l-313 313q-12 12 -41 22zM1408 -128v1024h-416q-40 0 -68 28t-28 68v416h-768v-1536h1280z
+M416 106v-106h327v106h-93v167h137q76 0 118 15q67 23 106.5 87t39.5 146q0 81 -37 141t-100 87q-48 19 -130 19h-368v-107h92v-555h-92zM769 386h-119v268h120q52 0 83 -18q56 -33 56 -115q0 -89 -62 -120q-31 -15 -78 -15z" />
+    <glyph glyph-name="_425" unicode="&#xf1c5;" 
+d="M1468 1156q28 -28 48 -76t20 -88v-1152q0 -40 -28 -68t-68 -28h-1344q-40 0 -68 28t-28 68v1600q0 40 28 68t68 28h896q40 0 88 -20t76 -48zM1024 1400v-376h376q-10 29 -22 41l-313 313q-12 12 -41 22zM1408 -128v1024h-416q-40 0 -68 28t-28 68v416h-768v-1536h1280z
+M1280 320v-320h-1024v192l192 192l128 -128l384 384zM448 512q-80 0 -136 56t-56 136t56 136t136 56t136 -56t56 -136t-56 -136t-136 -56z" />
+    <glyph glyph-name="_426" unicode="&#xf1c6;" 
+d="M640 1152v128h-128v-128h128zM768 1024v128h-128v-128h128zM640 896v128h-128v-128h128zM768 768v128h-128v-128h128zM1468 1156q28 -28 48 -76t20 -88v-1152q0 -40 -28 -68t-68 -28h-1344q-40 0 -68 28t-28 68v1600q0 40 28 68t68 28h896q40 0 88 -20t76 -48zM1024 1400
+v-376h376q-10 29 -22 41l-313 313q-12 12 -41 22zM1408 -128v1024h-416q-40 0 -68 28t-28 68v416h-128v-128h-128v128h-512v-1536h1280zM781 593l107 -349q8 -27 8 -52q0 -83 -72.5 -137.5t-183.5 -54.5t-183.5 54.5t-72.5 137.5q0 25 8 52q21 63 120 396v128h128v-128h79
+q22 0 39 -13t23 -34zM640 128q53 0 90.5 19t37.5 45t-37.5 45t-90.5 19t-90.5 -19t-37.5 -45t37.5 -45t90.5 -19z" />
+    <glyph glyph-name="_427" unicode="&#xf1c7;" 
+d="M1468 1156q28 -28 48 -76t20 -88v-1152q0 -40 -28 -68t-68 -28h-1344q-40 0 -68 28t-28 68v1600q0 40 28 68t68 28h896q40 0 88 -20t76 -48zM1024 1400v-376h376q-10 29 -22 41l-313 313q-12 12 -41 22zM1408 -128v1024h-416q-40 0 -68 28t-28 68v416h-768v-1536h1280z
+M620 686q20 -8 20 -30v-544q0 -22 -20 -30q-8 -2 -12 -2q-12 0 -23 9l-166 167h-131q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h131l166 167q16 15 35 7zM1037 -3q31 0 50 24q129 159 129 363t-129 363q-16 21 -43 24t-47 -14q-21 -17 -23.5 -43.5t14.5 -47.5
+q100 -123 100 -282t-100 -282q-17 -21 -14.5 -47.5t23.5 -42.5q18 -15 40 -15zM826 145q27 0 47 20q87 93 87 219t-87 219q-18 19 -45 20t-46 -17t-20 -44.5t18 -46.5q52 -57 52 -131t-52 -131q-19 -20 -18 -46.5t20 -44.5q20 -17 44 -17z" />
+    <glyph glyph-name="_428" unicode="&#xf1c8;" 
+d="M1468 1156q28 -28 48 -76t20 -88v-1152q0 -40 -28 -68t-68 -28h-1344q-40 0 -68 28t-28 68v1600q0 40 28 68t68 28h896q40 0 88 -20t76 -48zM1024 1400v-376h376q-10 29 -22 41l-313 313q-12 12 -41 22zM1408 -128v1024h-416q-40 0 -68 28t-28 68v416h-768v-1536h1280z
+M768 768q52 0 90 -38t38 -90v-384q0 -52 -38 -90t-90 -38h-384q-52 0 -90 38t-38 90v384q0 52 38 90t90 38h384zM1260 766q20 -8 20 -30v-576q0 -22 -20 -30q-8 -2 -12 -2q-14 0 -23 9l-265 266v90l265 266q9 9 23 9q4 0 12 -2z" />
+    <glyph glyph-name="_429" unicode="&#xf1c9;" 
+d="M1468 1156q28 -28 48 -76t20 -88v-1152q0 -40 -28 -68t-68 -28h-1344q-40 0 -68 28t-28 68v1600q0 40 28 68t68 28h896q40 0 88 -20t76 -48zM1024 1400v-376h376q-10 29 -22 41l-313 313q-12 12 -41 22zM1408 -128v1024h-416q-40 0 -68 28t-28 68v416h-768v-1536h1280z
+M480 768q8 11 21 12.5t24 -6.5l51 -38q11 -8 12.5 -21t-6.5 -24l-182 -243l182 -243q8 -11 6.5 -24t-12.5 -21l-51 -38q-11 -8 -24 -6.5t-21 12.5l-226 301q-14 19 0 38zM1282 467q14 -19 0 -38l-226 -301q-8 -11 -21 -12.5t-24 6.5l-51 38q-11 8 -12.5 21t6.5 24l182 243
+l-182 243q-8 11 -6.5 24t12.5 21l51 38q11 8 24 6.5t21 -12.5zM662 6q-13 2 -20.5 13t-5.5 24l138 831q2 13 13 20.5t24 5.5l63 -10q13 -2 20.5 -13t5.5 -24l-138 -831q-2 -13 -13 -20.5t-24 -5.5z" />
+    <glyph glyph-name="_430" unicode="&#xf1ca;" 
+d="M1497 709v-198q-101 -23 -198 -23q-65 -136 -165.5 -271t-181.5 -215.5t-128 -106.5q-80 -45 -162 3q-28 17 -60.5 43.5t-85 83.5t-102.5 128.5t-107.5 184t-105.5 244t-91.5 314.5t-70.5 390h283q26 -218 70 -398.5t104.5 -317t121.5 -235.5t140 -195q169 169 287 406
+q-142 72 -223 220t-81 333q0 192 104 314.5t284 122.5q178 0 273 -105.5t95 -297.5q0 -159 -58 -286q-7 -1 -19.5 -3t-46 -2t-63 6t-62 25.5t-50.5 51.5q31 103 31 184q0 87 -29 132t-79 45q-53 0 -85 -49.5t-32 -140.5q0 -186 105 -293.5t267 -107.5q62 0 121 14z" />
+    <glyph glyph-name="_431" unicode="&#xf1cb;" horiz-adv-x="1792" 
+d="M216 367l603 -402v359l-334 223zM154 511l193 129l-193 129v-258zM973 -35l603 402l-269 180l-334 -223v-359zM896 458l272 182l-272 182l-272 -182zM485 733l334 223v359l-603 -402zM1445 640l193 -129v258zM1307 733l269 180l-603 402v-359zM1792 913v-546
+q0 -41 -34 -64l-819 -546q-21 -13 -43 -13t-43 13l-819 546q-34 23 -34 64v546q0 41 34 64l819 546q21 13 43 13t43 -13l819 -546q34 -23 34 -64z" />
+    <glyph glyph-name="_432" unicode="&#xf1cc;" horiz-adv-x="2048" 
+d="M1800 764q111 -46 179.5 -145.5t68.5 -221.5q0 -164 -118 -280.5t-285 -116.5q-4 0 -11.5 0.5t-10.5 0.5h-1209h-1h-2h-5q-170 10 -288 125.5t-118 280.5q0 110 55 203t147 147q-12 39 -12 82q0 115 82 196t199 81q95 0 172 -58q75 154 222.5 248t326.5 94
+q166 0 306 -80.5t221.5 -218.5t81.5 -301q0 -6 -0.5 -18t-0.5 -18zM468 498q0 -122 84 -193t208 -71q137 0 240 99q-16 20 -47.5 56.5t-43.5 50.5q-67 -65 -144 -65q-55 0 -93.5 33.5t-38.5 87.5q0 53 38.5 87t91.5 34q44 0 84.5 -21t73 -55t65 -75t69 -82t77 -75t97 -55
+t121.5 -21q121 0 204.5 71.5t83.5 190.5q0 121 -84 192t-207 71q-143 0 -241 -97l93 -108q66 64 142 64q52 0 92 -33t40 -84q0 -57 -37 -91.5t-94 -34.5q-43 0 -82.5 21t-72 55t-65.5 75t-69.5 82t-77.5 75t-96.5 55t-118.5 21q-122 0 -207 -70.5t-85 -189.5z" />
+    <glyph glyph-name="_433" unicode="&#xf1cd;" horiz-adv-x="1792" 
+d="M896 1536q182 0 348 -71t286 -191t191 -286t71 -348t-71 -348t-191 -286t-286 -191t-348 -71t-348 71t-286 191t-191 286t-71 348t71 348t191 286t286 191t348 71zM896 1408q-190 0 -361 -90l194 -194q82 28 167 28t167 -28l194 194q-171 90 -361 90zM218 279l194 194
+q-28 82 -28 167t28 167l-194 194q-90 -171 -90 -361t90 -361zM896 -128q190 0 361 90l-194 194q-82 -28 -167 -28t-167 28l-194 -194q171 -90 361 -90zM896 256q159 0 271.5 112.5t112.5 271.5t-112.5 271.5t-271.5 112.5t-271.5 -112.5t-112.5 -271.5t112.5 -271.5
+t271.5 -112.5zM1380 473l194 -194q90 171 90 361t-90 361l-194 -194q28 -82 28 -167t-28 -167z" />
+    <glyph glyph-name="_434" unicode="&#xf1ce;" horiz-adv-x="1792" 
+d="M1760 640q0 -176 -68.5 -336t-184 -275.5t-275.5 -184t-336 -68.5t-336 68.5t-275.5 184t-184 275.5t-68.5 336q0 213 97 398.5t265 305.5t374 151v-228q-221 -45 -366.5 -221t-145.5 -406q0 -130 51 -248.5t136.5 -204t204 -136.5t248.5 -51t248.5 51t204 136.5
+t136.5 204t51 248.5q0 230 -145.5 406t-366.5 221v228q206 -31 374 -151t265 -305.5t97 -398.5z" />
+    <glyph glyph-name="uniF1D0" unicode="&#xf1d0;" horiz-adv-x="1792" 
+d="M19 662q8 217 116 406t305 318h5q0 -1 -1 -3q-8 -8 -28 -33.5t-52 -76.5t-60 -110.5t-44.5 -135.5t-14 -150.5t39 -157.5t108.5 -154q50 -50 102 -69.5t90.5 -11.5t69.5 23.5t47 32.5l16 16q39 51 53 116.5t6.5 122.5t-21 107t-26.5 80l-14 29q-10 25 -30.5 49.5t-43 41
+t-43.5 29.5t-35 19l-13 6l104 115q39 -17 78 -52t59 -61l19 -27q1 48 -18.5 103.5t-40.5 87.5l-20 31l161 183l160 -181q-33 -46 -52.5 -102.5t-22.5 -90.5l-4 -33q22 37 61.5 72.5t67.5 52.5l28 17l103 -115q-44 -14 -85 -50t-60 -65l-19 -29q-31 -56 -48 -133.5t-7 -170
+t57 -156.5q33 -45 77.5 -60.5t85 -5.5t76 26.5t57.5 33.5l21 16q60 53 96.5 115t48.5 121.5t10 121.5t-18 118t-37 107.5t-45.5 93t-45 72t-34.5 47.5l-13 17q-14 13 -7 13l10 -3q40 -29 62.5 -46t62 -50t64 -58t58.5 -65t55.5 -77t45.5 -88t38 -103t23.5 -117t10.5 -136
+q3 -259 -108 -465t-312 -321t-456 -115q-185 0 -351 74t-283.5 198t-184 293t-60.5 353z" />
+    <glyph glyph-name="uniF1D1" unicode="&#xf1d1;" horiz-adv-x="1792" 
+d="M874 -102v-66q-208 6 -385 109.5t-283 275.5l58 34q29 -49 73 -99l65 57q148 -168 368 -212l-17 -86q65 -12 121 -13zM276 428l-83 -28q22 -60 49 -112l-57 -33q-98 180 -98 385t98 385l57 -33q-30 -56 -49 -112l82 -28q-35 -100 -35 -212q0 -109 36 -212zM1528 251
+l58 -34q-106 -172 -283 -275.5t-385 -109.5v66q56 1 121 13l-17 86q220 44 368 212l65 -57q44 50 73 99zM1377 805l-233 -80q14 -42 14 -85t-14 -85l232 -80q-31 -92 -98 -169l-185 162q-57 -67 -147 -85l48 -241q-52 -10 -98 -10t-98 10l48 241q-90 18 -147 85l-185 -162
+q-67 77 -98 169l232 80q-14 42 -14 85t14 85l-233 80q33 93 99 169l185 -162q59 68 147 86l-48 240q44 10 98 10t98 -10l-48 -240q88 -18 147 -86l185 162q66 -76 99 -169zM874 1448v-66q-65 -2 -121 -13l17 -86q-220 -42 -368 -211l-65 56q-38 -42 -73 -98l-57 33
+q106 172 282 275.5t385 109.5zM1705 640q0 -205 -98 -385l-57 33q27 52 49 112l-83 28q36 103 36 212q0 112 -35 212l82 28q-19 56 -49 112l57 33q98 -180 98 -385zM1585 1063l-57 -33q-35 56 -73 98l-65 -56q-148 169 -368 211l17 86q-56 11 -121 13v66q209 -6 385 -109.5
+t282 -275.5zM1748 640q0 173 -67.5 331t-181.5 272t-272 181.5t-331 67.5t-331 -67.5t-272 -181.5t-181.5 -272t-67.5 -331t67.5 -331t181.5 -272t272 -181.5t331 -67.5t331 67.5t272 181.5t181.5 272t67.5 331zM1792 640q0 -182 -71 -348t-191 -286t-286 -191t-348 -71
+t-348 71t-286 191t-191 286t-71 348t71 348t191 286t286 191t348 71t348 -71t286 -191t191 -286t71 -348z" />
+    <glyph glyph-name="uniF1D2" unicode="&#xf1d2;" 
+d="M582 228q0 -66 -93 -66q-107 0 -107 63q0 64 98 64q102 0 102 -61zM546 694q0 -85 -74 -85q-77 0 -77 84q0 90 77 90q36 0 55 -25.5t19 -63.5zM712 769v125q-78 -29 -135 -29q-50 29 -110 29q-86 0 -145 -57t-59 -143q0 -50 29.5 -102t73.5 -67v-3q-38 -17 -38 -85
+q0 -53 41 -77v-3q-113 -37 -113 -139q0 -45 20 -78.5t54 -51t72 -25.5t81 -8q224 0 224 188q0 67 -48 99t-126 46q-27 5 -51.5 20.5t-24.5 39.5q0 44 49 52q77 15 122 70t45 134q0 24 -10 52q37 9 49 13zM771 350h137q-2 27 -2 82v387q0 46 2 69h-137q3 -23 3 -71v-392
+q0 -50 -3 -75zM1280 366v121q-30 -21 -68 -21q-53 0 -53 82v225h52q9 0 26.5 -1t26.5 -1v117h-105q0 82 3 102h-140q4 -24 4 -55v-47h-60v-117q36 3 37 3q3 0 11 -0.5t12 -0.5v-2h-2v-217q0 -37 2.5 -64t11.5 -56.5t24.5 -48.5t43.5 -31t66 -12q64 0 108 24zM924 1072
+q0 36 -24 63.5t-60 27.5t-60.5 -27t-24.5 -64q0 -36 25 -62.5t60 -26.5t59.5 27t24.5 62zM1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="_438" unicode="&#xf1d3;" horiz-adv-x="1792" 
+d="M595 22q0 100 -165 100q-158 0 -158 -104q0 -101 172 -101q151 0 151 105zM536 777q0 61 -30 102t-89 41q-124 0 -124 -145q0 -135 124 -135q119 0 119 137zM805 1101v-202q-36 -12 -79 -22q16 -43 16 -84q0 -127 -73 -216.5t-197 -112.5q-40 -8 -59.5 -27t-19.5 -58
+q0 -31 22.5 -51.5t58 -32t78.5 -22t86 -25.5t78.5 -37.5t58 -64t22.5 -98.5q0 -304 -363 -304q-69 0 -130 12.5t-116 41t-87.5 82t-32.5 127.5q0 165 182 225v4q-67 41 -67 126q0 109 63 137v4q-72 24 -119.5 108.5t-47.5 165.5q0 139 95 231.5t235 92.5q96 0 178 -47
+q98 0 218 47zM1123 220h-222q4 45 4 134v609q0 94 -4 128h222q-4 -33 -4 -124v-613q0 -89 4 -134zM1724 442v-196q-71 -39 -174 -39q-62 0 -107 20t-70 50t-39.5 78t-18.5 92t-4 103v351h2v4q-7 0 -19 1t-18 1q-21 0 -59 -6v190h96v76q0 54 -6 89h227q-6 -41 -6 -165h171
+v-190q-15 0 -43.5 2t-42.5 2h-85v-365q0 -131 87 -131q61 0 109 33zM1148 1389q0 -58 -39 -101.5t-96 -43.5q-58 0 -98 43.5t-40 101.5q0 59 39.5 103t98.5 44q58 0 96.5 -44.5t38.5 -102.5z" />
+    <glyph glyph-name="_439" unicode="&#xf1d4;" 
+d="M809 532l266 499h-112l-157 -312q-24 -48 -44 -92l-42 92l-155 312h-120l263 -493v-324h101v318zM1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="uniF1D5" unicode="&#xf1d5;" horiz-adv-x="1280" 
+d="M842 964q0 -80 -57 -136.5t-136 -56.5q-60 0 -111 35q-62 -67 -115 -146q-247 -371 -202 -859q1 -22 -12.5 -38.5t-34.5 -18.5h-5q-20 0 -35 13.5t-17 33.5q-14 126 -3.5 247.5t29.5 217t54 186t69 155.5t74 125q61 90 132 165q-16 35 -16 77q0 80 56.5 136.5t136.5 56.5
+t136.5 -56.5t56.5 -136.5zM1223 953q0 -158 -78 -292t-212.5 -212t-292.5 -78q-64 0 -131 14q-21 5 -32.5 23.5t-6.5 39.5q5 20 23 31.5t39 7.5q51 -13 108 -13q97 0 186 38t153 102t102 153t38 186t-38 186t-102 153t-153 102t-186 38t-186 -38t-153 -102t-102 -153
+t-38 -186q0 -114 52 -218q10 -20 3.5 -40t-25.5 -30t-39.5 -3t-30.5 26q-64 123 -64 265q0 119 46.5 227t124.5 186t186 124t226 46q158 0 292.5 -78t212.5 -212.5t78 -292.5z" />
+    <glyph glyph-name="uniF1D6" unicode="&#xf1d6;" horiz-adv-x="1792" 
+d="M270 730q-8 19 -8 52q0 20 11 49t24 45q-1 22 7.5 53t22.5 43q0 139 92.5 288.5t217.5 209.5q139 66 324 66q133 0 266 -55q49 -21 90 -48t71 -56t55 -68t42 -74t32.5 -84.5t25.5 -89.5t22 -98l1 -5q55 -83 55 -150q0 -14 -9 -40t-9 -38q0 -1 1.5 -3.5t3.5 -5t2 -3.5
+q77 -114 120.5 -214.5t43.5 -208.5q0 -43 -19.5 -100t-55.5 -57q-9 0 -19.5 7.5t-19 17.5t-19 26t-16 26.5t-13.5 26t-9 17.5q-1 1 -3 1l-5 -4q-59 -154 -132 -223q20 -20 61.5 -38.5t69 -41.5t35.5 -65q-2 -4 -4 -16t-7 -18q-64 -97 -302 -97q-53 0 -110.5 9t-98 20
+t-104.5 30q-15 5 -23 7q-14 4 -46 4.5t-40 1.5q-41 -45 -127.5 -65t-168.5 -20q-35 0 -69 1.5t-93 9t-101 20.5t-74.5 40t-32.5 64q0 40 10 59.5t41 48.5q11 2 40.5 13t49.5 12q4 0 14 2q2 2 2 4l-2 3q-48 11 -108 105.5t-73 156.5l-5 3q-4 0 -12 -20q-18 -41 -54.5 -74.5
+t-77.5 -37.5h-1q-4 0 -6 4.5t-5 5.5q-23 54 -23 100q0 275 252 466z" />
+    <glyph glyph-name="uniF1D7" unicode="&#xf1d7;" horiz-adv-x="2048" 
+d="M580 1075q0 41 -25 66t-66 25q-43 0 -76 -25.5t-33 -65.5q0 -39 33 -64.5t76 -25.5q41 0 66 24.5t25 65.5zM1323 568q0 28 -25.5 50t-65.5 22q-27 0 -49.5 -22.5t-22.5 -49.5q0 -28 22.5 -50.5t49.5 -22.5q40 0 65.5 22t25.5 51zM1087 1075q0 41 -24.5 66t-65.5 25
+q-43 0 -76 -25.5t-33 -65.5q0 -39 33 -64.5t76 -25.5q41 0 65.5 24.5t24.5 65.5zM1722 568q0 28 -26 50t-65 22q-27 0 -49.5 -22.5t-22.5 -49.5q0 -28 22.5 -50.5t49.5 -22.5q39 0 65 22t26 51zM1456 965q-31 4 -70 4q-169 0 -311 -77t-223.5 -208.5t-81.5 -287.5
+q0 -78 23 -152q-35 -3 -68 -3q-26 0 -50 1.5t-55 6.5t-44.5 7t-54.5 10.5t-50 10.5l-253 -127l72 218q-290 203 -290 490q0 169 97.5 311t264 223.5t363.5 81.5q176 0 332.5 -66t262 -182.5t136.5 -260.5zM2048 404q0 -117 -68.5 -223.5t-185.5 -193.5l55 -181l-199 109
+q-150 -37 -218 -37q-169 0 -311 70.5t-223.5 191.5t-81.5 264t81.5 264t223.5 191.5t311 70.5q161 0 303 -70.5t227.5 -192t85.5 -263.5z" />
+    <glyph glyph-name="_443" unicode="&#xf1d8;" horiz-adv-x="1792" 
+d="M1764 1525q33 -24 27 -64l-256 -1536q-5 -29 -32 -45q-14 -8 -31 -8q-11 0 -24 5l-453 185l-242 -295q-18 -23 -49 -23q-13 0 -22 4q-19 7 -30.5 23.5t-11.5 36.5v349l864 1059l-1069 -925l-395 162q-37 14 -40 55q-2 40 32 59l1664 960q15 9 32 9q20 0 36 -11z" />
+    <glyph glyph-name="_444" unicode="&#xf1d9;" horiz-adv-x="1792" 
+d="M1764 1525q33 -24 27 -64l-256 -1536q-5 -29 -32 -45q-14 -8 -31 -8q-11 0 -24 5l-527 215l-298 -327q-18 -21 -47 -21q-14 0 -23 4q-19 7 -30 23.5t-11 36.5v452l-472 193q-37 14 -40 55q-3 39 32 59l1664 960q35 21 68 -2zM1422 26l221 1323l-1434 -827l336 -137
+l863 639l-478 -797z" />
+    <glyph glyph-name="_445" unicode="&#xf1da;" 
+d="M1536 640q0 -156 -61 -298t-164 -245t-245 -164t-298 -61q-172 0 -327 72.5t-264 204.5q-7 10 -6.5 22.5t8.5 20.5l137 138q10 9 25 9q16 -2 23 -12q73 -95 179 -147t225 -52q104 0 198.5 40.5t163.5 109.5t109.5 163.5t40.5 198.5t-40.5 198.5t-109.5 163.5
+t-163.5 109.5t-198.5 40.5q-98 0 -188 -35.5t-160 -101.5l137 -138q31 -30 14 -69q-17 -40 -59 -40h-448q-26 0 -45 19t-19 45v448q0 42 40 59q39 17 69 -14l130 -129q107 101 244.5 156.5t284.5 55.5q156 0 298 -61t245 -164t164 -245t61 -298zM896 928v-448q0 -14 -9 -23
+t-23 -9h-320q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h224v352q0 14 9 23t23 9h64q14 0 23 -9t9 -23z" />
+    <glyph glyph-name="_446" unicode="&#xf1db;" 
+d="M768 1280q-130 0 -248.5 -51t-204 -136.5t-136.5 -204t-51 -248.5t51 -248.5t136.5 -204t204 -136.5t248.5 -51t248.5 51t204 136.5t136.5 204t51 248.5t-51 248.5t-136.5 204t-204 136.5t-248.5 51zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103
+t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="_447" unicode="&#xf1dc;" horiz-adv-x="1792" 
+d="M1682 -128q-44 0 -132.5 3.5t-133.5 3.5q-44 0 -132 -3.5t-132 -3.5q-24 0 -37 20.5t-13 45.5q0 31 17 46t39 17t51 7t45 15q33 21 33 140l-1 391q0 21 -1 31q-13 4 -50 4h-675q-38 0 -51 -4q-1 -10 -1 -31l-1 -371q0 -142 37 -164q16 -10 48 -13t57 -3.5t45 -15
+t20 -45.5q0 -26 -12.5 -48t-36.5 -22q-47 0 -139.5 3.5t-138.5 3.5q-43 0 -128 -3.5t-127 -3.5q-23 0 -35.5 21t-12.5 45q0 30 15.5 45t36 17.5t47.5 7.5t42 15q33 23 33 143l-1 57v813q0 3 0.5 26t0 36.5t-1.5 38.5t-3.5 42t-6.5 36.5t-11 31.5t-16 18q-15 10 -45 12t-53 2
+t-41 14t-18 45q0 26 12 48t36 22q46 0 138.5 -3.5t138.5 -3.5q42 0 126.5 3.5t126.5 3.5q25 0 37.5 -22t12.5 -48q0 -30 -17 -43.5t-38.5 -14.5t-49.5 -4t-43 -13q-35 -21 -35 -160l1 -320q0 -21 1 -32q13 -3 39 -3h699q25 0 38 3q1 11 1 32l1 320q0 139 -35 160
+q-18 11 -58.5 12.5t-66 13t-25.5 49.5q0 26 12.5 48t37.5 22q44 0 132 -3.5t132 -3.5q43 0 129 3.5t129 3.5q25 0 37.5 -22t12.5 -48q0 -30 -17.5 -44t-40 -14.5t-51.5 -3t-44 -12.5q-35 -23 -35 -161l1 -943q0 -119 34 -140q16 -10 46 -13.5t53.5 -4.5t41.5 -15.5t18 -44.5
+q0 -26 -12 -48t-36 -22z" />
+    <glyph glyph-name="_448" unicode="&#xf1dd;" horiz-adv-x="1280" 
+d="M1278 1347v-73q0 -29 -18.5 -61t-42.5 -32q-50 0 -54 -1q-26 -6 -32 -31q-3 -11 -3 -64v-1152q0 -25 -18 -43t-43 -18h-108q-25 0 -43 18t-18 43v1218h-143v-1218q0 -25 -17.5 -43t-43.5 -18h-108q-26 0 -43.5 18t-17.5 43v496q-147 12 -245 59q-126 58 -192 179
+q-64 117 -64 259q0 166 88 286q88 118 209 159q111 37 417 37h479q25 0 43 -18t18 -43z" />
+    <glyph glyph-name="_449" unicode="&#xf1de;" 
+d="M352 128v-128h-352v128h352zM704 256q26 0 45 -19t19 -45v-256q0 -26 -19 -45t-45 -19h-256q-26 0 -45 19t-19 45v256q0 26 19 45t45 19h256zM864 640v-128h-864v128h864zM224 1152v-128h-224v128h224zM1536 128v-128h-736v128h736zM576 1280q26 0 45 -19t19 -45v-256
+q0 -26 -19 -45t-45 -19h-256q-26 0 -45 19t-19 45v256q0 26 19 45t45 19h256zM1216 768q26 0 45 -19t19 -45v-256q0 -26 -19 -45t-45 -19h-256q-26 0 -45 19t-19 45v256q0 26 19 45t45 19h256zM1536 640v-128h-224v128h224zM1536 1152v-128h-864v128h864z" />
+    <glyph glyph-name="uniF1E0" unicode="&#xf1e0;" 
+d="M1216 512q133 0 226.5 -93.5t93.5 -226.5t-93.5 -226.5t-226.5 -93.5t-226.5 93.5t-93.5 226.5q0 12 2 34l-360 180q-92 -86 -218 -86q-133 0 -226.5 93.5t-93.5 226.5t93.5 226.5t226.5 93.5q126 0 218 -86l360 180q-2 22 -2 34q0 133 93.5 226.5t226.5 93.5
+t226.5 -93.5t93.5 -226.5t-93.5 -226.5t-226.5 -93.5q-126 0 -218 86l-360 -180q2 -22 2 -34t-2 -34l360 -180q92 86 218 86z" />
+    <glyph glyph-name="_451" unicode="&#xf1e1;" 
+d="M1280 341q0 88 -62.5 151t-150.5 63q-84 0 -145 -58l-241 120q2 16 2 23t-2 23l241 120q61 -58 145 -58q88 0 150.5 63t62.5 151t-62.5 150.5t-150.5 62.5t-151 -62.5t-63 -150.5q0 -7 2 -23l-241 -120q-62 57 -145 57q-88 0 -150.5 -62.5t-62.5 -150.5t62.5 -150.5
+t150.5 -62.5q83 0 145 57l241 -120q-2 -16 -2 -23q0 -88 63 -150.5t151 -62.5t150.5 62.5t62.5 150.5zM1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="_452" unicode="&#xf1e2;" horiz-adv-x="1792" 
+d="M571 947q-10 25 -34 35t-49 0q-108 -44 -191 -127t-127 -191q-10 -25 0 -49t35 -34q13 -5 24 -5q42 0 60 40q34 84 98.5 148.5t148.5 98.5q25 11 35 35t0 49zM1513 1303l46 -46l-244 -243l68 -68q19 -19 19 -45.5t-19 -45.5l-64 -64q89 -161 89 -343q0 -143 -55.5 -273.5
+t-150 -225t-225 -150t-273.5 -55.5t-273.5 55.5t-225 150t-150 225t-55.5 273.5t55.5 273.5t150 225t225 150t273.5 55.5q182 0 343 -89l64 64q19 19 45.5 19t45.5 -19l68 -68zM1521 1359q-10 -10 -22 -10q-13 0 -23 10l-91 90q-9 10 -9 23t9 23q10 9 23 9t23 -9l90 -91
+q10 -9 10 -22.5t-10 -22.5zM1751 1129q-11 -9 -23 -9t-23 9l-90 91q-10 9 -10 22.5t10 22.5q9 10 22.5 10t22.5 -10l91 -90q9 -10 9 -23t-9 -23zM1792 1312q0 -14 -9 -23t-23 -9h-96q-14 0 -23 9t-9 23t9 23t23 9h96q14 0 23 -9t9 -23zM1600 1504v-96q0 -14 -9 -23t-23 -9
+t-23 9t-9 23v96q0 14 9 23t23 9t23 -9t9 -23zM1751 1449l-91 -90q-10 -10 -22 -10q-13 0 -23 10q-10 9 -10 22.5t10 22.5l90 91q10 9 23 9t23 -9q9 -10 9 -23t-9 -23z" />
+    <glyph glyph-name="_453" unicode="&#xf1e3;" horiz-adv-x="1792" 
+d="M609 720l287 208l287 -208l-109 -336h-355zM896 1536q182 0 348 -71t286 -191t191 -286t71 -348t-71 -348t-191 -286t-286 -191t-348 -71t-348 71t-286 191t-191 286t-71 348t71 348t191 286t286 191t348 71zM1515 186q149 203 149 454v3l-102 -89l-240 224l63 323
+l134 -12q-150 206 -389 282l53 -124l-287 -159l-287 159l53 124q-239 -76 -389 -282l135 12l62 -323l-240 -224l-102 89v-3q0 -251 149 -454l30 132l326 -40l139 -298l-116 -69q117 -39 240 -39t240 39l-116 69l139 298l326 40z" />
+    <glyph glyph-name="_454" unicode="&#xf1e4;" horiz-adv-x="1792" 
+d="M448 224v-192q0 -14 -9 -23t-23 -9h-192q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h192q14 0 23 -9t9 -23zM256 608v-192q0 -14 -9 -23t-23 -9h-192q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h192q14 0 23 -9t9 -23zM832 224v-192q0 -14 -9 -23t-23 -9h-192q-14 0 -23 9t-9 23
+v192q0 14 9 23t23 9h192q14 0 23 -9t9 -23zM640 608v-192q0 -14 -9 -23t-23 -9h-192q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h192q14 0 23 -9t9 -23zM66 768q-28 0 -47 19t-19 46v129h514v-129q0 -27 -19 -46t-46 -19h-383zM1216 224v-192q0 -14 -9 -23t-23 -9h-192
+q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h192q14 0 23 -9t9 -23zM1024 608v-192q0 -14 -9 -23t-23 -9h-192q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h192q14 0 23 -9t9 -23zM1600 224v-192q0 -14 -9 -23t-23 -9h-192q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h192q14 0 23 -9t9 -23
+zM1408 608v-192q0 -14 -9 -23t-23 -9h-192q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h192q14 0 23 -9t9 -23zM1792 1016v-13h-514v10q0 104 -382 102q-382 -1 -382 -102v-10h-514v13q0 17 8.5 43t34 64t65.5 75.5t110.5 76t160 67.5t224 47.5t293.5 18.5t293 -18.5t224 -47.5
+t160.5 -67.5t110.5 -76t65.5 -75.5t34 -64t8.5 -43zM1792 608v-192q0 -14 -9 -23t-23 -9h-192q-14 0 -23 9t-9 23v192q0 14 9 23t23 9h192q14 0 23 -9t9 -23zM1792 962v-129q0 -27 -19 -46t-46 -19h-384q-27 0 -46 19t-19 46v129h514z" />
+    <glyph glyph-name="_455" unicode="&#xf1e5;" horiz-adv-x="1792" 
+d="M704 1216v-768q0 -26 -19 -45t-45 -19v-576q0 -26 -19 -45t-45 -19h-512q-26 0 -45 19t-19 45v512l249 873q7 23 31 23h424zM1024 1216v-704h-256v704h256zM1792 320v-512q0 -26 -19 -45t-45 -19h-512q-26 0 -45 19t-19 45v576q-26 0 -45 19t-19 45v768h424q24 0 31 -23z
+M736 1504v-224h-352v224q0 14 9 23t23 9h288q14 0 23 -9t9 -23zM1408 1504v-224h-352v224q0 14 9 23t23 9h288q14 0 23 -9t9 -23z" />
+    <glyph glyph-name="_456" unicode="&#xf1e6;" horiz-adv-x="1792" 
+d="M1755 1083q37 -38 37 -90.5t-37 -90.5l-401 -400l150 -150l-160 -160q-163 -163 -389.5 -186.5t-411.5 100.5l-362 -362h-181v181l362 362q-124 185 -100.5 411.5t186.5 389.5l160 160l150 -150l400 401q38 37 91 37t90 -37t37 -90.5t-37 -90.5l-400 -401l234 -234
+l401 400q38 37 91 37t90 -37z" />
+    <glyph glyph-name="_457" unicode="&#xf1e7;" horiz-adv-x="1792" 
+d="M873 796q0 -83 -63.5 -142.5t-152.5 -59.5t-152.5 59.5t-63.5 142.5q0 84 63.5 143t152.5 59t152.5 -59t63.5 -143zM1375 796q0 -83 -63 -142.5t-153 -59.5q-89 0 -152.5 59.5t-63.5 142.5q0 84 63.5 143t152.5 59q90 0 153 -59t63 -143zM1600 616v667q0 87 -32 123.5
+t-111 36.5h-1112q-83 0 -112.5 -34t-29.5 -126v-673q43 -23 88.5 -40t81 -28t81 -18.5t71 -11t70 -4t58.5 -0.5t56.5 2t44.5 2q68 1 95 -27q6 -6 10 -9q26 -25 61 -51q7 91 118 87q5 0 36.5 -1.5t43 -2t45.5 -1t53 1t54.5 4.5t61 8.5t62 13.5t67 19.5t67.5 27t72 34.5z
+M1763 621q-121 -149 -372 -252q84 -285 -23 -465q-66 -113 -183 -148q-104 -32 -182 15q-86 51 -82 164l-1 326v1q-8 2 -24.5 6t-23.5 5l-1 -338q4 -114 -83 -164q-79 -47 -183 -15q-117 36 -182 150q-105 180 -22 463q-251 103 -372 252q-25 37 -4 63t60 -1q4 -2 11.5 -7
+t10.5 -8v694q0 72 47 123t114 51h1257q67 0 114 -51t47 -123v-694l21 15q39 27 60 1t-4 -63z" />
+    <glyph glyph-name="_458" unicode="&#xf1e8;" horiz-adv-x="1792" 
+d="M896 1102v-434h-145v434h145zM1294 1102v-434h-145v434h145zM1294 342l253 254v795h-1194v-1049h326v-217l217 217h398zM1692 1536v-1013l-434 -434h-326l-217 -217h-217v217h-398v1158l109 289h1483z" />
+    <glyph glyph-name="_459" unicode="&#xf1e9;" 
+d="M773 217v-127q-1 -292 -6 -305q-12 -32 -51 -40q-54 -9 -181.5 38t-162.5 89q-13 15 -17 36q-1 12 4 26q4 10 34 47t181 216q1 0 60 70q15 19 39.5 24.5t49.5 -3.5q24 -10 37.5 -29t12.5 -42zM624 468q-3 -55 -52 -70l-120 -39q-275 -88 -292 -88q-35 2 -54 36
+q-12 25 -17 75q-8 76 1 166.5t30 124.5t56 32q13 0 202 -77q71 -29 115 -47l84 -34q23 -9 35.5 -30.5t11.5 -48.5zM1450 171q-7 -54 -91.5 -161t-135.5 -127q-37 -14 -63 7q-14 10 -184 287l-47 77q-14 21 -11.5 46t19.5 46q35 43 83 26q1 -1 119 -40q203 -66 242 -79.5
+t47 -20.5q28 -22 22 -61zM778 803q5 -102 -54 -122q-58 -17 -114 71l-378 598q-8 35 19 62q41 43 207.5 89.5t224.5 31.5q40 -10 49 -45q3 -18 22 -305.5t24 -379.5zM1440 695q3 -39 -26 -59q-15 -10 -329 -86q-67 -15 -91 -23l1 2q-23 -6 -46 4t-37 32q-30 47 0 87
+q1 1 75 102q125 171 150 204t34 39q28 19 65 2q48 -23 123 -133.5t81 -167.5v-3z" />
+    <glyph glyph-name="_460" unicode="&#xf1ea;" horiz-adv-x="2048" 
+d="M1024 1024h-384v-384h384v384zM1152 384v-128h-640v128h640zM1152 1152v-640h-640v640h640zM1792 384v-128h-512v128h512zM1792 640v-128h-512v128h512zM1792 896v-128h-512v128h512zM1792 1152v-128h-512v128h512zM256 192v960h-128v-960q0 -26 19 -45t45 -19t45 19
+t19 45zM1920 192v1088h-1536v-1088q0 -33 -11 -64h1483q26 0 45 19t19 45zM2048 1408v-1216q0 -80 -56 -136t-136 -56h-1664q-80 0 -136 56t-56 136v1088h256v128h1792z" />
+    <glyph glyph-name="_461" unicode="&#xf1eb;" horiz-adv-x="2048" 
+d="M1024 13q-20 0 -93 73.5t-73 93.5q0 32 62.5 54t103.5 22t103.5 -22t62.5 -54q0 -20 -73 -93.5t-93 -73.5zM1294 284q-2 0 -40 25t-101.5 50t-128.5 25t-128.5 -25t-101 -50t-40.5 -25q-18 0 -93.5 75t-75.5 93q0 13 10 23q78 77 196 121t233 44t233 -44t196 -121
+q10 -10 10 -23q0 -18 -75.5 -93t-93.5 -75zM1567 556q-11 0 -23 8q-136 105 -252 154.5t-268 49.5q-85 0 -170.5 -22t-149 -53t-113.5 -62t-79 -53t-31 -22q-17 0 -92 75t-75 93q0 12 10 22q132 132 320 205t380 73t380 -73t320 -205q10 -10 10 -22q0 -18 -75 -93t-92 -75z
+M1838 827q-11 0 -22 9q-179 157 -371.5 236.5t-420.5 79.5t-420.5 -79.5t-371.5 -236.5q-11 -9 -22 -9q-17 0 -92.5 75t-75.5 93q0 13 10 23q187 186 445 288t527 102t527 -102t445 -288q10 -10 10 -23q0 -18 -75.5 -93t-92.5 -75z" />
+    <glyph glyph-name="_462" unicode="&#xf1ec;" horiz-adv-x="1792" 
+d="M384 0q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM768 0q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM384 384q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5
+t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM1152 0q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM768 384q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5
+t37.5 90.5zM384 768q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM1152 384q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM768 768q0 53 -37.5 90.5t-90.5 37.5
+t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM1536 0v384q0 52 -38 90t-90 38t-90 -38t-38 -90v-384q0 -52 38 -90t90 -38t90 38t38 90zM1152 768q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5z
+M1536 1088v256q0 26 -19 45t-45 19h-1280q-26 0 -45 -19t-19 -45v-256q0 -26 19 -45t45 -19h1280q26 0 45 19t19 45zM1536 768q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM1664 1408v-1536q0 -52 -38 -90t-90 -38
+h-1408q-52 0 -90 38t-38 90v1536q0 52 38 90t90 38h1408q52 0 90 -38t38 -90z" />
+    <glyph glyph-name="_463" unicode="&#xf1ed;" 
+d="M1519 890q18 -84 -4 -204q-87 -444 -565 -444h-44q-25 0 -44 -16.5t-24 -42.5l-4 -19l-55 -346l-2 -15q-5 -26 -24.5 -42.5t-44.5 -16.5h-251q-21 0 -33 15t-9 36q9 56 26.5 168t26.5 168t27 167.5t27 167.5q5 37 43 37h131q133 -2 236 21q175 39 287 144q102 95 155 246
+q24 70 35 133q1 6 2.5 7.5t3.5 1t6 -3.5q79 -59 98 -162zM1347 1172q0 -107 -46 -236q-80 -233 -302 -315q-113 -40 -252 -42q0 -1 -90 -1l-90 1q-100 0 -118 -96q-2 -8 -85 -530q-1 -10 -12 -10h-295q-22 0 -36.5 16.5t-11.5 38.5l232 1471q5 29 27.5 48t51.5 19h598
+q34 0 97.5 -13t111.5 -32q107 -41 163.5 -123t56.5 -196z" />
+    <glyph glyph-name="_464" unicode="&#xf1ee;" horiz-adv-x="1792" 
+d="M441 864q33 0 52 -26q266 -364 362 -774h-446q-127 441 -367 749q-12 16 -3 33.5t29 17.5h373zM1000 507q-49 -199 -125 -393q-79 310 -256 594q40 221 44 449q211 -340 337 -650zM1099 1216q235 -324 384.5 -698.5t184.5 -773.5h-451q-41 665 -553 1472h435zM1792 640
+q0 -424 -101 -812q-67 560 -359 1083q-25 301 -106 584q-4 16 5.5 28.5t25.5 12.5h359q21 0 38.5 -13t22.5 -33q115 -409 115 -850z" />
+    <glyph glyph-name="uniF1F0" unicode="&#xf1f0;" horiz-adv-x="2304" 
+d="M1975 546h-138q14 37 66 179l3 9q4 10 10 26t9 26l12 -55zM531 611l-58 295q-11 54 -75 54h-268l-2 -13q311 -79 403 -336zM710 960l-162 -438l-17 89q-26 70 -85 129.5t-131 88.5l135 -510h175l261 641h-176zM849 318h166l104 642h-166zM1617 944q-69 27 -149 27
+q-123 0 -201 -59t-79 -153q-1 -102 145 -174q48 -23 67 -41t19 -39q0 -30 -30 -46t-69 -16q-86 0 -156 33l-22 11l-23 -144q74 -34 185 -34q130 -1 208.5 59t80.5 160q0 106 -140 174q-49 25 -71 42t-22 38q0 22 24.5 38.5t70.5 16.5q70 1 124 -24l15 -8zM2042 960h-128
+q-65 0 -87 -54l-246 -588h174l35 96h212q5 -22 20 -96h154zM2304 1280v-1280q0 -52 -38 -90t-90 -38h-2048q-52 0 -90 38t-38 90v1280q0 52 38 90t90 38h2048q52 0 90 -38t38 -90z" />
+    <glyph glyph-name="_466" unicode="&#xf1f1;" horiz-adv-x="2304" 
+d="M1119 1195q-128 85 -281 85q-103 0 -197.5 -40.5t-162.5 -108.5t-108.5 -162t-40.5 -197q0 -104 40.5 -198t108.5 -162t162 -108.5t198 -40.5q153 0 281 85q-131 107 -178 265.5t0.5 316.5t177.5 265zM1152 1171q-126 -99 -172 -249.5t-0.5 -300.5t172.5 -249
+q127 99 172.5 249t-0.5 300.5t-172 249.5zM1185 1195q130 -107 177.5 -265.5t0.5 -317t-178 -264.5q128 -85 281 -85q104 0 198 40.5t162 108.5t108.5 162t40.5 198q0 103 -40.5 197t-108.5 162t-162.5 108.5t-197.5 40.5q-153 0 -281 -85zM1926 473h7v3h-17v-3h7v-17h3v17z
+M1955 456h4v20h-5l-6 -13l-6 13h-5v-20h3v15l6 -13h4l5 13v-15zM1947 16v-2h-2h-3v3h3h2v-1zM1947 7h3l-4 5h2l1 1q1 1 1 3t-1 3l-1 1h-3h-6v-13h3v5h1zM685 75q0 19 11 31t30 12q18 0 29 -12.5t11 -30.5q0 -19 -11 -31t-29 -12q-19 0 -30 12t-11 31zM1158 119q30 0 35 -32
+h-70q5 32 35 32zM1514 75q0 19 11 31t29 12t29.5 -12.5t11.5 -30.5q0 -19 -11 -31t-30 -12q-18 0 -29 12t-11 31zM1786 75q0 18 11.5 30.5t29.5 12.5t29.5 -12.5t11.5 -30.5q0 -19 -11.5 -31t-29.5 -12t-29.5 12.5t-11.5 30.5zM1944 3q-2 0 -4 1q-1 0 -3 2t-2 3q-1 2 -1 4
+q0 3 1 4q0 2 2 4l1 1q2 0 2 1q2 1 4 1q3 0 4 -1l4 -2l2 -4v-1q1 -2 1 -3l-1 -1v-3t-1 -1l-1 -2q-2 -2 -4 -2q-1 -1 -4 -1zM599 7h30v85q0 24 -14.5 38.5t-39.5 15.5q-32 0 -47 -24q-14 24 -45 24q-24 0 -39 -20v16h-30v-135h30v75q0 36 33 36q30 0 30 -36v-75h29v75
+q0 36 33 36q30 0 30 -36v-75zM765 7h29v68v67h-29v-16q-17 20 -43 20q-29 0 -48 -20t-19 -51t19 -51t48 -20q28 0 43 20v-17zM943 48q0 34 -47 40l-14 2q-23 4 -23 14q0 15 25 15q23 0 43 -11l12 24q-22 14 -55 14q-26 0 -41 -12t-15 -32q0 -33 47 -39l13 -2q24 -4 24 -14
+q0 -17 -31 -17q-25 0 -45 14l-13 -23q25 -17 58 -17q29 0 45.5 12t16.5 32zM1073 14l-8 25q-13 -7 -26 -7q-19 0 -19 22v61h48v27h-48v41h-30v-41h-28v-27h28v-61q0 -50 47 -50q21 0 36 10zM1159 146q-29 0 -48 -20t-19 -51q0 -32 19.5 -51.5t49.5 -19.5q33 0 55 19l-14 22
+q-18 -15 -39 -15q-34 0 -41 33h101v12q0 32 -18 51.5t-46 19.5zM1318 146q-23 0 -35 -20v16h-30v-135h30v76q0 35 29 35q10 0 18 -4l9 28q-9 4 -21 4zM1348 75q0 -31 19.5 -51t52.5 -20q29 0 48 16l-14 24q-18 -13 -35 -12q-18 0 -29.5 12t-11.5 31t11.5 31t29.5 12
+q19 0 35 -12l14 24q-20 16 -48 16q-33 0 -52.5 -20t-19.5 -51zM1593 7h30v68v67h-30v-16q-15 20 -42 20q-29 0 -48.5 -20t-19.5 -51t19.5 -51t48.5 -20q28 0 42 20v-17zM1726 146q-23 0 -35 -20v16h-29v-135h29v76q0 35 29 35q10 0 18 -4l9 28q-8 4 -21 4zM1866 7h29v68v122
+h-29v-71q-15 20 -43 20t-47.5 -20.5t-19.5 -50.5t19.5 -50.5t47.5 -20.5q29 0 43 20v-17zM1944 27l-2 -1h-3q-2 -1 -4 -3q-3 -1 -3 -4q-1 -2 -1 -6q0 -3 1 -5q0 -2 3 -4q2 -2 4 -3t5 -1q4 0 6 1q0 1 2 2l2 1q1 1 3 4q1 2 1 5q0 4 -1 6q-1 1 -3 4q0 1 -2 2l-2 1q-1 0 -3 0.5
+t-3 0.5zM2304 1280v-1280q0 -52 -38 -90t-90 -38h-2048q-52 0 -90 38t-38 90v1280q0 52 38 90t90 38h2048q52 0 90 -38t38 -90z" />
+    <glyph glyph-name="_467" unicode="&#xf1f2;" horiz-adv-x="2304" 
+d="M313 759q0 -51 -36 -84q-29 -26 -89 -26h-17v220h17q61 0 89 -27q36 -31 36 -83zM2089 824q0 -52 -64 -52h-19v101h20q63 0 63 -49zM380 759q0 74 -50 120.5t-129 46.5h-95v-333h95q74 0 119 38q60 51 60 128zM410 593h65v333h-65v-333zM730 694q0 40 -20.5 62t-75.5 42
+q-29 10 -39.5 19t-10.5 23q0 16 13.5 26.5t34.5 10.5q29 0 53 -27l34 44q-41 37 -98 37q-44 0 -74 -27.5t-30 -67.5q0 -35 18 -55.5t64 -36.5q37 -13 45 -19q19 -12 19 -34q0 -20 -14 -33.5t-36 -13.5q-48 0 -71 44l-42 -40q44 -64 115 -64q51 0 83 30.5t32 79.5zM1008 604
+v77q-37 -37 -78 -37q-49 0 -80.5 32.5t-31.5 82.5q0 48 31.5 81.5t77.5 33.5q43 0 81 -38v77q-40 20 -80 20q-74 0 -125.5 -50.5t-51.5 -123.5t51 -123.5t125 -50.5q42 0 81 19zM2240 0v527q-65 -40 -144.5 -84t-237.5 -117t-329.5 -137.5t-417.5 -134.5t-504 -118h1569
+q26 0 45 19t19 45zM1389 757q0 75 -53 128t-128 53t-128 -53t-53 -128t53 -128t128 -53t128 53t53 128zM1541 584l144 342h-71l-90 -224l-89 224h-71l142 -342h35zM1714 593h184v56h-119v90h115v56h-115v74h119v57h-184v-333zM2105 593h80l-105 140q76 16 76 94q0 47 -31 73
+t-87 26h-97v-333h65v133h9zM2304 1274v-1268q0 -56 -38.5 -95t-93.5 -39h-2040q-55 0 -93.5 39t-38.5 95v1268q0 56 38.5 95t93.5 39h2040q55 0 93.5 -39t38.5 -95z" />
+    <glyph glyph-name="f1f3" unicode="&#xf1f3;" horiz-adv-x="2304" 
+d="M119 854h89l-45 108zM740 328l74 79l-70 79h-163v-49h142v-55h-142v-54h159zM898 406l99 -110v217zM1186 453q0 33 -40 33h-84v-69h83q41 0 41 36zM1475 457q0 29 -42 29h-82v-61h81q43 0 43 32zM1197 923q0 29 -42 29h-82v-60h81q43 0 43 31zM1656 854h89l-44 108z
+M699 1009v-271h-66v212l-94 -212h-57l-94 212v-212h-132l-25 60h-135l-25 -60h-70l116 271h96l110 -257v257h106l85 -184l77 184h108zM1255 453q0 -20 -5.5 -35t-14 -25t-22.5 -16.5t-26 -10t-31.5 -4.5t-31.5 -1t-32.5 0.5t-29.5 0.5v-91h-126l-80 90l-83 -90h-256v271h260
+l80 -89l82 89h207q109 0 109 -89zM964 794v-56h-217v271h217v-57h-152v-49h148v-55h-148v-54h152zM2304 235v-229q0 -55 -38.5 -94.5t-93.5 -39.5h-2040q-55 0 -93.5 39.5t-38.5 94.5v678h111l25 61h55l25 -61h218v46l19 -46h113l20 47v-47h541v99l10 1q10 0 10 -14v-86h279
+v23q23 -12 55 -18t52.5 -6.5t63 0.5t51.5 1l25 61h56l25 -61h227v58l34 -58h182v378h-180v-44l-25 44h-185v-44l-23 44h-249q-69 0 -109 -22v22h-172v-22q-24 22 -73 22h-628l-43 -97l-43 97h-198v-44l-22 44h-169l-78 -179v391q0 55 38.5 94.5t93.5 39.5h2040
+q55 0 93.5 -39.5t38.5 -94.5v-678h-120q-51 0 -81 -22v22h-177q-55 0 -78 -22v22h-316v-22q-31 22 -87 22h-209v-22q-23 22 -91 22h-234l-54 -58l-50 58h-349v-378h343l55 59l52 -59h211v89h21q59 0 90 13v-102h174v99h8q8 0 10 -2t2 -10v-87h529q57 0 88 24v-24h168
+q60 0 95 17zM1546 469q0 -23 -12 -43t-34 -29q25 -9 34 -26t9 -46v-54h-65v45q0 33 -12 43.5t-46 10.5h-69v-99h-65v271h154q48 0 77 -15t29 -58zM1269 936q0 -24 -12.5 -44t-33.5 -29q26 -9 34.5 -25.5t8.5 -46.5v-53h-65q0 9 0.5 26.5t0 25t-3 18.5t-8.5 16t-17.5 8.5
+t-29.5 3.5h-70v-98h-64v271l153 -1q49 0 78 -14.5t29 -57.5zM1798 327v-56h-216v271h216v-56h-151v-49h148v-55h-148v-54zM1372 1009v-271h-66v271h66zM2065 357q0 -86 -102 -86h-126v58h126q34 0 34 25q0 16 -17 21t-41.5 5t-49.5 3.5t-42 22.5t-17 55q0 39 26 60t66 21
+h130v-57h-119q-36 0 -36 -25q0 -16 17.5 -20.5t42 -4t49 -2.5t42 -21.5t17.5 -54.5zM2304 407v-101q-24 -35 -88 -35h-125v58h125q33 0 33 25q0 13 -12.5 19t-31 5.5t-40 2t-40 8t-31 24t-12.5 48.5q0 39 26.5 60t66.5 21h129v-57h-118q-36 0 -36 -25q0 -20 29 -22t68.5 -5
+t56.5 -26zM2139 1008v-270h-92l-122 203v-203h-132l-26 60h-134l-25 -60h-75q-129 0 -129 133q0 138 133 138h63v-59q-7 0 -28 1t-28.5 0.5t-23 -2t-21.5 -6.5t-14.5 -13.5t-11.5 -23t-3 -33.5q0 -38 13.5 -58t49.5 -20h29l92 213h97l109 -256v256h99l114 -188v188h66z" />
+    <glyph glyph-name="_469" unicode="&#xf1f4;" horiz-adv-x="2304" 
+d="M745 630q0 -37 -25.5 -61.5t-62.5 -24.5q-29 0 -46.5 16t-17.5 44q0 37 25 62.5t62 25.5q28 0 46.5 -16.5t18.5 -45.5zM1530 779q0 -42 -22 -57t-66 -15l-32 -1l17 107q2 11 13 11h18q22 0 35 -2t25 -12.5t12 -30.5zM1881 630q0 -36 -25.5 -61t-61.5 -25q-29 0 -47 16
+t-18 44q0 37 25 62.5t62 25.5q28 0 46.5 -16.5t18.5 -45.5zM513 801q0 59 -38.5 85.5t-100.5 26.5h-160q-19 0 -21 -19l-65 -408q-1 -6 3 -11t10 -5h76q20 0 22 19l18 110q1 8 7 13t15 6.5t17 1.5t19 -1t14 -1q86 0 135 48.5t49 134.5zM822 489l41 261q1 6 -3 11t-10 5h-76
+q-14 0 -17 -33q-27 40 -95 40q-72 0 -122.5 -54t-50.5 -127q0 -59 34.5 -94t92.5 -35q28 0 58 12t48 32q-4 -12 -4 -21q0 -16 13 -16h69q19 0 22 19zM1269 752q0 5 -4 9.5t-9 4.5h-77q-11 0 -18 -10l-106 -156l-44 150q-5 16 -22 16h-75q-5 0 -9 -4.5t-4 -9.5q0 -2 19.5 -59
+t42 -123t23.5 -70q-82 -112 -82 -120q0 -13 13 -13h77q11 0 18 10l255 368q2 2 2 7zM1649 801q0 59 -38.5 85.5t-100.5 26.5h-159q-20 0 -22 -19l-65 -408q-1 -6 3 -11t10 -5h82q12 0 16 13l18 116q1 8 7 13t15 6.5t17 1.5t19 -1t14 -1q86 0 135 48.5t49 134.5zM1958 489
+l41 261q1 6 -3 11t-10 5h-76q-14 0 -17 -33q-26 40 -95 40q-72 0 -122.5 -54t-50.5 -127q0 -59 34.5 -94t92.5 -35q29 0 59 12t47 32q0 -1 -2 -9t-2 -12q0 -16 13 -16h69q19 0 22 19zM2176 898v1q0 14 -13 14h-74q-11 0 -13 -11l-65 -416l-1 -2q0 -5 4 -9.5t10 -4.5h66
+q19 0 21 19zM392 764q-5 -35 -26 -46t-60 -11l-33 -1l17 107q2 11 13 11h19q40 0 58 -11.5t12 -48.5zM2304 1280v-1280q0 -52 -38 -90t-90 -38h-2048q-52 0 -90 38t-38 90v1280q0 52 38 90t90 38h2048q52 0 90 -38t38 -90z" />
+    <glyph glyph-name="_470" unicode="&#xf1f5;" horiz-adv-x="2304" 
+d="M1597 633q0 -69 -21 -106q-19 -35 -52 -35q-23 0 -41 9v224q29 30 57 30q57 0 57 -122zM2035 669h-110q6 98 56 98q51 0 54 -98zM476 534q0 59 -33 91.5t-101 57.5q-36 13 -52 24t-16 25q0 26 38 26q58 0 124 -33l18 112q-67 32 -149 32q-77 0 -123 -38q-48 -39 -48 -109
+q0 -58 32.5 -90.5t99.5 -56.5q39 -14 54.5 -25.5t15.5 -27.5q0 -31 -48 -31q-29 0 -70 12.5t-72 30.5l-18 -113q72 -41 168 -41q81 0 129 37q51 41 51 117zM771 749l19 111h-96v135l-129 -21l-18 -114l-46 -8l-17 -103h62v-219q0 -84 44 -120q38 -30 111 -30q32 0 79 11v118
+q-32 -7 -44 -7q-42 0 -42 50v197h77zM1087 724v139q-15 3 -28 3q-32 0 -55.5 -16t-33.5 -46l-10 56h-131v-471h150v306q26 31 82 31q16 0 26 -2zM1124 389h150v471h-150v-471zM1746 638q0 122 -45 179q-40 52 -111 52q-64 0 -117 -56l-8 47h-132v-645l150 25v151
+q36 -11 68 -11q83 0 134 56q61 65 61 202zM1278 986q0 33 -23 56t-56 23t-56 -23t-23 -56t23 -56.5t56 -23.5t56 23.5t23 56.5zM2176 629q0 113 -48 176q-50 64 -144 64q-96 0 -151.5 -66t-55.5 -180q0 -128 63 -188q55 -55 161 -55q101 0 160 40l-16 103q-57 -31 -128 -31
+q-43 0 -63 19q-23 19 -28 66h248q2 14 2 52zM2304 1280v-1280q0 -52 -38 -90t-90 -38h-2048q-52 0 -90 38t-38 90v1280q0 52 38 90t90 38h2048q52 0 90 -38t38 -90z" />
+    <glyph glyph-name="_471" unicode="&#xf1f6;" horiz-adv-x="2048" 
+d="M1558 684q61 -356 298 -556q0 -52 -38 -90t-90 -38h-448q0 -106 -75 -181t-181 -75t-180.5 74.5t-75.5 180.5zM1024 -176q16 0 16 16t-16 16q-59 0 -101.5 42.5t-42.5 101.5q0 16 -16 16t-16 -16q0 -73 51.5 -124.5t124.5 -51.5zM2026 1424q8 -10 7.5 -23.5t-10.5 -22.5
+l-1872 -1622q-10 -8 -23.5 -7t-21.5 11l-84 96q-8 10 -7.5 23.5t10.5 21.5l186 161q-19 32 -19 66q50 42 91 88t85 119.5t74.5 158.5t50 206t19.5 260q0 152 117 282.5t307 158.5q-8 19 -8 39q0 40 28 68t68 28t68 -28t28 -68q0 -20 -8 -39q124 -18 219 -82.5t148 -157.5
+l418 363q10 8 23.5 7t21.5 -11z" />
+    <glyph glyph-name="_472" unicode="&#xf1f7;" horiz-adv-x="2048" 
+d="M1040 -160q0 16 -16 16q-59 0 -101.5 42.5t-42.5 101.5q0 16 -16 16t-16 -16q0 -73 51.5 -124.5t124.5 -51.5q16 0 16 16zM503 315l877 760q-42 88 -132.5 146.5t-223.5 58.5q-93 0 -169.5 -31.5t-121.5 -80.5t-69 -103t-24 -105q0 -384 -137 -645zM1856 128
+q0 -52 -38 -90t-90 -38h-448q0 -106 -75 -181t-181 -75t-180.5 74.5t-75.5 180.5l149 129h757q-166 187 -227 459l111 97q61 -356 298 -556zM1942 1520l84 -96q8 -10 7.5 -23.5t-10.5 -22.5l-1872 -1622q-10 -8 -23.5 -7t-21.5 11l-84 96q-8 10 -7.5 23.5t10.5 21.5l186 161
+q-19 32 -19 66q50 42 91 88t85 119.5t74.5 158.5t50 206t19.5 260q0 152 117 282.5t307 158.5q-8 19 -8 39q0 40 28 68t68 28t68 -28t28 -68q0 -20 -8 -39q124 -18 219 -82.5t148 -157.5l418 363q10 8 23.5 7t21.5 -11z" />
+    <glyph glyph-name="_473" unicode="&#xf1f8;" horiz-adv-x="1408" 
+d="M512 160v704q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-704q0 -14 9 -23t23 -9h64q14 0 23 9t9 23zM768 160v704q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-704q0 -14 9 -23t23 -9h64q14 0 23 9t9 23zM1024 160v704q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-704
+q0 -14 9 -23t23 -9h64q14 0 23 9t9 23zM480 1152h448l-48 117q-7 9 -17 11h-317q-10 -2 -17 -11zM1408 1120v-64q0 -14 -9 -23t-23 -9h-96v-948q0 -83 -47 -143.5t-113 -60.5h-832q-66 0 -113 58.5t-47 141.5v952h-96q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h309l70 167
+q15 37 54 63t79 26h320q40 0 79 -26t54 -63l70 -167h309q14 0 23 -9t9 -23z" />
+    <glyph glyph-name="_474" unicode="&#xf1f9;" 
+d="M1150 462v-109q0 -50 -36.5 -89t-94 -60.5t-118 -32.5t-117.5 -11q-205 0 -342.5 139t-137.5 346q0 203 136 339t339 136q34 0 75.5 -4.5t93 -18t92.5 -34t69 -56.5t28 -81v-109q0 -16 -16 -16h-118q-16 0 -16 16v70q0 43 -65.5 67.5t-137.5 24.5q-140 0 -228.5 -91.5
+t-88.5 -237.5q0 -151 91.5 -249.5t233.5 -98.5q68 0 138 24t70 66v70q0 7 4.5 11.5t10.5 4.5h119q6 0 11 -4.5t5 -11.5zM768 1280q-130 0 -248.5 -51t-204 -136.5t-136.5 -204t-51 -248.5t51 -248.5t136.5 -204t204 -136.5t248.5 -51t248.5 51t204 136.5t136.5 204t51 248.5
+t-51 248.5t-136.5 204t-204 136.5t-248.5 51zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="_475" unicode="&#xf1fa;" 
+d="M972 761q0 108 -53.5 169t-147.5 61q-63 0 -124 -30.5t-110 -84.5t-79.5 -137t-30.5 -180q0 -112 53.5 -173t150.5 -61q96 0 176 66.5t122.5 166t42.5 203.5zM1536 640q0 -111 -37 -197t-98.5 -135t-131.5 -74.5t-145 -27.5q-6 0 -15.5 -0.5t-16.5 -0.5q-95 0 -142 53
+q-28 33 -33 83q-52 -66 -131.5 -110t-173.5 -44q-161 0 -249.5 95.5t-88.5 269.5q0 157 66 290t179 210.5t246 77.5q87 0 155 -35.5t106 -99.5l2 19l11 56q1 6 5.5 12t9.5 6h118q5 0 13 -11q5 -5 3 -16l-120 -614q-5 -24 -5 -48q0 -39 12.5 -52t44.5 -13q28 1 57 5.5t73 24
+t77 50t57 89.5t24 137q0 292 -174 466t-466 174q-130 0 -248.5 -51t-204 -136.5t-136.5 -204t-51 -248.5t51 -248.5t136.5 -204t204 -136.5t248.5 -51q228 0 405 144q11 9 24 8t21 -12l41 -49q8 -12 7 -24q-2 -13 -12 -22q-102 -83 -227.5 -128t-258.5 -45q-156 0 -298 61
+t-245 164t-164 245t-61 298t61 298t164 245t245 164t298 61q344 0 556 -212t212 -556z" />
+    <glyph glyph-name="_476" unicode="&#xf1fb;" horiz-adv-x="1792" 
+d="M1698 1442q94 -94 94 -226.5t-94 -225.5l-225 -223l104 -104q10 -10 10 -23t-10 -23l-210 -210q-10 -10 -23 -10t-23 10l-105 105l-603 -603q-37 -37 -90 -37h-203l-256 -128l-64 64l128 256v203q0 53 37 90l603 603l-105 105q-10 10 -10 23t10 23l210 210q10 10 23 10
+t23 -10l104 -104l223 225q93 94 225.5 94t226.5 -94zM512 64l576 576l-192 192l-576 -576v-192h192z" />
+    <glyph glyph-name="f1fc" unicode="&#xf1fc;" horiz-adv-x="1792" 
+d="M1615 1536q70 0 122.5 -46.5t52.5 -116.5q0 -63 -45 -151q-332 -629 -465 -752q-97 -91 -218 -91q-126 0 -216.5 92.5t-90.5 219.5q0 128 92 212l638 579q59 54 130 54zM706 502q39 -76 106.5 -130t150.5 -76l1 -71q4 -213 -129.5 -347t-348.5 -134q-123 0 -218 46.5
+t-152.5 127.5t-86.5 183t-29 220q7 -5 41 -30t62 -44.5t59 -36.5t46 -17q41 0 55 37q25 66 57.5 112.5t69.5 76t88 47.5t103 25.5t125 10.5z" />
+    <glyph glyph-name="_478" unicode="&#xf1fd;" horiz-adv-x="1792" 
+d="M1792 128v-384h-1792v384q45 0 85 14t59 27.5t47 37.5q30 27 51.5 38t56.5 11q24 0 44 -7t31 -15t33 -27q29 -25 47 -38t58 -27t86 -14q45 0 85 14.5t58 27t48 37.5q21 19 32.5 27t31 15t43.5 7q35 0 56.5 -11t51.5 -38q28 -24 47 -37.5t59 -27.5t85 -14t85 14t59 27.5
+t47 37.5q30 27 51.5 38t56.5 11q34 0 55.5 -11t51.5 -38q28 -24 47 -37.5t59 -27.5t85 -14zM1792 448v-192q-24 0 -44 7t-31 15t-33 27q-29 25 -47 38t-58 27t-85 14q-46 0 -86 -14t-58 -27t-47 -38q-22 -19 -33 -27t-31 -15t-44 -7q-35 0 -56.5 11t-51.5 38q-29 25 -47 38
+t-58 27t-86 14q-45 0 -85 -14.5t-58 -27t-48 -37.5q-21 -19 -32.5 -27t-31 -15t-43.5 -7q-35 0 -56.5 11t-51.5 38q-28 24 -47 37.5t-59 27.5t-85 14q-46 0 -86 -14t-58 -27t-47 -38q-30 -27 -51.5 -38t-56.5 -11v192q0 80 56 136t136 56h64v448h256v-448h256v448h256v-448
+h256v448h256v-448h64q80 0 136 -56t56 -136zM512 1312q0 -77 -36 -118.5t-92 -41.5q-53 0 -90.5 37.5t-37.5 90.5q0 29 9.5 51t23.5 34t31 28t31 31.5t23.5 44.5t9.5 67q38 0 83 -74t45 -150zM1024 1312q0 -77 -36 -118.5t-92 -41.5q-53 0 -90.5 37.5t-37.5 90.5
+q0 29 9.5 51t23.5 34t31 28t31 31.5t23.5 44.5t9.5 67q38 0 83 -74t45 -150zM1536 1312q0 -77 -36 -118.5t-92 -41.5q-53 0 -90.5 37.5t-37.5 90.5q0 29 9.5 51t23.5 34t31 28t31 31.5t23.5 44.5t9.5 67q38 0 83 -74t45 -150z" />
+    <glyph glyph-name="_479" unicode="&#xf1fe;" horiz-adv-x="2048" 
+d="M2048 0v-128h-2048v1536h128v-1408h1920zM1664 1024l256 -896h-1664v576l448 576l576 -576z" />
+    <glyph glyph-name="_480" unicode="&#xf200;" horiz-adv-x="1792" 
+d="M768 646l546 -546q-106 -108 -247.5 -168t-298.5 -60q-209 0 -385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103v-762zM955 640h773q0 -157 -60 -298.5t-168 -247.5zM1664 768h-768v768q209 0 385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="_481" unicode="&#xf201;" horiz-adv-x="2048" 
+d="M2048 0v-128h-2048v1536h128v-1408h1920zM1920 1248v-435q0 -21 -19.5 -29.5t-35.5 7.5l-121 121l-633 -633q-10 -10 -23 -10t-23 10l-233 233l-416 -416l-192 192l585 585q10 10 23 10t23 -10l233 -233l464 464l-121 121q-16 16 -7.5 35.5t29.5 19.5h435q14 0 23 -9
+t9 -23z" />
+    <glyph glyph-name="_482" unicode="&#xf202;" horiz-adv-x="1792" 
+d="M1292 832q0 -6 10 -41q10 -29 25 -49.5t41 -34t44 -20t55 -16.5q325 -91 325 -332q0 -146 -105.5 -242.5t-254.5 -96.5q-59 0 -111.5 18.5t-91.5 45.5t-77 74.5t-63 87.5t-53.5 103.5t-43.5 103t-39.5 106.5t-35.5 95q-32 81 -61.5 133.5t-73.5 96.5t-104 64t-142 20
+q-96 0 -183 -55.5t-138 -144.5t-51 -185q0 -160 106.5 -279.5t263.5 -119.5q177 0 258 95q56 63 83 116l84 -152q-15 -34 -44 -70l1 -1q-131 -152 -388 -152q-147 0 -269.5 79t-190.5 207.5t-68 274.5q0 105 43.5 206t116 176.5t172 121.5t204.5 46q87 0 159 -19t123.5 -50
+t95 -80t72.5 -99t58.5 -117t50.5 -124.5t50 -130.5t55 -127q96 -200 233 -200q81 0 138.5 48.5t57.5 128.5q0 42 -19 72t-50.5 46t-72.5 31.5t-84.5 27t-87.5 34t-81 52t-65 82t-39 122.5q-3 16 -3 33q0 110 87.5 192t198.5 78q78 -3 120.5 -14.5t90.5 -53.5h-1
+q12 -11 23 -24.5t26 -36t19 -27.5l-129 -99q-26 49 -54 70v1q-23 21 -97 21q-49 0 -84 -33t-35 -83z" />
+    <glyph glyph-name="_483" unicode="&#xf203;" 
+d="M1432 484q0 173 -234 239q-35 10 -53 16.5t-38 25t-29 46.5q0 2 -2 8.5t-3 12t-1 7.5q0 36 24.5 59.5t60.5 23.5q54 0 71 -15h-1q20 -15 39 -51l93 71q-39 54 -49 64q-33 29 -67.5 39t-85.5 10q-80 0 -142 -57.5t-62 -137.5q0 -7 2 -23q16 -96 64.5 -140t148.5 -73
+q29 -8 49 -15.5t45 -21.5t38.5 -34.5t13.5 -46.5v-5q1 -58 -40.5 -93t-100.5 -35q-97 0 -167 144q-23 47 -51.5 121.5t-48 125.5t-54 110.5t-74 95.5t-103.5 60.5t-147 24.5q-101 0 -192 -56t-144 -148t-50 -192v-1q4 -108 50.5 -199t133.5 -147.5t196 -56.5q186 0 279 110
+q20 27 31 51l-60 109q-42 -80 -99 -116t-146 -36q-115 0 -191 87t-76 204q0 105 82 189t186 84q112 0 170 -53.5t104 -172.5q8 -21 25.5 -68.5t28.5 -76.5t31.5 -74.5t38.5 -74t45.5 -62.5t55.5 -53.5t66 -33t80 -13.5q107 0 183 69.5t76 174.5zM1536 1120v-960
+q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="_484" unicode="&#xf204;" horiz-adv-x="2048" 
+d="M1152 640q0 104 -40.5 198.5t-109.5 163.5t-163.5 109.5t-198.5 40.5t-198.5 -40.5t-163.5 -109.5t-109.5 -163.5t-40.5 -198.5t40.5 -198.5t109.5 -163.5t163.5 -109.5t198.5 -40.5t198.5 40.5t163.5 109.5t109.5 163.5t40.5 198.5zM1920 640q0 104 -40.5 198.5
+t-109.5 163.5t-163.5 109.5t-198.5 40.5h-386q119 -90 188.5 -224t69.5 -288t-69.5 -288t-188.5 -224h386q104 0 198.5 40.5t163.5 109.5t109.5 163.5t40.5 198.5zM2048 640q0 -130 -51 -248.5t-136.5 -204t-204 -136.5t-248.5 -51h-768q-130 0 -248.5 51t-204 136.5
+t-136.5 204t-51 248.5t51 248.5t136.5 204t204 136.5t248.5 51h768q130 0 248.5 -51t204 -136.5t136.5 -204t51 -248.5z" />
+    <glyph glyph-name="_485" unicode="&#xf205;" horiz-adv-x="2048" 
+d="M0 640q0 130 51 248.5t136.5 204t204 136.5t248.5 51h768q130 0 248.5 -51t204 -136.5t136.5 -204t51 -248.5t-51 -248.5t-136.5 -204t-204 -136.5t-248.5 -51h-768q-130 0 -248.5 51t-204 136.5t-136.5 204t-51 248.5zM1408 128q104 0 198.5 40.5t163.5 109.5
+t109.5 163.5t40.5 198.5t-40.5 198.5t-109.5 163.5t-163.5 109.5t-198.5 40.5t-198.5 -40.5t-163.5 -109.5t-109.5 -163.5t-40.5 -198.5t40.5 -198.5t109.5 -163.5t163.5 -109.5t198.5 -40.5z" />
+    <glyph glyph-name="_486" unicode="&#xf206;" horiz-adv-x="2304" 
+d="M762 384h-314q-40 0 -57.5 35t6.5 67l188 251q-65 31 -137 31q-132 0 -226 -94t-94 -226t94 -226t226 -94q115 0 203 72.5t111 183.5zM576 512h186q-18 85 -75 148zM1056 512l288 384h-480l-99 -132q105 -103 126 -252h165zM2176 448q0 132 -94 226t-226 94
+q-60 0 -121 -24l174 -260q15 -23 10 -49t-27 -40q-15 -11 -36 -11q-35 0 -53 29l-174 260q-93 -95 -93 -225q0 -132 94 -226t226 -94t226 94t94 226zM2304 448q0 -185 -131.5 -316.5t-316.5 -131.5t-316.5 131.5t-131.5 316.5q0 97 39.5 183.5t109.5 149.5l-65 98l-353 -469
+q-18 -26 -51 -26h-197q-23 -164 -149 -274t-294 -110q-185 0 -316.5 131.5t-131.5 316.5t131.5 316.5t316.5 131.5q114 0 215 -55l137 183h-224q-26 0 -45 19t-19 45t19 45t45 19h384v-128h435l-85 128h-222q-26 0 -45 19t-19 45t19 45t45 19h256q33 0 53 -28l267 -400
+q91 44 192 44q185 0 316.5 -131.5t131.5 -316.5z" />
+    <glyph glyph-name="_487" unicode="&#xf207;" 
+d="M384 320q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM1408 320q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM1362 716l-72 384q-5 23 -22.5 37.5t-40.5 14.5
+h-918q-23 0 -40.5 -14.5t-22.5 -37.5l-72 -384q-5 -30 14 -53t49 -23h1062q30 0 49 23t14 53zM1136 1328q0 20 -14 34t-34 14h-640q-20 0 -34 -14t-14 -34t14 -34t34 -14h640q20 0 34 14t14 34zM1536 603v-603h-128v-128q0 -53 -37.5 -90.5t-90.5 -37.5t-90.5 37.5
+t-37.5 90.5v128h-768v-128q0 -53 -37.5 -90.5t-90.5 -37.5t-90.5 37.5t-37.5 90.5v128h-128v603q0 112 25 223l103 454q9 78 97.5 137t230 89t312.5 30t312.5 -30t230 -89t97.5 -137l105 -454q23 -102 23 -223z" />
+    <glyph glyph-name="_488" unicode="&#xf208;" horiz-adv-x="2048" 
+d="M1463 704q0 -35 -25 -60.5t-61 -25.5h-702q-36 0 -61 25.5t-25 60.5t25 60.5t61 25.5h702q36 0 61 -25.5t25 -60.5zM1677 704q0 86 -23 170h-982q-36 0 -61 25t-25 60q0 36 25 61t61 25h908q-88 143 -235 227t-320 84q-177 0 -327.5 -87.5t-238 -237.5t-87.5 -327
+q0 -86 23 -170h982q36 0 61 -25t25 -60q0 -36 -25 -61t-61 -25h-908q88 -143 235.5 -227t320.5 -84q132 0 253 51.5t208 139t139 208t52 253.5zM2048 959q0 -35 -25 -60t-61 -25h-131q17 -85 17 -170q0 -167 -65.5 -319.5t-175.5 -263t-262.5 -176t-319.5 -65.5
+q-246 0 -448.5 133t-301.5 350h-189q-36 0 -61 25t-25 61q0 35 25 60t61 25h132q-17 85 -17 170q0 167 65.5 319.5t175.5 263t262.5 176t320.5 65.5q245 0 447.5 -133t301.5 -350h188q36 0 61 -25t25 -61z" />
+    <glyph glyph-name="_489" unicode="&#xf209;" horiz-adv-x="1280" 
+d="M953 1158l-114 -328l117 -21q165 451 165 518q0 56 -38 56q-57 0 -130 -225zM654 471l33 -88q37 42 71 67l-33 5.5t-38.5 7t-32.5 8.5zM362 1367q0 -98 159 -521q17 10 49 10q15 0 75 -5l-121 351q-75 220 -123 220q-19 0 -29 -17.5t-10 -37.5zM283 608q0 -36 51.5 -119
+t117.5 -153t100 -70q14 0 25.5 13t11.5 27q0 24 -32 102q-13 32 -32 72t-47.5 89t-61.5 81t-62 32q-20 0 -45.5 -27t-25.5 -47zM125 273q0 -41 25 -104q59 -145 183.5 -227t281.5 -82q227 0 382 170q152 169 152 427q0 43 -1 67t-11.5 62t-30.5 56q-56 49 -211.5 75.5
+t-270.5 26.5q-37 0 -49 -11q-12 -5 -12 -35q0 -34 21.5 -60t55.5 -40t77.5 -23.5t87.5 -11.5t85 -4t70 0h23q24 0 40 -19q15 -19 19 -55q-28 -28 -96 -54q-61 -22 -93 -46q-64 -46 -108.5 -114t-44.5 -137q0 -31 18.5 -88.5t18.5 -87.5l-3 -12q-4 -12 -4 -14
+q-137 10 -146 216q-8 -2 -41 -2q2 -7 2 -21q0 -53 -40.5 -89.5t-94.5 -36.5q-82 0 -166.5 78t-84.5 159q0 34 33 67q52 -64 60 -76q77 -104 133 -104q12 0 26.5 8.5t14.5 20.5q0 34 -87.5 145t-116.5 111q-43 0 -70 -44.5t-27 -90.5zM11 264q0 101 42.5 163t136.5 88
+q-28 74 -28 104q0 62 61 123t122 61q29 0 70 -15q-163 462 -163 567q0 80 41 130.5t119 50.5q131 0 325 -581q6 -17 8 -23q6 16 29 79.5t43.5 118.5t54 127.5t64.5 123t70.5 86.5t76.5 36q71 0 112 -49t41 -122q0 -108 -159 -550q61 -15 100.5 -46t58.5 -78t26 -93.5
+t7 -110.5q0 -150 -47 -280t-132 -225t-211 -150t-278 -55q-111 0 -223 42q-149 57 -258 191.5t-109 286.5z" />
+    <glyph glyph-name="_490" unicode="&#xf20a;" horiz-adv-x="2048" 
+d="M785 528h207q-14 -158 -98.5 -248.5t-214.5 -90.5q-162 0 -254.5 116t-92.5 316q0 194 93 311.5t233 117.5q148 0 232 -87t97 -247h-203q-5 64 -35.5 99t-81.5 35q-57 0 -88.5 -60.5t-31.5 -177.5q0 -48 5 -84t18 -69.5t40 -51.5t66 -18q95 0 109 139zM1497 528h206
+q-14 -158 -98 -248.5t-214 -90.5q-162 0 -254.5 116t-92.5 316q0 194 93 311.5t233 117.5q148 0 232 -87t97 -247h-204q-4 64 -35 99t-81 35q-57 0 -88.5 -60.5t-31.5 -177.5q0 -48 5 -84t18 -69.5t39.5 -51.5t65.5 -18q49 0 76.5 38t33.5 101zM1856 647q0 207 -15.5 307
+t-60.5 161q-6 8 -13.5 14t-21.5 15t-16 11q-86 63 -697 63q-625 0 -710 -63q-5 -4 -17.5 -11.5t-21 -14t-14.5 -14.5q-45 -60 -60 -159.5t-15 -308.5q0 -208 15 -307.5t60 -160.5q6 -8 15 -15t20.5 -14t17.5 -12q44 -33 239.5 -49t470.5 -16q610 0 697 65q5 4 17 11t20.5 14
+t13.5 16q46 60 61 159t15 309zM2048 1408v-1536h-2048v1536h2048z" />
+    <glyph glyph-name="_491" unicode="&#xf20b;" 
+d="M992 912v-496q0 -14 -9 -23t-23 -9h-160q-14 0 -23 9t-9 23v496q0 112 -80 192t-192 80h-272v-1152q0 -14 -9 -23t-23 -9h-160q-14 0 -23 9t-9 23v1344q0 14 9 23t23 9h464q135 0 249 -66.5t180.5 -180.5t66.5 -249zM1376 1376v-880q0 -135 -66.5 -249t-180.5 -180.5
+t-249 -66.5h-464q-14 0 -23 9t-9 23v960q0 14 9 23t23 9h160q14 0 23 -9t9 -23v-768h272q112 0 192 80t80 192v880q0 14 9 23t23 9h160q14 0 23 -9t9 -23z" />
+    <glyph glyph-name="_492" unicode="&#xf20c;" 
+d="M1311 694v-114q0 -24 -13.5 -38t-37.5 -14h-202q-24 0 -38 14t-14 38v114q0 24 14 38t38 14h202q24 0 37.5 -14t13.5 -38zM821 464v250q0 53 -32.5 85.5t-85.5 32.5h-133q-68 0 -96 -52q-28 52 -96 52h-130q-53 0 -85.5 -32.5t-32.5 -85.5v-250q0 -22 21 -22h55
+q22 0 22 22v230q0 24 13.5 38t38.5 14h94q24 0 38 -14t14 -38v-230q0 -22 21 -22h54q22 0 22 22v230q0 24 14 38t38 14h97q24 0 37.5 -14t13.5 -38v-230q0 -22 22 -22h55q21 0 21 22zM1410 560v154q0 53 -33 85.5t-86 32.5h-264q-53 0 -86 -32.5t-33 -85.5v-410
+q0 -21 22 -21h55q21 0 21 21v180q31 -42 94 -42h191q53 0 86 32.5t33 85.5zM1536 1176v-1072q0 -96 -68 -164t-164 -68h-1072q-96 0 -164 68t-68 164v1072q0 96 68 164t164 68h1072q96 0 164 -68t68 -164z" />
+    <glyph glyph-name="_493" unicode="&#xf20d;" 
+d="M915 450h-294l147 551zM1001 128h311l-324 1024h-440l-324 -1024h311l383 314zM1536 1120v-960q0 -118 -85 -203t-203 -85h-960q-118 0 -203 85t-85 203v960q0 118 85 203t203 85h960q118 0 203 -85t85 -203z" />
+    <glyph glyph-name="_494" unicode="&#xf20e;" horiz-adv-x="2048" 
+d="M2048 641q0 -21 -13 -36.5t-33 -19.5l-205 -356q3 -9 3 -18q0 -20 -12.5 -35.5t-32.5 -19.5l-193 -337q3 -8 3 -16q0 -23 -16.5 -40t-40.5 -17q-25 0 -41 18h-400q-17 -20 -43 -20t-43 20h-399q-17 -20 -43 -20q-23 0 -40 16.5t-17 40.5q0 8 4 20l-193 335
+q-20 4 -32.5 19.5t-12.5 35.5q0 9 3 18l-206 356q-20 5 -32.5 20.5t-12.5 35.5q0 21 13.5 36.5t33.5 19.5l199 344q0 1 -0.5 3t-0.5 3q0 36 34 51l209 363q-4 10 -4 18q0 24 17 40.5t40 16.5q26 0 44 -21h396q16 21 43 21t43 -21h398q18 21 44 21q23 0 40 -16.5t17 -40.5
+q0 -6 -4 -18l207 -358q23 -1 39 -17.5t16 -38.5q0 -13 -7 -27l187 -324q19 -4 31.5 -19.5t12.5 -35.5zM1063 -158h389l-342 354h-143l-342 -354h360q18 16 39 16t39 -16zM112 654q1 -4 1 -13q0 -10 -2 -15l208 -360l15 -6l188 199v347l-187 194q-13 -8 -29 -10zM986 1438
+h-388l190 -200l554 200h-280q-16 -16 -38 -16t-38 16zM1689 226q1 6 5 11l-64 68l-17 -79h76zM1583 226l22 105l-252 266l-296 -307l63 -64h463zM1495 -142l16 28l65 310h-427l333 -343q8 4 13 5zM578 -158h5l342 354h-373v-335l4 -6q14 -5 22 -13zM552 226h402l64 66
+l-309 321l-157 -166v-221zM359 226h163v189l-168 -177q4 -8 5 -12zM358 1051q0 -1 0.5 -2t0.5 -2q0 -16 -8 -29l171 -177v269zM552 1121v-311l153 -157l297 314l-223 236zM556 1425l-4 -8v-264l205 74l-191 201q-6 -2 -10 -3zM1447 1438h-16l-621 -224l213 -225zM1023 946
+l-297 -315l311 -319l296 307zM688 634l-136 141v-284zM1038 270l-42 -44h85zM1374 618l238 -251l132 624l-3 5l-1 1zM1718 1018q-8 13 -8 29v2l-216 376q-5 1 -13 5l-437 -463l310 -327zM522 1142v223l-163 -282zM522 196h-163l163 -283v283zM1607 196l-48 -227l130 227h-82
+zM1729 266l207 361q-2 10 -2 14q0 1 3 16l-171 296l-129 -612l77 -82q5 3 15 7z" />
+    <glyph glyph-name="f210" unicode="&#xf210;" 
+d="M0 856q0 131 91.5 226.5t222.5 95.5h742l352 358v-1470q0 -132 -91.5 -227t-222.5 -95h-780q-131 0 -222.5 95t-91.5 227v790zM1232 102l-176 180v425q0 46 -32 79t-78 33h-484q-46 0 -78 -33t-32 -79v-492q0 -46 32.5 -79.5t77.5 -33.5h770z" />
+    <glyph glyph-name="_496" unicode="&#xf211;" 
+d="M934 1386q-317 -121 -556 -362.5t-358 -560.5q-20 89 -20 176q0 208 102.5 384.5t278.5 279t384 102.5q82 0 169 -19zM1203 1267q93 -65 164 -155q-389 -113 -674.5 -400.5t-396.5 -676.5q-93 72 -155 162q112 386 395 671t667 399zM470 -67q115 356 379.5 622t619.5 384
+q40 -92 54 -195q-292 -120 -516 -345t-343 -518q-103 14 -194 52zM1536 -125q-193 50 -367 115q-135 -84 -290 -107q109 205 274 370.5t369 275.5q-21 -152 -101 -284q65 -175 115 -370z" />
+    <glyph glyph-name="f212" unicode="&#xf212;" horiz-adv-x="2048" 
+d="M1893 1144l155 -1272q-131 0 -257 57q-200 91 -393 91q-226 0 -374 -148q-148 148 -374 148q-193 0 -393 -91q-128 -57 -252 -57h-5l155 1272q224 127 482 127q233 0 387 -106q154 106 387 106q258 0 482 -127zM1398 157q129 0 232 -28.5t260 -93.5l-124 1021
+q-171 78 -368 78q-224 0 -374 -141q-150 141 -374 141q-197 0 -368 -78l-124 -1021q105 43 165.5 65t148.5 39.5t178 17.5q202 0 374 -108q172 108 374 108zM1438 191l-55 907q-211 -4 -359 -155q-152 155 -374 155q-176 0 -336 -66l-114 -941q124 51 228.5 76t221.5 25
+q209 0 374 -102q172 107 374 102z" />
+    <glyph glyph-name="_498" unicode="&#xf213;" horiz-adv-x="2048" 
+d="M1500 165v733q0 21 -15 36t-35 15h-93q-20 0 -35 -15t-15 -36v-733q0 -20 15 -35t35 -15h93q20 0 35 15t15 35zM1216 165v531q0 20 -15 35t-35 15h-101q-20 0 -35 -15t-15 -35v-531q0 -20 15 -35t35 -15h101q20 0 35 15t15 35zM924 165v429q0 20 -15 35t-35 15h-101
+q-20 0 -35 -15t-15 -35v-429q0 -20 15 -35t35 -15h101q20 0 35 15t15 35zM632 165v362q0 20 -15 35t-35 15h-101q-20 0 -35 -15t-15 -35v-362q0 -20 15 -35t35 -15h101q20 0 35 15t15 35zM2048 311q0 -166 -118 -284t-284 -118h-1244q-166 0 -284 118t-118 284
+q0 116 63 214.5t168 148.5q-10 34 -10 73q0 113 80.5 193.5t193.5 80.5q102 0 180 -67q45 183 194 300t338 117q149 0 275 -73.5t199.5 -199.5t73.5 -275q0 -66 -14 -122q135 -33 221 -142.5t86 -247.5z" />
+    <glyph glyph-name="_499" unicode="&#xf214;" 
+d="M0 1536h1536v-1392l-776 -338l-760 338v1392zM1436 209v926h-1336v-926l661 -294zM1436 1235v201h-1336v-201h1336zM181 937v-115h-37v115h37zM181 789v-115h-37v115h37zM181 641v-115h-37v115h37zM181 493v-115h-37v115h37zM181 345v-115h-37v115h37zM207 202l15 34
+l105 -47l-15 -33zM343 142l15 34l105 -46l-15 -34zM478 82l15 34l105 -46l-15 -34zM614 23l15 33l104 -46l-15 -34zM797 10l105 46l15 -33l-105 -47zM932 70l105 46l15 -34l-105 -46zM1068 130l105 46l15 -34l-105 -46zM1203 189l105 47l15 -34l-105 -46zM259 1389v-36h-114
+v36h114zM421 1389v-36h-115v36h115zM583 1389v-36h-115v36h115zM744 1389v-36h-114v36h114zM906 1389v-36h-114v36h114zM1068 1389v-36h-115v36h115zM1230 1389v-36h-115v36h115zM1391 1389v-36h-114v36h114zM181 1049v-79h-37v115h115v-36h-78zM421 1085v-36h-115v36h115z
+M583 1085v-36h-115v36h115zM744 1085v-36h-114v36h114zM906 1085v-36h-114v36h114zM1068 1085v-36h-115v36h115zM1230 1085v-36h-115v36h115zM1355 970v79h-78v36h115v-115h-37zM1355 822v115h37v-115h-37zM1355 674v115h37v-115h-37zM1355 526v115h37v-115h-37zM1355 378
+v115h37v-115h-37zM1355 230v115h37v-115h-37zM760 265q-129 0 -221 91.5t-92 221.5q0 129 92 221t221 92q130 0 221.5 -92t91.5 -221q0 -130 -91.5 -221.5t-221.5 -91.5zM595 646q0 -36 19.5 -56.5t49.5 -25t64 -7t64 -2t49.5 -9t19.5 -30.5q0 -49 -112 -49q-97 0 -123 51
+h-3l-31 -63q67 -42 162 -42q29 0 56.5 5t55.5 16t45.5 33t17.5 53q0 46 -27.5 69.5t-67.5 27t-79.5 3t-67 5t-27.5 25.5q0 21 20.5 33t40.5 15t41 3q34 0 70.5 -11t51.5 -34h3l30 58q-3 1 -21 8.5t-22.5 9t-19.5 7t-22 7t-20 4.5t-24 4t-23 1q-29 0 -56.5 -5t-54 -16.5
+t-43 -34t-16.5 -53.5z" />
+    <glyph glyph-name="_500" unicode="&#xf215;" horiz-adv-x="2048" 
+d="M863 504q0 112 -79.5 191.5t-191.5 79.5t-191 -79.5t-79 -191.5t79 -191t191 -79t191.5 79t79.5 191zM1726 505q0 112 -79 191t-191 79t-191.5 -79t-79.5 -191q0 -113 79.5 -192t191.5 -79t191 79.5t79 191.5zM2048 1314v-1348q0 -44 -31.5 -75.5t-76.5 -31.5h-1832
+q-45 0 -76.5 31.5t-31.5 75.5v1348q0 44 31.5 75.5t76.5 31.5h431q44 0 76 -31.5t32 -75.5v-161h754v161q0 44 32 75.5t76 31.5h431q45 0 76.5 -31.5t31.5 -75.5z" />
+    <glyph glyph-name="_501" unicode="&#xf216;" horiz-adv-x="2048" 
+d="M1430 953zM1690 749q148 0 253 -98.5t105 -244.5q0 -157 -109 -261.5t-267 -104.5q-85 0 -162 27.5t-138 73.5t-118 106t-109 126t-103.5 132.5t-108.5 126.5t-117 106t-136 73.5t-159 27.5q-154 0 -251.5 -91.5t-97.5 -244.5q0 -157 104 -250t263 -93q100 0 208 37.5
+t193 98.5q5 4 21 18.5t30 24t22 9.5q14 0 24.5 -10.5t10.5 -24.5q0 -24 -60 -77q-101 -88 -234.5 -142t-260.5 -54q-133 0 -245.5 58t-180 165t-67.5 241q0 205 141.5 341t347.5 136q120 0 226.5 -43.5t185.5 -113t151.5 -153t139 -167.5t133.5 -153.5t149.5 -113
+t172.5 -43.5q102 0 168.5 61.5t66.5 162.5q0 95 -64.5 159t-159.5 64q-30 0 -81.5 -18.5t-68.5 -18.5q-20 0 -35.5 15t-15.5 35q0 18 8.5 57t8.5 59q0 159 -107.5 263t-266.5 104q-58 0 -111.5 -18.5t-84 -40.5t-55.5 -40.5t-33 -18.5q-15 0 -25.5 10.5t-10.5 25.5
+q0 19 25 46q59 67 147 103.5t182 36.5q191 0 318 -125.5t127 -315.5q0 -37 -4 -66q57 15 115 15z" />
+    <glyph glyph-name="_502" unicode="&#xf217;" horiz-adv-x="1664" 
+d="M1216 832q0 26 -19 45t-45 19h-128v128q0 26 -19 45t-45 19t-45 -19t-19 -45v-128h-128q-26 0 -45 -19t-19 -45t19 -45t45 -19h128v-128q0 -26 19 -45t45 -19t45 19t19 45v128h128q26 0 45 19t19 45zM640 0q0 -53 -37.5 -90.5t-90.5 -37.5t-90.5 37.5t-37.5 90.5
+t37.5 90.5t90.5 37.5t90.5 -37.5t37.5 -90.5zM1536 0q0 -53 -37.5 -90.5t-90.5 -37.5t-90.5 37.5t-37.5 90.5t37.5 90.5t90.5 37.5t90.5 -37.5t37.5 -90.5zM1664 1088v-512q0 -24 -16 -42.5t-41 -21.5l-1044 -122q1 -7 4.5 -21.5t6 -26.5t2.5 -22q0 -16 -24 -64h920
+q26 0 45 -19t19 -45t-19 -45t-45 -19h-1024q-26 0 -45 19t-19 45q0 14 11 39.5t29.5 59.5t20.5 38l-177 823h-204q-26 0 -45 19t-19 45t19 45t45 19h256q16 0 28.5 -6.5t20 -15.5t13 -24.5t7.5 -26.5t5.5 -29.5t4.5 -25.5h1201q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="_503" unicode="&#xf218;" horiz-adv-x="1664" 
+d="M1280 832q0 26 -19 45t-45 19t-45 -19l-147 -146v293q0 26 -19 45t-45 19t-45 -19t-19 -45v-293l-147 146q-19 19 -45 19t-45 -19t-19 -45t19 -45l256 -256q19 -19 45 -19t45 19l256 256q19 19 19 45zM640 0q0 -53 -37.5 -90.5t-90.5 -37.5t-90.5 37.5t-37.5 90.5
+t37.5 90.5t90.5 37.5t90.5 -37.5t37.5 -90.5zM1536 0q0 -53 -37.5 -90.5t-90.5 -37.5t-90.5 37.5t-37.5 90.5t37.5 90.5t90.5 37.5t90.5 -37.5t37.5 -90.5zM1664 1088v-512q0 -24 -16 -42.5t-41 -21.5l-1044 -122q1 -7 4.5 -21.5t6 -26.5t2.5 -22q0 -16 -24 -64h920
+q26 0 45 -19t19 -45t-19 -45t-45 -19h-1024q-26 0 -45 19t-19 45q0 14 11 39.5t29.5 59.5t20.5 38l-177 823h-204q-26 0 -45 19t-19 45t19 45t45 19h256q16 0 28.5 -6.5t20 -15.5t13 -24.5t7.5 -26.5t5.5 -29.5t4.5 -25.5h1201q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="_504" unicode="&#xf219;" horiz-adv-x="2048" 
+d="M212 768l623 -665l-300 665h-323zM1024 -4l349 772h-698zM538 896l204 384h-262l-288 -384h346zM1213 103l623 665h-323zM683 896h682l-204 384h-274zM1510 896h346l-288 384h-262zM1651 1382l384 -512q14 -18 13 -41.5t-17 -40.5l-960 -1024q-18 -20 -47 -20t-47 20
+l-960 1024q-16 17 -17 40.5t13 41.5l384 512q18 26 51 26h1152q33 0 51 -26z" />
+    <glyph glyph-name="_505" unicode="&#xf21a;" horiz-adv-x="2048" 
+d="M1811 -19q19 19 45 19t45 -19l128 -128l-90 -90l-83 83l-83 -83q-18 -19 -45 -19t-45 19l-83 83l-83 -83q-19 -19 -45 -19t-45 19l-83 83l-83 -83q-19 -19 -45 -19t-45 19l-83 83l-83 -83q-19 -19 -45 -19t-45 19l-83 83l-83 -83q-19 -19 -45 -19t-45 19l-83 83l-83 -83
+q-19 -19 -45 -19t-45 19l-83 83l-83 -83q-19 -19 -45 -19t-45 19l-128 128l90 90l83 -83l83 83q19 19 45 19t45 -19l83 -83l83 83q19 19 45 19t45 -19l83 -83l83 83q19 19 45 19t45 -19l83 -83l83 83q19 19 45 19t45 -19l83 -83l83 83q19 19 45 19t45 -19l83 -83l83 83
+q19 19 45 19t45 -19l83 -83zM237 19q-19 -19 -45 -19t-45 19l-128 128l90 90l83 -82l83 82q19 19 45 19t45 -19l83 -82l64 64v293l-210 314q-17 26 -7 56.5t40 40.5l177 58v299h128v128h256v128h256v-128h256v-128h128v-299l177 -58q30 -10 40 -40.5t-7 -56.5l-210 -314
+v-293l19 18q19 19 45 19t45 -19l83 -82l83 82q19 19 45 19t45 -19l128 -128l-90 -90l-83 83l-83 -83q-18 -19 -45 -19t-45 19l-83 83l-83 -83q-19 -19 -45 -19t-45 19l-83 83l-83 -83q-19 -19 -45 -19t-45 19l-83 83l-83 -83q-19 -19 -45 -19t-45 19l-83 83l-83 -83
+q-19 -19 -45 -19t-45 19l-83 83l-83 -83q-19 -19 -45 -19t-45 19l-83 83zM640 1152v-128l384 128l384 -128v128h-128v128h-512v-128h-128z" />
+    <glyph glyph-name="_506" unicode="&#xf21b;" 
+d="M576 0l96 448l-96 128l-128 64zM832 0l128 640l-128 -64l-96 -128zM992 1010q-2 4 -4 6q-10 8 -96 8q-70 0 -167 -19q-7 -2 -21 -2t-21 2q-97 19 -167 19q-86 0 -96 -8q-2 -2 -4 -6q2 -18 4 -27q2 -3 7.5 -6.5t7.5 -10.5q2 -4 7.5 -20.5t7 -20.5t7.5 -17t8.5 -17t9 -14
+t12 -13.5t14 -9.5t17.5 -8t20.5 -4t24.5 -2q36 0 59 12.5t32.5 30t14.5 34.5t11.5 29.5t17.5 12.5h12q11 0 17.5 -12.5t11.5 -29.5t14.5 -34.5t32.5 -30t59 -12.5q13 0 24.5 2t20.5 4t17.5 8t14 9.5t12 13.5t9 14t8.5 17t7.5 17t7 20.5t7.5 20.5q2 7 7.5 10.5t7.5 6.5
+q2 9 4 27zM1408 131q0 -121 -73 -190t-194 -69h-874q-121 0 -194 69t-73 190q0 61 4.5 118t19 125.5t37.5 123.5t63.5 103.5t93.5 74.5l-90 220h214q-22 64 -22 128q0 12 2 32q-194 40 -194 96q0 57 210 99q17 62 51.5 134t70.5 114q32 37 76 37q30 0 84 -31t84 -31t84 31
+t84 31q44 0 76 -37q36 -42 70.5 -114t51.5 -134q210 -42 210 -99q0 -56 -194 -96q7 -81 -20 -160h214l-82 -225q63 -33 107.5 -96.5t65.5 -143.5t29 -151.5t8 -148.5z" />
+    <glyph glyph-name="_507" unicode="&#xf21c;" horiz-adv-x="2304" 
+d="M2301 500q12 -103 -22 -198.5t-99 -163.5t-158.5 -106t-196.5 -31q-161 11 -279.5 125t-134.5 274q-12 111 27.5 210.5t118.5 170.5l-71 107q-96 -80 -151 -194t-55 -244q0 -27 -18.5 -46.5t-45.5 -19.5h-256h-69q-23 -164 -149 -274t-294 -110q-185 0 -316.5 131.5
+t-131.5 316.5t131.5 316.5t316.5 131.5q76 0 152 -27l24 45q-123 110 -304 110h-64q-26 0 -45 19t-19 45t19 45t45 19h128q78 0 145 -13.5t116.5 -38.5t71.5 -39.5t51 -36.5h512h115l-85 128h-222q-30 0 -49 22.5t-14 52.5q4 23 23 38t43 15h253q33 0 53 -28l70 -105
+l114 114q19 19 46 19h101q26 0 45 -19t19 -45v-128q0 -26 -19 -45t-45 -19h-179l115 -172q131 63 275 36q143 -26 244 -134.5t118 -253.5zM448 128q115 0 203 72.5t111 183.5h-314q-35 0 -55 31q-18 32 -1 63l147 277q-47 13 -91 13q-132 0 -226 -94t-94 -226t94 -226
+t226 -94zM1856 128q132 0 226 94t94 226t-94 226t-226 94q-60 0 -121 -24l174 -260q15 -23 10 -49t-27 -40q-15 -11 -36 -11q-35 0 -53 29l-174 260q-93 -95 -93 -225q0 -132 94 -226t226 -94z" />
+    <glyph glyph-name="_508" unicode="&#xf21d;" 
+d="M1408 0q0 -63 -61.5 -113.5t-164 -81t-225 -46t-253.5 -15.5t-253.5 15.5t-225 46t-164 81t-61.5 113.5q0 49 33 88.5t91 66.5t118 44.5t131 29.5q26 5 48 -10.5t26 -41.5q5 -26 -10.5 -48t-41.5 -26q-58 -10 -106 -23.5t-76.5 -25.5t-48.5 -23.5t-27.5 -19.5t-8.5 -12
+q3 -11 27 -26.5t73 -33t114 -32.5t160.5 -25t201.5 -10t201.5 10t160.5 25t114 33t73 33.5t27 27.5q-1 4 -8.5 11t-27.5 19t-48.5 23.5t-76.5 25t-106 23.5q-26 4 -41.5 26t-10.5 48q4 26 26 41.5t48 10.5q71 -12 131 -29.5t118 -44.5t91 -66.5t33 -88.5zM1024 896v-384
+q0 -26 -19 -45t-45 -19h-64v-384q0 -26 -19 -45t-45 -19h-256q-26 0 -45 19t-19 45v384h-64q-26 0 -45 19t-19 45v384q0 53 37.5 90.5t90.5 37.5h384q53 0 90.5 -37.5t37.5 -90.5zM928 1280q0 -93 -65.5 -158.5t-158.5 -65.5t-158.5 65.5t-65.5 158.5t65.5 158.5t158.5 65.5
+t158.5 -65.5t65.5 -158.5z" />
+    <glyph glyph-name="_509" unicode="&#xf21e;" horiz-adv-x="1792" 
+d="M1280 512h305q-5 -6 -10 -10.5t-9 -7.5l-3 -4l-623 -600q-18 -18 -44 -18t-44 18l-624 602q-5 2 -21 20h369q22 0 39.5 13.5t22.5 34.5l70 281l190 -667q6 -20 23 -33t39 -13q21 0 38 13t23 33l146 485l56 -112q18 -35 57 -35zM1792 940q0 -145 -103 -300h-369l-111 221
+q-8 17 -25.5 27t-36.5 8q-45 -5 -56 -46l-129 -430l-196 686q-6 20 -23.5 33t-39.5 13t-39 -13.5t-22 -34.5l-116 -464h-423q-103 155 -103 300q0 220 127 344t351 124q62 0 126.5 -21.5t120 -58t95.5 -68.5t76 -68q36 36 76 68t95.5 68.5t120 58t126.5 21.5q224 0 351 -124
+t127 -344z" />
+    <glyph glyph-name="venus" unicode="&#xf221;" horiz-adv-x="1280" 
+d="M1152 960q0 -221 -147.5 -384.5t-364.5 -187.5v-260h224q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-224v-224q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v224h-224q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h224v260q-150 16 -271.5 103t-186 224t-52.5 292
+q11 134 80.5 249t182 188t245.5 88q170 19 319 -54t236 -212t87 -306zM128 960q0 -185 131.5 -316.5t316.5 -131.5t316.5 131.5t131.5 316.5t-131.5 316.5t-316.5 131.5t-316.5 -131.5t-131.5 -316.5z" />
+    <glyph glyph-name="_511" unicode="&#xf222;" 
+d="M1472 1408q26 0 45 -19t19 -45v-416q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v262l-382 -383q126 -156 126 -359q0 -117 -45.5 -223.5t-123 -184t-184 -123t-223.5 -45.5t-223.5 45.5t-184 123t-123 184t-45.5 223.5t45.5 223.5t123 184t184 123t223.5 45.5
+q203 0 359 -126l382 382h-261q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h416zM576 0q185 0 316.5 131.5t131.5 316.5t-131.5 316.5t-316.5 131.5t-316.5 -131.5t-131.5 -316.5t131.5 -316.5t316.5 -131.5z" />
+    <glyph glyph-name="_512" unicode="&#xf223;" horiz-adv-x="1280" 
+d="M830 1220q145 -72 233.5 -210.5t88.5 -305.5q0 -221 -147.5 -384.5t-364.5 -187.5v-132h96q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-96v-96q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v96h-96q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h96v132q-217 24 -364.5 187.5
+t-147.5 384.5q0 167 88.5 305.5t233.5 210.5q-165 96 -228 273q-6 16 3.5 29.5t26.5 13.5h69q21 0 29 -20q44 -106 140 -171t214 -65t214 65t140 171q8 20 37 20h61q17 0 26.5 -13.5t3.5 -29.5q-63 -177 -228 -273zM576 256q185 0 316.5 131.5t131.5 316.5t-131.5 316.5
+t-316.5 131.5t-316.5 -131.5t-131.5 -316.5t131.5 -316.5t316.5 -131.5z" />
+    <glyph glyph-name="_513" unicode="&#xf224;" 
+d="M1024 1504q0 14 9 23t23 9h288q26 0 45 -19t19 -45v-288q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v134l-254 -255q126 -158 126 -359q0 -221 -147.5 -384.5t-364.5 -187.5v-132h96q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-96v-96q0 -14 -9 -23t-23 -9h-64
+q-14 0 -23 9t-9 23v96h-96q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h96v132q-149 16 -270.5 103t-186.5 223.5t-53 291.5q16 204 160 353.5t347 172.5q118 14 228 -19t198 -103l255 254h-134q-14 0 -23 9t-9 23v64zM576 256q185 0 316.5 131.5t131.5 316.5t-131.5 316.5
+t-316.5 131.5t-316.5 -131.5t-131.5 -316.5t131.5 -316.5t316.5 -131.5z" />
+    <glyph glyph-name="_514" unicode="&#xf225;" horiz-adv-x="1792" 
+d="M1280 1504q0 14 9 23t23 9h288q26 0 45 -19t19 -45v-288q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v134l-254 -255q126 -158 126 -359q0 -221 -147.5 -384.5t-364.5 -187.5v-132h96q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-96v-96q0 -14 -9 -23t-23 -9h-64
+q-14 0 -23 9t-9 23v96h-96q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h96v132q-217 24 -364.5 187.5t-147.5 384.5q0 201 126 359l-52 53l-101 -111q-9 -10 -22 -10.5t-23 7.5l-48 44q-10 8 -10.5 21.5t8.5 23.5l105 115l-111 112v-134q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9
+t-9 23v288q0 26 19 45t45 19h288q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-133l106 -107l86 94q9 10 22 10.5t23 -7.5l48 -44q10 -8 10.5 -21.5t-8.5 -23.5l-90 -99l57 -56q158 126 359 126t359 -126l255 254h-134q-14 0 -23 9t-9 23v64zM832 256q185 0 316.5 131.5
+t131.5 316.5t-131.5 316.5t-316.5 131.5t-316.5 -131.5t-131.5 -316.5t131.5 -316.5t316.5 -131.5z" />
+    <glyph glyph-name="_515" unicode="&#xf226;" horiz-adv-x="1792" 
+d="M1790 1007q12 -155 -52.5 -292t-186 -224t-271.5 -103v-260h224q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-224v-224q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v224h-512v-224q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v224h-224q-14 0 -23 9t-9 23v64q0 14 9 23
+t23 9h224v260q-150 16 -271.5 103t-186 224t-52.5 292q17 206 164.5 356.5t352.5 169.5q206 21 377 -94q171 115 377 94q205 -19 352.5 -169.5t164.5 -356.5zM896 647q128 131 128 313t-128 313q-128 -131 -128 -313t128 -313zM576 512q115 0 218 57q-154 165 -154 391
+q0 224 154 391q-103 57 -218 57q-185 0 -316.5 -131.5t-131.5 -316.5t131.5 -316.5t316.5 -131.5zM1152 128v260q-137 15 -256 94q-119 -79 -256 -94v-260h512zM1216 512q185 0 316.5 131.5t131.5 316.5t-131.5 316.5t-316.5 131.5q-115 0 -218 -57q154 -167 154 -391
+q0 -226 -154 -391q103 -57 218 -57z" />
+    <glyph glyph-name="_516" unicode="&#xf227;" horiz-adv-x="1920" 
+d="M1536 1120q0 14 9 23t23 9h288q26 0 45 -19t19 -45v-288q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v134l-254 -255q76 -95 107.5 -214t9.5 -247q-31 -182 -166 -312t-318 -156q-210 -29 -384.5 80t-241.5 300q-117 6 -221 57.5t-177.5 133t-113.5 192.5t-32 230
+q9 135 78 252t182 191.5t248 89.5q118 14 227.5 -19t198.5 -103l255 254h-134q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h288q26 0 45 -19t19 -45v-288q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v134l-254 -255q59 -74 93 -169q182 -9 328 -124l255 254h-134q-14 0 -23 9
+t-9 23v64zM1024 704q0 20 -4 58q-162 -25 -271 -150t-109 -292q0 -20 4 -58q162 25 271 150t109 292zM128 704q0 -168 111 -294t276 -149q-3 29 -3 59q0 210 135 369.5t338 196.5q-53 120 -163.5 193t-245.5 73q-185 0 -316.5 -131.5t-131.5 -316.5zM1088 -128
+q185 0 316.5 131.5t131.5 316.5q0 168 -111 294t-276 149q3 -28 3 -59q0 -210 -135 -369.5t-338 -196.5q53 -120 163.5 -193t245.5 -73z" />
+    <glyph glyph-name="_517" unicode="&#xf228;" horiz-adv-x="2048" 
+d="M1664 1504q0 14 9 23t23 9h288q26 0 45 -19t19 -45v-288q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v134l-254 -255q76 -95 107.5 -214t9.5 -247q-32 -180 -164.5 -310t-313.5 -157q-223 -34 -409 90q-117 -78 -256 -93v-132h96q14 0 23 -9t9 -23v-64q0 -14 -9 -23
+t-23 -9h-96v-96q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v96h-96q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h96v132q-155 17 -279.5 109.5t-187 237.5t-39.5 307q25 187 159.5 322.5t320.5 164.5q224 34 410 -90q146 97 320 97q201 0 359 -126l255 254h-134q-14 0 -23 9
+t-9 23v64zM896 391q128 131 128 313t-128 313q-128 -131 -128 -313t128 -313zM128 704q0 -185 131.5 -316.5t316.5 -131.5q117 0 218 57q-154 167 -154 391t154 391q-101 57 -218 57q-185 0 -316.5 -131.5t-131.5 -316.5zM1216 256q185 0 316.5 131.5t131.5 316.5
+t-131.5 316.5t-316.5 131.5q-117 0 -218 -57q154 -167 154 -391t-154 -391q101 -57 218 -57z" />
+    <glyph glyph-name="_518" unicode="&#xf229;" 
+d="M1472 1408q26 0 45 -19t19 -45v-416q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v262l-213 -214l140 -140q9 -10 9 -23t-9 -22l-46 -46q-9 -9 -22 -9t-23 9l-140 141l-78 -79q126 -156 126 -359q0 -117 -45.5 -223.5t-123 -184t-184 -123t-223.5 -45.5t-223.5 45.5
+t-184 123t-123 184t-45.5 223.5t45.5 223.5t123 184t184 123t223.5 45.5q203 0 359 -126l78 78l-172 172q-9 10 -9 23t9 22l46 46q9 9 22 9t23 -9l172 -172l213 213h-261q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h416zM576 0q185 0 316.5 131.5t131.5 316.5t-131.5 316.5
+t-316.5 131.5t-316.5 -131.5t-131.5 -316.5t131.5 -316.5t316.5 -131.5z" />
+    <glyph glyph-name="_519" unicode="&#xf22a;" horiz-adv-x="1280" 
+d="M640 892q217 -24 364.5 -187.5t147.5 -384.5q0 -167 -87 -306t-236 -212t-319 -54q-133 15 -245.5 88t-182 188t-80.5 249q-12 155 52.5 292t186 224t271.5 103v132h-160q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h160v165l-92 -92q-10 -9 -23 -9t-22 9l-46 46q-9 9 -9 22
+t9 23l202 201q19 19 45 19t45 -19l202 -201q9 -10 9 -23t-9 -22l-46 -46q-9 -9 -22 -9t-23 9l-92 92v-165h160q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-160v-132zM576 -128q185 0 316.5 131.5t131.5 316.5t-131.5 316.5t-316.5 131.5t-316.5 -131.5t-131.5 -316.5
+t131.5 -316.5t316.5 -131.5z" />
+    <glyph glyph-name="_520" unicode="&#xf22b;" horiz-adv-x="2048" 
+d="M1901 621q19 -19 19 -45t-19 -45l-294 -294q-9 -10 -22.5 -10t-22.5 10l-45 45q-10 9 -10 22.5t10 22.5l185 185h-294v-224q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v224h-132q-24 -217 -187.5 -364.5t-384.5 -147.5q-167 0 -306 87t-212 236t-54 319q15 133 88 245.5
+t188 182t249 80.5q155 12 292 -52.5t224 -186t103 -271.5h132v224q0 14 9 23t23 9h64q14 0 23 -9t9 -23v-224h294l-185 185q-10 9 -10 22.5t10 22.5l45 45q9 10 22.5 10t22.5 -10zM576 128q185 0 316.5 131.5t131.5 316.5t-131.5 316.5t-316.5 131.5t-316.5 -131.5
+t-131.5 -316.5t131.5 -316.5t316.5 -131.5z" />
+    <glyph glyph-name="_521" unicode="&#xf22c;" horiz-adv-x="1280" 
+d="M1152 960q0 -221 -147.5 -384.5t-364.5 -187.5v-612q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v612q-217 24 -364.5 187.5t-147.5 384.5q0 117 45.5 223.5t123 184t184 123t223.5 45.5t223.5 -45.5t184 -123t123 -184t45.5 -223.5zM576 512q185 0 316.5 131.5
+t131.5 316.5t-131.5 316.5t-316.5 131.5t-316.5 -131.5t-131.5 -316.5t131.5 -316.5t316.5 -131.5z" />
+    <glyph glyph-name="_522" unicode="&#xf22d;" horiz-adv-x="1280" 
+d="M1024 576q0 185 -131.5 316.5t-316.5 131.5t-316.5 -131.5t-131.5 -316.5t131.5 -316.5t316.5 -131.5t316.5 131.5t131.5 316.5zM1152 576q0 -117 -45.5 -223.5t-123 -184t-184 -123t-223.5 -45.5t-223.5 45.5t-184 123t-123 184t-45.5 223.5t45.5 223.5t123 184t184 123
+t223.5 45.5t223.5 -45.5t184 -123t123 -184t45.5 -223.5z" />
+    <glyph glyph-name="_523" unicode="&#xf22e;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="_524" unicode="&#xf22f;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="_525" unicode="&#xf230;" 
+d="M1451 1408q35 0 60 -25t25 -60v-1366q0 -35 -25 -60t-60 -25h-391v595h199l30 232h-229v148q0 56 23.5 84t91.5 28l122 1v207q-63 9 -178 9q-136 0 -217.5 -80t-81.5 -226v-171h-200v-232h200v-595h-735q-35 0 -60 25t-25 60v1366q0 35 25 60t60 25h1366z" />
+    <glyph glyph-name="_526" unicode="&#xf231;" horiz-adv-x="1280" 
+d="M0 939q0 108 37.5 203.5t103.5 166.5t152 123t185 78t202 26q158 0 294 -66.5t221 -193.5t85 -287q0 -96 -19 -188t-60 -177t-100 -149.5t-145 -103t-189 -38.5q-68 0 -135 32t-96 88q-10 -39 -28 -112.5t-23.5 -95t-20.5 -71t-26 -71t-32 -62.5t-46 -77.5t-62 -86.5
+l-14 -5l-9 10q-15 157 -15 188q0 92 21.5 206.5t66.5 287.5t52 203q-32 65 -32 169q0 83 52 156t132 73q61 0 95 -40.5t34 -102.5q0 -66 -44 -191t-44 -187q0 -63 45 -104.5t109 -41.5q55 0 102 25t78.5 68t56 95t38 110.5t20 111t6.5 99.5q0 173 -109.5 269.5t-285.5 96.5
+q-200 0 -334 -129.5t-134 -328.5q0 -44 12.5 -85t27 -65t27 -45.5t12.5 -30.5q0 -28 -15 -73t-37 -45q-2 0 -17 3q-51 15 -90.5 56t-61 94.5t-32.5 108t-11 106.5z" />
+    <glyph glyph-name="_527" unicode="&#xf232;" 
+d="M985 562q13 0 97.5 -44t89.5 -53q2 -5 2 -15q0 -33 -17 -76q-16 -39 -71 -65.5t-102 -26.5q-57 0 -190 62q-98 45 -170 118t-148 185q-72 107 -71 194v8q3 91 74 158q24 22 52 22q6 0 18 -1.5t19 -1.5q19 0 26.5 -6.5t15.5 -27.5q8 -20 33 -88t25 -75q0 -21 -34.5 -57.5
+t-34.5 -46.5q0 -7 5 -15q34 -73 102 -137q56 -53 151 -101q12 -7 22 -7q15 0 54 48.5t52 48.5zM782 32q127 0 243.5 50t200.5 134t134 200.5t50 243.5t-50 243.5t-134 200.5t-200.5 134t-243.5 50t-243.5 -50t-200.5 -134t-134 -200.5t-50 -243.5q0 -203 120 -368l-79 -233
+l242 77q158 -104 345 -104zM782 1414q153 0 292.5 -60t240.5 -161t161 -240.5t60 -292.5t-60 -292.5t-161 -240.5t-240.5 -161t-292.5 -60q-195 0 -365 94l-417 -134l136 405q-108 178 -108 389q0 153 60 292.5t161 240.5t240.5 161t292.5 60z" />
+    <glyph glyph-name="_528" unicode="&#xf233;" horiz-adv-x="1792" 
+d="M128 128h1024v128h-1024v-128zM128 640h1024v128h-1024v-128zM1696 192q0 40 -28 68t-68 28t-68 -28t-28 -68t28 -68t68 -28t68 28t28 68zM128 1152h1024v128h-1024v-128zM1696 704q0 40 -28 68t-68 28t-68 -28t-28 -68t28 -68t68 -28t68 28t28 68zM1696 1216
+q0 40 -28 68t-68 28t-68 -28t-28 -68t28 -68t68 -28t68 28t28 68zM1792 384v-384h-1792v384h1792zM1792 896v-384h-1792v384h1792zM1792 1408v-384h-1792v384h1792z" />
+    <glyph glyph-name="_529" unicode="&#xf234;" horiz-adv-x="2048" 
+d="M704 640q-159 0 -271.5 112.5t-112.5 271.5t112.5 271.5t271.5 112.5t271.5 -112.5t112.5 -271.5t-112.5 -271.5t-271.5 -112.5zM1664 512h352q13 0 22.5 -9.5t9.5 -22.5v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-352v-352q0 -13 -9.5 -22.5t-22.5 -9.5h-192q-13 0 -22.5 9.5
+t-9.5 22.5v352h-352q-13 0 -22.5 9.5t-9.5 22.5v192q0 13 9.5 22.5t22.5 9.5h352v352q0 13 9.5 22.5t22.5 9.5h192q13 0 22.5 -9.5t9.5 -22.5v-352zM928 288q0 -52 38 -90t90 -38h256v-238q-68 -50 -171 -50h-874q-121 0 -194 69t-73 190q0 53 3.5 103.5t14 109t26.5 108.5
+t43 97.5t62 81t85.5 53.5t111.5 20q19 0 39 -17q79 -61 154.5 -91.5t164.5 -30.5t164.5 30.5t154.5 91.5q20 17 39 17q132 0 217 -96h-223q-52 0 -90 -38t-38 -90v-192z" />
+    <glyph glyph-name="_530" unicode="&#xf235;" horiz-adv-x="2048" 
+d="M704 640q-159 0 -271.5 112.5t-112.5 271.5t112.5 271.5t271.5 112.5t271.5 -112.5t112.5 -271.5t-112.5 -271.5t-271.5 -112.5zM1781 320l249 -249q9 -9 9 -23q0 -13 -9 -22l-136 -136q-9 -9 -22 -9q-14 0 -23 9l-249 249l-249 -249q-9 -9 -23 -9q-13 0 -22 9l-136 136
+q-9 9 -9 22q0 14 9 23l249 249l-249 249q-9 9 -9 23q0 13 9 22l136 136q9 9 22 9q14 0 23 -9l249 -249l249 249q9 9 23 9q13 0 22 -9l136 -136q9 -9 9 -22q0 -14 -9 -23zM1283 320l-181 -181q-37 -37 -37 -91q0 -53 37 -90l83 -83q-21 -3 -44 -3h-874q-121 0 -194 69
+t-73 190q0 53 3.5 103.5t14 109t26.5 108.5t43 97.5t62 81t85.5 53.5t111.5 20q19 0 39 -17q154 -122 319 -122t319 122q20 17 39 17q28 0 57 -6q-28 -27 -41 -50t-13 -56q0 -54 37 -91z" />
+    <glyph glyph-name="_531" unicode="&#xf236;" horiz-adv-x="2048" 
+d="M256 512h1728q26 0 45 -19t19 -45v-448h-256v256h-1536v-256h-256v1216q0 26 19 45t45 19h128q26 0 45 -19t19 -45v-704zM832 832q0 106 -75 181t-181 75t-181 -75t-75 -181t75 -181t181 -75t181 75t75 181zM2048 576v64q0 159 -112.5 271.5t-271.5 112.5h-704
+q-26 0 -45 -19t-19 -45v-384h1152z" />
+    <glyph glyph-name="_532" unicode="&#xf237;" 
+d="M1536 1536l-192 -448h192v-192h-274l-55 -128h329v-192h-411l-357 -832l-357 832h-411v192h329l-55 128h-274v192h192l-192 448h256l323 -768h378l323 768h256zM768 320l108 256h-216z" />
+    <glyph glyph-name="_533" unicode="&#xf238;" 
+d="M1088 1536q185 0 316.5 -93.5t131.5 -226.5v-896q0 -130 -125.5 -222t-305.5 -97l213 -202q16 -15 8 -35t-30 -20h-1056q-22 0 -30 20t8 35l213 202q-180 5 -305.5 97t-125.5 222v896q0 133 131.5 226.5t316.5 93.5h640zM768 192q80 0 136 56t56 136t-56 136t-136 56
+t-136 -56t-56 -136t56 -136t136 -56zM1344 768v512h-1152v-512h1152z" />
+    <glyph glyph-name="_534" unicode="&#xf239;" 
+d="M1088 1536q185 0 316.5 -93.5t131.5 -226.5v-896q0 -130 -125.5 -222t-305.5 -97l213 -202q16 -15 8 -35t-30 -20h-1056q-22 0 -30 20t8 35l213 202q-180 5 -305.5 97t-125.5 222v896q0 133 131.5 226.5t316.5 93.5h640zM288 224q66 0 113 47t47 113t-47 113t-113 47
+t-113 -47t-47 -113t47 -113t113 -47zM704 768v512h-544v-512h544zM1248 224q66 0 113 47t47 113t-47 113t-113 47t-113 -47t-47 -113t47 -113t113 -47zM1408 768v512h-576v-512h576z" />
+    <glyph glyph-name="_535" unicode="&#xf23a;" horiz-adv-x="1792" 
+d="M597 1115v-1173q0 -25 -12.5 -42.5t-36.5 -17.5q-17 0 -33 8l-465 233q-21 10 -35.5 33.5t-14.5 46.5v1140q0 20 10 34t29 14q14 0 44 -15l511 -256q3 -3 3 -5zM661 1014l534 -866l-534 266v600zM1792 996v-1054q0 -25 -14 -40.5t-38 -15.5t-47 13l-441 220zM1789 1116
+q0 -3 -256.5 -419.5t-300.5 -487.5l-390 634l324 527q17 28 52 28q14 0 26 -6l541 -270q4 -2 4 -6z" />
+    <glyph glyph-name="_536" unicode="&#xf23b;" 
+d="M809 532l266 499h-112l-157 -312q-24 -48 -44 -92l-42 92l-155 312h-120l263 -493v-324h101v318zM1536 1408v-1536h-1536v1536h1536z" />
+    <glyph glyph-name="_537" unicode="&#xf23c;" horiz-adv-x="2296" 
+d="M478 -139q-8 -16 -27 -34.5t-37 -25.5q-25 -9 -51.5 3.5t-28.5 31.5q-1 22 40 55t68 38q23 4 34 -21.5t2 -46.5zM1819 -139q7 -16 26 -34.5t38 -25.5q25 -9 51.5 3.5t27.5 31.5q2 22 -39.5 55t-68.5 38q-22 4 -33 -21.5t-2 -46.5zM1867 -30q13 -27 56.5 -59.5t77.5 -41.5
+q45 -13 82 4.5t37 50.5q0 46 -67.5 100.5t-115.5 59.5q-40 5 -63.5 -37.5t-6.5 -76.5zM428 -30q-13 -27 -56 -59.5t-77 -41.5q-45 -13 -82 4.5t-37 50.5q0 46 67.5 100.5t115.5 59.5q40 5 63 -37.5t6 -76.5zM1158 1094h1q-41 0 -76 -15q27 -8 44 -30.5t17 -49.5
+q0 -35 -27 -60t-65 -25q-52 0 -80 43q-5 -23 -5 -42q0 -74 56 -126.5t135 -52.5q80 0 136 52.5t56 126.5t-56 126.5t-136 52.5zM1462 1312q-99 109 -220.5 131.5t-245.5 -44.5q27 60 82.5 96.5t118 39.5t121.5 -17t99.5 -74.5t44.5 -131.5zM2212 73q8 -11 -11 -42
+q7 -23 7 -40q1 -56 -44.5 -112.5t-109.5 -91.5t-118 -37q-48 -2 -92 21.5t-66 65.5q-687 -25 -1259 0q-23 -41 -66.5 -65t-92.5 -22q-86 3 -179.5 80.5t-92.5 160.5q2 22 7 40q-19 31 -11 42q6 10 31 1q14 22 41 51q-7 29 2 38q11 10 39 -4q29 20 59 34q0 29 13 37
+q23 12 51 -16q35 5 61 -2q18 -4 38 -19v73q-11 0 -18 2q-53 10 -97 44.5t-55 87.5q-9 38 0 81q15 62 93 95q2 17 19 35.5t36 23.5t33 -7.5t19 -30.5h13q46 -5 60 -23q3 -3 5 -7q10 1 30.5 3.5t30.5 3.5q-15 11 -30 17q-23 40 -91 43q0 6 1 10q-62 2 -118.5 18.5t-84.5 47.5
+q-32 36 -42.5 92t-2.5 112q16 126 90 179q23 16 52 4.5t32 -40.5q0 -1 1.5 -14t2.5 -21t3 -20t5.5 -19t8.5 -10q27 -14 76 -12q48 46 98 74q-40 4 -162 -14l47 46q61 58 163 111q145 73 282 86q-20 8 -41 15.5t-47 14t-42.5 10.5t-47.5 11t-43 10q595 126 904 -139
+q98 -84 158 -222q85 -10 121 9h1q5 3 8.5 10t5.5 19t3 19.5t3 21.5l1 14q3 28 32 40t52 -5q73 -52 91 -178q7 -57 -3.5 -113t-42.5 -91q-28 -32 -83.5 -48.5t-115.5 -18.5v-10q-71 -2 -95 -43q-14 -5 -31 -17q11 -1 32 -3.5t30 -3.5q1 5 5 8q16 18 60 23h13q5 18 19 30t33 8
+t36 -23t19 -36q79 -32 93 -95q9 -40 1 -81q-12 -53 -56 -88t-97 -44q-10 -2 -17 -2q0 -49 -1 -73q20 15 38 19q26 7 61 2q28 28 51 16q14 -9 14 -37q33 -16 59 -34q27 13 38 4q10 -10 2 -38q28 -30 41 -51q23 8 31 -1zM1937 1025q0 -29 -9 -54q82 -32 112 -132
+q4 37 -9.5 98.5t-41.5 90.5q-20 19 -36 17t-16 -20zM1859 925q35 -42 47.5 -108.5t-0.5 -124.5q67 13 97 45q13 14 18 28q-3 64 -31 114.5t-79 66.5q-15 -15 -52 -21zM1822 921q-30 0 -44 1q42 -115 53 -239q21 0 43 3q16 68 1 135t-53 100zM258 839q30 100 112 132
+q-9 25 -9 54q0 18 -16.5 20t-35.5 -17q-28 -29 -41.5 -90.5t-9.5 -98.5zM294 737q29 -31 97 -45q-13 58 -0.5 124.5t47.5 108.5v0q-37 6 -52 21q-51 -16 -78.5 -66t-31.5 -115q9 -17 18 -28zM471 683q14 124 73 235q-19 -4 -55 -18l-45 -19v1q-46 -89 -20 -196q25 -3 47 -3z
+M1434 644q8 -38 16.5 -108.5t11.5 -89.5q3 -18 9.5 -21.5t23.5 4.5q40 20 62 85.5t23 125.5q-24 2 -146 4zM1152 1285q-116 0 -199 -82.5t-83 -198.5q0 -117 83 -199.5t199 -82.5t199 82.5t83 199.5q0 116 -83 198.5t-199 82.5zM1380 646q-105 2 -211 0v1q-1 -27 2.5 -86
+t13.5 -66q29 -14 93.5 -14.5t95.5 10.5q9 3 11 39t-0.5 69.5t-4.5 46.5zM1112 447q8 4 9.5 48t-0.5 88t-4 63v1q-212 -3 -214 -3q-4 -20 -7 -62t0 -83t14 -46q34 -15 101 -16t101 10zM718 636q-16 -59 4.5 -118.5t77.5 -84.5q15 -8 24 -5t12 21q3 16 8 90t10 103
+q-69 -2 -136 -6zM591 510q3 -23 -34 -36q132 -141 271.5 -240t305.5 -154q172 49 310.5 146t293.5 250q-33 13 -30 34q0 2 0.5 3.5t1.5 3t1 2.5v1v-1q-17 2 -50 5.5t-48 4.5q-26 -90 -82 -132q-51 -38 -82 1q-5 6 -9 14q-7 13 -17 62q-2 -5 -5 -9t-7.5 -7t-8 -5.5t-9.5 -4
+l-10 -2.5t-12 -2l-12 -1.5t-13.5 -1t-13.5 -0.5q-106 -9 -163 11q-4 -17 -10 -26.5t-21 -15t-23 -7t-36 -3.5q-6 -1 -9 -1q-179 -17 -203 40q-2 -63 -56 -54q-47 8 -91 54q-12 13 -20 26q-17 29 -26 65q-58 -6 -87 -10q1 -2 4 -10zM507 -118q3 14 3 30q-17 71 -51 130
+t-73 70q-41 12 -101.5 -14.5t-104.5 -80t-39 -107.5q35 -53 100 -93t119 -42q51 -2 94 28t53 79zM510 53q23 -63 27 -119q195 113 392 174q-98 52 -180.5 120t-179.5 165q-6 -4 -29 -13q0 -1 -1 -4t-1 -5q31 -18 22 -37q-12 -23 -56 -34q-10 -13 -29 -24h-1q-2 -83 1 -150
+q19 -34 35 -73zM579 -113q532 -21 1145 0q-254 147 -428 196q-76 -35 -156 -57q-8 -3 -16 0q-65 21 -129 49q-208 -60 -416 -188h-1v-1q1 0 1 1zM1763 -67q4 54 28 120q14 38 33 71l-1 -1q3 77 3 153q-15 8 -30 25q-42 9 -56 33q-9 20 22 38q-2 4 -2 9q-16 4 -28 12
+q-204 -190 -383 -284q198 -59 414 -176zM2155 -90q5 54 -39 107.5t-104 80t-102 14.5q-38 -11 -72.5 -70.5t-51.5 -129.5q0 -16 3 -30q10 -49 53 -79t94 -28q54 2 119 42t100 93z" />
+    <glyph glyph-name="_538" unicode="&#xf23d;" horiz-adv-x="2304" 
+d="M1524 -25q0 -68 -48 -116t-116 -48t-116.5 48t-48.5 116t48.5 116.5t116.5 48.5t116 -48.5t48 -116.5zM775 -25q0 -68 -48.5 -116t-116.5 -48t-116 48t-48 116t48 116.5t116 48.5t116.5 -48.5t48.5 -116.5zM0 1469q57 -60 110.5 -104.5t121 -82t136 -63t166 -45.5
+t200 -31.5t250 -18.5t304 -9.5t372.5 -2.5q139 0 244.5 -5t181 -16.5t124 -27.5t71 -39.5t24 -51.5t-19.5 -64t-56.5 -76.5t-89.5 -91t-116 -104.5t-139 -119q-185 -157 -286 -247q29 51 76.5 109t94 105.5t94.5 98.5t83 91.5t54 80.5t13 70t-45.5 55.5t-116.5 41t-204 23.5
+t-304 5q-168 -2 -314 6t-256 23t-204.5 41t-159.5 51.5t-122.5 62.5t-91.5 66.5t-68 71.5t-50.5 69.5t-40 68t-36.5 59.5z" />
+    <glyph glyph-name="_539" unicode="&#xf23e;" horiz-adv-x="1792" 
+d="M896 1472q-169 0 -323 -66t-265.5 -177.5t-177.5 -265.5t-66 -323t66 -323t177.5 -265.5t265.5 -177.5t323 -66t323 66t265.5 177.5t177.5 265.5t66 323t-66 323t-177.5 265.5t-265.5 177.5t-323 66zM896 1536q182 0 348 -71t286 -191t191 -286t71 -348t-71 -348
+t-191 -286t-286 -191t-348 -71t-348 71t-286 191t-191 286t-71 348t71 348t191 286t286 191t348 71zM496 704q16 0 16 -16v-480q0 -16 -16 -16h-32q-16 0 -16 16v480q0 16 16 16h32zM896 640q53 0 90.5 -37.5t37.5 -90.5q0 -35 -17.5 -64t-46.5 -46v-114q0 -14 -9 -23
+t-23 -9h-64q-14 0 -23 9t-9 23v114q-29 17 -46.5 46t-17.5 64q0 53 37.5 90.5t90.5 37.5zM896 1408q209 0 385.5 -103t279.5 -279.5t103 -385.5t-103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103zM544 928v-96
+q0 -14 9 -23t23 -9h64q14 0 23 9t9 23v96q0 93 65.5 158.5t158.5 65.5t158.5 -65.5t65.5 -158.5v-96q0 -14 9 -23t23 -9h64q14 0 23 9t9 23v96q0 146 -103 249t-249 103t-249 -103t-103 -249zM1408 192v512q0 26 -19 45t-45 19h-896q-26 0 -45 -19t-19 -45v-512
+q0 -26 19 -45t45 -19h896q26 0 45 19t19 45z" />
+    <glyph glyph-name="_540" unicode="&#xf240;" horiz-adv-x="2304" 
+d="M1920 1024v-768h-1664v768h1664zM2048 448h128v384h-128v288q0 14 -9 23t-23 9h-1856q-14 0 -23 -9t-9 -23v-960q0 -14 9 -23t23 -9h1856q14 0 23 9t9 23v288zM2304 832v-384q0 -53 -37.5 -90.5t-90.5 -37.5v-160q0 -66 -47 -113t-113 -47h-1856q-66 0 -113 47t-47 113
+v960q0 66 47 113t113 47h1856q66 0 113 -47t47 -113v-160q53 0 90.5 -37.5t37.5 -90.5z" />
+    <glyph glyph-name="_541" unicode="&#xf241;" horiz-adv-x="2304" 
+d="M256 256v768h1280v-768h-1280zM2176 960q53 0 90.5 -37.5t37.5 -90.5v-384q0 -53 -37.5 -90.5t-90.5 -37.5v-160q0 -66 -47 -113t-113 -47h-1856q-66 0 -113 47t-47 113v960q0 66 47 113t113 47h1856q66 0 113 -47t47 -113v-160zM2176 448v384h-128v288q0 14 -9 23t-23 9
+h-1856q-14 0 -23 -9t-9 -23v-960q0 -14 9 -23t23 -9h1856q14 0 23 9t9 23v288h128z" />
+    <glyph glyph-name="_542" unicode="&#xf242;" horiz-adv-x="2304" 
+d="M256 256v768h896v-768h-896zM2176 960q53 0 90.5 -37.5t37.5 -90.5v-384q0 -53 -37.5 -90.5t-90.5 -37.5v-160q0 -66 -47 -113t-113 -47h-1856q-66 0 -113 47t-47 113v960q0 66 47 113t113 47h1856q66 0 113 -47t47 -113v-160zM2176 448v384h-128v288q0 14 -9 23t-23 9
+h-1856q-14 0 -23 -9t-9 -23v-960q0 -14 9 -23t23 -9h1856q14 0 23 9t9 23v288h128z" />
+    <glyph glyph-name="_543" unicode="&#xf243;" horiz-adv-x="2304" 
+d="M256 256v768h512v-768h-512zM2176 960q53 0 90.5 -37.5t37.5 -90.5v-384q0 -53 -37.5 -90.5t-90.5 -37.5v-160q0 -66 -47 -113t-113 -47h-1856q-66 0 -113 47t-47 113v960q0 66 47 113t113 47h1856q66 0 113 -47t47 -113v-160zM2176 448v384h-128v288q0 14 -9 23t-23 9
+h-1856q-14 0 -23 -9t-9 -23v-960q0 -14 9 -23t23 -9h1856q14 0 23 9t9 23v288h128z" />
+    <glyph glyph-name="_544" unicode="&#xf244;" horiz-adv-x="2304" 
+d="M2176 960q53 0 90.5 -37.5t37.5 -90.5v-384q0 -53 -37.5 -90.5t-90.5 -37.5v-160q0 -66 -47 -113t-113 -47h-1856q-66 0 -113 47t-47 113v960q0 66 47 113t113 47h1856q66 0 113 -47t47 -113v-160zM2176 448v384h-128v288q0 14 -9 23t-23 9h-1856q-14 0 -23 -9t-9 -23
+v-960q0 -14 9 -23t23 -9h1856q14 0 23 9t9 23v288h128z" />
+    <glyph glyph-name="_545" unicode="&#xf245;" horiz-adv-x="1280" 
+d="M1133 493q31 -30 14 -69q-17 -40 -59 -40h-382l201 -476q10 -25 0 -49t-34 -35l-177 -75q-25 -10 -49 0t-35 34l-191 452l-312 -312q-19 -19 -45 -19q-12 0 -24 5q-40 17 -40 59v1504q0 42 40 59q12 5 24 5q27 0 45 -19z" />
+    <glyph glyph-name="_546" unicode="&#xf246;" horiz-adv-x="1024" 
+d="M832 1408q-320 0 -320 -224v-416h128v-128h-128v-544q0 -224 320 -224h64v-128h-64q-272 0 -384 146q-112 -146 -384 -146h-64v128h64q320 0 320 224v544h-128v128h128v416q0 224 -320 224h-64v128h64q272 0 384 -146q112 146 384 146h64v-128h-64z" />
+    <glyph glyph-name="_547" unicode="&#xf247;" horiz-adv-x="2048" 
+d="M2048 1152h-128v-1024h128v-384h-384v128h-1280v-128h-384v384h128v1024h-128v384h384v-128h1280v128h384v-384zM1792 1408v-128h128v128h-128zM128 1408v-128h128v128h-128zM256 -128v128h-128v-128h128zM1664 0v128h128v1024h-128v128h-1280v-128h-128v-1024h128v-128
+h1280zM1920 -128v128h-128v-128h128zM1280 896h384v-768h-896v256h-384v768h896v-256zM512 512h640v512h-640v-512zM1536 256v512h-256v-384h-384v-128h640z" />
+    <glyph glyph-name="_548" unicode="&#xf248;" horiz-adv-x="2304" 
+d="M2304 768h-128v-640h128v-384h-384v128h-896v-128h-384v384h128v128h-384v-128h-384v384h128v640h-128v384h384v-128h896v128h384v-384h-128v-128h384v128h384v-384zM2048 1024v-128h128v128h-128zM1408 1408v-128h128v128h-128zM128 1408v-128h128v128h-128zM256 256
+v128h-128v-128h128zM1536 384h-128v-128h128v128zM384 384h896v128h128v640h-128v128h-896v-128h-128v-640h128v-128zM896 -128v128h-128v-128h128zM2176 -128v128h-128v-128h128zM2048 128v640h-128v128h-384v-384h128v-384h-384v128h-384v-128h128v-128h896v128h128z" />
+    <glyph glyph-name="_549" unicode="&#xf249;" 
+d="M1024 288v-416h-928q-40 0 -68 28t-28 68v1344q0 40 28 68t68 28h1344q40 0 68 -28t28 -68v-928h-416q-40 0 -68 -28t-28 -68zM1152 256h381q-15 -82 -65 -132l-184 -184q-50 -50 -132 -65v381z" />
+    <glyph glyph-name="_550" unicode="&#xf24a;" 
+d="M1400 256h-248v-248q29 10 41 22l185 185q12 12 22 41zM1120 384h288v896h-1280v-1280h896v288q0 40 28 68t68 28zM1536 1312v-1024q0 -40 -20 -88t-48 -76l-184 -184q-28 -28 -76 -48t-88 -20h-1024q-40 0 -68 28t-28 68v1344q0 40 28 68t68 28h1344q40 0 68 -28t28 -68
+z" />
+    <glyph glyph-name="_551" unicode="&#xf24b;" horiz-adv-x="2304" 
+d="M1951 538q0 -26 -15.5 -44.5t-38.5 -23.5q-8 -2 -18 -2h-153v140h153q10 0 18 -2q23 -5 38.5 -23.5t15.5 -44.5zM1933 751q0 -25 -15 -42t-38 -21q-3 -1 -15 -1h-139v129h139q3 0 8.5 -0.5t6.5 -0.5q23 -4 38 -21.5t15 -42.5zM728 587v308h-228v-308q0 -58 -38 -94.5
+t-105 -36.5q-108 0 -229 59v-112q53 -15 121 -23t109 -9l42 -1q328 0 328 217zM1442 403v113q-99 -52 -200 -59q-108 -8 -169 41t-61 142t61 142t169 41q101 -7 200 -58v112q-48 12 -100 19.5t-80 9.5l-28 2q-127 6 -218.5 -14t-140.5 -60t-71 -88t-22 -106t22 -106t71 -88
+t140.5 -60t218.5 -14q101 4 208 31zM2176 518q0 54 -43 88.5t-109 39.5v3q57 8 89 41.5t32 79.5q0 55 -41 88t-107 36q-3 0 -12 0.5t-14 0.5h-455v-510h491q74 0 121.5 36.5t47.5 96.5zM2304 1280v-1280q0 -52 -38 -90t-90 -38h-2048q-52 0 -90 38t-38 90v1280q0 52 38 90
+t90 38h2048q52 0 90 -38t38 -90z" />
+    <glyph glyph-name="_552" unicode="&#xf24c;" horiz-adv-x="2304" 
+d="M858 295v693q-106 -41 -172 -135.5t-66 -211.5t66 -211.5t172 -134.5zM1362 641q0 117 -66 211.5t-172 135.5v-694q106 41 172 135.5t66 211.5zM1577 641q0 -159 -78.5 -294t-213.5 -213.5t-294 -78.5q-119 0 -227.5 46.5t-187 125t-125 187t-46.5 227.5q0 159 78.5 294
+t213.5 213.5t294 78.5t294 -78.5t213.5 -213.5t78.5 -294zM1960 634q0 139 -55.5 261.5t-147.5 205.5t-213.5 131t-252.5 48h-301q-176 0 -323.5 -81t-235 -230t-87.5 -335q0 -171 87 -317.5t236 -231.5t323 -85h301q129 0 251.5 50.5t214.5 135t147.5 202.5t55.5 246z
+M2304 1280v-1280q0 -52 -38 -90t-90 -38h-2048q-52 0 -90 38t-38 90v1280q0 52 38 90t90 38h2048q52 0 90 -38t38 -90z" />
+    <glyph glyph-name="_553" unicode="&#xf24d;" horiz-adv-x="1792" 
+d="M1664 -96v1088q0 13 -9.5 22.5t-22.5 9.5h-1088q-13 0 -22.5 -9.5t-9.5 -22.5v-1088q0 -13 9.5 -22.5t22.5 -9.5h1088q13 0 22.5 9.5t9.5 22.5zM1792 992v-1088q0 -66 -47 -113t-113 -47h-1088q-66 0 -113 47t-47 113v1088q0 66 47 113t113 47h1088q66 0 113 -47t47 -113
+zM1408 1376v-160h-128v160q0 13 -9.5 22.5t-22.5 9.5h-1088q-13 0 -22.5 -9.5t-9.5 -22.5v-1088q0 -13 9.5 -22.5t22.5 -9.5h160v-128h-160q-66 0 -113 47t-47 113v1088q0 66 47 113t113 47h1088q66 0 113 -47t47 -113z" />
+    <glyph glyph-name="_554" unicode="&#xf24e;" horiz-adv-x="2304" 
+d="M1728 1088l-384 -704h768zM448 1088l-384 -704h768zM1269 1280q-14 -40 -45.5 -71.5t-71.5 -45.5v-1291h608q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-1344q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h608v1291q-40 14 -71.5 45.5t-45.5 71.5h-491q-14 0 -23 9t-9 23v64
+q0 14 9 23t23 9h491q21 57 70 92.5t111 35.5t111 -35.5t70 -92.5h491q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-491zM1088 1264q33 0 56.5 23.5t23.5 56.5t-23.5 56.5t-56.5 23.5t-56.5 -23.5t-23.5 -56.5t23.5 -56.5t56.5 -23.5zM2176 384q0 -73 -46.5 -131t-117.5 -91
+t-144.5 -49.5t-139.5 -16.5t-139.5 16.5t-144.5 49.5t-117.5 91t-46.5 131q0 11 35 81t92 174.5t107 195.5t102 184t56 100q18 33 56 33t56 -33q4 -7 56 -100t102 -184t107 -195.5t92 -174.5t35 -81zM896 384q0 -73 -46.5 -131t-117.5 -91t-144.5 -49.5t-139.5 -16.5
+t-139.5 16.5t-144.5 49.5t-117.5 91t-46.5 131q0 11 35 81t92 174.5t107 195.5t102 184t56 100q18 33 56 33t56 -33q4 -7 56 -100t102 -184t107 -195.5t92 -174.5t35 -81z" />
+    <glyph glyph-name="_555" unicode="&#xf250;" 
+d="M1408 1408q0 -261 -106.5 -461.5t-266.5 -306.5q160 -106 266.5 -306.5t106.5 -461.5h96q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-1472q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h96q0 261 106.5 461.5t266.5 306.5q-160 106 -266.5 306.5t-106.5 461.5h-96q-14 0 -23 9
+t-9 23v64q0 14 9 23t23 9h1472q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-96zM874 700q77 29 149 92.5t129.5 152.5t92.5 210t35 253h-1024q0 -132 35 -253t92.5 -210t129.5 -152.5t149 -92.5q19 -7 30.5 -23.5t11.5 -36.5t-11.5 -36.5t-30.5 -23.5q-77 -29 -149 -92.5
+t-129.5 -152.5t-92.5 -210t-35 -253h1024q0 132 -35 253t-92.5 210t-129.5 152.5t-149 92.5q-19 7 -30.5 23.5t-11.5 36.5t11.5 36.5t30.5 23.5z" />
+    <glyph glyph-name="_556" unicode="&#xf251;" 
+d="M1408 1408q0 -261 -106.5 -461.5t-266.5 -306.5q160 -106 266.5 -306.5t106.5 -461.5h96q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-1472q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h96q0 261 106.5 461.5t266.5 306.5q-160 106 -266.5 306.5t-106.5 461.5h-96q-14 0 -23 9
+t-9 23v64q0 14 9 23t23 9h1472q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-96zM1280 1408h-1024q0 -66 9 -128h1006q9 61 9 128zM1280 -128q0 130 -34 249.5t-90.5 208t-126.5 152t-146 94.5h-230q-76 -31 -146 -94.5t-126.5 -152t-90.5 -208t-34 -249.5h1024z" />
+    <glyph glyph-name="_557" unicode="&#xf252;" 
+d="M1408 1408q0 -261 -106.5 -461.5t-266.5 -306.5q160 -106 266.5 -306.5t106.5 -461.5h96q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-1472q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h96q0 261 106.5 461.5t266.5 306.5q-160 106 -266.5 306.5t-106.5 461.5h-96q-14 0 -23 9
+t-9 23v64q0 14 9 23t23 9h1472q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-96zM1280 1408h-1024q0 -206 85 -384h854q85 178 85 384zM1223 192q-54 141 -145.5 241.5t-194.5 142.5h-230q-103 -42 -194.5 -142.5t-145.5 -241.5h910z" />
+    <glyph glyph-name="_558" unicode="&#xf253;" 
+d="M1408 1408q0 -261 -106.5 -461.5t-266.5 -306.5q160 -106 266.5 -306.5t106.5 -461.5h96q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-1472q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h96q0 261 106.5 461.5t266.5 306.5q-160 106 -266.5 306.5t-106.5 461.5h-96q-14 0 -23 9
+t-9 23v64q0 14 9 23t23 9h1472q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-96zM874 700q77 29 149 92.5t129.5 152.5t92.5 210t35 253h-1024q0 -132 35 -253t92.5 -210t129.5 -152.5t149 -92.5q19 -7 30.5 -23.5t11.5 -36.5t-11.5 -36.5t-30.5 -23.5q-137 -51 -244 -196
+h700q-107 145 -244 196q-19 7 -30.5 23.5t-11.5 36.5t11.5 36.5t30.5 23.5z" />
+    <glyph glyph-name="_559" unicode="&#xf254;" 
+d="M1504 -64q14 0 23 -9t9 -23v-128q0 -14 -9 -23t-23 -9h-1472q-14 0 -23 9t-9 23v128q0 14 9 23t23 9h1472zM130 0q3 55 16 107t30 95t46 87t53.5 76t64.5 69.5t66 60t70.5 55t66.5 47.5t65 43q-43 28 -65 43t-66.5 47.5t-70.5 55t-66 60t-64.5 69.5t-53.5 76t-46 87
+t-30 95t-16 107h1276q-3 -55 -16 -107t-30 -95t-46 -87t-53.5 -76t-64.5 -69.5t-66 -60t-70.5 -55t-66.5 -47.5t-65 -43q43 -28 65 -43t66.5 -47.5t70.5 -55t66 -60t64.5 -69.5t53.5 -76t46 -87t30 -95t16 -107h-1276zM1504 1536q14 0 23 -9t9 -23v-128q0 -14 -9 -23t-23 -9
+h-1472q-14 0 -23 9t-9 23v128q0 14 9 23t23 9h1472z" />
+    <glyph glyph-name="_560" unicode="&#xf255;" 
+d="M768 1152q-53 0 -90.5 -37.5t-37.5 -90.5v-128h-32v93q0 48 -32 81.5t-80 33.5q-46 0 -79 -33t-33 -79v-429l-32 30v172q0 48 -32 81.5t-80 33.5q-46 0 -79 -33t-33 -79v-224q0 -47 35 -82l310 -296q39 -39 39 -102q0 -26 19 -45t45 -19h640q26 0 45 19t19 45v25
+q0 41 10 77l108 436q10 36 10 77v246q0 48 -32 81.5t-80 33.5q-46 0 -79 -33t-33 -79v-32h-32v125q0 40 -25 72.5t-64 40.5q-14 2 -23 2q-46 0 -79 -33t-33 -79v-128h-32v122q0 51 -32.5 89.5t-82.5 43.5q-5 1 -13 1zM768 1280q84 0 149 -50q57 34 123 34q59 0 111 -27
+t86 -76q27 7 59 7q100 0 170 -71.5t70 -171.5v-246q0 -51 -13 -108l-109 -436q-6 -24 -6 -71q0 -80 -56 -136t-136 -56h-640q-84 0 -138 58.5t-54 142.5l-308 296q-76 73 -76 175v224q0 99 70.5 169.5t169.5 70.5q11 0 16 -1q6 95 75.5 160t164.5 65q52 0 98 -21
+q72 69 174 69z" />
+    <glyph glyph-name="_561" unicode="&#xf256;" horiz-adv-x="1792" 
+d="M880 1408q-46 0 -79 -33t-33 -79v-656h-32v528q0 46 -33 79t-79 33t-79 -33t-33 -79v-528v-256l-154 205q-38 51 -102 51q-53 0 -90.5 -37.5t-37.5 -90.5q0 -43 26 -77l384 -512q38 -51 102 -51h688q34 0 61 22t34 56l76 405q5 32 5 59v498q0 46 -33 79t-79 33t-79 -33
+t-33 -79v-272h-32v528q0 46 -33 79t-79 33t-79 -33t-33 -79v-528h-32v656q0 46 -33 79t-79 33zM880 1536q68 0 125.5 -35.5t88.5 -96.5q19 4 42 4q99 0 169.5 -70.5t70.5 -169.5v-17q105 6 180.5 -64t75.5 -175v-498q0 -40 -8 -83l-76 -404q-14 -79 -76.5 -131t-143.5 -52
+h-688q-60 0 -114.5 27.5t-90.5 74.5l-384 512q-51 68 -51 154q0 106 75 181t181 75q78 0 128 -34v434q0 99 70.5 169.5t169.5 70.5q23 0 42 -4q31 61 88.5 96.5t125.5 35.5z" />
+    <glyph glyph-name="_562" unicode="&#xf257;" horiz-adv-x="1792" 
+d="M1073 -128h-177q-163 0 -226 141q-23 49 -23 102v5q-62 30 -98.5 88.5t-36.5 127.5q0 38 5 48h-261q-106 0 -181 75t-75 181t75 181t181 75h113l-44 17q-74 28 -119.5 93.5t-45.5 145.5q0 106 75 181t181 75q46 0 91 -17l628 -239h401q106 0 181 -75t75 -181v-668
+q0 -88 -54 -157.5t-140 -90.5l-339 -85q-92 -23 -186 -23zM1024 583l-155 -71l-163 -74q-30 -14 -48 -41.5t-18 -60.5q0 -46 33 -79t79 -33q26 0 46 10l338 154q-49 10 -80.5 50t-31.5 90v55zM1344 272q0 46 -33 79t-79 33q-26 0 -46 -10l-290 -132q-28 -13 -37 -17
+t-30.5 -17t-29.5 -23.5t-16 -29t-8 -40.5q0 -50 31.5 -82t81.5 -32q20 0 38 9l352 160q30 14 48 41.5t18 60.5zM1112 1024l-650 248q-24 8 -46 8q-53 0 -90.5 -37.5t-37.5 -90.5q0 -40 22.5 -73t59.5 -47l526 -200v-64h-640q-53 0 -90.5 -37.5t-37.5 -90.5t37.5 -90.5
+t90.5 -37.5h535l233 106v198q0 63 46 106l111 102h-69zM1073 0q82 0 155 19l339 85q43 11 70 45.5t27 78.5v668q0 53 -37.5 90.5t-90.5 37.5h-308l-136 -126q-36 -33 -36 -82v-296q0 -46 33 -77t79 -31t79 35t33 81v208h32v-208q0 -70 -57 -114q52 -8 86.5 -48.5t34.5 -93.5
+q0 -42 -23 -78t-61 -53l-310 -141h91z" />
+    <glyph glyph-name="_563" unicode="&#xf258;" horiz-adv-x="2048" 
+d="M1151 1536q61 0 116 -28t91 -77l572 -781q118 -159 118 -359v-355q0 -80 -56 -136t-136 -56h-384q-80 0 -136 56t-56 136v177l-286 143h-546q-80 0 -136 56t-56 136v32q0 119 84.5 203.5t203.5 84.5h420l42 128h-686q-100 0 -173.5 67.5t-81.5 166.5q-65 79 -65 182v32
+q0 80 56 136t136 56h959zM1920 -64v355q0 157 -93 284l-573 781q-39 52 -103 52h-959q-26 0 -45 -19t-19 -45q0 -32 1.5 -49.5t9.5 -40.5t25 -43q10 31 35.5 50t56.5 19h832v-32h-832q-26 0 -45 -19t-19 -45q0 -44 3 -58q8 -44 44 -73t81 -29h640h91q40 0 68 -28t28 -68
+q0 -15 -5 -30l-64 -192q-10 -29 -35 -47.5t-56 -18.5h-443q-66 0 -113 -47t-47 -113v-32q0 -26 19 -45t45 -19h561q16 0 29 -7l317 -158q24 -13 38.5 -36t14.5 -50v-197q0 -26 19 -45t45 -19h384q26 0 45 19t19 45z" />
+    <glyph glyph-name="_564" unicode="&#xf259;" horiz-adv-x="2048" 
+d="M459 -256q-77 0 -137.5 47.5t-79.5 122.5l-101 401q-13 57 -13 108q0 45 -5 67l-116 477q-7 27 -7 57q0 93 62 161t155 78q17 85 82.5 139t152.5 54q83 0 148 -51.5t85 -132.5l83 -348l103 428q20 81 85 132.5t148 51.5q89 0 155.5 -57.5t80.5 -144.5q92 -10 152 -79
+t60 -162q0 -24 -7 -59l-123 -512q10 7 37.5 28.5t38.5 29.5t35 23t41 20.5t41.5 11t49.5 5.5q105 0 180 -74t75 -179q0 -62 -28.5 -118t-78.5 -94l-507 -380q-68 -51 -153 -51h-694zM1104 1408q-38 0 -68.5 -24t-39.5 -62l-164 -682h-127l-145 602q-9 38 -39.5 62t-68.5 24
+q-48 0 -80 -33t-32 -80q0 -15 3 -28l132 -547h-26l-99 408q-9 37 -40 62.5t-69 25.5q-47 0 -80 -33t-33 -79q0 -14 3 -26l116 -478q7 -28 9 -86t10 -88l100 -401q8 -32 34 -52.5t59 -20.5h694q42 0 76 26l507 379q56 43 56 110q0 52 -37.5 88.5t-89.5 36.5q-43 0 -77 -26
+l-307 -230v227q0 4 32 138t68 282t39 161q4 18 4 29q0 47 -32 81t-79 34q-39 0 -69.5 -24t-39.5 -62l-116 -482h-26l150 624q3 14 3 28q0 48 -31.5 82t-79.5 34z" />
+    <glyph glyph-name="_565" unicode="&#xf25a;" horiz-adv-x="1792" 
+d="M640 1408q-53 0 -90.5 -37.5t-37.5 -90.5v-512v-384l-151 202q-41 54 -107 54q-52 0 -89 -38t-37 -90q0 -43 26 -77l384 -512q38 -51 102 -51h718q22 0 39.5 13.5t22.5 34.5l92 368q24 96 24 194v217q0 41 -28 71t-68 30t-68 -28t-28 -68h-32v61q0 48 -32 81.5t-80 33.5
+q-46 0 -79 -33t-33 -79v-64h-32v90q0 55 -37 94.5t-91 39.5q-53 0 -90.5 -37.5t-37.5 -90.5v-96h-32v570q0 55 -37 94.5t-91 39.5zM640 1536q107 0 181.5 -77.5t74.5 -184.5v-220q22 2 32 2q99 0 173 -69q47 21 99 21q113 0 184 -87q27 7 56 7q94 0 159 -67.5t65 -161.5
+v-217q0 -116 -28 -225l-92 -368q-16 -64 -68 -104.5t-118 -40.5h-718q-60 0 -114.5 27.5t-90.5 74.5l-384 512q-51 68 -51 154q0 105 74.5 180.5t179.5 75.5q71 0 130 -35v547q0 106 75 181t181 75zM768 128v384h-32v-384h32zM1024 128v384h-32v-384h32zM1280 128v384h-32
+v-384h32z" />
+    <glyph glyph-name="_566" unicode="&#xf25b;" 
+d="M1288 889q60 0 107 -23q141 -63 141 -226v-177q0 -94 -23 -186l-85 -339q-21 -86 -90.5 -140t-157.5 -54h-668q-106 0 -181 75t-75 181v401l-239 628q-17 45 -17 91q0 106 75 181t181 75q80 0 145.5 -45.5t93.5 -119.5l17 -44v113q0 106 75 181t181 75t181 -75t75 -181
+v-261q27 5 48 5q69 0 127.5 -36.5t88.5 -98.5zM1072 896q-33 0 -60.5 -18t-41.5 -48l-74 -163l-71 -155h55q50 0 90 -31.5t50 -80.5l154 338q10 20 10 46q0 46 -33 79t-79 33zM1293 761q-22 0 -40.5 -8t-29 -16t-23.5 -29.5t-17 -30.5t-17 -37l-132 -290q-10 -20 -10 -46
+q0 -46 33 -79t79 -33q33 0 60.5 18t41.5 48l160 352q9 18 9 38q0 50 -32 81.5t-82 31.5zM128 1120q0 -22 8 -46l248 -650v-69l102 111q43 46 106 46h198l106 233v535q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5v-640h-64l-200 526q-14 37 -47 59.5t-73 22.5
+q-53 0 -90.5 -37.5t-37.5 -90.5zM1180 -128q44 0 78.5 27t45.5 70l85 339q19 73 19 155v91l-141 -310q-17 -38 -53 -61t-78 -23q-53 0 -93.5 34.5t-48.5 86.5q-44 -57 -114 -57h-208v32h208q46 0 81 33t35 79t-31 79t-77 33h-296q-49 0 -82 -36l-126 -136v-308
+q0 -53 37.5 -90.5t90.5 -37.5h668z" />
+    <glyph glyph-name="_567" unicode="&#xf25c;" horiz-adv-x="1973" 
+d="M857 992v-117q0 -13 -9.5 -22t-22.5 -9h-298v-812q0 -13 -9 -22.5t-22 -9.5h-135q-13 0 -22.5 9t-9.5 23v812h-297q-13 0 -22.5 9t-9.5 22v117q0 14 9 23t23 9h793q13 0 22.5 -9.5t9.5 -22.5zM1895 995l77 -961q1 -13 -8 -24q-10 -10 -23 -10h-134q-12 0 -21 8.5
+t-10 20.5l-46 588l-189 -425q-8 -19 -29 -19h-120q-20 0 -29 19l-188 427l-45 -590q-1 -12 -10 -20.5t-21 -8.5h-135q-13 0 -23 10q-9 10 -9 24l78 961q1 12 10 20.5t21 8.5h142q20 0 29 -19l220 -520q10 -24 20 -51q3 7 9.5 24.5t10.5 26.5l221 520q9 19 29 19h141
+q13 0 22 -8.5t10 -20.5z" />
+    <glyph glyph-name="_568" unicode="&#xf25d;" horiz-adv-x="1792" 
+d="M1042 833q0 88 -60 121q-33 18 -117 18h-123v-281h162q66 0 102 37t36 105zM1094 548l205 -373q8 -17 -1 -31q-8 -16 -27 -16h-152q-20 0 -28 17l-194 365h-155v-350q0 -14 -9 -23t-23 -9h-134q-14 0 -23 9t-9 23v960q0 14 9 23t23 9h294q128 0 190 -24q85 -31 134 -109
+t49 -180q0 -92 -42.5 -165.5t-115.5 -109.5q6 -10 9 -16zM896 1376q-150 0 -286 -58.5t-234.5 -157t-157 -234.5t-58.5 -286t58.5 -286t157 -234.5t234.5 -157t286 -58.5t286 58.5t234.5 157t157 234.5t58.5 286t-58.5 286t-157 234.5t-234.5 157t-286 58.5zM1792 640
+q0 -182 -71 -348t-191 -286t-286 -191t-348 -71t-348 71t-286 191t-191 286t-71 348t71 348t191 286t286 191t348 71t348 -71t286 -191t191 -286t71 -348z" />
+    <glyph glyph-name="_569" unicode="&#xf25e;" horiz-adv-x="1792" 
+d="M605 303q153 0 257 104q14 18 3 36l-45 82q-6 13 -24 17q-16 2 -27 -11l-4 -3q-4 -4 -11.5 -10t-17.5 -13.5t-23.5 -14.5t-28.5 -13t-33.5 -9.5t-37.5 -3.5q-76 0 -125 50t-49 127q0 76 48 125.5t122 49.5q37 0 71.5 -14t50.5 -28l16 -14q11 -11 26 -10q16 2 24 14l53 78
+q13 20 -2 39q-3 4 -11 12t-30 23.5t-48.5 28t-67.5 22.5t-86 10q-148 0 -246 -96.5t-98 -240.5q0 -146 97 -241.5t247 -95.5zM1235 303q153 0 257 104q14 18 4 36l-45 82q-8 14 -25 17q-16 2 -27 -11l-4 -3q-4 -4 -11.5 -10t-17.5 -13.5t-23.5 -14.5t-28.5 -13t-33.5 -9.5
+t-37.5 -3.5q-76 0 -125 50t-49 127q0 76 48 125.5t122 49.5q37 0 71.5 -14t50.5 -28l16 -14q11 -11 26 -10q16 2 24 14l53 78q13 20 -2 39q-3 4 -11 12t-30 23.5t-48.5 28t-67.5 22.5t-86 10q-147 0 -245.5 -96.5t-98.5 -240.5q0 -146 97 -241.5t247 -95.5zM896 1376
+q-150 0 -286 -58.5t-234.5 -157t-157 -234.5t-58.5 -286t58.5 -286t157 -234.5t234.5 -157t286 -58.5t286 58.5t234.5 157t157 234.5t58.5 286t-58.5 286t-157 234.5t-234.5 157t-286 58.5zM896 1536q182 0 348 -71t286 -191t191 -286t71 -348t-71 -348t-191 -286t-286 -191
+t-348 -71t-348 71t-286 191t-191 286t-71 348t71 348t191 286t286 191t348 71z" />
+    <glyph glyph-name="f260" unicode="&#xf260;" horiz-adv-x="2048" 
+d="M736 736l384 -384l-384 -384l-672 672l672 672l168 -168l-96 -96l-72 72l-480 -480l480 -480l193 193l-289 287zM1312 1312l672 -672l-672 -672l-168 168l96 96l72 -72l480 480l-480 480l-193 -193l289 -287l-96 -96l-384 384z" />
+    <glyph glyph-name="f261" unicode="&#xf261;" horiz-adv-x="1792" 
+d="M717 182l271 271l-279 279l-88 -88l192 -191l-96 -96l-279 279l279 279l40 -40l87 87l-127 128l-454 -454zM1075 190l454 454l-454 454l-271 -271l279 -279l88 88l-192 191l96 96l279 -279l-279 -279l-40 40l-87 -88zM1792 640q0 -182 -71 -348t-191 -286t-286 -191
+t-348 -71t-348 71t-286 191t-191 286t-71 348t71 348t191 286t286 191t348 71t348 -71t286 -191t191 -286t71 -348z" />
+    <glyph glyph-name="_572" unicode="&#xf262;" horiz-adv-x="2304" 
+d="M651 539q0 -39 -27.5 -66.5t-65.5 -27.5q-39 0 -66.5 27.5t-27.5 66.5q0 38 27.5 65.5t66.5 27.5q38 0 65.5 -27.5t27.5 -65.5zM1805 540q0 -39 -27.5 -66.5t-66.5 -27.5t-66.5 27.5t-27.5 66.5t27.5 66t66.5 27t66.5 -27t27.5 -66zM765 539q0 79 -56.5 136t-136.5 57
+t-136.5 -56.5t-56.5 -136.5t56.5 -136.5t136.5 -56.5t136.5 56.5t56.5 136.5zM1918 540q0 80 -56.5 136.5t-136.5 56.5q-79 0 -136 -56.5t-57 -136.5t56.5 -136.5t136.5 -56.5t136.5 56.5t56.5 136.5zM850 539q0 -116 -81.5 -197.5t-196.5 -81.5q-116 0 -197.5 82t-81.5 197
+t82 196.5t197 81.5t196.5 -81.5t81.5 -196.5zM2004 540q0 -115 -81.5 -196.5t-197.5 -81.5q-115 0 -196.5 81.5t-81.5 196.5t81.5 196.5t196.5 81.5q116 0 197.5 -81.5t81.5 -196.5zM1040 537q0 191 -135.5 326.5t-326.5 135.5q-125 0 -231 -62t-168 -168.5t-62 -231.5
+t62 -231.5t168 -168.5t231 -62q191 0 326.5 135.5t135.5 326.5zM1708 1110q-254 111 -556 111q-319 0 -573 -110q117 0 223 -45.5t182.5 -122.5t122 -183t45.5 -223q0 115 43.5 219.5t118 180.5t177.5 123t217 50zM2187 537q0 191 -135 326.5t-326 135.5t-326.5 -135.5
+t-135.5 -326.5t135.5 -326.5t326.5 -135.5t326 135.5t135 326.5zM1921 1103h383q-44 -51 -75 -114.5t-40 -114.5q110 -151 110 -337q0 -156 -77 -288t-209 -208.5t-287 -76.5q-133 0 -249 56t-196 155q-47 -56 -129 -179q-11 22 -53.5 82.5t-74.5 97.5
+q-80 -99 -196.5 -155.5t-249.5 -56.5q-155 0 -287 76.5t-209 208.5t-77 288q0 186 110 337q-9 51 -40 114.5t-75 114.5h365q149 100 355 156.5t432 56.5q224 0 421 -56t348 -157z" />
+    <glyph glyph-name="f263" unicode="&#xf263;" horiz-adv-x="1280" 
+d="M640 629q-188 0 -321 133t-133 320q0 188 133 321t321 133t321 -133t133 -321q0 -187 -133 -320t-321 -133zM640 1306q-92 0 -157.5 -65.5t-65.5 -158.5q0 -92 65.5 -157.5t157.5 -65.5t157.5 65.5t65.5 157.5q0 93 -65.5 158.5t-157.5 65.5zM1163 574q13 -27 15 -49.5
+t-4.5 -40.5t-26.5 -38.5t-42.5 -37t-61.5 -41.5q-115 -73 -315 -94l73 -72l267 -267q30 -31 30 -74t-30 -73l-12 -13q-31 -30 -74 -30t-74 30q-67 68 -267 268l-267 -268q-31 -30 -74 -30t-73 30l-12 13q-31 30 -31 73t31 74l267 267l72 72q-203 21 -317 94
+q-39 25 -61.5 41.5t-42.5 37t-26.5 38.5t-4.5 40.5t15 49.5q10 20 28 35t42 22t56 -2t65 -35q5 -4 15 -11t43 -24.5t69 -30.5t92 -24t113 -11q91 0 174 25.5t120 50.5l38 25q33 26 65 35t56 2t42 -22t28 -35z" />
+    <glyph glyph-name="_574" unicode="&#xf264;" 
+d="M927 956q0 -66 -46.5 -112.5t-112.5 -46.5t-112.5 46.5t-46.5 112.5t46.5 112.5t112.5 46.5t112.5 -46.5t46.5 -112.5zM1141 593q-10 20 -28 32t-47.5 9.5t-60.5 -27.5q-10 -8 -29 -20t-81 -32t-127 -20t-124 18t-86 36l-27 18q-31 25 -60.5 27.5t-47.5 -9.5t-28 -32
+q-22 -45 -2 -74.5t87 -73.5q83 -53 226 -67l-51 -52q-142 -142 -191 -190q-22 -22 -22 -52.5t22 -52.5l9 -9q22 -22 52.5 -22t52.5 22l191 191q114 -115 191 -191q22 -22 52.5 -22t52.5 22l9 9q22 22 22 52.5t-22 52.5l-191 190l-52 52q141 14 225 67q67 44 87 73.5t-2 74.5
+zM1092 956q0 134 -95 229t-229 95t-229 -95t-95 -229t95 -229t229 -95t229 95t95 229zM1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="_575" unicode="&#xf265;" horiz-adv-x="1720" 
+d="M1565 1408q65 0 110 -45.5t45 -110.5v-519q0 -176 -68 -336t-182.5 -275t-274 -182.5t-334.5 -67.5q-176 0 -335.5 67.5t-274.5 182.5t-183 275t-68 336v519q0 64 46 110t110 46h1409zM861 344q47 0 82 33l404 388q37 35 37 85q0 49 -34.5 83.5t-83.5 34.5q-47 0 -82 -33
+l-323 -310l-323 310q-35 33 -81 33q-49 0 -83.5 -34.5t-34.5 -83.5q0 -51 36 -85l405 -388q33 -33 81 -33z" />
+    <glyph glyph-name="_576" unicode="&#xf266;" horiz-adv-x="2304" 
+d="M1494 -103l-295 695q-25 -49 -158.5 -305.5t-198.5 -389.5q-1 -1 -27.5 -0.5t-26.5 1.5q-82 193 -255.5 587t-259.5 596q-21 50 -66.5 107.5t-103.5 100.5t-102 43q0 5 -0.5 24t-0.5 27h583v-50q-39 -2 -79.5 -16t-66.5 -43t-10 -64q26 -59 216.5 -499t235.5 -540
+q31 61 140 266.5t131 247.5q-19 39 -126 281t-136 295q-38 69 -201 71v50l513 -1v-47q-60 -2 -93.5 -25t-12.5 -69q33 -70 87 -189.5t86 -187.5q110 214 173 363q24 55 -10 79.5t-129 26.5q1 7 1 25v24q64 0 170.5 0.5t180 1t92.5 0.5v-49q-62 -2 -119 -33t-90 -81
+l-213 -442q13 -33 127.5 -290t121.5 -274l441 1017q-14 38 -49.5 62.5t-65 31.5t-55.5 8v50l460 -4l1 -2l-1 -44q-139 -4 -201 -145q-526 -1216 -559 -1291h-49z" />
+    <glyph glyph-name="_577" unicode="&#xf267;" horiz-adv-x="1792" 
+d="M949 643q0 -26 -16.5 -45t-41.5 -19q-26 0 -45 16.5t-19 41.5q0 26 17 45t42 19t44 -16.5t19 -41.5zM964 585l350 581q-9 -8 -67.5 -62.5t-125.5 -116.5t-136.5 -127t-117 -110.5t-50.5 -51.5l-349 -580q7 7 67 62t126 116.5t136 127t117 111t50 50.5zM1611 640
+q0 -201 -104 -371q-3 2 -17 11t-26.5 16.5t-16.5 7.5q-13 0 -13 -13q0 -10 59 -44q-74 -112 -184.5 -190.5t-241.5 -110.5l-16 67q-1 10 -15 10q-5 0 -8 -5.5t-2 -9.5l16 -68q-72 -15 -146 -15q-199 0 -372 105q1 2 13 20.5t21.5 33.5t9.5 19q0 13 -13 13q-6 0 -17 -14.5
+t-22.5 -34.5t-13.5 -23q-113 75 -192 187.5t-110 244.5l69 15q10 3 10 15q0 5 -5.5 8t-10.5 2l-68 -15q-14 72 -14 139q0 206 109 379q2 -1 18.5 -12t30 -19t17.5 -8q13 0 13 12q0 6 -12.5 15.5t-32.5 21.5l-20 12q77 112 189 189t244 107l15 -67q2 -10 15 -10q5 0 8 5.5
+t2 10.5l-15 66q71 13 134 13q204 0 379 -109q-39 -56 -39 -65q0 -13 12 -13q11 0 48 64q111 -75 187.5 -186t107.5 -241l-56 -12q-10 -2 -10 -16q0 -5 5.5 -8t9.5 -2l57 13q14 -72 14 -140zM1696 640q0 163 -63.5 311t-170.5 255t-255 170.5t-311 63.5t-311 -63.5
+t-255 -170.5t-170.5 -255t-63.5 -311t63.5 -311t170.5 -255t255 -170.5t311 -63.5t311 63.5t255 170.5t170.5 255t63.5 311zM1792 640q0 -182 -71 -348t-191 -286t-286 -191t-348 -71t-348 71t-286 191t-191 286t-71 348t71 348t191 286t286 191t348 71t348 -71t286 -191
+t191 -286t71 -348z" />
+    <glyph glyph-name="_578" unicode="&#xf268;" horiz-adv-x="1792" 
+d="M893 1536q240 2 451 -120q232 -134 352 -372l-742 39q-160 9 -294 -74.5t-185 -229.5l-276 424q128 159 311 245.5t383 87.5zM146 1131l337 -663q72 -143 211 -217t293 -45l-230 -451q-212 33 -385 157.5t-272.5 316t-99.5 411.5q0 267 146 491zM1732 962
+q58 -150 59.5 -310.5t-48.5 -306t-153 -272t-246 -209.5q-230 -133 -498 -119l405 623q88 131 82.5 290.5t-106.5 277.5zM896 942q125 0 213.5 -88.5t88.5 -213.5t-88.5 -213.5t-213.5 -88.5t-213.5 88.5t-88.5 213.5t88.5 213.5t213.5 88.5z" />
+    <glyph glyph-name="_579" unicode="&#xf269;" horiz-adv-x="1792" 
+d="M903 -256q-283 0 -504.5 150.5t-329.5 398.5q-58 131 -67 301t26 332.5t111 312t179 242.5l-11 -281q11 14 68 15.5t70 -15.5q42 81 160.5 138t234.5 59q-54 -45 -119.5 -148.5t-58.5 -163.5q25 -8 62.5 -13.5t63 -7.5t68 -4t50.5 -3q15 -5 9.5 -45.5t-30.5 -75.5
+q-5 -7 -16.5 -18.5t-56.5 -35.5t-101 -34l15 -189l-139 67q-18 -43 -7.5 -81.5t36 -66.5t65.5 -41.5t81 -6.5q51 9 98 34.5t83.5 45t73.5 17.5q61 -4 89.5 -33t19.5 -65q-1 -2 -2.5 -5.5t-8.5 -12.5t-18 -15.5t-31.5 -10.5t-46.5 -1q-60 -95 -144.5 -135.5t-209.5 -29.5
+q74 -61 162.5 -82.5t168.5 -6t154.5 52t128 87.5t80.5 104q43 91 39 192.5t-37.5 188.5t-78.5 125q87 -38 137 -79.5t77 -112.5q15 170 -57.5 343t-209.5 284q265 -77 412 -279.5t151 -517.5q2 -127 -40.5 -255t-123.5 -238t-189 -196t-247.5 -135.5t-288.5 -49.5z" />
+    <glyph glyph-name="_580" unicode="&#xf26a;" horiz-adv-x="1792" 
+d="M1493 1308q-165 110 -359 110q-155 0 -293 -73t-240 -200q-75 -93 -119.5 -218t-48.5 -266v-42q4 -141 48.5 -266t119.5 -218q102 -127 240 -200t293 -73q194 0 359 110q-121 -108 -274.5 -168t-322.5 -60q-29 0 -43 1q-175 8 -333 82t-272 193t-181 281t-67 339
+q0 182 71 348t191 286t286 191t348 71h3q168 -1 320.5 -60.5t273.5 -167.5zM1792 640q0 -192 -77 -362.5t-213 -296.5q-104 -63 -222 -63q-137 0 -255 84q154 56 253.5 233t99.5 405q0 227 -99 404t-253 234q119 83 254 83q119 0 226 -65q135 -125 210.5 -295t75.5 -361z
+" />
+    <glyph glyph-name="_581" unicode="&#xf26b;" horiz-adv-x="1792" 
+d="M1792 599q0 -56 -7 -104h-1151q0 -146 109.5 -244.5t257.5 -98.5q99 0 185.5 46.5t136.5 130.5h423q-56 -159 -170.5 -281t-267.5 -188.5t-321 -66.5q-187 0 -356 83q-228 -116 -394 -116q-237 0 -237 263q0 115 45 275q17 60 109 229q199 360 475 606
+q-184 -79 -427 -354q63 274 283.5 449.5t501.5 175.5q30 0 45 -1q255 117 433 117q64 0 116 -13t94.5 -40.5t66.5 -76.5t24 -115q0 -116 -75 -286q101 -182 101 -390zM1722 1239q0 83 -53 132t-137 49q-108 0 -254 -70q121 -47 222.5 -131.5t170.5 -195.5q51 135 51 216z
+M128 2q0 -86 48.5 -132.5t134.5 -46.5q115 0 266 83q-122 72 -213.5 183t-137.5 245q-98 -205 -98 -332zM632 715h728q-5 142 -113 237t-251 95q-144 0 -251.5 -95t-112.5 -237z" />
+    <glyph glyph-name="_582" unicode="&#xf26c;" horiz-adv-x="2048" 
+d="M1792 288v960q0 13 -9.5 22.5t-22.5 9.5h-1600q-13 0 -22.5 -9.5t-9.5 -22.5v-960q0 -13 9.5 -22.5t22.5 -9.5h1600q13 0 22.5 9.5t9.5 22.5zM1920 1248v-960q0 -66 -47 -113t-113 -47h-736v-128h352q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-832q-14 0 -23 9t-9 23
+v64q0 14 9 23t23 9h352v128h-736q-66 0 -113 47t-47 113v960q0 66 47 113t113 47h1600q66 0 113 -47t47 -113z" />
+    <glyph glyph-name="_583" unicode="&#xf26d;" horiz-adv-x="1792" 
+d="M138 1408h197q-70 -64 -126 -149q-36 -56 -59 -115t-30 -125.5t-8.5 -120t10.5 -132t21 -126t28 -136.5q4 -19 6 -28q51 -238 81 -329q57 -171 152 -275h-272q-48 0 -82 34t-34 82v1304q0 48 34 82t82 34zM1346 1408h308q48 0 82 -34t34 -82v-1304q0 -48 -34 -82t-82 -34
+h-178q212 210 196 565l-469 -101q-2 -45 -12 -82t-31 -72t-59.5 -59.5t-93.5 -36.5q-123 -26 -199 40q-32 27 -53 61t-51.5 129t-64.5 258q-35 163 -45.5 263t-5.5 139t23 77q20 41 62.5 73t102.5 45q45 12 83.5 6.5t67 -17t54 -35t43 -48t34.5 -56.5l468 100
+q-68 175 -180 287z" />
+    <glyph glyph-name="_584" unicode="&#xf26e;" 
+d="M1401 -11l-6 -6q-113 -113 -259 -175q-154 -64 -317 -64q-165 0 -317 64q-148 63 -259 175q-113 112 -175 258q-42 103 -54 189q-4 28 48 36q51 8 56 -20q1 -1 1 -4q18 -90 46 -159q50 -124 152 -226q98 -98 226 -152q132 -56 276 -56q143 0 276 56q128 55 225 152l6 6
+q10 10 25 6q12 -3 33 -22q36 -37 17 -58zM929 604l-66 -66l63 -63q21 -21 -7 -49q-17 -17 -32 -17q-10 0 -19 10l-62 61l-66 -66q-5 -5 -15 -5q-15 0 -31 16l-2 2q-18 15 -18 29q0 7 8 17l66 65l-66 66q-16 16 14 45q18 18 31 18q6 0 13 -5l65 -66l65 65q18 17 48 -13
+q27 -27 11 -44zM1400 547q0 -118 -46 -228q-45 -105 -126 -186q-80 -80 -187 -126t-228 -46t-228 46t-187 126q-82 82 -125 186q-15 33 -15 40h-1q-9 27 43 44q50 16 60 -12q37 -99 97 -167h1v339v2q3 136 102 232q105 103 253 103q147 0 251 -103t104 -249
+q0 -147 -104.5 -251t-250.5 -104q-58 0 -112 16q-28 11 -13 61q16 51 44 43l14 -3q14 -3 33 -6t30 -3q104 0 176 71.5t72 174.5q0 101 -72 171q-71 71 -175 71q-107 0 -178 -80q-64 -72 -64 -160v-413q110 -67 242 -67q96 0 185 36.5t156 103.5t103.5 155t36.5 183
+q0 198 -141 339q-140 140 -339 140q-200 0 -340 -140q-53 -53 -77 -87l-2 -2q-8 -11 -13 -15.5t-21.5 -9.5t-38.5 3q-21 5 -36.5 16.5t-15.5 26.5v680q0 15 10.5 26.5t27.5 11.5h877q30 0 30 -55t-30 -55h-811v-483h1q40 42 102 84t108 61q109 46 231 46q121 0 228 -46
+t187 -126q81 -81 126 -186q46 -112 46 -229zM1369 1128q9 -8 9 -18t-5.5 -18t-16.5 -21q-26 -26 -39 -26q-9 0 -16 7q-106 91 -207 133q-128 56 -276 56q-133 0 -262 -49q-27 -10 -45 37q-9 25 -8 38q3 16 16 20q130 57 299 57q164 0 316 -64q137 -58 235 -152z" />
+    <glyph glyph-name="_585" unicode="&#xf270;" horiz-adv-x="1792" 
+d="M1551 60q15 6 26 3t11 -17.5t-15 -33.5q-13 -16 -44 -43.5t-95.5 -68t-141 -74t-188 -58t-229.5 -24.5q-119 0 -238 31t-209 76.5t-172.5 104t-132.5 105t-84 87.5q-8 9 -10 16.5t1 12t8 7t11.5 2t11.5 -4.5q192 -117 300 -166q389 -176 799 -90q190 40 391 135z
+M1758 175q11 -16 2.5 -69.5t-28.5 -102.5q-34 -83 -85 -124q-17 -14 -26 -9t0 24q21 45 44.5 121.5t6.5 98.5q-5 7 -15.5 11.5t-27 6t-29.5 2.5t-35 0t-31.5 -2t-31 -3t-22.5 -2q-6 -1 -13 -1.5t-11 -1t-8.5 -1t-7 -0.5h-5.5h-4.5t-3 0.5t-2 1.5l-1.5 3q-6 16 47 40t103 30
+q46 7 108 1t76 -24zM1364 618q0 -31 13.5 -64t32 -58t37.5 -46t33 -32l13 -11l-227 -224q-40 37 -79 75.5t-58 58.5l-19 20q-11 11 -25 33q-38 -59 -97.5 -102.5t-127.5 -63.5t-140 -23t-137.5 21t-117.5 65.5t-83 113t-31 162.5q0 84 28 154t72 116.5t106.5 83t122.5 57
+t130 34.5t119.5 18.5t99.5 6.5v127q0 65 -21 97q-34 53 -121 53q-6 0 -16.5 -1t-40.5 -12t-56 -29.5t-56 -59.5t-48 -96l-294 27q0 60 22 119t67 113t108 95t151.5 65.5t190.5 24.5q100 0 181 -25t129.5 -61.5t81 -83t45 -86t12.5 -73.5v-589zM692 597q0 -86 70 -133
+q66 -44 139 -22q84 25 114 123q14 45 14 101v162q-59 -2 -111 -12t-106.5 -33.5t-87 -71t-32.5 -114.5z" />
+    <glyph glyph-name="_586" unicode="&#xf271;" horiz-adv-x="1792" 
+d="M1536 1280q52 0 90 -38t38 -90v-1280q0 -52 -38 -90t-90 -38h-1408q-52 0 -90 38t-38 90v1280q0 52 38 90t90 38h128v96q0 66 47 113t113 47h64q66 0 113 -47t47 -113v-96h384v96q0 66 47 113t113 47h64q66 0 113 -47t47 -113v-96h128zM1152 1376v-288q0 -14 9 -23t23 -9
+h64q14 0 23 9t9 23v288q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23zM384 1376v-288q0 -14 9 -23t23 -9h64q14 0 23 9t9 23v288q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23zM1536 -128v1024h-1408v-1024h1408zM896 448h224q14 0 23 -9t9 -23v-64q0 -14 -9 -23t-23 -9h-224
+v-224q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v224h-224q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h224v224q0 14 9 23t23 9h64q14 0 23 -9t9 -23v-224z" />
+    <glyph glyph-name="_587" unicode="&#xf272;" horiz-adv-x="1792" 
+d="M1152 416v-64q0 -14 -9 -23t-23 -9h-576q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h576q14 0 23 -9t9 -23zM128 -128h1408v1024h-1408v-1024zM512 1088v288q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-288q0 -14 9 -23t23 -9h64q14 0 23 9t9 23zM1280 1088v288q0 14 -9 23
+t-23 9h-64q-14 0 -23 -9t-9 -23v-288q0 -14 9 -23t23 -9h64q14 0 23 9t9 23zM1664 1152v-1280q0 -52 -38 -90t-90 -38h-1408q-52 0 -90 38t-38 90v1280q0 52 38 90t90 38h128v96q0 66 47 113t113 47h64q66 0 113 -47t47 -113v-96h384v96q0 66 47 113t113 47h64q66 0 113 -47
+t47 -113v-96h128q52 0 90 -38t38 -90z" />
+    <glyph glyph-name="_588" unicode="&#xf273;" horiz-adv-x="1792" 
+d="M1111 151l-46 -46q-9 -9 -22 -9t-23 9l-188 189l-188 -189q-10 -9 -23 -9t-22 9l-46 46q-9 9 -9 22t9 23l189 188l-189 188q-9 10 -9 23t9 22l46 46q9 9 22 9t23 -9l188 -188l188 188q10 9 23 9t22 -9l46 -46q9 -9 9 -22t-9 -23l-188 -188l188 -188q9 -10 9 -23t-9 -22z
+M128 -128h1408v1024h-1408v-1024zM512 1088v288q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-288q0 -14 9 -23t23 -9h64q14 0 23 9t9 23zM1280 1088v288q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-288q0 -14 9 -23t23 -9h64q14 0 23 9t9 23zM1664 1152v-1280
+q0 -52 -38 -90t-90 -38h-1408q-52 0 -90 38t-38 90v1280q0 52 38 90t90 38h128v96q0 66 47 113t113 47h64q66 0 113 -47t47 -113v-96h384v96q0 66 47 113t113 47h64q66 0 113 -47t47 -113v-96h128q52 0 90 -38t38 -90z" />
+    <glyph glyph-name="_589" unicode="&#xf274;" horiz-adv-x="1792" 
+d="M1303 572l-512 -512q-10 -9 -23 -9t-23 9l-288 288q-9 10 -9 23t9 22l46 46q9 9 22 9t23 -9l220 -220l444 444q10 9 23 9t22 -9l46 -46q9 -9 9 -22t-9 -23zM128 -128h1408v1024h-1408v-1024zM512 1088v288q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-288q0 -14 9 -23
+t23 -9h64q14 0 23 9t9 23zM1280 1088v288q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-288q0 -14 9 -23t23 -9h64q14 0 23 9t9 23zM1664 1152v-1280q0 -52 -38 -90t-90 -38h-1408q-52 0 -90 38t-38 90v1280q0 52 38 90t90 38h128v96q0 66 47 113t113 47h64q66 0 113 -47
+t47 -113v-96h384v96q0 66 47 113t113 47h64q66 0 113 -47t47 -113v-96h128q52 0 90 -38t38 -90z" />
+    <glyph glyph-name="_590" unicode="&#xf275;" horiz-adv-x="1792" 
+d="M448 1536q26 0 45 -19t19 -45v-891l536 429q17 14 40 14q26 0 45 -19t19 -45v-379l536 429q17 14 40 14q26 0 45 -19t19 -45v-1152q0 -26 -19 -45t-45 -19h-1664q-26 0 -45 19t-19 45v1664q0 26 19 45t45 19h384z" />
+    <glyph glyph-name="_591" unicode="&#xf276;" horiz-adv-x="1024" 
+d="M512 448q66 0 128 15v-655q0 -26 -19 -45t-45 -19h-128q-26 0 -45 19t-19 45v655q62 -15 128 -15zM512 1536q212 0 362 -150t150 -362t-150 -362t-362 -150t-362 150t-150 362t150 362t362 150zM512 1312q14 0 23 9t9 23t-9 23t-23 9q-146 0 -249 -103t-103 -249
+q0 -14 9 -23t23 -9t23 9t9 23q0 119 84.5 203.5t203.5 84.5z" />
+    <glyph glyph-name="_592" unicode="&#xf277;" horiz-adv-x="1792" 
+d="M1745 1239q10 -10 10 -23t-10 -23l-141 -141q-28 -28 -68 -28h-1344q-26 0 -45 19t-19 45v256q0 26 19 45t45 19h576v64q0 26 19 45t45 19h128q26 0 45 -19t19 -45v-64h512q40 0 68 -28zM768 320h256v-512q0 -26 -19 -45t-45 -19h-128q-26 0 -45 19t-19 45v512zM1600 768
+q26 0 45 -19t19 -45v-256q0 -26 -19 -45t-45 -19h-1344q-40 0 -68 28l-141 141q-10 10 -10 23t10 23l141 141q28 28 68 28h512v192h256v-192h576z" />
+    <glyph glyph-name="_593" unicode="&#xf278;" horiz-adv-x="2048" 
+d="M2020 1525q28 -20 28 -53v-1408q0 -20 -11 -36t-29 -23l-640 -256q-24 -11 -48 0l-616 246l-616 -246q-10 -5 -24 -5q-19 0 -36 11q-28 20 -28 53v1408q0 20 11 36t29 23l640 256q24 11 48 0l616 -246l616 246q32 13 60 -6zM736 1390v-1270l576 -230v1270zM128 1173
+v-1270l544 217v1270zM1920 107v1270l-544 -217v-1270z" />
+    <glyph glyph-name="_594" unicode="&#xf279;" horiz-adv-x="1792" 
+d="M512 1536q13 0 22.5 -9.5t9.5 -22.5v-1472q0 -20 -17 -28l-480 -256q-7 -4 -15 -4q-13 0 -22.5 9.5t-9.5 22.5v1472q0 20 17 28l480 256q7 4 15 4zM1760 1536q13 0 22.5 -9.5t9.5 -22.5v-1472q0 -20 -17 -28l-480 -256q-7 -4 -15 -4q-13 0 -22.5 9.5t-9.5 22.5v1472
+q0 20 17 28l480 256q7 4 15 4zM640 1536q8 0 14 -3l512 -256q18 -10 18 -29v-1472q0 -13 -9.5 -22.5t-22.5 -9.5q-8 0 -14 3l-512 256q-18 10 -18 29v1472q0 13 9.5 22.5t22.5 9.5z" />
+    <glyph glyph-name="_595" unicode="&#xf27a;" horiz-adv-x="1792" 
+d="M640 640q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM1024 640q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM1408 640q0 53 -37.5 90.5t-90.5 37.5
+t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5zM1792 640q0 -174 -120 -321.5t-326 -233t-450 -85.5q-110 0 -211 18q-173 -173 -435 -229q-52 -10 -86 -13q-12 -1 -22 6t-13 18q-4 15 20 37q5 5 23.5 21.5t25.5 23.5t23.5 25.5t24 31.5t20.5 37
+t20 48t14.5 57.5t12.5 72.5q-146 90 -229.5 216.5t-83.5 269.5q0 174 120 321.5t326 233t450 85.5t450 -85.5t326 -233t120 -321.5z" />
+    <glyph glyph-name="_596" unicode="&#xf27b;" horiz-adv-x="1792" 
+d="M640 640q0 -53 -37.5 -90.5t-90.5 -37.5t-90.5 37.5t-37.5 90.5t37.5 90.5t90.5 37.5t90.5 -37.5t37.5 -90.5zM1024 640q0 -53 -37.5 -90.5t-90.5 -37.5t-90.5 37.5t-37.5 90.5t37.5 90.5t90.5 37.5t90.5 -37.5t37.5 -90.5zM1408 640q0 -53 -37.5 -90.5t-90.5 -37.5
+t-90.5 37.5t-37.5 90.5t37.5 90.5t90.5 37.5t90.5 -37.5t37.5 -90.5zM896 1152q-204 0 -381.5 -69.5t-282 -187.5t-104.5 -255q0 -112 71.5 -213.5t201.5 -175.5l87 -50l-27 -96q-24 -91 -70 -172q152 63 275 171l43 38l57 -6q69 -8 130 -8q204 0 381.5 69.5t282 187.5
+t104.5 255t-104.5 255t-282 187.5t-381.5 69.5zM1792 640q0 -174 -120 -321.5t-326 -233t-450 -85.5q-70 0 -145 8q-198 -175 -460 -242q-49 -14 -114 -22h-5q-15 0 -27 10.5t-16 27.5v1q-3 4 -0.5 12t2 10t4.5 9.5l6 9t7 8.5t8 9q7 8 31 34.5t34.5 38t31 39.5t32.5 51
+t27 59t26 76q-157 89 -247.5 220t-90.5 281q0 130 71 248.5t191 204.5t286 136.5t348 50.5t348 -50.5t286 -136.5t191 -204.5t71 -248.5z" />
+    <glyph glyph-name="_597" unicode="&#xf27c;" horiz-adv-x="1024" 
+d="M512 345l512 295v-591l-512 -296v592zM0 640v-591l512 296zM512 1527v-591l-512 -296v591zM512 936l512 295v-591z" />
+    <glyph glyph-name="_598" unicode="&#xf27d;" horiz-adv-x="1792" 
+d="M1709 1018q-10 -236 -332 -651q-333 -431 -562 -431q-142 0 -240 263q-44 160 -132 482q-72 262 -157 262q-18 0 -127 -76l-77 98q24 21 108 96.5t130 115.5q156 138 241 146q95 9 153 -55.5t81 -203.5q44 -287 66 -373q55 -249 120 -249q51 0 154 161q101 161 109 246
+q13 139 -109 139q-57 0 -121 -26q120 393 459 382q251 -8 236 -326z" />
+    <glyph glyph-name="f27e" unicode="&#xf27e;" 
+d="M0 1408h1536v-1536h-1536v1536zM1085 293l-221 631l221 297h-634l221 -297l-221 -631l317 -304z" />
+    <glyph glyph-name="uniF280" unicode="&#xf280;" 
+d="M0 1408h1536v-1536h-1536v1536zM908 1088l-12 -33l75 -83l-31 -114l25 -25l107 57l107 -57l25 25l-31 114l75 83l-12 33h-95l-53 96h-32l-53 -96h-95zM641 925q32 0 44.5 -16t11.5 -63l174 21q0 55 -17.5 92.5t-50.5 56t-69 25.5t-85 7q-133 0 -199 -57.5t-66 -182.5v-72
+h-96v-128h76q20 0 20 -8v-382q0 -14 -5 -20t-18 -7l-73 -7v-88h448v86l-149 14q-6 1 -8.5 1.5t-3.5 2.5t-0.5 4t1 7t0.5 10v387h191l38 128h-231q-6 0 -2 6t4 9v80q0 27 1.5 40.5t7.5 28t19.5 20t36.5 5.5zM1248 96v86l-54 9q-7 1 -9.5 2.5t-2.5 3t1 7.5t1 12v520h-275
+l-23 -101l83 -22q23 -7 23 -27v-370q0 -14 -6 -18.5t-20 -6.5l-70 -9v-86h352z" />
+    <glyph glyph-name="uniF281" unicode="&#xf281;" horiz-adv-x="1792" 
+d="M1792 690q0 -58 -29.5 -105.5t-79.5 -72.5q12 -46 12 -96q0 -155 -106.5 -287t-290.5 -208.5t-400 -76.5t-399.5 76.5t-290 208.5t-106.5 287q0 47 11 94q-51 25 -82 73.5t-31 106.5q0 82 58 140.5t141 58.5q85 0 145 -63q218 152 515 162l116 521q3 13 15 21t26 5
+l369 -81q18 37 54 59.5t79 22.5q62 0 106 -43.5t44 -105.5t-44 -106t-106 -44t-105.5 43.5t-43.5 105.5l-334 74l-104 -472q300 -9 519 -160q58 61 143 61q83 0 141 -58.5t58 -140.5zM418 491q0 -62 43.5 -106t105.5 -44t106 44t44 106t-44 105.5t-106 43.5q-61 0 -105 -44
+t-44 -105zM1228 136q11 11 11 26t-11 26q-10 10 -25 10t-26 -10q-41 -42 -121 -62t-160 -20t-160 20t-121 62q-11 10 -26 10t-25 -10q-11 -10 -11 -25.5t11 -26.5q43 -43 118.5 -68t122.5 -29.5t91 -4.5t91 4.5t122.5 29.5t118.5 68zM1225 341q62 0 105.5 44t43.5 106
+q0 61 -44 105t-105 44q-62 0 -106 -43.5t-44 -105.5t44 -106t106 -44z" />
+    <glyph glyph-name="_602" unicode="&#xf282;" horiz-adv-x="1792" 
+d="M69 741h1q16 126 58.5 241.5t115 217t167.5 176t223.5 117.5t276.5 43q231 0 414 -105.5t294 -303.5q104 -187 104 -442v-188h-1125q1 -111 53.5 -192.5t136.5 -122.5t189.5 -57t213 -3t208 46.5t173.5 84.5v-377q-92 -55 -229.5 -92t-312.5 -38t-316 53
+q-189 73 -311.5 249t-124.5 372q-3 242 111 412t325 268q-48 -60 -78 -125.5t-46 -159.5h635q8 77 -8 140t-47 101.5t-70.5 66.5t-80.5 41t-75 20.5t-56 8.5l-22 1q-135 -5 -259.5 -44.5t-223.5 -104.5t-176 -140.5t-138 -163.5z" />
+    <glyph glyph-name="_603" unicode="&#xf283;" horiz-adv-x="2304" 
+d="M0 32v608h2304v-608q0 -66 -47 -113t-113 -47h-1984q-66 0 -113 47t-47 113zM640 256v-128h384v128h-384zM256 256v-128h256v128h-256zM2144 1408q66 0 113 -47t47 -113v-224h-2304v224q0 66 47 113t113 47h1984z" />
+    <glyph glyph-name="_604" unicode="&#xf284;" horiz-adv-x="1792" 
+d="M1584 246l-218 111q-74 -120 -196.5 -189t-263.5 -69q-147 0 -271 72t-196 196t-72 270q0 110 42.5 209.5t115 172t172 115t209.5 42.5q131 0 247.5 -60.5t192.5 -168.5l215 125q-110 169 -286.5 265t-378.5 96q-161 0 -308 -63t-253 -169t-169 -253t-63 -308t63 -308
+t169 -253t253 -169t308 -63q213 0 397.5 107t290.5 292zM1030 643l693 -352q-116 -253 -334.5 -400t-492.5 -147q-182 0 -348 71t-286 191t-191 286t-71 348t71 348t191 286t286 191t348 71q260 0 470.5 -133.5t335.5 -366.5zM1543 640h-39v-160h-96v352h136q32 0 54.5 -20
+t28.5 -48t1 -56t-27.5 -48t-57.5 -20z" />
+    <glyph glyph-name="uniF285" unicode="&#xf285;" horiz-adv-x="1792" 
+d="M1427 827l-614 386l92 151h855zM405 562l-184 116v858l1183 -743zM1424 697l147 -95v-858l-532 335zM1387 718l-500 -802h-855l356 571z" />
+    <glyph glyph-name="uniF286" unicode="&#xf286;" horiz-adv-x="1792" 
+d="M640 528v224q0 16 -16 16h-96q-16 0 -16 -16v-224q0 -16 16 -16h96q16 0 16 16zM1152 528v224q0 16 -16 16h-96q-16 0 -16 -16v-224q0 -16 16 -16h96q16 0 16 16zM1664 496v-752h-640v320q0 80 -56 136t-136 56t-136 -56t-56 -136v-320h-640v752q0 16 16 16h96
+q16 0 16 -16v-112h128v624q0 16 16 16h96q16 0 16 -16v-112h128v112q0 16 16 16h96q16 0 16 -16v-112h128v112q0 6 2.5 9.5t8.5 5t9.5 2t11.5 0t9 -0.5v391q-32 15 -32 50q0 23 16.5 39t38.5 16t38.5 -16t16.5 -39q0 -35 -32 -50v-17q45 10 83 10q21 0 59.5 -7.5t54.5 -7.5
+q17 0 47 7.5t37 7.5q16 0 16 -16v-210q0 -15 -35 -21.5t-62 -6.5q-18 0 -54.5 7.5t-55.5 7.5q-40 0 -90 -12v-133q1 0 9 0.5t11.5 0t9.5 -2t8.5 -5t2.5 -9.5v-112h128v112q0 16 16 16h96q16 0 16 -16v-112h128v112q0 16 16 16h96q16 0 16 -16v-624h128v112q0 16 16 16h96
+q16 0 16 -16z" />
+    <glyph glyph-name="_607" unicode="&#xf287;" horiz-adv-x="2304" 
+d="M2288 731q16 -8 16 -27t-16 -27l-320 -192q-8 -5 -16 -5q-9 0 -16 4q-16 10 -16 28v128h-858q37 -58 83 -165q16 -37 24.5 -55t24 -49t27 -47t27 -34t31.5 -26t33 -8h96v96q0 14 9 23t23 9h320q14 0 23 -9t9 -23v-320q0 -14 -9 -23t-23 -9h-320q-14 0 -23 9t-9 23v96h-96
+q-32 0 -61 10t-51 23.5t-45 40.5t-37 46t-33.5 57t-28.5 57.5t-28 60.5q-23 53 -37 81.5t-36 65t-44.5 53.5t-46.5 17h-360q-22 -84 -91 -138t-157 -54q-106 0 -181 75t-75 181t75 181t181 75q88 0 157 -54t91 -138h104q24 0 46.5 17t44.5 53.5t36 65t37 81.5q19 41 28 60.5
+t28.5 57.5t33.5 57t37 46t45 40.5t51 23.5t61 10h107q21 57 70 92.5t111 35.5q80 0 136 -56t56 -136t-56 -136t-136 -56q-62 0 -111 35.5t-70 92.5h-107q-17 0 -33 -8t-31.5 -26t-27 -34t-27 -47t-24 -49t-24.5 -55q-46 -107 -83 -165h1114v128q0 18 16 28t32 -1z" />
+    <glyph glyph-name="_608" unicode="&#xf288;" horiz-adv-x="1792" 
+d="M1150 774q0 -56 -39.5 -95t-95.5 -39h-253v269h253q56 0 95.5 -39.5t39.5 -95.5zM1329 774q0 130 -91.5 222t-222.5 92h-433v-896h180v269h253q130 0 222 91.5t92 221.5zM1792 640q0 -182 -71 -348t-191 -286t-286 -191t-348 -71t-348 71t-286 191t-191 286t-71 348
+t71 348t191 286t286 191t348 71t348 -71t286 -191t191 -286t71 -348z" />
+    <glyph glyph-name="_609" unicode="&#xf289;" horiz-adv-x="2304" 
+d="M1645 438q0 59 -34 106.5t-87 68.5q-7 -45 -23 -92q-7 -24 -27.5 -38t-44.5 -14q-12 0 -24 3q-31 10 -45 38.5t-4 58.5q23 71 23 143q0 123 -61 227.5t-166 165.5t-228 61q-134 0 -247 -73t-167 -194q108 -28 188 -106q22 -23 22 -55t-22 -54t-54 -22t-55 22
+q-75 75 -180 75q-106 0 -181 -74.5t-75 -180.5t75 -180.5t181 -74.5h1046q79 0 134.5 55.5t55.5 133.5zM1798 438q0 -142 -100.5 -242t-242.5 -100h-1046q-169 0 -289 119.5t-120 288.5q0 153 100 267t249 136q62 184 221 298t354 114q235 0 408.5 -158.5t196.5 -389.5
+q116 -25 192.5 -118.5t76.5 -214.5zM2048 438q0 -175 -97 -319q-23 -33 -64 -33q-24 0 -43 13q-26 17 -32 48.5t12 57.5q71 104 71 233t-71 233q-18 26 -12 57t32 49t57.5 11.5t49.5 -32.5q97 -142 97 -318zM2304 438q0 -244 -134 -443q-23 -34 -64 -34q-23 0 -42 13
+q-26 18 -32.5 49t11.5 57q108 164 108 358q0 195 -108 357q-18 26 -11.5 57.5t32.5 48.5q26 18 57 12t49 -33q134 -198 134 -442z" />
+    <glyph glyph-name="_610" unicode="&#xf28a;" 
+d="M1500 -13q0 -89 -63 -152.5t-153 -63.5t-153.5 63.5t-63.5 152.5q0 90 63.5 153.5t153.5 63.5t153 -63.5t63 -153.5zM1267 268q-115 -15 -192.5 -102.5t-77.5 -205.5q0 -74 33 -138q-146 -78 -379 -78q-109 0 -201 21t-153.5 54.5t-110.5 76.5t-76 85t-44.5 83
+t-23.5 66.5t-6 39.5q0 19 4.5 42.5t18.5 56t36.5 58t64 43.5t94.5 18t94 -17.5t63 -41t35.5 -53t17.5 -49t4 -33.5q0 -34 -23 -81q28 -27 82 -42t93 -17l40 -1q115 0 190 51t75 133q0 26 -9 48.5t-31.5 44.5t-49.5 41t-74 44t-93.5 47.5t-119.5 56.5q-28 13 -43 20
+q-116 55 -187 100t-122.5 102t-72 125.5t-20.5 162.5q0 78 20.5 150t66 137.5t112.5 114t166.5 77t221.5 28.5q120 0 220 -26t164.5 -67t109.5 -94t64 -105.5t19 -103.5q0 -46 -15 -82.5t-36.5 -58t-48.5 -36t-49 -19.5t-39 -5h-8h-32t-39 5t-44 14t-41 28t-37 46t-24 70.5
+t-10 97.5q-15 16 -59 25.5t-81 10.5l-37 1q-68 0 -117.5 -31t-70.5 -70t-21 -76q0 -24 5 -43t24 -46t53 -51t97 -53.5t150 -58.5q76 -25 138.5 -53.5t109 -55.5t83 -59t60.5 -59.5t41 -62.5t26.5 -62t14.5 -63.5t6 -62t1 -62.5z" />
+    <glyph glyph-name="_611" unicode="&#xf28b;" 
+d="M704 352v576q0 14 -9 23t-23 9h-256q-14 0 -23 -9t-9 -23v-576q0 -14 9 -23t23 -9h256q14 0 23 9t9 23zM1152 352v576q0 14 -9 23t-23 9h-256q-14 0 -23 -9t-9 -23v-576q0 -14 9 -23t23 -9h256q14 0 23 9t9 23zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103
+t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="_612" unicode="&#xf28c;" 
+d="M768 1408q209 0 385.5 -103t279.5 -279.5t103 -385.5t-103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103zM768 96q148 0 273 73t198 198t73 273t-73 273t-198 198t-273 73t-273 -73t-198 -198t-73 -273
+t73 -273t198 -198t273 -73zM864 320q-14 0 -23 9t-9 23v576q0 14 9 23t23 9h192q14 0 23 -9t9 -23v-576q0 -14 -9 -23t-23 -9h-192zM480 320q-14 0 -23 9t-9 23v576q0 14 9 23t23 9h192q14 0 23 -9t9 -23v-576q0 -14 -9 -23t-23 -9h-192z" />
+    <glyph glyph-name="_613" unicode="&#xf28d;" 
+d="M1088 352v576q0 14 -9 23t-23 9h-576q-14 0 -23 -9t-9 -23v-576q0 -14 9 -23t23 -9h576q14 0 23 9t9 23zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5
+t103 -385.5z" />
+    <glyph glyph-name="_614" unicode="&#xf28e;" 
+d="M768 1408q209 0 385.5 -103t279.5 -279.5t103 -385.5t-103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103zM768 96q148 0 273 73t198 198t73 273t-73 273t-198 198t-273 73t-273 -73t-198 -198t-73 -273
+t73 -273t198 -198t273 -73zM480 320q-14 0 -23 9t-9 23v576q0 14 9 23t23 9h576q14 0 23 -9t9 -23v-576q0 -14 -9 -23t-23 -9h-576z" />
+    <glyph glyph-name="_615" unicode="&#xf290;" horiz-adv-x="1792" 
+d="M1757 128l35 -313q3 -28 -16 -50q-19 -21 -48 -21h-1664q-29 0 -48 21q-19 22 -16 50l35 313h1722zM1664 967l86 -775h-1708l86 775q3 24 21 40.5t43 16.5h256v-128q0 -53 37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5v128h384v-128q0 -53 37.5 -90.5t90.5 -37.5
+t90.5 37.5t37.5 90.5v128h256q25 0 43 -16.5t21 -40.5zM1280 1152v-256q0 -26 -19 -45t-45 -19t-45 19t-19 45v256q0 106 -75 181t-181 75t-181 -75t-75 -181v-256q0 -26 -19 -45t-45 -19t-45 19t-19 45v256q0 159 112.5 271.5t271.5 112.5t271.5 -112.5t112.5 -271.5z" />
+    <glyph glyph-name="_616" unicode="&#xf291;" horiz-adv-x="2048" 
+d="M1920 768q53 0 90.5 -37.5t37.5 -90.5t-37.5 -90.5t-90.5 -37.5h-15l-115 -662q-8 -46 -44 -76t-82 -30h-1280q-46 0 -82 30t-44 76l-115 662h-15q-53 0 -90.5 37.5t-37.5 90.5t37.5 90.5t90.5 37.5h1792zM485 -32q26 2 43.5 22.5t15.5 46.5l-32 416q-2 26 -22.5 43.5
+t-46.5 15.5t-43.5 -22.5t-15.5 -46.5l32 -416q2 -25 20.5 -42t43.5 -17h5zM896 32v416q0 26 -19 45t-45 19t-45 -19t-19 -45v-416q0 -26 19 -45t45 -19t45 19t19 45zM1280 32v416q0 26 -19 45t-45 19t-45 -19t-19 -45v-416q0 -26 19 -45t45 -19t45 19t19 45zM1632 27l32 416
+q2 26 -15.5 46.5t-43.5 22.5t-46.5 -15.5t-22.5 -43.5l-32 -416q-2 -26 15.5 -46.5t43.5 -22.5h5q25 0 43.5 17t20.5 42zM476 1244l-93 -412h-132l101 441q19 88 89 143.5t160 55.5h167q0 26 19 45t45 19h384q26 0 45 -19t19 -45h167q90 0 160 -55.5t89 -143.5l101 -441
+h-132l-93 412q-11 44 -45.5 72t-79.5 28h-167q0 -26 -19 -45t-45 -19h-384q-26 0 -45 19t-19 45h-167q-45 0 -79.5 -28t-45.5 -72z" />
+    <glyph glyph-name="_617" unicode="&#xf292;" horiz-adv-x="1792" 
+d="M991 512l64 256h-254l-64 -256h254zM1759 1016l-56 -224q-7 -24 -31 -24h-327l-64 -256h311q15 0 25 -12q10 -14 6 -28l-56 -224q-5 -24 -31 -24h-327l-81 -328q-7 -24 -31 -24h-224q-16 0 -26 12q-9 12 -6 28l78 312h-254l-81 -328q-7 -24 -31 -24h-225q-15 0 -25 12
+q-9 12 -6 28l78 312h-311q-15 0 -25 12q-9 12 -6 28l56 224q7 24 31 24h327l64 256h-311q-15 0 -25 12q-10 14 -6 28l56 224q5 24 31 24h327l81 328q7 24 32 24h224q15 0 25 -12q9 -12 6 -28l-78 -312h254l81 328q7 24 32 24h224q15 0 25 -12q9 -12 6 -28l-78 -312h311
+q15 0 25 -12q9 -12 6 -28z" />
+    <glyph glyph-name="_618" unicode="&#xf293;" 
+d="M841 483l148 -148l-149 -149zM840 1094l149 -149l-148 -148zM710 -130l464 464l-306 306l306 306l-464 464v-611l-255 255l-93 -93l320 -321l-320 -321l93 -93l255 255v-611zM1429 640q0 -209 -32 -365.5t-87.5 -257t-140.5 -162.5t-181.5 -86.5t-219.5 -24.5
+t-219.5 24.5t-181.5 86.5t-140.5 162.5t-87.5 257t-32 365.5t32 365.5t87.5 257t140.5 162.5t181.5 86.5t219.5 24.5t219.5 -24.5t181.5 -86.5t140.5 -162.5t87.5 -257t32 -365.5z" />
+    <glyph glyph-name="_619" unicode="&#xf294;" horiz-adv-x="1024" 
+d="M596 113l173 172l-173 172v-344zM596 823l173 172l-173 172v-344zM628 640l356 -356l-539 -540v711l-297 -296l-108 108l372 373l-372 373l108 108l297 -296v711l539 -540z" />
+    <glyph glyph-name="_620" unicode="&#xf295;" 
+d="M1280 256q0 52 -38 90t-90 38t-90 -38t-38 -90t38 -90t90 -38t90 38t38 90zM512 1024q0 52 -38 90t-90 38t-90 -38t-38 -90t38 -90t90 -38t90 38t38 90zM1536 256q0 -159 -112.5 -271.5t-271.5 -112.5t-271.5 112.5t-112.5 271.5t112.5 271.5t271.5 112.5t271.5 -112.5
+t112.5 -271.5zM1440 1344q0 -20 -13 -38l-1056 -1408q-19 -26 -51 -26h-160q-26 0 -45 19t-19 45q0 20 13 38l1056 1408q19 26 51 26h160q26 0 45 -19t19 -45zM768 1024q0 -159 -112.5 -271.5t-271.5 -112.5t-271.5 112.5t-112.5 271.5t112.5 271.5t271.5 112.5
+t271.5 -112.5t112.5 -271.5z" />
+    <glyph glyph-name="_621" unicode="&#xf296;" horiz-adv-x="1792" 
+d="M104 830l792 -1015l-868 630q-18 13 -25 34.5t0 42.5l101 308v0zM566 830h660l-330 -1015v0zM368 1442l198 -612h-462l198 612q8 23 33 23t33 -23zM1688 830l101 -308q7 -21 0 -42.5t-25 -34.5l-868 -630l792 1015v0zM1688 830h-462l198 612q8 23 33 23t33 -23z" />
+    <glyph glyph-name="_622" unicode="&#xf297;" horiz-adv-x="1792" 
+d="M384 704h160v224h-160v-224zM1221 372v92q-104 -36 -243 -38q-135 -1 -259.5 46.5t-220.5 122.5l1 -96q88 -80 212 -128.5t272 -47.5q129 0 238 49zM640 704h640v224h-640v-224zM1792 736q0 -187 -99 -352q89 -102 89 -229q0 -157 -129.5 -268t-313.5 -111
+q-122 0 -225 52.5t-161 140.5q-19 -1 -57 -1t-57 1q-58 -88 -161 -140.5t-225 -52.5q-184 0 -313.5 111t-129.5 268q0 127 89 229q-99 165 -99 352q0 209 120 385.5t326.5 279.5t449.5 103t449.5 -103t326.5 -279.5t120 -385.5z" />
+    <glyph glyph-name="_623" unicode="&#xf298;" 
+d="M515 625v-128h-252v128h252zM515 880v-127h-252v127h252zM1273 369v-128h-341v128h341zM1273 625v-128h-672v128h672zM1273 880v-127h-672v127h672zM1408 20v1240q0 8 -6 14t-14 6h-32l-378 -256l-210 171l-210 -171l-378 256h-32q-8 0 -14 -6t-6 -14v-1240q0 -8 6 -14
+t14 -6h1240q8 0 14 6t6 14zM553 1130l185 150h-406zM983 1130l221 150h-406zM1536 1260v-1240q0 -62 -43 -105t-105 -43h-1240q-62 0 -105 43t-43 105v1240q0 62 43 105t105 43h1240q62 0 105 -43t43 -105z" />
+    <glyph glyph-name="_624" unicode="&#xf299;" horiz-adv-x="1792" 
+d="M896 720q-104 196 -160 278q-139 202 -347 318q-34 19 -70 36q-89 40 -94 32t34 -38l39 -31q62 -43 112.5 -93.5t94.5 -116.5t70.5 -113t70.5 -131q9 -17 13 -25q44 -84 84 -153t98 -154t115.5 -150t131 -123.5t148.5 -90.5q153 -66 154 -60q1 3 -49 37q-53 36 -81 57
+q-77 58 -179 211t-185 310zM549 177q-76 60 -132.5 125t-98 143.5t-71 154.5t-58.5 186t-52 209t-60.5 252t-76.5 289q273 0 497.5 -36t379 -92t271 -144.5t185.5 -172.5t110 -198.5t56 -199.5t12.5 -198.5t-9.5 -173t-20 -143.5t-13 -107l323 -327h-104l-281 285
+q-22 -2 -91.5 -14t-121.5 -19t-138 -6t-160.5 17t-167.5 59t-179 111z" />
+    <glyph glyph-name="_625" unicode="&#xf29a;" horiz-adv-x="1792" 
+d="M1374 879q-6 26 -28.5 39.5t-48.5 7.5q-261 -62 -401 -62t-401 62q-26 6 -48.5 -7.5t-28.5 -39.5t7.5 -48.5t39.5 -28.5q194 -46 303 -58q-2 -158 -15.5 -269t-26.5 -155.5t-41 -115.5l-9 -21q-10 -25 1 -49t36 -34q9 -4 23 -4q44 0 60 41l8 20q54 139 71 259h42
+q17 -120 71 -259l8 -20q16 -41 60 -41q14 0 23 4q25 10 36 34t1 49l-9 21q-28 71 -41 115.5t-26.5 155.5t-15.5 269q109 12 303 58q26 6 39.5 28.5t7.5 48.5zM1024 1024q0 53 -37.5 90.5t-90.5 37.5t-90.5 -37.5t-37.5 -90.5t37.5 -90.5t90.5 -37.5t90.5 37.5t37.5 90.5z
+M1600 640q0 -143 -55.5 -273.5t-150 -225t-225 -150t-273.5 -55.5t-273.5 55.5t-225 150t-150 225t-55.5 273.5t55.5 273.5t150 225t225 150t273.5 55.5t273.5 -55.5t225 -150t150 -225t55.5 -273.5zM896 1408q-156 0 -298 -61t-245 -164t-164 -245t-61 -298t61 -298
+t164 -245t245 -164t298 -61t298 61t245 164t164 245t61 298t-61 298t-164 245t-245 164t-298 61zM1792 640q0 -182 -71 -348t-191 -286t-286 -191t-348 -71t-348 71t-286 191t-191 286t-71 348t71 348t191 286t286 191t348 71t348 -71t286 -191t191 -286t71 -348z" />
+    <glyph glyph-name="_626" unicode="&#xf29b;" 
+d="M1438 723q34 -35 29 -82l-44 -551q-4 -42 -34.5 -70t-71.5 -28q-6 0 -9 1q-44 3 -72.5 36.5t-25.5 77.5l35 429l-143 -8q55 -113 55 -240q0 -216 -148 -372l-137 137q91 101 91 235q0 145 -102.5 248t-247.5 103q-134 0 -236 -92l-137 138q120 114 284 141l264 300
+l-149 87l-181 -161q-33 -30 -77 -27.5t-73 35.5t-26.5 77t34.5 73l239 213q26 23 60 26.5t64 -14.5l488 -283q36 -21 48 -68q17 -67 -26 -117l-205 -232l371 20q49 3 83 -32zM1240 1180q-74 0 -126 52t-52 126t52 126t126 52t126.5 -52t52.5 -126t-52.5 -126t-126.5 -52z
+M613 -62q106 0 196 61l139 -139q-146 -116 -335 -116q-148 0 -273.5 73t-198.5 198t-73 273q0 188 116 336l139 -139q-60 -88 -60 -197q0 -145 102.5 -247.5t247.5 -102.5z" />
+    <glyph glyph-name="_627" unicode="&#xf29c;" 
+d="M880 336v-160q0 -14 -9 -23t-23 -9h-160q-14 0 -23 9t-9 23v160q0 14 9 23t23 9h160q14 0 23 -9t9 -23zM1136 832q0 -50 -15 -90t-45.5 -69t-52 -44t-59.5 -36q-32 -18 -46.5 -28t-26 -24t-11.5 -29v-32q0 -14 -9 -23t-23 -9h-160q-14 0 -23 9t-9 23v68q0 35 10.5 64.5
+t24 47.5t39 35.5t41 25.5t44.5 21q53 25 75 43t22 49q0 42 -43.5 71.5t-95.5 29.5q-56 0 -95 -27q-29 -20 -80 -83q-9 -12 -25 -12q-11 0 -19 6l-108 82q-10 7 -12 20t5 23q122 192 349 192q129 0 238.5 -89.5t109.5 -214.5zM768 1280q-130 0 -248.5 -51t-204 -136.5
+t-136.5 -204t-51 -248.5t51 -248.5t136.5 -204t204 -136.5t248.5 -51t248.5 51t204 136.5t136.5 204t51 248.5t-51 248.5t-136.5 204t-204 136.5t-248.5 51zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5
+t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="_628" unicode="&#xf29d;" horiz-adv-x="1408" 
+d="M366 1225q-64 0 -110 45.5t-46 110.5q0 64 46 109.5t110 45.5t109.5 -45.5t45.5 -109.5q0 -65 -45.5 -110.5t-109.5 -45.5zM917 583q0 -50 -30 -67.5t-63.5 -6.5t-47.5 34l-367 438q-7 12 -14 15.5t-11 1.5l-3 -3q-7 -8 4 -21l122 -139l1 -354l-161 -457
+q-67 -192 -92 -234q-15 -26 -28 -32q-50 -26 -103 -1q-29 13 -41.5 43t-9.5 57q2 17 197 618l5 416l-85 -164l35 -222q4 -24 -1 -42t-14 -27.5t-19 -16t-17 -7.5l-7 -2q-19 -3 -34.5 3t-24 16t-14 22t-7.5 19.5t-2 9.5l-46 299l211 381q23 34 113 34q75 0 107 -40l424 -521
+q7 -5 14 -17l3 -3l-1 -1q7 -13 7 -29zM514 433q43 -113 88.5 -225t69.5 -168l24 -55q36 -93 42 -125q11 -70 -36 -97q-35 -22 -66 -16t-51 22t-29 35h-1q-6 16 -8 25l-124 351zM1338 -159q31 -49 31 -57q0 -5 -3 -7q-9 -5 -14.5 0.5t-15.5 26t-16 30.5q-114 172 -423 661
+q3 -1 7 1t7 4l3 2q11 9 11 17z" />
+    <glyph glyph-name="_629" unicode="&#xf29e;" horiz-adv-x="2304" 
+d="M504 542h171l-1 265zM1530 641q0 87 -50.5 140t-146.5 53h-54v-388h52q91 0 145 57t54 138zM956 1018l1 -756q0 -14 -9.5 -24t-23.5 -10h-216q-14 0 -23.5 10t-9.5 24v62h-291l-55 -81q-10 -15 -28 -15h-267q-21 0 -30.5 18t3.5 35l556 757q9 14 27 14h332q14 0 24 -10
+t10 -24zM1783 641q0 -193 -125.5 -303t-324.5 -110h-270q-14 0 -24 10t-10 24v756q0 14 10 24t24 10h268q200 0 326 -109t126 -302zM1939 640q0 -11 -0.5 -29t-8 -71.5t-21.5 -102t-44.5 -108t-73.5 -102.5h-51q38 45 66.5 104.5t41.5 112t21 98t9 72.5l1 27q0 8 -0.5 22.5
+t-7.5 60t-20 91.5t-41 111.5t-66 124.5h43q41 -47 72 -107t45.5 -111.5t23 -96t10.5 -70.5zM2123 640q0 -11 -0.5 -29t-8 -71.5t-21.5 -102t-45 -108t-74 -102.5h-51q38 45 66.5 104.5t41.5 112t21 98t9 72.5l1 27q0 8 -0.5 22.5t-7.5 60t-19.5 91.5t-40.5 111.5t-66 124.5
+h43q41 -47 72 -107t45.5 -111.5t23 -96t10.5 -70.5zM2304 640q0 -11 -0.5 -29t-8 -71.5t-21.5 -102t-44.5 -108t-73.5 -102.5h-51q38 45 66 104.5t41 112t21 98t9 72.5l1 27q0 8 -0.5 22.5t-7.5 60t-19.5 91.5t-40.5 111.5t-66 124.5h43q41 -47 72 -107t45.5 -111.5t23 -96
+t9.5 -70.5z" />
+    <glyph glyph-name="uniF2A0" unicode="&#xf2a0;" horiz-adv-x="1408" 
+d="M617 -153q0 11 -13 58t-31 107t-20 69q-1 4 -5 26.5t-8.5 36t-13.5 21.5q-15 14 -51 14q-23 0 -70 -5.5t-71 -5.5q-34 0 -47 11q-6 5 -11 15.5t-7.5 20t-6.5 24t-5 18.5q-37 128 -37 255t37 255q1 4 5 18.5t6.5 24t7.5 20t11 15.5q13 11 47 11q24 0 71 -5.5t70 -5.5
+q36 0 51 14q9 8 13.5 21.5t8.5 36t5 26.5q2 9 20 69t31 107t13 58q0 22 -43.5 52.5t-75.5 42.5q-20 8 -45 8q-34 0 -98 -18q-57 -17 -96.5 -40.5t-71 -66t-46 -70t-45.5 -94.5q-6 -12 -9 -19q-49 -107 -68 -216t-19 -244t19 -244t68 -216q56 -122 83 -161q63 -91 179 -127
+l6 -2q64 -18 98 -18q25 0 45 8q32 12 75.5 42.5t43.5 52.5zM776 760q-26 0 -45 19t-19 45.5t19 45.5q37 37 37 90q0 52 -37 91q-19 19 -19 45t19 45t45 19t45 -19q75 -75 75 -181t-75 -181q-21 -19 -45 -19zM957 579q-27 0 -45 19q-19 19 -19 45t19 45q112 114 112 272
+t-112 272q-19 19 -19 45t19 45t45 19t45 -19q150 -150 150 -362t-150 -362q-18 -19 -45 -19zM1138 398q-27 0 -45 19q-19 19 -19 45t19 45q90 91 138.5 208t48.5 245t-48.5 245t-138.5 208q-19 19 -19 45t19 45t45 19t45 -19q109 -109 167 -249t58 -294t-58 -294t-167 -249
+q-18 -19 -45 -19z" />
+    <glyph glyph-name="uniF2A1" unicode="&#xf2a1;" horiz-adv-x="2176" 
+d="M192 352q-66 0 -113 -47t-47 -113t47 -113t113 -47t113 47t47 113t-47 113t-113 47zM704 352q-66 0 -113 -47t-47 -113t47 -113t113 -47t113 47t47 113t-47 113t-113 47zM704 864q-66 0 -113 -47t-47 -113t47 -113t113 -47t113 47t47 113t-47 113t-113 47zM1472 352
+q-66 0 -113 -47t-47 -113t47 -113t113 -47t113 47t47 113t-47 113t-113 47zM1984 352q-66 0 -113 -47t-47 -113t47 -113t113 -47t113 47t47 113t-47 113t-113 47zM1472 864q-66 0 -113 -47t-47 -113t47 -113t113 -47t113 47t47 113t-47 113t-113 47zM1984 864
+q-66 0 -113 -47t-47 -113t47 -113t113 -47t113 47t47 113t-47 113t-113 47zM1984 1376q-66 0 -113 -47t-47 -113t47 -113t113 -47t113 47t47 113t-47 113t-113 47zM384 192q0 -80 -56 -136t-136 -56t-136 56t-56 136t56 136t136 56t136 -56t56 -136zM896 192q0 -80 -56 -136
+t-136 -56t-136 56t-56 136t56 136t136 56t136 -56t56 -136zM384 704q0 -80 -56 -136t-136 -56t-136 56t-56 136t56 136t136 56t136 -56t56 -136zM896 704q0 -80 -56 -136t-136 -56t-136 56t-56 136t56 136t136 56t136 -56t56 -136zM384 1216q0 -80 -56 -136t-136 -56
+t-136 56t-56 136t56 136t136 56t136 -56t56 -136zM1664 192q0 -80 -56 -136t-136 -56t-136 56t-56 136t56 136t136 56t136 -56t56 -136zM896 1216q0 -80 -56 -136t-136 -56t-136 56t-56 136t56 136t136 56t136 -56t56 -136zM2176 192q0 -80 -56 -136t-136 -56t-136 56
+t-56 136t56 136t136 56t136 -56t56 -136zM1664 704q0 -80 -56 -136t-136 -56t-136 56t-56 136t56 136t136 56t136 -56t56 -136zM2176 704q0 -80 -56 -136t-136 -56t-136 56t-56 136t56 136t136 56t136 -56t56 -136zM1664 1216q0 -80 -56 -136t-136 -56t-136 56t-56 136
+t56 136t136 56t136 -56t56 -136zM2176 1216q0 -80 -56 -136t-136 -56t-136 56t-56 136t56 136t136 56t136 -56t56 -136z" />
+    <glyph glyph-name="uniF2A2" unicode="&#xf2a2;" horiz-adv-x="1792" 
+d="M128 -192q0 -26 -19 -45t-45 -19t-45 19t-19 45t19 45t45 19t45 -19t19 -45zM320 0q0 -26 -19 -45t-45 -19t-45 19t-19 45t19 45t45 19t45 -19t19 -45zM365 365l256 -256l-90 -90l-256 256zM704 384q0 -26 -19 -45t-45 -19t-45 19t-19 45t19 45t45 19t45 -19t19 -45z
+M1411 704q0 -59 -11.5 -108.5t-37.5 -93.5t-44 -67.5t-53 -64.5q-31 -35 -45.5 -54t-33.5 -50t-26.5 -64t-7.5 -74q0 -159 -112.5 -271.5t-271.5 -112.5q-26 0 -45 19t-19 45t19 45t45 19q106 0 181 75t75 181q0 57 11.5 105.5t37 91t43.5 66.5t52 63q40 46 59.5 72
+t37.5 74.5t18 103.5q0 185 -131.5 316.5t-316.5 131.5t-316.5 -131.5t-131.5 -316.5q0 -26 -19 -45t-45 -19t-45 19t-19 45q0 117 45.5 223.5t123 184t184 123t223.5 45.5t223.5 -45.5t184 -123t123 -184t45.5 -223.5zM896 576q0 -26 -19 -45t-45 -19t-45 19t-19 45t19 45
+t45 19t45 -19t19 -45zM1184 704q0 -26 -19 -45t-45 -19t-45 19t-19 45q0 93 -65.5 158.5t-158.5 65.5q-92 0 -158 -65.5t-66 -158.5q0 -26 -19 -45t-45 -19t-45 19t-19 45q0 146 103 249t249 103t249 -103t103 -249zM1578 993q10 -25 -1 -49t-36 -34q-9 -4 -23 -4
+q-19 0 -35.5 11t-23.5 30q-68 178 -224 295q-21 16 -25 42t12 47q17 21 43 25t47 -12q183 -137 266 -351zM1788 1074q9 -25 -1.5 -49t-35.5 -34q-11 -4 -23 -4q-44 0 -60 41q-92 238 -297 393q-22 16 -25.5 42t12.5 47q16 22 42 25.5t47 -12.5q235 -175 341 -449z" />
+    <glyph glyph-name="uniF2A3" unicode="&#xf2a3;" horiz-adv-x="2304" 
+d="M1032 576q-59 2 -84 55q-17 34 -48 53.5t-68 19.5q-53 0 -90.5 -37.5t-37.5 -90.5q0 -56 36 -89l10 -8q34 -31 82 -31q37 0 68 19.5t48 53.5q25 53 84 55zM1600 704q0 56 -36 89l-10 8q-34 31 -82 31q-37 0 -68 -19.5t-48 -53.5q-25 -53 -84 -55q59 -2 84 -55
+q17 -34 48 -53.5t68 -19.5q53 0 90.5 37.5t37.5 90.5zM1174 925q-17 -35 -55 -48t-73 4q-62 31 -134 31q-51 0 -99 -17q3 0 9.5 0.5t9.5 0.5q92 0 170.5 -50t118.5 -133q17 -36 3.5 -73.5t-49.5 -54.5q-18 -9 -39 -9q21 0 39 -9q36 -17 49.5 -54.5t-3.5 -73.5
+q-40 -83 -118.5 -133t-170.5 -50h-6q-16 2 -44 4l-290 27l-239 -120q-14 -7 -29 -7q-40 0 -57 35l-160 320q-11 23 -4 47.5t29 37.5l209 119l148 267q17 155 91.5 291.5t195.5 236.5q31 25 70.5 21.5t64.5 -34.5t21.5 -70t-34.5 -65q-70 -59 -117 -128q123 84 267 101
+q40 5 71.5 -19t35.5 -64q5 -40 -19 -71.5t-64 -35.5q-84 -10 -159 -55q46 10 99 10q115 0 218 -50q36 -18 49 -55.5t-5 -73.5zM2137 1085l160 -320q11 -23 4 -47.5t-29 -37.5l-209 -119l-148 -267q-17 -155 -91.5 -291.5t-195.5 -236.5q-26 -22 -61 -22q-45 0 -74 35
+q-25 31 -21.5 70t34.5 65q70 59 117 128q-123 -84 -267 -101q-4 -1 -12 -1q-36 0 -63.5 24t-31.5 60q-5 40 19 71.5t64 35.5q84 10 159 55q-46 -10 -99 -10q-115 0 -218 50q-36 18 -49 55.5t5 73.5q17 35 55 48t73 -4q62 -31 134 -31q51 0 99 17q-3 0 -9.5 -0.5t-9.5 -0.5
+q-92 0 -170.5 50t-118.5 133q-17 36 -3.5 73.5t49.5 54.5q18 9 39 9q-21 0 -39 9q-36 17 -49.5 54.5t3.5 73.5q40 83 118.5 133t170.5 50h6h1q14 -2 42 -4l291 -27l239 120q14 7 29 7q40 0 57 -35z" />
+    <glyph glyph-name="uniF2A4" unicode="&#xf2a4;" horiz-adv-x="1792" 
+d="M1056 704q0 -26 19 -45t45 -19t45 19t19 45q0 146 -103 249t-249 103t-249 -103t-103 -249q0 -26 19 -45t45 -19t45 19t19 45q0 93 66 158.5t158 65.5t158 -65.5t66 -158.5zM835 1280q-117 0 -223.5 -45.5t-184 -123t-123 -184t-45.5 -223.5q0 -26 19 -45t45 -19t45 19
+t19 45q0 185 131.5 316.5t316.5 131.5t316.5 -131.5t131.5 -316.5q0 -55 -18 -103.5t-37.5 -74.5t-59.5 -72q-34 -39 -52 -63t-43.5 -66.5t-37 -91t-11.5 -105.5q0 -106 -75 -181t-181 -75q-26 0 -45 -19t-19 -45t19 -45t45 -19q159 0 271.5 112.5t112.5 271.5q0 41 7.5 74
+t26.5 64t33.5 50t45.5 54q35 41 53 64.5t44 67.5t37.5 93.5t11.5 108.5q0 117 -45.5 223.5t-123 184t-184 123t-223.5 45.5zM591 561l226 -226l-579 -579q-12 -12 -29 -12t-29 12l-168 168q-12 12 -12 29t12 29zM1612 1524l168 -168q12 -12 12 -29t-12 -30l-233 -233
+l-26 -25l-71 -71q-66 153 -195 258l91 91l207 207q13 12 30 12t29 -12z" />
+    <glyph glyph-name="uniF2A5" unicode="&#xf2a5;" 
+d="M866 1021q0 -27 -13 -94q-11 -50 -31.5 -150t-30.5 -150q-2 -11 -4.5 -12.5t-13.5 -2.5q-20 -2 -31 -2q-58 0 -84 49.5t-26 113.5q0 88 35 174t103 124q28 14 51 14q28 0 36.5 -16.5t8.5 -47.5zM1352 597q0 14 -39 75.5t-52 66.5q-21 8 -34 8q-91 0 -226 -77l-2 2
+q3 22 27.5 135t24.5 178q0 233 -242 233q-24 0 -68 -6q-94 -17 -168.5 -89.5t-111.5 -166.5t-37 -189q0 -146 80.5 -225t227.5 -79q25 0 25 -3t-1 -5q-4 -34 -26 -117q-14 -52 -51.5 -101t-82.5 -49q-42 0 -42 47q0 24 10.5 47.5t25 39.5t29.5 28.5t26 20t11 8.5q0 3 -7 10
+q-24 22 -58.5 36.5t-65.5 14.5q-35 0 -63.5 -34t-41 -75t-12.5 -75q0 -88 51.5 -142t138.5 -54q82 0 155 53t117.5 126t65.5 153q6 22 15.5 66.5t14.5 66.5q3 12 14 18q118 60 227 60q48 0 127 -18q1 -1 4 -1q5 0 9.5 4.5t4.5 8.5zM1536 1120v-960q0 -119 -84.5 -203.5
+t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="uniF2A6" unicode="&#xf2a6;" horiz-adv-x="1535" 
+d="M744 1231q0 24 -2 38.5t-8.5 30t-21 23t-37.5 7.5q-39 0 -78 -23q-105 -58 -159 -190.5t-54 -269.5q0 -44 8.5 -85.5t26.5 -80.5t52.5 -62.5t81.5 -23.5q4 0 18 -0.5t20 0t16 3t15 8.5t7 16q16 77 48 231.5t48 231.5q19 91 19 146zM1498 575q0 -7 -7.5 -13.5t-15.5 -6.5
+l-6 1q-22 3 -62 11t-72 12.5t-63 4.5q-167 0 -351 -93q-15 -8 -21 -27q-10 -36 -24.5 -105.5t-22.5 -100.5q-23 -91 -70 -179.5t-112.5 -164.5t-154.5 -123t-185 -47q-135 0 -214.5 83.5t-79.5 219.5q0 53 19.5 117t63 116.5t97.5 52.5q38 0 120 -33.5t83 -61.5
+q0 -1 -16.5 -12.5t-39.5 -31t-46 -44.5t-39 -61t-16 -74q0 -33 16.5 -53t48.5 -20q45 0 85 31.5t66.5 78t48 105.5t32.5 107t16 90v9q0 2 -3.5 3.5t-8.5 1.5h-10t-10 -0.5t-6 -0.5q-227 0 -352 122.5t-125 348.5q0 108 34.5 221t96 210t156 167.5t204.5 89.5q52 9 106 9
+q374 0 374 -360q0 -98 -38 -273t-43 -211l3 -3q101 57 182.5 88t167.5 31q22 0 53 -13q19 -7 80 -102.5t61 -116.5z" />
+    <glyph glyph-name="uniF2A7" unicode="&#xf2a7;" horiz-adv-x="1664" 
+d="M831 863q32 0 59 -18l222 -148q61 -40 110 -97l146 -170q40 -46 29 -106l-72 -413q-6 -32 -29.5 -53.5t-55.5 -25.5l-527 -56l-352 -32h-9q-39 0 -67.5 28t-28.5 68q0 37 27 64t65 32l260 32h-448q-41 0 -69.5 30t-26.5 71q2 39 32 65t69 26l442 1l-521 64q-41 5 -66 37
+t-19 73q6 35 34.5 57.5t65.5 22.5h10l481 -60l-351 94q-38 10 -62 41.5t-18 68.5q6 36 33 58.5t62 22.5q6 0 20 -2l448 -96l217 -37q1 0 3 -0.5t3 -0.5q23 0 30.5 23t-12.5 36l-186 125q-35 23 -42 63.5t18 73.5q27 38 76 38zM761 661l186 -125l-218 37l-5 2l-36 38
+l-238 262q-1 1 -2.5 3.5t-2.5 3.5q-24 31 -18.5 70t37.5 64q31 23 68 17.5t64 -33.5l142 -147q-2 -1 -5 -3.5t-4 -4.5q-32 -45 -23 -99t55 -85zM1648 1115l15 -266q4 -73 -11 -147l-48 -219q-12 -59 -67 -87l-106 -54q2 62 -39 109l-146 170q-53 61 -117 103l-222 148
+q-34 23 -76 23q-51 0 -88 -37l-235 312q-25 33 -18 73.5t41 63.5q33 22 71.5 14t62.5 -40l266 -352l-262 455q-21 35 -10.5 75t47.5 59q35 18 72.5 6t57.5 -46l241 -420l-136 337q-15 35 -4.5 74t44.5 56q37 19 76 6t56 -51l193 -415l101 -196q8 -15 23 -17.5t27 7.5t11 26
+l-12 224q-2 41 26 71t69 31q39 0 67 -28.5t30 -67.5z" />
+    <glyph glyph-name="uniF2A8" unicode="&#xf2a8;" horiz-adv-x="1792" 
+d="M335 180q-2 0 -6 2q-86 57 -168.5 145t-139.5 180q-21 30 -21 69q0 9 2 19t4 18t7 18t8.5 16t10.5 17t10 15t12 15.5t11 14.5q184 251 452 365q-110 198 -110 211q0 19 17 29q116 64 128 64q18 0 28 -16l124 -229q92 19 192 19q266 0 497.5 -137.5t378.5 -369.5
+q20 -31 20 -69t-20 -69q-91 -142 -218.5 -253.5t-278.5 -175.5q110 -198 110 -211q0 -20 -17 -29q-116 -64 -127 -64q-19 0 -29 16l-124 229l-64 119l-444 820l7 7q-58 -24 -99 -47q3 -5 127 -234t243 -449t119 -223q0 -7 -9 -9q-13 -3 -72 -3q-57 0 -60 7l-456 841
+q-39 -28 -82 -68q24 -43 214 -393.5t190 -354.5q0 -10 -11 -10q-14 0 -82.5 22t-72.5 28l-106 197l-224 413q-44 -53 -78 -106q2 -3 18 -25t23 -34l176 -327q0 -10 -10 -10zM1165 282l49 -91q273 111 450 385q-180 277 -459 389q67 -64 103 -148.5t36 -176.5
+q0 -106 -47 -200.5t-132 -157.5zM848 896q0 -20 14 -34t34 -14q86 0 147 -61t61 -147q0 -20 14 -34t34 -14t34 14t14 34q0 126 -89 215t-215 89q-20 0 -34 -14t-14 -34zM1214 961l-9 4l7 -7z" />
+    <glyph glyph-name="uniF2A9" unicode="&#xf2a9;" horiz-adv-x="1280" 
+d="M1050 430q0 -215 -147 -374q-148 -161 -378 -161q-232 0 -378 161q-147 159 -147 374q0 147 68 270.5t189 196.5t268 73q96 0 182 -31q-32 -62 -39 -126q-66 28 -143 28q-167 0 -280.5 -123t-113.5 -291q0 -170 112.5 -288.5t281.5 -118.5t281 118.5t112 288.5
+q0 89 -32 166q66 13 123 49q41 -98 41 -212zM846 619q0 -192 -79.5 -345t-238.5 -253l-14 -1q-29 0 -62 5q83 32 146.5 102.5t99.5 154.5t58.5 189t30 192.5t7.5 178.5q0 69 -3 103q55 -160 55 -326zM791 947v-2q-73 214 -206 440q88 -59 142.5 -186.5t63.5 -251.5z
+M1035 744q-83 0 -160 75q218 120 290 247q19 37 21 56q-42 -94 -139.5 -166.5t-204.5 -97.5q-35 54 -35 113q0 37 17 79t43 68q46 44 157 74q59 16 106 58.5t74 100.5q74 -105 74 -253q0 -109 -24 -170q-32 -77 -88.5 -130.5t-130.5 -53.5z" />
+    <glyph glyph-name="uniF2AA" unicode="&#xf2aa;" 
+d="M1050 495q0 78 -28 147q-41 -25 -85 -34q22 -50 22 -114q0 -117 -77 -198.5t-193 -81.5t-193.5 81.5t-77.5 198.5q0 115 78 199.5t193 84.5q53 0 98 -19q4 43 27 87q-60 21 -125 21q-154 0 -257.5 -108.5t-103.5 -263.5t103.5 -261t257.5 -106t257.5 106.5t103.5 260.5z
+M872 850q2 -24 2 -71q0 -63 -5 -123t-20.5 -132.5t-40.5 -130t-68.5 -106t-100.5 -70.5q21 -3 42 -3h10q219 139 219 411q0 116 -38 225zM872 850q-4 80 -44 171.5t-98 130.5q92 -156 142 -302zM1207 955q0 102 -51 174q-41 -86 -124 -109q-69 -19 -109 -53.5t-40 -99.5
+q0 -40 24 -77q74 17 140.5 67t95.5 115q-4 -52 -74.5 -111.5t-138.5 -97.5q52 -52 110 -52q51 0 90 37t60 90q17 42 17 117zM1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960q119 0 203.5 -84.5
+t84.5 -203.5z" />
+    <glyph glyph-name="uniF2AB" unicode="&#xf2ab;" 
+d="M1279 388q0 22 -22 27q-67 15 -118 59t-80 108q-7 19 -7 25q0 15 19.5 26t43 17t43 20.5t19.5 36.5q0 19 -18.5 31.5t-38.5 12.5q-12 0 -32 -8t-31 -8q-4 0 -12 2q5 95 5 114q0 79 -17 114q-36 78 -103 121.5t-152 43.5q-199 0 -275 -165q-17 -35 -17 -114q0 -19 5 -114
+q-4 -2 -14 -2q-12 0 -32 7.5t-30 7.5q-21 0 -38.5 -12t-17.5 -32q0 -21 19.5 -35.5t43 -20.5t43 -17t19.5 -26q0 -6 -7 -25q-64 -138 -198 -167q-22 -5 -22 -27q0 -46 137 -68q2 -5 6 -26t11.5 -30.5t23.5 -9.5q12 0 37.5 4.5t39.5 4.5q35 0 67 -15t54 -32.5t57.5 -32.5
+t76.5 -15q43 0 79 15t57.5 32.5t53.5 32.5t67 15q14 0 39.5 -4t38.5 -4q16 0 23 10t11 30t6 25q137 22 137 68zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5
+t103 -385.5z" />
+    <glyph glyph-name="uniF2AC" unicode="&#xf2ac;" horiz-adv-x="1664" 
+d="M848 1408q134 1 240.5 -68.5t163.5 -192.5q27 -58 27 -179q0 -47 -9 -191q14 -7 28 -7q18 0 51 13.5t51 13.5q29 0 56 -18t27 -46q0 -32 -31.5 -54t-69 -31.5t-69 -29t-31.5 -47.5q0 -15 12 -43q37 -82 102.5 -150t144.5 -101q28 -12 80 -23q28 -6 28 -35
+q0 -70 -219 -103q-7 -11 -11 -39t-14 -46.5t-33 -18.5q-20 0 -62 6.5t-64 6.5q-37 0 -62 -5q-32 -5 -63 -22.5t-58 -38t-58 -40.5t-76 -33.5t-99 -13.5q-52 0 -96.5 13.5t-75 33.5t-57.5 40.5t-58 38t-62 22.5q-26 5 -63 5q-24 0 -65.5 -7.5t-58.5 -7.5q-25 0 -35 18.5
+t-14 47.5t-11 40q-219 33 -219 103q0 29 28 35q52 11 80 23q78 32 144.5 101t102.5 150q12 28 12 43q0 28 -31.5 47.5t-69.5 29.5t-69.5 31.5t-31.5 52.5q0 27 26 45.5t55 18.5q15 0 48 -13t53 -13q18 0 32 7q-9 142 -9 190q0 122 27 180q64 137 172 198t264 63z" />
+    <glyph glyph-name="uniF2AD" unicode="&#xf2ad;" 
+d="M1280 388q0 22 -22 27q-67 14 -118 58t-80 109q-7 14 -7 25q0 15 19.5 26t42.5 17t42.5 20.5t19.5 36.5q0 19 -18.5 31.5t-38.5 12.5q-11 0 -31 -8t-32 -8q-4 0 -12 2q5 63 5 115q0 78 -17 114q-36 78 -102.5 121.5t-152.5 43.5q-198 0 -275 -165q-18 -38 -18 -115
+q0 -38 6 -114q-10 -2 -15 -2q-11 0 -31.5 8t-30.5 8q-20 0 -37.5 -12.5t-17.5 -32.5q0 -21 19.5 -35.5t42.5 -20.5t42.5 -17t19.5 -26q0 -11 -7 -25q-64 -138 -198 -167q-22 -5 -22 -27q0 -47 138 -69q2 -5 6 -26t11 -30.5t23 -9.5q13 0 38.5 5t38.5 5q35 0 67.5 -15
+t54.5 -32.5t57.5 -32.5t76.5 -15q43 0 79 15t57.5 32.5t54 32.5t67.5 15q13 0 39 -4.5t39 -4.5q15 0 22.5 9.5t11.5 31t5 24.5q138 22 138 69zM1536 1120v-960q0 -119 -84.5 -203.5t-203.5 -84.5h-960q-119 0 -203.5 84.5t-84.5 203.5v960q0 119 84.5 203.5t203.5 84.5h960
+q119 0 203.5 -84.5t84.5 -203.5z" />
+    <glyph glyph-name="uniF2AE" unicode="&#xf2ae;" horiz-adv-x="2304" 
+d="M2304 1536q-69 -46 -125 -92t-89 -81t-59.5 -71.5t-37.5 -57.5t-22 -44.5t-14 -29.5q-10 -18 -35.5 -136.5t-48.5 -164.5q-15 -29 -50 -60.5t-67.5 -50.5t-72.5 -41t-48 -28q-47 -31 -151 -231q-341 14 -630 -158q-92 -53 -303 -179q47 16 86 31t55 22l15 7
+q71 27 163 64.5t133.5 53.5t108 34.5t142.5 31.5q186 31 465 -7q1 0 10 -3q11 -6 14 -17t-3 -22l-194 -345q-15 -29 -47 -22q-128 24 -354 24q-146 0 -402 -44.5t-392 -46.5q-82 -1 -149 13t-107 37t-61 40t-33 34l-1 1v2q0 6 6 6q138 0 371 55q192 366 374.5 524t383.5 158
+q5 0 14.5 -0.5t38 -5t55 -12t61.5 -24.5t63 -39.5t54 -59t40 -82.5l102 177q2 4 21 42.5t44.5 86.5t61 109.5t84 133.5t100.5 137q66 82 128 141.5t121.5 96.5t92.5 53.5t88 39.5z" />
+    <glyph glyph-name="uniF2B0" unicode="&#xf2b0;" 
+d="M1322 640q0 -45 -5 -76l-236 14l224 -78q-19 -73 -58 -141l-214 103l177 -158q-44 -61 -107 -108l-157 178l103 -215q-61 -37 -140 -59l-79 228l14 -240q-38 -6 -76 -6t-76 6l14 238l-78 -226q-74 19 -140 59l103 215l-157 -178q-59 43 -108 108l178 158l-214 -104
+q-39 69 -58 141l224 79l-237 -14q-5 42 -5 76q0 35 5 77l238 -14l-225 79q19 73 58 140l214 -104l-177 159q46 61 107 108l158 -178l-103 215q67 39 140 58l77 -224l-13 236q36 6 75 6q38 0 76 -6l-14 -237l78 225q74 -19 140 -59l-103 -214l158 178q61 -47 107 -108
+l-177 -159l213 104q37 -62 58 -141l-224 -78l237 14q5 -31 5 -77zM1352 640q0 160 -78.5 295.5t-213 214t-292.5 78.5q-119 0 -227 -46.5t-186.5 -125t-124.5 -187.5t-46 -229q0 -119 46 -228t124.5 -187.5t186.5 -125t227 -46.5q158 0 292.5 78.5t213 214t78.5 294.5z
+M1425 1023v-766l-657 -383l-657 383v766l657 383zM768 -183l708 412v823l-708 411l-708 -411v-823zM1536 1088v-896l-768 -448l-768 448v896l768 448z" />
+    <glyph glyph-name="uniF2B1" unicode="&#xf2b1;" horiz-adv-x="1664" 
+d="M339 1318h691l-26 -72h-665q-110 0 -188.5 -79t-78.5 -189v-771q0 -95 60.5 -169.5t153.5 -93.5q23 -5 98 -5v-72h-45q-140 0 -239.5 100t-99.5 240v771q0 140 99.5 240t239.5 100zM1190 1536h247l-482 -1294q-23 -61 -40.5 -103.5t-45 -98t-54 -93.5t-64.5 -78.5
+t-79.5 -65t-95.5 -41t-116 -18.5v195q163 26 220 182q20 52 20 105q0 54 -20 106l-285 733h228l187 -585zM1664 978v-1111h-795q37 55 45 73h678v1038q0 85 -49.5 155t-129.5 99l25 67q101 -34 163.5 -123.5t62.5 -197.5z" />
+    <glyph glyph-name="uniF2B2" unicode="&#xf2b2;" horiz-adv-x="1792" 
+d="M852 1227q0 -29 -17 -52.5t-45 -23.5t-45 23.5t-17 52.5t17 52.5t45 23.5t45 -23.5t17 -52.5zM688 -149v114q0 30 -20.5 51.5t-50.5 21.5t-50 -21.5t-20 -51.5v-114q0 -30 20.5 -52t49.5 -22q30 0 50.5 22t20.5 52zM860 -149v114q0 30 -20 51.5t-50 21.5t-50.5 -21.5
+t-20.5 -51.5v-114q0 -30 20.5 -52t50.5 -22q29 0 49.5 22t20.5 52zM1034 -149v114q0 30 -20.5 51.5t-50.5 21.5t-50.5 -21.5t-20.5 -51.5v-114q0 -30 20.5 -52t50.5 -22t50.5 22t20.5 52zM1208 -149v114q0 30 -20.5 51.5t-50.5 21.5t-50.5 -21.5t-20.5 -51.5v-114
+q0 -30 20.5 -52t50.5 -22t50.5 22t20.5 52zM1476 535q-84 -160 -232 -259.5t-323 -99.5q-123 0 -229.5 51.5t-178.5 137t-113 197.5t-41 232q0 88 21 174q-104 -175 -104 -390q0 -162 65 -312t185 -251q30 57 91 57q56 0 86 -50q32 50 87 50q56 0 86 -50q32 50 87 50t87 -50
+q30 50 86 50q28 0 52.5 -15.5t37.5 -40.5q112 94 177 231.5t73 287.5zM1326 564q0 75 -72 75q-17 0 -47 -6q-95 -19 -149 -19q-226 0 -226 243q0 86 30 204q-83 -127 -83 -275q0 -150 89 -260.5t235 -110.5q111 0 210 70q13 48 13 79zM884 1223q0 50 -32 89.5t-81 39.5
+t-81 -39.5t-32 -89.5q0 -51 31.5 -90.5t81.5 -39.5t81.5 39.5t31.5 90.5zM1513 884q0 96 -37.5 179t-113 137t-173.5 54q-77 0 -149 -35t-127 -94q-48 -159 -48 -268q0 -104 45.5 -157t147.5 -53q53 0 142 19q36 6 53 6q51 0 77.5 -28t26.5 -80q0 -26 -4 -46
+q75 68 117.5 165.5t42.5 200.5zM1792 667q0 -111 -33.5 -249.5t-93.5 -204.5q-58 -64 -195 -142.5t-228 -104.5l-4 -1v-114q0 -43 -29.5 -75t-72.5 -32q-56 0 -86 50q-32 -50 -87 -50t-87 50q-30 -50 -86 -50q-55 0 -87 50q-30 -50 -86 -50q-47 0 -75 33.5t-28 81.5
+q-90 -68 -198 -68q-118 0 -211 80q54 1 106 20q-113 31 -182 127q32 -7 71 -7q89 0 164 46q-192 192 -240 306q-24 56 -24 160q0 57 9 125.5t31.5 146.5t55 141t86.5 105t120 42q59 0 81 -52q19 29 42 54q2 3 12 13t13 16q10 15 23 38t25 42t28 39q87 111 211.5 177
+t260.5 66q35 0 62 -4q59 64 146 64q83 0 140 -57q5 -5 5 -12q0 -5 -6 -13.5t-12.5 -16t-16 -17l-10.5 -10.5q17 -6 36 -18t19 -24q0 -6 -16 -25q157 -138 197 -378q25 30 60 30q45 0 100 -49q90 -80 90 -279z" />
+    <glyph glyph-name="uniF2B3" unicode="&#xf2b3;" 
+d="M917 631q0 33 -6 64h-362v-132h217q-12 -76 -74.5 -120.5t-142.5 -44.5q-99 0 -169 71.5t-70 170.5t70 170.5t169 71.5q93 0 153 -59l104 101q-108 100 -257 100q-160 0 -272 -112.5t-112 -271.5t112 -271.5t272 -112.5q165 0 266.5 105t101.5 270zM1262 585h109v110
+h-109v110h-110v-110h-110v-110h110v-110h110v110zM1536 640q0 -209 -103 -385.5t-279.5 -279.5t-385.5 -103t-385.5 103t-279.5 279.5t-103 385.5t103 385.5t279.5 279.5t385.5 103t385.5 -103t279.5 -279.5t103 -385.5z" />
+    <glyph glyph-name="uniF2B4" unicode="&#xf2b4;" 
+d="M1536 1024v-839q0 -48 -49 -62q-174 -52 -338 -52q-73 0 -215.5 29.5t-227.5 29.5q-164 0 -370 -48v-338h-160v1368q-63 25 -101 81t-38 124q0 91 64 155t155 64t155 -64t64 -155q0 -68 -38 -124t-101 -81v-68q190 44 343 44q99 0 198 -15q14 -2 111.5 -22.5t149.5 -20.5
+q77 0 165 18q11 2 80 21t89 19q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="uniF2B5" unicode="&#xf2b5;" horiz-adv-x="2304" 
+d="M192 384q40 0 56 32t0 64t-56 32t-56 -32t0 -64t56 -32zM1665 442q-10 13 -38.5 50t-41.5 54t-38 49t-42.5 53t-40.5 47t-45 49l-125 -140q-83 -94 -208.5 -92t-205.5 98q-57 69 -56.5 158t58.5 157l177 206q-22 11 -51 16.5t-47.5 6t-56.5 -0.5t-49 -1q-92 0 -158 -66
+l-158 -158h-155v-544q5 0 21 0.5t22 0t19.5 -2t20.5 -4.5t17.5 -8.5t18.5 -13.5l297 -292q115 -111 227 -111q78 0 125 47q57 -20 112.5 8t72.5 85q74 -6 127 44q20 18 36 45.5t14 50.5q10 -10 43 -10q43 0 77 21t49.5 53t12 71.5t-30.5 73.5zM1824 384h96v512h-93l-157 180
+q-66 76 -169 76h-167q-89 0 -146 -67l-209 -243q-28 -33 -28 -75t27 -75q43 -51 110 -52t111 49l193 218q25 23 53.5 21.5t47 -27t8.5 -56.5q16 -19 56 -63t60 -68q29 -36 82.5 -105.5t64.5 -84.5q52 -66 60 -140zM2112 384q40 0 56 32t0 64t-56 32t-56 -32t0 -64t56 -32z
+M2304 960v-640q0 -26 -19 -45t-45 -19h-434q-27 -65 -82 -106.5t-125 -51.5q-33 -48 -80.5 -81.5t-102.5 -45.5q-42 -53 -104.5 -81.5t-128.5 -24.5q-60 -34 -126 -39.5t-127.5 14t-117 53.5t-103.5 81l-287 282h-358q-26 0 -45 19t-19 45v672q0 26 19 45t45 19h421
+q14 14 47 48t47.5 48t44 40t50.5 37.5t51 25.5t62 19.5t68 5.5h117q99 0 181 -56q82 56 181 56h167q35 0 67 -6t56.5 -14.5t51.5 -26.5t44.5 -31t43 -39.5t39 -42t41 -48t41.5 -48.5h355q26 0 45 -19t19 -45z" />
+    <glyph glyph-name="uniF2B6" unicode="&#xf2b6;" horiz-adv-x="1792" 
+d="M1792 882v-978q0 -66 -47 -113t-113 -47h-1472q-66 0 -113 47t-47 113v978q0 15 11 24q8 7 39 34.5t41.5 36t45.5 37.5t70 55.5t96 73t143.5 107t192.5 140.5q5 4 52.5 40t71.5 52.5t64 35t69 18.5t69 -18.5t65 -35.5t71 -52t52 -40q110 -80 192.5 -140.5t143.5 -107
+t96 -73t70 -55.5t45.5 -37.5t41.5 -36t39 -34.5q11 -9 11 -24zM1228 297q263 191 345 252q11 8 12.5 20.5t-6.5 23.5l-38 52q-8 11 -21 12.5t-24 -6.5q-231 -169 -343 -250q-5 -3 -52 -39t-71.5 -52.5t-64.5 -35t-69 -18.5t-69 18.5t-64.5 35t-71.5 52.5t-52 39
+q-186 134 -343 250q-11 8 -24 6.5t-21 -12.5l-38 -52q-8 -11 -6.5 -23.5t12.5 -20.5q82 -61 345 -252q10 -8 50 -38t65 -47t64 -39.5t77.5 -33.5t75.5 -11t75.5 11t79 34.5t64.5 39.5t65 47.5t48 36.5z" />
+    <glyph glyph-name="uniF2B7" unicode="&#xf2b7;" horiz-adv-x="1792" 
+d="M1474 623l39 -51q8 -11 6.5 -23.5t-11.5 -20.5q-43 -34 -126.5 -98.5t-146.5 -113t-67 -51.5q-39 -32 -60 -48t-60.5 -41t-76.5 -36.5t-74 -11.5h-1h-1q-37 0 -74 11.5t-76 36.5t-61 41.5t-60 47.5q-5 4 -65 50.5t-143.5 111t-122.5 94.5q-11 8 -12.5 20.5t6.5 23.5
+l37 52q8 11 21.5 13t24.5 -7q94 -73 306 -236q5 -4 43.5 -35t60.5 -46.5t56.5 -32.5t58.5 -17h1h1q24 0 58.5 17t56.5 32.5t60.5 46.5t43.5 35q258 198 313 242q11 8 24 6.5t21 -12.5zM1664 -96v928q-90 83 -159 139q-91 74 -389 304q-3 2 -43 35t-61 48t-56 32.5t-59 17.5
+h-1h-1q-24 0 -59 -17.5t-56 -32.5t-61 -48t-43 -35q-215 -166 -315.5 -245.5t-129.5 -104t-82 -74.5q-14 -12 -21 -19v-928q0 -13 9.5 -22.5t22.5 -9.5h1472q13 0 22.5 9.5t9.5 22.5zM1792 832v-928q0 -66 -47 -113t-113 -47h-1472q-66 0 -113 47t-47 113v928q0 56 41 94
+q123 114 350 290.5t233 181.5q36 30 59 47.5t61.5 42t76 36.5t74.5 12h1h1q37 0 74.5 -12t76 -36.5t61.5 -42t59 -47.5q43 -36 156 -122t226 -177t201 -173q41 -38 41 -94z" />
+    <glyph glyph-name="uniF2B8" unicode="&#xf2b8;" 
+d="M330 1l202 -214l-34 236l-216 213zM556 -225l274 218l-11 245l-300 -215zM245 413l227 -213l-48 327l-245 204zM495 189l317 214l-14 324l-352 -200zM843 178l95 -80l-2 239l-103 79q0 -1 1 -8.5t0 -12t-5 -7.5l-78 -52l85 -70q7 -6 7 -88zM138 930l256 -200l-68 465
+l-279 173zM1173 267l15 234l-230 -164l2 -240zM417 722l373 194l-19 441l-423 -163zM1270 357l20 233l-226 142l-2 -105l144 -95q6 -4 4 -9l-7 -119zM1461 496l30 222l-179 -128l-20 -228zM1273 329l-71 49l-8 -117q0 -5 -4 -8l-234 -187q-7 -5 -14 0l-98 83l7 -161
+q0 -5 -4 -8l-293 -234q-4 -2 -6 -2q-8 2 -8 3l-228 242q-4 4 -59 277q-2 7 5 11l61 37q-94 86 -95 92l-72 351q-2 7 6 12l94 45q-133 100 -135 108l-96 466q-2 10 7 13l433 135q5 0 8 -1l317 -153q6 -4 6 -9l20 -463q0 -7 -6 -10l-118 -61l126 -85q5 -2 5 -8l5 -123l121 74
+q5 4 11 0l84 -56l3 110q0 6 5 9l206 126q6 3 11 0l245 -135q4 -4 5 -7t-6.5 -60t-17.5 -124.5t-10 -70.5q0 -5 -4 -7l-191 -153q-6 -5 -13 0z" />
+    <glyph glyph-name="uniF2B9" unicode="&#xf2b9;" horiz-adv-x="1664" 
+d="M1201 298q0 57 -5.5 107t-21 100.5t-39.5 86t-64 58t-91 22.5q-6 -4 -33.5 -20.5t-42.5 -24.5t-40.5 -20t-49 -17t-46.5 -5t-46.5 5t-49 17t-40.5 20t-42.5 24.5t-33.5 20.5q-51 0 -91 -22.5t-64 -58t-39.5 -86t-21 -100.5t-5.5 -107q0 -73 42 -121.5t103 -48.5h576
+q61 0 103 48.5t42 121.5zM1028 892q0 108 -76.5 184t-183.5 76t-183.5 -76t-76.5 -184q0 -107 76.5 -183t183.5 -76t183.5 76t76.5 183zM1664 352v-192q0 -14 -9 -23t-23 -9h-96v-224q0 -66 -47 -113t-113 -47h-1216q-66 0 -113 47t-47 113v1472q0 66 47 113t113 47h1216
+q66 0 113 -47t47 -113v-224h96q14 0 23 -9t9 -23v-192q0 -14 -9 -23t-23 -9h-96v-128h96q14 0 23 -9t9 -23v-192q0 -14 -9 -23t-23 -9h-96v-128h96q14 0 23 -9t9 -23z" />
+    <glyph glyph-name="uniF2BA" unicode="&#xf2ba;" horiz-adv-x="1664" 
+d="M1028 892q0 -107 -76.5 -183t-183.5 -76t-183.5 76t-76.5 183q0 108 76.5 184t183.5 76t183.5 -76t76.5 -184zM980 672q46 0 82.5 -17t60 -47.5t39.5 -67t24 -81t11.5 -82.5t3.5 -79q0 -67 -39.5 -118.5t-105.5 -51.5h-576q-66 0 -105.5 51.5t-39.5 118.5q0 48 4.5 93.5
+t18.5 98.5t36.5 91.5t63 64.5t93.5 26h5q7 -4 32 -19.5t35.5 -21t33 -17t37 -16t35 -9t39.5 -4.5t39.5 4.5t35 9t37 16t33 17t35.5 21t32 19.5zM1664 928q0 -13 -9.5 -22.5t-22.5 -9.5h-96v-128h96q13 0 22.5 -9.5t9.5 -22.5v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-96v-128h96
+q13 0 22.5 -9.5t9.5 -22.5v-192q0 -13 -9.5 -22.5t-22.5 -9.5h-96v-224q0 -66 -47 -113t-113 -47h-1216q-66 0 -113 47t-47 113v1472q0 66 47 113t113 47h1216q66 0 113 -47t47 -113v-224h96q13 0 22.5 -9.5t9.5 -22.5v-192zM1408 -96v1472q0 13 -9.5 22.5t-22.5 9.5h-1216
+q-13 0 -22.5 -9.5t-9.5 -22.5v-1472q0 -13 9.5 -22.5t22.5 -9.5h1216q13 0 22.5 9.5t9.5 22.5z" />
+    <glyph glyph-name="uniF2BB" unicode="&#xf2bb;" horiz-adv-x="2048" 
+d="M1024 405q0 64 -9 117.5t-29.5 103t-60.5 78t-97 28.5q-6 -4 -30 -18t-37.5 -21.5t-35.5 -17.5t-43 -14.5t-42 -4.5t-42 4.5t-43 14.5t-35.5 17.5t-37.5 21.5t-30 18q-57 0 -97 -28.5t-60.5 -78t-29.5 -103t-9 -117.5t37 -106.5t91 -42.5h512q54 0 91 42.5t37 106.5z
+M867 925q0 94 -66.5 160.5t-160.5 66.5t-160.5 -66.5t-66.5 -160.5t66.5 -160.5t160.5 -66.5t160.5 66.5t66.5 160.5zM1792 416v64q0 14 -9 23t-23 9h-576q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h576q14 0 23 9t9 23zM1792 676v56q0 15 -10.5 25.5t-25.5 10.5h-568
+q-15 0 -25.5 -10.5t-10.5 -25.5v-56q0 -15 10.5 -25.5t25.5 -10.5h568q15 0 25.5 10.5t10.5 25.5zM1792 928v64q0 14 -9 23t-23 9h-576q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h576q14 0 23 9t9 23zM2048 1248v-1216q0 -66 -47 -113t-113 -47h-352v96q0 14 -9 23t-23 9
+h-64q-14 0 -23 -9t-9 -23v-96h-768v96q0 14 -9 23t-23 9h-64q-14 0 -23 -9t-9 -23v-96h-352q-66 0 -113 47t-47 113v1216q0 66 47 113t113 47h1728q66 0 113 -47t47 -113z" />
+    <glyph glyph-name="uniF2BC" unicode="&#xf2bc;" horiz-adv-x="2048" 
+d="M1024 405q0 -64 -37 -106.5t-91 -42.5h-512q-54 0 -91 42.5t-37 106.5t9 117.5t29.5 103t60.5 78t97 28.5q6 -4 30 -18t37.5 -21.5t35.5 -17.5t43 -14.5t42 -4.5t42 4.5t43 14.5t35.5 17.5t37.5 21.5t30 18q57 0 97 -28.5t60.5 -78t29.5 -103t9 -117.5zM867 925
+q0 -94 -66.5 -160.5t-160.5 -66.5t-160.5 66.5t-66.5 160.5t66.5 160.5t160.5 66.5t160.5 -66.5t66.5 -160.5zM1792 480v-64q0 -14 -9 -23t-23 -9h-576q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h576q14 0 23 -9t9 -23zM1792 732v-56q0 -15 -10.5 -25.5t-25.5 -10.5h-568
+q-15 0 -25.5 10.5t-10.5 25.5v56q0 15 10.5 25.5t25.5 10.5h568q15 0 25.5 -10.5t10.5 -25.5zM1792 992v-64q0 -14 -9 -23t-23 -9h-576q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h576q14 0 23 -9t9 -23zM1920 32v1216q0 13 -9.5 22.5t-22.5 9.5h-1728q-13 0 -22.5 -9.5
+t-9.5 -22.5v-1216q0 -13 9.5 -22.5t22.5 -9.5h352v96q0 14 9 23t23 9h64q14 0 23 -9t9 -23v-96h768v96q0 14 9 23t23 9h64q14 0 23 -9t9 -23v-96h352q13 0 22.5 9.5t9.5 22.5zM2048 1248v-1216q0 -66 -47 -113t-113 -47h-1728q-66 0 -113 47t-47 113v1216q0 66 47 113
+t113 47h1728q66 0 113 -47t47 -113z" />
+    <glyph glyph-name="uniF2BD" unicode="&#xf2bd;" horiz-adv-x="1792" 
+d="M1523 197q-22 155 -87.5 257.5t-184.5 118.5q-67 -74 -159.5 -115.5t-195.5 -41.5t-195.5 41.5t-159.5 115.5q-119 -16 -184.5 -118.5t-87.5 -257.5q106 -150 271 -237.5t356 -87.5t356 87.5t271 237.5zM1280 896q0 159 -112.5 271.5t-271.5 112.5t-271.5 -112.5
+t-112.5 -271.5t112.5 -271.5t271.5 -112.5t271.5 112.5t112.5 271.5zM1792 640q0 -182 -71 -347.5t-190.5 -286t-285.5 -191.5t-349 -71q-182 0 -348 71t-286 191t-191 286t-71 348t71 348t191 286t286 191t348 71t348 -71t286 -191t191 -286t71 -348z" />
+    <glyph glyph-name="uniF2BE" unicode="&#xf2be;" horiz-adv-x="1792" 
+d="M896 1536q182 0 348 -71t286 -191t191 -286t71 -348q0 -181 -70.5 -347t-190.5 -286t-286 -191.5t-349 -71.5t-349 71t-285.5 191.5t-190.5 286t-71 347.5t71 348t191 286t286 191t348 71zM1515 185q149 205 149 455q0 156 -61 298t-164 245t-245 164t-298 61t-298 -61
+t-245 -164t-164 -245t-61 -298q0 -250 149 -455q66 327 306 327q131 -128 313 -128t313 128q240 0 306 -327zM1280 832q0 159 -112.5 271.5t-271.5 112.5t-271.5 -112.5t-112.5 -271.5t112.5 -271.5t271.5 -112.5t271.5 112.5t112.5 271.5z" />
+    <glyph glyph-name="uniF2C0" unicode="&#xf2c0;" 
+d="M1201 752q47 -14 89.5 -38t89 -73t79.5 -115.5t55 -172t22 -236.5q0 -154 -100 -263.5t-241 -109.5h-854q-141 0 -241 109.5t-100 263.5q0 131 22 236.5t55 172t79.5 115.5t89 73t89.5 38q-79 125 -79 272q0 104 40.5 198.5t109.5 163.5t163.5 109.5t198.5 40.5
+t198.5 -40.5t163.5 -109.5t109.5 -163.5t40.5 -198.5q0 -147 -79 -272zM768 1408q-159 0 -271.5 -112.5t-112.5 -271.5t112.5 -271.5t271.5 -112.5t271.5 112.5t112.5 271.5t-112.5 271.5t-271.5 112.5zM1195 -128q88 0 150.5 71.5t62.5 173.5q0 239 -78.5 377t-225.5 145
+q-145 -127 -336 -127t-336 127q-147 -7 -225.5 -145t-78.5 -377q0 -102 62.5 -173.5t150.5 -71.5h854z" />
+    <glyph glyph-name="uniF2C1" unicode="&#xf2c1;" horiz-adv-x="1280" 
+d="M1024 278q0 -64 -37 -107t-91 -43h-512q-54 0 -91 43t-37 107t9 118t29.5 104t61 78.5t96.5 28.5q80 -75 188 -75t188 75q56 0 96.5 -28.5t61 -78.5t29.5 -104t9 -118zM870 797q0 -94 -67.5 -160.5t-162.5 -66.5t-162.5 66.5t-67.5 160.5t67.5 160.5t162.5 66.5
+t162.5 -66.5t67.5 -160.5zM1152 -96v1376h-1024v-1376q0 -13 9.5 -22.5t22.5 -9.5h960q13 0 22.5 9.5t9.5 22.5zM1280 1376v-1472q0 -66 -47 -113t-113 -47h-960q-66 0 -113 47t-47 113v1472q0 66 47 113t113 47h352v-96q0 -14 9 -23t23 -9h192q14 0 23 9t9 23v96h352
+q66 0 113 -47t47 -113z" />
+    <glyph glyph-name="uniF2C2" unicode="&#xf2c2;" horiz-adv-x="2048" 
+d="M896 324q0 54 -7.5 100.5t-24.5 90t-51 68.5t-81 25q-64 -64 -156 -64t-156 64q-47 0 -81 -25t-51 -68.5t-24.5 -90t-7.5 -100.5q0 -55 31.5 -93.5t75.5 -38.5h426q44 0 75.5 38.5t31.5 93.5zM768 768q0 80 -56 136t-136 56t-136 -56t-56 -136t56 -136t136 -56t136 56
+t56 136zM1792 288v64q0 14 -9 23t-23 9h-704q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h704q14 0 23 9t9 23zM1408 544v64q0 14 -9 23t-23 9h-320q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h320q14 0 23 9t9 23zM1792 544v64q0 14 -9 23t-23 9h-192q-14 0 -23 -9t-9 -23
+v-64q0 -14 9 -23t23 -9h192q14 0 23 9t9 23zM1792 800v64q0 14 -9 23t-23 9h-704q-14 0 -23 -9t-9 -23v-64q0 -14 9 -23t23 -9h704q14 0 23 9t9 23zM128 1152h1792v96q0 14 -9 23t-23 9h-1728q-14 0 -23 -9t-9 -23v-96zM2048 1248v-1216q0 -66 -47 -113t-113 -47h-1728
+q-66 0 -113 47t-47 113v1216q0 66 47 113t113 47h1728q66 0 113 -47t47 -113z" />
+    <glyph glyph-name="uniF2C3" unicode="&#xf2c3;" horiz-adv-x="2048" 
+d="M896 324q0 -55 -31.5 -93.5t-75.5 -38.5h-426q-44 0 -75.5 38.5t-31.5 93.5q0 54 7.5 100.5t24.5 90t51 68.5t81 25q64 -64 156 -64t156 64q47 0 81 -25t51 -68.5t24.5 -90t7.5 -100.5zM768 768q0 -80 -56 -136t-136 -56t-136 56t-56 136t56 136t136 56t136 -56t56 -136z
+M1792 352v-64q0 -14 -9 -23t-23 -9h-704q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h704q14 0 23 -9t9 -23zM1408 608v-64q0 -14 -9 -23t-23 -9h-320q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h320q14 0 23 -9t9 -23zM1792 608v-64q0 -14 -9 -23t-23 -9h-192q-14 0 -23 9t-9 23v64
+q0 14 9 23t23 9h192q14 0 23 -9t9 -23zM1792 864v-64q0 -14 -9 -23t-23 -9h-704q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h704q14 0 23 -9t9 -23zM1920 32v1120h-1792v-1120q0 -13 9.5 -22.5t22.5 -9.5h1728q13 0 22.5 9.5t9.5 22.5zM2048 1248v-1216q0 -66 -47 -113t-113 -47
+h-1728q-66 0 -113 47t-47 113v1216q0 66 47 113t113 47h1728q66 0 113 -47t47 -113z" />
+    <glyph glyph-name="uniF2C4" unicode="&#xf2c4;" horiz-adv-x="1792" 
+d="M1255 749q0 318 -105 474.5t-330 156.5q-222 0 -326 -157t-104 -474q0 -316 104 -471.5t326 -155.5q74 0 131 17q-22 43 -39 73t-44 65t-53.5 56.5t-63 36t-77.5 14.5q-46 0 -79 -16l-49 97q105 91 276 91q132 0 215.5 -54t150.5 -155q67 149 67 402zM1645 117h117
+q3 -27 -2 -67t-26.5 -95t-58 -100.5t-107 -78t-162.5 -32.5q-71 0 -130.5 19t-105.5 56t-79 78t-66 96q-97 -27 -205 -27q-150 0 -292.5 58t-253 158.5t-178 249t-67.5 317.5q0 170 67.5 319.5t178.5 250.5t253.5 159t291.5 58q121 0 238.5 -36t217 -106t176 -164.5
+t119.5 -219t43 -261.5q0 -190 -80.5 -347.5t-218.5 -264.5q47 -70 93.5 -106.5t104.5 -36.5q61 0 94 37.5t38 85.5z" />
+    <glyph glyph-name="uniF2C5" unicode="&#xf2c5;" horiz-adv-x="2304" 
+d="M453 -101q0 -21 -16 -37.5t-37 -16.5q-1 0 -13 3q-63 15 -162 140q-225 284 -225 676q0 341 213 614q39 51 95 103.5t94 52.5q19 0 35 -13.5t16 -32.5q0 -27 -63 -90q-98 -102 -147 -184q-119 -199 -119 -449q0 -281 123 -491q50 -85 136 -173q2 -3 14.5 -16t19.5 -21
+t17 -20.5t14.5 -23.5t4.5 -21zM1796 33q0 -29 -17.5 -48.5t-46.5 -19.5h-1081q-26 0 -45 19t-19 45q0 29 17.5 48.5t46.5 19.5h1081q26 0 45 -19t19 -45zM1581 644q0 -134 -67 -233q-25 -38 -69.5 -78.5t-83.5 -60.5q-16 -10 -27 -10q-7 0 -15 6t-8 12q0 9 19 30t42 46
+t42 67.5t19 88.5q0 76 -35 130q-29 42 -46 42q-3 0 -3 -5q0 -12 7.5 -35.5t7.5 -36.5q0 -22 -21.5 -35t-44.5 -13q-66 0 -66 76q0 15 1.5 44t1.5 44q0 25 -10 46q-13 25 -42 53.5t-51 28.5q-5 0 -7 -0.5t-3.5 -2.5t-1.5 -6q0 -2 16 -26t16 -54q0 -37 -19 -68t-46 -54
+t-53.5 -46t-45.5 -54t-19 -68q0 -98 42 -160q29 -43 79 -63q16 -5 17 -10q1 -2 1 -5q0 -16 -18 -16q-6 0 -33 11q-119 43 -195 139.5t-76 218.5q0 55 24.5 115.5t60 115t70.5 108.5t59.5 113.5t24.5 111.5q0 53 -25 94q-29 48 -56 64q-19 9 -19 21q0 20 41 20q50 0 110 -29
+q41 -19 71 -44.5t49.5 -51t33.5 -62.5t22 -69t16 -80q0 -1 3 -17.5t4.5 -25t5.5 -25t9 -27t11 -21.5t14.5 -16.5t18.5 -5.5q23 0 37 14t14 37q0 25 -20 67t-20 52t10 10q27 0 93 -70q72 -76 102.5 -156t30.5 -186zM2304 615q0 -274 -138 -503q-19 -32 -48 -72t-68 -86.5
+t-81 -77t-74 -30.5q-16 0 -31 15.5t-15 31.5q0 15 29 50.5t68.5 77t48.5 52.5q183 230 183 531q0 131 -20.5 235t-72.5 211q-58 119 -163 228q-2 3 -13 13.5t-16.5 16.5t-15 17.5t-15 20t-9.5 18.5t-4 19q0 19 16 35.5t35 16.5q70 0 196 -169q98 -131 146 -273t60 -314
+q2 -42 2 -64z" />
+    <glyph glyph-name="uniF2C6" unicode="&#xf2c6;" horiz-adv-x="1792" 
+d="M1189 229l147 693q9 44 -10.5 63t-51.5 7l-864 -333q-29 -11 -39.5 -25t-2.5 -26.5t32 -19.5l221 -69l513 323q21 14 32 6q7 -5 -4 -15l-415 -375v0v0l-16 -228q23 0 45 22l108 104l224 -165q64 -36 81 38zM1792 640q0 -182 -71 -348t-191 -286t-286 -191t-348 -71
+t-348 71t-286 191t-191 286t-71 348t71 348t191 286t286 191t348 71t348 -71t286 -191t191 -286t71 -348z" />
+    <glyph glyph-name="uniF2C7" unicode="&#xf2c7;" horiz-adv-x="1024" 
+d="M640 192q0 -80 -56 -136t-136 -56t-136 56t-56 136q0 60 35 110t93 71v907h128v-907q58 -21 93 -71t35 -110zM768 192q0 77 -34 144t-94 112v768q0 80 -56 136t-136 56t-136 -56t-56 -136v-768q-60 -45 -94 -112t-34 -144q0 -133 93.5 -226.5t226.5 -93.5t226.5 93.5
+t93.5 226.5zM896 192q0 -185 -131.5 -316.5t-316.5 -131.5t-316.5 131.5t-131.5 316.5q0 182 128 313v711q0 133 93.5 226.5t226.5 93.5t226.5 -93.5t93.5 -226.5v-711q128 -131 128 -313zM1024 768v-128h-192v128h192zM1024 1024v-128h-192v128h192zM1024 1280v-128h-192
+v128h192z" />
+    <glyph glyph-name="uniF2C8" unicode="&#xf2c8;" horiz-adv-x="1024" 
+d="M640 192q0 -80 -56 -136t-136 -56t-136 56t-56 136q0 60 35 110t93 71v651h128v-651q58 -21 93 -71t35 -110zM768 192q0 77 -34 144t-94 112v768q0 80 -56 136t-136 56t-136 -56t-56 -136v-768q-60 -45 -94 -112t-34 -144q0 -133 93.5 -226.5t226.5 -93.5t226.5 93.5
+t93.5 226.5zM896 192q0 -185 -131.5 -316.5t-316.5 -131.5t-316.5 131.5t-131.5 316.5q0 182 128 313v711q0 133 93.5 226.5t226.5 93.5t226.5 -93.5t93.5 -226.5v-711q128 -131 128 -313zM1024 768v-128h-192v128h192zM1024 1024v-128h-192v128h192zM1024 1280v-128h-192
+v128h192z" />
+    <glyph glyph-name="uniF2C9" unicode="&#xf2c9;" horiz-adv-x="1024" 
+d="M640 192q0 -80 -56 -136t-136 -56t-136 56t-56 136q0 60 35 110t93 71v395h128v-395q58 -21 93 -71t35 -110zM768 192q0 77 -34 144t-94 112v768q0 80 -56 136t-136 56t-136 -56t-56 -136v-768q-60 -45 -94 -112t-34 -144q0 -133 93.5 -226.5t226.5 -93.5t226.5 93.5
+t93.5 226.5zM896 192q0 -185 -131.5 -316.5t-316.5 -131.5t-316.5 131.5t-131.5 316.5q0 182 128 313v711q0 133 93.5 226.5t226.5 93.5t226.5 -93.5t93.5 -226.5v-711q128 -131 128 -313zM1024 768v-128h-192v128h192zM1024 1024v-128h-192v128h192zM1024 1280v-128h-192
+v128h192z" />
+    <glyph glyph-name="uniF2CA" unicode="&#xf2ca;" horiz-adv-x="1024" 
+d="M640 192q0 -80 -56 -136t-136 -56t-136 56t-56 136q0 60 35 110t93 71v139h128v-139q58 -21 93 -71t35 -110zM768 192q0 77 -34 144t-94 112v768q0 80 -56 136t-136 56t-136 -56t-56 -136v-768q-60 -45 -94 -112t-34 -144q0 -133 93.5 -226.5t226.5 -93.5t226.5 93.5
+t93.5 226.5zM896 192q0 -185 -131.5 -316.5t-316.5 -131.5t-316.5 131.5t-131.5 316.5q0 182 128 313v711q0 133 93.5 226.5t226.5 93.5t226.5 -93.5t93.5 -226.5v-711q128 -131 128 -313zM1024 768v-128h-192v128h192zM1024 1024v-128h-192v128h192zM1024 1280v-128h-192
+v128h192z" />
+    <glyph glyph-name="uniF2CB" unicode="&#xf2cb;" horiz-adv-x="1024" 
+d="M640 192q0 -80 -56 -136t-136 -56t-136 56t-56 136q0 79 56 135.5t136 56.5t136 -56.5t56 -135.5zM768 192q0 77 -34 144t-94 112v768q0 80 -56 136t-136 56t-136 -56t-56 -136v-768q-60 -45 -94 -112t-34 -144q0 -133 93.5 -226.5t226.5 -93.5t226.5 93.5t93.5 226.5z
+M896 192q0 -185 -131.5 -316.5t-316.5 -131.5t-316.5 131.5t-131.5 316.5q0 182 128 313v711q0 133 93.5 226.5t226.5 93.5t226.5 -93.5t93.5 -226.5v-711q128 -131 128 -313zM1024 768v-128h-192v128h192zM1024 1024v-128h-192v128h192zM1024 1280v-128h-192v128h192z" />
+    <glyph glyph-name="uniF2CC" unicode="&#xf2cc;" horiz-adv-x="1920" 
+d="M1433 1287q10 -10 10 -23t-10 -23l-626 -626q-10 -10 -23 -10t-23 10l-82 82q-10 10 -10 23t10 23l44 44q-72 91 -81.5 207t46.5 215q-74 71 -176 71q-106 0 -181 -75t-75 -181v-1280h-256v1280q0 104 40.5 198.5t109.5 163.5t163.5 109.5t198.5 40.5q106 0 201 -41
+t166 -115q94 39 197 24.5t185 -79.5l44 44q10 10 23 10t23 -10zM1344 1024q26 0 45 -19t19 -45t-19 -45t-45 -19t-45 19t-19 45t19 45t45 19zM1600 896q-26 0 -45 19t-19 45t19 45t45 19t45 -19t19 -45t-19 -45t-45 -19zM1856 1024q26 0 45 -19t19 -45t-19 -45t-45 -19
+t-45 19t-19 45t19 45t45 19zM1216 896q26 0 45 -19t19 -45t-19 -45t-45 -19t-45 19t-19 45t19 45t45 19zM1408 832q0 26 19 45t45 19t45 -19t19 -45t-19 -45t-45 -19t-45 19t-19 45zM1728 896q26 0 45 -19t19 -45t-19 -45t-45 -19t-45 19t-19 45t19 45t45 19zM1088 768
+q26 0 45 -19t19 -45t-19 -45t-45 -19t-45 19t-19 45t19 45t45 19zM1344 640q-26 0 -45 19t-19 45t19 45t45 19t45 -19t19 -45t-19 -45t-45 -19zM1600 768q26 0 45 -19t19 -45t-19 -45t-45 -19t-45 19t-19 45t19 45t45 19zM1216 512q-26 0 -45 19t-19 45t19 45t45 19t45 -19
+t19 -45t-19 -45t-45 -19zM1472 640q26 0 45 -19t19 -45t-19 -45t-45 -19t-45 19t-19 45t19 45t45 19zM1088 512q26 0 45 -19t19 -45t-19 -45t-45 -19t-45 19t-19 45t19 45t45 19zM1344 512q26 0 45 -19t19 -45t-19 -45t-45 -19t-45 19t-19 45t19 45t45 19zM1216 384
+q26 0 45 -19t19 -45t-19 -45t-45 -19t-45 19t-19 45t19 45t45 19zM1088 256q26 0 45 -19t19 -45t-19 -45t-45 -19t-45 19t-19 45t19 45t45 19z" />
+    <glyph glyph-name="uniF2CD" unicode="&#xf2cd;" horiz-adv-x="1792" 
+d="M1664 448v-192q0 -169 -128 -286v-194q0 -14 -9 -23t-23 -9h-64q-14 0 -23 9t-9 23v118q-63 -22 -128 -22h-768q-65 0 -128 22v-110q0 -17 -9.5 -28.5t-22.5 -11.5h-64q-13 0 -22.5 11.5t-9.5 28.5v186q-128 117 -128 286v192h1536zM704 864q0 -14 -9 -23t-23 -9t-23 9
+t-9 23t9 23t23 9t23 -9t9 -23zM768 928q0 -14 -9 -23t-23 -9t-23 9t-9 23t9 23t23 9t23 -9t9 -23zM704 992q0 -14 -9 -23t-23 -9t-23 9t-9 23t9 23t23 9t23 -9t9 -23zM832 992q0 -14 -9 -23t-23 -9t-23 9t-9 23t9 23t23 9t23 -9t9 -23zM768 1056q0 -14 -9 -23t-23 -9t-23 9
+t-9 23t9 23t23 9t23 -9t9 -23zM704 1120q0 -14 -9 -23t-23 -9t-23 9t-9 23t9 23t23 9t23 -9t9 -23zM1792 608v-64q0 -14 -9 -23t-23 -9h-1728q-14 0 -23 9t-9 23v64q0 14 9 23t23 9h96v640q0 106 75 181t181 75q108 0 184 -78q46 19 98 12t93 -39l22 22q11 11 22 0l42 -42
+q11 -11 0 -22l-314 -314q-11 -11 -22 0l-42 42q-11 11 0 22l22 22q-36 46 -40.5 104t23.5 108q-37 35 -88 35q-53 0 -90.5 -37.5t-37.5 -90.5v-640h1504q14 0 23 -9t9 -23zM896 1056q0 -14 -9 -23t-23 -9t-23 9t-9 23t9 23t23 9t23 -9t9 -23zM832 1120q0 -14 -9 -23t-23 -9
+t-23 9t-9 23t9 23t23 9t23 -9t9 -23zM768 1184q0 -14 -9 -23t-23 -9t-23 9t-9 23t9 23t23 9t23 -9t9 -23zM960 1120q0 -14 -9 -23t-23 -9t-23 9t-9 23t9 23t23 9t23 -9t9 -23zM896 1184q0 -14 -9 -23t-23 -9t-23 9t-9 23t9 23t23 9t23 -9t9 -23zM832 1248q0 -14 -9 -23
+t-23 -9t-23 9t-9 23t9 23t23 9t23 -9t9 -23zM1024 1184q0 -14 -9 -23t-23 -9t-23 9t-9 23t9 23t23 9t23 -9t9 -23zM960 1248q0 -14 -9 -23t-23 -9t-23 9t-9 23t9 23t23 9t23 -9t9 -23zM1088 1248q0 -14 -9 -23t-23 -9t-23 9t-9 23t9 23t23 9t23 -9t9 -23z" />
+    <glyph glyph-name="uniF2CE" unicode="&#xf2ce;" 
+d="M994 344q0 -86 -17 -197q-31 -215 -55 -313q-22 -90 -152 -90t-152 90q-24 98 -55 313q-17 110 -17 197q0 168 224 168t224 -168zM1536 768q0 -240 -134 -434t-350 -280q-8 -3 -15 3t-6 15q7 48 10 66q4 32 6 47q1 9 9 12q159 81 255.5 234t96.5 337q0 180 -91 330.5
+t-247 234.5t-337 74q-124 -7 -237 -61t-193.5 -140.5t-128 -202t-46.5 -240.5q1 -184 99 -336.5t257 -231.5q7 -3 9 -12q3 -21 6 -45q1 -9 5 -32.5t6 -35.5q1 -9 -6.5 -15t-15.5 -2q-148 58 -261 169.5t-173.5 264t-52.5 319.5q7 143 66 273.5t154.5 227t225 157.5t272.5 70
+q164 10 315.5 -46.5t261 -160.5t175 -250.5t65.5 -308.5zM994 800q0 -93 -65.5 -158.5t-158.5 -65.5t-158.5 65.5t-65.5 158.5t65.5 158.5t158.5 65.5t158.5 -65.5t65.5 -158.5zM1282 768q0 -122 -53.5 -228.5t-146.5 -177.5q-8 -6 -16 -2t-10 14q-6 52 -29 92q-7 10 3 20
+q58 54 91 127t33 155q0 111 -58.5 204t-157.5 141.5t-212 36.5q-133 -15 -229 -113t-109 -231q-10 -92 23.5 -176t98.5 -144q10 -10 3 -20q-24 -41 -29 -93q-2 -9 -10 -13t-16 2q-95 74 -148.5 183t-51.5 234q3 131 69 244t177 181.5t241 74.5q144 7 268 -60t196.5 -187.5
+t72.5 -263.5z" />
+    <glyph glyph-name="uniF2D0" unicode="&#xf2d0;" horiz-adv-x="1792" 
+d="M256 128h1280v768h-1280v-768zM1792 1248v-1216q0 -66 -47 -113t-113 -47h-1472q-66 0 -113 47t-47 113v1216q0 66 47 113t113 47h1472q66 0 113 -47t47 -113z" />
+    <glyph glyph-name="uniF2D1" unicode="&#xf2d1;" horiz-adv-x="1792" 
+d="M1792 224v-192q0 -66 -47 -113t-113 -47h-1472q-66 0 -113 47t-47 113v192q0 66 47 113t113 47h1472q66 0 113 -47t47 -113z" />
+    <glyph glyph-name="uniF2D2" unicode="&#xf2d2;" horiz-adv-x="2048" 
+d="M256 0h768v512h-768v-512zM1280 512h512v768h-768v-256h96q66 0 113 -47t47 -113v-352zM2048 1376v-960q0 -66 -47 -113t-113 -47h-608v-352q0 -66 -47 -113t-113 -47h-960q-66 0 -113 47t-47 113v960q0 66 47 113t113 47h608v352q0 66 47 113t113 47h960q66 0 113 -47
+t47 -113z" />
+    <glyph glyph-name="uniF2D3" unicode="&#xf2d3;" horiz-adv-x="1792" 
+d="M1175 215l146 146q10 10 10 23t-10 23l-233 233l233 233q10 10 10 23t-10 23l-146 146q-10 10 -23 10t-23 -10l-233 -233l-233 233q-10 10 -23 10t-23 -10l-146 -146q-10 -10 -10 -23t10 -23l233 -233l-233 -233q-10 -10 -10 -23t10 -23l146 -146q10 -10 23 -10t23 10
+l233 233l233 -233q10 -10 23 -10t23 10zM1792 1248v-1216q0 -66 -47 -113t-113 -47h-1472q-66 0 -113 47t-47 113v1216q0 66 47 113t113 47h1472q66 0 113 -47t47 -113z" />
+    <glyph glyph-name="uniF2D4" unicode="&#xf2d4;" horiz-adv-x="1792" 
+d="M1257 425l-146 -146q-10 -10 -23 -10t-23 10l-169 169l-169 -169q-10 -10 -23 -10t-23 10l-146 146q-10 10 -10 23t10 23l169 169l-169 169q-10 10 -10 23t10 23l146 146q10 10 23 10t23 -10l169 -169l169 169q10 10 23 10t23 -10l146 -146q10 -10 10 -23t-10 -23
+l-169 -169l169 -169q10 -10 10 -23t-10 -23zM256 128h1280v1024h-1280v-1024zM1792 1248v-1216q0 -66 -47 -113t-113 -47h-1472q-66 0 -113 47t-47 113v1216q0 66 47 113t113 47h1472q66 0 113 -47t47 -113z" />
+    <glyph glyph-name="uniF2D5" unicode="&#xf2d5;" horiz-adv-x="1792" 
+d="M1070 358l306 564h-654l-306 -564h654zM1792 640q0 -182 -71 -348t-191 -286t-286 -191t-348 -71t-348 71t-286 191t-191 286t-71 348t71 348t191 286t286 191t348 71t348 -71t286 -191t191 -286t71 -348z" />
+    <glyph glyph-name="uniF2D6" unicode="&#xf2d6;" horiz-adv-x="1794" 
+d="M1291 1060q-15 17 -35 8.5t-26 -28.5t5 -38q14 -17 40 -14.5t34 20.5t-18 52zM895 814q-8 -8 -19.5 -8t-18.5 8q-8 8 -8 19t8 18q7 8 18.5 8t19.5 -8q7 -7 7 -18t-7 -19zM1060 740l-35 -35q-12 -13 -29.5 -13t-30.5 13l-38 38q-12 13 -12 30t12 30l35 35q12 12 29.5 12
+t30.5 -12l38 -39q12 -12 12 -29.5t-12 -29.5zM951 870q-7 -8 -18.5 -8t-19.5 8q-7 8 -7 19t7 19q8 8 19 8t19 -8t8 -19t-8 -19zM1354 968q-34 -64 -107.5 -85.5t-127.5 16.5q-38 28 -61 66.5t-21 87.5t39 92t75.5 53t70.5 -5t70 -51q2 -2 13 -12.5t14.5 -13.5t13 -13.5
+t12.5 -15.5t10 -15.5t8.5 -18t4 -18.5t1 -21t-5 -22t-9.5 -24zM1555 486q3 20 -8.5 34.5t-27.5 21.5t-33 17t-23 20q-40 71 -84 98.5t-113 11.5q19 13 40 18.5t33 4.5l12 -1q2 45 -34 90q6 20 6.5 40.5t-2.5 30.5l-3 10q43 24 71 65t34 91q10 84 -43 150.5t-137 76.5
+q-60 7 -114 -18.5t-82 -74.5q-30 -51 -33.5 -101t14.5 -87t43.5 -64t56.5 -42q-45 4 -88 36t-57 88q-28 108 32 222q-16 21 -29 32q-50 0 -89 -19q19 24 42 37t36 14l13 1q0 50 -13 78q-10 21 -32.5 28.5t-47 -3.5t-37.5 -40q2 4 4 7q-7 -28 -6.5 -75.5t19 -117t48.5 -122.5
+q-25 -14 -47 -36q-35 -16 -85.5 -70.5t-84.5 -101.5l-33 -46q-90 -34 -181 -125.5t-75 -162.5q1 -16 11 -27q-15 -12 -30 -30q-21 -25 -21 -54t21.5 -40t63.5 6q41 19 77 49.5t55 60.5q-2 2 -6.5 5t-20.5 7.5t-33 3.5q23 5 51 12.5t40 10t27.5 6t26 4t23.5 0.5q14 -7 22 34
+q7 37 7 90q0 102 -40 150q106 -103 101 -219q-1 -29 -15 -50t-27 -27l-13 -6q-4 -7 -19 -32t-26 -45.5t-26.5 -52t-25 -61t-17 -63t-6.5 -66.5t10 -63q-35 54 -37 80q-22 -24 -34.5 -39t-33.5 -42t-30.5 -46t-16.5 -41t-0.5 -38t25.5 -27q45 -25 144 64t190.5 221.5
+t122.5 228.5q86 52 145 115.5t86 119.5q47 -93 154 -178q104 -83 167 -80q39 2 46 43zM1794 640q0 -182 -71 -348t-191 -286t-286.5 -191t-348.5 -71t-348.5 71t-286.5 191t-191 286t-71 348t71 348t191 286t286.5 191t348.5 71t348.5 -71t286.5 -191t191 -286t71 -348z" />
+    <glyph glyph-name="uniF2D7" unicode="&#xf2d7;" 
+d="M518 1353v-655q103 -1 191.5 1.5t125.5 5.5l37 3q68 2 90.5 24.5t39.5 94.5l33 142h103l-14 -322l7 -319h-103l-29 127q-15 68 -45 93t-84 26q-87 8 -352 8v-556q0 -78 43.5 -115.5t133.5 -37.5h357q35 0 59.5 2t55 7.5t54 18t48.5 32t46 50.5t39 73l93 216h89
+q-6 -37 -31.5 -252t-30.5 -276q-146 5 -263.5 8t-162.5 4h-44h-628l-376 -12v102l127 25q67 13 91.5 37t25.5 79l8 643q3 402 -8 645q-2 61 -25.5 84t-91.5 36l-127 24v102l376 -12h702q139 0 374 27q-6 -68 -14 -194.5t-12 -219.5l-5 -92h-93l-32 124q-31 121 -74 179.5
+t-113 58.5h-548q-28 0 -35.5 -8.5t-7.5 -30.5z" />
+    <glyph glyph-name="uniF2D8" unicode="&#xf2d8;" 
+d="M922 739v-182q0 -4 0.5 -15t0 -15l-1.5 -12t-3.5 -11.5t-6.5 -7.5t-11 -5.5t-16 -1.5v309q9 0 16 -1t11 -5t6.5 -5.5t3.5 -9.5t1 -10.5v-13.5v-14zM1238 643v-121q0 -1 0.5 -12.5t0 -15.5t-2.5 -11.5t-7.5 -10.5t-13.5 -3q-9 0 -14 9q-4 10 -4 165v7v8.5v9t1.5 8.5l3.5 7
+t5 5.5t8 1.5q6 0 10 -1.5t6.5 -4.5t4 -6t2 -8.5t0.5 -8v-9.5v-9zM180 407h122v472h-122v-472zM614 407h106v472h-159l-28 -221q-20 148 -32 221h-158v-472h107v312l45 -312h76l43 319v-319zM1039 712q0 67 -5 90q-3 16 -11 28.5t-17 20.5t-25 14t-26.5 8.5t-31 4t-29 1.5
+h-29.5h-12h-91v-472h56q169 -1 197 24.5t25 180.5q-1 62 -1 100zM1356 515v133q0 29 -2 45t-9.5 33.5t-24.5 25t-46 7.5q-46 0 -77 -34v154h-117v-472h110l7 30q30 -36 77 -36q50 0 66 30.5t16 83.5zM1536 1248v-1216q0 -66 -47 -113t-113 -47h-1216q-66 0 -113 47t-47 113
+v1216q0 66 47 113t113 47h1216q66 0 113 -47t47 -113z" />
+    <glyph glyph-name="uniF2D9" unicode="&#xf2d9;" horiz-adv-x="2176" 
+d="M1143 -197q-6 1 -11 4q-13 8 -36 23t-86 65t-116.5 104.5t-112 140t-89.5 172.5q-17 3 -175 37q66 -213 235 -362t391 -184zM502 409l168 -28q-25 76 -41 167.5t-19 145.5l-4 53q-84 -82 -121 -224q5 -65 17 -114zM612 1018q-43 -64 -77 -148q44 46 74 68zM2049 584
+q0 161 -62 307t-167.5 252t-250.5 168.5t-304 62.5q-147 0 -281 -52.5t-240 -148.5q-30 -58 -45 -160q60 51 143 83.5t158.5 43t143 13.5t108.5 -1l40 -3q33 -1 53 -15.5t24.5 -33t6.5 -37t-1 -28.5q-126 11 -227.5 0.5t-183 -43.5t-142.5 -71.5t-131 -98.5
+q4 -36 11.5 -92.5t35.5 -178t62 -179.5q123 -6 247.5 14.5t214.5 53.5t162.5 67t109.5 59l37 24q22 16 39.5 20.5t30.5 -5t17 -34.5q14 -97 -39 -121q-208 -97 -467 -134q-135 -20 -317 -16q41 -96 110 -176.5t137 -127t130.5 -79t101.5 -43.5l39 -12q143 -23 263 15
+q195 99 314 289t119 418zM2123 621q-14 -135 -40 -212q-70 -208 -181.5 -346.5t-318.5 -253.5q-48 -33 -82 -44q-72 -26 -163 -16q-36 -3 -73 -3q-283 0 -504.5 173t-295.5 442q-1 0 -4 0.5t-5 0.5q-6 -50 2.5 -112.5t26 -115t36 -98t31.5 -71.5l14 -26q8 -12 54 -82
+q-71 38 -124.5 106.5t-78.5 140t-39.5 137t-17.5 107.5l-2 42q-5 2 -33.5 12.5t-48.5 18t-53 20.5t-57.5 25t-50 25.5t-42.5 27t-25 25.5q19 -10 50.5 -25.5t113 -45.5t145.5 -38l2 32q11 149 94 290q41 202 176 365q28 115 81 214q15 28 32 45t49 32q158 74 303.5 104
+t302 11t306.5 -97q220 -115 333 -336t87 -474z" />
+    <glyph glyph-name="uniF2DA" unicode="&#xf2da;" horiz-adv-x="1792" 
+d="M1341 752q29 44 -6.5 129.5t-121.5 142.5q-58 39 -125.5 53.5t-118 4.5t-68.5 -37q-12 -23 -4.5 -28t42.5 -10q23 -3 38.5 -5t44.5 -9.5t56 -17.5q36 -13 67.5 -31.5t53 -37t40 -38.5t30.5 -38t22 -34.5t16.5 -28.5t12 -18.5t10.5 -6t11 9.5zM1704 178
+q-52 -127 -148.5 -220t-214.5 -141.5t-253 -60.5t-266 13.5t-251 91t-210 161.5t-141.5 235.5t-46.5 303.5q1 41 8.5 84.5t12.5 64t24 80.5t23 73q-51 -208 1 -397t173 -318t291 -206t346 -83t349 74.5t289 244.5q20 27 18 14q0 -4 -4 -14zM1465 627q0 -104 -40.5 -199
+t-108.5 -164t-162 -109.5t-198 -40.5t-198 40.5t-162 109.5t-108.5 164t-40.5 199t40.5 199t108.5 164t162 109.5t198 40.5t198 -40.5t162 -109.5t108.5 -164t40.5 -199zM1752 915q-65 147 -180.5 251t-253 153.5t-292 53.5t-301 -36.5t-275.5 -129t-220 -211.5t-131 -297
+t-10 -373q-49 161 -51.5 311.5t35.5 272.5t109 227t165.5 180.5t207 126t232 71t242.5 9t236 -54t216 -124.5t178 -197q33 -50 62 -121t31 -112zM1690 573q12 244 -136.5 416t-396.5 240q-8 0 -10 5t24 8q125 -4 230 -50t173 -120t116 -168.5t58.5 -199t-1 -208
+t-61.5 -197.5t-122.5 -167t-185 -117.5t-248.5 -46.5q108 30 201.5 80t174 123t129.5 176.5t55 225.5z" />
+    <glyph glyph-name="uniF2DB" unicode="&#xf2db;" 
+d="M192 256v-128h-112q-16 0 -16 16v16h-48q-16 0 -16 16v32q0 16 16 16h48v16q0 16 16 16h112zM192 512v-128h-112q-16 0 -16 16v16h-48q-16 0 -16 16v32q0 16 16 16h48v16q0 16 16 16h112zM192 768v-128h-112q-16 0 -16 16v16h-48q-16 0 -16 16v32q0 16 16 16h48v16
+q0 16 16 16h112zM192 1024v-128h-112q-16 0 -16 16v16h-48q-16 0 -16 16v32q0 16 16 16h48v16q0 16 16 16h112zM192 1280v-128h-112q-16 0 -16 16v16h-48q-16 0 -16 16v32q0 16 16 16h48v16q0 16 16 16h112zM1280 1440v-1472q0 -40 -28 -68t-68 -28h-832q-40 0 -68 28
+t-28 68v1472q0 40 28 68t68 28h832q40 0 68 -28t28 -68zM1536 208v-32q0 -16 -16 -16h-48v-16q0 -16 -16 -16h-112v128h112q16 0 16 -16v-16h48q16 0 16 -16zM1536 464v-32q0 -16 -16 -16h-48v-16q0 -16 -16 -16h-112v128h112q16 0 16 -16v-16h48q16 0 16 -16zM1536 720v-32
+q0 -16 -16 -16h-48v-16q0 -16 -16 -16h-112v128h112q16 0 16 -16v-16h48q16 0 16 -16zM1536 976v-32q0 -16 -16 -16h-48v-16q0 -16 -16 -16h-112v128h112q16 0 16 -16v-16h48q16 0 16 -16zM1536 1232v-32q0 -16 -16 -16h-48v-16q0 -16 -16 -16h-112v128h112q16 0 16 -16v-16
+h48q16 0 16 -16z" />
+    <glyph glyph-name="uniF2DC" unicode="&#xf2dc;" horiz-adv-x="1664" 
+d="M1566 419l-167 -33l186 -107q23 -13 29.5 -38.5t-6.5 -48.5q-14 -23 -39 -29.5t-48 6.5l-186 106l55 -160q13 -38 -12 -63.5t-60.5 -20.5t-48.5 42l-102 300l-271 156v-313l208 -238q16 -18 17 -39t-11 -36.5t-28.5 -25t-37 -5.5t-36.5 22l-112 128v-214q0 -26 -19 -45
+t-45 -19t-45 19t-19 45v214l-112 -128q-16 -18 -36.5 -22t-37 5.5t-28.5 25t-11 36.5t17 39l208 238v313l-271 -156l-102 -300q-13 -37 -48.5 -42t-60.5 20.5t-12 63.5l55 160l-186 -106q-23 -13 -48 -6.5t-39 29.5q-13 23 -6.5 48.5t29.5 38.5l186 107l-167 33
+q-29 6 -42 29t-8.5 46.5t25.5 40t50 10.5l310 -62l271 157l-271 157l-310 -62q-4 -1 -13 -1q-27 0 -44 18t-19 40t11 43t40 26l167 33l-186 107q-23 13 -29.5 38.5t6.5 48.5t39 30t48 -7l186 -106l-55 160q-13 38 12 63.5t60.5 20.5t48.5 -42l102 -300l271 -156v313
+l-208 238q-16 18 -17 39t11 36.5t28.5 25t37 5.5t36.5 -22l112 -128v214q0 26 19 45t45 19t45 -19t19 -45v-214l112 128q16 18 36.5 22t37 -5.5t28.5 -25t11 -36.5t-17 -39l-208 -238v-313l271 156l102 300q13 37 48.5 42t60.5 -20.5t12 -63.5l-55 -160l186 106
+q23 13 48 6.5t39 -29.5q13 -23 6.5 -48.5t-29.5 -38.5l-186 -107l167 -33q27 -5 40 -26t11 -43t-19 -40t-44 -18q-9 0 -13 1l-310 62l-271 -157l271 -157l310 62q29 6 50 -10.5t25.5 -40t-8.5 -46.5t-42 -29z" />
+    <glyph glyph-name="uniF2DD" unicode="&#xf2dd;" horiz-adv-x="1792" 
+d="M1473 607q7 118 -33 226.5t-113 189t-177 131t-221 57.5q-116 7 -225.5 -32t-192 -110.5t-135 -175t-59.5 -220.5q-7 -118 33 -226.5t113 -189t177.5 -131t221.5 -57.5q155 -9 293 59t224 195.5t94 283.5zM1792 1536l-349 -348q120 -117 180.5 -272t50.5 -321
+q-11 -183 -102 -339t-241 -255.5t-332 -124.5l-999 -132l347 347q-120 116 -180.5 271.5t-50.5 321.5q11 184 102 340t241.5 255.5t332.5 124.5q167 22 500 66t500 66z" />
+    <glyph glyph-name="uniF2DE" unicode="&#xf2de;" horiz-adv-x="1792" 
+d="M948 508l163 -329h-51l-175 350l-171 -350h-49l179 374l-78 33l21 49l240 -102l-21 -50zM563 1100l304 -130l-130 -304l-304 130zM907 915l240 -103l-103 -239l-239 102zM1188 765l191 -81l-82 -190l-190 81zM1680 640q0 159 -62 304t-167.5 250.5t-250.5 167.5t-304 62
+t-304 -62t-250.5 -167.5t-167.5 -250.5t-62 -304t62 -304t167.5 -250.5t250.5 -167.5t304 -62t304 62t250.5 167.5t167.5 250.5t62 304zM1792 640q0 -182 -71 -348t-191 -286t-286 -191t-348 -71t-348 71t-286 191t-191 286t-71 348t71 348t191 286t286 191t348 71t348 -71
+t286 -191t191 -286t71 -348z" />
+    <glyph glyph-name="uniF2E0" unicode="&#xf2e0;" horiz-adv-x="1920" 
+d="M1334 302q-4 24 -27.5 34t-49.5 10.5t-48.5 12.5t-25.5 38q-5 47 33 139.5t75 181t32 127.5q-14 101 -117 103q-45 1 -75 -16l-3 -2l-5 -2.5t-4.5 -2t-5 -2t-5 -0.5t-6 1.5t-6 3.5t-6.5 5q-3 2 -9 8.5t-9 9t-8.5 7.5t-9.5 7.5t-9.5 5.5t-11 4.5t-11.5 2.5q-30 5 -48 -3
+t-45 -31q-1 -1 -9 -8.5t-12.5 -11t-15 -10t-16.5 -5.5t-17 3q-54 27 -84 40q-41 18 -94 -5t-76 -65q-16 -28 -41 -98.5t-43.5 -132.5t-40 -134t-21.5 -73q-22 -69 18.5 -119t110.5 -46q30 2 50.5 15t38.5 46q7 13 79 199.5t77 194.5q6 11 21.5 18t29.5 0q27 -15 21 -53
+q-2 -18 -51 -139.5t-50 -132.5q-6 -38 19.5 -56.5t60.5 -7t55 49.5q4 8 45.5 92t81.5 163.5t46 88.5q20 29 41 28q29 0 25 -38q-2 -16 -65.5 -147.5t-70.5 -159.5q-12 -53 13 -103t74 -74q17 -9 51 -15.5t71.5 -8t62.5 14t20 48.5zM383 86q3 -15 -5 -27.5t-23 -15.5
+q-14 -3 -26.5 5t-15.5 23q-3 14 5 27t22 16t27 -5t16 -23zM953 -177q12 -17 8.5 -37.5t-20.5 -32.5t-37.5 -8t-32.5 21q-11 17 -7.5 37.5t20.5 32.5t37.5 8t31.5 -21zM177 635q-18 -27 -49.5 -33t-57.5 13q-26 18 -32 50t12 58q18 27 49.5 33t57.5 -12q26 -19 32 -50.5
+t-12 -58.5zM1467 -42q19 -28 13 -61.5t-34 -52.5t-60.5 -13t-51.5 34t-13 61t33 53q28 19 60.5 13t52.5 -34zM1579 562q69 -113 42.5 -244.5t-134.5 -207.5q-90 -63 -199 -60q-20 -80 -84.5 -127t-143.5 -44.5t-140 57.5q-12 -9 -13 -10q-103 -71 -225 -48.5t-193 126.5
+q-50 73 -53 164q-83 14 -142.5 70.5t-80.5 128t-2 152t81 138.5q-36 60 -38 128t24.5 125t79.5 98.5t121 50.5q32 85 99 148t146.5 91.5t168 17t159.5 -66.5q72 21 140 17.5t128.5 -36t104.5 -80t67.5 -115t17.5 -140.5q52 -16 87 -57t45.5 -89t-5.5 -99.5t-58 -87.5z
+M455 1222q14 -20 9.5 -44.5t-24.5 -38.5q-19 -14 -43.5 -9.5t-37.5 24.5q-14 20 -9.5 44.5t24.5 38.5q19 14 43.5 9.5t37.5 -24.5zM614 1503q4 -16 -5 -30.5t-26 -18.5t-31 5.5t-18 26.5q-3 17 6.5 31t25.5 18q17 4 31 -5.5t17 -26.5zM1800 555q4 -20 -6.5 -37t-30.5 -21
+q-19 -4 -36 6.5t-21 30.5t6.5 37t30.5 22q20 4 36.5 -7.5t20.5 -30.5zM1136 1448q16 -27 8.5 -58.5t-35.5 -47.5q-27 -16 -57.5 -8.5t-46.5 34.5q-16 28 -8.5 59t34.5 48t58 9t47 -36zM1882 792q4 -15 -4 -27.5t-23 -16.5q-15 -3 -27.5 5.5t-15.5 22.5q-3 15 5 28t23 16
+q14 3 26.5 -5t15.5 -23zM1691 1033q15 -22 10.5 -49t-26.5 -43q-22 -15 -49 -10t-42 27t-10 49t27 43t48.5 11t41.5 -28z" />
+    <glyph glyph-name="uniF2E1" unicode="&#xf2e1;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="uniF2E2" unicode="&#xf2e2;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="uniF2E3" unicode="&#xf2e3;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="uniF2E4" unicode="&#xf2e4;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="uniF2E5" unicode="&#xf2e5;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="uniF2E6" unicode="&#xf2e6;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="uniF2E7" unicode="&#xf2e7;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="_698" unicode="&#xf2e8;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="uniF2E9" unicode="&#xf2e9;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="uniF2EA" unicode="&#xf2ea;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="uniF2EB" unicode="&#xf2eb;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="uniF2EC" unicode="&#xf2ec;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="uniF2ED" unicode="&#xf2ed;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="uniF2EE" unicode="&#xf2ee;" horiz-adv-x="1792" 
+ />
+    <glyph glyph-name="lessequal" unicode="&#xf500;" horiz-adv-x="1792" 
+ />
+  </font>
+</defs></svg>
diff --git a/ee/bulk-operations-dashboard/assets/fonts/fontawesome-webfont.ttf b/ee/bulk-operations-dashboard/assets/fonts/fontawesome-webfont.ttf
new file mode 100644
index 0000000000..35acda2fa1
Binary files /dev/null and b/ee/bulk-operations-dashboard/assets/fonts/fontawesome-webfont.ttf differ
diff --git a/ee/bulk-operations-dashboard/assets/fonts/fontawesome-webfont.woff b/ee/bulk-operations-dashboard/assets/fonts/fontawesome-webfont.woff
new file mode 100644
index 0000000000..400014a4b0
Binary files /dev/null and b/ee/bulk-operations-dashboard/assets/fonts/fontawesome-webfont.woff differ
diff --git a/ee/bulk-operations-dashboard/assets/fonts/fontawesome-webfont.woff2 b/ee/bulk-operations-dashboard/assets/fonts/fontawesome-webfont.woff2
new file mode 100644
index 0000000000..4d13fc6040
Binary files /dev/null and b/ee/bulk-operations-dashboard/assets/fonts/fontawesome-webfont.woff2 differ
diff --git a/ee/bulk-operations-dashboard/assets/images/delete-16x21@2x.png b/ee/bulk-operations-dashboard/assets/images/delete-16x21@2x.png
new file mode 100644
index 0000000000..275b3235c9
Binary files /dev/null and b/ee/bulk-operations-dashboard/assets/images/delete-16x21@2x.png differ
diff --git a/ee/bulk-operations-dashboard/assets/images/download-16x16@2x.png b/ee/bulk-operations-dashboard/assets/images/download-16x16@2x.png
new file mode 100644
index 0000000000..2e6e7ebe23
Binary files /dev/null and b/ee/bulk-operations-dashboard/assets/images/download-16x16@2x.png differ
diff --git a/ee/bulk-operations-dashboard/assets/images/edit-pencil-16x21@2x.png b/ee/bulk-operations-dashboard/assets/images/edit-pencil-16x21@2x.png
new file mode 100644
index 0000000000..b5bfe59139
Binary files /dev/null and b/ee/bulk-operations-dashboard/assets/images/edit-pencil-16x21@2x.png differ
diff --git a/ee/bulk-operations-dashboard/assets/images/fleet-logo-black-118x40@2x.png b/ee/bulk-operations-dashboard/assets/images/fleet-logo-black-118x40@2x.png
new file mode 100644
index 0000000000..4fc177bdb0
Binary files /dev/null and b/ee/bulk-operations-dashboard/assets/images/fleet-logo-black-118x40@2x.png differ
diff --git a/ee/bulk-operations-dashboard/assets/images/icon-close.png b/ee/bulk-operations-dashboard/assets/images/icon-close.png
new file mode 100644
index 0000000000..fbced9c332
Binary files /dev/null and b/ee/bulk-operations-dashboard/assets/images/icon-close.png differ
diff --git a/ee/bulk-operations-dashboard/assets/images/icon-hamburger-blue-16x14@2x.png b/ee/bulk-operations-dashboard/assets/images/icon-hamburger-blue-16x14@2x.png
new file mode 100644
index 0000000000..0b25dd5a3c
Binary files /dev/null and b/ee/bulk-operations-dashboard/assets/images/icon-hamburger-blue-16x14@2x.png differ
diff --git a/ee/bulk-operations-dashboard/assets/images/powered-by-fleet-159x24@2x.png b/ee/bulk-operations-dashboard/assets/images/powered-by-fleet-159x24@2x.png
new file mode 100644
index 0000000000..5a86548cd0
Binary files /dev/null and b/ee/bulk-operations-dashboard/assets/images/powered-by-fleet-159x24@2x.png differ
diff --git a/ee/bulk-operations-dashboard/assets/images/profile-34x40@2x.png b/ee/bulk-operations-dashboard/assets/images/profile-34x40@2x.png
new file mode 100644
index 0000000000..0a886a2207
Binary files /dev/null and b/ee/bulk-operations-dashboard/assets/images/profile-34x40@2x.png differ
diff --git a/ee/bulk-operations-dashboard/assets/images/script-icon-ps1-34x40@2x.png b/ee/bulk-operations-dashboard/assets/images/script-icon-ps1-34x40@2x.png
new file mode 100644
index 0000000000..ff87e6d14d
Binary files /dev/null and b/ee/bulk-operations-dashboard/assets/images/script-icon-ps1-34x40@2x.png differ
diff --git a/ee/bulk-operations-dashboard/assets/images/script-icon-sh-34x40@2x.png b/ee/bulk-operations-dashboard/assets/images/script-icon-sh-34x40@2x.png
new file mode 100644
index 0000000000..de90423267
Binary files /dev/null and b/ee/bulk-operations-dashboard/assets/images/script-icon-sh-34x40@2x.png differ
diff --git a/ee/bulk-operations-dashboard/assets/images/trash-16x16@2x.png b/ee/bulk-operations-dashboard/assets/images/trash-16x16@2x.png
new file mode 100644
index 0000000000..880b8f41d6
Binary files /dev/null and b/ee/bulk-operations-dashboard/assets/images/trash-16x16@2x.png differ
diff --git a/ee/bulk-operations-dashboard/assets/images/upload-16x17@2x.png b/ee/bulk-operations-dashboard/assets/images/upload-16x17@2x.png
new file mode 100644
index 0000000000..b390f3b368
Binary files /dev/null and b/ee/bulk-operations-dashboard/assets/images/upload-16x17@2x.png differ
diff --git a/ee/bulk-operations-dashboard/assets/js/cloud.setup.js b/ee/bulk-operations-dashboard/assets/js/cloud.setup.js
new file mode 100644
index 0000000000..659d16fda2
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/js/cloud.setup.js
@@ -0,0 +1,19 @@
+/**
+ * cloud.setup.js
+ *
+ * Configuration for this Sails app's generated browser SDK ("Cloud").
+ *
+ * Above all, the purpose of this file is to provide endpoint definitions,
+ * each of which corresponds with one particular route+action on the server.
+ *
+ * > This file was automatically generated.
+ * > (To regenerate, run `sails run rebuild-cloud-sdk`)
+ */
+
+Cloud.setup({
+
+  /* eslint-disable */
+  methods: {"confirmEmail":{"verb":"GET","url":"/email/confirm","args":["token"]},"logout":{"verb":"GET","url":"/api/v1/account/logout","args":[]},"updatePassword":{"verb":"PUT","url":"/api/v1/account/update-password","args":["password"]},"updateProfile":{"verb":"PUT","url":"/api/v1/account/update-profile","args":["fullName","emailAddress"]},"login":{"verb":"PUT","url":"/api/v1/entrance/login","args":["emailAddress","password","rememberMe"]},"sendPasswordRecoveryEmail":{"verb":"POST","url":"/api/v1/entrance/send-password-recovery-email","args":["emailAddress"]},"updatePasswordAndLogin":{"verb":"POST","url":"/api/v1/entrance/update-password-and-login","args":["password","token"]},"observeMySession":{"verb":"POST","url":"/api/v1/observe-my-session","args":[],"protocol":"io.socket"},"deleteProfile":{"verb":"POST","url":"/api/v1/delete-profile","args":["profile"]},"downloadProfile":{"verb":"GET","url":"/download-profile","args":["id","uuid"]},"uploadProfile":{"verb":"POST","url":"/api/v1/upload-profile","args":["newProfile","teams"]},"editProfile":{"verb":"POST","url":"/api/v1/edit-profile","args":["profile","newTeamIds","newProfile"]},"getProfiles":{"verb":"GET","url":"/api/v1/get-profiles","args":[]},"getScripts":{"verb":"GET","url":"/api/v1/get-scripts","args":[]},"deleteScript":{"verb":"POST","url":"/api/v1/delete-script","args":["script"]},"downloadScript":{"verb":"GET","url":"/download-script","args":["id"]},"uploadScript":{"verb":"POST","url":"/api/v1/upload-script","args":["newScript","teams"]},"editScript":{"verb":"POST","url":"/api/v1/edit-script","args":["script","newTeamIds","newScript"]}}
+  /* eslint-enable */
+
+});
diff --git a/ee/bulk-operations-dashboard/assets/js/components/account-notification-banner.component.js b/ee/bulk-operations-dashboard/assets/js/components/account-notification-banner.component.js
new file mode 100644
index 0000000000..5b153a98c4
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/js/components/account-notification-banner.component.js
@@ -0,0 +1,93 @@
+/**
+ * <account-notification-banner>
+ * -----------------------------------------------------------------------------
+ *
+ * @type {Component}
+ *
+ * -----------------------------------------------------------------------------
+ */
+
+parasails.registerComponent('account-notification-banner', {
+
+  //  ╔═╗╦ ╦╔╗ ╦  ╦╔═╗  ╔═╗╦═╗╔═╗╔═╗╔═╗
+  //  ╠═╝║ ║╠╩╗║  ║║    ╠═╝╠╦╝║ ║╠═╝╚═╗
+  //  ╩  ╚═╝╚═╝╩═╝╩╚═╝  ╩  ╩╚═╚═╝╩  ╚═╝
+  props: [],
+
+  //  ╦╔╗╔╦╔╦╗╦╔═╗╦    ╦╔╗╔╔╦╗╔═╗╦═╗╔╗╔╔═╗╦    ╔═╗╔╦╗╔═╗╔╦╗╔═╗
+  //  ║║║║║ ║ ║╠═╣║    ║║║║ ║ ║╣ ╠╦╝║║║╠═╣║    ╚═╗ ║ ╠═╣ ║ ║╣
+  //  ╩╝╚╝╩ ╩ ╩╩ ╩╩═╝  ╩╝╚╝ ╩ ╚═╝╩╚═╝╚╝╩ ╩╩═╝  ╚═╝ ╩ ╩ ╩ ╩ ╚═╝
+  data: function () {
+    return {
+      notificationText: '',
+      roomName: undefined,
+    };
+  },
+
+
+  //  ╦ ╦╔╦╗╔╦╗╦
+  //  ╠═╣ ║ ║║║║
+  //  ╩ ╩ ╩ ╩ ╩╩═╝
+  template: `
+  <div>
+    <div class="container-fluid">
+      <div class="alert alert-warning mt-2 small" role="alert" v-if="notificationText">
+        {{notificationText}}
+      </div>
+    </div>
+  </div>
+  `,
+
+
+  //  ╦  ╦╔═╗╔═╗╔═╗╦ ╦╔═╗╦  ╔═╗
+  //  ║  ║╠╣ ║╣ ║  ╚╦╝║  ║  ║╣
+  //  ╩═╝╩╚  ╚═╝╚═╝ ╩ ╚═╝╩═╝╚═╝
+  mounted: async function() {
+    await Cloud.observeMySession();
+    // Listen for updates to the user's session
+    Cloud.on('session', (msg)=>{
+      if(msg.notificationText) {
+        this.notificationText = msg.notificationText;
+      } else {
+        this.notificationText = '';
+      }
+    });//œ
+  },
+
+  beforeDestroy: function() {
+    Cloud.off('session');
+  },
+
+  watch: {
+    loggedInUserId: function(unused) { throw new Error('Changes to `loggedInUserId` are not currently supported in <account-notification-banner>!'); },
+  },
+
+  //  ╦╔╗╔╔╦╗╔═╗╦═╗╔═╗╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
+  //  ║║║║ ║ ║╣ ╠╦╝╠═╣║   ║ ║║ ║║║║╚═╗
+  //  ╩╝╚╝ ╩ ╚═╝╩╚═╩ ╩╚═╝ ╩ ╩╚═╝╝╚╝╚═╝
+  methods: {
+
+    //  ╦╔╗╔╔╦╗╔═╗╦═╗╔╗╔╔═╗╦    ╔═╗╦  ╦╔═╗╔╗╔╔╦╗  ╦ ╦╔═╗╔╗╔╔╦╗╦  ╔═╗╦═╗╔═╗
+    //  ║║║║ ║ ║╣ ╠╦╝║║║╠═╣║    ║╣ ╚╗╔╝║╣ ║║║ ║   ╠═╣╠═╣║║║ ║║║  ║╣ ╠╦╝╚═╗
+    //  ╩╝╚╝ ╩ ╚═╝╩╚═╝╚╝╩ ╩╩═╝  ╚═╝ ╚╝ ╚═╝╝╚╝ ╩   ╩ ╩╩ ╩╝╚╝═╩╝╩═╝╚═╝╩╚═╚═╝
+
+    //…
+
+    //  ╔═╗╦ ╦╔╗ ╦  ╦╔═╗  ╔╦╗╔═╗╔╦╗╦ ╦╔═╗╔╦╗╔═╗
+    //  ╠═╝║ ║╠╩╗║  ║║    ║║║║╣  ║ ╠═╣║ ║ ║║╚═╗
+    //  ╩  ╚═╝╚═╝╩═╝╩╚═╝  ╩ ╩╚═╝ ╩ ╩ ╩╚═╝═╩╝╚═╝
+    // > Public methods are rarely exposed by Vue components, but sometimes they
+    // > are an important escape hatch.  They are callable via something like
+    // > `this.$refs.componentNameInCamelCase.doSomething())`, and, by convention,
+    // > are always prefixed with "do".
+    // N/A
+
+    //  ╔═╗╦═╗╦╦  ╦╔═╗╔╦╗╔═╗  ╔╦╗╔═╗╔╦╗╦ ╦╔═╗╔╦╗╔═╗
+    //  ╠═╝╠╦╝║╚╗╔╝╠═╣ ║ ║╣   ║║║║╣  ║ ╠═╣║ ║ ║║╚═╗
+    //  ╩  ╩╚═╩ ╚╝ ╩ ╩ ╩ ╚═╝  ╩ ╩╚═╝ ╩ ╩ ╩╚═╝═╩╝╚═╝
+
+    //…
+
+  }
+
+});
diff --git a/ee/bulk-operations-dashboard/assets/js/components/ajax-button.component.js b/ee/bulk-operations-dashboard/assets/js/components/ajax-button.component.js
new file mode 100644
index 0000000000..b6d8ebe663
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/js/components/ajax-button.component.js
@@ -0,0 +1,69 @@
+/**
+ * <ajax-button>
+ * -----------------------------------------------------------------------------
+ * A button with a built-in loading spinner.
+ *
+ * @type {Component}
+ *
+ * @event click   [emitted when clicked]
+ * -----------------------------------------------------------------------------
+ */
+
+parasails.registerComponent('ajaxButton', {
+  //  ╔═╗╦═╗╔═╗╔═╗╔═╗
+  //  ╠═╝╠╦╝║ ║╠═╝╚═╗
+  //  ╩  ╩╚═╚═╝╩  ╚═╝
+  props: [
+    'syncing'
+  ],
+
+  //  ╦╔╗╔╦╔╦╗╦╔═╗╦    ╔═╗╔╦╗╔═╗╔╦╗╔═╗
+  //  ║║║║║ ║ ║╠═╣║    ╚═╗ ║ ╠═╣ ║ ║╣
+  //  ╩╝╚╝╩ ╩ ╩╩ ╩╩═╝  ╚═╝ ╩ ╩ ╩ ╩ ╚═╝
+  data: function (){
+    return {
+      //…
+    };
+  },
+
+  //  ╦ ╦╔╦╗╔╦╗╦
+  //  ╠═╣ ║ ║║║║
+  //  ╩ ╩ ╩ ╩ ╩╩═╝
+  template: `
+  <button @click="click()" type="submit" class="btn ajax-button" :class="[syncing ? 'syncing' : '']">
+    <span class="button-text" v-if="!syncing"><slot name="default">Submit</slot></span>
+    <span class="button-loader clearfix" v-if="syncing">
+      <slot name="syncing-state">
+        <span style="top: -4px; font-size: 12px; margin: 0 2px;" class="loading-dot dot1 position-relative"><small><span class="fa fa-circle"></span></small></span>
+        <span style="top: -4px; font-size: 12px; margin: 0 2px;" class="loading-dot dot2 position-relative"><small><span class="fa fa-circle"></span></small></span>
+        <span style="top: -4px; font-size: 12px; margin: 0 2px;" class="loading-dot dot3 position-relative"><small><span class="fa fa-circle"></span></small></span>
+        <span style="top: -4px; font-size: 12px; margin: 0 2px;" class="loading-dot dot4 position-relative"><small><span class="fa fa-circle"></span></small></span>
+      </slot>
+    </span>
+  </button>
+  `,
+
+  //  ╦  ╦╔═╗╔═╗╔═╗╦ ╦╔═╗╦  ╔═╗
+  //  ║  ║╠╣ ║╣ ║  ╚╦╝║  ║  ║╣
+  //  ╩═╝╩╚  ╚═╝╚═╝ ╩ ╚═╝╩═╝╚═╝
+  beforeMount: function() {
+    //…
+  },
+  mounted: async function(){
+    //…
+  },
+  beforeDestroy: function() {
+    //…
+  },
+
+  //  ╦╔╗╔╔╦╗╔═╗╦═╗╔═╗╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
+  //  ║║║║ ║ ║╣ ╠╦╝╠═╣║   ║ ║║ ║║║║╚═╗
+  //  ╩╝╚╝ ╩ ╚═╝╩╚═╩ ╩╚═╝ ╩ ╩╚═╝╝╚╝╚═╝
+  methods: {
+
+    click: async function(){
+      this.$emit('click');
+    },
+
+  }
+});
diff --git a/ee/bulk-operations-dashboard/assets/js/components/ajax-form.component.js b/ee/bulk-operations-dashboard/assets/js/components/ajax-form.component.js
new file mode 100644
index 0000000000..8cc11d8f04
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/js/components/ajax-form.component.js
@@ -0,0 +1,379 @@
+/**
+ * <ajax-form>
+ * -----------------------------------------------------------------------------
+ * A form that talks to the backend using AJAX.
+ * > For example usage, take a look at one of the forms generated in a new
+ * > Sails app when using the "Web app" template.
+ *
+ * @type {Component}
+ *
+ * @slot default                     [form contents]
+ *
+ * @event update:cloudError          [:cloud-error.sync="…"]
+ * @event update:syncing             [:syncing.sync="…"]
+ * @event update:formErrors          [:form-errors.sync="…"]
+ * @event submitted                  [emitted after the server responds with a 2xx status code]
+ * @event rejected                   [emitted after the server responds with a non-2xx status code]
+ * -----------------------------------------------------------------------------
+ */
+
+parasails.registerComponent('ajaxForm', {
+  //  ╔═╗╦═╗╔═╗╔═╗╔═╗
+  //  ╠═╝╠╦╝║ ║╠═╝╚═╗
+  //  ╩  ╩╚═╚═╝╩  ╚═╝
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+  // Note:
+  // Some of these props rely on the `.sync` modifier re-introduced in Vue 2.3.x.
+  // For more info, see: https://vuejs.org/v2/guide/components.html#sync-Modifier
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+  props: [
+    'syncing',// « 2-way bound (:syncing.sync="…")
+    'cloudError',// « 2-way bound (:cloud-error.sync="…")
+    'action',
+    'formErrors',// « 2-way bound (:form-errors.sync="…")
+    'formData',
+    'formRules',
+
+    'handleSubmitting',// « alternative for `action`
+    'handleParsing',// « alternative for `formRules`+`formData`+`formErrors`
+  ],
+
+  //  ╦╔╗╔╦╔╦╗╦╔═╗╦    ╔═╗╔╦╗╔═╗╔╦╗╔═╗
+  //  ║║║║║ ║ ║╠═╣║    ╚═╗ ║ ╠═╣ ║ ║╣
+  //  ╩╝╚╝╩ ╩ ╩╩ ╩╩═╝  ╚═╝ ╩ ╩ ╩ ╩ ╚═╝
+  data: function (){
+    return {
+      //…
+    };
+  },
+
+  //  ╦ ╦╔╦╗╔╦╗╦
+  //  ╠═╣ ║ ║║║║
+  //  ╩ ╩ ╩ ╩ ╩╩═╝
+  template: `
+  <form class="ajax-form" @submit.prevent="submit()" @keydown.meta.enter="keydownMetaEnter()">
+    <slot name="default"></slot>
+  </form>
+  `,
+
+  //  ╦  ╦╔═╗╔═╗╔═╗╦ ╦╔═╗╦  ╔═╗
+  //  ║  ║╠╣ ║╣ ║  ╚╦╝║  ║  ║╣
+  //  ╩═╝╩╚  ╚═╝╚═╝ ╩ ╚═╝╩═╝╚═╝
+  beforeMount: function() {
+    //…
+  },
+  mounted: async function (){
+    if (this.action === undefined && this.handleSubmitting === undefined) {
+      throw new Error('Neither `:action` nor `:handle-submitting` was passed in to <ajax-form>, but one or the other must be provided.');
+    } else if (this.action !== undefined && this.handleSubmitting !== undefined) {
+      throw new Error('Both `:action` AND `:handle-submitting` were passed in to <ajax-form>, but only one or the other should be provided.');
+    } else if (this.action !== undefined && (!_.isString(this.action) || !_.isFunction(Cloud[_.camelCase(this.action)]))) {
+      throw new Error('Invalid `action` in <ajax-form>.  `action` should be the name of a method on the `Cloud` global.  For example: `action="login"` would make this form communicate using `Cloud.login()`, which corresponds to the "login" action on the server.');
+    } else if (this.action !== undefined && !_.isFunction(Cloud[this.action])) {
+      throw new Error('Unrecognized `action` in <ajax-form>.  Did you mean to type `action="'+_.camelCase(this.action)+'"`?  (<ajax-form> expects `action` to be provided in camelCase format.  In other words, to reference the action at "api/controllers/foo/bar/do-something", use `action="doSomething"`.)');
+    } else if (this.handleSubmitting !== undefined && !_.isFunction(this.handleSubmitting)) {
+      throw new Error('Invalid `:handle-submitting` function passed to <ajax-form>.  (Any chance you forgot the ":" in front of the prop name?)  For example: `:handle-submitting="handleSubmittingSomeForm"`.  This function should be an `async function`, and it should either throw a special exit signal or return response data from the server.  (If this custom `handleSubmitting` will be doing something more complex than a single request to a server, feel free to return whatever amalgamation of data you wish.)');
+    }
+
+    if (this.handleParsing === undefined && this.formData === undefined) {
+      throw new Error('Neither `:form-data` nor `:handle-parsing` was passed in to <ajax-form>, but one or the other must be provided.');
+    } else if (this.handleParsing !== undefined && this.formData !== undefined) {
+      throw new Error('Both `:form-data` AND `:handle-parsing` were passed in to <ajax-form>, but only one or the other should be provided.');
+    } else if (this.handleParsing !== undefined && !_.isFunction(this.handleParsing)) {
+      throw new Error('Invalid `:handle-parsing` function passed to <ajax-form>.  (Any chance you forgot the ":" in front of the prop name?)  For example: `:handle-parsing="handleParsingSomeForm"`.  This function should return a dictionary (plain JavaScript object like `{}`) of parsed form data, ready to be sent in a request to the server.');
+    } else if (this.formData !== undefined && (!_.isObject(this.formData) || _.isFunction(this.formData) || _.isArray(this.formData))) {
+      throw new Error('Invalid `:form-data` passed to <ajax-form>.  (Any chance you forgot the ":" in front of the prop name?)  For example: `:form-data="someFormData"`.  This should reference a dictionary (plain JavaScript object like `{}`).  Specifically, `:form-data` should only be used in the case where the raw data from the form in the user interface happens to correspond **EXACTLY** with the names and format of the argins that should be sent in a request to the server.  (For more nuanced behavior, use `handle-parsing` instead!)');
+    }
+
+    if (!this.formData && (this.formRules || this.formErrors)) {
+      throw new Error('If `:form-rules` or `:form-errors.sync` are in use, then `:form-data` must also be passed in.  (If the AJAX request doesn\'t need form data, then use an empty dictionary, i.e. `:form-data="{}"`.)');
+    } else if (this.formRules && !this.formErrors) {
+      throw new Error('If `:form-rules` are provided, then `:form-errors.sync` must also be passed in.');
+    }
+
+    if (this.formRules) {
+      var SUPPORTED_RULES = [
+        'required', 'isEmail', 'isIn', 'is', 'minLength', 'maxLength',
+        'sameAs', 'isHalfwayDecentPassword', 'custom'
+      ];
+      for (let fieldName in this.formRules) {
+        for (let ruleName in this.formRules[fieldName]) {
+          if (_.contains(SUPPORTED_RULES, ruleName)) {
+            // OK.  Good enough.
+            // - - - - - - - - - - - - - - - - - - - - -
+            // FUTURE: move rule rhs checks out here
+            // (so error messages from bad usage are
+            // logged sooner)
+            // - - - - - - - - - - - - - - - - - - - - -
+          } else {
+            let kebabRules = _.map(_.clone(SUPPORTED_RULES), (ruleName)=>_.kebabCase(ruleName));
+            let lowerCaseRules = _.map(_.clone(SUPPORTED_RULES), (ruleName)=>ruleName.toLowerCase());
+            let ruleIdx = (
+              _.indexOf(kebabRules, ruleName) === -1 ?
+              _.indexOf(lowerCaseRules, ruleName.toLowerCase()) === -1 ?
+              -1
+              : _.indexOf(lowerCaseRules, ruleName.toLowerCase())
+              : _.indexOf(kebabRules, ruleName)
+            );
+            if (ruleIdx !== -1) {
+              throw new Error('Did you mean `'+SUPPORTED_RULES[ruleIdx]+'`?  (note the capitalization)\nYou are seeing this error because <ajax-form> encountered an unsupported (but vaguely familiar-looking) client-side validation rule: `'+ruleName+'`.');
+            } else {
+              throw new Error('<ajax-form> does not support that client-side validation rule (`'+ruleName+'`).\n [?] If you\'re unsure, visit https://sailsjs.com/support');
+            }
+          }
+        }//∞
+      }//∞
+    }
+
+    // Focus our "focus-first" field, if relevant.
+    // (but not on mobile, because it can get weird)
+    if(typeof bowser !== 'undefined' && !bowser.mobile && this.$find('[focus-first]').length > 0) {
+      this.$focus('[focus-first]');
+    }
+  },
+  beforeDestroy: function() {
+    //…
+  },
+
+  //  ╦╔╗╔╔╦╗╔═╗╦═╗╔═╗╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
+  //  ║║║║ ║ ║╣ ╠╦╝╠═╣║   ║ ║║ ║║║║╚═╗
+  //  ╩╝╚╝ ╩ ╚═╝╩╚═╩ ╩╚═╝ ╩ ╩╚═╝╝╚╝╚═╝
+  methods: {
+
+    keydownMetaEnter: async function() {
+      await this._submit();
+    },
+
+    submit: async function () {
+      await this._submit();
+    },
+
+    //  ╔═╗╦═╗╦╦  ╦╔═╗╔╦╗╔═╗  ╔╦╗╔═╗╔╦╗╦ ╦╔═╗╔╦╗╔═╗
+    //  ╠═╝╠╦╝║╚╗╔╝╠═╣ ║ ║╣   ║║║║╣  ║ ╠═╣║ ║ ║║╚═╗
+    //  ╩  ╩╚═╩ ╚╝ ╩ ╩ ╩ ╚═╝  ╩ ╩╚═╝ ╩ ╩ ╩╚═╝═╩╝╚═╝
+    _submit: async function () {
+
+      // Prevent double-posting.
+      if (this.syncing) {
+        return;
+      }//•
+
+      // Clear the userland "cloudError" prop.
+      this.$emit('update:cloudError', '');
+
+      // Determine the argins that will be sent to the server in our request.
+      var argins;
+      if (this.handleParsing) {
+        // Run the provided "handle-parsing" logic.
+        // > This should clear out any pre-existing error messages, perform any additional
+        // > client-side form validation checks, and do any necessary data transformations
+        // > to munge the form data into the format expected by the server.
+        argins = this.handleParsing();
+        if (argins === undefined) {
+          // If argins came back undefined, then avast.
+          // (This means that parsing the form failed.  Submission will not be attempted.)
+          return;
+        } else if (!_.isObject(argins) || _.isArray(argins) || _.isFunction(argins)) {
+          throw new Error('Invalid data returned from custom form parsing logic.  (Should return a dictionary of argins, like `{}`.)');
+        }//•
+      } else if (this.formData) {
+        // Or use the simpler, built-in absorbtion strategy.
+        // > This uses the provided form data as our argins, verbatim.  Then it runs
+        // > built-in client-side validation, if configured to do so.
+        argins = this.formData;
+
+        let formData = this.formData;
+        let formErrors = {};
+
+        for (let fieldName in this.formRules) {
+          let fieldValue = formData[fieldName];
+
+          for (let ruleName in this.formRules[fieldName]) {
+            let ruleRhs = this.formRules[fieldName][ruleName];
+            let violation;
+
+            let isFieldValuePresent = (
+              fieldValue !== undefined &&
+              fieldValue !== '' &&
+              !_.isNull(fieldValue)
+            );
+
+            if (ruleName === 'required' && (ruleRhs === true || ruleRhs === false)) {
+              // ® Must be defined, non-null, and not the empty string
+              if (ruleRhs === false) {
+                violation = false;
+              } else {
+                violation = (
+                  !isFieldValuePresent
+                );
+              }
+            } else if (!isFieldValuePresent) {
+              // Do nothing.
+              // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+              // Note:
+              // In order to allow use with optional fields, all rules except for
+              // `required: true` are only actually checked when the field value
+              // is "present" -- i.e. some value other than `null`, `undefined`,
+              // or `''` (empty string).
+              //
+              // > Trying to figure out how to handle a conditionally-requiured
+              // > field that uses one of these validations?  For example, a
+              // > "Confirm email" re-entry field for an optional email address?
+              // > Just make `required` validation rule dynamic, and everything
+              // > else will work as expected.
+              // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+            } else if (ruleName === 'isEmail' && (ruleRhs === true || ruleRhs === false)) {
+              // ® Must be an email address (unless falsy)
+              if (ruleRhs === false) {
+                violation = false;
+              } else {
+                violation = (
+                  !parasails.util.isValidEmailAddress(fieldValue)
+                );
+              }
+            } else if (ruleName === 'isIn' && _.isArray(ruleRhs)) {
+              // ® Must be one of these things
+              violation = (
+                !_.contains(ruleRhs, fieldValue)
+              );
+            } else if (ruleName === 'is') {
+              // ® Must be exactly this thing (useful for required checkboxes)
+              violation = (
+                ruleRhs !== fieldValue
+              );
+            } else if (ruleName === 'minLength' && _.isNumber(ruleRhs)) {
+              // ® Must consist of at least this many characters
+              violation = (
+                !_.isString(fieldValue) ||
+                fieldValue.length < ruleRhs
+              );
+            } else if (ruleName === 'maxLength' && _.isNumber(ruleRhs)) {
+              // ® Must consist of no more than this many characters
+              violation = (
+                !_.isString(fieldValue) ||
+                fieldValue.length > ruleRhs
+              );
+            } else if (ruleName === 'sameAs' && ruleRhs !== '' && _.isString(ruleRhs)) {
+              // ® Must match the value in another field
+              let otherFieldName = ruleRhs;
+              let otherFieldValue = formData[otherFieldName];
+              violation = (
+                otherFieldValue !== fieldValue
+              );
+            } else if (ruleName === 'isHalfwayDecentPassword' && (ruleRhs === true || ruleRhs === false)) {
+              // ® Must be a halfway-decent password
+              // > This is an arbitrary distinction, so change it if you want.
+              // > Just... please use common sense.  And try to avoid engaging
+              // > in security theater.
+              if (ruleRhs === false) {
+                violation = false;
+              } else {
+                violation = (
+                  (!_.isString(fieldValue) && !_.isNumber(fieldValue)) ||
+                  fieldValue.length < 6
+                );
+              }
+            } else if (ruleName === 'custom' && _.isFunction(ruleRhs)) {
+              // ® Provided function must return truthy when invoked with the value.
+              try {
+                violation = (
+                  !ruleRhs(fieldValue)
+                );
+              } catch (err) {
+                console.warn(err);
+                violation = true;
+              }
+            } else {
+              throw new Error('Cannot interpret client-side validation rule (`'+ruleName+'`) because the configuration provided for it is not recognized by <ajax-form>.\n [?] If you\'re unsure, visit https://sailsjs.com/support');
+            }
+
+            // If a rule violation was detected, then set it as a form error
+            // and break out of the `for` loop to continue on to the next field.
+            // (We only track one form error per field.)
+            if (violation) {
+              formErrors[fieldName] = ruleName;
+              break;
+            }//˚
+
+          }//∞
+        }//∞
+
+        // Whether there are any errors or not, update userland "formErrors" prop
+        // so that the markup reflects the new reality (i.e. inline validation errors
+        // either get rendered or go away.)
+        this.$emit('update:formErrors', formErrors);
+
+        // If there were any form errors, avast.  (Submission will not be attempted.)
+        if (Object.keys(formErrors).length > 0) {
+          // In development mode, also log a warning
+          // (so that it's clear what's going on just in case validation
+          // states/messages are not hooked up in the HTML template)
+          if (this._environment !== 'production') {
+            console.warn(`<ajax-form> encountered ${Object.keys(formErrors).length} form error${Object.keys(formErrors).length !== 1 ? 's' : ''} when performing client-side validation of "form-data" versus "form-rules".  (Note: This warning is only here to assist with debugging-- it will not be displayed in production.  If you're unsure, check out https://sailsjs.com/support for more resources.)`, _.cloneDeep(formErrors));
+          }//fi
+          return;
+        }//•
+      }//fi  (determining argins)
+
+
+      // Set syncing state to `true` on userland "syncing" prop.
+      this.$emit('update:syncing', true);
+
+
+      // Submit the form
+      var failedWithCloudExit;
+      var rawErrorFromCloudSDK;
+      var result;
+      if (this.handleSubmitting) {
+        try {
+          // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+          // FUTURE: Consider cloning the argins ahead of time to prevent accidental mutation of form data.
+          // (but remember argins could contain File instances that might not be clone-able)
+          // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+          result = await this.handleSubmitting(argins);
+        } catch (err) {
+          rawErrorFromCloudSDK = err;
+          if (_.isString(err) && err !== '') {
+            failedWithCloudExit = err;
+          } else if (_.isError(err) && err.exit) {
+            failedWithCloudExit = err.exit;
+          } else if (_.isObject(err) && !_.isError(err) && !_.isArray(err) && !_.isFunction(err) && Object.keys(err)[0] && _.isString(Object.keys(err)[0])) {
+            failedWithCloudExit = Object.keys(err)[0];
+          } else {
+            throw err;
+          }
+        }
+      } else {
+        // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+        // FUTURE: Potentially filter unused data in argins here before proceeding
+        // (assuming cloudsdk has that information available)
+        // Or better yet, just have `Cloud.*.with()` take care of that automatically.
+        // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+        result = await Cloud[this.action].with(argins)
+        .tolerate((err)=>{
+          rawErrorFromCloudSDK = err;
+          failedWithCloudExit = err.exit || 'error';
+        });
+      }
+
+
+      // When a cloud error occurs, tolerate it, but set the userland "cloudError"
+      // prop accordingly.
+      if (failedWithCloudExit) {
+        this.$emit('update:cloudError', failedWithCloudExit);
+      }
+
+      // Set syncing state to `false` on userland "syncing" prop.
+      this.$emit('update:syncing', false);
+
+      // If the server says we were successful, then emit the "submitted" event.
+      if (!failedWithCloudExit) {
+        this.$emit('submitted', result);
+      } else {
+        this.$emit('rejected', rawErrorFromCloudSDK);
+      }
+
+    },
+
+  }
+});
diff --git a/ee/bulk-operations-dashboard/assets/js/components/cloud-error.component.js b/ee/bulk-operations-dashboard/assets/js/components/cloud-error.component.js
new file mode 100644
index 0000000000..79107b6c1a
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/js/components/cloud-error.component.js
@@ -0,0 +1,93 @@
+/**
+ * <cloud-error>
+ * -----------------------------------------------------------------------------
+ *
+ * @type {Component}
+ *
+ * --- SLOTS: ---
+ * @slot default
+ *
+ * --- EVENTS EMITTED: ---
+ * N/A
+ *
+ * -----------------------------------------------------------------------------
+ */
+
+parasails.registerComponent('cloud-error', {
+
+  //  ╔═╗╦ ╦╔╗ ╦  ╦╔═╗  ╔═╗╦═╗╔═╗╔═╗╔═╗
+  //  ╠═╝║ ║╠╩╗║  ║║    ╠═╝╠╦╝║ ║╠═╝╚═╗
+  //  ╩  ╚═╝╚═╝╩═╝╩╚═╝  ╩  ╩╚═╚═╝╩  ╚═╝
+  props: [
+    'withoutMargins'
+  ],
+
+  //  ╦╔╗╔╦╔╦╗╦╔═╗╦    ╦╔╗╔╔╦╗╔═╗╦═╗╔╗╔╔═╗╦    ╔═╗╔╦╗╔═╗╔╦╗╔═╗
+  //  ║║║║║ ║ ║╠═╣║    ║║║║ ║ ║╣ ╠╦╝║║║╠═╣║    ╚═╗ ║ ╠═╣ ║ ║╣
+  //  ╩╝╚╝╩ ╩ ╩╩ ╩╩═╝  ╩╝╚╝ ╩ ╚═╝╩╚═╝╚╝╩ ╩╩═╝  ╚═╝ ╩ ╩ ╩ ╩ ╚═╝
+  data: function () {
+    return {
+      beWithoutMargins: undefined,
+    };
+  },
+
+  beforeMount: function() {
+    if (this.withoutMargins !== undefined && typeof this.withoutMargins !== 'boolean') {
+      throw new Error('<cloud-error> received an invalid `withoutMargins`.  If provided, this prop should be precisely true or false.');
+    }
+    this.beWithoutMargins = this.withoutMargins||false;
+  },
+
+  //  ╦ ╦╔╦╗╔╦╗╦
+  //  ╠═╣ ║ ║║║║
+  //  ╩ ╩ ╩ ╩ ╩╩═╝
+  template: `
+  <div>
+    <p :class="{ 'm-0': beWithoutMargins }" class="text-danger"><slot name="default">An error occured while processing your request. Please check your information and try again, or <a href="/contact">contact support</a> if the error persists.</slot></p>
+  </div>
+  `,
+
+  //  ╦  ╦╔═╗╔═╗╔═╗╦ ╦╔═╗╦  ╔═╗
+  //  ║  ║╠╣ ║╣ ║  ╚╦╝║  ║  ║╣
+  //  ╩═╝╩╚  ╚═╝╚═╝ ╩ ╚═╝╩═╝╚═╝
+  mounted: async function () {
+
+  },
+
+  watch: {
+    withoutMargins: function(unused) { throw new Error('Changes to `withoutMargins` are not currently supported in <cloud-error>!'); },
+  },
+
+  beforeDestroy: function() {
+
+  },
+
+  //  ╦╔╗╔╔╦╗╔═╗╦═╗╔═╗╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
+  //  ║║║║ ║ ║╣ ╠╦╝╠═╣║   ║ ║║ ║║║║╚═╗
+  //  ╩╝╚╝ ╩ ╚═╝╩╚═╩ ╩╚═╝ ╩ ╩╚═╝╝╚╝╚═╝
+  methods: {
+
+    //  ╦╔╗╔╔╦╗╔═╗╦═╗╔╗╔╔═╗╦    ╔═╗╦  ╦╔═╗╔╗╔╔╦╗  ╦ ╦╔═╗╔╗╔╔╦╗╦  ╔═╗╦═╗╔═╗
+    //  ║║║║ ║ ║╣ ╠╦╝║║║╠═╣║    ║╣ ╚╗╔╝║╣ ║║║ ║   ╠═╣╠═╣║║║ ║║║  ║╣ ╠╦╝╚═╗
+    //  ╩╝╚╝ ╩ ╚═╝╩╚═╝╚╝╩ ╩╩═╝  ╚═╝ ╚╝ ╚═╝╝╚╝ ╩   ╩ ╩╩ ╩╝╚╝═╩╝╩═╝╚═╝╩╚═╚═╝
+
+    //…
+
+    //  ╔═╗╦ ╦╔╗ ╦  ╦╔═╗  ╔╦╗╔═╗╔╦╗╦ ╦╔═╗╔╦╗╔═╗
+    //  ╠═╝║ ║╠╩╗║  ║║    ║║║║╣  ║ ╠═╣║ ║ ║║╚═╗
+    //  ╩  ╚═╝╚═╝╩═╝╩╚═╝  ╩ ╩╚═╝ ╩ ╩ ╩╚═╝═╩╝╚═╝
+    // > Public methods are rarely exposed by Vue components, but sometimes they
+    // > are an important escape hatch.  They are callable via something like
+    // > `this.$refs.componentNameInCamelCase.doSomething())`, and, by convention,
+    // > are always prefixed with "do".
+    // N/A
+
+    //  ╔═╗╦═╗╦╦  ╦╔═╗╔╦╗╔═╗  ╔╦╗╔═╗╔╦╗╦ ╦╔═╗╔╦╗╔═╗
+    //  ╠═╝╠╦╝║╚╗╔╝╠═╣ ║ ║╣   ║║║║╣  ║ ╠═╣║ ║ ║║╚═╗
+    //  ╩  ╩╚═╩ ╚╝ ╩ ╩ ╩ ╚═╝  ╩ ╩╚═╝ ╩ ╩ ╩╚═╝═╩╝╚═╝
+
+    //…
+
+  }
+
+});
diff --git a/ee/bulk-operations-dashboard/assets/js/components/file-upload.component.js b/ee/bulk-operations-dashboard/assets/js/components/file-upload.component.js
new file mode 100644
index 0000000000..d10816e7ab
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/js/components/file-upload.component.js
@@ -0,0 +1,304 @@
+/**
+ * <file-upload>
+ * -----------------------------------------------------------------------------
+ * A form component which includes a file input,
+ * and handles showing a preview image when a file is selected.
+ *
+ * @type {Component}
+ *
+ * -----------------------------------------------------------------------------
+ * @slot image-upload-instructions
+ *                  Optional override for the HTML to display next to the image.
+ *                  (Only relevant when mode="image".)
+ * -----------------------------------------------------------------------------
+ * @event input   - emitted when a file upload is selectd or cleared privately
+ *                  (i.e. using the native file picker).  May be used implicitly
+ *                  with v-model -- e.g.:
+ *                      v-model="formData.logoUpload"
+ *
+ *                  And also explicitly with an @input listener -- e.g.:
+ *                      @input="inputLogoUpload($event)"
+ *
+ *                  In either case, the handler is passed a File instance.
+ *                  File instances can be passed around directly to a lot of
+ *                  things (like parasails/Cloud SDK), and you can also extract
+ *                  a data URI string from them using either FileReader's
+ *                  `.readAsDataURL()` or URL's `createObjectURL(file)`.
+ *                  Links:
+ *                   • https://developer.mozilla.org/en-US/docs/Web/API/FileReader/readAsDataURL
+ *                   • https://developer.mozilla.org/en-US/docs/Web/API/File/Using_files_from_web_applications#Example_Using_object_URLs_to_display_images#Example_Using_object_URLs_to_display_images
+ * -----------------------------------------------------------------------------
+ */
+
+parasails.registerComponent('fileUpload', {
+
+  //  ╔═╗╦═╗╔═╗╔═╗╔═╗
+  //  ╠═╝╠╦╝║ ║╠═╝╚═╗
+  //  ╩  ╩╚═╚═╝╩  ╚═╝
+  props: [
+    'mode', //« Tells us us whether this component should be mounted in the default "file" mode (miscellaneous file) or mounted with an image previewer in "image" mode.
+    'disabled',//« for disabling from the outside (e.g. while syncing)
+
+    'value',//« for v-model -- should not be used to set initial value
+
+    // Note that, for now, `value` is completely separate from initialFileName,
+    // initialMimeType, initialFileSize, and initialSrc.  These props are how
+    // you indicate the initial value for this file upload field.
+    // > FUTURE: Find some way to unify these props with `value` aka v-model
+    // > (see also other FUTURE note below about "value" watcher)
+    'initialFileName',// « file name (basename including extension; no path)
+    'initialFileMimeType',// « the file's MIME type (string)
+    'initialFileSize',// « number of bytes (positive integer)
+    'placeholderImageSrc',// « the placeholder image to display when no image is selected (e.g. a custom silhouette)
+    'initialSrc',// «Conventional approach is to either (A) prepare this on the
+    // backend so it can use the configured baseUrl and/or cache-busting, then
+    // pass that in here, or (B) to use a root-relative URL.  Either way, we
+    // always provide the proper dynamic URL here if we have one and just let
+    // the corresponding download action take care of either grabbing the real
+    // dynamic file or streaming a static placeholder file from disk (e.g. a
+    // fake avatar).  **THAT SAID:** If this initialSrc is omitted, then a
+    // baked-in placeholder image is used instead.  That allows the UI to
+    // display a file-upload-previewer-specific icon (by default, a photo icon)
+    'buttonClass',//« any classes to include on the button other than 'file-upload-button'.
+    // defaults to 'btn btn-outline-primary'
+  ],
+
+  //  ╦╔╗╔╦╔╦╗╦╔═╗╦    ╔═╗╔╦╗╔═╗╔╦╗╔═╗
+  //  ║║║║║ ║ ║╠═╣║    ╚═╗ ║ ╠═╣ ║ ║╣
+  //  ╩╝╚╝╩ ╩ ╩╩ ╩╩═╝  ╚═╝ ╩ ╩ ╩ ╩ ╚═╝
+  data: function (){
+    return {
+      isEmpty: false,// « whether or not this upload field is empty
+      previewSrc: undefined,// « determined by initialSrc or the bytes from a selected file upload
+      isCurrentlyDisabled: false, //« controlled by watching `disabled` prop
+      isReadingFileUpload: false, //« spinlock
+      selectedFileName: undefined,
+      selectedFileMimeType: undefined,
+      selectedFileIconClass: undefined,
+      selectedFileSize: undefined,
+    };
+  },
+
+  //  ╦ ╦╔╦╗╔╦╗╦
+  //  ╠═╣ ║ ║║║║
+  //  ╩ ╩ ╩ ╩ ╩╩═╝
+  template: `
+  <div class="clearfix" :class="[mode === 'image' ? 'image-mode' : 'file-mode', isCurrentlyDisabled ? 'disabled' : '']">
+    <div v-if="mode === 'profiles'">
+      <div purpose="profile-upload-input" v-if="isEmpty">
+        <div class="d-flex flex-column align-items-center">
+          <!-- <input id='file-upload' type="file" > -->
+          <img style="height: 40px; width: 34px;" src="/images/profile-34x40@2x.png">
+          <p><strong>Upload configuration profile</strong></p>
+          <p class="muted">.mobileconfig and .json for macOS, iOS, and iPadOS.</p>
+          <p class="muted">.xml for Windows.</p>
+          <div class="btn-and-tips-if-relevant">
+            <label purpose="file-upload" for="file-upload-input">
+              <img src="/images/upload-16x17@2x.png" style="height: 16px; width: 16px; margin-right: 8px">Choose File
+            </label>
+            <input id="file-upload-input" type="file" class="file-input d-none" :disabled="isCurrentlyDisabled" accept=".xml,.mobileconfig,.json" @change="changeFileInput($event)"/>
+          </div>
+        </div>
+      </div>
+      <div purpose="profile-information" v-else>
+        <div class="d-flex flex-row justify-content-start">
+          <img style="height: 40px; width: 34px;" src="/images/profile-34x40@2x.png">
+          <div class="d-flex flex-column">
+            <p><strong>{{selectedFileName.replace(/\.(xml|mobileconfig|json)$/g, '').replace(/^\d{4}-\d{2}-\d{2}_/, '')}}</strong></p>
+            <p class="muted" v-if="_.endsWith(selectedFileName, 'xml')">Windows</p>
+            <p class="muted" v-else>macOS, iOS, iPadOS</p>
+          </div>
+        </div>
+      </div>
+    </div>
+    <div v-else-if="mode === 'scripts'">
+      <div purpose="script-upload-input" v-if="isEmpty">
+        <div class="d-flex flex-column align-items-center">
+          <!-- <input id='file-upload' type="file" > -->
+          <div class="d-flex flex-row justify-content-center mb-2">
+            <img style="height: 40px; width: 34px; margin-right: 16px;" src="/images/script-icon-sh-34x40@2x.png">
+            <img style="height: 40px; width: 34px;" src="/images/script-icon-ps1-34x40@2x.png">
+          </div>
+          <p class="mb-2">Shell (.sh) for macOS and Linux or PowerShell (.ps1) for Windows</p>
+          <p style="color: #8B8FA2" class="muted">By default, scripts will run with “#!/bin/sh” on macOS and Linux. </p>
+          <div class="btn-and-tips-if-relevant">
+            <label purpose="file-upload" for="file-upload-input">
+              <img src="/images/upload-16x17@2x.png" style="height: 16px; width: 16px; margin-right: 8px">Choose file
+            </label>
+            <input id="file-upload-input" type="file" class="file-input d-none" :disabled="isCurrentlyDisabled" accept=".sh,.ps1" @change="changeFileInput($event)"/>
+          </div>
+        </div>
+      </div>
+      <div purpose="script-information" v-else>
+        <div class="d-flex flex-row justify-content-start">
+          <img style="height: 40px; width: 34px;" src="/images/script-icon-ps1-34x40@2x.png" v-if="_.endsWith(selectedFileName, 'ps1')">
+          <img style="height: 40px; width: 34px;" src="/images/script-icon-sh-34x40@2x.png" v-else>
+          <div class="d-flex flex-column">
+            <p><strong>{{selectedFileName}}</strong></p>
+            <p class="muted" v-if="_.endsWith(selectedFileName, 'ps1')">Windows</p>
+            <p class="muted" v-else>macOS & Linux</p>
+          </div>
+        </div>
+      </div>
+    </div>
+  </div>
+  `,
+
+  //  ╦  ╦╔═╗╔═╗╔═╗╦ ╦╔═╗╦  ╔═╗
+  //  ║  ║╠╣ ║╣ ║  ╚╦╝║  ║  ║╣
+  //  ╩═╝╩╚  ╚═╝╚═╝ ╩ ╚═╝╩═╝╚═╝
+  beforeMount: function() {
+    // Validate and then absorb initial props
+    if ((this.initialFileMimeType || this.initialFileMimeType) && !this.initialFileName) {
+      throw new Error('<file-upload>: If "initial-file-mime-type" or "initial-file-size" is provided, then "initial-file-name" must also be provided.');
+    }
+    if (this.mode !== 'image' && this.initialSrc) {
+      throw new Error('<file-upload>: Cannot set "initial-src" unless "mode" is "image".');
+    }
+    if (this.mode === 'image' && this.initialFileName) {
+      throw new Error('<file-upload>: Cannot set "initial-file-name" or "initial-file-mime-type" if "mode" is "image".');
+    }
+
+    if (this.initialSrc) {
+      this.isEmpty = false;
+      this.previewSrc = this.initialSrc;
+    } else if (this.initialFileName) {
+      this.isEmpty = false;
+      this.selectedFileName = this.initialFileName;
+      this.selectedFileMimeType = this.initialFileMimeType;
+      // this.selectedFileIconClass = parasails.util.getMimetypeIconClass(this.initialFileMimeType);
+      this.selectedFileSize = this.initialFileSize;
+    } else {
+      this.isEmpty = true;
+    }
+
+    this.isCurrentlyDisabled = !!this.disabled;
+  },
+  mounted: function (){
+    //…
+  },
+  beforeDestroy: function() {
+    //…
+  },
+  watch: {
+    disabled: function(newVal, unusedOldVal) {
+      this.isCurrentlyDisabled = !!newVal;
+    },
+    value: function(newFile, unusedOldVal) {
+      this._absorbValue(newFile);
+    },
+  },
+
+  //  ╦╔╗╔╔╦╗╔═╗╦═╗╔═╗╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
+  //  ║║║║ ║ ║╣ ╠╦╝╠═╣║   ║ ║║ ║║║║╚═╗
+  //  ╩╝╚╝ ╩ ╚═╝╩╚═╩ ╩╚═╝ ╩ ╩╚═╝╝╚╝╚═╝
+  methods: {
+    // FUTURE: add alias that makes clicking on image previewer open the file picker (but only if there is no existing image)
+    // FUTURE: if dragging compatible file onto the window, display previewer and button as dropzones
+    // FUTURE: think of some way to elegantly deal with paste (probably only for images though)
+
+    changeFileInput: function($event) {
+      // Apply spinlock
+      if (this.isReadingFileUpload || this.isCurrentlyDisabled) {
+        // Note that we can't preventDefault on an input's change event (it's
+        // not supported by the browser), so it's possible to end up in a weird
+        // situation here where the file input has changed in the DOM, but neither
+        // our file previewer nor the harvested form data reflects that.
+        // FUTURE: Look for solutions to this edgiest of edge cases
+        return;
+      }//• (avast)
+
+      var files = $event.target.files;
+      if (files.length > 1) {
+        throw new Error('<file-upload> component received multiple files!  But at this time, multiple file uploads are not supported, so this should never happen!');
+      }
+
+      // Cancelling the native upload window sets `files` to an empty array.
+      // So to address this, if you cancel from the native upload window, then
+      // we just avast (return early).
+      // > In this case, we'll just leave the harvested form data as it was, and
+      // > the previewer displaying whatever you had there before.
+      var selectedFile = files[0];
+      if (!selectedFile) {
+        return;
+      }//•
+
+      // Even though triggering the input event should fire our watcher, which
+      // will do exactly the same thing as this, still go ahead and manually
+      // absorb the new file beforehand.
+      // > This is just in case the variable provided to v-model/:value is
+      // > immutable, such as if it came from `slot-scope` of a parent component.
+      this._absorbValue(selectedFile);
+      // • FUTURE: make this component smarter so that the browser doesn't have
+      //           to double-read the file's bytes in this edge case.  (But this
+      //           kind of caching is pretty bug-prone so we should be careful.)
+
+      // Emit an event so the v-model can update with our selected file.
+      this.$emit('input', selectedFile);
+
+    },
+
+    //  ╔═╗╦ ╦╔╗ ╦  ╦╔═╗  ╔╦╗╔═╗╔╦╗╦ ╦╔═╗╔╦╗╔═╗
+    //  ╠═╝║ ║╠╩╗║  ║║    ║║║║╣  ║ ╠═╣║ ║ ║║╚═╗
+    //  ╩  ╚═╝╚═╝╩═╝╩╚═╝  ╩ ╩╚═╝ ╩ ╩ ╩╚═╝═╩╝╚═╝
+    doOpenFileBrowser: function() {
+      this.$find('[type="file"]').trigger('click');
+    },
+
+    //  ╔═╗╦═╗╦╦  ╦╔═╗╔╦╗╔═╗  ╔╦╗╔═╗╔╦╗╦ ╦╔═╗╔╦╗╔═╗
+    //  ╠═╝╠╦╝║╚╗╔╝╠═╣ ║ ║╣   ║║║║╣  ║ ╠═╣║ ║ ║║╚═╗
+    //  ╩  ╩╚═╩ ╚╝ ╩ ╩ ╩ ╚═╝  ╩ ╩╚═╝ ╩ ╩ ╩╚═╝═╩╝╚═╝
+    _absorbValue: function(newFile) {
+      // console.log(newFile);
+      if (!newFile) {
+        this.isEmpty = true;
+        this.previewSrc = undefined;
+        this.selectedFileName = undefined;
+        this.selectedFileMimeType = undefined;
+        this.selectedFileSize = undefined;
+      } else if (_.isObject(newFile) && newFile.name) {
+        // Duck-type File instance
+
+        // Set vm data for the filename and file MIME type in order to render
+        // help text / appropriate icon in the DOM.
+        this.isEmpty = false;
+        this.selectedFileName = newFile.name;
+        this.selectedFileName = this.selectedFileName.replace(/^\d{4}\-\d{2}\-\d{2}_/, '');
+        this.selectedFileMimeType = newFile.type;
+        this.selectedFileIconClass = parasails.util.getMimetypeIconClass(newFile.type);
+        this.selectedFileSize = newFile.size;
+        // console.log(newFile);
+        if (this.mode === 'image') {
+          // Set up the file preview for the UI, start reading, and when finished,
+          // tear it all down.  (Note that we're using a spinlock just to be safe,
+          // in case it turns out we're dealing with a huge file for some reason.)
+          this.isReadingFileUpload = true;
+          let reader = new FileReader();
+          reader.onload = (event)=>{
+            this.previewSrc = event.target.result;
+
+            // Unbind this "onload" event & release the lock.
+            delete reader.onload;
+            this.isReadingFileUpload = false;
+          };//œ
+          reader.readAsDataURL(newFile);
+        }//fi
+        // • FUTURE: potentially support changing this "value" to any arbitrary
+        //           Blob instance.
+        //           (see also FUTURE note above about replacing initial-src,
+        //           etc. with tighter v-model integration)
+      } else {
+        throw new Error(
+          'Changing to that value (v-model) for a <file-upload> component from '+
+          'the outside is not yet supported!  (Currently, this component only '+
+          'supports programmatically setting the value to `null`.)'
+        );
+      }//fi
+      // • FUTURE: potentially also support passing in a string (URL) as some
+      //           other prop, then automatically fetching a Blob from it, and
+      //           finally emitting an "input" event to set the v-model properly.
+    }
+
+  }
+
+});
diff --git a/ee/bulk-operations-dashboard/assets/js/components/js-timestamp.component.js b/ee/bulk-operations-dashboard/assets/js/components/js-timestamp.component.js
new file mode 100644
index 0000000000..e37cddb165
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/js/components/js-timestamp.component.js
@@ -0,0 +1,130 @@
+/**
+ * <js-timestamp>
+ * -----------------------------------------------------------------------------
+ * A human-readable, self-updating "timeago" timestamp, with some special rules:
+ *
+ * • Within 24 hours, displays in "timeago" format.
+ * • Within a month, displays month, day, and time of day.
+ * • Within a year, displays just the month and day.
+ * • Older/newer than that, displays the month and day with the full year.
+ *
+ * @type {Component}
+ * -----------------------------------------------------------------------------
+ */
+
+parasails.registerComponent('jsTimestamp', {
+
+  //  ╔═╗╦═╗╔═╗╔═╗╔═╗
+  //  ╠═╝╠╦╝║ ║╠═╝╚═╗
+  //  ╩  ╩╚═╚═╝╩  ╚═╝
+  props: [
+    'at',// « The JS timestamp to format
+    'short',// « Whether to shorten the formatted date by not including the time of day (may only be used with timeago, and even then only applicable in certain situations)
+    'format',// « one of: 'calendar', 'timeago' (defaults to 'timeago'.  Otherwise, the "calendar" format displays data as US-style calendar dates with a four-character year, separated by dashes.  In other words: "MM-DD-YYYY")
+  ],
+
+  //  ╦╔╗╔╦╔╦╗╦╔═╗╦    ╔═╗╔╦╗╔═╗╔╦╗╔═╗
+  //  ║║║║║ ║ ║╠═╣║    ╚═╗ ║ ╠═╣ ║ ║╣
+  //  ╩╝╚╝╩ ╩ ╩╩ ╩╩═╝  ╚═╝ ╩ ╩ ╩ ╩ ╚═╝
+  data: function (){
+    return {
+      formatType: undefined,
+      formattedTimestamp: '',
+      interval: undefined
+    };
+  },
+
+  //  ╦ ╦╔╦╗╔╦╗╦
+  //  ╠═╣ ║ ║║║║
+  //  ╩ ╩ ╩ ╩ ╩╩═╝
+  template: `
+  <span>{{formattedTimestamp}}</span>
+  `,
+
+  //  ╦  ╦╔═╗╔═╗╔═╗╦ ╦╔═╗╦  ╔═╗
+  //  ║  ║╠╣ ║╣ ║  ╚╦╝║  ║  ║╣
+  //  ╩═╝╩╚  ╚═╝╚═╝ ╩ ╚═╝╩═╝╚═╝
+  beforeMount: function() {
+    if (this.at === undefined) {
+      throw new Error('Incomplete usage of <js-timestamp>:  Please specify `at` as a JS timestamp (i.e. epoch ms, a number).  For example: `<js-timestamp :at="something.createdAt">`');
+    }
+    if(this.format === undefined) {
+      this.formatType = 'timeago';
+    } else  {
+      if(!_.contains(['calendar', 'timeago'], this.format)) { throw new Error('Unsupported `format` ('+this.format+') passed in to the JS timestamp component! Must be either \'calendar\' or \'timeago\'.'); }
+      this.formatType = this.format;
+    }
+
+    // If timeago timestamp, update the timestamp every minute.
+    if(this.formatType === 'timeago') {
+      this._formatTimeago();
+      this.interval = setInterval(async()=>{
+        try {
+          this._formatTimeago();
+          await this.forceRender();
+        } catch (err) {
+          err.raw = err;
+          throw new Error('Encountered unexpected error while attempting to automatically re-render <js-timestamp> in the background, as the seconds tick by.  '+err.message);
+        }
+      },60*1000);//œ
+    }
+
+    // If calendar timestamp, just set it the once.
+    // (Also don't allow usage with `short`.)
+    if(this.formatType === 'calendar') {
+      this.formattedTimestamp = moment(this.at).format('MM-DD-YYYY');
+      if (this.short) {
+        throw new Error('Invalid usage of <js-timestamp>:  Cannot use `short="true"` at the same time as `format="calendar"`.');
+      }
+    }
+  },
+
+  beforeDestroy: function() {
+    if(this.formatType === 'timeago') {
+      clearInterval(this.interval);
+    }
+  },
+
+  watch: {
+    at: function() {
+      // Render to account for after-mount programmatic changes to `at`.
+      if(this.formatType === 'timeago') {
+        this._formatTimeago();
+      } else if(this.formatType === 'calendar') {
+        this.formattedTimestamp = moment(this.at).format('MM-DD-YYYY');
+      } else {
+        throw new Error();
+      }
+    }
+  },
+
+
+  //  ╦╔╗╔╔╦╗╔═╗╦═╗╔═╗╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
+  //  ║║║║ ║ ║╣ ╠╦╝╠═╣║   ║ ║║ ║║║║╚═╗
+  //  ╩╝╚╝ ╩ ╚═╝╩╚═╩ ╩╚═╝ ╩ ╩╚═╝╝╚╝╚═╝
+  methods: {
+
+    _formatTimeago: function() {
+      var now = new Date().getTime();
+      var timeDifference = Math.abs(now - this.at);
+
+      // If the timestamp is less than a day old, format as time ago.
+      if(timeDifference < 1000*60*60*24) {
+        this.formattedTimestamp = moment(this.at).fromNow();
+      } else {
+        // If the timestamp is less than a month-ish old, we'll include the
+        // time of day in the formatted timestamp.
+        let includeTime = !this.short && timeDifference < 1000*60*60*24*31;
+
+        // If the timestamp is from a different year, we'll include the year
+        // in the formatted timestamp.
+        let includeYear = moment(now).format('YYYY') !== moment(this.at).format('YYYY');
+
+        this.formattedTimestamp = moment(this.at).format('MMMM DD'+(includeYear ? ', YYYY' : '')+(includeTime ? ' [at] h:mma' : ''));
+      }
+
+    }
+
+  }
+
+});
diff --git a/ee/bulk-operations-dashboard/assets/js/components/modal.component.js b/ee/bulk-operations-dashboard/assets/js/components/modal.component.js
new file mode 100644
index 0000000000..a5f924fd39
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/js/components/modal.component.js
@@ -0,0 +1,226 @@
+/**
+ * <modal>
+ * -----------------------------------------------------------------------------
+ * A modal dialog pop-up.
+ *
+ * > Be careful adding other Vue.js lifecycle callbacks in this file!  The
+ * > finnicky combination of Vue transitions and bootstrap modal animations used
+ * > herein work, and are very well-tested in practical applications.  But any
+ * > changes to that specific cocktail could be unpredictable, with unsavory
+ * > consequences.
+ *
+ * @type {Component}
+ *
+ * @event close   [emitted when the closing process begins]
+ * @event opened  [emitted when the opening process is completely done]
+ * -----------------------------------------------------------------------------
+ */
+
+parasails.registerComponent('modal', {
+  //  ╔═╗╦═╗╔═╗╔═╗╔═╗
+  //  ╠═╝╠╦╝║ ║╠═╝╚═╗
+  //  ╩  ╩╚═╚═╝╩  ╚═╝
+  props: [
+    'hideCloseButton'//« removes the default "x" button
+  ],
+
+  //  ╦╔╗╔╦╔╦╗╦╔═╗╦    ╔═╗╔╦╗╔═╗╔╦╗╔═╗
+  //  ║║║║║ ║ ║╠═╣║    ╚═╗ ║ ╠═╣ ║ ║╣
+  //  ╩╝╚╝╩ ╩ ╩╩ ╩╩═╝  ╚═╝ ╩ ╩ ╩ ╩ ╚═╝
+  data: function (){
+    return {
+      // Spinlock used for preventing trying to close the bootstrap modal more than once.
+      // (in practice it doesn't seem to hurt anything if it tries to close more than once,
+      // but still.... better safe than sorry!)
+      _bsModalIsAnimatingOut: false,
+
+      isMobileSafari: false,//« more on this below
+      originalScrollPosition: undefined,//« more on this below
+    };
+  },
+
+  //  ╦ ╦╔╦╗╔╦╗╦
+  //  ╠═╣ ║ ║║║║
+  //  ╩ ╩ ╩ ╩ ╩╩═╝
+  template: `
+  <transition name="modal" v-on:leave="leave" v-bind:css="false">
+    <div class="modal fade" tabindex="-1" role="dialog">
+      <div class="petticoat"></div>
+      <div class="modal-dialog custom-width position-relative" role="document" purpose="modal-dialog">
+        <div class="modal-content" purpose="modal-content">
+          <button type="button" style="top: 5px; right: 0; font-size: 28px; line-height: 1;" class="py-2 px-3 position-absolute" data-dismiss="modal" aria-label="Close" purpose="modal-close-button" v-if="!hideCloseButton">&times;</button>
+          <slot></slot>
+        </div><!-- /.modal-content -->
+      </div><!-- /.modal-dialog -->
+    </div><!-- /.modal -->
+  </transition>
+  `,
+
+  //  ╦  ╦╔═╗╔═╗╔═╗╦ ╦╔═╗╦  ╔═╗
+  //  ║  ║╠╣ ║╣ ║  ╚╦╝║  ║  ║╣
+  //  ╩═╝╩╚  ╚═╝╚═╝ ╩ ╚═╝╩═╝╚═╝
+  beforeMount: function() {
+    // If this is mobile safari, make note of it.
+    this.isMobileSafari = (typeof bowser !== 'undefined') && bowser.mobile && bowser.safari;
+    // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+    // ^^So there's a bug in mobile safari that misplaces the caret when the keyboard opening
+    // causes the page to scroll, so we need to do some special tricks to keep it from getting ugly.
+    // It's only in iOS 11... we think.  Hopefully it will be fixed.
+    // In the mean time, we have to get wacky.
+    //
+    // > More info about the bug here:
+    // > https://github.com/twbs/bootstrap/issues/24835#issuecomment-345974819
+    // > https://stackoverflow.com/questions/46567233/how-to-fix-the-ios-11-input-element-in-fixed-modals-bug?rq=1
+    //
+    // FUTURE: maybe the bug will be fixed and we can remove this someday?
+    // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+    if(this.isMobileSafari) {
+      // Get our original scroll position before opening the modal and save it for later.
+      this.originalScrollPosition = $(window).scrollTop();
+    }
+  },
+  mounted: function(){
+    // ^^ Note that this is not an `async function`.
+    // This is just to be safe, since the timing here is a little tricky w/ the
+    // animations and the fact that we're integrating with Bootstrap's modal.
+    // (That said, it might work fine-- just hasn't been extensively tested.)
+
+    // Immediately call out to the Bootstrap modal and tell it to show itself.
+    $(this.$el).modal({
+      // Set the modal backdrop to the 'static' option, which means it doesn't close the modal
+      // when clicked.
+      backdrop: 'static',
+      show: true
+    });
+
+    // Attach listener for underlying custom modal closing event,
+    // and when that happens, have Vue emit a custom "close" event.
+    // (Note: This isn't just for convenience-- it's crucial that
+    // the parent logic can use this event to update its scope.)
+    $(this.$el).on('hide.bs.modal', ()=>{
+
+      // Undo any mobile safari workarounds we may have added.
+      // (i.e. shed the wackiness)
+      if(this.isMobileSafari) {
+        // Remove style overrides on our modal dialog.
+        $(this.$el).css({
+          'overflow-y': '',
+          'position': '',
+          'left': '',
+          'top': '',
+        });
+
+        // Beckon to our siblings so they come out of hiding
+        this.$get().parent().children().not(this.$el).css({
+          'display': ''
+        });
+
+        // Scroll to our original position when the modal was summoned.
+        window.scrollTo(0, this.originalScrollPosition);
+      }//fi
+
+      this._bsModalIsAnimatingOut = true;
+      this.$emit('close');
+
+    });//œ
+
+    // Attach listener for underlying custom modal "opened" event,
+    // and when that happens, have Vue emit our own custom "opened" event.
+    // This is so we know when the entry animation has completed, allows
+    // us to do cool things like auto-focus the first input in a form modal.
+    $(this.$el).on('shown.bs.modal', ()=>{
+
+      // If this is mobile safari, let's get wacky.
+      if(this.isMobileSafari) {
+        // Scroll to the top of the page.
+        window.scrollTo(0, 0);
+        // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+        // ^^FUTURE: Don't actually do this -- instead, try setting `top` of the
+        // modal to whatever the original scrollTop of our window was.  This
+        // eliminates the need for auto-scrolling to the top and ripping you out
+        // of the context you were in before the modal opens.  It would also allow
+        // us to keep the nice animation when opening/closing modals on iOS.
+        // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+        // Hide siblings to lop off any extra space at the bottom.
+        this.$get().parent().children().not(this.$el).css({
+          'display': 'none'
+        });
+        // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+        // ^^FUTURE: Instead of just hiding siblings, which isn't perfect and won't
+        // always work for everyone, try grabbing outerHeight of the modal element
+        // and using that to set an explicit height for the body.
+        // (but also be sure to handle the case where the body is short!)
+        // But for now, this should work as long as we have sticky footer styles.
+        // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+        // Hard code some style overrides on our modal dialog.
+        // Without these, it gets weird.
+        $(this.$el).css({
+          'overflow-y': 'auto!important',
+          'position': 'absolute',
+          'left': '0',
+          'top': '0',
+        });
+      }//fi
+
+      // Focus our "focus-first" field, if relevant.
+      // (but not on mobile, because it can get weird)
+      if(typeof bowser !== 'undefined' && !bowser.mobile && this.$find('[focus-first]').length > 0) {
+        this.$focus('[focus-first]');
+      }
+
+      this.$emit('opened');
+      $(this.$el).off('shown.bs.modal');
+    });//ƒ
+  },
+  // ^Note that there is no `beforeDestroy()` lifecycle callback in this
+  // component. This is on purpose, since the timing vs. `leave()` gets tricky.
+
+  //  ╦╔╗╔╔╦╗╔═╗╦═╗╔═╗╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
+  //  ║║║║ ║ ║╣ ╠╦╝╠═╣║   ║ ║║ ║║║║╚═╗
+  //  ╩╝╚╝ ╩ ╚═╝╩╚═╩ ╩╚═╝ ╩ ╩╚═╝╝╚╝╚═╝
+  methods: {
+
+    leave: function (el, done) {
+      // > Note: This function signature comes from Vue.js's transition system.
+      // > It will likely be replaced with `async function (el){…}` in a future
+      // > release of Vue/Sails.js (i.e. no callback argument).
+
+      // If this shutting down was spawned by the bootstrap modal's built-in logic,
+      // then we'll have already begun animating the modal shut.  So we check our
+      // spinlock to make sure.  If it turns out that we HAVEN'T started that process
+      // yet, then we go ahead and start it now.
+      if (!this._bsModalIsAnimatingOut) {
+        $(this.$el).modal('hide');
+      }//fi
+
+      // When the bootstrap modal finishes animating into nothingness, unbind all
+      // the DOM events used by bootstrap, and then call `done()`, which passes
+      // control back to Vue and lets it finish the job (i.e. afterLeave).
+      //
+      // > Note that the other lifecycle events like `destroyed` were actually
+      // > already fired at this point.
+      // >
+      // > Also note that, since we're potentially long past the `destroyed` point
+      // > of the lifecycle here, we can't call `.$emit()` anymore either.  So,
+      // > for example, we wouldn't be able to emit a "fullyClosed" event --
+      // > because by the time it'd be appropriate to emit the Vue event, our
+      // > context for triggering it (i.e. the relevant instance of this component)
+      // > will no longer be capable of emitting custom Vue events (because by then,
+      // > it is no longer "reactive").
+      // >
+      // > For more info, see:
+      // > https://github.com/vuejs/vue-router/issues/1302#issuecomment-291207073
+      $(this.$el).on('hidden.bs.modal', ()=>{
+        $(this.$el).off('hide.bs.modal');
+        $(this.$el).off('hidden.bs.modal');
+        $(this.$el).off('shown.bs.modal');
+        done();
+      });//_∏_
+
+    },
+
+  }
+});
diff --git a/ee/bulk-operations-dashboard/assets/js/components/multifield.component.js b/ee/bulk-operations-dashboard/assets/js/components/multifield.component.js
new file mode 100644
index 0000000000..530ab7ef6e
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/js/components/multifield.component.js
@@ -0,0 +1,282 @@
+/**
+ * <multifield>
+ * -----------------------------------------------------------------------------
+ *
+ * @type {Component}
+ *
+ * --- SLOTS: ---
+ * @slot item-field
+ *       The template to use for each field.
+ *       > Also note:
+ *       > If this slot contains exactly one element with `role="focusable"` or
+ *       > `focus-first`, that element will be focused automatically on add/remove.
+ *       @param {Ref} item
+ *       @param {Function} doSet
+ *       @param {Array} allItems
+ *       @param {Number} idx
+ *
+ * --- EVENTS EMITTED: ---
+ * @event input
+ *
+ * -----------------------------------------------------------------------------
+ */
+
+parasails.registerComponent('multifield', {
+
+  //  ╔═╗╦═╗╔═╗╔═╗╔═╗
+  //  ╠═╝╠╦╝║ ║╠═╝╚═╗
+  //  ╩  ╩╚═╚═╝╩  ╚═╝
+  props: [
+    'value',// « 2-way (for v-model)
+    'addButtonText',//« Custom text for the "+ Add another" button (optional)
+    'inputType',// For customizing the input type.
+    'selectOptions',// For select support. An array of objects that have a name and value. ex: [{name: macOS, value: darwin}, {name: Windows, value: windows}]
+    'nameAndHostCountSelectOptions',// For nameAndHostCountSelect support. An array of objects that have a name, id, and hostCount. ex: [{"name": "Microsoft office for macOS 16.76","id": 289874,"hostCount": 1}]
+    'cloudError',// For highlighting fields, for this to work, the error response needs to return the value of the invalid fields, see api/controllers/update-priority-vulnerabilities to see an example of this.
+    'placeholder',// an optional placeholder value for text type inputs
+  ],
+
+  //  ╦╔╗╔╦╔╦╗╦╔═╗╦    ╔═╗╔╦╗╔═╗╔╦╗╔═╗
+  //  ║║║║║ ║ ║╠═╣║    ╚═╗ ║ ╠═╣ ║ ║╣
+  //  ╩╝╚╝╩ ╩ ╩╩ ╩╩═╝  ╚═╝ ╩ ╩ ╩ ╩ ╚═╝
+  data: function () {
+    return {
+      currentFieldValues: undefined, //« will be initialized to a single-item array in beforeMount
+      optionsForSelect: [],
+      inputPlaceholder: '',
+    };
+  },
+  //  ╦ ╦╔╦╗╔╦╗╦
+  //  ╠═╣ ║ ║║║║
+  //  ╩ ╩ ╩ ╩ ╩╩═╝
+  template: `
+  <div class="multifield-set">
+    <div class="multifield-item" v-for="(unused,idx) in currentFieldValues" :key="idx" :role="'item-'+idx">
+      <!-- <span class="multifield-item-label">{{idx+1}}.</span> -->
+      <slot name="item-field" :item="currentFieldValues[idx]" :do-set="_getCurriedDoSetFn(idx)" :all-items="currentFieldValues" :idx="idx">
+        <input type="text" :placeholder="inputPlaceholder" :class="[cloudError && _.contains(cloudError.responseInfo.data, currentFieldValues[idx]) ? 'text-danger is-invalid' : '']" :value.sync="currentFieldValues[idx]" @input="inputDefaultItemField($event, idx)" role="focusable" v-if="!inputType"/>
+        <select class="custom-select" :value.sync="currentFieldValues[idx]" @input="inputDefaultItemField($event, idx)" role="focusable" v-else-if="inputType && inputType === 'nameAndHostCountSelect'">
+          <option :value="undefined" selected>---</option>
+          <option v-for="option in optionsForSelect" :value="option.id">{{option.name}} ({{option.hostCount}} {{option.hostCount > 1 || option.hostCount === 0 ? 'hosts' : 'host'}})</option>
+        </select>
+        <select class="custom-select" :value.sync="currentFieldValues[idx]" @input="inputDefaultItemField($event, idx)" role="focusable" v-else-if="inputType && inputType === 'select'">
+          <option :value="undefined" selected>---</option>
+          <option v-for="option in optionsForSelect" :value="option.fleetApid">{{option.name}}</option>
+        </select>
+        <select class="custom-select" :value.sync="currentFieldValues[idx]" @input="inputTeamSelectItemField($event, idx)" role="focusable" v-else-if="inputType && inputType === 'teamSelect'">
+          <option :value="undefined" selected>---</option>
+          <option value="allTeams">All teams</option>
+          <option v-for="option in optionsForSelect" :value="option.fleetApid">{{option.teamName}}</option>
+        </select>
+        <input :type="inputType" :placeholder="inputPlaceholder" :value.sync="currentFieldValues[idx]" @input="inputDefaultItemField($event, idx)" role="focusable" v-else-if="inputType">
+      </slot>
+      <button class="multifield-item-remove-button" type="button" v-if="currentFieldValues.length >= 2" @click="clickRemoveItem(idx)"></button>
+      <button class="multifield-item-remove-button" type="button" v-else-if="currentFieldValues.length === 1 && currentFieldValues[0] !== undefined" @click="clickResetSingleItem()"></button>
+    </div>
+    <div class="add-button-wrapper d-flex flex-row justify-content-start" :class="_.all(currentFieldValues, (item)=> item !== undefined) ? '' : 'empty'">
+      <a class="add-button" @click="clickAddItem()" v-if="_.all(currentFieldValues, (item)=> item !== undefined)"><strong>+</strong>&nbsp;&nbsp;{{addButtonText || 'Add another'}}</a>
+      <span v-else>&nbsp;</span>
+    </div>
+  </div>
+  `,
+
+  //  ╦  ╦╔═╗╔═╗╔═╗╦ ╦╔═╗╦  ╔═╗
+  //  ║  ║╠╣ ║╣ ║  ╚╦╝║  ║  ║╣
+  //  ╩═╝╩╚  ╚═╝╚═╝ ╩ ╚═╝╩═╝╚═╝
+  beforeMount: function() {
+    // Absorb value
+    if (this.value !== undefined && !_.isArray(this.value)) {
+      throw new Error('In <multifield>, if specified, `v-model`/`:value` must be either an array or `undefined`.  But instead, got: '+this.value);
+    }//•
+
+    if (this.value === undefined || _.isEqual(this.value, [])) {
+      this.currentFieldValues = [ undefined ];
+    } else {
+      this.currentFieldValues = _.clone(this.value);
+      // ^^ The clone is to prevent entanglement risk.
+    }
+    if(this.inputType === 'nameAndHostCountSelect') {
+      if(!_.isArray(this.selectOptions)){
+        throw new Error('Missing selectOptions. When using inputType="nameAndHostCountSelect", an array of selectOptions is required.');
+      } else {
+        for(let option of this.selectOptions){
+          // If we're using inputType="nameAndHostCountSelect", we will validate all options before cloning the object.
+          if(!option.id){
+            throw new Error(`Option in selectOptions is missing an id. When using inputType="nameAndHostCountSelect", An id property is required for all objects in the selectOptions array. Object missing an id: ${option}`);
+          }
+          if(!option.name){
+            throw new Error(`Option in selectOptions is missing a name. When using inputType="nameAndHostCountSelect", A name property is required for all objects in the selectOptions array. Object missing a name: ${option}`);
+          }
+          if(option.hostCount === undefined){
+            throw new Error(`Option in selectOptions is missing a hostCount. When using inputType="nameAndHostCountSelect", A hostCount property is required for all objects in the selectOptions array. Object missing a hostCount: ${option}`);
+          }
+        }
+        this.optionsForSelect = _.clone(this.selectOptions);
+      }
+    }
+    if(this.inputType === 'teamSelect') {
+      if(!_.isArray(this.selectOptions)){
+        throw new Error('Missing selectOptions. When using inputType="teamSelect", an array of selectOptions is required.');
+      } else {
+        for(let option of this.selectOptions){
+          // If we're using inputType="nameAndHostCountSelect", we will validate all options before cloning the object.
+          if(typeof option.fleetApid !== 'number'){
+            throw new Error(`Option in selectOptions is missing an fleetApid. When using inputType="teamSelect", An fleetApid property is required for all objects in the selectOptions array. Object missing an fleetApid: ${option}`);
+          }
+          if(!option.teamName){
+            throw new Error(`Option in selectOptions is missing a teamName. When using inputType="teamSelect", A teamName property is required for all objects in the selectOptions array. Object missing a teamName: ${option}`);
+          }
+        }
+        this.optionsForSelect = _.clone(this.selectOptions);
+      }
+    }
+    if(this.inputType === 'select') {
+      if(!_.isArray(this.selectOptions)){
+        throw new Error('Missing selectOptions. When using inputType="select", an array of selectOptions is required.');
+      } else {
+        for(let option of this.selectOptions){
+          // If we're using inputType="select", we will validate all options before cloning the object.
+          if(!option.value){
+            throw new Error(`Option in selectOptions is missing a value. When using inputType="select", A value property is required for all objects in the selectOptions array. Object missing a value. ${option}`);
+          }
+          if(!option.name){
+            throw new Error(`Option in selectOptions is missing a name. When using inputType="select", A name property is required for all objects in the selectOptions array. Object missing a name. ${option}`);
+          }
+        }
+        this.optionsForSelect = _.clone(this.selectOptions);
+      }
+    }
+    if(this.placeholder){
+      this.inputPlaceholder = this.placeholder;
+    }
+  },
+
+  mounted: async function () {
+
+  },
+
+  beforeDestroy: function() {
+
+  },
+
+  watch: {
+
+    value: function(those) {
+      // console.log('ran the `value` watcher', those);
+      if (those !== undefined && !_.isArray(those)) {
+        throw new Error('Cannot programmatically set value for <multifield>: the given value must be an array or `undefined`, but instead got: '+those);
+      }
+      this.currentFieldValues = those;
+    }
+
+  },
+
+  //  ╦╔╗╔╔╦╗╔═╗╦═╗╔═╗╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
+  //  ║║║║ ║ ║╣ ╠╦╝╠═╣║   ║ ║║ ║║║║╚═╗
+  //  ╩╝╚╝ ╩ ╚═╝╩╚═╩ ╩╚═╝ ╩ ╩╚═╝╝╚╝╚═╝
+  methods: {
+
+    //  ╔═╗╦  ╦╔═╗╔╗╔╔╦╗  ╦ ╦╔═╗╔╗╔╔╦╗╦  ╔═╗╦═╗╔═╗
+    //  ║╣ ╚╗╔╝║╣ ║║║ ║   ╠═╣╠═╣║║║ ║║║  ║╣ ╠╦╝╚═╗
+    //  ╚═╝ ╚╝ ╚═╝╝╚╝ ╩   ╩ ╩╩ ╩╝╚╝═╩╝╩═╝╚═╝╩╚═╚═╝
+    inputDefaultItemField: async function($event, idx) {
+      var parsedValue = $event.target.value || undefined;
+      this.currentFieldValues[idx] = parsedValue;
+      await this.forceRender();
+      this._handleChangingFieldValues();
+    },
+
+    inputTeamSelectItemField: async function($event, idx) {
+      var parsedValue = $event.target.value || undefined;
+      this.currentFieldValues[idx] = parsedValue;
+      if(parsedValue === 'allTeams') {
+        this.currentFieldValues = _.pluck(this.optionsForSelect, 'fleetApid');
+      }
+      await this.forceRender();
+      this._handleChangingFieldValues();
+    },
+
+    clickAddItem: async function() {
+      this.currentFieldValues.push(undefined);
+      await this.forceRender();//«« this is so that the programmatic focusing code below will work
+
+      // Autofocus (but only if we're sure it's going to work)
+      var idxToFocus = this.currentFieldValues.length - 1;
+      var focalSelector = `[role="item-${idxToFocus}"] [role="focusable"], [role="item-${idxToFocus}"] [focus-first]`;
+      var focusableEls = this.$find(focalSelector);
+      if (focusableEls.length === 1) {
+        this.$focus(focalSelector);
+      }
+      this.$emit('input', _.clone(this.currentFieldValues));
+    },
+
+    clickRemoveItem: async function(idx) {
+
+      this.currentFieldValues.splice(idx, 1);
+      this.$emit('input', _.clone(this.currentFieldValues));
+      // The _.clone() above is to prevent an entanglement issue caused by
+      // emitting the same reference if we were to use this.currentFieldValues
+      // directly.
+
+      // Autofocus (but only if we're sure it's going to work)
+      var idxToFocus = idx >= this.currentFieldValues.length ? this.currentFieldValues.length - 1 : idx;
+      var focalSelector = `[role="item-${idxToFocus}"] [role="focusable"], [role="item-${idxToFocus}"] [focus-first]`;
+      var focusableEls = this.$find(focalSelector);
+      if (focusableEls.length === 1) {
+        this.$focus(focalSelector);
+      }
+    },
+    // To accomodate the requested behavior in wireframes.
+    clickResetSingleItem: async function() {
+      this.currentFieldValues[0] = undefined;
+      this.$emit('input', _.clone(this.currentFieldValues));
+      await this.forceRender();
+    },
+
+    //  ╔═╗╦ ╦╔╗ ╦  ╦╔═╗  ╔╦╗╔═╗╔╦╗╦ ╦╔═╗╔╦╗╔═╗
+    //  ╠═╝║ ║╠╩╗║  ║║    ║║║║╣  ║ ╠═╣║ ║ ║║╚═╗
+    //  ╩  ╚═╝╚═╝╩═╝╩╚═╝  ╩ ╩╚═╝ ╩ ╩ ╩╚═╝═╩╝╚═╝
+
+    //…
+
+    //  ╔═╗╦═╗╦╦  ╦╔═╗╔╦╗╔═╗  ╔╦╗╔═╗╔╦╗╦ ╦╔═╗╔╦╗╔═╗
+    //  ╠═╝╠╦╝║╚╗╔╝╠═╣ ║ ║╣   ║║║║╣  ║ ╠═╣║ ║ ║║╚═╗
+    //  ╩  ╩╚═╩ ╚╝ ╩ ╩ ╩ ╚═╝  ╩ ╩╚═╝ ╩ ╩ ╩╚═╝═╩╝╚═╝
+    _getCurriedDoSetFn: function(idx) {
+      return async (newVal)=>{
+        // Note that it is the responsibility of the userland contents of the
+        // slot to make sure this incoming value is proper.  For example, if
+        // the slot contains an `<input>`, then when invoking doSet, you should
+        // do so like:
+        // ```
+        // <input :value="item" @input="doSet($event.target.value||undefined)"/>
+        // ```
+        //
+        // The `||undefined` is because otherwise, you get `null`, and you
+        // probably want blank fields to be treated as undefined so we can
+        // automatically splice them out of the array before emitting our input
+        // event.
+        //
+        // The reason this is left as a userland concern is because the `null`
+        // value itself, just like `''`, `0`, `false`, `NaN` or other similar
+        // values, is technically a valid thing that might be relevant under
+        // unusual circumstances.
+        // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+        // console.log('FIRED DOSET for idx',idx,'and newVal', newVal);
+        this.currentFieldValues[idx] = newVal;
+        await this.forceRender();
+        this._handleChangingFieldValues();
+      };
+    },
+
+    _handleChangingFieldValues: function() {
+      // > Note that we do a `_.clone()`.  This is to prevent an entanglement
+      // > issue caused by emitting the same reference if we were to simply emit
+      // > `this.currentFieldValues` directly.
+      this.$emit('input', _.clone(this.currentFieldValues));
+      // console.log('emitting in <multifield>…', _.cloneDeep(this.currentFieldValues));
+    },
+
+  }
+
+});
diff --git a/ee/bulk-operations-dashboard/assets/js/components/stripe-card-element.component.js b/ee/bulk-operations-dashboard/assets/js/components/stripe-card-element.component.js
new file mode 100644
index 0000000000..c7b5401057
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/js/components/stripe-card-element.component.js
@@ -0,0 +1,192 @@
+/**
+ * <stripe-card-element>
+ * -----------------------------------------------------------------------------
+ * A wrapper for the Stripe Elements "card" component (https://stripe.com/elements)
+ *
+ * @type {Component}
+ *
+ * @event update:busy  [:busy.sync="…"]
+ * @event input        [emitted when the stripe token changes (supports v-model)]
+ * @event invalidated  [emitted when the field had been changed to include an invalid value]
+ * @event validated    [emitted when the field had been changed to include a valid value]
+ * -----------------------------------------------------------------------------
+ */
+parasails.registerComponent('stripeCardElement', {
+  //  ╦╔╗╔╔╦╗╔═╗╦═╗╔═╗╔═╗╔═╗╔═╗
+  //  ║║║║ ║ ║╣ ╠╦╝╠╣ ╠═╣║  ║╣
+  //  ╩╝╚╝ ╩ ╚═╝╩╚═╚  ╩ ╩╚═╝╚═╝
+  props: [
+    'stripePublishableKey',
+    'isErrored',
+    'errorMessage',//« optional custom error message to display
+    'value',//« the v-model passed in.
+    'busy',
+    'showExisting',// « whether to show the existing card info passed into `v-model`
+  ],
+  //  ╔╦╗╔═╗╦═╗╦╔═╦ ╦╔═╗
+  //  ║║║╠═╣╠╦╝╠╩╗║ ║╠═╝
+  //  ╩ ╩╩ ╩╩╚═╩ ╩╚═╝╩
+  template: `
+  <div>
+    <div v-if="existingCardData">
+      <span class="existing-card">{{existingCardData.billingCardBrand}} ending in <strong>{{existingCardData.billingCardLast4}}</strong></span>
+      <small class="new-card-text d-inline-block ml-2">(Want to use a different card ? <a class="text-primary change-card-button" type="button" @click="clickChangeExistingCard()">Click here</a>.)</small>
+    </div>
+    <div class="card-element-wrapper" :class="[existingCardData ? 'secret-card-element-wrapper' : '', isErrored ? 'is-invalid' : '']" :aria-hidden="existingCardData ? true : false">
+      <div class="card-element form-control" :class="isErrored ? 'is-invalid' : ''" card-element></div>
+      <span class="status-indicator syncing text-primary" :class="[isSyncing ? '' : 'hidden']"><span class="fa fa-spinner"></span></span>
+      <span class="status-indicator text-primary" :class="[isValidated ? '' : 'hidden']"><span class="fa fa-check-circle"></span></span>
+      <div class="invalid-feedback" v-if="!isValidated && isErrored">{{ errorMessage || 'Please check your card info.'}}</div>
+    </div>
+  </div>
+  `,
+  //  ╔═╗╔╦╗╔═╗╔╦╗╔═╗
+  //  ╚═╗ ║ ╠═╣ ║ ║╣
+  //  ╚═╝ ╩ ╩ ╩ ╩ ╚═╝
+  data: function (){
+    return {
+      isSyncing: false,
+      isValidated: false,
+      existingCardData: undefined,
+      // The underlying Stripe instance
+      _stripe: undefined,
+      // The underlying Stripe elements instance
+      _elements: undefined,
+      // The underlying Stripe element instance this component creates as it mounts.
+      _element: undefined,
+    };
+  },
+  //  ╦  ╦╔═╗╔═╗╔═╗╦ ╦╔═╗╦  ╔═╗
+  //  ║  ║╠╣ ║╣ ║  ╚╦╝║  ║  ║╣
+  //  ╩═╝╩╚  ╚═╝╚═╝ ╩ ╚═╝╩═╝╚═╝
+  beforeMount: function() {
+    // Initialize an instance of Stripe "elements", which we'll pass into
+    // our <stripe-element> component instances.
+    // (We also save an instance of `stripe` for use below.)
+    this._stripe = Stripe(this.stripePublishableKey);
+    this._elements = this._stripe.elements();
+  },
+  mounted: function (){
+    if(this.showExisting && _.isObject(this.value) && this.value.stripeToken && this.value.billingCardBrand && this.value.billingCardLast4) {
+      this.existingCardData = _.extend({}, this.value);
+    }
+    this._element = this._elements.create('card', {
+      // Classes
+      // > https://stripe.com/docs/js/elements_object/create_element?type=card#elements_create-options-classes
+      classes: {
+        // When the iframe is focused, attach the "pseudofocused" class
+        // to our wrapper <div>.
+        focus: 'pseudofocused'
+      },
+      // iframe styles:
+      // > https://stripe.com/docs/js/appendix/style?type=card
+      // You can update this section to match your website's theme
+      style: {
+        base: {
+          lineHeight: '36px',
+          fontSize: '16px',
+          color: '#495057',
+          iconColor: '#14acc2',
+          fontFamily: '-apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif',
+          '::placeholder': {
+            color: '#6c757d',
+          },
+        },
+        invalid: {
+          color: '#dc3545',
+        },
+      },
+    });
+    this._element.mount($(this.$el).find('[card-element]')[0]);
+    //  When a change occurs, immediately clear the token by
+    //  emitting an input event with '', show a loading spinner, and start
+    //  fetching a new token. Then in userland, the validation error for a missing
+    //  card becomes something reasonable that implies that we may not have finished
+    //  getting it yet, so hold your horses.
+    this._element.on('change', (stripeEvent)=> {
+      // If there is an error, set the v-model to be empty.
+      if(stripeEvent.error) {
+        this.$emit('input', '');
+      } else if(stripeEvent.complete) {
+        // If the field is complete, (aka valid), fetch a token and set that on the v-model
+        // (first clearing out the v-model, so this won't be considered valid yet e.g. if it was just changed.
+        if(this.isSyncing) { return; }
+        this.$emit('');
+        this.isSyncing = true;
+        this.$emit('update:busy', true);
+        this.isValidated = false;
+        this._fetchNewToken();
+      } else {
+        // FUTURE: possibly handle other events, if necessary.
+      }//fi
+    });//œ
+  },
+  beforeDestroy: function (){
+    // Note: There isn't any documented way to tear down a `stripe` instance.
+    // Same thing for the `elements` instance.  Only individual "element" instances
+    // can be cleaned up after, using `.unmount()`.
+    this._element.unmount();
+  },
+  //  ╔═╗╦  ╦╔═╗╔╗╔╔╦╗╔═╗
+  //  ║╣ ╚╗╔╝║╣ ║║║ ║ ╚═╗
+  //  ╚═╝ ╚╝ ╚═╝╝╚╝ ╩ ╚═╝
+  methods: {
+    clickChangeExistingCard: function() {
+      this.existingCardData = undefined;
+      this.$emit('input', '');
+    },
+    // Public method for fetching a fresh token (e.g. if card is declined)
+    doGetNewToken: function() {
+      this.isSyncing = true;
+      this.$emit('update:busy', true);
+      this.isValidated = false;
+      this.$emit('input', '');
+      this._fetchNewToken();
+    },
+    _fetchNewToken: function() {
+      this._getStripeTokenFromCardElement(this._stripe, this._element)
+      .then((paymentSourceInfo)=>{
+        this.isSyncing = false;
+        this.$emit('update:busy', false);
+        this.isValidated = true;
+        this.$emit('input', paymentSourceInfo);
+      }).catch((err)=>{
+        this.isSyncing = false;
+        this.$emit('update:busy', false);
+        this.isValidated = false;
+        // This error is only relevant if something COMPLETELY unexpected goes wrong,
+        // in which case we want to actually know about that.
+        throw err;
+      });//_∏_
+    },
+    _getStripeTokenFromCardElement: function(stripeInstance, stripeElement) {
+      // Build a Promise & send it back as our "thenable" (AsyncFunction's return value).
+      // (this is necessary b/c we're wrapping an api that isn't `await`-compatible)
+      return new Promise((resolve, reject)=>{
+        try {
+          // Create a stripe token using the Stripe "element".
+          stripeInstance.createToken(stripeElement)
+          .then((result)=>{
+            // Silently ignore the case where the field is empty, or if there are
+            // card validation issues.
+            if(!result || result.error) {
+              resolve();
+              return;
+            }
+            // Send back the token & payment info.
+            resolve({
+              stripeToken: result.token.id,
+              billingCardBrand: result.token.card.brand,
+              billingCardLast4: result.token.card.last4,
+              billingCardExpMonth: result.token.card.exp_month,
+              billingCardExpYear: result.token.card.exp_year
+            });
+          });
+        } catch (err) {
+          console.error('Could not obtain Stripe token:', err);
+          reject(err);
+        }
+      });//_∏_
+    }
+  }
+});
diff --git a/ee/bulk-operations-dashboard/assets/js/pages/account/account-overview.page.js b/ee/bulk-operations-dashboard/assets/js/pages/account/account-overview.page.js
new file mode 100644
index 0000000000..44f5893d6a
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/js/pages/account/account-overview.page.js
@@ -0,0 +1,106 @@
+parasails.registerPage('account-overview', {
+  //  ╦╔╗╔╦╔╦╗╦╔═╗╦    ╔═╗╔╦╗╔═╗╔╦╗╔═╗
+  //  ║║║║║ ║ ║╠═╣║    ╚═╗ ║ ╠═╣ ║ ║╣
+  //  ╩╝╚╝╩ ╩ ╩╩ ╩╩═╝  ╚═╝ ╩ ╩ ╩ ╩ ╚═╝
+  data: {
+    isBillingEnabled: false,
+
+    hasBillingCard: false,
+
+    // Syncing/loading states for this page.
+    syncingOpenCheckout: false,
+    syncingUpdateCard: false,
+    syncingRemoveCard: false,
+
+    // For <ajax-form>
+    formData: { /* … */ },
+    formRules: { /* … */ },
+    formErrors: { /* … */ },
+    cloudError: '',
+    syncing: '',
+
+    // For <modal>:
+    modal: '',
+
+  },
+
+  //  ╦  ╦╔═╗╔═╗╔═╗╦ ╦╔═╗╦  ╔═╗
+  //  ║  ║╠╣ ║╣ ║  ╚╦╝║  ║  ║╣
+  //  ╩═╝╩╚  ╚═╝╚═╝ ╩ ╚═╝╩═╝╚═╝
+  beforeMount: function (){
+    _.extend(this, window.SAILS_LOCALS);
+
+    this.isBillingEnabled = !!this.stripePublishableKey;
+
+    // Determine whether there is billing info for this user.
+    this.me.hasBillingCard = (
+      this.me.billingCardBrand &&
+      this.me.billingCardLast4 &&
+      this.me.billingCardExpMonth &&
+      this.me.billingCardExpYear
+    );
+  },
+  mounted: async function() {
+    //…
+  },
+
+  //  ╦╔╗╔╔╦╗╔═╗╦═╗╔═╗╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
+  //  ║║║║ ║ ║╣ ╠╦╝╠═╣║   ║ ║║ ║║║║╚═╗
+  //  ╩╝╚╝ ╩ ╚═╝╩╚═╩ ╩╚═╝ ╩ ╩╚═╝╝╚╝╚═╝
+  methods: {
+
+    clickUpdateBillingCardButton: function() {
+      this.modal = 'update-billing-card';
+      this.formData = { newPaymentSource: undefined };
+      this.formRules = { newPaymentSource: {required: true}};
+    },
+
+    closeModal: async function() {
+      // Dismiss modal
+      this.modal = '';
+      await this._resetForms();
+    },
+
+    handleSubmittingUpdateBillingCard: async function(argins) {
+      var newPaymentSource = argins.newPaymentSource;
+      await Cloud.updateBillingCard.with(newPaymentSource);
+    },
+
+    submittedUpdateBillingCard: async function() {
+      Object.assign(this.me, _.pick(this.formData.newPaymentSource, ['billingCardLast4', 'billingCardBrand', 'billingCardExpMonth', 'billingCardExpYear']));
+      this.me.hasBillingCard = true;
+
+      // Dismiss modal
+      this.modal = '';
+      await this._resetForms();
+    },
+
+    _resetForms: async function() {
+      this.cloudError = '';
+      this.formData = {};
+      this.formRules = {};
+      this.formErrors = {};
+      await this.forceRender();
+    },
+
+    clickRemoveCardButton: async function() {
+      this.modal = 'remove-billing-card';
+      this.formData.stripeToken = '';
+    },
+
+    submittedRemoveCardForm: async function() {
+
+      // Update billing info on success.
+      this.me.billingCardLast4 = undefined;
+      this.me.billingCardBrand = undefined;
+      this.me.billingCardExpMonth = undefined;
+      this.me.billingCardExpYear = undefined;
+      this.me.hasBillingCard = false;
+
+      // Close the modal and clear it out.
+      this.closeModal();
+
+    },
+
+  }
+});
diff --git a/ee/bulk-operations-dashboard/assets/js/pages/account/edit-password.page.js b/ee/bulk-operations-dashboard/assets/js/pages/account/edit-password.page.js
new file mode 100644
index 0000000000..c6a614e058
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/js/pages/account/edit-password.page.js
@@ -0,0 +1,50 @@
+parasails.registerPage('edit-password', {
+  //  ╦╔╗╔╦╔╦╗╦╔═╗╦    ╔═╗╔╦╗╔═╗╔╦╗╔═╗
+  //  ║║║║║ ║ ║╠═╣║    ╚═╗ ║ ╠═╣ ║ ║╣
+  //  ╩╝╚╝╩ ╩ ╩╩ ╩╩═╝  ╚═╝ ╩ ╩ ╩ ╩ ╚═╝
+  data: {
+    // Main syncing/loading state for this page.
+    syncing: false,
+
+    // Form data
+    formData: { /* … */ },
+
+    // For tracking client-side validation errors in our form.
+    // > Has property set to `true` for each invalid property in `formData`.
+    formErrors: { /* … */ },
+
+    // Form rules
+    formRules: {
+      password: {required: true},
+      confirmPassword: {required: true, sameAs: 'password'},
+    },
+
+    // Server error state for the form
+    cloudError: '',
+  },
+
+  //  ╦  ╦╔═╗╔═╗╔═╗╦ ╦╔═╗╦  ╔═╗
+  //  ║  ║╠╣ ║╣ ║  ╚╦╝║  ║  ║╣
+  //  ╩═╝╩╚  ╚═╝╚═╝ ╩ ╚═╝╩═╝╚═╝
+  beforeMount: function() {
+    //…
+  },
+  mounted: async function() {
+    //…
+  },
+
+  //  ╦╔╗╔╔╦╗╔═╗╦═╗╔═╗╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
+  //  ║║║║ ║ ║╣ ╠╦╝╠═╣║   ║ ║║ ║║║║╚═╗
+  //  ╩╝╚╝ ╩ ╚═╝╩╚═╩ ╩╚═╝ ╩ ╩╚═╝╝╚╝╚═╝
+  methods: {
+
+    submittedForm: async function() {
+      // Redirect to a different web page on success.
+      // > (Note that we re-enable the syncing state here.  This is on purpose--
+      // > to make sure the spinner stays there until the page navigation finishes.)
+      this.syncing = true;
+      window.location = '/account';
+    },
+
+  }
+});
diff --git a/ee/bulk-operations-dashboard/assets/js/pages/account/edit-profile.page.js b/ee/bulk-operations-dashboard/assets/js/pages/account/edit-profile.page.js
new file mode 100644
index 0000000000..4a9ce71221
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/js/pages/account/edit-profile.page.js
@@ -0,0 +1,52 @@
+parasails.registerPage('edit-profile', {
+  //  ╦╔╗╔╦╔╦╗╦╔═╗╦    ╔═╗╔╦╗╔═╗╔╦╗╔═╗
+  //  ║║║║║ ║ ║╠═╣║    ╚═╗ ║ ╠═╣ ║ ║╣
+  //  ╩╝╚╝╩ ╩ ╩╩ ╩╩═╝  ╚═╝ ╩ ╩ ╩ ╩ ╚═╝
+  data: {
+    // Main syncing/loading state for this page.
+    syncing: false,
+
+    // Form data
+    formData: { /* … */ },
+
+    // For tracking client-side validation errors in our form.
+    // > Has property set to `true` for each invalid property in `formData`.
+    formErrors: { /* … */ },
+
+    // Form rules
+    formRules: {
+      fullName: {required: true},
+      emailAddress: {required: true, isEmail: true},
+    },
+
+    // Server error state for the form
+    cloudError: '',
+  },
+
+  //  ╦  ╦╔═╗╔═╗╔═╗╦ ╦╔═╗╦  ╔═╗
+  //  ║  ║╠╣ ║╣ ║  ╚╦╝║  ║  ║╣
+  //  ╩═╝╩╚  ╚═╝╚═╝ ╩ ╚═╝╩═╝╚═╝
+  beforeMount: function() {
+    // Set the form data.
+    this.formData.fullName = this.me.fullName;
+    this.formData.emailAddress = this.me.emailChangeCandidate ? this.me.emailChangeCandidate : this.me.emailAddress;
+  },
+  mounted: async function() {
+    //…
+  },
+
+  //  ╦╔╗╔╔╦╗╔═╗╦═╗╔═╗╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
+  //  ║║║║ ║ ║╣ ╠╦╝╠═╣║   ║ ║║ ║║║║╚═╗
+  //  ╩╝╚╝ ╩ ╚═╝╩╚═╩ ╩╚═╝ ╩ ╩╚═╝╝╚╝╚═╝
+  methods: {
+
+    submittedForm: async function() {
+      // Redirect to the account page on success.
+      // > (Note that we re-enable the syncing state here.  This is on purpose--
+      // > to make sure the spinner stays there until the page navigation finishes.)
+      this.syncing = true;
+      window.location = '/account';
+    },
+
+  }
+});
diff --git a/ee/bulk-operations-dashboard/assets/js/pages/contact.page.js b/ee/bulk-operations-dashboard/assets/js/pages/contact.page.js
new file mode 100644
index 0000000000..035e53d7b5
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/js/pages/contact.page.js
@@ -0,0 +1,54 @@
+parasails.registerPage('contact', {
+  //  ╦╔╗╔╦╔╦╗╦╔═╗╦    ╔═╗╔╦╗╔═╗╔╦╗╔═╗
+  //  ║║║║║ ║ ║╠═╣║    ╚═╗ ║ ╠═╣ ║ ║╣
+  //  ╩╝╚╝╩ ╩ ╩╩ ╩╩═╝  ╚═╝ ╩ ╩ ╩ ╩ ╚═╝
+  data: {
+    // Main syncing/loading state for this page.
+    syncing: false,
+
+    // Form data
+    formData: { /* … */ },
+
+    // For tracking client-side validation errors in our form.
+    // > Has property set to `true` for each invalid property in `formData`.
+    formErrors: { /* … */ },
+
+    // Form rules
+    formRules: {
+      emailAddress: {isEmail: true, required: true},
+      fullName: {required: true},
+      topic: {required: true},
+      message: {required: true},
+    },
+
+    // Server error state for the form
+    cloudError: '',
+
+    // Success state when form has been submitted
+    cloudSuccess: false,
+  },
+
+  //  ╦  ╦╔═╗╔═╗╔═╗╦ ╦╔═╗╦  ╔═╗
+  //  ║  ║╠╣ ║╣ ║  ╚╦╝║  ║  ║╣
+  //  ╩═╝╩╚  ╚═╝╚═╝ ╩ ╚═╝╩═╝╚═╝
+  beforeMount: function() {
+    //…
+  },
+  mounted: async function() {
+    //…
+  },
+
+  //  ╦╔╗╔╔╦╗╔═╗╦═╗╔═╗╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
+  //  ║║║║ ║ ║╣ ╠╦╝╠═╣║   ║ ║║ ║║║║╚═╗
+  //  ╩╝╚╝ ╩ ╚═╝╩╚═╩ ╩╚═╝ ╩ ╩╚═╝╝╚╝╚═╝
+  methods: {
+
+    submittedForm: async function() {
+
+      // Show the success message.
+      this.cloudSuccess = true;
+
+    },
+
+  }
+});
diff --git a/ee/bulk-operations-dashboard/assets/js/pages/dashboard/welcome.page.js b/ee/bulk-operations-dashboard/assets/js/pages/dashboard/welcome.page.js
new file mode 100644
index 0000000000..2cc39bedae
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/js/pages/dashboard/welcome.page.js
@@ -0,0 +1,59 @@
+parasails.registerPage('welcome', {
+  //  ╦╔╗╔╦╔╦╗╦╔═╗╦    ╔═╗╔╦╗╔═╗╔╦╗╔═╗
+  //  ║║║║║ ║ ║╠═╣║    ╚═╗ ║ ╠═╣ ║ ║╣
+  //  ╩╝╚╝╩ ╩ ╩╩ ╩╩═╝  ╚═╝ ╩ ╩ ╩ ╩ ╚═╝
+  data: {
+    modal: '',
+    pageLoadedAt: Date.now()
+  },
+
+  //  ╦  ╦╔═╗╔═╗╔═╗╦ ╦╔═╗╦  ╔═╗
+  //  ║  ║╠╣ ║╣ ║  ╚╦╝║  ║  ║╣
+  //  ╩═╝╩╚  ╚═╝╚═╝ ╩ ╚═╝╩═╝╚═╝
+  beforeMount: function() {
+    //…
+  },
+  mounted: async function() {
+    //…
+  },
+
+  //  ╦  ╦╦╦═╗╔╦╗╦ ╦╔═╗╦    ╔═╗╔═╗╔═╗╔═╗╔═╗
+  //  ╚╗╔╝║╠╦╝ ║ ║ ║╠═╣║    ╠═╝╠═╣║ ╦║╣ ╚═╗
+  //   ╚╝ ╩╩╚═ ╩ ╚═╝╩ ╩╩═╝  ╩  ╩ ╩╚═╝╚═╝╚═╝
+  // Configure deep-linking (aka client-side routing)
+  virtualPagesRegExp: /^\/welcome\/?([^\/]+)?\/?/,
+  afterNavigate: async function(virtualPageSlug){
+    // `virtualPageSlug` is determined by the regular expression above, which
+    // corresponds with `:unused?` in the server-side route for this page.
+    switch (virtualPageSlug) {
+      case 'hello':
+        this.modal = 'example';
+        break;
+      default:
+        this.modal = '';
+    }
+  },
+
+  //  ╦╔╗╔╔╦╗╔═╗╦═╗╔═╗╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
+  //  ║║║║ ║ ║╣ ╠╦╝╠═╣║   ║ ║║ ║║║║╚═╗
+  //  ╩╝╚╝ ╩ ╚═╝╩╚═╩ ╩╚═╝ ╩ ╩╚═╝╝╚╝╚═╝
+  methods: {
+
+    clickOpenExampleModalButton: async function() {
+      this.goto('/welcome/hello');
+      // Or, without deep links, instead do:
+      // ```
+      // this.modal = 'example';
+      // ```
+    },
+
+    closeExampleModal: async function() {
+      this.goto('/welcome');
+      // Or, without deep links, instead do:
+      // ```
+      // this.modal = '';
+      // ```
+    },
+
+  }
+});
diff --git a/ee/bulk-operations-dashboard/assets/js/pages/entrance/confirmed-email.page.js b/ee/bulk-operations-dashboard/assets/js/pages/entrance/confirmed-email.page.js
new file mode 100644
index 0000000000..26fccd8b11
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/js/pages/entrance/confirmed-email.page.js
@@ -0,0 +1,25 @@
+parasails.registerPage('confirmed-email', {
+  //  ╦╔╗╔╦╔╦╗╦╔═╗╦    ╔═╗╔╦╗╔═╗╔╦╗╔═╗
+  //  ║║║║║ ║ ║╠═╣║    ╚═╗ ║ ╠═╣ ║ ║╣
+  //  ╩╝╚╝╩ ╩ ╩╩ ╩╩═╝  ╚═╝ ╩ ╩ ╩ ╩ ╚═╝
+  data: {
+    //…
+  },
+
+  //  ╦  ╦╔═╗╔═╗╔═╗╦ ╦╔═╗╦  ╔═╗
+  //  ║  ║╠╣ ║╣ ║  ╚╦╝║  ║  ║╣
+  //  ╩═╝╩╚  ╚═╝╚═╝ ╩ ╚═╝╩═╝╚═╝
+  beforeMount: function() {
+    //…
+  },
+  mounted: async function(){
+    //…
+  },
+
+  //  ╦╔╗╔╔╦╗╔═╗╦═╗╔═╗╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
+  //  ║║║║ ║ ║╣ ╠╦╝╠═╣║   ║ ║║ ║║║║╚═╗
+  //  ╩╝╚╝ ╩ ╚═╝╩╚═╩ ╩╚═╝ ╩ ╩╚═╝╝╚╝╚═╝
+  methods: {
+    //…
+  }
+});
diff --git a/ee/bulk-operations-dashboard/assets/js/pages/entrance/forgot-password.page.js b/ee/bulk-operations-dashboard/assets/js/pages/entrance/forgot-password.page.js
new file mode 100644
index 0000000000..124fc244da
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/js/pages/entrance/forgot-password.page.js
@@ -0,0 +1,49 @@
+parasails.registerPage('forgot-password', {
+  //  ╦╔╗╔╦╔╦╗╦╔═╗╦    ╔═╗╔╦╗╔═╗╔╦╗╔═╗
+  //  ║║║║║ ║ ║╠═╣║    ╚═╗ ║ ╠═╣ ║ ║╣
+  //  ╩╝╚╝╩ ╩ ╩╩ ╩╩═╝  ╚═╝ ╩ ╩ ╩ ╩ ╚═╝
+  data: {
+    // Main syncing/loading state for this page.
+    syncing: false,
+
+    // Form data
+    formData: { /* … */ },
+
+    // For tracking client-side validation errors in our form.
+    // > Has property set to `true` for each invalid property in `formData`.
+    formErrors: { /* … */ },
+
+    // Form rules
+    formRules: {
+      emailAddress: {required: true, isEmail: true},
+    },
+
+    // Server error state for the form
+    cloudError: '',
+
+    // Success state when form has been submitted
+    cloudSuccess: false,
+  },
+
+  //  ╦  ╦╔═╗╔═╗╔═╗╦ ╦╔═╗╦  ╔═╗
+  //  ║  ║╠╣ ║╣ ║  ╚╦╝║  ║  ║╣
+  //  ╩═╝╩╚  ╚═╝╚═╝ ╩ ╚═╝╩═╝╚═╝
+  beforeMount: function() {
+    //…
+  },
+  mounted: async function() {
+    //…
+  },
+
+  //  ╦╔╗╔╔╦╗╔═╗╦═╗╔═╗╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
+  //  ║║║║ ║ ║╣ ╠╦╝╠═╣║   ║ ║║ ║║║║╚═╗
+  //  ╩╝╚╝ ╩ ╚═╝╩╚═╩ ╩╚═╝ ╩ ╩╚═╝╝╚╝╚═╝
+  methods: {
+
+    submittedForm: async function() {
+      // If it worked, show the success message.
+      this.cloudSuccess = true;
+    },
+
+  }
+});
diff --git a/ee/bulk-operations-dashboard/assets/js/pages/entrance/login.page.js b/ee/bulk-operations-dashboard/assets/js/pages/entrance/login.page.js
new file mode 100644
index 0000000000..5af59267d5
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/js/pages/entrance/login.page.js
@@ -0,0 +1,53 @@
+parasails.registerPage('login', {
+  //  ╦╔╗╔╦╔╦╗╦╔═╗╦    ╔═╗╔╦╗╔═╗╔╦╗╔═╗
+  //  ║║║║║ ║ ║╠═╣║    ╚═╗ ║ ╠═╣ ║ ║╣
+  //  ╩╝╚╝╩ ╩ ╩╩ ╩╩═╝  ╚═╝ ╩ ╩ ╩ ╩ ╚═╝
+  data: {
+    // Main syncing/loading state for this page.
+    syncing: false,
+
+    // Form data
+    formData: {
+      rememberMe: true,
+    },
+
+    // For tracking client-side validation errors in our form.
+    // > Has property set to `true` for each invalid property in `formData`.
+    formErrors: { /* … */ },
+
+    // A set of validation rules for our form.
+    // > The form will not be submitted if these are invalid.
+    formRules: {
+      emailAddress: { required: true, isEmail: true },
+      password: { required: true },
+    },
+
+    // Server error state for the form
+    cloudError: '',
+  },
+
+  //  ╦  ╦╔═╗╔═╗╔═╗╦ ╦╔═╗╦  ╔═╗
+  //  ║  ║╠╣ ║╣ ║  ╚╦╝║  ║  ║╣
+  //  ╩═╝╩╚  ╚═╝╚═╝ ╩ ╚═╝╩═╝╚═╝
+  beforeMount: function() {
+    //…
+  },
+  mounted: async function() {
+    //…
+  },
+
+  //  ╦╔╗╔╔╦╗╔═╗╦═╗╔═╗╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
+  //  ║║║║ ║ ║╣ ╠╦╝╠═╣║   ║ ║║ ║║║║╚═╗
+  //  ╩╝╚╝ ╩ ╚═╝╩╚═╩ ╩╚═╝ ╩ ╩╚═╝╝╚╝╚═╝
+  methods: {
+
+    submittedForm: async function() {
+      // Redirect to the logged-in dashboard on success.
+      // > (Note that we re-enable the syncing state here.  This is on purpose--
+      // > to make sure the spinner stays there until the page navigation finishes.)
+      this.syncing = true;
+      window.location = '/';
+    },
+
+  }
+});
diff --git a/ee/bulk-operations-dashboard/assets/js/pages/entrance/new-password.page.js b/ee/bulk-operations-dashboard/assets/js/pages/entrance/new-password.page.js
new file mode 100644
index 0000000000..6729c24922
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/js/pages/entrance/new-password.page.js
@@ -0,0 +1,52 @@
+parasails.registerPage('new-password', {
+  //  ╦╔╗╔╦╔╦╗╦╔═╗╦    ╔═╗╔╦╗╔═╗╔╦╗╔═╗
+  //  ║║║║║ ║ ║╠═╣║    ╚═╗ ║ ╠═╣ ║ ║╣
+  //  ╩╝╚╝╩ ╩ ╩╩ ╩╩═╝  ╚═╝ ╩ ╩ ╩ ╩ ╚═╝
+  data: {
+    // Main syncing/loading state for this page.
+    syncing: false,
+
+    // Form data
+    formData: { /* … */ },
+
+    // For tracking client-side validation errors in our form.
+    // > Has property set to `true` for each invalid property in `formData`.
+    formErrors: { /* … */ },
+
+    // Form rules
+    formRules: {
+      password: {required: true},
+      confirmPassword: {required: true, sameAs: 'password'},
+    },
+
+    // Server error state for the form
+    cloudError: '',
+  },
+
+  //  ╦  ╦╔═╗╔═╗╔═╗╦ ╦╔═╗╦  ╔═╗
+  //  ║  ║╠╣ ║╣ ║  ╚╦╝║  ║  ║╣
+  //  ╩═╝╩╚  ╚═╝╚═╝ ╩ ╚═╝╩═╝╚═╝
+  beforeMount: function() {
+    //…
+  },
+  mounted: async function() {
+
+    this.formData.token = this.token;
+
+  },
+
+  //  ╦╔╗╔╔╦╗╔═╗╦═╗╔═╗╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
+  //  ║║║║ ║ ║╣ ╠╦╝╠═╣║   ║ ║║ ║║║║╚═╗
+  //  ╩╝╚╝ ╩ ╚═╝╩╚═╩ ╩╚═╝ ╩ ╩╚═╝╝╚╝╚═╝
+  methods: {
+
+    submittedForm: async function() {
+      // Redirect to the logged-in dashboard on success.
+      // > (Note that we re-enable the syncing state here.  This is on purpose--
+      // > to make sure the spinner stays there until the page navigation finishes.)
+      this.syncing = true;
+      window.location = '/';
+    },
+
+  }
+});
diff --git a/ee/bulk-operations-dashboard/assets/js/pages/entrance/signup.page.js b/ee/bulk-operations-dashboard/assets/js/pages/entrance/signup.page.js
new file mode 100644
index 0000000000..596b65721e
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/js/pages/entrance/signup.page.js
@@ -0,0 +1,62 @@
+parasails.registerPage('signup', {
+  //  ╦╔╗╔╦╔╦╗╦╔═╗╦    ╔═╗╔╦╗╔═╗╔╦╗╔═╗
+  //  ║║║║║ ║ ║╠═╣║    ╚═╗ ║ ╠═╣ ║ ║╣
+  //  ╩╝╚╝╩ ╩ ╩╩ ╩╩═╝  ╚═╝ ╩ ╩ ╩ ╩ ╚═╝
+  data: {
+    // Form data
+    formData: { /* … */ },
+
+    // For tracking client-side validation errors in our form.
+    // > Has property set to `true` for each invalid property in `formData`.
+    formErrors: { /* … */ },
+
+    // Form rules
+    formRules: {
+      fullName: {required: true},
+      emailAddress: {required: true, isEmail: true},
+      password: {required: true},
+      confirmPassword: {required: true, sameAs: 'password'},
+      agreed: {required: true},
+    },
+
+    // Syncing / loading state
+    syncing: false,
+
+    // Server error state
+    cloudError: '',
+
+    // Success state when form has been submitted
+    cloudSuccess: false,
+  },
+
+  //  ╦  ╦╔═╗╔═╗╔═╗╦ ╦╔═╗╦  ╔═╗
+  //  ║  ║╠╣ ║╣ ║  ╚╦╝║  ║  ║╣
+  //  ╩═╝╩╚  ╚═╝╚═╝ ╩ ╚═╝╩═╝╚═╝
+  beforeMount: function() {
+    //…
+  },
+  mounted: async function() {
+    //…
+  },
+
+  //  ╦╔╗╔╔╦╗╔═╗╦═╗╔═╗╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
+  //  ║║║║ ║ ║╣ ╠╦╝╠═╣║   ║ ║║ ║║║║╚═╗
+  //  ╩╝╚╝ ╩ ╚═╝╩╚═╩ ╩╚═╝ ╩ ╩╚═╝╝╚╝╚═╝
+  methods: {
+
+    submittedForm: async function() {
+      if(this.isEmailVerificationRequired) {
+        // If email confirmation is enabled, show the success message.
+        this.cloudSuccess = true;
+      }
+      else {
+        // Otherwise, redirect to the logged-in dashboard.
+        // > (Note that we re-enable the syncing state here.  This is on purpose--
+        // > to make sure the spinner stays there until the page navigation finishes.)
+        this.syncing = true;
+        window.location = '/';
+      }
+    },
+
+  }
+});
diff --git a/ee/bulk-operations-dashboard/assets/js/pages/faq.page.js b/ee/bulk-operations-dashboard/assets/js/pages/faq.page.js
new file mode 100644
index 0000000000..900d131ecc
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/js/pages/faq.page.js
@@ -0,0 +1,25 @@
+parasails.registerPage('faq', {
+  //  ╦╔╗╔╦╔╦╗╦╔═╗╦    ╔═╗╔╦╗╔═╗╔╦╗╔═╗
+  //  ║║║║║ ║ ║╠═╣║    ╚═╗ ║ ╠═╣ ║ ║╣
+  //  ╩╝╚╝╩ ╩ ╩╩ ╩╩═╝  ╚═╝ ╩ ╩ ╩ ╩ ╚═╝
+  data: {
+    //…
+  },
+
+  //  ╦  ╦╔═╗╔═╗╔═╗╦ ╦╔═╗╦  ╔═╗
+  //  ║  ║╠╣ ║╣ ║  ╚╦╝║  ║  ║╣
+  //  ╩═╝╩╚  ╚═╝╚═╝ ╩ ╚═╝╩═╝╚═╝
+  beforeMount: function() {
+    //…
+  },
+  mounted: async function(){
+    //…
+  },
+
+  //  ╦╔╗╔╔╦╗╔═╗╦═╗╔═╗╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
+  //  ║║║║ ║ ║╣ ╠╦╝╠═╣║   ║ ║║ ║║║║╚═╗
+  //  ╩╝╚╝ ╩ ╚═╝╩╚═╩ ╩╚═╝ ╩ ╩╚═╝╝╚╝╚═╝
+  methods: {
+    //…
+  }
+});
diff --git a/ee/bulk-operations-dashboard/assets/js/pages/homepage.page.js b/ee/bulk-operations-dashboard/assets/js/pages/homepage.page.js
new file mode 100644
index 0000000000..f94537e4aa
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/js/pages/homepage.page.js
@@ -0,0 +1,42 @@
+parasails.registerPage('homepage', {
+  //  ╦╔╗╔╦╔╦╗╦╔═╗╦    ╔═╗╔╦╗╔═╗╔╦╗╔═╗
+  //  ║║║║║ ║ ║╠═╣║    ╚═╗ ║ ╠═╣ ║ ║╣
+  //  ╩╝╚╝╩ ╩ ╩╩ ╩╩═╝  ╚═╝ ╩ ╩ ╩ ╩ ╚═╝
+  data: {
+    //…
+  },
+
+  //  ╦  ╦╔═╗╔═╗╔═╗╦ ╦╔═╗╦  ╔═╗
+  //  ║  ║╠╣ ║╣ ║  ╚╦╝║  ║  ║╣
+  //  ╩═╝╩╚  ╚═╝╚═╝ ╩ ╚═╝╩═╝╚═╝
+  beforeMount: function() {
+    //…
+  },
+  mounted: async function(){
+    this._setHeroHeight();
+  },
+
+  //  ╦╔╗╔╔╦╗╔═╗╦═╗╔═╗╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
+  //  ║║║║ ║ ║╣ ╠╦╝╠═╣║   ║ ║║ ║║║║╚═╗
+  //  ╩╝╚╝ ╩ ╚═╝╩╚═╩ ╩╚═╝ ╩ ╩╚═╝╝╚╝╚═╝
+  methods: {
+
+    clickHeroButton: async function() {
+      // Scroll to the 'get started' section:
+      $('html, body').animate({
+        scrollTop: this.$find('[purpose="scroll-destination"]').offset().top
+      }, 500);
+    },
+
+    // Private methods not tied to a particular DOM event are prefixed with _
+    _setHeroHeight: function() {
+      var $hero = this.$find('[purpose="full-page-hero"]');
+      var headerHeight = $('[purpose="page-header"]').outerHeight();
+      var heightToSet = $(window).height();
+      heightToSet = Math.max(heightToSet, 500);//« ensure min height of 500px - header height
+      heightToSet = Math.min(heightToSet, 1000);//« ensure max height of 1000px - header height
+      $hero.css('min-height', heightToSet - headerHeight+'px');
+    },
+
+  }
+});
diff --git a/ee/bulk-operations-dashboard/assets/js/pages/legal/privacy.page.js b/ee/bulk-operations-dashboard/assets/js/pages/legal/privacy.page.js
new file mode 100644
index 0000000000..00ae8d3b94
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/js/pages/legal/privacy.page.js
@@ -0,0 +1,25 @@
+parasails.registerPage('privacy', {
+  //  ╦╔╗╔╦╔╦╗╦╔═╗╦    ╔═╗╔╦╗╔═╗╔╦╗╔═╗
+  //  ║║║║║ ║ ║╠═╣║    ╚═╗ ║ ╠═╣ ║ ║╣
+  //  ╩╝╚╝╩ ╩ ╩╩ ╩╩═╝  ╚═╝ ╩ ╩ ╩ ╩ ╚═╝
+  data: {
+    //…
+  },
+
+  //  ╦  ╦╔═╗╔═╗╔═╗╦ ╦╔═╗╦  ╔═╗
+  //  ║  ║╠╣ ║╣ ║  ╚╦╝║  ║  ║╣
+  //  ╩═╝╩╚  ╚═╝╚═╝ ╩ ╚═╝╩═╝╚═╝
+  beforeMount: function() {
+    //…
+  },
+  mounted: async function(){
+    //…
+  },
+
+  //  ╦╔╗╔╔╦╗╔═╗╦═╗╔═╗╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
+  //  ║║║║ ║ ║╣ ╠╦╝╠═╣║   ║ ║║ ║║║║╚═╗
+  //  ╩╝╚╝ ╩ ╚═╝╩╚═╩ ╩╚═╝ ╩ ╩╚═╝╝╚╝╚═╝
+  methods: {
+    //…
+  }
+});
diff --git a/ee/bulk-operations-dashboard/assets/js/pages/legal/terms.page.js b/ee/bulk-operations-dashboard/assets/js/pages/legal/terms.page.js
new file mode 100644
index 0000000000..6dfccb7fba
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/js/pages/legal/terms.page.js
@@ -0,0 +1,25 @@
+parasails.registerPage('terms', {
+  //  ╦╔╗╔╦╔╦╗╦╔═╗╦    ╔═╗╔╦╗╔═╗╔╦╗╔═╗
+  //  ║║║║║ ║ ║╠═╣║    ╚═╗ ║ ╠═╣ ║ ║╣
+  //  ╩╝╚╝╩ ╩ ╩╩ ╩╩═╝  ╚═╝ ╩ ╩ ╩ ╩ ╚═╝
+  data: {
+    //…
+  },
+
+  //  ╦  ╦╔═╗╔═╗╔═╗╦ ╦╔═╗╦  ╔═╗
+  //  ║  ║╠╣ ║╣ ║  ╚╦╝║  ║  ║╣
+  //  ╩═╝╩╚  ╚═╝╚═╝ ╩ ╚═╝╩═╝╚═╝
+  beforeMount: function() {
+    //…
+  },
+  mounted: async function(){
+    //…
+  },
+
+  //  ╦╔╗╔╔╦╗╔═╗╦═╗╔═╗╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
+  //  ║║║║ ║ ║╣ ╠╦╝╠═╣║   ║ ║║ ║║║║╚═╗
+  //  ╩╝╚╝ ╩ ╚═╝╩╚═╩ ╩╚═╝ ╩ ╩╚═╝╝╚╝╚═╝
+  methods: {
+    //…
+  }
+});
diff --git a/ee/bulk-operations-dashboard/assets/js/pages/profiles.page.js b/ee/bulk-operations-dashboard/assets/js/pages/profiles.page.js
new file mode 100644
index 0000000000..b3a6aa1ee0
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/js/pages/profiles.page.js
@@ -0,0 +1,128 @@
+parasails.registerPage('profiles', {
+  //  ╦╔╗╔╦╔╦╗╦╔═╗╦    ╔═╗╔╦╗╔═╗╔╦╗╔═╗
+  //  ║║║║║ ║ ║╠═╣║    ╚═╗ ║ ╠═╣ ║ ║╣
+  //  ╩╝╚╝╩ ╩ ╩╩ ╩╩═╝  ╚═╝ ╩ ╩ ╩ ╩ ╚═╝
+  data: {
+    sortDirection: 'ASC',
+    teamFilter: undefined,
+    profilesToDisplay: [],
+    platformFriendlyNames: {
+      'darwin': 'macOS, iOS, ipadOS',
+      'windows': 'Windows',
+      'linux': 'Linux'
+    },
+    selectedTeam: {},
+    modal: '',
+    syncing: false,
+    formData: {},
+    formErrors: {},
+    addProfileFormRules: {
+      newProfile: {required: true}
+    },
+    editProfileFormRules: {},
+    profileToEdit: {},
+    cloudError: '',
+    newProfile: undefined,
+  },
+
+  //  ╦  ╦╔═╗╔═╗╔═╗╦ ╦╔═╗╦  ╔═╗
+  //  ║  ║╠╣ ║╣ ║  ╚╦╝║  ║  ║╣
+  //  ╩═╝╩╚  ╚═╝╚═╝ ╩ ╚═╝╩═╝╚═╝
+  beforeMount: function() {
+    this.profilesToDisplay = this.profiles;
+  },
+  mounted: async function() {
+    //…
+  },
+
+  //  ╦╔╗╔╔╦╗╔═╗╦═╗╔═╗╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
+  //  ║║║║ ║ ║╣ ╠╦╝╠═╣║   ║ ║║ ║║║║╚═╗
+  //  ╩╝╚╝ ╩ ╚═╝╩╚═╩ ╩╚═╝ ╩ ╩╚═╝╝╚╝╚═╝
+  methods: {
+    clickChangeSortDirection: async function() {
+      if(this.sortDirection === 'ASC') {
+        this.sortDirection = 'DESC';
+        this.profilesToDisplay = _.sortByOrder(this.profiles, 'name', 'desc');
+      } else {
+        this.sortDirection = 'ASC';
+        this.profilesToDisplay = _.sortByOrder(this.profiles, 'name', 'asc');
+      }
+      await this.forceRender();
+    },
+    changeTeamFilter: async function() {// Used by the team picker dropdown.
+      if(this.teamFilter !== undefined){
+        this.selectedTeam = _.find(this.teams, {fleetApid: this.teamFilter});
+        let profilesOnThisTeam = _.filter(this.profiles, (profile)=>{
+          // console.log(profile.profiles);
+          return profile.teams && _.where(profile.teams, {'fleetApid': this.selectedTeam.fleetApid}).length > 0;
+        });
+        this.profilesToDisplay = profilesOnThisTeam;
+      } else {
+        this.profilesToDisplay = this.profiles;
+      }
+    },
+    clickChangeTeamFilter: async function(teamApid) {// Used by the tooltip links.
+      this.teamFilter = teamApid;
+      this.selectedTeam = _.find(this.teams, {'fleetApid': teamApid});
+      let profilesOnThisTeam = _.filter(this.profiles, (profile)=>{
+        return profile.teams && _.where(profile.teams, {'fleetApid': this.selectedTeam.fleetApid}).length > 0;
+      });
+      this.profilesToDisplay = profilesOnThisTeam;
+    },
+    clickDownloadProfile: async function(profile) {
+      if(!profile.teams){
+        window.open('/download-profile?id='+encodeURIComponent(profile.id));
+      } else {
+        window.open('/download-profile?uuid='+encodeURIComponent(profile.teams[0].uuid));
+      }
+    },
+    clickOpenEditModal: async function(profile) {
+      this.profileToEdit = _.clone(profile);
+      this.formData.newTeamIds = _.pluck(this.profileToEdit.teams, 'fleetApid');
+      this.formData.profile = profile;
+      this.modal = 'edit-profile';
+    },
+    clickOpenDeleteModal: async function(profile) {
+      this.formData.profile = _.clone(profile);
+      this.modal = 'delete-profile';
+    },
+    clickOpenAddProfileModal: async function() {
+      this.modal = 'add-profile';
+    },
+    closeModal: async function() {
+      this.modal = '';
+      this.formErrors = {};
+      this.formData = {};
+      await this.forceRender();
+    },
+    submittedForm: async function() {
+      this.syncing = false;
+      this.closeModal();
+    },
+    handleSubmittingDeleteProfileForm: async function() {
+      let argins = _.clone(this.formData);
+      await Cloud.deleteProfile.with({profile: argins.profile});
+      await this._getProfiles();
+    },
+    handleSubmittingAddProfileForm: async function() {
+      let argins = _.clone(this.formData);
+      await Cloud.uploadProfile.with({newProfile: argins.newProfile, teams: argins.teams});
+      await this._getProfiles();
+    },
+    handleSubmittingEditProfileForm: async function() {
+      let argins = _.clone(this.formData);
+      if(argins.newTeamIds === [undefined]){
+        argins.newTeamIds = [];
+      }
+      await Cloud.editProfile.with({profile: argins.profile, newProfile: argins.newProfile, newTeamIds: argins.newTeamIds});
+      await this._getProfiles();
+    },
+    _getProfiles: async function() {
+      this.syncing = true;
+      let newProfilesInformation = await Cloud.getProfiles();
+      this.profiles = newProfilesInformation;
+      this.syncing = false;
+      await this.changeTeamFilter();
+    }
+  }
+});
diff --git a/ee/bulk-operations-dashboard/assets/js/pages/scripts.page.js b/ee/bulk-operations-dashboard/assets/js/pages/scripts.page.js
new file mode 100644
index 0000000000..d7fb575946
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/js/pages/scripts.page.js
@@ -0,0 +1,120 @@
+parasails.registerPage('scripts', {
+  //  ╦╔╗╔╦╔╦╗╦╔═╗╦    ╔═╗╔╦╗╔═╗╔╦╗╔═╗
+  //  ║║║║║ ║ ║╠═╣║    ╚═╗ ║ ╠═╣ ║ ║╣
+  //  ╩╝╚╝╩ ╩ ╩╩ ╩╩═╝  ╚═╝ ╩ ╩ ╩ ╩ ╚═╝
+  data: {
+    sortDirection: 'ASC',
+    teamFilter: undefined,
+    scriptsToDisplay: [],
+    platformFriendlyNames: {
+      'darwin': 'macOS, iOS, ipadOS',
+      'windows': 'Windows',
+      'linux': 'Linux'
+    },
+    selectedTeam: {},
+    modal: '',
+    syncing: false,
+    formData: {},
+    formErrors: {},
+    addScriptFormRules: {
+      newScript: {required: true},
+    },
+    editScriptFormRules: {},
+    profileToEdit: {},
+    cloudError: '',
+    newScript: undefined,
+  },
+
+  //  ╦  ╦╔═╗╔═╗╔═╗╦ ╦╔═╗╦  ╔═╗
+  //  ║  ║╠╣ ║╣ ║  ╚╦╝║  ║  ║╣
+  //  ╩═╝╩╚  ╚═╝╚═╝ ╩ ╚═╝╩═╝╚═╝
+  beforeMount: function() {
+    //…
+  },
+  mounted: async function() {
+    this.scriptsToDisplay = this.scripts;
+  },
+
+  //  ╦╔╗╔╔╦╗╔═╗╦═╗╔═╗╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
+  //  ║║║║ ║ ║╣ ╠╦╝╠═╣║   ║ ║║ ║║║║╚═╗
+  //  ╩╝╚╝ ╩ ╚═╝╩╚═╩ ╩╚═╝ ╩ ╩╚═╝╝╚╝╚═╝
+  methods: {
+    clickChangeSortDirection: async function() {
+      if(this.sortDirection === 'ASC') {
+        this.sortDirection = 'DESC';
+        this.scriptsToDisplay = _.sortByOrder(this.scripts, 'name', 'desc');
+      } else {
+        this.sortDirection = 'ASC';
+        this.scriptsToDisplay = _.sortByOrder(this.scripts, 'name', 'asc');
+      }
+      await this.forceRender();
+    },
+    changeTeamFilter: async function() {
+      if(this.teamFilter !== undefined){
+        this.selectedTeam = _.find(this.teams, {fleetApid: this.teamFilter});
+        let scriptsOnThisTeam = _.filter(this.scripts, (script)=>{
+          return _.where(script.teams, {'fleetApid': this.selectedTeam.fleetApid}).length > 0;
+        });
+        this.scriptsToDisplay = scriptsOnThisTeam;
+      } else {
+        this.scriptsToDisplay = this.scripts;
+      }
+    },
+    clickChangeTeamFilter: async function(teamApid) {
+      this.teamFilter = teamApid;
+      this.selectedTeam = _.find(this.teams, {'fleetApid': teamApid});
+      let scriptsOnThisTeam = _.filter(this.scripts, (script)=>{
+        return _.where(script.teams, {'fleetApid': this.selectedTeam.fleetApid}).length > 0;
+      });
+      this.scriptsToDisplay = scriptsOnThisTeam;
+    },
+    clickDownloadScript: async function(script) {
+      if(!script.teams){
+        window.open('/download-script?id='+encodeURIComponent(script.id));
+      } else {
+        window.open('/download-script?fleetApid='+encodeURIComponent(script.teams[0].scriptFleetApid));
+      }
+    },
+    clickOpenEditModal: async function(script) {
+      this.scriptToEdit = _.clone(script);
+      this.formData.newTeamIds = _.pluck(this.scriptToEdit.teams, 'fleetApid');
+      this.formData.script = script;
+      this.modal = 'edit-script';
+    },
+    clickOpenDeleteModal: async function(script) {
+      this.formData.script = _.clone(script);
+      this.modal = 'delete-script';
+    },
+    clickOpenAddScriptModal: async function() {
+      this.modal = 'add-script';
+    },
+    closeModal: async function() {
+      this.modal = '';
+      this.formErrors = {};
+      this.formData = {};
+      await this.forceRender();
+    },
+    submittedForm: async function() {
+      await this._getScripts();
+      this.syncing = false;
+      this.closeModal();
+    },
+    handleSubmittingDeleteScriptForm: async function() {
+      let argins = _.clone(this.formData);
+      await Cloud.deleteScript.with({script: argins.script});
+      await this._getScripts();
+    },
+    handleSubmittingAddScriptForm: async function() {
+      let argins = _.clone(this.formData);
+      await Cloud.uploadScript.with({newScript: argins.newScript, teams: argins.teams});
+      await this._getScripts();
+    },
+    _getScripts: async function() {
+      this.syncing = true;
+      let newScriptsInformation = await Cloud.getScripts();
+      this.scripts = newScriptsInformation;
+      this.syncing = false;
+      await this.changeTeamFilter();
+    }
+  }
+});
diff --git a/ee/bulk-operations-dashboard/assets/js/utilities/get-mimetype-icon-class.js b/ee/bulk-operations-dashboard/assets/js/utilities/get-mimetype-icon-class.js
new file mode 100644
index 0000000000..b8c937fe8e
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/js/utilities/get-mimetype-icon-class.js
@@ -0,0 +1,72 @@
+/**
+ * getMimetypeIconClass()
+ *
+ * -----------------------------------------------------------------
+ * @returns {String} the icon-bestowing class name for given MIME type
+ */
+
+parasails.registerUtility('getMimetypeIconClass', function getMimetypeIconClass(mimeType) {
+
+  var iconClassName;
+  switch(mimeType) {
+    case 'application/pdf':
+      iconClassName = 'fa fa-file-pdf-o';
+      break;
+    case 'image/png':
+    case 'image/jpeg':
+    case 'image/gif':
+    case 'application/icon':
+    case 'image/svg+xml':
+    case 'image/tiff':
+      iconClassName = 'fa fa-file-image-o';
+      break;
+    case 'application/zip':
+    case 'application/x-7z-compressed':
+    case 'application/x-rar-compressed':
+    case 'application/x-tar':
+    case 'application/x-bzip':
+    case 'application/x-bzip2':
+    case 'application/octet-stream':
+      iconClassName = 'fa fa-file-archive-o';
+      break;
+    case 'text/csv':
+    case 'application/vnd.ms-excel':
+    case 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet':
+    case 'application/vnd.oasis.opendocument.spreadsheet':
+      iconClassName = 'fa fa-file-excel-o';
+      break;
+    case 'application/msword':
+    case 'application/vnd.openxmlformats-officedocument.wordprocessingml.document':
+    case 'application/vnd.oasis.opendocument.text':
+    case 'application/rtf':
+      iconClassName = 'fa fa-file-word-o';
+      break;
+    case 'application/vnd.ms-powerpoint':
+    case 'application/vnd.openxmlformats-officedocument.presentationml.presentation':
+    case 'application/vnd.oasis.opendocument.presentation':
+      iconClassName = 'fa fa-file-powerpoint-o';
+      break;
+    case 'application/vnd.ms-outlook':
+      iconClassName = 'fa fa-envelope-o';
+      break;
+    case 'text/plain':
+      iconClassName = 'fa fa-file-text-o';
+      break;
+    default:
+      if(mimeType && mimeType.match(/^image/)) {
+        iconClassName = 'fa fa-file-image-o';
+      } else if(mimeType && mimeType.match(/^video/)) {
+        iconClassName = 'fa fa-file-video-o';
+      } else if(mimeType && mimeType.match(/^audio/)) {
+        iconClassName = 'fa fa-file-audio-o';
+      } else if(mimeType && mimeType.match(/^text/)) {
+        iconClassName = 'fa fa-file-text-o';
+      } else {
+        iconClassName = 'fa fa-file-o';
+      }
+      break;
+  }
+
+  return iconClassName;
+
+});
diff --git a/ee/bulk-operations-dashboard/assets/js/utilities/open-stripe-checkout.js b/ee/bulk-operations-dashboard/assets/js/utilities/open-stripe-checkout.js
new file mode 100644
index 0000000000..3929fa38d3
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/js/utilities/open-stripe-checkout.js
@@ -0,0 +1,98 @@
+/**
+ * openStripeCheckout()
+ *
+ * Open the Stripe Checkout modal dialog and resolve when it is closed.
+ *
+ * -----------------------------------------------------------------
+ * @param {String} stripePublishableKey
+ * @param {String} billingEmailAddress
+ * @param {String} headingText (optional)
+ * @param {String} descriptionText (optional)
+ * @param {String} buttonText (optional)
+ * -----------------------------------------------------------------
+ * @returns {Dictionary?}  (or undefined if the form was cancelled)
+ *          e.g.
+ *          {
+ *            stripeToken: '…',
+ *            billingCardLast4: '…',
+ *            billingCardBrand: '…',
+ *            billingCardExpMonth: '…',
+ *            billingCardExpYear: '…'
+ *          }
+ * -----------------------------------------------------------------
+ * Example usage:
+ * ```
+ * var billingInfo = await openStripeCheckout(
+ *   'pk_test_Qz5RfDmVV5IunTFAHtDqDWn4',
+ *   'foo@example.com'
+ * );
+ * ```
+ */
+
+parasails.registerUtility('openStripeCheckout', async function openStripeCheckout(stripePublishableKey, billingEmailAddress, headingText, descriptionText, buttonText) {
+
+  // Cache (& use cached) "checkout handler" globally on the page so that we
+  // don't end up configuring it more than once (i.e. so Stripe.js doesn't
+  // complain).
+  var CACHE_KEY = '_cachedStripeCheckoutHandler';
+  if (!window[CACHE_KEY]) {
+    window[CACHE_KEY] = StripeCheckout.configure({
+      key: stripePublishableKey,
+    });
+  }
+  var checkoutHandler = window[CACHE_KEY];
+
+  // Track whether the "token" callback was triggered.
+  // (If it has NOT at the time the "closed" callback is triggered, then we
+  // know the checkout form was cancelled.)
+  var hasTriggeredTokenCallback;
+
+  // Build a Promise & send it back as our "thenable" (AsyncFunction's return value).
+  // (this is necessary b/c we're wrapping an api that isn't `await`-compatible)
+  return new Promise((resolve, reject)=>{
+    try {
+      // Open Stripe checkout.
+      // (https://stripe.com/docs/checkout#integration-custom)
+      checkoutHandler.open({
+        name: headingText || 'NEW_APP_NAME',
+        description: descriptionText || 'Link your credit card.',
+        panelLabel: buttonText || 'Save card',
+        email: billingEmailAddress,//« So that Stripe doesn't prompt for an email address
+        locale: 'auto',
+        zipCode: false,
+        allowRememberMe: false,
+        closed: ()=>{
+          // If the Checkout dialog was cancelled, resolve undefined.
+          if (!hasTriggeredTokenCallback) {
+            resolve();
+          }
+        },
+        token: (stripeData)=>{
+
+          // After payment info has been successfully added, and a token
+          // was obtained...
+          hasTriggeredTokenCallback = true;
+
+          // Normalize token and billing card info from Stripe and resolve
+          // with that.
+          let stripeToken = stripeData.id;
+          let billingCardLast4 = stripeData.card.last4;
+          let billingCardBrand = stripeData.card.brand;
+          let billingCardExpMonth = String(stripeData.card.exp_month);
+          let billingCardExpYear = String(stripeData.card.exp_year);
+
+          resolve({
+            stripeToken,
+            billingCardLast4,
+            billingCardBrand,
+            billingCardExpMonth,
+            billingCardExpYear
+          });
+        }//Œ
+      });//_∏_
+    } catch (err) {
+      reject(err);
+    }
+  });//_∏_
+
+});
diff --git a/ee/bulk-operations-dashboard/assets/styles/bootstrap-overrides.less b/ee/bulk-operations-dashboard/assets/styles/bootstrap-overrides.less
new file mode 100644
index 0000000000..02681de50f
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/bootstrap-overrides.less
@@ -0,0 +1,37 @@
+/**
+ * This file is for overriding some default bootstrap styles.
+ *
+ * > NOTE THAT THIS FILE AFFECTS GLOBAL STYLES.
+ */
+
+// lesshint-disable
+* {
+  box-sizing: border-box;
+}
+// lesshint-enable
+
+img {
+  display: block;
+}
+
+// Get rid of weird background on <a>s with button styles
+.btn, [type='button'] {
+  -webkit-appearance: none;
+}
+
+// Custom link styles within bodies of text
+h1, h2, h3, h4, h5, h6, p, li, blockquote, label {
+  >a:not(.btn), small >a:not(.btn) {
+    color: @brand;
+    border-bottom: 1px solid @text-normal;
+    &:hover {
+      text-decoration: none;
+      color: @text-normal;
+    }
+  }
+}
+
+blockquote {
+  border-left: 3px solid @border-lt-gray;
+  padding-left: 20px;
+}
diff --git a/ee/bulk-operations-dashboard/assets/styles/components/ajax-button.component.less b/ee/bulk-operations-dashboard/assets/styles/components/ajax-button.component.less
new file mode 100644
index 0000000000..c1a655f39b
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/components/ajax-button.component.less
@@ -0,0 +1,41 @@
+
+/**
+ * <ajax-button>
+ *
+ * App-wide styles for our ajax buttons.
+ */
+
+ [parasails-component='ajax-button'] {
+   .button-loader, .button-loading {
+     display: none;
+     margin: auto;
+     .loading-dot {
+       opacity: 0;
+       display: inline;
+       .fade-in();
+       .animation-duration(1s);
+       .animation-iteration-count(infinite);
+       .animation-direction(linear);
+       &.dot1 {
+         .animation-delay(0.25s);
+       }
+       &.dot2 {
+         .animation-delay(0.5s);
+       }
+       &.dot3 {
+         .animation-delay(0.75s);
+       }
+       &.dot4 {
+         .animation-delay(1s);
+       }
+     }
+   }
+   &.syncing {
+     .button-loader, .button-loading {
+       display: inline-block;
+     }
+     .button-text {
+       display: none;
+     }
+   }
+ }
diff --git a/ee/bulk-operations-dashboard/assets/styles/components/cloud-error.component.less b/ee/bulk-operations-dashboard/assets/styles/components/cloud-error.component.less
new file mode 100644
index 0000000000..c652c26915
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/components/cloud-error.component.less
@@ -0,0 +1,9 @@
+/**
+ * <cloud-error>
+ *
+ * App-wide styles for our cloud-errors.
+ */
+
+[parasails-component='cloud-error'] {
+  // ...
+}
diff --git a/ee/bulk-operations-dashboard/assets/styles/components/file-upload.component.less b/ee/bulk-operations-dashboard/assets/styles/components/file-upload.component.less
new file mode 100644
index 0000000000..d2ab275134
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/components/file-upload.component.less
@@ -0,0 +1,88 @@
+/**
+ * <file-upload>
+ */
+
+[parasails-component='file-upload'] {
+  @min-desired-image-preview-height: 280px;//« e.g. ~100px for a logo, ~280px for a headshot, etc.
+
+  position: relative;
+  .btn-and-tips-if-relevant {
+    min-width: 200px;
+    .file-upload-button {
+      position: relative;
+      cursor: pointer;
+      margin-bottom: 10px;
+      .button-text {
+        padding-top: 2px;
+      }
+      .file-input {
+        position: absolute;
+        top: 0px;
+        left: 0px;
+        height: 100%;
+        width: 100%;
+        cursor: pointer;
+        opacity: 0;
+      }
+    }
+    p {
+      margin-top: 10px;
+    }
+  }
+
+
+  &.file-mode {
+    .btn-and-tips-if-relevant {
+      display: inline-block;
+      min-width: 0;
+    }
+    .file-metadata-preview {
+      padding-right: 30px;
+      .selected-file-name {
+        font-weight: bold;
+      }
+      .selected-file-size {
+        color: @text-muted;
+      }
+    }
+  }
+
+  &.disabled {
+    .btn-and-tips-if-relevant {
+      .file-upload-button {
+        cursor: default;
+        border-color: @border-lt-gray;
+        color: @border-lt-gray;
+        &:hover {
+          cursor: default;
+          background-color: transparent;
+          border-color: @border-lt-gray;
+          color: @border-lt-gray;
+          .button-text, .file-input {
+            cursor: default;
+          }
+        }
+      }
+    }
+  }
+
+  @media screen and (max-width: 767px) {
+    padding-left: 0px;
+    .image-preview {
+      position: static;
+      .image-preview-field {
+        margin-left: auto;
+        margin-right: auto;
+      }
+    }
+    .btn-and-tips-if-relevant {
+      width: 100%;
+      margin-top: 25px;
+      max-width: 400px;
+      margin-left: auto;
+      margin-right: auto;
+      text-align: center;
+    }
+  }
+}
+
diff --git a/ee/bulk-operations-dashboard/assets/styles/components/modal.component.less b/ee/bulk-operations-dashboard/assets/styles/components/modal.component.less
new file mode 100644
index 0000000000..964e1b1808
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/components/modal.component.less
@@ -0,0 +1,95 @@
+/**
+ * <modal>
+ *
+ * App-wide styles for our modals.
+ */
+
+[parasails-component='modal'] {
+  -webkit-overflow-scrolling: touch;//« makes this actually scrollable on certain phones
+  [purpose='modal-dialog'] {
+    z-index: 100;
+    position: relative;
+    max-width: 700px;
+    [purpose='modal-content'] {
+      max-width: 650px;
+      [purpose='modal-close-button'] {
+        .btn-reset();
+        opacity: 0.6;
+        &:hover {
+          opacity: 1;
+        }
+      }
+    }
+  }
+  // Custom styles for the Bootstrap modal:
+  // (Want to use Bootstrap's default styles? Just comment out the rest of the rules below)
+  .petticoat {
+    display: none;// 2022-12-11: mikermcneil: This is appearing as a dark aberration after changing up the modal so I'm hiding it
+    position: fixed;
+    width: 100%;
+    height: 75px;// should cover topbar
+    z-index: 50;
+    left: 0px;
+    top: 0px;
+    background-color: #192147;
+    opacity: 0.35;
+  }
+  .modal-content {
+    border-radius: 8px;
+    border: 1px solid #B3B6C1;
+    background: #FFF;
+    box-shadow: 0px 4px 16px 0px rgba(25, 33, 71, 0.25);
+
+    /* elevation/modal */
+    padding: 32px;
+    .modal-header {
+      border-bottom: none;
+      display: block;
+      position: relative;
+      text-align: center;
+      padding-bottom: 0px;
+      padding-left: 0px;
+      padding-right: 0px;
+      padding-top: 0px;
+      .modal-title {
+        font-weight: @bold;
+      }
+      .modal-intro {
+        margin-left: auto;
+        margin-right: auto;
+        color: @text-muted;
+        margin-bottom: 20px;
+      }
+      hr {
+        margin-top: 25px;
+        margin-left: auto;
+        margin-right: auto;
+        margin-bottom: 10px;
+        width: 100px;
+        height: 2px;
+        border-top: 2px solid @brand;
+      }
+    }
+    .modal-body {
+      padding-top: 10px;
+      padding-bottom: 10px;
+      padding-left: 0px;
+      padding-right: 0px;
+    }
+    .modal-footer {
+      padding-top: 25px;
+      padding-bottom: 0px;
+      padding-left: 0px;
+      padding-right: 0px;
+      margin-top: 10px;
+    }
+  }
+}
+
+// Modal backdrop styles are exposed globally here because this gets appended to the <body>
+.modal-backdrop {
+  background-color: #192147;
+  &.show {
+    opacity: 0.35;
+  }
+}
diff --git a/ee/bulk-operations-dashboard/assets/styles/components/multifield.component.less b/ee/bulk-operations-dashboard/assets/styles/components/multifield.component.less
new file mode 100644
index 0000000000..7380ee05bf
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/components/multifield.component.less
@@ -0,0 +1,71 @@
+/**
+ * <multifield>
+ *
+ * App-wide styles for our multifields.
+ */
+
+[parasails-component='multifield'] {
+  .multifield-item {
+    position: relative;
+    padding-right: 30px;
+    margin-top: 15px;
+    margin-bottom: 15px;
+    &:first-child {
+      margin-top: 0px;
+    }
+    .multifield-item-label {
+      position: absolute;
+      left: 0px;
+      top: 0px;
+      line-height: 38px;
+      vertical-align: middle;
+      color: @text-muted;
+    }
+    .multifield-item-remove-button {
+      .btn-reset();
+      .transition(all 250ms);
+      position: absolute;
+      right: 0px;
+      top: 7px;
+      line-height: 24px;
+      padding-top: 0;
+      padding-bottom: 0;
+      padding-left: 10px;
+      padding-right: 10px;
+      background-image: url('/images/trash-16x16@2x.png');
+      background-repeat: no-repeat;
+      background-position: right center;
+      background-size: 16px 16px;
+      width: 20px;
+      height: 20px;
+      font-size: 14px;
+      color: #515774;
+      opacity: 1;
+      &:hover {
+        opacity: 1;
+        color: @text-normal;
+      }
+    }
+    input {
+      width: 100%;
+      height: 40px;
+      padding: 0px 12px;
+      border: 1px solid #E2E4EA;
+      border-radius: 4px;
+    }
+    select {
+      width: 100%;
+      height: 40px;
+      border: 1px solid #E2E4EA;
+      border-radius: 4px;
+    }
+  }
+  .is-invalid:focus-visible {
+    outline: red auto 1px;
+  }
+ .add-button-wrapper {
+    justify-content: flex-end;
+    color: #6A67FE;
+    cursor: pointer;
+  }
+}
diff --git a/ee/bulk-operations-dashboard/assets/styles/components/stripe-card-element.component.less b/ee/bulk-operations-dashboard/assets/styles/components/stripe-card-element.component.less
new file mode 100644
index 0000000000..507e90afce
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/components/stripe-card-element.component.less
@@ -0,0 +1,65 @@
+/**
+ * <stripe-card-element>
+ */
+[parasails-component='stripe-card-element'] {
+  .card-element-wrapper {
+    position: relative;
+    .card-element {
+      padding-top: 0;
+      padding-bottom: 0;
+      padding-right: 30px;
+      &.pseudofocused {
+        // These should mimic your normal form inputs' :focus styles:
+        border-color: #80bdff;
+        outline: 0;
+        box-shadow: 0 0 0 0.2rem rgba(0, 123, 255, 0.25);
+      }
+    }
+    .status-indicator {
+      font-size: 15px;
+      position: absolute;
+      right: 14px;
+      top: 8px;
+      &.hidden {
+        display: none;
+      }
+      &.syncing {
+        -webkit-animation: fa-spinner-rotate 1.5s infinite linear;
+        animation: fa-spinner-rotate 1.5s infinite linear;
+        @-webkit-keyframes fa-spinner-rotate {
+          0% {
+            -webkit-transform: rotate(0deg);
+          }
+          100% {
+            -webkit-transform: rotate(360deg);
+          }
+        }
+        @keyframes rotate-clockwise {
+          0% {
+            -ms-transform: rotate(0deg);
+            transform: rotate(0deg);
+          }
+          100% {
+            -ms-transform: rotate(360deg);
+            transform: rotate(360deg);
+          }
+        }
+      }
+    }
+    &.secret-card-element-wrapper {
+      opacity: 0;
+      height: 1px;
+    }
+  }
+
+  @media screen and (max-width: 450px) {
+    .card-element-wrapper {
+      .card-element {
+        padding-right: 20px;
+      }
+      .status-indicator {
+        right: 9px;
+      }
+    }
+  }
+}
diff --git a/ee/bulk-operations-dashboard/assets/styles/importer.less b/ee/bulk-operations-dashboard/assets/styles/importer.less
new file mode 100644
index 0000000000..2b812422ff
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/importer.less
@@ -0,0 +1,41 @@
+/**
+ * importer.less
+ *
+ * By default, new Sails projects are configured to compile this file
+ * from LESS to CSS.  Unlike CSS files, LESS files are not compiled and
+ * included automatically unless they are imported below.
+ *
+ * For more information see:
+ *   https://sailsjs.com/anatomy/assets/styles/importer-less
+ */
+
+// Mixins and variables  (LESS mixins/variables only, no global selectors)
+@import 'mixins-and-variables/index.less';
+
+// Overall layout  (contains global selectors)
+@import 'bootstrap-overrides.less';
+@import 'layout.less';
+
+// Per-component styles
+@import 'components/stripe-card-element.component.less';
+@import 'components/ajax-button.component.less';
+@import 'components/modal.component.less';
+@import 'components/cloud-error.component.less';
+@import 'components/multifield.component.less';
+@import 'components/file-upload.component.less';
+
+// Per-page styles
+@import 'pages/scripts.less';
+@import 'pages/profiles.less';
+@import 'pages/entrance/confirmed-email.less';
+@import 'pages/entrance/login.less';
+@import 'pages/entrance/forgot-password.less';
+@import 'pages/entrance/new-password.less';
+@import 'pages/account/account-overview.less';
+@import 'pages/account/edit-password.less';
+@import 'pages/account/edit-profile.less';
+@import 'pages/legal/terms.less';
+@import 'pages/legal/privacy.less';
+@import 'pages/404.less';
+@import 'pages/500.less';
+@import 'pages/498.less';
diff --git a/ee/bulk-operations-dashboard/assets/styles/layout.less b/ee/bulk-operations-dashboard/assets/styles/layout.less
new file mode 100644
index 0000000000..6744269ef7
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/layout.less
@@ -0,0 +1,86 @@
+@footer-height: 40px;
+@container-md-max-width: 1100px;
+
+[v-cloak] { display: none; }
+
+html, body {
+  height: 100%;
+  margin: 0;
+}
+[purpose='page-header'] {
+  background-color: #fff;
+  height: 60px;
+  border-bottom: 1px solid #c4ccd2;
+  .nav-link {
+    color: #292b2d;
+    font-weight: bold;
+    font-size: 14px;
+  }
+  .dropdown-item:hover {
+    background-color: unset;
+    color: #6a67fe;
+  }
+  button {
+    color: #292b2d;
+    font-weight: bold;
+    font-size: 14px;
+    background: none;
+    border: none;
+    &:focus {
+      outline: none;
+    }
+  }
+}
+[purpose='page-wrap'] {
+  height: 100%;
+  /* lesshint-disable */height: auto !important;/* lesshint-enable */
+  // ^^The above is to disable "importantRule" and "duplicateProperty" rules.
+  min-height: 100%;
+  position: relative;
+  padding-bottom: @footer-height;
+  color: #292b2d;
+  a {
+    color: #007697;
+  }
+}
+
+[purpose='page-footer'] {
+  border-top: 1px solid rgba(0, 0, 0, 0.1);
+  height: @footer-height;
+  width: 100%;
+  position: absolute;
+  left: 0px;
+  bottom: 0px;
+}
+
+body.detected-mobile {
+  // Above and beyond the media queries below, this selector (which relies on
+  // `parasails` automatically attaching this class, if appropriate) contains
+  // styles intended to be activated specifically when loaded from a recognized
+  // mobile device, regardless of viewport dimensions.  This includes tablet
+  // devices (like the iPad) as well as handset devices (like the iPhone).
+  // …
+}
+
+@media (max-width: 800px) {
+  [purpose='page-wrap'] {
+    padding-bottom: 75px;
+    [purpose='page-footer'] {
+      height: 75px;
+      [purpose='footer-copy'], [purpose='footer-nav'] {
+        width: 100%;
+        display: block;
+        text-align: center;
+      }
+    }
+  }
+}
+
+@media (max-width: 575px) {
+  [purpose='page-wrap'] {
+    padding-bottom: 100px;
+    [purpose='page-footer'] {
+      height: 100px;
+    }
+  }
+}
diff --git a/ee/bulk-operations-dashboard/assets/styles/mixins-and-variables/animations.less b/ee/bulk-operations-dashboard/assets/styles/mixins-and-variables/animations.less
new file mode 100644
index 0000000000..7b25a53556
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/mixins-and-variables/animations.less
@@ -0,0 +1,270 @@
+.animation-delay(@delay) {
+  -moz-animation-delay: @delay;
+  -webkit-animation-delay: @delay;
+  -ms-animation-delay: @delay;
+  -o-animation-delay: @delay;
+  animation-delay: @delay;
+}
+
+.animation-name(@name) {
+  -moz-animation-name: @name;
+  -webkit-animation-name: @name;
+  -ms-animation-name: @name;
+  -o-animation-name: @name;
+  animation-name: @name;
+}
+
+.animation-duration(@duration) {
+  -moz-animation-duration: @duration;
+  -webkit-animation-duration: @duration;
+  -ms-animation-duration: @duration;
+  -o-animation-duration: @duration;
+  animation-duration: @duration;
+}
+
+.animation-iteration-count(@iteration-count) {
+  -moz-animation-iteration-count: @iteration-count;
+  -webkit-animation-iteration-count: @iteration-count;
+  -ms-animation-iteration-count: @iteration-count;
+  -o-animation-iteration-count: @iteration-count;
+  animation-iteration-count: @iteration-count;
+}
+
+.animation-direction(@direction) {
+  -moz-animation-direction: @direction;
+  -webkit-animation-direction: @direction;
+  -ms-animation-direction: @direction;
+  -o-animation-direction: @direction;
+  animation-direction: @direction;
+}
+
+.animation-timing-function(@timingFunction) {
+  -moz-animation-timing-function: @timingFunction;
+  -webkit-animation-timing-function: @timingFunction;
+  -ms-animation-timing-function: @timingFunction;
+   -o-animation-timing-function: @timingFunction;
+  animation-timing-function: @timingFunction;
+}
+
+.transition (@transition) {
+  -webkit-transition: @transition;
+  -moz-transition   : @transition;
+  -ms-transition    : @transition;
+  -o-transition     : @transition;
+}
+
+.translate (@x, @y:0) {
+  -webkit-transform: translate(@x, @y);
+  -moz-transform   : translate(@x, @y);
+  -ms-transform    : translate(@x, @y);
+  -o-transform     : translate(@x, @y);
+  transform        : translate(@x, @y);
+}
+
+//Animations
+.fade-in() {
+  .animation-name(fade-in);
+
+  @-webkit-keyframes fade-in {
+    0%    {opacity: 0;}// lesshint spaceBeforeBrace: false
+    100%  {opacity: 1;}// lesshint spaceBeforeBrace: false
+  }
+
+  @-moz-keyframes fade-in {
+    0%    {opacity: 0;}// lesshint spaceBeforeBrace: false
+    100%  {opacity: 1;}// lesshint spaceBeforeBrace: false
+  }
+
+  @-o-keyframes fade-in {
+    0%    {opacity: 0;}// lesshint spaceBeforeBrace: false
+    100%  {opacity: 1;}// lesshint spaceBeforeBrace: false
+  }
+
+  @keyframes fade-in {
+    0%    {opacity: 0;}// lesshint spaceBeforeBrace: false
+    100%  {opacity: 1;}// lesshint spaceBeforeBrace: false
+  }
+}
+
+.loader(@dot-color: @accent-white) {
+  display: inline-block;
+  margin: auto;
+
+  .loading-dot {
+    border-radius: 50%;
+    background-color: @dot-color;
+    float: left;
+    opacity: 0;
+    width: 16px;
+    height: 16px;
+    margin: 5px;
+    .fade-in();
+    .animation-duration(1s);
+    .animation-iteration-count(infinite);
+    .animation-direction(linear);
+
+    &.dot1 {
+      .animation-delay(0.25s);
+    }
+
+    &.dot2 {
+      .animation-delay(0.5s);
+    }
+
+    &.dot3 {
+      .animation-delay(0.75s);
+    }
+
+    &.dot4 {
+      .animation-delay(1s);
+    }
+  }
+}
+
+// Special rotation animation for a font awesome-based spinner:
+.fa-spinner-rotation() {
+  -webkit-animation: fa-spinner-rotate 1.5s infinite linear;
+  animation: fa-spinner-rotate 1.5s infinite linear;
+
+  @-webkit-keyframes fa-spinner-rotate {
+    0% {
+      -webkit-transform: rotate(0deg);
+    }
+    100% {
+      -webkit-transform: rotate(360deg);
+    }
+  }
+
+  @keyframes rotate-clockwise {
+    0% {
+      -ms-transform: rotate(0deg);
+      transform: rotate(0deg);
+    }
+    100% {
+      -ms-transform: rotate(360deg);
+      transform: rotate(360deg);
+    }
+  }
+}
+
+.skid() {
+  .animation-name(skid);
+  .animation-duration(2.5s);
+  .animation-iteration-count(infinite);
+  .animation-timing-function(linear);
+  @-webkit-keyframes skid {
+    0%   {-webkit-transform: translate(0px, 0px);}// lesshint spaceBeforeBrace: false
+    10%  {-webkit-transform: translate(-1px, -1px);}// lesshint spaceBeforeBrace: false
+    20%  {-webkit-transform: translate(-2px, -2px);}// lesshint spaceBeforeBrace: false
+    30%  {-webkit-transform: translate(-3px, -2px);}// lesshint spaceBeforeBrace: false
+    40%  {-webkit-transform: translate(-4px, -1px);}// lesshint spaceBeforeBrace: false
+    50%  {-webkit-transform: translate(-5px, 0px);}// lesshint spaceBeforeBrace: false
+    60%  {-webkit-transform: translate(-4px, 1px);}// lesshint spaceBeforeBrace: false
+    70%  {-webkit-transform: translate(-3px, 2px);}// lesshint spaceBeforeBrace: false
+    80%  {-webkit-transform: translate(-2px, 2px);}// lesshint spaceBeforeBrace: false
+    90%  {-webkit-transform: translate(-1px, 1px);}// lesshint spaceBeforeBrace: false
+    100% {-webkit-transform: translate(0, 0px);}// lesshint spaceBeforeBrace: false
+  }
+  @-moz-keyframes skid {
+    0%   {-moz-transform: translate(0px, 0px);}// lesshint spaceBeforeBrace: false
+    10%  {-moz-transform: translate(-1px, -1px);}// lesshint spaceBeforeBrace: false
+    20%  {-moz-transform: translate(-2px, -2px);}// lesshint spaceBeforeBrace: false
+    30%  {-moz-transform: translate(-3px, -2px);}// lesshint spaceBeforeBrace: false
+    40%  {-moz-transform: translate(-4px, -1px);}// lesshint spaceBeforeBrace: false
+    50%  {-moz-transform: translate(-5px, 0px);}// lesshint spaceBeforeBrace: false
+    60%  {-moz-transform: translate(-4px, 1px);}// lesshint spaceBeforeBrace: false
+    70%  {-moz-transform: translate(-3px, 2px);}// lesshint spaceBeforeBrace: false
+    80%  {-moz-transform: translate(-2px, 2px);}// lesshint spaceBeforeBrace: false
+    90%  {-moz-transform: translate(-1px, 1px);}// lesshint spaceBeforeBrace: false
+    100% {-moz-transform: translate(0, 0px);}// lesshint spaceBeforeBrace: false
+  }
+  @-o-keyframes skid {
+    0%   {-o-transform: translate(0px, 0px);}// lesshint spaceBeforeBrace: false
+    10%  {-o-transform: translate(-1px, -1px);}// lesshint spaceBeforeBrace: false
+    20%  {-o-transform: translate(-2px, -2px);}// lesshint spaceBeforeBrace: false
+    30%  {-o-transform: translate(-3px, -2px);}// lesshint spaceBeforeBrace: false
+    40%  {-o-transform: translate(-4px, -1px);}// lesshint spaceBeforeBrace: false
+    50%  {-o-transform: translate(-5px, 0px);}// lesshint spaceBeforeBrace: false
+    60%  {-o-transform: translate(-4px, 1px);}// lesshint spaceBeforeBrace: false
+    70%  {-o-transform: translate(-3px, 2px);}// lesshint spaceBeforeBrace: false
+    80%  {-o-transform: translate(-2px, 2px);}// lesshint spaceBeforeBrace: false
+    90%  {-o-transform: translate(-1px, 1px);}// lesshint spaceBeforeBrace: false
+    100% {-o-transform: translate(0, 0px);}// lesshint spaceBeforeBrace: false
+  }
+  @keyframes skid {
+    0%   {transform: translate(0px, 0px);}// lesshint spaceBeforeBrace: false
+    10%  {transform: translate(-1px, -1px);}// lesshint spaceBeforeBrace: false
+    20%  {transform: translate(-2px, -2px);}// lesshint spaceBeforeBrace: false
+    30%  {transform: translate(-3px, -2px);}// lesshint spaceBeforeBrace: false
+    40%  {transform: translate(-4px, -1px);}// lesshint spaceBeforeBrace: false
+    50%  {transform: translate(-5px, 0px);}// lesshint spaceBeforeBrace: false
+    60%  {transform: translate(-4px, 1px);}// lesshint spaceBeforeBrace: false
+    70%  {transform: translate(-3px, 2px);}// lesshint spaceBeforeBrace: false
+    80%  {transform: translate(-2px, 2px);}// lesshint spaceBeforeBrace: false
+    90%  {transform: translate(-1px, 1px);}// lesshint spaceBeforeBrace: false
+    100% {transform: translate(0, 0px);}// lesshint spaceBeforeBrace: false
+  }
+ }
+
+ .fly-fade() {
+  .animation-name(flyfade);
+  .animation-duration(7s);
+  .animation-iteration-count(infinite);
+  .animation-timing-function(linear);
+  @-webkit-keyframes flyfade {
+    0%   {-webkit-transform: translate(0px, 0px); opacity: 0;}// lesshint spaceBeforeBrace: false
+    25%  { opacity: 1;}// lesshint spaceBeforeBrace: false
+    50%  {-webkit-transform: translate(110px, 0px);}// lesshint spaceBeforeBrace: false
+    75%  { opacity: 1;}// lesshint spaceBeforeBrace: false
+    100% {-webkit-transform: translate(220px, 0); opacity: 0;}// lesshint spaceBeforeBrace: false
+  }
+  @-moz-keyframes flyfade {
+    0%   {-moz-transform: translate(0, 0px); opacity: 0;}// lesshint spaceBeforeBrace: false
+    25%  { opacity: 1;}// lesshint spaceBeforeBrace: false
+    50%  {-moz-transform: translate(110px, 0px); opacity: 1;}// lesshint spaceBeforeBrace: false
+    75%  { opacity: 1;}// lesshint spaceBeforeBrace: false
+    100% {-moz-transform: translate(220px, 0); opacity: 0;}// lesshint spaceBeforeBrace: false
+  }
+  @-o-keyframes flyfade {
+    0%   {-o-transform: translate(0, 0px); opacity: 0;}// lesshint spaceBeforeBrace: false
+    25%  { opacity: 1;}// lesshint spaceBeforeBrace: false
+    50%  {-o-transform: translate(110px, 0px); opacity: 1;}// lesshint spaceBeforeBrace: false
+    75%  { opacity: 1;}// lesshint spaceBeforeBrace: false
+    100% {-o-transform: translate(220px, 0); opacity: 0;}// lesshint spaceBeforeBrace: false
+  }
+  @keyframes flyfade {
+    0%   {transform: translate(0, 0px); opacity: 0;}// lesshint spaceBeforeBrace: false
+    25%  { opacity: 1;}// lesshint spaceBeforeBrace: false
+    50%  {transform: translate(110px, 0px); opacity: 1;}// lesshint spaceBeforeBrace: false
+    75%  { opacity: 1;}// lesshint spaceBeforeBrace: false
+    100% {transform: translate(220px, 0); opacity: 0;}// lesshint spaceBeforeBrace: false
+  }
+ }
+
+.bob() {
+  .animation-name(bob);
+  .animation-duration(3.2s);
+  .animation-iteration-count(infinite);
+  .animation-timing-function(ease-in-out);
+  @-webkit-keyframes bob {
+    0%   {-webkit-transform: translate(0px);}// lesshint spaceBeforeBrace: false
+    50%  {-webkit-transform: translatey(-7px);}// lesshint spaceBeforeBrace: false
+    100% {-webkit-transform: translatey(0px);}// lesshint spaceBeforeBrace: false
+  }
+  @-moz-keyframes bob {
+    0%   {-moz-transform: translatey(0px);}// lesshint spaceBeforeBrace: false
+    50%  {-moz-transform: translatey(-7px);}// lesshint spaceBeforeBrace: false
+    100% {-moz-transform: translatey(0px);}// lesshint spaceBeforeBrace: false
+  }
+  @-o-keyframes bob {
+    0%   {-o-transform: translatey(0px);}// lesshint spaceBeforeBrace: false
+    50%  {-o-transform: translatey(-7px);}// lesshint spaceBeforeBrace: false
+    100% {-o-transform: translatey(0px);}// lesshint spaceBeforeBrace: false
+  }
+  @keyframes bob {
+    0%   {transform: translatey(0px);}// lesshint spaceBeforeBrace: false
+    50%  {transform: translatey(-7px);}// lesshint spaceBeforeBrace: false
+    100% {transform: translatey(0px);}// lesshint spaceBeforeBrace: false
+  }
+ }
+
diff --git a/ee/bulk-operations-dashboard/assets/styles/mixins-and-variables/buttons.less b/ee/bulk-operations-dashboard/assets/styles/mixins-and-variables/buttons.less
new file mode 100644
index 0000000000..dbfc1cfef5
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/mixins-and-variables/buttons.less
@@ -0,0 +1,13 @@
+.btn-reset() {
+  border-top: none;
+  border-bottom: none;
+  border-left: none;
+  border-right: none;
+  background: transparent;
+  font-family: inherit;
+  cursor: pointer;
+  &:focus {
+    border-image: none;
+    outline: none;
+  }
+}
diff --git a/ee/bulk-operations-dashboard/assets/styles/mixins-and-variables/colors.less b/ee/bulk-operations-dashboard/assets/styles/mixins-and-variables/colors.less
new file mode 100644
index 0000000000..93b68443e7
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/mixins-and-variables/colors.less
@@ -0,0 +1,17 @@
+/**
+ * Color Variables
+ */
+
+@brand: #14acc2;
+@core-vibrant-blue: #6A67FE;
+@error: #B53A03;
+
+
+@text-normal: #000;
+@text-muted: lighten(@text-normal, 60%);
+
+@bg-lt-gray: #f1f1f1;
+@border-lt-gray: darken(@bg-lt-gray, 5%);
+@accent-lt-gray: darken(#fff, 5%);
+@accent-md-gray: darken(#fff, 25%);
+@accent-white: #fff;
diff --git a/ee/bulk-operations-dashboard/assets/styles/mixins-and-variables/containers.less b/ee/bulk-operations-dashboard/assets/styles/mixins-and-variables/containers.less
new file mode 100644
index 0000000000..39577d35a3
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/mixins-and-variables/containers.less
@@ -0,0 +1,13 @@
+.container-sm() {
+  width: 100%;
+  max-width: 450px;
+  margin-left: auto;
+  margin-right: auto;
+}
+
+.container-md() {
+  width: 100%;
+  max-width: 650px;
+  margin-left: auto;
+  margin-right: auto;
+}
diff --git a/ee/bulk-operations-dashboard/assets/styles/mixins-and-variables/index.less b/ee/bulk-operations-dashboard/assets/styles/mixins-and-variables/index.less
new file mode 100644
index 0000000000..1311e4e811
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/mixins-and-variables/index.less
@@ -0,0 +1,6 @@
+@import 'colors.less';
+@import 'typography.less';
+@import 'buttons.less';
+@import 'animations.less';
+@import 'truncate.less';
+@import 'containers.less';
diff --git a/ee/bulk-operations-dashboard/assets/styles/mixins-and-variables/truncate.less b/ee/bulk-operations-dashboard/assets/styles/mixins-and-variables/truncate.less
new file mode 100644
index 0000000000..38ebeffbdb
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/mixins-and-variables/truncate.less
@@ -0,0 +1,5 @@
+.truncate() {
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
diff --git a/ee/bulk-operations-dashboard/assets/styles/mixins-and-variables/typography.less b/ee/bulk-operations-dashboard/assets/styles/mixins-and-variables/typography.less
new file mode 100644
index 0000000000..b5c8607363
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/mixins-and-variables/typography.less
@@ -0,0 +1,7 @@
+// Font families:
+@main-font: 'Inter', sans-serif;
+@header-font: 'Inter', sans-serif;
+
+// Font weights:
+@bold: 700;
+@normal: 400;
diff --git a/ee/bulk-operations-dashboard/assets/styles/pages/404.less b/ee/bulk-operations-dashboard/assets/styles/pages/404.less
new file mode 100644
index 0000000000..b17ea3ae78
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/pages/404.less
@@ -0,0 +1,5 @@
+[id='404'] {
+
+  //…
+
+}
diff --git a/ee/bulk-operations-dashboard/assets/styles/pages/498.less b/ee/bulk-operations-dashboard/assets/styles/pages/498.less
new file mode 100644
index 0000000000..45b3803777
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/pages/498.less
@@ -0,0 +1,5 @@
+[id='498'] {
+
+  //…
+
+}
diff --git a/ee/bulk-operations-dashboard/assets/styles/pages/500.less b/ee/bulk-operations-dashboard/assets/styles/pages/500.less
new file mode 100644
index 0000000000..19aa03a49e
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/pages/500.less
@@ -0,0 +1,5 @@
+[id='500'] {
+
+  //…
+
+}
diff --git a/ee/bulk-operations-dashboard/assets/styles/pages/account/account-overview.less b/ee/bulk-operations-dashboard/assets/styles/pages/account/account-overview.less
new file mode 100644
index 0000000000..60e82a78c1
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/pages/account/account-overview.less
@@ -0,0 +1,9 @@
+#account-overview {
+
+  [purpose='remove-button'] {
+    color: @brand;
+    &:hover {
+      color: @text-normal;
+    }
+  }
+}
diff --git a/ee/bulk-operations-dashboard/assets/styles/pages/account/edit-password.less b/ee/bulk-operations-dashboard/assets/styles/pages/account/edit-password.less
new file mode 100644
index 0000000000..b456d00846
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/pages/account/edit-password.less
@@ -0,0 +1,5 @@
+#edit-password {
+
+  //…
+
+}
diff --git a/ee/bulk-operations-dashboard/assets/styles/pages/account/edit-profile.less b/ee/bulk-operations-dashboard/assets/styles/pages/account/edit-profile.less
new file mode 100644
index 0000000000..f06f5318a1
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/pages/account/edit-profile.less
@@ -0,0 +1,5 @@
+#edit-profile {
+
+  //…
+
+}
diff --git a/ee/bulk-operations-dashboard/assets/styles/pages/contact.less b/ee/bulk-operations-dashboard/assets/styles/pages/contact.less
new file mode 100644
index 0000000000..488cc71e78
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/pages/contact.less
@@ -0,0 +1,5 @@
+#contact {
+
+  //…
+
+}
diff --git a/ee/bulk-operations-dashboard/assets/styles/pages/dashboard/welcome.less b/ee/bulk-operations-dashboard/assets/styles/pages/dashboard/welcome.less
new file mode 100644
index 0000000000..2bcb3aa09d
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/pages/dashboard/welcome.less
@@ -0,0 +1,5 @@
+#welcome {
+
+  //…
+
+}
diff --git a/ee/bulk-operations-dashboard/assets/styles/pages/entrance/confirmed-email.less b/ee/bulk-operations-dashboard/assets/styles/pages/entrance/confirmed-email.less
new file mode 100644
index 0000000000..ad0858a47d
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/pages/entrance/confirmed-email.less
@@ -0,0 +1,5 @@
+#confirmed-email {
+
+  //…
+
+}
diff --git a/ee/bulk-operations-dashboard/assets/styles/pages/entrance/forgot-password.less b/ee/bulk-operations-dashboard/assets/styles/pages/entrance/forgot-password.less
new file mode 100644
index 0000000000..b3f5364e7e
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/pages/entrance/forgot-password.less
@@ -0,0 +1,5 @@
+#forgot-password {
+
+  //…
+
+}
diff --git a/ee/bulk-operations-dashboard/assets/styles/pages/entrance/login.less b/ee/bulk-operations-dashboard/assets/styles/pages/entrance/login.less
new file mode 100644
index 0000000000..3132144eb2
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/pages/entrance/login.less
@@ -0,0 +1,5 @@
+#login {
+
+  //…
+
+}
diff --git a/ee/bulk-operations-dashboard/assets/styles/pages/entrance/new-password.less b/ee/bulk-operations-dashboard/assets/styles/pages/entrance/new-password.less
new file mode 100644
index 0000000000..984d90cfa3
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/pages/entrance/new-password.less
@@ -0,0 +1,5 @@
+#new-password {
+
+  //…
+
+}
diff --git a/ee/bulk-operations-dashboard/assets/styles/pages/entrance/signup.less b/ee/bulk-operations-dashboard/assets/styles/pages/entrance/signup.less
new file mode 100644
index 0000000000..a0fda1ba25
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/pages/entrance/signup.less
@@ -0,0 +1,5 @@
+#signup {
+
+  //…
+
+}
diff --git a/ee/bulk-operations-dashboard/assets/styles/pages/faq.less b/ee/bulk-operations-dashboard/assets/styles/pages/faq.less
new file mode 100644
index 0000000000..5bd40558bb
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/pages/faq.less
@@ -0,0 +1,11 @@
+#faq {
+
+  @media (max-width: 500px) {
+    code {
+      word-break: break-all;
+    }
+    [purpose='placeholder'] {
+      word-break: break-all;
+    }
+  }
+}
diff --git a/ee/bulk-operations-dashboard/assets/styles/pages/homepage.less b/ee/bulk-operations-dashboard/assets/styles/pages/homepage.less
new file mode 100644
index 0000000000..581bc5c567
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/pages/homepage.less
@@ -0,0 +1,27 @@
+#homepage {
+
+  [purpose='cloud-1'] {
+    .fly-fade();
+    opacity: 0;
+    }
+  [purpose='cloud-2'] {
+    .fly-fade();
+    .animation-delay(3.5s);
+    opacity: 0;
+  }
+  [purpose='ship'] {
+    .skid();
+  }
+  [purpose='more-info-text'] {
+    .bob();
+  }
+  [purpose='setup-step'] {
+    padding-left: 240px;
+  }
+
+  @media (max-width: 991px) {
+    [purpose='setup-step'] {
+      padding-left: 0px;
+    }
+  }
+}
diff --git a/ee/bulk-operations-dashboard/assets/styles/pages/legal/privacy.less b/ee/bulk-operations-dashboard/assets/styles/pages/legal/privacy.less
new file mode 100644
index 0000000000..36db0a8ced
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/pages/legal/privacy.less
@@ -0,0 +1,5 @@
+#privacy {
+
+  //…
+
+}
diff --git a/ee/bulk-operations-dashboard/assets/styles/pages/legal/terms.less b/ee/bulk-operations-dashboard/assets/styles/pages/legal/terms.less
new file mode 100644
index 0000000000..9580dcff76
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/pages/legal/terms.less
@@ -0,0 +1,5 @@
+#terms {
+
+  //…
+
+}
diff --git a/ee/bulk-operations-dashboard/assets/styles/pages/profiles.less b/ee/bulk-operations-dashboard/assets/styles/pages/profiles.less
new file mode 100644
index 0000000000..68e3a3736b
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/pages/profiles.less
@@ -0,0 +1,235 @@
+#profiles {
+
+  [purpose='page-content'] {
+    padding: 24px 32px 64px 32px;
+  }
+  p {
+    margin-block-end: 0px;
+    font-size: 14px;
+    line-height: 150%;
+  }
+  .table td {
+    font-size: 14px;
+    line-height: 150%;
+    a {
+      cursor: pointer;
+      display: block;
+    }
+  }
+  .table thead th {
+    border-top: none;
+    border-bottom: none;
+    border-right: 1px solid #e2e4ea;
+    vertical-align: middle;
+  }
+  th.sortable {
+    cursor: pointer;
+  }
+  .table th, .table td {
+    padding: 0.5rem 1rem;
+    white-space: nowrap;
+  }
+  .table thead {
+    tr:first-child {
+      th {
+        border-top: none;
+        background-color: rgba(0, 43, 128, 0.0235294);
+        border-right: none;
+      }
+      th:first-child {
+        border-top-left-radius: 8px;
+      }
+      th:last-child {
+        border-top-right-radius: 8px;
+      }
+    }
+  }
+  .table tbody {
+    color: #515774;
+    border-radius: 8px;
+    td {
+      max-height: 48px;
+      height: 48px;
+      padding-left: 16px;
+      padding-right: 16px;
+      border-top: 1px solid @border-lt-gray;
+      position: relative;
+    }
+    tr {
+      td:last-child {
+        border-right: none;
+      }
+    }
+    tr:last-child {
+      td:first-child {
+        border-bottom-left-radius: 8px;
+      }
+      td:last-child {
+        border-bottom-right-radius: 8px;
+      }
+    }
+  }
+  .sort-arrows {
+    height: 14px;
+    padding-left: 0.5rem;
+    display: inline-flex;
+    flex-direction: column;
+    justify-content: space-between;
+    span {
+      display: flex;
+      align-items: center;
+      gap: 3px;
+    }
+    .ascending-arrow {
+      width: 0;
+      height: 0;
+      border-left: 5px solid transparent;
+      border-right: 5px solid transparent;
+      border-bottom: 6px solid #c5c7d1;
+    }
+    .descending-arrow {
+      width: 0;
+      height: 0;
+      border-left: 5px solid transparent;
+      border-right: 5px solid transparent;
+      border-top: 6px solid #c5c7d1;
+    }
+  }
+  .ascending .ascending-arrow {
+    border-bottom-color: #6a67fe;
+  }
+  .descending .descending-arrow {
+    border-top-color: #6a67fe;
+  }
+  .table td {
+    white-space: nowrap;
+    vertical-align: middle;
+  }
+
+  .affected-teams-link {
+    // color: #007697;
+    cursor: pointer;
+  }
+  .truncated-affected-teams {
+    color: #007697;
+    cursor: pointer;
+    position: relative;
+    .teams-tooltip {
+      display: none;
+    }
+  }
+  .truncated-affected-teams:hover {
+    text-decoration: underline;
+    .teams-tooltip {
+      z-index: 3;
+      display: flex;
+      flex-direction: column;
+      justify-content: center;
+      align-items: flex-start;
+      padding: 6px;
+      width: 250px;
+      background: #515774;
+      border-radius: 4px;
+      position: absolute;
+      top: 15px;
+      left: -30px;
+      color: #FFF;
+      p {
+        white-space: normal;
+        margin-bottom: 4px;
+        cursor: pointer;
+        color: #FFF;
+        &:hover {
+          text-decoration: underline;
+        }
+      }
+    }
+  }
+  .pointer {
+    cursor: pointer;
+  }
+  [parasails-component='file-upload'] {
+    &.is-invalid {
+      border: 1px solid #dc3545;
+    }
+  }
+  .is-invalid ~ .invalid-feedback {
+    display: block;
+  }
+  [purpose='profile-upload-input'] {
+    display: flex;
+    padding: 32px;
+    flex-direction: column;
+    justify-content: center;
+    align-items: center;
+    gap: 16px;
+    align-self: stretch;
+    border-radius: 4px;
+    border: 1px solid #E2E4EA;
+    background: #F9FAFC;
+  }
+  [purpose='profile-information'] {
+    display: flex;
+    flex-direction: column;
+    justify-content: center;
+    align-items: start;
+    gap: 16px;
+    // align-self: stretch;
+    border-radius: 4px;
+    padding: 16px 24px;
+    height: 72px;
+    border: 1px solid #E2E4EA;
+    background: #F9FAFC;
+    margin-bottom: 24px;
+    img {
+      margin-right: 16px;
+    }
+  }
+  [purpose='teams-picker'] {
+    // display: flex;
+    padding: 16px 24px;
+    // flex-direction: column;
+    // align-items: flex-start;
+    gap: 8px;
+    // align-self: stretch;
+    border-radius: 4px;
+    border: 1px solid #E2E4EA;
+    background: #F9FAFC;
+    margin-bottom: 24px;
+    margin-top: 24px;
+  }
+  // input[type='file'] {
+  //   display: none;
+  // }
+  [purpose='file-upload'] {
+    color: @core-vibrant-blue;
+    display: flex;
+    font-weight: 700;
+    font-size: 14px;
+    line-height: 150%;
+    margin-top: 24px;
+    cursor: pointer;
+    img {
+      margin-right: 8px;
+    }
+  }
+  [purpose='delete-button'] {
+    border-radius: 6px;
+    background: #D66C7B;
+    border-color: #D66C7B;
+    color: #FFF;
+  }
+  [purpose='modal-button'] {
+    border-radius: 6px;
+    background: #6A67FE;
+    color: #FFF;
+    border-color: #6A67FE;
+  }
+  [purpose='modal-buttons'] {
+    [purpose='cancel-button'] {
+      color: @core-vibrant-blue;
+      margin-right: 16px;
+      cursor: pointer;
+    }
+  }
+}
diff --git a/ee/bulk-operations-dashboard/assets/styles/pages/scripts.less b/ee/bulk-operations-dashboard/assets/styles/pages/scripts.less
new file mode 100644
index 0000000000..9ef71d164a
--- /dev/null
+++ b/ee/bulk-operations-dashboard/assets/styles/pages/scripts.less
@@ -0,0 +1,231 @@
+#scripts {
+
+  [purpose='page-content'] {
+    padding: 24px 32px 64px 32px;
+  }
+  p {
+    margin-block-end: 0px;
+    font-size: 14px;
+    line-height: 150%;
+  }
+  .table td {
+    font-size: 14px;
+    line-height: 150%;
+    a {
+      cursor: pointer;
+      display: block;
+    }
+  }
+  .table thead th {
+    border-top: none;
+    border-bottom: none;
+    border-right: 1px solid #e2e4ea;
+    vertical-align: middle;
+  }
+  th.sortable {
+    cursor: pointer;
+  }
+  .table th, .table td {
+    padding: 0.5rem 1rem;
+    white-space: nowrap;
+  }
+  .table thead {
+    tr:first-child {
+      th {
+        border-top: none;
+        background-color: rgba(0, 43, 128, 0.0235294);
+        border-right: none;
+      }
+      th:first-child {
+        border-top-left-radius: 8px;
+      }
+      th:last-child {
+        border-top-right-radius: 8px;
+      }
+    }
+  }
+  .table tbody {
+    color: #515774;
+    border-radius: 8px;
+    td {
+      max-height: 48px;
+      height: 48px;
+      padding-left: 16px;
+      padding-right: 16px;
+      border-top: 1px solid @border-lt-gray;
+      position: relative;
+    }
+    tr {
+      td:last-child {
+        border-right: none;
+      }
+    }
+    tr:last-child {
+      td:first-child {
+        border-bottom-left-radius: 8px;
+      }
+      td:last-child {
+        border-bottom-right-radius: 8px;
+      }
+    }
+  }
+  .sort-arrows {
+    height: 14px;
+    padding-left: 0.5rem;
+    display: inline-flex;
+    flex-direction: column;
+    justify-content: space-between;
+    span {
+      display: flex;
+      align-items: center;
+      gap: 3px;
+    }
+    .ascending-arrow {
+      width: 0;
+      height: 0;
+      border-left: 5px solid transparent;
+      border-right: 5px solid transparent;
+      border-bottom: 6px solid #c5c7d1;
+    }
+    .descending-arrow {
+      width: 0;
+      height: 0;
+      border-left: 5px solid transparent;
+      border-right: 5px solid transparent;
+      border-top: 6px solid #c5c7d1;
+    }
+  }
+  .ascending .ascending-arrow {
+    border-bottom-color: #6a67fe;
+  }
+  .descending .descending-arrow {
+    border-top-color: #6a67fe;
+  }
+  .table td {
+    white-space: nowrap;
+    vertical-align: middle;
+  }
+
+  .affected-teams-link {
+    // color: #007697;
+    cursor: pointer;
+  }
+  .truncated-affected-teams {
+    color: #007697;
+    cursor: pointer;
+    position: relative;
+    .teams-tooltip {
+      display: none;
+    }
+  }
+  .truncated-affected-teams:hover {
+    text-decoration: underline;
+    .teams-tooltip {
+      z-index: 3;
+      display: flex;
+      flex-direction: column;
+      justify-content: center;
+      align-items: flex-start;
+      padding: 6px;
+      width: 250px;
+      background: #515774;
+      border-radius: 4px;
+      position: absolute;
+      top: 15px;
+      left: -30px;
+      color: #FFF;
+      p {
+        white-space: normal;
+        margin-bottom: 4px;
+        cursor: pointer;
+        color: #FFF;
+        &:hover {
+          text-decoration: underline;
+        }
+      }
+    }
+  }
+  .pointer {
+    cursor: pointer;
+  }
+  [purpose='script-upload-input'] {
+    display: flex;
+    padding: 32px;
+    flex-direction: column;
+    justify-content: center;
+    align-items: center;
+    gap: 16px;
+    align-self: stretch;
+    border-radius: 4px;
+    border: 1px solid #E2E4EA;
+    background: #F9FAFC;
+  }
+  [parasails-component='file-upload'] {
+    &.is-invalid {
+      border: 1px solid #dc3545;
+    }
+  }
+  .is-invalid ~ .invalid-feedback {
+    display: block;
+  }
+
+  [purpose='script-information'] {
+    display: flex;
+    flex-direction: column;
+    justify-content: center;
+    align-items: start;
+    gap: 16px;
+    // align-self: stretch;
+    border-radius: 4px;
+    padding: 16px 24px;
+    height: 72px;
+    border: 1px solid #E2E4EA;
+    background: #F9FAFC;
+    margin-bottom: 24px;
+    img {
+      margin-right: 16px;
+    }
+  }
+  [purpose='teams-picker'] {
+    padding: 16px 24px;
+    gap: 8px;
+    border-radius: 4px;
+    border: 1px solid #E2E4EA;
+    background: #F9FAFC;
+    margin-bottom: 24px;
+    &.is-invalid {
+      border: 1px solid #dc3545;
+    }
+  }
+  [purpose='delete-button'] {
+    border-radius: 6px;
+    background: #D66C7B;
+    border-color: #D66C7B;
+    color: #FFF;
+  }
+  [purpose='file-upload'] {
+    color: @core-vibrant-blue;
+    display: flex;
+    font-weight: 700;
+    font-size: 14px;
+    line-height: 150%;
+    margin-top: 24px;
+    cursor: pointer;
+    img {
+      margin-right: 8px;
+    }
+  }
+  [purpose='modal-button'] {
+    border-radius: 6px;
+    background: #6A67FE;
+    color: #FFF;
+    border-color: #6A67FE;
+  }
+  [purpose='modal-buttons'] {
+    [purpose='cancel-button'] {
+      color: @core-vibrant-blue;
+      margin-right: 16px;
+      cursor: pointer;
+    }
+  }
+}
diff --git a/ee/bulk-operations-dashboard/assets/templates/.gitkeep b/ee/bulk-operations-dashboard/assets/templates/.gitkeep
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/ee/bulk-operations-dashboard/config/blueprints.js b/ee/bulk-operations-dashboard/config/blueprints.js
new file mode 100644
index 0000000000..b40598f80c
--- /dev/null
+++ b/ee/bulk-operations-dashboard/config/blueprints.js
@@ -0,0 +1,41 @@
+/**
+ * Blueprint API Configuration
+ * (sails.config.blueprints)
+ *
+ * For background on the blueprint API in Sails, check out:
+ * https://sailsjs.com/docs/reference/blueprint-api
+ *
+ * For details and more available options, see:
+ * https://sailsjs.com/config/blueprints
+ */
+
+module.exports.blueprints = {
+
+  /***************************************************************************
+  *                                                                          *
+  * Automatically expose implicit routes for every action in your app?       *
+  *                                                                          *
+  ***************************************************************************/
+
+  // actions: false,
+
+
+  /***************************************************************************
+  *                                                                          *
+  * Automatically expose RESTful routes for your models?                     *
+  *                                                                          *
+  ***************************************************************************/
+
+  rest: false,
+
+
+  /***************************************************************************
+  *                                                                          *
+  * Automatically expose CRUD "shortcut" routes to GET requests?             *
+  * (These are enabled by default in development only.)                      *
+  *                                                                          *
+  ***************************************************************************/
+
+  shortcuts: false,
+
+};
diff --git a/ee/bulk-operations-dashboard/config/bootstrap.js b/ee/bulk-operations-dashboard/config/bootstrap.js
new file mode 100644
index 0000000000..a43866b34a
--- /dev/null
+++ b/ee/bulk-operations-dashboard/config/bootstrap.js
@@ -0,0 +1,79 @@
+/**
+ * Seed Function
+ * (sails.config.bootstrap)
+ *
+ * A function that runs just before your Sails app gets lifted.
+ * > Need more flexibility?  You can also create a hook.
+ *
+ * For more information on seeding your app with fake data, check out:
+ * https://sailsjs.com/config/bootstrap
+ */
+
+module.exports.bootstrap = async function() {
+
+  // Import dependencies
+  var path = require('path');
+
+  // This bootstrap version indicates what version of fake data we're dealing with here.
+  var HARD_CODED_DATA_VERSION = 0;
+
+  // This path indicates where to store/look for the JSON file that tracks the "last run bootstrap info"
+  // locally on this development computer (if we happen to be on a development computer).
+  var bootstrapLastRunInfoPath = path.resolve(sails.config.appPath, '.tmp/bootstrap-version.json');
+
+  // Whether or not to continue doing the stuff in this file (i.e. wiping and regenerating data)
+  // depends on some factors:
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+  // If the hard-coded data version has been incremented, or we're being forced
+  // (i.e. `--drop` or `--environment=test` was set), then run the meat of this
+  // bootstrap script to wipe all existing data and rebuild hard-coded data.
+  if (sails.config.models.migrate !== 'drop' && sails.config.environment !== 'test') {
+    // If this is _actually_ a production environment (real or simulated), or we have
+    // `migrate: safe` enabled, then prevent accidentally removing all data!
+    if (process.env.NODE_ENV==='production' || sails.config.models.migrate === 'safe') {
+      sails.log('Since we are running with migrate: \'safe\' and/or NODE_ENV=production (in the "'+sails.config.environment+'" Sails environment, to be precise), skipping the rest of the bootstrap to avoid data loss...');
+      return;
+    }//•
+
+    // Compare bootstrap version from code base to the version that was last run
+    var lastRunBootstrapInfo = await sails.helpers.fs.readJson(bootstrapLastRunInfoPath)
+    .tolerate('doesNotExist');// (it's ok if the file doesn't exist yet-- just keep going.)
+
+    if (lastRunBootstrapInfo && lastRunBootstrapInfo.lastRunVersion === HARD_CODED_DATA_VERSION) {
+      sails.log('Skipping v'+HARD_CODED_DATA_VERSION+' bootstrap script...  (because it\'s already been run)');
+      sails.log('(last run on this computer: @ '+(new Date(lastRunBootstrapInfo.lastRunAt))+')');
+      return;
+    }//•
+
+    sails.log('Running v'+HARD_CODED_DATA_VERSION+' bootstrap script...  ('+(lastRunBootstrapInfo ? 'before this, the last time the bootstrap ran on this computer was for v'+lastRunBootstrapInfo.lastRunVersion+' @ '+(new Date(lastRunBootstrapInfo.lastRunAt)) : 'looks like this is the first time the bootstrap has run on this computer')+')');
+  }
+  else {
+    sails.log('Running bootstrap script because it was forced...  (either `--drop` or `--environment=test` was used)');
+  }
+
+  // Since the hard-coded data version has been incremented, and we're running in
+  // a "throwaway data" environment, delete all records from all models.
+  for (let identity in sails.models) {
+    await sails.models[identity].destroy({});
+  }//∞
+
+  // By convention, this is a good place to set up fake data during development.
+  await User.createEach([
+    { emailAddress: 'admin@example.com', fullName: 'Ryan Dahl', isSuperAdmin: true, password: await sails.helpers.passwords.hashPassword('abc123') },
+  ]);
+
+  // Save new bootstrap version
+  await sails.helpers.fs.writeJson.with({
+    destination: bootstrapLastRunInfoPath,
+    json: {
+      lastRunVersion: HARD_CODED_DATA_VERSION,
+      lastRunAt: Date.now()
+    },
+    force: true
+  })
+  .tolerate((err)=>{
+    sails.log.warn('For some reason, could not write bootstrap version .json file.  This could be a result of a problem with your configured paths, or, if you are in production, a limitation of your hosting provider related to `pwd`.  As a workaround, try updating app.js to explicitly pass in `appPath: __dirname` instead of relying on `chdir`.  Current sails.config.appPath: `'+sails.config.appPath+'`.  Full error details: '+err.stack+'\n\n(Proceeding anyway this time...)');
+  });
+
+};
diff --git a/ee/bulk-operations-dashboard/config/custom.js b/ee/bulk-operations-dashboard/config/custom.js
new file mode 100644
index 0000000000..a33b5d98cc
--- /dev/null
+++ b/ee/bulk-operations-dashboard/config/custom.js
@@ -0,0 +1,110 @@
+/**
+ * Custom configuration
+ * (sails.config.custom)
+ *
+ * One-off settings specific to your application.
+ *
+ * For more information on custom configuration, visit:
+ * https://sailsjs.com/config/custom
+ */
+
+module.exports.custom = {
+
+  /**************************************************************************
+  *                                                                         *
+  * The base URL to use during development.                                 *
+  *                                                                         *
+  * • No trailing slash at the end                                          *
+  * • `http://` or `https://` at the beginning.                             *
+  *                                                                         *
+  * > This is for use in custom logic that builds URLs.                     *
+  * > It is particularly handy for building dynamic links in emails,        *
+  * > but it can also be used for user-uploaded images, webhooks, etc.      *
+  *                                                                         *
+  **************************************************************************/
+  baseUrl: 'http://localhost:1337',
+
+  /**************************************************************************
+  *                                                                         *
+  * Display dates for your app                                              *
+  *                                                                         *
+  * > This is here to make it easier to change out the copyright date       *
+  * > that is displayed all over the app when it's first generated.         *
+  *                                                                         *
+  **************************************************************************/
+  platformCopyrightYear: '2024',
+
+  /**************************************************************************
+  *                                                                         *
+  * The TTL (time-to-live) for various sorts of tokens before they expire.  *
+  *                                                                         *
+  **************************************************************************/
+  passwordResetTokenTTL: 24*60*60*1000,// 24 hours
+  emailProofTokenTTL:    24*60*60*1000,// 24 hours
+
+  /**************************************************************************
+  *                                                                         *
+  * The extended length that browsers should retain the session cookie      *
+  * if "Remember Me" was checked while logging in.                          *
+  *                                                                         *
+  **************************************************************************/
+  rememberMeCookieMaxAge: 30*24*60*60*1000, // 30 days
+
+  /**************************************************************************
+  *                                                                         *
+  * Automated email configuration                                           *
+  *                                                                         *
+  * Sandbox Sendgrid credentials for use during development, as well as any *
+  * other default settings related to "how" and "where" automated emails    *
+  * are sent.                                                               *
+  *                                                                         *
+  * (https://app.sendgrid.com/settings/api_keys)                            *
+  *                                                                         *
+  **************************************************************************/
+  // sendgridSecret: 'SG.fake.3e0Bn0qSQVnwb1E4qNPz9JZP5vLZYqjh7sn8S93oSHU',
+  //--------------------------------------------------------------------------
+  // /\  Configure this to enable support for automated emails.
+  // ||  (Important for password recovery, verification, contact form, etc.)
+  //--------------------------------------------------------------------------
+
+  // The sender that all outgoing emails will appear to come from.
+  fromEmailAddress: 'noreply@example.com',
+  fromName: 'The NEW_APP_NAME Team',
+
+  // Email address for receiving support messages & other correspondences.
+  // > If you're using the default privacy policy, this will be referenced
+  // > as the contact email of your "data protection officer" for the purpose
+  // > of compliance with regulations such as GDPR.
+  internalEmailAddress: 'support+development@example.com',
+
+  // Whether to require proof of email address ownership any time a new user
+  // signs up, or when an existing user attempts to change their email address.
+  verifyEmailAddresses: false,
+
+  /**************************************************************************
+  *                                                                         *
+  * Billing & payments configuration                                        *
+  *                                                                         *
+  * (https://dashboard.stripe.com/account/apikeys)                          *
+  *                                                                         *
+  **************************************************************************/
+  // stripePublishableKey: 'pk_test_Zzd814nldl91104qor5911gjald',
+  // stripeSecret: 'sk_test_Zzd814nldl91104qor5911gjald',
+  //--------------------------------------------------------------------------
+  // /\  Configure these to enable support for billing features.
+  // ||  (Or if you don't need billing, feel free to remove them.)
+  //--------------------------------------------------------------------------
+
+  /***************************************************************************
+  *                                                                          *
+  * Any other custom config this Sails app should use during development.    *
+  *                                                                          *
+  ***************************************************************************/
+  // The base URL of your Fleet instance.
+  fleetBaseUrl: 'https://dogfood.fleetdm.com',
+
+  // The API token of a Fleet API-only user for your Fleet instance.
+  // [?] Here's how you get one: https://fleetdm.com/docs/using-fleet/fleetctl-cli#get-the-api-token-of-an-api-only-user
+  // fleetApiToken: 'asdfasdfasdfasdf',
+
+};
diff --git a/ee/bulk-operations-dashboard/config/datastores.js b/ee/bulk-operations-dashboard/config/datastores.js
new file mode 100644
index 0000000000..3853184314
--- /dev/null
+++ b/ee/bulk-operations-dashboard/config/datastores.js
@@ -0,0 +1,57 @@
+/**
+ * Datastores
+ * (sails.config.datastores)
+ *
+ * A set of datastore configurations which tell Sails where to fetch or save
+ * data when you execute built-in model methods like `.find()` and `.create()`.
+ *
+ *  > This file is mainly useful for configuring your development database,
+ *  > as well as any additional one-off databases used by individual models.
+ *  > Ready to go live?  Head towards `config/env/production.js`.
+ *
+ * For more information on configuring datastores, check out:
+ * https://sailsjs.com/config/datastores
+ */
+
+module.exports.datastores = {
+
+
+  /***************************************************************************
+  *                                                                          *
+  * Your app's default datastore.                                            *
+  *                                                                          *
+  * Sails apps read and write to local disk by default, using a built-in     *
+  * database adapter called `sails-disk`.  This feature is purely for        *
+  * convenience during development; since `sails-disk` is not designed for   *
+  * use in a production environment.                                         *
+  *                                                                          *
+  * To use a different db _in development_, follow the directions below.     *
+  * Otherwise, just leave the default datastore as-is, with no `adapter`.    *
+  *                                                                          *
+  * (For production configuration, see `config/env/production.js`.)          *
+  *                                                                          *
+  ***************************************************************************/
+
+  default: {
+
+    /***************************************************************************
+    *                                                                          *
+    * Want to use a different database during development?                     *
+    *                                                                          *
+    * 1. Choose an adapter:                                                    *
+    *    https://sailsjs.com/plugins/databases                                 *
+    *                                                                          *
+    * 2. Install it as a dependency of your Sails app.                         *
+    *    (For example:  npm install sails-mysql --save)                        *
+    *                                                                          *
+    * 3. Then pass it in, along with a connection URL.                         *
+    *    (See https://sailsjs.com/config/datastores for help.)                 *
+    *                                                                          *
+    ***************************************************************************/
+    // adapter: 'sails-mysql',
+    // url: 'mysql://user:password@host:port/database',
+
+  },
+
+
+};
diff --git a/ee/bulk-operations-dashboard/config/env/production.js b/ee/bulk-operations-dashboard/config/env/production.js
new file mode 100644
index 0000000000..8d28a4d013
--- /dev/null
+++ b/ee/bulk-operations-dashboard/config/env/production.js
@@ -0,0 +1,419 @@
+/**
+ * Production environment settings
+ * (sails.config.*)
+ *
+ * What you see below is a quick outline of the built-in settings you need
+ * to configure your Sails app for production.  The configuration in this file
+ * is only used in your production environment, i.e. when you lift your app using:
+ *
+ * ```
+ * NODE_ENV=production node app
+ * ```
+ *
+ * > If you're using git as a version control solution for your Sails app,
+ * > this file WILL BE COMMITTED to your repository by default, unless you add
+ * > it to your .gitignore file.  If your repository will be publicly viewable,
+ * > don't add private/sensitive data (like API secrets / db passwords) to this file!
+ *
+ * For more best practices and tips, see:
+ * https://sailsjs.com/docs/concepts/deployment
+ */
+
+module.exports = {
+
+
+  /**************************************************************************
+  *                                                                         *
+  * Tell Sails what database(s) it should use in production.                *
+  *                                                                         *
+  * (https://sailsjs.com/config/datastores)                                 *
+  *                                                                         *
+  **************************************************************************/
+  datastores: {
+
+    /***************************************************************************
+    *                                                                          *
+    * Configure your default production database.                              *
+    *                                                                          *
+    * 1. Choose an adapter:                                                    *
+    *    https://sailsjs.com/plugins/databases                                 *
+    *                                                                          *
+    * 2. Install it as a dependency of your Sails app.                         *
+    *    (For example:  npm install sails-mysql --save)                        *
+    *                                                                          *
+    * 3. Then set it here (`adapter`), along with a connection URL (`url`)     *
+    *    and any other, adapter-specific customizations.                       *
+    *    (See https://sailsjs.com/config/datastores for help.)                 *
+    *                                                                          *
+    ***************************************************************************/
+    default: {
+      adapter: 'sails-postgresql',
+      url: process.env.DATABASE_URL,
+      ssl: {
+        sslmode: 'require',
+        rejectUnauthorized: false,
+      }
+      //--------------------------------------------------------------------------
+      //  /\   To avoid checking it in to version control, you might opt to set
+      //  ||   sensitive credentials like `url` using an environment variable.
+      //
+      //  For example:
+      //  ```
+      //  sails_datastores__default__url=mysql://admin:myc00lpAssw2D@db.example.com:3306/my_prod_db
+      //  ```
+      //--------------------------------------------------------------------------
+
+      /****************************************************************************
+      *                                                                           *
+      * More adapter-specific options                                             *
+      *                                                                           *
+      * > For example, for some hosted PostgreSQL providers (like Heroku), the    *
+      * > extra `ssl` object with a `rejectUnauthorized` option must be provided. *
+      *                                                                           *
+      * More info:                                                                *
+      * https://sailsjs.com/config/datastores                                     *
+      *                                                                           *
+      ****************************************************************************/
+      // ssl: { rejectUnauthorized: true },
+
+    },
+
+  },
+
+
+
+  models: {
+
+    /***************************************************************************
+    *                                                                          *
+    * To help avoid accidents, Sails automatically sets the automigration      *
+    * strategy to "safe" when your app lifts in production mode.               *
+    * (This is just here as a reminder.)                                       *
+    *                                                                          *
+    * More info:                                                               *
+    * https://sailsjs.com/docs/concepts/models-and-orm/model-settings#?migrate *
+    *                                                                          *
+    ***************************************************************************/
+    migrate: 'safe',
+
+    /***************************************************************************
+    *                                                                          *
+    * If, in production, this app has access to physical-layer CASCADE         *
+    * constraints (e.g. PostgreSQL or MySQL), then set those up in the         *
+    * database and uncomment this to disable Waterline's `cascadeOnDestroy`    *
+    * polyfill.  (Otherwise, if you are using a databse like Mongo, you might  *
+    * choose to keep this enabled.)                                            *
+    *                                                                          *
+    ***************************************************************************/
+    // cascadeOnDestroy: false,
+
+  },
+
+
+
+  /**************************************************************************
+  *                                                                         *
+  * Always disable "shortcut" blueprint routes.                             *
+  *                                                                         *
+  * > You'll also want to disable any other blueprint routes if you are not *
+  * > actually using them (e.g. "actions" and "rest") -- but you can do     *
+  * > that in `config/blueprints.js`, since you'll want to disable them in  *
+  * > all environments (not just in production.)                            *
+  *                                                                         *
+  ***************************************************************************/
+  blueprints: {
+    shortcuts: false,
+  },
+
+
+
+  /***************************************************************************
+  *                                                                          *
+  * Configure your security settings for production.                         *
+  *                                                                          *
+  * IMPORTANT:                                                               *
+  * If web browsers will be communicating with your app, be sure that        *
+  * you have CSRF protection enabled.  To do that, set `csrf: true` over     *
+  * in the `config/security.js` file (not here), so that CSRF app can be     *
+  * tested with CSRF protection turned on in development mode too.           *
+  *                                                                          *
+  ***************************************************************************/
+  security: {
+
+    /***************************************************************************
+    *                                                                          *
+    * If this app has CORS enabled (see `config/security.js`) with the         *
+    * `allowCredentials` setting enabled, then you should uncomment the        *
+    * `allowOrigins` whitelist below.  This sets which "origins" are allowed   *
+    * to send cross-domain (CORS) requests to your Sails app.                  *
+    *                                                                          *
+    * > Replace "https://example.com" with the URL of your production server.  *
+    * > Be sure to use the right protocol!  ("http://" vs. "https://")         *
+    *                                                                          *
+    ***************************************************************************/
+    cors: {
+      // allowOrigins: [
+      //   'https://example.com',
+      // ]
+    },
+
+  },
+
+
+
+  /***************************************************************************
+  *                                                                          *
+  * Configure how your app handles sessions in production.                   *
+  *                                                                          *
+  * (https://sailsjs.com/config/session)                                     *
+  *                                                                          *
+  * > If you have disabled the "session" hook, then you can safely remove    *
+  * > this section from your `config/env/production.js` file.                *
+  *                                                                          *
+  ***************************************************************************/
+  session: {
+
+    /***************************************************************************
+    *                                                                          *
+    * Production session store configuration.                                  *
+    *                                                                          *
+    * Uncomment the following lines to finish setting up a package called      *
+    * "@sailshq/connect-redis" that will use Redis to handle session data.     *
+    * This makes your app more scalable by allowing you to share sessions      *
+    * across a cluster of multiple Sails/Node.js servers and/or processes.     *
+    * (See http://bit.ly/redis-session-config for more info.)                  *
+    *                                                                          *
+    * > While @sailshq/connect-redis is a popular choice for Sails apps, many  *
+    * > other compatible packages (like "connect-mongo") are available on NPM. *
+    * > (For a full list, see https://sailsjs.com/plugins/sessions)            *
+    *                                                                          *
+    ***************************************************************************/
+    adapter: '@sailshq/connect-redis',
+    url: process.env.REDIS_TLS_URL,
+    tls: {
+      rejectUnauthorized: false
+    },
+    //--------------------------------------------------------------------------
+    // /\   OR, to avoid checking it in to version control, you might opt to
+    // ||   set sensitive credentials like this using an environment variable.
+    //
+    // For example:
+    // ```
+    // sails_session__url=redis://admin:myc00lpAssw2D@bigsquid.redistogo.com:9562/0
+    // ```
+    //
+    //--------------------------------------------------------------------------
+
+    /***************************************************************************
+    *                                                                          *
+    * Production configuration for the session ID cookie name.                 *
+    *                                                                          *
+    * We reccomend prefixing your session cookie with `__Host-`, this limits   *
+    * the scope of your cookie to a single origin to protect against same-site *
+    * attacks.                                                                 *
+    *                                                                          *
+    * Note that with the `__Host-` prefix, session cookies will _not_ be sent  *
+    * unless `sails.config.cookie.secure` is set to `true`.                    *
+    *                                                                          *
+    * Read more:                                                               *
+    * https://sailsjs.com/config/session#?the-session-id-cookie                *
+    *                                                                          *
+    ***************************************************************************/
+    // name: '__Host-sails.sid',
+
+    /***************************************************************************
+    *                                                                          *
+    * Production configuration for the session ID cookie.                      *
+    *                                                                          *
+    * Tell browsers (or other user agents) to ensure that session ID cookies   *
+    * are always transmitted via HTTPS, and that they expire 24 hours after    *
+    * they are set.                                                            *
+    *                                                                          *
+    * Note that with `secure: true` set, session cookies will _not_ be         *
+    * transmitted over unsecured (HTTP) connections. Also, for apps behind     *
+    * proxies (like Heroku), the `trustProxy` setting under `http` must be     *
+    * configured in order for `secure: true` to work.                          *
+    *                                                                          *
+    * > While you might want to increase or decrease the `maxAge` or provide   *
+    * > other options, you should always set `secure: true` in production      *
+    * > if the app is being served over HTTPS.                                 *
+    *                                                                          *
+    * Read more:                                                               *
+    * https://sailsjs.com/config/session#?the-session-id-cookie                *
+    *                                                                          *
+    ***************************************************************************/
+    cookie: {
+      // secure: true,
+      maxAge: 24 * 60 * 60 * 1000,  // 24 hours
+    },
+
+  },
+
+
+
+  /**************************************************************************
+  *                                                                          *
+  * Set up Socket.io for your production environment.                        *
+  *                                                                          *
+  * (https://sailsjs.com/config/sockets)                                     *
+  *                                                                          *
+  * > If you have disabled the "sockets" hook, then you can safely remove    *
+  * > this section from your `config/env/production.js` file.                *
+  *                                                                          *
+  ***************************************************************************/
+  sockets: {
+
+    /***************************************************************************
+    *                                                                          *
+    * Uncomment the `onlyAllowOrigins` whitelist below to configure which      *
+    * "origins" are allowed to open socket connections to your Sails app.      *
+    *                                                                          *
+    * > Replace "https://example.com" etc. with the URL(s) of your app.        *
+    * > Be sure to use the right protocol!  ("http://" vs. "https://")         *
+    *                                                                          *
+    ***************************************************************************/
+    // onlyAllowOrigins: [
+    //   'https://example.com',
+    //   'https://staging.example.com',
+    // ],
+
+
+    /***************************************************************************
+    *                                                                          *
+    * If you are deploying a cluster of multiple servers and/or processes,     *
+    * then uncomment the following lines.  This tells Socket.io about a Redis  *
+    * server it can use to help it deliver broadcasted socket messages.        *
+    *                                                                          *
+    * > Be sure a compatible version of @sailshq/socket.io-redis is installed! *
+    * > (See https://sailsjs.com/config/sockets for the latest version info)   *
+    *                                                                          *
+    * (https://sailsjs.com/docs/concepts/deployment/scaling)                   *
+    *                                                                          *
+    ***************************************************************************/
+    // adapter: '@sailshq/socket.io-redis',
+    // url: 'redis://user:password@bigsquid.redistogo.com:9562/databasenumber',
+    //--------------------------------------------------------------------------
+    // /\   OR, to avoid checking it in to version control, you might opt to
+    // ||   set sensitive credentials like this using an environment variable.
+    //
+    // For example:
+    // ```
+    // sails_sockets__url=redis://admin:myc00lpAssw2D@bigsquid.redistogo.com:9562/0
+    // ```
+    //--------------------------------------------------------------------------
+
+  },
+
+
+
+  /**************************************************************************
+  *                                                                         *
+  * Set the production log level.                                           *
+  *                                                                         *
+  * (https://sailsjs.com/config/log)                                        *
+  *                                                                         *
+  ***************************************************************************/
+  log: {
+    level: 'debug'
+  },
+
+
+
+  http: {
+
+    /***************************************************************************
+    *                                                                          *
+    * The number of milliseconds to cache static assets in production.         *
+    * (the "max-age" to include in the "Cache-Control" response header)        *
+    *                                                                          *
+    * If you are caching assets with a tool like Cloudflare, you may want to   *
+    * reduce this considerably to allow more flexibility in purging the cache. *
+    *                                                                          *
+    ***************************************************************************/
+    cache: 365.25 * 24 * 60 * 60 * 1000, // One year
+
+    /***************************************************************************
+    *                                                                          *
+    * Proxy settings                                                           *
+    *                                                                          *
+    * If your app will be deployed behind a proxy/load balancer - for example, *
+    * on a PaaS like Heroku - then uncomment the `trustProxy` setting below.   *
+    * This tells Sails/Express how to interpret X-Forwarded headers.           *
+    *                                                                          *
+    * This setting is especially important if you are using secure cookies     *
+    * (see the `cookies: secure` setting under `session` above) or if your app *
+    * relies on knowing the original IP address that a request came from.      *
+    *                                                                          *
+    * (https://sailsjs.com/config/http)                                        *
+    *                                                                          *
+    ***************************************************************************/
+    // trustProxy: true,
+
+  },
+
+
+
+  /**************************************************************************
+  *                                                                         *
+  * Lift the server on port 80.                                             *
+  * (if deploying behind a proxy, or to a PaaS like Heroku or Deis, you     *
+  * probably don't need to set a port here, because it is oftentimes        *
+  * handled for you automatically.  If you are not sure if you need to set  *
+  * this, just try deploying without setting it and see if it works.)       *
+  *                                                                         *
+  ***************************************************************************/
+  // port: 80,
+
+
+
+  /**************************************************************************
+  *                                                                         *
+  * Configure an SSL certificate                                            *
+  *                                                                         *
+  * For the safety of your users' data, you should use SSL in production.   *
+  * ...But in many cases, you may not actually want to set it up _here_.    *
+  *                                                                         *
+  * Normally, this setting is only relevant when running a single-process   *
+  * deployment, with no proxy/load balancer in the mix.  But if, on the     *
+  * other hand, you are using a PaaS like Heroku, you'll want to set up     *
+  * SSL in your load balancer settings (usually somewhere in your hosting   *
+  * provider's dashboard-- not here.)                                       *
+  *                                                                         *
+  * > For more information about configuring SSL in Sails, see:             *
+  * > https://sailsjs.com/config/*#?sailsconfigssl                          *
+  *                                                                         *
+  **************************************************************************/
+  // ssl: undefined,
+
+
+
+  /**************************************************************************
+  *                                                                         *
+  * Production overrides for any custom settings specific to your app.      *
+  * (for example, production credentials for 3rd party APIs like Stripe)    *
+  *                                                                         *
+  * > See config/custom.js for more info on how to configure these options. *
+  *                                                                         *
+  ***************************************************************************/
+  custom: {
+    baseUrl: 'https://example.com',
+    internalEmailAddress: 'support@example.com',
+
+    // sendgridSecret: 'SG.fake.3e0Bn0qSQVnwb1E4qNPz9JZP5vLZYqjh7sn8S93oSHU',
+    // stripeSecret: 'sk_prod__fake_Nfgh82401348jaDa3lkZ0d9Hm',
+    //--------------------------------------------------------------------------
+    // /\   OR, to avoid checking them in to version control, you might opt to
+    // ||   set sensitive credentials like these using environment variables.
+    //
+    // For example:
+    // ```
+    // sendgridSecret=SG.fake.3e0Bn0qSQVnwb1E4qNPz9JZP5vLZYqjh7sn8S93oSHU
+    // sails_custom__stripeSecret=sk_prod__fake_Nfgh82401348jaDa3lkZ0d9Hm
+    // ```
+    //--------------------------------------------------------------------------
+
+  },
+
+
+
+};
diff --git a/ee/bulk-operations-dashboard/config/env/staging.js b/ee/bulk-operations-dashboard/config/env/staging.js
new file mode 100644
index 0000000000..226bdbe314
--- /dev/null
+++ b/ee/bulk-operations-dashboard/config/env/staging.js
@@ -0,0 +1,96 @@
+/**
+ * Staging environment settings
+ * (sails.config.*)
+ *
+ * This is mostly a carbon copy of the production environment settings
+ * in config/env/production.js, but with the overrides listed below.
+ * For more detailed information and links about what these settings do
+ * see the production config file.
+ *
+ * > This file takes effect when `sails.config.environment` is "staging".
+ * > But note that NODE_ENV should still be "production" when lifting
+ * > your app in the staging environment.  In other words:
+ * > ```
+ * >     NODE_ENV=production sails_environment=staging node app
+ * > ```
+ *
+ * If you're unsure or want advice, stop by:
+ * https://sailsjs.com/support
+ */
+
+var PRODUCTION_CONFIG = require('./production');
+//--------------------------------------------------------------------------
+// /\  Start with your production config, even if it's just a guess for now,
+// ||  then configure your staging environment afterwards.
+//     (That way, all you need to do in this file is set overrides.)
+//--------------------------------------------------------------------------
+
+module.exports = Object.assign({}, PRODUCTION_CONFIG, {
+
+  datastores: Object.assign({}, PRODUCTION_CONFIG.datastores, {
+    default: Object.assign({}, PRODUCTION_CONFIG.datastores.default, {
+      // url: 'mysql://shared:some_password_everyone_knows@db.example.com:3306/my_staging_db',
+      //--------------------------------------------------------------------------
+      // /\  Hard-code your staging db `url`.
+      // ||  (or use system env var: `sails_datastores__default__url`)
+      //--------------------------------------------------------------------------
+    })
+  }),
+
+  sockets: Object.assign({}, PRODUCTION_CONFIG.sockets, {
+
+    onlyAllowOrigins: [
+      'http://localhost:1337',
+      // 'https://example-staging.herokuapp.com',
+      // 'http://example-staging.herokuapp.com',
+      // 'https://staging.example.com',
+      // 'http://staging.example.com',
+    ],
+    //--------------------------------------------------------------------------
+    // /\  Hard-code a staging-only override for allowed origins.
+    // ||  (or set this array via JSON-encoded system env var)
+    //     ```
+    //     sails_sockets__onlyAllowOrigins='["http://localhost:1337", "…"]'
+    //     ```
+    //--------------------------------------------------------------------------
+
+    // url: 'redis://shared:some_password_everyone_knows@bigsquid.redistogo.com:9562/',
+    //--------------------------------------------------------------------------
+    // /\  Hard-code your staging Redis server's `url`.
+    // ||  (or use system env var: `sails_sockets__url`)
+    //--------------------------------------------------------------------------
+  }),
+
+  session: Object.assign({}, PRODUCTION_CONFIG.session, {
+    // url: 'redis://shared:some_password_everyone_knows@bigsquid.redistogo.com:9562/staging-sessions',
+    //--------------------------------------------------------------------------
+    // /\  Hard-code your staging Redis server's `url` again here.
+    // ||  (or use system env var: `sails_session__url`)
+    //--------------------------------------------------------------------------
+  }),
+
+  custom: Object.assign({}, PRODUCTION_CONFIG.custom, {
+
+    baseUrl: 'https://staging.example.com',
+    //--------------------------------------------------------------------------
+    // /\  Hard-code the base URL where your staging environment is hosted.
+    // ||  (or use system env var: `sails_custom__baseUrl`)
+    //--------------------------------------------------------------------------
+
+    internalEmailAddress: 'support+staging@example.com',
+    //--------------------------------------------------------------------------
+    // /\  Hard-code the email address that should receive support/contact form
+    // ||  messages in staging (or use `sails_custom__internalEmailAddress`)
+    //--------------------------------------------------------------------------
+
+    // sendgridSecret: 'SG.fake.3e0Bn0qSQVnwb1E4qNPz9JZP5vLZYqjh7sn8S93oSHU',
+    // stripeSecret: 'sk_sandbox__fake_Nfgh82401348jaDa3lkZ0d9Hm',
+    // stripePublishableKey: 'pk_sandbox__fake_fKd3mZJs1mlYrzWt7JQtkcRb',
+    //--------------------------------------------------------------------------
+    // /\  Hard-code credentials to use in staging for other 3rd party APIs, etc.
+    // ||  (or use system environment variables prefixed with "sails_custom__")
+    //--------------------------------------------------------------------------
+
+  })
+
+});
diff --git a/ee/bulk-operations-dashboard/config/globals.js b/ee/bulk-operations-dashboard/config/globals.js
new file mode 100644
index 0000000000..f63701f9af
--- /dev/null
+++ b/ee/bulk-operations-dashboard/config/globals.js
@@ -0,0 +1,52 @@
+/**
+ * Global Variable Configuration
+ * (sails.config.globals)
+ *
+ * Configure which global variables which will be exposed
+ * automatically by Sails.
+ *
+ * For more information on any of these options, check out:
+ * https://sailsjs.com/config/globals
+ */
+
+module.exports.globals = {
+
+  /****************************************************************************
+  *                                                                           *
+  * Whether to expose the locally-installed Lodash as a global variable       *
+  * (`_`), making  it accessible throughout your app.                         *
+  *                                                                           *
+  ****************************************************************************/
+
+  _: require('@sailshq/lodash'),
+
+  /****************************************************************************
+  *                                                                           *
+  * This app was generated without a dependency on the "async" NPM package.   *
+  *                                                                           *
+  * > Don't worry!  This is totally unrelated to JavaScript's "async/await".  *
+  * > Your code can (and probably should) use `await` as much as possible.    *
+  *                                                                           *
+  ****************************************************************************/
+
+  async: false,
+
+  /****************************************************************************
+  *                                                                           *
+  * Whether to expose each of your app's models as global variables.          *
+  * (See the link at the top of this file for more information.)              *
+  *                                                                           *
+  ****************************************************************************/
+
+  models: true,
+
+  /****************************************************************************
+  *                                                                           *
+  * Whether to expose the Sails app instance as a global variable (`sails`),  *
+  * making it accessible throughout your app.                                 *
+  *                                                                           *
+  ****************************************************************************/
+
+  sails: true,
+
+};
diff --git a/ee/bulk-operations-dashboard/config/http.js b/ee/bulk-operations-dashboard/config/http.js
new file mode 100644
index 0000000000..3cf438f1ff
--- /dev/null
+++ b/ee/bulk-operations-dashboard/config/http.js
@@ -0,0 +1,60 @@
+/**
+ * HTTP Server Settings
+ * (sails.config.http)
+ *
+ * Configuration for the underlying HTTP server in Sails.
+ * (for additional recommended settings, see `config/env/production.js`)
+ *
+ * For more information on configuration, check out:
+ * https://sailsjs.com/config/http
+ */
+
+module.exports.http = {
+
+  /****************************************************************************
+  *                                                                           *
+  * Sails/Express middleware to run for every HTTP request.                   *
+  * (Only applies to HTTP requests -- not virtual WebSocket requests.)        *
+  *                                                                           *
+  * https://sailsjs.com/documentation/concepts/middleware                     *
+  *                                                                           *
+  ****************************************************************************/
+
+  middleware: {
+
+    /***************************************************************************
+    *                                                                          *
+    * The order in which middleware should be run for HTTP requests.           *
+    * (This Sails app's routes are handled by the "router" middleware below.)  *
+    *                                                                          *
+    ***************************************************************************/
+
+    // order: [
+    //   'cookieParser',
+    //   'session',
+    //   'bodyParser',
+    //   'compress',
+    //   'poweredBy',
+    //   'router',
+    //   'www',
+    //   'favicon',
+    // ],
+
+
+    /***************************************************************************
+    *                                                                          *
+    * The body parser that will handle incoming multipart HTTP requests.       *
+    *                                                                          *
+    * https://sailsjs.com/config/http#?customizing-the-body-parser             *
+    *                                                                          *
+    ***************************************************************************/
+
+    // bodyParser: (function _configureBodyParser(){
+    //   var skipper = require('skipper');
+    //   var middlewareFn = skipper({ strict: true });
+    //   return middlewareFn;
+    // })(),
+
+  },
+
+};
diff --git a/ee/bulk-operations-dashboard/config/i18n.js b/ee/bulk-operations-dashboard/config/i18n.js
new file mode 100644
index 0000000000..0b652d26b5
--- /dev/null
+++ b/ee/bulk-operations-dashboard/config/i18n.js
@@ -0,0 +1,45 @@
+/**
+ * Internationalization / Localization Settings
+ * (sails.config.i18n)
+ *
+ * If your app will touch people from all over the world, i18n (or internationalization)
+ * may be an important part of your international strategy.
+ *
+ * For a complete list of options for Sails' built-in i18n support, see:
+ * https://sailsjs.com/config/i-18-n
+ *
+ * For more info on i18n in Sails in general, check out:
+ * https://sailsjs.com/docs/concepts/internationalization
+ */
+
+module.exports.i18n = {
+
+  /***************************************************************************
+  *                                                                          *
+  * Which locales are supported?                                             *
+  *                                                                          *
+  ***************************************************************************/
+
+  locales: ['en', 'es', 'fr', 'de'],
+
+  /****************************************************************************
+  *                                                                           *
+  * What is the default locale for the site? Note that this setting will be   *
+  * overridden for any request that sends an "Accept-Language" header (i.e.   *
+  * most browsers), but it's still useful if you need to localize the         *
+  * response for requests made by non-browser clients (e.g. cURL).            *
+  *                                                                           *
+  ****************************************************************************/
+
+  // defaultLocale: 'en',
+
+  /****************************************************************************
+  *                                                                           *
+  * Path (relative to app root) of directory to store locale (translation)    *
+  * files in.                                                                 *
+  *                                                                           *
+  ****************************************************************************/
+
+  // localesDirectory: 'config/locales'
+
+};
diff --git a/ee/bulk-operations-dashboard/config/locales/de.json b/ee/bulk-operations-dashboard/config/locales/de.json
new file mode 100644
index 0000000000..12f23d94a2
--- /dev/null
+++ b/ee/bulk-operations-dashboard/config/locales/de.json
@@ -0,0 +1,4 @@
+{
+  "Welcome": "Willkommen",
+  "A brand new app.": "Eine neue App."
+}
diff --git a/ee/bulk-operations-dashboard/config/locales/en.json b/ee/bulk-operations-dashboard/config/locales/en.json
new file mode 100644
index 0000000000..5989bd9df9
--- /dev/null
+++ b/ee/bulk-operations-dashboard/config/locales/en.json
@@ -0,0 +1,4 @@
+{
+  "Welcome": "Welcome",
+  "A brand new app.": "A brand new app."
+}
diff --git a/ee/bulk-operations-dashboard/config/locales/es.json b/ee/bulk-operations-dashboard/config/locales/es.json
new file mode 100644
index 0000000000..bc6edbf036
--- /dev/null
+++ b/ee/bulk-operations-dashboard/config/locales/es.json
@@ -0,0 +1,4 @@
+{
+  "Welcome": "Bienvenido",
+  "A brand new app.": "Una nueva aplicación."
+}
diff --git a/ee/bulk-operations-dashboard/config/locales/fr.json b/ee/bulk-operations-dashboard/config/locales/fr.json
new file mode 100644
index 0000000000..b5997400f6
--- /dev/null
+++ b/ee/bulk-operations-dashboard/config/locales/fr.json
@@ -0,0 +1,4 @@
+{
+  "Welcome": "Bienvenue",
+  "A brand new app.": "Une toute nouvelle application."
+}
diff --git a/ee/bulk-operations-dashboard/config/log.js b/ee/bulk-operations-dashboard/config/log.js
new file mode 100644
index 0000000000..1ef07f5523
--- /dev/null
+++ b/ee/bulk-operations-dashboard/config/log.js
@@ -0,0 +1,29 @@
+/**
+ * Built-in Log Configuration
+ * (sails.config.log)
+ *
+ * Configure the log level for your app, as well as the transport
+ * (Underneath the covers, Sails uses Winston for logging, which
+ * allows for some pretty neat custom transports/adapters for log messages)
+ *
+ * For more information on the Sails logger, check out:
+ * https://sailsjs.com/docs/concepts/logging
+ */
+
+module.exports.log = {
+
+  /***************************************************************************
+  *                                                                          *
+  * Valid `level` configs: i.e. the minimum log level to capture with        *
+  * sails.log.*()                                                            *
+  *                                                                          *
+  * The order of precedence for log levels from lowest to highest is:        *
+  * silly, verbose, info, debug, warn, error                                 *
+  *                                                                          *
+  * You may also set the level to "silent" to suppress all logs.             *
+  *                                                                          *
+  ***************************************************************************/
+
+  // level: 'info'
+
+};
diff --git a/ee/bulk-operations-dashboard/config/models.js b/ee/bulk-operations-dashboard/config/models.js
new file mode 100644
index 0000000000..54b2a2b27a
--- /dev/null
+++ b/ee/bulk-operations-dashboard/config/models.js
@@ -0,0 +1,124 @@
+/**
+ * Default model settings
+ * (sails.config.models)
+ *
+ * Your default, project-wide model settings. Can also be overridden on a
+ * per-model basis by setting a top-level properties in the model definition.
+ *
+ * For details about all available model settings, see:
+ * https://sailsjs.com/config/models
+ *
+ * For more general background on Sails model settings, and how to configure
+ * them on a project-wide or per-model basis, see:
+ * https://sailsjs.com/docs/concepts/models-and-orm/model-settings
+ */
+
+module.exports.models = {
+
+
+  /***************************************************************************
+  *                                                                          *
+  * Whether model methods like `.create()` and `.update()` should ignore     *
+  * (and refuse to persist) unrecognized data-- i.e. properties other than   *
+  * those explicitly defined by attributes in the model definition.          *
+  *                                                                          *
+  * To ease future maintenance of your code base, it is usually a good idea  *
+  * to set this to `true`.                                                   *
+  *                                                                          *
+  * > Note that `schema: false` is not supported by every database.          *
+  * > For example, if you are using a SQL database, then relevant models     *
+  * > are always effectively `schema: true`.  And if no `schema` setting is  *
+  * > provided whatsoever, the behavior is left up to the database adapter.  *
+  * >                                                                        *
+  * > For more info, see:                                                    *
+  * > https://sailsjs.com/docs/concepts/orm/model-settings#?schema           *
+  *                                                                          *
+  ***************************************************************************/
+
+  schema: true,
+
+
+  /***************************************************************************
+  *                                                                          *
+  * How and whether Sails will attempt to automatically rebuild the          *
+  * tables/collections/etc. in your schema.                                  *
+  *                                                                          *
+  * > Note that, when running in a production environment, this will be      *
+  * > automatically set to `migrate: 'safe'`, no matter what you configure   *
+  * > here.  This is a failsafe to prevent Sails from accidentally running   *
+  * > auto-migrations on your production database.                           *
+  * >                                                                        *
+  * > For more info, see:                                                    *
+  * > https://sailsjs.com/docs/concepts/orm/model-settings#?migrate          *
+  *                                                                          *
+  ***************************************************************************/
+
+  migrate: 'alter',
+
+
+  /***************************************************************************
+  *                                                                          *
+  * Base attributes that are included in all of your models by default.      *
+  * By convention, this is your primary key attribute (`id`), as well as two *
+  * other timestamp attributes for tracking when records were last created   *
+  * or updated.                                                              *
+  *                                                                          *
+  * > For more info, see:                                                    *
+  * > https://sailsjs.com/docs/concepts/orm/model-settings#?attributes       *
+  *                                                                          *
+  ***************************************************************************/
+
+  attributes: {
+    createdAt: { type: 'number', autoCreatedAt: true, },
+    updatedAt: { type: 'number', autoUpdatedAt: true, },
+    id: { type: 'number', autoIncrement: true, },
+    //--------------------------------------------------------------------------
+    //  /\   Using MongoDB?
+    //  ||   Replace `id` above with this instead:
+    //
+    // ```
+    // id: { type: 'string', columnName: '_id' },
+    // ```
+    //
+    // Plus, don't forget to configure MongoDB as your default datastore:
+    // https://sailsjs.com/docs/tutorials/using-mongo-db
+    //--------------------------------------------------------------------------
+  },
+
+
+  /******************************************************************************
+  *                                                                             *
+  * The set of DEKs (data encryption keys) for at-rest encryption.              *
+  * i.e. when encrypting/decrypting data for attributes with `encrypt: true`.   *
+  *                                                                             *
+  * > The `default` DEK is used for all new encryptions, but multiple DEKs      *
+  * > can be configured to allow for key rotation.  In production, be sure to   *
+  * > manage these keys like you would any other sensitive credential.          *
+  *                                                                             *
+  * > For more info, see:                                                       *
+  * > https://sailsjs.com/docs/concepts/orm/model-settings#?dataEncryptionKeys  *
+  *                                                                             *
+  ******************************************************************************/
+
+  dataEncryptionKeys: {
+    default: 'J3CduoHoKsowsRtNmgabXSEBzO8rwaz9c+mHPJKvXeY='
+  },
+
+
+  /***************************************************************************
+  *                                                                          *
+  * Whether or not implicit records for associations should be cleaned up    *
+  * automatically using the built-in polyfill.  This is especially useful    *
+  * during development with sails-disk.                                      *
+  *                                                                          *
+  * Depending on which databases you're using, you may want to disable this  *
+  * polyfill in your production environment.                                 *
+  *                                                                          *
+  * (For production configuration, see `config/env/production.js`.)          *
+  *                                                                          *
+  ***************************************************************************/
+
+  cascadeOnDestroy: true
+
+
+};
diff --git a/ee/bulk-operations-dashboard/config/policies.js b/ee/bulk-operations-dashboard/config/policies.js
new file mode 100644
index 0000000000..eaf06d11d9
--- /dev/null
+++ b/ee/bulk-operations-dashboard/config/policies.js
@@ -0,0 +1,21 @@
+/**
+ * Policy Mappings
+ * (sails.config.policies)
+ *
+ * Policies are simple functions which run **before** your actions.
+ *
+ * For more information on configuring policies, check out:
+ * https://sailsjs.com/docs/concepts/policies
+ */
+
+module.exports.policies = {
+
+  '*': 'is-logged-in',
+
+  // Bypass the `is-logged-in` policy for:
+  'entrance/*': true,
+  'account/logout': true,
+  'legal/view-terms': true,
+  'legal/view-privacy': true,
+
+};
diff --git a/ee/bulk-operations-dashboard/config/routes.js b/ee/bulk-operations-dashboard/config/routes.js
new file mode 100644
index 0000000000..0b106dc6f1
--- /dev/null
+++ b/ee/bulk-operations-dashboard/config/routes.js
@@ -0,0 +1,65 @@
+/**
+ * Route Mappings
+ * (sails.config.routes)
+ *
+ * Your routes tell Sails what to do each time it receives a request.
+ *
+ * For more information on configuring custom routes, check out:
+ * https://sailsjs.com/anatomy/config/routes-js
+ */
+
+module.exports.routes = {
+
+  //  ╦ ╦╔═╗╔╗ ╔═╗╔═╗╔═╗╔═╗╔═╗
+  //  ║║║║╣ ╠╩╗╠═╝╠═╣║ ╦║╣ ╚═╗
+  //  ╚╩╝╚═╝╚═╝╩  ╩ ╩╚═╝╚═╝╚═╝
+  'GET /profiles': { action: 'profiles/view-profiles' },
+  'GET /scripts': { action: 'scripts/view-scripts' },
+
+  'GET /email/confirm':      { action: 'entrance/confirm-email' },
+  'GET /email/confirmed':    { action: 'entrance/view-confirmed-email' },
+
+  'GET /login':              { action: 'entrance/view-login' },
+  'GET /password/forgot':    { action: 'entrance/view-forgot-password' },
+  'GET /password/new':       { action: 'entrance/view-new-password' },
+
+  'GET /account':            { action: 'account/view-account-overview' },
+  'GET /account/password':   { action: 'account/view-edit-password' },
+  'GET /account/profile':    { action: 'account/view-edit-profile' },
+
+
+  //  ╔╦╗╦╔═╗╔═╗  ╦═╗╔═╗╔╦╗╦╦═╗╔═╗╔═╗╔╦╗╔═╗   ┬   ╔╦╗╔═╗╦ ╦╔╗╔╦  ╔═╗╔═╗╔╦╗╔═╗
+  //  ║║║║╚═╗║    ╠╦╝║╣  ║║║╠╦╝║╣ ║   ║ ╚═╗  ┌┼─   ║║║ ║║║║║║║║  ║ ║╠═╣ ║║╚═╗
+  //  ╩ ╩╩╚═╝╚═╝  ╩╚═╚═╝═╩╝╩╩╚═╚═╝╚═╝ ╩ ╚═╝  └┘   ═╩╝╚═╝╚╩╝╝╚╝╩═╝╚═╝╩ ╩═╩╝╚═╝
+  '/terms':                   '/legal/terms',
+  '/logout':                  '/api/v1/account/logout',
+  '/':                        '/profiles',
+
+  //  ╦ ╦╔═╗╔╗ ╦ ╦╔═╗╔═╗╦╔═╔═╗
+  //  ║║║║╣ ╠╩╗╠═╣║ ║║ ║╠╩╗╚═╗
+  //  ╚╩╝╚═╝╚═╝╩ ╩╚═╝╚═╝╩ ╩╚═╝
+  // …
+
+
+  //  ╔═╗╔═╗╦  ╔═╗╔╗╔╔╦╗╔═╗╔═╗╦╔╗╔╔╦╗╔═╗
+  //  ╠═╣╠═╝║  ║╣ ║║║ ║║╠═╝║ ║║║║║ ║ ╚═╗
+  //  ╩ ╩╩  ╩  ╚═╝╝╚╝═╩╝╩  ╚═╝╩╝╚╝ ╩ ╚═╝
+  // Note that, in this app, these API endpoints may be accessed using the `Cloud.*()` methods
+  // from the Parasails library, or by using those method names as the `action` in <ajax-form>.
+  '/api/v1/account/logout':                              { action: 'account/logout' },
+  'PUT   /api/v1/account/update-password':               { action: 'account/update-password' },
+  'PUT   /api/v1/account/update-profile':                { action: 'account/update-profile' },
+  'PUT   /api/v1/entrance/login':                        { action: 'entrance/login' },
+  'POST  /api/v1/entrance/send-password-recovery-email': { action: 'entrance/send-password-recovery-email' },
+  'POST  /api/v1/entrance/update-password-and-login':    { action: 'entrance/update-password-and-login' },
+  'POST /api/v1/delete-profile':                         { action: 'profiles/delete-profile' },
+  'GET /download-profile':                               { action: 'profiles/download-profile' },
+  'POST /api/v1/upload-profile':                         { action: 'profiles/upload-profile' },
+  'POST /api/v1/edit-profile':                           { action: 'profiles/edit-profile' },
+  'GET /api/v1/get-profiles':                            { action: 'get-profiles' },
+  'GET /api/v1/get-scripts':                             { action: 'get-scripts' },
+  'POST /api/v1/delete-script':                          { action: 'scripts/delete-script' },
+  'GET /download-script':                                { action: 'scripts/download-script' },
+  'POST /api/v1/upload-script':                          { action: 'scripts/upload-script' },
+  'POST /api/v1/edit-script':                            { action: 'scripts/edit-script' },
+};
diff --git a/ee/bulk-operations-dashboard/config/security.js b/ee/bulk-operations-dashboard/config/security.js
new file mode 100644
index 0000000000..6b0de0c999
--- /dev/null
+++ b/ee/bulk-operations-dashboard/config/security.js
@@ -0,0 +1,49 @@
+/**
+ * Security Settings
+ * (sails.config.security)
+ *
+ * These settings affect aspects of your app's security, such
+ * as how it deals with cross-origin requests (CORS) and which
+ * routes require a CSRF token to be included with the request.
+ *
+ * For an overview of how Sails handles security, see:
+ * https://sailsjs.com/documentation/concepts/security
+ *
+ * For additional options and more information, see:
+ * https://sailsjs.com/config/security
+ */
+
+module.exports.security = {
+
+  /***************************************************************************
+  *                                                                          *
+  * CORS is like a more modern version of JSONP-- it allows your application *
+  * to circumvent browsers' same-origin policy, so that the responses from   *
+  * your Sails app hosted on one domain (e.g. example.com) can be received   *
+  * in the client-side JavaScript code from a page you trust hosted on _some *
+  * other_ domain (e.g. trustedsite.net).                                    *
+  *                                                                          *
+  * For additional options and more information, see:                        *
+  * https://sailsjs.com/docs/concepts/security/cors                          *
+  *                                                                          *
+  ***************************************************************************/
+
+  // cors: {
+  //   allRoutes: false,
+  //   allowOrigins: '*',
+  //   allowCredentials: false,
+  // },
+
+
+  /****************************************************************************
+  *                                                                           *
+  * CSRF protection should be enabled for this application.                   *
+  *                                                                           *
+  * For more information, see:                                                *
+  * https://sailsjs.com/docs/concepts/security/csrf                           *
+  *                                                                           *
+  ****************************************************************************/
+
+  csrf: true
+
+};
diff --git a/ee/bulk-operations-dashboard/config/session.js b/ee/bulk-operations-dashboard/config/session.js
new file mode 100644
index 0000000000..7b21600ed7
--- /dev/null
+++ b/ee/bulk-operations-dashboard/config/session.js
@@ -0,0 +1,39 @@
+/**
+ * Session Configuration
+ * (sails.config.session)
+ *
+ * Use the settings below to configure session integration in your app.
+ * (for additional recommended settings, see `config/env/production.js`)
+ *
+ * For all available options, see:
+ * https://sailsjs.com/config/session
+ */
+
+module.exports.session = {
+
+  /***************************************************************************
+  *                                                                          *
+  * Session secret is automatically generated when your new app is created   *
+  * Replace at your own risk in production-- you will invalidate the cookies *
+  * of your users, forcing them to log in again.                             *
+  *                                                                          *
+  ***************************************************************************/
+  secret: 'DUMMY_SECRET_REPLACED_IN_PROD',
+
+
+  /***************************************************************************
+  *                                                                          *
+  * Customize when built-in session support will be skipped.                 *
+  *                                                                          *
+  * (Useful for performance tuning; particularly to avoid wasting cycles on  *
+  * session management when responding to simple requests for static assets, *
+  * like images or stylesheets.)                                             *
+  *                                                                          *
+  * https://sailsjs.com/config/session                                       *
+  *                                                                          *
+  ***************************************************************************/
+  // isSessionDisabled: function (req){
+  //   return !!req.path.match(req._sails.LOOKS_LIKE_ASSET_RX);
+  // },
+
+};
diff --git a/ee/bulk-operations-dashboard/config/sockets.js b/ee/bulk-operations-dashboard/config/sockets.js
new file mode 100644
index 0000000000..9f466a04d9
--- /dev/null
+++ b/ee/bulk-operations-dashboard/config/sockets.js
@@ -0,0 +1,82 @@
+/**
+ * WebSocket Server Settings
+ * (sails.config.sockets)
+ *
+ * Use the settings below to configure realtime functionality in your app.
+ * (for additional recommended settings, see `config/env/production.js`)
+ *
+ * For all available options, see:
+ * https://sailsjs.com/config/sockets
+ */
+
+module.exports.sockets = {
+
+  /***************************************************************************
+  *                                                                          *
+  * `transports`                                                             *
+  *                                                                          *
+  * The protocols or "transports" that socket clients are permitted to       *
+  * use when connecting and communicating with this Sails application.       *
+  *                                                                          *
+  * > Never change this here without also configuring `io.sails.transports`  *
+  * > in your client-side code.  If the client and the server are not using  *
+  * > the same array of transports, sockets will not work properly.          *
+  * >                                                                        *
+  * > For more info, see:                                                    *
+  * > https://sailsjs.com/docs/reference/web-sockets/socket-client           *
+  *                                                                          *
+  ***************************************************************************/
+
+  // transports: [ 'websocket' ],
+
+
+  /***************************************************************************
+  *                                                                          *
+  * `beforeConnect`                                                          *
+  *                                                                          *
+  * This custom beforeConnect function will be run each time BEFORE a new    *
+  * socket is allowed to connect, when the initial socket.io handshake is    *
+  * performed with the server.                                               *
+  *                                                                          *
+  * https://sailsjs.com/config/sockets#?beforeconnect                        *
+  *                                                                          *
+  ***************************************************************************/
+
+  // beforeConnect: function(handshake, proceed) {
+  //
+  //   // `true` allows the socket to connect.
+  //   // (`false` would reject the connection)
+  //   return proceed(undefined, true);
+  //
+  // },
+
+
+  /***************************************************************************
+  *                                                                          *
+  * `afterDisconnect`                                                        *
+  *                                                                          *
+  * This custom afterDisconnect function will be run each time a socket      *
+  * disconnects                                                              *
+  *                                                                          *
+  ***************************************************************************/
+
+  // afterDisconnect: function(session, socket, done) {
+  //
+  //   // By default: do nothing.
+  //   // (but always trigger the callback)
+  //   return done();
+  //
+  // },
+
+
+  /***************************************************************************
+  *                                                                          *
+  * Whether to expose a 'GET /__getcookie' route that sets an HTTP-only      *
+  * session cookie.                                                          *
+  *                                                                          *
+  ***************************************************************************/
+
+  // grant3rdPartyCookie: true,
+
+
+};
diff --git a/ee/bulk-operations-dashboard/config/views.js b/ee/bulk-operations-dashboard/config/views.js
new file mode 100644
index 0000000000..55d0f9243b
--- /dev/null
+++ b/ee/bulk-operations-dashboard/config/views.js
@@ -0,0 +1,41 @@
+/**
+ * View Engine Configuration
+ * (sails.config.views)
+ *
+ * Server-sent views are a secure and effective way to get your app up
+ * and running. Views are normally served from actions.  Below, you can
+ * configure your templating language/framework of choice and configure
+ * Sails' layout support.
+ *
+ * For details on available options for configuring server-side views, check out:
+ * https://sailsjs.com/config/views
+ *
+ * For more background information on views and partials in Sails, check out:
+ * https://sailsjs.com/docs/concepts/views
+ */
+
+module.exports.views = {
+
+  /***************************************************************************
+  *                                                                          *
+  * Extension to use for your views. When calling `res.view()` in an action, *
+  * you can leave this extension off. For example, calling                   *
+  * `res.view('homepage')` will (using default settings) look for a          *
+  * `views/homepage.ejs` file.                                               *
+  *                                                                          *
+  ***************************************************************************/
+
+  // extension: 'ejs',
+
+  /***************************************************************************
+  *                                                                          *
+  * The path (relative to the views directory, and without extension) to     *
+  * the default layout file to use, or `false` to disable layouts entirely.  *
+  *                                                                          *
+  * Note that layouts only work with the built-in EJS view engine!           *
+  *                                                                          *
+  ***************************************************************************/
+
+  layout: 'layouts/layout'
+
+};
diff --git a/ee/bulk-operations-dashboard/docker-compose.yaml b/ee/bulk-operations-dashboard/docker-compose.yaml
new file mode 100644
index 0000000000..8e808b3d33
--- /dev/null
+++ b/ee/bulk-operations-dashboard/docker-compose.yaml
@@ -0,0 +1,28 @@
+version: '3'
+services:
+  bulk-operations-dashboard:
+    build: .
+    ports:
+      - "1337:1337"
+    depends_on:
+      - postgres
+    environment:
+      sails_datastores__default__url: postgres://user:password@postgres:5432/dbname
+      sails_datastores__default__adapter: sails-postgresql
+      sails_sockets__url: redis://redis:6379
+      sails_session__url: redis://redis:6379
+      sails_models__migrate: safe
+      sails_custom__fleetBaseUrl: '' #Add the base url of your Fleet instance: ex: https://fleet.example.com
+      sails_custom__fleetApiToken: '' # Add the API token of an API-only user [?] Here's how you get one: https://fleetdm.com/docs/using-fleet/fleetctl-cli#get-the-api-token-of-an-api-only-user
+
+  postgres:
+    image: "postgres:alpine"
+    environment:
+      POSTGRES_USER: user
+      POSTGRES_PASSWORD: password
+      POSTGRES_DB: dbname
+    volumes:
+      - pgdata:/var/lib/postgresql/data
+
+volumes:
+  pgdata:
diff --git a/ee/bulk-operations-dashboard/entrypoint.sh b/ee/bulk-operations-dashboard/entrypoint.sh
new file mode 100644
index 0000000000..bbec7ef5da
--- /dev/null
+++ b/ee/bulk-operations-dashboard/entrypoint.sh
@@ -0,0 +1,22 @@
+#!/bin/bash
+
+if [ -z "$sails_custom__fleetBaseUrl" ] && [ -z "$sails_custom__fleetApiToken" ]; then
+  echo 'ERROR: Missing environment variables. Please set "sails_custom__fleetApiToken" and "sails_custom__fleetBaseUrl" and and try starting this container again'
+  exit 1
+elif [ -z "$sails_custom__fleetBaseUrl" ]; then
+  echo 'ERROR: Missing environment variables. Please set "sails_custom__fleetBaseUrl" and try starting this container again'
+  exit 1
+elif [ -z "$sails_custom__fleetApiToken" ]; then
+  echo 'ERROR: Missing environment variables. Please set "sails_custom__fleetApiToken" and and try starting this container again'
+  exit 1
+fi
+
+# Check if the vulnerability dashboard has been initialized before
+if [ ! -f "/usr/src/app/.initialized" ]; then
+  # if it hasn't, lift the app with in console mode with the --drop flag to create our databsae tables.
+  echo '.exit' | node ./node_modules/sails/bin/sails console --drop
+
+fi
+
+# Start the dashboard
+exec node app.js
diff --git a/ee/bulk-operations-dashboard/package.json b/ee/bulk-operations-dashboard/package.json
new file mode 100644
index 0000000000..01df4711c4
--- /dev/null
+++ b/ee/bulk-operations-dashboard/package.json
@@ -0,0 +1,44 @@
+{
+  "name": "bulk-operations-dashboard",
+  "private": true,
+  "version": "0.0.0",
+  "description": "a Sails application",
+  "keywords": [],
+  "dependencies": {
+    "@sailshq/connect-redis": "^6.1.3",
+    "@sailshq/lodash": "^3.10.6",
+    "@sailshq/socket.io-redis": "^6.1.2",
+    "sails": "^1.5.11",
+    "sails-hook-apianalytics": "^2.0.6",
+    "sails-hook-organics": "^2.2.2",
+    "sails-hook-orm": "^4.0.3",
+    "sails-hook-sockets": "^3.0.0",
+    "sails-hook-uploads": "^0.4.3",
+    "sails-postgresql": "^5.0.1"
+  },
+  "devDependencies": {
+    "eslint": "5.16.0",
+    "grunt": "1.0.4",
+    "htmlhint": "0.11.0",
+    "lesshint": "6.3.6",
+    "sails-hook-grunt": "^5.0.0"
+  },
+  "scripts": {
+    "start": "NODE_ENV=production node app.js",
+    "test": "npm run lint && npm run custom-tests && echo 'Done.'",
+    "lint": "./node_modules/eslint/bin/eslint.js . --max-warnings=0 --report-unused-disable-directives && echo '✔  Your .js files look so good.' && ./node_modules/htmlhint/bin/htmlhint -c ./.htmlhintrc views/*.ejs && ./node_modules/htmlhint/bin/htmlhint -c ./.htmlhintrc views/**/*.ejs && ./node_modules/htmlhint/bin/htmlhint -c ./.htmlhintrc views/**/**/*.ejs && ./node_modules/htmlhint/bin/htmlhint -c ./.htmlhintrc views/**/**/**/*.ejs && ./node_modules/htmlhint/bin/htmlhint -c ./.htmlhintrc views/**/**/**/**/*.ejs && ./node_modules/htmlhint/bin/htmlhint -c ./.htmlhintrc views/**/**/**/**/**/*.ejs && ./node_modules/htmlhint/bin/htmlhint -c ./.htmlhintrc views/**/**/**/**/**/**/*.ejs && echo '✔  So do your .ejs files.' && ./node_modules/lesshint/bin/lesshint assets/styles/ --max-warnings=0 && echo '✔  Your .less files look good, too.'",
+    "custom-tests": "echo \"(No other custom tests yet.)\" && echo",
+    "deploy": "echo 'This script assumes a dead-simple, opinionated setup on Heroku.' && echo 'But, of course, you can deploy your app anywhere you like.' && echo '(Node.js/Sails.js apps are supported on all modern hosting platforms.)' && echo && echo 'Warning: Specifically, this script assumes you are on the master branch, and that your app can be deployed simply by force-pushing on top of the *deploy* branch.  It will also temporarily use a local *predeploy* branch for preparing assets, that it will delete after it finishes.  Please make sure there is nothing you care about on either of these two branches!!!' && echo '' && echo '' && echo 'Preparing to deploy...' && echo '--' && git status && echo '' && echo '--' && echo 'I hope you are on the master branch and have everything committed/pulled/pushed and are completely up to date and stuff.' && echo '********************************************'  && echo '** IF NOT THEN PLEASE PRESS <CTRL+C> NOW! **' && echo '********************************************' && echo 'Press CTRL+C to cancel.' && echo '(you have five seconds)' && sleep 1 && echo '...4' && sleep 1 && echo '...3' && sleep 1 && echo '...2' && sleep 1 && echo '...1' && sleep 1  && echo '' && echo 'Alright, here we go.  No turning back now!' && echo 'Trying to switch to master branch...' && git checkout master && echo && echo 'OK.  Now wiping node_modules/ and running npm install...' && rm -rf node_modules && rm -rf package-lock.json && npm install && (git add package-lock.json && git commit -am 'AUTOMATED COMMIT: Did fresh npm install before deploying, and it caused something relevant (probably the package-lock.json file) to change!  This commit tracks that change.' || true) && echo 'Deploying as version:' && npm version patch && echo '' && git push origin master && git push --tags && (git branch -D predeploy > /dev/null 2>&1 || true) && git checkout -b predeploy && (echo 'Now building+minifying assets for production...' && echo '(Hang tight, this could take a while.)' && echo && node node_modules/grunt/bin/grunt buildProd || (echo && echo '------------------------------------------' && echo 'IMPORTANT!  IMPORTANT!  IMPORTANT!' && echo 'ERROR: Could not compile assets for production!' && echo && echo 'Attempting to recover automatically by stashing, ' && echo 'switching back to the master branch, and then ' && echo 'deleting the predeploy branch... ' && echo && echo 'After this, please fix the issues logged above' && echo 'and push that up.  Then, try deploying again.' && echo '------------------------------------------' && echo && echo 'Staging, deleting the predeploy branch, and switching back to master...' && git stash && git checkout master && git branch -D predeploy && false)) && mv www .www && git add .www && node -e 'sailsrc = JSON.parse(require(\"fs\").readFileSync(\"./.sailsrc\", \"utf8\"));  if (sailsrc.paths&&sailsrc.paths.public !== undefined || sailsrc.hooks&&sailsrc.hooks.grunt !== undefined) { throw new Error(\"Cannot complete deployment script: .sailsrc file has conflicting contents!  Please throw away this midway-complete deployment, switch back to your original branch (master), remove the conflicting stuff from .sailsrc, then commit and push that up.\"); }  sailsrc.paths = sailsrc.paths || {};  sailsrc.paths.public = \"./.www\";   sailsrc.hooks = sailsrc.hooks || {};  sailsrc.hooks.grunt = false;  require(\"fs\").writeFileSync(\"./.sailsrc\", JSON.stringify(sailsrc))' && git commit -am 'AUTOMATED COMMIT: Automatically bundling compiled assets as part of deploy, updating the EJS layout and .sailsrc file accordingly.' && git push origin predeploy && git checkout master && git push origin +predeploy:deploy && git push --tags && git branch -D predeploy && git push origin :predeploy && echo '' && echo '--' && echo 'OK, done.  It should be live momentarily on your staging environment.' && echo '(if you get impatient, check the Heroku dashboard for status)' && echo && echo 'Staging environment:' && echo ' 🌐–•  https://staging.example.com' && echo '       (hold ⌘ and click to open links in the terminal)' && echo && echo 'Please review that to make sure it looks good.' && echo 'When you are ready to go to production, visit your pipeline on Heroku and press the PROMOTE TO PRODUCTION button.'",
+    "build-for-prod": "echo 'Now building+minifying assets for production...' && echo '(Hang tight, this could take a while.)' && echo && node node_modules/grunt/bin/grunt buildProd || (echo && echo '------------------------------------------' && echo 'IMPORTANT!  IMPORTANT!  IMPORTANT!' && echo 'ERROR: Could not compile assets for production!' && echo && echo 'Please fix the issues logged above' && echo 'and push that up.  Then, try deploying again.' && echo '------------------------------------------' && echo) && mv www .www && node -e 'sailsrc = JSON.parse(require(\"fs\").readFileSync(\"./.sailsrc\", \"utf8\"));  if (sailsrc.paths&&sailsrc.paths.public !== undefined || sailsrc.hooks&&sailsrc.hooks.grunt !== undefined) { throw new Error(\"Cannot complete deployment script: .sailsrc file has conflicting contents!  Please remove the conflicting stuff from .sailsrc, then commit and push that up.\"); }  sailsrc.paths = sailsrc.paths || {};  sailsrc.paths.public = \"./.www\";   sailsrc.hooks = sailsrc.hooks || {};  sailsrc.hooks.grunt = false;  require(\"fs\").writeFileSync(\"./.sailsrc\", JSON.stringify(sailsrc))' && echo 'Build is complete.  Ready to deploy.'"
+  },
+  "main": "app.js",
+  "repository": {
+    "type": "git",
+    "url": "git://github.com/eashaw/bulk-operations-dashboard.git"
+  },
+  "author": "eashaw",
+  "license": "",
+  "engines": {
+    "node": "^18.18"
+  }
+}
diff --git a/ee/bulk-operations-dashboard/scripts/rebuild-cloud-sdk.js b/ee/bulk-operations-dashboard/scripts/rebuild-cloud-sdk.js
new file mode 100644
index 0000000000..ce6789911c
--- /dev/null
+++ b/ee/bulk-operations-dashboard/scripts/rebuild-cloud-sdk.js
@@ -0,0 +1,134 @@
+module.exports = {
+
+  friendlyName: 'Rebuild Cloud SDK',
+
+
+  description: 'Regenerate the configuration for the "Cloud SDK" -- the JavaScript module used for AJAX and WebSockets.',
+
+
+  fn: async function(){
+
+    var path = require('path');
+
+    var endpointsByMethodName = {};
+    var extraEndpointsOnlyForTestsByMethodName = {};
+
+    for (let address in sails.config.routes) {
+      let target = sails.config.routes[address];
+
+      // If the route target is an array, then only consider
+      // the very last sub-target in the array.
+      if (_.isArray(target)) {
+        target = _.last(target);
+      }//fi
+
+      // Skip redirects
+      // (Note that, by doing this, we also skip traditional shorthand
+      // -- that's ok though.)
+      if (_.isString(target)) {
+        continue;
+      }
+
+      // Skip routes whose target doesn't contain `action` for any
+      // other miscellaneous reason.
+      if (!target.action) {
+        continue;
+      }
+
+      // Just about everything else gets a Cloud SDK method.
+
+      // We determine its name using the bare action name.
+      var bareActionName = _.last(target.action.split(/\//));
+      var methodName = _.camelCase(bareActionName);
+      var expandedAddress = sails.getRouteFor(target);
+
+      // Skip routes that just serve views.
+      // (but still generate them for use in tests, for convenience)
+      if (target.view || (bareActionName.match(/^view-/))) {
+        extraEndpointsOnlyForTestsByMethodName[methodName] = {
+          verb: (expandedAddress.method||'get').toUpperCase(),
+          url: expandedAddress.url
+        };
+        continue;
+      }//•
+
+      endpointsByMethodName[methodName] = {
+        verb: (expandedAddress.method||'get').toUpperCase(),
+        url: expandedAddress.url,
+      };
+
+      // If this is an actions2 action, then determine appropriate serial usage.
+      // (deduced the same way as helpers)
+      // > If there is no such action for some reason, then don't compile a
+      // > method for this one.
+      var requestable = sails.getActions()[target.action];
+      if (!requestable) {
+        sails.log.warn('Skipping unrecognized action: `'+target.action+'`');
+        continue;
+      }
+      var def = requestable.toJSON && requestable.toJSON();
+      if (def && def.fn) {
+        if (def.args !== undefined) {
+          endpointsByMethodName[methodName].args = def.args;
+        } else {
+          endpointsByMethodName[methodName].args = _.reduce(def.inputs, (args, inputDef, inputCodeName)=>{
+            args.push(inputCodeName);
+            return args;
+          }, []);
+        }
+      }
+
+      // And we determine whether it needs to communicate over WebSockets
+      // by checking for an additional property in the route target.
+      if (target.isSocket || target.hasSocketFeatures) {
+        endpointsByMethodName[methodName].protocol = 'io.socket';
+      }
+    }//∞
+
+    // Smash and rewrite the `cloud.setup.js` file in the assets folder to
+    // reflect the latest set of available cloud actions exposed by this Sails
+    // app (as determined by its routes above)
+    await sails.helpers.fs.write.with({
+      destination: path.resolve(sails.config.appPath, 'assets/js/cloud.setup.js'),
+      force: true,
+      string: ``+
+`/**
+ * cloud.setup.js
+ *
+ * Configuration for this Sails app's generated browser SDK ("Cloud").
+ *
+ * Above all, the purpose of this file is to provide endpoint definitions,
+ * each of which corresponds with one particular route+action on the server.
+ *
+ * > This file was automatically generated.
+ * > (To regenerate, run \`sails run rebuild-cloud-sdk\`)
+ */
+
+Cloud.setup({
+
+  /* eslint-disable */
+  methods: ${JSON.stringify(endpointsByMethodName)}
+  /* eslint-enable */
+
+});`+
+      `\n`
+    });
+
+    // Also, if a `test/` folder exists, set up a barebones bounce of this data
+    // as a JSON file inside of it, for testing purposes:
+    var hasTestFolder = await sails.helpers.fs.exists(path.resolve(sails.config.appPath, 'test/'));
+    if (hasTestFolder) {
+      await sails.helpers.fs.write.with({
+        destination: path.resolve(sails.config.appPath, 'test/private/CLOUD_SDK_METHODS.json'),
+        string: JSON.stringify(_.extend(endpointsByMethodName, extraEndpointsOnlyForTestsByMethodName)),
+        force: true
+      });
+    }
+
+    sails.log.info('--');
+    sails.log.info('Successfully rebuilt Cloud SDK for use in the browser.');
+    sails.log.info('(and CLOUD_SDK_METHODS.json for use in automated tests)');
+
+  }
+
+};
diff --git a/ee/bulk-operations-dashboard/tasks/config/babel.js b/ee/bulk-operations-dashboard/tasks/config/babel.js
new file mode 100644
index 0000000000..c9720a1bdf
--- /dev/null
+++ b/ee/bulk-operations-dashboard/tasks/config/babel.js
@@ -0,0 +1,54 @@
+/**
+ * `tasks/config/babel`
+ *
+ * ---------------------------------------------------------------
+ *
+ * Transpile >=ES6 code for broader browser compatibility.
+ *
+ * For more information, see:
+ *   https://sailsjs.com/anatomy/tasks/config/babel.js
+ *
+ */
+module.exports = function(grunt) {
+
+  grunt.config.set('babel', {
+    dist: {
+      options: {
+        presets: [require('sails-hook-grunt/accessible/babel-preset-env')]
+      },
+      files: [
+        {
+          expand: true,
+          cwd: '.tmp/public',
+          src: ['js/**/*.js'],
+          dest: '.tmp/public'
+        }
+      ]
+    }
+  });
+
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+  // This Grunt plugin is part of the default asset pipeline in Sails,
+  // so it's already been automatically loaded for you at this point.
+  //
+  // Of course, you can always remove this Grunt plugin altogether by
+  // deleting this file.  But check this out: you can also use your
+  // _own_ custom version of this Grunt plugin.
+  //
+  // Here's how:
+  //
+  // 1. Install it as a local dependency of your Sails app:
+  //    ```
+  //    $ npm install grunt-babel --save-dev --save-exact
+  //    ```
+  //
+  //
+  // 2. Then uncomment the following code:
+  //
+  // ```
+  // // Load Grunt plugin from the node_modules/ folder.
+  // grunt.loadNpmTasks('grunt-babel');
+  // ```
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+};
diff --git a/ee/bulk-operations-dashboard/tasks/config/clean.js b/ee/bulk-operations-dashboard/tasks/config/clean.js
new file mode 100644
index 0000000000..a267b8dfd0
--- /dev/null
+++ b/ee/bulk-operations-dashboard/tasks/config/clean.js
@@ -0,0 +1,52 @@
+/**
+ * `tasks/config/clean`
+ *
+ * ---------------------------------------------------------------
+ *
+ * Remove generated files and folders.
+ *
+ * For more information, see:
+ *   https://sailsjs.com/anatomy/tasks/config/clean.js
+ *
+ */
+module.exports = function(grunt) {
+
+  grunt.config.set('clean', {
+    dev: ['.tmp/public/**'],
+    build: ['www'],
+    afterBuildProd: [
+      'www/concat',
+      'www/min',
+      'www/hash',
+      'www/js',
+      'www/styles',
+      'www/templates',
+      'www/dependencies'
+    ]
+  });
+
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+  // This Grunt plugin is part of the default asset pipeline in Sails,
+  // so it's already been automatically loaded for you at this point.
+  //
+  // Of course, you can always remove this Grunt plugin altogether by
+  // deleting this file.  But check this out: you can also use your
+  // _own_ custom version of this Grunt plugin.
+  //
+  // Here's how:
+  //
+  // 1. Install it as a local dependency of your Sails app:
+  //    ```
+  //    $ npm install grunt-contrib-clean --save-dev --save-exact
+  //    ```
+  //
+  //
+  // 2. Then uncomment the following code:
+  //
+  // ```
+  // // Load Grunt plugin from the node_modules/ folder.
+  // grunt.loadNpmTasks('grunt-contrib-clean');
+  // ```
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+};
diff --git a/ee/bulk-operations-dashboard/tasks/config/concat.js b/ee/bulk-operations-dashboard/tasks/config/concat.js
new file mode 100644
index 0000000000..4a3530ceb4
--- /dev/null
+++ b/ee/bulk-operations-dashboard/tasks/config/concat.js
@@ -0,0 +1,50 @@
+/**
+ * `tasks/config/concat`
+ *
+ * ---------------------------------------------------------------
+ *
+ * An intermediate step to generate monolithic files that can
+ * then be passed in to `uglify` and/or `cssmin` for minification.
+ *
+ * For more information, see:
+ *   https://sailsjs.com/anatomy/tasks/config/concat.js
+ *
+ */
+module.exports = function(grunt) {
+
+  grunt.config.set('concat', {
+    js: {
+      src: require('../pipeline').jsFilesToInject,
+      dest: '.tmp/public/concat/production.js'
+    },
+    css: {
+      src: require('../pipeline').cssFilesToInject,
+      dest: '.tmp/public/concat/production.css'
+    }
+  });
+
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+  // This Grunt plugin is part of the default asset pipeline in Sails,
+  // so it's already been automatically loaded for you at this point.
+  //
+  // Of course, you can always remove this Grunt plugin altogether by
+  // deleting this file.  But check this out: you can also use your
+  // _own_ custom version of this Grunt plugin.
+  //
+  // Here's how:
+  //
+  // 1. Install it as a local dependency of your Sails app:
+  //    ```
+  //    $ npm install grunt-contrib-concat --save-dev --save-exact
+  //    ```
+  //
+  //
+  // 2. Then uncomment the following code:
+  //
+  // ```
+  // // Load Grunt plugin from the node_modules/ folder.
+  // grunt.loadNpmTasks('grunt-contrib-concat');
+  // ```
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+};
diff --git a/ee/bulk-operations-dashboard/tasks/config/copy.js b/ee/bulk-operations-dashboard/tasks/config/copy.js
new file mode 100644
index 0000000000..f06c50b7db
--- /dev/null
+++ b/ee/bulk-operations-dashboard/tasks/config/copy.js
@@ -0,0 +1,65 @@
+/**
+ * `tasks/config/copy`
+ *
+ * ---------------------------------------------------------------
+ *
+ * Copy files and/or folders.
+ *
+ * For more information, see:
+ *   https://sailsjs.com/anatomy/tasks/config/copy.js
+ *
+ */
+module.exports = function(grunt) {
+
+  grunt.config.set('copy', {
+    dev: {
+      files: [{
+        expand: true,
+        cwd: './assets',
+        src: ['**/*.!(coffee|less)'],
+        dest: '.tmp/public'
+      }]
+    },
+    build: {
+      files: [{
+        expand: true,
+        cwd: '.tmp/public',
+        src: ['**/*'],
+        dest: 'www'
+      }]
+    },
+    beforeLinkBuildProd: {
+      files: [{
+        expand: true,
+        cwd: '.tmp/public/hash',
+        src: ['**/*'],
+        dest: '.tmp/public/dist'
+      }]
+    },
+  });
+
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+  // This Grunt plugin is part of the default asset pipeline in Sails,
+  // so it's already been automatically loaded for you at this point.
+  //
+  // Of course, you can always remove this Grunt plugin altogether by
+  // deleting this file.  But check this out: you can also use your
+  // _own_ custom version of this Grunt plugin.
+  //
+  // Here's how:
+  //
+  // 1. Install it as a local dependency of your Sails app:
+  //    ```
+  //    $ npm install grunt-contrib-copy --save-dev --save-exact
+  //    ```
+  //
+  //
+  // 2. Then uncomment the following code:
+  //
+  // ```
+  // // Load Grunt plugin from the node_modules/ folder.
+  // grunt.loadNpmTasks('grunt-contrib-copy');
+  // ```
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+};
diff --git a/ee/bulk-operations-dashboard/tasks/config/cssmin.js b/ee/bulk-operations-dashboard/tasks/config/cssmin.js
new file mode 100644
index 0000000000..e3f3edf5b3
--- /dev/null
+++ b/ee/bulk-operations-dashboard/tasks/config/cssmin.js
@@ -0,0 +1,47 @@
+/**
+ * `tasks/config/cssmin`
+ *
+ * ---------------------------------------------------------------
+ *
+ * Together with the `concat` task, this is the final step that minifies
+ * all CSS files from `assets/styles/` (and potentially your LESS importer
+ * file from `assets/styles/importer.less`)
+ *
+ * For more information, see:
+ *   https://sailsjs.com/anatomy/tasks/config/cssmin.js
+ *
+ */
+module.exports = function(grunt) {
+
+  grunt.config.set('cssmin', {
+    dist: {
+      src: ['.tmp/public/concat/production.css'],
+      dest: '.tmp/public/min/production.min.css'
+    }
+  });
+
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+  // This Grunt plugin is part of the default asset pipeline in Sails,
+  // so it's already been automatically loaded for you at this point.
+  //
+  // Of course, you can always remove this Grunt plugin altogether by
+  // deleting this file.  But check this out: you can also use your
+  // _own_ custom version of this Grunt plugin.
+  //
+  // Here's how:
+  //
+  // 1. Install it as a local dependency of your Sails app:
+  //    ```
+  //    $ npm install grunt-contrib-cssmin --save-dev --save-exact
+  //    ```
+  //
+  //
+  // 2. Then uncomment the following code:
+  //
+  // ```
+  // // Load Grunt plugin from the node_modules/ folder.
+  // grunt.loadNpmTasks('grunt-contrib-cssmin');
+  // ```
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+};
diff --git a/ee/bulk-operations-dashboard/tasks/config/hash.js b/ee/bulk-operations-dashboard/tasks/config/hash.js
new file mode 100644
index 0000000000..41435ac855
--- /dev/null
+++ b/ee/bulk-operations-dashboard/tasks/config/hash.js
@@ -0,0 +1,62 @@
+/**
+ * `tasks/config/hash`
+ *
+ * ---------------------------------------------------------------
+ *
+ * Implement cache-busting for minified CSS and JavaScript files.
+ *
+ * For more information, see:
+ *   https://sailsjs.com/anatomy/tasks/config/hash.js
+ *
+ */
+module.exports = function(grunt) {
+
+  grunt.config.set('hash', {
+    options: {
+      mapping: '',
+      srcBasePath: '',
+      destBasePath: '',
+      flatten: false,
+      hashLength: 8,
+      hashFunction: function(source, encoding){
+        if (!source || !encoding) {
+          throw new Error('Consistency violation: Cannot compute unique hash for production .css/.js cache-busting suffix, because `source` and/or `encoding` are falsey-- but they should be truthy strings!  Here they are, respectively:\nsource: '+require('util').inspect(source, {depth:null})+'\nencoding: '+require('util').inspect(encoding, {depth:null}));
+        }
+        return require('crypto').createHash('sha1').update(source, encoding).digest('hex');
+      }
+    },
+    js: {
+      src: '.tmp/public/min/*.js',
+      dest: '.tmp/public/hash/'
+    },
+    css: {
+      src: '.tmp/public/min/*.css',
+      dest: '.tmp/public/hash/'
+    }
+  });
+
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+  // This Grunt plugin is part of the default asset pipeline in Sails,
+  // so it's already been automatically loaded for you at this point.
+  //
+  // Of course, you can always remove this Grunt plugin altogether by
+  // deleting this file.  But check this out: you can also use your
+  // _own_ custom version of this Grunt plugin.
+  //
+  // Here's how:
+  //
+  // 1. Install it as a local dependency of your Sails app:
+  //    ```
+  //    $ npm install grunt-hash --save-dev --save-exact
+  //    ```
+  //
+  //
+  // 2. Then uncomment the following code:
+  //
+  // ```
+  // // Load Grunt plugin from the node_modules/ folder.
+  // grunt.loadNpmTasks('grunt-hash');
+  // ```
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+};
diff --git a/ee/bulk-operations-dashboard/tasks/config/less.js b/ee/bulk-operations-dashboard/tasks/config/less.js
new file mode 100644
index 0000000000..06e3a0806a
--- /dev/null
+++ b/ee/bulk-operations-dashboard/tasks/config/less.js
@@ -0,0 +1,50 @@
+/**
+ * `tasks/config/less`
+ *
+ * ---------------------------------------------------------------
+ *
+ * Compile your LESS files into a CSS stylesheet.
+ *
+ * For more information, see:
+ *   https://sailsjs.com/anatomy/tasks/config/less.js
+ *
+ */
+module.exports = function(grunt) {
+
+  grunt.config.set('less', {
+    dev: {
+      files: [{
+        expand: true,
+        cwd: 'assets/styles/',
+        src: ['importer.less'],
+        dest: '.tmp/public/styles/',
+        ext: '.css'
+      }]
+    }
+  });
+
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+  // This Grunt plugin is part of the default asset pipeline in Sails,
+  // so it's already been automatically loaded for you at this point.
+  //
+  // Of course, you can always remove this Grunt plugin altogether by
+  // deleting this file.  But check this out: you can also use your
+  // _own_ custom version of this Grunt plugin.
+  //
+  // Here's how:
+  //
+  // 1. Install it as a local dependency of your Sails app:
+  //    ```
+  //    $ npm install grunt-contrib-less --save-dev --save-exact
+  //    ```
+  //
+  //
+  // 2. Then uncomment the following code:
+  //
+  // ```
+  // // Load Grunt plugin from the node_modules/ folder.
+  // grunt.loadNpmTasks('grunt-contrib-less');
+  // ```
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+};
diff --git a/ee/bulk-operations-dashboard/tasks/config/sails-linker.js b/ee/bulk-operations-dashboard/tasks/config/sails-linker.js
new file mode 100644
index 0000000000..c197efbfc0
--- /dev/null
+++ b/ee/bulk-operations-dashboard/tasks/config/sails-linker.js
@@ -0,0 +1,184 @@
+/**
+ * `tasks/config/sails-linker`
+ *
+ * ---------------------------------------------------------------
+ *
+ * Automatically inject <script> tags and <link> tags into the specified
+ * specified HTML and/or EJS files.  The specified delimiters (`startTag`
+ * and `endTag`) determine the insertion points.
+ *
+ * For more information, see:
+ *   https://sailsjs.com/anatomy/tasks/config/sails-linker.js
+ *
+ */
+module.exports = function(grunt) {
+
+  grunt.config.set('sails-linker', {
+
+
+    //   ╦╔═╗╦  ╦╔═╗╔═╗╔═╗╦═╗╦╔═╗╔╦╗
+    //   ║╠═╣╚╗╔╝╠═╣╚═╗║  ╠╦╝║╠═╝ ║
+    //  ╚╝╩ ╩ ╚╝ ╩ ╩╚═╝╚═╝╩╚═╩╩   ╩
+    //  ┌─    ┌─┐┬  ┬┌─┐┌┐┌┌┬┐  ┌─┐┬┌┬┐┌─┐   ┬┌─┐┬  ┬┌─┐┌─┐┌─┐┬─┐┬┌─┐┌┬┐    ─┐
+    //  │───  │  │  │├┤ │││ │───└─┐│ ││├┤    │├─┤└┐┌┘├─┤└─┐│  ├┬┘│├─┘ │   ───│
+    //  └─    └─┘┴─┘┴└─┘┘└┘ ┴   └─┘┴─┴┘└─┘  └┘┴ ┴ └┘ ┴ ┴└─┘└─┘┴└─┴┴   ┴     ─┘
+    devJs: {
+      options: {
+        startTag: '<!--SCRIPTS-->',
+        endTag: '<!--SCRIPTS END-->',
+        fileTmpl: '<script src="%s"></script>',
+        appRoot: '.tmp/public'
+      },
+      files: {
+        '.tmp/public/**/*.html': require('../pipeline').jsFilesToInject,
+        'views/**/*.html': require('../pipeline').jsFilesToInject,
+        'views/**/*.ejs': require('../pipeline').jsFilesToInject
+      }
+    },
+
+    devJsBuild: {
+      options: {
+        startTag: '<!--SCRIPTS-->',
+        endTag: '<!--SCRIPTS END-->',
+        fileTmpl: '<script src="%s"></script>',
+        appRoot: '.tmp/public',
+        // relative: true
+        // ^^ Uncomment this if compiling assets for use in PhoneGap, CDN, etc.
+        //    (but be note that this can break custom font URLs)
+      },
+      files: {
+        '.tmp/public/**/*.html': require('../pipeline').jsFilesToInject,
+        'views/**/*.html': require('../pipeline').jsFilesToInject,
+        'views/**/*.ejs': require('../pipeline').jsFilesToInject
+      }
+    },
+
+    prodJs: {
+      options: {
+        startTag: '<!--SCRIPTS-->',
+        endTag: '<!--SCRIPTS END-->',
+        fileTmpl: '<script src="%s"></script>',
+        appRoot: '.tmp/public'
+      },
+      files: {
+        '.tmp/public/**/*.html': ['.tmp/public/min/production.min.js'],
+        'views/**/*.html': ['.tmp/public/min/production.min.js'],
+        'views/**/*.ejs': ['.tmp/public/min/production.min.js']
+      }
+    },
+
+    prodJsBuild: {
+      options: {
+        startTag: '<!--SCRIPTS-->',
+        endTag: '<!--SCRIPTS END-->',
+        fileTmpl: '<script src="%s"></script>',
+        appRoot: '.tmp/public',
+        // relative: true
+        // ^^ Uncomment this if compiling assets for use in PhoneGap, CDN, etc.
+        //    (but be note that this can break custom font URLs)
+      },
+      files: {
+        '.tmp/public/**/*.html': ['.tmp/public/dist/*.js'],
+        'views/**/*.html': ['.tmp/public/dist/*.js'],
+        'views/**/*.ejs': ['.tmp/public/dist/*.js']
+      }
+    },
+
+
+    //  ╔═╗╔╦╗╦ ╦╦  ╔═╗╔═╗╦ ╦╔═╗╔═╗╔╦╗╔═╗
+    //  ╚═╗ ║ ╚╦╝║  ║╣ ╚═╗╠═╣║╣ ║╣  ║ ╚═╗
+    //  ╚═╝ ╩  ╩ ╩═╝╚═╝╚═╝╩ ╩╚═╝╚═╝ ╩ ╚═╝
+    //  ┌─    ┬┌┐┌┌─┐┬  ┬ ┬┌┬┐┬┌┐┌┌─┐  ╔═╗╔═╗╔═╗   ┬   ┌─┐┌─┐┌┬┐┌─┐┬┬  ┌─┐┌┬┐  ╦  ╔═╗╔═╗╔═╗    ─┐
+    //  │───  │││││  │  │ │ │││││││ ┬  ║  ╚═╗╚═╗  ┌┼─  │  │ ││││├─┘││  ├┤  ││  ║  ║╣ ╚═╗╚═╗  ───│
+    //  └─    ┴┘└┘└─┘┴─┘└─┘─┴┘┴┘└┘└─┘  ╚═╝╚═╝╚═╝  └┘   └─┘└─┘┴ ┴┴  ┴┴─┘└─┘─┴┘  ╩═╝╚═╝╚═╝╚═╝    ─┘
+    devStyles: {
+      options: {
+        startTag: '<!--STYLES-->',
+        endTag: '<!--STYLES END-->',
+        fileTmpl: '<link rel="stylesheet" href="%s">',
+        appRoot: '.tmp/public'
+      },
+
+      files: {
+        '.tmp/public/**/*.html': require('../pipeline').cssFilesToInject,
+        'views/**/*.html': require('../pipeline').cssFilesToInject,
+        'views/**/*.ejs': require('../pipeline').cssFilesToInject
+      }
+    },
+
+    devStylesBuild: {
+      options: {
+        startTag: '<!--STYLES-->',
+        endTag: '<!--STYLES END-->',
+        fileTmpl: '<link rel="stylesheet" href="%s">',
+        appRoot: '.tmp/public',
+        // relative: true
+        // ^^ Uncomment this if compiling assets for use in PhoneGap, CDN, etc.
+        //    (but be note that this can break custom font URLs)
+      },
+
+      files: {
+        '.tmp/public/**/*.html': require('../pipeline').cssFilesToInject,
+        'views/**/*.html': require('../pipeline').cssFilesToInject,
+        'views/**/*.ejs': require('../pipeline').cssFilesToInject
+      }
+    },
+
+    prodStyles: {
+      options: {
+        startTag: '<!--STYLES-->',
+        endTag: '<!--STYLES END-->',
+        fileTmpl: '<link rel="stylesheet" href="%s">',
+        appRoot: '.tmp/public'
+      },
+      files: {
+        '.tmp/public/index.html': ['.tmp/public/min/production.min.css'],
+        'views/**/*.html': ['.tmp/public/min/production.min.css'],
+        'views/**/*.ejs': ['.tmp/public/min/production.min.css']
+      }
+    },
+
+    prodStylesBuild: {
+      options: {
+        startTag: '<!--STYLES-->',
+        endTag: '<!--STYLES END-->',
+        fileTmpl: '<link rel="stylesheet" href="%s">',
+        appRoot: '.tmp/public',
+        // relative: true
+        // ^^ Uncomment this if compiling assets for use in PhoneGap, CDN, etc.
+        //    (but be note that this can break custom font URLs)
+      },
+      files: {
+        '.tmp/public/index.html': ['.tmp/public/dist/*.css'],
+        'views/**/*.html': ['.tmp/public/dist/*.css'],
+        'views/**/*.ejs': ['.tmp/public/dist/*.css']
+      }
+    },
+
+  });//</ grunt.config.set() >
+
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+  // This Grunt plugin is part of the default asset pipeline in Sails,
+  // so it's already been automatically loaded for you at this point.
+  //
+  // Of course, you can always remove this Grunt plugin altogether by
+  // deleting this file.  But check this out: you can also use your
+  // _own_ custom version of this Grunt plugin.
+  //
+  // Here's how:
+  //
+  // 1. Install it as a local dependency of your Sails app:
+  //    ```
+  //    $ npm install grunt-sails-linker --save-dev --save-exact
+  //    ```
+  //
+  //
+  // 2. Then uncomment the following code:
+  //
+  // ```
+  // // Load Grunt plugin from the node_modules/ folder.
+  // grunt.loadNpmTasks('grunt-sails-linker');
+  // ```
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+};
diff --git a/ee/bulk-operations-dashboard/tasks/config/sync.js b/ee/bulk-operations-dashboard/tasks/config/sync.js
new file mode 100644
index 0000000000..23ff3b87c2
--- /dev/null
+++ b/ee/bulk-operations-dashboard/tasks/config/sync.js
@@ -0,0 +1,49 @@
+/**
+ * `tasks/config/sync`
+ *
+ * ---------------------------------------------------------------
+ *
+ * Synchronize files from the `assets` folder to `.tmp/public`,
+ * smashing anything that's already there.
+ *
+ * For more information, see:
+ *   https://sailsjs.com/anatomy/tasks/config/sync.js
+ *
+ */
+module.exports = function(grunt) {
+
+  grunt.config.set('sync', {
+    dev: {
+      files: [{
+        cwd: './assets',
+        src: ['**/*.!(coffee|less)'],
+        dest: '.tmp/public'
+      }]
+    }
+  });
+
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+  // This Grunt plugin is part of the default asset pipeline in Sails,
+  // so it's already been automatically loaded for you at this point.
+  //
+  // Of course, you can always remove this Grunt plugin altogether by
+  // deleting this file.  But check this out: you can also use your
+  // _own_ custom version of this Grunt plugin.
+  //
+  // Here's how:
+  //
+  // 1. Install it as a local dependency of your Sails app:
+  //    ```
+  //    $ npm install grunt-sync --save-dev --save-exact
+  //    ```
+  //
+  //
+  // 2. Then uncomment the following code:
+  //
+  // ```
+  // // Load Grunt plugin from the node_modules/ folder.
+  // grunt.loadNpmTasks('grunt-sync');
+  // ```
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+};
diff --git a/ee/bulk-operations-dashboard/tasks/config/uglify.js b/ee/bulk-operations-dashboard/tasks/config/uglify.js
new file mode 100644
index 0000000000..34f591c7a0
--- /dev/null
+++ b/ee/bulk-operations-dashboard/tasks/config/uglify.js
@@ -0,0 +1,64 @@
+/**
+ * `tasks/config/uglify`
+ *
+ * ---------------------------------------------------------------
+ *
+ * Minify client-side JavaScript files using UglifyES.
+ *
+ * For more information, see:
+ *   https://sailsjs.com/anatomy/tasks/config/uglify.js
+ *
+ */
+module.exports = function(grunt) {
+
+  grunt.config.set('uglify', {
+    dist: {
+      src: ['.tmp/public/concat/production.js'],
+      dest: '.tmp/public/min/production.min.js'
+    },
+    options: {
+      mangle: {
+        reserved: [
+          'AsyncFunction',
+          'SailsSocket',
+          'Promise',
+          'File',
+          'FileList',
+          'FormData',
+          'Location',
+          'RttcRefPlaceholder',
+        ],
+        keep_fnames: true//eslint-disable-line
+      },
+      compress: {
+        keep_fnames: true//eslint-disable-line
+      }
+    }
+  });
+
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+  // This Grunt plugin is part of the default asset pipeline in Sails,
+  // so it's already been automatically loaded for you at this point.
+  //
+  // Of course, you can always remove this Grunt plugin altogether by
+  // deleting this file.  But check this out: you can also use your
+  // _own_ custom version of this Grunt plugin.
+  //
+  // Here's how:
+  //
+  // 1. Install it as a local dependency of your Sails app:
+  //    ```
+  //    $ npm install grunt-contrib-uglify --save-dev --save-exact
+  //    ```
+  //
+  //
+  // 2. Then uncomment the following code:
+  //
+  // ```
+  // // Load Grunt plugin from the node_modules/ folder.
+  // grunt.loadNpmTasks('grunt-contrib-uglify');
+  // ```
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+};
+
diff --git a/ee/bulk-operations-dashboard/tasks/config/watch.js b/ee/bulk-operations-dashboard/tasks/config/watch.js
new file mode 100644
index 0000000000..611e297705
--- /dev/null
+++ b/ee/bulk-operations-dashboard/tasks/config/watch.js
@@ -0,0 +1,56 @@
+/**
+ * `tasks/config/watch`
+ *
+ * ---------------------------------------------------------------
+ *
+ * Run predefined tasks whenever certain files are added, changed or deleted.
+ *
+ * For more information, see:
+ *   https://sailsjs.com/anatomy/tasks/config/watch.js
+ *
+ */
+module.exports = function(grunt) {
+
+  grunt.config.set('watch', {
+    assets: {
+
+      // Assets to watch:
+      files: [
+        'assets/**/*',
+        'tasks/pipeline.js',
+        '!**/node_modules/**'
+      ],
+
+      // When assets are changed:
+      tasks: [
+        'syncAssets',
+        'linkAssets'
+      ]
+    }
+  });
+
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+  // This Grunt plugin is part of the default asset pipeline in Sails,
+  // so it's already been automatically loaded for you at this point.
+  //
+  // Of course, you can always remove this Grunt plugin altogether by
+  // deleting this file.  But check this out: you can also use your
+  // _own_ custom version of this Grunt plugin.
+  //
+  // Here's how:
+  //
+  // 1. Install it as a local dependency of your Sails app:
+  //    ```
+  //    $ npm install grunt-contrib-watch --save-dev --save-exact
+  //    ```
+  //
+  //
+  // 2. Then uncomment the following code:
+  //
+  // ```
+  // // Load Grunt plugin from the node_modules/ folder.
+  // grunt.loadNpmTasks('grunt-contrib-watch');
+  // ```
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+};
diff --git a/ee/bulk-operations-dashboard/tasks/pipeline.js b/ee/bulk-operations-dashboard/tasks/pipeline.js
new file mode 100644
index 0000000000..d6bb9e47e2
--- /dev/null
+++ b/ee/bulk-operations-dashboard/tasks/pipeline.js
@@ -0,0 +1,158 @@
+/**
+ * tasks/pipeline.js
+ *
+ * The order in which your CSS, JavaScript, and client-side template files
+ * injected as <script> or <link> tags.
+ *
+ * > If you are not relying on automatic asset linking, then you can safely ignore this file.
+ *
+ * For more information see:
+ *   https://sailsjs.com/anatomy/tasks/pipeline.js
+ */
+
+
+
+//  ██████╗ ██╗      █████╗ ██╗███╗   ██╗        ██████╗███████╗███████╗
+//  ██╔══██╗██║     ██╔══██╗██║████╗  ██║       ██╔════╝██╔════╝██╔════╝
+//  ██████╔╝██║     ███████║██║██╔██╗ ██║       ██║     ███████╗███████╗
+//  ██╔═══╝ ██║     ██╔══██║██║██║╚██╗██║       ██║     ╚════██║╚════██║
+//  ██║     ███████╗██║  ██║██║██║ ╚████║    ██╗╚██████╗███████║███████║
+//  ╚═╝     ╚══════╝╚═╝  ╚═╝╚═╝╚═╝  ╚═══╝    ╚═╝ ╚═════╝╚══════╝╚══════╝
+//
+//  ███████╗██╗██╗     ███████╗███████╗
+//  ██╔════╝██║██║     ██╔════╝██╔════╝
+//  █████╗  ██║██║     █████╗  ███████╗
+//  ██╔══╝  ██║██║     ██╔══╝  ╚════██║
+//  ██║     ██║███████╗███████╗███████║
+//  ╚═╝     ╚═╝╚══════╝╚══════╝╚══════╝
+//
+// CSS files to inject as <link> tags, in order.
+//
+// > Note: if you're using built-in LESS support with default settings,
+// > you'll want to change `assets/styles/importer.less` instead.
+//
+var cssFilesToInject = [
+
+  // Bring in `.css` files for themes and style guides (e.g. Bootstrap, Foundation)
+  'dependencies/**/*.css',
+
+  // All of the rest of your custom `.css` files will be injected here,
+  // in no particular order.  To customize the ordering, add additional
+  // items here, _above_ this one.
+  'styles/**/*.css'
+];
+
+
+//   ██████╗██╗     ██╗███████╗███╗   ██╗████████╗   ███████╗██╗██████╗ ███████╗
+//  ██╔════╝██║     ██║██╔════╝████╗  ██║╚══██╔══╝   ██╔════╝██║██╔══██╗██╔════╝
+//  ██║     ██║     ██║█████╗  ██╔██╗ ██║   ██║█████╗███████╗██║██║  ██║█████╗
+//  ██║     ██║     ██║██╔══╝  ██║╚██╗██║   ██║╚════╝╚════██║██║██║  ██║██╔══╝
+//  ╚██████╗███████╗██║███████╗██║ ╚████║   ██║      ███████║██║██████╔╝███████╗
+//   ╚═════╝╚══════╝╚═╝╚══════╝╚═╝  ╚═══╝   ╚═╝      ╚══════╝╚═╝╚═════╝ ╚══════╝
+//
+//          ██╗███████╗    ███████╗██╗██╗     ███████╗███████╗
+//          ██║██╔════╝    ██╔════╝██║██║     ██╔════╝██╔════╝
+//          ██║███████╗    █████╗  ██║██║     █████╗  ███████╗
+//     ██   ██║╚════██║    ██╔══╝  ██║██║     ██╔══╝  ╚════██║
+//  ██╗╚█████╔╝███████║    ██║     ██║███████╗███████╗███████║
+//  ╚═╝ ╚════╝ ╚══════╝    ╚═╝     ╚═╝╚══════╝╚══════╝╚══════╝
+//
+// Client-side javascript files to inject as <script> tags, in order.
+//
+var jsFilesToInject = [
+
+  // Load `sails.io` before everything else.
+  'dependencies/sails.io.js',
+
+  // Bring in `.js` files for any other client-side JavaScript dependencies.
+  // (e.g. Lodash, Vue.js, jQuery, Bootstrap, Ember, Angular, etc.)
+  // > Be sure to list dependencies that depend on each other in the right order!
+  'dependencies/lodash.js',
+  'dependencies/jquery.min.js',
+  'dependencies/vue.js',
+  'dependencies/vue-router.js',
+  'dependencies/**/*.js',
+
+  // First amongst the app-level files, bring in cloud configuration
+  'js/cloud.setup.js',
+
+  // Bring in components & utilities before bringing in the rest (i.e. page scripts)
+  'js/components/**/*.js',
+  'js/utilities/**/*.js',
+
+  // All of the rest of your custom client-side js files will be injected here,
+  // in no particular order.  To customize the ordering, add additional items
+  // here, _above_ this one.
+  'js/**/*.js'
+];
+
+
+//   ██████╗██╗     ██╗███████╗███╗   ██╗████████╗   ███████╗██╗██████╗ ███████╗
+//  ██╔════╝██║     ██║██╔════╝████╗  ██║╚══██╔══╝   ██╔════╝██║██╔══██╗██╔════╝
+//  ██║     ██║     ██║█████╗  ██╔██╗ ██║   ██║█████╗███████╗██║██║  ██║█████╗
+//  ██║     ██║     ██║██╔══╝  ██║╚██╗██║   ██║╚════╝╚════██║██║██║  ██║██╔══╝
+//  ╚██████╗███████╗██║███████╗██║ ╚████║   ██║      ███████║██║██████╔╝███████╗
+//   ╚═════╝╚══════╝╚═╝╚══════╝╚═╝  ╚═══╝   ╚═╝      ╚══════╝╚═╝╚═════╝ ╚══════╝
+//
+//  ████████╗███████╗███╗   ███╗██████╗ ██╗      █████╗ ████████╗███████╗███████╗
+//  ╚══██╔══╝██╔════╝████╗ ████║██╔══██╗██║     ██╔══██╗╚══██╔══╝██╔════╝██╔════╝
+//     ██║   █████╗  ██╔████╔██║██████╔╝██║     ███████║   ██║   █████╗  ███████╗
+//     ██║   ██╔══╝  ██║╚██╔╝██║██╔═══╝ ██║     ██╔══██║   ██║   ██╔══╝  ╚════██║
+//     ██║   ███████╗██║ ╚═╝ ██║██║     ███████╗██║  ██║   ██║   ███████╗███████║
+//     ╚═╝   ╚══════╝╚═╝     ╚═╝╚═╝     ╚══════╝╚═╝  ╚═╝   ╚═╝   ╚══════╝╚══════╝
+//
+// Client-side HTML templates to precompile and inject as a single <script> tag.
+// (The ordering of this array shouldn't matter.)
+//
+// > By default, Sails uses JST (~=lodash/underscore) templates and precompiles
+// > them into functions for you.  If you want to use handlebars, pug, dust, etc.,
+// > with the asset linker, no problem-- you'll just want to make sure the precompiled
+// > templates get spit out to the same file.  For information on customizing and
+// > installing your own Grunt tasks or using a different build pipeline, be sure
+// > to check out:
+// >   https://sailsjs.com/docs/concepts/assets/task-automation
+//
+var templateFilesToInject = [
+  'templates/**/*.html'
+];
+
+
+
+//  ███╗   ███╗██╗███████╗ ██████╗       ███████╗███████╗████████╗██╗   ██╗██████╗
+//  ████╗ ████║██║██╔════╝██╔════╝       ██╔════╝██╔════╝╚══██╔══╝██║   ██║██╔══██╗
+//  ██╔████╔██║██║███████╗██║            ███████╗█████╗     ██║   ██║   ██║██████╔╝
+//  ██║╚██╔╝██║██║╚════██║██║            ╚════██║██╔══╝     ██║   ██║   ██║██╔═══╝
+//  ██║ ╚═╝ ██║██║███████║╚██████╗██╗    ███████║███████╗   ██║   ╚██████╔╝██║
+//  ╚═╝     ╚═╝╚═╝╚══════╝ ╚═════╝╚═╝    ╚══════╝╚══════╝   ╚═╝    ╚═════╝ ╚═╝
+//
+// The following code exists to parse the arrays of glob expressions above, and
+// then expose them via `module.exports`.  **You should not need to change any of
+// the code below, unless you are modifying the default asset pipeline.**
+
+// Default path for public folder (see documentation on sailsjs.com for more information)
+var tmpPath = '.tmp/public/';
+
+// Prefix relative paths to source files so they point to the proper locations
+// (i.e. where the other Grunt tasks spit them out, or in some cases, where
+// they reside in the first place)
+module.exports.cssFilesToInject = cssFilesToInject.map((cssPath)=>{
+  // If we're ignoring the file, make sure the ! is at the beginning of the path
+  if (cssPath[0] === '!') {
+    return require('path').join('!' + tmpPath, cssPath.substr(1));
+  }
+  return require('path').join(tmpPath, cssPath);
+});
+module.exports.jsFilesToInject = jsFilesToInject.map((jsPath)=>{
+  // If we're ignoring the file, make sure the ! is at the beginning of the path
+  if (jsPath[0] === '!') {
+    return require('path').join('!' + tmpPath, jsPath.substr(1));
+  }
+  return require('path').join(tmpPath, jsPath);
+});
+module.exports.templateFilesToInject = templateFilesToInject.map((tplPath)=>{
+  // If we're ignoring the file, make sure the ! is at the beginning of the path
+  if (tplPath[0] === '!') {
+    return require('path').join('!assets/', tplPath.substr(1));
+  }
+  return require('path').join('assets/', tplPath);
+});
diff --git a/ee/bulk-operations-dashboard/tasks/register/build.js b/ee/bulk-operations-dashboard/tasks/register/build.js
new file mode 100644
index 0000000000..684b10ddd2
--- /dev/null
+++ b/ee/bulk-operations-dashboard/tasks/register/build.js
@@ -0,0 +1,22 @@
+/**
+ * `tasks/register/build.js`
+ *
+ * ---------------------------------------------------------------
+ *
+ * This Grunt tasklist will be executed if you run `sails www` or
+ * `grunt build` in a development environment.
+ *
+ * For more information see:
+ *   https://sailsjs.com/anatomy/tasks/register/build.js
+ *
+ */
+module.exports = function(grunt) {
+  grunt.registerTask('build', [
+    // 'polyfill:dev', //« uncomment to ALSO transpile during development (for broader browser compat.)
+    'compileAssets',
+    // 'babel',        //« uncomment to ALSO transpile during development (for broader browser compat.)
+    'linkAssetsBuild',
+    'clean:build',
+    'copy:build'
+  ]);
+};
diff --git a/ee/bulk-operations-dashboard/tasks/register/buildProd.js b/ee/bulk-operations-dashboard/tasks/register/buildProd.js
new file mode 100644
index 0000000000..67fdb8964c
--- /dev/null
+++ b/ee/bulk-operations-dashboard/tasks/register/buildProd.js
@@ -0,0 +1,30 @@
+/**
+ * `tasks/register/buildProd.js`
+ *
+ * ---------------------------------------------------------------
+ *
+ * This Grunt tasklist will be executed instead of `build` if you
+ * run `sails www` in a production environment, e.g.:
+ * `NODE_ENV=production sails www`
+ *
+ * For more information see:
+ *   https://sailsjs.com/anatomy/tasks/register/build-prod.js
+ *
+ */
+module.exports = function(grunt) {
+  grunt.registerTask('buildProd', [
+    'polyfill:prod', //« Remove this to skip transpilation in production (not recommended)
+    'compileAssets',
+    'babel',         //« Remove this to skip transpilation in production (not recommended)
+    'concat',
+    'uglify',
+    'cssmin',
+    'hash',//« Cache-busting
+    'copy:beforeLinkBuildProd',//« For prettier URLs after cache-busting
+    'linkAssetsBuildProd',
+    'clean:build',
+    'copy:build',
+    'clean:afterBuildProd'
+  ]);
+};
+
diff --git a/ee/bulk-operations-dashboard/tasks/register/compileAssets.js b/ee/bulk-operations-dashboard/tasks/register/compileAssets.js
new file mode 100644
index 0000000000..c53a02a819
--- /dev/null
+++ b/ee/bulk-operations-dashboard/tasks/register/compileAssets.js
@@ -0,0 +1,16 @@
+/**
+ * `tasks/register/compileAssets.js`
+ *
+ * ---------------------------------------------------------------
+ *
+ * For more information see:
+ *   https://sailsjs.com/anatomy/tasks/register/compile-assets.js
+ *
+ */
+module.exports = function(grunt) {
+  grunt.registerTask('compileAssets', [
+    'clean:dev',
+    'less:dev',
+    'copy:dev',
+  ]);
+};
diff --git a/ee/bulk-operations-dashboard/tasks/register/default.js b/ee/bulk-operations-dashboard/tasks/register/default.js
new file mode 100644
index 0000000000..e76605c9c7
--- /dev/null
+++ b/ee/bulk-operations-dashboard/tasks/register/default.js
@@ -0,0 +1,27 @@
+/**
+ * `tasks/register/default.js`
+ *
+ * ---------------------------------------------------------------
+ *
+ * This is the default Grunt tasklist that will be executed if you
+ * run `grunt` in the top level directory of your app.  It is also
+ * called automatically when you start Sails in development mode using
+ * `sails lift` or `node app` in a development environment.
+ *
+ * For more information see:
+ *   https://sailsjs.com/anatomy/tasks/register/default.js
+ *
+ */
+module.exports = function (grunt) {
+
+
+  grunt.registerTask('default', [
+    // 'polyfill:dev', //« uncomment to ALSO transpile during development (for broader browser compat.)
+    'compileAssets',
+    // 'babel',        //« uncomment to ALSO transpile during development (for broader browser compat.)
+    'linkAssets',
+    'watch'
+  ]);
+
+
+};
diff --git a/ee/bulk-operations-dashboard/tasks/register/linkAssets.js b/ee/bulk-operations-dashboard/tasks/register/linkAssets.js
new file mode 100644
index 0000000000..b0ac855c66
--- /dev/null
+++ b/ee/bulk-operations-dashboard/tasks/register/linkAssets.js
@@ -0,0 +1,15 @@
+/**
+ * `tasks/register/linkAssets.js`
+ *
+ * ---------------------------------------------------------------
+ *
+ * For more information see:
+ *   https://sailsjs.com/anatomy/tasks/register/link-assets.js
+ *
+ */
+module.exports = function(grunt) {
+  grunt.registerTask('linkAssets', [
+    'sails-linker:devJs',
+    'sails-linker:devStyles',
+  ]);
+};
diff --git a/ee/bulk-operations-dashboard/tasks/register/linkAssetsBuild.js b/ee/bulk-operations-dashboard/tasks/register/linkAssetsBuild.js
new file mode 100644
index 0000000000..3a05cc1243
--- /dev/null
+++ b/ee/bulk-operations-dashboard/tasks/register/linkAssetsBuild.js
@@ -0,0 +1,15 @@
+/**
+ * `tasks/register/linkAssetsBuild.js`
+ *
+ * ---------------------------------------------------------------
+ *
+ * For more information see:
+ *   https://sailsjs.com/anatomy/tasks/register/link-assets-build.js
+ *
+ */
+module.exports = function(grunt) {
+  grunt.registerTask('linkAssetsBuild', [
+    'sails-linker:devJsBuild',
+    'sails-linker:devStylesBuild',
+  ]);
+};
diff --git a/ee/bulk-operations-dashboard/tasks/register/linkAssetsBuildProd.js b/ee/bulk-operations-dashboard/tasks/register/linkAssetsBuildProd.js
new file mode 100644
index 0000000000..ac477be5b4
--- /dev/null
+++ b/ee/bulk-operations-dashboard/tasks/register/linkAssetsBuildProd.js
@@ -0,0 +1,15 @@
+/**
+ * `tasks/register/linkAssetsBuildProd.js`
+ *
+ * ---------------------------------------------------------------
+ *
+ * For more information see:
+ *   https://sailsjs.com/anatomy/tasks/register/link-assets-build-prod.js
+ *
+ */
+module.exports = function(grunt) {
+  grunt.registerTask('linkAssetsBuildProd', [
+    'sails-linker:prodJsBuild',
+    'sails-linker:prodStylesBuild',
+  ]);
+};
diff --git a/ee/bulk-operations-dashboard/tasks/register/polyfill.js b/ee/bulk-operations-dashboard/tasks/register/polyfill.js
new file mode 100644
index 0000000000..a77d82c458
--- /dev/null
+++ b/ee/bulk-operations-dashboard/tasks/register/polyfill.js
@@ -0,0 +1,28 @@
+/**
+ * `tasks/register/polyfill.js`
+ *
+ * ---------------------------------------------------------------
+ *
+ * For more information see:
+ *   https://sailsjs.com/anatomy/tasks/register/polyfill.js
+ *
+ */
+module.exports = function(grunt) {
+  grunt.registerTask('polyfill:prod', 'Add the polyfill file to the top of the list of files to concatenate', ()=>{
+    grunt.config.set('concat.js.src', [require('sails-hook-grunt/accessible/babel-polyfill')].concat(grunt.config.get('concat.js.src')));
+  });
+  grunt.registerTask('polyfill:dev', 'Add the polyfill file to the top of the list of files to copy and link', ()=>{
+    grunt.config.set('copy.dev.files', grunt.config.get('copy.dev.files').concat({
+      expand: true,
+      cwd: require('path').dirname(require('sails-hook-grunt/accessible/babel-polyfill')),
+      src: require('path').basename(require('sails-hook-grunt/accessible/babel-polyfill')),
+      dest: '.tmp/public/polyfill'
+    }));
+    var devLinkFiles = grunt.config.get('sails-linker.devJs.files');
+    grunt.config.set('sails-linker.devJs.files', Object.keys(devLinkFiles).reduce((linkerConfigSoFar, glob)=>{
+      linkerConfigSoFar[glob] = ['.tmp/public/polyfill/polyfill.min.js'].concat(devLinkFiles[glob]);
+      return linkerConfigSoFar;
+    }, {}));
+  });
+};
+
diff --git a/ee/bulk-operations-dashboard/tasks/register/prod.js b/ee/bulk-operations-dashboard/tasks/register/prod.js
new file mode 100644
index 0000000000..8188d25a97
--- /dev/null
+++ b/ee/bulk-operations-dashboard/tasks/register/prod.js
@@ -0,0 +1,26 @@
+/**
+ * `tasks/register/prod.js`
+ *
+ * ---------------------------------------------------------------
+ *
+ * This Grunt tasklist will be executed instead of `default` when
+ * your Sails app is lifted in a production environment (e.g. using
+ * `NODE_ENV=production node app`).
+ *
+ * For more information see:
+ *   https://sailsjs.com/anatomy/tasks/register/prod.js
+ *
+ */
+module.exports = function(grunt) {
+  grunt.registerTask('prod', [
+    'polyfill:prod', //« Remove this to skip transpilation in production (not recommended)
+    'compileAssets',
+    'babel',         //« Remove this to skip transpilation in production (not recommended)
+    'concat',
+    'uglify',
+    'cssmin',
+    'sails-linker:prodJs',
+    'sails-linker:prodStyles',
+  ]);
+};
+
diff --git a/ee/bulk-operations-dashboard/tasks/register/syncAssets.js b/ee/bulk-operations-dashboard/tasks/register/syncAssets.js
new file mode 100644
index 0000000000..3e0d0c97c8
--- /dev/null
+++ b/ee/bulk-operations-dashboard/tasks/register/syncAssets.js
@@ -0,0 +1,15 @@
+/**
+ * `tasks/register/syncAssets.js`
+ *
+ * ---------------------------------------------------------------
+ *
+ * For more information see:
+ *   https://sailsjs.com/anatomy/tasks/register/sync-assets.js
+ *
+ */
+module.exports = function(grunt) {
+  grunt.registerTask('syncAssets', [
+    'less:dev',
+    'sync:dev',
+  ]);
+};
diff --git a/ee/bulk-operations-dashboard/views/.eslintrc b/ee/bulk-operations-dashboard/views/.eslintrc
new file mode 100644
index 0000000000..ad4c06efcd
--- /dev/null
+++ b/ee/bulk-operations-dashboard/views/.eslintrc
@@ -0,0 +1,21 @@
+{
+  //   ╔═╗╔═╗╦  ╦╔╗╔╔╦╗┬─┐┌─┐  ┌─┐┬  ┬┌─┐┬─┐┬─┐┬┌┬┐┌─┐
+  //   ║╣ ╚═╗║  ║║║║ ║ ├┬┘│    │ │└┐┌┘├┤ ├┬┘├┬┘│ ││├┤
+  //  o╚═╝╚═╝╩═╝╩╝╚╝ ╩ ┴└─└─┘  └─┘ └┘ └─┘┴└─┴└─┴─┴┘└─┘
+  //  ┌─  ┌─┐┌─┐┬─┐  ┬┌┐┌┬  ┬┌┐┌┌─┐  ┌─┐┌─┐┬─┐┬┌─┐┌┬┐  ┌┬┐┌─┐┌─┐┌─┐  ─┐
+  //  │   ├┤ │ │├┬┘  │││││  ││││├┤   └─┐│  ├┬┘│├─┘ │    │ ├─┤│ ┬└─┐   │
+  //  └─  └  └─┘┴└─  ┴┘└┘┴─┘┴┘└┘└─┘  └─┘└─┘┴└─┴┴   ┴    ┴ ┴ ┴└─┘└─┘  ─┘
+  // > An .eslintrc configuration override for use in the `views/` directory.
+  //
+  // (This works just like assets/.eslintrc, with one minor addition)
+  //
+  // For more information see:
+  //   https://sailsjs.com/anatomy/views/.eslintrc
+  // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+  "extends": [
+    "../assets/.eslintrc"
+  ],
+  "rules": {
+    "eol-last": [0]
+  }
+}
diff --git a/ee/bulk-operations-dashboard/views/404.ejs b/ee/bulk-operations-dashboard/views/404.ejs
new file mode 100644
index 0000000000..9b76f76a65
--- /dev/null
+++ b/ee/bulk-operations-dashboard/views/404.ejs
@@ -0,0 +1,10 @@
+<div id="404">
+  <div style="max-width: 650px;" class="container text-center pt-5 pb-5">
+    <h1 class="display-1 mb-3">404</h1>
+    <hr/>
+    <h2>The page you seek doesn't exist.</h2>
+    <div>
+      <p>Think you're seeing this message in error?<br class="d-none d-sm-inline" /><span class="d-inline d-sm-none">&nbsp;</span>Please <a href="/contact">let us know.</a></p>
+    </div>
+  </div>
+</div>
diff --git a/ee/bulk-operations-dashboard/views/498.ejs b/ee/bulk-operations-dashboard/views/498.ejs
new file mode 100644
index 0000000000..2a02e2d048
--- /dev/null
+++ b/ee/bulk-operations-dashboard/views/498.ejs
@@ -0,0 +1,11 @@
+<div id="498">
+  <div style="max-width: 650px;" class="container text-center pt-5 pb-5">
+    <h1>Sorry, that link is expired, or<br class="d-none d-sm-inline" /><span class="d-inline d-sm-none">&nbsp;</span>it has already been used.</h1>
+    <hr/>
+    <div>
+      <p>Need further help accessing your account?<br class="d-none d-sm-inline" /><span class="d-inline d-sm-none">&nbsp;</span>Please <a href="/contact">contact support</a> or request a new <a href="/password/forgot">password reset.</a></p>
+      <a class="btn btn-lg btn-outline-dark" href="/password/forgot">Reset password</a>
+    </div>
+  </div>
+</div>
+<%- /* Expose locals as `window.SAILS_LOCALS` :: */ exposeLocalsToBrowser() %>
diff --git a/ee/bulk-operations-dashboard/views/500.ejs b/ee/bulk-operations-dashboard/views/500.ejs
new file mode 100644
index 0000000000..34a36ab5eb
--- /dev/null
+++ b/ee/bulk-operations-dashboard/views/500.ejs
@@ -0,0 +1,11 @@
+<div id="500">
+  <div style="max-width: 650px;" class="container text-center pt-5 pb-5">
+    <h1 class="display-1 mb-3">Oh my.</h1>
+    <hr/>
+    <h2>We've encountered an unexpected error.</h2>
+    <div>
+      <p>Need help with your account? Please <a href="/contact">let us know</a>.</p>
+      <a class="btn btn-lg btn-outline-dark" href="/contact">Open a help request</a>
+    </div>
+  </div>
+</div>
diff --git a/ee/bulk-operations-dashboard/views/emails/email-reset-password.ejs b/ee/bulk-operations-dashboard/views/emails/email-reset-password.ejs
new file mode 100644
index 0000000000..2c3df4b0dc
--- /dev/null
+++ b/ee/bulk-operations-dashboard/views/emails/email-reset-password.ejs
@@ -0,0 +1,9 @@
+<% /* Note: This is injected into `views/layouts/layout-email.ejs` */ %>
+<p style="margin-bottom: 25px;">Dear <%= fullName %>,</p>
+<p style="margin-bottom: 25px;">Someone requested a password reset for your account. If this was not you, please disregard this email. Otherwise, simply click the button below:</p>
+<div style="margin-bottom: 25px; text-align: center;">
+  <a style="background-color: #00ACC4; display: inline-block; font-size: 1.1em; color: #fff; padding: 10px 35px 10px; font-weight: 500; text-decoration: none; border-radius: 7px;" href="<%= url.resolve(sails.config.custom.baseUrl,'/password/new')+'?token='+encodeURIComponent(token) %>">Update password</a>
+</div>
+<p style="margin-bottom: 25px;">If you have any trouble, try pasting this link in your browser: <a style="color: #00ACC4; word-wrap: break-word;" href="<%= url.resolve(sails.config.custom.baseUrl,'/password/new')+'?token='+encodeURIComponent(token) %>"><%= url.resolve(sails.config.custom.baseUrl,'/password/new')+'?token='+encodeURIComponent(token) %></a></p>
+<p style="margin-bottom: 5px;">Sincerely,</p>
+<p style="margin-top: 0px;">The NEW_APP_NAME Team</p>
diff --git a/ee/bulk-operations-dashboard/views/emails/email-verify-account.ejs b/ee/bulk-operations-dashboard/views/emails/email-verify-account.ejs
new file mode 100644
index 0000000000..a7de4965e1
--- /dev/null
+++ b/ee/bulk-operations-dashboard/views/emails/email-verify-account.ejs
@@ -0,0 +1,9 @@
+<% /* Note: This is injected into `views/layouts/layout-email.ejs` */ %>
+<p style="margin-bottom: 25px;">Welcome, <%= fullName %>!</p>
+<p style="margin-bottom: 25px;">You're almost ready to get started. Just click the button below to confirm the email address for your account:</p>
+<div style="margin-bottom: 25px; text-align: center;">
+  <a style="background-color: #00ACC4; display: inline-block; font-size: 1.1em; color: #fff; padding: 10px 35px 10px; font-weight: 500; text-decoration: none; border-radius: 7px;" href="<%= url.resolve(sails.config.custom.baseUrl,'/email/confirm')+'?token='+encodeURIComponent(token) %>">Confirm email</a>
+</div>
+<p style="margin-bottom: 25px;">If you have any trouble, try pasting this link in your browser: <a style="color: #00ACC4; word-wrap: break-word;" href="<%= url.resolve(sails.config.custom.baseUrl,'/email/confirm')+'?token='+encodeURIComponent(token) %>"><%= url.resolve(sails.config.custom.baseUrl,'/email/confirm')+'?token='+encodeURIComponent(token) %></a></p>
+<p style="margin-bottom: 5px;">Sincerely,</p>
+<p style="margin-top: 0px;">The NEW_APP_NAME Team</p>
diff --git a/ee/bulk-operations-dashboard/views/emails/email-verify-new-email.ejs b/ee/bulk-operations-dashboard/views/emails/email-verify-new-email.ejs
new file mode 100644
index 0000000000..e3bfe025e2
--- /dev/null
+++ b/ee/bulk-operations-dashboard/views/emails/email-verify-new-email.ejs
@@ -0,0 +1,9 @@
+<% /* Note: This is injected into `views/layouts/layout-email.ejs` */ %>
+<p style="margin-bottom: 25px;">Dear <%= fullName %>,</p>
+<p style="margin-bottom: 25px;">You recently requested an update to the email address for your account. To verify your new email, please click the button below:</p>
+<div style="margin-bottom: 25px; text-align: center;">
+  <a style="background-color: #28AFB0; display: inline-block; font-size: 1.1em; color: #fff; padding: 10px 35px 10px; font-weight: 500; text-decoration: none; border-radius: 7px;" href="<%= url.resolve(sails.config.custom.baseUrl,'/email/confirm')+'?token='+encodeURIComponent(token) %>">Confirm email</a>
+</div>
+<p style="margin-bottom: 25px;">If you have any trouble, try pasting this link in your browser: <a style="color: #28AFB0; word-wrap: break-word;" href="<%= url.resolve(sails.config.custom.baseUrl,'/email/confirm')+'?token='+encodeURIComponent(token) %>"><%= url.resolve(sails.config.custom.baseUrl,'/email/confirm')+'?token='+encodeURIComponent(token) %></a></p>
+<p style="margin-bottom: 5px;">Sincerely,</p>
+<p style="margin-top: 0px;">The NEW_APP_NAME Team</p>
diff --git a/ee/bulk-operations-dashboard/views/emails/internal/email-contact-form.ejs b/ee/bulk-operations-dashboard/views/emails/internal/email-contact-form.ejs
new file mode 100644
index 0000000000..fbdc58d3b9
--- /dev/null
+++ b/ee/bulk-operations-dashboard/views/emails/internal/email-contact-form.ejs
@@ -0,0 +1,16 @@
+<% /* Note: Unlike other emails, this is NOT intended for use with a layout! */ %>
+<div style="background-color: #FAFAFA; width: 100%; font-family: 'Arial', 'Helvetica Neue', 'Helvetica', sans-serif; box-sizing: border-box; padding-bottom: 25px; margin: 0;">
+  <div style="background: transparent; padding-top: 30px; padding-bottom: 20px; text-align: center;">
+    <img style="display: inline-block; height: 30px; width: auto; margin-left: auto; margin-right: auto;" alt="Sails" src="https://sailsjs.com/images/logos/sails-logo_ltBg_ltBlue.png"/>
+  </div>
+  <div style="background-color: #fff; color: #000; font-size: 1em; border-top: 2px solid #00ACC4; border-bottom: 1px solid #E6E6E6; box-sizing: border-box; padding: 25px; width: 100%; max-width: 600px; margin-left: auto; margin-right: auto;">
+
+    <p style="margin-bottom: 25px;">Dear admin,</p>
+    <p style="margin-bottom: 25px;">We have received the following message through the contact form:</p>
+    <p><strong>From:</strong> <%= contactName %> &lt;<%= contactEmail %>&gt;</p>
+    <p><strong>Topic:</strong> <%= topic %></p>
+    <p style="margin-bottom: 35px;"><strong>Message:</strong> <%= message %></p>
+  </div>
+</div>
+
+
diff --git a/ee/bulk-operations-dashboard/views/layouts/layout-email.ejs b/ee/bulk-operations-dashboard/views/layouts/layout-email.ejs
new file mode 100644
index 0000000000..e32db825d6
--- /dev/null
+++ b/ee/bulk-operations-dashboard/views/layouts/layout-email.ejs
@@ -0,0 +1,22 @@
+<% /* Default layout for email templates */ %>
+<div style="background-color: #FAFAFA; width: 100%; font-family: 'Arial', 'Helvetica Neue', 'Helvetica', sans-serif; box-sizing: border-box; padding-bottom: 25px; margin: 0;">
+  <div style="background: transparent; padding-top: 30px; padding-bottom: 20px; text-align: center;">
+    <img style="display: inline-block; height: 30px; width: auto; margin-left: auto; margin-right: auto;" alt="Logo" src="http://via.placeholder.com/200x60/fafafa/000?text=YOUR+LOGO+HERE"/>
+  </div>
+  <div style="background-color: #fff; color: #000; font-size: 1em; border-top: 2px solid #00ACC4; border-bottom: 1px solid #E6E6E6; box-sizing: border-box; padding: 25px; width: 100%; max-width: 600px; margin-left: auto; margin-right: auto;">
+
+    <%- body %>
+
+  </div>
+  <div style="text-align: center; padding-top: 15px; margin-bottom: 15px; font-size: 12px;">
+    <a style="color: #00ACC4;" href="<%= url.resolve(sails.config.custom.baseUrl, '/contact') %>">Help</a>
+    <span style="color: #ccc;">&nbsp;&nbsp;|&nbsp;&nbsp;</span>
+    <a style="color: #00ACC4;" href="<%= url.resolve(sails.config.custom.baseUrl, '/faq') %>">FAQ</a>
+    <span style="color: #ccc;">&nbsp;&nbsp;|&nbsp;&nbsp;</span>
+    <a style="color: #00ACC4;" href="<%= url.resolve(sails.config.custom.baseUrl, '/legal/terms') %>">Terms of Service</a>
+    <span style="color: #ccc;">&nbsp;&nbsp;|&nbsp;&nbsp;</span>
+    <a style="color: #00ACC4;" href="<%= url.resolve(sails.config.custom.baseUrl, '/legal/privacy') %>">Privacy Policy</a>
+  </div>
+  <p style="color: #777777; padding: 0 25px; max-width: 400px; box-sizing: border-box; margin-left: auto; margin-right: auto; font-size: 10px; text-align: center;">Please do not reply to this email. To get in touch with us, visit our <a style="color: #00ACC4;" href="<%= url.resolve(sails.config.custom.baseUrl, '/contact') %>"> help center.</a> If you have not signed up for an account with us, please disregard this message.</p>
+  <p style="color: #777777; padding: 0 25px; max-width: 400px; box-sizing: border-box; margin-left: auto; margin-right: auto; font-size: 10px; text-align: center;"><em>(built with <a style="color: #00ACC4;" href="https://sailsjs.com">Sails.js</a>)</em></p>
+</div>
diff --git a/ee/bulk-operations-dashboard/views/layouts/layout.ejs b/ee/bulk-operations-dashboard/views/layouts/layout.ejs
new file mode 100644
index 0000000000..462cf4f582
--- /dev/null
+++ b/ee/bulk-operations-dashboard/views/layouts/layout.ejs
@@ -0,0 +1,233 @@
+<% if(typeof me === 'undefined') {
+  // In case we're displaying the 404 or 500 page and relevant code in the "custom" hook was not able to run,
+  // we make sure `me` exists.  This ensures we don't have to do `typeof` checks below.
+  var me = undefined;
+} %><!DOCTYPE html>
+<html>
+  <head>
+    <title>Bulk operations dashboard</title>
+
+    <% /* Viewport tag for sensible mobile support */ %>
+    <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
+
+    <% /* Script tags should normally be included further down the page- but any
+    scripts that load fonts (e.g. Fontawesome ≥v5) are special exceptions to the
+    rule. (Include them up here along with any hard-coded «link» tags for Typekit,
+    Google Fonts, etc. - above the «body» to prevent the page flickering when fonts
+    load.) */ %>
+
+    <link rel="preconnect" href="https://fonts.googleapis.com">
+    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+    <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;700&display=swap" rel="stylesheet">
+
+    <% /* Certain scripts, normally analytics tools like Google Tag Manager and
+    Google Analytics, should only be included in production: */
+    if (sails.config.environment === 'production') { %>
+    <!-- Google Analytics, Google Tag Manager, etc. -->
+    <% }
+    /* Otherwise, any such scripts are excluded, and we instead inject a
+    robots/noindex meta tag to help prevent any unwanted visits from search engines. */
+    else { %>
+    <meta name="robots" content="noindex">
+    <% } %>
+
+    <% /*
+        Stylesheets
+        ========================
+
+        Stylesheets can be hard-coded as «link» tags, automatically injected
+        by the asset pipeline between "STYLES" and "STYLES END", or both.
+        (https://sailsjs.com/docs/concepts/assets/task-automation)
+    */ %>
+
+    <% /* Auto-injected «link» tags: */ %>
+    <!--STYLES-->
+    <link rel="stylesheet" href="/dependencies/bootstrap-4/bootstrap-4.css">
+    <link rel="stylesheet" href="/dependencies/fontawesome.css">
+    <link rel="stylesheet" href="/styles/importer.css">
+    <!--STYLES END-->
+  </head>
+  <body>
+    <div purpose="page-wrap">
+      <header class="navbar navbar-expand-sm navbar flex-row justify-content-between align-items-center" purpose="page-header">
+        <a style="cursor: pointer;" class="navbar-brand mr-0" href="/"><img style="height: 20px;" class="logo" alt="Fleet logo" src="images/fleet-logo-black-118x40@2x.png"/></a>
+        <div class="navbar-nav flex-row d-none d-sm-flex">
+          <!-- LOGGED-IN NAVIGATION -->
+          <a class="nav-item nav-link mr-3 d-flex align-items-center" href="/profiles">Configuration profiles</a>
+          <a class="nav-item nav-link ml-3 mr-3 d-flex align-items-center" href="/scripts">Scripts</a>
+          <% if(me) { %>
+          <a class="nav-item nav-link ml-3 d-flex align-items-center" href="/logout">Sign out</a>
+          <% } else { %>
+          <a class="nav-item nav-link ml-3 d-flex align-items-center mr-2" href="/login">Log in</a>
+          <% } %>
+        </div>
+        <div class="nav-item dropdown d-block d-sm-none">
+          <a class="nav-link nav-item d-flex" id="header-account-menu-link" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false"><img class="align-self-center" alt="An icon indicating that interacting with this button will open the navigation menu." style="height: 16px;" src="/images/icon-hamburger-blue-16x14@2x.png"/></a>
+          <div style="left: auto; right: 0;" class="dropdown-menu" aria-labelledby="header-account-menu-link">
+            <a class="dropdown-item nav-link" href="/dashboard">Configuration profiles</a>
+            <a class="dropdown-item nav-link" href="/patch-progress">Scripts</a>
+            <% if(me) { %>
+            <a class="dropdown-item nav-link" href="/logout">Sign out</a>
+            <% } else { %>
+            <a class="dropdown-item nav-link" href="/login">Log in</a>
+            <% } %>
+          </div>
+        </div>
+      </header>
+
+
+      <!-- Alert if email has not been confirmed -->
+      <% if(me&&me.emailChangeCandidate) { %>
+      <div class="container-fluid">
+        <div class="alert alert-secondary mt-2 small" role="alert">
+        Your updated email address needs verification. Until you click the link sent to <strong><%= me.emailChangeCandidate %></strong>, you'll still need to sign in as <strong><%= me.emailAddress %></strong>.
+        </div>
+      </div>
+      <% } else if(me&&me.emailStatus === 'unconfirmed') { %>
+      <div class="container-fluid">
+        <div class="alert alert-secondary mt-2 small" role="alert">
+        Your email address still needs verification. Your account access may be limited until you click the link sent to <strong><%= me.emailChangeCandidate ? me.emailChangeCandidate : me.emailAddress%></strong>.
+        </div>
+      </div>
+      <% } %>
+
+      <%- body %>
+
+      <footer class="w-100 px-4 d-flex justify-content-end" style="position: absolute; bottom: 1rem;">
+        <a style="cursor: pointer;" class="navbar-brand mr-0" href="https://fleetdm.com"><img style="height: 24px;" class="logo" alt="Powered by Fleet" src="/images/powered-by-fleet-159x24@2x.png"/></a>
+      </footer>
+    </div>
+
+
+    <% /*
+      Client-side JavaScript
+      ========================
+
+      Scripts can be hard-coded as «script» tags, automatically injected
+      by the asset pipeline between "SCRIPTS" and "SCRIPTS END", or both.
+      (https://sailsjs.com/docs/concepts/assets/task-automation)
+    */ %>
+
+    <%/* Stripe.js */%>
+    <script src="https://js.stripe.com/v3/"></script>
+
+    <% /* Delete the global `self` to help avoid client-side bugs.
+    (see https://developer.mozilla.org/en-US/docs/Web/API/Window/self) */ %>
+    <script>delete window.self;</script>
+
+    <%/* bowser.js (for browser detection) -- included inline to avoid issues with minification that could affect the unsupported browser overlay */%>
+    <script>!function(e,i,s){if("undefined"!=typeof module&&module.exports)module.exports=s();else if("function"==typeof define&&define.amd)define(i,s);else e[i]=s()}(this,"bowser",function(){var e=true;function i(i){function s(e){var s=i.match(e);return s&&s.length>1&&s[1]||""}function o(e){var s=i.match(e);return s&&s.length>1&&s[2]||""}var r=s(/(ipod|iphone|ipad)/i).toLowerCase(),n=/like android/i.test(i),t=!n&&/android/i.test(i),a=/nexus\s*[0-6]\s*/i.test(i),d=!a&&/nexus\s*[0-9]+/i.test(i),l=/CrOS/.test(i),f=/silk/i.test(i),m=/sailfish/i.test(i),v=/tizen/i.test(i),p=/(web|hpw)os/i.test(i),c=/windows phone/i.test(i),u=/SamsungBrowser/i.test(i),h=!c&&/windows/i.test(i),w=!r&&!f&&/macintosh/i.test(i),b=!t&&!m&&!v&&!p&&/linux/i.test(i),g=o(/edg([ea]|ios)\/(\d+(\.\d+)?)/i),k=s(/version\/(\d+(\.\d+)?)/i),x=/tablet/i.test(i)&&!/tablet pc/i.test(i),y=!x&&/[^-]mobi/i.test(i),S=/xbox/i.test(i),B;if(/opera/i.test(i))B={name:"Opera",opera:e,version:k||s(/(?:opera|opr|opios)[\s\/](\d+(\.\d+)?)/i)};else if(/opr\/|opios/i.test(i))B={name:"Opera",opera:e,version:s(/(?:opr|opios)[\s\/](\d+(\.\d+)?)/i)||k};else if(/SamsungBrowser/i.test(i))B={name:"Samsung Internet for Android",samsungBrowser:e,version:k||s(/(?:SamsungBrowser)[\s\/](\d+(\.\d+)?)/i)};else if(/coast/i.test(i))B={name:"Opera Coast",coast:e,version:k||s(/(?:coast)[\s\/](\d+(\.\d+)?)/i)};else if(/yabrowser/i.test(i))B={name:"Yandex Browser",yandexbrowser:e,version:k||s(/(?:yabrowser)[\s\/](\d+(\.\d+)?)/i)};else if(/ucbrowser/i.test(i))B={name:"UC Browser",ucbrowser:e,version:s(/(?:ucbrowser)[\s\/](\d+(?:\.\d+)+)/i)};else if(/mxios/i.test(i))B={name:"Maxthon",maxthon:e,version:s(/(?:mxios)[\s\/](\d+(?:\.\d+)+)/i)};else if(/epiphany/i.test(i))B={name:"Epiphany",epiphany:e,version:s(/(?:epiphany)[\s\/](\d+(?:\.\d+)+)/i)};else if(/puffin/i.test(i))B={name:"Puffin",puffin:e,version:s(/(?:puffin)[\s\/](\d+(?:\.\d+)?)/i)};else if(/sleipnir/i.test(i))B={name:"Sleipnir",sleipnir:e,version:s(/(?:sleipnir)[\s\/](\d+(?:\.\d+)+)/i)};else if(/k-meleon/i.test(i))B={name:"K-Meleon",kMeleon:e,version:s(/(?:k-meleon)[\s\/](\d+(?:\.\d+)+)/i)};else if(c){B={name:"Windows Phone",osname:"Windows Phone",windowsphone:e};if(g){B.msedge=e;B.version=g}else{B.msie=e;B.version=s(/iemobile\/(\d+(\.\d+)?)/i)}}else if(/msie|trident/i.test(i))B={name:"Internet Explorer",msie:e,version:s(/(?:msie |rv:)(\d+(\.\d+)?)/i)};else if(l)B={name:"Chrome",osname:"Chrome OS",chromeos:e,chromeBook:e,chrome:e,version:s(/(?:chrome|crios|crmo)\/(\d+(\.\d+)?)/i)};else if(/edg([ea]|ios)/i.test(i))B={name:"Microsoft Edge",msedge:e,version:g};else if(/vivaldi/i.test(i))B={name:"Vivaldi",vivaldi:e,version:s(/vivaldi\/(\d+(\.\d+)?)/i)||k};else if(m)B={name:"Sailfish",osname:"Sailfish OS",sailfish:e,version:s(/sailfish\s?browser\/(\d+(\.\d+)?)/i)};else if(/seamonkey\//i.test(i))B={name:"SeaMonkey",seamonkey:e,version:s(/seamonkey\/(\d+(\.\d+)?)/i)};else if(/firefox|iceweasel|fxios/i.test(i)){B={name:"Firefox",firefox:e,version:s(/(?:firefox|iceweasel|fxios)[ \/](\d+(\.\d+)?)/i)};if(/\((mobile|tablet);[^\)]*rv:[\d\.]+\)/i.test(i)){B.firefoxos=e;B.osname="Firefox OS"}}else if(f)B={name:"Amazon Silk",silk:e,version:s(/silk\/(\d+(\.\d+)?)/i)};else if(/phantom/i.test(i))B={name:"PhantomJS",phantom:e,version:s(/phantomjs\/(\d+(\.\d+)?)/i)};else if(/slimerjs/i.test(i))B={name:"SlimerJS",slimer:e,version:s(/slimerjs\/(\d+(\.\d+)?)/i)};else if(/blackberry|\bbb\d+/i.test(i)||/rim\stablet/i.test(i))B={name:"BlackBerry",osname:"BlackBerry OS",blackberry:e,version:k||s(/blackberry[\d]+\/(\d+(\.\d+)?)/i)};else if(p){B={name:"WebOS",osname:"WebOS",webos:e,version:k||s(/w(?:eb)?osbrowser\/(\d+(\.\d+)?)/i)};/touchpad\//i.test(i)&&(B.touchpad=e)}else if(/bada/i.test(i))B={name:"Bada",osname:"Bada",bada:e,version:s(/dolfin\/(\d+(\.\d+)?)/i)};else if(v)B={name:"Tizen",osname:"Tizen",tizen:e,version:s(/(?:tizen\s?)?browser\/(\d+(\.\d+)?)/i)||k};else if(/qupzilla/i.test(i))B={name:"QupZilla",qupzilla:e,version:s(/(?:qupzilla)[\s\/](\d+(?:\.\d+)+)/i)||k};else if(/chromium/i.test(i))B={name:"Chromium",chromium:e,version:s(/(?:chromium)[\s\/](\d+(?:\.\d+)?)/i)||k};else if(/chrome|crios|crmo/i.test(i))B={name:"Chrome",chrome:e,version:s(/(?:chrome|crios|crmo)\/(\d+(\.\d+)?)/i)};else if(t)B={name:"Android",version:k};else if(/safari|applewebkit/i.test(i)){B={name:"Safari",safari:e};if(k)B.version=k}else if(r){B={name:"iphone"==r?"iPhone":"ipad"==r?"iPad":"iPod"};if(k)B.version=k}else if(/googlebot/i.test(i))B={name:"Googlebot",googlebot:e,version:s(/googlebot\/(\d+(\.\d+))/i)||k};else B={name:s(/^(.*)\/(.*) /),version:o(/^(.*)\/(.*) /)};if(!B.msedge&&/(apple)?webkit/i.test(i)){if(/(apple)?webkit\/537\.36/i.test(i)){B.name=B.name||"Blink";B.blink=e}else{B.name=B.name||"Webkit";B.webkit=e}if(!B.version&&k)B.version=k}else if(!B.opera&&/gecko\//i.test(i)){B.name=B.name||"Gecko";B.gecko=e;B.version=B.version||s(/gecko\/(\d+(\.\d+)?)/i)}if(!B.windowsphone&&(t||B.silk)){B.android=e;B.osname="Android"}else if(!B.windowsphone&&r){B[r]=e;B.ios=e;B.osname="iOS"}else if(w){B.mac=e;B.osname="macOS"}else if(S){B.xbox=e;B.osname="Xbox"}else if(h){B.windows=e;B.osname="Windows"}else if(b){B.linux=e;B.osname="Linux"}function O(e){switch(e){case"NT":return"NT";case"XP":return"XP";case"NT 5.0":return"2000";case"NT 5.1":return"XP";case"NT 5.2":return"2003";case"NT 6.0":return"Vista";case"NT 6.1":return"7";case"NT 6.2":return"8";case"NT 6.3":return"8.1";case"NT 10.0":return"10";default:return undefined}}var T="";if(B.windows)T=O(s(/Windows ((NT|XP)( \d\d?.\d)?)/i));else if(B.windowsphone)T=s(/windows phone (?:os)?\s?(\d+(\.\d+)*)/i);else if(B.mac){T=s(/Mac OS X (\d+([_\.\s]\d+)*)/i);T=T.replace(/[_\s]/g,".")}else if(r){T=s(/os (\d+([_\s]\d+)*) like mac os x/i);T=T.replace(/[_\s]/g,".")}else if(t)T=s(/android[ \/-](\d+(\.\d+)*)/i);else if(B.webos)T=s(/(?:web|hpw)os\/(\d+(\.\d+)*)/i);else if(B.blackberry)T=s(/rim\stablet\sos\s(\d+(\.\d+)*)/i);else if(B.bada)T=s(/bada\/(\d+(\.\d+)*)/i);else if(B.tizen)T=s(/tizen[\/\s](\d+(\.\d+)*)/i);if(T)B.osversion=T;var P=!B.windows&&T.split(".")[0];if(x||d||"ipad"==r||t&&(3==P||P>=4&&!y)||B.silk)B.tablet=e;else if(y||"iphone"==r||"ipod"==r||t||a||B.blackberry||B.webos||B.bada)B.mobile=e;if(B.msedge||B.msie&&B.version>=10||B.yandexbrowser&&B.version>=15||B.vivaldi&&B.version>=1||B.chrome&&B.version>=20||B.samsungBrowser&&B.version>=4||B.firefox&&B.version>=20||B.safari&&B.version>=6||B.opera&&B.version>=10||B.ios&&B.osversion&&B.osversion.split(".")[0]>=6||B.blackberry&&B.version>=10.1||B.chromium&&B.version>=20)B.a=e;else if(B.msie&&B.version<10||B.chrome&&B.version<20||B.firefox&&B.version<20||B.safari&&B.version<6||B.opera&&B.version<10||B.ios&&B.osversion&&B.osversion.split(".")[0]<6||B.chromium&&B.version<20)B.c=e;else B.x=e;return B}var s=i("undefined"!==typeof navigator?navigator.userAgent||"":"");s.test=function(e){for(var i=0;i<e.length;++i){var o=e[i];if("string"===typeof o)if(o in s)return true}return false};function o(e){return e.split(".").length}function r(e,i){var s=[],o;if(Array.prototype.map)return Array.prototype.map.call(e,i);for(o=0;o<e.length;o++)s.push(i(e[o]));return s}function n(e){var i=Math.max(o(e[0]),o(e[1]));var s=r(e,function(e){var s=i-o(e);e+=new Array(s+1).join(".0");return r(e.split("."),function(e){return new Array(20-e.length).join("0")+e}).reverse()});while(--i>=0)if(s[0][i]>s[1][i])return 1;else if(s[0][i]===s[1][i]){if(0===i)return 0}else return-1}function t(e,o,r){var t=s;if("string"===typeof o){r=o;o=void 0}if(void 0===o)o=false;if(r)t=i(r);var a=""+t.version;for(var d in e)if(e.hasOwnProperty(d))if(t[d]){if("string"!==typeof e[d])throw new Error("Browser version in the minVersion map should be a string: "+d+": "+String(e));return n([a,e[d]])<0}return o}function a(e,i,s){return!t(e,i,s)}s.isUnsupportedBrowser=t;s.compareVersions=n;s.check=a;s._detect=i;s.detect=i;return s});</script>
+
+    <% /* Auto-injected «script» tags: */ %>
+    <!--SCRIPTS-->
+    <script src="/dependencies/sails.io.js"></script>
+    <script src="/dependencies/lodash.js"></script>
+    <script src="/dependencies/jquery.min.js"></script>
+    <script src="/dependencies/vue.js"></script>
+    <script src="/dependencies/vue-router.js"></script>
+    <script src="/dependencies/bootstrap-4/bootstrap-4.bundle.js"></script>
+    <script src="/dependencies/cloud.js"></script>
+    <script src="/dependencies/moment.js"></script>
+    <script src="/dependencies/parasails.js"></script>
+    <script src="/js/cloud.setup.js"></script>
+    <script src="/js/components/account-notification-banner.component.js"></script>
+    <script src="/js/components/ajax-button.component.js"></script>
+    <script src="/js/components/ajax-form.component.js"></script>
+    <script src="/js/components/cloud-error.component.js"></script>
+    <script src="/js/components/file-upload.component.js"></script>
+    <script src="/js/components/js-timestamp.component.js"></script>
+    <script src="/js/components/modal.component.js"></script>
+    <script src="/js/components/multifield.component.js"></script>
+    <script src="/js/components/stripe-card-element.component.js"></script>
+    <script src="/js/utilities/get-mimetype-icon-class.js"></script>
+    <script src="/js/utilities/open-stripe-checkout.js"></script>
+    <script src="/js/pages/account/account-overview.page.js"></script>
+    <script src="/js/pages/account/edit-password.page.js"></script>
+    <script src="/js/pages/account/edit-profile.page.js"></script>
+    <script src="/js/pages/contact.page.js"></script>
+    <script src="/js/pages/dashboard/welcome.page.js"></script>
+    <script src="/js/pages/entrance/confirmed-email.page.js"></script>
+    <script src="/js/pages/entrance/forgot-password.page.js"></script>
+    <script src="/js/pages/entrance/login.page.js"></script>
+    <script src="/js/pages/entrance/new-password.page.js"></script>
+    <script src="/js/pages/entrance/signup.page.js"></script>
+    <script src="/js/pages/faq.page.js"></script>
+    <script src="/js/pages/homepage.page.js"></script>
+    <script src="/js/pages/legal/privacy.page.js"></script>
+    <script src="/js/pages/legal/terms.page.js"></script>
+    <script src="/js/pages/profiles.page.js"></script>
+    <script src="/js/pages/scripts.page.js"></script>
+    <!--SCRIPTS END-->
+
+    <% /* Display an overlay if the current browser is not supported.
+    (Relies on `bowser`, which is loaded inline above.) */ %>
+    <script>
+    (function(){
+      if (typeof bowser !== 'undefined') {
+        // --------------------------------------------------------------------
+        // Additional compatibility tips:
+        //
+        // • The browser/OS compatibility below is determined by the needs of Vue.js and Bootstrap.js.
+        // • All browsers on Windows XP are probably unsupported (because of compatibility issues with modern SSL certs)
+        // • See https://getbootstrap.com/docs/4.0/getting-started/browsers-devices/
+        // • See also https://github.com/vuejs/vue/tree/0e5306658ad7b83c553a6a3eeedb15f9066ab063#browser-compatibility
+        // • For more info, see:
+        //    - https://github.com/lancedikson/bowser/blob/1fb99ced0e8834fd9662604bad7e0f0c3eba2786/test/test.js#L110-L123
+        //    - https://github.com/lancedikson/bowser/tree/1fb99ced0e8834fd9662604bad7e0f0c3eba2786#rendering-engine-flags
+        // --------------------------------------------------------------------
+        var LATEST_SUPPORTED_VERSION_BY_OS = {
+          iOS: '10',//« earliest version to eliminate rare bug where `window.location` doesn't exist momentarily after doing a server-side redirect
+          Android: '6'
+        };
+        var LATEST_SUPPORTED_VERSION_BY_USER_AGENT = {
+          msedge: '16',
+          msie: '11',
+          safari: '10',//« earliest version to eliminate rare bug where `window.location` doesn't exist momentarily after doing a server-side redirect
+          firefox: '28',//« earliest version to support both ES5 (for Vue.js) and unprefixed flexbox (for Bootstrap 4)
+          chrome: '29',//« earliest version to support both ES5 (for Vue.js) and unprefixed flexbox (for Bootstrap 4)
+          opera: '17',//« earliest version to support both ES5 (for Vue.js) and unprefixed flexbox (for Bootstrap 4)
+        };
+        var LATEST_SUPPORTED_VERSION_BY_BROWSER_NAME = {
+          'microsoft edge': LATEST_SUPPORTED_VERSION_BY_USER_AGENT.msedge,
+          'internet explorer': LATEST_SUPPORTED_VERSION_BY_USER_AGENT.msie,
+          'safari': LATEST_SUPPORTED_VERSION_BY_USER_AGENT.safari,
+          'firefox': LATEST_SUPPORTED_VERSION_BY_USER_AGENT.firefox,
+          'chrome': LATEST_SUPPORTED_VERSION_BY_USER_AGENT.chrome,
+          'opera': LATEST_SUPPORTED_VERSION_BY_USER_AGENT.opera
+        };
+        var isUnsupportedBrowser = (
+          bowser.isUnsupportedBrowser(LATEST_SUPPORTED_VERSION_BY_USER_AGENT, window.navigator.userAgent)
+        );
+        var isUnsupportedOS = (
+          LATEST_SUPPORTED_VERSION_BY_OS[bowser.osname] &&
+          bowser.compareVersions([bowser.osversion, LATEST_SUPPORTED_VERSION_BY_OS[bowser.osname]]) < 0
+        );
+        if (isUnsupportedBrowser || isUnsupportedOS) {
+          document.body.innerHTML =
+          '<div class="container browser-warning-message text-center">'+
+          '  <a href="https://sailsjs.com/support">'+
+          '<img style="display: block; height: 75px; width: auto; margin: 0 auto 15px;" alt="Logo" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAASwAAABxCAYAAABvGp7oAAAMKWlDQ1BJQ0MgUHJvZmlsZQAASImVVwdYU8kWnluSkJDQAqFICb2J0qvU0AIISBVshCSQUEJMCCp2VFRgLaiIYkVXRRRdCyCLDXtZBOz1YUFFWRdXsaHyJgmgq99773vn++be/545c85/zp2ZbwYA9ViOWJyDagCQK8qXxIUFMcenpDJJjwACtIEu0AOqHK5UHBgbGwWgDL3/Ke9uQGsoVx3kvn7u/6+iyeNLuQAgsRCn86TcXIgPAYC7c8WSfAAIPVBvPi1fDDERsgTaEkgQYgs5zlRiTzlOV+IohU1CHAviNABUqByOJBMANTkvZgE3E/pRK4PYUcQTiiBuhtiPK+DwIP4M8cjc3DyI1W0gtkn/zk/mP3ymD/vkcDKHsTIXhagEC6XiHM6M/7Mc/1tyc2RDMcxhowok4XHynOV1y86LlGMqxOdF6dExEGtBfE3IU9jL8VOBLDxx0P4DV8qCNQMMAFAqjxMcCbEhxGainOioQb1fhjCUDTGsPZogzGcnKMeiPEle3KB/dDpfGhI/hDkSRSy5TYksOzFw0OcmAZ895LOpUJCQrOSJthUIk6IhVoP4njQ7PnLQ5kWhgBU9ZCORxck5w3+OgQxJaJzSBrPIlQ7lhXkLhOzoQRyVL0gIV47FJnM5Cm56EGfxpeOjhnjy+MEhyrywIr4ocZA/Vi7OD4obtN8uzokdtMea+Tlhcr0ZxK3Sgvihsb35cLIp88WBOD82QckN187iRMQqOeB2IAqwQDBgAhls6SAPZAFha09DD/xS9oQCDpCATMAHDoOaoRHJih4RfMaDQvAnRHwgHR4XpOjlgwKo/zKsVT4dQIait0AxIhs8hTgXRIIc+C1TjBINR0sCT6BG+FN0LuSaA5u87ycdU31IRwwhBhPDiaFEW9wA98N98Cj4DIDNGffEvYZ4fbMnPCW0Ex4RrhM6CbenCIskPzBngrGgE3IMHcwu/fvscCvo1Q0Pwn2hf+gbZ+AGwAF3hZECcX8Y2w1qv+cqG874Wy0HfZEdyShZlxxAtvmRgZqdmtuwF3mlvq+Fklf6cLVYwz0/5sH6rn48+I780RJbgh3EzmEnsQtYM9YAmNhxrBG7jB2V4+G58UQxN4aixSn4ZEM/wp/icQZjyqsmdax17Hb8PNgH8vnT8+WLhZUnniERZgrymYFwt+Yz2SLuqJFMZ0cnuIvK937l1vKGodjTEcbFb7qitwD48gYGBpq/6aLgmjy0CADK028662NwOesCcL6UK5MUKHW4/EEAFKAOV4o+MIZ7lw3MyBm4Ax8QAEJABIgBCSAFTIZ1FsB5KgHTwCwwHxSDUrACrAHrwWawDewCe8EB0ACawUlwFlwCbeA6uAvnShd4CXrBO9CPIAgJoSF0RB8xQSwRe8QZ8UT8kBAkColDUpA0JBMRITJkFrIAKUXKkfXIVqQG+Q05gpxELiDtyG3kIdKN/I18QjGUimqjRqgVOhr1RAPRSDQBnYRmolPRQnQhugytRKvRPWg9ehK9hF5HO9GXaB8GMFWMgZliDpgnxsJisFQsA5Ngc7ASrAKrxuqwJvinr2KdWA/2ESfidJyJO8D5Go4n4lx8Kj4HL8PX47vwevw0fhV/iPfiXwk0giHBnuBNYBPGEzIJ0wjFhArCDsJhwhm4droI74hEIoNoTfSAay+FmEWcSSwjbiTuI54gthMfE/tIJJI+yZ7kS4ohcUj5pGLSOtIe0nFSB6mL9EFFVcVExVklVCVVRaRSpFKhslvlmEqHyjOVfrIG2ZLsTY4h88gzyMvJ28lN5CvkLnI/RZNiTfGlJFCyKPMplZQ6yhnKPcobVVVVM1Uv1XGqQtV5qpWq+1XPqz5U/UjVotpRWdSJVBl1GXUn9QT1NvUNjUazogXQUmn5tGW0Gtop2gPaBzW62ig1thpPba5alVq9WofaK3WyuqV6oPpk9UL1CvWD6lfUezTIGlYaLA2OxhyNKo0jGjc1+jTpmk6aMZq5mmWauzUvaD7XImlZaYVo8bQWam3TOqX1mI7RzeksOpe+gL6dfobepU3UttZma2dpl2rv1W7V7tXR0nHVSdKZrlOlc1Snk4ExrBhsRg5jOeMA4wbjk66RbqAuX3epbp1uh+57vRF6AXp8vRK9fXrX9T7pM/VD9LP1V+o36N83wA3sDMYZTDPYZHDGoGeE9gifEdwRJSMOjLhjiBraGcYZzjTcZnjZsM/I2CjMSGy0zuiUUY8xwzjAOMt4tfEx424TuomfidBktclxkxdMHWYgM4dZyTzN7DU1NA03lZluNW017TezNks0KzLbZ3bfnGLuaZ5hvtq8xbzXwsRirMUsi1qLO5ZkS09LgeVay3OW762srZKtFls1WD231rNmWxda11rfs6HZ+NtMtam2uWZLtPW0zbbdaNtmh9q52Qnsquyu2KP27vZC+4327SMJI71GikZWj7zpQHUIdChwqHV4OIoxKmpU0aiGUa9GW4xOHb1y9LnRXx3dHHMctzveddJyinAqcmpy+tvZzpnrXOV8zYXmEuoy16XR5bWrvSvfdZPrLTe621i3xW4tbl/cPdwl7nXu3R4WHmkeGzxuemp7xnqWeZ73IngFec31avb66O3une99wPsvHwefbJ/dPs/HWI/hj9k+5rGvmS/Hd6tvpx/TL81vi1+nv6k/x7/a/1GAeQAvYEfAs0DbwKzAPYGvghyDJEGHg96zvFmzWSeCseCw4JLg1hCtkMSQ9SEPQs1CM0NrQ3vD3MJmhp0IJ4RHhq8Mv8k2YnPZNezeCI+I2RGnI6mR8ZHrIx9F2UVJoprGomMjxq4aey/aMloU3RADYtgxq2Lux1rHTo39fRxxXOy4qnFP45ziZsWdi6fHT4nfHf8uIShhecLdRJtEWWJLknrSxKSapPfJwcnlyZ3jR4+fPf5SikGKMKUxlZSalLojtW9CyIQ1E7omuk0snnhjkvWk6ZMuTDaYnDP56BT1KZwpB9MIaclpu9M+c2I41Zy+dHb6hvReLou7lvuSF8Bbzevm+/LL+c8yfDPKM55n+mauyuwW+AsqBD1ClnC98HVWeNbmrPfZMdk7swdyknP25arkpuUeEWmJskWn84zzpue1i+3FxeLOqd5T10ztlURKdkgR6SRpY742PGRfltnIFskeFvgVVBV8mJY07eB0zemi6Zdn2M1YOuNZYWjhrzPxmdyZLbNMZ82f9XB24Oytc5A56XNa5prPXTi3a17YvF3zKfOz5/9R5FhUXvR2QfKCpoVGC+ctfLwobFFtsVqxpPjmYp/Fm5fgS4RLWpe6LF239GsJr+RiqWNpRennMm7ZxV+cfqn8ZWBZxrLW5e7LN60grhCtuLHSf+Wucs3ywvLHq8auql/NXF2y+u2aKWsuVLhWbF5LWStb21kZVdm4zmLdinWf1wvWX68Kqtq3wXDD0g3vN/I2dmwK2FS32Whz6eZPW4Rbbm0N21pfbVVdsY24rWDb0+1J28/96vlrzQ6DHaU7vuwU7ezcFbfrdI1HTc1uw93La9FaWW33nol72vYG722sc6jbuo+xr3Q/2C/b/+K3tN9uHIg80HLQ82DdIctDGw7TD5fUI/Uz6nsbBA2djSmN7UcijrQ0+TQd/n3U7zubTZurjuocXX6McmzhsYHjhcf7TohP9JzMPPm4ZUrL3VPjT107Pe5065nIM+fPhp49dS7w3PHzvuebL3hfOHLR82LDJfdL9ZfdLh/+w+2Pw63urfVXPK40tnm1NbWPaT/W4d9x8mrw1bPX2NcuXY++3n4j8catmxNvdt7i3Xp+O+f26zsFd/rvzrtHuFdyX+N+xQPDB9X/sv3Xvk73zqMPgx9efhT/6O5j7uOXT6RPPnctfEp7WvHM5FnNc+fnzd2h3W0vJrzoeil+2d9T/Kfmnxte2bw69FfAX5d7x/d2vZa8Hvi77I3+m51vXd+29MX2PXiX+67/fckH/Q+7Pnp+PPcp+dOz/mmfSZ8rv9h+afoa+fXeQO7AgJgj4SiOAhhsaEYGAH/vBICWAgC9DZ4fJijvZgpBlPdJBQL/CSvvbwpxB6AOvuTHcNYJAPbDZjUP+g4AQH4ETwgAqIvLcBsUaYaLs9IXFd5YCB8GBt4YAUBqAuCLZGCgf+PAwJftkOxtAE5MVd4J5SK/g25xlKMOk4PgR/k3go9xAQNCqCIAAAAJcEhZcwAACxMAAAsTAQCanBgAAAILaVRYdFhNTDpjb20uYWRvYmUueG1wAAAAAAA8eDp4bXBtZXRhIHhtbG5zOng9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJYTVAgQ29yZSA1LjQuMCI+CiAgIDxyZGY6UkRGIHhtbG5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8yMi1yZGYtc3ludGF4LW5zIyI+CiAgICAgIDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiCiAgICAgICAgICAgIHhtbG5zOnRpZmY9Imh0dHA6Ly9ucy5hZG9iZS5jb20vdGlmZi8xLjAvIj4KICAgICAgICAgPHRpZmY6UmVzb2x1dGlvblVuaXQ+MjwvdGlmZjpSZXNvbHV0aW9uVW5pdD4KICAgICAgICAgPHRpZmY6Q29tcHJlc3Npb24+MTwvdGlmZjpDb21wcmVzc2lvbj4KICAgICAgICAgPHRpZmY6T3JpZW50YXRpb24+MTwvdGlmZjpPcmllbnRhdGlvbj4KICAgICAgICAgPHRpZmY6UGhvdG9tZXRyaWNJbnRlcnByZXRhdGlvbj4yPC90aWZmOlBob3RvbWV0cmljSW50ZXJwcmV0YXRpb24+CiAgICAgIDwvcmRmOkRlc2NyaXB0aW9uPgogICA8L3JkZjpSREY+CjwveDp4bXBtZXRhPgoPRSqTAAA28ElEQVR4Ae19CZwdRbV3Vfe9d2YyQBIyk5BkksyEAEJAwCAqPCUBPxfUpyiJ6MPoU1z4VFYf8lOUARVFyQL6qfghSxB8hA/9XD7f5/YyqDwXREANKAbIMglkYQkkmZl7u7ve/3+qe+bOnbv0zNzZ7nT9pqf7Vp86derUqVOnttNKJSHhQMKBhAMJBxIOJBxIODCqHGhvdxSvJCQcSDiQcGDccsAqqlQvfcbo3ufkIeFAwoGEA+OCA1RM7e29imrGmnVHN61ed5LQVqOWVm9hx0UFJEQkHEg4EIcDVFSu0toDsNe05vbZWpv/qbR7hfb9qxH3RzV7tot7EAfZRIJJFNZEqq2E1oQD69e7asUKHwrLm7bmlmkp5VwEvfRxnWk4VKczKti/90AtMylRWLVcu0nZaocDy6GoFj9iRFlt2JBqfmjbh1G4y3XDlBbT06NMd3e3ct16ZXRNT7onCqt2RDopSS1ygPNUV13lqvYVnrpbqZmrbztLPbTtalXfcKzJ5ZTpOsBhIYaHCm259ufaE4VVi0KelKk2OMAJ9XCeauaq24832lyjMpkzWThYVFBUhtaUbcPGqivcajokCqumqzcp3ITkQLTCh3mqQ2/4ziEp37/SKHOhrm9wTfeBcCJd92+7tW9cSVX2L/SErN2E6IQDNcSB9g0p1b6MwzzVvHbdcuUHX1YNja2q60BoVRUoqhoqepyiJAorDpcSmIQDI82BXqtqmTf9+nXzU0avxarfWSoI7DyVxjyVMZO+vU56Boy0HCb4Ew5U5ECeVdW0dt0HdaC+rOvrp5nuLh9pOdhLqVqfnKrIJAuQKKyYjErAEg5UnQNcAbz7bketWOYduurmea6T+obO1L9JVv+6uzgsTNpnAdMThhQwJPmZcGBUOMANoFrTgvKb1972Tm30/8JWhRn9rKpRIWRiZZIorIlVXwm1tcABDgFhVbW231K/f6rzVZ2uP8/4MKgSq6pi7SYKqyKLEoCEA1XiQN4QcNbq7xy3Xwd3YKf6caZrP7YqyL6EpD1WYHXCoAoMSl4nHKgKB9qxyVNjOp1DwDXr3mdU8E2dqaszB7BTXU/urQqD4W9NnzsaDCMS2IQDI8YB7lhvF2WlZq5dt1rX1d1iHKfOZHt8e6RmxHKuOcSJhVVzVZoUaFxxINyyMPXrd0xP9/jrVf2U1+L8X+T2hS5gkjAIDiQKaxDMSkATDgyKA6Gyalr77aN0j/9DXT/lSBkCOpqbQCfJYZpBcawicKKwKrIoAUg4MAQOyDBwGZ3rLdXGfF9nMtgIeiCHIWAaymoICJMk5ECisBI5SDhQXQ5otX49NoOu8GauuvUdOLS8Xrkpx2Rz3Aiarm5Wkw9bMuk++eo8KfHIcUCr5aKssBl03QdMOv1/lOM4yvewQTQ5B1gNticWVjW4mOBIOMCNVO38KITGtoXbPo6DyzfwiI0yOL0MZ+sJg6rDgURhVYePCZbJzYFwGAhltXbdBTpddz22LJAjVFbJKKaKspEws4rMTFBNUg7YOStuCP1of2WlkvZVZZFILKwqMzRBN8k4EJ4LbF5923sxDPxan2WVKKuRkISkBxgJriY4JwcHwn1WM1bf9laVSt1qPMxZ2W8BJu1qhCQgYewIMTZBW+McCJXVrFW3vFJrvV72VhlDdzFJmxrBqk+GhCPI3AR1jXJAPma6zJt93R0LPMf/gZNKZ2BdUVklq4EjXOVJbzDCDE7Q1xgH6HudX15evz7jucE9uq5+JpQVN4UmymoUqjpRWKPA5CSL2uNA047uW3RDwxLT082Jq2SkMkpVnDB6lBidZFMDHAjnrZpX334hLKt3my7xu54ctxnFqk0U1igyO8lqAnMgnLc6dNV3Xql0sAaWFQpjkmHgKFdporBGmeFJdhOQA3QFgw9GtKxe39DjYCiYymiTyyaT7GNQlckc1hgwPclygnGAn+JC6Nbdq+DT6iUmm00m2ceoChOFNUaMT7KdIBygXyusCsK18euxfeF88RZKB3xJGBMOJEPCMWF7kumE4IAdCnpzbrxxSu6AukHTR6jGN5gNPiiRhDHhQML4MWF7kumE4MBVV4kllTvQcIVuaDwS7mI8qKvEuhrDyksU1hgyP8l6HHOAG0Tb273DVt+6GA6NL4V7YxKbKKsxrrJkSDjGFRAzew5G0LkszftwQQeT8usr0RdY+DtOyMMRBxw2xSQOvuN+zqmrz5jubk6012Z7sUPfCVHPtVkBtdXA2KtzCR1XR7GSRVZyXMU1IQSzWEFHLU72XK3wZ6xZd7py3LNMdxd5VrttResJIxO1WwmjJt0jmhGVEZWVSs1rezWMqZMdo5sDY3JaO1vwKeF7ezqf+EdIQaTYwp9Fb45qaalTQVDZynIcfJwYcLNn59QDD4jflKIYazFy+XJR/mD+Z3UqpYzv8XdNDgenf2n91FRD96m7L1z5EwyBOQyO2/GNSc0nCmtM2B4rUyqVINXS+gY8XIOVqRPR2yt+zU60DfrEwAQ96ZbWe1LKu6yrs3M74EspLSq+oG7uwkVI81OscWXobLycJxR8msrDIHSWeXrPFRgLrcZwFLLSwWFRbQdaV9gkCr/sb9Tp9GnY0V6ryopiZJ6b8nR3szf1M01rbn56z8Xv/xP80kNp2a9Uj8eKjoYT45G2yUwT68VAGV0IX0v/gQZ0In9DQ3mwenJymYCWVx2+yvLunErdn5k371j8ZlxJS8C4XhrarhU458BCa8EyfclL4Fy3AYRMA06llrwoelKea/lfaF0ZpT/BDgJhwgyXhlQtF1zQA/lq1jp1nU1/1ZDQjFaiRGGNFqfj58NWIpYVBGmtdQynaNlAYcinonjYlhfhOGzLQvnMNsa9RzUvPghxVFqllAsbX0/obC7AnXuKil9KZfkqgLWBNJMjWOvKNK++5dXacU+HdUV+lewAaoIpKDMK+ZzTePCypuvXnSNDQh7yHqchUVjjq2KoaERB4OFqS5qGsir5TTvCZzC6y8LSOjJVd+D8sDjlGllU50xb4eLrksovzKqGbnfbskBZfQRfambRJ4Wyxl5YbXxfOYG6duoX75iu2pdhvxknH8ZfiIR3/FE2OSkSIUnPWcAh4EliCcXzCIDJLQxilHl7yLbQIpucTBxSqTnhfPcK/7A1320FK986qbwxGI0vU+OzZPUN8zN1nu0ow/OTQ+LlCCZKFNYIMncIqG19aOc4DAepvDjhG6enc6xyU0ep1lY75zSEzCd5EuG9b3Ln6IYpjRhsTyqlr/GBatPTBTPL+djMVbefEnpVLWepj4m4JAprTNheKtOl9oUTHAyFxefBTvjWNeRSnMdKwuA4gC82t0fDoHOUR10VTLK2AXnjlGU6g5IbrAoj0BV0vA5TwEfj3ySrlNFg6XDy6AgT6wOhxRTHusrP0OvS9gxJfmTyXIEDy9dLO5i59rZTlKOPh68rJJiUX2x26TrHqW94RdOadRcJ19o3jCsrK1FYFWR5lF/bTXuBenSQCgsTWNJDPq46O58fZZonfnaLH5GOIVDOP2M4yPLQxJqkwch8FhjSPv36dfNlAp7ze+MkjBtCxgk/xpoMGQLmtm++HzNXj4TzWHFWqjwqLEy6/xgFiDY6DnY4OdZlH6v87XAQy/topG9UYl1hy+ykDCIyDrbKeHBUODVl9LXCho3HiEIfDyyZpBUzHlhflAZKDE1wHzvNvxDOYxGwnNLKAY5bG3ZmvNTXCIyQKCvLh8r/29ulMTZt7zkewMfChQxGg3YCsXLiWoPo1UspeKcIcCzpnFmr172Fq6eY4xsXe7MShTX+ZI7Kycl2brlTB/5XsGrDoyKixKCHOFTBe9mbJTPDeJ/G8LHHBOZd+3Y+vgvvCWuHlnhIQiUOnCZtAGbFUgwH0WLB23G6B6lSSar73vZ5OE16HX3Z5y1KVDebQWJLFNYgGTZK4CItUFqX4TjOh7DjfIcoLcdNiQJzNO545sRwEPwa+/5e4W3fsgG0hYptlKishWyuXCrWK7Yi/ZOdNxyfGyZHn9XYmwWHhVDiR/aorisk/9Ch4ejT0pfjuDDz+shJnkIOUGGJfZ7rfPJ/q4UL12ey/psws/5yDPZm4g2OzagtgNngdW6+N0yTKKuQEfFv8jUcM+sr6xrhAeNkuzo4WeevinLNhWsdSKK+DCuod+266L1/VstxOJxDxDEK1VZY0shQluheWCxrZ46/OZZK9BaWYzR+R7xy1RNP7MVC+53IlFexQEt5zISoGEEV4vL5nf8cJYvKzt/5z9H76tzbr8KEO7zHuOpoEDFH4XiKSO7I5VgdukcPC9ZxjI+PxqaC7i7uzXqtWg/XO8VqbJRoGu6QkKSzZ6fi4zOrmhfnUIpd0XvA0l2JpB2L4od0Cw3kQURX4R2vestXiVfEOZiLuMsF4mKe5KOjlixJyxXRs3gxDrv1o5/w4zWEZelHb8TrcnJCGMhXb7oql9HOX6H2T0SjJG4fz1XOY7xWSWy6XBxT8rE36wy43Hk/rC2jxvBw9FAsrFD4ehVTX8++aFGdOuAcnFHZJuM6B8EDShoLLvAKoHocJ/ViTzrYoxoautTGjTAYOvL3urBhEi+Fl0I6EoH4o2ET8wDdHX35UAHs3etiTkhjnsiozkVYLhIa+8pnaYyUSCGdhb/7cA/tifginAZO9MibvrBxY9/z+H0ir3ixrlGWjqgMrmo6akpDJjfd08GheFcPlxFYWkhltcp1p113z/5c7gXsKePnlfvXk+0cIyWH18MJ90pirAkei7xJYMTv4SCtxbTaeLJ6+oXDbrj5R09fsGw3JuHHxNnfYBVW1OBtI57ZNiuTVq/Gp7tPRls+znTnjkBjn4Va5zJ7CsqKSgKvtA9XTn46qw6o7P6dumXBJsT9BW9+n/Wz96kdO/YInP0X5ZEXNazHSBmSZqsk5xw+L6NzrwBhL0WHegTktEU9v3+G0qlGuC9z0YfkVMvmF7RqfQrvN0GPPojoX4XePSMF1p/OWbMaVdCE8nKhrlyYCecwzwUos3zVoCTkwoVTG5Saqnp60DjxFCN0TavbZTuDGMAjC5LPc9C/NJVu2fIyzBi9Grw9AVkfjc+SLsDmMRwjwgICDnhzF5kKICbwGZANTDYFJumW1q14/yjk60Ft3F9lO5+gzEQdHflPBRMpQTwOMrS3R3V5JLyKMrGV10GimQTgDobLnIA/LDhw4Aso74fUMWOzNyuuwqIAMrCCdWZe61sDo8/FAPcM9IvTFFfdpW/CP8wGDwziHgV56TqIxHQI5UtwfzNh007mGTW39edY7rqjZ/tWbnyUPJgPrqELo01PobYCvmDB7LTvnA0Cz0IWJxvtNkJp4jVCHs0SE0Ur9VLAvJ4OE6x3zwW/gQ6+Kbtt878jFejkUKXDU3Pnzkg76T8qs/8QpRqZX4iByPsFMGd/HfT5llxLyythQWBGU2DzmGZxprLBJZ7Wn1VO+gXsZqhUT8zPpPd6p6Mf/D2eWV/D4R2SDzmQVuF5XcvCIzAFstKoze9A3NHw2xWWlsXFs/A9r+jWAmadwTJXjQBuAf9PYbShud6y4CF0IHeng+ydXTt2bAMcQ29+9mfs/8KzRTfcULfXV0eoRGFVYlwKH5E1KuV+sGnN7XfuWbGiQ9F/mD1vWClt1d5XagjMiAIkPVGmZcFZEJjP4DpRO6hv9IeUJFhTaBzS+ikEvEoEwlO1QVLpHU40nZqhXOccKMBz0i1tD6AHvja7/Ul6JsL7IQtj1GC9hrmLWjzHuxQlWIlzYoeKj2F6Bx5IN2mOaGfeDKCThZSyQdm6ZyDiDNB5qXH8i7ytHfcRKJNKzTS+WgAwTlKG4HxTEMJ32BQ6U4aeBa/zf6IAdVhqB499HmZmeSoGsDQWXEVEQwOI6t5raGmZ66nUZwMVrFSuWy88YdnpMVWC0BnxunhuhLf8j2QL+9GcJWDxEk9lPgVvrLekXXPtgS1bngJclHd8JR3WxQtB0zTo18NEhPvqvzhNSWygXddVnr8arpRPUivoL4zbQNBqRylUEnAqNB8fLjgUyupuNKDvoVGeKI3dCh8JBQ6a9aLYiC8SnlJ3wkAJShrCWNe/VCBaLYEor8+0tP4U/sePxLtQwPEUP5AWEdz03NaLPe39BYJ+EeIOlQZjXQsXozufdj7n00mlTeWFSVmoJq1O0oHzm9TcBZcgHrrHacaNyop4S3vyJC8BgT8YQuUDZtKoVQnEzoIP5S7CIcnoCQ4zzAu2HkEDeP5eKKu/YmrgQ3hfD4XLjZihIqGlLdZ2Pq9LyQnjAdcrW+zkoANF6R0C/BfmfP2X9LzW8wFH3jAPpokXrrpKYAON6QChE8njp46XR+1ByeFoPWXKic3TvvNvUrz2DraNUQsUnFKBhHhUHGmV+oNx3LOlsbLBiiCJ4FWjioEjFGLixmUc53WBDv6Untu2shRxxeM5nIKS4/Cvpe0XsNy4FDtNGo0IteTDcg2FbqZhWoxPrCJFb7MKDfTDwA9f6b0oyzVGfOiGhPQBA1/xAKC8F3wudUVg0FZjsumRdIlmRUdzLRTJrSheHs9F4ZSTs4j+SnfmAzxSh+jkOIbTmHd0vo4PddyjWlsPC+kgXOUQzcEEwWGwAmG9oQz9eV4Zx+SE4KohqsF8pnn17YtG+3B0KUFivK/mLJzva/8/IRSHw4ygVWAb7MhVlMUvwog5DEffBivmVWF2pWiNqIGy6vCgQE5I+ep+pD2jT1H1WnMR7DDv0mjQ20uvvMbRzkdRgcQZr7EMM/dxllzKTGWFjuYymR4Qi6raPO9XauRJ/GB6EPQ4rvv2dE6tDSHi1cEj1kMD9FQzVwiBSiqwXy7Jj2IcgO3Pw9ENjdjh8JViACMZV0wJsMLFvE47wXfh33ouhJDKih8+GL0AD4gg45s4cvJbPEQ0lcpfLKv0vHknAfJXmNydaxXsiDYaEkghb8DCAybyrZVRisAajWcHE2Ra2s7FdAGOEVGDS10Vk6uRYAGN1Tr4I39Gu8HnBpfBaQKOCpwGCwvP8GiehLgckMPRKlP3NuzNOhtbHAJcbIMjHooJlsSl5mF+xnFOsQ1/yMqKDZrXIALmKNjl+cF/5bZt5vxEpUBp89TstgUwAH8MAT4YCpZzX6OhYKlIObfCMsbr2QFYI4Hl9dVhi5oxD3RdXjUPhQ+RnAxGVggrsooV3Pdlt27lxjRRoLH4O/uxkE5zMDplJEksrFh86wUC++xa25ebrv32wVBYo3JovFBhWSHEHiBMh1wc1iFrM26AEMmkqKwqIhHxhYIhk8hUJNEkcjGcmNB2UmDEzpTKvTMEEGkqBow4Sy8EFytG2GrgzALNsAbFsiqRpOrR+WWsOvJxjNB2bCnvfFi0Id+tAolJM+SAXiekQ4t4yDsVEd6JHNHqKaHEsEJFP+RBcIUv22Fk/jKSOySrEJ46UvBioaKhAmTyujgHHGwmpd+sNiedvlJARuFwdKHCEuWUyZq3yLCqd4K9OMUFsRQW7BKHdWS7LL6mUFiB4yacyNuA3VBKYcwXMMLJ119gsryra/v2TmWPZOTDAKRfsPTOXXAVhPeVwxi6Mm/k09tIokwQz7jehhXFT/a77ShwXAgP/zLIjo285lDOxTwjZKV3AYLxYDV+06WOyBH3dbBTKuQ/6oRpTXA3pgy4kREwHeXkhJgLwr3yG7lhk7NkDRxJGBQHtHKxN4tLPZc2rV53klhZ3Js1gqFw3Ck1hxHOayEQECvWZKx6xJYECKAxz2Ci+/ug93cmcLZiUu5F0o6Z0UZMTM+E6b5QGedE9IunYt4HqzrMQ+Y9rLBSUIPgIusqhT1mB3vgUoHC7GXmz1+Mxe7LxTy1+7ZKwReLZ75UnGggMi5gme1FaDYeWnwM3I5lFSwZUqjo+W4yBfLApHc9dwLuR4YNPg5PwETylKnNvdji9lNHm78FgdmNr7bkMGmfhhBNDzx/Hjj8ErSEUwF7oiinXv6jgsQK9zfmgtz7gImBGIc6B4VzWEkYEgfsqioPR7uqp5sr8q/BRlLWg9TwkHBWSJSvsJgJeyk0XnWcFULp4SqggKDAeoIY/djL6vPUrs07KyVQ+BRVxjevhz78CNIuFXjIMZTXrbnOzdfjN4S/rLJiEtKLJM6noWwwjJRl7vzy8HW5EJZVlOSLxg82APh32HfweGCcZ5kQjWkaviDSipWklyO70xHRFCo0m7Yc9tp+R+XE/WYnQHmwEuLwg3oBdRbsw/6L98HX1z3FWFTQQ2ms+h4P/CsB+6/IC5s8gcaofegel6tOOd7EHp35Dy1Eai6kbmhIJnUqORyNVcNXz1xz+/m7Ln7PN+RwND/GOgJhYAOfNQs7kxWOREhu9n/pjEVZQYI2e0H2nWoXBQheBdQDrP7oYuoQz1LcOwK1efPzOP18F+LvcucufLOjg68Bek+us/WDSm0mfKXABuNn5s07Fs4hl1vrCiIcP3CuDJ158AIMvFVpk7vZDkHLIJhzZFNK96zURl+OtM0xG2kZhBP41ZIlGoexUWVmrozoYEKjNJX4z2Eg5eAyHG2isgK8yEMpOWG8D//2D+H+EHbPr/KMeyVE6YPoQN6X3bLlUaSH/Fbs2JC8WDhNImHpZ2UwwX1YSRgqB7T1JWY+hwn4H+z55LIdGB46uKLuYKh4B6Rjw+8fGhupxBqshdX/1cBf8MQglpH+pRzmpQsU9QC3QFC7stcjwbz4jEuEi78puMxH+9uf+HFOeS/LucFbwve298bLMsEqQOOeK8MFO/dk48okCl9FyurXrmtOgAO8q0NlhXxl4pYNL++SOEfteGyPt23LakzuHw8F+fNwCDn0nr0yneMX4gHpkBSG9jjvx1BxwyqVAcBNN07R/kySSIcm8lBKTiLeUh5SXZ2d23OdWz7kGOeo0DpDfQ9VWQFjuEqIY1L45HFc0QkpT26FHIgOR8/QmfQX5WW0MbcQcpi/ByosulaxCiYGaggqoOVsHKEfkCQDcQ7ExDyo1HhP4RDws8qeCWPaSlqZ0uUruINB4rdZxRpr6IpkmLyFZYWdbz/C0PM13Vu2PBn6mArz7W1AbCzhJXFWyUIh8+waev3XwTLDMSWZ94oaFpJMlrA0LKhMhuM59pGg+oC74BmWLKlkkQkY/pH3lBXWkdOz/YnHcKcMUHaGHo60q4S+VvvDk0OJ1ho6N5mSh6Px4Yr0yplr171eDkWPwN6sgcrF8zBaU8+I5VRZKNBrYipDqzNT89peE1pXtnFbkz9lFYJYKbSoKKTMk8IRCQiFMfrNtJWCpEs/v/9lADwqtAQjXOXS8gwgV5Yezh7SCK8NElIY2tAijJMvfVIRVhqa1/nyFcj7AfCJvyeh0gLTNBZZJMhQzz4W/8/6oWWLRM6lAmJ5yUfKQygntNBLygrriBfhh6esgEDdey//o/rMXvE02iePEp/8GxIHOOzH+pRZpdrXZ0ZibxYrPwoUAo35pW5I1z/C+qskGBREDgvhQ8r8MD2v7aN0tYI4pkMjhnUigilWSv4wke9tflZAiSdmWCo0GwcrSLIbXnr5SumZl90yYcz51meUNAzSNNiAcjHt3WiA+iNQWhZ3NRrRYCkZM/gOlhkV6DxmOwz436kcOGdIgX4Xzv59j0eokITpqIRCOWGHUFJWCMtOT/LGfXjhmGMED2zDZxKFNTxW5qV2MZflOQ2Ni5umdV8u8VXem0UByA8UCjbi30J1vcE2xkq6AD2etamnQsl9La3TV6u5bQ8qx2yCMDyHIcB+yOQBPMMhnnoWmxie9nR6K2bJdqtNmzB/IAIa0UB6aK2UEcoOsYaA73ixy6KUZe/cZCj7dtZ7nXLUB+Xsl2/Z1ANfStpUbtsTf4SPpjuwZ+hcdCugW84YDgSvvRipA981f3A8tRfFQ91LnVUSFkwhGIiEg6NMwVlwEfMXpPsr6vFp6LJ9DmTFaMNVxOcDx9mFiZHt2UymE3LyAuAoF1Fgp8W88uOid/HudGCEgEWb3YreNGm50f1v8okv8mI4QT5cAQPmUzPWrLv7mYtXPgpXNJiAx3x3FUKhwgqR6v+LieXPQiaiHq2SIFoz3e6pOhRVfwbMfzj3C+00O4qCRKODxQaItPK6VbfaAY+Sf8Gw4o8Quw3eji2/R3kiiyfqeQsVF+kgjcjPYP8POSC+lfhQJsACACz2+6wrAzTYVzZ3pb+NyjkXdJDmyRJYdgfW+NOmZcHPMZV3NraVQHmIvFTiAacRqGj4vcXj5MIP2OgiH0wscgJjDLrDS3d7e1VL698B8SD0yX1Zx3SE850EpdwxDL4xLH7EKCgt7fo7dOBmsVoIH/lSpRZj8n+oHGBFcgd8ndN9YBWQnKnUVUPFNSBdVOHRC1EG2c4n/4z+63t2yNWrRCKYUncqEzZaSpov+6Lo4UEu7Ey2vqQoEYRrgKAejo2Cb8No8vNwBngfvUnixP/lPJuG9xRo2yjwMCDMmcMvBswP44mvXAAeDKyN2Q0P8/eFgIMX8IE5CA74Av0dcD+BLEhHNfAOzGl8xli+a+cGlB8UylweH+KESE7o8SKUFR+ygr10/B3OgoOn6DDpQgZeRx39UXR3d6Z9vRHDye9iWHkaMiK/eRV2vJVpuPJKodXX6Z3A+4LMr8WlvjL2SQ5hcDi6CxtKG96IvVn/ItsbqvThikKF1ctox7ifgvBgOCeHiAdjelOQIZDS22ISlen7+aGiWFCphcIqx2EA7hwLBfbFdMqjQF4EGAYK40DLxas7GEgOsQ1F4Mr9wxybvH6E+7/KAQ7yHctBK6MbpbmfOhFhMok8ZcLxtj35a3RGN6FzIwNkbEVGxAiEp/zlyYrIDOs7kkvwE9pQZAXKzCqy6fRQi/6hIzOv9Yd1LYcvAjwt84FygsiSwdaXevawDGTcbIVvM4JOpvoryZoqvdB0O43K+9LUr98xvVp+syLByKdReqyezsc3oU4/EDZE1uZglFY+vsJnCmqesIbzPpFQat0MgVwDD6f/D19WOTjMN6KT6VRdnUu3wTEFFPMSIpymk2kRiKtKgrlU6MLi1xOCeXJZWCyy8DGn/AvgXeNPUFoYVimuMlcr5MmKKDNbd/Q6CnmBS5u3BMqHZb6A7n0onzFlQsgzsrnR+iT/h3UxU515lmoVfoLjweFojx+uaMlkvaulLFXYmyUNrghjpMfCjuS7IJIfkgZvl+/Zg1apsQ/IFbRAKEVxBThX5p6Zru/5heLXaKwi6KXV6Gwd4mIKJ/UvAyf/JYjSC5+rckPLec4iqriBsir5jSMklAWXH9Oo81NvgEX+kFVasnIbMb7a5KL+pJPDd0sw5aB1I113Z+a00rvHIJXWaSJT6NEexcIJ0I6UaFebBRMEH3QGD0fDRvjYzOtvP0X2Zg3zcHSvEijCAql8fiodh5bfhFWwnRBGDvEoMFRoI1W7pCkNYcwiv5PTmYZbQtp689N+ivnHbBBhEfGBnkI84e/h37Qc4B4+nomJQeRk39Obdud69uMzXsFdUCL0wgDGi+Li+5EKaSgZznlx6eWO9IIF3JsXX2kds1tkCsPLv6mcbHgv1x5Gqgy1i9euuGKaEIZ3YHg4WoVf2Rmy0VCpgqTy/c4tP8nlNA+h3gjhgGsPupCRcRaUhigvKg9Wfq9SIW3DDBkUEorJWY7e8xzgMtHu6B7lUG3HVFjhbnwONW2oIo0dghHr4dx7hoDh5+QMVkns3r0PVvk5+ArluyAnf5OtJNYyJ2/YyRCu2nJC00hOMChffzVkP/OpHB7BSiGCG3h/NbkccEDJco0rCdXkgHy4QtU3vKJpzTo7N92+IeboaCAZlRQWU7DyU2rXkzvhAfQj8OxxIlZzvoql/Kekgvv5LZK5KcBT0fDqFdIhCiqHWNJ7fhI08MCtndStC17E725GxQgWhwpewuM8gKdAxkoYA3fUMI4NxTwOP2OgnZAg5AXL72R3bP73XApuYYz/ASiu/0Ic9pjS6sK4y3Z05D/qQeQDddpPVqLODyBxA6cSsLqI1cRwPosJKzeK9nZRTgelZm4CvJ14h7jFzTWBi8sBA6XVg0an22dfd9OC4UzAx21g7B0J62a3Pf5XHEK9AJ/mPQaeC87GZOs3IJQP4p39kjF7VHHUByuMQko/U4zrFVQR0rhCgf1TsPe1PgEfo1gWskfL5+6x2TBUO5VwcUsDkurD0/v2Le7FET4M42YbHbZhAP0paDBEFZefw8h2XCclE3i5XD3NbdtyM85sngo3b0vgvudTGC7+BB3d03hP5QJHfSIfaSsvvQqNPCRviSfqEPBYKdjFFSwJnxtCVpILgsnE+6YLzsR4EPsBU+zPkon3kH/VvEUfrpjquZlrBfHGoX05Os7+FQoPg7RI3K1AWRcx9+A3LwffLpydMu5R2NzXanxnNhJNh9hNxSgJ7pZVMzquRdCwc0VIrTM24ovRwDFHAbMOu6D/B+D/E8NCnv/LYtPpk9jsdzQErZJgghQoSTQOHRieIYRyXYp8O6LyIGoIwdKRS6dzy7EFaQbm3Ni4KvfqQ8hqAiVhfUaKhnJDfni5LVvYofFSXPlN12UXauMfAbOrBXvwqPCnItlUVOQ0yMgC1Gkb6pwrwazeuHLCz3ND5Mxr1Pz509XWrc8hNWmoIB8y8Y7d9+qPgF7BLJMwIhyQD1dgPuuds9beeufOi1b8EKu0KVw0hmKHSgorv8IpfGyUUUPnu0jh+Fgp2o6ct5fMuaWlIW1SR6GHPRvK60IRyFjCCFGyIne84H4gysE8AgE7Uywwkcsovtgdu9BBNfI9DxtT16qnO3YDKmpcxRJUinNkeDrrpY3KvPCJsE2QH5M5sPyRcmGN8YqEEbyWTsJXe/7+IsaAD+Mdr2LBxXclZ2YC8xqoqgvQ0cB6tSZyMeCBcboppdzFyPg3eJcvvwNBJeZekWfMu/06kBUtTH8kR3RK8Gq40RAJVCVW1a9rWb3+552XrOjCb/RR8ed+I4VTjBJb2fwghT3QTGVFBRc1TAok43gxjheVGmB46l5g+dvmgaVvOmPLbnvyClgky0Aoe0C+I55yAXhlYqHNzkE9wPwQ5dzPwiPbcmUQUAIhAT9aMBMbU78URkY0RzBx773p0pkXvgKcbSCPDTMOHXHzmGhw5Imply8XidJixbDuowCl0EEeSYXhTl7h/VLICi+BZRzx+Dx6wy01kJdTMdS+XYaPVs7wumRgWh7Eh5M1szCEqlwn4TxWWj/3MHJ/UqdAjlWQJTNKXgyVAziYxw9XNDQe0eP0XCFYBnk4ulyFisCls8HVKZ3+c3rewpcjg1DoRMgoIFGgIPKiMgGMTI4Tlr/ZgxGWl6MWLarjoWFMYXwDjR1RUCTlQ5TPDLVrFycZpEfM6tx9ECxOvguS8ijkLf3FU6Dfj530FyMmyje/YVVCw8Yl5cRn0C5Fkc4XnJPn0HMx/gj/6+a0HYXD0A/jeJV14Gb5S34Vyhj5xzoE/6nERJFFcsJ3VlbsAonKueqTqGfOj7Ke+L5MwPwTFBbADrVAS8vA9r4yavl6t/OSS9jb/0pxCT6UsV6I5KGaHJDD0ajJy2auuv14GRIOYm9WoTBFhFE4PCipk3D/GJTLHPR0v8vMXfA5zFU15PWWkUBGSiVKX3inoFlBnTpVFA5spk0WSCSsEL7/b7GkVJ2aOjWi1+EQFDh+ZZWeVWL9ExX9heElyHD0avjv+gwgSBMbC/CKEiZ+22D67tE7xlMJK/IBM8bXCS4Lx+hJHYxj+Jn6qZhXvBxeGH6bbmk7GQwhv1jflCdeleQEIFInxroAAnxT0x7E7LKKSN4RpkQQ0aJ/NtE6JYAGRi+2X4HG6ORn1tVMnAP1A9EkMbE4wCkeT9fVYeSuVkmK5cttxcVIHimAQtCw5oNVGHHRfQyPW+B4oXtFWqUeTs9r/VdaSoiLBJINn8orX4EVNnz8hlII3etCjGmxIcQYv1qd1q327g0LtlToRqbfrSTCNo/e/6QJeo6Ts/pqNKxfwtp6JeKAV3p64mdZ8q/onUnNn/9PSHMvduFfARwRTJxGCJQ1GVjfQWZu29lQVG+VhQcOj7UGT83vobRuwh66lwCGnQIv8izqAKjAWI9F5ASiHG5ByezYswgi0hKvc7DiDIRY9RtEuPJK0gZ9m/qlyfU8h1VLIiKtSRgRDuBwdE+3jy9Hn4EvR78f8oLV2g2UpYrB1nA/MLE0DIQNR3Kc18j+FhgVAOFsGYXxCFTtzXD78TCslE+HAkmho/LKV2BRg867i1KA5QaFpxWHU0RLwS0XIsHZidWfUBA7RMB85X8P9D0OmoiDyOIE0gqlJft2TgcdtAZ+AUV0YWrOglNUW9ssOQ7EI0GzDp+J7RSv4jsqNx04v0ZeEU+YF3FN1mDrvHnxQfBhZZeqhR+Gx6ukfmDJfgC2ysP0ruDOnf/m8Gxo1AEQRgQA9zwZkWefFlbjzLZZxtU3Qw5FMQKuAr+RGzsjrXbaSumIZMf+LPVfGky7s+uidyOd7tAZ9sWx5akU1iS+PAc05rMAoa857Ib1zXH3ZhVqNSiwDq8RjTabM58L84uEBHcKIytSpAJbGPTnMRS4Eq5hMGGp0Zix8uOrv+dUqlNl9z6PU8q+SqWMymad+nR6VhDok5H43SDyn62MinBG+EsUT+YlQJd5NNw4SiVLQacv+C41r20N8sZXd6j9Yk3AMx/myT1ebDTcI3YGL2wWUemc2a/SDTx3CBh/Cm5T0PXSjAUJ4qSJeVdSsgCp+UAeeJm6fZ+FxblQXMP0+cPiO3Zw5G+G3hUco89x63t2mHmtv4FK+QMWiB91A/1E1vF2oePqVpkM+QqM3pSU4xztBM7rssZ8GPUyC/XEd0U6V0kR/WMNhc4k9SNhZDyFZYFFrrBa+D3Qc5ZIyGBSR1Qk97gciD5cMcvr2n8NEn1QxTgcXaiwRHlkc8HnYRbPLBDCiBArOBQiUV44o6edkyBYJ1GPwXy3DvrqpmCiVO/DaDWnncxBcO82DTD1UHJQN3YjFhBKfhHisnej7rPvlyL/Dgqw9OK5bSd9M91y/3mg4YReBVQWUb+XVvGIry6J5+9G0MkD12hyocTKESHuuhdFZdMIwKT9Rx546TkLToTyudRaymLl5jME/EIH16u4sNuZc6Far8CLFZrGkGOymGLoxuM+7JTDpDc7j9R09BtT4WrI8j/qVPIxF3+macU5yn9kZz35qOoUoPgqh8PC9naVrlP/kc327BL5Nz7Tx5fR4nQlsaU5wA9XGO2mzmu6/o4796xYsUFxAt560Ciayiof+4pC6ItjNK3Ps0oFu49LB0qUFUgqLzpfs8LFCsbEvEPHawtQ3YsgqIchDt87JJxssCRMHEGAwCCPIDiAT3L9yJIiyoqPFCbQfLePj6l+PFQuLEN8ISUWG5guSss5LntZXJaGxKqKeMV6k84CQ77r0FFQhvi7VH0iXuSEysROK8hHb6U34FTDIbKoA4eOwNeK39hEimBdyIR1LDEV/kG2oK+Q2ffx9SaONaL6rJAufM1hIRrL9o+99xlI0I8wKYwXcK2dhJHmQEBfZDrwVnO11iorMQ6K5hspLCuEra3w5AkhtLJnTfSiyfpFMi3wiHKLhISNnI0eVphcFDxezI8wcQN2qCOJUXfJJ7ls2ny6KFCut+OJ34CIywXWChnzGkpgWYpd5XBFZSsHU0vvRGbSLfPpduh0mQuMX6fgLZWXyAr5bHlnOwgrK1FcpOTicQ54gBNDS63cb4dJhioDJOp2nn0DKYOR1XiUJlCFHJDD0dibdULzq7r/TV62d5TkuwgfgOTueuaN6OXs0K4Qbfzf+Q2eeHlFcfGx2HkquJnx97mp3vm0YkJIBaaznZuvhcB+C/SjQcjcSTHYweQfB5Z5QMdznCuNL06aiQzDcobWlP44LZrw91DLFMkF78ORFenYQM4aOp4ELgp8fscWj75wKLLnkpX3YnvD/TqTocmWWFnxuDccKH7uni3piubVty8qNwEvigo5SaXAjcwPjO9jQySCrLzxFP2YNEQqAhw1Exm+NLSuOPwsJoS9igkHbT+Mw9i3yGFaACOMpLCJopRcAvV1ULtPnseGX2HWI36zChpl1E76HPQLkZdR8mIkeV2uYDnICfxiBX/C9ybbQ8BiclIOR9+78OOfmBC7CXJU27XZV+qxfooOR8MZo/pKOWIihUUY9nKBt33Laiy4/ROGcn8PGz7ixcNCOTzVfEdho7JydeBfBweC38Jv0knlWSqwIUlZcJzj/fCnd7VYPSOndNk4HSpUjGY+nfMOXAbuUaFOhiBKK7t108bcIQe9CnNNXwOv4UeKk+7SwQ1dWQyee/A46qRR3zvcnHpHuNmU1lVvJzZolOGeLL+n7i58SGGbclNDs9YGnfGkTyCHo51M5m3Na9ctxwJIgGtAm8pXWFElp7wdW+/LKe9EKgywMbDDLArBoFzDDLYGmD9d3kL4HXwMzFyT7dxix7TxBJANheXh8PDK0Evq5j6lW5XGREVF1ygUYiqrT0DBXwN3N/B6ib0/dogU8ZEghSF8F6NN240Uhemr8bscfcXwF4NnnEsFgQ7l4/jxejBjo/BaPI1WhdfFaIniWA+QS7Gs/q6Vd1r305s3I471MjxLz+7JSj13+Yq96O1vwrAQKIta9oxPQlU5ANuIu5OM+XLTtd8+GAqLC3k0pHpDvsKKImnJiJ9uURjw8wmL6/uIs/6LeLdCQcEoJsyIjh2YHnhEEQK/k4YS2IWlxHPwNZZPh1iYX9x8Ik3gipfUrtTx2GXBPR7P9zUmYpUGZYXe4i7Ez9/RBTiBB5lQVHRCZ9QfaYWCRh4tkK9l8z+eGSK8pKXgwp4yrEVgYiSiUxIU/9d7AqAARyHOvt/AW1iOYqijcsXAK+hK4WQ5WTcu+PCz3NTGl1GB49qRx2vk0au8SuEpRmOxOKQXOeFqIOoBHVtgvpOrT53c09nJeSv2xqRp+CG0snS6/ltYdn8m7PSGS//w6ap9DNHh6FYnk2qX4hYcji6msAjXK4z0sOB1bn479kyeCu13JwRwH4dr0nCtwKIiKZRFlQArObqiBgLcvULMCWs4/JNVoxeA//r6nHucz49f2N5yMMqKdDMwP9Lvqmc3vQDvEJ9OKe9Y7Li4QqwAQoiDQXEsKBYZYpgPQ0Qrf5M2XIAjvLw1v0MjWQmr4mRaoYhivOUhHQpyzk1r7EuTIRKHSQUX4GVeDnu9KgSotDoxVrSuG4inH17beMFH4wZi+ZVEbdKkh/gs3wfQ1w+v5A8/ZGJilMDZx2tYW1TgnvKOA68/AT49KnT390gb1T3rJ5KHiOf5d77LhyVfbYdJmuHFFBb0maiH94RfhWa5y00ZlCC/RHRoZe3+6Ao6ifyG3eJQJWVYIsskOuQAlnn54Qp065fMWHvLy8XKyjscHTXUcvyKlBqFSNW3tS3wc+ZtwPgmVObJECQ46QvRyNaaPFTyG+/yc8mHNYZrxw9CUr+fDtzvdu14fFuYmoqgGgLInEk/GwiDi+M3r8DO6zOcwJwEY/M4xHGPGDfdsDHjhkC6tezleRY2y4OI+S1ifopJ/d/Le/svGn4wkUnPn79EBfoEMAnLHfKNvjzQvkcHs3OBDvZxgQOxEV19AJbegJsyQdHLKuFjwogQP0j/f7XjsT2IEprykNrfcBXkZv03OdiaHlQccgYBJummIOEf5MO6IV15OAsfmUef4liyJF23c89r4RnvrZCV1+JdG4f6fZRRP4VBHslzoogCnqOfGCZgj0wntOzPsKH0u97WJ34RQvWTzShlVe6hn6Y5193YlEs1/AXEHAa5oLxGeVYlmyoiwdeWGxpUd9cnd1288stqw4aUWrasXBsid2XvWdP27t+iX345VuTHR/kMvPOnU/XG9zbsvmjl6SGPhN5IJOLwjcJI0RLFJQlwhMfNBUvgKvl4IDoC8jYXAM14NwNXPS4qArQN1Y14ugjBV3bNDkc7j2FVZyNWjP8QmvN4JWFgHtGb4d0pZLz6VyD2nalcqimt/Tk4DzcdAKQZc7jmBUzl7sjub+xUuzdGq38RBVSmVDTkRRSEmdGPKtyHg284aUuRPhichO1TXMSIg/LpA7ljYF3iRIR6CYaNbTCYZkIBNAP4EDCSVhz5CmUvB5efRfxTiN+K3xux8fghr3vKnwrqgnkUU/iIrlIIPWLy4wnu9BlrVA/aM5UqSzjOAlb3lXPINOU/vePzuy9Z+Rl1441p9eEPcwNtqcBSiMJq3t61yZ3e1GpYvtJ9bSk8IxLPk3bOlEYV7Nndvuvi91wlm0rvXuFTSOKGSDiixu+rJ5/cicifAAGvKLhwQZNB5brKhzsYx8WBi+cDdfDBHsx3avBigXRQEUZ5FIMZThxx82Ilgf6luHf48tVmpTpRq51lkAN2KRpHR4Sjv9KzCam8Ir6UQdX7ivDlyjpYfBFi4mTaUoHlZ0MfTIjKHTcN8yePQl7jCfUOHtNS5dUX6PHjxRdTyp/mqGm+Fm8cPH/aySop6Fxsqoh2lrMc//ryGM5Te7vkUW/qb+x5/tk6GKVT4C0zcHAodjhoq502wBoVcAbwmHoQJlh+KvifeqoSf6yc4MtBZlrbl/znnpmHEUfW8XFQagwDy0L+BtgjYA7sz6CDwMkDUKarc+ogbABLqXAiYapUXCoMwvMic8ay8pk3L9JB+vOvsaYN5NRMiHgc1XvcOkd99MpW3DTVZtpY5Tv0crS3U3ZrMoxEZVTCWc4CqEkmJ4UqyoGJJCcaQywq2/EfaFlxD9NgAoe+s/ndmHEYnsLMwCA/VDEOS5GQlHAg4UDCgYQDCQcSDiQcSDiQcCDhQMKBhAPD58B/A683SXUvOOG7AAAAAElFTkSuQmCC"/>'+
+          '</a>'+
+          '  <h5 class="card-title">This '+(isUnsupportedBrowser ? 'browser' : 'operating system')+' is not supported.</h5>'+
+          '  <p style="max-width: 500px; margin-left: auto; margin-right: auto;">'+
+          '    This app does not currently support '+(
+            isUnsupportedBrowser?
+            '<strong>'+bowser.name+'</strong> for versions lower than <strong>v'+ LATEST_SUPPORTED_VERSION_BY_BROWSER_NAME[bowser.name.toLowerCase()]+'</strong>. '+
+            'To continue, please upgrade your browser to the newest version, or download the <a href="https://www.google.com/chrome">latest version of Google Chrome</a>.'+
+            '  </p>'+
+            '  <a class="btn btn-primary" style="padding: 5px 10px" href="https://www.google.com/chrome">Download Chrome</a>'
+            :
+            '<strong>'+bowser.osname+'</strong> for versions lower than <strong>v'+ LATEST_SUPPORTED_VERSION_BY_OS[bowser.osname]+'</strong>. '+
+            'To continue, please use a different device, or <a href="'+(bowser.osname === 'iOS' ? 'https://support.apple.com/en-us/HT204204' : 'https://support.google.com/android/?hl=en#topic=7313011')+'">upgrade this device\'s software</a> to the latest compatible version.'+
+            '  </p>'+
+            '  <a class="btn btn-primary" style="padding: 5px 10px" href="/contact">Need help?</a>'
+          )+
+          '</div>';
+          document.body.style.padding = '75px 0';
+        }
+      }
+    })();//†
+    </script>
+
+  </body>
+</html>
diff --git a/ee/bulk-operations-dashboard/views/pages/account/account-overview.ejs b/ee/bulk-operations-dashboard/views/pages/account/account-overview.ejs
new file mode 100644
index 0000000000..2f5f3dc3d1
--- /dev/null
+++ b/ee/bulk-operations-dashboard/views/pages/account/account-overview.ejs
@@ -0,0 +1,62 @@
+<div id="account-overview" v-cloak>
+  <account-notification-banner></account-notification-banner>
+  <div class="container pt-5 pb-5">
+    <h1>My account</h1>
+    <hr/>
+    <div class="row mb-3">
+      <div class="col-sm-6">
+        <h4>Personal information</h4>
+      </div>
+      <div class="col-sm-6">
+        <span class="float-sm-right">
+          <a style="width: 150px" class="btn btn-sm btn-outline-info" href="/account/profile">Edit profile</a>
+        </span>
+      </div>
+    </div>
+    <div class="row">
+      <div class="col-3">Name:</div>
+      <div class="col"><strong>{{me.fullName}}</strong></div>
+    </div>
+    <div class="row">
+      <div class="col-3">Email:</div>
+      <div class="col">
+        <strong :class="[me.emailStatus === 'unconfirmed' || me.emailStatus === 'change-requested' ? 'text-muted' : '']">{{me.emailChangeCandidate ? me.emailChangeCandidate : me.emailAddress}}</strong>
+        <span v-if="me.emailStatus === 'unconfirmed' || me.emailStatus === 'change-requested'" class="badge badge-pill badge-warning">Unverified</span>
+      </div>
+    </div>
+    <hr/>
+    <div class="row mb-3">
+      <div class="col-sm-6">
+        <h4>Password</h4>
+      </div>
+      <div class="col-sm-6">
+        <span class="float-sm-right">
+          <a style="width: 150px" class="btn btn-sm btn-outline-info" href="/account/password">Change password</a>
+        </span>
+      </div>
+    </div>
+    <div class="row">
+      <div class="col-3">Password:</div>
+      <div class="col"><strong>••••••••••</strong></div>
+    </div>
+    <hr/>
+    <div class="row mb-3" v-if="isBillingEnabled">
+      <div class="col-sm-6">
+        <h4>Billing</h4>
+      </div>
+      <div class="col-sm-6">
+        <span class="float-sm-right">
+          <button style="width: 150px;" class="btn btn-sm btn-outline-info" @click="clickUpdateBillingCardButton()">{{ me.hasBillingCard ? 'Change card' : '+ Add card' }}</button>
+        </span>
+      </div>
+    </div>
+    <div class="alert alert-danger" v-else-if="isBillingEnabled && cloudError">
+      There was an error updating your credit card information. Please check your information and try again, or <a href="/contact">contact support</a> if the error persists.
+    </div>
+    <div class="alert alert-secondary" v-else-if="isBillingEnabled">
+      You have not linked a payment source to your account. In order to access paid features, you'll need to provide your credit card information. (Don't worry: you will only be charged when you've reached the limit of your free plan.)
+    </div>
+  </div>
+
+</div>
+<%- /* Expose locals as `window.SAILS_LOCALS` :: */ exposeLocalsToBrowser() %>
diff --git a/ee/bulk-operations-dashboard/views/pages/account/edit-password.ejs b/ee/bulk-operations-dashboard/views/pages/account/edit-password.ejs
new file mode 100644
index 0000000000..689b7ccf63
--- /dev/null
+++ b/ee/bulk-operations-dashboard/views/pages/account/edit-password.ejs
@@ -0,0 +1,37 @@
+<div id="edit-password" v-cloak>
+  <account-notification-banner></account-notification-banner>
+  <div class="container pt-5 pb-5">
+    <h1>Change password</h1>
+    <hr/>
+    <ajax-form action="updatePassword" :syncing.sync="syncing" :cloud-error.sync="cloudError" :form-data="formData" :form-rules="formRules" :form-errors.sync="formErrors" @submitted="submittedForm()">
+      <div class="row">
+        <div class="col-sm-6">
+          <div class="form-group">
+            <label for="password">New password</label>
+            <input class="form-control" id="password" name="password" type="password"  :class="[formErrors.password ? 'is-invalid' : '']" v-model.trim="formData.password" placeholder="••••••••" autocomplete="new-password" focus-first>
+            <div class="invalid-feedback" v-if="formErrors.password">Please enter a password or choose "Cancel".</div>
+          </div>
+        </div>
+        <div class="col-sm-6">
+          <div class="form-group">
+            <label for="confirm-password">Confirm password</label>
+            <input class="form-control" id="confirm-password" name="confirm-password" type="password"  :class="[formErrors.confirmPassword ? 'is-invalid' : '']" v-model.trim="formData.confirmPassword" autocomplete="new-password" placeholder="••••••••">
+            <div class="invalid-feedback" v-if="formErrors.confirmPassword">Your new password and confirmation do not match.</div>
+          </div>
+        </div>
+      </div>
+      <div class="row">
+        <div class="col-sm-6">
+          <cloud-error v-if="cloudError"></cloud-error>
+        </div>
+        <div class="col-sm-6">
+          <div class="form-group text-right">
+            <a class="btn btn-outline-info" href="/account">Cancel</a>
+            <ajax-button type="submit" :syncing="syncing" class="btn btn-dark">Save changes</ajax-button>
+          </div>
+        </div>
+      </div>
+    </ajax-form>
+  </div>
+</div>
+<%- /* Expose locals as `window.SAILS_LOCALS` :: */ exposeLocalsToBrowser() %>
diff --git a/ee/bulk-operations-dashboard/views/pages/account/edit-profile.ejs b/ee/bulk-operations-dashboard/views/pages/account/edit-profile.ejs
new file mode 100644
index 0000000000..75589f176d
--- /dev/null
+++ b/ee/bulk-operations-dashboard/views/pages/account/edit-profile.ejs
@@ -0,0 +1,38 @@
+<div id="edit-profile" v-cloak>
+  <account-notification-banner></account-notification-banner>
+  <div class="container pt-5 pb-5">
+    <h1>Update personal info</h1>
+    <hr/>
+    <ajax-form action="updateProfile" :syncing.sync="syncing" :cloud-error.sync="cloudError" :form-data="formData" :form-rules="formRules" :form-errors.sync="formErrors" @submitted="submittedForm()">
+      <div class="row">
+        <div class="col-sm-6">
+          <div class="form-group">
+            <label for="full-name">Full name</label>
+            <input class="form-control" id="full-name" name="full-name" type="text"  :class="[formErrors.fullName ? 'is-invalid' : '']" v-model.trim="formData.fullName" placeholder="Sturgis P. Sturgeon" autocomplete="name" focus-first>
+            <div class="invalid-feedback" v-if="formErrors.fullName">Please enter your full name.</div>
+          </div>
+        </div>
+        <div class="col-sm-6">
+          <div class="form-group">
+            <label for="email-address">Email address</label>
+            <input class="form-control" id="email-address" name="email-address" type="email"  :class="[formErrors.emailAddress ? 'is-invalid' : '']" v-model.trim="formData.emailAddress" placeholder="sturgeon@example.com" autocomplete="email">
+            <div class="invalid-feedback" v-if="formErrors.emailAddress">Please enter a valid email address.</div>
+          </div>
+        </div>
+      </div>
+      <div class="row">
+        <div class="col-sm-6">
+          <cloud-error v-if="cloudError === 'emailAlreadyInUse'">There is already an account using that email address.</cloud-error>
+          <cloud-error v-if="cloudError"></cloud-error>
+        </div>
+        <div class="col-sm-6">
+          <div class="form-group text-right">
+            <a class="btn btn-outline-info" href="/account">Cancel</a>
+            <ajax-button type="submit" :syncing="syncing" class="btn btn-dark">Save changes</ajax-button>
+          </div>
+        </div>
+      </div>
+    </ajax-form>
+  </div>
+</div>
+<%- /* Expose locals as `window.SAILS_LOCALS` :: */ exposeLocalsToBrowser() %>
diff --git a/ee/bulk-operations-dashboard/views/pages/contact.ejs b/ee/bulk-operations-dashboard/views/pages/contact.ejs
new file mode 100644
index 0000000000..d1ed43b775
--- /dev/null
+++ b/ee/bulk-operations-dashboard/views/pages/contact.ejs
@@ -0,0 +1,41 @@
+<div id="contact" v-cloak>
+  <div class="container-fluid pt-5 pb-5">
+    <h1 class="text-center">Get in touch</h1>
+    <div style="max-width:  650px;" class="mx-auto" v-if="!cloudSuccess">
+      <p class="text-center">Have a question for us?  Maybe some feedback?  We love talking to users about NEW_APP_NAME, and we're happy to answer questions about our pricing, roadmap, or business solutions.  Send us a note and we'll get back to you as soon as possible.</p>
+      <hr/>
+      <ajax-form action="deliverContactFormMessage" :form-errors.sync="formErrors" :form-data="formData" :form-rules="formRules" :syncing.sync="syncing" :cloud-error.sync="cloudError" @submitted="submittedForm()">
+        <div class="form-group">
+          <label for="full-name">Name</label>
+          <input class="form-control" id="full-name" name="full-name" type="text"  :class="[formErrors.fullName ? 'is-invalid' : '']" v-model.trim="formData.fullName" placeholder="Sturgis P. Sturgeon" autocomplete="name" focus-first>
+          <div class="invalid-feedback" v-if="formErrors.fullName">Please let us know what to call you.</div>
+        </div>
+        <div class="form-group">
+          <label for="email-address">Email address</label>
+          <input class="form-control" id="email-address" name="email-address" type="email"  :class="[formErrors.emailAddress ? 'is-invalid' : '']" v-model.trim="formData.emailAddress" placeholder="sturgeon@example.com" autocomplete="email">
+          <div class="invalid-feedback" v-if="formErrors.emailAddress">Please enter a valid email address.</div>
+        </div>
+        <div class="form-group">
+          <label for="topic">Topic</label>
+          <input class="form-control" id="topic" name="topic" type="text"  :class="[formErrors.topic ? 'is-invalid' : '']" v-model.trim="formData.topic" placeholder="Pricing question" autocomplete="none">
+          <div class="invalid-feedback" v-if="formErrors.topic">Please choose a topic for your message.</div>
+        </div>
+        <div class="form-group">
+          <label for="message">Message</label>
+          <textarea class="form-control" id="message" name="message" :class="[formErrors.message ? 'is-invalid' : '']" v-model.trim="formData.message" placeholder="What is the difference between the &quot;Individual&quot; plan and the &quot;Professional&quot; plan?" autocomplete="none"></textarea>
+          <div class="invalid-feedback" v-if="formErrors.message">Message cannot be empty.</div>
+        </div>
+        <cloud-error v-if="cloudError"></cloud-error>
+        <div class="form-group">
+          <ajax-button type="submit" :syncing="syncing" class="btn btn-dark btn-lg btn-block">Send message</ajax-button>
+        </div>
+      </ajax-form>
+    </div>
+    <div style="max-width: 450px;" class="mx-auto text-center" v-else>
+      <p class="text-center">Thanks for reaching out!</p>
+      <hr/>
+      <p>We have received your message, and someone from our team will get back to you soon.</p>
+    </div>
+  </div>
+</div>
+<%- /* Expose locals as `window.SAILS_LOCALS` :: */ exposeLocalsToBrowser() %>
diff --git a/ee/bulk-operations-dashboard/views/pages/dashboard/welcome.ejs b/ee/bulk-operations-dashboard/views/pages/dashboard/welcome.ejs
new file mode 100644
index 0000000000..ce149d2d47
--- /dev/null
+++ b/ee/bulk-operations-dashboard/views/pages/dashboard/welcome.ejs
@@ -0,0 +1,102 @@
+<div id="welcome">
+  <account-notification-banner></account-notification-banner>
+  <div class="container pt-5 pb-5">
+    <h1>Welcome!</h1>
+    <hr/>
+    <p>This is a page that only logged-in people can visit. Don't you feel special? Try clicking on a button below to do some things you can't do when you're logged out.</p>
+    <div class="buttons">
+      <a class="btn btn-info" href="/account/profile">Update my email</a>
+      <button class="btn btn-outline-info ml-2" @click="clickOpenExampleModalButton()">Open a modal</button>
+    </div>
+  </div>
+
+  <router-view></router-view>
+
+  <!--  ╔═╗═╗ ╦╔═╗╔╦╗╔═╗╦  ╔═╗  ┌┬┐┌─┐┌┬┐┌─┐┬
+        ║╣ ╔╩╦╝╠═╣║║║╠═╝║  ║╣   ││││ │ ││├─┤│
+        ╚═╝╩ ╚═╩ ╩╩ ╩╩  ╩═╝╚═╝  ┴ ┴└─┘─┴┘┴ ┴┴─┘  -->
+  <modal class="example-modal" v-if="modal==='example'" @close="closeExampleModal()" v-cloak>
+    <div class="modal-header">
+      <h2 class="modal-title">Example modal</h2>
+      <p class="modal-intro">At your leisure, please peruse this excerpt from a whale of a tale.</p>
+      <hr>
+    </div>
+    <div class="modal-body">
+      <h5 class="pb-2 mb-3 border-bottom">Chapter 1: Loomings.</h5>
+      <p>Call me Ishmael. Some years ago—never mind how long precisely—having little or no money in my purse, and nothing particular to interest me on shore, I thought I would sail about a little and see the watery part of the world. It is a way I have of driving off the spleen and regulating the circulation. Whenever I find myself growing grim about the mouth; whenever it is a damp, drizzly November in my soul; whenever I find myself involuntarily pausing before coffin warehouses, and bringing up the rear of every funeral I meet; and especially whenever my hypos get such an upper hand of me, that it requires a strong moral principle to prevent me from deliberately stepping into the street, and methodically knocking people's hats off—then, I account it high time to get to sea as soon as I can. This is my substitute for pistol and ball. With a philosophical flourish Cato throws himself upon his sword; I quietly take to the ship. There is nothing surprising in this. If they but knew it, almost all men in their degree, some time or other, cherish very nearly the same feelings towards the ocean with me.</p>
+      <div class="js-timestamp-examples">
+        <h5 class="pt-4 pb-2 mb-3 border-bottom">About 2 years ago</h5>
+        <p>
+          <js-timestamp :at="pageLoadedAt-(2*365*24*60*60*1000)"></js-timestamp><br/>
+          <js-timestamp :at="pageLoadedAt-(2*365*24*60*60*1000)" format="timeago" short="true"></js-timestamp><br/>
+          <js-timestamp :at="pageLoadedAt-(2*365*24*60*60*1000)" format="calendar"></js-timestamp><br/>
+        </p>
+        <h5 class="pt-4 pb-2 mb-3 border-bottom">About 2 months ago</h5>
+        <p>
+          <js-timestamp :at="pageLoadedAt-(2*30*24*60*60*1000)"></js-timestamp><br/>
+          <js-timestamp :at="pageLoadedAt-(2*30*24*60*60*1000)" format="timeago" short="true"></js-timestamp><br/>
+          <js-timestamp :at="pageLoadedAt-(2*30*24*60*60*1000)" format="calendar"></js-timestamp><br/>
+        </p>
+        <h5 class="pt-4 pb-2 mb-3 border-bottom">2 days ago</h5>
+        <p>
+          <js-timestamp :at="pageLoadedAt-(2*24*60*60*1000)"></js-timestamp><br/>
+          <js-timestamp :at="pageLoadedAt-(2*24*60*60*1000)" format="timeago" short="true"></js-timestamp><br/>
+          <js-timestamp :at="pageLoadedAt-(2*24*60*60*1000)" format="calendar"></js-timestamp><br/>
+        </p>
+        <h5 class="pt-4 pb-2 mb-3 border-bottom">2 hours ago</h5>
+        <p>
+          <js-timestamp :at="pageLoadedAt-(2*60*60*1000)"></js-timestamp><br/>
+          <js-timestamp :at="pageLoadedAt-(2*60*60*1000)" format="timeago" short="true"></js-timestamp><br/>
+          <js-timestamp :at="pageLoadedAt-(2*60*60*1000)" format="calendar"></js-timestamp><br/>
+        </p>
+        <h5 class="pt-4 pb-2 mb-3 border-bottom">15 minutes ago</h5>
+        <p>
+          <js-timestamp :at="pageLoadedAt-(15*60*1000)"></js-timestamp><br/>
+          <js-timestamp :at="pageLoadedAt-(15*60*1000)" format="timeago" short="true"></js-timestamp><br/>
+          <js-timestamp :at="pageLoadedAt-(15*60*1000)" format="calendar"></js-timestamp><br/>
+        </p>
+        <h5 class="pt-4 pb-2 mb-3 border-bottom">45 seconds ago</h5>
+        <p>
+          <js-timestamp :at="pageLoadedAt-(45*1000)"></js-timestamp><br/>
+          <js-timestamp :at="pageLoadedAt-(45*1000)" format="timeago" short="true"></js-timestamp><br/>
+          <js-timestamp :at="pageLoadedAt-(45*1000)" format="calendar"></js-timestamp><br/>
+        </p>
+        <h5 class="pt-4 pb-2 mb-3 border-bottom">Right now</h5>
+        <p>
+          <js-timestamp :at="pageLoadedAt"></js-timestamp><br/>
+          <js-timestamp :at="pageLoadedAt" format="timeago" short="true"></js-timestamp><br/>
+          <js-timestamp :at="pageLoadedAt" format="calendar"></js-timestamp><br/>
+        </p>
+        <h5 class="pt-4 pb-2 mb-3 border-bottom">In an hour</h5>
+        <p>
+          <js-timestamp :at="pageLoadedAt+(60*60*1000)"></js-timestamp><br/>
+          <js-timestamp :at="pageLoadedAt+(60*60*1000)" format="timeago" short="true"></js-timestamp><br/>
+          <js-timestamp :at="pageLoadedAt+(60*60*1000)" format="calendar"></js-timestamp><br/>
+        </p>
+        <h5 class="pt-4 pb-2 mb-3 border-bottom">In two days</h5>
+        <p>
+          <js-timestamp :at="pageLoadedAt+(2*24*60*60*1000)"></js-timestamp><br/>
+          <js-timestamp :at="pageLoadedAt+(2*24*60*60*1000)" format="timeago" short="true"></js-timestamp><br/>
+          <js-timestamp :at="pageLoadedAt+(2*24*60*60*1000)" format="calendar"></js-timestamp><br/>
+        </p>
+        <h5 class="pt-4 pb-2 mb-3 border-bottom">In about two months</h5>
+        <p>
+          <js-timestamp :at="pageLoadedAt+(2*30*24*60*60*1000)"></js-timestamp><br/>
+          <js-timestamp :at="pageLoadedAt+(2*30*24*60*60*1000)" format="timeago" short="true"></js-timestamp><br/>
+          <js-timestamp :at="pageLoadedAt+(2*30*24*60*60*1000)" format="calendar"></js-timestamp><br/>
+        </p>
+        <h5 class="pt-4 pb-2 mb-3 border-bottom">In about two years</h5>
+        <p>
+          <js-timestamp :at="pageLoadedAt+(2*365*24*60*60*1000)"></js-timestamp><br/>
+          <js-timestamp :at="pageLoadedAt+(2*365*24*60*60*1000)" format="timeago" short="true"></js-timestamp><br/>
+          <js-timestamp :at="pageLoadedAt+(2*365*24*60*60*1000)" format="calendar"></js-timestamp><br/>
+        </p>
+      </div>
+    </div>
+    <div class="modal-footer flex-row-reverse justify-content-between">
+      <button type="button" data-dismiss="modal" class="btn btn-info">Close</button>
+      <button type="button" data-dismiss="modal" class="btn btn-outline-info">Cancel</button>
+    </div>
+  </modal>
+</div>
+<%- /* Expose locals as `window.SAILS_LOCALS` :: */ exposeLocalsToBrowser() %>
diff --git a/ee/bulk-operations-dashboard/views/pages/entrance/confirmed-email.ejs b/ee/bulk-operations-dashboard/views/pages/entrance/confirmed-email.ejs
new file mode 100644
index 0000000000..0f3539dbb6
--- /dev/null
+++ b/ee/bulk-operations-dashboard/views/pages/entrance/confirmed-email.ejs
@@ -0,0 +1,11 @@
+<div id="confirmed-email" v-cloak>
+  <div class="container-fluid pt-5 pb-5">
+    <h1 class="text-center">Email confirmed</h1>
+    <div style="max-width: 450px;" class="mx-auto text-center">
+      <hr/>
+      <p>Congratulations, your account is now verified! You now have full access to your account.</p>
+      <p><a class="btn btn-outline-info" href="/">To my dashboard</a></p>
+    </div>
+  </div>
+</div>
+<%- /* Expose locals as `window.SAILS_LOCALS` :: */ exposeLocalsToBrowser() %>
diff --git a/ee/bulk-operations-dashboard/views/pages/entrance/forgot-password.ejs b/ee/bulk-operations-dashboard/views/pages/entrance/forgot-password.ejs
new file mode 100644
index 0000000000..22d29591d6
--- /dev/null
+++ b/ee/bulk-operations-dashboard/views/pages/entrance/forgot-password.ejs
@@ -0,0 +1,27 @@
+<div id="forgot-password" v-cloak>
+  <div class="container-fluid pt-5 pb-5">
+    <h1 class="text-center">Recover password</h1>
+    <div style="max-width:  450px;" class="mx-auto" v-if="!cloudSuccess">
+      <p class="text-center">Enter your email address below to reset the password for your account.</p>
+      <hr/>
+      <ajax-form action="sendPasswordRecoveryEmail" :syncing.sync="syncing" :cloud-error.sync="cloudError" :form-data="formData" :form-rules="formRules" :form-errors.sync="formErrors" @submitted="submittedForm()">
+        <div class="form-group">
+          <input type="email" name="email-address" class="form-control" placeholder="sturgeon@example.com" :class="[formErrors.emailAddress ? 'is-invalid' : '']" v-model.trim="formData.emailAddress" autocomplete="email" focus-first>
+          <div class="invalid-feedback" v-if="formErrors.emailAddress">Please enter a valid email address.</div>
+        </div>
+        <cloud-error v-if="cloudError"></cloud-error>
+        <div class="form-group">
+          <ajax-button type="submit" :syncing="syncing" class="btn btn-dark btn-lg btn-block">Send reset link</ajax-button>
+        </div>
+      </ajax-form>
+      <p class="text-center"><a href="/login">Back to login</a></p>
+    </div>
+    <div style="max-width:  450px;" class="mx-auto text-center" v-else>
+      <p>We've sent you a link to update your password.</p>
+      <hr/>
+      <p>If the email doesn’t arrive after a few minutes, try checking your spam folder.  If you still can’t find it, please try again, or <a href="/contact">contact support</a>.</p>
+      <p class="text-center"><a class="btn btn-outline-primary" href="/login">Back to login</a></p>
+    </div>
+  </div>
+</div>
+<%- /* Expose locals as `window.SAILS_LOCALS` :: */ exposeLocalsToBrowser() %>
diff --git a/ee/bulk-operations-dashboard/views/pages/entrance/login.ejs b/ee/bulk-operations-dashboard/views/pages/entrance/login.ejs
new file mode 100644
index 0000000000..e2855782cf
--- /dev/null
+++ b/ee/bulk-operations-dashboard/views/pages/entrance/login.ejs
@@ -0,0 +1,29 @@
+<div id="login" v-cloak>
+  <div class="container-fluid pt-5 pb-5">
+    <h1 class="text-center">Sign in to your account</h1>
+    <div style="max-width: 450px;" class="mx-auto">
+      <hr/>
+      <ajax-form action="login" :syncing.sync="syncing" :cloud-error.sync="cloudError" :form-data="formData" :form-rules="formRules" :form-errors.sync="formErrors" @submitted="submittedForm()">
+        <div class="form-group">
+          <input type="email" class="form-control" placeholder="Email address" :class="[formErrors.emailAddress ? 'is-invalid' : '']" v-model.trim="formData.emailAddress" autocomplete="email" focus-first>
+          <div class="invalid-feedback" v-if="formErrors.emailAddress">Please provide a valid email address.</div>
+        </div>
+        <div class="form-group">
+          <input type="password" class="form-control" placeholder="Password" :class="[formErrors.password ? 'is-invalid' : '']" v-model.trim="formData.password" autocomplete="current-password">
+          <div class="invalid-feedback" v-if="formErrors.password">Please enter your password.</div>
+        </div>
+        <div class="form-group form-check">
+          <input class="form-check-input" type="checkbox" id="remember" name="rememberMe" v-model="formData.rememberMe"/>
+          <label class="form-check-label" for="remember">Remember me</label>
+        </div>
+        <cloud-error v-if="cloudError==='badCombo'">The credentials you entered are not associated with an account. Please check your email and/or password and try again.</cloud-error>
+        <cloud-error v-else-if="cloudError"></cloud-error>
+        <div class="form-group">
+          <ajax-button :syncing="syncing" class="btn-dark btn-lg btn-block">Sign in</ajax-button>
+        </div>
+      </ajax-form>
+      <p class="text-center"><a href="/password/forgot">Forgot your password?</a></p>
+    </div>
+  </div>
+</div>
+<%- /* Expose locals as `window.SAILS_LOCALS` :: */ exposeLocalsToBrowser() %>
diff --git a/ee/bulk-operations-dashboard/views/pages/entrance/new-password.ejs b/ee/bulk-operations-dashboard/views/pages/entrance/new-password.ejs
new file mode 100644
index 0000000000..c276aaa8c7
--- /dev/null
+++ b/ee/bulk-operations-dashboard/views/pages/entrance/new-password.ejs
@@ -0,0 +1,26 @@
+<div id="new-password" v-cloak>
+  <div class="container-fluid pt-5 pb-5">
+    <h1 class="text-center">Reset password</h1>
+    <div style="max-width: 450px" class="mx-auto">
+      <hr/>
+      <ajax-form action="updatePasswordAndLogin" :syncing.sync="syncing" :cloud-error.sync="cloudError" :form-data="formData" :form-rules="formRules" :form-errors.sync="formErrors" @submitted="submittedForm()">
+        <div class="form-group">
+          <label for="password">New password</label>
+          <input class="form-control" id="password" name="password" type="password"  :class="[formErrors.password ? 'is-invalid' : '']" v-model.trim="formData.password" placeholder="••••••••" autocomplete="new-password" focus-first>
+          <div class="invalid-feedback" v-if="formErrors.password">Please enter a password.</div>
+        </div>
+        <div class="form-group">
+          <label for="confirm-password">Confirm password</label>
+          <input class="form-control" id="confirm-password" name="confirm-password" type="password"  :class="[formErrors.confirmPassword ? 'is-invalid' : '']" v-model.trim="formData.confirmPassword" placeholder="••••••••" autocomplete="new-password">
+          <div class="invalid-feedback" v-if="formErrors.confirmPassword">Your new password and confirmation do not match.</div>
+        </div>
+        <cloud-error v-if="cloudError"></cloud-error>
+        <div class="form-group">
+          <ajax-button type="submit" :syncing="syncing" class="btn btn-dark btn-lg btn-block">Submit</ajax-button>
+        </div>
+      </ajax-form>
+      <p class="text-center">Remember your password? <a href="/login">Login</a></p>
+    </div>
+  </div>
+</div>
+<%- /* Expose locals as `window.SAILS_LOCALS` :: */ exposeLocalsToBrowser() %>
diff --git a/ee/bulk-operations-dashboard/views/pages/entrance/signup.ejs b/ee/bulk-operations-dashboard/views/pages/entrance/signup.ejs
new file mode 100644
index 0000000000..5a76182f01
--- /dev/null
+++ b/ee/bulk-operations-dashboard/views/pages/entrance/signup.ejs
@@ -0,0 +1,51 @@
+<div id="signup" v-cloak>
+  <div class="container-fluid pt-5 pb-5" v-if="!cloudSuccess">
+    <h1 class="text-center">Create an account</h1>
+    <div style="max-width: 450px;" class="mx-auto" >
+      <p class="text-center">Let's get started! Becoming a member is free and only takes a few minutes.</p>
+      <hr/>
+      <ajax-form action="signup" :syncing.sync="syncing" :cloud-error.sync="cloudError" :form-errors.sync="formErrors" :form-data="formData" :form-rules="formRules" @submitted="submittedForm()">
+        <div class="form-group">
+          <label for="full-name">Full name</label>
+          <input class="form-control" id="full-name" type="text"  :class="[formErrors.fullName ? 'is-invalid' : '']" v-model.trim="formData.fullName" placeholder="Sturgis P. Sturgeon" autocomplete="name" focus-first>
+          <div class="invalid-feedback" v-if="formErrors.fullName">Please enter your full name.</div>
+        </div>
+        <div class="form-group">
+          <label for="email-address">Email address</label>
+          <input class="form-control" id="email-address" type="email"  :class="[formErrors.emailAddress ? 'is-invalid' : '']" v-model.trim="formData.emailAddress" placeholder="sturgeon@example.com" autocomplete="email">
+          <div class="invalid-feedback" v-if="formErrors.emailAddress">Please enter a valid email address.</div>
+        </div>
+        <div class="form-group">
+          <label for="password">Choose a password</label>
+          <input class="form-control" id="password" type="password"  :class="[formErrors.password ? 'is-invalid' : '']" v-model.trim="formData.password" placeholder="••••••••" autocomplete="new-password">
+          <div class="invalid-feedback" v-if="formErrors.password">Please enter a password.</div>
+        </div>
+        <div class="form-group">
+          <label for="confirm-password">Confirm password</label>
+          <input class="form-control" id="confirm-password" type="password"  :class="[formErrors.confirmPassword ? 'is-invalid' : '']" v-model.trim="formData.confirmPassword" placeholder="••••••••" autocomplete="new-password">
+          <div class="invalid-feedback" v-if="formErrors.confirmPassword">Your password and confirmation do not match.</div>
+        </div>
+        <div class="form-group form-check">
+          <input class="form-check-input" id="terms-agreement" type="checkbox" v-model="formData.agreed">
+          <label for="terms-agreement" class="form-check-label" :class="[formErrors.agreed ? 'text-danger' : '']">I have read &amp; agree to the <a target="_blank" href="/terms">terms of service</a>.</label>
+        </div>
+        <cloud-error v-if="cloudError==='emailAlreadyInUse'">It looks like there's already an account with your email address. If you forgot your password, you can recover it <a href="password/forgot">here</a>.</cloud-error>
+        <cloud-error v-else-if="cloudError"></cloud-error>
+        <div class="form-group">
+          <ajax-button type="submit" :syncing="syncing" class="btn-dark btn-lg btn-block">Create account</ajax-button>
+        </div>
+      </ajax-form>
+      <p class="text-center">Have an account? <a href="/login">Sign in</a></p>
+    </div>
+  </div>
+  <div class="container-fluid pt-5 pb-5" v-if="cloudSuccess">
+    <h1 class="text-center">Check your email!</h1>
+    <div class="text-center">
+      <hr/>
+      <p>Your account is nearly ready. All you have to do is click the link we sent to <strong>{{formData.emailAddress}}</strong>.</p>
+      <p>(You can still access your dashboard now, but some features will be unvavailable until we've verified your email address.)</p>
+      <p><a class="btn btn-outline-info" href="/">Go to dashboard</a></p>
+    </div>
+  </div>
+</div>
+<%- /* Expose locals as `window.SAILS_LOCALS` :: */ exposeLocalsToBrowser() %>
diff --git a/ee/bulk-operations-dashboard/views/pages/faq.ejs b/ee/bulk-operations-dashboard/views/pages/faq.ejs
new file mode 100644
index 0000000000..d6f19b22b7
--- /dev/null
+++ b/ee/bulk-operations-dashboard/views/pages/faq.ejs
@@ -0,0 +1,151 @@
+<div id="faq">
+  <div class="container pt-5 pb-5">
+    <h1>FAQ</h1>
+    <div>
+      <hr class="mt-4 mb-4"/>
+      <h4>What is this page for?</h4>
+      <p>This is a template for building your own "Frequently Asked Questions" page.  It was generated automatically as part of the expanded seed app provided by <a href="https://sailsjs.com/about">Sails</a>.  On top of its primary purpose as a template, this page doubles as a handy guide about the seed app itself.</p>
+      <p><small>Before you deploy this app to production, be sure to replace the content on this page with real questions and answers that are relevant to your project.  Or if you don't need an FAQ, just delete this file altogether.</small></p>
+    </div>
+    <div>
+      <hr class="mt-4 mb-4"/>
+      <h4>Other than Sails, what technologies, frameworks, or services does this app rely on?</h4>
+      <p>This app includes several tools and integrations that we use frequently on top of Sails.  They've worked well for us in the past; allowing us to focus on developing new features with minimal overhead.  Some are files we've rolled ourselves, and the rest are 3rd party services and frameworks. While a couple of these will require you to make an account (or obtain an API key, etc.), we want to emphasize that we only included trusted, reliable tools that we feel comfortable using on our own projects, and our customers' projects.</p>
+      <ul class="pl-3 pl-sm-5">
+        <li><a target="_blank" href="http://getbootstrap.com/docs/4.0/getting-started/introduction/"><strong>Bootstrap 4</strong></a> - Front-end component library</li>
+        <li><a target="_blank" href="http://fontawesome.io/icons/"><strong>Font Awesome 4</strong></a> - Icons</li>
+        <li><a target="_blank" href="https://vuejs.org/"><strong>Vue.js</strong></a> - Front-end framework</li>
+        <li><a target="_blank" href="https://npmjs.com/package/parasails"><strong>parasails.js</strong></a> - Thin layer of bundled conventions for using Vue.js with Sails.js, and dynamically-generated SDK for handling AJAX and/or WebSocket requests from the front-end to the actions in your Sails app. (More info on usage below.)</li>
+        <li><a target="_blank" href="https://www.sendgrid.com/"><strong>Sendgrid</strong></a>* - Emails</li>
+        <li><a target="_blank" href="https://stripe.com/docs"><strong>Stripe</strong></a>* - Payments</li>
+      </ul>
+      <p><small>* requires an API key</small></p>
+    </div>
+    <div>
+      <hr class="mt-4 mb-4"/>
+      <h4>Why do I see placeholders like "NEW_APP_NAME" all over the place? What's the best way to customize these?</h4>
+      <p>Because projects are often generated before product and/or company names are finalized, we felt it made more sense to use easily find-and-replaceable placeholders than to prompt for an app or company name at the beginning. (It's a lot easier to find/replace "NEW_APP_NAME" without conflicts than it is to find/replace a more commonly-used word.)</p>
+      <p>When you've got your product, company name, and branding finalized, here are the placeholders you'll want to switch out:</p>
+      <ul class="pl-3 pl-sm-5">
+        <li><strong purpose="placeholder">NEW_APP_NAME</strong> - You can replace this with the name of your product.</li>
+        <li><strong purpose="placeholder">NEW_APP_COMPANY_NAME</strong> - This placeholder is used for the entity name in the default legal terms &amp; privacy policy, and can be replaced with the name of the company behind your app.</li>
+        <li><strong purpose="placeholder">DATE_PRIVACY_POLICY_LAST_UPDATED</strong> - Replace this with the date your Privacy Policy was updated (so if you're switching out the company name: today).</li>
+        <li><strong purpose="placeholder">DATE_TERMS_OF_SERVICE_LAST_UPDATED</strong> - Replace this with the date your Terms of Service were updated (so if you're switching out the company name: today).</li>
+        <li><strong purpose="placeholder">NEW_APP_COMPANY_ABOUT_HREF</strong> - This is the link in the copyright section of the footer. You'll probably want to switch it out for a link to your company's about page or marketing site.</li>
+        <li>Placeholder logo - To use your custom branding, you can simply replace the image file at <code>assets/images/logo.png</code> with a custom image of the same name, or change the image <code>src</code> in the header in <code>views/layouts/layout.ejs</code>.</li>
+      </ul>
+      <blockquote><small>Just a heads up, the previous couple paragraphs will make a lot less sense once you've done a find/replace on each of those placeholder words.</small></blockquote>
+    </div>
+    <div>
+      <hr class="mt-4 mb-4"/>
+      <h4>How do I configure a new method to use with cloud.js?</h4>
+      <p>Once you've created a controller action and added it to your routes (see the <a target="_blank" href="https://sailsjs.com/documentation/concepts/routes">Sails.js docs for more info on how to do that</a>), there are just a few simple steps to add it to your global <code>Cloud</code> SDK:</p>
+      <ul class="pl-3 pl-sm-5">
+        <li>Rebuild this app's custom SDK using <code>sails run scripts/rebuild-cloud-sdk</code>.  (This automatically regenerates the method definitions in your <code>assets/js/cloud.setup.js</code> file based on your configured routes.)</li>
+        <li>You can then call any relevant new actions as "cloud methods" in your frontend code like so: <code>await Cloud.doSomething.with({…})</code></li>
+      </ul>
+    </div>
+    <div>
+      <hr class="mt-4 mb-4"/>
+      <h4>How do I register a new page with parasails.js?</h4>
+      <p>To generate files for a new page (for example, "hotels-overview"), run:</p>
+      <p><code>sails generate page hotels-overview</code></p>
+      <p>Then you can add a route for the new view action to make it accessible from the browser.  For example:</p>
+      <p><code>'GET /hotels': { action: 'view-hotels-overview' }</code></p>
+      <p><small>To register a new page without the generator, make sure the top-level element of the view you wish to register has an <code>id</code> property (e.g. <code>&lt;div id="my-new-page"&gt;...&lt;/div&gt;</code>). Then, create a new javascript file, and include <code>parasails.registerPage('my-new-page', { /* options for the Vue.js instance */ })</code>. For more thorough examples, dig around in <code>assets/js/pages/</code>.</small></p>
+    </div>
+    <div>
+      <hr class="mt-4 mb-4"/>
+      <h4>What's up with all the inline styles?</h4>
+      <p>Since this starter app uses Bootstrap, we wanted to make it a little clearer where our custom styles end and Bootstrap styles begin. Wherever possible, you'll see <code>style="..."</code> in the HTML. If for some reason a style tag wouldn't work (e.g. for media queries), you'll see <code>purpose="..."</code> in the HTML, and <code>[purpose='...']</code> in the .less file– we took that approach, rather than using custom class names, to help avoid confusion about which classes come from Bootstrap and which ones we added ourselves.</p>
+      <p>Another reason: copy/pasting! With the styles inline, it's easy to copy HTML from a page without the need to also duplicate styles from the matching .less files.</p>
+    </div>
+    <div>
+      <hr class="mt-4 mb-4"/>
+      <h4>How do I deploy to Heroku?</h4>
+      <p>In your <a target="_blank" href="https://dashboard.heroku.com">Heroku dashboard</a>, configure your app to auto-deploy from the <code>deploy</code> branch of this project's GitHub repository. Then, from the command line, run <code>sails run deploy</code>.</p>
+      <p>For more deployment tips, <a href="https://sailsjs.com/documentation/concepts/deployment">click here</a>.</p>
+    </div>
+    <div>
+      <hr class="mt-4 mb-4"/>
+      <h4>Do I have to host on Heroku?</h4>
+      <p>No way!  You can deploy your app <a target="_blank" href="https://sailsjs.com/documentation/concepts/deployment/hosting">anywhere that supports Node.js</a>.</p>
+    </div>
+    <div>
+      <hr class="mt-4 mb-4"/>
+      <h4>How do I verify my user's email addresses?</h4>
+      <p>By default, email verification is neither required for signup, nor for when an existing user changes their email address from their account page.  To enable an email verification step for both of these actions, open <code>config/custom.js</code> and change <code>verifyEmailAddresses: false</code> to <code>verifyEmailAddresses: true</code>.</p>
+    </div>
+    <div>
+      <hr class="mt-4 mb-4"/>
+      <h4>How do I finish setting up Sendgrid?</h4>
+      <p>To use Sendgrid, you'll need to <a target="_blank" href="https://www.sendgrid.com/">sign up for an account</a>. (While this <em>is</em> a paid service at higher usage levels, you should be able to use Sendgrid in development without having to provide any credit card information.)</p>
+      <p>After you've created an account, you'll need to add your Sendgrid API secret to your custom config. (In development, this will be either in <code>config/custom.js</code>, or in a <code>local.js</code> file you add to your <code>config/</code> folder. For your staging or production deployment, you'll want to set these using system environment variables -- aka "config variables" in Heroku.)</p>
+      <p>If you already own a domain for your app, you can follow Sendgrid's instructions for configuring a sending domain.</p>
+      <p>Otherwise, to send emails from this app <em>without</em> configuring a sending domain, you can <a target="_blank" href="https://app.sendgrid.com/settings/sender_auth">verify a single sender</a>. Just be sure to set <code>sails.config.custom.fromEmailAddress</code> to use the verified email, or there will be errors from the endpoints that attempt to send emails.</p>
+    </div>
+    <div>
+      <hr class="mt-4 mb-4"/>
+      <h4>How do I finish setting up Stripe?</h4>
+      <p>To use Stripe for your app's payment processing, you'll need to <a target="_blank" href="https://stripe.com">sign up for an account</a>.</p>
+      <p>Once you have an account, you'll need to include your publishable and secret keys in your app's custom config as <code>sails.config.custom.stripePublishableKey</code> and <code>sails.config.custom.stripeSecret</code>. In development, you can add your test keys to <code>config/custom.js</code>, or in a <code>local.js</code> file you add to your <code>config/</code> folder.</p>
+      <p>In your staging or production deployment, you'll want to set your API keys using system environment variables (aka "config variables" in Heroku), and you will need ensure that your site meets Stripe's HTTPS requirements in order for Stripe Checkout to work. For more information, see Stripe's <a target="_blank" href="https://stripe.com/docs/checkout">Detailed Checkout Guide</a>.</p>
+    </div>
+    <div>
+      <hr class="mt-4 mb-4"/>
+      <h4>How do I disable ___________?</h4>
+      <p class="pt-4 text-muted"><strong><em>To disable the Bootstrap framework:</em></strong></p>
+      <ul class="pl-3 pl-sm-5">
+        <li>Delete the folder <code>assets/dependencies/bootstrap/</code></li>
+        <li>In <code>tasks/pipeline.js</code>, delete <code>'dependencies/bootstrap/dependencies/**/*.js',</code> from <code>jsFilesToInject</code></li>
+      </ul>
+      <p class="pt-4 text-muted"><strong><em>To disable FontAwesome:</em></strong></p>
+      <ul class="pl-3 pl-sm-5">
+        <li>Delete the folder at <code>assets/dependencies/font-awesome-4/</code>. (You'll also likely want to search the project for "fa fa-" to check for any lingering icons in the HTML.)</li>
+      </ul>
+      <p class="pt-4 text-muted"><strong><em>To swap out Sendgrid:</em></strong></p>
+      <p>We chose Sendgrid because of its very generous free tier (you can send up to 100 emails per day).  Plus, it integrates easily, it's been around for a while (so it's stable and does a good job evading spam filters), and it's used internally at companies like Slack and Medium.</p>
+      <p>Out-of-the box, if Sendgrid is not configured for this app, the contact form and password recovery flow will fail outright unless an email address ending in "@example.com" is used.  Luckily, if you wish to use <a target="_blank" href="https://stackshare.io/twilio-sendgrid">a different solution for sending automated emails</a>, the logic for sending emails is fairly contained. To switch to a service other than Sendgrid, you'll need to make the following changes to your code:</p>
+      <ul class="pl-3 pl-sm-5">
+        <li>Modify the code in <code>api/helpers/send-template-email.js</code> to use the email service of your choice.</li>
+        <li>In <code>api/hooks/custom/index.js</code>, remove the warnings related to Sendgrid.</li>
+      </ul>
+      <p class="pt-4 text-muted"><strong><em>To remove or replace Stripe integration:</em></strong></p>
+      <p>We chose Stripe because it is the easiest-to-integrate payment processor in the industry.  Its rates are about the same <a target="_blank" href="https://stackshare.io/stripe/alternatives">as its competitors'</a>, but even if that weren't the case, Stripe's focus on developer happiness would probably make up for it.  Stripe processes payments, payouts, and more for <a target="_blank" href="https://stripe.com/us/customers">hundreds of thousands of businesses</a> all around the world.</p>
+      <p>By default, features related to billing are automatically disabled if you don't have a Stripe publishable key &amp; secret key in your custom config (<code>sails.config.custom.stripePublishableKey</code> and <code>sails.config.custom.stripeSecret</code>, respectively). Your app will not be negatively impacted or appear broken; it will merely have some extraneous code in places. If you don't anticipate integrating billing features into your app and want to remove this code entirely, you can make the following changes:</p>
+      <ul class="pl-3 pl-sm-5">
+        <li>In the <code>User</code> model definition at <code>api/models/User.js</code>, remove the <code>stripeCustomerId</code>, <code>billingCardBrand</code>, <code>billingCardLast4</code>, <code>billingCardExpMonth</code>, and <code>billingCardExpYear</code> attribute definitions.</li>
+        <li>In the "signup" action at <code>api/controllers/entrance/signup.js</code>:
+          <ul class="pl-3 pl-sm-5">
+            <li>Remove the line at the top requiring the Stripe dependency</li>
+            <li>Remove the block of code creating a Stripe customer. (If you have trouble finding where this happens, be sure to read the comments.)</li>
+            <li>In the call to <code>User.create()</code>, remove the <code>stripeCustomerId</code> property.</li>
+          </ul>
+        </li>
+        <li>In the "confirm email" action at <code>api/controllers/entrance/confirm-email.js</code>:
+          <ul class="pl-3 pl-sm-5">
+            <li>Remove the line at the top requiring the Stripe dependency.</li>
+            <li>Remove the block of code that handles creating/updating a Stripe customer. (If you have trouble finding where this happens, be sure to read the comments.)</li>
+          </ul>
+        </li>
+        <li>Remove the update billing card endpoint and all references to it by doing the following:
+          <ul class="pl-3 pl-sm-5">
+            <li>Delete the file at <code>api/controllers/account/update-billing-card.js</code>.</li>
+            <li>In <code>config/routes.js</code>, delete the route configuration for <code>'PUT /api/v1/account/update-billing-card'</code>.</li>
+            <li>In <code>assets/js/cloud.setup.js</code>, delete the <code>updateBillingCard</code> method.</li>
+            <li>In <code>assets/js/pages/account/account-overview.page.js</code>, remove the <code>clickStripeCheckoutButton</code> method.</li>
+            <li>In <code>views/pages/account/account-overview.ejs</code>, remove the HTML related to billing.</li>
+          </ul>
+        </li>
+        <li>In <code>api/hooks/custom/index.js</code>, remove the warnings related to Stripe.</li>
+        <li>In <code>api/hooks/custom/index.js</code>, remove <code>sails.config.custom.enableBillingFeatures = !isMissingStripeConfig;</code>.</li>
+      </ul>
+    </div>
+    <div>
+      <hr class="mt-4 mb-4"/>
+      <h4>Where can I go for more help?</h4>
+      <p>If you run into trouble, you can often find the answer in the <a target="_blank" href="http://sailsjs.com/documentation">Sails.js documentation</a>.  If you're unsure about how to proceed, or completely stumped, be sure to check out the <a target="_blank" href="http://sailsjs.com/support">latest available resources</a>.</p>
+    </div>
+  </div>
+</div>
+<%- /* Expose locals as `window.SAILS_LOCALS` :: */ exposeLocalsToBrowser() %>
diff --git a/ee/bulk-operations-dashboard/views/pages/homepage.ejs b/ee/bulk-operations-dashboard/views/pages/homepage.ejs
new file mode 100644
index 0000000000..b96f3a651e
--- /dev/null
+++ b/ee/bulk-operations-dashboard/views/pages/homepage.ejs
@@ -0,0 +1,106 @@
+<div id="homepage" v-cloak>
+  <div style="padding-top: 100px; padding-bottom: 25px; color: #14acc2;" class="d-flex flex-column justify-content-center position-relative" purpose="full-page-hero">
+    <div class="container text-center">
+      <div style="width: 220px; height: 170px;" class="mx-auto position-relative">
+        <img style="width: 170px; left: 25px; top: 25px;" class="position-absolute" alt="The sky above the ocean" src="/images/hero-sky.png"/>
+        <img style="width: 80px; top: 55px; left: -40px;" class="position-absolute" purpose="cloud-1" alt="A grayish-blue cloud" src="/images/hero-cloud.png"/>
+        <img style="width: 80px; top: 45px; left: -40px;" class="position-absolute" purpose="cloud-2" alt="Another grayish-blue cloud" src="/images/hero-cloud.png"/>
+        <img style="width: 160px; bottom: 50px; left: 18px;" class="position-absolute" purpose="ship" alt="A ship hovering a few feet over the surface of the water, bearing a flagpole with the Sails.js logo" src="/images/hero-ship.png"/>
+        <img style="width: 170px; bottom: 40px; left: 25px;" class="position-absolute" alt="The shadow of the floating ship on the water" src="/images/hero-water.png"/>
+      </div>
+      <h1 class="display-4 pb-5">A new <strong>Sails</strong> app.</h1>
+      <div>
+        <div style="cursor: pointer; bottom: 25px; left: 0;" class="position-absolute w-100 mt-5" purpose="more-info-text" @click="clickHeroButton()">
+          <div style="letter-spacing: 2px;" class="text-uppercase font-weight-bold">Dive in</div>
+          <div style="font-size: 20px;">&darr;</div>
+        </div>
+      </div>
+    </div>
+  </div>
+  <div style="background-color: rgba(238, 245, 249, 0.72);" class="text-center py-5" purpose="scroll-destination">
+    <div class="container pt-3 pb-5" purpose="about-section">
+      <h3>This is your freshly-generated project + a few extras.</h3>
+      <p style="max-width: 800px;" class="mx-auto">In our time <a target="_blank" href="https://sailsjs.com/about">building apps for customers</a>, we've found ourselves re-rolling some of the same key features over and over again between projects.  So we picked some of the things that kept popping up, implemented our own opinionated solutions for them, and then included it all in this free and open-source starter app.  We hope it helps you as much as it helps us!</p>
+      <div class="row pt-5">
+        <div class="mb-4 mb-sm-0 col-sm">
+          <div style="color: #fff; background-color: #14acc2; font-size: 35px; line-height: 75px; height: 75px; width: 75px;" class="rounded-circle mx-auto text-center mb-3">
+            <i class="fa fa-envelope"></i>
+          </div>
+          <h4>Emails</h4>
+          <p class="text-muted">Built-in support for internal emails from the <a href="/contact">contact form</a>, as well as transactional emails for users.</p>
+        </div>
+        <div class="pt-4 pt-sm-0 mb-4 mb-sm-0 col-sm">
+          <div style="color: #fff; background-color: #14acc2; font-size: 35px; line-height: 75px; height: 75px; width: 75px;" class="rounded-circle mx-auto text-center mb-3">
+            <i class="fa fa-lock"></i>
+          </div>
+          <h4>Authentication</h4>
+          <p class="text-muted">Ready-to-go, customizable <a href="/signup">sign up</a>, <a href="/login">login</a>, and <a href="/password/forgot">password recovery</a> flows for your users.</p>
+        </div>
+        <div class="pt-4 pt-sm-0 col-sm">
+          <div style="color: #fff; background-color: #14acc2; font-size: 35px; line-height: 75px; height: 75px; width: 75px;" class="rounded-circle mx-auto text-center mb-3">
+            <i class="fa fa-credit-card"></i>
+          </div>
+          <h4>Billing</h4>
+          <p class="text-muted">Hook up to your Stripe account for managing customers and payment sources.</p>
+        </div>
+      </div>
+      <a class="btn btn-outline-info mt-3" href="/faq">Learn more</a>
+    </div>
+  </div>
+  <div class="container pt-5">
+    <div class="pt-5" purpose="setup-section">
+      <h3 class="text-center">How to get started:</h3>
+      <div class="position-relative my-5" purpose="setup-step">
+        <div style="left: 0; top: 0; width: 140px;" class="position-absolute d-none d-lg-block">
+          <img alt="computer with email symbol on screen" src="/images/setup-email.png" class="w-100"/>
+        </div>
+        <h5>Set up your branding and content</h5>
+        <p>This starter app includes several different page templates (including the one you're reading right now) that you can change as much or as little as you like.  If there are any pages you won't need, just remove them.</p>
+        <p>To get started, do a global find/replace in this project for occurrences of <code>NEW_APP_NAME</code> and replace them all with the actual name of your app or platform (e.g. "Facebag").  Then do the same thing again to replace <code>NEW_APP_COMPANY_NAME</code> with the actual name of your organization (e.g. "Facebag Corporation").</p>
+        <blockquote><small>This app also includes a default <a href="/legal/terms">Terms of Use</a> and <a href="/legal/privacy">Privacy Policy</a>.  We want to make it easier for apps to be transparent about their users' rights and privacy.  But we are developers, not lawyers; and this is <em>definitely not legal advice</em>.  Before going live, be sure to replace these example documents with your own company's policies, and <a href="https://en.wikipedia.org/wiki/Counsel" target="_blank">seek counsel</a> for assistance if you need to design new terms from scratch.</small></blockquote>
+      </div>
+      <div class="position-relative my-5" purpose="setup-step">
+        <div style="left: 0; top: 0; width: 140px;" class="position-absolute d-none d-lg-block">
+          <img alt="computer with credit card icon on screen" src="/images/setup-payment.png" class="w-100"/>
+        </div>
+        <h5>Configure integrations</h5>
+        <p>In order for this app to send automated emails, you'll need to create a <a target="_blank" href="https://sendgrid.com/">Sendgrid</a> account.  Then, in <code>config/custom.js</code>, configure the following:</p>
+        <div class="card bg-light mb-4">
+          <div class="card-body"><pre><code><span class="text-muted">// Recipient of contact form messages</span>
+internalEmailAddress: my.email@example.com,
+
+<span class="text-muted">// For outgoing emails</span>
+fromEmailAddress: 'noreply@example.com',
+fromName: 'The NEW_APP_NAME Team',
+
+<span class="text-muted">// Sendgrid settings</span>
+sendgridSecret: 'SG.fake.3e0Bn0qSQVnwb1E4qNPz9JZP5vLZYqjh7sn8S93oSHU'</code></pre>
+          </div>
+        </div>
+        <p>To enable support for billing features, you'll need to make a <a target="_blank" href="https://stripe.com">Stripe</a> account, then include your test credentials like so:</p>
+        <div class="card bg-light mb-4">
+          <div class="card-body"><pre><code><span class="text-muted">// Stripe credentials</span>
+stripePublishableKey: 'pk_test_Zzd814nldl91104qor5911gjald',
+stripeSecret: 'sk_test_Zzd814nldl91104qor5911gjald'</code></pre>
+          </div>
+        </div>
+        <blockquote><small>If your app doesn't need payment processing, it will still work without Stripe configuration. In this case, all references to billing will just be omitted from the UI.</small></blockquote>
+      </div>
+      <div class="position-relative my-5" purpose="setup-step">
+        <div style="left: 0; top: 0; width: 140px;" class="position-absolute d-none d-lg-block">
+          <img alt="computer with sails logo on screen" src="/images/setup-customize.png" class="w-100"/>
+        </div>
+        <h5>Customize</h5>
+        <p>Once the initial configuration is done, you're ready to start building out the rest of your app.</p>
+        <p>We worked hard to make this starter app's structure consistent and its files are as bare-bones as possible, so it's easy to add new pages and business logic following the conventions we set up. If you run into trouble, have a look at <a href="/faq">your new FAQ page</a>, which covers the tools we used and how to customize.  For a deeper dive, check out the Sails <a href="https://courses.platzi.com/courses/sails-js/">walkthrough</a>, <a href="https://sailsjs.com/documentation">reference documentation</a> and <a href="https://sailsjs.com/support">support</a> pages.</p>
+      </div>
+    </div>
+    <hr/>
+    <div class="text-center py-5" purpose="pep-talk">
+      <h3>Let's get to work.</h3>
+      <p style="max-width: 800px;" class="mx-auto">We think this project is a pretty convenient starting point, but of course there's no one-size-fits-all solution. The good news is, this app is in your hands now, so you can jump into the files and adapt it to your needs. Change some code around. Break stuff.  Fix it. And above all: <strong>make something people want to use</strong>.</p>
+      <p class="mb-5"><span class="text-muted">&hearts;</span> <a href="https://sailsjs.com/about" class="border-0">The Sails Team</a></p>
+    </div>
+  </div>
+</div>
+<%- /* Expose locals as `window.SAILS_LOCALS` :: */ exposeLocalsToBrowser() %>
diff --git a/ee/bulk-operations-dashboard/views/pages/legal/privacy.ejs b/ee/bulk-operations-dashboard/views/pages/legal/privacy.ejs
new file mode 100644
index 0000000000..a82bcd6034
--- /dev/null
+++ b/ee/bulk-operations-dashboard/views/pages/legal/privacy.ejs
@@ -0,0 +1,82 @@
+<div id="privacy">
+  <div class="container pt-5 pb-5">
+    <h1>NEW_APP_COMPANY_NAME privacy policy</h1>
+    <hr/>
+    <p>At NEW_APP_COMPANY_NAME we care deeply about your privacy, and we take pride in being a good steward of any data you choose to share with us.  If you have any questions about how we use or handle user data, just <a href="/contact">ask</a> and we'll get back to you in a jiffy.</p>
+
+    <h3>General information</h3>
+    <p>We believe it is important for you to understand what types of information we are collecting and what may happen to that information when using our website and related applications and resources (collectively, the “Service”). This Privacy Policy is designed to explain NEW_APP_COMPANY_NAME’s policies and procedures with respect of collection, use and disclosure by NEW_APP_COMPANY_NAME of information about you in connection with the Service. This Privacy Policy has a limited scope and applies only to the Service.</p>
+    <p>By accessing the Service, you consent to the collection, use and disclosure of your personal information as explained in this privacy policy (the “Privacy Policy”). This Privacy Policy is incorporated into and is subject to the Terms of Service, which can be accessed <a href="/terms">here</a>. Your use of the Service and any information you provide through the Service is subject to the terms of this Privacy Policy and our Terms of Service.</p>
+
+    <h3>What you will find in this privacy policy?</h3>
+    <ol>
+      <li>How we collect information about you</li>
+      <li>How we use or share information about you</li>
+      <li>How we safeguard information about you</li>
+      <li>Other matters related to the information we collect about you</li>
+    </ol>
+
+    <h3>Collection of information</h3>
+    <p>We collect information about you in a variety of ways in connection the Service. NEW_APP_COMPANY_NAME will be the controller of your personal data processed in connection with the Service, and can be contacted <a href="/contact">here</a>.</p>
+    <h5>Registration</h5>
+    <p>To use some features and resources available through the Service, a user must complete our registration process. During registration, a user is required to provide certain categories of information, which may include personally identifiable information and other information about you such as your name, address, e-mail address, social network account information, password, user type, birthdate, gender, phone number, and how you heard about NEW_APP_COMPANY_NAME.</p>
+    <h5>Optional information</h5>
+    <p>At various other points during your use of the Service, you may have the option to provide additional information related to you. For example, you may wish to create a profile, post, comment on another user’s post or share a post with another person, or you may wish to utilize social network integrations or location-based features of the Service.  For voluntary activities like these you have the choice about whether to disclose the information necessary to use these features of the Service.</p>
+    <h5>Passive collection of information</h5>
+    <p>In addition to the information which you actively provide to us by methods such as completing our registration process, commenting on, or sharing a post, we collect information about how you interact with the Service. We collect passive information for purposes such as testing and improving user experience with the Service and the compilation of demographic data and related usage information for internal purposes and for disclosure to third parties such as advertisers and business partners. The types of passive information we collect include, without limitation, certain standard information sent by your browser, such as your Internet Protocol (IP) address, your device ID, your browser type and capabilities and language, your operating system, the date and time you access the Service, and the referring website from which you linked to the Service.  We also collect information related to your behavior within the Service (such as pages viewed, links clicked, and other actions taken within the Service).  We also may utilize special links, electronic images or other objects embedded within the Site—sometimes referred to as web beacons or tracking pixels—to collect information that helps determine and analyze how you and other visitors use the Site.  If you have provided us with personal information through registration or other voluntary means, we may connect your personal information with passive information collected through our Site and use the combined information to help determine your potential interests in certain products, services or information and for other purposes described in this Privacy Policy.</p>
+    <h5>Cookies</h5>
+    <p>Information related to your interactions with the Service may be collected and stored by us in small data files—commonly referred to as cookies—that are placed onto your device by our servers. We may use temporary session cookies, which are terminated when you close your current session, to store certain personal information you provide for purposes of administering that session and facilitating transactions requested by you during that session. We also may use persistent cookies, which remain saved on your device after your current session is closed, to store information related to your interactions with the Service to facilitate future sessions.  Most browsers automatically accept cookies, but you can usually modify your browser settings to decline cookies or to notify you when a cookie is being placed on your device. Each browser is different, but generally users can remove cookies by following directions provided in the browser’s “help” file. Please note that, if you reject cookies or disable cookies, some features of the Service may not function properly.</p>
+    <h5>Collection of information from minors</h5>
+    <p>The Service is intended for a general audience and it is not intended for children under the age of 16.  Use of the Service is prohibited for anyone under the age of 16.   If you are between 16 and 18 years of age, you must secure authorization from your parents or legal guardian before using the Service.  Although the Service may contain information that may be of interest to children, the Service is not directed at children and we do not knowingly collect or solicit personal information from children under the age 16.</p>
+
+    <h3>Use and sharing of information</h3>
+    <p>The Service enables that enable users to post, access and share user generated content and other information across the NEW_APP_COMPANY_NAME community, other social networks and other websites and online services and may include various features and functionality such as comments, message boards or chat areas, where users can post information and communicate with one another. Please be aware that these posts and communications are being made publicly available online and you do so at your own risk.</p>
+    <p>We will not knowingly use, share, or otherwise transfer information about you other than in accordance with the terms set forth in this Privacy Policy.  Additionally, we may use, share, or otherwise transfer information about you for other purposes for which we have obtained your consent. Your consent may be implied, deemed (using an opt-out mechanism) or express. Express consent can be given orally, electronically or in writing. Implied consent is consent that can reasonably be inferred from your action or inaction. Regardless of your decision regarding the sharing of your personal information, we may share demographic data and related usage information with our business partners in an aggregated or anonymized manner intended to remove or obscure any personal information which can identify any individual user.</p>
+    <p>We may use information about you in order to deliver products and services to you and to customize the Service to your interests and enhance your overall experience with the Service. We try to recognize you using various methods, including having you log in with your user name and your password. Once we recognize you, your experience may be customized for you so that you can see what interests you the most. In addition, as described above, we utilize passive information to learn more about how you interact with the Service. This passive information may be combined with other information and used for purposes such as enhancing your experience using the Service, improving the Service, testing and enhancing security and compilation of demographic data and related usage information for our internal purposes and for other purposes described in this Privacy Policy.</p>
+    <p>While we strive to protect the personal information of our users, we may use, share, or otherwise transfer your personal without your knowledge or consent if required by applicable law or regulatory requirements or in the good-faith belief that such action is necessary or appropriate.</p>
+    <p>From time to time, we may decide that it is more efficient to use third parties to perform specific functions related to the Service. If we use a third party to perform specific functions (such as sending communications to our users on our behalf), then information (such as contact information) may be shared with that third party to the extent necessary for that third party to perform that function. We authorize these third party service providers to use personally identifiable information only for the purpose of providing the specific services requested by us. Third party service providers covered by this paragraph do not include third party sites, applications or services that are accessed via links within the Service, which are governed by a more specific provision below.</p>
+    <p>If you opt-in to a feature that allows third parties to contact you, personal information about you (such as your contact information and other information collected during your visit to the Service) may be shared with data aggregators, marketers, and other organizations (possibly in the form of list rental).</p>
+    <p>In the event that we sell, assign or transfer some or all of our business to a successor or acquirer, we may sell, assign or transfer all of your information, regardless of your status, to such successor or acquirer.</p>
+
+    <h3>How long we store information</h3>
+    <p>NEW_APP_COMPANY_NAME will store your data as long as needed to provide you with our services and to operate our organization. If you ask NEW_APP_COMPANY_NAME to delete specific personal information, we'll honor your request unless deleting that information prevents us from carrying out necessary functions, like calculating taxes or conducting required audits.</p>
+
+    <h3>Security</h3>
+    <p>We have security measures in place to help protect against the unauthorized access to personally identifiable information under our control. We utilize both online and offline security methods, including firewalls, passwords and restricted physical access to the places where your information is stored to help protect personally identifiable information. Our team is trained to comply with our security procedures, and our security procedures are regularly reviewed and revised as we deem necessary.</p>
+
+    <h3>How you can access and update your information</h3>
+    <p>Our goal is for any personal information in our possession to be as accurate, current and complete as necessary for the purposes for which we use that information. If you want to review, verify or correct your personal information, please contact us using the contact information set out below. We reserve the right not to change any personal information and instead append any alternative information the individual concerned believes is appropriate. To some extent, we rely on individuals to update their own personal information. Unless an individual advises us of these important changes, we may have no way of knowing about them.</p>
+
+    <h3>Your legal rights</h3>
+    <p>The State of California enacted the Shine the Light law (CA Civil Code Sec 198.83) that permits users who are California residents to request certain information regarding the disclosure of personal information during the past year for marketing purposes. To make such a request, you can <a href="/contact">contact us</a>.</p>
+    <p>If you are in the European Union, you have certain rights under the General Data Protection Regulation in relation to your personal data:</p>
+    <ul>
+      <li><strong>Access</strong> - You are welcome to request NEW_APP_COMPANY_NAME for copies of your personal data. We may charge you a small fee for this service.</li>
+      <li><strong>Rectification</strong> - You may request that NEW_APP_COMPANY_NAME correct any information you believe is inaccurate. You may also request NEW_APP_COMPANY_NAME to complete the information you believe is incomplete.</li>
+      <li><strong>Erasure</strong> - You may request that NEW_APP_COMPANY_NAME erase your personal data, under certain conditions.</li>
+      <li><strong>Restriction of processing</strong> - You may request that NEW_APP_COMPANY_NAME restrict the processing of your personal data, under certain conditions.</li>
+      <li><strong>Objection to processing</strong> -  You may object to NEW_APP_COMPANY_NAME's processing of your personal data, under certain conditions.</li>
+      <li><strong>Data portability</strong> - You may request that NEW_APP_COMPANY_NAME transfer the data that we have collected to another organization, or directly to you, under certain conditions.</li>
+    </ul>
+    <p>If you make such a request, please be sure to include your contact information. We will reply within 30 days. If you would like to exercise any of these rights, please <a href="/contact">contact us</a>.</p>
+    <p>Should you wish to report a complaint or if you feel that we have not addressed your concern in a satisfactory manner, you have the right to lodge a complaint with your local data protection authority.</p>
+
+    <h3>Electronic mailing lists and how to unsubscribe</h3>
+    <p>We may use your contact information periodically in order to send you email or other communications regarding updates to the Service and to alert you or remind you of happenings related to the Service. The frequency of these messages will vary depending upon various factors.</p>
+    <p>If you no longer wish to receive e-mails from us and want to be removed from our electronic mailing list, please <a href="/contact">contact us</a> and include “Email Unsubscribe” in the body of your message.  If you choose to unsubscribe from our mailing lists, we will hold your contact information on file marked so that we do not inadvertently contact you if your details are subsequently provided to us by a third party.</p>
+
+    <h3>Data protection officer</h3>
+    <p>To communicate with our Data Protection Officer, please email <%= sails.config.custom.internalEmailAddress %>.</p>
+
+    <h3>Other provisions</h3>
+    <p>Your use of the Service indicates an acceptance of the terms of the Privacy Policy. We reserve the right to update or amend this Privacy Policy at any time. We will post any revised version of this Privacy Policy on our website, and we encourage you to refer back to it on a regular basis. The changes contained in any such revised version of this Privacy Policy will be effective from the time such revised version is posted unless otherwise specifically stated therein.</p>
+    <p>This Privacy Policy does not create or confer upon any individual any rights, or impose upon NEW_APP_COMPANY_NAME any rights or obligations outside of, or in addition to, any rights or obligations imposed by the privacy laws of such individual’s jurisdiction, as applicable. Privacy legislation or an individual’s right to privacy may differ from one jurisdiction to another. The rights and obligations described in this Privacy Policy may not apply to all individuals or in all jurisdictions. Should there be, in a specific case, any inconsistency between this Privacy Policy and the applicable privacy laws of such individual’s jurisdiction, this Privacy Policy shall be interpreted, in respect of that case, to give effect to, and comply with, such privacy laws.</p>
+    <p>Please be aware that, by accessing our Service, you acknowledge that our servers are currently located in the United States and that the various communications necessarily result in the transfer of information across international boundaries. By accessing the Service and communicating electronically with us, you consent to the processing and transfer of your personal information as set out in this Privacy Policy.  Personal information collected by us may be stored and processed in the United States of America or any other country in which we maintain facilities. Personal information collected by us may be transferred among our various divisions and affiliated companies around the world, which may involve transfer from countries within the European Economic Area to countries outside the European Economic Area.  By choosing to access the Service, you consent to any such transfer, storage or processing of personal data outside of your country.</p>
+    <p>This Privacy Policy applies solely to the information collected by us on-line through the Service and does not apply to any website, application or service other than the Service.  The Service contains links to other websites, applications and services provided by third parties that we do not own or control and we are not responsible for the privacy policies and practices of those third parties.  Similarly, we are not responsible for the privacy policies and practices of any other websites, applications and services from which you linked to our Service.  We encourage you to be aware when you leave our Service and to read the privacy policies of each and every third party that may be providing websites, applications or information linked to the Service.</p>
+    <p>This Privacy Policy may include examples but is not intended to be restricted in its application to such examples, thus ‘including’ means ‘including without limitation.’</p>
+    <p>Your privacy is important to us. If you have questions about any of the provisions described above, please <a href="/contact">contact us</a>.</p>
+
+    <p><strong>Last updated: DATE_PRIVACY_POLICY_LAST_UPDATED</strong></p>
+  </div>
+</div>
+<%- /* Expose locals as `window.SAILS_LOCALS` :: */ exposeLocalsToBrowser() %>
diff --git a/ee/bulk-operations-dashboard/views/pages/legal/terms.ejs b/ee/bulk-operations-dashboard/views/pages/legal/terms.ejs
new file mode 100644
index 0000000000..f959e137d7
--- /dev/null
+++ b/ee/bulk-operations-dashboard/views/pages/legal/terms.ejs
@@ -0,0 +1,38 @@
+<div id="terms">
+  <div class="container pt-5 pb-5">
+    <h1>Terms of service</h1>
+    <hr/>
+    <p>There are some simple ground rules you'll need to agree to before using NEW_APP_NAME.  Playing by these rules is a mandatory part of using our application, so if you have any questions about them, please <a href="/contact">drop us a line</a> and we'll respond posthaste.</p>
+
+    <h3>NEW_APP_NAME agreement</h3>
+    <p>By using or signing up for NEW_APP_NAME, you are agreeing to be bound by the following terms and conditions (the “<strong>Agreement</strong>”). </p>
+    <p>By marking the applicable "I have read and agree to the terms of service" checkbox, you hereby agree to the Agreement.</p>
+
+    <h5>1. NEW_APP_NAME services</h5>
+    <p>In exchange for your payment of the applicable subscription fee, you may request NEW_APP_NAME services, as described on our website at <%= sails.config.custom.baseUrl %>. We will provide the NEW_APP_NAME services in accordance with this Agreement and the other terms and conditions described on our website at <%= sails.config.custom.baseUrl %>.</p>
+
+    <h5>2. NEW_APP_NAME account</h5>
+    <p>To become a customer, you must complete an order form and create an account by providing first name, last name and company name (if applicable), email address, and any other information indicated as required. We may reject any order form or application for an account for any reason, in our sole discretion. You acknowledge that we will use the email address provided by you as the primary method for communication. You are responsible for keeping your account password secure. We cannot and will not be liable for any loss or damage arising from any failure to maintain the security of the account and password.</p>
+    <p>If you place an order and sign up for an account on behalf of your employer, your employer will be deemed to be the customer for the purpose of this Agreement, and you represent and warrant that you have the authority to bind your employer to this Agreement. Each customer is responsible for assuring that its employees, agents and subcontractors comply with this Agreement.</p>
+
+    <h5>3. Fees</h5>
+    <p>You will pay a fee for your subscription as specified in your NEW_APP_NAME order form.  Fees are based on the subscription term and not actual usage, and fees paid are non-refundable.</p>
+
+    <h5>4. Termination</h5>
+    <p>Either party may terminate this Agreement at any time, with or without cause, effective immediately upon written or electronic notice. Upon termination of this Agreement, all rights granted to you hereunder will immediately cease, including but not limited to the right to access the Account, unless otherwise determined in our sole discretion.</p>
+
+    <h5>5. Intellectual property rights</h5>
+    <p>You agree not to provide us with any confidential or proprietary information. Each party acknowledges and agrees that the other party may freely use and otherwise commercially exploit any ideas, feedback or suggestions provided by it to the other party.</p>
+
+    <h5>6. Disclaimers and limitation of liability of warranty</h5>
+    <p><strong>THE SERVICES ARE PROVIDED “AS-IS” AND WE EXPRESSLY DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, WARRANTIES OF MERCHANTABILITY, NON-INFRINGEMENT AND FITNESS FOR A PARTICULAR PURPOSE.</strong></p>
+    <p><strong>NEITHER PARTY WILL HAVE ANY LIABILITY WITH RESPECT TO THE SERVICES OR OBLIGATIONS UNDER THIS AGREEMENT OR OTHERWISE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR EXEMPLARY DAMAGES, INCLUDING BUT NOT LIMITED TO, DAMAGES FOR LOSSES OF PROFITS, GOODWILL, USE, DATA OR OTHER INTANGIBLE LOSSES RESULTING IN ANY WAY FROM THE SERVICES.  IN ANY EVENT, EACH PARTY’S LIABILITY UNDER THIS AGREEMENT FOR ANY REASON WILL BE LIMITED TO THE FEES PAID BY YOU DURING THE SIX MONTH PERIOD IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM FOR DAMAGES. THIS LIMITATION APPLIES TO ALL CAUSES OF ACTION IN THE AGGREGATE, INCLUDING, BUT NOT LIMITED TO, BREACH OF CONTRACT, BREACH OF WARRANTY, NEGLIGENCE, STRICT LIABILITY, MISREPRESENTATIONS, AND OTHER TORTS. THESE LIMITATIONS APPLY EVEN IF A PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. THE FOREGOING LIMITATIONS APPLY TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW.</strong></p>
+
+    <h5>7. General provisions</h5>
+    <p>This Agreement sets forth the entire agreement and supersedes any and all prior agreements, written or oral, of the parties with respect to the subject matter hereof. We reserve the right to update and change the Agreement prospectively by posting updates and changes on our website, <%= sails.config.custom.baseUrl %>. You are advised to please check the Agreement from time to time for any updates or changes that may impact you. If a significant change is made, we will provide reasonable notice by email and an opportunity to terminate this Agreement if you do not agree with the change.</p>
+    <p>The parties to this Agreement are independent contractors. Neither party is an agent, representative or related entity of the other party. Nothing in this Agreement is intended to create, nor will it be construed as creating, any exclusive arrangement between the parties to this Agreement. This Agreement does not restrict either party from entering into similar arrangements with others. Each party understands that the other party may now or in the future be involved in developing or providing competitive products or services. Neither party is liability for any failure or delay caused by any circumstance or event beyond its reasonable control.</p>
+
+    <p><strong>Last updated: DATE_TERMS_OF_SERVICE_LAST_UPDATED</strong></p>
+  </div>
+</div>
+<%- /* Expose locals as `window.SAILS_LOCALS` :: */ exposeLocalsToBrowser() %>
diff --git a/ee/bulk-operations-dashboard/views/pages/profiles.ejs b/ee/bulk-operations-dashboard/views/pages/profiles.ejs
new file mode 100644
index 0000000000..a7f2989009
--- /dev/null
+++ b/ee/bulk-operations-dashboard/views/pages/profiles.ejs
@@ -0,0 +1,154 @@
+<div id="profiles" v-cloak>
+
+  <div purpose="page-content" class="container-fluid">
+    <div class="d-flex flex-column">
+      <div class="pb-4 d-flex flex-row justify-content-between">
+        <div>
+        <h3 purpose="page-heading">Configuration profiles</h3>
+        </div>
+        <div class="d-flex flex-row align-items-center">
+          <p class="mb-0 mr-2">Team:</p>
+          <select class="custom-select team-select" v-model="teamFilter" @change="changeTeamFilter()">
+            <option :value="undefined" selected>All teams</option>
+            <option v-for="team of teams" :value="team.fleetApid">{{team.teamName}}</option>
+          </select>
+        </div>
+      </div>
+    </div>
+    <div class="d-flex flex-row justify-content-between pb-3">
+      <div>
+        <p><strong>Profiles</strong></p>
+      </div>
+      <div>
+        <p style="color: #6A67FE; cursor: pointer;" @click="clickOpenAddProfileModal()">+ Add profile</p>
+      </div>
+    </div>
+    <div style="overflow: visible;" class="mb-4 border rounded table-responsive-md" v-if="profilesToDisplay.length > 0">
+      <table class="table my-0">
+        <thead>
+          <tr>
+            <th class="sortable" :class="sortDirection === 'ASC' ? 'ascending' : sortDirection === 'DESC' ? 'descending' : ''" @click="clickChangeSortDirection()">
+              <div style="cursor: pointer;" class="d-flex flex-row align-items-center pointer">
+                <small><strong>Name</strong></small>
+                <div class="sort-arrows"><span class="ascending-arrow"></span><span class="descending-arrow"></span></div>
+              </div>
+            </th>
+            <th><small><strong>Platform</strong></small></th>
+            <th v-if="teamFilter === undefined"><span><small><strong>Team</strong></small></span></th>
+            <th><span><small><strong>Upload date</strong></small></span></th>
+            <th></th>
+          </tr>
+        </thead>
+        <tbody>
+          <tr v-for="profile in profilesToDisplay">
+            <td class="name-column">{{profile.name}}</td>
+            <td>{{platformFriendlyNames[profile.platform]}}</td>
+            <td v-if="teamFilter === undefined">
+              <a class="affected-teams-link" v-if="profile.teams && profile.teams.length > 0">
+                <span class="truncated-affected-teams" v-if="profile.teams.length > 1">
+                  {{profile.teams.length}} teams
+                  <div class="teams-tooltip">
+                    <p v-for="team in profile.teams" @click="clickChangeTeamFilter(team.fleetApid)">{{team.teamName}}</p>
+                  </div>
+                </span>
+                <span v-else @click="clickChangeTeamFilter(profile.teams[0].fleetApid)">
+                  {{profile.teams[0].teamName}}
+                </span>
+              </a>
+              <p v-else>---</p>
+            </td>
+            <td>
+              <js-timestamp :at="profile.createdAt" format="timeago"></js-timestamp>
+            </td>
+            <td>
+              <div class="d-flex flex-row align-items-start justify-content-end">
+                <img style="height: 16px; margin-right: 24px;" alt="download" class="pointer" src="/images/download-16x16@2x.png" @click="clickDownloadProfile(profile)">
+                <img style="height: 16px; margin-right: 24px;" alt="edit" class="pointer" src="/images/edit-pencil-16x21@2x.png" @click="clickOpenEditModal(profile)">
+                <img style="height: 16px" alt="delete" class="pointer" src="/images/delete-16x21@2x.png" @click="clickOpenDeleteModal(profile)">
+              </div>
+            </td>
+          </tr>
+        </tbody>
+      </table>
+    </div>
+    <div v-else>
+      <h2 class="px-3 text-center mx-auto pt-5">No profiles matching the selected filters were found.</h2>
+    </div>
+  </div>
+<%//  ╔═╗╔╦╗╦╔╦╗  ╔═╗╦═╗╔═╗╔═╗╦╦  ╔═╗
+  //  ║╣  ║║║ ║   ╠═╝╠╦╝║ ║╠╣ ║║  ║╣
+  //  ╚═╝═╩╝╩ ╩   ╩  ╩╚═╚═╝╚  ╩╩═╝╚═╝%>
+  <modal v-if="modal === 'edit-profile'" hide-close-button="true" @close="closeModal()">
+    <div>
+      <div class="d-flex flex-row justify-content-between">
+        <h3 class="mb-4">Edit profile</h3>
+        <div class="pointer" @click="closeModal()">&times;</div>
+      </div>
+      <ajax-form :handle-submitting="handleSubmittingEditProfileForm" :syncing.sync="syncing" :cloud-error.sync="cloudError" :form-errors.sync="formErrors" :form-data="formData" :form-rules="editProfileFormRules" @submitted="submittedForm()">
+        <div purpose="profile-information" v-if="!formData.newProfile">
+          <div class="d-flex flex-row justify-content-start">
+            <img style="height: 40px; width: 34px;" alt="Configuration profile" src="/images/profile-34x40@2x.png">
+            <div class="d-flex flex-column">
+              <p><strong>{{profileToEdit.name}}</strong></p>
+              <p class="muted">{{platformFriendlyNames[profileToEdit.platform]}}</p>
+            </div>
+          </div>
+        </div>
+        <cloud-error v-if="cloudError === 'payloadIdentifierDoesNotMatch'"></cloud-error>
+        <file-upload id="edit-file-upload" mode="profiles" :disabled="syncing" accept=".xml,.mobileconfig" v-model="formData.newProfile"></file-upload>
+        <div purpose="teams-picker">
+          <p class="mb-2"><strong>Teams</strong></p>
+          <multifield :value="formData.teams" v-model="formData.newTeamIds" input-type="teamSelect" :select-options="teams" add-button-text="Add team"></multifield>
+        </div>
+        <div purpose="modal-buttons" class="d-flex flex-row justify-content-end align-items-center">
+          <cloud-error v-if="cloudError && cloudError !== 'payloadIdentifierDoesNotMatch'"></cloud-error>
+          <ajax-button :syncing.sync="syncing" purpose="modal-button" type="submit">Save</ajax-button>
+        </div>
+      </ajax-form>
+    </div>
+  </modal>
+  <%//  ╔╦╗╔═╗╦  ╔═╗╔╦╗╔═╗  ╔═╗╦═╗╔═╗╔═╗╦╦  ╔═╗
+    //   ║║║╣ ║  ║╣  ║ ║╣   ╠═╝╠╦╝║ ║╠╣ ║║  ║╣
+    //  ═╩╝╚═╝╩═╝╚═╝ ╩ ╚═╝  ╩  ╩╚═╚═╝╚  ╩╩═╝╚═╝%>
+  <modal v-if="modal === 'delete-profile'" hide-close-button="true" @close="closeModal()">
+    <div class="d-flex flex-row justify-content-between">
+      <h3 class="mb-4">Delete profile</h3>
+      <div class="pointer" @click="closeModal()">&times;</div>
+    </div>
+    <p>Delete this profile from all teams</p>
+    <ajax-form :handle-submitting="handleSubmittingDeleteProfileForm" :syncing.sync="syncing" :cloud-error.sync="cloudError" :form-errors.sync="formErrors" :form-data="formData" :form-rules="editProfileFormRules" @submitted="submittedForm()">
+    <cloud-error v-if="cloudError"></cloud-error>
+    <div class="d-flex flex-row justify-content-end align-items-center">
+      <a class="mr-3" style="color: #D66C7B; cursor: pointer;" @click="closeModal()">Cancel</a>
+      <ajax-button class="btn" purpose="delete-button" :syncing.sync="syncing">Delete</ajax-button>
+    </div>
+    </ajax-form>
+  </modal>
+  <%//  ╔═╗╔╦╗╔╦╗  ╔═╗╦═╗╔═╗╔═╗╦╦  ╔═╗
+    //  ╠═╣ ║║ ║║  ╠═╝╠╦╝║ ║╠╣ ║║  ║╣
+    //  ╩ ╩═╩╝═╩╝  ╩  ╩╚═╚═╝╚  ╩╩═╝╚═╝%>
+  <modal v-if="modal === 'add-profile'" hide-close-button="true" @close="closeModal()">
+    <div>
+      <div class="d-flex flex-row justify-content-between">
+        <h3 class="mb-4">Add profile</h3>
+        <div class="pointer" @click="closeModal()">&times;</div>
+      </div>
+      <ajax-form :handle-submitting="handleSubmittingAddProfileForm" :syncing.sync="syncing" :cloud-error.sync="cloudError" :form-errors.sync="formErrors" :form-data="formData" :form-rules="addProfileFormRules" @submitted="submittedForm()">
+        <file-upload id="add-file-upload" mode="profiles" :class="[formErrors.newProfile ? 'is-invalid' : '']"  :disabled="syncing" v-model="formData.newProfile">
+        </file-upload>
+        <div class="invalid-feedback text-center" v-if="formErrors.newProfile">Please upload a new profile.</div>
+
+        <div purpose="teams-picker" class="mt-4">
+          <p class="mb-2"><strong>Teams</strong></p>
+          <multifield :value="formData.teams" v-model="formData.teams" input-type="teamSelect" :select-options="teams" add-button-text="Add team"></multifield>
+        </div>
+        <cloud-error v-if="cloudError"></cloud-error>
+        <div purpose="modal-buttons" class="d-flex flex-row justify-content-end align-items-center">
+          <a purpose="cancel-button" @click="closeModal()">Cancel</a>
+          <ajax-button :syncing.sync="syncing" purpose="modal-button" :disabled="!formData.newProfile" type="submit">Add</ajax-button>
+        </div>
+      </ajax-form>
+    </div>
+  </modal>
+</div>
+<%- /* Expose server-rendered data as window.SAILS_LOCALS :: */ exposeLocalsToBrowser() %>
diff --git a/ee/bulk-operations-dashboard/views/pages/scripts.ejs b/ee/bulk-operations-dashboard/views/pages/scripts.ejs
new file mode 100644
index 0000000000..2b00b7771c
--- /dev/null
+++ b/ee/bulk-operations-dashboard/views/pages/scripts.ejs
@@ -0,0 +1,164 @@
+<div id="scripts" v-cloak>
+    <div purpose="page-content" class="container-fluid">
+      <div class="d-flex flex-column">
+        <div class="pb-4 d-flex flex-row justify-content-between">
+          <div>
+          <h3 purpose="page-heading" @click="clickChangeTeamFilter(9)">Scripts</h3>
+          </div>
+          <div class="d-flex flex-row align-items-center">
+            <p class="mb-0 mr-2">Team:</p>
+            <select class="custom-select team-select" v-model="teamFilter" @change="changeTeamFilter()">
+              <option :value="undefined" selected>All teams</option>
+              <option v-for="team of teams" :value="team.fleetApid">{{team.teamName}}</option>
+            </select>
+          </div>
+        </div>
+      </div>
+      <div class="d-flex flex-row justify-content-between pb-3">
+        <div>
+          <p><strong>Scripts</strong></p>
+        </div>
+        <div>
+          <p style="color: #6A67FE; cursor: pointer;" @click="clickOpenAddScriptModal()">+ Add script</p>
+        </div>
+      </div>
+      <div style="overflow-y: visible;" class="mb-4 border rounded table-responsive-md" v-if="scriptsToDisplay.length > 0">
+        <table class="table my-0">
+          <thead>
+            <tr>
+              <th class="sortable" :class="sortDirection === 'ASC' ? 'ascending' : sortDirection === 'DESC' ? 'descending' : ''" @click="clickChangeSortDirection()">
+                <div style="cursor: pointer;" class="d-flex flex-row align-items-center pointer">
+                  <small><strong>Name</strong></small>
+                  <div class="sort-arrows">
+                    <span class="ascending-arrow"></span>
+                    <span class="descending-arrow"></span>
+                  </div>
+                </div>
+              </th>
+              <th>
+                <small><strong>Platform</strong></small>
+              </th>
+              <th v-if="teamFilter === undefined">
+                <span><small><strong>Team</strong></small></span>
+              </th>
+              <th>
+                <span><small><strong>Upload date</strong></small></span>
+              </th>
+              <th></th>
+            </tr>
+          </thead>
+          <tbody>
+            <tr v-for="script in scriptsToDisplay" :key="script.name">
+              <td class="name-column">{{script.name}}</td>
+              <td>{{script.platform}}</td>
+              <td v-if="teamFilter === undefined">
+                <a class="affected-teams-link" v-if="script.teams && script.teams.length > 0">
+                  <span class="truncated-affected-teams" v-if="script.teams.length > 1">
+                    {{script.teams.length}} teams
+                    <div class="teams-tooltip">
+                      <p v-for="team in script.teams" @click="clickChangeTeamFilter(team.fleetApid)">{{team.teamName}}</p>
+                    </div>
+                  </span>
+                  <span v-else @click="clickChangeTeamFilter(script.teams[0].fleetApid)">
+                    {{script.teams[0].teamName}}
+                  </span>
+                </a>
+                <span v-else>---</span>
+              </td>
+              <td>
+                <js-timestamp :at="script.createdAt" format="timeago"></js-timestamp>
+              </td>
+              <td>
+                <div class="d-flex flex-row align-items-start justify-content-end">
+                  <img style="height: 16px; margin-right: 24px;" alt="download" class="pointer" src="/images/download-16x16@2x.png" @click="clickDownloadScript(script)">
+                  <img style="height: 16px; margin-right: 24px;" alt="edit" class="pointer" src="/images/edit-pencil-16x21@2x.png" @click="clickOpenEditModal(script)">
+                  <img style="height: 16px" alt="delete" class="pointer" src="/images/delete-16x21@2x.png" @click="clickOpenDeleteModal(script)">
+                </div>
+              </td>
+            </tr>
+          </tbody>
+        </table>
+      </div>
+      <div v-else>
+        <h3 class="px-3 text-center mx-auto pt-5">No scripts matching the selected filters were found.</h3>
+      </div>
+    </div>
+  <%//  ╔═╗╔╦╗╦╔╦╗  ╔═╗╔═╗╦═╗╦╔═╗╔╦╗
+    //  ║╣  ║║║ ║   ╚═╗║  ╠╦╝║╠═╝ ║
+    //  ╚═╝═╩╝╩ ╩   ╚═╝╚═╝╩╚═╩╩   ╩ %>
+    <modal v-if="modal === 'edit-script'" hide-close-button="true" @close="closeModal()">
+      <div>
+        <div class="d-flex flex-row justify-content-between">
+          <h3 class="mb-4">Edit script</h3>
+          <div class="pointer" @click="closeModal()">&times;</div>
+        </div>
+        <ajax-form action="editScript" :syncing.sync="syncing" :cloud-error.sync="cloudError" :form-errors.sync="formErrors" :form-data="formData" :form-rules="editScriptFormRules" @submitted="submittedForm()">
+          <div purpose="script-information" v-if="!formData.newScripts">
+            <div class="d-flex flex-row justify-content-start">
+              <img style="height: 40px; width: 34px;" alt="Windows script" src="/images/script-icon-ps1-34x40@2x.png" v-if="scriptToEdit.platform === 'Windows'">
+              <img style="height: 40px; width: 34px;" alt="macOs and Linux script" src="/images/script-icon-sh-34x40@2x.png" v-else>
+              <div class="d-flex flex-column">
+                <p><strong>{{scriptToEdit.name}}</strong></p>
+                <p class="muted">{{scriptToEdit.platform}}</p>
+              </div>
+            </div>
+          </div>
+          <file-upload id="edit-file-upload" mode="scripts" :disabled="syncing" accept=".xml,.mobileconfig" v-model="formData.newScript"></file-upload>
+          <div purpose="teams-picker" class="mt-4">
+            <p class="mb-2"><strong>Teams</strong></p>
+            <multifield :value="formData.teams" v-model="formData.newTeamIds" input-type="teamSelect" :select-options="teams" add-button-text="Add team"></multifield>
+          </div>
+          <cloud-error v-if="cloudError === 'scriptNameDoesNotMatch'">The new scripts file name identifier must match the old scripts’ file name.</cloud-error>
+          <cloud-error v-else-if="cloudError"></cloud-error>
+          <div purpose="modal-buttons" class="d-flex flex-row justify-content-end align-items-center">
+            <ajax-button :syncing.sync="syncing" purpose="modal-button" type="submit">Save</ajax-button>
+          </div>
+        </ajax-form>
+      </div>
+    </modal>
+    <%//  ╔╦╗╔═╗╦  ╔═╗╔╦╗╔═╗  ╔═╗╔═╗╦═╗╦╔═╗╔╦╗
+      //   ║║║╣ ║  ║╣  ║ ║╣   ╚═╗║  ╠╦╝║╠═╝ ║
+      //  ═╩╝╚═╝╩═╝╚═╝ ╩ ╚═╝  ╚═╝╚═╝╩╚═╩╩   ╩ %>
+    <modal v-if="modal === 'delete-script'" hide-close-button="true" @close="closeModal()">
+      <div class="d-flex flex-row justify-content-between">
+        <h3 class="mb-4">Delete script</h3>
+        <div class="pointer" @click="closeModal()">&times;</div>
+      </div>
+      <p class="mb-2">Delete this script from all teams.</p>
+      <p>This will cancel the script from running.</p>
+      <ajax-form :handle-submitting="handleSubmittingDeleteScriptForm" :syncing.sync="syncing" :cloud-error.sync="cloudError" :form-errors.sync="formErrors" :form-data="formData" :form-rules="editScriptFormRules" @submitted="submittedForm()">
+        <cloud-error v-if="cloudError"></cloud-error>
+      <div class="d-flex flex-row justify-content-end align-items-center">
+        <a class="mr-3" style="color: #D66C7B; cursor: pointer;" @click="closeModal()">Cancel</a>
+        <ajax-button class="btn" purpose="delete-button" :syncing.sync="syncing">Delete</ajax-button>
+      </div>
+      </ajax-form>
+    </modal>
+    <%//  ╔═╗╔╦╗╔╦╗  ╔═╗╔═╗╦═╗╦╔═╗╔╦╗
+      //  ╠═╣ ║║ ║║  ╚═╗║  ╠╦╝║╠═╝ ║
+      //  ╩ ╩═╩╝═╩╝  ╚═╝╚═╝╩╚═╩╩   ╩ %>
+    <modal v-if="modal === 'add-script'" hide-close-button="true" @close="closeModal()">
+      <div>
+        <div class="d-flex flex-row justify-content-between">
+          <h3 class="mb-4">Add script</h3>
+          <div class="pointer" @click="closeModal()">&times;</div>
+        </div>
+        <ajax-form :handle-submitting="handleSubmittingAddScriptForm" :syncing.sync="syncing" :cloud-error.sync="cloudError" :form-errors.sync="formErrors" :form-data="formData" :form-rules="addScriptFormRules" @submitted="submittedForm()">
+          <file-upload id="file-upload" :class="[formErrors.newScript ? 'is-invalid' : '']"  mode="scripts" :disabled="syncing" v-model="formData.newScript"></file-upload>
+          <div class="invalid-feedback text-center" v-if="formErrors.newScript">Please upload a new script.</div>
+          <div purpose="teams-picker" class="mt-4">
+            <p class="mb-2"><strong>Teams</strong></p>
+            <multifield :value="formData.teams" v-model="formData.teams" input-type="teamSelect" :select-options="teams" add-button-text="Add team"></multifield>
+          </div>
+          <div class="invalid-feedback text-center" v-if="formErrors.teams">Please select the teams you want to deploy this script to.</div>
+          <cloud-error v-if="cloudError && cloudError === 'scriptWithThisNameAlreadyExists'">A script with the same name as the uploaded script already exists on one or more of the selected teams.</cloud-error>
+          <cloud-error v-else-if="cloudError"></cloud-error>
+          <div purpose="modal-buttons" class="d-flex flex-row justify-content-end align-items-center">
+            <a purpose="cancel-button" @click="closeModal()">Cancel</a>
+            <ajax-button :syncing.sync="syncing" purpose="modal-button" :disabled="!formData.newScript"  type="submit">Add</ajax-button>
+          </div>
+        </ajax-form>
+      </div>
+    </modal>
+</div>
+<%- /* Expose server-rendered data as window.SAILS_LOCALS :: */ exposeLocalsToBrowser() %>
diff --git a/ee/fleetctl/updates_test.go b/ee/fleetctl/updates_test.go
index 3c5b16f796..041cfea636 100644
--- a/ee/fleetctl/updates_test.go
+++ b/ee/fleetctl/updates_test.go
@@ -210,7 +210,7 @@ func compressSingleFile(t *testing.T, filePath, outFilePath string) {
 	require.NoError(t, err)
 }
 
-func TestUpdatesIntegration(t *testing.T) {
+func TestIntegrationsUpdates(t *testing.T) {
 	// Not t.Parallel() due to modifications to environment.
 	tmpDir := t.TempDir()
 
diff --git a/ee/fleetd-chrome/package-lock.json b/ee/fleetd-chrome/package-lock.json
index 0a5e25d1a5..b2e657bd58 100644
--- a/ee/fleetd-chrome/package-lock.json
+++ b/ee/fleetd-chrome/package-lock.json
@@ -29,7 +29,7 @@
         "ts-loader": "^9.4.2",
         "ts-node": "^10.9.2",
         "typescript": "^4.9.5",
-        "webpack": "^5.75.0",
+        "webpack": "^5.94.0",
         "webpack-cli": "^5.0.1",
         "webpack-merge": "^5.8.0"
       }
@@ -1122,14 +1122,14 @@
       }
     },
     "node_modules/@jridgewell/gen-mapping": {
-      "version": "0.3.2",
-      "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.2.tgz",
-      "integrity": "sha512-mh65xKQAzI6iBcFzwv28KVWSmCkdRBWoOh+bYQGW3+6OZvbbN3TqMGo5hqYxQniRcH9F2VZIoJCm4pa3BPDK/A==",
+      "version": "0.3.5",
+      "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.5.tgz",
+      "integrity": "sha512-IzL8ZoEDIBRWEzlCcRhOaCupYyN5gdIK+Q6fbFdPDg6HqX6jpkItn7DFIpW9LQzXG6Df9sA7+OKnq0qlz/GaQg==",
       "dev": true,
       "dependencies": {
-        "@jridgewell/set-array": "^1.0.1",
+        "@jridgewell/set-array": "^1.2.1",
         "@jridgewell/sourcemap-codec": "^1.4.10",
-        "@jridgewell/trace-mapping": "^0.3.9"
+        "@jridgewell/trace-mapping": "^0.3.24"
       },
       "engines": {
         "node": ">=6.0.0"
@@ -1145,22 +1145,22 @@
       }
     },
     "node_modules/@jridgewell/set-array": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@jridgewell/set-array/-/set-array-1.1.2.tgz",
-      "integrity": "sha512-xnkseuNADM0gt2bs+BvhO0p78Mk762YnZdsuzFV018NoG1Sj1SCQvpSqa7XUaTam5vAGasABV9qXASMKnFMwMw==",
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/@jridgewell/set-array/-/set-array-1.2.1.tgz",
+      "integrity": "sha512-R8gLRTZeyp03ymzP/6Lil/28tGeGEzhx1q2k703KGWRAI1VdvPIXdG70VJc2pAMw3NA6JKL5hhFu1sJX0Mnn/A==",
       "dev": true,
       "engines": {
         "node": ">=6.0.0"
       }
     },
     "node_modules/@jridgewell/source-map": {
-      "version": "0.3.2",
-      "resolved": "https://registry.npmjs.org/@jridgewell/source-map/-/source-map-0.3.2.tgz",
-      "integrity": "sha512-m7O9o2uR8k2ObDysZYzdfhb08VuEml5oWGiosa1VdaPZ/A6QyPkAJuwN0Q1lhULOf6B7MtQmHENS743hWtCrgw==",
+      "version": "0.3.6",
+      "resolved": "https://registry.npmjs.org/@jridgewell/source-map/-/source-map-0.3.6.tgz",
+      "integrity": "sha512-1ZJTZebgqllO79ue2bm3rIGud/bOe0pP5BjSRCRxxYkEZS8STV7zN84UBbiYu7jy+eCKSnVIUgoWWE/tt+shMQ==",
       "dev": true,
       "dependencies": {
-        "@jridgewell/gen-mapping": "^0.3.0",
-        "@jridgewell/trace-mapping": "^0.3.9"
+        "@jridgewell/gen-mapping": "^0.3.5",
+        "@jridgewell/trace-mapping": "^0.3.25"
       }
     },
     "node_modules/@jridgewell/sourcemap-codec": {
@@ -1170,13 +1170,13 @@
       "dev": true
     },
     "node_modules/@jridgewell/trace-mapping": {
-      "version": "0.3.17",
-      "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.17.tgz",
-      "integrity": "sha512-MCNzAp77qzKca9+W/+I0+sEpaUnZoeasnghNeVc41VZCEKaCH73Vq3BZZ/SzWIgrqE4H4ceI+p+b6C0mHf9T4g==",
+      "version": "0.3.25",
+      "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.25.tgz",
+      "integrity": "sha512-vNk6aEwybGtawWmy/PzwnGDOjCkLWSD2wqvjGGAgOAwCGWySYXfYoxt00IJkTF+8Lb57DwOb3Aa0o9CApepiYQ==",
       "dev": true,
       "dependencies": {
-        "@jridgewell/resolve-uri": "3.1.0",
-        "@jridgewell/sourcemap-codec": "1.4.14"
+        "@jridgewell/resolve-uri": "^3.1.0",
+        "@jridgewell/sourcemap-codec": "^1.4.14"
       }
     },
     "node_modules/@mswjs/cookies": {
@@ -1411,30 +1411,10 @@
         "@types/ms": "*"
       }
     },
-    "node_modules/@types/eslint": {
-      "version": "8.21.1",
-      "resolved": "https://registry.npmjs.org/@types/eslint/-/eslint-8.21.1.tgz",
-      "integrity": "sha512-rc9K8ZpVjNcLs8Fp0dkozd5Pt2Apk1glO4Vgz8ix1u6yFByxfqo5Yavpy65o+93TAe24jr7v+eSBtFLvOQtCRQ==",
-      "dev": true,
-      "dependencies": {
-        "@types/estree": "*",
-        "@types/json-schema": "*"
-      }
-    },
-    "node_modules/@types/eslint-scope": {
-      "version": "3.7.4",
-      "resolved": "https://registry.npmjs.org/@types/eslint-scope/-/eslint-scope-3.7.4.tgz",
-      "integrity": "sha512-9K4zoImiZc3HlIp6AVUDE4CWYx22a+lhSZMYNpbjW04+YF0KWj4pJXnEMjdnFTiQibFFmElcsasJXDbdI/EPhA==",
-      "dev": true,
-      "dependencies": {
-        "@types/eslint": "*",
-        "@types/estree": "*"
-      }
-    },
     "node_modules/@types/estree": {
-      "version": "0.0.51",
-      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-0.0.51.tgz",
-      "integrity": "sha512-CuPgU6f3eT/XgKKPqKd/gLZV1Xmvf1a2R5POBOGQa6uv82xpls89HU5zKeVoyR8XzHd1RGNOlQlvUe3CFkjWNQ==",
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.5.tgz",
+      "integrity": "sha512-/kYRxGDLWzHOB7q+wtSUQlFrtcdUccpfy+X+9iMBpHK8QLLhx2wIPYuS5DYtR9Wa/YlZAbIovy7qVdB1Aq6Lyw==",
       "dev": true
     },
     "node_modules/@types/filesystem": {
@@ -1597,148 +1577,148 @@
       "dev": true
     },
     "node_modules/@webassemblyjs/ast": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/ast/-/ast-1.11.1.tgz",
-      "integrity": "sha512-ukBh14qFLjxTQNTXocdyksN5QdM28S1CxHt2rdskFyL+xFV7VremuBLVbmCePj+URalXBENx/9Lm7lnhihtCSw==",
+      "version": "1.12.1",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/ast/-/ast-1.12.1.tgz",
+      "integrity": "sha512-EKfMUOPRRUTy5UII4qJDGPpqfwjOmZ5jeGFwid9mnoqIFK+e0vqoi1qH56JpmZSzEL53jKnNzScdmftJyG5xWg==",
       "dev": true,
       "dependencies": {
-        "@webassemblyjs/helper-numbers": "1.11.1",
-        "@webassemblyjs/helper-wasm-bytecode": "1.11.1"
+        "@webassemblyjs/helper-numbers": "1.11.6",
+        "@webassemblyjs/helper-wasm-bytecode": "1.11.6"
       }
     },
     "node_modules/@webassemblyjs/floating-point-hex-parser": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/floating-point-hex-parser/-/floating-point-hex-parser-1.11.1.tgz",
-      "integrity": "sha512-iGRfyc5Bq+NnNuX8b5hwBrRjzf0ocrJPI6GWFodBFzmFnyvrQ83SHKhmilCU/8Jv67i4GJZBMhEzltxzcNagtQ==",
+      "version": "1.11.6",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/floating-point-hex-parser/-/floating-point-hex-parser-1.11.6.tgz",
+      "integrity": "sha512-ejAj9hfRJ2XMsNHk/v6Fu2dGS+i4UaXBXGemOfQ/JfQ6mdQg/WXtwleQRLLS4OvfDhv8rYnVwH27YJLMyYsxhw==",
       "dev": true
     },
     "node_modules/@webassemblyjs/helper-api-error": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/helper-api-error/-/helper-api-error-1.11.1.tgz",
-      "integrity": "sha512-RlhS8CBCXfRUR/cwo2ho9bkheSXG0+NwooXcc3PAILALf2QLdFyj7KGsKRbVc95hZnhnERon4kW/D3SZpp6Tcg==",
+      "version": "1.11.6",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/helper-api-error/-/helper-api-error-1.11.6.tgz",
+      "integrity": "sha512-o0YkoP4pVu4rN8aTJgAyj9hC2Sv5UlkzCHhxqWj8butaLvnpdc2jOwh4ewE6CX0txSfLn/UYaV/pheS2Txg//Q==",
       "dev": true
     },
     "node_modules/@webassemblyjs/helper-buffer": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/helper-buffer/-/helper-buffer-1.11.1.tgz",
-      "integrity": "sha512-gwikF65aDNeeXa8JxXa2BAk+REjSyhrNC9ZwdT0f8jc4dQQeDQ7G4m0f2QCLPJiMTTO6wfDmRmj/pW0PsUvIcA==",
+      "version": "1.12.1",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/helper-buffer/-/helper-buffer-1.12.1.tgz",
+      "integrity": "sha512-nzJwQw99DNDKr9BVCOZcLuJJUlqkJh+kVzVl6Fmq/tI5ZtEyWT1KZMyOXltXLZJmDtvLCDgwsyrkohEtopTXCw==",
       "dev": true
     },
     "node_modules/@webassemblyjs/helper-numbers": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/helper-numbers/-/helper-numbers-1.11.1.tgz",
-      "integrity": "sha512-vDkbxiB8zfnPdNK9Rajcey5C0w+QJugEglN0of+kmO8l7lDb77AnlKYQF7aarZuCrv+l0UvqL+68gSDr3k9LPQ==",
+      "version": "1.11.6",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/helper-numbers/-/helper-numbers-1.11.6.tgz",
+      "integrity": "sha512-vUIhZ8LZoIWHBohiEObxVm6hwP034jwmc9kuq5GdHZH0wiLVLIPcMCdpJzG4C11cHoQ25TFIQj9kaVADVX7N3g==",
       "dev": true,
       "dependencies": {
-        "@webassemblyjs/floating-point-hex-parser": "1.11.1",
-        "@webassemblyjs/helper-api-error": "1.11.1",
+        "@webassemblyjs/floating-point-hex-parser": "1.11.6",
+        "@webassemblyjs/helper-api-error": "1.11.6",
         "@xtuc/long": "4.2.2"
       }
     },
     "node_modules/@webassemblyjs/helper-wasm-bytecode": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/helper-wasm-bytecode/-/helper-wasm-bytecode-1.11.1.tgz",
-      "integrity": "sha512-PvpoOGiJwXeTrSf/qfudJhwlvDQxFgelbMqtq52WWiXC6Xgg1IREdngmPN3bs4RoO83PnL/nFrxucXj1+BX62Q==",
+      "version": "1.11.6",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/helper-wasm-bytecode/-/helper-wasm-bytecode-1.11.6.tgz",
+      "integrity": "sha512-sFFHKwcmBprO9e7Icf0+gddyWYDViL8bpPjJJl0WHxCdETktXdmtWLGVzoHbqUcY4Be1LkNfwTmXOJUFZYSJdA==",
       "dev": true
     },
     "node_modules/@webassemblyjs/helper-wasm-section": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/helper-wasm-section/-/helper-wasm-section-1.11.1.tgz",
-      "integrity": "sha512-10P9No29rYX1j7F3EVPX3JvGPQPae+AomuSTPiF9eBQeChHI6iqjMIwR9JmOJXwpnn/oVGDk7I5IlskuMwU/pg==",
+      "version": "1.12.1",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/helper-wasm-section/-/helper-wasm-section-1.12.1.tgz",
+      "integrity": "sha512-Jif4vfB6FJlUlSbgEMHUyk1j234GTNG9dBJ4XJdOySoj518Xj0oGsNi59cUQF4RRMS9ouBUxDDdyBVfPTypa5g==",
       "dev": true,
       "dependencies": {
-        "@webassemblyjs/ast": "1.11.1",
-        "@webassemblyjs/helper-buffer": "1.11.1",
-        "@webassemblyjs/helper-wasm-bytecode": "1.11.1",
-        "@webassemblyjs/wasm-gen": "1.11.1"
+        "@webassemblyjs/ast": "1.12.1",
+        "@webassemblyjs/helper-buffer": "1.12.1",
+        "@webassemblyjs/helper-wasm-bytecode": "1.11.6",
+        "@webassemblyjs/wasm-gen": "1.12.1"
       }
     },
     "node_modules/@webassemblyjs/ieee754": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/ieee754/-/ieee754-1.11.1.tgz",
-      "integrity": "sha512-hJ87QIPtAMKbFq6CGTkZYJivEwZDbQUgYd3qKSadTNOhVY7p+gfP6Sr0lLRVTaG1JjFj+r3YchoqRYxNH3M0GQ==",
+      "version": "1.11.6",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/ieee754/-/ieee754-1.11.6.tgz",
+      "integrity": "sha512-LM4p2csPNvbij6U1f19v6WR56QZ8JcHg3QIJTlSwzFcmx6WSORicYj6I63f9yU1kEUtrpG+kjkiIAkevHpDXrg==",
       "dev": true,
       "dependencies": {
         "@xtuc/ieee754": "^1.2.0"
       }
     },
     "node_modules/@webassemblyjs/leb128": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/leb128/-/leb128-1.11.1.tgz",
-      "integrity": "sha512-BJ2P0hNZ0u+Th1YZXJpzW6miwqQUGcIHT1G/sf72gLVD9DZ5AdYTqPNbHZh6K1M5VmKvFXwGSWZADz+qBWxeRw==",
+      "version": "1.11.6",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/leb128/-/leb128-1.11.6.tgz",
+      "integrity": "sha512-m7a0FhE67DQXgouf1tbN5XQcdWoNgaAuoULHIfGFIEVKA6tu/edls6XnIlkmS6FrXAquJRPni3ZZKjw6FSPjPQ==",
       "dev": true,
       "dependencies": {
         "@xtuc/long": "4.2.2"
       }
     },
     "node_modules/@webassemblyjs/utf8": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/utf8/-/utf8-1.11.1.tgz",
-      "integrity": "sha512-9kqcxAEdMhiwQkHpkNiorZzqpGrodQQ2IGrHHxCy+Ozng0ofyMA0lTqiLkVs1uzTRejX+/O0EOT7KxqVPuXosQ==",
+      "version": "1.11.6",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/utf8/-/utf8-1.11.6.tgz",
+      "integrity": "sha512-vtXf2wTQ3+up9Zsg8sa2yWiQpzSsMyXj0qViVP6xKGCUT8p8YJ6HqI7l5eCnWx1T/FYdsv07HQs2wTFbbof/RA==",
       "dev": true
     },
     "node_modules/@webassemblyjs/wasm-edit": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/wasm-edit/-/wasm-edit-1.11.1.tgz",
-      "integrity": "sha512-g+RsupUC1aTHfR8CDgnsVRVZFJqdkFHpsHMfJuWQzWU3tvnLC07UqHICfP+4XyL2tnr1amvl1Sdp06TnYCmVkA==",
+      "version": "1.12.1",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/wasm-edit/-/wasm-edit-1.12.1.tgz",
+      "integrity": "sha512-1DuwbVvADvS5mGnXbE+c9NfA8QRcZ6iKquqjjmR10k6o+zzsRVesil54DKexiowcFCPdr/Q0qaMgB01+SQ1u6g==",
       "dev": true,
       "dependencies": {
-        "@webassemblyjs/ast": "1.11.1",
-        "@webassemblyjs/helper-buffer": "1.11.1",
-        "@webassemblyjs/helper-wasm-bytecode": "1.11.1",
-        "@webassemblyjs/helper-wasm-section": "1.11.1",
-        "@webassemblyjs/wasm-gen": "1.11.1",
-        "@webassemblyjs/wasm-opt": "1.11.1",
-        "@webassemblyjs/wasm-parser": "1.11.1",
-        "@webassemblyjs/wast-printer": "1.11.1"
+        "@webassemblyjs/ast": "1.12.1",
+        "@webassemblyjs/helper-buffer": "1.12.1",
+        "@webassemblyjs/helper-wasm-bytecode": "1.11.6",
+        "@webassemblyjs/helper-wasm-section": "1.12.1",
+        "@webassemblyjs/wasm-gen": "1.12.1",
+        "@webassemblyjs/wasm-opt": "1.12.1",
+        "@webassemblyjs/wasm-parser": "1.12.1",
+        "@webassemblyjs/wast-printer": "1.12.1"
       }
     },
     "node_modules/@webassemblyjs/wasm-gen": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/wasm-gen/-/wasm-gen-1.11.1.tgz",
-      "integrity": "sha512-F7QqKXwwNlMmsulj6+O7r4mmtAlCWfO/0HdgOxSklZfQcDu0TpLiD1mRt/zF25Bk59FIjEuGAIyn5ei4yMfLhA==",
+      "version": "1.12.1",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/wasm-gen/-/wasm-gen-1.12.1.tgz",
+      "integrity": "sha512-TDq4Ojh9fcohAw6OIMXqiIcTq5KUXTGRkVxbSo1hQnSy6lAM5GSdfwWeSxpAo0YzgsgF182E/U0mDNhuA0tW7w==",
       "dev": true,
       "dependencies": {
-        "@webassemblyjs/ast": "1.11.1",
-        "@webassemblyjs/helper-wasm-bytecode": "1.11.1",
-        "@webassemblyjs/ieee754": "1.11.1",
-        "@webassemblyjs/leb128": "1.11.1",
-        "@webassemblyjs/utf8": "1.11.1"
+        "@webassemblyjs/ast": "1.12.1",
+        "@webassemblyjs/helper-wasm-bytecode": "1.11.6",
+        "@webassemblyjs/ieee754": "1.11.6",
+        "@webassemblyjs/leb128": "1.11.6",
+        "@webassemblyjs/utf8": "1.11.6"
       }
     },
     "node_modules/@webassemblyjs/wasm-opt": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/wasm-opt/-/wasm-opt-1.11.1.tgz",
-      "integrity": "sha512-VqnkNqnZlU5EB64pp1l7hdm3hmQw7Vgqa0KF/KCNO9sIpI6Fk6brDEiX+iCOYrvMuBWDws0NkTOxYEb85XQHHw==",
+      "version": "1.12.1",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/wasm-opt/-/wasm-opt-1.12.1.tgz",
+      "integrity": "sha512-Jg99j/2gG2iaz3hijw857AVYekZe2SAskcqlWIZXjji5WStnOpVoat3gQfT/Q5tb2djnCjBtMocY/Su1GfxPBg==",
       "dev": true,
       "dependencies": {
-        "@webassemblyjs/ast": "1.11.1",
-        "@webassemblyjs/helper-buffer": "1.11.1",
-        "@webassemblyjs/wasm-gen": "1.11.1",
-        "@webassemblyjs/wasm-parser": "1.11.1"
+        "@webassemblyjs/ast": "1.12.1",
+        "@webassemblyjs/helper-buffer": "1.12.1",
+        "@webassemblyjs/wasm-gen": "1.12.1",
+        "@webassemblyjs/wasm-parser": "1.12.1"
       }
     },
     "node_modules/@webassemblyjs/wasm-parser": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/wasm-parser/-/wasm-parser-1.11.1.tgz",
-      "integrity": "sha512-rrBujw+dJu32gYB7/Lup6UhdkPx9S9SnobZzRVL7VcBH9Bt9bCBLEuX/YXOOtBsOZ4NQrRykKhffRWHvigQvOA==",
+      "version": "1.12.1",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/wasm-parser/-/wasm-parser-1.12.1.tgz",
+      "integrity": "sha512-xikIi7c2FHXysxXe3COrVUPSheuBtpcfhbpFj4gmu7KRLYOzANztwUU0IbsqvMqzuNK2+glRGWCEqZo1WCLyAQ==",
       "dev": true,
       "dependencies": {
-        "@webassemblyjs/ast": "1.11.1",
-        "@webassemblyjs/helper-api-error": "1.11.1",
-        "@webassemblyjs/helper-wasm-bytecode": "1.11.1",
-        "@webassemblyjs/ieee754": "1.11.1",
-        "@webassemblyjs/leb128": "1.11.1",
-        "@webassemblyjs/utf8": "1.11.1"
+        "@webassemblyjs/ast": "1.12.1",
+        "@webassemblyjs/helper-api-error": "1.11.6",
+        "@webassemblyjs/helper-wasm-bytecode": "1.11.6",
+        "@webassemblyjs/ieee754": "1.11.6",
+        "@webassemblyjs/leb128": "1.11.6",
+        "@webassemblyjs/utf8": "1.11.6"
       }
     },
     "node_modules/@webassemblyjs/wast-printer": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/wast-printer/-/wast-printer-1.11.1.tgz",
-      "integrity": "sha512-IQboUWM4eKzWW+N/jij2sRatKMh99QEelo3Eb2q0qXkvPRISAj8Qxtmw5itwqK+TTkBuUIE45AxYPToqPtL5gg==",
+      "version": "1.12.1",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/wast-printer/-/wast-printer-1.12.1.tgz",
+      "integrity": "sha512-+X4WAlOisVWQMikjbcvY2e0rwPsKQ9F688lksZhBcPycBBuii3O7m8FACbDMWDojpAqvjIncrG8J0XHKyQfVeA==",
       "dev": true,
       "dependencies": {
-        "@webassemblyjs/ast": "1.11.1",
+        "@webassemblyjs/ast": "1.12.1",
         "@xtuc/long": "4.2.2"
       }
     },
@@ -1849,10 +1829,10 @@
         "acorn-walk": "^8.0.2"
       }
     },
-    "node_modules/acorn-import-assertions": {
-      "version": "1.8.0",
-      "resolved": "https://registry.npmjs.org/acorn-import-assertions/-/acorn-import-assertions-1.8.0.tgz",
-      "integrity": "sha512-m7VZ3jwz4eK6A4Vtt8Ew1/mNbP24u0FhdyfA7fSvnJR6LMdfOYnmuIrrJAgrYfYJ10F/otaHTtrtrtmHdMNzEw==",
+    "node_modules/acorn-import-attributes": {
+      "version": "1.9.5",
+      "resolved": "https://registry.npmjs.org/acorn-import-attributes/-/acorn-import-attributes-1.9.5.tgz",
+      "integrity": "sha512-n02Vykv5uA3eHGM/Z2dQrcD56kL8TyDb2p1+0P83PClMnC/nc+anbQRhIOWnSq4Ke/KvDPrY3C9hDtC/A3eHnQ==",
       "dev": true,
       "peerDependencies": {
         "acorn": "^8"
@@ -2268,9 +2248,9 @@
       }
     },
     "node_modules/browserslist": {
-      "version": "4.21.5",
-      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.21.5.tgz",
-      "integrity": "sha512-tUkiguQGW7S3IhB7N+c2MV/HZPSCPAAiYBZXLsBhFB/PCy6ZKKsZrmBayHV9fdGV/ARIfJ14NkxKzRDjvp7L6w==",
+      "version": "4.23.3",
+      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.23.3.tgz",
+      "integrity": "sha512-btwCFJVjI4YWDNfau8RhZ+B1Q/VLoUITrm3RlP6y1tYGWIOa+InuYiRGXUBXo8nA1qKmHMyLB/iVQg5TT4eFoA==",
       "dev": true,
       "funding": [
         {
@@ -2280,13 +2260,17 @@
         {
           "type": "tidelift",
           "url": "https://tidelift.com/funding/github/npm/browserslist"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
         }
       ],
       "dependencies": {
-        "caniuse-lite": "^1.0.30001449",
-        "electron-to-chromium": "^1.4.284",
-        "node-releases": "^2.0.8",
-        "update-browserslist-db": "^1.0.10"
+        "caniuse-lite": "^1.0.30001646",
+        "electron-to-chromium": "^1.5.4",
+        "node-releases": "^2.0.18",
+        "update-browserslist-db": "^1.1.0"
       },
       "bin": {
         "browserslist": "cli.js"
@@ -2474,9 +2458,9 @@
       }
     },
     "node_modules/caniuse-lite": {
-      "version": "1.0.30001611",
-      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001611.tgz",
-      "integrity": "sha512-19NuN1/3PjA3QI8Eki55N8my4LzfkMCRLgCVfrl/slbSAchQfV0+GwjPrK3rq37As4UCLlM/DHajbKkAqbv92Q==",
+      "version": "1.0.30001653",
+      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001653.tgz",
+      "integrity": "sha512-XGWQVB8wFQ2+9NZwZ10GxTYC5hk0Fa+q8cSkr0tgvMhYhMHP/QC+WTgrePMDBWiWc/pV+1ik82Al20XOK25Gcw==",
       "dev": true,
       "funding": [
         {
@@ -3230,9 +3214,9 @@
       }
     },
     "node_modules/electron-to-chromium": {
-      "version": "1.4.315",
-      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.4.315.tgz",
-      "integrity": "sha512-ndBQYz3Eyy3rASjjQ9poMJGoAlsZ/aZnq6GBsGL4w/4sWIAwiUHVSsMuADbxa8WJw7pZ0oxLpGbtoDt4vRTdCg==",
+      "version": "1.5.13",
+      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.13.tgz",
+      "integrity": "sha512-lbBcvtIJ4J6sS4tb5TLp1b4LyfCdMkwStzXPyAgVgTRAsep4bvrAGaBOP7ZJtQMNJpSQ9SqG4brWOroNaQtm7Q==",
       "dev": true
     },
     "node_modules/emittery": {
@@ -3264,9 +3248,9 @@
       }
     },
     "node_modules/enhanced-resolve": {
-      "version": "5.12.0",
-      "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.12.0.tgz",
-      "integrity": "sha512-QHTXI/sZQmko1cbDoNAa3mJ5qhWUUNAq3vR0/YiD379fWQrcfuoX1+HW2S0MTt7XmoPLapdaDKUtelUSPic7hQ==",
+      "version": "5.17.1",
+      "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.17.1.tgz",
+      "integrity": "sha512-LMHl3dXhTcfv8gM4kEzIUeTQ+7fpdA0l2tUf34BddXPkz2A5xJ5L/Pchd5BL6rdccM9QGvu0sWZzK1Z1t4wwyg==",
       "dev": true,
       "dependencies": {
         "graceful-fs": "^4.2.4",
@@ -3322,15 +3306,15 @@
       }
     },
     "node_modules/es-module-lexer": {
-      "version": "0.9.3",
-      "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-0.9.3.tgz",
-      "integrity": "sha512-1HQ2M2sPtxwnvOvT1ZClHyQDiggdNjURWpY2we6aMKCQiUVxTmVs2UYPLIrD84sS+kMdUwfBSylbJPwNnBrnHQ==",
+      "version": "1.5.4",
+      "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-1.5.4.tgz",
+      "integrity": "sha512-MVNK56NiMrOwitFB7cqDwq0CQutbw+0BvLshJSse0MUNU+y1FC3bUS/AQg7oUng+/wKrrki7JfmwtVHkVfPLlw==",
       "dev": true
     },
     "node_modules/escalade": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/escalade/-/escalade-3.1.1.tgz",
-      "integrity": "sha512-k0er2gUkLf8O0zKJiAhmkTnJlTvINGv7ygDNPbeIsX/TJjGJZHuh9B2UxbsaEkmlEo9MfhrSzmhIlhRlI2GXnw==",
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/escalade/-/escalade-3.1.2.tgz",
+      "integrity": "sha512-ErCHMCae19vR8vQGe50xIsVomy19rg6gFu3+r3jkEO46suLMWBksvVyoGgQV+jOfl84ZSOSlmv6Gxa89PmTGmA==",
       "dev": true,
       "engines": {
         "node": ">=6"
@@ -3909,9 +3893,9 @@
       }
     },
     "node_modules/graceful-fs": {
-      "version": "4.2.10",
-      "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.10.tgz",
-      "integrity": "sha512-9ByhssR2fPVsNZj478qUUbKfmL0+t5BDVyjShtyZZLiK7ZDAArFFfopyOTj0M05wE2tJPisA4iTnnXl2YoPvOA==",
+      "version": "4.2.11",
+      "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.11.tgz",
+      "integrity": "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==",
       "dev": true
     },
     "node_modules/graphql": {
@@ -6287,9 +6271,9 @@
       "dev": true
     },
     "node_modules/node-releases": {
-      "version": "2.0.10",
-      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.10.tgz",
-      "integrity": "sha512-5GFldHPXVG/YZmFzJvKK2zDSzPKhEp0+ZR5SVaoSag9fsL5YgHbUHDfnG5494ISANDcK4KwPXAx2xqVEydmd7w==",
+      "version": "2.0.18",
+      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.18.tgz",
+      "integrity": "sha512-d9VeXT4SJ7ZeOqGX6R5EM022wpL+eWPooLI+5UpWn2jCT1aosUQEhQP214x33Wkwx3JQMvIm+tIoVOdodFS40g==",
       "dev": true
     },
     "node_modules/node-sass": {
@@ -6629,9 +6613,9 @@
       }
     },
     "node_modules/picocolors": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.0.0.tgz",
-      "integrity": "sha512-1fygroTLlHu66zi26VoTDv8yRgm0Fccecssto+MhsZ0D/DGW2sm8E8AjW7NU5VVTRt5GxbeZ5qBuJr+HyLYkjQ==",
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.0.1.tgz",
+      "integrity": "sha512-anP1Z8qwhkbmu7MFP5iTt+wQKXgwzf7zTyGlcdzabySa9vd0Xt392U0rVmz9poOaBj0uHJKyyo9/upk0HrEQew==",
       "dev": true
     },
     "node_modules/picomatch": {
@@ -7828,13 +7812,13 @@
       }
     },
     "node_modules/terser": {
-      "version": "5.16.5",
-      "resolved": "https://registry.npmjs.org/terser/-/terser-5.16.5.tgz",
-      "integrity": "sha512-qcwfg4+RZa3YvlFh0qjifnzBHjKGNbtDo9yivMqMFDy9Q6FSaQWSB/j1xKhsoUFJIqDOM3TsN6D5xbrMrFcHbg==",
+      "version": "5.31.6",
+      "resolved": "https://registry.npmjs.org/terser/-/terser-5.31.6.tgz",
+      "integrity": "sha512-PQ4DAriWzKj+qgehQ7LK5bQqCFNMmlhjR2PFFLuqGCpuCAauxemVBWwWOxo3UIwWQx8+Pr61Df++r76wDmkQBg==",
       "dev": true,
       "dependencies": {
-        "@jridgewell/source-map": "^0.3.2",
-        "acorn": "^8.5.0",
+        "@jridgewell/source-map": "^0.3.3",
+        "acorn": "^8.8.2",
         "commander": "^2.20.0",
         "source-map-support": "~0.5.20"
       },
@@ -7846,16 +7830,16 @@
       }
     },
     "node_modules/terser-webpack-plugin": {
-      "version": "5.3.6",
-      "resolved": "https://registry.npmjs.org/terser-webpack-plugin/-/terser-webpack-plugin-5.3.6.tgz",
-      "integrity": "sha512-kfLFk+PoLUQIbLmB1+PZDMRSZS99Mp+/MHqDNmMA6tOItzRt+Npe3E+fsMs5mfcM0wCtrrdU387UnV+vnSffXQ==",
+      "version": "5.3.10",
+      "resolved": "https://registry.npmjs.org/terser-webpack-plugin/-/terser-webpack-plugin-5.3.10.tgz",
+      "integrity": "sha512-BKFPWlPDndPs+NGGCr1U59t0XScL5317Y0UReNrHaw9/FwhPENlq6bfgs+4yPfyP51vqC1bQ4rp1EfXW5ZSH9w==",
       "dev": true,
       "dependencies": {
-        "@jridgewell/trace-mapping": "^0.3.14",
+        "@jridgewell/trace-mapping": "^0.3.20",
         "jest-worker": "^27.4.5",
         "schema-utils": "^3.1.1",
-        "serialize-javascript": "^6.0.0",
-        "terser": "^5.14.1"
+        "serialize-javascript": "^6.0.1",
+        "terser": "^5.26.0"
       },
       "engines": {
         "node": ">= 10.13.0"
@@ -7911,9 +7895,9 @@
       "dev": true
     },
     "node_modules/terser-webpack-plugin/node_modules/schema-utils": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/schema-utils/-/schema-utils-3.1.1.tgz",
-      "integrity": "sha512-Y5PQxS4ITlC+EahLuXaY86TXfR7Dc5lw294alXOq86JAHCihAIZfqv8nNCWvaEJvaC51uN9hbLGeV0cFBdH+Fw==",
+      "version": "3.3.0",
+      "resolved": "https://registry.npmjs.org/schema-utils/-/schema-utils-3.3.0.tgz",
+      "integrity": "sha512-pN/yOAvcC+5rQ5nERGuwrjLlYvLTbCibnZ1I7B1LaiAz9BRBlE9GMgE/eqV30P7aJQUf7Ddimy/RsbYO/GrVGg==",
       "dev": true,
       "dependencies": {
         "@types/json-schema": "^7.0.8",
@@ -8216,9 +8200,9 @@
       }
     },
     "node_modules/update-browserslist-db": {
-      "version": "1.0.13",
-      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.0.13.tgz",
-      "integrity": "sha512-xebP81SNcPuNpPP3uzeW1NYXxI3rxyJzF3pD6sH4jE7o/IX+WtSpwnVU+qIsDPyk0d3hmFQ7mjqc6AtV604hbg==",
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.1.0.tgz",
+      "integrity": "sha512-EdRAaAyk2cUE1wOf2DkEhzxqOQvFOoRJFNS6NeyJ01Gp2beMRpBAINjM2iDXE3KCuKhwnvHIQCJm6ThL2Z+HzQ==",
       "dev": true,
       "funding": [
         {
@@ -8235,8 +8219,8 @@
         }
       ],
       "dependencies": {
-        "escalade": "^3.1.1",
-        "picocolors": "^1.0.0"
+        "escalade": "^3.1.2",
+        "picocolors": "^1.0.1"
       },
       "bin": {
         "update-browserslist-db": "cli.js"
@@ -8351,9 +8335,9 @@
       }
     },
     "node_modules/watchpack": {
-      "version": "2.4.0",
-      "resolved": "https://registry.npmjs.org/watchpack/-/watchpack-2.4.0.tgz",
-      "integrity": "sha512-Lcvm7MGST/4fup+ifyKi2hjyIAwcdI4HRgtvTpIUxBRhB+RFtUh8XtDOxUfctVCnhVi+QQj49i91OyvzkJl6cg==",
+      "version": "2.4.2",
+      "resolved": "https://registry.npmjs.org/watchpack/-/watchpack-2.4.2.tgz",
+      "integrity": "sha512-TnbFSbcOCcDgjZ4piURLCbJ3nJhznVh9kw6F6iokjiFPl8ONxe9A6nMDVXDiNbrSfLILs6vB07F7wLBrwPYzJw==",
       "dev": true,
       "dependencies": {
         "glob-to-regexp": "^0.4.1",
@@ -8391,34 +8375,33 @@
       "dev": true
     },
     "node_modules/webpack": {
-      "version": "5.76.1",
-      "resolved": "https://registry.npmjs.org/webpack/-/webpack-5.76.1.tgz",
-      "integrity": "sha512-4+YIK4Abzv8172/SGqObnUjaIHjLEuUasz9EwQj/9xmPPkYJy2Mh03Q/lJfSD3YLzbxy5FeTq5Uw0323Oh6SJQ==",
+      "version": "5.94.0",
+      "resolved": "https://registry.npmjs.org/webpack/-/webpack-5.94.0.tgz",
+      "integrity": "sha512-KcsGn50VT+06JH/iunZJedYGUJS5FGjow8wb9c0v5n1Om8O1g4L6LjtfxwlXIATopoQu+vOXXa7gYisWxCoPyg==",
       "dev": true,
       "dependencies": {
-        "@types/eslint-scope": "^3.7.3",
-        "@types/estree": "^0.0.51",
-        "@webassemblyjs/ast": "1.11.1",
-        "@webassemblyjs/wasm-edit": "1.11.1",
-        "@webassemblyjs/wasm-parser": "1.11.1",
+        "@types/estree": "^1.0.5",
+        "@webassemblyjs/ast": "^1.12.1",
+        "@webassemblyjs/wasm-edit": "^1.12.1",
+        "@webassemblyjs/wasm-parser": "^1.12.1",
         "acorn": "^8.7.1",
-        "acorn-import-assertions": "^1.7.6",
-        "browserslist": "^4.14.5",
+        "acorn-import-attributes": "^1.9.5",
+        "browserslist": "^4.21.10",
         "chrome-trace-event": "^1.0.2",
-        "enhanced-resolve": "^5.10.0",
-        "es-module-lexer": "^0.9.0",
+        "enhanced-resolve": "^5.17.1",
+        "es-module-lexer": "^1.2.1",
         "eslint-scope": "5.1.1",
         "events": "^3.2.0",
         "glob-to-regexp": "^0.4.1",
-        "graceful-fs": "^4.2.9",
+        "graceful-fs": "^4.2.11",
         "json-parse-even-better-errors": "^2.3.1",
         "loader-runner": "^4.2.0",
         "mime-types": "^2.1.27",
         "neo-async": "^2.6.2",
-        "schema-utils": "^3.1.0",
+        "schema-utils": "^3.2.0",
         "tapable": "^2.1.1",
-        "terser-webpack-plugin": "^5.1.3",
-        "watchpack": "^2.4.0",
+        "terser-webpack-plugin": "^5.3.10",
+        "watchpack": "^2.4.1",
         "webpack-sources": "^3.2.3"
       },
       "bin": {
@@ -8545,9 +8528,9 @@
       "dev": true
     },
     "node_modules/webpack/node_modules/schema-utils": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/schema-utils/-/schema-utils-3.1.1.tgz",
-      "integrity": "sha512-Y5PQxS4ITlC+EahLuXaY86TXfR7Dc5lw294alXOq86JAHCihAIZfqv8nNCWvaEJvaC51uN9hbLGeV0cFBdH+Fw==",
+      "version": "3.3.0",
+      "resolved": "https://registry.npmjs.org/schema-utils/-/schema-utils-3.3.0.tgz",
+      "integrity": "sha512-pN/yOAvcC+5rQ5nERGuwrjLlYvLTbCibnZ1I7B1LaiAz9BRBlE9GMgE/eqV30P7aJQUf7Ddimy/RsbYO/GrVGg==",
       "dev": true,
       "dependencies": {
         "@types/json-schema": "^7.0.8",
diff --git a/ee/fleetd-chrome/package.json b/ee/fleetd-chrome/package.json
index e8c3f9e322..1958255936 100644
--- a/ee/fleetd-chrome/package.json
+++ b/ee/fleetd-chrome/package.json
@@ -24,7 +24,7 @@
     "ts-loader": "^9.4.2",
     "ts-node": "^10.9.2",
     "typescript": "^4.9.5",
-    "webpack": "^5.75.0",
+    "webpack": "^5.94.0",
     "webpack-cli": "^5.0.1",
     "webpack-merge": "^5.8.0"
   },
diff --git a/ee/server/calendar/google_calendar.go b/ee/server/calendar/google_calendar.go
index 73c47d5cde..7abbc6c4c6 100644
--- a/ee/server/calendar/google_calendar.go
+++ b/ee/server/calendar/google_calendar.go
@@ -298,30 +298,30 @@ func (c *GoogleCalendar) Configure(userEmail string) error {
 }
 
 func (c *GoogleCalendar) UpdateEventBody(event *fleet.CalendarEvent,
-	genBodyFn fleet.CalendarGenBodyFn) error {
+	genBodyFn fleet.CalendarGenBodyFn) (string, error) {
 	details, err := c.unmarshalDetails(event)
 	if err != nil {
-		return err
+		return "", err
 	}
 	gEvent, err := c.config.API.GetEvent(details.ID, "")
 	if err != nil {
-		return ctxerr.Wrap(c.config.Context, err, "retrieving Google calendar event")
+		return "", ctxerr.Wrap(c.config.Context, err, "retrieving Google calendar event")
 	}
 	// Check if the current description contains the conflict text
 	conflict := strings.Contains(gEvent.Description, fleet.CalendarEventConflictText)
 	var ok bool
 	gEvent.Description, ok, err = genBodyFn(conflict)
 	if err != nil {
-		return ctxerr.Wrap(c.config.Context, err, "generating calendar event body")
+		return "", ctxerr.Wrap(c.config.Context, err, "generating calendar event body")
 	}
 	if !ok {
-		return nil
+		return "", nil
 	}
-	_, err = c.config.API.UpdateEvent(gEvent)
+	updatedEvent, err := c.config.API.UpdateEvent(gEvent)
 	if err != nil {
-		return ctxerr.Wrap(c.config.Context, err, "updating Google calendar event")
+		return "", ctxerr.Wrap(c.config.Context, err, "updating Google calendar event")
 	}
-	return nil
+	return updatedEvent.Etag, nil
 }
 
 func (c *GoogleCalendar) GetAndUpdateEvent(event *fleet.CalendarEvent, genBodyFn fleet.CalendarGenBodyFn,
@@ -441,7 +441,8 @@ func (c *GoogleCalendar) GetAndUpdateEvent(event *fleet.CalendarEvent, genBodyFn
 			if err != nil {
 				return nil, false, err
 			}
-			fleetEvent, err := c.googleEventToFleetEvent(*startTime, *endTime, gEvent, event.UUID, details.ChannelID, details.ResourceID)
+			fleetEvent, err := c.googleEventToFleetEvent(*startTime, *endTime, gEvent, event.UUID, details.ChannelID, details.ResourceID,
+				details.BodyTag)
 			if err != nil {
 				return nil, false, err
 			}
@@ -596,6 +597,11 @@ func (c *GoogleCalendar) createEvent(
 			continue
 		}
 
+		if gEvent.Transparency == "transparent" {
+			// Ignore events that do not block time on the calendar (e.g. free events)
+			continue
+		}
+
 		// Ignore events that the user has declined
 		var declined bool
 		for _, attendee := range gEvent.Attendees {
@@ -674,8 +680,8 @@ func (c *GoogleCalendar) createEvent(
 		resourceID = opts.ResourceID
 	}
 
-	// Convert Google event to Fleet event
-	fleetEvent, err := c.googleEventToFleetEvent(eventStart, eventEnd, event, eventUUID, channelID, resourceID)
+	// Convert Google event to Fleet event. Body tag will be updated by the calling function.
+	fleetEvent, err := c.googleEventToFleetEvent(eventStart, eventEnd, event, eventUUID, channelID, resourceID, "body_tag")
 	if err != nil {
 		return nil, err
 	}
@@ -726,8 +732,7 @@ func getLocation(tz string, config *GoogleCalendarConfig) *time.Location {
 }
 
 func (c *GoogleCalendar) googleEventToFleetEvent(startTime time.Time, endTime time.Time, event *calendar.Event, eventUUID string,
-	channelID string,
-	resourceID string) (
+	channelID string, resourceID string, bodyTag string) (
 	*fleet.CalendarEvent, error,
 ) {
 	tzName := c.location.String()
@@ -742,6 +747,7 @@ func (c *GoogleCalendar) googleEventToFleetEvent(startTime time.Time, endTime ti
 		ETag:       event.Etag,
 		ChannelID:  channelID,
 		ResourceID: resourceID,
+		BodyTag:    bodyTag,
 	}
 	detailsJson, err := json.Marshal(details)
 	if err != nil {
diff --git a/ee/server/calendar/google_calendar_integration_test.go b/ee/server/calendar/google_calendar_integration_test.go
index 8efb8ec881..7e51a4d1f7 100644
--- a/ee/server/calendar/google_calendar_integration_test.go
+++ b/ee/server/calendar/google_calendar_integration_test.go
@@ -45,7 +45,7 @@ func (s *googleCalendarIntegrationTestSuite) TearDownSuite() {
 
 // TestGoogleCalendarIntegration tests should be able to be run in parallel, but this is not natively supported by suites: https://github.com/stretchr/testify/issues/187
 // There are workarounds that can be explored.
-func TestGoogleCalendarIntegration(t *testing.T) {
+func TestIntegrationsGoogleCalendar(t *testing.T) {
 	testingSuite := new(googleCalendarIntegrationTestSuite)
 	suite.Run(t, testingSuite)
 }
diff --git a/ee/server/service/calendar.go b/ee/server/service/calendar.go
index 4f5f971b56..57ac9834bc 100644
--- a/ee/server/service/calendar.go
+++ b/ee/server/service/calendar.go
@@ -229,13 +229,15 @@ func (svc *Service) processCalendarEvent(ctx context.Context, eventDetails *flee
 	}
 	if updated && event != nil {
 		// Event was updated, so we set a flag.
-		_, err = svc.distributedLock.AcquireLock(ctx, calendar.RecentUpdateKeyPrefix+event.UUID, calendar.RecentCalendarUpdateValue,
+		_, err = svc.distributedLock.SetIfNotExist(ctx, calendar.RecentUpdateKeyPrefix+event.UUID, calendar.RecentCalendarUpdateValue,
 			uint64(calendar.RecentCalendarUpdateDuration.Milliseconds()))
 		if err != nil {
 			return ctxerr.Wrap(ctx, err, "set recent update flag")
 		}
 		// Event was updated, so we need to save it
-		err = event.SaveBodyTag(generatedTag)
+		if generatedTag != "" {
+			err = event.SaveDataItems("body_tag", generatedTag)
+		}
 		if err != nil {
 			return ctxerr.Wrap(ctx, err, "save calendar event body tag")
 		}
@@ -288,7 +290,7 @@ func (svc *Service) getCalendarLock(ctx context.Context, eventUUID string, addTo
 	if !reserved {
 		// Try to acquire the lock
 		lockValue = uuid.New().String()
-		lockAcquired, err = svc.distributedLock.AcquireLock(ctx, calendar.LockKeyPrefix+eventUUID, lockValue,
+		lockAcquired, err = svc.distributedLock.SetIfNotExist(ctx, calendar.LockKeyPrefix+eventUUID, lockValue,
 			calendar.DistributedLockExpireMs)
 		if err != nil {
 			return "", false, ctxerr.Wrap(ctx, err, "acquire calendar lock")
@@ -308,7 +310,7 @@ func (svc *Service) getCalendarLock(ctx context.Context, eventUUID string, addTo
 		}
 
 		// Try to acquire the lock again in case it was released while we were adding the event to the queue.
-		lockAcquired, err = svc.distributedLock.AcquireLock(ctx, calendar.LockKeyPrefix+eventUUID, lockValue,
+		lockAcquired, err = svc.distributedLock.SetIfNotExist(ctx, calendar.LockKeyPrefix+eventUUID, lockValue,
 			calendar.DistributedLockExpireMs)
 		if err != nil {
 			return "", false, ctxerr.Wrap(ctx, err, "acquire calendar lock again")
diff --git a/ee/server/service/calendar_test.go b/ee/server/service/calendar_test.go
index 499112f5dd..9000bab137 100644
--- a/ee/server/service/calendar_test.go
+++ b/ee/server/service/calendar_test.go
@@ -15,7 +15,7 @@ type mockLock struct {
 	AddToSetFn    func(ctx context.Context, key string, value string) error
 }
 
-func (m *mockLock) AcquireLock(ctx context.Context, key string, value string, expireMs uint64) (ok bool, err error) {
+func (m *mockLock) SetIfNotExist(ctx context.Context, key string, value string, expireMs uint64) (ok bool, err error) {
 	return m.AcquireLockFn(ctx, key, value, expireMs)
 }
 
@@ -27,6 +27,10 @@ func (m *mockLock) Get(ctx context.Context, key string) (*string, error) {
 	return m.GetFn(ctx, key)
 }
 
+func (m *mockLock) GetAndDelete(ctx context.Context, key string) (*string, error) {
+	panic("implement me")
+}
+
 func (m *mockLock) AddToSet(ctx context.Context, key string, value string) error {
 	return m.AddToSetFn(ctx, key, value)
 }
diff --git a/ee/server/service/devices.go b/ee/server/service/devices.go
index 590067e916..7c3b580e92 100644
--- a/ee/server/service/devices.go
+++ b/ee/server/service/devices.go
@@ -62,7 +62,12 @@ func (svc *Service) TriggerMigrateMDMDevice(ctx context.Context, host *fleet.Hos
 		return ctxerr.Wrap(ctx, err, "fetching host mdm info")
 	}
 
-	if !fleet.IsEligibleForDEPMigration(host, mdmInfo, connected) {
+	manualMigrationEligible, err := fleet.IsEligibleForManualMigration(host, mdmInfo, connected)
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "checking manual migration eligibility")
+	}
+
+	if !fleet.IsEligibleForDEPMigration(host, mdmInfo, connected) && !manualMigrationEligible {
 		bre.InternalErr = ctxerr.New(ctx, "host not eligible for macOS migration")
 	}
 
@@ -139,9 +144,15 @@ func (svc *Service) GetFleetDesktopSummary(ctx context.Context) (fleet.DesktopSu
 			sum.Notifications.RenewEnrollmentProfile = true
 		}
 
-		if fleet.IsEligibleForDEPMigration(host, mdmInfo, connected) {
+		manualMigrationEligible, err := fleet.IsEligibleForManualMigration(host, mdmInfo, connected)
+		if err != nil {
+			return sum, ctxerr.Wrap(ctx, err, "checking manual migration eligibility")
+		}
+
+		if fleet.IsEligibleForDEPMigration(host, mdmInfo, connected) || manualMigrationEligible {
 			sum.Notifications.NeedsMDMMigration = true
 		}
+
 	}
 
 	// organization information
diff --git a/ee/server/service/mdm.go b/ee/server/service/mdm.go
index cfed0983d1..f6db29af5c 100644
--- a/ee/server/service/mdm.go
+++ b/ee/server/service/mdm.go
@@ -4,12 +4,13 @@ import (
 	"bytes"
 	"context"
 	"crypto/sha256"
+	"crypto/x509"
 	"encoding/base64"
 	"encoding/json"
+	"encoding/pem"
 	"errors"
 	"fmt"
 	"io"
-	"net/http"
 	"net/url"
 	"sort"
 	"strings"
@@ -20,17 +21,14 @@ import (
 	"github.com/fleetdm/fleet/v4/server/contexts/ctxdb"
 	"github.com/fleetdm/fleet/v4/server/contexts/ctxerr"
 	"github.com/fleetdm/fleet/v4/server/contexts/logging"
-	"github.com/fleetdm/fleet/v4/server/datastore/mysql"
 	"github.com/fleetdm/fleet/v4/server/fleet"
 	"github.com/fleetdm/fleet/v4/server/mdm"
 	apple_mdm "github.com/fleetdm/fleet/v4/server/mdm/apple"
 	"github.com/fleetdm/fleet/v4/server/mdm/apple/mobileconfig"
 	"github.com/fleetdm/fleet/v4/server/mdm/assets"
-	depclient "github.com/fleetdm/fleet/v4/server/mdm/nanodep/client"
-	"github.com/fleetdm/fleet/v4/server/mdm/nanodep/storage"
+	"github.com/fleetdm/fleet/v4/server/mdm/nanodep/client"
 	"github.com/fleetdm/fleet/v4/server/sso"
 	"github.com/fleetdm/fleet/v4/server/worker"
-	kitlog "github.com/go-kit/log"
 	"github.com/go-kit/log/level"
 	"github.com/google/uuid"
 )
@@ -49,75 +47,30 @@ func (svc *Service) GetAppleBM(ctx context.Context) (*fleet.AppleBM, error) {
 		return nil, err
 	}
 
-	abmAssets, err := svc.ds.GetAllMDMConfigAssetsHashes(ctx, []fleet.MDMAssetName{
-		fleet.MDMAssetABMKey,
-		fleet.MDMAssetABMCert,
-		fleet.MDMAssetABMToken,
-	})
+	tokens, err := svc.ds.ListABMTokens(ctx)
 	if err != nil {
-		if errors.Is(err, mysql.ErrPartialResult) {
-			_, hasABMKey := abmAssets[fleet.MDMAssetABMKey]
-			_, hasABMCert := abmAssets[fleet.MDMAssetABMCert]
-			_, hasABMToken := abmAssets[fleet.MDMAssetABMToken]
-
-			// to preserve existing behavior, if the ABM setup is
-			// incomplete, return a not found error
-			if hasABMKey && hasABMCert && !hasABMToken {
-				return nil, notFoundError{}
-			}
-		}
-		return nil, err
+		return nil, ctxerr.Wrap(ctx, err, "GetAppleBM: listing ABM tokens")
 	}
 
-	appleBM, err := getAppleBMAccountDetail(ctx, svc.depStorage, svc.ds, svc.logger)
-	if err != nil {
-		return nil, err
+	if len(tokens) == 0 {
+		return nil, notFoundError{}
 	}
 
-	token, err := assets.ABMToken(ctx, svc.ds)
-	if err != nil {
-		return nil, err
+	if len(tokens) > 1 {
+		return nil, errors.New("This API endpoint has been deprecated. Please use the new GET /abm_tokens API endpoint documented here: https://fleetdm.com/learn-more-about/apple-business-manager-tokens-api")
 	}
 
-	// fill the rest of the AppleBM fields
-	appleBM.RenewDate = token.AccessTokenExpiry
-	appleBM.DefaultTeam = appCfg.MDM.AppleBMDefaultTeam
+	abmToken := tokens[0]
+
+	var appleBM fleet.AppleBM
+	// transfer the abmToken metadata info to the appleBM struct
+	appleBM.AppleID = abmToken.AppleID
+	appleBM.OrgName = abmToken.OrganizationName
+	appleBM.RenewDate = abmToken.RenewAt
+	appleBM.DefaultTeam = appCfg.MDM.DeprecatedAppleBMDefaultTeam
 	appleBM.MDMServerURL = mdmServerURL
 
-	return appleBM, nil
-}
-
-func getAppleBMAccountDetail(ctx context.Context, depStorage storage.AllDEPStorage, ds fleet.Datastore, logger kitlog.Logger) (*fleet.AppleBM, error) {
-	depClient := apple_mdm.NewDEPClient(depStorage, ds, logger)
-	res, err := depClient.AccountDetail(ctx, apple_mdm.DEPName)
-	if err != nil {
-		var authErr *depclient.AuthError
-		if errors.As(err, &authErr) {
-			// authentication failure with 401 unauthorized means that the configured
-			// Apple BM certificate and/or token are invalid. Fail with a 400 Bad
-			// Request.
-			msg := err.Error()
-			if authErr.StatusCode == http.StatusUnauthorized {
-				msg = "The Apple Business Manager certificate or server token is invalid. Restart Fleet with a valid certificate and token. See https://fleetdm.com/learn-more-about/setup-abm for help."
-			}
-			return nil, ctxerr.Wrap(ctx, &fleet.BadRequestError{
-				Message:     msg,
-				InternalErr: err,
-			}, "apple GET /account request failed with authentication error")
-		}
-		return nil, ctxerr.Wrap(ctx, err, "apple GET /account request failed")
-	}
-
-	if res.AdminID == "" {
-		// fallback to facilitator ID, as this is the same information but for
-		// older versions of the Apple API.
-		// https://github.com/fleetdm/fleet/issues/7515#issuecomment-1346579398
-		res.AdminID = res.FacilitatorID
-	}
-	return &fleet.AppleBM{
-		AppleID: res.AdminID,
-		OrgName: res.OrgName,
-	}, nil
+	return &appleBM, nil
 }
 
 func (svc *Service) MDMAppleDeviceLock(ctx context.Context, hostID uint) error {
@@ -367,7 +320,7 @@ func (svc *Service) MDMAppleUploadBootstrapPackage(ctx context.Context, name str
 		Sha256: hash.Sum(nil),
 		Bytes:  pkgBuf.Bytes(),
 	}
-	if err := svc.ds.InsertMDMAppleBootstrapPackage(ctx, bp); err != nil {
+	if err := svc.ds.InsertMDMAppleBootstrapPackage(ctx, bp, svc.bootstrapPackageStore); err != nil {
 		return err
 	}
 
@@ -385,7 +338,7 @@ func (svc *Service) GetMDMAppleBootstrapPackageBytes(ctx context.Context, token
 	// skipauth: bootstrap packages are gated by token
 	svc.authz.SkipAuthorization(ctx)
 
-	pkg, err := svc.ds.GetMDMAppleBootstrapPackageBytes(ctx, token)
+	pkg, err := svc.ds.GetMDMAppleBootstrapPackageBytes(ctx, token, svc.bootstrapPackageStore)
 	if err != nil {
 		return nil, ctxerr.Wrap(ctx, err)
 	}
@@ -557,8 +510,10 @@ func (svc *Service) SetOrUpdateMDMAppleSetupAssistant(ctx context.Context, asst
 	// enabled (either globally or for a specific team, if provided)
 	var endUserAuthEnabled bool
 	var teamName *string
+	var tm *fleet.Team
 	if asst.TeamID != nil {
-		tm, err := svc.ds.Team(ctx, *asst.TeamID)
+		var err error
+		tm, err = svc.ds.Team(ctx, *asst.TeamID)
 		if err != nil {
 			return nil, ctxerr.Wrap(ctx, err, "get team")
 		}
@@ -587,6 +542,12 @@ func (svc *Service) SetOrUpdateMDMAppleSetupAssistant(ctx context.Context, asst
 		return nil, ctxerr.Wrap(ctx, fleet.NewInvalidArgumentError("profile", `Couldn't edit macos_setup_assistant. The profile can't include "await_device_configured" option.`))
 	}
 
+	// Validate the profile with Apple's API. Don't save the profile if it isn't valid.
+	err := svc.depService.ValidateSetupAssistant(ctx, tm, asst, "")
+	if err != nil {
+		return nil, fleet.NewInvalidArgumentError("profile", err.Error())
+	}
+
 	// must read the existing setup assistant first to detect if it did change
 	// (so that the changed activity is not created if the same assistant was
 	// uploaded).
@@ -1119,7 +1080,7 @@ func (svc *Service) mdmAppleEditedAppleOSUpdates(ctx context.Context, teamID *ui
 		// This only sets profiles that haven't been queued by the cron to 'pending' (both removes and installs, which includes
 		// the OS updates we just deleted). It doesn't have a functional difference because if you don't call this function
 		// the cron will catch up, but it's important for the UX to mark them as pending immediately so it's reflected in the UI.
-		if err := svc.ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{globalOrTeamID}, nil, nil); err != nil {
+		if _, err := svc.ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{globalOrTeamID}, nil, nil); err != nil {
 			return ctxerr.Wrap(ctx, err, "bulk set pending host profiles")
 		}
 		return nil
@@ -1152,7 +1113,7 @@ func (svc *Service) mdmAppleEditedAppleOSUpdates(ctx context.Context, teamID *ui
 		return err
 	}
 
-	if err := svc.ds.BulkSetPendingMDMHostProfiles(ctx, nil, nil, []string{decl.DeclarationUUID}, nil); err != nil {
+	if _, err := svc.ds.BulkSetPendingMDMHostProfiles(ctx, nil, nil, []string{decl.DeclarationUUID}, nil); err != nil {
 		return ctxerr.Wrap(ctx, err, "bulk set pending host declarations")
 	}
 	return nil
@@ -1225,3 +1186,220 @@ func (svc *Service) GetMDMManualEnrollmentProfile(ctx context.Context) ([]byte,
 	// need arises.
 	return mobileConfig, nil
 }
+
+func (svc *Service) UploadABMToken(ctx context.Context, token io.Reader) (*fleet.ABMToken, error) {
+	encryptedToken, decryptedToken, err := svc.decryptUploadedABMToken(ctx, token)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "decrypting uploaded ABM token")
+	}
+
+	if err := svc.authz.Authorize(ctx, &fleet.AppleBM{}, fleet.ActionWrite); err != nil {
+		return nil, err
+	}
+
+	tok := &fleet.ABMToken{
+		EncryptedToken: encryptedToken,
+	}
+
+	if err := apple_mdm.SetDecryptedABMTokenMetadata(ctx, tok, decryptedToken, svc.depStorage, svc.ds, svc.logger); err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "setting ABM token metadata")
+	}
+
+	tok, err = svc.ds.InsertABMToken(ctx, tok)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "save ABM token")
+	}
+
+	// flip the app config flag
+	appCfg, err := svc.ds.AppConfig(ctx)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "retrieving app config")
+	}
+
+	appCfg.MDM.AppleBMEnabledAndConfigured = true
+
+	if err := svc.ds.SaveAppConfig(ctx, appCfg); err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "saving app config after ABM enablement")
+	}
+
+	return tok, nil
+}
+
+func (svc *Service) DeleteABMToken(ctx context.Context, tokenID uint) error {
+	if err := svc.authz.Authorize(ctx, &fleet.AppleBM{}, fleet.ActionWrite); err != nil {
+		return err
+	}
+
+	if err := svc.ds.DeleteABMToken(ctx, tokenID); err != nil {
+		return ctxerr.Wrap(ctx, err, "removing ABM token")
+	}
+
+	count, err := svc.ds.GetABMTokenCount(ctx)
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "getting ABM token count")
+	}
+
+	if count == 0 {
+		// flip the app config flag
+		appCfg, err := svc.ds.AppConfig(ctx)
+		if err != nil {
+			return ctxerr.Wrap(ctx, err, "retrieving app config")
+		}
+
+		appCfg.MDM.AppleBMEnabledAndConfigured = false
+		return svc.ds.SaveAppConfig(ctx, appCfg)
+	}
+
+	return nil
+}
+
+func (svc *Service) ListABMTokens(ctx context.Context) ([]*fleet.ABMToken, error) {
+	if err := svc.authz.Authorize(ctx, &fleet.AppleBM{}, fleet.ActionList); err != nil {
+		return nil, err
+	}
+
+	tokens, err := svc.ds.ListABMTokens(ctx)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "list ABM tokens")
+	}
+
+	return tokens, nil
+}
+
+func (svc *Service) UpdateABMTokenTeams(ctx context.Context, tokenID uint, macOSTeamID, iOSTeamID, iPadOSTeamID *uint) (*fleet.ABMToken, error) {
+	if err := svc.authz.Authorize(ctx, &fleet.AppleBM{}, fleet.ActionWrite); err != nil {
+		return nil, err
+	}
+
+	token, err := svc.ds.GetABMTokenByID(ctx, tokenID)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "get ABM token to update teams")
+	}
+
+	// validate the team IDs
+
+	token.MacOSTeam = fleet.ABMTokenTeam{Name: fleet.TeamNameNoTeam}
+	token.MacOSDefaultTeamID = nil
+	token.IOSTeam = fleet.ABMTokenTeam{Name: fleet.TeamNameNoTeam}
+	token.IOSDefaultTeamID = nil
+	token.IPadOSTeam = fleet.ABMTokenTeam{Name: fleet.TeamNameNoTeam}
+	token.IPadOSDefaultTeamID = nil
+
+	if macOSTeamID != nil && *macOSTeamID != 0 {
+		macOSTeam, err := svc.ds.Team(ctx, *macOSTeamID)
+		if err != nil {
+			return nil, &fleet.BadRequestError{
+				Message:     fmt.Sprintf("team with ID %d not found", *macOSTeamID),
+				InternalErr: ctxerr.Wrap(ctx, err, "checking existence of macOS team"),
+			}
+		}
+
+		token.MacOSTeam.Name = macOSTeam.Name
+		token.MacOSTeam.ID = *macOSTeamID
+		token.MacOSDefaultTeamID = macOSTeamID
+	}
+
+	if iOSTeamID != nil && *iOSTeamID != 0 {
+		iOSTeam, err := svc.ds.Team(ctx, *iOSTeamID)
+		if err != nil {
+			return nil, &fleet.BadRequestError{
+				Message:     fmt.Sprintf("team with ID %d not found", *iOSTeamID),
+				InternalErr: ctxerr.Wrap(ctx, err, "checking existence of iOS team"),
+			}
+		}
+		token.IOSTeam.Name = iOSTeam.Name
+		token.IOSTeam.ID = *iOSTeamID
+		token.IOSDefaultTeamID = iOSTeamID
+	}
+
+	if iPadOSTeamID != nil && *iPadOSTeamID != 0 {
+		iPadOSTeam, err := svc.ds.Team(ctx, *iPadOSTeamID)
+		if err != nil {
+			return nil, &fleet.BadRequestError{
+				Message:     fmt.Sprintf("team with ID %d not found", *iPadOSTeamID),
+				InternalErr: ctxerr.Wrap(ctx, err, "checking existence of iPadOS team"),
+			}
+		}
+		token.IPadOSTeam.Name = iPadOSTeam.Name
+		token.IPadOSTeam.ID = *iPadOSTeamID
+		token.IPadOSDefaultTeamID = iPadOSTeamID
+	}
+
+	if err := svc.ds.SaveABMToken(ctx, token); err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "updating token teams in db")
+	}
+
+	return token, nil
+}
+
+func (svc *Service) RenewABMToken(ctx context.Context, token io.Reader, tokenID uint) (*fleet.ABMToken, error) {
+	if err := svc.authz.Authorize(ctx, &fleet.AppleBM{}, fleet.ActionRead); err != nil {
+		return nil, err
+	}
+
+	oldTok, err := svc.ds.GetABMTokenByID(ctx, tokenID)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "get ABM token by id")
+	}
+
+	encryptedToken, decryptedToken, err := svc.decryptUploadedABMToken(ctx, token)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "decrypting ABM token for renewal")
+	}
+
+	if err := apple_mdm.SetDecryptedABMTokenMetadata(ctx, oldTok, decryptedToken, svc.depStorage, svc.ds, svc.logger); err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "setting ABM token metadata")
+	}
+
+	oldTok.EncryptedToken = encryptedToken
+
+	if err := svc.ds.SaveABMToken(ctx, oldTok); err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "renewing ABM token")
+	}
+
+	return oldTok, nil
+}
+
+func (svc *Service) decryptUploadedABMToken(ctx context.Context, token io.Reader) (encryptedToken []byte, decryptedToken *client.OAuth1Tokens, err error) {
+	if err := svc.authz.Authorize(ctx, &fleet.AppleBM{}, fleet.ActionRead); err != nil {
+		return nil, nil, err
+	}
+
+	pair, err := svc.ds.GetAllMDMConfigAssetsByName(ctx, []fleet.MDMAssetName{
+		fleet.MDMAssetABMCert,
+		fleet.MDMAssetABMKey,
+	})
+	if err != nil {
+		if fleet.IsNotFound(err) {
+			return nil, nil, ctxerr.Wrap(ctx, &fleet.BadRequestError{
+				Message: "Please generate a keypair first.",
+			}, "renewing ABM token")
+		}
+
+		return nil, nil, ctxerr.Wrap(ctx, err, "retrieving stored ABM assets")
+	}
+
+	encryptedToken, err = io.ReadAll(token)
+	if err != nil {
+		return nil, nil, ctxerr.Wrap(ctx, err, "reading token bytes")
+	}
+
+	derCert, _ := pem.Decode(pair[fleet.MDMAssetABMCert].Value)
+	if derCert == nil {
+		return nil, nil, ctxerr.New(ctx, "ABM certificate in the database cannot be parsed")
+	}
+
+	cert, err := x509.ParseCertificate(derCert.Bytes)
+	if err != nil {
+		return nil, nil, ctxerr.Wrap(ctx, err, "parsing ABM certificate")
+	}
+
+	decryptedToken, err = assets.DecryptRawABMToken(encryptedToken, cert, pair[fleet.MDMAssetABMKey].Value)
+	if err != nil {
+		return nil, nil, ctxerr.Wrap(ctx, &fleet.BadRequestError{
+			Message:     "Invalid token. Please provide a valid token from Apple Business Manager.",
+			InternalErr: err,
+		}, "validating ABM token")
+	}
+	return encryptedToken, decryptedToken, nil
+}
diff --git a/ee/server/service/mdm_external_test.go b/ee/server/service/mdm_external_test.go
index 06e244622e..760d046c9c 100644
--- a/ee/server/service/mdm_external_test.go
+++ b/ee/server/service/mdm_external_test.go
@@ -4,6 +4,9 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
+	"net/http"
+	"net/http/httptest"
+	"strings"
 	"testing"
 	"time"
 
@@ -18,7 +21,7 @@ import (
 	"github.com/fleetdm/fleet/v4/server/datastore/mysql"
 	"github.com/fleetdm/fleet/v4/server/fleet"
 	"github.com/fleetdm/fleet/v4/server/mdm/apple/mobileconfig"
-	nanodep_storage "github.com/fleetdm/fleet/v4/server/mdm/nanodep/storage"
+	nanodep_client "github.com/fleetdm/fleet/v4/server/mdm/nanodep/client"
 	"github.com/fleetdm/fleet/v4/server/mock"
 	nanodep_mock "github.com/fleetdm/fleet/v4/server/mock/nanodep"
 	"github.com/fleetdm/fleet/v4/server/ptr"
@@ -30,7 +33,7 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-func setupMockDatastorePremiumService() (*mock.Store, *eeservice.Service, context.Context) {
+func setupMockDatastorePremiumService(t testing.TB) (*mock.Store, *eeservice.Service, context.Context) {
 	ds := new(mock.Store)
 	lic := &fleet.LicenseInfo{Tier: fleet.TierPremium}
 	ctx := license.NewContext(context.Background(), lic)
@@ -42,7 +45,29 @@ func setupMockDatastorePremiumService() (*mock.Store, *eeservice.Service, contex
 			AppleSCEPKeyBytes:  eeservice.TestKey,
 		},
 	}
-	var depStorage nanodep_storage.AllDEPStorage = &nanodep_mock.Storage{}
+	depStorage := &nanodep_mock.Storage{}
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch {
+		case strings.Contains(r.URL.Path, "/server/devices"):
+			_, err := w.Write([]byte("{}"))
+			require.NoError(t, err)
+		case strings.Contains(r.URL.Path, "/session"):
+			_, err := w.Write([]byte(`{"auth_session_token": "yoo"}`))
+			require.NoError(t, err)
+		case strings.Contains(r.URL.Path, "/profile"):
+			_, err := w.Write([]byte(`{"profile_uuid": "profile123"}`))
+			require.NoError(t, err)
+		}
+	}))
+	depStorage.RetrieveConfigFunc = func(context.Context, string) (*nanodep_client.Config, error) {
+		return &nanodep_client.Config{
+			BaseURL: ts.URL,
+		}, nil
+	}
+	depStorage.RetrieveAuthTokensFunc = func(ctx context.Context, name string) (*nanodep_client.OAuth1Tokens, error) {
+		return &nanodep_client.OAuth1Tokens{}, nil
+	}
+	t.Cleanup(func() { ts.Close() })
 
 	freeSvc, err := service.NewService(
 		ctx,
@@ -83,6 +108,8 @@ func setupMockDatastorePremiumService() (*mock.Store, *eeservice.Service, contex
 		nil,
 		nil,
 		nil,
+		nil,
+		nil,
 	)
 	if err != nil {
 		panic(err)
@@ -91,7 +118,7 @@ func setupMockDatastorePremiumService() (*mock.Store, *eeservice.Service, contex
 }
 
 func TestGetOrCreatePreassignTeam(t *testing.T) {
-	ds, svc, ctx := setupMockDatastorePremiumService()
+	ds, svc, ctx := setupMockDatastorePremiumService(t)
 
 	ssoSettings := fleet.SSOProviderSettings{
 		EntityID:    "foo",
@@ -199,8 +226,9 @@ func TestGetOrCreatePreassignTeam(t *testing.T) {
 			declaration.DeclarationUUID = uuid.NewString()
 			return declaration, nil
 		}
-		ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hostIDs, teamIDs []uint, profileUUIDs, hostUUIDs []string) error {
-			return nil
+		ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hostIDs, teamIDs []uint, profileUUIDs, hostUUIDs []string,
+		) (updates fleet.MDMProfilesUpdates, err error) {
+			return fleet.MDMProfilesUpdates{}, nil
 		}
 		apnsCert, apnsKey, err := mysql.GenerateTestCertBytes()
 		require.NoError(t, err)
@@ -208,15 +236,28 @@ func TestGetOrCreatePreassignTeam(t *testing.T) {
 		require.NoError(t, err)
 		ds.GetAllMDMConfigAssetsByNameFunc = func(ctx context.Context, assetNames []fleet.MDMAssetName) (map[fleet.MDMAssetName]fleet.MDMConfigAsset, error) {
 			return map[fleet.MDMAssetName]fleet.MDMConfigAsset{
-				fleet.MDMAssetABMCert:  {Name: fleet.MDMAssetABMCert, Value: certPEM},
-				fleet.MDMAssetABMKey:   {Name: fleet.MDMAssetABMKey, Value: keyPEM},
-				fleet.MDMAssetABMToken: {Name: fleet.MDMAssetABMToken, Value: tokenBytes},
-				fleet.MDMAssetAPNSCert: {Name: fleet.MDMAssetAPNSCert, Value: apnsCert},
-				fleet.MDMAssetAPNSKey:  {Name: fleet.MDMAssetAPNSKey, Value: apnsKey},
-				fleet.MDMAssetCACert:   {Name: fleet.MDMAssetCACert, Value: certPEM},
-				fleet.MDMAssetCAKey:    {Name: fleet.MDMAssetCAKey, Value: keyPEM},
+				fleet.MDMAssetABMCert:            {Name: fleet.MDMAssetABMCert, Value: certPEM},
+				fleet.MDMAssetABMKey:             {Name: fleet.MDMAssetABMKey, Value: keyPEM},
+				fleet.MDMAssetABMTokenDeprecated: {Name: fleet.MDMAssetABMTokenDeprecated, Value: tokenBytes},
+				fleet.MDMAssetAPNSCert:           {Name: fleet.MDMAssetAPNSCert, Value: apnsCert},
+				fleet.MDMAssetAPNSKey:            {Name: fleet.MDMAssetAPNSKey, Value: apnsKey},
+				fleet.MDMAssetCACert:             {Name: fleet.MDMAssetCACert, Value: certPEM},
+				fleet.MDMAssetCAKey:              {Name: fleet.MDMAssetCAKey, Value: keyPEM},
 			}, nil
 		}
+
+		ds.GetMDMAppleEnrollmentProfileByTypeFunc = func(ctx context.Context, typ fleet.MDMAppleEnrollmentType) (*fleet.MDMAppleEnrollmentProfile, error) {
+			return &fleet.MDMAppleEnrollmentProfile{Token: "foobar"}, nil
+		}
+		ds.GetABMTokenOrgNamesAssociatedWithTeamFunc = func(ctx context.Context, teamID *uint) ([]string, error) {
+			return []string{"foobar"}, nil
+		}
+		ds.ListABMTokensFunc = func(ctx context.Context) ([]*fleet.ABMToken, error) {
+			return []*fleet.ABMToken{{ID: 1}}, nil
+		}
+		ds.CountABMTokensWithTermsExpiredFunc = func(ctx context.Context) (int, error) {
+			return 0, nil
+		}
 	}
 
 	authzCtx := &authz_ctx.AuthorizationContext{}
@@ -318,11 +359,10 @@ func TestGetOrCreatePreassignTeam(t *testing.T) {
 		}
 		setupAsstByTeam := make(map[uint]*fleet.MDMAppleSetupAssistant)
 		globalSetupAsst := &fleet.MDMAppleSetupAssistant{
-			ID:          15,
-			TeamID:      nil,
-			Name:        "test asst",
-			Profile:     json.RawMessage(`{"foo": "bar"}`),
-			ProfileUUID: "abc-def",
+			ID:      15,
+			TeamID:  nil,
+			Name:    "test asst",
+			Profile: json.RawMessage(`{"foo": "bar"}`),
 		}
 		setupAsstByTeam[0] = globalSetupAsst
 		ds.GetMDMAppleSetupAssistantFunc = func(ctx context.Context, teamID *uint) (*fleet.MDMAppleSetupAssistant, error) {
diff --git a/ee/server/service/service.go b/ee/server/service/service.go
index 34b35bd3bc..fb66f21136 100644
--- a/ee/server/service/service.go
+++ b/ee/server/service/service.go
@@ -17,18 +17,20 @@ import (
 type Service struct {
 	fleet.Service
 
-	ds                   fleet.Datastore
-	logger               kitlog.Logger
-	config               config.FleetConfig
-	clock                clock.Clock
-	authz                *authz.Authorizer
-	depStorage           storage.AllDEPStorage
-	mdmAppleCommander    fleet.MDMAppleCommandIssuer
-	ssoSessionStore      sso.SessionStore
-	depService           *apple_mdm.DEPService
-	profileMatcher       fleet.ProfileMatcher
-	softwareInstallStore fleet.SoftwareInstallerStore
-	distributedLock      fleet.Lock
+	ds                    fleet.Datastore
+	logger                kitlog.Logger
+	config                config.FleetConfig
+	clock                 clock.Clock
+	authz                 *authz.Authorizer
+	depStorage            storage.AllDEPStorage
+	mdmAppleCommander     fleet.MDMAppleCommandIssuer
+	ssoSessionStore       sso.SessionStore
+	depService            *apple_mdm.DEPService
+	profileMatcher        fleet.ProfileMatcher
+	softwareInstallStore  fleet.SoftwareInstallerStore
+	bootstrapPackageStore fleet.MDMBootstrapPackageStore
+	distributedLock       fleet.Lock
+	keyValueStore         fleet.KeyValueStore
 }
 
 func NewService(
@@ -43,7 +45,9 @@ func NewService(
 	sso sso.SessionStore,
 	profileMatcher fleet.ProfileMatcher,
 	softwareInstallStore fleet.SoftwareInstallerStore,
+	bootstrapPackageStore fleet.MDMBootstrapPackageStore,
 	distributedLock fleet.Lock,
+	keyValueStore fleet.KeyValueStore,
 ) (*Service, error) {
 	authorizer, err := authz.NewAuthorizer()
 	if err != nil {
@@ -51,19 +55,21 @@ func NewService(
 	}
 
 	eeservice := &Service{
-		Service:              svc,
-		ds:                   ds,
-		logger:               logger,
-		config:               config,
-		clock:                c,
-		authz:                authorizer,
-		depStorage:           depStorage,
-		mdmAppleCommander:    mdmAppleCommander,
-		ssoSessionStore:      sso,
-		depService:           apple_mdm.NewDEPService(ds, depStorage, logger),
-		profileMatcher:       profileMatcher,
-		softwareInstallStore: softwareInstallStore,
-		distributedLock:      distributedLock,
+		Service:               svc,
+		ds:                    ds,
+		logger:                logger,
+		config:                config,
+		clock:                 c,
+		authz:                 authorizer,
+		depStorage:            depStorage,
+		mdmAppleCommander:     mdmAppleCommander,
+		ssoSessionStore:       sso,
+		depService:            apple_mdm.NewDEPService(ds, depStorage, logger),
+		profileMatcher:        profileMatcher,
+		softwareInstallStore:  softwareInstallStore,
+		bootstrapPackageStore: bootstrapPackageStore,
+		distributedLock:       distributedLock,
+		keyValueStore:         keyValueStore,
 	}
 
 	// Override methods that can't be easily overriden via
diff --git a/ee/server/service/software_installers.go b/ee/server/service/software_installers.go
index 8754879992..ac4461a592 100644
--- a/ee/server/service/software_installers.go
+++ b/ee/server/service/software_installers.go
@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"context"
 	"encoding/hex"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
@@ -11,6 +12,9 @@ import (
 	"net/http"
 	"net/url"
 	"path/filepath"
+	"regexp"
+	"strings"
+	"time"
 
 	"github.com/fleetdm/fleet/v4/pkg/file"
 	"github.com/fleetdm/fleet/v4/pkg/fleethttp"
@@ -20,11 +24,16 @@ import (
 	"github.com/fleetdm/fleet/v4/server/contexts/viewer"
 	"github.com/fleetdm/fleet/v4/server/fleet"
 	"github.com/fleetdm/fleet/v4/server/mdm/apple/vpp"
+	"github.com/fleetdm/fleet/v4/server/ptr"
+	"github.com/go-kit/log"
+	kitlog "github.com/go-kit/log"
 	"github.com/go-kit/log/level"
 	"github.com/google/uuid"
 	"golang.org/x/sync/errgroup"
 )
 
+const softwareInstallerTokenMaxLength = 36 // UUID length
+
 func (svc *Service) UploadSoftwareInstaller(ctx context.Context, payload *fleet.UploadSoftwareInstallerPayload) error {
 	if err := svc.authz.Authorize(ctx, &fleet.SoftwareInstaller{TeamID: payload.TeamID}, fleet.ActionWrite); err != nil {
 		return err
@@ -34,12 +43,14 @@ func (svc *Service) UploadSoftwareInstaller(ctx context.Context, payload *fleet.
 	if !ok {
 		return fleet.ErrNoContext
 	}
+	payload.UserID = vc.UserID()
 
 	// make sure all scripts use unix-style newlines to prevent errors when
 	// running them, browsers use windows-style newlines, which breaks the
 	// shebang when the file is directly executed.
 	payload.InstallScript = file.Dos2UnixNewlines(payload.InstallScript)
 	payload.PostInstallScript = file.Dos2UnixNewlines(payload.PostInstallScript)
+	payload.UninstallScript = file.Dos2UnixNewlines(payload.UninstallScript)
 
 	if _, err := svc.addMetadataToSoftwarePayload(ctx, payload); err != nil {
 		return ctxerr.Wrap(ctx, err, "adding metadata to payload")
@@ -52,6 +63,9 @@ func (svc *Service) UploadSoftwareInstaller(ctx context.Context, payload *fleet.
 	// TODO: basic validation of install and post-install script (e.g., supported interpreters)?
 	// TODO: any validation of pre-install query?
 
+	// Update $PACKAGE_ID in uninstall script
+	preProcessUninstallScript(payload)
+
 	installerID, err := svc.ds.MatchOrCreateSoftwareInstaller(ctx, payload)
 	if err != nil {
 		return ctxerr.Wrap(ctx, err, "matching or creating software installer")
@@ -83,6 +97,251 @@ func (svc *Service) UploadSoftwareInstaller(ctx context.Context, payload *fleet.
 	return nil
 }
 
+var packageIDRegex = regexp.MustCompile(`((("\$PACKAGE_ID")|(\$PACKAGE_ID))(?P<suffix>\W|$))|(("\${PACKAGE_ID}")|(\${PACKAGE_ID}))`)
+
+func preProcessUninstallScript(payload *fleet.UploadSoftwareInstallerPayload) {
+	// We assume that we already validated that payload.PackageIDs is not empty.
+	// Replace $PACKAGE_ID in the uninstall script with the package ID(s).
+	var packageID string
+	switch payload.Extension {
+	case "pkg":
+		var sb strings.Builder
+		_, _ = sb.WriteString("(\n")
+		for _, pkgID := range payload.PackageIDs {
+			_, _ = sb.WriteString(fmt.Sprintf("  \"%s\"\n", pkgID))
+		}
+		_, _ = sb.WriteString(")") // no ending newline
+		packageID = sb.String()
+	default:
+		packageID = fmt.Sprintf("\"%s\"", payload.PackageIDs[0])
+	}
+
+	payload.UninstallScript = packageIDRegex.ReplaceAllString(payload.UninstallScript, fmt.Sprintf("%s${suffix}", packageID))
+}
+
+func (svc *Service) UpdateSoftwareInstaller(ctx context.Context, payload *fleet.UpdateSoftwareInstallerPayload) (*fleet.SoftwareInstaller, error) {
+	if err := svc.authz.Authorize(ctx, &fleet.SoftwareInstaller{TeamID: payload.TeamID}, fleet.ActionWrite); err != nil {
+		return nil, err
+	}
+
+	vc, ok := viewer.FromContext(ctx)
+	if !ok {
+		return nil, fleet.ErrNoContext
+	}
+	payload.UserID = vc.UserID()
+
+	if payload.TeamID == nil {
+		return nil, &fleet.BadRequestError{Message: "team_id is required; enter 0 for no team"}
+	}
+
+	var teamName *string
+	if *payload.TeamID != 0 {
+		t, err := svc.ds.Team(ctx, *payload.TeamID)
+		if err != nil {
+			return nil, err
+		}
+		teamName = &t.Name
+	}
+
+	// get software by ID, fail if it does not exist or does not have an existing installer
+	software, err := svc.ds.SoftwareTitleByID(ctx, payload.TitleID, payload.TeamID, fleet.TeamFilter{
+		User:            vc.User,
+		IncludeObserver: true,
+	})
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "getting software title by id")
+	}
+
+	// TODO when we start supporting multiple installers per title X team, need to rework how we determine installer to edit
+	if software.SoftwareInstallersCount != 1 {
+		return nil, &fleet.BadRequestError{
+			Message: "There are no software installers defined yet for this title and team. Please add an installer instead of attempting to edit.",
+		}
+	}
+
+	existingInstaller, err := svc.ds.GetSoftwareInstallerMetadataByTeamAndTitleID(ctx, payload.TeamID, payload.TitleID, true)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "getting existing installer")
+	}
+
+	if payload.SelfService == nil && payload.InstallerFile == nil && payload.PreInstallQuery == nil &&
+		payload.InstallScript == nil && payload.PostInstallScript == nil && payload.UninstallScript == nil {
+		return existingInstaller, nil // no payload, noop
+	}
+
+	payload.InstallerID = existingInstaller.InstallerID
+	dirty := make(map[string]bool)
+
+	if payload.SelfService != nil && *payload.SelfService != existingInstaller.SelfService {
+		dirty["SelfService"] = true
+	}
+
+	activity := fleet.ActivityTypeEditedSoftware{
+		SoftwareTitle:   existingInstaller.SoftwareTitle,
+		TeamName:        teamName,
+		TeamID:          payload.TeamID,
+		SelfService:     existingInstaller.SelfService,
+		SoftwarePackage: &existingInstaller.Name,
+	}
+
+	var payloadForNewInstallerFile *fleet.UploadSoftwareInstallerPayload
+	if payload.InstallerFile != nil {
+		payloadForNewInstallerFile = &fleet.UploadSoftwareInstallerPayload{
+			InstallerFile: payload.InstallerFile,
+			Filename:      payload.Filename,
+		}
+
+		newInstallerExtension, err := svc.addMetadataToSoftwarePayload(ctx, payloadForNewInstallerFile)
+		if err != nil {
+			return nil, ctxerr.Wrap(ctx, err, "extracting updated installer metadata")
+		}
+
+		if newInstallerExtension != existingInstaller.Extension {
+			return nil, &fleet.BadRequestError{
+				Message:     "The selected package is for a different file type.",
+				InternalErr: ctxerr.Wrap(ctx, err, "installer extension mismatch"),
+			}
+		}
+
+		if payloadForNewInstallerFile.Title != software.Name {
+			return nil, &fleet.BadRequestError{
+				Message:     "The selected package is for different software.",
+				InternalErr: ctxerr.Wrap(ctx, err, "installer software title mismatch"),
+			}
+		}
+
+		if payloadForNewInstallerFile.StorageID != existingInstaller.StorageID {
+			activity.SoftwarePackage = &payload.Filename
+			payload.StorageID = payloadForNewInstallerFile.StorageID
+			payload.Filename = payloadForNewInstallerFile.Filename
+			payload.Version = payloadForNewInstallerFile.Version
+			payload.PackageIDs = payloadForNewInstallerFile.PackageIDs
+
+			dirty["Package"] = true
+		} else { // noop if uploaded installer is identical to previous installer
+			payloadForNewInstallerFile = nil
+			payload.InstallerFile = nil
+		}
+	}
+
+	if payload.InstallerFile == nil { // fill in existing existingInstaller data to payload
+		payload.StorageID = existingInstaller.StorageID
+		payload.Filename = existingInstaller.Name
+		payload.Version = existingInstaller.Version
+		payload.PackageIDs = existingInstaller.PackageIDs()
+	}
+
+	// default pre-install query is blank, so blanking out the query doesn't have a semantic meaning we have to take care of
+	if payload.PreInstallQuery != nil && *payload.PreInstallQuery != existingInstaller.PreInstallQuery {
+		dirty["PreInstallQuery"] = true
+	}
+
+	if payload.InstallScript != nil {
+		installScript := file.Dos2UnixNewlines(*payload.InstallScript)
+		if installScript == "" {
+			installScript = file.GetInstallScript(existingInstaller.Extension)
+		}
+
+		if installScript != existingInstaller.InstallScript {
+			dirty["InstallScript"] = true
+		}
+		payload.InstallScript = &installScript
+	}
+
+	if payload.PostInstallScript != nil {
+		postInstallScript := file.Dos2UnixNewlines(*payload.PostInstallScript)
+		if postInstallScript != existingInstaller.PostInstallScript {
+			dirty["PostInstallScript"] = true
+		}
+		payload.PostInstallScript = &postInstallScript
+	}
+
+	if payload.UninstallScript != nil {
+		uninstallScript := file.Dos2UnixNewlines(*payload.UninstallScript)
+		if uninstallScript == "" { // extension can't change on an edit so we can generate off of the existing file
+			uninstallScript = file.GetUninstallScript(existingInstaller.Extension)
+		}
+
+		payloadForUninstallScript := &fleet.UploadSoftwareInstallerPayload{
+			Extension:       existingInstaller.Extension,
+			UninstallScript: uninstallScript,
+			PackageIDs:      existingInstaller.PackageIDs(),
+		}
+		if payloadForNewInstallerFile != nil {
+			payloadForUninstallScript.PackageIDs = payloadForNewInstallerFile.PackageIDs
+		}
+
+		preProcessUninstallScript(payloadForUninstallScript)
+		if payloadForUninstallScript.UninstallScript != existingInstaller.UninstallScript {
+			dirty["UninstallScript"] = true
+		}
+		uninstallScript = payloadForUninstallScript.UninstallScript
+		payload.UninstallScript = &uninstallScript
+	}
+
+	// persist changes starting here, now that we've done all the validation/diffing we can
+	if len(dirty) > 0 {
+		if len(dirty) == 1 && dirty["SelfService"] == true { // only self-service changed; use lighter update function
+			if err := svc.ds.UpdateInstallerSelfServiceFlag(ctx, *payload.SelfService, existingInstaller.InstallerID); err != nil {
+				return nil, ctxerr.Wrap(ctx, err, "updating installer self service flag")
+			}
+		} else {
+			if payloadForNewInstallerFile != nil {
+				if err := svc.storeSoftware(ctx, payloadForNewInstallerFile); err != nil {
+					return nil, ctxerr.Wrap(ctx, err, "storing software installer")
+				}
+			}
+
+			// fill in values from existing installer if they weren't supplied
+			if payload.InstallScript == nil {
+				payload.InstallScript = &existingInstaller.InstallScript
+			}
+			if payload.UninstallScript == nil {
+				payload.UninstallScript = &existingInstaller.UninstallScript
+			}
+			if payload.PostInstallScript == nil && dirty["PostInstallScript"] == false {
+				payload.PostInstallScript = &existingInstaller.PostInstallScript
+			}
+			if payload.PreInstallQuery == nil {
+				payload.PreInstallQuery = &existingInstaller.PreInstallQuery
+			}
+			if payload.SelfService == nil {
+				payload.SelfService = &existingInstaller.SelfService
+			}
+
+			if err := svc.ds.SaveInstallerUpdates(ctx, payload); err != nil {
+				return nil, ctxerr.Wrap(ctx, err, "saving installer updates")
+			}
+
+			// if we're updating anything other than self-service, we cancel pending installs/uninstalls,
+			// and if we're updating the package we reset counts. This is run in its own transaction internally
+			// for consistency, but independent of the installer update query as the main update should stick
+			// even if side effects fail.
+			if err := svc.ds.ProcessInstallerUpdateSideEffects(ctx, existingInstaller.InstallerID, true, dirty["Package"] == true); err != nil {
+				return nil, err
+			}
+		}
+
+		if err := svc.NewActivity(ctx, vc.User, activity); err != nil {
+			return nil, ctxerr.Wrap(ctx, err, "creating activity for edited software")
+		}
+	}
+
+	// re-pull installer from database to ensure any side effects are accounted for; may be able to optimize this out later
+	updatedInstaller, err := svc.ds.GetSoftwareInstallerMetadataByTeamAndTitleID(ctx, payload.TeamID, payload.TitleID, true)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "re-hydrating updated installer metadata")
+	}
+
+	statuses, err := svc.ds.GetSummaryHostSoftwareInstalls(ctx, updatedInstaller.InstallerID)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "getting updated installer statuses")
+	}
+	updatedInstaller.Status = statuses
+
+	return updatedInstaller, nil
+}
+
 func (svc *Service) DeleteSoftwareInstaller(ctx context.Context, titleID uint, teamID *uint) error {
 	if teamID == nil {
 		return fleet.NewInvalidArgumentError("team_id", "is required")
@@ -121,7 +380,7 @@ func (svc *Service) deleteVPPApp(ctx context.Context, teamID *uint, meta *fleet.
 	}
 
 	var teamName *string
-	if teamID != nil {
+	if teamID != nil && *teamID != 0 {
 		t, err := svc.ds.Team(ctx, *teamID)
 		if err != nil {
 			return ctxerr.Wrap(ctx, err, "getting team name for deleted VPP app")
@@ -161,11 +420,19 @@ func (svc *Service) deleteSoftwareInstaller(ctx context.Context, meta *fleet.Sof
 		teamName = &t.Name
 	}
 
+	var teamID *uint
+	switch {
+	case meta.TeamID == nil:
+		teamID = ptr.Uint(0)
+	case meta.TeamID != nil:
+		teamID = meta.TeamID
+	}
+
 	if err := svc.NewActivity(ctx, vc.User, fleet.ActivityTypeDeletedSoftware{
 		SoftwareTitle:   meta.SoftwareTitle,
 		SoftwarePackage: meta.Name,
 		TeamName:        teamName,
-		TeamID:          meta.TeamID,
+		TeamID:          teamID,
 		SelfService:     meta.SelfService,
 	}); err != nil {
 		return ctxerr.Wrap(ctx, err, "creating activity for deleted software")
@@ -174,9 +441,13 @@ func (svc *Service) deleteSoftwareInstaller(ctx context.Context, meta *fleet.Sof
 	return nil
 }
 
-func (svc *Service) GetSoftwareInstallerMetadata(ctx context.Context, titleID uint, teamID *uint) (*fleet.SoftwareInstaller, error) {
-	if err := svc.authz.Authorize(ctx, &fleet.SoftwareInstaller{TeamID: teamID}, fleet.ActionRead); err != nil {
-		return nil, err
+func (svc *Service) GetSoftwareInstallerMetadata(ctx context.Context, skipAuthz bool, titleID uint, teamID *uint) (*fleet.SoftwareInstaller,
+	error,
+) {
+	if !skipAuthz {
+		if err := svc.authz.Authorize(ctx, &fleet.SoftwareInstaller{TeamID: teamID}, fleet.ActionRead); err != nil {
+			return nil, err
+		}
 	}
 
 	meta, err := svc.ds.GetSoftwareInstallerMetadataByTeamAndTitleID(ctx, teamID, titleID, true)
@@ -187,12 +458,93 @@ func (svc *Service) GetSoftwareInstallerMetadata(ctx context.Context, titleID ui
 	return meta, nil
 }
 
-func (svc *Service) DownloadSoftwareInstaller(ctx context.Context, titleID uint, teamID *uint) (*fleet.DownloadSoftwareInstallerPayload, error) {
+func (svc *Service) GenerateSoftwareInstallerToken(ctx context.Context, alt string, titleID uint, teamID *uint) (string, error) {
+	downloadRequested := alt == "media"
+	if !downloadRequested {
+		svc.authz.SkipAuthorization(ctx)
+		return "", fleet.NewInvalidArgumentError("alt", "only alt=media is supported")
+	}
+
 	if teamID == nil {
+		svc.authz.SkipAuthorization(ctx)
+		return "", fleet.NewInvalidArgumentError("team_id", "is required")
+	}
+
+	if err := svc.authz.Authorize(ctx, &fleet.SoftwareInstaller{TeamID: teamID}, fleet.ActionRead); err != nil {
+		return "", err
+	}
+
+	meta := fleet.SoftwareInstallerTokenMetadata{
+		TitleID: titleID,
+		TeamID:  *teamID,
+	}
+	metaByte, err := json.Marshal(meta)
+	if err != nil {
+		return "", ctxerr.Wrap(ctx, err, "marshaling software installer metadata")
+	}
+
+	// Generate token and store in Redis
+	token := uuid.NewString()
+	const tokenExpirationMs = 10 * 60 * 1000 // 10 minutes
+	ok, err := svc.distributedLock.SetIfNotExist(ctx, fmt.Sprintf("software_installer_token:%s", token), string(metaByte),
+		tokenExpirationMs)
+	if err != nil {
+		return "", ctxerr.Wrap(ctx, err, "saving software installer token")
+	}
+	if !ok {
+		// Should not happen since token is unique
+		return "", ctxerr.Errorf(ctx, "failed to save software installer token")
+	}
+
+	return token, nil
+}
+
+func (svc *Service) GetSoftwareInstallerTokenMetadata(ctx context.Context, token string,
+	titleID uint,
+) (*fleet.SoftwareInstallerTokenMetadata, error) {
+	// We will manually authorize this endpoint based on the token.
+	svc.authz.SkipAuthorization(ctx)
+
+	if len(token) > softwareInstallerTokenMaxLength {
+		return nil, fleet.NewPermissionError("invalid token")
+	}
+
+	metaStr, err := svc.distributedLock.GetAndDelete(ctx, fmt.Sprintf("software_installer_token:%s", token))
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "getting software installer token metadata")
+	}
+	if metaStr == nil {
+		return nil, ctxerr.Wrap(ctx, fleet.NewPermissionError("invalid token"))
+	}
+
+	var meta fleet.SoftwareInstallerTokenMetadata
+	if err := json.Unmarshal([]byte(*metaStr), &meta); err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "unmarshaling software installer token metadata")
+	}
+
+	if titleID != meta.TitleID {
+		return nil, ctxerr.Wrap(ctx, fleet.NewPermissionError("invalid token"))
+	}
+
+	// The token is valid.
+	return &meta, nil
+}
+
+func (svc *Service) DownloadSoftwareInstaller(ctx context.Context, skipAuthz bool, alt string, titleID uint,
+	teamID *uint,
+) (*fleet.DownloadSoftwareInstallerPayload, error) {
+	downloadRequested := alt == "media"
+	if !downloadRequested {
+		svc.authz.SkipAuthorization(ctx)
+		return nil, fleet.NewInvalidArgumentError("alt", "only alt=media is supported")
+	}
+
+	if teamID == nil {
+		svc.authz.SkipAuthorization(ctx)
 		return nil, fleet.NewInvalidArgumentError("team_id", "is required")
 	}
 
-	meta, err := svc.GetSoftwareInstallerMetadata(ctx, titleID, teamID)
+	meta, err := svc.GetSoftwareInstallerMetadata(ctx, skipAuthz, titleID, teamID)
 	if err != nil {
 		return nil, err
 	}
@@ -204,11 +556,20 @@ func (svc *Service) OrbitDownloadSoftwareInstaller(ctx context.Context, installe
 	// this is not a user-authenticated endpoint
 	svc.authz.SkipAuthorization(ctx)
 
-	_, ok := hostctx.FromContext(ctx)
+	host, ok := hostctx.FromContext(ctx)
 	if !ok {
 		return nil, fleet.OrbitError{Message: "internal error: missing host from request context"}
 	}
 
+	access, err := svc.ds.ValidateOrbitSoftwareInstallerAccess(ctx, host.ID, installerID)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "check software installer access")
+	}
+
+	if !access {
+		return nil, fleet.NewUserMessageError(errors.New("Host doesn't have access to this installer"), http.StatusForbidden)
+	}
+
 	// get the installer's metadata
 	meta, err := svc.ds.GetSoftwareInstallerMetadataByID(ctx, installerID)
 	if err != nil {
@@ -288,11 +649,30 @@ func (svc *Service) InstallSoftwareTitle(ctx context.Context, hostID uint, softw
 
 		// if we found an installer, use that
 		if installer != nil {
+			lastInstallRequest, err := svc.ds.GetHostLastInstallData(ctx, host.ID, installer.InstallerID)
+			if err != nil {
+				return ctxerr.Wrapf(ctx, err, "getting last install data for host %d and installer %d", host.ID, installer.InstallerID)
+			}
+			if lastInstallRequest != nil && lastInstallRequest.Status != nil &&
+				(*lastInstallRequest.Status == fleet.SoftwareInstallPending || *lastInstallRequest.Status == fleet.SoftwareUninstallPending) {
+				return &fleet.BadRequestError{
+					Message: "Couldn't install software. Host has a pending install/uninstall request.",
+					InternalErr: ctxerr.WrapWithData(
+						ctx, err, "host already has a pending install/uninstall for this installer",
+						map[string]any{
+							"host_id":               host.ID,
+							"software_installer_id": installer.InstallerID,
+							"team_id":               host.TeamID,
+							"title_id":              softwareTitleID,
+						},
+					),
+				}
+			}
 			return svc.installSoftwareTitleUsingInstaller(ctx, host, installer)
 		}
 	}
 
-	vppApp, err := svc.ds.GetVPPAppByTeamAndTitleID(ctx, host.TeamID, softwareTitleID, false)
+	vppApp, err := svc.ds.GetVPPAppByTeamAndTitleID(ctx, host.TeamID, softwareTitleID)
 	if err != nil {
 		// if we couldn't find an installer or a VPP app, return a bad
 		// request error
@@ -309,10 +689,10 @@ func (svc *Service) InstallSoftwareTitle(ctx context.Context, hostID uint, softw
 		return ctxerr.Wrap(ctx, err, "finding VPP app for title")
 	}
 
-	return svc.installSoftwareFromVPP(ctx, host, vppApp, mobileAppleDevice || fleet.AppleDevicePlatform(platform) == fleet.MacOSPlatform)
+	return svc.installSoftwareFromVPP(ctx, host, vppApp, mobileAppleDevice || fleet.AppleDevicePlatform(platform) == fleet.MacOSPlatform, false)
 }
 
-func (svc *Service) installSoftwareFromVPP(ctx context.Context, host *fleet.Host, vppApp *fleet.VPPApp, appleDevice bool) error {
+func (svc *Service) installSoftwareFromVPP(ctx context.Context, host *fleet.Host, vppApp *fleet.VPPApp, appleDevice bool, selfService bool) error {
 	if !appleDevice {
 		return &fleet.BadRequestError{
 			Message: "VPP apps can only be installed only on Apple hosts.",
@@ -347,7 +727,7 @@ func (svc *Service) installSoftwareFromVPP(ctx context.Context, host *fleet.Host
 		}
 	}
 
-	token, err := svc.getVPPToken(ctx)
+	token, err := svc.getVPPToken(ctx, host.TeamID)
 	if err != nil {
 		return ctxerr.Wrap(ctx, err, "getting VPP token")
 	}
@@ -416,8 +796,6 @@ func (svc *Service) installSoftwareFromVPP(ctx context.Context, host *fleet.Host
 
 	}
 
-	user := authz.UserFromContext(ctx)
-
 	// add command to install
 	cmdUUID := uuid.NewString()
 	err = svc.mdmAppleCommander.InstallApplication(ctx, []string{host.UUID}, cmdUUID, vppApp.AdamID)
@@ -425,7 +803,7 @@ func (svc *Service) installSoftwareFromVPP(ctx context.Context, host *fleet.Host
 		return ctxerr.Wrapf(ctx, err, "sending command to install VPP %s application to host with serial %s", vppApp.AdamID, host.HardwareSerial)
 	}
 
-	err = svc.ds.InsertHostVPPSoftwareInstall(ctx, host.ID, user.ID, vppApp.VPPAppID, cmdUUID, eventID)
+	err = svc.ds.InsertHostVPPSoftwareInstall(ctx, host.ID, vppApp.VPPAppID, cmdUUID, eventID, selfService)
 	if err != nil {
 		return ctxerr.Wrapf(ctx, err, "inserting host vpp software install for host with serial %s and app with adamID %s", host.HardwareSerial, vppApp.AdamID)
 	}
@@ -455,6 +833,153 @@ func (svc *Service) installSoftwareTitleUsingInstaller(ctx context.Context, host
 	return ctxerr.Wrap(ctx, err, "inserting software install request")
 }
 
+func (svc *Service) UninstallSoftwareTitle(ctx context.Context, hostID uint, softwareTitleID uint) error {
+	// First check if scripts are disabled globally. If so, no need for further processing.
+	cfg, err := svc.ds.AppConfig(ctx)
+	if err != nil {
+		svc.authz.SkipAuthorization(ctx)
+		return err
+	}
+
+	if cfg.ServerSettings.ScriptsDisabled {
+		svc.authz.SkipAuthorization(ctx)
+		return fleet.NewUserMessageError(errors.New(fleet.RunScriptScriptsDisabledGloballyErrMsg), http.StatusForbidden)
+	}
+
+	// we need to use ds.Host because ds.HostLite doesn't return the orbit node key
+	host, err := svc.ds.Host(ctx, hostID)
+	if err != nil {
+		// if error is because the host does not exist, check first if the user
+		// had access to install/uninstall software (to prevent leaking valid host ids).
+		if fleet.IsNotFound(err) {
+			if err := svc.authz.Authorize(ctx, &fleet.HostSoftwareInstallerResultAuthz{}, fleet.ActionWrite); err != nil {
+				return err
+			}
+		}
+		svc.authz.SkipAuthorization(ctx)
+		return ctxerr.Wrap(ctx, err, "get host")
+	}
+
+	if host.OrbitNodeKey == nil || *host.OrbitNodeKey == "" {
+		// fleetd is required to install software so if the host is enrolled via plain osquery we return an error
+		svc.authz.SkipAuthorization(ctx)
+		return fleet.NewUserMessageError(errors.New("host does not have fleetd installed"), http.StatusUnprocessableEntity)
+	}
+
+	// If scripts are disabled (according to the last detail query), we return an error.
+	// host.ScriptsEnabled may be nil for older orbit versions.
+	if host.ScriptsEnabled != nil && !*host.ScriptsEnabled {
+		svc.authz.SkipAuthorization(ctx)
+		return fleet.NewUserMessageError(errors.New(fleet.RunScriptsOrbitDisabledErrMsg), http.StatusUnprocessableEntity)
+	}
+
+	// authorize with the host's team
+	if err := svc.authz.Authorize(ctx, &fleet.HostSoftwareInstallerResultAuthz{HostTeamID: host.TeamID}, fleet.ActionWrite); err != nil {
+		return err
+	}
+
+	installer, err := svc.ds.GetSoftwareInstallerMetadataByTeamAndTitleID(ctx, host.TeamID, softwareTitleID, false)
+	if err != nil {
+		if fleet.IsNotFound(err) {
+			return &fleet.BadRequestError{
+				Message: "Couldn't uninstall software. Software title is not available for uninstall. Please add software package to install/uninstall.",
+				InternalErr: ctxerr.WrapWithData(
+					ctx, err, "couldn't find an installer for software title",
+					map[string]any{"host_id": host.ID, "team_id": host.TeamID, "title_id": softwareTitleID},
+				),
+			}
+		}
+		return ctxerr.Wrap(ctx, err, "finding software installer for title")
+	}
+
+	lastInstallRequest, err := svc.ds.GetHostLastInstallData(ctx, host.ID, installer.InstallerID)
+	if err != nil {
+		return ctxerr.Wrapf(ctx, err, "getting last install data for host %d and installer %d", host.ID, installer.InstallerID)
+	}
+	if lastInstallRequest != nil && lastInstallRequest.Status != nil &&
+		(*lastInstallRequest.Status == fleet.SoftwareInstallPending || *lastInstallRequest.Status == fleet.SoftwareUninstallPending) {
+		return &fleet.BadRequestError{
+			Message: "Couldn't uninstall software. Host has a pending install/uninstall request.",
+			InternalErr: ctxerr.WrapWithData(
+				ctx, err, "host already has a pending install/uninstall for this installer",
+				map[string]any{
+					"host_id":               host.ID,
+					"software_installer_id": installer.InstallerID,
+					"team_id":               host.TeamID,
+					"title_id":              softwareTitleID,
+					"status":                *lastInstallRequest.Status,
+				},
+			),
+		}
+	}
+
+	// Validate platform
+	ext := filepath.Ext(installer.Name)
+	requiredPlatform := packageExtensionToPlatform(ext)
+	if requiredPlatform == "" {
+		// this should never happen
+		return ctxerr.Errorf(ctx, "software installer has unsupported type %s", ext)
+	}
+
+	if host.FleetPlatform() != requiredPlatform {
+		return &fleet.BadRequestError{
+			Message: fmt.Sprintf("Package (%s) can be uninstalled only on %s hosts.", ext, requiredPlatform),
+			InternalErr: ctxerr.NewWithData(
+				ctx, "invalid host platform for requested uninstall",
+				map[string]any{"host_id": host.ID, "team_id": host.TeamID, "title_id": installer.TitleID},
+			),
+		}
+	}
+
+	// Get the uninstall script and use the standard script infrastructure to run it.
+	contents, err := svc.ds.GetAnyScriptContents(ctx, installer.UninstallScriptContentID)
+	if err != nil {
+		if fleet.IsNotFound(err) {
+			return ctxerr.Wrap(ctx,
+				fleet.NewInvalidArgumentError("software_title_id", `No uninstall script exists for the provided "software_title_id".`).
+					WithStatus(http.StatusNotFound), "getting uninstall script contents")
+		}
+		return err
+	}
+
+	var teamID uint
+	if host.TeamID != nil {
+		teamID = *host.TeamID
+	}
+	// create the script execution request, the host will be notified of the
+	// script execution request via the orbit config's Notifications mechanism.
+	request := fleet.HostScriptRequestPayload{
+		HostID:          host.ID,
+		ScriptContents:  string(contents),
+		ScriptContentID: installer.UninstallScriptContentID,
+		TeamID:          teamID,
+	}
+	if ctxUser := authz.UserFromContext(ctx); ctxUser != nil {
+		request.UserID = &ctxUser.ID
+	}
+	scriptResult, err := svc.ds.NewHostScriptExecutionRequest(ctx, &request)
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "create script execution request")
+	}
+
+	// Update the host software installs table with the uninstall request.
+	// Pending uninstalls will automatically show up in the UI Host Details -> Activity -> Upcoming tab.
+	if err = svc.insertSoftwareUninstallRequest(ctx, scriptResult.ExecutionID, host, installer); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (svc *Service) insertSoftwareUninstallRequest(ctx context.Context, executionID string, host *fleet.Host,
+	installer *fleet.SoftwareInstaller,
+) error {
+	if err := svc.ds.InsertSoftwareUninstallRequest(ctx, executionID, host.ID, installer.InstallerID); err != nil {
+		return ctxerr.Wrap(ctx, err, "inserting software uninstall request")
+	}
+	return nil
+}
+
 func (svc *Service) GetSoftwareInstallResults(ctx context.Context, resultUUID string) (*fleet.HostSoftwareInstallerResult, error) {
 	// Basic auth check
 	if err := svc.authz.Authorize(ctx, &fleet.Host{}, fleet.ActionList); err != nil {
@@ -535,6 +1060,21 @@ func (svc *Service) addMetadataToSoftwarePayload(ctx context.Context, payload *f
 		}
 		return "", ctxerr.Wrap(ctx, err, "extracting metadata from installer")
 	}
+
+	if meta.Version == "" {
+		return "", &fleet.BadRequestError{
+			Message:     fmt.Sprintf("Couldn't add. Fleet couldn't read the version from %s.", payload.Filename),
+			InternalErr: ctxerr.New(ctx, "extracting version from installer metadata"),
+		}
+	}
+
+	if len(meta.PackageIDs) == 0 {
+		return "", &fleet.BadRequestError{
+			Message:     fmt.Sprintf("Couldn't add. Fleet couldn't read the package IDs, product code, or name from %s.", payload.Filename),
+			InternalErr: ctxerr.New(ctx, "extracting package IDs from installer metadata"),
+		}
+	}
+
 	payload.Title = meta.Name
 	if payload.Title == "" {
 		// use the filename if no title from metadata
@@ -543,6 +1083,8 @@ func (svc *Service) addMetadataToSoftwarePayload(ctx context.Context, payload *f
 	payload.Version = meta.Version
 	payload.StorageID = hex.EncodeToString(meta.SHASum)
 	payload.BundleIdentifier = meta.BundleIdentifier
+	payload.PackageIDs = meta.PackageIDs
+	payload.Extension = meta.Extension
 
 	// reset the reader (it was consumed to extract metadata)
 	if _, err := payload.InstallerFile.Seek(0, 0); err != nil {
@@ -553,6 +1095,10 @@ func (svc *Service) addMetadataToSoftwarePayload(ctx context.Context, payload *f
 		payload.InstallScript = file.GetInstallScript(meta.Extension)
 	}
 
+	if payload.UninstallScript == "" {
+		payload.UninstallScript = file.GetUninstallScript(meta.Extension)
+	}
+
 	source, err := fleet.SofwareInstallerSourceFromExtensionAndName(meta.Extension, meta.Name)
 	if err != nil {
 		return "", ctxerr.Wrap(ctx, err, "determining source from extension and name")
@@ -568,112 +1114,205 @@ func (svc *Service) addMetadataToSoftwarePayload(ctx context.Context, payload *f
 	return meta.Extension, nil
 }
 
-const maxInstallerSizeBytes int64 = 1024 * 1024 * 500
-
-func (svc *Service) BatchSetSoftwareInstallers(ctx context.Context, tmName string, payloads []fleet.SoftwareInstallerPayload, dryRun bool) error {
-	if tmName == "" {
-		svc.authz.SkipAuthorization(ctx) // so that the error message is not replaced by "forbidden"
-		return ctxerr.Wrap(ctx, fleet.NewInvalidArgumentError("team_name", "must not be empty"))
-	}
+const (
+	maxInstallerSizeBytes int64 = 1024 * 1024 * 500
+	batchSoftwarePrefix         = "software_batch_"
+)
 
+func (svc *Service) BatchSetSoftwareInstallers(
+	ctx context.Context, tmName string, payloads []fleet.SoftwareInstallerPayload, dryRun bool,
+) (string, error) {
 	if err := svc.authz.Authorize(ctx, &fleet.Team{}, fleet.ActionRead); err != nil {
-		return err
+		return "", err
 	}
 
-	tm, err := svc.ds.TeamByName(ctx, tmName)
-	if err != nil {
-		// If this is a dry run, the team may not have been created yet
-		if dryRun && fleet.IsNotFound(err) {
-			return nil
+	vc, ok := viewer.FromContext(ctx)
+	if !ok {
+		return "", fleet.ErrNoContext
+	}
+
+	var teamID *uint
+	if tmName != "" {
+		tm, err := svc.ds.TeamByName(ctx, tmName)
+		if err != nil {
+			// If this is a dry run, the team may not have been created yet
+			if dryRun && fleet.IsNotFound(err) {
+				return "", nil
+			}
+			return "", err
 		}
-		return err
+		teamID = &tm.ID
 	}
 
-	if err := svc.authz.Authorize(ctx, &fleet.SoftwareInstaller{TeamID: &tm.ID}, fleet.ActionWrite); err != nil {
-		return ctxerr.Wrap(ctx, err, "validating authorization")
+	if err := svc.authz.Authorize(ctx, &fleet.SoftwareInstaller{TeamID: teamID}, fleet.ActionWrite); err != nil {
+		return "", ctxerr.Wrap(ctx, err, "validating authorization")
 	}
 
-	g, workerCtx := errgroup.WithContext(ctx)
+	// Verify payloads first, to prevent starting the download+upload process if the data is invalid.
+	for _, payload := range payloads {
+		if len(payload.URL) > fleet.SoftwareInstallerURLMaxLength {
+			return "", fleet.NewInvalidArgumentError(
+				"software.url",
+				"software URL is too long, must be less than 256 characters",
+			)
+		}
+		if _, err := url.ParseRequestURI(payload.URL); err != nil {
+			return "", fleet.NewInvalidArgumentError(
+				"software.url",
+				fmt.Sprintf("Couldn't edit software. URL (%q) is invalid", payload.URL),
+			)
+		}
+	}
+
+	// keyExpireTime is the current maximum time supported for retrieving
+	// the result of a software by batch operation.
+	const keyExpireTime = 24 * time.Hour
+
+	requestUUID := uuid.NewString()
+	if err := svc.keyValueStore.Set(ctx, batchSoftwarePrefix+requestUUID, batchSetProcessing, keyExpireTime); err != nil {
+		return "", ctxerr.Wrapf(ctx, err, "failed to set key as %s", batchSetProcessing)
+	}
+
+	svc.logger.Log(
+		"msg", "software batch start",
+		"request_uuid", requestUUID,
+		"team_id", teamID,
+		"payloads", len(payloads),
+	)
+
+	go svc.softwareBatchUpload(
+		requestUUID,
+		teamID,
+		vc.UserID(),
+		payloads,
+		dryRun,
+	)
+
+	return requestUUID, nil
+}
+
+const (
+	batchSetProcessing   = "processing"
+	batchSetCompleted    = "completed"
+	batchSetFailedPrefix = "failed:"
+)
+
+func (svc *Service) softwareBatchUpload(
+	requestUUID string,
+	teamID *uint,
+	userID uint,
+	payloads []fleet.SoftwareInstallerPayload,
+	dryRun bool,
+) {
+	var batchErr error
+
+	// We do not use the request ctx on purpose because this method runs in the background.
+	ctx := context.Background()
+
+	defer func(start time.Time) {
+		status := batchSetCompleted
+		if batchErr != nil {
+			status = fmt.Sprintf("%s%s", batchSetFailedPrefix, batchErr)
+		}
+		logger := log.With(svc.logger,
+			"request_uuid", requestUUID,
+			"team_id", teamID,
+			"payloads", len(payloads),
+			"status", status,
+			"took", time.Since(start),
+		)
+		logger.Log("msg", "software batch done")
+		// Give 10m for the client to read the result (it overrides the previos expiration time).
+		if err := svc.keyValueStore.Set(ctx, batchSoftwarePrefix+requestUUID, status, 10*time.Minute); err != nil {
+			logger.Log("msg", "failed to set result", "err", err)
+		}
+	}(time.Now())
+
+	downloadURLFn := func(ctx context.Context, url string) (http.Header, []byte, error) {
+		client := fleethttp.NewClient()
+		client.Transport = fleethttp.NewSizeLimitTransport(maxInstallerSizeBytes)
+
+		req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
+		if err != nil {
+			return nil, nil, fmt.Errorf("creating request for URL %q: %w", url, err)
+		}
+
+		resp, err := client.Do(req)
+		if err != nil {
+			var maxBytesErr *http.MaxBytesError
+			if errors.Is(err, fleethttp.ErrMaxSizeExceeded) || errors.As(err, &maxBytesErr) {
+				return nil, nil, fleet.NewInvalidArgumentError(
+					"software.url",
+					fmt.Sprintf("Couldn't edit software. URL (%q). The maximum file size is %d MiB", url, maxInstallerSizeBytes/(1024*1024)),
+				)
+			}
+
+			return nil, nil, fmt.Errorf("performing request for URL %q: %w", url, err)
+		}
+		defer resp.Body.Close()
+
+		if resp.StatusCode == http.StatusNotFound {
+			return nil, nil, fleet.NewInvalidArgumentError(
+				"software.url",
+				fmt.Sprintf("Couldn't edit software. URL (%q) returned \"Not Found\". Please make sure that URLs are reachable from your Fleet server.", url),
+			)
+		}
+
+		// Allow all 2xx and 3xx status codes in this pass.
+		if resp.StatusCode >= 400 {
+			return nil, nil, fleet.NewInvalidArgumentError(
+				"software.url",
+				fmt.Sprintf("Couldn't edit software. URL (%q) received response status code %d.", url, resp.StatusCode),
+			)
+		}
+
+		bodyBytes, err := io.ReadAll(resp.Body)
+		if err != nil {
+			// the max size error can be received either at client.Do or here when
+			// reading the body if it's caught via a limited body reader.
+			var maxBytesErr *http.MaxBytesError
+			if errors.Is(err, fleethttp.ErrMaxSizeExceeded) || errors.As(err, &maxBytesErr) {
+				return nil, nil, fleet.NewInvalidArgumentError(
+					"software.url",
+					fmt.Sprintf("Couldn't edit software. URL (%q). The maximum file size is %d MiB", url, maxInstallerSizeBytes/(1024*1024)),
+				)
+			}
+			return nil, nil, fmt.Errorf("reading installer %q contents: %w", url, err)
+		}
+
+		return resp.Header, bodyBytes, nil
+	}
+
+	var g errgroup.Group
 	g.SetLimit(3)
 	// critical to avoid data race, the slice is pre-allocated and each
 	// goroutine only writes to its index.
 	installers := make([]*fleet.UploadSoftwareInstallerPayload, len(payloads))
 
-	client := fleethttp.NewClient()
-	client.Transport = fleethttp.NewSizeLimitTransport(maxInstallerSizeBytes)
 	for i, p := range payloads {
 		i, p := i, p
 
 		g.Go(func() error {
-			// validate the URL before doing the request
-			_, err := url.ParseRequestURI(p.URL)
+			headers, bodyBytes, err := downloadURLFn(ctx, p.URL)
 			if err != nil {
-				return fleet.NewInvalidArgumentError(
-					"software.url",
-					fmt.Sprintf("Couldn't edit software. URL (%q) is invalid", p.URL),
-				)
-			}
-
-			req, err := http.NewRequestWithContext(workerCtx, http.MethodGet, p.URL, nil)
-			if err != nil {
-				return ctxerr.Wrapf(ctx, err, "creating request for URL %s", p.URL)
-			}
-
-			resp, err := client.Do(req)
-			if err != nil {
-				var maxBytesErr *http.MaxBytesError
-				if errors.Is(err, fleethttp.ErrMaxSizeExceeded) || errors.As(err, &maxBytesErr) {
-					return fleet.NewInvalidArgumentError(
-						"software.url",
-						fmt.Sprintf("Couldn't edit software. URL (%q). The maximum file size is %d MB", p.URL, maxInstallerSizeBytes/(1024*1024)),
-					)
-				}
-
-				return ctxerr.Wrapf(ctx, err, "performing request for URL %s", p.URL)
-			}
-			defer resp.Body.Close()
-
-			if resp.StatusCode == http.StatusNotFound {
-				return fleet.NewInvalidArgumentError(
-					"software.url",
-					fmt.Sprintf("Couldn't edit software. URL (%q) doesn't exist. Please make sure that URLs are publicy accessible to the internet.", p.URL),
-				)
-			}
-
-			// Allow all 2xx and 3xx status codes in this pass.
-			if resp.StatusCode > 400 {
-				return fleet.NewInvalidArgumentError(
-					"software.url",
-					fmt.Sprintf("Couldn't edit software. URL (%q) received response status code %d.", p.URL, resp.StatusCode),
-				)
-			}
-
-			bodyBytes, err := io.ReadAll(resp.Body)
-			if err != nil {
-				// the max size error can be received either at client.Do or here when
-				// reading the body if it's caught via a limited body reader.
-				var maxBytesErr *http.MaxBytesError
-				if errors.Is(err, fleethttp.ErrMaxSizeExceeded) || errors.As(err, &maxBytesErr) {
-					return fleet.NewInvalidArgumentError(
-						"software.url",
-						fmt.Sprintf("Couldn't edit software. URL (%q). The maximum file size is %d MB", p.URL, maxInstallerSizeBytes/(1024*1024)),
-					)
-				}
-				return ctxerr.Wrapf(ctx, err, "reading installer %q contents", p.URL)
+				return err
 			}
 
 			installer := &fleet.UploadSoftwareInstallerPayload{
-				TeamID:            &tm.ID,
+				TeamID:            teamID,
 				InstallScript:     p.InstallScript,
 				PreInstallQuery:   p.PreInstallQuery,
 				PostInstallScript: p.PostInstallScript,
+				UninstallScript:   p.UninstallScript,
 				InstallerFile:     bytes.NewReader(bodyBytes),
 				SelfService:       p.SelfService,
+				UserID:            userID,
+				URL:               p.URL,
 			}
 
 			// set the filename before adding metadata, as it is used as fallback
 			var filename string
-			cdh, ok := resp.Header["Content-Disposition"]
+			cdh, ok := headers["Content-Disposition"]
 			if ok && len(cdh) > 0 {
 				_, params, err := mime.ParseMediaType(cdh[0])
 				if err == nil {
@@ -687,6 +1326,9 @@ func (svc *Service) BatchSetSoftwareInstallers(ctx context.Context, tmName strin
 				return err
 			}
 
+			// Update $PACKAGE_ID in uninstall script
+			preProcessUninstallScript(installer)
+
 			// if filename was empty, try to extract it from the URL with the
 			// now-known extension
 			if filename == "" {
@@ -708,48 +1350,149 @@ func (svc *Service) BatchSetSoftwareInstallers(ctx context.Context, tmName strin
 	}
 
 	if err := g.Wait(); err != nil {
-		// NOTE: intentionally not wrapping to avoid polluting user
-		// errors.
-		return err
+		// NOTE: intentionally not wrapping to avoid polluting user errors.
+		batchErr = err
+		return
 	}
 
 	if dryRun {
-		return nil
+		return
 	}
 
 	for _, payload := range installers {
 		if err := svc.storeSoftware(ctx, payload); err != nil {
-			return ctxerr.Wrap(ctx, err, "storing software installer")
+			batchErr = fmt.Errorf("storing software installer %q: %w", payload.Filename, err)
+			return
 		}
 	}
 
-	if err := svc.ds.BatchSetSoftwareInstallers(ctx, &tm.ID, installers); err != nil {
-		return ctxerr.Wrap(ctx, err, "batch set software installers")
+	if err := svc.ds.BatchSetSoftwareInstallers(ctx, teamID, installers); err != nil {
+		batchErr = fmt.Errorf("batch set software installers: %w", err)
+		return
 	}
 
 	// Note: per @noahtalerman we don't want activity items for CLI actions
 	// anymore, so that's intentionally skipped.
+}
 
-	return nil
+func (svc *Service) GetBatchSetSoftwareInstallersResult(ctx context.Context, tmName string, requestUUID string, dryRun bool) (string, string, []fleet.SoftwarePackageResponse, error) {
+	// We've already authorized in the POST /api/latest/fleet/software/batch,
+	// but adding it here so we don't need to worry about a special case endpoint.
+	if err := svc.authz.Authorize(ctx, &fleet.Team{}, fleet.ActionRead); err != nil {
+		return "", "", nil, err
+	}
+
+	result, err := svc.keyValueStore.Get(ctx, batchSoftwarePrefix+requestUUID)
+	if err != nil {
+		return "", "", nil, ctxerr.Wrap(ctx, err, "failed to get result")
+	}
+	if result == nil {
+		return "", "", nil, ctxerr.Wrap(ctx, notFoundError{}, "request_uuid not found")
+	}
+
+	switch {
+	case *result == batchSetCompleted:
+		if dryRun {
+			return fleet.BatchSetSoftwareInstallersStatusCompleted, "", nil, nil
+		} // this will fall through to retrieving software packages if not a dry run.
+	case *result == batchSetProcessing:
+		return fleet.BatchSetSoftwareInstallersStatusProcessing, "", nil, nil
+	case strings.HasPrefix(*result, batchSetFailedPrefix):
+		message := strings.TrimPrefix(*result, batchSetFailedPrefix)
+		return fleet.BatchSetSoftwareInstallersStatusFailed, message, nil, nil
+	default:
+		return "", "", nil, ctxerr.New(ctx, "invalid status")
+	}
+
+	var (
+		teamID    uint  // GetSoftwareInstallers uses 0 for "No team"
+		ptrTeamID *uint // Authorize uses *uint for "No team" teamID
+	)
+	if tmName != "" {
+		team, err := svc.ds.TeamByName(ctx, tmName)
+		if err != nil {
+			return "", "", nil, ctxerr.Wrap(ctx, err, "load team by name")
+		}
+		teamID = team.ID
+		ptrTeamID = &team.ID
+	}
+
+	// We've already authorized in the POST /api/latest/fleet/software/batch,
+	// but adding it here so we don't need to worry about a special case endpoint.
+	//
+	// We use fleet.ActionWrite because this method is the counterpart of the POST
+	// /api/latest/fleet/software/batch.
+	if err := svc.authz.Authorize(ctx, &fleet.SoftwareInstaller{TeamID: ptrTeamID}, fleet.ActionWrite); err != nil {
+		return "", "", nil, ctxerr.Wrap(ctx, err, "validating authorization")
+	}
+
+	softwarePackages, err := svc.ds.GetSoftwareInstallers(ctx, teamID)
+	if err != nil {
+		return "", "", nil, ctxerr.Wrap(ctx, err, "get software installers")
+	}
+
+	return fleet.BatchSetSoftwareInstallersStatusCompleted, "", softwarePackages, nil
 }
 
 func (svc *Service) SelfServiceInstallSoftwareTitle(ctx context.Context, host *fleet.Host, softwareTitleID uint) error {
 	installer, err := svc.ds.GetSoftwareInstallerMetadataByTeamAndTitleID(ctx, host.TeamID, softwareTitleID, false)
 	if err != nil {
-		if fleet.IsNotFound(err) {
+		if !fleet.IsNotFound(err) {
+			return ctxerr.Wrap(ctx, err, "finding software installer for title")
+		}
+		installer = nil
+	}
+
+	if installer != nil {
+		if !installer.SelfService {
 			return &fleet.BadRequestError{
-				Message: "Software title has no package added. Please add software package to install.",
-				InternalErr: ctxerr.WrapWithData(
-					ctx, err, "couldn't find an installer for software title",
+				Message: "Software title is not available through self-service",
+				InternalErr: ctxerr.NewWithData(
+					ctx, "software title not available through self-service",
 					map[string]any{"host_id": host.ID, "team_id": host.TeamID, "title_id": softwareTitleID},
 				),
 			}
 		}
 
-		return ctxerr.Wrap(ctx, err, "finding software installer for title")
+		ext := filepath.Ext(installer.Name)
+		requiredPlatform := packageExtensionToPlatform(ext)
+		if requiredPlatform == "" {
+			// this should never happen
+			return ctxerr.Errorf(ctx, "software installer has unsupported type %s", ext)
+		}
+
+		if host.FleetPlatform() != requiredPlatform {
+			return &fleet.BadRequestError{
+				Message: fmt.Sprintf("Package (%s) can be installed only on %s hosts.", ext, requiredPlatform),
+				InternalErr: ctxerr.WrapWithData(
+					ctx, err, "invalid host platform for requested installer",
+					map[string]any{"host_id": host.ID, "team_id": host.TeamID, "title_id": softwareTitleID},
+				),
+			}
+		}
+
+		_, err = svc.ds.InsertSoftwareInstallRequest(ctx, host.ID, installer.InstallerID, true)
+		return ctxerr.Wrap(ctx, err, "inserting self-service software install request")
 	}
 
-	if !installer.SelfService {
+	vppApp, err := svc.ds.GetVPPAppByTeamAndTitleID(ctx, host.TeamID, softwareTitleID)
+	if err != nil {
+		// if we couldn't find an installer or a VPP app, return a bad
+		// request error
+		if fleet.IsNotFound(err) {
+			return &fleet.BadRequestError{
+				Message: "Couldn't install software. Software title is not available for install. Please add software package or App Store app to install.",
+				InternalErr: ctxerr.WrapWithData(
+					ctx, err, "couldn't find an installer or VPP app for software title",
+					map[string]any{"host_id": host.ID, "team_id": host.TeamID, "title_id": softwareTitleID},
+				),
+			}
+		}
+
+		return ctxerr.Wrap(ctx, err, "finding VPP app for title")
+	}
+
+	if !vppApp.SelfService {
 		return &fleet.BadRequestError{
 			Message: "Software title is not available through self-service",
 			InternalErr: ctxerr.NewWithData(
@@ -759,25 +1502,10 @@ func (svc *Service) SelfServiceInstallSoftwareTitle(ctx context.Context, host *f
 		}
 	}
 
-	ext := filepath.Ext(installer.Name)
-	requiredPlatform := packageExtensionToPlatform(ext)
-	if requiredPlatform == "" {
-		// this should never happen
-		return ctxerr.Errorf(ctx, "software installer has unsupported type %s", ext)
-	}
+	platform := host.FleetPlatform()
+	mobileAppleDevice := fleet.AppleDevicePlatform(platform) == fleet.IOSPlatform || fleet.AppleDevicePlatform(platform) == fleet.IPadOSPlatform
 
-	if host.FleetPlatform() != requiredPlatform {
-		return &fleet.BadRequestError{
-			Message: fmt.Sprintf("Package (%s) can be installed only on %s hosts.", ext, requiredPlatform),
-			InternalErr: ctxerr.WrapWithData(
-				ctx, err, "invalid host platform for requested installer",
-				map[string]any{"host_id": host.ID, "team_id": host.TeamID, "title_id": softwareTitleID},
-			),
-		}
-	}
-
-	_, err = svc.ds.InsertSoftwareInstallRequest(ctx, host.ID, installer.InstallerID, true)
-	return ctxerr.Wrap(ctx, err, "inserting self-service software install request")
+	return svc.installSoftwareFromVPP(ctx, host, vppApp, mobileAppleDevice || fleet.AppleDevicePlatform(platform) == fleet.MacOSPlatform, true)
 }
 
 // packageExtensionToPlatform returns the platform name based on the
@@ -797,3 +1525,68 @@ func packageExtensionToPlatform(ext string) string {
 
 	return requiredPlatform
 }
+
+func UninstallSoftwareMigration(
+	ctx context.Context,
+	ds fleet.Datastore,
+	softwareInstallStore fleet.SoftwareInstallerStore,
+	logger kitlog.Logger,
+) error {
+	// Find software installers without package_id
+	idMap, err := ds.GetSoftwareInstallersWithoutPackageIDs(ctx)
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "getting software installers without package_id")
+	}
+	if len(idMap) == 0 {
+		return nil
+	}
+
+	// Download each package and parse it
+	for id, storageID := range idMap {
+		// check if the installer exists in the store
+		exists, err := softwareInstallStore.Exists(ctx, storageID)
+		if err != nil {
+			return ctxerr.Wrap(ctx, err, "checking if installer exists")
+		}
+		if !exists {
+			level.Warn(logger).Log("msg", "software installer not found in store", "software_installer_id", id, "storage_id", storageID)
+			continue
+		}
+
+		// get the installer from the store
+		installer, _, err := softwareInstallStore.Get(ctx, storageID)
+		if err != nil {
+			return ctxerr.Wrap(ctx, err, "getting installer from store")
+		}
+
+		meta, err := file.ExtractInstallerMetadata(installer)
+		if err != nil {
+			level.Warn(logger).Log("msg", "extracting metadata from installer", "software_installer_id", id, "storage_id", storageID, "err",
+				err)
+			continue
+		}
+		if len(meta.PackageIDs) == 0 {
+			level.Warn(logger).Log("msg", "no package_id found in metadata", "software_installer_id", id, "storage_id", storageID)
+			continue
+		}
+		if meta.Extension == "" {
+			level.Warn(logger).Log("msg", "no extension found in metadata", "software_installer_id", id, "storage_id", storageID)
+			continue
+		}
+		payload := fleet.UploadSoftwareInstallerPayload{
+			PackageIDs: meta.PackageIDs,
+			Extension:  meta.Extension,
+		}
+		payload.UninstallScript = file.GetUninstallScript(payload.Extension)
+
+		// Update $PACKAGE_ID in uninstall script
+		preProcessUninstallScript(&payload)
+
+		// Update the package_id and extension in the software installer and the uninstall script
+		if err := ds.UpdateSoftwareInstallerWithoutPackageIDs(ctx, id, payload); err != nil {
+			return ctxerr.Wrap(ctx, err, "updating package_id in software installer")
+		}
+	}
+
+	return nil
+}
diff --git a/ee/server/service/software_installers_test.go b/ee/server/service/software_installers_test.go
new file mode 100644
index 0000000000..6abd95085e
--- /dev/null
+++ b/ee/server/service/software_installers_test.go
@@ -0,0 +1,223 @@
+package service
+
+import (
+	"context"
+	"testing"
+
+	"github.com/fleetdm/fleet/v4/server/authz"
+	"github.com/fleetdm/fleet/v4/server/contexts/viewer"
+	"github.com/fleetdm/fleet/v4/server/fleet"
+	"github.com/fleetdm/fleet/v4/server/mock"
+	"github.com/fleetdm/fleet/v4/server/ptr"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestPreProcessUninstallScript(t *testing.T) {
+	t.Parallel()
+	var input = `
+blah$PACKAGE_IDS
+pkgids=$PACKAGE_ID
+they are $PACKAGE_ID, right $MY_SECRET?
+quotes for "$PACKAGE_ID"
+blah${PACKAGE_ID}withConcat
+quotes and braces for "${PACKAGE_ID}"
+${PACKAGE_ID}`
+
+	payload := fleet.UploadSoftwareInstallerPayload{
+		Extension:       "exe",
+		UninstallScript: input,
+		PackageIDs:      []string{"com.foo"},
+	}
+
+	preProcessUninstallScript(&payload)
+	expected := `
+blah$PACKAGE_IDS
+pkgids="com.foo"
+they are "com.foo", right $MY_SECRET?
+quotes for "com.foo"
+blah"com.foo"withConcat
+quotes and braces for "com.foo"
+"com.foo"`
+	assert.Equal(t, expected, payload.UninstallScript)
+
+	payload = fleet.UploadSoftwareInstallerPayload{
+		Extension:       "pkg",
+		UninstallScript: input,
+		PackageIDs:      []string{"com.foo", "com.bar"},
+	}
+	preProcessUninstallScript(&payload)
+	expected = `
+blah$PACKAGE_IDS
+pkgids=(
+  "com.foo"
+  "com.bar"
+)
+they are (
+  "com.foo"
+  "com.bar"
+), right $MY_SECRET?
+quotes for (
+  "com.foo"
+  "com.bar"
+)
+blah(
+  "com.foo"
+  "com.bar"
+)withConcat
+quotes and braces for (
+  "com.foo"
+  "com.bar"
+)
+(
+  "com.foo"
+  "com.bar"
+)`
+	assert.Equal(t, expected, payload.UninstallScript)
+
+}
+
+func TestInstallUninstallAuth(t *testing.T) {
+	t.Parallel()
+	ds := new(mock.Store)
+	svc := newTestService(t, ds)
+
+	ds.AppConfigFunc = func(ctx context.Context) (*fleet.AppConfig, error) {
+		return &fleet.AppConfig{}, nil
+	}
+	ds.HostFunc = func(ctx context.Context, id uint) (*fleet.Host, error) {
+		return &fleet.Host{
+			OrbitNodeKey: ptr.String("orbit_key"),
+			Platform:     "darwin",
+			TeamID:       ptr.Uint(1),
+		}, nil
+	}
+	ds.GetSoftwareInstallerMetadataByTeamAndTitleIDFunc = func(ctx context.Context, teamID *uint, titleID uint,
+		withScriptContents bool) (*fleet.SoftwareInstaller, error) {
+		return &fleet.SoftwareInstaller{
+			Name:     "installer.pkg",
+			Platform: "darwin",
+			TeamID:   ptr.Uint(1),
+		}, nil
+	}
+	ds.GetHostLastInstallDataFunc = func(ctx context.Context, hostID uint, installerID uint) (*fleet.HostLastInstallData, error) {
+		return nil, nil
+	}
+	ds.InsertSoftwareInstallRequestFunc = func(ctx context.Context, hostID uint, softwareInstallerID uint, selfService bool) (string,
+		error) {
+		return "request_id", nil
+	}
+	ds.GetAnyScriptContentsFunc = func(ctx context.Context, id uint) ([]byte, error) {
+		return []byte("script"), nil
+	}
+	ds.NewHostScriptExecutionRequestFunc = func(ctx context.Context, request *fleet.HostScriptRequestPayload) (*fleet.HostScriptResult,
+		error) {
+		return &fleet.HostScriptResult{
+			ExecutionID: "execution_id",
+		}, nil
+	}
+	ds.InsertSoftwareUninstallRequestFunc = func(ctx context.Context, executionID string, hostID uint, softwareInstallerID uint) error {
+		return nil
+	}
+
+	testCases := []struct {
+		name       string
+		user       *fleet.User
+		shouldFail bool
+	}{
+		{
+			"global admin",
+			&fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)},
+			false,
+		},
+		{
+			"global maintainer",
+			&fleet.User{GlobalRole: ptr.String(fleet.RoleMaintainer)},
+			false,
+		},
+		{
+			"global observer",
+			&fleet.User{GlobalRole: ptr.String(fleet.RoleObserver)},
+			true,
+		},
+		{
+			"team admin",
+			&fleet.User{Teams: []fleet.UserTeam{{Team: fleet.Team{ID: 1}, Role: fleet.RoleAdmin}}},
+			false,
+		},
+		{
+			"team maintainer",
+			&fleet.User{Teams: []fleet.UserTeam{{Team: fleet.Team{ID: 1}, Role: fleet.RoleMaintainer}}},
+			false,
+		},
+		{
+			"team observer",
+			&fleet.User{Teams: []fleet.UserTeam{{Team: fleet.Team{ID: 1}, Role: fleet.RoleObserver}}},
+			true,
+		},
+	}
+	for _, tt := range testCases {
+		t.Run(tt.name, func(t *testing.T) {
+			ctx := viewer.NewContext(context.Background(), viewer.Viewer{User: tt.user})
+			checkAuthErr(t, tt.shouldFail, svc.InstallSoftwareTitle(ctx, 1, 10))
+			checkAuthErr(t, tt.shouldFail, svc.UninstallSoftwareTitle(ctx, 1, 10))
+		})
+	}
+}
+
+// TestUninstallSoftwareTitle is mostly tested in enterprise integration test. This test hits a few edge cases.
+func TestUninstallSoftwareTitle(t *testing.T) {
+	t.Parallel()
+	ds := new(mock.Store)
+	svc := newTestService(t, ds)
+
+	host := &fleet.Host{
+		OrbitNodeKey: ptr.String("orbit_key"),
+		Platform:     "darwin",
+		TeamID:       ptr.Uint(1),
+	}
+
+	ds.HostFunc = func(ctx context.Context, id uint) (*fleet.Host, error) {
+		return host, nil
+	}
+
+	// Scripts disabled
+	ds.AppConfigFunc = func(ctx context.Context) (*fleet.AppConfig, error) {
+		return &fleet.AppConfig{
+			ServerSettings: fleet.ServerSettings{
+				ScriptsDisabled: true,
+			},
+		}, nil
+	}
+	require.ErrorContains(t, svc.UninstallSoftwareTitle(context.Background(), 1, 10), fleet.RunScriptScriptsDisabledGloballyErrMsg)
+	ds.AppConfigFunc = func(ctx context.Context) (*fleet.AppConfig, error) {
+		return &fleet.AppConfig{}, nil
+	}
+
+	// Host scripts disabled
+	host.ScriptsEnabled = ptr.Bool(false)
+	require.ErrorContains(t, svc.UninstallSoftwareTitle(context.Background(), 1, 10), fleet.RunScriptsOrbitDisabledErrMsg)
+
+}
+
+func checkAuthErr(t *testing.T, shouldFail bool, err error) {
+	t.Helper()
+	if shouldFail {
+		require.Error(t, err)
+		var forbiddenError *authz.Forbidden
+		require.ErrorAs(t, err, &forbiddenError)
+	} else {
+		require.NoError(t, err)
+	}
+}
+
+func newTestService(t *testing.T, ds fleet.Datastore) *Service {
+	t.Helper()
+	authorizer, err := authz.NewAuthorizer()
+	require.NoError(t, err)
+	svc := &Service{
+		authz: authorizer,
+		ds:    ds,
+	}
+	return svc
+}
diff --git a/ee/server/service/teams.go b/ee/server/service/teams.go
index 4b8df03123..448abc3674 100644
--- a/ee/server/service/teams.go
+++ b/ee/server/service/teams.go
@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"net/http"
 	"net/url"
+	"strings"
 
 	"github.com/fleetdm/fleet/v4/pkg/optjson"
 	"github.com/fleetdm/fleet/v4/server"
@@ -73,6 +74,13 @@ func (svc *Service) NewTeam(ctx context.Context, p fleet.TeamPayload) (*fleet.Te
 	if *p.Name == "" {
 		return nil, fleet.NewInvalidArgumentError("name", "may not be empty")
 	}
+	l := strings.ToLower(*p.Name)
+	if l == strings.ToLower(fleet.ReservedNameAllTeams) {
+		return nil, fleet.NewInvalidArgumentError("name", `"All teams" is a reserved team name`)
+	}
+	if l == strings.ToLower(fleet.ReservedNameNoTeam) {
+		return nil, fleet.NewInvalidArgumentError("name", `"No team" is a reserved team name`)
+	}
 	team.Name = *p.Name
 
 	if p.Description != nil {
@@ -129,6 +137,13 @@ func (svc *Service) ModifyTeam(ctx context.Context, teamID uint, payload fleet.T
 		if *payload.Name == "" {
 			return nil, fleet.NewInvalidArgumentError("name", "may not be empty")
 		}
+		l := strings.ToLower(*payload.Name)
+		if l == strings.ToLower(fleet.ReservedNameAllTeams) {
+			return nil, fleet.NewInvalidArgumentError("name", `"All teams" is a reserved team name`)
+		}
+		if l == strings.ToLower(fleet.ReservedNameNoTeam) {
+			return nil, fleet.NewInvalidArgumentError("name", `"No team" is a reserved team name`)
+		}
 		team.Name = *payload.Name
 	}
 	if payload.Description != nil {
@@ -612,7 +627,7 @@ func (svc *Service) DeleteTeam(ctx context.Context, teamID uint) error {
 	}
 
 	if len(hostIDs) > 0 {
-		if err := svc.ds.BulkSetPendingMDMHostProfiles(ctx, hostIDs, nil, nil, nil); err != nil {
+		if _, err := svc.ds.BulkSetPendingMDMHostProfiles(ctx, hostIDs, nil, nil, nil); err != nil {
 			return ctxerr.Wrap(ctx, err, "bulk set pending host profiles")
 		}
 
@@ -860,6 +875,14 @@ func (svc *Service) ApplyTeamSpecs(ctx context.Context, specs []*fleet.TeamSpec,
 			}
 		}
 
+		l := strings.ToLower(spec.Name)
+		if l == strings.ToLower(fleet.ReservedNameAllTeams) {
+			return nil, fleet.NewInvalidArgumentError("name", `"All teams" is a reserved team name`)
+		}
+		if l == strings.ToLower(fleet.ReservedNameNoTeam) {
+			return nil, fleet.NewInvalidArgumentError("name", `"No team" is a reserved team name`)
+		}
+
 		var team *fleet.Team
 		// If filename is provided, try to find the team by filename first.
 		// This is needed in case user is trying to modify the team name.
@@ -868,7 +891,22 @@ func (svc *Service) ApplyTeamSpecs(ctx context.Context, specs []*fleet.TeamSpec,
 			if err != nil && !fleet.IsNotFound(err) {
 				return nil, err
 			}
+			if team != nil && team.Name != spec.Name {
+				// If user is trying to change team name, check that the new name is not already taken.
+				_, err = svc.ds.TeamByName(ctx, spec.Name)
+				switch {
+				case err == nil:
+					return nil, fleet.NewInvalidArgumentError("name",
+						fmt.Sprintf("cannot change team name from '%s' (filename: %s) to '%s' because team name already exists", team.Name,
+							*spec.Filename, spec.Name))
+				case fleet.IsNotFound(err):
+					// OK
+				default:
+					return nil, err
+				}
+			}
 		}
+
 		var create bool
 		if team == nil {
 			team, err = svc.ds.TeamByName(ctx, spec.Name)
@@ -1246,7 +1284,7 @@ func (svc *Service) editTeamFromSpec(
 
 	if spec.Software != nil {
 		if team.Config.Software == nil {
-			team.Config.Software = &fleet.TeamSpecSoftware{}
+			team.Config.Software = &fleet.SoftwareSpec{}
 		}
 
 		if spec.Software.Packages.Set {
diff --git a/ee/server/service/vpp.go b/ee/server/service/vpp.go
index c280be9729..d1f13bd555 100644
--- a/ee/server/service/vpp.go
+++ b/ee/server/service/vpp.go
@@ -2,10 +2,10 @@ package service
 
 import (
 	"context"
-	"encoding/base64"
-	"encoding/json"
+	"database/sql"
 	"errors"
 	"fmt"
+	"io"
 	"net/http"
 	"sort"
 	"strings"
@@ -18,40 +18,25 @@ import (
 	"github.com/fleetdm/fleet/v4/server/mdm/apple/vpp"
 )
 
+// Used for overriding the env var value in testing
+var testSetEmptyPrivateKey bool
+
 // getVPPToken returns the base64 encoded VPP token, ready for use in requests to Apple's VPP API.
 // It returns an error if the token is expired.
-func (svc *Service) getVPPToken(ctx context.Context) (string, error) {
-	configMap, err := svc.ds.GetAllMDMConfigAssetsByName(ctx, []fleet.MDMAssetName{fleet.MDMAssetVPPToken})
+func (svc *Service) getVPPToken(ctx context.Context, teamID *uint) (string, error) {
+	token, err := svc.ds.GetVPPTokenByTeamID(ctx, teamID)
 	if err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			return "", fleet.NewUserMessageError(errors.New("No available VPP Token"), http.StatusUnprocessableEntity)
+		}
 		return "", ctxerr.Wrap(ctx, err, "fetching vpp token")
 	}
 
-	var vppTokenData fleet.VPPTokenData
-	if err := json.Unmarshal(configMap[fleet.MDMAssetVPPToken].Value, &vppTokenData); err != nil {
-		return "", ctxerr.Wrap(ctx, err, "unmarshaling VPP token data")
-	}
-
-	vppTokenRawBytes, err := base64.StdEncoding.DecodeString(vppTokenData.Token)
-	if err != nil {
-		return "", ctxerr.Wrap(ctx, err, "decoding raw vpp token data")
-	}
-
-	var vppTokenRaw fleet.VPPTokenRaw
-
-	if err := json.Unmarshal(vppTokenRawBytes, &vppTokenRaw); err != nil {
-		return "", ctxerr.Wrap(ctx, err, "unmarshaling raw vpp token data")
-	}
-
-	exp, err := time.Parse("2006-01-02T15:04:05Z0700", vppTokenRaw.ExpDate)
-	if err != nil {
-		return "", ctxerr.Wrap(ctx, err, "parsing vpp token expiration date")
-	}
-
-	if time.Now().After(exp) {
+	if time.Now().After(token.RenewDate) {
 		return "", fleet.NewUserMessageError(errors.New("Couldn't install. VPP token expired."), http.StatusUnprocessableEntity)
 	}
 
-	return vppTokenData.Token, nil
+	return token.Token, nil
 }
 
 func (svc *Service) BatchAssociateVPPApps(ctx context.Context, teamName string, payloads []fleet.VPPBatchPayload, dryRun bool) error {
@@ -83,22 +68,27 @@ func (svc *Service) BatchAssociateVPPApps(ctx context.Context, teamName string,
 
 	payloadsWithPlatform := make([]fleet.VPPBatchPayloadWithPlatform, 0, len(payloads))
 	for _, payload := range payloads {
+		// Currently only macOS is supported for self-service. Don't
+		// import vpp apps as self-service for ios or ipados
 		payloadsWithPlatform = append(payloadsWithPlatform, []fleet.VPPBatchPayloadWithPlatform{{
-			AppStoreID: payload.AppStoreID,
-			Platform:   fleet.IOSPlatform,
+			AppStoreID:  payload.AppStoreID,
+			SelfService: false,
+			Platform:    fleet.IOSPlatform,
 		}, {
-			AppStoreID: payload.AppStoreID,
-			Platform:   fleet.IPadOSPlatform,
+			AppStoreID:  payload.AppStoreID,
+			SelfService: false,
+			Platform:    fleet.IPadOSPlatform,
 		}, {
-			AppStoreID: payload.AppStoreID,
-			Platform:   fleet.MacOSPlatform,
+			AppStoreID:  payload.AppStoreID,
+			SelfService: payload.SelfService,
+			Platform:    fleet.MacOSPlatform,
 		}}...)
 	}
 
-	var vppAppIDs []fleet.VPPAppID
+	var vppAppTeams []fleet.VPPAppTeam
 	// Don't check for token if we're only disassociating assets
 	if len(payloads) > 0 {
-		token, err := svc.getVPPToken(ctx)
+		token, err := svc.getVPPToken(ctx, &team.ID)
 		if err != nil {
 			return fleet.NewUserMessageError(ctxerr.Wrap(ctx, err, "could not retrieve vpp token"), http.StatusUnprocessableEntity)
 		}
@@ -111,7 +101,7 @@ func (svc *Service) BatchAssociateVPPApps(ctx context.Context, teamName string,
 				return fleet.NewInvalidArgumentError("app_store_apps.platform",
 					fmt.Sprintf("platform must be one of '%s', '%s', or '%s", fleet.IOSPlatform, fleet.IPadOSPlatform, fleet.MacOSPlatform))
 			}
-			vppAppIDs = append(vppAppIDs, fleet.VPPAppID{AdamID: payload.AppStoreID, Platform: payload.Platform})
+			vppAppTeams = append(vppAppTeams, fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: payload.AppStoreID, Platform: payload.Platform}, SelfService: payload.SelfService})
 		}
 
 		var missingAssets []string
@@ -126,7 +116,7 @@ func (svc *Service) BatchAssociateVPPApps(ctx context.Context, teamName string,
 			assetMap[asset.AdamID] = struct{}{}
 		}
 
-		for _, vppAppID := range vppAppIDs {
+		for _, vppAppID := range vppAppTeams {
 			if _, ok := assetMap[vppAppID.AdamID]; !ok {
 				missingAssets = append(missingAssets, vppAppID.AdamID)
 			}
@@ -139,8 +129,8 @@ func (svc *Service) BatchAssociateVPPApps(ctx context.Context, teamName string,
 	}
 
 	if !dryRun {
-		if len(vppAppIDs) > 0 {
-			apps, err := getVPPAppsMetadata(ctx, vppAppIDs)
+		if len(vppAppTeams) > 0 {
+			apps, err := getVPPAppsMetadata(ctx, vppAppTeams)
 			if err != nil {
 				return ctxerr.Wrap(ctx, err, "refreshing VPP app metadata")
 			}
@@ -153,16 +143,19 @@ func (svc *Service) BatchAssociateVPPApps(ctx context.Context, teamName string,
 				return ctxerr.Wrap(ctx, err, "inserting vpp app metadata")
 			}
 			// Filter out the apps with invalid platforms
-			if len(apps) != len(vppAppIDs) {
-				vppAppIDs = make([]fleet.VPPAppID, 0, len(apps))
+			if len(apps) != len(vppAppTeams) {
+				vppAppTeams = make([]fleet.VPPAppTeam, 0, len(apps))
 				for _, app := range apps {
-					vppAppIDs = append(vppAppIDs, app.VPPAppID)
+					vppAppTeams = append(vppAppTeams, app.VPPAppTeam)
 				}
 			}
-		}
 
-		if err := svc.ds.SetTeamVPPApps(ctx, &team.ID, vppAppIDs); err != nil {
-			return fleet.NewUserMessageError(ctxerr.Wrap(ctx, err, "set team vpp assets"), http.StatusInternalServerError)
+		}
+		if err := svc.ds.SetTeamVPPApps(ctx, &team.ID, vppAppTeams); err != nil {
+			if errors.Is(err, sql.ErrNoRows) {
+				return fleet.NewUserMessageError(ctxerr.Wrap(ctx, err, "no vpp token to set team vpp assets"), http.StatusUnprocessableEntity)
+			}
+			return ctxerr.Wrap(ctx, err, "set team vpp assets")
 		}
 	}
 
@@ -174,7 +167,7 @@ func (svc *Service) GetAppStoreApps(ctx context.Context, teamID *uint) ([]*fleet
 		return nil, err
 	}
 
-	vppToken, err := svc.getVPPToken(ctx)
+	vppToken, err := svc.getVPPToken(ctx, teamID)
 	if err != nil {
 		return nil, ctxerr.Wrap(ctx, err, "retrieving VPP token")
 	}
@@ -219,16 +212,20 @@ func (svc *Service) GetAppStoreApps(ctx context.Context, teamID *uint) ([]*fleet
 				AdamID:   a.AdamID,
 				Platform: platform,
 			}
+			vppAppTeam := fleet.VPPAppTeam{
+				VPPAppID: vppAppID,
+			}
 			app := &fleet.VPPApp{
-				VPPAppID:         vppAppID,
+				VPPAppTeam:       vppAppTeam,
 				BundleIdentifier: m.BundleID,
 				IconURL:          m.ArtworkURL,
 				Name:             m.TrackName,
 				LatestVersion:    m.Version,
 			}
 
-			if _, ok := assignedApps[vppAppID]; ok {
+			if appFleet, ok := assignedApps[vppAppID]; ok {
 				// Then this is already assigned, so filter it out.
+				app.SelfService = appFleet.SelfService
 				appsToUpdate = append(appsToUpdate, app)
 				continue
 			}
@@ -274,7 +271,7 @@ func getPlatformsFromSupportedDevices(supportedDevices []string) map[fleet.Apple
 	return platforms
 }
 
-func (svc *Service) AddAppStoreApp(ctx context.Context, teamID *uint, appID fleet.VPPAppID) error {
+func (svc *Service) AddAppStoreApp(ctx context.Context, teamID *uint, appID fleet.VPPAppTeam) error {
 	if err := svc.authz.Authorize(ctx, &fleet.VPPApp{TeamID: teamID}, fleet.ActionWrite); err != nil {
 		return err
 	}
@@ -300,7 +297,11 @@ func (svc *Service) AddAppStoreApp(ctx context.Context, teamID *uint, appID flee
 		teamName = tm.Name
 	}
 
-	vppToken, err := svc.getVPPToken(ctx)
+	if appID.SelfService && appID.Platform != fleet.MacOSPlatform {
+		return fleet.NewUserMessageError(errors.New("Currently, self-service only supports macOS"), http.StatusBadRequest)
+	}
+
+	vppToken, err := svc.getVPPToken(ctx, teamID)
 	if err != nil {
 		return ctxerr.Wrap(ctx, err, "retrieving VPP token")
 	}
@@ -345,7 +346,7 @@ func (svc *Service) AddAppStoreApp(ctx context.Context, teamID *uint, appID flee
 	}
 
 	app := &fleet.VPPApp{
-		VPPAppID:         appID,
+		VPPAppTeam:       appID,
 		BundleIdentifier: assetMD.BundleID,
 		IconURL:          assetMD.ArtworkURL,
 		Name:             assetMD.TrackName,
@@ -361,6 +362,7 @@ func (svc *Service) AddAppStoreApp(ctx context.Context, teamID *uint, appID flee
 		TeamName:      &teamName,
 		SoftwareTitle: app.Name,
 		TeamID:        teamID,
+		SelfService:   app.SelfService,
 	}
 	if err := svc.NewActivity(ctx, authz.UserFromContext(ctx), act); err != nil {
 		return ctxerr.Wrap(ctx, err, "create activity for add app store app")
@@ -369,17 +371,17 @@ func (svc *Service) AddAppStoreApp(ctx context.Context, teamID *uint, appID flee
 	return nil
 }
 
-func getVPPAppsMetadata(ctx context.Context, ids []fleet.VPPAppID) ([]*fleet.VPPApp, error) {
+func getVPPAppsMetadata(ctx context.Context, ids []fleet.VPPAppTeam) ([]*fleet.VPPApp, error) {
 	var apps []*fleet.VPPApp
 
-	// Map of adamID to platform.
-	var adamIDMap = make(map[string]map[fleet.AppleDevicePlatform]struct{})
+	// Map of adamID to platform, then to whether it's available as self-service.
+	adamIDMap := make(map[string]map[fleet.AppleDevicePlatform]bool)
 	for _, id := range ids {
 		if _, ok := adamIDMap[id.AdamID]; !ok {
-			adamIDMap[id.AdamID] = make(map[fleet.AppleDevicePlatform]struct{}, 1)
-			adamIDMap[id.AdamID][id.Platform] = struct{}{}
+			adamIDMap[id.AdamID] = make(map[fleet.AppleDevicePlatform]bool, 1)
+			adamIDMap[id.AdamID][id.Platform] = id.SelfService
 		} else {
-			adamIDMap[id.AdamID][id.Platform] = struct{}{}
+			adamIDMap[id.AdamID][id.Platform] = id.SelfService
 		}
 	}
 
@@ -395,22 +397,166 @@ func getVPPAppsMetadata(ctx context.Context, ids []fleet.VPPAppID) ([]*fleet.VPP
 	for adamID, metadata := range assetMetatada {
 		platforms := getPlatformsFromSupportedDevices(metadata.SupportedDevices)
 		for platform := range platforms {
-			if _, ok := adamIDMap[adamID][platform]; !ok {
+			if selfService, ok := adamIDMap[adamID][platform]; ok {
+				app := &fleet.VPPApp{
+					VPPAppTeam: fleet.VPPAppTeam{
+						VPPAppID: fleet.VPPAppID{
+							AdamID:   adamID,
+							Platform: platform,
+						},
+						SelfService: selfService,
+					},
+					BundleIdentifier: metadata.BundleID,
+					IconURL:          metadata.ArtworkURL,
+					Name:             metadata.TrackName,
+					LatestVersion:    metadata.Version,
+				}
+				apps = append(apps, app)
+			} else {
 				continue
 			}
-			app := &fleet.VPPApp{
-				VPPAppID: fleet.VPPAppID{
-					AdamID:   adamID,
-					Platform: platform,
-				},
-				BundleIdentifier: metadata.BundleID,
-				IconURL:          metadata.ArtworkURL,
-				Name:             metadata.TrackName,
-				LatestVersion:    metadata.Version,
-			}
-			apps = append(apps, app)
 		}
 	}
 
 	return apps, nil
 }
+
+func (svc *Service) UploadVPPToken(ctx context.Context, token io.ReadSeeker) (*fleet.VPPTokenDB, error) {
+	if err := svc.authz.Authorize(ctx, &fleet.AppleCSR{}, fleet.ActionWrite); err != nil {
+		return nil, err
+	}
+
+	privateKey := svc.config.Server.PrivateKey
+	if testSetEmptyPrivateKey {
+		privateKey = ""
+	}
+
+	if len(privateKey) == 0 {
+		return nil, ctxerr.New(ctx, "Couldn't upload content token. Missing required private key. Learn how to configure the private key here: https://fleetdm.com/learn-more-about/fleet-server-private-key")
+	}
+
+	if token == nil {
+		return nil, ctxerr.Wrap(ctx, fleet.NewInvalidArgumentError("token", "Invalid token. Please provide a valid content token from Apple Business Manager."))
+	}
+
+	tokenBytes, err := io.ReadAll(token)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "reading VPP token")
+	}
+
+	locName, err := vpp.GetConfig(string(tokenBytes))
+	if err != nil {
+		var vppErr *vpp.ErrorResponse
+		if errors.As(err, &vppErr) {
+			// Per https://developer.apple.com/documentation/devicemanagement/app_and_book_management/app_and_book_management_legacy/interpreting_error_codes
+			if vppErr.ErrorNumber == 9622 {
+				return nil, ctxerr.Wrap(ctx, fleet.NewInvalidArgumentError("token", "Invalid token. Please provide a valid content token from Apple Business Manager."))
+			}
+		}
+		return nil, ctxerr.Wrap(ctx, err, "validating VPP token with Apple")
+	}
+
+	data := fleet.VPPTokenData{
+		Token:    string(tokenBytes),
+		Location: locName,
+	}
+
+	tok, err := svc.ds.InsertVPPToken(ctx, &data)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "writing VPP token to db")
+	}
+
+	if err := svc.NewActivity(ctx, authz.UserFromContext(ctx), fleet.ActivityEnabledVPP{
+		Location: locName,
+	}); err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "create activity for upload VPP token")
+	}
+
+	return tok, nil
+}
+
+func (svc *Service) UpdateVPPToken(ctx context.Context, tokenID uint, token io.ReadSeeker) (*fleet.VPPTokenDB, error) {
+	if err := svc.authz.Authorize(ctx, &fleet.AppleCSR{}, fleet.ActionWrite); err != nil {
+		return nil, err
+	}
+
+	privateKey := svc.config.Server.PrivateKey
+	if testSetEmptyPrivateKey {
+		privateKey = ""
+	}
+
+	if len(privateKey) == 0 {
+		return nil, ctxerr.New(ctx, "Couldn't upload content token. Missing required private key. Learn how to configure the private key here: https://fleetdm.com/learn-more-about/fleet-server-private-key")
+	}
+
+	if token == nil {
+		return nil, ctxerr.Wrap(ctx, fleet.NewInvalidArgumentError("token", "Invalid token. Please provide a valid content token from Apple Business Manager."))
+	}
+
+	tokenBytes, err := io.ReadAll(token)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "reading VPP token")
+	}
+
+	locName, err := vpp.GetConfig(string(tokenBytes))
+	if err != nil {
+		var vppErr *vpp.ErrorResponse
+		if errors.As(err, &vppErr) {
+			// Per https://developer.apple.com/documentation/devicemanagement/app_and_book_management/app_and_book_management_legacy/interpreting_error_codes
+			if vppErr.ErrorNumber == 9622 {
+				return nil, ctxerr.Wrap(ctx, fleet.NewInvalidArgumentError("token", "Invalid token. Please provide a valid content token from Apple Business Manager."))
+			}
+		}
+		return nil, ctxerr.Wrap(ctx, err, "validating VPP token with Apple")
+	}
+
+	data := fleet.VPPTokenData{
+		Token:    string(tokenBytes),
+		Location: locName,
+	}
+
+	tok, err := svc.ds.UpdateVPPToken(ctx, tokenID, &data)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "updating vpp token")
+	}
+
+	return tok, nil
+}
+
+func (svc *Service) UpdateVPPTokenTeams(ctx context.Context, tokenID uint, teamIDs []uint) (*fleet.VPPTokenDB, error) {
+	if err := svc.authz.Authorize(ctx, &fleet.AppleCSR{}, fleet.ActionWrite); err != nil {
+		return nil, err
+	}
+
+	tok, err := svc.ds.UpdateVPPTokenTeams(ctx, tokenID, teamIDs)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "updating vpp token team")
+	}
+
+	return tok, nil
+}
+
+func (svc *Service) GetVPPTokens(ctx context.Context) ([]*fleet.VPPTokenDB, error) {
+	if err := svc.authz.Authorize(ctx, &fleet.AppleCSR{}, fleet.ActionRead); err != nil {
+		return nil, err
+	}
+
+	return svc.ds.ListVPPTokens(ctx)
+}
+
+func (svc *Service) DeleteVPPToken(ctx context.Context, tokenID uint) error {
+	if err := svc.authz.Authorize(ctx, &fleet.AppleCSR{}, fleet.ActionWrite); err != nil {
+		return err
+	}
+	tok, err := svc.ds.GetVPPToken(ctx, tokenID)
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "getting vpp token")
+	}
+	if err := svc.NewActivity(ctx, authz.UserFromContext(ctx), fleet.ActivityDisabledVPP{
+		Location: tok.Location,
+	}); err != nil {
+		return ctxerr.Wrap(ctx, err, "create activity for delete VPP token")
+	}
+
+	return svc.ds.DeleteVPPToken(ctx, tokenID)
+}
diff --git a/ee/server/service/vulnerabilities.go b/ee/server/service/vulnerabilities.go
index 1e5583e134..c94e14c356 100644
--- a/ee/server/service/vulnerabilities.go
+++ b/ee/server/service/vulnerabilities.go
@@ -21,6 +21,7 @@ func (svc *Service) ListVulnerabilities(ctx context.Context, opt fleet.VulnListO
 	return svc.Service.ListVulnerabilities(ctx, opt)
 }
 
-func (svc *Service) Vulnerability(ctx context.Context, cve string, teamID *uint, useCVSScores bool) (*fleet.VulnerabilityWithMetadata, error) {
+func (svc *Service) Vulnerability(ctx context.Context, cve string, teamID *uint, useCVSScores bool) (vuln *fleet.VulnerabilityWithMetadata,
+	known bool, err error) {
 	return svc.Service.Vulnerability(ctx, cve, teamID, true)
 }
diff --git a/ee/vulnerability-dashboard/api/controllers/dashboard/view-welcome.js b/ee/vulnerability-dashboard/api/controllers/dashboard/view-welcome.js
index dc3d56ba7b..71069df830 100644
--- a/ee/vulnerability-dashboard/api/controllers/dashboard/view-welcome.js
+++ b/ee/vulnerability-dashboard/api/controllers/dashboard/view-welcome.js
@@ -369,74 +369,11 @@ module.exports = {
     // console.log(realDataForGraphs);
 
 
-    //  ┌─┐┌─┐┌┬┐  ┌─┐┬─┐┬┌─┐┬─┐┬┌┬┐┬ ┬  ┌─┐┬  ┬┌─┐  ┌─┐┬─┐┌─┐┌─┐┬─┐┌─┐┌─┐┌─┐
-    //  │ ┬├┤  │   ├─┘├┬┘││ │├┬┘│ │ └┬┘  │  └┐┌┘├┤   ├─┘├┬┘│ ││ ┬├┬┘├┤ └─┐└─┐
-    //  └─┘└─┘ ┴   ┴  ┴└─┴└─┘┴└─┴ ┴  ┴   └─┘ └┘ └─┘  ┴  ┴└─└─┘└─┘┴└─└─┘└─┘└─┘
 
-    // Get the JSON array of Priority CVE IDs from the platform record.
-    let platformRecord = await Platform.find({}).limit(1);
-    let priorityVulnerabilities = platformRecord[0].priorityCveIds;
-    let priorityVulnerabilitiesThatExistInTheDatabase = await Vulnerability.find({isPriority: true});
-    let cveIdsThatDontExistInTheDatabase = _.difference(priorityVulnerabilities, _.pluck(priorityVulnerabilitiesThatExistInTheDatabase, 'cveId'));
-    let priorityVulnPatchProgress = [];
-
-    // Get patch progress for priority CVE IDs that only exist in the Platform record.
-    for(let cve of cveIdsThatDontExistInTheDatabase){
-      // Trim whitespace from the CVE ID. https://github.com/fleetdm/fleet/issues/14904
-      let trimmedCveId = _.trim(cve);
-      // Check to see if a Vulnerability record has been created for this CVE ID.
-      let vulnRecordForThisCveExists = await Vulnerability.findOne({cveId: trimmedCveId, isPriority: false});
-      if(vulnRecordForThisCveExists){// If we found a Vulnerability record that matches a CVE ID, we'll update it to have `isPriority: true`.
-        let updatedVulnRecord = await Vulnerability.updateOne({id: vulnRecordForThisCveExists.id}).set({isPriority: true});
-        priorityVulnerabilitiesThatExistInTheDatabase.push(updatedVulnRecord);
-      } else {// Otherwise, we'll add 100% patch progress for this CVE.
-        let patchProgress = {
-          cveId: trimmedCveId,
-          patchProgressPercentage: 100,
-          additionalDetailsUrl: 'https://nvd.nist.gov/vuln/detail/'+ encodeURIComponent(cve),
-        };
-        priorityVulnPatchProgress.push(patchProgress);
-      }
-    }
-
-    // Get patch progress for CVEs we have records for.
-    for(let vuln of priorityVulnerabilitiesThatExistInTheDatabase) {
-      let vulnPatchProgress = _.clone(vuln);
-      vulnPatchProgress.affectedSoftware = [];
-      // Calculate how many host have been affected by this vulnerability, and how many hosts are currently affected by this vulnerability
-      let installsForThisVulnerability = await VulnerabilityInstall.find({vulnerability: vuln.id});
-      // This number will represent the number of hosts that are currently affected by the vulnerability
-      let uniqueAffectedHosts = _.uniq(_.pluck(installsForThisVulnerability, 'host'));
-
-      let resolvedInstallsForThisVuln = [];
-      let affectedSoftwareForThisVulnerability = [];
-      vulnPatchProgress.numberOfHostsAffected = uniqueAffectedHosts.length;
-      for(let install of installsForThisVulnerability) {
-        // If the install has a non-zero uninstalledAt value, then it has been uninstalled.
-        if(install.uninstalledAt !== 0) {
-          // If this is a resolved install, we'll check the other installs for this vulnerability to see if there is an unresolved VulnerabilityInstall for this host.
-          if(!_.find(installsForThisVulnerability, {host: install.host, uninstalledAt: 0})){
-            // If an unresolved vulnerabilityInstall record affecting this host is found, we won't count this vulnerability as resolved for this host.
-            resolvedInstallsForThisVuln.push(install);
-          }
-        }
-        affectedSoftwareForThisVulnerability.push({name: install.softwareName, version: install.versionName, url: sails.config.custom.fleetBaseUrl+'/software/'+install.fleetApid });
-      }//∞
-
-      // Get the number of unique hosts who were previosuly affected by this vulnerability.
-      let uniqNumberOfResolvedInstallsForThisVuln = _.uniq(resolvedInstallsForThisVuln, 'host').length;
-      vulnPatchProgress.affectedSoftware = _.uniq(affectedSoftwareForThisVulnerability, 'url');
-      // To calculate the patch progress, we'll use the number of unique hosts who were previously affected by this vulnerability as the numerator and the number of unique hosts affected by the vulnerability as the denominator.
-      vulnPatchProgress.patchProgressPercentage = Math.floor((uniqNumberOfResolvedInstallsForThisVuln / vulnPatchProgress.numberOfHostsAffected) * 100);
-      priorityVulnPatchProgress.push(vulnPatchProgress);
-    }//∞
-
-    // Sort the priority vulnerabilities by CVE ID.
-    priorityVulnPatchProgress = _.sortBy(priorityVulnPatchProgress, 'cveId');
 
     return {
       realDataForGraphs: {
-        priorityVulnPatchProgress,
+        priorityVulnPatchProgress: [],// This information is gathered after the initial page load.
         remediationTimeline: realDataForGraphs.remediationTimeline,
         timelineDatasets: realDataForGraphs.timelineDatasets,
         newPublishedVulnerabilities:realDataForGraphs.newPublishedVulnerabilities,//last 48 hours
diff --git a/ee/vulnerability-dashboard/api/controllers/get-priority-vulnerabilities.js b/ee/vulnerability-dashboard/api/controllers/get-priority-vulnerabilities.js
new file mode 100644
index 0000000000..9f55ec19c8
--- /dev/null
+++ b/ee/vulnerability-dashboard/api/controllers/get-priority-vulnerabilities.js
@@ -0,0 +1,80 @@
+module.exports = {
+
+
+  friendlyName: 'Get priority vulnerabilities',
+
+
+  description: 'Returns information about priority CVEs.',
+  extendedDescription: 'This code was previously in the view action for the dashboard page, but was moved to a separate action to reduce inital page laoding time.',
+
+  exits: {
+    success: {
+      outputType: [{}],
+    },
+  },
+
+
+  fn: async function () {
+    //  ┌─┐┌─┐┌┬┐  ┌─┐┬─┐┬┌─┐┬─┐┬┌┬┐┬ ┬  ┌─┐┬  ┬┌─┐  ┌─┐┬─┐┌─┐┌─┐┬─┐┌─┐┌─┐┌─┐
+    //  │ ┬├┤  │   ├─┘├┬┘││ │├┬┘│ │ └┬┘  │  └┐┌┘├┤   ├─┘├┬┘│ ││ ┬├┬┘├┤ └─┐└─┐
+    //  └─┘└─┘ ┴   ┴  ┴└─┴└─┘┴└─┴ ┴  ┴   └─┘ └┘ └─┘  ┴  ┴└─└─┘└─┘┴└─└─┘└─┘└─┘
+
+    // Get the JSON array of Priority CVE IDs from the platform record.
+    let platformRecord = await Platform.find({}).limit(1);
+    let priorityVulnerabilities = platformRecord[0].priorityCveIds;
+    let priorityVulnerabilitiesThatExistInTheDatabase = await Vulnerability.find({isPriority: true});
+    let cveIdsThatDontExistInTheDatabase = _.difference(priorityVulnerabilities, _.pluck(priorityVulnerabilitiesThatExistInTheDatabase, 'cveId'));
+    let priorityVulnPatchProgress = [];
+
+    // Get patch progress for priority CVE IDs that only exist in the Platform record.
+    for(let cve of cveIdsThatDontExistInTheDatabase){
+      // Trim whitespace from the CVE ID. https://github.com/fleetdm/fleet/issues/14904
+      let trimmedCveId = _.trim(cve);
+      // Check to see if a Vulnerability record has been created for this CVE ID.
+      let vulnRecordForThisCveExists = await Vulnerability.findOne({cveId: trimmedCveId, isPriority: false});
+      if(vulnRecordForThisCveExists){// If we found a Vulnerability record that matches a CVE ID, we'll update it to have `isPriority: true`.
+        let updatedVulnRecord = await Vulnerability.updateOne({id: vulnRecordForThisCveExists.id}).set({isPriority: true});
+        priorityVulnerabilitiesThatExistInTheDatabase.push(updatedVulnRecord);
+      } else {// Otherwise, we'll add 100% patch progress for this CVE.
+        let patchProgress = {
+          cveId: trimmedCveId,
+          patchProgressPercentage: 100,
+          additionalDetailsUrl: 'https://nvd.nist.gov/vuln/detail/'+ encodeURIComponent(cve),
+        };
+        priorityVulnPatchProgress.push(patchProgress);
+      }
+    }
+
+    // Get patch progress for CVEs we have records for.
+    for(let vuln of priorityVulnerabilitiesThatExistInTheDatabase) {
+      let vulnPatchProgress = _.clone(vuln);
+      vulnPatchProgress.affectedSoftware = [];
+      // Calculate how many host have been affected by this vulnerability, and how many hosts are currently affected by this vulnerability
+      let installsForThisVulnerability = await VulnerabilityInstall.find({vulnerability: vuln.id});
+      // This number will represent the number of hosts that have been affected by the vulnerability.
+      let uniqueAffectedHosts = _.uniq(_.pluck(installsForThisVulnerability, 'host'));
+      // Get a list of software that is currently installed and affected by this vulnerability.
+      let unresolvedInstallsForThisVuln = _.filter(installsForThisVulnerability, {uninstalledAt: 0});
+      let unresolvedHosts = _.uniq(_.pluck(unresolvedInstallsForThisVuln, 'host'));
+      let resolvedHosts = _.difference(uniqueAffectedHosts, unresolvedHosts);
+      let uniqNumberOfResolvedInstallsForThisVuln = resolvedHosts.length;
+      // Iterate through the installs for this vulnerability to build a list of software
+      await sails.helpers.flow.simultaneouslyForEach(_.uniq(installsForThisVulnerability, 'fleetApid'), (install)=>{
+        vulnPatchProgress.affectedSoftware.push({name: install.softwareName, version: install.versionName, url: sails.config.custom.fleetBaseUrl+'/software/'+install.fleetApid });
+      });
+      // Get the number of unique hosts who were previosuly affected by this vulnerability.
+      vulnPatchProgress.numberOfHostsAffected = uniqueAffectedHosts.length;
+      // To calculate the patch progress, we'll use the number of unique hosts who were previously affected by this vulnerability as the numerator and the number of unique hosts affected by the vulnerability as the denominator.
+      vulnPatchProgress.patchProgressPercentage = Math.floor((uniqNumberOfResolvedInstallsForThisVuln / vulnPatchProgress.numberOfHostsAffected) * 100);
+      priorityVulnPatchProgress.push(vulnPatchProgress);
+    }//∞
+
+    // Sort the priority vulnerabilities by CVE ID.
+    priorityVulnPatchProgress = _.sortBy(priorityVulnPatchProgress, 'cveId');
+
+    return priorityVulnPatchProgress;
+
+  }
+
+
+};
diff --git a/ee/vulnerability-dashboard/api/controllers/update-priority-vulnerabilities.js b/ee/vulnerability-dashboard/api/controllers/update-priority-vulnerabilities.js
index 6e10db81c5..92de07fc25 100644
--- a/ee/vulnerability-dashboard/api/controllers/update-priority-vulnerabilities.js
+++ b/ee/vulnerability-dashboard/api/controllers/update-priority-vulnerabilities.js
@@ -88,25 +88,17 @@ module.exports = {
       let installsForThisVulnerability = await VulnerabilityInstall.find({vulnerability: vuln.id});
       // This number will represent the number of hosts that are currently affected by the vulnerability
       let uniqueAffectedHosts = _.uniq(_.pluck(installsForThisVulnerability, 'host'));
-
-      let resolvedInstallsForThisVuln = [];
-      let affectedSoftwareForThisVulnerability = [];
-      vulnPatchProgress.numberOfHostsAffected = uniqueAffectedHosts.length;
-      for(let install of installsForThisVulnerability) {
-        // If the install has a non-zero uninstalledAt value, then it has been uninstalled.
-        if(install.uninstalledAt !== 0) {
-          // If this is a resolved install, we'll check the other installs for this vulnerability to see if there is an unresolved VulnerabilityInstall for this host.
-          if(!_.find(installsForThisVulnerability, {host: install.host, uninstalledAt: 0})){
-            // If an unresolved vulnerabilityInstall record affecting this host is found, we won't count this vulnerability as resolved for this host.
-            resolvedInstallsForThisVuln.push(install);
-          }
-        }
-        affectedSoftwareForThisVulnerability.push({name: install.softwareName, version: install.versionName, url: sails.config.custom.fleetBaseUrl+'/software/'+install.fleetApid });
-      }//∞
-
+      // Get a list of software that is currently installed and affected by this vulnerability.
+      let unresolvedInstallsForThisVuln = _.filter(installsForThisVulnerability, {uninstalledAt: 0});
+      let unresolvedHosts = _.uniq(_.pluck(unresolvedInstallsForThisVuln, 'host'));
+      let resolvedHosts = _.difference(uniqueAffectedHosts, unresolvedHosts);
+      let uniqNumberOfResolvedInstallsForThisVuln = resolvedHosts.length;
+      // Iterate through the installs for this vulnerability to build a list of software
+      await sails.helpers.flow.simultaneouslyForEach(_.uniq(installsForThisVulnerability, 'fleetApid'), (install)=>{
+        vulnPatchProgress.affectedSoftware.push({name: install.softwareName, version: install.versionName, url: sails.config.custom.fleetBaseUrl+'/software/'+install.fleetApid });
+      });
       // Get the number of unique hosts who were previosuly affected by this vulnerability.
-      let uniqNumberOfResolvedInstallsForThisVuln = _.uniq(resolvedInstallsForThisVuln, 'host').length;
-      vulnPatchProgress.affectedSoftware = _.uniq(affectedSoftwareForThisVulnerability, 'url');
+      vulnPatchProgress.numberOfHostsAffected = uniqueAffectedHosts.length;
       // To calculate the patch progress, we'll use the number of unique hosts who were previously affected by this vulnerability as the numerator and the number of unique hosts affected by the vulnerability as the denominator.
       vulnPatchProgress.patchProgressPercentage = Math.floor((uniqNumberOfResolvedInstallsForThisVuln / vulnPatchProgress.numberOfHostsAffected) * 100);
       priorityVulnPatchProgress.push(vulnPatchProgress);
diff --git a/ee/vulnerability-dashboard/assets/js/cloud.setup.js b/ee/vulnerability-dashboard/assets/js/cloud.setup.js
index e230bec296..b4d0951c46 100644
--- a/ee/vulnerability-dashboard/assets/js/cloud.setup.js
+++ b/ee/vulnerability-dashboard/assets/js/cloud.setup.js
@@ -13,7 +13,7 @@
 Cloud.setup({
 
   /* eslint-disable */
-  methods: {"logout":{"verb":"GET","url":"/api/v1/account/logout","args":[]},"updatePassword":{"verb":"PUT","url":"/api/v1/account/update-password","args":["password"]},"updateProfile":{"verb":"PUT","url":"/api/v1/account/update-profile","args":["fullName","emailAddress"]},"login":{"verb":"PUT","url":"/api/v1/entrance/login","args":["emailAddress","password","rememberMe"]},"sendPasswordRecoveryEmail":{"verb":"POST","url":"/api/v1/entrance/send-password-recovery-email","args":["emailAddress"]},"updatePasswordAndLogin":{"verb":"POST","url":"/api/v1/entrance/update-password-and-login","args":["password","token"]},"signupOktaUserOrRedirect":{"verb":"GET","url":"/entrance/signup-okta-user-or-redirect","args":[]},"getVulnerabilities":{"verb":"GET","url":"/api/v1/get-vulnerabilities","args":["minSeverity","maxSeverity","sortBy","sortDirection","page","teamApid"],"protocol":"io.socket"},"getRemediationTimeline":{"verb":"GET","url":"/api/v1/get-remediation-timeline","args":["vulnerabilityId","teamApid"],"protocol":"io.socket"},"downloadVulnerabilitiesCsv":{"verb":"GET","url":"/download-vulnerabilities-csv","args":["minSeverity","maxSeverity","sortBy","sortDirection","page","teamApid","pageSize","exportType"]},"downloadOneVulnerabilityCsv":{"verb":"GET","url":"/download-one-vulnerability-csv","args":["cveId","teamApid"]},"setCompliantVersions":{"verb":"POST","url":"/api/v1/set-compliant-versions","args":["complianceType","compliantVersions"]},"updatePriorityVulnerabilities":{"verb":"GET","url":"/api/v1/update-priority-vulnerabilities","args":["newPriorityCveIds"]},"getPatchProgressForASingleTeam":{"verb":"GET","url":"/api/v1/get-patch-progress-for-a-single-team","args":["teamApid"]},"downloadUnpatchedHostsCsv":{"verb":"GET","url":"/download-unpatched-hosts-csv","args":["exportType","teamApid"]}}
+  methods: {"logout":{"verb":"GET","url":"/api/v1/account/logout","args":[]},"updatePassword":{"verb":"PUT","url":"/api/v1/account/update-password","args":["password"]},"updateProfile":{"verb":"PUT","url":"/api/v1/account/update-profile","args":["fullName","emailAddress"]},"login":{"verb":"PUT","url":"/api/v1/entrance/login","args":["emailAddress","password","rememberMe"]},"sendPasswordRecoveryEmail":{"verb":"POST","url":"/api/v1/entrance/send-password-recovery-email","args":["emailAddress"]},"updatePasswordAndLogin":{"verb":"POST","url":"/api/v1/entrance/update-password-and-login","args":["password","token"]},"signupOktaUserOrRedirect":{"verb":"GET","url":"/entrance/signup-okta-user-or-redirect","args":[]},"getPriorityVulnerabilities":{"verb":"GET","url":"/api/v1/get-priority-vulnerabilities","args":[]},"getVulnerabilities":{"verb":"GET","url":"/api/v1/get-vulnerabilities","args":["minSeverity","maxSeverity","sortBy","sortDirection","page","teamApid"],"protocol":"io.socket"},"getRemediationTimeline":{"verb":"GET","url":"/api/v1/get-remediation-timeline","args":["vulnerabilityId","teamApid"],"protocol":"io.socket"},"downloadVulnerabilitiesCsv":{"verb":"GET","url":"/download-vulnerabilities-csv","args":["minSeverity","maxSeverity","sortBy","sortDirection","page","teamApid","pageSize","exportType"]},"downloadOneVulnerabilityCsv":{"verb":"GET","url":"/download-one-vulnerability-csv","args":["cveId","teamApid"]},"setCompliantVersions":{"verb":"POST","url":"/api/v1/set-compliant-versions","args":["complianceType","compliantVersions"]},"updatePriorityVulnerabilities":{"verb":"GET","url":"/api/v1/update-priority-vulnerabilities","args":["newPriorityCveIds"]},"getPatchProgressForASingleTeam":{"verb":"GET","url":"/api/v1/get-patch-progress-for-a-single-team","args":["teamApid"]},"downloadUnpatchedHostsCsv":{"verb":"GET","url":"/download-unpatched-hosts-csv","args":["exportType","teamApid"]}}
   /* eslint-enable */
 
 });
diff --git a/ee/vulnerability-dashboard/assets/js/pages/dashboard/welcome.page.js b/ee/vulnerability-dashboard/assets/js/pages/dashboard/welcome.page.js
index d5b62c3daf..5f991bd440 100644
--- a/ee/vulnerability-dashboard/assets/js/pages/dashboard/welcome.page.js
+++ b/ee/vulnerability-dashboard/assets/js/pages/dashboard/welcome.page.js
@@ -48,6 +48,7 @@ parasails.registerPage('welcome', {
       }]
     };
     await this.drawGraphsOnPage();
+    await this.getPriorityCves();
   },
 
   //  ╦╔╗╔╔╦╗╔═╗╦═╗╔═╗╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
@@ -56,7 +57,6 @@ parasails.registerPage('welcome', {
   methods: {
     clickOpenEditModal: function () {
       this.formData.priorityCves = _.pluck(this.dataForGraphs.priorityVulnPatchProgress, 'cveId');
-      console.log(this.formData);
       this.modal = 'priority-cves';
     },
     handleSubmittingPriorityCveForm: async function(argins) {
@@ -79,6 +79,12 @@ parasails.registerPage('welcome', {
       this.syncing = false;
       this.modal = '';
     },
+    getPriorityCves: async function () {
+      this.syncing = true;
+      let priorityCveProgress = await Cloud.getPriorityVulnerabilities();
+      this.dataForGraphs.priorityVulnPatchProgress = priorityCveProgress;
+      this.syncing = false;
+    },
     drawGraphsOnPage: async function(){
       new Chart('average-remediation-time', {
         type: 'line',
diff --git a/ee/vulnerability-dashboard/assets/styles/pages/dashboard/welcome.less b/ee/vulnerability-dashboard/assets/styles/pages/dashboard/welcome.less
index dcd7ced24e..4611ac980d 100644
--- a/ee/vulnerability-dashboard/assets/styles/pages/dashboard/welcome.less
+++ b/ee/vulnerability-dashboard/assets/styles/pages/dashboard/welcome.less
@@ -100,6 +100,9 @@
       text-align: center;
     }
   }
+  [purpose='loading-indicator'] {
+    .loader(@brand);
+  }
   [purpose='vuln-patch-progress-bar'] {
     width: 300px;
     height: 16px;
diff --git a/ee/vulnerability-dashboard/config/routes.js b/ee/vulnerability-dashboard/config/routes.js
index 1960f3352d..cf026e4db3 100644
--- a/ee/vulnerability-dashboard/config/routes.js
+++ b/ee/vulnerability-dashboard/config/routes.js
@@ -67,7 +67,7 @@ module.exports.routes = {
   'GET  /entrance/signup-okta-user-or-redirect':    { action: 'entrance/signup-okta-user-or-redirect' },
   // 'POST  /api/v1/deliver-contact-form-message':          { action: 'deliver-contact-form-message' },
   // 'POST  /api/v1/observe-my-session':                 { action: 'observe-my-session', hasSocketFeatures: true },
-
+  'GET /api/v1/get-priority-vulnerabilities': { action: 'get-priority-vulnerabilities' },
   'GET   /api/v1/get-vulnerabilities':                { action: 'get-vulnerabilities', hasSocketFeatures: true },
   'GET   /api/v1/get-remediation-timeline':           { action: 'get-remediation-timeline', hasSocketFeatures: true  },
   'GET /download-vulnerabilities-csv':                { action: 'download-vulnerabilities-csv'},
diff --git a/ee/vulnerability-dashboard/views/pages/dashboard/welcome.ejs b/ee/vulnerability-dashboard/views/pages/dashboard/welcome.ejs
index bdc36573ba..f4fe23c906 100644
--- a/ee/vulnerability-dashboard/views/pages/dashboard/welcome.ejs
+++ b/ee/vulnerability-dashboard/views/pages/dashboard/welcome.ejs
@@ -6,14 +6,25 @@
           <p style="font-size: 14px; margin-bottom: 0px; font-wieght: 700;">
             Priority CVEs
           </p>
-          <a purpose="edit-button" @click="clickOpenEditModal">
+          <a purpose="edit-button" @click="clickOpenEditModal" v-if="!syncing">
             <img alt="a small pencil" src="/images/pencil-14x14@2x.png">Edit
           </a>
         </div>
-          <div class="d-flex flex-column align-items-center w-100" v-if="dataForGraphs.priorityVulnPatchProgress.length === 0">
+          <div class="d-flex flex-column align-items-center w-100" v-if="dataForGraphs.priorityVulnPatchProgress.length === 0 && !syncing">
             <p class="font-weight-bold mb-1">No priority CVEs</p>
             <p class="text-muted mb-0">Configure a list <a @click="clickOpenEditModal">here</a> to track your organization's progress patching particular vulnerabilities.</p>
           </div>
+          <div class="d-flex flex-column align-items-center w-100" v-else-if="syncing">
+            <p class="font-weight-bold mb-1">Loading priority CVE progress</p>
+            <p>
+              <span purpose="loading-indicator">
+                <span class="loading-dot dot1"></span>
+                <span class="loading-dot dot2"></span>
+                <span class="loading-dot dot3"></span>
+                <span class="loading-dot dot4"></span>
+              </span>
+            </p>
+          </div>
           <div v-else>
             <p class="">This is the list of particular CVEs your organization is currently working to patch.</p>
             <table purpose="priority-cve-table" class="table table-responsive-md my-0">
diff --git a/frontend/__mocks__/policyMock.ts b/frontend/__mocks__/policyMock.ts
index b14095463e..ba60c55c74 100644
--- a/frontend/__mocks__/policyMock.ts
+++ b/frontend/__mocks__/policyMock.ts
@@ -23,6 +23,10 @@ const DEFAULT_POLICY_MOCK: IPolicyStats = {
   has_run: true,
   next_update_ms: 3600000,
   calendar_events_enabled: true,
+  install_software: {
+    name: "testSw0",
+    software_title_id: 1,
+  },
 };
 
 const createMockPolicy = (overrides?: Partial<IPolicyStats>): IPolicyStats => {
diff --git a/frontend/__mocks__/scriptMock.ts b/frontend/__mocks__/scriptMock.ts
index bb57b11857..ff8d635122 100644
--- a/frontend/__mocks__/scriptMock.ts
+++ b/frontend/__mocks__/scriptMock.ts
@@ -24,6 +24,7 @@ const DEFAULT_SCRIPT_RESULT_MOCK: IScriptResultResponse = {
   runtime: 0,
   host_timeout: false,
   script_id: 1,
+  created_at: "2020-01-01T00:00:00.000Z",
 };
 
 export const createMockScriptResult = (
diff --git a/frontend/__mocks__/softwareMock.ts b/frontend/__mocks__/softwareMock.ts
index 2846b18dde..fb2fc313ba 100644
--- a/frontend/__mocks__/softwareMock.ts
+++ b/frontend/__mocks__/softwareMock.ts
@@ -14,6 +14,8 @@ import {
   ISoftwareVersionsResponse,
   ISoftwareVersionResponse,
 } from "services/entities/software";
+import { IOSVersionsResponse } from "../services/entities/operating_systems";
+import { IOperatingSystemVersion } from "../interfaces/operating_system";
 
 const DEFAULT_SOFTWARE_MOCK: ISoftware = {
   hosts_count: 1,
@@ -93,17 +95,54 @@ const DEFAULT_SOFTWARE_VERSIONS_RESPONSE_MOCK: ISoftwareVersionsResponse = {
   },
 };
 
-export const createMockSoftwareVersionsReponse = (
+export const createMockSoftwareVersionsResponse = (
   overrides?: Partial<ISoftwareVersionsResponse>
 ): ISoftwareVersionsResponse => {
   return { ...DEFAULT_SOFTWARE_VERSIONS_RESPONSE_MOCK, ...overrides };
 };
 
+const DEFAULT_OS_VERSION_MOCK = {
+  os_version_id: 1,
+  name: "macOS 14.6.1",
+  name_only: "macOS",
+  version: "14.6.1",
+  platform: "darwin",
+  hosts_count: 42,
+  generated_cpes: [],
+  vulnerabilities: [],
+};
+
+export const createMockOSVersion = (
+  overrides?: Partial<IOperatingSystemVersion>
+): IOperatingSystemVersion => {
+  return {
+    ...DEFAULT_OS_VERSION_MOCK,
+    ...overrides,
+  };
+};
+
+const DEFAULT_OS_VERSIONS_RESPONSE_MOCK: IOSVersionsResponse = {
+  counts_updated_at: "2020-01-01T00:00:00.000Z",
+  count: 1,
+  os_versions: [createMockOSVersion()],
+  meta: {
+    has_next_results: false,
+    has_previous_results: false,
+  },
+};
+
+export const createMockOSVersionsResponse = (
+  overrides?: Partial<IOSVersionsResponse>
+): IOSVersionsResponse => {
+  return { ...DEFAULT_OS_VERSIONS_RESPONSE_MOCK, ...overrides };
+};
+
 const DEFAULT_APP_STORE_APP_MOCK: IAppStoreApp = {
   name: "test app",
   app_store_id: 1,
   icon_url: "https://via.placeholder.com/512",
   latest_version: "1.2.3",
+  self_service: true,
   status: {
     installed: 1,
     pending: 2,
@@ -165,8 +204,10 @@ const DEFAULT_SOFTWARE_PACKAGE_MOCK: ISoftwarePackage = {
   icon_url: null,
   status: {
     installed: 1,
-    pending: 2,
-    failed: 3,
+    pending_install: 2,
+    failed_install: 1,
+    pending_uninstall: 1,
+    failed_uninstall: 1,
   },
 };
 
@@ -207,7 +248,7 @@ const DEFAULT_SOFTWARE_TITLES_RESPONSE_MOCK: ISoftwareTitlesResponse = {
   },
 };
 
-export const createMockSoftwareTitlesReponse = (
+export const createMockSoftwareTitlesResponse = (
   overrides?: Partial<ISoftwareTitlesResponse>
 ): ISoftwareTitlesResponse => {
   return { ...DEFAULT_SOFTWARE_TITLES_RESPONSE_MOCK, ...overrides };
diff --git a/frontend/components/ActivityDetails/InstallDetails/SoftwareInstallDetails/SoftwareInstallDetails.tsx b/frontend/components/ActivityDetails/InstallDetails/SoftwareInstallDetails/SoftwareInstallDetails.tsx
index 61c2d5f04f..42ed1d6dd3 100644
--- a/frontend/components/ActivityDetails/InstallDetails/SoftwareInstallDetails/SoftwareInstallDetails.tsx
+++ b/frontend/components/ActivityDetails/InstallDetails/SoftwareInstallDetails/SoftwareInstallDetails.tsx
@@ -1,5 +1,6 @@
 import React from "react";
 import { useQuery } from "react-query";
+import { formatDistanceToNow } from "date-fns";
 
 import { IActivityDetails } from "interfaces/activity";
 import {
@@ -29,7 +30,14 @@ export type IPackageInstallDetails = Pick<
 >;
 
 const StatusMessage = ({
-  result: { host_display_name, software_package, software_title, status },
+  result: {
+    host_display_name,
+    software_package,
+    software_title,
+    status,
+    updated_at,
+    created_at,
+  },
 }: {
   result: ISoftwareInstallResult;
 }) => {
@@ -38,13 +46,24 @@ const StatusMessage = ({
   ) : (
     "the host"
   );
+
+  const timeStamp = updated_at || created_at;
+  const displayTimeStamp = ["failed_install", "installed"].includes(
+    status || ""
+  )
+    ? ` (${formatDistanceToNow(new Date(timeStamp), {
+        includeSeconds: true,
+        addSuffix: true,
+      })})`
+    : "";
   return (
     <div className={`${baseClass}__status-message`}>
       <Icon name={INSTALL_DETAILS_STATUS_ICONS[status]} />
       <span>
         Fleet {getInstallDetailsStatusPredicate(status)} <b>{software_title}</b>{" "}
         ({software_package}) on {formattedHost}
-        {status === "pending" ? " when it comes online" : ""}.
+        {status === "pending_install" ? " when it comes online" : ""}
+        {displayTimeStamp}.
       </span>
     </div>
   );
@@ -104,7 +123,7 @@ export const SoftwareInstallDetails = ({
             result.host_display_name ? result : { ...result, host_display_name } // prefer result.host_display_name (it may be empty if the host was deleted) otherwise default to whatever we received via props
           }
         />
-        {result.status !== "pending" && (
+        {result.status !== "pending_install" && (
           <>
             {result.pre_install_query_output && (
               <Output displayKey="pre_install_query_output" result={result} />
diff --git a/frontend/components/ActivityDetails/InstallDetails/SoftwareUninstallDetailsModal/SoftwareUninstallDetailsModal.tsx b/frontend/components/ActivityDetails/InstallDetails/SoftwareUninstallDetailsModal/SoftwareUninstallDetailsModal.tsx
new file mode 100644
index 0000000000..dfb4ef13c9
--- /dev/null
+++ b/frontend/components/ActivityDetails/InstallDetails/SoftwareUninstallDetailsModal/SoftwareUninstallDetailsModal.tsx
@@ -0,0 +1,157 @@
+import Button from "components/buttons/Button";
+import DataError from "components/DataError";
+import Icon from "components/Icon";
+import Modal from "components/Modal";
+import Spinner from "components/Spinner";
+import Textarea from "components/Textarea";
+import { formatDistanceToNow } from "date-fns";
+import { IActivityDetails } from "interfaces/activity";
+import { isPendingStatus, SoftwareInstallStatus } from "interfaces/software";
+import React from "react";
+import { useQuery } from "react-query";
+import scriptsAPI, { IScriptResultResponse } from "services/entities/scripts";
+import { DEFAULT_USE_QUERY_OPTIONS } from "utilities/constants";
+import {
+  getInstallDetailsStatusPredicate,
+  INSTALL_DETAILS_STATUS_ICONS,
+} from "../constants";
+
+const baseClass = "software-uninstall-details-modal";
+
+type ISoftwareUninstallDetails = Pick<
+  IActivityDetails,
+  "script_execution_id" | "host_display_name" | "software_title" | "status"
+>;
+// TODO - rely on activity created_at for timestamp? what else?
+
+interface IUninstallStatusMessage {
+  host_display_name: string;
+  // TODO - improve status typing
+  status: string;
+  software_title: string;
+  timestamp: string;
+}
+
+const StatusMessage = ({
+  host_display_name,
+  status,
+  software_title,
+  timestamp,
+}: IUninstallStatusMessage) => {
+  const formattedHost = host_display_name ? (
+    <b>{host_display_name}</b>
+  ) : (
+    "the host"
+  );
+
+  const isPending = isPendingStatus(status);
+  const displayTimeStamp =
+    !isPending && timestamp
+      ? ` (${formatDistanceToNow(new Date(timestamp), {
+          includeSeconds: true,
+          addSuffix: true,
+        })})`
+      : "";
+  return (
+    <div className={`${baseClass}__status-message`}>
+      <Icon
+        name={INSTALL_DETAILS_STATUS_ICONS[status as SoftwareInstallStatus]}
+      />
+      <span>
+        Fleet {getInstallDetailsStatusPredicate(status)} <b>{software_title}</b>{" "}
+        from {formattedHost}
+        {isPending ? " when it comes online" : ""}
+        {displayTimeStamp}.
+      </span>
+    </div>
+  );
+};
+
+const SoftwareUninstallDetailsModal = ({
+  details,
+  onCancel,
+}: {
+  details: ISoftwareUninstallDetails;
+  onCancel: () => void;
+}) => {
+  const SoftwareUninstallDetails = ({
+    script_execution_id = "",
+    host_display_name = "",
+    software_title = "",
+    status = "",
+  }: ISoftwareUninstallDetails) => {
+    const {
+      data: scriptResult,
+      isLoading,
+      isError,
+    } = useQuery<IScriptResultResponse>(
+      ["uninstallResult", details.script_execution_id],
+      () => {
+        return scriptsAPI.getScriptResult(script_execution_id);
+      },
+      { ...DEFAULT_USE_QUERY_OPTIONS }
+    );
+
+    if (isLoading) {
+      return <Spinner />;
+    } else if (isError) {
+      return <DataError description="Close this modal and try again." />;
+    } else if (!scriptResult) {
+      // FIXME: Find a better solution for this.
+      return <DataError description="No data returned." />;
+    }
+
+    status = status === "failed" ? "failed_uninstall" : status;
+
+    return (
+      <>
+        <StatusMessage
+          host_display_name={host_display_name}
+          status={status}
+          software_title={software_title}
+          timestamp={scriptResult.created_at}
+        />
+        {!isPendingStatus(status) && scriptResult && (
+          <>
+            <div className={`${baseClass}__script-output`}>
+              Uninstall script content:
+              <Textarea className={`${baseClass}__output-textarea`}>
+                {scriptResult.script_contents}
+              </Textarea>
+            </div>
+
+            <div className={`${baseClass}__script-output`}>
+              Uninstall script output:
+              <Textarea className={`${baseClass}__output-textarea`}>
+                {scriptResult.output}
+              </Textarea>
+            </div>
+          </>
+        )}
+      </>
+    );
+  };
+
+  return (
+    <Modal
+      title="Uninstall details"
+      onExit={onCancel}
+      onEnter={onCancel}
+      width="large"
+      className={baseClass}
+    >
+      <>
+        <div className={`${baseClass}__modal-content`}>
+          <SoftwareUninstallDetails {...details} />
+        </div>
+        <div className="modal-cta-wrap">
+          <Button onClick={onCancel} variant="brand">
+            Done
+          </Button>
+        </div>
+      </>
+    </Modal>
+  );
+};
+
+export default SoftwareUninstallDetailsModal;
diff --git a/frontend/components/ActivityDetails/InstallDetails/SoftwareUninstallDetailsModal/_styles.scss b/frontend/components/ActivityDetails/InstallDetails/SoftwareUninstallDetailsModal/_styles.scss
new file mode 100644
index 0000000000..ca0ad4a2c1
--- /dev/null
+++ b/frontend/components/ActivityDetails/InstallDetails/SoftwareUninstallDetailsModal/_styles.scss
@@ -0,0 +1,23 @@
+.software-uninstall-details-modal {
+  &__modal-content {
+    display: flex;
+    flex-direction: column;
+    gap: 2rem;
+  }
+  &__status-message {
+    display: flex;
+    align-items: center;
+    gap: $pad-small;
+    margin: 0;
+    .icon {
+      align-self: flex-start;
+    }
+  }
+  &__script-output {
+    .textarea {
+      margin-top: $pad-medium;
+      overflow-wrap: break-word;
+      font-family: "SourceCodePro", $monospace;
+    }
+  }
+}
diff --git a/frontend/components/ActivityDetails/InstallDetails/SoftwareUninstallDetailsModal/index.ts b/frontend/components/ActivityDetails/InstallDetails/SoftwareUninstallDetailsModal/index.ts
new file mode 100644
index 0000000000..c57d50fe8d
--- /dev/null
+++ b/frontend/components/ActivityDetails/InstallDetails/SoftwareUninstallDetailsModal/index.ts
@@ -0,0 +1 @@
+export { default } from "./SoftwareUninstallDetailsModal";
diff --git a/frontend/components/ActivityDetails/InstallDetails/constants.ts b/frontend/components/ActivityDetails/InstallDetails/constants.ts
index c4c1ae8cb7..255b12e5fd 100644
--- a/frontend/components/ActivityDetails/InstallDetails/constants.ts
+++ b/frontend/components/ActivityDetails/InstallDetails/constants.ts
@@ -5,30 +5,36 @@ export const INSTALL_DETAILS_STATUS_ICONS: Record<
   SoftwareInstallStatus,
   IconNames
 > = {
-  pending: "pending-outline",
+  pending_install: "pending-outline",
   installed: "success-outline",
-  failed: "error-outline",
+  uninstalled: "success-outline",
+  failed_install: "error-outline",
+  pending_uninstall: "pending-outline",
+  failed_uninstall: "error-outline",
 } as const;
 
 const INSTALL_DETAILS_STATUS_PREDICATES: Record<
   SoftwareInstallStatus,
   string
 > = {
-  pending: "is installing or will install",
+  pending_install: "is installing or will install",
   installed: "installed",
-  failed: "failed to install",
+  uninstalled: "uninstalled",
+  failed_install: "failed to install",
+  pending_uninstall: "is uninstalling or will uninstall",
+  failed_uninstall: "failed to uninstall",
 } as const;
 
 export const getInstallDetailsStatusPredicate = (
   status: string | undefined
 ) => {
   if (!status) {
-    return INSTALL_DETAILS_STATUS_PREDICATES.pending;
+    return INSTALL_DETAILS_STATUS_PREDICATES.pending_install;
   }
   return (
     INSTALL_DETAILS_STATUS_PREDICATES[
       status.toLowerCase() as SoftwareInstallStatus
-    ] || INSTALL_DETAILS_STATUS_PREDICATES.pending
+    ] || INSTALL_DETAILS_STATUS_PREDICATES.pending_install
   );
 };
 
diff --git a/frontend/components/AddHostsModal/AddHostsModal.tests.tsx b/frontend/components/AddHostsModal/AddHostsModal.tests.tsx
index 658bbd1188..2af31091f6 100644
--- a/frontend/components/AddHostsModal/AddHostsModal.tests.tsx
+++ b/frontend/components/AddHostsModal/AddHostsModal.tests.tsx
@@ -73,8 +73,9 @@ describe("AddHostsModal", () => {
     expect(screen.queryByText(/--enable-scripts/i)).not.toBeInTheDocument();
 
     await user.click(screen.getByRole("tab", { name: "iOS & iPadOS" }));
-    expect(screen.queryByText(/Apple Business Manager/i)).toBeInTheDocument();
-    expect(screen.queryByText(/Learn more/i)).toBeInTheDocument();
+    expect(
+      screen.queryByText(/Send this to your end users:/i)
+    ).toBeInTheDocument();
 
     await user.click(screen.getByRole("tab", { name: "Advanced" }));
     const advancedText = screen.getByText(/--type=YOUR_TYPE/i);
diff --git a/frontend/components/AddHostsModal/AddHostsModal.tsx b/frontend/components/AddHostsModal/AddHostsModal.tsx
index 04a42908ed..1cac771209 100644
--- a/frontend/components/AddHostsModal/AddHostsModal.tsx
+++ b/frontend/components/AddHostsModal/AddHostsModal.tsx
@@ -9,7 +9,6 @@ import Modal from "components/Modal";
 import Spinner from "components/Spinner";
 
 import PlatformWrapper from "./PlatformWrapper/PlatformWrapper";
-import DownloadInstallers from "./DownloadInstallers/DownloadInstallers";
 
 const baseClass = "add-hosts-modal";
 
diff --git a/frontend/components/AddHostsModal/PlatformWrapper/IosIpadosPanel/IosIpadosPanel.tsx b/frontend/components/AddHostsModal/PlatformWrapper/IosIpadosPanel/IosIpadosPanel.tsx
new file mode 100644
index 0000000000..7cfba0f4d2
--- /dev/null
+++ b/frontend/components/AddHostsModal/PlatformWrapper/IosIpadosPanel/IosIpadosPanel.tsx
@@ -0,0 +1,48 @@
+import React, { useContext } from "react";
+
+import { AppContext } from "context/app";
+
+// @ts-ignore
+import InputField from "components/forms/fields/InputField";
+
+const generateUrl = (serverUrl: string, enrollSecret: string) => {
+  return `${serverUrl}/enroll?enroll_secret=${encodeURIComponent(
+    enrollSecret
+  )}`;
+};
+
+const baseClass = "ios-ipados-panel";
+
+interface IosIpadosPanelProps {
+  enrollSecret: string;
+}
+
+const IosIpadosPanel = ({ enrollSecret }: IosIpadosPanelProps) => {
+  const { config } = useContext(AppContext);
+
+  const helpText =
+    "When the end user navigates to this URL, the enrollment profile " +
+    "will download in their browser. End users will have to install the profile " +
+    "to enroll to Fleet.";
+
+  if (!config) return null;
+
+  const url = generateUrl(config.server_settings.server_url, enrollSecret);
+
+  return (
+    <div className={baseClass}>
+      <InputField
+        label="Send this to your end users:"
+        enableCopy
+        copyButtonPosition="inside"
+        readOnly
+        inputWrapperClass
+        name="enroll-link"
+        value={url}
+        helpText={helpText}
+      />
+    </div>
+  );
+};
+
+export default IosIpadosPanel;
diff --git a/frontend/components/AddHostsModal/PlatformWrapper/IosIpadosPanel/_styles.scss b/frontend/components/AddHostsModal/PlatformWrapper/IosIpadosPanel/_styles.scss
new file mode 100644
index 0000000000..e781e7ca70
--- /dev/null
+++ b/frontend/components/AddHostsModal/PlatformWrapper/IosIpadosPanel/_styles.scss
@@ -0,0 +1,5 @@
+.ios-ipados-panel {
+  &__spinner {
+    margin: $pad-xxlarge auto;
+  }
+}
diff --git a/frontend/components/AddHostsModal/PlatformWrapper/IosIpadosPanel/index.ts b/frontend/components/AddHostsModal/PlatformWrapper/IosIpadosPanel/index.ts
new file mode 100644
index 0000000000..4dc628ef88
--- /dev/null
+++ b/frontend/components/AddHostsModal/PlatformWrapper/IosIpadosPanel/index.ts
@@ -0,0 +1 @@
+export { default } from "./IosIpadosPanel";
diff --git a/frontend/components/AddHostsModal/PlatformWrapper/PlatformWrapper.tsx b/frontend/components/AddHostsModal/PlatformWrapper/PlatformWrapper.tsx
index f10fbead55..a2a8ccb1d1 100644
--- a/frontend/components/AddHostsModal/PlatformWrapper/PlatformWrapper.tsx
+++ b/frontend/components/AddHostsModal/PlatformWrapper/PlatformWrapper.tsx
@@ -19,6 +19,7 @@ import InfoBanner from "components/InfoBanner/InfoBanner";
 import CustomLink from "components/CustomLink/CustomLink";
 
 import { isValidPemCertificate } from "../../../pages/hosts/ManageHostsPage/helpers";
+import IosIpadosPanel from "./IosIpadosPanel";
 
 interface IPlatformSubNav {
   name: string;
@@ -324,7 +325,7 @@ const PlatformWrapper = ({
     );
   };
 
-  const renderTab = (packageType: string) => {
+  const renderPanel = (packageType: string) => {
     const CHROME_OS_INFO = {
       extensionId: "fleeedmmihkfkeemmipgmhhjemlljidg",
       installationUrl: "https://chrome.fleetdm.com/updates.xml",
@@ -395,19 +396,7 @@ const PlatformWrapper = ({
     }
 
     if (packageType === "ios-ipados") {
-      return (
-        <div className={`${baseClass}__ios-ipados--info`}>
-          <p>
-            Enroll iPhones and iPads by adding them to Fleet in Apple Business
-            Manager (ABM).{" "}
-            <CustomLink
-              url="https://fleetdm.com/learn-more-about/setup-abm"
-              text="Learn more"
-              newTab
-            />
-          </p>
-        </div>
-      );
+      return <IosIpadosPanel enrollSecret={enrollSecret} />;
     }
 
     if (packageType === "advanced") {
@@ -590,7 +579,7 @@ const PlatformWrapper = ({
             return (
               <TabPanel className={`${baseClass}__info`} key={navItem.type}>
                 <div className={`${baseClass} form`}>
-                  {renderTab(navItem.type)}
+                  {renderPanel(navItem.type)}
                 </div>
               </TabPanel>
             );
diff --git a/frontend/components/App/App.tsx b/frontend/components/App/App.tsx
index 5f9de3e3b9..da850f26d0 100644
--- a/frontend/components/App/App.tsx
+++ b/frontend/components/App/App.tsx
@@ -1,6 +1,8 @@
 import React, { useContext, useEffect, useState } from "react";
 import { AxiosError, AxiosResponse } from "axios";
 import { useQuery } from "react-query";
+import { ErrorBoundary } from "react-error-boundary";
+import { isBefore } from "date-fns";
 
 import page_titles from "router/page_titles";
 import TableProvider from "context/table";
@@ -10,25 +12,27 @@ import NotificationProvider from "context/notification";
 import { AppContext } from "context/app";
 import { authToken, clearToken } from "utilities/local";
 import useDeepEffect from "hooks/useDeepEffect";
-
+import { QueryParams } from "utilities/url";
+import { DEFAULT_USE_QUERY_OPTIONS } from "utilities/constants";
 import usersAPI from "services/entities/users";
 import configAPI from "services/entities/config";
 import hostCountAPI from "services/entities/host_count";
 import mdmAppleBMAPI, {
-  IGetAppleBMInfoResponse,
+  IGetAbmTokensResponse,
 } from "services/entities/mdm_apple_bm";
-import mdmAppleAPI from "services/entities/mdm_apple";
+import mdmAppleAPI, {
+  IGetVppTokensResponse,
+} from "services/entities/mdm_apple";
 
-import { ErrorBoundary } from "react-error-boundary";
 // @ts-ignore
 import Fleet403 from "pages/errors/Fleet403";
 // @ts-ignore
 import Fleet404 from "pages/errors/Fleet404";
 // @ts-ignore
 import Fleet500 from "pages/errors/Fleet500";
+
 import Spinner from "components/Spinner";
-import { QueryParams } from "utilities/url";
-import { DEFAULT_USE_QUERY_OPTIONS } from "utilities/constants";
+import { IMdmVppToken } from "interfaces/mdm";
 
 interface IAppProps {
   children: JSX.Element;
@@ -40,6 +44,29 @@ interface IAppProps {
   };
 }
 
+interface RecordWithRenewDate {
+  renew_date: string;
+}
+
+const GUARANTEED_PAST_DATE = "2000-01-01T01:00:00Z";
+
+// TODO: add tests for this function
+const getEarliestExpiry = (records: RecordWithRenewDate[]): string => {
+  const earliest = records.reduce((acc, record) => {
+    const renewDate = new Date(record.renew_date);
+    return isBefore(acc, renewDate) ? acc : renewDate;
+  }, new Date(NaN));
+
+  if (isNaN(earliest.valueOf())) {
+    // this should never happen assuming the API always returns valid dates, but just in case we'll
+    // return a guaranteed past date and log a warning to aid debugging
+    console.warn("No valid renew dates found, returning guaranteed past date.");
+    return GUARANTEED_PAST_DATE;
+  }
+
+  return earliest.toISOString();
+};
+
 const baseClass = "app";
 
 const App = ({ children, location }: IAppProps): JSX.Element => {
@@ -66,22 +93,30 @@ const App = ({ children, location }: IAppProps): JSX.Element => {
   // We will do a series of API calls to get the data that we need to display
   // warnings to the user about various token expirations.
 
-  // Get the Apple Business Manager token expiration date
-  useQuery<IGetAppleBMInfoResponse, AxiosError>(
-    ["abm"],
-    () => mdmAppleBMAPI.getAppleBMInfo(),
+  // Get the ABM tokens
+  useQuery<IGetAbmTokensResponse, AxiosError>(
+    ["abm_tokens"],
+    () => mdmAppleBMAPI.getTokens(),
     {
       ...DEFAULT_USE_QUERY_OPTIONS,
-      enabled: !!isGlobalAdmin && !!config?.mdm.apple_bm_enabled_and_configured,
-      onSuccess: (data) => {
-        setABMExpiry(data.renew_date);
+      enabled: !!isGlobalAdmin && !!config?.mdm.enabled_and_configured,
+      onSuccess: ({ abm_tokens }) => {
+        abm_tokens.length &&
+          setABMExpiry({
+            earliestExpiry: getEarliestExpiry(abm_tokens),
+            needsAbmTermsRenewal: abm_tokens.some(
+              (token) => token.terms_expired
+            ),
+          });
       },
+      // TODO: Do we need to catch and check for a 400 status code? The old
+      // API behaved this way when the token is already expired or invalid.
       onError: (err) => {
-        // we need to catch and check for a 400 status code because the
-        // API behaves this way when the token is already expired or invalid.
         if (err.status === 400) {
-          const GUARANTEED_PAST_DATE = "2000-01-01T01:00:00Z";
-          setABMExpiry(GUARANTEED_PAST_DATE);
+          setABMExpiry({
+            earliestExpiry: GUARANTEED_PAST_DATE,
+            needsAbmTermsRenewal: true, // TODO: if order of precedence for banners changes, we may need to upate this
+          });
         }
       },
     }
@@ -96,14 +131,18 @@ const App = ({ children, location }: IAppProps): JSX.Element => {
     },
   });
 
-  // Get the Apple Push VPP token expiration date
-  useQuery(["vppToken"], () => mdmAppleAPI.getVppInfo(), {
-    ...DEFAULT_USE_QUERY_OPTIONS,
-    enabled: !!isGlobalAdmin && !!config?.mdm.enabled_and_configured,
-    onSuccess: (data) => {
-      setVppExpiry(data.renew_date);
-    },
-  });
+  // Get the Apple VPP token expiration date
+  useQuery<IGetVppTokensResponse>(
+    ["vpp_tokens"],
+    () => mdmAppleAPI.getVppTokens(),
+    {
+      ...DEFAULT_USE_QUERY_OPTIONS,
+      enabled: !!isGlobalAdmin && !!config?.mdm.enabled_and_configured,
+      onSuccess: ({ vpp_tokens }) => {
+        vpp_tokens.length && setVppExpiry(getEarliestExpiry(vpp_tokens));
+      },
+    }
+  );
 
   const fetchConfig = async () => {
     try {
diff --git a/frontend/components/ClickableUrls/ClickableUrls.tsx b/frontend/components/ClickableUrls/ClickableUrls.tsx
index 444dee0f3d..2dffcc2d63 100644
--- a/frontend/components/ClickableUrls/ClickableUrls.tsx
+++ b/frontend/components/ClickableUrls/ClickableUrls.tsx
@@ -20,21 +20,19 @@ const ClickableUrls = ({ text, className }: IClickableUrls): JSX.Element => {
   const clickableUrlClasses = classnames(baseClass, className);
 
   // Regex to find case insensitive URLs and replace with link
-  const replacedLinks = text.replaceAll(
+  const textWithLinks = text.replaceAll(
     /(((https?)?(:\/\/))|((https?)?(:\/\/)?(www\.)))[-a-zA-Z0-9@:%._+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b([-a-zA-Z0-9()@:%_+.~#?&//=]*)/g,
     urlReplacer
   );
-  const sanitizedResolutionContent = DOMPurify.sanitize(replacedLinks, {
+  const sanitizedTextWithLinks = DOMPurify.sanitize(textWithLinks, {
     ADD_ATTR: ["target"], // Allows opening in a new tab
   });
 
-  const textWithLinks = (
+  return (
     <div
       className={clickableUrlClasses}
-      dangerouslySetInnerHTML={{ __html: sanitizedResolutionContent }}
+      dangerouslySetInnerHTML={{ __html: sanitizedTextWithLinks }}
     />
   );
-
-  return textWithLinks;
 };
 export default ClickableUrls;
diff --git a/frontend/components/Editor/Editor.tsx b/frontend/components/Editor/Editor.tsx
index e8f230e379..b724a296c3 100644
--- a/frontend/components/Editor/Editor.tsx
+++ b/frontend/components/Editor/Editor.tsx
@@ -29,6 +29,10 @@ interface IEditorProps {
    * @default "editor"
    */
   name?: string;
+  /** Include correct styles as a form field.
+   * @default false
+   */
+  isFormField?: boolean;
   maxLines?: number;
   className?: string;
   onChange?: (value: string, event?: any) => void;
@@ -52,11 +56,13 @@ const Editor = ({
   readOnly = false,
   wrapEnabled = false,
   name = "editor",
+  isFormField = false,
   maxLines = 20,
   className,
   onChange,
 }: IEditorProps) => {
   const classNames = classnames(baseClass, className, {
+    "form-field": isFormField,
     [`${baseClass}__error`]: !!error,
   });
 
diff --git a/frontend/components/Editor/_styles.scss b/frontend/components/Editor/_styles.scss
index 676172697d..22fbacfd33 100644
--- a/frontend/components/Editor/_styles.scss
+++ b/frontend/components/Editor/_styles.scss
@@ -3,7 +3,6 @@
   &__label {
     font-size: $x-small;
     font-weight: $bold;
-    margin-bottom: $pad-small;
 
     &--error {
       color: $core-vibrant-red;
diff --git a/frontend/components/EmptyTable/_styles.scss b/frontend/components/EmptyTable/_styles.scss
index 2aa30b7d68..76591c83e8 100644
--- a/frontend/components/EmptyTable/_styles.scss
+++ b/frontend/components/EmptyTable/_styles.scss
@@ -4,7 +4,7 @@
     flex-direction: column;
     align-items: center;
     margin: 96px auto; // 96px to top of div
-    max-width: 450px; // standard empty state width
+    max-width: 500px; // standard empty state width
     gap: $pad-medium; // 16px between image, text, and buttons
   }
 
diff --git a/frontend/components/FileDetails/FileDetails.tsx b/frontend/components/FileDetails/FileDetails.tsx
new file mode 100644
index 0000000000..78d48d5bde
--- /dev/null
+++ b/frontend/components/FileDetails/FileDetails.tsx
@@ -0,0 +1,64 @@
+import React from "react";
+
+import { ISupportedGraphicNames } from "components/FileUploader/FileUploader";
+import Graphic from "components/Graphic";
+import Button from "components/buttons/Button";
+import Icon from "components/Icon";
+
+interface IFileDetailsProps {
+  graphicNames: ISupportedGraphicNames | ISupportedGraphicNames[];
+  fileDetails: {
+    name: string;
+    platform?: string;
+  };
+  canEdit: boolean;
+  onFileSelect: (e: React.ChangeEvent<HTMLInputElement>) => void;
+  accept?: string;
+}
+
+const baseClass = "file-details";
+
+const FileDetails = ({
+  graphicNames,
+  fileDetails,
+  canEdit,
+  onFileSelect,
+  accept,
+}: IFileDetailsProps) => {
+  return (
+    <div className={baseClass}>
+      <div className={`${baseClass}__info`}>
+        <Graphic
+          name={
+            typeof graphicNames === "string" ? graphicNames : graphicNames[0]
+          }
+        />
+        <div className={`${baseClass}__content`}>
+          <div className={`${baseClass}__name`}>{fileDetails.name}</div>
+          {fileDetails.platform && (
+            <div className={`${baseClass}__platform`}>
+              {fileDetails.platform}
+            </div>
+          )}
+        </div>
+      </div>
+      {canEdit && (
+        <div className={`${baseClass}__edit`}>
+          <Button className={`${baseClass}__edit-button`} variant="icon">
+            <label htmlFor="edit-file">
+              <Icon name="pencil" color="ui-fleet-black-75" />
+            </label>
+          </Button>
+          <input
+            accept={accept}
+            id="edit-file"
+            type="file"
+            onChange={onFileSelect}
+          />
+        </div>
+      )}
+    </div>
+  );
+};
+
+export default FileDetails;
diff --git a/frontend/components/FileDetails/_styles.scss b/frontend/components/FileDetails/_styles.scss
new file mode 100644
index 0000000000..497dabcc3d
--- /dev/null
+++ b/frontend/components/FileDetails/_styles.scss
@@ -0,0 +1,37 @@
+.file-details {
+  display: flex;
+  justify-content: space-between;
+  width: 100%;
+
+  &__info {
+    display: flex;
+    gap: $pad-medium;
+    align-items: center;
+    width: 100%;
+    text-align: left;
+  }
+
+  &__name {
+    font-size: $x-small;
+    font-weight: $bold;
+  }
+
+  &__platform {
+    font-size: $xx-small;
+    color: $ui-fleet-black-75;
+  }
+
+  &__edit {
+    display: flex;
+    align-items: center; // Center the button vertically
+    margin-right: -$pad-medium; // Adjust for button padding
+  }
+
+  label {
+    display: flex;
+
+    &:hover {
+      cursor: pointer;
+    }
+  }
+}
diff --git a/frontend/components/FileDetails/index.ts b/frontend/components/FileDetails/index.ts
new file mode 100644
index 0000000000..4341857617
--- /dev/null
+++ b/frontend/components/FileDetails/index.ts
@@ -0,0 +1 @@
+export { default } from "./FileDetails";
diff --git a/frontend/components/FileUploader/FileUploader.tsx b/frontend/components/FileUploader/FileUploader.tsx
index a79955df28..6ba3bfa42f 100644
--- a/frontend/components/FileUploader/FileUploader.tsx
+++ b/frontend/components/FileUploader/FileUploader.tsx
@@ -1,4 +1,4 @@
-import React, { ReactNode, useState } from "react";
+import React, { useState } from "react";
 import classnames from "classnames";
 
 import Button from "components/buttons/Button";
@@ -6,10 +6,11 @@ import Card from "components/Card";
 import { GraphicNames } from "components/graphics";
 import Icon from "components/Icon";
 import Graphic from "components/Graphic";
+import FileDetails from "components/FileDetails";
 
 const baseClass = "file-uploader";
 
-type ISupportedGraphicNames = Extract<
+export type ISupportedGraphicNames = Extract<
   GraphicNames,
   | "file-configuration-profile"
   | "file-sh"
@@ -23,29 +24,6 @@ type ISupportedGraphicNames = Extract<
   | "file-vpp"
 >;
 
-export const FileDetails = ({
-  details: { name, platform },
-  graphicName = "file-pkg",
-}: {
-  details: {
-    name: string;
-    platform?: string;
-  };
-  graphicName?: ISupportedGraphicNames;
-}) => (
-  <div className={`${baseClass}__selected-file`}>
-    <Graphic name={graphicName} />
-    <div className={`${baseClass}__selected-file--details`}>
-      <div className={`${baseClass}__selected-file--details--name`}>{name}</div>
-      {platform && (
-        <div className={`${baseClass}__selected-file--details--platform`}>
-          {platform}
-        </div>
-      )}
-    </div>
-  </div>
-);
-
 interface IFileUploaderProps {
   graphicName: ISupportedGraphicNames | ISupportedGraphicNames[];
   message: string;
@@ -53,8 +31,8 @@ interface IFileUploaderProps {
   /** Controls the loading spinner on the upload button */
   isLoading?: boolean;
   /** Disables the upload button */
-  diabled?: boolean;
-  /** A comma seperated string of one or more file types accepted to upload.
+  disabled?: boolean;
+  /** A comma separated string of one or more file types accepted to upload.
    * This is the same as the html accept attribute.
    * https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes/accept
    */
@@ -69,33 +47,36 @@ interface IFileUploaderProps {
    * @default "button"
    */
   buttonType?: "button" | "link";
-  /** If provided FileUploader will display this component when the file is
-   * selected. This is used for previewing the file before uploading.
-   */
-  filePreview?: ReactNode; // TODO: refactor this to be a function that returns a ReactNode?
   onFileUpload: (files: FileList | null) => void;
+  /** renders the current file with the edit pencil button */
+  canEdit?: boolean;
+  fileDetails?: {
+    name: string;
+    platform?: string;
+  };
 }
 
 /**
- * A component that encapsulates the UI for uploading a file.
+ * A component that encapsulates the UI for uploading a file and a file selected.
  */
 export const FileUploader = ({
   graphicName: graphicNames,
   message,
   additionalInfo,
   isLoading = false,
-  diabled = false,
+  disabled = false,
   accept,
-  filePreview,
   className,
   buttonMessage = "Upload",
   buttonType = "button",
   onFileUpload,
+  canEdit = false,
+  fileDetails,
 }: IFileUploaderProps) => {
-  const [isFileSelected, setIsFileSelected] = useState(false);
+  const [isFileSelected, setIsFileSelected] = useState(!!fileDetails);
 
   const classes = classnames(baseClass, className, {
-    [`${baseClass}__file-preview`]: filePreview !== undefined && isFileSelected,
+    [`${baseClass}__file-preview`]: isFileSelected,
   });
   const buttonVariant = buttonType === "button" ? "brand" : "text-icon";
 
@@ -119,35 +100,47 @@ export const FileUploader = ({
     ));
   };
 
+  const renderFileUploader = () => {
+    return (
+      <>
+        <div className={`${baseClass}__graphics`}>{renderGraphics()}</div>
+        <p className={`${baseClass}__message`}>{message}</p>
+        {additionalInfo && (
+          <p className={`${baseClass}__additional-info`}>{additionalInfo}</p>
+        )}
+        <Button
+          className={`${baseClass}__upload-button`}
+          variant={buttonVariant}
+          isLoading={isLoading}
+          disabled={disabled}
+        >
+          <label htmlFor="upload-file">
+            {buttonType === "link" && <Icon name="upload" />}
+            <span>{buttonMessage}</span>
+          </label>
+        </Button>
+        <input
+          accept={accept}
+          id="upload-file"
+          type="file"
+          onChange={onFileSelect}
+        />
+      </>
+    );
+  };
+
   return (
     <Card color="gray" className={classes}>
-      {isFileSelected && filePreview ? (
-        filePreview
+      {isFileSelected && fileDetails ? (
+        <FileDetails
+          graphicNames={graphicNames}
+          fileDetails={fileDetails}
+          canEdit={canEdit}
+          onFileSelect={onFileSelect}
+          accept={accept}
+        />
       ) : (
-        <>
-          <div className={`${baseClass}__graphics`}>{renderGraphics()}</div>
-          <p className={`${baseClass}__message`}>{message}</p>
-          {additionalInfo && (
-            <p className={`${baseClass}__additional-info`}>{additionalInfo}</p>
-          )}
-          <Button
-            className={`${baseClass}__upload-button`}
-            variant={buttonVariant}
-            isLoading={isLoading}
-            disabled={diabled}
-          >
-            <label htmlFor="upload-file">
-              {buttonType === "link" && <Icon name="upload" />}
-              <span>{buttonMessage}</span>
-            </label>
-          </Button>
-          <input
-            accept={accept}
-            id="upload-file"
-            type="file"
-            onChange={onFileSelect}
-          />
-        </>
+        renderFileUploader()
       )}
     </Card>
   );
diff --git a/frontend/components/FileUploader/_styles.scss b/frontend/components/FileUploader/_styles.scss
index b94ca3ef7c..a9df15676b 100644
--- a/frontend/components/FileUploader/_styles.scss
+++ b/frontend/components/FileUploader/_styles.scss
@@ -16,26 +16,6 @@
     padding: $pad-medium $pad-large;
   }
 
-  &__selected-file {
-    display: flex;
-    gap: $pad-medium;
-    align-items: center;
-    width: 100%;
-    text-align: left;
-
-    &--details {
-      &--name {
-        font-size: $x-small;
-        font-weight: $bold;
-      }
-
-      &--platform {
-        font-size: $xx-small;
-        color: $ui-fleet-black-75;
-      }
-    }
-  }
-
   &__graphics {
     display: flex;
     align-items: center;
@@ -56,20 +36,19 @@
   }
 
   &__upload-button {
-    margin-top: 8px;
     // we handle the padding in the label so the entire button is clickable
     padding: 0;
-  }
 
-  label {
-    padding: $pad-small $pad-medium;
-    display: flex;
-    align-items: center;
-    justify-content: center;
-    gap: $pad-small;
+    label {
+      padding: $pad-small $pad-medium;
+      display: flex;
+      align-items: center;
+      justify-content: center;
+      gap: $pad-small;
 
-    &:hover {
-      cursor: pointer;
+      &:hover {
+        cursor: pointer;
+      }
     }
   }
 }
diff --git a/frontend/components/FlashMessage/FlashMessage.tsx b/frontend/components/FlashMessage/FlashMessage.tsx
index 102b2c3601..d8c36caf6c 100644
--- a/frontend/components/FlashMessage/FlashMessage.tsx
+++ b/frontend/components/FlashMessage/FlashMessage.tsx
@@ -65,38 +65,40 @@ const FlashMessage = ({
   }
 
   return (
-    <div className={baseClasses} id={baseClasses}>
-      <div className={`${baseClass}__content`}>
-        <Icon
-          name={alertType === "success" ? "success" : "error"}
-          color="core-fleet-white"
-        />
-        <span>{message}</span>
-        {onUndoActionClick && undoAction && (
-          <Button
-            className={`${baseClass}__undo`}
-            variant="unstyled"
-            onClick={onUndoActionClick(undoAction)}
-          >
-            Undo
-          </Button>
-        )}
-      </div>
-      <div className={`${baseClass}__action`}>
-        <div className={`${baseClass}__ex`}>
-          <button
-            className={`${baseClass}__remove ${baseClass}__remove--${alertType} button--unstyled`}
-            onClick={onRemoveFlash}
-          >
-            <Icon
-              name="close"
-              color={
-                alertType === "warning-filled"
-                  ? "core-fleet-black"
-                  : "core-fleet-white"
-              }
-            />
-          </button>
+    <div className={"flash-message-container"}>
+      <div className={baseClasses} id={baseClasses}>
+        <div className={`${baseClass}__content`}>
+          <Icon
+            name={alertType === "success" ? "success" : "error"}
+            color="core-fleet-white"
+          />
+          <span>{message}</span>
+          {onUndoActionClick && undoAction && (
+            <Button
+              className={`${baseClass}__undo`}
+              variant="unstyled"
+              onClick={onUndoActionClick(undoAction)}
+            >
+              Undo
+            </Button>
+          )}
+        </div>
+        <div className={`${baseClass}__action`}>
+          <div className={`${baseClass}__ex`}>
+            <button
+              className={`${baseClass}__remove ${baseClass}__remove--${alertType} button--unstyled`}
+              onClick={onRemoveFlash}
+            >
+              <Icon
+                name="close"
+                color={
+                  alertType === "warning-filled"
+                    ? "core-fleet-black"
+                    : "core-fleet-white"
+                }
+              />
+            </button>
+          </div>
         </div>
       </div>
     </div>
diff --git a/frontend/components/FlashMessage/_styles.scss b/frontend/components/FlashMessage/_styles.scss
index 26b9ce8907..f4e67d4928 100644
--- a/frontend/components/FlashMessage/_styles.scss
+++ b/frontend/components/FlashMessage/_styles.scss
@@ -8,11 +8,18 @@
   }
 }
 
-.flash-message {
+// Allows for centering flash message for short and long, wrapped messages
+.flash-message-container {
   @include position(fixed);
   top: 80px;
-  left: 50%;
-  transform: translate(-50%, 0);
+  left: 0;
+  right: 0;
+  display: flex;
+  justify-content: center;
+  z-index: 999;
+}
+
+.flash-message {
   display: flex;
   align-items: center;
   justify-content: center;
@@ -20,11 +27,11 @@
   padding: $pad-small $pad-medium;
   z-index: 999;
   background-color: $core-vibrant-blue;
-  margin: auto;
   border: 1px solid $ui-fleet-black-10;
   box-sizing: border-box;
   box-shadow: 0px 7px 3px -5px rgba(25, 33, 71, 0.1);
   border-radius: 8px;
+  max-width: calc(100% - 64px); // Same horizontal margin as .main-content
 
   &--success {
     background-color: $ui-success;
@@ -42,7 +49,6 @@
       margin-right: 15px;
       font-size: $x-small;
       color: $core-fleet-black;
-      white-space: nowrap;
     }
   }
 
@@ -54,7 +60,6 @@
       margin-left: 15px;
       margin-right: 15px;
       font-size: $x-small;
-      white-space: nowrap;
     }
 
     .fleeticon {
@@ -65,6 +70,10 @@
       width: 16px;
       height: 16px;
     }
+
+    a {
+      color: inherit;
+    }
   }
 
   &__undo {
diff --git a/frontend/components/FleetAce/FleetAce.tsx b/frontend/components/FleetAce/FleetAce.tsx
index c30232cb59..b0422d4cde 100644
--- a/frontend/components/FleetAce/FleetAce.tsx
+++ b/frontend/components/FleetAce/FleetAce.tsx
@@ -29,6 +29,7 @@ export interface IFleetAceProps {
   label?: string;
   name?: string;
   value?: string;
+  placeholder?: string;
   readOnly?: boolean;
   maxLines?: number;
   showGutter?: boolean;
@@ -55,6 +56,7 @@ const FleetAce = ({
   labelActionComponent,
   name = "query-editor",
   value,
+  placeholder,
   readOnly,
   maxLines = 20,
   showGutter = true,
@@ -266,6 +268,7 @@ const FleetAce = ({
         showPrintMargin={false}
         theme="fleet"
         value={value}
+        placeholder={placeholder}
         width="100%"
         wrapEnabled={wrapEnabled}
         style={style}
diff --git a/frontend/components/FleetAce/_styles.scss b/frontend/components/FleetAce/_styles.scss
index c12237a3a7..f9f0dccf89 100644
--- a/frontend/components/FleetAce/_styles.scss
+++ b/frontend/components/FleetAce/_styles.scss
@@ -25,6 +25,16 @@
     }
   }
 
+  .ace_content {
+    padding-left: 4px;
+  }
+
+  .ace_placeholder {
+    font-family: "SourceCodePro", $monospace;
+    margin: initial;
+    font-size: 15px;
+  }
+
   &__help-text {
     @include help-text;
 
diff --git a/frontend/components/MDM/AppleBMRenewalMessage/AppleBMRenewalMessage.tsx b/frontend/components/MDM/AppleBMRenewalMessage/AppleBMRenewalMessage.tsx
index 819b6f4dc7..c64031d51f 100644
--- a/frontend/components/MDM/AppleBMRenewalMessage/AppleBMRenewalMessage.tsx
+++ b/frontend/components/MDM/AppleBMRenewalMessage/AppleBMRenewalMessage.tsx
@@ -16,10 +16,9 @@ const AppleBMRenewalMessage = ({ expired }: IAppleBMRenewalMessageProps) => {
       color="yellow"
       cta={
         <CustomLink
-          url="https://fleetdm.com/learn-more-about/renew-abm"
+          url="/settings/integrations/mdm/abm"
           text="Renew ABM"
-          className={`${baseClass}__new-tab`}
-          newTab
+          className={`${baseClass}`}
           color="core-fleet-black"
           iconColor="core-fleet-black"
         />
@@ -27,14 +26,16 @@ const AppleBMRenewalMessage = ({ expired }: IAppleBMRenewalMessageProps) => {
     >
       {expired ? (
         <>
-          Your Apple Business Manager (ABM) server token has expired or is
-          invalid. New macOS hosts will not automatically enroll to Fleet.
+          Your Apple Business Manager (ABM) server token has expired. macOS,
+          iOS, and iPadOS hosts won’t automatically enroll to Fleet. Users with
+          the admin role in Fleet can renew ABM.
         </>
       ) : (
         <>
           Your Apple Business Manager (ABM) server token is less than 30 days
-          from expiration. If it expires, new macOS hosts will not automatically
-          enroll to Fleet.
+          from expiration. If it expires, macOS, iOS, and iPadOS hosts won’t
+          automatically enroll to Fleet. Users with the admin role in Fleet can
+          renew ABM.
         </>
       )}
     </InfoBanner>
diff --git a/frontend/components/MDM/AppleBMTermsMessage/AppleBMTermsMessage.tsx b/frontend/components/MDM/AppleBMTermsMessage/AppleBMTermsMessage.tsx
index 432f88e55c..6fcff4be67 100644
--- a/frontend/components/MDM/AppleBMTermsMessage/AppleBMTermsMessage.tsx
+++ b/frontend/components/MDM/AppleBMTermsMessage/AppleBMTermsMessage.tsx
@@ -12,7 +12,7 @@ const AppleBMTermsMessage = () => {
       color="yellow"
       cta={
         <CustomLink
-          url="https://business.apple.com/"
+          url="https://business.apple.com/" // TODO: maybe point to new /settings/integrations/mdm/abm
           text="Go to ABM"
           className={`${baseClass}__new-tab`}
           newTab
@@ -21,10 +21,9 @@ const AppleBMTermsMessage = () => {
         />
       }
     >
-      Your organization can&apos;t automatically enroll macOS hosts until you
-      accept the new terms and conditions for Apple Business Manager (ABM). An
-      ABM administrator can accept these terms. Done? It might take some time
-      for ABM to report back to Fleet.
+      You can’t automatically enroll macOS, iOS, and iPadOS hosts until you
+      accept the new terms and conditions for your Apple Business Manager (ABM).
+      An ABM administrator can accept these terms.
     </InfoBanner>
   );
 };
diff --git a/frontend/components/MainContent/MainContent.tsx b/frontend/components/MainContent/MainContent.tsx
index 5c322637d6..6733a437cb 100644
--- a/frontend/components/MainContent/MainContent.tsx
+++ b/frontend/components/MainContent/MainContent.tsx
@@ -37,9 +37,13 @@ const MainContent = ({
     config,
     isPremiumTier,
     noSandboxHosts,
-    apnsExpiry = "",
-    abmExpiry = "",
-    vppExpiry = "",
+    isApplePnsExpired,
+    isAppleBmExpired,
+    isVppExpired,
+    needsAbmTermsRenewal,
+    willAppleBmExpire,
+    willApplePnsExpire,
+    willVppExpire,
   } = useContext(AppContext);
 
   const sandboxExpiryTime =
@@ -48,31 +52,23 @@ const MainContent = ({
       : formatDistanceToNow(new Date(sandboxExpiry));
 
   const renderAppWideBanner = () => {
-    const isAppleBmTermsExpired = config?.mdm?.apple_bm_terms_expired;
-    const isApplePnsExpired = hasLicenseExpired(apnsExpiry);
-    const willApplePnsExpireIn30Days = willExpireWithinXDays(apnsExpiry, 30);
-    const isAppleBmExpired = hasLicenseExpired(abmExpiry); // NOTE: See Rachel's related FIXME added to App.tsx in https://github.com/fleetdm/fleet/pull/19571
-    const willAppleBmExpireIn30Days = willExpireWithinXDays(abmExpiry, 30);
     const isFleetLicenseExpired = hasLicenseExpired(
       config?.license.expiration || ""
     );
 
-    const isVppExpired = hasLicenseExpired(vppExpiry);
-    const willVppExpireIn30Days = willExpireWithinXDays(vppExpiry, 30);
-
     let banner: JSX.Element | null = null;
 
     if (isPremiumTier) {
-      if (isApplePnsExpired || willApplePnsExpireIn30Days) {
+      if (isApplePnsExpired || willApplePnsExpire) {
         banner = <ApplePNCertRenewalMessage expired={isApplePnsExpired} />;
-      } else if (isAppleBmExpired || willAppleBmExpireIn30Days) {
+      } else if (isAppleBmExpired || willAppleBmExpire) {
         banner = <AppleBMRenewalMessage expired={isAppleBmExpired} />;
-      } else if (isAppleBmTermsExpired) {
+      } else if (needsAbmTermsRenewal) {
         banner = <AppleBMTermsMessage />;
+      } else if (isVppExpired || willVppExpire) {
+        banner = <VppRenewalMessage expired={isVppExpired} />;
       } else if (isFleetLicenseExpired) {
         banner = <LicenseExpirationBanner />;
-      } else if (isVppExpired || willVppExpireIn30Days) {
-        banner = <VppRenewalMessage expired={isVppExpired} />;
       }
     }
 
diff --git a/frontend/components/MainContent/banners/VppRenewalMessage/VppRenewalMessage.tsx b/frontend/components/MainContent/banners/VppRenewalMessage/VppRenewalMessage.tsx
index 4100a55474..8980f485f2 100644
--- a/frontend/components/MainContent/banners/VppRenewalMessage/VppRenewalMessage.tsx
+++ b/frontend/components/MainContent/banners/VppRenewalMessage/VppRenewalMessage.tsx
@@ -16,10 +16,9 @@ const VppRenewalMessage = ({ expired }: IVppRenewalMessageProps) => {
       color="yellow"
       cta={
         <CustomLink
-          url="https://fleetdm.com/learn-more-about/renew-vpp"
+          url="/settings/integrations/mdm/vpp"
           text="Renew VPP"
-          className={`${baseClass}__new-tab`}
-          newTab
+          className={`${baseClass}`}
           color="core-fleet-black"
           iconColor="core-fleet-black"
         />
@@ -28,13 +27,15 @@ const VppRenewalMessage = ({ expired }: IVppRenewalMessageProps) => {
       {expired ? (
         <>
           Your Volume Purchasing Program (VPP) content token has expired. You
-          can&apos;t add or install App Store apps.
+          can’t add or install App Store apps. Users with the admin role in
+          Fleet can renew VPP.
         </>
       ) : (
         <>
           Your Volume Purchasing Program (VPP) content token is less than 30
-          days from expiration. If it expires, you won&apos;t be able to add or
-          install App Store apps.
+          days from expiration. If it expires, you won’t be able to add or
+          install App Store apps. Users with the admin role in Fleet can renew
+          VPP.
         </>
       )}
     </InfoBanner>
diff --git a/frontend/components/Modal/Modal.tsx b/frontend/components/Modal/Modal.tsx
index 8d96a37818..d69c10c481 100644
--- a/frontend/components/Modal/Modal.tsx
+++ b/frontend/components/Modal/Modal.tsx
@@ -12,12 +12,25 @@ export interface IModalProps {
   children: JSX.Element;
   onExit: () => void;
   onEnter?: () => void;
-  /**     default 650px, large 800px, xlarge 850px, auto auto-width */
+  /**     medium 650px, large 800px, xlarge 850px, auto auto-width
+   * @default "medium"
+   */
   width?: ModalWidth;
-  /**    isHidden can be set true to hide the modal when opening another modal */
+  /**    isHidden can be set true to hide the modal when opening another modal
+   * @default false
+   */
   isHidden?: boolean;
-  /**    isLoading can be set true to enable targeting elements by loading state */
+  /**    isLoading can be set true to enable targeting elements by loading state
+   * @default false
+   */
   isLoading?: boolean;
+  /** `isContentDisabled` can be set to true to display the modal content as disabled.
+   * At the moment this will place an overlay over the modal content and make it
+   * unclickable. The top right will not be disabled and will still be clickable.
+   *
+   * @default false
+   */
+  isContentDisabled?: boolean;
   className?: string;
 }
 
@@ -29,6 +42,7 @@ const Modal = ({
   width = "medium",
   isHidden = false,
   isLoading = false,
+  isContentDisabled = false,
   className,
 }: IModalProps): JSX.Element => {
   useEffect(() => {
@@ -61,26 +75,30 @@ const Modal = ({
     }
   }, [onEnter]);
 
-  const modalContainerClassName = classnames(
-    `${baseClass}__modal_container`,
+  const backgroundClasses = classnames(`${baseClass}__background`, {
+    [`${baseClass}__hidden`]: isHidden,
+  });
+
+  const modalContainerClasses = classnames(
     className,
-    { [`${baseClass}__modal_container__medium`]: width === "medium" },
-    { [`${baseClass}__modal_container__large`]: width === "large" },
-    { [`${baseClass}__modal_container__xlarge`]: width === "xlarge" },
-    { [`${baseClass}__modal_container__auto`]: width === "auto" }
+    `${baseClass}__modal_container`,
+    `${baseClass}__modal_container__${width}`,
+    {
+      [`${className}__loading`]: isLoading,
+    }
   );
 
+  const contentWrapperClasses = classnames(`${baseClass}__content-wrapper`, {
+    [`${baseClass}__content-wrapper-disabled`]: isContentDisabled,
+  });
+
+  const contentClasses = classnames(`${baseClass}__content`, {
+    [`${baseClass}__content-disabled`]: isContentDisabled,
+  });
+
   return (
-    <div
-      className={`${baseClass}__background ${
-        isHidden ? `${baseClass}__hidden` : ""
-      }`}
-    >
-      <div
-        className={`${modalContainerClassName} ${
-          isLoading ? `${className}__loading` : ""
-        }`}
-      >
+    <div className={backgroundClasses}>
+      <div className={modalContainerClasses}>
         <div className={`${baseClass}__header`}>
           <span>{title}</span>
           <div className={`${baseClass}__ex`}>
@@ -89,7 +107,13 @@ const Modal = ({
             </Button>
           </div>
         </div>
-        <div className={`${baseClass}__content`}>{children}</div>
+
+        <div className={contentWrapperClasses}>
+          {isContentDisabled && (
+            <div className={`${baseClass}__disabled-overlay`} />
+          )}
+          <div className={contentClasses}>{children}</div>
+        </div>
       </div>
     </div>
   );
diff --git a/frontend/components/Modal/_styles.scss b/frontend/components/Modal/_styles.scss
index 33fc9939eb..04dc539176 100644
--- a/frontend/components/Modal/_styles.scss
+++ b/frontend/components/Modal/_styles.scss
@@ -16,7 +16,7 @@
     }
   }
 
-  &__content {
+  &__content-wrapper {
     margin-top: $pad-large;
     font-size: $x-small;
 
@@ -100,4 +100,21 @@
       width: auto;
     }
   }
+
+  // these styles are for the modal content when it is disabled
+  &__content-wrapper-disabled {
+    position: relative;
+  }
+
+  &__content-disabled {
+    transition: opacity 150ms ease-in-out;
+    opacity: 0.5; // this adds a disabled effect to the modal content
+  }
+
+  &__disabled-overlay {
+    position: absolute;
+    height: 100%;
+    width: 100%;
+    z-index: 1000;
+  }
 }
diff --git a/frontend/components/PremiumFeatureMessage/PremiumFeatureMessage.tsx b/frontend/components/PremiumFeatureMessage/PremiumFeatureMessage.tsx
index 40a7fbf775..7b07e1dc20 100644
--- a/frontend/components/PremiumFeatureMessage/PremiumFeatureMessage.tsx
+++ b/frontend/components/PremiumFeatureMessage/PremiumFeatureMessage.tsx
@@ -6,10 +6,23 @@ import Icon from "components/Icon";
 
 interface IPremiumFeatureMessage {
   className?: string;
+  /** Aligns premium message, default: centered */
+  alignment?: "left";
 }
 
-const PremiumFeatureMessage = ({ className }: IPremiumFeatureMessage) => {
-  const classes = classnames("premium-feature-message-container", className);
+const baseClass = "premium-feature-message-container";
+
+const PremiumFeatureMessage = ({
+  className,
+  alignment,
+}: IPremiumFeatureMessage) => {
+  const classes = classnames(
+    baseClass,
+    {
+      [`${baseClass}__align-${alignment}`]: alignment !== undefined,
+    },
+    className
+  );
 
   return (
     <div className={classes}>
diff --git a/frontend/components/PremiumFeatureMessage/_styles.scss b/frontend/components/PremiumFeatureMessage/_styles.scss
index f24d2364a1..c8a895d785 100644
--- a/frontend/components/PremiumFeatureMessage/_styles.scss
+++ b/frontend/components/PremiumFeatureMessage/_styles.scss
@@ -4,6 +4,11 @@
   align-items: center;
   font-size: $x-small;
 
+  &__align-left {
+    justify-content: left;
+    align-items: left;
+  }
+
   .premium-feature-message {
     display: flex;
     gap: 4px;
@@ -18,10 +23,6 @@
       display: flex;
       gap: 4px;
       align-items: center;
-
-      .custom-link {
-        font-weight: normal;
-      }
     }
   }
 }
diff --git a/frontend/components/StatusIndicator/StatusIndicator.tsx b/frontend/components/StatusIndicator/StatusIndicator.tsx
index 236d3139cc..bd573ea455 100644
--- a/frontend/components/StatusIndicator/StatusIndicator.tsx
+++ b/frontend/components/StatusIndicator/StatusIndicator.tsx
@@ -1,17 +1,32 @@
-import React from "react";
+import React, { ReactNode } from "react";
 import classnames from "classnames";
 import { DEFAULT_EMPTY_CELL_VALUE } from "utilities/constants";
 import TooltipWrapper from "components/TooltipWrapper";
 import { capitalize } from "lodash";
 
+const baseClass = "status-indicator";
+
+export type IIndicatorValue = "success" | "warning" | "error" | "indeterminate";
+
 interface IStatusIndicatorProps {
-  /** Only the first letter of value will be capitalized by the component */
+  /** Only the first letter of value will be capitalized by the component.
+   * NOTE: Do not rely on the value prop to determine the status indicator. Use the
+   * `indicator` prop instead.
+   */
   value: string;
+  /** The indicator type allows for showing the desired indicator.
+   * NOTE: use this instead relying on the `value` prop to determine the indicator.
+   */
+  indicator?: IIndicatorValue;
   tooltip?: {
-    tooltipText: string | JSX.Element;
+    tooltipText: ReactNode;
     position?: "top" | "bottom";
   };
+  /**
+   * @deprecated Use `indicator` instead to show the desired indicator.
+   */
   customIndicatorType?: string;
+  className?: string;
 }
 
 const generateIndicatorStateClassTag = (
@@ -27,17 +42,22 @@ const generateIndicatorStateClassTag = (
 
 const StatusIndicator = ({
   value,
+  indicator,
   tooltip,
   customIndicatorType,
+  className,
 }: IStatusIndicatorProps): JSX.Element => {
   const indicatorStateClassTag = generateIndicatorStateClassTag(
     value,
     customIndicatorType
   );
-  const indicatorClassNames = classnames(
-    "status-indicator",
-    `status-indicator--${indicatorStateClassTag}`,
-    `status--${indicatorStateClassTag}`
+
+  const classes = classnames(
+    baseClass,
+    className,
+    `${baseClass}--${indicatorStateClassTag}`,
+    `status--${indicatorStateClassTag}`,
+    indicator ? `${baseClass}--${indicator}` : null
   );
 
   const capitalizedValue = capitalize(value);
@@ -56,7 +76,7 @@ const StatusIndicator = ({
     capitalizedValue
   );
 
-  return <span className={indicatorClassNames}>{indicatorContent}</span>;
+  return <span className={classes}>{indicatorContent}</span>;
 };
 
 export default StatusIndicator;
diff --git a/frontend/components/StatusIndicator/_styles.scss b/frontend/components/StatusIndicator/_styles.scss
index b601663c1b..ebe03cc190 100644
--- a/frontend/components/StatusIndicator/_styles.scss
+++ b/frontend/components/StatusIndicator/_styles.scss
@@ -11,6 +11,38 @@
     min-width: 8px;
   }
 
+  // New indicator styles
+  &--success {
+    &:before {
+      background-color: $ui-success;
+    }
+  }
+
+  &--warning {
+    &:before {
+      background-color: $ui-warning;
+    }
+  }
+
+  &--error {
+    &:before {
+      background-color: $ui-error;
+    }
+  }
+
+  &--indeterminate {
+    &:before {
+      background-color: $ui-offline;
+    }
+  }
+
+
+  // NOTE: We will move away from styling the indicator status depending
+  // on the value passed to the component. Instead we have added an `indicator`
+  // prop that will allow us explicitly define the desired status. This makes
+  // the component more flexible and easier to use. The next two blocks of
+  // styles (host status and user status) will be removed in the future.
+
   // host status
   &--online:before,
   &--enabled:before,
@@ -39,8 +71,4 @@
       background-color: $ui-warning;
     }
   }
-
-  .component__tooltip-wrapper__tip-text {
-    text-align: center;
-  }
 }
diff --git a/frontend/components/TableContainer/DataTable/DataTable.tests.tsx b/frontend/components/TableContainer/DataTable/DataTable.tests.tsx
index 424f4982b2..ce10b6e70c 100644
--- a/frontend/components/TableContainer/DataTable/DataTable.tests.tsx
+++ b/frontend/components/TableContainer/DataTable/DataTable.tests.tsx
@@ -165,4 +165,69 @@ describe("DataTable - component", () => {
     expect(firstNameInTableCell).toHaveTextContent("bar user");
     expect(secondNameInTableCell).toHaveTextContent("foo user");
   });
+
+  it("does not render help text when no rows are present", () => {
+    const columns = [
+      {
+        title: "Name",
+        Header: "Name",
+        accessor: "name",
+        disableHidden: false,
+      },
+    ];
+
+    const data: any = [];
+
+    render(
+      <DataTable
+        columns={columns}
+        data={data}
+        sortHeader="name"
+        sortDirection="desc"
+        isLoading
+        onSort={noop}
+        showMarkAllPages={false}
+        isAllPagesSelected={false}
+        resultsTitle="users"
+        defaultPageSize={DEFAULT_PAGE_SIZE}
+        disableMultiRowSelect={false}
+        renderTableHelpText={() => <div>Help text</div>}
+      />
+    );
+
+    const helpText = screen.queryByText("Help text");
+    expect(helpText).toBeNull();
+  });
+  it("renders help text when rows are present", () => {
+    const columns = [
+      {
+        title: "Name",
+        Header: "Name",
+        accessor: "name",
+        disableHidden: false,
+      },
+    ];
+
+    const data = [{ name: "Gabe" }];
+
+    render(
+      <DataTable
+        columns={columns}
+        data={data}
+        sortHeader="name"
+        sortDirection="desc"
+        isLoading={false}
+        onSort={noop}
+        showMarkAllPages={false}
+        isAllPagesSelected={false}
+        resultsTitle="users"
+        defaultPageSize={DEFAULT_PAGE_SIZE}
+        disableMultiRowSelect={false}
+        renderTableHelpText={() => <div>Help text</div>}
+      />
+    );
+
+    const helpText = screen.getByText("Help text");
+    expect(helpText).toBeInTheDocument();
+  });
 });
diff --git a/frontend/components/TableContainer/DataTable/DataTable.tsx b/frontend/components/TableContainer/DataTable/DataTable.tsx
index 8f8906ee1c..43bde85890 100644
--- a/frontend/components/TableContainer/DataTable/DataTable.tsx
+++ b/frontend/components/TableContainer/DataTable/DataTable.tsx
@@ -58,7 +58,9 @@ interface IDataTableProps {
   onSelectSingleRow?: (value: Row) => void;
   onClickRow?: (value: any) => void;
   onResultsCountChange?: (value: number) => void;
-  renderFooter?: () => JSX.Element | null;
+  /** Optional help text to render on bottom-left of the table. Hidden when table is loading and no
+   * rows of data are present. */
+  renderTableHelpText?: () => JSX.Element | null;
   renderPagination?: () => JSX.Element | null;
   setExportRows?: (rows: Row[]) => void;
 }
@@ -100,7 +102,7 @@ const DataTable = ({
   onSelectSingleRow,
   onClickRow,
   onResultsCountChange,
-  renderFooter,
+  renderTableHelpText,
   renderPagination,
   setExportRows,
 }: IDataTableProps): JSX.Element => {
@@ -443,6 +445,7 @@ const DataTable = ({
 
   const tableStyles = classnames({
     "data-table__table": true,
+    "data-table__no-rows": !rows.length,
     "is-observer": isOnlyObserver,
   });
 
@@ -554,8 +557,10 @@ const DataTable = ({
         </table>
       </div>
       <div className={`${baseClass}__footer`}>
-        {renderFooter && (
-          <div className={`${baseClass}__footer-text`}>{renderFooter()}</div>
+        {renderTableHelpText && !!rows?.length && (
+          <div className={`${baseClass}__table-help-text`}>
+            {renderTableHelpText()}
+          </div>
         )}
         {isClientSidePagination ? (
           <div className={`${baseClass}__pagination`}>
diff --git a/frontend/components/TableContainer/DataTable/TextCell/TextCell.tsx b/frontend/components/TableContainer/DataTable/TextCell/TextCell.tsx
index 1761cd4114..565ad1c824 100644
--- a/frontend/components/TableContainer/DataTable/TextCell/TextCell.tsx
+++ b/frontend/components/TableContainer/DataTable/TextCell/TextCell.tsx
@@ -7,7 +7,7 @@ import { DEFAULT_EMPTY_CELL_VALUE } from "utilities/constants";
 
 const baseClass = "text-cell";
 interface ITextCellProps {
-  value?: string | number | boolean | { timeString: string } | null;
+  value?: React.ReactNode | { timeString: string };
   formatter?: (val: any) => React.ReactNode; // string, number, or null
   grey?: boolean;
   italic?: boolean;
diff --git a/frontend/components/TableContainer/DataTable/_styles.scss b/frontend/components/TableContainer/DataTable/_styles.scss
index 230ac590e3..ecb3ccce2e 100644
--- a/frontend/components/TableContainer/DataTable/_styles.scss
+++ b/frontend/components/TableContainer/DataTable/_styles.scss
@@ -37,6 +37,11 @@ $shadow-transition-width: 10px;
       background-attachment: local, local, scroll, scroll;
       // End shadow
     }
+    
+    // applied to same element as data-table__table while loading
+    &__no-rows {
+      min-height: 272px;
+    }
 
     &__table {
       position: relative;
@@ -46,33 +51,6 @@ $shadow-transition-width: 10px;
       font-size: $x-small;
     }
 
-    tbody {
-      .component__tooltip-wrapper {
-        margin: 10px 0; // vertical padding multiline text with tooltip
-      }
-
-      .component__tooltip-wrapper__element {
-        white-space: initial; // wraps long text with tooltip
-      }
-
-      tr,
-      .single-row {
-        transition: background-color 150ms ease-out;
-        &:hover {
-          background-color: $ui-off-white-opaque; // opaque needed for horizontal scroll shadow
-        }
-      }
-
-      .single-row {
-        &:hover {
-          cursor: pointer;
-        }
-        &:active {
-          background-color: $ui-vibrant-blue-10-opaque; // opaque needed for horizontal scroll shadow
-        }
-      }
-    }
-
     tr {
       border-bottom: 1px solid $ui-fleet-black-10;
 
@@ -205,6 +183,31 @@ $shadow-transition-width: 10px;
     }
 
     tbody {
+      .component__tooltip-wrapper {
+        margin: 10px 0; // vertical padding multiline text with tooltip
+      }
+
+      .component__tooltip-wrapper__element {
+        white-space: initial; // wraps long text with tooltip
+      }
+
+      tr,
+      .single-row {
+        transition: background-color 150ms ease-out;
+        &:hover {
+          background-color: $ui-off-white-opaque; // opaque needed for horizontal scroll shadow
+        }
+      }
+
+      .single-row {
+        &:hover {
+          cursor: pointer;
+        }
+        &:active {
+          background-color: $ui-vibrant-blue-10-opaque; // opaque needed for horizontal scroll shadow
+        }
+      }
+
       td {
         height: 40px;
         padding: 0 $pad-large;
@@ -361,7 +364,7 @@ $shadow-transition-width: 10px;
     align-items: center;
   }
 
-  &__footer-text {
+  &__table-help-text {
     font-size: $x-small;
 
     display: flex;
diff --git a/frontend/components/TableContainer/TableContainer.tsx b/frontend/components/TableContainer/TableContainer.tsx
index e4b4f9c0b7..4ba6af2027 100644
--- a/frontend/components/TableContainer/TableContainer.tsx
+++ b/frontend/components/TableContainer/TableContainer.tsx
@@ -81,6 +81,8 @@ interface ITableContainerProps<T = any> {
     | ((queryData: ITableQueryData) => void)
     | ((queryData: ITableQueryData) => number);
   customControl?: () => JSX.Element;
+  /** Filter button right of the search rendering alternative responsive design where search bar moves to new line but filter button remains inline with other table headers */
+  customFiltersButton?: () => JSX.Element;
   stackControls?: boolean;
   onSelectSingleRow?: (value: Row | IRowProps) => void;
   /** This is called when you click on a row. This was added as `onSelectSingleRow`
@@ -92,7 +94,9 @@ interface ITableContainerProps<T = any> {
    * key */
   filters?: Record<string, string | number | boolean>;
   renderCount?: () => JSX.Element | null;
-  renderFooter?: () => JSX.Element | null;
+  /** Optional help text to render on bottom-left of the table. Hidden when table is loading and no
+   * rows of data are present. */
+  renderTableHelpText?: () => JSX.Element | null;
   setExportRows?: (rows: Row[]) => void;
   /** Use for serverside filtering: Set to true when filters change in URL
    * bar and API call so TableContainer will reset its page state to 0  */
@@ -144,11 +148,12 @@ const TableContainer = <T,>({
   searchQueryColumn,
   onQueryChange,
   customControl,
+  customFiltersButton,
   stackControls,
   onSelectSingleRow,
   onClickRow,
   renderCount,
-  renderFooter,
+  renderTableHelpText,
   setExportRows,
   resetPageIndex,
   disableTableHeader,
@@ -266,30 +271,15 @@ const TableContainer = <T,>({
     onPaginationChange,
   ]);
 
-  const opacity = isLoading ? { opacity: 0.4 } : { opacity: 1 };
+  const renderFilters = useCallback(() => {
+    const opacity = isLoading ? { opacity: 0.4 } : { opacity: 1 };
 
-  return (
-    <div className={wrapperClasses}>
-      {wideSearch && searchable && (
-        <div className={`${baseClass}__search-input wide-search`}>
-          <SearchField
-            placeholder={inputPlaceHolder}
-            defaultValue={searchQuery}
-            onChange={onSearchQueryChange}
-          />
-        </div>
-      )}
-      {!disableTableHeader && (
-        <div
-          className={`${baseClass}__header ${
-            stackControls ? "stack-table-controls" : ""
-          }`}
-        >
-          <div
-            className={`${baseClass}__header-left ${
-              stackControls ? "stack-table-controls" : ""
-            }`}
-          >
+    // New preferred pattern uses grid container/box to allow for more dynamic responsiveness
+    // At low widths, search bar (3rd div of 4) moves above other 3 divs
+    if (customFiltersButton) {
+      return (
+        <div className="container">
+          <div className="box">
             {renderCount && !disableCount && (
               <div
                 className={`${baseClass}__results-count ${
@@ -300,57 +290,160 @@ const TableContainer = <T,>({
                 {renderCount()}
               </div>
             )}
-            <span className="controls">
-              {actionButton && !actionButton.hideButton && (
-                <Button
-                  disabled={disableActionButton}
-                  onClick={actionButton.onActionButtonClick}
-                  variant={actionButton.variant || "brand"}
-                  className={`${baseClass}__table-action-button`}
-                >
-                  <>
-                    {actionButton.buttonText}
-                    {actionButton.iconSvg && (
-                      <Icon name={actionButton.iconSvg} />
-                    )}
-                  </>
-                </Button>
-              )}
-              {customControl && customControl()}
-            </span>
           </div>
-
-          {/* Render search bar only if not empty component */}
-          {searchable && !wideSearch && (
-            <div className={`${baseClass}__search`}>
-              <div
-                className={`${baseClass}__search-input ${
-                  stackControls ? "stack-table-controls" : ""
-                }`}
-                data-tip
-                data-for="search-tooltip"
-                data-tip-disable={!searchToolTipText}
+          <div className="box">
+            {actionButton && !actionButton.hideButton && (
+              <Button
+                disabled={disableActionButton}
+                onClick={actionButton.onActionButtonClick}
+                variant={actionButton.variant || "brand"}
+                className={`${baseClass}__table-action-button`}
               >
-                <SearchField
-                  placeholder={inputPlaceHolder}
-                  defaultValue={searchQuery}
-                  onChange={onSearchQueryChange}
-                />
+                <>
+                  {actionButton.buttonText}
+                  {actionButton.iconSvg && <Icon name={actionButton.iconSvg} />}
+                </>
+              </Button>
+            )}
+            {customControl && customControl()}
+          </div>
+          <div className="box search">
+            {searchable && !wideSearch && (
+              <div className={`${baseClass}__search`}>
+                <div
+                  className={`${baseClass}__search-input`}
+                  data-tip
+                  data-for="search-tooltip"
+                  data-tip-disable={!searchToolTipText}
+                >
+                  <SearchField
+                    placeholder={inputPlaceHolder}
+                    defaultValue={searchQuery}
+                    onChange={onSearchQueryChange}
+                  />
+                </div>
+                <ReactTooltip
+                  effect="solid"
+                  backgroundColor={COLORS["tooltip-bg"]}
+                  id="search-tooltip"
+                  data-html
+                >
+                  <span className={`tooltip ${baseClass}__tooltip-text`}>
+                    {searchToolTipText}
+                  </span>
+                </ReactTooltip>
               </div>
-              <ReactTooltip
-                effect="solid"
-                backgroundColor={COLORS["tooltip-bg"]}
-                id="search-tooltip"
-                data-html
-              >
-                <span className={`tooltip ${baseClass}__tooltip-text`}>
-                  {searchToolTipText}
-                </span>
-              </ReactTooltip>
-            </div>
-          )}
+            )}
+          </div>
+          <div className="box"> {customFiltersButton()} </div>
         </div>
-      )}
+      );
+    }
+    return (
+      <>
+        {wideSearch && searchable && (
+          <div className={`${baseClass}__search-input wide-search`}>
+            <SearchField
+              placeholder={inputPlaceHolder}
+              defaultValue={searchQuery}
+              onChange={onSearchQueryChange}
+            />
+          </div>
+        )}
+        {!disableTableHeader && (
+          <div
+            className={`${baseClass}__header ${
+              stackControls ? "stack-table-controls" : ""
+            }`}
+          >
+            <div
+              className={`${baseClass}__header-left ${
+                stackControls ? "stack-table-controls" : ""
+              }`}
+            >
+              {renderCount && !disableCount && (
+                <div
+                  className={`${baseClass}__results-count ${
+                    stackControls ? "stack-table-controls" : ""
+                  }`}
+                  style={opacity}
+                >
+                  {renderCount()}
+                </div>
+              )}
+              <span className="controls">
+                {actionButton && !actionButton.hideButton && (
+                  <Button
+                    disabled={disableActionButton}
+                    onClick={actionButton.onActionButtonClick}
+                    variant={actionButton.variant || "brand"}
+                    className={`${baseClass}__table-action-button`}
+                  >
+                    <>
+                      {actionButton.buttonText}
+                      {actionButton.iconSvg && (
+                        <Icon name={actionButton.iconSvg} />
+                      )}
+                    </>
+                  </Button>
+                )}
+                {customControl && customControl()}
+              </span>
+            </div>
+
+            {/* Render search bar only if not empty component */}
+            {searchable && !wideSearch && (
+              <div className={`${baseClass}__search`}>
+                <div
+                  className={`${baseClass}__search-input ${
+                    stackControls ? "stack-table-controls" : ""
+                  }`}
+                  data-tip
+                  data-for="search-tooltip"
+                  data-tip-disable={!searchToolTipText}
+                >
+                  <SearchField
+                    placeholder={inputPlaceHolder}
+                    defaultValue={searchQuery}
+                    onChange={onSearchQueryChange}
+                  />
+                </div>
+                <ReactTooltip
+                  effect="solid"
+                  backgroundColor={COLORS["tooltip-bg"]}
+                  id="search-tooltip"
+                  data-html
+                >
+                  <span className={`tooltip ${baseClass}__tooltip-text`}>
+                    {searchToolTipText}
+                  </span>
+                </ReactTooltip>
+              </div>
+            )}
+          </div>
+        )}
+      </>
+    );
+  }, [
+    actionButton,
+    customControl,
+    customFiltersButton,
+    disableActionButton,
+    disableCount,
+    disableTableHeader,
+    inputPlaceHolder,
+    isLoading,
+    renderCount,
+    searchQuery,
+    searchToolTipText,
+    searchable,
+    stackControls,
+    wideSearch,
+  ]);
+
+  return (
+    <div className={wrapperClasses}>
+      {renderFilters()}
       <div className={`${baseClass}__data-table-block`}>
         {/* No entities for this result. */}
         {(!isLoading && data.length === 0 && !isMultiColumnFilter) ||
@@ -415,7 +508,7 @@ const TableContainer = <T,>({
                 searchQuery={searchQuery}
                 searchQueryColumn={searchQueryColumn}
                 selectedDropdownFilter={selectedDropdownFilter}
-                renderFooter={renderFooter}
+                renderTableHelpText={renderTableHelpText}
                 renderPagination={
                   isClientSidePagination ? undefined : renderPagination
                 }
diff --git a/frontend/components/TableContainer/_styles.scss b/frontend/components/TableContainer/_styles.scss
index 326937a5f5..9abf876944 100644
--- a/frontend/components/TableContainer/_styles.scss
+++ b/frontend/components/TableContainer/_styles.scss
@@ -1,4 +1,82 @@
 .table-container {
+  .form-field {
+    width: initial; // 100% causes weird rendering in dropdown
+  }
+
+  // Container is responsive design used when customFilters is rendered
+  .container {
+    display: grid;
+    grid-template-columns: 1fr auto auto; /* First column takes all remaining space */
+    grid-template-rows: auto auto; /* Two rows */
+    width: 100%;
+    height: max-content;
+    gap: $pad-small $pad-medium;
+  }
+
+  .box {
+    min-width: max-content;
+    align-content: center;
+    display: flex;
+    flex-direction: row;
+    gap: $pad-medium;
+
+    > div {
+      display: flex;
+      flex-direction: row;
+    }
+  }
+
+  .search {
+    grid-column: 1 / -1; /* Span across all columns */
+    grid-row: 1; /* Place in the first row */
+  }
+
+  .box:nth-child(1) {
+    grid-column: 1 / span 2; /* Make Box 1 expand across two columns */
+    grid-row: 2;
+  }
+
+  .box:nth-child(2) {
+    grid-column: 2; /* Place Box 2 in the second row, second column */
+    grid-row: 2;
+  }
+
+  .box:nth-child(4) {
+    grid-column: 3; /* Place Box 4 in the second row, third column */
+    grid-row: 2;
+    max-width: min-content;
+  }
+
+  /* Media query for larger screens */
+  @media (min-width: $table-controls-break) {
+    .container {
+      grid-template-columns: 1fr auto auto auto; /* First column takes all remaining space */
+      grid-template-rows: auto; /* Single row */
+    }
+
+    .search {
+      grid-column: 1 / -1; /* Keep spanning across all columns if needed */
+      grid-row: auto;
+    }
+
+    .box:nth-child(1) {
+      grid-column: 1; /* Ensure Box 1 stays in the first column */
+    }
+
+    .box:nth-child(2) {
+      grid-column: 2; /* Place Box 2 in the second column */
+    }
+
+    .box:nth-child(3) {
+      grid-column: 3; /* Place Box 3 in the third column */
+      grid-row: 2;
+    }
+
+    .box:nth-child(4) {
+      grid-column: 4; /* Place Box 4 in the fourth column */
+    }
+  }
+
   // TODO: Fix hacky solution to clientside search being 0 no longer accessing rows.length
   .client-result-count-0 {
     display: none;
@@ -13,16 +91,28 @@
     margin-top: 3px; // Fits button highlight during tabbing
 
     &.stack-table-controls {
-      flex-direction: column-reverse;
       align-items: start;
 
       @media (min-width: $break-xs) {
         flex-direction: row;
         align-items: end;
         justify-content: space-between;
+
+        .table-container__search {
+          order: -2;
+        }
+
+        .table-container__results-count {
+          order: -1;
+        }
       }
+
       @media (min-width: $break-md) {
         align-items: center;
+
+        .table-container__search {
+          order: initial;
+        }
       }
     }
 
@@ -37,16 +127,15 @@
     display: flex;
     width: 100%;
     justify-content: space-between;
+    flex-direction: row;
     align-items: center;
 
     &.stack-table-controls {
-      flex-direction: column-reverse;
+      flex-direction: column;
       align-items: start;
 
       @media (min-width: $break-md) {
-        flex-direction: row;
         justify-content: space-between;
-        align-items: center;
       }
     }
 
diff --git a/frontend/components/TeamsDropdown/TeamsDropdown.tsx b/frontend/components/TeamsDropdown/TeamsDropdown.tsx
index c7dfa508ac..31f2400d3d 100644
--- a/frontend/components/TeamsDropdown/TeamsDropdown.tsx
+++ b/frontend/components/TeamsDropdown/TeamsDropdown.tsx
@@ -8,8 +8,6 @@ import {
 
 // @ts-ignore
 import Dropdown from "components/forms/fields/Dropdown";
-import ReactTooltip from "react-tooltip";
-import { uniqueId } from "lodash";
 
 const generateDropdownOptions = (
   teams: ITeamSummary[] | undefined,
diff --git a/frontend/components/buttons/Button/_styles.scss b/frontend/components/buttons/Button/_styles.scss
index c2e78a9b81..f38badbcce 100644
--- a/frontend/components/buttons/Button/_styles.scss
+++ b/frontend/components/buttons/Button/_styles.scss
@@ -70,6 +70,7 @@ $base-class: "button";
   border: 0;
   position: relative;
   cursor: pointer;
+  min-width: max-content;
 
   &:focus {
     outline: none;
diff --git a/frontend/components/buttons/RevealButton/RevealButton.tsx b/frontend/components/buttons/RevealButton/RevealButton.tsx
index c1db68f9d9..c54d5a0010 100644
--- a/frontend/components/buttons/RevealButton/RevealButton.tsx
+++ b/frontend/components/buttons/RevealButton/RevealButton.tsx
@@ -13,6 +13,7 @@ export interface IRevealButtonProps {
   autofocus?: boolean;
   disabled?: boolean;
   tooltipContent?: React.ReactNode;
+  disabledTooltipContent?: React.ReactNode;
   onClick?:
     | ((value?: any) => void)
     | ((evt: React.MouseEvent<HTMLButtonElement>) => void);
@@ -29,6 +30,7 @@ const RevealButton = ({
   autofocus,
   disabled,
   tooltipContent,
+  disabledTooltipContent,
   onClick,
 }: IRevealButtonProps): JSX.Element => {
   const classNames = classnames(baseClass, className);
@@ -36,11 +38,12 @@ const RevealButton = ({
   const buttonContent = () => {
     const text = isShowing ? hideText : showText;
 
-    const buttonText = tooltipContent ? (
-      <TooltipWrapper tipContent={tooltipContent}>{text}</TooltipWrapper>
-    ) : (
-      text
-    );
+    const buttonText =
+      tooltipContent && !disabled ? (
+        <TooltipWrapper tipContent={tooltipContent}>{text}</TooltipWrapper>
+      ) : (
+        text
+      );
 
     return (
       <>
@@ -61,7 +64,7 @@ const RevealButton = ({
     );
   };
 
-  return (
+  const button = (
     <Button
       variant="text-icon"
       className={classNames}
@@ -72,6 +75,22 @@ const RevealButton = ({
       {buttonContent()}
     </Button>
   );
+
+  if (disabled && disabledTooltipContent) {
+    // wrap the tooltip around the Button so it works while disabled
+    return (
+      <TooltipWrapper
+        tipContent={disabledTooltipContent}
+        showArrow
+        underline={false}
+        position="right"
+        tipOffset={12}
+      >
+        {button}
+      </TooltipWrapper>
+    );
+  }
+  return button;
 };
 
 export default RevealButton;
diff --git a/frontend/components/forms/FormField/FormField.tsx b/frontend/components/forms/FormField/FormField.tsx
index 4d40930179..3417bb9d05 100644
--- a/frontend/components/forms/FormField/FormField.tsx
+++ b/frontend/components/forms/FormField/FormField.tsx
@@ -18,6 +18,7 @@ export interface IFormFieldProps {
   className?: string;
   tooltip?: React.ReactNode;
   labelTooltipPosition?: PlacesType;
+  disabled?: boolean;
 }
 
 const FormField = ({
@@ -30,10 +31,12 @@ const FormField = ({
   type,
   tooltip,
   labelTooltipPosition,
+  disabled,
 }: IFormFieldProps): JSX.Element => {
   const renderLabel = () => {
     const labelWrapperClasses = classnames(`${baseClass}__label`, {
       [`${baseClass}__label--error`]: !isEmpty(error),
+      [`${baseClass}__label--disabled`]: disabled,
     });
 
     if (!label) {
diff --git a/frontend/components/forms/fields/Dropdown/Dropdown.jsx b/frontend/components/forms/fields/Dropdown/Dropdown.jsx
index 337851793c..b44d6e4b7d 100644
--- a/frontend/components/forms/fields/Dropdown/Dropdown.jsx
+++ b/frontend/components/forms/fields/Dropdown/Dropdown.jsx
@@ -27,6 +27,19 @@ class Dropdown extends Component {
     onClose: PropTypes.func,
     options: PropTypes.arrayOf(dropdownOptionInterface).isRequired,
     placeholder: PropTypes.oneOfType([PropTypes.array, PropTypes.string]),
+    /**
+     value must correspond to the value of a dropdown option to render
+     e.g. with options:
+
+     [
+       {
+       label: "Display name",
+       value: 1,  <– the id of the thing
+       }
+     ]
+
+     set value to 1, not "Display name"
+    */
     value: PropTypes.oneOfType([
       PropTypes.array,
       PropTypes.string,
@@ -36,8 +49,8 @@ class Dropdown extends Component {
     parseTarget: PropTypes.bool,
     tooltip: PropTypes.string,
     autoFocus: PropTypes.bool,
-    /** Includes styled filter icon */
-    tableFilterDropdown: PropTypes.bool,
+    /** Includes styled icon */
+    iconName: PropTypes.string,
     helpText: PropTypes.oneOfType([
       PropTypes.string,
       PropTypes.arrayOf(PropTypes.string),
@@ -58,7 +71,7 @@ class Dropdown extends Component {
     parseTarget: false,
     tooltip: "",
     autoFocus: false,
-    tableFilterDropdown: false,
+    iconName: "",
   };
 
   onMenuOpen = () => {
@@ -75,7 +88,7 @@ class Dropdown extends Component {
     const { multi, onChange, clearable, name, parseTarget } = this.props;
 
     if (parseTarget) {
-      // Returns both name and value
+      // Returns both name of the Dropdown and value of the selected option
       return onChange({ value: selected.value, name });
     }
 
@@ -142,16 +155,16 @@ class Dropdown extends Component {
     );
   };
 
-  // Adds styled filter icon to dropdown
-  renderCustomTableFilter = () => {
-    const { options, value } = this.props;
+  // Adds styled icon to dropdown
+  renderWithIcon = () => {
+    const { options, value, iconName } = this.props;
     const customLabel = options
       .filter((option) => option.value === value)
       .map((option) => option.label);
 
     return (
       <div className={`${baseClass}__custom-value`}>
-        <Icon name="filter" className={`${baseClass}__icon`} />
+        <Icon name={iconName} className={`${baseClass}__icon`} />
         <div className={`${baseClass}__custom-value-label`}>{customLabel}</div>
       </div>
     );
@@ -164,7 +177,7 @@ class Dropdown extends Component {
       onMenuOpen,
       onMenuClose,
       renderCustomDropdownArrow,
-      renderCustomTableFilter,
+      renderWithIcon,
     } = this;
     const {
       error,
@@ -179,7 +192,7 @@ class Dropdown extends Component {
       wrapperClassName,
       searchable,
       autoFocus,
-      tableFilterDropdown,
+      iconName,
     } = this.props;
 
     const formFieldProps = pick(this.props, [
@@ -188,9 +201,11 @@ class Dropdown extends Component {
       "error",
       "name",
       "tooltip",
+      "disabled",
     ]);
     const selectClasses = classnames(className, `${baseClass}__select`, {
       [`${baseClass}__select--error`]: error,
+      [`${baseClass}__select--disabled`]: disabled,
     });
 
     return (
@@ -215,9 +230,7 @@ class Dropdown extends Component {
           onClose={onMenuClose}
           autoFocus={autoFocus}
           arrowRenderer={renderCustomDropdownArrow}
-          valueComponent={
-            tableFilterDropdown ? renderCustomTableFilter : undefined
-          }
+          valueComponent={iconName ? renderWithIcon : undefined}
         />
       </FormField>
     );
diff --git a/frontend/components/forms/fields/Dropdown/_styles.scss b/frontend/components/forms/fields/Dropdown/_styles.scss
index c36f457e0d..c86dc61bf6 100644
--- a/frontend/components/forms/fields/Dropdown/_styles.scss
+++ b/frontend/components/forms/fields/Dropdown/_styles.scss
@@ -6,7 +6,6 @@
     }
 
     &-label {
-      width: 105px;
       line-height: 38px;
       font-size: $small;
     }
@@ -67,11 +66,13 @@
   &.dropdown__select {
     border: 1px solid $ui-fleet-black-10;
     border-radius: $border-radius;
-    &:hover {
+
+    &:hover:not(.is-disabled) {
       box-shadow: none;
-      border: 1px solid $core-vibrant-blue;
+      border-color: $core-vibrant-blue;
     }
   }
+
   .Select-control {
     background-color: $ui-light-grey;
     border: 0;
@@ -206,6 +207,12 @@
         }
       }
     }
+
+    &.is-disabled {
+      > .Select-control .Select-value .Select-value-label {
+        color: $ui-fleet-black-50;
+      }
+    }
   }
 
   .Select-menu-outer {
@@ -309,7 +316,7 @@
 
     .Select-option {
       &.is-disabled {
-        color: $core-fleet-black;
+        color: $ui-fleet-black-50;
         cursor: default;
 
         &.is-focused {
@@ -330,3 +337,11 @@
     margin-left: 3px;
   }
 }
+
+.form-field {
+  &__label {
+    &--disabled {
+      color: $ui-fleet-black-50;
+    }
+  }
+}
diff --git a/frontend/components/forms/fields/InputField/InputField.jsx b/frontend/components/forms/fields/InputField/InputField.jsx
index 09ffad2fa4..758ef70ab4 100644
--- a/frontend/components/forms/fields/InputField/InputField.jsx
+++ b/frontend/components/forms/fields/InputField/InputField.jsx
@@ -43,6 +43,7 @@ class InputField extends Component {
       PropTypes.object,
     ]),
     enableCopy: PropTypes.bool,
+    copyButtonPosition: PropTypes.oneOfType(["inside", "outside"]),
     ignore1password: PropTypes.bool,
   };
 
@@ -62,6 +63,7 @@ class InputField extends Component {
     labelTooltipPosition: undefined,
     helpText: "",
     enableCopy: false,
+    copyButtonPosition: "outside",
     ignore1password: false,
   };
 
@@ -97,6 +99,59 @@ class InputField extends Component {
     return onChange(value);
   };
 
+  renderCopyButton = () => {
+    const { value, copyButtonPosition } = this.props;
+
+    const copyValue = (e) => {
+      e.preventDefault();
+      stringToClipboard(value).then(() => {
+        this.setState({ copied: true });
+        setTimeout(() => {
+          this.setState({ copied: false });
+        }, 2000);
+      });
+    };
+
+    const copyButtonValue =
+      copyButtonPosition === "outside" ? (
+        <>
+          <Icon name="copy" />
+          <span>Copy</span>
+        </>
+      ) : (
+        <Icon name="copy" />
+      );
+
+    const wrapperClasses = classnames(
+      `${baseClass}__copy-wrapper`,
+      copyButtonPosition === "outside"
+        ? `${baseClass}__copy-wrapper-outside`
+        : `${baseClass}__copy-wrapper-inside`
+    );
+
+    const copiedConfirmationClasses = classnames(
+      `${baseClass}__copied-confirmation`,
+      copyButtonPosition === "outside"
+        ? `${baseClass}__copied-confirmation-outside`
+        : `${baseClass}__copied-confirmation-inside`
+    );
+
+    return (
+      <div className={wrapperClasses}>
+        <Button
+          variant="text-icon"
+          onClick={copyValue}
+          className={`${baseClass}__copy-value-button`}
+        >
+          {copyButtonValue}
+        </Button>
+        {this.state.copied && (
+          <span className={copiedConfirmationClasses}>Copied!</span>
+        )}
+      </div>
+    );
+  };
+
   render() {
     const {
       readOnly,
@@ -113,6 +168,8 @@ class InputField extends Component {
       blockAutoComplete,
       value,
       ignore1password,
+      enableCopy,
+      copyButtonPosition,
     } = this.props;
 
     const { onInputChange } = this;
@@ -139,16 +196,6 @@ class InputField extends Component {
       "labelTooltipPosition",
     ]);
 
-    const copyValue = (e) => {
-      e.preventDefault();
-      stringToClipboard(value).then(() => {
-        this.setState({ copied: true });
-        setTimeout(() => {
-          this.setState({ copied: false });
-        }, 2000);
-      });
-    };
-
     if (type === "textarea") {
       return (
         <FormField
@@ -175,7 +222,9 @@ class InputField extends Component {
     }
 
     const inputContainerClasses = classnames(`${baseClass}__input-container`, {
-      "copy-enabled": this.props.enableCopy,
+      "copy-enabled": enableCopy,
+      "copy-outside": enableCopy && copyButtonPosition === "outside",
+      "copy-inside": enableCopy && copyButtonPosition === "inside",
     });
 
     return (
@@ -203,22 +252,8 @@ class InputField extends Component {
             autoComplete={blockAutoComplete ? "new-password" : ""}
             data-1p-ignore={ignore1password}
           />
-          {this.props.enableCopy && (
-            <div className={`${baseClass}__copy-wrapper`}>
-              <Button
-                variant="text-icon"
-                onClick={copyValue}
-                className={`${baseClass}__copy-value-button`}
-              >
-                <Icon name="copy" /> Copy
-              </Button>
-              {this.state.copied && (
-                <span className={`${baseClass}__copied-confirmation`}>
-                  Copied!
-                </span>
-              )}
-            </div>
-          )}
+
+          {enableCopy && this.renderCopyButton()}
         </div>
       </FormField>
     );
diff --git a/frontend/components/forms/fields/InputField/InputField.stories.jsx b/frontend/components/forms/fields/InputField/InputField.stories.jsx
index 09ccb5a197..7b27aa435c 100644
--- a/frontend/components/forms/fields/InputField/InputField.stories.jsx
+++ b/frontend/components/forms/fields/InputField/InputField.stories.jsx
@@ -8,3 +8,16 @@ const meta = {
 export default meta;
 
 export const Basic = {};
+
+export const WithCopyEnabled = {
+  args: {
+    enableCopy: true,
+  },
+};
+
+export const WithCopyEnabledInsideInput = {
+  args: {
+    enableCopy: true,
+    copyButtonPosition: "inside",
+  },
+};
diff --git a/frontend/components/forms/fields/InputField/_styles.scss b/frontend/components/forms/fields/InputField/_styles.scss
index caf6c23713..c70b755175 100644
--- a/frontend/components/forms/fields/InputField/_styles.scss
+++ b/frontend/components/forms/fields/InputField/_styles.scss
@@ -86,17 +86,32 @@
     }
   }
 
-  &__copy-wrapper {
+  &__copy-wrapper-outside {
     position: relative;
   }
 
+  &__copy-wrapper-inside {
+    position: absolute;
+    top: 50%;
+    transform: translateY(-50%);
+    right: 12px;
+  }
+
+
   &__input-container.copy-enabled {
-    display: flex;
-    align-items: center;
-    gap: $pad-medium;
+    &.copy-outside {
+      display: flex;
+      align-items: center;
+      gap: $pad-medium;
+    }
+
+    &.copy-inside {
+      position: relative;
+    }
   }
 
   &__copied-confirmation {
+    font-size: $x-small;
     position: absolute;
     background-color: $ui-light-grey;
     border: solid 1px $ui-fleet-black-10;
@@ -104,6 +119,13 @@
     padding: $pad-xxsmall 6px;
     top: 50%;
     transform: translateY(-50%);
+  }
+
+  &__copied-confirmation-inside {
+    right: 24px;
+  }
+
+  &__copied-confirmation-outside {
     left: -90px;
   }
 }
diff --git a/frontend/components/graphics/EmptySearchCheck.tsx b/frontend/components/graphics/EmptySearchCheck.tsx
new file mode 100644
index 0000000000..3c15d02f38
--- /dev/null
+++ b/frontend/components/graphics/EmptySearchCheck.tsx
@@ -0,0 +1,5 @@
+import { renderEmptySearch } from "./EmptySearchQuestion";
+
+const EmptySearchCheck = () => renderEmptySearch("check");
+
+export default EmptySearchCheck;
diff --git a/frontend/components/graphics/EmptySearchExclamation.tsx b/frontend/components/graphics/EmptySearchExclamation.tsx
new file mode 100644
index 0000000000..a86cf02658
--- /dev/null
+++ b/frontend/components/graphics/EmptySearchExclamation.tsx
@@ -0,0 +1,5 @@
+import { renderEmptySearch } from "./EmptySearchQuestion";
+
+const EmptySearchExclamation = () => renderEmptySearch("exclamation");
+
+export default EmptySearchExclamation;
diff --git a/frontend/components/graphics/EmptySearchQuestion.tsx b/frontend/components/graphics/EmptySearchQuestion.tsx
new file mode 100644
index 0000000000..2d93529d82
--- /dev/null
+++ b/frontend/components/graphics/EmptySearchQuestion.tsx
@@ -0,0 +1,78 @@
+import React from "react";
+
+export const renderEmptySearch = (
+  type: "exclamation" | "question" | "check"
+) => {
+  const renderIconPath = () => {
+    switch (type) {
+      case "exclamation":
+        return (
+          <path
+            d="m24.24 28.656-1.022-9.774a2.5 2.5 0 1 1 4.973-.003l-1.012 9.775a1.478 1.478 0 0 1-2.94.002h.001Zm-.803 4.951a2.28 2.28 0 1 1 4.562 0 2.28 2.28 0 0 1-4.562 0Z"
+            fill="#9C9EDB"
+          />
+        );
+      case "question":
+        return (
+          <path
+            d="M25.836 30.184a1.966 1.966 0 0 1-1.954-2.167c.059-.587.182-1.194.422-1.682.235-.477.995-1.115 2.166-1.979.613-.45 1.04-.87 1.28-1.259.24-.388.36-.87.36-1.446 0-.71-.226-1.268-.677-1.676-.451-.408-.998-.612-1.64-.612-1.274 0-2.13.675-2.566 2.024a1.945 1.945 0 0 1-2.128 1.313 1.932 1.932 0 0 1-1.53-2.614c.416-1.064 1.017-1.933 1.799-2.608 1.29-1.112 2.866-1.668 4.727-1.668 1.86 0 3.491.547 4.777 1.64 1.285 1.094 1.928 2.48 1.928 4.159 0 2.081-1.07 3.822-3.208 5.223-.931.614-1.495 1.093-1.691 1.439-.065.113-.119.259-.162.436a1.955 1.955 0 0 1-1.903 1.478v-.001Zm.317 5.626h-.173a2.172 2.172 0 1 1 0-4.345h.173a2.173 2.173 0 0 1 0 4.345Z"
+            fill="#9C9EDB"
+          />
+        );
+      case "check":
+        return (
+          <path
+            d="m31.503 18.45-8.13 10.054a.142.142 0 0 1-.202 0l-3.294-4.383a1.855 1.855 0 1 0-2.641 2.606l4.493 5.58a2.284 2.284 0 0 0 3.275-.026l9.181-11.252c.72-.752.68-1.95-.088-2.652l-.008-.007a1.856 1.856 0 0 0-2.586.08Z"
+            fill="#9C9EDB"
+          />
+        );
+      default:
+        return null;
+    }
+  };
+
+  return (
+    <svg width="55" height="71" fill="none" xmlns="http://www.w3.org/2000/svg">
+      <path
+        d="M25.73 49.4c13.123 0 23.762-10.638 23.762-23.761S38.853 1.878 25.73 1.878c-13.123 0-23.761 10.638-23.761 23.76C1.97 38.763 12.608 49.4 25.73 49.4Z"
+        fill="#F1F0FF"
+        stroke="#fff"
+        strokeWidth="1.199"
+      />
+      <path
+        fillRule="evenodd"
+        clipRule="evenodd"
+        d="M11.669 7.23a23.06 23.06 0 0 1 14.06-4.755c12.792 0 23.162 10.37 23.162 23.162a23.06 23.06 0 0 1-4.758 14.065 23.06 23.06 0 0 1-14.06 4.754c-12.792 0-23.162-10.37-23.162-23.161A23.06 23.06 0 0 1 11.67 7.23Z"
+        fill="#fff"
+      />
+      <path
+        fillRule="evenodd"
+        clipRule="evenodd"
+        d="M11.669 7.809a23.06 23.06 0 0 1 14.06-4.755c12.792 0 23.162 10.37 23.162 23.162a23.06 23.06 0 0 1-4.758 14.065 23.06 23.06 0 0 1-14.06 4.754c-12.792 0-23.162-10.37-23.162-23.161A23.06 23.06 0 0 1 11.67 7.809Z"
+        fill="#fff"
+      />
+      {renderIconPath()}
+      <path
+        fillRule="evenodd"
+        clipRule="evenodd"
+        d="M13.687 4.313C1.875 11.132-2.172 26.235 4.647 38.047c6.473 11.211 20.41 15.427 31.91 9.994l4.452 7.712 4.074-2.352-4.48-7.76c10.074-7.34 13.19-21.252 6.818-32.29C40.6 1.542 25.498-2.506 13.687 4.314Zm-6 31.98C1.835 26.158 5.306 13.201 15.44 7.35c10.133-5.85 23.09-2.378 28.941 7.755 5.85 10.133 2.379 23.09-7.755 28.941-10.133 5.85-23.09 2.379-28.94-7.755Z"
+        fill="#E3E3FE"
+        stroke="#9C9EDB"
+        strokeWidth=".882"
+      />
+      <path
+        d="M37.443 52.516a1 1 0 0 1 .366-1.366l4.888-2.822a1 1 0 0 1 1.366.366l9.171 15.886a3 3 0 0 1-1.098 4.098l-1.423.822a3 3 0 0 1-4.098-1.098l-9.172-15.886Z"
+        fill="#9C9EDB"
+      />
+      <path
+        d="M37.825 52.296a.559.559 0 0 1 .205-.764l4.887-2.822a.559.559 0 0 1 .764.205L52.853 64.8a2.56 2.56 0 0 1-.937 3.495l-1.423.822a2.559 2.559 0 0 1-3.496-.937l-9.172-15.885Z"
+        stroke="#9C9EDB"
+        strokeWidth=".882"
+      />
+    </svg>
+  );
+};
+
+const EmptySearchQuestion = () => renderEmptySearch("question");
+
+export default EmptySearchQuestion;
diff --git a/frontend/components/graphics/index.ts b/frontend/components/graphics/index.ts
index dfb7209263..38862d51da 100644
--- a/frontend/components/graphics/index.ts
+++ b/frontend/components/graphics/index.ts
@@ -17,6 +17,9 @@ import EmptyHosts from "./EmptyHosts";
 import EmptyTeams from "./EmptyTeams";
 import EmptyPacks from "./EmptyPacks";
 import EmptySchedule from "./EmptySchedule";
+import EmptySearchExclamation from "./EmptySearchExclamation";
+import EmptySearchCheck from "./EmptySearchCheck";
+import EmptySearchQuestion from "./EmptySearchQuestion";
 import CollectingResults from "./CollectingResults";
 import DataError from "./DataError";
 
@@ -31,6 +34,9 @@ export const GRAPHIC_MAP = {
   "empty-teams": EmptyTeams,
   "empty-packs": EmptyPacks,
   "empty-schedule": EmptySchedule,
+  "empty-search-exclamation": EmptySearchExclamation,
+  "empty-search-check": EmptySearchCheck,
+  "empty-search-question": EmptySearchQuestion,
   // File type graphics
   "file-configuration-profile": FileConfigurationProfile,
   "file-sh": FileSh,
diff --git a/frontend/components/top_nav/SiteTopNav/SiteTopNav.tsx b/frontend/components/top_nav/SiteTopNav/SiteTopNav.tsx
index 86944020b6..be5646f2c9 100644
--- a/frontend/components/top_nav/SiteTopNav/SiteTopNav.tsx
+++ b/frontend/components/top_nav/SiteTopNav/SiteTopNav.tsx
@@ -4,7 +4,7 @@ import classnames from "classnames";
 
 import { AppContext } from "context/app";
 import { IConfig } from "interfaces/config";
-import { APP_CONTEXT_ALL_TEAMS_ID } from "interfaces/team";
+import { API_ALL_TEAMS_ID, APP_CONTEXT_ALL_TEAMS_ID } from "interfaces/team";
 import { IUser } from "interfaces/user";
 import { QueryParams } from "utilities/url";
 
@@ -54,10 +54,6 @@ const REGEX_GLOBAL_PAGES = {
   PROFILE: /\/profile/i,
 };
 
-const REGEX_EXCLUDE_NO_TEAM_PAGES = {
-  MANAGE_POLICIES: /\/policies\/manage/i,
-};
-
 const testDetailPage = (path: string, re: RegExp) => {
   if (re === REGEX_DETAIL_PAGES.LABEL_EDIT) {
     // we want to match "/labels/10" but not "/hosts/manage/labels/10"
@@ -76,12 +72,6 @@ const isGlobalPage = (path: string) => {
   return Object.values(REGEX_GLOBAL_PAGES).some((re) => path.match(re));
 };
 
-const isExcludeNoTeamPage = (path: string) => {
-  return Object.values(REGEX_EXCLUDE_NO_TEAM_PAGES).some((re) =>
-    path.match(re)
-  );
-};
-
 const SiteTopNav = ({
   config,
   currentUser,
@@ -96,23 +86,19 @@ const SiteTopNav = ({
     isGlobalMaintainer,
     isAnyTeamMaintainer,
     isNoAccess,
-    isSandboxMode,
   } = useContext(AppContext);
 
   const isActiveDetailPage = isDetailPage(currentPath);
   const isActiveGlobalPage = isGlobalPage(currentPath);
 
   const currentQueryParams = { ...query };
-  if (
-    isActiveGlobalPage ||
-    (isActiveDetailPage && !currentPath.match(REGEX_DETAIL_PAGES.POLICY_EDIT))
-  ) {
-    // detail pages (e.g., host details) and some manage pages (e.g., queries) don't have team_id
-    // query params that we can simply append to the top nav links so instead we need grab the team
-    // id from context (note that policy edit page does support team_id param so we exclude that one)
+  if (isActiveGlobalPage || isActiveDetailPage) {
+    // detail pages (e.g., host details) and some manage pages (e.g., queries) aren't guaranteed to
+    // have a team_id in the URL that we can simply append to the top nav links so instead we need grab the team
+    // id from context
     currentQueryParams.team_id =
       currentTeam?.id === APP_CONTEXT_ALL_TEAMS_ID
-        ? undefined
+        ? API_ALL_TEAMS_ID
         : currentTeam?.id;
   }
 
@@ -150,7 +136,7 @@ const SiteTopNav = ({
         : currentPath;
 
       const includeTeamId = (activePath: string) => {
-        if (currentQueryParams.team_id) {
+        if (currentQueryParams.team_id !== API_ALL_TEAMS_ID) {
           return `${path}?team_id=${currentQueryParams.team_id}`;
         }
         return activePath;
@@ -174,20 +160,13 @@ const SiteTopNav = ({
       );
     }
 
-    if (
-      isExcludeNoTeamPage(navItem.location.pathname) &&
-      (currentQueryParams.team_id === "0" || currentQueryParams.team_id === 0)
-    ) {
-      currentQueryParams.team_id = undefined;
-    }
-
     return (
       <li className={navItemClasses} key={`nav-item-${name}`}>
         {withParams ? (
           <LinkWithContext
             className={`${navItemBaseClass}__link`}
             withParams={withParams}
-            currentQueryParams={currentQueryParams}
+            currentQueryParams={{ team_id: currentQueryParams.team_id }}
             to={navItem.location.pathname}
           >
             <span
@@ -220,8 +199,7 @@ const SiteTopNav = ({
     isAnyTeamAdmin,
     isAnyTeamMaintainer,
     isGlobalMaintainer,
-    isNoAccess,
-    isSandboxMode
+    isNoAccess
   );
 
   const renderNavItems = () => {
@@ -238,7 +216,6 @@ const SiteTopNav = ({
           currentUser={currentUser}
           isAnyTeamAdmin={isAnyTeamAdmin}
           isGlobalAdmin={isGlobalAdmin}
-          isSandboxMode={isSandboxMode}
         />
       </div>
     );
diff --git a/frontend/components/top_nav/SiteTopNav/navItems.ts b/frontend/components/top_nav/SiteTopNav/navItems.ts
index cbf0654723..00e145ae4b 100644
--- a/frontend/components/top_nav/SiteTopNav/navItems.ts
+++ b/frontend/components/top_nav/SiteTopNav/navItems.ts
@@ -27,8 +27,7 @@ export default (
   isAnyTeamAdmin = false,
   isAnyTeamMaintainer = false,
   isGlobalMaintainer = false,
-  isNoAccess = false,
-  isSandboxMode = false
+  isNoAccess = false
 ): INavItem[] => {
   if (!user) {
     return [];
@@ -67,7 +66,7 @@ export default (
         regex: new RegExp(`^${URL_PREFIX}/controls/`),
         pathname: PATHS.CONTROLS,
       },
-      exclude: isSandboxMode || !isMaintainerOrAdmin,
+      exclude: !isMaintainerOrAdmin,
       withParams: { type: "query", names: ["team_id"] },
     },
     {
diff --git a/frontend/components/top_nav/UserMenu/UserMenu.tsx b/frontend/components/top_nav/UserMenu/UserMenu.tsx
index 4e08464120..38f7986a43 100644
--- a/frontend/components/top_nav/UserMenu/UserMenu.tsx
+++ b/frontend/components/top_nav/UserMenu/UserMenu.tsx
@@ -17,7 +17,6 @@ interface IUserMenuProps {
   isAnyTeamAdmin: boolean | undefined;
   isGlobalAdmin: boolean | undefined;
   currentUser: IUser;
-  isSandboxMode?: boolean;
 }
 
 const UserMenu = ({
@@ -26,7 +25,6 @@ const UserMenu = ({
   isAnyTeamAdmin,
   isGlobalAdmin,
   currentUser,
-  isSandboxMode = false,
 }: IUserMenuProps): JSX.Element => {
   const accountNavigate = onNavItemClick(PATHS.ACCOUNT);
   const dropdownItems = [
@@ -44,7 +42,7 @@ const UserMenu = ({
     },
   ];
 
-  if (isGlobalAdmin && !isSandboxMode) {
+  if (isGlobalAdmin) {
     const manageUsersNavigate = onNavItemClick(PATHS.ADMIN_USERS);
 
     const manageUserNavItem = {
diff --git a/frontend/context/app.tsx b/frontend/context/app.tsx
index bf84e72aa3..8ee9a9412a 100644
--- a/frontend/context/app.tsx
+++ b/frontend/context/app.tsx
@@ -1,4 +1,4 @@
-import React, { createContext, useReducer, ReactNode } from "react";
+import React, { createContext, useReducer, useMemo, ReactNode } from "react";
 
 import { IConfig } from "interfaces/config";
 import { IEnrollSecret } from "interfaces/enroll_secret";
@@ -11,6 +11,7 @@ import {
 import { IUser } from "interfaces/user";
 import permissions from "utilities/permissions";
 import sort from "utilities/sort";
+import { hasLicenseExpired, willExpireWithinXDays } from "utilities/helpers";
 
 enum ACTIONS {
   SET_AVAILABLE_TEAMS = "SET_AVAILABLE_TEAMS",
@@ -53,9 +54,14 @@ interface ISetEnrollSecretAction {
   enrollSecret: IEnrollSecret[];
 }
 
+interface IAbmExpiry {
+  earliestExpiry: string;
+  needsAbmTermsRenewal: boolean;
+}
+
 interface ISetABMExpiryAction {
   type: ACTIONS.SET_ABM_EXPIRY;
-  abmExpiry: string;
+  abmExpiry: IAbmExpiry;
 }
 
 interface ISetAPNsExpiryAction {
@@ -144,7 +150,14 @@ type InitialStateType = {
   isOnlyObserver?: boolean;
   isObserverPlus?: boolean;
   isNoAccess?: boolean;
-  abmExpiry?: string;
+  isAppleBmExpired: boolean;
+  isApplePnsExpired: boolean;
+  isVppExpired: boolean;
+  needsAbmTermsRenewal: boolean;
+  willAppleBmExpire: boolean;
+  willApplePnsExpire: boolean;
+  willVppExpire: boolean;
+  abmExpiry?: IAbmExpiry;
   apnsExpiry?: string;
   vppExpiry?: string;
   sandboxExpiry?: string;
@@ -163,7 +176,7 @@ type InitialStateType = {
   setConfig: (config: IConfig) => void;
   setEnrollSecret: (enrollSecret: IEnrollSecret[]) => void;
   setAPNsExpiry: (apnsExpiry: string) => void;
-  setABMExpiry: (abmExpiry: string) => void;
+  setABMExpiry: (abmExpiry: IAbmExpiry) => void;
   setVppExpiry: (vppExpiry: string) => void;
   setSandboxExpiry: (sandboxExpiry: string) => void;
   setNoSandboxHosts: (noSandboxHosts: boolean) => void;
@@ -206,6 +219,13 @@ export const initialState = {
   filteredSoftwarePath: undefined,
   filteredQueriesPath: undefined,
   filteredPoliciesPath: undefined,
+  isAppleBmExpired: false,
+  isApplePnsExpired: false,
+  isVppExpired: false,
+  needsAbmTermsRenewal: false,
+  willAppleBmExpire: false,
+  willApplePnsExpire: false,
+  willVppExpire: false,
   setAvailableTeams: () => null,
   setCurrentUser: () => null,
   setCurrentTeam: () => null,
@@ -336,9 +356,13 @@ const reducer = (state: InitialStateType, action: IAction) => {
     }
     case ACTIONS.SET_ABM_EXPIRY: {
       const { abmExpiry } = action;
+      const { earliestExpiry, needsAbmTermsRenewal } = abmExpiry;
       return {
         ...state,
         abmExpiry,
+        isAppleBmExpired: hasLicenseExpired(earliestExpiry),
+        willAppleBmExpire: willExpireWithinXDays(earliestExpiry, 30),
+        needsAbmTermsRenewal,
       };
     }
     case ACTIONS.SET_APNS_EXPIRY: {
@@ -346,6 +370,8 @@ const reducer = (state: InitialStateType, action: IAction) => {
       return {
         ...state,
         apnsExpiry,
+        isApplePnsExpired: hasLicenseExpired(apnsExpiry),
+        willApplePnsExpire: willExpireWithinXDays(apnsExpiry, 30),
       };
     }
     case ACTIONS.SET_VPP_EXPIRY: {
@@ -353,6 +379,8 @@ const reducer = (state: InitialStateType, action: IAction) => {
       return {
         ...state,
         vppExpiry,
+        isVppExpired: hasLicenseExpired(vppExpiry),
+        willVppExpire: willExpireWithinXDays(vppExpiry, 30),
       };
     }
     case ACTIONS.SET_SANDBOX_EXPIRY: {
@@ -392,10 +420,9 @@ const reducer = (state: InitialStateType, action: IAction) => {
     }
     case ACTIONS.SET_FILTERED_POLICIES_PATH: {
       const { filteredPoliciesPath } = action;
-      // TODO: if policies page is updated to support team_id=0, remove the replace below
       return {
         ...state,
-        filteredPoliciesPath: filteredPoliciesPath.replace("team_id=0", ""),
+        filteredPoliciesPath,
       };
     }
     default:
@@ -408,104 +435,159 @@ export const AppContext = createContext<InitialStateType>(initialState);
 const AppProvider = ({ children }: Props): JSX.Element => {
   const [state, dispatch] = useReducer(reducer, initialState);
 
-  const value = {
-    availableTeams: state.availableTeams,
-    config: state.config,
-    currentUser: state.currentUser,
-    currentTeam: state.currentTeam,
-    enrollSecret: state.enrollSecret,
-    sandboxExpiry: state.sandboxExpiry,
-    abmExpiry: state.abmExpiry,
-    apnsExpiry: state.apnsExpiry,
-    vppExpiry: state.vppExpiry,
-    noSandboxHosts: state.noSandboxHosts,
-    filteredHostsPath: state.filteredHostsPath,
-    filteredSoftwarePath: state.filteredSoftwarePath,
-    filteredQueriesPath: state.filteredQueriesPath,
-    filteredPoliciesPath: state.filteredPoliciesPath,
-    isPreviewMode: detectPreview(),
-    isSandboxMode: state.isSandboxMode,
-    isFreeTier: state.isFreeTier,
-    isPremiumTier: state.isPremiumTier,
-    isMacMdmEnabledAndConfigured: state.isMacMdmEnabledAndConfigured,
-    isWindowsMdmEnabledAndConfigured: state.isWindowsMdmEnabledAndConfigured,
-    isGlobalAdmin: state.isGlobalAdmin,
-    isGlobalMaintainer: state.isGlobalMaintainer,
-    isGlobalObserver: state.isGlobalObserver,
-    isOnGlobalTeam: state.isOnGlobalTeam,
-    isAnyTeamObserverPlus: state.isAnyTeamObserverPlus,
-    isAnyTeamMaintainer: state.isAnyTeamMaintainer,
-    isAnyTeamMaintainerOrTeamAdmin: state.isAnyTeamMaintainerOrTeamAdmin,
-    isTeamObserver: state.isTeamObserver,
-    isTeamMaintainer: state.isTeamMaintainer,
-    isTeamAdmin: state.isTeamAdmin,
-    isTeamMaintainerOrTeamAdmin: state.isTeamMaintainerOrTeamAdmin,
-    isAnyTeamAdmin: state.isAnyTeamAdmin,
-    isOnlyObserver: state.isOnlyObserver,
-    isObserverPlus: state.isObserverPlus,
-    isNoAccess: state.isNoAccess,
-    setAvailableTeams: (user: IUser | null, availableTeams: ITeamSummary[]) => {
-      dispatch({
-        type: ACTIONS.SET_AVAILABLE_TEAMS,
-        user,
-        availableTeams,
-      });
-    },
-    setCurrentUser: (currentUser: IUser) => {
-      dispatch({ type: ACTIONS.SET_CURRENT_USER, currentUser });
-    },
-    setCurrentTeam: (currentTeam: ITeamSummary | undefined) => {
-      dispatch({ type: ACTIONS.SET_CURRENT_TEAM, currentTeam });
-    },
-    setConfig: (config: IConfig) => {
-      dispatch({ type: ACTIONS.SET_CONFIG, config });
-    },
-    setEnrollSecret: (enrollSecret: IEnrollSecret[]) => {
-      dispatch({ type: ACTIONS.SET_ENROLL_SECRET, enrollSecret });
-    },
-    setABMExpiry: (abmExpiry: string) => {
-      dispatch({ type: ACTIONS.SET_ABM_EXPIRY, abmExpiry });
-    },
-    setAPNsExpiry: (apnsExpiry: string) => {
-      dispatch({ type: ACTIONS.SET_APNS_EXPIRY, apnsExpiry });
-    },
-    setVppExpiry: (vppExpiry: string) => {
-      dispatch({
-        type: ACTIONS.SET_VPP_EXPIRY,
-        vppExpiry,
-      });
-    },
-    setSandboxExpiry: (sandboxExpiry: string) => {
-      dispatch({ type: ACTIONS.SET_SANDBOX_EXPIRY, sandboxExpiry });
-    },
-    setNoSandboxHosts: (noSandboxHosts: boolean) => {
-      dispatch({
-        type: ACTIONS.SET_NO_SANDBOX_HOSTS,
-        noSandboxHosts,
-      });
-    },
-    setFilteredHostsPath: (filteredHostsPath: string) => {
-      dispatch({ type: ACTIONS.SET_FILTERED_HOSTS_PATH, filteredHostsPath });
-    },
-    setFilteredSoftwarePath: (filteredSoftwarePath: string) => {
-      dispatch({
-        type: ACTIONS.SET_FILTERED_SOFTWARE_PATH,
-        filteredSoftwarePath,
-      });
-    },
-    setFilteredQueriesPath: (filteredQueriesPath: string) => {
-      dispatch({
-        type: ACTIONS.SET_FILTERED_QUERIES_PATH,
-        filteredQueriesPath,
-      });
-    },
-    setFilteredPoliciesPath: (filteredPoliciesPath: string) => {
-      dispatch({
-        type: ACTIONS.SET_FILTERED_POLICIES_PATH,
-        filteredPoliciesPath,
-      });
-    },
-  };
+  const value = useMemo(
+    () => ({
+      availableTeams: state.availableTeams,
+      config: state.config,
+      currentUser: state.currentUser,
+      currentTeam: state.currentTeam,
+      enrollSecret: state.enrollSecret,
+      sandboxExpiry: state.sandboxExpiry,
+      abmExpiry: state.abmExpiry,
+      apnsExpiry: state.apnsExpiry,
+      vppExpiry: state.vppExpiry,
+      isAppleBmExpired: state.isAppleBmExpired,
+      isApplePnsExpired: state.isApplePnsExpired,
+      isVppExpired: state.isVppExpired,
+      needsAbmTermsRenewal: state.needsAbmTermsRenewal,
+      willAppleBmExpire: state.willAppleBmExpire,
+      willApplePnsExpire: state.willApplePnsExpire,
+      willVppExpire: state.willVppExpire,
+      noSandboxHosts: state.noSandboxHosts,
+      filteredHostsPath: state.filteredHostsPath,
+      filteredSoftwarePath: state.filteredSoftwarePath,
+      filteredQueriesPath: state.filteredQueriesPath,
+      filteredPoliciesPath: state.filteredPoliciesPath,
+      isPreviewMode: detectPreview(),
+      isSandboxMode: state.isSandboxMode,
+      isFreeTier: state.isFreeTier,
+      isPremiumTier: state.isPremiumTier,
+      isMacMdmEnabledAndConfigured: state.isMacMdmEnabledAndConfigured,
+      isWindowsMdmEnabledAndConfigured: state.isWindowsMdmEnabledAndConfigured,
+      isGlobalAdmin: state.isGlobalAdmin,
+      isGlobalMaintainer: state.isGlobalMaintainer,
+      isGlobalObserver: state.isGlobalObserver,
+      isOnGlobalTeam: state.isOnGlobalTeam,
+      isAnyTeamObserverPlus: state.isAnyTeamObserverPlus,
+      isAnyTeamMaintainer: state.isAnyTeamMaintainer,
+      isAnyTeamMaintainerOrTeamAdmin: state.isAnyTeamMaintainerOrTeamAdmin,
+      isTeamObserver: state.isTeamObserver,
+      isTeamMaintainer: state.isTeamMaintainer,
+      isTeamAdmin: state.isTeamAdmin,
+      isTeamMaintainerOrTeamAdmin: state.isTeamMaintainerOrTeamAdmin,
+      isAnyTeamAdmin: state.isAnyTeamAdmin,
+      isOnlyObserver: state.isOnlyObserver,
+      isObserverPlus: state.isObserverPlus,
+      isNoAccess: state.isNoAccess,
+      setAvailableTeams: (
+        user: IUser | null,
+        availableTeams: ITeamSummary[]
+      ) => {
+        dispatch({
+          type: ACTIONS.SET_AVAILABLE_TEAMS,
+          user,
+          availableTeams,
+        });
+      },
+      setCurrentUser: (currentUser: IUser) => {
+        dispatch({ type: ACTIONS.SET_CURRENT_USER, currentUser });
+      },
+      setCurrentTeam: (currentTeam: ITeamSummary | undefined) => {
+        dispatch({ type: ACTIONS.SET_CURRENT_TEAM, currentTeam });
+      },
+      setConfig: (config: IConfig) => {
+        dispatch({ type: ACTIONS.SET_CONFIG, config });
+      },
+      setEnrollSecret: (enrollSecret: IEnrollSecret[]) => {
+        dispatch({ type: ACTIONS.SET_ENROLL_SECRET, enrollSecret });
+      },
+      setABMExpiry: (abmExpiry: IAbmExpiry) => {
+        dispatch({ type: ACTIONS.SET_ABM_EXPIRY, abmExpiry });
+      },
+      setAPNsExpiry: (apnsExpiry: string) => {
+        dispatch({ type: ACTIONS.SET_APNS_EXPIRY, apnsExpiry });
+      },
+      setVppExpiry: (vppExpiry: string) => {
+        dispatch({
+          type: ACTIONS.SET_VPP_EXPIRY,
+          vppExpiry,
+        });
+      },
+      setSandboxExpiry: (sandboxExpiry: string) => {
+        dispatch({ type: ACTIONS.SET_SANDBOX_EXPIRY, sandboxExpiry });
+      },
+      setNoSandboxHosts: (noSandboxHosts: boolean) => {
+        dispatch({
+          type: ACTIONS.SET_NO_SANDBOX_HOSTS,
+          noSandboxHosts,
+        });
+      },
+      setFilteredHostsPath: (filteredHostsPath: string) => {
+        dispatch({ type: ACTIONS.SET_FILTERED_HOSTS_PATH, filteredHostsPath });
+      },
+      setFilteredSoftwarePath: (filteredSoftwarePath: string) => {
+        dispatch({
+          type: ACTIONS.SET_FILTERED_SOFTWARE_PATH,
+          filteredSoftwarePath,
+        });
+      },
+      setFilteredQueriesPath: (filteredQueriesPath: string) => {
+        dispatch({
+          type: ACTIONS.SET_FILTERED_QUERIES_PATH,
+          filteredQueriesPath,
+        });
+      },
+      setFilteredPoliciesPath: (filteredPoliciesPath: string) => {
+        dispatch({
+          type: ACTIONS.SET_FILTERED_POLICIES_PATH,
+          filteredPoliciesPath,
+        });
+      },
+    }),
+    [
+      state.abmExpiry,
+      state.apnsExpiry,
+      state.availableTeams,
+      state.config,
+      state.currentTeam,
+      state.currentUser,
+      state.enrollSecret,
+      state.filteredHostsPath,
+      state.filteredPoliciesPath,
+      state.filteredQueriesPath,
+      state.filteredSoftwarePath,
+      state.isAnyTeamAdmin,
+      state.isAnyTeamMaintainer,
+      state.isAnyTeamMaintainerOrTeamAdmin,
+      state.isAnyTeamObserverPlus,
+      state.isAppleBmExpired,
+      state.isApplePnsExpired,
+      state.isFreeTier,
+      state.isGlobalAdmin,
+      state.isGlobalMaintainer,
+      state.isGlobalObserver,
+      state.isMacMdmEnabledAndConfigured,
+      state.isNoAccess,
+      state.isObserverPlus,
+      state.isOnGlobalTeam,
+      state.isOnlyObserver,
+      state.isPremiumTier,
+      state.isSandboxMode,
+      state.isTeamAdmin,
+      state.isTeamMaintainer,
+      state.isTeamMaintainerOrTeamAdmin,
+      state.isTeamObserver,
+      state.isVppExpired,
+      state.isWindowsMdmEnabledAndConfigured,
+      state.needsAbmTermsRenewal,
+      state.noSandboxHosts,
+      state.sandboxExpiry,
+      state.vppExpiry,
+      state.willAppleBmExpire,
+      state.willApplePnsExpire,
+      state.willVppExpire,
+    ]
+  );
   return <AppContext.Provider value={value}>{children}</AppContext.Provider>;
 };
 
diff --git a/frontend/context/table.tsx b/frontend/context/table.tsx
index 25dac2b10c..bcd3400f50 100644
--- a/frontend/context/table.tsx
+++ b/frontend/context/table.tsx
@@ -1,4 +1,4 @@
-import React, { createContext, useReducer, ReactNode } from "react";
+import React, { createContext, useReducer, useMemo, ReactNode } from "react";
 
 type Props = {
   children: ReactNode;
@@ -32,12 +32,15 @@ export const TableContext = createContext<InitialStateType>(initialState);
 const TableProvider = ({ children }: Props) => {
   const [state, dispatch] = useReducer(reducer, initialState);
 
-  const value = {
-    resetSelectedRows: state.resetSelectedRows,
-    setResetSelectedRows: (resetSelectedRows: boolean) => {
-      dispatch({ type: actions.RESET_SELECTED_ROWS, resetSelectedRows });
-    },
-  };
+  const value = useMemo(
+    () => ({
+      resetSelectedRows: state.resetSelectedRows,
+      setResetSelectedRows: (resetSelectedRows: boolean) => {
+        dispatch({ type: actions.RESET_SELECTED_ROWS, resetSelectedRows });
+      },
+    }),
+    [state.resetSelectedRows]
+  );
 
   return (
     <TableContext.Provider value={value}>{children}</TableContext.Provider>
diff --git a/frontend/hooks/useTeamIdParam.ts b/frontend/hooks/useTeamIdParam.ts
index f1683aa204..79e4b6cfbe 100644
--- a/frontend/hooks/useTeamIdParam.ts
+++ b/frontend/hooks/useTeamIdParam.ts
@@ -16,7 +16,6 @@ import {
 import { IUser, IUserRole } from "interfaces/user";
 import permissions from "utilities/permissions";
 import sort from "utilities/sort";
-import { HOSTS_QUERY_PARAMS } from "services/entities/hosts";
 
 type OnTeamChangeFuncShouldStripParam = (
   teamIdForApi: number | undefined
@@ -329,7 +328,7 @@ export const useTeamIdParam = ({
 
   const handleTeamChange = useCallback(
     (teamId: number) => {
-      // TODO: This results in a warning that TableProvider is being updated while rendering while
+      // TODO: This results in a warning that TableProvider is being updated while
       // rendering a different component (the component that invokes the useTeamIdParam hook).
       // This requires further investigation but is not currently causing any known issues.
       if (resetSelectedRowsOnTeamChange) {
@@ -394,7 +393,10 @@ export const useTeamIdParam = ({
     currentTeamId: currentTeam?.id,
     currentTeamName: currentTeam?.name,
     currentTeamSummary: currentTeam,
+    // not including the 'No team' "team", whose id of 0 is falsey
     isAnyTeamSelected: isAnyTeamSelected(currentTeam?.id),
+    isAllTeamsSelected:
+      !isAnyTeamSelected(currentTeam?.id) && currentTeam?.id !== 0,
     isRouteOk,
     isTeamAdmin:
       !!currentTeam?.id && permissions.isTeamAdmin(currentUser, currentTeam.id),
@@ -411,7 +413,7 @@ export const useTeamIdParam = ({
       !!currentTeam?.id &&
       !!currentUser &&
       permissions.isObserverPlus(currentUser, currentTeam.id),
-    teamIdForApi: getTeamIdForApi({ currentTeam, includeNoTeam }), // for everywhere except AppContext
+    teamIdForApi: getTeamIdForApi({ currentTeam, includeNoTeam }), // for everywhere except AppContext: team_id=0 for No team (same as currentTeamId), undefined for All teams
     userTeams,
     handleTeamChange,
   };
diff --git a/frontend/interfaces/activity.ts b/frontend/interfaces/activity.ts
index 8854af1935..d8eacf643e 100644
--- a/frontend/interfaces/activity.ts
+++ b/frontend/interfaces/activity.ts
@@ -78,8 +78,10 @@ export enum ActivityType {
   EditedDeclarationProfile = "edited_declaration_profile",
   ResentConfigurationProfile = "resent_configuration_profile",
   AddedSoftware = "added_software",
+  EditedSoftware = "edited_software",
   DeletedSoftware = "deleted_software",
   InstalledSoftware = "installed_software",
+  UninstalledSoftware = "uninstalled_software",
   EnabledVpp = "enabled_vpp",
   DisabledVpp = "disabled_vpp",
   AddedAppStoreApp = "added_app_store_app",
@@ -93,12 +95,14 @@ export type IHostPastActivityType =
   | ActivityType.LockedHost
   | ActivityType.UnlockedHost
   | ActivityType.InstalledSoftware
+  | ActivityType.UninstalledSoftware
   | ActivityType.InstalledAppStoreApp;
 
 // This is a subset of ActivityType that are shown only for the host upcoming activities
 export type IHostUpcomingActivityType =
   | ActivityType.RanScript
   | ActivityType.InstalledSoftware
+  | ActivityType.UninstalledSoftware
   | ActivityType.InstalledAppStoreApp;
 
 export interface IActivity {
@@ -169,4 +173,5 @@ export interface IActivityDetails {
   self_service?: boolean;
   command_uuid?: string;
   app_store_id?: number;
+  location?: string; // name of location associated with VPP token
 }
diff --git a/frontend/interfaces/config.ts b/frontend/interfaces/config.ts
index 8ba36f0fa0..4c4d4d6e9e 100644
--- a/frontend/interfaces/config.ts
+++ b/frontend/interfaces/config.ts
@@ -47,6 +47,11 @@ export interface IMdmConfig {
   only supported apple mdm, so thats why it's name the way it is. */
   enabled_and_configured: boolean;
   apple_bm_default_team?: string;
+  /**
+   * @deprecated
+   * Refer to needsAbmTermsRenewal from AppContext instead of config.apple_bm_terms_expired.
+   * https://github.com/fleetdm/fleet/pull/21043/files#r1705977965
+   */
   apple_bm_terms_expired: boolean;
   apple_bm_enabled_and_configured: boolean;
   windows_enabled_and_configured: boolean;
diff --git a/frontend/interfaces/errors.ts b/frontend/interfaces/errors.ts
index 9fc72c82bd..4a109200bd 100644
--- a/frontend/interfaces/errors.ts
+++ b/frontend/interfaces/errors.ts
@@ -122,22 +122,6 @@ const filterFleetErrorReasonIncludes = (errs: unknown[], value: string) => {
     | undefined;
 };
 
-const DEFAULT_ERROR_MSG_FOR_SQL_ERROR =
-  "An error occurred with the Fleet server.";
-
-/**
- * This function checks if the error reason is a SQL error. The API sends a
- * specific error message for sql errors that begin with this format:
- * `Error 123 (123):`
-
- * This will look to match strings in this format, for example:
- *
- * Error 1234 (23000): Duplicate entry 'foo' for key 'bar'
- */
-const isSqlError = (reason: string) => {
-  return new RegExp(/^Error \d+ \(\d+\):/g).test(reason);
-};
-
 const getReasonFromErrors = (errors: unknown[], filter?: IFilterFleetError) => {
   if (!errors.length) {
     return "";
@@ -152,20 +136,7 @@ const getReasonFromErrors = (errors: unknown[], filter?: IFilterFleetError) => {
     fleetError = isFleetApiError(errors[0]) ? errors[0] : undefined;
   }
 
-  // We do not want to display the specific SQL error message to the user in the UI.
-  // Instead, we want to display a generic error message. This at least offers
-  // some level of security by not leaking the specific SQL error message
-  // to the user, even though you can still find the SQL error message in the
-  // API response.
-  //
-  // TODO: This should really be handled on the server and in the future
-  // we can remove this.
-  let reason = fleetError?.reason ?? "";
-  if (isSqlError(reason)) {
-    reason = DEFAULT_ERROR_MSG_FOR_SQL_ERROR;
-  }
-
-  return reason;
+  return fleetError?.reason || "";
 };
 
 const getReasonFromRecordWithDataErrors = (
diff --git a/frontend/interfaces/mdm.ts b/frontend/interfaces/mdm.ts
index 496cc1c8b9..2f822eb968 100644
--- a/frontend/interfaces/mdm.ts
+++ b/frontend/interfaces/mdm.ts
@@ -1,4 +1,5 @@
 import { IConfigServerSettings } from "./config";
+import { ITeamSummary } from "./team";
 
 export interface IMdmApple {
   common_name: string;
@@ -15,6 +16,31 @@ export interface IMdmAppleBm {
   renew_date: string;
 }
 
+export type ITokenTeam = {
+  team_id: number;
+  name: string;
+};
+
+export interface IMdmAbmToken {
+  id: number;
+  apple_id: string;
+  org_name: string;
+  mdm_server_url: string;
+  renew_date: string;
+  terms_expired: boolean;
+  macos_team: ITokenTeam;
+  ios_team: ITokenTeam;
+  ipados_team: ITokenTeam;
+}
+
+export interface IMdmVppToken {
+  id: number;
+  org_name: string;
+  location: string;
+  renew_date: string;
+  teams: ITokenTeam[] | null; // null means token isn't configured to a team; empty array means all teams
+}
+
 export const getMdmServerUrl = ({ server_url }: IConfigServerSettings) => {
   return server_url.concat("/mdm/apple/mdm");
 };
diff --git a/frontend/interfaces/package_type.ts b/frontend/interfaces/package_type.ts
new file mode 100644
index 0000000000..8afb43cef3
--- /dev/null
+++ b/frontend/interfaces/package_type.ts
@@ -0,0 +1,22 @@
+const unixPackageTypes = ["pkg", "deb"] as const;
+const windowsPackageTypes = ["msi", "exe"] as const;
+export const packageTypes = [
+  ...unixPackageTypes,
+  ...windowsPackageTypes,
+] as const;
+
+export type WindowsPackageType = typeof windowsPackageTypes[number];
+export type UnixPackageType = typeof unixPackageTypes[number];
+export type PackageType = WindowsPackageType | UnixPackageType;
+
+export const isWindowsPackageType = (s: any): s is WindowsPackageType => {
+  return windowsPackageTypes.includes(s);
+};
+
+export const isUnixPackageType = (s: any): s is UnixPackageType => {
+  return unixPackageTypes.includes(s);
+};
+
+export const isPackageType = (s: any): s is PackageType => {
+  return packageTypes.includes(s);
+};
diff --git a/frontend/interfaces/platform.ts b/frontend/interfaces/platform.ts
index 0d1c153b6a..2be1f412d4 100644
--- a/frontend/interfaces/platform.ts
+++ b/frontend/interfaces/platform.ts
@@ -108,3 +108,6 @@ export const isAppleDevice = (platform: string) => {
     platform as typeof HOST_APPLE_PLATFORMS[number]
   );
 };
+
+export const isIPadOrIPhone = (platform: string | HostPlatform) =>
+  ["ios", "ipados"].includes(platform);
diff --git a/frontend/interfaces/policy.ts b/frontend/interfaces/policy.ts
index 41586ea22d..621c52f638 100644
--- a/frontend/interfaces/policy.ts
+++ b/frontend/interfaces/policy.ts
@@ -41,6 +41,12 @@ export interface IPolicy {
   updated_at: string;
   critical: boolean;
   calendar_events_enabled: boolean;
+  install_software?: IPolicySoftwareToInstall;
+}
+
+export interface IPolicySoftwareToInstall {
+  name: string;
+  software_title_id: number;
 }
 
 // Used on the manage hosts page and other places where aggregate stats are displayed
@@ -94,6 +100,8 @@ export interface IPolicyFormData {
   team_id?: number | null;
   id?: number;
   calendar_events_enabled?: boolean;
+  // undefined from GET/LIST when not set, null for PATCH to unset
+  software_title_id?: number | null;
 }
 
 export interface IPolicyNew {
diff --git a/frontend/interfaces/software.ts b/frontend/interfaces/software.ts
index 62ad068bd1..a3e633a8bb 100644
--- a/frontend/interfaces/software.ts
+++ b/frontend/interfaces/software.ts
@@ -40,6 +40,8 @@ export interface ISoftware {
   hosts_count?: number;
   last_opened_at?: string | null; // e.g., "2021-08-18T15:11:35Z”
   installed_paths?: string[];
+  browser?: string;
+  vendor?: string;
 }
 
 export type IVulnerabilitySoftware = Omit<ISoftware, "vulnerabilities"> & {
@@ -64,8 +66,10 @@ export interface ISoftwarePackage {
   icon_url: string | null;
   status: {
     installed: number;
-    pending: number;
-    failed: number;
+    pending_install: number;
+    failed_install: number;
+    pending_uninstall: number;
+    failed_uninstall: number;
   };
 }
 
@@ -79,6 +83,7 @@ export interface IAppStoreApp {
   app_store_id: number;
   latest_version: string;
   icon_url: string;
+  self_service: boolean;
   status: {
     installed: number;
     pending: number;
@@ -106,6 +111,7 @@ export interface ISoftwareTitleDetails {
   source: string; // "apps" | "ios_apps" | "ipados_apps" | ?
   hosts_count: number;
   versions: ISoftwareTitleVersion[] | null;
+  versions_updated_at?: string;
   bundle_identifier?: string;
   browser?: string;
   versions_count?: number;
@@ -190,10 +196,19 @@ export const formatSoftwareType = ({
 /**
  * This list comprises all possible states of software install operations.
  */
+export const SOFTWARE_UNINSTALL_STATUSES = [
+  "uninstalled",
+  "pending_uninstall",
+  "failed_uninstall",
+] as const;
+
+export type SoftwareUninstallStatus = typeof SOFTWARE_UNINSTALL_STATUSES[number];
+
 export const SOFTWARE_INSTALL_STATUSES = [
-  "failed",
   "installed",
-  "pending",
+  "pending_install",
+  "failed_install",
+  ...SOFTWARE_UNINSTALL_STATUSES,
 ] as const;
 
 /*
@@ -202,26 +217,51 @@ export const SOFTWARE_INSTALL_STATUSES = [
 export type SoftwareInstallStatus = typeof SOFTWARE_INSTALL_STATUSES[number];
 
 export const isValidSoftwareInstallStatus = (
-  s: string | undefined
+  s: string | undefined | null
 ): s is SoftwareInstallStatus =>
   !!s && SOFTWARE_INSTALL_STATUSES.includes(s as SoftwareInstallStatus);
 
+export const SOFTWARE_AGGREGATE_STATUSES = [
+  "installed",
+  "pending",
+  "failed",
+] as const;
+
+export type SoftwareAggregateStatus = typeof SOFTWARE_AGGREGATE_STATUSES[number];
+
+export const isValidSoftwareAggregateStatus = (
+  s: string | undefined | null
+): s is SoftwareAggregateStatus =>
+  !!s && SOFTWARE_AGGREGATE_STATUSES.includes(s as SoftwareAggregateStatus);
+
+export const isSoftwareUninstallStatus = (
+  s: string | undefined | null
+): s is SoftwareUninstallStatus =>
+  !!s && SOFTWARE_UNINSTALL_STATUSES.includes(s as SoftwareUninstallStatus);
+
+// not a typeguard, as above 2 functions are
+export const isPendingStatus = (s: string | undefined | null) =>
+  ["pending_install", "pending_uninstall"].includes(s || "");
+
 /**
  * ISoftwareInstallResult is the shape of a software install result object
  * returned by the Fleet API.
  */
 export interface ISoftwareInstallResult {
+  host_display_name?: string;
   install_uuid: string;
   software_title: string;
   software_title_id: number;
   software_package: string;
   host_id: number;
-  host_display_name: string;
   status: SoftwareInstallStatus;
   detail: string;
   output: string;
   pre_install_query_output: string;
   post_install_script_output: string;
+  created_at: string;
+  updated_at: string | null;
+  self_service: boolean;
 }
 
 export interface ISoftwareInstallResults {
@@ -272,16 +312,23 @@ export interface IHostSoftware {
   app_store_app: IHostAppStoreApp | null;
   source: string;
   bundle_identifier?: string;
-  status: SoftwareInstallStatus | null;
+  status: Exclude<SoftwareInstallStatus, "uninstalled"> | null;
   installed_versions: ISoftwareInstallVersion[] | null;
 }
 
 export type IDeviceSoftware = IHostSoftware;
 
-const INSTALL_STATUS_PREDICATES: Record<SoftwareInstallStatus, string> = {
-  failed: "failed to install",
+const INSTALL_STATUS_PREDICATES: Record<
+  SoftwareInstallStatus | "pending",
+  string
+> = {
+  pending: "pending",
   installed: "installed",
-  pending: "told Fleet to install",
+  uninstalled: "uninstalled",
+  pending_install: "told Fleet to install",
+  failed_install: "failed to install",
+  pending_uninstall: "told Fleet to uninstall",
+  failed_uninstall: "failed to uninstall",
 } as const;
 
 export const getInstallStatusPredicate = (status: string | undefined) => {
@@ -294,10 +341,26 @@ export const getInstallStatusPredicate = (status: string | undefined) => {
   );
 };
 
-export const INSTALL_STATUS_ICONS: Record<SoftwareInstallStatus, IconNames> = {
+export const aggregateInstallStatusCounts = (
+  packageStatuses: ISoftwarePackage["status"]
+) => ({
+  installed: packageStatuses.installed,
+  pending: packageStatuses.pending_install + packageStatuses.pending_uninstall,
+  failed: packageStatuses.failed_install + packageStatuses.failed_uninstall,
+});
+
+export const INSTALL_STATUS_ICONS: Record<
+  SoftwareInstallStatus | "pending" | "failed",
+  IconNames
+> = {
   pending: "pending-outline",
+  pending_install: "pending-outline",
   installed: "success-outline",
+  uninstalled: "success-outline",
   failed: "error-outline",
+  failed_install: "error-outline",
+  pending_uninstall: "pending-outline",
+  failed_uninstall: "error-outline",
 } as const;
 
 type IHostSoftwarePackageWithLastInstall = IHostSoftwarePackage & {
@@ -323,3 +386,6 @@ export const hasHostSoftwareAppLastInstall = (
 } => {
   return !!software.app_store_app?.last_install;
 };
+
+export const isIpadOrIphoneSoftwareSource = (source: string) =>
+  ["ios_apps", "ipados_apps"].includes(source);
diff --git a/frontend/interfaces/vulnerability.ts b/frontend/interfaces/vulnerability.ts
index 92329b2b1a..40c2e237b1 100644
--- a/frontend/interfaces/vulnerability.ts
+++ b/frontend/interfaces/vulnerability.ts
@@ -1,8 +1,5 @@
 import PropTypes from "prop-types";
 
-import { IVulnerabilityOSVersion } from "./operating_system";
-import { IVulnerabilitySoftware } from "./software";
-
 export default PropTypes.shape({
   cve: PropTypes.string,
   details_link: PropTypes.string,
diff --git a/frontend/pages/DashboardPage/DashboardPage.tsx b/frontend/pages/DashboardPage/DashboardPage.tsx
index 345e6eb7b6..1816ab4cee 100644
--- a/frontend/pages/DashboardPage/DashboardPage.tsx
+++ b/frontend/pages/DashboardPage/DashboardPage.tsx
@@ -4,6 +4,7 @@ import React, {
   useEffect,
   useRef,
   useCallback,
+  useMemo,
 } from "react";
 import { InjectedRouter } from "react-router";
 import { useQuery } from "react-query";
@@ -19,11 +20,7 @@ import {
 } from "interfaces/enroll_secret";
 import { IHostSummary, IHostSummaryPlatforms } from "interfaces/host_summary";
 import { ILabelSummary } from "interfaces/label";
-import {
-  IMacadminAggregate,
-  IMunkiIssuesAggregate,
-  IMunkiVersionsAggregate,
-} from "interfaces/macadmins";
+import { IMacadminAggregate } from "interfaces/macadmins";
 import {
   IMdmStatusCardData,
   IMdmSummaryResponse,
@@ -150,7 +147,6 @@ const DashboardPage = ({ router, location }: IDashboardProps): JSX.Element => {
   const [softwareNavTabIndex, setSoftwareNavTabIndex] = useState(0);
   const [softwarePageIndex, setSoftwarePageIndex] = useState(0);
   const [softwareActionUrl, setSoftwareActionUrl] = useState<string>();
-  const [showMunkiCard, setShowMunkiCard] = useState(true);
   const [showMdmCard, setShowMdmCard] = useState(true);
   const [showSoftwareCard, setShowSoftwareCard] = useState(false);
   const [showAddHostsModal, setShowAddHostsModal] = useState(false);
@@ -172,18 +168,9 @@ const DashboardPage = ({ router, location }: IDashboardProps): JSX.Element => {
 
   const selectedMdmSolutionName = useRef<string>("");
 
-  const [munkiIssuesData, setMunkiIssuesData] = useState<
-    IMunkiIssuesAggregate[]
-  >([]);
-  const [munkiVersionsData, setMunkiVersionsData] = useState<
-    IMunkiVersionsAggregate[]
-  >([]);
   const [mdmTitleDetail, setMdmTitleDetail] = useState<
     JSX.Element | string | null
   >();
-  const [munkiTitleDetail, setMunkiTitleDetail] = useState<
-    JSX.Element | string | null
-  >();
 
   useEffect(() => {
     const platformByPathname =
@@ -423,26 +410,24 @@ const DashboardPage = ({ router, location }: IDashboardProps): JSX.Element => {
     }
   );
 
-  const { isFetching: isMacAdminsFetching, error: errorMacAdmins } = useQuery<
-    IMacadminAggregate,
-    Error
-  >(["macAdmins", teamIdForApi], () => macadminsAPI.loadAll(teamIdForApi), {
-    keepPreviousData: true,
-    enabled: isRouteOk && selectedPlatform === "darwin",
-    onSuccess: ({
-      macadmins: { munki_issues, munki_versions, counts_updated_at },
-    }) => {
-      setMunkiVersionsData(munki_versions);
-      setMunkiIssuesData(munki_issues);
-      setShowMunkiCard(!!munki_versions);
-      setMunkiTitleDetail(
-        <LastUpdatedText
-          lastUpdatedAt={counts_updated_at}
-          whatToRetrieve="Munki"
-        />
-      );
-    },
-  });
+  const {
+    data: macAdminsData,
+    isFetching: isMacAdminsFetching,
+    error: errorMacAdmins,
+  } = useQuery<IMacadminAggregate, Error, IMacadminAggregate["macadmins"]>(
+    ["macAdmins", teamIdForApi],
+    () => macadminsAPI.loadAll(teamIdForApi),
+    {
+      select: (data) => data.macadmins,
+      keepPreviousData: true,
+      enabled: isRouteOk && selectedPlatform === "darwin",
+    }
+  );
+  const {
+    munki_issues: munkiIssues,
+    munki_versions: munkiVersions,
+    counts_updated_at: munkiCountsUpdatedAt,
+  } = macAdminsData || {};
 
   useEffect(() => {
     softwareCount && softwareCount > 0
@@ -536,13 +521,6 @@ const DashboardPage = ({ router, location }: IDashboardProps): JSX.Element => {
       renderFlash,
     ]
   );
-  // TODO: Rework after backend is adjusted to differentiate empty search/filter results from
-  // collecting inventory
-  const isCollectingInventory =
-    !isAnyTeamSelected &&
-    !softwarePageIndex &&
-    !software?.software &&
-    software?.counts_updated_at === null;
 
   const HostsSummaryCard = useInfoCard({
     title: "Hosts",
@@ -655,7 +633,6 @@ const DashboardPage = ({ router, location }: IDashboardProps): JSX.Element => {
     children: (
       <Software
         errorSoftware={errorSoftware}
-        isCollectingInventory={isCollectingInventory}
         isSoftwareFetching={isSoftwareFetching}
         isSoftwareEnabled={isSoftwareEnabled}
         software={software}
@@ -668,6 +645,16 @@ const DashboardPage = ({ router, location }: IDashboardProps): JSX.Element => {
     ),
   });
 
+  const munkiTitleDetail = useMemo(
+    () => (
+      <LastUpdatedText
+        lastUpdatedAt={munkiCountsUpdatedAt}
+        whatToRetrieve="Munki"
+      />
+    ),
+    [munkiCountsUpdatedAt]
+  );
+
   const MunkiCard = useInfoCard({
     title: "Munki",
     titleDetail: munkiTitleDetail,
@@ -686,8 +673,8 @@ const DashboardPage = ({ router, location }: IDashboardProps): JSX.Element => {
       <Munki
         errorMacAdmins={errorMacAdmins}
         isMacAdminsFetching={isMacAdminsFetching}
-        munkiIssuesData={munkiIssuesData}
-        munkiVersionsData={munkiVersionsData}
+        munkiIssuesData={munkiIssues || []}
+        munkiVersionsData={munkiVersions || []}
         selectedTeamId={currentTeamId}
       />
     ),
@@ -752,7 +739,7 @@ const DashboardPage = ({ router, location }: IDashboardProps): JSX.Element => {
     <>
       <div className={`${baseClass}__section`}>{OperatingSystemsCard}</div>
       {showMdmCard && <div className={`${baseClass}__section`}>{MDMCard}</div>}
-      {showMunkiCard && (
+      {!!munkiVersions && (
         <div className={`${baseClass}__section`}>{MunkiCard}</div>
       )}
     </>
diff --git a/frontend/pages/DashboardPage/cards/ActivityFeed/ActivityFeed.tsx b/frontend/pages/DashboardPage/cards/ActivityFeed/ActivityFeed.tsx
index c9e6b08af9..47f08d4430 100644
--- a/frontend/pages/DashboardPage/cards/ActivityFeed/ActivityFeed.tsx
+++ b/frontend/pages/DashboardPage/cards/ActivityFeed/ActivityFeed.tsx
@@ -18,6 +18,7 @@ import FleetIcon from "components/icons/FleetIcon";
 
 import { AppInstallDetailsModal } from "components/ActivityDetails/InstallDetails/AppInstallDetails";
 import { SoftwareInstallDetailsModal } from "components/ActivityDetails/InstallDetails/SoftwareInstallDetails/SoftwareInstallDetails";
+import SoftwareUninstallDetailsModal from "components/ActivityDetails/InstallDetails/SoftwareUninstallDetailsModal/SoftwareUninstallDetailsModal";
 
 import ActivityItem from "./ActivityItem";
 import ScriptDetailsModal from "./components/ScriptDetailsModal/ScriptDetailsModal";
@@ -41,6 +42,10 @@ const ActivityFeed = ({
     packageInstallDetails,
     setPackageInstallDetails,
   ] = useState<IActivityDetails | null>(null);
+  const [
+    packageUninstallDetails,
+    setPackageUninstallDetails,
+  ] = useState<IActivityDetails | null>(null);
   const [
     appInstallDetails,
     setAppInstallDetails,
@@ -106,6 +111,9 @@ const ActivityFeed = ({
       case ActivityType.InstalledSoftware:
         setPackageInstallDetails({ ...details });
         break;
+      case ActivityType.UninstalledSoftware:
+        setPackageUninstallDetails({ ...details });
+        break;
       case ActivityType.InstalledAppStoreApp:
         setAppInstallDetails({ ...details });
         break;
@@ -205,6 +213,12 @@ const ActivityFeed = ({
           onCancel={() => setPackageInstallDetails(null)}
         />
       )}
+      {packageUninstallDetails && (
+        <SoftwareUninstallDetailsModal
+          details={packageUninstallDetails}
+          onCancel={() => setPackageUninstallDetails(null)}
+        />
+      )}
       {appInstallDetails && (
         <AppInstallDetailsModal
           details={appInstallDetails}
diff --git a/frontend/pages/DashboardPage/cards/ActivityFeed/ActivityItem/ActivityItem.tests.tsx b/frontend/pages/DashboardPage/cards/ActivityFeed/ActivityItem/ActivityItem.tests.tsx
index f04e855af7..b12c50a802 100644
--- a/frontend/pages/DashboardPage/cards/ActivityFeed/ActivityItem/ActivityItem.tests.tsx
+++ b/frontend/pages/DashboardPage/cards/ActivityFeed/ActivityItem/ActivityItem.tests.tsx
@@ -1057,6 +1057,29 @@ describe("Activity Feed", () => {
     expect(withNoTeams).toBeNull();
   });
 
+  it("renders an 'edited_script' type activity for a team", () => {
+    const activity = createMockActivity({
+      type: ActivityType.EditedScript,
+      details: { team_name: "Alphas" },
+    });
+    render(<ActivityItem activity={activity} isPremiumTier />);
+
+    expect(
+      screen.getByText("edited scripts", { exact: false })
+    ).toBeInTheDocument();
+    expect(
+      screen.getByText(" for the ", {
+        exact: false,
+      })
+    ).toBeInTheDocument();
+    expect(screen.getByText("Alphas")).toBeInTheDocument();
+    expect(
+      screen.getByText(" team via fleetctl.", { exact: false })
+    ).toBeInTheDocument();
+    const withNoTeams = screen.queryByText("no team");
+    expect(withNoTeams).toBeNull();
+  });
+
   it("renders a 'deleted_script' type activity for a team", () => {
     const activity = createMockActivity({
       type: ActivityType.DeletedScript,
@@ -1095,6 +1118,21 @@ describe("Activity Feed", () => {
     ).toBeInTheDocument();
   });
 
+  it("renders an 'edited_script' type activity for hosts with no team.", () => {
+    const activity = createMockActivity({
+      type: ActivityType.EditedScript,
+      details: {},
+    });
+    render(<ActivityItem activity={activity} isPremiumTier />);
+
+    expect(
+      screen.getByText("edited scripts", { exact: false })
+    ).toBeInTheDocument();
+    expect(
+      screen.getByText("for no team via fleetctl.", { exact: false })
+    ).toBeInTheDocument();
+  });
+
   it("renders a 'deleted_script' type activity for hosts with no team.", () => {
     const activity = createMockActivity({
       type: ActivityType.DeletedScript,
@@ -1111,42 +1149,141 @@ describe("Activity Feed", () => {
     ).toBeInTheDocument();
   });
 
-  it("renders an 'edited_script' type activity for a team", () => {
+  it("renders an 'added_software' type activity for a team", () => {
     const activity = createMockActivity({
-      type: ActivityType.EditedScript,
-      details: { team_name: "Alphas" },
+      type: ActivityType.AddedSoftware,
+      details: {
+        software_title: "Foo bar",
+        software_package: "foobar.pkg",
+        team_name: "Alphas",
+      },
     });
     render(<ActivityItem activity={activity} isPremiumTier />);
 
     expect(
-      screen.getByText("edited scripts", { exact: false })
+      screen.getByText("added software ", { exact: false })
     ).toBeInTheDocument();
     expect(
-      screen.getByText(" for the ", {
+      screen.getByText("foobar.pkg", { exact: false })
+    ).toBeInTheDocument();
+    expect(
+      screen.getByText(" to the ", {
         exact: false,
       })
     ).toBeInTheDocument();
     expect(screen.getByText("Alphas")).toBeInTheDocument();
-    expect(
-      screen.getByText(" team via fleetctl.", { exact: false })
-    ).toBeInTheDocument();
+    expect(screen.getByText(" team.", { exact: false })).toBeInTheDocument();
     const withNoTeams = screen.queryByText("no team");
     expect(withNoTeams).toBeNull();
   });
-  it("renders an 'edited_script' type activity for hosts with no team.", () => {
+
+  it("renders an 'edited_software' type activity for a team", () => {
     const activity = createMockActivity({
-      type: ActivityType.EditedScript,
-      details: {},
+      type: ActivityType.EditedSoftware,
+      details: {
+        software_title: "Foo bar",
+        software_package: "foobar.pkg",
+        team_name: "Alphas",
+      },
     });
     render(<ActivityItem activity={activity} isPremiumTier />);
 
     expect(
-      screen.getByText("edited scripts", { exact: false })
+      screen.getByText("edited software", { exact: false })
     ).toBeInTheDocument();
     expect(
-      screen.getByText("for no team via fleetctl.", { exact: false })
+      screen.getByText(" on the ", {
+        exact: false,
+      })
+    ).toBeInTheDocument();
+    expect(screen.getByText("Alphas")).toBeInTheDocument();
+    expect(screen.getByText(" team.", { exact: false })).toBeInTheDocument();
+    const withNoTeams = screen.queryByText("no team");
+    expect(withNoTeams).toBeNull();
+  });
+
+  it("renders a 'deleted_software' type activity for a team", () => {
+    const activity = createMockActivity({
+      type: ActivityType.DeletedSoftware,
+      details: {
+        software_title: "Foo bar",
+        software_package: "foobar.pkg",
+        team_name: "Alphas",
+      },
+    });
+    render(<ActivityItem activity={activity} isPremiumTier />);
+
+    expect(
+      screen.getByText("deleted software ", { exact: false })
+    ).toBeInTheDocument();
+    expect(
+      screen.getByText("foobar.pkg", { exact: false })
+    ).toBeInTheDocument();
+    expect(
+      screen.getByText(" from the ", {
+        exact: false,
+      })
+    ).toBeInTheDocument();
+    expect(screen.getByText("Alphas")).toBeInTheDocument();
+    expect(screen.getByText(" team.", { exact: false })).toBeInTheDocument();
+    const withNoTeams = screen.queryByText("no team");
+    expect(withNoTeams).toBeNull();
+  });
+
+  it("renders an 'added_software' type activity for hosts with no team.", () => {
+    const activity = createMockActivity({
+      type: ActivityType.AddedSoftware,
+      details: { software_title: "Foo bar", software_package: "foobar.pkg" },
+    });
+    render(<ActivityItem activity={activity} isPremiumTier />);
+
+    expect(
+      screen.getByText("added software ", { exact: false })
+    ).toBeInTheDocument();
+    expect(
+      screen.getByText("foobar.pkg", { exact: false })
+    ).toBeInTheDocument();
+    expect(
+      screen.getByText("to no team.", { exact: false })
     ).toBeInTheDocument();
   });
+
+  it("renders an 'edited_software' type activity for hosts with no team.", () => {
+    const activity = createMockActivity({
+      type: ActivityType.EditedSoftware,
+      details: {
+        software_title: "Foo bar",
+        software_package: "foobar.pkg",
+      },
+    });
+    render(<ActivityItem activity={activity} isPremiumTier />);
+
+    expect(
+      screen.getByText("edited software", { exact: false })
+    ).toBeInTheDocument();
+    expect(
+      screen.getByText("on no team", { exact: false })
+    ).toBeInTheDocument();
+  });
+
+  it("renders a 'deleted_software' type activity for hosts with no team.", () => {
+    const activity = createMockActivity({
+      type: ActivityType.DeletedSoftware,
+      details: { software_title: "Foo bar", software_package: "foobar.pkg" },
+    });
+    render(<ActivityItem activity={activity} isPremiumTier />);
+
+    expect(
+      screen.getByText("deleted software ", { exact: false })
+    ).toBeInTheDocument();
+    expect(
+      screen.getByText("foobar.pkg", { exact: false })
+    ).toBeInTheDocument();
+    expect(
+      screen.getByText("from no team.", { exact: false })
+    ).toBeInTheDocument();
+  });
+
   it("renders a pluralized 'deleted_multiple_saved_query' type activity when deleting multiple queries.", () => {
     const activity = createMockActivity({
       type: ActivityType.DeletedMultipleSavedQuery,
@@ -1203,4 +1340,34 @@ describe("Activity Feed", () => {
     render(<ActivityItem activity={activity} isPremiumTier />);
     expect(screen.getByText("An end user")).toBeInTheDocument();
   });
+
+  it("renders the correct actor for a installed_app_store_app activity without self_service", () => {
+    const activity = createMockActivity({
+      type: ActivityType.InstalledAppStoreApp,
+      actor_id: 1,
+      actor_full_name: "Test Admin",
+      details: {
+        software_title: "Foo Software",
+        host_display_name: "Foo Host",
+      },
+    });
+
+    render(<ActivityItem activity={activity} isPremiumTier />);
+    expect(screen.getByText("Test Admin")).toBeInTheDocument();
+  });
+
+  it("renders the correct actor for a installed_app_store_app activity that was self_service", () => {
+    const activity = createMockActivity({
+      type: ActivityType.InstalledAppStoreApp,
+      actor_id: 1,
+      details: {
+        software_title: "Foo Software",
+        self_service: true,
+        host_display_name: "Foo Host",
+      },
+    });
+
+    render(<ActivityItem activity={activity} isPremiumTier />);
+    expect(screen.getByText("An end user")).toBeInTheDocument();
+  });
 });
diff --git a/frontend/pages/DashboardPage/cards/ActivityFeed/ActivityItem/ActivityItem.tsx b/frontend/pages/DashboardPage/cards/ActivityFeed/ActivityItem/ActivityItem.tsx
index c0f81ef72d..b6a59a4172 100644
--- a/frontend/pages/DashboardPage/cards/ActivityFeed/ActivityItem/ActivityItem.tsx
+++ b/frontend/pages/DashboardPage/cards/ActivityFeed/ActivityItem/ActivityItem.tsx
@@ -1,5 +1,5 @@
 import React from "react";
-import { find, lowerCase, noop } from "lodash";
+import { find, lowerCase, noop, trimEnd } from "lodash";
 import { formatDistanceToNowStrict } from "date-fns";
 
 import { ActivityType, IActivity, IActivityDetails } from "interfaces/activity";
@@ -41,16 +41,19 @@ const PREMIUM_ACTIVITIES = new Set([
 
 const getProfileMessageSuffix = (
   isPremiumTier: boolean,
+  platform: "apple" | "windows",
   teamName?: string | null
 ) => {
-  let messageSuffix = <>hosts</>;
+  const platformDisplayName =
+    platform === "apple" ? "macOS, iOS, and iPadOS" : "Windows";
+  let messageSuffix = <>all {platformDisplayName} hosts</>;
   if (isPremiumTier) {
     messageSuffix = teamName ? (
       <>
-        the <b>{teamName}</b> team
+        {platformDisplayName} hosts assigned to the <b>{teamName}</b> team
       </>
     ) : (
-      <>hosts with no team</>
+      <>{platformDisplayName} hosts with no team</>
     );
   }
   return messageSuffix;
@@ -364,7 +367,12 @@ const TAGGED_TEMPLATES = {
         ) : (
           <>a configuration profile</>
         )}{" "}
-        to {getProfileMessageSuffix(isPremiumTier, activity.details?.team_name)}
+        to{" "}
+        {getProfileMessageSuffix(
+          isPremiumTier,
+          "apple",
+          activity.details?.team_name
+        )}
         .
       </>
     );
@@ -383,7 +391,12 @@ const TAGGED_TEMPLATES = {
           <>a configuration profile</>
         )}{" "}
         from{" "}
-        {getProfileMessageSuffix(isPremiumTier, activity.details?.team_name)}.
+        {getProfileMessageSuffix(
+          isPremiumTier,
+          "apple",
+          activity.details?.team_name
+        )}
+        .
       </>
     );
   },
@@ -394,6 +407,7 @@ const TAGGED_TEMPLATES = {
         edited configuration profiles for{" "}
         {getProfileMessageSuffix(
           isPremiumTier,
+          "apple",
           activity.details?.team_name
         )}{" "}
         via fleetctl.
@@ -413,7 +427,12 @@ const TAGGED_TEMPLATES = {
         ) : (
           <>a configuration profile</>
         )}{" "}
-        to {getProfileMessageSuffix(isPremiumTier, activity.details?.team_name)}
+        to{" "}
+        {getProfileMessageSuffix(
+          isPremiumTier,
+          "windows",
+          activity.details?.team_name
+        )}
         .
       </>
     );
@@ -432,7 +451,12 @@ const TAGGED_TEMPLATES = {
           <>a configuration profile</>
         )}{" "}
         from{" "}
-        {getProfileMessageSuffix(isPremiumTier, activity.details?.team_name)}.
+        {getProfileMessageSuffix(
+          isPremiumTier,
+          "windows",
+          activity.details?.team_name
+        )}
+        .
       </>
     );
   },
@@ -443,6 +467,7 @@ const TAGGED_TEMPLATES = {
         edited configuration profiles for{" "}
         {getProfileMessageSuffix(
           isPremiumTier,
+          "windows",
           activity.details?.team_name
         )}{" "}
         via fleetctl.
@@ -762,7 +787,12 @@ const TAGGED_TEMPLATES = {
         added declaration (DDM) profile <b>
           {activity.details?.profile_name}
         </b>{" "}
-        to {getProfileMessageSuffix(isPremiumTier, activity.details?.team_name)}
+        to{" "}
+        {getProfileMessageSuffix(
+          isPremiumTier,
+          "apple",
+          activity.details?.team_name
+        )}
         .
       </>
     );
@@ -773,7 +803,12 @@ const TAGGED_TEMPLATES = {
         {" "}
         removed declaration (DDM) profile{" "}
         <b>{activity.details?.profile_name}</b> from{" "}
-        {getProfileMessageSuffix(isPremiumTier, activity.details?.team_name)}.
+        {getProfileMessageSuffix(
+          isPremiumTier,
+          "apple",
+          activity.details?.team_name
+        )}
+        .
       </>
     );
   },
@@ -783,7 +818,11 @@ const TAGGED_TEMPLATES = {
         {" "}
         edited declaration (DDM) profiles{" "}
         <b>{activity.details?.profile_name}</b> for{" "}
-        {getProfileMessageSuffix(isPremiumTier, activity.details?.team_name)}{" "}
+        {getProfileMessageSuffix(
+          isPremiumTier,
+          "apple",
+          activity.details?.team_name
+        )}{" "}
         via fleetctl.
       </>
     );
@@ -802,7 +841,7 @@ const TAGGED_TEMPLATES = {
     return (
       <>
         {" "}
-        added <b>{activity.details?.software_title}</b> (
+        added software <b>{activity.details?.software_title}</b> (
         {activity.details?.software_package}) to{" "}
         {activity.details?.team_name ? (
           <>
@@ -815,11 +854,28 @@ const TAGGED_TEMPLATES = {
       </>
     );
   },
+  editedSoftware: (activity: IActivity) => {
+    return (
+      <>
+        {" "}
+        edited software <b>{activity.details?.software_title}</b> (
+        {activity.details?.software_package}) on{" "}
+        {activity.details?.team_name ? (
+          <>
+            {" "}
+            the <b>{activity.details?.team_name}</b> team.
+          </>
+        ) : (
+          "no team."
+        )}
+      </>
+    );
+  },
   deletedSoftware: (activity: IActivity) => {
     return (
       <>
         {" "}
-        deleted <b>{activity.details?.software_title}</b> (
+        deleted software <b>{activity.details?.software_title}</b> (
         {activity.details?.software_package}) from{" "}
         {activity.details?.team_name ? (
           <>
@@ -868,19 +924,71 @@ const TAGGED_TEMPLATES = {
       </>
     );
   },
-  enabledVpp: () => {
+  uninstalledSoftware: (
+    activity: IActivity,
+    onDetailsClick?: (type: ActivityType, details: IActivityDetails) => void
+  ) => {
+    const { details } = activity;
+    if (!details) {
+      return TAGGED_TEMPLATES.defaultActivityTemplate(activity);
+    }
+
+    const { host_display_name: hostName, software_title: title } = details;
+    const status =
+      details.status === "failed" ? "failed_uninstall" : details.status;
+
+    const showSoftwarePackage =
+      !!details.software_package &&
+      activity.type === ActivityType.InstalledSoftware;
+
     return (
       <>
         {" "}
-        enabled <b>Volume Purchasing Program (VPP)</b>.
+        {getInstallStatusPredicate(status)} software <b>{title}</b>
+        {showSoftwarePackage && ` (${details.software_package})`} from{" "}
+        <b>{hostName}</b>.{" "}
+        <Button
+          className={`${baseClass}__show-query-link`}
+          variant="text-link"
+          onClick={() => onDetailsClick?.(activity.type, details)}
+        >
+          Show details{" "}
+          <Icon className={`${baseClass}__show-query-icon`} name="eye" />
+        </Button>
       </>
     );
   },
-  disabledVpp: () => {
+  enabledVpp: (activity: IActivity) => {
     return (
       <>
         {" "}
-        disabled <b>Volume Purchasing Program (VPP)</b>.
+        enabled <b>Volume Purchasing Program (VPP)</b>
+        {activity.details?.location ? (
+          <>
+            {" "}
+            for <b>{trimEnd(activity.details?.location, ".")}</b>
+          </>
+        ) : (
+          ""
+        )}
+        .
+      </>
+    );
+  },
+  disabledVpp: (activity: IActivity) => {
+    return (
+      <>
+        {" "}
+        disabled <b>Volume Purchasing Program (VPP)</b>
+        {activity.details?.location ? (
+          <>
+            {" "}
+            for <b>{trimEnd(activity.details?.location, ".")}</b>
+          </>
+        ) : (
+          ""
+        )}
+        .
       </>
     );
   },
@@ -1105,12 +1213,18 @@ const getDetail = (
     case ActivityType.AddedSoftware: {
       return TAGGED_TEMPLATES.addedSoftware(activity);
     }
+    case ActivityType.EditedSoftware: {
+      return TAGGED_TEMPLATES.editedSoftware(activity);
+    }
     case ActivityType.DeletedSoftware: {
       return TAGGED_TEMPLATES.deletedSoftware(activity);
     }
     case ActivityType.InstalledSoftware: {
       return TAGGED_TEMPLATES.installedSoftware(activity, onDetailsClick);
     }
+    case ActivityType.UninstalledSoftware: {
+      return TAGGED_TEMPLATES.uninstalledSoftware(activity, onDetailsClick);
+    }
     case ActivityType.AddedAppStoreApp: {
       return TAGGED_TEMPLATES.addedAppStoreApp(activity);
     }
@@ -1121,10 +1235,10 @@ const getDetail = (
       return TAGGED_TEMPLATES.installedSoftware(activity, onDetailsClick);
     }
     case ActivityType.EnabledVpp: {
-      return TAGGED_TEMPLATES.enabledVpp();
+      return TAGGED_TEMPLATES.enabledVpp(activity);
     }
     case ActivityType.DisabledVpp: {
-      return TAGGED_TEMPLATES.disabledVpp();
+      return TAGGED_TEMPLATES.disabledVpp(activity);
     }
 
     default: {
@@ -1177,6 +1291,8 @@ const ActivityItem = ({
           DEFAULT_ACTOR_DISPLAY
         );
       case ActivityType.InstalledSoftware:
+      case ActivityType.UninstalledSoftware:
+      case ActivityType.InstalledAppStoreApp:
         return activity.details?.self_service ? (
           <span>An end user</span>
         ) : (
diff --git a/frontend/pages/DashboardPage/cards/Munki/Munki.tests.tsx b/frontend/pages/DashboardPage/cards/Munki/Munki.tests.tsx
new file mode 100644
index 0000000000..b533c26956
--- /dev/null
+++ b/frontend/pages/DashboardPage/cards/Munki/Munki.tests.tsx
@@ -0,0 +1,89 @@
+import React from "react";
+import { screen } from "@testing-library/react";
+import { createCustomRenderer } from "test/test-utils";
+import createMockUser from "__mocks__/userMock";
+
+import {
+  IMunkiIssuesAggregate,
+  IMunkiVersionsAggregate,
+} from "interfaces/macadmins";
+import Munki from "./Munki";
+
+describe("Munki card", () => {
+  it("renders data normally when present", async () => {
+    const [name1, name2] = ["Munki issue 1", "Munki issue 2"];
+    const [
+      errorMacAdmins,
+      isMacAdminsFetching,
+      munkiIssuesData,
+      munkiVersionsData,
+      selectedTeamId,
+    ] = [
+      null,
+      false,
+      [
+        {
+          id: 476,
+          name: name1,
+          type: "warning",
+          hosts_count: 2345,
+        },
+        {
+          id: 555,
+          name: name2,
+          type: "error",
+          hosts_count: 5432,
+        },
+      ] as IMunkiIssuesAggregate[],
+      [
+        {
+          version: "1.2.3",
+          hosts_count: 37,
+        },
+      ] as IMunkiVersionsAggregate[],
+      undefined,
+    ];
+
+    const render = createCustomRenderer({
+      context: {
+        app: {
+          isPremiumTier: true,
+          isGlobalAdmin: true,
+          currentUser: createMockUser(),
+        },
+      },
+    });
+
+    const { user } = render(
+      <Munki
+        errorMacAdmins={errorMacAdmins}
+        isMacAdminsFetching={isMacAdminsFetching}
+        munkiIssuesData={munkiIssuesData}
+        munkiVersionsData={munkiVersionsData}
+        selectedTeamId={selectedTeamId}
+      />
+    );
+
+    // Issues tab
+    expect(screen.getByText("Issue")).toBeInTheDocument();
+    expect(screen.getByText("Type")).toBeInTheDocument();
+    expect(screen.getByText("Hosts")).toBeInTheDocument();
+
+    expect(screen.getAllByText(name1)).toHaveLength(2);
+    expect(screen.getByText("Warning")).toBeInTheDocument();
+    expect(screen.getByText("2345")).toBeInTheDocument();
+
+    expect(screen.getAllByText(name2)).toHaveLength(2);
+    expect(screen.getByText("Error")).toBeInTheDocument();
+    expect(screen.getByText("5432")).toBeInTheDocument();
+
+    // Versions tab
+
+    await user.click(screen.getByText("Versions"));
+
+    expect(screen.getByText("Version")).toBeInTheDocument();
+    expect(screen.getByText("Hosts")).toBeInTheDocument();
+    expect(screen.getByText("1.2.3")).toBeInTheDocument();
+    expect(screen.getByText("37")).toBeInTheDocument();
+  });
+});
diff --git a/frontend/pages/DashboardPage/cards/OperatingSystems/OSTable.tests.tsx b/frontend/pages/DashboardPage/cards/OperatingSystems/OSTable.tests.tsx
new file mode 100644
index 0000000000..934bd5db44
--- /dev/null
+++ b/frontend/pages/DashboardPage/cards/OperatingSystems/OSTable.tests.tsx
@@ -0,0 +1,55 @@
+import React from "react";
+import { render, screen } from "@testing-library/react";
+
+import OSTable from "./OSTable";
+
+describe("Dashboard OS table", () => {
+  it("renders data normally when present", () => {
+    render(
+      <OSTable
+        currentTeamId={undefined}
+        osVersions={[
+          {
+            os_version_id: 1,
+            hosts_count: 234,
+            name: "Microsoft Windows 11 Enterprise 22H2 10.0.22621",
+            name_only: "Microsoft Windows 11 Enterprise 22H2",
+            version: "1.2.3",
+            platform: "windows",
+            vulnerabilities: [],
+          },
+          {
+            os_version_id: 2,
+            hosts_count: 567,
+            name: "Microsoft Windows 11 Pro 22H2 10.0.22621.3880",
+            name_only: "Microsoft Windows 11 Pro 22H2",
+            version: "4.5.6",
+            platform: "windows",
+            vulnerabilities: [
+              {
+                cve: "CVE-2022-2601",
+                details_link: "https://nvd.nist.gov/vuln/detail/CVE-2022-2601",
+                created_at: "2024-08-14T01:01:19Z",
+                cvss_score: 8.6,
+                epss_probability: 0.00075,
+                cisa_known_exploit: false,
+                cve_published: "2022-12-14T21:15:00Z",
+                cve_description: "Very bad",
+                resolved_in_version: "10.0.22621.4037",
+              },
+            ],
+          },
+        ]}
+        selectedPlatform="windows"
+        isLoading={false}
+      />
+    );
+
+    expect(screen.getByText("Version")).toBeInTheDocument();
+    expect(screen.getByText("Hosts")).toBeInTheDocument();
+    expect(screen.getByText("1.2.3")).toBeInTheDocument();
+    expect(screen.getByText("234")).toBeInTheDocument();
+    expect(screen.getByText("4.5.6")).toBeInTheDocument();
+    expect(screen.getByText("567")).toBeInTheDocument();
+  });
+});
diff --git a/frontend/pages/DashboardPage/cards/OperatingSystems/OSTable.tsx b/frontend/pages/DashboardPage/cards/OperatingSystems/OSTable.tsx
new file mode 100644
index 0000000000..ad2a985124
--- /dev/null
+++ b/frontend/pages/DashboardPage/cards/OperatingSystems/OSTable.tsx
@@ -0,0 +1,68 @@
+import EmptyTable from "components/EmptyTable";
+import TableContainer from "components/TableContainer";
+import { IOperatingSystemVersion } from "interfaces/operating_system";
+import React, { useMemo } from "react";
+import {
+  PlatformValueOptions,
+  PLATFORM_DISPLAY_NAMES,
+} from "utilities/constants";
+
+import generateTableHeaders from "./OSTableConfig";
+
+const DEFAULT_SORT_DIRECTION = "desc";
+const DEFAULT_SORT_HEADER = "hosts_count";
+const PAGE_SIZE = 8;
+
+const baseClass = "operating-systems";
+
+const EmptyOS = (platform: PlatformValueOptions): JSX.Element => (
+  <EmptyTable
+    className={`${baseClass}__os-empty-table`}
+    header={`No${
+      ` ${PLATFORM_DISPLAY_NAMES[platform]}` || ""
+    } operating systems detected`}
+    info="This report is updated every hour to protect the performance of your
+  devices."
+  />
+);
+
+interface IOSTableProps {
+  currentTeamId?: number;
+  osVersions: IOperatingSystemVersion[];
+  selectedPlatform: PlatformValueOptions;
+  isLoading: boolean;
+}
+
+const OSTable = ({
+  currentTeamId,
+  osVersions,
+  selectedPlatform,
+  isLoading,
+}: IOSTableProps) => {
+  const columnConfigs = useMemo(
+    () => generateTableHeaders(currentTeamId, undefined),
+    [currentTeamId]
+  );
+
+  const showPaginationControls = osVersions.length > PAGE_SIZE;
+
+  return (
+    <TableContainer
+      columnConfigs={columnConfigs}
+      data={osVersions}
+      isLoading={isLoading}
+      defaultSortHeader={DEFAULT_SORT_HEADER}
+      defaultSortDirection={DEFAULT_SORT_DIRECTION}
+      resultsTitle="Operating systems"
+      emptyComponent={() => EmptyOS(selectedPlatform)}
+      showMarkAllPages={false}
+      isAllPagesSelected={false}
+      disableCount
+      isClientSidePagination={showPaginationControls}
+      disablePagination={!showPaginationControls}
+      pageSize={PAGE_SIZE}
+    />
+  );
+};
+
+export default OSTable;
diff --git a/frontend/pages/DashboardPage/cards/OperatingSystems/OperatingSystemsTableConfig.tsx b/frontend/pages/DashboardPage/cards/OperatingSystems/OSTableConfig.tsx
similarity index 98%
rename from frontend/pages/DashboardPage/cards/OperatingSystems/OperatingSystemsTableConfig.tsx
rename to frontend/pages/DashboardPage/cards/OperatingSystems/OSTableConfig.tsx
index 80df2741ac..1ddc7c0e70 100644
--- a/frontend/pages/DashboardPage/cards/OperatingSystems/OperatingSystemsTableConfig.tsx
+++ b/frontend/pages/DashboardPage/cards/OperatingSystems/OSTableConfig.tsx
@@ -146,6 +146,7 @@ const generateDefaultTableHeaders = (
   },
 ];
 
+// this is also used by frontend/pages/SoftwarePage/SoftwareOS/SoftwareOSTable/SoftwareOSTable.tsx
 const generateTableHeaders = (
   teamId?: number,
   router?: InjectedRouter,
diff --git a/frontend/pages/DashboardPage/cards/OperatingSystems/OperatingSystems.tsx b/frontend/pages/DashboardPage/cards/OperatingSystems/OperatingSystems.tsx
index 5d2ef7f5da..343f74fe70 100644
--- a/frontend/pages/DashboardPage/cards/OperatingSystems/OperatingSystems.tsx
+++ b/frontend/pages/DashboardPage/cards/OperatingSystems/OperatingSystems.tsx
@@ -1,4 +1,4 @@
-import React, { useEffect, useMemo } from "react";
+import React, { useEffect } from "react";
 import { useQuery } from "react-query";
 
 import {
@@ -11,20 +11,15 @@ import {
   IOSVersionsResponse,
   OS_VERSIONS_API_SUPPORTED_PLATFORMS,
 } from "services/entities/operating_systems";
-import {
-  PLATFORM_DISPLAY_NAMES,
-  PlatformValueOptions,
-} from "utilities/constants";
+import { PlatformValueOptions } from "utilities/constants";
 
-import TableContainer from "components/TableContainer";
 import Spinner from "components/Spinner";
 import TableDataError from "components/DataError";
 import LastUpdatedText from "components/LastUpdatedText";
 import CustomLink from "components/CustomLink";
-import EmptyTable from "components/EmptyTable";
 import { AxiosError } from "axios";
 
-import generateTableHeaders from "./OperatingSystemsTableConfig";
+import OSTable from "./OSTable";
 
 interface IOperatingSystemsCardProps {
   currentTeamId: number | undefined;
@@ -32,40 +27,23 @@ interface IOperatingSystemsCardProps {
   showTitle: boolean;
   /** controls the displaying of description text under the title. Defaults to `true` */
   showDescription?: boolean;
-  /** controls the displaying of the **Name** column in the table. Defaults to `true` */
-  includeNameColumn?: boolean;
   setShowTitle: (showTitle: boolean) => void;
   setTitleDetail?: (content: JSX.Element | string | null) => void;
   setTitleDescription?: (content: JSX.Element | string | null) => void;
 }
 
-const DEFAULT_SORT_DIRECTION = "desc";
-const DEFAULT_SORT_HEADER = "hosts_count";
-const PAGE_SIZE = 8;
 const baseClass = "operating-systems";
 
-const EmptyOperatingSystems = (platform: PlatformValueOptions): JSX.Element => (
-  <EmptyTable
-    className={`${baseClass}__os-empty-table`}
-    header={`No${
-      ` ${PLATFORM_DISPLAY_NAMES[platform]}` || ""
-    } operating systems detected`}
-    info="This report is updated every hour to protect the performance of your
-      devices."
-  />
-);
-
 const OperatingSystems = ({
   currentTeamId,
   selectedPlatform,
   showTitle,
   showDescription = true,
-  includeNameColumn = true,
   setShowTitle,
   setTitleDetail,
   setTitleDescription,
 }: IOperatingSystemsCardProps): JSX.Element => {
-  const { data: osInfo, error, isFetching } = useQuery<
+  const { data: osInfo, error, isLoading } = useQuery<
     IOSVersionsResponse,
     AxiosError,
     IOSVersionsResponse,
@@ -133,36 +111,31 @@ const OperatingSystems = ({
     />
   ) : null;
 
+  const osVersions = osInfo?.os_versions || [];
+
   useEffect(() => {
-    if (isFetching) {
+    if (isLoading) {
       setShowTitle(false);
       setTitleDescription?.(null);
       setTitleDetail?.(null);
       return;
     }
     setShowTitle(true);
-    if (osInfo?.os_versions?.length) {
+    if (osVersions.length) {
       setTitleDescription?.(renderDescription());
       setTitleDetail?.(titleDetail);
       return;
     }
     setTitleDescription?.(null);
     setTitleDetail?.(null);
-  }, [isFetching, osInfo, setTitleDescription, setTitleDetail]);
-
-  const tableHeaders = useMemo(
-    () => generateTableHeaders(currentTeamId, undefined, { includeName: true }),
-    [includeNameColumn, currentTeamId]
-  );
-
-  const showPaginationControls = (osInfo?.os_versions?.length || 0) > 8;
+  }, [isLoading, osInfo, setTitleDescription, setTitleDetail]);
 
   // Renders opaque information as host information is loading
-  const opacity = isFetching || !showTitle ? { opacity: 0 } : { opacity: 1 };
+  const opacity = isLoading || !showTitle ? { opacity: 0 } : { opacity: 1 };
 
   return (
     <div className={baseClass}>
-      {isFetching && (
+      {isLoading && (
         <div className="spinner">
           <Spinner />
         </div>
@@ -171,20 +144,11 @@ const OperatingSystems = ({
         {error?.status && error?.status >= 500 ? (
           <TableDataError card />
         ) : (
-          <TableContainer
-            columnConfigs={tableHeaders}
-            data={osInfo?.os_versions || []}
-            isLoading={isFetching}
-            defaultSortHeader={DEFAULT_SORT_HEADER}
-            defaultSortDirection={DEFAULT_SORT_DIRECTION}
-            resultsTitle="Operating systems"
-            emptyComponent={() => EmptyOperatingSystems(selectedPlatform)}
-            showMarkAllPages={false}
-            isAllPagesSelected={false}
-            disableCount
-            isClientSidePagination={showPaginationControls}
-            disablePagination={!showPaginationControls}
-            pageSize={PAGE_SIZE}
+          <OSTable
+            currentTeamId={currentTeamId}
+            osVersions={osVersions}
+            selectedPlatform={selectedPlatform}
+            isLoading={isLoading}
           />
         )}
       </div>
diff --git a/frontend/pages/DashboardPage/cards/Software/DashboardSoftware.tests.tsx b/frontend/pages/DashboardPage/cards/Software/DashboardSoftware.tests.tsx
new file mode 100644
index 0000000000..c6ddbdaa10
--- /dev/null
+++ b/frontend/pages/DashboardPage/cards/Software/DashboardSoftware.tests.tsx
@@ -0,0 +1,141 @@
+import React from "react";
+import { render, screen } from "@testing-library/react";
+import { createMockRouter } from "test/test-utils";
+
+import { ISoftwareResponse } from "interfaces/software";
+
+import Software from "./Software";
+
+describe("Dashboard software card", () => {
+  const vulnSwInfo = {
+    name: "ms-toolsai.jupyter",
+    version: "2.3.4",
+    hostsCount: 432,
+  };
+  const noVulnSwInfo = {
+    name: "common.extension_2",
+    version: "5.6.7",
+    hostsCount: 543,
+  };
+
+  it("renders all software normally when present", () => {
+    const allSwResponse: ISoftwareResponse = {
+      counts_updated_at: "2024-08-21T21:01:31Z",
+      software: [
+        {
+          id: 784,
+          name: vulnSwInfo.name,
+          version: vulnSwInfo.version,
+          source: "vscode_extensions",
+          browser: "",
+          vendor: "Microsoft",
+          generated_cpe:
+            "cpe:2.3:a:microsoft:jupyter:2023.10.10:*:*:*:*:visual_studio_code:*:*",
+          vulnerabilities: [
+            {
+              cve: "CVE-2023-36018",
+              details_link: "https://nvd.nist.gov/vuln/detail/CVE-2023-36018",
+              created_at: "2024-07-12T04:00:56Z",
+              cvss_score: 9.8,
+              epss_probability: 0.00162,
+              cisa_known_exploit: false,
+              cve_published: "2023-11-14T18:15:00Z",
+              cve_description:
+                "Visual Studio Code Jupyter Extension Spoofing Vulnerability",
+              resolved_in_version: "2023.10.1100000000",
+            },
+          ],
+          hosts_count: vulnSwInfo.hostsCount,
+        },
+        {
+          id: 758,
+          name: noVulnSwInfo.name,
+          version: noVulnSwInfo.version,
+          source: "vscode_extensions",
+          browser: "",
+          generated_cpe: "",
+          vulnerabilities: null,
+          hosts_count: noVulnSwInfo.hostsCount,
+        },
+      ],
+    };
+    render(
+      <Software
+        errorSoftware={null}
+        isSoftwareFetching={false}
+        isSoftwareEnabled
+        navTabIndex={0}
+        onTabChange={jest.fn()}
+        onQueryChange={jest.fn()}
+        software={allSwResponse}
+        teamId={-1}
+        router={createMockRouter()}
+      />
+    );
+
+    expect(screen.getByText("Name")).toBeInTheDocument();
+    expect(screen.getByText("Version")).toBeInTheDocument();
+    expect(screen.getByText("Hosts")).toBeInTheDocument();
+
+    Object.keys(noVulnSwInfo).forEach((key) => {
+      expect(
+        screen.getByText(noVulnSwInfo[key as keyof typeof noVulnSwInfo])
+      ).toBeInTheDocument();
+    });
+  });
+  it("renders vulnerable software normally when present", () => {
+    const vulnSwResponse: ISoftwareResponse = {
+      counts_updated_at: "2024-08-21T21:01:31Z",
+      software: [
+        {
+          id: 784,
+          name: vulnSwInfo.name,
+          version: vulnSwInfo.version,
+          source: "vscode_extensions",
+          browser: "",
+          vendor: "Microsoft",
+          generated_cpe:
+            "cpe:2.3:a:microsoft:jupyter:2023.10.10:*:*:*:*:visual_studio_code:*:*",
+          vulnerabilities: [
+            {
+              cve: "CVE-2023-36018",
+              details_link: "https://nvd.nist.gov/vuln/detail/CVE-2023-36018",
+              created_at: "2024-07-12T04:00:56Z",
+              cvss_score: 9.8,
+              epss_probability: 0.00162,
+              cisa_known_exploit: false,
+              cve_published: "2023-11-14T18:15:00Z",
+              cve_description:
+                "Visual Studio Code Jupyter Extension Spoofing Vulnerability",
+              resolved_in_version: "2023.10.1100000000",
+            },
+          ],
+          hosts_count: vulnSwInfo.hostsCount,
+        },
+      ],
+    };
+    render(
+      <Software
+        errorSoftware={null}
+        isSoftwareFetching={false}
+        isSoftwareEnabled
+        navTabIndex={1}
+        onTabChange={jest.fn()}
+        onQueryChange={jest.fn()}
+        software={vulnSwResponse}
+        teamId={-1}
+        router={createMockRouter()}
+      />
+    );
+
+    expect(screen.getByText("Name")).toBeInTheDocument();
+    expect(screen.getByText("Version")).toBeInTheDocument();
+    expect(screen.getByText("Hosts")).toBeInTheDocument();
+
+    Object.keys(vulnSwInfo).forEach((key) => {
+      expect(
+        screen.getByText(vulnSwInfo[key as keyof typeof vulnSwInfo])
+      ).toBeInTheDocument();
+    });
+  });
+});
diff --git a/frontend/pages/DashboardPage/cards/Software/Software.tsx b/frontend/pages/DashboardPage/cards/Software/Software.tsx
index 0b2af37375..a8b8d98741 100644
--- a/frontend/pages/DashboardPage/cards/Software/Software.tsx
+++ b/frontend/pages/DashboardPage/cards/Software/Software.tsx
@@ -18,7 +18,6 @@ import generateTableHeaders from "./SoftwareTableConfig";
 
 interface ISoftwareCardProps {
   errorSoftware: Error | null;
-  isCollectingInventory: boolean;
   isSoftwareFetching: boolean;
   isSoftwareEnabled?: boolean;
   software?: ISoftwareResponse;
@@ -45,7 +44,6 @@ const baseClass = "home-software";
 
 const Software = ({
   errorSoftware,
-  isCollectingInventory,
   isSoftwareFetching,
   isSoftwareEnabled,
   navTabIndex,
@@ -95,11 +93,7 @@ const Software = ({
                   defaultSortHeader={SOFTWARE_DEFAULT_SORT_DIRECTION}
                   defaultSortDirection={SOFTWARE_DEFAULT_SORT_DIRECTION}
                   resultsTitle="software"
-                  emptyComponent={() => (
-                    <EmptySoftwareTable
-                      isCollectingSoftware={isCollectingInventory}
-                    />
-                  )}
+                  emptyComponent={() => <EmptySoftwareTable />}
                   showMarkAllPages={false}
                   isAllPagesSelected={false}
                   disableCount
@@ -122,10 +116,7 @@ const Software = ({
                   defaultSortDirection={SOFTWARE_DEFAULT_SORT_DIRECTION}
                   resultsTitle="software"
                   emptyComponent={() => (
-                    <EmptySoftwareTable
-                      isCollectingSoftware={isCollectingInventory}
-                      softwareFilter="vulnerableSoftware"
-                    />
+                    <EmptySoftwareTable vulnFilters={{ vulnerable: true }} />
                   )}
                   showMarkAllPages={false}
                   isAllPagesSelected={false}
diff --git a/frontend/pages/DashboardPage/components/MdmSolutionModal/MdmSolutionModal.tests.tsx b/frontend/pages/DashboardPage/components/MdmSolutionModal/MdmSolutionModal.tests.tsx
new file mode 100644
index 0000000000..7e0d5e2bdc
--- /dev/null
+++ b/frontend/pages/DashboardPage/components/MdmSolutionModal/MdmSolutionModal.tests.tsx
@@ -0,0 +1,27 @@
+import React from "react";
+
+import { render, screen } from "@testing-library/react";
+
+import { IMdmSolution } from "interfaces/mdm";
+
+import MdmSolutionModal from "./MdmSolutionModal";
+
+describe("MdmSolutionModal table", () => {
+  it("Renders table data normally", () => {
+    const [server_url, hosts_count] = ["a.b.c", 123];
+    const mdmSolutions: IMdmSolution[] = [
+      {
+        id: 1,
+        name: "test solution",
+        server_url,
+        hosts_count,
+      },
+    ];
+    render(
+      <MdmSolutionModal mdmSolutions={mdmSolutions} onCancel={() => null} />
+    );
+
+    expect(screen.getByText(server_url)).toBeInTheDocument();
+    expect(screen.getByText(hosts_count)).toBeInTheDocument();
+  });
+});
diff --git a/frontend/pages/DashboardPage/components/MdmSolutionModal/MdmSolutionModal.tsx b/frontend/pages/DashboardPage/components/MdmSolutionModal/MdmSolutionModal.tsx
index aeae56538e..bc2ce8196b 100644
--- a/frontend/pages/DashboardPage/components/MdmSolutionModal/MdmSolutionModal.tsx
+++ b/frontend/pages/DashboardPage/components/MdmSolutionModal/MdmSolutionModal.tsx
@@ -24,7 +24,7 @@ interface IMdmSolutionModalProps {
   onCancel: () => void;
 }
 
-const MdmSolutionsModal = ({
+const MdmSolutionModal = ({
   mdmSolutions,
   selectedPlatformLabelId,
   selectedTeamId,
@@ -73,4 +73,4 @@ const MdmSolutionsModal = ({
   );
 };
 
-export default MdmSolutionsModal;
+export default MdmSolutionModal;
diff --git a/frontend/pages/ManageControlsPage/OSSettings/_styles.scss b/frontend/pages/ManageControlsPage/OSSettings/_styles.scss
index 986234a842..37228609c6 100644
--- a/frontend/pages/ManageControlsPage/OSSettings/_styles.scss
+++ b/frontend/pages/ManageControlsPage/OSSettings/_styles.scss
@@ -18,4 +18,9 @@
   .side-nav__card-container > .custom-settings {
     max-width: none;
   }
+  @media (max-width: 1120px) {
+    .side-nav__nav-list {
+      padding-right: 0;
+    }
+  }
 }
diff --git a/frontend/pages/ManageControlsPage/OSSettings/cards/CustomSettings/components/ProfileUploader/components/AddProfileModal/AddProfileModal.tsx b/frontend/pages/ManageControlsPage/OSSettings/cards/CustomSettings/components/ProfileUploader/components/AddProfileModal/AddProfileModal.tsx
index 88b7e96ed9..694970c4ca 100644
--- a/frontend/pages/ManageControlsPage/OSSettings/cards/CustomSettings/components/ProfileUploader/components/AddProfileModal/AddProfileModal.tsx
+++ b/frontend/pages/ManageControlsPage/OSSettings/cards/CustomSettings/components/ProfileUploader/components/AddProfileModal/AddProfileModal.tsx
@@ -7,7 +7,7 @@ import { NotificationContext } from "context/notification";
 import { IApiError } from "interfaces/errors";
 import { ILabelSummary } from "interfaces/label";
 
-import labelsAPI from "services/entities/labels";
+import labelsAPI, { getCustomLabels } from "services/entities/labels";
 import mdmAPI from "services/entities/mdm";
 
 // @ts-ignore
@@ -77,7 +77,7 @@ interface IFileDetailsProps {
 
 // TODO: if we reuse this one more time, we should consider moving this
 // into FileUploader as a default preview. Currently we have this in
-// AddSoftwareForm.tsx and here.
+// AddPackageForm.tsx and here.
 const FileDetails = ({ details: { name, platform } }: IFileDetailsProps) => (
   <div className={`${baseClass}__selected-file`}>
     <ProfileGraphic baseClass={baseClass} />
@@ -250,10 +250,7 @@ const AddProfileModal = ({
     isError: isErrorLabels,
   } = useQuery<ILabelSummary[], Error>(
     ["custom_labels"],
-    () =>
-      labelsAPI
-        .summary()
-        .then((res) => res.labels.filter((l) => l.label_type !== "builtin")),
+    () => labelsAPI.summary().then((res) => getCustomLabels(res.labels)),
 
     {
       enabled: isPremiumTier,
diff --git a/frontend/pages/ManageControlsPage/OSSettings/cards/DiskEncryption/components/DiskEncryptionTable/_styles.scss b/frontend/pages/ManageControlsPage/OSSettings/cards/DiskEncryption/components/DiskEncryptionTable/_styles.scss
index 74a24f3ac2..45790a5389 100644
--- a/frontend/pages/ManageControlsPage/OSSettings/cards/DiskEncryption/components/DiskEncryptionTable/_styles.scss
+++ b/frontend/pages/ManageControlsPage/OSSettings/cards/DiskEncryption/components/DiskEncryptionTable/_styles.scss
@@ -9,11 +9,29 @@
     border-right: none;
   }
 
-  @media (max-width: 1120px) {
-    .view-hosts-link {
-      span {
-        display: none;
-      }
+  .linkToFilteredHosts__header {
+    width: auto;
+    max-width: 120px;
+  }
+
+}
+
+@media (max-width: 1120px) {
+  .view-hosts-link {
+    span {
+      display: none;
     }
   }
-}
+  .linkToFilteredHosts {
+    &__header {
+      width: 0;
+      .column-header {
+        width: 0;
+      }
+    }
+    &__cell {
+      width: min-content;
+    }
+
+  }
+}
\ No newline at end of file
diff --git a/frontend/pages/ManageControlsPage/OSUpdates/components/AppleOSTargetForm/AppleOSTargetForm.tsx b/frontend/pages/ManageControlsPage/OSUpdates/components/AppleOSTargetForm/AppleOSTargetForm.tsx
index 8c12c49053..755b59d093 100644
--- a/frontend/pages/ManageControlsPage/OSUpdates/components/AppleOSTargetForm/AppleOSTargetForm.tsx
+++ b/frontend/pages/ManageControlsPage/OSUpdates/components/AppleOSTargetForm/AppleOSTargetForm.tsx
@@ -166,28 +166,18 @@ const AppleOSTargetForm = ({
     setDeadline(val);
   };
 
-  const getMinimumVersionPlaceholder = (platform: ApplePlatform) => {
-    switch (platform) {
-      case "darwin":
-        return "13.0.1";
-      case "ios":
-      case "ipados":
-        return "17.5.1";
-      default:
-        return "";
-    }
-  };
-
-  const getMinimumVersionTooltip = (platform: ApplePlatform) => {
-    switch (platform) {
-      case "darwin":
-        return "The end user sees the window until their macOS is at or above this version.";
-      case "ios":
-      case "ipados":
-        return "If the end user's host is below the minimum version, they see a notification in their Notification Center after the deadline. They can’t continue until the OS update is installed.";
-      default:
-        return "";
-    }
+  const getMinimumVersionTooltip = () => {
+    return (
+      <>
+        If an already enrolled host is below the minimum version,
+        <br /> the host is updated to exactly the minimum version if it&apos;s
+        <br /> available from Apple.
+        <br />
+        <br /> If a new or wiped host is below the minimum version and
+        <br /> automatically enrolls (ADE), the host is updated to Apple&apos;s
+        <br /> lastest version during Setup Assistant.
+      </>
+    );
   };
 
   const getDeadlineTooltip = (platform: ApplePlatform) => {
@@ -206,9 +196,8 @@ const AppleOSTargetForm = ({
     <form className={baseClass} onSubmit={handleSubmit}>
       <InputField
         label="Minimum version"
-        tooltip={getMinimumVersionTooltip(applePlatform)}
+        tooltip={getMinimumVersionTooltip()}
         helpText="Version number only (e.g., “13.0.1” not “Ventura 13” or “13.0.1 (22A400)”)"
-        placeholder={getMinimumVersionPlaceholder(applePlatform)}
         value={minOsVersion}
         error={minOsVersionError}
         onChange={handleMinVersionChange}
@@ -217,7 +206,6 @@ const AppleOSTargetForm = ({
         label="Deadline"
         tooltip={getDeadlineTooltip(applePlatform)}
         helpText="YYYY-MM-DD format only (e.g., “2024-07-01”)."
-        placeholder="2024-07-01"
         value={deadline}
         error={deadlineError}
         onChange={handleDeadlineChange}
diff --git a/frontend/pages/ManageControlsPage/OSUpdates/components/WindowsTargetForm/WindowsTargetForm.tsx b/frontend/pages/ManageControlsPage/OSUpdates/components/WindowsTargetForm/WindowsTargetForm.tsx
index ec7007a29e..7addf342e3 100644
--- a/frontend/pages/ManageControlsPage/OSUpdates/components/WindowsTargetForm/WindowsTargetForm.tsx
+++ b/frontend/pages/ManageControlsPage/OSUpdates/components/WindowsTargetForm/WindowsTargetForm.tsx
@@ -158,7 +158,6 @@ const WindowsTargetForm = ({
         label="Deadline"
         tooltip="Number of days the end user has before updates are installed and the host is forced to restart."
         helpText="Number of days from 0 to 30."
-        placeholder="5"
         value={deadlineDays}
         error={deadlineDaysError}
         onChange={handleDeadlineDaysChange}
@@ -167,7 +166,6 @@ const WindowsTargetForm = ({
         label="Grace period"
         tooltip="Number of days after the deadline the end user has before the host is forced to restart (only if end user was offline when deadline passed)."
         helpText="Number of days from 0 to 7."
-        placeholder="2"
         value={gracePeriodDays}
         error={gracePeriodDaysError}
         onChange={handleGracePeriodDays}
diff --git a/frontend/pages/ManageControlsPage/Scripts/components/DeleteScriptModal/DeleteScriptModal.tsx b/frontend/pages/ManageControlsPage/Scripts/components/DeleteScriptModal/DeleteScriptModal.tsx
index 4d67aea8b6..1935b38b11 100644
--- a/frontend/pages/ManageControlsPage/Scripts/components/DeleteScriptModal/DeleteScriptModal.tsx
+++ b/frontend/pages/ManageControlsPage/Scripts/components/DeleteScriptModal/DeleteScriptModal.tsx
@@ -42,9 +42,10 @@ const DeleteScriptModal = ({
     >
       <>
         <p>
-          This action will cancel script{" "}
-          <span className={`${baseClass}__script-name`}>{scriptName}</span> from
-          running on macOS hosts on which the script hasn&apos;t run yet.
+          The script{" "}
+          <span className={`${baseClass}__script-name`}>{scriptName}</span> will
+          run on pending hosts. After the scripts runs, it&apos;s output and
+          exit code will appear in the activity feed.
         </p>
         <div className="modal-cta-wrap">
           <Button
diff --git a/frontend/pages/ManageControlsPage/SetupExperience/cards/EndUserAuthentication/EndUserAuthentication.tsx b/frontend/pages/ManageControlsPage/SetupExperience/cards/EndUserAuthentication/EndUserAuthentication.tsx
index 30602d7049..6f114df0a6 100644
--- a/frontend/pages/ManageControlsPage/SetupExperience/cards/EndUserAuthentication/EndUserAuthentication.tsx
+++ b/frontend/pages/ManageControlsPage/SetupExperience/cards/EndUserAuthentication/EndUserAuthentication.tsx
@@ -79,7 +79,7 @@ const EndUserAuthentication = ({
   );
 
   const onClickConnect = () => {
-    router.push(PATHS.ADMIN_INTEGRATIONS_AUTOMATIC_ENROLLMENT);
+    router.push(PATHS.ADMIN_INTEGRATIONS_MDM);
   };
 
   return (
diff --git a/frontend/pages/ManageControlsPage/SetupExperience/cards/EndUserAuthentication/components/EndUserAuthForm/EndUserAuthForm.tsx b/frontend/pages/ManageControlsPage/SetupExperience/cards/EndUserAuthentication/components/EndUserAuthForm/EndUserAuthForm.tsx
index 1b8a505657..924992b54c 100644
--- a/frontend/pages/ManageControlsPage/SetupExperience/cards/EndUserAuthentication/components/EndUserAuthForm/EndUserAuthForm.tsx
+++ b/frontend/pages/ManageControlsPage/SetupExperience/cards/EndUserAuthentication/components/EndUserAuthForm/EndUserAuthForm.tsx
@@ -55,9 +55,7 @@ const EndUserAuthForm = ({
           Require end users to authenticate with your identity provider (IdP)
           and agree to an end user license agreement (EULA) when they setup
           their new macOS hosts.{" "}
-          <Link to={PATHS.ADMIN_INTEGRATIONS_AUTOMATIC_ENROLLMENT}>
-            View IdP and EULA
-          </Link>
+          <Link to={PATHS.ADMIN_INTEGRATIONS_MDM}>View IdP and EULA</Link>
         </p>
         <Button isLoading={isUpdating} onClick={onClickSave}>
           Save
diff --git a/frontend/pages/ManageControlsPage/SetupExperience/cards/SetupAssistant/components/SetupAssistantProfileUploader/SetupAssistantProfileUploader.tsx b/frontend/pages/ManageControlsPage/SetupExperience/cards/SetupAssistant/components/SetupAssistantProfileUploader/SetupAssistantProfileUploader.tsx
index 936e9f58fa..35789ee3b8 100644
--- a/frontend/pages/ManageControlsPage/SetupExperience/cards/SetupAssistant/components/SetupAssistantProfileUploader/SetupAssistantProfileUploader.tsx
+++ b/frontend/pages/ManageControlsPage/SetupExperience/cards/SetupAssistant/components/SetupAssistantProfileUploader/SetupAssistantProfileUploader.tsx
@@ -5,6 +5,7 @@ import { IApiError } from "interfaces/errors";
 import { NotificationContext } from "context/notification";
 import mdmAPI from "services/entities/mdm";
 
+import CustomLink from "components/CustomLink";
 import FileUploader from "components/FileUploader";
 
 import { getErrorMessage } from "./helpers";
@@ -40,7 +41,23 @@ const SetupAssistantProfileUploader = ({
     } catch (e) {
       const error = e as AxiosResponse<IApiError>;
       const errMessage = getErrorMessage(error);
-      renderFlash("error", errMessage);
+      let errComponent = <>{errMessage}</>;
+      if (errMessage.includes("Couldn't upload")) {
+        errComponent = (
+          <>
+            {errMessage}.{" "}
+            <CustomLink
+              url="https://fleetdm.com/learn-more-about/dep-profile"
+              text="Learn more"
+              className={`${baseClass}__new-tab`}
+              newTab
+              color="core-fleet-black"
+              iconColor="core-fleet-white"
+            />
+          </>
+        );
+      }
+      renderFlash("error", errComponent);
     } finally {
       setShowLoading(false);
     }
diff --git a/frontend/pages/SoftwarePage/SoftwareOS/SoftwareOSTable/SoftwareOSTable.tests.tsx b/frontend/pages/SoftwarePage/SoftwareOS/SoftwareOSTable/SoftwareOSTable.tests.tsx
new file mode 100644
index 0000000000..21a59614b2
--- /dev/null
+++ b/frontend/pages/SoftwarePage/SoftwareOS/SoftwareOSTable/SoftwareOSTable.tests.tsx
@@ -0,0 +1,70 @@
+import React from "react";
+import { render, screen } from "@testing-library/react";
+
+import { createMockOSVersionsResponse } from "__mocks__/softwareMock";
+
+import SoftwareOSTable from "./SoftwareOSTable";
+
+// TODO: figure out how to mock the router properly.
+const mockRouter = {
+  push: jest.fn(),
+  replace: jest.fn(),
+  goBack: jest.fn(),
+  goForward: jest.fn(),
+  go: jest.fn(),
+  setRouteLeaveHook: jest.fn(),
+  isActive: jest.fn(),
+  createHref: jest.fn(),
+  createPath: jest.fn(),
+};
+
+describe("Software operating systems table", () => {
+  it("Renders the page-wide disabled state when software inventory is disabled", async () => {
+    render(
+      <SoftwareOSTable
+        router={mockRouter}
+        isSoftwareEnabled={false} // Set to false
+        data={createMockOSVersionsResponse({
+          count: 0,
+          os_versions: [],
+        })}
+        perPage={20}
+        orderDirection="asc"
+        orderKey="hosts_count"
+        currentPage={0}
+        teamId={1}
+        isLoading={false}
+        resetPageIndex={false}
+      />
+    );
+
+    expect(screen.getByText("Software inventory disabled")).toBeInTheDocument();
+  });
+
+  it("Renders the page-wide empty state when no software is present", () => {
+    render(
+      <SoftwareOSTable
+        router={mockRouter}
+        isSoftwareEnabled
+        data={createMockOSVersionsResponse({
+          count: 0,
+          os_versions: [],
+        })}
+        perPage={20}
+        orderDirection="asc"
+        orderKey="hosts_count"
+        currentPage={0}
+        teamId={1}
+        isLoading={false}
+        resetPageIndex={false}
+      />
+    );
+
+    expect(
+      screen.getByText("No operating systems detected")
+    ).toBeInTheDocument();
+    expect(screen.getByText("0 items")).toBeInTheDocument();
+    expect(screen.queryByText("Search")).toBeNull();
+    expect(screen.queryByText("Updated")).toBeNull();
+  });
+});
diff --git a/frontend/pages/SoftwarePage/SoftwareOS/SoftwareOSTable/SoftwareOSTable.tsx b/frontend/pages/SoftwarePage/SoftwareOS/SoftwareOSTable/SoftwareOSTable.tsx
index f76a6deca6..9be6ee4d16 100644
--- a/frontend/pages/SoftwarePage/SoftwareOS/SoftwareOSTable/SoftwareOSTable.tsx
+++ b/frontend/pages/SoftwarePage/SoftwareOS/SoftwareOSTable/SoftwareOSTable.tsx
@@ -17,7 +17,7 @@ import TableCount from "components/TableContainer/TableCount";
 import EmptySoftwareTable from "pages/SoftwarePage/components/EmptySoftwareTable";
 import { IOSVersionsResponse } from "services/entities/operating_systems";
 
-import generateTableConfig from "pages/DashboardPage/cards/OperatingSystems/OperatingSystemsTableConfig";
+import generateTableConfig from "pages/DashboardPage/cards/OperatingSystems/OSTableConfig";
 import { buildQueryStringFromParams } from "utilities/url";
 import { getNextLocationPath } from "utilities/helpers";
 
@@ -129,7 +129,7 @@ const SoftwareOSTable = ({
   };
 
   const renderSoftwareCount = () => {
-    if (!data?.os_versions || !data?.count) return null;
+    if (!data) return null;
 
     return (
       <>
@@ -150,7 +150,7 @@ const SoftwareOSTable = ({
     );
   };
 
-  const renderTableFooter = () => {
+  const renderTableHelpText = () => {
     return (
       <div>
         Seeing unexpected software or vulnerabilities?{" "}
@@ -174,7 +174,7 @@ const SoftwareOSTable = ({
           <EmptySoftwareTable
             tableName="operating systems"
             isSoftwareDisabled={!isSoftwareEnabled}
-            isNotDetectingSoftware // non-searchable table renders not detecting by default
+            noSearchQuery // non-searchable table renders not detecting by default
           />
         )}
         defaultSortHeader={orderKey}
@@ -189,7 +189,7 @@ const SoftwareOSTable = ({
         onQueryChange={onQueryChange}
         stackControls
         renderCount={renderSoftwareCount}
-        renderFooter={renderTableFooter}
+        renderTableHelpText={renderTableHelpText}
         disableMultiRowSelect
         onSelectSingleRow={handleRowSelect}
         resetPageIndex={resetPageIndex}
diff --git a/frontend/pages/SoftwarePage/SoftwarePage.tsx b/frontend/pages/SoftwarePage/SoftwarePage.tsx
index 7def709f9a..9dcf95250f 100644
--- a/frontend/pages/SoftwarePage/SoftwarePage.tsx
+++ b/frontend/pages/SoftwarePage/SoftwarePage.tsx
@@ -17,10 +17,15 @@ import { ITeamConfig } from "interfaces/team";
 import { IWebhookSoftwareVulnerabilities } from "interfaces/webhook";
 import configAPI from "services/entities/config";
 import teamsAPI, { ILoadTeamResponse } from "services/entities/teams";
+import { ISoftwareApiParams } from "services/entities/software";
 import { AppContext } from "context/app";
 import { NotificationContext } from "context/notification";
 import useTeamIdParam from "hooks/useTeamIdParam";
-import { buildQueryStringFromParams } from "utilities/url";
+import {
+  buildQueryStringFromParams,
+  convertParamsToSnakeCase,
+} from "utilities/url";
+import { getNextLocationPath } from "utilities/helpers";
 
 import Button from "components/buttons/Button";
 import MainContent from "components/MainContent";
@@ -29,7 +34,14 @@ import TabsWrapper from "components/TabsWrapper";
 
 import ManageAutomationsModal from "./components/ManageSoftwareAutomationsModal";
 import AddSoftwareModal from "./components/AddSoftwareModal";
-import { getSoftwareFilterFromQueryParams } from "./SoftwareTitles/SoftwareTable/helpers";
+import {
+  buildSoftwareFilterQueryParams,
+  buildSoftwareVulnFiltersQueryParams,
+  getSoftwareFilterFromQueryParams,
+  getSoftwareVulnFiltersFromQueryParams,
+  ISoftwareVulnFiltersParams,
+} from "./SoftwareTitles/SoftwareTable/helpers";
+import SoftwareFiltersModal from "./components/SoftwareFiltersModal";
 
 interface ISoftwareSubNavItem {
   name: string;
@@ -93,9 +105,11 @@ interface ISoftwarePageProps {
     search: string;
     query: {
       team_id?: string;
-      vulnerable?: string;
       available_for_install?: string;
+      vulnerable?: string;
       exploit?: string;
+      min_cvss_score?: string;
+      max_cvss_score?: string;
       page?: string;
       query?: string;
       order_key?: string;
@@ -144,17 +158,27 @@ const SoftwarePage = ({ children, router, location }: ISoftwarePageProps) => {
   // defined redirect behavior if the params are invalid
   const softwareFilter = getSoftwareFilterFromQueryParams(queryParams);
 
+  const softwareVulnFilters = getSoftwareVulnFiltersFromQueryParams(
+    queryParams
+  );
+
   const [showManageAutomationsModal, setShowManageAutomationsModal] = useState(
     false
   );
   const [showPreviewPayloadModal, setShowPreviewPayloadModal] = useState(false);
   const [showPreviewTicketModal, setShowPreviewTicketModal] = useState(false);
   const [showAddSoftwareModal, setShowAddSoftwareModal] = useState(false);
+  const [showSoftwareFiltersModal, setShowSoftwareFiltersModal] = useState(
+    false
+  );
   const [resetPageIndex, setResetPageIndex] = useState<boolean>(false);
+  const [addedSoftwareToken, setAddedSoftwareToken] = useState<string | null>(
+    null
+  );
 
   const {
     currentTeamId,
-    isAnyTeamSelected,
+    isAllTeamsSelected,
     isRouteOk,
     teamIdForApi,
     userTeams,
@@ -243,6 +267,10 @@ const SoftwarePage = ({ children, router, location }: ISoftwarePageProps) => {
     setShowPreviewTicketModal(!showPreviewTicketModal);
   }, [setShowPreviewTicketModal, showPreviewTicketModal]);
 
+  const toggleSoftwareFiltersModal = useCallback(() => {
+    setShowSoftwareFiltersModal(!showSoftwareFiltersModal);
+  }, [setShowSoftwareFiltersModal, showSoftwareFiltersModal]);
+
   // TODO: move into manage automations modal
   const onCreateWebhookSubmit = async (
     configSoftwareAutomations: ISoftwareAutomations
@@ -281,6 +309,27 @@ const SoftwarePage = ({ children, router, location }: ISoftwarePageProps) => {
     [handleTeamChange]
   );
 
+  const onApplyVulnFilters = (vulnFilters: ISoftwareVulnFiltersParams) => {
+    const newQueryParams: ISoftwareApiParams = {
+      query,
+      teamId: currentTeamId,
+      orderDirection: sortDirection,
+      orderKey: sortHeader,
+      page: 0, // resets page index
+      ...buildSoftwareFilterQueryParams(softwareFilter),
+      ...buildSoftwareVulnFiltersQueryParams(vulnFilters),
+    };
+
+    router.replace(
+      getNextLocationPath({
+        pathPrefix: location.pathname,
+        routeTemplate: "",
+        queryParams: convertParamsToSnakeCase(newQueryParams),
+      })
+    );
+    toggleSoftwareFiltersModal();
+  };
+
   const navigateToNav = useCallback(
     (i: number): void => {
       setResetPageIndex(true); // Fixes flakey page reset in table state when switching between tabs
@@ -315,7 +364,7 @@ const SoftwarePage = ({ children, router, location }: ISoftwarePageProps) => {
 
   const renderPageActions = () => {
     const canManageAutomations =
-      isGlobalAdmin && (!isPremiumTier || !isAnyTeamSelected);
+      isGlobalAdmin && (!isPremiumTier || isAllTeamsSelected);
 
     const canAddSoftware =
       isGlobalAdmin || isGlobalMaintainer || isTeamAdmin || isTeamMaintainer;
@@ -345,8 +394,8 @@ const SoftwarePage = ({ children, router, location }: ISoftwarePageProps) => {
   const renderHeaderDescription = () => {
     return (
       <p>
-        Manage software and search for installed software, OS and
-        vulnerabilities {isAnyTeamSelected ? "on this team" : "for all hosts"}.
+        Manage software and search for installed software, OS, and
+        vulnerabilities {isAllTeamsSelected ? "for all hosts" : "on this team"}.
       </p>
     );
   };
@@ -384,7 +433,10 @@ const SoftwarePage = ({ children, router, location }: ISoftwarePageProps) => {
           query,
           showExploitedVulnerabilitiesOnly,
           softwareFilter,
+          vulnFilters: softwareVulnFilters,
           resetPageIndex,
+          addedSoftwareToken,
+          onAddFiltersClick: toggleSoftwareFiltersModal,
         })}
       </div>
     );
@@ -424,6 +476,16 @@ const SoftwarePage = ({ children, router, location }: ISoftwarePageProps) => {
             teamId={currentTeamId ?? 0}
             router={router}
             onExit={toggleAddSoftwareModal}
+            setAddedSoftwareToken={setAddedSoftwareToken}
+            isFreeTier={isFreeTier}
+          />
+        )}
+        {showSoftwareFiltersModal && (
+          <SoftwareFiltersModal
+            onExit={toggleSoftwareFiltersModal}
+            onSubmit={onApplyVulnFilters}
+            vulnFilters={softwareVulnFilters}
+            isPremiumTier={isPremiumTier || false}
           />
         )}
       </div>
diff --git a/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/AdvancedOptionsModal/AdvancedOptionsModal.tsx b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/AdvancedOptionsModal/AdvancedOptionsModal.tsx
index 8f95044ae0..5cfc313e44 100644
--- a/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/AdvancedOptionsModal/AdvancedOptionsModal.tsx
+++ b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/AdvancedOptionsModal/AdvancedOptionsModal.tsx
@@ -22,7 +22,7 @@ const AdvancedOptionsModal = ({
   onExit,
 }: IAdvancedOptionsModalProps) => {
   return (
-    <Modal className={baseClass} title="Advanced Options" onExit={onExit}>
+    <Modal className={baseClass} title="Advanced options" onExit={onExit}>
       <>
         <p>
           Advanced options are read-only. To change options, delete software and
@@ -38,6 +38,7 @@ const AdvancedOptionsModal = ({
             helpText="Fleet will run this command on hosts to install software."
             label="Install script"
             labelTooltip="For security agents, add the script provided by the vendor."
+            isFormField
           />
           {preInstallQuery && (
             <div className={`${baseClass}__input-field`}>
@@ -72,6 +73,7 @@ const AdvancedOptionsModal = ({
                 maxLines={10}
                 value={postInstallScript}
                 helpText="Shell (macOS and Linux) or PowerShell (Windows)."
+                isFormField
               />
             </div>
           )}
diff --git a/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/AdvancedOptionsModal/index.ts b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/AdvancedOptionsModal/index.ts
deleted file mode 100644
index 79a369995f..0000000000
--- a/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/AdvancedOptionsModal/index.ts
+++ /dev/null
@@ -1 +0,0 @@
-export { default } from "./AdvancedOptionsModal";
diff --git a/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/ConfirmSaveChangesModal/ConfirmSaveChangesModal.tsx b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/ConfirmSaveChangesModal/ConfirmSaveChangesModal.tsx
new file mode 100644
index 0000000000..d164f8dd8b
--- /dev/null
+++ b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/ConfirmSaveChangesModal/ConfirmSaveChangesModal.tsx
@@ -0,0 +1,62 @@
+import React from "react";
+
+import Button from "components/buttons/Button";
+import Modal from "components/Modal";
+
+import { IPackageFormData } from "pages/SoftwarePage/components/PackageForm/PackageForm";
+
+const baseClass = "save-changes-modal";
+
+export interface IConfirmSaveChangesModalProps {
+  onSaveChanges: () => void;
+  softwarePackageName?: string;
+  onClose: () => void;
+}
+
+const ConfirmSaveChangesModal = ({
+  onSaveChanges,
+  softwarePackageName,
+  onClose,
+}: IConfirmSaveChangesModalProps) => {
+  const warningText = (
+    <>
+      The changes you are making will cancel any pending installs and uninstalls
+      {softwarePackageName ? (
+        <>
+          {" "}
+          for <b> {softwarePackageName}</b>
+        </>
+      ) : (
+        ""
+      )}
+      .
+    </>
+  );
+  return (
+    <Modal title="Save changes?" onExit={onClose}>
+      <form className={`${baseClass}__form`}>
+        <p>{warningText}</p>
+        <p>
+          Installs or uninstalls currently running on a host will still
+          complete, but results won’t appear in Fleet.
+        </p>
+        <p>You cannot undo this action.</p>
+        <div className="modal-cta-wrap">
+          <Button
+            type="button"
+            onClick={onSaveChanges}
+            variant="brand"
+            className="save-loading"
+          >
+            Save
+          </Button>
+          <Button onClick={onClose} variant="inverse">
+            Cancel
+          </Button>
+        </div>
+      </form>
+    </Modal>
+  );
+};
+
+export default ConfirmSaveChangesModal;
diff --git a/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/ConfirmSaveChangesModal/index.ts b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/ConfirmSaveChangesModal/index.ts
new file mode 100644
index 0000000000..c8c31da396
--- /dev/null
+++ b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/ConfirmSaveChangesModal/index.ts
@@ -0,0 +1 @@
+export { default } from "./ConfirmSaveChangesModal";
diff --git a/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/DeleteSoftwareModal/DeleteSoftwareModal.tsx b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/DeleteSoftwareModal/DeleteSoftwareModal.tsx
index 23d03c5852..fa75f1d554 100644
--- a/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/DeleteSoftwareModal/DeleteSoftwareModal.tsx
+++ b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/DeleteSoftwareModal/DeleteSoftwareModal.tsx
@@ -3,11 +3,15 @@ import React, { useCallback, useContext } from "react";
 import softwareAPI from "services/entities/software";
 import { NotificationContext } from "context/notification";
 
+import { getErrorReason } from "interfaces/errors";
+
 import Modal from "components/Modal";
 import Button from "components/buttons/Button";
 
 const baseClass = "delete-software-modal";
 
+const DELETE_SW_USED_BY_POLICY_ERROR_MSG =
+  "Couldn't delete. Policy automation uses this software. Please disable policy automation for this software and try again.";
 interface IDeleteSoftwareModalProps {
   softwareId: number;
   teamId: number;
@@ -28,8 +32,13 @@ const DeleteSoftwareModal = ({
       await softwareAPI.deleteSoftwarePackage(softwareId, teamId);
       renderFlash("success", "Software deleted successfully!");
       onSuccess();
-    } catch {
-      renderFlash("error", "Couldn't delete. Please try again.");
+    } catch (error) {
+      const reason = getErrorReason(error);
+      if (reason.includes("Policy automation uses this software")) {
+        renderFlash("error", DELETE_SW_USED_BY_POLICY_ERROR_MSG);
+      } else {
+        renderFlash("error", "Couldn't delete. Please try again.");
+      }
     }
     onExit();
   }, [softwareId, teamId, renderFlash, onSuccess, onExit]);
diff --git a/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/EditSoftwareModal/EditSoftwareModal.tsx b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/EditSoftwareModal/EditSoftwareModal.tsx
new file mode 100644
index 0000000000..4b7cbc09c6
--- /dev/null
+++ b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/EditSoftwareModal/EditSoftwareModal.tsx
@@ -0,0 +1,231 @@
+import React, { useContext, useState, useEffect } from "react";
+import { InjectedRouter } from "react-router";
+import classnames from "classnames";
+import deepDifference from "utilities/deep_difference";
+
+import { getErrorReason } from "interfaces/errors";
+
+import PATHS from "router/paths";
+import { NotificationContext } from "context/notification";
+import softwareAPI from "services/entities/software";
+import { QueryParams, buildQueryStringFromParams } from "utilities/url";
+
+import { LEARN_MORE_ABOUT_BASE_LINK } from "utilities/constants";
+
+import CustomLink from "components/CustomLink";
+import Modal from "components/Modal";
+
+import PackageForm from "pages/SoftwarePage/components/PackageForm";
+import { IPackageFormData } from "pages/SoftwarePage/components/PackageForm/PackageForm";
+import {
+  UPLOAD_TIMEOUT,
+  MAX_FILE_SIZE_MB,
+  MAX_FILE_SIZE_BYTES,
+} from "pages/SoftwarePage/components/AddPackage/AddPackage";
+import { getErrorMessage } from "./helpers";
+import ConfirmSaveChangesModal from "../ConfirmSaveChangesModal";
+
+const baseClass = "edit-software-modal";
+
+interface IEditSoftwareModalProps {
+  softwareId: number;
+  teamId: number;
+  router: InjectedRouter;
+  software?: any; // TODO
+  refetchSoftwareTitle: () => void;
+
+  onExit: () => void;
+  setAddedSoftwareToken: (token: string) => void;
+}
+
+const EditSoftwareModal = ({
+  softwareId,
+  teamId,
+  router,
+  software,
+  onExit,
+  setAddedSoftwareToken,
+  refetchSoftwareTitle,
+}: IEditSoftwareModalProps) => {
+  const { renderFlash } = useContext(NotificationContext);
+
+  const [editSoftwareModalClasses, setEditSoftwareModalClasses] = useState(
+    baseClass
+  );
+  const [isUpdatingSoftware, setIsUpdatingSoftware] = useState(false);
+  const [
+    showConfirmSaveChangesModal,
+    setShowConfirmSaveChangesModal,
+  ] = useState(false);
+  const [pendingUpdates, setPendingUpdates] = useState<IPackageFormData>({
+    software: null,
+    installScript: "",
+    selfService: false,
+  });
+
+  // Work around to not lose Edit Software modal data when Save changes modal opens
+  // by using CSS to hide Edit Software modal when Save changes modal is open
+  useEffect(() => {
+    setEditSoftwareModalClasses(
+      classnames(baseClass, {
+        [`${baseClass}--hidden`]: showConfirmSaveChangesModal,
+      })
+    );
+  }, [showConfirmSaveChangesModal]);
+
+  useEffect(() => {
+    let timeout: NodeJS.Timeout;
+
+    const beforeUnloadHandler = (e: BeforeUnloadEvent) => {
+      e.preventDefault();
+      // Next line with e.returnValue is included for legacy support
+      // e.g.Chrome / Edge < 119
+      e.returnValue = true;
+    };
+
+    // set up event listener to prevent user from leaving page while uploading
+    if (isUpdatingSoftware) {
+      addEventListener("beforeunload", beforeUnloadHandler);
+      timeout = setTimeout(() => {
+        removeEventListener("beforeunload", beforeUnloadHandler);
+      }, UPLOAD_TIMEOUT);
+    } else {
+      removeEventListener("beforeunload", beforeUnloadHandler);
+    }
+
+    // clean up event listener and timeout on component unmount
+    return () => {
+      removeEventListener("beforeunload", beforeUnloadHandler);
+      clearTimeout(timeout);
+    };
+  }, [isUpdatingSoftware]);
+
+  const toggleConfirmSaveChangesModal = () => {
+    // open and closes save changes modal
+    setShowConfirmSaveChangesModal(!showConfirmSaveChangesModal);
+  };
+
+  const onSaveSoftwareChanges = async (formData: IPackageFormData) => {
+    setIsUpdatingSoftware(true);
+
+    if (formData.software && formData.software.size > MAX_FILE_SIZE_BYTES) {
+      renderFlash(
+        "error",
+        `Couldn't edit software. The maximum file size is ${MAX_FILE_SIZE_MB} MB.`
+      );
+      setIsUpdatingSoftware(false);
+      return;
+    }
+
+    // Note: This TODO is copied over from onAddPackage on AddPackage.tsx
+    // TODO: confirm we are deleting the second sentence (not modifying it) for non-self-service installers
+    try {
+      await softwareAPI.editSoftwarePackage(
+        formData,
+        softwareId,
+        teamId,
+        UPLOAD_TIMEOUT
+      );
+
+      renderFlash(
+        "success",
+        <>
+          Successfully edited <b>{formData.software?.name}</b>.
+          {formData.selfService
+            ? " The end user can install from Fleet Desktop."
+            : ""}
+        </>
+      );
+      onExit();
+      refetchSoftwareTitle();
+    } catch (e) {
+      const reason = getErrorReason(e);
+      if (reason.includes("Fleet couldn't read the version from")) {
+        renderFlash(
+          "error",
+          <>
+            Couldn&apos;t edit <b>{software.name}</b>. {reason}.
+            <CustomLink
+              newTab
+              url={`${LEARN_MORE_ABOUT_BASE_LINK}/read-package-version`}
+              text="Learn more"
+            />
+          </>
+        );
+      } else if (reason.includes("selected package is")) {
+        renderFlash(
+          "error",
+          <>
+            Couldn&apos;t edit <b>{software.name}</b>. {reason}
+          </>
+        );
+      } else {
+        renderFlash("error", getErrorMessage(e));
+      }
+    }
+    setIsUpdatingSoftware(false);
+  };
+
+  const onEditSoftware = (formData: IPackageFormData) => {
+    // Check for changes to conditionally confirm save changes modal
+    const updates = deepDifference(formData, {
+      software,
+      installScript: software.install_script || "",
+      preInstallQuery: software.pre_install_query || "",
+      postInstallScript: software.post_install_script || "",
+      uninstallScript: software.uninstall_script || "",
+      selfService: software.self_service || false,
+    });
+
+    setPendingUpdates(formData);
+
+    const onlySelfServiceUpdated =
+      Object.keys(updates).length === 1 && "selfService" in updates;
+    if (!onlySelfServiceUpdated) {
+      console.log("non-self-service updates: ", updates);
+      // Open the confirm save changes modal
+      setShowConfirmSaveChangesModal(true);
+    } else {
+      // Proceed with saving changes (API expects only changes)
+      onSaveSoftwareChanges(formData);
+    }
+  };
+
+  const onConfirmSoftwareChanges = () => {
+    setShowConfirmSaveChangesModal(false);
+    onSaveSoftwareChanges(pendingUpdates);
+  };
+
+  return (
+    <>
+      <Modal
+        className={editSoftwareModalClasses}
+        title="Edit software"
+        onExit={onExit}
+        width="large"
+      >
+        <PackageForm
+          isEditingSoftware
+          isUploading={isUpdatingSoftware}
+          onCancel={onExit}
+          onSubmit={onEditSoftware}
+          defaultSoftware={software}
+          defaultInstallScript={software.install_script}
+          defaultPreInstallQuery={software.pre_install_query}
+          defaultPostInstallScript={software.post_install_script}
+          defaultUninstallScript={software.uninstall_script}
+          defaultSelfService={software.self_service}
+        />
+      </Modal>
+      {showConfirmSaveChangesModal && (
+        <ConfirmSaveChangesModal
+          onClose={toggleConfirmSaveChangesModal}
+          softwarePackageName={software?.name}
+          onSaveChanges={onConfirmSoftwareChanges}
+        />
+      )}
+    </>
+  );
+};
+
+export default EditSoftwareModal;
diff --git a/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/AdvancedOptionsModal/_styles.scss b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/EditSoftwareModal/_styles.scss
similarity index 66%
rename from frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/AdvancedOptionsModal/_styles.scss
rename to frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/EditSoftwareModal/_styles.scss
index a63d438bdf..6dd1252403 100644
--- a/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/AdvancedOptionsModal/_styles.scss
+++ b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/EditSoftwareModal/_styles.scss
@@ -1,4 +1,4 @@
-.advanced-options-modal {
+.edit-software-modal {
   &__form-inputs {
     display: flex;
     flex-direction: column;
@@ -8,6 +8,10 @@
   &__input-field {
     display: flex;
     flex-direction: column;
-    gap: $pad-medium
+    gap: $pad-medium;
+  }
+
+  &--hidden {
+    display: none;
   }
 }
diff --git a/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/EditSoftwareModal/helpers.ts b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/EditSoftwareModal/helpers.ts
new file mode 100644
index 0000000000..967bfb0882
--- /dev/null
+++ b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/EditSoftwareModal/helpers.ts
@@ -0,0 +1,13 @@
+import { getErrorReason } from "interfaces/errors";
+
+const UPLOAD_ERROR_MESSAGES = {
+  default: {
+    message: "Couldn't edit software. Please try again.",
+  },
+};
+
+// eslint-disable-next-line import/prefer-default-export
+export const getErrorMessage = (err: unknown) => {
+  if (typeof err === "string") return err;
+  return getErrorReason(err) || UPLOAD_ERROR_MESSAGES.default.message;
+};
diff --git a/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/EditSoftwareModal/index.ts b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/EditSoftwareModal/index.ts
new file mode 100644
index 0000000000..88fca9330c
--- /dev/null
+++ b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/EditSoftwareModal/index.ts
@@ -0,0 +1 @@
+export { default } from "./EditSoftwareModal";
diff --git a/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwarePackageCard/SoftwarePackageCard.tsx b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwarePackageCard/SoftwarePackageCard.tsx
index 1cc7d63699..30a0578191 100644
--- a/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwarePackageCard/SoftwarePackageCard.tsx
+++ b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwarePackageCard/SoftwarePackageCard.tsx
@@ -4,17 +4,18 @@ import React, {
   useLayoutEffect,
   useState,
 } from "react";
-import FileSaver from "file-saver";
+import { InjectedRouter } from "react-router";
 
 import PATHS from "router/paths";
 import { AppContext } from "context/app";
 import { NotificationContext } from "context/notification";
-import { SoftwareInstallStatus, ISoftwarePackage } from "interfaces/software";
+import { ISoftwarePackage } from "interfaces/software";
 import softwareAPI from "services/entities/software";
 
 import { buildQueryStringFromParams } from "utilities/url";
 import { internationalTimeFormat } from "utilities/helpers";
 import { uploadedFromNow } from "utilities/date_format";
+import { noop } from "lodash";
 
 // @ts-ignore
 import Dropdown from "components/forms/fields/Dropdown";
@@ -25,12 +26,15 @@ import DataSet from "components/DataSet";
 import Icon from "components/Icon";
 
 import SoftwareIcon from "pages/SoftwarePage/components/icons/SoftwareIcon";
+import endpoints from "utilities/endpoints";
+import URL_PREFIX from "router/url_prefix";
 
 import DeleteSoftwareModal from "../DeleteSoftwareModal";
-import AdvancedOptionsModal from "../AdvancedOptionsModal";
+import EditSoftwareModal from "../EditSoftwareModal";
 import {
   APP_STORE_APP_DROPDOWN_OPTIONS,
-  SOFTWARE_PACAKGE_DROPDOWN_OPTIONS,
+  SOFTWARE_PACKAGE_DROPDOWN_OPTIONS,
+  downloadFile,
 } from "./helpers";
 
 const baseClass = "software-package-card";
@@ -41,10 +45,15 @@ function useTruncatedElement<T extends HTMLElement>(ref: React.RefObject<T>) {
 
   useLayoutEffect(() => {
     const element = ref.current;
-    if (element) {
-      const { scrollWidth, clientWidth } = element;
-      setIsTruncated(scrollWidth > clientWidth);
+    function updateIsTruncated() {
+      if (element) {
+        const { scrollWidth, clientWidth } = element;
+        setIsTruncated(scrollWidth > clientWidth);
+      }
     }
+    window.addEventListener("resize", updateIsTruncated);
+    updateIsTruncated();
+    return () => window.removeEventListener("resize", updateIsTruncated);
   }, [ref]);
 
   return isTruncated;
@@ -76,33 +85,56 @@ const SoftwareName = ({ name }: ISoftwareNameProps) => {
 interface IStatusDisplayOption {
   displayName: string;
   iconName: "success" | "pending-outline" | "error";
-  tooltip: string;
+  tooltip: React.ReactNode;
 }
 
+// "pending" and "failed" each encompass both "_install" and "_uninstall" sub-statuses
+type SoftwareInstallDisplayStatus = "installed" | "pending" | "failed";
+
 const STATUS_DISPLAY_OPTIONS: Record<
-  SoftwareInstallStatus,
+  SoftwareInstallDisplayStatus,
   IStatusDisplayOption
 > = {
   installed: {
     displayName: "Installed",
     iconName: "success",
-    tooltip: "Fleet installed software on these hosts.",
+    tooltip: (
+      <>
+        Software is installed on these hosts (install script finished
+        <br />
+        with exit code 0). Currently, if the software is uninstalled, the
+        <br />
+        &quot;Installed&quot; status won&apos;t be updated.
+      </>
+    ),
   },
   pending: {
     displayName: "Pending",
     iconName: "pending-outline",
-    tooltip: "Fleet will install software when these hosts come online.",
+    tooltip: (
+      <>
+        Fleet is installing/uninstalling or will
+        <br />
+        do so when the host comes online.
+      </>
+    ),
   },
   failed: {
     displayName: "Failed",
     iconName: "error",
-    tooltip: "Fleet failed to install software on these hosts.",
+    tooltip: (
+      <>
+        These hosts failed to install/uninstall software.
+        <br />
+        Click on a host to view error(s).
+      </>
+    ),
   },
 };
 
 interface IPackageStatusCountProps {
   softwareId: number;
-  status: SoftwareInstallStatus;
+  status: SoftwareInstallDisplayStatus;
   count: number;
   teamId?: number;
 }
@@ -121,16 +153,18 @@ const PackageStatusCount = ({
   })}`;
   return (
     <DataSet
+      className={`${baseClass}__status`}
       title={
         <TooltipWrapper
           position="top"
           tipContent={displayData.tooltip}
           underline={false}
           showArrow
+          tipOffset={10}
         >
           <div className={`${baseClass}__status-title`}>
             <Icon name={displayData.iconName} />
-            <span>{displayData.displayName}</span>
+            <div>{displayData.displayName}</div>
           </div>
         </TooltipWrapper>
       }
@@ -147,14 +181,14 @@ interface IActionsDropdownProps {
   isSoftwarePackage: boolean;
   onDownloadClick: () => void;
   onDeleteClick: () => void;
-  onAdvancedOptionsClick: () => void;
+  onEditSoftwareClick: () => void;
 }
 
 const ActionsDropdown = ({
   isSoftwarePackage,
   onDownloadClick,
   onDeleteClick,
-  onAdvancedOptionsClick,
+  onEditSoftwareClick,
 }: IActionsDropdownProps) => {
   const onSelect = (value: string) => {
     switch (value) {
@@ -164,8 +198,8 @@ const ActionsDropdown = ({
       case "delete":
         onDeleteClick();
         break;
-      case "advanced":
-        onAdvancedOptionsClick();
+      case "edit":
+        onEditSoftwareClick();
         break;
       default:
       // noop
@@ -181,7 +215,7 @@ const ActionsDropdown = ({
         searchable={false}
         options={
           isSoftwarePackage
-            ? SOFTWARE_PACAKGE_DROPDOWN_OPTIONS
+            ? SOFTWARE_PACKAGE_DROPDOWN_OPTIONS
             : APP_STORE_APP_DROPDOWN_OPTIONS
         }
       />
@@ -204,9 +238,11 @@ interface ISoftwarePackageCardProps {
   // NOTE: we will only have this if we are working with a software package.
   softwarePackage?: ISoftwarePackage;
   onDelete: () => void;
+  router: InjectedRouter;
+  refetchSoftwareTitle: () => void;
 }
 
-// NOTE: This component is depeent on having either a software package
+// NOTE: This component is dependent on having either a software package
 // (ISoftwarePackage) or an app store app (IAppStoreApp). If we add more types
 // of packages we should consider refactoring this to be more dynamic.
 const SoftwarePackageCard = ({
@@ -219,6 +255,8 @@ const SoftwarePackageCard = ({
   softwareId,
   teamId,
   onDelete,
+  router,
+  refetchSoftwareTitle,
 }: ISoftwarePackageCardProps) => {
   const {
     isGlobalAdmin,
@@ -228,13 +266,11 @@ const SoftwarePackageCard = ({
   } = useContext(AppContext);
   const { renderFlash } = useContext(NotificationContext);
 
-  const [showAdvancedOptionsModal, setShowAdvancedOptionsModal] = useState(
-    false
-  );
+  const [showEditSoftwareModal, setShowEditSoftwareModal] = useState(false);
   const [showDeleteModal, setShowDeleteModal] = useState(false);
 
-  const onAdvancedOptionsClick = () => {
-    setShowAdvancedOptionsModal(true);
+  const onEditSoftwareClick = () => {
+    setShowEditSoftwareModal(true);
   };
 
   const onDeleteClick = () => {
@@ -248,29 +284,20 @@ const SoftwarePackageCard = ({
 
   const onDownloadClick = useCallback(async () => {
     try {
-      const resp = await softwareAPI.downloadSoftwarePackage(
+      const resp = await softwareAPI.getSoftwarePackageToken(
         softwareId,
         teamId
       );
-      const contentLength = parseInt(resp.headers["content-length"], 10);
-      if (contentLength !== resp.data.size) {
-        throw new Error(
-          `Byte size (${resp.data.size}) does not match content-length header (${contentLength})`
-        );
+      if (!resp.token) {
+        throw new Error("No download token returned");
       }
-      const filename = name;
-      const file = new File([resp.data], filename, {
-        type: "application/octet-stream",
-      });
-      if (file.size === 0) {
-        throw new Error("Downloaded file is empty");
-      }
-      if (file.size !== resp.data.size) {
-        throw new Error(
-          `File size (${file.size}) does not match expected size (${resp.data.size})`
-        );
-      }
-      FileSaver.saveAs(file);
+      // Now that we received the download token, we construct the download URL.
+      const { origin } = global.window.location;
+      const url = `${origin}${URL_PREFIX}/api${endpoints.SOFTWARE_PACKAGE_TOKEN(
+        softwareId
+      )}/${resp.token}`;
+      // The download occurs without any additional authentication.
+      downloadFile(url, name);
     } catch (e) {
       renderFlash("error", "Couldn't download. Please try again.");
     }
@@ -305,63 +332,66 @@ const SoftwarePackageCard = ({
 
   return (
     <Card borderRadiusSize="xxlarge" includeShadow className={baseClass}>
-      <div className={`${baseClass}__main-content`}>
+      <div className={`${baseClass}__row-1`}>
         {/* TODO: main-info could be a seperate component as its reused on a couple
         pages already. Come back and pull this into a component */}
         <div className={`${baseClass}__main-info`}>
           {renderIcon()}
           <div className={`${baseClass}__info`}>
-            <SoftwareName name={name} />
+            <SoftwareName name={softwarePackage?.name || name} />
             <span className={`${baseClass}__details`}>{renderDetails()}</span>
           </div>
         </div>
-        <div className={`${baseClass}__package-statuses`}>
-          <PackageStatusCount
-            softwareId={softwareId}
-            status="installed"
-            count={status.installed}
-            teamId={teamId}
-          />
-          <PackageStatusCount
-            softwareId={softwareId}
-            status="pending"
-            count={status.pending}
-            teamId={teamId}
-          />
-          <PackageStatusCount
-            softwareId={softwareId}
-            status="failed"
-            count={status.failed}
-            teamId={teamId}
-          />
+        <div className={`${baseClass}__actions-wrapper`}>
+          {isSelfService && (
+            <div className={`${baseClass}__self-service-badge`}>
+              <Icon
+                name="install-self-service"
+                size="small"
+                color="ui-fleet-black-75"
+              />
+              Self-service
+            </div>
+          )}
+          {showActions && (
+            <ActionsDropdown
+              isSoftwarePackage={!!softwarePackage}
+              onDownloadClick={onDownloadClick}
+              onDeleteClick={onDeleteClick}
+              onEditSoftwareClick={onEditSoftwareClick}
+            />
+          )}
         </div>
       </div>
-      <div className={`${baseClass}__actions-wrapper`}>
-        {isSelfService && (
-          <div className={`${baseClass}__self-service-badge`}>
-            <Icon
-              name="install-self-service"
-              size="small"
-              color="ui-fleet-black-75"
-            />
-            Self-service
-          </div>
-        )}
-        {showActions && (
-          <ActionsDropdown
-            isSoftwarePackage={!!softwarePackage}
-            onDownloadClick={onDownloadClick}
-            onDeleteClick={onDeleteClick}
-            onAdvancedOptionsClick={onAdvancedOptionsClick}
-          />
-        )}
+      <div className={`${baseClass}__package-statuses`}>
+        <PackageStatusCount
+          softwareId={softwareId}
+          status="installed"
+          count={status.installed}
+          teamId={teamId}
+        />
+        <PackageStatusCount
+          softwareId={softwareId}
+          status="pending"
+          count={status.pending}
+          teamId={teamId}
+        />
+        <PackageStatusCount
+          softwareId={softwareId}
+          status="failed"
+          count={status.failed}
+          teamId={teamId}
+        />
       </div>
-      {showAdvancedOptionsModal && (
-        <AdvancedOptionsModal
-          installScript={softwarePackage?.install_script ?? ""}
-          preInstallQuery={softwarePackage?.pre_install_query}
-          postInstallScript={softwarePackage?.post_install_script}
-          onExit={() => setShowAdvancedOptionsModal(false)}
+      {showEditSoftwareModal && (
+        <EditSoftwareModal
+          softwareId={softwareId}
+          teamId={teamId}
+          software={softwarePackage}
+          onExit={() => setShowEditSoftwareModal(false)}
+          router={router}
+          setAddedSoftwareToken={noop}
+          refetchSoftwareTitle={refetchSoftwareTitle}
         />
       )}
       {showDeleteModal && (
diff --git a/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwarePackageCard/_styles.scss b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwarePackageCard/_styles.scss
index 6897dffe7b..f4c5f6a9e0 100644
--- a/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwarePackageCard/_styles.scss
+++ b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwarePackageCard/_styles.scss
@@ -1,13 +1,15 @@
 .software-package-card {
   display: flex;
+  flex-direction: column;
   justify-content: space-between;
   align-items: center;
   gap: $pad-medium;
 
-  &__main-content {
+  &__row-1 {
     display: flex;
-    align-items: flex-start;
-    gap: $pad-xxlarge;
+    justify-content: space-between;
+    width: 100%;
+    gap: $pad-medium;
   }
 
   &__main-info {
@@ -19,13 +21,14 @@
     display: flex;
     flex-direction: column;
     gap: $pad-xsmall;
+    justify-content: center;
   }
 
   &__title {
     font-size: $x-small;
     font-weight: $bold;
     @include ellipse-text;
-    max-width: 290px;
+    max-width: 48vw;
   }
 
   &__details {
@@ -34,13 +37,36 @@
 
   &__package-statuses {
     display: flex;
-    gap: $pad-xxlarge;
+    align-items: flex-start;
+    align-self: stretch;
+    border-radius: 6px;
+    border: 1px solid $ui-fleet-black-10;
+    font-size: $x-small;
   }
 
-  &__status-title {
+  &__status {
     display: flex;
+    flex-direction: column;
+    padding: 16px 24px;
+    justify-content: center;
     align-items: center;
-    gap: $pad-xsmall;
+    flex: 1 0 0;
+    border-right: 1px solid var(--UI-Fleet-Black-10, #e2e4ea);
+
+    &:last-child {
+      border-right: none;
+    }
+
+    .react-tooltip {
+      text-align: center;
+    }
+  }
+
+  &__status-title{
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    gap: $pad-small;
   }
 
   &__status-count {
@@ -51,6 +77,7 @@
     display: flex;
     justify-content: flex-end;
     gap: $pad-medium;
+    align-items: center;
   }
 
   &__self-service-badge {
@@ -65,6 +92,7 @@
     color: $ui-fleet-black-75;
     font-size: $xx-small;
     font-weight: $bold;
+    white-space: nowrap;
   }
 
   &__actions {
diff --git a/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwarePackageCard/helpers.ts b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwarePackageCard/helpers.ts
index 26b5d97744..e1bf206901 100644
--- a/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwarePackageCard/helpers.ts
+++ b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwarePackageCard/helpers.ts
@@ -1,15 +1,15 @@
-export const SOFTWARE_PACAKGE_DROPDOWN_OPTIONS = [
+export const SOFTWARE_PACKAGE_DROPDOWN_OPTIONS = [
   {
     label: "Download",
     value: "download",
   },
   {
-    label: "Delete",
-    value: "delete",
+    label: "Edit",
+    value: "edit",
   },
   {
-    label: "Advanced options",
-    value: "advanced",
+    label: "Delete",
+    value: "delete",
   },
 ] as const;
 
@@ -19,3 +19,14 @@ export const APP_STORE_APP_DROPDOWN_OPTIONS = [
     value: "delete",
   },
 ] as const;
+
+export const downloadFile = (url: string, fileName: string) => {
+  // Download a file by simulating a link click.
+  const downloadLink = document.createElement("a");
+  downloadLink.href = url;
+  downloadLink.download = fileName;
+  downloadLink.click();
+
+  // Clean up above-created "a" element
+  downloadLink.remove();
+};
diff --git a/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwareTitleDetailsPage.tsx b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwareTitleDetailsPage.tsx
index 70c4b4ef77..d3c77d16c3 100644
--- a/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwareTitleDetailsPage.tsx
+++ b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwareTitleDetailsPage.tsx
@@ -12,7 +12,11 @@ import useTeamIdParam from "hooks/useTeamIdParam";
 
 import { AppContext } from "context/app";
 
-import { ISoftwareTitleDetails, formatSoftwareType } from "interfaces/software";
+import {
+  ISoftwareTitleDetails,
+  formatSoftwareType,
+  isIpadOrIphoneSoftwareSource,
+} from "interfaces/software";
 import { ignoreAxiosError } from "interfaces/errors";
 import softwareAPI, {
   ISoftwareTitleResponse,
@@ -101,8 +105,8 @@ const SoftwareTitleDetailsPage = ({
     }
   );
 
-  const hasSoftwarePackage = !!softwareTitle?.software_package;
-  const hasAppStoreApp = !!softwareTitle?.app_store_app;
+  const isAvailableForInstall =
+    !!softwareTitle?.software_package || !!softwareTitle?.app_store_app;
 
   const onDeleteInstaller = useCallback(() => {
     if (softwareTitle?.versions?.length) {
@@ -132,7 +136,7 @@ const SoftwareTitleDetailsPage = ({
     const showPackageCard =
       currentTeamId !== APP_CONTEXT_ALL_TEAMS_ID &&
       hasPermission &&
-      (hasSoftwarePackage || hasAppStoreApp);
+      isAvailableForInstall;
 
     if (showPackageCard) {
       const packageCardData = getPackageCardInfo(title);
@@ -147,6 +151,8 @@ const SoftwareTitleDetailsPage = ({
           softwareId={softwareId}
           teamId={currentTeamId ?? APP_CONTEXT_NO_TEAM_ID}
           onDelete={onDeleteInstaller}
+          router={router}
+          refetchSoftwareTitle={refetchSoftwareTitle}
         />
       );
     }
@@ -163,7 +169,7 @@ const SoftwareTitleDetailsPage = ({
       return (
         <DetailsNoHosts
           header="Software not detected"
-          details="No hosts have this software installed."
+          details="Expecting to see software? Check back later."
         />
       );
     }
@@ -200,9 +206,11 @@ const SoftwareTitleDetailsPage = ({
               data={softwareTitle.versions ?? []}
               isLoading={isSoftwareTitleLoading}
               teamIdForApi={teamIdForApi}
-              isIPadOSOrIOSApp={["ios_apps", "ipados_apps"].includes(
+              isIPadOSOrIOSApp={isIpadOrIphoneSoftwareSource(
                 softwareTitle.source
               )}
+              isAvailableForInstall={isAvailableForInstall}
+              countsUpdatedAt={softwareTitle.versions_updated_at}
             />
           </Card>
         </>
diff --git a/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwareTitleDetailsTable/SoftwareTitleDetailsTable.tsx b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwareTitleDetailsTable/SoftwareTitleDetailsTable.tsx
index a348b501b0..6eaafa2a28 100644
--- a/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwareTitleDetailsTable/SoftwareTitleDetailsTable.tsx
+++ b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwareTitleDetailsTable/SoftwareTitleDetailsTable.tsx
@@ -13,6 +13,7 @@ import TableContainer from "components/TableContainer";
 import TableCount from "components/TableContainer/TableCount";
 import EmptyTable from "components/EmptyTable";
 import CustomLink from "components/CustomLink";
+import LastUpdatedText from "components/LastUpdatedText";
 
 import generateSoftwareTitleDetailsTableConfig from "./SoftwareTitleDetailsTableConfig";
 
@@ -21,19 +22,42 @@ const DEFAULT_SORT_DIRECTION = "desc";
 
 const baseClass = "software-title-details-table";
 
-const NoVersionsDetected = (): JSX.Element => {
+const SoftwareLastUpdatedInfo = (lastUpdatedAt: string) => {
+  return (
+    <LastUpdatedText
+      lastUpdatedAt={lastUpdatedAt}
+      customTooltipText={
+        <>
+          The last time software data was <br />
+          updated, including vulnerabilities <br />
+          and host counts.
+        </>
+      }
+    />
+  );
+};
+
+const NoVersionsDetected = (isAvailableForInstall = false): JSX.Element => {
   return (
     <EmptyTable
-      header="No versions detected for this software item."
+      header={
+        isAvailableForInstall
+          ? "No versions detected."
+          : "No versions detected for this software item."
+      }
       info={
-        <>
-          Expecting to see versions?{" "}
-          <CustomLink
-            url={GITHUB_NEW_ISSUE_LINK}
-            text="File an issue on GitHub"
-            newTab
-          />
-        </>
+        isAvailableForInstall ? (
+          "Install this software on a host to see versions."
+        ) : (
+          <>
+            Expecting to see versions?{" "}
+            <CustomLink
+              url={GITHUB_NEW_ISSUE_LINK}
+              text="File an issue on GitHub"
+              newTab
+            />
+          </>
+        )
       }
     />
   );
@@ -45,6 +69,8 @@ interface ISoftwareTitleDetailsTableProps {
   isLoading: boolean;
   teamIdForApi?: number;
   isIPadOSOrIOSApp: boolean;
+  isAvailableForInstall?: boolean;
+  countsUpdatedAt?: string;
 }
 
 interface IRowProps extends Row {
@@ -59,6 +85,8 @@ const SoftwareTitleDetailsTable = ({
   isLoading,
   teamIdForApi,
   isIPadOSOrIOSApp,
+  isAvailableForInstall,
+  countsUpdatedAt,
 }: ISoftwareTitleDetailsTableProps) => {
   const handleRowSelect = (row: IRowProps) => {
     const hostsBySoftwareParams = {
@@ -85,7 +113,10 @@ const SoftwareTitleDetailsTable = ({
   );
 
   const renderVersionsCount = () => (
-    <TableCount name="versions" count={data?.length} />
+    <>
+      <TableCount name="versions" count={data?.length} />
+      {countsUpdatedAt && SoftwareLastUpdatedInfo(countsUpdatedAt)}
+    </>
   );
 
   return (
@@ -94,7 +125,7 @@ const SoftwareTitleDetailsTable = ({
       columnConfigs={softwareTableHeaders}
       data={data}
       isLoading={isLoading}
-      emptyComponent={NoVersionsDetected}
+      emptyComponent={() => NoVersionsDetected(isAvailableForInstall)}
       showMarkAllPages={false}
       isAllPagesSelected={false}
       defaultSortHeader={DEFAULT_SORT_HEADER}
diff --git a/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/helpers.tests.ts b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/helpers.tests.ts
new file mode 100644
index 0000000000..b87ee91649
--- /dev/null
+++ b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/helpers.tests.ts
@@ -0,0 +1,80 @@
+import { ISoftwareTitleDetails } from "interfaces/software";
+import { getPackageCardInfo } from "./helpers";
+
+describe("SoftwareTitleDetailsPage helpers", () => {
+  describe("getPackageCardInfo", () => {
+    it("returns the correct data for a software package", () => {
+      const softwareTitle: ISoftwareTitleDetails = {
+        id: 1,
+        name: "Test Software",
+        versions: [{ id: 1, version: "1.0.0", vulnerabilities: [] }],
+        software_package: {
+          name: "TestPackage.pkg",
+          version: "1.0.0",
+          self_service: true,
+          uploaded_at: "2021-01-01T00:00:00Z",
+          status: {
+            installed: 10,
+            pending_install: 5,
+            pending_uninstall: 3,
+            failed_install: 2,
+            failed_uninstall: 1,
+          },
+          install_script: "echo foo",
+          icon_url: "https://example.com/icon.png",
+        },
+        app_store_app: null,
+        source: "apps",
+        hosts_count: 10,
+      };
+      const packageCardInfo = getPackageCardInfo(softwareTitle);
+      expect(packageCardInfo).toEqual({
+        softwarePackage: softwareTitle.software_package,
+        name: "TestPackage.pkg", // packages should display the package name not the software title name
+        version: "1.0.0",
+        uploadedAt: "2021-01-01T00:00:00Z",
+        status: {
+          installed: 10,
+          pending: 8,
+          failed: 3,
+        },
+        isSelfService: true,
+      });
+    });
+    it("returns the correct data for an app store app", () => {
+      const softwareTitle: ISoftwareTitleDetails = {
+        id: 1,
+        name: "Test Software",
+        versions: [{ id: 1, version: "1.0.0", vulnerabilities: [] }],
+        software_package: null,
+        app_store_app: {
+          app_store_id: 1,
+          name: "Test App",
+          latest_version: "1.0.1",
+          self_service: false,
+          status: {
+            installed: 10,
+            pending: 5,
+            failed: 3,
+          },
+          icon_url: "https://example.com/icon.png",
+        },
+        source: "apps",
+        hosts_count: 10,
+      };
+      const packageCardInfo = getPackageCardInfo(softwareTitle);
+      expect(packageCardInfo).toEqual({
+        softwarePackage: undefined,
+        name: "Test Software", // apps should display the software title name (backend should ensure the app name and software title name match)
+        version: "1.0.1",
+        uploadedAt: "",
+        status: {
+          installed: 10,
+          pending: 5,
+          failed: 3,
+        },
+        isSelfService: false,
+      });
+    });
+  });
+});
diff --git a/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/helpers.ts b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/helpers.ts
index b662f30556..7cc6ac51d4 100644
--- a/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/helpers.ts
+++ b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/helpers.ts
@@ -2,11 +2,17 @@ import {
   IAppStoreApp,
   ISoftwareTitleDetails,
   isSoftwarePackage,
+  aggregateInstallStatusCounts,
 } from "interfaces/software";
 import { DEFAULT_EMPTY_CELL_VALUE } from "utilities/constants";
 
 /**
- * Generates the data needed to render the package card.
+ * Generates the data needed to render the package card. It differentiates between
+ * software packages and app store apps and returns the appropriate data.
+ *
+ * FIXME: This function ought to be refactored or renamed to better reflect its purpose.
+ * "PackageCard" is a bit ambiguous in this context (it refers to the card that displays
+ * package or app information, as applicable).
  */
 // eslint-disable-next-line import/prefer-default-export
 export const getPackageCardInfo = (softwareTitle: ISoftwareTitleDetails) => {
@@ -16,17 +22,19 @@ export const getPackageCardInfo = (softwareTitle: ISoftwareTitleDetails) => {
     ? softwareTitle.software_package
     : (softwareTitle.app_store_app as IAppStoreApp);
 
+  const isPackage = isSoftwarePackage(packageData);
+
   return {
-    softwarePackage: isSoftwarePackage(packageData) ? packageData : undefined,
-    name: softwareTitle.name,
+    softwarePackage: isPackage ? packageData : undefined,
+    name: (isPackage && packageData.name) || softwareTitle.name,
     version:
       (isSoftwarePackage(packageData)
         ? packageData.version
         : packageData.latest_version) || DEFAULT_EMPTY_CELL_VALUE,
     uploadedAt: isSoftwarePackage(packageData) ? packageData.uploaded_at : "",
-    status: packageData.status,
-    isSelfService: isSoftwarePackage(packageData)
-      ? packageData.self_service
-      : false,
+    status: isSoftwarePackage(packageData)
+      ? aggregateInstallStatusCounts(packageData.status)
+      : packageData.status,
+    isSelfService: packageData.self_service,
   };
 };
diff --git a/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/SoftwareTable.tests.tsx b/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/SoftwareTable.tests.tsx
new file mode 100644
index 0000000000..1c07bc5cd7
--- /dev/null
+++ b/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/SoftwareTable.tests.tsx
@@ -0,0 +1,262 @@
+import React from "react";
+import { screen } from "@testing-library/react";
+import { createCustomRenderer } from "test/test-utils";
+
+import createMockUser from "__mocks__/userMock";
+import {
+  createMockSoftwareTitlesResponse,
+  createMockSoftwareVersionsResponse,
+} from "__mocks__/softwareMock";
+import { noop } from "lodash";
+
+import SoftwareTable from "./SoftwareTable";
+
+// TODO: figure out how to mock the router properly.
+const mockRouter = {
+  push: jest.fn(),
+  replace: jest.fn(),
+  goBack: jest.fn(),
+  goForward: jest.fn(),
+  go: jest.fn(),
+  setRouteLeaveHook: jest.fn(),
+  isActive: jest.fn(),
+  createHref: jest.fn(),
+  createPath: jest.fn(),
+};
+
+describe("Software table", () => {
+  it("Renders the page-wide disabled state when software inventory is disabled", () => {
+    const render = createCustomRenderer({
+      context: {
+        app: {
+          isGlobalAdmin: true,
+          currentUser: createMockUser(),
+        },
+      },
+    });
+
+    render(
+      <SoftwareTable
+        router={mockRouter}
+        isSoftwareEnabled={false} // Set to false
+        showVersions={false}
+        data={createMockSoftwareTitlesResponse({
+          counts_updated_at: null,
+          software_titles: [],
+        })}
+        installableSoftwareExists={false}
+        query=""
+        perPage={20}
+        orderDirection="asc"
+        orderKey="hosts_count"
+        softwareFilter="allSoftware"
+        vulnFilters={{
+          vulnerable: false,
+          exploit: false,
+          minCvssScore: undefined,
+          maxCvssScore: undefined,
+        }}
+        currentPage={0}
+        teamId={1}
+        isLoading={false}
+        resetPageIndex={false}
+        onAddFiltersClick={noop}
+      />
+    );
+
+    expect(screen.getByText("Software inventory disabled")).toBeInTheDocument();
+    expect(screen.queryByText("Vulnerability")).toBeNull();
+  });
+
+  it("Renders the page-wide empty state when no software are present", () => {
+    const render = createCustomRenderer({
+      context: {
+        app: {
+          isGlobalAdmin: true,
+          currentUser: createMockUser(),
+        },
+      },
+    });
+
+    render(
+      <SoftwareTable
+        router={mockRouter}
+        isSoftwareEnabled
+        showVersions={false}
+        data={createMockSoftwareTitlesResponse({
+          count: 0,
+          counts_updated_at: null,
+          software_titles: [],
+        })}
+        installableSoftwareExists={false}
+        query=""
+        perPage={20}
+        orderDirection="asc"
+        orderKey="hosts_count"
+        softwareFilter="allSoftware"
+        vulnFilters={{
+          vulnerable: false,
+          exploit: false,
+          minCvssScore: undefined,
+          maxCvssScore: undefined,
+        }}
+        currentPage={0}
+        teamId={1}
+        isLoading={false}
+        resetPageIndex={false}
+        onAddFiltersClick={noop}
+      />
+    );
+
+    expect(screen.getByText("No software detected")).toBeInTheDocument();
+    expect(
+      screen.getByText("Expecting to see software? Check back later.")
+    ).toBeInTheDocument();
+    expect(screen.getByText("0 items")).toBeInTheDocument();
+    expect(screen.queryByText("Search")).toBeNull();
+    expect(screen.queryByText("Updated")).toBeNull();
+  });
+
+  it("Renders the page-wide empty state when search query does not exist but versions toggle is applied", () => {
+    const render = createCustomRenderer({
+      context: {
+        app: {
+          isGlobalAdmin: true,
+          currentUser: createMockUser(),
+        },
+      },
+    });
+
+    render(
+      <SoftwareTable
+        router={mockRouter}
+        isSoftwareEnabled
+        showVersions // Versions toggle applied
+        data={createMockSoftwareVersionsResponse({
+          counts_updated_at: null,
+          software: [],
+        })}
+        installableSoftwareExists={false}
+        query=""
+        perPage={20}
+        orderDirection="asc"
+        orderKey="hosts_count"
+        softwareFilter="allSoftware"
+        vulnFilters={{
+          vulnerable: false,
+          exploit: false,
+          minCvssScore: undefined,
+          maxCvssScore: undefined,
+        }}
+        currentPage={0}
+        teamId={1}
+        isLoading={false}
+        resetPageIndex={false}
+        onAddFiltersClick={noop}
+      />
+    );
+
+    expect(screen.getByText("No software detected")).toBeInTheDocument();
+    expect(
+      screen.getByText("Expecting to see software? Check back later.")
+    ).toBeInTheDocument();
+  });
+
+  it("Renders the empty search state when search query does not exist but dropdown is applied", () => {
+    const render = createCustomRenderer({
+      context: {
+        app: {
+          isGlobalAdmin: true,
+          currentUser: createMockUser(),
+        },
+      },
+    });
+
+    render(
+      <SoftwareTable
+        router={mockRouter}
+        isSoftwareEnabled
+        showVersions={false}
+        data={createMockSoftwareTitlesResponse({
+          counts_updated_at: null,
+          software_titles: [],
+        })}
+        installableSoftwareExists={false}
+        query=""
+        perPage={20}
+        orderDirection="asc"
+        orderKey="hosts_count"
+        softwareFilter="installableSoftware" // Dropdown applied
+        vulnFilters={{
+          vulnerable: false,
+          exploit: false,
+          minCvssScore: undefined,
+          maxCvssScore: undefined,
+        }}
+        currentPage={0}
+        teamId={1}
+        isLoading={false}
+        resetPageIndex={false}
+        onAddFiltersClick={noop}
+      />
+    );
+
+    expect(
+      screen.getByText("No items match the current search criteria")
+    ).toBeInTheDocument();
+    expect(
+      screen.getByText(
+        "Expecting to see installable software? Check back later."
+      )
+    ).toBeInTheDocument();
+  });
+
+  it("Renders the empty search state when search query does not exist but vulnerability filter is applied", () => {
+    const render = createCustomRenderer({
+      context: {
+        app: {
+          isGlobalAdmin: true,
+          currentUser: createMockUser(),
+        },
+      },
+    });
+
+    render(
+      <SoftwareTable
+        router={mockRouter}
+        isSoftwareEnabled
+        showVersions={false}
+        data={createMockSoftwareTitlesResponse({
+          counts_updated_at: null,
+          software_titles: [],
+        })}
+        installableSoftwareExists={false}
+        query=""
+        perPage={20}
+        orderDirection="asc"
+        orderKey="hosts_count"
+        softwareFilter="allSoftware"
+        vulnFilters={{
+          vulnerable: true,
+          exploit: false,
+          minCvssScore: undefined,
+          maxCvssScore: undefined,
+        }}
+        currentPage={0}
+        teamId={1}
+        isLoading={false}
+        resetPageIndex={false}
+        onAddFiltersClick={noop}
+      />
+    );
+
+    expect(
+      screen.getByText("No items match the current search criteria")
+    ).toBeInTheDocument();
+    expect(
+      screen.getByText(
+        "Expecting to see vulnerable software? Check back later."
+      )
+    ).toBeInTheDocument();
+  });
+});
diff --git a/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/SoftwareTable.tsx b/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/SoftwareTable.tsx
index aefe5bad64..24dd8a95e0 100644
--- a/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/SoftwareTable.tsx
+++ b/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/SoftwareTable.tsx
@@ -29,6 +29,9 @@ import CustomLink from "components/CustomLink";
 import LastUpdatedText from "components/LastUpdatedText";
 import { ITableQueryData } from "components/TableContainer/TableContainer";
 import TableCount from "components/TableContainer/TableCount";
+import Button from "components/buttons/Button";
+import Icon from "components/Icon";
+import TooltipWrapper from "components/TooltipWrapper";
 
 import EmptySoftwareTable from "pages/SoftwarePage/components/EmptySoftwareTable";
 
@@ -36,9 +39,11 @@ import generateTitlesTableConfig from "./SoftwareTitlesTableConfig";
 import generateVersionsTableConfig from "./SoftwareVersionsTableConfig";
 import {
   ISoftwareDropdownFilterVal,
+  ISoftwareVulnFiltersParams,
   SOFTWARE_TITLES_DROPDOWN_OPTIONS,
-  SOFTWARE_VERSIONS_DROPDOWN_OPTIONS,
-  getSoftwareFilterForQueryKey,
+  buildSoftwareFilterQueryParams,
+  buildSoftwareVulnFiltersQueryParams,
+  getVulnFilterRenderDetails,
 } from "./helpers";
 
 interface IRowProps extends Row {
@@ -60,16 +65,19 @@ interface ISoftwareTableProps {
   router: InjectedRouter;
   data?: ISoftwareTitlesResponse | ISoftwareVersionsResponse;
   showVersions: boolean;
+  installableSoftwareExists: boolean;
   isSoftwareEnabled: boolean;
   query: string;
   perPage: number;
   orderDirection: "asc" | "desc";
   orderKey: string;
   softwareFilter: ISoftwareDropdownFilterVal;
+  vulnFilters: ISoftwareVulnFiltersParams;
   currentPage: number;
   teamId?: number;
   isLoading: boolean;
   resetPageIndex: boolean;
+  onAddFiltersClick: () => void;
 }
 
 const baseClass = "software-table";
@@ -78,16 +86,19 @@ const SoftwareTable = ({
   router,
   data,
   showVersions,
+  installableSoftwareExists,
   isSoftwareEnabled,
   query,
   perPage,
   orderDirection,
   orderKey,
   softwareFilter,
+  vulnFilters,
   currentPage,
   teamId,
   isLoading,
   resetPageIndex,
+  onAddFiltersClick,
 }: ISoftwareTableProps) => {
   const currentPath = showVersions
     ? PATHS.SOFTWARE_VERSIONS
@@ -122,18 +133,18 @@ const SoftwareTable = ({
         order_direction: newTableQuery.sortDirection,
         order_key: newTableQuery.sortHeader,
         page: changedParam === "pageIndex" ? newTableQuery.pageIndex : 0,
+        ...buildSoftwareVulnFiltersQueryParams(vulnFilters),
       };
       if (softwareFilter === "installableSoftware") {
         newQueryParam.available_for_install = true.toString();
-      } else {
-        newQueryParam.vulnerable = (
-          softwareFilter === "vulnerableSoftware"
-        ).toString();
+      }
+      if (softwareFilter === "selfServiceSoftware") {
+        newQueryParam.self_service = true.toString();
       }
 
       return newQueryParam;
     },
-    [softwareFilter, teamId]
+    [softwareFilter, teamId, vulnFilters]
   );
 
   // NOTE: this is called once on initial render and every time the query changes
@@ -179,32 +190,33 @@ const SoftwareTable = ({
     return generateTableConfig(router, teamId);
   }, [generateTableConfig, data, router, teamId]);
 
-  // determines if a user be able to search in the table
-  const searchable =
+  // Determines if a user should be able to filter or search in the table
+  const hasData = tableData && tableData.length > 0;
+  const hasQuery = query !== "";
+  const hasSoftwareFilter = softwareFilter !== "allSoftware";
+  const hasVersionFilter = showVersions;
+  const vulnFilterDetails = getVulnFilterRenderDetails(vulnFilters);
+  const hasVulnFilters = vulnFilterDetails.filterCount > 0;
+
+  const showFilterHeaders =
     isSoftwareEnabled &&
-    ((tableData && tableData.length > 0) ||
-      query !== "" ||
-      softwareFilter !== "allSoftware");
+    (hasData ||
+      hasQuery ||
+      hasSoftwareFilter ||
+      hasVersionFilter ||
+      hasVulnFilters);
 
   const handleShowVersionsToggle = () => {
-    const queryParams: Record<string, string | number | undefined> = {
+    const queryParams: Record<string, string | number | boolean | undefined> = {
       query,
       team_id: teamId,
       order_direction: orderDirection,
       order_key: orderKey,
       page: 0, // resets page index
+      ...buildSoftwareFilterQueryParams("allSoftware"), // Reset to all software
+      ...buildSoftwareVulnFiltersQueryParams(vulnFilters),
     };
 
-    // if we are currently showing installable titles, we want to switch to
-    // all software versions. If not, we want to keep the current filter.
-    if (softwareFilter === "installableSoftware") {
-      queryParams.vulnerable = "false";
-    } else {
-      queryParams.vulnerable = (
-        softwareFilter === "vulnerableSoftware"
-      ).toString();
-    }
-
     router.replace(
       getNextLocationPath({
         pathPrefix: showVersions
@@ -225,7 +237,8 @@ const SoftwareTable = ({
       orderDirection,
       orderKey,
       page: 0, // resets page index
-      ...getSoftwareFilterForQueryKey(value),
+      ...buildSoftwareVulnFiltersQueryParams(vulnFilters),
+      ...buildSoftwareFilterQueryParams(value),
     };
 
     router.replace(
@@ -256,7 +269,7 @@ const SoftwareTable = ({
   };
 
   const renderSoftwareCount = () => {
-    if (!tableData || !data?.count) return null;
+    if (!tableData || !data) return null;
 
     return (
       <>
@@ -277,56 +290,59 @@ const SoftwareTable = ({
     );
   };
 
-  const renderCustomFilters = () => {
-    // Hide filters if no software is detected with no filters present
-    if (
-      query === "" &&
-      !showVersions &&
-      softwareFilter === "allSoftware" &&
-      data?.count === 0
-    )
-      return <></>;
-
-    const options = showVersions
-      ? SOFTWARE_VERSIONS_DROPDOWN_OPTIONS
-      : SOFTWARE_TITLES_DROPDOWN_OPTIONS;
-
+  const renderCustomControls = () => {
     return (
       <div className={`${baseClass}__filter-controls`}>
-        <div className={`${baseClass}__version-slider`}>
-          {/* div required dropdown form field width bug */}
-          <Slider
-            value={showVersions}
-            onChange={handleShowVersionsToggle}
-            inactiveText="Show versions"
-            activeText="Show versions"
+        {!showVersions && ( // Hidden when viewing versions table
+          <Dropdown
+            value={softwareFilter}
+            className={`${baseClass}__vuln_dropdown`}
+            options={SOFTWARE_TITLES_DROPDOWN_OPTIONS}
+            searchable={false}
+            onChange={handleCustomFilterDropdownChange}
+            iconName="filter"
           />
-        </div>
-        <Dropdown
-          value={softwareFilter}
-          className={`${baseClass}__vuln_dropdown`}
-          options={options}
-          searchable={false}
-          onChange={handleCustomFilterDropdownChange}
-          tableFilterDropdown
+        )}
+        <Slider
+          value={showVersions}
+          onChange={handleShowVersionsToggle}
+          inactiveText="Show versions"
+          activeText="Show versions"
         />
       </div>
     );
   };
 
-  const renderTableFooter = () => {
+  const renderCustomFiltersButton = () => {
     return (
-      <div>
-        Seeing unexpected software or vulnerabilities?{" "}
-        <CustomLink
-          url={GITHUB_NEW_ISSUE_LINK}
-          text="File an issue on GitHub"
-          newTab
-        />
-      </div>
+      <TooltipWrapper
+        className={`${baseClass}__filters`}
+        position="left"
+        underline={false}
+        showArrow
+        tipOffset={12}
+        tipContent={vulnFilterDetails.tooltipText}
+        disableTooltip={!hasVulnFilters}
+      >
+        <Button variant="text-link" onClick={onAddFiltersClick}>
+          <Icon name="filter" color="core-fleet-blue" />
+          <span>{vulnFilterDetails.buttonText}</span>
+        </Button>
+      </TooltipWrapper>
     );
   };
 
+  const renderTableHelpText = () => (
+    <div>
+      Seeing unexpected software or vulnerabilities?{" "}
+      <CustomLink
+        url={GITHUB_NEW_ISSUE_LINK}
+        text="File an issue on GitHub"
+        newTab
+      />
+    </div>
+  );
+
   return (
     <div className={baseClass}>
       <TableContainer
@@ -337,8 +353,10 @@ const SoftwareTable = ({
         emptyComponent={() => (
           <EmptySoftwareTable
             softwareFilter={softwareFilter}
+            vulnFilters={vulnFilters}
             isSoftwareDisabled={!isSoftwareEnabled}
-            isNotDetectingSoftware={query === ""}
+            noSearchQuery={query === ""}
+            installableSoftwareExists={installableSoftwareExists}
           />
         )}
         defaultSortHeader={orderKey}
@@ -350,17 +368,20 @@ const SoftwareTable = ({
         showMarkAllPages={false}
         isAllPagesSelected={false}
         disableNextPage={!data?.meta.has_next_results}
-        searchable={searchable}
-        inputPlaceHolder="Search by name or vulnerabilities (CVEs)"
+        searchable={showFilterHeaders}
+        inputPlaceHolder="Search by name or vulnerability (CVE)"
         onQueryChange={onQueryChange}
         // additionalQueries serves as a trigger for the useDeepEffect hook
         // to fire onQueryChange for events happeing outside of
         // the TableContainer.
         // additionalQueries={softwareFilter}
-        customControl={searchable ? renderCustomFilters : undefined}
+        customControl={showFilterHeaders ? renderCustomControls : undefined}
+        customFiltersButton={
+          showFilterHeaders ? renderCustomFiltersButton : undefined
+        }
         stackControls
         renderCount={renderSoftwareCount}
-        renderFooter={renderTableFooter}
+        renderTableHelpText={renderTableHelpText}
         disableMultiRowSelect
         onSelectSingleRow={handleRowSelect}
         resetPageIndex={resetPageIndex}
diff --git a/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/SoftwareTitlesTableConfig.tsx b/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/SoftwareTitlesTableConfig.tsx
index ea31ff42d4..f9758cb3ba 100644
--- a/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/SoftwareTitlesTableConfig.tsx
+++ b/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/SoftwareTitlesTableConfig.tsx
@@ -2,7 +2,11 @@ import React from "react";
 import { CellProps, Column } from "react-table";
 import { InjectedRouter } from "react-router";
 
-import { ISoftwareTitle, formatSoftwareType } from "interfaces/software";
+import {
+  ISoftwareTitle,
+  formatSoftwareType,
+  isIpadOrIphoneSoftwareSource,
+} from "interfaces/software";
 import PATHS from "router/paths";
 
 import { buildQueryStringFromParams } from "utilities/url";
@@ -72,7 +76,7 @@ const getSoftwareNameCellData = (
     isSelfService = software_package.self_service;
   } else if (app_store_app) {
     hasPackage = true;
-    isSelfService = false;
+    isSelfService = app_store_app.self_service;
     iconUrl = app_store_app.icon_url;
   }
 
@@ -145,9 +149,7 @@ const generateTableHeaders = (
       Header: "Vulnerabilities",
       disableSortBy: true,
       Cell: (cellProps: IVulnerabilitiesCellProps) => {
-        if (
-          ["ios_apps", "ipados_apps"].includes(cellProps.row.original.source)
-        ) {
+        if (isIpadOrIphoneSoftwareSource(cellProps.row.original.source)) {
           return <TextCell value="Not supported" grey />;
         }
         const vulnerabilities = getVulnerabilities(
diff --git a/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/_styles.scss b/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/_styles.scss
index 0727dfe0bd..8e413e4818 100644
--- a/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/_styles.scss
+++ b/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/_styles.scss
@@ -25,9 +25,15 @@
     gap: $pad-medium;
   }
 
-  // Fix dropdown form bug
-  &__version-slider {
-    width: 210px;
+  &__filters {
+    .component__tooltip-wrapper__element {
+      display: flex;
+      align-items: center;
+    }
+
+    .children-wrapper {
+      gap: $pad-small;
+    }
   }
 
   .table-container {
@@ -46,6 +52,9 @@
         .form-field--dropdown {
           margin: 0;
         }
+        .form-field {
+          width: initial; // Negate form-field styling on slider
+        }
       }
     }
 
@@ -61,7 +70,7 @@
         width: auto;
 
         .input-icon-field__input {
-          width: 375px;
+          width: 310px; // Any wider would run up against time ago header
         }
       }
     }
diff --git a/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/helpers.tests.ts b/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/helpers.tests.ts
new file mode 100644
index 0000000000..aed9762f45
--- /dev/null
+++ b/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/helpers.tests.ts
@@ -0,0 +1,49 @@
+import { isValidNumber } from "./helpers";
+
+describe("isValidNumber", () => {
+  // Test valid numbers
+  it("returns true for valid numbers", () => {
+    expect(isValidNumber(0)).toBe(true);
+    expect(isValidNumber(42)).toBe(true);
+    expect(isValidNumber(-10)).toBe(true);
+    expect(isValidNumber(3.14)).toBe(true);
+  });
+
+  // Test invalid inputs
+  it("returns false for non-number inputs", () => {
+    expect(isValidNumber("42")).toBe(false);
+    expect(isValidNumber(null)).toBe(false);
+    expect(isValidNumber(undefined)).toBe(false);
+    expect(isValidNumber({})).toBe(false);
+    expect(isValidNumber([])).toBe(false);
+    expect(isValidNumber(true)).toBe(false);
+  });
+
+  // Test NaN
+  it("returns false for NaN", () => {
+    expect(isValidNumber(NaN)).toBe(false);
+  });
+
+  // Test with min value
+  it("respects min value when provided", () => {
+    expect(isValidNumber(5, 0)).toBe(true);
+    expect(isValidNumber(5, 5)).toBe(true);
+    expect(isValidNumber(5, 6)).toBe(false);
+  });
+
+  // Test with max value
+  it("respects max value when provided", () => {
+    expect(isValidNumber(5, undefined, 10)).toBe(true);
+    expect(isValidNumber(5, undefined, 5)).toBe(true);
+    expect(isValidNumber(5, undefined, 4)).toBe(false);
+  });
+
+  // Test with both min and max values
+  it("respects both min and max values when provided", () => {
+    expect(isValidNumber(5, 0, 10)).toBe(true);
+    expect(isValidNumber(0, 0, 10)).toBe(true);
+    expect(isValidNumber(10, 0, 10)).toBe(true);
+    expect(isValidNumber(-1, 0, 10)).toBe(false);
+    expect(isValidNumber(11, 0, 10)).toBe(false);
+  });
+});
diff --git a/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/helpers.ts b/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/helpers.ts
index 5cdc0fcde9..b4dacf1c7d 100644
--- a/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/helpers.ts
+++ b/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/helpers.ts
@@ -1,29 +1,23 @@
-import { QueryParams } from "utilities/url";
+import { QueryParams, parseQueryValueToNumberOrUndefined } from "utilities/url";
+import stringUtils from "utilities/strings/stringUtils";
+import { tooltipTextWithLineBreaks } from "utilities/helpers";
 
 export type ISoftwareDropdownFilterVal =
   | "allSoftware"
-  | "vulnerableSoftware"
   | "installableSoftware"
   | "selfServiceSoftware";
 
-export const SOFTWARE_VERSIONS_DROPDOWN_OPTIONS = [
+export type IHostSoftwareDropdownFilterVal =
+  | ISoftwareDropdownFilterVal
+  | "vulnerableSoftware";
+
+export const SOFTWARE_TITLES_DROPDOWN_OPTIONS = [
   {
     disabled: false,
     label: "All software",
     value: "allSoftware",
     helpText: "All software installed on your hosts.",
   },
-  {
-    disabled: false,
-    label: "Vulnerable software",
-    value: "vulnerableSoftware",
-    helpText:
-      "All software installed on your hosts with detected vulnerabilities.",
-  },
-];
-
-export const SOFTWARE_TITLES_DROPDOWN_OPTIONS = [
-  ...SOFTWARE_VERSIONS_DROPDOWN_OPTIONS,
   {
     disabled: false,
     label: "Available for install",
@@ -38,7 +32,50 @@ export const SOFTWARE_TITLES_DROPDOWN_OPTIONS = [
   },
 ];
 
-export const getSoftwareFilterForQueryKey = (
+export const SEVERITY_DROPDOWN_OPTIONS = [
+  {
+    disabled: false,
+    label: "Any severity",
+    value: "any",
+    helpText: "CVSS score 0-10",
+    minSeverity: undefined,
+    maxSeverity: undefined,
+  },
+  {
+    disabled: false,
+    label: "Low severity",
+    value: "low",
+    helpText: "CVSS score 0.1-3.9",
+    minSeverity: 0.1,
+    maxSeverity: 3.9,
+  },
+  {
+    disabled: false,
+    label: "Medium severity",
+    value: "medium",
+    helpText: "CVSS score 4.0-6.9",
+    minSeverity: 4.0,
+    maxSeverity: 6.9,
+  },
+  {
+    disabled: false,
+    label: "High severity",
+    value: "high",
+    helpText: "CVSS score 7.0-8.9",
+    minSeverity: 7.0,
+    maxSeverity: 8.9,
+  },
+  {
+    disabled: false,
+    label: "Critical severity",
+    value: "critical",
+    helpText: "CVSS score 9.0-10",
+    minSeverity: 9.0,
+    maxSeverity: 10,
+  },
+];
+
+export const buildSoftwareFilterQueryParams = (
   val: ISoftwareDropdownFilterVal
 ) => {
   switch (val) {
@@ -46,23 +83,142 @@ export const getSoftwareFilterForQueryKey = (
       return { availableForInstall: true };
     case "selfServiceSoftware":
       return { selfService: true };
-    case "vulnerableSoftware":
-      return { vulnerable: true };
     default:
       return {};
   }
 };
 
 export const getSoftwareFilterFromQueryParams = (queryParams: QueryParams) => {
-  const { vulnerable, available_for_install, self_service } = queryParams;
+  const { available_for_install, self_service } = queryParams;
   switch (true) {
     case available_for_install === "true":
       return "installableSoftware";
     case self_service === "true":
       return "selfServiceSoftware";
-    case vulnerable === "true":
-      return "vulnerableSoftware";
     default:
       return "allSoftware";
   }
 };
+
+export const getSoftwareVulnFiltersFromQueryParams = (
+  queryParams: QueryParams
+) => {
+  const { vulnerable, exploit, min_cvss_score, max_cvss_score } = queryParams;
+
+  return {
+    vulnerable: stringUtils.strToBool(vulnerable as string),
+    exploit: stringUtils.strToBool(exploit as string),
+    minCvssScore: parseQueryValueToNumberOrUndefined(min_cvss_score, 0, 10),
+    maxCvssScore: parseQueryValueToNumberOrUndefined(max_cvss_score, 0, 10),
+  };
+};
+
+export type ISoftwareVulnFilters = {
+  vulnerable?: boolean;
+  exploit?: boolean;
+  min_cvss_score?: number;
+  max_cvss_score?: number;
+};
+
+export type ISoftwareVulnFiltersParams = {
+  vulnerable?: boolean;
+  exploit?: boolean;
+  minCvssScore?: number;
+  maxCvssScore?: number;
+};
+
+export const isValidNumber = (
+  value: any,
+  min?: number,
+  max?: number
+): value is number => {
+  // Check if the value is a number and not NaN
+  const isNumber = typeof value === "number" && !isNaN(value);
+
+  // If min or max is provided, check if the number is within the range
+  const withinRange =
+    (min === undefined || value >= min) && (max === undefined || value <= max);
+
+  return isNumber && withinRange;
+};
+
+export const buildSoftwareVulnFiltersQueryParams = (
+  vulnFilters: ISoftwareVulnFiltersParams
+) => {
+  const { vulnerable, exploit, minCvssScore, maxCvssScore } = vulnFilters;
+
+  if (!vulnerable) {
+    return {};
+  }
+
+  return {
+    vulnerable: true,
+    ...(exploit && { exploit: true }),
+    ...(isValidNumber(minCvssScore, 0, maxCvssScore || 10) && {
+      min_cvss_score: minCvssScore.toString(),
+    }),
+    ...(isValidNumber(maxCvssScore, minCvssScore || 0, 10) && {
+      max_cvss_score: maxCvssScore.toString(),
+    }),
+  };
+};
+
+export const findOptionBySeverityRange = (
+  minSeverityValue: number | undefined,
+  maxSeverityValue: number | undefined
+) => {
+  const severityOption = SEVERITY_DROPDOWN_OPTIONS.find(
+    (option) =>
+      option.minSeverity === minSeverityValue &&
+      option.maxSeverity === maxSeverityValue
+  ) || {
+    disabled: true,
+    label: "Custom severity",
+    value: "custom",
+    helpText: `CVSS score ${minSeverityValue || 0}-${maxSeverityValue || 10}`,
+    minSeverity: minSeverityValue || 0,
+    maxSeverity: maxSeverityValue || 10,
+  };
+
+  return severityOption;
+};
+
+export const getVulnFilterRenderDetails = (
+  vulnFilters?: ISoftwareVulnFiltersParams
+) => {
+  let filterCount = 0;
+  const tooltipText = [];
+
+  if (vulnFilters) {
+    if (vulnFilters.vulnerable) {
+      filterCount += 1;
+      tooltipText.push("Vulnerable software");
+
+      if (vulnFilters.minCvssScore || vulnFilters.maxCvssScore) {
+        filterCount += 1;
+        const severityOption = findOptionBySeverityRange(
+          vulnFilters.minCvssScore,
+          vulnFilters.maxCvssScore
+        );
+        const severityText = stringUtils.capitalize(severityOption?.value);
+        tooltipText.push(`Severity: ${severityText}`);
+      }
+
+      if (vulnFilters.exploit) {
+        filterCount += 1;
+        tooltipText.push("Has known exploit");
+      }
+    }
+  }
+
+  const buttonText =
+    filterCount > 0
+      ? `${filterCount} filter${filterCount > 1 ? "s" : ""}`
+      : "Add filters";
+
+  return {
+    filterCount,
+    buttonText,
+    tooltipText: tooltipTextWithLineBreaks(tooltipText),
+  };
+};
diff --git a/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTitles.tsx b/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTitles.tsx
index 1a90c284f5..4d28342bcb 100644
--- a/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTitles.tsx
+++ b/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTitles.tsx
@@ -21,7 +21,8 @@ import TableDataError from "components/DataError";
 import SoftwareTable from "./SoftwareTable";
 import {
   ISoftwareDropdownFilterVal,
-  getSoftwareFilterForQueryKey,
+  ISoftwareVulnFilters,
+  buildSoftwareFilterQueryParams,
 } from "./SoftwareTable/helpers";
 
 const baseClass = "software-titles";
@@ -40,9 +41,12 @@ interface ISoftwareTitlesProps {
   orderDirection: "asc" | "desc";
   orderKey: string;
   softwareFilter: ISoftwareDropdownFilterVal;
+  vulnFilters: ISoftwareVulnFilters;
   currentPage: number;
   teamId?: number;
   resetPageIndex: boolean;
+  addedSoftwareToken: string | null;
+  onAddFiltersClick: () => void;
 }
 
 const SoftwareTitles = ({
@@ -53,13 +57,16 @@ const SoftwareTitles = ({
   orderDirection,
   orderKey,
   softwareFilter,
+  vulnFilters,
   currentPage,
   teamId,
   resetPageIndex,
+  addedSoftwareToken,
+  onAddFiltersClick,
 }: ISoftwareTitlesProps) => {
   const showVersions = location.pathname === PATHS.SOFTWARE_VERSIONS;
 
-  // request to get software data
+  // for Titles view, request to get software data
   const {
     data: titlesData,
     isFetching: isTitlesFetching,
@@ -80,7 +87,9 @@ const SoftwareTitles = ({
         orderDirection,
         orderKey,
         teamId,
-        ...getSoftwareFilterForQueryKey(softwareFilter),
+        addedSoftwareToken,
+        ...vulnFilters,
+        ...buildSoftwareFilterQueryParams(softwareFilter),
       },
     ],
     ({ queryKey: [queryKey] }) =>
@@ -91,7 +100,9 @@ const SoftwareTitles = ({
     }
   );
 
-  // request to get software versions data
+  // For Versions view, request software versions data. If empty, request titles available for
+  // install to determine empty state copy
+
   const {
     data: versionsData,
     isFetching: isVersionsFetching,
@@ -112,7 +123,8 @@ const SoftwareTitles = ({
         orderDirection,
         orderKey,
         teamId,
-        vulnerable: softwareFilter === "vulnerableSoftware",
+        addedSoftwareToken,
+        ...vulnFilters,
       },
     ],
     ({ queryKey: [queryKey] }) =>
@@ -123,11 +135,46 @@ const SoftwareTitles = ({
     }
   );
 
-  if (isTitlesLoading || isVersionsLoading) {
+  const {
+    data: titlesAvailableForInstallResponse,
+    isFetching: isTitlesAFIFetching,
+    isLoading: isTitlesAFILoading,
+    isError: isTitlesAFIError,
+  } = useQuery<
+    ISoftwareTitlesResponse,
+    Error,
+    ISoftwareTitlesResponse,
+    [ISoftwareTitlesQueryKey]
+  >(
+    [
+      {
+        scope: "software-titles",
+        page: 0,
+        perPage,
+        query: "",
+        orderDirection,
+        orderKey,
+        teamId,
+        availableForInstall: true,
+        ...vulnFilters,
+      },
+    ],
+    ({ queryKey: [queryKey] }) =>
+      softwareAPI.getSoftwareTitles(omit(queryKey, "scope")),
+    {
+      ...QUERY_OPTIONS,
+      enabled:
+        location.pathname === PATHS.SOFTWARE_VERSIONS &&
+        versionsData &&
+        versionsData.count === 0,
+    }
+  );
+
+  if (isTitlesLoading || isVersionsLoading || isTitlesAFILoading) {
     return <Spinner />;
   }
 
-  if (isTitlesError || isVersionsError) {
+  if (isTitlesError || isVersionsError || isTitlesAFIError) {
     return <TableDataError className={`${baseClass}__table-error`} />;
   }
 
@@ -137,6 +184,7 @@ const SoftwareTitles = ({
         router={router}
         data={showVersions ? versionsData : titlesData}
         showVersions={showVersions}
+        installableSoftwareExists={!!titlesAvailableForInstallResponse?.count}
         isSoftwareEnabled={isSoftwareEnabled}
         query={query}
         perPage={perPage}
@@ -145,8 +193,12 @@ const SoftwareTitles = ({
         softwareFilter={softwareFilter}
         currentPage={currentPage}
         teamId={teamId}
-        isLoading={isTitlesFetching || isVersionsFetching}
+        isLoading={
+          isTitlesFetching || isVersionsFetching || isTitlesAFIFetching
+        }
         resetPageIndex={resetPageIndex}
+        onAddFiltersClick={onAddFiltersClick}
+        vulnFilters={vulnFilters}
       />
     </div>
   );
diff --git a/frontend/pages/SoftwarePage/SoftwareVersionDetailsPage/SoftwareVersionDetailsPage.tsx b/frontend/pages/SoftwarePage/SoftwareVersionDetailsPage/SoftwareVersionDetailsPage.tsx
index 828c3d5011..afb9d0ec47 100644
--- a/frontend/pages/SoftwarePage/SoftwareVersionDetailsPage/SoftwareVersionDetailsPage.tsx
+++ b/frontend/pages/SoftwarePage/SoftwareVersionDetailsPage/SoftwareVersionDetailsPage.tsx
@@ -18,7 +18,11 @@ import hostsCountAPI, {
   IHostsCountQueryKey,
   IHostsCountResponse,
 } from "services/entities/host_count";
-import { ISoftwareVersion, formatSoftwareType } from "interfaces/software";
+import {
+  ISoftwareVersion,
+  formatSoftwareType,
+  isIpadOrIphoneSoftwareSource,
+} from "interfaces/software";
 import { ignoreAxiosError } from "interfaces/errors";
 
 import { DEFAULT_USE_QUERY_OPTIONS } from "utilities/constants";
@@ -114,7 +118,7 @@ const SoftwareVersionDetailsPage = ({
   );
 
   const renderVulnTable = (swVersion: ISoftwareVersion) => {
-    if (["ios_apps", "ipados_apps"].includes(swVersion.source)) {
+    if (isIpadOrIphoneSoftwareSource(swVersion.source)) {
       const platformText = swVersion.source === "ios_apps" ? "iOS" : "iPadOS";
       return <VulnsNotSupported platformText={platformText} />;
     }
diff --git a/frontend/pages/SoftwarePage/SoftwareVulnerabilities/SoftwareVulnerabilities.tsx b/frontend/pages/SoftwarePage/SoftwareVulnerabilities/SoftwareVulnerabilities.tsx
index 845275db5b..3c7bdd5663 100644
--- a/frontend/pages/SoftwarePage/SoftwareVulnerabilities/SoftwareVulnerabilities.tsx
+++ b/frontend/pages/SoftwarePage/SoftwareVulnerabilities/SoftwareVulnerabilities.tsx
@@ -1,18 +1,27 @@
 /** software/vulnerabilities Vulnerabilities tab */
 
-import React from "react";
+import React, { useState, useEffect } from "react";
 import { useQuery } from "react-query";
 import { InjectedRouter } from "react-router";
-import {
+import { AxiosError } from "axios";
+import softwareVulnAPI, {
   IGetVulnerabilitiesQueryKey,
   IVulnerabilitiesResponse,
+  IGetVulnerabilityQueryKey,
+  IVulnerabilityResponse,
   getVulnerabilities,
+  IVulnerabilitiesEmptyStateReason,
 } from "services/entities/vulnerabilities";
+import { IApiError } from "interfaces/errors";
+
+import { DEFAULT_USE_QUERY_OPTIONS } from "utilities/constants";
+import { stripQuotes } from "utilities/strings/stringUtils";
 
 import TableDataError from "components/DataError";
 import Spinner from "components/Spinner";
 
 import SoftwareVulnerabilitiesTable from "./SoftwareVulnerabilitiesTable";
+import { isValidCVEFormat } from "./SoftwareVulnerabilitiesTable/helpers";
 
 const baseClass = "software-vulnerabilities";
 
@@ -41,6 +50,12 @@ const SoftwareVulnerabilities = ({
   showExploitedVulnerabilitiesOnly,
   resetPageIndex,
 }: ISoftwareVulnerabilitiesProps) => {
+  const [tableData, setTableData] = useState<IVulnerabilitiesResponse>();
+  const [
+    emptyStateReason,
+    setEmptyStateReason,
+  ] = useState<IVulnerabilitiesEmptyStateReason>();
+
   const queryParams = {
     page: currentPage,
     per_page: perPage,
@@ -51,7 +66,15 @@ const SoftwareVulnerabilities = ({
     exploit: showExploitedVulnerabilitiesOnly,
   };
 
-  const { data, isFetching, isLoading, isError } = useQuery<
+  const isExactMatchQuery = (() => {
+    if (query) {
+      const pattern = /^(['"]).*\1$/;
+      return pattern.test(query);
+    }
+    return false;
+  })();
+
+  const { isFetching, isLoading, isError } = useQuery<
     IVulnerabilitiesResponse,
     Error,
     IVulnerabilitiesResponse,
@@ -66,11 +89,156 @@ const SoftwareVulnerabilities = ({
     () => getVulnerabilities(queryParams),
     {
       keepPreviousData: true,
-      staleTime: 30000,
+      enabled: !isExactMatchQuery && isSoftwareEnabled,
+      onSuccess: (data) => {
+        setTableData(data);
+        if (data.count === 0) {
+          if (
+            queryParams.exploit ||
+            (queryParams.query && queryParams.query.length > 0)
+          ) {
+            setEmptyStateReason("no-matching-items");
+          } else {
+            setEmptyStateReason("no-vulns-detected");
+          }
+        }
+      },
     }
   );
 
-  if (isLoading) {
+  // Calling software/vulnerabilities/:CVE endpoint when user searches with quotation marks
+  const {
+    isLoading: isLoadingExactMatch,
+    isFetching: isFetchingExactMatch,
+    refetch: refetchExactMatch,
+  } = useQuery<
+    IVulnerabilityResponse | null,
+    AxiosError<IApiError>,
+    IVulnerabilityResponse,
+    IGetVulnerabilityQueryKey[]
+  >(
+    [
+      {
+        scope: "softwareVulnByCVE",
+        vulnerability: (query && stripQuotes(query)) || "",
+        teamId,
+      },
+    ],
+    ({ queryKey }) => {
+      // Revisit: Refactor to return status alongside data and check for 204 instead of !data
+      return softwareVulnAPI.getVulnerability(queryKey[0]);
+    },
+    {
+      ...DEFAULT_USE_QUERY_OPTIONS,
+      retry: false,
+      onSuccess: (data) => {
+        // Handle 204 response which doesn't return data if it is a known CVE but doesn't exist in response
+        if (!data) {
+          setTableData({
+            count: 0,
+            counts_updated_at: "",
+            vulnerabilities: [],
+            meta: {
+              has_next_results: false,
+              has_previous_results: false,
+            },
+          });
+          setEmptyStateReason("known-vuln");
+        }
+        // If filtering for exploited vulns, hide vulnerability if cisa_known_exploit is false
+        else if (
+          queryParams.exploit &&
+          !data.vulnerability.cisa_known_exploit
+        ) {
+          setTableData({
+            count: 0,
+            counts_updated_at: "",
+            vulnerabilities: [],
+            meta: {
+              has_next_results: false,
+              has_previous_results: false,
+            },
+          });
+          setEmptyStateReason("no-matching-items");
+          // Otherwise return IVulnerabilityResponse as IVulnerabilitiesResponse format
+        } else {
+          setTableData({
+            count: 1,
+            counts_updated_at: data.vulnerability.hosts_count_updated_at,
+            vulnerabilities: [data.vulnerability],
+            meta: {
+              has_next_results: false,
+              has_previous_results: false,
+            },
+          });
+        }
+      },
+      onError: (err) => {
+        // Type assertion for failing "Property 'data' does not exist on type 'AxiosError<IApiError, any>"
+        const error = err as AxiosError<IApiError> & {
+          data?: IApiError;
+        };
+
+        // Handle 400 response which is an invalid CVE format
+        if (error.status === 400) {
+          if (
+            error?.data?.errors &&
+            error.data.errors[0].reason.includes(
+              "That vulnerability (CVE) is not valid."
+            )
+          ) {
+            setTableData({
+              count: 0,
+              counts_updated_at: "",
+              vulnerabilities: [],
+              meta: {
+                has_next_results: false,
+                has_previous_results: false,
+              },
+            });
+            setEmptyStateReason("invalid-cve");
+          }
+
+          // Handle 404 response which is BE validated CVE string but not a known CVE
+        } else if (error.status === 404) {
+          if (
+            error?.data?.errors &&
+            (error.data.errors[0].reason.includes("This is not a known CVE.") ||
+              error.data.errors[0].reason.includes(
+                "was not found in the datastore"
+              ))
+          ) {
+            // FE validatation for CVE string
+            if (query && !isValidCVEFormat(stripQuotes(query))) {
+              setEmptyStateReason("invalid-cve");
+            } else {
+              setEmptyStateReason("unknown-cve");
+            }
+          }
+          setTableData({
+            count: 0,
+            counts_updated_at: "",
+            vulnerabilities: [],
+            meta: {
+              has_next_results: false,
+              has_previous_results: false,
+            },
+          });
+        }
+      },
+      enabled: isExactMatchQuery && isSoftwareEnabled,
+    }
+  );
+
+  // If a user toggles between exact exploit and non-exploit,
+  // we need the table data to recheck cisa_known_exploit and populate accordingly
+  useEffect(() => {
+    if (isExactMatchQuery) {
+      refetchExactMatch();
+    }
+  }, [queryParams.exploit, isExactMatchQuery]);
+
+  if (isLoading || isLoadingExactMatch) {
     return <Spinner />;
   }
 
@@ -82,7 +250,8 @@ const SoftwareVulnerabilities = ({
     <div className={baseClass}>
       <SoftwareVulnerabilitiesTable
         router={router}
-        data={data}
+        data={tableData}
+        emptyStateReason={emptyStateReason}
         query={query}
         showExploitedVulnerabilitiesOnly={showExploitedVulnerabilitiesOnly}
         isSoftwareEnabled={isSoftwareEnabled}
@@ -91,7 +260,7 @@ const SoftwareVulnerabilities = ({
         orderKey={orderKey}
         currentPage={currentPage}
         teamId={teamId}
-        isLoading={isFetching}
+        isLoading={isFetching || isFetchingExactMatch}
         resetPageIndex={resetPageIndex}
       />
     </div>
diff --git a/frontend/pages/SoftwarePage/SoftwareVulnerabilities/SoftwareVulnerabilitiesTable/SoftwareVulnerabilitiesTable.tests.tsx b/frontend/pages/SoftwarePage/SoftwareVulnerabilities/SoftwareVulnerabilitiesTable/SoftwareVulnerabilitiesTable.tests.tsx
index 0ec5fcd96b..2e869892d1 100644
--- a/frontend/pages/SoftwarePage/SoftwareVulnerabilities/SoftwareVulnerabilitiesTable/SoftwareVulnerabilitiesTable.tests.tsx
+++ b/frontend/pages/SoftwarePage/SoftwareVulnerabilities/SoftwareVulnerabilitiesTable/SoftwareVulnerabilitiesTable.tests.tsx
@@ -1,9 +1,11 @@
 import React from "react";
 import { screen, waitFor } from "@testing-library/react";
-import { noop } from "lodash";
 import { createCustomRenderer } from "test/test-utils";
 
-import { createMockVulnerabilitiesResponse } from "__mocks__/vulnerabilitiesMock";
+import {
+  createMockVulnerabilitiesResponse,
+  createMockVulnerability,
+} from "__mocks__/vulnerabilitiesMock";
 import createMockUser from "__mocks__/userMock";
 
 import SoftwareVulnerabilitiesTable from "./SoftwareVulnerabilitiesTable";
@@ -22,7 +24,7 @@ const mockRouter = {
 };
 
 describe("Software Vulnerabilities table", () => {
-  it("Renders the page-wide disabled state when software inventory is disabled", async () => {
+  it("Renders the page-wide disabled state when software inventory is disabled", () => {
     const render = createCustomRenderer({
       context: {
         app: {
@@ -60,7 +62,49 @@ describe("Software Vulnerabilities table", () => {
   });
 
   // TODO: Reinstate collecting software view
-  it("Renders the page-wide empty state when no software vulnerabilities are present", async () => {
+  it("Renders the page-wide empty state when no software vulnerabilities are present", () => {
+    const render = createCustomRenderer({
+      context: {
+        app: {
+          isGlobalAdmin: true,
+          currentUser: createMockUser(),
+        },
+      },
+    });
+
+    render(
+      <SoftwareVulnerabilitiesTable
+        router={mockRouter}
+        isSoftwareEnabled
+        data={createMockVulnerabilitiesResponse({
+          count: 0,
+          vulnerabilities: null,
+          meta: {
+            has_next_results: false,
+            has_previous_results: false,
+          },
+        })}
+        emptyStateReason="no-vulns-detected"
+        query=""
+        perPage={20}
+        orderDirection="asc"
+        orderKey="hosts_count"
+        showExploitedVulnerabilitiesOnly={false}
+        currentPage={0}
+        isLoading={false}
+        resetPageIndex={false}
+      />
+    );
+
+    expect(screen.getByText("No vulnerabilities detected")).toBeInTheDocument();
+    expect(screen.getByText("0 items")).toBeInTheDocument();
+    expect(
+      screen.getByText("Expecting to see vulnerabilities? Check back later.")
+    ).toBeInTheDocument();
+    expect(screen.queryByText("Vulnerability")).toBeNull();
+  });
+
+  it("Renders the empty search state when search query does not exist but exploited vulnerabilities dropdown is applied", () => {
     const render = createCustomRenderer({
       context: {
         app: {
@@ -86,18 +130,23 @@ describe("Software Vulnerabilities table", () => {
         perPage={20}
         orderDirection="asc"
         orderKey="hosts_count"
-        showExploitedVulnerabilitiesOnly={false}
+        showExploitedVulnerabilitiesOnly
         currentPage={0}
         isLoading={false}
         resetPageIndex={false}
       />
     );
 
-    expect(screen.getByText("No software detected")).toBeInTheDocument();
+    expect(
+      screen.getByText("No items match the current search criteria")
+    ).toBeInTheDocument();
+    expect(
+      screen.getByText("Expecting to see vulnerabilities? Check back later.")
+    ).toBeInTheDocument();
     expect(screen.queryByText("Vulnerability")).toBeNull();
   });
 
-  it("Renders the empty search state when search query exists for server side search with no results", async () => {
+  it("Renders the invalid CVE empty search state when search query wrapped in quotes is invalid with no results", () => {
     const render = createCustomRenderer({
       context: {
         app: {
@@ -119,7 +168,8 @@ describe("Software Vulnerabilities table", () => {
             has_previous_results: false,
           },
         })}
-        query="abcdefg"
+        emptyStateReason="invalid-cve"
+        query='"abcdefg"'
         perPage={20}
         orderDirection="asc"
         orderKey="hosts_count"
@@ -131,12 +181,103 @@ describe("Software Vulnerabilities table", () => {
     );
 
     expect(
-      screen.getByText("No items match the current search criteria")
+      screen.getByText("That vulnerability (CVE) is not valid")
+    ).toBeInTheDocument();
+    expect(
+      screen.getByText(/Try updating your search to use CVE format:/i)
     ).toBeInTheDocument();
     expect(screen.queryByText("Vulnerability")).toBeNull();
   });
 
-  it("Renders premium columns", async () => {
+  it("Renders the valid known CVE empty search state when search query wrapped in quotes is valid known CVE with no results", () => {
+    const render = createCustomRenderer({
+      context: {
+        app: {
+          isGlobalAdmin: true,
+          currentUser: createMockUser(),
+        },
+      },
+    });
+
+    render(
+      <SoftwareVulnerabilitiesTable
+        router={mockRouter}
+        isSoftwareEnabled
+        data={createMockVulnerabilitiesResponse({
+          count: 0,
+          vulnerabilities: null,
+          meta: {
+            has_next_results: false,
+            has_previous_results: false,
+          },
+        })}
+        emptyStateReason="known-vuln"
+        query='"cve-2002-1000"'
+        perPage={20}
+        orderDirection="asc"
+        orderKey="hosts_count"
+        showExploitedVulnerabilitiesOnly={false}
+        currentPage={0}
+        isLoading={false}
+        resetPageIndex={false}
+      />
+    );
+
+    expect(
+      screen.getByText(
+        "This is a known vulnerability (CVE), but it wasn't detected on any hosts"
+      )
+    ).toBeInTheDocument();
+    expect(
+      screen.getByText("Expecting to see vulnerabilities? Check back later.")
+    ).toBeInTheDocument();
+    expect(screen.queryByText("Vulnerability")).toBeNull();
+  });
+
+  it("Renders the valid unknown CVE empty search state when search query wrapped in quotes is not a valid known CVE with no results", () => {
+    const render = createCustomRenderer({
+      context: {
+        app: {
+          isGlobalAdmin: true,
+          currentUser: createMockUser(),
+        },
+      },
+    });
+
+    render(
+      <SoftwareVulnerabilitiesTable
+        router={mockRouter}
+        isSoftwareEnabled
+        data={createMockVulnerabilitiesResponse({
+          count: 0,
+          vulnerabilities: null,
+          meta: {
+            has_next_results: false,
+            has_previous_results: false,
+          },
+        })}
+        emptyStateReason="unknown-cve"
+        query="cve-2002-12345"
+        perPage={20}
+        orderDirection="asc"
+        orderKey="hosts_count"
+        showExploitedVulnerabilitiesOnly={false}
+        currentPage={0}
+        isLoading={false}
+        resetPageIndex={false}
+      />
+    );
+
+    expect(screen.getByText("This is not a known CVE")).toBeInTheDocument();
+    expect(
+      screen.getByText(
+        "None of Fleet's vulnerability sources are aware of this CVE."
+      )
+    ).toBeInTheDocument();
+    expect(screen.queryByText("Vulnerability")).toBeNull();
+  });
+
+  it("Renders premium columns", () => {
     const render = createCustomRenderer({
       context: {
         app: {
@@ -152,7 +293,7 @@ describe("Software Vulnerabilities table", () => {
         router={mockRouter}
         isSoftwareEnabled
         data={createMockVulnerabilitiesResponse()}
-        query=""
+        query="CVE-2018-16463"
         perPage={20}
         orderDirection="asc"
         orderKey="hosts_count"
diff --git a/frontend/pages/SoftwarePage/SoftwareVulnerabilities/SoftwareVulnerabilitiesTable/SoftwareVulnerabilitiesTable.tsx b/frontend/pages/SoftwarePage/SoftwareVulnerabilities/SoftwareVulnerabilitiesTable/SoftwareVulnerabilitiesTable.tsx
index 1152c13376..b7c49b4b47 100644
--- a/frontend/pages/SoftwarePage/SoftwareVulnerabilities/SoftwareVulnerabilitiesTable/SoftwareVulnerabilitiesTable.tsx
+++ b/frontend/pages/SoftwarePage/SoftwareVulnerabilities/SoftwareVulnerabilitiesTable/SoftwareVulnerabilitiesTable.tsx
@@ -7,7 +7,11 @@ import { Row } from "react-table";
 import PATHS from "router/paths";
 
 import { AppContext } from "context/app";
-import { GITHUB_NEW_ISSUE_LINK } from "utilities/constants";
+import {
+  GITHUB_NEW_ISSUE_LINK,
+  VULNERABILITIES_SEARCH_BOX_TOOLTIP,
+} from "utilities/constants";
+import { isIncompleteQuoteQuery } from "utilities/strings/stringUtils";
 
 // @ts-ignore
 import Dropdown from "components/forms/fields/Dropdown";
@@ -17,12 +21,17 @@ import LastUpdatedText from "components/LastUpdatedText";
 import { ITableQueryData } from "components/TableContainer/TableContainer";
 import TableCount from "components/TableContainer/TableCount";
 
-import EmptySoftwareTable from "pages/SoftwarePage/components/EmptySoftwareTable";
-import { IVulnerabilitiesResponse } from "services/entities/vulnerabilities";
+import EmptyVulnerabilitiesTable from "pages/SoftwarePage/components/EmptyVulnerabilitiesTable";
+
+import {
+  IVulnerabilitiesResponse,
+  IVulnerabilitiesEmptyStateReason,
+} from "services/entities/vulnerabilities";
 import { buildQueryStringFromParams } from "utilities/url";
 import { getNextLocationPath } from "utilities/helpers";
 
 import generateTableConfig from "./VulnerabilitiesTableConfig";
+import { getExploitedVulnerabilitiesDropdownOptions } from "./helpers";
 
 const baseClass = "software-vulnerabilities-table";
 
@@ -36,6 +45,7 @@ interface ISoftwareVulnerabilitiesTableProps {
   router: InjectedRouter;
   isSoftwareEnabled: boolean;
   data?: IVulnerabilitiesResponse;
+  emptyStateReason?: IVulnerabilitiesEmptyStateReason;
   query?: string;
   perPage: number;
   orderDirection: "asc" | "desc";
@@ -51,6 +61,7 @@ const SoftwareVulnerabilitiesTable = ({
   router,
   isSoftwareEnabled,
   data,
+  emptyStateReason,
   query,
   perPage,
   orderDirection,
@@ -108,6 +119,11 @@ const SoftwareVulnerabilitiesTable = ({
 
   const onQueryChange = useCallback(
     (newTableQuery: ITableQueryData) => {
+      // We don't want to start searching until a user completes their quote query
+      if (isIncompleteQuoteQuery(newTableQuery.searchQuery)) {
+        return;
+      }
+
       // we want to determine which query param has changed in order to
       // reset the page index to 0 if any other param has changed.
       const changedParam = determineQueryParamChange(newTableQuery);
@@ -181,11 +197,13 @@ const SoftwareVulnerabilitiesTable = ({
   };
 
   const renderVulnerabilityCount = () => {
-    if (!data?.vulnerabilities || !data?.count) return null;
+    if (!data) return null;
+
+    const count = data?.count;
 
     return (
       <>
-        <TableCount name="items" count={data?.count} />
+        <TableCount name="items" count={count} />
         {data?.vulnerabilities && data?.counts_updated_at && (
           <LastUpdatedText
             lastUpdatedAt={data.counts_updated_at}
@@ -202,7 +220,7 @@ const SoftwareVulnerabilitiesTable = ({
     );
   };
 
-  const renderTableFooter = () => {
+  const renderTableHelpText = () => {
     return (
       <div>
         Seeing unexpected software or vulnerabilities?{" "}
@@ -215,37 +233,16 @@ const SoftwareVulnerabilitiesTable = ({
     );
   };
 
-  const getExploitedVulnerabiltiesDropdownOptions = () => {
-    const disabledTooltipContent = "Available in Fleet Premium.";
-
-    return [
-      {
-        disabled: false,
-        label: "All vulnerabilities",
-        value: false,
-        helpText: "All vulnerabilities detected on your hosts.",
-      },
-      {
-        disabled: !isPremiumTier,
-        label: "Exploited vulnerabilities",
-        value: true,
-        helpText:
-          "Vulnerabilities that have been actively exploited in the wild.",
-        tooltipContent: !isPremiumTier && disabledTooltipContent,
-      },
-    ];
-  };
-
   // Exploited vulnerabilities is a premium feature
   const renderExploitedVulnerabilitiesDropdown = () => {
     return (
       <Dropdown
         value={showExploitedVulnerabilitiesOnly}
         className={`${baseClass}__exploited-vulnerabilities-dropdown`}
-        options={getExploitedVulnerabiltiesDropdownOptions()}
+        options={getExploitedVulnerabilitiesDropdownOptions(isPremiumTier)}
         searchable={false}
         onChange={handleExploitedVulnFilterDropdownChange}
-        tableFilterDropdown
+        iconName="filter"
       />
     );
   };
@@ -254,16 +251,19 @@ const SoftwareVulnerabilitiesTable = ({
     <div className={baseClass}>
       <TableContainer
         columnConfigs={vulnerabilitiesTableHeaders}
-        data={data?.vulnerabilities ?? []}
+        data={data?.vulnerabilities || []}
         isLoading={isLoading}
         resultsTitle={"items"}
         emptyComponent={() => (
-          <EmptySoftwareTable
-            tableName="vulnerabilities"
+          <EmptyVulnerabilitiesTable
+            isPremiumTier={isPremiumTier}
+            teamId={teamId}
+            exploitedFilter={showExploitedVulnerabilitiesOnly}
             isSoftwareDisabled={!isSoftwareEnabled}
-            isNotDetectingSoftware={query === ""}
+            emptyStateReason={emptyStateReason}
           />
         )}
+        defaultSearchQuery={query}
         defaultSortHeader={orderKey}
         defaultSortDirection={orderDirection}
         defaultPageIndex={currentPage}
@@ -275,12 +275,13 @@ const SoftwareVulnerabilitiesTable = ({
         searchable={searchable}
         searchQueryColumn="vulnerability"
         inputPlaceHolder="Search by CVE"
+        searchToolTipText={VULNERABILITIES_SEARCH_BOX_TOOLTIP}
         onQueryChange={onQueryChange}
         customControl={
           searchable ? renderExploitedVulnerabilitiesDropdown : undefined
         }
         renderCount={renderVulnerabilityCount}
-        renderFooter={renderTableFooter}
+        renderTableHelpText={renderTableHelpText}
         disableMultiRowSelect
         onSelectSingleRow={handleRowSelect}
         resetPageIndex={resetPageIndex}
diff --git a/frontend/pages/SoftwarePage/SoftwareVulnerabilities/SoftwareVulnerabilitiesTable/helpers.ts b/frontend/pages/SoftwarePage/SoftwareVulnerabilities/SoftwareVulnerabilitiesTable/helpers.ts
new file mode 100644
index 0000000000..39fba03fa4
--- /dev/null
+++ b/frontend/pages/SoftwarePage/SoftwareVulnerabilities/SoftwareVulnerabilitiesTable/helpers.ts
@@ -0,0 +1,31 @@
+export const getExploitedVulnerabilitiesDropdownOptions = (
+  isPremiumTier = false
+) => {
+  const disabledTooltipContent = "Available in Fleet Premium.";
+
+  return [
+    {
+      disabled: false,
+      label: "All vulnerabilities",
+      value: false,
+      helpText: "All vulnerabilities detected on your hosts.",
+    },
+    {
+      disabled: !isPremiumTier,
+      label: "Exploited vulnerabilities",
+      value: true,
+      helpText:
+        "Vulnerabilities that have been actively exploited in the wild.",
+      tooltipContent: !isPremiumTier && disabledTooltipContent,
+    },
+  ];
+};
+
+export const isValidCVEFormat = (query: string): boolean => {
+  if (query.length < 9) {
+    return false;
+  }
+
+  const cveRegex = /^CVE-\d{4}-\d{4,}$/i;
+  return cveRegex.test(query);
+};
diff --git a/frontend/pages/SoftwarePage/components/AddPackage/AddPackage.tsx b/frontend/pages/SoftwarePage/components/AddPackage/AddPackage.tsx
index 78e559b750..df20f7845a 100644
--- a/frontend/pages/SoftwarePage/components/AddPackage/AddPackage.tsx
+++ b/frontend/pages/SoftwarePage/components/AddPackage/AddPackage.tsx
@@ -1,29 +1,41 @@
 import React, { useContext, useEffect, useState } from "react";
 import { InjectedRouter } from "react-router";
 
+import { getErrorReason } from "interfaces/errors";
+
 import PATHS from "router/paths";
 import { NotificationContext } from "context/notification";
 import softwareAPI from "services/entities/software";
 import { QueryParams, buildQueryStringFromParams } from "utilities/url";
 
-import AddPackageForm from "../AddPackageForm";
-import { IAddSoftwareFormData } from "../AddPackageForm/AddSoftwareForm";
+import { LEARN_MORE_ABOUT_BASE_LINK } from "utilities/constants";
+
+import CustomLink from "components/CustomLink";
+
+import PackageForm from "../PackageForm";
+import { IPackageFormData } from "../PackageForm/PackageForm";
 import { getErrorMessage } from "../AddSoftwareModal/helpers";
 
 const baseClass = "add-package";
 
 // 8 minutes + 15 seconds to account for extra roundtrip time.
-const UPLOAD_TIMEOUT = (8 * 60 + 15) * 1000;
-const MAX_FILE_SIZE_MB = 500;
-const MAX_FILE_SIZE_BYTES = MAX_FILE_SIZE_MB * 1024 * 1024;
+export const UPLOAD_TIMEOUT = (8 * 60 + 15) * 1000;
+export const MAX_FILE_SIZE_MB = 500;
+export const MAX_FILE_SIZE_BYTES = MAX_FILE_SIZE_MB * 1024 * 1024;
 
 interface IAddPackageProps {
   teamId: number;
   router: InjectedRouter;
   onExit: () => void;
+  setAddedSoftwareToken: (token: string) => void;
 }
 
-const AddPackage = ({ teamId, router, onExit }: IAddPackageProps) => {
+const AddPackage = ({
+  teamId,
+  router,
+  onExit,
+  setAddedSoftwareToken,
+}: IAddPackageProps) => {
   const { renderFlash } = useContext(NotificationContext);
   const [isUploading, setIsUploading] = useState(false);
 
@@ -54,7 +66,7 @@ const AddPackage = ({ teamId, router, onExit }: IAddPackageProps) => {
     };
   }, [isUploading]);
 
-  const onAddPackage = async (formData: IAddSoftwareFormData) => {
+  const onAddPackage = async (formData: IPackageFormData) => {
     setIsUploading(true);
 
     if (formData.software && formData.software.size > MAX_FILE_SIZE_BYTES) {
@@ -67,6 +79,7 @@ const AddPackage = ({ teamId, router, onExit }: IAddPackageProps) => {
       return;
     }
 
+    // Note: This TODO is copied to onSaveSoftwareChanges in EditSoftwareModal
     // TODO: confirm we are deleting the second sentence (not modifying it) for non-self-service installers
     try {
       await softwareAPI.addSoftwarePackage(formData, teamId, UPLOAD_TIMEOUT);
@@ -86,12 +99,31 @@ const AddPackage = ({ teamId, router, onExit }: IAddPackageProps) => {
       } else {
         newQueryParams.available_for_install = true;
       }
-
+      // any unique string - triggers SW refetch
+      setAddedSoftwareToken(`${Date.now()}`);
       router.push(
         `${PATHS.SOFTWARE_TITLES}?${buildQueryStringFromParams(newQueryParams)}`
       );
     } catch (e) {
-      renderFlash("error", getErrorMessage(e));
+      const reason = getErrorReason(e);
+      if (
+        reason.includes("Couldn't add. Fleet couldn't read the version from")
+      ) {
+        renderFlash(
+          "error",
+          <>
+            {reason}{" "}
+            <CustomLink
+              newTab
+              url={`${LEARN_MORE_ABOUT_BASE_LINK}/read-package-version`}
+              text="Learn more"
+              iconColor="core-fleet-white"
+            />
+          </>
+        );
+      } else {
+        renderFlash("error", getErrorMessage(e));
+      }
     }
 
     onExit();
@@ -100,7 +132,7 @@ const AddPackage = ({ teamId, router, onExit }: IAddPackageProps) => {
 
   return (
     <div className={baseClass}>
-      <AddPackageForm
+      <PackageForm
         isUploading={isUploading}
         onCancel={onExit}
         onSubmit={onAddPackage}
diff --git a/frontend/pages/SoftwarePage/components/AddPackageForm/AddSoftwareForm.tsx b/frontend/pages/SoftwarePage/components/AddPackageForm/AddSoftwareForm.tsx
deleted file mode 100644
index aab97985d0..0000000000
--- a/frontend/pages/SoftwarePage/components/AddPackageForm/AddSoftwareForm.tsx
+++ /dev/null
@@ -1,250 +0,0 @@
-import React, { useContext, useState } from "react";
-
-import { NotificationContext } from "context/notification";
-import { getFileDetails } from "utilities/file/fileUtils";
-import getInstallScript from "utilities/software_install_scripts";
-
-import Button from "components/buttons/Button";
-import Checkbox from "components/forms/fields/Checkbox";
-import Editor from "components/Editor";
-import {
-  FileUploader,
-  FileDetails,
-} from "components/FileUploader/FileUploader";
-import Spinner from "components/Spinner";
-import TooltipWrapper from "components/TooltipWrapper";
-
-import AddSoftwareAdvancedOptions from "../AddSoftwareAdvancedOptions";
-
-import { generateFormValidation } from "./helpers";
-
-export const baseClass = "add-software-form";
-
-const UploadingSoftware = () => {
-  return (
-    <div className={`${baseClass}__uploading-message`}>
-      <Spinner centered={false} />
-      <p>Uploading. It may take a few minutes to finish.</p>
-    </div>
-  );
-};
-
-export interface IAddSoftwareFormData {
-  software: File | null;
-  installScript: string;
-  preInstallCondition?: string;
-  postInstallScript?: string;
-  selfService: boolean;
-}
-
-export interface IFormValidation {
-  isValid: boolean;
-  software: { isValid: boolean };
-  preInstallCondition?: { isValid: boolean; message?: string };
-  postInstallScript?: { isValid: boolean; message?: string };
-  selfService?: { isValid: boolean };
-}
-
-interface IAddSoftwareFormProps {
-  isUploading: boolean;
-  onCancel: () => void;
-  onSubmit: (formData: IAddSoftwareFormData) => void;
-}
-
-const AddSoftwareForm = ({
-  isUploading,
-  onCancel,
-  onSubmit,
-}: IAddSoftwareFormProps) => {
-  const { renderFlash } = useContext(NotificationContext);
-
-  const [showPreInstallCondition, setShowPreInstallCondition] = useState(false);
-  const [showPostInstallScript, setShowPostInstallScript] = useState(false);
-  const [formData, setFormData] = useState<IAddSoftwareFormData>({
-    software: null,
-    installScript: "",
-    preInstallCondition: undefined,
-    postInstallScript: undefined,
-    selfService: false,
-  });
-  const [formValidation, setFormValidation] = useState<IFormValidation>({
-    isValid: false,
-    software: { isValid: false },
-  });
-
-  const onFileUpload = (files: FileList | null) => {
-    if (files && files.length > 0) {
-      const file = files[0];
-
-      let installScript: string;
-      try {
-        installScript = getInstallScript(file.name);
-      } catch (e) {
-        renderFlash("error", `${e}`);
-        return;
-      }
-
-      const newData = {
-        ...formData,
-        software: file,
-        installScript,
-      };
-      setFormData(newData);
-      setFormValidation(
-        generateFormValidation(
-          newData,
-          showPreInstallCondition,
-          showPostInstallScript
-        )
-      );
-    }
-  };
-
-  const onFormSubmit = (evt: React.FormEvent<HTMLFormElement>) => {
-    evt.preventDefault();
-    onSubmit(formData);
-  };
-
-  const onTogglePreInstallConditionCheckbox = (value: boolean) => {
-    const newData = { ...formData, preInstallCondition: undefined };
-    setShowPreInstallCondition(value);
-    setFormData(newData);
-    setFormValidation(
-      generateFormValidation(newData, value, showPostInstallScript)
-    );
-  };
-
-  const onTogglePostInstallScriptCheckbox = (value: boolean) => {
-    const newData = { ...formData, postInstallScript: undefined };
-    setShowPostInstallScript(value);
-    setFormData(newData);
-    setFormValidation(
-      generateFormValidation(newData, showPreInstallCondition, value)
-    );
-  };
-
-  const onChangeInstallScript = (value: string) => {
-    setFormData({ ...formData, installScript: value });
-  };
-
-  const onChangePreInstallCondition = (value?: string) => {
-    const newData = { ...formData, preInstallCondition: value };
-    setFormData(newData);
-    setFormValidation(
-      generateFormValidation(
-        newData,
-        showPreInstallCondition,
-        showPostInstallScript
-      )
-    );
-  };
-
-  const onChangePostInstallScript = (value?: string) => {
-    const newData = { ...formData, postInstallScript: value };
-    setFormData(newData);
-    setFormValidation(
-      generateFormValidation(
-        newData,
-        showPreInstallCondition,
-        showPostInstallScript
-      )
-    );
-  };
-
-  const onToggleSelfServiceCheckbox = (value: boolean) => {
-    const newData = { ...formData, selfService: value };
-    setFormData(newData);
-    setFormValidation(
-      generateFormValidation(
-        newData,
-        showPreInstallCondition,
-        showPostInstallScript
-      )
-    );
-  };
-
-  const isSubmitDisabled = !formValidation.isValid;
-
-  return (
-    <div className={baseClass}>
-      {isUploading ? (
-        <UploadingSoftware />
-      ) : (
-        <form className={`${baseClass}__form`} onSubmit={onFormSubmit}>
-          <FileUploader
-            graphicName={"file-pkg"}
-            accept=".pkg,.msi,.exe,.deb"
-            message=".pkg, .msi, .exe, or .deb"
-            onFileUpload={onFileUpload}
-            buttonMessage="Choose file"
-            buttonType="link"
-            className={`${baseClass}__file-uploader`}
-            filePreview={
-              formData.software && (
-                <FileDetails details={getFileDetails(formData.software)} />
-              )
-            }
-          />
-          {formData.software && (
-            <Editor
-              wrapEnabled
-              maxLines={10}
-              name="install-script"
-              onChange={onChangeInstallScript}
-              value={formData.installScript}
-              helpText="Fleet will run this command on hosts to install software."
-              label="Install script"
-              labelTooltip={
-                <>
-                  For security agents, add the script provided by the vendor.
-                  <br />
-                  In custom scripts, you can use the $INSTALLER_PATH variable to
-                  point to the installer.
-                </>
-              }
-            />
-          )}
-          <Checkbox
-            value={formData.selfService}
-            onChange={onToggleSelfServiceCheckbox}
-          >
-            <TooltipWrapper
-              tipContent={
-                <>
-                  End users can install from{" "}
-                  <b>Fleet Desktop {">"} Self-service</b>.
-                </>
-              }
-            >
-              Self-service
-            </TooltipWrapper>
-          </Checkbox>
-          <AddSoftwareAdvancedOptions
-            errors={{
-              preInstallCondition: formValidation.preInstallCondition?.message,
-              postInstallScript: formValidation.postInstallScript?.message,
-            }}
-            showPreInstallCondition={showPreInstallCondition}
-            showPostInstallScript={showPostInstallScript}
-            preInstallCondition={formData.preInstallCondition}
-            postInstallScript={formData.postInstallScript}
-            onTogglePreInstallCondition={onTogglePreInstallConditionCheckbox}
-            onTogglePostInstallScript={onTogglePostInstallScriptCheckbox}
-            onChangePreInstallCondition={onChangePreInstallCondition}
-            onChangePostInstallScript={onChangePostInstallScript}
-          />
-          <div className="modal-cta-wrap">
-            <Button type="submit" variant="brand" disabled={isSubmitDisabled}>
-              Add software
-            </Button>
-            <Button onClick={onCancel} variant="inverse">
-              Cancel
-            </Button>
-          </div>
-        </form>
-      )}
-    </div>
-  );
-};
-
-export default AddSoftwareForm;
diff --git a/frontend/pages/SoftwarePage/components/AddPackageForm/helpers.ts b/frontend/pages/SoftwarePage/components/AddPackageForm/helpers.ts
deleted file mode 100644
index d38ca110d5..0000000000
--- a/frontend/pages/SoftwarePage/components/AddPackageForm/helpers.ts
+++ /dev/null
@@ -1,161 +0,0 @@
-import validator from "validator";
-
-// @ts-ignore
-import validateQuery from "components/forms/validators/validate_query";
-
-import { IAddSoftwareFormData, IFormValidation } from "./AddSoftwareForm";
-
-type IAddSoftwareFormValidatorKey = Exclude<
-  keyof IAddSoftwareFormData,
-  "installScript"
->;
-
-type IMessageFunc = (formData: IAddSoftwareFormData) => string;
-type IValidationMessage = string | IMessageFunc;
-
-interface IValidation {
-  name: string;
-  isValid: (
-    formData: IAddSoftwareFormData,
-    enabledPreInstallCondition?: boolean,
-    enabledPostInstallScript?: boolean
-  ) => boolean;
-  message?: IValidationMessage;
-}
-
-/** configuration defines validations for each filed in the form. It defines rules
- *  to determine if a field is valid, and rules for generating an error message.
- */
-const FORM_VALIDATION_CONFIG: Record<
-  IAddSoftwareFormValidatorKey,
-  { validations: IValidation[] }
-> = {
-  software: {
-    validations: [
-      {
-        name: "required",
-        isValid: (formData) => formData.software !== null,
-      },
-    ],
-  },
-  preInstallCondition: {
-    validations: [
-      {
-        name: "required",
-        isValid: (
-          formData: IAddSoftwareFormData,
-          enabledPreInstallCondition
-        ) => {
-          if (!enabledPreInstallCondition) {
-            return true;
-          }
-          return (
-            formData.preInstallCondition !== undefined &&
-            !validator.isEmpty(formData.preInstallCondition)
-          );
-        },
-        message: (formData) => {
-          // we dont want an error message until the user has interacted with
-          // the field. This is why we check for undefined here.
-          if (formData.preInstallCondition === undefined) {
-            return "";
-          }
-          return "Pre-install condition is required when enabled.";
-        },
-      },
-      {
-        name: "invalidQuery",
-        isValid: (formData, enabledPreInstallCondition) => {
-          if (!enabledPreInstallCondition) {
-            return true;
-          }
-          return (
-            formData.preInstallCondition !== undefined &&
-            validateQuery(formData.preInstallCondition).valid
-          );
-        },
-        message: (formData) =>
-          validateQuery(formData.preInstallCondition).error,
-      },
-    ],
-  },
-  postInstallScript: {
-    validations: [
-      {
-        name: "required",
-        message: (formData) => {
-          // we dont want an error message until the user has interacted with
-          // the field. This is why we check for undefined here.
-          if (formData.postInstallScript === undefined) {
-            return "";
-          }
-          return "Post-install script is required when enabled.";
-        },
-        isValid: (formData, _, enabledPostInstallScript) => {
-          if (!enabledPostInstallScript) {
-            return true;
-          }
-          return (
-            formData.postInstallScript !== undefined &&
-            !validator.isEmpty(formData.postInstallScript)
-          );
-        },
-      },
-    ],
-  },
-  selfService: {
-    // no validations related to self service
-    validations: [],
-  },
-};
-
-const getErrorMessage = (
-  formData: IAddSoftwareFormData,
-  message?: IValidationMessage
-) => {
-  if (message === undefined || typeof message === "string") {
-    return message;
-  }
-  return message(formData);
-};
-
-export const generateFormValidation = (
-  formData: IAddSoftwareFormData,
-  showingPreInstallCondition: boolean,
-  showingPostInstallScript: boolean
-) => {
-  const formValidation: IFormValidation = {
-    isValid: true,
-    software: {
-      isValid: false,
-    },
-  };
-
-  Object.keys(FORM_VALIDATION_CONFIG).forEach((key) => {
-    const objKey = key as keyof typeof FORM_VALIDATION_CONFIG;
-    const failedValidation = FORM_VALIDATION_CONFIG[objKey].validations.find(
-      (validation) =>
-        !validation.isValid(
-          formData,
-          showingPreInstallCondition,
-          showingPostInstallScript
-        )
-    );
-
-    if (!failedValidation) {
-      formValidation[objKey] = {
-        isValid: true,
-      };
-    } else {
-      formValidation.isValid = false;
-      formValidation[objKey] = {
-        isValid: false,
-        message: getErrorMessage(formData, failedValidation.message),
-      };
-    }
-  });
-
-  return formValidation;
-};
-
-export default generateFormValidation;
diff --git a/frontend/pages/SoftwarePage/components/AddPackageForm/index.ts b/frontend/pages/SoftwarePage/components/AddPackageForm/index.ts
deleted file mode 100644
index d3ea76d47d..0000000000
--- a/frontend/pages/SoftwarePage/components/AddPackageForm/index.ts
+++ /dev/null
@@ -1 +0,0 @@
-export { default } from "./AddSoftwareForm";
diff --git a/frontend/pages/SoftwarePage/components/AddSoftwareAdvancedOptions/AddSoftwareAdvancedOptions.tsx b/frontend/pages/SoftwarePage/components/AddSoftwareAdvancedOptions/AddSoftwareAdvancedOptions.tsx
deleted file mode 100644
index 96de54fd33..0000000000
--- a/frontend/pages/SoftwarePage/components/AddSoftwareAdvancedOptions/AddSoftwareAdvancedOptions.tsx
+++ /dev/null
@@ -1,110 +0,0 @@
-import React, { useState } from "react";
-
-import Editor from "components/Editor";
-import CustomLink from "components/CustomLink";
-import FleetAce from "components/FleetAce";
-import RevealButton from "components/buttons/RevealButton";
-import Checkbox from "components/forms/fields/Checkbox";
-
-const baseClass = "add-software-advanced-options";
-
-interface IAddSoftwareAdvancedOptionsProps {
-  errors: { preInstallCondition?: string; postInstallScript?: string };
-  showPreInstallCondition: boolean;
-  showPostInstallScript: boolean;
-  preInstallCondition?: string;
-  postInstallScript?: string;
-  onTogglePreInstallCondition: (value: boolean) => void;
-  onTogglePostInstallScript: (value: boolean) => void;
-  onChangePreInstallCondition: (value?: string) => void;
-  onChangePostInstallScript: (value?: string) => void;
-}
-
-const AddSoftwareAdvancedOptions = ({
-  errors,
-  showPreInstallCondition,
-  showPostInstallScript,
-  preInstallCondition,
-  postInstallScript,
-  onTogglePreInstallCondition,
-  onTogglePostInstallScript,
-  onChangePreInstallCondition,
-  onChangePostInstallScript,
-}: IAddSoftwareAdvancedOptionsProps) => {
-  const [showAdvancedOptions, setShowAdvancedOptions] = useState(false);
-
-  const onChangePreInstallCheckbox = () => {
-    onTogglePreInstallCondition(!showPreInstallCondition);
-  };
-
-  const onChangePostInstallCheckbox = () => {
-    onTogglePostInstallScript(!showPostInstallScript);
-  };
-
-  return (
-    <div className={baseClass}>
-      <RevealButton
-        className={`${baseClass}__accordion-title`}
-        isShowing={showAdvancedOptions}
-        showText="Advanced options"
-        hideText="Advanced options"
-        caretPosition="after"
-        onClick={() => setShowAdvancedOptions(!showAdvancedOptions)}
-      />
-      {showAdvancedOptions && (
-        <div className={`${baseClass}__input-fields`}>
-          <Checkbox
-            value={showPreInstallCondition}
-            onChange={onChangePreInstallCheckbox}
-          >
-            Pre-install condition
-          </Checkbox>
-          {showPreInstallCondition && (
-            <FleetAce
-              focus
-              error={errors.preInstallCondition}
-              value={preInstallCondition}
-              label="Query"
-              name="preInstallQuery"
-              maxLines={10}
-              onChange={onChangePreInstallCondition}
-              helpText={
-                <>
-                  Software will be installed only if the{" "}
-                  <CustomLink
-                    className={`${baseClass}__table-link`}
-                    text="query returns results"
-                    url="https://fleetdm.com/tables"
-                    newTab
-                  />
-                </>
-              }
-            />
-          )}
-          <Checkbox
-            value={showPostInstallScript}
-            onChange={onChangePostInstallCheckbox}
-          >
-            Post-install script
-          </Checkbox>
-          {showPostInstallScript && (
-            <>
-              <Editor
-                focus
-                error={errors.postInstallScript}
-                wrapEnabled
-                name="post-install-script-editor"
-                maxLines={10}
-                onChange={onChangePostInstallScript}
-                value={postInstallScript}
-                helpText="Shell (macOS and Linux) or PowerShell (Windows)."
-              />
-            </>
-          )}
-        </div>
-      )}
-    </div>
-  );
-};
-
-export default AddSoftwareAdvancedOptions;
diff --git a/frontend/pages/SoftwarePage/components/AddSoftwareAdvancedOptions/index.ts b/frontend/pages/SoftwarePage/components/AddSoftwareAdvancedOptions/index.ts
deleted file mode 100644
index 264fa61b11..0000000000
--- a/frontend/pages/SoftwarePage/components/AddSoftwareAdvancedOptions/index.ts
+++ /dev/null
@@ -1 +0,0 @@
-export { default } from "./AddSoftwareAdvancedOptions";
diff --git a/frontend/pages/SoftwarePage/components/AddSoftwareModal/AddSoftwareModal.tsx b/frontend/pages/SoftwarePage/components/AddSoftwareModal/AddSoftwareModal.tsx
index f6af29e7b4..4046e090c9 100644
--- a/frontend/pages/SoftwarePage/components/AddSoftwareModal/AddSoftwareModal.tsx
+++ b/frontend/pages/SoftwarePage/components/AddSoftwareModal/AddSoftwareModal.tsx
@@ -7,6 +7,7 @@ import { APP_CONTEXT_ALL_TEAMS_ID } from "interfaces/team";
 import Modal from "components/Modal";
 import Button from "components/buttons/Button";
 import TabsWrapper from "components/TabsWrapper";
+import PremiumFeatureMessage from "components/PremiumFeatureMessage";
 
 import AppStoreVpp from "../AppStoreVpp";
 import AddPackage from "../AddPackage";
@@ -37,13 +38,63 @@ interface IAddSoftwareModalProps {
   teamId: number;
   router: InjectedRouter;
   onExit: () => void;
+  setAddedSoftwareToken: (token: string) => void;
+  isFreeTier?: boolean;
 }
 
 const AddSoftwareModal = ({
   teamId,
   router,
   onExit,
+  setAddedSoftwareToken,
+  isFreeTier,
 }: IAddSoftwareModalProps) => {
+  const renderModalContent = () => {
+    if (isFreeTier) {
+      return (
+        <>
+          <PremiumFeatureMessage alignment="left" />{" "}
+          <div className="modal-cta-wrap">
+            <Button variant="brand" onClick={onExit}>
+              Done
+            </Button>
+          </div>
+        </>
+      );
+    }
+
+    if (teamId === APP_CONTEXT_ALL_TEAMS_ID) {
+      return <AllTeamsMessage onExit={onExit} />;
+    }
+
+    return (
+      <TabsWrapper className={`${baseClass}__tabs`}>
+        <Tabs>
+          <TabList>
+            <Tab>Package</Tab>
+            <Tab>App Store (VPP)</Tab>
+          </TabList>
+          <TabPanel>
+            <AddPackage
+              teamId={teamId}
+              router={router}
+              onExit={onExit}
+              setAddedSoftwareToken={setAddedSoftwareToken}
+            />
+          </TabPanel>
+          <TabPanel>
+            <AppStoreVpp
+              teamId={teamId}
+              router={router}
+              onExit={onExit}
+              setAddedSoftwareToken={setAddedSoftwareToken}
+            />
+          </TabPanel>
+        </Tabs>
+      </TabsWrapper>
+    );
+  };
+
   return (
     <Modal
       title="Add software"
@@ -51,26 +102,7 @@ const AddSoftwareModal = ({
       width="large"
       className={baseClass}
     >
-      <>
-        {teamId === APP_CONTEXT_ALL_TEAMS_ID ? (
-          <AllTeamsMessage onExit={onExit} />
-        ) : (
-          <TabsWrapper className={`${baseClass}__tabs`}>
-            <Tabs>
-              <TabList>
-                <Tab>Package</Tab>
-                <Tab>App Store (VPP)</Tab>
-              </TabList>
-              <TabPanel>
-                <AddPackage teamId={teamId} router={router} onExit={onExit} />
-              </TabPanel>
-              <TabPanel>
-                <AppStoreVpp teamId={teamId} router={router} onExit={onExit} />
-              </TabPanel>
-            </Tabs>
-          </TabsWrapper>
-        )}
-      </>
+      {renderModalContent()}
     </Modal>
   );
 };
diff --git a/frontend/pages/SoftwarePage/components/AppStoreVpp/AppStoreVpp.tsx b/frontend/pages/SoftwarePage/components/AppStoreVpp/AppStoreVpp.tsx
index 874d2d8849..12664495fe 100644
--- a/frontend/pages/SoftwarePage/components/AppStoreVpp/AppStoreVpp.tsx
+++ b/frontend/pages/SoftwarePage/components/AppStoreVpp/AppStoreVpp.tsx
@@ -5,12 +5,12 @@ import { AxiosError } from "axios";
 
 import PATHS from "router/paths";
 import mdmAppleAPI, {
-  IGetVppInfoResponse,
+  IGetVppTokensResponse,
   IVppApp,
 } from "services/entities/mdm_apple";
 import { DEFAULT_USE_QUERY_OPTIONS } from "utilities/constants";
-
 import { PLATFORM_DISPLAY_NAMES } from "interfaces/platform";
+import { NotificationContext } from "context/notification";
 
 import Card from "components/Card";
 import CustomLink from "components/CustomLink";
@@ -18,11 +18,15 @@ import Spinner from "components/Spinner";
 import Button from "components/buttons/Button";
 import DataError from "components/DataError";
 import Radio from "components/forms/fields/Radio";
-import { NotificationContext } from "context/notification";
-import { getErrorReason } from "interfaces/errors";
-import { buildQueryStringFromParams } from "utilities/url";
+import Checkbox from "components/forms/fields/Checkbox";
+
 import SoftwareIcon from "../icons/SoftwareIcon";
-import { getErrorMessage, getUniqueAppId } from "./helpers";
+import {
+  generateRedirectQueryParams,
+  getErrorMessage,
+  getUniqueAppId,
+  teamHasVPPToken,
+} from "./helpers";
 
 const baseClass = "app-store-vpp";
 
@@ -31,14 +35,14 @@ const EnableVppCard = () => {
     <Card borderRadiusSize="medium">
       <div className={`${baseClass}__enable-vpp`}>
         <p className={`${baseClass}__enable-vpp-title`}>
-          <b>Volume Purchasing Program (VPP) isn&apos;t enabled</b>
+          <b>No Volume Purchasing Program (VPP) token assigned</b>
         </p>
         <p className={`${baseClass}__enable-vpp-description`}>
-          To add App Store apps, first enable VPP.
+          To add App Store apps, assign a VPP token to this team.
         </p>
         <CustomLink
           url={PATHS.ADMIN_INTEGRATIONS_VPP}
-          text="Enable VPP"
+          text="Edit VPP"
           className={`${baseClass}__enable-vpp-link`}
         />
       </div>
@@ -53,9 +57,8 @@ const NoVppAppsCard = () => (
         You don&apos;t have any App Store apps
       </p>
       <p className={`${baseClass}__no-software-description`}>
-        Add apps in{" "}
-        <CustomLink url="https://business.apple.com" text="ABM" newTab /> Apps
-        that are already added to this team are not listed.
+        You must purchase apps in ABM. App Store apps that are already added to
+        this team are not listed.
       </p>
     </div>
   </Card>
@@ -130,20 +133,27 @@ interface IAppStoreVppProps {
   teamId: number;
   router: InjectedRouter;
   onExit: () => void;
+  setAddedSoftwareToken: (token: string) => void;
 }
 
-const AppStoreVpp = ({ teamId, router, onExit }: IAppStoreVppProps) => {
+const AppStoreVpp = ({
+  teamId,
+  router,
+  onExit,
+  setAddedSoftwareToken,
+}: IAppStoreVppProps) => {
   const { renderFlash } = useContext(NotificationContext);
   const [isSubmitDisabled, setIsSubmitDisabled] = useState(true);
   const [selectedApp, setSelectedApp] = useState<IVppApp | null>(null);
+  const [isSelfService, setIsSelfService] = useState(false);
 
   const {
     data: vppInfo,
     isLoading: isLoadingVppInfo,
     error: errorVppInfo,
-  } = useQuery<IGetVppInfoResponse, AxiosError>(
+  } = useQuery<IGetVppTokensResponse, AxiosError>(
     ["vppInfo"],
-    () => mdmAppleAPI.getVppInfo(),
+    () => mdmAppleAPI.getVppTokens(),
     {
       ...DEFAULT_USE_QUERY_OPTIONS,
       staleTime: 30000,
@@ -151,13 +161,15 @@ const AppStoreVpp = ({ teamId, router, onExit }: IAppStoreVppProps) => {
     }
   );
 
+  const hasVPPToken = teamHasVPPToken(teamId, vppInfo?.vpp_tokens);
+
   const {
     data: vppApps,
     isLoading: isLoadingVppApps,
     error: errorVppApps,
   } = useQuery(["vppSoftware", teamId], () => mdmAppleAPI.getVppApps(teamId), {
     ...DEFAULT_USE_QUERY_OPTIONS,
-    enabled: !!vppInfo,
+    enabled: hasVPPToken,
     staleTime: 30000,
     select: (res) => res.app_store_apps,
   });
@@ -165,6 +177,9 @@ const AppStoreVpp = ({ teamId, router, onExit }: IAppStoreVppProps) => {
   const onSelectApp = (app: IVppApp) => {
     setIsSubmitDisabled(false);
     setSelectedApp(app);
+    if (app.platform === "ios" || app.platform === "ipados") {
+      setIsSelfService(false);
+    }
   };
 
   const onAddSoftware = async () => {
@@ -176,7 +191,8 @@ const AppStoreVpp = ({ teamId, router, onExit }: IAppStoreVppProps) => {
       await mdmAppleAPI.addVppApp(
         teamId,
         selectedApp.app_store_id,
-        selectedApp.platform
+        selectedApp.platform,
+        isSelfService
       );
       renderFlash(
         "success",
@@ -185,10 +201,10 @@ const AppStoreVpp = ({ teamId, router, onExit }: IAppStoreVppProps) => {
           to install software.
         </>
       );
-      const queryParams = buildQueryStringFromParams({
-        team_id: teamId,
-        available_for_install: true,
-      });
+
+      const queryParams = generateRedirectQueryParams(teamId, isSelfService);
+      // any unique string - triggers SW refetch
+      setAddedSoftwareToken(`${Date.now()}`);
       router.push(`${PATHS.SOFTWARE}?${queryParams}`);
     } catch (e) {
       renderFlash("error", getErrorMessage(e));
@@ -196,15 +212,33 @@ const AppStoreVpp = ({ teamId, router, onExit }: IAppStoreVppProps) => {
     onExit();
   };
 
+  const renderSelfServiceContent = (platform: string) => {
+    if (platform !== "ios" && platform !== "ipados") {
+      return (
+        <Checkbox
+          value={isSelfService}
+          onChange={(newVal: boolean) => setIsSelfService(newVal)}
+          className={`${baseClass}__self-service-checkbox`}
+          tooltipContent={
+            <>
+              End users can install from <b>Fleet Desktop</b> {">"}{" "}
+              <b>Self-service</b>.
+            </>
+          }
+        >
+          Self-service
+        </Checkbox>
+      );
+    }
+    return null;
+  };
+
   const renderContent = () => {
     if (isLoadingVppInfo || isLoadingVppApps) {
       return <Spinner />;
     }
 
-    if (
-      errorVppInfo &&
-      getErrorReason(errorVppInfo).includes("MDMConfigAsset was not found")
-    ) {
+    if (!hasVPPToken) {
       return <EnableVppCard />;
     }
 
@@ -217,7 +251,7 @@ const AppStoreVpp = ({ teamId, router, onExit }: IAppStoreVppProps) => {
         return <NoVppAppsCard />;
       }
       return (
-        <>
+        <div className={`${baseClass}__modal-body`}>
           <VppAppList
             apps={vppApps}
             selectedApp={selectedApp}
@@ -228,7 +262,10 @@ const AppStoreVpp = ({ teamId, router, onExit }: IAppStoreVppProps) => {
             apps, head to{" "}
             <CustomLink url="https://business.apple.com" text="ABM" newTab />
           </div>
-        </>
+          {renderSelfServiceContent(
+            (selectedApp && selectedApp.platform) || ""
+          )}
+        </div>
       );
     }
     return null;
diff --git a/frontend/pages/SoftwarePage/components/AppStoreVpp/_styles.scss b/frontend/pages/SoftwarePage/components/AppStoreVpp/_styles.scss
index 8602abf76e..604750a258 100644
--- a/frontend/pages/SoftwarePage/components/AppStoreVpp/_styles.scss
+++ b/frontend/pages/SoftwarePage/components/AppStoreVpp/_styles.scss
@@ -4,10 +4,11 @@
   &__list-container {
     border: 1px solid $ui-fleet-black-10;
     border-radius: $border-radius-medium;
-    margin-bottom: $pad-medium;
   }
 
   &__list {
+    max-height: 315px;
+    overflow-y: auto;
     list-style: none;
     margin: 0;
     padding: 0;
@@ -52,12 +53,19 @@
   &__no-software-description {
     margin: 0;
     color: $ui-fleet-black-75;
+    text-align: center;
   }
 
   &__error {
     margin: $pad-xxlarge 0;
   }
 
+  &__modal-body {
+    display: flex;
+    flex-direction: column;
+    gap: $pad-medium;
+  }
+
   &__enable-vpp {
     display: flex;
     flex-direction: column;
diff --git a/frontend/pages/SoftwarePage/components/AppStoreVpp/helpers.tsx b/frontend/pages/SoftwarePage/components/AppStoreVpp/helpers.tsx
index a0130de802..8d8c5a171d 100644
--- a/frontend/pages/SoftwarePage/components/AppStoreVpp/helpers.tsx
+++ b/frontend/pages/SoftwarePage/components/AppStoreVpp/helpers.tsx
@@ -1,6 +1,8 @@
 import React from "react";
 import { getErrorReason } from "interfaces/errors";
+import { IMdmVppToken } from "interfaces/mdm";
 import { IVppApp } from "services/entities/mdm_apple";
+import { buildQueryStringFromParams } from "utilities/url";
 
 const ADD_SOFTWARE_ERROR_PREFIX = "Couldn’t add software.";
 const DEFAULT_ERROR_MESSAGE = `${ADD_SOFTWARE_ERROR_PREFIX} Please try again.`;
@@ -33,14 +35,58 @@ const generateAlreadyAvailableMessage = (msg: string) => {
 
 // eslint-disable-next-line import/prefer-default-export
 export const getErrorMessage = (e: unknown) => {
-  const reason = getErrorReason(e);
-
+  let reason = getErrorReason(e);
   // software is already available for install
   if (reason.toLowerCase().includes("already")) {
     return generateAlreadyAvailableMessage(reason);
   }
-  return DEFAULT_ERROR_MESSAGE;
+  if (reason && !reason.endsWith(".")) {
+    reason += ".";
+  }
+  return reason || DEFAULT_ERROR_MESSAGE;
 };
 
 export const getUniqueAppId = (app: IVppApp) =>
   `${app.app_store_id}_${app.platform}`;
+
+/**
+ * Generates the query params for the redirect to the software page. This
+ * will either generate query params to filter by available for install or
+ * self service.
+ */
+export const generateRedirectQueryParams = (
+  teamId: number,
+  isSelfService: boolean
+) => {
+  let queryParams = buildQueryStringFromParams({ team_id: teamId });
+  if (isSelfService) {
+    queryParams = `${queryParams}&self_service=true`;
+  } else {
+    queryParams = `${queryParams}&available_for_install=true`;
+  }
+  return queryParams;
+};
+
+/**
+ * Checks if the given team has an available VPP token (either a token
+ * that's associated with the team, or a token that's available to "All
+ * teams")
+ */
+export const teamHasVPPToken = (
+  currentTeamId: number,
+  tokens?: IMdmVppToken[]
+) => {
+  if (!tokens || tokens.length === 0) {
+    return false;
+  }
+
+  return tokens.some((token) => {
+    // if we've got a non-null, empty array it means the token is available for
+    // "All teams"
+    if (token.teams?.length === 0) {
+      return true;
+    }
+
+    return token.teams?.some((team) => team.team_id === currentTeamId);
+  });
+};
diff --git a/frontend/pages/SoftwarePage/components/EmptySoftwareTable/EmptySoftwareTable.tsx b/frontend/pages/SoftwarePage/components/EmptySoftwareTable/EmptySoftwareTable.tsx
index 8548afbfed..829b4ff136 100644
--- a/frontend/pages/SoftwarePage/components/EmptySoftwareTable/EmptySoftwareTable.tsx
+++ b/frontend/pages/SoftwarePage/components/EmptySoftwareTable/EmptySoftwareTable.tsx
@@ -1,32 +1,31 @@
-// This component is used on DashboardPage.tsx > Software.tsx,
-// Host Details / Device User > Software.tsx, and SoftwarePage.tsx
-
 import React from "react";
-
 import CustomLink from "components/CustomLink";
 import EmptyTable from "components/EmptyTable";
 import { IEmptyTableProps } from "interfaces/empty_table";
-import { ISoftwareDropdownFilterVal } from "pages/SoftwarePage/SoftwareTitles/SoftwareTable/helpers";
+import {
+  getVulnFilterRenderDetails,
+  ISoftwareDropdownFilterVal,
+  ISoftwareVulnFiltersParams,
+} from "pages/SoftwarePage/SoftwareTitles/SoftwareTable/helpers";
 
 export interface IEmptySoftwareTableProps {
   softwareFilter?: ISoftwareDropdownFilterVal;
-  /** tableName is displayed in the search empty state */
+  vulnFilters?: ISoftwareVulnFiltersParams;
   tableName?: string;
   isSoftwareDisabled?: boolean;
-  /** isNotDetectingSoftware renders empty states when no search string is present */
-  isNotDetectingSoftware?: boolean;
-  /** isCollectingSoftware is only used on the Dashboard page with a TODO to revisit */
-  isCollectingSoftware?: boolean;
+  noSearchQuery?: boolean;
+  installableSoftwareExists?: boolean;
 }
 
 const generateTypeText = (
   tableName: string,
-  softwareFilter?: ISoftwareDropdownFilterVal
+  softwareFilter?: ISoftwareDropdownFilterVal,
+  vulnFilters?: ISoftwareVulnFiltersParams
 ) => {
   if (softwareFilter === "installableSoftware") {
     return "installable software";
   }
-  if (softwareFilter === "vulnerableSoftware") {
+  if (vulnFilters?.vulnerable) {
     return "vulnerable software";
   }
   return tableName;
@@ -34,46 +33,69 @@ const generateTypeText = (
 
 const EmptySoftwareTable = ({
   softwareFilter = "allSoftware",
+  vulnFilters,
   tableName = "software",
   isSoftwareDisabled,
-  isNotDetectingSoftware,
-  isCollectingSoftware,
+  noSearchQuery,
+  installableSoftwareExists,
 }: IEmptySoftwareTableProps): JSX.Element => {
-  const softwareTypeText = generateTypeText(tableName, softwareFilter);
+  const softwareTypeText = generateTypeText(
+    tableName,
+    softwareFilter,
+    vulnFilters
+  );
 
-  const emptySoftware: IEmptyTableProps = {
-    header: "No items match the current search criteria",
-    info: `Expecting to see ${softwareTypeText}? Check back later.`,
+  const { filterCount: vulnFiltersCount } = getVulnFilterRenderDetails(
+    vulnFilters
+  );
+
+  const isFiltered =
+    vulnFiltersCount > 0 || !noSearchQuery || softwareFilter !== "allSoftware";
+
+  const getEmptySoftwareInfo = (): IEmptyTableProps => {
+    if (isSoftwareDisabled) {
+      return {
+        header: "Software inventory disabled",
+        info: (
+          <>
+            Users with the admin role can{" "}
+            <CustomLink
+              url="https://fleetdm.com/docs/using-fleet/vulnerability-processing#configuration"
+              text="turn on software inventory"
+              newTab
+            />
+            .
+          </>
+        ),
+      };
+    }
+
+    if (!isFiltered) {
+      if (softwareFilter === "allSoftware") {
+        if (installableSoftwareExists) {
+          return {
+            header: `No ${tableName} detected`,
+            info: "Install software on your hosts to see versions.",
+          };
+        }
+        return {
+          header: `No ${tableName} detected`,
+          info: `Expecting to see ${softwareTypeText}? Check back later.`,
+        };
+      }
+    }
+
+    return {
+      header: "No items match the current search criteria",
+      info: `Expecting to see ${softwareTypeText}? Check back later.`,
+    };
   };
 
-  if (isNotDetectingSoftware && softwareFilter === "allSoftware") {
-    emptySoftware.header = "No software detected";
-  }
-
-  if (isCollectingSoftware) {
-    emptySoftware.header = "No software detected";
-    emptySoftware.info =
-      "This report is updated every hour to protect the performance of your devices.";
-  }
-
-  if (isSoftwareDisabled) {
-    emptySoftware.header = "Software inventory disabled";
-    emptySoftware.info = (
-      <>
-        Users with the admin role can{" "}
-        <CustomLink
-          url="https://fleetdm.com/docs/using-fleet/vulnerability-processing#configuration"
-          text="turn on software inventory"
-          newTab
-        />
-        .
-      </>
-    );
-  }
+  const emptySoftware = getEmptySoftwareInfo();
 
   return (
     <EmptyTable
-      graphicName="empty-software"
+      graphicName="empty-search-question"
       header={emptySoftware.header}
       info={emptySoftware.info}
     />
diff --git a/frontend/pages/SoftwarePage/components/EmptyVulnerabilitiesTable/EmptyVulnerabilitiesTable.tsx b/frontend/pages/SoftwarePage/components/EmptyVulnerabilitiesTable/EmptyVulnerabilitiesTable.tsx
new file mode 100644
index 0000000000..107fd9fb32
--- /dev/null
+++ b/frontend/pages/SoftwarePage/components/EmptyVulnerabilitiesTable/EmptyVulnerabilitiesTable.tsx
@@ -0,0 +1,111 @@
+import React from "react";
+import CustomLink from "components/CustomLink";
+import EmptyTable from "components/EmptyTable";
+import { IEmptyTableProps } from "interfaces/empty_table";
+import { IVulnerabilitiesEmptyStateReason } from "services/entities/vulnerabilities";
+
+export interface IEmptyVulnerabilitiesTableProps {
+  isPremiumTier?: boolean;
+  teamId?: number;
+  exploitedFilter?: boolean;
+  isSoftwareDisabled?: boolean;
+  emptyStateReason?: IVulnerabilitiesEmptyStateReason;
+}
+
+const LearnMoreLink = () => (
+  <CustomLink
+    url="https://fleetdm.com/learn-more-about/vulnerability-processing"
+    text="Learn more"
+    newTab
+  />
+);
+
+const emptyStateDetails: Record<
+  IVulnerabilitiesEmptyStateReason,
+  Partial<IEmptyTableProps>
+> = {
+  "no-vulns-detected": {
+    graphicName: "empty-search-question",
+    header: "No vulnerabilities detected",
+    info: "Expecting to see vulnerabilities? Check back later.",
+  },
+  "no-matching-items": {
+    graphicName: "empty-search-question",
+    header: "No items match the current search criteria",
+    info: "Expecting to see vulnerabilities? Check back later.",
+  },
+  "invalid-cve": {
+    graphicName: "empty-search-exclamation",
+    header: "That vulnerability (CVE) is not valid",
+    info:
+      'Try updating your search to use CVE format: "CVE-YYYY-<4 or more digits>"',
+  },
+  "unknown-cve": {
+    graphicName: "empty-search-question",
+    header: "This is not a known CVE",
+    info: "None of Fleet's vulnerability sources are aware of this CVE.",
+    additionalInfo: <LearnMoreLink />,
+  },
+  "known-vuln": {
+    graphicName: "empty-search-check",
+    header:
+      "This is a known vulnerability (CVE), but it wasn't detected on any hosts",
+    additionalInfo: <LearnMoreLink />,
+  },
+};
+
+const EmptyVulnerabilitiesTable: React.FC<IEmptyVulnerabilitiesTableProps> = ({
+  isPremiumTier,
+  teamId,
+  exploitedFilter,
+  isSoftwareDisabled,
+  emptyStateReason,
+}) => {
+  if (isSoftwareDisabled) {
+    return (
+      <EmptyTable
+        graphicName="empty-search-question"
+        header="Software inventory disabled"
+        info={
+          <>
+            Users with the admin role can{" "}
+            <CustomLink
+              url="https://fleetdm.com/docs/using-fleet/vulnerability-processing#configuration"
+              text="turn on software inventory"
+              newTab
+            />
+            .
+          </>
+        }
+      />
+    );
+  }
+
+  const defaultEmptyState: IEmptyTableProps = {
+    graphicName: "empty-search-question",
+    header: "No items match the current search criteria",
+    info: "Expecting to see vulnerabilities? Check back later.",
+  };
+
+  const emptyState = emptyStateReason
+    ? { ...defaultEmptyState, ...emptyStateDetails[emptyStateReason] }
+    : defaultEmptyState;
+
+  if (emptyStateReason === "known-vuln" && teamId !== undefined) {
+    emptyState.header += " in this team";
+  }
+
+  if (
+    isPremiumTier &&
+    exploitedFilter &&
+    emptyStateReason !== "unknown-cve" &&
+    emptyStateReason !== "invalid-cve"
+  ) {
+    emptyState.info =
+      "Try removing the exploited vulnerabilities filter to expand your search.";
+  }
+
+  return <EmptyTable {...emptyState} />;
+};
+
+export default EmptyVulnerabilitiesTable;
diff --git a/frontend/pages/SoftwarePage/components/EmptyVulnerabilitiesTable/index.ts b/frontend/pages/SoftwarePage/components/EmptyVulnerabilitiesTable/index.ts
new file mode 100644
index 0000000000..66d385ed4e
--- /dev/null
+++ b/frontend/pages/SoftwarePage/components/EmptyVulnerabilitiesTable/index.ts
@@ -0,0 +1 @@
+export { default } from "./EmptyVulnerabilitiesTable";
diff --git a/frontend/pages/SoftwarePage/components/PackageAdvancedOptions/PackageAdvancedOptions.tsx b/frontend/pages/SoftwarePage/components/PackageAdvancedOptions/PackageAdvancedOptions.tsx
new file mode 100644
index 0000000000..ad06e516ec
--- /dev/null
+++ b/frontend/pages/SoftwarePage/components/PackageAdvancedOptions/PackageAdvancedOptions.tsx
@@ -0,0 +1,179 @@
+import React, { useState } from "react";
+
+import { LEARN_MORE_ABOUT_BASE_LINK } from "utilities/constants";
+
+import {
+  isPackageType,
+  isWindowsPackageType,
+  PackageType,
+} from "interfaces/package_type";
+
+import Editor from "components/Editor";
+import CustomLink from "components/CustomLink";
+import FleetAce from "components/FleetAce";
+import RevealButton from "components/buttons/RevealButton";
+import { IPackageFormData } from "../PackageForm/PackageForm";
+
+const getSupportedScriptTypeText = (pkgType: PackageType) => {
+  return `Currently, ${
+    isWindowsPackageType(pkgType) ? "PowerS" : "s"
+  }hell scripts are supported.`;
+};
+
+const PKG_TYPE_TO_ID_TEXT = {
+  pkg: "package IDs",
+  deb: "package name",
+  msi: "product code",
+  exe: "software name",
+} as const;
+
+const getInstallHelpText = (pkgType: PackageType) => (
+  <>
+    Use the $INSTALLER_PATH variable to point to the installer.{" "}
+    {getSupportedScriptTypeText(pkgType)}{" "}
+    <CustomLink
+      url={`${LEARN_MORE_ABOUT_BASE_LINK}/install-scripts`}
+      text="Learn more about install scripts"
+      newTab
+    />
+  </>
+);
+
+const getPostInstallHelpText = (pkgType: PackageType) => {
+  return getSupportedScriptTypeText(pkgType);
+};
+
+const getUninstallHelpText = (pkgType: PackageType) => {
+  return (
+    <>
+      $PACKAGE_ID will be populated with the {PKG_TYPE_TO_ID_TEXT[pkgType]} from
+      the .{pkgType} file after the software is added.{" "}
+      {getSupportedScriptTypeText(pkgType)}{" "}
+      <CustomLink
+        url={`${LEARN_MORE_ABOUT_BASE_LINK}/uninstall-scripts`}
+        text="Learn more about uninstall scripts"
+        newTab
+      />
+    </>
+  );
+};
+
+const baseClass = "package-advanced-options";
+
+interface IPackageAdvancedOptionsProps {
+  errors: { preInstallQuery?: string; postInstallScript?: string };
+  selectedPackage: IPackageFormData["software"];
+  preInstallQuery?: string;
+  installScript: string;
+  postInstallScript?: string;
+  uninstallScript?: string;
+  onChangePreInstallQuery: (value?: string) => void;
+  onChangeInstallScript: (value: string) => void;
+  onChangePostInstallScript: (value?: string) => void;
+  onChangeUninstallScript: (value?: string) => void;
+}
+
+const PackageAdvancedOptions = ({
+  errors,
+  selectedPackage,
+  preInstallQuery,
+  installScript,
+  postInstallScript,
+  uninstallScript,
+  onChangePreInstallQuery,
+  onChangeInstallScript,
+  onChangePostInstallScript,
+  onChangeUninstallScript,
+}: IPackageAdvancedOptionsProps) => {
+  const [showAdvancedOptions, setShowAdvancedOptions] = useState(false);
+
+  const renderAdvancedOptions = () => {
+    const name = selectedPackage?.name || "";
+    const ext = name.split(".").pop() as PackageType;
+    if (!isPackageType(ext)) {
+      // this should never happen
+      return null;
+    }
+    return (
+      <div className={`${baseClass}__input-fields`}>
+        <FleetAce
+          className="form-field"
+          focus
+          error={errors.preInstallQuery}
+          value={preInstallQuery}
+          placeholder="SELECT * FROM osquery_info WHERE start_time > 1"
+          label="Pre-install query"
+          name="preInstallQuery"
+          maxLines={10}
+          onChange={onChangePreInstallQuery}
+          helpText={
+            <>
+              Software will be installed only if the{" "}
+              <CustomLink
+                className={`${baseClass}__table-link`}
+                text="query returns results"
+                url="https://fleetdm.com/tables"
+                newTab
+              />
+            </>
+          }
+        />
+        <Editor
+          wrapEnabled
+          maxLines={10}
+          name="install-script"
+          onChange={onChangeInstallScript}
+          value={installScript}
+          helpText={getInstallHelpText(ext)}
+          label="Install script"
+          isFormField
+        />
+        <Editor
+          label="Post-install script"
+          focus
+          error={errors.postInstallScript}
+          wrapEnabled
+          name="post-install-script-editor"
+          maxLines={10}
+          onChange={onChangePostInstallScript}
+          value={postInstallScript}
+          helpText={getPostInstallHelpText(ext)}
+          isFormField
+        />
+        <Editor
+          label="Uninstall script"
+          focus
+          wrapEnabled
+          name="uninstall-script-editor"
+          maxLines={20}
+          onChange={onChangeUninstallScript}
+          value={uninstallScript}
+          helpText={getUninstallHelpText(ext)}
+          isFormField
+        />
+      </div>
+    );
+  };
+
+  return (
+    <div className={baseClass}>
+      <RevealButton
+        className={`${baseClass}__accordion-title`}
+        isShowing={showAdvancedOptions}
+        showText="Advanced options"
+        hideText="Advanced options"
+        caretPosition="after"
+        onClick={() => setShowAdvancedOptions(!showAdvancedOptions)}
+        disabled={!selectedPackage}
+        disabledTooltipContent={
+          selectedPackage
+            ? "Choose a file to modify advanced options."
+            : undefined
+        }
+      />
+      {showAdvancedOptions && !!selectedPackage && renderAdvancedOptions()}
+    </div>
+  );
+};
+
+export default PackageAdvancedOptions;
diff --git a/frontend/pages/SoftwarePage/components/AddSoftwareAdvancedOptions/_styles.scss b/frontend/pages/SoftwarePage/components/PackageAdvancedOptions/_styles.scss
similarity index 88%
rename from frontend/pages/SoftwarePage/components/AddSoftwareAdvancedOptions/_styles.scss
rename to frontend/pages/SoftwarePage/components/PackageAdvancedOptions/_styles.scss
index 58f1f85892..99167137da 100644
--- a/frontend/pages/SoftwarePage/components/AddSoftwareAdvancedOptions/_styles.scss
+++ b/frontend/pages/SoftwarePage/components/PackageAdvancedOptions/_styles.scss
@@ -1,4 +1,4 @@
-.add-software-advanced-options {
+.package-advanced-options {
   display: flex;
   flex-direction: column;
   align-items: flex-start;
diff --git a/frontend/pages/SoftwarePage/components/PackageAdvancedOptions/index.ts b/frontend/pages/SoftwarePage/components/PackageAdvancedOptions/index.ts
new file mode 100644
index 0000000000..884237783f
--- /dev/null
+++ b/frontend/pages/SoftwarePage/components/PackageAdvancedOptions/index.ts
@@ -0,0 +1 @@
+export { default } from "./PackageAdvancedOptions";
diff --git a/frontend/pages/SoftwarePage/components/PackageForm/PackageForm.tsx b/frontend/pages/SoftwarePage/components/PackageForm/PackageForm.tsx
new file mode 100644
index 0000000000..343423d2d8
--- /dev/null
+++ b/frontend/pages/SoftwarePage/components/PackageForm/PackageForm.tsx
@@ -0,0 +1,230 @@
+// Used in AddPackageModal.tsx and EditSoftwareModal.tsx
+import React, { useContext, useState } from "react";
+
+import { NotificationContext } from "context/notification";
+import { getFileDetails } from "utilities/file/fileUtils";
+import getDefaultInstallScript from "utilities/software_install_scripts";
+import getDefaultUninstallScript from "utilities/software_uninstall_scripts";
+
+import Button from "components/buttons/Button";
+import Checkbox from "components/forms/fields/Checkbox";
+import FileUploader from "components/FileUploader";
+import Spinner from "components/Spinner";
+import TooltipWrapper from "components/TooltipWrapper";
+
+import PackageAdvancedOptions from "../PackageAdvancedOptions";
+
+import { generateFormValidation } from "./helpers";
+
+export const baseClass = "package-form";
+
+const UploadingSoftware = () => {
+  return (
+    <div className={`${baseClass}__uploading-message`}>
+      <Spinner centered={false} />
+      <p>Uploading software. This may take a few minutes to finish.</p>
+    </div>
+  );
+};
+
+export interface IPackageFormData {
+  software: File | null;
+  preInstallQuery?: string;
+  installScript: string;
+  postInstallScript?: string;
+  uninstallScript?: string;
+  selfService: boolean;
+}
+
+export interface IFormValidation {
+  isValid: boolean;
+  software: { isValid: boolean };
+  preInstallQuery?: { isValid: boolean; message?: string };
+  postInstallScript?: { isValid: boolean; message?: string };
+  uninstallScript?: { isValid: boolean; message?: string };
+  selfService?: { isValid: boolean };
+}
+
+interface IPackageFormProps {
+  isUploading: boolean;
+  onCancel: () => void;
+  onSubmit: (formData: IPackageFormData) => void;
+  isEditingSoftware?: boolean;
+  defaultSoftware?: any; // TODO
+  defaultInstallScript?: string;
+  defaultPreInstallQuery?: string;
+  defaultPostInstallScript?: string;
+  defaultUninstallScript?: string;
+  defaultSelfService?: boolean;
+}
+
+const ACCEPTED_EXTENSIONS = ".pkg,.msi,.exe,.deb";
+
+const PackageForm = ({
+  isUploading,
+  onCancel,
+  onSubmit,
+  isEditingSoftware = false,
+  defaultSoftware,
+  defaultInstallScript,
+  defaultPreInstallQuery,
+  defaultPostInstallScript,
+  defaultUninstallScript,
+  defaultSelfService,
+}: IPackageFormProps) => {
+  const { renderFlash } = useContext(NotificationContext);
+
+  const initialFormData = {
+    software: defaultSoftware || null,
+    installScript: defaultInstallScript || "",
+    preInstallQuery: defaultPreInstallQuery || "",
+    postInstallScript: defaultPostInstallScript || "",
+    uninstallScript: defaultUninstallScript || "",
+    selfService: defaultSelfService || false,
+  };
+  const [formData, setFormData] = useState<IPackageFormData>(initialFormData);
+  const [formValidation, setFormValidation] = useState<IFormValidation>({
+    isValid: false,
+    software: { isValid: false },
+  });
+
+  const onFileSelect = (files: FileList | null) => {
+    if (files && files.length > 0) {
+      const file = files[0];
+
+      // Only populate default install/uninstall scripts when adding (but not editing) software
+      if (isEditingSoftware) {
+        const newData = { ...formData, software: file };
+        setFormData(newData);
+        setFormValidation(generateFormValidation(newData));
+      } else {
+        let newDefaultInstallScript: string;
+        try {
+          newDefaultInstallScript = getDefaultInstallScript(file.name);
+        } catch (e) {
+          renderFlash("error", `${e}`);
+          return;
+        }
+
+        let newDefaultUninstallScript: string;
+        try {
+          newDefaultUninstallScript = getDefaultUninstallScript(file.name);
+        } catch (e) {
+          renderFlash("error", `${e}`);
+          return;
+        }
+
+        const newData = {
+          ...formData,
+          software: file,
+          installScript: newDefaultInstallScript || "",
+          uninstallScript: newDefaultUninstallScript || "",
+        };
+        setFormData(newData);
+        setFormValidation(generateFormValidation(newData));
+      }
+    }
+  };
+
+  const onFormSubmit = (evt: React.FormEvent<HTMLFormElement>) => {
+    evt.preventDefault();
+    onSubmit(formData);
+  };
+
+  const onChangeInstallScript = (value: string) => {
+    const newData = { ...formData, installScript: value };
+    setFormData(newData);
+    setFormValidation(generateFormValidation(newData));
+  };
+
+  const onChangePreInstallQuery = (value?: string) => {
+    const newData = { ...formData, preInstallQuery: value };
+    setFormData(newData);
+    setFormValidation(generateFormValidation(newData));
+  };
+
+  const onChangePostInstallScript = (value?: string) => {
+    const newData = { ...formData, postInstallScript: value };
+    setFormData(newData);
+    setFormValidation(generateFormValidation(newData));
+  };
+
+  const onChangeUninstallScript = (value?: string) => {
+    const newData = { ...formData, uninstallScript: value };
+    setFormData(newData);
+    setFormValidation(generateFormValidation(newData));
+  };
+
+  const onToggleSelfServiceCheckbox = (value: boolean) => {
+    const newData = { ...formData, selfService: value };
+    setFormData(newData);
+    setFormValidation(generateFormValidation(newData));
+  };
+
+  const isSubmitDisabled = !formValidation.isValid;
+
+  return (
+    <div className={baseClass}>
+      {isUploading ? (
+        <UploadingSoftware /> // Note: Sarah is replacing uploading state as subsequent 4.57 feature
+      ) : (
+        <form className={`${baseClass}__form`} onSubmit={onFormSubmit}>
+          <FileUploader
+            canEdit={isEditingSoftware}
+            graphicName={"file-pkg"}
+            accept={ACCEPTED_EXTENSIONS}
+            message=".pkg, .msi, .exe, or .deb"
+            onFileUpload={onFileSelect}
+            buttonMessage="Choose file"
+            buttonType="link"
+            className={`${baseClass}__file-uploader`}
+            fileDetails={
+              formData.software ? getFileDetails(formData.software) : undefined
+            }
+          />
+          <Checkbox
+            value={formData.selfService}
+            onChange={onToggleSelfServiceCheckbox}
+          >
+            <TooltipWrapper
+              tipContent={
+                <>
+                  End users can install from{" "}
+                  <b>Fleet Desktop {">"} Self-service</b>.
+                </>
+              }
+            >
+              Self-service
+            </TooltipWrapper>
+          </Checkbox>
+          <PackageAdvancedOptions
+            selectedPackage={formData.software}
+            errors={{
+              preInstallQuery: formValidation.preInstallQuery?.message,
+              postInstallScript: formValidation.postInstallScript?.message,
+            }}
+            preInstallQuery={formData.preInstallQuery}
+            installScript={formData.installScript}
+            postInstallScript={formData.postInstallScript}
+            uninstallScript={formData.uninstallScript}
+            onChangePreInstallQuery={onChangePreInstallQuery}
+            onChangeInstallScript={onChangeInstallScript}
+            onChangePostInstallScript={onChangePostInstallScript}
+            onChangeUninstallScript={onChangeUninstallScript}
+          />
+          <div className="modal-cta-wrap">
+            <Button type="submit" variant="brand" disabled={isSubmitDisabled}>
+              {isEditingSoftware ? "Save" : "Add software"}
+            </Button>
+            <Button onClick={onCancel} variant="inverse">
+              Cancel
+            </Button>
+          </div>
+        </form>
+      )}
+    </div>
+  );
+};
+
+// Allows form not to re-render as long as its props don't change
+export default React.memo(PackageForm);
diff --git a/frontend/pages/SoftwarePage/components/AddPackageForm/_styles.scss b/frontend/pages/SoftwarePage/components/PackageForm/_styles.scss
similarity index 93%
rename from frontend/pages/SoftwarePage/components/AddPackageForm/_styles.scss
rename to frontend/pages/SoftwarePage/components/PackageForm/_styles.scss
index 8e09f0a64d..e3f90adbf0 100644
--- a/frontend/pages/SoftwarePage/components/AddPackageForm/_styles.scss
+++ b/frontend/pages/SoftwarePage/components/PackageForm/_styles.scss
@@ -1,4 +1,4 @@
-.add-software-form {
+.package-form {
   &__uploading-message {
     display: flex;
     align-items: center;
diff --git a/frontend/pages/SoftwarePage/components/PackageForm/helpers.ts b/frontend/pages/SoftwarePage/components/PackageForm/helpers.ts
new file mode 100644
index 0000000000..c265ac07bf
--- /dev/null
+++ b/frontend/pages/SoftwarePage/components/PackageForm/helpers.ts
@@ -0,0 +1,99 @@
+// @ts-ignore
+import validateQuery from "components/forms/validators/validate_query";
+
+import { IPackageFormData, IFormValidation } from "./PackageForm";
+
+type IPackageFormValidatorKey = Exclude<
+  keyof IPackageFormData,
+  "installScript" | "uninstallScript"
+>;
+
+type IMessageFunc = (formData: IPackageFormData) => string;
+type IValidationMessage = string | IMessageFunc;
+
+interface IValidation {
+  name: string;
+  isValid: (formData: IPackageFormData) => boolean;
+  message?: IValidationMessage;
+}
+
+/** configuration defines validations for each filed in the form. It defines rules
+ *  to determine if a field is valid, and rules for generating an error message.
+ */
+const FORM_VALIDATION_CONFIG: Record<
+  IPackageFormValidatorKey,
+  { validations: IValidation[] }
+> = {
+  software: {
+    validations: [
+      {
+        name: "required",
+        isValid: (formData) => formData.software !== null,
+      },
+    ],
+  },
+  preInstallQuery: {
+    validations: [
+      {
+        name: "invalidQuery",
+        isValid: (formData) => {
+          const query = formData.preInstallQuery;
+          return (
+            query === undefined || query === "" || validateQuery(query).valid
+          );
+        },
+        message: (formData) => validateQuery(formData.preInstallQuery).error,
+      },
+    ],
+  },
+  postInstallScript: {
+    // no validations related to postInstallScript
+    validations: [],
+  },
+  selfService: {
+    // no validations related to self service
+    validations: [],
+  },
+};
+
+const getErrorMessage = (
+  formData: IPackageFormData,
+  message?: IValidationMessage
+) => {
+  if (message === undefined || typeof message === "string") {
+    return message;
+  }
+  return message(formData);
+};
+
+export const generateFormValidation = (formData: IPackageFormData) => {
+  const formValidation: IFormValidation = {
+    isValid: true,
+    software: {
+      isValid: false,
+    },
+  };
+
+  Object.keys(FORM_VALIDATION_CONFIG).forEach((key) => {
+    const objKey = key as keyof typeof FORM_VALIDATION_CONFIG;
+    const failedValidation = FORM_VALIDATION_CONFIG[objKey].validations.find(
+      (validation) => !validation.isValid(formData)
+    );
+
+    if (!failedValidation) {
+      formValidation[objKey] = {
+        isValid: true,
+      };
+    } else {
+      formValidation.isValid = false;
+      formValidation[objKey] = {
+        isValid: false,
+        message: getErrorMessage(formData, failedValidation.message),
+      };
+    }
+  });
+
+  return formValidation;
+};
+
+export default generateFormValidation;
diff --git a/frontend/pages/SoftwarePage/components/PackageForm/index.ts b/frontend/pages/SoftwarePage/components/PackageForm/index.ts
new file mode 100644
index 0000000000..30c933af55
--- /dev/null
+++ b/frontend/pages/SoftwarePage/components/PackageForm/index.ts
@@ -0,0 +1 @@
+export { default } from "./PackageForm";
diff --git a/frontend/pages/SoftwarePage/components/SoftwareFiltersModal/SoftwareFiltersModal.tsx b/frontend/pages/SoftwarePage/components/SoftwareFiltersModal/SoftwareFiltersModal.tsx
new file mode 100644
index 0000000000..91223b5746
--- /dev/null
+++ b/frontend/pages/SoftwarePage/components/SoftwareFiltersModal/SoftwareFiltersModal.tsx
@@ -0,0 +1,127 @@
+import React, { useState } from "react";
+
+// @ts-ignore
+import Dropdown from "components/forms/fields/Dropdown";
+import Modal from "components/Modal";
+import Button from "components/buttons/Button";
+import Slider from "components/forms/fields/Slider";
+import Checkbox from "components/forms/fields/Checkbox";
+import TooltipWrapper from "components/TooltipWrapper";
+import {
+  findOptionBySeverityRange,
+  ISoftwareVulnFilters,
+  ISoftwareVulnFiltersParams,
+  SEVERITY_DROPDOWN_OPTIONS,
+} from "pages/SoftwarePage/SoftwareTitles/SoftwareTable/helpers";
+
+const baseClass = "software-filters-modal";
+
+interface ISoftwareFiltersModalProps {
+  onExit: () => void;
+  onSubmit: (vulnFilters: ISoftwareVulnFiltersParams) => void;
+  vulnFilters: ISoftwareVulnFiltersParams;
+  isPremiumTier: boolean;
+}
+
+const SoftwareFiltersModal = ({
+  onExit,
+  onSubmit,
+  vulnFilters,
+  isPremiumTier,
+}: ISoftwareFiltersModalProps) => {
+  const [vulnSoftwareFilterEnabled, setVulnSoftwareFilterEnabled] = useState(
+    vulnFilters.vulnerable || false
+  );
+  const [severity, setSeverity] = useState(
+    findOptionBySeverityRange(
+      vulnFilters.minCvssScore,
+      vulnFilters.maxCvssScore
+    )
+  );
+  const [hasKnownExploit, setHasKnownExploit] = useState(vulnFilters.exploit);
+
+  const onChangeSeverity = (value: string) => {
+    const selectedOption = SEVERITY_DROPDOWN_OPTIONS.find(
+      (option) => option.value === value
+    );
+    if (selectedOption) {
+      setSeverity(selectedOption);
+    }
+  };
+
+  const onApplyFilters = () => {
+    onSubmit({
+      vulnerable: vulnSoftwareFilterEnabled,
+      exploit: hasKnownExploit || undefined,
+      minCvssScore: severity?.minSeverity || undefined,
+      maxCvssScore: severity?.maxSeverity || undefined,
+    });
+  };
+
+  const renderSeverityLabel = () => {
+    return (
+      <TooltipWrapper
+        tipContent="The worst case impact across different environments (CVSS version 3.x base score)."
+        clickable={false}
+      >
+        Severity
+      </TooltipWrapper>
+    );
+  };
+
+  const renderModalContent = () => {
+    return (
+      <>
+        <Slider
+          value={vulnSoftwareFilterEnabled}
+          onChange={() =>
+            setVulnSoftwareFilterEnabled(!vulnSoftwareFilterEnabled)
+          }
+          inactiveText="Vulnerable software"
+          activeText="Vulnerable software"
+        />
+        {isPremiumTier && (
+          <Dropdown
+            label={renderSeverityLabel()}
+            options={SEVERITY_DROPDOWN_OPTIONS}
+            value={severity}
+            onChange={onChangeSeverity}
+            placeholder="Any severity"
+            className={`${baseClass}__select-severity`}
+            disabled={!vulnSoftwareFilterEnabled}
+          />
+        )}
+        {isPremiumTier && (
+          <Checkbox
+            onChange={({ value }: { value: boolean }) =>
+              setHasKnownExploit(value)
+            }
+            name="hasKnownExploit"
+            value={hasKnownExploit}
+            parseTarget
+            helpText="Software has vulnerabilities that have been actively exploited in the wild."
+            disabled={!vulnSoftwareFilterEnabled}
+          >
+            Has known exploit
+          </Checkbox>
+        )}
+        <div className="modal-cta-wrap">
+          <Button variant="brand" onClick={onApplyFilters}>
+            Apply
+          </Button>
+          <Button variant="inverse" onClick={onExit}>
+            Cancel
+          </Button>
+        </div>
+      </>
+    );
+  };
+
+  return (
+    <Modal title="Filters" onExit={onExit} className={baseClass}>
+      {renderModalContent()}
+    </Modal>
+  );
+};
+
+export default SoftwareFiltersModal;
diff --git a/frontend/pages/SoftwarePage/components/SoftwareFiltersModal/_styles.scss b/frontend/pages/SoftwarePage/components/SoftwareFiltersModal/_styles.scss
new file mode 100644
index 0000000000..6239c7da77
--- /dev/null
+++ b/frontend/pages/SoftwarePage/components/SoftwareFiltersModal/_styles.scss
@@ -0,0 +1,15 @@
+.software-filters-modal {
+  .select-menu-outer {
+    min-height: 500px;
+  }
+
+  .modal__content {
+    display: flex;
+    flex-direction: column;
+    gap: $pad-medium;
+  }
+
+  .Select-menu {
+    padding-bottom: $pad-medium;
+  }
+}
diff --git a/frontend/pages/SoftwarePage/components/SoftwareFiltersModal/index.ts b/frontend/pages/SoftwarePage/components/SoftwareFiltersModal/index.ts
new file mode 100644
index 0000000000..7afc56184c
--- /dev/null
+++ b/frontend/pages/SoftwarePage/components/SoftwareFiltersModal/index.ts
@@ -0,0 +1 @@
+export { default } from "./SoftwareFiltersModal";
diff --git a/frontend/pages/SoftwarePage/components/VulnerabilitiesCell/VulnerabilitiesCell.tsx b/frontend/pages/SoftwarePage/components/VulnerabilitiesCell/VulnerabilitiesCell.tsx
index be607717e7..2ba4ba1775 100644
--- a/frontend/pages/SoftwarePage/components/VulnerabilitiesCell/VulnerabilitiesCell.tsx
+++ b/frontend/pages/SoftwarePage/components/VulnerabilitiesCell/VulnerabilitiesCell.tsx
@@ -61,7 +61,7 @@ const generateTooltip = (
     return null;
   }
 
-  const condensedVulnerabilties = condenseVulnerabilities(vulnerabilities);
+  const condensedVulnerabilities = condenseVulnerabilities(vulnerabilities);
 
   return (
     <ReactTooltip
@@ -71,8 +71,10 @@ const generateTooltip = (
       data-html
     >
       <ul className={`${baseClass}__vulnerability-list`}>
-        {condensedVulnerabilties.map((vulnerability) => {
-          return <li>{vulnerability}</li>;
+        {condensedVulnerabilities.map((vulnerability) => {
+          const key =
+            typeof vulnerability === "string" ? vulnerability : uniqueId();
+          return <li key={key}>{vulnerability}</li>;
         })}
       </ul>
     </ReactTooltip>
diff --git a/frontend/pages/SoftwarePage/components/icons/SoftwareIcon/_styles.scss b/frontend/pages/SoftwarePage/components/icons/SoftwareIcon/_styles.scss
index a94db1daa5..bb62bd5cb8 100644
--- a/frontend/pages/SoftwarePage/components/icons/SoftwareIcon/_styles.scss
+++ b/frontend/pages/SoftwarePage/components/icons/SoftwareIcon/_styles.scss
@@ -22,6 +22,10 @@
     display: block;
   }
 
+  // These following classs are when a software icon is passed a url prop. In
+  // this case we need to add custom width,height, and padding to show these
+  // icons correctly.
+
   // we use this selector to give higher specifity than the selector
   // ".core-wrapper a img" which is in /styles/global/_styles.scss
   // TODO: we should change ".core-wrapper a img" selector in that file
@@ -34,6 +38,22 @@
     margin-left: 0;
   }
 
+  >img.software-icon__software-img-medium {
+    width: 38px;
+    height: 38px;
+    border-radius: $border-radius-xlarge;
+    padding: 1px;
+    margin-left: 0;
+  }
+
+  >img.software-icon__software-img-large {
+    width: 60px;
+    height: 60px;
+    border-radius: $border-radius-xxlarge;
+    padding: 1px;
+    margin-left: 0;
+  }
+
   >img.software-icon__software-img-xlarge {
     width: 88px;
     height: 88px;
diff --git a/frontend/pages/SoftwarePage/components/icons/index.ts b/frontend/pages/SoftwarePage/components/icons/index.ts
index 59e6187009..2c8d355f7e 100644
--- a/frontend/pages/SoftwarePage/components/icons/index.ts
+++ b/frontend/pages/SoftwarePage/components/icons/index.ts
@@ -45,6 +45,7 @@ const SOFTWARE_NAME_TO_ICON_MAP = {
   "microsoft teams": Teams,
   "visual studio code": VisualStudioCode,
   "microsoft word": Word,
+  "google chrome": ChromeApp,
   darwin: MacOS,
   windows: WindowsOS,
   chrome: ChromeOS,
@@ -113,8 +114,6 @@ const matchStrictNameSourceToIcon = ({
       return Zoom;
     case name === "zoom":
       return Zoom;
-    case name === "google chrome":
-      return ChromeApp;
     default:
       return null;
   }
diff --git a/frontend/pages/admin/IntegrationsPage/IntegrationNavItems.tsx b/frontend/pages/admin/IntegrationsPage/IntegrationNavItems.tsx
index 908974e119..3669bac65e 100644
--- a/frontend/pages/admin/IntegrationsPage/IntegrationNavItems.tsx
+++ b/frontend/pages/admin/IntegrationsPage/IntegrationNavItems.tsx
@@ -3,9 +3,7 @@ import PATHS from "router/paths";
 import { ISideNavItem } from "../components/SideNav/SideNav";
 import Integrations from "./cards/Integrations";
 import MdmSettings from "./cards/MdmSettings";
-import AutomaticEnrollment from "./cards/AutomaticEnrollment";
 import Calendars from "./cards/Calendars";
-import Vpp from "./cards/Vpp";
 
 const integrationSettingsNavItems: ISideNavItem<any>[] = [
   // TODO: types
@@ -21,24 +19,12 @@ const integrationSettingsNavItems: ISideNavItem<any>[] = [
     path: PATHS.ADMIN_INTEGRATIONS_MDM,
     Card: MdmSettings,
   },
-  {
-    title: "Automatic enrollment",
-    urlSection: "automatic-enrollment",
-    path: PATHS.ADMIN_INTEGRATIONS_AUTOMATIC_ENROLLMENT,
-    Card: AutomaticEnrollment,
-  },
   {
     title: "Calendars",
     urlSection: "calendars",
     path: PATHS.ADMIN_INTEGRATIONS_CALENDARS,
     Card: Calendars,
   },
-  {
-    title: "Volume Purchasing Program (VPP)",
-    urlSection: "vpp",
-    path: PATHS.ADMIN_INTEGRATIONS_VPP,
-    Card: Vpp,
-  },
 ];
 
 export default integrationSettingsNavItems;
diff --git a/frontend/pages/admin/IntegrationsPage/IntegrationPage.tests.tsx b/frontend/pages/admin/IntegrationsPage/IntegrationPage.tests.tsx
index a567506653..af91a14787 100644
--- a/frontend/pages/admin/IntegrationsPage/IntegrationPage.tests.tsx
+++ b/frontend/pages/admin/IntegrationsPage/IntegrationPage.tests.tsx
@@ -1,24 +1,14 @@
 import React from "react";
 import { screen } from "@testing-library/react";
 
-import { createCustomRenderer } from "test/test-utils";
+import { createCustomRenderer, createMockRouter } from "test/test-utils";
 import IntegrationsPage from "./IntegrationsPage";
 
-// TODO: figure out how to mock the router properly.
-const mockRouter = {
-  push: jest.fn(),
-  replace: jest.fn(),
-  goBack: jest.fn(),
-  goForward: jest.fn(),
-  go: jest.fn(),
-  setRouteLeaveHook: jest.fn(),
-  isActive: jest.fn(),
-  createHref: jest.fn(),
-  createPath: jest.fn(),
-};
-
 describe("Integrations Page", () => {
+  // TODO: change this test to cover rendering all other sections displayed.
   it("renders the MDM sidenav and content if MDM feature is enabled", () => {
+    const mockRouter = createMockRouter();
+
     const render = createCustomRenderer({
       withBackendMock: true,
       context: {
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/AppleAutomaticEnrollmentPage/AppleAutomaticEnrollmentPage.tsx b/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/AppleAutomaticEnrollmentPage/AppleAutomaticEnrollmentPage.tsx
deleted file mode 100644
index 1bf40cbb75..0000000000
--- a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/AppleAutomaticEnrollmentPage/AppleAutomaticEnrollmentPage.tsx
+++ /dev/null
@@ -1,288 +0,0 @@
-import React, { useCallback, useContext, useState } from "react";
-
-import { useQuery } from "react-query";
-import { InjectedRouter } from "react-router";
-
-import { AxiosError } from "axios";
-
-import PATHS from "router/paths";
-
-import { NotificationContext } from "context/notification";
-import { getErrorReason } from "interfaces/errors";
-import { IMdmAppleBm } from "interfaces/mdm";
-import mdmAppleBmAPI from "services/entities/mdm_apple_bm";
-import { readableDate } from "utilities/helpers";
-
-import BackLink from "components/BackLink";
-import Button from "components/buttons/Button";
-import CustomLink from "components/CustomLink/CustomLink";
-import DataError from "components/DataError";
-import FileUploader from "components/FileUploader";
-import MainContent from "components/MainContent";
-import Spinner from "components/Spinner";
-
-import DownloadKey from "../../../../components/DownloadFileButtons/DownloadABMKey";
-import DisableAutomaticEnrollmentModal from "./modals/DisableAutomaticEnrollmentModal";
-import RenewTokenModal from "./modals/RenewTokenModal";
-
-const baseClass = "apple-automatic-enrollment-page";
-
-const ButtonWrap = ({
-  onClickDisable,
-  onClickRenew,
-}: {
-  onClickDisable: () => void;
-  onClickRenew: () => void;
-}) => {
-  return (
-    <div className={`${baseClass}__button-wrap`}>
-      <Button variant="inverse" onClick={onClickDisable}>
-        Disable automatic enrollment
-      </Button>
-      <Button variant="brand" onClick={onClickRenew}>
-        Renew token
-      </Button>
-    </div>
-  );
-};
-
-const AppleAutomaticEnrollmentPage = ({
-  router,
-}: {
-  router: InjectedRouter;
-}) => {
-  const { renderFlash } = useContext(NotificationContext);
-
-  const [isUploading, setIsUploading] = useState(false);
-  const [showDisableModal, setShowDisableModal] = useState(false);
-  const [showRenewModal, setShowRenewModal] = useState(false);
-
-  const {
-    data: mdmAppleBm,
-    error: errorMdmAppleBm,
-    isLoading,
-    isRefetching,
-    refetch,
-  } = useQuery<IMdmAppleBm, AxiosError, IMdmAppleBm>(
-    ["mdmAppleBmAPI"],
-    () => mdmAppleBmAPI.getAppleBMInfo(),
-    {
-      refetchOnWindowFocus: false,
-      retry: (tries, error) =>
-        error.status !== 404 && error.status !== 400 && tries <= 3,
-    }
-  );
-
-  const uploadToken = useCallback(
-    async (data: FileList | null) => {
-      setIsUploading(true);
-      const token = data?.[0];
-      if (!token) {
-        setIsUploading(false);
-        renderFlash("error", "No token selected.");
-        return;
-      }
-
-      try {
-        await mdmAppleBmAPI.uploadToken(token);
-        renderFlash(
-          "success",
-          "Automatic enrollment for macOS hosts is enabled."
-        );
-        router.push(PATHS.ADMIN_INTEGRATIONS_AUTOMATIC_ENROLLMENT);
-      } catch (e) {
-        const msg = getErrorReason(e);
-        if (msg.toLowerCase().includes("valid token")) {
-          renderFlash("error", msg);
-        } else {
-          renderFlash("error", "Couldn’t enable. Please try again.");
-        }
-      } finally {
-        setIsUploading(false);
-      }
-    },
-    [renderFlash, router]
-  );
-
-  const onClickDisable = useCallback(() => {
-    setShowDisableModal(true);
-  }, []);
-
-  const onClickRenew = useCallback(() => {
-    setShowRenewModal(true);
-  }, []);
-
-  const disableAutomaticEnrollment = useCallback(async () => {
-    try {
-      await mdmAppleBmAPI.disableAutomaticEnrollment();
-      renderFlash("success", "Automatic enrollment disabled successfully.");
-      router.push(PATHS.ADMIN_INTEGRATIONS_AUTOMATIC_ENROLLMENT);
-    } catch (e) {
-      renderFlash(
-        "error",
-        "Couldn’t disable automatic enrollment. Please try again."
-      );
-      setShowDisableModal(false);
-    }
-  }, [renderFlash, router]);
-
-  const onCancelDisable = useCallback(() => {
-    setShowDisableModal(false);
-  }, []);
-
-  const onRenew = useCallback(() => {
-    refetch();
-    setShowRenewModal(false);
-  }, [refetch]);
-
-  const onCancelRenew = useCallback(() => {
-    setShowRenewModal(false);
-  }, []);
-
-  if (isLoading || isRefetching) {
-    return <Spinner />;
-  }
-
-  const showDataError = errorMdmAppleBm && errorMdmAppleBm.status !== 404;
-  const showConnectAbm = !mdmAppleBm;
-
-  return (
-    <MainContent className={baseClass}>
-      <>
-        <BackLink
-          text="Back to automatic enrollment"
-          path={PATHS.ADMIN_INTEGRATIONS_AUTOMATIC_ENROLLMENT}
-          className={`${baseClass}__back-to-automatic-enrollment`}
-        />
-        <h1>Apple Business Manager (ABM)</h1>
-        {showDataError && (
-          <div>
-            <DataError />
-            <ButtonWrap
-              onClickDisable={onClickDisable}
-              onClickRenew={onClickRenew}
-            />
-          </div>
-        )}
-        {!showDataError && !showConnectAbm && (
-          <div>
-            <h4>Apple ID</h4>
-            <p>{mdmAppleBm.apple_id}</p>
-            <h4>Organization name</h4>
-            <p>{mdmAppleBm.org_name}</p>
-            <h4>MDM server URL</h4>
-            <p>{mdmAppleBm.mdm_server_url}</p>
-            <h4>Renew date</h4>
-            <p>{readableDate(mdmAppleBm.renew_date)}</p>
-            <ButtonWrap
-              onClickDisable={onClickDisable}
-              onClickRenew={onClickRenew}
-            />
-          </div>
-        )}
-        {!showDataError && showConnectAbm && (
-          <>
-            <p>
-              Connect Fleet to your Apple Business Manager account to
-              automatically enroll macOS hosts to Fleet when they’re first
-              booted.{" "}
-            </p>
-            {/* Ideally we'd use the native browser list styles and css to display
-        the list numbers but this does not allow us to style the list items as we'd
-        like so we write the numbers in the JSX instead. */}
-            <ol className={`${baseClass}__setup-list`}>
-              <li>
-                <span>1.</span>
-                <p>
-                  Download your public key.{" "}
-                  <DownloadKey baseClass={baseClass} />
-                </p>
-              </li>
-              <li>
-                <span>2.</span>
-                <span>
-                  <span>
-                    Sign in to{" "}
-                    <CustomLink
-                      newTab
-                      text="Apple Business Manager"
-                      url="https://business.apple.com"
-                    />
-                    <br />
-                    If your organization doesn’t have an account, select{" "}
-                    <b>Sign up now</b>.
-                  </span>
-                </span>
-              </li>
-              <li>
-                <span>3.</span>
-                <span>
-                  Select your <b>account name</b> at the bottom left of the
-                  screen, then select <b>Preferences</b>.
-                </span>
-              </li>
-              <li>
-                <span>4.</span>
-                <span>
-                  In the <b>Your MDM Servers</b> section, select <b>Add</b>.
-                </span>
-              </li>
-              <li>
-                <span>5.</span>
-                <span>Enter a name for the server such as “Fleet”.</span>
-              </li>
-              <li>
-                <span>6.</span>
-                <span>
-                  Under <b>MDM Server Settings</b>, upload the public key
-                  downloaded in the first step and select <b>Save</b>.
-                </span>
-              </li>
-              <li>
-                <span>7.</span>
-                <span>
-                  In the <b>Default Device Assignment</b> section, select{" "}
-                  <b>Change</b>, then assign the newly created server as the
-                  default for your Macs, and select <b>Done</b>.
-                </span>
-              </li>
-              <li>
-                <span>8.</span>
-                <span>
-                  Select newly created server in the sidebar, then select{" "}
-                  <b>Download Token</b> on the top.
-                </span>
-              </li>
-              <li>
-                <span>9.</span>
-                <span>Upload the downloaded token (.p7m file).</span>
-              </li>
-            </ol>
-            <FileUploader
-              className={`${baseClass}__file-uploader ${
-                isUploading ? `${baseClass}__file-uploader--loading` : ""
-              }`}
-              accept=".p7m"
-              message="ABM token (.p7m)"
-              graphicName={"file-p7m"}
-              buttonType="link"
-              buttonMessage={isUploading ? "Uploading..." : "Upload"}
-              onFileUpload={uploadToken}
-            />
-          </>
-        )}
-      </>
-      {showDisableModal && (
-        <DisableAutomaticEnrollmentModal
-          onCancel={onCancelDisable}
-          onConfirm={disableAutomaticEnrollment}
-        />
-      )}
-      {showRenewModal && (
-        <RenewTokenModal onCancel={onCancelRenew} onRenew={onRenew} />
-      )}
-    </MainContent>
-  );
-};
-
-export default AppleAutomaticEnrollmentPage;
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/AppleAutomaticEnrollmentPage/_styles.scss b/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/AppleAutomaticEnrollmentPage/_styles.scss
deleted file mode 100644
index 7f47c4dbd4..0000000000
--- a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/AppleAutomaticEnrollmentPage/_styles.scss
+++ /dev/null
@@ -1,110 +0,0 @@
-.apple-automatic-enrollment-page {
-  &__back-to-automatic-enrollment {
-    margin-bottom: $pad-xlarge;
-  }
-
-  h1 {
-    margin-bottom: $pad-xxlarge;
-    font-size: $large;
-  }
-
-  h4 {
-    margin-bottom: 0;
-    font-size: $x-small;
-  }
-
-  p {
-    font-size: $x-small;
-    margin: 0 0 $pad-large;
-  }
-
-  &__setup-list {
-    font-size: $x-small;
-    display: flex;
-    flex-direction: column;
-    gap: $pad-large;
-    padding: 0;
-    margin: 0;
-    max-width: 660px;
-    list-style: none;
-
-    li {
-      display: flex;
-      flex-direction: row;
-      gap: $pad-small;
-
-      p {
-        display: flex;
-        flex-direction: column;
-        align-items: flex-start;
-        margin: 0;
-      }
-    }
-  }
-
-  &__url-inputs-wrapper {
-    display: flex;
-    flex-direction: column;
-    gap: $pad-icon;
-    margin-top: $pad-large;
-  }
-
-  &__url-input {
-    margin-bottom: 0;
-  }
-
-  &__permissions-list {
-    margin-top: $pad-large;
-    list-style: disc;
-    display: flex;
-    flex-direction: column;
-    gap: $pad-medium;
-  }
-
-  &__request-button {
-    display: flex;
-    gap: $pad-small;
-    align-items: center;
-    margin-top: $pad-small;
-
-    label {
-      display: flex;
-      gap: $pad-small;
-      cursor: pointer;
-    }
-  }
-
-  &__file-uploader {
-    margin-top: $pad-medium;
-    margin-left: $pad-medium;
-    border-radius: 6px;
-
-    .file-uploader__message {
-      color: $ui-fleet-black-75;
-      margin: 0;
-    }
-
-    button {
-      margin-top: 0;
-    }
-
-    &--loading {
-      label {
-        opacity: 0.5;
-      }
-    }
-  }
-  &__button-wrap {
-    display: flex;
-    gap: $pad-medium;
-  }
-
-  // TODO: remove these styles when the updated error component is used
-  .data-error {
-    margin: $pad-xxlarge 0;
-    padding: $pad-xlarge 0;
-  }
-  .data-error__inner {
-    padding: $pad-xlarge 0;
-  }
-}
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/AppleAutomaticEnrollmentPage/index.ts b/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/AppleAutomaticEnrollmentPage/index.ts
deleted file mode 100644
index f488014c97..0000000000
--- a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/AppleAutomaticEnrollmentPage/index.ts
+++ /dev/null
@@ -1 +0,0 @@
-export { default } from "./AppleAutomaticEnrollmentPage";
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/AppleAutomaticEnrollmentPage/modals/DisableAutomaticEnrollmentModal.tsx b/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/AppleAutomaticEnrollmentPage/modals/DisableAutomaticEnrollmentModal.tsx
deleted file mode 100644
index b15b1a0b67..0000000000
--- a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/AppleAutomaticEnrollmentPage/modals/DisableAutomaticEnrollmentModal.tsx
+++ /dev/null
@@ -1,61 +0,0 @@
-import React, { useCallback, useState } from "react";
-
-import Button from "components/buttons/Button";
-
-import Modal from "components/Modal";
-
-const baseClass = "modal disable-automatic-enrollment-modal";
-
-interface IDisableAutomaticEnrollmentModalProps {
-  onCancel: () => void;
-  onConfirm: () => void;
-}
-
-const DisableAutomaticEnrollmentModal = ({
-  onConfirm,
-  onCancel,
-}: IDisableAutomaticEnrollmentModalProps): JSX.Element => {
-  const [isDeleting, setIsDeleting] = useState(false);
-
-  const onClickConfirm: React.MouseEventHandler<HTMLButtonElement> = useCallback(() => {
-    setIsDeleting(true);
-    onConfirm();
-  }, [onConfirm]);
-
-  return (
-    <Modal
-      title="Disable macOS automatic enrollment"
-      onExit={onCancel}
-      className={baseClass}
-    >
-      <div className={baseClass}>
-        New macOS hosts won’t automatically enroll to Fleet.
-        <br />
-        <br />
-        If you want to enable automatic enrollment, you’ll have to create a new
-        MDM server in Apple Business Manager, reassign all devices, and upload
-        your new server token in Fleet.{" "}
-        <div className="modal-cta-wrap">
-          <Button
-            type="button"
-            variant="alert"
-            onClick={onClickConfirm}
-            disabled={isDeleting}
-            isLoading={isDeleting}
-          >
-            Disable
-          </Button>
-          <Button
-            onClick={onCancel}
-            disabled={isDeleting}
-            variant="inverse-alert"
-          >
-            Cancel
-          </Button>
-        </div>
-      </div>
-    </Modal>
-  );
-};
-
-export default DisableAutomaticEnrollmentModal;
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/AppleAutomaticEnrollmentPage/modals/RenewTokenModal/index.ts b/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/AppleAutomaticEnrollmentPage/modals/RenewTokenModal/index.ts
deleted file mode 100644
index 2714cd78b9..0000000000
--- a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/AppleAutomaticEnrollmentPage/modals/RenewTokenModal/index.ts
+++ /dev/null
@@ -1 +0,0 @@
-export { default } from "./RenewTokenModal";
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/AutomaticEnrollment.tsx b/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/AutomaticEnrollment.tsx
deleted file mode 100644
index 2040e0fdaa..0000000000
--- a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/AutomaticEnrollment.tsx
+++ /dev/null
@@ -1,89 +0,0 @@
-import React, { useContext } from "react";
-import { useQuery } from "react-query";
-import { AxiosError } from "axios";
-import { InjectedRouter } from "react-router";
-
-import PATHS from "router/paths";
-import { AppContext } from "context/app";
-import { IMdmApple } from "interfaces/mdm";
-import mdmAppleAPI from "services/entities/mdm_apple";
-
-import Spinner from "components/Spinner";
-import DataError from "components/DataError";
-import PremiumFeatureMessage from "components/PremiumFeatureMessage/PremiumFeatureMessage";
-import EmptyTable from "components/EmptyTable/EmptyTable";
-import Button from "components/buttons/Button/Button";
-
-import MdmPlatformsSection from "./components/MdmPlatformsSection/MdmPlatformsSection";
-import DefaultTeamSection from "./components/DefaultTeamSection/DefaultTeamSection";
-import IdpSection from "./components/IdpSection/IdpSection";
-import EulaSection from "./components/EulaSection/EulaSection";
-
-const baseClass = "automatic-enrollment";
-
-interface IAutomaticEnrollment {
-  router: InjectedRouter;
-}
-
-const AutomaticEnrollment = ({ router }: IAutomaticEnrollment) => {
-  const { config, isPremiumTier } = useContext(AppContext);
-
-  const { isLoading: isLoadingAPNInfo, error: errorAPNInfo } = useQuery<
-    IMdmApple,
-    AxiosError
-  >(["appleAPNInfo"], () => mdmAppleAPI.getAppleAPNInfo(), {
-    refetchOnWindowFocus: false,
-    retry: false,
-    enabled: config?.mdm.enabled_and_configured,
-  });
-
-  const onClickConnect = () => {
-    router.push(PATHS.ADMIN_INTEGRATIONS_MDM);
-  };
-
-  if (!isPremiumTier) return <PremiumFeatureMessage />;
-
-  if (isLoadingAPNInfo) {
-    return (
-      <div className={baseClass}>
-        <Spinner />
-      </div>
-    );
-  }
-
-  if (errorAPNInfo?.status === 404) {
-    return (
-      <EmptyTable
-        header="Automatic enrollment for macOS hosts"
-        info="Connect Fleet to the Apple Push Certificates Portal to get started."
-        primaryButton={<Button onClick={onClickConnect}>Connect</Button>}
-        className={`${baseClass}__connect-message`}
-      />
-    );
-  }
-
-  if (errorAPNInfo) {
-    return <DataError />;
-  }
-
-  return (
-    <div className={baseClass}>
-      <div className={`${baseClass}__section`}>
-        <MdmPlatformsSection router={router} />
-      </div>
-      {!!config?.mdm.apple_bm_enabled_and_configured && (
-        <div className={`${baseClass}__section`}>
-          <DefaultTeamSection />
-        </div>
-      )}
-      <div className={`${baseClass}__section`}>
-        <IdpSection />
-      </div>
-      <div className={`${baseClass}__section`}>
-        <EulaSection />
-      </div>
-    </div>
-  );
-};
-
-export default AutomaticEnrollment;
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/_styles.scss b/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/_styles.scss
deleted file mode 100644
index c09bd27fa9..0000000000
--- a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/_styles.scss
+++ /dev/null
@@ -1,9 +0,0 @@
-.automatic-enrollment {
-  &__connect-message {
-    margin-top: 0;
-  }
-
-  &__section {
-    margin-bottom: $pad-xxlarge;
-  }
-}
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/DefaultTeamSection/DefaultTeamSection.tsx b/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/DefaultTeamSection/DefaultTeamSection.tsx
deleted file mode 100644
index f4d11ed3f8..0000000000
--- a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/DefaultTeamSection/DefaultTeamSection.tsx
+++ /dev/null
@@ -1,55 +0,0 @@
-import React, { useCallback, useContext, useState } from "react";
-
-import { AppContext } from "context/app";
-
-import Button from "components/buttons/Button";
-import Icon from "components/Icon";
-import SectionHeader from "components/SectionHeader";
-import TooltipWrapper from "components/TooltipWrapper";
-import EditTeamModal from "../EditTeamModal";
-
-const baseClass = "default-team-section";
-
-const DefaultTeamSection = () => {
-  const { config } = useContext(AppContext);
-  const [showEditTeamModal, setShowEditTeamModal] = useState(false);
-
-  const toggleEditTeamModal = useCallback(() => {
-    setShowEditTeamModal((prev) => !prev);
-  }, []);
-
-  const defaultTeamName = config?.mdm?.apple_bm_default_team || "No team";
-
-  return (
-    <div className={`${baseClass}`}>
-      <SectionHeader title="Default team" />
-      <p>macOS hosts automatically enroll to this team.</p>
-      <h4>
-        <TooltipWrapper
-          position="top-start"
-          tipContent="macOS hosts will be added to this team when they’re first unboxed."
-        >
-          Team
-        </TooltipWrapper>
-      </h4>
-      <p>
-        {config?.mdm?.apple_bm_default_team || "No team"}{" "}
-        <Button
-          className={`${baseClass}__edit-team-btn`}
-          onClick={toggleEditTeamModal}
-          variant="text-icon"
-        >
-          Edit <Icon name="pencil" />
-        </Button>
-      </p>
-      {showEditTeamModal && (
-        <EditTeamModal
-          defaultTeamName={defaultTeamName}
-          onCancel={toggleEditTeamModal}
-        />
-      )}
-    </div>
-  );
-};
-
-export default DefaultTeamSection;
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/DefaultTeamSection/_styles.scss b/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/DefaultTeamSection/_styles.scss
deleted file mode 100644
index 3d96a55416..0000000000
--- a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/DefaultTeamSection/_styles.scss
+++ /dev/null
@@ -1,16 +0,0 @@
-.default-team-section {
-  h4 {
-    margin: $pad-medium 0 0;
-    font-size: $x-small;
-  }
-
-  p {
-    display: flex;
-    align-items: center;
-    margin: 0;
-  }
-
-  &__edit-team-btn {
-    margin-left: $pad-medium;
-  }
-}
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/DefaultTeamSection/index.ts b/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/DefaultTeamSection/index.ts
deleted file mode 100644
index a2168a26a8..0000000000
--- a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/DefaultTeamSection/index.ts
+++ /dev/null
@@ -1 +0,0 @@
-export { default } from "./DefaultTeamSection";
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EditTeamModal/EditTeamModal.tsx b/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EditTeamModal/EditTeamModal.tsx
deleted file mode 100644
index 429e776129..0000000000
--- a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EditTeamModal/EditTeamModal.tsx
+++ /dev/null
@@ -1,101 +0,0 @@
-import React, { useState, useContext, FormEvent, useCallback } from "react";
-
-import { AppContext } from "context/app";
-import { NotificationContext } from "context/notification";
-import {
-  APP_CONTEXT_NO_TEAM_ID,
-  APP_CONTEX_NO_TEAM_SUMMARY,
-} from "interfaces/team";
-import configAPI from "services/entities/config";
-
-// @ts-ignore
-import Dropdown from "components/forms/fields/Dropdown";
-import Modal from "components/Modal";
-import Button from "components/buttons/Button";
-
-interface IEditTeamModal {
-  onCancel: () => void;
-  defaultTeamName: string;
-}
-
-const baseClass = "edit-team-modal";
-
-const EditTeamModal = ({
-  onCancel,
-  defaultTeamName,
-}: IEditTeamModal): JSX.Element => {
-  const { availableTeams, setConfig } = useContext(AppContext);
-  const { renderFlash } = useContext(NotificationContext);
-
-  const [selectedTeam, setSelectedTeam] = useState(defaultTeamName);
-
-  const teamNameOptions = availableTeams
-    ?.filter((t) => t.id >= APP_CONTEXT_NO_TEAM_ID)
-    .map((teamSummary) => {
-      return {
-        value:
-          teamSummary.name === APP_CONTEX_NO_TEAM_SUMMARY.name
-            ? ""
-            : teamSummary.name,
-        label: teamSummary.name,
-      };
-    });
-
-  const [isLoading, setIsLoading] = useState(false);
-
-  const handleUpdateTeam = useCallback(
-    async (newName: string) => {
-      try {
-        const configData = await configAPI.update({
-          mdm: { apple_bm_default_team: newName },
-        });
-        renderFlash("success", "Default team updated successfully.");
-        setConfig(configData);
-      } catch (e) {
-        renderFlash(
-          "error",
-          "Unable to update default team. Please try again."
-        );
-      } finally {
-        onCancel();
-      }
-    },
-    [renderFlash, setConfig, onCancel]
-  );
-
-  const onFormSubmit = useCallback(
-    (evt: FormEvent<HTMLFormElement>) => {
-      evt.preventDefault();
-      setIsLoading(true);
-      handleUpdateTeam(selectedTeam);
-    },
-    [selectedTeam, setIsLoading, handleUpdateTeam]
-  );
-
-  return (
-    <Modal title="Edit team" onExit={onCancel} className={baseClass}>
-      <form className={`${baseClass}__form`} onSubmit={onFormSubmit}>
-        <div className="bottom-label">
-          <Dropdown
-            placeholder={selectedTeam}
-            options={teamNameOptions}
-            onChange={setSelectedTeam}
-            value={selectedTeam}
-            label="Team"
-            helpText="macOS hosts will be added to this team when they're first unboxed."
-          />
-        </div>
-        <div className="modal-cta-wrap">
-          <Button type="submit" variant="brand" isLoading={isLoading}>
-            Save
-          </Button>
-          <Button onClick={onCancel} variant="inverse">
-            Cancel
-          </Button>
-        </div>
-      </form>
-    </Modal>
-  );
-};
-
-export default EditTeamModal;
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EditTeamModal/index.ts b/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EditTeamModal/index.ts
deleted file mode 100644
index 4e5065e76c..0000000000
--- a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EditTeamModal/index.ts
+++ /dev/null
@@ -1 +0,0 @@
-export { default } from "./EditTeamModal";
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/EulaSection.tsx b/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/EulaSection.tsx
deleted file mode 100644
index f37f10e3a4..0000000000
--- a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/EulaSection.tsx
+++ /dev/null
@@ -1,85 +0,0 @@
-import React, { useContext, useState } from "react";
-import { useQuery } from "react-query";
-import { AxiosResponse } from "axios";
-
-import { IApiError } from "interfaces/errors";
-import mdmAPI, { IEulaMetadataResponse } from "services/entities/mdm";
-import { NotificationContext } from "context/notification";
-
-import Spinner from "components/Spinner";
-import SectionHeader from "components/SectionHeader";
-
-import EulaUploader from "./components/EulaUploader/EulaUploader";
-import UploadedEulaView from "./components/UploadedEulaView/UploadedEulaView";
-import DeleteEulaModal from "./components/DeleteEulaModal/DeleteEulaModal";
-
-const baseClass = "eula-section";
-
-const EulaSection = () => {
-  const { renderFlash } = useContext(NotificationContext);
-  const [showDeleteEulaModal, setShowDeleteEulaModal] = useState(false);
-
-  const {
-    data: eulaMetadata,
-    isLoading,
-    error,
-    refetch: refetchEulaMetadata,
-  } = useQuery<IEulaMetadataResponse, AxiosResponse<IApiError>>(
-    ["eula-metadata"],
-    () => mdmAPI.getEULAMetadata(),
-    {
-      retry: false,
-      refetchOnWindowFocus: false,
-    }
-  );
-
-  const onUpload = () => {
-    refetchEulaMetadata();
-  };
-
-  const onDelete = async () => {
-    if (!eulaMetadata) return;
-
-    try {
-      await mdmAPI.deleteEULA(eulaMetadata.token);
-      renderFlash("success", "Successfully deleted!");
-    } catch {
-      renderFlash("error", "Couldn’t delete. Please try again.");
-    } finally {
-      setShowDeleteEulaModal(false);
-      refetchEulaMetadata();
-    }
-  };
-
-  // we are relying on the API to tell us this resource does not exist to
-  // determine if the user has uploaded a bootstrap package.
-  const noEulaUploaded = (error && error.status === 404) || !eulaMetadata;
-
-  return (
-    <div className={baseClass}>
-      <SectionHeader title="End user license agreement (EULA)" />
-      {isLoading ? (
-        <Spinner />
-      ) : (
-        <div className={`${baseClass}__content`}>
-          {noEulaUploaded ? (
-            <EulaUploader onUpload={onUpload} />
-          ) : (
-            <UploadedEulaView
-              eulaMetadata={eulaMetadata}
-              onDelete={() => setShowDeleteEulaModal(true)}
-            />
-          )}
-        </div>
-      )}
-      {showDeleteEulaModal && (
-        <DeleteEulaModal
-          onDelete={onDelete}
-          onCancel={() => setShowDeleteEulaModal(false)}
-        />
-      )}
-    </div>
-  );
-};
-
-export default EulaSection;
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/components/UploadedEulaView/_styles.scss b/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/components/UploadedEulaView/_styles.scss
deleted file mode 100644
index a2b5824ba7..0000000000
--- a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/components/UploadedEulaView/_styles.scss
+++ /dev/null
@@ -1,10 +0,0 @@
-.uploaded-eula-view {
-
-  > p {
-    font-size: $x-small;
-  }
-
-  .upload-list__list-item {
-    border-top: 1px solid $ui-fleet-black-10;
-  }
-}
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/MdmPlatformsSection/MdmPlatformsSection.tsx b/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/MdmPlatformsSection/MdmPlatformsSection.tsx
deleted file mode 100644
index f00fb5b7e4..0000000000
--- a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/MdmPlatformsSection/MdmPlatformsSection.tsx
+++ /dev/null
@@ -1,50 +0,0 @@
-import React, { useContext } from "react";
-import { InjectedRouter } from "react-router";
-import PATHS from "router/paths";
-import { AppContext } from "context/app";
-import SectionHeader from "components/SectionHeader";
-
-import WindowsAutomaticEnrollmentCard from "./components/WindowsAutomaticEnrollmentCard";
-import AppleAutomaticEnrollmentCard from "./components/AppleAutomaticEnrollmentCard";
-
-const baseClass = "mdm-platforms-section";
-
-interface IMdmPlatformsSectionProps {
-  router: InjectedRouter;
-}
-
-const MdmPlatformsSection = ({ router }: IMdmPlatformsSectionProps) => {
-  const { config } = useContext(AppContext);
-
-  const navigateToWindowsAutomaticEnrollment = () => {
-    router.push(PATHS.ADMIN_INTEGRATIONS_AUTOMATIC_ENROLLMENT_WINDOWS);
-  };
-
-  const navigateToAppleAutomaticEnrollment = () => {
-    router.push(PATHS.ADMIN_INTEGRATIONS_AUTOMATIC_ENROLLMENT_APPLE);
-  };
-
-  const navigateToApplePushCertSetup = () => {
-    router.push(PATHS.ADMIN_INTEGRATIONS_MDM);
-  };
-
-  return (
-    <div className={baseClass}>
-      <SectionHeader title="Apple Business Manager" />
-      <AppleAutomaticEnrollmentCard
-        viewDetails={navigateToAppleAutomaticEnrollment}
-        turnOn={
-          !config?.mdm.enabled_and_configured
-            ? navigateToApplePushCertSetup
-            : undefined
-        }
-        configured={!!config?.mdm.apple_bm_enabled_and_configured}
-      />
-      <WindowsAutomaticEnrollmentCard
-        viewDetails={navigateToWindowsAutomaticEnrollment}
-      />
-    </div>
-  );
-};
-
-export default MdmPlatformsSection;
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/MdmPlatformsSection/_styles.scss b/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/MdmPlatformsSection/_styles.scss
deleted file mode 100644
index eb17869fdb..0000000000
--- a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/MdmPlatformsSection/_styles.scss
+++ /dev/null
@@ -1,80 +0,0 @@
-.mdm-platforms-section {
-  h4 {
-    margin-bottom: 0;
-  }
-
-  .section-header {
-    margin-bottom: $pad-xxlarge;
-  }
-
-  .mdm-settings-team-btn {
-    margin-left: 12px;
-
-    .children-wrapper {
-      gap: $pad-small;
-    }
-  }
-
-  .component__tooltip-wrapper__tip-text {
-    max-width: initial;
-  }
-
-  &__section-description,
-  &__section-instructions,
-  &__section-information {
-    font-size: $x-small;
-    color: $core-fleet-black;
-    width: 100%;
-  }
-
-  &__section-information {
-    p {
-      margin: 0;
-    }
-  }
-
-  &__400-error-info {
-    display: block;
-    color: $core-fleet-black;
-    font-weight: normal;
-    font-size: $x-small;
-    text-align: left;
-    margin-top: 10px;
-  }
-}
-
-.automatic-enrollment-card {
-  margin-top: 0;
-  margin-bottom: $pad-xxlarge;
-  font-size: $x-small;
-  display: flex;
-  justify-content: space-between;
-  align-items: center;
-
-  h3 {
-    font-size: $x-small;
-    font-weight: $bold;
-    margin: 0 0 $pad-xsmall;
-  }
-
-  p {
-    margin: 0;
-    max-width: 520px;
-
-    span {
-      display: flex;
-      align-items: center;
-      gap: $pad-small;
-    }
-  }
-
-  &__turn-on-mdm {
-    flex-direction: column;
-    align-items: flex-start;
-    gap: $pad-medium;
-
-    .button {
-      height: auto;
-    }
-  }
-}
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/MdmPlatformsSection/index.ts b/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/MdmPlatformsSection/index.ts
deleted file mode 100644
index a8608e00c1..0000000000
--- a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/MdmPlatformsSection/index.ts
+++ /dev/null
@@ -1 +0,0 @@
-export { default } from "./MdmPlatformsSection";
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/index.ts b/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/index.ts
deleted file mode 100644
index bee5a5abf5..0000000000
--- a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/index.ts
+++ /dev/null
@@ -1 +0,0 @@
-export { default } from "./AutomaticEnrollment";
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/AppleBusinessManagerPage.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/AppleBusinessManagerPage.tsx
new file mode 100644
index 0000000000..c484171eeb
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/AppleBusinessManagerPage.tsx
@@ -0,0 +1,266 @@
+import React, { useCallback, useContext, useRef, useState } from "react";
+
+import { useQuery } from "react-query";
+import { InjectedRouter } from "react-router";
+
+import { AxiosError } from "axios";
+
+import PATHS from "router/paths";
+
+import { AppContext } from "context/app";
+import { IMdmAbmToken } from "interfaces/mdm";
+import mdmAbmAPI, {
+  IGetAbmTokensResponse,
+} from "services/entities/mdm_apple_bm";
+
+import BackLink from "components/BackLink";
+import Button from "components/buttons/Button";
+import DataError from "components/DataError";
+import MainContent from "components/MainContent";
+import Spinner from "components/Spinner";
+import PremiumFeatureMessage from "components/PremiumFeatureMessage";
+
+import AppleBusinessManagerTable from "./components/AppleBusinessManagerTable";
+import AddAbmModal from "./components/AddAbmModal";
+import RenewAbmModal from "./components/RenewAbmModal";
+import DeleteAbmModal from "./components/DeleteAbmModal";
+import EditTeamsAbmModal from "./components/EditTeamsAbmModal";
+
+const baseClass = "apple-business-manager-page";
+
+interface ITurnOnMdmMessageProps {
+  router: InjectedRouter;
+}
+
+const TurnOnMdmMessage = ({ router }: ITurnOnMdmMessageProps) => {
+  return (
+    <div className={`${baseClass}__turn-on-mdm-message`}>
+      <h2>Turn on Apple MDM</h2>
+      <p>
+        To add your ABM and enable automatic enrollment for macOS, iOS, and
+        iPadOS hosts, first turn on Apple MDM.
+      </p>
+      <Button
+        variant="brand"
+        onClick={() => {
+          router.push(PATHS.ADMIN_INTEGRATIONS_MDM);
+        }}
+      >
+        Turn on
+      </Button>
+    </div>
+  );
+};
+
+interface IAddAbmMessageProps {
+  onAddAbm: () => void;
+}
+
+const AddAbmMessage = ({ onAddAbm }: IAddAbmMessageProps) => {
+  return (
+    <div className={`${baseClass}__add-adm-message`}>
+      <h2>Add your ABM</h2>
+      <p>
+        Automatically enroll newly purchased Apple hosts when they&apos;re first
+        unboxed and set up by your end users.
+      </p>
+      <Button variant="brand" onClick={onAddAbm}>
+        Add ABM
+      </Button>
+    </div>
+  );
+};
+
+const AppleBusinessManagerPage = ({ router }: { router: InjectedRouter }) => {
+  const { config, isPremiumTier } = useContext(AppContext);
+
+  const [showRenewModal, setShowRenewModal] = useState(false);
+  const [showDeleteModal, setShowDeleteModal] = useState(false);
+  const [showAddAbmModal, setShowAddAbmModal] = useState(false);
+  const [showEditTeamsModal, setShowEditTeamsModal] = useState(false);
+
+  const selectedToken = useRef<IMdmAbmToken | null>(null);
+
+  const {
+    data: abmTokens,
+    error: errorAbmTokens,
+    isLoading,
+    isRefetching,
+    refetch,
+  } = useQuery<IGetAbmTokensResponse, AxiosError, IMdmAbmToken[]>(
+    ["abmTokens"],
+    () => mdmAbmAPI.getTokens(),
+    {
+      refetchOnWindowFocus: false,
+      retry: (tries, error) =>
+        error.status !== 404 && error.status !== 400 && tries <= 3,
+      select: (data) => data?.abm_tokens,
+      enabled: isPremiumTier,
+    }
+  );
+
+  const onEditTokenTeam = (abmToken: IMdmAbmToken) => {
+    selectedToken.current = abmToken;
+    setShowEditTeamsModal(true);
+  };
+
+  const onCancelEditTeam = useCallback(() => {
+    selectedToken.current = null;
+    setShowEditTeamsModal(false);
+  }, []);
+
+  const onEditedTeam = useCallback(() => {
+    selectedToken.current = null;
+    refetch();
+    setShowEditTeamsModal(false);
+  }, [refetch]);
+
+  const onAddAbm = () => {
+    setShowAddAbmModal(true);
+  };
+
+  const onAdded = () => {
+    refetch();
+    setShowAddAbmModal(false);
+  };
+
+  const onRenewToken = (abmToken: IMdmAbmToken) => {
+    selectedToken.current = abmToken;
+    setShowRenewModal(true);
+  };
+
+  const onCancelRenewToken = useCallback(() => {
+    selectedToken.current = null;
+    setShowRenewModal(false);
+  }, []);
+
+  const onRenewed = useCallback(() => {
+    selectedToken.current = null;
+    refetch();
+    setShowRenewModal(false);
+  }, [refetch]);
+
+  const onDeleteToken = (abmToken: IMdmAbmToken) => {
+    selectedToken.current = abmToken;
+    setShowDeleteModal(true);
+  };
+
+  const onCancelDeleteToken = useCallback(() => {
+    selectedToken.current = null;
+    setShowDeleteModal(false);
+  }, []);
+
+  const onDeleted = useCallback(() => {
+    selectedToken.current = null;
+    refetch();
+    setShowDeleteModal(false);
+  }, [refetch]);
+
+  if (isLoading || isRefetching) {
+    return <Spinner />;
+  }
+
+  const showDataError = errorAbmTokens && errorAbmTokens.status !== 404;
+
+  const renderContent = () => {
+    if (!isPremiumTier) {
+      return <PremiumFeatureMessage />;
+    }
+
+    if (!config?.mdm.enabled_and_configured) {
+      return <TurnOnMdmMessage router={router} />;
+    }
+
+    if (isLoading) {
+      return <Spinner />;
+    }
+
+    // TODO: error UI
+    if (showDataError) {
+      return (
+        <div>
+          <DataError />
+        </div>
+      );
+    }
+
+    if (abmTokens?.length === 0) {
+      return <AddAbmMessage onAddAbm={onAddAbm} />;
+    }
+
+    if (abmTokens) {
+      return (
+        <>
+          <p>
+            Add your ABM to automatically enroll newly purchased Apple hosts
+            when they&apos;re first unboxed and set up by your end users.
+          </p>
+          <AppleBusinessManagerTable
+            abmTokens={abmTokens}
+            onEditTokenTeam={onEditTokenTeam}
+            onRenewToken={onRenewToken}
+            onDeleteToken={onDeleteToken}
+          />
+        </>
+      );
+    }
+
+    return null;
+  };
+
+  return (
+    <MainContent className={baseClass}>
+      <>
+        <BackLink
+          text="Back to MDM"
+          path={PATHS.ADMIN_INTEGRATIONS_MDM}
+          className={`${baseClass}__back-to-mdm`}
+        />
+        <div className={`${baseClass}__page-content`}>
+          <div className={`${baseClass}__page-header-section`}>
+            <h1>Apple Business Manager (ABM)</h1>
+            {isPremiumTier &&
+              abmTokens?.length !== 0 &&
+              !!config?.mdm.enabled_and_configured && (
+                <Button variant="brand" onClick={onAddAbm}>
+                  Add ABM
+                </Button>
+              )}
+          </div>
+          <>{renderContent()}</>
+        </div>
+      </>
+      {showAddAbmModal && (
+        <AddAbmModal
+          onAdded={onAdded}
+          onCancel={() => setShowAddAbmModal(false)}
+        />
+      )}
+      {showRenewModal && selectedToken.current && (
+        <RenewAbmModal
+          tokenId={selectedToken.current.id}
+          orgName={selectedToken.current.org_name}
+          onCancel={onCancelRenewToken}
+          onRenewedToken={onRenewed}
+        />
+      )}
+      {showDeleteModal && selectedToken.current && (
+        <DeleteAbmModal
+          tokenOrgName={selectedToken.current.org_name}
+          tokenId={selectedToken.current.id}
+          onCancel={onCancelDeleteToken}
+          onDeletedToken={onDeleted}
+        />
+      )}
+      {showEditTeamsModal && selectedToken.current && (
+        <EditTeamsAbmModal
+          token={selectedToken.current}
+          onCancel={onCancelEditTeam}
+          onSuccess={onEditedTeam}
+        />
+      )}
+    </MainContent>
+  );
+};
+
+export default AppleBusinessManagerPage;
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/_styles.scss b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/_styles.scss
new file mode 100644
index 0000000000..ea3356cff8
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/_styles.scss
@@ -0,0 +1,65 @@
+.apple-business-manager-page {
+  &__back-to-mdm {
+    margin-bottom: $pad-xlarge;
+  }
+
+  &__page-content {
+    display: flex;
+    flex-direction: column;
+    gap: $pad-xxlarge;
+  }
+
+  &__page-header-section {
+    display: flex;
+    flex-direction: row;
+    gap: $pad-large;
+    align-items: center;
+    justify-content: space-between;
+
+    h1 {
+      margin-bottom: 0;
+      font-size: $large;
+    }
+  }
+
+
+  &__turn-on-mdm-message, &__add-adm-message {
+    margin: 0 auto;
+    text-align: center;
+    width: 450px;
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    justify-content: center;
+
+    > h2 {
+      margin-bottom: $pad-small;
+      font-size: $small;
+      font-weight: $bold;
+    }
+
+    > p {
+      margin: 0 0 $pad-medium;
+    }
+  }
+
+  &__url-inputs-wrapper {
+    display: flex;
+    flex-direction: column;
+    gap: $pad-icon;
+    margin-top: $pad-large;
+  }
+
+  &__url-input {
+    margin-bottom: 0;
+  }
+
+  // TODO: remove these styles when the updated error component is used
+  .data-error {
+    margin: $pad-xxlarge 0;
+    padding: $pad-xlarge 0;
+  }
+  .data-error__inner {
+    padding: $pad-xlarge 0;
+  }
+}
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AddAbmModal/AddAbmModal.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AddAbmModal/AddAbmModal.tsx
new file mode 100644
index 0000000000..6ed19ad10b
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AddAbmModal/AddAbmModal.tsx
@@ -0,0 +1,155 @@
+import React, { useCallback, useContext, useState } from "react";
+
+import { NotificationContext } from "context/notification";
+import mdmAbmAPI from "services/entities/mdm_apple_bm";
+
+import Modal from "components/Modal";
+import Button from "components/buttons/Button";
+import FileUploader from "components/FileUploader";
+import CustomLink from "components/CustomLink";
+import DownloadABMKey from "pages/admin/components/DownloadFileButtons/DownloadABMKey";
+import { getErrorMessage } from "./helpers";
+
+const baseClass = "add-abm-modal";
+
+interface IAddAbmModalProps {
+  onCancel: () => void;
+  onAdded: () => void;
+}
+
+const AddAbmModal = ({ onCancel, onAdded }: IAddAbmModalProps) => {
+  const { renderFlash } = useContext(NotificationContext);
+
+  const [tokenFile, setTokenFile] = useState<File | null>(null);
+  const [isUploading, setIsUploading] = useState(false);
+
+  const onSelectFile = useCallback((files: FileList | null) => {
+    const file = files?.[0];
+    if (file) {
+      setTokenFile(file);
+    }
+  }, []);
+
+  const uploadAbmToken = useCallback(async () => {
+    setIsUploading(true);
+    if (!tokenFile) {
+      setIsUploading(false);
+      renderFlash("error", "No token selected.");
+      return;
+    }
+
+    try {
+      await mdmAbmAPI.uploadToken(tokenFile);
+      renderFlash("success", "Added successfully.");
+      onAdded();
+    } catch (e) {
+      renderFlash("error", getErrorMessage(e));
+      onCancel();
+    } finally {
+      setIsUploading(false);
+    }
+  }, [tokenFile, renderFlash, onAdded, onCancel]);
+
+  return (
+    <Modal
+      className={baseClass}
+      title="Add ABM"
+      onExit={onCancel}
+      width="large"
+    >
+      <>
+        <ol className={`${baseClass}__setup-list`}>
+          <li>
+            <span>1.</span>
+            <p>
+              Download your public key. <DownloadABMKey baseClass={baseClass} />
+            </p>
+          </li>
+          <li>
+            <span>2.</span>
+            <span>
+              <span>
+                Sign in to{" "}
+                <CustomLink
+                  newTab
+                  text="Apple Business Manager"
+                  url="https://business.apple.com"
+                />
+                <br />
+                If your organization doesn&apos;t have an account, select{" "}
+                <b>Enroll now</b>.
+              </span>
+            </span>
+          </li>
+          <li>
+            <span>3.</span>
+            <span>
+              Select your <b>account name</b> at the bottom left of the screen,
+              then select <b>Preferences</b>.
+            </span>
+          </li>
+          <li>
+            <span>4.</span>
+            <span>
+              In the <b>Your MDM Servers</b> section, select <b>Add</b>.
+            </span>
+          </li>
+          <li>
+            <span>5.</span>
+            <span>Enter a name for the server such as “Fleet”.</span>
+          </li>
+          <li>
+            <span>6.</span>
+            <span>
+              Under <b>MDM Server Settings</b>, upload the public key downloaded
+              in the first step and select <b>Save</b>.
+            </span>
+          </li>
+          <li>
+            <span>7.</span>
+            <span>
+              In the <b>Default Device Assignment</b> section, select{" "}
+              <b>Change</b>, then assign the newly created server as the default
+              for your Macs, and select <b>Done</b>.
+            </span>
+          </li>
+          <li>
+            <span>8.</span>
+            <span>
+              Select newly created server in the sidebar, then select{" "}
+              <b>Download Token</b> on the top.
+            </span>
+          </li>
+          <li>
+            <span>9.</span>
+            <span>Upload the downloaded token (.p7m file).</span>
+          </li>
+        </ol>
+        <FileUploader
+          className={`${baseClass}__file-uploader ${
+            isUploading ? `${baseClass}__file-uploader--loading` : ""
+          }`}
+          accept=".p7m"
+          message="ABM token (.p7m)"
+          graphicName={"file-p7m"}
+          buttonType="link"
+          buttonMessage={isUploading ? "Uploading..." : "Upload"}
+          fileDetails={tokenFile ? { name: tokenFile.name } : undefined}
+          onFileUpload={onSelectFile}
+        />
+        <div className="modal-cta-wrap">
+          <Button
+            variant="brand"
+            onClick={uploadAbmToken}
+            isLoading={isUploading}
+            disabled={!tokenFile || isUploading}
+          >
+            Add ABM
+          </Button>
+        </div>
+      </>
+    </Modal>
+  );
+};
+
+export default AddAbmModal;
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AddAbmModal/_styles.scss b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AddAbmModal/_styles.scss
new file mode 100644
index 0000000000..74ccf5138b
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AddAbmModal/_styles.scss
@@ -0,0 +1,59 @@
+.add-abm-modal {
+
+  &__request-button {
+    display: flex;
+    gap: $pad-small;
+    align-items: center;
+    margin-top: $pad-small;
+
+    label {
+      display: flex;
+      gap: $pad-small;
+      cursor: pointer;
+    }
+  }
+
+  &__setup-list {
+    font-size: $x-small;
+    display: flex;
+    flex-direction: column;
+    gap: $pad-large;
+    padding: 0;
+    margin: 0;
+    max-width: 660px;
+    list-style: none;
+
+    li {
+      display: flex;
+      flex-direction: row;
+      gap: $pad-small;
+
+      p {
+        display: flex;
+        flex-direction: column;
+        align-items: flex-start;
+        margin: 0;
+      }
+    }
+  }
+
+  &__file-uploader {
+    margin-top: $pad-medium;
+    margin-left: $pad-medium;
+
+    .file-uploader__message {
+      color: $ui-fleet-black-75;
+      margin: 0;
+    }
+
+    button {
+      margin-top: 0;
+    }
+
+    &--loading {
+      label {
+        opacity: 0.5;
+      }
+    }
+  }
+}
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AddAbmModal/helpers.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AddAbmModal/helpers.tsx
new file mode 100644
index 0000000000..a7ec3afc7b
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AddAbmModal/helpers.tsx
@@ -0,0 +1,35 @@
+import React from "react";
+
+import { getErrorReason } from "interfaces/errors";
+
+const DEFAULT_ERROR_MESSAGE = "Couldn't add. Please try again.";
+
+const generateDuplicateMessage = (msg: string) => {
+  const orgName = msg.split("'")[1];
+  return (
+    <>
+      Couldn&apos;t add. There&apos;s already an ABM connection for the{" "}
+      <b>{orgName}</b> organization.
+    </>
+  );
+};
+
+// eslint-disable-next-line import/prefer-default-export
+export const getErrorMessage = (err: unknown) => {
+  const duplicateEntryReason = getErrorReason(err, {
+    reasonIncludes: "Duplicate entry",
+  });
+  const invalidTokenReason = getErrorReason(err, {
+    reasonIncludes: "Invalid token",
+  });
+
+  if (duplicateEntryReason) {
+    return generateDuplicateMessage(duplicateEntryReason);
+  }
+
+  if (invalidTokenReason) {
+    return invalidTokenReason;
+  }
+
+  return DEFAULT_ERROR_MESSAGE;
+};
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AddAbmModal/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AddAbmModal/index.ts
new file mode 100644
index 0000000000..b20b39d0f2
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AddAbmModal/index.ts
@@ -0,0 +1 @@
+export { default } from "./AddAbmModal";
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AppleBusinessManagerTable/AppleBusinessManagerTable.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AppleBusinessManagerTable/AppleBusinessManagerTable.tsx
new file mode 100644
index 0000000000..27a3f9aa2a
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AppleBusinessManagerTable/AppleBusinessManagerTable.tsx
@@ -0,0 +1,58 @@
+import React from "react";
+
+import { IMdmAbmToken } from "interfaces/mdm";
+
+import TableContainer from "components/TableContainer";
+
+import { generateTableConfig } from "./AppleBusinessManagerTableConfig";
+
+const baseClass = "apple-business-manager-table";
+
+interface IAppleBusinessManagerTableProps {
+  abmTokens: IMdmAbmToken[];
+  onEditTokenTeam: (token: IMdmAbmToken) => void;
+  onRenewToken: (token: IMdmAbmToken) => void;
+  onDeleteToken: (token: IMdmAbmToken) => void;
+}
+
+const AppleBusinessManagerTable = ({
+  abmTokens,
+  onEditTokenTeam,
+  onRenewToken,
+  onDeleteToken,
+}: IAppleBusinessManagerTableProps) => {
+  const onSelectAction = (action: string, abmToken: IMdmAbmToken) => {
+    switch (action) {
+      case "editTeams":
+        onEditTokenTeam(abmToken);
+        break;
+      case "renew":
+        onRenewToken(abmToken);
+        break;
+      case "delete":
+        onDeleteToken(abmToken);
+        break;
+      default:
+        break;
+    }
+  };
+
+  const tableConfig = generateTableConfig(onSelectAction);
+
+  return (
+    <TableContainer<IMdmAbmToken>
+      columnConfigs={tableConfig}
+      defaultSortHeader="org_name"
+      disableTableHeader
+      disablePagination
+      showMarkAllPages={false}
+      isAllPagesSelected={false}
+      emptyComponent={() => <></>}
+      isLoading={false}
+      data={abmTokens}
+      className={baseClass}
+    />
+  );
+};
+
+export default AppleBusinessManagerTable;
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AppleBusinessManagerTable/AppleBusinessManagerTableConfig.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AppleBusinessManagerTable/AppleBusinessManagerTableConfig.tsx
new file mode 100644
index 0000000000..d79e1d3eb1
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AppleBusinessManagerTable/AppleBusinessManagerTableConfig.tsx
@@ -0,0 +1,180 @@
+import React from "react";
+import { CellProps, Column } from "react-table";
+
+import { IMdmAbmToken } from "interfaces/mdm";
+import { IHeaderProps, IStringCellProps } from "interfaces/datatable_config";
+import { IDropdownOption } from "interfaces/dropdownOption";
+
+import HeaderCell from "components/TableContainer/DataTable/HeaderCell";
+import DropdownCell from "components/TableContainer/DataTable/DropdownCell";
+import TextCell from "components/TableContainer/DataTable/TextCell";
+import TooltipWrapper from "components/TooltipWrapper";
+
+import RenewDateCell from "../../../components/RenewDateCell";
+import OrgNameCell from "./OrgNameCell";
+import { IRenewDateCellStatusConfig } from "../../../components/RenewDateCell/RenewDateCell";
+
+type IAbmTableConfig = Column<IMdmAbmToken>;
+type ITableStringCellProps = IStringCellProps<IMdmAbmToken>;
+type IRenewDateCellProps = CellProps<IMdmAbmToken, IMdmAbmToken["renew_date"]>;
+
+type ITableHeaderProps = IHeaderProps<IMdmAbmToken>;
+
+const DEFAULT_ACTION_OPTIONS: IDropdownOption[] = [
+  { value: "editTeams", label: "Edit teams", disabled: false },
+  { value: "renew", label: "Renew", disabled: false },
+  { value: "delete", label: "Delete", disabled: false },
+];
+
+const generateActions = () => {
+  return DEFAULT_ACTION_OPTIONS;
+};
+
+const RENEW_DATE_CELL_STATUS_CONFIG: IRenewDateCellStatusConfig = {
+  warning: {
+    tooltipText: (
+      <>
+        ABM server token is less than 30 days from expiration.
+        <br /> To renew, go to <b>Actions {">"} Renew.</b>
+      </>
+    ),
+  },
+  error: {
+    tooltipText: (
+      <>
+        ABM server token is expired.
+        <br /> To renew, go to <b>Actions {">"} Renew</b>.
+      </>
+    ),
+  },
+};
+
+export const generateTableConfig = (
+  actionSelectHandler: (value: string, team: IMdmAbmToken) => void
+): IAbmTableConfig[] => {
+  return [
+    {
+      accessor: "org_name",
+      sortType: "caseInsensitive",
+      Header: (cellProps: ITableHeaderProps) => (
+        <HeaderCell
+          value="Organization name"
+          isSortedDesc={cellProps.column.isSortedDesc}
+        />
+      ),
+      Cell: (cellProps: ITableStringCellProps) => {
+        const { terms_expired, org_name } = cellProps.cell.row.original;
+        return <OrgNameCell orgName={org_name} termsExpired={terms_expired} />;
+      },
+    },
+    {
+      accessor: "renew_date",
+      Header: "Renew date",
+      disableSortBy: true,
+      Cell: (cellProps: IRenewDateCellProps) => (
+        <RenewDateCell
+          value={cellProps.cell.value}
+          statusConfig={RENEW_DATE_CELL_STATUS_CONFIG}
+          className="abm-renew-date-cell"
+        />
+      ),
+    },
+    {
+      accessor: "apple_id",
+      Header: "Apple ID",
+      disableSortBy: true,
+      Cell: (cellProps: ITableStringCellProps) => (
+        <TextCell value={cellProps.cell.value} />
+      ),
+    },
+    {
+      id: "macos_team",
+      accessor: (originalRow) => originalRow.macos_team.name,
+      Header: () => {
+        const titleWithToolTip = (
+          <TooltipWrapper
+            tipContent={
+              <>
+                macOS hosts are automatically added to this team in Fleet when
+                they appear in Apple Business Manager.
+              </>
+            }
+          >
+            macOS team
+          </TooltipWrapper>
+        );
+        return <HeaderCell value={titleWithToolTip} disableSortBy />;
+      },
+      disableSortBy: true,
+      Cell: (cellProps: ITableStringCellProps) => (
+        <TextCell value={cellProps.cell.value} />
+      ),
+    },
+    {
+      id: "ios_team",
+      accessor: (originalRow) => originalRow.ios_team.name,
+      Header: () => {
+        const titleWithToolTip = (
+          <TooltipWrapper
+            tipContent={
+              <>
+                iOS hosts are automatically added to this team in Fleet when
+                they appear in Apple Business Manager.
+              </>
+            }
+          >
+            iOS team
+          </TooltipWrapper>
+        );
+        return <HeaderCell value={titleWithToolTip} disableSortBy />;
+      },
+      disableSortBy: true,
+      Cell: (cellProps: ITableStringCellProps) => (
+        <TextCell value={cellProps.cell.value} />
+      ),
+    },
+    {
+      id: "ipados_team",
+      accessor: (originalRow) => originalRow.ipados_team.name,
+      Header: () => {
+        const titleWithToolTip = (
+          <TooltipWrapper
+            tipContent={
+              <>
+                iPadOS hosts are automatically added to this team in Fleet when
+                they appear in Apple Business Manager.
+              </>
+            }
+          >
+            iPadOS team
+          </TooltipWrapper>
+        );
+        return <HeaderCell value={titleWithToolTip} disableSortBy />;
+      },
+      disableSortBy: true,
+      Cell: (cellProps: ITableStringCellProps) => (
+        <TextCell value={cellProps.cell.value} />
+      ),
+    },
+    {
+      Header: "",
+      disableSortBy: true,
+      // the accessor here is insignificant, we just need it as its required
+      // but we don't use it.
+      accessor: "id",
+      Cell: (cellProps) => (
+        <DropdownCell
+          options={generateActions()}
+          onChange={(value: string) =>
+            actionSelectHandler(value, cellProps.row.original)
+          }
+          placeholder="Actions"
+        />
+      ),
+    },
+  ];
+};
+
+export const generateTableData = (data: IMdmAbmToken[]) => {
+  return data;
+};
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AppleBusinessManagerTable/OrgNameCell/OrgNameCell.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AppleBusinessManagerTable/OrgNameCell/OrgNameCell.tsx
new file mode 100644
index 0000000000..e1ff84532f
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AppleBusinessManagerTable/OrgNameCell/OrgNameCell.tsx
@@ -0,0 +1,23 @@
+import Icon from "components/Icon";
+import TextCell from "components/TableContainer/DataTable/TextCell";
+import React from "react";
+
+const baseClass = "org-name-cell";
+
+interface IOrgNameCellProps {
+  orgName: string;
+  termsExpired: boolean;
+}
+
+const OrgNameCell = ({ orgName, termsExpired }: IOrgNameCellProps) => {
+  const cellContent = termsExpired ? (
+    <>
+      <span>{orgName}</span> <Icon name="warning" />
+    </>
+  ) : (
+    orgName
+  );
+  return <TextCell value={cellContent} className={baseClass} />;
+};
+
+export default OrgNameCell;
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AppleBusinessManagerTable/OrgNameCell/_styles.scss b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AppleBusinessManagerTable/OrgNameCell/_styles.scss
new file mode 100644
index 0000000000..43a212797a
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AppleBusinessManagerTable/OrgNameCell/_styles.scss
@@ -0,0 +1,3 @@
+.org-name-cell {
+
+}
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AppleBusinessManagerTable/OrgNameCell/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AppleBusinessManagerTable/OrgNameCell/index.ts
new file mode 100644
index 0000000000..93810b068e
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AppleBusinessManagerTable/OrgNameCell/index.ts
@@ -0,0 +1 @@
+export { default } from "./OrgNameCell";
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AppleBusinessManagerTable/_styles.scss b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AppleBusinessManagerTable/_styles.scss
new file mode 100644
index 0000000000..6dc700f6bd
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AppleBusinessManagerTable/_styles.scss
@@ -0,0 +1,33 @@
+.apple-business-manager-table {
+
+  // The desired behavior is to hide the header and team cell one by one
+  // as the viewport gets smaller. This is achieved by using the max-width
+  // media query with the breakpoint values taken from when the table content
+  // starts to overflow.
+  @media (max-width: $break-lg) {
+    .ipados_team__header, .ipados_team__cell {
+      display: none;
+    }
+  }
+
+  @media (max-width: 1230px) {
+    .ios_team__header, .ios_team__cell {
+      display: none;
+    }
+  }
+
+  @media (max-width: $break-md) {
+    .macos_team__header, .macos_team__cell {
+      display: none;
+    }
+  }
+
+  // this is a special case where the org name cell is too long at smaller widths.
+  // We dont want to remove any more columns so we need to reduce the width of
+  // the org name cell content to prevent table content overflow.
+  @media (max-width: $break-sm) {
+    .org-name-cell {
+      width: 140px;
+    }
+  }
+}
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AppleBusinessManagerTable/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AppleBusinessManagerTable/index.ts
new file mode 100644
index 0000000000..ca9ab15861
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/AppleBusinessManagerTable/index.ts
@@ -0,0 +1 @@
+export { default } from "./AppleBusinessManagerTable";
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/DeleteAbmModal/DeleteAbmModal.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/DeleteAbmModal/DeleteAbmModal.tsx
new file mode 100644
index 0000000000..afa4729031
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/DeleteAbmModal/DeleteAbmModal.tsx
@@ -0,0 +1,86 @@
+import React, { useCallback, useContext, useState } from "react";
+
+import mdmAbmAPI from "services/entities/mdm_apple_bm";
+import { IMdmAbmToken } from "interfaces/mdm";
+import { NotificationContext } from "context/notification";
+
+import Button from "components/buttons/Button";
+import Modal from "components/Modal";
+
+const baseClass = "delete-abm-modal";
+
+interface IDeleteAbmModalProps {
+  tokenOrgName: string;
+  tokenId: number;
+  onCancel: () => void;
+  onDeletedToken: () => void;
+}
+
+const DeleteAbmModal = ({
+  tokenOrgName,
+  tokenId,
+  onCancel,
+  onDeletedToken,
+}: IDeleteAbmModalProps) => {
+  const { renderFlash } = useContext(NotificationContext);
+
+  const [isDeleting, setIsDeleting] = useState(false);
+
+  const onDeleteToken = useCallback(async () => {
+    setIsDeleting(true);
+
+    try {
+      await mdmAbmAPI.deleteToken(tokenId);
+      renderFlash("success", "Deleted successfully.");
+      onDeletedToken();
+    } catch (e) {
+      // TODO: Check API sends back correct error messages
+      renderFlash(
+        "error",
+        "Couldn’t disable automatic enrollment. Please try again."
+      );
+      onCancel();
+    }
+  }, [onCancel, onDeletedToken, renderFlash, tokenId]);
+
+  return (
+    <Modal
+      title="Delete ABM"
+      className={baseClass}
+      onExit={onCancel}
+      isContentDisabled={isDeleting}
+    >
+      <>
+        <p>
+          New hosts purchased in the <b>{tokenOrgName}</b> won&apos;t
+          automatically enroll to Fleet.{" "}
+        </p>
+        <p>
+          If you want to re-enable automatic enrollment, you&apos;ll have to
+          upload a new ABM token.
+        </p>
+
+        <div className="modal-cta-wrap">
+          <Button
+            type="button"
+            variant="alert"
+            onClick={onDeleteToken}
+            disabled={isDeleting}
+            isLoading={isDeleting}
+          >
+            Delete
+          </Button>
+          <Button
+            onClick={onCancel}
+            disabled={isDeleting}
+            variant="inverse-alert"
+          >
+            Cancel
+          </Button>
+        </div>
+      </>
+    </Modal>
+  );
+};
+
+export default DeleteAbmModal;
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/DeleteAbmModal/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/DeleteAbmModal/index.ts
new file mode 100644
index 0000000000..6621778d72
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/DeleteAbmModal/index.ts
@@ -0,0 +1 @@
+export { default } from "./DeleteAbmModal";
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/EditTeamsAbmModal/EditTeamsAbmModal.tests.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/EditTeamsAbmModal/EditTeamsAbmModal.tests.ts
new file mode 100644
index 0000000000..00bf0bdce5
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/EditTeamsAbmModal/EditTeamsAbmModal.tests.ts
@@ -0,0 +1,41 @@
+import {
+  APP_CONTEX_NO_TEAM_SUMMARY,
+  APP_CONTEXT_ALL_TEAMS_SUMMARY,
+} from "interfaces/team";
+import { getOptions, getSelectedTeamIds } from "./EditTeamsAbmModal";
+
+describe("EditTeamsAbmModal", () => {
+  const availableTeams = [
+    APP_CONTEXT_ALL_TEAMS_SUMMARY,
+    APP_CONTEX_NO_TEAM_SUMMARY,
+    { name: "Team 1", id: 1 },
+    { name: "Team 2", id: 2 },
+  ];
+
+  describe("getOptions", () => {
+    it("excludes all teams", () => {
+      const expectedOptions = availableTeams.reduce((acc, t) => {
+        if (t.name !== "All teams") {
+          acc.push({ value: t.name, label: t.name });
+        }
+        return acc;
+      }, [] as { value: string; label: string }[]);
+      expect(getOptions(availableTeams)).toEqual(expectedOptions);
+    });
+  });
+
+  describe("getSelectedTeamIds", () => {
+    it("returns selected team ids", () => {
+      const selectedTeamNames = {
+        ios_team: "Team 1",
+        ipados_team: "Team 2",
+        macos_team: "No team",
+      };
+      expect(getSelectedTeamIds(selectedTeamNames, availableTeams)).toEqual({
+        ios_team_id: 1,
+        ipados_team_id: 2,
+        macos_team_id: 0,
+      });
+    });
+  });
+});
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/EditTeamsAbmModal/EditTeamsAbmModal.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/EditTeamsAbmModal/EditTeamsAbmModal.tsx
new file mode 100644
index 0000000000..c33f9ebd56
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/EditTeamsAbmModal/EditTeamsAbmModal.tsx
@@ -0,0 +1,204 @@
+import React, { useCallback, useContext, useMemo, useState } from "react";
+
+import { AppContext } from "context/app";
+import { NotificationContext } from "context/notification";
+
+import { IMdmAbmToken } from "interfaces/mdm";
+import { ITeamSummary } from "interfaces/team";
+
+import mdmAbmAPI from "services/entities/mdm_apple_bm";
+
+import Modal from "components/Modal";
+// @ts-ignore
+import Dropdown from "components/forms/fields/Dropdown";
+import Button from "components/buttons/Button";
+
+const baseClass = "edit-teams-abm-modal";
+
+interface IEditTeamsAbmModalProps {
+  token: IMdmAbmToken;
+  onCancel: () => void;
+  onSuccess: () => void;
+}
+
+/**
+ * Given available teams, return the options for the dropdowns. The "All teams" option is excluded.
+ */
+export const getOptions = (availableTeams: ITeamSummary[] = []) => {
+  return availableTeams
+    ?.filter((t) => t.name !== "All teams")
+    .map((t) => ({
+      value: t.name,
+      label: t.name,
+    }));
+};
+
+/**
+ * Type for the selected team names, which is derived from the shape of the teams object
+ * returned by the get token API.
+ */
+interface SelectedTeamNames {
+  ios_team: IMdmAbmToken["ios_team"]["name"];
+  ipados_team: IMdmAbmToken["ipados_team"]["name"];
+  macos_team: IMdmAbmToken["macos_team"]["name"];
+}
+
+/**
+ * Type for the selected team ids, which takes the shape of the teams object
+ * expected by the edit token teams API.
+ */
+type SelectedTeamIds = Parameters<typeof mdmAbmAPI.editTeams>[0]["teams"];
+
+/**
+ * Given selected team names and available teams, return the corresponding team ids with the keys
+ * expected by the API. If a team name does not exist in the available teams, its id will be undefined.
+ * The caller is responsible for handling undefined ids appropriately (e.g., using error messages from
+ * `validateSelectedTeamIds` function).
+ */
+export const getSelectedTeamIds = (
+  { ios_team, ipados_team, macos_team }: SelectedTeamNames,
+  availableTeams: ITeamSummary[] = []
+): SelectedTeamIds => {
+  const byName = availableTeams.reduce((acc, t) => {
+    acc[t.name] = t.id;
+    return acc;
+  }, {} as Record<string, number>);
+  return {
+    ios_team_id: byName[ios_team],
+    ipados_team_id: byName[ipados_team],
+    macos_team_id: byName[macos_team],
+  };
+};
+
+const EditTeamsAbmModal = ({
+  token,
+  onCancel,
+  onSuccess,
+}: IEditTeamsAbmModalProps) => {
+  const { renderFlash } = useContext(NotificationContext);
+  const { availableTeams } = useContext(AppContext);
+
+  const [isSaving, setIsSaving] = useState(false);
+
+  const [selectedTeamNames, setSelectedTeamNames] = useState<SelectedTeamNames>(
+    {
+      ios_team: token.ios_team.name,
+      ipados_team: token.ipados_team.name,
+      macos_team: token.macos_team.name,
+    }
+  );
+
+  const options = useMemo(() => {
+    return availableTeams
+      ?.filter((t) => t.name !== "All teams")
+      .map((t) => ({
+        value: t.name,
+        label: t.name,
+      }));
+  }, [availableTeams]);
+
+  const onSave = useCallback(
+    async (evt: React.MouseEvent<HTMLFormElement>) => {
+      evt.preventDefault();
+
+      setIsSaving(true);
+      try {
+        await mdmAbmAPI.editTeams({
+          tokenId: token.id,
+          teams: getSelectedTeamIds(selectedTeamNames, availableTeams),
+        });
+        renderFlash("success", "Edited successfully.");
+        onSuccess();
+      } catch (e) {
+        renderFlash("error", "Couldn’t edit. Please try again.");
+        onCancel();
+      }
+    },
+    [
+      token.id,
+      selectedTeamNames,
+      availableTeams,
+      renderFlash,
+      onSuccess,
+      onCancel,
+    ]
+  );
+
+  return (
+    <Modal
+      className={baseClass}
+      title="Edit teams"
+      onExit={onCancel}
+      width="large"
+      isContentDisabled={isSaving}
+    >
+      <>
+        <p>
+          Edit teams for <b>{token.org_name}</b>.
+        </p>
+        <form onSubmit={onSave} className={baseClass} autoComplete="off">
+          <Dropdown
+            searchable={false}
+            options={options}
+            onChange={(value: string) => {
+              setSelectedTeamNames((prev) => ({ ...prev, macos_team: value }));
+            }}
+            value={selectedTeamNames.macos_team}
+            label="macOS team"
+            wrapperClassName={`${baseClass}__form-field form-field--macos`}
+            tooltip={
+              <>
+                macOS hosts are automatically added to this team in Fleet when
+                they appear in Apple Business Manager.
+              </>
+            }
+          />
+          <Dropdown
+            searchable={false}
+            options={options}
+            onChange={(value: string) => {
+              setSelectedTeamNames((prev) => ({ ...prev, ios_team: value }));
+            }}
+            value={selectedTeamNames.ios_team}
+            label="iOS team"
+            wrapperClassName={`${baseClass}__form-field form-field--ios`}
+            tooltip={
+              <>
+                iOS hosts are automatically added to this team in Fleet when
+                they appear in Apple Business Manager.
+              </>
+            }
+          />
+          <Dropdown
+            searchable={false}
+            options={options}
+            onChange={(value: string) =>
+              setSelectedTeamNames((prev) => ({ ...prev, ipados_team: value }))
+            }
+            value={selectedTeamNames.ipados_team}
+            label="iPadOS team"
+            wrapperClassName={`${baseClass}__form-field form-field--ipados`}
+            tooltip={
+              <>
+                iPadOS hosts are automatically added to this team in Fleet when
+                they appear in Apple Business Manager.
+              </>
+            }
+          />
+          <div className="modal-cta-wrap">
+            <Button
+              type="submit"
+              variant="brand"
+              className="save-abm-teams-loading"
+              isLoading={isSaving}
+            >
+              Save
+            </Button>
+          </div>
+        </form>
+      </>
+    </Modal>
+  );
+};
+
+export default EditTeamsAbmModal;
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/EditTeamsAbmModal/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/EditTeamsAbmModal/index.ts
new file mode 100644
index 0000000000..8e8451b1e0
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/EditTeamsAbmModal/index.ts
@@ -0,0 +1 @@
+export { default } from "./EditTeamsAbmModal";
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/AppleAutomaticEnrollmentPage/modals/RenewTokenModal/RenewTokenModal.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/RenewAbmModal/RenewAbmModal.tsx
similarity index 67%
rename from frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/AppleAutomaticEnrollmentPage/modals/RenewTokenModal/RenewTokenModal.tsx
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/RenewAbmModal/RenewAbmModal.tsx
index 5e99d7c8c0..42e5b8cb20 100644
--- a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/AppleAutomaticEnrollmentPage/modals/RenewTokenModal/RenewTokenModal.tsx
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/RenewAbmModal/RenewAbmModal.tsx
@@ -1,30 +1,30 @@
 import React, { useState, useContext, useCallback } from "react";
 
 import { NotificationContext } from "context/notification";
-
-import { getErrorReason } from "interfaces/errors";
-
 import mdmAppleBmAPI from "services/entities/mdm_apple_bm";
 
 import Button from "components/buttons/Button";
 import CustomLink from "components/CustomLink";
-import {
-  FileUploader,
-  FileDetails,
-} from "components/FileUploader/FileUploader";
+import { FileUploader } from "components/FileUploader/FileUploader";
 import Modal from "components/Modal";
 
-const baseClass = "modal renew-token-modal";
+import { getErrorMessage } from "./helpers";
 
-interface IRenewCertModalProps {
+const baseClass = "renew-abm-modal";
+
+interface IRenewAbmModalProps {
+  tokenId: number;
+  orgName: string;
   onCancel: () => void;
-  onRenew: () => void;
+  onRenewedToken: () => void;
 }
 
-const RenewCertModal = ({
+const RenewAbmModal = ({
+  tokenId,
+  orgName,
   onCancel,
-  onRenew,
-}: IRenewCertModalProps): JSX.Element => {
+  onRenewedToken,
+}: IRenewAbmModalProps) => {
   const { renderFlash } = useContext(NotificationContext);
 
   const [isUploading, setIsUploading] = useState(false);
@@ -37,7 +37,7 @@ const RenewCertModal = ({
     }
   }, []);
 
-  const onRenewClick = useCallback(async () => {
+  const onRenewToken = useCallback(async () => {
     if (!tokenFile) {
       // this shouldn'r happen, but just in case
       renderFlash("error", "Please provide a token file.");
@@ -45,24 +45,29 @@ const RenewCertModal = ({
     }
     setIsUploading(true);
     try {
-      await mdmAppleBmAPI.uploadToken(tokenFile);
-      renderFlash("success", "ABM token renewed successfully.");
+      await mdmAppleBmAPI.renewToken(tokenId, tokenFile);
+      renderFlash("success", "Renewed successfully.");
       setIsUploading(false);
-      onRenew();
+      onRenewedToken();
     } catch (e) {
-      const msg = getErrorReason(e);
-      if (msg.toLowerCase().includes("valid token")) {
-        renderFlash("error", msg);
-      } else {
-        renderFlash("error", "Couldn’t renew. Please try again.");
-      }
+      renderFlash("error", getErrorMessage(e));
+      onCancel();
       setIsUploading(false);
     }
-  }, [tokenFile, renderFlash, onRenew]);
+  }, [tokenFile, renderFlash, tokenId, onRenewedToken, onCancel]);
 
   return (
-    <Modal title="Renew token" onExit={onCancel} className={baseClass}>
+    <Modal
+      title="Renew token"
+      onExit={onCancel}
+      className={baseClass}
+      isContentDisabled={isUploading}
+      width="large"
+    >
       <div className={`${baseClass}__page-content ${baseClass}__setup-content`}>
+        <p className={`${baseClass}__description`}>
+          Renew Apple Business Manager for <b>{orgName}</b>.
+        </p>
         <ol className={`${baseClass}__setup-instructions-list`}>
           <li>
             <p>
@@ -97,19 +102,12 @@ const RenewCertModal = ({
                 graphicName="file-p7m"
                 message="ABM token (.p7m)"
                 onFileUpload={onSelectFile}
-                filePreview={
-                  tokenFile && (
-                    <FileDetails
-                      details={{ name: tokenFile.name }}
-                      graphicName="file-p7m"
-                    />
-                  )
-                }
+                fileDetails={tokenFile ? { name: tokenFile.name } : undefined}
               />
             </p>
           </li>
         </ol>
-        <div className={`${baseClass}__button-wrap`}>
+        <div className="modal-cta-wrap">
           <Button
             className={`${baseClass}__submit-button ${
               isUploading ? `uploading` : ""
@@ -118,9 +116,9 @@ const RenewCertModal = ({
             disabled={!tokenFile || isUploading}
             isLoading={isUploading}
             type="button"
-            onClick={onRenewClick}
+            onClick={onRenewToken}
           >
-            Renew token
+            Renew ABM
           </Button>
         </div>
       </div>
@@ -128,4 +126,4 @@ const RenewCertModal = ({
   );
 };
 
-export default RenewCertModal;
+export default RenewAbmModal;
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/AppleAutomaticEnrollmentPage/modals/RenewTokenModal/_styles.scss b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/RenewAbmModal/_styles.scss
similarity index 55%
rename from frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/AppleAutomaticEnrollmentPage/modals/RenewTokenModal/_styles.scss
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/RenewAbmModal/_styles.scss
index 8b78546b0b..03d6b4d42d 100644
--- a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/AppleAutomaticEnrollmentPage/modals/RenewTokenModal/_styles.scss
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/RenewAbmModal/_styles.scss
@@ -1,9 +1,4 @@
-.renew-token-modal {
-  width: 760px;
-
-  &__info-header {
-    margin-bottom: $pad-xlarge;
-  }
+.renew-abm-modal {
 
   &__setup-content {
     display: flex;
@@ -29,33 +24,10 @@
     }
   }
 
-  &__request-button {
-    display: flex;
-    gap: $pad-small;
-    align-items: center;
-    margin-top: $pad-small;
-    margin-left: $pad-medium;
-
-    label {
-      display: flex;
-      gap: $pad-small;
-      cursor: pointer;
-    }
-  }
 
   &__file-uploader {
     margin-top: $pad-medium;
     margin-left: $pad-medium;
-    border-radius: 6px;
-
-    .file-uploader__message {
-      color: $ui-fleet-black-75;
-      margin: 0;
-    }
-
-    button {
-      margin-top: 0;
-    }
   }
 
   &__button-wrap {
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/RenewAbmModal/helpers.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/RenewAbmModal/helpers.tsx
new file mode 100644
index 0000000000..7eaa905cb9
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/RenewAbmModal/helpers.tsx
@@ -0,0 +1,18 @@
+import React from "react";
+
+import { getErrorReason } from "interfaces/errors";
+
+const DEFAULT_ERROR_MESSAGE = "Couldn’t renew. Please try again.";
+
+// eslint-disable-next-line import/prefer-default-export
+export const getErrorMessage = (err: unknown) => {
+  const invalidTokenReason = getErrorReason(err, {
+    reasonIncludes: "Invalid token",
+  });
+
+  if (invalidTokenReason) {
+    return invalidTokenReason;
+  }
+
+  return DEFAULT_ERROR_MESSAGE;
+};
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/RenewAbmModal/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/RenewAbmModal/index.ts
new file mode 100644
index 0000000000..892e78e390
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/components/RenewAbmModal/index.ts
@@ -0,0 +1 @@
+export { default } from "./RenewAbmModal";
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/index.ts
new file mode 100644
index 0000000000..7d921836ae
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage/index.ts
@@ -0,0 +1 @@
+export { default } from "./AppleBusinessManagerPage";
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleMdmPage/components/content/ApplePushCertSetup.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleMdmPage/components/content/ApplePushCertSetup.tsx
index 5ba5121497..2f90f070f0 100644
--- a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleMdmPage/components/content/ApplePushCertSetup.tsx
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleMdmPage/components/content/ApplePushCertSetup.tsx
@@ -6,6 +6,7 @@ import mdmAppleApi from "services/entities/mdm_apple";
 
 import CustomLink from "components/CustomLink";
 import FileUploader from "components/FileUploader";
+import ClickableUrls from "components/ClickableUrls";
 import DownloadCSR from "../../../../../../components/DownloadFileButtons/DownloadCSR";
 
 interface IApplePushCertSetupProps {
@@ -49,13 +50,13 @@ const ApplePushCertSetup = ({
   const onDownloadError = useCallback(
     (e: unknown) => {
       const msg = getErrorReason(e);
-      if (
-        msg.toLowerCase().includes("email address") ||
-        msg.toLowerCase().includes("required private key")
-      ) {
+      if (msg.toLowerCase().includes("email address")) {
         renderFlash("error", msg);
+      } else if (msg.toLowerCase().includes("required private key")) {
+        // replace link with actually clickable link
+        renderFlash("error", ClickableUrls({ text: msg }));
       } else {
-        renderFlash("error", "Something’s gone wrong. Please try again.");
+        renderFlash("error", "Something's gone wrong. Please try again.");
       }
     },
     [renderFlash]
@@ -112,7 +113,7 @@ const ApplePushCertSetup = ({
           accept=".pem"
           buttonMessage={isUploading ? "Uploading..." : "Upload"}
           buttonType="link"
-          diabled={isUploading}
+          disabled={isUploading}
           graphicName="file-pem"
           message="APNs certificate (.pem)"
           onFileUpload={onFileUpload}
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleMdmPage/components/modals/RenewCertModal/RenewCertModal.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleMdmPage/components/modals/RenewCertModal/RenewCertModal.tsx
index b070f4bdc3..f76d96461e 100644
--- a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleMdmPage/components/modals/RenewCertModal/RenewCertModal.tsx
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/AppleMdmPage/components/modals/RenewCertModal/RenewCertModal.tsx
@@ -1,4 +1,4 @@
-import React, { useState, useContext, useEffect, useCallback } from "react";
+import React, { useState, useContext, useCallback } from "react";
 
 import { NotificationContext } from "context/notification";
 
@@ -7,10 +7,7 @@ import { getErrorReason } from "interfaces/errors";
 
 import Button from "components/buttons/Button";
 import CustomLink from "components/CustomLink";
-import {
-  FileUploader,
-  FileDetails,
-} from "components/FileUploader/FileUploader";
+import { FileUploader } from "components/FileUploader/FileUploader";
 import Modal from "components/Modal";
 import DownloadCSR from "../../../../../../../components/DownloadFileButtons/DownloadCSR";
 
@@ -65,7 +62,13 @@ const RenewCertModal = ({
   const onDownloadError = useCallback(
     // eslint-disable-next-line @typescript-eslint/no-unused-vars
     (e: unknown) => {
-      renderFlash("error", "Something’s gone wrong. Please try again.");
+      const msg = getErrorReason(e);
+
+      if (msg.toLowerCase().includes("email address is not valid")) {
+        renderFlash("error", msg);
+      } else {
+        renderFlash("error", "Something's gone wrong. Please try again.");
+      }
     },
     [renderFlash]
   );
@@ -112,14 +115,7 @@ const RenewCertModal = ({
                 graphicName="file-pem"
                 message="APNs certificate (.pem)"
                 onFileUpload={onSelectFile}
-                filePreview={
-                  certFile && (
-                    <FileDetails
-                      details={{ name: certFile.name }}
-                      graphicName="file-pem"
-                    />
-                  )
-                }
+                fileDetails={certFile ? { name: certFile.name } : undefined}
               />
             </p>
           </li>
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/MdmSettings.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/MdmSettings.tsx
index e4b6e0bb1b..b6e0f02795 100644
--- a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/MdmSettings.tsx
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/MdmSettings.tsx
@@ -3,19 +3,20 @@ import { useQuery } from "react-query";
 import { AxiosError } from "axios";
 import { InjectedRouter } from "react-router";
 
+import { DEFAULT_USE_QUERY_OPTIONS } from "utilities/constants";
 import { AppContext } from "context/app";
-
-import mdmAppleAPI from "services/entities/mdm_apple";
 import { IMdmApple } from "interfaces/mdm";
+import mdmAppleAPI, {
+  IGetVppTokensResponse,
+} from "services/entities/mdm_apple";
+import mdmAPI, { IEulaMetadataResponse } from "services/entities/mdm";
 
-import PATHS from "router/paths";
-
-import Spinner from "components/Spinner";
-import SectionHeader from "components/SectionHeader";
-
-import EndUserMigrationSection from "./components/EndUserMigrationSection/EndUserMigrationSection";
-import WindowsMdmCard from "./components/WindowsMdmCard/WindowsMdmCard";
-import AppleMdmCard from "./components/AppleMdmCard/AppleMdmCard";
+import MdmSettingsSection from "./components/MdmSettingsSection";
+import AutomaticEnrollmentSection from "./components/AutomaticEnrollmentSection";
+import VppSection from "./components/VppSection";
+import IdpSection from "./components/IdpSection";
+import EulaSection from "./components/EulaSection";
+import EndUserMigrationSection from "./components/EndUserMigrationSection";
 
 const baseClass = "mdm-settings";
 
@@ -26,17 +27,21 @@ interface IMdmSettingsProps {
 const MdmSettings = ({ router }: IMdmSettingsProps) => {
   const { isPremiumTier, config } = useContext(AppContext);
 
+  const isMdmEnabled = !!config?.mdm.enabled_and_configured;
+
   // Currently the status of this API call is what determines various UI states on
   // this page. Because of this we will not render any of this components UI until this API
   // call has completed.
   const {
-    data: appleAPNInfo,
-    isLoading: isLoadingMdmApple,
-    error: errorMdmApple,
+    data: APNSInfo,
+    isLoading: isLoadingAPNSInfo,
+    isError: isAPNSInfoError,
+    error: errorAPNSInfo,
   } = useQuery<IMdmApple, AxiosError, IMdmApple>(
     ["appleAPNInfo"],
     () => mdmAppleAPI.getAppleAPNInfo(),
     {
+      ...DEFAULT_USE_QUERY_OPTIONS,
       retry: (tries, error) =>
         error.status !== 404 && error.status !== 400 && tries <= 3,
       // TODO: There is a potential race condition here immediately after MDM is turned off. This
@@ -44,44 +49,100 @@ const MdmSettings = ({ router }: IMdmSettingsProps) => {
       // enabled, resulting in a 400 response. The race really should  be fixed higher up the chain where
       // we're fetching and setting the config, but for now we'll just assume that any 400 response
       // means that MDM is not enabled and we'll show the "Turn on MDM" button.
-      enabled: !!config?.mdm.enabled_and_configured,
       staleTime: 5000,
+      enabled: isMdmEnabled,
     }
   );
 
-  const navigateToAppleMdm = () => {
-    router.push(PATHS.ADMIN_INTEGRATIONS_MDM_APPLE);
-  };
+  // get the vpp info
+  const {
+    data: vppData,
+    isLoading: isLoadingVpp,
+    isError: isVppError,
+  } = useQuery<IGetVppTokensResponse, AxiosError>(
+    "vppInfo",
+    () => mdmAppleAPI.getVppTokens(),
+    {
+      ...DEFAULT_USE_QUERY_OPTIONS,
+      retry: false,
+      enabled: isPremiumTier && isMdmEnabled,
+    }
+  );
 
-  const navigateToWindowsMdm = () => {
-    router.push(PATHS.ADMIN_INTEGRATIONS_MDM_WINDOWS);
-  };
+  // get the eula metadata
+  const {
+    data: eulaMetadata,
+    isLoading: isLoadingEula,
+    isError: isEulaError,
+    error: eulaError,
+    refetch: refetchEulaMetadata,
+  } = useQuery<IEulaMetadataResponse, AxiosError>(
+    ["eula-metadata"],
+    () => mdmAPI.getEULAMetadata(),
+    {
+      ...DEFAULT_USE_QUERY_OPTIONS,
+      retry: false,
+      enabled: isPremiumTier && isMdmEnabled,
+    }
+  );
+
+  // we use this to determine if we any of the request are still in progress
+  // and should show a spinner.
+  const isLoading = isLoadingAPNSInfo || isLoadingVpp || isLoadingEula;
+
+  const noVppTokenUploaded = !vppData || !vppData.vpp_tokens.length;
+  const hasVppError = isVppError && !noVppTokenUploaded;
+
+  // We are relying on the API to give us a 404 to
+  // tell use the user has not uploaded a eula.
+  const noEulaUploaded = eulaError && eulaError.status === 404;
+  const hasEulaError = isEulaError && !noEulaUploaded;
+
+  // we use this to determine if there was any errors when getting any of the
+  // data we depend on to render the page. We will not include the VPP or EULA
+  // 404 errors. We only want to show an error if there was a "real" error
+  // (e.g.non 404 error).
+  const hasError = isAPNSInfoError || hasVppError || hasEulaError;
+
+  // we use this to determine if we have all the data we need to render the UI.
+  // Notice that we do not need VPP or EULA data to render this page.
+  const hasAllData = !isMdmEnabled || !!APNSInfo;
 
   return (
     <div className={baseClass}>
-      <div className={`${baseClass}__section`}>
-        <SectionHeader title="Mobile device management (MDM)" />
-        {isLoadingMdmApple ? (
-          <Spinner />
-        ) : (
-          <div className={`${baseClass}__section ${baseClass}__mdm-section`}>
-            <AppleMdmCard
-              appleAPNInfo={appleAPNInfo}
-              errorData={errorMdmApple}
-              turnOnAppleMdm={navigateToAppleMdm}
-              viewDetails={navigateToAppleMdm}
-            />
-            <WindowsMdmCard
-              turnOnWindowsMdm={navigateToWindowsMdm}
-              editWindowsMdm={navigateToWindowsMdm}
-            />
-          </div>
-        )}
-      </div>
-      {isPremiumTier && appleAPNInfo && (
-        <div className={`${baseClass}__section`}>
-          <EndUserMigrationSection router={router} />
-        </div>
+      {/* The MDM settings section component handles showing the pages overall
+       * loading and error states */}
+      <MdmSettingsSection
+        isLoading={isLoading}
+        isError={hasError}
+        appleAPNSInfo={APNSInfo}
+        appleAPNSError={errorAPNSInfo}
+        router={router}
+      />
+      {!isLoading && !hasError && hasAllData && (
+        <>
+          <AutomaticEnrollmentSection
+            router={router}
+            isPremiumTier={!!isPremiumTier}
+          />
+          <VppSection
+            router={router}
+            isVppOn={!noVppTokenUploaded}
+            isPremiumTier={!!isPremiumTier}
+          />
+          {isPremiumTier && !!config?.mdm.apple_bm_enabled_and_configured && (
+            <>
+              <IdpSection />
+              <EulaSection
+                eulaMetadata={eulaMetadata}
+                isEulaUploaded={!noEulaUploaded}
+                onUpload={refetchEulaMetadata}
+                onDelete={refetchEulaMetadata}
+              />
+              <EndUserMigrationSection router={router} />
+            </>
+          )}
+        </>
       )}
     </div>
   );
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/VppPage.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/VppPage.tsx
new file mode 100644
index 0000000000..3c08f62912
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/VppPage.tsx
@@ -0,0 +1,262 @@
+import React, { useCallback, useContext, useRef, useState } from "react";
+import { InjectedRouter } from "react-router";
+import { AxiosError } from "axios";
+import { useQuery } from "react-query";
+
+import PATHS from "router/paths";
+import { AppContext } from "context/app";
+import { IMdmVppToken } from "interfaces/mdm";
+import mdmAppleAPI, {
+  IGetVppTokensResponse,
+} from "services/entities/mdm_apple";
+
+import BackLink from "components/BackLink";
+import MainContent from "components/MainContent";
+import Button from "components/buttons/Button";
+import DataError from "components/DataError";
+import Spinner from "components/Spinner";
+import PremiumFeatureMessage from "components/PremiumFeatureMessage";
+
+import AddVppModal from "./components/AddVppModal";
+import RenewVppModal from "./components/RenewVppModal";
+import DeleteVppModal from "./components/DeleteVppModal";
+import VppTable from "./components/VppTable";
+import EditTeamsVppModal from "./components/EditTeamsVppModal";
+
+const baseClass = "vpp-page";
+
+interface ITurnOnMdmMessageProps {
+  router: InjectedRouter;
+}
+
+const TurnOnMdmMessage = ({ router }: ITurnOnMdmMessageProps) => {
+  return (
+    <div className={`${baseClass}__turn-on-mdm-message`}>
+      <h2>Turn on Apple MDM</h2>
+      <p>
+        To install Apple App Store apps purchased through Apple Business
+        Manager, first turn on Apple MDM.
+      </p>
+      <Button
+        variant="brand"
+        onClick={() => {
+          router.push(PATHS.ADMIN_INTEGRATIONS_MDM);
+        }}
+      >
+        Turn on
+      </Button>
+    </div>
+  );
+};
+
+interface IAddVppMessageProps {
+  onAddVpp: () => void;
+}
+
+const AddVppMessage = ({ onAddVpp }: IAddVppMessageProps) => {
+  return (
+    <div className={`${baseClass}__add-vpp-message`}>
+      <h2>Add your VPP</h2>
+      <p>
+        Install Apple App Store apps purchased through Apple Business Manager.
+      </p>
+      <Button variant="brand" onClick={onAddVpp}>
+        Add VPP
+      </Button>
+    </div>
+  );
+};
+
+interface IVppPageProps {
+  router: InjectedRouter;
+}
+
+const VppPage = ({ router }: IVppPageProps) => {
+  const { config, isPremiumTier } = useContext(AppContext);
+
+  const [showRenewModal, setShowRenewModal] = useState(false);
+  const [showDeleteModal, setShowDeleteModal] = useState(false);
+  const [showAddVppModal, setShowAddVppModal] = useState(false);
+  const [showEditTeamsModal, setShowEditTeamsModal] = useState(false);
+
+  const selectedToken = useRef<IMdmVppToken | null>(null);
+
+  const {
+    data: vppTokens,
+    error: errorVppTokens,
+    isLoading,
+    refetch,
+  } = useQuery<IGetVppTokensResponse, AxiosError, IMdmVppToken[]>(
+    ["vpp_tokens"],
+    () => mdmAppleAPI.getVppTokens(),
+    {
+      refetchOnWindowFocus: false,
+      retry: (tries, error) =>
+        error.status !== 404 && error.status !== 400 && tries <= 3,
+      select: (data) => data.vpp_tokens,
+      enabled: isPremiumTier,
+    }
+  );
+
+  const onEditTokenTeams = (token: IMdmVppToken) => {
+    selectedToken.current = token;
+    setShowEditTeamsModal(true);
+  };
+
+  const onCancelEditTokenTeams = useCallback(() => {
+    selectedToken.current = null;
+    setShowEditTeamsModal(false);
+  }, []);
+
+  const onEditedTeams = useCallback(() => {
+    selectedToken.current = null;
+    refetch();
+    setShowEditTeamsModal(false);
+  }, [refetch]);
+
+  const onAddVpp = () => {
+    setShowAddVppModal(true);
+  };
+
+  const onAdded = () => {
+    refetch();
+    setShowAddVppModal(false);
+  };
+
+  const onRenewToken = (vppToken: IMdmVppToken) => {
+    selectedToken.current = vppToken;
+    setShowRenewModal(true);
+  };
+
+  const onCancelRenewToken = useCallback(() => {
+    selectedToken.current = null;
+    setShowRenewModal(false);
+  }, []);
+
+  const onRenewed = useCallback(() => {
+    selectedToken.current = null;
+    refetch();
+    setShowRenewModal(false);
+  }, [refetch]);
+
+  const onDeleteToken = (vppToken: IMdmVppToken) => {
+    selectedToken.current = vppToken;
+    setShowDeleteModal(true);
+  };
+
+  const onCancelDeleteToken = useCallback(() => {
+    selectedToken.current = null;
+    setShowDeleteModal(false);
+  }, []);
+
+  const onDeleted = useCallback(() => {
+    selectedToken.current = null;
+    refetch();
+    setShowDeleteModal(false);
+  }, [refetch]);
+
+  const showDataError = errorVppTokens && errorVppTokens.status !== 404;
+
+  const renderContent = () => {
+    if (!isPremiumTier) {
+      return <PremiumFeatureMessage />;
+    }
+
+    if (!config?.mdm.enabled_and_configured) {
+      return <TurnOnMdmMessage router={router} />;
+    }
+
+    if (isLoading) {
+      return <Spinner />;
+    }
+
+    // TODO: error UI
+    if (showDataError) {
+      return (
+        <div>
+          <DataError />
+        </div>
+      );
+    }
+
+    if (vppTokens?.length === 0) {
+      return <AddVppMessage onAddVpp={onAddVpp} />;
+    }
+
+    if (vppTokens) {
+      return (
+        <>
+          <p>
+            Add your VPP to install Apple App Store apps purchased through Apple
+            Business Manager.
+          </p>
+          <VppTable
+            vppTokens={vppTokens}
+            onEditTokenTeam={onEditTokenTeams}
+            onRenewToken={onRenewToken}
+            onDeleteToken={onDeleteToken}
+          />
+        </>
+      );
+    }
+
+    return null;
+  };
+
+  return (
+    <MainContent className={baseClass}>
+      <>
+        <BackLink
+          text="Back to MDM"
+          path={PATHS.ADMIN_INTEGRATIONS_MDM}
+          className={`${baseClass}__back-to-mdm`}
+        />
+        <div className={`${baseClass}__page-content`}>
+          <div className={`${baseClass}__page-header-section`}>
+            <h1>Volume Purchasing Program (VPP)</h1>
+            {isPremiumTier &&
+              vppTokens?.length !== 0 &&
+              !!config?.mdm.enabled_and_configured && (
+                <Button variant="brand" onClick={onAddVpp}>
+                  Add VPP
+                </Button>
+              )}
+          </div>
+          <>{renderContent()}</>
+        </div>
+      </>
+      {showAddVppModal && (
+        <AddVppModal
+          onAdded={onAdded}
+          onCancel={() => setShowAddVppModal(false)}
+        />
+      )}
+      {showRenewModal && selectedToken.current && (
+        <RenewVppModal
+          tokenId={selectedToken.current.id}
+          orgName={selectedToken.current.org_name}
+          onCancel={onCancelRenewToken}
+          onRenewedToken={onRenewed}
+        />
+      )}
+      {showDeleteModal && selectedToken.current && (
+        <DeleteVppModal
+          orgName={selectedToken.current.org_name}
+          tokenId={selectedToken.current.id}
+          onCancel={onCancelDeleteToken}
+          onDeletedToken={onDeleted}
+        />
+      )}
+      {showEditTeamsModal && selectedToken.current && (
+        <EditTeamsVppModal
+          currentToken={selectedToken.current}
+          tokens={vppTokens || []}
+          onCancel={onCancelEditTokenTeams}
+          onSuccess={onEditedTeams}
+        />
+      )}
+    </MainContent>
+  );
+};
+
+export default VppPage;
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/_styles.scss b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/_styles.scss
new file mode 100644
index 0000000000..dd76601ce9
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/_styles.scss
@@ -0,0 +1,67 @@
+.vpp-page {
+  &__back-to-mdm {
+    margin-bottom: $pad-xlarge;
+  }
+
+  &__page-content {
+    display: flex;
+    flex-direction: column;
+    gap: $pad-xxlarge;
+  }
+
+  &__page-header-section {
+    display: flex;
+    flex-direction: row;
+    gap: $pad-large;
+    align-items: center;
+    justify-content: space-between;
+
+    h1 {
+      margin-bottom: 0;
+      font-size: $large;
+    }
+  }
+
+
+  &__turn-on-mdm-message,
+  &__add-vpp-message {
+    margin: 0 auto;
+    text-align: center;
+    width: 450px;
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    justify-content: center;
+
+    >h2 {
+      margin-bottom: $pad-small;
+      font-size: $small;
+      font-weight: $bold;
+    }
+
+    >p {
+      margin: 0 0 $pad-medium;
+    }
+  }
+
+  &__url-inputs-wrapper {
+    display: flex;
+    flex-direction: column;
+    gap: $pad-icon;
+    margin-top: $pad-large;
+  }
+
+  &__url-input {
+    margin-bottom: 0;
+  }
+
+  // TODO: remove these styles when the updated error component is used
+  .data-error {
+    margin: $pad-xxlarge 0;
+    padding: $pad-xlarge 0;
+  }
+
+  .data-error__inner {
+    padding: $pad-xlarge 0;
+  }
+}
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/AddVppModal/AddVppModal.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/AddVppModal/AddVppModal.tsx
new file mode 100644
index 0000000000..520cea425f
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/AddVppModal/AddVppModal.tsx
@@ -0,0 +1,90 @@
+import React, { useCallback, useContext, useState } from "react";
+
+import { NotificationContext } from "context/notification";
+import { getErrorReason } from "interfaces/errors";
+import mdmAppleAPI from "services/entities/mdm_apple";
+
+import Modal from "components/Modal";
+import Button from "components/buttons/Button";
+import FileUploader from "components/FileUploader";
+
+import VppSetupSteps from "../VppSetupSteps";
+import { getErrorMessage } from "./helpers";
+
+const baseClass = "add-vpp-modal";
+
+interface IAddVppModalProps {
+  onCancel: () => void;
+  onAdded: () => void;
+}
+
+const AddVppModal = ({ onCancel, onAdded }: IAddVppModalProps) => {
+  const { renderFlash } = useContext(NotificationContext);
+
+  const [tokenFile, setTokenFile] = useState<File | null>(null);
+  const [isUploading, setIsUploading] = useState(false);
+
+  const onSelectFile = useCallback((files: FileList | null) => {
+    const file = files?.[0];
+    if (file) {
+      setTokenFile(file);
+    }
+  }, []);
+
+  const uploadVppToken = useCallback(async () => {
+    setIsUploading(true);
+    if (!tokenFile) {
+      setIsUploading(false);
+      renderFlash("error", "No token selected.");
+      return;
+    }
+
+    try {
+      await mdmAppleAPI.uploadVppToken(tokenFile);
+      renderFlash("success", "Added successfully.");
+      onAdded();
+    } catch (e) {
+      renderFlash("error", getErrorMessage(e));
+      onCancel();
+    } finally {
+      setIsUploading(false);
+    }
+  }, [tokenFile, renderFlash, onAdded, onCancel]);
+
+  return (
+    <Modal
+      className={baseClass}
+      title="Add VPP"
+      onExit={onCancel}
+      width="large"
+    >
+      <>
+        <VppSetupSteps extendendSteps />
+        <FileUploader
+          className={`${baseClass}__file-uploader ${
+            isUploading ? `${baseClass}__file-uploader--loading` : ""
+          }`}
+          accept=".vpptoken"
+          message="Content token (.vpptoken)"
+          graphicName="file-vpp"
+          buttonType="link"
+          buttonMessage={isUploading ? "Uploading..." : "Upload"}
+          fileDetails={tokenFile ? { name: tokenFile.name } : undefined}
+          onFileUpload={onSelectFile}
+        />
+        <div className="modal-cta-wrap">
+          <Button
+            variant="brand"
+            onClick={uploadVppToken}
+            isLoading={isUploading}
+            disabled={!tokenFile || isUploading}
+          >
+            Add VPP
+          </Button>
+        </div>
+      </>
+    </Modal>
+  );
+};
+
+export default AddVppModal;
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/AddVppModal/_styles.scss b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/AddVppModal/_styles.scss
new file mode 100644
index 0000000000..072f29a9d5
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/AddVppModal/_styles.scss
@@ -0,0 +1,59 @@
+.add-vpp-modal {
+
+  &__request-button {
+    display: flex;
+    gap: $pad-small;
+    align-items: center;
+    margin-top: $pad-small;
+
+    label {
+      display: flex;
+      gap: $pad-small;
+      cursor: pointer;
+    }
+  }
+
+  &__setup-list {
+    font-size: $x-small;
+    display: flex;
+    flex-direction: column;
+    gap: $pad-large;
+    padding: 0;
+    margin: 0;
+    max-width: 660px;
+    list-style: none;
+
+    li {
+      display: flex;
+      flex-direction: row;
+      gap: $pad-small;
+
+      p {
+        display: flex;
+        flex-direction: column;
+        align-items: flex-start;
+        margin: 0;
+      }
+    }
+  }
+
+  &__file-uploader {
+    margin-top: $pad-medium;
+    margin-left: $pad-medium;
+
+    .file-uploader__message {
+      color: $ui-fleet-black-75;
+      margin: 0;
+    }
+
+    button {
+      margin-top: 0;
+    }
+
+    &--loading {
+      label {
+        opacity: 0.5;
+      }
+    }
+  }
+}
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/AddVppModal/helpers.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/AddVppModal/helpers.tsx
new file mode 100644
index 0000000000..7716c6de6c
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/AddVppModal/helpers.tsx
@@ -0,0 +1,35 @@
+import React from "react";
+
+import { getErrorReason } from "interfaces/errors";
+
+const DEFAULT_ERROR_MESSAGE = "Couldn’t add. Please try again.";
+
+const generateDuplicateMessage = (msg: string) => {
+  const orgName = msg.split("'")[1];
+  return (
+    <>
+      Couldn&apos;t add. There&apos;s already a VPP connection for the{" "}
+      <b>{orgName}</b> location.
+    </>
+  );
+};
+
+// eslint-disable-next-line import/prefer-default-export
+export const getErrorMessage = (err: unknown) => {
+  const duplicateEntryReason = getErrorReason(err, {
+    reasonIncludes: "Duplicate entry",
+  });
+  const invalidTokenReason = getErrorReason(err, {
+    reasonIncludes: "Invalid token",
+  });
+
+  if (duplicateEntryReason) {
+    return generateDuplicateMessage(duplicateEntryReason);
+  }
+
+  if (invalidTokenReason) {
+    return invalidTokenReason;
+  }
+
+  return DEFAULT_ERROR_MESSAGE;
+};
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/AddVppModal/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/AddVppModal/index.ts
new file mode 100644
index 0000000000..766b0c2cfe
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/AddVppModal/index.ts
@@ -0,0 +1 @@
+export { default } from "./AddVppModal";
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/DeleteVppModal/DeleteVppModal.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/DeleteVppModal/DeleteVppModal.tsx
new file mode 100644
index 0000000000..8f36149861
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/DeleteVppModal/DeleteVppModal.tsx
@@ -0,0 +1,82 @@
+import React, { useCallback, useContext, useState } from "react";
+
+import mdmAppleAPI from "services/entities/mdm_apple";
+import { NotificationContext } from "context/notification";
+
+import Button from "components/buttons/Button";
+import Modal from "components/Modal";
+
+const baseClass = "delete-vpp-modal";
+
+interface IDeleteVppModalProps {
+  orgName: string;
+  tokenId: number;
+  onCancel: () => void;
+  onDeletedToken: () => void;
+}
+
+const DeleteVppModal = ({
+  orgName,
+  tokenId,
+  onCancel,
+  onDeletedToken,
+}: IDeleteVppModalProps) => {
+  const { renderFlash } = useContext(NotificationContext);
+
+  const [isDeleting, setIsDeleting] = useState(false);
+
+  const onDeleteToken = useCallback(async () => {
+    setIsDeleting(true);
+
+    try {
+      await mdmAppleAPI.deleteVppToken(tokenId);
+      renderFlash("success", "Deleted successfully.");
+      onDeletedToken();
+    } catch (e) {
+      // TODO: Check API sends back correct error messages
+      renderFlash("error", "Couldn’t delete. Please try again.");
+      onCancel();
+    }
+  }, [onCancel, onDeletedToken, renderFlash, tokenId]);
+
+  return (
+    <Modal
+      title="Delete VPP"
+      className={baseClass}
+      onExit={onCancel}
+      isContentDisabled={isDeleting}
+    >
+      <>
+        <p>
+          Apps purchased for the <b>{orgName}</b> location won&apos;t appear in
+          Fleet. Apps won&apos;t be uninstalled from hosts.
+        </p>
+        <p>
+          If you want to enable VPP integration again, you&apos;ll have to
+          upload a new token.
+        </p>
+
+        <div className="modal-cta-wrap">
+          <Button
+            type="button"
+            variant="alert"
+            onClick={onDeleteToken}
+            disabled={isDeleting}
+            isLoading={isDeleting}
+          >
+            Delete
+          </Button>
+          <Button
+            onClick={onCancel}
+            disabled={isDeleting}
+            variant="inverse-alert"
+          >
+            Cancel
+          </Button>
+        </div>
+      </>
+    </Modal>
+  );
+};
+
+export default DeleteVppModal;
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/DeleteVppModal/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/DeleteVppModal/index.ts
new file mode 100644
index 0000000000..a95996dfdb
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/DeleteVppModal/index.ts
@@ -0,0 +1 @@
+export { default } from "./DeleteVppModal";
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/EditTeamsVppModal/EditTeamsVppModal.tests.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/EditTeamsVppModal/EditTeamsVppModal.tests.tsx
new file mode 100644
index 0000000000..8db87eb38e
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/EditTeamsVppModal/EditTeamsVppModal.tests.tsx
@@ -0,0 +1,224 @@
+import {
+  APP_CONTEXT_ALL_TEAMS_ID,
+  APP_CONTEXT_NO_TEAM_ID,
+} from "interfaces/team";
+import {
+  getOptions,
+  selectedValueFromToken,
+  teamIdsFromSelectedValue,
+  updateSelectedValue,
+} from "./EditTeamsVppModal";
+
+describe("EditTeamsVppModal", () => {
+  const allTeamsToken = {
+    id: 1,
+    org_name: "Org 1",
+    location: "https://example.com/mdm/apple/mdm",
+    renew_date: "2024-11-29T00:00:00Z",
+    teams: [], // all teams
+  };
+
+  const unassignedToken = {
+    id: 2,
+    org_name: "Org 2",
+    location: "https://example.com/mdm/apple/mdm",
+    renew_date: "2024-11-29T00:00:00Z",
+    teams: null, // unassigned
+  };
+
+  const noTeamToken = {
+    id: 3,
+    org_name: "Org 3",
+    location: "https://example.com/mdm/apple/mdm",
+    renew_date: "2024-11-29T00:00:00Z",
+    teams: [{ team_id: 0, name: "No team" }],
+  };
+
+  const piratesAndNinjasToken = {
+    id: 4,
+    org_name: "Org 4",
+    location: "https://example.com/mdm/apple/mdm",
+    renew_date: "2024-11-29T00:00:00Z",
+    teams: [
+      { team_id: 2, name: "Pirates" },
+      { team_id: 1, name: "Ninjas" },
+    ],
+  };
+
+  const pandasToken = {
+    id: 5,
+    org_name: "Org 5",
+    location: "https://example.com/mdm/apple/mdm",
+    renew_date: "2024-11-29T00:00:00Z",
+    teams: [{ team_id: 3, name: "Pandas" }],
+  };
+
+  const availableTeams = [
+    { id: APP_CONTEXT_ALL_TEAMS_ID, name: "All teams" },
+    { id: APP_CONTEXT_NO_TEAM_ID, name: "No team" },
+    { id: 1, name: "Ninjas" },
+    { id: 2, name: "Pirates" },
+    { id: 3, name: "Pandas" },
+    { id: 4, name: "Penguins" },
+  ];
+
+  const allOptions = availableTeams.map((t) => ({
+    label: t.name,
+    value: t.id,
+  }));
+
+  describe("getOptions", () => {
+    it("returns no options when another token is all teams", () => {
+      const tokens = [allTeamsToken, piratesAndNinjasToken];
+      const currentToken = piratesAndNinjasToken;
+      const options = getOptions(availableTeams, tokens, currentToken);
+      expect(options).toEqual([]);
+    });
+
+    it("includes all options when all tokens are unassigned", () => {
+      const tokens = [
+        unassignedToken,
+        { ...unassignedToken, id: 1337 },
+        { ...unassignedToken, id: 1338 },
+      ];
+      const currentToken = unassignedToken;
+      const options = getOptions(availableTeams, tokens, currentToken);
+      expect(options).toEqual(allOptions);
+    });
+
+    it("includes all options when current token is all teams and other tokens are unassigned", () => {
+      const tokens = [
+        allTeamsToken,
+        unassignedToken,
+        { ...unassignedToken, id: 1337 },
+        { ...unassignedToken, id: 1338 },
+      ];
+      const currentToken = allTeamsToken;
+      const options = getOptions(availableTeams, tokens, currentToken);
+      expect(options).toEqual(allOptions);
+    });
+
+    it("excludes all teams option when any token is assigned", () => {
+      const tokens = [unassignedToken, piratesAndNinjasToken];
+      const currentToken = unassignedToken;
+      const options = getOptions(availableTeams, tokens, currentToken);
+      expect(options).toEqual(
+        options.filter((o) => o.value !== APP_CONTEXT_ALL_TEAMS_ID)
+      );
+    });
+
+    it("excludes teams assigned to other tokens", () => {
+      const tokens = [
+        piratesAndNinjasToken,
+        noTeamToken,
+        pandasToken,
+        unassignedToken,
+      ];
+
+      // test with unassignedToken
+      expect(getOptions(availableTeams, tokens, unassignedToken)).toEqual([
+        { label: "Penguins", value: 4 }, // only penguins is available
+      ]);
+
+      // test with piratesAndNinjasToken
+      let unavailableTeamIds = [
+        APP_CONTEXT_ALL_TEAMS_ID, // all teams is excluded unless current token is all teams or all tokens are unassigned
+        APP_CONTEXT_NO_TEAM_ID, // already assigned to noTeamToken
+        3, // already assigned to pandasToken
+      ];
+      expect(getOptions(availableTeams, tokens, piratesAndNinjasToken)).toEqual(
+        allOptions.filter((o) => !unavailableTeamIds.includes(o.value))
+      );
+
+      // test with pandasToken
+      unavailableTeamIds = [
+        APP_CONTEXT_ALL_TEAMS_ID, // all teams is excluded unless current token is all teams or all tokens are unassigned
+        APP_CONTEXT_NO_TEAM_ID, // already assigned to noTeamToken
+        1, // already assigned to piratesAndNinjasToken
+        2, // already assigned to piratesAndNinjasToken
+      ];
+      expect(getOptions(availableTeams, tokens, pandasToken)).toEqual(
+        allOptions.filter((o) => !unavailableTeamIds.includes(o.value))
+      );
+
+      // test with noTeamToken
+      unavailableTeamIds = [
+        APP_CONTEXT_ALL_TEAMS_ID, // all teams is excluded unless current token is all teams or all tokens are unassigned
+        1, // already assigned to piratesAndNinjasToken
+        2, // already assigned to piratesAndNinjasToken
+        3, // already assigned to pandasToken
+      ];
+      expect(getOptions(availableTeams, tokens, noTeamToken)).toEqual(
+        allOptions.filter((o) => !unavailableTeamIds.includes(o.value))
+      );
+
+      // test with allTeamsToken
+      unavailableTeamIds = [
+        APP_CONTEXT_NO_TEAM_ID, // already assigned to noTeamToken
+        1, // already assigned to piratesAndNinjasToken
+        2, // already assigned to piratesAndNinjasToken
+        3, // already assigned to pandasToken
+      ];
+      expect(
+        getOptions(availableTeams, [...tokens, allTeamsToken], allTeamsToken)
+      ).toEqual(
+        allOptions.filter((o) => !unavailableTeamIds.includes(o.value))
+      );
+    });
+  });
+  describe("updateSelectedValue", () => {
+    it("returns next value when only one team is selected", () => {
+      const prev = "1";
+      const next = "2";
+      expect(updateSelectedValue(prev, next)).toEqual(next);
+    });
+
+    it("removes all teams when all teams was previously selected", () => {
+      const prev = "-1,2";
+      const next = "2";
+      expect(updateSelectedValue(prev, next)).toEqual(next);
+    });
+
+    it("selects all teams when all teams is newly selected", () => {
+      const prev = "2";
+      const next = "2,-1";
+      expect(updateSelectedValue(prev, next)).toEqual("-1");
+    });
+
+    it("returns next value when all teams is not selected", () => {
+      const prev = "2";
+      const next = "2,3";
+      expect(updateSelectedValue(prev, next)).toEqual(next);
+    });
+  });
+
+  describe("selectedValueFromToken", () => {
+    it("returns empty string when teams is null", () => {
+      expect(selectedValueFromToken(unassignedToken)).toEqual("");
+    });
+
+    it("returns all teams when teams is empty", () => {
+      expect(selectedValueFromToken(allTeamsToken)).toEqual("-1");
+    });
+
+    it("returns team ids when teams is not empty", () => {
+      expect(selectedValueFromToken(piratesAndNinjasToken)).toEqual("2,1");
+    });
+  });
+
+  describe("teamIdsFromSelectedValue", () => {
+    it("returns empty array when value is all teams id", () => {
+      expect(
+        teamIdsFromSelectedValue(APP_CONTEXT_ALL_TEAMS_ID.toString())
+      ).toEqual([]);
+    });
+
+    it("returns mull when value is empty string", () => {
+      expect(teamIdsFromSelectedValue("")).toEqual(null);
+    });
+
+    it("returns team ids when value is not all teams id", () => {
+      expect(teamIdsFromSelectedValue("2,1")).toEqual([2, 1]);
+    });
+  });
+});
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/EditTeamsVppModal/EditTeamsVppModal.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/EditTeamsVppModal/EditTeamsVppModal.tsx
new file mode 100644
index 0000000000..029380e60e
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/EditTeamsVppModal/EditTeamsVppModal.tsx
@@ -0,0 +1,259 @@
+import React, { useCallback, useContext, useMemo, useState } from "react";
+
+import { AppContext } from "context/app";
+import { NotificationContext } from "context/notification";
+
+import { IMdmVppToken } from "interfaces/mdm";
+import { APP_CONTEXT_ALL_TEAMS_ID, ITeamSummary } from "interfaces/team";
+
+import mdmAppleAPI from "services/entities/mdm_apple";
+
+import Modal from "components/Modal";
+// @ts-ignore
+import Dropdown from "components/forms/fields/Dropdown";
+import Button from "components/buttons/Button";
+import TooltipWrapper from "components/TooltipWrapper";
+
+const baseClass = "edit-teams-vpp-modal";
+
+interface IEditTeamsVppModalProps {
+  currentToken: IMdmVppToken;
+  tokens: IMdmVppToken[];
+  onCancel: () => void;
+  onSuccess: () => void;
+}
+
+/**
+ * Returns an array of team ids from a token. It includes special handling for "All teams".
+ */
+export const selectedValueFromToken = (token: IMdmVppToken) => {
+  if (!token.teams) {
+    // if teams is null, it means the token isn't configured to any team
+    return "";
+  }
+  if (token.teams.length === 0) {
+    // if teams is an empty array, it means the token is configured to all teams
+    return APP_CONTEXT_ALL_TEAMS_ID.toString();
+  }
+  return token.teams.map((team) => team.team_id).join(",");
+};
+
+/** Returns an array of team ids for the API. It includes special handling for "All teams". */
+export const teamIdsFromSelectedValue = (selectedValue: string) => {
+  if (!selectedValue) {
+    // TODO: confirm whether the API will allow un-configuring a token
+    return null;
+  }
+  if (selectedValue === APP_CONTEXT_ALL_TEAMS_ID.toString()) {
+    return [];
+  }
+  const ids = selectedValue.split(",").map((str) => parseInt(str, 10));
+  // NOTE: We could do some extra frontend validation here like filtering out -1 (to ensure that
+  // we're not trying to send all teams and other teams at the same time) and checking for isNaN,
+  // but instead we're relying on the API to return an error if the request is invalid.
+  return ids;
+};
+
+/**
+ * Compare two comma-separated strings of team names and returns an updated value. It includes
+ * special handling for "All teams".
+ */
+export const updateSelectedValue = (prev: string, next: string) => {
+  // react-select uses a string of comma-separated values for multi-select so we split it
+  // fo get an array of selected team ids
+  const nextParts = next.split(",").map((p) => p.trim());
+  if (nextParts.length === 1) {
+    // if only one team is selected, no need for other checks
+    return next;
+  }
+
+  // we need to do some special handling for "All teams"
+  const allTeamsId = APP_CONTEXT_ALL_TEAMS_ID.toString();
+  // split the previous value to get an array of team ids
+  const prevParts = prev.split(",").map((p) => p.trim());
+  if (prevParts.includes(allTeamsId)) {
+    // if "All teams" was previously selected, we need to remove it from the next selections
+    return nextParts.filter((p) => p !== allTeamsId).join(", ");
+  }
+
+  // if "All teams" is newly selected, we need to remove any other selections
+  if (nextParts.includes(allTeamsId)) {
+    return allTeamsId;
+  }
+
+  // otherwise, just return the next selections
+  return next;
+};
+
+const isTokenAllTeams = (token: IMdmVppToken) => token.teams?.length === 0;
+
+const isTokenUnassigned = (token: IMdmVppToken) => token.teams === null;
+
+/**
+ * Returns a dictionary of team ids that are already assigned tokens other than the current token.
+ */
+const getUnavailableTeamIds = (
+  currentTokenId: number,
+  tokens: IMdmVppToken[]
+) => {
+  const unavailableTeamIds = {} as Record<string, boolean>;
+  tokens.forEach((token) => {
+    if (token.id === currentTokenId) {
+      return;
+    }
+    token.teams?.forEach((team) => {
+      unavailableTeamIds[team.team_id.toString()] = true;
+    });
+  });
+  return unavailableTeamIds;
+};
+
+/**
+ * Returns an array of options for the dropdown. It includes special handling for "All teams".
+ */
+export const getOptions = (
+  availableTeams: ITeamSummary[],
+  tokens: IMdmVppToken[],
+  currentToken: IMdmVppToken
+) => {
+  const allOptions =
+    availableTeams?.map((t) => ({
+      label: t.name,
+      value: t.id,
+    })) || [];
+
+  if (tokens.every(isTokenUnassigned)) {
+    // if all tokens are unassigned, we can include all options
+    return allOptions;
+  }
+
+  if (tokens.some(isTokenAllTeams) && !isTokenAllTeams(currentToken)) {
+    // if another token is assigned to all teams, we can't assign this token to any team
+    return [];
+  }
+
+  // if other tokens are assigned to specific teams, we'll filter out those team options
+  const unavailableTeamIds = getUnavailableTeamIds(currentToken.id, tokens);
+  if (!isTokenAllTeams(currentToken)) {
+    // if current token isn't already assigned to all teams, we'll exclude that option too
+    unavailableTeamIds[APP_CONTEXT_ALL_TEAMS_ID] = true;
+  }
+
+  return allOptions.filter((o) => !unavailableTeamIds[o.value]);
+};
+
+const EditTeamsVppModal = ({
+  tokens,
+  currentToken,
+  onCancel,
+  onSuccess,
+}: IEditTeamsVppModalProps) => {
+  const { renderFlash } = useContext(NotificationContext);
+  const { availableTeams } = useContext(AppContext);
+
+  // react-select uses a string of comma-separated values for multi-select so we're using a string
+  // of ids here so that we don't need to worry about a team name including a comma
+  const [selectedValue, setSelectedValue] = useState<string>(
+    selectedValueFromToken(currentToken)
+  );
+  const [isSaving, setIsSaving] = useState(false);
+
+  const options = useMemo(() => {
+    return getOptions(availableTeams || [], tokens, currentToken);
+  }, [availableTeams, tokens, currentToken]);
+
+  const isAnyTokenAllTeams = useMemo(() => tokens.some(isTokenAllTeams), [
+    tokens,
+  ]);
+
+  const onChange = useCallback((val: string) => {
+    setSelectedValue((prev) => updateSelectedValue(prev, val));
+  }, []);
+
+  const onSave = useCallback(
+    async (evt: React.MouseEvent<HTMLFormElement>) => {
+      evt.preventDefault();
+      setIsSaving(true);
+      try {
+        await mdmAppleAPI.editVppTeams({
+          tokenId: currentToken.id,
+          teamIds: teamIdsFromSelectedValue(selectedValue),
+        });
+        renderFlash("success", "Edited successfully.");
+        onSuccess();
+      } catch (e) {
+        renderFlash("error", "Couldn’t edit. Please try again.");
+      }
+    },
+    [currentToken.id, selectedValue, renderFlash, onSuccess]
+  );
+
+  const isDropdownDisabled = options.length === 0 && isAnyTokenAllTeams;
+
+  return (
+    <Modal
+      className={baseClass}
+      title="Edit teams"
+      onExit={onCancel}
+      width="large"
+      isContentDisabled={isSaving}
+    >
+      <>
+        <p>
+          Edit teams for <b>{currentToken.org_name}</b>.
+        </p>
+        <form onSubmit={onSave} className={baseClass} autoComplete="off">
+          <TooltipWrapper
+            position="top"
+            underline={false}
+            showArrow
+            tipContent={
+              <div className={`${baseClass}__tooltip--all-teams`}>
+                You can&apos;t choose teams because you already have a VPP token
+                assigned to all teams. First, edit teams for that VPP token to
+                choose teams here.
+              </div>
+            }
+            disableTooltip={!isDropdownDisabled}
+          >
+            <Dropdown
+              options={options}
+              multi
+              onChange={onChange}
+              placeholder="Search teams"
+              value={selectedValue}
+              label="Teams"
+              className={`${baseClass}__vpp-dropdown`}
+              wrapperClassName={`${baseClass}__form-field--vpp-teams ${
+                isDropdownDisabled ? `${baseClass}__form-field--disabled` : ""
+              }`}
+              tooltip={
+                isDropdownDisabled ? undefined : (
+                  <>
+                    Each team can have only one VPP token. Teams that already
+                    have a VPP token won&apos;t show up here.
+                  </>
+                )
+              }
+              helpText="App Store apps in this VPP token’s Apple Business Manager (ABM) will only be available to install on hosts in these teams."
+              disabled={isDropdownDisabled}
+            />
+          </TooltipWrapper>
+          <div className="modal-cta-wrap">
+            <Button
+              type="submit"
+              variant="brand"
+              className="save-vpp-teams-loading"
+              isLoading={isSaving}
+              disabled={isDropdownDisabled}
+            >
+              Save
+            </Button>
+          </div>
+        </form>
+      </>
+    </Modal>
+  );
+};
+
+export default EditTeamsVppModal;
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/EditTeamsVppModal/_styles.scss b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/EditTeamsVppModal/_styles.scss
new file mode 100644
index 0000000000..72ed9e4a10
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/EditTeamsVppModal/_styles.scss
@@ -0,0 +1,29 @@
+.edit-teams-vpp-modal {
+  .component__tooltip-wrapper__element {
+    width: 100%; // default component style was causing the select box not to be full width
+  }
+
+  // this is needed to wrap the selected team names in that are displayed
+  // in the dropdown select box.
+  .dropdown__select {
+    text-wrap: wrap;
+  }
+
+  // styles needed to make select look like figma design when disabled,
+  // default styles in the Dropdown component were not enough
+  &__form-field--disabled {
+    .Select.dropdown__select {
+      background-color: $ui-off-white;
+    }
+    .Select-placeholder {
+      color: $ui-fleet-black-50;
+    }
+    .form-field__help-text {
+      opacity: 0.6;
+    }
+  }
+  // TODO: how to adjust positioning of the tooltip so that it is just above the select box?
+  &__tooltip--all-teams {
+    text-align: center;
+  }
+}
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/EditTeamsVppModal/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/EditTeamsVppModal/index.ts
new file mode 100644
index 0000000000..0465dee0b0
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/EditTeamsVppModal/index.ts
@@ -0,0 +1 @@
+export { default } from "./EditTeamsVppModal";
diff --git a/frontend/pages/admin/IntegrationsPage/cards/Vpp/VppSetupPage/components/RenewVppTokenModal/RenewVppTokenModal.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/RenewVppModal/RenewVppModal.tsx
similarity index 58%
rename from frontend/pages/admin/IntegrationsPage/cards/Vpp/VppSetupPage/components/RenewVppTokenModal/RenewVppTokenModal.tsx
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/RenewVppModal/RenewVppModal.tsx
index dafd2b4b93..fa1c665350 100644
--- a/frontend/pages/admin/IntegrationsPage/cards/Vpp/VppSetupPage/components/RenewVppTokenModal/RenewVppTokenModal.tsx
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/RenewVppModal/RenewVppModal.tsx
@@ -1,27 +1,30 @@
-import React, { useContext, useState } from "react";
+import React, { useState, useContext, useCallback } from "react";
 
-import mdmAppleAPI from "services/entities/mdm_apple";
 import { NotificationContext } from "context/notification";
 import { getErrorReason } from "interfaces/errors";
+import mdmAppleAPI from "services/entities/mdm_apple";
 
-import Modal from "components/Modal";
 import Button from "components/buttons/Button";
-import FileUploader from "components/FileUploader";
-import { FileDetails } from "components/FileUploader/FileUploader";
-
+import { FileUploader } from "components/FileUploader/FileUploader";
+import Modal from "components/Modal";
 import VppSetupSteps from "../VppSetupSteps";
+import { getErrorMessage } from "./helpers";
 
-const baseClass = "renew-vpp-token-modal";
+const baseClass = "modal renew-vpp-modal";
 
-interface IRenewVppTokenModalProps {
-  onExit: () => void;
-  onTokenRenewed: () => void;
+interface IRenewVppModalProps {
+  tokenId: number;
+  orgName: string;
+  onCancel: () => void;
+  onRenewedToken: () => void;
 }
 
-const RenewVppTokenModal = ({
-  onExit,
-  onTokenRenewed,
-}: IRenewVppTokenModalProps) => {
+const RenewVppModal = ({
+  tokenId,
+  orgName,
+  onCancel,
+  onRenewedToken,
+}: IRenewVppModalProps) => {
   const { renderFlash } = useContext(NotificationContext);
   const [isRenewing, setIsRenewing] = useState(false);
   const [tokenFile, setTokenFile] = useState<File | null>(null);
@@ -33,7 +36,7 @@ const RenewVppTokenModal = ({
     }
   };
 
-  const onRenewToken = async () => {
+  const onRenewToken = useCallback(async () => {
     setIsRenewing(true);
 
     if (!tokenFile) {
@@ -43,27 +46,31 @@ const RenewVppTokenModal = ({
     }
 
     try {
-      await mdmAppleAPI.uploadVppToken(tokenFile);
+      await mdmAppleAPI.renewVppToken(tokenId, tokenFile);
       renderFlash(
         "success",
         "Volume Purchasing Program (VPP) integration enabled successfully."
       );
-      onTokenRenewed();
+      onRenewedToken();
     } catch (e) {
-      const msg = getErrorReason(e, { reasonIncludes: "valid token" });
-      if (msg) {
-        renderFlash("error", msg);
-      } else {
-        renderFlash("error", "Couldn't Upload. Please try again.");
-      }
+      renderFlash("error", getErrorMessage(e));
+      onCancel();
     }
-    onExit();
     setIsRenewing(false);
-  };
+  }, [onCancel, onRenewedToken, renderFlash, tokenFile, tokenId]);
 
   return (
-    <Modal title="Renew token" className={baseClass} onExit={onExit}>
+    <Modal
+      title="Renew VPP"
+      onExit={onCancel}
+      className={baseClass}
+      isContentDisabled={isRenewing}
+      width="large"
+    >
       <>
+        <p className={`${baseClass}__description`}>
+          Renew Volume Purchasing Program for <b>{orgName}</b> location.
+        </p>
         <VppSetupSteps />
         <FileUploader
           className={`${baseClass}__file-uploader`}
@@ -72,14 +79,7 @@ const RenewVppTokenModal = ({
           graphicName="file-vpp"
           buttonType="link"
           buttonMessage="Upload"
-          filePreview={
-            tokenFile && (
-              <FileDetails
-                details={{ name: tokenFile.name }}
-                graphicName="file-vpp"
-              />
-            )
-          }
+          fileDetails={tokenFile ? { name: tokenFile.name } : undefined}
           onFileUpload={onSelectFile}
         />
         <div className="modal-cta-wrap">
@@ -97,4 +97,4 @@ const RenewVppTokenModal = ({
   );
 };
 
-export default RenewVppTokenModal;
+export default RenewVppModal;
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/RenewVppModal/_styles.scss b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/RenewVppModal/_styles.scss
new file mode 100644
index 0000000000..c9079fd589
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/RenewVppModal/_styles.scss
@@ -0,0 +1,11 @@
+.renew-vpp-modal {
+
+  &__description {
+    margin: 0 0 $pad-large;
+  }
+
+  &__file-uploader {
+    margin-top: $pad-medium;
+    margin-left: $pad-medium;
+  }
+}
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/RenewVppModal/helpers.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/RenewVppModal/helpers.ts
new file mode 100644
index 0000000000..a7c0fe9ea2
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/RenewVppModal/helpers.ts
@@ -0,0 +1,16 @@
+import { getErrorReason } from "interfaces/errors";
+
+const DEFAULT_ERROR_MESSAGE = "Couldn’t renew. Please try again.";
+
+// eslint-disable-next-line import/prefer-default-export
+export const getErrorMessage = (err: unknown) => {
+  const invalidTokenReason = getErrorReason(err, {
+    reasonIncludes: "invalid",
+  });
+
+  if (invalidTokenReason) {
+    return "Invalid token. Please provide a valid token from Apple Business Manager.";
+  }
+
+  return DEFAULT_ERROR_MESSAGE;
+};
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/RenewVppModal/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/RenewVppModal/index.ts
new file mode 100644
index 0000000000..2064650e09
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/RenewVppModal/index.ts
@@ -0,0 +1 @@
+export { default } from "./RenewVppModal";
diff --git a/frontend/pages/admin/IntegrationsPage/cards/Vpp/VppSetupPage/components/VppSetupSteps/VppSetupSteps.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/VppSetupSteps/VppSetupSteps.tsx
similarity index 100%
rename from frontend/pages/admin/IntegrationsPage/cards/Vpp/VppSetupPage/components/VppSetupSteps/VppSetupSteps.tsx
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/VppSetupSteps/VppSetupSteps.tsx
diff --git a/frontend/pages/admin/IntegrationsPage/cards/Vpp/VppSetupPage/components/VppSetupSteps/_styles.scss b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/VppSetupSteps/_styles.scss
similarity index 100%
rename from frontend/pages/admin/IntegrationsPage/cards/Vpp/VppSetupPage/components/VppSetupSteps/_styles.scss
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/VppSetupSteps/_styles.scss
diff --git a/frontend/pages/admin/IntegrationsPage/cards/Vpp/VppSetupPage/components/VppSetupSteps/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/VppSetupSteps/index.ts
similarity index 100%
rename from frontend/pages/admin/IntegrationsPage/cards/Vpp/VppSetupPage/components/VppSetupSteps/index.ts
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/VppSetupSteps/index.ts
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/VppTable/TeamsCell/TeamsCell.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/VppTable/TeamsCell/TeamsCell.tsx
new file mode 100644
index 0000000000..57a21e7e48
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/VppTable/TeamsCell/TeamsCell.tsx
@@ -0,0 +1,110 @@
+import React from "react";
+import classnames from "classnames";
+
+import { ITokenTeam } from "interfaces/mdm";
+
+import TextCell from "components/TableContainer/DataTable/TextCell";
+import { uniqueId } from "lodash";
+import ReactTooltip from "react-tooltip";
+
+const baseClass = "teams-cell";
+
+const NUM_TEAMS_IN_TOOLTIP = 3;
+
+const generateCell = (teams: ITokenTeam[] | null) => {
+  if (!teams) {
+    return <TextCell value="---" grey />;
+  }
+
+  if (teams.length === 0) {
+    return <TextCell value="All Teams" />;
+  }
+
+  let text = "";
+  let italicize = true;
+  if (teams.length === 1) {
+    italicize = false;
+    text = teams[0].name;
+  } else {
+    text = `${teams.length} teams`;
+  }
+
+  return <TextCell value={text} italic={italicize} />;
+};
+
+const condenseTeams = (teams: ITokenTeam[]) => {
+  const condensed =
+    (teams?.length &&
+      teams
+        .slice(-NUM_TEAMS_IN_TOOLTIP)
+        .map((team) => team.name)
+        .reverse()) ||
+    [];
+
+  return teams.length > NUM_TEAMS_IN_TOOLTIP
+    ? condensed.concat(`+${teams.length - NUM_TEAMS_IN_TOOLTIP} more`)
+    : condensed;
+};
+
+const generateTooltip = (teams: ITokenTeam[] | null, tooltipId: string) => {
+  if (teams === null || teams.length <= 1) {
+    return null;
+  }
+
+  const condensedTeams = condenseTeams(teams);
+
+  return (
+    <ReactTooltip
+      effect="solid"
+      backgroundColor="#3e4771"
+      id={tooltipId}
+      data-html
+    >
+      <ul className={`${baseClass}__team-list`}>
+        {condensedTeams.map((teamName) => {
+          return <li key={teamName}>{teamName}</li>;
+        })}
+      </ul>
+    </ReactTooltip>
+  );
+};
+
+interface ITeamsCellProps {
+  teams: ITokenTeam[] | null;
+  className?: string;
+}
+
+const TeamsCell = ({ teams, className }: ITeamsCellProps) => {
+  const tooltipId = uniqueId();
+  const classNames = classnames(baseClass, className);
+
+  if (!teams) {
+    return <TextCell value={teams} />;
+  }
+
+  if (teams.length === 0) {
+    return <TextCell value="All Teams" />;
+  }
+
+  if (teams.length === 1) {
+    return <TextCell value={teams[0].name} />;
+  }
+
+  const cell = generateCell(teams);
+  const tooltip = generateTooltip(teams, tooltipId);
+
+  return (
+    <>
+      <div
+        className={`${baseClass}__team-text-with-tooltip`}
+        data-tip
+        data-for={tooltipId}
+      >
+        {cell}
+      </div>
+      {tooltip}
+    </>
+  );
+};
+
+export default TeamsCell;
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/VppTable/TeamsCell/_styles.scss b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/VppTable/TeamsCell/_styles.scss
new file mode 100644
index 0000000000..58f64d8de9
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/VppTable/TeamsCell/_styles.scss
@@ -0,0 +1,12 @@
+.teams-cell {
+  &__team-text-with-tooltip {
+    display: inline-block;
+  }
+
+  &__team-list {
+    margin: 0;
+    padding: 0;
+    list-style: none;
+    text-align: left;
+  }
+}
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/VppTable/TeamsCell/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/VppTable/TeamsCell/index.ts
new file mode 100644
index 0000000000..958df7313f
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/VppTable/TeamsCell/index.ts
@@ -0,0 +1 @@
+export { default } from "./TeamsCell";
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/VppTable/VppTable.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/VppTable/VppTable.tsx
new file mode 100644
index 0000000000..703c5af41e
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/VppTable/VppTable.tsx
@@ -0,0 +1,58 @@
+import React from "react";
+
+import { IMdmVppToken } from "interfaces/mdm";
+
+import TableContainer from "components/TableContainer";
+
+import { generateTableConfig } from "./VppTableConfig";
+
+const baseClass = "vpp-table";
+
+interface IVppTableProps {
+  vppTokens: IMdmVppToken[];
+  onEditTokenTeam: (token: IMdmVppToken) => void;
+  onRenewToken: (token: IMdmVppToken) => void;
+  onDeleteToken: (token: IMdmVppToken) => void;
+}
+
+const VppTable = ({
+  vppTokens,
+  onEditTokenTeam,
+  onRenewToken,
+  onDeleteToken,
+}: IVppTableProps) => {
+  const onSelectAction = (action: string, abmToken: IMdmVppToken) => {
+    switch (action) {
+      case "editTeams":
+        onEditTokenTeam(abmToken);
+        break;
+      case "renew":
+        onRenewToken(abmToken);
+        break;
+      case "delete":
+        onDeleteToken(abmToken);
+        break;
+      default:
+        break;
+    }
+  };
+
+  const tableConfig = generateTableConfig(onSelectAction);
+
+  return (
+    <TableContainer<IMdmVppToken>
+      columnConfigs={tableConfig}
+      defaultSortHeader="org_name"
+      disableTableHeader
+      disablePagination
+      showMarkAllPages={false}
+      isAllPagesSelected={false}
+      emptyComponent={() => <></>}
+      isLoading={false}
+      data={vppTokens}
+      className={baseClass}
+    />
+  );
+};
+
+export default VppTable;
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/VppTable/VppTableConfig.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/VppTable/VppTableConfig.tsx
new file mode 100644
index 0000000000..28e1e32cae
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/VppTable/VppTableConfig.tsx
@@ -0,0 +1,121 @@
+import React from "react";
+import { CellProps, Column } from "react-table";
+
+import { IMdmAbmToken, IMdmVppToken } from "interfaces/mdm";
+import { IHeaderProps, IStringCellProps } from "interfaces/datatable_config";
+import { IDropdownOption } from "interfaces/dropdownOption";
+
+import HeaderCell from "components/TableContainer/DataTable/HeaderCell";
+import DropdownCell from "components/TableContainer/DataTable/DropdownCell";
+import TextCell from "components/TableContainer/DataTable/TextCell";
+
+import RenewDateCell from "../../../components/RenewDateCell";
+import { IRenewDateCellStatusConfig } from "../../../components/RenewDateCell/RenewDateCell";
+import TeamsCell from "./TeamsCell";
+
+type IAbmTableConfig = Column<IMdmVppToken>;
+type ITableStringCellProps = IStringCellProps<IMdmVppToken>;
+type IRenewDateCellProps = CellProps<IMdmVppToken, IMdmVppToken["renew_date"]>;
+type ITeamsCellProps = CellProps<IMdmVppToken, IMdmVppToken["teams"]>;
+
+type ITableHeaderProps = IHeaderProps<IMdmVppToken>;
+
+const DEFAULT_ACTION_OPTIONS: IDropdownOption[] = [
+  { value: "editTeams", label: "Edit teams", disabled: false },
+  { value: "renew", label: "Renew", disabled: false },
+  { value: "delete", label: "Delete", disabled: false },
+];
+
+const generateActions = () => {
+  return DEFAULT_ACTION_OPTIONS;
+};
+
+const RENEW_DATE_CELL_STATUS_CONFIG: IRenewDateCellStatusConfig = {
+  warning: {
+    tooltipText: (
+      <>
+        VPP content token is less than 30 days from expiration.
+        <br />
+        To renew, go to <b>Actions {">"} Renew</b>.
+      </>
+    ),
+  },
+  error: {
+    tooltipText: (
+      <>
+        VPP content token is expired.
+        <br />
+        To renew, go to <b>Actions {">"} Renew</b>.
+      </>
+    ),
+  },
+};
+
+export const generateTableConfig = (
+  actionSelectHandler: (value: string, team: IMdmVppToken) => void
+): IAbmTableConfig[] => {
+  return [
+    {
+      accessor: "org_name",
+      sortType: "caseInsensitive",
+      Header: (cellProps: ITableHeaderProps) => (
+        <HeaderCell
+          value="Organization name"
+          isSortedDesc={cellProps.column.isSortedDesc}
+        />
+      ),
+      Cell: (cellProps: ITableStringCellProps) => (
+        <TextCell value={cellProps.cell.value} />
+      ),
+    },
+    {
+      accessor: "location",
+      Header: "Location",
+      disableSortBy: true,
+      Cell: (cellProps: ITableStringCellProps) => (
+        <TextCell value={cellProps.cell.value} />
+      ),
+    },
+    {
+      accessor: "renew_date",
+      Header: "Renew date",
+      disableSortBy: true,
+      Cell: (cellProps: IRenewDateCellProps) => (
+        <RenewDateCell
+          value={cellProps.cell.value}
+          statusConfig={RENEW_DATE_CELL_STATUS_CONFIG}
+          className="vpp-renew-date-cell"
+        />
+      ),
+    },
+
+    {
+      accessor: "teams",
+      Header: "Teams",
+      disableSortBy: true,
+      Cell: (cellProps: ITeamsCellProps) => (
+        <TeamsCell teams={cellProps.cell.value} className="vpp-teams-cell" />
+      ),
+    },
+    {
+      Header: "",
+      disableSortBy: true,
+      // the accessor here is insignificant, we just need it as its required
+      // but we don't use it.
+      accessor: "id",
+      Cell: (cellProps) => (
+        <DropdownCell
+          options={generateActions()}
+          onChange={(value: string) =>
+            actionSelectHandler(value, cellProps.row.original)
+          }
+          placeholder="Actions"
+        />
+      ),
+    },
+  ];
+};
+
+export const generateTableData = (data: IMdmAbmToken[]) => {
+  return data;
+};
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/VppTable/_styles.scss b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/VppTable/_styles.scss
new file mode 100644
index 0000000000..e60fe16747
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/VppTable/_styles.scss
@@ -0,0 +1,20 @@
+.vpp-table {
+  // The desired behavior is to remove the location header and cell as the
+  // viewport gets smaller. This is achieved by using the max-width media query
+  // with the breakpoint value taken from when the table content starts to overflow.
+  @media (max-width: $break-md) {
+    .location__header,
+    .location__cell {
+      display: none;
+    }
+  }
+
+  // this is a special case where the org name cell is too long at smaller widths.
+  // We dont want to remove any more columns so we need to reduce the width of
+  // the org name cell content to prevent table content overflow.
+  @media (max-width: $break-sm) {
+    .org_name__cell > span {
+      width: 140px;
+    }
+  }
+}
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/VppTable/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/VppTable/index.ts
new file mode 100644
index 0000000000..321386ec4f
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/components/VppTable/index.ts
@@ -0,0 +1 @@
+export { default } from "./VppTable";
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/index.ts
new file mode 100644
index 0000000000..11d6ddfc4f
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/VppPage/index.ts
@@ -0,0 +1 @@
+export { default } from "./VppPage";
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/WindowsAutomaticEnrollmentPage/WindowsAutomaticEnrollmentPage.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/WindowsAutomaticEnrollmentPage/WindowsAutomaticEnrollmentPage.tsx
similarity index 98%
rename from frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/WindowsAutomaticEnrollmentPage/WindowsAutomaticEnrollmentPage.tsx
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/WindowsAutomaticEnrollmentPage/WindowsAutomaticEnrollmentPage.tsx
index 2397d0b836..70e2ee636d 100644
--- a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/WindowsAutomaticEnrollmentPage/WindowsAutomaticEnrollmentPage.tsx
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/WindowsAutomaticEnrollmentPage/WindowsAutomaticEnrollmentPage.tsx
@@ -26,8 +26,8 @@ const WindowsAutomaticEnrollmentPage = () => {
     <MainContent className={baseClass}>
       <>
         <BackLink
-          text="Back to automatic enrollment"
-          path={PATHS.ADMIN_INTEGRATIONS_AUTOMATIC_ENROLLMENT}
+          text="Back to MDM"
+          path={PATHS.ADMIN_INTEGRATIONS_MDM}
           className={`${baseClass}__back-to-automatic-enrollment`}
         />
         <h1>Azure Active Directory</h1>
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/WindowsAutomaticEnrollmentPage/_styles.scss b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/WindowsAutomaticEnrollmentPage/_styles.scss
similarity index 100%
rename from frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/WindowsAutomaticEnrollmentPage/_styles.scss
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/WindowsAutomaticEnrollmentPage/_styles.scss
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/WindowsAutomaticEnrollmentPage/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/WindowsAutomaticEnrollmentPage/index.ts
similarity index 100%
rename from frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/WindowsAutomaticEnrollmentPage/index.ts
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/WindowsAutomaticEnrollmentPage/index.ts
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/_styles.scss b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/_styles.scss
index a724544af2..a957eece06 100644
--- a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/_styles.scss
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/_styles.scss
@@ -16,10 +16,4 @@
       max-width: initial;
     }
   }
-
-  &__mdm-section {
-    display: flex;
-    flex-direction: column;
-    gap: 40px;
-  }
 }
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/MdmPlatformsSection/components/AppleAutomaticEnrollmentCard/AppleAutomaticEnrollmentCard.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/AutomaticEnrollmentSection/AppleAutomaticEnrollmentCard/AppleAutomaticEnrollmentCard.tsx
similarity index 57%
rename from frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/MdmPlatformsSection/components/AppleAutomaticEnrollmentCard/AppleAutomaticEnrollmentCard.tsx
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/AutomaticEnrollmentSection/AppleAutomaticEnrollmentCard/AppleAutomaticEnrollmentCard.tsx
index 91c5cd85be..69d2c65ad5 100644
--- a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/MdmPlatformsSection/components/AppleAutomaticEnrollmentCard/AppleAutomaticEnrollmentCard.tsx
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/AutomaticEnrollmentSection/AppleAutomaticEnrollmentCard/AppleAutomaticEnrollmentCard.tsx
@@ -7,32 +7,30 @@ import Icon from "components/Icon/Icon";
 const baseClass = "automatic-enrollment-card";
 
 interface IAppleAutomaticEnrollmentCardProps {
+  isAppleMdmOn: boolean;
   viewDetails: () => void;
-  turnOn?: () => void;
   configured?: boolean;
 }
 
 const AppleAutomaticEnrollmentCard = ({
+  isAppleMdmOn,
   viewDetails,
-  turnOn,
   configured,
 }: IAppleAutomaticEnrollmentCardProps) => {
   let icon = "";
   let msg =
     "To enable automatic enrollment for macOS, iOS, and iPadOS hosts, first turn on Apple MDM.";
-  if (!turnOn && !configured) {
+  if (isAppleMdmOn && !configured) {
     msg =
-      "Automatically enroll newly purchased Apple hosts when they're first unboxed and set up by your end user.";
-  } else if (!turnOn && configured) {
-    msg = "Automatic enrollment for Apple (macOS, iOS, iPadOS) hosts enabled.";
+      "Add an Apple Business Manager (ABM) connection to automatically enroll newly " +
+      "purchased Apple hosts when they're first unboxed and set up by your end users.";
+  } else if (isAppleMdmOn && configured) {
+    msg = "Automatic enrollment for Apple (macOS, iOS, iPadOS) is enabled.";
     icon = "success";
   }
 
   return (
-    <Card
-      className={`${baseClass} ${turnOn ? `${baseClass}__turn-on-mdm` : ""}`}
-      color="gray"
-    >
+    <Card className={baseClass} color="gray">
       <div>
         {!icon && (
           <h3>Automatic enrollment for Apple (macOS, iOS, iPadOS) hosts.</h3>
@@ -48,30 +46,17 @@ const AppleAutomaticEnrollmentCard = ({
           )}
         </p>
       </div>
-      {turnOn && (
+      {isAppleMdmOn && !configured && (
         <Button
-          className="apple-details-button"
-          onClick={turnOn}
-          variant="text-icon"
-        >
-          Turn on MDM
-        </Button>
-      )}
-      {!turnOn && !configured && (
-        <Button
-          className="apple-details-button"
+          className="add-abm-button"
           onClick={viewDetails}
           variant="brand"
         >
-          Enable
+          Add ABM
         </Button>
       )}
-      {!turnOn && configured && (
-        <Button
-          className="apple-details-button"
-          onClick={viewDetails}
-          variant="text-icon"
-        >
+      {isAppleMdmOn && configured && (
+        <Button onClick={viewDetails} variant="text-icon">
           <Icon name="pencil" />
           Edit
         </Button>
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/MdmPlatformsSection/components/AppleAutomaticEnrollmentCard/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/AutomaticEnrollmentSection/AppleAutomaticEnrollmentCard/index.ts
similarity index 100%
rename from frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/MdmPlatformsSection/components/AppleAutomaticEnrollmentCard/index.ts
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/AutomaticEnrollmentSection/AppleAutomaticEnrollmentCard/index.ts
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/AutomaticEnrollmentSection/AutomaticEnrollmentSection.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/AutomaticEnrollmentSection/AutomaticEnrollmentSection.tsx
new file mode 100644
index 0000000000..5badb918e5
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/AutomaticEnrollmentSection/AutomaticEnrollmentSection.tsx
@@ -0,0 +1,54 @@
+import React, { useContext } from "react";
+import { InjectedRouter } from "react-router";
+import PATHS from "router/paths";
+
+import { AppContext } from "context/app";
+
+import PremiumFeatureMessage from "components/PremiumFeatureMessage";
+import SettingsSection from "pages/admin/components/SettingsSection";
+
+import AppleAutomaticEnrollmentCard from "./AppleAutomaticEnrollmentCard";
+import WindowsAutomaticEnrollmentCard from "./WindowsAutomaticEnrollmentCard";
+
+const baseClass = "automatic-enrollment-section";
+
+interface IAutomaticEnrollmentSectionProps {
+  router: InjectedRouter;
+  isPremiumTier: boolean;
+}
+
+const AutomaticEnrollmentSection = ({
+  router,
+  isPremiumTier,
+}: IAutomaticEnrollmentSectionProps) => {
+  const { config } = useContext(AppContext);
+
+  const navigateToWindowsAutomaticEnrollment = () => {
+    router.push(PATHS.ADMIN_INTEGRATIONS_AUTOMATIC_ENROLLMENT_WINDOWS);
+  };
+
+  const navigateToAppleAutomaticEnrollment = () => {
+    router.push(PATHS.ADMIN_INTEGRATIONS_APPLE_BUSINESS_MANAGER);
+  };
+
+  return (
+    <SettingsSection title="Automatic Enrollment" className={baseClass}>
+      {!isPremiumTier ? (
+        <PremiumFeatureMessage alignment="left" />
+      ) : (
+        <div className={`${baseClass}__content`}>
+          <AppleAutomaticEnrollmentCard
+            viewDetails={navigateToAppleAutomaticEnrollment}
+            isAppleMdmOn={!!config?.mdm.enabled_and_configured}
+            configured={!!config?.mdm.apple_bm_enabled_and_configured}
+          />
+          <WindowsAutomaticEnrollmentCard
+            viewDetails={navigateToWindowsAutomaticEnrollment}
+          />
+        </div>
+      )}
+    </SettingsSection>
+  );
+};
+
+export default AutomaticEnrollmentSection;
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/MdmPlatformsSection/components/WindowsAutomaticEnrollmentCard/WindowsAutomaticEnrollmentCard.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/AutomaticEnrollmentSection/WindowsAutomaticEnrollmentCard/WindowsAutomaticEnrollmentCard.tsx
similarity index 100%
rename from frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/MdmPlatformsSection/components/WindowsAutomaticEnrollmentCard/WindowsAutomaticEnrollmentCard.tsx
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/AutomaticEnrollmentSection/WindowsAutomaticEnrollmentCard/WindowsAutomaticEnrollmentCard.tsx
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/MdmPlatformsSection/components/WindowsAutomaticEnrollmentCard/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/AutomaticEnrollmentSection/WindowsAutomaticEnrollmentCard/index.ts
similarity index 100%
rename from frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/MdmPlatformsSection/components/WindowsAutomaticEnrollmentCard/index.ts
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/AutomaticEnrollmentSection/WindowsAutomaticEnrollmentCard/index.ts
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/AutomaticEnrollmentSection/_styles.scss b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/AutomaticEnrollmentSection/_styles.scss
new file mode 100644
index 0000000000..d1a74a4e63
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/AutomaticEnrollmentSection/_styles.scss
@@ -0,0 +1,36 @@
+.automatic-enrollment-section {
+  &__content {
+    display: flex;
+    flex-direction: column;
+    gap: $pad-xxlarge;
+
+    // styles for the apple and windows automatic enrollment cards.
+    .automatic-enrollment-card {
+      font-size: $x-small;
+      display: flex;
+      justify-content: space-between;
+      align-items: center;
+      gap: $pad-medium;
+
+      h3 {
+        font-size: $x-small;
+        font-weight: $bold;
+        margin: 0 0 $pad-xsmall;
+      }
+
+      p {
+        margin: 0;
+
+        span {
+          display: flex;
+          align-items: center;
+          gap: $pad-small;
+        }
+      }
+
+      .add-abm-button {
+        white-space: nowrap;
+      }
+    }
+  }
+}
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/AutomaticEnrollmentSection/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/AutomaticEnrollmentSection/index.ts
new file mode 100644
index 0000000000..45ccdee57c
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/AutomaticEnrollmentSection/index.ts
@@ -0,0 +1 @@
+export { default } from "./AutomaticEnrollmentSection";
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EndUserMigrationSection/EndUserMigrationSection.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EndUserMigrationSection/EndUserMigrationSection.tsx
index 8e4eac52e7..7b9cc54164 100644
--- a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EndUserMigrationSection/EndUserMigrationSection.tsx
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EndUserMigrationSection/EndUserMigrationSection.tsx
@@ -21,6 +21,7 @@ import Button from "components/buttons/Button/Button";
 import SectionHeader from "components/SectionHeader";
 import PremiumFeatureMessage from "components/PremiumFeatureMessage/PremiumFeatureMessage";
 import EmptyTable from "components/EmptyTable/EmptyTable";
+import SettingsSection from "pages/admin/components/SettingsSection";
 
 import ExampleWebhookUrlPayloadModal from "../ExampleWebhookUrlPayloadModal/ExampleWebhookUrlPayloadModal";
 
@@ -78,7 +79,7 @@ const EndUserMigrationSection = ({ router }: IEndUserMigrationSectionProps) => {
   };
 
   const onClickConnect = () => {
-    router.push(PATHS.ADMIN_INTEGRATIONS_AUTOMATIC_ENROLLMENT);
+    router.push(PATHS.ADMIN_INTEGRATIONS_MDM);
   };
 
   const onChangeMode = (mode: string) => {
@@ -159,14 +160,9 @@ const EndUserMigrationSection = ({ router }: IEndUserMigrationSectionProps) => {
   }
 
   return (
-    <div className={baseClass}>
-      <SectionHeader title="End user migration workflow" />
+    <SettingsSection className={baseClass} title="End user migration workflow">
       <form>
-        <p>
-          Control the end user migration workflow for macOS hosts that
-          automatically enrolled to your old MDM solution.
-        </p>
-
+        <p>Control the end user migration workflow for macOS hosts.</p>
         <img
           src={MdmMigrationPreview}
           alt="end user migration preview"
@@ -240,7 +236,7 @@ const EndUserMigrationSection = ({ router }: IEndUserMigrationSectionProps) => {
       {showExamplePayload && (
         <ExampleWebhookUrlPayloadModal onCancel={toggleExamplePayloadModal} />
       )}
-    </div>
+    </SettingsSection>
   );
 };
 
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/EulaSection.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/EulaSection.tsx
new file mode 100644
index 0000000000..bf6f632eeb
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/EulaSection.tsx
@@ -0,0 +1,73 @@
+import React, { useContext, useState } from "react";
+import { useQuery } from "react-query";
+import { AxiosResponse } from "axios";
+
+import { IApiError } from "interfaces/errors";
+import mdmAPI, { IEulaMetadataResponse } from "services/entities/mdm";
+import { NotificationContext } from "context/notification";
+
+import Spinner from "components/Spinner";
+import SettingsSection from "pages/admin/components/SettingsSection";
+
+import EulaUploader from "./components/EulaUploader/EulaUploader";
+import UploadedEulaView from "./components/UploadedEulaView/UploadedEulaView";
+import DeleteEulaModal from "./components/DeleteEulaModal/DeleteEulaModal";
+
+const baseClass = "eula-section";
+
+interface IEulaSectionProps {
+  eulaMetadata?: IEulaMetadataResponse;
+  isEulaUploaded: boolean;
+  onUpload: () => void;
+  onDelete: () => void;
+}
+
+const EulaSection = ({
+  eulaMetadata,
+  isEulaUploaded,
+  onUpload,
+  onDelete,
+}: IEulaSectionProps) => {
+  const { renderFlash } = useContext(NotificationContext);
+  const [showDeleteEulaModal, setShowDeleteEulaModal] = useState(false);
+
+  const onDeleteEula = async () => {
+    if (!eulaMetadata) return;
+
+    try {
+      await mdmAPI.deleteEULA(eulaMetadata.token);
+      renderFlash("success", "Successfully deleted!");
+    } catch {
+      renderFlash("error", "Couldn’t delete. Please try again.");
+    } finally {
+      setShowDeleteEulaModal(false);
+      onDelete();
+    }
+  };
+
+  return (
+    <SettingsSection
+      className={baseClass}
+      title="End user license agreement (EULA)"
+    >
+      <div className={`${baseClass}__content`}>
+        {!isEulaUploaded || !eulaMetadata ? (
+          <EulaUploader onUpload={onUpload} />
+        ) : (
+          <UploadedEulaView
+            eulaMetadata={eulaMetadata}
+            onDelete={() => setShowDeleteEulaModal(true)}
+          />
+        )}
+      </div>
+      {showDeleteEulaModal && (
+        <DeleteEulaModal
+          onDelete={onDeleteEula}
+          onCancel={() => setShowDeleteEulaModal(false)}
+        />
+      )}
+    </SettingsSection>
+  );
+};
+
+export default EulaSection;
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/components/DeleteEulaModal/DeleteEulaModal.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/components/DeleteEulaModal/DeleteEulaModal.tsx
similarity index 100%
rename from frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/components/DeleteEulaModal/DeleteEulaModal.tsx
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/components/DeleteEulaModal/DeleteEulaModal.tsx
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/components/DeleteEulaModal/_styles.scss b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/components/DeleteEulaModal/_styles.scss
similarity index 100%
rename from frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/components/DeleteEulaModal/_styles.scss
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/components/DeleteEulaModal/_styles.scss
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/components/DeleteEulaModal/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/components/DeleteEulaModal/index.ts
similarity index 100%
rename from frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/components/DeleteEulaModal/index.ts
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/components/DeleteEulaModal/index.ts
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/components/EulaListItem/EulaListItem.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/components/EulaListItem/EulaListItem.tsx
similarity index 100%
rename from frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/components/EulaListItem/EulaListItem.tsx
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/components/EulaListItem/EulaListItem.tsx
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/components/EulaListItem/_styles.scss b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/components/EulaListItem/_styles.scss
similarity index 100%
rename from frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/components/EulaListItem/_styles.scss
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/components/EulaListItem/_styles.scss
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/components/EulaListItem/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/components/EulaListItem/index.ts
similarity index 100%
rename from frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/components/EulaListItem/index.ts
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/components/EulaListItem/index.ts
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/components/EulaUploader/EulaUploader.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/components/EulaUploader/EulaUploader.tsx
similarity index 100%
rename from frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/components/EulaUploader/EulaUploader.tsx
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/components/EulaUploader/EulaUploader.tsx
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/components/EulaUploader/_styles.scss b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/components/EulaUploader/_styles.scss
similarity index 100%
rename from frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/components/EulaUploader/_styles.scss
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/components/EulaUploader/_styles.scss
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/components/EulaUploader/helpers.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/components/EulaUploader/helpers.ts
similarity index 100%
rename from frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/components/EulaUploader/helpers.ts
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/components/EulaUploader/helpers.ts
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/components/EulaUploader/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/components/EulaUploader/index.ts
similarity index 100%
rename from frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/components/EulaUploader/index.ts
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/components/EulaUploader/index.ts
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/components/UploadedEulaView/UploadedEulaView.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/components/UploadedEulaView/UploadedEulaView.tsx
similarity index 100%
rename from frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/components/UploadedEulaView/UploadedEulaView.tsx
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/components/UploadedEulaView/UploadedEulaView.tsx
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/components/UploadedEulaView/_styles.scss b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/components/UploadedEulaView/_styles.scss
new file mode 100644
index 0000000000..fb74a0eb42
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/components/UploadedEulaView/_styles.scss
@@ -0,0 +1,6 @@
+.uploaded-eula-view {
+
+  > p {
+    font-size: $x-small;
+  }
+}
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/components/UploadedEulaView/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/components/UploadedEulaView/index.ts
similarity index 100%
rename from frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/components/UploadedEulaView/index.ts
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/components/UploadedEulaView/index.ts
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/index.ts
similarity index 100%
rename from frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/EulaSection/index.ts
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/EulaSection/index.ts
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/IdpSection/IdpSection.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/IdpSection/IdpSection.tsx
similarity index 96%
rename from frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/IdpSection/IdpSection.tsx
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/IdpSection/IdpSection.tsx
index 5889ec50af..a3f50e6e2f 100644
--- a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/IdpSection/IdpSection.tsx
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/IdpSection/IdpSection.tsx
@@ -7,11 +7,11 @@ import configAPI from "services/entities/config";
 import InputField from "components/forms/fields/InputField";
 import CustomLink from "components/CustomLink/CustomLink";
 import Button from "components/buttons/Button/Button";
-import SectionHeader from "components/SectionHeader";
 import validateUrl from "components/forms/validators/valid_url";
 import ReactTooltip from "react-tooltip";
 import { NotificationContext } from "context/notification";
 import { AppContext } from "context/app";
+import SettingsSection from "pages/admin/components/SettingsSection";
 
 const baseClass = "idp-section";
 
@@ -74,8 +74,7 @@ const IdpSection = () => {
   };
 
   return (
-    <div className={baseClass}>
-      <SectionHeader title="End user authentication" />
+    <SettingsSection className={baseClass} title="End user authentication">
       <form>
         <p>
           Connect Fleet to your identity provider to require end users to
@@ -130,7 +129,7 @@ const IdpSection = () => {
           Complete all fields to save end user authentication.
         </ReactTooltip>
       </form>
-    </div>
+    </SettingsSection>
   );
 };
 
diff --git a/frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/IdpSection/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/IdpSection/index.ts
similarity index 100%
rename from frontend/pages/admin/IntegrationsPage/cards/AutomaticEnrollment/components/IdpSection/index.ts
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/IdpSection/index.ts
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/AppleMdmCard/MacOSMdmCard.tests.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MdmSettingsSection/AppleMdmCard/AppleMdmCard.tests.tsx
similarity index 89%
rename from frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/AppleMdmCard/MacOSMdmCard.tests.tsx
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MdmSettingsSection/AppleMdmCard/AppleMdmCard.tests.tsx
index 1a0fc96003..0ff7ece81d 100644
--- a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/AppleMdmCard/MacOSMdmCard.tests.tsx
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MdmSettingsSection/AppleMdmCard/AppleMdmCard.tests.tsx
@@ -11,7 +11,7 @@ describe("AppleMdmCard", () => {
   it("renders the turn on Apple mdm state when there is no appleAPNInfo", () => {
     render(
       <AppleMdmCard
-        appleAPNInfo={undefined}
+        appleAPNSInfo={undefined}
         errorData={null}
         turnOnAppleMdm={noop}
         viewDetails={noop}
@@ -26,7 +26,7 @@ describe("AppleMdmCard", () => {
   it("renders the show details state when there is appleAPNInfo", () => {
     render(
       <AppleMdmCard
-        appleAPNInfo={createMockMdmApple()}
+        appleAPNSInfo={createMockMdmApple()}
         errorData={null}
         turnOnAppleMdm={noop}
         viewDetails={noop}
@@ -41,7 +41,7 @@ describe("AppleMdmCard", () => {
   it("renders the error state when there is a non 404 error", () => {
     render(
       <AppleMdmCard
-        appleAPNInfo={createMockMdmApple()}
+        appleAPNSInfo={createMockMdmApple()}
         errorData={createMockAxiosError({ status: 500 })}
         turnOnAppleMdm={noop}
         viewDetails={noop}
@@ -52,7 +52,7 @@ describe("AppleMdmCard", () => {
 
     render(
       <AppleMdmCard
-        appleAPNInfo={createMockMdmApple()}
+        appleAPNSInfo={createMockMdmApple()}
         errorData={createMockAxiosError({ status: 404 })}
         turnOnAppleMdm={noop}
         viewDetails={noop}
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/AppleMdmCard/AppleMdmCard.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MdmSettingsSection/AppleMdmCard/AppleMdmCard.tsx
similarity index 95%
rename from frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/AppleMdmCard/AppleMdmCard.tsx
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MdmSettingsSection/AppleMdmCard/AppleMdmCard.tsx
index 91027827ae..ebfebcfb44 100644
--- a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/AppleMdmCard/AppleMdmCard.tsx
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MdmSettingsSection/AppleMdmCard/AppleMdmCard.tsx
@@ -47,7 +47,7 @@ const SeeDetailsAppleMdm = ({ onClickDetails }: ITurnOffAppleMdmProps) => {
 };
 
 interface IAppleMdmCardProps {
-  appleAPNInfo: IMdmApple | undefined;
+  appleAPNSInfo: IMdmApple | undefined;
   errorData: AxiosError | null;
   turnOnAppleMdm: () => void;
   viewDetails: () => void;
@@ -60,7 +60,7 @@ interface IAppleMdmCardProps {
  * loading states on the page.
  */
 const AppleMdmCard = ({
-  appleAPNInfo,
+  appleAPNSInfo,
   errorData,
   turnOnAppleMdm,
   viewDetails,
@@ -76,7 +76,7 @@ const AppleMdmCard = ({
 
   return (
     <Card className={baseClass} color="gray">
-      {appleAPNInfo !== undefined ? (
+      {appleAPNSInfo !== undefined ? (
         <SeeDetailsAppleMdm onClickDetails={viewDetails} />
       ) : (
         <TurnOnAppleMdm onClickTurnOn={turnOnAppleMdm} />
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/AppleMdmCard/_styles.scss b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MdmSettingsSection/AppleMdmCard/_styles.scss
similarity index 100%
rename from frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/AppleMdmCard/_styles.scss
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MdmSettingsSection/AppleMdmCard/_styles.scss
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/AppleMdmCard/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MdmSettingsSection/AppleMdmCard/index.ts
similarity index 100%
rename from frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/AppleMdmCard/index.ts
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MdmSettingsSection/AppleMdmCard/index.ts
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MdmSettingsSection/MdmSettingsSection.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MdmSettingsSection/MdmSettingsSection.tsx
new file mode 100644
index 0000000000..c845eec181
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MdmSettingsSection/MdmSettingsSection.tsx
@@ -0,0 +1,75 @@
+import React from "react";
+import { InjectedRouter } from "react-router";
+import { AxiosError } from "axios";
+
+import PATHS from "router/paths";
+import { IMdmApple } from "interfaces/mdm";
+
+import Spinner from "components/Spinner";
+import DataError from "components/DataError";
+import SettingsSection from "pages/admin/components/SettingsSection";
+
+import AppleMdmCard from "./AppleMdmCard";
+import WindowsMdmCard from "./WindowsMdmCard";
+
+const baseClass = "mdm-settings-section";
+
+interface IMdmSectionProps {
+  isLoading: boolean;
+  isError: boolean;
+  appleAPNSError: AxiosError | null;
+  router: InjectedRouter;
+  appleAPNSInfo?: IMdmApple;
+}
+
+const MdmSettingsSection = ({
+  isLoading,
+  isError,
+  appleAPNSError,
+  router,
+  appleAPNSInfo,
+}: IMdmSectionProps) => {
+  const navigateToAppleMdm = () => {
+    router.push(PATHS.ADMIN_INTEGRATIONS_MDM_APPLE);
+  };
+
+  const navigateToWindowsMdm = () => {
+    router.push(PATHS.ADMIN_INTEGRATIONS_MDM_WINDOWS);
+  };
+
+  const renderContent = () => {
+    if (isLoading) {
+      return <Spinner />;
+    }
+
+    if (isError) {
+      return <DataError />;
+    }
+
+    return (
+      <div className={`${baseClass}__content`}>
+        <AppleMdmCard
+          appleAPNSInfo={appleAPNSInfo}
+          errorData={appleAPNSError}
+          turnOnAppleMdm={navigateToAppleMdm}
+          viewDetails={navigateToAppleMdm}
+        />
+        <WindowsMdmCard
+          turnOnWindowsMdm={navigateToWindowsMdm}
+          editWindowsMdm={navigateToWindowsMdm}
+        />
+      </div>
+    );
+  };
+
+  return (
+    <SettingsSection
+      title="Mobile device management (MDM)"
+      className={baseClass}
+    >
+      {renderContent()}
+    </SettingsSection>
+  );
+};
+
+export default MdmSettingsSection;
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/WindowsMdmCard/WindowsMdmCard.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MdmSettingsSection/WindowsMdmCard/WindowsMdmCard.tsx
similarity index 100%
rename from frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/WindowsMdmCard/WindowsMdmCard.tsx
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MdmSettingsSection/WindowsMdmCard/WindowsMdmCard.tsx
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/WindowsMdmCard/_styles.scss b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MdmSettingsSection/WindowsMdmCard/_styles.scss
similarity index 100%
rename from frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/WindowsMdmCard/_styles.scss
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MdmSettingsSection/WindowsMdmCard/_styles.scss
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/WindowsMdmCard/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MdmSettingsSection/WindowsMdmCard/index.ts
similarity index 100%
rename from frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/WindowsMdmCard/index.ts
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MdmSettingsSection/WindowsMdmCard/index.ts
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MdmSettingsSection/_styles.scss b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MdmSettingsSection/_styles.scss
new file mode 100644
index 0000000000..60dd8e6136
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MdmSettingsSection/_styles.scss
@@ -0,0 +1,8 @@
+.mdm-settings-section {
+
+  &__content {
+    display: flex;
+    flex-direction: column;
+    gap: 40px;
+  }
+}
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MdmSettingsSection/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MdmSettingsSection/index.ts
new file mode 100644
index 0000000000..822a78c2ab
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/MdmSettingsSection/index.ts
@@ -0,0 +1 @@
+export { default } from "./MdmSettingsSection";
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/RenewDateCell/RenewDateCell.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/RenewDateCell/RenewDateCell.tsx
new file mode 100644
index 0000000000..be5f5b7990
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/RenewDateCell/RenewDateCell.tsx
@@ -0,0 +1,68 @@
+import React, { ReactNode } from "react";
+import classnames from "classnames";
+
+import StatusIndicator from "components/StatusIndicator";
+
+import { monthDayYearFormat } from "utilities/date_format";
+import { hasLicenseExpired, willExpireWithinXDays } from "utilities/helpers";
+import { IIndicatorValue } from "components/StatusIndicator/StatusIndicator";
+
+const baseClass = "renew-date-cell";
+
+export type IRenewDateCellStatusConfig = Record<
+  Exclude<IIndicatorValue, "indeterminate" | "success">,
+  {
+    tooltipText: ReactNode;
+  }
+>;
+
+interface IRenewDateCellProps {
+  value: string;
+  /**
+   * `statusConfig` currently this allows us to dynamically change the tooltip
+   * text depending on the status of the date. Can be extended later if needed.
+   */
+  statusConfig: IRenewDateCellStatusConfig;
+  className?: string;
+}
+
+const RenewDateCell = ({
+  value,
+  statusConfig,
+  className,
+}: IRenewDateCellProps) => {
+  const formattedDate = monthDayYearFormat(value);
+
+  // "w250" is a utility class that sets the width the the same as
+  // the other text cells in the table.
+  // TODO: consider creating a generic StatusIndicatorCell component that
+  // take in a value, a desired status to display and, can contain these
+  // table cell styles.
+  const classNames = classnames(baseClass, className, "w250");
+
+  let indicatorStatus: Exclude<IIndicatorValue, "indeterminate"> = "success";
+  let tooltipText: ReactNode = null;
+
+  if (willExpireWithinXDays(value, 30)) {
+    indicatorStatus = "warning";
+  } else if (hasLicenseExpired(value)) {
+    indicatorStatus = "error";
+  }
+
+  if (indicatorStatus !== "success") {
+    tooltipText = statusConfig[indicatorStatus].tooltipText;
+  }
+
+  const tooltipProp = tooltipText ? { tooltipText } : undefined;
+
+  return (
+    <StatusIndicator
+      className={classNames}
+      value={formattedDate}
+      indicator={indicatorStatus}
+      tooltip={tooltipProp}
+    />
+  );
+};
+
+export default RenewDateCell;
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/RenewDateCell/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/RenewDateCell/index.ts
new file mode 100644
index 0000000000..6a678382f3
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/RenewDateCell/index.ts
@@ -0,0 +1 @@
+export { default } from "./RenewDateCell";
diff --git a/frontend/pages/admin/IntegrationsPage/cards/Vpp/Vpp.tests.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/VppSection/VppSection.tests.tsx
similarity index 54%
rename from frontend/pages/admin/IntegrationsPage/cards/Vpp/Vpp.tests.tsx
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/VppSection/VppSection.tests.tsx
index bc7c79623d..1c95cb0310 100644
--- a/frontend/pages/admin/IntegrationsPage/cards/Vpp/Vpp.tests.tsx
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/VppSection/VppSection.tests.tsx
@@ -9,10 +9,10 @@ import {
 } from "test/handlers/apple_mdm";
 import createMockConfig, { createMockMdmConfig } from "__mocks__/configMock";
 
-import Vpp from "./Vpp";
+import VppSection from "./VppSection";
 
 describe("Vpp Section", () => {
-  it("renders turn on apple mdm message when apple mdm is not turned on ", async () => {
+  it("renders mdm is off message when apple mdm is not turned on ", async () => {
     mockServer.use(defaultVppInfoHandler);
 
     const render = createCustomRenderer({
@@ -26,14 +26,18 @@ describe("Vpp Section", () => {
       withBackendMock: true,
     });
 
-    render(<Vpp router={createMockRouter()} />);
+    render(
+      <VppSection router={createMockRouter()} isVppOn={false} isPremiumTier />
+    );
 
     expect(
-      await screen.findByRole("button", { name: "Turn on MDM" })
+      await screen.findByText(
+        "To enable Volume Purchasing Program (VPP), first turn on Apple (macOS, iOS, iPadOS) MDM."
+      )
     ).toBeInTheDocument();
   });
 
-  it("renders enable vpp when vpp is disabled", async () => {
+  it("renders add vpp when vpp is disabled", async () => {
     mockServer.use(errorNoVppInfoHandler);
 
     const render = createCustomRenderer({
@@ -47,10 +51,12 @@ describe("Vpp Section", () => {
       withBackendMock: true,
     });
 
-    render(<Vpp router={createMockRouter()} />);
+    render(
+      <VppSection router={createMockRouter()} isVppOn={false} isPremiumTier />
+    );
 
     expect(
-      await screen.findByRole("button", { name: "Enable" })
+      await screen.findByRole("button", { name: "Add VPP" })
     ).toBeInTheDocument();
   });
 
@@ -67,9 +73,34 @@ describe("Vpp Section", () => {
       },
       withBackendMock: true,
     });
-    render(<Vpp router={createMockRouter()} />);
+    render(<VppSection router={createMockRouter()} isVppOn isPremiumTier />);
     expect(
       await screen.findByRole("button", { name: "Edit" })
     ).toBeInTheDocument();
   });
+
+  it("render the premium message when not in premium tier", async () => {
+    mockServer.use(defaultVppInfoHandler);
+
+    const render = createCustomRenderer({
+      context: {
+        app: {
+          config: createMockConfig({
+            mdm: createMockMdmConfig({ enabled_and_configured: true }),
+          }),
+        },
+      },
+      withBackendMock: true,
+    });
+    render(
+      <VppSection
+        router={createMockRouter()}
+        isVppOn={false}
+        isPremiumTier={false}
+      />
+    );
+    expect(
+      await screen.findByText("This feature is included in Fleet Premium.")
+    ).toBeInTheDocument();
+  });
 });
diff --git a/frontend/pages/admin/IntegrationsPage/cards/Vpp/Vpp.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/VppSection/VppSection.tsx
similarity index 64%
rename from frontend/pages/admin/IntegrationsPage/cards/Vpp/Vpp.tsx
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/VppSection/VppSection.tsx
index 479b8a704e..afcd3af3c2 100644
--- a/frontend/pages/admin/IntegrationsPage/cards/Vpp/Vpp.tsx
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/VppSection/VppSection.tsx
@@ -9,13 +9,14 @@ import mdmAppleAPI, { IGetVppInfoResponse } from "services/entities/mdm_apple";
 import { DEFAULT_USE_QUERY_OPTIONS } from "utilities/constants";
 
 import Card from "components/Card";
-import SectionHeader from "components/SectionHeader";
 import Button from "components/buttons/Button";
 import Icon from "components/Icon";
 import Spinner from "components/Spinner";
 import DataError from "components/DataError";
+import SettingsSection from "pages/admin/components/SettingsSection";
+import PremiumFeatureMessage from "components/PremiumFeatureMessage";
 
-const baseClass = "vpp";
+const baseClass = "vpp-section";
 
 interface IVppCardProps {
   isAppleMdmOn: boolean;
@@ -24,10 +25,6 @@ interface IVppCardProps {
 }
 
 const VppCard = ({ isAppleMdmOn, isVppOn, router }: IVppCardProps) => {
-  const nagivateToMdm = () => {
-    router.push(PATHS.ADMIN_INTEGRATIONS_MDM);
-  };
-
   const navigateToVppSetup = () => {
     router.push(PATHS.ADMIN_INTEGRATIONS_VPP_SETUP);
   };
@@ -41,17 +38,15 @@ const VppCard = ({ isAppleMdmOn, isVppOn, router }: IVppCardProps) => {
           iOS, iPadOS) MDM.
         </p>
       </div>
-      <Button onClick={nagivateToMdm} variant="text-link">
-        Turn on MDM
-      </Button>
     </div>
   );
-  const isOnContent = (
+
+  const isVppOnContent = (
     <div className={`${baseClass}__vpp-on-content`}>
       <p>
         <span>
           <Icon name="success" />
-          Volume Purchasing Program (VPP) enabled.
+          Volume Purchasing Program (VPP) is enabled.
         </span>
       </p>
       <Button onClick={navigateToVppSetup} variant="text-icon">
@@ -61,17 +56,21 @@ const VppCard = ({ isAppleMdmOn, isVppOn, router }: IVppCardProps) => {
     </div>
   );
 
-  const isOffContent = (
+  const isVppOffContent = (
     <div className={`${baseClass}__vpp-off-content`}>
       <div>
         <h3>Volume Purchasing Program (VPP)</h3>
         <p>
-          Install apps from Apple&apos;s App Store purchased through Apple
-          Business Manager.
+          Add a VPP connection to install Apple App Store apps purchased through
+          Apple Business Manager.
         </p>
       </div>
-      <Button onClick={navigateToVppSetup} variant="brand">
-        Enable
+      <Button
+        className={`${baseClass}__add-vpp-button`}
+        onClick={navigateToVppSetup}
+        variant="brand"
+      >
+        Add VPP
       </Button>
     </div>
   );
@@ -81,7 +80,7 @@ const VppCard = ({ isAppleMdmOn, isVppOn, router }: IVppCardProps) => {
       return appleMdmDiabledContent;
     }
 
-    return isVppOn ? isOnContent : isOffContent;
+    return isVppOn ? isVppOnContent : isVppOffContent;
   };
 
   return (
@@ -91,45 +90,37 @@ const VppCard = ({ isAppleMdmOn, isVppOn, router }: IVppCardProps) => {
   );
 };
 
-interface IVppProps {
+interface IVppSectionProps {
   router: InjectedRouter;
+  isVppOn: boolean;
+  isPremiumTier: boolean;
 }
 
-const Vpp = ({ router }: IVppProps) => {
+const VppSection = ({ router, isVppOn, isPremiumTier }: IVppSectionProps) => {
   const { config } = useContext(AppContext);
 
-  const { data: vppData, error: vppError, isLoading, isError } = useQuery<
-    IGetVppInfoResponse,
-    AxiosError
-  >("vppInfo", () => mdmAppleAPI.getVppInfo(), {
-    ...DEFAULT_USE_QUERY_OPTIONS,
-    retry: false,
-  });
-
   const renderContent = () => {
-    if (isLoading) {
-      return <Spinner />;
-    }
-
-    if (isError && vppError?.status !== 404) {
-      return <DataError />;
+    if (!isPremiumTier) {
+      return <PremiumFeatureMessage alignment="left" />;
     }
 
     return (
       <VppCard
         isAppleMdmOn={!!config?.mdm.enabled_and_configured}
-        isVppOn={!!vppData && vppError?.status !== 404}
+        isVppOn={isVppOn}
         router={router}
       />
     );
   };
 
   return (
-    <div className={baseClass}>
-      <SectionHeader title="Volume Purchasing Program (VPP)" />
+    <SettingsSection
+      title="Volume Purchasing Program (VPP)"
+      className={baseClass}
+    >
       <>{renderContent()}</>
-    </div>
+    </SettingsSection>
   );
 };
 
-export default Vpp;
+export default VppSection;
diff --git a/frontend/pages/admin/IntegrationsPage/cards/Vpp/_styles.scss b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/VppSection/_styles.scss
similarity index 90%
rename from frontend/pages/admin/IntegrationsPage/cards/Vpp/_styles.scss
rename to frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/VppSection/_styles.scss
index a8616fd5f6..9cbe7e0e63 100644
--- a/frontend/pages/admin/IntegrationsPage/cards/Vpp/_styles.scss
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/VppSection/_styles.scss
@@ -1,4 +1,4 @@
-.vpp {
+.vpp-section {
 
   // TODO: this is very similar to the Apple Mdm card, consider pulling out
   // into a shared component if we do this pattern one more time.
@@ -42,5 +42,10 @@
     display: flex;
     justify-content: space-between;
     align-items: center;
+    gap: $pad-medium;
+  }
+
+  &__add-vpp-button {
+    white-space: nowrap;
   }
 }
diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/VppSection/index.ts b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/VppSection/index.ts
new file mode 100644
index 0000000000..656c50cfa6
--- /dev/null
+++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/components/VppSection/index.ts
@@ -0,0 +1 @@
+export { default } from "./VppSection";
diff --git a/frontend/pages/admin/IntegrationsPage/cards/Vpp/VppSetupPage/VppSetupPage.tests.tsx b/frontend/pages/admin/IntegrationsPage/cards/Vpp/VppSetupPage/VppSetupPage.tests.tsx
deleted file mode 100644
index e2159d9a79..0000000000
--- a/frontend/pages/admin/IntegrationsPage/cards/Vpp/VppSetupPage/VppSetupPage.tests.tsx
+++ /dev/null
@@ -1,49 +0,0 @@
-import React from "react";
-import { screen } from "@testing-library/react";
-
-import { createCustomRenderer, createMockRouter } from "test/test-utils";
-import mockServer from "test/mock-server";
-import {
-  defaultVppInfoHandler,
-  errorNoVppInfoHandler,
-} from "test/handlers/apple_mdm";
-
-import VppSetupPage from "./VppSetupPage";
-
-describe("VppSetupPage", () => {
-  it("renders the VPP setup steps content when VPP is not set up", async () => {
-    mockServer.use(errorNoVppInfoHandler);
-
-    const render = createCustomRenderer({
-      withBackendMock: true,
-    });
-
-    render(<VppSetupPage router={createMockRouter()} />);
-
-    // This is part of the setup steps content we expect to see.
-    expect(await screen.findByText(/Sign in to/g)).toBeInTheDocument();
-    // This is the upload token UI we expect to see.
-    expect(
-      await screen.findByRole("button", { name: "Upload" })
-    ).toBeInTheDocument();
-  });
-
-  it("renders the VPP disable and renew content when VPP is set up", async () => {
-    mockServer.use(defaultVppInfoHandler);
-
-    const render = createCustomRenderer({
-      withBackendMock: true,
-    });
-
-    render(<VppSetupPage router={createMockRouter()} />);
-
-    expect(await screen.findByText("Organization name")).toBeInTheDocument();
-
-    expect(
-      await screen.findByRole("button", { name: "Disable" })
-    ).toBeInTheDocument();
-    expect(
-      await screen.findByRole("button", { name: "Renew token" })
-    ).toBeInTheDocument();
-  });
-});
diff --git a/frontend/pages/admin/IntegrationsPage/cards/Vpp/VppSetupPage/VppSetupPage.tsx b/frontend/pages/admin/IntegrationsPage/cards/Vpp/VppSetupPage/VppSetupPage.tsx
deleted file mode 100644
index a4289664e6..0000000000
--- a/frontend/pages/admin/IntegrationsPage/cards/Vpp/VppSetupPage/VppSetupPage.tsx
+++ /dev/null
@@ -1,190 +0,0 @@
-import React, { useContext, useState } from "react";
-import { InjectedRouter } from "react-router";
-import { useQuery } from "react-query";
-import { AxiosError } from "axios";
-
-import PATHS from "router/paths";
-import { NotificationContext } from "context/notification";
-import { getErrorReason } from "interfaces/errors";
-import mdmAppleAPI, { IGetVppInfoResponse } from "services/entities/mdm_apple";
-import { DEFAULT_USE_QUERY_OPTIONS } from "utilities/constants";
-import { readableDate } from "utilities/helpers";
-
-import MainContent from "components/MainContent";
-import BackLink from "components/BackLink";
-import FileUploader from "components/FileUploader";
-import DataSet from "components/DataSet";
-import Button from "components/buttons/Button";
-import Spinner from "components/Spinner";
-import DataError from "components/DataError";
-
-import DisableVppModal from "./components/DisableVppModal";
-import VppSetupSteps from "./components/VppSetupSteps";
-import RenewVppTokenModal from "./components/RenewVppTokenModal";
-
-const baseClass = "vpp-setup-page";
-
-interface IVppSetupContentProps {
-  router: InjectedRouter;
-}
-
-const VPPSetupContent = ({ router }: IVppSetupContentProps) => {
-  const { renderFlash } = useContext(NotificationContext);
-  const [isUploading, setIsUploading] = useState(false);
-
-  const uploadToken = async (files: FileList | null) => {
-    setIsUploading(true);
-
-    const token = files?.[0];
-    if (!token) {
-      setIsUploading(false);
-      renderFlash("error", "No token selected.");
-      return;
-    }
-
-    try {
-      await mdmAppleAPI.uploadVppToken(token);
-      renderFlash(
-        "success",
-        "Volume Purchasing Program (VPP) integration enabled successfully."
-      );
-      router.push(PATHS.ADMIN_INTEGRATIONS_VPP);
-    } catch (e) {
-      // TODO: error messages
-      const msg = getErrorReason(e, { reasonIncludes: "valid token" });
-      if (msg) {
-        renderFlash("error", msg);
-      } else {
-        renderFlash("error", "Couldn't Upload. Please try again.");
-      }
-    } finally {
-      setIsUploading(false);
-    }
-  };
-
-  return (
-    <div className={`${baseClass}__setup-content`}>
-      <p className={`${baseClass}__description`}>
-        Connect Fleet to your Apple Business Manager account to enable access to
-        purchased apps.
-      </p>
-      <VppSetupSteps extendendSteps />
-      <FileUploader
-        className={`${baseClass}__file-uploader ${
-          isUploading ? `${baseClass}__file-uploader--loading` : ""
-        }`}
-        accept=".vpptoken"
-        message="Content token (.vpptoken)"
-        graphicName="file-vpp"
-        buttonType="link"
-        buttonMessage={isUploading ? "Uploading..." : "Upload"}
-        onFileUpload={uploadToken}
-      />
-    </div>
-  );
-};
-
-interface IVppDisableOrRenewContentProps {
-  vppInfo: IGetVppInfoResponse;
-  onDisable: () => void;
-  onRenew: () => void;
-}
-
-const VPPDisableOrRenewContent = ({
-  vppInfo,
-  onDisable,
-  onRenew,
-}: IVppDisableOrRenewContentProps) => {
-  return (
-    <div className={`${baseClass}__disable-renew-content`}>
-      <div className={`${baseClass}__info`}>
-        <DataSet title="Organization name" value={vppInfo.org_name} />
-        <DataSet title="Location" value={vppInfo.location} />
-        <DataSet title="Renew date" value={readableDate(vppInfo.renew_date)} />
-      </div>
-      <div className={`${baseClass}__button-wrap`}>
-        <Button variant="inverse" onClick={onDisable}>
-          Disable
-        </Button>
-        <Button variant="brand" onClick={onRenew}>
-          Renew token
-        </Button>
-      </div>
-    </div>
-  );
-};
-
-interface IVppSetupPageProps {
-  router: InjectedRouter;
-}
-
-const VppSetupPage = ({ router }: IVppSetupPageProps) => {
-  const [showDisableModal, setShowDisableModal] = useState(false);
-  const [showRenewModal, setShowRenewModal] = useState(false);
-
-  const {
-    data: vppData,
-    error: vppError,
-    isLoading,
-    isError,
-    refetch: refetchVppInfo,
-  } = useQuery<IGetVppInfoResponse, AxiosError>(
-    "vppInfo",
-    () => mdmAppleAPI.getVppInfo(),
-    {
-      ...DEFAULT_USE_QUERY_OPTIONS,
-      retry: false,
-    }
-  );
-
-  const renderContent = () => {
-    if (isLoading) {
-      return <Spinner />;
-    }
-
-    if (isError && vppError?.status !== 404) {
-      return <DataError />;
-    }
-
-    // 404 means there is no token, se we want to show the setup steps content
-    if (vppError?.status === 404) {
-      return <VPPSetupContent router={router} />;
-    }
-
-    return vppData ? (
-      <VPPDisableOrRenewContent
-        vppInfo={vppData}
-        onDisable={() => setShowDisableModal(true)}
-        onRenew={() => setShowRenewModal(true)}
-      />
-    ) : null;
-  };
-
-  return (
-    <MainContent className={baseClass}>
-      <>
-        <BackLink
-          text="Back to automatic enrollment"
-          path={PATHS.ADMIN_INTEGRATIONS_VPP}
-          className={`${baseClass}__back-to-vpp`}
-        />
-        <h1>Volume Purchasing Program (VPP)</h1>
-        <>{renderContent()}</>
-      </>
-      {showDisableModal && (
-        <DisableVppModal
-          router={router}
-          onExit={() => setShowDisableModal(false)}
-        />
-      )}
-      {showRenewModal && (
-        <RenewVppTokenModal
-          onExit={() => setShowRenewModal(false)}
-          onTokenRenewed={refetchVppInfo}
-        />
-      )}
-    </MainContent>
-  );
-};
-
-export default VppSetupPage;
diff --git a/frontend/pages/admin/IntegrationsPage/cards/Vpp/VppSetupPage/_styles.scss b/frontend/pages/admin/IntegrationsPage/cards/Vpp/VppSetupPage/_styles.scss
deleted file mode 100644
index 4c1efec145..0000000000
--- a/frontend/pages/admin/IntegrationsPage/cards/Vpp/VppSetupPage/_styles.scss
+++ /dev/null
@@ -1,48 +0,0 @@
-.vpp-setup-page {
-  &__back-to-vpp {
-    margin-bottom: $pad-xlarge;
-  }
-
-  h1 {
-    margin-bottom: $pad-xxlarge;
-    font-size: $large;
-  }
-
-  &__description {
-    font-size: $x-small;
-    margin: 0 0 $pad-large;
-  }
-
-  &__file-uploader {
-    max-width: 784px;
-    margin-top: $pad-medium;
-    margin-left: $pad-medium;
-
-    button {
-      margin-top: 0;
-    }
-
-    &--loading {
-      label {
-        opacity: 0.5;
-      }
-    }
-  }
-
-  &__button-wrap {
-    display: flex;
-    gap: $pad-medium;
-  }
-
-  &__disable-renew-content {
-    display: flex;
-    flex-direction: column;
-    gap: $pad-large;
-  }
-
-  &__info {
-    display: flex;
-    flex-direction: column;
-    gap: $pad-medium;
-  }
-}
diff --git a/frontend/pages/admin/IntegrationsPage/cards/Vpp/VppSetupPage/components/DisableVppModal/DisableVppModal.tsx b/frontend/pages/admin/IntegrationsPage/cards/Vpp/VppSetupPage/components/DisableVppModal/DisableVppModal.tsx
deleted file mode 100644
index b601dc4847..0000000000
--- a/frontend/pages/admin/IntegrationsPage/cards/Vpp/VppSetupPage/components/DisableVppModal/DisableVppModal.tsx
+++ /dev/null
@@ -1,70 +0,0 @@
-import React, { useContext, useState } from "react";
-import { InjectedRouter } from "react-router";
-import paths from "router/paths";
-
-import mdmAppleAPI from "services/entities/mdm_apple";
-import { NotificationContext } from "context/notification";
-
-import Modal from "components/Modal";
-import Button from "components/buttons/Button";
-
-const baseClass = "diable-vpp-modal";
-
-interface IDisableVppModalProps {
-  router: InjectedRouter;
-  onExit: () => void;
-}
-
-const DisableVppModal = ({ router, onExit }: IDisableVppModalProps) => {
-  const { renderFlash } = useContext(NotificationContext);
-  const [isDisabling, setIsDisabling] = useState(false);
-
-  const onDisableVpp = async () => {
-    setIsDisabling(true);
-    try {
-      await mdmAppleAPI.disableVpp();
-      renderFlash(
-        "success",
-        "Volume Purchasing Program (VPP) disabled successfully."
-      );
-      router.push(paths.ADMIN_INTEGRATIONS_VPP);
-    } catch {
-      renderFlash(
-        "error",
-        "Couldn't disable Volume Purchasing Program (VPP). Please try again."
-      );
-    }
-
-    onExit();
-  };
-
-  return (
-    <Modal
-      title="Disable Volume Purchasing Program (VPP)"
-      onExit={onExit}
-      className={baseClass}
-    >
-      <>
-        <p>
-          Apps purchased in Apple Business Manager won&apos;t appear in Fleet.
-          Apps won&apos;t be uninstalled from hosts. If you want to enable VPP
-          integration again, you&apos;ll have to upload a new content token.
-        </p>
-        <div className="modal-cta-wrap">
-          <Button
-            variant="alert"
-            onClick={onDisableVpp}
-            isLoading={isDisabling}
-          >
-            Disable
-          </Button>
-          <Button onClick={onExit} variant="inverse-alert">
-            Cancel
-          </Button>
-        </div>
-      </>
-    </Modal>
-  );
-};
-
-export default DisableVppModal;
diff --git a/frontend/pages/admin/IntegrationsPage/cards/Vpp/VppSetupPage/components/DisableVppModal/index.ts b/frontend/pages/admin/IntegrationsPage/cards/Vpp/VppSetupPage/components/DisableVppModal/index.ts
deleted file mode 100644
index d223bbdb91..0000000000
--- a/frontend/pages/admin/IntegrationsPage/cards/Vpp/VppSetupPage/components/DisableVppModal/index.ts
+++ /dev/null
@@ -1 +0,0 @@
-export { default } from "./DisableVppModal";
diff --git a/frontend/pages/admin/IntegrationsPage/cards/Vpp/VppSetupPage/components/RenewVppTokenModal/_styles.scss b/frontend/pages/admin/IntegrationsPage/cards/Vpp/VppSetupPage/components/RenewVppTokenModal/_styles.scss
deleted file mode 100644
index a848fb9c45..0000000000
--- a/frontend/pages/admin/IntegrationsPage/cards/Vpp/VppSetupPage/components/RenewVppTokenModal/_styles.scss
+++ /dev/null
@@ -1,15 +0,0 @@
-.renew-vpp-token-modal {
-  &__file-uploader {
-    margin-top: $pad-medium;
-
-    button {
-      margin-top: 0;
-    }
-
-    &--loading {
-      label {
-        opacity: 0.5;
-      }
-    }
-  }
-}
diff --git a/frontend/pages/admin/IntegrationsPage/cards/Vpp/VppSetupPage/components/RenewVppTokenModal/index.ts b/frontend/pages/admin/IntegrationsPage/cards/Vpp/VppSetupPage/components/RenewVppTokenModal/index.ts
deleted file mode 100644
index 8cb881457f..0000000000
--- a/frontend/pages/admin/IntegrationsPage/cards/Vpp/VppSetupPage/components/RenewVppTokenModal/index.ts
+++ /dev/null
@@ -1 +0,0 @@
-export { default } from "./RenewVppTokenModal";
diff --git a/frontend/pages/admin/IntegrationsPage/cards/Vpp/VppSetupPage/index.ts b/frontend/pages/admin/IntegrationsPage/cards/Vpp/VppSetupPage/index.ts
deleted file mode 100644
index a591bb640a..0000000000
--- a/frontend/pages/admin/IntegrationsPage/cards/Vpp/VppSetupPage/index.ts
+++ /dev/null
@@ -1 +0,0 @@
-export { default } from "./VppSetupPage";
diff --git a/frontend/pages/admin/IntegrationsPage/cards/Vpp/index.ts b/frontend/pages/admin/IntegrationsPage/cards/Vpp/index.ts
deleted file mode 100644
index 35854011a7..0000000000
--- a/frontend/pages/admin/IntegrationsPage/cards/Vpp/index.ts
+++ /dev/null
@@ -1 +0,0 @@
-export { default } from "./Vpp";
diff --git a/frontend/pages/admin/TeamManagementPage/TeamDetailsWrapper/TeamDetailsWrapper.tsx b/frontend/pages/admin/TeamManagementPage/TeamDetailsWrapper/TeamDetailsWrapper.tsx
index 90a3d609d9..dc7d191ec2 100644
--- a/frontend/pages/admin/TeamManagementPage/TeamDetailsWrapper/TeamDetailsWrapper.tsx
+++ b/frontend/pages/admin/TeamManagementPage/TeamDetailsWrapper/TeamDetailsWrapper.tsx
@@ -337,11 +337,18 @@ const TeamDetailsWrapper = ({
           setBackendValidators({
             name: "A team with this name already exists",
           });
+        } else if (errorObject.base.includes("all teams")) {
+          setBackendValidators({
+            name: `"All teams" is a reserved team name. Please try another name.`,
+          });
+        } else if (errorObject.base.includes("no team")) {
+          setBackendValidators({
+            name: `"No team" is a reserved team name. Please try another name.`,
+          });
         } else {
           renderFlash("error", "Could not create team. Please try again.");
         }
       } finally {
-        toggleRenameTeamModal();
         setIsUpdatingTeams(false);
       }
     },
diff --git a/frontend/pages/admin/TeamManagementPage/TeamManagementPage.tsx b/frontend/pages/admin/TeamManagementPage/TeamManagementPage.tsx
index 92bbec0280..e50128dc8e 100644
--- a/frontend/pages/admin/TeamManagementPage/TeamManagementPage.tsx
+++ b/frontend/pages/admin/TeamManagementPage/TeamManagementPage.tsx
@@ -116,6 +116,14 @@ const TeamManagementPage = (): JSX.Element => {
             setBackendValidators({
               name: "A team with this name already exists",
             });
+          } else if (createError.data.errors[0].reason.includes("All teams")) {
+            setBackendValidators({
+              name: `"All teams" is a reserved team name. Please try another name.`,
+            });
+          } else if (createError.data.errors[0].reason.includes("No team")) {
+            setBackendValidators({
+              name: `"No team" is a reserved team name. Please try another name.`,
+            });
           } else {
             renderFlash("error", "Could not create team. Please try again.");
             toggleCreateTeamModal();
@@ -185,6 +193,16 @@ const TeamManagementPage = (): JSX.Element => {
               setBackendValidators({
                 name: "A team with this name already exists",
               });
+            } else if (
+              updateError.data.errors[0].reason.includes("all teams")
+            ) {
+              setBackendValidators({
+                name: `"All teams" is a reserved team name.`,
+              });
+            } else if (updateError.data.errors[0].reason.includes("no team")) {
+              setBackendValidators({
+                name: `"No team" is a reserved team name. Please try another name.`,
+              });
             } else {
               renderFlash(
                 "error",
diff --git a/frontend/pages/admin/components/SettingsSection/SettingsSection.tsx b/frontend/pages/admin/components/SettingsSection/SettingsSection.tsx
new file mode 100644
index 0000000000..d3a93ab09b
--- /dev/null
+++ b/frontend/pages/admin/components/SettingsSection/SettingsSection.tsx
@@ -0,0 +1,30 @@
+import React from "react";
+import classnames from "classnames";
+
+import SectionHeader from "components/SectionHeader";
+
+const baseClass = "settings-section";
+
+interface ISettingsSectionProps {
+  title: string;
+  children: React.ReactNode;
+  className?: string;
+}
+
+/** This component encapsulates the common styles for each settings section */
+const SettingsSection = ({
+  title,
+  children,
+  className,
+}: ISettingsSectionProps) => {
+  const classes = classnames(baseClass, className);
+
+  return (
+    <section className={classes}>
+      <SectionHeader title={title} className={`${baseClass}__title`} />
+      <>{children}</>
+    </section>
+  );
+};
+
+export default SettingsSection;
diff --git a/frontend/pages/admin/components/SettingsSection/index.ts b/frontend/pages/admin/components/SettingsSection/index.ts
new file mode 100644
index 0000000000..279f1769e8
--- /dev/null
+++ b/frontend/pages/admin/components/SettingsSection/index.ts
@@ -0,0 +1 @@
+export { default } from "./SettingsSection";
diff --git a/frontend/pages/hosts/ManageHostsPage/HostTableConfig.tsx b/frontend/pages/hosts/ManageHostsPage/HostTableConfig.tsx
index fa52ec67b7..7666f46876 100644
--- a/frontend/pages/hosts/ManageHostsPage/HostTableConfig.tsx
+++ b/frontend/pages/hosts/ManageHostsPage/HostTableConfig.tsx
@@ -23,6 +23,7 @@ import {
   humanHostMemory,
   humanHostLastSeen,
   hostTeamName,
+  tooltipTextWithLineBreaks,
 } from "utilities/helpers";
 import { COLORS } from "styles/var/colors";
 import {
@@ -69,17 +70,6 @@ const condenseDeviceUsers = (users: IDeviceUser[]): string[] => {
     : condensed;
 };
 
-const tooltipTextWithLineBreaks = (lines: string[]) => {
-  return lines.map((line) => {
-    return (
-      <span key={Math.random().toString().slice(2)}>
-        {line}
-        <br />
-      </span>
-    );
-  });
-};
-
 const lastSeenTime = (status: string, seenTime: string): string => {
   if (status !== "online") {
     return `Last Seen: ${humanHostLastSeen(seenTime)} UTC`;
@@ -148,9 +138,8 @@ const allHostTableHeaders: IHostTableColumnConfig[] = [
               <span className={`tooltip__tooltip-text`}>
                 This host was ordered using <br />
                 Apple Business Manager <br />
-                (ABM). You can&apos;t see host <br />
-                vitals until it&apos;s unboxed and <br />
-                automatically enrolls to Fleet.
+                (ABM). You will see host <br />
+                vitals when it is enrolled in Fleet <br />
               </span>
             </ReactTooltip>
           </>
diff --git a/frontend/pages/hosts/ManageHostsPage/ManageHostsPage.tsx b/frontend/pages/hosts/ManageHostsPage/ManageHostsPage.tsx
index 71f2386c58..6464f4d59b 100644
--- a/frontend/pages/hosts/ManageHostsPage/ManageHostsPage.tsx
+++ b/frontend/pages/hosts/ManageHostsPage/ManageHostsPage.tsx
@@ -51,10 +51,10 @@ import { ILabel } from "interfaces/label";
 import { IOperatingSystemVersion } from "interfaces/operating_system";
 import { IPolicy, IStoredPolicyResponse } from "interfaces/policy";
 import {
-  isValidSoftwareInstallStatus,
-  SoftwareInstallStatus,
+  isValidSoftwareAggregateStatus,
+  SoftwareAggregateStatus,
 } from "interfaces/software";
-import { ITeam } from "interfaces/team";
+import { API_ALL_TEAMS_ID, ITeam } from "interfaces/team";
 import { IEmptyTableProps } from "interfaces/empty_table";
 import {
   DiskEncryptionStatus,
@@ -169,8 +169,9 @@ const ManageHostsPage = ({
     includeAllTeams: true,
     includeNoTeam: true,
     overrideParamsOnTeamChange: {
-      // remove the software status filter when selecting all teams
-      [HOSTS_QUERY_PARAMS.SOFTWARE_STATUS]: (newTeamId?: number) => !newTeamId,
+      // remove the software status filter when selecting All teams
+      [HOSTS_QUERY_PARAMS.SOFTWARE_STATUS]: (newTeamId?: number) =>
+        newTeamId === API_ALL_TEAMS_ID,
     },
   });
 
@@ -242,10 +243,12 @@ const ManageHostsPage = ({
     queryParams?.software_title_id !== undefined
       ? parseInt(queryParams.software_title_id, 10)
       : undefined;
-  const softwareStatus = isValidSoftwareInstallStatus(
+  const softwareStatus = isValidSoftwareAggregateStatus(
     queryParams?.[HOSTS_QUERY_PARAMS.SOFTWARE_STATUS]
   )
-    ? (queryParams[HOSTS_QUERY_PARAMS.SOFTWARE_STATUS] as SoftwareInstallStatus)
+    ? (queryParams[
+        HOSTS_QUERY_PARAMS.SOFTWARE_STATUS
+      ] as SoftwareAggregateStatus)
     : undefined;
   const status = isAcceptableStatus(queryParams?.status)
     ? queryParams?.status
@@ -735,8 +738,8 @@ const ManageHostsPage = ({
     );
   };
 
-  const handleSoftwareInstallStatausChange = (
-    newStatus: SoftwareInstallStatus
+  const handleSoftwareInstallStatusChange = (
+    newStatus: SoftwareAggregateStatus
   ) => {
     handleResetPageIndex();
 
@@ -845,8 +848,8 @@ const ManageHostsPage = ({
         newQueryParams.software_version_id = softwareVersionId;
       } else if (softwareTitleId) {
         newQueryParams.software_title_id = softwareTitleId;
-        if (softwareStatus && teamIdForApi && teamIdForApi > 0) {
-          // software_status is only valid when software_title_id is present and a team is selected
+        if (softwareStatus && teamIdForApi !== API_ALL_TEAMS_ID) {
+          // software_status is only valid when software_title_id is present and a subset of hosts ('No team' or a team) is selected
           newQueryParams[HOSTS_QUERY_PARAMS.SOFTWARE_STATUS] = softwareStatus;
         }
       } else if (mdmId) {
@@ -1375,7 +1378,10 @@ const ManageHostsPage = ({
       teamId: teamIdForApi,
     };
 
-    if (queryParams.team_id) {
+    if (
+      queryParams.team_id !== API_ALL_TEAMS_ID &&
+      queryParams.team_id !== ""
+    ) {
       options.teamId = queryParams.team_id;
     }
 
@@ -1437,7 +1443,7 @@ const ManageHostsPage = ({
           options={getHostSelectStatuses(isSandboxMode)}
           searchable={false}
           onChange={handleStatusDropdownChange}
-          tableFilterDropdown
+          iconName="filter"
         />
         <LabelFilterSelect
           className={`${baseClass}__label-filter-dropdown`}
@@ -1550,7 +1556,6 @@ const ManageHostsPage = ({
       softwareId ||
       softwareTitleId ||
       softwareVersionId ||
-      softwareStatus ||
       osName ||
       osVersionId ||
       osVersion ||
@@ -1722,7 +1727,7 @@ const ManageHostsPage = ({
             }
             onChangeMacSettingsFilter={handleMacSettingsStatusDropdownChange}
             onChangeSoftwareInstallStatusFilter={
-              handleSoftwareInstallStatausChange
+              handleSoftwareInstallStatusChange
             }
             onClickEditLabel={onEditLabelClick}
             onClickDeleteLabel={toggleDeleteLabelModal}
diff --git a/frontend/pages/hosts/ManageHostsPage/_styles.scss b/frontend/pages/hosts/ManageHostsPage/_styles.scss
index 290ea1d098..76cce5f298 100644
--- a/frontend/pages/hosts/ManageHostsPage/_styles.scss
+++ b/frontend/pages/hosts/ManageHostsPage/_styles.scss
@@ -108,6 +108,7 @@
 
         .manage-hosts__filter-dropdowns {
           display: flex;
+          flex-direction: row;
           margin-left: $pad-medium;
 
           // Dropdown height matches search bar height
@@ -166,10 +167,12 @@
         }
 
         .controls {
-          order: 1;
-          margin-bottom: $pad-medium;
+          order: -2;
+          margin-bottom: $pad-small;
 
           .manage-hosts__filter-dropdowns {
+            display: flex;
+            flex-direction: row;
             flex: 1;
 
             .form-field--dropdown,
diff --git a/frontend/pages/hosts/ManageHostsPage/components/HostsFilterBlock/HostsFilterBlock.tsx b/frontend/pages/hosts/ManageHostsPage/components/HostsFilterBlock/HostsFilterBlock.tsx
index 5f6e626b44..62dc63ed56 100644
--- a/frontend/pages/hosts/ManageHostsPage/components/HostsFilterBlock/HostsFilterBlock.tsx
+++ b/frontend/pages/hosts/ManageHostsPage/components/HostsFilterBlock/HostsFilterBlock.tsx
@@ -15,7 +15,7 @@ import {
 } from "interfaces/mdm";
 import { IMunkiIssuesAggregate } from "interfaces/macadmins";
 import { IPolicy } from "interfaces/policy";
-import { SoftwareInstallStatus } from "interfaces/software";
+import { SoftwareAggregateStatus } from "interfaces/software";
 
 import {
   HOSTS_QUERY_PARAMS,
@@ -72,7 +72,7 @@ interface IHostsFilterBlockProps {
     osSettingsStatus?: MdmProfileStatus;
     diskEncryptionStatus?: DiskEncryptionStatus;
     bootstrapPackageStatus?: BootstrapPackageStatus;
-    softwareStatus?: SoftwareInstallStatus;
+    softwareStatus?: SoftwareAggregateStatus;
   };
   selectedLabel?: ILabel;
   isOnlyObserver?: boolean;
@@ -88,7 +88,7 @@ interface IHostsFilterBlockProps {
     newMacSettingsStatus: MacSettingsStatusQueryParam
   ) => void;
   onChangeSoftwareInstallStatusFilter: (
-    newStatus: SoftwareInstallStatus
+    newStatus: SoftwareAggregateStatus
   ) => void;
   onClickEditLabel: (evt: React.MouseEvent<HTMLButtonElement>) => void;
   onClickDeleteLabel: () => void;
@@ -251,6 +251,8 @@ const HostsFilterBlock = ({
           className={`${baseClass}__macsettings-dropdown`}
           options={OS_SETTINGS_FILTER_OPTIONS}
           onChange={onChangeMacSettingsFilter}
+          searchable={false}
+          iconName="filter-alt"
         />
         <FilterPill
           label={label}
@@ -414,6 +416,8 @@ const HostsFilterBlock = ({
           className={`${baseClass}__os_settings-dropdown`}
           options={OS_SETTINGS_FILTER_OPTIONS}
           onChange={onChangeOsSettingsFilter}
+          searchable={false}
+          iconName="filter-alt"
         />
         <FilterPill
           label={label}
@@ -472,7 +476,9 @@ const HostsFilterBlock = ({
           value={softwareStatus}
           className={`${baseClass}__sw-install-status-dropdown`}
           options={OPTIONS}
+          searchable={false}
           onChange={onChangeSoftwareInstallStatusFilter}
+          iconName="filter-alt"
         />
         {renderSoftwareFilterBlock([HOSTS_QUERY_PARAMS.SOFTWARE_STATUS])}
       </>
diff --git a/frontend/pages/hosts/ManageHostsPage/components/HostsFilterBlock/_styles.scss b/frontend/pages/hosts/ManageHostsPage/components/HostsFilterBlock/_styles.scss
index b270d85184..667c4f086a 100644
--- a/frontend/pages/hosts/ManageHostsPage/components/HostsFilterBlock/_styles.scss
+++ b/frontend/pages/hosts/ManageHostsPage/components/HostsFilterBlock/_styles.scss
@@ -10,40 +10,23 @@
       // and other "form-fields" in the filter block
       width: initial;
     }
+
+    // Vertically centers icon and text
+    .Select-multi-value-wrapper {
+      display: flex;
+      align-items: center;
+    }
   }
 
-  // NOTE: Look more into this styling
   &__os_settings-dropdown,
   &__macsettings-dropdown,
   &__sw-install-status-dropdown {
-    .Select-value {
-      display: flex;
-      align-items: center;
-      position: initial !important;
-      line-height: initial !important;
-
-      &::before {
-        position: relative;
-        content: url(../assets/images/icon-filter-v2-black-16x16@2x.png);
-        transform: scale(0.5);
-        top: 1px;
-      }
-    }
-
-    .Select-input {
-      display: none !important;
-    }
-
-    .Select {
-      box-sizing: initial;
-    }
-
-    .Select-control {
-      height: 36px;
-    }
-
     .dropdown__select {
       border: 1px solid #e2e4ea;
     }
+
+    .Select-multi-value-wrapper {
+      width: 150px; // Fits all dropdown options without resizing
+    }
   }
 }
diff --git a/frontend/pages/hosts/ManageHostsPage/components/LabelFilterSelect/_styles.scss b/frontend/pages/hosts/ManageHostsPage/components/LabelFilterSelect/_styles.scss
index 72ab4f59e9..c3d1f4802e 100644
--- a/frontend/pages/hosts/ManageHostsPage/components/LabelFilterSelect/_styles.scss
+++ b/frontend/pages/hosts/ManageHostsPage/components/LabelFilterSelect/_styles.scss
@@ -1,5 +1,5 @@
 .label-filter-select {
-  width: 175px;
+  width: 300px;
 
   svg {
     transition: transform 0.25s ease;
diff --git a/frontend/pages/hosts/ManageHostsPage/components/LabelFilterSelect/helpers.ts b/frontend/pages/hosts/ManageHostsPage/components/LabelFilterSelect/helpers.ts
index b6aad87e53..746a2b6ddb 100644
--- a/frontend/pages/hosts/ManageHostsPage/components/LabelFilterSelect/helpers.ts
+++ b/frontend/pages/hosts/ManageHostsPage/components/LabelFilterSelect/helpers.ts
@@ -1,4 +1,6 @@
 import { ILabel } from "interfaces/label";
+import { getCustomLabels } from "services/entities/labels";
+
 import { EMPTY_OPTION, FILTERED_LINUX, NO_LABELS_OPTION } from "./constants";
 
 export interface IEmptyOption {
@@ -27,7 +29,7 @@ const createOptionGroup = (
 /** Will create the custom label group options and handles when no labels have been created yet or
  * will filter by the desired search query */
 const createCustomLabelOptions = (labels: ILabel[], query: string) => {
-  const customLabels = labels.filter((label) => label.label_type === "regular");
+  const customLabels = getCustomLabels(labels);
 
   let customLabelGroupOptions: ILabel[] | IEmptyOption[];
   if (customLabels.length === 0) {
diff --git a/frontend/pages/hosts/ManageHostsPage/components/PoliciesFilter/PoliciesFilter.tsx b/frontend/pages/hosts/ManageHostsPage/components/PoliciesFilter/PoliciesFilter.tsx
index 77f3118d97..fae5ba45e1 100644
--- a/frontend/pages/hosts/ManageHostsPage/components/PoliciesFilter/PoliciesFilter.tsx
+++ b/frontend/pages/hosts/ManageHostsPage/components/PoliciesFilter/PoliciesFilter.tsx
@@ -32,13 +32,14 @@ const PoliciesFilter = ({
   const value = policyResponse;
 
   return (
-    <div className={`${baseClass}__policies-block`}>
+    <div className={baseClass}>
       <Dropdown
         value={value}
         className={`${baseClass}__status_dropdown`}
         options={POLICY_RESPONSE_OPTIONS}
         searchable={false}
         onChange={onChange}
+        iconName="filter-alt"
       />
     </div>
   );
diff --git a/frontend/pages/hosts/ManageHostsPage/components/PoliciesFilter/_styles.scss b/frontend/pages/hosts/ManageHostsPage/components/PoliciesFilter/_styles.scss
index c7d9fa8af7..c1f44b8863 100644
--- a/frontend/pages/hosts/ManageHostsPage/components/PoliciesFilter/_styles.scss
+++ b/frontend/pages/hosts/ManageHostsPage/components/PoliciesFilter/_styles.scss
@@ -1,41 +1,5 @@
 .policies-filter {
-  display: flex;
-  justify-content: flex-start;
-  align-items: center;
-
-  &__status_dropdown {
-    width: 114px;
-
-    .Select-menu-outer {
-      width: 114px;
-      max-height: 310px;
-
-      .Select-menu {
-        max-height: none;
-
-        .dropdown__option {
-          font-size: $small !important;
-        }
-      }
-    }
-    .Select-value {
-      padding-left: $pad-medium;
-      padding-right: $pad-medium;
-
-      &::before {
-        display: inline-block;
-        position: absolute;
-        padding: 5px 0 0 0; // centers spin
-        content: url(../assets/images/icon-filter-v2-black-16x16@2x.png);
-        transform: scale(0.5);
-        width: 16px;
-        height: 26px;
-        left: 2px;
-      }
-    }
-    .Select-value-label {
-      padding-left: $pad-large;
-      font-size: $small !important;
-    }
+  .Select-multi-value-wrapper {
+    width: 91px; // Fits all dropdown options without resizing
   }
 }
diff --git a/frontend/pages/hosts/details/DeviceUserPage/AutoEnrollMdmModal/AutoEnrollMdmModal.tsx b/frontend/pages/hosts/details/DeviceUserPage/AutoEnrollMdmModal/AutoEnrollMdmModal.tsx
index 2f40fa82b6..e4b50bdbdb 100644
--- a/frontend/pages/hosts/details/DeviceUserPage/AutoEnrollMdmModal/AutoEnrollMdmModal.tsx
+++ b/frontend/pages/hosts/details/DeviceUserPage/AutoEnrollMdmModal/AutoEnrollMdmModal.tsx
@@ -23,6 +23,57 @@ const AutoEnrollMdmModal = ({
       .map((s) => parseInt(s, 10));
     isMacOsSonomaOrLater = major >= 14;
   }
+
+  const preSonomaBody = (
+    <>
+      <p className={`${baseClass}__description`}>
+        To turn on MDM, Apple Inc. requires you to follow the steps below.
+      </p>
+      <ol>
+        <li>
+          Open your Mac&apos;s notification center by selecting the date and
+          time in the top right corner of your screen.
+        </li>
+        <li>
+          Select the <b>Device Enrollment</b> notification. This will open{" "}
+          <b>System Settings</b>. Select <b>Allow</b>.
+        </li>
+        <li>
+          Enter your password, and select <b>Enroll</b>.
+        </li>
+        <li>
+          Select <b>Done</b> to close this window and select Refetch on your My
+          device page to tell your organization that MDM is on.
+        </li>
+      </ol>
+    </>
+  );
+
+  const sonomaAndAboveBody = (
+    <>
+      <p className={`${baseClass}__description`}>
+        To turn on MDM, Apple Inc. requires that you install a profile.
+      </p>
+      <ol>
+        <li>
+          From the Apple menu in the top left corner of your screen, select{" "}
+          <b>System Settings</b> or <b>System Preferences</b>.
+        </li>
+        <li>
+          In the sidebar menu, select <b>Enroll in Remote Management</b>, and
+          select <b>Enroll</b>.
+        </li>
+        <li>
+          Enter your password, and select <b>Enroll</b>.
+        </li>
+        <li>
+          Close this window and select <b>Refetch</b> on your My device page to
+          tell your organization that MDM is on.
+        </li>
+      </ol>
+    </>
+  );
+
   return (
     <Modal
       title="Turn on MDM"
@@ -31,35 +82,7 @@ const AutoEnrollMdmModal = ({
       width="xlarge"
     >
       <div>
-        <p className={`${baseClass}__description`}>
-          To turn on MDM, Apple Inc. requires that you install a profile.
-        </p>
-        <ol>
-          <li>
-            From the Apple menu in the top left corner of your screen, select{" "}
-            <b>System Settings</b> or <b>System Preferences</b>.
-          </li>
-          <li>
-            {isMacOsSonomaOrLater ? (
-              <>
-                In the sidebar menu, select <b>Enroll in Remote Management</b>,
-                and select <b>Enroll</b>.
-              </>
-            ) : (
-              <>
-                In the search bar, type “Profiles.” Select <b>Profiles</b>, find
-                and select <b>Enrollment Profile</b>, and select <b>Install</b>.
-              </>
-            )}
-          </li>
-          <li>
-            Enter your password, and select <b>Enroll</b>.
-          </li>
-          <li>
-            Close this window and select <b>Refetch</b> on your My device page
-            to tell your organization that MDM is on.
-          </li>
-        </ol>
+        {isMacOsSonomaOrLater ? sonomaAndAboveBody : preSonomaBody}
         <div className="modal-cta-wrap">
           <Button type="button" onClick={onCancel} variant="brand">
             Done
diff --git a/frontend/pages/hosts/details/DeviceUserPage/DeviceUserPage.tsx b/frontend/pages/hosts/details/DeviceUserPage/DeviceUserPage.tsx
index ba78e6ab25..2393f128ed 100644
--- a/frontend/pages/hosts/details/DeviceUserPage/DeviceUserPage.tsx
+++ b/frontend/pages/hosts/details/DeviceUserPage/DeviceUserPage.tsx
@@ -415,11 +415,12 @@ const DeviceUserPage = ({
                     <SoftwareCard
                       id={deviceAuthToken}
                       softwareUpdatedAt={host.software_updated_at}
-                      hostCanInstallSoftware={!!host.orbit_version}
+                      hostCanWriteSoftware={!!host.orbit_version}
                       router={router}
                       pathname={location.pathname}
                       queryParams={parseHostSoftwareQueryParams(location.query)}
                       isMyDevicePage
+                      platform={host.platform}
                       hostTeamId={host.team_id || 0}
                       isSoftwareEnabled={isSoftwareEnabled}
                     />
diff --git a/frontend/pages/hosts/details/DeviceUserPage/ManualEnrollMdmModal/ManualEnrollMdmModal.tsx b/frontend/pages/hosts/details/DeviceUserPage/ManualEnrollMdmModal/ManualEnrollMdmModal.tsx
index 7b525906f4..1920408bf2 100644
--- a/frontend/pages/hosts/details/DeviceUserPage/ManualEnrollMdmModal/ManualEnrollMdmModal.tsx
+++ b/frontend/pages/hosts/details/DeviceUserPage/ManualEnrollMdmModal/ManualEnrollMdmModal.tsx
@@ -51,8 +51,9 @@ const ManualEnrollMdmModal = ({
             profile.
           </li>
           <li>
-            Select <b>Enroll</b> then enter your password.
+            Select <b>Install...</b> then confirm again clicking <b>Install</b>.
           </li>
+          <li>Enter your password when you get a prompt.</li>
           <li>
             Select <b>Done</b> to close this window and select <b>Refetch</b> on
             your My device page to tell <br /> your organization that MDM is on.
diff --git a/frontend/pages/hosts/details/DeviceUserPage/components/DeviceUserBanners/DeviceUserBanners.tsx b/frontend/pages/hosts/details/DeviceUserPage/components/DeviceUserBanners/DeviceUserBanners.tsx
index 028165648f..286101a026 100644
--- a/frontend/pages/hosts/details/DeviceUserPage/components/DeviceUserBanners/DeviceUserBanners.tsx
+++ b/frontend/pages/hosts/details/DeviceUserPage/components/DeviceUserBanners/DeviceUserBanners.tsx
@@ -51,8 +51,9 @@ const DeviceUserBanners = ({
       return (
         <InfoBanner color="yellow" cta={turnOnMdmButton}>
           Mobile device management (MDM) is off. MDM allows your organization to
-          change settings and install software. This lets your organization keep
-          your device up to date so you don&apos;t have to.
+          enforce settings, OS updates, disk encryption, and more. This lets
+          your organization keep your device up to date so you don&apos;t have
+          to.
         </InfoBanner>
       );
     }
diff --git a/frontend/pages/hosts/details/HostDetailsPage/HostActionsDropdown/helpers.tsx b/frontend/pages/hosts/details/HostDetailsPage/HostActionsDropdown/helpers.tsx
index 3665687d03..5590846c9e 100644
--- a/frontend/pages/hosts/details/HostDetailsPage/HostActionsDropdown/helpers.tsx
+++ b/frontend/pages/hosts/details/HostDetailsPage/HostActionsDropdown/helpers.tsx
@@ -282,6 +282,36 @@ const removeUnavailableOptions = (
   return options;
 };
 
+// Available tooltips for disabled options
+export const getDropdownOptionTooltipContent = (
+  value: string | number,
+  isHostOnline?: boolean
+) => {
+  const tooltipAction: Record<string, string> = {
+    runScript: "run scripts on",
+    wipe: "wipe",
+    lock: "lock",
+    unlock: "unlock",
+    installSoftware: "install software on", // Host software dropdown option
+    uninstallSoftware: "uninstall software on", // Host software dropdown option
+  };
+  if (tooltipAction[value]) {
+    return (
+      <>
+        To {tooltipAction[value]} this host, deploy the
+        <br />
+        fleetd agent with --enable-scripts and
+        <br />
+        refetch host vitals
+      </>
+    );
+  }
+  if (!isHostOnline && value === "query") {
+    return <>You can&apos;t query an offline host.</>;
+  }
+  return undefined;
+};
+
 const modifyOptions = (
   options: IDropdownOption[],
   {
@@ -291,34 +321,13 @@ const modifyOptions = (
     hostPlatform,
   }: IHostActionConfigOptions
 ) => {
-  // Available tooltips for disabled options
-  const getDropdownOptionTooltipContent = (value: string | number) => {
-    const tooltipAction: Record<string, string> = {
-      runScript: "run scripts on",
-      wipe: "wipe",
-      lock: "lock",
-      unlock: "unlock",
-    };
-    if (tooltipAction[value]) {
-      return (
-        <>
-          To {tooltipAction[value]} this host, deploy the
-          <br />
-          fleetd agent with --enable-scripts and
-          <br />
-          refetch host vitals
-        </>
-      );
-    }
-    if (!isHostOnline && value === "query") {
-      return <>You can&apos;t query an offline host.</>;
-    }
-  };
-
   const disableOptions = (optionsToDisable: IDropdownOption[]) => {
     optionsToDisable.forEach((option) => {
       option.disabled = true;
-      option.tooltipContent = getDropdownOptionTooltipContent(option.value);
+      option.tooltipContent = getDropdownOptionTooltipContent(
+        option.value,
+        isHostOnline
+      );
     });
   };
 
diff --git a/frontend/pages/hosts/details/HostDetailsPage/HostDetailsPage.tsx b/frontend/pages/hosts/details/HostDetailsPage/HostDetailsPage.tsx
index 5f4a57a356..0c56d7c6ca 100644
--- a/frontend/pages/hosts/details/HostDetailsPage/HostDetailsPage.tsx
+++ b/frontend/pages/hosts/details/HostDetailsPage/HostDetailsPage.tsx
@@ -53,6 +53,8 @@ import {
   HOST_OSQUERY_DATA,
 } from "utilities/constants";
 
+import { isIPadOrIPhone } from "interfaces/platform";
+
 import Spinner from "components/Spinner";
 import TabsWrapper from "components/TabsWrapper";
 import MainContent from "components/MainContent";
@@ -66,6 +68,7 @@ import {
   SoftwareInstallDetailsModal,
   IPackageInstallDetails,
 } from "components/ActivityDetails/InstallDetails/SoftwareInstallDetails/SoftwareInstallDetails";
+import SoftwareUninstallDetailsModal from "components/ActivityDetails/InstallDetails/SoftwareUninstallDetailsModal";
 
 import HostSummaryCard from "../cards/HostSummary";
 import AboutCard from "../cards/About";
@@ -179,6 +182,10 @@ const HostDetailsPage = ({
     packageInstallDetails,
     setPackageInstallDetails,
   ] = useState<IPackageInstallDetails | null>(null);
+  const [
+    packageUninstallDetails,
+    setPackageUninstallDetails,
+  ] = useState<IPackageInstallDetails | null>(null);
   const [
     appInstallDetails,
     setAppInstallDetails,
@@ -313,7 +320,10 @@ const HostDetailsPage = ({
             // If our 60 second timer wasn't already started (e.g., if a refetch was pending when
             // the first page loads), we start it now if the host is online. If the host is offline,
             // we skip the refetch on page load.
-            if (returnedHost.status === "online") {
+            if (
+              returnedHost.status === "online" ||
+              isIPadOrIPhone(returnedHost.platform)
+            ) {
               setRefetchStartTime(Date.now());
               setTimeout(() => {
                 refetchHostDetails();
@@ -323,9 +333,13 @@ const HostDetailsPage = ({
               setShowRefetchSpinner(false);
             }
           } else {
+            // !!refetchStartTime
             const totalElapsedTime = Date.now() - refetchStartTime;
             if (totalElapsedTime < 60000) {
-              if (returnedHost.status === "online") {
+              if (
+                returnedHost.status === "online" ||
+                isIPadOrIPhone(returnedHost.platform)
+              ) {
                 setTimeout(() => {
                   refetchHostDetails();
                   refetchExtensions();
@@ -338,6 +352,7 @@ const HostDetailsPage = ({
                 setShowRefetchSpinner(false);
               }
             } else {
+              // totalElapsedTime > 60000
               renderFlash(
                 "error",
                 `We're having trouble fetching fresh vitals for this host. Please try again later.`
@@ -469,7 +484,7 @@ const HostDetailsPage = ({
       case "ios":
         return mdmConfig?.ios_updates;
       default:
-        null;
+        return undefined;
     }
   };
 
@@ -592,6 +607,13 @@ const HostDetailsPage = ({
               host?.display_name || details?.host_display_name || "",
           });
           break;
+        case "uninstalled_software":
+          setPackageUninstallDetails({
+            ...details,
+            host_display_name:
+              host?.display_name || details?.host_display_name || "",
+          });
+          break;
         case "installed_app_store_app":
           setAppInstallDetails({
             ...details,
@@ -921,10 +943,10 @@ const HostDetailsPage = ({
             <TabPanel>
               <SoftwareCard
                 id={host.id}
+                platform={host.platform}
                 softwareUpdatedAt={host.software_updated_at}
-                hostCanInstallSoftware={
-                  !!host.orbit_version || isIosOrIpadosHost
-                }
+                hostCanWriteSoftware={!!host.orbit_version || isIosOrIpadosHost}
+                hostScriptsEnabled={host.scripts_enabled || false}
                 isSoftwareEnabled={featuresConfig?.enable_software_inventory}
                 router={router}
                 queryParams={parseHostSoftwareQueryParams(location.query)}
@@ -1054,6 +1076,12 @@ const HostDetailsPage = ({
             onCancel={onCancelSoftwareInstallDetailsModal}
           />
         )}
+        {packageUninstallDetails && (
+          <SoftwareUninstallDetailsModal
+            details={packageUninstallDetails}
+            onCancel={() => setPackageUninstallDetails(null)}
+          />
+        )}
         {!!appInstallDetails && (
           <AppInstallDetailsModal
             details={appInstallDetails}
diff --git a/frontend/pages/hosts/details/HostDetailsPage/_styles.scss b/frontend/pages/hosts/details/HostDetailsPage/_styles.scss
index 3809916a6b..25f6e705f6 100644
--- a/frontend/pages/hosts/details/HostDetailsPage/_styles.scss
+++ b/frontend/pages/hosts/details/HostDetailsPage/_styles.scss
@@ -63,11 +63,6 @@
           flex-direction: row;
         }
       }
-      &__block {
-        display: flex;
-        flex-direction: column;
-        margin-right: $pad-xxlarge;
-      }
       &__data {
         margin-bottom: $pad-medium;
 
diff --git a/frontend/pages/hosts/details/HostDetailsPage/components/HostDetailsBanners/HostDetailsBanners.tsx b/frontend/pages/hosts/details/HostDetailsPage/components/HostDetailsBanners/HostDetailsBanners.tsx
index 89632164b0..656d3f2deb 100644
--- a/frontend/pages/hosts/details/HostDetailsPage/components/HostDetailsBanners/HostDetailsBanners.tsx
+++ b/frontend/pages/hosts/details/HostDetailsPage/components/HostDetailsBanners/HostDetailsBanners.tsx
@@ -23,32 +23,34 @@ const HostDetailsBanners = ({
   connectedToFleetMdm,
   diskEncryptionStatus,
 }: IHostDetailsBannersProps) => {
-  const { config, isPremiumTier, apnsExpiry, abmExpiry } = useContext(
-    AppContext
-  );
+  const {
+    config,
+    isPremiumTier,
+    isAppleBmExpired,
+    isApplePnsExpired,
+    isVppExpired,
+    needsAbmTermsRenewal,
+    willAppleBmExpire,
+    willApplePnsExpire,
+    willVppExpire,
+  } = useContext(AppContext);
 
   // Checks to see if an app-wide banner is being shown (the ABM terms, ABM expiry,
   // or APNs expiry banner) in a parent component. App-wide banners found in parent
   // component take priority over host details page-level banners.
-  const isAppleBmTermsExpired = config?.mdm?.apple_bm_terms_expired;
-  const isApplePnsExpired = hasLicenseExpired(apnsExpiry || "");
-  const willApplePnsExpireIn30Days = willExpireWithinXDays(
-    apnsExpiry || "",
-    30
-  );
-  const isAppleBmExpired = hasLicenseExpired(abmExpiry || "");
-  const willAppleBmExpireIn30Days = willExpireWithinXDays(abmExpiry || "", 30);
   const isFleetLicenseExpired = hasLicenseExpired(
     config?.license.expiration || ""
   );
 
   const showingAppWideBanner =
     isPremiumTier &&
-    (isAppleBmTermsExpired ||
+    (needsAbmTermsRenewal ||
       isApplePnsExpired ||
-      willApplePnsExpireIn30Days ||
+      willApplePnsExpire ||
       isAppleBmExpired ||
-      willAppleBmExpireIn30Days ||
+      willAppleBmExpire ||
+      isVppExpired ||
+      willVppExpire ||
       isFleetLicenseExpired);
 
   const isMdmUnenrolled =
@@ -71,9 +73,9 @@ const HostDetailsBanners = ({
       <div className={baseClass}>
         {showTurnOnMdmInfoBanner && (
           <InfoBanner color="yellow">
-            To change settings and install software, ask the end user to follow
-            the <strong>Turn on MDM</strong> instructions on their{" "}
-            <strong>My device</strong> page.
+            To enforce settings, OS updates, disk encryption, and more, ask the
+            end user to follow the <strong>Turn on MDM</strong> instructions on
+            their <strong>My device</strong> page.
           </InfoBanner>
         )}
         {showDiskEncryptionUserActionRequired && (
diff --git a/frontend/pages/hosts/details/HostDetailsPage/modals/UnenrollMdmModal/UnenrollMdmModal.tsx b/frontend/pages/hosts/details/HostDetailsPage/modals/UnenrollMdmModal/UnenrollMdmModal.tsx
index ef2135dc19..a254ea2fa4 100644
--- a/frontend/pages/hosts/details/HostDetailsPage/modals/UnenrollMdmModal/UnenrollMdmModal.tsx
+++ b/frontend/pages/hosts/details/HostDetailsPage/modals/UnenrollMdmModal/UnenrollMdmModal.tsx
@@ -25,11 +25,15 @@ const UnenrollMdmModal = ({ hostId, onClose }: IUnenrollMdmModalProps) => {
     setRequestState("unenrolling");
     try {
       await mdmAPI.unenrollHostFromMdm(hostId, 5000);
-      renderFlash("success", "Successfully turned off MDM.");
+      renderFlash(
+        "success",
+        "Turning off MDM or will turn off when the host comes online."
+      );
       onClose();
     } catch (unenrollMdmError: unknown) {
+      renderFlash("error", "Couldn't turn off MDM. Please try again.");
       console.log(unenrollMdmError);
-      setRequestState("error");
+      onClose();
     }
   };
 
diff --git a/frontend/pages/hosts/details/OSSettingsModal/OSSettingsModal.tsx b/frontend/pages/hosts/details/OSSettingsModal/OSSettingsModal.tsx
index a9c916f570..f86226a967 100644
--- a/frontend/pages/hosts/details/OSSettingsModal/OSSettingsModal.tsx
+++ b/frontend/pages/hosts/details/OSSettingsModal/OSSettingsModal.tsx
@@ -43,7 +43,7 @@ const OSSettingsModal = ({
       title="OS settings"
       onExit={onClose}
       className={baseClass}
-      width="large"
+      width="xlarge"
     >
       <>
         <OSSettingsTable
diff --git a/frontend/pages/hosts/details/OSSettingsModal/OSSettingsTable/OSSettingsErrorCell/_styles.scss b/frontend/pages/hosts/details/OSSettingsModal/OSSettingsTable/OSSettingsErrorCell/_styles.scss
index f91e845c9a..10de839ebb 100644
--- a/frontend/pages/hosts/details/OSSettingsModal/OSSettingsTable/OSSettingsErrorCell/_styles.scss
+++ b/frontend/pages/hosts/details/OSSettingsModal/OSSettingsTable/OSSettingsErrorCell/_styles.scss
@@ -15,6 +15,7 @@
   }
 
   &__resend-button {
+    width: 106px;
     display: flex;
 
     .children-wrapper {
diff --git a/frontend/pages/hosts/details/OSSettingsModal/OSSettingsTable/_styles.scss b/frontend/pages/hosts/details/OSSettingsModal/OSSettingsTable/_styles.scss
index c4a3911286..dc33019945 100644
--- a/frontend/pages/hosts/details/OSSettingsModal/OSSettingsTable/_styles.scss
+++ b/frontend/pages/hosts/details/OSSettingsModal/OSSettingsTable/_styles.scss
@@ -4,8 +4,15 @@
   // for these cells in the table. Total width of the table cell will be
   // 240px including the padding.
   .data-table-block .data-table tbody td {
-    .os-settings-name-cell, .os-settings-status-cell, .os-settings-error-cell {
-      max-width: 192px;
+    .os-settings-name-cell {
+      width: 135px;
+      max-width: none;
+    }
+    .os-settings-status-cell {
+      width: 200px;
+    }
+    .os-settings-error-cell {
+      width: 237px;
     }
   }
 
diff --git a/frontend/pages/hosts/details/_styles.scss b/frontend/pages/hosts/details/_styles.scss
index e3f17951b7..f2ef26fe9d 100644
--- a/frontend/pages/hosts/details/_styles.scss
+++ b/frontend/pages/hosts/details/_styles.scss
@@ -21,41 +21,6 @@
       margin: 0 0 $pad-medium 0;
     }
 
-    .info-grid {
-      display: grid;
-      grid-auto-flow: column;
-      grid-template-columns: repeat(
-        3,
-        max-content
-      ); // Prevents overflow off screen
-      grid-template-rows: repeat(4, 1fr);
-      column-gap: $pad-xxlarge;
-      row-gap: $pad-medium;
-
-      @media (min-width: $break-md) {
-        grid-template-columns: repeat(4, max-content);
-        grid-template-rows: repeat(3, 1fr);
-      }
-
-      &__block {
-        font-size: $x-small;
-        display: flex;
-        flex-direction: column;
-        white-space: nowrap;
-      }
-
-      &__data {
-        .device-mapping {
-          &__source {
-            color: $ui-fleet-black-75;
-          }
-          &__more {
-            color: $ui-fleet-black-50;
-          }
-        }
-      }
-    }
-
     .list {
       list-style: none;
       padding: 0;
diff --git a/frontend/pages/hosts/details/cards/About/About.tsx b/frontend/pages/hosts/details/cards/About/About.tsx
index 94d1bdf36f..f1667f8900 100644
--- a/frontend/pages/hosts/details/cards/About/About.tsx
+++ b/frontend/pages/hosts/details/cards/About/About.tsx
@@ -189,11 +189,11 @@ const About = ({
     <Card
       borderRadiusSize="xxlarge"
       includeShadow
-      largePadding
+      paddingSize="large"
       className={baseClass}
     >
       <p className="card__header">About</p>
-      <div className="info-grid">
+      <div className="info-flex">
         <DataSet
           title="Added to Fleet"
           value={
diff --git a/frontend/pages/hosts/details/cards/About/_styles.scss b/frontend/pages/hosts/details/cards/About/_styles.scss
index 4cfb5ee69d..bac579cff0 100644
--- a/frontend/pages/hosts/details/cards/About/_styles.scss
+++ b/frontend/pages/hosts/details/cards/About/_styles.scss
@@ -1,4 +1,54 @@
 .about-card {
+  // Adjusts for edge cases of extra long MDM server URL and used by email
+  .info-flex {
+    display: flex;
+    flex-direction: column;
+    flex-wrap: wrap;
+    gap: $pad-medium $pad-xxlarge;
+    max-height: 350px;
+    align-content: flex-start;
+
+    .data-set {
+      min-width: none;
+    }
+
+    dd,
+    .component__tooltip-wrapper__element {
+      max-width: 350px;
+      white-space: initial;
+      word-break: break-word;
+    }
+
+    &__data {
+      .device-mapping {
+        &__source {
+          color: $ui-fleet-black-75;
+        }
+        &__more {
+          color: $ui-fleet-black-50;
+        }
+      }
+    }
+
+    @media (min-width: $break-md) {
+      max-height: 250px;
+
+      dd,
+      .component__tooltip-wrapper__element {
+        max-width: 340px;
+      }
+    }
+
+    @media (min-width: $break-lg) {
+      max-height: 200px;
+
+      dd,
+      .component__tooltip-wrapper__element {
+        max-width: 500px;
+      }
+    }
+  }
+
   .text-muted {
     color: $ui-fleet-black-50;
   }
diff --git a/frontend/pages/hosts/details/cards/Activity/Activity.tsx b/frontend/pages/hosts/details/cards/Activity/Activity.tsx
index 91d35ce35f..507ceaa335 100644
--- a/frontend/pages/hosts/details/cards/Activity/Activity.tsx
+++ b/frontend/pages/hosts/details/cards/Activity/Activity.tsx
@@ -31,11 +31,12 @@ const UpcomingTooltip = () => {
     <TooltipWrapper
       tipContent={
         <>
-          Upcoming activities will run as listed. Failure of one activity
-          won&apos;t cancel other activities.
+          Currently, only scripts run before other scripts and
+          <br />
+          software is installed before other software.
           <br />
           <br />
-          Currently, only scripts are guaranteed to run in order.
+          Failure of one activity won&apos;t cancel other activities.
         </>
       }
       className={`${baseClass}__upcoming-tooltip`}
diff --git a/frontend/pages/hosts/details/cards/Activity/ActivityConfig.tsx b/frontend/pages/hosts/details/cards/Activity/ActivityConfig.tsx
index 24802d95a5..f877ceb63d 100644
--- a/frontend/pages/hosts/details/cards/Activity/ActivityConfig.tsx
+++ b/frontend/pages/hosts/details/cards/Activity/ActivityConfig.tsx
@@ -36,6 +36,7 @@ export const pastActivityComponentMap: Record<
   [ActivityType.LockedHost]: LockedHostActivityItem,
   [ActivityType.UnlockedHost]: UnlockedHostActivityItem,
   [ActivityType.InstalledSoftware]: InstalledSoftwareActivityItem,
+  [ActivityType.UninstalledSoftware]: InstalledSoftwareActivityItem,
   [ActivityType.InstalledAppStoreApp]: InstalledSoftwareActivityItem,
 };
 
@@ -46,5 +47,6 @@ export const upcomingActivityComponentMap: Record<
 > = {
   [ActivityType.RanScript]: RanScriptActivityItem,
   [ActivityType.InstalledSoftware]: InstalledSoftwareActivityItem,
+  [ActivityType.UninstalledSoftware]: InstalledSoftwareActivityItem,
   [ActivityType.InstalledAppStoreApp]: InstalledSoftwareActivityItem,
 };
diff --git a/frontend/pages/hosts/details/cards/Activity/ActivityItems/InstalledSoftwareActivityItem/InstalledSoftwareActivityItem.tsx b/frontend/pages/hosts/details/cards/Activity/ActivityItems/InstalledSoftwareActivityItem/InstalledSoftwareActivityItem.tsx
index 5d474d4d8b..c3c6384944 100644
--- a/frontend/pages/hosts/details/cards/Activity/ActivityItems/InstalledSoftwareActivityItem/InstalledSoftwareActivityItem.tsx
+++ b/frontend/pages/hosts/details/cards/Activity/ActivityItems/InstalledSoftwareActivityItem/InstalledSoftwareActivityItem.tsx
@@ -13,7 +13,9 @@ const InstalledSoftwareActivityItem = ({
   onShowDetails,
 }: IHostActivityItemComponentPropsWithShowDetails) => {
   const { actor_full_name: actorName, details } = activity;
-  const { self_service, status, software_title: title } = details;
+  const { self_service, software_title: title } = details;
+  const status =
+    details.status === "failed" ? "failed_uninstall" : details.status;
 
   const actorDisplayName = self_service ? (
     <span>An end user</span>
diff --git a/frontend/pages/hosts/details/cards/Activity/PastActivityFeed/PastActivityFeed.tsx b/frontend/pages/hosts/details/cards/Activity/PastActivityFeed/PastActivityFeed.tsx
index 5e58a50f4c..2321f9674d 100644
--- a/frontend/pages/hosts/details/cards/Activity/PastActivityFeed/PastActivityFeed.tsx
+++ b/frontend/pages/hosts/details/cards/Activity/PastActivityFeed/PastActivityFeed.tsx
@@ -44,7 +44,7 @@ const PastActivityFeed = ({
     return (
       <EmptyFeed
         title="No activity"
-        message="When a script runs on a host, it shows up here."
+        message="Completed actions will appear here (scripts, software, lock, and wipe)."
         className={`${baseClass}__empty-feed`}
       />
     );
diff --git a/frontend/pages/hosts/details/cards/Activity/UpcomingActivityFeed/UpcomingActivityFeed.tsx b/frontend/pages/hosts/details/cards/Activity/UpcomingActivityFeed/UpcomingActivityFeed.tsx
index c9c12696f2..ab4a3ba565 100644
--- a/frontend/pages/hosts/details/cards/Activity/UpcomingActivityFeed/UpcomingActivityFeed.tsx
+++ b/frontend/pages/hosts/details/cards/Activity/UpcomingActivityFeed/UpcomingActivityFeed.tsx
@@ -43,7 +43,7 @@ const UpcomingActivityFeed = ({
     return (
       <EmptyFeed
         title="No pending activity "
-        message="When you run a script on an offline host, it will appear here."
+        message="Pending actions will appear here (scripts, software, lock, and wipe)."
         className={`${baseClass}__empty-feed`}
       />
     );
diff --git a/frontend/pages/hosts/details/cards/Software/HostSoftware.tsx b/frontend/pages/hosts/details/cards/Software/HostSoftware.tsx
index 095bb46122..1853d0aeee 100644
--- a/frontend/pages/hosts/details/cards/Software/HostSoftware.tsx
+++ b/frontend/pages/hosts/details/cards/Software/HostSoftware.tsx
@@ -12,6 +12,7 @@ import deviceAPI, {
   IGetDeviceSoftwareResponse,
 } from "services/entities/device_user";
 import { IHostSoftware, ISoftware } from "interfaces/software";
+import { HostPlatform, isIPadOrIPhone } from "interfaces/platform";
 import { DEFAULT_USE_QUERY_OPTIONS } from "utilities/constants";
 import { NotificationContext } from "context/notification";
 import { AppContext } from "context/app";
@@ -23,7 +24,7 @@ import Spinner from "components/Spinner";
 import { generateSoftwareTableHeaders as generateHostSoftwareTableConfig } from "./HostSoftwareTableConfig";
 import { generateSoftwareTableHeaders as generateDeviceSoftwareTableConfig } from "./DeviceSoftwareTableConfig";
 import HostSoftwareTable from "./HostSoftwareTable";
-import { getErrorMessage } from "./helpers";
+import { getInstallErrorMessage, getUninstallErrorMessage } from "./helpers";
 
 const baseClass = "software-card";
 
@@ -34,14 +35,16 @@ export interface ITableSoftware extends Omit<ISoftware, "vulnerabilities"> {
 interface IHostSoftwareProps {
   /** This is the host id or the device token */
   id: number | string;
+  platform?: HostPlatform;
   softwareUpdatedAt?: string;
-  hostCanInstallSoftware: boolean;
+  hostCanWriteSoftware: boolean;
   router: InjectedRouter;
   queryParams: ReturnType<typeof parseHostSoftwareQueryParams>;
   pathname: string;
   hostTeamId: number;
   onShowSoftwareDetails?: (software: IHostSoftware) => void;
   isSoftwareEnabled?: boolean;
+  hostScriptsEnabled?: boolean;
   isMyDevicePage?: boolean;
 }
 
@@ -82,8 +85,10 @@ export const parseHostSoftwareQueryParams = (queryParams: {
 
 const HostSoftware = ({
   id,
+  platform,
   softwareUpdatedAt,
-  hostCanInstallSoftware,
+  hostCanWriteSoftware,
+  hostScriptsEnabled,
   router,
   queryParams,
   pathname,
@@ -93,6 +98,8 @@ const HostSoftware = ({
   isMyDevicePage = false,
 }: IHostSoftwareProps) => {
   const { renderFlash } = useContext(NotificationContext);
+  const vulnFilterAndNotSupported =
+    isIPadOrIPhone(platform ?? "") && queryParams.vulnerable;
   const {
     isGlobalAdmin,
     isGlobalMaintainer,
@@ -100,7 +107,8 @@ const HostSoftware = ({
     isTeamMaintainer,
   } = useContext(AppContext);
 
-  const [installingSoftwareId, setInstallingSoftwareId] = useState<
+  // disables install/uninstall actions after click
+  const [softwareIdActionPending, setSoftwareIdActionPending] = useState<
     number | null
   >(null);
 
@@ -129,7 +137,8 @@ const HostSoftware = ({
     },
     {
       ...DEFAULT_USE_QUERY_OPTIONS,
-      enabled: isSoftwareEnabled && !isMyDevicePage, // if disabled, we'll always show a generic "No software detected" message
+      enabled:
+        isSoftwareEnabled && !isMyDevicePage && !vulnFilterAndNotSupported,
       keepPreviousData: true,
       staleTime: 7000,
     }
@@ -158,7 +167,7 @@ const HostSoftware = ({
     ({ queryKey }) => deviceAPI.getDeviceSoftware(queryKey[0]),
     {
       ...DEFAULT_USE_QUERY_OPTIONS,
-      enabled: isSoftwareEnabled && isMyDevicePage, // if disabled, we'll always show a generic "No software detected" message
+      enabled: isSoftwareEnabled && isMyDevicePage, // if disabled, we'll always show a generic "No software detected" message. No DUP for iPad/iPhone
       keepPreviousData: true,
       staleTime: 7000,
     }
@@ -169,13 +178,13 @@ const HostSoftware = ({
     [isMyDevicePage, refetchDeviceSoftware, refetchHostSoftware]
   );
 
-  const userHasSWInstallPermission = Boolean(
+  const userHasSWWritePermission = Boolean(
     isGlobalAdmin || isGlobalMaintainer || isTeamAdmin || isTeamMaintainer
   );
 
   const installHostSoftwarePackage = useCallback(
     async (softwareId: number) => {
-      setInstallingSoftwareId(softwareId);
+      setSoftwareIdActionPending(softwareId);
       try {
         await hostAPI.installHostSoftwarePackage(id as number, softwareId);
         renderFlash(
@@ -183,9 +192,30 @@ const HostSoftware = ({
           "Software is installing or will install when the host comes online."
         );
       } catch (e) {
-        renderFlash("error", getErrorMessage(e));
+        renderFlash("error", getInstallErrorMessage(e));
       }
-      setInstallingSoftwareId(null);
+      setSoftwareIdActionPending(null);
+      refetchSoftware();
+    },
+    [id, renderFlash, refetchSoftware]
+  );
+
+  const uninstallHostSoftwarePackage = useCallback(
+    async (softwareId: number) => {
+      setSoftwareIdActionPending(softwareId);
+      try {
+        await hostAPI.uninstallHostSoftwarePackage(id as number, softwareId);
+        renderFlash(
+          "success",
+          <>
+            Software is uninstalling or will uninstall when the host comes
+            online. To see details, go to <b>Details &gt; Activity</b>.
+          </>
+        );
+      } catch (e) {
+        renderFlash("error", getUninstallErrorMessage(e));
+      }
+      setSoftwareIdActionPending(null);
       refetchSoftware();
     },
     [id, renderFlash, refetchSoftware]
@@ -197,6 +227,9 @@ const HostSoftware = ({
         case "install":
           installHostSoftwarePackage(software.id);
           break;
+        case "uninstall":
+          uninstallHostSoftwarePackage(software.id);
+          break;
         case "showDetails":
           onShowSoftwareDetails?.(software);
           break;
@@ -204,7 +237,11 @@ const HostSoftware = ({
           break;
       }
     },
-    [installHostSoftwarePackage, onShowSoftwareDetails]
+    [
+      installHostSoftwarePackage,
+      onShowSoftwareDetails,
+      uninstallHostSoftwarePackage,
+    ]
   );
 
   const tableConfig = useMemo(() => {
@@ -212,20 +249,22 @@ const HostSoftware = ({
       ? generateDeviceSoftwareTableConfig()
       : generateHostSoftwareTableConfig({
           router,
-          installingSoftwareId,
-          userHasSWInstallPermission,
+          softwareIdActionPending,
+          userHasSWWritePermission,
+          hostScriptsEnabled,
           onSelectAction,
           teamId: hostTeamId,
-          hostCanInstallSoftware,
+          hostCanWriteSoftware,
         });
   }, [
     isMyDevicePage,
     router,
-    installingSoftwareId,
-    userHasSWInstallPermission,
+    softwareIdActionPending,
+    userHasSWWritePermission,
+    hostScriptsEnabled,
     onSelectAction,
     hostTeamId,
-    hostCanInstallSoftware,
+    hostCanWriteSoftware,
   ]);
 
   const isLoading = isMyDevicePage
@@ -251,7 +290,10 @@ const HostSoftware = ({
     if (isLoading) {
       return <Spinner />;
     }
-
+    // will never be the case - to handle `platform` typing discrepancy with DeviceUserPage
+    if (!platform) {
+      return null;
+    }
     return (
       <>
         {isError && <DataError />}
@@ -260,7 +302,20 @@ const HostSoftware = ({
             isLoading={
               isMyDevicePage ? deviceSoftwareFetching : hostSoftwareFetching
             }
-            data={data}
+            // this could be cleaner, however, we are going to revert this commit anyway once vulns are
+            // supported for iPad/iPhone, by the end of next sprint
+            data={
+              vulnFilterAndNotSupported
+                ? ({
+                    count: 0,
+                    meta: {
+                      has_next_results: false,
+                      has_previous_results: false,
+                    },
+                  } as IGetHostSoftwareResponse)
+                : data
+            } // eshould be mpty for iPad/iPhone since API call is disabled, but to be sure to trigger empty state
+            platform={platform}
             router={router}
             tableConfig={tableConfig}
             sortHeader={queryParams.order_key}
diff --git a/frontend/pages/hosts/details/cards/Software/HostSoftwareTable/HostSoftwareTable.tsx b/frontend/pages/hosts/details/cards/Software/HostSoftwareTable/HostSoftwareTable.tsx
index 6ac5f7a4a9..be7a476d78 100644
--- a/frontend/pages/hosts/details/cards/Software/HostSoftwareTable/HostSoftwareTable.tsx
+++ b/frontend/pages/hosts/details/cards/Software/HostSoftwareTable/HostSoftwareTable.tsx
@@ -6,7 +6,14 @@ import { IGetDeviceSoftwareResponse } from "services/entities/device_user";
 import { getNextLocationPath } from "utilities/helpers";
 import { QueryParams } from "utilities/url";
 
-import { ISoftwareDropdownFilterVal } from "pages/SoftwarePage/SoftwareTitles/SoftwareTable/helpers";
+import { IHostSoftwareDropdownFilterVal } from "pages/SoftwarePage/SoftwareTitles/SoftwareTable/helpers";
+
+import {
+  ApplePlatform,
+  APPLE_PLATFORM_DISPLAY_NAMES,
+  HostPlatform,
+  isIPadOrIPhone,
+} from "interfaces/platform";
 
 import TableContainer from "components/TableContainer";
 import { ITableQueryData } from "components/TableContainer/TableContainer";
@@ -15,6 +22,7 @@ import Dropdown from "components/forms/fields/Dropdown";
 
 import EmptySoftwareTable from "pages/SoftwarePage/components/EmptySoftwareTable";
 import TableCount from "components/TableContainer/TableCount";
+import { VulnsNotSupported } from "pages/SoftwarePage/components/SoftwareVulnerabilitiesTable/SoftwareVulnerabilitiesTable";
 
 const DEFAULT_PAGE_SIZE = 20;
 
@@ -45,6 +53,7 @@ export const DROPDOWN_OPTIONS = [
 interface IHostSoftwareTableProps {
   tableConfig: any; // TODO: type
   data?: IGetHostSoftwareResponse | IGetDeviceSoftwareResponse;
+  platform: HostPlatform;
   isLoading: boolean;
   router: InjectedRouter;
   sortHeader: string;
@@ -54,12 +63,13 @@ interface IHostSoftwareTableProps {
   pagePath: string;
   routeTemplate?: string;
   pathPrefix: string;
-  hostSoftwareFilter: ISoftwareDropdownFilterVal;
+  hostSoftwareFilter: IHostSoftwareDropdownFilterVal;
 }
 
 const HostSoftwareTable = ({
   tableConfig,
   data,
+  platform,
   isLoading,
   router,
   sortHeader,
@@ -72,7 +82,7 @@ const HostSoftwareTable = ({
   hostSoftwareFilter,
 }: IHostSoftwareTableProps) => {
   const handleFilterDropdownChange = useCallback(
-    (val: ISoftwareDropdownFilterVal) => {
+    (val: IHostSoftwareDropdownFilterVal) => {
       const newParams: QueryParams = {
         query: searchQuery,
         order_key: sortHeader,
@@ -104,7 +114,7 @@ const HostSoftwareTable = ({
         options={DROPDOWN_OPTIONS}
         searchable={false}
         onChange={handleFilterDropdownChange}
-        tableFilterDropdown
+        iconName="filter"
       />
     );
   }, [handleFilterDropdownChange, hostSoftwareFilter]);
@@ -167,7 +177,7 @@ const HostSoftwareTable = ({
     [determineQueryParamChange, pagePath, generateNewQueryParams, router]
   );
 
-  const count = data?.count || data?.software.length || 0;
+  const count = data?.count || data?.software?.length || 0;
   const isSoftwareNotDetected = count === 0 && searchQuery === "";
 
   const memoizedSoftwareCount = useCallback(() => {
@@ -179,8 +189,16 @@ const HostSoftwareTable = ({
   }, [count, isSoftwareNotDetected]);
 
   const memoizedEmptyComponent = useCallback(() => {
-    return <EmptySoftwareTable isNotDetectingSoftware={searchQuery === ""} />;
-  }, [searchQuery]);
+    const vulnFilterAndNotSupported =
+      isIPadOrIPhone(platform) && hostSoftwareFilter === "vulnerableSoftware";
+    return vulnFilterAndNotSupported ? (
+      <VulnsNotSupported
+        platformText={APPLE_PLATFORM_DISPLAY_NAMES[platform as ApplePlatform]}
+      />
+    ) : (
+      <EmptySoftwareTable noSearchQuery={searchQuery === ""} />
+    );
+  }, [hostSoftwareFilter, platform, searchQuery]);
 
   return (
     <div className={baseClass}>
diff --git a/frontend/pages/hosts/details/cards/Software/HostSoftwareTableConfig.tests.tsx b/frontend/pages/hosts/details/cards/Software/HostSoftwareTableConfig.tests.tsx
new file mode 100644
index 0000000000..aa14172c86
--- /dev/null
+++ b/frontend/pages/hosts/details/cards/Software/HostSoftwareTableConfig.tests.tsx
@@ -0,0 +1,83 @@
+import {
+  generateActions,
+  DEFAULT_ACTION_OPTIONS,
+  generateActionsProps,
+} from "./HostSoftwareTableConfig";
+
+describe("generateActions", () => {
+  const defaultProps: generateActionsProps = {
+    userHasSWWritePermission: true,
+    hostScriptsEnabled: true,
+    hostCanWriteSoftware: true,
+    softwareIdActionPending: null,
+    softwareId: 1,
+    status: null,
+    software_package: null,
+    app_store_app: null,
+  };
+
+  it("returns default actions when user has write permission and scripts are enabled", () => {
+    const actions = generateActions(defaultProps);
+    expect(actions).toEqual(DEFAULT_ACTION_OPTIONS);
+  });
+
+  it("removes install and uninstall actions when user has no write permission", () => {
+    const props = { ...defaultProps, userHasSWWritePermission: false };
+    const actions = generateActions(props);
+    expect(actions.find((a) => a.value === "install")).toBeUndefined();
+    expect(actions.find((a) => a.value === "uninstall")).toBeUndefined();
+  });
+
+  it("disables install and uninstall actions when host scripts are disabled", () => {
+    const props = { ...defaultProps, hostScriptsEnabled: false };
+    const actions = generateActions(props);
+    expect(actions.find((a) => a.value === "install")?.disabled).toBe(true);
+    expect(actions.find((a) => a.value === "uninstall")?.disabled).toBe(true);
+  });
+
+  it("disables install and uninstall actions when locally pending (waiting for API response)", () => {
+    const props = {
+      ...defaultProps,
+      softwareIdActionPending: 1,
+      softwareId: 1,
+    };
+    const actions = generateActions(props);
+    expect(actions.find((a) => a.value === "install")?.disabled).toBe(true);
+    expect(actions.find((a) => a.value === "uninstall")?.disabled).toBe(true);
+  });
+
+  it("disables install and uninstall actions when pending install status", () => {
+    const props: generateActionsProps = {
+      ...defaultProps,
+      status: "pending_install",
+    };
+    const actions = generateActions(props);
+    expect(actions.find((a) => a.value === "install")?.disabled).toBe(true);
+    expect(actions.find((a) => a.value === "uninstall")?.disabled).toBe(true);
+  });
+
+  it("disables install and uninstall actions when pending uninstall status", () => {
+    const props: generateActionsProps = {
+      ...defaultProps,
+      status: "pending_uninstall",
+    };
+    const actions = generateActions(props);
+    expect(actions.find((a) => a.value === "install")?.disabled).toBe(true);
+    expect(actions.find((a) => a.value === "uninstall")?.disabled).toBe(true);
+  });
+
+  it("removes uninstall action for VPP apps", () => {
+    const props: generateActionsProps = {
+      ...defaultProps,
+      app_store_app: {
+        app_store_id: "1",
+        self_service: false,
+        icon_url: "",
+        version: "",
+        last_install: { command_uuid: "", installed_at: "" },
+      },
+    };
+    const actions = generateActions(props);
+    expect(actions.find((a) => a.value === "uninstall")).toBeUndefined();
+  });
+});
diff --git a/frontend/pages/hosts/details/cards/Software/HostSoftwareTableConfig.tsx b/frontend/pages/hosts/details/cards/Software/HostSoftwareTableConfig.tsx
index 66777b1ed3..53256f50bf 100644
--- a/frontend/pages/hosts/details/cards/Software/HostSoftwareTableConfig.tsx
+++ b/frontend/pages/hosts/details/cards/Software/HostSoftwareTableConfig.tsx
@@ -9,6 +9,7 @@ import {
   IHostSoftwarePackage,
   SoftwareInstallStatus,
   formatSoftwareType,
+  isIpadOrIphoneSoftwareSource,
 } from "interfaces/software";
 import {
   IHeaderProps,
@@ -28,10 +29,12 @@ import VersionCell from "pages/SoftwarePage/components/VersionCell";
 import { getVulnerabilities } from "pages/SoftwarePage/SoftwareTitles/SoftwareTable/SoftwareTitlesTableConfig";
 
 import InstallStatusCell from "./InstallStatusCell";
+import { getDropdownOptionTooltipContent } from "../../HostDetailsPage/HostActionsDropdown/helpers";
 
-const DEFAULT_ACTION_OPTIONS: IDropdownOption[] = [
+export const DEFAULT_ACTION_OPTIONS: IDropdownOption[] = [
   { value: "showDetails", label: "Show details", disabled: false },
   { value: "install", label: "Install", disabled: false },
+  { value: "uninstall", label: "Uninstall", disabled: false },
 ];
 
 type ISoftwareTableConfig = Column<IHostSoftware>;
@@ -47,25 +50,26 @@ type IInstalledVersionsCellProps = CellProps<
   IHostSoftware["installed_versions"]
 >;
 type IVulnerabilitiesCellProps = IInstalledVersionsCellProps;
-// type IActionsCellProps = CellProps<IHostSoftware, IHostSoftware["id"]>;
 
-const generateActions = ({
-  userHasSWInstallPermission,
-  hostCanInstallSoftware,
-  installingSoftwareId,
-  softwareId,
-  status,
-  software_package,
-  app_store_app,
-}: {
-  userHasSWInstallPermission: boolean;
-  hostCanInstallSoftware: boolean;
-  installingSoftwareId: number | null;
+export interface generateActionsProps {
+  userHasSWWritePermission: boolean;
+  hostScriptsEnabled: boolean;
+  hostCanWriteSoftware: boolean;
+  softwareIdActionPending: number | null;
   softwareId: number;
   status: SoftwareInstallStatus | null;
   software_package: IHostSoftwarePackage | null;
   app_store_app: IHostAppStoreApp | null;
-}) => {
+}
+
+export const generateActions = ({
+  userHasSWWritePermission,
+  hostScriptsEnabled,
+  softwareIdActionPending,
+  softwareId,
+  status,
+  app_store_app,
+}: generateActionsProps) => {
   // this gives us a clean slate of the default actions so we can modify
   // the options.
   const actions = cloneDeep(DEFAULT_ACTION_OPTIONS);
@@ -76,39 +80,59 @@ const generateActions = ({
     // error to fail loudly so that we know to update this function
     throw new Error("Install action not found in default actions");
   }
+  const indexUninstallAction = actions.findIndex(
+    (a) => a.value === "uninstall"
+  );
+  if (indexUninstallAction === -1) {
+    // this should never happen unless the default actions change, but if it does we'll throw an
+    // error to fail loudly so that we know to update this function
+    throw new Error("Uninstall action not found in default actions");
+  }
 
-  const hasSoftwareToInstall = !!software_package || !!app_store_app;
-  // remove install if there is no package to install or if the software is already installed
-  if (
-    !hasSoftwareToInstall ||
-    !userHasSWInstallPermission ||
-    status === "installed"
-  ) {
+  if (!userHasSWWritePermission) {
+    // Reverse order to not change index of subsequent array element before removal
+    actions.splice(indexUninstallAction, 1);
     actions.splice(indexInstallAction, 1);
-    return actions;
+  } else {
+    // if host's scripts are disabled, disable install/uninstall with tooltip
+    if (!hostScriptsEnabled) {
+      actions[indexInstallAction].disabled = true;
+      actions[indexUninstallAction].disabled = true;
+
+      actions[
+        indexInstallAction
+      ].tooltipContent = getDropdownOptionTooltipContent("installSoftware");
+      actions[
+        indexUninstallAction
+      ].tooltipContent = getDropdownOptionTooltipContent("uninstallSoftware");
+    }
+
+    // user has software write permission for host
+    const pendingStatuses = ["pending_install", "pending_uninstall"];
+
+    // if locally pending (waiting for API response) or pending install/uninstall,
+    // disable both install and uninstall
+    if (
+      softwareId === softwareIdActionPending ||
+      pendingStatuses.includes(status || "")
+    ) {
+      actions[indexInstallAction].disabled = true;
+      actions[indexUninstallAction].disabled = true;
+    }
   }
 
-  // disable install option if not a fleetd, iPad, or iOS host
-  if (!hostCanInstallSoftware) {
-    actions[indexInstallAction].disabled = true;
-    actions[indexInstallAction].tooltipContent =
-      "To install software on this host, deploy the fleetd agent with --enable-scripts and refetch host vitals.";
-    return actions;
+  if (app_store_app) {
+    // remove uninstall for VPP apps
+    actions.splice(indexUninstallAction, 1);
   }
-
-  // disable install option if software is already installing
-  if (softwareId === installingSoftwareId || status === "pending") {
-    actions[indexInstallAction].disabled = true;
-    return actions;
-  }
-
   return actions;
 };
 
 interface ISoftwareTableHeadersProps {
-  userHasSWInstallPermission: boolean;
-  hostCanInstallSoftware: boolean;
-  installingSoftwareId: number | null;
+  userHasSWWritePermission: boolean;
+  hostScriptsEnabled?: boolean;
+  hostCanWriteSoftware: boolean;
+  softwareIdActionPending: number | null;
   router: InjectedRouter;
   teamId: number;
   onSelectAction: (software: IHostSoftware, action: string) => void;
@@ -117,9 +141,10 @@ interface ISoftwareTableHeadersProps {
 // NOTE: cellProps come from react-table
 // more info here https://react-table.tanstack.com/docs/api/useTable#cell-properties
 export const generateSoftwareTableHeaders = ({
-  userHasSWInstallPermission,
-  hostCanInstallSoftware,
-  installingSoftwareId,
+  userHasSWWritePermission,
+  hostScriptsEnabled = false,
+  hostCanWriteSoftware,
+  softwareIdActionPending,
   router,
   teamId,
   onSelectAction,
@@ -184,6 +209,9 @@ export const generateSoftwareTableHeaders = ({
       accessor: (originalRow) => originalRow.installed_versions,
       disableSortBy: true,
       Cell: (cellProps: IVulnerabilitiesCellProps) => {
+        if (isIpadOrIphoneSoftwareSource(cellProps.row.original.source)) {
+          return <TextCell value="Not supported" grey />;
+        }
         const vulnerabilities = getVulnerabilities(cellProps.cell.value ?? []);
         return <VulnerabilitiesCell vulnerabilities={vulnerabilities} />;
       },
@@ -206,9 +234,10 @@ export const generateSoftwareTableHeaders = ({
           <DropdownCell
             placeholder="Actions"
             options={generateActions({
-              userHasSWInstallPermission,
-              hostCanInstallSoftware,
-              installingSoftwareId,
+              userHasSWWritePermission,
+              hostScriptsEnabled,
+              hostCanWriteSoftware,
+              softwareIdActionPending,
               softwareId,
               status,
               software_package,
diff --git a/frontend/pages/hosts/details/cards/Software/InstallStatusCell/InstallStatusCell.tsx b/frontend/pages/hosts/details/cards/Software/InstallStatusCell/InstallStatusCell.tsx
index 38a3a42df3..bd7982a066 100644
--- a/frontend/pages/hosts/details/cards/Software/InstallStatusCell/InstallStatusCell.tsx
+++ b/frontend/pages/hosts/details/cards/Software/InstallStatusCell/InstallStatusCell.tsx
@@ -4,7 +4,6 @@ import ReactTooltip from "react-tooltip";
 import { uniqueId } from "lodash";
 
 import { IHostSoftware, SoftwareInstallStatus } from "interfaces/software";
-import { dateAgo } from "utilities/date_format";
 
 import Icon from "components/Icon";
 import TextCell from "components/TableContainer/DataTable/TextCell";
@@ -14,6 +13,7 @@ const baseClass = "install-status-cell";
 type IStatusValue = SoftwareInstallStatus | "avaiableForInstall";
 interface TootipArgs {
   softwareName?: string | null;
+  // this field is used in My device > Self-service
   lastInstalledAt?: string;
   isAppStoreApp?: boolean;
 }
@@ -30,31 +30,51 @@ export type IStatusDisplayConfig = {
 };
 
 export const INSTALL_STATUS_DISPLAY_OPTIONS: Record<
-  IStatusValue | "selfService",
+  Exclude<IStatusValue, "uninstalled"> | "selfService",
   IStatusDisplayConfig
 > = {
   installed: {
     iconName: "success",
     displayText: "Installed",
-    tooltip: ({ lastInstalledAt: lastInstall }) => (
+    tooltip: () =>
+      "Software is installed (install script finished with exit code 0).",
+  },
+  pending_install: {
+    iconName: "pending-outline",
+    displayText: "Installing (pending)",
+    tooltip: () =>
+      "Fleet is installing or will install when the host comes online.",
+  },
+  pending_uninstall: {
+    iconName: "pending-outline",
+    displayText: "Uninstalling (pending)",
+    tooltip: () => (
       <>
-        Fleet installed software on these hosts. (
-        {dateAgo(lastInstall as string)})
+        Fleet is uninstalling or will uninstall
+        <br />
+        software when the host comes online.
       </>
     ),
   },
-  pending: {
-    iconName: "pending-outline",
-    displayText: "Pending",
-    tooltip: () => "Fleet will install software when the host comes online.",
-  },
-  failed: {
+  failed_install: {
     iconName: "error",
-    displayText: "Failed",
-    tooltip: ({ lastInstalledAt: lastInstall }) => (
+    displayText: "Install (failed)",
+    tooltip: () => (
       <>
-        Fleet failed to install software ({dateAgo(lastInstall as string)} ago).
-        Select <b>Actions &gt; Software details</b> to see more.
+        The host failed to install software.
+        <br />
+        Select <b>Actions &gt; Show details</b> view errors.
+      </>
+    ),
+  },
+  failed_uninstall: {
+    iconName: "error",
+    displayText: "Uninstall (failed)",
+    tooltip: () => (
+      <>
+        The host failed to uninstall software.
+        <br />
+        Select <b>Details &gt; Activity</b> to view errors.
       </>
     ),
   },
@@ -95,10 +115,6 @@ const InstallStatusCell = ({
   app_store_app,
 }: IInstallStatusCellProps) => {
   // FIXME: Improve the way we handle polymophism of software_package and app_store_app
-  const lastInstalledAt =
-    software_package?.last_install?.installed_at ||
-    app_store_app?.last_install?.installed_at ||
-    "";
   const hasPackage = !!software_package;
   const hasAppStoreApp = !!app_store_app;
 
@@ -139,7 +155,6 @@ const InstallStatusCell = ({
         <span className={`${baseClass}__status-tooltip-text`}>
           {displayConfig.tooltip({
             softwareName,
-            lastInstalledAt,
             isAppStoreApp: hasAppStoreApp,
           })}
         </span>
diff --git a/frontend/pages/hosts/details/cards/Software/SelfService/SelfService.tests.tsx b/frontend/pages/hosts/details/cards/Software/SelfService/SelfService.tests.tsx
index 2c995aa2b2..2b96a578c3 100644
--- a/frontend/pages/hosts/details/cards/Software/SelfService/SelfService.tests.tsx
+++ b/frontend/pages/hosts/details/cards/Software/SelfService/SelfService.tests.tsx
@@ -112,13 +112,13 @@ describe("SelfService", () => {
     ).toHaveTextContent("Reinstall");
   });
 
-  it("renders 'Retry' action button with 'Failed' status", async () => {
+  it("renders 'Retry' action button with 'failed_install' status", async () => {
     mockServer.use(
       customDeviceSoftwareHandler({
         software: [
           createMockDeviceSoftware({
             name: "test-software",
-            status: "failed",
+            status: "failed_install",
           }),
         ],
       })
@@ -166,13 +166,13 @@ describe("SelfService", () => {
     ).toHaveTextContent("Install");
   });
 
-  it("renders no action button with 'Install in progress...' status", async () => {
+  it("renders no action button with 'pending_install' status", async () => {
     mockServer.use(
       customDeviceSoftwareHandler({
         software: [
           createMockDeviceSoftware({
             name: "test-software",
-            status: "pending",
+            status: "pending_install",
           }),
         ],
       })
@@ -186,7 +186,7 @@ describe("SelfService", () => {
 
     expect(
       screen.getByTestId("self-service-item__status--test")
-    ).toHaveTextContent("Install in progress...");
+    ).toHaveTextContent("Pending");
 
     expect(
       screen.queryByTestId("self-service-item__item-action-button--test")
diff --git a/frontend/pages/hosts/details/cards/Software/SelfService/SelfService.tsx b/frontend/pages/hosts/details/cards/Software/SelfService/SelfService.tsx
index 190fd11092..2a772a8e75 100644
--- a/frontend/pages/hosts/details/cards/Software/SelfService/SelfService.tsx
+++ b/frontend/pages/hosts/details/cards/Software/SelfService/SelfService.tsx
@@ -122,9 +122,12 @@ const SoftwareSelfService = ({
                   </div>
                   <div className={`${baseClass}__items`}>
                     {data.software.map((s) => {
-                      // TODO: update this if/when we support self-service app store apps
-                      const uuid =
-                        s.software_package?.last_install?.install_uuid || "";
+                      let uuid =
+                        s.software_package?.last_install?.install_uuid ??
+                        s.app_store_app?.last_install?.command_uuid;
+                      if (!uuid) {
+                        uuid = "";
+                      }
                       // concatenating uuid so item updates with fresh data on refetch
                       const key = `${s.id}${uuid}`;
                       return (
diff --git a/frontend/pages/hosts/details/cards/Software/SelfService/SelfServiceItem/SelfServiceItem.tsx b/frontend/pages/hosts/details/cards/Software/SelfService/SelfServiceItem/SelfServiceItem.tsx
index 9c4146da4d..f2907e693f 100644
--- a/frontend/pages/hosts/details/cards/Software/SelfService/SelfServiceItem/SelfServiceItem.tsx
+++ b/frontend/pages/hosts/details/cards/Software/SelfService/SelfServiceItem/SelfServiceItem.tsx
@@ -2,6 +2,7 @@ import React, { useCallback, useContext, useEffect, useRef } from "react";
 import ReactTooltip from "react-tooltip";
 
 import {
+  IAppLastInstall,
   IDeviceSoftware,
   IHostSoftware,
   ISoftwareLastInstall,
@@ -20,28 +21,31 @@ import { IStatusDisplayConfig } from "../../InstallStatusCell/InstallStatusCell"
 
 const baseClass = "self-service-item";
 
-const STATUS_CONFIG: Record<SoftwareInstallStatus, IStatusDisplayConfig> = {
+const STATUS_CONFIG: Record<
+  Exclude<
+    SoftwareInstallStatus,
+    "pending_uninstall" | "failed_uninstall" | "uninstalled"
+  >,
+  IStatusDisplayConfig
+> = {
   installed: {
     iconName: "success",
     displayText: "Installed",
-    tooltip: ({ lastInstalledAt }) => (
-      <>
-        Software installed successfully ({dateAgo(lastInstalledAt as string)}).
-      </>
-    ),
+    tooltip: ({ lastInstalledAt }) =>
+      `Software is installed (${dateAgo(lastInstalledAt as string)}).`,
   },
-  pending: {
+  pending_install: {
     iconName: "pending-outline",
-    displayText: "Install in progress...",
-    tooltip: () => "Software installation in progress...",
+    displayText: "Pending",
+    tooltip: () => "Fleet is installing software.",
   },
-  failed: {
+  failed_install: {
     iconName: "error",
     displayText: "Failed",
     tooltip: ({ lastInstalledAt = "" }) => (
       <>
         Software failed to install
-        {lastInstalledAt ? `(${dateAgo(lastInstalledAt)})` : ""}. Select{" "}
+        {lastInstalledAt ? ` (${dateAgo(lastInstalledAt)})` : ""}. Select{" "}
         <b>Retry</b> to install again, or contact your IT department.
       </>
     ),
@@ -53,18 +57,28 @@ interface IInstallerInfoProps {
 }
 
 const InstallerInfo = ({ software }: IInstallerInfoProps) => {
-  const { name, source, software_package: installerPackage } = software;
+  const {
+    name,
+    source,
+    software_package: installerPackage,
+    app_store_app: vppApp,
+  } = software;
   return (
     <div className={`${baseClass}__item-topline`}>
       <div className={`${baseClass}__item-icon`}>
-        <SoftwareIcon name={name} source={source} size="large" />
+        <SoftwareIcon
+          url={vppApp?.icon_url}
+          name={name}
+          source={source}
+          size="large"
+        />
       </div>
       <div className={`${baseClass}__item-name-version`}>
         <div className={`${baseClass}__item-name`}>
           {name || installerPackage?.name}
         </div>
         <div className={`${baseClass}__item-version`}>
-          {installerPackage?.version || ""}
+          {installerPackage?.version || vppApp?.version || ""}
         </div>
       </div>
     </div>
@@ -73,7 +87,7 @@ const InstallerInfo = ({ software }: IInstallerInfoProps) => {
 
 // TODO: update if/when we support self-service app store apps
 type IInstallerStatusProps = Pick<IHostSoftware, "id" | "status"> & {
-  last_install: ISoftwareLastInstall | null;
+  last_install: ISoftwareLastInstall | IAppLastInstall | null;
 };
 
 const InstallerStatus = ({
@@ -126,39 +140,36 @@ const getInstallButtonText = (status: SoftwareInstallStatus | null) => {
   switch (status) {
     case null:
       return "Install";
-    case "failed":
+    case "failed_install":
       return "Retry";
     case "installed":
       return "Reinstall";
     default:
-      // we don't show a button for pending installs
       return "";
   }
 };
 
 const InstallerStatusAction = ({
   deviceToken,
-  software: { id, status, software_package },
+  software: { id, status, software_package, app_store_app },
   onInstall,
 }: IInstallerStatusActionProps) => {
   const { renderFlash } = useContext(NotificationContext);
 
   // TODO: update this if/when we support self-service app store apps
-  const last_install = software_package?.last_install || null;
+  const last_install =
+    software_package?.last_install ?? app_store_app?.last_install ?? null;
 
   // localStatus is used to track the status of the any user-initiated install action
   const [localStatus, setLocalStatus] = React.useState<
     SoftwareInstallStatus | undefined
   >(undefined);
 
-  // displayStatus allows us to display the localStatus (if any) or the status from the list
-  // software reponse
-  const displayStatus = localStatus || status;
-  const installButtonText = getInstallButtonText(displayStatus);
+  const installButtonText = getInstallButtonText(status);
 
   // if the localStatus is "failed", we don't want our tooltip to include the old installed_at date so we
   // set this to null, which tells the tooltip to omit the parenthetical date
-  const lastInstall = localStatus === "failed" ? null : last_install;
+  const lastInstall = localStatus === "failed_install" ? null : last_install;
 
   const isMountedRef = useRef(false);
   useEffect(() => {
@@ -169,7 +180,7 @@ const InstallerStatusAction = ({
   }, []);
 
   const onClick = useCallback(async () => {
-    setLocalStatus("pending");
+    setLocalStatus("pending_install");
     try {
       await deviceApi.installSelfServiceSoftware(deviceToken, id);
       if (isMountedRef.current) {
@@ -178,7 +189,7 @@ const InstallerStatusAction = ({
     } catch (error) {
       renderFlash("error", "Couldn't install. Please try again.");
       if (isMountedRef.current) {
-        setLocalStatus("failed");
+        setLocalStatus("failed_install");
       }
     }
   }, [deviceToken, id, onInstall, renderFlash]);
@@ -186,21 +197,16 @@ const InstallerStatusAction = ({
   return (
     <div className={`${baseClass}__item-status-action`}>
       <div className={`${baseClass}__item-status`}>
-        <InstallerStatus
-          id={id}
-          status={displayStatus}
-          last_install={lastInstall}
-        />
+        <InstallerStatus id={id} status={status} last_install={lastInstall} />
       </div>
       <div className={`${baseClass}__item-action`}>
         {!!installButtonText && (
           <Button
             variant="text-icon"
             type="button"
-            className={`${baseClass}__item-action-button${
-              localStatus === "pending" ? "--installing" : ""
-            }`}
+            className={`${baseClass}__item-action-button`}
             onClick={onClick}
+            disabled={localStatus === "pending_install"}
           >
             <span data-testid={`${baseClass}__item-action-button--test`}>
               {installButtonText}
diff --git a/frontend/pages/hosts/details/cards/Software/SelfService/SelfServiceItem/_styles.scss b/frontend/pages/hosts/details/cards/Software/SelfService/SelfServiceItem/_styles.scss
index 027b9c4fd6..eb21c7d118 100644
--- a/frontend/pages/hosts/details/cards/Software/SelfService/SelfServiceItem/_styles.scss
+++ b/frontend/pages/hosts/details/cards/Software/SelfService/SelfServiceItem/_styles.scss
@@ -87,9 +87,5 @@
 
   &__item-action-button {
     height: auto;
-
-    &--installing {
-      display: none;
-    }
   }
 }
diff --git a/frontend/pages/hosts/details/cards/Software/helpers.tsx b/frontend/pages/hosts/details/cards/Software/helpers.tsx
index 2020a14870..2c12ca9e10 100644
--- a/frontend/pages/hosts/details/cards/Software/helpers.tsx
+++ b/frontend/pages/hosts/details/cards/Software/helpers.tsx
@@ -3,7 +3,10 @@ import { getErrorReason } from "interfaces/errors";
 import { trimEnd, upperFirst } from "lodash";
 
 const INSTALL_SOFTWARE_ERROR_PREFIX = "Couldn't install.";
-const DEFAULT_ERROR_MESSAGE = `${INSTALL_SOFTWARE_ERROR_PREFIX} Please try again.`;
+const DEFAULT_INSTALL_ERROR_MESSAGE = `${INSTALL_SOFTWARE_ERROR_PREFIX} Please try again.`;
+
+const UNINSTALL_SOFTWARE_ERROR_PREFIX = "Couldn't uninstall.";
+const DEFAULT_UNINSTALL_ERROR_MESSAGE = `${UNINSTALL_SOFTWARE_ERROR_PREFIX} Please try again.`;
 
 const createOnlyInstallableOnMacOSMessage = (reason: string) =>
   `Couldn't install. ${reason.replace("darwin", "macOS")}.`;
@@ -28,7 +31,7 @@ const showAPIMessage = (message: string) => {
 };
 
 // eslint-disable-next-line import/prefer-default-export
-export const getErrorMessage = (e: unknown) => {
+export const getInstallErrorMessage = (e: unknown) => {
   const reason = upperFirst(trimEnd(getErrorReason(e), "."));
 
   if (reason.includes("fleetd installed")) {
@@ -41,5 +44,28 @@ export const getErrorMessage = (e: unknown) => {
     return reason;
   }
 
-  return DEFAULT_ERROR_MESSAGE;
+  return DEFAULT_INSTALL_ERROR_MESSAGE;
+};
+
+// eslint-disable-next-line import/prefer-default-export
+export const getUninstallErrorMessage = (e: unknown) => {
+  const reason = upperFirst(trimEnd(getErrorReason(e), "."));
+
+  if (
+    reason.includes("run script") ||
+    reason.includes("running script") ||
+    reason.includes("have fleetd") ||
+    reason.includes("only on")
+  ) {
+    return `${UNINSTALL_SOFTWARE_ERROR_PREFIX} ${reason}.`;
+  } else if (reason.startsWith("Couldn't uninstall software.")) {
+    return reason.replace(
+      "Couldn't uninstall software.",
+      "Couldn't uninstall."
+    );
+  } else if (reason.startsWith("No uninstall script exists")) {
+    return `${UNINSTALL_SOFTWARE_ERROR_PREFIX}. An uninstall script does not exist for this package.`;
+  }
+
+  return DEFAULT_UNINSTALL_ERROR_MESSAGE;
 };
diff --git a/frontend/pages/policies/ManagePoliciesPage/ManagePoliciesPage.tsx b/frontend/pages/policies/ManagePoliciesPage/ManagePoliciesPage.tsx
index ff587f290a..559ab2cd08 100644
--- a/frontend/pages/policies/ManagePoliciesPage/ManagePoliciesPage.tsx
+++ b/frontend/pages/policies/ManagePoliciesPage/ManagePoliciesPage.tsx
@@ -1,3 +1,4 @@
+// TODO: make 'queryParams', 'router', and 'tableQueryData' dependencies stable (aka, memoized)
 import React, { useCallback, useContext, useEffect, useState } from "react";
 import { useQuery } from "react-query";
 import { InjectedRouter } from "react-router/lib/Router";
@@ -20,7 +21,7 @@ import {
   IPoliciesCountResponse,
   IPolicy,
 } from "interfaces/policy";
-import { ITeamConfig } from "interfaces/team";
+import { API_ALL_TEAMS_ID, ITeamConfig } from "interfaces/team";
 
 import configAPI from "services/entities/config";
 import globalPoliciesAPI, {
@@ -49,6 +50,8 @@ import AddPolicyModal from "./components/AddPolicyModal";
 import DeletePolicyModal from "./components/DeletePolicyModal";
 import CalendarEventsModal from "./components/CalendarEventsModal";
 import { ICalendarEventsFormData } from "./components/CalendarEventsModal/CalendarEventsModal";
+import InstallSoftwareModal from "./components/InstallSoftwareModal";
+import { IInstallSoftwareFormData } from "./components/InstallSoftwareModal/InstallSoftwareModal";
 
 interface IManagePoliciesPageProps {
   router: InjectedRouter;
@@ -104,6 +107,7 @@ const ManagePolicyPage = ({
     currentTeamName,
     currentTeamSummary,
     isAnyTeamSelected,
+    isAllTeamsSelected,
     isTeamAdmin,
     isTeamMaintainer,
     isRouteOk,
@@ -114,7 +118,7 @@ const ManagePolicyPage = ({
     location,
     router,
     includeAllTeams: true,
-    includeNoTeam: false,
+    includeNoTeam: true,
     permittedAccessByTeamRole: {
       admin: true,
       maintainer: true,
@@ -127,12 +131,19 @@ const ManagePolicyPage = ({
   const [isUpdatingCalendarEvents, setIsUpdatingCalendarEvents] = useState(
     false
   );
+  const [
+    isUpdatingPolicySoftwareInstall,
+    setIsUpdatingPolicySoftwareInstall,
+  ] = useState(false);
   const [isUpdatingOtherWorkflows, setIsUpdatingOtherWorkflows] = useState(
     false
   );
   const [selectedPolicyIds, setSelectedPolicyIds] = useState<number[]>([]);
   const [showAddPolicyModal, setShowAddPolicyModal] = useState(false);
   const [showDeletePolicyModal, setShowDeletePolicyModal] = useState(false);
+  const [showInstallSoftwareModal, setShowInstallSoftwareModal] = useState(
+    false
+  );
   const [showCalendarEventsModal, setShowCalendarEventsModal] = useState(false);
   const [showOtherWorkflowsModal, setShowOtherWorkflowsModal] = useState(false);
   const [
@@ -162,7 +173,7 @@ const ManagePolicyPage = ({
 
   useEffect(() => {
     setLastEditedQueryPlatform(null);
-  }, []);
+  }, [setLastEditedQueryPlatform]);
 
   useEffect(() => {
     if (!isRouteOk) {
@@ -171,13 +182,20 @@ const ManagePolicyPage = ({
     setSearchQuery(initialSearchQuery);
     setSortHeader(initialSortHeader);
     setSortDirection(initialSortDirection);
-  }, [location, isRouteOk]);
+  }, [
+    location,
+    isRouteOk,
+    initialSearchQuery,
+    initialSortHeader,
+    initialSortDirection,
+  ]);
 
   useEffect(() => {
     if (!isRouteOk) {
       return;
     }
     const path = location.pathname + location.search;
+    // udpate app context with URL path
     if (location.search && filteredPoliciesPath !== path) {
       setFilteredPoliciesPath(path);
     }
@@ -214,7 +232,7 @@ const ManagePolicyPage = ({
       return globalPoliciesAPI.loadAllNew(queryKey[0]);
     },
     {
-      enabled: isRouteOk && !isAnyTeamSelected,
+      enabled: isRouteOk && isAllTeamsSelected,
       select: (data) => data.policies || [],
       staleTime: 5000,
       onSuccess: (data) => {
@@ -232,12 +250,12 @@ const ManagePolicyPage = ({
     [
       {
         scope: "policiesCount",
-        query: isAnyTeamSelected ? "" : searchQuery,
+        query: !isAllTeamsSelected ? "" : searchQuery,
       },
     ],
     ({ queryKey }) => globalPoliciesAPI.getCount(queryKey[0]),
     {
-      enabled: isRouteOk,
+      enabled: isRouteOk && isAllTeamsSelected,
       keepPreviousData: true,
       refetchOnWindowFocus: false,
       retry: 1,
@@ -264,15 +282,17 @@ const ManagePolicyPage = ({
         query: searchQuery,
         orderDirection: sortDirection,
         orderKey: sortHeader,
+        // teamIdForApi will never actually be undefined here
         teamId: teamIdForApi || 0,
-        mergeInherited: !!teamIdForApi,
+        // no teams does inherit
+        mergeInherited: true,
       },
     ],
     ({ queryKey }) => {
       return teamPoliciesAPI.loadAllNew(queryKey[0]);
     },
     {
-      enabled: isRouteOk && isPremiumTier && !!teamIdForApi,
+      enabled: isRouteOk && isPremiumTier && !isAllTeamsSelected,
       select: (data: ILoadTeamPoliciesResponse) => data.policies || [],
       onSuccess: (data) => {
         const allPoliciesAvailableToAutomate = data.filter(
@@ -303,7 +323,7 @@ const ManagePolicyPage = ({
     ],
     ({ queryKey }) => teamPoliciesAPI.getCount(queryKey[0]),
     {
-      enabled: isRouteOk && !!teamIdForApi,
+      enabled: isRouteOk && isPremiumTier && !isAllTeamsSelected,
       keepPreviousData: true,
       refetchOnWindowFocus: false,
       retry: 1,
@@ -325,7 +345,7 @@ const ManagePolicyPage = ({
       return configAPI.loadAll();
     },
     {
-      enabled: canAddOrDeletePolicy,
+      enabled: isRouteOk && canAddOrDeletePolicy,
       onSuccess: (data) => {
         setConfig(data);
       },
@@ -341,13 +361,14 @@ const ManagePolicyPage = ({
     ["teams", teamIdForApi],
     () => teamsAPI.load(teamIdForApi),
     {
+      // no call for no team (teamIdForApi === 0)
       enabled: isRouteOk && !!teamIdForApi && canAddOrDeletePolicy,
       select: (data) => data.team,
     }
   );
 
   const refetchPolicies = (teamId?: number) => {
-    if (teamId) {
+    if (teamId !== undefined) {
       refetchTeamPolicies();
       refetchTeamPoliciesCountMergeInherited();
     } else {
@@ -360,7 +381,7 @@ const ManagePolicyPage = ({
   // NOTE: Solution reused from ManageHostPage.tsx
   useEffect(() => {
     setResetPageIndex(false);
-  }, [page]);
+  }, []);
 
   // NOTE: used to reset page number to 0 when modifying filters
   const handleResetPageIndex = () => {
@@ -427,7 +448,16 @@ const ManagePolicyPage = ({
 
       router?.replace(locationPath);
     },
-    [isRouteOk, teamIdForApi, searchQuery, sortDirection, page, sortHeader] // Other dependencies can cause infinite re-renders as URL is source of truth
+    [
+      isRouteOk,
+      tableQueryData,
+      sortDirection,
+      sortHeader,
+      searchQuery,
+      teamIdForApi,
+      queryParams,
+      router,
+    ] // Other dependencies can cause infinite re-renders as URL is source of truth
   );
 
   const toggleOtherWorkflowsModal = () =>
@@ -438,6 +468,10 @@ const ManagePolicyPage = ({
   const toggleDeletePolicyModal = () =>
     setShowDeletePolicyModal(!showDeletePolicyModal);
 
+  const toggleInstallSoftwareModal = () => {
+    setShowInstallSoftwareModal(!showInstallSoftwareModal);
+  };
+
   const toggleCalendarEventsModal = () => {
     setShowCalendarEventsModal(!showCalendarEventsModal);
   };
@@ -447,6 +481,9 @@ const ManagePolicyPage = ({
       case "calendar_events":
         toggleCalendarEventsModal();
         break;
+      case "install_software":
+        toggleInstallSoftwareModal();
+        break;
       case "other_workflows":
         toggleOtherWorkflowsModal();
         break;
@@ -460,7 +497,7 @@ const ManagePolicyPage = ({
   }) => {
     setIsUpdatingOtherWorkflows(true);
     try {
-      await (isAnyTeamSelected
+      await (!isAllTeamsSelected
         ? teamsAPI.update(requestBody, teamIdForApi)
         : configAPI.update(requestBody));
       renderFlash("success", "Successfully updated policy automations.");
@@ -472,7 +509,64 @@ const ManagePolicyPage = ({
     } finally {
       toggleOtherWorkflowsModal();
       setIsUpdatingOtherWorkflows(false);
-      isAnyTeamSelected ? refetchTeamConfig() : refetchConfig();
+      !isAllTeamsSelected ? refetchTeamConfig() : refetchConfig();
+    }
+  };
+
+  const onUpdatePolicySoftwareInstall = async (
+    formData: IInstallSoftwareFormData
+  ) => {
+    try {
+      setIsUpdatingPolicySoftwareInstall(true);
+      const changedPolicies = formData.filter((formPolicy) => {
+        const prevPolicyState = policiesAvailableToAutomate.find(
+          (policy) => policy.id === formPolicy.id
+        );
+
+        const turnedOff =
+          prevPolicyState?.install_software !== undefined &&
+          formPolicy.installSoftwareEnabled === false;
+
+        const turnedOn =
+          prevPolicyState?.install_software === undefined &&
+          formPolicy.installSoftwareEnabled === true;
+
+        const updatedSwId =
+          prevPolicyState?.install_software?.software_title_id !== undefined &&
+          formPolicy.swIdToInstall !==
+            prevPolicyState?.install_software?.software_title_id;
+
+        return turnedOff || turnedOn || updatedSwId;
+      });
+      if (!changedPolicies.length) {
+        renderFlash("success", "No changes detected.");
+        return;
+      }
+      const responses: Promise<
+        ReturnType<typeof teamPoliciesAPI.update>
+      >[] = [];
+      responses.concat(
+        changedPolicies.map((changedPolicy) => {
+          return teamPoliciesAPI.update(changedPolicy.id, {
+            // "software_title_id:" 0 will unset software install for the policy
+            // "software_title_id": X will set the value to the given integer (except 0).
+            software_title_id: changedPolicy.swIdToInstall || 0,
+            team_id: teamIdForApi,
+          });
+        })
+      );
+      await Promise.all(responses);
+      await wait(100); // prevent race
+      refetchTeamPolicies();
+      renderFlash("success", "Successfully updated policy automations.");
+    } catch {
+      renderFlash(
+        "error",
+        "Could not update policy automations. Please try again."
+      );
+    } finally {
+      toggleInstallSoftwareModal();
+      setIsUpdatingPolicySoftwareInstall(false);
     }
   };
 
@@ -558,7 +652,7 @@ const ManagePolicyPage = ({
   const onDeletePolicySubmit = async () => {
     setIsUpdatingPolicies(true);
     try {
-      const request = isAnyTeamSelected
+      const request = !isAllTeamsSelected
         ? teamPoliciesAPI.destroy(teamIdForApi, selectedPolicyIds)
         : globalPoliciesAPI.destroy(selectedPolicyIds);
 
@@ -585,11 +679,11 @@ const ManagePolicyPage = ({
     }
   };
 
-  const policiesErrors = isAnyTeamSelected
+  const policiesErrors = !isAllTeamsSelected
     ? teamPoliciesError
     : globalPoliciesError;
 
-  const policyResults = isAnyTeamSelected
+  const policyResults = !isAllTeamsSelected
     ? teamPolicies && teamPolicies.length > 0
     : globalPolicies && globalPolicies.length > 0;
 
@@ -597,10 +691,10 @@ const ManagePolicyPage = ({
   const showCtaButtons =
     !policiesErrors && (policyResults || searchQuery !== "");
 
-  const automationsConfig = isAnyTeamSelected ? teamConfig : config;
+  const automationsConfig = !isAllTeamsSelected ? teamConfig : config;
   const hasPoliciesToAutomateOrDelete = policiesAvailableToAutomate.length > 0;
   const showAutomationsDropdown =
-    canManageAutomations && automationsConfig && hasPoliciesToAutomateOrDelete;
+    canManageAutomations && hasPoliciesToAutomateOrDelete;
 
   // NOTE: backend uses webhook_settings to store automated policy ids for both webhooks and integrations
   let currentAutomatedPolicies: number[] = [];
@@ -625,7 +719,7 @@ const ManagePolicyPage = ({
 
   const renderPoliciesCount = (count?: number) => {
     // Hide count if fetching count || there are errors OR there are no policy results with no a search filter
-    const isFetchingCount = isAnyTeamSelected
+    const isFetchingCount = !isAllTeamsSelected
       ? isFetchingTeamCountMergeInherited
       : isFetchingGlobalCount;
 
@@ -642,67 +736,84 @@ const ManagePolicyPage = ({
   };
 
   const renderMainTable = () => {
-    return !isRouteOk || (isPremiumTier && !userTeams) ? (
-      <Spinner />
-    ) : (
+    if (!isRouteOk || (isPremiumTier && !userTeams)) {
+      return <Spinner />;
+    }
+    if (isAllTeamsSelected) {
+      // Global policies
+
+      if (globalPoliciesError) {
+        return <TableDataError />;
+      }
+      return (
+        <PoliciesTable
+          policiesList={globalPolicies || []}
+          isLoading={isFetchingGlobalPolicies || isFetchingConfig}
+          onAddPolicyClick={onAddPolicyClick}
+          onDeletePolicyClick={onDeletePolicyClick}
+          canAddOrDeletePolicy={canAddOrDeletePolicy}
+          hasPoliciesToDelete={hasPoliciesToAutomateOrDelete}
+          currentTeam={currentTeamSummary}
+          currentAutomatedPolicies={currentAutomatedPolicies}
+          isPremiumTier={isPremiumTier}
+          renderPoliciesCount={() => renderPoliciesCount(globalPoliciesCount)}
+          searchQuery={searchQuery}
+          sortHeader={sortHeader}
+          sortDirection={sortDirection}
+          page={page}
+          onQueryChange={onQueryChange}
+          resetPageIndex={resetPageIndex}
+        />
+      );
+    }
+
+    // Team policies
+    if (teamPoliciesError) {
+      return <TableDataError />;
+    }
+    return (
       <div>
-        {isAnyTeamSelected && teamPoliciesError && <TableDataError />}
-        {isAnyTeamSelected && !teamPoliciesError && (
-          <PoliciesTable
-            policiesList={teamPolicies || []}
-            isLoading={
-              isFetchingTeamPolicies || isFetchingTeamConfig || isFetchingConfig
-            }
-            onAddPolicyClick={onAddPolicyClick}
-            onDeletePolicyClick={onDeletePolicyClick}
-            canAddOrDeletePolicy={canAddOrDeletePolicy}
-            hasPoliciesToDelete={hasPoliciesToAutomateOrDelete}
-            currentTeam={currentTeamSummary}
-            currentAutomatedPolicies={currentAutomatedPolicies}
-            renderPoliciesCount={() =>
-              renderPoliciesCount(teamPoliciesCountMergeInherited)
-            }
-            isPremiumTier={isPremiumTier}
-            searchQuery={searchQuery}
-            sortHeader={sortHeader}
-            sortDirection={sortDirection}
-            page={page}
-            onQueryChange={onQueryChange}
-            resetPageIndex={resetPageIndex}
-          />
-        )}
-        {!isAnyTeamSelected && globalPoliciesError && <TableDataError />}
-        {!isAnyTeamSelected && !globalPoliciesError && (
-          <PoliciesTable
-            policiesList={globalPolicies || []}
-            isLoading={isFetchingGlobalPolicies || isFetchingConfig}
-            onAddPolicyClick={onAddPolicyClick}
-            onDeletePolicyClick={onDeletePolicyClick}
-            canAddOrDeletePolicy={canAddOrDeletePolicy}
-            hasPoliciesToDelete={hasPoliciesToAutomateOrDelete}
-            currentTeam={currentTeamSummary}
-            currentAutomatedPolicies={currentAutomatedPolicies}
-            isPremiumTier={isPremiumTier}
-            renderPoliciesCount={() => renderPoliciesCount(globalPoliciesCount)}
-            searchQuery={searchQuery}
-            sortHeader={sortHeader}
-            sortDirection={sortDirection}
-            page={page}
-            onQueryChange={onQueryChange}
-            resetPageIndex={resetPageIndex}
-          />
-        )}
+        <PoliciesTable
+          policiesList={teamPolicies || []}
+          isLoading={
+            isFetchingTeamPolicies || isFetchingTeamConfig || isFetchingConfig
+          }
+          onAddPolicyClick={onAddPolicyClick}
+          onDeletePolicyClick={onDeletePolicyClick}
+          canAddOrDeletePolicy={canAddOrDeletePolicy}
+          hasPoliciesToDelete={hasPoliciesToAutomateOrDelete}
+          currentTeam={currentTeamSummary}
+          currentAutomatedPolicies={currentAutomatedPolicies}
+          renderPoliciesCount={() =>
+            renderPoliciesCount(teamPoliciesCountMergeInherited)
+          }
+          isPremiumTier={isPremiumTier}
+          searchQuery={searchQuery}
+          sortHeader={sortHeader}
+          sortDirection={sortDirection}
+          page={page}
+          onQueryChange={onQueryChange}
+          resetPageIndex={resetPageIndex}
+        />
       </div>
     );
   };
 
-  const getAutomationsDropdownOptions = () => {
-    const isAllTeams = teamIdForApi === undefined || teamIdForApi === -1;
-    let disabledTooltipContent: React.ReactNode;
+  const getAutomationsDropdownOptions = (configPresent: boolean) => {
+    let disabledInstallTooltipContent: React.ReactNode;
+    let disabledCalendarTooltipContent: React.ReactNode;
     if (!isPremiumTier) {
-      disabledTooltipContent = "Available in Fleet Premium.";
-    } else if (isAllTeams) {
-      disabledTooltipContent = (
+      disabledInstallTooltipContent = "Available in Fleet Premium.";
+      disabledCalendarTooltipContent = "Available in Fleet Premium.";
+    } else if (isAllTeamsSelected) {
+      disabledInstallTooltipContent = (
+        <>
+          Select a team to manage
+          <br />
+          install software automation.
+        </>
+      );
+      disabledCalendarTooltipContent = (
         <>
           Select a team to manage
           <br />
@@ -710,15 +821,26 @@ const ManagePolicyPage = ({
         </>
       );
     }
+    const installSWOption = {
+      label: "Install software",
+      value: "install_software",
+      disabled: !!disabledInstallTooltipContent,
+      helpText: "Install software to resolve failing policies.",
+      tooltipContent: disabledInstallTooltipContent,
+    };
+    if (!configPresent) {
+      return [installSWOption];
+    }
 
     return [
       {
         label: "Calendar events",
         value: "calendar_events",
-        disabled: !isPremiumTier || isAllTeams,
+        disabled: !!disabledCalendarTooltipContent,
         helpText: "Automatically reserve time to resolve failing policies.",
-        tooltipContent: disabledTooltipContent,
+        tooltipContent: disabledCalendarTooltipContent,
       },
+      installSWOption,
       {
         label: "Other workflows",
         value: "other_workflows",
@@ -733,6 +855,9 @@ const ManagePolicyPage = ({
       config?.integrations.google_calendar.length > 0) ??
     false;
 
+  if (!isRouteOk) {
+    return <Spinner />;
+  }
   return (
     <MainContent className={baseClass}>
       <div className={`${baseClass}__wrapper`}>
@@ -747,6 +872,7 @@ const ManagePolicyPage = ({
                       currentUserTeams={userTeams || []}
                       selectedTeamId={currentTeamId}
                       onChange={onTeamChange}
+                      includeNoTeams
                     />
                   )}
                 {isPremiumTier &&
@@ -765,7 +891,7 @@ const ManagePolicyPage = ({
                     onChange={onSelectAutomationOption}
                     placeholder="Manage automations"
                     searchable={false}
-                    options={getAutomationsDropdownOptions()}
+                    options={getAutomationsDropdownOptions(!!automationsConfig)}
                   />
                 </div>
               )}
@@ -805,7 +931,8 @@ const ManagePolicyPage = ({
           <AddPolicyModal
             onCancel={toggleAddPolicyModal}
             router={router}
-            teamId={teamIdForApi || 0}
+            // default to all teams, though should be present here
+            teamId={currentTeamId ?? API_ALL_TEAMS_ID}
             teamName={currentTeamName}
           />
         )}
@@ -816,6 +943,16 @@ const ManagePolicyPage = ({
             onSubmit={onDeletePolicySubmit}
           />
         )}
+        {showInstallSoftwareModal && (
+          <InstallSoftwareModal
+            onExit={toggleInstallSoftwareModal}
+            onSubmit={onUpdatePolicySoftwareInstall}
+            isUpdating={isUpdatingPolicySoftwareInstall}
+            policies={policiesAvailableToAutomate}
+            // currentTeamId will at this point be present
+            teamId={currentTeamId ?? 0}
+          />
+        )}
         {showCalendarEventsModal && (
           <CalendarEventsModal
             onExit={toggleCalendarEventsModal}
diff --git a/frontend/pages/policies/ManagePoliciesPage/_styles.scss b/frontend/pages/policies/ManagePoliciesPage/_styles.scss
index cd7f309af3..a9300ee34b 100644
--- a/frontend/pages/policies/ManagePoliciesPage/_styles.scss
+++ b/frontend/pages/policies/ManagePoliciesPage/_styles.scss
@@ -220,7 +220,7 @@
     }
   }
 
-  // Used in both CalendarEventsModal and OtherWorkflowsModal
+  // Used in CalendarEventsModal, InstallSoftwareModal, and OtherWorkflowsModal
   .automated-policies-section {
     display: flex;
     flex-direction: column;
@@ -228,8 +228,10 @@
     align-self: stretch;
     border-radius: 4px;
     border: 1px solid $ui-fleet-black-10;
+    // negate ul padding
+    padding-left: 0;
 
-    .checkbox-row {
+    .policy-row {
       display: flex;
       max-width: 100%;
       padding: 8px 12px;
@@ -270,7 +272,7 @@
           cursor: pointer;
         }
 
-        .checkbox-row__preview-button {
+        .policy-row__preview-button {
           visibility: visible;
         }
       }
diff --git a/frontend/pages/policies/ManagePoliciesPage/components/AddPolicyModal/AddPolicyModal.tsx b/frontend/pages/policies/ManagePoliciesPage/components/AddPolicyModal/AddPolicyModal.tsx
index d369f79370..e6e1e9bd38 100644
--- a/frontend/pages/policies/ManagePoliciesPage/components/AddPolicyModal/AddPolicyModal.tsx
+++ b/frontend/pages/policies/ManagePoliciesPage/components/AddPolicyModal/AddPolicyModal.tsx
@@ -14,11 +14,13 @@ import Modal from "components/Modal";
 // @ts-ignore
 import Dropdown from "components/forms/fields/Dropdown";
 import CustomLink from "components/CustomLink";
+import { API_ALL_TEAMS_ID, APP_CONTEXT_ALL_TEAMS_ID } from "interfaces/team";
 
 export interface IAddPolicyModalProps {
   onCancel: () => void;
   router: InjectedRouter; // v3
-  teamId: number;
+  // API context, all teams: undefined
+  teamId: number | undefined;
   teamName?: string;
 }
 
@@ -81,19 +83,27 @@ const AddPolicyModal = ({
     setLastEditedQueryResolution(selectedPolicy.resolution);
     setLastEditedQueryCritical(selectedPolicy.critical || false);
     setLastEditedQueryId(null);
-    setPolicyTeamId(teamId);
+    setPolicyTeamId(
+      teamId === API_ALL_TEAMS_ID ? APP_CONTEXT_ALL_TEAMS_ID : teamId
+    );
     setLastEditedQueryPlatform(selectedPolicy.platform || null);
     router.push(
-      !teamId ? PATHS.NEW_POLICY : `${PATHS.NEW_POLICY}?team_id=${teamId}`
+      teamId === API_ALL_TEAMS_ID
+        ? PATHS.NEW_POLICY
+        : `${PATHS.NEW_POLICY}?team_id=${teamId}`
     );
   };
 
   const onCreateYourOwnPolicyClick = useCallback(() => {
-    setPolicyTeamId(teamId);
+    setPolicyTeamId(
+      teamId === API_ALL_TEAMS_ID ? APP_CONTEXT_ALL_TEAMS_ID : teamId
+    );
     setLastEditedQueryBody(DEFAULT_POLICY.query);
     setLastEditedQueryId(null);
     router.push(
-      !teamId ? PATHS.NEW_POLICY : `${PATHS.NEW_POLICY}?team_id=${teamId}`
+      teamId === API_ALL_TEAMS_ID
+        ? PATHS.NEW_POLICY
+        : `${PATHS.NEW_POLICY}?team_id=${teamId}`
     );
   }, [
     router,
@@ -173,7 +183,7 @@ const AddPolicyModal = ({
           options={PLATFORM_FILTER_OPTIONS}
           searchable={false}
           onChange={onPlatformFilterChange}
-          tableFilterDropdown
+          iconName="filter"
         />
         <div className={`${baseClass}__policy-selection`}>
           {filteredPoliciesCount > 0 ? filteredPoliciesList : renderNoResults()}
diff --git a/frontend/pages/policies/ManagePoliciesPage/components/AddPolicyModal/_styles.scss b/frontend/pages/policies/ManagePoliciesPage/components/AddPolicyModal/_styles.scss
index 924a16b0d8..c1cfe99bb9 100644
--- a/frontend/pages/policies/ManagePoliciesPage/components/AddPolicyModal/_styles.scss
+++ b/frontend/pages/policies/ManagePoliciesPage/components/AddPolicyModal/_styles.scss
@@ -1,17 +1,25 @@
 .add-policy-modal {
   height: 90%;
   overflow: hidden;
-  min-height: 460px;
-  max-height: fit-content;
+
+  // we have to reach into the modal component classes to style the content
+  // correctly. This is because this modal always has a fixed height and
+  // the content is scrollable.
+  .modal__content-wrapper {
+    height: 95%;
+  }
 
   .modal__content {
-    height: 90%;
-    overflow: scroll;
+    height: 100%;
     display: flex;
     flex-direction: column;
     gap: $pad-large;
   }
 
+  &__policy-selection {
+    overflow-y: auto;
+  }
+
   .Select-multi-value-wrapper {
     display: flex;
   }
diff --git a/frontend/pages/policies/ManagePoliciesPage/components/CalendarEventsModal/CalendarEventsModal.tsx b/frontend/pages/policies/ManagePoliciesPage/components/CalendarEventsModal/CalendarEventsModal.tsx
index 4a10a9c010..3e2a916789 100644
--- a/frontend/pages/policies/ManagePoliciesPage/components/CalendarEventsModal/CalendarEventsModal.tsx
+++ b/frontend/pages/policies/ManagePoliciesPage/components/CalendarEventsModal/CalendarEventsModal.tsx
@@ -185,11 +185,11 @@ const CalendarEventsModal = ({
     return (
       <div className="form-field">
         <div className="form-field__label">Policies:</div>
-        <div className="automated-policies-section">
+        <ul className="automated-policies-section">
           {formData.policies.map((policy) => {
             const { isChecked, name, id } = policy;
             return (
-              <div className="checkbox-row" id={`checkbox-row--${id}`} key={id}>
+              <li className="policy-row" id={`policy-row--${id}`} key={id}>
                 <Checkbox
                   value={isChecked}
                   name={name}
@@ -208,14 +208,14 @@ const CalendarEventsModal = ({
                     );
                     togglePreviewCalendarEvent();
                   }}
-                  className="checkbox-row__preview-button"
+                  className="policy-row__preview-button"
                 >
                   <Icon name="eye" /> Preview
                 </Button>
-              </div>
+              </li>
             );
           })}
-        </div>
+        </ul>
         <span className="form-field__help-text">
           A calendar event will be created for end users if one of their hosts
           fail any of these policies.{" "}
diff --git a/frontend/pages/policies/ManagePoliciesPage/components/InstallSoftwareModal/InstallSoftwareModal.tsx b/frontend/pages/policies/ManagePoliciesPage/components/InstallSoftwareModal/InstallSoftwareModal.tsx
new file mode 100644
index 0000000000..7c29b4979f
--- /dev/null
+++ b/frontend/pages/policies/ManagePoliciesPage/components/InstallSoftwareModal/InstallSoftwareModal.tsx
@@ -0,0 +1,276 @@
+import React, { useCallback, useState } from "react";
+
+import { useQuery } from "react-query";
+import { omit } from "lodash";
+
+import { IPolicyStats } from "interfaces/policy";
+import softwareAPI, {
+  ISoftwareTitlesQueryKey,
+  ISoftwareTitlesResponse,
+} from "services/entities/software";
+import { DEFAULT_USE_QUERY_OPTIONS } from "utilities/constants";
+
+// @ts-ignore
+import Dropdown from "components/forms/fields/Dropdown";
+import Modal from "components/Modal";
+import DataError from "components/DataError";
+import Spinner from "components/Spinner";
+import Checkbox from "components/forms/fields/Checkbox";
+import TooltipTruncatedText from "components/TooltipTruncatedText";
+import CustomLink from "components/CustomLink";
+import Button from "components/buttons/Button";
+import { ISoftwareTitle } from "interfaces/software";
+
+const getPlatformDisplayFromPackageSuffix = (packageName: string) => {
+  const split = packageName.split(".");
+  const suff = split[split.length - 1];
+  switch (suff) {
+    case "pkg":
+      return "macOS";
+    case "deb":
+      return "Linux";
+    case "exe":
+      return "Windows";
+    case "msi":
+      return "Windows";
+    default:
+      return null;
+  }
+};
+
+const AFI_SOFTWARE_BATCH_SIZE = 1000;
+
+const baseClass = "install-software-modal";
+
+interface ISwDropdownField {
+  name: string;
+  value: number;
+}
+interface IFormPolicy {
+  name: string;
+  id: number;
+  installSoftwareEnabled: boolean;
+  swIdToInstall?: number;
+}
+
+export type IInstallSoftwareFormData = IFormPolicy[];
+
+interface IInstallSoftwareModal {
+  onExit: () => void;
+  onSubmit: (formData: IInstallSoftwareFormData) => void;
+  isUpdating: boolean;
+  policies: IPolicyStats[];
+  teamId: number;
+}
+const InstallSoftwareModal = ({
+  onExit,
+  onSubmit,
+  isUpdating,
+  policies,
+  teamId,
+}: IInstallSoftwareModal) => {
+  const [formData, setFormData] = useState<IInstallSoftwareFormData>(
+    policies.map((policy) => ({
+      name: policy.name,
+      id: policy.id,
+      installSoftwareEnabled: !!policy.install_software,
+      swIdToInstall: policy.install_software?.software_title_id,
+    }))
+  );
+
+  const anyPolicyEnabledWithoutSelectedSoftware = formData.some(
+    (policy) => policy.installSoftwareEnabled && !policy.swIdToInstall
+  );
+  const {
+    data: titlesAFI,
+    isLoading: isTitlesAFILoading,
+    isError: isTitlesAFIError,
+  } = useQuery<
+    ISoftwareTitlesResponse,
+    Error,
+    ISoftwareTitle[],
+    [ISoftwareTitlesQueryKey]
+  >(
+    [
+      {
+        scope: "software-titles",
+        page: 0,
+        perPage: AFI_SOFTWARE_BATCH_SIZE,
+        query: "",
+        orderDirection: "desc",
+        orderKey: "hosts_count",
+        teamId,
+        availableForInstall: true,
+        packagesOnly: true,
+      },
+    ],
+    ({ queryKey: [queryKey] }) =>
+      softwareAPI.getSoftwareTitles(omit(queryKey, "scope")),
+    {
+      select: (data) => data.software_titles,
+      ...DEFAULT_USE_QUERY_OPTIONS,
+    }
+  );
+
+  const onUpdateInstallSoftware = useCallback(() => {
+    onSubmit(formData);
+  }, [formData, onSubmit]);
+
+  const onChangeEnableInstallSoftware = useCallback(
+    (newVal: { policyName: string; value: boolean }) => {
+      const { policyName, value } = newVal;
+      setFormData(
+        formData.map((policy) => {
+          if (policy.name === policyName) {
+            return {
+              ...policy,
+              installSoftwareEnabled: value,
+              swIdToInstall: value ? policy.swIdToInstall : undefined,
+            };
+          }
+          return policy;
+        })
+      );
+    },
+    [formData]
+  );
+
+  const onSelectPolicySoftware = useCallback(
+    ({ name, value }: ISwDropdownField) => {
+      const [policyName, softwareId] = [name, value];
+      setFormData(
+        formData.map((policy) => {
+          if (policy.name === policyName) {
+            return { ...policy, swIdToInstall: softwareId };
+          }
+          return policy;
+        })
+      );
+    },
+    [formData]
+  );
+
+  const availableSoftwareOptions = titlesAFI?.map((title) => {
+    const platformDisplay = getPlatformDisplayFromPackageSuffix(
+      title.software_package?.name ?? ""
+    );
+    const platformString = platformDisplay ? `${platformDisplay} • ` : "";
+    return {
+      label: title.name,
+      value: title.id,
+      helpText: `${platformString}${title.software_package?.version ?? ""}`,
+    };
+  });
+
+  const renderPolicySwInstallOption = (policy: IFormPolicy) => {
+    const {
+      name: policyName,
+      id: policyId,
+      installSoftwareEnabled: enabled,
+      swIdToInstall,
+    } = policy;
+
+    return (
+      <li
+        className={`${baseClass}__policy-row policy-row`}
+        id={`policy-row--${policyId}`}
+        key={policyId}
+      >
+        <Checkbox
+          value={enabled}
+          name={policyName}
+          onChange={() => {
+            onChangeEnableInstallSoftware({
+              policyName,
+              value: !enabled,
+            });
+          }}
+        >
+          <TooltipTruncatedText value={policyName} />
+        </Checkbox>
+        {enabled && (
+          <Dropdown
+            options={availableSoftwareOptions}
+            value={swIdToInstall}
+            onChange={onSelectPolicySoftware}
+            placeholder="Select software"
+            className={`${baseClass}__software-dropdown`}
+            name={policyName}
+            parseTarget
+          />
+        )}
+      </li>
+    );
+  };
+
+  const renderContent = () => {
+    if (isTitlesAFIError) {
+      return <DataError />;
+    }
+    if (isTitlesAFILoading) {
+      return <Spinner />;
+    }
+    if (!titlesAFI?.length) {
+      return (
+        <div className={`${baseClass}__no-software`}>
+          <b>No software available for install</b>
+          <span>
+            Go to <b>Software</b> to add software to this team.
+          </span>
+        </div>
+      );
+    }
+
+    return (
+      <div className={`${baseClass} form`}>
+        <div className="form-field">
+          <div className="form-field__label">Policies:</div>
+          <ul className="automated-policies-section">
+            {formData.map((policyData) =>
+              renderPolicySwInstallOption(policyData)
+            )}
+          </ul>
+          <span className="form-field__help-text">
+            Selected software will be installed when hosts fail the chosen
+            policy.{" "}
+            <CustomLink
+              url="https://fleetdm.com/learn-more-about/policy-automation-install-software"
+              text="Learn more"
+              newTab
+            />
+          </span>
+        </div>
+        <div className="modal-cta-wrap">
+          <Button
+            type="submit"
+            variant="brand"
+            onClick={onUpdateInstallSoftware}
+            className="save-loading"
+            isLoading={isUpdating}
+            disabled={anyPolicyEnabledWithoutSelectedSoftware}
+          >
+            Save
+          </Button>
+          <Button onClick={onExit} variant="inverse">
+            Cancel
+          </Button>
+        </div>
+      </div>
+    );
+  };
+
+  return (
+    <Modal
+      title="Install software"
+      className={baseClass}
+      onExit={onExit}
+      onEnter={onUpdateInstallSoftware}
+      width="large"
+      isContentDisabled={isUpdating}
+    >
+      {renderContent()}
+    </Modal>
+  );
+};
+
+export default InstallSoftwareModal;
diff --git a/frontend/pages/policies/ManagePoliciesPage/components/InstallSoftwareModal/_styles.scss b/frontend/pages/policies/ManagePoliciesPage/components/InstallSoftwareModal/_styles.scss
new file mode 100644
index 0000000000..de9cfc05be
--- /dev/null
+++ b/frontend/pages/policies/ManagePoliciesPage/components/InstallSoftwareModal/_styles.scss
@@ -0,0 +1,41 @@
+.manage-policies-page {
+  .install-software-modal {
+    .form-field--dropdown {
+      width: 276px;
+      .Select-placeholder {
+        color: $ui-fleet-black-50;
+      }
+      .Select-menu {
+        max-height: none;
+        overflow: visible;
+      }
+      .Select-menu-outer {
+        max-height: 240px;
+        overflow-y: auto;
+      }
+    }
+    .policy-row {
+      height: 40px;
+      padding-top: 4px;
+      padding-bottom: 4px;
+    }
+
+    &__no-software {
+      display: flex;
+      height: 178px;
+      flex-direction: column;
+      align-items: center;
+      gap: $pad-small;
+      justify-content: center;
+      font-size: $small;
+      
+      span {
+        color: $ui-fleet-black-75;
+        font-size: $xx-small;
+      }
+    }
+    .data-error {
+      padding: 78px;
+    }
+  }
+}
diff --git a/frontend/pages/policies/ManagePoliciesPage/components/InstallSoftwareModal/index.ts b/frontend/pages/policies/ManagePoliciesPage/components/InstallSoftwareModal/index.ts
new file mode 100644
index 0000000000..a9f46a726a
--- /dev/null
+++ b/frontend/pages/policies/ManagePoliciesPage/components/InstallSoftwareModal/index.ts
@@ -0,0 +1 @@
+export { default } from "./InstallSoftwareModal";
diff --git a/frontend/pages/policies/ManagePoliciesPage/components/OtherWorkflowsModal/OtherWorkflowsModal.tsx b/frontend/pages/policies/ManagePoliciesPage/components/OtherWorkflowsModal/OtherWorkflowsModal.tsx
index 75c66b5fd7..7a9668e825 100644
--- a/frontend/pages/policies/ManagePoliciesPage/components/OtherWorkflowsModal/OtherWorkflowsModal.tsx
+++ b/frontend/pages/policies/ManagePoliciesPage/components/OtherWorkflowsModal/OtherWorkflowsModal.tsx
@@ -367,6 +367,7 @@ const OtherWorkflowsModal = ({
       title="Other workflows"
       className={baseClass}
       width="large"
+      isContentDisabled={isUpdating}
     >
       <div className={`${baseClass} form`}>
         <Slider
@@ -415,8 +416,8 @@ const OtherWorkflowsModal = ({
                       const { isChecked, name, id } = policyItem;
                       return (
                         <div
-                          className="checkbox-row"
-                          id={`checkbox-row--${id}`}
+                          className="policy-row"
+                          id={`policy-row--${id}`}
                           key={id}
                         >
                           <Checkbox
diff --git a/frontend/pages/policies/ManagePoliciesPage/components/PoliciesTable/PoliciesTableConfig.tsx b/frontend/pages/policies/ManagePoliciesPage/components/PoliciesTable/PoliciesTableConfig.tsx
index cf7afa1b1a..39dea4b872 100644
--- a/frontend/pages/policies/ManagePoliciesPage/components/PoliciesTable/PoliciesTableConfig.tsx
+++ b/frontend/pages/policies/ManagePoliciesPage/components/PoliciesTable/PoliciesTableConfig.tsx
@@ -155,9 +155,10 @@ const generateTableHeaders = (
                   </ReactTooltip5>
                 </div>
               )}
-              {viewingTeamPolicies && !cellProps.row.original.team_id && (
-                <InheritedBadge tooltipContent="This policy runs on all hosts." />
-              )}
+              {viewingTeamPolicies &&
+                cellProps.row.original.team_id === null && (
+                  <InheritedBadge tooltipContent="This policy runs on all hosts." />
+                )}
             </>
           }
           path={PATHS.EDIT_POLICY(cellProps.row.original)}
@@ -274,7 +275,7 @@ const generateTableHeaders = (
     tableHeaders.unshift({
       id: "selection",
       Header: (headerProps: any) => {
-        // When viewing team policies select all checkbox accounts for not selecting inherited policies
+        // When viewing team policies, the select all checkbox will ignore inherited policies
         const teamCheckboxProps = getConditionalSelectHeaderCheckboxProps({
           headerProps,
           checkIfRowIsSelectable: (row) => row.original.team_id !== null,
@@ -301,7 +302,7 @@ const generateTableHeaders = (
         return <Checkbox {...checkboxProps} />;
       },
       Cell: (cellProps: ICellProps): JSX.Element => {
-        const inheritedPolicy = !cellProps.row.original.team_id;
+        const inheritedPolicy = cellProps.row.original.team_id === null;
         const props = cellProps.row.getToggleRowSelectedProps();
         const checkboxProps = {
           value: props.checked,
diff --git a/frontend/pages/policies/PolicyPage/PolicyPage.tsx b/frontend/pages/policies/PolicyPage/PolicyPage.tsx
index 4fcb582bc4..48a39cb2c5 100644
--- a/frontend/pages/policies/PolicyPage/PolicyPage.tsx
+++ b/frontend/pages/policies/PolicyPage/PolicyPage.tsx
@@ -14,7 +14,11 @@ import {
   IStoredPolicyResponse,
 } from "interfaces/policy";
 import { ITarget } from "interfaces/target";
-import { ITeam } from "interfaces/team";
+import {
+  API_ALL_TEAMS_ID,
+  APP_CONTEXT_ALL_TEAMS_ID,
+  ITeam,
+} from "interfaces/team";
 import globalPoliciesAPI from "services/entities/global_policies";
 import teamPoliciesAPI from "services/entities/team_policies";
 import hostAPI from "services/entities/hosts";
@@ -84,7 +88,7 @@ const PolicyPage = ({
     location,
     router,
     includeAllTeams: true,
-    includeNoTeam: false,
+    includeNoTeam: true,
     permittedAccessByTeamRole: {
       admin: true,
       maintainer: true,
@@ -112,7 +116,11 @@ const PolicyPage = ({
       return;
     }
     if (policyTeamId !== teamIdForApi) {
-      setPolicyTeamId(teamIdForApi || 0);
+      setPolicyTeamId(
+        teamIdForApi === API_ALL_TEAMS_ID
+          ? APP_CONTEXT_ALL_TEAMS_ID
+          : teamIdForApi
+      );
     }
   }, [isRouteOk, teamIdForApi, policyTeamId, setPolicyTeamId]);
 
@@ -155,6 +163,8 @@ const PolicyPage = ({
       retry: false,
       select: (data: IStoredPolicyResponse) => data.policy,
       onSuccess: (returnedQuery) => {
+        const deNulledReturnedQueryTeamId = returnedQuery.team_id ?? undefined;
+
         setLastEditedQueryId(returnedQuery.id);
         setLastEditedQueryName(returnedQuery.name);
         setLastEditedQueryDescription(returnedQuery.description);
@@ -164,7 +174,11 @@ const PolicyPage = ({
         setLastEditedQueryPlatform(returnedQuery.platform);
         // TODO(sarah): What happens if the team id in the policy response doesn't match the
         // url param? In theory, the backend should ensure this doesn't happen.
-        setPolicyTeamId(returnedQuery.team_id || 0);
+        setPolicyTeamId(
+          deNulledReturnedQueryTeamId === API_ALL_TEAMS_ID
+            ? APP_CONTEXT_ALL_TEAMS_ID
+            : deNulledReturnedQueryTeamId
+        );
       },
       onError: (error) => handlePageError(error),
     }
@@ -197,7 +211,7 @@ const PolicyPage = ({
   if (
     !isOnGlobalTeam &&
     !isStoredPolicyLoading &&
-    storedPolicy?.team_id &&
+    storedPolicy?.team_id !== undefined &&
     !(storedPolicy?.team_id?.toString() === location.query.team_id)
   ) {
     router.push(
@@ -205,9 +219,10 @@ const PolicyPage = ({
     );
   }
 
+  // this function is passed way down, wrapped and ultimately called by SaveNewPolicyModal
   const { mutateAsync: createPolicy } = useMutation(
     (formData: IPolicyFormData) => {
-      return formData.team_id
+      return formData.team_id !== undefined
         ? teamPoliciesAPI.create(formData)
         : globalPoliciesAPI.create(formData);
     }
diff --git a/frontend/pages/policies/PolicyPage/components/PolicyForm/PolicyForm.tsx b/frontend/pages/policies/PolicyPage/components/PolicyForm/PolicyForm.tsx
index c9d1266c20..8490d2c24a 100644
--- a/frontend/pages/policies/PolicyPage/components/PolicyForm/PolicyForm.tsx
+++ b/frontend/pages/policies/PolicyPage/components/PolicyForm/PolicyForm.tsx
@@ -98,7 +98,6 @@ const PolicyForm = ({
   // Note: The PolicyContext values should always be used for any mutable policy data such as query name
   // The storedPolicy prop should only be used to access immutable metadata such as author id
   const {
-    policyTeamId,
     lastEditedQueryId,
     lastEditedQueryName,
     lastEditedQueryDescription,
diff --git a/frontend/pages/policies/PolicyPage/screens/QueryEditor.tsx b/frontend/pages/policies/PolicyPage/screens/QueryEditor.tsx
index 4f51ef87ef..553209818e 100644
--- a/frontend/pages/policies/PolicyPage/screens/QueryEditor.tsx
+++ b/frontend/pages/policies/PolicyPage/screens/QueryEditor.tsx
@@ -14,6 +14,7 @@ import { IPolicyFormData, IPolicy } from "interfaces/policy";
 
 import BackLink from "components/BackLink";
 import PolicyForm from "pages/policies/PolicyPage/components/PolicyForm";
+import { APP_CONTEXT_ALL_TEAMS_ID } from "interfaces/team";
 
 interface IQueryEditorProps {
   router: InjectedRouter;
@@ -23,8 +24,6 @@ interface IQueryEditorProps {
   storedPolicyError: Error | null;
   showOpenSchemaActionText: boolean;
   isStoredPolicyLoading: boolean;
-  isTeamAdmin: boolean;
-  isTeamMaintainer: boolean;
   isTeamObserver: boolean;
   createPolicy: (formData: IPolicyFormData) => Promise<any>;
   onOsqueryTableSelect: (tableName: string) => void;
@@ -41,8 +40,6 @@ const QueryEditor = ({
   storedPolicyError,
   showOpenSchemaActionText,
   isStoredPolicyLoading,
-  isTeamAdmin,
-  isTeamMaintainer,
   isTeamObserver,
   createPolicy,
   onOsqueryTableSelect,
@@ -86,7 +83,6 @@ const QueryEditor = ({
     policyAutofillData,
     setPolicyAutofillData,
   ] = useState<IAutofillPolicy | null>(null);
-  const [policyAutofillErrors, setPolicyAutofillErrors] = useState<any>({});
   const [
     isFetchingAutofillDescription,
     setIsFetchingAutofillDescription,
@@ -115,7 +111,6 @@ const QueryEditor = ({
       } catch (error) {
         console.log(error);
         renderFlash("error", "Couldn't autofill policy data.");
-        setPolicyAutofillErrors(error);
       }
       setIsFetchingAutofillDescription(false);
     }
@@ -139,14 +134,13 @@ const QueryEditor = ({
       } catch (error) {
         console.log(error);
         renderFlash("error", "Couldn't autofill policy data.");
-        setPolicyAutofillErrors(error);
       }
       setIsFetchingAutofillResolution(false);
     }
   };
 
   const onCreatePolicy = debounce(async (formData: IPolicyFormData) => {
-    if (policyTeamId) {
+    if (policyTeamId !== APP_CONTEXT_ALL_TEAMS_ID) {
       formData.team_id = policyTeamId;
     }
     setIsUpdatingPolicy(true);
@@ -204,9 +198,9 @@ const QueryEditor = ({
 
     const updateAPIRequest = () => {
       // storedPolicy.team_id is used for existing policies because selectedTeamId is subject to change
-      const team_id = storedPolicy?.team_id;
+      const team_id = storedPolicy?.team_id ?? undefined;
 
-      return team_id
+      return team_id !== undefined
         ? teamPoliciesAPI.update(policyIdForEdit, {
             ...updatedPolicy,
             team_id,
diff --git a/frontend/pages/queries/ManageQueriesPage/components/QueriesTable/QueriesTable.tsx b/frontend/pages/queries/ManageQueriesPage/components/QueriesTable/QueriesTable.tsx
index 9037d20a89..eae763105b 100644
--- a/frontend/pages/queries/ManageQueriesPage/components/QueriesTable/QueriesTable.tsx
+++ b/frontend/pages/queries/ManageQueriesPage/components/QueriesTable/QueriesTable.tsx
@@ -272,7 +272,7 @@ const QueriesTable = ({
         options={PLATFORM_FILTER_OPTIONS}
         searchable={false}
         onChange={handlePlatformFilterDropdownChange}
-        tableFilterDropdown
+        iconName="filter"
       />
     );
   }, [platform, queryParams, router]);
diff --git a/frontend/pages/queries/details/QueryDetailsPage/QueryDetailsPage.tsx b/frontend/pages/queries/details/QueryDetailsPage/QueryDetailsPage.tsx
index 42a2413c99..cdaec1aebd 100644
--- a/frontend/pages/queries/details/QueryDetailsPage/QueryDetailsPage.tsx
+++ b/frontend/pages/queries/details/QueryDetailsPage/QueryDetailsPage.tsx
@@ -49,7 +49,12 @@ interface IQueryDetailsPageProps {
   params: Params;
   location: {
     pathname: string;
-    query: { team_id?: string; order_key?: string; order_direction?: string };
+    query: {
+      team_id?: string;
+      order_key?: string;
+      order_direction?: string;
+      host_id?: string;
+    };
     search: string;
   };
 }
@@ -67,6 +72,12 @@ const QueryDetailsPage = ({
   }
   const queryParams = location.query;
 
+  // Present when observer is redirected from host details > query
+  // since observer does not have access to edit page
+  const hostId = queryParams?.host_id
+    ? parseInt(queryParams.host_id, 10)
+    : undefined;
+
   const { currentTeamId } = useTeamIdParam({
     location,
     router,
@@ -295,7 +306,7 @@ const QueryDetailsPage = ({
                         onClick={() => {
                           queryId &&
                             router.push(
-                              PATHS.LIVE_QUERY(queryId, currentTeamId)
+                              PATHS.LIVE_QUERY(queryId, currentTeamId, hostId)
                             );
                         }}
                         disabled={isLiveQueryDisabled}
diff --git a/frontend/pages/queries/edit/EditQueryPage.tsx b/frontend/pages/queries/edit/EditQueryPage.tsx
index addfd6b061..d2bc087b60 100644
--- a/frontend/pages/queries/edit/EditQueryPage.tsx
+++ b/frontend/pages/queries/edit/EditQueryPage.tsx
@@ -208,7 +208,14 @@ const EditQueryPage = ({
       queryId > 0 &&
       !canEditExistingQuery
     ) {
-      router.push(PATHS.QUERY_DETAILS(queryId));
+      // Reroute to query report page still maintains query params for live query purposes
+      const baseUrl = PATHS.QUERY_DETAILS(queryId);
+      const queryParams = buildQueryStringFromParams({
+        host_id: location.query.host_id,
+        team_id: location.query.team_id,
+      });
+
+      router.push(queryParams ? `${baseUrl}?${queryParams}` : baseUrl);
     }
   }, [queryId, isTeamMaintainerOrTeamAdmin, isStoredQueryLoading]);
 
diff --git a/frontend/router/index.tsx b/frontend/router/index.tsx
index f3785ba771..ecdb4aa9fc 100644
--- a/frontend/router/index.tsx
+++ b/frontend/router/index.tsx
@@ -64,9 +64,9 @@ import SetupExperience from "pages/ManageControlsPage/SetupExperience/SetupExper
 import WindowsMdmPage from "pages/admin/IntegrationsPage/cards/MdmSettings/WindowsMdmPage";
 import AppleMdmPage from "pages/admin/IntegrationsPage/cards/MdmSettings/AppleMdmPage";
 import Scripts from "pages/ManageControlsPage/Scripts/Scripts";
-import AppleAutomaticEnrollmentPage from "pages/admin/IntegrationsPage/cards/AutomaticEnrollment/AppleAutomaticEnrollmentPage";
-import WindowsAutomaticEnrollmentPage from "pages/admin/IntegrationsPage/cards/AutomaticEnrollment/WindowsAutomaticEnrollmentPage";
-import VppSetupPage from "pages/admin/IntegrationsPage/cards/Vpp/VppSetupPage";
+import WindowsAutomaticEnrollmentPage from "pages/admin/IntegrationsPage/cards/MdmSettings/WindowsAutomaticEnrollmentPage";
+import AppleBusinessManagerPage from "pages/admin/IntegrationsPage/cards/MdmSettings/AppleBusinessManagerPage";
+import VppPage from "pages/admin/IntegrationsPage/cards/MdmSettings/VppPage";
 import HostQueryReport from "pages/hosts/details/HostQueryReport";
 import SoftwarePage from "pages/SoftwarePage";
 import SoftwareTitles from "pages/SoftwarePage/SoftwareTitles";
@@ -168,6 +168,13 @@ const routes = (
                   component={OrgSettingsPage}
                 />
                 <Route path="integrations" component={AdminIntegrationsPage} />
+                {/* This redirect is used to handle the old URL for these two
+                pages */}
+                <Redirect
+                  from="integrations/automatic-enrollment"
+                  to="integrations/mdm"
+                />
+                <Redirect from="integrations/vpp" to="integrations/mdm" />
                 <Route
                   path="integrations/:section"
                   component={AdminIntegrationsPage}
@@ -182,15 +189,23 @@ const routes = (
             </Route>
             <Route path="integrations/mdm/windows" component={WindowsMdmPage} />
             <Route path="integrations/mdm/apple" component={AppleMdmPage} />
+            {/* This redirect is used to handle old apple automatic enrollments page */}
+            <Redirect
+              from="integrations/automatic-enrollment/apple"
+              to="integrations/mdm/abm"
+            />
             <Route
-              path="integrations/automatic-enrollment/apple"
-              component={AppleAutomaticEnrollmentPage}
+              path="integrations/mdm/abm"
+              component={AppleBusinessManagerPage}
             />
             <Route
               path="integrations/automatic-enrollment/windows"
               component={WindowsAutomaticEnrollmentPage}
             />
-            <Route path="integrations/vpp/setup" component={VppSetupPage} />
+            {/* This redirect is used to handle old vpp setup page */}
+            <Redirect from="integrations/vpp/setup" to="integrations/mdm/vpp" />
+            <Route path="integrations/mdm/vpp" component={VppPage} />
+
             <Route path="teams" component={TeamDetailsWrapper}>
               <Redirect from="members" to="users" />
               <Route path="users" component={UsersPage} />
diff --git a/frontend/router/paths.ts b/frontend/router/paths.ts
index 1ca4c6e39d..1db857b432 100644
--- a/frontend/router/paths.ts
+++ b/frontend/router/paths.ts
@@ -1,3 +1,5 @@
+import { buildQueryStringFromParams } from "utilities/url";
+
 import { IPolicy } from "../interfaces/policy";
 import URL_PREFIX from "./url_prefix";
 
@@ -26,20 +28,25 @@ export default {
   DASHBOARD_IOS: `${URL_PREFIX}/dashboard/ios`,
   DASHBOARD_IPADOS: `${URL_PREFIX}/dashboard/ipados`,
 
-  // Admin pages
+  /**
+   * Admin pages
+   */
+
   ADMIN_SETTINGS: `${URL_PREFIX}/settings`,
   ADMIN_USERS: `${URL_PREFIX}/settings/users`,
+
+  // Integrations pages
   ADMIN_INTEGRATIONS: `${URL_PREFIX}/settings/integrations`,
   ADMIN_INTEGRATIONS_TICKET_DESTINATIONS: `${URL_PREFIX}/settings/integrations/ticket-destinations`,
   ADMIN_INTEGRATIONS_MDM: `${URL_PREFIX}/settings/integrations/mdm`,
   ADMIN_INTEGRATIONS_MDM_APPLE: `${URL_PREFIX}/settings/integrations/mdm/apple`,
   ADMIN_INTEGRATIONS_MDM_WINDOWS: `${URL_PREFIX}/settings/integrations/mdm/windows`,
-  ADMIN_INTEGRATIONS_AUTOMATIC_ENROLLMENT: `${URL_PREFIX}/settings/integrations/automatic-enrollment`,
-  ADMIN_INTEGRATIONS_AUTOMATIC_ENROLLMENT_APPLE: `${URL_PREFIX}/settings/integrations/automatic-enrollment/apple`,
+  ADMIN_INTEGRATIONS_APPLE_BUSINESS_MANAGER: `${URL_PREFIX}/settings/integrations/mdm/abm`,
   ADMIN_INTEGRATIONS_AUTOMATIC_ENROLLMENT_WINDOWS: `${URL_PREFIX}/settings/integrations/automatic-enrollment/windows`,
   ADMIN_INTEGRATIONS_CALENDARS: `${URL_PREFIX}/settings/integrations/calendars`,
-  ADMIN_INTEGRATIONS_VPP: `${URL_PREFIX}/settings/integrations/vpp`,
+  ADMIN_INTEGRATIONS_VPP: `${URL_PREFIX}/settings/integrations/mdm/vpp`,
   ADMIN_INTEGRATIONS_VPP_SETUP: `${URL_PREFIX}/settings/integrations/vpp/setup`,
+
   ADMIN_TEAMS: `${URL_PREFIX}/settings/teams`,
   ADMIN_ORGANIZATION: `${URL_PREFIX}/settings/organization`,
   ADMIN_ORGANIZATION_INFO: `${URL_PREFIX}/settings/organization/info`,
@@ -90,10 +97,17 @@ export default {
       teamId ? `?team_id=${teamId}` : ""
     }`;
   },
-  LIVE_QUERY: (queryId: number | null, teamId?: number): string => {
-    return `${URL_PREFIX}/queries/${queryId || "new"}/live${
-      teamId ? `?team_id=${teamId}` : ""
-    }`;
+  LIVE_QUERY: (
+    queryId: number | null,
+    teamId?: number,
+    hostId?: number
+  ): string => {
+    const baseUrl = `${URL_PREFIX}/queries/${queryId || "new"}/live`;
+    const queryParams = buildQueryStringFromParams({
+      team_id: teamId,
+      host_id: hostId,
+    });
+    return queryParams ? `${baseUrl}?${queryParams}` : baseUrl;
   },
   QUERY_DETAILS: (queryId: number, teamId?: number): string => {
     return `${URL_PREFIX}/queries/${queryId}${
@@ -102,7 +116,7 @@ export default {
   },
   EDIT_POLICY: (policy: IPolicy): string => {
     return `${URL_PREFIX}/policies/${policy.id}${
-      policy.team_id ? `?team_id=${policy.team_id}` : ""
+      policy.team_id !== undefined ? `?team_id=${policy.team_id}` : ""
     }`;
   },
   FORGOT_PASSWORD: `${URL_PREFIX}/login/forgot`,
diff --git a/frontend/services/entities/hosts.ts b/frontend/services/entities/hosts.ts
index ba7e0dc7ab..5a5c625f0c 100644
--- a/frontend/services/entities/hosts.ts
+++ b/frontend/services/entities/hosts.ts
@@ -12,7 +12,7 @@ import {
 import {
   IHostSoftware,
   ISoftware,
-  SoftwareInstallStatus,
+  SoftwareAggregateStatus,
 } from "interfaces/software";
 import {
   DiskEncryptionStatus,
@@ -72,7 +72,7 @@ export interface ILoadHostsOptions {
   softwareId?: number;
   softwareTitleId?: number;
   softwareVersionId?: number;
-  softwareStatus?: SoftwareInstallStatus;
+  softwareStatus?: SoftwareAggregateStatus;
   status?: HostStatus;
   mdmId?: number;
   mdmEnrollmentStatus?: string;
@@ -103,7 +103,7 @@ export interface IExportHostsOptions {
   softwareId?: number;
   softwareTitleId?: number;
   softwareVersionId?: number;
-  softwareStatus?: SoftwareInstallStatus;
+  softwareStatus?: SoftwareAggregateStatus;
   status?: HostStatus;
   mdmId?: number;
   munkiIssueId?: number;
@@ -133,7 +133,7 @@ export interface IActionByFilter {
   softwareId?: number | null;
   softwareTitleId?: number | null;
   softwareVersionId?: number | null;
-  softwareStatus?: SoftwareInstallStatus;
+  softwareStatus?: SoftwareAggregateStatus;
   osName?: string;
   osVersion?: string;
   osVersionId?: number | null;
@@ -590,4 +590,11 @@ export default {
       HOST_SOFTWARE_PACKAGE_INSTALL(hostId, softwareId)
     );
   },
+  uninstallHostSoftwarePackage: (hostId: number, softwareId: number) => {
+    const { HOST_SOFTWARE_PACKAGE_UNINSTALL } = endpoints;
+    return sendRequest(
+      "POST",
+      HOST_SOFTWARE_PACKAGE_UNINSTALL(hostId, softwareId)
+    );
+  },
 };
diff --git a/frontend/services/entities/labels.ts b/frontend/services/entities/labels.ts
index 7a58cb9a04..5ce8d04938 100644
--- a/frontend/services/entities/labels.ts
+++ b/frontend/services/entities/labels.ts
@@ -49,6 +49,28 @@ const generateCreateLabelBody = (
 
 const generateUpdateLabelBody = generateCreateLabelBody;
 
+/** gets the custom label and returns them in case-insensitive alphabetical
+ * ascending order by label name. (e.g. [A, B, C, a, b, c] => [A, a, B, b, C, c])
+ */
+export const getCustomLabels = <T extends { label_type: string; name: string }>(
+  labels: T[]
+) => {
+  if (labels.length === 0) {
+    return [];
+  }
+
+  return labels
+    .filter((label) => label.label_type === "regular")
+    .sort((a, b) => {
+      // Found this technique here
+      // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/localeCompare
+      // This is a case insensitive sort
+      return a.name.localeCompare(b.name, undefined, {
+        sensitivity: "base",
+      });
+    });
+};
+
 export default {
   create: (
     formData: IDynamicLabelFormData | IManualLabelFormData
diff --git a/frontend/services/entities/mdm_apple.ts b/frontend/services/entities/mdm_apple.ts
index 34ea85747f..4a50779df4 100644
--- a/frontend/services/entities/mdm_apple.ts
+++ b/frontend/services/entities/mdm_apple.ts
@@ -1,3 +1,4 @@
+import { IMdmVppToken } from "interfaces/mdm";
 import { ApplePlatform } from "interfaces/platform";
 import sendRequest from "services";
 import endpoints from "utilities/endpoints";
@@ -18,10 +19,27 @@ export interface IVppApp {
   platform: ApplePlatform;
 }
 
+interface IAddVppAppPostBody {
+  app_store_id: string;
+  team_id: number;
+  platform: ApplePlatform;
+  self_service?: boolean;
+}
+
 export interface IGetVppAppsResponse {
   app_store_apps: IVppApp[];
 }
 
+export interface IGetVppTokensResponse {
+  vpp_tokens: IMdmVppToken[];
+}
+
+export interface IUploadVppTokenReponse {
+  vpp_token: IMdmVppToken;
+}
+
+export type IRenewVppTokenResponse = IUploadVppTokenReponse;
+
 export default {
   getAppleAPNInfo: () => {
     const { MDM_APPLE_PNS } = endpoints;
@@ -46,18 +64,6 @@ export default {
     return sendRequest("GET", MDM_REQUEST_CSR);
   },
 
-  getVppInfo: (): Promise<IGetVppInfoResponse> => {
-    const { MDM_APPLE_VPP } = endpoints;
-    return sendRequest("GET", MDM_APPLE_VPP);
-  },
-
-  uploadVppToken: (token: File) => {
-    const { MDM_APPLE_VPP_TOKEN } = endpoints;
-    const formData = new FormData();
-    formData.append("token", token);
-    return sendRequest("POST", MDM_APPLE_VPP_TOKEN, formData);
-  },
-
   disableVpp: () => {
     const { MDM_APPLE_VPP_TOKEN } = endpoints;
     return sendRequest("DELETE", MDM_APPLE_VPP_TOKEN);
@@ -69,12 +75,58 @@ export default {
     return sendRequest("GET", path);
   },
 
-  addVppApp: (teamId: number, appStoreId: string, platform: ApplePlatform) => {
+  addVppApp: (
+    teamId: number,
+    appStoreId: string,
+    platform: ApplePlatform,
+    isSelfService: boolean
+  ) => {
     const { MDM_APPLE_VPP_APPS } = endpoints;
-    return sendRequest("POST", MDM_APPLE_VPP_APPS, {
+    const postBody: IAddVppAppPostBody = {
       app_store_id: appStoreId,
       team_id: teamId,
       platform,
-    });
+    };
+
+    if (isSelfService) {
+      postBody.self_service = isSelfService;
+    }
+
+    return sendRequest("POST", MDM_APPLE_VPP_APPS, postBody);
+  },
+
+  getVppTokens: (): Promise<IGetVppTokensResponse> => {
+    const { MDM_VPP_TOKENS } = endpoints;
+    return sendRequest("GET", MDM_VPP_TOKENS);
+  },
+
+  uploadVppToken: (token: File): Promise<IUploadVppTokenReponse> => {
+    const { MDM_VPP_TOKENS } = endpoints;
+    const formData = new FormData();
+    formData.append("token", token);
+    return sendRequest("POST", MDM_VPP_TOKENS, formData);
+  },
+
+  renewVppToken(id: number, token: File): Promise<IRenewVppTokenResponse> {
+    const { MDM_VPP_TOKENS_RENEW } = endpoints;
+    const path = MDM_VPP_TOKENS_RENEW(id);
+    const formData = new FormData();
+    formData.append("token", token);
+    return sendRequest("PATCH", path, formData);
+  },
+
+  deleteVppToken: (id: number): Promise<void> => {
+    const { MDM_VPP_TOKEN } = endpoints;
+    const path = MDM_VPP_TOKEN(id);
+    return sendRequest("DELETE", path);
+  },
+
+  editVppTeams: async (params: {
+    tokenId: number;
+    teamIds: number[] | null;
+  }) => {
+    const { MDM_VPP_TOKEN_TEAMS } = endpoints;
+    const path = MDM_VPP_TOKEN_TEAMS(params.tokenId);
+    return sendRequest("PATCH", path, { teams: params.teamIds });
   },
 };
diff --git a/frontend/services/entities/mdm_apple_bm.ts b/frontend/services/entities/mdm_apple_bm.ts
index b963bd1d64..f00ad36a4b 100644
--- a/frontend/services/entities/mdm_apple_bm.ts
+++ b/frontend/services/entities/mdm_apple_bm.ts
@@ -1,4 +1,5 @@
 /* eslint-disable @typescript-eslint/explicit-module-boundary-types */
+import { IMdmAbmToken } from "interfaces/mdm";
 import sendRequest from "services";
 import endpoints from "utilities/endpoints";
 
@@ -14,6 +15,14 @@ export interface IGetAppleBMInfoResponse {
   renew_date: string;
 }
 
+export interface IGetAbmTokensResponse {
+  abm_tokens: IMdmAbmToken[];
+}
+
+export interface IAbmTokenResponse {
+  abm_token: IMdmAbmToken;
+}
+
 export default {
   getAppleBMInfo: (): Promise<IGetAppleBMInfoResponse> => {
     const { MDM_APPLE_BM } = endpoints;
@@ -46,16 +55,45 @@ export default {
     return sendRequest("GET", MDM_APPLE_ABM_PUBLIC_KEY);
   },
 
-  uploadToken: (token: File) => {
-    const { MDM_APPLE_ABM_TOKEN: MDM_APPLE_BM_TOKEN } = endpoints;
+  uploadToken: (token: File): Promise<IMdmAbmToken> => {
+    const { MDM_ABM_TOKENS } = endpoints;
     const formData = new FormData();
     formData.append("token", token);
 
-    return sendRequest("POST", MDM_APPLE_BM_TOKEN, formData);
+    return sendRequest("POST", MDM_ABM_TOKENS, formData);
   },
 
-  disableAutomaticEnrollment: () => {
-    const { MDM_APPLE_ABM_TOKEN: MDM_APPLE_BM_TOKEN } = endpoints;
-    return sendRequest("DELETE", MDM_APPLE_BM_TOKEN);
+  renewToken: (id: number, token: File): Promise<IAbmTokenResponse> => {
+    const { MDM_ABM_TOKEN_RENEW } = endpoints;
+    const path = MDM_ABM_TOKEN_RENEW(id);
+
+    const formData = new FormData();
+    formData.append("token", token);
+
+    return sendRequest("PATCH", path, formData);
+  },
+
+  deleteToken: (id: number): Promise<void> => {
+    const { MDM_ABM_TOKEN } = endpoints;
+    const path = MDM_ABM_TOKEN(id);
+    return sendRequest("DELETE", path);
+  },
+
+  getTokens: (): Promise<IGetAbmTokensResponse> => {
+    const { MDM_ABM_TOKENS } = endpoints;
+    return sendRequest("GET", MDM_ABM_TOKENS);
+  },
+
+  editTeams: async (params: {
+    tokenId: number;
+    teams: {
+      ios_team_id: number;
+      ipados_team_id: number;
+      macos_team_id: number;
+    };
+  }) => {
+    const { MDM_ABM_TOKEN_TEAMS } = endpoints;
+    const path = MDM_ABM_TOKEN_TEAMS(params.tokenId);
+    return sendRequest("PATCH", path, params.teams);
   },
 };
diff --git a/frontend/services/entities/scripts.ts b/frontend/services/entities/scripts.ts
index 8ed35f9a17..6f5792cd25 100644
--- a/frontend/services/entities/scripts.ts
+++ b/frontend/services/entities/scripts.ts
@@ -39,6 +39,7 @@ export interface IScriptResultResponse {
   message: string;
   runtime: number;
   host_timeout: boolean;
+  created_at: string;
 }
 
 /**
diff --git a/frontend/services/entities/software.ts b/frontend/services/entities/software.ts
index ecb4d98847..b244f6de4d 100644
--- a/frontend/services/entities/software.ts
+++ b/frontend/services/entities/software.ts
@@ -1,5 +1,3 @@
-import { AxiosResponse } from "axios";
-
 import sendRequest from "services";
 import endpoints from "utilities/endpoints";
 import {
@@ -13,7 +11,7 @@ import {
   buildQueryStringFromParams,
   convertParamsToSnakeCase,
 } from "utilities/url";
-import { IAddSoftwareFormData } from "pages/SoftwarePage/components/AddPackageForm/AddSoftwareForm";
+import { IPackageFormData } from "pages/SoftwarePage/components/PackageForm/PackageForm";
 
 export interface ISoftwareApiParams {
   page?: number;
@@ -22,7 +20,11 @@ export interface ISoftwareApiParams {
   orderDirection?: "asc" | "desc";
   query?: string;
   vulnerable?: boolean;
+  max_cvss_score?: number;
+  min_cvss_score?: number;
+  exploit?: boolean;
   availableForInstall?: boolean;
+  packagesOnly?: boolean;
   selfService?: boolean;
   teamId?: number;
 }
@@ -56,10 +58,14 @@ export interface ISoftwareVersionResponse {
 }
 
 export interface ISoftwareVersionsQueryKey extends ISoftwareApiParams {
+  // used to trigger software refetches from sibling pages
+  addedSoftwareToken: string | null;
   scope: "software-versions";
 }
 
 export interface ISoftwareTitlesQueryKey extends ISoftwareApiParams {
+  // used to trigger software refetches from sibling pages
+  addedSoftwareToken?: string | null;
   scope: "software-titles";
 }
 
@@ -92,6 +98,10 @@ export interface IGetSoftwareVersionQueryKey
   scope: "softwareVersion";
 }
 
+export interface ISoftwareInstallTokenResponse {
+  token: string;
+}
+
 const ORDER_KEY = "name";
 const ORDER_DIRECTION = "asc";
 
@@ -195,7 +205,7 @@ export default {
   },
 
   addSoftwarePackage: (
-    data: IAddSoftwareFormData,
+    data: IPackageFormData,
     teamId?: number,
     timeout?: number
   ) => {
@@ -209,8 +219,10 @@ export default {
     formData.append("software", data.software);
     formData.append("self_service", data.selfService.toString());
     data.installScript && formData.append("install_script", data.installScript);
-    data.preInstallCondition &&
-      formData.append("pre_install_query", data.preInstallCondition);
+    data.uninstallScript &&
+      formData.append("uninstall_script", data.uninstallScript);
+    data.preInstallQuery &&
+      formData.append("pre_install_query", data.preInstallQuery);
     data.postInstallScript &&
       formData.append("post_install_script", data.postInstallScript);
     teamId && formData.append("team_id", teamId.toString());
@@ -224,7 +236,32 @@ export default {
       true
     );
   },
+  editSoftwarePackage: (
+    data: IPackageFormData,
+    softwareId: number,
+    teamId: number,
+    timeout?: number
+  ) => {
+    const { EDIT_SOFTWARE_PACKAGE } = endpoints;
 
+    const formData = new FormData();
+    formData.append("team_id", teamId.toString());
+    data.software && formData.append("software", data.software);
+    formData.append("self_service", data.selfService.toString());
+    formData.append("install_script", data.installScript);
+    formData.append("pre_install_query", data.preInstallQuery || "");
+    formData.append("post_install_script", data.postInstallScript || "");
+    formData.append("uninstall_script", data.uninstallScript || "");
+
+    return sendRequest(
+      "PATCH",
+      EDIT_SOFTWARE_PACKAGE(softwareId),
+      formData,
+      undefined,
+      timeout,
+      true
+    );
+  },
   deleteSoftwarePackage: (softwareId: number, teamId: number) => {
     const { SOFTWARE_AVAILABLE_FOR_INSTALL } = endpoints;
     const path = `${SOFTWARE_AVAILABLE_FOR_INSTALL(
@@ -233,23 +270,15 @@ export default {
     return sendRequest("DELETE", path);
   },
 
-  downloadSoftwarePackage: (
+  getSoftwarePackageToken: (
     softwareTitleId: number,
     teamId: number
-  ): Promise<AxiosResponse> => {
-    const path = `${endpoints.SOFTWARE_PACKAGE(
+  ): Promise<ISoftwareInstallTokenResponse> => {
+    const path = `${endpoints.SOFTWARE_PACKAGE_TOKEN(
       softwareTitleId
     )}?${buildQueryStringFromParams({ alt: "media", team_id: teamId })}`;
 
-    return sendRequest(
-      "GET",
-      path,
-      undefined,
-      "blob",
-      undefined,
-      undefined,
-      true // return raw response
-    );
+    return sendRequest("POST", path);
   },
 
   getSoftwareInstallResult: (installUuid: string) => {
diff --git a/frontend/services/entities/team_policies.ts b/frontend/services/entities/team_policies.ts
index a10d954e8b..5da02ad3fc 100644
--- a/frontend/services/entities/team_policies.ts
+++ b/frontend/services/entities/team_policies.ts
@@ -86,6 +86,7 @@ export default {
       platform,
       critical,
       calendar_events_enabled,
+      software_title_id,
     } = data;
     const { TEAMS } = endpoints;
     const path = `${TEAMS}/${team_id}/policies/${id}`;
@@ -98,10 +99,11 @@ export default {
       platform,
       critical,
       calendar_events_enabled,
+      software_title_id,
     });
   },
   destroy: (teamId: number | undefined, ids: number[]) => {
-    if (!teamId || teamId <= API_NO_TEAM_ID) {
+    if (teamId === undefined || teamId < API_NO_TEAM_ID) {
       return Promise.reject(
         new Error(
           `Invalid team id: ${teamId} must be greater than ${API_NO_TEAM_ID}`
@@ -121,10 +123,6 @@ export default {
   loadAll: (team_id?: number): Promise<ILoadTeamPoliciesResponse> => {
     const { TEAMS } = endpoints;
     const path = `${TEAMS}/${team_id}/policies`;
-    if (!team_id) {
-      throw new Error("Invalid team id");
-    }
-
     return sendRequest("GET", path);
   },
   loadAllNew: async ({
@@ -150,10 +148,6 @@ export default {
     const snakeCaseParams = convertParamsToSnakeCase(queryParams);
     const queryString = buildQueryStringFromParams(snakeCaseParams);
     const path = `${TEAMS}/${teamId}/policies?${queryString}`;
-    if (!teamId) {
-      throw new Error("Invalid team id");
-    }
-
     return sendRequest("GET", path);
   },
   getCount: async ({
diff --git a/frontend/services/entities/vulnerabilities.ts b/frontend/services/entities/vulnerabilities.ts
index fbad6c5f80..baadb559bd 100644
--- a/frontend/services/entities/vulnerabilities.ts
+++ b/frontend/services/entities/vulnerabilities.ts
@@ -85,6 +85,13 @@ const getVulnerability = ({
   return sendRequest("GET", path);
 };
 
+export type IVulnerabilitiesEmptyStateReason =
+  | "unknown-cve"
+  | "invalid-cve"
+  | "known-vuln"
+  | "no-matching-items"
+  | "no-vulns-detected";
+
 export default {
   getVulnerabilities,
   getVulnerability,
diff --git a/frontend/styles/byod.css b/frontend/styles/byod.css
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/frontend/styles/var/mixins.scss b/frontend/styles/var/mixins.scss
index df8714f0ce..31bb7259bd 100644
--- a/frontend/styles/var/mixins.scss
+++ b/frontend/styles/var/mixins.scss
@@ -132,6 +132,9 @@ $max-width: 2560px;
   font-size: $xx-small;
   font-weight: $regular;
   @include grey-text;
+  .custom-link {
+    font-size: inherit;
+  }
 }
 
 @mixin link {
diff --git a/frontend/templates/enroll-ota.html b/frontend/templates/enroll-ota.html
new file mode 100644
index 0000000000..bb3853ecdf
--- /dev/null
+++ b/frontend/templates/enroll-ota.html
@@ -0,0 +1,200 @@
+<html>
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <meta name="robots" content="noindex" />
+    <link rel="shortcut icon" href="{{.URLPrefix}}/assets/favicon.ico" />
+    <title>Fleet</title>
+    <style>
+      @font-face {
+        font-family: "Inter";
+        font-weight: 400;
+        src: url("../assets/fonts/inter/Inter-Regular.woff2") format("woff2"),
+          url("../assets/fonts/inter/Inter-Regular.woff") format("woff");
+      }
+      @font-face {
+        font-family: "Inter";
+        font-weight: 700;
+        src: url("../assets/fonts/inter/Inter-Bold.woff2") format("woff2"),
+          url("../assets/fonts/inter/Inter-Bold.woff") format("woff");
+      }
+
+      html {
+        box-sizing: border-box;
+        font-family: "Inter", sans-serif;
+        color: #192147;
+      }
+
+      *,
+      *:before,
+      *:after {
+        box-sizing: inherit;
+      }
+
+      body,
+      h1,
+      p {
+        margin: 0;
+      }
+
+      .download-link {
+        color: #fff;
+        background-color: #6a67fe;
+        padding: 8px 16px;
+        border-radius: 4px;
+        text-decoration: none;
+        font-weight: 700;
+        font-size: 14px;
+        width: 100px;
+        line-height: 21px;
+      }
+
+      header {
+        background-color: #192147;
+        padding: 13px 20px;
+      }
+
+      h1 {
+        margin-bottom: 8px;
+      }
+
+      p {
+        font-size: 14px;
+      }
+
+      ol {
+        display: flex;
+        flex-direction: column;
+        gap: 48px;
+        list-style: none;
+        padding: 0;
+      }
+
+      li {
+        display: flex;
+        flex-direction: column;
+        gap: 20px;
+      }
+
+      li > p {
+        display: flex;
+        gap: 4px;
+      }
+
+      .page-description {
+        font-size: 16px;
+        margin-bottom: 48px;
+      }
+
+      .profile-downloaded-container,
+      .install-profile-container {
+        width: 100%;
+        background-color: #f9fafc;
+        text-align: center;
+      }
+
+      .profile-downloaded-img,
+      .install-profile-img {
+        max-width: 100%;
+      }
+
+      .profile-downloaded-img {
+        max-height: 150px;
+      }
+
+      .install-profile-img {
+        max-height: 118px;
+      }
+
+      #main-content {
+        padding: 48px 24px;
+      }
+    </style>
+  </head>
+  <body>
+    <header>
+      <img src="{{.URLPrefix}}/assets/images/fleet-logo.svg" />
+    </header>
+    <section id="main-content">
+      <h1>
+        Enroll your
+        <span data-attribute="dynamic-device-type">iPhone or iPad</span> to
+        Fleet
+      </h1>
+      <p class="page-description">
+        On your
+        <span data-attribute="dynamic-device-type">iPhone or iPad</span>, follow
+        the instructions below to download and install the Fleet profile.
+      </p>
+      <ol>
+        <li>
+          <p>
+            <span>1.</span>
+            <span>
+              <b>Download</b> the Fleet profile and select <b>Allow</b> in the
+              pop-up.
+            </span>
+          </p>
+          <a class="download-link" href="{{.EnrollURL}}">Download</a>
+        </li>
+        <li>
+          <p>
+            <span>2.</span>
+            <span>
+              Navigate to <b>Settings</b> and select <b>Profile Downloaded</b>.
+            </span>
+          </p>
+          <div class="profile-downloaded-container">
+            <img
+              class="profile-downloaded-img"
+              src=""
+              alt="select profile downloaded in settings"
+            />
+          </div>
+        </li>
+        <li>
+          <p>
+            <span>3.</span>
+            <span>Select <b>Install</b>.</span>
+          </p>
+          <div class="install-profile-container">
+            <img class="install-profile-img" src="" alt="select install" />
+          </div>
+        </li>
+      </ol>
+    </section>
+    <script>
+      document.addEventListener("DOMContentLoaded", function () {
+        const userAgent = navigator.userAgent;
+        const isIPhone = /iPhone/.test(userAgent);
+        const isIPad =
+          /iPad/.test(userAgent) ||
+          (/Macintosh/i.test(navigator.userAgent) &&
+            navigator.maxTouchPoints &&
+            navigator.maxTouchPoints > 1);
+
+        // update text content for device type
+        let deviceType = "iPhone or iPad";
+        if (isIPhone) {
+          deviceType = "iPhone";
+        } else if (isIPad) {
+          deviceType = "iPad";
+        }
+        document
+          .querySelectorAll('[data-attribute="dynamic-device-type"]')
+          .forEach((el) => {
+            el.textContent = deviceType;
+          });
+
+        // update image src based on OS
+        const osImagePrefix = isIPhone ? "ios" : "iPadOS";
+        document.querySelector(
+          ".profile-downloaded-img"
+        ).src = `{{.URLPrefix}}/assets/images/${osImagePrefix}-profile-downloaded.png`;
+        document.querySelector(
+          ".install-profile-img"
+        ).src = `{{.URLPrefix}}/assets/images/${osImagePrefix}-install-profile.png`;
+      });
+    </script>
+  </body>
+</html>
diff --git a/frontend/test/test-utils.tsx b/frontend/test/test-utils.tsx
index ce7bde4298..5e4e089889 100644
--- a/frontend/test/test-utils.tsx
+++ b/frontend/test/test-utils.tsx
@@ -171,3 +171,17 @@ export const createMockRouter = (overrides?: Partial<InjectedRouter>) => {
     ...overrides,
   };
 };
+
+/** helper method to generate a date "x" days ago. */
+export const getPastDate = (days: number) => {
+  const targetDate = new Date();
+  targetDate.setDate(targetDate.getDate() - days);
+  return targetDate.toISOString();
+};
+
+/** helper method to generate a date "x" days from now */
+export const getFutureDate = (days: number) => {
+  const targetDate = new Date();
+  targetDate.setDate(targetDate.getDate() + days);
+  return targetDate.toISOString();
+};
diff --git a/frontend/utilities/constants.tsx b/frontend/utilities/constants.tsx
index c8c9128317..4b780aebc9 100644
--- a/frontend/utilities/constants.tsx
+++ b/frontend/utilities/constants.tsx
@@ -60,9 +60,13 @@ export const HOST_STATUS_WEBHOOK_WINDOW_DROPDOWN_OPTIONS: IDropdownOption[] = [
 export const GITHUB_NEW_ISSUE_LINK =
   "https://github.com/fleetdm/fleet/issues/new?assignees=&labels=bug%2C%3Areproduce&template=bug-report.md";
 
-export const SUPPORT_LINK = "https://fleetdm.com/support";
+export const FLEET_WEBSITE_URL = "https://fleetdm.com";
 
-export const CONTACT_FLEET_LINK = "https://fleetdm.com/contact";
+export const SUPPORT_LINK = `${FLEET_WEBSITE_URL}/support`;
+
+export const CONTACT_FLEET_LINK = `${FLEET_WEBSITE_URL}/contact`;
+
+export const LEARN_MORE_ABOUT_BASE_LINK = `${FLEET_WEBSITE_URL}/learn-more-about`;
 
 /**  July 28, 2016 is the date of the initial commit to fleet/fleet. */
 export const INITIAL_FLEET_DATE = "2016-07-28T00:00:00Z";
@@ -307,6 +311,9 @@ export const HOSTS_SEARCH_BOX_PLACEHOLDER =
 export const HOSTS_SEARCH_BOX_TOOLTIP =
   "Search hosts by name, hostname, UUID, serial number, or private IP address";
 
+export const VULNERABILITIES_SEARCH_BOX_TOOLTIP =
+  'To search for an exact CVE, surround the string in double quotes (e.g. "CVE-2024-1234")';
+
 // Keys from API
 export const MDM_STATUS_TOOLTIP: Record<string, string | React.ReactNode> = {
   "On (automatic)": (
diff --git a/frontend/utilities/date_format/date_format.tests.ts b/frontend/utilities/date_format/date_format.tests.ts
index 102f34d048..b39d0d1eeb 100644
--- a/frontend/utilities/date_format/date_format.tests.ts
+++ b/frontend/utilities/date_format/date_format.tests.ts
@@ -1,6 +1,6 @@
-import { uploadedFromNow } from ".";
+import { monthDayYearFormat, uploadedFromNow } from ".";
 
-describe("date_format", () => {
+describe("date_format utilities", () => {
   describe("uploadedFromNow util", () => {
     it("returns an user friendly uploaded at message", () => {
       const currentDate = new Date();
@@ -10,4 +10,11 @@ describe("date_format", () => {
       expect(uploadedFromNow(twoDaysAgo)).toEqual("Uploaded 2 days ago");
     });
   });
+
+  describe("monthDayYearFormat util", () => {
+    it("returns a date in the format of 'MonthName Date, Year' (e.g. January 01, 2024)", () => {
+      const date = "2024-11-29T00:00:00Z";
+      expect(monthDayYearFormat(date)).toEqual("November 29, 2024");
+    });
+  });
 });
diff --git a/frontend/utilities/date_format/index.ts b/frontend/utilities/date_format/index.ts
index 329d977dba..538c3a827d 100644
--- a/frontend/utilities/date_format/index.ts
+++ b/frontend/utilities/date_format/index.ts
@@ -1,4 +1,4 @@
-import { formatDistanceToNow } from "date-fns";
+import { format, formatDistanceToNow, intlFormat } from "date-fns";
 
 /** Utility to create a string from a date in this format:
   `Uploaded .... ago`
@@ -15,3 +15,11 @@ export const dateAgo = (date: string) => {
   // NOTE: Malformed dates will result in errors. This is expected "fail loudly" behavior.
   return `${formatDistanceToNow(new Date(date))} ago`;
 };
+
+/**
+ * returns a date in the format of 'MonthName Date, Year'
+ * @example "January 01, 2024"
+ */
+export const monthDayYearFormat = (date: string) => {
+  return format(date, "MMMM d, yyyy");
+};
diff --git a/frontend/utilities/endpoints.ts b/frontend/utilities/endpoints.ts
index 92553ada42..29524b4c31 100644
--- a/frontend/utilities/endpoints.ts
+++ b/frontend/utilities/endpoints.ts
@@ -52,7 +52,9 @@ export default {
     `/${API_VERSION}/fleet/hosts/${hostId}/configuration_profiles/resend/${profileUUID}`,
   HOST_SOFTWARE: (id: number) => `/${API_VERSION}/fleet/hosts/${id}/software`,
   HOST_SOFTWARE_PACKAGE_INSTALL: (hostId: number, softwareId: number) =>
-    `/${API_VERSION}/fleet/hosts/${hostId}/software/install/${softwareId}`,
+    `/${API_VERSION}/fleet/hosts/${hostId}/software/${softwareId}/install`,
+  HOST_SOFTWARE_PACKAGE_UNINSTALL: (hostId: number, softwareId: number) =>
+    `/${API_VERSION}/fleet/hosts/${hostId}/software/${softwareId}/uninstall`,
 
   INVITES: `/${API_VERSION}/fleet/invites`,
 
@@ -71,21 +73,38 @@ export default {
   LOGOUT: `/${API_VERSION}/fleet/logout`,
   MACADMINS: `/${API_VERSION}/fleet/macadmins`,
 
-  // MDM endpoints
+  /**
+   * MDM endpoints
+   */
+
+  MDM_SUMMARY: `/${API_VERSION}/fleet/hosts/summary/mdm`,
+
+  // apple mdm endpoints
   MDM_APPLE: `/${API_VERSION}/fleet/mdm/apple`,
-  MDM_APPLE_ABM_TOKEN: `/${API_VERSION}/fleet/mdm/apple/abm_token`,
+
+  // Apple Business Manager (ABM) endpoints
+  MDM_ABM_TOKENS: `/${API_VERSION}/fleet/abm_tokens`,
+  MDM_ABM_TOKEN: (id: number) => `/${API_VERSION}/fleet/abm_tokens/${id}`,
+  MDM_ABM_TOKEN_RENEW: (id: number) =>
+    `/${API_VERSION}/fleet/abm_tokens/${id}/renew`,
+  MDM_ABM_TOKEN_TEAMS: (id: number) =>
+    `/${API_VERSION}/fleet/abm_tokens/${id}/teams`,
   MDM_APPLE_ABM_PUBLIC_KEY: `/${API_VERSION}/fleet/mdm/apple/abm_public_key`,
   MDM_APPLE_APNS_CERTIFICATE: `/${API_VERSION}/fleet/mdm/apple/apns_certificate`,
   MDM_APPLE_PNS: `/${API_VERSION}/fleet/apns`,
-  MDM_APPLE_BM: `/${API_VERSION}/fleet/abm`,
+  MDM_APPLE_BM: `/${API_VERSION}/fleet/abm`, // TODO: Deprecated?
   MDM_APPLE_BM_KEYS: `/${API_VERSION}/fleet/mdm/apple/dep/key_pair`,
   MDM_APPLE_VPP_APPS: `/${API_VERSION}/fleet/software/app_store_apps`,
-  MDM_SUMMARY: `/${API_VERSION}/fleet/hosts/summary/mdm`,
   MDM_REQUEST_CSR: `/${API_VERSION}/fleet/mdm/apple/request_csr`,
 
   // Apple VPP endpoints
-  MDM_APPLE_VPP: `/${API_VERSION}/fleet/vpp`,
-  MDM_APPLE_VPP_TOKEN: `/${API_VERSION}/fleet/mdm/apple/vpp_token`,
+  MDM_APPLE_VPP_TOKEN: `/${API_VERSION}/fleet/mdm/apple/vpp_token`, // TODO: Deprecated?
+  MDM_VPP_TOKENS: `/${API_VERSION}/fleet/vpp_tokens`,
+  MDM_VPP_TOKEN: (id: number) => `/${API_VERSION}/fleet/vpp_tokens/${id}`,
+  MDM_VPP_TOKENS_RENEW: (id: number) =>
+    `/${API_VERSION}/fleet/vpp_tokens/${id}/renew`,
+  MDM_VPP_TOKEN_TEAMS: (id: number) =>
+    `/${API_VERSION}/fleet/vpp_tokens/${id}/teams`,
 
   // MDM profile endpoints
   MDM_PROFILES: `/${API_VERSION}/fleet/mdm/profiles`,
@@ -141,14 +160,16 @@ export default {
   SOFTWARE: `/${API_VERSION}/fleet/software`,
   SOFTWARE_TITLES: `/${API_VERSION}/fleet/software/titles`,
   SOFTWARE_TITLE: (id: number) => `/${API_VERSION}/fleet/software/titles/${id}`,
+  EDIT_SOFTWARE_PACKAGE: (id: number) =>
+    `/${API_VERSION}/fleet/software/titles/${id}/package`,
   SOFTWARE_VERSIONS: `/${API_VERSION}/fleet/software/versions`,
   SOFTWARE_VERSION: (id: number) =>
     `/${API_VERSION}/fleet/software/versions/${id}`,
   SOFTWARE_PACKAGE_ADD: `/${API_VERSION}/fleet/software/package`,
-  SOFTWARE_PACKAGE: (id: number) =>
-    `/${API_VERSION}/fleet/software/${id}/package`,
+  SOFTWARE_PACKAGE_TOKEN: (id: number) =>
+    `/${API_VERSION}/fleet/software/titles/${id}/package/token`,
   SOFTWARE_INSTALL_RESULTS: (uuid: string) =>
-    `/${API_VERSION}/fleet/software/install/results/${uuid}`,
+    `/${API_VERSION}/fleet/software/install/${uuid}/results`,
   SOFTWARE_PACKAGE_INSTALL: (id: number) =>
     `/${API_VERSION}/fleet/software/packages/${id}`,
   SOFTWARE_AVAILABLE_FOR_INSTALL: (id: number) =>
diff --git a/frontend/utilities/helpers.tests.tsx b/frontend/utilities/helpers.tests.tsx
index 3efbeb3a3b..f7acfa7944 100644
--- a/frontend/utilities/helpers.tests.tsx
+++ b/frontend/utilities/helpers.tests.tsx
@@ -1,4 +1,9 @@
-import { removeOSPrefix, compareVersions } from "./helpers";
+import { getPastDate, getFutureDate } from "test/test-utils";
+import {
+  removeOSPrefix,
+  compareVersions,
+  willExpireWithinXDays,
+} from "./helpers";
 
 describe("helpers utilities", () => {
   describe("removeOSPrefix function", () => {
@@ -46,4 +51,30 @@ describe("helpers utilities", () => {
       expect(compareVersions("14", "14.0.0")).toEqual(0);
     });
   });
+
+  describe("willExpireWithinXDays function", () => {
+    it("will return true if the date is within x number of days", () => {
+      const fiveDaysFromNow = getFutureDate(5);
+      expect(willExpireWithinXDays(fiveDaysFromNow, 10)).toEqual(true);
+
+      const tenDaysFromNow = getFutureDate(10);
+      expect(willExpireWithinXDays(tenDaysFromNow, 30)).toEqual(true);
+    });
+
+    it("will return false if the date is not within x number of days", () => {
+      const thirtyDaysFromNow = getFutureDate(30);
+      expect(willExpireWithinXDays(thirtyDaysFromNow, 10)).toEqual(false);
+
+      const fiftyDaysFromNow = getFutureDate(50);
+      expect(willExpireWithinXDays(fiftyDaysFromNow, 30)).toEqual(false);
+    });
+
+    it("will return false if the date has already expired", () => {
+      const fiveDaysAgo = getPastDate(5);
+      expect(willExpireWithinXDays(fiveDaysAgo, 10)).toEqual(false);
+
+      const fiftyDaysAgo = getPastDate(50);
+      expect(willExpireWithinXDays(fiftyDaysAgo, 30)).toEqual(false);
+    });
+  });
 });
diff --git a/frontend/utilities/helpers.tsx b/frontend/utilities/helpers.tsx
index efd67bb371..49f0022383 100644
--- a/frontend/utilities/helpers.tsx
+++ b/frontend/utilities/helpers.tsx
@@ -11,6 +11,7 @@ import {
   trim,
   trimEnd,
   union,
+  uniqueId,
 } from "lodash";
 import md5 from "js-md5";
 import {
@@ -722,13 +723,17 @@ export const hasLicenseExpired = (expiration: string): boolean => {
   return isAfter(new Date(), new Date(expiration));
 };
 
-export const willExpireWithinXDays = (
-  expiration: string,
-  x: number
-): boolean => {
+/**
+ * determines if a date will expire within "x" number of days. If the date has
+ * has already expired, this function will return false.
+ */
+export const willExpireWithinXDays = (expiration: string, x: number) => {
   const xDaysFromNow = addDays(new Date(), x);
 
-  return isAfter(xDaysFromNow, new Date(expiration));
+  return (
+    !hasLicenseExpired(expiration) &&
+    isAfter(xDaysFromNow, new Date(expiration))
+  );
 };
 
 export const readableDate = (date: string) => {
@@ -821,6 +826,17 @@ export const syntaxHighlight = (json: any): string => {
   /* eslint-enable no-useless-escape */
 };
 
+export const tooltipTextWithLineBreaks = (lines: string[]) => {
+  return lines.map((line) => {
+    return (
+      <span key={uniqueId()}>
+        {line}
+        <br />
+      </span>
+    );
+  });
+};
+
 export const getSortedTeamOptions = memoize((teams: ITeam[]) =>
   teams
     .map((team) => {
diff --git a/frontend/utilities/software_install_scripts.ts b/frontend/utilities/software_install_scripts.ts
index 5bc59c6763..5c21e8a1f4 100644
--- a/frontend/utilities/software_install_scripts.ts
+++ b/frontend/utilities/software_install_scripts.ts
@@ -11,7 +11,7 @@ import installDeb from "../../pkg/file/scripts/install_deb.sh";
  * getInstallScript returns a string with a script to install the
  * provided software.
  * */
-const getInstallScript = (fileName: string): string => {
+const getDefaultInstallScript = (fileName: string): string => {
   const extension = fileName.split(".").pop();
   switch (extension) {
     case "pkg":
@@ -27,4 +27,4 @@ const getInstallScript = (fileName: string): string => {
   }
 };
 
-export default getInstallScript;
+export default getDefaultInstallScript;
diff --git a/frontend/utilities/software_uninstall_scripts.ts b/frontend/utilities/software_uninstall_scripts.ts
new file mode 100644
index 0000000000..041d2519c4
--- /dev/null
+++ b/frontend/utilities/software_uninstall_scripts.ts
@@ -0,0 +1,30 @@
+// @ts-ignore
+import uninstallPkg from "../../pkg/file/scripts/uninstall_pkg.sh";
+// @ts-ignore
+import uninstallMsi from "../../pkg/file/scripts/uninstall_msi.ps1";
+// @ts-ignore
+import uninstallExe from "../../pkg/file/scripts/uninstall_exe.ps1";
+// @ts-ignore
+import uninstallDeb from "../../pkg/file/scripts/uninstall_deb.sh";
+
+/*
+ * getUninstallScript returns a string with a script to uninstall the
+ * provided software.
+ * */
+const getDefaultUninstallScript = (fileName: string): string => {
+  const extension = fileName.split(".").pop();
+  switch (extension) {
+    case "pkg":
+      return uninstallPkg;
+    case "msi":
+      return uninstallMsi;
+    case "deb":
+      return uninstallDeb;
+    case "exe":
+      return uninstallExe;
+    default:
+      throw new Error(`unsupported file extension: ${extension}`);
+  }
+};
+
+export default getDefaultUninstallScript;
diff --git a/frontend/utilities/strings/stringUtils.tests.ts b/frontend/utilities/strings/stringUtils.tests.ts
index 25755873ff..4ebc69c632 100644
--- a/frontend/utilities/strings/stringUtils.tests.ts
+++ b/frontend/utilities/strings/stringUtils.tests.ts
@@ -1,4 +1,10 @@
-import { enforceFleetSentenceCasing, pluralize } from "./stringUtils";
+import {
+  enforceFleetSentenceCasing,
+  pluralize,
+  strToBool,
+  stripQuotes,
+  isIncompleteQuoteQuery,
+} from "./stringUtils";
 
 describe("string utilities", () => {
   describe("enforceFleetSentenceCasing utility", () => {
@@ -44,4 +50,45 @@ describe("string utilities", () => {
       expect(pluralize(100, "hero")).toEqual("heros");
     });
   });
+
+  describe("strToBool utility", () => {
+    it("converts 'true' to true and 'false' to false", () => {
+      expect(strToBool("true")).toBe(true);
+      expect(strToBool("false")).toBe(false);
+    });
+
+    it("returns false for undefined, null, or empty string", () => {
+      expect(strToBool(undefined)).toBe(false);
+      expect(strToBool(null)).toBe(false);
+      expect(strToBool("")).toBe(false);
+    });
+  });
+
+  describe("stripQuotes utility", () => {
+    it("removes matching single or double quotes from the start and end of a string", () => {
+      expect(stripQuotes('"Hello, World!"')).toEqual("Hello, World!");
+      expect(stripQuotes("'Hello, World!'")).toEqual("Hello, World!");
+    });
+    it("does not modify a string without quotes or mismatched quotes", () => {
+      expect(stripQuotes("No quotes here")).toEqual("No quotes here");
+      expect(stripQuotes(`'Mismatched quotes"`)).toEqual(`'Mismatched quotes"`);
+    });
+  });
+
+  describe("isIncompleteQuoteQuery utility", () => {
+    it("returns true for a string starting with a quote but not ending with one", () => {
+      expect(isIncompleteQuoteQuery('"incomplete')).toBe(true);
+      expect(isIncompleteQuoteQuery("'incomplete")).toBe(true);
+    });
+
+    it("returns false for a string with matching quotes", () => {
+      expect(isIncompleteQuoteQuery('"complete"')).toBe(false);
+      expect(isIncompleteQuoteQuery("'complete'")).toBe(false);
+    });
+
+    it("returns false for a string without any quotes or an empty string", () => {
+      expect(isIncompleteQuoteQuery("no quotes")).toBe(false);
+      expect(isIncompleteQuoteQuery("")).toBe(false);
+    });
+  });
 });
diff --git a/frontend/utilities/strings/stringUtils.ts b/frontend/utilities/strings/stringUtils.ts
index 6d0c8756fe..7a679b933b 100644
--- a/frontend/utilities/strings/stringUtils.ts
+++ b/frontend/utilities/strings/stringUtils.ts
@@ -75,8 +75,30 @@ export const pluralize = (
   return `${root}${count !== 1 ? pluralSuffix : singularSuffix}`;
 };
 
+export const strToBool = (str?: string | null) => {
+  return str ? JSON.parse(str) : false;
+};
+
+export const stripQuotes = (string: string) => {
+  // Regular expression to match quotes at the start and end of the string
+  const quoteRegex = /^([''""])([\s\S]*?)(\1)$/;
+
+  // If the string matches the regex, return the content between the quotes
+  // Otherwise, return the original string
+  const match = string.match(quoteRegex);
+  return match ? match[2] : string;
+};
+
+export const isIncompleteQuoteQuery = (str: string) => {
+  const pattern = /^(['"])(?!.*\1$)/;
+  return pattern.test(str);
+};
+
 export default {
   capitalize,
   capitalizeRole,
   pluralize,
+  strToBool,
+  stripQuotes,
+  isIncompleteQuoteQuery,
 };
diff --git a/frontend/utilities/url/index.ts b/frontend/utilities/url/index.ts
index b8f274ee17..cf827047b7 100644
--- a/frontend/utilities/url/index.ts
+++ b/frontend/utilities/url/index.ts
@@ -9,9 +9,10 @@ import {
   HOSTS_QUERY_PARAMS,
   MacSettingsStatusQueryParam,
 } from "services/entities/hosts";
-import { isValidSoftwareInstallStatus } from "interfaces/software";
+import { isValidSoftwareAggregateStatus } from "interfaces/software";
+import { API_ALL_TEAMS_ID } from "interfaces/team";
 
-type QueryValues = string | number | boolean | undefined | null;
+export type QueryValues = string | number | boolean | undefined | null;
 export type QueryParams = Record<string, QueryValues>;
 type FilteredQueryValues = string | number | boolean;
 type FilteredQueryParams = Record<string, FilteredQueryValues>;
@@ -45,6 +46,30 @@ interface IMutuallyExclusiveHostParams {
   bootstrapPackageStatus?: BootstrapPackageStatus;
 }
 
+export const parseQueryValueToNumberOrUndefined = (
+  value: QueryValues,
+  min?: number,
+  max?: number
+): number | undefined => {
+  const isWithinRange = (num: number) => {
+    if (min !== undefined && max !== undefined) {
+      return num >= min && num <= max;
+    }
+    return true; // No range check if min or max is undefined
+  };
+
+  if (typeof value === "number") {
+    return isWithinRange(value) ? value : undefined;
+  }
+  if (typeof value === "string") {
+    const parsedValue = parseFloat(value);
+    return !isNaN(parsedValue) && isWithinRange(parsedValue)
+      ? parsedValue
+      : undefined;
+  }
+  return undefined;
+};
+
 const reduceQueryParams = (
   params: string[],
   value: FilteredQueryValues,
@@ -95,10 +120,9 @@ export const reconcileSoftwareParams = ({
   | "softwareStatus"
 >) => {
   if (
-    isValidSoftwareInstallStatus(softwareStatus) &&
+    isValidSoftwareAggregateStatus(softwareStatus) &&
     softwareTitleId &&
-    teamId &&
-    teamId > 0
+    teamId !== API_ALL_TEAMS_ID
   ) {
     return {
       software_title_id: softwareTitleId,
diff --git a/go.mod b/go.mod
index f735a2244b..0dd27931fb 100644
--- a/go.mod
+++ b/go.mod
@@ -1,9 +1,9 @@
 module github.com/fleetdm/fleet/v4
 
-go 1.22.4
+go 1.23.1
 
 require (
-	cloud.google.com/go/pubsub v1.36.1
+	cloud.google.com/go/pubsub v1.37.0
 	fyne.io/systray v1.10.1-0.20240111184411-11c585fff98d
 	github.com/AbGuthrie/goquery/v2 v2.0.1
 	github.com/DATA-DOG/go-sqlmock v1.5.0
@@ -14,11 +14,12 @@ require (
 	github.com/XSAM/otelsql v0.10.0
 	github.com/andygrunwald/go-jira v1.16.0
 	github.com/antchfx/xmlquery v1.3.14
+	github.com/apex/log v1.9.0
 	github.com/aws/aws-sdk-go v1.44.288
 	github.com/beevik/etree v1.3.0
 	github.com/beevik/ntp v0.3.0
 	github.com/blakesmith/ar v0.0.0-20190502131153-809d4375e1fb
-	github.com/briandowns/spinner v1.13.0
+	github.com/briandowns/spinner v1.23.1
 	github.com/cenkalti/backoff v2.2.1+incompatible
 	github.com/cenkalti/backoff/v4 v4.3.0
 	github.com/clbanning/mxj v1.8.4
@@ -26,7 +27,7 @@ require (
 	github.com/davecgh/go-spew v1.1.1
 	github.com/dgraph-io/badger/v2 v2.2007.4
 	github.com/digitalocean/go-smbios v0.0.0-20180907143718-390a4f403a8e
-	github.com/docker/docker v26.1.4+incompatible
+	github.com/docker/docker v26.1.5+incompatible
 	github.com/docker/go-units v0.5.0
 	github.com/doug-martin/goqu/v9 v9.18.0
 	github.com/e-dard/netbug v0.0.0-20151029172837-e64d308a0b20
@@ -65,7 +66,7 @@ require (
 	github.com/kevinburke/go-bindata v3.24.0+incompatible
 	github.com/kolide/launcher v1.0.12
 	github.com/lib/pq v1.10.9
-	github.com/macadmins/osquery-extension v1.1.3-0.20240530154548-05bb97403086
+	github.com/macadmins/osquery-extension v1.2.1
 	github.com/mattermost/xml-roundtrip-validator v0.0.0-20201213122252-bcd7e1b9601e
 	github.com/mattn/go-sqlite3 v1.14.22
 	github.com/micromdm/micromdm v1.9.0
@@ -89,11 +90,12 @@ require (
 	github.com/rs/zerolog v1.32.0
 	github.com/russellhaering/goxmldsig v1.2.0
 	github.com/saferwall/pe v1.5.2
-	github.com/sassoftware/relic/v7 v7.6.2
+	github.com/sassoftware/relic/v8 v8.0.1
 	github.com/scjalliance/comshim v0.0.0-20230315213746-5e51f40bd3b9
 	github.com/sethvargo/go-password v0.3.0
 	github.com/shirou/gopsutil/v3 v3.24.3
 	github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966
+	github.com/smallstep/pkcs7 v0.0.0-20240723090913-5e2c6a136dfa
 	github.com/spf13/cast v1.4.1
 	github.com/spf13/cobra v1.8.0
 	github.com/spf13/viper v1.10.0
@@ -101,7 +103,7 @@ require (
 	github.com/theupdateframework/go-tuf v0.5.2
 	github.com/throttled/throttled/v2 v2.8.0
 	github.com/tj/assert v0.0.3
-	github.com/ulikunitz/xz v0.5.11
+	github.com/ulikunitz/xz v0.5.12
 	github.com/urfave/cli/v2 v2.23.5
 	github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8
 	github.com/ziutek/mymysql v1.5.4
@@ -109,7 +111,6 @@ require (
 	go.elastic.co/apm/module/apmsql/v2 v2.4.3
 	go.elastic.co/apm/v2 v2.4.3
 	go.etcd.io/bbolt v1.3.9
-	go.mozilla.org/pkcs7 v0.0.0-20210826202110-33d05740a352
 	go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux v0.44.0
 	go.opentelemetry.io/otel v1.28.0
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.28.0
@@ -125,7 +126,7 @@ require (
 	golang.org/x/sys v0.21.0
 	golang.org/x/text v0.16.0
 	golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d
-	google.golang.org/api v0.169.0
+	google.golang.org/api v0.178.0
 	google.golang.org/grpc v1.64.1
 	gopkg.in/guregu/null.v3 v3.5.0
 	gopkg.in/ini.v1 v1.67.0
@@ -136,11 +137,13 @@ require (
 )
 
 require (
-	cloud.google.com/go v0.112.1 // indirect
+	cloud.google.com/go v0.112.2 // indirect
+	cloud.google.com/go/auth v0.3.0 // indirect
+	cloud.google.com/go/auth/oauth2adapt v0.2.2 // indirect
 	cloud.google.com/go/compute/metadata v0.3.0 // indirect
-	cloud.google.com/go/iam v1.1.6 // indirect
-	cloud.google.com/go/kms v1.15.7 // indirect
-	cloud.google.com/go/storage v1.38.0 // indirect
+	cloud.google.com/go/iam v1.1.8 // indirect
+	cloud.google.com/go/kms v1.15.9 // indirect
+	cloud.google.com/go/storage v1.39.1 // indirect
 	code.gitea.io/sdk/gitea v0.15.0 // indirect
 	dario.cat/mergo v1.0.0 // indirect
 	github.com/AlekSi/pointer v1.2.0 // indirect
@@ -166,29 +169,28 @@ require (
 	github.com/Masterminds/sprig v2.22.0+incompatible // indirect
 	github.com/Microsoft/go-winio v0.6.2 // indirect
 	github.com/OneOfOne/xxhash v1.2.8 // indirect
-	github.com/ProtonMail/go-crypto v0.0.0-20230828082145-3c4c8a2d2371 // indirect
+	github.com/ProtonMail/go-crypto v1.0.0 // indirect
 	github.com/agnivade/levenshtein v1.1.1 // indirect
 	github.com/akavel/rsrc v0.10.2 // indirect
 	github.com/alecthomas/jsonschema v0.0.0-20211022214203-8b29eab41725 // indirect
 	github.com/antchfx/xpath v1.2.2 // indirect
 	github.com/apache/thrift v0.18.1 // indirect
-	github.com/apex/log v1.9.0 // indirect
 	github.com/armon/go-radix v1.0.0 // indirect
 	github.com/atc0005/go-teams-notify/v2 v2.6.0 // indirect
-	github.com/aws/aws-sdk-go-v2 v1.24.1 // indirect
-	github.com/aws/aws-sdk-go-v2/config v1.26.6 // indirect
-	github.com/aws/aws-sdk-go-v2/credentials v1.16.16 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.14.11 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.2.10 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.5.10 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/ini v1.7.3 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.10.4 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.10.10 // indirect
-	github.com/aws/aws-sdk-go-v2/service/kms v1.27.9 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.18.7 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.21.7 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.26.7 // indirect
-	github.com/aws/smithy-go v1.19.0 // indirect
+	github.com/aws/aws-sdk-go-v2 v1.26.1 // indirect
+	github.com/aws/aws-sdk-go-v2/config v1.27.11 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.17.11 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.1 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.5 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.5 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.2 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.7 // indirect
+	github.com/aws/aws-sdk-go-v2/service/kms v1.31.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.20.5 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.23.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.28.6 // indirect
+	github.com/aws/smithy-go v1.20.2 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/c-bata/go-prompt v0.2.3 // indirect
 	github.com/caarlos0/ctrlc v1.0.0 // indirect
@@ -197,7 +199,7 @@ require (
 	github.com/cavaliercoder/go-cpio v0.0.0-20180626203310-925f9528c45e // indirect
 	github.com/cespare/xxhash v1.1.0 // indirect
 	github.com/cespare/xxhash/v2 v2.2.0 // indirect
-	github.com/cloudflare/circl v1.3.7 // indirect
+	github.com/cloudflare/circl v1.3.8 // indirect
 	github.com/containerd/log v0.1.0 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.3 // indirect
 	github.com/cyphar/filepath-securejoin v0.2.4 // indirect
@@ -236,7 +238,7 @@ require (
 	github.com/google/s2a-go v0.1.7 // indirect
 	github.com/google/wire v0.5.0 // indirect
 	github.com/googleapis/enterprise-certificate-proxy v0.3.2 // indirect
-	github.com/googleapis/gax-go/v2 v2.12.2 // indirect
+	github.com/googleapis/gax-go/v2 v2.12.4 // indirect
 	github.com/goreleaser/chglog v0.1.2 // indirect
 	github.com/goreleaser/fileglob v1.2.0 // indirect
 	github.com/gorilla/schema v1.4.1 // indirect
@@ -257,7 +259,7 @@ require (
 	github.com/joeshaw/multierror v0.0.0-20140124173710-69b34d4ec901 // indirect
 	github.com/jonboulle/clockwork v0.2.2 // indirect
 	github.com/kevinburke/ssh_config v1.2.0 // indirect
-	github.com/klauspost/compress v1.17.7 // indirect
+	github.com/klauspost/compress v1.17.8 // indirect
 	github.com/kolide/kit v0.0.0-20221107170827-fb85e3d59eab // indirect
 	github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 // indirect
 	github.com/magiconair/properties v1.8.5 // indirect
@@ -272,7 +274,7 @@ require (
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
-	github.com/opencontainers/image-spec v1.1.0-rc6 // indirect
+	github.com/opencontainers/image-spec v1.1.0 // indirect
 	github.com/oschwald/maxminddb-golang v1.10.0 // indirect
 	github.com/pelletier/go-toml v1.9.4 // indirect
 	github.com/pjbgf/sha1cd v0.3.0 // indirect
@@ -308,6 +310,7 @@ require (
 	github.com/yusufpapurcu/wmi v1.2.4 // indirect
 	go.elastic.co/apm/module/apmhttp/v2 v2.3.0 // indirect
 	go.elastic.co/fastjson v1.1.0 // indirect
+	go.mozilla.org/pkcs7 v0.0.0-20210826202110-33d05740a352 // indirect
 	go.opencensus.io v0.24.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.49.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.49.0 // indirect
@@ -320,7 +323,7 @@ require (
 	golang.org/x/term v0.21.0 // indirect
 	golang.org/x/time v0.5.0 // indirect
 	golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 // indirect
-	google.golang.org/genproto v0.0.0-20240213162025-012b6fc9bca9 // indirect
+	google.golang.org/genproto v0.0.0-20240506185236-b8a5c65736ae // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20240701130421-f6361c86f094 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20240701130421-f6361c86f094 // indirect
 	google.golang.org/protobuf v1.34.2 // indirect
diff --git a/go.sum b/go.sum
index 7eceaae2aa..f6cb680a80 100644
--- a/go.sum
+++ b/go.sum
@@ -31,8 +31,12 @@ cloud.google.com/go v0.92.2/go.mod h1:8utlLll2EF5XMAV15woO4lSbWQlk8rer9aLOfLh7+Y
 cloud.google.com/go v0.92.3/go.mod h1:8utlLll2EF5XMAV15woO4lSbWQlk8rer9aLOfLh7+YI=
 cloud.google.com/go v0.93.3/go.mod h1:8utlLll2EF5XMAV15woO4lSbWQlk8rer9aLOfLh7+YI=
 cloud.google.com/go v0.94.0/go.mod h1:qAlAugsXlC+JWO+Bke5vCtc9ONxjQT3drlTTnAplMW4=
-cloud.google.com/go v0.112.1 h1:uJSeirPke5UNZHIb4SxfZklVSiWWVqW4oXlETwZziwM=
-cloud.google.com/go v0.112.1/go.mod h1:+Vbu+Y1UU+I1rjmzeMOb/8RfkKJK2Gyxi1X6jJCZLo4=
+cloud.google.com/go v0.112.2 h1:ZaGT6LiG7dBzi6zNOvVZwacaXlmf3lRqnC4DQzqyRQw=
+cloud.google.com/go v0.112.2/go.mod h1:iEqjp//KquGIJV/m+Pk3xecgKNhV+ry+vVTsy4TbDms=
+cloud.google.com/go/auth v0.3.0 h1:PRyzEpGfx/Z9e8+lHsbkoUVXD0gnu4MNmm7Gp8TQNIs=
+cloud.google.com/go/auth v0.3.0/go.mod h1:lBv6NKTWp8E3LPzmO1TbiiRKc4drLOfHsgmlH9ogv5w=
+cloud.google.com/go/auth/oauth2adapt v0.2.2 h1:+TTV8aXpjeChS9M+aTtN/TjdQnzJvmzKFt//oWu7HX4=
+cloud.google.com/go/auth/oauth2adapt v0.2.2/go.mod h1:wcYjgpZI9+Yu7LyYBg4pqSiaRkfEK3GQcpb7C/uyF1Q=
 cloud.google.com/go/bigquery v1.0.1/go.mod h1:i/xbL2UlR5RvWAURpBYZTtm/cXjCha9lbfbpx4poX+o=
 cloud.google.com/go/bigquery v1.3.0/go.mod h1:PjpwJnslEMmckchkHFfq+HTD2DmtT67aNFKH1/VBDHE=
 cloud.google.com/go/bigquery v1.4.0/go.mod h1:S8dzgnTigyfTmLBfrtrhyYhwRxG72rYxvftPBK2Dvzc=
@@ -45,19 +49,19 @@ cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7
 cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1b3c64qFpCk=
 cloud.google.com/go/firestore v1.1.0/go.mod h1:ulACoGHTpvq5r8rxGJ4ddJZBZqakUQqClKRT5SZwBmk=
 cloud.google.com/go/firestore v1.5.0/go.mod h1:c4nNYR1qdq7eaZ+jSc5fonrQN2k3M7sWATcYTiakjEo=
-cloud.google.com/go/iam v1.1.6 h1:bEa06k05IO4f4uJonbB5iAgKTPpABy1ayxaIZV/GHVc=
-cloud.google.com/go/iam v1.1.6/go.mod h1:O0zxdPeGBoFdWW3HWmBxJsk0pfvNM/p/qa82rWOGTwI=
+cloud.google.com/go/iam v1.1.8 h1:r7umDwhj+BQyz0ScZMp4QrGXjSTI3ZINnpgU2nlB/K0=
+cloud.google.com/go/iam v1.1.8/go.mod h1:GvE6lyMmfxXauzNq8NbgJbeVQNspG+tcdL/W8QO1+zE=
 cloud.google.com/go/kms v0.1.0/go.mod h1:8Qp8PCAypHg4FdmlyW1QRAv09BGQ9Uzh7JnmIZxPk+c=
-cloud.google.com/go/kms v1.15.7 h1:7caV9K3yIxvlQPAcaFffhlT7d1qpxjB1wHBtjWa13SM=
-cloud.google.com/go/kms v1.15.7/go.mod h1:ub54lbsa6tDkUwnu4W7Yt1aAIFLnspgh0kPGToDukeI=
+cloud.google.com/go/kms v1.15.9 h1:ouZjTxCqDNEdxWfaAAbRzG22s/2iewRw6JPARQL+0vc=
+cloud.google.com/go/kms v1.15.9/go.mod h1:5v/R/RRuBUVO+eJioGcqENr3syh8ZqNn1y1Wc9DjM+4=
 cloud.google.com/go/monitoring v0.1.0/go.mod h1:Hpm3XfzJv+UTiXzCG5Ffp0wijzHTC7Cv4eR7o3x/fEE=
 cloud.google.com/go/pubsub v1.0.1/go.mod h1:R0Gpsv3s54REJCy4fxDixWD93lHJMoZTyQ2kNxGRt3I=
 cloud.google.com/go/pubsub v1.1.0/go.mod h1:EwwdRX2sKPjnvnqCa270oGRyludottCI76h+R3AArQw=
 cloud.google.com/go/pubsub v1.2.0/go.mod h1:jhfEVHT8odbXTkndysNHCcx0awwzvfOlguIAii9o8iA=
 cloud.google.com/go/pubsub v1.3.1/go.mod h1:i+ucay31+CNRpDW4Lu78I4xXG+O1r/MAHgjpRVR+TSU=
 cloud.google.com/go/pubsub v1.16.0/go.mod h1:6A8EfoWZ/lUvCWStKGwAWauJZSiuV0Mkmu6WilK/TxQ=
-cloud.google.com/go/pubsub v1.36.1 h1:dfEPuGCHGbWUhaMCTHUFjfroILEkx55iUmKBZTP5f+Y=
-cloud.google.com/go/pubsub v1.36.1/go.mod h1:iYjCa9EzWOoBiTdd4ps7QoMtMln5NwaZQpK1hbRfBDE=
+cloud.google.com/go/pubsub v1.37.0 h1:0uEEfaB1VIJzabPpwpZf44zWAKAme3zwKKxHk7vJQxQ=
+cloud.google.com/go/pubsub v1.37.0/go.mod h1:YQOQr1uiUM092EXwKs56OPT650nwnawc+8/IjoUeGzQ=
 cloud.google.com/go/secretmanager v0.1.0/go.mod h1:3nGKHvnzDUVit7U0S9KAKJ4aOsO1xtwRG+7ey5LK1bM=
 cloud.google.com/go/storage v1.0.0/go.mod h1:IhtSnM/ZTZV8YYJWCY8RULGVqBDmpoyjwiyrjsg+URw=
 cloud.google.com/go/storage v1.5.0/go.mod h1:tpKbwo567HUNpVclU5sGELwQWBDZ8gh0ZeosJ0Rtdos=
@@ -65,8 +69,8 @@ cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohl
 cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RXyy7KQOVs=
 cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0=
 cloud.google.com/go/storage v1.16.1/go.mod h1:LaNorbty3ehnU3rEjXSNV/NRgQA0O8Y+uh6bPe5UOk4=
-cloud.google.com/go/storage v1.38.0 h1:Az68ZRGlnNTpIBbLjSMIV2BDcwwXYlRlQzis0llkpJg=
-cloud.google.com/go/storage v1.38.0/go.mod h1:tlUADB0mAb9BgYls9lq+8MGkfzOXuLrnHXlpHmvFJoY=
+cloud.google.com/go/storage v1.39.1 h1:MvraqHKhogCOTXTlct/9C3K3+Uy2jBmFYb3/Sp6dVtY=
+cloud.google.com/go/storage v1.39.1/go.mod h1:xK6xZmxZmo+fyP7+DEF6FhNc24/JAe95OLyOHCXFH1o=
 cloud.google.com/go/trace v0.1.0/go.mod h1:wxEwsoeRVPbeSkt7ZC9nWCgmoKQRAoySN7XHW2AmI7g=
 code.gitea.io/gitea-vet v0.2.1/go.mod h1:zcNbT/aJEmivCAhfmkHOlT645KNOf9W2KnkLgFjGGfE=
 code.gitea.io/sdk/gitea v0.15.0 h1:tsNhxDM/2N1Ohv1Xq5UWrht/esg0WmtRj4wsHVHriTg=
@@ -174,8 +178,8 @@ github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA
 github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
 github.com/OneOfOne/xxhash v1.2.8 h1:31czK/TI9sNkxIKfaUfGlU47BAxQ0ztGgd9vPyqimf8=
 github.com/OneOfOne/xxhash v1.2.8/go.mod h1:eZbhyaAYD41SGSSsnmcpxVoRiQ/MPUTjUdIIOT9Um7Q=
-github.com/ProtonMail/go-crypto v0.0.0-20230828082145-3c4c8a2d2371 h1:kkhsdkhsCvIsutKu5zLMgWtgh9YxGCNAw8Ad8hjwfYg=
-github.com/ProtonMail/go-crypto v0.0.0-20230828082145-3c4c8a2d2371/go.mod h1:EjAoLdwvbIOoOQr3ihjnSoLZRtE8azugULFRteWMNc0=
+github.com/ProtonMail/go-crypto v1.0.0 h1:LRuvITjQWX+WIfr930YHG2HNfjR1uOfyf5vE0kC2U78=
+github.com/ProtonMail/go-crypto v1.0.0/go.mod h1:EjAoLdwvbIOoOQr3ihjnSoLZRtE8azugULFRteWMNc0=
 github.com/ProtonMail/go-mime v0.0.0-20190923161245-9b5a4261663a h1:W6RrgN/sTxg1msqzFFb+G80MFmpjMw61IU+slm+wln4=
 github.com/ProtonMail/go-mime v0.0.0-20190923161245-9b5a4261663a/go.mod h1:NYt+V3/4rEeDuaev/zw1zCq8uqVEuPHzDPo3OZrlGJ4=
 github.com/ProtonMail/gopenpgp/v2 v2.2.2 h1:u2m7xt+CZWj88qK1UUNBoXeJCFJwJCZ/Ff4ymGoxEXs=
@@ -243,45 +247,45 @@ github.com/aws/aws-sdk-go v1.40.34/go.mod h1:585smgzpB/KqRA+K3y/NL/oYRqQvpNJYvLm
 github.com/aws/aws-sdk-go v1.44.288 h1:Ln7fIao/nl0ACtelgR1I4AiEw/GLNkKcXfCaHupUW5Q=
 github.com/aws/aws-sdk-go v1.44.288/go.mod h1:aVsgQcEevwlmQ7qHE9I3h+dtQgpqhFB+i8Phjh7fkwI=
 github.com/aws/aws-sdk-go-v2 v1.9.0/go.mod h1:cK/D0BBs0b/oWPIcX/Z/obahJK1TT7IPVjy53i/mX/4=
-github.com/aws/aws-sdk-go-v2 v1.24.1 h1:xAojnj+ktS95YZlDf0zxWBkbFtymPeDP+rvUQIH3uAU=
-github.com/aws/aws-sdk-go-v2 v1.24.1/go.mod h1:LNh45Br1YAkEKaAqvmE1m8FUx6a5b/V0oAKV7of29b4=
+github.com/aws/aws-sdk-go-v2 v1.26.1 h1:5554eUqIYVWpU0YmeeYZ0wU64H2VLBs8TlhRB2L+EkA=
+github.com/aws/aws-sdk-go-v2 v1.26.1/go.mod h1:ffIFB97e2yNsv4aTSGkqtHnppsIJzw7G7BReUZ3jCXM=
 github.com/aws/aws-sdk-go-v2/config v1.7.0/go.mod h1:w9+nMZ7soXCe5nT46Ri354SNhXDQ6v+V5wqDjnZE+GY=
-github.com/aws/aws-sdk-go-v2/config v1.26.6 h1:Z/7w9bUqlRI0FFQpetVuFYEsjzE3h7fpU6HuGmfPL/o=
-github.com/aws/aws-sdk-go-v2/config v1.26.6/go.mod h1:uKU6cnDmYCvJ+pxO9S4cWDb2yWWIH5hra+32hVh1MI4=
+github.com/aws/aws-sdk-go-v2/config v1.27.11 h1:f47rANd2LQEYHda2ddSCKYId18/8BhSRM4BULGmfgNA=
+github.com/aws/aws-sdk-go-v2/config v1.27.11/go.mod h1:SMsV78RIOYdve1vf36z8LmnszlRWkwMQtomCAI0/mIE=
 github.com/aws/aws-sdk-go-v2/credentials v1.4.0/go.mod h1:dgGR+Qq7Wjcd4AOAW5Rf5Tnv3+x7ed6kETXyS9WCuAY=
-github.com/aws/aws-sdk-go-v2/credentials v1.16.16 h1:8q6Rliyv0aUFAVtzaldUEcS+T5gbadPbWdV1WcAddK8=
-github.com/aws/aws-sdk-go-v2/credentials v1.16.16/go.mod h1:UHVZrdUsv63hPXFo1H7c5fEneoVo9UXiz36QG1GEPi0=
+github.com/aws/aws-sdk-go-v2/credentials v1.17.11 h1:YuIB1dJNf1Re822rriUOTxopaHHvIq0l/pX3fwO+Tzs=
+github.com/aws/aws-sdk-go-v2/credentials v1.17.11/go.mod h1:AQtFPsDH9bI2O+71anW6EKL+NcD7LG3dpKGMV4SShgo=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.5.0/go.mod h1:CpNzHK9VEFUCknu50kkB8z58AH2B5DvPP7ea1LHve/Y=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.14.11 h1:c5I5iH+DZcH3xOIMlz3/tCKJDaHFwYEmxvlh2fAcFo8=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.14.11/go.mod h1:cRrYDYAMUohBJUtUnOhydaMHtiK/1NZ0Otc9lIb6O0Y=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.2.10 h1:vF+Zgd9s+H4vOXd5BMaPWykta2a6Ih0AKLq/X6NYKn4=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.2.10/go.mod h1:6BkRjejp/GR4411UGqkX8+wFMbFbqsUIimfK4XjOKR4=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.5.10 h1:nYPe006ktcqUji8S2mqXf9c/7NdiKriOwMvWQHgYztw=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.5.10/go.mod h1:6UV4SZkVvmODfXKql4LCbaZUpF7HO2BX38FgBf9ZOLw=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.1 h1:FVJ0r5XTHSmIHJV6KuDmdYhEpvlHpiSd38RQWhut5J4=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.1/go.mod h1:zusuAeqezXzAB24LGuzuekqMAEgWkVYukBec3kr3jUg=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.5 h1:aw39xVGeRWlWx9EzGVnhOR4yOjQDHPQ6o6NmBlscyQg=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.5/go.mod h1:FSaRudD0dXiMPK2UjknVwwTYyZMRsHv3TtkabsZih5I=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.5 h1:PG1F3OD1szkuQPzDw3CIQsRIrtTlUC3lP84taWzHlq0=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.5/go.mod h1:jU1li6RFryMz+so64PpKtudI+QzbKoIEivqdf6LNpOc=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.2.2/go.mod h1:BQV0agm+JEhqR+2RT5e1XTFIDcAAV0eW6z2trp+iduw=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.7.3 h1:n3GDfwqF2tzEkXlv5cuy4iy7LpKDtqDMcNLfZDu9rls=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.7.3/go.mod h1:6fQQgfuGmw8Al/3M2IgIllycxV7ZW7WCdVSqfBeUiCY=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.10.4 h1:/b31bi3YVNlkzkBrm9LfpaKoaYZUxIAj4sHfOTmLfqw=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.10.4/go.mod h1:2aGXHFmbInwgP9ZfpmdIfOELL79zhdNYNmReK8qDfdQ=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0 h1:hT8rVHwugYE2lEfdFE0QWVo81lF7jMrYJVDWI+f+VxU=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0/go.mod h1:8tu/lYfQfFe6IGnaOdrpVgEL2IrrDOf6/m9RQum4NkY=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.2 h1:Ji0DY1xUsUr3I8cHps0G+XM3WWU16lP6yG8qu1GAZAs=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.2/go.mod h1:5CsjAbs3NlGQyZNFACh+zztPDI7fU6eW9QsxjfnuBKg=
 github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.3.0/go.mod h1:R1KK+vY8AfalhG1AOu5e35pOD2SdoPKQCFLTvnxiohk=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.10.10 h1:DBYTXwIGQSGs9w4jKm60F5dmCQ3EEruxdc0MFh+3EY4=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.10.10/go.mod h1:wohMUQiFdzo0NtxbBg0mSRGZ4vL3n0dKjLTINdcIino=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.7 h1:ogRAwT1/gxJBcSWDMZlgyFUM962F51A5CRhDLbxLdmo=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.7/go.mod h1:YCsIZhXfRPLFFCl5xxY+1T9RKzOKjCut+28JSX2DnAk=
 github.com/aws/aws-sdk-go-v2/service/kms v1.5.0/go.mod h1:w7JuP9Oq1IKMFQPkNe3V6s9rOssXzOVEMNEqK1L1bao=
-github.com/aws/aws-sdk-go-v2/service/kms v1.27.9 h1:W9PbZAZAEcelhhjb7KuwUtf+Lbc+i7ByYJRuWLlnxyQ=
-github.com/aws/aws-sdk-go-v2/service/kms v1.27.9/go.mod h1:2tFmR7fQnOdQlM2ZCEPpFnBIQD1U8wmXmduBgZbOag0=
+github.com/aws/aws-sdk-go-v2/service/kms v1.31.0 h1:yl7wcqbisxPzknJVfWTLnK83McUvXba+pz2+tPbIUmQ=
+github.com/aws/aws-sdk-go-v2/service/kms v1.31.0/go.mod h1:2snWQJQUKsbN66vAawJuOGX7dr37pfOq9hb0tZDGIqQ=
 github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.6.0/go.mod h1:B+7C5UKdVq1ylkI/A6O8wcurFtaux0R1njePNPtKwoA=
 github.com/aws/aws-sdk-go-v2/service/ssm v1.10.0/go.mod h1:4dXS5YNqI3SNbetQ7X7vfsMlX6ZnboJA2dulBwJx7+g=
 github.com/aws/aws-sdk-go-v2/service/sso v1.4.0/go.mod h1:+1fpWnL96DL23aXPpMGbsmKe8jLTEfbjuQoA4WS1VaA=
-github.com/aws/aws-sdk-go-v2/service/sso v1.18.7 h1:eajuO3nykDPdYicLlP3AGgOyVN3MOlFmZv7WGTuJPow=
-github.com/aws/aws-sdk-go-v2/service/sso v1.18.7/go.mod h1:+mJNDdF+qiUlNKNC3fxn74WWNN+sOiGOEImje+3ScPM=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.21.7 h1:QPMJf+Jw8E1l7zqhZmMlFw6w1NmfkfiSK8mS4zOx3BA=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.21.7/go.mod h1:ykf3COxYI0UJmxcfcxcVuz7b6uADi1FkiUz6Eb7AgM8=
+github.com/aws/aws-sdk-go-v2/service/sso v1.20.5 h1:vN8hEbpRnL7+Hopy9dzmRle1xmDc7o8tmY0klsr175w=
+github.com/aws/aws-sdk-go-v2/service/sso v1.20.5/go.mod h1:qGzynb/msuZIE8I75DVRCUXw3o3ZyBmUvMwQ2t/BrGM=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.23.4 h1:Jux+gDDyi1Lruk+KHF91tK2KCuY61kzoCpvtvJJBtOE=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.23.4/go.mod h1:mUYPBhaF2lGiukDEjJX2BLRRKTmoUSitGDUgM4tRxak=
 github.com/aws/aws-sdk-go-v2/service/sts v1.7.0/go.mod h1:0qcSMCyASQPN2sk/1KQLQ2Fh6yq8wm0HSDAimPhzCoM=
-github.com/aws/aws-sdk-go-v2/service/sts v1.26.7 h1:NzO4Vrau795RkUdSHKEwiR01FaGzGOH1EETJ+5QHnm0=
-github.com/aws/aws-sdk-go-v2/service/sts v1.26.7/go.mod h1:6h2YuIoxaMSCFf5fi1EgZAwdfkGMgDY+DVfa61uLe4U=
+github.com/aws/aws-sdk-go-v2/service/sts v1.28.6 h1:cwIxeBttqPN3qkaAjcEcsh8NYr8n2HZPkcKgPAi1phU=
+github.com/aws/aws-sdk-go-v2/service/sts v1.28.6/go.mod h1:FZf1/nKNEkHdGGJP/cI2MoIMquumuRK6ol3QQJNDxmw=
 github.com/aws/smithy-go v1.8.0/go.mod h1:SObp3lf9smib00L/v3U2eAKG8FyQ7iLrJnQiAmR5n+E=
-github.com/aws/smithy-go v1.19.0 h1:KWFKQV80DpP3vJrrA9sVAHQ5gc2z8i4EzrLhLlWXcBM=
-github.com/aws/smithy-go v1.19.0/go.mod h1:NukqUGpCZIILqqiV0NIjeFh24kd/FAa4beRb6nbIUPE=
+github.com/aws/smithy-go v1.20.2 h1:tbp628ireGtzcHDDmLT/6ADHidqnwgF57XOXZe6tp4Q=
+github.com/aws/smithy-go v1.20.2/go.mod h1:krry+ya/rV9RDcV/Q16kpu6ypI4K2czasz0NC3qS14E=
 github.com/aybabtme/rgbterm v0.0.0-20170906152045-cc83f3b3ce59/go.mod h1:q/89r3U2H7sSsE2t6Kca0lfwTK8JdoNGS/yzM/4iH5I=
 github.com/beevik/etree v1.1.0/go.mod h1:r8Aw8JqVegEf0w2fDnATrX9VpkMcyFeM0FhwO62wh+A=
 github.com/beevik/etree v1.3.0 h1:hQTc+pylzIKDb23yYprodCWWTt+ojFfUZyzU09a/hmU=
@@ -297,8 +301,8 @@ github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kB
 github.com/bketelsen/crypt v0.0.3-0.20200106085610-5cbc8cc4026c/go.mod h1:MKsuJmJgSg28kpZDP6UIiPt0e0Oz0kqKNGyRaWEPv84=
 github.com/blakesmith/ar v0.0.0-20190502131153-809d4375e1fb h1:m935MPodAbYS46DG4pJSv7WO+VECIWUQ7OJYSoTrMh4=
 github.com/blakesmith/ar v0.0.0-20190502131153-809d4375e1fb/go.mod h1:PkYb9DJNAwrSvRx5DYA+gUcOIgTGVMNkfSCbZM8cWpI=
-github.com/briandowns/spinner v1.13.0 h1:q/Y9LtpwtvL0CRzXrAMj0keVXqNhBYUFg6tBOUiY8ek=
-github.com/briandowns/spinner v1.13.0/go.mod h1:QOuQk7x+EaDASo80FEXwlwiA+j/PPIcX3FScO+3/ZPQ=
+github.com/briandowns/spinner v1.23.1 h1:t5fDPmScwUjozhDj4FA46p5acZWIPXYE30qW2Ptu650=
+github.com/briandowns/spinner v1.23.1/go.mod h1:LaZeM4wm2Ywy6vO571mvhQNRcWfRUnXOs0RcKV0wYKM=
 github.com/bwesterb/go-ristretto v1.2.3/go.mod h1:fUIoIZaG73pV5biE2Blr2xEzDoMj7NFEuV9ekS419A0=
 github.com/bytecodealliance/wasmtime-go v0.36.0 h1:B6thr7RMM9xQmouBtUqm1RpkJjuLS37m6nxX+iwsQSc=
 github.com/bytecodealliance/wasmtime-go v0.36.0/go.mod h1:q320gUxqyI8yB+ZqRuaJOEnGkAnHh6WtJjMaT2CW4wI=
@@ -336,8 +340,8 @@ github.com/clbanning/mxj v1.8.4 h1:HuhwZtbyvyOw+3Z1AowPkU87JkJUSv751ELWaiTpj8I=
 github.com/clbanning/mxj v1.8.4/go.mod h1:BVjHeAH+rl9rs6f+QIpeRl0tfu10SXn1pUSa5PVGJng=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/cloudflare/circl v1.3.3/go.mod h1:5XYMA4rFBvNIrhs50XuiBJ15vF2pZn4nnUKZrLbUZFA=
-github.com/cloudflare/circl v1.3.7 h1:qlCDlTPz2n9fu58M0Nh1J/JzcFpfgkFHHX3O35r5vcU=
-github.com/cloudflare/circl v1.3.7/go.mod h1:sRTcRWXGLrKw6yIGJ+l7amYJFfAXbZG0kBSc8r4zxgA=
+github.com/cloudflare/circl v1.3.8 h1:j+V8jJt09PoeMFIu2uh5JUyEaIHTXVOHslFoLNAKqwI=
+github.com/cloudflare/circl v1.3.8/go.mod h1:PDRU+oXvdD7KCtgKxW95M5Z8BpSCJXQORiZFnBQS5QU=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
 github.com/cncf/udpa/go v0.0.0-20200629203442-efcf912fb354/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
 github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
@@ -397,8 +401,8 @@ github.com/dimchansky/utfbom v1.1.1 h1:vV6w1AhK4VMnhBno/TPVCoK9U/LP0PkLCS9tbxHdi
 github.com/dimchansky/utfbom v1.1.1/go.mod h1:SxdoEBH5qIqFocHMyGOXVAybYJdr71b1Q/j0mACtrfE=
 github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
-github.com/docker/docker v26.1.4+incompatible h1:vuTpXDuoga+Z38m1OZHzl7NKisKWaWlhjQk7IDPSLsU=
-github.com/docker/docker v26.1.4+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker v26.1.5+incompatible h1:NEAxTwEjxV6VbBMBoGG3zPqbiJosIApZjxlbrG9q3/g=
+github.com/docker/docker v26.1.5+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/go-connections v0.4.0 h1:El9xVISelRB7BuFusrZozjnkIM5YnzCViNKohAFqRJQ=
 github.com/docker/go-connections v0.4.0/go.mod h1:Gbd7IOopHjR8Iph03tsViu4nIes5XhDvyHbTtUxmeec=
 github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
@@ -668,8 +672,8 @@ github.com/googleapis/enterprise-certificate-proxy v0.3.2/go.mod h1:VLSiSSBs/ksP
 github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
 github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
 github.com/googleapis/gax-go/v2 v2.1.0/go.mod h1:Q3nei7sK6ybPYH7twZdmQpAd1MKb7pfu6SK+H1/DsU0=
-github.com/googleapis/gax-go/v2 v2.12.2 h1:mhN09QQW1jEWeMF74zGR81R30z4VJzjZsfkUhuHF+DA=
-github.com/googleapis/gax-go/v2 v2.12.2/go.mod h1:61M8vcyyXR2kqKFxKrfA22jaA8JGF7Dc8App1U3H6jc=
+github.com/googleapis/gax-go/v2 v2.12.4 h1:9gWcmF85Wvq4ryPFvGFaOgPIs1AQX0d0bcbGw4Z96qg=
+github.com/googleapis/gax-go/v2 v2.12.4/go.mod h1:KYEYLorsnIGDi/rPC8b5TdlB9kbKoFubselGIoBMCwI=
 github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
 github.com/goreleaser/chglog v0.1.2 h1:tdzAb/ILeMnphzI9zQ7Nkq+T8R9qyXli8GydD8plFRY=
 github.com/goreleaser/chglog v0.1.2/go.mod h1:tTZsFuSZK4epDXfjMkxzcGbrIOXprf0JFp47BjIr3B8=
@@ -805,8 +809,8 @@ github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+o
 github.com/klauspost/compress v1.10.3/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
 github.com/klauspost/compress v1.12.3/go.mod h1:8dP1Hq4DHOhN9w426knH3Rhby4rFm6D8eO+e+Dq5Gzg=
 github.com/klauspost/compress v1.13.5/go.mod h1:/3/Vjq9QcHkK5uEr5lBEmyoZ1iFhe47etQ6QUkpK6sk=
-github.com/klauspost/compress v1.17.7 h1:ehO88t2UGzQK66LMdE8tibEd1ErmzZjNEqWkjLAKQQg=
-github.com/klauspost/compress v1.17.7/go.mod h1:Di0epgTjJY877eYKx5yC51cX2A2Vl2ibi7bDH9ttBbw=
+github.com/klauspost/compress v1.17.8 h1:YcnTYrq7MikUT7k0Yb5eceMmALQPYBW/Xltxn0NAMnU=
+github.com/klauspost/compress v1.17.8/go.mod h1:Di0epgTjJY877eYKx5yC51cX2A2Vl2ibi7bDH9ttBbw=
 github.com/kolide/kit v0.0.0-20221107170827-fb85e3d59eab h1:KVR7cs+oPyy85i+8t1ZaNSy1bymCy5FuWyt51pdrXu4=
 github.com/kolide/kit v0.0.0-20221107170827-fb85e3d59eab/go.mod h1:OYYulo9tUqRadRLwB0+LE914sa1ui2yL7OrcU3Q/1XY=
 github.com/kolide/launcher v1.0.12 h1:f2uT1kKYGIbj/WVsHDc10f7MIiwu8MpmgwaGaT7D09k=
@@ -834,8 +838,8 @@ github.com/lib/pq v1.10.9 h1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw=
 github.com/lib/pq v1.10.9/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
 github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 h1:6E+4a0GO5zZEnZ81pIr0yLvtUWk2if982qA3F3QD6H4=
 github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0/go.mod h1:zJYVVT2jmtg6P3p1VtQj7WsuWi/y4VnjVBn7F8KPB3I=
-github.com/macadmins/osquery-extension v1.1.3-0.20240530154548-05bb97403086 h1:pom8HjoknG5GF+cqeTP+2sXIn8Tl8Y7cinlPNv0O+LY=
-github.com/macadmins/osquery-extension v1.1.3-0.20240530154548-05bb97403086/go.mod h1:q0BnBuYocHBRB+m3AQwdQNETH5a2KzVT3S8TKMHo9Lk=
+github.com/macadmins/osquery-extension v1.2.1 h1:p7tAAhfEjUjoMQJNb+X7Qc3FraVqGZqMhZ1BYJbrlaw=
+github.com/macadmins/osquery-extension v1.2.1/go.mod h1:q0BnBuYocHBRB+m3AQwdQNETH5a2KzVT3S8TKMHo9Lk=
 github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
 github.com/magiconair/properties v1.8.1/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
 github.com/magiconair/properties v1.8.4/go.mod h1:y3VJvCyxH9uVvJTWEGAELF3aiYNyPKd5NZ3oSwXrF60=
@@ -944,8 +948,8 @@ github.com/open-policy-agent/opa v0.44.0/go.mod h1:YpJaFIk5pq89n/k72c1lVvfvR5uop
 github.com/opencensus-integrations/ocsql v0.1.1/go.mod h1:ozPYpNVBHZsX33jfoQPO5TlI5lqh0/3R36kirEqJKAM=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
-github.com/opencontainers/image-spec v1.1.0-rc6 h1:XDqvyKsJEbRtATzkgItUqBA7QHk58yxX1Ov9HERHNqU=
-github.com/opencontainers/image-spec v1.1.0-rc6/go.mod h1:W4s4sFTMaBeK1BQLXbG4AdM2szdn85PY75RI83NrTrM=
+github.com/opencontainers/image-spec v1.1.0 h1:8SG7/vwALn54lVB/0yZ/MMwhFrPYtpEHQb2IpWsCzug=
+github.com/opencontainers/image-spec v1.1.0/go.mod h1:W4s4sFTMaBeK1BQLXbG4AdM2szdn85PY75RI83NrTrM=
 github.com/oschwald/geoip2-golang v1.8.0 h1:KfjYB8ojCEn/QLqsDU0AzrJ3R5Qa9vFlx3z6SLNcKTs=
 github.com/oschwald/geoip2-golang v1.8.0/go.mod h1:R7bRvYjOeaoenAp9sKRS8GX5bJWcZ0laWO5+DauEktw=
 github.com/oschwald/maxminddb-golang v1.10.0 h1:Xp1u0ZhqkSuopaKmk1WwHtjF0H9Hd9181uj2MQ5Vndg=
@@ -1024,8 +1028,8 @@ github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQD
 github.com/ryanuber/columnize v0.0.0-20160712163229-9b3edd62028f/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
 github.com/saferwall/pe v1.5.2 h1:h5lLtLsyxGHQ9dN6cd8EfeLEBEo5gdqJpkuw4o4vTMY=
 github.com/saferwall/pe v1.5.2/go.mod h1:SNzv3cdgk8SBI0UwHfyTcdjawfdnN+nbydnEL7GZ25s=
-github.com/sassoftware/relic/v7 v7.6.2 h1:rS44Lbv9G9eXsukknS4mSjIAuuX+lMq/FnStgmZlUv4=
-github.com/sassoftware/relic/v7 v7.6.2/go.mod h1:kjmP0IBVkJZ6gXeAu35/KCEfca//+PKM6vTAsyDPY+k=
+github.com/sassoftware/relic/v8 v8.0.1 h1:uYUoaoTQMs67up8/46NgrSxSftgfY4VWBusDVg56k7I=
+github.com/sassoftware/relic/v8 v8.0.1/go.mod h1:s/MwugRcovgYcNJNOyvLfqRHDX7iArHtFtUR9kEodz8=
 github.com/scjalliance/comshim v0.0.0-20230315213746-5e51f40bd3b9 h1:rc/CcqLH3lh8n+csdOuDfP+NuykE0U6AeYSJJHKDgSg=
 github.com/scjalliance/comshim v0.0.0-20230315213746-5e51f40bd3b9/go.mod h1:a/83NAfUXvEuLpmxDssAXxgUgrEy12MId3Wd7OTs76s=
 github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529/go.mod h1:DxrIzT+xaE7yg65j358z/aeFdxmN0P9QXhEzd20vsDc=
@@ -1056,6 +1060,8 @@ github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966 h1:JIAuq3EE
 github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966/go.mod h1:sUM3LWHvSMaG192sy56D9F7CNvL7jUJVXoqM1QKLnog=
 github.com/slack-go/slack v0.9.4 h1:C+FC3zLxLxUTQjDy2RZeMHYon005zsCROiZNWVo+opQ=
 github.com/slack-go/slack v0.9.4/go.mod h1:wWL//kk0ho+FcQXcBTmEafUI5dz4qz5f4mMk8oIkioQ=
+github.com/smallstep/pkcs7 v0.0.0-20240723090913-5e2c6a136dfa h1:FtxzVccOwaK+bK4bnWBPGua0FpCOhrVyeo6Fy9nxdlo=
+github.com/smallstep/pkcs7 v0.0.0-20240723090913-5e2c6a136dfa/go.mod h1:SoUAr/4M46rZ3WaLstHxGhLEgoYIDRqxQEXLOmOEB0Y=
 github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
 github.com/smartystreets/assertions v1.0.0/go.mod h1:kHHU4qYBaI3q23Pp3VPrmWhuIUrLW/7eUrw0BU5VaoM=
 github.com/smartystreets/go-aws-auth v0.0.0-20180515143844-0c1422d1fdb9/go.mod h1:SnhjPscd9TpLiy1LpzGSKh3bXCfxxXuqd9xmQJy3slM=
@@ -1140,8 +1146,8 @@ github.com/ugorji/go v1.1.7/go.mod h1:kZn38zHttfInRq0xu/PH0az30d+z6vm202qpg1oXVM
 github.com/ugorji/go/codec v0.0.0-20181204163529-d75b2dcb6bc8/go.mod h1:VFNgLljTbGfSG7qAOspJ7OScBnGdDN/yBr0sguwnwf0=
 github.com/ugorji/go/codec v1.1.7/go.mod h1:Ax+UKWsSmolVDwsd+7N3ZtXu+yMGCf907BLYF3GoBXY=
 github.com/ulikunitz/xz v0.5.7/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
-github.com/ulikunitz/xz v0.5.11 h1:kpFauv27b6ynzBNT/Xy+1k+fK4WswhN/6PN5WhFAGw8=
-github.com/ulikunitz/xz v0.5.11/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
+github.com/ulikunitz/xz v0.5.12 h1:37Nm15o69RwBkXM0J6A5OlE67RZTfzUxTj8fB3dfcsc=
+github.com/ulikunitz/xz v0.5.12/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
 github.com/urfave/cli/v2 v2.23.5 h1:xbrU7tAYviSpqeR3X4nEFWUdB/uDZ6DE+HxmRU7Xtyw=
 github.com/urfave/cli/v2 v2.23.5/go.mod h1:GHupkWPMM0M/sj1a2b4wUrWBPzazNrIjouW6fmdJLxc=
 github.com/vartanbeno/go-reddit/v2 v2.0.0 h1:fxYMqx5lhbmJ3yYRN1nnQC/gecRB3xpUS2BbG7GLpsk=
@@ -1653,8 +1659,8 @@ google.golang.org/api v0.52.0/go.mod h1:Him/adpjt0sxtkWViy0b6xyKW/SD71CwdJ7HqJo7
 google.golang.org/api v0.54.0/go.mod h1:7C4bFFOvVDGXjfDTAsgGwDgAxRDeQ4X8NvUedIt6z3k=
 google.golang.org/api v0.55.0/go.mod h1:38yMfeP1kfjsl8isn0tliTjIb1rJXcQi4UXlbqivdVE=
 google.golang.org/api v0.56.0/go.mod h1:38yMfeP1kfjsl8isn0tliTjIb1rJXcQi4UXlbqivdVE=
-google.golang.org/api v0.169.0 h1:QwWPy71FgMWqJN/l6jVlFHUa29a7dcUy02I8o799nPY=
-google.golang.org/api v0.169.0/go.mod h1:gpNOiMA2tZ4mf5R9Iwf4rK/Dcz0fbdIgWYWVoxmsyLg=
+google.golang.org/api v0.178.0 h1:yoW/QMI4bRVCHF+NWOTa4cL8MoWL3Jnuc7FlcFF91Ok=
+google.golang.org/api v0.178.0/go.mod h1:84/k2v8DFpDRebpGcooklv/lais3MEfqpaBLA12gl2U=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.3.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
@@ -1724,8 +1730,8 @@ google.golang.org/genproto v0.0.0-20210821163610-241b8fcbd6c8/go.mod h1:eFjDcFEc
 google.golang.org/genproto v0.0.0-20210825212027-de86158e7fda/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY=
 google.golang.org/genproto v0.0.0-20210828152312-66f60bf46e71/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY=
 google.golang.org/genproto v0.0.0-20210831024726-fe130286e0e2/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY=
-google.golang.org/genproto v0.0.0-20240213162025-012b6fc9bca9 h1:9+tzLLstTlPTRyJTh+ah5wIMsBW5c4tQwGTN3thOW9Y=
-google.golang.org/genproto v0.0.0-20240213162025-012b6fc9bca9/go.mod h1:mqHbVIp48Muh7Ywss/AD6I5kNVKZMmAa/QEW58Gxp2s=
+google.golang.org/genproto v0.0.0-20240506185236-b8a5c65736ae h1:HjgkYCl6cWQEKSHkpUp4Q8VB74swzyBwTz1wtTzahm0=
+google.golang.org/genproto v0.0.0-20240506185236-b8a5c65736ae/go.mod h1:i4np6Wrjp8EujFAUn0CM0SH+iZhY1EbrfzEIJbFkHFM=
 google.golang.org/genproto/googleapis/api v0.0.0-20240701130421-f6361c86f094 h1:0+ozOGcrp+Y8Aq8TLNN2Aliibms5LEzsq99ZZmAGYm0=
 google.golang.org/genproto/googleapis/api v0.0.0-20240701130421-f6361c86f094/go.mod h1:fJ/e3If/Q67Mj99hin0hMhiNyCRmt6BQ2aWIJshUSJw=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20240701130421-f6361c86f094 h1:BwIjyKYGsK9dMCBOorzRri8MQwmi7mT9rGHsCEinZkA=
diff --git a/handbook/business-operations/README.md b/handbook/business-operations/README.md
deleted file mode 100644
index 81ba9c82be..0000000000
--- a/handbook/business-operations/README.md
+++ /dev/null
@@ -1,553 +0,0 @@
-# Business Operations
-This handbook page details processes specific to working [with](#contact-us) and [within](#responsibilities) this department.
-
-## Team
-| Role                          | Contributor(s)           |
-|:------------------------------|:-----------------------------------------------------------------------------------------------------------|
-| Head of Business Operations   | [Joanne Stableford](https://www.linkedin.com/in/joanne-stableford/) _([@jostableford](https://github.com/JoStableford))_
-| Business Operations Engineer  | [Nathan Holliday](https://www.linkedin.com/in/nathanael-holliday/) _([@hollidayn](https://github.com/hollidayn))_ <br> [Isabell Reedy](https://www.linkedin.com/in/isabell-reedy-202aa3123/) _([@ireedy](https://github.com/ireedy))_
-
-## Contact us
-- To **make a request** of this department, [create an issue](https://github.com/fleetdm/confidential/issues/new?assignees=&labels=%23g-business-operations&projects=&template=custom-request.md&title=Request%3A+_______________________) and a team member will get back to you within one business day (If urgent, mention a [team member](#team) in [#g-business-operations](https://fleetdm.slack.com/archives/C047N5L6EGH).
-  - Please **use issue comments and GitHub mentions** to communicate follow-ups or answer questions related to your request.
-  - Any Fleet team member can [view the kanban board](https://app.zenhub.com/workspaces/-g-business-operations-63f3dc3cc931f6247fcf55a9/board?sprints=none) for this department, including pending tasks and the status of new requests.
-
-
-## Responsibilities
-The Business Operations department is directly responsible for people operations, finance + invoicing, tax, compliance, and legal + deal desk.
-
-
-### Run payroll
-Many of these processes are automated, but it's vital to check Gusto and Plane manually for accuracy.
- - Salaried fleeties are automated in Gusto and Plane.
- - Hourly fleeties and consultants are a manual process each month in Gusto and Plane.
-
-| Payroll type                 | What to use                  | DRI                          |
-|:-----------------------------|:-----------------------------|:-----------------------------|
-| [Commissions and ramp](https://fleetdm.com/handbook/business-operations#run-us-commission-payroll)         | "Off-cycle - Commission" payroll          | Head of Business Operations
-| Sign-on bonus                | "Bonus" payroll              | Head of Business Operations
-| Performance bonus            | "Bonus" payroll              | Head of Business Operations     
-| Accelerations (quarterly)    | "Off-cycle - Commission" payroll          | Head of Business Operations
-| [US contractor payroll](https://fleetdm.com/handbook/business-operations#run-us-contractor-payroll) | "Off-cycle" payroll | Head of Business Operations
-
-### Reconcile monthly recurring expenses
-Recurring monthly or annual expenses, such as the tools we use throughout Fleet, are tracked as recurring, non-personnel expenses in ["🧮 The Numbers"](https://docs.google.com/spreadsheets/d/1X-brkmUK7_Rgp7aq42drNcUg8ZipzEiS153uKZSabWc/edit#gid=2112277278) _(¶confidential Google Sheet)_, along with their payment source. Reconciliation of recurring expenses happens monthly. <!-- TODO: Merge "🧮 The Numbers" and  ["Tools we use" (private Google doc)](https://docs.google.com/spreadsheets/d/170qjzvyGjmbFhwS4Mucotxnw_JvyAjYv4qpwBrS6Gl8/edit?usp=sharing) -->
-
-> Use this spreadsheet as the source of truth.  Always make changes to it first before adding or removing a recurring expense. Only track significant expenses. (Other things besides amount can make a payment significant; like it being an individualized expense, for example.)
-
-
-### Access a background check
-All Fleet team members undergo a background check provided through [Vetty](https://vetty.co/). Only the most recent background checks appear on the home page of Vetty's dashboard. To access a complete list of background checks run in Vetty, scroll down to the bottom of the candidates page and click "View Historical".
-
-
-### Register Fleet as an employer with a new state 
-Fleet must register as an employer in any state where we hire new teammates. To do this, complete the following steps in Gusto:
-1. After a new teammate completes their Gusto profile, the Business Operations department will be prompted to approve it for payroll. Sign in to your Gusto admin account and begin the approval process.
-2. Select "yes" when prompted to file a new hire report and complete the approval process.
-3. Once the profile is approved, navigate to Tax setup and select the state you’d like to register Fleet in.
-4. Select “Have us register for you” and then “Start registration.”
-5. Verify, add, and amend any company information to ensure accuracy.
-6. Select “Send registration” and authorize payment for the specified amount. CorpNet will then send an email with next steps, which vary by state.
-7. Update the [list of states that Fleet is currently registered with as an employer](https://fleetdm.com/handbook/business-operations#review-state-employment-tax-filings-for-the-previous-quarter).
-    
-
-### Process an email from a state agency
-From time to time, you may get notices via email (or in the mail) from state agencies regarding Fleet's withholding and/or unemployment tax accounts. You can resolve some of these notices on your own by verifying and/or updating the settings in your Gusto account.
-
-If the notice is regarding an upcoming change to your deposit schedule or unemployment tax rate, make the required change in Gusto, such as:
-- Update your unemployment tax rate.
-- Update your federal deposit schedule.
-- Update your state deposit schedule.
-
-In Gusto, you can click **How to review your notice** to help you understand what kind of notice you received and what additional action you can take to help speed up the time it takes to resolve the issue.
-
-> **Note:** Many agencies do not send notices to Gusto directly, so it’s important that you read and take action before any listed deadlines or effective dates of requested changes, in case you have to do something.  If you can't resolve the notice on your own, are unsure what the notice is in reference to, or the tax notice has a missing payment or balance owed, follow the steps in the Report and upload a tax notice in Gusto.
-
-Every quarter, payroll and tax filings are due for each state. Gusto can handle these automatically if Third-party authorization (TPA) is enabled. Each state is unique and Gusto has a library of [State registration and resources](https://support.gusto.com/hub/Employers-and-admins/Taxes-forms-and-compliance/State-registration-and-resources) available to review.  You will need to grant Third-party authorization (TPA) per state and this should be checked quarterly before the filing due dates to ensure that Gusto can file on time. -->
-
-
-### Review state employment tax filings for the previous quarter
-
-Every quarter, payroll and tax filings are due for each state. Gusto automates this process, however there are often delays or quirks between Gusto's submission and the state receiving the filings.
-To mitigate the risk of penalties and to ensure filings occur as expected, follow these steps in the first month of the new quarter, verifying past quarter submission:
-1. Create an issue to "Review state filings for the previous quarter".
-2. Copy this text block into the issue to track progress by state:
-
-
-```
-States checked:
-- [ ] California
-- [ ] Colorado
-- [ ] Connecticut
-- [ ] Florida
-- [ ] Georgia
-- [ ] Hawaii
-- [ ] Illinois
-- [ ] Kansas
-- [ ] Maryland
-- [ ] Massachusetts
-- [ ] New York
-- [ ] Ohio
-- [ ] Oregon
-- [ ] Pennsylvania
-- [ ] Rhode Island
-- [ ] Tennessee
-- [ ] Texas
-- [ ] Utah
-- [ ] Virginia
-- [ ] Washington
-- [ ] Washington, DC
-- [ ] West Virginia
-- [ ] Wisconsin
-```
- 
-
-3. Login to Gusto and navigate to "Taxes and compliance", then "Tax documents".
-4. Login to each State portal (using the details saved in 1Password) and verify that the portal has received the automated submission from Gusto.
-5. Check off states that are correct, and use comments to explain any quirks or remediation that's needed.
-
-
-### Inform managers about hours worked
-
-Every Friday at 2:00 PM CT, we collect hours worked for all hourly employees at Fleet, including core team members and consultants, regardless of their location.
-
-Here's how:
-
-1. For each hourly core team member in Gusto or Plane.com, find the DRI by checking [who they report to](https://docs.google.com/spreadsheets/d/1OSLn-ZCbGSjPusHPiR5dwQhheH1K8-xqyZdsOe9y7qc/edit#gid=0).
-   - If any direct report is hourly in Plane.com and submits hours monthly, still list them and provide an explanation.
-2. Consultants submit their hours through Gusto (US consultants) or Plane.com (international consultants) and require DRI approval. Find the DRI using the [Business Operations KPIs](https://docs.google.com/spreadsheets/d/1Hso0LxqwrRVINCyW_n436bNHmoqhoLhC8bcbvLPOs9A/edit#gid=0).
-3. Send the teammate's DRI a direct message in Slack with a screenshot of the HRIS portal, showing hours logged since last Saturday at midnight, and ask them to confirm the hours are expected. Ensure the screenshot does not include compensation information.
-4. The following Monday, check for updates to logged hours and ensure the KPI sheet aligns with HRIS records.
-   - If there are discrepancies between what was previously reported, reconfirm logged hours with the teammate's DRI and update the KPI sheet to reflect the correct amount.
-
-
-### Change the DRI of a consultant
-
-1. In the [KPIs](https://docs.google.com/spreadsheets/d/1Hso0LxqwrRVINCyW_n436bNHmoqhoLhC8bcbvLPOs9A/edit#gid=0) sheet, find the consultant's column.
-2. Change the DRI documented there to the new DRI who will receive information about the consultant's hours.
-
-### Run US contractor payroll
-For Fleet's US contractors, running payroll is a manual process:
-1. Add the amount to be paid to the "Gross" line.
-2. Review hours _("Time tools > Time tracking")_
-3. Adjust time frame to match current payroll period (the 27th through 26th of the month)
-4. Sync hours and run contractor payroll.
-
-### Create an invoice
-To create a new invoice for a Fleet customer, follow these steps:
-1. Go to the [invoice folder in google drive](https://drive.google.com/drive/folders/11limC_KQYNYQPApPoXN0CplHo_5Qgi2b?usp=drive_link).
-2. Create a copy of the invoice template, and title the copy `[invoice number] Fleet invoice - [customer name]`.
-    - The invoice number follows the format of `YYMMDD[daily issued invoice number]`, where the daily issued invoice number should equal `01` if it's the first invoice issued that day, `02` if it's the second, etc.
-3.  Edit the new invoice to reflect details from the signed subscription agreement (and PO if required).
-    - Enter the invoice number (and PO number if required) into the top right section of the invoice.
-    - Update the date of the invoice to reflect the current date.
-    - Make sure the payment terms match the signed subscription agreement.
-    - Copy the customer address from the signed subscription agreement and input it in the "Bill to" section of the invoice.
-    - Copy the "Billing contact" email from the signed subscription agreement and add it to the last line of the "Bill to" address.
-    - Make sure the start and end dates of the contract and amount match the subscription agreement.
-    - If professional services are included in the subscription agreement, include as a separate line in the invoice, and ensure the amounts total correctly.
-    - Ensure the "Notes" section has wiring instructions for payment via SVB.
-4.  Download the completed invoice as a PDF.
-5.  Send the PDF to the billing contact from the "Bill to" section of the invoice and cc [Fleet's billing email address](https://fleetdm.com/handbook/company/communications#email-relays). Use the following template for the email:
-
-```
-Subject: Invoice for Fleet Device Management [invoice number]
-Hello,
-
-I've attached the invoice for [customer name]'s purchase of Fleet Device Management's premium subscription.
-For payment instructions please refer to your invoice, and reach out to [insert Fleet's billing address] with any questions.
-
-Thanks,
-[name]
-```
-
-6. Update the opportunity and the opportunity billing cycle in Salesforce to include the "Invoice date" as the day the invoice was sent.
-8. Notify the AE/CSM that the invoice has been sent.
-
-> Certain vendors require invoices submitted via a payment portal (such as Coupa). Once you've generated the invoice using the steps above, upload it to the relevant payment portal and email the billing contact to let them know you've submitted the invoice.
-
-
-### Communicate the status of customer financial actions
-This reporting is performed to update the status of open or upcoming customer actions regarding the financial health of the opportunity. To complete the report:
-1. Go to this [report folder](https://fleetdm.lightning.force.com/lightning/r/Folder/00lUG000000DstpYAC/view?queryScope=userFolders) in SFDC. The three reports will provide the data used in the report.
-2. Copy the template below and paste it into the [#g-sales slack channel](https://fleetdm.slack.com/archives/C030A767HQV) and complete all "todos" using the data from Salesforce before sending. 
-
-```
-Weekly revenue report - [@`todo: CRO` and @`todo: CEO`]
-- Number accounts with outstanding balances = `todo`
-- Number of customers awaiting invoices = `todo`
-- Number of past-due renewals = `todo`
-```
-
-3. Send payment reminders via email to all outstanding accounts by responding to the invoice email initially sent to the customer.
-
-```
-Hello,
-This is a reminder that you have an outstanding balance due for your Fleet Device Management premium subscription.
-We have included the invoice here for your convenience.
-For payment instructions please refer to your invoice, and reach out to [Fleet's billing contact] with any questions.
-
-Thanks,
-[name]
-```
-4. If any accounts will become overdue within a week, reply in thread to the slack post, mention the opportunity owner of the account, and ask them to notify their contact that Fleet is still awaiting payment.
-5. Review the [billing cycles](https://fleetdm.lightning.force.com/lightning/r/Report/00OUG000000yGjR2AU/view) report in SFDC for customers on multiyear deals. For any customers due for invoicing within the next week, create an issue on the Business Operations board.
-
-
-### Run US commission payroll
-1. Update individual teammates commission calculators (linked from [main commission calculator](https://docs.google.com/spreadsheets/d/1PuqUbfPGos87TfcHWgUd05TRJgQLlBmhyz1euj79m2A/edit?usp=sharing)) with new revenue from any deals that are closed-won (have a subscription agreement signed by both parties) and have a **close date** within the previous month.
-    - Verify closed-won deal numbers with CRO to ensure any agreed upon exceptions are captured (eg: CRO approves an AE to receive commission on a renewal deal due to cross-sell).
-2. In the "Monthly commission payroll party" meeting, present the commission calculations for Fleeties receiving commission for approval.
-    - If there are any quarterly accelerators due for the teammate receiving commission, ensure the individual total includes both the monthly and the quarterly amount.
-3. After the amounts are approved in the meeting, process the commission payroll.
-    - Use the off-cycle payroll option in Gusto. Be sure to classify the payment as "Commission" in the "other earnings" field and not the generic "Bonus."
-4. Once commission payroll has been run, update the [main commission calculator](https://docs.google.com/spreadsheets/d/1PuqUbfPGos87TfcHWgUd05TRJgQLlBmhyz1euj79m2A/edit?usp=sharing) to mark the commission as paid.
-
-### Run international commission payroll
-1. Follow the steps in [run US commission payroll](https://fleetdm.com/handbook/business-operations#run-us-commission-payroll) to have the commission amounts approved by the CRO.
-2. After the amounts are approved in the "Monthly commission payroll party", navigate to Help > Ask a question in Plane to request a commission payment for the teammate.
-3. Send a message using the following template
-
-    ```
-    Hello,
-    I’d like to run an off-cycle commission payment for [teammate’s full name] for the period of [commission period].
-    The amount of [USD amount] should be paid with their next payroll.
-    Please let me know if you need any additional information to process this request.
-    
-    Thanks,
-    [name]
-    ```
-
-4. Once Plane confirms the payroll change has been actioned, update the [main commission calculator](https://docs.google.com/spreadsheets/d/1PuqUbfPGos87TfcHWgUd05TRJgQLlBmhyz1euj79m2A/edit#gid=928324236) to mark the commission as paid. 
-
-
-### Run quarterly or annual employee bonus payroll
-1. Update individual teammate bonus calculator (linked from [main commission calculator](https://docs.google.com/spreadsheets/d/1PuqUbfPGos87TfcHWgUd05TRJgQLlBmhyz1euj79m2A/edit?usp=sharing)) with relevant metrics.
-    - Bonus plans will have details specified on how to measure success, with most drawing from the [KPI spreadsheet](https://docs.google.com/spreadsheets/d/1Hso0LxqwrRVINCyW_n436bNHmoqhoLhC8bcbvLPOs9A/edit?usp=sharing) or from linked SFDC reports. If unsure where to pull achievement metrics from, contact teammate's manager to clarify.
-2. In the "Monthly commission payroll party" meeting, present the bonus calculations for Fleeties receiving bonus for approval.
-3. After the amounts are approved in the meeting, process the bonus payroll.
-    - Use the off-cycle payroll option in Gusto and be sure to classify the payment as "Bonus".
-    - For international teammates, you may need to use the "Help" function, or email support to notify Plane of the amount needing to be paid.
-4. Once bonus payroll has been run, update the [main commission calculator](https://docs.google.com/spreadsheets/d/1PuqUbfPGos87TfcHWgUd05TRJgQLlBmhyz1euj79m2A/edit?usp=sharing) to mark the bonus as paid. 
-
-
-### Convert a Fleetie to a consultant
-If a Fleetie decides they want to move to being a [consultant](https://fleetdm.com/handbook/company/leadership#consultants), either the Fleetie or their manager need to create a [custom issue for the BizOps team](https://github.com/fleetdm/confidential/issues/new?assignees=&labels=%23g-business-operations&projects=&template=custom-request.md&title=Request%3A+_______________________) to notify them of the change.
-Once notified, BizOps takes the following steps:
-1. Confirm the following details with the Fleetie:
-    - Date of change
-    - Term of consultancy (time period)
-    - Hours/capacity expected (hours per week or month)
-    - Confirm hourly rate
-2. Once details are confirmed, use the information given to create the consulting agreement for the Fleetie (either in docusign (US-based) or via Plane (international)), and send to their personal email for signature. Once signed, save in Fleetie's [employee file](https://drive.google.com/drive/folders/1UL7o3BzkTKnpvIS4hm_RtbOilSABo3oG?usp=drive_link).
-3. Schedule the Fleetie's final day in HRIS (Gusto or Plane).
-4. Update final day in ["🧑‍🚀 Fleeties"](https://docs.google.com/spreadsheets/d/1OSLn-ZCbGSjPusHPiR5dwQhheH1K8-xqyZdsOe9y7qc/edit#gid=0) spreadsheet.
-5. Create an [offboarding issue](https://github.com/fleetdm/classified/blob/main/.github/ISSUE_TEMPLATE/%F0%9F%9A%AA-offboarding-____________.md) for the Fleetie converting to a consultant, and confirm with their manager if there is a need to retain any tools or access while they are a consultant (default to removing all access from Fleet email, and migrating to personal email for Slack and other tools unless there is a business case to retain the Fleet email and associated tool access).
-6. Follow the offboarding issue for next steps, including communicating to teammates and updating equity plan.
-
-
-### Update personnel details
-When a Fleetie, consultant or advisor requests an update to their personnel details (name, location, phone, etc), follow these steps to ensure accurate representation across systems.
-1. Team member submits a [custom issue](https://github.com/fleetdm/confidential/issues/new?assignees=&labels=%23g-business-operations&projects=&template=custom-request.md&title=Request%3A+_______________________) to update their personnel details (or BizOps team creates if the request comes via email or is sensitive and needs a classified issue).
-    - If change is for a primary identification or contact method, ask for evidence of change and capture in [employee's personnel file](https://drive.google.com/drive/folders/1UL7o3BzkTKnpvIS4hm_RtbOilSABo3oG?usp=drive_link).
-2. BizOps makes change to HRIS (Gusto or Plane) to reflect change. 
-    - Note: if making the change requires follow up steps, resolve those steps to action the change.
-3. Once change is effected in HRIS, BizOps makes changes to ["🧑‍🚀 Fleeties"](https://docs.google.com/spreadsheets/d/1OSLn-ZCbGSjPusHPiR5dwQhheH1K8-xqyZdsOe9y7qc/edit#gid=0) spreadsheet.
-4. If required, BizOps makes any relevant changes to [Fleet's equity plan](https://docs.google.com/spreadsheets/d/1_GJlqnWWIQBiZFOoyl9YbTr72bg5qdSSp4O3kuKm1Jc/edit#gid=0).
-5. If required, BizOps makes any relevant changes to the ["🗺️ Geographical factors"](https://docs.google.com/spreadsheets/d/1rCVCs-eOo-VSEG7fPLgdq5l7oSaActl5bewaWP7PnSE/edit#gid=1533353559) spreadsheet and follows through on any action items involving tax implications (i.e. registering with a new state for employer taxes).
-6. If required, BizOps also makes changes to other core systems (e.g: creating a new email alias in google workspace; updating details in Carta; etc).
-7. The change is now actioned, notify the team member and close the issue.
-
-> Note: if the Fleetie is US based and has a qualifying life event that impacts benefit coverage, they can [follow the Gusto steps](https://support.gusto.com/article/100895878100000/Change-your-benefits-with-a-qualifying-life-event) to update their coverage elections.
-
-
-### Change a Fleetie's job title
-When BizOps receives notification of a Fleetie's job title changing, follow these steps to ensure accurate recording of the change across our systems.
-1. Update ["🧑‍🚀 Fleeties"](https://docs.google.com/spreadsheets/d/1OSLn-ZCbGSjPusHPiR5dwQhheH1K8-xqyZdsOe9y7qc/edit#gid=0):
-    - Search the spreadsheet for the Fleetie in need of a job title change.
-    - Input the new job title in the Fleetie's row in the "Job title" cell.
-    - Navigate to the "Org chart" tab of the spreadsheet, and verify that the Fleetie's title appears correctly in the org chart.
-2. Update the departmental handbook page with the change of job title
-3. Update the relevant payroll/HRIS system.
-    - For updating Gusto (US-based Fleeties):
-      - Login to Gusto and navigate to "People > Team members".
-      - Find the Fleetie and select them to see their profile page.
-      - Under the "Compensation" heading, select edit and update the "Job title" and input the specific date the change happened. Save the changes.
-    - For updating Plane (non-US Fleeties):
-      - Login to Plane and navigate to "People > Team".
-      - Find the Fleetie and select them to see their profile page.
-      - Use the "Help" function, or email support@plane.com to notify Plane of the need to change the job title for the Fleetie. Include the Fleetie's name, current title, new title, and effective date.
-      - Take any relevant steps as directed by Plane in order to make the required changes to the Fleetie's profile.
-
-
-### Change a Fleetie's manager
-When BizOps receives notification of a Fleetie's manager changing, follow these steps to ensure correct recording in our systems.
-1. Update [🧑‍🚀 Fleeties](https://docs.google.com/spreadsheets/d/1OSLn-ZCbGSjPusHPiR5dwQhheH1K8-xqyZdsOe9y7qc/edit#gid=0):
-    - Search for the Fleetie's new manager, and copy the new manager's unique ID from the far left "Unique ID" column.
-    - Search for the Fleetie who's manager is changing, and paste (without formatting) their new manager's unique ID in the "Reports to: (manager unique ID)" cell in the Fleetie's row.
-    - Verify that the "Reports to (auto: manager name and job title)" cell in the Fleetie's row reflects the new manager's details.
-    - Verify that in the new manager's row, the "# direct reports" cell reflect the correct number.
-    - Navigate to the "Org chart" tab in the spreadsheet, and verify that the Fleetie now appears in the correct place in the org chart.
-2. If the person's department is changing, then update both departmental handbook pages to move the person to their new department:
-    - Remove the person from the "Team" section of the old department and add them to the "Team" section of the new department.
-3. If the person's level of confidential access will change along with the change to their manager, then update that level of access:
-    - Update Google Workspace to make sure this person lives in the correct Google Group, removing them from the old and/or adding them to the new.
-    - Update 1password to remove this person from old vaults and/or add them to new vaults.
-    - For a team member moving from "classified" to "confidential" access, check Gusto, Plane, and other systems to remove their access.
-
-> **Note:** The Fleeties spreadsheet is the source of truth for who everyone's manager is and their job titles.
-
-### Recognize employee workiversaries
-
-At Fleet, everyone is recognized on their [workiversary](https://fleetdm.com/handbook/company/communications#workiversaries). To ensure this happens, take the following steps:
-
-1. Bimonthly, use [Fleeties (private google doc)](https://docs.google.com/spreadsheets/d/1OSLn-ZCbGSjPusHPiR5dwQhheH1K8-xqyZdsOe9y7qc/edit#gid=0) to determine who is celebrating their workiversary in the following two months.
-2. Post in the #help-classifed Slack channel and cc the Head of Business Operations. Use the following template:
-
-   
-    ```
-    [Month]
-    [workiversary date (DD-MMM)] - [teammate name] - [number of years at Fleet]
-    ```
-
-    
-   The Apprentice to the CEO will also use this post to update the [All hands](https://fleetdm.com/handbook/company/communications#all-hands) deck.
-3. On the day prior to a workiversary, send the teammate’s manager a DM on Slack:
-
-
-    ```
-    Hey! Just a heads up, tomorrow is [teammate’s name] [number of years at Fleet] workiversary at Fleet.
-    BizOps were planning on posting something in the #random channel to recognize them, but I was wondering if you would like to instead?
-    ```
-
-    
-   > If a manager elects to post and hasn't done so by 2pm ET on the day of the workiversary, send them a friendly reminder and offer to post instead.
-
-4. If the manager has deferred to BizOps, schedule a Slack post for the following day to recognize the teammate's contributions at Fleet. If you’re unsure about what to post, take a look at what’s been [posted previously](https://docs.google.com/document/d/1Va4TYAs9Tb0soDQPeoeMr-qHxk0Xrlf-DUlBe4jn29Q/edit).
-
-
-
-### Prepare salary benchmarking information
-1. Use the relevant template text in the README section of the [¶¶ 💌 Compensation decisions document](https://docs.google.com/document/d/1NQ-IjcOTbyFluCWqsFLMfP4SvnopoXDcX0civ-STS5c/edit?usp=sharing) for a current Fleetie, a new role, a prospective hire, or other benchmarking use case.
-2. Copy the template text and paste at the end of the document.
-3. Fill in details as required, pulling from [🧑‍🚀 Fleeties spreadsheet](https://docs.google.com/spreadsheets/d/1OSLn-ZCbGSjPusHPiR5dwQhheH1K8-xqyZdsOe9y7qc/edit#gid=0) and [equity spreadsheet](https://docs.google.com/spreadsheets/d/1_GJlqnWWIQBiZFOoyl9YbTr72bg5qdSSp4O3kuKm1Jc/edit?usp=sharing) as required.
-4. Use the teammate's information to benchmark in [Pave](https://www.pave.com/) (login details in 1Password). You can pattern match from previous benchmarking entries, and include all company assumtions. Add the direct link to the Pave benchmark.
-
-
-### Update a team member's compensation
-To [change a team member's compensation](https://fleetdm.com/handbook/company/communications#compensation-changes), follow these steps:
-1. Create a copy of the ["Values assessment" template](https://docs.google.com/spreadsheets/d/1P5TyRV2v-YN0aR_X8vd8GksKcr3uHfUDdshqpVzamV8/edit?usp=drive_link) and move it to the team member's [personnel folder in Google Drive](https://drive.google.com/drive/folders/1UL7o3BzkTKnpvIS4hm_RtbOilSABo3oG?usp=drive_link).
-2. Share the values assessment document with the manager and ask them to perform the values assessment.
-3. Once the values assessment is complete, [prepare salary benchmarking information](#prepare-salary-benchmarking-information) and set a meeting between the manager, head of department, and Head of Business Operations about level of job skill in relation to compensation benchmarking levels.
-4. Schedule a new calendar event for the Head of Business Operations with the founders over an existing founders' 1:1 to discuss if an adjustment needs to be made to team member's compensation to align with benchmarking. During the 1:1 call, founders review values assessment, benchmarking for role and geography, and decide if there will be an adjustment.
-5. Head of Business Operations will post in slack to `#help-classified` with the decision on compensation changes and effective date, if any.
-6. Communicate via Slack DM the decision to the teammate's people manager, who will then communicate to their teammate.
-7. Update the respective payroll platform (Gusto or Plane) by navigating to the personnel page, selecting salary field, and updating with an effective date that makes the next payroll.
-8. Update the [equity spreadsheet](https://docs.google.com/spreadsheets/d/1_GJlqnWWIQBiZFOoyl9YbTr72bg5qdSSp4O3kuKm1Jc/edit?usp=sharing) (internal doc) by copying existing OTE to the bottom of the "Notes" cell, updating the OTE column with the new compensation information, and updating the "Last compensation change" column with the effective date from payroll platform.
-
-> If the company decides on an additional equity grant as part of a compensation change, note the previous equity and new situation in detail in the "Notes" column of the equity plan. Update the "Grant started?" column to "todo" which adds it to the queue for the next time grants are processed (quarterly).
-
-### Review Fleet's US company benefits
-
-Annually, around mid-year, Fleet will be prompted by Gusto to review company benefits. The goal is to keep changes minimal. Follow these steps:
-1. Log in to your [Gusto admin account](https://gusto.com/).
-2. Navigate to "Benefits" and select "Renewal survey".
-3. Complete the survey questions, aiming for minimal changes.
-4. Approximately 2-3 months after survery completion, Gusto will suggest plans based on Fleet's responses. Choose plans with minimal changes.
-5. Gusto will offer these plans to employees during open enrollment, with new coverage starting 3-4 weeks afterward.
-   
-
-### Process monthly accounting
-Create a [new montly accounting issue](https://github.com/fleetdm/confidential/issues/new/choose) for the current month and year named "Closing out YYYY-MM" in GitHub and complete all of the tasks in the issue. (This uses the [monthly accounting issue template](https://github.com/fleetdm/confidential/blob/main/.github/ISSUE_TEMPLATE/5-monthly-accounting.md).
-
-- **SLA:** The monthly accounting issue should be completed and closed before the 7th of the month.
-- The close date is tracked each month in [KPIs](https://docs.google.com/spreadsheets/d/1Hso0LxqwrRVINCyW_n436bNHmoqhoLhC8bcbvLPOs9A/edit).
-- **When is the issue created?** We create and close the monthly accounting issue for the previous month within the first 7 days of the following month.  For example, the monthly accounting issue to close out the month of January is created promptly in February and closed before the end of the day, Feb 7th.  A convenient trick is to create the issue on the first Friday of the month and close it ASAP.
-
-
-### Respond to low credit alert
-Fleet admins will receive an email alert when the usage of company cards for the month is aproaching the company credit limit. To avoid the limit being exceeded, a Brex admin will follow these steps:
-1. Sign in to Fleet's Brex account.
-2. On the landing page, use the "Move money" button to "Add funds to your Brex business accounts".
-3. Select "Transfer from a connected account" and select the primary business account.
-4. Choose the "One time" transfer option and process the transfer.
-
-No further action needs to be taken, the amount available for use will increase without disruption to regular processes.
-
-### Check franchise tax status
-No later than the second month of every quarter, we check [Delaware divison of corporations](https://icis.corp.delaware.gov) to ensure that Fleet has paid the quarterly franchise tax amounts to remain in good standing with the state of Delaware.
-- Go to the [DCIS - eCorp website](https://icis.corp.delaware.gov/ecorp/logintax.aspx?FilingType=FranchiseTax) and use the details in 1Password to look up Fleet's status.
-- If no outstanding amounts: the tax has been paid.
-- If outstanding amounts shown: ensure payment before due date to avoid penalties, interest, and entering bad standing.
-
-
-### Check finances for quirks
-Every quarter, we check Quickbooks Online (QBO) for discrepancies and follow up on quirks.
-1. Check to make sure [bookkeeping quirks](https://docs.google.com/spreadsheets/d/1nuUPMZb1z_lrbaQEcgjnxppnYv_GWOTTo4FMqLOlsWg/edit?usp=sharing) are all accounted for and resolved or in progress toward resolution.
-2. Check balance sheet and profit and loss statements (P&Ls) in QBO against the latest [monthly workbooks](https://drive.google.com/drive/folders/1ben-xJgL5MlMJhIl2OeQpDjbk-pF6eJM) in Google Drive. Ensure reports are in the "accural" accounting method.
-3. Reach out to Pilot with any differences or quirks, and ask them to resolve/provide clarity.  This often will need to happen over a call to review sycnhronously.
-4. Once quirks are resolved, note the day it was resolved in the spreadsheet.
-
-
-### Report quarterly numbers in Chronograph
-Follow these steps to perform quarterly reporting for Fleet's investors:
-1. Login to Chronograph and upload our profit and loss statement (P&L), balance sheet and cash flow statements for CRV (all in one book saved in [Google Drive](https://drive.google.com/drive/folders/1ben-xJgL5MlMJhIl2OeQpDjbk-pF6eJM).
-2. Provide updated metrics for the following items using Fleet's [KPI spreadsheet](https://docs.google.com/spreadsheets/d/1Hso0LxqwrRVINCyW_n436bNHmoqhoLhC8bcbvLPOs9A/edit#gid=0).
-    - Headcount at end of the previous quarter.
-    - Starting ARR for the previous quarter.
-    - Total new ARR for the previous quarter.
-    - "Upsell ARR" (new ARR from expansions only- Chronograph defines "upsell" as price increases for any reason.
-      **- Fleet does not "upsell" anything; we deliver more value and customers enroll more hosts), downgrade ARR and churn ARR (if any) for the previous quarter.**
-    - Ending ARR for the previous quarter.
-    - Starting number of customers, churned customers, and the number of new customers Fleet gained during the previous quarter.
-    - Total amount of Fleet customers at the end of the previous quarter.
-    - Gross margin % 
-      - How to calculate: (total revenue for the quarter - cost of goods sold for the quarter)/total revenue for the quarter (these metrics can be found in our books from Pilot). Chronograph will automatically conver this number to a %.
-    - Net dollar retention rate
-      - How to calculate: (starting ARR + new subscriptions and expansions - churn)/starting ARR. 
-    - Cash burn
-      - How to calculate: start of quarter runway - end of quarter runway. 
-
-
-### Grant equity
-Equity grants for new hires are queued up as part of the [hiring process](https://fleetdm.com/handbook/business-operations#hiring), then grants and consents are [batched and processed quarterly](https://github.com/fleetdm/confidential/issues/new/choose).
-
-Doing an equity grant involves:
-- Executing a board consent
-- The recipient and CEO signing paperwork about the stock options
-- Updating the number of shares for the recipient in the equity plan
-- Updating Carta to reflect the grant
-
-For the status of stock option grants, exercises, and all other _common stock_ including advisor, founder, and team member equity ownership, see [Fleet's equity plan](https://docs.google.com/spreadsheets/d/1_GJlqnWWIQBiZFOoyl9YbTr72bg5qdSSp4O3kuKm1Jc/edit#gid=0).  For information about investor ownership, see [Carta](https://app.carta.com/corporations/1234715/summary/).
-
-> Fleet's [equity plan](https://docs.google.com/spreadsheets/d/1_GJlqnWWIQBiZFOoyl9YbTr72bg5qdSSp4O3kuKm1Jc/edit#gid=0) is the source of truth, not Carta.  Neither are pro formas sent in an email attachment, even if they come from lawyers.
-> 
-> Anyone can make mistakes, and none of us are perfect.  Even when we triple check.  Small mistakes in share counts can be hard to attribute, and can cause headaches and eat up nights of our CEO's and operations team's time.  If you notice what might be a discrepancy between the equity plan and any other secondary source of information, please speak up and let Fleet's CEO know ASAP.  Even if you're wrong, your note will be appreciated.
-
-
-### Deliver annual report for venture line
-Within 60 days of the end of the year, follow these steps:
-1. Provide Silicon Valley Bank (SVB) with our balance sheet and profit and loss statement (P&L, sometimes called a cashflow statement) for the past twelve months.  
-2. Provide SVB with our board-approved annual operating budgets and projections (on a quarterly granularity) for the new year.
-3. Deliver this as early as possible in case they have questions.
-
-
-### Process a new vendor invoice
-Fleet pays its vendors in less than 15 business days in most cases. All invoices and tax documents should be submitted to the Business Operations department using the [appropriate Fleet email address (confidential Google Doc)](https://docs.google.com/document/d/1tE-NpNfw1icmU2MjYuBRib0VWBPVAdmq4NiCrpuI0F0/edit#heading=h.wqalwz1je6rq).
-- After making sure the invoice received from a new vendor is valid, add the new vendor to the recurring expenses section of ["The numbers"](https://docs.google.com/spreadsheets/d/1X-brkmUK7_Rgp7aq42drNcUg8ZipzEiS153uKZSabWc/edit#gid=2112277278) before paying the invoice.
-- If we have not paid this vendor before, make sure we have received the required W-9 or W-8 form from the vendor. **Accounting cannot process a payment without these tax forms for compliance reasons.**
-  - **US-based vendors** are required to complete a [W-9 form](https://www.irs.gov/pub/irs-pdf/fw9.pdf).
-  - **Non-US based vendors and individuals** are required to follow these [instructions](https://www.irs.gov/instructions/iw8bene) and provide a completed [W-8BEN-E](https://www.irs.gov/pub/irs-pdf/fw8bene.pdf) form.
-
-
-
-### Process a request to cancel a vendor
-- Make the cancellation notification in accordance with the contract terms between Fleet and the vendor, typically these notifications are made via email and may have a specific address that notice must be sent to. If the vendor has an autorenew contract with Fleet there will often be a window of time in which Fleet can cancel, if notification is made after this time period Fleet may be obligated to pay for the subsequent year even if we don't use the vendor during the next contract term.  
-- Once cancelled, update the recurring expenses section of [The Numbers](https://docs.google.com/spreadsheets/d/1X-brkmUK7_Rgp7aq42drNcUg8ZipzEiS153uKZSabWc/edit#gid=2112277278) to reflect the cancellation by changing the projected monthly burn in column G to $0 and adding "CANCELLED" in front of the vendor's name in column C.
-
-
-### Review an NDA
-We need to review an NDA anytime a vendor, customer or other party wants to:
-- Use their own NDA rather than Fleet's standard NDA, or
-- "Redline" (modify) Fleet's NDA by removing, adding or altering its terms.
-
-We should always seek to use Fleet's own NDA first, without alteration. 
-
-When reading an NDA, we want to pay close attention to the following:
-- We want to be sure that the confidentiality obligations of the NDA are reciprocal.  Fleet and the other party to the agreement should be bound to the same standards of confidentiality toward the handling of each other's confidential information.
-- Fleet does not agree to _"do not compete"_ or _"do not solicit clauses"_. An NDA should not contain provisions beyond the scope of an NDA. The two most commonly encountered examples of this are the "do not compete" and "do not solicit" clauses. We want to be free to hire the best people and make the best products, so when reading through an NDA it is important to keep an eye out for language that prohibits Fleet from hiring or soliciting current or former employees of other companies or that prohibit Fleet from independently developing products that compete with another company's products.  Using the `cmd + f` function to search for "solici", "compet" and "hir" and reading through the results is a helpful method to quickly scan for these clauses.
-- Look for any language that discusses a transfer of property rights. Rarely, you may find a clause snuck into an agreement that discusses the transfer of intellectual property rights.  _We want to avoid any situation where Fleet transfers its intellectual property to another party as part of an NDA_.  
-- Should you find any clauses in steps 2 or 3 that are beyond the scope of protecting both party's confidential information in a customer NDA or an altered version of Fleet's NDA, reject this language and communicate that Fleet cannot agree to those terms.
-- Any concerns or uncertainty over _any_ provisions in an NDA should be brought to Nathanael Holliday in BizOps, who will consult legal counsel if necessary to resolve any concerns.
-
-### Review a vendor agreement
-When reviewing contracts from a vendor, Fleet is concerned about the following:
-- If there are confidentiality provisions in the agreement in place of a stand-alone NDA, verify the confidentiality provisions are appropriate and protect Fleet when sensitive data is involved that isn't otherwise available to the public.
-- We want to make sure there are no _do not solicit_ or _do not compete_ clauses in the contract.  To aid in this search, we double check by using the cmd + f function and searching for "solici", "compet" and "hir" and then looking through the results to be sure that nothing prohibits Fleet from independently developing competing products or from hiring personnel with ties to the vendor.
-- We want to make sure that contracts can be terminated relatively easily and be aware of what the process is for terminating them, avoiding commitments over 12 months in length.
-- We want to make sure the payment terms work for us (i.e. being able to pay via wire transfer, credit card or bill.com) and that the price in any contract or order form is what we have agreed to.  While almost never malicious, mistakes often occur in the steps between agreeing on a price, negotiating a contract, and receiving an invoice.  We want to be sure at every step that the dollar amount and service provided is consistent with what has been negotiated and agreed upon.
-- Remember, once we have signed the agreement - we're stuck with it. If any clause in the agreement appears strange or gives you pause or concern, it is better to seek clarification than to commit to something that might be detrimental to Fleet.  Contracts are fairly standardized, and you'll quickly learn what is normal and what feels out of place.  Unusual clauses or wording that seems out of the ordinary should get a second set of eyes just to be sure, do not hesitate to reach out to Nathanael Holliday with questions, who will reach out to legal counsel as necessary.
-
-### Review an order form
-- We should always check order forms for additional terms that go beyond the scope of the order form (caps on price increases, for example).
-- Be sure the order form includes contact information + billing address and information so that Fleet knows how and who to invoice for payment.
-- Verify that the payment terms are correct and matches what's in the agreement. This is a frequent common mistake as companies usually have default payment terms and overlook changing them to match atypical payment terms.
-- Make sure the effective term of the order matches what was agreed upon (usually a one year term) and that the order form includes the correct number of hosts and whether or not it should contain professional services (usually, it does not). 
-- Check that the amount on the order form reflects what Fleet agreed to, as this is the amount that the customer will expect to be invoiced for.
-- Lastly, double check one more time to make sure there are no sneaky, unusual terms snuck in at the bottom of an order form or stashed away in fine print.  Common things that are included in order forms and not always communicated to Fleet are caps on price increases upon renewal, new SLAs, or a product roadmap or milestones we may not have agreed upon.  Any clauses on an order form that appear beyond the scope of simply elaborating on the services being provided, the purchase cost, the contract that the purchase is being made under, how Fleet will bill and how the customer will pay deserves a careful look.  Reach out to Nathanael Holliday in BizOps with concerns.
-
-### Review a non-standard subscription agreement
-We want to use our standard terms whenever possible with our customers, but it is common that customers want to use their own agreement or redline (modify) Fleet's terms.  
-When reviewing subscription agreements on customer paper or when a customer has made changes to Fleet's terms, we review it using [these guidelines](https://docs.google.com/document/d/1aGgN5It1i3fdsBF37vWSbvukO_gQhy5vCp4fINg191Q/edit?usp=sharing).
-   
-
-### Update weekly KPIs
-- Create the weekly update issue from the template in ZenHub every Friday and update the [KPIs for BizOps](https://docs.google.com/spreadsheets/d/1Hso0LxqwrRVINCyW_n436bNHmoqhoLhC8bcbvLPOs9A/edit#gid=0) by 5pm US central time.
-- Check the KPI sheet at 5pm US central time to ensure all departments have updated their KPIs on time.  If any departments are delinquent, notify the department head and let the [Apprentice](https://fleetdm.com/handbook/digital-experience#team) know so they can put it on the agenda for their next one-on-one with the CEO.
-
-
-## Rituals
-
-The following table lists this department's rituals, frequency, and Directly Responsible Individual (DRI).
-
-<rituals :rituals="rituals['handbook/business-operations/business-operations.rituals.yml']"></rituals>
-
-<!--
-Note: These are out of date, but retained for future reference.  TODO: Deal with them and delete them
-
-| Access revalidation | Quarterly | Review critical access groups to make sure they contain only relevant people. | Mike McNeil |
-| 550C update | Annually | File California 550C. | Mike McNeil |
-| TPA verifications | Quarterly | Every quarter before tax filing due dates, Mike McNeil audits state accounts to ensure TPA is set up or renewed. | Mike McNeil |
-| YubiKey adoption | Monthly | Track YubiKey adoption in Google workspace and follow up with those that aren't using it. | Mike McNeil |
-| Security policy update | Annually | Update security policies and have them approved by the CEO. | Nathanael Holliday |
-| Security notifications check | Daily | Check Slack, Google, Vanta, and Fleet dogfood for security-related notifications. | Nathanael Holliday |
-| Changeset for onboarding issue template | Quarterly | pull up the changeset in the onboarding issue template and send out a link to the diff to all team members by posting in Slack's `#general` channel. | Mike McNeil |
-| MDM device enrollment | Quarterly | Provide export of MDM enrolled devices to the ops team. | Luke Heath |
--->
-
-#### Stubs
-The following stubs are included only to make links backward compatible.
-
-##### Vetty
-Please see [hanbook/business-operations#access-a-background-check](https://www.fleetdm.com/handbook/business-operations#access-a-background-check).
-
-##### Role-specific licenses  
-Please see [hanbook/business-operations#grant-role-specific-license-to-a-team member](https://www.fleetdm.com/handbook/business-operations#grant-role-specific-license-to-a-team-member).
-
-##### Recurring expenses
-##### Tools we use
-Please see [hanbook/business-operations#grant-role-specific-license-to-a-team member](https://www.fleetdm.com/handbook/business-operations#reconcile-monthly-recurring-expenses).
-
-##### Secure company-issued equipment for a team member
-Please see [handbook/engineering#secure-company-issued-equipment-for-a-team-member](https://www.fleetdm.com/handbook/engineering#secure-company-issued-equipment-for-a-team-member).
-
-##### Register a domain for Fleet
-Please see [handbook/register-a-domain-for-fleet](https://www.fleetdm.com/handbook/engineering#register-a-domain-for-fleet).
-
-##### Updating personnel details
-Please see [handbook/engineering#update-personnel-details](https://www.fleetdm.com/handbook/engineering#update-personnel-details).
-
-##### Fix a laptop that's not checking in
-Please see [handbook/engineering#fix-a-laptop-thats-not-checking-in](https://www.fleetdm.com/handbook/engineering#fix-a-laptop-thats-not-checking-in)
-
-##### Enroll a macOS host in dogfood
-Please see [handbook/engineering#enroll-a-macos-host-in-dogfood](https://www.fleetdm.com/handbook/engineering#enroll-a-macos-host-in-dogfood)
-
-##### Enroll a Windows or Ubuntu Linux device in dogfood
-Please see [handbook/engineering#enroll-a-windows-or-ubuntu-linux-device-in-dogfood](https://www.fleetdm.com/handbook/engineering#enroll-a-windows-or-ubuntu-linux-device-in-dogfood)
-
-##### Enroll a ChromeOS device in dogfood
-Please see [handbook/engineering#enroll-a-chromeos-device-in-dogfood](https://www.fleetdm.com/handbook/engineering#enroll-a-chromeos-device-in-dogfood)
-
-##### Lock a macOS host in dogfood using fleetctl CLI tool
-Please see [handbook/engineering#lock-a-macos-host-in-dogfood-using-fleetctl-cli-tool](https://www.fleetdm.com/handbook/engineering#lock-a-macos-host-in-dogfood-using-fleetctl-cli-tool)
-
-##### Book an event
-Please see [handbook/engineering#book-an-event](https://www.fleetdm.com/handbook/engineering#book-an-event)
-
-##### Order SWAG
-Please see [handbook/engineering#order-swag](https://www.fleetdm.com/handbook/engineering#order-swag)
-
-
-<meta name="maintainedBy" value="jostableford">
-<meta name="title" value="🔦 Business Operations">
diff --git a/handbook/company/README.md b/handbook/company/README.md
index 03f0ac42a7..037922d3d1 100644
--- a/handbook/company/README.md
+++ b/handbook/company/README.md
@@ -137,34 +137,19 @@ Fleet added support for [scripting and management capabilities](https://fleetdm.
 ## Org chart
 To provide clarity about decision-making, [responsibility](https://fleetdm.com/handbook/company/why-this-way#why-direct-responsibility), and resources, everyone at Fleet has a manager, and [every manager](https://fleetdm.com/handbook/company/leadership) has direct reports.  Fleet's organizational chart is accessible company-wide as a sub-tab in ["🧑‍🚀 Fleeties" (private google doc)](https://docs.google.com/spreadsheets/d/1OSLn-ZCbGSjPusHPiR5dwQhheH1K8-xqyZdsOe9y7qc/edit#gid=0).  On the other sub-tabs, you can also check out a world map of where everyone is located, hiring stats, and fun facts about each team member.
 
-- 🔦 [Business Operations](https://fleetdm.com/handbook/business-operations): The Business Operations department is directly responsible for people operations, finance + invoicing, tax, compliance, and legal + deal desk.
-- 🌦️ [Customer Success](https://fleetdm.com/handbook/customer-success): The customer success department is directly responsible for ensuring that customers and community members of Fleet achieve their desired outcomes with Fleet products and services.
-- 🐋 [Sales](https://fleetdm.com/handbook/sales): The Sales department is directly responsible for attaining the revenue goals of Fleet and helping customers deliver on their objectives.
-- 🫧 [Demand](https://fleetdm.com/handbook/demand): The Demand department is directly responsible for growing awareness of Fleet and nurturing the community through participation in events, conversations, and other programs.
 - 🚀 [Engineering](https://fleetdm.com/handbook/engineering): The Engineering department at Fleet is directly responsible for writing and maintaining the code for Fleet's core product, as well as Fleet's Information technology (IT) infrastucture.
 - 🦢 [Product Design](https://fleetdm.com/handbook/product-design): The Product Design department is directly responsible for defining and prioritizing the changes made to the core product, Fleet API, and reference documentation.
-- 🌐 [Digital Experience](https://fleetdm.com/handbook/digital-experience): The Digital Experience department is directly responsible for the framework, content design, and technology behind Fleet's remote work culture and overall brand experience, including fleetdm.com, the handbook, issue templates, UI style guides, consistent brandfronts, internal tooling, Zapier flows, Docusign templates, key spreadsheets, and project management processes. 
+- 🌦️ [Customer Success](https://fleetdm.com/handbook/customer-success): The customer success department is directly responsible for ensuring that customers and community members of Fleet achieve their desired outcomes with Fleet products and services.
+- 🫧 [Demand](https://fleetdm.com/handbook/demand): The Demand department is directly responsible for growing awareness of Fleet and nurturing the community through participation in events, conversations, and other programs.
+- 💸 [Finance](https://fleetdm.com/handbook/finance): The Finance department is directly responsible for accounts receivable including invoicing, accounts payable including commision calculations, exspense reporting including Brex memos and maintaining accurate spend projections in "🧮The numbers", sales taxes, payroll taxes, corporate income/franchise taxes, and financial operations including bank accounts and cash flow management.
+- 🐋 [Sales](https://fleetdm.com/handbook/sales): The Sales department is directly responsible for attaining the revenue goals of Fleet and helping customers deliver on their objectives.
+- 🌐 [Digital Experience](https://fleetdm.com/handbook/digital-experience): The Digital Experience department is directly responsible for the culture, training, framework, content design, and technology behind Fleet's remote work culture, including fleetdm.com, the handbook, issue templates, UI style guides, internal tooling, Zapier flows, Docusign templates, key spreadsheets, contracts, compliance, receiving and responding to legal notices, SOC2, deal desk, project management processes, human resources, benefits, opening positions, compensation planning, onboarding, and offboarding.
+
 
 ## Advisors
 While most improvements at Fleet are driven by informal conversations with customers and open-source contributors, the company also has a few dozen advisors and investors, including  
 [Sid](https://about.gitlab.com/blog/2022/10/14/one-third-of-what-we-learned-about-ipos-in-taking-gitlab-public/) [Sijbrandij](https://about.gitlab.com/handbook/ceo/#sijbrandij-pronunciation-hint) _(GitLab)_, [Dylan Field](https://en.wikipedia.org/wiki/Dylan_Field) _(Figma)_, [Mike Arpaia](https://www.youtube.com/watch?v=zfCak2UIOD8) _(osquery)_, [Alexandr Wang](https://www.businessofbusiness.com/articles/scale-ai-machine-learning-startup-alexandr-wang/) _(Scale AI)_, [Sanjay](https://www.zdnet.com/article/vmware-buys-airwatch-for-1-54-billion-acquires-mobility-strategy/) [Poonen](https://www.businessinsider.com/vmware-carbon-black-acquisition-sanjay-poonen-cybersecurity-2019-10?op=1) _(VMware, Cohesity)_, and [other smart people who are eager to help](https://docs.google.com/spreadsheets/d/15knBE2-PrQ1Ad-QcIk0mxCN-xFsATKK9hcifqrm0qFQ/edit).  If you have a question for one of them, Fleet's CEO is happy to introduce you.  ([Just ask](https://fleetdm.com/handbook/company/leadership#contact-the-ceo).)
 
-<!--
-#### Stubs
-The following stubs are included only to make links backward compatible.
-
-##### Levels of confidentiality
-
-Please see [📖handbook/company/communications#levels-0f-confidentiality](https://fleetdm.com/handbook/communtications#levels-of-confidentiality).
-
-##### Email relays
-
-Please see [📖handbook/company/communications#email-relays](https://fleetdm.com/handbook/communtications#email-realys).
-
-##### Tools we use
-
-Please see [📖Business Operations#tools-we-use](https://fleetdm.com/handbook/business-operations#tools-we-use).
--->
 
 <meta name="maintainedBy" value="mikermcneil">
 <meta name="title" value="🔭 Company">
diff --git a/handbook/company/communications.md b/handbook/company/communications.md
index 0c3eed5af7..c83524ee66 100644
--- a/handbook/company/communications.md
+++ b/handbook/company/communications.md
@@ -38,8 +38,8 @@ We track competitors' capabilities and adjacent (or commonly integrated) product
 | Social media                         | <sup><sub>_See [🫧 Digital Marketing Manager](https://fleetdm.com/handbook/demand#team)_</sup></sub>
 | Blog                                 | <sup><sub>_See [🚀 Client Platform Engineer &amp; Community Advocate](https://fleetdm.com/handbook/engineering#team)_</sup></sub>
 | Information technology (IT)          | <sup><sub>_See [🚀 Client Platform Engineer &amp; Community Advocate](https://fleetdm.com/handbook/engineering#team)_</sup></sub>
-| Payroll, bookkeeping, AR/AP          | <sup><sub>_See [🔦 Head of Business Operations](https://fleetdm.com/handbook/customer-success#team)_</sup></sub>
-| Legal contracts                      | <sup><sub>_See [🔦 Business Operations team](https://fleetdm.com/handbook/customer-success#team)_</sup></sub>
+| Payroll, bookkeeping, AR/AP          | <sup><sub>_See [💸 Head of Finance](https://fleetdm.com/handbook/finance#team)_</sup></sub>
+| Legal contracts                      | <sup><sub>_See [🌐 Digital Experience team](https://fleetdm.com/handbook/digital-experience#team)_</sup></sub>
 | Customer renewals                    | <sup><sub>_See [🌦️ VP of Customer Success](https://fleetdm.com/handbook/customer-success#team)_</sup></sub>
 | Customer deployments                 | <sup><sub>_See [🌦️ Infrastructure Engineer](https://fleetdm.com/handbook/customer-success#team)_ </sup></sub>
 | Customer support                     | <sup><sub>_See [🌦️ Customer Success team](https://fleetdm.com/handbook/customer-success#team)_</sup></sub>
@@ -53,11 +53,26 @@ We track competitors' capabilities and adjacent (or commonly integrated) product
 | Product introduction docs            | <sup><sub>_See [🛠️ CEO responsibilities](https://fleetdm.com/handbook/company/leadership#ceo-responsibilities)_</sup></sub>
 | Product deployment docs              | <sup><sub>_See [🚀 Chief Technology Officer](https://fleetdm.com/handbook/engineering#team)_</sup></sub>
 | Product usage docs                   | <sup><sub>_See [🦢 Head of Product Design](https://fleetdm.com/handbook/product-design#team)_</sup></sub>
-| Product reference docs               | <sup><sub>_See [🦢 Noah Talerman](https://fleetdm.com/handbook/product-design#team)_</sup></sub>
+| Product reference docs               | <sup><sub>_See [🦢 Head of Product Design](https://fleetdm.com/handbook/product-design#team)_</sup></sub>
 | What goes in a release               | <sup><sub>_See [🚀 Chief Technology Officer](https://fleetdm.com/handbook/engineering#team)_ </sup></sub> 
 | Engineering output and architecture  | <sup><sub>_See [🚀 Chief Technology Officer](https://fleetdm.com/handbook/engineering#team)_ </sup></sub>
 | Product development                  | <sup><sub>_See [🛩️ Product groups](https://fleetdm.com/handbook/company/product-groups#current-product-groups)_ </sup></sub>
 
+## Tech stack admins
+
+| Role | Google Workspace | Slack | GitHub | Gusto | Pilot | Plane | 1Password |
+|:-----|-----------------:|------:|-------:|------:|------:|------:|----------:|
+| CEO | ✅ Super admin | ✅ Primary workspace owner | ✅ Owner | ✅ Primary admin | ✅ Owner |✅ Owner | ✅ Owner |
+| CTO | ❌ | ❌ | ✅ Owner | ❌ | ❌ | ✅ Admin | ❌ |
+| Head of Finance | ❌ | ❌ | ❌ | ✅ Admin | ✅ Admin | ✅ Admin | ❌ |
+| Finance Engineer | ❌ | ❌ | ❌ | ✅ Admin | ✅ Admin |✅ Admin | ❌ |
+| Head of Digital Experience | ✅ Super admin | ✅ Owner | ✅ Owner| ✅ Admin | ❌ | ✅ Admin | ✅ Admin |
+| Apprentice | ✅ Super admin| ✅ Owner | ✅ Owner | ✅ Admin | ❌ | ✅ Admin | ✅ Admin |
+| Digital Experience Engineer | ✅ Super admin | ✅ Admin | ❌ | ❌ | ❌ | ❌ | ✅ Admin |
+| Head of Product Design | ❌ | ✅ Admin | ❌ | ❌ | ❌ | ❌ | ❌ |
+| VP of CX | ❌ | ✅ Owner | ❌ | ❌ | ❌ | ❌ | ❌ |
+| CX Sr. Suppoert Engineer | ❌ | ✅ Admin | ❌ | ❌ | ❌ | ❌ | ❌ |
+| Pilot bookkeeper | ❌ | ❌ | ❌ | ✅ Admin | ❌ | ✅ Admin | ❌ |
 
 ### Docs
 
@@ -92,7 +107,7 @@ Any change to fleetdm.com follows the same process as [making changes](https://f
 
 Before committing anything to code, we create wireframes (referred to as ["drafting"](https://fleetdm.com/handbook/company/product-groups#making-changes)) to illustrate all changes that affect the layout and structure of the user interface, design, or APIs of fleetdm.com. See [Why do we use a wireframe first approach](https://fleetdm.com/handbook/company/why-this-way#why-do-we-use-a-wireframe-first-approach) for more information. 
 
-The [Digital Experience team](https://fleetdm.com/handbook/digital-experience#team) holds regular design review sessions to evaluate, revise, and approve wireframes before moving into production. Design review sessions are hosted by the [Head of Design](https://calendar.google.com/calendar/u/0?cid=bXRob21hc0BmbGVldGRtLmNvbQ) and typically take place daily, late afternoon (CST). Anyone is welcome to join.
+The [Digital Experience team](https://fleetdm.com/handbook/digital-experience#team) holds regular design review sessions to evaluate, revise, and approve wireframes before moving into production. Design review sessions are hosted by the [Head of Design](https://calendar.google.com/calendar/u/0?cid=bXRob21hc0BmbGVldGRtLmNvbQ) and typically take place daily, late afternoon (CT). Anyone is welcome to join.
 
 
 ## Marketing programs
@@ -133,11 +148,10 @@ It's important for Fleet to engage at [events](https://docs.google.com/spreadshe
 
 #### Event lead follow-up
 
-Eventgoers expect a timely follow-up from Fleet based on the conversations that they had at the event.
+Eventgoers expect a timely [follow-up from Fleet](https://fleetdm.com/handbook/demand#upload-contacts-to-salesforce-after-an-event) based on the conversations that they had at the event.
 
-1. Once a list of badge scans is available, Fleeties that attended the event are to add any follow up notes that note buying situation, amount of endpoints, level of interest, and general talking points.
-2. Within 3 business days of returning from the event, attendees will set up a debrief meeting with the demand team to discuss follow-up.
-3. Demand will determine appropriate follow-up to each potential lead, and sales will be notified of actions needed immediately following.
+1. Once a list of badge scans is available, Fleeties who attended the event are to add any follow-up notes, including primary buying situation, amount of endpoints, level of interest, and general talking points.
+2. Within three business days of returning from the event, attendees will set up a debrief meeting with the demand team to discuss follow-up and provide the list of badge scans uploaded to the ["Events" folder in Google Drive](https://drive.google.com/drive/u/0/folders/1uXf95V6CHKHnqxRc9iQr0a0FnTZk3bXR).
 
 
 ### Podcast
@@ -177,7 +191,7 @@ Fleet uses YouTube to help keep the community up-to-date and informed. These vid
 
 When scheduling external meetings, provide external participants with a
 [Calendly](https://calendly.com) link to schedule with the relevant internal participants. If you
-need a Calendly account, reach out to `#g-business-operations` via Slack.
+need a Calendly account, reach out to `#g-digital-experience` via Slack.
 
 
 ### Internal meeting scheduling
@@ -285,7 +299,7 @@ In some instances, you may need to record a call locally (i.e. save the recordin
 Fleet uses these levels to standardize a commitment to minimal esotericism across the company.  
 - **Public:**   _Share with anyone, anywhere in the world_
 - **Confidential:**  _Share only with team members who've signed an NDA, consulting agreement, or employment agreement_
-- **Classified:**  _Share only with founders of Fleet, business operations, and/or the people involved.  e.g., US social security numbers during hiring_
+- **Classified:**  _Share only with the CEO, Head of Digital Experience, and/or the people involved.  e.g., US social security numbers during hiring_
 
 
 ### Document titles
@@ -294,8 +308,8 @@ Fleet uses these levels to standardize a commitment to minimal esotericism acros
 - **"Public":** _(Available to public)_ 
 - _(Confidential - for Fleet eyes only)_     
 - **"¶":** _(E-group - Direct reports the the CEO)_
-- **"¶¶":** _(Classified - CEO, Apprentice, and BizOps)_
-- **"¶¶¶":** _(CEO, Apprentice to the CEO, and board members)_
+- **"¶¶":** _(Classified - CEO, Head of Digital Experience, and Apprentice)_
+
 
 ## Google Drive
 
@@ -346,7 +360,7 @@ We use these prefixes to organize the Fleet Slack:
 
 ### Create a GitHub issue from a Slack thread
 
-If you need to track content from a Slack channel (ie. #g-sales), you can automatically generate a github issue by selecting the `create-github-issue` emoji on the thread. This will automatically create an issue tagged with the #g-business-operations label. If you need the issue logged against a specific board, ensure that you have updated the label during issue creation.
+If you need to track content from a Slack channel (ie. #g-sales), you can automatically generate a github issue by selecting the `create-github-issue` emoji on the thread. This will automatically create an issue tagged with the GitHub label that corisponds with the Slack channel. If you need the issue logged against a specific board, ensure that you have updated the label during issue creation.
 
 <img width="384" alt="image" src="https://github.com/fleetdm/fleet/assets/618009/97ce6caa-4b21-4cc2-8fcb-91aa03dfc6d6">
 
@@ -454,7 +468,7 @@ Any Fleetie can follow the process below to add a priority label to an issue.
 
 Estimation points represent the effort required to complete a task. After accessing wireframes, we typically play planning poker, a gamified estimation technique, to determine the necessary story point value.
 
-We use the following story points to estimate website tasks:
+We use the following story points to estimate tasks:
 
 | Story point | Time |
 |:---|:--------------|
@@ -465,11 +479,13 @@ We use the following story points to estimate website tasks:
 | 8  | Up to a week  |
 | 13 | 1 to 2 weeks  |
 
+> Larger projects are estimated in a way that can sometimes look disproportionate to account for edge cases that weren't caught during planning. This helps us develop [iteratively](https://fleetdm.com/handbook/company#results) and deliver bite-sized functionality on more predictable time scales.
+
 
 ### Making a pull request
 
 Our handbook and docs pages are written in Markdown and are editable from our website (via GitHub). Follow the instructions below to propose an edit to the handbook or docs.
-1. Click the _"Edit page"_ button from the relevant handbook or docs page on [fleetdm.com](https://www.fleetdm.com) (this will take you to the GitHub browser).
+1. Click the _"Edit page"_ button (top right of the page) from the relevant handbook or docs page on [fleetdm.com](https://www.fleetdm.com) (this will take you to the GitHub browser).
 2. Make your suggested edits in the GitHub.
 3. Click _"Commit changes...."_
 4. Give your proposed change a title or _["Commit message"](https://about.gitlab.com/topics/version-control/version-control-best-practices/#write-descriptive-commit-messages)_ and optional _"Extended description"_ (good commit messages help page maintainers quickly understand the proposed changes).
@@ -597,7 +613,7 @@ For more developed thoughts about __spending guidelines and limits__, please rea
 
 #### Non-travel purchases that exceed a Brex cardholder's limit
 
-For non-travel purchases that would require an increase in the Brex cardholder's limit ($2,000 by default), please [make a request](https://fleetdm.com/handbook/business-operations#contact-us) with following information:
+For non-travel purchases that would require an increase in the Brex cardholder's limit ($2,000 by default), please [make a request](https://fleetdm.com/handbook/digital-experience#contact-us) with following information:
 - The nature of the purchase (i.e. SaaS subscription and what it's used for)
 - The cost of the purchase and whether it is a fixed or variable (i.e. use-based) cost.
 - Whether it is a one time purchase or a recurring purchase and at what frequency the purchase will re-occur (annually, monthly, etc.)
@@ -620,7 +636,7 @@ When procuring SaaS tools and services, analyze the purchase of these subscripti
 
 #### Reimbursements
 
-Fleet does not reimburse expenses. We provide all of our team members with Brex cards for making purchases for the company. For company expenses, **use your Brex card.**  If there was an extreme accident, [get help](https://fleetdm.com/handbook/business-operations#contact-us).
+Fleet does not reimburse expenses. We provide all of our team members with Brex cards for making purchases for the company. For company expenses, **use your Brex card.**  If there was an extreme accident, [get help](https://fleetdm.com/handbook/digital-experience#contact-us).
 
 <!-- 
 No longer supported.  -mike, CEO, 2023-04-26.
@@ -639,10 +655,10 @@ Recurring expenses related to a particular team member, such as coworking fees,
 - Seat licenses for tools like Salesforce or GitHub are NOT considered "individualized".
 - Individualized expenses should include the team member's name explicitly in the name of the expense.
 - If multiple team members use the same vendor for an individualized expense (for example, "WeWork"), use a separate row for each individualized expense.  (For example: "Coworking, Mungojerry (WeWork)" and "Coworking, Jennyanydots (WeWork)")
-- Individualized expenses are always attributed to the  "🔦 Business operations" department.
+- Individualized expenses are always attributed to the  "💸 Finance" department.
 - These expenses are still considered non-personnel expenses, in the same way seat licenses for tools like Salesforce or GitHub are considered non-personnel expenses.
 
-For all new individualized expenses, [create an issue](https://github.com/fleetdm/confidential/issues/new?assignees=&labels=%23g-business-operations&projects=&template=custom-request.md&title=Request%3A+_______________________) to notify the Business Operations department.  
+For all new individualized expenses, [create an issue](https://github.com/fleetdm/confidential/issues/new?assignees=&labels=%23g-finance&projects=&template=custom-request.md) to notify the Finance department.  
 
 
 ### Accounts payable cards
@@ -652,9 +668,9 @@ For recurring business expenses paid by credit card, there are four accounts pay
 | Card title  | Purpose | Card owner |
 | ---------- |----------- | --------- |
 | Business spend | Business tax, insurance, IT, SaaS, other | CEO |
-| Individualized spend | Flowers, swag, and other internal gifting for Fleeties, coaching/training, coworking, and other large [individualized expenses](https://fleetdm.com/handbook/company/communications#individualized-expenses) | Head of Business Operations |
+| Individualized spend | Flowers, swag, and other internal gifting for Fleeties, coaching/training, coworking, and other large [individualized expenses](https://fleetdm.com/handbook/company/communications#individualized-expenses) | Head of Finance |
 | Infrastructure spend | AWS and other production/cloud infrastructure related to hosting Fleet for customers or load testing customer scale | CTO |
-| Marketing program spend | Ads, events, sponsorship, etc. | Head of Business Operations | 
+| Marketing program spend | Ads, events, sponsorship, etc. | Head of Marketing | 
 
 
 
@@ -675,18 +691,18 @@ For recurring business expenses paid by credit card, there are four accounts pay
 - Do not share bedrooms.  Shared bathrooms are OK, but make sure every hotel room or Airbnb has at least one bathroom per gender identity.   <!-- Make sure everyone is well-rested, efficiently primped, with sufficient privacy. -->
 - Be creative.  If an AirBnb is the most efficient way to house the team, then do that.  If separate hotel rooms are more efficient, then do that.
 - If the stay is longer than 4 nights and an Airbnb with a washing machine is not available, then dry cleaning can be purchased with your Brex card.
-- If you need to meet with a large group that won't fit in your hotel room or Airbnb (e.g. more than 5 people), [contact Business Operations](https://fleetdm.com/handbook/business-operations#contact-us) for their help approving and booking additional event space.
+- If you need to meet with a large group that won't fit in your hotel room or Airbnb (e.g. more than 5 people), [contact Digital Experience](https://fleetdm.com/handbook/digital-experience#contact-us) for their help approving and booking additional event space.
 
 
 ### Spending company money while traveling
 
 When attending a conference or traveling for Fleet, keep the following in mind:
 - **No reimbursements:** Use your company Brex card.  Reimbursements are time consuming, so Fleet does not do reimbursements for spending on personal credit cards.
-- **Food:** Be efficient and use your own credit card when it makes sense.  There is a $100 allowance per day for your own personal food and beverage on your company Brex card. _(There are many good reasons to make exceptions to this allowance, such as dinners with customers.  Before proceeding, please [request approval from the Head of Business Operations](https://fleetdm.com/handbook/business-operations#contact-us) to avoid complexities._
+- **Food:** Be efficient and use your own credit card when it makes sense.  There is a $100 allowance per day for your own personal food and beverage on your company Brex card. _(There are many good reasons to make exceptions to this allowance, such as dinners with customers.
 - **Tipping:** Tipping norms vary by culture.  How you tip when representing the company reflects on Fleet's brand.  When traveling in the United States and using your company Brex card, prepare to tip between 18-20% at restaurants.  For rideshare, takeout, delivery, and other situations where tipping comes up, tip between 10-20%.
 - **Personal credit card:** Please use your personal credit card for hotel incidentals, personal consumables, movies, mini bars, and entertainment.  These expenses _will not_ be reimbursed.
 - **Company credit card:** We recommend you order a physical Brex card if you do not have one before traveling.
-- **Credit card limit increases:** The monthly limit on your Brex card may need to be increased temporarily as necessary to accommodate the increased spending associated with the conference, such as [booking your own travel](https://fleetdm.com/handbook/company/communications#flights).  You can [request that here](https://fleetdm.com/handbook/business-operations#contact-us) by providing the following information:
+- **Credit card limit increases:** The monthly limit on your Brex card may need to be increased temporarily as necessary to accommodate the increased spending associated with the conference, such as [booking your own travel](https://fleetdm.com/handbook/company/communications#flights).  You can [request that here](https://fleetdm.com/handbook/digital-experience#contact-us) by providing the following information:
   - The start and end dates for your trip.
   - The [price of your flight](https://fleetdm.com/handbook/company/communications#flights)
   - The [price of your hotel or Airbnb](https://fletdm.com/handbook/comopany/communications#lodging) per night
@@ -717,10 +733,10 @@ Before spending any money on an offsite, inviting people, booking travel, or oth
     - a lean budget (including links and street address of lodging and event spaces, estimated airfare, and spending for other food or accomodations)
     - a detailed agenda of how time will be spent
   - **Bring to e-group:** Ask your manager to bring your plan for the offsite to the next weekly e-group meeting for feedback, edits, and CEO approval.
-  - **Iteration:** The E-group will discuss live, make edits, and may ask you to provide additional information or changes and return the following week for another pass.
+  - **Iteration:** The E-group will discuss live, make edits, and establish a DRI for the offsite.
 
-After the plan for the offsite is approved at the e-group meeting (including participants, detailed agenda, and final budget):
-  - The Head of Business Operations will confirm dates with all approved participants, then book all [lodging](#lodging) and coordinate any additional event space.  (Participants [book their own flights](https://fleetdm.com/handbook/company/communications#flights).)
+After the plan for the offsite is approved at the e-group meeting (including recommended participants, goals, and budget):
+  - The DRI will confirm dates with all approved participants, then book all [lodging](#lodging) and coordinate any additional event space.  (Participants [book their own flights](https://fleetdm.com/handbook/company/communications#flights).)
   - _**Note:** If the plan needs to change again, after it is approved, [ask Apprentice to the CEO for help](https://fleetdm.com/handbook/digital-experience#contact-us)._
 
 
@@ -740,7 +756,7 @@ You can learn more about how Fleet approaches security in the [security handbook
 
 ## Vendor questionnaires 
 
-In responding to security questionnaires, Fleet endeavors to provide full transparency via our [security policies](https://fleetdm.com/handbook/security/security-policies#security-policies), [trust](https://trust.fleetdm.com/), and [application security](https://fleetdm.com/handbook/business-operations/application-security) documentation. In addition to this documentation, please refer to [the vendor questionnaires page](https://fleetdm.com/handbook/business-operations/vendor-questionnaires). [Contact the Sales department](https://fleetdm.com/handbook/sales#contact-us) to address any pending questionnaires.
+In responding to security questionnaires, Fleet endeavors to provide full transparency via our [security policies](https://fleetdm.com/handbook/digital-experience/security-policies#security-policies), [trust](https://trust.fleetdm.com/), and [application security](https://fleetdm.com/handbook/digital-experience/application-security) documentation. In addition to this documentation, please refer to [the vendor questionnaires page](https://fleetdm.com/handbook/digital-experience/vendor-questionnaires). [Contact the Sales department](https://fleetdm.com/handbook/sales#contact-us) to address any pending questionnaires.
 
 
 ## Getting a contract signed
@@ -764,7 +780,7 @@ Please use [Fleet's billing email address](https://fleetdm.com/handbook/company/
 
 To get a contract reviewed, upload the agreement to [Google Drive](https://drive.google.com/drive/folders/1G1JTpFxhKZZzmn2L2RppohCX5Bv_CQ9c).
 
-Complete the [contract review issue template in GitHub](https://fleetdm.com/handbook/business-operations#contact-us), being sure to include the link to the document you uploaded and using the Calendly link in the issue template to schedule time to discuss the agreement with Nathan Holliday (allowing for sufficient time for him to have reviewed the contract prior to the call).
+Complete the [contract review issue template in GitHub](https://github.com/fleetdm/confidential/issues/new?assignees=hollidayn&labels=%23g-digital-experience&projects=&template=contract-review.md&title=Review%3A++%F0%9F%96%8B%EF%B8%8F+__________________________), being sure to include the link to the document you uploaded and using the Calendly link in the issue template to schedule time to discuss the agreement with Nathan Holliday (allowing for sufficient time for him to have reviewed the contract prior to the call).
 
 Follow up comments should be made in the GitHub issue and in the document itself so it is all in the same place.
 
@@ -776,7 +792,7 @@ If an agreement requires an additional review during the negotiation process, th
 
 When no further review or action is required for an agreement and the document is ready to be signed, the requestor is then responsible for routing the document for signature.
 
-> **Note:** Please submit other legal questions and requests to [Business Operations department](https://fleetdm.com/handbook/business-operations#contact-us).
+> **Note:** Please submit other legal questions and requests to [Digital Experience](https://fleetdm.com/handbook/digital-experience#contact-us).
 
 
 ## Trust
@@ -794,7 +810,7 @@ Here are a few different entry points for a tour of Fleet's security policies an
 3. [Account recovery process](https://fleetdm.com/handbook/security#account-recovery-process)
 4. [Personal mobile devices](https://fleetdm.com/handbook/security#personal-mobile-devices)
 5. [Hardware security keys](https://fleetdm.com/handbook/security#hardware-security-keys)
-6. More details about internal security processes at Fleet are located on [the Security page](https://fleetdm.com/handbook/business-operations/security).
+6. More details about internal security processes at Fleet are located on [the Security page](https://fleetdm.com/handbook/digital-experience/security).
 
 
 ## Benefits
@@ -848,7 +864,7 @@ When you need to take time off, follow this process:
 
 ### Coworking
 
-Your Brex card may be used for up to $500 USD per month in coworking costs. Please get prior approval by making a [custom request to the business operations team](https://fleetdm.com/handbook/business-operations#contact-us).
+Your Brex card may be used for up to $500 USD per month in coworking costs. Please get prior approval from the [Digital Experience team](https://fleetdm.com/handbook/digital-experience#contact-us).
 
 
 ## Compensation
@@ -870,12 +886,12 @@ We're happy you've ventured a trip around the sun with Fleet- let's celebrate! T
 
 ### Compensation changes
 
-Fleet evaluates and (if relevant) updates compensation decisions yearly, shortly after the anniversary of a team member's start date. The Head of BizOps is responsible for the process to [update compensation](https://fleetdm.com/handbook/business-operations#updating-compensation)
+Fleet evaluates and (if relevant) updates compensation decisions yearly, shortly after the anniversary of a team member's start date. The Head of Digital Experience is responsible for the process to [update compensation](https://fleetdm.com/handbook/digital-experience#updating-compensation)
 
 
 ### Relocating
 
-When Fleeties relocate, there are vendors that need to be notified of the change. Before relocating, please [let the company know in advance](https://fleetdm.com/handbook/business-operations#contact-us) by following the directions listed in the relevant issue template ("Moving").
+When Fleeties relocate, there are vendors that need to be notified of the change. Before relocating, please [let the company know in advance](https://fleetdm.com/handbook/digital-experience#contact-us) by following the directions listed in the relevant issue template ("Moving").
 
 
 ## Team member onboarding
@@ -908,7 +924,7 @@ We want to make sure that the new team member will be able to complete every tas
 We believe in taking onboarding and training seriously and that the onboarding template is an essential source of truth and good use of time for every single new hire. If managers see a step that they don't feel is necessary, they should make a pull request to the [onboarding template](https://github.com/fleetdm/confidential/blob/main/.github/ISSUE_TEMPLATE/onboarding.md).
 
 Expectations during onboarding:
-- Onboarding time (all checkboxes checked) is a KPI for the business operations team.  Our goal is 14 days or less.
+- Onboarding time (all checkboxes checked) is a KPI for the Digital Experience team.  Our goal is 14 days or less.
 - The first 3 weekdays (excluding days off) for **every new team member** at Fleet is reserved for completing onboarding tasks from the checkboxes in their onboarding issue.  New team members **should not work on anything else during this time**, whether or not other tasks are stacking up or assigned.  It is OK, expected, and appreciated for new team members to **remind their manager and colleagues** of this [important](https://fleetdm.com/handbook/company/why-this-way#why-the-emphasis-on-training) responsibility.
 - Even after the first 3 days, during the rest of their first 2 weeks, completing onboarding tasks on time is a new team member's [highest priority](https://fleetdm.com/handbook/company/why-this-way#why-the-emphasis-on-training).
 
@@ -940,6 +956,7 @@ During their first week at Fleet, every new team member schedules a contributor
 - make sure you can succeed with submitting a PR with the GitHub web editor, modifying docs or handbook, and working with Markdown.
 - talk about Google calendar.
 - give you a quick tour of the Fleet Google Drive folder.
+- make sure new team members understand the expectations of, and [how to prepare](https://fleetdm.com/handbook/company/leadership#prepare-for-the-program) for, the [CEO shadow program](https://fleetdm.com/handbook/company/leadership#ceo-shadow-program).
 
 
 
@@ -1000,13 +1017,13 @@ Fleet provides laptops, YubiKey security keys, and software licenses for core te
 
 ### Requesting new equipment
 
-As soon as an offer is accepted, Business Operations will reach out to the new team member to start this process and will work with the new team member to get their equipment requested and shipped to them on time. From time to time, team members need to purchase additional equipment in the interest of the company.
+As soon as an offer is accepted, Digital Experience will reach out to the new team member to start this process and will work with the new team member to get their equipment requested and shipped to them on time. From time to time, team members need to purchase additional equipment in the interest of the company.
 
 If you are in need of additional equipment for any reason, [open an IT support request](https://github.com/fleetdm/confidential/issues/new?assignees=spokanemac&labels=%3Ahelp-it&projects=&template=request-it-support.md&title=%F0%9F%92%BB+Request+IT+support). When possible, Fleet will pull from its warehouse of existing assets before spending [more money on new equipment](https://fleetdm.com/handbook/company/why-this-way#why-spend-less).
 
 - **Tracking equipment:** When a device has been purchased, it's added to the [spreadsheet of company equipment](https://docs.google.com/spreadsheets/d/1hFlymLlRWIaWeVh14IRz03yE-ytBLfUaqVz0VVmmoGI/edit#gid=0) where we keep track of devices and equipment, purchased by Fleet. When you receive your new computer, complete the entry by adding a description, model, and serial number to the spreadsheet.
 
-- **Returning equipment:** Apple computers with remaining AppleCare Protection Plans should be reprovisioned to other Fleeties who may have older or less-capable computers. Equipment should be returned once offboarded for reprovisioning. Coordinate offboarding and return with the Head of Business Operations. Please return all equipment to the Fleet IT warehouse using Fleet's FedEx account (address and account # in 1Password).
+- **Returning equipment:** Apple computers with remaining AppleCare Protection Plans should be reprovisioned to other Fleeties who may have older or less-capable computers. Equipment should be returned once offboarded for reprovisioning. Coordinate offboarding and return with the Head of Digital Experience. Please return all equipment to the Fleet IT warehouse using Fleet's FedEx account (address and account # in 1Password).
 
 - **Equipment retention and replacement:** Older equipment results in lost productivity of Fleeties and should be considered for replacement. Replacement candidates are computers that are no longer under an AppleCare+ Protection Plan (or another warranty plan), are >3 years from the [discontinued date](https://everymac.com/systems/apple/macbook_pro/index-macbookpro.html#specs), or when the "Battery condition" status in Fleet is less than "Normal". The old equipment should be evaluated for return or retention as a test environment.
 
@@ -1042,7 +1059,7 @@ Learn how to communicate as Fleet with guidelines for tone of voice, our approac
 
 ### What would Mister Rogers say?
 
-[*Mister Rogers’ Neighborhood*](https://en.wikipedia.org/wiki/Mister_Rogers%27_Neighborhood) was one of the longest-running children’s TV series. That’s thanks to [Fred Rogers](https://en.wikipedia.org/wiki/Fred_Rogers)’ communication skills. He knew kids heard things differently than adults. So, he checked every line to avoid confusion and encourage positivity.
+[*Mister Rogers’ Neighborhood*](https://en.wikipedia.org/wiki/Mister_Rogers%27_Neighborhood) was one of the longest-running children’s T.V. series. That’s thanks to [Fred Rogers](https://en.wikipedia.org/wiki/Fred_Rogers)’ communication skills. He knew kids heard things differently than adults. So, he checked every line to avoid confusion and encourage positivity.
 
 Our audience is a little older. But just like the show, Mister Rogers’ method is appropriate for all ages. Here are some steps you can take to communicate like Mister Rogers:
 
@@ -1116,21 +1133,50 @@ As we use sentence case, only the first word is capitalized. But, if a word woul
 - When talking about a users' computer, we prefer to use "device" over _endpoint._ Devices in this context can be a physical device or virtual instance that connect to and exchange information with a computer network. Examples of devices include mobile devices, desktop computers, laptop computers, virtual machines, and servers.
 
 
-### Headings
+### Headings and titles
 
-Headings help readers quickly scan content to find what they need and guide readers through your writing. Organize page content using clear headings specific to the topic they describe. 
+Headings and titles should give an accurate idea of a topic's content and help guide readers through your writing so they can quickly find what they need.
 
-While our readers are more tech-savvy than most, we can’t expect them to recognize queries by SQL alone.  Avoid using code for headings. Instead, say what the code does and include code examples in the body of your document.
+#### Static headings
+
+Use static headings (a `noun` or `noun phrase`) e.g., “Log destinations,” for concept or reference topics. Be as short and specific as possible.
+
+#### Task-based headings
+
+Use task-based headings (`verb` + `topic`) e.g., _“Configure a log destination”_ for guides and tutorials where the heading should reveal the task that the reader is trying to achieve. 
+
+#### Avoid _-ing_ verb forms in headings
+
+Avoid starting a heading with _-ing_ verb form, if possible.
+
+_-ing_ verb forms are more difficult for non-native English readers to understand, translate inconsistently, and increase character counts in limit spaces, such as in docs navigation.
+
+| ✅ Recommended | ❌ Not recommended | 
+| ---------------- | -------------------- |
+| “Configure a log destination” | “Configuring a log destination” |
+
+#### Avoid vague verbs in headings
+
+Were possible, avoid starting a heading with a vague verb, like “understand,” “learn,” or “Use.” Headings that start with a vague verb can mislead readers by making a topic appear to be task-oriented (a guide) when it is actually reference or conceptual information. 
+
+| ✅ Recommended | ❌ Not recommended | 
+| ---------------- | -------------------- |
+| “Log destinations” | “Understand log destinations.” |
+
+
+#### Avoid code in headings
+
+While our readers are more tech-savvy than most, we can’t expect them to recognize queries by SQL alone.  Avoid using code for headings. Instead, say what the code does and include code examples in the body of your document. That aside, it doesn't render well on the website.
+
+#### Heading hierarchy 
+
+Use heading tags to structure your content hierarchically. Try to stay within three or four heading levels. Detailed documents may use more, but pages with a simpler structure are easier to read.
 
-Keep headings brief, organized, and in a logical order:
 - H1: Page title
 - H2: Main headings
 - H3: Subheadings
 - H4: Sub-subheadings
 
-Try to stay within three or four heading levels. Detailed documents may use more, but pages with a simpler structure are easier to read.
-
-
 #### Punctuation in headings
 
 Fleet headings do not use end punctuation unless the heading is a question:
@@ -1217,6 +1263,7 @@ Sometimes numerals seem out of place. If an expression typically spells out the
 - First impression
 - Third-party integration
 - All-in-one platform
+
 Numbers over 3 digits get commas:
 - 999
 - 1,000
@@ -1228,6 +1275,7 @@ Numbers over 3 digits get commas:
 Use numerals and am or pm without a space in between:
 - 7am
 - 7:30pm
+
 Use a hyphen between times to indicate a time period:
 - 7am–10:30pm
 
@@ -1307,6 +1355,33 @@ Markdown is a simple formatting syntax used to write content on the web. In orde
 
 ### Headings
 
+Each heading needs two lines of empty space separating it from the previous section and one line of empty space between the heading and related content. This helps break up blocks of text and is especially important on larger, more detailed pages. Here's an example:
+
+```
+...previous content.
+<!-- Empty space -->
+<!-- Empty space -->
+### New heading
+<!-- Empty space -->
+Related content... 
+```
+
+
+#### Nested headings
+
+Wherever possible, avoid creating nested headings. For example:
+
+```
+## Things
+
+### Thing 1
+
+Hi my name is Thing 1
+```
+
+
+#### Heading levels
+
 Try to stay within three or four heading levels. Complicated documents may use more, but pages with a simpler structure are easier to read.
 | Markdown | Rendered heading |
 |:--------------------|:-----------------------------|
@@ -1367,8 +1442,6 @@ line two
 | <pre>1. Line one<br>2. Line two  <br>3. Line three<br>4. Line four</pre> | 1. Line one<br>2. Line two<br> 3. Line three<br>4. Line four |
 | <pre>1. Line one<br>1. Indent one<br>2. Line two<br>3. Line three<br>1. Indent one<br>2. Indent two<br>4. Line four</pre> | 1. Line one<br>&nbsp;1. Indent one<br>2. Line two<br>3. Line three<br>&nbsp;1. Indent one<br>&nbsp;2. Indent two<br>4. Line four |
 
-Content nested within an ordered list needs to be indented. If the list is not formatted correctly, the number will reset on each list item, as shown in the example below.
-
 **Markdown:**
 
 ```
@@ -1387,26 +1460,6 @@ Paragraph about item one
 
 2. Item two
 
-To make sure that ordered lists increment correctly, you can indent the content nested within the list. For example, the same ordered list with indentation:
-
-**Markdown:**
-
-```
-1. Item one
-
-   Paragraph about item one
-
-2. Item two
-```
-
-**Rendered output:**
-
-1. Item one
-
-   Paragraph about item one
-
-2. Item two
-
 
 #### Unordered lists
 
@@ -1466,6 +1519,11 @@ Use dashes (at least 3) to separate the header, and add colons to align the text
 |:---|---:|:---:|
 | Left alignment | Right alignment | Center Alignment |
 
+> When using tables to document API endpoint parameters, we use the following conventions:
+> + Document nested objects in their own separate tables. See the [**Modify configuration**](https://fleetdm.com/docs/rest-api/rest-api#modify-configuration) documentation for example formatting.
+> + In the **Type** column, use the terms "boolean" (not "bool"), and "array" (not "list").
+> + In the **Description** column for required parameters, begin the description with "**Required.**"
+
 
 ### Blockquotes
 
@@ -1617,7 +1675,7 @@ This glossary provides definitions to commonly used terms within our space.
 | **open source** | Software with intentionally public code for the sake of transparency. |
 | **OS** | (Operating System) Software that provides the groundwork and instructions for a device's basic functions, including application use and controlling peripherals. |
 | **osquery**  | A tool that assembles low-level operating system analytics and monitoring. |
-| **out-of-policy device** | A device that is fails any security or vulnerability policy created in Fleet. |
+| **out-of-policy device** | A device that fails any security or vulnerability policy created in Fleet. |
 | **permissions** | Users have different abilities depending on the access level they have. |
 | **platform** | Any software or hardware for hosting an application, data, or service. |
 | **policies** | Yes or no questions you can ask using Fleet about your host devices. |
@@ -1697,9 +1755,6 @@ Please see 📖[handbook/company/communications#purchase-company-issued-equipmen
 ##### Buying other new equipment
 Please see 📖[handbook/company/communications#purchase-company-issued-equipment](https://fleetdm.com/handbook/company/communications#equipment) for above.
 
-##### Purchasing a company-issued device
-Please see 📖[handbook/business-operations#secure-company-issued-equipment-for-a-team-member](https://fleetdm.com/handbook/business-operations#secure-company-issued-equipment-for-a-team-member).
-
 ##### Company travel
 Please see 📖[handbook/company/communications#travel](https://fleetdm.com/handbook/company/communications#travel).
 
diff --git a/handbook/company/handbook.md b/handbook/company/handbook.md
index 345437ee0c..f7d416e9b2 100644
--- a/handbook/company/handbook.md
+++ b/handbook/company/handbook.md
@@ -16,7 +16,7 @@ All done!
 To contribute a new handbook page:
 1. Determine where the new page should live in the handbook.  That is, nested under either:
   a. [the "Company" handbook](https://fleetdm.com/handbook/company), or
-  b. the handbook for a particular division (Security, Engineering, Product, Sales, Marketing, Business Operations)
+  b. the handbook for a particular division (Engineering, Product Design, Customer Support, Sales, Demand, Finance, Digital Experience)
 2. Locate the appropriate folder for the new page in [the GitHub repository under `handbook/`](https://github.com/fleetdm/fleet/tree/main/handbook).
 3. Create a new markdown file (like [one of these](https://github.com/fleetdm/fleet/tree/f90148abad96fccb6c5647a31877fa7e91b5ee57/handbook/digital-experience)).  A simple, easy way to do this is by clicking "Add file" on GitHub.com.
   a. Name your new file the kebab-cased, all lowercase version of your page title, with `.md` at the end.  (For example, a page titled "Why this way?" would have the file path: `handbook/company/why-this-way.md`.)
diff --git a/handbook/company/leadership.md b/handbook/company/leadership.md
index 6885a8ca97..d89b81639f 100644
--- a/handbook/company/leadership.md
+++ b/handbook/company/leadership.md
@@ -2,7 +2,7 @@
 
 This page covers the things managers and other leaders at Fleet need to know about running a great company.
 
-<img width="384" alt="image" src="https://github.com/fleetdm/fleet/assets/618009/06da9dde-c6f8-4f4d-952f-26d6ad7d3aa0">
+<img width="384" alt="image" src="https://github.com/user-attachments/assets/6aec084e-3b0a-4a2c-b7c5-ed4536d73b40">
 
 
 
@@ -39,7 +39,7 @@ These flaws are listed here publicly for two reasons. The first is so that peopl
 
 
 ## CEO responsibilities
-Ultimately, the CEO is responsible for the success or failure of the company. The CEO is the [directly responsible individual (DRI)](https://fleetdm.com/handbook/company/why-this-way#why-direct-responsibility) for pricing, tiers, the business model, signatures on all documents, product marketing (brandfronts, pitchfronts, featurefronts, ICPs, personas, and targeting).
+Ultimately, the CEO is responsible for the success or failure of the company. The CEO is the [directly responsible individual (DRI)](https://fleetdm.com/handbook/company/why-this-way#why-direct-responsibility) for pricing, tiers, the business model, human resources, legal counsel, signatures on all documents, and brand &amp; product marketing (brandfronts, pitchfronts, featurefronts, ICPs, personas, and targeting).
 
 > **Note:** When the CEO is out of office, CEO responsibilities are either paused, delegated, or coordinated through the [Apprentice to the CEO](https://fleetdm.com/handbook/digital-experience#team) so they can be handled promptly.  (It depends on the responsibility and the situation.)
 
@@ -109,7 +109,7 @@ In this meeting, the department leader discusses actual week-over-week progress
 
 At Fleet, we collaborate with [core team members](#creating-a-new-position), [consultants](#hiring-a-consultant), [advisors](#adding-an-advisor), and [outside contributors](https://github.com/fleetdm/fleet/graphs/contributors) from the community.  
 
-> Are you a new fleetie joining the Business Operations team?  For Loom recordings demonstrating how to make offers, hire, onboard, and more please see [this classified Google Doc](https://docs.google.com/document/d/1fimxQguPOtK-2YLAVjWRNCYqs5TszAHJslhtT_23Ly0/edit).
+> Are you a new fleetie joining the Digital Experience team?  For Loom recordings demonstrating how to make offers, hire, onboard, and more please see [this classified Google Doc](https://docs.google.com/document/d/1fimxQguPOtK-2YLAVjWRNCYqs5TszAHJslhtT_23Ly0/edit).
 
 ### Consultants
 
@@ -131,7 +131,7 @@ Consultants:
 
 Consultants [track time using the company's tools](#tracking-hours) and sign [Fleet's consulting agreement](#sending-a-consulting-agreement).
 
-To hire a consultant, [submit a new consultant onboarding request](https://github.com/fleetdm/confidential/issues/new?assignees=&labels=%23g-business-operations&projects=&template=new-consultant-onboarding.md&title=New+US%2Finternational+consultant) to the business operations team.
+To hire a consultant, [submit a new consultant onboarding request](https://github.com/fleetdm/confidential/issues/new?assignees=&labels=%23g-digital-experience&projects=&template=new-consultant-onboarding.md&title=New+US%2Finternational+consultant) to the Digital Experience team.
 
 #### Who ISN'T a consultant?
 
@@ -151,7 +151,7 @@ Consultants aren't required to do any of those things.
 
 #### Sending a consulting agreement
 
-To send a consulting agreement, you will need to [submit a new consultant onboarding request](https://github.com/fleetdm/confidential/issues/new?assignees=&labels=%23g-business-operations&projects=&template=new-consultant-onboarding.md&title=New+US%2Finternational+consultant) to the business operations team. They will then peform the steps needed to bring aboard a new consultant.
+To send a consulting agreement, you will need to [submit a new consultant onboarding request](https://github.com/fleetdm/confidential/issues/new?assignees=&labels=%23g-digital-experience&projects=&template=new-consultant-onboarding.md&title=New+US%2Finternational+consultant) to the Digital Experience team. They will then peform the steps needed to bring aboard a new consultant.
 
 You will be asked to provide the following details:
 - Consultant's name (or business name)
@@ -166,7 +166,7 @@ If the consultant is international, you will also provide:
 - Consultant's date of birth
 
 
-> To update a consultant's fee, [submit an issue to BizOps](https://github.com/fleetdm/confidential/issues/new?assignees=&labels=%23g-business-operations&projects=&title=Update%20consultant%20fee) with the consultant's name and new hourly rate.
+> To update a consultant's fee, [submit an issue to Digital Experience](https://github.com/fleetdm/confidential/issues/new?assignees=&labels=%23g-digital-experience&projects=&title=Update%20consultant%20fee) with the consultant's name and new hourly rate.
 
 <img width="384" alt="image" src="https://github.com/fleetdm/fleet/assets/618009/e9d36657-fab9-44c1-9162-7bc640e2f3a0">
 
@@ -244,17 +244,18 @@ A completed open position entry should look something like this:
 - _**Why bother with approvals?**  We avoid cancelling or significantly changing a role after opening it.  It hurts candidates too much.  Instead, get the position approved first, before you start recruiting and interviewing.  This gives you a sounding board and avoids misunderstandings._
 
 ### Approving a new position
-When review is requested on a proposal to open a new position, the 🐈‍⬛ CEO will complete the following steps when reviewing the pull request:
+When review is requested on a proposal to open a new position, the Apprentice to the CEO will complete the following steps when reviewing the pull request:
 
 1. **Consider role and reporting structure:** Confirm the new row in "Fleeties" has a manager, job title, and department, that it doesn't have any corrupted spreadsheet formulas or formatting, and that the start date is set to the first Monday of the next month.
 2. **Read job description:** Confirm the job description consists only of changes to "Responsibilities" and "Experience," with an appropriate filename, and that the content looks accurate, is grammatically correct, and is otherwise ready to post in a public job description on fleetdm.com.
 3. **Budget compensation:** Ballpark and document compensation research for the role based on 
    - _Add screenshot:_ Scroll to the very bottom of ["¶¶ 💌 Compensation decisions (offer math)"](https://docs.google.com/document/d/1NQ-IjcOTbyFluCWqsFLMfP4SvnopoXDcX0civ-STS5c/edit#heading=h.slomq4whmyas) and add a new heading for the role, pattern-matching off of the names of other nearby role headings. Then create written documentation of your research for future reference.  The easiest way to do this is to take screenshots of the [relevant benchmarks in Pave](https://pave.com) and paste those screenshots under the new heading.
+4. **Decide**: Decide whether to approve this role or to consider it a different time.  If approving, then:
+   - _Update financial model:_ Update ["¶ Financial model"](https://docs.google.com/spreadsheets/d/1tIcuwhmOKolnwNJqQ0zH5rWCqjawYzySDsKTb98RvxI/edit?gid=1184088923#gid=1184088923)
    - _Update team database:_ Update the row in ["¶¶ 🥧 Equity plan"](https://docs.google.com/spreadsheets/d/1_GJlqnWWIQBiZFOoyl9YbTr72bg5qdSSp4O3kuKm1Jc/edit#gid=0) using the benchmarked compensation and share count.
      - _Salary:_ Enter the salary: If the role has variable compensation, use the role's OTE (on-target earning estimate) as the budgeted salary amount, and leave a note in the "Notes (¶¶)" cell clarifying the role's bonus or commission structure.
      - _Equity:_ Enter the equity as a number of shares, watching the percentage that is automatically calculated in the next cell.  Keep guessing different numbers of shares until you get the derived percentage looking like what you want to see.
-4. **Decide**: Decide whether to approve this role or to consider it a different time.  If approving, then:
-   - _Create Slack channel:_ Create a private "#hiring-xxxxxx-YYYY" Slack channel (where "xxxxxx" is the job title and YYYY is the current year) for discussion and invite the hiring manager and Head of Business Operations.
+   - _Create Slack channel:_ Create a private "#YYYY-hiring-xxxxxx" Slack channel (where "xxxxxx" is the job title and YYYY is the current year) for discussion and invite the hiring manager and Head of Digital Experience.
    - _Publish opening:_ Approve and merge the pull request.  The job posting will go live within ≤10 minutes.
    - _Track as approved in "Fleeties":_ In the "Fleeties" spreadsheet, find the row for the new position and update the "Job description" column and replace the URL of the pull request that originally proposed this new position with the URL of the GitHub merge commit when that PR was merged.
    - _Reply to requestor:_ Post a comment on the pull request, being sure to include a direct link to their live job description on fleetdm.com.  (This is the URL where candidates can go to read about the job and apply.  For example: `fleetdm.com/handbook/company/product-designer`):
@@ -281,7 +282,7 @@ Fleet uses [certain email templates](https://docs.google.com/document/d/1VAMWIH8
 ### Hiring restrictions
 
 #### Incompatible former employers
-Fleet maintains a list of companies with whom Fleet has do-not-solicit terms that prevents us from making offers to employees of these companies.  The list is in the Do Not Solicit tab of the [BizOps spreadsheet](https://docs.google.com/spreadsheets/d/1lp3OugxfPfMjAgQWRi_rbyL_3opILq-duHmlng_pwyo/edit#gid=0).
+Fleet maintains a list of companies with whom Fleet has do-not-solicit terms that prevents us from making offers to employees of these companies.  The list is in the Do Not Solicit tab of the [Digital Experience spreadsheet](https://docs.google.com/spreadsheets/d/1lp3OugxfPfMjAgQWRi_rbyL_3opILq-duHmlng_pwyo/edit#gid=0).
 
 #### Incompatible locations
 Fleet is unable to hire team members in some countries. See [this internal document](https://docs.google.com/document/d/1jHHJqShIyvlVwzx1C-FB9GC74Di_Rfdgmhpai1SPC0g/edit) for the list.
@@ -303,38 +304,54 @@ Department specific interviewing instructions:
 #### Hiring a new team member
 This section is about the hiring process a new core team member, or fleetie.
 
-> **_Note:_** _Employment classification isn't what makes someone a fleetie.  Some Fleet team members are contractors and others are employees.  The distinction between "contractor" and "employee" varies in different geographies, and the appropriate employment classification and agreement for any given team member and the place where they work is determined by Head of Business Operations during the process of making an offer._
+> **_Note:_** _Employment classification isn't what makes someone a fleetie.  Some Fleet team members are contractors and others are employees.  The distinction between "contractor" and "employee" varies in different geographies, and the appropriate employment classification and agreement for any given team member and the place where they work is determined by Head of Digital Experience during the process of making an offer._
 
 Here are the steps hiring managers follow to get an offer out to a candidate:
 1. **Call references:** Before proceeding, make sure you have 2-5+ references. Ask the candidate for at least 2-5+ references and contact each reference in parallel using the instructions in [Fleet's reference check template](https://docs.google.com/document/d/1LMOUkLJlAohuFykdgxTPL0RjAQxWkypzEYP_AT-bUAw/edit?usp=sharing).  Be respectful and keep these calls very short.
 2. **Add to team database:** Update the [Fleeties](https://docs.google.com/spreadsheets/d/1OSLn-ZCbGSjPusHPiR5dwQhheH1K8-xqyZdsOe9y7qc/edit#gid=0) doc to accurately reflect the candidate's:
    - Start date
+
 > _**Tip:** No need to check with the candidate if you haven't already.  Just guess.  First Mondays tend to make good start dates.  When hiring an international employee, Pilot.co recommends starting the hiring process a month before the new employee's start date._
+
    - First and last name
    - Preferred pronoun _("them", "her", or "him")_
    - LinkedIn URL _(If the fleetie does not have a LinkedIn account, enter `N/A`)_
    - Location of candidate
-3. **Schedule CEO interview:** [Book a quick chat](https://fleetdm.com/handbook/digital-experience#contact-us) so our CEO can get to know the future Fleetie.  (Please take care of all of the previous steps first.)
-4. **Confirm intent to offer:** Compile feedback about the candidate into a single document and share that document (the "interview packet") with the Head of Business Operations via Google Drive.  _This will be interpreted as a signal that you are ready for them to make an offer to this candidate._
-   - _Compile feedback into a single doc:_ Include feedback from interviews, reference checks, and challenge submissions.  Include any other notes you can think of offhand, and embed links to any supporting documents that were impactful in your final decision-making, such as portfolios or challenge submissions.
-   - _Share_ this single document with the Head of Business Operations via email.
-    - Share only _one, single Google Doc, please_; with a short, formulaic name that's easy to understand in an instant from just an email subject line (e.g. "_Why hire Jane Doe ("Train Conductor") - 2023-03-21_").
-    - When the Head of Business Operations receives this doc shared doc in their email with the compiled feedback about the candidate, they will understand that to mean that it is time for Fleet to make an offer to the candidate.
+
+3. **Compile feedback into a single doc:** In the "interview packet", include feedback from interviews, reference checks, and challenge submissions. Include any other notes you can think of offhand, and embed links to any supporting documents that were impactful in your final decision-making, such as portfolios or challenge submissions.
+   - Name the doc with a short, formulaic name that's easy to understand in an instant from just an email subject line (e.g. "_Why hire Jane Doe ("Train Conductor") - 2023-03-21_").
+   - _Share_ this single document with the CEO.
+4. **Request a CEO interview:** Copy the template below, paste it in the hiring Slack channel for the position, and complete all "TODOs" before sending.
+
+     ```
+    *CEO interview request:*
+    Hi @Savannah Friend, the following candidate is ready for a CEO interview. cc: @Sam Pfluger
+    - Name: TODO
+    - Position: TODO
+    - LinkedIn: TODO
+    - Email: TODO
+    - Single doc URL: TODO
+     ```
+     
+5. **Confirm intent to offer:** Share the single document (the "interview packet") with the Head of Digital Experience via Google Drive.
+   - _Share_ this single document with the Head of Digital Experience via email.
+   - When the Head of Digital Experience receives this shared doc in their email with the compiled feedback about the candidate, they will understand that to mean that it is time for Fleet to make an offer to the candidate.
+
 
 ### Making an offer
-After receiving the interview packet, the Head of Business Operations uses the following steps to make an offer:
+After receiving the interview packet, the Head of Digital Experience uses the following steps to make an offer:
 
 <!-- For future use: some ready-to-go language around rebencharking compensation for cost of living: https://github.com/fleetdm/fleet/pulls/13499 -->
-1. **Prepare the "exit scenarios" spreadsheet:** 🔦 Head of Business Operations [copies the "Exit scenarios (template)"](https://docs.google.com/spreadsheets/d/1k2TzsFYR0QxlD-KGPxuhuvvlJMrCvLPo2z8s8oGChT0/copy) for the candidate, and renames the copy to e.g. "Exit scenarios for Jane Doe".
+1. **Prepare the "exit scenarios" spreadsheet:** 🌐 Head of Digital Experience [copies the "Exit scenarios (template)"](https://docs.google.com/spreadsheets/d/1k2TzsFYR0QxlD-KGPxuhuvvlJMrCvLPo2z8s8oGChT0/copy) for the candidate, and renames the copy to e.g. "Exit scenarios for Jane Doe".
    - _Edit the candidate's copy of the exit scenarios spreadsheet_ to reflect the number of shares in ["🥧 Equity plan"](https://docs.google.com/spreadsheets/d/1_GJlqnWWIQBiZFOoyl9YbTr72bg5qdSSp4O3kuKm1Jc/edit#gid=0), and the spreadsheet will update automatically to reflect their approximate ownership percentage.
      > _**Note:** Don't play with numbers in the exit scenarios spreadsheet. The revision history is visible to the candidate, and they might misunderstand._
-2. **Prepare offer:** 🔦 Head of Business Operations [copies "Offer email (template)"](https://docs.google.com/document/d/1zpNN2LWzAj-dVBC8iOg9jLurNlSe7XWKU69j7ntWtbY/copy) and renames to e.g. "Offer email for Jane Doe".  Edit the candidate's copy of the offer email template doc and fill in the missing information:
+2. **Prepare offer:** 🌐 Head of Digital Experience [copies "Offer email (template)"](https://docs.google.com/document/d/1zpNN2LWzAj-dVBC8iOg9jLurNlSe7XWKU69j7ntWtbY/copy) and renames to e.g. "Offer email for Jane Doe".  Edit the candidate's copy of the offer email template doc and fill in the missing information:
    - _Benefits:_ If candidate will work outside the US, [change the "Benefits" bullet](https://docs.google.com/document/d/1zpNN2LWzAj-dVBC8iOg9jLurNlSe7XWKU69j7ntWtbY/edit) to reflect what will be included through Fleet's international payroll provider, depending on the candidate's location.
    - _Equity:_ Highlight the number of shares with a link to the candidate's custom "exit scenarios" spreadsheet.
    - _Hand off:_ Share the offer email doc with the [Apprentice to the CEO](https://fleetdm.com/handbook/digital-experience#team).
 3. **Draft email:** 🦿 Apprentice to the CEO drafts the offer email in the CEO's inbox, reviews one more time, and then brings it to their next daily meeting for CEO's approval:
    - To: The candidate's personal email address _(use the email from the CEO interview calendar event)_
-   - Cc: Head of Business Operations _(BizOps will participate in the email thread after the offer is accepted)_
+   - Cc: Head of Digital Experience
    - Subject: "Full time?"
    - Body: _Copy the offer email verbatim from the Google doc into Gmail as the body of the message, formatting and all, then:_
      - _Check all links in offer letter for accuracy (e.g. LinkedIn profile of hiring manager, etc.)_
@@ -343,43 +360,43 @@ After receiving the interview packet, the Head of Business Operations uses the f
 4. **Send offer:** 🐈‍⬛ CEO reviews and sends the offer to the candidate:
    - _Grant the candidate "edit" access_ to their "exit scenarios" spreadsheet.
    - _Send_ the email.
+5. **Process the offer response** The Head of Digital Experience will process the offer response by either creating a new ["Teammate pre-onboarding" issue](https://github.com/fleetdm/confidential/issues/new?assignees=&labels=%23g-digital-experience&projects=&template=pre-onboarding.md&title=Pre-onboarding%3A+______________________) and following the steps if the offer is accepted or notifying the stakeholders that the offer was not accepted and we should continue the search. 
 
-#### Steps after an offer is accepted
-Once the new team member replies and accepts their offer in writing, 🔦 Head of Business Operations follows these steps:
-1. **Verify, track, and reply:** Reply to the candidate:
-   - _Verify the candidate replied with their physical address… or else keep asking._  If they did not reply with their physical address, then we are not done.  No offer is "accepted" until we've received a physical address.
-   - _Review and update the team database_ to be sure everything is accurate, **one last time**.  Remember to read the column headers and precisely follow the instructions about how to format the data:
-     - The new team member's role in ["🧑‍🚀 Fleeties"](https://docs.google.com/spreadsheets/d/1OSLn-ZCbGSjPusHPiR5dwQhheH1K8-xqyZdsOe9y7qc/edit#gid=0) now includes:
-       - **Start date** _(The new fleetie's first day, YYYY-MM-DD)_
-       - **Location** _(Derive this from the physical address)_
-       - **GitHub username**  _(Username of 2FA-enabled GitHub account)_
-       - **@fleetdm.com email** _(Set this to whatever email you think this person should have)_
-     - The new team member's row in ["🥧 Equity plan"](https://docs.google.com/spreadsheets/d/1_GJlqnWWIQBiZFOoyl9YbTr72bg5qdSSp4O3kuKm1Jc/edit#gid=0) now includes:
-       - **OTE** _("On-target earnings", i.e. anticipated total annual cash compensation)_
-       - **Equity** _(Stock options)_
-       - **"Notes"** _(Track base salary here, as well as a very short explanation of commission or bonus structure.)_
-       - **Physical address** _(The full street address of the location where work will typically be performed.)_
-       - **Personal email** _(Use the personal email they're replying from, e.g. `@gmail.com`)_
-       - **"Offer accepted?"** _(Set this to `TRUE`)_
-   - _[Create a "Hiring" issue](https://github.com/fleetdm/confidential/issues/new/choose)_ for the new team member.  (This issue will keep track of the hiring tasks for the new team member.)
-   - _Send a reply_ welcoming the team member to Fleet and letting them know to expect a separate email with next steps for getting the team member's laptop, Yubikeys, and agreement going ASAP so they can start on time.  For example:
-     ```
-     \o/  It's official!
-     
-     Be on the lookout for an email in a separate thread with next steps for quickly signing the paperwork and getting your company laptop and hardware 2FA keys (Yubikeys), which we recommend setting up ASAP.
-     
-     Thanks, and welcome to the team!
-     
-     -Joanne
-     ```
-2. **Ask hiring manager to send rejections:** Post to the `hiring-xxxxx-yyyy` Slack channel to let folks know the offer was accepted, and at-mention the _hiring manager_ to ask them to communicate with [all other interviewees](https://fleetdm.com/handbook/company#empathy) who are still in the running and [let them know that we chose a different person](https://fleetdm.com/handbook/company/leadership#candidate-correspondence-email-templates).
-   >_**Note:** Send rejection emails quickly, within 1 business day.  It only gets harder if you wait._
-3. **Remove open position:** The hiring manager removes the newly-filled position from the fleetdm.com website by [making a pull request](https://fleetdm.com/handbook/company/communications#making-a-pull-request) to delete it from the [open-positions.yml](https://github.com/fleetdm/fleet/blob/main/handbook/company/open-positions.yml) file.
-4. **Close Slack channel:** Then archive and close the channel.
+#### After an offer is accepted
 
-Now what happens?  🔦 Business Operations will then follow the steps in the "Hiring" issue, which includes reaching out to the new team member within 1 business day from a separate email thread to get additional information as needed, prepare their agreement, add them to the company's payroll system, and get their new laptop and hardware security keys ordered so that everything is ready for them to start on their first day.
+The Head of Digital Experience will then follow the steps in the ["Teammate pre-onboarding"](https://github.com/fleetdm/confidential/issues/new?assignees=&labels=%23g-digital-experience&projects=&template=pre-onboarding.md&title=Pre-onboarding%3A+______________________) issue, which includes reaching out to the new team member within 1 business day from a separate email thread to get additional information as needed, prepare their agreement, add them to the company's payroll system, and get their new laptop and hardware security keys ordered so that everything is ready for them to start on their first day.
 
 
+## Create a 30-60-90 day plan
+
+The hiring manager creates a 30-60-90 day plan outlining key role objectives to be reviewed in 1:1 meetings during the first three months of employment. To create the 30-60-90 day plan, use the prompts in the "Vision" section of the new teammates [1:1 meeting doc (TEMPLATE)](https://docs.google.com/document/d/1IkGQJ4PPU0MyW35Xo8BuvoUPKpStsmcw_nHWt71W2yE/edit#heading=h.uzxntzlyyaou) to ensure continuous support and alignment with company goals.
+
+
+## CEO shadow program
+
+The CEO shadow program is a three-day temporary assignment (usually completed during onboarding) in which core team members will shadow all relevant meetings on the CEO's calendar. This gives team members an overview of all aspects of the company and provides high context and in turn, high-output contributors. The program also creates opportunities for the CEO to build relationships with team members across the company and to identify [challenges and opportunities](https://fleetdm.com/handbook/company/leadership#ceo-flaws) earlier. 
+ 
+> **What it's not**: The CEO shadow program is not a performance evaluation or a determinating factor for a promotion or raise. 
+
+As a CEO shadow, you will be attending both internal and external meetings regarding various areas of the company. In order to make the most of your time as a shadow:
+- **Be on time**: Your time is priceless, your time as a CEO shadow is short! Join each meeting on time, this limits the distraction for other attendees and gives the CEO the opportunity to introduce you to other folks on the call without interrupting the meeting.
+- **Be present**: During meetings outside of your department, it can be easy to find yourself charging ahead on other projects. The interactions you'll have in these meetings and the context you'll gain are important.
+- **Be active**: There are many short-term tasks you'll be asked to perform as a shadow. Here are some examples:
+  - Prepare for, participate in, take notes during, and follow up on meetings.
+  - Make handbook updates and shadow PR reviews.
+  - Solve urgent issues. For example, help solve a complaint from a customer or coordinate the response to a technical issue.
+  - Create and/or complete GitHub issues involving multiple departments at Fleet, and work towards closing or creating pull requests to complete issues.
+
+
+### Prepare for the program
+
+CEO shadows join all meetings on the [CEO's calendar](https://calendar.google.com/calendar/embed?src=mike%40fleetdm.com&ctz=America%2FChicago) that **do not have** "[no shadows]" appended to the calendar event title. Before beginning your time as a [CEO shadow](https://fleetdm.com/handbook/company/leadership#ceo-shadow-program):
+1. Make sure you've read through the [CEO flaws](https://fleetdm.com/handbook/company/leadership#ceo-flaws) to better understand how to communicate with him.
+2. Update your Zoom display name to be "CEO shadow | [your name]" (e.g. "CEO shadow | Jayne Doo").
+3. Know which meetings you're expected to join. **You won't be listed as an attendee on any of the CEO's calendar events** to avoid confusion when scheduling meetings with external participants. You're intentionally marked out of office to avoid scheduling conflicts.
+
+> Please **DO NOT** add yourself as an attendee to any of the CEO's meetings. The CEO regularly meets with prospects and customers in the community, and without the context of the CEO shadow program, an unknown name on the calendar event could be mistaken for a sales tactic.
+
 
 ## Tracking hours
 Fleet asks US-based hourly contributors to track hours in Gusto, and contributors outside the US to track hours via Pilot.co.
@@ -391,24 +408,21 @@ This applies to anyone who gets paid by the hour, including consultants and hour
 
 ## Communicating departures
 Although it's sad to see someone go, Fleet understands that not everything is meant to be forever [like open-source is](https://fleetdm.com/handbook/company/why-this-way#why-open-source). There are a few steps that the company needs to take to facilitate a departure. 
-1. **Departing team member's manager:** Inform the Head of Business Operations about the departure via email and cc your manager. The Head of Business Operations will coordinate the team member's last day, offboarding, and exit meeting.
-3. **Business Operations**: Will then create and begin completing [offboarding issue](https://github.com/fleetdm/classified/blob/main/.github/ISSUE_TEMPLATE/%F0%9F%9A%AA-offboarding-____________.md), to include coordinating team member's last day, offboarding, and exit meeting.
-   > After finding out about the departure, the Head of Business Operations will post in #g-e to inform the E-group of the team member's departure, asking E-group members to inform any other managers on their teams.
+1. **Departing team member's manager:** Inform the Head of Digital Experience about the departure via email and cc your manager. The Head of Digital Experience will coordinate the team member's last day, offboarding, and exit meeting.
+3. **Digital Experience**: Will then create and begin completing [offboarding issue](https://github.com/fleetdm/classified/blob/main/.github/ISSUE_TEMPLATE/%F0%9F%9A%AA-offboarding-____________.md), to include coordinating team member's last day, offboarding, and exit meeting.
+   > After finding out about the departure, the Head of Digital Experience will post in #g-e to inform the E-group of the team member's departure, asking E-group members to inform any other managers on their teams.
 4. **CEO**: The CEO will make an announcement during the "🌈 Weekly Update" post on Friday in the `#general` channel on Slack. 
 
 
+<<<<<<< HEAD
 ## Changing someone's position
-
-From time to time, someone's job title changes.  To do this, Business Operations follows these steps:
-
-1. Change "Fleeties" to reflect the new job title, manager, and/or department.
-2. If there is a compensation change, update "Equity plan".  Use the first day of a month as the date, and enter this in the corresponding column.
-3. If applicable, schedule the change in the appropriate payroll system.  (Don't worry about updating job titles in the payroll system.)
+From time to time, someone's job title changes.  To do this, reach out to [Digital Experience](https://fleetdm.com/handbook/digital-experience).
 
 <img width="384" alt="image" src="https://github.com/fleetdm/fleet/assets/618009/1e59ac8f-26d8-4f2f-9ff4-2e303753c910">
 
 
 ## Delivering performance feedback
+
 When it comes to performance feedback, [speak freely](https://fleetdm.com/handbook/company#openness), sooner, and provide an explicit example of the behavior you observed and the impact it had.
 
 1. Deliver negative feedback privately whenever possible, and be constructive not punitive. Celebrate positive feedback publicly.
diff --git a/handbook/company/open-positions.yml b/handbook/company/open-positions.yml
index 2558d77a30..71bcb2af6b 100644
--- a/handbook/company/open-positions.yml
+++ b/handbook/company/open-positions.yml
@@ -9,6 +9,30 @@
 #   experience: |
 #     Add markdown content to this field.
 ################################################
+- jobTitle: 🦢 Product Designer
+  department: Product Design
+  hiringManagerName: Noah Talerman
+  hiringManagerLinkedInUrl: https://www.linkedin.com/in/noah-talerman/
+  hiringManagerGithubUsername: noahtalerman
+  responsibilities: |
+    - ⏫ Engage with product management, engineering, business stakeholders, and customers to understand initiatives.
+    - 📣 Design consistent interactions across the Fleet user experience, including API and CLI.
+    - 🌡️ Drive the refinement process from concept to high-fidelity prototypes.
+  experience: |
+    - 💭 3 - 5 years of experience as a Product Designer.
+    - 💖 Proficient in visual design and wireframing tools (we use Figma).
+    - 🦉 Articulate the problem to be solved and create a compelling narrative around proposed solutions.
+    - 📖 Maintain a design system that enables speed for designers, PMs, and engineers.
+    - 🧑‍🔬 Develop an understanding of developer-first automation workflows, including API and CLI experiences.
+    - 🧪 Translate user insights into digital experiences that are well-crafted and easy to use.
+    - 🤝 Collaboration: You work best in a participatory, team-based environment.
+    - 🚀 Prototype-first: You embrace speed and failure as we iterate towards the right solution. You have hands-on experience in creating low and high-fidelity prototypes. You’re comfortable accepting suboptimal designs in favor of iteration.
+    - 🧬 Simplicity: You love complex questions and use your work to simplify that complexity for users.
+    - 🟣 Openness: You are flexible and open to new ideas and ways of working.
+    - ✍️ Experience designing CLI experiences for developers or willingness to learn.
+    - ➕ Bonus: YB2B SaaS background
+    - ➕ Bonus: cybersecurity or IT background
+
 - jobTitle: 🚀 Software Engineer
   department: Engineering
   hiringManagerName: Luke Heath
@@ -22,7 +46,7 @@
       - 🚀 Actively participate in all engineering scrum meetings, including sprint planning, daily standups, sprint demos, sprint retrospectives, and estimation sessions.
       - 🌟 Contribute to the overall success of the [MDM](https://fleetdm.com/handbook/company/product-groups#mdm-group) product group by ensuring users receive valuable new features.
   experience: |
-      - 💭 3-5 years' of experience in backend/SaaS development.
+      - 💭 3-5 years of experience in backend/SaaS development.
       - 🦉 Proficient in backend development. You practice OOP design and are comfortable in a lean software development environment. 
       - 🦉 Translate requirements into well-designed and functional software.
       - 🤝 Communicate regularly with stakeholders, project managers, quality assurance teams, and other developers regarding progress on long-term technology roadmap.
@@ -36,26 +60,4 @@
       - 🛠️ Technical: You understand the software development processes. You understand that software quality matters.
       - 🟣 Openness: You are flexible and open to new ideas and ways of working.
       - ➕ Bonus: Cybersecurity or IT background.
-- jobTitle: 🐋 Solutions Consultant
-  department: Sales
-  hiringManagerName: Dave Herder
-  hiringManagerLinkedInUrl: https://linkedin.com/in/daveherder
-  hiringManagerGithubUsername: dherder
-  responsibilities: |
-      - ⏫ Work hand-in-hand with the Sales team by participating in calls with potential customers to show them a demonstration of Fleet in action.
-      - 📖 You’ll provide commentary, detailed technical explanations, examples from your experience, and answer customer questions based on your experience managing Apple, Windows, and Linux devices with MDM and other tools (osquery).
-      - 🏃‍♂️ Provide internal technical training, and participate in sales enablement activities to ensure our team is prepared to explain how Fleet works, where we fit in the Security and IT ecosystem, and how we can solve problems with our customers. 
-  experience: |
-      - 🦉 3+ years of experience in a technical sales role (Solutions Consultant, Sales Engineer, Solutions Architect, Technical Account Manager, etc) in the device management or cybersecurity space.
-      - 🧑‍🔬 Experience working with Enterprise customers to help resolve complex technical issues.
-      - 💭 Cybersecurity or IT background, experience with device management solutions like Fleet, Intune, Jamf Pro, Workspace One, etc. in addition to EDR platforms like Crowdstrike, SentinelOne, CarbonBlack, etc. 
-      - ➕ Familiarity with GitOps workflows and steps to contribute code in open source projects.
-      - 🛠️ Has deployed infrastructure via some form of CI tooling to at least one of the big cloud platforms and lived to tell the tale.
-      - 💖 An excellent understanding of macOS, Windows, Linux and core services like Autopilot, ABM/ASM, MDM, ADE, APNs, syslog, etc.
-      - ✍️ Familiarity with SQLite, shell scripting, Python, Powershell, and using Terminal to execute commands or run scripts.
-      - 🎯 Strong attention to detail and can act as an encyclopedia of knowledge about how Fleet works - our potential customers represent a wide range of needs across many different use cases. Be adaptable to learning new things quickly and then share this knowledge with others.
-      - 💡 Excellent communication and collaboration skills, with the ability to work closely with sales, engineering, and product teams.
-      - 🌐 Coordinate with our Customer Success team to assist with any technical questions during renewal discussions. You’ll be a resource for existing customers too.
-      - 👥 A customer-centric mindset, focusing on delivering value and a positive user experience.
-      - 🤝 Collaboration: You work best in a participatory, team-based environment.
-      - 🟣 Openness: You are flexible and open to new ideas and ways of working.
+
diff --git a/handbook/company/pricing-features-table.yml b/handbook/company/pricing-features-table.yml
index f29ddac991..13e19b9388 100644
--- a/handbook/company/pricing-features-table.yml
+++ b/handbook/company/pricing-features-table.yml
@@ -12,6 +12,189 @@
 #   jamfProHasFeature: Whether or not Jamf Pro has this (or a comparable) feature. Supported values: "yes", "no" or "appleOnly" (currently not used by Fleet website UI)
 #   jamfProtectHasFeature: Whether or not Jamf Protext has this (or a comparable) feature. Supported values: "yes", "no" or "appleOnly" (currently not used by Fleet website UI)
 #
+#                                                                                                                                                                                                                                                                                                                             
+#
+#  ██████╗ ███████╗██████╗ ██╗      ██████╗ ██╗   ██╗███╗   ███╗███████╗███╗   ██╗████████╗ 
+#  ██╔══██╗██╔════╝██╔══██╗██║     ██╔═══██╗╚██╗ ██╔╝████╗ ████║██╔════╝████╗  ██║╚══██╔══╝
+#  ██║  ██║█████╗  ██████╔╝██║     ██║   ██║ ╚████╔╝ ██╔████╔██║█████╗  ██╔██╗ ██║   ██║   
+#  ██║  ██║██╔══╝  ██╔═══╝ ██║     ██║   ██║  ╚██╔╝  ██║╚██╔╝██║██╔══╝  ██║╚██╗██║   ██║   
+#  ██████╔╝███████╗██║     ███████╗╚██████╔╝   ██║   ██║ ╚═╝ ██║███████╗██║ ╚████║   ██║   
+#  ╚═════╝ ╚══════╝╚═╝     ╚══════╝ ╚═════╝    ╚═╝   ╚═╝     ╚═╝╚══════╝╚═╝  ╚═══╝   ╚═╝   
+#         
+#
+#  ╔╦╗╔═╗╔╗╔╔═╗╔═╗╔═╗╔╦╗  ╔═╗╦  ╔═╗╦ ╦╔╦╗
+#  ║║║╠═╣║║║╠═╣║ ╦║╣  ║║  ║  ║  ║ ║║ ║ ║║
+#  ╩ ╩╩ ╩╝╚╝╩ ╩╚═╝╚═╝═╩╝  ╚═╝╩═╝╚═╝╚═╝═╩╝
+- industryName: Managed cloud
+  description: Have Fleet host it for you (currently only available for customers with 700+ hosts.  PS. Wish we could host for you?  We're working on it!  Please let us know if you know of a good partner.  In the meantime, join fleetdm.com/support and we're happy to help you deploy Fleet yourself.)
+  pricingTableCategories: [Deployment]
+  productCategories: [Endpoint operations,Device management,Vulnerability management]
+  tier: Premium
+  jamfProHasFeature: yes
+  jamfProtectHasFeature: yes
+# 
+#  ╔═╗╔═╗╦  ╔═╗  ╦ ╦╔═╗╔═╗╔╦╗╔═╗╔╦╗
+#  ╚═╗║╣ ║  ╠╣───╠═╣║ ║╚═╗ ║ ║╣  ║║
+#  ╚═╝╚═╝╩═╝╚    ╩ ╩╚═╝╚═╝ ╩ ╚═╝═╩╝
+- industryName: Self-hosted
+  friendlyName: Host it yourself
+  description: Deploy Fleet anywhere and host it yourself, even in air-gapped environments except where technologically impossible.
+  pricingTableCategories: [Deployment]
+  documentationUrl: https://fleetdm.com/docs/deploy/introduction
+  productCategories: [Endpoint operations,Device management,Vulnerability management]
+  tier: Free
+  jamfProHasFeature: yes
+  jamfProtectHasFeature: no
+  buzzwords: [Self-hosted]
+#  
+#  ╔╦╗╦ ╦╦ ╔╦╗╦  ╔╦╗╔═╗╔╗╔╔═╗╔╗╔╔═╗╦ ╦
+#  ║║║║ ║║  ║ ║───║ ║╣ ║║║╠═╣║║║║  ╚╦╝
+#  ╩ ╩╚═╝╩═╝╩ ╩   ╩ ╚═╝╝╚╝╩ ╩╝╚╝╚═╝ ╩ 
+- industryName: Multi-tenancy
+  description: For managed service providers to use a single instance of Fleet for multiple customers.
+  documentationUrl: https://github.com/fleetdm/fleet/issues/9956
+  productCategories: [Device management]
+  pricingTableCategories: [Deployment]
+  usualDepartment: IT
+  buzzwords: [OEM,Private label,House brand,Clear label,Multi-tenancy]
+  tier: Premium
+#  
+#  ╔╦╗╔═╗╔═╗╦  ╔═╗╦ ╦╔╦╗╔═╗╔╗╔╔╦╗  ╔╦╗╔═╗╔═╗╦  ╔═╗
+#   ║║║╣ ╠═╝║  ║ ║╚╦╝║║║║╣ ║║║ ║    ║ ║ ║║ ║║  ╚═╗
+#  ═╩╝╚═╝╩  ╩═╝╚═╝ ╩ ╩ ╩╚═╝╝╚╝ ╩    ╩ ╚═╝╚═╝╩═╝╚═╝
+- industryName: Deployment tools 
+  description: Pre-built Terraform modules and Helm charts to help you get up and running. 
+  documentationUrl: https://fleetdm.com/docs/deploy/introduction
+  usualDepartment: IT
+  tier: Free
+  jamfProHasFeature: no
+  jamfProtectHasFeature: no
+  productCategories: [Endpoint operations]
+  pricingTableCategories: [Deployment] 
+#
+#
+#   ██████╗ ██████╗ ███╗   ██╗███████╗██╗ ██████╗ ██╗   ██╗██████╗  █████╗ ████████╗██╗ ██████╗ ███╗   ██╗
+#  ██╔════╝██╔═══██╗████╗  ██║██╔════╝██║██╔════╝ ██║   ██║██╔══██╗██╔══██╗╚══██╔══╝██║██╔═══██╗████╗  ██║
+#  ██║     ██║   ██║██╔██╗ ██║█████╗  ██║██║  ███╗██║   ██║██████╔╝███████║   ██║   ██║██║   ██║██╔██╗ ██║
+#  ██║     ██║   ██║██║╚██╗██║██╔══╝  ██║██║   ██║██║   ██║██╔══██╗██╔══██║   ██║   ██║██║   ██║██║╚██╗██║
+#  ╚██████╗╚██████╔╝██║ ╚████║██║     ██║╚██████╔╝╚██████╔╝██║  ██║██║  ██║   ██║   ██║╚██████╔╝██║ ╚████║
+#   ╚═════╝ ╚═════╝ ╚═╝  ╚═══╝╚═╝     ╚═╝ ╚═════╝  ╚═════╝ ╚═╝  ╚═╝╚═╝  ╚═╝   ╚═╝   ╚═╝ ╚═════╝ ╚═╝  ╚═══╝
+#
+#
+#  ╔═╗╦═╗╦╦  ╦╔═╗╔╦╗╔═╗  ╦ ╦╔═╗╔╦╗╔═╗╔╦╗╔═╗  ╦═╗╔═╗╔═╗╦╔═╗╔╦╗╦═╗╦ ╦
+#  ╠═╝╠╦╝║╚╗╔╝╠═╣ ║ ║╣   ║ ║╠═╝ ║║╠═╣ ║ ║╣   ╠╦╝║╣ ║ ╦║╚═╗ ║ ╠╦╝╚╦╝
+#  ╩  ╩╚═╩ ╚╝ ╩ ╩ ╩ ╚═╝  ╚═╝╩  ═╩╝╩ ╩ ╩ ╚═╝  ╩╚═╚═╝╚═╝╩╚═╝ ╩ ╩╚═ ╩
+- industryName: Private update registry
+  friendlyName: Update agents from a secret URL
+  description: Load agent code from a secret URL that you manage.
+  documentationUrl: https://fleetdm.com/docs/using-fleet/update-agents
+  tier: Premium
+  jamfProHasFeature: no
+  jamfProtectHasFeature: no
+  productCategories: [Endpoint operations]
+  pricingTableCategories: [Configuration]
+  usualDepartment: Security
+#
+#  ╔═╗╔═╗╔╗╔╔╦╗╦═╗╔═╗╦    ╔═╗╔═╗╔═╗╔╗╔╔╦╗  ╦  ╦╔═╗╦═╗╔═╗╦╔═╗╔╗╔╔═╗
+#  ║  ║ ║║║║ ║ ╠╦╝║ ║║    ╠═╣║ ╦║╣ ║║║ ║   ╚╗╔╝║╣ ╠╦╝╚═╗║║ ║║║║╚═╗
+#  ╚═╝╚═╝╝╚╝ ╩ ╩╚═╚═╝╩═╝  ╩ ╩╚═╝╚═╝╝╚╝ ╩    ╚╝ ╚═╝╩╚═╚═╝╩╚═╝╝╚╝╚═╝
+- industryName: Control agent versions
+  description: Manage agents remotely by setting different versions per-baseline.
+  documentationUrl: https://fleetdm.com/docs/configuration/agent-configuration#configure-fleetd-update-channels
+  tier: Premium
+  jamfProHasFeature: no
+  jamfProtectHasFeature: no
+  productCategories: [Endpoint operations]
+  pricingTableCategories: [Configuration]
+  usualDepartment: IT
+  waysToUse:
+    - description: Supply-chain Levels for Software Artifacts (SLSA) attestations for the fleetd binary artifacts and server container image to enable verification that the binaries are built and uploaded using GitHub Actions from the Fleet repository at a particular commit SHA coming soon (2024-12-31).
+    - moreInfoUrl: https://github.com/fleetdm/fleet/issues/20219 #customer-figali
+#
+#  ╔═╗╔═╗╔╦╗╔╦╗╔═╗╔╗╔╔╦╗  ╦  ╦╔╗╔╔═╗  ╔╦╗╔═╗╔═╗╦    ┌─  ╔═╗╦  ╦  ─┐
+#  ║  ║ ║║║║║║║╠═╣║║║ ║║  ║  ║║║║║╣    ║ ║ ║║ ║║    │   ║  ║  ║   │
+#  ╚═╝╚═╝╩ ╩╩ ╩╩ ╩╝╚╝═╩╝  ╩═╝╩╝╚╝╚═╝   ╩ ╚═╝╚═╝╩═╝  └─  ╚═╝╩═╝╩  ─┘
+- industryName: Command line tool (CLI)
+  friendlyName: fleetctl
+  documentationUrl: https://fleetdm.com/docs/using-fleet/fleetctl-cli
+  productCategories: [Endpoint operations,Device management]
+  pricingTableCategories: [Configuration]
+  usualDepartment: IT
+  tier: Free
+  jamfProHasFeature: yes
+  jamfProtectHasFeature: yes      
+#
+#  ╔═╗╦╔╦╗╔═╗╔═╗╔═╗
+#  ║ ╦║ ║ ║ ║╠═╝╚═╗
+#  ╚═╝╩ ╩ ╚═╝╩  ╚═╝
+- industryName: GitOps
+  friendlyName: Manage endpoints in git
+  documentationUrl: https://github.com/fleetdm/fleet-gitops
+  description: Fork the best practices GitHub repo and use the included GitHub Actions to quickly automate Fleet console and configuration workflow management.
+  productCategories: [Endpoint operations,Device management,Vulnerability management]
+  pricingTableCategories: [Configuration]
+  usualDepartment: IT
+  tier: Free
+  jamfProHasFeature: yes
+  jamfProtectHasFeature: yes
+  demos:
+    description: A top savings and investment company wanted workflows and automation so that one bad actor can't brick their fleet.  This way, they have to make a pull request first.
+    quote: I don't want one bad actor to brick my fleet.  I want them to make a pull request first.
+    moreInfoUrl: https://docs.google.com/document/d/1hAQL6P--Tt3syq1MTRONAxhQA_2Vjt3oOJJt_O4xbiE/edit?disco=AAABAVnYvns&usp_dm=true#heading=h.7en766pueek4
+#  
+#  ╔╦╗╦ ╦╔═╗   ╔═╗╔═╗╔═╗╔╦╗╔═╗╦═╗  ╔═╗╦ ╦╔╦╗╦ ╦╔═╗╔╗╔╔╦╗╦╔═╗╔═╗╔╦╗╦╔═╗╔╗╔
+#   ║ ║║║║ ║───╠╣ ╠═╣║   ║ ║ ║╠╦╝  ╠═╣║ ║ ║ ╠═╣║╣ ║║║ ║ ║║  ╠═╣ ║ ║║ ║║║║
+#   ╩ ╚╩╝╚═╝   ╚  ╩ ╩╚═╝ ╩ ╚═╝╩╚═  ╩ ╩╚═╝ ╩ ╩ ╩╚═╝╝╚╝ ╩ ╩╚═╝╩ ╩ ╩ ╩╚═╝╝╚╝
+- industryName: Two-factor authentication
+  moreInfoUrl: https://github.com/fleetdm/fleet/issues/5478
+  productCategories: [Endpoint operations,Device management,Vulnerability management]
+  pricingTableCategories: [Configuration]
+  usualDepartment: IT
+  tier: Free
+  jamfProHasFeature: yes
+  jamfProtectHasFeature: yes
+  waysToUse:
+    - description: Enforce two-factor authentication when logging in to Fleet for added security.
+  comingSoonOn: 2024-12-31 #customer-rosner
+#  
+#  ╦═╗╔═╗╦  ╔═╗  ╔╗ ╔═╗╔═╗╔═╗╔╦╗  ╔═╗╔═╗╔═╗╔═╗╔═╗╔═╗  ╔═╗╔═╗╔╗╔╔╦╗╦═╗╔═╗╦  
+#  ╠╦╝║ ║║  ║╣───╠╩╗╠═╣╚═╗║╣  ║║  ╠═╣║  ║  ║╣ ╚═╗╚═╗  ║  ║ ║║║║ ║ ╠╦╝║ ║║  
+#  ╩╚═╚═╝╩═╝╚═╝  ╚═╝╩ ╩╚═╝╚═╝═╩╝  ╩ ╩╚═╝╚═╝╚═╝╚═╝╚═╝  ╚═╝╚═╝╝╚╝ ╩ ╩╚═╚═╝╩═╝
+- industryName: Role-based access control
+  documentationUrl: https://fleetdm.com/docs/using-fleet/manage-access#manage-access
+  productCategories: [Endpoint operations,Device management,Vulnerability management]
+  pricingTableCategories: [Configuration]
+  usualDepartment: IT
+  tier: Premium
+  jamfProHasFeature: yes
+  jamfProtectHasFeature: yes
+#
+#  ╔═╗╦ ╦╔╦╗╦╔╦╗  ╦  ╔═╗╔═╗╔═╗╦╔╗╔╔═╗
+#  ╠═╣║ ║ ║║║ ║   ║  ║ ║║ ╦║ ╦║║║║║ ╦
+#  ╩ ╩╚═╝═╩╝╩ ╩   ╩═╝╚═╝╚═╝╚═╝╩╝╚╝╚═╝
+- industryName: Audit logging
+  description: Log all activity, including queries, scripts, access, etc.
+  documentationUrl: https://fleetdm.com/docs/rest-api/rest-api#list-activities
+  productCategories: [Endpoint operations, Device management]
+  pricingTableCategories: [Configuration]
+  tier: Premium
+  jamfProHasFeature: yes
+  jamfProtectHasFeature: yes
+  usualDepartment: Security
+  waysToUse:
+    - description: Export activity of Fleet admins to your SIEM or data lake
+#  
+#  ╔═╗╔═╗╔═╗╔═╗╔═╗  ╔╦╗╦═╗╔═╗╔╗╔╔═╗╔═╗╔═╗╦═╗╔═╗╔╗╔╔═╗╦ ╦
+#  ╚═╗║  ║ ║╠═╝║╣    ║ ╠╦╝╠═╣║║║╚═╗╠═╝╠═╣╠╦╝║╣ ║║║║  ╚╦╝
+#  ╚═╝╚═╝╚═╝╩  ╚═╝   ╩ ╩╚═╩ ╩╝╚╝╚═╝╩  ╩ ╩╩╚═╚═╝╝╚╝╚═╝ ╩ 
+- industryName: Scope transparency
+  description: Let end users see the source code for exactly how they are being monitored, and set clear expectations about what is and isn’t acceptable use of work computers.
+  tier: Free
+  documentationUrl: https://fleetdm.com/transparency
+  productCategories: [Endpoint operations]
+  pricingTableCategories: [Configuration]
+#        
+#  
 #  ██████╗ ███████╗██╗   ██╗██╗ ██████╗███████╗                                                
 #  ██╔══██╗██╔════╝██║   ██║██║██╔════╝██╔════╝                                                
 #  ██║  ██║█████╗  ██║   ██║██║██║     █████╗                                                  
@@ -31,14 +214,14 @@
 #  ║  ╠╦╝║ ║╚═╗╚═╗───╠═╝║  ╠═╣ ║ ╠╣ ║ ║╠╦╝║║║  ║║║ ║║║║║  ╚═╗║ ║╠═╝╠═╝║ ║╠╦╝ ║ 
 #  ╚═╝╩╚═╚═╝╚═╝╚═╝   ╩  ╩═╝╩ ╩ ╩ ╚  ╚═╝╩╚═╩ ╩  ╩ ╩═╩╝╩ ╩  ╚═╝╚═╝╩  ╩  ╚═╝╩╚═ ╩ 
 - industryName: Cross-platform MDM support
-  description: macOS, Windows, and Linux.
-  documentationUrl: https://fleetdm.com/announcements/fleet-introduces-windows-mdm
+  description: Apple, Windows, and Linux.
+  documentationUrl: https://fleetdm.com/announcements/debunk-the-cross-platform-myth
   tier: Premium
   jamfProHasFeature: appleOnly
   jamfProtectHasFeature: no
   usualDepartment: IT
   productCategories: [Device management]
-  pricingTableCategories: [Device management]       
+  pricingTableCategories: [Devices]       
 #  
 #  ╔╦╗╔╦╗╔╦╗  ╔╦╗╦╔═╗╦═╗╔═╗╔╦╗╦╔═╗╔╗╔
 #  ║║║ ║║║║║  ║║║║║ ╦╠╦╝╠═╣ ║ ║║ ║║║║
@@ -51,29 +234,44 @@
   documentationUrl: https://fleetdm.com/docs/using-fleet/mdm-migration-guide
   usualDepartment: IT
   productCategories: [Device management]
-  pricingTableCategories: [Device management]
+  pricingTableCategories: [Devices]
 #  
 #  ╔═╗╔═╗╦═╗╔═╗  ╔╦╗╔═╗╦ ╦╔═╗╦ ╦  ╔═╗╔═╗╔╦╗╦ ╦╔═╗
 #  ╔═╝║╣ ╠╦╝║ ║───║ ║ ║║ ║║  ╠═╣  ╚═╗║╣  ║ ║ ║╠═╝
 #  ╚═╝╚═╝╩╚═╚═╝   ╩ ╚═╝╚═╝╚═╝╩ ╩  ╚═╝╚═╝ ╩ ╚═╝╩  
 - industryName: Zero-touch setup
-  description: Zero-touch setup for macOS, iOS/iPadOS (coming soon), and Windows.
+  description: Zero-touch setup for macOS, iOS/iPadOS, and Windows.
   documentationUrl: https://fleetdm.com/docs/using-fleet/mdm-macos-setup-experience
   tier: Premium
   jamfProHasFeature: appleOnly
   jamfProtectHasFeature: no
   usualDepartment: IT
   productCategories: [Device management]
-  pricingTableCategories: [Device management]
+  pricingTableCategories: [Devices]
   waysToUse:
-    - description: Zero-touch for iOS/iPadOS is coming soon (2024-07-15).
-    - description: Ship a macOS workstation to the end user's home and have them automatically enroll to Fleet during out-of-the-box setup.
+    - description: Ship a macOS, iOS, or iPadOS device to the end user's home and have them automatically enroll to Fleet during out-of-the-box setup.
     - description: Ship a Windows workstation to the end user's home and have them automatically enroll to Fleet during out-of-the-box setup.
     - description: Customize the out-of-the-box setup experience for your end users.
     - description: Install a bootstrap package to run custom scripts during the setup experience. Store the bootstrap package outside the Fleet database coming soon (2024-09-15) #customer-faltona
       moreInfoUrl: https://github.com/fleetdm/fleet/issues/19037
     - description: Require end users to authenticate with your identity provider (IdP) and agree to an end user license agreement (EULA) before they can use their new workstation
 #  
+#  ╔╗ ╦ ╦╔═╗╔╦╗  ╔═╗╔╗╔╦═╗╔═╗╦  ╦  ╔╦╗╔═╗╔╗╔╔╦╗
+#  ╠╩╗╚╦╝║ ║ ║║  ║╣ ║║║╠╦╝║ ║║  ║  ║║║║╣ ║║║ ║ 
+#  ╚═╝ ╩ ╚═╝═╩╝  ╚═╝╝╚╝╩╚═╚═╝╩═╝╩═╝╩ ╩╚═╝╝╚╝ ╩ 
+- industryName: Bring your own device (BYOD) enrollment
+  description: BYOD enrollment for macOS, iOS/iPadOS (coming soon), Windows, and Android (coming soon) devices.
+  documentationUrl: https://fleetdm.com/guides/sysadmin-diaries-device-enrollment#byod-enrollment
+  tier: Free
+  jamfProHasFeature: yes
+  jamfProtectHasFeature: no
+  usualDepartment: IT
+  productCategories: [Device management]
+  pricingTableCategories: [Devices]
+  waysToUse:
+    - description: Support ACME as a protocol for MDM certificate generation. Coming soon (2025-03-31) #customer-rosner
+      moreInfoUrl: https://github.com/fleetdm/fleet/issues/15611 
+#  
 #  ╦ ╦╔═╗╔═╗╦═╗  ╔═╗╔═╗╔═╗╔═╗╦ ╦╔╗╔╔╦╗  ╔═╗╦ ╦╔╗╔╔═╗
 #  ║ ║╚═╗║╣ ╠╦╝  ╠═╣║  ║  ║ ║║ ║║║║ ║   ╚═╗╚╦╝║║║║  
 #  ╚═╝╚═╝╚═╝╩╚═  ╩ ╩╚═╝╚═╝╚═╝╚═╝╝╚╝ ╩   ╚═╝ ╩ ╝╚╝╚═╝
@@ -81,43 +279,100 @@
   description: Sync user accounts via Okta, AD, or any IDP. 
   documentationUrl: https://fleetdm.com/docs/using-fleet/mdm-macos-setup-experience
   productCategories: [Endpoint operations,Device management,Vulnerability management]
-  pricingTableCategories: [Device management]
+  pricingTableCategories: [Devices]
   usualDepartment: IT
   tier: Premium
   jamfProHasFeature: yes
   jamfProtectHasFeature: yes
   waysToUse:
     - description: Automatically set admin access to Fleet based on your IDP
-#  
-#  ╔╗ ╦ ╦╔═╗╔╦╗  ╔═╗╔╗╔╦═╗╔═╗╦  ╦  ╔╦╗╔═╗╔╗╔╔╦╗
-#  ╠╩╗╚╦╝║ ║ ║║  ║╣ ║║║╠╦╝║ ║║  ║  ║║║║╣ ║║║ ║ 
-#  ╚═╝ ╩ ╚═╝═╩╝  ╚═╝╝╚╝╩╚═╚═╝╩═╝╩═╝╩ ╩╚═╝╝╚╝ ╩ 
-- industryName: BYOD enrollment
-  description: BYOD enrollment for macOS, iOS/iPadOS (coming soon), Windows, and Android (coming soon) devices.
-  documentationUrl: https://fleetdm.com/guides/sysadmin-diaries-device-enrollment#byod-enrollment
+#
+#  ╦ ╦╦ ╦╔╦╗╔═╗╔╗╔   ╔═╗╔╗╔╔╦╗╔═╗╔═╗╦╔╗╔╔╦╗  ╔╦╗╔═╗╔═╗╔═╗╦╔╗╔╔═╗
+#  ╠═╣║ ║║║║╠═╣║║║───║╣ ║║║ ║║╠═╝║ ║║║║║ ║   ║║║╠═╣╠═╝╠═╝║║║║║ ╦
+#  ╩ ╩╚═╝╩ ╩╩ ╩╝╚╝   ╚═╝╝╚╝═╩╝╩  ╚═╝╩╝╚╝ ╩   ╩ ╩╩ ╩╩  ╩  ╩╝╚╝╚═╝
+- industryName: Human-endpoint mapping
+  friendlyName: See who logs in on every computer
+  description: Identify who logs in to any system, including login history and current sessions.  Look up any host by the email address of the person using it.
+  documentationUrl: https://fleetdm.com/docs/rest-api/rest-api#get-hosts-google-chrome-profiles
+  screenshotSrc:
   tier: Free
   jamfProHasFeature: yes
-  jamfProtectHasFeature: no
+  jamfProtectHasFeature: yes
+  productCategories: [Endpoint operations]
+  pricingTableCategories: [Devices]
   usualDepartment: IT
-  productCategories: [Device management]
-  pricingTableCategories: [Device management]
+  buzzwords: [Device users,human-to-device mapping]
+  dri: mikermcneil
+  demos:
+    - description: Security engineers at a top gaming company wanted to get demographics off their macOS, Windows, and Linux machines about who the user is and who's logged in.
+      moreInfoUrl: https://docs.google.com/document/d/1qFYtMoKh3zyERLhbErJOEOo2me6Bc7KOOkjKn482Sqc/edit
+    - description: Data engineers at a top biotech corporation needed to know who is logged into their devices. 
+      quote: So we don't know exactly what's going on after we deploy the device, we know that they are compliant with the security because we are running these stuff, but we don't know certainly who is running, who is logging in the device?
+      moreInfoUrl: https://docs.google.com/document/d/17MNI5ykzlFjdVmQ8SPMrT1oR_hY_vkYAJx31F7l7Pv8/edit#heading=h.7en766pueek4 
   waysToUse:
-    - description: Support ACME as a protocol for MDM certificate generation. Coming soon (2024-12-31) #customer-rosner
-      moreInfoUrl: https://github.com/fleetdm/fleet/issues/15611 
+    - description: Look up computer by ActiveDirectory account
+    - description: Find device by Google Chrome user
+    - description: Identify who logs in to any system, including login history and current sessions.
+    - description: Look up any host by the email address of the person using it.
+    - description: Check user login history
+      moreInfoUrl: https://www.lepide.com/how-to/audit-who-logged-into-a-computer-and-when.html#:~:text=To%20find%20out%20the%20details,logs%20in%20%E2%80%9CWindows%20Logs%E2%80%9D.
+    - description: See currently logged in users
+      moreInfoUrl: https://www.top-password.com/blog/see-currently-logged-in-users-in-windows/
+    - description: Get demographics off of our machines about who the user is and who's logged in
+      moreInfoUrl: https://docs.google.com/document/d/1qFYtMoKh3zyERLhbErJOEOo2me6Bc7KOOkjKn482Sqc/edit
+    - description: See what servers someone is logged-in on
+      moreInfoUrl: https://community.spiceworks.com/topic/138171-is-there-a-way-to-see-what-servers-someone-is-logged-in-on
 #  
 #  ╔╦╗╔═╗╦  ╦╦╔═╗╔═╗  ╦╔╗╔╦  ╦╔═╗╔╗╔╔╦╗╔═╗╦═╗╦ ╦
 #   ║║║╣ ╚╗╔╝║║  ║╣   ║║║║╚╗╔╝║╣ ║║║ ║ ║ ║╠╦╝╚╦╝
 #  ═╩╝╚═╝ ╚╝ ╩╚═╝╚═╝  ╩╝╚╝ ╚╝ ╚═╝╝╚╝ ╩ ╚═╝╩╚═ ╩ 
 - industryName: Device inventory
-  description: The device inventory allows admins to view device data.
+  description:  Includes a list of all devices and all hardware and software attributes for each device.
   documentationUrl: https://fleetdm.com/docs/using-fleet/understanding-host-vitals
   moreInfoUrl: https://github.com/fleetdm/fleet/issues/14415
   tier: Free
   jamfProHasFeature: yes
   jamfProtectHasFeature: yes
   usualDepartment: IT
+  productCategories: [Endpoint operations,Device management, Vulnerability management]
+  pricingTableCategories: [Devices]
+  waysToUse:
+    - description: Implement software inventory recommendations from the SANS 20 / CIS 18.
+      moreInfoUrl: https://docs.google.com/document/d/1E6EQMMqrsRc6Z3YsR6Q33OaF9eAa8zLNaz4K2YzFdyo/edit#heading=h.7en766pueek4
+    - description: View a list of all hardware attributes of a device.
+      moreInfoUrl: https://fleetdm.com/tables/system_info  
+    - description: View a list of all software and their versions installed on all your hosts.
+      moreInfoUrl: https://fleetdm.com/docs/get-started/anatomy#software-library
+    - description: View a list of software rolled up by title.
+      moreInfoUrl: https://github.com/fleetdm/fleet/issues/14674
+    - description: Implement hardware and infrastructure inventory recommendations from the SANS 20 / CIS 18.
+      moreInfoUrl: https://docs.google.com/document/d/1E6EQMMqrsRc6Z3YsR6Q33OaF9eAa8zLNaz4K2YzFdyo/edit#heading=h.7en766pueek4 
+#  
+#  ╔═╗╔═╗╔═╗╦═╗╔═╗╦ ╦  ╦╔╗╔╦  ╦╔═╗╔╗╔╔╦╗╔═╗╦═╗╦ ╦
+#  ╚═╗║╣ ╠═╣╠╦╝║  ╠═╣  ║║║║╚╗╔╝║╣ ║║║ ║ ║ ║╠╦╝╚╦╝
+#  ╚═╝╚═╝╩ ╩╩╚═╚═╝╩ ╩  ╩╝╚╝ ╚╝ ╚═╝╝╚╝ ╩ ╚═╝╩╚═ ╩ 
+- industryName: Search inventory
+  description: Search devices by IP, serial, hostname, and UUID.
+  documentationUrl: https://fleetdm.com/docs/using-fleet/learn-how-to-use-fleet#how-to-ask-questions-about-your-device
   productCategories: [Endpoint operations,Device management]
-  pricingTableCategories: [Device management] 
+  pricingTableCategories: [Devices]
+  usualDepartment: IT
+  tier: Free
+  jamfProHasFeature: yes
+  jamfProtectHasFeature: yes
+#  
+#  ╔╦╗╔═╗╦═╗╔═╗╔═╗╔╦╗╔═╗╔╦╗  ╔╦╗╔═╗╦  ╦╦╔═╗╔═╗  ╔═╗╔═╗╔═╗╔═╗╦╔╗╔╔═╗
+#   ║ ╠═╣╠╦╝║ ╦║╣  ║ ║╣  ║║   ║║║╣ ╚╗╔╝║║  ║╣   ╚═╗║  ║ ║╠═╝║║║║║ ╦
+#   ╩ ╩ ╩╩╚═╚═╝╚═╝ ╩ ╚═╝═╩╝  ═╩╝╚═╝ ╚╝ ╩╚═╝╚═╝  ╚═╝╚═╝╚═╝╩  ╩╝╚╝╚═╝
+- industryName: Targeted device scoping
+  description: Organize devices with Teams and Labels.
+  documentationUrl: https://fleetdm.com/guides/managing-labels-in-fleet
+  tier: Premium
+  jamfProHasFeature: yes
+  jamfProtectHasFeature: yes
+  usualDepartment: IT
+  productCategories: [Device management]
+  pricingTableCategories: [Devices]      
 #  
 #  ╔═╗╔╗╔╔═╗╔═╗╦═╗╔═╗╔═╗  ╔╦╗╦╔═╗╦╔═  ╔═╗╔╗╔╔═╗╦═╗╦ ╦╔═╗╔╦╗╦╔═╗╔╗╔
 #  ║╣ ║║║╠╣ ║ ║╠╦╝║  ║╣    ║║║╚═╗╠╩╗  ║╣ ║║║║  ╠╦╝╚╦╝╠═╝ ║ ║║ ║║║║
@@ -127,7 +382,7 @@
   documentationUrl: https://fleetdm.com/docs/using-fleet/mdm-disk-encryption
   friendlyName: Ensure hard disks are encrypted
   productCategories: [Device management]
-  pricingTableCategories: [Device management]
+  pricingTableCategories: [Devices]
   usualDepartment: Security
   tier: Premium
   jamfProHasFeature: appleOnly
@@ -149,7 +404,7 @@
   jamfProtectHasFeature: no
   usualDepartment: IT
   productCategories: [Device management,Vulnerability management]
-  pricingTableCategories: [Device management]
+  pricingTableCategories: [Devices]
   waysToUse:
     - description: Enforce macOS updates via Nudge.
     - description: Progressively enhance from Nudge to DDM-based OS updates.
@@ -171,17 +426,147 @@
       moreInfoUrl: https://github.com/fleetdm/fleet/issues/13281
     - description: Deploy custom declaration (DDM) profiles on macOS.
       moreInfoUrl: https://github.com/fleetdm/fleet/issues/14550
-    - description: Target profiles to specific hosts using SQL. Exclusions coming soon (2024-07-15) #customer-rosner
+    - description: Target profiles to specific hosts using SQL.
       moreInfoUrl: https://github.com/fleetdm/fleet/issues/17315
     - description: Automatically re-deploy configuration profiles when they're not installed.
-    - description: Deploy configuration profiles on iOS/iPadOS. Coming soon (2024-07-15).
+    - description: Deploy configuration profiles on iOS/iPadOS.
     - description: See a list of the upcoming MDM commands and scripts in unified queue. Coming soon (2024-07-15)
       moreInfoUrl: https://github.com/fleetdm/fleet/issues/15920
-    - description: MDM commands for iOS/iPadOS are coming soon (2024-07-15).
     - description: Send MDM commands to tell end users to update their OS.
       moreInfoUrl: https://developer.apple.com/documentation/devicemanagement/schedule_an_os_update
+    - description: Configure agent options remotely, over the air.  (Includes osquery config, and osquery startup flags.).
+      moreInfoUrl: https://fleetdm.com/docs/configuration/agent-configuration
   productCategories: [Device management]
-  pricingTableCategories: [Device management]
+  pricingTableCategories: [Devices]
+#  
+#  ╔╦╗╔═╗╔═╗╦  ╔═╗╦═╗╔═╗╔╦╗╦╦  ╦╔═╗  ╔╦╗╔═╗╦  ╦╦╔═╗╔═╗  ╔╦╗╔═╗╔╗╔╔═╗╔═╗╔═╗╔╦╗╔═╗╔╗╔╔╦╗  
+#   ║║║╣ ║  ║  ╠═╣╠╦╝╠═╣ ║ ║╚╗╔╝║╣    ║║║╣ ╚╗╔╝║║  ║╣   ║║║╠═╣║║║╠═╣║ ╦║╣ ║║║║╣ ║║║ ║   
+#  ═╩╝╚═╝╚═╝╩═╝╩ ╩╩╚═╩ ╩ ╩ ╩ ╚╝ ╚═╝  ═╩╝╚═╝ ╚╝ ╩╚═╝╚═╝  ╩ ╩╩ ╩╝╚╝╩ ╩╚═╝╚═╝╩ ╩╚═╝╝╚╝ ╩            
+- industryName: Declarative Device Management (DDM) support for configuration profiles
+  description: Full support for Apple DDM configuration profiles.
+  documentationUrl: https://fleetdm.com/docs/using-fleet/mdm-os-updates#macos
+  tier: Free
+  jamfProHasFeature: cloudOnly
+  jamfProtectHasFeature: cloudOnly
+  usualDepartment: IT
+  productCategories: [Device management]
+  pricingTableCategories: [Devices]
+#
+#  ╔╦╗╔═╗╦  ╦╦╔═╗╔═╗  ╦ ╦╔═╗╔═╗╦ ╔╦╗╦ ╦
+#   ║║║╣ ╚╗╔╝║║  ║╣   ╠═╣║╣ ╠═╣║  ║ ╠═╣
+#  ═╩╝╚═╝ ╚╝ ╩╚═╝╚═╝  ╩ ╩╚═╝╩ ╩╩═╝╩ ╩ ╩
+- industryName: Device health
+  friendlyName: Automate device health
+  description: Automatically report system health issues using webhooks or integrations, to notify or quarantine outdated or misconfigured systems that are at higher risk of vulnerabilities or theft.
+  documentationUrl: https://fleetdm.com/docs/using-fleet/automations#automations
+  screenshotSrc:
+  tier: Free
+  jamfProHasFeature: no
+  jamfProtectHasFeature: yes
+  productCategories: [Device management,Endpoint operations]
+  pricingTableCategories: [Devices]
+  usualDepartment: IT
+  dri: mikermcneil
+  demos:
+    - description: A large tech company used the Fleet API to block access to corporate apps for outdated operating system versions with certain "celebrity" vulnerabilities.
+      quote: 
+      moreInfoUrl: https://play.goconsensus.com/s4e490bb9
+  buzzwords: [Device trust,Zero trust,Layer 7 device trust,Beyondcorp,Device attestation,Conditional access]
+  waysToUse:
+    - description: Automatically manage the behavior of endpoints that are at higher risk of vulnerabilities or data loss due to their configuration or patch level.
+    - description: Block access to corporate apps for users whose devices with unexpected settings, like disabled screen lock, passwords that are too short, unencrypted hard disks, and more
+    - description: Quickly implement conditional access based on device health using osquery and a simple device health REST API.
+      moreInfoUrl: https://github.com/fleetdm/fleet/issues/14920
+    - description: Control and restore access to applications by automatically restricting access when devices do not meet particular security requirements.
+      moreInfoUrl: https://duo.com/docs/device-health
+    - description: Control which laptop and desktop devices can access corporate apps and websites based on what vulnerabilities it might be exposed to based on how the device is configured, whether it's up to date, its MDM enrollment status, and anything else you can build in a SQL query of Fleet's 300 data tables representing information about enrolled host systems. Coming soon (2024-09-30).
+      moreInfoUrl: https://github.com/fleetdm/fleet/issues/16236
+    - description: Implement multivariate device trust
+      moreInfoUrl: https://youtu.be/5sFOdpMLXQg?feature=shared&t=1445
+    - description: Implement your own version of Google's zero trust model (BeyondCorp)
+      moreInfoUrl: https://cloud.google.com/beyondcorp
+    - description: Get endpoint data into ServiceNow and make your asset management teams happy
+      moreInfoUrl: https://www.youtube.com/watch?v=aVbU6_9JoM0
+    - description: Monitor devices that don't meet your organization's custom security policies
+    - description: Quickly report your posture and vulnerabilities to auditors, showing remediation status and timing.
+    - description: Keep your devices compliant with customizable baselines, or use common benchmarks like CIS.
+    - description: Discover security misconfigurations that increase attack surface.
+    - description: Detect suspcious services listening on open ports that should not be connected to the internet, such as Remote Desktop Protocol (RDP).
+      moreInfoUrl: https://paraflare.com/articles/vulnerability-management-via-osquery/#:~:text=WHERE%20statename%20%3D%20%E2%80%9CEnabled%E2%80%9D-,OPEN%20SOCKETS,-Lastly%2C%20an%20examination
+    - description: Discover potentially unwanted programs that increase attack surface.
+      moreInfoUrl: https://paraflare.com/articles/vulnerability-management-via-osquery/
+    - description: Detect self-signed certifcates
+    - description: Detect legacy protocols with safer versions
+      moreInfoUrl: https://paraflare.com/articles/vulnerability-management-via-osquery/#:~:text=WHERE%20self_signed%20%3D%201%3B-,LEGACY%20PROTOCOLS,-This%20section%20will
+    - description: Detect exposed secrets on the command line
+      moreInfoUrl: https://paraflare.com/articles/vulnerability-management-via-osquery/#:~:text=WDigest%20is%20disabled.-,EXPOSED%20SECRETS,-Often%2C%20to%20create
+    - description: Detect and surface issues with devices
+    - description: Share device health reports
+    - description: Align endpoints with your security policies
+      moreInfoUrl: https://www.axonius.com/use-cases/cmdb-reconciliation
+    - description: Maximize security control coverage
+    - description: Uncover gaps in security policies, configurations, and hygiene
+      moreInfoUrl: https://www.axonius.com/use-cases/coverage-gap-discovery
+    - description: Automatically apply security policies to protect endpoints against attack.
+    - description: Surface security issues in all your deployed endpoints even data centers and factories.
+    - description: Continually validate controls and policies
+    - description: Block access to corporate apps if your end users are failing a specific number of critical policies.
+      moreInfoUrl: https://github.com/fleetdm/fleet/issues/16206       
+#  
+#  ╔═╗╔═╗╔═╗╦  ╦╔═╗╔═╗╔╦╗╦╔═╗╔╗╔  ╔╦╗╔═╗╔═╗╦  ╔═╗╦ ╦╔╦╗╔═╗╔╗╔╔╦╗
+#  ╠═╣╠═╝╠═╝║  ║║  ╠═╣ ║ ║║ ║║║║   ║║║╣ ╠═╝║  ║ ║╚╦╝║║║║╣ ║║║ ║ 
+#  ╩ ╩╩  ╩  ╩═╝╩╚═╝╩ ╩ ╩ ╩╚═╝╝╚╝  ═╩╝╚═╝╩  ╩═╝╚═╝ ╩ ╩ ╩╚═╝╝╚╝ ╩ 
+- industryName: Application deployment
+  description: Deploy applications and security agents on macOS, iOS/iPadOS, Linux, Windows, and Android (coming soon) devices. Additionally, install macOS and iOS/iPadOS apps from the App Store (coming soon).
+  tier: Premium
+  jamfProHasFeature: appleOnly
+  jamfProtectHasFeature: no
+  isExperimental: yes
+  usualDepartment: IT
+  productCategories: [Device management]
+  pricingTableCategories: [Devices]
+  moreInfoUrl: https://github.com/fleetdm/fleet/issues/18867
+  waysToUse:
+   - description: Easily configure and install SentinelOne, Crowdstrike, and other security tools.
+     moreInfoUrl: https://github.com/fleetdm/fleet/issues/14921 
+   - description: Offer licenses for Photoshop and other App Sore apps for your end users.
+   - description: iOS/iPadOS coming soon (2024-08-11).
+     moreInfoUrl: https://github.com/fleetdm/fleet/issues/14899
+#  
+#  ╔═╗╔═╗╦  ╔═╗  ╔═╗╔═╗╦═╗╦  ╦╦╔═╗╔═╗  ╔═╗╔═╗╔═╗╦  ╦╔═╗╔═╗╔╦╗╦╔═╗╔╗╔  ╦╔╗╔╔═╗╔╦╗╔═╗╦  ╦  ╔═╗╔╦╗╦╔═╗╔╗╔                                   
+#  ╚═╗║╣ ║  ╠╣───╚═╗║╣ ╠╦╝╚╗╔╝║║  ║╣   ╠═╣╠═╝╠═╝║  ║║  ╠═╣ ║ ║║ ║║║║  ║║║║╚═╗ ║ ╠═╣║  ║  ╠═╣ ║ ║║ ║║║║                                   
+#  ╚═╝╚═╝╩═╝╚    ╚═╝╚═╝╩╚═ ╚╝ ╩╚═╝╚═╝  ╩ ╩╩  ╩  ╩═╝╩╚═╝╩ ╩ ╩ ╩╚═╝╝╚╝  ╩╝╚╝╚═╝ ╩ ╩ ╩╩═╝╩═╝╩ ╩ ╩ ╩╚═╝╝╚╝                                   
+- industryName: Self-service application installation
+  description: Allow end users to install apps through Fleet Desktop for macOS, Linux, and Windows.
+  tier: Premium
+  jamfProHasFeature: yes
+  jamfProtectHasFeature: no
+  isExperimental: yes
+  usualDepartment: IT
+  productCategories: [Device management]
+  pricingTableCategories: [Devices]
+  moreInfoUrl: https://github.com/fleetdm/fleet/issues/17587
+  waysToUse:
+   - description: Build scripts for Ansible deployments
+     moreInfoUrl: https://www.youtube.com/watch?v=qflUfLQCnwY&list=PL6-FgoWOoK2YUR4ADGsxTSL3onb-GzCnM&index=4
+   - description: Deploy osquery to macOS via Jamf
+     moreInfoUrl: https://www.youtube.com/watch?v=qflUfLQCnwY&list=PL6-FgoWOoK2YUR4ADGsxTSL3onb-GzCnM&index=4
+   - description: Package osquery for Linux servers via Workspace One and Windows servers via group policies
+     moreInfoUrl: https://www.youtube.com/watch?v=qflUfLQCnwY&list=PL6-FgoWOoK2YUR4ADGsxTSL3onb-GzCnM&index=4
+#  
+#  ╔═╗╔═╗╔═╗╦  ╦╔═╗╔═╗╔╦╗╦╔═╗╔╗╔  ╔╦╗╔═╗╔╗╔╔═╗╔═╗╔═╗╔╦╗╔═╗╔╗╔╔╦╗
+#  ╠═╣╠═╝╠═╝║  ║║  ╠═╣ ║ ║║ ║║║║  ║║║╠═╣║║║╠═╣║ ╦║╣ ║║║║╣ ║║║ ║ 
+#  ╩ ╩╩  ╩  ╩═╝╩╚═╝╩ ╩ ╩ ╩╚═╝╝╚╝  ╩ ╩╩ ╩╝╚╝╩ ╩╚═╝╚═╝╩ ╩╚═╝╝╚╝ ╩ 
+- industryName: Application management
+  description: Manage updates and patches for apps on macOS, Windows, and Linux computers.
+  tier: Premium
+  jamfProHasFeature: appleOnly
+  jamfProtectHasFeature: no
+  comingSoonOn: 2024-08-25
+  usualDepartment: IT
+  productCategories: [Device management]
+  pricingTableCategories: [Devices]
+  moreInfoUrl: https://github.com/fleetdm/fleet/issues/18865
 #
 #  ╔═╗╔═╗╦═╗╦╔═╗╔╦╗  ╔═╗═╗ ╦╔═╗╔═╗╦ ╦╔╦╗╦╔═╗╔╗╔
 #  ╚═╗║  ╠╦╝║╠═╝ ║   ║╣ ╔╩╦╝║╣ ║  ║ ║ ║ ║║ ║║║║
@@ -196,7 +581,7 @@
   dri: mikermcneil
   usualDepartment: IT
   productCategories: [Endpoint operations,Device management]
-  pricingTableCategories: [Device management]
+  pricingTableCategories: [Devices]
   demos:
     - description: A large tech company used scripts to fix issues with their security and compliance agents on workstations.
   buzzwords: [Remote script execution,PowerShell scripts,Bash scripts]
@@ -216,57 +601,7 @@
     - description: Run scripts on online/offline hosts
       moreInfoUrl: https://github.com/fleetdm/fleet/issues/15529
     - description: Only maintainers and admins can run scripts.
-      moreInfoUrl: https://github.com/fleetdm/fleet/issues/19055
-#  
-#  ╔═╗╔═╗╔═╗╦  ╦╔═╗╔═╗╔╦╗╦╔═╗╔╗╔  ╔╦╗╔═╗╔═╗╦  ╔═╗╦ ╦╔╦╗╔═╗╔╗╔╔╦╗
-#  ╠═╣╠═╝╠═╝║  ║║  ╠═╣ ║ ║║ ║║║║   ║║║╣ ╠═╝║  ║ ║╚╦╝║║║║╣ ║║║ ║ 
-#  ╩ ╩╩  ╩  ╩═╝╩╚═╝╩ ╩ ╩ ╩╚═╝╝╚╝  ═╩╝╚═╝╩  ╩═╝╚═╝ ╩ ╩ ╩╚═╝╝╚╝ ╩ 
-- industryName: Application deployment
-  description: Deploy applications and security agents on macOS, iOS/iPadOS, Linux, Windows, and Android (coming soon) devices. Additionally, install macOS and iOS/iPadOS apps from the App Store (coming soon).
-  tier: Premium
-  jamfProHasFeature: appleOnly
-  jamfProtectHasFeature: no
-  isExperimental: yes
-  usualDepartment: IT
-  productCategories: [Device management]
-  pricingTableCategories: [Device management]
-  moreInfoUrl: https://github.com/fleetdm/fleet/issues/18867
-  waysToUse:
-   - description: Easily configure and install SentinelOne, Crowdstrike, and other security tools.
-     moreInfoUrl: https://github.com/fleetdm/fleet/issues/14921 
-   - description: Offer licenses for Photoshop and other App Sore apps for your end users.
-   - description: macOS coming soon (2024-07-15). #customer-rosner
-     moreInfoUrl: https://github.com/fleetdm/fleet/issues/18867
-   - description: iOS/iPadOS coming soon (2024-08-11).
-     moreInfoUrl: https://github.com/fleetdm/fleet/issues/14899
-#  
-#  ╔═╗╔═╗╦  ╔═╗  ╔═╗╔═╗╦═╗╦  ╦╦╔═╗╔═╗  ╔═╗╔═╗╔═╗╦  ╦╔═╗╔═╗╔╦╗╦╔═╗╔╗╔  ╦╔╗╔╔═╗╔╦╗╔═╗╦  ╦  ╔═╗╔╦╗╦╔═╗╔╗╔                                   
-#  ╚═╗║╣ ║  ╠╣   ╚═╗║╣ ╠╦╝╚╗╔╝║║  ║╣   ╠═╣╠═╝╠═╝║  ║║  ╠═╣ ║ ║║ ║║║║  ║║║║╚═╗ ║ ╠═╣║  ║  ╠═╣ ║ ║║ ║║║║                                   
-#  ╚═╝╚═╝╩═╝╚    ╚═╝╚═╝╩╚═ ╚╝ ╩╚═╝╚═╝  ╩ ╩╩  ╩  ╩═╝╩╚═╝╩ ╩ ╩ ╩╚═╝╝╚╝  ╩╝╚╝╚═╝ ╩ ╩ ╩╩═╝╩═╝╩ ╩ ╩ ╩╚═╝╝╚╝                                   
-- industryName: Self service application installation
-  description: Allow end users to install apps through Fleet Desktop for macOS, Linux, and Windows.
-  tier: Premium
-  jamfProHasFeature: yes
-  jamfProtectHasFeature: no
-  isExperimental: yes
-  usualDepartment: IT
-  productCategories: [Device management]
-  pricingTableCategories: [Device management]
-  moreInfoUrl: https://github.com/fleetdm/fleet/issues/17587
-#  
-#  ╔═╗╔═╗╔═╗╦  ╦╔═╗╔═╗╔╦╗╦╔═╗╔╗╔  ╔╦╗╔═╗╔╗╔╔═╗╔═╗╔═╗╔╦╗╔═╗╔╗╔╔╦╗
-#  ╠═╣╠═╝╠═╝║  ║║  ╠═╣ ║ ║║ ║║║║  ║║║╠═╣║║║╠═╣║ ╦║╣ ║║║║╣ ║║║ ║ 
-#  ╩ ╩╩  ╩  ╩═╝╩╚═╝╩ ╩ ╩ ╩╚═╝╝╚╝  ╩ ╩╩ ╩╝╚╝╩ ╩╚═╝╚═╝╩ ╩╚═╝╝╚╝ ╩ 
-- industryName: Application management
-  description: Manage updates and patches for apps on macOS, Windows, and Linux computers.
-  tier: Premium
-  jamfProHasFeature: appleOnly
-  jamfProtectHasFeature: no
-  comingSoonOn: 2024-08-25
-  usualDepartment: IT
-  productCategories: [Device management]
-  pricingTableCategories: [Device management]
-  moreInfoUrl: https://github.com/fleetdm/fleet/issues/18865
+      moreInfoUrl: https://github.com/fleetdm/fleet/issues/19055  
 #  
 #  ╔╦╗╔═╗╦  ╦╦╔═╗╔═╗  ╦═╗╔═╗╔╦╗╔═╗╔╦╗╦╔═╗╔╦╗╦╔═╗╔╗╔
 #   ║║║╣ ╚╗╔╝║║  ║╣   ╠╦╝║╣ ║║║║╣  ║║║╠═╣ ║ ║║ ║║║║
@@ -279,9 +614,23 @@
   jamfProtectHasFeature: no
   usualDepartment: IT
   productCategories: [Device management, Vulnerability management]
-  pricingTableCategories: [Device management]
+  pricingTableCategories: [Devices]
   waysToUse:
     - description: Send software vulnerability emails to end users to encourage self-remediation.
+#
+#  ╔╦╗╔═╗╦╔╗╔╔╦╗╔═╗╔╗╔╔═╗╔╗╔╔═╗╔═╗  ╦ ╦╦╔╗╔╔╦╗╔═╗╦ ╦╔═╗
+#  ║║║╠═╣║║║║ ║ ║╣ ║║║╠═╣║║║║  ║╣   ║║║║║║║ ║║║ ║║║║╚═╗
+#  ╩ ╩╩ ╩╩╝╚╝ ╩ ╚═╝╝╚╝╩ ╩╝╚╝╚═╝╚═╝  ╚╩╝╩╝╚╝═╩╝╚═╝╚╩╝╚═╝
+- industryName: Maintenance windows
+  friendlyName: Fleet in your calendar
+  description: Create a calendar event to auto-remediate failing policies when your end users are free.
+  documentationUrl: https://github.com/fleetdm/fleet/issues/17230
+  tier: Premium
+  jamfProHasFeature: no
+  jamfProtectHasFeature: no
+  isExperimental: yes
+  productCategories: [Device management, Endpoint operations]
+  pricingTableCategories: [Devices]
 #  
 #  ╔═╗╔═╗╔╗╔╔╦╗  ╦  ╔═╗╔═╗╦╔═  ╔═╗╔╗╔╔╦╗  ╦ ╦╦╔═╗╔═╗  ╔═╗╔═╗╔╦╗╔╦╗╔═╗╔╗╔╔╦╗╔═╗
 #  ╚═╗║╣ ║║║ ║║  ║  ║ ║║  ╠╩╗  ╠═╣║║║ ║║  ║║║║╠═╝║╣   ║  ║ ║║║║║║║╠═╣║║║ ║║╚═╗
@@ -299,36 +648,256 @@
   jamfProtectHasFeature: no
   usualDepartment: IT
   productCategories: [Device management]
-  pricingTableCategories: [Device management]
+  pricingTableCategories: [Devices]
 #  
-#  ╔═╗╔═╗╔═╗╦  ╔═╗  ╔╦╗╔═╗╔═╗╦  ╔═╗╦═╗╔═╗╔╦╗╦╦  ╦╔═╗  ╔╦╗╔═╗╦  ╦╦╔═╗╔═╗  ╔╦╗╔═╗╔╗╔╔═╗╔═╗╔═╗╔╦╗╔═╗╔╗╔╔╦╗  
-#  ╠═╣╠═╝╠═╝║  ║╣    ║║║╣ ║  ║  ╠═╣╠╦╝╠═╣ ║ ║╚╗╔╝║╣    ║║║╣ ╚╗╔╝║║  ║╣   ║║║╠═╣║║║╠═╣║ ╦║╣ ║║║║╣ ║║║ ║   
-#  ╩ ╩╩  ╩  ╩═╝╚═╝  ═╩╝╚═╝╚═╝╩═╝╩ ╩╩╚═╩ ╩ ╩ ╩ ╚╝ ╚═╝  ═╩╝╚═╝ ╚╝ ╩╚═╝╚═╝  ╩ ╩╩ ╩╝╚╝╩ ╩╚═╝╚═╝╩ ╩╚═╝╝╚╝ ╩   
-#  ╔═╗╦ ╦╔═╗╔═╗╔═╗╦═╗╔╦╗  ╔═╗╔═╗╦═╗  ╔═╗╔═╗╔╗╔╔═╗╦╔═╗╦ ╦╦═╗╔═╗╔╦╗╦╔═╗╔╗╔  ╔═╗╦═╗╔═╗╔═╗╦╦  ╔═╗╔═╗         
-#  ╚═╗║ ║╠═╝╠═╝║ ║╠╦╝ ║   ╠╣ ║ ║╠╦╝  ║  ║ ║║║║╠╣ ║║ ╦║ ║╠╦╝╠═╣ ║ ║║ ║║║║  ╠═╝╠╦╝║ ║╠╣ ║║  ║╣ ╚═╗         
-#  ╚═╝╚═╝╩  ╩  ╚═╝╩╚═ ╩   ╚  ╚═╝╩╚═  ╚═╝╚═╝╝╚╝╚  ╩╚═╝╚═╝╩╚═╩ ╩ ╩ ╩╚═╝╝╚╝  ╩  ╩╚═╚═╝╚  ╩╩═╝╚═╝╚═╝         
-- industryName: Apple Declarative Device Management (DDM) support for configuration profiles
-  description: Use the latest device management protocol on your Apple devices.
-  documentationUrl: https://fleetdm.com/docs/using-fleet/mdm-os-updates#macos
-  tier: Premium
-  jamfProHasFeature: cloudOnly
-  jamfProtectHasFeature: cloudOnly
+#
+#  ███████╗███╗   ██╗██████╗ ██████╗  ██████╗ ██╗███╗   ██╗████████╗               
+#  ██╔════╝████╗  ██║██╔══██╗██╔══██╗██╔═══██╗██║████╗  ██║╚══██╔══╝               
+#  █████╗  ██╔██╗ ██║██║  ██║██████╔╝██║   ██║██║██╔██╗ ██║   ██║                  
+#  ██╔══╝  ██║╚██╗██║██║  ██║██╔═══╝ ██║   ██║██║██║╚██╗██║   ██║                  
+#  ███████╗██║ ╚████║██████╔╝██║     ╚██████╔╝██║██║ ╚████║   ██║                  
+#  ╚══════╝╚═╝  ╚═══╝╚═════╝ ╚═╝      ╚═════╝ ╚═╝╚═╝  ╚═══╝   ╚═╝                  
+#                                                                                  
+#   ██████╗ ██████╗ ███████╗██████╗  █████╗ ████████╗██╗ ██████╗ ███╗   ██╗███████╗
+#  ██╔═══██╗██╔══██╗██╔════╝██╔══██╗██╔══██╗╚══██╔══╝██║██╔═══██╗████╗  ██║██╔════╝
+#  ██║   ██║██████╔╝█████╗  ██████╔╝███████║   ██║   ██║██║   ██║██╔██╗ ██║███████╗
+#  ██║   ██║██╔═══╝ ██╔══╝  ██╔══██╗██╔══██║   ██║   ██║██║   ██║██║╚██╗██║╚════██║
+#  ╚██████╔╝██║     ███████╗██║  ██║██║  ██║   ██║   ██║╚██████╔╝██║ ╚████║███████║
+#   ╚═════╝ ╚═╝     ╚══════╝╚═╝  ╚═╝╚═╝  ╚═╝   ╚═╝   ╚═╝ ╚═════╝ ╚═╝  ╚═══╝╚══════╝
+#                                                                                  
+#
+#      
+#  ╔═╗ ╦ ╦╔═╗╦═╗╦╔═╗╔═╗ 
+#  ║═╬╗║ ║║╣ ╠╦╝║║╣ ╚═╗ 
+#  ╚═╝╚╚═╝╚═╝╩╚═╩╚═╝╚═╝                                                                                                                                                                                                          
+- industryName: Queries
+  description: Scheduled or saved queries with optional AI-generated descriptions, and, live queries for real-time data collection.  
+  documentationUrl: https://fleetdm.com/docs/using-fleet/fleet-ui
+  tier: Free
+  jamfProHasFeature: no
+  jamfProtectHasFeature: no
+  productCategories: [Endpoint operations,Device management,Vulnerability management]
+  pricingTableCategories: [Devices]
   usualDepartment: IT
-  productCategories: [Device management]
-  pricingTableCategories: [Device management]
+  demos:
+    - description: A top financial services company needed to set up rolling deployments for changes to osquery agents running on their production servers.
+      moreInfoUrl: https://docs.google.com/document/d/1UdzZMyBLbs9SUXfSXN2x2wZQCbjZZUetYlNWH6-ryqQ/edit#heading=h.2lh6ehprpvl6
+#
+#  ╔═╗ ╦ ╦╔═╗╦═╗╦ ╦  ╔═╗╔═╗╦═╗╔═╗╔═╗╦═╗╔╦╗╔═╗╔╗╔╔═╗╔═╗  ╔╦╗╔═╗╔╗╔╦╔╦╗╔═╗╦═╗╦╔╗╔╔═╗
+#  ║═╬╗║ ║║╣ ╠╦╝╚╦╝  ╠═╝║╣ ╠╦╝╠╣ ║ ║╠╦╝║║║╠═╣║║║║  ║╣   ║║║║ ║║║║║ ║ ║ ║╠╦╝║║║║║ ╦
+#  ╚═╝╚╚═╝╚═╝╩╚═ ╩   ╩  ╚═╝╩╚═╚  ╚═╝╩╚═╩ ╩╩ ╩╝╚╝╚═╝╚═╝  ╩ ╩╚═╝╝╚╝╩ ╩ ╚═╝╩╚═╩╝╚╝╚═╝
+- industryName: Query performance monitoring
+  documentationUrl: https://fleetdm.com/docs/get-started/faq#will-fleet-slow-down-my-servers-what-about-my-employee-laptops
+  tier: Free
+  jamfProHasFeature: no
+  jamfProtectHasFeature: no
+  productCategories: [Endpoint operations]
+  pricingTableCategories: [Devices]
+  demos:
+    - description: A top software company needed to understand the performance impact of osquery queries before running them on all of their production Linux servers.
+      moreInfoUrl: https://docs.google.com/document/d/1WzMc8GJCRU6tTBb6gLsSTzFysqtXO8CtP2sXMPKgYSk/edit?disco=AAAA6xuVxGg
+    - description: A top software company wanted to detect regressions when adding/changing queries and fail builds if queries were too expensive.
+      moreInfoUrl: https://docs.google.com/document/d/1WzMc8GJCRU6tTBb6gLsSTzFysqtXO8CtP2sXMPKgYSk/edit?disco=AAAA6xuVxGg
+  waysToUse:
+    - description: Monitor performance for automated queries.
+    - description: Monitor performance for live queries.
+      moreInfoUrl: https://github.com/fleetdm/fleet/issues/467
 #  
-#  ╔╦╗╔═╗╦═╗╔═╗╔═╗╔╦╗╔═╗╔╦╗  ╔╦╗╔═╗╦  ╦╦╔═╗╔═╗  ╔═╗╔═╗╔═╗╔═╗╦╔╗╔╔═╗
-#   ║ ╠═╣╠╦╝║ ╦║╣  ║ ║╣  ║║   ║║║╣ ╚╗╔╝║║  ║╣   ╚═╗║  ║ ║╠═╝║║║║║ ╦
-#   ╩ ╩ ╩╩╚═╚═╝╚═╝ ╩ ╚═╝═╩╝  ═╩╝╚═╝ ╚╝ ╩╚═╝╚═╝  ╚═╝╚═╝╚═╝╩  ╩╝╚╝╚═╝
-- industryName: Targeted device scoping
-  description: Organize devices with Teams and Labels.
-  documentationUrl: https://fleetdm.com/guides/managing-labels-in-fleet
+#  ╔═╗╦ ╦╔═╗╔╦╗╔═╗╔╦╗  ╔╦╗╔═╗╔╗ ╦  ╔═╗╔═╗
+#  ║  ║ ║╚═╗ ║ ║ ║║║║   ║ ╠═╣╠╩╗║  ║╣ ╚═╗
+#  ╚═╝╚═╝╚═╝ ╩ ╚═╝╩ ╩   ╩ ╩ ╩╚═╝╩═╝╚═╝╚═╝
+- industryName: Custom tables
+  friendlyName: Add tables to osquery with extensions
+  description: Create your own osquery tables, extensions & automatic table configurations or disable existing tables to maintain PII or privacy.
+  documentationUrl: https://fleetdm.com/docs/configuration/agent-configuration#extensions
+  moreInfoUrl: https://github.com/trailofbits/osquery-extensions/blob/3df2b72ad78549e25344c79dbc9bce6808c4d92a/README.md#extensions
+  tier: Premium
+  jamfProHasFeature: no
+  jamfProtectHasFeature: no
+  productCategories: [Endpoint operations]
+  pricingTableCategories: [Devices]
+  usualDepartment: IT
+# 
+#  ╦═╗╔═╗╔╦╗╔═╗╔╦╗╔═╗  ╔═╗╔═╗╔╦╗╔╦╗╦╔╗╔╔═╗╔═╗
+#  ╠╦╝║╣ ║║║║ ║ ║ ║╣   ╚═╗║╣  ║  ║ ║║║║║ ╦╚═╗
+#  ╩╚═╚═╝╩ ╩╚═╝ ╩ ╚═╝  ╚═╝╚═╝ ╩  ╩ ╩╝╚╝╚═╝╚═╝
+- industryName: Remote settings
+  description: Configure agent options remotely, over the air.  (Includes osquery config, and osquery startup flags.).
+  documentationUrl: https://fleetdm.com/docs/configuration/agent-configuration
+  moreInfoUrl: https://github.com/fleetdm/fleet/issues/13825
+  tier: Free
+  jamfProHasFeature: no
+  jamfProtectHasFeature: no
+  productCategories: [Endpoint operations]
+  pricingTableCategories: [Devices]
+  usualDepartment: Security
+#      
+#  ╔╦╗╔═╗╔═╗╔╦╗╔═╗
+#   ║ ║╣ ╠═╣║║║╚═╗
+#   ╩ ╚═╝╩ ╩╩ ╩╚═╝
+- industryName: Teams
+  friendlyName: Manage different endpoints differently
+  documentationUrl: https://fleetdm.com/docs/using-fleet/segment-hosts
+  description: Teams are what Fleet calls baselines, kinda like security groups or images. Every host in a team matches the same baseline, with minor exceptions. This makes it faster and less risky to maintain computers, leading to faster timelines and fewer tickets. #Enroll hosts into device groups ("teams") using different enrollment secrets and/or installers. Set baselines and strategies for hosts in different situations, and move hosts between them via API-driven automations or a simple, delegatable user interface with role-based access.
   tier: Premium
   jamfProHasFeature: yes
   jamfProtectHasFeature: yes
+  productCategories: [Endpoint operations,Device management,Vulnerability management]
+  pricingTableCategories: [Devices]
+  waysToUse:
+    - description: Automate remediation for different applications with different security postures (cloud security engineering)
+#     
+#  ╦  ╔═╗╔╗ ╔═╗╦  ╔═╗
+#  ║  ╠═╣╠╩╗║╣ ║  ╚═╗
+#  ╩═╝╩ ╩╚═╝╚═╝╩═╝╚═╝
+- industryName: Labels
+  documentationUrl: https://fleetdm.com/docs/rest-api/rest-api#add-label
+  friendlyName: Filter hosts using SQL
+  productCategories: [Endpoint operations,Device management,Vulnerability management]
+  pricingTableCategories: [Devices]
   usualDepartment: IT
-  productCategories: [Device management]
-  pricingTableCategories: [Device management] 
+  tier: Free
+  jamfProHasFeature: no
+  jamfProtectHasFeature: no
+#  
+#  ╔═╗╔═╗╦  ╦╔═╗╦╔═╗╔═╗ 
+#  ╠═╝║ ║║  ║║  ║║╣ ╚═╗ 
+#  ╩  ╚═╝╩═╝╩╚═╝╩╚═╝╚═╝                                                                                                                                                                                                          
+- industryName: Policies
+  description: A policy is a specific “yes” or “no” query. Use policies to manage security compliance in your organization.  
+  documentationUrl: https://fleetdm.com/docs/using-fleet/fleet-ui
+  tier: Free
+  jamfProHasFeature: yes
+  jamfProtectHasFeature: no
+  productCategories: [Endpoint operations,Device management,Vulnerability management]
+  pricingTableCategories: [Devices]
+  usualDepartment: IT
+  demos:
+    - description: A top financial services company needed to set up rolling deployments for changes to osquery agents running on their production servers.
+      moreInfoUrl: https://docs.google.com/document/d/1UdzZMyBLbs9SUXfSXN2x2wZQCbjZZUetYlNWH6-ryqQ/edit#heading=h.2lh6ehprpvl6
+  waysToUse:
+    - description: Trigger a workflow based on a failing policy
+      moreInfoUrl: https://fleetdm.com/docs/using-fleet/automations#policy-automations
+#
+#  ╔═╗╦╦  ╔═╗  ╦╔╗╔╔╦╗╔═╗╔═╗╦═╗╦╔╦╗╦ ╦  ╔╦╗╔═╗╔╗╔╦╔╦╗╔═╗╦═╗╦╔╗╔╔═╗
+#  ╠╣ ║║  ║╣   ║║║║ ║ ║╣ ║ ╦╠╦╝║ ║ ╚╦╝  ║║║║ ║║║║║ ║ ║ ║╠╦╝║║║║║ ╦
+#  ╚  ╩╩═╝╚═╝  ╩╝╚╝ ╩ ╚═╝╚═╝╩╚═╩ ╩  ╩   ╩ ╩╚═╝╝╚╝╩ ╩ ╚═╝╩╚═╩╝╚╝╚═╝
+- industryName: File integrity monitoring (FIM) # Short industry phrase
+  friendlyName: Detect changes to critical files # Short, Fleet one-liner for the feature, written in the imperative mood.  (If easy to do, base this off of the words that an actual customer is saying.)
+  description: Specify files to monitor for changes or deletions, then log those events to your SIEM or data lake, including key information such as filepath and checksum. # Clear Mr. Rogers description
+  documentationUrl: https://fleetdm.com/guides/osquery-evented-tables-overview#file-integrity-monitoring-fim # URL of the single-best page within the docs which serves as a "jumping-off point" for this feature.
+  screenshotSrc: "" # A screenshot of the single, best, simplifying, obvious example 
+  tier: Free # Either "Free" or "Premium"
+  jamfProHasFeature: no
+  jamfProtectHasFeature: yes
+  usualDepartment: Security # or omit if there isn't a particular departmental leaning we've noticed
+  productCategories: [Endpoint operations] # or omit if this isn't associated with a single product category
+  pricingTableCategories: [Devices]
+  dri: mikermcneil #GitHub user name
+  demos:
+    - description: A top gaming company needed a way to monitor critical files on production Debian servers.
+      quote: The FIM features are kind of a top priority.
+      moreInfoUrl: https://docs.google.com/document/d/1pE9U-1E4YDiy6h4TorszrTOiFAauFiORikSUFUqW7Pk/edit
+  buzzwords: [File integrity monitoring (FIM),Host-based intrusion detection system (HIDS),Anomaly detection]
+  waysToUse:
+    - description: Monitor critical files on production Debian servers
+    - description: Detect anomalous filesystem activity
+      moreInfoUrl: https://www.beyondtrust.com/resources/glossary/file-integrity-monitoring
+    - description: Detect unintended changes
+      moreInfoUrl: https://www.beyondtrust.com/resources/glossary/file-integrity-monitoring
+    - description: Verify update status and monitor system health
+      moreInfoUrl: https://www.beyondtrust.com/resources/glossary/file-integrity-monitoring
+    - description: Meet compliance mandates
+      moreInfoUrl: https://www.beyondtrust.com/resources/glossary/file-integrity-monitoring
+#  
+#  ╔═╗╦╦  ╔═╗  ╔═╗╔═╗╦═╗╦  ╦╦╔╗╔╔═╗
+#  ╠╣ ║║  ║╣   ║  ╠═╣╠╦╝╚╗╔╝║║║║║ ╦
+#  ╚  ╩╩═╝╚═╝  ╚═╝╩ ╩╩╚═ ╚╝ ╩╝╚╝╚═╝
+- industryName: File carving
+  description: Write the results of complex queries to AWS S3.
+  documentationUrl: https://fleetdm.com/docs/configuration/fleet-server-configuration#s-3-file-carving-backend
+  tier: Free
+  jamfProHasFeature: no
+  jamfProtectHasFeature: no
+  usualDepartment: Security
+  productCategories: [Endpoint operations]
+  pricingTableCategories: [Devices]           
+#
+#  ╔╗ ╦╔╗╔╔═╗╦═╗╦ ╦  ╔═╗╦ ╦╔╦╗╦ ╦╔═╗╦═╗╦╔═╗╔═╗╔╦╗╦╔═╗╔╗╔
+#  ╠╩╗║║║║╠═╣╠╦╝╚╦╝  ╠═╣║ ║ ║ ╠═╣║ ║╠╦╝║╔═╝╠═╣ ║ ║║ ║║║║
+#  ╚═╝╩╝╚╝╩ ╩╩╚═ ╩   ╩ ╩╚═╝ ╩ ╩ ╩╚═╝╩╚═╩╚═╝╩ ╩ ╩ ╩╚═╝╝╚╝
+- industryName: Binary authorization
+  friendlyName: Restrict what programs can run, and what files running programs can access.
+  description: 
+  documentationUrl: 
+  tier: Free
+  jamfProHasFeature: yes
+  jamfProtectHasFeature: yes
+  dri: mikermcneil
+  usualDepartment: Security
+  productCategories: [Endpoint operations]
+  pricingTableCategories: [Devices]
+  comingSoonOn: 2025-06-30
+  buzzwords: [Mandatory Access Control (MAC),Privilege confinement,Binary authorization,Santa,Binary allowlisting,Binary whitelisting]
+  demos:
+    - description: 
+      moreInfoUrl: 
+  waysToUse:
+    - description: Confine programs to a limited set of resources.
+    - description: Report on AppArmor events
+      moreInfoUrl: https://fleetdm.com/tables/apparmor_events
+    - description: Confine programs according to a set of rules that specify which files a program can access.
+      moreInfoUrl: https://wiki.debian.org/AppArmor
+    - description: Proactively protect the system against both known and unknown vulnerabilities.
+#  
+#  ╦═╗╔═╗╔═╗╔═╗╦═╗╔╦╗╦╔╗╔╔═╗  
+#  ╠╦╝║╣ ╠═╝║ ║╠╦╝ ║ ║║║║║ ╦   
+#  ╩╚═╚═╝╩  ╚═╝╩╚═ ╩ ╩╝╚╝╚═╝                                                                                                                                                                                                               
+- industryName: Reporting
+  description: Generate reports based on searchable device attributes
+  documentationUrl: https://fleetdm.com/docs/rest-api/rest-api#get-query-report
+  productCategories: [Endpoint operations,Device management,Vulnerability management]
+  pricingTableCategories: [Devices]
+  usualDepartment: IT
+  tier: Premium
+  jamfProHasFeature: yes
+  jamfProtectHasFeature: yes
+#
+#  ╦╔╗╔╔═╗╦╔╦╗╔═╗╔╗╔╔╦╗  ╦═╗╔═╗╔═╗╔═╗╔═╗╔╗╔╔═╗╔═╗
+#  ║║║║║  ║ ║║║╣ ║║║ ║   ╠╦╝║╣ ╚═╗╠═╝║ ║║║║╚═╗║╣ 
+#  ╩╝╚╝╚═╝╩═╩╝╚═╝╝╚╝ ╩   ╩╚═╚═╝╚═╝╩  ╚═╝╝╚╝╚═╝╚═╝
+- industryName: Incident response
+  friendlyName: Interrogate hosts in real time
+  description: Live query, triage, figuring out scope of impact, remediate using scripts or MDM commands (e.g. remote wipe), and quarantine or reimage using other systems and APIs (e.g. remove from network, decommission container)
+  documentationUrl: https://fleetdm.com/securing/how-osquery-can-help-cyber-responders#simplifying-endpoint-visibility-with-osquery-and-fleet
+  tier: Free
+  jamfProHasFeature: yes
+  jamfProtectHasFeature: yes
+  dri: mikermcneil
+  usualDepartment: Security
+  productCategories: [Endpoint operations]
+  pricingTableCategories: [Devices]
+  buzzwords: []
+  demos:
+    - description: 
+      moreInfoUrl: 
+  waysToUse:
+    - description: 
+#      
+#  ╔═╗╦ ╦╔═╗╔╦╗╔═╗╔╦╗ ╦  ╔═╗╔═╗╔═╗╦╔╗╔╔═╗
+#  ║  ║ ║╚═╗ ║ ║ ║║║║ ║  ║ ║║ ╦║ ╦║║║║║ ╦
+#  ╚═╝╚═╝╚═╝ ╩ ╚═╝╩ ╩ ╩═╝╚═╝╚═╝╚═╝╩╝╚╝╚═╝
+- industryName: Custom logging
+  description: Flexible, configurable logging destinations (AWS Kinesis, Lambda, GCP, Kafka).
+  documentationUrl: https://fleetdm.com/docs/using-fleet/log-destinations#log-destinations
+  tier: Free
+  jamfProHasFeature: yes
+  jamfProtectHasFeature: yes
+  usualDepartment: Security
+  productCategories: [Endpoint operations]
+  pricingTableCategories: [Devices]
+  buzzwords: [Real-time export,Ship logs]
+#
 #
 #  ██╗   ██╗██╗   ██╗██╗     ███╗   ██╗███████╗██████╗  █████╗ ██████╗ ██╗██╗     ██╗████████╗██╗   ██╗    
 #  ██║   ██║██║   ██║██║     ████╗  ██║██╔════╝██╔══██╗██╔══██╗██╔══██╗██║██║     ██║╚══██╔══╝╚██╗ ██╔╝    
@@ -358,7 +927,7 @@
   dri: mikermcneil
   usualDepartment: Security
   productCategories: [Endpoint operations,Vulnerability management]
-  pricingTableCategories: [Vulnerability management]
+  pricingTableCategories: [Devices]
   buzzwords: [YARA scanning,Cyber Threat Intelligence (CTI),Indicators of compromise (IOCs),Antivirus (AV),Endpoint protection platform (EPP),Endpoint detection and response (EDR),Malware detection,Signature-based malware detection,Malware scanning,Malware analysis,Anomaly detection]
   demos:
     - description: A top media company used Fleet policies with YARA rules to continuously scan host filesystems for malware signatures provided by internal and external threat intelligence teams.
@@ -388,7 +957,7 @@
   friendlyName: Detect vulnerable software
   documentationUrl: https://fleetdm.com/vulnerability-management
   productCategories: [Vulnerability management]
-  pricingTableCategories: [Vulnerability management]
+  pricingTableCategories: [Devices]
   usualDepartment: Security
   tier: Free
   jamfProHasFeature: no
@@ -408,36 +977,18 @@
     - description: One of the world's largest, top transportation companies uses Fleet's API to email relevant, actually-installed vulnerabilities to responsible teams so they can fix them.
       moreInfoUrl: https://docs.google.com/document/d/1oeCmT077o_5nxzLhnxs7kcg_4Qn1Pn1F5zx10nQOAp8/edit
 #
-#  ╦  ╦╦ ╦╦  ╔╗╔╔═╗╦═╗╔═╗╔╗ ╦╦  ╦╔╦╗╦ ╦  ╔╦╗╔═╗╔═╗╦ ╦╔╗ ╔═╗╔═╗╦═╗╔╦╗
-#  ╚╗╔╝║ ║║  ║║║║╣ ╠╦╝╠═╣╠╩╗║║  ║ ║ ╚╦╝   ║║╠═╣╚═╗╠═╣╠╩╗║ ║╠═╣╠╦╝ ║║
-#   ╚╝ ╚═╝╩═╝╝╚╝╚═╝╩╚═╩ ╩╚═╝╩╩═╝╩ ╩  ╩   ═╩╝╩ ╩╚═╝╩ ╩╚═╝╚═╝╩ ╩╩╚══╩╝
-- industryName: Vulnerability dashboard 
-  friendlyName: Vulnerability dashboard
-  documentationUrl: https://fleetdm.com/vulnerability-management
-  productCategories: [Vulnerability management]
-  pricingTableCategories: [Vulnerability management]
-  usualDepartment: Security
-  tier: Premium
-  jamfProHasFeature: no
-  jamfProtectHasFeature: yes
-  demos:
-    - description: See a list of all vulnerabilities across your hosts.
-      moreInfoUrl: https://github.com/fleetdm/fleet/issues/15919
-    - description: AI generated CVSS v4 context. Coming soon (2024-12-31).
-  waysToUse:
-    - description: Easily communicate to executives regarding the progress of patching vulnerable software. Only show vulnerabilities that you care about.
-#
 #  ╦  ╦╦ ╦╦  ╔╗╔╔═╗╦═╗╔═╗╔╗ ╦╦  ╦╔╦╗╦ ╦  ╔═╗╔═╗╔═╗╦═╗╔═╗╔═╗       ╔═╗╔═╗╔═╗╔═╗  ╔═╗╔╗╔╔╦╗  ╔═╗╦  ╦╔═╗╔═╗
 #  ╚╗╔╝║ ║║  ║║║║╣ ╠╦╝╠═╣╠╩╗║║  ║ ║ ╚╦╝  ╚═╗║  ║ ║╠╦╝║╣ ╚═╗  ───  ║╣ ╠═╝╚═╗╚═╗  ╠═╣║║║ ║║  ║  ╚╗╔╝╚═╗╚═╗
 #   ╚╝ ╚═╝╩═╝╝╚╝╚═╝╩╚═╩ ╩╚═╝╩╩═╝╩ ╩  ╩   ╚═╝╚═╝╚═╝╩╚═╚═╝╚═╝       ╚═╝╩  ╚═╝╚═╝  ╩ ╩╝╚╝═╩╝  ╚═╝ ╚╝ ╚═╝╚═╝
-- industryName: Vulnerability scores (EPSS and CVSS) 
+- industryName: Vulnerability scores
+  friendlyName: EPSS and CVSS
   documentationUrl: https://fleetdm.com/vulnerability-management
   tier: Premium
   jamfProHasFeature: no
   jamfProtectHasFeature: yes
   usualDepartment: Security
   productCategories: [Vulnerability management]
-  pricingTableCategories: [Vulnerability management]
+  pricingTableCategories: [Devices]
   buzzwords: [Risk scores,Cyber risk,Risk reduction,Security operations effectiveness,Peer benchmarking,Security program effectiveness,Risk-based exposure scoring,Threat context,Cyber exposure,Exposure quantification and benchmarking,Optimize security investments,Vulnerability assessment]
   demos:
     - description: Fleet enables a more modern, threat-first prioritization approach to vulnerability management.
@@ -452,14 +1003,15 @@
 #  ╔═╗╦╔═╗╔═╗  ╦╔═╔═╗╦  ╦╔═╗
 #  ║  ║╚═╗╠═╣  ╠╩╗║╣ ╚╗╔╝╚═╗
 #  ╚═╝╩╚═╝╩ ╩  ╩ ╩╚═╝ ╚╝ ╚═╝
-- industryName: CISA KEVs (known exploited vulnerabilities)
+- industryName: CISA KEVs
+  description: Known exploited vulnerabilities
   documentationUrl: https://fleetdm.com/vulnerability-management
   tier: Premium
   jamfProHasFeature: no
   jamfProtectHasFeature: yes
   usualDepartment: Security
   productCategories: [Vulnerability management]
-  pricingTableCategories: [Vulnerability management]
+  pricingTableCategories: [Devices]
   demos:
     - description: 
       moreInfoUrl:
@@ -468,721 +1020,159 @@
     - description: Use CISA KEVs for vulnerability management
     - moreInfoUrl: https://www.youtube.com/watch?v=Z3mw2oxssYk
 #  
-#  ╔═╗╔═╗╔═╗╔═╗╔╦╗  ╔╦╗╦╔═╗╔═╗╔═╗╦  ╦╔═╗╦═╗╦ ╦
-#  ╠═╣╚═╗╚═╗║╣  ║    ║║║╚═╗║  ║ ║╚╗╔╝║╣ ╠╦╝╚╦╝
-#  ╩ ╩╚═╝╚═╝╚═╝ ╩   ═╩╝╩╚═╝╚═╝╚═╝ ╚╝ ╚═╝╩╚═ ╩ 
+#   ╔═╗╔═╗╔═╗╔═╗╔╦╗  ╔╦╗╦╔═╗╔═╗╔═╗╦  ╦╔═╗╦═╗╦ ╦
+#   ╠═╣╚═╗╚═╗║╣  ║    ║║║╚═╗║  ║ ║╚╗╔╝║╣ ╠╦╝╚╦╝
+#   ╩ ╩╚═╝╚═╝╚═╝ ╩   ═╩╝╩╚═╝╚═╝╚═╝ ╚╝ ╚═╝╩╚═ ╩ 
 - industryName: Asset discovery
   documentationUrl:
   tier: Premium
   comingSoonOn: 2025-06-30
   usualDepartment: Security
   productCategories: [Vulnerability management]
-  pricingTableCategories: [Vulnerability management]
+  pricingTableCategories: [Devices]  
+#     
 #
-#  ███████╗███╗   ██╗██████╗ ██████╗  ██████╗ ██╗███╗   ██╗████████╗               
-#  ██╔════╝████╗  ██║██╔══██╗██╔══██╗██╔═══██╗██║████╗  ██║╚══██╔══╝               
-#  █████╗  ██╔██╗ ██║██║  ██║██████╔╝██║   ██║██║██╔██╗ ██║   ██║                  
-#  ██╔══╝  ██║╚██╗██║██║  ██║██╔═══╝ ██║   ██║██║██║╚██╗██║   ██║                  
-#  ███████╗██║ ╚████║██████╔╝██║     ╚██████╔╝██║██║ ╚████║   ██║                  
-#  ╚══════╝╚═╝  ╚═══╝╚═════╝ ╚═╝      ╚═════╝ ╚═╝╚═╝  ╚═══╝   ╚═╝                  
-#                                                                                  
-#   ██████╗ ██████╗ ███████╗██████╗  █████╗ ████████╗██╗ ██████╗ ███╗   ██╗███████╗
-#  ██╔═══██╗██╔══██╗██╔════╝██╔══██╗██╔══██╗╚══██╔══╝██║██╔═══██╗████╗  ██║██╔════╝
-#  ██║   ██║██████╔╝█████╗  ██████╔╝███████║   ██║   ██║██║   ██║██╔██╗ ██║███████╗
-#  ██║   ██║██╔═══╝ ██╔══╝  ██╔══██╗██╔══██║   ██║   ██║██║   ██║██║╚██╗██║╚════██║
-#  ╚██████╔╝██║     ███████╗██║  ██║██║  ██║   ██║   ██║╚██████╔╝██║ ╚████║███████║
-#   ╚═════╝ ╚═╝     ╚══════╝╚═╝  ╚═╝╚═╝  ╚═╝   ╚═╝   ╚═╝ ╚═════╝ ╚═╝  ╚═══╝╚══════╝
-#                                                                                  
 #
-#  ╔╦╗╔═╗╦  ╦╦╔═╗╔═╗  ╦ ╦╔═╗╔═╗╦ ╔╦╗╦ ╦
-#   ║║║╣ ╚╗╔╝║║  ║╣   ╠═╣║╣ ╠═╣║  ║ ╠═╣
-#  ═╩╝╚═╝ ╚╝ ╩╚═╝╚═╝  ╩ ╩╚═╝╩ ╩╩═╝╩ ╩ ╩
-- industryName: Device health
-  friendlyName: Automate device health
-  description: Automatically report system health issues using webhooks or integrations, to notify or quarantine outdated or misconfigured systems that are at higher risk of vulnerabilities or theft.
+#  ██╗███╗   ██╗████████╗███████╗ ██████╗ ██████╗  █████╗ ████████╗██╗ ██████╗ ███╗   ██╗███████╗
+#  ██║████╗  ██║╚══██╔══╝██╔════╝██╔════╝ ██╔══██╗██╔══██╗╚══██╔══╝██║██╔═══██╗████╗  ██║██╔════╝
+#  ██║██╔██╗ ██║   ██║   █████╗  ██║  ███╗██████╔╝███████║   ██║   ██║██║   ██║██╔██╗ ██║███████╗
+#  ██║██║╚██╗██║   ██║   ██╔══╝  ██║   ██║██╔══██╗██╔══██║   ██║   ██║██║   ██║██║╚██╗██║╚════██║
+#  ██║██║ ╚████║   ██║   ███████╗╚██████╔╝██║  ██║██║  ██║   ██║   ██║╚██████╔╝██║ ╚████║███████║
+#  ╚═╝╚═╝  ╚═══╝   ╚═╝   ╚══════╝ ╚═════╝ ╚═╝  ╚═╝╚═╝  ╚═╝   ╚═╝   ╚═╝ ╚═════╝ ╚═╝  ╚═══╝╚══════╝
+#                                                                                                                                                                                 
+#
+#  ╦═╗╔═╗╔═╗╔╦╗  ╔═╗╔═╗╦
+#  ╠╦╝║╣ ╚═╗ ║   ╠═╣╠═╝║
+#  ╩╚═╚═╝╚═╝ ╩   ╩ ╩╩  ╩
+- industryName: REST API
+  friendlyName: Automate any feature
+  description: 
+  productCategories: [Endpoint operations,Device management,Vulnerability management]
+  pricingTableCategories: [Integrations]
+  usualDepartment: IT
+  documentationUrl: https://fleetdm.com/docs/rest-api/rest-api 
+  screenshotSrc:
+  tier: Free
+  jamfProHasFeature: yes
+  jamfProtectHasFeature: yes
+  dri: rachaelshaw
+#
+#  ╦ ╦╔═╗╔╗ ╦ ╦╔═╗╔═╗╦╔═╔═╗
+#  ║║║║╣ ╠╩╗╠═╣║ ║║ ║╠╩╗╚═╗
+#  ╚╩╝╚═╝╚═╝╩ ╩╚═╝╚═╝╩ ╩╚═╝
+- industryName: Webhooks
+  friendlyName: Automations
   documentationUrl: https://fleetdm.com/docs/using-fleet/automations#automations
-  screenshotSrc:
-  tier: Free
-  jamfProHasFeature: no
-  jamfProtectHasFeature: yes
-  productCategories: [Device management,Endpoint operations]
-  pricingTableCategories: [Endpoint operations]
-  usualDepartment: IT
-  dri: mikermcneil
-  demos:
-    - description: A large tech company used the Fleet API to block access to corporate apps for outdated operating system versions with certain "celebrity" vulnerabilities.
-      quote: 
-      moreInfoUrl: https://play.goconsensus.com/s4e490bb9
-  buzzwords: [Device trust,Zero trust,Layer 7 device trust,Beyondcorp,Device attestation,Conditional access]
-  waysToUse:
-    - description: Automatically manage the behavior of endpoints that are at higher risk of vulnerabilities or data loss due to their configuration or patch level.
-    - description: Block access to corporate apps for users whose devices with unexpected settings, like disabled screen lock, passwords that are too short, unencrypted hard disks, and more
-    - description: Quickly implement conditional access based on device health using osquery and a simple device health REST API.
-      moreInfoUrl: https://github.com/fleetdm/fleet/issues/14920
-    - description: Control and restore access to applications by automatically restricting access when devices do not meet particular security requirements.
-      moreInfoUrl: https://duo.com/docs/device-health
-    - description: Control which laptop and desktop devices can access corporate apps and websites based on what vulnerabilities it might be exposed to based on how the device is configured, whether it's up to date, its MDM enrollment status, and anything else you can build in a SQL query of Fleet's 300 data tables representing information about enrolled host systems. Coming soon (2024-09-30).
-      moreInfoUrl: https://github.com/fleetdm/fleet/issues/16236
-    - description: Implement multivariate device trust
-      moreInfoUrl: https://youtu.be/5sFOdpMLXQg?feature=shared&t=1445
-    - description: Implement your own version of Google's zero trust model (BeyondCorp)
-      moreInfoUrl: https://cloud.google.com/beyondcorp
-    - description: Get endpoint data into ServiceNow and make your asset management teams happy
-      moreInfoUrl: https://www.youtube.com/watch?v=aVbU6_9JoM0
-#
-#  ╔═╗╦ ╦╔╦╗╔═╗╔╦╗╔═╗╔╦╗╦╔═╗  ╔═╗╔═╗╔═╗╔╦╗╦ ╦╦═╗╔═╗  ╔═╗╔═╗╔═╗╔═╗╔═╗╔═╗╔╦╗╔═╗╔╗╔╔╦╗
-#  ╠═╣║ ║ ║ ║ ║║║║╠═╣ ║ ║║    ╠═╝║ ║╚═╗ ║ ║ ║╠╦╝║╣   ╠═╣╚═╗╚═╗║╣ ╚═╗╚═╗║║║║╣ ║║║ ║
-#  ╩ ╩╚═╝ ╩ ╚═╝╩ ╩╩ ╩ ╩ ╩╚═╝  ╩  ╚═╝╚═╝ ╩ ╚═╝╩╚═╚═╝  ╩ ╩╚═╝╚═╝╚═╝╚═╝╚═╝╩ ╩╚═╝╝╚╝ ╩
-- industryName: Automatic posture assessment
-  friendlyName: Verify any security or compliance goal
-  description: Simplify security audits, build definitive reports, and discover + verify ongoing compliance for every endpoint, from workstations to data centers.
-  documentationUrl: https://fleetdm.com/docs/using-fleet/cis-benchmarks#cis-benchmarks
-  screenshotSrc:
-  usualDepartment: Security
-  tier: Free
-  jamfProHasFeature: no
-  jamfProtectHasFeature: yes
-  productCategories: [Endpoint operations]
-  pricingTableCategories: [Endpoint operations]
-  dri: mikermcneil
-  demos:
-    - description: A large tech company used Fleet's CIS Benchmark policies to automatically assess posuture of 80,000 endpoints. 
-      quote:
-      moreInfoUrl: 
-  buzzwords: [Attack surface management (ASM),Endpoint hardening,Security posture,Cyber hygiene,Anomaly detection,Configuration management,Attack Surface Monitoring,Policy assessment]
-  waysToUse:
-    - description: Monitor devices that don't meet your organization's custom security policies
-    - description: Quickly report your posture and vulnerabilities to auditors, showing remediation status and timing.
-    - description: Keep your devices compliant with customizable baselines, or use common benchmarks like CIS.
-    - description: Discover security misconfigurations that increase attack surface.
-    - description: Detect suspcious services listening on open ports that should not be connected to the internet, such as Remote Desktop Protocol (RDP).
-      moreInfoUrl: https://paraflare.com/articles/vulnerability-management-via-osquery/#:~:text=WHERE%20statename%20%3D%20%E2%80%9CEnabled%E2%80%9D-,OPEN%20SOCKETS,-Lastly%2C%20an%20examination
-    - description: Discover potentially unwanted programs that increase attack surface.
-      moreInfoUrl: https://paraflare.com/articles/vulnerability-management-via-osquery/
-    - description: Detect self-signed certifcates
-    - description: Detect legacy protocols with safer versions
-      moreInfoUrl: https://paraflare.com/articles/vulnerability-management-via-osquery/#:~:text=WHERE%20self_signed%20%3D%201%3B-,LEGACY%20PROTOCOLS,-This%20section%20will
-    - description: Detect exposed secrets on the command line
-      moreInfoUrl: https://paraflare.com/articles/vulnerability-management-via-osquery/#:~:text=WDigest%20is%20disabled.-,EXPOSED%20SECRETS,-Often%2C%20to%20create
-    - description: Detect and surface issues with devices
-    - description: Share device health reports
-    - description: Align endpoints with your security policies
-      moreInfoUrl: https://www.axonius.com/use-cases/cmdb-reconciliation
-    - description: Maximize security control coverage
-    - description: Uncover gaps in security policies, configurations, and hygiene
-      moreInfoUrl: https://www.axonius.com/use-cases/coverage-gap-discovery
-    - description: Automatically apply security policies to protect endpoints against attack.
-    - description: Surface security issues in all your deployed endpoints even data centers and factories.
-    - description: Continually validate controls and policies
-#
-#  ╦ ╦╦ ╦╔╦╗╔═╗╔╗╔   ╔═╗╔╗╔╔╦╗╔═╗╔═╗╦╔╗╔╔╦╗  ╔╦╗╔═╗╔═╗╔═╗╦╔╗╔╔═╗
-#  ╠═╣║ ║║║║╠═╣║║║───║╣ ║║║ ║║╠═╝║ ║║║║║ ║   ║║║╠═╣╠═╝╠═╝║║║║║ ╦
-#  ╩ ╩╚═╝╩ ╩╩ ╩╝╚╝   ╚═╝╝╚╝═╩╝╩  ╚═╝╩╝╚╝ ╩   ╩ ╩╩ ╩╩  ╩  ╩╝╚╝╚═╝
-- industryName: Human-endpoint mapping
-  friendlyName: See who logs in on every computer
-  description: Identify who logs in to any system, including login history and current sessions.  Look up any host by the email address of the person using it.
-  documentationUrl: https://fleetdm.com/docs/rest-api/rest-api#get-hosts-google-chrome-profiles
-  screenshotSrc:
-  tier: Free
-  jamfProHasFeature: yes
-  jamfProtectHasFeature: yes
-  productCategories: [Endpoint operations]
-  pricingTableCategories: [Endpoint operations]
-  usualDepartment: IT
-  buzzwords: [Device users,human-to-device mapping]
-  dri: mikermcneil
-  demos:
-    - description: Security engineers at a top gaming company wanted to get demographics off their macOS, Windows, and Linux machines about who the user is and who's logged in.
-      moreInfoUrl: https://docs.google.com/document/d/1qFYtMoKh3zyERLhbErJOEOo2me6Bc7KOOkjKn482Sqc/edit
-    - description: Data engineers at a top biotech corporation needed to know who is logged into their devices. 
-      quote: So we don't know exactly what's going on after we deploy the device, we know that they are compliant with the security because we are running these stuff, but we don't know certainly who is running, who is logging in the device?
-      moreInfoUrl: https://docs.google.com/document/d/17MNI5ykzlFjdVmQ8SPMrT1oR_hY_vkYAJx31F7l7Pv8/edit#heading=h.7en766pueek4 
-  waysToUse:
-    - description: Look up computer by ActiveDirectory account
-    - description: Find device by Google Chrome user
-    - description: Identify who logs in to any system, including login history and current sessions.
-    - description: Look up any host by the email address of the person using it.
-    - description: Check user login history
-      moreInfoUrl: https://www.lepide.com/how-to/audit-who-logged-into-a-computer-and-when.html#:~:text=To%20find%20out%20the%20details,logs%20in%20%E2%80%9CWindows%20Logs%E2%80%9D.
-    - description: See currently logged in users
-      moreInfoUrl: https://www.top-password.com/blog/see-currently-logged-in-users-in-windows/
-    - description: Get demographics off of our machines about who the user is and who's logged in
-      moreInfoUrl: https://docs.google.com/document/d/1qFYtMoKh3zyERLhbErJOEOo2me6Bc7KOOkjKn482Sqc/edit
-    - description: See what servers someone is logged-in on
-      moreInfoUrl: https://community.spiceworks.com/topic/138171-is-there-a-way-to-see-what-servers-someone-is-logged-in-on
-#
-#  ╦╔╗╔╔╦╗╦═╗╦ ╦╔═╗╔╦╗╦╔═╗╔╗╔  ╔╦╗╔═╗╔╦╗╔═╗╔═╗╔╦╗╦╔═╗╔╗╔
-#  ║║║║ ║ ╠╦╝║ ║╚═╗ ║ ║║ ║║║║   ║║║╣  ║ ║╣ ║   ║ ║║ ║║║║
-#  ╩╝╚╝ ╩ ╩╚═╚═╝╚═╝ ╩ ╩╚═╝╝╚╝  ═╩╝╚═╝ ╩ ╚═╝╚═╝ ╩ ╩╚═╝╝╚╝     
-- industryName: Intrusion detection
-  friendlyName: Build custom query and policy automations to detect suspicious behavior
-  description: Send webhooks and ship logs to detect intrusions and issues with devices.
-  documentationUrl: https://fleetdm.com/docs/using-fleet/log-destinations
-  tier: Free
-  jamfProHasFeature: no
-  jamfProtectHasFeature: yes
-  usualDepartment: Security
-  productCategories: [Endpoint operations]
-  pricingTableCategories: [Endpoint operations]
-  buzzwords: [Host-based intrusion detection system (HIDS,Indicators of Compromise (IOCs),Feeder for SIEM]
-  demos:
-    - description: A top media company wanted to share more security data with other departments without slowing down hosts.
-  waysToUse:
-    - description: Send webhooks to generate alerts when an IOC is detected on one or more devices.
-    - description: Ship logs to Splunk, Snowflake, and other SIEMs to build a host-based intrusion detection system (HIDS).
-    - description: Synchronize live state of endpoints to a data lake or SIEM in a consistent shape.
-    - description: Export the data to other systems
-      moreInfoUrl: https://docs.google.com/document/d/1pE9U-1E4YDiy6h4TorszrTOiFAauFiORikSUFUqW7Pk/edit
-    - description: Export data to a third-party SIEM tool
-      moreInfoUrl: https://www.websense.com/content/support/library/web/hosted/admin_guide/siem_integration_explain.aspx
-    - description: Gather data and log events from endpoints
-      moreInfoUrl: https://techbeacon.com/security/how-osquery-can-lift-your-security-teams-game#:~:text=%22If%20security%20teams%20didn%27t%20have%20osquery%2C%20they%20would%20have%20to%20find%20a%20way%20to%20manually%20go%20into%20each%20endpoint%20and%20gather%20data%2C%20or%20buy%20a%20third%2Dparty%20tool%20to%20do%20that%20for%20them
-#
-#  ╔═╗╦   ╔═╗╔═╗╔╗╔╔═╗╦═╗╔═╗╔╦╗╔═╗╔╦╗  ╔╦╗╔═╗╔═╗╔═╗╦═╗╦╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
-#  ╠═╣║───║ ╦║╣ ║║║║╣ ╠╦╝╠═╣ ║ ║╣  ║║   ║║║╣ ╚═╗║  ╠╦╝║╠═╝ ║ ║║ ║║║║╚═╗
-#  ╩ ╩╩   ╚═╝╚═╝╝╚╝╚═╝╩╚═╩ ╩ ╩ ╚═╝═╩╝  ═╩╝╚═╝╚═╝╚═╝╩╚═╩╩   ╩ ╩╚═╝╝╚╝╚═╝
-- industryName: AI-generated descriptions (optional)
-  description: Optionally use AI to explain why your security policies matter.
-  documentationUrl: https://github.com/fleetdm/fleet/issues/18187
-  tier: Free
-  jamfProHasFeature: no
-  jamfProtectHasFeature: no
-  productCategories: [Endpoint operations]
-  pricingTableCategories: [Endpoint operations]
-#
-#  ╔═╗╦╔╦╗
-#  ╠╣ ║║║║
-#  ╚  ╩╩ ╩
-- industryName: File integrity monitoring (FIM) # Short industry phrase
-  friendlyName: Detect changes to critical files # Short, Fleet one-liner for the feature, written in the imperative mood.  (If easy to do, base this off of the words that an actual customer is saying.)
-  description: Specify files to monitor for changes or deletions, then log those events to your SIEM or data lake, including key information such as filepath and checksum. # Clear Mr. Rogers description
-  documentationUrl: https://fleetdm.com/guides/osquery-evented-tables-overview#file-integrity-monitoring-fim # URL of the single-best page within the docs which serves as a "jumping-off point" for this feature.
-  screenshotSrc: "" # A screenshot of the single, best, simplifying, obvious example 
-  tier: Free # Either "Free" or "Premium"
-  jamfProHasFeature: no
-  jamfProtectHasFeature: yes
-  usualDepartment: Security # or omit if there isn't a particular departmental leaning we've noticed
-  productCategories: [Endpoint operations] # or omit if this isn't associated with a single product category
-  pricingTableCategories: [Endpoint operations]
-  dri: mikermcneil #GitHub user name
-  demos:
-    - description: A top gaming company needed a way to monitor critical files on production Debian servers.
-      quote: The FIM features are kind of a top priority.
-      moreInfoUrl: https://docs.google.com/document/d/1pE9U-1E4YDiy6h4TorszrTOiFAauFiORikSUFUqW7Pk/edit
-  buzzwords: [File integrity monitoring (FIM),Host-based intrusion detection system (HIDS),Anomaly detection]
-  waysToUse:
-    - description: Monitor critical files on production Debian servers
-    - description: Detect anomalous filesystem activity
-      moreInfoUrl: https://www.beyondtrust.com/resources/glossary/file-integrity-monitoring
-    - description: Detect unintended changes
-      moreInfoUrl: https://www.beyondtrust.com/resources/glossary/file-integrity-monitoring
-    - description: Verify update status and monitor system health
-      moreInfoUrl: https://www.beyondtrust.com/resources/glossary/file-integrity-monitoring
-    - description: Meet compliance mandates
-      moreInfoUrl: https://www.beyondtrust.com/resources/glossary/file-integrity-monitoring
-#
-#  ╔╦╗╔═╗╦╔╗╔╔╦╗╔═╗╔╗╔╔═╗╔╗╔╔═╗╔═╗  ╦ ╦╦╔╗╔╔╦╗╔═╗╦ ╦╔═╗
-#  ║║║╠═╣║║║║ ║ ║╣ ║║║╠═╣║║║║  ║╣   ║║║║║║║ ║║║ ║║║║╚═╗
-#  ╩ ╩╩ ╩╩╝╚╝ ╩ ╚═╝╝╚╝╩ ╩╝╚╝╚═╝╚═╝  ╚╩╝╩╝╚╝═╩╝╚═╝╚╩╝╚═╝
-- industryName: Maintenance windows
-  friendlyName: Fleet in your calendar
-  description: Create a calendar event to auto-remediate failing policies when your end users are free.
-  documentationUrl: https://github.com/fleetdm/fleet/issues/17230
-  tier: Premium
-  jamfProHasFeature: no
-  jamfProtectHasFeature: no
-  isExperimental: yes
-  productCategories: [Endpoint operations]
-  pricingTableCategories: [Endpoint operations]
-#
-#  ╔╦╗╔═╗╔╦╗╔═╗╔═╗╔╦╗╦╔═╗╔╗╔  ╔═╗╔╗╔╔═╗╦╔╗╔╔═╗╔═╗╦═╗╦╔╗╔╔═╗
-#   ║║║╣  ║ ║╣ ║   ║ ║║ ║║║║  ║╣ ║║║║ ╦║║║║║╣ ║╣ ╠╦╝║║║║║ ╦
-#  ═╩╝╚═╝ ╩ ╚═╝╚═╝ ╩ ╩╚═╝╝╚╝  ╚═╝╝╚╝╚═╝╩╝╚╝╚═╝╚═╝╩╚═╩╝╚╝╚═╝
-- industryName: Detection engineering
-  friendlyName: # Ship logs to your data lake and comopare with known bad binary hashes or capture behavioral data and build custom detections (e.g. using a framework like MITRE)
-  description: 
-  documentationUrl: https://fleetdm.com/docs/using-fleet/log-destinations
-  tier: Free
-  jamfProHasFeature: no
-  jamfProtectHasFeature: yes
-  dri: mikermcneil
-  usualDepartment: Security
-  productCategories: [Endpoint operations]
-  pricingTableCategories: [Endpoint operations]
-  buzzwords: [Security analytics,Behavioral analytics,MITRE ATT&CK,Tactics techniques and procedures (TTPs),Security information and event management (SIEM)]
-  demos:
-    - description: 
-      moreInfoUrl: 
-  waysToUse:
-    - description: 
-#
-#  ╔╦╗╦ ╦╦═╗╔═╗╔═╗╔╦╗  ╦ ╦╦ ╦╔╗╔╔╦╗╦╔╗╔╔═╗
-#   ║ ╠═╣╠╦╝║╣ ╠═╣ ║   ╠═╣║ ║║║║ ║ ║║║║║ ╦
-#   ╩ ╩ ╩╩╚═╚═╝╩ ╩ ╩   ╩ ╩╚═╝╝╚╝ ╩ ╩╝╚╝╚═╝
-- industryName: Threat hunting
-  friendlyName: # TODO: live query
-  description: 
-  documentationUrl: https://fleetdm.com/queries
-  tier: Free
-  jamfProHasFeature: no
-  jamfProtectHasFeature: yes
-  dri: mikermcneil
-  usualDepartment: Security
-  productCategories: [Endpoint operations]
-  pricingTableCategories: [Endpoint operations]
-  buzzwords: []
-  demos:
-    - description: 
-      moreInfoUrl: 
-  waysToUse:
-    - description: 
-#
-#  ╦╔╗╔╔═╗╦╔╦╗╔═╗╔╗╔╔╦╗  ╦═╗╔═╗╔═╗╔═╗╔═╗╔╗╔╔═╗╔═╗
-#  ║║║║║  ║ ║║║╣ ║║║ ║   ╠╦╝║╣ ╚═╗╠═╝║ ║║║║╚═╗║╣ 
-#  ╩╝╚╝╚═╝╩═╩╝╚═╝╝╚╝ ╩   ╩╚═╚═╝╚═╝╩  ╚═╝╝╚╝╚═╝╚═╝
-- industryName: Incident response
-  friendlyName: Interrogate hosts in real time
-  description: Live query, triage, figuring out scope of impact, remediate using scripts or MDM commands (e.g. remote wipe), and quarantine or reimage using other systems and APIs (e.g. remove from network, decommission container)
-  documentationUrl: https://fleetdm.com/securing/how-osquery-can-help-cyber-responders#simplifying-endpoint-visibility-with-osquery-and-fleet
-  tier: Free
-  jamfProHasFeature: yes
-  jamfProtectHasFeature: yes
-  dri: mikermcneil
-  usualDepartment: Security
-  productCategories: [Endpoint operations]
-  pricingTableCategories: [Endpoint operations]
-  buzzwords: []
-  demos:
-    - description: 
-      moreInfoUrl: 
-  waysToUse:
-    - description: 
-#
-#  ╔╗ ╦╔╗╔╔═╗╦═╗╦ ╦  ╔═╗╦ ╦╔╦╗╦ ╦╔═╗╦═╗╦╔═╗╔═╗╔╦╗╦╔═╗╔╗╔
-#  ╠╩╗║║║║╠═╣╠╦╝╚╦╝  ╠═╣║ ║ ║ ╠═╣║ ║╠╦╝║╔═╝╠═╣ ║ ║║ ║║║║
-#  ╚═╝╩╝╚╝╩ ╩╩╚═ ╩   ╩ ╩╚═╝ ╩ ╩ ╩╚═╝╩╚═╩╚═╝╩ ╩ ╩ ╩╚═╝╝╚╝
-- industryName: Binary authorization
-  friendlyName: Restrict what programs can run, and what files running programs can access.
-  description: 
-  documentationUrl: 
-  tier: Free
-  jamfProHasFeature: yes
-  jamfProtectHasFeature: yes
-  dri: mikermcneil
-  usualDepartment: Security
-  productCategories: [Endpoint operations]
-  pricingTableCategories: [Endpoint operations]
-  comingSoonOn: 2025-06-30
-  buzzwords: [Mandatory Access Control (MAC),Privilege confinement,Binary authorization,Santa,Binary allowlisting,Binary whitelisting]
-  demos:
-    - description: 
-      moreInfoUrl: 
-  waysToUse:
-    - description: Confine programs to a limited set of resources.
-    - description: Report on AppArmor events
-      moreInfoUrl: https://fleetdm.com/tables/apparmor_events
-    - description: Confine programs according to a set of rules that specify which files a program can access.
-      moreInfoUrl: https://wiki.debian.org/AppArmor
-    - description: Proactively protect the system against both known and unknown vulnerabilities.
-#
-#  ╔═╗╔═╗╔═╗╔╗╔╔╦╗  ╔═╗╦ ╦╔╦╗╔═╗   ╦ ╦╔═╗╔╦╗╔═╗╔╦╗╔═╗
-#  ╠═╣║ ╦║╣ ║║║ ║   ╠═╣║ ║ ║ ║ ║───║ ║╠═╝ ║║╠═╣ ║ ║╣
-#  ╩ ╩╚═╝╚═╝╝╚╝ ╩   ╩ ╩╚═╝ ╩ ╚═╝   ╚═╝╩  ═╩╝╩ ╩ ╩ ╚═╝
-- industryName: Agent auto-update (optional)
-  friendlyName: Keep agents and extensions up to date
-  description: Optionally keep agents and extensions up to date automatically using Fleet's free update registry, powered by The Update Framework (TUF).
-  documentationUrl: https://fleetdm.com/docs/using-fleet/enroll-hosts
-  tier: Free
-  jamfProHasFeature: yes
-  jamfProtectHasFeature: no
-  productCategories: [Endpoint operations]
-  pricingTableCategories: [Endpoint operations]
-  usualDepartment: IT
-#
-#  ╦╔╗╔╔═╗╔╦╗╔═╗╦  ╦  ╔═╗╦═╗╔═╗
-#  ║║║║╚═╗ ║ ╠═╣║  ║  ║╣ ╠╦╝╚═╗
-#  ╩╝╚╝╚═╝ ╩ ╩ ╩╩═╝╩═╝╚═╝╩╚═╚═╝
-- industryName: Installers (self-service)
-  tier: Free
-  jamfProHasFeature: yes
-  jamfProtectHasFeature: no
-  productCategories: [Endpoint operations]
-  pricingTableCategories: [Endpoint operations]
-  usualDepartment: IT
-  documentationUrl: https://fleetdm.com/docs/using-fleet/enroll-hosts
-  waysToUse:
-    - description: Build scripts for Ansible deployments
-      moreInfoUrl: https://www.youtube.com/watch?v=qflUfLQCnwY&list=PL6-FgoWOoK2YUR4ADGsxTSL3onb-GzCnM&index=4
-    - description: Deploy osquery to macOS via Jamf
-      moreInfoUrl: https://www.youtube.com/watch?v=qflUfLQCnwY&list=PL6-FgoWOoK2YUR4ADGsxTSL3onb-GzCnM&index=4
-    - description: Package osquery for Linux servers via Workspace One and Windows servers via group policies
-      moreInfoUrl: https://www.youtube.com/watch?v=qflUfLQCnwY&list=PL6-FgoWOoK2YUR4ADGsxTSL3onb-GzCnM&index=4
-#
-#  ╔╗ ╔═╗╔╦╗╔═╗╦ ╦  ╦╔╗╔╔═╗╔╦╗╔═╗╦  ╦  ╔═╗╔╦╗╦╔═╗╔╗╔
-#  ╠╩╗╠═╣ ║ ║  ╠═╣  ║║║║╚═╗ ║ ╠═╣║  ║  ╠═╣ ║ ║║ ║║║║
-#  ╚═╝╩ ╩ ╩ ╚═╝╩ ╩  ╩╝╚╝╚═╝ ╩ ╩ ╩╩═╝╩═╝╩ ╩ ╩ ╩╚═╝╝╚╝
-- industryName: Batch installation (Chef, Ansible, Puppet, MDM)
-  friendlyName: Install agents over the air
-  documentationUrl: https://fleetdm.com/docs/using-fleet/enroll-hosts
-  tier: Free
-  jamfProHasFeature: no
-  jamfProtectHasFeature: no
-  productCategories: [Endpoint operations]
-  pricingTableCategories: [Endpoint operations]
-  usualDepartment: IT
-#
-#  ╦═╗╔═╗╔╦╗╔═╗╔╦╗╔═╗  ╔═╗╔═╗╔╦╗╔╦╗╦╔╗╔╔═╗╔═╗
-#  ╠╦╝║╣ ║║║║ ║ ║ ║╣   ╚═╗║╣  ║  ║ ║║║║║ ╦╚═╗
-#  ╩╚═╚═╝╩ ╩╚═╝ ╩ ╚═╝  ╚═╝╚═╝ ╩  ╩ ╩╝╚╝╚═╝╚═╝
-- industryName: Remote settings
-  description: Configure agent options remotely, over the air.  (Includes osquery config, and osquery startup flags.).
-  documentationUrl: https://fleetdm.com/docs/configuration/agent-configuration
-  moreInfoUrl: https://github.com/fleetdm/fleet/issues/13825
-  tier: Free
-  jamfProHasFeature: no
-  jamfProtectHasFeature: no
-  productCategories: [Endpoint operations]
-  pricingTableCategories: [Endpoint operations]
-  usualDepartment: Security
-#  
-#  ╔╦╗╦═╗╦╔═╗╔═╗╔═╗╦═╗  ╔═╗  ╦ ╦╔═╗╦═╗╦╔═╔═╗╦  ╔═╗╦ ╦  ╔╗ ╔═╗╔═╗╔═╗╔╦╗  ╔═╗╔╗╔  ╔═╗  
-#   ║ ╠╦╝║║ ╦║ ╦║╣ ╠╦╝  ╠═╣  ║║║║ ║╠╦╝╠╩╗╠╣ ║  ║ ║║║║  ╠╩╗╠═╣╚═╗║╣  ║║  ║ ║║║║  ╠═╣  
-#   ╩ ╩╚═╩╚═╝╚═╝╚═╝╩╚═  ╩ ╩  ╚╩╝╚═╝╩╚═╩ ╩╚  ╩═╝╚═╝╚╩╝  ╚═╝╩ ╩╚═╝╚═╝═╩╝  ╚═╝╝╚╝  ╩ ╩  
-#  ╔═╗╔═╗╦╦  ╦╔╗╔╔═╗  ╔═╗╔═╗╦  ╦╔═╗╦ ╦                                               
-#  ╠╣ ╠═╣║║  ║║║║║ ╦  ╠═╝║ ║║  ║║  ╚╦╝                                               
-#  ╚  ╩ ╩╩╩═╝╩╝╚╝╚═╝  ╩  ╚═╝╩═╝╩╚═╝ ╩                                                
-- industryName: Trigger a workflow based on a failing policy
-  documentationUrl: https://fleetdm.com/docs/using-fleet/automations#policy-automations
-  productCategories: [Endpoint operations,Device management]
-  pricingTableCategories: [Endpoint operations]
-  usualDepartment: IT
-  tier: Free
-  jamfProHasFeature: yes
-  jamfProtectHasFeature: no
-#  
-#  ╔═╗╔═╗╔═╗╔╦╗╦ ╦╔═╗╦═╗╔═╗  ╦╔╗╔╦  ╦╔═╗╔╗╔╔╦╗╔═╗╦═╗╦ ╦
-#  ╚═╗║ ║╠╣  ║ ║║║╠═╣╠╦╝║╣   ║║║║╚╗╔╝║╣ ║║║ ║ ║ ║╠╦╝╚╦╝
-#  ╚═╝╚═╝╚   ╩ ╚╩╝╩ ╩╩╚═╚═╝  ╩╝╚╝ ╚╝ ╚═╝╝╚╝ ╩ ╚═╝╩╚═ ╩ 
-- industryName: Software inventory
-  documentationUrl: https://fleetdm.com/docs/get-started/anatomy#software-library
-  tier: Free
-  jamfProHasFeature: yes
-  jamfProtectHasFeature: no
   productCategories: [Endpoint operations,Device management,Vulnerability management]
-  pricingTableCategories: [Endpoint operations]
-  waysToUse:
-    - description: Implement software inventory recommendations from the SANS 20 / CIS 18.
-      moreInfoUrl: https://docs.google.com/document/d/1E6EQMMqrsRc6Z3YsR6Q33OaF9eAa8zLNaz4K2YzFdyo/edit#heading=h.7en766pueek4
-    - description: View a list of all software and their versions installed on all your hosts.
-    - description: View a list of software rolled up by title.
-      moreInfoUrl: https://github.com/fleetdm/fleet/issues/14674
-#  
-#  ╦ ╦╔═╗╦═╗╔╦╗╦ ╦╔═╗╦═╗╔═╗  ╦╔╗╔╦  ╦╔═╗╔╗╔╔╦╗╔═╗╦═╗╦ ╦
-#  ╠═╣╠═╣╠╦╝ ║║║║║╠═╣╠╦╝║╣   ║║║║╚╗╔╝║╣ ║║║ ║ ║ ║╠╦╝╚╦╝
-#  ╩ ╩╩ ╩╩╚══╩╝╚╩╝╩ ╩╩╚═╚═╝  ╩╝╚╝ ╚╝ ╚═╝╝╚╝ ╩ ╚═╝╩╚═ ╩ 
-- industryName: Hardware inventory
-  documentationUrl: https://fleetdm.com/tables/system_info
-  productCategories: [Endpoint operations,Device management,Vulnerability management]
-  pricingTableCategories: [Endpoint operations]
+  pricingTableCategories: [Integrations]
+  usualDepartment: IT 
   tier: Free
   jamfProHasFeature: yes
-  jamfProtectHasFeature: no
-  waysToUse:
-    - description: Implement hardware and infrastructure inventory recommendations from the SANS 20 / CIS 18.
-      moreInfoUrl: https://docs.google.com/document/d/1E6EQMMqrsRc6Z3YsR6Q33OaF9eAa8zLNaz4K2YzFdyo/edit#heading=h.7en766pueek4
+  jamfProtectHasFeature: yes
 #  
-#  ╔╦╗╔═╗╦  ╦╦╔═╗╔═╗  ╦╔╗╔╦  ╦╔═╗╔╗╔╔╦╗╔═╗╦═╗╦ ╦  ╔╦╗╔═╗╔═╗╦ ╦╔╗ ╔═╗╔═╗╦═╗╔╦╗
-#   ║║║╣ ╚╗╔╝║║  ║╣   ║║║║╚╗╔╝║╣ ║║║ ║ ║ ║╠╦╝╚╦╝   ║║╠═╣╚═╗╠═╣╠╩╗║ ║╠═╣╠╦╝ ║║
-#  ═╩╝╚═╝ ╚╝ ╩╚═╝╚═╝  ╩╝╚╝ ╚╝ ╚═╝╝╚╝ ╩ ╚═╝╩╚═ ╩   ═╩╝╩ ╩╚═╝╩ ╩╚═╝╚═╝╩ ╩╩╚══╩╝
-- industryName: Device inventory dashboard
-  documentationUrl: 
-  productCategories: [Endpoint operations,Device management]
-  pricingTableCategories: [Endpoint operations]
+#  ╔═╗╦═╗╔═╗╔╗╔╔╦╗  ╔═╗╔═╗╦   ╔═╗╔╗╔╦ ╦ ╦  ╔═╗╔═╗╔═╗╔═╗╔═╗╔═╗
+#  ║ ╦╠╦╝╠═╣║║║ ║   ╠═╣╠═╝║───║ ║║║║║ ╚╦╝  ╠═╣║  ║  ║╣ ╚═╗╚═╗
+#  ╚═╝╩╚═╩ ╩╝╚╝ ╩   ╩ ╩╩  ╩   ╚═╝╝╚╝╩═╝╩   ╩ ╩╚═╝╚═╝╚═╝╚═╝╚═╝
+- industryName: Grant API-only access
+  description: Grant API-only access to accounts exclusively for automation.
+  documentationUrl: https://fleetdm.com/docs/using-fleet/fleetctl-cli#using-fleetctl-with-an-api-only-user
+  productCategories: [Endpoint operations]
+  pricingTableCategories: [Integrations]
+  tier: Free
+  jamfProHasFeature: yes
+  jamfProtectHasFeature: yes
+#  
+#  ╔═╗╦╔╗╔╔═╗╦  ╔═╗  ╔═╗╦╔═╗╔╗╔  ╔═╗╔╗╔
+#  ╚═╗║║║║║ ╦║  ║╣   ╚═╗║║ ╦║║║  ║ ║║║║
+#  ╚═╝╩╝╚╝╚═╝╩═╝╚═╝  ╚═╝╩╚═╝╝╚╝  ╚═╝╝╚╝
+- industryName: Single sign on
+  description: SSO, SAML
+  documentationUrl: https://fleetdm.com/docs/deploy/single-sign-on-sso#single-sign-on-sso
+  productCategories: [Endpoint operations,Device management,Vulnerability management]
+  pricingTableCategories: [Integrations]
   usualDepartment: IT
   tier: Free
   jamfProHasFeature: yes
   jamfProtectHasFeature: yes
 #  
-#  ╔╗ ╦═╗╔═╗╦ ╦╔═╗╔═╗  ╦╔╗╔╔═╗╔╦╗╔═╗╦  ╦  ╔═╗╔╦╗  ╔═╗╔═╗╔═╗╔╦╗╦ ╦╔═╗╦═╗╔═╗  ╔═╗╔═╗╔═╗╦╔═╔═╗╔═╗╔═╗╔═╗
-#  ╠╩╗╠╦╝║ ║║║║╚═╗║╣   ║║║║╚═╗ ║ ╠═╣║  ║  ║╣  ║║  ╚═╗║ ║╠╣  ║ ║║║╠═╣╠╦╝║╣   ╠═╝╠═╣║  ╠╩╗╠═╣║ ╦║╣ ╚═╗
-#  ╚═╝╩╚═╚═╝╚╩╝╚═╝╚═╝  ╩╝╚╝╚═╝ ╩ ╩ ╩╩═╝╩═╝╚═╝═╩╝  ╚═╝╚═╝╚   ╩ ╚╩╝╩ ╩╩╚═╚═╝  ╩  ╩ ╩╚═╝╩ ╩╩ ╩╚═╝╚═╝╚═╝
-- industryName: Browse installed software packages
-  documentationUrl: https://fleetdm.com/docs/rest-api/rest-api#software
+#   ╦╦ ╦╔═╗╔╦╗  ╦╔╗╔  ╔╦╗╦╔╦╗╔═╗  ╔═╗╦═╗╔═╗╦  ╦╦╔═╗╦╔═╗╔╗╔╦╔╗╔╔═╗
+#   ║║ ║╚═╗ ║───║║║║───║ ║║║║║╣   ╠═╝╠╦╝║ ║╚╗╔╝║╚═╗║║ ║║║║║║║║║ ╦
+#  ╚╝╚═╝╚═╝ ╩   ╩╝╚╝   ╩ ╩╩ ╩╚═╝  ╩  ╩╚═╚═╝ ╚╝ ╩╚═╝╩╚═╝╝╚╝╩╝╚╝╚═╝
+- industryName: Automatic user creation (JIT, SCIM)
+  description: Auto-create and manipulate Fleet users from Okta, etc with just-in-time (JIT) provisioning.
+  documentationUrl: https://fleetdm.com/docs/deploy/single-sign-on-sso#just-in-time-jit-user-provisioning
   productCategories: [Endpoint operations,Device management,Vulnerability management]
-  pricingTableCategories: [Endpoint operations]
-  tier: Free
-  jamfProHasFeature: yes
-  jamfProtectHasFeature: no
-#  
-#  ╔╦╗╦ ╦╔═╗   ╔═╗╔═╗╔═╗╔╦╗╔═╗╦═╗  ╔═╗╦ ╦╔╦╗╦ ╦╔═╗╔╗╔╔╦╗╦╔═╗╔═╗╔╦╗╦╔═╗╔╗╔
-#   ║ ║║║║ ║───╠╣ ╠═╣║   ║ ║ ║╠╦╝  ╠═╣║ ║ ║ ╠═╣║╣ ║║║ ║ ║║  ╠═╣ ║ ║║ ║║║║
-#   ╩ ╚╩╝╚═╝   ╚  ╩ ╩╚═╝ ╩ ╚═╝╩╚═  ╩ ╩╚═╝ ╩ ╩ ╩╚═╝╝╚╝ ╩ ╩╚═╝╩ ╩ ╩ ╩╚═╝╝╚╝
-- industryName: Two-factor authentication
-  moreInfoUrl: https://github.com/fleetdm/fleet/issues/5478
-  productCategories: [Endpoint operations,Device management,Vulnerability management]
-  pricingTableCategories: [Endpoint operations]
-  usualDepartment: IT
-  tier: Free
-  jamfProHasFeature: yes
-  jamfProtectHasFeature: yes
-  waysToUse:
-    - description: Enforce two-factor authentication when logging in to Fleet for added security.
-  comingSoonOn: 2024-12-31 #customer-rosner
-#  
-#  ╔═╗╦ ╦╔═╗╔╦╗╔═╗╔╦╗  ╔═╗╔═╗╦═╗  ╔═╗╦═╗╔═╗╔═╗╔═╗  ╔╦╗╔═╗╔╦╗╔═╗╦╔╗╔  ╦╔╦╗╔═╗╔╗╔╔╦╗╦╔╦╗╦ ╦  
-#  ╚═╗╚╦╝╚═╗ ║ ║╣ ║║║  ╠╣ ║ ║╠╦╝  ║  ╠╦╝║ ║╚═╗╚═╗───║║║ ║║║║╠═╣║║║║  ║ ║║║╣ ║║║ ║ ║ ║ ╚╦╝  
-#  ╚═╝ ╩ ╚═╝ ╩ ╚═╝╩ ╩  ╚  ╚═╝╩╚═  ╚═╝╩╚═╚═╝╚═╝╚═╝  ═╩╝╚═╝╩ ╩╩ ╩╩╝╚╝  ╩═╩╝╚═╝╝╚╝ ╩ ╩ ╩  ╩   
-#  ╔╦╗╔═╗╔╗╔╔═╗╔═╗╔═╗╔╦╗╔═╗╔╗╔╔╦╗  ╔═╗╦═╗╔═╗╦  ╦╦╔═╗╦╔═╗╔╗╔╦╔╗╔╔═╗                         
-#  ║║║╠═╣║║║╠═╣║ ╦║╣ ║║║║╣ ║║║ ║   ╠═╝╠╦╝║ ║╚╗╔╝║╚═╗║║ ║║║║║║║║║ ╦                         
-#  ╩ ╩╩ ╩╝╚╝╩ ╩╚═╝╚═╝╩ ╩╚═╝╝╚╝ ╩   ╩  ╩╚═╚═╝ ╚╝ ╩╚═╝╩╚═╝╝╚╝╩╝╚╝╚═╝                         
-- industryName: System for Cross-domain Identity Management (SCIM) provisioning
-  moreInfoUrl: https://github.com/fleetdm/fleet/issues/15671
-  productCategories: [Endpoint operations,Device management,Vulnerability management]
-  pricingTableCategories: [Endpoint operations]
+  pricingTableCategories: [Integrations]
   usualDepartment: IT
   tier: Premium
-  comingSoonOn: 2024-12-31 #customer-rosner
-#  
-#  ╔═╗╔═╗╔═╗╦═╗╔═╗╦ ╦  ╔╦╗╔═╗╦  ╦╦╔═╗╔═╗╔═╗  ╔╗ ╦ ╦  ╦╔═╗  ╔═╗╔═╗╦═╗╦╔═╗╦     
-#  ╚═╗║╣ ╠═╣╠╦╝║  ╠═╣   ║║║╣ ╚╗╔╝║║  ║╣ ╚═╗  ╠╩╗╚╦╝  ║╠═╝  ╚═╗║╣ ╠╦╝║╠═╣║     
-#  ╚═╝╚═╝╩ ╩╩╚═╚═╝╩ ╩  ═╩╝╚═╝ ╚╝ ╩╚═╝╚═╝╚═╝  ╚═╝ ╩   ╩╩┘   ╚═╝╚═╝╩╚═╩╩ ╩╩═╝┘  
-#  ╦ ╦╔═╗╔═╗╔╦╗╔╗╔╔═╗╔╦╗╔═╗   ╦ ╦╦ ╦╦╔╦╗                                      
-#  ╠═╣║ ║╚═╗ ║ ║║║╠═╣║║║║╣    ║ ║║ ║║ ║║                                      
-#  ╩ ╩╚═╝╚═╝ ╩ ╝╚╝╩ ╩╩ ╩╚═╝┘  ╚═╝╚═╝╩═╩╝                                      
-- industryName: Search devices by IP, serial, hostname, UUID
-  documentationUrl: https://fleetdm.com/docs/rest-api/rest-api#hosts
-  productCategories: [Endpoint operations,Device management]
-  pricingTableCategories: [Endpoint operations]
-  tier: Free
   jamfProHasFeature: yes
-  jamfProtectHasFeature: yes
-# 
-#  ╦  ╔═╗╔╗ ╔═╗╦  ╔═╗  ╔═╗╔═╗ ╦    ╔╦╗╦═╗╦╦  ╦╔═╗╔╗╔
-#  ║  ╠═╣╠╩╗║╣ ║  ╚═╗  ╚═╗║═╬╗║─────║║╠╦╝║╚╗╔╝║╣ ║║║
-#  ╩═╝╩ ╩╚═╝╚═╝╩═╝╚═╝  ╚═╝╚═╝╚╩═╝  ═╩╝╩╚═╩ ╚╝ ╚═╝╝╚╝
-- industryName: Labels (SQL-driven)
-  documentationUrl: https://fleetdm.com/docs/rest-api/rest-api#add-label
-  friendlyName: Filter hosts using SQL
-  productCategories: [Endpoint operations,Device management,Vulnerability management]
-  pricingTableCategories: [Endpoint operations]
-  usualDepartment: IT
-  tier: Free
-  jamfProHasFeature: no
   jamfProtectHasFeature: no
-#  
-#  ╦  ╦╔═╗╦═╗╔═╗╦╔═╗╔╗╔╔═╗╔╗ ╦  ╔═╗  ╔═╗ ╦ ╦╔═╗╦═╗╦╔═╗╔═╗  ╔═╗╔╗╔╔╦╗  ╔═╗╔═╗╔╗╔╔═╗╦╔═╗  
-#  ╚╗╔╝║╣ ╠╦╝╚═╗║║ ║║║║╠═╣╠╩╗║  ║╣   ║═╬╗║ ║║╣ ╠╦╝║║╣ ╚═╗  ╠═╣║║║ ║║  ║  ║ ║║║║╠╣ ║║ ╦  
-#   ╚╝ ╚═╝╩╚═╚═╝╩╚═╝╝╚╝╩ ╩╚═╝╩═╝╚═╝  ╚═╝╚╚═╝╚═╝╩╚═╩╚═╝╚═╝  ╩ ╩╝╚╝═╩╝  ╚═╝╚═╝╝╚╝╚  ╩╚═╝  
-#  ╔═╗╦╔╦╗╔═╗╔═╗╔═╗                                                                     
-#  ║ ╦║ ║ ║ ║╠═╝╚═╗                                                                     
-#  ╚═╝╩ ╩ ╚═╝╩  ╚═╝                                                                     
-- industryName: Versionable queries and config (GitOps)
-  documentationUrl: https://fleetdm.com/guides/using-github-actions-to-apply-configuration-profiles-with-fleet#basic-article
-  tier: Free
-  jamfProHasFeature: no
-  jamfProtectHasFeature: no
-  productCategories: [Endpoint operations,Device management,Vulnerability management]
-  pricingTableCategories: [Endpoint operations]
-  usualDepartment: IT
-  demos:
-    - description: A top financial services company needed to set up rolling deployments for changes to osquery agents running on their production servers.
-      moreInfoUrl: https://docs.google.com/document/d/1UdzZMyBLbs9SUXfSXN2x2wZQCbjZZUetYlNWH6-ryqQ/edit#heading=h.2lh6ehprpvl6
-#  
-#  ╔═╗╔═╗╔═╗╔═╗╔═╗  ╔╦╗╦═╗╔═╗╔╗╔╔═╗╔═╗╔═╗╦═╗╔═╗╔╗╔╔═╗╦ ╦
-#  ╚═╗║  ║ ║╠═╝║╣    ║ ╠╦╝╠═╣║║║╚═╗╠═╝╠═╣╠╦╝║╣ ║║║║  ╚╦╝
-#  ╚═╝╚═╝╚═╝╩  ╚═╝   ╩ ╩╚═╩ ╩╝╚╝╚═╝╩  ╩ ╩╩╚═╚═╝╝╚╝╚═╝ ╩ 
-- industryName: Scope transparency
-  tier: Free
-  documentationUrl: https://fleetdm.com/transparency
-  productCategories: [Endpoint operations]
-  pricingTableCategories: [Endpoint operations]
-#  
-#  ╔═╗╦ ╦╔╦╗╦╔╦╗  ╦  ╔═╗╔═╗  ╔═╗╔═╗  ╔═╗╔═╗╔╦╗╦╦  ╦╦╔╦╗╦ ╦
-#  ╠═╣║ ║ ║║║ ║   ║  ║ ║║ ╦  ║ ║╠╣   ╠═╣║   ║ ║╚╗╔╝║ ║ ╚╦╝
-#  ╩ ╩╚═╝═╩╝╩ ╩   ╩═╝╚═╝╚═╝  ╚═╝╚    ╩ ╩╚═╝ ╩ ╩ ╚╝ ╩ ╩  ╩ 
-- industryName: Audit log of activity (queries, scripts, logins, etc)
-  documentationUrl: https://fleetdm.com/docs/rest-api/rest-api#list-activities
-  productCategories: [Endpoint operations, Device management]
-  pricingTableCategories: [Endpoint operations]
-  tier: Premium
-  jamfProHasFeature: yes
-  jamfProtectHasFeature: yes
-  usualDepartment: Security
-  waysToUse:
-    - description: Export activity of Fleet admins to your SIEM or data lake
-#  
-#  ╔═╗ ╦ ╦╔═╗╦═╗╦ ╦  ╔═╗╔═╗╦═╗╔═╗╔═╗╦═╗╔╦╗╔═╗╔╗╔╔═╗╔═╗  ╔╦╗╔═╗╔╗╔╦╔╦╗╔═╗╦═╗╦╔╗╔╔═╗
-#  ║═╬╗║ ║║╣ ╠╦╝╚╦╝  ╠═╝║╣ ╠╦╝╠╣ ║ ║╠╦╝║║║╠═╣║║║║  ║╣   ║║║║ ║║║║║ ║ ║ ║╠╦╝║║║║║ ╦
-#  ╚═╝╚╚═╝╚═╝╩╚═ ╩   ╩  ╚═╝╩╚═╚  ╚═╝╩╚═╩ ╩╩ ╩╝╚╝╚═╝╚═╝  ╩ ╩╚═╝╝╚╝╩ ╩ ╚═╝╩╚═╩╝╚╝╚═╝
-- industryName: Query performance monitoring
-  documentationUrl: https://fleetdm.com/docs/get-started/faq#will-fleet-slow-down-my-servers-what-about-my-employee-laptops
-  tier: Free
-  jamfProHasFeature: no
-  jamfProtectHasFeature: no
-  productCategories: [Endpoint operations]
-  pricingTableCategories: [Endpoint operations]
-  demos:
-    - description: A top software company needed to understand the performance impact of osquery queries before running them on all of their production Linux servers.
-      moreInfoUrl: https://docs.google.com/document/d/1WzMc8GJCRU6tTBb6gLsSTzFysqtXO8CtP2sXMPKgYSk/edit?disco=AAAA6xuVxGg
-    - description: A top software company wanted to detect regressions when adding/changing queries and fail builds if queries were too expensive.
-      moreInfoUrl: https://docs.google.com/document/d/1WzMc8GJCRU6tTBb6gLsSTzFysqtXO8CtP2sXMPKgYSk/edit?disco=AAAA6xuVxGg
-  waysToUse:
-    - description: Monitor performance for automated queries.
-    - description: Monitor performance for live queries.
-      moreInfoUrl: https://github.com/fleetdm/fleet/issues/467
-#  
-#  ╔╦╗╔═╗╔╦╗╔═╗╔═╗╔╦╗  ╔═╗╔╗╔╔╦╗  ╔═╗╦ ╦╦═╗╔═╗╔═╗╔═╗╔═╗  ╦╔═╗╔═╗╦ ╦╔═╗╔═╗  ╦ ╦╦╔╦╗╦ ╦  
-#   ║║║╣  ║ ║╣ ║   ║   ╠═╣║║║ ║║  ╚═╗║ ║╠╦╝╠╣ ╠═╣║  ║╣   ║╚═╗╚═╗║ ║║╣ ╚═╗  ║║║║ ║ ╠═╣  
-#  ═╩╝╚═╝ ╩ ╚═╝╚═╝ ╩   ╩ ╩╝╚╝═╩╝  ╚═╝╚═╝╩╚═╚  ╩ ╩╚═╝╚═╝  ╩╚═╝╚═╝╚═╝╚═╝╚═╝  ╚╩╝╩ ╩ ╩ ╩  
-#  ╔╦╗╔═╗╦  ╦╦╔═╗╔═╗╔═╗                                                                
-#   ║║║╣ ╚╗╔╝║║  ║╣ ╚═╗                                                                
-#  ═╩╝╚═╝ ╚╝ ╩╚═╝╚═╝╚═╝                                                                
-- industryName: Detect and surface issues with devices (policies)
-  documentationUrl: https://fleetdm.com/docs/get-started/anatomy#policy
-  productCategories: [Endpoint operations,Device management]
-  pricingTableCategories: [Endpoint operations]
-  usualDepartment: IT
-  tier: Free
-  jamfProHasFeature: yes
-  jamfProtectHasFeature: yes
-#  
-#  ╔═╗╦  ╔═╗═╗ ╦╦╔╗ ╦  ╔═╗  ╦  ╔═╗╔═╗  ╔╦╗╔═╗╔═╗╔╦╗╦╔╗╔╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
-#  ╠╣ ║  ║╣ ╔╩╦╝║╠╩╗║  ║╣   ║  ║ ║║ ╦   ║║║╣ ╚═╗ ║ ║║║║╠═╣ ║ ║║ ║║║║╚═╗
-#  ╚  ╩═╝╚═╝╩ ╚═╩╚═╝╩═╝╚═╝  ╩═╝╚═╝╚═╝  ═╩╝╚═╝╚═╝ ╩ ╩╝╚╝╩ ╩ ╩ ╩╚═╝╝╚╝╚═╝
-- industryName: Flexible log destinations (AWS Kinesis, Lambda, GCP, Kafka)
-  documentationUrl: https://fleetdm.com/docs/using-fleet/log-destinations#log-destinations
-  tier: Free
-  jamfProHasFeature: yes
-  jamfProtectHasFeature: yes
-  usualDepartment: Security
-  productCategories: [Endpoint operations]
-  pricingTableCategories: [Endpoint operations]
-  buzzwords: [Real-time export,Ship logs]
-#  
-#  ╔═╗╦╦  ╔═╗  ╔═╗╔═╗╦═╗╦  ╦╦╔╗╔╔═╗
-#  ╠╣ ║║  ║╣   ║  ╠═╣╠╦╝╚╗╔╝║║║║║ ╦
-#  ╚  ╩╩═╝╚═╝  ╚═╝╩ ╩╩╚═ ╚╝ ╩╝╚╝╚═╝
-- industryName: File carving (AWS S3)
-  documentationUrl: https://fleetdm.com/docs/configuration/fleet-server-configuration#s-3-file-carving-backend
-  tier: Free
-  jamfProHasFeature: no
-  jamfProtectHasFeature: no
-  usualDepartment: Security
-  productCategories: [Endpoint operations]
-  pricingTableCategories: [Endpoint operations]
+  # System for Cross-domain Identity Management (SCIM) provisioning comingSoonOn: 2024-12-31 #customer-rosner, https://github.com/fleetdm/fleet/issues/15671
 #
-#  ╦  ╦╔═╗╦═╗╦╔═╗╔╗ ╦  ╔═╗  ╔═╗╔╗╔╦═╗╔═╗╦  ╦  ╔╦╗╔═╗╔╗╔╔╦╗
-#  ╚╗╔╝╠═╣╠╦╝║╠═╣╠╩╗║  ║╣   ║╣ ║║║╠╦╝║ ║║  ║  ║║║║╣ ║║║ ║
-#   ╚╝ ╩ ╩╩╚═╩╩ ╩╚═╝╩═╝╚═╝  ╚═╝╝╚╝╩╚═╚═╝╩═╝╩═╝╩ ╩╚═╝╝╚╝ ╩
-- industryName: Variable enrollment
-  description: Enroll hosts in different groups using different enrollment secrets and/or installers per-baseline.
-  documentationUrl: https://fleetdm.com/docs/using-fleet/segment-hosts
-  tier: Premium
-  jamfProHasFeature: yes
-  jamfProtectHasFeature: no
-  productCategories: [Endpoint operations, Device management]
-  pricingTableCategories: [Endpoint operations]
+#  ╔╦╗╦ ╦╦╦═╗╔╦╗   ╔═╗╔═╗╦═╗╔╦╗╦ ╦  ╔═╗╦ ╦╔╦╗╔═╗╔╦╗╔═╗╔╦╗╦╔═╗╔╗╔
+#   ║ ╠═╣║╠╦╝ ║║───╠═╝╠═╣╠╦╝ ║ ╚╦╝  ╠═╣║ ║ ║ ║ ║║║║╠═╣ ║ ║║ ║║║║
+#   ╩ ╩ ╩╩╩╚══╩╝   ╩  ╩ ╩╩╚═ ╩  ╩   ╩ ╩╚═╝ ╩ ╚═╝╩ ╩╩ ╩ ╩ ╩╚═╝╝╚╝
+- industryName: Third-party automation
+  friendlyName: Borrow off-the-shelf tactics from the community
+  documentationUrl: https://fleetdm.com/integrations
+  productCategories: [Endpoint operations,Device management,Vulnerability management]
+  pricingTableCategories: [Integrations]
   usualDepartment: IT
-#
-#  ╔═╗╦═╗╦╦  ╦╔═╗╔╦╗╔═╗  ╦ ╦╔═╗╔╦╗╔═╗╔╦╗╔═╗  ╦═╗╔═╗╔═╗╦╔═╗╔╦╗╦═╗╦ ╦
-#  ╠═╝╠╦╝║╚╗╔╝╠═╣ ║ ║╣   ║ ║╠═╝ ║║╠═╣ ║ ║╣   ╠╦╝║╣ ║ ╦║╚═╗ ║ ╠╦╝╚╦╝
-#  ╩  ╩╚═╩ ╚╝ ╩ ╩ ╩ ╚═╝  ╚═╝╩  ═╩╝╩ ╩ ╩ ╚═╝  ╩╚═╚═╝╚═╝╩╚═╝ ╩ ╩╚═ ╩
-- industryName: Private update registry
-  friendlyName: Update agents from a secret URL
-  description: Load agent code from a secret URL that you manage.
-  documentationUrl: https://fleetdm.com/docs/using-fleet/update-agents
-  tier: Premium
-  jamfProHasFeature: no
-  jamfProtectHasFeature: no
-  productCategories: [Endpoint operations]
-  pricingTableCategories: [Endpoint operations]
-  usualDepartment: Security
-#
-#  ╦  ╦╔═╗╦═╗╦╔═╗╔╗ ╦  ╔═╗  ╔═╗╔═╗╔═╗╔╗╔╔╦╗  ╦  ╦╔═╗╦═╗╔═╗╦╔═╗╔╗╔╔═╗
-#  ╚╗╔╝╠═╣╠╦╝║╠═╣╠╩╗║  ║╣   ╠═╣║ ╦║╣ ║║║ ║   ╚╗╔╝║╣ ╠╦╝╚═╗║║ ║║║║╚═╗
-#   ╚╝ ╩ ╩╩╚═╩╩ ╩╚═╝╩═╝╚═╝  ╩ ╩╚═╝╚═╝╝╚╝ ╩    ╚╝ ╚═╝╩╚═╚═╝╩╚═╝╝╚╝╚═╝
-- industryName: Variable agent versions
-  descrption: Manage agents remotely by setting different versions per-baseline.
-  documentationUrl: https://fleetdm.com/docs/configuration/agent-configuration#configure-fleetd-update-channels
-  tier: Premium
-  jamfProHasFeature: no
-  jamfProtectHasFeature: no
-  productCategories: [Endpoint operations]
-  pricingTableCategories: [Endpoint operations]
-  usualDepartment: IT
-#
-#  ╔═╗╦ ╦╔═╗╔╦╗╔═╗╔╦╗  ╔╦╗╔═╗╔╗ ╦  ╔═╗╔═╗
-#  ║  ║ ║╚═╗ ║ ║ ║║║║   ║ ╠═╣╠╩╗║  ║╣ ╚═╗
-#  ╚═╝╚═╝╚═╝ ╩ ╚═╝╩ ╩   ╩ ╩ ╩╚═╝╩═╝╚═╝╚═╝
-- industryName: Custom tables
-  friendlyName: Add tables to osquery with extensions
-  description: Install osquery extensions over the air. #  (GitOptional)
-  documentationUrl: https://fleetdm.com/docs/configuration/agent-configuration#extensions
-  moreInfoUrl: https://github.com/trailofbits/osquery-extensions/blob/3df2b72ad78549e25344c79dbc9bce6808c4d92a/README.md#extensions
-  tier: Premium
-  jamfProHasFeature: no
-  jamfProtectHasFeature: no
-  productCategories: [Endpoint operations]
-  pricingTableCategories: [Endpoint operations]
-  usualDepartment: IT
-#  
-#  ╔╗ ╔═╗╔═╗╔═╗╦  ╦╔╗╔╔═╗╔═╗  ╔╦╗╔═╗╦  ╦╦╔═╗╔═╗  ╔═╗╦═╗╔═╗╦ ╦╔═╗╔═╗
-#  ╠╩╗╠═╣╚═╗║╣ ║  ║║║║║╣ ╚═╗   ║║║╣ ╚╗╔╝║║  ║╣   ║ ╦╠╦╝║ ║║ ║╠═╝╚═╗
-#  ╚═╝╩ ╩╚═╝╚═╝╩═╝╩╝╚╝╚═╝╚═╝  ═╩╝╚═╝ ╚╝ ╩╚═╝╚═╝  ╚═╝╩╚═╚═╝╚═╝╩  ╚═╝
-- industryName: Baselines (device groups)
-  friendlyName: Manage different endpoints differently
-  documentationUrl: https://fleetdm.com/docs/using-fleet/segment-hosts
-  description: Set baselines and strategies for hosts in different situations called "teams", and move hosts between them via API-driven automations or a simple, delegatable user interface with role-based access.
-  tier: Premium
+  description: Plug Fleet into other frameworks and tools like Tines, Snowflake, Terraform, Chronicle, Jira, Zendesk, etc
+  moreInfoUrl: https://fleetdm.com/integrations
+  tier: Free
   jamfProHasFeature: yes
   jamfProtectHasFeature: yes
-  productCategories: [Endpoint operations,Device management,Vulnerability management]
-  pricingTableCategories: [Endpoint operations]
   waysToUse:
-    - description: Automate remediation for different applications with different security postures (cloud security engineering)
-#  
-#  ╔═╗╔═╗╔╗╔╔═╗╦═╗╔═╗╔╦╗╔═╗  ╦═╗╔═╗╔═╗╔═╗╦═╗╔╦╗╔═╗  ╔═╗╔═╗╦═╗  ╔═╗╦═╗╔═╗╦ ╦╔═╗╔═╗  
-#  ║ ╦║╣ ║║║║╣ ╠╦╝╠═╣ ║ ║╣   ╠╦╝║╣ ╠═╝║ ║╠╦╝ ║ ╚═╗  ╠╣ ║ ║╠╦╝  ║ ╦╠╦╝║ ║║ ║╠═╝╚═╗   
-#  ╚═╝╚═╝╝╚╝╚═╝╩╚═╩ ╩ ╩ ╚═╝  ╩╚═╚═╝╩  ╚═╝╩╚═ ╩ ╚═╝  ╚  ╚═╝╩╚═  ╚═╝╩╚═╚═╝╚═╝╩  ╚═╝      
-#  ╔═╗╔═╗ ╔╦╗╔═╗╦  ╦╦╔═╗╔═╗╔═╗                                                                    
-#  ║ ║╠╣   ║║║╣ ╚╗╔╝║║  ║╣ ╚═╗                                                                    
-#  ╚═╝╚   ═╩╝╚═╝ ╚╝ ╩╚═╝╚═╝╚═╝                                                                    
-- industryName: Generate reports for groups of devices
-  documentationUrl: https://fleetdm.com/docs/rest-api/rest-api#get-query-report
+    - description: (ActiveDirectory) Know who opened your computer and check their device posture before you let them log into anything.
+    - description: (Ansible) Easily issue MDM commands and standardize data across operating systems.
+    - description: (AWS) Deploy your own self-managed Fleet in any AWS environment in minutes.
+    - description: (Azure) Deploy your own self-managed Fleet in the Microsoft Cloud in minutes.
+    - description: (Chef) Easily issue MDM commands and standardize data across operating systems.
+    - description: (Elastic) Ingest osquery data and monitor for important changes or events.
+    - description: (GitHub) Version control using git, enabling collaboration and a GitOps workflow.
+    - description: (GitLab) Version control using git, enabling collaboration and a GitOps workflow.
+    - description: (Chronicle) Ingest osquery data and monitor for important changes or events.
+    - description: (Google Cloud) Deploy your own self-managed Fleet in any GCP environment in minutes.
+    - description: (Munki) Easily issue MDM commands and standardize data across operating systems.
+    - description: (Okta) Know who opened your computer and check their device posture before you let them log into anything.
+    - description: (Snowflake) Ingest osquery data and monitor for important changes or events.
+    - description: (Splunk) Ingest osquery data and monitor for important changes or events.
+    - description: (Tines) Build custom workflows that trigger in various situations.
+    - description: (Webhooks) Configure automations that send webhooks to specific URLs when Fleet detects changes to host, policy, and CVE statuses.
+    - description: (Zendesk) Automatically create Zendesk tickets in various situations.
+    - description: (Jira) Automatically create Jira tickets in various situations, including exporting vulnerabilities to Jira and syncing tickets.
+  buzzwords: [Snowflake,Okta,Tines,Splunk,Elastic,AWS,ActiveDirectory,Ansible,GitHub,GitLab,Chronicle,Google Cloud,Munki,Vanta,Chef,Zendesk,Jira]
+#
+#  ╔╦╗╦ ╦╦╦═╗╔╦╗   ╔═╗╔═╗╦═╗╔╦╗╦ ╦  ╔═╗╦═╗╔═╗╦ ╦╔═╗╔═╗╔╦╗╦═╗╔═╗╔╦╗╦╔═╗╔╗╔
+#   ║ ╠═╣║╠╦╝ ║║───╠═╝╠═╣╠╦╝ ║ ╚╦╝  ║ ║╠╦╝║  ╠═╣║╣ ╚═╗ ║ ╠╦╝╠═╣ ║ ║║ ║║║║
+#   ╩ ╩ ╩╩╩╚══╩╝   ╩  ╩ ╩╩╚═ ╩  ╩   ╚═╝╩╚═╚═╝╩ ╩╚═╝╚═╝ ╩ ╩╚═╩ ╩ ╩ ╩╚═╝╝╚╝
+- industryName: Third-party orchestration
+  friendlyName: Borrow off-the-shelf tactics from legendary brands
+  documentationUrl: https://fleetdm.com/integrations
+  description: Plug Fleet into other frameworks and tools like Puppet, Vanta, etc.
   productCategories: [Endpoint operations,Device management,Vulnerability management]
-  pricingTableCategories: [Endpoint operations]
+  pricingTableCategories: [Integrations]
   usualDepartment: IT
+  moreInfoUrl: https://fleetdm.com/integrations
   tier: Premium
-  jamfProHasFeature: yes
-  jamfProtectHasFeature: yes
-#  
-#  ╦═╗╔═╗╦  ╔═╗  ╔╗ ╔═╗╔═╗╔═╗╔╦╗  ╔═╗╔═╗╔═╗╔═╗╔═╗╔═╗  ╔═╗╔═╗╔╗╔╔╦╗╦═╗╔═╗╦  
-#  ╠╦╝║ ║║  ║╣───╠╩╗╠═╣╚═╗║╣  ║║  ╠═╣║  ║  ║╣ ╚═╗╚═╗  ║  ║ ║║║║ ║ ╠╦╝║ ║║  
-#  ╩╚═╚═╝╩═╝╚═╝  ╚═╝╩ ╩╚═╝╚═╝═╩╝  ╩ ╩╚═╝╚═╝╚═╝╚═╝╚═╝  ╚═╝╚═╝╝╚╝ ╩ ╩╚═╚═╝╩═╝
-- industryName: Role-based access control
-  documentationUrl: https://fleetdm.com/docs/using-fleet/manage-access#manage-access
-  productCategories: [Endpoint operations,Device management,Vulnerability management]
-  pricingTableCategories: [Endpoint operations]
-  usualDepartment: IT
-  tier: Premium
-  jamfProHasFeature: yes
-  jamfProtectHasFeature: yes
-#  
-#  ╔═╗╔═╗╦  ╦╔═╗╦ ╦  ╔═╗╔═╗╔═╗╦═╗╦╔╗╔╔═╗
-#  ╠═╝║ ║║  ║║  ╚╦╝  ╚═╗║  ║ ║╠╦╝║║║║║ ╦
-#  ╩  ╚═╝╩═╝╩╚═╝ ╩   ╚═╝╚═╝╚═╝╩╚═╩╝╚╝╚═╝
-- industryName: Policy scoring
-  documentationUrl: 
-  friendlyName: Mark policies as critical
-  productCategories: [Endpoint operations,Device management]
-  pricingTableCategories: [Endpoint operations]
-  usualDepartment: IT
-  tier: Premium
-  jamfProHasFeature: no
-  jamfProtectHasFeature: no
   waysToUse:
-    - description: Block access to corporate apps if your end users are failing a specific number of critical policies.
-      moreInfoUrl: https://github.com/fleetdm/fleet/issues/16206
+    - description: (Vanta) Trigger a workflow based on a failing policy.
+    - description: (Puppet) Easily issue MDM commands, standardize data across operating systems, and map macOS+Windows settings to computers with the Puppet module.
+    - description: (Torq) Build custom workflows that trigger in various situations.
+    - description: (Custom IdP) Manage access to Fleet single sign-on (SSO) through any IdP (using SAML).
+  buzzwords: [Vanta,Puppet,Custom IdP]
+#  
+#  ╔╦╗╦ ╦╔╗╔╦╔═╦  ╔═╗╔═╗╔╦╗╔═╗╔═╗╔╦╗╦╔╗ ╦╦  ╦╔╦╗╦ ╦ 
+#  ║║║║ ║║║║╠╩╗║  ║  ║ ║║║║╠═╝╠═╣ ║ ║╠╩╗║║  ║ ║ ╚╦╝ 
+#  ╩ ╩╚═╝╝╚╝╩ ╩╩  ╚═╝╚═╝╩ ╩╩  ╩ ╩ ╩ ╩╚═╝╩╩═╝╩ ╩  ╩  
+- industryName: Munki compatibility + visibility
+  tier: Premium
+  jamfProHasFeature: yes
+  jamfProtectHasFeature: yes
+  usualDepartment: IT
+  productCategories: [Device management]
+  pricingTableCategories: [Integrations]
 #
 #
 #  ███████╗██╗   ██╗██████╗ ██████╗  ██████╗ ██████╗ ████████╗
@@ -1237,261 +1227,353 @@
   jamfProHasFeature: no
   jamfProtectHasFeature: no
 #
-#  ██████╗ ███████╗██████╗ ██╗      ██████╗ ██╗   ██╗███╗   ███╗███████╗███╗   ██╗████████╗
-#  ██╔══██╗██╔════╝██╔══██╗██║     ██╔═══██╗╚██╗ ██╔╝████╗ ████║██╔════╝████╗  ██║╚══██╔══╝
-#  ██║  ██║█████╗  ██████╔╝██║     ██║   ██║ ╚████╔╝ ██╔████╔██║█████╗  ██╔██╗ ██║   ██║   
-#  ██║  ██║██╔══╝  ██╔═══╝ ██║     ██║   ██║  ╚██╔╝  ██║╚██╔╝██║██╔══╝  ██║╚██╗██║   ██║   
-#  ██████╔╝███████╗██║     ███████╗╚██████╔╝   ██║   ██║ ╚═╝ ██║███████╗██║ ╚████║   ██║   
-#  ╚═════╝ ╚══════╝╚═╝     ╚══════╝ ╚═════╝    ╚═╝   ╚═╝     ╚═╝╚══════╝╚═╝  ╚═══╝   ╚═╝   
-#         
+# 
 #
-#  ╔═╗╦╔╦╗╔═╗╔═╗╔═╗
-#  ║ ╦║ ║ ║ ║╠═╝╚═╗
-#  ╚═╝╩ ╩ ╚═╝╩  ╚═╝
-- industryName: GitOps
-  friendlyName: Manage endpoints in git
-  documentationUrl: https://github.com/fleetdm/fleet-gitops
-  description: Fork the best practices repo and use the GitHub Action to hook it up to your Fleet instance in minutes.
-  productCategories: [Endpoint operations,Device management,Vulnerability management]
-  pricingTableCategories: [Deployment]
-  usualDepartment: IT
-  tier: Free
-  jamfProHasFeature: yes
-  jamfProtectHasFeature: yes
-  demos:
-    description: A top savings and investment company wanted workflows and automation so that one bad actor can't brick their fleet.  This way, they have to make a pull request first.
-    quote: I don't want one bad actor to brick my fleet.  I want them to make a pull request first.
-    moreInfoUrl: https://docs.google.com/document/d/1hAQL6P--Tt3syq1MTRONAxhQA_2Vjt3oOJJt_O4xbiE/edit?disco=AAABAVnYvns&usp_dm=true#heading=h.7en766pueek4
-#  
-#  ╔═╗╔═╗╦  ╔═╗  ╦ ╦╔═╗╔═╗╔╦╗╔═╗╔╦╗
-#  ╚═╗║╣ ║  ╠╣───╠═╣║ ║╚═╗ ║ ║╣  ║║
-#  ╚═╝╚═╝╩═╝╚    ╩ ╩╚═╝╚═╝ ╩ ╚═╝═╩╝
-- industryName: Self-hosted
-  friendlyName: Host it yourself
-  description: Deploy Fleet anywhere and host it yourself, even in air-gapped environments except where technologically impossible.
-  pricingTableCategories: [Deployment]
-  documentationUrl: https://fleetdm.com/docs/deploy/introduction
-  productCategories: [Endpoint operations,Device management,Vulnerability management]
-  tier: Free
-  jamfProHasFeature: yes
-  jamfProtectHasFeature: no
-  buzzwords: [Self-hosted]
-#  
-#  ╔╦╗╔═╗╔═╗╦  ╔═╗╦ ╦╔╦╗╔═╗╔╗╔╔╦╗  ╔╦╗╔═╗╔═╗╦  ╔═╗  ╔╦╗╔═╗╦═╗╦═╗╔═╗╔═╗╔═╗╦═╗╔╦╗   ╦ ╦╔═╗╦  ╔╦╗
-#   ║║║╣ ╠═╝║  ║ ║╚╦╝║║║║╣ ║║║ ║    ║ ║ ║║ ║║  ╚═╗   ║ ║╣ ╠╦╝╠╦╝╠═╣╠╣ ║ ║╠╦╝║║║   ╠═╣║╣ ║  ║║║
-#  ═╩╝╚═╝╩  ╩═╝╚═╝ ╩ ╩ ╩╚═╝╝╚╝ ╩    ╩ ╚═╝╚═╝╩═╝╚═╝   ╩ ╚═╝╩╚═╩╚═╩ ╩╚  ╚═╝╩╚═╩ ╩┘  ╩ ╩╚═╝╩═╝╩ ╩
-- industryName: Deployment tools (Terraform, Helm)
-  documentationUrl: https://fleetdm.com/docs/deploy/introduction
-  usualDepartment: IT
-  tier: Free
-  jamfProHasFeature: no
-  jamfProtectHasFeature: no
-  productCategories: [Endpoint operations]
-  pricingTableCategories: [Deployment]
-#  
-#  ╔╦╗╔═╗╔╗╔╔═╗╔═╗╔═╗╔╦╗  ╔═╗╦  ╔═╗╦ ╦╔╦╗
-#  ║║║╠═╣║║║╠═╣║ ╦║╣  ║║  ║  ║  ║ ║║ ║ ║║
-#  ╩ ╩╩ ╩╝╚╝╩ ╩╚═╝╚═╝═╩╝  ╚═╝╩═╝╚═╝╚═╝═╩╝
-- industryName: Managed Cloud
-  description: Have Fleet host it for you (currently only available for customers with 700+ hosts.  PS. Wish we could host for you?  We're working on it!  Please let us know if you know of a good partner.  In the meantime, join fleetdm.com/support and we're happy to help you deploy Fleet yourself.)
-  pricingTableCategories: [Deployment]
-  productCategories: [Endpoint operations,Device management,Vulnerability management]
-  tier: Premium
-  jamfProHasFeature: yes
-  jamfProtectHasFeature: yes
-#  
-#  ╔╦╗╦ ╦╦ ╔╦╗╦  ╔╦╗╔═╗╔╗╔╔═╗╔╗╔╔═╗╦ ╦
-#  ║║║║ ║║  ║ ║───║ ║╣ ║║║╠═╣║║║║  ╚╦╝
-#  ╩ ╩╚═╝╩═╝╩ ╩   ╩ ╚═╝╝╚╝╩ ╩╝╚╝╚═╝ ╩ 
-- industryName: Multi-tenancy
-  description: For managed service providers to use a single instance of Fleet for multiple customers.
-  documentationUrl: https://github.com/fleetdm/fleet/issues/9956
-  productCategories: [Device management]
-  pricingTableCategories: [Deployment]
-  usualDepartment: IT
-  buzzwords: [OEM,Private label,House brand,Clear label,Multi-tenancy]
-  tier: Premium
-  comingSoonOn: 2024-08-26 #customer-deebradel
 #
-#  ██╗███╗   ██╗████████╗███████╗ ██████╗ ██████╗  █████╗ ████████╗██╗ ██████╗ ███╗   ██╗███████╗
-#  ██║████╗  ██║╚══██╔══╝██╔════╝██╔════╝ ██╔══██╗██╔══██╗╚══██╔══╝██║██╔═══██╗████╗  ██║██╔════╝
-#  ██║██╔██╗ ██║   ██║   █████╗  ██║  ███╗██████╔╝███████║   ██║   ██║██║   ██║██╔██╗ ██║███████╗
-#  ██║██║╚██╗██║   ██║   ██╔══╝  ██║   ██║██╔══██╗██╔══██║   ██║   ██║██║   ██║██║╚██╗██║╚════██║
-#  ██║██║ ╚████║   ██║   ███████╗╚██████╔╝██║  ██║██║  ██║   ██║   ██║╚██████╔╝██║ ╚████║███████║
-#  ╚═╝╚═╝  ╚═══╝   ╚═╝   ╚══════╝ ╚═════╝ ╚═╝  ╚═╝╚═╝  ╚═╝   ╚═╝   ╚═╝ ╚═════╝ ╚═╝  ╚═══╝╚══════╝
-#                                                                                                                                                                                 
 #
-#  ╦═╗╔═╗╔═╗╔╦╗  ╔═╗╔═╗╦
-#  ╠╦╝║╣ ╚═╗ ║   ╠═╣╠═╝║
-#  ╩╚═╚═╝╚═╝ ╩   ╩ ╩╩  ╩
-- industryName: REST API
-  friendlyName: Automate any feature
-  description: 
-  productCategories: [Endpoint operations,Device management,Vulnerability management]
-  pricingTableCategories: [Integrations]
-  usualDepartment: IT
-  documentationUrl: https://fleetdm.com/docs/rest-api/rest-api 
-  screenshotSrc:
-  tier: Free
-  jamfProHasFeature: yes
-  jamfProtectHasFeature: yes
-  dri: rachaelshaw
 #
-#  ╦ ╦╔═╗╔╗ ╦ ╦╔═╗╔═╗╦╔═╔═╗
-#  ║║║║╣ ╠╩╗╠═╣║ ║║ ║╠╩╗╚═╗
-#  ╚╩╝╚═╝╚═╝╩ ╩╚═╝╚═╝╩ ╩╚═╝
-- industryName: Webhooks
-  friendlyName: Automations
-  documentationUrl: https://fleetdm.com/docs/using-fleet/automations#automations
-  productCategories: [Endpoint operations,Device management,Vulnerability management]
-  pricingTableCategories: [Integrations]
-  usualDepartment: IT 
-  tier: Free
-  jamfProHasFeature: yes
-  jamfProtectHasFeature: yes
 #
-#  ╔═╗╔═╗╔╦╗╔╦╗╔═╗╔╗╔╔╦╗  ╦  ╦╔╗╔╔═╗  ╔╦╗╔═╗╔═╗╦    ┌─  ╔═╗╦  ╦  ─┐
-#  ║  ║ ║║║║║║║╠═╣║║║ ║║  ║  ║║║║║╣    ║ ║ ║║ ║║    │   ║  ║  ║   │
-#  ╚═╝╚═╝╩ ╩╩ ╩╩ ╩╝╚╝═╩╝  ╩═╝╩╝╚╝╚═╝   ╩ ╚═╝╚═╝╩═╝  └─  ╚═╝╩═╝╩  ─┘
-- industryName: Command line tool (CLI)
-  friendlyName: fleetctl
-  documentationUrl: https://fleetdm.com/docs/using-fleet/fleetctl-cli
-  productCategories: [Endpoint operations,Device management]
-  pricingTableCategories: [Integrations]
-  usualDepartment: IT
-  tier: Free
-  jamfProHasFeature: yes
-  jamfProtectHasFeature: yes
-#  
-#  ╔═╗╦═╗╔═╗╔╗╔╔╦╗  ╔═╗╔═╗╦   ╔═╗╔╗╔╦ ╦ ╦  ╔═╗╔═╗╔═╗╔═╗╔═╗╔═╗
-#  ║ ╦╠╦╝╠═╣║║║ ║   ╠═╣╠═╝║───║ ║║║║║ ╚╦╝  ╠═╣║  ║  ║╣ ╚═╗╚═╗
-#  ╚═╝╩╚═╩ ╩╝╚╝ ╩   ╩ ╩╩  ╩   ╚═╝╝╚╝╩═╝╩   ╩ ╩╚═╝╚═╝╚═╝╚═╝╚═╝
-- industryName: Grant API-only access
-  documentationUrl: https://fleetdm.com/docs/using-fleet/fleetctl-cli#using-fleetctl-with-an-api-only-user
-  productCategories: [Endpoint operations]
-  pricingTableCategories: [Integrations]
-  tier: Free
-  jamfProHasFeature: yes
-  jamfProtectHasFeature: yes
-#  
-#  ╔═╗╦╔╗╔╔═╗╦  ╔═╗  ╔═╗╦╔═╗╔╗╔  ╔═╗╔╗╔
-#  ╚═╗║║║║║ ╦║  ║╣   ╚═╗║║ ╦║║║  ║ ║║║║
-#  ╚═╝╩╝╚╝╚═╝╩═╝╚═╝  ╚═╝╩╚═╝╝╚╝  ╚═╝╝╚╝
-- industryName: Single sign on (SSO, SAML)
-  documentationUrl: https://fleetdm.com/docs/deploy/single-sign-on-sso#single-sign-on-sso
-  productCategories: [Endpoint operations,Device management,Vulnerability management]
-  pricingTableCategories: [Integrations]
-  usualDepartment: IT
-  tier: Free
-  jamfProHasFeature: yes
-  jamfProtectHasFeature: yes
-#  
-#   ╦╦ ╦╔═╗╔╦╗  ╦╔╗╔  ╔╦╗╦╔╦╗╔═╗  ╔═╗╦═╗╔═╗╦  ╦╦╔═╗╦╔═╗╔╗╔╦╔╗╔╔═╗
-#   ║║ ║╚═╗ ║───║║║║───║ ║║║║║╣   ╠═╝╠╦╝║ ║╚╗╔╝║╚═╗║║ ║║║║║║║║║ ╦
-#  ╚╝╚═╝╚═╝ ╩   ╩╝╚╝   ╩ ╩╩ ╩╚═╝  ╩  ╩╚═╚═╝ ╚╝ ╩╚═╝╩╚═╝╝╚╝╩╝╚╝╚═╝
-- industryName: Just-in-time (JIT) provisioning
-  documentationUrl: https://fleetdm.com/docs/deploy/single-sign-on-sso#just-in-time-jit-user-provisioning
-  productCategories: [Endpoint operations,Device management,Vulnerability management]
-  pricingTableCategories: [Integrations]
-  usualDepartment: IT
-  tier: Premium
-  jamfProHasFeature: yes
-  jamfProtectHasFeature: no
 #
-#  ╔╦╗╔═╗╔═╗╔═╗  ╔═╗╦ ╦╔╦╗╔═╗╔╦╗╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
-#   ║║║╣ ║╣ ╠═╝  ╠═╣║ ║ ║ ║ ║║║║╠═╣ ║ ║║ ║║║║╚═╗
-#  ═╩╝╚═╝╚═╝╩    ╩ ╩╚═╝ ╩ ╚═╝╩ ╩╩ ╩ ╩ ╩╚═╝╝╚╝╚═╝
-- industryName: Deep automations
-  friendlyName: Trigger webhooks or run scripts
-  documentationUrl: https://fleetdm.com/docs/using-fleet/automations#automations
-  description: Fire off webhooks or run scripts on hosts when certain things happen in Fleet.
-  productCategories: [Endpoint operations,Device management,Vulnerability management]
-  pricingTableCategories: [Integrations]
-  comingSoonOn: 2024-12-31
-  tier: Free
-  buzzwords: [Automated remediation,Auto-remediation,Self-healing]
-  waysToUse:
-    - description: Use policy automations to automatically remediate issues and mitigate vulnerabilities.
-    - description: Use osquery and santa to work around inflexibilities in proprietary MDMs and other protection solutions.
-    - description: Listen to webhooks to perform autonomous self-healing (cloud security engineering)
-      moreInfoUrl: https://www.fugue.co/blog/automated-remediation-scripts-vs.-self-healing-infrastructure-two-approaches-to-cloud-security
+#   █████╗ ██████╗  ██████╗██╗  ██╗██╗██╗   ██╗███████╗
+#  ██╔══██╗██╔══██╗██╔════╝██║  ██║██║██║   ██║██╔════╝
+#  ███████║██████╔╝██║     ███████║██║██║   ██║█████╗  
+#  ██╔══██║██╔══██╗██║     ██╔══██║██║╚██╗ ██╔╝██╔══╝  
+#  ██║  ██║██║  ██║╚██████╗██║  ██║██║ ╚████╔╝ ███████╗
+#  ╚═╝  ╚═╝╚═╝  ╚═╝ ╚═════╝╚═╝  ╚═╝╚═╝  ╚═══╝  ╚══════╝
 #
-#  ╦╔╗╔╔╦╗╔═╗╔═╗╦═╗╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
-#  ║║║║ ║ ║╣ ║ ╦╠╦╝╠═╣ ║ ║║ ║║║║╚═╗
-#  ╩╝╚╝ ╩ ╚═╝╚═╝╩╚═╩ ╩ ╩ ╩╚═╝╝╚╝╚═╝
-- industryName: Integrations (Tines, Snowflake, Terraform, Chronicle, Jira, Zendesk, etc)
-  friendlyName: Borrow off-the-shelf tactics from the community
-  documentationUrl: https://fleetdm.com/integrations
-  productCategories: [Endpoint operations,Device management,Vulnerability management]
-  pricingTableCategories: [Integrations]
-  usualDepartment: IT
-  description:
-  moreInfoUrl: https://fleetdm.com/integrations
-  tier: Free
-  jamfProHasFeature: yes
-  jamfProtectHasFeature: yes
-  waysToUse:
-    - description: (ActiveDirectory) Know who opened your computer and check their device posture before you let them log into anything.
-    - description: (Ansible) Easily issue MDM commands and standardize data across operating systems.
-    - description: (AWS) Deploy your own self-managed Fleet in any AWS environment in minutes.
-    - description: (Azure) Deploy your own self-managed Fleet in the Microsoft Cloud in minutes.
-    - description: (Chef) Easily issue MDM commands and standardize data across operating systems.
-    - description: (Elastic) Ingest osquery data and monitor for important changes or events.
-    - description: (GitHub) Version control using git, enabling collaboration and a GitOps workflow.
-    - description: (GitLab) Version control using git, enabling collaboration and a GitOps workflow.
-    - description: (Chronicle) Ingest osquery data and monitor for important changes or events.
-    - description: (Google Cloud) Deploy your own self-managed Fleet in any GCP environment in minutes.
-    - description: (Munki) Easily issue MDM commands and standardize data across operating systems.
-    - description: (Okta) Know who opened your computer and check their device posture before you let them log into anything.
-    - description: (Snowflake) Ingest osquery data and monitor for important changes or events.
-    - description: (Splunk) Ingest osquery data and monitor for important changes or events.
-    - description: (Tines) Build custom workflows that trigger in various situations.
-    - description: (Webhooks) Configure automations that send webhooks to specific URLs when Fleet detects changes to host, policy, and CVE statuses.
-    - description: (Zendesk) Automatically create Zendesk tickets in various situations.
-    - description: (Jira) Automatically create Jira tickets in various situations, including exporting vulnerabilities to Jira and syncing tickets.
-  buzzwords: [Snowflake,Okta,Tines,Splunk,Elastic,AWS,ActiveDirectory,Ansible,GitHub,GitLab,Chronicle,Google Cloud,Munki,Vanta,Chef,Zendesk,Jira]
 #
-#  ╔═╗╦═╗╔═╗╔╦╗╦╦ ╦╔╦╗  ╦╔╗╔╔╦╗╔═╗╔═╗╦═╗╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
-#  ╠═╝╠╦╝║╣ ║║║║║ ║║║║  ║║║║ ║ ║╣ ║ ╦╠╦╝╠═╣ ║ ║║ ║║║║╚═╗
-#  ╩  ╩╚═╚═╝╩ ╩╩╚═╝╩ ╩  ╩╝╚╝ ╩ ╚═╝╚═╝╩╚═╩ ╩ ╩ ╩╚═╝╝╚╝╚═╝
-- industryName: Premium integrations (Puppet, Vanta, etc)
-  friendlyName: Borrow off-the-shelf tactics from legendary brands
-  documentationUrl: https://fleetdm.com/integrations
-  description: Plug Fleet into other frameworks and tools.
-  productCategories: [Endpoint operations,Device management,Vulnerability management]
-  pricingTableCategories: [Integrations]
-  usualDepartment: IT
-  moreInfoUrl: https://fleetdm.com/integrations
-  tier: Premium
-  waysToUse:
-    - description: (Vanta) Trigger a workflow based on a failing policy.
-    - description: (Puppet) Easily issue MDM commands, standardize data across operating systems, and map macOS+Windows settings to computers with the Puppet module.
-    - description: (Torq) Build custom workflows that trigger in various situations.
-    - description: (Custom IdP) Manage access to Fleet single sign-on (SSO) through any IdP (using SAML).
-  buzzwords: [Vanta,Puppet,Custom IdP]
-#  
-#  ╔╦╗╦ ╦╔╗╔╦╔═╦  ╔═╗╔═╗╔╦╗╔═╗╔═╗╔╦╗╦╔╗ ╦╦  ╦╔╦╗╦ ╦ 
-#  ║║║║ ║║║║╠╩╗║  ║  ║ ║║║║╠═╝╠═╣ ║ ║╠╩╗║║  ║ ║ ╚╦╝ 
-#  ╩ ╩╚═╝╝╚╝╩ ╩╩  ╚═╝╚═╝╩ ╩╩  ╩ ╩ ╩ ╩╚═╝╩╩═╝╩ ╩  ╩  
-- industryName: Munki compatibility + visibility
-  tier: Premium
-  jamfProHasFeature: yes
-  jamfProtectHasFeature: yes
-  usualDepartment: IT
-  productCategories: [Device management]
-  pricingTableCategories: [Integrations]
+# #  ╔╦╗╔═╗╔╦╗╔═╗╔═╗╔╦╗╦╔═╗╔╗╔  ╔═╗╔╗╔╔═╗╦╔╗╔╔═╗╔═╗╦═╗╦╔╗╔╔═╗
+# #   ║║║╣  ║ ║╣ ║   ║ ║║ ║║║║  ║╣ ║║║║ ╦║║║║║╣ ║╣ ╠╦╝║║║║║ ╦
+# #  ═╩╝╚═╝ ╩ ╚═╝╚═╝ ╩ ╩╚═╝╝╚╝  ╚═╝╝╚╝╚═╝╩╝╚╝╚═╝╚═╝╩╚═╩╝╚╝╚═╝
+# - industryName: Detection engineering
+#   friendlyName: # Ship logs to your data lake and comopare with known bad binary hashes or capture behavioral data and build custom detections (e.g. using a framework like MITRE)
+#   description: 
+#   documentationUrl: https://fleetdm.com/docs/using-fleet/log-destinations
+#   tier: Free
+#   jamfProHasFeature: no
+#   jamfProtectHasFeature: yes
+#   dri: mikermcneil
+#   usualDepartment: Security
+#   productCategories: [Endpoint operations]
+#   pricingTableCategories: [Devices]
+#   buzzwords: [Security analytics,Behavioral analytics,MITRE ATT&CK,Tactics techniques and procedures (TTPs),Security information and event management (SIEM)]
+#   demos:
+#     - description: 
+#       moreInfoUrl: 
+#   waysToUse:
+#     - description: 
 #
+#
+# #  ╦╔╗╔╔╦╗╦═╗╦ ╦╔═╗╔╦╗╦╔═╗╔╗╔  ╔╦╗╔═╗╔╦╗╔═╗╔═╗╔╦╗╦╔═╗╔╗╔
+# #  ║║║║ ║ ╠╦╝║ ║╚═╗ ║ ║║ ║║║║   ║║║╣  ║ ║╣ ║   ║ ║║ ║║║║
+# #  ╩╝╚╝ ╩ ╩╚═╚═╝╚═╝ ╩ ╩╚═╝╝╚╝  ═╩╝╚═╝ ╩ ╚═╝╚═╝ ╩ ╩╚═╝╝╚╝     
+# - industryName: Intrusion detection
+#   friendlyName: Build custom query and policy automations to detect suspicious behavior
+#   description: Send webhooks and ship logs to detect intrusions and issues with devices.
+#   documentationUrl: https://fleetdm.com/docs/using-fleet/log-destinations
+#   tier: Free
+#   jamfProHasFeature: no
+#   jamfProtectHasFeature: yes
+#   usualDepartment: Security
+#   productCategories: [Endpoint operations]
+#   pricingTableCategories: [Devices]
+#   buzzwords: [Host-based intrusion detection system (HIDS,Indicators of Compromise (IOCs),Feeder for SIEM]
+#   demos:
+#     - description: A top media company wanted to share more security data with other departments without slowing down hosts.
+#   waysToUse:
+#     - description: Send webhooks to generate alerts when an IOC is detected on one or more devices.
+#     - description: Ship logs to Splunk, Snowflake, and other SIEMs to build a host-based intrusion detection system (HIDS).
+#     - description: Synchronize live state of endpoints to a data lake or SIEM in a consistent shape.
+#     - description: Export the data to other systems
+#       moreInfoUrl: https://docs.google.com/document/d/1pE9U-1E4YDiy6h4TorszrTOiFAauFiORikSUFUqW7Pk/edit
+#     - description: Export data to a third-party SIEM tool
+#       moreInfoUrl: https://www.websense.com/content/support/library/web/hosted/admin_guide/siem_integration_explain.aspx
+#     - description: Gather data and log events from endpoints
+#       moreInfoUrl: https://techbeacon.com/security/how-osquery-can-lift-your-security-teams-game#:~:text=%22If%20security%20teams%20didn%27t%20have%20osquery%2C%20they%20would%20have%20to%20find%20a%20way%20to%20manually%20go%20into%20each%20endpoint%20and%20gather%20data%2C%20or%20buy%20a%20third%2Dparty%20tool%20to%20do%20that%20for%20them
+# 
+# #  ╔╦╗╦ ╦╦═╗╔═╗╔═╗╔╦╗  ╦ ╦╦ ╦╔╗╔╔╦╗╦╔╗╔╔═╗
+# #   ║ ╠═╣╠╦╝║╣ ╠═╣ ║   ╠═╣║ ║║║║ ║ ║║║║║ ╦
+# #   ╩ ╩ ╩╩╚═╚═╝╩ ╩ ╩   ╩ ╩╚═╝╝╚╝ ╩ ╩╝╚╝╚═╝
+# - industryName: Threat hunting
+#   friendlyName: # TODO: live query
+#   description: 
+#   documentationUrl: https://fleetdm.com/queries
+#   tier: Free
+#   jamfProHasFeature: no
+#   jamfProtectHasFeature: yes
+#   dri: mikermcneil
+#   usualDepartment: Security
+#   productCategories: [Endpoint operations]
+#   pricingTableCategories: [Devices]
+#   buzzwords: []
+#   demos:
+#     - description: 
+#       moreInfoUrl: 
+#   waysToUse:
+#     - description:
+#
+#   
+# #  ╔╦╗╔═╗╔╦╗╔═╗╔═╗╔╦╗  ╔═╗╔╗╔╔╦╗  ╔═╗╦ ╦╦═╗╔═╗╔═╗╔═╗╔═╗  ╦╔═╗╔═╗╦ ╦╔═╗╔═╗  ╦ ╦╦╔╦╗╦ ╦  
+# #   ║║║╣  ║ ║╣ ║   ║   ╠═╣║║║ ║║  ╚═╗║ ║╠╦╝╠╣ ╠═╣║  ║╣   ║╚═╗╚═╗║ ║║╣ ╚═╗  ║║║║ ║ ╠═╣  
+# #  ═╩╝╚═╝ ╩ ╚═╝╚═╝ ╩   ╩ ╩╝╚╝═╩╝  ╚═╝╚═╝╩╚═╚  ╩ ╩╚═╝╚═╝  ╩╚═╝╚═╝╚═╝╚═╝╚═╝  ╚╩╝╩ ╩ ╩ ╩  
+# #  ╔╦╗╔═╗╦  ╦╦╔═╗╔═╗╔═╗                                                                
+# #   ║║║╣ ╚╗╔╝║║  ║╣ ╚═╗                                                                
+# #  ═╩╝╚═╝ ╚╝ ╩╚═╝╚═╝╚═╝                                                                
+# - industryName: Detect and surface issues with devices (policies)
+#   documentationUrl: https://fleetdm.com/docs/get-started/anatomy#policy
+#   productCategories: [Endpoint operations,Device management]
+#   pricingTableCategories: [Devices]
+#   usualDepartment: IT
+#   tier: Free
+#   jamfProHasFeature: yes
+#   jamfProtectHasFeature: yes
+#
+# 
+# #  ╔╗ ╔═╗╔╦╗╔═╗╦ ╦  ╦╔╗╔╔═╗╔╦╗╔═╗╦  ╦  ╔═╗╔╦╗╦╔═╗╔╗╔
+# #  ╠╩╗╠═╣ ║ ║  ╠═╣  ║║║║╚═╗ ║ ╠═╣║  ║  ╠═╣ ║ ║║ ║║║║
+# #  ╚═╝╩ ╩ ╩ ╚═╝╩ ╩  ╩╝╚╝╚═╝ ╩ ╩ ╩╩═╝╩═╝╩ ╩ ╩ ╩╚═╝╝╚╝
+# - industryName: Batch installation (Chef, Ansible, Puppet, MDM)
+#   friendlyName: Install agents over the air
+#   documentationUrl: https://fleetdm.com/docs/using-fleet/enroll-hosts
+#   tier: Free
+#   jamfProHasFeature: no
+#   jamfProtectHasFeature: no
+#   productCategories: [Endpoint operations]
+#   pricingTableCategories: [Devices]
+#   usualDepartment: IT
+#
+# 
+# #  ╦  ╦╦ ╦╦  ╔╗╔╔═╗╦═╗╔═╗╔╗ ╦╦  ╦╔╦╗╦ ╦  ╔╦╗╔═╗╔═╗╦ ╦╔╗ ╔═╗╔═╗╦═╗╔╦╗
+# #  ╚╗╔╝║ ║║  ║║║║╣ ╠╦╝╠═╣╠╩╗║║  ║ ║ ╚╦╝   ║║╠═╣╚═╗╠═╣╠╩╗║ ║╠═╣╠╦╝ ║║
+# #   ╚╝ ╚═╝╩═╝╝╚╝╚═╝╩╚═╩ ╩╚═╝╩╩═╝╩ ╩  ╩   ═╩╝╩ ╩╚═╝╩ ╩╚═╝╚═╝╩ ╩╩╚══╩╝
+# - industryName: Vulnerability dashboard 
+#   friendlyName: Vulnerability dashboard
+#   documentationUrl: https://fleetdm.com/vulnerability-management
+#   productCategories: [Vulnerability management]
+#   pricingTableCategories: [Devices]
+#   usualDepartment: Security
+#   tier: Premium
+#   jamfProHasFeature: no
+#   jamfProtectHasFeature: yes
+#   demos:
+#     - description: See a list of all vulnerabilities across your hosts.
+#       moreInfoUrl: https://github.com/fleetdm/fleet/issues/15919
+#     - description: AI generated CVSS v4 context. Coming soon (2024-12-31).
+#   waysToUse:
+#     - description: Easily communicate to executives regarding the progress of patching vulnerable software. Only show vulnerabilities that you care about.
+#
+#
+# #  ╔═╗╦   ╔═╗╔═╗╔╗╔╔═╗╦═╗╔═╗╔╦╗╔═╗╔╦╗  ╔╦╗╔═╗╔═╗╔═╗╦═╗╦╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
+# #  ╠═╣║───║ ╦║╣ ║║║║╣ ╠╦╝╠═╣ ║ ║╣  ║║   ║║║╣ ╚═╗║  ╠╦╝║╠═╝ ║ ║║ ║║║║╚═╗
+# #  ╩ ╩╩   ╚═╝╚═╝╝╚╝╚═╝╩╚═╩ ╩ ╩ ╚═╝═╩╝  ═╩╝╚═╝╚═╝╚═╝╩╚═╩╩   ╩ ╩╚═╝╝╚╝╚═╝
+# - industryName: AI-generated descriptions (optional)
+#   description: Optionally use AI to explain why your security policies matter.
+#   documentationUrl: https://github.com/fleetdm/fleet/issues/18187
+#   tier: Free
+#   jamfProHasFeature: no
+#   jamfProtectHasFeature: no
+#   productCategories: [Endpoint operations]
+#   pricingTableCategories: [Devices] 
+# 
+# 
+# CONSOLIDATED WITH DEVICE HEALTH       
+# #  ╔═╗╦ ╦╔╦╗╔═╗╔╦╗╔═╗╔╦╗╦╔═╗  ╔═╗╔═╗╔═╗╔╦╗╦ ╦╦═╗╔═╗  ╔═╗╔═╗╔═╗╔═╗╔═╗╔═╗╔╦╗╔═╗╔╗╔╔╦╗
+# #  ╠═╣║ ║ ║ ║ ║║║║╠═╣ ║ ║║    ╠═╝║ ║╚═╗ ║ ║ ║╠╦╝║╣   ╠═╣╚═╗╚═╗║╣ ╚═╗╚═╗║║║║╣ ║║║ ║
+# #  ╩ ╩╚═╝ ╩ ╚═╝╩ ╩╩ ╩ ╩ ╩╚═╝  ╩  ╚═╝╚═╝ ╩ ╚═╝╩╚═╚═╝  ╩ ╩╚═╝╚═╝╚═╝╚═╝╚═╝╩ ╩╚═╝╝╚╝ ╩
+# - industryName: Automatic posture assessment
+#   friendlyName: Verify any security or compliance goal
+#   description: Simplify security audits, build definitive reports, and discover + verify ongoing compliance for every endpoint, from workstations to data centers.
+#   documentationUrl: https://fleetdm.com/docs/using-fleet/cis-benchmarks#cis-benchmarks
+#   screenshotSrc:
+#   usualDepartment: Security
+#   tier: Free
+#   jamfProHasFeature: no
+#   jamfProtectHasFeature: yes
+#   productCategories: [Endpoint operations]
+#   pricingTableCategories: [Devices]
+#   dri: mikermcneil
+#   demos:
+#     - description: A large tech company used Fleet's CIS Benchmark policies to automatically assess posuture of 80,000 endpoints. 
+#       quote:
+#       moreInfoUrl: 
+#   buzzwords: [Attack surface management (ASM),Endpoint hardening,Security posture,Cyber hygiene,Anomaly detection,Configuration management,Attack Surface Monitoring,Policy assessment]
+#   waysToUse: 
+#     # Consolidated ways to use with "Device health"
+# 
+#
+#  CONSOLIDATED WITH DEVICE HEALTH
+# #  ╔═╗╔═╗╦  ╦╔═╗╦ ╦  ╔═╗╔═╗╔═╗╦═╗╦╔╗╔╔═╗
+# #  ╠═╝║ ║║  ║║  ╚╦╝  ╚═╗║  ║ ║╠╦╝║║║║║ ╦
+# #  ╩  ╚═╝╩═╝╩╚═╝ ╩   ╚═╝╚═╝╚═╝╩╚═╩╝╚╝╚═╝
+# - industryName: Policy scoring
+#   documentationUrl: 
+#   friendlyName: Mark policies as critical
+#   productCategories: [Endpoint operations,Device management]
+#   pricingTableCategories: [Devices]
+#   usualDepartment: IT
+#   tier: Premium
+#   jamfProHasFeature: no
+#   jamfProtectHasFeature: no
+#   waysToUse:
+#     # Consolidated ways to use with "Device health"
+# 
+#
+#  CONSOLIDATED WITH TEAMS
+# #  ╦  ╦╔═╗╦═╗╦╔═╗╔╗ ╦  ╔═╗  ╔═╗╔╗╔╦═╗╔═╗╦  ╦  ╔╦╗╔═╗╔╗╔╔╦╗
+# #  ╚╗╔╝╠═╣╠╦╝║╠═╣╠╩╗║  ║╣   ║╣ ║║║╠╦╝║ ║║  ║  ║║║║╣ ║║║ ║
+# #   ╚╝ ╩ ╩╩╚═╩╩ ╩╚═╝╩═╝╚═╝  ╚═╝╝╚╝╩╚═╚═╝╩═╝╩═╝╩ ╩╚═╝╝╚╝ ╩
+# - industryName: Variable enrollment
+#   description: Enroll hosts in different groups using different enrollment secrets and/or installers per-baseline.
+#   documentationUrl: https://fleetdm.com/docs/using-fleet/segment-hosts
+#   tier: Premium
+#   jamfProHasFeature: yes
+#   jamfProtectHasFeature: no
+#   productCategories: [Endpoint operations, Device management]
+#   pricingTableCategories: [Devices]
+#   usualDepartment: IT  
+# 
+#
+# #  ╔═╗╔═╗╔═╗╔╗╔╔╦╗  ╔═╗╦ ╦╔╦╗╔═╗   ╦ ╦╔═╗╔╦╗╔═╗╔╦╗╔═╗
+# #  ╠═╣║ ╦║╣ ║║║ ║   ╠═╣║ ║ ║ ║ ║───║ ║╠═╝ ║║╠═╣ ║ ║╣
+# #  ╩ ╩╚═╝╚═╝╝╚╝ ╩   ╩ ╩╚═╝ ╩ ╚═╝   ╚═╝╩  ═╩╝╩ ╩ ╩ ╚═╝
+# - industryName: Agent auto-update (optional)
+#   friendlyName: Keep agents and extensions up to date
+#   description: Optionally keep agents and extensions up to date automatically using Fleet's free update registry, powered by The Update Framework (TUF).
+#   documentationUrl: https://fleetdm.com/docs/using-fleet/enroll-hosts
+#   tier: Free
+#   jamfProHasFeature: yes
+#   jamfProtectHasFeature: no
+#   productCategories: [Endpoint operations]
+#   pricingTableCategories: [Devices]
+#   usualDepartment: IT
+# 
+#
+# #  ╔╦╗╔═╗╔═╗╔═╗  ╔═╗╦ ╦╔╦╗╔═╗╔╦╗╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
+# #   ║║║╣ ║╣ ╠═╝  ╠═╣║ ║ ║ ║ ║║║║╠═╣ ║ ║║ ║║║║╚═╗
+# #  ═╩╝╚═╝╚═╝╩    ╩ ╩╚═╝ ╩ ╚═╝╩ ╩╩ ╩ ╩ ╩╚═╝╝╚╝╚═╝
+# - industryName: Deep automations
+#   friendlyName: Trigger webhooks or run scripts
+#   documentationUrl: https://fleetdm.com/docs/using-fleet/automations#automations
+#   description: Fire off webhooks or run scripts on hosts when certain things happen in Fleet.
+#   productCategories: [Endpoint operations,Device management,Vulnerability management]
+#   pricingTableCategories: [Integrations]
+#   comingSoonOn: 2024-12-31
+#   tier: Free
+#   buzzwords: [Automated remediation,Auto-remediation,Self-healing]
+#   waysToUse:
+#     - description: Use policy automations to automatically remediate issues and mitigate vulnerabilities.
+#     - description: Use osquery and santa to work around inflexibilities in proprietary MDMs and other protection solutions.
+#     - description: Listen to webhooks to perform autonomous self-healing (cloud security engineering)
+#       moreInfoUrl: https://www.fugue.co/blog/automated-remediation-scripts-vs.-self-healing-infrastructure-two-approaches-to-cloud-security
+# 
+#
+#    CONSOLIDATED WITH "SELF-SERVICE APPLICATION INSTALLATION"
+# #  ╦╔╗╔╔═╗╔╦╗╔═╗╦  ╦  ╔═╗╦═╗╔═╗
+# #  ║║║║╚═╗ ║ ╠═╣║  ║  ║╣ ╠╦╝╚═╗
+# #  ╩╝╚╝╚═╝ ╩ ╩ ╩╩═╝╩═╝╚═╝╩╚═╚═╝
+# - industryName: Installers (self-service)
+#   tier: Free
+#   jamfProHasFeature: yes
+#   jamfProtectHasFeature: no
+#   productCategories: [Endpoint operations]
+#   pricingTableCategories: [Devices]
+#   usualDepartment: IT
+#   documentationUrl: https://fleetdm.com/docs/using-fleet/enroll-hosts
+#   waysToUse:
+#     CONSOLIDATED WITH "SELF-SERVICE APPLICATION INSTALLATION"
+# 
+#
+#   CONSOLIDATED WITH "POLICIES"
 #  ╔╦╗╦═╗╦╔═╗╔═╗╔═╗╦═╗  ╔═╗  ╦ ╦╔═╗╦═╗╦╔═╔═╗╦  ╔═╗╦ ╦  ╔╗ ╔═╗╔═╗╔═╗╔╦╗  ╔═╗╔╗╔  ╔═╗  
 #   ║ ╠╦╝║║ ╦║ ╦║╣ ╠╦╝  ╠═╣  ║║║║ ║╠╦╝╠╩╗╠╣ ║  ║ ║║║║  ╠╩╗╠═╣╚═╗║╣  ║║  ║ ║║║║  ╠═╣  
 #   ╩ ╩╚═╩╚═╝╚═╝╚═╝╩╚═  ╩ ╩  ╚╩╝╚═╝╩╚═╩ ╩╚  ╩═╝╚═╝╚╩╝  ╚═╝╩ ╩╚═╝╚═╝═╩╝  ╚═╝╝╚╝  ╩ ╩  
 #  ╔═╗╔═╗╦╦  ╦╔╗╔╔═╗  ╔═╗╔═╗╦  ╦╔═╗╦ ╦                                               
 #  ╠╣ ╠═╣║║  ║║║║║ ╦  ╠═╝║ ║║  ║║  ╚╦╝                                               
 #  ╚  ╩ ╩╩╩═╝╩╝╚╝╚═╝  ╩  ╚═╝╩═╝╩╚═╝ ╩                                                
-- industryName: Trigger a workflow based on a failing policy
-  documentationUrl: https://fleetdm.com/docs/using-fleet/automations#policy-automations
-  productCategories: [Endpoint operations,Device management]
-  pricingTableCategories: [Integrations]
-  usualDepartment: IT
-  tier: Free
-  jamfProHasFeature: yes
-  jamfProtectHasFeature: no
+# - industryName: Trigger a workflow based on a failing policy
+#   documentationUrl: https://fleetdm.com/docs/using-fleet/automations#policy-automations
+#   productCategories: [Endpoint operations,Device management]
+#   pricingTableCategories: [Integrations]
+#   usualDepartment: IT
+#   tier: Free
+#   jamfProHasFeature: yes
+#   jamfProtectHasFeature: no
+# 
+#
+#   CONSOLIDATED WITH "DEVICE INVENTORY"
+# #  ╦ ╦╔═╗╦═╗╔╦╗╦ ╦╔═╗╦═╗╔═╗  ╦╔╗╔╦  ╦╔═╗╔╗╔╔╦╗╔═╗╦═╗╦ ╦
+# #  ╠═╣╠═╣╠╦╝ ║║║║║╠═╣╠╦╝║╣   ║║║║╚╗╔╝║╣ ║║║ ║ ║ ║╠╦╝╚╦╝
+# #  ╩ ╩╩ ╩╩╚══╩╝╚╩╝╩ ╩╩╚═╚═╝  ╩╝╚╝ ╚╝ ╚═╝╝╚╝ ╩ ╚═╝╩╚═ ╩ 
+# - industryName: Hardware inventory
+#   documentationUrl: https://fleetdm.com/tables/system_info
+#   productCategories: [Endpoint operations,Device management,Vulnerability management]
+#   pricingTableCategories: [Devices]
+#   tier: Free
+#   jamfProHasFeature: yes
+#   jamfProtectHasFeature: no
+#   waysToUse:
+#     - description: Implement hardware and infrastructure inventory recommendations from the SANS 20 / CIS 18.
+#       moreInfoUrl: https://docs.google.com/document/d/1E6EQMMqrsRc6Z3YsR6Q33OaF9eAa8zLNaz4K2YzFdyo/edit#heading=h.7en766pueek4
+#   
+
+#   CONSOLIDATED WITH "DEVICE INVENTORY"
+# #  ╔╦╗╔═╗╦  ╦╦╔═╗╔═╗  ╦╔╗╔╦  ╦╔═╗╔╗╔╔╦╗╔═╗╦═╗╦ ╦  ╔╦╗╔═╗╔═╗╦ ╦╔╗ ╔═╗╔═╗╦═╗╔╦╗
+# #   ║║║╣ ╚╗╔╝║║  ║╣   ║║║║╚╗╔╝║╣ ║║║ ║ ║ ║╠╦╝╚╦╝   ║║╠═╣╚═╗╠═╣╠╩╗║ ║╠═╣╠╦╝ ║║
+# #  ═╩╝╚═╝ ╚╝ ╩╚═╝╚═╝  ╩╝╚╝ ╚╝ ╚═╝╝╚╝ ╩ ╚═╝╩╚═ ╩   ═╩╝╩ ╩╚═╝╩ ╩╚═╝╚═╝╩ ╩╩╚══╩╝
+# - industryName: Device inventory dashboard
+#   documentationUrl: 
+#   productCategories: [Endpoint operations,Device management]
+#   pricingTableCategories: [Devices]
+#   usualDepartment: IT
+#   tier: Free
+#   jamfProHasFeature: yes
+#   jamfProtectHasFeature: yes
+# 
+#
+#   CONSOLIDATED WITH "DEVICE INVENTORY"
+# #  ╔═╗╔═╗╔═╗╔╦╗╦ ╦╔═╗╦═╗╔═╗  ╦╔╗╔╦  ╦╔═╗╔╗╔╔╦╗╔═╗╦═╗╦ ╦
+# #  ╚═╗║ ║╠╣  ║ ║║║╠═╣╠╦╝║╣   ║║║║╚╗╔╝║╣ ║║║ ║ ║ ║╠╦╝╚╦╝
+# #  ╚═╝╚═╝╚   ╩ ╚╩╝╩ ╩╩╚═╚═╝  ╩╝╚╝ ╚╝ ╚═╝╝╚╝ ╩ ╚═╝╩╚═ ╩ 
+# - industryName: Software inventory
+#   documentationUrl: https://fleetdm.com/docs/get-started/anatomy#software-library
+#   tier: Free
+#   jamfProHasFeature: yes
+#   jamfProtectHasFeature: no
+#   productCategories: [Endpoint operations,Device management,Vulnerability management]
+#   pricingTableCategories: [Devices]
+#   waysToUse:
+#     - description: Implement software inventory recommendations from the SANS 20 / CIS 18.
+#       moreInfoUrl: https://docs.google.com/document/d/1E6EQMMqrsRc6Z3YsR6Q33OaF9eAa8zLNaz4K2YzFdyo/edit#heading=h.7en766pueek4
+#     - description: View a list of all software and their versions installed on all your hosts.
+#     - description: View a list of software rolled up by title.
+#       moreInfoUrl: https://github.com/fleetdm/fleet/issues/14674
+# #
+# 
+#   CONSOLIDATED WITH "DEVICE INVENTORY"
+# #  ╔╗ ╦═╗╔═╗╦ ╦╔═╗╔═╗  ╦╔╗╔╔═╗╔╦╗╔═╗╦  ╦  ╔═╗╔╦╗  ╔═╗╔═╗╔═╗╔╦╗╦ ╦╔═╗╦═╗╔═╗  ╔═╗╔═╗╔═╗╦╔═╔═╗╔═╗╔═╗╔═╗
+# #  ╠╩╗╠╦╝║ ║║║║╚═╗║╣   ║║║║╚═╗ ║ ╠═╣║  ║  ║╣  ║║  ╚═╗║ ║╠╣  ║ ║║║╠═╣╠╦╝║╣   ╠═╝╠═╣║  ╠╩╗╠═╣║ ╦║╣ ╚═╗
+# #  ╚═╝╩╚═╚═╝╚╩╝╚═╝╚═╝  ╩╝╚╝╚═╝ ╩ ╩ ╩╩═╝╩═╝╚═╝═╩╝  ╚═╝╚═╝╚   ╩ ╚╩╝╩ ╩╩╚═╚═╝  ╩  ╩ ╩╚═╝╩ ╩╩ ╩╚═╝╚═╝╚═╝
+# - industryName: Browse installed software packages
+#   documentationUrl: https://fleetdm.com/docs/rest-api/rest-api#software
+#   productCategories: [Endpoint operations,Device management,Vulnerability management]
+#   pricingTableCategories: [Devices]
+#   tier: Free
+#   jamfProHasFeature: yes
+#   jamfProtectHasFeature: no
+#  
+#
+#   CONSOLIDATED WITH "SEARCH INVENTORY"
+# #  ╔═╗╔═╗╔═╗╦═╗╔═╗╦ ╦  ╔╦╗╔═╗╦  ╦╦╔═╗╔═╗╔═╗  ╔╗ ╦ ╦  ╦╔═╗  ╔═╗╔═╗╦═╗╦╔═╗╦     
+# #  ╚═╗║╣ ╠═╣╠╦╝║  ╠═╣   ║║║╣ ╚╗╔╝║║  ║╣ ╚═╗  ╠╩╗╚╦╝  ║╠═╝  ╚═╗║╣ ╠╦╝║╠═╣║     
+# #  ╚═╝╚═╝╩ ╩╩╚═╚═╝╩ ╩  ═╩╝╚═╝ ╚╝ ╩╚═╝╚═╝╚═╝  ╚═╝ ╩   ╩╩┘   ╚═╝╚═╝╩╚═╩╩ ╩╩═╝┘  
+# #  ╦ ╦╔═╗╔═╗╔╦╗╔╗╔╔═╗╔╦╗╔═╗   ╦ ╦╦ ╦╦╔╦╗                                      
+# #  ╠═╣║ ║╚═╗ ║ ║║║╠═╣║║║║╣    ║ ║║ ║║ ║║                                      
+# #  ╩ ╩╚═╝╚═╝ ╩ ╝╚╝╩ ╩╩ ╩╚═╝┘  ╚═╝╚═╝╩═╩╝                                      
+# - industryName: Search devices by IP, serial, hostname, UUID
+#   documentationUrl: https://fleetdm.com/docs/rest-api/rest-api#hosts
+#   productCategories: [Endpoint operations,Device management]
+#   pricingTableCategories: [Devices]
+#   tier: Free
+#   jamfProHasFeature: yes
+#   jamfProtectHasFeature: yes
+#
diff --git a/handbook/company/product-groups.md b/handbook/company/product-groups.md
index 17b3acbd15..1308b2ea58 100644
--- a/handbook/company/product-groups.md
+++ b/handbook/company/product-groups.md
@@ -1,4 +1,5 @@
 # 🛩️ Product groups
+
 This page covers what all contributors (fleeties or not) need to know in order to contribute changes to [the core product](https://fleetdm.com/docs).
 
 When creating software, handoffs between teams or contributors are one of the most common sources of miscommunication and waste.  Like [GitLab](https://docs.google.com/document/d/1RxqS2nR5K0vN6DbgaBw7SEgpPLi0Kr9jXNGzpORT-OY/edit#heading=h.7sfw1n9c1i2t), Fleet uses product groups to minimize handoffs and maximize iteration and efficiency in the way we build the product.
@@ -6,10 +7,14 @@ When creating software, handoffs between teams or contributors are one of the mo
 > - Write down philosophies and show how the pieces of the development process fit together on this "🛩️ Product groups" page.
 > - Use the dedicated [departmental](https://fleetdm.com/handbook/company#org-chart) handbook pages for [🚀 Engineering](https://fleetdm.com/handbook/engineering) and [🦢 Product Design](https://fleetdm.com/handbook/product) to keep track of specific, rote responsibilities and recurring rituals designed to be read and used only by people within those departments.
 
+
 ## Product roadmap
-Fleet team members can read [Fleet's high-level product goals and planned releases for the current quarter and the next quarter](https://docs.google.com/document/d/11XEb__EJoGQJE9hXwaLrN45_5_k1NCi-zlJKH-OlKKk/edit#heading=h.33k3ii7z7ubc) (confidential Google Doc).
+
+Fleet team members can read [Fleet's high-level product goals for the current quarter](https://docs.google.com/spreadsheets/d/1Hso0LxqwrRVINCyW_n436bNHmoqhoLhC8bcbvLPOs9A/edit?usp=sharing) (confidential Google Sheet).
+
 
 ## What are product groups?
+
 Fleet organizes product development efforts into separate, cross-functional product groups that include product designers, developers, and quality engineers.  These product groups are organized by business goal, and designed to operate in parallel.
 
 Security, performance, stability, scalability, database migrations, release compatibility, usage documentation (such as REST API and configuration reference), contributor experience, and support escalation are the responsibility of every product group.
@@ -18,33 +23,34 @@ At Fleet, [anyone can contribute](https://fleetdm.com/handbook/company#openness)
 
 > Ideas expressed in wireframes, like code contributions, [are welcome from everyone](https://chat.osquery.io/c/fleet), inside or outside the company.
 
+
 ## Current product groups
 
-| Product group             | Goal _(value for customers and/or community)_                       | Capacity\* |
-|:--------------------------|:--------------------------------------------------------------------|:-----------------|
-| [Endpoint ops](#endpoint-ops-group)                     | Increase and exceed maturity in the "Endpoint operations" category.             | 130       |
-| [MDM](#mdm-group)                                       | Reach maturity in the "MDM" product category.           | 156       |
+| Product group                            | Goal _(value for customers and/or community)_                         | Capacity\*   |
+|:-----------------------------------------|:----------------------------------------------------------------------|:-------------|
+| [Endpoint ops](#endpoint-ops-group)      | Increase and exceed maturity in the "Endpoint operations" category.   | 156          |
+| [MDM](#mdm-group)                        | Reach maturity in the "MDM" product category.                         | 156          |
 
-\* The number of estimated story points this group can take on per-sprint under ideal circumstances, used as a baseline number for planning and prioritizing user stories for drafting. In reality, capacity will vary as engineers are on-call, out-of-office, filling in for other product groups, etc.
+\* The number of [estimated story points](https://fleetdm.com/handbook/company/communications#estimation-points) this group can take on per-sprint under ideal circumstances, used as a baseline number for planning and prioritizing user stories for drafting. In reality, capacity will vary as engineers are on-call, out-of-office, filling in for other product groups, etc.
 
-> _**What happened to "CX"?**  The customer experience (CX) group at Fleet is now [`#g-endpoint-ops`](#endpoint-ops-group)._
->
-> _Why?  Making users and customers happier and more successful is the goal of _every_ product group.  This includes simpler usage, lovable design + help text + error messages, fixed bugs, responding quickly to incidents, using Fleet's brand standards, more successful customer onboarding, features that drive more win-win meetings with contributors and Fleet's sales team, and "whole product solutions", including professional services, design partnerships, and training._
 
 ### Endpoint ops group
+
 The goal of the endpoint ops group is to increase and exceed [Fleet's product maturity goals in the endpoint operations category](https://drive.google.com/file/d/11yQ_2WG7TbRErUpMBKWu_hQ5wRIZyQhr/view?usp=sharing).
 
 | Responsibility                    | Human(s)                  |
 |:----------------------------------|:--------------------------|
-| Product Designer                  | [Rachael Shaw](https://www.linkedin.com/in/rachaelcshaw/) _([@rachaelshaw](https://github.com/rachaelshaw))_
+| Product Designer                  | [Rachael Shaw](https://www.linkedin.com/in/rachaelcshaw/) _([@rachaelshaw](https://github.com/rachaelshaw))_, [Randy Hill](https://www.linkedin.com/in/rockingmoose/) _([@randy-fleet](https://github.com/randy-fleet))_
 | Engineering Manager               | [Sharon Katz](https://www.linkedin.com/in/sharon-katz-45b1b3a/) _([@sharon-fdm](https://github.com/sharon-fdm))_
 | Product Manager                   | [Noah Talerman](https://www.linkedin.com/in/noah-talerman/) _([@noahtalerman](https://github.com/@noahtalerman))_
 | Quality Assurance                 | [Reed Haynes](https://www.linkedin.com/in/reed-haynes-633a69a3/) _([@xpkoala](https://github.com/xpkoala))_
-| Developer                         | [Jacob Shandling](https://www.linkedin.com/in/jacob-shandling/) _([@jacobshandling](https://github.com/jacobshandling))_, [Lucas Rodriguez](https://www.linkedin.com/in/lukmr/) _([@lucasmrod](https://github.com/lucasmrod))_, [Rachel Perkins](https://www.linkedin.com/in/rachelelysia/) _([@rachelelysia](https://github.com/rachelelysia))_, [Eric Shaw](https://www.linkedin.com/in/eric-shaw-1423831a9/) _([@eashaw](https://github.com/eashaw))_, [Tim Lee](https://www.linkedin.com/in/mostlikelee/) _([@mostlikelee](https://github.com/mostlikelee))_, [Victor Lyuboslavsky](https://www.linkedin.com/in/lyuboslavsky/) _([@getvictor](https://github.com/getvictor))_
+| Developer                         | [Jacob Shandling](https://www.linkedin.com/in/jacob-shandling/) _([@jacobshandling](https://github.com/jacobshandling))_, [Lucas Rodriguez](https://www.linkedin.com/in/lukmr/) _([@lucasmrod](https://github.com/lucasmrod))_, [Rachel Perkins](https://www.linkedin.com/in/rachelelysia/) _([@rachelelysia](https://github.com/rachelelysia))_, [Eric Shaw](https://www.linkedin.com/in/eric-shaw-1423831a9/) _([@eashaw](https://github.com/eashaw))_, [Tim Lee](https://www.linkedin.com/in/mostlikelee/) _([@mostlikelee](https://github.com/mostlikelee))_, [Victor Lyuboslavsky](https://www.linkedin.com/in/lyuboslavsky/) _([@getvictor](https://github.com/getvictor))_, [Ian Littman](https://www.linkedin.com/in/ian-littman/) _([@iansltx](https://github.com/iansltx))_
 
 > The [Slack channel](https://fleetdm.slack.com/archives/C01EZVBHFHU), [kanban release board](https://app.zenhub.com/workspaces/-g-endpoint-ops-current-sprint-63bd7e0bf75dba002a2343ac/board), and [GitHub label](https://github.com/fleetdm/fleet/issues?q=is%3Aopen+is%3Aissue+label%3A%23g-endpoint-ops) for this product group is `#g-endpoint-ops`.
 
+
 ### MDM group
+
 The goal of the MDM group is to increase and exceed [Fleet's product maturity goals](https://drive.google.com/file/d/11yQ_2WG7TbRErUpMBKWu_hQ5wRIZyQhr/view?usp=sharing) in the "MDM" product category.
 
 | Responsibility                    | Human(s)                  |
@@ -57,7 +63,9 @@ The goal of the MDM group is to increase and exceed [Fleet's product maturity go
 
 > The [Slack channel](https://fleetdm.slack.com/archives/C03C41L5YEL), [kanban release board](https://app.zenhub.com/workspaces/-g-mdm-current-sprint-63bc507f6558550011840298/board), and [GitHub label](https://github.com/fleetdm/fleet/issues?q=is%3Aopen+is%3Aissue+label%3A%23g-mdm) for this product group is `#g-mdm`.
 
+
 ## Making changes
+
 Fleet's highest product ambition is to create experiences that users want.
 
 To deliver on this mission, we need a clear, repeatable process for turning an idea into a set of cohesively-designed changes in the product. We also need to allow [open source contributions](https://fleetdm.com/handbook/company#open-source) at any point in the process from the wider Fleet community - these won't necessarily follow this process.
@@ -69,30 +77,49 @@ To make a change to Fleet:
 - Then, it will be [drafted](https://fleetdm.com/handbook/company/product-groups#drafting) (planned).
 - Next, it will be [implemented](https://fleetdm.com/handbook/company/product-groups#implementing) and [released](https://fleetdm.com/handbook/engineering#release-process).
 
+
 ### Planned and unplanned changes
+
 Most changes to Fleet are planned changes. They are [prioritized](https://fleetdm.com/handbook/product), defined, designed, revised, estimated, and scheduled into a release sprint _prior to starting implementation_.  The process of going from a prioritized goal to an estimated, scheduled, committed user story with a target release is called "drafting", or "the drafting phase".
 
 Occasionally, changes are unplanned.  Like a patch for an unexpected bug, or a hotfix for a security issue.  Or if an open source contributor suggests an unplanned change in the form of a pull request.  These unplanned changes are sometimes OK to merge as-is.  But if they change the user interface, the CLI usage, or the REST API, then they need to go through drafting and reconsideration before merging.
 
 > But wait, [isn't this "waterfall"?](https://about.gitlab.com/handbook/product-development-flow/#but-wait-isnt-this-waterfall) Waterfall is something else.  Between 2015-2023, GitLab and The Sails Company independently developed and coevolved similar delivery processes.  (What we call "drafting" and "implementation" at Fleet, is called "the validation phase" and "the build phase" at GitLab.)
 
+
+### Experimental features
+
+When a new feature is introduced it may be labeled as experimental. Experimental features are undergoing a rapid [incremental improvement and iteration process](https://fleetdm.com/handbook/company/why-this-way#why-lean-software-development) where new learnings may requires breaking changes. When we introduce experimental features, it is important that any API endpoints or configuration surface that may change in the future be clearly labeled as experimental.
+
+1. Apply the `~experimental` label to all associated user stories.
+2. Set the optional `isExperimental` property to "yes" in [pricing-features-table.yml](https://github.com/fleetdm/fleet/blob/main/handbook/company/pricing-features-table.yml).
+3. Make sure all API endpoints and configuration surface documentation includes the following message:
+
+> **Experimental feature**. This feature is undergoing rapid improvement, which may result in breaking changes to the API or configuration surface. It is not recommended for use in automated workflows.
+
+
 ### Breaking changes
-For product changes that cause breaking API or configuration changes or major impact for users (or even just the _impression_ of major impact!), the company plans migration thoughtfully.  That means the product department and E-group:
 
-1. **Written:** Write a migration guide, even if that's just a Google Doc
-2. **Tested:** Test out the migration ourselves, first-hand, as an engineer.
-3. **Gamed out:** We pretend we are one or two key customers and try it out as a role play.
-4. **Adapt:** If it becomes clear that the plan is insufficient, then fix it.
-5. **Communicate:** Develop a plan for how to proactively communicate the change to customers.
+For product changes that cause breaking API or configuration changes or major impact for users (or even just the _impression_ of major impact!), the company plans migration thoughtfully. If the feature was released as stable (not experimental), the product group and E-group:
+
+1. **Written:** Write a migration guide.
+2. **Tested:** Test the migration thoroughly as engineers.
+3. **Gamed out:** Pretend we are one or two key customers and try it out as a role play.
+4. **Adapt:** If it becomes clear that the plan is insufficient, fix it.
+5. **Communicate:** Create a plan for how to proactively communicate the change to customers.
+
+All of the steps above happen prior to any breaking changes to stable features being prioritized for implementation.
 
-That all happens prior to work getting prioritized for the change.
 
 #### API changes
+
 To maintain consistency, ensure perspective, and provide a single pair of eyes in the design of Fleet's REST API and API documentation, there is a single Directly Responsible Individual (DRI). The API design DRI will review and approve any alterations at the pull request stage, instead of making it a prerequisite during drafting of the story. You may tag the DRI in a GitHub issue with draft API specs in place to receive a review and feedback prior to implementation. Receiving a pre-review from the DRI is encouraged if the API changes introduce new endpoints, or substantially change existing endpoints.
 
 No API changes are merged without accompanying API documentation and approval from the DRI. The DRI is responsible for ensuring that the API design remains consistent and adequately addresses both standard and edge-case scenarios. The DRI is also the code owner of the API documentation Markdown file. The DRI is committed to reviewing PRs within one business day. In instances where the DRI is unavailable, the Head of Product will act as the substitute code owner and reviewer.
 
+
 #### Changes to tables' schema
+
 Whenever a PR is proposed for making changes to our [tables' schema](https://fleetdm.com/tables/screenlock)(e.g. to schema/tables/screenlock.yml), it also has to be reflected in our osquery_fleet_schema.json file.
 
 The website team will [periodically](https://fleetdm.com/handbook/marketing/website-handbook#rituals) update the json file with the latest changes. If the changes should be deployed sooner, you can generate the new json file yourself by running these commands:
@@ -105,14 +132,18 @@ cd website
 
 > If a table is added to our ChromeOS extension but it does not exist in osquery or if it is a table added by fleetd, add a note that mentions it, as in this [example](https://github.com/fleetdm/fleet/blob/e95e075e77b683167e86d50960e3dc17045e3c44/schema/tables/mdm.yml#L2).
 
+
 ### Drafting
+
 "Drafting" is the art of defining a change, designing and shepherding it through the drafting process until it is ready for implementation.
 
-The goal of drafting is to deliver software that works every time with less total effort and investment, without making contribution any less fun.  By researching and iterating [prior to development](https://fleetdm.com/handbook/company/why-this-way#why-do-we-use-a-wireframe-first-approach), we design better product features, crystallize fewer bad, preemptive naming decisions, and achieve better throughput: getting more done in less time. 
+The goal of drafting is to deliver software that works every time with less total effort and investment, without making contribution any less fun.  By researching and iterating [prior to development](https://fleetdm.com/handbook/company/why-this-way#why-do-we-use-a-wireframe-first-approach), we design better product features, crystallize fewer bad, preemptive naming decisions, and achieve better throughput: getting more done in less time.
 
 > Fleet's drafting process is focused first and foremost on product development, but it can be used for any kind of change that benefits from planning or a "dry run".  For example, imagine you work for a business who has decided to swap out one of your payroll or device management vendors.  You will probably need to plan and execute changes to a number of complicated onboarding/offboarding processes.
 
+
 #### Drafting process
+
 The DRI for defining and drafting issues for a product group is the product manager, with close involvement from the designer and engineering manager.  But drafting is a team effort, and all contributors participate.
 
 A user story is considered ready for implementation once:
@@ -125,19 +156,25 @@ A user story is considered ready for implementation once:
 
 > All user stories intended for the next sprint are estimated by the last estimation session before the sprint begins. This makes sure contributors have adequate time to complete the current sprint and provide accurate estimates for the next sprint.
 
+
 #### Writing a good user story
+
 Good user stories are short, with clear, unambiguous language.
 - What screen are they looking at?  (`As an observer on the host details page…`)
-- What do they want to do? (`As an observer on the host details page, I want to run a permitted query.`) 
+- What do they want to do? (`As an observer on the host details page, I want to run a permitted query.`)
 - Don't get hung up on the "so that I can ________" clause.  It is helpful, but optional.
 - Example: "As an admin I would like to be asked for confirmation before deleting a user so that I do not accidentally delete a user."
 
+
 #### Is it actually a story?
+
 User stories are small and independently valuable.
 - Is it small enough? Will this task be likely to fit in 1 sprint when estimated?
 - Is it valuable enough? Will this task drive business value when released, independent of other tasks?
 
+
 #### Defining "done"
+
 To successfully deliver a user story, the people working on it need to know what "done" means.
 
 Since the goal of a user story is to implement certain changes to the product, the "definition of done" is written and maintained by the product manager.  But ultimately, this "definition of done" involves everyone in the product group.  We all collectively rely on accuracy of estimations, astuteness of designs, and cohesiveness of changes envisioned in order to deliver on time and without fuss.
@@ -158,7 +195,9 @@ Things to consider when writing the "definition of done" for a user story:
 - **QA:** Changes are tested by hand prior to submitting pull requests. In addition, quality assurance will do an extra QA check prior to considering this story "done".  Any special QA notes?
 - **Follow-through:** Is there anything in particular that we should inform others (people who aren't in this product group) about after this user story is released?  For example: communication to specific customers, tips on how best to highlight this in a release post, gotchas, etc.
 
+
 #### Providing context
+
 User story issues contain an optional section called "Context".
 
 This section is optional and hidden by default.  It can be included or omitted, as time allows.  As Fleet grows as an all-remote company with more asynchronous processes across timezones, we will rely on this section more and more.
@@ -176,14 +215,18 @@ Here are some examples of questions that might be helpful to answer:
 
 These questions are helpful for the product team when considering what to prioritize.  (The act of writing the answers is a lot of the value!)  But these answers can also be helpful when users or contributors (including our future selves) have questions about how best to estimate, iterate, or refine.
 
+
 #### Initiate an air guitar session
-Anyone in the product group can initiate an air guitar session.   
+
+Anyone in the product group can initiate an air guitar session.
 
 1. Initiate: Create a user story and add the `~air-guitar` label to indicate that it is going through the air guitar process. Air guitar issues are always intended to be designed right away. If they can't be, the requestor is notified via at-mention in the issue (that person is either the CSM or AE).
 
+> An air guitar session may be used to design features that won't be delivered in the next 6 weeks.
+
 2. Prioritize: Bring the user story to [feature fest](https://fleetdm.com/handbook/product#rituals). If the user story is prioritized, proceed through the regular steps of specifying and designing as outlined in the drafting process. However, keep in mind that these are conceptual and may or may not proceed to engineering.
 
-> An air guitar session may be needed before the next feature fest. In this case, the product group PM will prioritize the user story. 
+> An air guitar session may be needed before the next feature fest. In this case, the product group PM will prioritize the user story.
 
 3. Review: Conduct an air guitar meeting where the idea or feature is discussed. Involve roles like the product manager, designer, and a sampling of engineers to provide various perspectives.
 
@@ -198,9 +241,12 @@ Anyone in the product group can initiate an air guitar session.
 
 Air guitar sessions are timeboxed to ensure they are fast and focused. Documentation from this process may inform future user stories and can be invaluable when revisiting the idea at a later stage. While the air guitar process is exploratory in nature, it should be thorough enough to provide meaningful insights and data for future decision-making.
 
+
 ### Implementing
 
+
 #### Developing from wireframes
+
 Please read carefully and [pay special attention](https://fleetdm.com/handbook/company/why-this-way#why-do-we-use-a-wireframe-first-approach) to UI wireframes.
 
 Designs have usually gone through multiple rounds of revisions, but they could easily still be overlooking complexities or edge cases! When you think you've discovered a blocker, here's how to proceed:
@@ -219,7 +265,9 @@ At Fleet, we prioritize [iteration](https://fleetdm.com/handbook/company#results
 
 After these considerations, if you still think you've found a blocker, alert the [appropriate PM](https://fleetdm.com/handbook/company/product-groups#current-product-groups) so that the user story can be brought back for [expedited drafting](https://fleetdm.com/handbook/product#expedited-drafting). Otherwise, make a [feature request](https://fleetdm.com/handbook/product#intake).
 
+
 #### Sub-tasks
+
 The simplest way to manage work is to use a single user story issue, then pass it around between contributors/asignees as seldom as possible.  But on a case-by-case basis, for particular user stories and teams, it can sometimes be worthwhile to invest additional overhead in creating separate **unestimated sub-task** issues ("sub-tasks").
 
 A user story is estimated to fit within 1 sprint and drives business value when released, independent of other stories.  Sub-tasks are not.
@@ -234,20 +282,28 @@ Sub-tasks:
 - are NOT the best place to post GitHub comments (instead, concentrate conversation in the top-level "user story" issue)
 - will NOT be looked at or QA'd by quality assurance
 
+
 ## Outages
+
 At Fleet, we consider an outage to be a situation where new features or previously stable features are broken or unusable.
 
 - Occurences of outages are tracked in the [Outages](https://docs.google.com/spreadsheets/d/1a8rUk0pGlCPpPHAV60kCEUBLvavHHXbk_L3BI0ybME4/edit#gid=0) spreadsheet.
 - Fleet encourages embracing the inevitability of mistakes and discourages blame games.
 - Fleet stresses the critical importance of avoiding outages because they make customers' lives worse instead of better.
 
+
 ## Scaling Fleet
+
 Fleet, as a Go server, scales horizontally very well. It’s not very CPU or memory intensive. However, there are some specific gotchas to be aware of when implementing new features. Visit our [scaling Fleet page](https://fleetdm.com/handbook/engineering/scaling-fleet) for tips on scaling Fleet as efficiently and effectively as possible.
 
+
 ## Load testing
+
 The [load testing page](https://fleetdm.com/handbook/engineering/load-testing) outlines the process we use to load test Fleet, and contains the results of our semi-annual load test.
 
+
 ## Version support
+
 To provide the most accurate and efficient support, Fleet will only target fixes based on the latest released version. In the current version fixes, Fleet will not backport to older releases.
 
 Community version supported for bug fixes: **Latest version only**
@@ -258,7 +314,9 @@ Premium version supported for bug fixes: **Latest version only**
 
 Premium support for support/troubleshooting: **All versions**
 
+
 ## Release testing
+
 When a release is in testing, QA should use the Slack channel #help-qa to keep everyone aware of issues found. All bugs found should be reported in the channel after creating the bug first.
 
 When a critical bug is found, the Fleetie who labels the bug as critical is responsible for following the [critical bug notification process](https://fleetdm.com/handbook/engineering#notify-community-members-about-a-critical-bug) below.
@@ -273,14 +331,16 @@ All unreleased bugs are addressed before publishing a release. Released bugs tha
   - Causes irreversible damage, such as data loss
   - Introduces a security vulnerability
 
+
 ### Notify the community about a critical bug
+
 We inform customers and the community about critical bugs immediately so they don’t trigger it themselves. When a bug meeting the definition of critical is found, the bug finder is responsible for raising an alarm. Raising an alarm means pinging @here in the `#g-mdm` or `#g-endpoint-ops` channel with the filed bug.
 
 If the bug finder is not a Fleetie (e.g., a member of the community), then whoever sees the critical bug should raise the alarm. Note that the bug finder here is NOT necessarily the **first** person who sees the bug. If you come across a bug you think is critical, but it has not been escalated, raise the alarm!
 
 Once raised, product design confirms whether or not it's critical and defines expected behavior. When outside of working hours for the product design team or if no one from product design responds within 1 hour, then fall back to the #help-p1 channel.
 
-Once the critical bug is confirmed, a [priority label](https://fleetdm.com/handbook/company/product-groups#high-priority-user-stories-and-bugs) is applied and the priority response process begins. Customer Success notifies impacted customers and the community if community features are impacted. If Customer Success is not available, the on-call engineer or infrastructure on-call engineer is responsible for this. If a quick fix workaround exists, that should be communicated as well for those who are already upgraded.
+Once the critical bug is confirmed, a [priority label](https://fleetdm.com/handbook/company/communications#high-priority-user-stories-and-bugs) is applied and the priority response process begins. Customer Success notifies impacted customers and the community if community features are impacted. If Customer Success is not available, the on-call engineer or infrastructure on-call engineer is responsible for this. If a quick fix workaround exists, that should be communicated as well for those who are already upgraded.
 
 The relevant release page on GitHub is updated to indicate that the release contains a critical bug, as shown on the [fleet-v4.45.0 release page](https://github.com/fleetdm/fleet/releases/tag/fleet-v4.45.0).
 
@@ -288,41 +348,33 @@ When a critical bug is identified, we will then follow the patch release process
 
 > After a critical bug is fixed, [an incident postmortem](https://fleetdm.com/handbook/engineering#preform-an-incident-postmortem) is scheduled by the EM of the product group that fixed the bug.
 
+
 ## Feature fest
-To stay in-sync with our customers' needs, Fleet accepts feature requests from customers and community members on a sprint-by-sprint basis in the regular 🎁🗣 Feature Fest meeting. Anyone in the company is invited to submit requests or simply listen in on the 🎁🗣 Feature Fest meeting. Folks from the wider community can also [request an invite](https://fleetdm.com/contact). 
+
+To stay in-sync with our customers' needs, Fleet accepts feature requests from customers and community members on a sprint-by-sprint basis in the regular 🎁🗣 Feature Fest meeting. Anyone in the company is invited to submit requests or simply listen in on the 🎁🗣 Feature Fest meeting. Folks from the wider community can also [request an invite](https://fleetdm.com/contact).
 
 ### Making a request
-To make a feature request or advocate for a feature request from a customer or community member, [create an issue](https://github.com/fleetdm/fleet/issues/new/choose) using the feature request template and attend the next scheduled 🎁🗣 Feature Fest meeting. 
+To make a feature request or advocate for a feature request from a customer or community member, [create an issue](https://github.com/fleetdm/fleet/issues/new/choose) using the feature request template and attend the next scheduled 🎁🗣 Feature Fest meeting.
 
 Requests are weighed from top to bottom while prioritizing attendee requests. This means that if the individual that added a feature request is not in attendance, the feature request will be discussed towards the end of the call if there's time.
 
-To be acceptable for consideration, a request must:
-- Have a clear proposed change
-- Have a well-articulated underlying user need
-- Specify the requestor (either internal stakeholder or customer or community user)
-
-To help the product team, other pieces of information can be optionally included:
-- How would they solve the problem without any changes if pressed?
-- How does this change fit into the requester's overall usage of Fleet?
-- What other potential changes to the product have you considered?
-
-To ensure your request appears on the ["Feature Fest" board](https://app.zenhub.com/workspaces/-feature-fest-651b2962605ba29209324c57/board):
-- Add the `~feature fest` label to your issue
-- Add the relevant customer label (if applicable) 
-
-To maximize your chances of having a feature accepted, requesters can visit the [🗣 Product office hours](#rituals) meeting to get feedback on requests prior to being accepted. 
 
 ### How feature requests are evaluated
+
 Digestion of these new product ideas (requests) happens at the **🎁🗣 Feature Fest** meeting.
 
-At the **🎁🗣 Feature Fest** meeting, the DRI (Head of Product) weighs all requests on the board. When the team weighs a request, it is immediately prioritized or put to the side.
+Before the **🎁🗣 Feature Fest** meeting, the [Customer renewals DRI](https://fleetdm.com/handbook/company/communications#directly-responsible-individuals-dris) goes through the "Inbox" column and removes customer requests that are not a high priority for the business. Stakeholders will be notified by the Customer renewals DRI.
 
-Product Managers prioritize all potential product improvements worked on by Fleeties. Anyone (Fleeties, customers, and community members) are invited to suggest improvements.
+All community and contributor requests (non-customer) are left in the inbox. A high priority customer request may be a request that's blocking a customer from getting their job done or a request that's critical for customer renewal.
 
-- A _request is prioritized_ when the DRI decides it is a priority. When this happens, the team sets the request to be estimated within five business days.
+Before the meeting, the Feature prioritization DRI adds requests from Fleet's roadmap that are planned for the next design sprint. The quarterly roadmap is in the [OKRs spreadsheet](https://docs.google.com/spreadsheets/d/1Hso0LxqwrRVINCyW_n436bNHmoqhoLhC8bcbvLPOs9A/edit?gid=1846478041#gid=1846478041&range=393:419).
+
+At the **🎁🗣 Feature Fest** meeting, the Feature prioritization DRI weighs all requests in the inbox. When the team weighs a request, it is immediately prioritized or put to the side (not prioritized).
+
+- A _request is prioritized_ when the Feature prioritization DRI decides it is a priority.
 - A _request is put to the side_ when the business perceives competing priorities as more pressing in the immediate moment.
 
-If a feature is not prioritized during a 🎁🗣 Feature Fest meeting, it only means the feature has been rejected _at that time_. Requestors will be notified by the Head of Product, and they can resubmit their request at a future meeting.
+If a feature is not prioritized during a 🎁🗣 Feature Fest meeting, it only means the feature has been rejected _at that time_. Requestors will be notified by the Feature prioritization DRI, and they can resubmit their request at a future meeting.
 
 Requests are weighed by:
 - The completeness of the request (see [making a request](#making-a-request))
@@ -331,21 +383,17 @@ Requests are weighed by:
 - How well the request fits within Fleet's product vision and roadmap
 - Whether the feature seems like it can be designed, estimated, and developed in 6 weeks, given its individual complexity and when combined with other work already accepted
 
-### Customer feature requests 
-The product team's goal is to prioritize 16 customer feature requests at Feature Fest, then take them from settled to shipped. The customer success team is responsible for providing the Head of Product a live count during the Feature Fest meeting. Product Operations is responsible for monitoring this KPI and raising alarms throughout the design and engineering sprints. 
-> Customer stories should be estimated at 1-3 points each to count as 1 request. If a feature request spans across multiple customers, it will be counted as the number of customers involved. 
 
 ### After the feature is accepted
-After the 🎁🗣 Feature Fest meeting, Product Operations will clear the Feature Fest board as follows:
-**Prioritized features:** Remove `feature fest` label, add `:product` label, and assign the group Product Manager. 
-**Put to the side features:** Remove `feature fest` label and close the issue.
 
-Group Product Managers will then develop user stories for the prioritized features. 
+After the "🎁🗣 Feature fest" meeting, the feature prioritization DRI will clear the ["🎁 Feature fest" board](https://github.com/fleetdm/fleet/issues#workspaces/feature-fest-651b2962605ba29209324c57/board) as follows:
+**Prioritized features:** Remove the `~feature fest` label, create a new user story with the `:product` label, add a link from the original request to the user story, notify the requester, and move the user story to the "Ready" column in the drafting board. The user story will then be assigned to a [Product Designer](https://fleetdm.com/handbook/company/product-groups#current-product-groups) during the "Design sprint kick-off" ritual.
+**Put to the side features:** Remove `feature fest` label and notify the requestor.
 
-> The product team's commitment to the requester is that a prioritized feature will be delivered within 6 weeks or the requester will be notified within 1 business day of the decision to de-prioritize the feature. 
+> The product team's commitment to the requester is that a prioritized feature will be delivered within 6 weeks or the requester will be notified within 1 business day of the decision to de-prioritize the feature.
 
 Potential reasons for why a feature may be de-prioritized include:
-- The work was not designed in time. Since Fleet's engineering sprints are 3 weeks each, this means that a prioritized feature has 3 weeks to be designed, approved, and estimated in order to make it to the engineering sprint. At the prioritization meeting, the perceived design complexity of proposed features will inevitably be different from the actual complexity. 
+- The work was not designed in time. Since Fleet's engineering sprints are 3 weeks each, this means that a prioritized feature has 3 weeks to be designed, approved, and estimated in order to make it to the engineering sprint. At the prioritization meeting, the perceived design complexity of proposed features will inevitably be different from the actual complexity.
   - This may be because other higher-priority design work took longer than expected or the work itself was more complex than expected
 - The was designed but was not selected for the sprint. When a new sprint starts, it is populated with bugs, features, and technical tasks. Depending on the size and quantity of non-feature work, certain features may not be selected for the sprint.
 
@@ -374,14 +422,18 @@ You can read our guide to diagnosing issues in Fleet on the [debugging page](htt
   - [In engineering](https://fleetdm.com/handbook/company/product-groups#in-engineering)
   - [Awaiting QA](https://fleetdm.com/handbook/company/product-groups#awaiting-qa)
 
+
 ### All bugs
+
 - [See on GitHub](https://github.com/fleetdm/fleet/issues?q=is%3Aissue+is%3Aopen+label%3Abug).
 
 - **Bugs opened this week:** This filter returns all "bug" issues opened after the specified date. Simply replace the date with a YYYY-MM-DD equal to one week ago. [See on GitHub](https://github.com/fleetdm/fleet/issues?q=is%3Aissue+archived%3Afalse+label%3Abug+created%3A%3E%3DREPLACE_ME_YYYY-MM-DD).
 
 - **Bugs closed this week:** This filter returns all "bug" issues closed after the specified date. Simply replace the date with a YYYY-MM-DD equal to one week ago. [See on Github](https://github.com/fleetdm/fleet/issues?q=is%3Aissue+archived%3Afalse+is%3Aclosed+label%3Abug+closed%3A%3E%3DREPLACE_ME_YYYY-MM-DD).
 
+
 #### Inbox
+
 Quickly reproducing bug reports is a [priority for Fleet](https://fleetdm.com/handbook/company/why-this-way#why-make-it-obvious-when-stuff-breaks). When a new bug is created using the [bug report form](https://github.com/fleetdm/fleet/issues/new?assignees=&labels=bug%2C%3Areproduce&template=bug-report.md&title=), it is in the "inbox" state.
 
 At this state, the bug review DRI (QA) is responsible for going through the inbox and documenting reproduction steps, asking for more reproduction details from the reporter, or asking the product team for more guidance.  QA has **1 business day** to move the bug to the next step (reproduced).
@@ -390,27 +442,33 @@ For community-reported bugs, this may require QA to gather more information from
 
 Once reproduced, QA documents the reproduction steps in the description and moves it to the reproduced state. If QA or the engineering manager feels the bug report may be expected behavior, or if clarity is required on the intended behavior, it is assigned to the group's product manager. [See on GitHub](https://github.com/fleetdm/fleet/issues?q=archived%3Afalse+org%3Afleetdm+is%3Aissue+is%3Aopen+label%3Abug+label%3A%3Areproduce+sort%3Acreated-asc+).
 
+
 #### Reproduced
+
 QA has reproduced the issue successfully. It should now be transferred to engineering.
 
-Remove the “reproduce” label, add the following labels: 
+Remove the “reproduce” label, add the following labels:
 
 1. The relevant product group (e.g. `#g-endpoint-ops`, `#g-mdm`, `#g-digital-experience`).
 3. The `~released bug` label if the bug is in a published version of Fleet, or `~unreleased bug` if it is not yet published.
-2. The `:incoming` label indicates to the EM that it is a new bug. 
-3. The `:release` label will place the bug on the team's release board. 
+2. The `:incoming` label indicates to the EM that it is a new bug.
+3. The `:release` label will place the bug on the team's release board.
 
 Once the bug is properly labeled, assign it to the [relevant engineering manager](https://fleetdm.com/handbook/company/product-groups#current-product-groups). (Make your best guess as to which team. The EM will re-assign if they think it belongs to another team.) [See on GitHub](https://github.com/fleetdm/fleet/issues?q=archived%3Afalse+org%3Afleetdm+is%3Aissue+is%3Aopen+label%3Abug+label%3A%3Aproduct%2C%3Arelease+-label%3A%3Areproduce+sort%3Aupdated-asc+).
 
 > **Fast track for Fleeties:** Fleeties do not have to wait for QA to reproduce the bug. If you're confident it's reproducible, it's a bug, and the reproduction steps are well-documented, it can be moved directly to the reproduced state.
 
+
 #### In product drafting (as needed)
+
 If a bug requires input from product the `:product` label is added, the `:release` label is removed, and the PM is assigned to the issue. It will stay in this state until product closes the bug, or removes the `:product` label and assigns to an EM.
 
-#### In engineering 
+
+#### In engineering
+
 A bug is in engineering after it has been reproduced and assigned to an EM. If a bug meets the criteria for a [critical bug](https://fleetdm.com/handbook/engineering#critical-bugs), the `~critical bug` label is added, and the EM follows the [critical bug notification process](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Releasing-Fleet.md#critical-bug-notification-process).
 
-During daily standup, the EM will filter the board to only `:incoming` bugs and review with the team. The EM will remove the `:incoming` label, prioritize the bug in the "Ready" coulmn, unassign themselves, and assign an engineer or leave it unassigned for the first available engineer.  
+During daily standup, the EM will filter the board to only `:incoming` bugs and review with the team. The EM will remove the `:incoming` label, prioritize the bug in the "Ready" coulmn, unassign themselves, and assign an engineer or leave it unassigned for the first available engineer.
 
 When fixing the bug, if the proposed solution requires changes that would affect the user experience (UI, API, or CLI), notify the EM and PM to align on the acceptability of the change.
 
@@ -424,50 +482,36 @@ For Endpoint ops support on MDM bugs:
 - Remove the `#g-mdm` label and add `#g-endpoint-ops` label.
 - Add `~assisting g-mdm` to clarify the bug’s origin.
 
-Fleet [always prioritizes bugs](https://fleetdm.com/handbook/product#prioritizing-improvements). 
+Fleet [always prioritizes bugs](https://fleetdm.com/handbook/product#prioritizing-improvements).
+
 
 #### Awaiting QA
+
 Bugs will be verified as fixed by QA when they are placed in the "Awaiting QA" column of the relevant product group's sprint board. If the bug is verified as fixed, it is moved to the "Ready for release" column of the sprint board. Otherwise, the remaining issues are noted in a comment, and it is moved back to the "In progress" column of the sprint board.
 
-## High priority user stories and bugs
-All issues are treated as standard priority by default. Some issues are assigned a priority label to indicate the level of urgency.
-
-- Emergency: `P0`
-  - Examples: Customer outage, confirmed security vulnerability ([critical bug](https://fleetdm.com/handbook/company/product-groups#release-testing)), a new feature is needed to address an immediate Fleet emergency.
-  - Response: Immediately stop other work to swarm the issue. Work 24/7 in shifts until resolved.
-  - Impact: Significant impact. May void current sprint.
-
-- Critical: `P1`
-  - Examples: A supported workflow is broken ([critical bug](https://fleetdm.com/handbook/company/product-groups#release-testing)), a potential security vulnerability, a new feature is required to address an immediate critical Fleet need.
-  - Response: Issue brought to next standup for estimation and immediately brought into the sprint. Necessary team members are assigned as their top priority.
-  - Impact: High impact. Does not void sprint, but reduces overall velocity and requires deprioritizing other work.
-
-- Urgent: `P2`
-  - Examples: A supported workflow is not functioning as intended, a newly drafted feature has an associated urgent Fleet need.
-  - Response: Issue is prioritized at the top of the next sprint. If opporunity cost of waiting for the next sprint is too high, it may be considered for current sprint.
-  - Impact: Low to medium impact. If prioritized into current sprint, may reduce overall velocity and require deprioritizing other work.
-
-Add as much context as possible to the issue description and assign labels to help the team understand the problem and what is driving the urgency. All issues with a `P0`, `P1`, or `P2` label should be assigned to the [DRI for what goes in a release](https://fleetdm.com/handbook/company/communications#directly-responsible-individuals-dris). For immediate action, follow up on Slack or by phone.
-
-Once the release DRI is aware of the issue, they will adjust the labels as needed and assign to the PM and EM of the appropriate product group. If they disagree with the priority label applied to the issue, they will contact the requestor to discuss further.
 
 ## How to reach the developer on-call
+
 Oncall engineers do not need to actively monitor Slack channels, except when called in by the Community or Customer teams. Members of those teams are instructed to `@oncall` in `#help-engineering` to get the attention of the on-call engineer to continue discussing any issues that come up. In some cases, the Community or Customer representative will continue to communicate with the requestor. In others, the on-call engineer will communicate directly (team members should use their judgment and discuss on a case-by-case basis how to best communicate with community members and customers).
 
+
 ### The developer on-call rotation
+
 See [the internal Google Doc](https://docs.google.com/document/d/1FNQdu23wc1S9Yo6x5k04uxT2RwT77CIMzLLeEI2U7JA/edit#) for the engineers in the rotation.
 
 Fleet team members can also subscribe to the [shared calendar](https://calendar.google.com/calendar/u/0?cid=Y181MzVkYThiNzMxMGQwN2QzOWEwMzU0MWRkYzc5ZmVhYjk4MmU0NzQ1ZTFjNzkzNmIwMTAxOTllOWRmOTUxZWJhQGdyb3VwLmNhbGVuZGFyLmdvb2dsZS5jb20) for calendar events.
 
-New developers are added to the on-call rotation by their manager after they have completed onboarding and at least one full release cycle. We aim to alternate the rotation between product groups when possible. 
+New developers are added to the on-call rotation by their manager after they have completed onboarding and at least one full release cycle. We aim to alternate the rotation between product groups when possible.
 
 > The on-call rotation may be adjusted with approval from the EMs of any product groups affected. Any changes should be made before the start of the sprint so that capacity can be planned accordingly.
 
+
 ### Developer on-call responsibilities
+
 - **Second-line response**
 The on-call developer is a second-line responder to questions raised by customers and community members.
 
-The on-call developer is responsible for the first response to community pull requests. 
+The on-call developer is responsible for the first response to community pull requests.
 
 Customer Support Engineers are responsible for the first response to Slack messages in the [#fleet channel](https://osquery.slack.com/archives/C01DXJL16D8) of osquery Slack, and other public Slacks. The Customer Success group is responsible for the first response to messages in private customer Slack channels.
 
@@ -492,7 +536,9 @@ Fleet's documentation for contributors can be found in the [Fleet GitHub repo](h
 
 The on-call developer is asked to read, understand, test, correct, and improve at least one doc page per week. Our goal is to 1, ensure accuracy and verify that our deployment guides and tutorials are up to date and work as expected. And 2, improve the readability, consistency, and simplicity of our documentation – with empathy towards first-time users. See [Writing documentation](https://fleetdm.com/handbook/marketing#writing-documentation) for writing guidelines, and don't hesitate to reach out to [#g-digital-experience](https://fleetdm.slack.com/archives/C01GQUZ91TN) on Slack for writing support. A backlog of documentation improvement needs is kept [here](https://github.com/fleetdm/fleet/issues?q=is%3Aopen+is%3Aissue+label%3A%22%3Aimprove+documentation%22).
 
+
 ### Escalations
+
 When the on-call developer is unsure of the answer, they should follow this process for escalation.
 
 To achieve quick "first-response" times, you are encouraged to say something like "I don't know the answer and I'm taking it back to the team," or "I think X, but I'm confirming that with the team (or by looking in the code)."
@@ -503,21 +549,16 @@ How to escalate:
 
 2. Create a new thread in the [#help-engineering channel](https://fleetdm.slack.com/archives/C019WG4GH0A), tagging `@lukeheath` and provide the information turned up in your research. Please include possibly relevant links (even if you didn't find what you were looking for there). Luke will work with you to craft an appropriate answer or find another team member who can help.
 
+
 ### Changing of the guard
+
 The on-call developer changes each week on Wednesday.
 
 A Slack reminder should notify the on-call of the handoff. Please do the following:
 
-1. The new on-call developer should change the `@oncall` alias in Slack to point to them. In the
-   search box, type "people" and select "People & user groups." Switch to the "User groups" tab.
-   Click `@oncall`. In the right sidebar, click "Edit Members." Remove the former on-call, and add
-   yourself.
+1. The new on-call developer should change the `@oncall` alias in Slack to point to them. In the search box, type "people" and select "People & user groups." Switch to the "User groups" tab. Click `@oncall`. In the right sidebar, click "Edit Members." Remove the former on-call, and add yourself.
 
-2. Hand off newer conversations (Slack threads, issues, PRs, etc.). For more recent threads, the former on-call can unsubscribe from the thread, and the new on-call should subscribe. The former on-call should explicitly share each of
-   these threads and the new on-call can select "Get notified about new replies" in the "..." menu.
-   The former on-call can select "Turn off notifications for replies" in that same menu. It can be
-   helpful for the former on-call to remain available for any conversations they were deeply involved
-   in, so use your judgment on which threads to hand off. Anything not clearly handed off remains the responsibility of the former on-call developer.
+2. Hand off newer conversations (Slack threads, issues, PRs, etc.). For more recent threads, the former on-call can unsubscribe from the thread, and the new on-call should subscribe. The former on-call should explicitly share each of these threads and the new on-call can select "Get notified about new replies" in the "..." menu. The former on-call can select "Turn off notifications for replies" in that same menu. It can be helpful for the former on-call to remain available for any conversations they were deeply involved in, so use your judgment on which threads to hand off. Anything not clearly handed off remains the responsibility of the former on-call developer.
 
 In the Slack reminder thread, the on-call developer includes their retrospective. Please answer the following:
 
@@ -527,7 +568,9 @@ In the Slack reminder thread, the on-call developer includes their retrospective
 
 3. How did you spend the rest of your on-call week? This is a chance to demo or share what you learned.
 
-## Wireframes 
+
+## Wireframes
+
 - Showing these principles and ideas, to help remember the pros and cons and conceptualize the above visually.
 - Figma: [⚗️ Fleet product project](https://www.figma.com/files/project/17318630/%E2%9A%97%EF%B8%8F-Fleet-product?fuid=1234929285759903870)
 
@@ -541,6 +584,10 @@ Use the 🧩 ["Design System (current)"](https://www.figma.com/file/8oXlYXpgCV1S
 
 Use `---`, with color `$ui-fleet-black-50` as the default UI for empty columns.
 
+**Images**
+
+Simple icons (aka any images used in the icon [design system component](https://www.figma.com/design/8oXlYXpgCV1Sn4ek7OworP/%F0%9F%A7%A9-Design-system-(current)?node-id=12-2&t=iO2vXbQ9Sc1kFVEJ-1)) are exported as SVGs. All other images are exported as PNGs, following the [Fleet website image](https://github.com/fleetdm/fleet/tree/main/website/assets/images) naming conventions.
+
 **Form behavior**
 
 Pressing the return or enter key with an open form will cause the form to be submitted.
@@ -557,7 +604,7 @@ When including an external link, specify a [redirect on fleetdm.com](https://git
 
 **Tooltips**
 
-All tooltips change the cursor to a question mark on hover. All tooltips have a solid background color. 
+All tooltips change the cursor to a question mark on hover. All tooltips have a solid background color.
 
 There are two types of tooltips. The two types of tooltips have some unique styles:
 
@@ -596,13 +643,16 @@ When writing copy for CLI help pages use the following descriptions:
 $ fleetctl <command with --hosts/--host flag> -h
 
 OPTIONS
---hosts     Hosts specified by hostname, uuid, osquery_host_id or node_key that you want to target.     
---host      Host specified by hostname, uuid, osquery_host_id or node_key that you want to target.     
+--hosts     Hosts specified by hostname, uuid, osquery_host_id or node_key that you want to target.
+--host      Host specified by hostname, uuid, osquery_host_id or node_key that you want to target.
 ```
 
+
 ## Meetings
 
+
 ### User story discovery
+
 User story discovery meetings are scheduled as needed to align on large or complicated user stories. Before a discovery meeting is scheduled, the user story must be prioritized for product drafting and go through the design and specification process. When the user story is ready to be estimated, a user story discovery meeting may be scheduled to provide more dedicated, synchronous time for the team to discuss the user story than is available during weekly estimation sessions.
 
 All participants are expected to review the user story and associated designs and specifications before the discovery meeting.
@@ -622,8 +672,10 @@ All participants are expected to review the user story and associated designs an
 - Software Engineers: Clarifying questions and implementation details
 - Product Quality Specialist: Testing plan
 
+
 ### Design consultation
-Design consultations are scheduled as needed with the relevant participants, typically product designers and frontend engineers. It is an opportunity to collaborate and discuss design, implementation, and story requirements. The meeting is scheduled as needed by the product designer or frontend engineer when a user story is in the "Prioritized" column on the [drafting board](https://app.zenhub.com/workspaces/-drafting-ships-in-6-weeks-6192dd66ea2562000faea25c/board). 
+
+Design consultations are scheduled as needed with the relevant participants, typically product designers and frontend engineers. It is an opportunity to collaborate and discuss design, implementation, and story requirements. The meeting is scheduled as needed by the product designer or frontend engineer when a user story is in the "Prioritized" column on the [drafting board](https://app.zenhub.com/workspaces/-drafting-ships-in-6-weeks-6192dd66ea2562000faea25c/board).
 
 **Participants:**
 - Product Designer
@@ -632,30 +684,34 @@ Design consultations are scheduled as needed with the relevant participants, typ
 **Sample agenda**
 - Review user story requirements
 - Review wireframes
-- Discuss design input 
+- Discuss design input
 - Discuss implementation details
 
-### Design reviews
-Design reviews are conducted daily between the [Head of Product Design](https://fleetdm.com/handbook/product-design#team) and contributors proposing changes to Fleet's interfaces, such as the graphical user interface (GUI) or REST API.  This fast cadence shortens the feedback loop, makes progress visible, and encourages early feedback.  This helps Fleet stay intentional about how the product is designed and minimize common issues like UI inconsistencies or accidental breaking changes to the API.
 
-Product designers or other contributors come prepared to this meeting with their proposed changes in a GitHub issue.  Usually these are in the form of Figma wireframes, a pull request to the API docs showing changes, or a demo of a prototype.  The Head of Product Design and other participants review the changes quickly and give feedback, and then the contributor applies revisions and attends again the next day or as soon as possible for another go-round.  The Head of Product Design is responsible for looping in the right engineers, community members, and other subject-matter experts to iterate on and refine upcoming product changes in the best interest of the business.
+### Design reviews
+
+Design reviews are conducted daily between the [Head of Product Design](https://fleetdm.com/handbook/product-design#team), [CTO](https://fleetdm.com/handbook/engineering#team), and contributors (most often Product Designers) proposing changes to Fleet's interfaces, such as the graphical user interface (GUI) or REST API.  This fast cadence shortens the feedback loop, makes progress visible, and encourages early feedback. This helps Fleet stay intentional about how the product is designed and minimize common issues like UI inconsistencies or accidental breaking changes to the API.
+
+Anyone at Fleet can attend as a shadow. Shadows are asked to leave feedback/comments in the agenda doc without interrupting the meeting. This helps the team iterate and move designs to ready for spec faster. 
+
+> In addition to design reviews, Fleeties or community member can provide feedback asynchronously at any time by finding the GitHub issue (user story) associated with the designs and @ mentioning the assigned Product Designer in the comment section.
+
+Product Designers or other contributors come prepared to this meeting with their proposed changes in a GitHub issue.  Usually these are in the form of Figma wireframes, a pull request to the API docs showing changes, or a demo of a prototype.  
+
+After the meeting, the contributor applies revisions and attends again the next day or as soon as possible for another go-round.  The Head of Product Design is responsible for looping in the right engineers, community members, and other subject-matter experts to iterate on and refine upcoming product changes in the best interest of the business.
 
 Here are some tips for making this meeting effective:
-- Bring 1 key engineer who has been helping out with the user story, when possible and helpful.
 - Say the user story out loud to remind participants of what it is.
-- At the beginning of describing your change, indicate whether you are 70% sure you are 100% done, or are looking for early feedback.
 - Avoid explaining or showing multiple ways it could work.  Show the one way you think it should work and let your work speak for itself.
+- Make clear whether we're in "final review" or "feedback" mode:
+  - Final review: contributor is 70% sure the design is 100% done.
+  — Feedback: the design is not ready for final review, but contributor would like to get early feedback.
 - For follow-ups, repeat the user story, but show only what has changed or been added since the last review.
+- Bring 1 key engineer who has been helping out with the user story, when possible and helpful.
 - Read Fleet's [best practices for meetings](https://fleetdm.com/handbook/company/communications#meetings).
 
-> To allow for asynchronous participation, instead of attending, contributors can alternatively choose to add an agenda item to the "Product design review" meeting with a GitHub link.  Then, the Head of Product Design will review during the meeting and provide feedback.  Every "Product design review" is recorded and automatically transcribed to a Google Doc so that it is searchable by every Fleet team member.
-
-### Weekly bug review
-QA has weekly check-in with product to go over the inbox items. QA is responsible for proposing “not a bug”, closing due to lack of response (with a nice message), or raising other relevant questions. All requires product agreement
-
-QA may also propose that a reported bug is not actually a bug. A bug is defined as “behavior that is not according to spec or implied by spec.” If agreed that it is not a bug, then it's assigned to the relevant product manager to determine its priority.
-
 ### Group weeklies
+
 A chance for deeper, synchronous discussion on topics relevant across product groups like “Frontend weekly”, “Backend weekly”, etc.
 
 **Participants:** Anyone who wishes to participate.
@@ -665,7 +721,9 @@ A chance for deeper, synchronous discussion on topics relevant across product gr
 - Review difficult frontend bugs
 - Write engineering-initiated stories
 
+
 ### Eng Together
+
 This meeting is to disseminate engineering-wide announcements, promote cohesion across groups within the engineering team, and connect with engineers (and the "engineering-curious") in other departments. Held monthly for one hour.
 
 **Participants:** Everyone at the company is welcome to attend. All engineers are asked to attend. The subject matter is focused on engineering.
@@ -678,32 +736,49 @@ This meeting is to disseminate engineering-wide announcements, promote cohesion
   - Everyone is welcome to present on a technical topic. Add your name and tech talk subject in the agenda doc included in the Eng Together calendar event.
 - Social
   - Structured and/or unstructured social activities
+ 
+### New customer promise(s)
+
+The Chief Revenue Office (CRO) schedules this meeting before Fleet commits to one or more new customer promises. It's meant to streamline communication and encourage getting the best product decisions.
+
+**Participants:** CRO, CEO, CTO, VP of Customer Success, and Head of Product Design.
+
+**Agenda:**
+- Discuss new promises
+- Decide if we know enough to say yes/no or go back to the customer for more digging
 
 ## Development best practices
+
 - Remember the user.  What would you do if you saw that error message? [🔴](https://fleetdm.com/handbook/company#empathy)
 - Communicate any blockers ASAP in your group Slack channel or standup. [🟠](https://fleetdm.com/handbook/company#ownership)
 - Think fast and iterate.  [🟢](https://fleetdm.com/handbook/company#results)
 - If it probably works, assume it's still broken.  Assume it's your fault.  [🔵](https://fleetdm.com/handbook/company#objectivity)
 - Speak up and have short toes.  Write things down to make them complete. [🟣](https://fleetdm.com/handbook/company#openness)
 
+
 ## Product design conventions
-Behind every [wireframe at Fleet](https://fleetdm.com/handbook/company/why-this-way#why-do-we-use-a-wireframe-first-approach), there are 3 foundational design principles:  
+
+Behind every [wireframe at Fleet](https://fleetdm.com/handbook/company/why-this-way#why-do-we-use-a-wireframe-first-approach), there are 3 foundational design principles:
 
 - **Use-case first.** Taking advantage of top-level features vs. per-platform options allows us to take advantage of similarities and avoid having two different ways to configure the same thing.
 Start off cross-platform for every option, setting, and feature. If we **prove** it's impossible, _then_ work backward making it platform-specific.
 
 - **Bridge the gap.** Implement enough help text, links, guides, gifs, etc that a reasonably persistent human being can figure it out just by trying to use the UI.
-   Even if that means we have fewer features or slightly lower granularity (we can iterate and add more granularity later), make it easy enough to understand. Whether they're experienced Mac admins people or career Windows folks (even if someone has never used a Windows tool) they should _"get it"_. 
+   Even if that means we have fewer features or slightly lower granularity (we can iterate and add more granularity later), make it easy enough to understand. Whether they're experienced Mac admins people or career Windows folks (even if someone has never used a Windows tool) they should _"get it"_.
 
 - **Control the noise.** Bring the needs surface level, tuck away things you don't need by default (when possible, given time). For example, hide Windows controls if there are no Windows devices (based on number of Windows hosts).
 
+
 ## Scrum at Fleet
+
 Fleet product groups employ scrum, an agile methodology, as a core practice in software development. This process is designed around sprints, which last three weeks to align with our release cadence.
 
 New tickets are estimated, specified, and prioritized on the roadmap:
 - [Roadmap](https://app.zenhub.com/workspaces/-roadmap-ships-in-6-weeks-6192dd66ea2562000faea25c/board)
 
+
 ### Scrum items
+
 Our scrum boards are exclusively composed of four types of scrum items:
 
 1. **User stories**: These are simple and concise descriptions of features or requirements from the user's perspective, marked with the `story` label. They keep our focus on delivering value to our customers. Occasionally, due to ZenHub's ticket sub-task structure, the term "epic" may be seen. However, we treat these as regular user stories.
@@ -716,26 +791,34 @@ Our scrum boards are exclusively composed of four types of scrum items:
 
 > Our sprint boards do not accommodate any other type of ticket. By strictly adhering to these four types of scrum items, we maintain an organized and focused workflow that consistently adds value for our users.
 
+
 ## Sprints
+
 Sprints align with Fleet's [3-week release cycle](https://fleetdm.com/handbook/company/why-this-way#why-a-three-week-cadence).
 
-On the first day of each release, all estimated issues are moved into the relevant section of the new "Release" board, which has a kanban view per group. 
+On the first day of each release, all estimated issues are moved into the relevant section of the new "Release" board, which has a kanban view per group.
 
 Sprints are managed in [Zenhub](https://fleetdm.com/handbook/company/why-this-way#why-make-work-visible). To plan capacity for a sprint, [create a "Sprint" issue](https://github.com/fleetdm/confidential/issues/new/choose), replace the fake constants with real numbers, and attach the appropriate labels for your product group.
 
+
 ### Sprint numbering
+
 Sprints are numbered according to the release version. For example, for the sprint ending on June 30th, 2023, on which date we expect to release Fleet v4.34, the sprint is called the 4.34 sprint.
 
+
 ### Sprint ceremonies
+
 Each sprint is marked by five essential ceremonies:
 
 1. **Sprint kickoff**: On the first day of the sprint, the team, along with stakeholders, select items from the backlog to work on. The team then commits to completing these items within the sprint.
-2. **Daily standup**: Every day, the team convenes for updates. During this session, each team member shares what they accomplished since the last standup, their plans until the next meeting, and any blockers they are experiencing. Standups should last no longer than fifteen minutes. If additional discussion is necessary, it takes place after the standup with only the required partipants. 
+2. **Daily standup**: Every day, the team convenes for updates. During this session, each team member shares what they accomplished since the last standup, their plans until the next meeting, and any blockers they are experiencing. Standups should last no longer than fifteen minutes. If additional discussion is necessary, it takes place after the standup with only the required partipants.
 3. **Weekly estimation sessions**: The team estimates backlog items once a week (three times per sprint). These sessions help to schedule work completion and align the roadmap with business needs. They also provide estimated work units for upcoming sprints. The EM is responsible for the point values assigned to each item and ensures they are as realistic as possible.
 4. **Sprint demo**: On the last day of each sprint, all engineering teams and stakeholders come together to review the next release. Engineers are allotted 3-10 minutes to showcase features, improvements, and bug fixes they have contributed to the upcoming release. We focus on changes that can be demoed live and avoid overly technical details so the presentation is accessible to everyone. Features should show what is capable and bugs should identify how this might have impacted existing customers and how this resolution fixed that. (These meetings are recorded and posted publicly to YouTube or other platforms, so participants should avoid mentioning customer names.  For example, instead of "Fastly", you can say "a publicly-traded hosting company", or use the [customer's codename](https://fleetdm.com/handbook/customers#customer-codenames).)
 5. **Sprint retrospective**: Also held on the last day of the sprint, this meeting encourages discussions among the team and stakeholders around three key areas: what went well, what could have been better, and what the team learned during the sprint.
 
+
 ## Outside contributions
+
 [Anyone can contribute](https://fleetdm.com/handbook/company#openness) at Fleet, from inside or outside the company.  Since contributors from the wider community don't receive a paycheck from Fleet, they work on whatever they want.
 
 Many open source contributions that start as a small, seemingly innocuous pull request come with lots of additional [unplanned work](https://fleetdm.com/handbook/company/development-groups#planned-and-unplanned-changes) down the road: unforseen side effects, documentation, testing, potential breaking changes, database migrations, [and more](https://fleetdm.com/handbook/company/development-groups#defining-done).
@@ -747,11 +830,13 @@ Thus, to ensure consistency, completeness, and secure development practices, no
 The following stubs are included only to make links backward compatible
 
 ##### Endpoint ops group
-Please see [handbook/company/product-groups#endpoint-ops-group](https://fleetdm.com/handbook/company/product-groups#endpoint-ops-group)
+Please see [handbook/company/product-groups/endpoint-ops-group](https://fleetdm.com/handbook/company/product-groups#endpoint-ops-group)
 
 ##### Air guitar
 Please see [handbook/company/initiate-an-air-guitar-session](https://fleetdm.com/handbook/company/product-groups#initiate-an-air-guitar-session)
 
+##### High priority user stories and bugs
+Please see [handbook/company/communications/high-priority-user-stories-and-bugs](https://fleetdm.com/handbook/company/communications#high-priority-user-stories-and-bugs)
 
-<meta name="maintainedBy" value="mikermcneil">
+<meta name="maintainedBy" value="lukeheath">
 <meta name="title" value="🛩️ Product groups">
diff --git a/handbook/company/testimonials.yml b/handbook/company/testimonials.yml
index 96fefc9427..909daf02e3 100644
--- a/handbook/company/testimonials.yml
+++ b/handbook/company/testimonials.yml
@@ -141,15 +141,6 @@
   quoteAuthorProfileImageFilename: testimonial-author-dhruv-majumdar-48x48@2x.png
   quoteAuthorJobTitle: Director Of Cyber Risk & Advisory
   productCategories: [Vulnerability management, Endpoint operations]
--
-  quote: When we look at vendors, we look for ones that are very receptive to feedback, where you’re just part of the family, I guess. Fleet’s really good at that.
-  quoteImageFilename: logo-deputy-118x28@2x.png
-  quoteAuthorName: Harrison Ravazzolo
-  quoteAuthorProfileImageFilename: testimonial-author-harrison-ravazzolo-48x48@2x.png
-  quoteLinkUrl: https://www.linkedin.com/in/harrison-ravazzolo/
-  quoteAuthorJobTitle: Lead platform and identity engineer
-  youtubeVideoUrl: https://www.youtube.com/watch?v=5W0q5yQE3R0
-  productCategories: [Endpoint operations]
 -
   quote: Fleet has such a huge amount of use cases. My goal was to get telemetry on endpoints, but then our IR team, our TBM team, and multiple other folks in security started heavily utilizing the system in ways I didn’t expect. It spread so naturally, even our corporate and infrastructure teams want to run it.
   quoteAuthorName: Charles Zaffery
diff --git a/handbook/company/why-this-way.md b/handbook/company/why-this-way.md
index da8748cd09..6c5e89a942 100644
--- a/handbook/company/why-this-way.md
+++ b/handbook/company/why-this-way.md
@@ -12,6 +12,7 @@ Here are some of Fleet's decisions about the best way to work, and the reasoning
 
 
 ## Why open source?
+
 Fleet's source code, website, documentation, company handbook, and internal tools are [public](https://github.com/fleetdm/fleet) and accessible to everyone, including engineers, executives, and end users. (Even [paid features](https://fleetdm.com/pricing) are source-available.)
 
 Meanwhile, the [company behind Fleet](https://twitter.com/fleetctl) is built on the [open-core](https://www.heavybit.com/library/video/commercial-open-source-business-strategies) business model.  Openness is one of our core [values](https://fleetdm.com/handbook/company#values), and everything we do is [public by default](https://handbook.gitlab.com/handbook/values/#public-by-default).  Even the [company handbook](https://fleetdm.com/handbook) is open to the world.
@@ -31,6 +32,7 @@ Here are some of the reasons we build in the open:
 
 
 ## Why handbook-first strategy?
+
 The Fleet handbook provides team members with up-to-date information about how to do things in the company. 
 
 At Fleet, we make changes to the handbook first.  That means, before any change to how we run the business is "live" or "official", it is first changed in the relevant [handbook pages](https://fleetdm.com/handbook) and [issue templates](https://github.com/fleetdm/confidential/tree/main/.github/ISSUE_TEMPLATE).
@@ -43,6 +45,7 @@ To contribute to the handbook, click "Edit this page" and make your [edits in Ma
 
 
 ## Why read documentation?
+
 There are three reasons for visiting [the docs](https://fleetdm.com/docs):
 - **Tire-kicking**: "I think this is cool, now is it something that I could ACTUALLY use? Does it ACTUALLY work? What all's in it?  What links can I share with my colleagues to help them see what I'm seeing?"
 - **Committed learning**: "I've decided to learn this. I need a curriculum to get me there; with content that makes it as easy as possible, surface-level as possible. I want to learn how Fleet works and how to do all the things."
@@ -61,19 +64,21 @@ Everyone [can contribute](https://fleetdm.com/handbook/company#openness) to Flee
 <!-- 🔌🚪🪟 -->
 
 ## Why the emphasis on training?
+
 Investing in people and providing generous, prioritized training, especially up front, helps contributors understand what is going on at Fleet. By making training a prerequisite at Fleet, we can:
 - help team members feel confident in the better decisions they make at work. 
 - create a culture of helping others, which results in team members feeling more comfortable even if they aren’t familiar with the osquery, security, startup, or IT space. 
 
 Here are a few examples of how Fleet prioritizes training:
 - the first 3 days at the company for every new team member are reserved for working on the tasks and training in their onboarding issue.
-- during the first 2 weeks at the company, every new fleetie joins a **daily 1:1 meeting** with their manager to check in and see how they're doing, and if they have any questions or blockers.  If the manager is not available for this meeting, the CEO (pending availability) or the Head of Business Operations will join this short daily meeting with them instead.
+- during the first 2 weeks at the company, every new fleetie joins a **daily 1:1 meeting** with their manager to check in and see how they're doing, and if they have any questions or blockers.  If the manager is not available for this meeting, the CEO (pending availability) or the Head of Digital Experience will join this short daily meeting with them instead.
 - In their first few days, every new fleetie joins:
-  - hands-on contributor experience training session with the Head of Business Operations where they share their screen, check the configuration of their tools, complete any remaining setup, and discuss best practices.
-  - a short sightseeing tour with the Head of Business Operations and (pending availability) Fleet's CEO to show them around and welcome them to the company.
+  - hands-on contributor experience training session with the Head of Digital Experience where they share their screen, check the configuration of their tools, complete any remaining setup, and discuss best practices.
+  - a short sightseeing tour with the Head of Digital Experience and (pending availability) Fleet's CEO to show them around and welcome them to the company.
 
 
 ## Why direct responsibility?
+
 Like Apple and GitLab, Fleet uses the concept of [directly responsible individuals (DRIs)](https://about.gitlab.com/handbook/people-group/directly-responsible-individuals/) to know who is responsible for what. 
 
 DRIs help us collaborate efficiently by knowing exactly who is responsible and can make decisions about the work they're doing.  This saves time by eliminating a requirement for consensus decisions or political presenteeism, enables faster decision-making, and ensures a single individual is aware of what to do next.
@@ -85,9 +90,8 @@ DRIs help us collaborate efficiently by knowing exactly who is responsible and c
 - **Multiple maintainers**: In some cases, multiple subject-matter experts called "maintainers" can merge changes to certain file paths, even though there is already a dedicated DRI configured as the "CODEOWNER".  For examples of this, see the auto-approval flows configured as `sails.config.custom.githubRepoMaintainersByPath` and related configuration in [`website/config/custom.js`](https://github.com/fleetdm/fleet/blob/main/website/config/custom.js).
 
 
-
-
 ## Why do we use a wireframe-first approach?
+
 Wireframing (usually as part of what Fleet calls ["drafting"](https://fleetdm.com/handbook/company/development-groups#making-changes)) provides a clear overview of page layout, information architecture, user flow, and functionality. The [wireframe-first approach](https://speakerdeck.com/mikermcneil/i-love-apis?slide=28) extends beyond what users see on their screens. Wireframe-first is also excellent for drafting APIs, config settings, CLI options, and even business processes.
 
 It's design thinking, applied to software development.
@@ -109,8 +113,8 @@ Here's why Fleet uses a wireframe-first approach:
 - While the "wireframe first" practice is [still sometimes misunderstood](https://about.gitlab.com/handbook/product-development-flow/#but-wait-isnt-this-waterfall), today many modern high-performing teams now use a [wireframe-first methodology](https://speakerdeck.com/mikermcneil/i-love-apis), including [startups](https://www.forbes.com/sites/danwoods/2015/10/19/dont-get-ubered-apis-hold-key-to-digital-transformation/?sh=50112fea182c#:~:text=One%20recommendation%20that,deep%20experience) and [publicly-traded companies](https://about.gitlab.com/handbook/product-development-flow/#validation-phase-3-design).
 
 
-
 ## Why do we use one repo?
+
 At Fleet, we keep everything in one repo ([`fleetdm/fleet`](https://github.com/fleetdm/fleet)). Here's why:
 
 - One repo is easier to manage. It has less surface area for keeping content up to date and reduces the risk of things getting lost and forgotten.
@@ -138,8 +142,8 @@ Besides the exceptions above, Fleet does not use any other repositories.  Other
 > _**Tip:** In addition to the built-in search available for the public handbook on fleetdm.com, you can also [search any public AND non-public content, including issue templates, at the same time](https://github.com/search?q=org%3Afleetdm+path%3A.github%2FISSUE_TEMPLATE+path%3Ahandbook%2F+path%3Adocs%2F+foo&type=code)._
 
 
-
 ## Why not continuously generate REST API reference docs from javadoc-style code comments?
+
 Here are a few of the drawbacks that we have experienced when generating docs via tools like Swagger or OpenAPI, and some of the advantages of doing it by hand with Markdown.
 
 - Markdown gives us more control over how the docs are compiled, what annotations we can include, and how we [present the information to the end-user](https://x.com/wesleytodd/status/1769810305448616185?s=46&t=4_cwTxqV5IXDLBvCm8KI6Q). 
@@ -153,21 +157,25 @@ Here are a few of the drawbacks that we have experienced when generating docs vi
 
 
 ## Why group Slack channels?
+
 Groups (`g-*`) are organized around goals. Connecting people with the same goals helps them produce better results by fostering freer communication. Some groups align with teams in the org chart.  Other groups, such as [product groups](https://fleetdm.com/handbook/company/development-groups), are cross-functional, with some group members who do not report to the same manager.
 
 Every group at Fleet maintains their own Slack channel, which all group members join and keep unmuted.  Everyone else at Fleet is encouraged to mute these channels, using them only as needed.  Each channel has a directly responsible individual responsible for keeping up with all new messages, even if they aren't explicitly mentioned (`@`).
 
 
 ## Why make work visible?
+
 Work is tracked in [GitHub issues](https://github.com/issues?q=archived%3Afalse+org%3Afleetdm+is%3Aissue+is%3Aopen+).
 
-Every department organizes their work into [team-based kanban boards](https://app.zenhub.com/workspaces/-g-business-operations-63f3dc3cc931f6247fcf55a9/board?sprints=none).  This provides a consistent framework for how every team works, plans, and requests things from each other.
+Every department organizes their work into [team-based kanban boards](https://app.zenhub.com/workspaces/-g-digital-experience-63f3dc3cc931f6247fcf55a9/board?sprints=none).  This provides a consistent framework for how every team works, plans, and requests things from each other.
 
 1. **Intake:** Give people from anywhere in the world the ability to [request something](https://github.com/fleetdm/confidential/issues/new/choose) from a particular team, and give that team the ability to see and [respond quickly](https://fleetdm.com/handbook/company#results) to new requests.
 2. **Planning:** Give the team's manager and other team members a way to plan the [next three-week iteration](https://fleetdm.com/handbook/company/why-this-way#why-a-three-week-cadence) of what the team is working on.  Provide a world (the kanban board) where the team has clarity, and the appropriate [DRI](https://fleetdm.com/handbook/company#why-direct-responsibility) can confidently [prioritize and plan changes](https://fleetdm.com/handbook/company/development-groups#planned-and-unplanned-changes) with enough context to make the right decisions.
 3. **Shared to-do list:** What should I work on next? Who needs help? What important work is blocked? Is that bug fix merged yet? When will it be released? When will that new feature ship? What did I do yesterday?
 
+
 ## Why agile?
+
 Releasing software [🟢iteratively](https://fleetdm.com/handbook/company#results) gets changes and improvements into the hands of users faster and generally results in [🔵software that works](https://fleetdm.com/handbook/company#objectivity). This makes contributors fitter, happier, and more productive.
 
 We apply the [twelve principles of agile](https://agilemanifesto.org) to Fleet's [development process](https://fleetdm.com/handbook/company/product-groups#making-changes):
@@ -177,7 +185,7 @@ We apply the [twelve principles of agile](https://agilemanifesto.org) to Fleet's
 3. Deliver working software frequently, from a couple of weeks to a couple of months, with a preference to the shorter timescale.
 4. Business people and developers must [work together daily](https://fleetdm.com/handbook/company/product-groups) throughout the project.
 5. Build projects around motivated individuals. Give them the environment and support they need, and trust them to get the job done.
-6. The most efficient and effective method of conveying information to and within a development team is [face-to-face conversation](https://fleetdm.com/handbook/business-operations#meetings).
+6. The most efficient and effective method of conveying information to and within a development team is [face-to-face conversation](https://fleetdm.com/handbook/communications#meetings).
 7. Working software is the primary measure of progress.
 8. Agile processes promote sustainable development. The sponsors, developers, and users should be able to maintain a constant pace indefinitely.
 9. Continuous attention to technical excellence and good design enhances agility.
@@ -187,6 +195,7 @@ We apply the [twelve principles of agile](https://agilemanifesto.org) to Fleet's
 
 
 ### Why scrum?
+
 Scrum is an agile framework for software development that helps teams deliver high quality software faster. It emphasizes teamwork, collaboration, and continuous improvement to achieve business objectives. Here are some of the key reasons why [we use scrum at Fleet](https://fleetdm.com/handbook/engineering#scrum)): 
 - Improved collaboration and communication: Scrum emphasizes teamwork and collaboration, which leads to better communication between team members and stakeholders. This helps ensure that everyone is aligned and working towards the same goals.
 - Flexibility and adaptability: Scrum allows teams to respond quickly to changing requirements and market conditions. By working in short sprints, teams can continuously adapt to new information and feedback, and adjust their approach as needed.
@@ -194,7 +203,9 @@ Scrum is an agile framework for software development that helps teams deliver hi
 - Faster delivery of working software: Scrum helps teams deliver working software faster by breaking down the development process into manageable chunks that can be completed within a sprint. Stakeholders can see progress and provide feedback more quickly, which helps ensure the final product meets their needs.
 - Higher quality software: Scrum includes regular testing and quality assurance activities, which help ensure that the software being developed is of high quality and meets the required standards.
 
+
 ### Why lean software development?
+
 [Lean software development](https://en.wikipedia.org/wiki/Lean_software_development) is an iterative and incremental approach to software development that aims to eliminate waste and deliver value to customers quickly. It is based on the principles of [lean manufacturing](https://en.wikipedia.org/wiki/Lean_manufacturing) and emphasizes continuous improvement, collaboration, and customer focus.
 
 Lean development can be summarized by its seven principles:
@@ -206,7 +217,9 @@ Lean development can be summarized by its seven principles:
 6. Build integrity in: Build quality into the software by continuously testing, reviewing, and improving the code throughout the development process.
 7. Optimize the whole: Optimize the entire process and focus on the system's overall performance rather than just individual parts to ensure the most efficient and effective use of resources.
 
+
 ## Why a three-week cadence?
+
 The Fleet product is released every three weeks. By syncing the whole company to this schedule, we can:
 
 - Keep all team members (especially those who aren't directly involved with the core product) aware of the current version of Fleet and when the next release is shipping.
@@ -228,7 +241,9 @@ Why bother with all that?  And why do it in this particular order?
 - **Better customer experience.** Understanding the impact of every production issue means we can reach out to affected users ASAP and acknowledge their challenge, showing them that Fleet takes quality and stability seriously.  This kind of customer support is rare and memorable.
 - **It helps us prevent future outages.** By finding outages sooner, we incentivize ourselves to fix the root cause sooner.  And by fixing bugs sooner, we prevent them from stacking and bleeding into one another, and we prevent ourselves from implementing future fixes and improvements on top of shaky foundations.  This makes contributions less risky and reduces the number of outages.
 
+
 ## Why make it obvious when stuff breaks?
+
 At Fleet, we detect and fix bugs as quickly as possible.  
 
 Breaking loudly means we can fix the break sooner and improve how fast and certain we are about making future changes.  Especially in an all-remote environment, this provides contributors with discipline around quality and stability of the main branch.  This is ["good annoying"](https://agilehope.blogspot.com/2014/12/diy-build-light-indicator.html).
@@ -239,7 +254,9 @@ If that happens by mistake, first priority is merging a fix, then notifying the
 
 > Here is [an example of a deliberate decision to make broken images in Fleet fail more loudly](https://github.com/fleetdm/fleet/issues/12305#issuecomment-1671924257) so that they can't be overlooked, even though this might slow down short-term development.
 
+
 ## Why keep issue templates simple?
+
 At Fleet, we optimize for the person submitting the issue, not the person receiving it.
 
 We avoid making the submitter read anything.  We prompt for as little information as possible.  Why?
@@ -251,6 +268,7 @@ For example, here is the [philosophy behind Fleet's bug report template](https:/
 
 
 ## Why spend less?
+
 - **Default to efficiency. Reward richly.** At Fleet, we celebrate success and reward hard work.  But we do everyday things cheap.  And that is very important, because it shapes the kind of people we hire, and the kind of expectations we set for the team about what "comfortable" feels like.
 - **Offsites are not rewards.** Day to day, Fleet does not look rich.  Rich !== welcoming.  The company is open, not closed.  Work here means flexible collaboration, accessible people, and clear expectations.  And a rich, exciting future worth working for.  Not a rich, complacent baseline worth coasting for.
 - **Minimally viable comfort.**  We stay at La Quintas by the train tracks every single time unless customers are coming into the room and we need more space.  Even then, we accommodate in the spirit of _hospitality_, not to show off how well Fleet is doing.  They'll know how well we're doing by how great the product is, how great the support is, and [how that makes them feel](https://fleetdm.com/handbook/company#purpose).  They'll remember openness, flexibility, accessibility, and clarity in all of their interactions with the brand.  Not the view from our hotel rooms.
@@ -258,6 +276,7 @@ For example, here is the [philosophy behind Fleet's bug report template](https:/
 
 
 ## Why don't we sell like everyone else?
+
 Many companies encourage salespeople to ["spray and pray"](https://www.linkedin.com/posts/amstech_the-rampant-abuse-of-linkedin-connections-activity-7178412289413246978-Ci0I?utm_source=share&utm_medium=member_ios) email blasts, and to do whatever it takes to close deals.  This can sometimes be temporarily effective.  But Fleet takes a [🟠longer-term](https://fleetdm.com/handbook/company#ownership) approach:
 - **No spam.**  Fleet is deliberate and thoughtful in the way we do outreach, whether that's for community-building, education, or [🧊 conversation-starting](https://github.com/fleetdm/confidential/blob/main/cold-outbound-strategy.md).
 - **Be a helper.**  We focus on [🔴being helpers](https://fleetdm.com/handbook/company#empathy).  Always be depositing value.  This is how we create a virtuous cycle. (That doesn't mean sharing a random article; it means genuinely hearing, doing whatever it takes to fully understand, and offering only advice or links that we would actually want.)  We are genuinely curious and desperate to help, because creating real value for people is the way we win.
@@ -268,39 +287,8 @@ Many companies encourage salespeople to ["spray and pray"](https://www.linkedin.
 - **Step up.** We look at the [🟠big picture](https://fleetdm.com/handbook/company#ownership).  The goal is for the organization using Fleet to be successful, as well as the individuals who decide to use or buy the product.  There are multiple versions of Fleet, and so many ways to "do" open-source security and IT.  It is in the company's best interest to help engineers pick the right one; even if that's Fleet Free, or another solution altogether.  We think about our customer's needs like they are our own.
 
 
-## Why don't we track leads differently?
-There are about as many "MQL" definitions as there are sales orgs in the world. Exaggerating here, but only somewhat.
-
-Fleet documents all KPI's with clear definitions that are simple to evaluate, easy to track, and highly iterable.
-
-- **Lead** == A "Lead" row in Salesforce.
-  
-- **MQL** == a human from an in-ICP organization that meets these parameters when the lead is created:
-  - Their organization is _not_ already a Fleet customer
-  - Their organization is _not_ already considering buying Fleet as part of a qualified, mutually beneficial opportunity
-  - Our friend, the human, has chosen to open or widen their line of communication with the company. This could come from an event or or sending a contact form message requesting a call.
-    - Attendees at events are considered MQLs if they have done any of the following:
-      -  Had a 5+ minute conversation or a badge scan at a physical event.
-      -  RSVPed yes to extracurricular in-person side event (e.g. dinner or activity) OR attended the in-person side event and a Fleetie was able to track their attendance.
-      -  RSVPed yes to a virtual event OR indicated intent by sending a follow-up email.
-  - Multiple people from the same org each count as _separate_ MQLs. <!-- However, Once the opportunity is created for an account, all MQLs associated with that account become "converted". Meaning they no longer count towards "open MQLs", though they still count as MQLs created. -->
-  - When an account converts to an opportunity, all subsequent new leads created for that account are ***NOT*** MQLs (i.e. do not count towards "MQLs created".). If an opportunity is marked "closed lost", then it is _no longer_ open, so subsequent new leads associated with the prospective customer are considered MQLs again.
-
-- **Open MQL** == An MQL whose lead status is neither _"disqualified" nor "converted"_.
-  
-- **SQL** == An MQL whose lead status in Salesforce has exceeded a _certain threshold_, for **any** reason, from **any** source (threshold TBD: we aren't reporting these yet in KPIs)
-  
-- **Lead source** == where a lead came from. To determine attribution, we will consider the lead source. (e.g. sales-sourced vs. marketing-sourced vs. misc-sourced leads can be determined by looking at the lead source. No need to establish any other *QL or change these.)
-
-  - Instead of saying _"outbound lead"_ or _"inbound lead"_, you can say _"a lead from a badge scan at an event"_ or _"a lead from a customer referral"_ or _"a lead from the website"_.
-
-- **Opportunity** == A _"Opportunity"_ row in Salesforce.
-
-- **Open opportunity** == An opportunity whose stats is not _"closed lost"_ nor _"closed won"_.
-
-
-
 ## Why does Fleet support query packs?
+
 As originally envisioned by Zach Wasserman and the team when creating osquery, packs are a way to import and export queries into (and out of!) any platform that speaks osquery, whether that's Fleet, [Security Onion](https://securityonionsolutions.com/), an EDR, or even Rapid7. Queries [should be portable](https://github.com/fleetdm/fleet/blob/f711e60de47c69ab8be5bc13cf73fedf88adc338/README.md#lighter-than-air) to minimize lock-in to particular tools.
 
 The "Packs" section of the UI that began in `kolide/fleet` c. 2017 was an early attempt to  segment and target formations of hosts that share certain characteristics.  This came with some difficulties with debugging and collaboration, since it could be hard to tell which queries were running on which hosts. It also made it harder to understand what performance impact running all those queries might cause.
@@ -311,7 +299,9 @@ The first step was to add a simpler way to schedule queries, and tuck away the l
 
 Packs will always be supported in Fleet.
 
+
 ## Why does Fleet use sentence case?
+
 Fleet uses sentence case capitalization for all headings, subheadings, button text in the Fleet product, fleetdm.com, the documentation, the handbook, marketing material, direct emails, in Slack, and in every other conceivable situation.
 
 In sentence case, we write and capitalize words as if they were in sentences:
@@ -322,7 +312,9 @@ As we use sentence case, only the first word is capitalized. But, if a word woul
 
 The reason for sentence case at Fleet is that everyone capitalizes differently in English, and capitalization conventions have not been taught very consistently in schools.  Sentence case simplifies capitalization rules so that contributors can deliver more natural, even-looking content with a voice that feels similar no matter where you're reading it.
 
+
 ## Why not use superlatives?
+
 A superlative is an adjective or adverb that expresses the degree of a quality, such as "best," "worst," or "most beautiful."
 
 A superlative is a judgment or evaluation, [which only the customer can decide](https://twitter.com/mikermcneil/status/1686837625187930112). 
@@ -341,6 +333,7 @@ Avoid using too many unnecessary words or superlatives, so your writing is short
 
 
 ## Why does Fleet use "MDM on/off" instead of "MDM enrolled/unenrolled"?
+
 MDM should be a capability, not a product category.
 
 In Fleet, the word "enrolled" means "the host shows up in the dashboard and API".
@@ -351,7 +344,9 @@ Since Fleet is more than MDM, you can collect logs and health data on any comput
 
 That means you can collect logs from Linux servers or Windows factory workstations without enabling remote script execution on those computers, even if you're using script execution on your Macs.
 
+
 ## Why not mention the CEO in Slack threads?
+
 Everyone else who works at Fleet is expected to read (and reply or acknowledge with an emoji reaction) every time they're mentioned in Slack, even deep inside long threads.
 
 Now that the company has grown, the CEO gets mentioned in threads [too often](https://docs.google.com/document/d/1vK-Dy2BVrw7doYUzabOPyCiN4RfolWFgOKMm23l91s0/edit) to keep up with thread replies, even for threads he participates in.
@@ -377,6 +372,7 @@ Thank you so much!" 🙇
 
 
 #### Stubs
+
 The following stubs are included only so that old links continue to work (for backwards compatibility.)
 
 ##### Reporting structure
diff --git a/handbook/customer-success/README.md b/handbook/customer-success/README.md
index 1aefe82038..0aeba57401 100644
--- a/handbook/customer-success/README.md
+++ b/handbook/customer-success/README.md
@@ -9,7 +9,7 @@ This handbook page details processes specific to working [with](#contact-us) and
 |:--------------------------------------|:------------------------------------------------------------------------------------------------------------------------|
 | VP of Customer Success                | [Zay Hanlon](https://www.linkedin.com/in/zayhanlon/) _([@zayhanlon](https://github.com/zayhanlon))_
 | Infrastructure Engineer               | [Robert Fairburn](https://www.linkedin.com/in/robert-fairburn/) _([@rfairburn](https://github.com/rfairburn))_
-| Customer Support (CSE/CSA)       | [Kathy Satterlee](https://www.linkedin.com/in/ksatter/) _([@ksatter](https://github.com/ksatter))_ <br> [Grant Bilstad](https://www.linkedin.com/in/grantbilstad/) _([@Pacamaster](https://github.com/Pacamaster))_ <br> [Dale Ribeiro](https://www.linkedin.com/in/daleribeiro/) _([@ddribeiro](https://github.com/ddribeiro))_ <br> Ben Edwards _([@edwardsb](https://github.com/edwardsb))_ <br> [Brock Walters](https://www.linkedin.com/in/brock-walters-247a2990/) _([@nonpunctual](https://github.com/nonpunctual))_
+| Customer Support (CSE/CSA)       | [Kathy Satterlee](https://www.linkedin.com/in/ksatter/) _([@ksatter](https://github.com/ksatter))_ <br> [Rebecca Cowart](https://www.linkedin.com/in/rebeccaui/) _([@rebeccaui](https://github.com/rebeccaui))_ <br> [Dale Ribeiro](https://www.linkedin.com/in/daleribeiro/) _([@ddribeiro](https://github.com/ddribeiro))_ <br> Ben Edwards _([@edwardsb](https://github.com/edwardsb))_ <br> [Brock Walters](https://www.linkedin.com/in/brock-walters-247a2990/) _([@nonpunctual](https://github.com/nonpunctual))_
 | Customer Success Manager (CSM)        | [Jason Lewis](https://www.linkedin.com/in/jlewis0451/) _([@patagonia121](https://github.com/patagonia121))_ <br> [Michael Pinto](https://www.linkedin.com/in/michael-pinto-a06b4515a/) _([@pintomi1989](https://github.com/pintomi1989))_
 
 
@@ -29,7 +29,7 @@ The customer success department is directly responsible for ensuring that custom
 
 Occasionally, we will need to track public issues for customers and prospects who wish to remain anonymous on our public issue tracker. To do this: 
 
-1. The team member creating the issue will choose an appropriate minor planet name from this [Minor planets page](https://minorplanetcenter.net//iau/lists/MPNames.html) (alphabetical).
+1. The team member creating the issue will choose an appropriate minor planet name from this [minor planets page](https://minorplanetcenter.net//iau/lists/MPNames.html) (alphabetical).
 2. Create a label in the fleetdm/fleet and fleetdm/confidential repos which can be attached to current and future issues for the customer or prospect. As part of the label description in the fleetdm/confidential repo, add the customer or prospect name. This way, we maintain a confidential mapping of codename to customer or prospect.
 
 
@@ -56,10 +56,20 @@ Before a routine customer call, the CSM prepares an agenda including the followi
 4. Fill out all the required fields making sure to pick "Expansion" in the  "Type" dropdown menu and then click "Save".
 
 
+### Conduct a health check
+
+Health checks are conducted quarterly or bi-annually, in preparation for a quarterly business review (QBR). The purpose of a health check is to understand what features and functionality the customer is currently using in Fleet. This information will be used to provide guidance to the customer during their QBR. For more information around QBRs, please see the section below, titled "Conduct a quarterly business review".
+
+1. Work with your champion to schedule the health check at a time when their Fleet admins and daily users are available. Be sure to take notes, and record the meeting if possible.
+2. During the meeting, ask the customer to share their screen and walk through their day-to-day use of Fleet.
+3. Ask the customer questions about the features they are using to understand the "why" behind their use cases for Fleet. Try not to provide guidance directly on this call.
+4. Review your notes after the meeting, and find areas of improvement that you can highlight to help your partner more thoroughly utilize Fleet and add your findings to the QBR deck.
+
+
 ### Conduct a quarterly business review (QBR)
 
 Business reviews are conducted quarterly or bi-annually to ensure initial success criteria completion, ongoing adoption, alignment on goals, and delivery of value as a vendor. Use the meeting to assess customer priorities for the coming year, review performance metrics, address any challenges and showcase value in upcoming and unutilized features.
-1. Work with your champion to schedule the business review at a time thier stakeholders are available (typically 90 days after kickoff and again, 90 days before renewal).
+1. Work with your champion to schedule the business review at a time their stakeholders are available (typically 90 days after kickoff and again, 90 days before renewal).
 2. Collect usage metrics from the [usage data report](https://docs.google.com/spreadsheets/d/1Mh7Vf4kJL8b5TWlHxcX7mYwaakZMg_ZGNLY3kl1VI-c/edit?gid=0#gid=0) (internal Fleet document) and the following:
     - Optionally schedule a health check with day to day admins prior to the QBR to better understand how the product is being used and which features have been adopted.
     - Have a support engineer collect data on open and closed bugs from the previous quarter and highlight any P0 or P1 incidents along with a summary of the postmortem (search Unthread and GitHub for issues tagged with the customer codename and ':bug').
diff --git a/handbook/customer-success/customer-success.rituals.yml b/handbook/customer-success/customer-success.rituals.yml
index 017063ae96..2c493ccf74 100644
--- a/handbook/customer-success/customer-success.rituals.yml
+++ b/handbook/customer-success/customer-success.rituals.yml
@@ -2,7 +2,7 @@
   task: "Prioritize for next sprint" # Title that will actually show in rituals table
   startedOn: "2023-09-04" # Needs to align with frequency e.g. if frequency is every thrid Thursday startedOn === any third thursday
   frequency: "Triweekly" # must be supported by
-  description: "Drag next sprint's priorities to the top of the 'Not yet' column." # example of a longer thing: description: "[Prioritizing next sprint](https://fleetdm.com/handbook/company/communication)"
+  description: "Using your departmental kanban board, prioritize and finalize next sprint's goals for your team by draging the appropriate issues to the top of the 'Not yet' column." # example of a longer thing: description: "[Prioritizing next sprint](https://fleetdm.com/handbook/company/communication)"
   moreInfoUrl: "https://fleetdm.com/handbook/company/why-this-way#why-make-work-visible" #URL used to highlight "description:" test in table
   dri: "zayhanlon" # DRI for ritual (assignee if autoIssue) (TODO display GitHub proflie pic instead of name or title)
   autoIssue:   # Enables automation of GitHub issues
diff --git a/handbook/demand/README.md b/handbook/demand/README.md
index 8f62bda026..69dd7a2d84 100644
--- a/handbook/demand/README.md
+++ b/handbook/demand/README.md
@@ -7,7 +7,7 @@ This handbook page details processes specific to working [with](#contact-us) and
 
 | Role                               | Contributor(s)
 |:-----------------------------------|:------------------------------------------------------------------------------------------------------------------------|
-| Digital Marketing Manager          | [Drew Baker](https://www.linkedin.com/in/andrew-baker-51547179/) _([@drewbakerfdm](https://github.com/drewbakerfdm))_
+| Head of Marketing                   | [Drew Baker](https://www.linkedin.com/in/andrew-baker-51547179/) _([@drewbakerfdm](https://github.com/drewbakerfdm))_
 
 
 ## Contact us
@@ -58,6 +58,49 @@ To propose an ad, or a change to an ad:
 7. Create a calendar reminder to check ad performance two weeks from the date changes were made.
 
 
+### Measure intent signals
+
+Intent signals help measure an individual's current level of engagement with the Fleet brand. Use the following steps to decide if:  
+
+(a) A contact and/or account needs to be created/updated. 
+
+(b) An account should be prioritized for [manual research](https://fleetdm.com/handbook/demand#research-an-account).
+
+(c) An account/contact would benefit from a sales conversation.
+
+(in order of how worthwhile it is to spend time looking at the intent signal)
+
+1. Accounts currently assigned to reps (i.e. pipeline + stage0 + pre-pipeline IQMs).
+2. Accounts with trending psychological progression (as measured by fleetdm.com website signups (i.e. new contacts ± contacts that have increased their psystage to a certain point).
+3. Accounts that fleeties have suggested to go after in ABM maneuver sheet.
+4. [MacAdmins Slack traffic](https://macadmins.slack.com/archives/C0214NELAE7/p1722561481530559) in the #fleet AND #osquery channels (channel joins, posts, reactions, thread replies, thread reactions).
+5. [LinkedIn page follows](https://www.linkedin.com/company/71111416/admin/analytics/followers/).
+6. [GitHub stars to fleetdm/fleet](https://github.com/fleetdm/fleet/stargazers) from non-fleeties.
+
+
+### Research an account
+
+Follow these steps to research an account and move it toward sales-readiness **after** discovering [relevant intent signals](https://fleetdm.com/handbook/demand#measure-intent-signals).
+
+1. Create the account in SalesForce if it doesn't already exist.
+2. Update any incorrect, mistagged, or incomplete contacts already on the account and merge any duplicates that are found. Verify the following data is current for each existing contact:
+  - "Title"
+  - "Role"
+  - "Primary buying situation" 
+  - "LinkedIn"
+  - "Psychological stage" 
+  - "intent signals" 
+3. If you any reason that the account organization wouldn't benefit from a relationship with Fleet, change the "Type" to "Distraction" stop here. If you haven't disqualified the account at this point, update the "Marketing stage" to "Research-ready". 
+After an account is marked "[Research-ready](https://fleetdm.lightning.force.com/lightning/r/Report/00OUG000001LerV2AS/view?queryScope=userFolders)".
+
+1. Research missing contacts and add them to salesforce if they are real by using the [ABM maneuvers spreadsheet](https://docs.google.com/spreadsheets/d/1ijtBKTjPg_AodnKEZY0ivia70ttDR3VMURT8rpYwYiw/edit?gid=0#gid=0) to generate a Sales Nav search. Make sure they have "role", "buying situation", "linkedinUrl", "psychological stage", "intent signals" completely filled out and correct.
+2. For "Contact source" for any new contacts, use "Manual research".
+3. Rank the account in terms of closability and fit based on what we see from it and its contacts. Mark any account that is not a fit as "Distraction" instead of "Prospect".
+4. Research and discover mutual connections between fleeties and Mac admin community members within those contacts to help determine fit.
+5. Check Snitcher activity for the account and the psystages of its contacts in Salesforce.
+6. Update the "marketing stage" AND "type" accordingly (qualify or disqualify based on whether the contacts look good). Start running ABM ads on the account if moving it to "Ads running" for a total of 60 days otherwise, stop them if moving it out of "Ads running".
+
+
 ### Promote a post on LinkedIn
 
 1. Create a classic campaign under ["Experiments"](https://www.linkedin.com/campaignmanager/accounts/509911695/campaigns?campaignGroupIds=%5B678398233%5D) following the YYYY-MM-DD.buying-situation - ad description with a goal of website visits or engagement to run for two weeks.
@@ -66,9 +109,24 @@ To propose an ad, or a change to an ad:
 4. Launch campaign once approved.
 
 
+### Settle content strategy
+
+The Head of Marketing is the DRI for deploying Fleet's outward-facing content. The content schedule is settled significantly in advance to provide ample time for strategy and planning. Use the following steps to settle content strategy:
+
+1. Using the [content calendar](https://docs.google.com/spreadsheets/d/1KUMsb5OkAsCBQHGkGnNoj__UCPJ7Vbhk1LaEWGEARsg/edit?gid=1931288160#gid=1931288160), propose the content that Fleet will produce in the current quarter, and the strategy behind that content, including:
+  - Content type and title (e.g. "Article: Fleet takes bacon to new heights with flying pigs release").
+  - Create date: The date by which the DRI will start crafting the content.
+  - Release date: The date by which the content will be complete and finalized.
+  - Primary buying situation: The intended audience.
+  - DRI: Person(s) responsible for the project management of this content.
+  - Author: Person(s) responsible for the creation of this content.
+  - Related event?: Related community or Fleet event, if any.
+2. Attend a 30m meeting with Fleet's Client Platform Engineer & Community Advocate, CTO, and CEO to review and settle the proposed content.
+
+
 ### Settle event strategy
 
-The Head of Demand is the DRI for deploying Fleet's event budget, and events are settled significantly in advance to provide ample time for strategy and planning.  Fleet's [Client Platform Engineer & Community Advocate](https://fleetdm.com/handbook/engineering#team) is the DRI for executing Fleet events efficiently, on-brand, and on-strategy.
+The Head of Marketing is the DRI for deploying Fleet's event budget, and events are settled significantly in advance to provide ample time for strategy and planning.  Fleet's [Client Platform Engineer & Community Advocate](https://fleetdm.com/handbook/engineering#team) is the DRI for executing Fleet events efficiently, on-brand, and on-strategy.
 
 1. Using the [event strategy workbook](https://docs.google.com/spreadsheets/d/1YQXAX2Q_WnGkAwMYjMbQpV3nbCj7gOBbv7Y0u4twxzQ/edit#gid=1411322737), propose the events that Fleet will attend in the next 6 months, and the strategy for those events, including:
   - target buying situation of the audience
@@ -78,11 +136,31 @@ The Head of Demand is the DRI for deploying Fleet's event budget, and events are
   - all event materials, including printouts, banners, swag given out, and even the clothing worn by fleeties
   - estimated budget, including sponsorship or airfare, and lodging for attendees
 2. Set up and attend a 30m meeting with the Fleet's Client Platform Engineer & Community Advocate and CEO:
-  - First during this meeting, the Head of Demand proposes an event issue for each of the **_current quarter's_** events to get input and any new information or changes from Fleet's Client Platform Engineer & Community Advocate and CEO. (Events for the current quarter were already decided in a previous event strategy session, so Fleet does not make changes except in extreme circumstances.)
+  - First during this meeting, the Head of Marketing proposes an event issue for each of the **_current quarter's_** events to get input and any new information or changes from Fleet's Client Platform Engineer & Community Advocate and CEO. (Events for the current quarter were already decided in a previous event strategy session, so Fleet does not make changes except in extreme circumstances.)
   - Next, decide which events in the **_following quarter_** the company will invest time or money into.  This includes any event that Fleet pays to send someone to or to sponsor, and even events where Fleet's only involvement is that a fleetie will be giving a talk or otherwise representing the brand.
   - Finally, qualify or disqualify any newly-entered event ideas by either verifying and setting the buying situation, or removing the event idea from the spreadsheet.
 
 
+### Upload contacts to Salesforce after an event
+
+1. [Create a new lead source](https://fleetdm.lightning.force.com/lightning/setup/ObjectManager/Contact/FieldsAndRelationships/LeadSource/view) with naming convention "[Retired]Events - {Event name}". 
+2. Add the new lead source name to the .csv of leads before uploading to Salesforce.
+    a. Add a new column header labeled "Lead source" and add the new lead source name to each row in the CSV.
+
+
+3. Navigate to the [contact import wizard](https://fleetdm.lightning.force.com/one/one.app#eyJjb21wb25lbnREZWYiOiJvbmU6YWxvaGFQYWdlIiwiYXR0cmlidXRlcyI6eyJhZGRyZXNzIjoiL2RhdGFJbXBvcnRlci9kYXRhSW1wb3J0ZXIuYXBwP29iamVjdFNlbGVjdGlvbj1BY2NvdW50In0sInN0YXRlIjp7fX0%3D):
+    a. Select the standard object "Accounts and Contacts".
+    b. Select "Add new and update existing records" (Do not change the matching rules). 
+    c. Upload the CSV.
+    d. Verify the data is mapped to the correct Salesforce fields and start the Import.
+
+
+### Follow up after an event
+
+1. Email relevant information according to the event buying situation, but refer to the original lead list in [Google Drive](https://drive.google.com/drive/u/0/folders/1uXf95V6CHKHnqxRc9iQr0a0FnTZk3bXR) for those who asked for contact.
+2. If feedback is present in the original event CSV, manually add any worthwhile feedback to the contact description in Salesforce.
+
+
 ### Optimize ads through experimentation
 
 Fleet improves click-through rates in their campaigns to make the most of their advertising budget and attract more engaged users, boosting product adoption and community participation.
@@ -138,7 +216,7 @@ There are many times in which community members, customers, and contributors are
 - Reach out to the contributor to thank them for their contribution
 - Consider sharing the contribution on social media
 - Ask if we could send the contributor any swag
-- If yes, follow the steps to fufuill a swag request.
+- If yes, follow the steps to fulfill a swag request.
 
 
 ### Run a new ad or change an existing ad
@@ -150,7 +228,6 @@ Any changes to the current running ads visible to a user, including designs, key
 
 > **Do changes to keywords or targeting require a design review?** Currently, all changes to these things require discussion with our product marketer.
 
-
 ### Engage with the community
 
 Public conversations on social media create valuable opportunities for contributors to answer technical questions and collect feedback.
diff --git a/handbook/demand/demand.rituals.yml b/handbook/demand/demand.rituals.yml
index f64b087da0..dc1ae27b47 100644
--- a/handbook/demand/demand.rituals.yml
+++ b/handbook/demand/demand.rituals.yml
@@ -9,7 +9,7 @@
   task: "Prioritize for next sprint" # Title that will actually show in rituals table
   startedOn: "2023-09-04" # Needs to align with frequency e.g. if frequency is every thrid Thursday startedOn === any third thursday
   frequency: "Triweekly"
-  description: "Drag next sprint's priorities to the top of the 'Not yet' column." # example of a longer thing: description: "[Prioritizing next sprint](https://fleetdm.com/handbook/company/communication)"
+  description: "Using your departmental kanban board, prioritize and finalize next sprint's goals for your team by draging the appropriate issues to the top of the 'Not yet' column." # example of a longer thing: description: "[Prioritizing next sprint](https://fleetdm.com/handbook/company/communication)"
   moreInfoUrl: "https://fleetdm.com/handbook/company/why-this-way#why-make-work-visible" #URL used to highlight "description:" test in table
   dri: "mikermcneil" # DRI for ritual (assignee if autoIssue) (TODO display GitHub proflie pic instead of name or title)
   autoIssue:   # « Enable automation of GitHub issues
@@ -22,6 +22,13 @@
   description: "https://fleetdm.com/handbook/demand#settle-event-strategy"
   moreInfoUrl: "https://fleetdm.com/handbook/demand#settle-event-strategy"
   dri: "Drew-P-drawers"
+-
+  task: "🫧 Pipeline sync"
+  startedOn: "2024-08-29"
+  frequency: "Weekly"
+  description: "Allign with CRO and AEs on pipeline processes and incoming leads"
+  moreInfoUrl: ""
+  dri: "Drew-P-drawers"
 -
   task: "Optimize ads"
   startedOn: "2024-02-26"
@@ -50,6 +57,20 @@
   description: "Every release cycle, upload the ☁️🌈 Sprint demos video to YouTube"
   moreInfoUrl: "https://fleetdm.com/handbook/demand#upload-to-youtube"
   dri: "Drew-P-drawers"
+- 
+  task: "Measure intent signals"
+  startedOn: "2024-08-09"
+  frequency: "Daily"
+  description: "Measure intent signals and update SalesForce"
+  moreInfoUrl: "https://fleetdm.com/handbook/demand#measure-intent-signals"
+  dri: "Drew-P-drawers"
+- 
+  task: "Research accounts"
+  startedOn: "2024-08-09"
+  frequency: "Daily"
+  description: "Research SalesForce accounts and begin ABM ads"
+  moreInfoUrl: "https://fleetdm.com/handbook/demand#warm-up-actions"
+  dri: "Drew-P-drawers"
 # -
 #   task: "Propose a fleet event"
 #   startedOn: "2023-10-02"
diff --git a/handbook/digital-experience/README.md b/handbook/digital-experience/README.md
index b4bc7db24a..1fec6328ca 100644
--- a/handbook/digital-experience/README.md
+++ b/handbook/digital-experience/README.md
@@ -7,29 +7,238 @@ This page details processes specific to working [with](#contact-us) and [within]
 
 | Role                            | Contributor(s)
 |:--------------------------------|:----------------------------------------------------------------------|
+| [CEO](https://fleetdm.com/handbook/company/leadership#ceo-flaws) | [Mike McNeil](https://www.linkedin.com/in/mikermcneil) _([@mikermcneil](https://github.com/mikermcneil))_
+| Head of People / HR / Legal     | <sup><sub> See [CEO](https://www.fleetdm.com/handbook/digital-experience#team) <sup><sub>
+| Apprentice to the CEO           | <sup><sub> See [Head of Digital Experience](https://www.fleetdm.com/handbook/digital-experience#team) <sup><sub>
 | Head of Digital Experience      | [Sam Pfluger](https://www.linkedin.com/in/sampfluger88/) _([@sampfluger88](https://github.com/sampfluger88))_ 
+| Apprentice                      | [Savannah Friend](https://www.linkedin.com/in/savannah-friend-2b1a53148/) _([@sfriendlee](https://github.com/sfriendlee))_
 | Head of Design                  | [Mike Thomas](https://www.linkedin.com/in/mike-thomas-52277938) _([@mike-j-thomas](https://github.com/mike-j-thomas))_
 | Software Engineer               | [Eric Shaw](https://www.linkedin.com/in/eric-shaw-1423831a9/) _([@eashaw](https://github.com/eashaw))_
-| Apprentice to the CEO           | <sup><sub> See [Head of Digital Experience](https://www.fleetdm.com/handbook/digital-experience#team) <sup><sub>
-| Apprentice                      | [Savannah Friend](https://www.linkedin.com/in/savannah-friend-2b1a53148/) _([@sfriendlee](https://github.com/sfriendlee))_
+| Contracts and Compliance Engineer       | [Nathan Holliday](https://www.linkedin.com/in/nathanael-holliday/) _([@hollidayn](https://github.com/hollidayn))_
 
+ 
 
 ## Contact us
 
 - To **make a request** of this department, [create an issue](https://github.com/fleetdm/fleet/issues/new?assignees=&labels=%23g-digital-experience&projects=&template=digital-experience-request.md&title=TODO%3A+) and a team member will get back to you within one business day (If urgent, mention a [team member](#team) in the [#g-digital-experience](https://fleetdm.slack.com/archives/C058S8PFSK0) Slack channel.
-  - Any Fleet team member can [view the kanban board](https://app.zenhub.com/workspaces/g-digital-experience-6451748b4eb15200131d4bab/board) for this department, including pending tasks and the status of new requests.
+  - Any Fleet team member can [view the kanban board](https://app.zenhub.com/workspaces/g-digital-experience-6451748b4eb15200131d4bab/board?sprints=none) for this department, including pending tasks and the status of new requests.
   - Please **use issue comments and GitHub mentions** to communicate follow-ups or answer questions related to your request.
 
 
 ## Responsibilities
 
-The Digital Experience department is directly responsible for the framework, content design, and technology behind Fleet's remote work culture, including fleetdm.com, the handbook, issue templates, UI style guides, internal tooling, Zapier flows, Docusign templates, key spreadsheets, and project management processes. 
+The Digital Experience department is directly responsible for the culture, training, framework, content design, and technology behind Fleet's remote work culture, including fleetdm.com, the handbook, issue templates, UI style guides, internal tooling, Zapier flows, Docusign templates, key spreadsheets, contracts, compliance, receiving and responding to legal notices, SOC2, deal desk, project management processes, human resources, benefits, opening positions, compensation planning, onboarding, and offboarding.
+
+> _**Note:**: Commission planning, taxes, state unemployment insurance filings, business insurance, Delaware registered agent and franchise taxes, virtual mailbox, company phone number, and other adjacent areas of responsibility are run by [the Finance department](https://fleetdm.com/handbook/finance)._
 
 > _**Note:** If a user story involves only changes to fleetdm.com, without changing the core product, then that user story is prioritized, drafted, implemented, and shipped by the [Digital Experience](https://fleetdm.com/handbook/digital-experience) department.  Otherwise, if the story **also** involves changes to the core product **as well as** fleetdm.com, then that user story is prioritized, drafted, implemented, and shipped by [the other relevant product group](https://fleetdm.com/handbook/company/product-groups#current-product-groups), and not by `#g-digital-experience`._
 
 
-### QA a change to fleetdm.com
+### Access a background check
 
+All Fleet team members undergo a background check provided through [Vetty](https://vetty.co/). Only the most recent background checks appear on the home page of Vetty's dashboard. To access a complete list of background checks run in Vetty, scroll down to the bottom of the candidates page and click "View Historical".
+
+
+### Convert a Fleetie to a consultant
+
+If a Fleetie decides they want to move to being a [consultant](https://fleetdm.com/handbook/company/leadership#consultants), either the Fleetie or their manager need to create a [custom issue for the Digital Experience team](https://github.com/fleetdm/confidential/issues/new?assignees=&labels=%23g-digital-experience&projects=&template=custom-request.md&title=Request%3A+_______________________) to notify them of the change.
+Once notified, Digital Experience takes the following steps:
+1. Confirm the following details with the Fleetie:
+    - Date of change
+    - Term of consultancy (time period)
+    - Hours/capacity expected (hours per week or month)
+    - Confirm hourly rate
+2. Once details are confirmed, use the information given to create the consulting agreement for the Fleetie (either in docusign (US-based) or via Plane (international)), and send to their personal email for signature. Once signed, save in Fleetie's [employee file](https://drive.google.com/drive/folders/1UL7o3BzkTKnpvIS4hm_RtbOilSABo3oG?usp=drive_link).
+3. Schedule the Fleetie's final day in HRIS (Gusto or Plane).
+4. Update final day in ["🧑‍🚀 Fleeties"](https://docs.google.com/spreadsheets/d/1OSLn-ZCbGSjPusHPiR5dwQhheH1K8-xqyZdsOe9y7qc/edit#gid=0) spreadsheet.
+5. Create an [offboarding issue](https://github.com/fleetdm/classified/blob/main/.github/ISSUE_TEMPLATE/%F0%9F%9A%AA-offboarding-____________.md) for the Fleetie converting to a consultant, and confirm with their manager if there is a need to retain any tools or access while they are a consultant (default to removing all access from Fleet email, and migrating to personal email for Slack and other tools unless there is a business case to retain the Fleet email and associated tool access).
+6. Follow the offboarding issue for next steps, including communicating to teammates and updating equity plan.
+
+
+### Inform managers about hours worked
+
+Every Friday at 2:00 PM CT, we collect hours worked for all hourly employees at Fleet, including core team members and consultants, regardless of their location.
+
+Here's how:
+
+1. Consultants submit their hours through Gusto (US consultants) or Plane.com (international consultants) and require DRI approval (generally their manager) for hours worked. Find the DRI using the [Digital Experience KPIs](https://docs.google.com/spreadsheets/d/1Hso0LxqwrRVINCyW_n436bNHmoqhoLhC8bcbvLPOs9A/edit#gid=0).
+2. Send the teammate's DRI a direct message in Slack with a screenshot of the HRIS portal, showing hours logged since last Saturday at midnight, and ask them to confirm the hours are expected. Ensure the screenshot does not include compensation information.
+     - For international teammates, they cannot enter hours weekly in Plane.com, so you will need to request the hours worked from them in order to have the DRI approve them.
+3. The following Monday, check for updates to logged hours and ensure the KPI sheet aligns with HRIS records.
+     - If there are discrepancies between what was previously reported, reconfirm logged hours with the teammate's DRI and update the KPI sheet to reflect the correct amount.
+
+
+### Change the DRI of a consultant
+
+1. In the [KPIs](https://docs.google.com/spreadsheets/d/1Hso0LxqwrRVINCyW_n436bNHmoqhoLhC8bcbvLPOs9A/edit#gid=0) sheet, find the consultant's column.
+2. Change the DRI documented there to the new DRI who will receive information about the consultant's hours.
+
+
+### Update personnel details
+When a Fleetie, consultant or advisor requests an update to their personnel details (name, location, phone, etc), follow these steps to ensure accurate representation across systems.
+1. Team member submits a [custom issue](https://github.com/fleetdm/confidential/issues/new?assignees=&labels=%23g-digital-experience&projects=&template=custom-request.md&title=Request%3A+_______________________) to update their personnel details (or Digital Experience team creates if the request comes via email or is sensitive and needs a classified issue).
+    - If change is for a primary identification or contact method, ask for evidence of change and capture in [employee's personnel file](https://drive.google.com/drive/folders/1UL7o3BzkTKnpvIS4hm_RtbOilSABo3oG?usp=drive_link).
+2. Digital Experience makes change to HRIS (Gusto or Plane) to reflect change. 
+    - Note: if making the change requires follow up steps, resolve those steps to action the change.
+3. Once change is effected in HRIS, Digital Experience makes changes to ["🧑‍🚀 Fleeties"](https://docs.google.com/spreadsheets/d/1OSLn-ZCbGSjPusHPiR5dwQhheH1K8-xqyZdsOe9y7qc/edit#gid=0) spreadsheet.
+4. If required, Digital Experience makes any relevant changes to [Fleet's equity plan](https://docs.google.com/spreadsheets/d/1_GJlqnWWIQBiZFOoyl9YbTr72bg5qdSSp4O3kuKm1Jc/edit#gid=0).
+5. If required, Digital Experience makes any relevant changes to the ["🗺️ Geographical factors"](https://docs.google.com/spreadsheets/d/1rCVCs-eOo-VSEG7fPLgdq5l7oSaActl5bewaWP7PnSE/edit#gid=1533353559) spreadsheet and follows through on any action items involving tax implications (i.e. registering with a new state for employer taxes).
+6. If required, Digital Experience also makes changes to other core systems (e.g: creating a new email alias in google workspace; updating details in Carta; etc).
+7. The change is now actioned, notify the team member and close the issue.
+
+> Note: if the Fleetie is US based and has a qualifying life event that impacts benefit coverage, they can [follow the Gusto steps](https://support.gusto.com/article/100895878100000/Change-your-benefits-with-a-qualifying-life-event) to update their coverage elections.
+
+
+### Change a Fleetie's job title
+When Digital Experience receives notification of a Fleetie's job title changing, follow these steps to ensure accurate recording of the change across our systems.
+1. Update ["🧑‍🚀 Fleeties"](https://docs.google.com/spreadsheets/d/1OSLn-ZCbGSjPusHPiR5dwQhheH1K8-xqyZdsOe9y7qc/edit#gid=0):
+    - Search the spreadsheet for the Fleetie in need of a job title change.
+    - Input the new job title in the Fleetie's row in the "Job title" cell.
+    - Navigate to the "Org chart" tab of the spreadsheet, and verify that the Fleetie's title appears correctly in the org chart.
+2. Update the departmental handbook page with the change of job title
+3. [Prepare salary benchmarking information](#prepare-salary-benchmarking-information) to determine whether the teammate's current compensation aligns with the benchmarks of the new role.
+   -  If the benchmark is significantly different, take the steps to [update a team member's compensation](#prepare-salary-benchmarking-information).
+4. Update the relevant payroll/HRIS system.
+    - For updating Gusto (US-based Fleeties):
+      - Login to Gusto and navigate to "People > Team members".
+      - Find the Fleetie and select them to see their profile page.
+      - Under the "Compensation" heading, select edit and update the "Job title" and input the specific date the change happened. Save the changes.
+    - For updating Plane (non-US Fleeties):
+      - Login to Plane and navigate to "People > Team".
+      - Find the Fleetie and select them to see their profile page.
+      - Use the "Help" function, or email support@plane.com to notify Plane of the need to change the job title for the Fleetie. Include the Fleetie's name, current title, new title, and effective date.
+      - Take any relevant steps as directed by Plane in order to make the required changes to the Fleetie's profile.
+
+
+### Change a Fleetie's manager
+When Digital Experience receives notification of a Fleetie's manager changing, follow these steps to ensure correct recording in our systems.
+1. Update [🧑‍🚀 Fleeties](https://docs.google.com/spreadsheets/d/1OSLn-ZCbGSjPusHPiR5dwQhheH1K8-xqyZdsOe9y7qc/edit#gid=0):
+    - Search for the Fleetie's new manager, and copy the new manager's unique ID from the far left "Unique ID" column.
+    - Search for the Fleetie whose manager is changing, and paste (without formatting) their new manager's unique ID in the "Reports to: (manager unique ID)" cell in the Fleetie's row.
+    - Verify that the "Reports to (auto: manager name and job title)" cell in the Fleetie's row reflects the new manager's details.
+    - Verify that in the new manager's row, the "# direct reports" cell reflect the correct number.
+    - Navigate to the "Org chart" tab in the spreadsheet, and verify that the Fleetie now appears in the correct place in the org chart.
+2. If the person's department is changing, then update both departmental handbook pages to move the person to their new department:
+    - Remove the person from the "Team" section of the old department and add them to the "Team" section of the new department.
+3. If the person's level of confidential access will change along with the change to their manager, then update that level of access:
+    - Update Google Workspace to make sure this person lives in the correct Google Group, removing them from the old and/or adding them to the new.
+    - Update 1password to remove this person from old vaults and/or add them to new vaults.
+    - For a team member moving from "classified" to "confidential" access, check Gusto, Plane, and other systems to remove their access.
+
+> **Note:** The Fleeties spreadsheet is the source of truth for who everyone's manager is and their job titles.
+
+### Recognize employee workiversaries
+
+At Fleet, everyone is recognized on their [workiversary](https://fleetdm.com/handbook/company/communications#workiversaries). To ensure this happens, take the following steps:
+
+1. Bimonthly, use [Fleeties (private google doc)](https://docs.google.com/spreadsheets/d/1OSLn-ZCbGSjPusHPiR5dwQhheH1K8-xqyZdsOe9y7qc/edit#gid=0) to determine who is celebrating their workiversary in the following two months.
+2. Post in the #help-classifed Slack channel and cc the Head of Digital Experience. Use the following template:
+
+   
+    ```
+    [Month]
+    [workiversary date (DD-MMM)] - [teammate name] - [number of years at Fleet]
+    ```
+
+    
+   The Head of Digital Experience will also use this post to update the [All hands](https://fleetdm.com/handbook/company/communications#all-hands) deck.
+3. On the day prior to a workiversary, send the teammate’s manager a DM on Slack:
+
+
+    ```
+    Hey! Just a heads up, tomorrow is [teammate’s name] [number of years at Fleet] workiversary at Fleet.
+    Digital Experience can post something in the #random channel to recognize them, would you like to make that post instead?
+    ```
+ 
+   > If a manager elects to post and hasn't done so by 2pm ET on the day of the workiversary, send them a friendly reminder and offer to post instead.
+
+4. If the manager has deferred to Digital Experience, schedule a Slack post for the following day to recognize the teammate's contributions at Fleet. If you’re unsure about what to post, take a look at what’s been [posted previously](https://docs.google.com/document/d/1Va4TYAs9Tb0soDQPeoeMr-qHxk0Xrlf-DUlBe4jn29Q/edit).
+
+
+
+### Prepare salary benchmarking information
+1. Use the relevant template text in the README section of the [¶¶ 💌 Compensation decisions document](https://docs.google.com/document/d/1NQ-IjcOTbyFluCWqsFLMfP4SvnopoXDcX0civ-STS5c/edit?usp=sharing) for a current Fleetie, a new role, a prospective hire, or other benchmarking use case.
+2. Copy the template text and paste at the end of the document.
+3. Fill in details as required, pulling from [🧑‍🚀 Fleeties spreadsheet](https://docs.google.com/spreadsheets/d/1OSLn-ZCbGSjPusHPiR5dwQhheH1K8-xqyZdsOe9y7qc/edit#gid=0) and [equity spreadsheet](https://docs.google.com/spreadsheets/d/1_GJlqnWWIQBiZFOoyl9YbTr72bg5qdSSp4O3kuKm1Jc/edit?usp=sharing) as required.
+4. Use the teammate's information to benchmark in [Pave](https://www.pave.com/) (login details in 1Password). You can pattern match from previous benchmarking entries, and include all company assumtions. Add the direct link to the Pave benchmark.
+
+
+### Update a team member's compensation
+
+To [change a teammate's compensation](https://fleetdm.com/handbook/company/communications#compensation-changes), follow these steps:
+1. Create a copy of the ["Values assessment" template](https://docs.google.com/spreadsheets/d/1P5TyRV2v-YN0aR_X8vd8GksKcr3uHfUDdshqpVzamV8/edit?usp=drive_link) and move it to the teammate's [personnel folder in Google Drive](https://drive.google.com/drive/folders/1UL7o3BzkTKnpvIS4hm_RtbOilSABo3oG?usp=drive_link).
+2. Share the values assessment document with the manager and ask them to perform the values assessment.
+3. Once the values assessment is complete, [prepare salary benchmarking information](#prepare-salary-benchmarking-information) and notify the Head of Digital Experience so the compensation change can be added to the e-group agenda for discussion amongst Fleet leadership.
+   - If the teammate's manager is not part of the e-group, the Head of Digital Experience will ensure they're included in the discussion at e-group as well. 
+4. Once compensation decisions have been finalized, the Head of Digital Experience will post in slack to `#help-classified` to confirm the decisions have been recorded in ["¶¶ 💌 Compensation decisions (offer math)"](https://docs.google.com/document/d/1NQ-IjcOTbyFluCWqsFLMfP4SvnopoXDcX0civ-STS5c/edit#heading=h.slomq4whmyas). 
+5. Send the teammates manager a Slack DM to determine who will communicate the decision to the teammate.
+6. Update the respective payroll platform (Gusto or Plane) by navigating to the personnel page, selecting salary field, and updating with an effective date that makes the next payroll.
+7. Update the [equity spreadsheet](https://docs.google.com/spreadsheets/d/1_GJlqnWWIQBiZFOoyl9YbTr72bg5qdSSp4O3kuKm1Jc/edit?usp=sharing) (internal doc) by copying existing OTE to the bottom of the "Notes" cell, updating the OTE column with the new compensation information, and updating the "Last compensation change" column with the effective date from payroll platform.
+8. Calculate the monthly burn rate increase percentage and notify the CEO via a Slack DM.
+
+> If the company decides on an additional equity grant as part of a compensation change, note the previous equity and new situation in detail in the "Notes" column of the equity plan. Update the "Grant started?" column to "todo" which adds it to the queue for the next time grants are processed (quarterly).
+
+
+### Review Fleet's US company benefits
+
+Annually, around mid-year, Fleet will be prompted by Gusto to review company benefits. The goal is to keep changes minimal. Follow these steps:
+1. Log in to your [Gusto admin account](https://gusto.com/).
+2. Navigate to "Benefits" and select "Renewal survey".
+3. Complete the survey questions, aiming for minimal changes.
+4. Approximately 2-3 months after survery completion, Gusto will suggest plans based on Fleet's responses. Choose plans with minimal changes.
+5. Gusto will offer these plans to employees during open enrollment, with new coverage starting 3-4 weeks afterward.
+
+### Grant equity
+Equity grants for new hires are queued up as part of the [hiring process](https://fleetdm.com/handbook/digital-experience#hiring), then grants and consents are [batched and processed quarterly](https://github.com/fleetdm/confidential/issues/new/choose).
+
+Doing an equity grant involves:
+- Executing a board consent
+- The recipient and CEO signing paperwork about the stock options
+- Updating the number of shares for the recipient in the equity plan
+- Updating Carta to reflect the grant
+
+For the status of stock option grants, exercises, and all other _common stock_ including advisor, founder, and team member equity ownership, see [Fleet's equity plan](https://docs.google.com/spreadsheets/d/1_GJlqnWWIQBiZFOoyl9YbTr72bg5qdSSp4O3kuKm1Jc/edit#gid=0).  For information about investor ownership, see [Carta](https://app.carta.com/corporations/1234715/summary/).
+
+> Fleet's [equity plan](https://docs.google.com/spreadsheets/d/1_GJlqnWWIQBiZFOoyl9YbTr72bg5qdSSp4O3kuKm1Jc/edit#gid=0) is the source of truth, not Carta.  Neither are pro formas sent in an email attachment, even if they come from lawyers.
+> 
+> Anyone can make mistakes, and none of us are perfect.  Even when we triple check.  Small mistakes in share counts can be hard to attribute, and can cause headaches and eat up nights of our CEO's and operations team's time.  If you notice what might be a discrepancy between the equity plan and any other secondary source of information, please speak up and let Fleet's CEO know ASAP.  Even if you're wrong, your note will be appreciated.
+
+
+### Review an NDA
+We need to review an NDA anytime a vendor, customer or other party wants to:
+- Use their own NDA rather than Fleet's standard NDA, or
+- "Redline" (modify) Fleet's NDA by removing, adding or altering its terms.
+
+We should always seek to use Fleet's own NDA first, without alteration. 
+
+When reading an NDA, we want to pay close attention to the following:
+- We want to be sure that the confidentiality obligations of the NDA are reciprocal.  Fleet and the other party to the agreement should be bound to the same standards of confidentiality toward the handling of each other's confidential information.
+- Fleet does not agree to _"do not compete"_ or _"do not solicit clauses"_. An NDA should not contain provisions beyond the scope of an NDA. The two most commonly encountered examples of this are the "do not compete" and "do not solicit" clauses. We want to be free to hire the best people and make the best products, so when reading through an NDA it is important to keep an eye out for language that prohibits Fleet from hiring or soliciting current or former employees of other companies or that prohibit Fleet from independently developing products that compete with another company's products.  Using the `cmd + f` function to search for "solici", "compet" and "hir" and reading through the results is a helpful method to quickly scan for these clauses.
+- Look for any language that discusses a transfer of property rights. Rarely, you may find a clause snuck into an agreement that discusses the transfer of intellectual property rights.  _We want to avoid any situation where Fleet transfers its intellectual property to another party as part of an NDA_.  
+- Should you find any clauses in steps 2 or 3 that are beyond the scope of protecting both party's confidential information in a customer NDA or an altered version of Fleet's NDA, reject this language and communicate that Fleet cannot agree to those terms.
+- Any concerns or uncertainty over _any_ provisions in an NDA should be brought to Nathanael Holliday in Digital Experience, who will consult legal counsel if necessary to resolve any concerns.
+
+### Review a vendor agreement
+When reviewing contracts from a vendor, Fleet is concerned about the following:
+- If there are confidentiality provisions in the agreement in place of a stand-alone NDA, verify the confidentiality provisions are appropriate and protect Fleet when sensitive data is involved that isn't otherwise available to the public.
+- We want to make sure there are no _do not solicit_ or _do not compete_ clauses in the contract.  To aid in this search, we double check by using the cmd + f function and searching for "solici", "compet" and "hir" and then looking through the results to be sure that nothing prohibits Fleet from independently developing competing products or from hiring personnel with ties to the vendor.
+- We want to make sure that contracts can be terminated relatively easily and be aware of what the process is for terminating them, avoiding commitments over 12 months in length.
+- We want to make sure the payment terms work for us (i.e. being able to pay via wire transfer, credit card or bill.com) and that the price in any contract or order form is what we have agreed to.  While almost never malicious, mistakes often occur in the steps between agreeing on a price, negotiating a contract, and receiving an invoice.  We want to be sure at every step that the dollar amount and service provided is consistent with what has been negotiated and agreed upon.
+- Remember, once we have signed the agreement - we're stuck with it. If any clause in the agreement appears strange or gives you pause or concern, it is better to seek clarification than to commit to something that might be detrimental to Fleet.  Contracts are fairly standardized, and you'll quickly learn what is normal and what feels out of place.  Unusual clauses or wording that seems out of the ordinary should get a second set of eyes just to be sure, do not hesitate to reach out to Nathanael Holliday with questions, who will reach out to legal counsel as necessary.
+
+### Review an order form
+- We should always check order forms for additional terms that go beyond the scope of the order form (caps on price increases, for example).
+- Be sure the order form includes contact information + billing address and information so that Fleet knows how and who to invoice for payment.
+- Verify that the payment terms are correct and matches what's in the agreement. This is a frequent common mistake as companies usually have default payment terms and overlook changing them to match atypical payment terms.
+- Make sure the effective term of the order matches what was agreed upon (usually a one year term) and that the order form includes the correct number of hosts and whether or not it should contain professional services (usually, it does not). 
+- Check that the amount on the order form reflects what Fleet agreed to, as this is the amount that the customer will expect to be invoiced for.
+- Lastly, double check one more time to make sure there are no sneaky, unusual terms snuck in at the bottom of an order form or stashed away in fine print.  Common things that are included in order forms and not always communicated to Fleet are caps on price increases upon renewal, new SLAs, or a product roadmap or milestones we may not have agreed upon.  Any clauses on an order form that appear beyond the scope of simply elaborating on the services being provided, the purchase cost, the contract that the purchase is being made under, how Fleet will bill and how the customer will pay deserves a careful look.  Reach out to Nathanael Holliday in Digital Experience with concerns.
+
+### Review a non-standard subscription agreement
+We want to use our standard terms whenever possible with our customers, but it is common that customers want to use their own agreement or redline (modify) Fleet's terms.  
+When reviewing subscription agreements on customer paper or when a customer has made changes to Fleet's terms, we review it using [these guidelines](https://docs.google.com/document/d/1aGgN5It1i3fdsBF37vWSbvukO_gQhy5vCp4fINg191Q/edit?usp=sharing).
+
+### QA a change to fleetdm.com
 Each PR to the website is manually checked for quality and tested before going live on fleetdm.com. To test any change to fleetdm.com
 
 1. Write clear step-by-step instructions to confirm that the change to the fleetdm.com functions as expected and doesn't break any possible automation. These steps should be simple and clear enough for anybody to follow.
@@ -41,7 +250,7 @@ Each PR to the website is manually checked for quality and tested before going l
 
 ### Update the host count of a premium subscription
 
-When a self-service license dispenser customer reaches out to upgrade a license via the contact form, a member of the [Demand department](https://fleetdm.com/handbook/demand) will create a confidential issue detailing the request and add it to the new requests column of Ditigal Experience kanban board. A member of this team will then log into Stripe using the shared login, and upgrade the customer's subscription.
+When a self-service license dispenser customer reaches out to upgrade a license via the contact form, a member of the [Demand department](https://fleetdm.com/handbook/demand) will create a confidential issue detailing the request and add it to the new requests column of [Digital Experience kanban board](https://github.com/fleetdm/confidential/issues#workspaces/g-digital-experience-6451748b4eb15200131d4bab/board). A member of this team will then log into Stripe using the shared login, and upgrade the customer's subscription.
 
 To update the host count on a user's subscription:
 
@@ -88,7 +297,7 @@ Once you have the above follow these steps:
 
 ### Check production dependencies of fleetdm.com
 
-Every week, we run `npm audit --only=prod` to check for vulnerabilities on the production dependencies of fleetdm.com. Once we have a solution to configure GitHub's Dependabot to ignore devDependencies, this manual process can be replaced with Dependabot.
+Every week, we run `npm audit --only=prod` to check for vulnerabilities on the production dependencies of fleetdm.com. Once we have a solution to configure GitHub's Dependabot to ignore devDependencies, this [manual process](https://www.loom.com/share/153613cc1c5347478d3a9545e438cc97?sid=5102dafc-7e27-43cb-8c62-70c8789e5559) can be replaced with Dependabot.
 
 
 ### Respond to a 5xx error on fleetdm.com
@@ -104,7 +313,7 @@ Production systems can fail for various reasons, and it can be frustrating to us
 
 ### Check browser compatibility for fleetdm.com
 
-A browser compatibility check of [fleetdm.com](https://fleetdm.com/) should be carried out monthly to verify that the website looks and functions as expected across all [supported browsers](https://fleetdm.com/docs/using-fleet/supported-browsers).
+A [browser compatibility check](https://www.loom.com/share/4b1945ccffa14b7daca8ab9546b8fbb9?sid=eaa4d27a-236b-426d-a7cb-9c3bdb2c8cdc) of [fleetdm.com](https://fleetdm.com/) should be carried out monthly to verify that the website looks and functions as expected across all [supported browsers](https://fleetdm.com/docs/using-fleet/supported-browsers).
 
 - We use [BrowserStack](https://www.browserstack.com/users/sign_in) (logins can be found in [1Password](https://start.1password.com/open/i?a=N3F7LHAKQ5G3JPFPX234EC4ZDQ&v=3ycqkai6naxhqsylmsos6vairu&i=nwnxrrbpcwkuzaazh3rywzoh6e&h=fleetdevicemanagement.1password.com)) for our cross-browser checks.
 - Check for issues against the latest version of Google Chrome (macOS). We use this as our baseline for quality assurance.
@@ -123,7 +332,7 @@ In Figma:
   - Avoid using SVGs or icon fonts.
 3. Click the __Export__ button.
 
-
+<!-- Commenting this out as we don't have any planned landing pages in the future see: https://github.com/fleetdm/fleet/issues/21117
 ### Generate a new landing page
 
 Experimental pages are short-lived, temporary landing pages intended for a small audience. All experiments and landing pages need to go through the standard [drafting process](https://fleetdm.com/handbook/company/product-groups#making-changes) before they are created.
@@ -160,7 +369,7 @@ To generate a new page, you'll need:
 5. Start the website by running `node ./node_modules/sails/bin/sails lift` (or `sails lift` if you have Sails installed globally). The new landing page will be availible at `http://localhost:1337/imagine/{page-name}`.
 
 6. Replace the lorum ipsum and placeholder images on the generated page with the page's real content, and add a meta description and title by changing the `pageTitleForMeta` and `pageDescriptionForMeta in the page's `locals` in `website/config/routes.js`.
-
+-->
 
 ### Restart Algolia manually
 
@@ -226,7 +435,7 @@ Certain new team members, especially in go-to-market (GTM) roles, will need paid
 
 ### Downgrade an unused license seat
 
-- On the first Wednesday of every quarter, the CEO, head of BizOps and Head of Digital experience will meet for 30 minutes to audit license seats in Figma, Slack, GitHub, Salesforce and other tools.
+- On the first Wednesday of every quarter, the CEO and Head of Digital experience will meet for 30 minutes to audit license seats in Figma, Slack, GitHub, Salesforce and other tools.
 - During this meeting, as many seats will be downgraded as possible. When doubt exists, downgrade.
 - Afterward, post in #random letting folks know that the quarterly tool reconciliation and seat clearing is complete, and that any members who lost access to anything they still need can submit a ZenHub issue to Digital Experience to have their access restored.
 - The goal is to build deep, integrated knowledge of tool usage across Fleet and cut costs whenever possible. It will also force conversations on redundancies and decisions that aren't helping the business that otherwise might not be looked at a second time.  
@@ -243,10 +452,19 @@ Here are the steps we take to grant appropriate Salesforce licenses to a new hir
 - Once the basic license has been added, you can create a new user using the new team member's `@fleetdm.com` email and assign a license to it.
 - To also assign a user an "Inbox license", go to the ["Setup" page](https://fleetdm.lightning.force.com/lightning/setup/SetupOneHome/home) and select "User > Permission sets". Find the [inbox permission set](https://fleetdm.lightning.force.com/lightning/setup/PermSets/page?address=%2F005%3Fid%3D0PS4x000002uUn2%26isUserEntityOverride%3D1%26SetupNode%3DPermSets%26sfdcIFrameOrigin%3Dhttps%253A%252F%252Ffleetdm.lightning.force.com%26clc%3D1) and assign it to the new team member.
 
+### Change the "Integrations admin" Salesforce account password
+
+Salesforce requires that the password to the "Integrations admin" account is changed every 90 days. When this happens, the Salesforce integrations on the Fleet website/Hydroplane will fail with an `INVALID_LOGIN` error. To prevent this from happening, a member of the Digital expererience team will:
+
+1. Log into the "Integrations admin" account in Salesforce.
+2. Change the password and save it in the shared 1Password vault.
+3. Request a new security token for the "Integrations admin" account (This will be sent to the email address associated with the account).
+4. Update the `sails_config__custom_salesforceIntegrationPasskey` config variable in Heroku to be `[password][security token]` (For both the Fleet website and Hydroplane).
+
 
 ### Schedule press release
 
-Fleet will occasionally release information to the press regarding upcoming initiatives before updating the functionality of the core product. This process sUse the following steps to schedule a press release:  
+Fleet will occasionally release information to the press regarding upcoming initiatives before updating the functionality of the core product. Use the following steps to schedule a press release:  
 
 1. Add context for the next press release to the [e-group agenda](https://docs.google.com/document/d/13fjq3T0bZGOUah9cqHVxngckv0EB2R24A3gfl5cH7eo/edit) as a "DISCUSS:" to be reviewed by Fleet's executive team for alignment and finalization of date.
 2. Once a release date is set, at-mention our public relations firm in the [#help-public-relations-firm--mindshare-pr--brand-marketing](https://fleetdm.slack.com/archives/C04PC9H34LF) and schedule a 30m call for our CEO and to communicate the press release.
@@ -281,12 +499,22 @@ Follow these steps to archive any document:
 
 ### Schedule CEO interview
 
-From time to time, you will need to schedule an interview between a candidate and the CEO:
-1. [Make a copy of the "¶¶ CEO interview template"](https://docs.google.com/document/d/1yARlH6iZY-cP9cQbmL3z6TbMy-Ii7lO64RbuolpWQzI/copy) (private Google doc)
-2. Change file name and heading of doc to `¶¶ CANDIDATE_NAME (CANDIDATE_TITLE) <> Mike McNeil, CEO final interview (YYYY-MM-DD)`
+Use the following steps to schedule an interview between a candidate and the CEO:
+1. Once you receive a [CEO interview request](https://fleetdm.com/handbook/company/leadership#hiring-a-new-team-member), apply the "eyes" (👀) emoji to the Slack post to acknowledge you've seen the request.
+2. Reach out to the candidate via email to find a time when the CEO and candidate are both available.
+   > This entire process takes an hour for the CEO: a 30-minute interview followed by a 30-minute "¶¶ Postgame" Be sure to offer times that accommodate this.
+3. [Make a copy of the "¶¶ CEO interview template"](https://docs.google.com/document/d/1yARlH6iZY-cP9cQbmL3z6TbMy-Ii7lO64RbuolpWQzI/copy) (private Google doc) and move it to the "[🕵️ ¶±¶ Reference checks & hiring data](https://drive.google.com/drive/folders/1VgKT6_VrQ9zYMnDOwJGE1mT1WrrMFqJw?usp=drive_link)" folder in Google Drive. 
+4. Prep the CEO interview doc:
+   - Change file name and heading of doc to `¶¶ CANDIDATE_NAME (CANDIDATE_TITLE) <> Mike McNeil, CEO final interview (YYYY-MM-DD)`.
    - Add candidate's personal email in the "👥" (attendees) section at the top of the doc.
    - Add candidate's [LinkedIn url](https://www.linkedin.com/search/results/all/?keywords=people) on the first bullet for Mike.
-3. Set the Google Calendar description of the calendar event to: `Agenda: URL_FOR_NEW_COPY_OF_FINAL_INTERVIEW_DOC`
+   - Share the CEO interview doc with the hiring manager as a "Commenter".
+5. Link the CEO interview doc at the top of the "feedback" doc shared in the CEO interview request
+6. Create a Google Calendar event at a time when the CEO and the candidate are both available.
+   - Create a Google Calendar event matching the title of the interview doc.
+   - Add the interview doc to the calendar event description as the agenda (i.e. `Agenda: INTERVIEW_DOC_FULL_URL`) and save the calendar event.
+7. Schedule a 30-minute "¶¶ Postgame" working session for the CEO to evaluate the candidate and give his recommendation.
+8. In the hiring channel for the position, apply the "green-check-mark" (✅) emoji to the CEO interview request to confirm the request has been processed. 
 
 
 ### Program the CEO to do something
@@ -308,11 +536,11 @@ Agenda:
 
 When an agreement is routed to the CEO for signature, the [Apprentice](https://fleetdm.com/handbook/digital-experience#team) is responsible for obtaining a signature from the CEO using the following steps:
 1. Drag the email to the ["🔏 SAM: Signature wanted"](https://mail.google.com/mail/u/0/#label/SAM%3A+Signature+wanted) label making sure to mark the email as unread.
-2. A Business Operations Engineer will at-mention the Apprentice in a legal review issue, letting them know the contract is good to go. After that, move the email to the "[✍️ MIKE: Ready to sign](https://mail.google.com/mail/u/0/#label/%E2%9C%8D%EF%B8%8F+MIKE%3A+Ready+to+sign)" label
+2. The [Contracts and Compliance Engineer](https://fleetdm.com/handbook/digital-experience#team) will at-mention the Apprentice in a legal review issue, letting them know the contract is good to go. After that, move the email to the "[✍️ MIKE: Ready to sign](https://mail.google.com/mail/u/0/#label/%E2%9C%8D%EF%B8%8F+MIKE%3A+Ready+to+sign)" label
 
 > If the agreement closes a deal, inform the CEO (via Slack DM) that a subscription agreement is ready for his review/signature. The SLA for CEO review and signature is 48hrs.
 
-3. Comment in the issue once the CEO has signed the agreement and assign the issue to [Nathan Holiday](https://fleetdm.com/handbook/business-operations#team).
+3. Comment in the issue once the CEO has signed the agreement and assign the issue to [Nathan Holiday](https://fleetdm.com/handbook/digital-experience#team).
 
 
 ### Prepare for CEO office minutes 
@@ -355,6 +583,14 @@ Time management for the CEO is essential.  The Apprentice processes the CEO's ca
   6. Edit the calendar event description, changing “Notes” to “Agenda” when you're finished preparing the document to signify that this meeting has been prepped.
 
 
+### Confirm CEO shadow dates
+
+After the team member notifies the Head of Digital Experience (via Slack), the Head of DigExp will bring the dates to the next roundup as a "DISCUSS: CEO shadow dates". Use the following steps to confirm CEO shadow dates:
+1. Create an "All day", "Free" event on the CEO's calendar that matches the CEO shadow dates and name the calendar event "CEO shadow - [NAME] (Job title)".
+3. Confirm the "shadowability" for external and nonrecurring internal meetings with the CEO during the next daily 🐈‍⬛🌪️ Roundup.
+4. Go through the calendar and make sure all private meetings (e.g. 1:1's, E-Group, and quarterly board meetings) have "[no shadows]" in the event title.
+
+
 ### Process the CEO's inbox
 
 - The Apprentice is [responsible](https://fleetdm.com/handbook/company/why-this-way#why-direct-responsibility) for [processing all email traffic](https://docs.google.com/document/d/1gH3IRRgptrqSYzBFy-77g98JROTL8wqrazJIMkp-Gb4/edit#heading=h.i7mkhr6m123r) prior to CEO review to reduce the scope of Mike's inbox to only include necessary and actionable communication.
@@ -366,9 +602,9 @@ Time management for the CEO is essential.  The Apprentice processes the CEO's ca
 
 ### Document performance feedback
 
-Every Friday at 5PM a [Business Operations team member](https://fleetdm.com/handbook/business-operations#team) will look for missing data in the [KPIs spreadsheet](https://docs.google.com/spreadsheets/d/1Hso0LxqwrRVINCyW_n436bNHmoqhoLhC8bcbvLPOs9A/edit#gid=0). 
-1. If KPIs are not reported on time, the BizOps Engineer will notify the Apprentice to the CEO and the DRI.
-2. The Apprentice will update the "performance management" section of the appropriate individual's 1:1 doc so that the CEO can address during the next 1:1 meeting with the DRI.
+Every Friday at 5PM a [Digital Experience team member](https://fleetdm.com/handbook/digital-experience#team) will look for missing data in the [KPIs spreadsheet](https://docs.google.com/spreadsheets/d/1Hso0LxqwrRVINCyW_n436bNHmoqhoLhC8bcbvLPOs9A/edit#gid=0). 
+1. If KPIs are not reported on time, notify the Head of Digital Experience and the DRI.
+2. The Head of Digital Experience will update the "performance management" section of the appropriate individual's 1:1 doc so that the CEO can address during the next 1:1 meeting with the DRI.
 
 
 ### Send the weekly update
@@ -383,7 +619,8 @@ We like to be open about milestones and announcements. Every Friday, e-group mem
   To send the weekly update follow these steps:  
   
 1. Navigate to the current weeks row in the [KPIs Google Sheet](https://docs.google.com/spreadsheets/d/1Hso0LxqwrRVINCyW_n436bNHmoqhoLhC8bcbvLPOs9A/edit#gid=0).
-2. Copy the entire formula in this weeks "Weekly update" update cell and paste without formating (CMD+⇧+V) back into the same cell. The formula will now look like this:
+2. Check the KPI sheet at 5pm US central time to ensure all departments have updated their KPIs on time.  If any departments are delinquent, notify the department head and [document performance feedback](https://fleetdm.com/handbook/digital-experience#document-performance-feedback).
+3. Copy the entire formula in this weeks "Weekly update" update cell and paste without formating (CMD+⇧+V) back into the same cell. The formula will now look like this:
 
 <img width="464" alt="image" src="https://github.com/fleetdm/fleet/assets/108141731/1f7c652c-955e-4e84-b16f-83bc48af71f1">
 
@@ -517,6 +754,12 @@ It's not enough to just "delete" a recording of a meeting in Gong.  Instead, use
 - Search for the title of the meeting Google Drive and delete the auto-generated Google Doc containing the transcript. 
 - Always check back to ensure the recording **and** transcript were both deleted.
 
+### Update a company brand front
+
+Fleet has several brand fronts that need to be updated from time to time. Check each [brand front](https://docs.google.com/spreadsheets/d/1c15vwMZytpCLHUdGvXxi0d6WGgPcQU1UBMniC1F9oKk/edit?gid=0#gid=0) for consistency and update as needed with the following: 
+- The current pitch, found in the blurbs section of the [🎐 Why Fleet?](https://docs.google.com/document/d/1E0VU4AcB6UTVRd4JKD45Saxh9Gz-mkO3LnGSTBDLEZo/edit#heading=h.uovxedjegxdc) doc. 
+- The current [brand imagery](https://www.figma.com/design/1J2yxqH8Q7u8V7YTtA1iej/Social-media-(logos%2C-covers%2C-banners)?node-id=3962-65895). Check this [Loom video](https://www.loom.com/share/4432646cc9614046aaa4a74da1c0adb5?sid=2f84779f-f0bd-4055-be69-282c5a16f5c5) for more info.
+
 
 ## Rituals
 
diff --git a/handbook/business-operations/Application-security.md b/handbook/digital-experience/application-security.md
similarity index 77%
rename from handbook/business-operations/Application-security.md
rename to handbook/digital-experience/application-security.md
index e914e99f0f..3c17410299 100644
--- a/handbook/business-operations/Application-security.md
+++ b/handbook/digital-experience/application-security.md
@@ -1,13 +1,13 @@
 # Application security
 
-- [Describe your secure coding practices (SDLC)](https://fleetdm.com/handbook/business-operations/application-security#describe-your-secure-coding-practices-including-code-reviews-use-of-static-dynamic-security-testing-tools-3-rd-party-scans-reviews)
-- [SQL injection](https://fleetdm.com/handbook/business-operations/application-security#sql-injection)
-- [Broken authentication](https://fleetdm.com/handbook/business-operations/application-security#broken-authentication-authentication-session-management-flaws-that-compromise-passwords-keys-session-tokens-etc)
-  - [Passwords](https://fleetdm.com/handbook/business-operations/application-security#passwords)
-  - [Authentication tokens](https://fleetdm.com/handbook/business-operations/application-security#authentication-tokens)
-- [Sensitive data exposure](https://fleetdm.com/handbook/business-operations/application-security#sensitive-data-exposure-encryption-in-transit-at-rest-improperly-implemented-apis)
-- [Cross-site scripting](https://fleetdm.com/handbook/business-operations/application-security#cross-site-scripting-ensure-an-attacker-cant-execute-scripts-in-the-users-browser)
-- [Components with known vulnerabilities](https://fleetdm.com/handbook/business-operations/application-security#components-with-known-vulnerabilities-prevent-the-use-of-libraries-frameworks-other-software-with-existing-vulnerabilities)
+- [Describe your secure coding practices (SDLC)](https://fleetdm.com/handbook/digital-experience/application-security#describe-your-secure-coding-practices-including-code-reviews-use-of-static-dynamic-security-testing-tools-3-rd-party-scans-reviews)
+- [SQL injection](https://fleetdm.com/handbook/digital-experience/application-security#sql-injection)
+- [Broken authentication](https://fleetdm.com/handbook/digital-experience/application-security#broken-authentication-authentication-session-management-flaws-that-compromise-passwords-keys-session-tokens-etc)
+  - [Passwords](https://fleetdm.com/handbook/digital-experience/application-security#passwords)
+  - [Authentication tokens](https://fleetdm.com/handbook/digital-experience/application-security#authentication-tokens)
+- [Sensitive data exposure](https://fleetdm.com/handbook/digital-experience/application-security#sensitive-data-exposure-encryption-in-transit-at-rest-improperly-implemented-apis)
+- [Cross-site scripting](https://fleetdm.com/handbook/digital-experience/application-security#cross-site-scripting-ensure-an-attacker-cant-execute-scripts-in-the-users-browser)
+- [Components with known vulnerabilities](https://fleetdm.com/handbook/digital-experience/application-security#components-with-known-vulnerabilities-prevent-the-use-of-libraries-frameworks-other-software-with-existing-vulnerabilities)
 
 The Fleet community follows best practices when coding. Here are some of the ways we mitigate against the OWASP top 10 issues:
 
diff --git a/handbook/digital-experience/digital-experience.rituals.yml b/handbook/digital-experience/digital-experience.rituals.yml
index bc2b4db7ca..c36e75db31 100644
--- a/handbook/digital-experience/digital-experience.rituals.yml
+++ b/handbook/digital-experience/digital-experience.rituals.yml
@@ -1,6 +1,24 @@
 # https://github.com/fleetdm/fleet/pull/13084
-
-
+- 
+  task: "Complete Digital Experience KPIs"
+  startedOn: "2024-08-30" 
+  frequency: "Weekly"
+  description: "Complete Digital Experience KPIs for this week"
+  moreInfoUrl: "https://docs.google.com/spreadsheets/d/1Hso0LxqwrRVINCyW_n436bNHmoqhoLhC8bcbvLPOs9A/edit?gid=0#gid=0&range=DB1"
+  dri: "SFriendLee"
+  autoIssue:   
+    labels: [ "#g-digital-experience" ]
+    repo: "fleet"
+- 
+  task: "Prep 1:1s for OKR planning"
+  startedOn: "2024-09-09" 
+  frequency: "Monthly"
+  description: "Add ”DISCUSS: Mike: Expectations of OKR planning“ to each e-group member's 1:1 document"
+  moreInfoUrl: "https://docs.google.com/spreadsheets/d/1Hso0LxqwrRVINCyW_n436bNHmoqhoLhC8bcbvLPOs9A/edit"
+  dri: "SFriendLee"
+  autoIssue:   
+    labels: [ "#g-digital-experience" ]
+    repo: fleet
 - 
   task: "Check browser compatibility for fleetdm.com"
   startedOn: "2024-03-06" 
@@ -18,6 +36,13 @@
   description: "Run through the entire website in `?utm_content=clear` mode and build a fresh outline of the headings to make sure they all still make sense."
   moreInfoUrl: ""
   dri: "mike-j-thomas"
+- 
+  task: "Check brand fronts are up to date"
+  startedOn: "2024-08-01"
+  frequency: "Quarterly"
+  description: "Check all brand fronts for consistancy and update as needed with the current product pitch and graphics."
+  moreInfoUrl: "https://fleetdm.com/handbook/digital-experience#update-a-company-brand-front"
+  dri: "mike-j-thomas"  
 - 
   task: "Check production dependencies of fleetdm.com"
   startedOn: "2023-11-10" 
@@ -49,7 +74,7 @@
   task: "Prioritize for next sprint" # Title that will actually show in rituals table
   startedOn: "2023-08-09" # Needs to align with frequency e.g. if frequency is every thrid Thursday startedOn === any third thursday
   frequency: "Triweekly" # must be supported by https://github.com/fleetdm/fleet/blob/dbbb501358e226fa3fdf48865175efe3334c826c/website/scripts/build-static-content.js
-  description: "Drag next sprint's priorities to the top of the 'Not yet' column." # example of a longer thing: description: "[Prioritizing next sprint](https://fleetdm.com/handbook/digital-experiencemunication)"
+  description: "Using your departmental kanban board, prioritize and finalize next sprint's goals for your team by draging the appropriate issues to the top of the 'Not yet' column." # example of a longer thing: description: "[Prioritizing next sprint](https://fleetdm.com/handbook/digital-experiencemunication)"
   moreInfoUrl: "https://fleetdm.com/handbook/company/why-this-way#why-make-work-visible" #URL used to highlight "description:" test in table
   dri: "sampfluger88" # DRI for ritual (assignee if autoIssue) (TODO display GitHub proflie pic instead of name or title)
   autoIssue:   # Enables automation of GitHub issues
@@ -98,8 +123,8 @@
     repo: "confidential"
 -
   task: "Process and backup Sid agenda"
-  startedOn: "2023-09-15"
-  frequency: "Weekly"
+  startedOn: "2023-09-25"
+  frequency: "Monthly"
   description: "Process and backup Sid agenda"
   moreInfoUrl: "https://fleetdm.com/handbook/digital-experience#process-and-backup-e-group-agenda"
   dri: "SFriendLee"
@@ -150,7 +175,7 @@
   startedOn: "2024-03-31" 
   frequency: "Quarterly"
   description: "Downgrade unused or questionable license seats on the first Wednesday of every quarter" 
-  moreInfoUrl: "https://fleetdm.com/handbook/business-operations#downgrade-an-unused-license-seat"
+  moreInfoUrl: "https://fleetdm.com/handbook/digital-experience#downgrade-an-unused-license-seat"
   dri: "sampfluger88"
 -
   task: "Communicate Fleet's potential energy to stakeholders" 
@@ -162,15 +187,34 @@
   autoIssue:  
     labels: [ "#g-digital-experience" ] 
     repo: "confidential"
-
-
-
-
-
-
-
-
-
-
-
-
+-
+  task: "Vanta check" # TODO tie this to a responsibility
+  startedOn: "2024-04-01"
+  frequency: "Monthly"
+  description: "Look for any new actions in Vanta due in the upcoming months and create issues to ensure they're done on time."
+  moreInfoUrl:
+  dri: "sampfluger88"
+  autoIssue:
+    labels: [ "#g-digital-experience" ]
+    repo: "confidential"
+-
+  task: "Recognize and benchmark workiversaries"
+  startedOn: "2024-07-15"
+  frequency: "Bimonthly"
+  description: "Identify workiversaries coming up in the next two months and follow the steps to ensure they're recognized and benchmarked"
+  moreInfoUrl: "https://fleetdm.com/handbook/digital-experience#recognize-employee-workiversaries"
+  dri: "sampfluger88"
+-
+  task: "Quarterly grants"
+  startedOn: "2024-02-01"
+  frequency: "Quarterly"
+  description: "Create the equity grants GitHub issue and walk through the steps."
+  moreInfoUrl: "https://fleetdm.com/handbook/digital-experience#grant-equity"
+  dri: "hollidayn"
+-
+  task: "Change password of \"Integrations admin\" Salesforce account"
+  startedOn: "2024-09-10"
+  frequency: "Quarterly"
+  description: "Log into the \"Integrations admin\" account in Salesforce and change the password to prevent a password change being required by Salesforce."
+  moreInfoUrl: "https://fleetdm.com/handbook/digital-experience#change-the-integrations-admin-salesforce-account-password"
+  dri: "eashaw"
diff --git a/handbook/business-operations/security-audits.md b/handbook/digital-experience/security-audits.md
similarity index 94%
rename from handbook/business-operations/security-audits.md
rename to handbook/digital-experience/security-audits.md
index 0df67d30d3..81a3af83b6 100644
--- a/handbook/business-operations/security-audits.md
+++ b/handbook/digital-experience/security-audits.md
@@ -1,6 +1,15 @@
 # Security audits
 This page contains explanations of the latest external security audits performed on Fleet software.
 
+## June 2024 penetration testing of Fleet 4.50.1
+In June 2024, [Latacora](https://www.latacora.com/) performed an application penetration assessment of the application from Fleet. 
+
+An application penetration test captures a point-in-time assessment of vulnerabilities, misconfigurations, and gaps in applications that could allow an attacker to compromise the security, availability, processing integrity, confidentiality, and privacy (SAPCP) of sensitive data and application resources. An application penetration test simulates the capabilities of a real adversary, but accelerates testing by using information provided by the target company.
+
+Latacora identified a few medium and low severity risks, and Fleet is prioritizing and responding to those within SLAs. Once all action has been taken, a summary will be provided.
+
+You can find the full report here: [2024-06-14-fleet-penetration-test.pdf](https://github.com/fleetdm/fleet/raw/main/docs/files/2024-06-14-fleet-penetration-test.pdf).
+
 ## June 2023 penetration testing of Fleet 4.32 
 In June 2023, [Latacora](https://www.latacora.com/) performed an application penetration assessment of the application from Fleet. 
 
diff --git a/handbook/business-operations/security-policies.md b/handbook/digital-experience/security-policies.md
similarity index 99%
rename from handbook/business-operations/security-policies.md
rename to handbook/digital-experience/security-policies.md
index 42a911c991..842e67a44d 100644
--- a/handbook/business-operations/security-policies.md
+++ b/handbook/digital-experience/security-policies.md
@@ -102,7 +102,7 @@ Fleet policy requires that:
 
 - Use of shared credentials/secrets must be minimized.
 
-- If required by business operations, secrets/credentials must be shared securely and stored in encrypted vaults that meet the Fleet data encryption standards.
+- If required by Digital Experience, secrets/credentials must be shared securely and stored in encrypted vaults that meet the Fleet data encryption standards.
 
 ### Privileged access management
 
@@ -158,7 +158,7 @@ For technical incidents:
 
 For business/operational incidents:
 - CEO (Mike McNeil)
-- Head of Business Operations (Joanne Stableford)
+- Head of Digital Experience (Sam Pfluger)
 
 ### Response Teams and Responsibilities
 
@@ -612,7 +612,7 @@ CTO                                             | Oversight over information sec
 | System owners                                   | Manage the confidentiality, integrity, and availability of the information systems for which they are responsible in compliance with Fleet policies on information security and privacy.<br/>  Approve of technical access and change requests for non-standard access                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
 | Employees, contractors, temporary workers, etc. | Acting at all times in a manner that does not place at risk the security of themselves, colleagues, and the information and resources they have use of<br/>  Helping to identify areas where risk management practices should be adopted<br/>  Adhering to company policies and standards of conduct Reporting incidents and observed anomalies or weaknesses                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
 | Head of People Operations                       | Ensuring employees and contractors are qualified and competent for their roles<br/>  Ensuring appropriate testing and background checks are completed<br/>  Ensuring that employees and relevant contractors are presented with company policies <br/>  Ensuring that employee performance and adherence to values is evaluated<br/>  Ensuring that employees receive appropriate security training                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
-| Head of Business Operations                     | Responsible for oversight over third-party risk management process; responsible for review of vendor service contracts                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
+| Head of Digital Experience                     | Responsible for oversight over third-party risk management process; responsible for review of vendor service contracts                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
 ## Network and system hardening standards
 
 Fleet leverages industry best practices for network hardening, which involves implementing a layered defense strategy called defense in depth. This approach ensures multiple security controls protect data and systems from internal and external threats.
@@ -790,4 +790,4 @@ Fleet makes every effort to assure all third-party organizations are compliant a
 > Fleet is committed to ethical business practices and compliance with the law.  All Fleeties are required to comply with the "Foreign Corrup Practices Act" and anti-bribery laws and regulations in applicable jurisdictions including, but not limited to, the "UK Bribery Act 2010", "European Commission on Anti-Corruption" and others.  The policies set forth in [this document](https://docs.google.com/document/d/16iHhLhAV0GS2mBrDKIBaIRe_pmXJrA1y7-gTWNxSR6c/edit?usp=sharing) go over Fleet's anti-corruption policy in detail.
 
 <meta name="maintainedBy" value="jostableford">
-<meta name="title" value="📜 Security policies">
+<meta name="title" value="📜 Security policies">
\ No newline at end of file
diff --git a/handbook/business-operations/security.md b/handbook/digital-experience/security.md
similarity index 96%
rename from handbook/business-operations/security.md
rename to handbook/digital-experience/security.md
index ab0b90337b..46bbbf31ed 100644
--- a/handbook/business-operations/security.md
+++ b/handbook/digital-experience/security.md
@@ -27,7 +27,7 @@ As an all-remote company, we do not have the luxury of seeing each other or bein
 | Participant | Role                                                                                                                                                 |
 | ----------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- |
 | Requester   | Requests recovery for their own account                                                                |
-| Recoverer   | Person with access to perform the recovery who monitors `#g-business-operations`                                                                                                                               |
+| Recoverer   | Person with access to perform the recovery who monitors `#g-digital-experience`                                                                                                                               |
 | Identifier  | Person that visually identifies the requester in a video call. The identifier can be the recoverer or a person the recoverer can recognize visually |
 
 
@@ -35,10 +35,10 @@ As an all-remote company, we do not have the luxury of seeing each other or bein
 
 
 1. If the requester still has access to GitHub and/or Slack, they [ask for
-   help](https://fleetdm.com/handbook/business-operations#intake). For non-urgent requests, please
-   prefer filing an issue with the business operations team. If they do not have access,
+   help](https://fleetdm.com/handbook/digital-experience#contact-us). For non-urgent requests, please
+   prefer filing an issue with the Digital Experience team. If they do not have access,
    they can contact their manager or a teammate over the phone via voice or texting, and they will
-   [ask for help](https://fleetdm.com/handbook/business-operations#intake) on behalf of the
+   [ask for help](https://fleetdm.com/handbook/digital-experience#contact-us) on behalf of the
    requester.
 2. The recoverer identifies the requester through a live video call.
 * If the recoverer does not know the requester well enough to positively identify them visually, the
@@ -311,32 +311,6 @@ We do not apply ultra restrictive Data Loss Prevention style policies to our dev
 
 We use osquery and Fleet to monitor our own devices. This is used for vulnerability detection, security posture tracking, and incident response when necessary.
 
-#### Deploy Nudge
-Keeping operating systems up to date is important to fix known vulnerabilities. This is why we enable automatic updates on macOS, but as that system is neither aggressive or reliable enough, we also use Nudge to push individuals to update their systems before a deadline.
-
-##### Deploying Nudge
-Two packages from the Nudge [releases](https://github.com/macadmins/nudge/releases) must be deployed via MDM.
-
-1. Nudge itself. This is the Nudge executables that display prompts to update the system.
-2. Nudge LaunchAgent. This is the package that contains the automated tasks that make Nudge check if the system is up to date, and if not, to show the prompt.
-
-If only Nudge is deployed, nothing will happen on the system, as it will never launch unless triggered manually. The main reason to only install Nudge would be to run it manually for testing purposes, or if some other tool was used to schedule running it. 
-
-At Fleet, we use the standard LaunchAgent.
-
-We do not bundle any configuration with the Nudge packages themselves.
-
-##### Nudge configuration
-Nudge supports multiple configuration modes, but the one we use is via a [profile](https://github.com/fleetdm/confidential/blob/main/mdm_profiles/nudge_configuration.mobileconfig). (Note: our MDM profiles are not public simply because a few of them contain secrets, such as Chrome organization identification strings. Our Nudge profile is extremely similar to the [sample one](https://github.com/macadmins/nudge/blob/main/Example%20Assets/com.github.macadmins.Nudge.mobileconfig)).
-
-By joining a laptop to our MDM and deploying profiles, Nudge will get configured. 
-
-When a new update is released, the following fields must be updated:
-
-* `aboutUpdateURLs` in all languages, pointing to the Apple page with information about vulnerabilities fixed in each update. If an update had no vulnerabilities fixed, we'd typically not enforce it via Nudge, but this is extremely rare.
-* `requiredMinimumOSVersion` must be set to the new version (ex: `13.1`).
-* `requiredInstallationDate` must be set to a date in the future, based on the criticality of the vulnerabilities fixed by the update.
-
 ### Chrome configuration
 We configure Chrome on company-owned devices with a basic policy.
 
@@ -896,12 +870,12 @@ questions and more on [https://fleetdm.com/trust](https://fleetdm.com/trust)
 
 ## Securtiy audits
 
-Read about Fleet's security audits on [this page](https://fleetdm.com/handbook/business-operations/security-audits).
+Read about Fleet's security audits on [this page](https://fleetdm.com/handbook/digital-experience/security-audits).
 
 
 ## Application security
 
-Read about Fleet's application security practices on the [application security page](https://fleetdm.com/handbook/business-operations/application-security).
+Read about Fleet's application security practices on the [application security page](https://fleetdm.com/handbook/digital-experience/application-security).
 
 <meta name="maintainedBy" value="hollidayn">
 <meta name="title" value="Security">
diff --git a/handbook/business-operations/vendor-questionnaires.md b/handbook/digital-experience/vendor-questionnaires.md
similarity index 95%
rename from handbook/business-operations/vendor-questionnaires.md
rename to handbook/digital-experience/vendor-questionnaires.md
index 8af1763870..ee3bf32cd2 100644
--- a/handbook/business-operations/vendor-questionnaires.md
+++ b/handbook/digital-experience/vendor-questionnaires.md
@@ -17,7 +17,7 @@ Please also see [Application security](https://fleetdm.com/docs/using-fleet/appl
 
 
 ## Data security
-Please also see ["Data security"](https://fleetdm.com/handbook/business-operations/security-policies#data-management-policy)
+Please also see ["Data security"](https://fleetdm.com/handbook/digital-experience/security-policies#data-management-policy)
 | Question | Answer                                                                                                                                                 |
 | ----------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- |
 | Should the need arise during an active relationship, how can our Data be removed from the Fleet's environment?   | Customer data is primarily stored in RDS, S3, and Cloudwatch logs. Deleting these resources will remove the vast majority of customer data. Fleet can take further steps to remove data on demand, including deleting individual records in monitoring systems if requested.                                                                                                                              |
@@ -35,7 +35,7 @@ Please also see ["Data security"](https://fleetdm.com/handbook/business-operatio
 | Can Fleet customers access service logs?    |    Logs will not be accessible by default, but can be provided upon request. |
 
 ## Encryption and key management
-Please also see [Encryption and key management](https://fleetdm.com/handbook/business-operations/security-policies#encryption-policy)
+Please also see [Encryption and key management](https://fleetdm.com/handbook/digital-experience/security-policies#encryption-policy)
 | Question | Answer                                                                                                                                                 |
 | ----------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- |
 | Does Fleet have a cryptographic key management process (generation, exchange, storage, safeguards, use, vetting, and replacement), that is documented and currently implemented, for all system components? (e.g. database, system, web, etc.)   | All data is encrypted at rest using methods appropriate for the system (ie KMS for AWS based resources). Data going over the internet is encrypted using TLS or other appropiate transport security. |
@@ -48,10 +48,10 @@ Please also see [Encryption and key management](https://fleetdm.com/handbook/bus
 | Does Fleet have documented information security baselines for every component of the infrastructure (e.g., hypervisors, operating systems, routers, DNS servers, etc.)?  | Fleet follows best practices for the given system. For instance, with AWS we utilize AWS best practices for security including GuardDuty, CloudTrail, etc.                                                                |
 
 ## Business continuity
-Please also see [Business continuity](https://fleetdm.com/handbook/business-operations/security-policies#business-continuity-plan)
+Please also see [Business continuity](https://fleetdm.com/handbook/digital-experience/security-policies#business-continuity-plan)
 | Question | Answer                                                                                                                                                 |
 | ----------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Please provide your application/solution disaster recovery RTO/RPO | RTO and RPO intervals differ depending on the service that is impacted. Please refer to https://fleetdm.com/handbook/business-operations/security-policies#business-continuity-and-disaster-recovery-policy                                                               |
+| Please provide your application/solution disaster recovery RTO/RPO | RTO and RPO intervals differ depending on the service that is impacted. Please refer to https://fleetdm.com/handbook/digital-experience/security-policies#business-continuity-and-disaster-recovery-policy                                                               |
 
 ## Network security
 | Question | Answer                                                                                                                                                 |
diff --git a/handbook/engineering/README.md b/handbook/engineering/README.md
index d6f18bde2c..388a5c8724 100644
--- a/handbook/engineering/README.md
+++ b/handbook/engineering/README.md
@@ -111,11 +111,10 @@ If there is partially merged feature work when the release candidate is created,
 Before kicking off release QA, confirm that we are using the latest versions of dependencies we want to keep up-to-date with each release. Currently, those dependencies are:
 
 1. **Go**: Latest minor release
-- Check the [version included in Fleet](https://github.com/fleetdm/fleet/settings/variables/actions).
+- Check the [Go version specified in Fleet's go.mod file](https://github.com/fleetdm/fleet/blob/main/go.mod) (`go 1.XX.YY`).
 - Check the [latest minor version of Go](https://go.dev/dl/). For example, if we are using `go1.19.8`, and there is a new minor version `go1.19.9`, we will upgrade.
 - If the latest minor version is greater than the version included in Fleet, [file a bug](https://github.com/fleetdm/fleet/issues/new?assignees=&labels=bug%2C%3Areproduce&projects=&template=bug-report.md&title=) and assign it to the [release ritual DRI](https://fleetdm.com/handbook/engineering#rituals) and the current oncall engineer. Add the `~release blocker` label. We must upgrade to the latest minor version before publishing the next release.
 - If the latest major version is greater than the version included in Fleet, [create a story](https://github.com/fleetdm/fleet/issues/new?assignees=&labels=story%2C%3Aproduct&projects=&template=story.md&title=) and assign it to the [release ritual DRI](https://fleetdm.com/handbook/engineering#rituals) and the current oncall engineer. This will be considered for an upcoming sprint. The release can proceed without upgrading the major version.
-- Note that major version upgrades also require an [update to go.mod](https://github.com/fleetdm/fleet/blob/7b3134498873a31ba748ca27fabb0059cef70db9/go.mod#L3). 
 
 > In Go versioning, the number after the first dot is the "major" version, while the number after the second dot is the "minor" version. For example, in Go 1.19.9, "19" is the major version and "9" is the minor version. Major version upgrades are assessed separately by engineering.
 
@@ -131,7 +130,7 @@ Our goal is to keep these dependencies up-to-date with each release of Fleet. If
 
 3. **osquery**: Latest release
 - Check the [latest version of osquery](https://github.com/osquery/osquery/releases).
-- Check the [version included in Fleet](https://github.com/fleetdm/fleet/blob/ceb4e4602ba9a90ebf0e33e1eddef770c9a8d8b5/.github/workflows/generate-osqueryd-targets.yml#L27).
+- Check the [version included in Fleet](https://github.com/fleetdm/fleet/blob/main/.github/workflows/generate-osqueryd-targets.yml#L27).
 - If the latest release of osquery is greater than the version included in Fleet, [file a bug](https://github.com/fleetdm/fleet/issues/new?assignees=&labels=bug%2C%3Areproduce&projects=&template=bug-report.md&title=) and assign it to the [release ritual DRI](https://fleetdm.com/handbook/engineering#rituals) and the [current on-call engineer](https://fleetdm.com/handbook/engineering#how-to-reach-the-oncall-engineer).
 - Do not add the `~release blocker` label. 
 - Update the bug description to note that changes to [osquery command-line flags](https://osquery.readthedocs.io/en/stable/installation/cli-flags/) require updates to Fleet's flag validation and related documentation [as shown in this pull request](https://github.com/fleetdm/fleet/pull/16239/files). 
@@ -464,7 +463,7 @@ When this occurs, we will begin receiving the following error message when attem
 
 2. Log in using the credentials stored in 1Password under "Apple developer account".
 
-3. Contact the Head of Business Operations to determine which phone number to use for 2FA.
+3. Contact the Head of Digital Experience to determine which phone number to use for 2FA.
 
 4. Complete the 2FA process to log in.
 
@@ -492,7 +491,7 @@ The certificate signing request (CSR) certificate expires every year. It needs t
 
 Steps to renew the certificate:
 
-1. Visit the [Apple developer account login page](https://appleid.apple.com/account?appId=632&returnUrl=https%3A%2F%2Fdeveloper.apple.com%2Fcontact%2F).
+1. Visit the [Apple developer account login page](https://developer.apple.com/account).
 2. Log in using the credentials stored in 1Password under **Apple developer account**.
 3. Verify you are using the **Enterprise** subaccount for Fleet Device Management Inc.
 4. Generate a new certificate following the instructions in [MicroMDM](https://github.com/micromdm/micromdm/blob/c7e70b94d0cfc7710e5c92be20d4534d9d5a0640/docs/user-guide/quickstart.md?plain=1#L103-L118).
@@ -536,16 +535,28 @@ Upon receiving any device, follow these steps to process incoming equipment.
 
 ### Ship approved equipment
 
-Once the Business Operations department approves inventory to be shipped from Fleet IT, follow these step to ship the equipment.
+Once the Digital Experience department approves inventory to be shipped from Fleet IT, follow these step to ship the equipment.
 1. Compare the equipment request issue with the ["Company equipment" spreadsheet](https://docs.google.com/spreadsheets/d/1hFlymLlRWIaWeVh14IRz03yE-ytBLfUaqVz0VVmmoGI/edit#gid=0) and verify physical inventory.
 2. Plug in the device and ensure inventory has been correctly processed and all components are present (e.g. charger cord, power converter).
-3. package equipment for shipment and include Yubikeys (if requested).
+3. Package equipment for shipment and include Yubikeys (if requested).
 4. Change the "Company equipment" spreadsheet to reflect the new user.
   - If you encounter any issues, repeat the [process incoming equipment steps](https://fleetdm.com/handbook/engineering#process-incoming-equipment). If problems persist, create a ["💻 IT support issue](https://github.com/fleetdm/confidential/issues/new?assignees=%40spokanemac&labels=%3Ahelp-it&projects=&template=request-it-support.md&title=%F0%9F%92%BB+Request+IT+support) for IT to troubleshoot the device.
 6. Ship via FedEx to the address listed in the equipment request.
 7. Add a comment to the equipment request issue, at-mentioning the requestor with the FedEx tracking info and close the issue.
 
 
+### Provide 0-day support for major version macOS releases
+
+Beginning with macOS 16, Fleet will offer 0-day support for all major version macOS releases. 
+
+1. Install major version macOS beta release on test devices. 
+2. Create a new [QA release issue](https://github.com/fleetdm/fleet/issues/new?assignees=xpkoala%2Cpezhub&labels=%23g-mdm%2C%23g-endpoint-ops%2C%3Arelease&projects=&template=release-qa.md&title=Release+QA%3A+macOS+16) with the new major version in the issue title.
+3. Complete all manual smoke tests in the issue and confirm they are passing. 
+4. Confirm all automated tests are passing.
+5. [File bugs](https://github.com/fleetdm/fleet/issues/new?assignees=&labels=P1%2Cbug%2C%3Areproduce%2C%3Aincoming&projects=&template=bug-report.md&title=) with a `P1` label and assign to the appropriate [product group](https://fleetdm.com/handbook/company/product-groups#current-product-groups).
+6. When all bugs are fixed, follow the [writing a feature guide](https://fleetdm.com/handbook/engineering#write-a-feature-guide) process to publish an article announcing Fleet 0-day support for the new major release.
+
+
 ## Rituals
 
 <rituals :rituals="rituals['handbook/engineering/engineering.rituals.yml']"></rituals>
diff --git a/handbook/engineering/engineering.rituals.yml b/handbook/engineering/engineering.rituals.yml
index 62432b78c3..bdc8aa69ec 100644
--- a/handbook/engineering/engineering.rituals.yml
+++ b/handbook/engineering/engineering.rituals.yml
@@ -46,7 +46,7 @@
   task: "Release candidate ritual"
   startedOn: "2023-08-09" 
   frequency: "Triweekly"
-  description: "Go through the process of create a release candidate."
+  description: "Go through the process of creating a release candidate."
   moreInfoUrl: "https://github.com/fleetdm/fleet/blob/main/tools/release/README.md#minor-release-typically-end-of-sprint"
   dri: "lukeheath"
 - 
@@ -74,14 +74,14 @@
   task: "QA report"
   startedOn: "2023-08-09" 
   frequency: "Triweekly"
-  description: "Every release cycle, on the Monday of release week, the DRI for the release ritual is updated on status of testing."
+  description: "Every release cycle, on the Monday of release week, update the DRI for the release ritual on status of testing."
   moreInfoUrl:
   dri: "xpkoala"
 - 
   task: "Release QA"
   startedOn: "2023-08-09" 
   frequency: "Triweekly"
-  description: "Every release cycle, by end of day Friday of release week, all issues move to Ready for release on the #g-mdm and #g-endpoint-ops sprint boards."
+  description: "Every release cycle, by end of day Friday of release week, move all issues to the ”✅ Ready for release” column on the #g-mdm and #g-endpoint-ops sprint boards."
   moreInfoUrl:
   dri: "xpkoala"
 #-
@@ -95,8 +95,8 @@
   task: "Check ongoing events"
   startedOn: "2024-02-09"
   frequency: "Daily"
-  description: "Check event issues and complete steps"
-  moreInfoUrl: "https://fleetdm.com/handbook/business-operations#book-an-event"
+  description: "Check event issues and complete steps."
+  moreInfoUrl: "https://fleetdm.com/handbook/engineering#book-an-event"
   dri: "spokanemac"
 
 
diff --git a/handbook/finance/README.md b/handbook/finance/README.md
new file mode 100644
index 0000000000..77d9bc9b67
--- /dev/null
+++ b/handbook/finance/README.md
@@ -0,0 +1,344 @@
+# Finance
+This handbook page details processes specific to working [with](#contact-us) and [within](#responsibilities) this department.
+
+## Team
+| Role                          | Contributor(s)           |
+|:------------------------------|:-----------------------------------------------------------------------------------------------------------|
+| Head of Finance   | [Joanne Stableford](https://www.linkedin.com/in/joanne-stableford/) _([@jostableford](https://github.com/JoStableford))_
+| Finance Engineer | [Isabell Reedy](https://www.linkedin.com/in/isabell-reedy-202aa3123/) _([@ireedy](https://github.com/ireedy))_
+
+
+## Contact us
+- To **make a request** of this department, [create an issue](https://github.com/fleetdm/confidential/issues/new?assignees=&labels=%23g-finance&projects=&template=custom-request.md) and a team member will get back to you within one business day (If urgent, mention a [team member](#team) in [#g-finance](https://fleetdm.slack.com/archives/C047N5L6EGH).
+  - Please **use issue comments and GitHub mentions** to communicate follow-ups or answer questions related to your request.
+  - Any Fleet team member can [view the kanban board](https://app.zenhub.com/workspaces/-g-finance-63f3dc3cc931f6247fcf55a9/board?sprints=none) for this department, including pending tasks and the status of new requests.
+
+
+## Responsibilities
+The Finance department is directly responsible for accounts receivable including invoicing, accounts payable including commision calculations, exspense reporting including Brex memos and maintaining accurate spend projections in "🧮The numbers", sales taxes, payroll taxes, corporate income/franchise taxes, and financial operations including bank accounts and cash flow management.
+
+
+### Run payroll
+Many of these processes are automated, but it's vital to check Gusto and Plane manually for accuracy.
+ - Salaried fleeties are automated in Gusto and Plane.
+ - Hourly fleeties and consultants are a manual process each month in Gusto and Plane.
+
+| Payroll type                 | What to use                  | DRI                          |
+|:-----------------------------|:-----------------------------|:-----------------------------|
+| [Commissions and ramp](https://fleetdm.com/handbook/finance#run-us-commission-payroll)         | "Off-cycle - Commission" payroll          | Head of Finance
+| Sign-on bonus                | "Bonus" payroll              | Head of Finance
+| Performance bonus            | "Bonus" payroll              | Head of Finance     
+| Accelerations (quarterly)    | "Off-cycle - Commission" payroll          | Head of Finance
+| [US contractor payroll](https://fleetdm.com/handbook/finance#run-us-contractor-payroll) | "Off-cycle" payroll | Head of Finance
+
+### Reconcile monthly recurring expenses
+Recurring monthly or annual expenses, such as the tools we use throughout Fleet, are tracked as recurring, non-personnel expenses in ["🧮 The Numbers"](https://docs.google.com/spreadsheets/d/1X-brkmUK7_Rgp7aq42drNcUg8ZipzEiS153uKZSabWc/edit#gid=2112277278) _(¶confidential Google Sheet)_, along with their payment source. Reconciliation of recurring expenses happens monthly. <!-- TODO: Merge "🧮 The Numbers" and  ["Tools we use" (private Google doc)](https://docs.google.com/spreadsheets/d/170qjzvyGjmbFhwS4Mucotxnw_JvyAjYv4qpwBrS6Gl8/edit?usp=sharing) -->
+
+> Use this spreadsheet as the source of truth.  Always make changes to it first before adding or removing a recurring expense. Only track significant expenses. (Other things besides amount can make a payment significant; like it being an individualized expense, for example.)
+
+
+### Register Fleet as an employer with a new state 
+Fleet must register as an employer in any state where we hire new teammates. To do this, complete the following steps in Gusto:
+1. After a new teammate completes their Gusto profile, the Finance department will be prompted to approve it for payroll. Sign in to your Gusto admin account and begin the approval process.
+2. Select "yes" when prompted to file a new hire report and complete the approval process.
+3. Once the profile is approved, navigate to Tax setup and select the state you’d like to register Fleet in.
+4. Select “Have us register for you” and then “Start registration.”
+5. Verify, add, and amend any company information to ensure accuracy.
+6. Select “Send registration” and authorize payment for the specified amount. CorpNet will then send an email with next steps, which vary by state.
+7. Update the [list of states that Fleet is currently registered with as an employer](https://fleetdm.com/handbook/finance#review-state-employment-tax-filings-for-the-previous-quarter).
+    
+
+### Process an email from a state agency
+From time to time, you may get notices via email (or in the mail) from state agencies regarding Fleet's withholding and/or unemployment tax accounts. You can resolve some of these notices on your own by verifying and/or updating the settings in your Gusto account.
+
+If the notice is regarding an upcoming change to your deposit schedule or unemployment tax rate, make the required change in Gusto, such as:
+- Update your unemployment tax rate.
+- Update your federal deposit schedule.
+- Update your state deposit schedule.
+
+In Gusto, you can click **How to review your notice** to help you understand what kind of notice you received and what additional action you can take to help speed up the time it takes to resolve the issue.
+
+> **Note:** Many agencies do not send notices to Gusto directly, so it’s important that you read and take action before any listed deadlines or effective dates of requested changes, in case you have to do something.  If you can't resolve the notice on your own, are unsure what the notice is in reference to, or the tax notice has a missing payment or balance owed, follow the steps in the Report and upload a tax notice in Gusto.
+
+Every quarter, payroll and tax filings are due for each state. Gusto can handle these automatically if Third-party authorization (TPA) is enabled. Each state is unique and Gusto has a library of [State registration and resources](https://support.gusto.com/hub/Employers-and-admins/Taxes-forms-and-compliance/State-registration-and-resources) available to review.  You will need to grant Third-party authorization (TPA) per state and this should be checked quarterly before the filing due dates to ensure that Gusto can file on time. -->
+
+
+### Review state employment tax filings for the previous quarter
+
+Every quarter, payroll and tax filings are due for each state. Gusto automates this process, however there are often delays or quirks between Gusto's submission and the state receiving the filings.
+To mitigate the risk of penalties and to ensure filings occur as expected, follow these steps in the first month of the new quarter, verifying past quarter submission:
+1. Create an issue to "Review state filings for the previous quarter".
+2. Copy this text block into the issue to track progress by state:
+
+
+```
+States checked:
+- [ ] California
+- [ ] Colorado
+- [ ] Connecticut
+- [ ] Florida
+- [ ] Georgia
+- [ ] Hawaii
+- [ ] Illinois
+- [ ] Kansas
+- [ ] Maryland
+- [ ] Massachusetts
+- [ ] New York
+- [ ] Ohio
+- [ ] Oregon
+- [ ] Pennsylvania
+- [ ] Rhode Island
+- [ ] Tennessee
+- [ ] Texas
+- [ ] Utah
+- [ ] Virginia
+- [ ] Washington
+- [ ] Washington, DC
+- [ ] West Virginia
+- [ ] Wisconsin
+```
+ 
+
+3. Login to Gusto and navigate to "Taxes and compliance", then "Tax documents".
+4. Login to each State portal (using the details saved in 1Password) and verify that the portal has received the automated submission from Gusto.
+5. Check off states that are correct, and use comments to explain any quirks or remediation that's needed.
+
+
+### Run US contractor payroll
+For Fleet's US contractors, running payroll is a manual process:
+1. Add the amount to be paid to the "Gross" line.
+2. Review hours _("Time tools > Time tracking")_
+3. Adjust time frame to match current payroll period (the 27th through 26th of the month)
+4. Sync hours and run contractor payroll.
+
+### Create an invoice
+To create a new invoice for a Fleet customer, follow these steps:
+1. Go to the [invoice folder in google drive](https://drive.google.com/drive/folders/11limC_KQYNYQPApPoXN0CplHo_5Qgi2b?usp=drive_link).
+2. Create a copy of the invoice template, and title the copy `[invoice number] Fleet invoice - [customer name]`.
+    - The invoice number follows the format of `YYMMDD[daily issued invoice number]`, where the daily issued invoice number should equal `01` if it's the first invoice issued that day, `02` if it's the second, etc.
+3.  Edit the new invoice to reflect details from the signed subscription agreement (and PO if required).
+    - Enter the invoice number (and PO number if required) into the top right section of the invoice.
+    - Update the date of the invoice to reflect the current date.
+    - Make sure the payment terms match the signed subscription agreement.
+    - Copy the customer address from the signed subscription agreement and input it in the "Bill to" section of the invoice.
+    - Copy the "Billing contact" email from the signed subscription agreement and add it to the last line of the "Bill to" address.
+    - Make sure the start and end dates of the contract and amount match the subscription agreement.
+    - If professional services are included in the subscription agreement, include as a separate line in the invoice, and ensure the amounts total correctly.
+    - Ensure the "Notes" section has wiring instructions for payment via SVB.
+4.  Download the completed invoice as a PDF.
+5.  Send the PDF to the billing contact from the "Bill to" section of the invoice and cc [Fleet's billing email address](https://fleetdm.com/handbook/company/communications#email-relays). Use the following template for the email:
+
+```
+Subject: Invoice for Fleet Device Management [invoice number]
+Hello,
+
+I've attached the invoice for [customer name]'s purchase of Fleet Device Management's premium subscription.
+For payment instructions please refer to your invoice, and reach out to [insert Fleet's billing address] with any questions.
+
+Thanks,
+[name]
+```
+
+6. Update the opportunity and the opportunity billing cycle in Salesforce to include the "Invoice date" as the day the invoice was sent.
+8. Notify the AE/CSM that the invoice has been sent.
+
+> Certain vendors require invoices submitted via a payment portal (such as Coupa). Once you've generated the invoice using the steps above, upload it to the relevant payment portal and email the billing contact to let them know you've submitted the invoice.
+
+
+### Communicate the status of customer financial actions
+This reporting is performed to update the status of open or upcoming customer actions regarding the financial health of the opportunity. To complete the report:
+1. Check [SVB](https://connect.svb.com/#/) and [Brex](https://accounts.brex.com/login) for any recently received payments from customers and record them in SFDC.
+2. Go to this [report folder](https://fleetdm.lightning.force.com/lightning/r/Folder/00lUG000000DstpYAC/view?queryScope=userFolders) in SFDC. The three reports will provide the data used in the report.
+3. Copy the template below and paste it into the [#g-sales slack channel](https://fleetdm.slack.com/archives/C030A767HQV) and complete all "todos" using the data from Salesforce before sending.
+
+```
+Weekly revenue report - [@`todo: CRO` and @`todo: CEO`]
+- Number accounts with outstanding balances = `todo`
+- Number of customers awaiting invoices = `todo`
+- Number of past-due renewals = `todo`
+```
+
+4. Send payment reminders via email to all outstanding accounts by responding to the invoice email initially sent to the customer.
+
+```
+Hello,
+This is a reminder that you have an outstanding balance due for your Fleet Device Management premium subscription.
+We have included the invoice here for your convenience.
+For payment instructions please refer to your invoice, and reach out to [Fleet's billing contact] with any questions.
+
+Thanks,
+[name]
+```
+
+5. If any accounts will become overdue within a week, reply in thread to the slack post, mention the opportunity owner of the account, and ask them to notify their contact that Fleet is still awaiting payment.
+6. Review the [billing cycles](https://fleetdm.lightning.force.com/lightning/r/Report/00OUG000000yGjR2AU/view) report in SFDC for customers on multiyear deals. For any customers due for invoicing within the next week, create an issue on the Finance board.
+
+
+### Run US commission payroll
+1. Update individual teammates commission calculators (linked from [main commission calculator](https://docs.google.com/spreadsheets/d/1PuqUbfPGos87TfcHWgUd05TRJgQLlBmhyz1euj79m2A/edit?usp=sharing)) with new revenue from any deals that are closed-won (have a subscription agreement signed by both parties) and have a **close date** within the previous month.
+    - Verify closed-won deal numbers with CRO to ensure any agreed upon exceptions are captured (eg: CRO approves an AE to receive commission on a renewal deal due to cross-sell).
+2. In the "Monthly commission payroll party" meeting, present the commission calculations for Fleeties receiving commission for approval.
+    - If there are any quarterly accelerators due for the teammate receiving commission, ensure the individual total includes both the monthly and the quarterly amount.
+3. After the amounts are approved in the meeting, process the commission payroll.
+    - Use the off-cycle payroll option in Gusto. Be sure to classify the payment as "Commission" in the "other earnings" field and not the generic "Bonus."
+4. Once commission payroll has been run, update the [main commission calculator](https://docs.google.com/spreadsheets/d/1PuqUbfPGos87TfcHWgUd05TRJgQLlBmhyz1euj79m2A/edit?usp=sharing) to mark the commission as paid.
+
+### Run international commission payroll
+1. Follow the steps in [run US commission payroll](https://fleetdm.com/handbook/finance#run-us-commission-payroll) to have the commission amounts approved by the CRO.
+2. After the amounts are approved in the "Monthly commission payroll party", navigate to Help > Ask a question in Plane to request a commission payment for the teammate.
+3. Send a message using the following template
+
+    ```
+    Hello,
+    I’d like to run an off-cycle commission payment for [teammate’s full name] for the period of [commission period].
+    The amount of [USD amount] should be paid with their next payroll.
+    Please let me know if you need any additional information to process this request.
+    
+    Thanks,
+    [name]
+    ```
+
+4. Once Plane confirms the payroll change has been actioned, update the [main commission calculator](https://docs.google.com/spreadsheets/d/1PuqUbfPGos87TfcHWgUd05TRJgQLlBmhyz1euj79m2A/edit#gid=928324236) to mark the commission as paid. 
+
+
+### Run quarterly or annual employee bonus payroll
+1. Update individual teammate bonus calculator (linked from [main commission calculator](https://docs.google.com/spreadsheets/d/1PuqUbfPGos87TfcHWgUd05TRJgQLlBmhyz1euj79m2A/edit?usp=sharing)) with relevant metrics.
+    - Bonus plans will have details specified on how to measure success, with most drawing from the [KPI spreadsheet](https://docs.google.com/spreadsheets/d/1Hso0LxqwrRVINCyW_n436bNHmoqhoLhC8bcbvLPOs9A/edit?usp=sharing) or from linked SFDC reports. If unsure where to pull achievement metrics from, contact teammate's manager to clarify.
+2. In the "Monthly commission payroll party" meeting, present the bonus calculations for Fleeties receiving bonus for approval.
+3. After the amounts are approved in the meeting, process the bonus payroll.
+    - Use the off-cycle payroll option in Gusto and be sure to classify the payment as "Bonus".
+    - For international teammates, you may need to use the "Help" function, or email support to notify Plane of the amount needing to be paid.
+4. Once bonus payroll has been run, update the [main commission calculator](https://docs.google.com/spreadsheets/d/1PuqUbfPGos87TfcHWgUd05TRJgQLlBmhyz1euj79m2A/edit?usp=sharing) to mark the bonus as paid. 
+ 
+
+### Process monthly accounting
+Create a [new montly accounting issue](https://github.com/fleetdm/confidential/issues/new/choose) for the current month and year named "Closing out YYYY-MM" in GitHub and complete all of the tasks in the issue. (This uses the [monthly accounting issue template](https://github.com/fleetdm/confidential/blob/main/.github/ISSUE_TEMPLATE/5-monthly-accounting.md).
+
+- **SLA:** The monthly accounting issue should be completed and closed before the 7th of the month.
+- The close date is tracked each month in [KPIs](https://docs.google.com/spreadsheets/d/1Hso0LxqwrRVINCyW_n436bNHmoqhoLhC8bcbvLPOs9A/edit).
+- **When is the issue created?** We create and close the monthly accounting issue for the previous month within the first 7 days of the following month.  For example, the monthly accounting issue to close out the month of January is created promptly in February and closed before the end of the day, Feb 7th.  A convenient trick is to create the issue on the first Friday of the month and close it ASAP.
+
+
+### Respond to low credit alert
+Fleet admins will receive an email alert when the usage of company cards for the month is aproaching the company credit limit. To avoid the limit being exceeded, a Brex admin will follow these steps:
+1. Sign in to Fleet's Brex account.
+2. On the landing page, use the "Move money" button to "Add funds to your Brex business accounts".
+3. Select "Transfer from a connected account" and select the primary business account.
+4. Choose the "One time" transfer option and process the transfer.
+
+No further action needs to be taken, the amount available for use will increase without disruption to regular processes.
+
+### Check franchise tax status
+No later than the second month of every quarter, we check [Delaware divison of corporations](https://icis.corp.delaware.gov) to ensure that Fleet has paid the quarterly franchise tax amounts to remain in good standing with the state of Delaware.
+- Go to the [DCIS - eCorp website](https://icis.corp.delaware.gov/ecorp/logintax.aspx?FilingType=FranchiseTax) and use the details in 1Password to look up Fleet's status.
+- If no outstanding amounts: the tax has been paid.
+- If outstanding amounts shown: ensure payment before due date to avoid penalties, interest, and entering bad standing.
+
+
+### Check finances for quirks
+Every quarter, we check Quickbooks Online (QBO) for discrepancies and follow up on quirks.
+1. Check to make sure [bookkeeping quirks](https://docs.google.com/spreadsheets/d/1nuUPMZb1z_lrbaQEcgjnxppnYv_GWOTTo4FMqLOlsWg/edit?usp=sharing) are all accounted for and resolved or in progress toward resolution.
+2. Check balance sheet and profit and loss statements (P&Ls) in QBO against the latest [monthly workbooks](https://drive.google.com/drive/folders/1ben-xJgL5MlMJhIl2OeQpDjbk-pF6eJM) in Google Drive. Ensure reports are in the "accural" accounting method.
+3. Reach out to Pilot with any differences or quirks, and ask them to resolve/provide clarity.  This often will need to happen over a call to review sycnhronously.
+4. Once quirks are resolved, note the day it was resolved in the spreadsheet.
+
+
+### Report quarterly numbers in Chronograph
+Follow these steps to perform quarterly reporting for Fleet's investors:
+1. Login to Chronograph and upload our profit and loss statement (P&L), balance sheet and cash flow statements for CRV (all in one book saved in [Google Drive](https://drive.google.com/drive/folders/1ben-xJgL5MlMJhIl2OeQpDjbk-pF6eJM).
+2. Provide updated metrics for the following items using Fleet's [KPI spreadsheet](https://docs.google.com/spreadsheets/d/1Hso0LxqwrRVINCyW_n436bNHmoqhoLhC8bcbvLPOs9A/edit#gid=0).
+    - Headcount at end of the previous quarter.
+    - Starting ARR for the previous quarter.
+    - Total new ARR for the previous quarter.
+    - "Upsell ARR" (new ARR from expansions only- Chronograph defines "upsell" as price increases for any reason.
+      **- Fleet does not "upsell" anything; we deliver more value and customers enroll more hosts), downgrade ARR and churn ARR (if any) for the previous quarter.**
+    - Ending ARR for the previous quarter.
+    - Starting number of customers, churned customers, and the number of new customers Fleet gained during the previous quarter.
+    - Total amount of Fleet customers at the end of the previous quarter.
+    - Gross margin % 
+      - How to calculate: (total revenue for the quarter - cost of goods sold for the quarter)/total revenue for the quarter (these metrics can be found in our books from Pilot). Chronograph will automatically conver this number to a %.
+    - Net dollar retention rate
+      - How to calculate: (starting ARR + new subscriptions and expansions - churn)/starting ARR. 
+    - Cash burn
+      - How to calculate: start of quarter runway - end of quarter runway. 
+
+
+### Deliver annual report for venture line
+Within 60 days of the end of the year, follow these steps:
+1. Provide Silicon Valley Bank (SVB) with our balance sheet and profit and loss statement (P&L, sometimes called a cashflow statement) for the past twelve months.  
+2. Provide SVB with our board-approved annual operating budgets and projections (on a quarterly granularity) for the new year.
+3. Deliver this as early as possible in case they have questions.
+
+
+### Process a new vendor invoice
+Fleet pays its vendors in less than 15 business days in most cases. All invoices and tax documents should be submitted to the Finance department using the [appropriate Fleet email address (confidential Google Doc)](https://docs.google.com/document/d/1tE-NpNfw1icmU2MjYuBRib0VWBPVAdmq4NiCrpuI0F0/edit#heading=h.wqalwz1je6rq).
+- After making sure the invoice received from a new vendor is valid, add the new vendor to the recurring expenses section of ["The numbers"](https://docs.google.com/spreadsheets/d/1X-brkmUK7_Rgp7aq42drNcUg8ZipzEiS153uKZSabWc/edit#gid=2112277278) before paying the invoice.
+- If we have not paid this vendor before, make sure we have received the required W-9 or W-8 form from the vendor. **Accounting cannot process a payment without these tax forms for compliance reasons.**
+  - **US-based vendors** are required to complete a [W-9 form](https://www.irs.gov/pub/irs-pdf/fw9.pdf).
+  - **Non-US based vendors and individuals** are required to follow these [instructions](https://www.irs.gov/instructions/iw8bene) and provide a completed [W-8BEN-E](https://www.irs.gov/pub/irs-pdf/fw8bene.pdf) form.
+
+
+### Process a request to cancel a vendor
+- Make the cancellation notification in accordance with the contract terms between Fleet and the vendor, typically these notifications are made via email and may have a specific address that notice must be sent to. If the vendor has an autorenew contract with Fleet there will often be a window of time in which Fleet can cancel, if notification is made after this time period Fleet may be obligated to pay for the subsequent year even if we don't use the vendor during the next contract term.  
+- Once cancelled, update the recurring expenses section of [The Numbers](https://docs.google.com/spreadsheets/d/1X-brkmUK7_Rgp7aq42drNcUg8ZipzEiS153uKZSabWc/edit#gid=2112277278) to reflect the cancellation by changing the projected monthly burn in column G to $0 and adding "CANCELLED" in front of the vendor's name in column C.
+
+
+### Update weekly KPIs
+- Create the weekly update issue from the template in ZenHub every Friday and update the [KPIs for finance](https://docs.google.com/spreadsheets/d/1Hso0LxqwrRVINCyW_n436bNHmoqhoLhC8bcbvLPOs9A/edit#gid=0) by 5pm US central time.
+
+
+## Rituals
+
+The following table lists this department's rituals, frequency, and Directly Responsible Individual (DRI).
+
+<rituals :rituals="rituals['handbook/finance/finance.rituals.yml']"></rituals>
+
+<!--
+Note: These are out of date, but retained for future reference.  TODO: Deal with them and delete them
+
+| Access revalidation | Quarterly | Review critical access groups to make sure they contain only relevant people. | Mike McNeil |
+| 550C update | Annually | File California 550C. | Mike McNeil |
+| TPA verifications | Quarterly | Every quarter before tax filing due dates, Mike McNeil audits state accounts to ensure TPA is set up or renewed. | Mike McNeil |
+| YubiKey adoption | Monthly | Track YubiKey adoption in Google workspace and follow up with those that aren't using it. | Mike McNeil |
+| Security policy update | Annually | Update security policies and have them approved by the CEO. | Nathanael Holliday |
+| Security notifications check | Daily | Check Slack, Google, Vanta, and Fleet dogfood for security-related notifications. | Nathanael Holliday |
+| Changeset for onboarding issue template | Quarterly | pull up the changeset in the onboarding issue template and send out a link to the diff to all team members by posting in Slack's `#general` channel. | Mike McNeil |
+| MDM device enrollment | Quarterly | Provide export of MDM enrolled devices to the ops team. | Luke Heath |
+-->
+
+#### Stubs
+The following stubs are included only to make links backward compatible.
+
+##### Secure company-issued equipment for a team member
+Please see [handbook/engineering#secure-company-issued-equipment-for-a-team-member](https://www.fleetdm.com/handbook/engineering#secure-company-issued-equipment-for-a-team-member).
+
+##### Register a domain for Fleet
+Please see [handbook/register-a-domain-for-fleet](https://www.fleetdm.com/handbook/engineering#register-a-domain-for-fleet).
+
+##### Updating personnel details
+Please see [handbook/engineering#update-personnel-details](https://www.fleetdm.com/handbook/engineering#update-personnel-details).
+
+##### Fix a laptop that's not checking in
+Please see [handbook/engineering#fix-a-laptop-thats-not-checking-in](https://www.fleetdm.com/handbook/engineering#fix-a-laptop-thats-not-checking-in)
+
+##### Enroll a macOS host in dogfood
+Please see [handbook/engineering#enroll-a-macos-host-in-dogfood](https://www.fleetdm.com/handbook/engineering#enroll-a-macos-host-in-dogfood)
+
+##### Enroll a Windows or Ubuntu Linux device in dogfood
+Please see [handbook/engineering#enroll-a-windows-or-ubuntu-linux-device-in-dogfood](https://www.fleetdm.com/handbook/engineering#enroll-a-windows-or-ubuntu-linux-device-in-dogfood)
+
+##### Enroll a ChromeOS device in dogfood
+Please see [handbook/engineering#enroll-a-chromeos-device-in-dogfood](https://www.fleetdm.com/handbook/engineering#enroll-a-chromeos-device-in-dogfood)
+
+##### Lock a macOS host in dogfood using fleetctl CLI tool
+Please see [handbook/engineering#lock-a-macos-host-in-dogfood-using-fleetctl-cli-tool](https://www.fleetdm.com/handbook/engineering#lock-a-macos-host-in-dogfood-using-fleetctl-cli-tool)
+
+##### Book an event
+Please see [handbook/engineering#book-an-event](https://www.fleetdm.com/handbook/engineering#book-an-event)
+
+##### Order SWAG
+Please see [handbook/engineering#order-swag](https://www.fleetdm.com/handbook/engineering#order-swag)
+
+
+<meta name="maintainedBy" value="jostableford">
+<meta name="title" value="💸 Finance">
diff --git a/handbook/business-operations/business-operations.rituals.yml b/handbook/finance/finance.rituals.yml
similarity index 57%
rename from handbook/business-operations/business-operations.rituals.yml
rename to handbook/finance/finance.rituals.yml
index e6df744a0a..c96c59ce80 100644
--- a/handbook/business-operations/business-operations.rituals.yml
+++ b/handbook/finance/finance.rituals.yml
@@ -3,40 +3,30 @@
   startedOn: "2024-02-12" 
   frequency: "Weekly"
   description: "At the start of every week, check the Salesforce reports for past due invoices, non-invoiced opportunities, and past due renewals.  Report findings to in the `#g-sales` channel." 
-  moreInfoUrl: "https://fleetdm.com/handbook/business-operations#communicate-the-status-of-customer-financial-actions"
+  moreInfoUrl: "https://fleetdm.com/handbook/finance#communicate-the-status-of-customer-financial-actions"
   dri: "ireedy" 
   autoIssue:   
-    labels: [ "#g-business-operations" ] 
+    labels: [ "#g-finance" ] 
     repo: "confidential"
 -
   task: "AP invoice monitoring"
   startedOn: "2024-04-01" 
   frequency: "Weekly"
   description: "Look for new accounts payable invoices and make sure that Fleet's suppliers are paid." 
-  moreInfoUrl: "https://fleetdm.com/handbook/business-operations#process-a-new-vendor-invoice"
+  moreInfoUrl: "https://fleetdm.com/handbook/finance#process-a-new-vendor-invoice"
   dri: "ireedy"
   autoIssue:   
-    labels: [ "#g-business-operations" ] 
-    repo: "confidential"
--    
-  task: "Inform managers about hours worked" 
-  startedOn: "2024-02-09" 
-  frequency: "Weekly" 
-  description: "Gather hours worked for anyone who gets paid hourly by Fleet, and get those hours approved by their manager." 
-  moreInfoUrl: "https://fleetdm.com/handbook/business-operations#inform-managers-about-hours-worked"
-  dri: "ireedy" 
-  autoIssue:   
-    labels: [ "#g-business-operations" ] 
+    labels: [ "#g-finance" ] 
     repo: "confidential"
 -
-  task: "KPI roundup + weekly update" 
+  task: "Complete Finance KPI inputs" 
   startedOn: "2024-02-16" 
   frequency: "Weekly"
-  description: "Create the weekly KPI issue, complete the BizOps update and ensure all other inputs are completed on time." 
-  moreInfoUrl: "https://fleetdm.com/handbook/business-operations#update-weekly-kpis"
-  dri: "hollidayn"
+  description: "Create the weekly team KPI issue, complete the finance update." 
+  moreInfoUrl: "https://fleetdm.com/handbook/finance#update-weekly-kpis"
+  dri: "ireedy"
   autoIssue:   
-    labels: [ "#g-business-operations" ] 
+    labels: [ "#g-finance" ] 
     repo: "confidential"
 -
   task: "Key review prep"
@@ -46,48 +36,48 @@
   moreInfoUrl: "https://fleetdm.com/handbook/company/leadership#key-reviews"
   dri: "jostableford"
   autoIssue:   
-    labels: [ "#g-business-operations" ] 
+    labels: [ "#g-finance" ] 
     repo: "confidential"
 -
   task: "Prioritize for next sprint" # Title that will actually show in rituals table
   startedOn: "2023-08-09" # Needs to align with frequency e.g. if frequency is every thrid Thursday startedOn === any third thursday
   frequency: "Triweekly" # must be supported by https://github.com/fleetdm/fleet/blob/dbbb501358e226fa3fdf48865175efe3334c826c/website/scripts/build-static-content.js
-  description: "Drag next sprint's priorities to the top of the 'Not yet' column." # example of a longer thing: description: "[Prioritizing next sprint](https://fleetdm.com/handbook/digital-experiencemunication)"
+  description: "Using your departmental kanban board, prioritize and finalize next sprint's goals for your team by draging the appropriate issues to the top of the 'Not yet' column." # example of a longer thing: description: "[Prioritizing next sprint](https://fleetdm.com/handbook/digital-experiencemunication)"
   moreInfoUrl: "https://fleetdm.com/handbook/company/why-this-way#why-make-work-visible" #URL used to highlight "description:" test in table
   dri: "jostableford" # DRI for ritual (assignee if autoIssue) (TODO display GitHub proflie pic instead of name or title)
   autoIssue:   # Enables automation of GitHub issues
-    labels: [ "#g-business-operations" ] # label to be applied to issue
+    labels: [ "#g-finance" ] # label to be applied to issue
     repo: "confidential" # The GitHub repo that issues will be created in
--
-  task: "Vanta check" # TODO tie this to a responsibility
-  startedOn: "2024-04-01" 
-  frequency: "Monthly"
-  description: "Look for any new actions in Vanta due in the upcoming months and create issues to ensure they're done on time." 
-  moreInfoUrl: 
-  dri: "jostableford"
-  autoIssue:   
-    labels: [ "#g-business-operations" ] 
-    repo: "confidential"
 -
   task: "Reconcile monthly recurring expenses" 
   startedOn: "2024-02-28" 
   frequency: "Monthly"
   description: "Each month, update the inputs in “The numbers” spreadsheet to reflect the actuals for recurring non-personnel spend, and identify any unexpected increase or decrease in spend." 
-  moreInfoUrl: "https://fleetdm.com/handbook/business-operations#reconcile-monthly-recurring-expenses"
+  moreInfoUrl: "https://fleetdm.com/handbook/finance#reconcile-monthly-recurring-expenses"
   dri: "jostableford" 
   autoIssue:   
-    labels: [ "#g-business-operations" ] 
+    labels: [ "#g-finance" ] 
     repo: "confidential"
 -
   task: "Monthly accounting"
   startedOn: "2024-02-28" 
   frequency: "Monthly"
   description: "Create the monthly close GitHub issue and walk through the steps. This process includes fulfilling the monthly reporting requirement for SVB." 
-  moreInfoUrl: "https://fleetdm.com/handbook/business-operations#process-monthly-accounting"
-  dri: "hollidayn" 
+  moreInfoUrl: "https://fleetdm.com/handbook/finance#process-monthly-accounting"
+  dri: "ireedy" 
   autoIssue:   
-    labels: [ "#g-business-operations" ] 
+    labels: [ "#g-finance" ] 
     repo: "confidential"
+-
+  task: "Run regular payroll" 
+  startedOn: "2024-02-24" 
+  frequency: "Monthly" 
+  description: "Verify auto-populated payroll for all full time employees is accurate, and approve for processing." 
+  moreInfoUrl: "https://fleetdm.com/handbook/finance#run-payroll"
+  dri: "jostableford" 
+  autoIssue:   
+    labels: [ "#g-finance" ] 
+    repo: "confidential" 
 -
   task: "Monthly mail review" # TODO tie this to a responsibility
   startedOn: "2024-04-15" 
@@ -96,86 +86,62 @@
   moreInfoUrl: null 
   dri: "ireedy"
   autoIssue:   
-    labels: [ "#g-business-operations" ] 
+    labels: [ "#g-finance" ] 
     repo: "confidential"
--
-  task: "Run regular payroll" 
-  startedOn: "2024-02-24" 
-  frequency: "Monthly" 
-  description: "Verify auto-populated payroll for all full time employees is accurate, and approve for processing." 
-  moreInfoUrl: "https://fleetdm.com/handbook/business-operations#run-payroll"
-  dri: "jostableford" 
-  autoIssue:   
-    labels: [ "#g-business-operations" ] 
-    repo: "confidential" 
 -
   task: "Run US contractor payroll" 
   startedOn: "2024-02-28" 
   frequency: "Monthly"
   description: "Manually process US contractor payroll by verifying and syncing time contractor worked, then processing payment." 
-  moreInfoUrl: "https://fleetdm.com/handbook/business-operations#run-us-contractor-payroll"
+  moreInfoUrl: "https://fleetdm.com/handbook/finance#run-us-contractor-payroll"
   dri: "jostableford" 
   autoIssue:   
-    labels: [ "#g-business-operations" ] 
+    labels: [ "#g-finance" ] 
     repo: "confidential" 
 -
   task: "Run US commission payroll" 
   startedOn: "2024-01-31" 
   frequency: "Monthly"
   description: "Verify closed-won deal amounts, use commission calculators to determine commissions owed, and process payroll." 
-  moreInfoUrl: "https://fleetdm.com/handbook/business-operations#run-us-commission-payroll"
+  moreInfoUrl: "https://fleetdm.com/handbook/finance#run-us-commission-payroll"
   dri: "jostableford" 
   autoIssue:   
-    labels: [ "#g-business-operations" ] 
+    labels: [ "#g-finance" ] 
     repo: "confidential"
--
-  task: "Recognize and benchmark workiversaries" 
-  startedOn: "2024-07-15" 
-  frequency: "Bimonthly"
-  description: "Identify workiversaries coming up in the next two months and follow the steps to ensure they're recognized and benchmarked" 
-  moreInfoUrl: "https://fleetdm.com/handbook/business-operations#recognize-employee-workiversaries"
-  dri: "ireedy" 
 -
   task: "Run bonus payroll" 
   startedOn: "2024-01-31" 
   frequency: "Quarterly"
   description: "Verify completion of any objective or outcome based bonus plans, and process payroll." 
-  moreInfoUrl: "https://fleetdm.com/handbook/business-operations#run-us-commission-payroll" # TODO update linked process and add a new process that captures MBO payment
+  moreInfoUrl: "https://fleetdm.com/handbook/finance#run-us-commission-payroll" # TODO update linked process and add a new process that captures MBO payment
   dri: "jostableford" 
 -
   task: "Review state filings for the previous quarter"
   startedOn: "2024-07-19" 
   frequency: "Quarterly"
   description: "Verify that state filings have been successfully submitted for the previous quarter" 
-  moreInfoUrl: "https://fleetdm.com/handbook/business-operations#review-state-employment-tax-filings-for-the-previous-quarter"
+  moreInfoUrl: "https://fleetdm.com/handbook/finance#review-state-employment-tax-filings-for-the-previous-quarter"
   dri: "ireedy" 
 -
   task: "Investor reporting" 
   startedOn: "2024-03-31" 
   frequency: "Quarterly"
   description: "Provide updated metrics for CRV in Chronograph." 
-  moreInfoUrl: "https://fleetdm.com/handbook/business-operations#report-quarterly-numbers-in-chronograph"
-  dri: "hollidayn"
+  moreInfoUrl: "https://fleetdm.com/handbook/finance#report-quarterly-numbers-in-chronograph"
+  dri: "ireedy"
 -
   task: "Quartlery finance check" 
   startedOn: "2024-03-31" 
   frequency: "Quarterly"
   description: "Every quarter, we check Quickbooks Online (QBO) for discrepancies and follow up with accounting providers for any quirks found." 
-  moreInfoUrl: "https://fleetdm.com/handbook/business-operations#check-finances-for-quirks"
+  moreInfoUrl: "https://fleetdm.com/handbook/finance#check-finances-for-quirks"
   dri: "jostableford"
--
-  task: "Quarterly grants" 
-  startedOn: "2024-02-01" 
-  frequency: "Quarterly"
-  description: "Create the equity grants GitHub issue and walk through the steps." 
-  moreInfoUrl: "https://fleetdm.com/handbook/business-operations#grant-equity"
-  dri: "hollidayn" 
 -
   task: "Deliver annual report for venture line" 
   startedOn: "2024-12-01" 
   frequency: "Annually"
   description: "Within 60 days of the new year, provide financial statements to SVB, along with board-approved projections for the new year" 
-  moreInfoUrl: "https://fleetdm.com/handbook/business-operations#deliver-annual-report-for-venture-line"
+  moreInfoUrl: "https://fleetdm.com/handbook/finance#deliver-annual-report-for-venture-line"
   dri: "jostableford"
 -
   task: "Tax preparation" # TODO tie this to a responsibility
@@ -183,4 +149,4 @@
   frequency: "Annually"
   description: "Provide information to tax team with Deloitte and assist with filing and paying state and federal returns" 
   moreInfoUrl: 
-  dri: "hollidayn"
+  dri: "jostableford"
diff --git a/handbook/product-design/README.md b/handbook/product-design/README.md
index af31d259ee..2044bde60c 100644
--- a/handbook/product-design/README.md
+++ b/handbook/product-design/README.md
@@ -1,78 +1,85 @@
 # Product Design
+
 This handbook page details processes specific to working [with](#contact-us) and [within](#responsibilities) this department.
 
+
 ## Team
+
 | Role                             | Contributor(s)           |
 |:---------------------------------|:-----------------------------------------------------------------------------------------------------------|
 | Head of Product Design           | [Noah Talerman](https://www.linkedin.com/in/noah-talerman/) _([@noahtalerman](https://github.com/noahtalerman))_
 | Product Designer                 | <sup><sub>_See [🛩️ Product groups](https://fleetdm.com/handbook/company/product-groups#current-product-groups)_ </sup></sub>
 
+
 ## Contact us
+
 - To **make a request** of this department, [create an issue](https://github.com/fleetdm/confidential/issues/new?labels=%3Aproduct&title=Product%20design%20request%C2%BB______________________&template=custom-request.md) and a team member will get back to you within one business day (If urgent, mention a [team member](#team) in `#help-design`.
   - Please **use issue comments and GitHub mentions** to communicate follow-ups or answer questions related to your request.
-  - Any Fleet team member can [view the kanban board](https://app.zenhub.com/workspaces/-g-digital-experience-6451748b4eb15200131d4bab/board?sprints=none) for this department, including pending tasks and the status of new requests.
+  - Any Fleet team member can [view the kanban board](https://app.zenhub.com/workspaces/-g-digital-experience-6451748b4eb15200131d4bab/board) for this department, including pending tasks and the status of new requests.
+
 
 ## Responsibilities
+
 The Product Design department is responsible for reviewing and collecting feedback from users, would-be users, and future users, prioritizing changes, designing the changes, and delivering these changes to the engineering team. Product Design prioritizes and shapes all changes involving functionality or usage, including the UI, REST API, command line, and webhooks. 
 
-### Release relavent Figma files
-- Once your designs are reviewed and approved, change the status on the cover page of the relevant Figma file and move the issue to the "Settled" column.
-- After each release (every 3 weeks) make sure you change the status on the cover page of the relevant Figma files that you worked on during the sprint to "Released".
 
->**Questions and missing information:** Take a screenshot of the area in Figma and add a comment in the story's GitHub issue. Figma does have a commenting system, but it is not easy to search for outstanding concerns and is therefore not preferred.
->
->For external contributors: please consider opening an issue with reference screenshots if you have a Figma related question you need to resolve.
+### Drafting
 
-### Create a new Figma file
 At Fleet, like [GitLab](https://about.gitlab.com/handbook/product-development-flow/#but-wait-isnt-this-waterfall) and [other organizations](https://speakerdeck.com/mikermcneil/i-love-apis), every change to the product's UI gets [wireframed first](https://fleetdm.com/handbook/company/why-this-way#why-do-we-use-a-wireframe-first-approach).
 
-- Take the top user story that is assigned to you in the "Prioritized" column of the [drafting board](https://app.zenhub.com/workspaces/-product-backlog-coming-soon-6192dd66ea2562000faea25c/board).
+- Take the top user story that is assigned to you in the "Ready" column of the [drafting board](https://app.zenhub.com/workspaces/-product-backlog-coming-soon-6192dd66ea2562000faea25c/board) and move it to "In progress."
   
-- Create a new file inside the [Fleet product](https://www.figma.com/files/project/17318630/%F0%9F%94%9C%F0%9F%93%A6-Fleet-EE%C2%AE-(product)?fuid=1234929285759903870) Figma project. See [Working with Figma](https://fleetdm.com/handbook/product#working-with-figma) below for more details.
-  
-- Use dev notes (component available in our library) to highlight important information to engineers and other teammates.
+- Create a new file inside the [Fleet product](https://www.figma.com/files/project/17318630/%F0%9F%94%9C%F0%9F%93%A6-Fleet-EE%C2%AE-(product)?fuid=1234929285759903870) Figma project by duplicating "\[TEMPLATE\] Starter file" (pinned to the top of the project).
+
+- The starter file includes 3 predefined pages: Cover, Ready, and Scratchpad.
+  -  **Cover.** This page has a component with issue number, issue name, and status fields. There are 3 statuses: Work in progress, Approved, and Released (the main source of truth is still the drafting board).
+  -  **Ready.** Use this page to communicate designs reviews and development.
+  -  **Scratchpad.** Use this page for work in progress and design that might be useful in the future.
+
+- If the story requires API or YAML file changes, open a pull request to the reference docs release branch (e.g. `docs-v4.58.0`) with the proposed design. Mark the PR ready for review as soon as it's ready for feedback from the [API design DRI](https://fleetdm.com/handbook/company/communications#directly-responsible-individuals-dris).
+
+- Add links to the user story as specified in the [issue template](https://github.com/fleetdm/fleet/issues/new?template=story.md).
 
 - Draft changes to the Fleet product that solve the problem specified in the story. Constantly place yourself in the shoes of a user while drafting changes. Place these drafts in the appropriate Figma file in Fleet product project.
 
+- Use dev notes (component available in our library) to highlight important information to engineers and other teammates.
+
+- To help contributors find Figma wireframes for the area of the UI you're making changes to, add page names (ex. Host details page) to the user story's title and/or description.
+
 - Be intentional about changes to design components (e.g. button border-radius or modal width) because these are expensive. They'll require code changes and QA in multiple parts of the product. Propose changes to a design component as part of an already-prioritized user story instead of [making a new request](#making-a-request) in 🎁🗣 Feature Fest.
 
-- While drafting, reach out to sales, customer success, and demand for a business perspective.
+- Reach out to sales, customer success, and demand for a business perspective.
 
-- While drafting, engage engineering to gain insight into technical costs and feasibility.
+- Engage engineering to gain insight into technical costs and feasibility.
 
-When starting a new draft:
-- Create a new file inside the [Fleet product](https://www.figma.com/files/project/17318630/%F0%9F%94%9C%F0%9F%93%A6-Fleet-EE%C2%AE-(product)?fuid=1234929285759903870) project by duplicating "\[TEMPLATE\] Starter file" (pinned to the top of the project).
-- Right-click on the duplicated file, select "Share", and ensure **anyone with the link** can view the file.
-- Rename each Figma file to include the number and name of the corresponding issue on the [drafting board](https://app.zenhub.com/workspaces/-product-backlog-coming-soon-6192dd66ea2562000faea25c/board). (e.g. # 11766 Instructions for Autopilot enrollment).
-- The starter file includes 3 predefined pages: Cover, Ready, and Scratchpad.
-    -  **Cover.** This page has a component with issue number, issue name, and status fields. There are 3 statuses: Work in progress, Approved, and Released (the main source of truth is still the drafting board).
-    -  **Ready.** Use this page to communicate designs reviews and development.
-    -  **Scratchpad.** Use this page for work in progress and design that might be useful in the future.
-- If the story requires API changes, open a draft PR with the proposed API design.
-    - These draft PRs are not actually merged, since they're often created weeks ahead of implementation and can artificially affect our PR open time KPI. Instead, once the documentation changes are ready for final review, the designer closes the draft PR and opens a fresh PR from the same branch.
-      
-### Schedule a design review
-- Prepare your draft in the user story issue.
-- Prepare the agenda for your design review meeting, which should be an empty document other than the proposed changes you will present.
-- Review the draft with the CEO at one of the daily design review meetings, or schedule an ad-hoc design review if you need to move faster.  (Efficient access to design reviews on-demand [is a priority for Fleet's CEO](https://fleetdm.com/handbook/company/ceo). Emphasizing design helps us live our [empathy](https://fleetdm.com/handbook/company#empathy) value.)
-- When introducing a story, clarify which review "mode" the CEO should operate in:
-  + **Final review** mode — you are 70% sure the design is 100% done.
-  + **Feedback** mode — you know the design is not ready for final review, but would like to get early feedback. Before bringing something in feedback mode consider whether the CEO will be best for giving feedback or if it would be better suited for someone else (engineer or PM).
-- During the review meeting, take detailed notes of any feedback on the draft.
-- Address the feedback by modifying your draft.
-- Rinse and repeat at subsequent sessions until there is no more feedback.
+- If the story has a requester and the title and/or description change during drafting (scope change), notify the requester. The customer DRI should confirm that the updated scope still meets the requester's needs.
+
+>**Questions, missing information, and notes:** Take a screenshot of the area in Figma and add a comment in the story's GitHub issue. Figma does have a commenting system, but it is not easy to search for outstanding concerns and is therefore not preferred. Also, commenting in Figma, sends all contributors email notifications.
+>
+>For external contributors: please consider opening an issue with reference screenshots if you have a Figma related question you need to resolve.
+
+### Prepare for design review
+
+1. Link to your draft in the user story issue.
+2. Add the user story to the agenda for the [design review](https://fleetdm.com/handbook/company/product-groups#design-reviews) meeting.
+3. Attend design review or schedule an ad-hoc design review if you need to move faster.
 
 > As drafting occurs, inevitably, the requirements will change. The main description of the issue should be the single source of truth for the problem to be solved and the required outcome. The product manager is responsible for keeping the main description of the issue up-to-date. Comments and other items can and should be kept in the issue for historical record-keeping.
 
+
 ### Ensure story drafting is complete
-<!--TODO update responsibility to reflect reality (e.g. line 75 == "Bugs board"?)-->
-Once a story has gone through design and is considered "Settled", it moves to the "Settled" column on the drafting board and assign to the Engineering Manager (EM).
 
-Before assigning an EM to [estimate](https://fleetdm.com/handbook/engineering#sprint-ceremonies) a user story, the product designer ensures the product section of the user story [checklist](https://github.com/fleetdm/fleet/issues/new?assignees=&labels=story&projects=&template=story.md&title=) is complete. 
+Once a story is approved in [design review](https://fleetdm.com/handbook/company/product-groups#design-reviews), the Product Designer is responsible for moving the user story to the "Ready to spec" column, assigning the appropriate Engineering Manager (EM), adding a product group label, and changing the status on the cover page of the relevant Figma file to "Approved".
+
+The EM is responsible for moving the user story to the "Specified" and "Estimated" columns.
+
+Before assigning an EM, double-check that the "Product" section of the user story [checklist](https://github.com/fleetdm/fleet/issues/new?assignees=&labels=story&projects=&template=story.md&title=) is complete (no TODOs). 
+
+Once a bug is approved in design review, The Product Designer is responsible for moving the bug to the appropriate release board.
 
-Once a bug has gone through design and is considered "Settled", the designer removes the `:product` label and moves the issue to the 'Sprint backlog' column on the "Bugs" board and assigns the group engineering manager. 
 
 ### Revise a draft currently in development
+
 Expedited drafting is the revision of drafted changes currently being developed by
 the engineering team. Expedited drafting aims to quickly adapt to unknown edge cases and
 changing specifications while ensuring that Fleet meets our brand and quality guidelines. 
@@ -80,61 +87,32 @@ changing specifications while ensuring that Fleet meets our brand and quality gu
 You'll know it's time for expedited drafting when:
 - The team discovers that a drafted user story is missing crucial information that prevents contributors from continuing the development task.
 - A user story is taking more effort than was originally estimated, and Product Manager wants to find ways to cut aspects of planned functionality in order to still ship the improvement in the currently scheduled release.
-- A user story on the drafting board won't reach "Settled" by the last estimation session in the current sprint and cannot wait until the next sprint. This can also happen when we decide to bring a user story in mid-sprint.
+- A user story on the drafting board won't reach "Ready for spec" by the last estimation session in the current sprint and cannot wait until the next sprint. This can also happen when we decide to bring a user story in mid-sprint.
 
 What happens during expedited drafting?
-1. If the user story wasn't "Settled" by the last estimation session, the product group's engineering manager (EM), [release DRI](https://fleetdm.com/handbook/company/communications#directly-responsible-individuals-dris), and Head of Product Design are notified in `#g-mdm` or `#g-endpoint-ops`. Decision to allow the user story to make it into the sprint is up to the release DRI.
-2. If the user story is already in the sprint, the EM, release DRI, and Head of Product Design are notified in `#g-mdm` or `#g-endpoint-ops`. If there are significant changes to the requirements, then the user story might be pushed to the next sprint. Decision is up to the release DRI.
-3. If the release DRI decides the user story will be worked on this sprint, drafts are updated or finished.
-4. UI changes [are approved](https://fleetdm.com/handbook/company/development-groups#drafting-process), and the UI changes are brought back into the sprint or are estimated.
+1. If the story has a requester, notify the requester. The customer DRI should confirm that the updated scope still meets the requester's need.
+2. If the user story wasn't "Ready for spec" by the last estimation session, the product group's engineering manager (EM), [release DRI](https://fleetdm.com/handbook/company/communications#directly-responsible-individuals-dris), and Head of Product Design are notified in the `#g-mdm` or `#g-endpoint-ops` Slack channel. Decision to allow the user story to make it into the sprint is up to the release DRI.
+3. If the user story is already in the sprint, the EM, release DRI, and Head of Product Design are notified in the `#g-mdm` or `#g-endpoint-ops` channel. If there are significant changes to the requirements, then the user story might be pushed to the next sprint. Decision is up to the release DRI.
+4. If the release DRI decides the user story will be worked on this sprint, drafts are updated or finished.
+5. UI changes [are approved](https://fleetdm.com/handbook/company/development-groups#drafting-process), and the UI changes are brought back into the sprint or are estimated.
 
-### Correctly prioritize a bug
-Bugs are always prioritized. (Fleet takes quality and stability [very seriously](https://fleetdm.com/handbook/company/why-this-way#why-spend-so-much-energy-responding-to-every-potential-production-incident).) Bugs should be prioritized in the following order:
-1. Quality: product does what it's supposed to (what is documented).
-2. Common-sense user criticality: If no one can load any page, that's obviously important.
-3. Age of bugs: Long-open bugs are open wounds bleeding quality out of the product.  They must be closed quickly.
-4. Customer criticality: How important it is to a customer use case.
-
-
-If a bug is unreleased or [critical](https://fleetdm.com/handbook/engineering#critical-bugs), it is addressed in the current sprint. Otherwise, it may be prioritized and estimated for the next sprint. If a bug [requires drafting](https://fleetdm.com/handbook/engineering#in-product-drafting-as-needed) to determine the expected functionality, the bug should undergo [expedited drafting](#expedited-drafting). 
-
-If a bug is not addressed within six weeks, it is [sent to the product team for triage](https://fleetdm.com/handbook/engineering#in-engineering). Each sprint, the Head of Product Design reviews these bugs. Bugs are categorized as follows:
-- **Schedule**: the bug should be prioritized in the next sprint if there's engineering capacity for it.
-- **De-prioritized**: the issue will be closed and the necessary subsequent steps will be initiated. This might include updating documentation and informing the community.
-
-The Head of Product Design meets with the Director of Product Development to discuss and finalize the outcomes for the churned bugs.
-
-After aligning with the Director of Product Development on the outcomes, The Head of Product Design will clean up churned bugs. Below are the steps for each category:
-- **Schedule**: Remove the `:product` label, move the bug ticket to the 'Sprint backlog' column on the bug board, and assign it to the appropriate group's Engineering Manager so that it can be prioritized into the sprint backlog.
-- **De-prioritized**: The Head of Product Design should close the issue and, as the DRI, ensure all follow-up actions are finalized.
 
 ### Write a user story
+
 Product Managers [write user stories](https://fleetdm.com/handbook/company/product-groups#writing-a-good-user-story) in the [drafting board](https://app.zenhub.com/workspaces/-product-backlog-coming-soon-6192dd66ea2562000faea25c/board). The drafting board is shared by every [product group](https://fleetdm.com/handbook/company/development-groups).
 
+
 ### Draft a user story
+
 Product Designers [draft user stories](https://fleetdm.com/handbook/company/product-groups#drafting) that have been prioritized by PMs. If the estimated user stories for a product group exceed [that group's capacity](https://fleetdm.com/handbook/company/product-groups#current-product-groups), all new design work for that group is paused, and the designer will contribute in other ways (documentation & handbook work, Figma maintenance, QA, etc.) until the PM deprioritizes estimated stories to make room, or until the next sprint begins. (If the designer has existing work-in-progress, they will continue to review and iterate on those designs and see the stories through to estimation.)
 
 If an issue's title or user story summary (_"as a…I want to…so that"_) does not match the intended change being discussed, the designer will move the issue to the "Needs clarity" column of the drafting board and assign the group product manager.  The group product manager will revisit ASAP and edit the issue title and user story summary, then reassign the designer and move the issue back to the "Prioritized" column.
 
 Engineering Managers estimate user stories.  They are responsible for delivering planned work in the current sprint (0-3 weeks) while quickly getting user stories estimated for the next sprint (3-6 weeks).  Only work that is slated to be released into the hands of users within ≤six weeks will be estimated. Estimation is run by each group's Engineering Manager and occurs on the [drafting board](https://app.zenhub.com/workspaces/-product-backlog-coming-soon-6192dd66ea2562000faea25c/board).
 
-### Rank features before release
-These measures exist to keep all contributors (including other departments besides engineering and product) up to date with improvements and changes to the Fleet product.  This helps folks plan and communicate with customers and users more effectively.
-
-After the kickoff of a product sprint, the demand and product teams decide which improvements are most important to highlight in this release, whether that's through social media "drumbeat" tweets, collaboration with partners, or emphasized [content blocks](https://about.gitlab.com/handbook/marketing/blog/release-posts/#3rd-to-10th) within the release blog post.
-
-When an improvement gets scheduled for release, the Head of Product sets its "echelon" to determine the emphasis the company will place on it. This leveling is based on the improvement's desirability and timeliness, and will affect demand effort for the feature.
-
-- **Echelon 1: A major product feature announcement.** The most important release types, these require a specific and custom demand package. Usually including an individual blog post, a demo video and potentially a press release or official product demand launch. There is a maximum of one _echelon 1_ product announcement per release sprint.
-- **Echelon 2: A highlighted feature in the release notes.** This product feature will be highlighted at the top of the Sprint Release blog post. Depending on the feature specifics this will include: a 1-2 paragraph write-up of the feature, a demo video (if applicable) and a link to the docs. Ideally there would be no more than three _echelon 2_ features in a release post, otherwise the top features will be crowded.
-- **Echelon 3: A notable feature to mention in the [changelog](https://github.com/fleetdm/fleet/blob/main/CHANGELOG.md)**. Most product improvements fit into this echelon. This includes 1-2 sentences in the changelog and [release blog post](https://fleetdm.com/releases).
-
-### Create release issue
-Before each release, the Head of Product [creates a "Release" issue](https://github.com/fleetdm/confidential/issues/new/choose), which includes a list of all improvements included in the upcoming release.  Each improvement links to the relevant bug or user story issue on GitHub so it is easy to read the related discussion and history.
-
-The product team is responsible for providing the demand team with the necessary information for writing the release blog post. Every three weeks after the sprint is kicked off, the product team meets with the relevant demand team members to go over the features for that sprint and recommend items to highlight as _echelon 2_ features and provide relevant context for other features to help demand decide which features to highlight.
 
 ### Consider a feature eligible to be flagged
+
 At Fleet, features are placed behind feature flags if the changes could affect Fleet's availability of existing functionalities. The following highlights should be considered when deciding if we should leverage feature flags:
 
 - The feature flag must be disabled by default.
@@ -146,19 +124,9 @@ At Fleet, features are placed behind feature flags if the changes could affect F
 
 > Fleet's feature flag guidelines is borrowed from GitLab's ["When to use feature flags" section](https://about.gitlab.com/handbook/product-development-flow/feature-flag-lifecycle/#when-to-use-feature-flags) of their handbook. Check out [GitLab's "Feature flags only when needed" video](https://www.youtube.com/watch?v=DQaGqyolOd8) for an explanation of the costs of introducing feature flags.
 
-### Consider promoting a feature as "beta"
-At Fleet, features are advertised as "beta" if there are concerns that the feature may not work as intended in certain Fleet
-deployments. For example, these concerns could be related to the feature's performance in Fleet
-deployments with hundreds of thousands of hosts.
-
-The following highlights should be considered when deciding if we promote a feature as "beta:"
-
-- The feature will not be advertised as "beta" permanently. This means that the Directly
-  Responsible Individual (DRI) who decides a feature is advertised as "beta" is also responsible for creating an issue that
-  explains why the feature is advertised as "beta" and tracking the feature's progress towards advertising the feature as "stable."
-- The feature will be advertised as "beta" in the documentation on fleetdm.com/docs, release notes, release blog posts, and Twitter.
 
 ### View Fleet usage statistics
+
 In order to understand the usage of the Fleet product, we [collect statistics](https://fleetdm.com/docs/using-fleet/usage-statistics) from installations where this functionality is enabled.
 
 Fleeties can view these statistics in the Google spreadsheet [Fleet
@@ -252,9 +220,6 @@ Please see [handbook/product#create-release-issue](https://fleetdm.com/handbook/
 ##### Feature flags
 Please see [handbook/product#consider-a-feature-eligible-to-be-flagged](https://fleetdm.com/handbook/product#consider-a-feature-eligible-to-be-flagged)
 
-##### Beta features
-Please see [handbook/product#consider-promoting-a-feature-as-beta](https://fleetdm.com/handbook/product#consider-promoting-a-feature-as-beta)
-
 ##### Feature fest
 Please see [handbook/product-groups#feature-fest](https://fleetdm.com/handbook/product-groups#feature-fest)
 
@@ -275,5 +240,11 @@ Please see [handbook/product-groups#after-the-feature-is-accepted](https://fleet
 ##### Restart Algolia manually
 Please see [handbook/digital-experience#restart-algolia-manually](https://fleetdm.com/handbook/digital-experience#restart-algolia-manually)
 
+##### Schedule a design review
+Please see [handbook/product#prepare-for-design-review](https://fleetdm.com/handbook/product#prepare-for-design-review)
+
+##### Create a new Figma file
+Please see [handbook/product#drafting](https://fleetdm.com/handbook/product#drafting)
+
 <meta name="maintainedBy" value="noahtalerman">
 <meta name="title" value="🦢 Product design">
diff --git a/handbook/product-design/product-design.rituals.yml b/handbook/product-design/product-design.rituals.yml
index c72a9a6207..b32f5406fe 100644
--- a/handbook/product-design/product-design.rituals.yml
+++ b/handbook/product-design/product-design.rituals.yml
@@ -16,7 +16,7 @@
   task: "Design sprint kickoff" # 2024-03-06 TODO: Link to responsibility or corresponding "how to" info e.g. https://fleetdm.com/handbook/company/product-groups#making-changes
   startedOn: "2024-03-07" 
   frequency: "Triweekly" 
-  description: "Add stories prioritized during Feature fest to Drafting board, assign stories to product designers, and align on priorities." 
+  description: "Add stories prioritized during Feature fest to Drafting board, assign stories to product designers, create upcoming reference docs release branch, and align on priorities." 
   moreInfoUrl: 
   dri: "noahtalerman"
 -
@@ -30,7 +30,7 @@
   task: "🦢🗣 Design review"
   startedOn: "2024-03-07" 
   frequency: "Daily" 
-  description: "Contributors present wireframes (UI changes) that are “Ready for review”. Head of Product Design provides feedback on UI/CLI/API changes." 
+  description: "On Mondays, contributors present wireframes in 'Feedback' mode and anyone can give feedback. 'Final review' mode during all other days and only Head of Product Design + CTO + Product Designers give feedback." 
   moreInfoUrl: "https://fleetdm.com/handbook/company/product-groups#design-reviews" 
   dri: "noahtalerman"
 -
@@ -67,10 +67,3 @@
   frequency: "Triweekly"
   description: "Discuss what stories weren't completed in the previous sprint. Record the number of stories in KPIs. Align on priorities for upcoming sprint."
   dri: "noahtalerman"
--
-  task: "🦢🗣 Apple MDM maturity review"
-  startedOn: "2024-07-29" 
-  frequency: "Weekly" 
-  description: "Review stories in the “In review“ column on the drafting board with the “~apple-mdm-maturity“ label. Would this be usable for an IT admin and how does it compare to Jamf?" 
-  moreInfoUrl: 
-  dri: "noahtalerman"
diff --git a/handbook/sales/README.md b/handbook/sales/README.md
index 9c86735f5d..c27cbc8785 100644
--- a/handbook/sales/README.md
+++ b/handbook/sales/README.md
@@ -8,7 +8,7 @@ This handbook page details processes specific to working [with](#contact-us) and
 | Role                                  | Contributor(s)           |
 |:--------------------------------------|:------------------------------------------------------------------------------------------------------------------------|
 | Chief Revenue Officer (CRO)                  | [Alex Mitchell](https://www.linkedin.com/in/alexandercmitchell/) _([@alexmitchelliii](https://github.com/alexmitchelliii))_
-| Solutions Consulting (SC)                    | [Dave Herder](https://www.linkedin.com/in/daveherder/) _([@dherder](https://github.com/dherder))_ <br> [Zach Wasserman](https://www.linkedin.com/in/zacharywasserman/) _([@zwass](https://github.com/zwass))_
+| Solutions Consulting (SC)                    | [Dave Herder](https://www.linkedin.com/in/daveherder/) _([@dherder](https://github.com/dherder))_ <br> [Zach Wasserman](https://www.linkedin.com/in/zacharywasserman/) _([@zwass](https://github.com/zwass))_ <br> [Allen Houchins](https://www.linkedin.com/in/allenhouchins/) _([@allenhouchins](https://github.com/allenhouchins))_ <br> [Harrison Ravazzolo](https://www.linkedin.com/in/harrison-ravazzolo/) _([@harrisonravazzolo](https://github.com/harrisonravazzolo))_
 | Channel Sales                                | [Tom Ostertag](https://www.linkedin.com/in/tom-ostertag-77212791/) _([@tomostertag](https://github.com/TomOstertag))_
 | Account Executive (AE)                       | [Patricia Ambrus](https://www.linkedin.com/in/pambrus/) _([@ambrusps](https://github.com/ambrusps))_ <br> [Anthony Snyder](https://www.linkedin.com/in/anthonysnyder8/) _([@anthonysnyder8](https://github.com/AnthonySnyder8))_ <br> [Paul Tardif](https://www.linkedin.com/in/paul-t-750833/) _([@phtardif1](https://github.com/phtardif1))_
 
@@ -25,6 +25,13 @@ This handbook page details processes specific to working [with](#contact-us) and
 The Sales department is directly responsible for attaining the revenue goals of Fleet and helping to deliver upon our customers' objectives.
 
 
+### Track an objection
+
+We often hear objections to using Fleet that are important to track, understand, and solve for. To track an objection:
+1. Navigate to the ["Understanding objections document" (Confidential Google Doc)](https://docs.google.com/document/d/1UFjHaIBdoSGDiqNqwgxRdwRz9Wn9SqP7h-g2OM8Runk/edit).
+2. Copy the template at the top of the page and paste it at the top of the "Objections" section completing all TODOs.
+
+
 ### Onboard a new sales team member
 
 Once the standard Fleetie onboarding issue is complete, create a new ["Sales team onboarding"](https://github.com/fleetdm/confidential/issues/new?assignees=&labels=%23g-sales&projects=&template=sales-team-onboarding.md&title=Sales%20onboarding%3A_____________) issue and complete it.
@@ -34,12 +41,12 @@ Once the standard Fleetie onboarding issue is complete, create a new ["Sales tea
 
 During the buying cycle, the champion will need to start the process to secure funding in cooperation with the economic buyer and the finance org.
 
-All quotes and purchase orders must be approved by CRO before being sent to the prospect or customer. Often, the CRO will request Fleet business operations/legal of any unique terms required.
+All quotes and purchase orders must be approved by CRO before being sent to the prospect or customer. Often, the CRO will request legal review of any unique terms required.
 
 The Fleet owner of the opportunity (usually AE or CSM) will prepare a quote and/or a Purchase Order when requested.
 - Because the champion may need to socialize "what is Fleet" or "what are we getting when buying Fleet," it is most often best to send the quote in [slide form](https://docs.google.com/presentation/d/15kbqm0OYPf1OmmTZvDp4F7VvMERnX4K6TMYqCYNr-wI/edit?usp=sharing).
 - Docusign can be used to create a [standard Purchase Order](https://www.loom.com/share/Loom-Message-16-January-2023-2ba8cf195ec645ebabac267d7df59823?sid=214f8c6b-beb3-427a-a3a8-e8c20b5dc350) if no special terms or pricing are needed.
-- Before sending to prospect, work with the Business operations team to verify if sales tax needs to be charged and, if so, how much.
+- Before sending to prospect, work with the Finance team to verify if sales tax needs to be charged and, if so, how much.
 
 
 ### Obtain a copy of Fleet's W-9
@@ -51,7 +58,9 @@ A recent signed copy of Fleet's W-9 form can be found in [this confidential PDF
 
 For customers with large deployments, Fleet accepts payment via wire transfer or electronic debit (ACH/SWIFT).
 
-Provide remittance information to customers by exporting ["💸 Paying Fleet"](https://docs.google.com/document/d/1KP_-x9c1x3sS1X9Q8Wlib2H7tq69xRONn1KMA3nVFQc/edit) into a PDF, then sending that to the prospect.
+Payment information for customers within the United States is on Fleet's invoices. Typically, payment information does not need to be sent separately.
+
+For Fleet customers outside of the United States or instances where a customer is requesting payment information prior to invoicing, provide remittance information to customers by exporting ["💸 Paying Fleet"](https://docs.google.com/document/d/1KP_-x9c1x3sS1X9Q8Wlib2H7tq69xRONn1KMA3nVFQc/edit) into a PDF, then sending that to the prospect.
 
 
 ### Review rep activity
@@ -59,10 +68,21 @@ Provide remittance information to customers by exporting ["💸 Paying Fleet"](h
 Following up with people interested in Fleet is an important part of finding out whether or not they'd like to continue the process of buying the product.  It is also very important not to be annoying.  At Fleet, team members follow up with people, but not too often.
 
 To help coach reps and avoid being annoying to Fleet users, Fleet reviews rep activity on a regular basis following these steps:
-1. In Salesforce, visit the activity report on your dashboard.  (TODO: taylor will replace this and/or link it)
+1. In Salesforce, visit the activity report on your dashboard.
 2. For each rep, review recent activity from the last 30 days across all of that rep's accounts.
 3. If outreach is too frequent or doesn't fit the company's strategy, then set up a 30 minute coaching session to discuss with the rep.
 
+Every week, AEs will review the status of all qualified opportunities with leadership in an opportunity pipeline review meeting. For this meeting, reps will:
+1. Update the following information in Salesforce for every opp:
+  - Contacts (and Roles)
+  - Amount
+  - Close date
+  - Stage
+  - Next steps
+2. Make sure all contacts have been sent a connection request from Mike McNeil.
+3. Identify and discuss where gaps are in [MEDDPICC](https://handbook.gitlab.com/handbook/sales/meddppicc/).
+4. Relay how many meetings they had with attendees from both IT and security this week.
+
 
 ### Validate Salesforce data (RevOps) 
 
@@ -123,6 +143,25 @@ To schedule an [ad hoc meeting](https://www.vocabulary.com/dictionary/ad%20hoc)
  - Ensure that the product category is defined ("Endpoint ops", "Device management", or "Vulnerability management") in the description of the issue.
 
 
+### Conduct a POV
+
+We use the "tech eval test plan" as a guide when conducting a "POV" (Proof of Value) with a prospect. This planning helps us avoid costly detours that can take a long time, and result in folks getting lost. The tech eval test plan is the main document that will track success criteria for the tech eval. Before the Solutions Consultant (SC) creates a [tech eval issue](https://github.com/fleetdm/confidential/issues/new?assignees=dherder&labels=%23g-sales&projects=&template=technical-evaluation.md&title=Technical+evaluation%3A+___________________), the AE and SC will ask each other, at minimum, the following questions in order to enter the "Stage 3 - Requested POV" phase for the tech eval:
+1. Do we have a well-defined set of technical criteria to test?
+2. Do we have a timeline agreed upon?
+3. What are the key business outcomes that will be verified as a result of completing the tech eval?
+
+If the above questions cannot be answered, the opportunity should not progress to tech eval. Once the opportunity moves to the "Stage 3 - Requested POV" phase in Salesforce, automation will generate the tech eval test plan. This doc will exist in Google Drive> Sales> Opportunities> "Account Name". 
+
+Once there is agreement to proceed with the tech eval and success criteria have been defined and documented, follow this process:
+1. SC creates a [tech eval issue](https://github.com/fleetdm/confidential/issues/new?assignees=dherder&labels=%23g-sales&projects=&template=technical-evaluation.md&title=Technical+evaluation%3A+___________________).
+2. SC updates the issue labels to include: "~sc, :tech-eval" and the obfuscated "prospect-codename" label. See [Assign a customer a codename](https://fleetdm.com/handbook/customer-success#assign-a-customer-codename). Instead of
+   "customer-codename", prospects are labeled "prospect-codename". When a prospect purchases Fleet, the SC will edit this label from "prospect-codename" to "customer-codename".
+3. SC sets the appropriate sprint duration based on the defined timelines and an estimation of effort in points.
+4. SC converts the issue to an Epic. All issues related to this prospect tech eval (ie: cloud instance deployments, etc.) should be added to the newly created epic.
+5. All check-in meetings and notes taken are documented in the tech eval test plan document. Any TODO item will be added as a comment to the tech eval issue epic.
+6. The SC presents the tech eval test plan and feature tracker used for the tech eval to the CS team upon the prospect's transition to Fleet customer.
+
+
 ### Hand off a technical evaluation to a temporary DRI
 
 Tech evals will have a DRI at all times; should the DRI be unavailable (ie: vacation), a hand off process to a temporary DRI will be required. In advance of vacation time (target one week in advance), refer to the following examples and review with each individual that will act as the temporary DRI for the technical evaluation while you are away. This can be documented as a google doc or can be added to the relevant tech eval epic issue in github.
@@ -179,7 +218,7 @@ Temp Transfer to: Temp technical DRI
 1. If a customer has no objections to using Fleet's NDA, route the NDA to them for signature using the "🙊 NDA (Non-disclosure agreement)" template in [DocuSign](https://apps.docusign.com/send/home).
 > If a customer would like to review the NDA first, download a .docx of [Fleet's NDA](https://docs.google.com/document/d/1gQCrF3silBFG9dJgyCvpmLa6hPhX_T4V7pL3XAwgqEU/edit?usp=sharing) and send it to the customer.
 2. If the customer has no objections, route the NDA using the template in DocuSign (do not upload and use the copy you emailed to the customer).
-3. If the customer "redlines" (i.e. wants to change) the NDA, follow the [contract review process](https://fleetdm.com/handbook/company/communications#getting-a-contract-reviewed) so that BizOps can look over any proposed changes and provide guidance on how to proceed.
+3. If the customer "redlines" (i.e. wants to change) the NDA, follow the [contract review process](https://fleetdm.com/handbook/company/communications#getting-a-contract-reviewed) so that Digital Experience can look over any proposed changes and provide guidance on how to proceed.
 
 
 ### Create a customer agreement
@@ -192,12 +231,12 @@ Temp Transfer to: Temp technical DRI
 
 - **Standard terms:** For all subscription agreements, NDAs, and similar contracts, Fleet maintains a [standard set of terms and maximum allowable adjustments for those terms](https://docs.google.com/spreadsheets/d/1gAenC948YWG2NwcaVHleUvX0LzS8suyMFpjaBqxHQNg/edit#gid=1136345578). Exceptions to these maximum allowable adjustments always require CEO approval, whether in the form of redlines to Fleet's agreements or in terms on a prospective customer's own contract.
 
-> All non-standard (from another party) subscription agreements, NDAs, and similar contracts require legal review from the Business Operations department before being signed. [Create an issue to request legal review](https://github.com/fleetdm/confidential/blob/main/.github/ISSUE_TEMPLATE/contract-review.md).
+> All non-standard (from another party) subscription agreements, NDAs, and similar contracts require legal review from the Contracts and Compliance department before being signed. [Create an issue to request legal review](https://github.com/fleetdm/confidential/blob/main/.github/ISSUE_TEMPLATE/contract-review.md).
 
 
 ### Close a new customer deal
 
-To close a deal with a new customer (non-self-service), create and complete a GitHub issue using the ["Sale" issue template](https://github.com/fleetdm/confidential/issues/new?assignees=hughestaylor&labels=%23g-business-operations&projects=&template=3-sale.md&title=New+customer%3A+_____________).
+To close a deal with a new customer (non-self-service), create and complete a GitHub issue using the ["Sale" issue template](https://github.com/fleetdm/confidential/issues/new?assignees=alexmitchelliii&labels=%23g-sales&projects=&template=3-sale.md&title=New+customer%3A+_____________).
 
 
 ### Change customer credit card number
@@ -207,8 +246,8 @@ You can help a Premium license dispenser customers change their credit card by d
 
 ### Process a security questionnaire
 
-- The AE will [use the handbook](https://fleetdm.com/handbook/company/communications#vendor-questionnaires) to answer most of the questions with links to appropriate sections in the handbook. After this first pass has been completed, and if there are outstanding questions, the AE will [assign the issue to Business Operations (#g-business-operations)](https://fleetdm.com/handbook/business-operations#contact-us)  with a requested timeline for completion defined.
-- BizOps consults the handbook to validate that nothing was missed by the AE. After the second pass has been completed, and if there are outstanding questions, BizOps will [reassign the issue to Sales (#g-sales)](https://fleetdm.com/handbook/sales#contact-us) for intake.
+- The AE will [use the handbook](https://fleetdm.com/handbook/company/communications#vendor-questionnaires) to answer most of the questions with links to appropriate sections in the handbook. After this first pass has been completed, and if there are outstanding questions, the AE will [assign the issue to Digital Experience (#g-digital-experience)](https://fleetdm.com/handbook/digital-experience#contact-us)  with a requested timeline for completion defined.
+- Digital Experience consults the handbook to validate that nothing was missed by the AE. After the second pass has been completed, and if there are outstanding questions, Digital Experience will [reassign the issue to Sales (#g-sales)](https://fleetdm.com/handbook/sales#contact-us) for intake.
 - The issue will be assigned to the Solutions Consultant (SC) associated to the opportunity in order to complete any unanswered questions.
 - The SC will search for unanswered questions and confirm again that nothing was missed from the handbook. Content missing from the handbook will need to be added via PR by the SC. Any unanswered questions after this pass has been completed by the SC will need to be [escalated to the Infrastructure team (#g-customer-success)](https://fleetdm.com/handbook/customer-success#contact-us) with the requested timeline for completion defined in the issue. Once complete, the infra team will assign the issue back to the #g-sales board.
 - Any questions answered by the infra team will be added to the handbook by the SC.
diff --git a/handbook/sales/sales.rituals.yml b/handbook/sales/sales.rituals.yml
index 6b2fd8fd0d..e83a43e851 100644
--- a/handbook/sales/sales.rituals.yml
+++ b/handbook/sales/sales.rituals.yml
@@ -1,12 +1,18 @@
 # https://github.com/fleetdm/fleet/pull/13084
 
 
-
+ -
+  task: "Close leads contacted ≥7 days ago"
+  startedOn: "2024-07-05"
+  frequency: "Daily"
+  description: "Close all of your leads in the 'Attempted to contact' stage and which have been there for 7 or more days.  If follow-up is appropriate, and won't be bothersome, it can be done after closing the lead.  (A new lead can always be opened for the contact later.)"
+  moreInfoUrl: ""
+  dri: "Every AE"
  -
   task: "Prioritize for next sprint" # Title that will actually show in rituals table
   startedOn: "2023-09-04" # Needs to align with frequency e.g. if frequency is every thrid Thursday startedOn === any third thursday
   frequency: "Triweekly" # must be supported by
-  description: "Drag next sprint's priorities to the top of the 'Not yet' column." # example of a longer thing: description: "[Prioritizing next sprint](https://fleetdm.com/handbook/company/communication)"
+  description: "Using your departmental kanban board, prioritize and finalize next sprint's goals for your team by draging the appropriate issues to the top of the 'Not yet' column." # example of a longer thing: description: "[Prioritizing next sprint](https://fleetdm.com/handbook/company/communication)"
   moreInfoUrl: "https://fleetdm.com/handbook/company/why-this-way#why-make-work-visible" #URL used to highlight "description:" test in table
   dri: "alexmitchelliii" # DRI for ritual (assignee if autoIssue) (TODO display GitHub proflie pic instead of name or title)
   autoIssue:   # Enables automation of GitHub issues
diff --git a/infrastructure/dogfood/terraform/aws-tf-module/free.tf b/infrastructure/dogfood/terraform/aws-tf-module/free.tf
index 308db90bfa..37eb03f37e 100644
--- a/infrastructure/dogfood/terraform/aws-tf-module/free.tf
+++ b/infrastructure/dogfood/terraform/aws-tf-module/free.tf
@@ -25,7 +25,7 @@ module "free" {
   }
   rds_config = {
     name                = local.customer_free
-    engine_version      = "8.0.mysql_aurora.3.05.2"
+    engine_version      = "8.0.mysql_aurora.3.07.1"
     snapshot_identifier = "arn:aws:rds:us-east-2:611884880216:cluster-snapshot:a2023-03-06-pre-migration"
     db_parameters = {
       # 8mb up from 262144 (256k) default
diff --git a/infrastructure/dogfood/terraform/aws-tf-module/main.tf b/infrastructure/dogfood/terraform/aws-tf-module/main.tf
index 4256d37d25..2bede111ec 100644
--- a/infrastructure/dogfood/terraform/aws-tf-module/main.tf
+++ b/infrastructure/dogfood/terraform/aws-tf-module/main.tf
@@ -76,7 +76,7 @@ module "main" {
   }
   rds_config = {
     name                = local.customer
-    engine_version      = "8.0.mysql_aurora.3.05.2"
+    engine_version      = "8.0.mysql_aurora.3.07.1"
     snapshot_identifier = "arn:aws:rds:us-east-2:611884880216:cluster-snapshot:a2023-03-06-pre-migration"
     db_parameters = {
       # 8mb up from 262144 (256k) default
diff --git a/infrastructure/dogfood/terraform/aws/variables.tf b/infrastructure/dogfood/terraform/aws/variables.tf
index 4329e1f0b4..db7a79e5e1 100644
--- a/infrastructure/dogfood/terraform/aws/variables.tf
+++ b/infrastructure/dogfood/terraform/aws/variables.tf
@@ -56,7 +56,7 @@ variable "database_name" {
 
 variable "fleet_image" {
   description = "the name of the container image to run"
-  default     = "fleetdm/fleet:v4.54.1"
+  default     = "fleetdm/fleet:v4.56.0"
 }
 
 variable "software_inventory" {
diff --git a/infrastructure/dogfood/terraform/gcp/variables.tf b/infrastructure/dogfood/terraform/gcp/variables.tf
index 0850224609..ba81f4af53 100644
--- a/infrastructure/dogfood/terraform/gcp/variables.tf
+++ b/infrastructure/dogfood/terraform/gcp/variables.tf
@@ -68,7 +68,7 @@ variable "redis_mem" {
 }
 
 variable "image" {
-  default = "fleetdm/fleet:v4.54.1"
+  default = "fleetdm/fleet:v4.56.0"
 }
 
 variable "software_installers_bucket_name" {
diff --git a/infrastructure/loadtesting/terraform/docker/loadtest.Dockerfile b/infrastructure/loadtesting/terraform/docker/loadtest.Dockerfile
index 18936fa2d8..c232760b44 100644
--- a/infrastructure/loadtesting/terraform/docker/loadtest.Dockerfile
+++ b/infrastructure/loadtesting/terraform/docker/loadtest.Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.22.4-alpine3.20@sha256:ace6cc3fe58d0c7b12303c57afe6d6724851152df55e08057b43990b927ad5e8
+FROM golang:1.23.1-alpine3.20@sha256:436e2d978524b15498b98faa367553ba6c3655671226f500c72ceb7afb2ef0b1
 ARG TAG
 RUN apk add git
 RUN git clone -b $TAG --depth=1 --no-tags --progress --no-recurse-submodules https://github.com/fleetdm/fleet.git && cd /go/fleet/cmd/osquery-perf/ && go build .
diff --git a/infrastructure/loadtesting/terraform/ecs.tf b/infrastructure/loadtesting/terraform/ecs.tf
index cce392657a..2327c2787b 100644
--- a/infrastructure/loadtesting/terraform/ecs.tf
+++ b/infrastructure/loadtesting/terraform/ecs.tf
@@ -203,7 +203,11 @@ resource "aws_ecs_task_definition" "backend" {
           {
             name  = "FLEET_OSQUERY_ASYNC_HOST_REDIS_SCAN_KEYS_COUNT"
             value = "10000"
-          }
+          },
+          {
+            name  = "FLEET_S3_SOFTWARE_INSTALLERS_BUCKET"
+            value = aws_s3_bucket.software_installers.bucket
+          },
         ], local.additional_env_vars)
       }
   ])
@@ -329,18 +333,18 @@ resource "aws_appautoscaling_policy" "ecs_policy_cpu" {
 resource "random_password" "fleet_server_private_key" {
   length  = 32
   special = true
-} 
-    
-resource "aws_secretsmanager_secret" "fleet_server_private_key" { 
+}
+
+resource "aws_secretsmanager_secret" "fleet_server_private_key" {
   name = "${terraform.workspace}-fleet-server-private-key"
 
   recovery_window_in_days = "0"
   lifecycle {
     create_before_destroy = true
   }
-} 
-  
+}
+
 resource "aws_secretsmanager_secret_version" "fleet_server_private_key" {
   secret_id     = aws_secretsmanager_secret.fleet_server_private_key.id
   secret_string = random_password.fleet_server_private_key.result
-} 
+}
diff --git a/infrastructure/loadtesting/terraform/rds.tf b/infrastructure/loadtesting/terraform/rds.tf
index 4276c0d81c..b70d4de1cf 100644
--- a/infrastructure/loadtesting/terraform/rds.tf
+++ b/infrastructure/loadtesting/terraform/rds.tf
@@ -26,10 +26,10 @@ module "aurora_mysql" { #tfsec:ignore:aws-rds-enable-performance-insights-encryp
   source  = "terraform-aws-modules/rds-aurora/aws"
   version = "7.7.1"
 
-  name                  = "${local.name}-mysql"
-  engine                = "aurora-mysql"
-  engine_version        = "8.0.mysql_aurora.3.03.3"
-  instance_class         = var.db_instance_type
+  name           = "${local.name}-mysql"
+  engine         = "aurora-mysql"
+  engine_version = "8.0.mysql_aurora.3.05.2"
+  instance_class = var.db_instance_type
 
   instances = {
     one = {}
diff --git a/infrastructure/loadtesting/terraform/readme.md b/infrastructure/loadtesting/terraform/readme.md
index 9e14ad8d0e..bfa120bfa1 100644
--- a/infrastructure/loadtesting/terraform/readme.md
+++ b/infrastructure/loadtesting/terraform/readme.md
@@ -61,13 +61,14 @@ If you need to run a load test with MDM enabled and configured you will need to
 
 2. Then set the `fleet_config` terraform var the following way (make sure to add any extra configuration you need to this JSON):
 ```sh
-export TF_VAR_fleet_config='{"FLEET_DEV_MDM_APPLE_DISABLE_PUSH":"1","FLEET_MDM_APPLE_SCEP_CHALLENGE":"foobar","FLEET_MDM_APPLE_SCEP_CERT_BYTES":"'$(cat /Users/foobar/mdm/fleet-mdm-apple-scep.crt | gsed -z 's/\n/\\n/g')'","FLEET_MDM_APPLE_SCEP_KEY_BYTES":"'$(cat /Users/foobar/mdm/fleet-mdm-apple-scep.key | gsed -z 's/\n/\\n/g')'","FLEET_MDM_APPLE_APNS_CERT_BYTES":"'$(cat /Users/foobar/mdm/mdmcert.download.push.pem | gsed -z 's/\n/\\n/g')'","FLEET_MDM_APPLE_APNS_KEY_BYTES":"'$(cat /Users/foobar/mdm/mdmcert.download.push.key | gsed -z 's/\n/\\n/g')'","FLEET_MDM_APPLE_BM_SERVER_TOKEN_BYTES":"'$(cat /Users/foobar/mdm/downloadtoken.p7m | gsed -z 's/\n/\\n/g' | gsed 's/"smime\.p7m"/\\"smime.p7m\\"/g' | tr -d '\r\n')'","FLEET_MDM_APPLE_BM_CERT_BYTES":"'$(cat /Users/foobar/mdm/fleet-apple-mdm-bm-public-key.crt | gsed -z 's/\n/\\n/g')'","FLEET_MDM_APPLE_BM_KEY_BYTES":"'$(cat /Users/foobar/mdm/fleet-apple-mdm-bm-private.key | gsed -z 's/\n/\\n/g')'"}'
+export TF_VAR_fleet_config='{"FLEET_DEV_MDM_APPLE_DISABLE_PUSH":"1","FLEET_DEV_MDM_APPLE_DISABLE_DEVICE_INFO_CERT_VERIFY":"1","FLEET_MDM_APPLE_SCEP_CHALLENGE":"foobar","FLEET_MDM_APPLE_SCEP_CERT_BYTES":"'$(cat /Users/foobar/mdm/fleet-mdm-apple-scep.crt | gsed -z 's/\n/\\n/g')'","FLEET_MDM_APPLE_SCEP_KEY_BYTES":"'$(cat /Users/foobar/mdm/fleet-mdm-apple-scep.key | gsed -z 's/\n/\\n/g')'","FLEET_MDM_APPLE_APNS_CERT_BYTES":"'$(cat /Users/foobar/mdm/mdmcert.download.push.pem | gsed -z 's/\n/\\n/g')'","FLEET_MDM_APPLE_APNS_KEY_BYTES":"'$(cat /Users/foobar/mdm/mdmcert.download.push.key | gsed -z 's/\n/\\n/g')'","FLEET_MDM_APPLE_BM_SERVER_TOKEN_BYTES":"'$(cat /Users/foobar/mdm/downloadtoken.p7m | gsed -z 's/\n/\\n/g' | gsed 's/"smime\.p7m"/\\"smime.p7m\\"/g' | tr -d '\r\n')'","FLEET_MDM_APPLE_BM_CERT_BYTES":"'$(cat /Users/foobar/mdm/fleet-apple-mdm-bm-public-key.crt | gsed -z 's/\n/\\n/g')'","FLEET_MDM_APPLE_BM_KEY_BYTES":"'$(cat /Users/foobar/mdm/fleet-apple-mdm-bm-private.key | gsed -z 's/\n/\\n/g')'"}'
 ```
 
 - The above is needed because the newline characters in the certificate/key/token files.
 - The value set in `FLEET_MDM_APPLE_SCEP_CHALLENGE` must match whatever you set in `osquery-perf`'s `mdm_scep_challenge` argument. 
 - The above `export TF_VAR_fleet_config=...` command was tested on `bash`. It did not work in `zsh`.
 - Note that we are also setting `FLEET_DEV_MDM_APPLE_DISABLE_PUSH=1`. We don't want to generate push notifications against fake UUIDs (otherwise it may cause Apple to rate limit due to invalid requests).
+- Note that we are also setting `FLEET_DEV_MDM_APPLE_DISABLE_DEVICE_INFO_CERT_VERIFY=1` to skip verification of Apple certificates for OTA enrollments.
 This has an impact on real devices because they will not be notified of any command to execute (it may take a reboot for them to reach out to Fleet for more commands).
 
 3. Add the following `osquery-perf` arguments to [loadtesting.tf](./loadtesting.tf)
@@ -97,8 +98,8 @@ There are a few main places of interest to monitor the load and resource usage:
 
 You can deploy new code changes to an environment the following way:
 
-1. Push the code changes to the `BRANCH_NAME` and wait for the [Docker publish](https://github.com/fleetdm/fleet/actions/workflows/goreleaser-snapshot-fleet.yaml) action to complete.
-2. Find the docker image ID corresponding to your branch:
+1. Push the code changes to the `BRANCH_NAME`, trigger a manual run of the [Docker publish](https://github.com/fleetdm/fleet/actions/workflows/goreleaser-snapshot-fleet.yaml) workflow (make sure to select the branch) and wait for it to complete.
+2. Find the docker image IDs corresponding to your branch:
 ```sh
 docker images | grep 'BRANCH_NAME' | awk '{print $3}'
 ```
diff --git a/infrastructure/loadtesting/terraform/s3.tf b/infrastructure/loadtesting/terraform/s3.tf
new file mode 100644
index 0000000000..ca15b37dba
--- /dev/null
+++ b/infrastructure/loadtesting/terraform/s3.tf
@@ -0,0 +1,46 @@
+data "aws_iam_policy_document" "software_installers" {
+  statement {
+    actions = [
+      "s3:GetObject*",
+      "s3:PutObject*",
+      "s3:ListBucket*",
+      "s3:ListMultipartUploadParts*",
+      "s3:DeleteObject",
+      "s3:CreateMultipartUpload",
+      "s3:AbortMultipartUpload",
+      "s3:ListMultipartUploadParts",
+      "s3:GetBucketLocation"
+    ]
+    resources = [aws_s3_bucket.software_installers.arn, "${aws_s3_bucket.software_installers.arn}/*"]
+  }
+}
+
+resource "aws_iam_policy" "software_installers" {
+  policy = data.aws_iam_policy_document.software_installers.json
+}
+
+resource "aws_iam_role_policy_attachment" "software_installers" {
+  policy_arn = aws_iam_policy.software_installers.arn
+  role       = aws_iam_role.main.name
+}
+
+resource "aws_s3_bucket" "software_installers" { #tfsec:ignore:aws-s3-encryption-customer-key:exp:2022-07-01  #tfsec:ignore:aws-s3-enable-versioning #tfsec:ignore:aws-s3-enable-bucket-logging:exp:2022-06-15
+  bucket_prefix = terraform.workspace
+}
+
+resource "aws_s3_bucket_server_side_encryption_configuration" "software_installers" {
+  bucket = aws_s3_bucket.software_installers.bucket
+  rule {
+    apply_server_side_encryption_by_default {
+      sse_algorithm = "aws:kms"
+    }
+  }
+}
+
+resource "aws_s3_bucket_public_access_block" "software_installers" {
+  bucket                  = aws_s3_bucket.software_installers.id
+  block_public_acls       = true
+  block_public_policy     = true
+  ignore_public_acls      = true
+  restrict_public_buckets = true
+}
diff --git a/infrastructure/render/README.md b/infrastructure/render/README.md
index 23bd1618d0..2a464c75ae 100644
--- a/infrastructure/render/README.md
+++ b/infrastructure/render/README.md
@@ -1,43 +1,43 @@
 [![Deploy to Render](https://render.com/images/deploy-to-render-button.svg)](https://render.com/deploy?repo=https://github.com/fleetdm/fleet)
 
-# Fleet Deployment Guide
+# Fleet deployment guide
 
 This guide outlines the services configured in the Render blueprint for deploying the Fleet system, which includes a web service, a MySQL database, and a Redis server.
 
-## Services Overview
+## Services overview
 
-### 1. Fleet Web Service
+### 1. Fleet web service
 - **Type:** Web
 - **Runtime:** Image
 - **Image:** `fleetdm/fleet:latest` 
 - **Description:** Main web service running the Fleet application, which is deployed using the latest Fleet Docker image. Configured to prepare the database before deployment.
-- **Health Check Path:** `/healthz`
-- **Environment Variables:** Connects to MySQL and Redis using service-bound environment variables.
+- **Health check path:** `/healthz`
+- **Environment variables:** Connects to MySQL and Redis using service-bound environment variables.
 
-### 2. Fleet MySQL Database
-- **Type:** Private Service (pserv)
+### 2. Fleet MySQL database
+- **Type:** Private service (pserv)
 - **Runtime:** Docker
 - **Repository:** [MySQL Example on Render](https://github.com/render-examples/mysql)
 - **Disk:** 10 GB mounted at `/var/lib/mysql`
 - **Description:** MySQL database used by the Fleet web service. Environment variables for database credentials are managed within the service and some are automatically generated.
 
-### 3. Fleet Redis Service
-- **Type:** Private Service (pserv)
+### 3. Fleet Redis service
+- **Type:** Private service (pserv)
 - **Runtime:** Image
 - **Repository:** [Redis Docker image](https://hub.docker.com/_/redis)
 - **Description:** Redis service for caching and other in-memory data storage needs of the Fleet web service.
 
-## Deployment Guide
+## Deployment guide
 
 ### Prerequisites
 - You need an account on [Render](https://render.com).
 - Familiarity with Render's dashboard and deployment concepts.
 
-### Steps to Deploy
+### Steps to deploy
 
 Click the deploy on render button or import the blueprint from the Render service deployment dashboard.
 
-### Post-Deployment
+### Post-deployment
 
 Navigate to the generated URL and run through the initial setup. If you have a license key you can add it post-deploy as
 an environment variable `FLEET_LICENSE_KEY=value` in the Fleet service configuration.
diff --git a/it-and-security/default.yml b/it-and-security/default.yml
index c94732459b..52baadb564 100644
--- a/it-and-security/default.yml
+++ b/it-and-security/default.yml
@@ -38,6 +38,10 @@ org_settings:
     zendesk: [ ]
   mdm:
     apple_bm_default_team: $DOGFOOD_APPLE_BM_DEFAULT_TEAM
+    end_user_authentication:
+      entity_id: dogfood-eula.fleetdm.com
+      idp_name: Google Workspace
+      metadata_url: $DOGFOOD_MDM_SSO_METADATA_URL
   org_info:
     contact_url: https://fleetdm.com/company/contact
     org_logo_url: ""
@@ -86,3 +90,4 @@ org_settings:
 policies:
 queries:
   - path: ./lib/collect-fleetd-update-channels.queries.yml
+software:
diff --git a/it-and-security/lib/configuration-profiles/macos-ensure-show-status-bar-is-enabled.mobileconfig b/it-and-security/lib/configuration-profiles/macos-ensure-show-status-bar-is-enabled.mobileconfig
new file mode 100644
index 0000000000..393f4ffbb5
--- /dev/null
+++ b/it-and-security/lib/configuration-profiles/macos-ensure-show-status-bar-is-enabled.mobileconfig
@@ -0,0 +1,37 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+	<dict>
+		<key>PayloadContent</key>
+		<array>
+			<dict>
+				<key>PayloadDisplayName</key>
+				<string>Ensure Show Status Bar Is Enabled</string>
+				<key>PayloadType</key>
+				<string>com.apple.Safari</string>
+				<key>PayloadIdentifier</key>
+				<string>com.fleetdm.cis-ensure-show-status-bar-is-enabled</string>
+				<key>PayloadUUID</key>
+				<string>708B39DB-E2B7-405C-A523-88F3DDC8DFFC</string>
+				<key>ShowOverlayStatusBar</key>
+				<true/>
+			</dict>
+		</array>
+		<key>PayloadDescription</key>
+		<string>Ensure Show Status Bar Is Enabled</string>
+		<key>PayloadDisplayName</key>
+		<string>Ensure Show Status Bar Is Enabled</string>
+		<key>PayloadIdentifier</key>
+		<string>com.fleetdm.cis-ensure-show-status-bar-is-enabled</string>
+		<key>PayloadRemovalDisallowed</key>
+		<false/>
+		<key>PayloadScope</key>
+		<string>System</string>
+		<key>PayloadType</key>
+		<string>Configuration</string>
+		<key>PayloadUUID</key>
+		<string>00FB5D02-8044-4E6F-884C-D73E7A32A2E7</string>
+		<key>PayloadVersion</key>
+		<integer>1</integer>
+	</dict>
+</plist>
diff --git a/it-and-security/lib/configuration-profiles/passcode-settings-ddm.json b/it-and-security/lib/configuration-profiles/passcode-settings-ddm.json
index dabb02d1a6..f4811f765b 100644
--- a/it-and-security/lib/configuration-profiles/passcode-settings-ddm.json
+++ b/it-and-security/lib/configuration-profiles/passcode-settings-ddm.json
@@ -2,7 +2,7 @@
     "Type": "com.apple.configuration.passcode.settings",
     "Identifier": "956e0d14-6019-479b-a6f9-a69ef77668c5",
     "Payload": {
-        "MaximumFailedAttempts": "five",
+        "MaximumFailedAttempts": 5,
         "MaximumInactivityInMinutes ": 5,
         "MinimumLength ": 12,
         "MinimumComplexCharacters": 3
diff --git a/it-and-security/lib/configuration-profiles/windows-firewall.xml b/it-and-security/lib/configuration-profiles/windows-firewall.xml
new file mode 100644
index 0000000000..424d89f886
--- /dev/null
+++ b/it-and-security/lib/configuration-profiles/windows-firewall.xml
@@ -0,0 +1,25 @@
+<Replace>
+  <!-- Enable firewall -->
+  <Item>
+    <Meta>
+      <Format xmlns="syncml:metinf">bool</Format>
+    </Meta>
+    <Target>
+      <LocURI>./Vendor/MSFT/Firewall/MdmStore/DomainProfile/EnableFirewall</LocURI>
+    </Target>
+    <Data>true</Data>
+  </Item>
+</Replace>
+<Replace>
+  <!-- Enable stealth mode -->
+  <Item>
+    <Meta>
+      <Format xmlns="syncml:metinf">bool</Format>
+    </Meta>
+    <Target>
+      <LocURI>./Vendor/MSFT/Firewall/MdmStore/DomainProfile/DisableStealthMode
+</LocURI>
+    </Target>
+    <Data>true</Data>
+  </Item>
+</Replace>
diff --git a/it-and-security/lib/configuration-profiles/windows-password.xml b/it-and-security/lib/configuration-profiles/windows-password.xml
new file mode 100644
index 0000000000..ce9c96ff9c
--- /dev/null
+++ b/it-and-security/lib/configuration-profiles/windows-password.xml
@@ -0,0 +1,24 @@
+<Replace>
+  <!-- Enforce PIN or password length (10 characters) -->
+  <Item>
+    <Meta>
+      <Format xmlns="syncml:metinf">int</Format>
+    </Meta>
+    <Target>
+      <LocURI>./Device/Vendor/MSFT/Policy/Config/DeviceLock/MinDevicePasswordLength</LocURI>
+    </Target>
+    <Data>10</Data>
+  </Item>
+</Replace>
+<Replace>
+  <!-- Enforce PIN or password has at least one lowercase letter and at least one number -->
+  <Item>
+    <Meta>
+      <Format xmlns="syncml:metinf">int</Format>
+    </Meta>
+    <Target>
+      <LocURI>./Device/Vendor/MSFT/Policy/Config/DeviceLock/MinDevicePasswordComplexCharacters</LocURI>
+    </Target>
+    <Data>2</Data>
+  </Item>
+</Replace>
diff --git a/it-and-security/lib/configuration-profiles/windows-screen-lock.xml b/it-and-security/lib/configuration-profiles/windows-screen-lock.xml
new file mode 100644
index 0000000000..f7d95aa803
--- /dev/null
+++ b/it-and-security/lib/configuration-profiles/windows-screen-lock.xml
@@ -0,0 +1,24 @@
+<Replace>
+  <!-- Enforce screenlock -->
+  <Item>
+    <Meta>
+      <Format xmlns="syncml:metinf">int</Format>
+    </Meta>
+    <Target>
+      <LocURI>./Device/Vendor/MSFT/Policy/Config/DeviceLock/DevicePasswordEnabled</LocURI>
+    </Target>
+    <Data>0</Data>
+  </Item>
+</Replace>
+<Replace>
+  <!-- Enforce screenlock after 15 minutes -->
+  <Item>
+    <Meta>
+      <Format xmlns="syncml:metinf">int</Format>
+    </Meta>
+    <Target>
+      <LocURI>./Device/Vendor/MSFT/Policy/Config/DeviceLock/MaxInactivityTimeDeviceLock</LocURI>
+    </Target>
+    <Data>15</Data>
+  </Item>
+</Replace>
diff --git a/it-and-security/lib/explore-data.queries.yml b/it-and-security/lib/explore-data.queries.yml
deleted file mode 100644
index deb070644d..0000000000
--- a/it-and-security/lib/explore-data.queries.yml
+++ /dev/null
@@ -1,3210 +0,0 @@
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - account_policy_data'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM account_policy_data;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - ad_config'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM ad_config;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - alf'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM alf;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - alf_exceptions'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM alf_exceptions;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - alf_explicit_auths'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM alf_explicit_auths;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - apfs_physical_stores'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM apfs_physical_stores;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - apfs_volumes'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM apfs_volumes;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - app_icons'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM app_icons;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - app_schemes'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM app_schemes;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - apparmor_events'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM apparmor_events;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - apparmor_profiles'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM apparmor_profiles;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - appcompat_shims'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM appcompat_shims;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - apps'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM apps;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - apt_sources'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM apt_sources;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - arp_cache'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM arp_cache;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - asl'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM asl;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - atom_packages'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM atom_packages;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - augeas'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM augeas;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - authdb'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM authdb;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - authenticode'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM authenticode;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - authorization_mechanisms'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM authorization_mechanisms;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - authorizations'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM authorizations;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - authorized_keys'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM authorized_keys;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - autoexec'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM autoexec;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - azure_instance_metadata'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM azure_instance_metadata;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - azure_instance_tags'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM azure_instance_tags;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - background_activities_moderator'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM background_activities_moderator;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - battery'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM battery;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - bitlocker_info'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM bitlocker_info;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - block_devices'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM block_devices;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - bpf_process_events'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM bpf_process_events;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - bpf_socket_events'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM bpf_socket_events;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - carbon_black_info'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM carbon_black_info;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - carves'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM carves;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - certificates'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM certificates;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - chassis_info'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM chassis_info;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - chocolatey_packages'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM chocolatey_packages;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - chrome_extension_content_scripts'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM chrome_extension_content_scripts;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - chrome_extensions'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM chrome_extensions;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - cis_audit'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM cis_audit;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - connected_displays'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM connected_displays;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - connectivity'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM connectivity;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - corestorage_logical_volume_families'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM corestorage_logical_volume_families;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - corestorage_logical_volumes'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM corestorage_logical_volumes;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - cpu_info'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM cpu_info;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - cpu_time'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM cpu_time;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - cpuid'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM cpuid;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - crashes'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM crashes;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - crontab'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM crontab;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - cryptoinfo'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM cryptoinfo;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - cryptsetup_status'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM cryptsetup_status;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - csrutil_info'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM csrutil_info;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - cups_destinations'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM cups_destinations;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - cups_jobs'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM cups_jobs;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - curl'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM curl;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - curl_certificate'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM curl_certificate;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - deb_packages'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM deb_packages;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - default_environment'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM default_environment;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - device_file'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM device_file;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - device_firmware'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM device_firmware;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - device_hash'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM device_hash;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - device_partitions'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM device_partitions;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - disk_encryption'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM disk_encryption;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - disk_events'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM disk_events;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - disk_info'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM disk_info;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - dns_cache'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM dns_cache;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - dns_resolvers'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM dns_resolvers;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - docker_container_envs'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM docker_container_envs;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - docker_container_fs_changes'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM docker_container_fs_changes;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - docker_container_labels'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM docker_container_labels;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - docker_container_mounts'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM docker_container_mounts;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - docker_container_networks'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM docker_container_networks;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - docker_container_ports'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM docker_container_ports;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - docker_container_processes'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM docker_container_processes;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - docker_container_stats'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM docker_container_stats;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - docker_containers'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM docker_containers;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - docker_image_history'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM docker_image_history;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - docker_image_labels'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM docker_image_labels;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - docker_image_layers'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM docker_image_layers;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - docker_images'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM docker_images;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - docker_info'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM docker_info;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - docker_network_labels'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM docker_network_labels;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - docker_networks'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM docker_networks;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - docker_version'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM docker_version;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - docker_volume_labels'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM docker_volume_labels;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - docker_volumes'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM docker_volumes;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - drivers'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM drivers;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - dscl'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM dscl;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - ec2_instance_metadata'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM ec2_instance_metadata;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - ec2_instance_tags'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM ec2_instance_tags;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - es_process_events'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM es_process_events;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - es_process_file_events'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM es_process_file_events;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - etc_hosts'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM etc_hosts;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - etc_protocols'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM etc_protocols;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - etc_services'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM etc_services;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - event_taps'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM event_taps;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - extended_attributes'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM extended_attributes;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - falcon_kernel_check'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM falcon_kernel_check;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - falconctl_options'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM falconctl_options;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - fan_speed_sensors'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM fan_speed_sensors;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - file'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM file;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - file_events'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM file_events;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - file_lines'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM file_lines;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - filevault_prk'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM filevault_prk;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - filevault_status'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM filevault_status;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - filevault_users'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM filevault_users;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - find_cmd'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM find_cmd;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - firefox_addons'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM firefox_addons;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - firefox_preferences'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM firefox_preferences;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - firmware_eficheck_integrity_check'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM firmware_eficheck_integrity_check;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - firmwarepasswd'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM firmwarepasswd;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - gatekeeper'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM gatekeeper;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - gatekeeper_approved_apps'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM gatekeeper_approved_apps;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - geolocation'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM geolocation;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - google_chrome_profiles'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM google_chrome_profiles;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - groups'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM groups;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - hardware_events'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM hardware_events;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - hash'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM hash;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - homebrew_packages'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM homebrew_packages;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - hvci_status'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM hvci_status;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - ibridge_info'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM ibridge_info;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - icloud_private_relay'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM icloud_private_relay;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - ie_extensions'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM ie_extensions;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - intel_me_info'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM intel_me_info;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - interface_addresses'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM interface_addresses;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - interface_details'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM interface_details;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - interface_ipv6'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM interface_ipv6;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - iokit_devicetree'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM iokit_devicetree;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - iokit_registry'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM iokit_registry;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - ioreg'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM ioreg;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - kernel_extensions'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM kernel_extensions;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - kernel_info'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM kernel_info;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - kernel_keys'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM kernel_keys;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - kernel_modules'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM kernel_modules;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - kernel_panics'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM kernel_panics;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - keychain_acls'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM keychain_acls;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - keychain_items'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM keychain_items;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - known_hosts'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM known_hosts;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - kva_speculative_info'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM kva_speculative_info;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - last'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM last;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - launchd'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM launchd;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - launchd_overrides'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM launchd_overrides;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - listening_ports'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM listening_ports;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - load_average'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM load_average;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - location_services'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM location_services;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - logged_in_users'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM logged_in_users;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - logical_drives'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM logical_drives;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - logon_sessions'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM logon_sessions;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - lxd_certificates'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM lxd_certificates;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - lxd_cluster'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM lxd_cluster;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - lxd_cluster_members'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM lxd_cluster_members;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - lxd_images'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM lxd_images;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - lxd_instance_config'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM lxd_instance_config;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - lxd_instance_devices'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM lxd_instance_devices;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - lxd_instances'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM lxd_instances;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - lxd_networks'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM lxd_networks;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - lxd_storage_pools'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM lxd_storage_pools;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - macadmins_unified_log'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM macadmins_unified_log;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - macos_profiles'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM macos_profiles;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - macos_rsr'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM macos_rsr;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - magic'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM magic;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - managed_policies'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM managed_policies;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - md_devices'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM md_devices;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - md_drives'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM md_drives;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - md_personalities'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM md_personalities;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - mdfind'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM mdfind;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - mdls'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM mdls;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - mdm'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM mdm;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - mdm_bridge'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM mdm_bridge;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - memory_array_mapped_addresses'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM memory_array_mapped_addresses;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - memory_arrays'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM memory_arrays;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - memory_device_mapped_addresses'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM memory_device_mapped_addresses;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - memory_devices'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM memory_devices;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - memory_error_info'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM memory_error_info;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - memory_info'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM memory_info;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - memory_map'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM memory_map;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - mounts'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM mounts;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - msr'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM msr;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - munki_info'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM munki_info;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - munki_installs'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM munki_installs;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - network_interfaces'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM network_interfaces;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - nfs_shares'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM nfs_shares;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - npm_packages'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM npm_packages;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - ntdomains'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM ntdomains;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - ntfs_acl_permissions'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM ntfs_acl_permissions;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - ntfs_journal_events'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM ntfs_journal_events;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - nvram'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM nvram;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - nvram_info'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM nvram_info;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - oem_strings'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM oem_strings;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - office_mru'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM office_mru;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - orbit_info'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM orbit_info;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - os_version'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM os_version;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - osquery_events'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM osquery_events;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - osquery_extensions'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM osquery_extensions;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - osquery_flags'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM osquery_flags;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - osquery_info'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM osquery_info;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - osquery_packs'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM osquery_packs;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - osquery_registry'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM osquery_registry;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - osquery_schedule'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM osquery_schedule;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - package_bom'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM package_bom;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - package_install_history'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM package_install_history;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - package_receipts'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM package_receipts;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - password_policy'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM password_policy;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - patches'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM patches;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - pci_devices'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM pci_devices;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - physical_disk_performance'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM physical_disk_performance;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - pipes'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM pipes;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - platform_info'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM platform_info;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - plist'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM plist;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - pmset'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM pmset;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - portage_keywords'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM portage_keywords;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - portage_packages'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM portage_packages;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - portage_use'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM portage_use;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - power_sensors'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM power_sensors;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - powershell_events'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM powershell_events;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - preferences'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM preferences;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - prefetch'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM prefetch;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - privacy_preferences'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM privacy_preferences;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - process_envs'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM process_envs;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - process_etw_events'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM process_etw_events;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - process_events'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM process_events;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - process_file_events'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM process_file_events;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - process_memory_map'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM process_memory_map;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - process_namespaces'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM process_namespaces;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - process_open_files'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM process_open_files;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - process_open_pipes'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM process_open_pipes;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - process_open_sockets'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM process_open_sockets;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - processes'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM processes;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - programs'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM programs;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - prometheus_metrics'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM prometheus_metrics;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - puppet_info'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM puppet_info;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - puppet_logs'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM puppet_logs;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - puppet_state'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM puppet_state;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - pwd_policy'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM pwd_policy;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - python_packages'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM python_packages;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - quicklook_cache'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM quicklook_cache;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - registry'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM registry;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - routes'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM routes;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - rpm_package_files'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM rpm_package_files;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - rpm_packages'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM rpm_packages;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - running_apps'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM running_apps;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - safari_extensions'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM safari_extensions;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - sandboxes'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM sandboxes;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - scheduled_tasks'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM scheduled_tasks;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - screenlock'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM screenlock;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - seccomp_events'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM seccomp_events;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - secureboot'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM secureboot;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - security_profile_info'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM security_profile_info;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - selinux_events'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM selinux_events;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - selinux_settings'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM selinux_settings;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - services'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM services;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - shadow'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM shadow;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - shared_folders'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM shared_folders;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - shared_memory'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM shared_memory;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - shared_resources'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM shared_resources;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - sharing_preferences'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM sharing_preferences;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - shell_history'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM shell_history;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - shellbags'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM shellbags;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - shimcache'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM shimcache;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - signature'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM signature;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - sip_config'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM sip_config;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - smbios_tables'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM smbios_tables;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - smc_keys'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM smc_keys;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - sntp_request'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM sntp_request;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - socket_events'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM socket_events;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - software_update'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM software_update;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - ssh_configs'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM ssh_configs;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - startup_items'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM startup_items;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - sudo_info'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM sudo_info;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - sudoers'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM sudoers;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - suid_bin'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM suid_bin;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - syslog_events'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM syslog_events;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - system_controls'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM system_controls;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - system_extensions'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM system_extensions;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - system_info'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM system_info;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - system_state'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM system_state;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - systemd_units'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM systemd_units;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - temperature_sensors'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM temperature_sensors;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - time'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM time;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - time_machine_backups'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM time_machine_backups;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - time_machine_destinations'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM time_machine_destinations;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - tpm_info'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM tpm_info;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - ulimit_info'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM ulimit_info;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - unified_log'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM unified_log;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - uptime'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM uptime;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - usb_devices'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM usb_devices;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - user_events'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM user_events;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - user_groups'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM user_groups;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - user_interaction_events'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM user_interaction_events;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - user_login_settings'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM user_login_settings;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - user_ssh_keys'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM user_ssh_keys;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - userassist'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM userassist;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - users'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM users;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - video_info'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM video_info;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - virtual_memory_info'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM virtual_memory_info;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - wifi_networks'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM wifi_networks;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - wifi_status'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM wifi_status;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - wifi_survey'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM wifi_survey;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - winbaseobj'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM winbaseobj;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - windows_crashes'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM windows_crashes;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - windows_eventlog'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM windows_eventlog;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - windows_events'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM windows_events;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - windows_firewall_rules'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM windows_firewall_rules;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - windows_optional_features'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM windows_optional_features;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - windows_search'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM windows_search;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - windows_security_center'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM windows_security_center;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - windows_security_products'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM windows_security_products;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - windows_update_history'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM windows_update_history;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - windows_updates'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM windows_updates;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - wmi_bios_info'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM wmi_bios_info;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - wmi_cli_event_consumers'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM wmi_cli_event_consumers;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - wmi_event_filters'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM wmi_event_filters;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - wmi_filter_consumer_binding'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM wmi_filter_consumer_binding;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - wmi_script_event_consumers'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM wmi_script_event_consumers;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - xprotect_entries'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM xprotect_entries;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - xprotect_meta'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM xprotect_meta;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - xprotect_reports'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM xprotect_reports;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - yara'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM yara;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - yara_events'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM yara_events;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - ycloud_instance_metadata'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM ycloud_instance_metadata;
-- automations_enabled: true
-  description: ""
-  discard_data: false
-  interval: 3600
-  logging: snapshot
-  min_osquery_version: ""
-  name: '[Explore data] - yum_sources'
-  observer_can_run: false
-  platform: ""
-  query: SELECT * FROM yum_sources;
diff --git a/it-and-security/teams/company-owned-ipads.yml b/it-and-security/teams/company-owned-ipads.yml
index ef8c46a47b..6209f77663 100644
--- a/it-and-security/teams/company-owned-ipads.yml
+++ b/it-and-security/teams/company-owned-ipads.yml
@@ -11,8 +11,15 @@ team_settings:
       enable_calendar_events: false
 agent_options:
 controls:
+  ipados_updates:
+    deadline: "2024-08-23"
+    minimum_version: "17.6"
   macos_settings:
     custom_settings:
   scripts:
 policies:
-queries:
\ No newline at end of file
+queries:
+software:
+  app_store_apps:
+    - app_store_id: '618783545' # Slack
+    - app_store_id: '546505307' # Zoom
diff --git a/it-and-security/teams/company-owned-iphones.yml b/it-and-security/teams/company-owned-iphones.yml
index badc8fa942..1b1ed229d1 100644
--- a/it-and-security/teams/company-owned-iphones.yml
+++ b/it-and-security/teams/company-owned-iphones.yml
@@ -11,6 +11,9 @@ team_settings:
       enable_calendar_events: false
 agent_options:
 controls:
+  ios_updates:
+    deadline: "2024-08-23"
+    minimum_version: "17.6"
   macos_settings:
     custom_settings:
       - path: ../lib/configuration-profiles/ios-restrictions.mobileconfig
@@ -20,3 +23,7 @@ controls:
   scripts:
 policies:
 queries:
+software:
+  app_store_apps:
+    - app_store_id: '618783545' # Slack
+    - app_store_id: '546505307' # Zoom
diff --git a/it-and-security/teams/compliance-exclusions.yml b/it-and-security/teams/compliance-exclusions.yml
index bf5a3896f7..fde00d1aea 100644
--- a/it-and-security/teams/compliance-exclusions.yml
+++ b/it-and-security/teams/compliance-exclusions.yml
@@ -9,7 +9,25 @@ team_settings:
   secrets:
     - secret: $DOGFOOD_COMPLIANCE_EXCLUSIONS_ENROLL_SECRET
 agent_options:
-  path: ../lib/agent-options.yml
+  config:
+    decorators:
+      load:
+        - SELECT uuid AS host_uuid FROM system_info;
+        - SELECT hostname AS hostname FROM system_info;
+    options:
+      disable_distributed: false
+      distributed_interval: 10
+      distributed_plugin: tls
+      distributed_tls_max_attempts: 3
+      logger_tls_endpoint: /api/osquery/log
+      logger_tls_period: 10
+      pack_delimiter: /
+  update_channels:
+    # We want to use these hosts to smoke test edge releases.
+    osqueryd: edge
+    orbit: edge
+    desktop: edge
 controls:
 policies:
 queries:
+software:
diff --git a/it-and-security/teams/explore-data.yml b/it-and-security/teams/explore-data.yml
deleted file mode 100644
index abea724c2a..0000000000
--- a/it-and-security/teams/explore-data.yml
+++ /dev/null
@@ -1,43 +0,0 @@
-name: "Explore data (fleetdm.com)"
-team_settings:
-  features:
-    enable_host_users: true
-    enable_software_inventory: true
-  host_expiry_settings:
-    host_expiry_enabled: false
-    host_expiry_window: 0
-  secrets:
-    - secret: $DOGFOOD_EXPLORE_DATA_ENROLL_SECRET
-agent_options:
-  config:
-    decorators:
-      load:
-        - SELECT uuid AS host_uuid FROM system_info;
-        - SELECT hostname AS hostname FROM system_info;
-    options:
-      disable_distributed: false
-      distributed_interval: 5
-      distributed_plugin: tls
-      distributed_tls_max_attempts: 3
-      logger_tls_endpoint: /api/v1/osquery/log
-      pack_delimiter: /
-controls:
-  enable_disk_encryption: false
-  macos_settings:
-    custom_settings:
-  macos_setup:
-    bootstrap_package: null
-    enable_end_user_authentication: false
-    macos_setup_assistant: null
-  macos_updates:
-    deadline: null
-    minimum_version: null
-  windows_settings:
-    custom_settings: null
-  windows_updates:
-    deadline_days: null
-    grace_period_days: null
-  scripts:
-policies:
-queries:
-  - path: ../lib/explore-data.queries.yml
diff --git a/it-and-security/teams/servers-canary.yml b/it-and-security/teams/servers-canary.yml
index 4911176def..e324a8ab4d 100644
--- a/it-and-security/teams/servers-canary.yml
+++ b/it-and-security/teams/servers-canary.yml
@@ -29,3 +29,4 @@ controls:
   scripts:
 policies:
 queries:
+software:
diff --git a/it-and-security/teams/servers.yml b/it-and-security/teams/servers.yml
index c43085a695..5d9e4586a6 100644
--- a/it-and-security/teams/servers.yml
+++ b/it-and-security/teams/servers.yml
@@ -29,3 +29,4 @@ controls:
   scripts:
 policies:
 queries:
+software:
diff --git a/it-and-security/teams/workstations-canary.yml b/it-and-security/teams/workstations-canary.yml
index 27ab9430ee..1d7ea39710 100644
--- a/it-and-security/teams/workstations-canary.yml
+++ b/it-and-security/teams/workstations-canary.yml
@@ -65,7 +65,6 @@ controls:
   enable_disk_encryption: true
   macos_settings:
     custom_settings:
-      - path: ../lib/configuration-profiles/macos-automatic-updates.mobileconfig
       - path: ../lib/configuration-profiles/macos-chrome-enrollment.mobileconfig
       - path: ../lib/configuration-profiles/macos-date-time.mobileconfig
       - path: ../lib/configuration-profiles/macos-disable-bluetooth-file-sharing.mobileconfig
@@ -88,15 +87,19 @@ controls:
       - path: ../lib/configuration-profiles/macos-secure-terminal-keyboard.mobileconfig
       - path: ../lib/configuration-profiles/macos-disable-update-notifications.mobileconfig
       - path: ../lib/configuration-profiles/passcode-settings-ddm.json
+      - path: ../lib/configuration-profiles/macos-ensure-show-status-bar-is-enabled.mobileconfig
   macos_setup:
     bootstrap_package: ""
     enable_end_user_authentication: true
     macos_setup_assistant: null
   macos_updates:
-    deadline: ""
-    minimum_version: ""
+    deadline: "2024-08-23"
+    minimum_version: "14.6.1"
   windows_settings:
-    custom_settings: null
+    custom_settings:
+      - path: ../lib/configuration-profiles/windows-firewall.xml
+      - path: ../lib/configuration-profiles/windows-password.xml
+      - path: ../lib/configuration-profiles/windows-screen-lock.xml
   windows_updates:
     deadline_days: 7
     grace_period_days: 2
@@ -115,7 +118,7 @@ policies:
   - path: ../lib/windows-device-health.policies.yml
   - path: ../lib/linux-device-health.policies.yml
   - name: macOS - Check if latest version
-    query: SELECT 1 FROM os_version WHERE major = '14' AND minor = '5';
+    query: SELECT 1 FROM os_version WHERE (major = '14' AND minor = '6') OR major = '15';
     critical: false
     description: Using an outdated macOS version risks exposure to security vulnerabilities and potential system instability.
     resolution: We will update your macOS to the latest version.
@@ -129,12 +132,26 @@ policies:
     platform: darwin
     calendar_events_enabled: false
   - name: macOS - System maintenance complete
-    query: SELECT 1 AS result FROM system_info WHERE computer_name NOT IN ('Titanosauria', 'Drew’s MacBook Pro','fleetwoodmike','Anthony’s MacBook Pro','Patricia’s MacBook Pro','Paul’s MacBook Pro','Tom’s MacBook Air');
+    query: SELECT 1 AS result FROM system_info WHERE computer_name NOT IN ('Drew’s MacBook Pro','Anthony’s MacBook Pro','Patricia’s MacBook Pro','Paul’s MacBook Pro','Tom’s MacBook Air');
     critical: false
     description: Determines if the device has completed system maintenance.
     resolution: We will perform system maintenance on your device.
     platform: darwin
     calendar_events_enabled: true
+  - name: macOS - Upgrade Firefox
+    query: SELECT 1 FROM apps WHERE name = 'Firefox.app' AND version_compare(bundle_short_version, '130.0.1') >= 0;
+    critical: false
+    description: The host may have an outdated or non-existent version of Firefox, potentially risking security vulnerabilities or compatibility issues.
+    resolution: During maintenance, the Firefox app could be updated to the correct version or installed if it's missing.
+    platform: darwin
+    calendar_events_enabled: false
+  - name: macOS - Upgrade Slack
+    query: SELECT 1 FROM apps WHERE name = 'Slack.app' AND version_compare(bundle_short_version, '4.40.126') >= 0;
+    critical: false
+    description: The host may be running an outdated version of Slack, which could pose security vulnerabilities or compatibility issues.
+    resolution: The host's Slack application will likely be updated to a version that is greater than or equal to '4.40.126'.
+    platform: darwin
+    calendar_events_enabled: false
 queries:
   - path: ../lib/collect-failed-login-attempts.queries.yml
   - path: ../lib/collect-fleetd-information.yml
@@ -143,3 +160,9 @@ queries:
   - path: ../lib/collect-software-permissions-system.queries.yml
   - path: ../lib/collect-software-permissions-user.queries.yml
   - path: ../lib/collect-crowdstrike-info.queries.yml
+software:
+  app_store_apps:
+      - app_store_id: '803453959' # Slack Desktop
+      - app_store_id: '1333542190' # 1Password 7 Desktop
+      - app_store_id: '1477376905' # GitHub
+      - app_store_id: '1152747299' # Figma
diff --git a/it-and-security/teams/workstations.yml b/it-and-security/teams/workstations.yml
index 1e6981a0b3..0ad266f905 100644
--- a/it-and-security/teams/workstations.yml
+++ b/it-and-security/teams/workstations.yml
@@ -18,7 +18,6 @@ controls:
   enable_disk_encryption: true
   macos_settings:
     custom_settings:
-      - path: ../lib/configuration-profiles/macos-automatic-updates.mobileconfig
       - path: ../lib/configuration-profiles/macos-date-time.mobileconfig
       - path: ../lib/configuration-profiles/macos-chrome-enrollment.mobileconfig
       - path: ../lib/configuration-profiles/macos-disable-bluetooth-file-sharing.mobileconfig
@@ -44,8 +43,8 @@ controls:
     enable_end_user_authentication: true
     macos_setup_assistant: null
   macos_updates:
-    deadline: "2024-07-12"
-    minimum_version: "14.5"
+    deadline: "2024-08-23"
+    minimum_version: "14.6.1"
   windows_settings:
     custom_settings: null
   windows_updates:
@@ -64,6 +63,13 @@ policies:
   - path: ../lib/linux-device-health.policies.yml
   - path: ../lib/macos-cis.policies.yml
   - path: ../lib/windows-cis.policies.yml
+  - name: macOS - Check if latest version
+    query: SELECT 1 FROM os_version WHERE (major = '14' AND minor = '6') OR major = '15';
+    critical: false
+    description: Using an outdated macOS version risks exposure to security vulnerabilities and potential system instability.
+    resolution: We will update your macOS to the latest version.
+    platform: darwin
+    calendar_events_enabled: false
 queries:
   - path: ../lib/collect-failed-login-attempts.queries.yml
   - path: ../lib/collect-usb-devices.queries.yml
@@ -76,7 +82,15 @@ queries:
     automations_enabled: false
     observer_can_run: true
 software:
-  - url: https://zoom.us/client/latest/Zoom.pkg?archType=arm64
-    pre_install_query: 
-      path: ../lib/macos-check-if-apple-silicon.queries.yml
-    self_service: true
+  packages:
+    - url: https://zoom.us/client/latest/Zoom.pkg?archType=arm64
+      pre_install_query:
+        path: ../lib/macos-check-if-apple-silicon.queries.yml
+      self_service: true
+    - url: https://dl.google.com/chrome/mac/stable/accept_tos%3Dhttps%253A%252F%252Fwww.google.com%252Fintl%252Fen_ph%252Fchrome%252Fterms%252F%26_and_accept_tos%3Dhttps%253A%252F%252Fpolicies.google.com%252Fterms/googlechrome.pkg
+      self_service: true
+  app_store_apps:
+    - app_store_id: '803453959' # Slack Desktop
+    - app_store_id: '1333542190' # 1Password 7 Desktop
+    - app_store_id: '1477376905' # GitHub
+    - app_store_id: '1152747299' # Figma
diff --git a/orbit/CHANGELOG.md b/orbit/CHANGELOG.md
index 6596e4286f..fa9efe36ef 100644
--- a/orbit/CHANGELOG.md
+++ b/orbit/CHANGELOG.md
@@ -1,3 +1,29 @@
+## Orbit 1.33.0 (Sep 20, 2024)
+
+* Added support to run the configured uninstall script when installer's post-install script fails.
+
+* Updated Go to go1.23.1
+
+## Orbit 1.32.0 (Aug 29, 2024)
+
+* Bumped macadmins extension to use SOFA feed sofafeed.macadmins.io
+
+* Fixed Fleet Desktop to refresh host status when the user clicks on "My Device" or "Self-service" dropdown option.
+
+* Updated go to go1.22.6
+
+* Added ability for MDM migrations if the host is manually enrolled to a 3rd party MDM.
+
+* Fixed a formatting error when an unrecognized error happens during BitLocker encryption.
+
+## Orbit 1.31.0 (Aug 19, 2024)
+
+* Fixed an issue that would display a disk encryption modal with MDM configured and FileVault enabled if the user hadn't escrowed the key in the past.
+
+## Orbit 1.30.0 (Aug 05, 2024)
+
+* Use Escrow Buddy to rotate FileVault keys on macOS
+
 ## Orbit 1.29.0 (Jul 24, 2024)
 
 * Fixed a startup bug by performing an early restart of orbit if an agent options setting has changed.
diff --git a/orbit/TUF.md b/orbit/TUF.md
index 1671d78545..c022aa4a65 100644
--- a/orbit/TUF.md
+++ b/orbit/TUF.md
@@ -7,18 +7,20 @@ Following are the currently deployed versions of fleetd components on the `stabl
 
 | Component\OS |    macOS     | Linux  | Windows | Linux (arm64) |
 |--------------|--------------|--------|---------|---------------|
-| orbit        | 1.29.0       | 1.29.0 | 1.29.0  | 1.29.0        |
-| desktop      | 1.29.0       | 1.29.0 | 1.29.0  | 1.29.0        |
-| osqueryd     | 5.12.1       | 5.12.1 | 5.12.1  | 5.12.1        |
+| orbit        | 1.33.0       | 1.33.0 | 1.33.0  | 1.33.0        |
+| desktop      | 1.33.0       | 1.33.0 | 1.33.0  | 1.33.0        |
+| osqueryd     | 5.13.1       | 5.13.1 | 5.13.1  | 5.13.1        |
 | nudge        | 1.1.10.81462 | -      | -       | -             |
 | swiftDialog  | 2.1.0        | -      | -       | -             |
+| escrowBuddy  | 1.0.0        | -      | -       | -             |
 
 ## `edge`
 
 | Component\OS | macOS  | Linux  | Windows | Linux (arm64) |
 |--------------|--------|--------|---------|---------------|
-| orbit        | 1.29.0 | 1.29.0 | 1.29.0  | 1.29.0        |
-| desktop      | 1.29.0 | 1.29.0 | 1.29.0  | 1.29.0        |
-| osqueryd     | 5.12.2 | 5.12.2 | 5.12.2  | 5.12.1        |
+| orbit        | 1.33.0 | 1.33.0 | 1.33.0  | 1.33.0        |
+| desktop      | 1.33.0 | 1.33.0 | 1.33.0  | 1.33.0        |
+| osqueryd     | 5.13.1 | 5.13.1 | 5.13.1  | 5.13.1        |
 | nudge        | -      | -      | -       | -             |
 | swiftDialog  | -      | -      | -       | -             |
+| escrowBuddy  | -      | -      | -       | -             |
diff --git a/orbit/changes/13157-fv-escrow b/orbit/changes/13157-fv-escrow
deleted file mode 100644
index b4ff408b05..0000000000
--- a/orbit/changes/13157-fv-escrow
+++ /dev/null
@@ -1 +0,0 @@
-* Use Escrow Buddy to rotate FileVault keys on macOS
diff --git a/orbit/cmd/desktop/desktop.go b/orbit/cmd/desktop/desktop.go
index b423936061..89915c8f4a 100644
--- a/orbit/cmd/desktop/desktop.go
+++ b/orbit/cmd/desktop/desktop.go
@@ -1,6 +1,7 @@
 package main
 
 import (
+	"context"
 	_ "embed"
 	"errors"
 	"fmt"
@@ -12,6 +13,7 @@ import (
 	"fyne.io/systray"
 	"github.com/fleetdm/fleet/v4/orbit/pkg/constant"
 	"github.com/fleetdm/fleet/v4/orbit/pkg/go-paniclog"
+	"github.com/fleetdm/fleet/v4/orbit/pkg/migration"
 	"github.com/fleetdm/fleet/v4/orbit/pkg/profiles"
 	"github.com/fleetdm/fleet/v4/orbit/pkg/token"
 	"github.com/fleetdm/fleet/v4/orbit/pkg/update"
@@ -59,6 +61,11 @@ func setupRunners() {
 }
 
 func main() {
+	// FIXME: we need to do a better job of graceful shutdown, releasing resources, stopping
+	// tickers, etc. (https://github.com/fleetdm/fleet/issues/21256)
+	// This context will be used as a general context to handle graceful shutdown in the future.
+	offlineWatcherCtx, cancelOfflineWatcherCtx := context.WithCancel(context.Background())
+
 	// Orbits uses --version to get the fleet-desktop version. Logs do not need to be set up when running this.
 	if len(os.Args) > 1 && os.Args[1] == "--version" {
 		// Must work with update.GetVersion
@@ -105,6 +112,15 @@ func main() {
 	go setupRunners()
 
 	var mdmMigrator useraction.MDMMigrator
+	// swiftDialogCh is a channel shared by the migrator and the offline watcher to
+	// coordinate the display of the dialog and ensure only one dialog is shown at a time.
+	var swiftDialogCh chan struct{}
+	var offlineWatcher useraction.MDMOfflineWatcher
+
+	// This ticker is used for fetching the desktop summary. It is initialized here because it is
+	// stopped in `OnExit.`
+	const checkInterval = 5 * time.Minute
+	summaryTicker := time.NewTicker(checkInterval)
 
 	onReady := func() {
 		log.Info().Msg("ready")
@@ -157,6 +173,7 @@ func main() {
 		if err != nil {
 			log.Fatal().Err(err).Msg("unable to initialize request client")
 		}
+
 		client.WithInvalidTokenRetry(func() string {
 			log.Debug().Msg("refetching token from disk for API retry")
 			newToken, err := tokenReader.Read()
@@ -168,13 +185,6 @@ func main() {
 			return newToken
 		})
 
-		refetchToken := func() {
-			if _, err := tokenReader.Read(); err != nil {
-				log.Error().Err(err).Msg("refetch token")
-			}
-			log.Debug().Msg("successfully refetched the token from disk")
-		}
-
 		disableTray := func() {
 			log.Debug().Msg("disabling tray items")
 			myDeviceItem.SetTitle("Connecting...")
@@ -186,6 +196,44 @@ func main() {
 			migrateMDMItem.Hide()
 		}
 
+		reportError := func(err error, info map[string]any) {
+			if !client.GetServerCapabilities().Has(fleet.CapabilityErrorReporting) {
+				log.Info().Msg("skipped reporting error to the server as it doesn't have the capability enabled")
+				return
+			}
+
+			fleetdErr := fleet.FleetdError{
+				ErrorSource:         "fleet-desktop",
+				ErrorSourceVersion:  version,
+				ErrorTimestamp:      time.Now(),
+				ErrorMessage:        err.Error(),
+				ErrorAdditionalInfo: info,
+			}
+
+			if err := client.ReportError(tokenReader.GetCached(), fleetdErr); err != nil {
+				log.Error().Err(err).EmbedObject(fleetdErr).Msg("reporting error to Fleet server")
+			}
+		}
+
+		if runtime.GOOS == "darwin" {
+			m, s, o, err := mdmMigrationSetup(offlineWatcherCtx, tufUpdateRoot, fleetURL, client, &tokenReader)
+			if err != nil {
+				go reportError(err, nil)
+				log.Error().Err(err).Msg("setting up MDM migration resources")
+			}
+
+			mdmMigrator = m
+			swiftDialogCh = s
+			offlineWatcher = o
+		}
+
+		refetchToken := func() {
+			if _, err := tokenReader.Read(); err != nil {
+				log.Error().Err(err).Msg("refetch token")
+			}
+			log.Debug().Msg("successfully refetched the token from disk")
+		}
+
 		// checkToken performs API test calls to enable the "My device" item as
 		// soon as the device auth token is registered by Fleet.
 		checkToken := func() <-chan interface{} {
@@ -246,50 +294,15 @@ func main() {
 			}
 		}()
 
-		if runtime.GOOS == "darwin" {
-			_, swiftDialogPath, _ := update.LocalTargetPaths(
-				tufUpdateRoot,
-				"swiftDialog",
-				update.SwiftDialogMacOSTarget,
-			)
-			mdmMigrator = useraction.NewMDMMigrator(
-				swiftDialogPath,
-				15*time.Minute,
-				&mdmMigrationHandler{
-					client:      client,
-					tokenReader: &tokenReader,
-				},
-			)
-		}
-
-		reportError := func(err error, info map[string]any) {
-			if !client.GetServerCapabilities().Has(fleet.CapabilityErrorReporting) {
-				log.Info().Msg("skipped reporting error to the server as it doesn't have the capability enabled")
-				return
-			}
-
-			fleetdErr := fleet.FleetdError{
-				ErrorSource:         "fleet-desktop",
-				ErrorSourceVersion:  version,
-				ErrorTimestamp:      time.Now(),
-				ErrorMessage:        err.Error(),
-				ErrorAdditionalInfo: info,
-			}
-
-			if err := client.ReportError(tokenReader.GetCached(), fleetdErr); err != nil {
-				log.Error().Err(err).EmbedObject(fleetdErr).Msg("reporting error to Fleet server")
-			}
-		}
-
 		// poll the server to check the policy status of the host and update the
 		// tray icon accordingly
 		go func() {
 			<-deviceEnabledChan
-			tic := time.NewTicker(5 * time.Minute)
-			defer tic.Stop()
 
 			for {
-				<-tic.C
+				<-summaryTicker.C
+				// Reset the ticker to the intended interval, in case we reset it to 1ms
+				summaryTicker.Reset(checkInterval)
 				sum, err := client.DesktopSummary(tokenReader.GetCached())
 				switch {
 				case err == nil:
@@ -306,42 +319,22 @@ func main() {
 					continue
 				}
 
-				// Check for null for backward compatibility with an old Fleet server
-				if sum.SelfService != nil && !*sum.SelfService {
-					selfServiceItem.Disable()
-					selfServiceItem.Hide()
-				} else {
-					selfServiceItem.Enable()
-					selfServiceItem.Show()
-				}
-
-				failingPolicies := 0
-				if sum.FailingPolicies != nil {
-					failingPolicies = int(*sum.FailingPolicies)
-				}
-
-				if failingPolicies > 0 {
-					if runtime.GOOS == "windows" {
-						// Windows (or maybe just the systray library?) doesn't support color emoji
-						// in the system tray menu, so we use text as an alternative.
-						if failingPolicies == 1 {
-							myDeviceItem.SetTitle("My device (1 issue)")
-						} else {
-							myDeviceItem.SetTitle(fmt.Sprintf("My device (%d issues)", failingPolicies))
-						}
-					} else {
-						myDeviceItem.SetTitle(fmt.Sprintf("🔴 My device (%d)", failingPolicies))
-					}
-				} else {
-					if runtime.GOOS == "windows" {
-						myDeviceItem.SetTitle("My device")
-					} else {
-						myDeviceItem.SetTitle("🟢 My device")
-					}
-				}
+				refreshMenuItems(sum.DesktopSummary, selfServiceItem, myDeviceItem)
 				myDeviceItem.Enable()
 
-				shouldRunMigrator := sum.Notifications.NeedsMDMMigration || sum.Notifications.RenewEnrollmentProfile
+				// Check our file to see if we should migrate
+				var migrationType string
+				if runtime.GOOS == "darwin" {
+					migrationType, err = mdmMigrator.MigrationInProgress()
+					if err != nil {
+						go reportError(err, nil)
+						log.Error().Err(err).Msg("checking if MDM migration is in progress")
+					}
+				}
+
+				migrationInProgress := migrationType != ""
+
+				shouldRunMigrator := sum.Notifications.NeedsMDMMigration || sum.Notifications.RenewEnrollmentProfile || migrationInProgress
 
 				if runtime.GOOS == "darwin" && shouldRunMigrator && mdmMigrator.CanRun() {
 					enrolled, enrollURL, err := profiles.IsEnrolledInMDM()
@@ -376,18 +369,28 @@ func main() {
 						})
 
 						// enable tray items
-						migrateMDMItem.Enable()
-						migrateMDMItem.Show()
+						if migrationType != constant.MDMMigrationTypeADE {
+							migrateMDMItem.Enable()
+							migrateMDMItem.Show()
+						}
 
 						// if the device is unmanaged or we're in force mode and the device needs
 						// migration, enable aggressive mode.
-						if isUnmanaged || forceModeEnabled {
+						if isUnmanaged || forceModeEnabled || migrationInProgress {
 							log.Info().Msg("MDM device is unmanaged or force mode enabled, automatically showing dialog")
 							if err := mdmMigrator.ShowInterval(); err != nil {
 								go reportError(err, nil)
 								log.Error().Err(err).Msg("showing MDM migration dialog at interval")
 							}
 						}
+					} else {
+						// we're done with the migration, so mark it as complete.
+						if err := mdmMigrator.MarkMigrationCompleted(); err != nil {
+							go reportError(err, nil)
+							log.Error().Err(err).Msg("failed to mark MDM migration as completed")
+						}
+						migrateMDMItem.Disable()
+						migrateMDMItem.Hide()
 					}
 				} else {
 					migrateMDMItem.Disable()
@@ -404,6 +407,8 @@ func main() {
 					if err := open.Browser(openURL); err != nil {
 						log.Error().Err(err).Str("url", openURL).Msg("open browser my device")
 					}
+					// Also refresh the device status by forcing the polling ticker to fire
+					summaryTicker.Reset(1 * time.Millisecond)
 				case <-transparencyItem.ClickedCh:
 					openURL := client.BrowserTransparencyURL(tokenReader.GetCached())
 					if err := open.Browser(openURL); err != nil {
@@ -414,7 +419,13 @@ func main() {
 					if err := open.Browser(openURL); err != nil {
 						log.Error().Err(err).Str("url", openURL).Msg("open browser self-service")
 					}
+					// Also refresh the device status by forcing the polling ticker to fire
+					summaryTicker.Reset(1 * time.Millisecond)
 				case <-migrateMDMItem.ClickedCh:
+					if offline := offlineWatcher.ShowIfOffline(offlineWatcherCtx); offline {
+						continue
+					}
+
 					if err := mdmMigrator.Show(); err != nil {
 						go reportError(err, nil)
 						log.Error().Err(err).Msg("showing MDM migration dialog on user action")
@@ -423,16 +434,60 @@ func main() {
 			}
 		}()
 	}
+
+	// FIXME: it doesn't look like this is actually triggering, at least when desktop gets
+	// killed (https://github.com/fleetdm/fleet/issues/21256)
 	onExit := func() {
+		log.Info().Msg("exit")
 		if mdmMigrator != nil {
 			mdmMigrator.Exit()
 		}
-		log.Info().Msg("exit")
+		if swiftDialogCh != nil {
+			close(swiftDialogCh)
+		}
+		summaryTicker.Stop()
+		cancelOfflineWatcherCtx()
 	}
 
 	systray.Run(onReady, onExit)
 }
 
+func refreshMenuItems(sum fleet.DesktopSummary, selfServiceItem *systray.MenuItem, myDeviceItem *systray.MenuItem) {
+	// Check for null for backward compatibility with an old Fleet server
+	if sum.SelfService != nil && !*sum.SelfService {
+		selfServiceItem.Disable()
+		selfServiceItem.Hide()
+	} else {
+		selfServiceItem.Enable()
+		selfServiceItem.Show()
+	}
+
+	failingPolicies := 0
+	if sum.FailingPolicies != nil {
+		failingPolicies = int(*sum.FailingPolicies)
+	}
+
+	if failingPolicies > 0 {
+		if runtime.GOOS == "windows" {
+			// Windows (or maybe just the systray library?) doesn't support color emoji
+			// in the system tray menu, so we use text as an alternative.
+			if failingPolicies == 1 {
+				myDeviceItem.SetTitle("My device (1 issue)")
+			} else {
+				myDeviceItem.SetTitle(fmt.Sprintf("My device (%d issues)", failingPolicies))
+			}
+		} else {
+			myDeviceItem.SetTitle(fmt.Sprintf("🔴 My device (%d)", failingPolicies))
+		}
+	} else {
+		if runtime.GOOS == "windows" {
+			myDeviceItem.SetTitle("My device")
+		} else {
+			myDeviceItem.SetTitle("🟢 My device")
+		}
+	}
+}
+
 type mdmMigrationHandler struct {
 	client      *service.DeviceClient
 	tokenReader *token.Reader
@@ -563,3 +618,36 @@ func logDir() (string, error) {
 
 	return dir, nil
 }
+
+func mdmMigrationSetup(ctx context.Context, tufUpdateRoot, fleetURL string, client *service.DeviceClient, tokenReader *token.Reader) (useraction.MDMMigrator, chan struct{}, useraction.MDMOfflineWatcher, error) {
+	dir, err := migration.Dir()
+	if err != nil {
+		return nil, nil, nil, err
+	}
+
+	mrw := migration.NewReadWriter(dir, constant.MigrationFileName)
+
+	// we use channel buffer size of 1 to allow one dialog at a time with non-blocking sends.
+	swiftDialogCh := make(chan struct{}, 1)
+
+	_, swiftDialogPath, _ := update.LocalTargetPaths(
+		tufUpdateRoot,
+		"swiftDialog",
+		update.SwiftDialogMacOSTarget,
+	)
+	mdmMigrator := useraction.NewMDMMigrator(
+		swiftDialogPath,
+		15*time.Minute,
+		&mdmMigrationHandler{
+			client:      client,
+			tokenReader: tokenReader,
+		},
+		mrw,
+		fleetURL,
+		swiftDialogCh,
+	)
+
+	offlineWatcher := useraction.StartMDMMigrationOfflineWatcher(ctx, client, swiftDialogPath, swiftDialogCh, migration.FileWatcher(mrw))
+
+	return mdmMigrator, swiftDialogCh, offlineWatcher, nil
+}
diff --git a/orbit/cmd/orbit/orbit.go b/orbit/cmd/orbit/orbit.go
index 40d1d5283f..334d69be85 100644
--- a/orbit/cmd/orbit/orbit.go
+++ b/orbit/cmd/orbit/orbit.go
@@ -851,7 +851,7 @@ func main() {
 		// create the notifications middleware that wraps the orbit client
 		// (must be shared by all runners that use a ConfigFetcher).
 		const (
-			renewEnrollmentProfileCommandFrequency = time.Hour
+			renewEnrollmentProfileCommandFrequency = 3 * time.Minute
 			windowsMDMEnrollmentCommandFrequency   = time.Hour
 			windowsMDMBitlockerCommandFrequency    = time.Hour
 		)
@@ -864,8 +864,7 @@ func main() {
 		switch runtime.GOOS {
 		case "darwin":
 			orbitClient.RegisterConfigReceiver(update.ApplyRenewEnrollmentProfileConfigFetcherMiddleware(
-				orbitClient, renewEnrollmentProfileCommandFrequency, fleetURL,
-			))
+				orbitClient, renewEnrollmentProfileCommandFrequency, fleetURL))
 			const nudgeLaunchInterval = 30 * time.Minute
 			orbitClient.RegisterConfigReceiver(update.ApplyNudgeConfigReceiverMiddleware(update.NudgeConfigFetcherOptions{
 				UpdateRunner: updateRunner, RootDir: c.String("root-dir"), Interval: nudgeLaunchInterval,
@@ -1224,7 +1223,12 @@ func main() {
 			if orbitClient.GetServerCapabilities().Has(fleet.CapabilityEscrowBuddy) {
 				orbitClient.RegisterConfigReceiver(update.NewEscrowBuddyRunner(updateRunner, 5*time.Minute))
 			} else {
-				orbitClient.RegisterConfigReceiver(update.ApplyDiskEncryptionRunnerMiddleware())
+				orbitClient.RegisterConfigReceiver(
+					update.ApplyDiskEncryptionRunnerMiddleware(
+						orbitClient.GetServerCapabilities,
+						orbitClient.TriggerOrbitRestart,
+					),
+				)
 			}
 		}
 
diff --git a/orbit/pkg/bitlocker/bitlocker_management_windows.go b/orbit/pkg/bitlocker/bitlocker_management_windows.go
index 79a5791a49..4fe472d19f 100644
--- a/orbit/pkg/bitlocker/bitlocker_management_windows.go
+++ b/orbit/pkg/bitlocker/bitlocker_management_windows.go
@@ -85,7 +85,7 @@ func encryptErrHandler(val int32) error {
 	case ErrorCodeProtectorExists:
 		msg = "key protector cannot be added; only one key protector of this type is allowed for this drive"
 	default:
-		msg = "error code returned during encryption: %d"
+		msg = fmt.Sprintf("error code returned during encryption: %d", val)
 	}
 
 	return &EncryptionError{msg, val}
diff --git a/orbit/pkg/constant/constant.go b/orbit/pkg/constant/constant.go
index 8a11160e5b..8f8e7e91e5 100644
--- a/orbit/pkg/constant/constant.go
+++ b/orbit/pkg/constant/constant.go
@@ -55,4 +55,17 @@ const (
 	// ServerOverridesFileName is the name of the file in the root directory
 	// that specifies the override configuration fetched from the server.
 	ServerOverridesFileName = "server-overrides.json"
+	// MigrationFileName is the name of the file used by fleetd to determine if the host is
+	// partially through an MDM migration.
+	MigrationFileName = "mdm_migration.txt"
+	// MDMMigrationTypeManual indicates that the MDM migration is for a manually enrolled host.
+	MDMMigrationTypeManual = "manual"
+	// MDMMigrationTypeADE indicates that the MDM migration is for an ADE enrolled host.
+	MDMMigrationTypeADE = "ade"
+	// MDMMigrationTypePreSonoma indicates that the MDM migration is for a host on a macOS version < 14.
+	MDMMigrationTypePreSonoma = "pre-sonoma"
+	// MDMMigrationOfflineWatcherInterval is the interval at which the offline watcher checks for
+	// the presence of the migration file.
+	MDMMigrationOfflineWatcherInterval = 3 * time.Minute
+	SonomaMajorVersion                 = 14
 )
diff --git a/orbit/pkg/installer/installer.go b/orbit/pkg/installer/installer.go
index 3f8f31cb46..c8fac3fcca 100644
--- a/orbit/pkg/installer/installer.go
+++ b/orbit/pkg/installer/installer.go
@@ -242,13 +242,24 @@ func (r *Runner) installSoftware(ctx context.Context, installID string) (*fleet.
 			log.Info().Msgf("installation of %s failed, attempting rollback. Exit code: %d, error: %s", installerPath, postExitCode, postErr)
 			ext := filepath.Ext(installerPath)
 			ext = strings.TrimPrefix(ext, ".")
-			uninstallScript := file.GetRemoveScript(ext)
-			uninstallOutput, uninstallExitCode, uninstallErr := r.runInstallerScript(ctx, uninstallScript, installerPath, "rollback-script")
+			uninstallScript := installer.UninstallScript
+			var builder strings.Builder
+			builder.WriteString(*payload.PostInstallScriptOutput)
+			builder.WriteString("\nAttempting rollback by running uninstall script...\n")
+			if uninstallScript == "" {
+				// The Fleet server is < v4.57.0, so we need to use the old method.
+				// If all customers have updated to v4.57.0 or later, we can remove this method.
+				uninstallScript = file.GetRemoveScript(ext)
+			}
+			uninstallOutput, uninstallExitCode, uninstallErr := r.runInstallerScript(ctx, uninstallScript, installerPath,
+				"rollback-script"+scriptExtension)
 			log.Info().Msgf(
 				"rollback staus: exit code: %d, error: %s, output: %s",
 				uninstallExitCode, uninstallErr, uninstallOutput,
 			)
-
+			builder.WriteString(fmt.Sprintf("Uninstall script exit code: %d\n", uninstallExitCode))
+			builder.WriteString(uninstallOutput)
+			payload.PostInstallScriptOutput = ptr.String(builder.String())
 			return payload, uninstallErr
 		}
 	}
diff --git a/orbit/pkg/installer/installer_test.go b/orbit/pkg/installer/installer_test.go
index 106a0b59c9..76d6173071 100644
--- a/orbit/pkg/installer/installer_test.go
+++ b/orbit/pkg/installer/installer_test.go
@@ -8,11 +8,13 @@ import (
 	"path/filepath"
 	"runtime"
 	"strconv"
+	"strings"
 	"testing"
 
 	"github.com/fleetdm/fleet/v4/server/fleet"
 	"github.com/fleetdm/fleet/v4/server/ptr"
 	osquery_gen "github.com/osquery/osquery-go/gen/osquery"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -360,6 +362,10 @@ func TestInstallerRun(t *testing.T) {
 			if len(executedScripts) == 2 {
 				return execOutput, 1, &exec.ExitError{}
 			}
+			// good exit on rollback uninstall script
+			if len(executedScripts) == 3 {
+				return []byte("all good"), 0, nil
+			}
 			return execOutput, execExitCode, execErr
 		}
 
@@ -374,7 +380,9 @@ func TestInstallerRun(t *testing.T) {
 		require.Equal(t, 0, *savedInstallerResult.InstallScriptExitCode)
 		require.Equal(t, string(execOutput), *savedInstallerResult.InstallScriptOutput)
 		require.Equal(t, 1, *savedInstallerResult.PostInstallScriptExitCode)
-		require.Equal(t, string(execOutput), *savedInstallerResult.PostInstallScriptOutput)
+		require.NotNil(t, savedInstallerResult.PostInstallScriptOutput)
+		numPostInstallMatches := strings.Count(*savedInstallerResult.PostInstallScriptOutput, string(execOutput))
+		assert.Equal(t, 1, numPostInstallMatches, *savedInstallerResult.PostInstallScriptOutput)
 	})
 
 	t.Run("failed rollback script", func(t *testing.T) {
@@ -402,7 +410,8 @@ func TestInstallerRun(t *testing.T) {
 		require.Equal(t, 0, *savedInstallerResult.InstallScriptExitCode)
 		require.Equal(t, string(execOutput), *savedInstallerResult.InstallScriptOutput)
 		require.Equal(t, 1, *savedInstallerResult.PostInstallScriptExitCode)
-		require.Equal(t, string(execOutput), *savedInstallerResult.PostInstallScriptOutput)
+		numPostInstallMatches := strings.Count(*savedInstallerResult.PostInstallScriptOutput, string(execOutput))
+		assert.Equal(t, 2, numPostInstallMatches)
 	})
 }
 
diff --git a/orbit/pkg/migration/readwriter.go b/orbit/pkg/migration/readwriter.go
new file mode 100644
index 0000000000..08c7d36537
--- /dev/null
+++ b/orbit/pkg/migration/readwriter.go
@@ -0,0 +1,157 @@
+package migration
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+
+	"github.com/fleetdm/fleet/v4/orbit/pkg/constant"
+)
+
+type ReadWriter struct {
+	Path     string
+	FileName string
+}
+
+func NewReadWriter(path, filename string) *ReadWriter {
+	return &ReadWriter{
+		Path:     path,
+		FileName: filepath.Join(path, filename),
+	}
+}
+
+// SetMigrationFile sets `typ` in the file used to track MDM migration type. This overwrites the
+// file if it exists.
+func (rw *ReadWriter) SetMigrationFile(typ string) error {
+	_, err := rw.read()
+	switch {
+	case err == nil:
+		// ensure the file is readable by other processes
+		if err := rw.setChmod(); err != nil {
+			return fmt.Errorf("loading migration file, chmod %q: %w", rw.Path, err)
+		}
+	case errors.Is(err, os.ErrNotExist):
+		if err := os.MkdirAll(rw.Path, constant.DefaultDirMode); err != nil {
+			return fmt.Errorf("creating directory for migration file: %w", err)
+		}
+		if err := os.WriteFile(rw.FileName, []byte(typ), constant.DefaultWorldReadableFileMode); err != nil {
+			return fmt.Errorf("writing migration file: %w", err)
+		}
+
+	default:
+		return fmt.Errorf("load migration file %q: %w", rw.Path, err)
+	}
+	return nil
+}
+
+// RemoveFile removes the file used for tracking the MDM migration type.
+func (rw *ReadWriter) RemoveFile() error {
+	if err := os.Remove(rw.FileName); err != nil {
+		if errors.Is(err, os.ErrNotExist) {
+			// that's ok, noop
+			return nil
+		}
+
+		return fmt.Errorf("removing migration file: %w", err)
+	}
+
+	return nil
+}
+
+// GetMigrationType returns the contents of the MDM migration file. The contents say what type of
+// migration it is.
+func (rw *ReadWriter) GetMigrationType() (string, error) {
+	data, err := rw.read()
+	if err != nil {
+		if errors.Is(err, os.ErrNotExist) {
+			return "", nil
+		}
+
+		return "", err
+	}
+
+	return data, nil
+}
+
+// FileExists returns whether or not the MDM migration file exists on this host.
+func (rw *ReadWriter) FileExists() (bool, error) {
+	_, err := os.Stat(rw.FileName)
+	if err != nil {
+		if errors.Is(err, os.ErrNotExist) {
+			return false, nil
+		}
+
+		return false, err
+	}
+
+	return true, nil
+}
+
+// DirExists returns whether or not the directory where the MDM migration file is stored exists.
+func (rw *ReadWriter) DirExists() (bool, error) {
+	_, err := os.Stat(rw.FileName)
+	if err != nil {
+		if errors.Is(err, os.ErrNotExist) {
+			return false, nil
+		}
+
+		return false, err
+	}
+
+	return true, nil
+}
+
+func (rw *ReadWriter) read() (string, error) {
+	data, err := os.ReadFile(rw.FileName)
+	if err != nil {
+		return "", err
+	}
+
+	return string(data), nil
+}
+
+func (rw *ReadWriter) setChmod() error {
+	return os.Chmod(rw.FileName, constant.DefaultWorldReadableFileMode)
+}
+
+func (rw *ReadWriter) NewFileWatcher() FileWatcher {
+	return &fileWatcher{rw: rw}
+}
+
+type FileWatcher interface {
+	GetMigrationType() (string, error)
+	FileExists() (bool, error)
+	DirExists() (bool, error)
+}
+
+type fileWatcher struct {
+	rw *ReadWriter
+}
+
+// GetMigrationType returns the contents of the MDM migration file which indicate what type of
+// migration it is.
+func (r *fileWatcher) GetMigrationType() (string, error) {
+	return r.rw.GetMigrationType()
+}
+
+// FileExists returns whether or not the MDM migration file exists on this host.
+func (r *fileWatcher) FileExists() (bool, error) {
+	return r.rw.FileExists()
+}
+
+// DirExists returns whether or not the directory where the MDM migration file is stored exists.
+func (r *fileWatcher) DirExists() (bool, error) {
+	return r.rw.DirExists()
+}
+
+// Dir returns the path to the directory where the MDM migration file is stored. This path should be
+// ~/Library/Caches/com.fleetdm.orbit
+func Dir() (string, error) {
+	homedir, err := os.UserHomeDir()
+	if err != nil {
+		return "", fmt.Errorf("failed to get user's home directory: %w", err)
+	}
+
+	return filepath.Join(homedir, "Library/Caches/com.fleetdm.orbit"), nil
+}
diff --git a/orbit/pkg/profiles/profiles_darwin.go b/orbit/pkg/profiles/profiles_darwin.go
index 93d197a587..8f4dd296f7 100644
--- a/orbit/pkg/profiles/profiles_darwin.go
+++ b/orbit/pkg/profiles/profiles_darwin.go
@@ -127,6 +127,37 @@ func IsEnrolledInMDM() (bool, string, error) {
 	return true, enrollmentURL, nil
 }
 
+func IsManuallyEnrolledInMDM() (bool, error) {
+	out, err := getMDMInfoFromProfilesCmd()
+	if err != nil {
+		return false, fmt.Errorf("calling /usr/bin/profiles: %w", err)
+	}
+
+	// The output of the command is in the form:
+	//
+	// ```
+	// Enrolled via DEP: No
+	// MDM enrollment: Yes (User Approved)
+	// MDM server: https://test.example.com/mdm/apple/mdm
+	// ```
+	//
+	// If the host is not enrolled into an MDM, the last line is ommitted,
+	// so we need to check that:
+	//
+	// 1. We've got three rows
+	// 2. Whether the first line contains "Yes" or "No"
+	lines := bytes.Split(bytes.TrimSpace(out), []byte("\n"))
+	if len(lines) < 3 {
+		return false, nil
+	}
+
+	if strings.Contains(string(lines[0]), "Yes") {
+		return false, nil
+	}
+
+	return true, nil
+}
+
 // getMDMInfoFromProfilesCmd is declared as a variable so it can be overwritten by tests.
 var getMDMInfoFromProfilesCmd = func() ([]byte, error) {
 	cmd := exec.Command("/usr/bin/profiles", "status", "-type", "enrollment")
diff --git a/orbit/pkg/update/disk_encryption.go b/orbit/pkg/update/disk_encryption.go
index ae09f386d6..1f6497265d 100644
--- a/orbit/pkg/update/disk_encryption.go
+++ b/orbit/pkg/update/disk_encryption.go
@@ -1,6 +1,7 @@
 package update
 
 import (
+	"errors"
 	"sync/atomic"
 
 	"github.com/fleetdm/fleet/v4/orbit/pkg/useraction"
@@ -11,16 +12,37 @@ import (
 const maxRetries = 2
 
 type DiskEncryptionRunner struct {
-	isRunning atomic.Bool
+	isRunning           atomic.Bool
+	capabilitiesFetcher func() fleet.CapabilityMap
+	triggerOrbitRestart func(reason string)
 }
 
-func ApplyDiskEncryptionRunnerMiddleware() fleet.OrbitConfigReceiver {
-	return &DiskEncryptionRunner{}
+func ApplyDiskEncryptionRunnerMiddleware(
+	capabilitiesFetcher func() fleet.CapabilityMap,
+	triggerOrbitRestart func(reason string),
+) fleet.OrbitConfigReceiver {
+	return &DiskEncryptionRunner{
+		capabilitiesFetcher: capabilitiesFetcher,
+		triggerOrbitRestart: triggerOrbitRestart,
+	}
 }
 
 func (d *DiskEncryptionRunner) Run(cfg *fleet.OrbitConfig) error {
 	log.Debug().Msgf("running disk encryption fetcher middleware, notification: %v, isIdle: %v", cfg.Notifications.RotateDiskEncryptionKey, d.isRunning.Load())
 
+	if d.capabilitiesFetcher == nil {
+		return errors.New("disk encryption runner needs a capabilitites fetcher configured")
+	}
+
+	if d.triggerOrbitRestart == nil {
+		return errors.New("disk encryption runner needs a function to trigger orbit restarts configured")
+	}
+
+	if d.capabilitiesFetcher().Has(fleet.CapabilityEscrowBuddy) {
+		d.triggerOrbitRestart("server has Escrow Buddy capability but old disk encryption fetcher was running")
+		return nil
+	}
+
 	if cfg.Notifications.RotateDiskEncryptionKey && !d.isRunning.Swap(true) {
 		go func() {
 			defer d.isRunning.Store(false)
diff --git a/orbit/pkg/update/notifications.go b/orbit/pkg/update/notifications.go
index 3d8b9bb033..fa5b6b993c 100644
--- a/orbit/pkg/update/notifications.go
+++ b/orbit/pkg/update/notifications.go
@@ -66,7 +66,7 @@ func (h *renewEnrollmentProfileConfigReceiver) Run(config *fleet.OrbitConfig) er
 			// enrolled (after the user's manual steps, and osquery reporting the
 			// updated mdm enrollment).
 			// See https://github.com/fleetdm/fleet/pull/9409#discussion_r1084382455
-			if time.Since(h.lastRun) > h.Frequency {
+			if time.Since(h.lastRun) >= h.Frequency {
 				// we perform this check locally on the client too to avoid showing the
 				// dialog if the client is enrolled to an MDM server.
 				enrollFn := h.checkEnrollmentFn
diff --git a/orbit/pkg/update/swift_dialog.go b/orbit/pkg/update/swift_dialog.go
index eebd68477b..bdbfde5e3e 100644
--- a/orbit/pkg/update/swift_dialog.go
+++ b/orbit/pkg/update/swift_dialog.go
@@ -34,7 +34,10 @@ func (s *SwiftDialogDownloader) Run(cfg *fleet.OrbitConfig) error {
 		return nil
 	}
 
+	// TODO: we probably want to ensure that swiftDialog is always installed if we're going to be
+	// using it offline.
 	if !cfg.Notifications.NeedsMDMMigration && !cfg.Notifications.RenewEnrollmentProfile {
+		log.Debug().Msg("got false needs migration and false renew enrollment")
 		return nil
 	}
 
diff --git a/orbit/pkg/useraction/mdm_migration.go b/orbit/pkg/useraction/mdm_migration.go
index 27480b6ab6..228a396664 100644
--- a/orbit/pkg/useraction/mdm_migration.go
+++ b/orbit/pkg/useraction/mdm_migration.go
@@ -1,6 +1,10 @@
 package useraction
 
-import "github.com/fleetdm/fleet/v4/server/fleet"
+import (
+	"context"
+
+	"github.com/fleetdm/fleet/v4/server/fleet"
+)
 
 // MDMMigrator represents the minimum set of methods a migration must implement
 // in order to be used by Fleet Desktop.
@@ -19,6 +23,12 @@ type MDMMigrator interface {
 	ShowInterval() error
 	// Exit tries to stop any processes started by the migrator.
 	Exit()
+	// MigrationInProgress checks if the MDM migration is still in progress (i.e. the host is not
+	// yet fully enrolled in Fleet MDM). It returns the type of migration that is in progress, if any.
+	MigrationInProgress() (string, error)
+	// MarkMigrationCompleted marks the migration as completed. This is currently done by removing
+	// the migration file.
+	MarkMigrationCompleted() error
 }
 
 // MDMMigratorProps are props required to display the dialog. It's akin to the
@@ -26,6 +36,8 @@ type MDMMigrator interface {
 type MDMMigratorProps struct {
 	OrgInfo     fleet.DesktopOrgInfo
 	IsUnmanaged bool
+	// DisableTakeover is used to disable the blur and always on top features of the dialog.
+	DisableTakeover bool
 }
 
 // MDMMigratorHandler handles remote actions/callbacks that the migrator calls.
@@ -33,3 +45,7 @@ type MDMMigratorHandler interface {
 	NotifyRemote() error
 	ShowInstructions() error
 }
+
+type MDMOfflineWatcher interface {
+	ShowIfOffline(ctx context.Context) bool
+}
diff --git a/orbit/pkg/useraction/mdm_migration_darwin.go b/orbit/pkg/useraction/mdm_migration_darwin.go
index ba4c574d6e..e4daeab997 100644
--- a/orbit/pkg/useraction/mdm_migration_darwin.go
+++ b/orbit/pkg/useraction/mdm_migration_darwin.go
@@ -4,6 +4,7 @@ package useraction
 
 import (
 	"bytes"
+	"context"
 	"errors"
 	"fmt"
 	"os"
@@ -14,9 +15,13 @@ import (
 	"text/template"
 	"time"
 
+	"github.com/fleetdm/fleet/v4/orbit/pkg/constant"
+	"github.com/fleetdm/fleet/v4/orbit/pkg/migration"
+
 	"github.com/fleetdm/fleet/v4/orbit/pkg/profiles"
 	"github.com/fleetdm/fleet/v4/pkg/file"
 	"github.com/fleetdm/fleet/v4/pkg/retry"
+	"github.com/fleetdm/fleet/v4/server/service"
 	"github.com/rs/zerolog/log"
 )
 
@@ -56,15 +61,23 @@ var mdmMigrationTemplatePreSonoma = template.Must(template.New("mdmMigrationTemp
 
 Select **Start** and look for this notification in your notification center:` +
 	"\n\n![Image showing MDM migration notification](https://fleetdm.com/images/permanent/mdm-migration-screenshot-notification-2048x480.png)\n\n" +
-	"After you start, this window will popup every 15-20 minutes until you finish.",
+	"After you start, this window will popup every 3 minutes until you finish.",
 ))
 
-var mdmMigrationTemplate = template.Must(template.New("mdmMigrationTemplate").Parse(`
+var mdmManualMigrationTemplate = template.Must(template.New("").Parse(`
+## Migrate to Fleet
+
+Select **Start** and My device page will appear soon:` +
+	"\n\n![Image showing MDM migration notification](https://fleetdm.com/images/permanent/mdm-manual-migration-1024x500.png)\n\n" +
+	"After you start, this dialog will popup every 3 minutes until you finish.",
+))
+
+var mdmADEMigrationTemplate = template.Must(template.New("").Parse(`
 ## Migrate to Fleet
 
 Select **Start** and Remote Management window will appear soon:` +
-	"\n\n![Image showing MDM migration notification](https://fleetdm.com/images/permanent/mdm-migration-sonoma-1500x938.png)\n\n" +
-	"After you start, this window will popup every 15-20 minutes until you finish.",
+	"\n\n![Image showing MDM migration notification](https://fleetdm.com/images/permanent/mdm-ade-migration-1024x500.png)\n\n" +
+	"After you start, **Remote Management** will popup every minute until you finish.",
 ))
 
 var errorTemplate = template.Must(template.New("").Parse(`
@@ -73,6 +86,14 @@ var errorTemplate = template.Must(template.New("").Parse(`
 Please contact your IT admin [here]({{ .ContactURL }}).
 `))
 
+var unenrollBody = "## Migrate to Fleet\nUnenrolling you from your old MDM. This could take 90 seconds...\n\n%s"
+
+var mdmMigrationTemplateOffline = template.Must(template.New("").Parse(`
+## Migrate to Fleet
+
+🛜🚫 No internet connection. Please connect to internet to continue.`,
+))
+
 // baseDialog implements the basic building blocks to render dialogs using
 // swiftDialog.
 type baseDialog struct {
@@ -110,11 +131,9 @@ func (b *baseDialog) render(flags ...string) (chan swiftDialogExitCode, chan err
 	exitCodeCh := make(chan swiftDialogExitCode, 1)
 	errCh := make(chan error, 1)
 	go func() {
-		// all dialogs should always be blurred and on top
+		// all dialogs should always be centered
 		flags = append(
 			flags,
-			"--blurscreen",
-			"--ontop",
 			"--messageposition", "center",
 		)
 		cmd := exec.Command(b.path, flags...) //nolint:gosec
@@ -166,14 +185,18 @@ func (b *baseDialog) render(flags ...string) (chan swiftDialogExitCode, chan err
 }
 
 // NewMDMMigrator creates a new  swiftDialogMDMMigrator with the right internal state.
-func NewMDMMigrator(path string, frequency time.Duration, handler MDMMigratorHandler) MDMMigrator {
+func NewMDMMigrator(path string, frequency time.Duration, handler MDMMigratorHandler, mrw *migration.ReadWriter, fleetURL string, showCh chan struct{}) MDMMigrator {
+	if cap(showCh) != 1 {
+		log.Fatal().Msg("swift dialog channel must have a buffer size of 1")
+	}
 	return &swiftDialogMDMMigrator{
 		handler:                   handler,
 		baseDialog:                newBaseDialog(path),
 		frequency:                 frequency,
 		unenrollmentRetryInterval: defaultUnenrollmentRetryInterval,
-		// set a buffer size of 1 to allow one Show without blocking
-		showCh: make(chan struct{}, 1),
+		mrw:                       mrw,
+		fleetURL:                  fleetURL,
+		showCh:                    showCh,
 	}
 }
 
@@ -189,7 +212,8 @@ type swiftDialogMDMMigrator struct {
 	// lastShown
 	lastShown   time.Time
 	lastShownMu sync.RWMutex
-	showCh      chan struct{}
+	// showCh is shared with the offline watcher and used to ensure only one dialog is open at a time
+	showCh chan struct{}
 
 	// testEnrollmentCheckFileFn is used in tests to mock the call to verify
 	// the enrollment status of the host
@@ -198,6 +222,8 @@ type swiftDialogMDMMigrator struct {
 	// the enrollment status of the host
 	testEnrollmentCheckStatusFn func() (bool, string, error)
 	unenrollmentRetryInterval   time.Duration
+	mrw                         *migration.ReadWriter
+	fleetURL                    string
 }
 
 /**
@@ -248,12 +274,23 @@ func (m *swiftDialogMDMMigrator) render(message string, flags ...string) (chan s
 	return m.baseDialog.render(flags...)
 }
 
-func (m *swiftDialogMDMMigrator) renderLoadingSpinner() (chan swiftDialogExitCode, chan error) {
-	return m.render("## Migrate to Fleet\nUnenrolling you from your old MDM. This could take 90 seconds...",
+func (m *swiftDialogMDMMigrator) renderLoadingSpinner(preSonoma, isManual bool) (chan swiftDialogExitCode, chan error) {
+	var body string
+	switch true {
+	case preSonoma:
+		body = fmt.Sprintf(unenrollBody, "![Image showing MDM migration notification](https://fleetdm.com/images/permanent/mdm-migration-pre-sonoma-unenroll-1024x500.png)")
+	case isManual:
+		body = fmt.Sprintf(unenrollBody, "![Image showing MDM migration notification](https://fleetdm.com/images/permanent/mdm-manual-migration-1024x500.png)")
+	default:
+		// ADE migration, macOS > 14
+		body = fmt.Sprintf(unenrollBody, "![Image showing MDM migration notification](https://fleetdm.com/images/permanent/mdm-ade-migration-1024x500.png)")
+	}
+
+	return m.render(body,
 		"--button1text", "Start",
 		"--button1disabled",
 		"--quitkey", "x",
-		"--height", "220",
+		"--height", "669",
 	)
 }
 
@@ -275,7 +312,7 @@ func (m *swiftDialogMDMMigrator) renderError() (chan swiftDialogExitCode, chan e
 // waitForUnenrollment waits 90 seconds (value determined by product) for the
 // device to unenroll from the current MDM solution. If the device doesn't
 // unenroll, an error is returned.
-func (m *swiftDialogMDMMigrator) waitForUnenrollment() error {
+func (m *swiftDialogMDMMigrator) waitForUnenrollment(isADEMigration bool) error {
 	maxRetries := int(mdmUnenrollmentTotalWaitTime.Seconds() / m.unenrollmentRetryInterval.Seconds())
 	checkFileFn := m.testEnrollmentCheckFileFn
 	if checkFileFn == nil {
@@ -292,14 +329,16 @@ func (m *swiftDialogMDMMigrator) waitForUnenrollment() error {
 	return retry.Do(func() error {
 		var unenrolled bool
 
-		fileExists, fileErr := checkFileFn()
-		if fileErr != nil {
-			log.Error().Err(fileErr).Msg("checking for existence of cloudConfigProfileInstalled in migration modal")
-		} else if fileExists {
-			log.Info().Msg("checking for existence of cloudConfigProfileInstalled in migration modal: found")
-		} else {
-			log.Info().Msg("checking for existence of cloudConfigProfileInstalled in migration modal: not found")
-			unenrolled = true
+		if isADEMigration {
+			fileExists, fileErr := checkFileFn()
+			if fileErr != nil {
+				log.Error().Err(fileErr).Msg("checking for existence of cloudConfigProfileInstalled in migration modal")
+			} else if fileExists {
+				log.Info().Msg("checking for existence of cloudConfigProfileInstalled in migration modal: found")
+			} else {
+				log.Info().Msg("checking for existence of cloudConfigProfileInstalled in migration modal: not found")
+				unenrolled = true
+			}
 		}
 
 		statusEnrolled, serverURL, statusErr := checkStatusFn()
@@ -326,7 +365,33 @@ func (m *swiftDialogMDMMigrator) waitForUnenrollment() error {
 }
 
 func (m *swiftDialogMDMMigrator) renderMigration() error {
-	message, flags, err := m.getMessageAndFlags()
+	log.Debug().Msg("checking current enrollment status")
+	isCurrentlyManuallyEnrolled, err := profiles.IsManuallyEnrolledInMDM()
+	if err != nil {
+		return err
+	}
+
+	// Check what kind of migration was in progress, if any.
+	previousMigrationType, err := m.mrw.GetMigrationType()
+	if err != nil {
+		log.Error().Err(err).Msg("getting migration type")
+		return fmt.Errorf("getting migration type: %w", err)
+	}
+
+	isManualMigration := isCurrentlyManuallyEnrolled || previousMigrationType == constant.MDMMigrationTypeManual
+	isADEMigration := previousMigrationType == constant.MDMMigrationTypeADE
+
+	log.Debug().Bool("isManualMigration", isManualMigration).Bool("isADEMigration", isADEMigration).Bool("isCurrentlyManuallyEnrolled", isCurrentlyManuallyEnrolled).Str("previousMigrationType", previousMigrationType).Msg("props after assigning")
+
+	vers, err := m.getMacOSMajorVersion()
+	if err != nil {
+		// log error for debugging and continue with default template
+		log.Error().Err(err).Msg("getting macOS major version failed: using default migration template")
+	}
+
+	isPreSonoma := vers < constant.SonomaMajorVersion
+
+	message, flags, err := m.getMessageAndFlags(vers, isManualMigration)
 	if err != nil {
 		return fmt.Errorf("getting mdm migrator message: %w", err)
 	}
@@ -342,9 +407,24 @@ func (m *swiftDialogMDMMigrator) renderMigration() error {
 			return nil
 		}
 
+		if previousMigrationType == constant.MDMMigrationTypeADE {
+			// Do nothing; the Remote Management modal will be launched by Orbit every minute.
+			return nil
+		}
+
+		if previousMigrationType == constant.MDMMigrationTypeManual || previousMigrationType == constant.MDMMigrationTypePreSonoma {
+			// Launch the "My device" page.
+			log.Info().Msg("showing instructions")
+
+			if err := m.handler.ShowInstructions(); err != nil {
+				return err
+			}
+			return nil
+		}
+
 		if !m.props.IsUnmanaged {
 			// show the loading spinner
-			m.renderLoadingSpinner()
+			m.renderLoadingSpinner(isPreSonoma, isCurrentlyManuallyEnrolled)
 
 			// send the API call
 			if notifyErr := m.handler.NotifyRemote(); notifyErr != nil {
@@ -361,7 +441,7 @@ func (m *swiftDialogMDMMigrator) renderMigration() error {
 			}
 
 			log.Info().Msg("webhook sent, checking for unenrollment")
-			if err := m.waitForUnenrollment(); err != nil {
+			if err := m.waitForUnenrollment(isADEMigration); err != nil {
 				m.baseDialog.Exit()
 				errDialogExitChan, errDialogErrChan := m.renderError()
 				select {
@@ -374,6 +454,35 @@ func (m *swiftDialogMDMMigrator) renderMigration() error {
 				}
 			}
 
+			switch {
+			case isPreSonoma:
+				if err := m.mrw.SetMigrationFile(constant.MDMMigrationTypePreSonoma); err != nil {
+					log.Error().Str("migration_type", constant.MDMMigrationTypeADE).Err(err).Msg("set migration file")
+				}
+
+				log.Info().Msg("showing instructions after pre-sonoma unenrollment")
+				if err := m.handler.ShowInstructions(); err != nil {
+					return err
+				}
+
+			case isManualMigration:
+				if err := m.mrw.SetMigrationFile(constant.MDMMigrationTypeManual); err != nil {
+					log.Error().Str("migration_type", constant.MDMMigrationTypeManual).Err(err).Msg("set migration file")
+				}
+
+				log.Info().Msg("showing instructions after manual unenrollment")
+				if err := m.handler.ShowInstructions(); err != nil {
+					return err
+				}
+
+				m.frequency = 3 * time.Minute
+
+			default:
+				if err := m.mrw.SetMigrationFile(constant.MDMMigrationTypeADE); err != nil {
+					log.Error().Str("migration_type", constant.MDMMigrationTypeADE).Err(err).Msg("set migration file")
+				}
+			}
+
 			// close the spinner
 			// TODO: maybe it's better to use
 			// https://github.com/bartreardon/swiftDialog/wiki/Updating-Dialog-with-new-content
@@ -381,10 +490,6 @@ func (m *swiftDialogMDMMigrator) renderMigration() error {
 			m.baseDialog.Exit()
 		}
 
-		log.Info().Msg("showing instructions")
-		if err := m.handler.ShowInstructions(); err != nil {
-			return err
-		}
 	}
 
 	return nil
@@ -435,16 +540,14 @@ func (m *swiftDialogMDMMigrator) SetProps(props MDMMigratorProps) {
 	m.props = props
 }
 
-func (m *swiftDialogMDMMigrator) getMessageAndFlags() (*bytes.Buffer, []string, error) {
-	vers, err := m.getMacOSMajorVersion()
-	if err != nil {
-		// log error for debugging and continue with default template
-		log.Error().Err(err).Msg("getting macOS major version failed: using default migration template")
+func (m *swiftDialogMDMMigrator) getMessageAndFlags(version int, isManualMigration bool) (*bytes.Buffer, []string, error) {
+	tmpl := mdmADEMigrationTemplate
+	if isManualMigration {
+		tmpl = mdmManualMigrationTemplate
 	}
 
-	tmpl := mdmMigrationTemplate
 	height := "669"
-	if vers != 0 && vers < 14 {
+	if version != 0 && version < constant.SonomaMajorVersion {
 		height = "440"
 		tmpl = mdmMigrationTemplatePreSonoma
 	}
@@ -454,7 +557,7 @@ func (m *swiftDialogMDMMigrator) getMessageAndFlags() (*bytes.Buffer, []string,
 		&message,
 		m.props,
 	); err != nil {
-		return nil, nil, fmt.Errorf("executing migrqation template: %w", err)
+		return nil, nil, fmt.Errorf("executing migration template: %w", err)
 	}
 
 	flags := []string{
@@ -465,6 +568,13 @@ func (m *swiftDialogMDMMigrator) getMessageAndFlags() (*bytes.Buffer, []string,
 		"--height", height,
 	}
 
+	if !m.props.DisableTakeover {
+		flags = append(flags,
+			"--blurscreen",
+			"--ontop",
+		)
+	}
+
 	if m.props.OrgInfo.ContactURL != "" {
 		flags = append(flags,
 			// info button
@@ -502,3 +612,236 @@ func (m *swiftDialogMDMMigrator) getMacOSMajorVersion() (int, error) {
 	}
 	return major, nil
 }
+
+func (m *swiftDialogMDMMigrator) MigrationInProgress() (string, error) {
+	return m.mrw.GetMigrationType()
+}
+
+func (m *swiftDialogMDMMigrator) MarkMigrationCompleted() error {
+	// Reset this to the original frequency.
+	m.frequency = 15 * time.Minute
+	return m.mrw.RemoveFile()
+}
+
+type offlineWatcher struct {
+	client          *service.DeviceClient
+	swiftDialogPath string
+	// swiftDialogCh is shared with the migrator and used to ensure only one dialog is open at a time
+	swiftDialogCh chan struct{}
+	fileWatcher   migration.FileWatcher
+}
+
+// StartMDMMigrationOfflineWatcher starts a watcher running on a 3-minute loop that checks if the
+// device goes offline in the process of migrating to Fleet's MDM and offline. If so, it shows a
+// dialog to prompt the user to connect to the internet.
+func StartMDMMigrationOfflineWatcher(ctx context.Context, client *service.DeviceClient, swiftDialogPath string, swiftDialogCh chan struct{}, fileWatcher migration.FileWatcher) MDMOfflineWatcher {
+	if cap(swiftDialogCh) != 1 {
+		log.Fatal().Msg("swift dialog channel must have a buffer size of 1")
+	}
+
+	watcher := &offlineWatcher{
+		client:          client,
+		swiftDialogPath: swiftDialogPath,
+		swiftDialogCh:   swiftDialogCh,
+		fileWatcher:     fileWatcher,
+	}
+
+	// start loop with 3-minute interval to ping server and show dialog if offline
+	go func() {
+		ticker := time.NewTicker(constant.MDMMigrationOfflineWatcherInterval)
+		defer ticker.Stop()
+
+		log.Info().Msg("starting watcher loop")
+		for {
+			select {
+			case <-ctx.Done():
+				log.Debug().Msg("stopping offline dialog loop")
+				return
+			case <-ticker.C:
+				log.Debug().Msg("offline dialog, got tick")
+				go watcher.ShowIfOffline(ctx)
+			}
+		}
+	}()
+
+	return watcher
+}
+
+// ShowIfOffline shows the offline dialog if the host is offline.
+// It returns true if the host is offline, and false otherwise.
+func (o *offlineWatcher) ShowIfOffline(ctx context.Context) bool {
+	// try the dialog channel
+	select {
+	case o.swiftDialogCh <- struct{}{}:
+		log.Debug().Msg("occupying dialog channel")
+	default:
+		log.Debug().Msg("dialog channel already occupied")
+		return false
+	}
+
+	defer func() {
+		// non-blocking release of dialog channel
+		select {
+		case <-o.swiftDialogCh:
+			log.Debug().Msg("releasing dialog channel")
+		default:
+			// this shouldn't happen so log for debugging
+			log.Debug().Msg("dialog channel already released")
+		}
+	}()
+
+	if !o.isUnmanaged() || !o.isOffline() {
+		return false
+	}
+
+	log.Info().Msg("showing offline dialog")
+	if err := o.showSwiftDialogMDMMigrationOffline(ctx); err != nil {
+		log.Error().Err(err).Msg("error showing offline dialog")
+	} else {
+		log.Info().Msg("done showing offline dialog")
+	}
+
+	return true
+}
+
+func (o *offlineWatcher) isUnmanaged() bool {
+	mt, err := o.fileWatcher.GetMigrationType()
+	if err != nil {
+		log.Error().Err(err).Msg("getting migration type")
+	}
+
+	if mt == "" {
+		log.Debug().Msg("offline dialog, no migration type found, do nothing")
+		return false
+	}
+
+	log.Debug().Msgf("offline dialog, device is unmanaged, migration type %s", mt)
+
+	return true
+}
+
+func (o *offlineWatcher) isOffline() bool {
+	err := o.client.Ping()
+	if err == nil {
+		log.Debug().Msg("offline dialog, ping ok, device is online")
+		return false
+	}
+	if !isOfflineError(err) {
+		log.Error().Err(err).Msg("offline dialog, error pinging server does not contain dial tcp or no such host, assuming device is online")
+		return false
+	}
+	log.Debug().Err(err).Msg("offline dialog, error pinging server, assuming device is offline")
+
+	return true
+}
+
+func isOfflineError(err error) bool {
+	if err == nil {
+		return false
+	}
+	offlineMsgs := []string{"no such host", "dial tcp", "no route to host"}
+	for _, msg := range offlineMsgs {
+		if strings.Contains(err.Error(), msg) {
+			return true
+		}
+	}
+
+	//  //  NOTE: We're starting with basic string matching and planning to improve error matching
+	//  // in future iterations. Here's some ideas for stuff to add in addition to strings.Contains:
+	// 	if urlErr, ok := err.(*url.Error); ok {
+	// 		log.Info().Msg("is url error")
+	// 		if urlErr.Timeout() {
+	// 			log.Info().Msg("is timeout")
+	// 			return true
+	// 		}
+	// 		// Check for no such host error
+	// 		if opErr, ok := urlErr.Err.(*net.OpError); ok {
+	// 			log.Info().Msg("is net op error")
+	// 			if dnsErr, ok := opErr.Err.(*net.DNSError); ok {
+	// 				log.Info().Msg("is dns error")
+	// 				if dnsErr.Err == "no such host" {
+	// 					log.Info().Msg("is dns no such host")
+	// 					return true
+	// 				}
+	// 			}
+	// 		}
+	// 	}
+
+	return false
+}
+
+// ShowDialogMDMMigrationOffline displays the dialog every time is called
+func (o *offlineWatcher) showSwiftDialogMDMMigrationOffline(ctx context.Context) error {
+	props := MDMMigratorProps{
+		DisableTakeover: true,
+	}
+	m := swiftDialogMDMMigrationOffline{
+		baseDialog: newBaseDialog(o.swiftDialogPath),
+		props:      props,
+	}
+
+	flags, err := m.getFlags()
+	if err != nil {
+		return fmt.Errorf("getting flags for offline dialog: %w", err)
+	}
+
+	exitCodeCh, errCh := m.render(flags...)
+
+	select {
+	case <-ctx.Done():
+		log.Debug().Msg("dialog context canceled")
+		m.baseDialog.Exit()
+		return nil
+	case err := <-errCh:
+		return fmt.Errorf("showing offline dialog: %w", err)
+	case <-exitCodeCh:
+		// there's only one button, so we don't need to check the exit code
+		log.Info().Msg("closing offline dialog")
+		return nil
+	}
+}
+
+type swiftDialogMDMMigrationOffline struct {
+	*baseDialog
+	props MDMMigratorProps
+}
+
+func (m *swiftDialogMDMMigrationOffline) render(flags ...string) (chan swiftDialogExitCode, chan error) {
+	return m.baseDialog.render(flags...)
+}
+
+func (m *swiftDialogMDMMigrationOffline) getFlags() ([]string, error) {
+	tmpl := mdmMigrationTemplateOffline
+	var message bytes.Buffer
+	if err := tmpl.Execute(
+		&message,
+		nil,
+	); err != nil {
+		return nil, fmt.Errorf("executing migration template: %w", err)
+	}
+
+	// disable the built-in title and icon so we have full control over content
+	title := "none"
+	icon := "none"
+
+	flags := []string{
+		"--height", "124",
+		"--alignment", "center",
+		"--title", title,
+		"--icon", icon,
+		// modal content
+		"--message", message.String(),
+		"--messagefont", "size=16",
+		// main button
+		"--button1text", "Close",
+	}
+
+	if !m.props.DisableTakeover {
+		flags = append(flags,
+			"--blurscreen",
+			"--ontop",
+		)
+	}
+
+	return flags, nil
+}
diff --git a/orbit/pkg/useraction/mdm_migration_darwin_test.go b/orbit/pkg/useraction/mdm_migration_darwin_test.go
index 76be50f964..d71cb6fbb6 100644
--- a/orbit/pkg/useraction/mdm_migration_darwin_test.go
+++ b/orbit/pkg/useraction/mdm_migration_darwin_test.go
@@ -17,6 +17,7 @@ func (d dummyHandler) NotifyRemote() error {
 func (d dummyHandler) ShowInstructions() error { return nil }
 
 func TestWaitForUnenrollment(t *testing.T) {
+	t.Parallel()
 	m := &swiftDialogMDMMigrator{
 		handler:                   dummyHandler{},
 		baseDialog:                newBaseDialog("foo/bar"),
@@ -51,7 +52,7 @@ func TestWaitForUnenrollment(t *testing.T) {
 				return true, "example.com", nil
 			}
 
-			outErr := m.waitForUnenrollment()
+			outErr := m.waitForUnenrollment(true)
 			if c.wantErr {
 				require.Error(t, outErr)
 			} else {
@@ -70,7 +71,27 @@ func TestWaitForUnenrollment(t *testing.T) {
 			return false, "", nil
 		}
 
-		outErr := m.waitForUnenrollment()
+		outErr := m.waitForUnenrollment(true)
 		require.NoError(t, outErr)
 	})
+
+	t.Run("only check file during ADE enrollment", func(t *testing.T) {
+		var fileWasChecked bool
+		m.testEnrollmentCheckFileFn = func() (bool, error) {
+			fileWasChecked = true
+			return true, nil
+		}
+
+		m.testEnrollmentCheckStatusFn = func() (bool, string, error) {
+			return false, "", nil
+		}
+
+		err := m.waitForUnenrollment(false)
+		require.NoError(t, err)
+		require.False(t, fileWasChecked)
+
+		err = m.waitForUnenrollment(true)
+		require.NoError(t, err)
+		require.True(t, fileWasChecked)
+	})
 }
diff --git a/orbit/pkg/useraction/mdm_migration_notdarwin.go b/orbit/pkg/useraction/mdm_migration_notdarwin.go
index 98615a193c..5b16b395e0 100644
--- a/orbit/pkg/useraction/mdm_migration_notdarwin.go
+++ b/orbit/pkg/useraction/mdm_migration_notdarwin.go
@@ -2,16 +2,32 @@
 
 package useraction
 
-import "time"
+import (
+	"context"
+	"time"
 
-func NewMDMMigrator(path string, frequency time.Duration, handler MDMMigratorHandler) MDMMigrator {
+	"github.com/fleetdm/fleet/v4/orbit/pkg/migration"
+	"github.com/fleetdm/fleet/v4/server/service"
+)
+
+func NewMDMMigrator(path string, frequency time.Duration, handler MDMMigratorHandler, mrw *migration.ReadWriter, fleetURL string, showCh chan struct{}) MDMMigrator {
 	return &NoopMDMMigrator{}
 }
 
+func StartMDMMigrationOfflineWatcher(ctx context.Context, client *service.DeviceClient, swiftDialogPath string, swiftDialogCh chan struct{}, fileWatcher migration.FileWatcher) MDMOfflineWatcher {
+	return &NoopOfflineWatcher{}
+}
+
+type NoopOfflineWatcher struct{}
+
+func (o *NoopOfflineWatcher) ShowIfOffline(ctx context.Context) bool { return false }
+
 type NoopMDMMigrator struct{}
 
-func (m *NoopMDMMigrator) CanRun() bool              { return false }
-func (m *NoopMDMMigrator) SetProps(MDMMigratorProps) {}
-func (m *NoopMDMMigrator) Show() error               { return nil }
-func (m *NoopMDMMigrator) ShowInterval() error       { return nil }
-func (m *NoopMDMMigrator) Exit()                     {}
+func (m *NoopMDMMigrator) CanRun() bool                         { return false }
+func (m *NoopMDMMigrator) SetProps(MDMMigratorProps)            {}
+func (m *NoopMDMMigrator) Show() error                          { return nil }
+func (m *NoopMDMMigrator) ShowInterval() error                  { return nil }
+func (m *NoopMDMMigrator) Exit()                                {}
+func (m *NoopMDMMigrator) MigrationInProgress() (string, error) { return "", nil }
+func (m *NoopMDMMigrator) MarkMigrationCompleted() error        { return nil }
diff --git a/package.json b/package.json
index 7171ac7fbf..29f8e60a66 100644
--- a/package.json
+++ b/package.json
@@ -18,14 +18,15 @@
   "dependencies": {
     "@types/dompurify": "3.0.2",
     "ace-builds": "1.4.12",
-    "axios": "1.6.0",
+    "axios": "1.7.4",
+    "content-disposition": "0.5.4",
     "core-js": "3.25.1",
     "date-fns": "3.6.0",
     "date-fns-tz": "3.1.3",
-    "dompurify": "3.0.3",
+    "dompurify": "3.1.3",
     "es6-object-assign": "1.1.0",
     "es6-promise": "4.2.8",
-    "express": "4.19.2",
+    "express": "4.20.0",
     "file-saver": "1.3.8",
     "history": "2.1.0",
     "isomorphic-fetch": "3.0.0",
@@ -99,6 +100,7 @@
     "@tsconfig/recommended": "1.0.1",
     "@types/chrome": "0.0.237",
     "@types/classnames": "0.0.32",
+    "@types/content-disposition": "0.5.4",
     "@types/expect": "1.20.3",
     "@types/file-saver": "2.0.5",
     "@types/jest": "29.5.12",
diff --git a/pkg/download/download.go b/pkg/download/download.go
index 89fbea8c3e..23c0f5c152 100644
--- a/pkg/download/download.go
+++ b/pkg/download/download.go
@@ -79,6 +79,10 @@ func download(client *http.Client, u *url.URL, path string, extract bool) error
 		}
 		defer resp.Body.Close()
 
+		if resp.StatusCode != http.StatusOK {
+			return fmt.Errorf("unexpected status code %d", resp.StatusCode)
+		}
+
 		r := io.Reader(resp.Body)
 
 		// extract (optional)
diff --git a/pkg/file/deb.go b/pkg/file/deb.go
index 81351e23d3..35d5881342 100644
--- a/pkg/file/deb.go
+++ b/pkg/file/deb.go
@@ -33,9 +33,9 @@ func ExtractDebMetadata(r io.Reader) (*InstallerMetadata, error) {
 			return nil, fmt.Errorf("failed to advance to next file in archive: %w", err)
 		}
 
-		name := path.Clean(hdr.Name)
-		if strings.HasPrefix(name, "control.tar") {
-			ext := filepath.Ext(name)
+		filename := path.Clean(hdr.Name)
+		if strings.HasPrefix(filename, "control.tar") {
+			ext := filepath.Ext(filename)
 			if ext == ".tar" {
 				ext = ""
 			}
@@ -49,9 +49,10 @@ func ExtractDebMetadata(r io.Reader) (*InstallerMetadata, error) {
 				return nil, fmt.Errorf("failed to read all content: %w", err)
 			}
 			return &InstallerMetadata{
-				Name:    name,
-				Version: version,
-				SHASum:  h.Sum(nil),
+				Name:       name,
+				Version:    version,
+				PackageIDs: []string{name},
+				SHASum:     h.Sum(nil),
 			}, nil
 		}
 	}
diff --git a/pkg/file/file.go b/pkg/file/file.go
index 5b061bcf07..7abd79169f 100644
--- a/pkg/file/file.go
+++ b/pkg/file/file.go
@@ -25,6 +25,7 @@ type InstallerMetadata struct {
 	BundleIdentifier string
 	SHASum           []byte
 	Extension        string
+	PackageIDs       []string
 }
 
 // ExtractInstallerMetadata extracts the software name and version from the
diff --git a/pkg/file/management.go b/pkg/file/management.go
index f5f981d840..26d1294952 100644
--- a/pkg/file/management.go
+++ b/pkg/file/management.go
@@ -16,8 +16,7 @@ var installExeScript string
 //go:embed scripts/install_deb.sh
 var installDebScript string
 
-// GetInstallScript returns a script that can be used to install the
-// the given extension
+// GetInstallScript returns a script that can be used to install the given extension
 func GetInstallScript(extension string) string {
 	switch extension {
 	case "msi":
@@ -61,3 +60,32 @@ func GetRemoveScript(extension string) string {
 		return ""
 	}
 }
+
+//go:embed scripts/uninstall_exe.ps1
+var uninstallExeScript string
+
+//go:embed scripts/uninstall_pkg.sh
+var uninstallPkgScript string
+
+//go:embed scripts/uninstall_msi.ps1
+var uninstallMsiScript string
+
+//go:embed scripts/uninstall_deb.sh
+var uninstallDebScript string
+
+// GetUninstallScript returns a script that can be used to uninstall a
+// software item with the given extension.
+func GetUninstallScript(extension string) string {
+	switch extension {
+	case "msi":
+		return uninstallMsiScript
+	case "deb":
+		return uninstallDebScript
+	case "pkg":
+		return uninstallPkgScript
+	case "exe":
+		return uninstallExeScript
+	default:
+		return ""
+	}
+}
diff --git a/pkg/file/management_test.go b/pkg/file/management_test.go
index 422bb637a6..8b5d8608c5 100644
--- a/pkg/file/management_test.go
+++ b/pkg/file/management_test.go
@@ -7,6 +7,7 @@ import (
 	"path/filepath"
 	"testing"
 
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -19,35 +20,43 @@ func TestMain(m *testing.M) {
 	os.Exit(m.Run())
 }
 
-// Note: to update the goldens, run the tests with `-update`:
+// Note: to update the goldens, delete testdata/scripts/* and run the tests with `-update`:
 //
 // go test ./pkg/file/... -update
 func TestGetInstallAndRemoveScript(t *testing.T) {
-	scriptsByType := map[string][2]string{
+	t.Parallel()
+	scriptsByType := map[string]map[string]string{
 		"msi": {
-			"./scripts/install_msi.ps1",
-			"./scripts/remove_msi.ps1",
+			"install":   "./scripts/install_msi.ps1",
+			"remove":    "./scripts/remove_msi.ps1",
+			"uninstall": "./scripts/uninstall_msi.ps1",
 		},
 		"pkg": {
-			"./scripts/install_pkg.sh",
-			"./scripts/remove_pkg.sh",
+			"install":   "./scripts/install_pkg.sh",
+			"remove":    "./scripts/remove_pkg.sh",
+			"uninstall": "./scripts/uninstall_pkg.sh",
 		},
 		"deb": {
-			"./scripts/install_deb.sh",
-			"./scripts/remove_deb.sh",
+			"install":   "./scripts/install_deb.sh",
+			"remove":    "./scripts/remove_deb.sh",
+			"uninstall": "./scripts/uninstall_deb.sh",
 		},
 		"exe": {
-			"./scripts/install_exe.ps1",
-			"./scripts/remove_exe.ps1",
+			"install":   "./scripts/install_exe.ps1",
+			"remove":    "./scripts/remove_exe.ps1",
+			"uninstall": "./scripts/uninstall_exe.ps1",
 		},
 	}
 
 	for itype, scripts := range scriptsByType {
 		gotScript := GetInstallScript(itype)
-		assertGoldenMatches(t, scripts[0], gotScript, *update)
+		assertGoldenMatches(t, scripts["install"], gotScript, *update)
 
 		gotScript = GetRemoveScript(itype)
-		assertGoldenMatches(t, scripts[1], gotScript, *update)
+		assertGoldenMatches(t, scripts["remove"], gotScript, *update)
+
+		gotScript = GetUninstallScript(itype)
+		assertGoldenMatches(t, scripts["uninstall"], gotScript, *update)
 	}
 }
 
@@ -67,5 +76,5 @@ func assertGoldenMatches(t *testing.T, goldenFile string, actual string, update
 
 	content, err := io.ReadAll(f)
 	require.NoError(t, err)
-	require.Equal(t, string(content), actual)
+	assert.Equal(t, string(content), actual)
 }
diff --git a/pkg/file/msi.go b/pkg/file/msi.go
index 885c28a79b..2568261e64 100644
--- a/pkg/file/msi.go
+++ b/pkg/file/msi.go
@@ -9,7 +9,7 @@ import (
 	"io"
 	"strings"
 
-	"github.com/sassoftware/relic/v7/lib/comdoc"
+	"github.com/sassoftware/relic/v8/lib/comdoc"
 )
 
 func ExtractMSIMetadata(r io.Reader) (*InstallerMetadata, error) {
@@ -77,10 +77,12 @@ func ExtractMSIMetadata(r io.Reader) (*InstallerMetadata, error) {
 		return nil, err
 	}
 
+	// MSI installer product information properties: https://learn.microsoft.com/en-us/windows/win32/msi/property-reference#product-information-properties
 	return &InstallerMetadata{
-		Name:    strings.TrimSpace(props["ProductName"]),
-		Version: strings.TrimSpace(props["ProductVersion"]),
-		SHASum:  h.Sum(nil),
+		Name:       strings.TrimSpace(props["ProductName"]),
+		Version:    strings.TrimSpace(props["ProductVersion"]),
+		PackageIDs: []string{strings.TrimSpace(props["ProductCode"])},
+		SHASum:     h.Sum(nil),
 	}, nil
 }
 
diff --git a/pkg/file/pe.go b/pkg/file/pe.go
index 1b0e053c09..70d2596ec0 100644
--- a/pkg/file/pe.go
+++ b/pkg/file/pe.go
@@ -50,10 +50,12 @@ func ExtractPEMetadata(r io.Reader) (*InstallerMetadata, error) {
 	if err != nil {
 		return nil, fmt.Errorf("error parsing PE version resources: %w", err)
 	}
+	name := strings.TrimSpace(v["ProductName"])
 	return applySpecialCases(&InstallerMetadata{
-		Name:    strings.TrimSpace(v["ProductName"]),
-		Version: strings.TrimSpace(v["ProductVersion"]),
-		SHASum:  h.Sum(nil),
+		Name:       name,
+		Version:    strings.TrimSpace(v["ProductVersion"]),
+		PackageIDs: []string{name},
+		SHASum:     h.Sum(nil),
 	}, v), nil
 }
 
diff --git a/pkg/file/pe_test.go b/pkg/file/pe_test.go
new file mode 100644
index 0000000000..0bfd0776aa
--- /dev/null
+++ b/pkg/file/pe_test.go
@@ -0,0 +1,21 @@
+package file
+
+import (
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestExtractPEMetadata(t *testing.T) {
+	t.Parallel()
+	file, err := os.Open("testdata/software-installers/hello-world-installer.exe")
+	require.NoError(t, err)
+	meta, err := ExtractPEMetadata(file)
+	require.NoError(t, err)
+	require.NotNil(t, meta)
+	assert.Equal(t, "Hello world", meta.Name)
+	assert.Equal(t, "1.0.0", meta.Version)
+	assert.Equal(t, []string{"Hello world"}, meta.PackageIDs)
+}
diff --git a/pkg/file/scripts/install_exe.ps1 b/pkg/file/scripts/install_exe.ps1
index f9d762b318..f4e83b4de3 100644
--- a/pkg/file/scripts/install_exe.ps1
+++ b/pkg/file/scripts/install_exe.ps1
@@ -1,16 +1,29 @@
+# Learn more about .exe install scripts:
+# http://fleetdm.com/learn-more-about/exe-install-scripts
+
 $exeFilePath = "${env:INSTALLER_PATH}"
 
-# extract the name of the executable to use as the sub-directory name
-$exeName = [System.IO.Path]::GetFileName($exeFilePath)
-$subDir = [System.IO.Path]::GetFileNameWithoutExtension($exeFilePath)
+try {
 
-$destinationPath = Join-Path -Path $env:ProgramFiles -ChildPath $subDir
-
-# check if the directory does not exist, and create it if necessary
-if (-not (Test-Path -Path $destinationPath)) {
-    New-Item -ItemType Directory -Path $destinationPath
+# Add argument to install silently
+# Argument to make install silent depends on installer,
+# each installer might use different argument (usually it's "/S" or "/s")
+$processOptions = @{
+  FilePath = "$exeFilePath"
+  ArgumentList = "/S"
+  PassThru = $true
+  Wait = $true
 }
+    
+# Start process and track exit code
+$process = Start-Process @processOptions
+$exitCode = $process.ExitCode
 
-# copy the .exe file to the new sub-directory
-$destinationExePath = Join-Path -Path $destinationPath -ChildPath $exeName
-Copy-Item -Path $exeFilePath -Destination $destinationExePath
+# Prints the exit code
+Write-Host "Install exit code: $exitCode"
+Exit $exitCode
+
+} catch {
+  Write-Host "Error: $_"
+  Exit 1
+}
diff --git a/pkg/file/scripts/install_msi.ps1 b/pkg/file/scripts/install_msi.ps1
index 838c431c1d..fbd89aa10b 100644
--- a/pkg/file/scripts/install_msi.ps1
+++ b/pkg/file/scripts/install_msi.ps1
@@ -1,9 +1,16 @@
 $logFile = "${env:TEMP}/fleet-install-software.log"
 
+try {
+
 $installProcess = Start-Process msiexec.exe `
   -ArgumentList "/quiet /norestart /lv ${logFile} /i `"${env:INSTALLER_PATH}`"" `
   -PassThru -Verb RunAs -Wait
 
 Get-Content $logFile -Tail 500
 
-exit $installProcess.ExitCode
+Exit $installProcess.ExitCode
+
+} catch {
+  Write-Host "Error: $_"
+  Exit 1
+}
diff --git a/pkg/file/scripts/uninstall_deb.sh b/pkg/file/scripts/uninstall_deb.sh
new file mode 100644
index 0000000000..b88a15a880
--- /dev/null
+++ b/pkg/file/scripts/uninstall_deb.sh
@@ -0,0 +1,4 @@
+package_name=$PACKAGE_ID
+
+# Fleet uninstalls app using product name that's extracted on upload
+apt-get remove --purge --assume-yes "$package_name"
diff --git a/pkg/file/scripts/uninstall_exe.ps1 b/pkg/file/scripts/uninstall_exe.ps1
new file mode 100644
index 0000000000..bc6ea14214
--- /dev/null
+++ b/pkg/file/scripts/uninstall_exe.ps1
@@ -0,0 +1,91 @@
+# Fleet extracts name from installer (EXE) and saves it to PACKAGE_ID
+# variable
+$softwareName = $PACKAGE_ID
+
+# It is recommended to use exact software name here if possible to avoid
+# uninstalling unintended software.
+$softwareNameLike = "*$softwareName*"
+
+# Some uninstallers require a flag to run silently.
+# Each uninstaller might use different argument (usually it's "/S" or "/s")
+$uninstallArgs = "/S"
+
+$machineKey = `
+ 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*'
+$machineKey32on64 = `
+ 'HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
+
+$exitCode = 0
+
+try {
+
+[array]$uninstallKeys = Get-ChildItem `
+    -Path @($machineKey, $machineKey32on64) `
+    -ErrorAction SilentlyContinue |
+        ForEach-Object { Get-ItemProperty $_.PSPath }
+
+$foundUninstaller = $false
+foreach ($key in $uninstallKeys) {
+    # If needed, add -notlike to the comparison to exclude certain similar
+    # software
+    if ($key.DisplayName -like $softwareNameLike) {
+        $foundUninstaller = $true
+        # Get the uninstall command. Some uninstallers do not include
+        # 'QuietUninstallString' and require a flag to run silently.
+        $uninstallCommand = if ($key.QuietUninstallString) {
+            $key.QuietUninstallString
+        } else {
+            $key.UninstallString
+        }
+
+        # The uninstall command may contain command and args, like:
+        # "C:\Program Files\Software\uninstall.exe" --uninstall --silent
+        # Split the command and args
+        $splitArgs = $uninstallCommand.Split('"')
+        if ($splitArgs.Length -gt 1) {
+            if ($splitArgs.Length -eq 3) {
+                $uninstallArgs = "$( $splitArgs[2] ) $uninstallArgs".Trim()
+            } elseif ($splitArgs.Length -gt 3) {
+                Throw `
+                    "Uninstall command contains multiple quoted strings. " +
+                        "Please update the uninstall script.`n" +
+                        "Uninstall command: $uninstallCommand"
+            }
+            $uninstallCommand = $splitArgs[1]
+        }
+        Write-Host "Uninstall command: $uninstallCommand"
+        Write-Host "Uninstall args: $uninstallArgs"
+
+        $processOptions = @{
+            FilePath = $uninstallCommand
+            PassThru = $true
+            Wait = $true
+        }
+        if ($uninstallArgs -ne '') {
+            $processOptions.ArgumentList = "$uninstallArgs"
+        }
+
+        # Start process and track exit code
+        $process = Start-Process @processOptions
+        $exitCode = $process.ExitCode
+
+        # Prints the exit code
+        Write-Host "Uninstall exit code: $exitCode"
+        # Exit the loop once the software is found and uninstalled.
+        break
+    }
+}
+
+if (-not $foundUninstaller) {
+    Write-Host "Uninstaller for '$softwareName' not found."
+    # Change exit code to 0 if you don't want to fail if uninstaller is not
+    # found. This could happen if program was already uninstalled.
+    $exitCode = 1
+}
+
+} catch {
+    Write-Host "Error: $_"
+    $exitCode = 1
+}
+
+Exit $exitCode
diff --git a/pkg/file/scripts/uninstall_msi.ps1 b/pkg/file/scripts/uninstall_msi.ps1
new file mode 100644
index 0000000000..ca6b350b2b
--- /dev/null
+++ b/pkg/file/scripts/uninstall_msi.ps1
@@ -0,0 +1,5 @@
+$product_code = $PACKAGE_ID
+
+# Fleet uninstalls app using product code that's extracted on upload
+msiexec /quiet /x $product_code
+Exit $LASTEXITCODE
diff --git a/pkg/file/scripts/uninstall_pkg.sh b/pkg/file/scripts/uninstall_pkg.sh
new file mode 100644
index 0000000000..473cff971b
--- /dev/null
+++ b/pkg/file/scripts/uninstall_pkg.sh
@@ -0,0 +1,21 @@
+#!/bin/sh
+
+# Fleet extracts and saves package IDs.
+pkg_ids=$PACKAGE_ID
+
+# Get all files associated with package and remove them
+for pkg_id in "${pkg_ids[@]}"
+do
+  # Get volume and location of package
+  volume=$(pkgutil --pkg-info "$pkg_id" | grep -i "volume" | awk '{for (i=2; i<NF; i++) printf $i " "; print $NF}')
+  location=$(pkgutil --pkg-info "$pkg_id" | grep -i "location" | awk '{for (i=2; i<NF; i++) printf $i " "; print $NF}')
+  # Check if this package id corresponds to a valid/installed package
+  if [[ ! -z "$volume" && ! -z "$location" ]]; then
+    # Remove individual files/directories belonging to package
+    pkgutil --files "$pkg_id" | sed -e 's@^@'"$volume""$location"'/@' | tr '\n' '\0' | xargs -n 1 -0 rm -rf
+    # Remove receipts
+    pkgutil --forget "$pkg_id"
+  else
+    echo "WARNING: volume or location are empty for package ID $pkg_id"
+  fi
+done
diff --git a/pkg/file/testdata/distribution/test-zero-installkbytes.xml b/pkg/file/testdata/distribution/test-zero-installkbytes.xml
new file mode 100644
index 0000000000..5e8b36380a
--- /dev/null
+++ b/pkg/file/testdata/distribution/test-zero-installkbytes.xml
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="utf-8" standalone="yes"?>
+<installer-gui-script minSpecVersion="2">
+    <pkg-ref id="com.bozo.zeroinstallsize" installKBytes="0" packageIdentifier="com.bozo.zeroinstallsize.app">
+        <bundle-version>
+            <bundle CFBundleShortVersionString="1.2.3" CFBundleVersion="8.10.34.234040" id="com.bozo.zeroinstallsize" path="ZeroInstallSize.app"/>
+        </bundle-version>
+    </pkg-ref>
+    <product id="com.bozo.zeroinstallsize" version="1.2.3"/>
+    <title>ZeroInstallSize</title>
+</installer-gui-script>
diff --git a/pkg/file/testdata/scripts/install_exe.ps1.golden b/pkg/file/testdata/scripts/install_exe.ps1.golden
index f9d762b318..f4e83b4de3 100644
--- a/pkg/file/testdata/scripts/install_exe.ps1.golden
+++ b/pkg/file/testdata/scripts/install_exe.ps1.golden
@@ -1,16 +1,29 @@
+# Learn more about .exe install scripts:
+# http://fleetdm.com/learn-more-about/exe-install-scripts
+
 $exeFilePath = "${env:INSTALLER_PATH}"
 
-# extract the name of the executable to use as the sub-directory name
-$exeName = [System.IO.Path]::GetFileName($exeFilePath)
-$subDir = [System.IO.Path]::GetFileNameWithoutExtension($exeFilePath)
+try {
 
-$destinationPath = Join-Path -Path $env:ProgramFiles -ChildPath $subDir
-
-# check if the directory does not exist, and create it if necessary
-if (-not (Test-Path -Path $destinationPath)) {
-    New-Item -ItemType Directory -Path $destinationPath
+# Add argument to install silently
+# Argument to make install silent depends on installer,
+# each installer might use different argument (usually it's "/S" or "/s")
+$processOptions = @{
+  FilePath = "$exeFilePath"
+  ArgumentList = "/S"
+  PassThru = $true
+  Wait = $true
 }
+    
+# Start process and track exit code
+$process = Start-Process @processOptions
+$exitCode = $process.ExitCode
 
-# copy the .exe file to the new sub-directory
-$destinationExePath = Join-Path -Path $destinationPath -ChildPath $exeName
-Copy-Item -Path $exeFilePath -Destination $destinationExePath
+# Prints the exit code
+Write-Host "Install exit code: $exitCode"
+Exit $exitCode
+
+} catch {
+  Write-Host "Error: $_"
+  Exit 1
+}
diff --git a/pkg/file/testdata/scripts/install_msi.ps1.golden b/pkg/file/testdata/scripts/install_msi.ps1.golden
index 838c431c1d..fbd89aa10b 100644
--- a/pkg/file/testdata/scripts/install_msi.ps1.golden
+++ b/pkg/file/testdata/scripts/install_msi.ps1.golden
@@ -1,9 +1,16 @@
 $logFile = "${env:TEMP}/fleet-install-software.log"
 
+try {
+
 $installProcess = Start-Process msiexec.exe `
   -ArgumentList "/quiet /norestart /lv ${logFile} /i `"${env:INSTALLER_PATH}`"" `
   -PassThru -Verb RunAs -Wait
 
 Get-Content $logFile -Tail 500
 
-exit $installProcess.ExitCode
+Exit $installProcess.ExitCode
+
+} catch {
+  Write-Host "Error: $_"
+  Exit 1
+}
diff --git a/pkg/file/testdata/scripts/uninstall_deb.sh.golden b/pkg/file/testdata/scripts/uninstall_deb.sh.golden
new file mode 100644
index 0000000000..b88a15a880
--- /dev/null
+++ b/pkg/file/testdata/scripts/uninstall_deb.sh.golden
@@ -0,0 +1,4 @@
+package_name=$PACKAGE_ID
+
+# Fleet uninstalls app using product name that's extracted on upload
+apt-get remove --purge --assume-yes "$package_name"
diff --git a/pkg/file/testdata/scripts/uninstall_exe.ps1.golden b/pkg/file/testdata/scripts/uninstall_exe.ps1.golden
new file mode 100644
index 0000000000..bc6ea14214
--- /dev/null
+++ b/pkg/file/testdata/scripts/uninstall_exe.ps1.golden
@@ -0,0 +1,91 @@
+# Fleet extracts name from installer (EXE) and saves it to PACKAGE_ID
+# variable
+$softwareName = $PACKAGE_ID
+
+# It is recommended to use exact software name here if possible to avoid
+# uninstalling unintended software.
+$softwareNameLike = "*$softwareName*"
+
+# Some uninstallers require a flag to run silently.
+# Each uninstaller might use different argument (usually it's "/S" or "/s")
+$uninstallArgs = "/S"
+
+$machineKey = `
+ 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*'
+$machineKey32on64 = `
+ 'HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
+
+$exitCode = 0
+
+try {
+
+[array]$uninstallKeys = Get-ChildItem `
+    -Path @($machineKey, $machineKey32on64) `
+    -ErrorAction SilentlyContinue |
+        ForEach-Object { Get-ItemProperty $_.PSPath }
+
+$foundUninstaller = $false
+foreach ($key in $uninstallKeys) {
+    # If needed, add -notlike to the comparison to exclude certain similar
+    # software
+    if ($key.DisplayName -like $softwareNameLike) {
+        $foundUninstaller = $true
+        # Get the uninstall command. Some uninstallers do not include
+        # 'QuietUninstallString' and require a flag to run silently.
+        $uninstallCommand = if ($key.QuietUninstallString) {
+            $key.QuietUninstallString
+        } else {
+            $key.UninstallString
+        }
+
+        # The uninstall command may contain command and args, like:
+        # "C:\Program Files\Software\uninstall.exe" --uninstall --silent
+        # Split the command and args
+        $splitArgs = $uninstallCommand.Split('"')
+        if ($splitArgs.Length -gt 1) {
+            if ($splitArgs.Length -eq 3) {
+                $uninstallArgs = "$( $splitArgs[2] ) $uninstallArgs".Trim()
+            } elseif ($splitArgs.Length -gt 3) {
+                Throw `
+                    "Uninstall command contains multiple quoted strings. " +
+                        "Please update the uninstall script.`n" +
+                        "Uninstall command: $uninstallCommand"
+            }
+            $uninstallCommand = $splitArgs[1]
+        }
+        Write-Host "Uninstall command: $uninstallCommand"
+        Write-Host "Uninstall args: $uninstallArgs"
+
+        $processOptions = @{
+            FilePath = $uninstallCommand
+            PassThru = $true
+            Wait = $true
+        }
+        if ($uninstallArgs -ne '') {
+            $processOptions.ArgumentList = "$uninstallArgs"
+        }
+
+        # Start process and track exit code
+        $process = Start-Process @processOptions
+        $exitCode = $process.ExitCode
+
+        # Prints the exit code
+        Write-Host "Uninstall exit code: $exitCode"
+        # Exit the loop once the software is found and uninstalled.
+        break
+    }
+}
+
+if (-not $foundUninstaller) {
+    Write-Host "Uninstaller for '$softwareName' not found."
+    # Change exit code to 0 if you don't want to fail if uninstaller is not
+    # found. This could happen if program was already uninstalled.
+    $exitCode = 1
+}
+
+} catch {
+    Write-Host "Error: $_"
+    $exitCode = 1
+}
+
+Exit $exitCode
diff --git a/pkg/file/testdata/scripts/uninstall_msi.ps1.golden b/pkg/file/testdata/scripts/uninstall_msi.ps1.golden
new file mode 100644
index 0000000000..ca6b350b2b
--- /dev/null
+++ b/pkg/file/testdata/scripts/uninstall_msi.ps1.golden
@@ -0,0 +1,5 @@
+$product_code = $PACKAGE_ID
+
+# Fleet uninstalls app using product code that's extracted on upload
+msiexec /quiet /x $product_code
+Exit $LASTEXITCODE
diff --git a/pkg/file/testdata/scripts/uninstall_pkg.sh.golden b/pkg/file/testdata/scripts/uninstall_pkg.sh.golden
new file mode 100644
index 0000000000..473cff971b
--- /dev/null
+++ b/pkg/file/testdata/scripts/uninstall_pkg.sh.golden
@@ -0,0 +1,21 @@
+#!/bin/sh
+
+# Fleet extracts and saves package IDs.
+pkg_ids=$PACKAGE_ID
+
+# Get all files associated with package and remove them
+for pkg_id in "${pkg_ids[@]}"
+do
+  # Get volume and location of package
+  volume=$(pkgutil --pkg-info "$pkg_id" | grep -i "volume" | awk '{for (i=2; i<NF; i++) printf $i " "; print $NF}')
+  location=$(pkgutil --pkg-info "$pkg_id" | grep -i "location" | awk '{for (i=2; i<NF; i++) printf $i " "; print $NF}')
+  # Check if this package id corresponds to a valid/installed package
+  if [[ ! -z "$volume" && ! -z "$location" ]]; then
+    # Remove individual files/directories belonging to package
+    pkgutil --files "$pkg_id" | sed -e 's@^@'"$volume""$location"'/@' | tr '\n' '\0' | xargs -n 1 -0 rm -rf
+    # Remove receipts
+    pkgutil --forget "$pkg_id"
+  else
+    echo "WARNING: volume or location are empty for package ID $pkg_id"
+  fi
+done
diff --git a/pkg/file/testdata/software-installers/README.md b/pkg/file/testdata/software-installers/README.md
new file mode 100644
index 0000000000..d655ba739a
--- /dev/null
+++ b/pkg/file/testdata/software-installers/README.md
@@ -0,0 +1 @@
+- `hello-world-installer.exe` is an installer with a text file. It was created using [Inno Setup](https://jrsoftware.org/isinfo.php) on Windows.
diff --git a/pkg/file/testdata/software-installers/hello-world-installer.exe b/pkg/file/testdata/software-installers/hello-world-installer.exe
new file mode 100755
index 0000000000..48ab4d1444
Binary files /dev/null and b/pkg/file/testdata/software-installers/hello-world-installer.exe differ
diff --git a/pkg/file/xar.go b/pkg/file/xar.go
index e4d75f9b5c..4bbbd3ebfb 100644
--- a/pkg/file/xar.go
+++ b/pkg/file/xar.go
@@ -123,6 +123,7 @@ type distributionPkgRef struct {
 	BundleVersions    []distributionBundleVersion `xml:"bundle-version"`
 	MustClose         distributionMustClose       `xml:"must-close"`
 	PackageIdentifier string                      `xml:"packageIdentifier,attr"`
+	InstallKBytes     string                      `xml:"installKBytes,attr"`
 }
 
 // distributionBundleVersion represents the bundle-version element
@@ -223,21 +224,55 @@ func parseDistributionFile(rawXML []byte) (*InstallerMetadata, error) {
 		return nil, fmt.Errorf("unmarshal Distribution XML: %w", err)
 	}
 
-	name, identifier, version := getDistributionInfo(&distXML)
+	name, identifier, version, packageIDs := getDistributionInfo(&distXML)
 	return &InstallerMetadata{
 		Name:             name,
 		Version:          version,
 		BundleIdentifier: identifier,
+		PackageIDs:       packageIDs,
 	}, nil
 
 }
 
 // getDistributionInfo gets the name, bundle identifier and version of a PKG distribution file
-func getDistributionInfo(d *distributionXML) (name string, identifier string, version string) {
+func getDistributionInfo(d *distributionXML) (name string, identifier string, version string, packageIDs []string) {
 	var appVersion string
 
+	// find the package ids that have an installation size
+	var packageIDSet = make(map[string]struct{}, 1)
+	for _, pkg := range d.PkgRefs {
+		if pkg.InstallKBytes != "" && pkg.InstallKBytes != "0" {
+			var id string
+			if pkg.PackageIdentifier != "" {
+				id = pkg.PackageIdentifier
+			} else if pkg.ID != "" {
+				id = pkg.ID
+			}
+			if id != "" {
+				packageIDSet[id] = struct{}{}
+			}
+		}
+	}
+	if len(packageIDSet) == 0 {
+		// if we didn't find any package IDs with installation size, then grab all of them
+		for _, pkg := range d.PkgRefs {
+			var id string
+			if pkg.PackageIdentifier != "" {
+				id = pkg.PackageIdentifier
+			} else if pkg.ID != "" {
+				id = pkg.ID
+			}
+			if id != "" {
+				packageIDSet[id] = struct{}{}
+			}
+		}
+	}
+	for id := range packageIDSet {
+		packageIDs = append(packageIDs, id)
+	}
+
 out:
-	// first, look in all the bundle versions for one that has a `path` attribute
+	// look in all the bundle versions for one that has a `path` attribute
 	// that is not nested, this is generally the case for packages that distribute
 	// `.app` files, which are ultimately picked up as an installed app by osquery
 	for _, pkg := range d.PkgRefs {
@@ -284,6 +319,11 @@ out:
 		identifier = d.Product.ID
 	}
 
+	// if package IDs are still empty, use the identifier as the package ID
+	if len(packageIDs) == 0 && identifier != "" {
+		packageIDs = append(packageIDs, identifier)
+	}
+
 	// for the name, try to use the title and fallback to the bundle
 	// identifier
 	if name == "" && d.Title != "" {
@@ -296,7 +336,7 @@ out:
 	// for the version, try to use the top-level product version, if not,
 	// fallback to any version definition alongside the name or the first
 	// version in a pkg-ref we find.
-	if version == "" && d.Product.Version != "" {
+	if d.Product.Version != "" {
 		version = d.Product.Version
 	}
 	if version == "" && appVersion != "" {
@@ -310,7 +350,7 @@ out:
 		}
 	}
 
-	return name, identifier, version
+	return name, identifier, version, packageIDs
 }
 
 // isValidAppFilePath checks if the given input is a file name ending with .app
diff --git a/pkg/file/xar_test.go b/pkg/file/xar_test.go
index cef5230fb9..be1cc7d278 100644
--- a/pkg/file/xar_test.go
+++ b/pkg/file/xar_test.go
@@ -8,6 +8,7 @@ import (
 	"path/filepath"
 	"testing"
 
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -52,113 +53,147 @@ func TestCheckPKGSignature(t *testing.T) {
 }
 
 func TestParseRealDistributionFiles(t *testing.T) {
+	t.Parallel()
 	tests := []struct {
-		file             string
-		expectedName     string
-		expectedVersion  string
-		expectedBundleID string
+		file               string
+		expectedName       string
+		expectedVersion    string
+		expectedBundleID   string
+		expectedPackageIDs []string
 	}{
 		{
-			file:             "distribution-1password.xml",
-			expectedName:     "1Password.app",
-			expectedVersion:  "8.10.34",
-			expectedBundleID: "com.1password.1password",
+			file:               "distribution-1password.xml",
+			expectedName:       "1Password.app",
+			expectedVersion:    "8.10.34",
+			expectedBundleID:   "com.1password.1password",
+			expectedPackageIDs: []string{"com.1password.1password"},
 		},
 		{
-			file:             "distribution-chrome.xml",
-			expectedName:     "Google Chrome.app",
-			expectedVersion:  "126.0.6478.62",
-			expectedBundleID: "com.google.Chrome",
+			file:               "distribution-chrome.xml",
+			expectedName:       "Google Chrome.app",
+			expectedVersion:    "126.0.6478.62",
+			expectedBundleID:   "com.google.Chrome",
+			expectedPackageIDs: []string{"com.google.Chrome"},
 		},
 		{
-			file:             "distribution-edge.xml",
-			expectedName:     "Microsoft Edge.app",
-			expectedVersion:  "126.0.2592.56",
-			expectedBundleID: "com.microsoft.edgemac",
+			file:               "distribution-edge.xml",
+			expectedName:       "Microsoft Edge.app",
+			expectedVersion:    "126.0.2592.56",
+			expectedBundleID:   "com.microsoft.edgemac",
+			expectedPackageIDs: []string{"com.microsoft.edgemac"},
 		},
 		{
-			file:             "distribution-firefox.xml",
-			expectedName:     "Firefox.app",
-			expectedVersion:  "99.0",
-			expectedBundleID: "org.mozilla.firefox",
+			file:               "distribution-firefox.xml",
+			expectedName:       "Firefox.app",
+			expectedVersion:    "99.0",
+			expectedBundleID:   "org.mozilla.firefox",
+			expectedPackageIDs: []string{"org.mozilla.firefox"},
 		},
 		{
-			file:             "distribution-fleet.xml",
-			expectedName:     "Fleet osquery",
-			expectedVersion:  "42.0.0",
-			expectedBundleID: "com.fleetdm.orbit",
+			file:               "distribution-fleet.xml",
+			expectedName:       "Fleet osquery",
+			expectedVersion:    "42.0.0",
+			expectedBundleID:   "com.fleetdm.orbit",
+			expectedPackageIDs: []string{"com.fleetdm.orbit.base.pkg"},
 		},
 		{
-			file:             "distribution-go.xml",
-			expectedName:     "Go",
-			expectedVersion:  "go1.22.4",
-			expectedBundleID: "org.golang.go",
+			file:               "distribution-go.xml",
+			expectedName:       "Go",
+			expectedVersion:    "go1.22.4",
+			expectedBundleID:   "org.golang.go",
+			expectedPackageIDs: []string{"org.golang.go"},
 		},
 		{
 			file:             "distribution-microsoft-teams.xml",
 			expectedName:     "Microsoft Teams.app",
 			expectedVersion:  "24124.1412.2911.3341",
 			expectedBundleID: "com.microsoft.teams2",
+			expectedPackageIDs: []string{"com.microsoft.teams2", "com.microsoft.package.Microsoft_AutoUpdate.app",
+				"com.microsoft.MSTeamsAudioDevice"},
 		},
 		{
-			file:             "distribution-zoom.xml",
-			expectedName:     "zoom.us.app",
-			expectedVersion:  "6.0.11.35001",
-			expectedBundleID: "us.zoom.xos",
+			file:               "distribution-zoom.xml",
+			expectedName:       "zoom.us.app",
+			expectedVersion:    "6.0.11.35001",
+			expectedBundleID:   "us.zoom.xos",
+			expectedPackageIDs: []string{"us.zoom.pkg.videomeeting"},
 		},
 		{
 			file:             "distribution-acrobatreader.xml",
 			expectedName:     "Adobe Acrobat Reader.app",
 			expectedVersion:  "24.002.20857",
 			expectedBundleID: "com.adobe.Reader",
+			expectedPackageIDs: []string{"com.adobe.acrobat.DC.reader.app.pkg.MUI", "com.adobe.acrobat.DC.reader.appsupport.pkg.MUI",
+				"com.adobe.acrobat.reader.DC.reader.app.pkg.MUI", "com.adobe.armdc.app.pkg"},
 		},
 		{
-			file:             "distribution-airtame.xml",
-			expectedName:     "Airtame.app",
-			expectedVersion:  "4.10.1",
-			expectedBundleID: "com.airtame.airtame-application",
+			file:               "distribution-airtame.xml",
+			expectedName:       "Airtame.app",
+			expectedVersion:    "4.10.1",
+			expectedBundleID:   "com.airtame.airtame-application",
+			expectedPackageIDs: []string{"com.airtame.airtame-application"},
 		},
 		{
 			file:             "distribution-boxdrive.xml",
 			expectedName:     "Box.app",
 			expectedVersion:  "2.38.173",
 			expectedBundleID: "com.box.desktop",
+			expectedPackageIDs: []string{"com.box.desktop.installer.desktop", "com.box.desktop.installer.local.appsupport",
+				"com.box.desktop.installer.autoupdater", "com.box.desktop.installer.osxfuse"},
 		},
 		{
 			file:             "distribution-iriunwebcam.xml",
 			expectedName:     "IriunWebcam.app",
 			expectedVersion:  "2.8.8",
 			expectedBundleID: "com.iriun.macwebcam",
+			// Note: "com.iriun.pkg.multicam" is part of the installer package, but it is not actually installed by default.
+			// We can't reliably determine which packages are installed by the installer, so we just list all of them.
+			expectedPackageIDs: []string{"com.iriun.pkg.webcam.tmp", "com.iriun.pkg.multicam"},
 		},
 		{
 			file:             "distribution-microsoftexcel.xml",
 			expectedName:     "Microsoft Excel.app",
 			expectedVersion:  "16.86",
 			expectedBundleID: "com.microsoft.Excel",
+			expectedPackageIDs: []string{"com.microsoft.package.Microsoft_Excel.app", "com.microsoft.package.Microsoft_AutoUpdate.app",
+				"com.microsoft.pkg.licensing"},
 		},
 		{
 			file:             "distribution-microsoftword.xml",
 			expectedName:     "Microsoft Word.app",
 			expectedVersion:  "16.86",
 			expectedBundleID: "com.microsoft.Word",
+			expectedPackageIDs: []string{"com.microsoft.package.Microsoft_Word.app", "com.microsoft.package.Microsoft_AutoUpdate.app",
+				"com.microsoft.pkg.licensing"},
 		},
 		{
 			file:             "distribution-miscrosoftpowerpoint.xml",
 			expectedName:     "Microsoft PowerPoint.app",
 			expectedVersion:  "16.86",
 			expectedBundleID: "com.microsoft.Powerpoint",
+			expectedPackageIDs: []string{"com.microsoft.package.Microsoft_PowerPoint.app", "com.microsoft.package.Microsoft_AutoUpdate.app",
+				"com.microsoft.pkg.licensing"},
 		},
 		{
-			file:             "distribution-ringcentral.xml",
-			expectedName:     "RingCentral.app",
-			expectedVersion:  "24.1.32.9774",
-			expectedBundleID: "com.ringcentral.glip",
+			file:               "distribution-ringcentral.xml",
+			expectedName:       "RingCentral.app",
+			expectedVersion:    "24.1.32.9774",
+			expectedBundleID:   "com.ringcentral.glip",
+			expectedPackageIDs: []string{"com.ringcentral.glip"},
 		},
 		{
-			file:             "distribution-zoom-full.xml",
-			expectedName:     "Zoom Workplace",
-			expectedVersion:  "6.1.1.36333",
-			expectedBundleID: "us.zoom.xos",
+			file:               "distribution-zoom-full.xml",
+			expectedName:       "Zoom Workplace",
+			expectedVersion:    "6.1.1.36333",
+			expectedBundleID:   "us.zoom.xos",
+			expectedPackageIDs: []string{"us.zoom.pkg.videomeeting"},
+		},
+		{
+			file:               "test-zero-installkbytes.xml",
+			expectedName:       "ZeroInstallSize.app",
+			expectedVersion:    "1.2.3",
+			expectedBundleID:   "com.bozo.zeroinstallsize",
+			expectedPackageIDs: []string{"com.bozo.zeroinstallsize.app"},
 		},
 	}
 
@@ -168,6 +203,7 @@ func TestParseRealDistributionFiles(t *testing.T) {
 			require.NoError(t, err)
 			metadata, err := parseDistributionFile(rawXML)
 			require.NoError(t, err)
+			assert.ElementsMatch(t, tt.expectedPackageIDs, metadata.PackageIDs)
 			require.Equal(t, tt.expectedName, metadata.Name)
 			require.Equal(t, tt.expectedVersion, metadata.Version)
 			require.Equal(t, tt.expectedBundleID, metadata.BundleIdentifier)
diff --git a/pkg/mdm/mdmtest/apple.go b/pkg/mdm/mdmtest/apple.go
index 326d40be60..601fe313b6 100644
--- a/pkg/mdm/mdmtest/apple.go
+++ b/pkg/mdm/mdmtest/apple.go
@@ -33,7 +33,7 @@ import (
 	kitlog "github.com/go-kit/log"
 	"github.com/google/uuid"
 	"github.com/groob/plist"
-	"go.mozilla.org/pkcs7"
+	"github.com/smallstep/pkcs7"
 )
 
 // TestAppleMDMClient simulates a macOS MDM client.
@@ -65,6 +65,13 @@ type TestAppleMDMClient struct {
 	// fetchEnrollmentProfileFromDEP indicates whether this simulated device will fetch
 	// the enrollment profile from Fleet as if it were a device running the DEP flow.
 	fetchEnrollmentProfileFromDEP bool
+
+	// fetchEnrollmentProfileFromOTA indicates whether this simulated device will fetch
+	// the enrollment profile from Fleet as if it were a device running the OTA flow.
+	fetchEnrollmentProfileFromOTA bool
+	// otaEnrollSecret is the team enroll secret to be used during the OTA flow.
+	otaEnrollSecret string
+
 	// desktopURLToken is the token used to fetch the enrollment profile
 	// from Fleet as if it were a device running the DEP flow.
 	depURLToken string
@@ -151,6 +158,24 @@ func NewTestMDMClientAppleDirect(enrollInfo AppleEnrollInfo, model string, opts
 	return &c
 }
 
+// NewTestMDMClientAppleOTA will create a simulated device that will fetch
+// enrollment profile from Fleet as if it were a device running the Over The
+// Air (OTA) flow.
+func NewTestMDMClientAppleOTA(serverURL, enrollSecret, model string, opts ...TestMDMAppleClientOption) *TestAppleMDMClient {
+	c := TestAppleMDMClient{
+		UUID:                          strings.ToUpper(uuid.New().String()),
+		SerialNumber:                  RandSerialNumber(),
+		Model:                         model,
+		fetchEnrollmentProfileFromOTA: true,
+		fleetServerURL:                serverURL,
+		otaEnrollSecret:               enrollSecret,
+	}
+	for _, fn := range opts {
+		fn(&c)
+	}
+	return &c
+}
+
 func (c *TestAppleMDMClient) SetDesktopToken(tok string) {
 	c.desktopURLToken = tok
 }
@@ -170,6 +195,10 @@ func (c *TestAppleMDMClient) Enroll() error {
 		if err := c.fetchEnrollmentProfileFromDEPURL(); err != nil {
 			return fmt.Errorf("get enrollment profile from DEP URL: %w", err)
 		}
+	case c.fetchEnrollmentProfileFromOTA:
+		if err := c.fetchEnrollmentProfileFromOTAURL(); err != nil {
+			return fmt.Errorf("get enrollment profile from OTA URL: %w", err)
+		}
 	default:
 		if c.EnrollInfo.SCEPURL == "" || c.EnrollInfo.MDMURL == "" || c.EnrollInfo.SCEPChallenge == "" {
 			return fmt.Errorf("missing info needed to perform enrollment: %+v", c.EnrollInfo)
@@ -188,7 +217,7 @@ func (c *TestAppleMDMClient) Enroll() error {
 }
 
 func (c *TestAppleMDMClient) fetchEnrollmentProfileFromDesktopURL() error {
-	return c.fetchEnrollmentProfile(
+	return c.fetchOTAProfile(
 		"/api/latest/fleet/device/" + c.desktopURLToken + "/mdm/apple/manual_enrollment_profile",
 	)
 }
@@ -199,6 +228,167 @@ func (c *TestAppleMDMClient) fetchEnrollmentProfileFromDEPURL() error {
 	)
 }
 
+func (c *TestAppleMDMClient) fetchEnrollmentProfileFromOTAURL() error {
+	return c.fetchOTAProfile(
+		"/api/latest/fleet/enrollment_profiles/ota?enroll_secret=" + url.QueryEscape(c.otaEnrollSecret),
+	)
+}
+
+func (c *TestAppleMDMClient) fetchOTAProfile(url string) error {
+	request, err := http.NewRequest("GET", c.fleetServerURL+url, nil)
+	if err != nil {
+		return fmt.Errorf("create request: %w", err)
+	}
+	// #nosec (this client is used for testing only)
+	cc := fleethttp.NewClient(fleethttp.WithTLSClientConfig(&tls.Config{
+		InsecureSkipVerify: true,
+	}))
+	response, err := cc.Do(request)
+	if err != nil {
+		return fmt.Errorf("send request: %w", err)
+	}
+	defer response.Body.Close()
+	if response.StatusCode != http.StatusOK {
+		return fmt.Errorf("request error: %d, %s", response.StatusCode, response.Status)
+	}
+
+	body, err := io.ReadAll(response.Body)
+	if err != nil {
+		return fmt.Errorf("read body: %w", err)
+	}
+
+	p7, err := pkcs7.Parse(body)
+	if err != nil {
+		return fmt.Errorf("OTA profile is not XML nor PKCS7 parseable: %w", err)
+	}
+	err = p7.Verify()
+	if err != nil {
+		return fmt.Errorf("verifying OTA profile: %w", err)
+	}
+
+	var otaEnrollmentProfile struct {
+		PayloadContent struct {
+			URL string `plist:"URL"`
+		} `plist:"PayloadContent"`
+	}
+	err = plist.Unmarshal(p7.Content, &otaEnrollmentProfile)
+	if err != nil {
+		return fmt.Errorf("unmarshaling OTA enrollment response: %w", err)
+	}
+
+	rawDeviceInfo := []byte(fmt.Sprintf(`<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>PRODUCT</key>
+	<string>%s</string>
+	<key>SERIAL</key>
+	<string>%s</string>
+	<key>UDID</key>
+	<string>%s</string>
+	<key>VERSION</key>
+	<string>22A5316k</string>
+</dict>
+</plist>`, c.Model, c.SerialNumber, c.UUID))
+
+	do := func(cert *x509.Certificate, key *rsa.PrivateKey) ([]byte, error) {
+		signedData, err := pkcs7.NewSignedData(rawDeviceInfo)
+		if err != nil {
+			return nil, fmt.Errorf("create signed data: %w", err)
+		}
+		err = signedData.AddSigner(cert, key, pkcs7.SignerInfoConfig{})
+		if err != nil {
+			return nil, fmt.Errorf("add signer: %w", err)
+		}
+		sig, err := signedData.Finish()
+		if err != nil {
+			return nil, fmt.Errorf("finish signing: %w", err)
+		}
+
+		request, err := http.NewRequest(
+			"POST",
+			otaEnrollmentProfile.PayloadContent.URL,
+			bytes.NewReader(sig),
+		)
+		if err != nil {
+			return nil, fmt.Errorf("create request: %w", err)
+		}
+		// #nosec (this client is used for testing only)
+		cc := fleethttp.NewClient(fleethttp.WithTLSClientConfig(&tls.Config{
+			InsecureSkipVerify: true,
+		}))
+		response, err := cc.Do(request)
+		if err != nil {
+			return nil, fmt.Errorf("send request: %w", err)
+		}
+		defer response.Body.Close()
+		if response.StatusCode != http.StatusOK {
+			return nil, fmt.Errorf("request error: %d, %s", response.StatusCode, response.Status)
+		}
+
+		body, err := io.ReadAll(response.Body)
+		if err != nil {
+			return nil, fmt.Errorf("read body: %w", err)
+		}
+
+		return body, nil
+	}
+
+	// TODO(roberto 09-10-2024): the first request in the OTA flow must be
+	// signed using a keypair that has a valid Apple certificate as root. I
+	// believe this could be done with a little bit of reverse
+	// engineering/cleverness but for now, we're signing the request with
+	// our mock certs and setting this env var to skip the verification.
+	os.Setenv("FLEET_DEV_MDM_APPLE_DISABLE_DEVICE_INFO_CERT_VERIFY", "1")
+	mockedCert, mockedKey, err := apple_mdm.NewSCEPCACertKey()
+	if err != nil {
+		return fmt.Errorf("creating mock certificates: %w", err)
+	}
+	body, err = do(mockedCert, mockedKey)
+	if err != nil {
+		return fmt.Errorf("first OTA request: %w", err)
+	}
+	os.Unsetenv("FLEET_DEV_MDM_APPLE_DISABLE_DEVICE_INFO_CERT_VERIFY")
+
+	var scepInfo struct {
+		PayloadContent []struct {
+			PayloadContent struct {
+				Challenge string `plist:"Challenge"`
+				URL       string `plist:"URL"`
+			} `plist:"PayloadContent"`
+		} `plist:"PayloadContent"`
+	}
+
+	err = plist.Unmarshal(body, &scepInfo)
+	if err != nil {
+		return fmt.Errorf("unmarshaling SCEP response: %w", err)
+	}
+
+	tmpCert, tmpKey, err := c.doSCEP(scepInfo.PayloadContent[0].PayloadContent.URL, scepInfo.PayloadContent[0].PayloadContent.Challenge)
+	if err != nil {
+		return fmt.Errorf("get SCEP certificate for OTA: %w", err)
+	}
+
+	body, err = do(tmpCert, tmpKey)
+	if err != nil {
+		return fmt.Errorf("seconde OTA request: %w", err)
+	}
+	p7, err = pkcs7.Parse(body)
+	if err != nil {
+		return fmt.Errorf("enrollment profile is not XML nor PKCS7 parseable: %w", err)
+	}
+	err = p7.Verify()
+	if err != nil {
+		return fmt.Errorf("verifying enrollment profile: %w", err)
+	}
+	enrollInfo, err := ParseEnrollmentProfile(p7.Content)
+	if err != nil {
+		return fmt.Errorf("parse OTA SCEP profile: %w", err)
+	}
+	c.EnrollInfo = *enrollInfo
+	return nil
+}
+
 func (c *TestAppleMDMClient) fetchEnrollmentProfile(path string) error {
 	request, err := http.NewRequest("GET", c.fleetServerURL+path, nil)
 	if err != nil {
@@ -212,6 +402,7 @@ func (c *TestAppleMDMClient) fetchEnrollmentProfile(path string) error {
 	if err != nil {
 		return fmt.Errorf("send request: %w", err)
 	}
+	defer response.Body.Close()
 	if response.StatusCode != http.StatusOK {
 		return fmt.Errorf("request error: %d, %s", response.StatusCode, response.Status)
 	}
@@ -247,8 +438,7 @@ func (c *TestAppleMDMClient) fetchEnrollmentProfile(path string) error {
 	return nil
 }
 
-// SCEPEnroll runs the SCEP enroll protocol for the simulated device.
-func (c *TestAppleMDMClient) SCEPEnroll() error {
+func (c *TestAppleMDMClient) doSCEP(url, challenge string) (*x509.Certificate, *rsa.PrivateKey, error) {
 	ctx := context.Background()
 
 	var logger log.Logger
@@ -257,25 +447,25 @@ func (c *TestAppleMDMClient) SCEPEnroll() error {
 	} else {
 		logger = kitlog.NewNopLogger()
 	}
-	client, err := newSCEPClient(c.EnrollInfo.SCEPURL, logger)
+	client, err := newSCEPClient(url, logger)
 	if err != nil {
-		return fmt.Errorf("scep client: %w", err)
+		return nil, nil, fmt.Errorf("scep client: %w", err)
 	}
 
 	// (1). Get the CA certificate from the SCEP server.
 	resp, _, err := client.GetCACert(ctx, "")
 	if err != nil {
-		return fmt.Errorf("get CA cert: %w", err)
+		return nil, nil, fmt.Errorf("get CA cert: %w", err)
 	}
 	caCert, err := x509.ParseCertificates(resp)
 	if err != nil {
-		return fmt.Errorf("parse CA cert: %w", err)
+		return nil, nil, fmt.Errorf("parse CA cert: %w", err)
 	}
 
 	// (2). Generate RSA key pair.
 	devicePrivateKey, err := rsa.GenerateKey(rand.Reader, 2048)
 	if err != nil {
-		return fmt.Errorf("generate RSA private key: %w", err)
+		return nil, nil, fmt.Errorf("generate RSA private key: %w", err)
 	}
 
 	// (3). Generate CSR.
@@ -288,15 +478,15 @@ func (c *TestAppleMDMClient) SCEPEnroll() error {
 			},
 			SignatureAlgorithm: x509.SHA256WithRSA,
 		},
-		ChallengePassword: c.EnrollInfo.SCEPChallenge,
+		ChallengePassword: challenge,
 	}
 	csrDerBytes, err := x509util.CreateCertificateRequest(rand.Reader, &csrTemplate, devicePrivateKey)
 	if err != nil {
-		return fmt.Errorf("create CSR: %w", err)
+		return nil, nil, fmt.Errorf("create CSR: %w", err)
 	}
 	csr, err := x509.ParseCertificateRequest(csrDerBytes)
 	if err != nil {
-		return fmt.Errorf("parse CSR: %w", err)
+		return nil, nil, fmt.Errorf("parse CSR: %w", err)
 	}
 
 	// (4). SCEP requires a certificate for client authentication. We generate a new one
@@ -312,7 +502,7 @@ func (c *TestAppleMDMClient) SCEPEnroll() error {
 	serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)
 	certSerialNumber, err := rand.Int(rand.Reader, serialNumberLimit)
 	if err != nil {
-		return fmt.Errorf("generate cert serial number: %w", err)
+		return nil, nil, fmt.Errorf("generate cert serial number: %w", err)
 	}
 	deviceCertificateTemplate := x509.Certificate{
 		SerialNumber: certSerialNumber,
@@ -334,11 +524,11 @@ func (c *TestAppleMDMClient) SCEPEnroll() error {
 		devicePrivateKey,
 	)
 	if err != nil {
-		return fmt.Errorf("create device certificate: %w", err)
+		return nil, nil, fmt.Errorf("create device certificate: %w", err)
 	}
 	deviceCertificateForRequest, err := x509.ParseCertificate(deviceCertificateDerBytes)
 	if err != nil {
-		return fmt.Errorf("parse device certificate: %w", err)
+		return nil, nil, fmt.Errorf("parse device certificate: %w", err)
 	}
 
 	// (5). Send the PKCSReq message to the SCEP server.
@@ -353,31 +543,40 @@ func (c *TestAppleMDMClient) SCEPEnroll() error {
 	}
 	msg, err := scep.NewCSRRequest(csr, pkiMsgReq, scep.WithLogger(logger))
 	if err != nil {
-		return fmt.Errorf("create CSR request: %w", err)
+		return nil, nil, fmt.Errorf("create CSR request: %w", err)
 	}
 	respBytes, err := client.PKIOperation(ctx, msg.Raw)
 	if err != nil {
-		return fmt.Errorf("do CSR request: %w", err)
+		return nil, nil, fmt.Errorf("do CSR request: %w", err)
 	}
 	pkiMsgResp, err := scep.ParsePKIMessage(respBytes, scep.WithLogger(logger), scep.WithCACerts(msg.Recipients))
 	if err != nil {
-		return fmt.Errorf("parse PKIMessage response: %w", err)
+		return nil, nil, fmt.Errorf("parse PKIMessage response: %w", err)
 	}
 	if pkiMsgResp.PKIStatus != scep.SUCCESS {
-		return fmt.Errorf("PKIMessage CSR request failed with code: %s, fail info: %s", pkiMsgResp.PKIStatus, pkiMsgResp.FailInfo)
+		return nil, nil, fmt.Errorf("PKIMessage CSR request failed with code: %s, fail info: %s", pkiMsgResp.PKIStatus, pkiMsgResp.FailInfo)
 	}
 	if err := pkiMsgResp.DecryptPKIEnvelope(deviceCertificateForRequest, devicePrivateKey); err != nil {
-		return fmt.Errorf("decrypt PKI envelope: %w", err)
+		return nil, nil, fmt.Errorf("decrypt PKI envelope: %w", err)
 	}
 
-	// (6). Finally, set the signed certificate returned from the server as the device certificate and key.
-	c.scepCert = pkiMsgResp.CertRepMessage.Certificate
-	c.scepKey = devicePrivateKey
-
 	if c.debug {
 		fmt.Println("SCEP enrollment successful")
 	}
 
+	// (6). return the signed certificate returned from the server as the device certificate and key.
+	return pkiMsgResp.CertRepMessage.Certificate, devicePrivateKey, nil
+}
+
+// SCEPEnroll runs the SCEP enroll protocol for the simulated device.
+func (c *TestAppleMDMClient) SCEPEnroll() error {
+	cert, key, err := c.doSCEP(c.EnrollInfo.SCEPURL, c.EnrollInfo.SCEPChallenge)
+	if err != nil {
+		return err
+	}
+
+	c.scepCert = cert
+	c.scepKey = key
 	return nil
 }
 
diff --git a/pkg/spec/gitops.go b/pkg/spec/gitops.go
index b6eea43708..9e4adc2268 100644
--- a/pkg/spec/gitops.go
+++ b/pkg/spec/gitops.go
@@ -7,9 +7,11 @@ import (
 	"os"
 	"path/filepath"
 	"slices"
+	"strings"
 	"unicode"
 
 	"github.com/fleetdm/fleet/v4/server/fleet"
+	"github.com/fleetdm/fleet/v4/server/ptr"
 	"github.com/ghodss/yaml"
 	"github.com/hashicorp/go-multierror"
 	"golang.org/x/text/unicode/norm"
@@ -35,11 +37,33 @@ type Controls struct {
 	EnableDiskEncryption interface{} `json:"enable_disk_encryption"`
 
 	Scripts []BaseItem `json:"scripts"`
+
+	Defined bool
+}
+
+func (c Controls) Set() bool {
+	return c.MacOSUpdates != nil || c.IOSUpdates != nil ||
+		c.IPadOSUpdates != nil || c.MacOSSettings != nil ||
+		c.MacOSSetup != nil || c.MacOSMigration != nil ||
+		c.WindowsUpdates != nil || c.WindowsSettings != nil || c.WindowsEnabledAndConfigured != nil ||
+		c.EnableDiskEncryption != nil || len(c.Scripts) > 0
 }
 
 type Policy struct {
 	BaseItem
+	GitOpsPolicySpec
+}
+
+type GitOpsPolicySpec struct {
 	fleet.PolicySpec
+	InstallSoftware *PolicyInstallSoftware `json:"install_software"`
+	// InstallSoftwareURL is populated after parsing the software installer yaml
+	// referenced by InstallSoftware.PackagePath.
+	InstallSoftwareURL string `json:"-"`
+}
+
+type PolicyInstallSoftware struct {
+	PackagePath string `json:"package_path"`
 }
 
 type Query struct {
@@ -47,6 +71,16 @@ type Query struct {
 	fleet.QuerySpec
 }
 
+type SoftwarePackage struct {
+	BaseItem
+	fleet.SoftwarePackageSpec
+}
+
+type Software struct {
+	Packages     []SoftwarePackage           `json:"packages"`
+	AppStoreApps []fleet.TeamSpecAppStoreApp `json:"app_store_apps"`
+}
+
 type GitOps struct {
 	TeamID       *uint
 	TeamName     *string
@@ -54,19 +88,21 @@ type GitOps struct {
 	OrgSettings  map[string]interface{}
 	AgentOptions *json.RawMessage
 	Controls     Controls
-	Policies     []*fleet.PolicySpec
+	Policies     []*GitOpsPolicySpec
 	Queries      []*fleet.QuerySpec
 	// Software is only allowed on teams, not on global config.
 	Software GitOpsSoftware
 }
 
 type GitOpsSoftware struct {
-	Packages     []*fleet.TeamSpecSoftwarePackage
+	Packages     []*fleet.SoftwarePackageSpec
 	AppStoreApps []*fleet.TeamSpecAppStoreApp
 }
 
+type Logf func(format string, a ...interface{})
+
 // GitOpsFromFile parses a GitOps yaml file.
-func GitOpsFromFile(filePath, baseDir string) (*GitOps, error) {
+func GitOpsFromFile(filePath, baseDir string, appConfig *fleet.EnrichedAppConfig, logFn Logf) (*GitOps, error) {
 	b, err := os.ReadFile(filePath)
 	if err != nil {
 		return nil, fmt.Errorf("failed to read file: %s: %w", filePath, err)
@@ -96,27 +132,44 @@ func GitOpsFromFile(filePath, baseDir string) (*GitOps, error) {
 	// Figure out if this is an org or team settings file
 	teamRaw, teamOk := top["name"]
 	teamSettingsRaw, teamSettingsOk := top["team_settings"]
-	teamSoftware, teamSoftwareOk := top["software"]
 	orgSettingsRaw, orgOk := top["org_settings"]
 	if orgOk {
-		if teamOk || teamSettingsOk || teamSoftwareOk {
-			multiError = multierror.Append(multiError, errors.New("'org_settings' cannot be used with 'name', 'team_settings' or 'software'"))
+		if teamOk || teamSettingsOk {
+			multiError = multierror.Append(multiError, errors.New("'org_settings' cannot be used with 'name', 'team_settings'"))
 		} else {
 			multiError = parseOrgSettings(orgSettingsRaw, result, baseDir, multiError)
 		}
-	} else if teamOk && teamSettingsOk {
+	} else if teamOk {
 		multiError = parseName(teamRaw, result, multiError)
-		multiError = parseTeamSettings(teamSettingsRaw, result, baseDir, multiError)
-		multiError = parseSoftware(teamSoftware, result, baseDir, multiError)
+		if result.IsNoTeam() {
+			if teamSettingsOk {
+				multiError = multierror.Append(multiError, fmt.Errorf("cannot set 'team_settings' on 'No team' file: %q", filePath))
+			}
+			if filepath.Base(filePath) != "no-team.yml" {
+				multiError = multierror.Append(multiError, fmt.Errorf("file %q for 'No team' must be named 'no-team.yml'", filePath))
+			}
+		} else {
+			if !teamSettingsOk {
+				multiError = multierror.Append(multiError, errors.New("'team_settings' is required when 'name' is provided"))
+			} else {
+				multiError = parseTeamSettings(teamSettingsRaw, result, baseDir, multiError)
+			}
+		}
 	} else {
 		multiError = multierror.Append(multiError, errors.New("either 'org_settings' or 'name' and 'team_settings' is required"))
 	}
 
 	// Validate the required top level options
 	multiError = parseControls(top, result, baseDir, multiError)
-	multiError = parseAgentOptions(top, result, baseDir, multiError)
+	multiError = parseAgentOptions(top, result, baseDir, logFn, multiError)
+	multiError = parseQueries(top, result, baseDir, logFn, multiError)
+
+	if appConfig != nil && appConfig.License.IsPremium() {
+		multiError = parseSoftware(top, result, baseDir, multiError)
+	}
+
+	// Policies can reference software installers, thus we parse them after parseSoftware.
 	multiError = parsePolicies(top, result, baseDir, multiError)
-	multiError = parseQueries(top, result, baseDir, multiError)
 
 	return result, multiError.ErrorOrNil()
 }
@@ -134,6 +187,20 @@ func parseName(raw json.RawMessage, result *GitOps, multiError *multierror.Error
 	return multiError
 }
 
+func (g *GitOps) global() bool {
+	return g.TeamName == nil || *g.TeamName == ""
+}
+
+func (g *GitOps) IsNoTeam() bool {
+	return g.TeamName != nil && isNoTeam(*g.TeamName)
+}
+
+func isNoTeam(teamName string) bool {
+	return strings.ToLower(teamName) == strings.ToLower(noTeam)
+}
+
+const noTeam = "No team"
+
 func parseOrgSettings(raw json.RawMessage, result *GitOps, baseDir string, multiError *multierror.Error) *multierror.Error {
 	var orgSettingsTop BaseItem
 	if err := json.Unmarshal(raw, &orgSettingsTop); err != nil {
@@ -287,9 +354,14 @@ func parseSecrets(result *GitOps, multiError *multierror.Error) *multierror.Erro
 	return multiError
 }
 
-func parseAgentOptions(top map[string]json.RawMessage, result *GitOps, baseDir string, multiError *multierror.Error) *multierror.Error {
+func parseAgentOptions(top map[string]json.RawMessage, result *GitOps, baseDir string, logFn Logf, multiError *multierror.Error) *multierror.Error {
 	agentOptionsRaw, ok := top["agent_options"]
-	if !ok {
+	if result.IsNoTeam() {
+		if ok {
+			logFn("[!] 'agent_options' is not supported for \"No team\". This key will be ignored.\n")
+		}
+		return multiError
+	} else if !ok {
 		return multierror.Append(multiError, errors.New("'agent_options' is required"))
 	}
 	var agentOptionsTop BaseItem
@@ -339,12 +411,14 @@ func parseAgentOptions(top map[string]json.RawMessage, result *GitOps, baseDir s
 func parseControls(top map[string]json.RawMessage, result *GitOps, baseDir string, multiError *multierror.Error) *multierror.Error {
 	controlsRaw, ok := top["controls"]
 	if !ok {
-		return multierror.Append(multiError, errors.New("'controls' is required"))
+		// Nothing to do, return.
+		return multiError
 	}
 	var controlsTop Controls
 	if err := json.Unmarshal(controlsRaw, &controlsTop); err != nil {
 		return multierror.Append(multiError, fmt.Errorf("failed to unmarshal controls: %v", err))
 	}
+	controlsTop.Defined = true
 	if controlsTop.Path == nil {
 		result.Controls = controlsTop
 	} else {
@@ -387,7 +461,11 @@ func parsePolicies(top map[string]json.RawMessage, result *GitOps, baseDir strin
 	for _, item := range policies {
 		item := item
 		if item.Path == nil {
-			result.Policies = append(result.Policies, &item.PolicySpec)
+			if err := parsePolicyInstallSoftware(baseDir, result.TeamName, &item, result.Software.Packages); err != nil {
+				multiError = multierror.Append(multiError, fmt.Errorf("failed to parse policy install_software %q: %v", item.Name, err))
+				continue
+			}
+			result.Policies = append(result.Policies, &item.GitOpsPolicySpec)
 		} else {
 			fileBytes, err := os.ReadFile(resolveApplyRelativePath(baseDir, *item.Path))
 			if err != nil {
@@ -414,7 +492,11 @@ func parsePolicies(top map[string]json.RawMessage, result *GitOps, baseDir strin
 								multiError, fmt.Errorf("nested paths are not supported: %s in %s", *pp.Path, *item.Path),
 							)
 						} else {
-							result.Policies = append(result.Policies, &pp.PolicySpec)
+							if err := parsePolicyInstallSoftware(baseDir, result.TeamName, pp, result.Software.Packages); err != nil {
+								multiError = multierror.Append(multiError, fmt.Errorf("failed to parse policy install_software %q: %v", pp.Name, err))
+								continue
+							}
+							result.Policies = append(result.Policies, &pp.GitOpsPolicySpec)
 						}
 					}
 				}
@@ -436,9 +518,12 @@ func parsePolicies(top map[string]json.RawMessage, result *GitOps, baseDir strin
 		} else {
 			item.Team = ""
 		}
+		if item.CalendarEventsEnabled && result.IsNoTeam() {
+			multiError = multierror.Append(multiError, fmt.Errorf("calendar events are not supported on \"No team\" policies: %q", item.Name))
+		}
 	}
 	duplicates := getDuplicateNames(
-		result.Policies, func(p *fleet.PolicySpec) string {
+		result.Policies, func(p *GitOpsPolicySpec) string {
 			return p.Name
 		},
 	)
@@ -448,9 +533,47 @@ func parsePolicies(top map[string]json.RawMessage, result *GitOps, baseDir strin
 	return multiError
 }
 
-func parseQueries(top map[string]json.RawMessage, result *GitOps, baseDir string, multiError *multierror.Error) *multierror.Error {
+func parsePolicyInstallSoftware(baseDir string, teamName *string, policy *Policy, packages []*fleet.SoftwarePackageSpec) error {
+	if policy.InstallSoftware == nil {
+		policy.SoftwareTitleID = ptr.Uint(0) // unset the installer
+		return nil
+	}
+	if policy.InstallSoftware != nil && policy.InstallSoftware.PackagePath != "" && teamName == nil {
+		return errors.New("install_software can only be set on team policies")
+	}
+	if policy.InstallSoftware.PackagePath == "" {
+		return errors.New("empty package_path")
+	}
+	fileBytes, err := os.ReadFile(resolveApplyRelativePath(baseDir, policy.InstallSoftware.PackagePath))
+	if err != nil {
+		return fmt.Errorf("failed to read install_software.package_path file %q: %v", policy.InstallSoftware.PackagePath, err)
+	}
+	var policyInstallSoftwareSpec fleet.SoftwarePackageSpec
+	if err := yaml.Unmarshal(fileBytes, &policyInstallSoftwareSpec); err != nil {
+		return fmt.Errorf("failed to unmarshal install_software.package_path file %s: %v", policy.InstallSoftware.PackagePath, err)
+	}
+	installerOnTeamFound := false
+	for _, pkg := range packages {
+		if pkg.URL == policyInstallSoftwareSpec.URL {
+			installerOnTeamFound = true
+			break
+		}
+	}
+	if !installerOnTeamFound {
+		return fmt.Errorf("install_software.package_path URL %s not found on team: %s", policyInstallSoftwareSpec.URL, policy.InstallSoftware.PackagePath)
+	}
+	policy.InstallSoftwareURL = policyInstallSoftwareSpec.URL
+	return nil
+}
+
+func parseQueries(top map[string]json.RawMessage, result *GitOps, baseDir string, logFn Logf, multiError *multierror.Error) *multierror.Error {
 	queriesRaw, ok := top["queries"]
-	if !ok {
+	if result.IsNoTeam() {
+		if ok {
+			logFn("[!] 'queries' is not supported for \"No team\". This key will be ignored.\n")
+		}
+		return multiError
+	} else if !ok {
 		return multierror.Append(multiError, errors.New("'queries' key is required"))
 	}
 	var queries []Query
@@ -523,32 +646,62 @@ func parseQueries(top map[string]json.RawMessage, result *GitOps, baseDir string
 	return multiError
 }
 
-func parseSoftware(softwareRaw json.RawMessage, result *GitOps, baseDir string, multiError *multierror.Error) *multierror.Error {
-	var software fleet.TeamSpecSoftware
+func parseSoftware(top map[string]json.RawMessage, result *GitOps, baseDir string, multiError *multierror.Error) *multierror.Error {
+	softwareRaw, ok := top["software"]
+	if result.global() {
+		if ok && string(softwareRaw) != "null" {
+			return multierror.Append(multiError, errors.New("'software' cannot be set on global file"))
+		}
+	} else if !ok {
+		return multierror.Append(multiError, errors.New("'software' is required"))
+	}
+	var software Software
 	if len(softwareRaw) > 0 {
 		if err := json.Unmarshal(softwareRaw, &software); err != nil {
-			return multierror.Append(multiError, fmt.Errorf("failed to unmarshall software: %v", err))
+			var typeErr *json.UnmarshalTypeError
+			if errors.As(err, &typeErr) {
+				typeErrField := typeErr.Field
+				if typeErrField == "" {
+					// UnmarshalTypeError.Field is empty when trying to set an invalid type on the root node.
+					typeErrField = "software"
+				}
+				return multierror.Append(multiError, fmt.Errorf("Couldn't edit software. %q must be a %s, found %s", typeErrField, typeErr.Type.String(), typeErr.Value))
+			}
+			return multierror.Append(multiError, fmt.Errorf("failed to unmarshall softwarespec: %v", err))
 		}
 	}
-	if software.AppStoreApps.Set {
-		for _, item := range software.AppStoreApps.Value {
-			item := item
-			if item.AppStoreID == "" {
-				multiError = multierror.Append(multiError, errors.New("software app store id required"))
-				continue
-			}
-			result.Software.AppStoreApps = append(result.Software.AppStoreApps, &item)
+	for _, item := range software.AppStoreApps {
+		item := item
+		if item.AppStoreID == "" {
+			multiError = multierror.Append(multiError, errors.New("software app store id required"))
+			continue
 		}
+		result.Software.AppStoreApps = append(result.Software.AppStoreApps, &item)
 	}
-	if software.Packages.Set {
-		for _, item := range software.Packages.Value {
-			item := item
-			if item.URL == "" {
-				multiError = multierror.Append(multiError, errors.New("software URL is required"))
+	for _, item := range software.Packages {
+		var softwarePackageSpec fleet.SoftwarePackageSpec
+		if item.Path != nil {
+			fileBytes, err := os.ReadFile(resolveApplyRelativePath(baseDir, *item.Path))
+			if err != nil {
+				multiError = multierror.Append(multiError, fmt.Errorf("failed to read policies file %s: %v", *item.Path, err))
 				continue
 			}
-			result.Software.Packages = append(result.Software.Packages, &item)
+			if err := yaml.Unmarshal(fileBytes, &softwarePackageSpec); err != nil {
+				multiError = multierror.Append(multiError, fmt.Errorf("failed to unmarshal software package file %s: %v", *item.Path, err))
+				continue
+			}
+		} else {
+			softwarePackageSpec = item.SoftwarePackageSpec
 		}
+		if softwarePackageSpec.URL == "" {
+			multiError = multierror.Append(multiError, errors.New("software URL is required"))
+			continue
+		}
+		if len(softwarePackageSpec.URL) > fleet.SoftwareInstallerURLMaxLength {
+			multiError = multierror.Append(multiError, fmt.Errorf("software URL %q is too long, must be less than 256 characters", softwarePackageSpec.URL))
+			continue
+		}
+		result.Software.Packages = append(result.Software.Packages, &softwarePackageSpec)
 	}
 
 	return multiError
diff --git a/pkg/spec/gitops_test.go b/pkg/spec/gitops_test.go
index 644c3e453e..65a73ab7c2 100644
--- a/pkg/spec/gitops_test.go
+++ b/pkg/spec/gitops_test.go
@@ -5,8 +5,10 @@ import (
 	"os"
 	"path/filepath"
 	"slices"
+	"strings"
 	"testing"
 
+	"github.com/fleetdm/fleet/v4/pkg/file"
 	"github.com/fleetdm/fleet/v4/server/fleet"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -51,9 +53,22 @@ func createTempFile(t *testing.T, pattern, contents string) (filePath string, ba
 	return tmpFile.Name(), filepath.Dir(tmpFile.Name())
 }
 
+func createNamedFileOnTempDir(t *testing.T, name string, contents string) (filePath string, baseDir string) {
+	tmpFilePath := filepath.Join(t.TempDir(), name)
+	tmpFile, err := os.Create(tmpFilePath)
+	require.NoError(t, err)
+	_, err = tmpFile.WriteString(contents)
+	require.NoError(t, err)
+	require.NoError(t, tmpFile.Close())
+	return tmpFile.Name(), filepath.Dir(tmpFile.Name())
+}
+
 func gitOpsFromString(t *testing.T, s string) (*GitOps, error) {
 	path, basePath := createTempFile(t, "", s)
-	return GitOpsFromFile(path, basePath)
+	return GitOpsFromFile(path, basePath, nil, nopLogf)
+}
+
+func nopLogf(_ string, _ ...interface{}) {
 }
 
 func TestValidGitOpsYaml(t *testing.T) {
@@ -104,11 +119,17 @@ func TestValidGitOpsYaml(t *testing.T) {
 							os.Unsetenv(k)
 						}
 					})
-				} else {
-					t.Parallel()
 				}
 
-				gitops, err := GitOpsFromFile(test.filePath, "./testdata")
+				var appConfig *fleet.EnrichedAppConfig
+				if test.isTeam {
+					appConfig = &fleet.EnrichedAppConfig{}
+					appConfig.License = &fleet.LicenseInfo{
+						Tier: fleet.TierPremium,
+					}
+				}
+
+				gitops, err := GitOpsFromFile(test.filePath, "./testdata", appConfig, nopLogf)
 				require.NoError(t, err)
 
 				if test.isTeam {
@@ -132,6 +153,14 @@ func TestValidGitOpsYaml(t *testing.T) {
 					require.Len(t, secrets.([]*fleet.EnrollSecret), 2)
 					assert.Equal(t, "SampleSecret123", secrets.([]*fleet.EnrollSecret)[0].Secret)
 					assert.Equal(t, "ABC", secrets.([]*fleet.EnrollSecret)[1].Secret)
+					require.Len(t, gitops.Software.Packages, 2)
+					for _, pkg := range gitops.Software.Packages {
+						if strings.Contains(pkg.URL, "MicrosoftTeams") {
+							assert.Equal(t, "uninstall.sh", pkg.UninstallScript.Path)
+						} else {
+							assert.Empty(t, pkg.UninstallScript.Path)
+						}
+					}
 				} else {
 					// Check org settings
 					serverSettings, ok := gitops.OrgSettings["server_settings"]
@@ -201,14 +230,32 @@ func TestValidGitOpsYaml(t *testing.T) {
 				assert.Equal(t, "darwin,linux,windows", gitops.Queries[1].Platform)
 				assert.Equal(t, "osquery_info", gitops.Queries[2].Name)
 
+				// Check software
+				if test.isTeam {
+					require.Len(t, gitops.Software.Packages, 2)
+					require.Equal(t, "https://statics.teams.cdn.office.net/production-osx/enterprise/webview2/lkg/MicrosoftTeams.pkg", gitops.Software.Packages[0].URL)
+					require.False(t, gitops.Software.Packages[0].SelfService)
+					require.Equal(t, "https://ftp.mozilla.org/pub/firefox/releases/129.0.2/mac/en-US/Firefox%20129.0.2.pkg", gitops.Software.Packages[1].URL)
+					require.True(t, gitops.Software.Packages[1].SelfService)
+				}
+
 				// Check policies
-				require.Len(t, gitops.Policies, 5)
+				expectedPoliciesCount := 5
+				if test.isTeam {
+					expectedPoliciesCount = 6
+				}
+				require.Len(t, gitops.Policies, expectedPoliciesCount)
 				assert.Equal(t, "😊 Failing policy", gitops.Policies[0].Name)
 				assert.Equal(t, "Passing policy", gitops.Policies[1].Name)
 				assert.Equal(t, "No root logins (macOS, Linux)", gitops.Policies[2].Name)
 				assert.Equal(t, "🔥 Failing policy", gitops.Policies[3].Name)
 				assert.Equal(t, "linux", gitops.Policies[3].Platform)
 				assert.Equal(t, "😊😊 Failing policy", gitops.Policies[4].Name)
+				if test.isTeam {
+					assert.Equal(t, "Microsoft Teams on macOS installed and up to date", gitops.Policies[5].Name)
+					assert.NotNil(t, gitops.Policies[5].InstallSoftware)
+					assert.Equal(t, "./microsoft-teams.pkg.software.yml", gitops.Policies[5].InstallSoftware.PackagePath)
+				}
 			},
 		)
 	}
@@ -336,20 +383,20 @@ func TestMixingGlobalAndTeamConfig(t *testing.T) {
 	config := getGlobalConfig(nil)
 	config += "name: TeamName\n"
 	_, err := gitOpsFromString(t, config)
-	assert.ErrorContains(t, err, "'org_settings' cannot be used with 'name', 'team_settings' or 'software'")
+	assert.ErrorContains(t, err, "'org_settings' cannot be used with 'name', 'team_settings'")
 
 	// Mixing org_settings and team_settings
 	config = getGlobalConfig(nil)
 	config += "team_settings:\n  secrets: []\n"
 	_, err = gitOpsFromString(t, config)
-	assert.ErrorContains(t, err, "'org_settings' cannot be used with 'name', 'team_settings' or 'software'")
+	assert.ErrorContains(t, err, "'org_settings' cannot be used with 'name', 'team_settings'")
 
 	// Mixing org_settings and team name and team_settings
 	config = getGlobalConfig(nil)
 	config += "name: TeamName\n"
 	config += "team_settings:\n  secrets: []\n"
 	_, err = gitOpsFromString(t, config)
-	assert.ErrorContains(t, err, "'org_settings' cannot be used with 'name', 'team_settings' or 'software'")
+	assert.ErrorContains(t, err, "'org_settings' cannot be used with 'name', 'team_settings'")
 }
 
 func TestInvalidGitOpsYaml(t *testing.T) {
@@ -415,14 +462,44 @@ func TestInvalidGitOpsYaml(t *testing.T) {
 					_, err = gitOpsFromString(t, config)
 					assert.ErrorContains(t, err, "must have a 'secret' key")
 
+					// Missing team_settings.
+					config = getConfig([]string{"team_settings"})
+					_, err = gitOpsFromString(t, config)
+					assert.ErrorContains(t, err, "'team_settings' is required when 'name' is provided")
+
+					// team_settings set on a "no-team.yml".
+					config = getConfig([]string{"name"})
+					config += "name: No team\n"
+					noTeamPath1, noTeamBasePath1 := createNamedFileOnTempDir(t, "no-team.yml", config)
+					_, err = GitOpsFromFile(noTeamPath1, noTeamBasePath1, nil, nopLogf)
+					assert.ErrorContains(t, err, fmt.Sprintf("cannot set 'team_settings' on 'No team' file: %q", noTeamPath1))
+
+					// 'No team' file with invalid name.
+					config = getConfig([]string{"name", "team_settings"})
+					config += "name: No team\n"
+					noTeamPath2, noTeamBasePath2 := createNamedFileOnTempDir(t, "foobar.yml", config)
+					_, err = GitOpsFromFile(noTeamPath2, noTeamBasePath2, nil, nopLogf)
+					assert.ErrorContains(t, err, fmt.Sprintf("file %q for 'No team' must be named 'no-team.yml'", noTeamPath2))
+
 					// Missing secrets
 					config = getConfig([]string{"team_settings"})
 					config += "team_settings:\n"
 					_, err = gitOpsFromString(t, config)
 					assert.ErrorContains(t, err, "'team_settings.secrets' is required")
 				} else {
+					// 'software' is not allowed in global config
+					config := getConfig(nil)
+					config += "software:\n  packages:\n    - url: https://example.com\n"
+					path1, basePath1 := createTempFile(t, "", config)
+					appConfig := fleet.EnrichedAppConfig{}
+					appConfig.License = &fleet.LicenseInfo{
+						Tier: fleet.TierPremium,
+					}
+					_, err = GitOpsFromFile(path1, basePath1, &appConfig, nopLogf)
+					assert.ErrorContains(t, err, "'software' cannot be set on global file")
+
 					// Invalid org_settings
-					config := getConfig([]string{"org_settings"})
+					config = getConfig([]string{"org_settings"})
 					config += "org_settings:\n  path: [2]\n"
 					_, err = gitOpsFromString(t, config)
 					assert.ErrorContains(t, err, "failed to unmarshal org_settings")
@@ -567,9 +644,6 @@ func TestTopLevelGitOpsValidation(t *testing.T) {
 		"missing_all": {
 			optsToExclude: []string{"controls", "queries", "policies", "agent_options", "org_settings"},
 		},
-		"missing_controls": {
-			optsToExclude: []string{"controls"},
-		},
 		"missing_queries": {
 			optsToExclude: []string{"queries"},
 		},
@@ -696,7 +770,7 @@ func TestGitOpsPaths(t *testing.T) {
 				err = os.WriteFile(mainTmpFile.Name(), []byte(config), 0o644)
 				require.NoError(t, err)
 
-				_, err = GitOpsFromFile(mainTmpFile.Name(), dir)
+				_, err = GitOpsFromFile(mainTmpFile.Name(), dir, nil, nopLogf)
 				assert.NoError(t, err)
 
 				// Test a bad path
@@ -709,7 +783,7 @@ func TestGitOpsPaths(t *testing.T) {
 				err = os.WriteFile(mainTmpFile.Name(), []byte(config), 0o644)
 				require.NoError(t, err)
 
-				_, err = GitOpsFromFile(mainTmpFile.Name(), dir)
+				_, err = GitOpsFromFile(mainTmpFile.Name(), dir, nil, nopLogf)
 				assert.ErrorContains(t, err, "no such file or directory")
 
 				// Test a bad file -- cannot be unmarshalled
@@ -744,13 +818,127 @@ func TestGitOpsPaths(t *testing.T) {
 				}
 				err = os.WriteFile(mainTmpFile.Name(), []byte(config), 0o644)
 				require.NoError(t, err)
-				_, err = GitOpsFromFile(mainTmpFile.Name(), dir)
+				_, err = GitOpsFromFile(mainTmpFile.Name(), dir, nil, nopLogf)
 				assert.ErrorContains(t, err, "nested paths are not supported")
 			},
 		)
 	}
 }
 
+func TestGitOpsGlobalPolicyWithInstallSoftware(t *testing.T) {
+	t.Parallel()
+	config := getGlobalConfig([]string{"policies"})
+	config += `
+policies:
+- name: Some policy
+  query: SELECT 1;
+  install_software:
+    package_path: ./some_path.yml
+`
+	_, err := gitOpsFromString(t, config)
+	assert.ErrorContains(t, err, "install_software can only be set on team policies")
+}
+
+func TestGitOpsTeamPolicyWithInvalidInstallSoftware(t *testing.T) {
+	t.Parallel()
+	config := getTeamConfig([]string{"policies"})
+	config += `
+policies:
+- name: Some policy
+  query: SELECT 1;
+  install_software:
+    package_path: ./some_path.yml
+`
+	_, err := gitOpsFromString(t, config)
+	assert.ErrorContains(t, err, "failed to read install_software.package_path file")
+
+	config = getTeamConfig([]string{"policies"})
+	config += `
+policies:
+- name: Some policy
+  query: SELECT 1;
+  install_software:
+    package_path:
+`
+	_, err = gitOpsFromString(t, config)
+	assert.ErrorContains(t, err, "empty package_path")
+
+	// Software has a URL that's too big
+	tooBigURL := fmt.Sprintf("https://ftp.mozilla.org/%s", strings.Repeat("a", 232))
+	config = getTeamConfig([]string{"software"})
+	config += fmt.Sprintf(`
+software:
+  packages:
+    - url: %s
+`, tooBigURL)
+	appConfig := fleet.EnrichedAppConfig{}
+	appConfig.License = &fleet.LicenseInfo{
+		Tier: fleet.TierPremium,
+	}
+	path, basePath := createTempFile(t, "", config)
+	_, err = GitOpsFromFile(path, basePath, &appConfig, nopLogf)
+	assert.ErrorContains(t, err, fmt.Sprintf("software URL \"%s\" is too long, must be less than 256 characters", tooBigURL))
+
+	// Policy references a software installer not present in the team.
+	config = getTeamConfig([]string{"policies"})
+	config += `
+policies:
+  - path: ./team_install_software.policies.yml
+software:
+  packages:
+    - url: https://ftp.mozilla.org/pub/firefox/releases/129.0.2/mac/en-US/Firefox%20129.0.2.pkg
+      self_service: true
+
+`
+	path, basePath = createTempFile(t, "", config)
+	err = file.Copy(
+		filepath.Join("testdata", "team_install_software.policies.yml"),
+		filepath.Join(basePath, "team_install_software.policies.yml"),
+		0o755,
+	)
+	require.NoError(t, err)
+	err = file.Copy(
+		filepath.Join("testdata", "microsoft-teams.pkg.software.yml"),
+		filepath.Join(basePath, "microsoft-teams.pkg.software.yml"),
+		0o755,
+	)
+	require.NoError(t, err)
+	_, err = GitOpsFromFile(path, basePath, &appConfig, nopLogf)
+	assert.ErrorContains(t, err,
+		"install_software.package_path URL https://statics.teams.cdn.office.net/production-osx/enterprise/webview2/lkg/MicrosoftTeams.pkg not found on team",
+	)
+
+	// Policy references a software installer file that has an invalid yaml.
+	config = getTeamConfig([]string{"policies"})
+	config += `
+policies:
+  - path: ./team_install_software.policies.yml
+software:
+  packages:
+    - url: https://ftp.mozilla.org/pub/firefox/releases/129.0.2/mac/en-US/Firefox%20129.0.2.pkg
+      self_service: true
+`
+	path, basePath = createTempFile(t, "", config)
+	err = file.Copy(
+		filepath.Join("testdata", "team_install_software.policies.yml"),
+		filepath.Join(basePath, "team_install_software.policies.yml"),
+		0o755,
+	)
+	require.NoError(t, err)
+	err = os.WriteFile( // nolint:gosec
+		filepath.Join(basePath, "microsoft-teams.pkg.software.yml"),
+		[]byte("invalid yaml"),
+		0o755,
+	)
+	require.NoError(t, err)
+	appConfig = fleet.EnrichedAppConfig{}
+	appConfig.License = &fleet.LicenseInfo{
+		Tier: fleet.TierPremium,
+	}
+	_, err = GitOpsFromFile(path, basePath, &appConfig, nopLogf)
+	assert.ErrorContains(t, err, "failed to unmarshal install_software.package_path file")
+}
+
 func getGlobalConfig(optsToExclude []string) string {
 	return getBaseConfig(topLevelOptions, optsToExclude)
 }
diff --git a/pkg/spec/spec.go b/pkg/spec/spec.go
index d760f8b1d3..10bafd76da 100644
--- a/pkg/spec/spec.go
+++ b/pkg/spec/spec.go
@@ -26,6 +26,7 @@ type Group struct {
 	Packs    []*fleet.PackSpec
 	Labels   []*fleet.LabelSpec
 	Policies []*fleet.PolicySpec
+	Software []*fleet.SoftwarePackageSpec
 	// This needs to be interface{} to allow for the patch logic. Otherwise we send a request that looks to the
 	// server like the user explicitly set the zero values.
 	AppConfig              interface{}
diff --git a/pkg/spec/testdata/microsoft-teams.pkg.software.yml b/pkg/spec/testdata/microsoft-teams.pkg.software.yml
new file mode 100644
index 0000000000..664068cb94
--- /dev/null
+++ b/pkg/spec/testdata/microsoft-teams.pkg.software.yml
@@ -0,0 +1,4 @@
+url: https://statics.teams.cdn.office.net/production-osx/enterprise/webview2/lkg/MicrosoftTeams.pkg
+self_service: false
+uninstall_script:
+  path: uninstall.sh
diff --git a/pkg/spec/testdata/team_config.yml b/pkg/spec/testdata/team_config.yml
index 127ed82bcf..8d593283a0 100644
--- a/pkg/spec/testdata/team_config.yml
+++ b/pkg/spec/testdata/team_config.yml
@@ -25,3 +25,9 @@ policies:
     description: This policy should always fail.
     resolution: There is no resolution for this policy.
     query: SELECT 1 FROM osquery_info WHERE start_time < 0;
+  - path: ./team_install_software.policies.yml
+software:
+  packages:
+    - path: ./microsoft-teams.pkg.software.yml
+    - url: https://ftp.mozilla.org/pub/firefox/releases/129.0.2/mac/en-US/Firefox%20129.0.2.pkg
+      self_service: true
diff --git a/pkg/spec/testdata/team_config_no_paths.yml b/pkg/spec/testdata/team_config_no_paths.yml
index 44c4ff36b0..c0c0742d72 100644
--- a/pkg/spec/testdata/team_config_no_paths.yml
+++ b/pkg/spec/testdata/team_config_no_paths.yml
@@ -115,3 +115,13 @@ policies:
     description: This policy should always fail.
     resolution: There is no resolution for this policy.
     query: SELECT 1 FROM osquery_info WHERE start_time < 0;
+  - name: Microsoft Teams on macOS installed and up to date
+    platform: darwin
+    query: SELECT 1 FROM apps WHERE name = 'Microsoft Teams.app' AND version_compare(bundle_short_version, '24193.1707.3028.4282') >= 0;
+    install_software:
+      package_path: ./microsoft-teams.pkg.software.yml
+software:
+  packages:
+    - path: ./microsoft-teams.pkg.software.yml
+    - url: https://ftp.mozilla.org/pub/firefox/releases/129.0.2/mac/en-US/Firefox%20129.0.2.pkg
+      self_service: true
diff --git a/pkg/spec/testdata/team_install_software.policies.yml b/pkg/spec/testdata/team_install_software.policies.yml
new file mode 100644
index 0000000000..1811340788
--- /dev/null
+++ b/pkg/spec/testdata/team_install_software.policies.yml
@@ -0,0 +1,5 @@
+- name: Microsoft Teams on macOS installed and up to date
+  platform: darwin
+  query: SELECT 1 FROM apps WHERE name = 'Microsoft Teams.app' AND version_compare(bundle_short_version, '24193.1707.3028.4282') >= 0;
+  install_software:
+    package_path: ./microsoft-teams.pkg.software.yml
diff --git a/schema/osquery_fleet_schema.json b/schema/osquery_fleet_schema.json
index ed0f676276..db3567e3dc 100644
--- a/schema/osquery_fleet_schema.json
+++ b/schema/osquery_fleet_schema.json
@@ -5349,7 +5349,7 @@
   },
   {
     "name": "cryptoinfo",
-    "description": "Get info about the a certificate on the host.",
+    "description": "Get info about a certificate on the host.",
     "evented": false,
     "notes": "This table is not a core osquery table. It is included as part of fleetd, the osquery manager from Fleet. Code based on work by [Kolide](https://github.com/kolide/launcher).",
     "platforms": [
@@ -12799,7 +12799,6 @@
         "index": false
       }
     ],
-    "hidden": true,
     "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/iptables.yml"
   },
   {
diff --git a/schema/tables/cryptoinfo.yml b/schema/tables/cryptoinfo.yml
index 4fd8d5da37..38055381b7 100644
--- a/schema/tables/cryptoinfo.yml
+++ b/schema/tables/cryptoinfo.yml
@@ -1,5 +1,5 @@
 name: cryptoinfo
-description: Get info about the a certificate on the host.
+description: Get info about a certificate on the host.
 evented: false
 notes: This table is not a core osquery table. It is included as part of fleetd, the osquery manager from Fleet. Code based on work by [Kolide](https://github.com/kolide/launcher).
 platforms:
diff --git a/schema/tables/iptables.yml b/schema/tables/iptables.yml
index 8e560b85a0..564ecfeb86 100644
--- a/schema/tables/iptables.yml
+++ b/schema/tables/iptables.yml
@@ -1,2 +1 @@
-name: iptables
-hidden: true
+name: iptables
\ No newline at end of file
diff --git a/scripts/macos-install-wine.sh b/scripts/macos-install-wine.sh
index fc89c8398c..0b7b0752cc 100755
--- a/scripts/macos-install-wine.sh
+++ b/scripts/macos-install-wine.sh
@@ -7,7 +7,8 @@ set -eo pipefail
 brew_wine(){
 # Wine reference: https://wiki.winehq.org/MacOS
 # Wine can be installed without brew via a distribution such as https://github.com/Gcenx/macOS_Wine_builds/releases/tag/9.0 or by building from source.
-brew install --cask --no-quarantine https://raw.githubusercontent.com/Homebrew/homebrew-cask/1ecfe82f84e0f3c3c6b741d3ddc19a164c2cb18d/Casks/w/wine-stable.rb; exit 0
+curl -O https://raw.githubusercontent.com/Homebrew/homebrew-cask/1ecfe82f84e0f3c3c6b741d3ddc19a164c2cb18d/Casks/w/wine-stable.rb
+brew install --cask --no-quarantine wine-stable.rb; exit 0
 }
 
 
diff --git a/server/authz/policy.rego b/server/authz/policy.rego
index fbdaf51659..11a9a07c59 100644
--- a/server/authz/policy.rego
+++ b/server/authz/policy.rego
@@ -677,7 +677,7 @@ allow {
 # Host software installs
 ##
 
-# Global admins and maintainers can write (install) software on hosts (not
+# Global admins and maintainers can write (install/uninstall) software on hosts (not
 # gitops as this is not something that relates to fleetctl apply).
 allow {
   object.type == "host_software_installer_result"
@@ -685,7 +685,7 @@ allow {
   action == write
 }
 
-# Team admin and maintainers can write (install) software on hosts for their
+# Team admin and maintainers can write (install/uninstall) software on hosts for their
 # teams (not gitops as this is not something that relates to fleetctl apply).
 allow {
   object.type == "host_software_installer_result"
@@ -733,11 +733,11 @@ allow {
   action == [read, write][_]
 }
 
-# Global admins can read and write MDM apple information.
+# Global admins can read, write, and list MDM apple information.
 allow {
   object.type == "mdm_apple"
   subject.global_role == admin
-  action == [read, write][_]
+  action == [read, write, list][_]
 }
 
 # Global admins can read and write Apple MDM enrollments.
@@ -937,7 +937,7 @@ allow {
   action == write
 }
 
-# Global admins, maintainers, observer_plus and observers can read scripts.
+# Global admins, maintainers, observer_plus and observers can read script results, including software uninstall results.
 allow {
   object.type == "host_script_result"
   subject.global_role == [admin, maintainer, observer, observer_plus][_]
@@ -953,7 +953,7 @@ allow {
   action == write
 }
 
-# Team admins, maintainers, observer_plus and observers can read scripts for their teams.
+# Team admins, maintainers, observer_plus and observers can read script results for their teams, including software uninstall results.
 allow {
   object.type == "host_script_result"
   not is_null(object.team_id)
diff --git a/server/config/config.go b/server/config/config.go
index 9e4cb6003a..5f6a9164eb 100644
--- a/server/config/config.go
+++ b/server/config/config.go
@@ -99,9 +99,12 @@ type ServerConfig struct {
 
 func (s *ServerConfig) DefaultHTTPServer(ctx context.Context, handler http.Handler) *http.Server {
 	return &http.Server{
-		Addr:              s.Address,
-		Handler:           handler,
-		ReadTimeout:       25 * time.Second,
+		Addr:        s.Address,
+		Handler:     handler,
+		ReadTimeout: 25 * time.Second,
+		// WriteTimeout is set for security purposes.
+		// If we don't set it, (bugy or malignant) clients making long running
+		// requests could DDOS Fleet.
 		WriteTimeout:      40 * time.Second,
 		ReadHeaderTimeout: 5 * time.Second,
 		IdleTimeout:       5 * time.Minute,
@@ -622,6 +625,7 @@ type CalendarConfig struct {
 func (c *CalendarConfig) AlwaysReloadEvent() bool {
 	return c.alwaysReloadEvent
 }
+
 func (c *CalendarConfig) SetAlwaysReloadEvent(value bool) {
 	c.alwaysReloadEvent = value
 }
@@ -714,8 +718,7 @@ func (m *MDMConfig) IsAppleBMSet() bool {
 	return pair.IsSet() || m.AppleBMServerToken != "" || m.AppleBMServerTokenBytes != ""
 }
 
-// AppleAPNs returns the parsed and validated TLS certificate for Apple APNs.
-// It parses and validates it if it hasn't been done yet.
+// AppleAPNs returns the parsed TLS certificate for Apple APNs.
 func (m *MDMConfig) AppleAPNs() (cert *tls.Certificate, pemCert, pemKey []byte, err error) {
 	if m.appleAPNs == nil {
 		pair := x509KeyPairConfig{
@@ -735,8 +738,7 @@ func (m *MDMConfig) AppleAPNs() (cert *tls.Certificate, pemCert, pemKey []byte,
 	return m.appleAPNs, m.appleAPNsPEMCert, m.appleAPNsPEMKey, nil
 }
 
-// AppleSCEP returns the parsed and validated TLS certificate for Apple SCEP.
-// It parses and validates it if it hasn't been done yet.
+// AppleSCEP returns the parsed TLS certificate for Apple SCEP.
 func (m *MDMConfig) AppleSCEP() (cert *tls.Certificate, pemCert, pemKey []byte, err error) {
 	if m.appleSCEP == nil {
 		pair := x509KeyPairConfig{
@@ -763,7 +765,7 @@ type ParsedAppleBM struct {
 	Token          *nanodep_client.OAuth1Tokens
 }
 
-func decryptAndValidateABMToken(tokenBytes []byte, cert *x509.Certificate, keyPEM []byte) (*nanodep_client.OAuth1Tokens, error) {
+func decryptABMToken(tokenBytes []byte, cert *x509.Certificate, keyPEM []byte) (*nanodep_client.OAuth1Tokens, error) {
 	bmKey, err := tokenpki.RSAKeyFromPEM(keyPEM)
 	if err != nil {
 		return nil, fmt.Errorf("Apple BM configuration: parse private key: %w", err)
@@ -776,14 +778,11 @@ func decryptAndValidateABMToken(tokenBytes []byte, cert *x509.Certificate, keyPE
 	if err := json.Unmarshal(token, &jsonTok); err != nil {
 		return nil, fmt.Errorf("Apple BM configuration: unmarshal JSON token: %w", err)
 	}
-	if jsonTok.AccessTokenExpiry.Before(time.Now()) {
-		return nil, errors.New("Apple BM configuration: token is expired")
-	}
 	return &jsonTok, nil
 }
 
-// AppleBM returns the parsed, validated and decrypted server token for Apple
-// Business Manager. It also parses and validates the Apple BM certificate and
+// AppleBM returns the parsed and decrypted server token for Apple
+// Business Manager. It also parses the Apple BM certificate and
 // private key in the process, in order to decrypt the token.
 func (m *MDMConfig) AppleBM() (*ParsedAppleBM, error) {
 	if m.appleBMToken == nil {
@@ -801,7 +800,7 @@ func (m *MDMConfig) AppleBM() (*ParsedAppleBM, error) {
 		if err != nil {
 			return nil, fmt.Errorf("Apple BM configuration: %w", err)
 		}
-		jsonTok, err := decryptAndValidateABMToken(encToken, cert.Leaf, pair.keyBytes)
+		jsonTok, err := decryptABMToken(encToken, cert.Leaf, pair.keyBytes)
 		if err != nil {
 			return nil, err
 		}
diff --git a/server/contexts/apple_bm/apple_bm.go b/server/contexts/apple_bm/apple_bm.go
new file mode 100644
index 0000000000..e6024a9a78
--- /dev/null
+++ b/server/contexts/apple_bm/apple_bm.go
@@ -0,0 +1,20 @@
+package apple_bm
+
+import (
+	"context"
+
+	depclient "github.com/fleetdm/fleet/v4/server/mdm/nanodep/client"
+)
+
+type key int
+
+const abmKey key = 0
+
+func NewContext(ctx context.Context, decryptedToken *depclient.OAuth1Tokens) context.Context {
+	return context.WithValue(ctx, abmKey, decryptedToken)
+}
+
+func FromContext(ctx context.Context) (*depclient.OAuth1Tokens, bool) {
+	tok, ok := ctx.Value(abmKey).(*depclient.OAuth1Tokens)
+	return tok, ok
+}
diff --git a/server/cron/calendar_cron.go b/server/cron/calendar_cron.go
index 4e717a84b6..72b1498af2 100644
--- a/server/cron/calendar_cron.go
+++ b/server/cron/calendar_cron.go
@@ -326,7 +326,7 @@ func processFailingHostExistingCalendarEvent(
 	// Try to acquire the lock. Lock is needed to ensure calendar callback is not processed for this event at the same time.
 	eventUUID := calendarEvent.UUID
 	lockValue := uuid.New().String()
-	lockAcquired, err := distributedLock.AcquireLock(ctx, calendar.LockKeyPrefix+eventUUID, lockValue, calendar.DistributedLockExpireMs)
+	lockAcquired, err := distributedLock.SetIfNotExist(ctx, calendar.LockKeyPrefix+eventUUID, lockValue, calendar.DistributedLockExpireMs)
 	if err != nil {
 		return fmt.Errorf("acquire calendar lock: %w", err)
 	}
@@ -334,7 +334,7 @@ func processFailingHostExistingCalendarEvent(
 	lockReserved := false
 	if !lockAcquired {
 		// Lock was not acquired. We reserve the lock and try to acquire it until we do.
-		lockAcquired, err = distributedLock.AcquireLock(ctx, calendar.ReservedLockKeyPrefix+eventUUID, lockValue,
+		lockAcquired, err = distributedLock.SetIfNotExist(ctx, calendar.ReservedLockKeyPrefix+eventUUID, lockValue,
 			calendar.ReserveLockExpireMs)
 		if err != nil {
 			return fmt.Errorf("reserve calendar lock: %w", err)
@@ -348,7 +348,7 @@ func processFailingHostExistingCalendarEvent(
 		go func() {
 			for {
 				// Keep trying to get the lock.
-				lockAcquired, err = distributedLock.AcquireLock(ctx, calendar.LockKeyPrefix+eventUUID, lockValue,
+				lockAcquired, err = distributedLock.SetIfNotExist(ctx, calendar.LockKeyPrefix+eventUUID, lockValue,
 					calendar.DistributedLockExpireMs)
 				if err != nil || lockAcquired {
 					done <- struct{}{}
@@ -396,6 +396,7 @@ func processFailingHostExistingCalendarEvent(
 
 	// Function to generate calendar event body.
 	var generatedTag string
+	var newETag string
 	var genBodyFn fleet.CalendarGenBodyFn = func(conflict bool) (string, bool, error) {
 		var body string
 		body, generatedTag = calendar.GenerateCalendarEventBody(ctx, ds, orgName, host, policyIDtoPolicy, conflict, logger)
@@ -409,7 +410,7 @@ func processFailingHostExistingCalendarEvent(
 		updatedBodyTag := getBodyTag(ctx, ds, host, policyIDtoPolicy, logger)
 
 		if currentBodyTag != updatedBodyTag && updatedBodyTag != "" {
-			err = userCalendar.UpdateEventBody(calendarEvent, genBodyFn)
+			newETag, err = userCalendar.UpdateEventBody(calendarEvent, genBodyFn)
 			if err != nil {
 				return fmt.Errorf("update event body: %w", err)
 			}
@@ -440,8 +441,8 @@ func processFailingHostExistingCalendarEvent(
 	}
 
 	if updated {
-		if generatedTag != "" {
-			err = updatedEvent.SaveBodyTag(generatedTag)
+		if generatedTag != "" && newETag != "" {
+			err = updatedEvent.SaveDataItems("body_tag", generatedTag, "etag", newETag)
 			if err != nil {
 				return fmt.Errorf("save calendar event body tag: %w", err)
 			}
@@ -623,7 +624,7 @@ func attemptCreatingEventOnUserCalendar(
 		var dee fleet.DayEndedError
 		switch {
 		case err == nil:
-			err = calendarEvent.SaveBodyTag(generatedTag)
+			err = calendarEvent.SaveDataItems("body_tag", generatedTag)
 			if err != nil {
 				return nil, err
 			}
diff --git a/server/cron/calendar_cron_test.go b/server/cron/calendar_cron_test.go
index b4cb9141b9..3e780ee515 100644
--- a/server/cron/calendar_cron_test.go
+++ b/server/cron/calendar_cron_test.go
@@ -401,6 +401,7 @@ func (n notFoundErr) Error() string {
 }
 
 func TestCalendarEvents1KHosts(t *testing.T) {
+	t.Parallel()
 	ds := new(mock.Store)
 	ctx := context.Background()
 	var logger kitlog.Logger
diff --git a/server/datastore/filesystem/software_installer.go b/server/datastore/filesystem/software_installer.go
index 7bb68a87cc..e9a1eb891e 100644
--- a/server/datastore/filesystem/software_installer.go
+++ b/server/datastore/filesystem/software_installer.go
@@ -6,6 +6,7 @@ import (
 	"io"
 	"os"
 	"path/filepath"
+	"time"
 
 	"github.com/fleetdm/fleet/v4/server/contexts/ctxerr"
 	"github.com/fleetdm/fleet/v4/server/fleet"
@@ -93,7 +94,7 @@ func (i *SoftwareInstallerStore) Exists(ctx context.Context, installerID string)
 	return true, nil
 }
 
-func (i *SoftwareInstallerStore) Cleanup(ctx context.Context, usedInstallerIDs []string) (int, error) {
+func (i *SoftwareInstallerStore) Cleanup(ctx context.Context, usedInstallerIDs []string, removeCreatedBefore time.Time) (int, error) {
 	usedSet := make(map[string]struct{}, len(usedInstallerIDs))
 	for _, id := range usedInstallerIDs {
 		usedSet[id] = struct{}{}
@@ -115,6 +116,14 @@ func (i *SoftwareInstallerStore) Cleanup(ctx context.Context, usedInstallerIDs [
 		if _, isUsed := usedSet[de.Name()]; isUsed {
 			continue
 		}
+
+		info, err := de.Info()
+		if err != nil {
+			return 0, ctxerr.Wrap(ctx, err, "get software installer modtime in filesystem store")
+		}
+		if info.ModTime().After(removeCreatedBefore) {
+			continue
+		}
 		if err := os.Remove(filepath.Join(baseDir, de.Name())); err != nil {
 			errs = append(errs, err)
 		} else {
diff --git a/server/datastore/filesystem/software_installer_test.go b/server/datastore/filesystem/software_installer_test.go
index 3b942df885..6e7b0e454a 100644
--- a/server/datastore/filesystem/software_installer_test.go
+++ b/server/datastore/filesystem/software_installer_test.go
@@ -11,6 +11,7 @@ import (
 	"os"
 	"path/filepath"
 	"testing"
+	"time"
 
 	"github.com/fleetdm/fleet/v4/server/fleet"
 	"github.com/google/uuid"
@@ -107,7 +108,7 @@ func TestSoftwareInstallerCleanup(t *testing.T) {
 	}
 
 	// cleanup an empty store
-	n, err := store.Cleanup(ctx, nil)
+	n, err := store.Cleanup(ctx, nil, time.Now())
 	require.NoError(t, err)
 	require.Equal(t, 0, n)
 
@@ -117,14 +118,14 @@ func TestSoftwareInstallerCleanup(t *testing.T) {
 	require.NoError(t, err)
 
 	// cleanup but mark it as used
-	n, err = store.Cleanup(ctx, []string{ins0})
+	n, err = store.Cleanup(ctx, []string{ins0}, time.Now())
 	require.NoError(t, err)
 	require.Equal(t, 0, n)
 
 	assertExisting([]string{ins0})
 
 	// cleanup but mark it as unused
-	n, err = store.Cleanup(ctx, []string{})
+	n, err = store.Cleanup(ctx, []string{}, time.Now())
 	require.NoError(t, err)
 	require.Equal(t, 1, n)
 
@@ -137,9 +138,15 @@ func TestSoftwareInstallerCleanup(t *testing.T) {
 		require.NoError(t, err)
 	}
 
-	n, err = store.Cleanup(ctx, []string{installers[0], installers[2]})
+	// cleanup with a time in the past, nothing gets removed
+	n, err = store.Cleanup(ctx, []string{}, time.Now().Add(-time.Minute))
+	require.NoError(t, err)
+	require.Equal(t, 0, n)
+	assertExisting([]string{installers[0], installers[1], installers[2], installers[3]})
+
+	// cleanup in the future, all unused get removed
+	n, err = store.Cleanup(ctx, []string{installers[0], installers[2]}, time.Now().Add(time.Minute))
 	require.NoError(t, err)
 	require.Equal(t, 2, n)
-
 	assertExisting([]string{installers[0], installers[2]})
 }
diff --git a/server/datastore/mysql/activities.go b/server/datastore/mysql/activities.go
index d0e6dee037..650c097cb9 100644
--- a/server/datastore/mysql/activities.go
+++ b/server/datastore/mysql/activities.go
@@ -31,7 +31,12 @@ func (ds *Datastore) NewActivity(
 	var userName *string
 	var userEmail *string
 	if user != nil {
-		userID = &user.ID
+		// To support creating activities with users that were deleted. This can happen
+		// for automatically installed software which uses the author of the upload as the author of
+		// the installation.
+		if user.ID != 0 {
+			userID = &user.ID
+		}
 		userName = &user.Name
 		userEmail = &user.Email
 	}
@@ -237,15 +242,22 @@ func (ds *Datastore) ListHostUpcomingActivities(ctx context.Context, hostID uint
 		`SELECT
 			COUNT(*) c
 			FROM host_script_results hsr
+			LEFT OUTER JOIN
+		    	host_software_installs hsi ON hsi.execution_id = hsr.execution_id
 			WHERE hsr.host_id = :host_id AND
 						exit_code IS NULL AND
-						(sync_request = 0 OR created_at >= DATE_SUB(NOW(), INTERVAL :max_wait_time SECOND))`,
+						hsi.execution_id IS NULL AND
+						(sync_request = 0 OR hsr.created_at >= DATE_SUB(NOW(), INTERVAL :max_wait_time SECOND))`,
 		`SELECT
 			COUNT(*) c
 			FROM host_software_installs hsi
 			WHERE hsi.host_id = :host_id AND
-						pre_install_query_output IS NULL AND
-						install_script_exit_code IS NULL`,
+				hsi.status = :software_status_install_pending`,
+		`SELECT
+			COUNT(*) c
+			FROM host_software_installs hsi
+			WHERE hsi.host_id = :host_id AND
+				hsi.status = :software_status_uninstall_pending`,
 		`
 		SELECT
 			COUNT(*) c
@@ -260,8 +272,10 @@ func (ds *Datastore) ListHostUpcomingActivities(ctx context.Context, hostID uint
 
 	seconds := int(scripts.MaxServerWaitTime.Seconds())
 	countStmt, args, err := sqlx.Named(countStmt, map[string]any{
-		"host_id":       hostID,
-		"max_wait_time": seconds,
+		"host_id":                           hostID,
+		"max_wait_time":                     seconds,
+		"software_status_install_pending":   fleet.SoftwareInstallPending,
+		"software_status_uninstall_pending": fleet.SoftwareUninstallPending,
 	})
 	if err != nil {
 		return nil, nil, ctxerr.Wrap(ctx, err, "build count query from named args")
@@ -300,21 +314,26 @@ func (ds *Datastore) ListHostUpcomingActivities(ctx context.Context, hostID uint
 			host_display_names hdn ON hdn.host_id = hsr.host_id
 		LEFT OUTER JOIN
 			scripts scr ON scr.id = hsr.script_id
+		LEFT OUTER JOIN
+		    host_software_installs hsi ON hsi.execution_id = hsr.execution_id
 		WHERE
 			hsr.host_id = :host_id AND
 			hsr.exit_code IS NULL AND
 			(
 				hsr.sync_request = 0 OR
 				hsr.created_at >= DATE_SUB(NOW(), INTERVAL :max_wait_time SECOND)
-			)
+			) AND
+			hsi.execution_id IS NULL
 `,
 		// list pending software installs
 		fmt.Sprintf(`SELECT
 			hsi.execution_id as uuid,
-			u.name as name,
-			u.id as user_id,
-			u.gravatar_url as gravatar_url,
-			u.email as user_email,
+			-- policies with automatic installers generate a host_software_installs with (user_id=NULL,self_service=0),
+			-- thus the user_id for the upcoming activity needs to be the user that uploaded the software installer.
+			IF(hsi.user_id IS NULL AND NOT hsi.self_service, u2.name, u.name) AS name,
+			IF(hsi.user_id IS NULL AND NOT hsi.self_service, u2.id, u.id) as user_id,
+			IF(hsi.user_id IS NULL AND NOT hsi.self_service, u2.gravatar_url, u.gravatar_url) as gravatar_url,
+			IF(hsi.user_id IS NULL AND NOT hsi.self_service, u2.email, u.email) AS user_email,
 			:installed_software_type as activity_type,
 			hsi.created_at as created_at,
 			JSON_OBJECT(
@@ -323,8 +342,8 @@ func (ds *Datastore) ListHostUpcomingActivities(ctx context.Context, hostID uint
 				'software_title', COALESCE(st.name, ''),
 				'software_package', si.filename,
 				'install_uuid', hsi.execution_id,
-				'status', CAST(%s AS CHAR),
-				'self_service', si.self_service IS TRUE
+				'status', CAST(hsi.status AS CHAR),
+				'self_service', hsi.self_service IS TRUE
 			) as details
 		FROM
 			host_software_installs hsi
@@ -334,13 +353,48 @@ func (ds *Datastore) ListHostUpcomingActivities(ctx context.Context, hostID uint
 			software_titles st ON st.id = si.title_id
 		LEFT OUTER JOIN
 			users u ON u.id = hsi.user_id
+		LEFT OUTER JOIN
+			users u2 ON u2.id = si.user_id
 		LEFT OUTER JOIN
 			host_display_names hdn ON hdn.host_id = hsi.host_id
 		WHERE
 			hsi.host_id = :host_id AND
-			hsi.pre_install_query_output IS NULL AND
-			hsi.install_script_exit_code IS NULL
-		`, softwareInstallerHostStatusNamedQuery("hsi", "")),
+			hsi.status = :software_status_install_pending
+		`),
+		// list pending software uninstalls
+		fmt.Sprintf(`SELECT
+			hsi.execution_id as uuid,
+			-- policies with automatic installers generate a host_software_installs with (user_id=NULL,self_service=0),
+			-- thus the user_id for the upcoming activity needs to be the user that uploaded the software installer.
+			IF(hsi.user_id IS NULL AND NOT hsi.self_service, u2.name, u.name) AS name,
+			IF(hsi.user_id IS NULL AND NOT hsi.self_service, u2.id, u.id) as user_id,
+			IF(hsi.user_id IS NULL AND NOT hsi.self_service, u2.gravatar_url, u.gravatar_url) as gravatar_url,
+			IF(hsi.user_id IS NULL AND NOT hsi.self_service, u2.email, u.email) AS user_email,
+			:uninstalled_software_type as activity_type,
+			hsi.created_at as created_at,
+			JSON_OBJECT(
+				'host_id', hsi.host_id,
+				'host_display_name', COALESCE(hdn.display_name, ''),
+				'software_title', COALESCE(st.name, ''),
+				'script_execution_id', hsi.execution_id,
+				'status', CAST(hsi.status AS CHAR)
+			) as details
+		FROM
+			host_software_installs hsi
+		INNER JOIN
+			software_installers si ON si.id = hsi.software_installer_id
+		LEFT OUTER JOIN
+			software_titles st ON st.id = si.title_id
+		LEFT OUTER JOIN
+			users u ON u.id = hsi.user_id
+		LEFT OUTER JOIN
+			users u2 ON u2.id = si.user_id
+		LEFT OUTER JOIN
+			host_display_names hdn ON hdn.host_id = hsi.host_id
+		WHERE
+			hsi.host_id = :host_id AND
+			hsi.status = :software_status_uninstall_pending
+		`),
 		`
 SELECT
 	hvsi.command_uuid AS uuid,
@@ -356,8 +410,9 @@ SELECT
 		'software_title', st.name,
 		'app_store_id', hvsi.adam_id,
 		'command_uuid', hvsi.command_uuid,
+		'self_service', hvsi.self_service IS TRUE,
 		-- status is always pending because only pending MDM commands are upcoming.
-		'status', :software_status_pending
+		'status', :software_status_install_pending
 	) AS details
 FROM
 	host_vpp_software_installs hvsi
@@ -389,14 +444,14 @@ WHERE
 			details
 		FROM ( ` + strings.Join(listStmts, " UNION ALL ") + ` ) AS upcoming `
 	listStmt, args, err = sqlx.Named(listStmt, map[string]any{
-		"host_id":                      hostID,
-		"ran_script_type":              fleet.ActivityTypeRanScript{}.ActivityName(),
-		"installed_software_type":      fleet.ActivityTypeInstalledSoftware{}.ActivityName(),
-		"installed_app_store_app_type": fleet.ActivityInstalledAppStoreApp{}.ActivityName(),
-		"max_wait_time":                seconds,
-		"software_status_failed":       string(fleet.SoftwareInstallerFailed),
-		"software_status_installed":    string(fleet.SoftwareInstallerInstalled),
-		"software_status_pending":      string(fleet.SoftwareInstallerPending),
+		"host_id":                           hostID,
+		"ran_script_type":                   fleet.ActivityTypeRanScript{}.ActivityName(),
+		"installed_software_type":           fleet.ActivityTypeInstalledSoftware{}.ActivityName(),
+		"uninstalled_software_type":         fleet.ActivityTypeUninstalledSoftware{}.ActivityName(),
+		"installed_app_store_app_type":      fleet.ActivityInstalledAppStoreApp{}.ActivityName(),
+		"max_wait_time":                     seconds,
+		"software_status_install_pending":   fleet.SoftwareInstallPending,
+		"software_status_uninstall_pending": fleet.SoftwareUninstallPending,
 	})
 	if err != nil {
 		return nil, nil, ctxerr.Wrap(ctx, err, "build list query from named args")
diff --git a/server/datastore/mysql/activities_test.go b/server/datastore/mysql/activities_test.go
index e91a825227..17bd72e6ee 100644
--- a/server/datastore/mysql/activities_test.go
+++ b/server/datastore/mysql/activities_test.go
@@ -371,10 +371,15 @@ func testListHostUpcomingActivities(t *testing.T, ds *Datastore) {
 	u2 := test.NewUser(t, ds, "user2", "user2@example.com", false)
 	ctx := viewer.NewContext(noUserCtx, viewer.Viewer{User: u2})
 
+	test.CreateInsertGlobalVPPToken(t, ds)
+
 	// create three hosts
 	h1 := test.NewHost(t, ds, "h1.local", "10.10.10.1", "1", "1", time.Now())
+	nanoEnrollAndSetHostMDMData(t, ds, h1, false)
 	h2 := test.NewHost(t, ds, "h2.local", "10.10.10.2", "2", "2", time.Now())
+	nanoEnrollAndSetHostMDMData(t, ds, h2, false)
 	h3 := test.NewHost(t, ds, "h3.local", "10.10.10.3", "3", "3", time.Now())
+	nanoEnrollAndSetHostMDMData(t, ds, h3, false)
 
 	// create a couple of named scripts
 	scr1, err := ds.NewScript(ctx, &fleet.Script{
@@ -398,6 +403,7 @@ func testListHostUpcomingActivities(t *testing.T, ds *Datastore) {
 		Title:         "foo",
 		Source:        "apps",
 		Version:       "0.0.1",
+		UserID:        u.ID,
 	})
 	require.NoError(t, err)
 	sw2, err := ds.MatchOrCreateSoftwareInstaller(ctx, &fleet.UploadSoftwareInstallerPayload{
@@ -408,6 +414,7 @@ func testListHostUpcomingActivities(t *testing.T, ds *Datastore) {
 		Title:         "bar",
 		Source:        "apps",
 		Version:       "0.0.2",
+		UserID:        u.ID,
 	})
 	require.NoError(t, err)
 	sw1Meta, err := ds.GetSoftwareInstallerMetadataByID(ctx, sw1)
@@ -415,6 +422,35 @@ func testListHostUpcomingActivities(t *testing.T, ds *Datastore) {
 	sw2Meta, err := ds.GetSoftwareInstallerMetadataByID(ctx, sw2)
 	require.NoError(t, err)
 
+	// insert a VPP app
+	vppCommand1, vppCommand2 := "vpp-command-1", "vpp-command-2"
+	vppApp := &fleet.VPPApp{
+		Name: "vpp_no_team_app_1", VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "3", Platform: fleet.MacOSPlatform}},
+		BundleIdentifier: "b3",
+	}
+	_, err = ds.InsertVPPAppWithTeam(ctx, vppApp, nil)
+	require.NoError(t, err)
+
+	// install the VPP app on h1
+	commander, _ := createMDMAppleCommanderAndStorage(t, ds)
+	err = ds.InsertHostVPPSoftwareInstall(ctx, h1.ID, vppApp.VPPAppID, vppCommand1, "event-id-1", false)
+	require.NoError(t, err)
+	err = commander.EnqueueCommand(
+		ctx,
+		[]string{h1.UUID},
+		createRawAppleCmd("InstallApplication", vppCommand1),
+	)
+	require.NoError(t, err)
+	// install the VPP app on h2, self-service
+	err = ds.InsertHostVPPSoftwareInstall(noUserCtx, h2.ID, vppApp.VPPAppID, vppCommand2, "event-id-2", true)
+	require.NoError(t, err)
+	err = commander.EnqueueCommand(
+		ctx,
+		[]string{h1.UUID},
+		createRawAppleCmd("InstallApplication", vppCommand2),
+	)
+	require.NoError(t, err)
+
 	// create a sync script request for h1 that has been pending for > MaxWaitTime, will not show up
 	hsr, err := ds.NewHostScriptExecutionRequest(ctx, &fleet.HostScriptRequestPayload{HostID: h1.ID, ScriptContents: "sync", UserID: &u.ID, SyncRequest: true})
 	require.NoError(t, err)
@@ -460,7 +496,10 @@ func testListHostUpcomingActivities(t *testing.T, ds *Datastore) {
 		InstallScriptExitCode:     ptr.Int(0),
 	})
 	require.NoError(t, err)
-	h1Foo, err := ds.InsertSoftwareInstallRequest(noUserCtx, h1.ID, sw1Meta.InstallerID, false) // no user for this one
+
+	// No user for this one and not Self-service, means it was installed by Fleet thus the author was decided to be the admin
+	// that uploaded the installer.
+	h1Foo, err := ds.InsertSoftwareInstallRequest(noUserCtx, h1.ID, sw1Meta.InstallerID, false)
 	require.NoError(t, err)
 
 	// create a single pending request for h2, as well as a non-pending one
@@ -469,12 +508,16 @@ func testListHostUpcomingActivities(t *testing.T, ds *Datastore) {
 	h2A := hsr.ExecutionID
 	hsr, err = ds.NewHostScriptExecutionRequest(ctx, &fleet.HostScriptRequestPayload{HostID: h2.ID, ScriptContents: "F", UserID: &u.ID})
 	require.NoError(t, err)
-	_, err = ds.SetHostScriptExecutionResult(ctx, &fleet.HostScriptResultPayload{HostID: h2.ID, ExecutionID: hsr.ExecutionID, Output: "ok", ExitCode: 0})
+	_, _, err = ds.SetHostScriptExecutionResult(ctx,
+		&fleet.HostScriptResultPayload{HostID: h2.ID, ExecutionID: hsr.ExecutionID, Output: "ok", ExitCode: 0})
 	require.NoError(t, err)
 	h2F := hsr.ExecutionID
 	// add a pending software install request for h2
 	h2Bar, err := ds.InsertSoftwareInstallRequest(ctx, h2.ID, sw2Meta.InstallerID, false)
 	require.NoError(t, err)
+	// No user for this one and Self-service, means it was installed by the end user, so the user_id should be null/nil.
+	h2Foo, err := ds.InsertSoftwareInstallRequest(noUserCtx, h2.ID, sw1Meta.InstallerID, true)
+	require.NoError(t, err)
 
 	// nothing for h3
 
@@ -483,20 +526,26 @@ func testListHostUpcomingActivities(t *testing.T, ds *Datastore) {
 	endTime = SetOrderedCreatedAtTimestamps(t, ds, endTime, "host_software_installs", "execution_id", h1FooFailed, h1Bar)
 	endTime = SetOrderedCreatedAtTimestamps(t, ds, endTime, "host_script_results", "execution_id", h1C, h1D, h1E)
 	endTime = SetOrderedCreatedAtTimestamps(t, ds, endTime, "host_software_installs", "execution_id", h1FooInstalled, h1Foo)
+	endTime = SetOrderedCreatedAtTimestamps(t, ds, endTime, "host_software_installs", "execution_id", h1Foo)
+	endTime = SetOrderedCreatedAtTimestamps(t, ds, endTime, "host_software_installs", "execution_id", h2Foo)
 	endTime = SetOrderedCreatedAtTimestamps(t, ds, endTime, "host_software_installs", "execution_id", h2Bar)
-	SetOrderedCreatedAtTimestamps(t, ds, endTime, "host_script_results", "execution_id", h2A, h2F)
+	endTime = SetOrderedCreatedAtTimestamps(t, ds, endTime, "host_script_results", "execution_id", h2A, h2F)
+	SetOrderedCreatedAtTimestamps(t, ds, endTime, "host_vpp_software_installs", "command_uuid", vppCommand1, vppCommand2)
 
 	execIDsWithUser := map[string]bool{
-		h1A:   true,
-		h1B:   true,
-		h1C:   true,
-		h1D:   false,
-		h1E:   false,
-		h2A:   true,
-		h2F:   true,
-		h1Foo: false,
-		h1Bar: true,
-		h2Bar: true,
+		h1A:         true,
+		h1B:         true,
+		h1C:         true,
+		h1D:         false,
+		h1E:         false,
+		h2A:         true,
+		h2F:         true,
+		h1Foo:       true,
+		h2Foo:       false,
+		h1Bar:       true,
+		h2Bar:       true,
+		vppCommand1: true,
+		vppCommand2: false,
 	}
 	execIDsScriptName := map[string]string{
 		h1A: scr1.Name,
@@ -507,6 +556,10 @@ func testListHostUpcomingActivities(t *testing.T, ds *Datastore) {
 		h1Foo: "foo",
 		h1Bar: "bar",
 		h2Bar: "bar",
+		h2Foo: "foo",
+	}
+	execIDsWithUserAdminID := map[string]struct{}{
+		h1Foo: {},
 	}
 
 	cases := []struct {
@@ -519,49 +572,49 @@ func testListHostUpcomingActivities(t *testing.T, ds *Datastore) {
 			opts:      fleet.ListOptions{PerPage: 2},
 			hostID:    h1.ID,
 			wantExecs: []string{h1A, h1B},
-			wantMeta:  &fleet.PaginationMetadata{HasNextResults: true, HasPreviousResults: false, TotalResults: 7},
+			wantMeta:  &fleet.PaginationMetadata{HasNextResults: true, HasPreviousResults: false, TotalResults: 8},
 		},
 		{
 			opts:      fleet.ListOptions{Page: 1, PerPage: 2},
 			hostID:    h1.ID,
 			wantExecs: []string{h1Bar, h1C},
-			wantMeta:  &fleet.PaginationMetadata{HasNextResults: true, HasPreviousResults: true, TotalResults: 7},
+			wantMeta:  &fleet.PaginationMetadata{HasNextResults: true, HasPreviousResults: true, TotalResults: 8},
 		},
 		{
 			opts:      fleet.ListOptions{Page: 2, PerPage: 2},
 			hostID:    h1.ID,
 			wantExecs: []string{h1D, h1E},
-			wantMeta:  &fleet.PaginationMetadata{HasNextResults: true, HasPreviousResults: true, TotalResults: 7},
+			wantMeta:  &fleet.PaginationMetadata{HasNextResults: true, HasPreviousResults: true, TotalResults: 8},
 		},
 		{
 			opts:      fleet.ListOptions{Page: 3, PerPage: 2},
 			hostID:    h1.ID,
-			wantExecs: []string{h1Foo},
-			wantMeta:  &fleet.PaginationMetadata{HasNextResults: false, HasPreviousResults: true, TotalResults: 7},
+			wantExecs: []string{h1Foo, vppCommand1},
+			wantMeta:  &fleet.PaginationMetadata{HasNextResults: false, HasPreviousResults: true, TotalResults: 8},
 		},
 		{
 			opts:      fleet.ListOptions{PerPage: 4},
 			hostID:    h1.ID,
 			wantExecs: []string{h1A, h1B, h1Bar, h1C},
-			wantMeta:  &fleet.PaginationMetadata{HasNextResults: true, HasPreviousResults: false, TotalResults: 7},
+			wantMeta:  &fleet.PaginationMetadata{HasNextResults: true, HasPreviousResults: false, TotalResults: 8},
 		},
 		{
 			opts:      fleet.ListOptions{Page: 1, PerPage: 4},
 			hostID:    h1.ID,
-			wantExecs: []string{h1D, h1E, h1Foo},
-			wantMeta:  &fleet.PaginationMetadata{HasNextResults: false, HasPreviousResults: true, TotalResults: 7},
+			wantExecs: []string{h1D, h1E, h1Foo, vppCommand1},
+			wantMeta:  &fleet.PaginationMetadata{HasNextResults: false, HasPreviousResults: true, TotalResults: 8},
 		},
 		{
 			opts:      fleet.ListOptions{Page: 2, PerPage: 4},
 			hostID:    h1.ID,
 			wantExecs: []string{},
-			wantMeta:  &fleet.PaginationMetadata{HasNextResults: false, HasPreviousResults: true, TotalResults: 7},
+			wantMeta:  &fleet.PaginationMetadata{HasNextResults: false, HasPreviousResults: true, TotalResults: 8},
 		},
 		{
-			opts:      fleet.ListOptions{PerPage: 3},
+			opts:      fleet.ListOptions{PerPage: 4},
 			hostID:    h2.ID,
-			wantExecs: []string{h2Bar, h2A},
-			wantMeta:  &fleet.PaginationMetadata{HasNextResults: false, HasPreviousResults: false, TotalResults: 2},
+			wantExecs: []string{h2Foo, h2Bar, h2A, vppCommand2},
+			wantMeta:  &fleet.PaginationMetadata{HasNextResults: false, HasPreviousResults: false, TotalResults: 4},
 		},
 		{
 			opts:      fleet.ListOptions{},
@@ -602,6 +655,16 @@ func testListHostUpcomingActivities(t *testing.T, ds *Datastore) {
 				case fleet.ActivityTypeInstalledSoftware{}.ActivityName():
 					require.Equal(t, wantExec, details["install_uuid"], "result %d", i)
 					require.Equal(t, execIDsSoftwareTitle[wantExec], details["software_title"], "result %d", i)
+					if _, ok := execIDsWithUserAdminID[details["install_uuid"].(string)]; ok {
+						wantUser = u
+					} else {
+						wantUser = u2
+					}
+
+				case fleet.ActivityInstalledAppStoreApp{}.ActivityName():
+					require.Equal(t, wantExec, details["command_uuid"], "result %d", i)
+					require.Equal(t, "vpp_no_team_app_1", details["software_title"], "result %d", i)
+					require.Equal(t, !execIDsWithUser[wantExec], details["self_service"], "result %d", i)
 					wantUser = u2
 
 				default:
diff --git a/server/datastore/mysql/apple_mdm.go b/server/datastore/mysql/apple_mdm.go
index a0e95f7d75..b4ae8c5ac0 100644
--- a/server/datastore/mysql/apple_mdm.go
+++ b/server/datastore/mysql/apple_mdm.go
@@ -7,10 +7,12 @@ import (
 	"crypto/cipher"
 	"crypto/rand"
 	"database/sql"
+	"encoding/hex"
 	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
+	"math"
 	"os"
 	"strings"
 	"time"
@@ -25,10 +27,14 @@ import (
 	"github.com/fleetdm/fleet/v4/server/ptr"
 	"github.com/go-kit/log"
 	"github.com/go-kit/log/level"
+	"github.com/google/go-cmp/cmp"
 	"github.com/google/uuid"
 	"github.com/jmoiron/sqlx"
 )
 
+// addHostMDMCommandsBatchSize is the number of host MDM commands to add in a single batch. This is a var so that it can be modified in tests.
+var addHostMDMCommandsBatchSize = 10000
+
 func (ds *Datastore) NewMDMAppleConfigProfile(ctx context.Context, cp fleet.MDMAppleConfigProfile) (*fleet.MDMAppleConfigProfile, error) {
 	profUUID := "a" + uuid.New().String()
 	stmt := `
@@ -83,7 +89,7 @@ INSERT INTO
 			cp.LabelsExcludeAny[i].Exclude = true
 			labels = append(labels, cp.LabelsExcludeAny[i])
 		}
-		if err := batchSetProfileLabelAssociationsDB(ctx, tx, labels, "darwin"); err != nil {
+		if _, err := batchSetProfileLabelAssociationsDB(ctx, tx, labels, "darwin"); err != nil {
 			return ctxerr.Wrap(ctx, err, "inserting darwin profile label associations")
 		}
 
@@ -890,48 +896,36 @@ func insertMDMAppleHostDB(
 	return nil
 }
 
-type hostWithEnrolled struct {
-	fleet.Host
-	Enrolled *bool `db:"enrolled"`
+// hostToCreateFromMDM defines a common set of parameters required to create
+// host records without a pre-existing osquery enrollment from MDM flows like
+// ADE ingestion or OTA enrollments
+type hostToCreateFromMDM struct {
+	// HardwareSerial should match the value for hosts.hardware_serial
+	HardwareSerial string
+	// HardwareModel should match the value for hosts.hardware_model
+	HardwareModel string
+	// PlatformHint is used to determine hosts.platform, if it:
+	//
+	// - contains "iphone" the platform is "ios"
+	// - contains "ipad" the platform is "ipados"
+	// - otherwise the platform is "darwin"
+	PlatformHint string
 }
 
-func (ds *Datastore) IngestMDMAppleDevicesFromDEPSync(ctx context.Context, devices []godep.Device) (createdCount int64, teamID *uint, err error) {
-	if len(devices) < 1 {
-		level.Debug(ds.logger).Log("msg", "ingesting devices from DEP received < 1 device, skipping", "len(devices)", len(devices))
-		return 0, nil, nil
-	}
+func createHostFromMDMDB(
+	ctx context.Context,
+	tx sqlx.ExtContext,
+	logger log.Logger,
+	devices []hostToCreateFromMDM,
+	fromADE bool,
+	macOSTeam, iosTeam, ipadTeam *uint,
+) (int64, []fleet.Host, error) {
+	// NOTE: order of arguments for teams is important, see statement.
+	args := []any{iosTeam, ipadTeam, macOSTeam}
+	us, unionArgs := unionSelectDevices(devices)
+	args = append(args, unionArgs...)
 
-	appCfg, err := ds.AppConfig(ctx)
-	if err != nil {
-		return 0, nil, ctxerr.Wrap(ctx, err, "ingest mdm apple host get app config")
-	}
-
-	args := []interface{}{nil}
-	if name := appCfg.MDM.AppleBMDefaultTeam; name != "" {
-		team, err := ds.TeamByName(ctx, name)
-		switch {
-		case fleet.IsNotFound(err):
-			level.Debug(ds.logger).Log(
-				"msg",
-				"ingesting devices from DEP: unable to find default team assigned in config, the devices won't be assigned to a team",
-				"team_name",
-				name,
-			)
-			// If the team doesn't exist, we still ingest the device, but it won't
-			// belong to any team.
-		case err != nil:
-			return 0, nil, ctxerr.Wrap(ctx, err, "ingest mdm apple host get team by name")
-		default:
-			args[0] = team.ID
-			teamID = &team.ID
-		}
-	}
-
-	err = ds.withRetryTxx(ctx, func(tx sqlx.ExtContext) error {
-		us, unionArgs := unionSelectDevices(devices)
-		args = append(args, unionArgs...)
-
-		stmt := fmt.Sprintf(`
+	stmt := fmt.Sprintf(`
 		INSERT INTO hosts (
 			hardware_serial,
 			hardware_model,
@@ -950,97 +944,190 @@ func (ds *Datastore) IngestMDMAppleDevicesFromDEPSync(ctx context.Context, devic
 				'2000-01-01 00:00:00' AS detail_updated_at,
 				NULL AS osquery_host_id,
 				IF(us.platform = 'ios' OR us.platform = 'ipados', 0, 1) AS refetch_requested,
-				? AS team_id
+				CASE
+					WHEN us.platform = 'ios' THEN ?
+					WHEN us.platform = 'ipados' THEN ?
+					ELSE ?
+				END AS team_id
 			FROM (%s) us
 			LEFT JOIN hosts h ON us.hardware_serial = h.hardware_serial
 		WHERE
 			h.id IS NULL
 		GROUP BY
 			us.hardware_serial, us.platform)`,
-			us,
-		)
+		us,
+	)
 
-		res, err := tx.ExecContext(ctx, stmt, args...)
-		if err != nil {
-			return ctxerr.Wrap(ctx, err, "ingest mdm apple hosts from dep sync insert")
-		}
+	res, err := tx.ExecContext(ctx, stmt, args...)
+	if err != nil {
+		return 0, nil, ctxerr.Wrap(ctx, err, "inserting new host in MDM ingestion")
+	}
 
-		n, err := res.RowsAffected()
-		if err != nil {
-			return ctxerr.Wrap(ctx, err, "ingest mdm apple hosts from dep sync rows affected")
-		}
-		createdCount = n
+	n, _ := res.RowsAffected()
+	// get new host ids
+	args = []any{}
+	parts := []string{}
+	for _, d := range devices {
+		args = append(args, d.HardwareSerial)
+		parts = append(parts, "?")
+	}
 
-		// get new host ids
-		args = []interface{}{}
-		parts := []string{}
-		for _, d := range devices {
-			args = append(args, d.SerialNumber)
-			parts = append(parts, "?")
-		}
-		var hostsWithEnrolled []hostWithEnrolled
-		err = sqlx.SelectContext(ctx, tx, &hostsWithEnrolled, fmt.Sprintf(`
+	var hostsWithEnrolled []struct {
+		fleet.Host
+		Enrolled *bool `db:"enrolled"`
+	}
+	err = sqlx.SelectContext(ctx, tx, &hostsWithEnrolled, fmt.Sprintf(`
 			SELECT
 				h.id,
 				h.platform,
 				h.hardware_model,
 				h.hardware_serial,
+				h.hostname,
 				COALESCE(hmdm.enrolled, 0) as enrolled
 			FROM hosts h
 			LEFT JOIN host_mdm hmdm ON hmdm.host_id = h.id
 			WHERE h.hardware_serial IN(%s)`,
-			strings.Join(parts, ",")),
-			args...)
-		if err != nil {
-			return ctxerr.Wrap(ctx, err, "ingest mdm apple host get host ids")
+		strings.Join(parts, ",")),
+		args...)
+	if err != nil {
+		return 0, nil, ctxerr.Wrap(ctx, err, "ingest mdm apple host get host ids")
+	}
+
+	var hosts []fleet.Host
+	var unmanagedHostIDs []uint
+	for _, h := range hostsWithEnrolled {
+		hosts = append(hosts, h.Host)
+		if h.Enrolled == nil || !*h.Enrolled {
+			unmanagedHostIDs = append(unmanagedHostIDs, h.ID)
+		}
+	}
+
+	if err := upsertMDMAppleHostDisplayNamesDB(ctx, tx, hosts...); err != nil {
+		return 0, nil, ctxerr.Wrap(ctx, err, "ingest mdm apple host upsert display names")
+	}
+
+	if err := upsertMDMAppleHostLabelMembershipDB(ctx, tx, logger, hosts...); err != nil {
+		return 0, nil, ctxerr.Wrap(ctx, err, "ingest mdm apple host upsert label membership")
+	}
+
+	appCfg, err := appConfigDB(ctx, tx)
+	if err != nil {
+		return 0, nil, ctxerr.Wrap(ctx, err, "ingest mdm apple host get app config")
+	}
+
+	// only upsert MDM info for hosts that are unmanaged. This
+	// prevents us from overriding valuable info with potentially
+	// incorrect data. For example: if a host is enrolled in a
+	// third-party MDM, but gets assigned in ABM to Fleet (during
+	// migration) we'll get an 'added' event. In that case, we
+	// expect that MDM info will be updated in due time as we ingest
+	// future osquery data from the host
+	if err := upsertMDMAppleHostMDMInfoDB(
+		ctx,
+		tx,
+		appCfg.ServerSettings,
+		fromADE,
+		unmanagedHostIDs...,
+	); err != nil {
+		return 0, nil, ctxerr.Wrap(ctx, err, "ingest mdm apple host upsert MDM info")
+	}
+
+	return n, hosts, nil
+}
+
+func (ds *Datastore) IngestMDMAppleDeviceFromOTAEnrollment(
+	ctx context.Context,
+	teamID *uint,
+	deviceInfo fleet.MDMAppleMachineInfo,
+) error {
+	return ds.withRetryTxx(ctx, func(tx sqlx.ExtContext) error {
+		toInsert := []hostToCreateFromMDM{
+			{
+				HardwareSerial: deviceInfo.Serial,
+				PlatformHint:   deviceInfo.Product,
+				HardwareModel:  deviceInfo.Product,
+			},
+		}
+		_, _, err := createHostFromMDMDB(ctx, tx, ds.logger, toInsert, false, teamID, teamID, teamID)
+		return ctxerr.Wrap(ctx, err, "creating host from OTA enrollment")
+	})
+}
+
+func (ds *Datastore) IngestMDMAppleDevicesFromDEPSync(
+	ctx context.Context,
+	devices []godep.Device,
+	abmTokenID uint,
+	macOSTeam, iosTeam, ipadTeam *fleet.Team,
+) (createdCount int64, err error) {
+	if len(devices) < 1 {
+		level.Debug(ds.logger).Log("msg", "ingesting devices from DEP received < 1 device, skipping", "len(devices)", len(devices))
+		return 0, nil
+	}
+
+	var teamIDs []*uint
+	for _, team := range []*fleet.Team{macOSTeam, iosTeam, ipadTeam} {
+		if team == nil {
+			teamIDs = append(teamIDs, nil)
+			continue
 		}
 
-		var hosts []fleet.Host
-		var unmanagedHostIDs []uint
-		for _, h := range hostsWithEnrolled {
-			hosts = append(hosts, h.Host)
-			if h.Enrolled == nil || !*h.Enrolled {
-				unmanagedHostIDs = append(unmanagedHostIDs, h.ID)
+		exists, err := ds.TeamExists(ctx, team.ID)
+		if err != nil {
+			return 0, ctxerr.Wrap(ctx, err, "ingest mdm apple host get team by name")
+		}
+
+		if exists {
+			teamIDs = append(teamIDs, &team.ID)
+			continue
+		}
+
+		// If the team doesn't exist, we still ingest the device, but it won't
+		// belong to any team.
+		level.Debug(ds.logger).Log(
+			"msg",
+			"ingesting devices from ABM: unable to find default team assigned in config, the devices won't be assigned to a team",
+			"team_id",
+			team,
+		)
+		teamIDs = append(teamIDs, nil)
+	}
+
+	err = ds.withRetryTxx(ctx, func(tx sqlx.ExtContext) error {
+		htc := make([]hostToCreateFromMDM, len(devices))
+		for i, d := range devices {
+			htc[i] = hostToCreateFromMDM{
+				HardwareSerial: d.SerialNumber,
+				HardwareModel:  d.Model,
+				PlatformHint:   d.DeviceFamily,
 			}
 		}
 
-		if err := upsertMDMAppleHostDisplayNamesDB(ctx, tx, hosts...); err != nil {
-			return ctxerr.Wrap(ctx, err, "ingest mdm apple host upsert display names")
-		}
-
-		if err := upsertMDMAppleHostLabelMembershipDB(ctx, tx, ds.logger, hosts...); err != nil {
-			return ctxerr.Wrap(ctx, err, "ingest mdm apple host upsert label membership")
-		}
-		if err := upsertHostDEPAssignmentsDB(ctx, tx, hosts); err != nil {
-			return ctxerr.Wrap(ctx, err, "ingest mdm apple host upsert DEP assignments")
-		}
-
-		// only upsert MDM info for hosts that are unmanaged. This
-		// prevents us from overriding valuable info with potentially
-		// incorrect data. For example: if a host is enrolled in a
-		// third-party MDM, but gets assigned in ABM to Fleet (during
-		// migration) we'll get an 'added' event. In that case, we
-		// expect that MDM info will be updated in due time as we ingest
-		// future osquery data from the host
-		if err := upsertMDMAppleHostMDMInfoDB(
+		n, hosts, err := createHostFromMDMDB(
 			ctx,
 			tx,
-			appCfg.ServerSettings,
+			ds.logger,
+			htc,
 			true,
-			unmanagedHostIDs...,
-		); err != nil {
-			return ctxerr.Wrap(ctx, err, "ingest mdm apple host upsert MDM info")
+			teamIDs[0], teamIDs[1], teamIDs[2],
+		)
+		if err != nil {
+			return err
+		}
+		createdCount = n
+
+		if err := upsertHostDEPAssignmentsDB(ctx, tx, hosts, abmTokenID); err != nil {
+			return ctxerr.Wrap(ctx, err, "ingest mdm apple host upsert DEP assignments")
 		}
 
 		return nil
 	})
 
-	return createdCount, teamID, err
+	return createdCount, err
 }
 
-func (ds *Datastore) UpsertMDMAppleHostDEPAssignments(ctx context.Context, hosts []fleet.Host) error {
+func (ds *Datastore) UpsertMDMAppleHostDEPAssignments(ctx context.Context, hosts []fleet.Host, abmTokenID uint) error {
 	return ds.withTx(ctx, func(tx sqlx.ExtContext) error {
-		if err := upsertHostDEPAssignmentsDB(ctx, tx, hosts); err != nil {
+		if err := upsertHostDEPAssignmentsDB(ctx, tx, hosts, abmTokenID); err != nil {
 			return ctxerr.Wrap(ctx, err, "upsert host DEP assignments")
 		}
 
@@ -1048,13 +1135,13 @@ func (ds *Datastore) UpsertMDMAppleHostDEPAssignments(ctx context.Context, hosts
 	})
 }
 
-func upsertHostDEPAssignmentsDB(ctx context.Context, tx sqlx.ExtContext, hosts []fleet.Host) error {
+func upsertHostDEPAssignmentsDB(ctx context.Context, tx sqlx.ExtContext, hosts []fleet.Host, abmTokenID uint) error {
 	if len(hosts) == 0 {
 		return nil
 	}
 
 	stmt := `
-		INSERT INTO host_dep_assignments (host_id)
+		INSERT INTO host_dep_assignments (host_id, abm_token_id)
 		VALUES %s
 		ON DUPLICATE KEY UPDATE
 		  added_at = CURRENT_TIMESTAMP,
@@ -1063,8 +1150,8 @@ func upsertHostDEPAssignmentsDB(ctx context.Context, tx sqlx.ExtContext, hosts [
 	args := []interface{}{}
 	values := []string{}
 	for _, host := range hosts {
-		args = append(args, host.ID)
-		values = append(values, "(?)")
+		args = append(args, host.ID, abmTokenID)
+		values = append(values, "(?, ?)")
 	}
 
 	_, err := tx.ExecContext(ctx, fmt.Sprintf(stmt, strings.Join(values, ",")), args...)
@@ -1113,7 +1200,7 @@ func upsertMDMAppleHostMDMInfoDB(ctx context.Context, tx sqlx.ExtContext, server
 	}
 
 	var mdmID int64
-	if insertOnDuplicateDidInsert(result) {
+	if insertOnDuplicateDidInsertOrUpdate(result) {
 		mdmID, _ = result.LastInsertId()
 	} else {
 		stmt := `SELECT id FROM mobile_device_management_solutions WHERE name = ? AND server_url = ?`
@@ -1287,22 +1374,24 @@ func (ds *Datastore) MDMTurnOff(ctx context.Context, uuid string) error {
 	})
 }
 
-func unionSelectDevices(devices []godep.Device) (stmt string, args []interface{}) {
+func unionSelectDevices(devices []hostToCreateFromMDM) (stmt string, args []interface{}) {
 	for i, d := range devices {
 		if i == 0 {
 			stmt = "SELECT ? hardware_serial, ? hardware_model, ? platform"
 		} else {
 			stmt += " UNION SELECT ?, ?, ?"
 		}
-		// Map Apple's device family to Fleet's hosts.platform field.
-		platform := "darwin"
-		switch d.DeviceFamily {
-		case "iPhone":
-			platform = "ios"
-		case "iPad":
-			platform = "ipados"
+
+		// map the platform hint to Fleet's hosts.platform field.
+		normalizedHint := strings.ToLower(d.PlatformHint)
+		platform := string(fleet.MacOSPlatform)
+		switch {
+		case strings.Contains(normalizedHint, "iphone"):
+			platform = string(fleet.IOSPlatform)
+		case strings.Contains(normalizedHint, "ipad"):
+			platform = string(fleet.IPadOSPlatform)
 		}
-		args = append(args, d.SerialNumber, d.Model, platform)
+		args = append(args, d.HardwareSerial, d.HardwareModel, platform)
 	}
 
 	return stmt, args
@@ -1311,7 +1400,7 @@ func unionSelectDevices(devices []godep.Device) (stmt string, args []interface{}
 func (ds *Datastore) GetHostDEPAssignment(ctx context.Context, hostID uint) (*fleet.HostDEPAssignment, error) {
 	var res fleet.HostDEPAssignment
 	err := sqlx.GetContext(ctx, ds.reader(ctx), &res, `
-		SELECT host_id, added_at, deleted_at FROM host_dep_assignments hdep WHERE hdep.host_id = ?`, hostID)
+		SELECT host_id, added_at, deleted_at, abm_token_id FROM host_dep_assignments hdep WHERE hdep.host_id = ?`, hostID)
 	if err != nil {
 		if err == sql.ErrNoRows {
 			return nil, ctxerr.Wrap(ctx, notFound("HostDEPAssignment").WithID(hostID))
@@ -1422,7 +1511,8 @@ func (ds *Datastore) GetNanoMDMEnrollment(ctx context.Context, id string) (*flee
 
 func (ds *Datastore) BatchSetMDMAppleProfiles(ctx context.Context, tmID *uint, profiles []*fleet.MDMAppleConfigProfile) error {
 	return ds.withRetryTxx(ctx, func(tx sqlx.ExtContext) error {
-		return ds.batchSetMDMAppleProfilesDB(ctx, tx, tmID, profiles)
+		_, err := ds.batchSetMDMAppleProfilesDB(ctx, tx, tmID, profiles)
+		return err
 	})
 }
 
@@ -1432,7 +1522,7 @@ func (ds *Datastore) batchSetMDMAppleProfilesDB(
 	tx sqlx.ExtContext,
 	tmID *uint,
 	profiles []*fleet.MDMAppleConfigProfile,
-) error {
+) (updatedDB bool, err error) {
 	const loadExistingProfiles = `
 SELECT
   identifier,
@@ -1494,13 +1584,13 @@ ON DUPLICATE KEY UPDATE
 			if err == nil {
 				err = errors.New(ds.testBatchSetMDMAppleProfilesErr)
 			}
-			return ctxerr.Wrap(ctx, err, "build query to load existing profiles")
+			return false, ctxerr.Wrap(ctx, err, "build query to load existing profiles")
 		}
 		if err := sqlx.SelectContext(ctx, tx, &existingProfiles, stmt, args...); err != nil || strings.HasPrefix(ds.testBatchSetMDMAppleProfilesErr, "select") {
 			if err == nil {
 				err = errors.New(ds.testBatchSetMDMAppleProfilesErr)
 			}
-			return ctxerr.Wrap(ctx, err, "load existing profiles")
+			return false, ctxerr.Wrap(ctx, err, "load existing profiles")
 		}
 	}
 
@@ -1521,31 +1611,37 @@ ON DUPLICATE KEY UPDATE
 	var (
 		stmt string
 		args []interface{}
-		err  error
 	)
 	// delete the obsolete profiles (all those that are not in keepIdents or delivered by Fleet)
+	var result sql.Result
 	stmt, args, err = sqlx.In(deleteProfilesNotInList, profTeamID, append(keepIdents, fleetIdents...))
 	if err != nil || strings.HasPrefix(ds.testBatchSetMDMAppleProfilesErr, "indelete") {
 		if err == nil {
 			err = errors.New(ds.testBatchSetMDMAppleProfilesErr)
 		}
-		return ctxerr.Wrap(ctx, err, "build statement to delete obsolete profiles")
+		return false, ctxerr.Wrap(ctx, err, "build statement to delete obsolete profiles")
 	}
-	if _, err := tx.ExecContext(ctx, stmt, args...); err != nil || strings.HasPrefix(ds.testBatchSetMDMAppleProfilesErr, "delete") {
+	if result, err = tx.ExecContext(ctx, stmt, args...); err != nil || strings.HasPrefix(ds.testBatchSetMDMAppleProfilesErr, "delete") {
 		if err == nil {
 			err = errors.New(ds.testBatchSetMDMAppleProfilesErr)
 		}
-		return ctxerr.Wrap(ctx, err, "delete obsolete profiles")
+		return false, ctxerr.Wrap(ctx, err, "delete obsolete profiles")
+	}
+	if result != nil {
+		rows, _ := result.RowsAffected()
+		updatedDB = rows > 0
 	}
 
 	// insert the new profiles and the ones that have changed
 	for _, p := range incomingProfs {
-		if _, err := tx.ExecContext(ctx, insertNewOrEditedProfile, profTeamID, p.Identifier, p.Name, p.Mobileconfig); err != nil || strings.HasPrefix(ds.testBatchSetMDMAppleProfilesErr, "insert") {
+		if result, err = tx.ExecContext(ctx, insertNewOrEditedProfile, profTeamID, p.Identifier, p.Name,
+			p.Mobileconfig); err != nil || strings.HasPrefix(ds.testBatchSetMDMAppleProfilesErr, "insert") {
 			if err == nil {
 				err = errors.New(ds.testBatchSetMDMAppleProfilesErr)
 			}
-			return ctxerr.Wrapf(ctx, err, "insert new/edited profile with identifier %q", p.Identifier)
+			return false, ctxerr.Wrapf(ctx, err, "insert new/edited profile with identifier %q", p.Identifier)
 		}
+		updatedDB = updatedDB || insertOnDuplicateDidInsertOrUpdate(result)
 	}
 
 	// build a list of labels so the associations can be batch-set all at once
@@ -1561,19 +1657,19 @@ ON DUPLICATE KEY UPDATE
 			if err == nil {
 				err = errors.New(ds.testBatchSetMDMAppleProfilesErr)
 			}
-			return ctxerr.Wrap(ctx, err, "build query to load newly inserted profiles")
+			return false, ctxerr.Wrap(ctx, err, "build query to load newly inserted profiles")
 		}
 		if err := sqlx.SelectContext(ctx, tx, &newlyInsertedProfs, stmt, args...); err != nil || strings.HasPrefix(ds.testBatchSetMDMAppleProfilesErr, "reselect") {
 			if err == nil {
 				err = errors.New(ds.testBatchSetMDMAppleProfilesErr)
 			}
-			return ctxerr.Wrap(ctx, err, "load newly inserted profiles")
+			return false, ctxerr.Wrap(ctx, err, "load newly inserted profiles")
 		}
 
 		for _, newlyInsertedProf := range newlyInsertedProfs {
 			incomingProf, ok := incomingProfs[newlyInsertedProf.Identifier]
 			if !ok {
-				return ctxerr.Wrapf(ctx, err, "profile %q is in the database but was not incoming", newlyInsertedProf.Identifier)
+				return false, ctxerr.Wrapf(ctx, err, "profile %q is in the database but was not incoming", newlyInsertedProf.Identifier)
 			}
 
 			for _, label := range incomingProf.LabelsIncludeAll {
@@ -1589,13 +1685,15 @@ ON DUPLICATE KEY UPDATE
 	}
 
 	// insert label associations
-	if err := batchSetProfileLabelAssociationsDB(ctx, tx, incomingLabels, "darwin"); err != nil || strings.HasPrefix(ds.testBatchSetMDMAppleProfilesErr, "labels") {
+	var updatedLabels bool
+	if updatedLabels, err = batchSetProfileLabelAssociationsDB(ctx, tx, incomingLabels,
+		"darwin"); err != nil || strings.HasPrefix(ds.testBatchSetMDMAppleProfilesErr, "labels") {
 		if err == nil {
 			err = errors.New(ds.testBatchSetMDMAppleProfilesErr)
 		}
-		return ctxerr.Wrap(ctx, err, "inserting apple profile label associations")
+		return false, ctxerr.Wrap(ctx, err, "inserting apple profile label associations")
 	}
-	return nil
+	return updatedDB || updatedLabels, nil
 }
 
 func (ds *Datastore) BulkDeleteMDMAppleHostsConfigProfiles(ctx context.Context, profs []*fleet.MDMAppleProfilePayload) error {
@@ -1660,9 +1758,9 @@ func (ds *Datastore) bulkSetPendingMDMAppleHostProfilesDB(
 	ctx context.Context,
 	tx sqlx.ExtContext,
 	uuids []string,
-) error {
+) (updatedDB bool, err error) {
 	if len(uuids) == 0 {
-		return nil
+		return false, nil
 	}
 
 	appleMDMProfilesDesiredStateQuery := generateDesiredStateQuery("profile")
@@ -1708,18 +1806,39 @@ func (ds *Datastore) bulkSetPendingMDMAppleHostProfilesDB(
 		( hmap.host_uuid IS NOT NULL AND ( hmap.operation_type = ? OR hmap.operation_type IS NULL ) )
 `, fmt.Sprintf(appleMDMProfilesDesiredStateQuery, "h.uuid IN (?)", "h.uuid IN (?)", "h.uuid IN (?)"))
 
-	// TODO: if a very large number (~65K) of host uuids was matched (via
-	// uuids, teams or profile IDs), could result in too many placeholders (not
-	// an immediate concern).
-	stmt, args, err := sqlx.In(toInstallStmt, uuids, uuids, uuids, fleet.MDMOperationTypeRemove)
-	if err != nil {
-		return ctxerr.Wrap(ctx, err, "building profiles to install statement")
+	// batches of 10K hosts because h.uuid appears three times in the
+	// query, and the max number of prepared statements is 65K, this was
+	// good enough during a load test and gives us wiggle room if we add
+	// more arguments and we forget to update the batch size.
+	selectProfilesBatchSize := 10_000
+	if ds.testSelectMDMProfilesBatchSize > 0 {
+		selectProfilesBatchSize = ds.testSelectMDMProfilesBatchSize
 	}
+	selectProfilesTotalBatches := int(math.Ceil(float64(len(uuids)) / float64(selectProfilesBatchSize)))
 
 	var wantedProfiles []*fleet.MDMAppleProfilePayload
-	err = sqlx.SelectContext(ctx, tx, &wantedProfiles, stmt, args...)
-	if err != nil {
-		return ctxerr.Wrap(ctx, err, "bulk set pending profile status execute")
+	for i := 0; i < selectProfilesTotalBatches; i++ {
+		start := i * selectProfilesBatchSize
+		end := start + selectProfilesBatchSize
+		if end > len(uuids) {
+			end = len(uuids)
+		}
+
+		batchUUIDs := uuids[start:end]
+
+		stmt, args, err := sqlx.In(toInstallStmt, batchUUIDs, batchUUIDs, batchUUIDs, fleet.MDMOperationTypeRemove)
+		if err != nil {
+			return false, ctxerr.Wrapf(ctx, err, "building statement to select profiles to install, batch %d of %d", i,
+				selectProfilesTotalBatches)
+		}
+
+		var partialResult []*fleet.MDMAppleProfilePayload
+		err = sqlx.SelectContext(ctx, tx, &partialResult, stmt, args...)
+		if err != nil {
+			return false, ctxerr.Wrapf(ctx, err, "selecting profiles to install, batch %d of %d", i, selectProfilesTotalBatches)
+		}
+
+		wantedProfiles = append(wantedProfiles, partialResult...)
 	}
 
 	// Exclude macOS only profiles from iPhones/iPads.
@@ -1756,28 +1875,44 @@ func (ds *Datastore) bulkSetPendingMDMAppleHostProfilesDB(
 		)
 `, fmt.Sprintf(appleMDMProfilesDesiredStateQuery, "h.uuid IN (?)", "h.uuid IN (?)", "h.uuid IN (?)"))
 
-	// TODO: if a very large number (~65K) of host uuids was matched (via
-	// uuids, teams or profile IDs), could result in too many placeholders (not
-	// an immediate concern). Note that uuids are provided twice.
-	stmt, args, err = sqlx.In(toRemoveStmt, uuids, uuids, uuids, uuids, fleet.MDMOperationTypeRemove)
-	if err != nil {
-		return ctxerr.Wrap(ctx, err, "building profiles to remove statement")
-	}
 	var currentProfiles []*fleet.MDMAppleProfilePayload
-	err = sqlx.SelectContext(ctx, tx, &currentProfiles, stmt, args...)
-	if err != nil {
-		return ctxerr.Wrap(ctx, err, "fetching profiles to remove")
+	for i := 0; i < selectProfilesTotalBatches; i++ {
+		start := i * selectProfilesBatchSize
+		end := start + selectProfilesBatchSize
+		if end > len(uuids) {
+			end = len(uuids)
+		}
+
+		batchUUIDs := uuids[start:end]
+
+		stmt, args, err := sqlx.In(toRemoveStmt, batchUUIDs, batchUUIDs, batchUUIDs, batchUUIDs, fleet.MDMOperationTypeRemove)
+		if err != nil {
+			return false, ctxerr.Wrap(ctx, err, "building profiles to remove statement")
+		}
+		var partialResult []*fleet.MDMAppleProfilePayload
+		err = sqlx.SelectContext(ctx, tx, &partialResult, stmt, args...)
+		if err != nil {
+			return false, ctxerr.Wrap(ctx, err, "fetching profiles to remove")
+		}
+
+		currentProfiles = append(currentProfiles, partialResult...)
 	}
 
 	if len(wantedProfiles) == 0 && len(currentProfiles) == 0 {
-		return nil
+		return false, nil
 	}
 
 	// delete all host profiles to start from a clean slate, new entries will be added next
 	// TODO(roberto): is this really necessary? this was pre-existing
 	// behavior but I think it can be refactored. For now leaving it as-is.
-	if err := ds.bulkDeleteMDMAppleHostsConfigProfilesDB(ctx, tx, wantedProfiles); err != nil {
-		return ctxerr.Wrap(ctx, err, "bulk delete all profiles")
+	//
+	// TODO part II(roberto): we found this call to be a major bottleneck during load testing
+	// https://github.com/fleetdm/fleet/issues/21338
+	if len(wantedProfiles) > 0 {
+		if err := ds.bulkDeleteMDMAppleHostsConfigProfilesDB(ctx, tx, wantedProfiles); err != nil {
+			return false, ctxerr.Wrap(ctx, err, "bulk delete all profiles")
+		}
+		updatedDB = true
 	}
 
 	// profileIntersection tracks profilesToAdd ∩ profilesToRemove, this is used to avoid:
@@ -1798,11 +1933,57 @@ func (ds *Datastore) bulkSetPendingMDMAppleHostProfilesDB(
 			hostProfilesToClean = append(hostProfilesToClean, p)
 		}
 	}
-	if err := ds.bulkDeleteMDMAppleHostsConfigProfilesDB(ctx, tx, hostProfilesToClean); err != nil {
-		return ctxerr.Wrap(ctx, err, "bulk delete profiles to clean")
+	if len(hostProfilesToClean) > 0 {
+		if err := ds.bulkDeleteMDMAppleHostsConfigProfilesDB(ctx, tx, hostProfilesToClean); err != nil {
+			return false, ctxerr.Wrap(ctx, err, "bulk delete profiles to clean")
+		}
+		updatedDB = true
 	}
 
+	profilesToInsert := make(map[string]*fleet.MDMAppleProfilePayload)
+
 	executeUpsertBatch := func(valuePart string, args []any) error {
+		// Check if the update needs to be done at all.
+		selectStmt := fmt.Sprintf(`
+			SELECT 
+				host_uuid,
+				profile_uuid,
+				profile_identifier,
+				status,
+				COALESCE(operation_type, '') AS operation_type,
+				COALESCE(detail, '') AS detail,
+				command_uuid,
+				profile_name,
+				checksum,
+				profile_uuid
+			FROM host_mdm_apple_profiles WHERE (host_uuid, profile_uuid) IN (%s)`,
+			strings.TrimSuffix(strings.Repeat("(?,?),", len(profilesToInsert)), ","))
+		var selectArgs []any
+		for _, p := range profilesToInsert {
+			selectArgs = append(selectArgs, p.HostUUID, p.ProfileUUID)
+		}
+		var existingProfiles []fleet.MDMAppleProfilePayload
+		if err := sqlx.SelectContext(ctx, tx, &existingProfiles, selectStmt, selectArgs...); err != nil {
+			return ctxerr.Wrap(ctx, err, "bulk set pending profile status select existing")
+		}
+		var updateNeeded bool
+		if len(existingProfiles) == len(profilesToInsert) {
+			for _, exist := range existingProfiles {
+				insert, ok := profilesToInsert[fmt.Sprintf("%s\n%s", exist.HostUUID, exist.ProfileUUID)]
+				if !ok || !exist.Equal(*insert) {
+					updateNeeded = true
+					break
+				}
+			}
+		} else {
+			updateNeeded = true
+		}
+		if !updateNeeded {
+			// All profiles are already in the database, no need to update.
+			return nil
+		}
+
+		updatedDB = true
 		baseStmt := fmt.Sprintf(`
 				INSERT INTO host_mdm_apple_profiles (
 					profile_uuid,
@@ -1842,6 +2023,7 @@ func (ds *Datastore) bulkSetPendingMDMAppleHostProfilesDB(
 
 	resetBatch := func() {
 		batchCount = 0
+		clear(profilesToInsert)
 		pargs = pargs[:0]
 		psb.Reset()
 	}
@@ -1849,6 +2031,18 @@ func (ds *Datastore) bulkSetPendingMDMAppleHostProfilesDB(
 	for _, p := range wantedProfiles {
 		if pp, ok := profileIntersection.GetMatchingProfileInCurrentState(p); ok {
 			if pp.Status != &fleet.MDMDeliveryFailed && bytes.Equal(pp.Checksum, p.Checksum) {
+				profilesToInsert[fmt.Sprintf("%s\n%s", p.HostUUID, p.ProfileUUID)] = &fleet.MDMAppleProfilePayload{
+					ProfileUUID:       p.ProfileUUID,
+					ProfileIdentifier: p.ProfileIdentifier,
+					ProfileName:       p.ProfileName,
+					HostUUID:          p.HostUUID,
+					HostPlatform:      p.HostPlatform,
+					Checksum:          p.Checksum,
+					Status:            pp.Status,
+					OperationType:     pp.OperationType,
+					Detail:            pp.Detail,
+					CommandUUID:       pp.CommandUUID,
+				}
 				pargs = append(pargs, p.ProfileUUID, p.HostUUID, p.ProfileIdentifier, p.ProfileName, p.Checksum,
 					pp.OperationType, pp.Status, pp.CommandUUID, pp.Detail)
 				psb.WriteString("(?, ?, ?, ?, ?, ?, ?, ?, ?),")
@@ -1856,7 +2050,7 @@ func (ds *Datastore) bulkSetPendingMDMAppleHostProfilesDB(
 
 				if batchCount >= batchSize {
 					if err := executeUpsertBatch(psb.String(), pargs); err != nil {
-						return err
+						return false, err
 					}
 					resetBatch()
 				}
@@ -1864,6 +2058,18 @@ func (ds *Datastore) bulkSetPendingMDMAppleHostProfilesDB(
 			}
 		}
 
+		profilesToInsert[fmt.Sprintf("%s\n%s", p.HostUUID, p.ProfileUUID)] = &fleet.MDMAppleProfilePayload{
+			ProfileUUID:       p.ProfileUUID,
+			ProfileIdentifier: p.ProfileIdentifier,
+			ProfileName:       p.ProfileName,
+			HostUUID:          p.HostUUID,
+			HostPlatform:      p.HostPlatform,
+			Checksum:          p.Checksum,
+			OperationType:     fleet.MDMOperationTypeInstall,
+			Status:            nil,
+			CommandUUID:       "",
+			Detail:            "",
+		}
 		pargs = append(pargs, p.ProfileUUID, p.HostUUID, p.ProfileIdentifier, p.ProfileName, p.Checksum,
 			fleet.MDMOperationTypeInstall, nil, "", "")
 		psb.WriteString("(?, ?, ?, ?, ?, ?, ?, ?, ?),")
@@ -1871,7 +2077,7 @@ func (ds *Datastore) bulkSetPendingMDMAppleHostProfilesDB(
 
 		if batchCount >= batchSize {
 			if err := executeUpsertBatch(psb.String(), pargs); err != nil {
-				return err
+				return false, err
 			}
 			resetBatch()
 		}
@@ -1881,13 +2087,25 @@ func (ds *Datastore) bulkSetPendingMDMAppleHostProfilesDB(
 		if _, ok := profileIntersection.GetMatchingProfileInDesiredState(p); ok {
 			continue
 		}
-		// If the installation failed, then we do not want to change the operation to "Remove".
+		// If the profile wasn't installed, then we do not want to change the operation to "Remove".
 		// Doing so will result in Fleet attempting to remove a profile that doesn't exist on the
 		// host (since the installation failed). Skipping it here will lead to it being removed from
 		// the host in Fleet during profile reconciliation, which is what we want.
-		if p.FailedToInstallOnHost() {
+		if p.DidNotInstallOnHost() {
 			continue
 		}
+		profilesToInsert[fmt.Sprintf("%s\n%s", p.HostUUID, p.ProfileUUID)] = &fleet.MDMAppleProfilePayload{
+			ProfileUUID:       p.ProfileUUID,
+			ProfileIdentifier: p.ProfileIdentifier,
+			ProfileName:       p.ProfileName,
+			HostUUID:          p.HostUUID,
+			HostPlatform:      p.HostPlatform,
+			Checksum:          p.Checksum,
+			OperationType:     fleet.MDMOperationTypeRemove,
+			Status:            nil,
+			CommandUUID:       "",
+			Detail:            "",
+		}
 		pargs = append(pargs, p.ProfileUUID, p.HostUUID, p.ProfileIdentifier, p.ProfileName, p.Checksum,
 			fleet.MDMOperationTypeRemove, nil, "", "")
 		psb.WriteString("(?, ?, ?, ?, ?, ?, ?, ?, ?),")
@@ -1895,7 +2113,7 @@ func (ds *Datastore) bulkSetPendingMDMAppleHostProfilesDB(
 
 		if batchCount >= batchSize {
 			if err := executeUpsertBatch(psb.String(), pargs); err != nil {
-				return err
+				return false, err
 			}
 			resetBatch()
 		}
@@ -1903,10 +2121,10 @@ func (ds *Datastore) bulkSetPendingMDMAppleHostProfilesDB(
 
 	if batchCount > 0 {
 		if err := executeUpsertBatch(psb.String(), pargs); err != nil {
-			return err
+			return false, err
 		}
 	}
-	return nil
+	return updatedDB, nil
 }
 
 // mdmEntityTypeToDynamicNames tracks what names should be used in the
@@ -2960,21 +3178,74 @@ func (ds *Datastore) BulkUpsertMDMAppleConfigProfiles(ctx context.Context, paylo
 	return nil
 }
 
-func (ds *Datastore) InsertMDMAppleBootstrapPackage(ctx context.Context, bp *fleet.MDMAppleBootstrapPackage) error {
-	stmt := `
-          INSERT INTO mdm_apple_bootstrap_packages (team_id, name, sha256, bytes, token)
-	  VALUES (?, ?, ?, ?, ?)
-	`
-
-	_, err := ds.writer(ctx).ExecContext(ctx, stmt, bp.TeamID, bp.Name, bp.Sha256, bp.Bytes, bp.Token)
-	if err != nil {
-		if IsDuplicate(err) {
-			return ctxerr.Wrap(ctx, alreadyExists("BootstrapPackage", fmt.Sprintf("for team %d", bp.TeamID)))
+func isMDMAppleBootstrapPackageInDB(ctx context.Context, q sqlx.QueryerContext, teamID uint) (isInDB, existsForTeam bool, err error) {
+	const stmt = `SELECT COALESCE(LENGTH(bytes), 0) FROM mdm_apple_bootstrap_packages WHERE team_id = ?`
+	var pkgLen int
+	if err := sqlx.GetContext(ctx, q, &pkgLen, stmt, teamID); err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			return false, false, nil
 		}
-		return ctxerr.Wrap(ctx, err, "create bootstrap package")
+		return false, false, ctxerr.Wrapf(ctx, err, "check for bootstrap package content in database for team %d", teamID)
+	}
+	return pkgLen > 0, true, nil
+}
+
+func (ds *Datastore) InsertMDMAppleBootstrapPackage(ctx context.Context, bp *fleet.MDMAppleBootstrapPackage, pkgStore fleet.MDMBootstrapPackageStore) error {
+	const insStmt = `INSERT INTO mdm_apple_bootstrap_packages (team_id, name, sha256, bytes, token) VALUES (?, ?, ?, ?, ?)`
+	execInsert := func(args ...any) error {
+		if _, err := ds.writer(ctx).ExecContext(ctx, insStmt, args...); err != nil {
+			if IsDuplicate(err) {
+				return ctxerr.Wrap(ctx, alreadyExists("BootstrapPackage", fmt.Sprintf("for team %d", bp.TeamID)))
+			}
+			return ctxerr.Wrap(ctx, err, "create bootstrap package")
+		}
+		return nil
 	}
 
-	return nil
+	if pkgStore == nil {
+		// no S3 storage configured, insert the metadata and the content in the DB
+		return execInsert(bp.TeamID, bp.Name, bp.Sha256, bp.Bytes, bp.Token)
+	}
+
+	// using distinct storages for content and metadata introduces an
+	// intractable problem: the operation cannot be atomic (all succeed or all
+	// fail together), so what we do instead is to minimize the risk of data
+	// inconsistency:
+	//
+	//   1. check if the row exists in the DB, if so fail immediately with a
+	//   duplicate error (which would happen at the INSERT stage anyway
+	//   otherwise).
+	//   2. if it does not exist in the DB, check if the package is already on
+	//   S3, to avoid a costly upload if it is.
+	//   3. if it is not already on S3, upload the package - if this fails,
+	//   return and the DB was not touched and data is still consistent.
+	//   4. after upload, insert the metadata in the DB - if this fails, the
+	//   only possible inconsistency is an unused package stored on S3, which a
+	//   cron job will eventually cleanup.
+	//   5. if everything succeeds, data is consistent and the S3 package
+	//   cannot be used before it is uploaded (since the DB row is inserted
+	//   after upload).
+	_, existsInDB, err := isMDMAppleBootstrapPackageInDB(ctx, ds.writer(ctx), bp.TeamID)
+	if err != nil {
+		return err
+	}
+	if existsInDB {
+		return ctxerr.Wrap(ctx, alreadyExists("BootstrapPackage", fmt.Sprintf("for team %d", bp.TeamID)))
+	}
+
+	pkgID := hex.EncodeToString(bp.Sha256)
+	ok, err := pkgStore.Exists(ctx, pkgID)
+	if err != nil {
+		return ctxerr.Wrapf(ctx, err, "check if bootstrap package %s already exists", pkgID)
+	}
+	if !ok {
+		if err := pkgStore.Put(ctx, pkgID, bytes.NewReader(bp.Bytes)); err != nil {
+			return ctxerr.Wrapf(ctx, err, "upload bootstrap package %s to S3", pkgID)
+		}
+	}
+
+	// insert in the DB with a NULL bytes content (to indicate it is on S3)
+	return execInsert(bp.TeamID, bp.Name, bp.Sha256, nil, bp.Token)
 }
 
 func (ds *Datastore) CopyDefaultMDMAppleBootstrapPackage(ctx context.Context, ac *fleet.AppConfig, toTeamID uint) error {
@@ -2985,6 +3256,9 @@ func (ds *Datastore) CopyDefaultMDMAppleBootstrapPackage(ctx context.Context, ac
 		return ctxerr.New(ctx, "team id must not be zero")
 	}
 
+	// NOTE: if the bootstrap package is stored in S3, nothing needs to happen on
+	// S3 for a copy of it since the bytes are the same and the stored contents
+	// is the same (the sha256 is copied, so it points to the same file on S3).
 	return ds.withRetryTxx(ctx, func(tx sqlx.ExtContext) error {
 		// Copy the bytes for the default bootstrap package to the specified team
 		insertStmt := `
@@ -3029,6 +3303,12 @@ WHERE id = ?
 }
 
 func (ds *Datastore) DeleteMDMAppleBootstrapPackage(ctx context.Context, teamID uint) error {
+	// NOTE: if S3 storage is used for the bootstrap package, we don't delete it
+	// here. The reason for this is that other teams may be using the same
+	// package, so it would use the same S3 key (based on its hash). Instead we
+	// rely on the cron job to clear unused packages from S3. Outside of using up
+	// space in the bucket, an unused package on S3 is not a problem.
+
 	stmt := "DELETE FROM mdm_apple_bootstrap_packages WHERE team_id = ?"
 	res, err := ds.writer(ctx).ExecContext(ctx, stmt, teamID)
 	if err != nil {
@@ -3042,8 +3322,9 @@ func (ds *Datastore) DeleteMDMAppleBootstrapPackage(ctx context.Context, teamID
 	return nil
 }
 
-func (ds *Datastore) GetMDMAppleBootstrapPackageBytes(ctx context.Context, token string) (*fleet.MDMAppleBootstrapPackage, error) {
-	stmt := "SELECT name, bytes FROM mdm_apple_bootstrap_packages WHERE token = ?"
+func (ds *Datastore) GetMDMAppleBootstrapPackageBytes(ctx context.Context, token string, pkgStore fleet.MDMBootstrapPackageStore) (*fleet.MDMAppleBootstrapPackage, error) {
+	const stmt = `SELECT name, bytes, sha256 FROM mdm_apple_bootstrap_packages WHERE token = ?`
+
 	var bp fleet.MDMAppleBootstrapPackage
 	if err := sqlx.GetContext(ctx, ds.reader(ctx), &bp, stmt, token); err != nil {
 		if err == sql.ErrNoRows {
@@ -3051,6 +3332,24 @@ func (ds *Datastore) GetMDMAppleBootstrapPackageBytes(ctx context.Context, token
 		}
 		return nil, ctxerr.Wrap(ctx, err, "get bootstrap package bytes")
 	}
+
+	if pkgStore != nil && len(bp.Bytes) == 0 {
+		// bootstrap package is stored on S3, retrieve it
+		pkgID := hex.EncodeToString(bp.Sha256)
+		rc, _, err := pkgStore.Get(ctx, pkgID)
+		if err != nil {
+			return nil, ctxerr.Wrapf(ctx, err, "get bootstrap package %s from S3", pkgID)
+		}
+		defer rc.Close()
+
+		// TODO: optimize memory usage by supporting a streaming approach
+		// throughout the API (we have a similar issue with software installers).
+		// Currently we load everything in memory and those can be quite big.
+		bp.Bytes, err = io.ReadAll(rc)
+		if err != nil {
+			return nil, ctxerr.Wrapf(ctx, err, "reading bootstrap package %s from S3", pkgID)
+		}
+	}
 	return &bp, nil
 }
 
@@ -3153,6 +3452,27 @@ func (ds *Datastore) GetMDMAppleBootstrapPackageMeta(ctx context.Context, teamID
 	return &bp, nil
 }
 
+func (ds *Datastore) CleanupUnusedBootstrapPackages(ctx context.Context, pkgStore fleet.MDMBootstrapPackageStore, removeCreatedBefore time.Time) error {
+	if pkgStore == nil {
+		// no-op in this case, possible if not running with a Premium license or
+		// configured S3 storage
+		return nil
+	}
+
+	// get the list of bootstrap package hashes that are in use
+	var shaIDs [][]byte
+	if err := sqlx.SelectContext(ctx, ds.reader(ctx), &shaIDs, `SELECT DISTINCT sha256 FROM mdm_apple_bootstrap_packages`); err != nil {
+		return ctxerr.Wrap(ctx, err, "get list of bootstrap packages in use")
+	}
+	var pkgIDs []string
+	for _, sha := range shaIDs {
+		pkgIDs = append(pkgIDs, hex.EncodeToString(sha))
+	}
+
+	_, err := pkgStore.Cleanup(ctx, pkgIDs, removeCreatedBefore)
+	return ctxerr.Wrap(ctx, err, "cleanup unused bootstrap packages")
+}
+
 func (ds *Datastore) CleanupDiskEncryptionKeysOnTeamChange(ctx context.Context, hostIDs []uint, newTeamID *uint) error {
 	return ds.withTx(ctx, func(tx sqlx.ExtContext) error {
 		return cleanupDiskEncryptionKeysOnTeamChangeDB(ctx, tx, hostIDs, newTeamID)
@@ -3230,7 +3550,6 @@ func (ds *Datastore) SetOrUpdateMDMAppleSetupAssistant(ctx context.Context, asst
 			(?, ?, ?, ?)
 		ON DUPLICATE KEY UPDATE
 			updated_at = IF(profile = VALUES(profile) AND name = VALUES(name), updated_at, CURRENT_TIMESTAMP),
-			profile_uuid = IF(profile = VALUES(profile) AND name = VALUES(name), profile_uuid, ''),
 			name = VALUES(name),
 			profile = VALUES(profile)
 `
@@ -3238,41 +3557,116 @@ func (ds *Datastore) SetOrUpdateMDMAppleSetupAssistant(ctx context.Context, asst
 	if asst.TeamID != nil {
 		globalOrTmID = *asst.TeamID
 	}
-	_, err := ds.writer(ctx).ExecContext(ctx, stmt, asst.TeamID, globalOrTmID, asst.Name, asst.Profile)
+	res, err := ds.writer(ctx).ExecContext(ctx, stmt, asst.TeamID, globalOrTmID, asst.Name, asst.Profile)
 	if err != nil {
 		return nil, ctxerr.Wrap(ctx, err, "upsert mdm apple setup assistant")
 	}
 
+	// TODO(mna): to improve, previously we only cleared the profile UUIDs if the
+	// profile/name did change, but from tests it seems we can't rely on
+	// insertOnDuplicateDidUpdate to handle this case properly (presumably
+	// because the updated_at update condition is too complex?), so at the moment
+	// this clears the profile uuids at all times, even if the profile did not
+	// change.
+	if insertOnDuplicateDidInsertOrUpdate(res) {
+		// profile was updated, need to clear the profile uuids
+		if err := ds.SetMDMAppleSetupAssistantProfileUUID(ctx, asst.TeamID, "", ""); err != nil {
+			return nil, ctxerr.Wrap(ctx, err, "clear mdm apple setup assistant profiles")
+		}
+	}
+
 	// reload to return the proper timestamp and id
 	return ds.getMDMAppleSetupAssistant(ctx, ds.writer(ctx), asst.TeamID)
 }
 
-func (ds *Datastore) SetMDMAppleSetupAssistantProfileUUID(ctx context.Context, teamID *uint, profileUUID string) error {
-	const stmt = `
-	UPDATE
-		mdm_apple_setup_assistants
-	SET
-		profile_uuid = ?,
-		-- ensure updated_at does not change, as it is used to reflect the time
-		-- the setup assistant was uploaded, not when its profile was defined
-		-- with Apple's API.
-		updated_at = updated_at
-	WHERE global_or_team_id = ?`
+func (ds *Datastore) SetMDMAppleSetupAssistantProfileUUID(ctx context.Context, teamID *uint, profileUUID, abmTokenOrgName string) error {
+	const clearStmt = `
+		DELETE FROM mdm_apple_setup_assistant_profiles
+			WHERE setup_assistant_id = (
+				SELECT
+					id
+				FROM
+					mdm_apple_setup_assistants
+				WHERE
+					global_or_team_id = ?
+			)`
+
+	const upsertStmt = `
+	INSERT INTO mdm_apple_setup_assistant_profiles (
+		setup_assistant_id, abm_token_id, profile_uuid
+	) (
+		SELECT
+			mas.id, abt.id, ?
+		FROM
+			mdm_apple_setup_assistants mas,
+			abm_tokens abt
+		WHERE
+			mas.global_or_team_id = ? AND
+			abt.organization_name = ? AND
+			mas.id IS NOT NULL AND
+			abt.id IS NOT NULL
+	)
+	ON DUPLICATE KEY UPDATE
+		profile_uuid = VALUES(profile_uuid)
+	`
 
 	var globalOrTmID uint
 	if teamID != nil {
 		globalOrTmID = *teamID
 	}
-	res, err := ds.writer(ctx).ExecContext(ctx, stmt, profileUUID, globalOrTmID)
+
+	if profileUUID == "" && abmTokenOrgName == "" {
+		// delete all profile uuids for that team, regardless of ABM token
+		_, err := ds.writer(ctx).ExecContext(ctx, clearStmt, globalOrTmID)
+		if err != nil {
+			return ctxerr.Wrap(ctx, err, "delete mdm apple setup assistant profiles")
+		}
+		return nil
+	}
+
+	_, err := ds.writer(ctx).ExecContext(ctx, upsertStmt, profileUUID, globalOrTmID, abmTokenOrgName)
 	if err != nil {
 		return ctxerr.Wrap(ctx, err, "set mdm apple setup assistant profile uuid")
 	}
-	if n, _ := res.RowsAffected(); n == 0 {
-		return ctxerr.Wrap(ctx, notFound("MDMAppleSetupAssistant").WithID(globalOrTmID))
-	}
 	return nil
 }
 
+func (ds *Datastore) GetMDMAppleSetupAssistantProfileForABMToken(ctx context.Context, teamID *uint, abmTokenOrgName string) (string, time.Time, error) {
+	// to preserve previous behavior, the updated_at we use is the one of the
+	// setup assistant (what we refer to as "uploaded_at" in the API responses),
+	// as the important signal is when the content of the setup assistant
+	// changes.
+	const stmt = `
+	SELECT
+		msap.profile_uuid,
+		mas.updated_at
+	FROM
+		mdm_apple_setup_assistants mas
+	INNER JOIN
+		mdm_apple_setup_assistant_profiles msap ON mas.id = msap.setup_assistant_id
+	INNER JOIN
+		abm_tokens abt ON abt.id = msap.abm_token_id
+	WHERE
+		mas.global_or_team_id = ? AND
+		abt.organization_name = ?
+`
+	var globalOrTmID uint
+	if teamID != nil {
+		globalOrTmID = *teamID
+	}
+	var asstProf struct {
+		ProfileUUID string    `db:"profile_uuid"`
+		UpdatedAt   time.Time `db:"updated_at"`
+	}
+	if err := sqlx.GetContext(ctx, ds.writer(ctx) /* needs to read recent writes */, &asstProf, stmt, globalOrTmID, abmTokenOrgName); err != nil {
+		if err == sql.ErrNoRows {
+			return "", time.Time{}, ctxerr.Wrap(ctx, notFound("MDMAppleSetupAssistant").WithID(globalOrTmID))
+		}
+		return "", time.Time{}, ctxerr.Wrap(ctx, err, "get mdm apple setup assistant")
+	}
+	return asstProf.ProfileUUID, asstProf.UpdatedAt, nil
+}
+
 func (ds *Datastore) GetMDMAppleSetupAssistant(ctx context.Context, teamID *uint) (*fleet.MDMAppleSetupAssistant, error) {
 	return ds.getMDMAppleSetupAssistant(ctx, ds.reader(ctx), teamID)
 }
@@ -3284,7 +3678,6 @@ func (ds *Datastore) getMDMAppleSetupAssistant(ctx context.Context, q sqlx.Query
 		team_id,
 		name,
 		profile,
-		profile_uuid,
 		updated_at as uploaded_at
 	FROM
 		mdm_apple_setup_assistants
@@ -3305,6 +3698,8 @@ func (ds *Datastore) getMDMAppleSetupAssistant(ctx context.Context, q sqlx.Query
 }
 
 func (ds *Datastore) DeleteMDMAppleSetupAssistant(ctx context.Context, teamID *uint) error {
+	// this deletes the setup assistant for that team, and via foreign key
+	// cascade also the profiles associated with it.
 	const stmt = `
 		DELETE FROM mdm_apple_setup_assistants
 		WHERE global_or_team_id = ?`
@@ -3377,12 +3772,20 @@ WHERE
 	return serials, nil
 }
 
-func (ds *Datastore) SetMDMAppleDefaultSetupAssistantProfileUUID(ctx context.Context, teamID *uint, profileUUID string) error {
-	const stmt = `
+func (ds *Datastore) SetMDMAppleDefaultSetupAssistantProfileUUID(ctx context.Context, teamID *uint, profileUUID, abmTokenOrgName string) error {
+	const clearStmt = `
+		DELETE FROM mdm_apple_default_setup_assistants
+			WHERE global_or_team_id = ?`
+
+	const upsertStmt = `
 		INSERT INTO
-			mdm_apple_default_setup_assistants (team_id, global_or_team_id, profile_uuid)
-		VALUES
-			(?, ?, ?)
+			mdm_apple_default_setup_assistants (team_id, global_or_team_id, profile_uuid, abm_token_id)
+		SELECT
+			?, ?, ?, abt.id
+		FROM
+			abm_tokens abt
+		WHERE
+			abt.organization_name = ?
 		ON DUPLICATE KEY UPDATE
 			profile_uuid = VALUES(profile_uuid)
 `
@@ -3390,34 +3793,53 @@ func (ds *Datastore) SetMDMAppleDefaultSetupAssistantProfileUUID(ctx context.Con
 	if teamID != nil {
 		globalOrTmID = *teamID
 	}
-	_, err := ds.writer(ctx).ExecContext(ctx, stmt, teamID, globalOrTmID, profileUUID)
+
+	if profileUUID == "" && abmTokenOrgName == "" {
+		// delete all profile uuids for that team, regardless of ABM token
+		_, err := ds.writer(ctx).ExecContext(ctx, clearStmt, globalOrTmID)
+		if err != nil {
+			return ctxerr.Wrap(ctx, err, "delete mdm apple default setup assistant")
+		}
+		return nil
+	}
+
+	// upsert the profile uuid for the provided token
+	_, err := ds.writer(ctx).ExecContext(ctx, upsertStmt, teamID, globalOrTmID, profileUUID, abmTokenOrgName)
 	if err != nil {
 		return ctxerr.Wrap(ctx, err, "upsert mdm apple default setup assistant")
 	}
 	return nil
 }
 
-func (ds *Datastore) GetMDMAppleDefaultSetupAssistant(ctx context.Context, teamID *uint) (profileUUID string, updatedAt time.Time, err error) {
+func (ds *Datastore) GetMDMAppleDefaultSetupAssistant(ctx context.Context, teamID *uint, abmTokenOrgName string) (profileUUID string, updatedAt time.Time, err error) {
 	const stmt = `
 	SELECT
-		profile_uuid,
-		updated_at as uploaded_at
+		mad.profile_uuid,
+		mad.updated_at
 	FROM
-		mdm_apple_default_setup_assistants
-	WHERE global_or_team_id = ?`
+		mdm_apple_default_setup_assistants mad
+	INNER JOIN
+		abm_tokens abt ON mad.abm_token_id = abt.id
+	WHERE
+		mad.global_or_team_id = ? AND
+		abt.organization_name = ?
+	`
 
 	var globalOrTmID uint
 	if teamID != nil {
 		globalOrTmID = *teamID
 	}
-	var asst fleet.MDMAppleSetupAssistant
-	if err := sqlx.GetContext(ctx, ds.writer(ctx) /* needs to read recent writes */, &asst, stmt, globalOrTmID); err != nil {
+	var asstProf struct {
+		ProfileUUID string    `db:"profile_uuid"`
+		UpdatedAt   time.Time `db:"updated_at"`
+	}
+	if err := sqlx.GetContext(ctx, ds.writer(ctx) /* needs to read recent writes */, &asstProf, stmt, globalOrTmID, abmTokenOrgName); err != nil {
 		if err == sql.ErrNoRows {
 			return "", time.Time{}, ctxerr.Wrap(ctx, notFound("MDMAppleDefaultSetupAssistant").WithID(globalOrTmID))
 		}
 		return "", time.Time{}, ctxerr.Wrap(ctx, err, "get mdm apple default setup assistant")
 	}
-	return asst.ProfileUUID, asst.UploadedAt, nil
+	return asstProf.ProfileUUID, asstProf.UpdatedAt, nil
 }
 
 func (ds *Datastore) UpdateHostDEPAssignProfileResponses(ctx context.Context, payload *godep.ProfileResponse) error {
@@ -3499,9 +3921,9 @@ WHERE
 // depCooldownPeriod is the waiting period following a failed DEP assign profile request for a host.
 const depCooldownPeriod = 1 * time.Hour // TODO: Make this a test config option?
 
-func (ds *Datastore) ScreenDEPAssignProfileSerialsForCooldown(ctx context.Context, serials []string) (skipSerials []string, assignSerials []string, err error) {
+func (ds *Datastore) ScreenDEPAssignProfileSerialsForCooldown(ctx context.Context, serials []string) (skipSerialsByOrgName map[string][]string, serialsByOrgName map[string][]string, err error) {
 	if len(serials) == 0 {
-		return skipSerials, assignSerials, nil
+		return skipSerialsByOrgName, serialsByOrgName, nil
 	}
 
 	stmt := `
@@ -3511,12 +3933,14 @@ SELECT
 	ELSE
 		'assign'
 	END AS status,
-	hardware_serial
+	h.hardware_serial,
+	abm.organization_name
 FROM
-	host_dep_assignments
-	JOIN hosts ON id = host_id
+	host_dep_assignments hda
+	JOIN hosts h ON h.id = hda.host_id
+	JOIN abm_tokens abm ON abm.id = hda.abm_token_id
 WHERE
-	hardware_serial IN (?)
+	h.hardware_serial IN (?)
 `
 
 	stmt, args, err := sqlx.In(stmt, string(fleet.DEPAssignProfileResponseFailed), depCooldownPeriod.Seconds(), serials)
@@ -3527,23 +3951,27 @@ WHERE
 	var rows []struct {
 		Status         string `db:"status"`
 		HardwareSerial string `db:"hardware_serial"`
+		ABMOrgName     string `db:"organization_name"`
 	}
 	if err := sqlx.SelectContext(ctx, ds.reader(ctx), &rows, stmt, args...); err != nil {
 		return nil, nil, ctxerr.Wrap(ctx, err, "screen dep serials: get rows")
 	}
 
+	serialsByOrgName = make(map[string][]string)
+	skipSerialsByOrgName = make(map[string][]string)
+
 	for _, r := range rows {
 		switch r.Status {
 		case "assign":
-			assignSerials = append(assignSerials, r.HardwareSerial)
+			serialsByOrgName[r.ABMOrgName] = append(serialsByOrgName[r.ABMOrgName], r.HardwareSerial)
 		case "skip":
-			skipSerials = append(skipSerials, r.HardwareSerial)
+			skipSerialsByOrgName[r.ABMOrgName] = append(skipSerialsByOrgName[r.ABMOrgName], r.HardwareSerial)
 		default:
 			return nil, nil, ctxerr.New(ctx, fmt.Sprintf("screen dep serials: %s unrecognized status: %s", r.HardwareSerial, r.Status))
 		}
 	}
 
-	return skipSerials, assignSerials, nil
+	return skipSerialsByOrgName, serialsByOrgName, nil
 }
 
 func (ds *Datastore) GetDEPAssignProfileExpiredCooldowns(ctx context.Context) (map[uint][]string, error) {
@@ -3690,7 +4118,9 @@ WHERE h.uuid = ?
 	return nil
 }
 
-func (ds *Datastore) batchSetMDMAppleDeclarations(ctx context.Context, tx sqlx.ExtContext, tmID *uint, incomingDeclarations []*fleet.MDMAppleDeclaration) ([]*fleet.MDMAppleDeclaration, error) {
+func (ds *Datastore) batchSetMDMAppleDeclarations(ctx context.Context, tx sqlx.ExtContext, tmID *uint,
+	incomingDeclarations []*fleet.MDMAppleDeclaration,
+) (declarations []*fleet.MDMAppleDeclaration, updatedDB bool, err error) {
 	const insertStmt = `
 INSERT INTO mdm_apple_declarations (
 	declaration_uuid,
@@ -3757,13 +4187,13 @@ WHERE
 			if err == nil {
 				err = errors.New(ds.testBatchSetMDMAppleProfilesErr)
 			}
-			return nil, ctxerr.Wrap(ctx, err, "build query to load existing declarations")
+			return nil, false, ctxerr.Wrap(ctx, err, "build query to load existing declarations")
 		}
 		if err := sqlx.SelectContext(ctx, tx, &existingDecls, stmt, args...); err != nil || strings.HasPrefix(ds.testBatchSetMDMAppleProfilesErr, "select") {
 			if err == nil {
 				err = errors.New(ds.testBatchSetMDMAppleProfilesErr)
 			}
-			return nil, ctxerr.Wrap(ctx, err, "load existing declarations")
+			return nil, false, ctxerr.Wrap(ctx, err, "load existing declarations")
 		}
 	}
 
@@ -3786,23 +4216,29 @@ WHERE
 		// delete the obsolete declarations (all those that are not in keepNames)
 		stmt, args, err := sqlx.In(fmt.Sprintf(fmtDeleteStmt, andNameNotInList), declTeamID, keepNames)
 		if err != nil {
-			return nil, ctxerr.Wrap(ctx, err, "build query to delete obsolete profiles")
+			return nil, false, ctxerr.Wrap(ctx, err, "build query to delete obsolete profiles")
 		}
 		delStmt = stmt
 		delArgs = args
 	}
 
-	if _, err := tx.ExecContext(ctx, delStmt, delArgs...); err != nil || strings.HasPrefix(ds.testBatchSetMDMAppleProfilesErr, "delete") {
+	var result sql.Result
+	if result, err = tx.ExecContext(ctx, delStmt, delArgs...); err != nil || strings.HasPrefix(ds.testBatchSetMDMAppleProfilesErr,
+		"delete") {
 		if err == nil {
 			err = errors.New(ds.testBatchSetMDMAppleProfilesErr)
 		}
-		return nil, ctxerr.Wrap(ctx, err, "delete obsolete declarations")
+		return nil, false, ctxerr.Wrap(ctx, err, "delete obsolete declarations")
+	}
+	if result != nil {
+		rows, _ := result.RowsAffected()
+		updatedDB = rows > 0
 	}
 
 	for _, d := range incomingDeclarations {
 		checksum := md5ChecksumScriptContent(string(d.RawJSON))
 		declUUID := fleet.MDMAppleDeclarationUUIDPrefix + uuid.NewString()
-		if _, err := tx.ExecContext(ctx, insertStmt,
+		if result, err = tx.ExecContext(ctx, insertStmt,
 			declUUID,
 			d.Identifier,
 			d.Name,
@@ -3812,8 +4248,9 @@ WHERE
 			if err == nil {
 				err = errors.New(ds.testBatchSetMDMAppleProfilesErr)
 			}
-			return nil, ctxerr.Wrapf(ctx, err, "insert new/edited declaration with identifier %q", d.Identifier)
+			return nil, false, ctxerr.Wrapf(ctx, err, "insert new/edited declaration with identifier %q", d.Identifier)
 		}
+		updatedDB = updatedDB || insertOnDuplicateDidInsertOrUpdate(result)
 	}
 
 	incomingLabels := []fleet.ConfigurationProfileLabel{}
@@ -3828,16 +4265,16 @@ WHERE
 		// optimization for a later iteration.
 		stmt, args, err := sqlx.In(loadExistingDecls, declTeamID, incomingNames)
 		if err != nil {
-			return nil, ctxerr.Wrap(ctx, err, "build query to load newly inserted declarations")
+			return nil, false, ctxerr.Wrap(ctx, err, "build query to load newly inserted declarations")
 		}
 		if err := sqlx.SelectContext(ctx, tx, &newlyInsertedDecls, stmt, args...); err != nil {
-			return nil, ctxerr.Wrap(ctx, err, "load newly inserted declarations")
+			return nil, false, ctxerr.Wrap(ctx, err, "load newly inserted declarations")
 		}
 
 		for _, newlyInsertedDecl := range newlyInsertedDecls {
 			incomingDecl, ok := incomingDecls[newlyInsertedDecl.Name]
 			if !ok {
-				return nil, ctxerr.Wrapf(ctx, err, "declaration %q is in the database but was not incoming", newlyInsertedDecl.Name)
+				return nil, false, ctxerr.Wrapf(ctx, err, "declaration %q is in the database but was not incoming", newlyInsertedDecl.Name)
 			}
 
 			for _, label := range incomingDecl.LabelsIncludeAll {
@@ -3852,14 +4289,16 @@ WHERE
 		}
 	}
 
-	if err := batchSetDeclarationLabelAssociationsDB(ctx, tx, incomingLabels); err != nil || strings.HasPrefix(ds.testBatchSetMDMAppleProfilesErr, "labels") {
+	var updatedLabels bool
+	if updatedLabels, err = batchSetDeclarationLabelAssociationsDB(ctx, tx,
+		incomingLabels); err != nil || strings.HasPrefix(ds.testBatchSetMDMAppleProfilesErr, "labels") {
 		if err == nil {
 			err = errors.New(ds.testBatchSetMDMAppleProfilesErr)
 		}
-		return nil, ctxerr.Wrap(ctx, err, "inserting apple declaration label associations")
+		return nil, false, ctxerr.Wrap(ctx, err, "inserting apple declaration label associations")
 	}
 
-	return incomingDeclarations, nil
+	return incomingDeclarations, updatedDB || updatedLabels, nil
 }
 
 func (ds *Datastore) NewMDMAppleDeclaration(ctx context.Context, declaration *fleet.MDMAppleDeclaration) (*fleet.MDMAppleDeclaration, error) {
@@ -3956,7 +4395,7 @@ func (ds *Datastore) insertOrUpsertMDMAppleDeclaration(ctx context.Context, insO
 			declaration.LabelsExcludeAny[i].Exclude = true
 			labels = append(labels, declaration.LabelsExcludeAny[i])
 		}
-		if err := batchSetDeclarationLabelAssociationsDB(ctx, tx, labels); err != nil {
+		if _, err := batchSetDeclarationLabelAssociationsDB(ctx, tx, labels); err != nil {
 			return ctxerr.Wrap(ctx, err, "inserting mdm declaration label associations")
 		}
 
@@ -3970,9 +4409,11 @@ func (ds *Datastore) insertOrUpsertMDMAppleDeclaration(ctx context.Context, insO
 	return declaration, nil
 }
 
-func batchSetDeclarationLabelAssociationsDB(ctx context.Context, tx sqlx.ExtContext, declarationLabels []fleet.ConfigurationProfileLabel) error {
+func batchSetDeclarationLabelAssociationsDB(ctx context.Context, tx sqlx.ExtContext,
+	declarationLabels []fleet.ConfigurationProfileLabel,
+) (updatedDB bool, err error) {
 	if len(declarationLabels) == 0 {
-		return nil
+		return false, nil
 	}
 
 	// delete any profile+label tuple that is NOT in the list of provided tuples
@@ -3994,38 +4435,72 @@ func batchSetDeclarationLabelAssociationsDB(ctx context.Context, tx sqlx.ExtCont
               exclude = VALUES(exclude)
 	`
 
+	selectStmt := `
+		SELECT apple_declaration_uuid as profile_uuid, label_name, label_id, exclude FROM mdm_declaration_labels
+		WHERE (apple_declaration_uuid, label_name) IN (%s)
+	`
+
 	var (
-		insertBuilder strings.Builder
-		deleteBuilder strings.Builder
-		insertParams  []any
-		deleteParams  []any
+		insertBuilder         strings.Builder
+		selectOrDeleteBuilder strings.Builder
+		selectParams          []any
+		insertParams          []any
+		deleteParams          []any
 
 		setProfileUUIDs = make(map[string]struct{})
+		labelsToInsert  = make(map[string]*fleet.ConfigurationProfileLabel, len(declarationLabels))
 	)
 	for i, pl := range declarationLabels {
+		labelsToInsert[fmt.Sprintf("%s\n%s", pl.ProfileUUID, pl.LabelName)] = &declarationLabels[i]
 		if i > 0 {
 			insertBuilder.WriteString(",")
-			deleteBuilder.WriteString(",")
+			selectOrDeleteBuilder.WriteString(",")
 		}
 		insertBuilder.WriteString("(?, ?, ?, ?)")
-		deleteBuilder.WriteString("(?, ?)")
+		selectOrDeleteBuilder.WriteString("(?, ?)")
+		selectParams = append(selectParams, pl.ProfileUUID, pl.LabelName)
 		insertParams = append(insertParams, pl.ProfileUUID, pl.LabelID, pl.LabelName, pl.Exclude)
 		deleteParams = append(deleteParams, pl.ProfileUUID, pl.LabelID)
 
 		setProfileUUIDs[pl.ProfileUUID] = struct{}{}
 	}
 
-	_, err := tx.ExecContext(ctx, fmt.Sprintf(upsertStmt, insertBuilder.String()), insertParams...)
+	// Determine if we need to update the database
+	var existingProfileLabels []fleet.ConfigurationProfileLabel
+	err = sqlx.SelectContext(ctx, tx, &existingProfileLabels,
+		fmt.Sprintf(selectStmt, selectOrDeleteBuilder.String()), selectParams...)
 	if err != nil {
-		if isChildForeignKeyError(err) {
-			// one of the provided labels doesn't exist
-			return foreignKey("mdm_declaration_labels", fmt.Sprintf("(declaration, label)=(%v)", insertParams))
-		}
-
-		return ctxerr.Wrap(ctx, err, "setting label associations for declarations")
+		return false, ctxerr.Wrap(ctx, err, "selecting existing profile labels")
 	}
 
-	deleteStmt = fmt.Sprintf(deleteStmt, deleteBuilder.String())
+	updateNeeded := false
+	if len(existingProfileLabels) == len(labelsToInsert) {
+		for _, existing := range existingProfileLabels {
+			toInsert, ok := labelsToInsert[fmt.Sprintf("%s\n%s", existing.ProfileUUID, existing.LabelName)]
+			// The fleet.ConfigurationProfileLabel struct has no pointers, so we can use standard cmp.Equal
+			if !ok || !cmp.Equal(existing, *toInsert) {
+				updateNeeded = true
+				break
+			}
+		}
+	} else {
+		updateNeeded = true
+	}
+
+	if updateNeeded {
+		_, err = tx.ExecContext(ctx, fmt.Sprintf(upsertStmt, insertBuilder.String()), insertParams...)
+		if err != nil {
+			if isChildForeignKeyError(err) {
+				// one of the provided labels doesn't exist
+				return false, foreignKey("mdm_declaration_labels", fmt.Sprintf("(declaration, label)=(%v)", insertParams))
+			}
+
+			return false, ctxerr.Wrap(ctx, err, "setting label associations for declarations")
+		}
+		updatedDB = true
+	}
+
+	deleteStmt = fmt.Sprintf(deleteStmt, selectOrDeleteBuilder.String())
 
 	profUUIDs := make([]string, 0, len(setProfileUUIDs))
 	for k := range setProfileUUIDs {
@@ -4035,13 +4510,21 @@ func batchSetDeclarationLabelAssociationsDB(ctx context.Context, tx sqlx.ExtCont
 
 	deleteStmt, args, err := sqlx.In(deleteStmt, deleteArgs...)
 	if err != nil {
-		return ctxerr.Wrap(ctx, err, "sqlx.In delete labels for declarations")
+		return false, ctxerr.Wrap(ctx, err, "sqlx.In delete labels for declarations")
 	}
-	if _, err := tx.ExecContext(ctx, deleteStmt, args...); err != nil {
-		return ctxerr.Wrap(ctx, err, "deleting labels for declarations")
+	var result sql.Result
+	if result, err = tx.ExecContext(ctx, deleteStmt, args...); err != nil {
+		return false, ctxerr.Wrap(ctx, err, "deleting labels for declarations")
+	}
+	if result != nil {
+		rows, err := result.RowsAffected()
+		if err != nil {
+			return false, ctxerr.Wrap(ctx, err, "count rows affected by insert")
+		}
+		updatedDB = updatedDB || rows > 0
 	}
 
-	return nil
+	return updatedDB, nil
 }
 
 func (ds *Datastore) MDMAppleDDMDeclarationsToken(ctx context.Context, hostUUID string) (*fleet.MDMAppleDDMDeclarationsToken, error) {
@@ -4128,23 +4611,25 @@ func (ds *Datastore) MDMAppleBatchSetHostDeclarationState(ctx context.Context) (
 
 	err := ds.withRetryTxx(ctx, func(tx sqlx.ExtContext) error {
 		var err error
-		uuids, err = mdmAppleBatchSetHostDeclarationStateDB(ctx, tx, batchSize, &fleet.MDMDeliveryPending)
+		uuids, _, err = mdmAppleBatchSetHostDeclarationStateDB(ctx, tx, batchSize, &fleet.MDMDeliveryPending)
 		return err
 	})
 
 	return uuids, ctxerr.Wrap(ctx, err, "upserting host declaration state")
 }
 
-func mdmAppleBatchSetHostDeclarationStateDB(ctx context.Context, tx sqlx.ExtContext, batchSize int, status *fleet.MDMDeliveryStatus) ([]string, error) {
+func mdmAppleBatchSetHostDeclarationStateDB(ctx context.Context, tx sqlx.ExtContext, batchSize int,
+	status *fleet.MDMDeliveryStatus,
+) ([]string, bool, error) {
 	// once all the declarations are in place, compute the desired state
 	// and find which hosts need a DDM sync.
 	changedDeclarations, err := mdmAppleGetHostsWithChangedDeclarationsDB(ctx, tx)
 	if err != nil {
-		return nil, ctxerr.Wrap(ctx, err, "find hosts with changed declarations")
+		return nil, false, ctxerr.Wrap(ctx, err, "find hosts with changed declarations")
 	}
 
 	if len(changedDeclarations) == 0 {
-		return []string{}, nil
+		return []string{}, false, nil
 	}
 
 	// a host might have more than one declaration to sync, we do this to
@@ -4166,11 +4651,12 @@ func mdmAppleBatchSetHostDeclarationStateDB(ctx context.Context, tx sqlx.ExtCont
 	// - support the DDM endpoints, which use data from the
 	//   `host_mdm_apple_declarations` table to compute which declarations to
 	//   serve
-	if err := mdmAppleBatchSetPendingHostDeclarationsDB(ctx, tx, batchSize, changedDeclarations, status); err != nil {
-		return nil, ctxerr.Wrap(ctx, err, "batch insert mdm apple host declarations")
+	var updatedDB bool
+	if updatedDB, err = mdmAppleBatchSetPendingHostDeclarationsDB(ctx, tx, batchSize, changedDeclarations, status); err != nil {
+		return nil, false, ctxerr.Wrap(ctx, err, "batch insert mdm apple host declarations")
 	}
 
-	return uuids, nil
+	return uuids, updatedDB, nil
 }
 
 // mdmAppleBatchSetPendingHostDeclarationsDB tracks the current status of all
@@ -4181,7 +4667,7 @@ func mdmAppleBatchSetPendingHostDeclarationsDB(
 	batchSize int,
 	changedDeclarations []*fleet.MDMAppleHostDeclaration,
 	status *fleet.MDMDeliveryStatus,
-) error {
+) (updatedDB bool, err error) {
 	baseStmt := `
 	  INSERT INTO host_mdm_apple_declarations
 	    (host_uuid, status, operation_type, checksum, declaration_uuid, declaration_identifier, declaration_name)
@@ -4193,7 +4679,50 @@ func mdmAppleBatchSetPendingHostDeclarationsDB(
 	    checksum = VALUES(checksum)
 	  `
 
+	profilesToInsert := make(map[string]*fleet.MDMAppleHostDeclaration)
+
 	executeUpsertBatch := func(valuePart string, args []any) error {
+		// Check if the update needs to be done at all.
+		selectStmt := fmt.Sprintf(`
+			SELECT 
+				host_uuid,
+				declaration_uuid,
+				status,
+				COALESCE(operation_type, '') AS operation_type,
+				COALESCE(detail, '') AS detail,
+				checksum,
+				declaration_uuid,
+				declaration_identifier,
+				declaration_name
+			FROM host_mdm_apple_declarations WHERE (host_uuid, declaration_uuid) IN (%s)`,
+			strings.TrimSuffix(strings.Repeat("(?,?),", len(profilesToInsert)), ","))
+		var selectArgs []any
+		for _, p := range profilesToInsert {
+			selectArgs = append(selectArgs, p.HostUUID, p.DeclarationUUID)
+		}
+		var existingProfiles []fleet.MDMAppleHostDeclaration
+		if err := sqlx.SelectContext(ctx, tx, &existingProfiles, selectStmt, selectArgs...); err != nil {
+			return ctxerr.Wrap(ctx, err, "bulk set pending declarations select existing")
+		}
+		var updateNeeded bool
+		if len(existingProfiles) == len(profilesToInsert) {
+			for _, exist := range existingProfiles {
+				insert, ok := profilesToInsert[fmt.Sprintf("%s\n%s", exist.HostUUID, exist.DeclarationUUID)]
+				if !ok || !exist.Equal(*insert) {
+					updateNeeded = true
+					break
+				}
+			}
+		} else {
+			updateNeeded = true
+		}
+		clear(profilesToInsert)
+		if !updateNeeded {
+			// All profiles are already in the database, no need to update.
+			return nil
+		}
+
+		updatedDB = true
 		_, err := tx.ExecContext(
 			ctx,
 			fmt.Sprintf(baseStmt, strings.TrimSuffix(valuePart, ",")),
@@ -4203,13 +4732,23 @@ func mdmAppleBatchSetPendingHostDeclarationsDB(
 	}
 
 	generateValueArgs := func(d *fleet.MDMAppleHostDeclaration) (string, []any) {
+		profilesToInsert[fmt.Sprintf("%s\n%s", d.HostUUID, d.DeclarationUUID)] = &fleet.MDMAppleHostDeclaration{
+			HostUUID:        d.HostUUID,
+			DeclarationUUID: d.DeclarationUUID,
+			Name:            d.Name,
+			Identifier:      d.Identifier,
+			Status:          status,
+			OperationType:   d.OperationType,
+			Detail:          d.Detail,
+			Checksum:        d.Checksum,
+		}
 		valuePart := "(?, ?, ?, ?, ?, ?, ?),"
 		args := []any{d.HostUUID, status, d.OperationType, d.Checksum, d.DeclarationUUID, d.Identifier, d.Name}
 		return valuePart, args
 	}
 
-	err := batchProcessDB(changedDeclarations, batchSize, generateValueArgs, executeUpsertBatch)
-	return ctxerr.Wrap(ctx, err, "inserting changed host declaration state")
+	err = batchProcessDB(changedDeclarations, batchSize, generateValueArgs, executeUpsertBatch)
+	return updatedDB, ctxerr.Wrap(ctx, err, "inserting changed host declaration state")
 }
 
 // mdmAppleGetHostsWithChangedDeclarationsDB returns a
@@ -4571,19 +5110,22 @@ func (ds *Datastore) ReplaceMDMConfigAssets(ctx context.Context, assets []fleet.
 
 // ListIOSAndIPadOSToRefetch returns the UUIDs of iPhones/iPads that should be refetched
 // (their details haven't been updated in the given `interval`).
-func (ds *Datastore) ListIOSAndIPadOSToRefetch(ctx context.Context, interval time.Duration) (uuids []string, err error) {
-	var deviceUUIDs []string
+func (ds *Datastore) ListIOSAndIPadOSToRefetch(ctx context.Context, interval time.Duration) (devices []fleet.AppleDevicesToRefetch,
+	err error,
+) {
 	hostsStmt := fmt.Sprintf(`
-SELECT h.uuid FROM hosts h
-JOIN host_mdm hmdm ON hmdm.host_id = h.id
+SELECT h.id as host_id, h.uuid as uuid, JSON_ARRAYAGG(hmc.command_type) as commands_already_sent FROM hosts h
+INNER JOIN host_mdm hmdm ON hmdm.host_id = h.id
+LEFT JOIN host_mdm_commands hmc ON hmc.host_id = h.id
 WHERE (h.platform = 'ios' OR h.platform = 'ipados')
-AND hmdm.enrolled
-AND TIMESTAMPDIFF(SECOND, h.detail_updated_at, NOW()) > ?;`)
-	if err := sqlx.SelectContext(ctx, ds.reader(ctx), &deviceUUIDs, hostsStmt, interval.Seconds()); err != nil {
+AND TRIM(h.uuid) != ''
+AND TIMESTAMPDIFF(SECOND, h.detail_updated_at, NOW()) > ?
+GROUP BY h.id`)
+	if err := sqlx.SelectContext(ctx, ds.reader(ctx), &devices, hostsStmt, interval.Seconds()); err != nil {
 		return nil, err
 	}
 
-	return deviceUUIDs, nil
+	return devices, nil
 }
 
 func (ds *Datastore) GetHostUUIDsWithPendingMDMAppleCommands(ctx context.Context) (uuids []string, err error) {
@@ -4603,3 +5145,490 @@ LIMIT 500
 
 	return deviceUUIDs, nil
 }
+
+func (ds *Datastore) GetABMTokenByOrgName(ctx context.Context, orgName string) (*fleet.ABMToken, error) {
+	tok, err := ds.getABMToken(ctx, 0, orgName)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "get ABM token by org name")
+	}
+
+	return tok, nil
+}
+
+func (ds *Datastore) SaveABMToken(ctx context.Context, tok *fleet.ABMToken) error {
+	const stmt = `
+UPDATE
+	abm_tokens
+SET
+	organization_name = ?,
+	apple_id = ?,
+	terms_expired = ?,
+	renew_at = ?,
+	token = ?,
+	macos_default_team_id = ?,
+	ios_default_team_id = ?,
+	ipados_default_team_id = ?
+WHERE
+	id = ?`
+
+	doubleEncTok, err := encrypt(tok.EncryptedToken, ds.serverPrivateKey)
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "encrypt with datastore.serverPrivateKey")
+	}
+
+	_, err = ds.writer(ctx).ExecContext(
+		ctx,
+		stmt,
+		tok.OrganizationName,
+		tok.AppleID,
+		tok.TermsExpired,
+		tok.RenewAt.UTC(),
+		doubleEncTok,
+		tok.MacOSDefaultTeamID,
+		tok.IOSDefaultTeamID,
+		tok.IPadOSDefaultTeamID,
+		tok.ID)
+	return ctxerr.Wrap(ctx, err, "updating abm_token")
+}
+
+func (ds *Datastore) InsertABMToken(ctx context.Context, tok *fleet.ABMToken) (*fleet.ABMToken, error) {
+	const stmt = `
+INSERT INTO
+	abm_tokens
+	(organization_name, apple_id, terms_expired, renew_at, token, macos_default_team_id, ios_default_team_id, ipados_default_team_id)
+VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+`
+	doubleEncTok, err := encrypt(tok.EncryptedToken, ds.serverPrivateKey)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "encrypt abm_token with datastore.serverPrivateKey")
+	}
+
+	res, err := ds.writer(ctx).ExecContext(
+		ctx,
+		stmt,
+		tok.OrganizationName,
+		tok.AppleID,
+		tok.TermsExpired,
+		tok.RenewAt,
+		doubleEncTok,
+		tok.MacOSDefaultTeamID,
+		tok.IOSDefaultTeamID,
+		tok.IPadOSDefaultTeamID,
+	)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "inserting abm_token")
+	}
+
+	tokenID, _ := res.LastInsertId()
+
+	tok.ID = uint(tokenID)
+
+	cfg, err := ds.AppConfig(ctx)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "get app config")
+	}
+
+	url, err := apple_mdm.ResolveAppleMDMURL(cfg.ServerSettings.ServerURL)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "getting ABM token MDM server url")
+	}
+
+	tok.MDMServerURL = url
+
+	return tok, nil
+}
+
+func (ds *Datastore) ListABMTokens(ctx context.Context) ([]*fleet.ABMToken, error) {
+	stmt := `
+SELECT
+	abt.id,
+	abt.organization_name,
+	abt.apple_id,
+	abt.terms_expired,
+	abt.renew_at,
+	abt.token,
+	abt.macos_default_team_id,
+	abt.ios_default_team_id,
+	abt.ipados_default_team_id,
+	COALESCE(t1.name, :no_team) as macos_team,
+	COALESCE(t2.name, :no_team) as ios_team,
+	COALESCE(t3.name, :no_team) as ipados_team
+FROM
+	abm_tokens abt
+LEFT OUTER JOIN
+	teams t1 ON t1.id = abt.macos_default_team_id
+LEFT OUTER JOIN
+	teams t2 ON t2.id = abt.ios_default_team_id
+LEFT OUTER JOIN
+	teams t3 ON t3.id = abt.ipados_default_team_id
+
+	`
+
+	stmt, args, err := sqlx.Named(stmt, map[string]any{"no_team": fleet.TeamNameNoTeam})
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "build list ABM tokens query from named args")
+	}
+
+	var tokens []*fleet.ABMToken
+	if err := sqlx.SelectContext(ctx, ds.reader(ctx), &tokens, stmt, args...); err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "list ABM tokens")
+	}
+
+	cfg, err := ds.AppConfig(ctx)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "get app config")
+	}
+
+	url, err := apple_mdm.ResolveAppleMDMURL(cfg.ServerSettings.ServerURL)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "getting ABM token MDM server url")
+	}
+
+	for _, tok := range tokens {
+		tok.MDMServerURL = url
+
+		// Promote DB fields into respective objects
+		var macOSTeamID, iOSTeamID, iPadIOSTeamID uint
+		if tok.MacOSDefaultTeamID != nil {
+			macOSTeamID = *tok.MacOSDefaultTeamID
+		}
+		if tok.IOSDefaultTeamID != nil {
+			iOSTeamID = *tok.IOSDefaultTeamID
+		}
+		if tok.IPadOSDefaultTeamID != nil {
+			iPadIOSTeamID = *tok.IPadOSDefaultTeamID
+		}
+
+		tok.MacOSTeam = fleet.ABMTokenTeam{Name: tok.MacOSTeamName, ID: macOSTeamID}
+		tok.IOSTeam = fleet.ABMTokenTeam{Name: tok.IOSTeamName, ID: iOSTeamID}
+		tok.IPadOSTeam = fleet.ABMTokenTeam{Name: tok.IPadOSTeamName, ID: iPadIOSTeamID}
+
+		// decrypt the token with the serverPrivateKey, the resulting value will be
+		// the token still encrypted, but just with the ABM cert and key (it is that
+		// encrypted value that is stored with another layer of encryption with the
+		// serverPrivateKey).
+		decrypted, err := decrypt(tok.EncryptedToken, ds.serverPrivateKey)
+		if err != nil {
+			return nil, ctxerr.Wrapf(ctx, err, "decrypting abm token with datastore.serverPrivateKey")
+		}
+		tok.EncryptedToken = decrypted
+	}
+
+	return tokens, nil
+}
+
+func (ds *Datastore) DeleteABMToken(ctx context.Context, tokenID uint) error {
+	const stmt = `
+DELETE FROM
+	abm_tokens
+WHERE ID = ?
+		`
+
+	_, err := ds.writer(ctx).ExecContext(ctx, stmt, tokenID)
+
+	return ctxerr.Wrap(ctx, err, "deleting ABM token")
+}
+
+func (ds *Datastore) GetABMTokenByID(ctx context.Context, tokenID uint) (*fleet.ABMToken, error) {
+	tok, err := ds.getABMToken(ctx, tokenID, "")
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "get ABM token by id")
+	}
+
+	return tok, nil
+}
+
+func (ds *Datastore) getABMToken(ctx context.Context, tokenID uint, orgName string) (*fleet.ABMToken, error) {
+	stmt := `
+SELECT
+	abt.id,
+	abt.organization_name,
+	abt.apple_id,
+	abt.terms_expired,
+	abt.renew_at,
+	abt.token,
+	abt.macos_default_team_id,
+	abt.ios_default_team_id,
+	abt.ipados_default_team_id,
+	COALESCE(t1.name, :no_team) as macos_team,
+	COALESCE(t2.name, :no_team) as ios_team,
+	COALESCE(t3.name, :no_team) as ipados_team
+FROM
+	abm_tokens abt
+LEFT OUTER JOIN
+	teams t1 ON t1.id = abt.macos_default_team_id
+LEFT OUTER JOIN
+	teams t2 ON t2.id = abt.ios_default_team_id
+LEFT OUTER JOIN
+	teams t3 ON t3.id = abt.ipados_default_team_id
+%s
+	`
+
+	stmt, args, err := sqlx.Named(stmt, map[string]any{"no_team": fleet.TeamNameNoTeam})
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "build list ABM tokens query from named args")
+	}
+
+	var ident any = orgName
+	clause := "WHERE abt.organization_name = ?"
+	if tokenID != 0 {
+		clause = "WHERE abt.id = ?"
+		ident = tokenID
+	}
+
+	stmt = fmt.Sprintf(stmt, clause)
+
+	args = append(args, ident)
+
+	var tok fleet.ABMToken
+	if err := sqlx.GetContext(ctx, ds.reader(ctx), &tok, stmt, args...); err != nil {
+		if err == sql.ErrNoRows {
+			return nil, ctxerr.Wrap(ctx, notFound("ABMToken"))
+		}
+
+		return nil, ctxerr.Wrap(ctx, err, "get ABM token")
+	}
+
+	// decrypt the token with the serverPrivateKey, the resulting value will be
+	// the token still encrypted, but just with the ABM cert and key (it is that
+	// encrypted value that is stored with another layer of encryption with the
+	// serverPrivateKey).
+	decrypted, err := decrypt(tok.EncryptedToken, ds.serverPrivateKey)
+	if err != nil {
+		return nil, ctxerr.Wrapf(ctx, err, "decrypting abm token with datastore.serverPrivateKey")
+	}
+	tok.EncryptedToken = decrypted
+
+	cfg, err := ds.AppConfig(ctx)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "get app config")
+	}
+
+	url, err := apple_mdm.ResolveAppleMDMURL(cfg.ServerSettings.ServerURL)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "getting ABM token MDM server url")
+	}
+
+	tok.MDMServerURL = url
+
+	// Promote DB fields into respective objects
+	var macOSTeamID, iOSTeamID, iPadIOSTeamID uint
+	if tok.MacOSDefaultTeamID != nil {
+		macOSTeamID = *tok.MacOSDefaultTeamID
+	}
+	if tok.IOSDefaultTeamID != nil {
+		iOSTeamID = *tok.IOSDefaultTeamID
+	}
+	if tok.IPadOSDefaultTeamID != nil {
+		iPadIOSTeamID = *tok.IPadOSDefaultTeamID
+	}
+
+	tok.MacOSTeam = fleet.ABMTokenTeam{Name: tok.MacOSTeamName, ID: macOSTeamID}
+	tok.IOSTeam = fleet.ABMTokenTeam{Name: tok.IOSTeamName, ID: iOSTeamID}
+	tok.IPadOSTeam = fleet.ABMTokenTeam{Name: tok.IPadOSTeamName, ID: iPadIOSTeamID}
+
+	return &tok, nil
+}
+
+func (ds *Datastore) GetABMTokenCount(ctx context.Context) (int, error) {
+	var count int
+	const countStmt = `SELECT COUNT(*) FROM abm_tokens`
+
+	if err := sqlx.GetContext(ctx, ds.reader(ctx), &count, countStmt); err != nil {
+		return 0, ctxerr.Wrap(ctx, err, "counting existing ABM tokens")
+	}
+
+	return count, nil
+}
+
+func (ds *Datastore) SetABMTokenTermsExpiredForOrgName(ctx context.Context, orgName string, expired bool) (wasSet bool, err error) {
+	const stmt = `UPDATE abm_tokens SET terms_expired = ? WHERE organization_name = ? AND terms_expired != ?`
+	res, err := ds.writer(ctx).ExecContext(ctx, stmt, expired, orgName, expired)
+	if err != nil {
+		return false, ctxerr.Wrap(ctx, err, "update abm_tokens terms_expired")
+	}
+	affRows, _ := res.RowsAffected()
+
+	if affRows > 0 {
+		// if it did update the row, then the previous value was the opposite of
+		// expired
+		wasSet = !expired
+	} else {
+		// if it did not update any row, then the previous value was the same
+		wasSet = expired
+	}
+	return wasSet, nil
+}
+
+func (ds *Datastore) CountABMTokensWithTermsExpired(ctx context.Context) (int, error) {
+	// The expectation is that abm_tokens will have few rows (we don't even
+	// support pagination on the "list ABM tokens" endpoint), so this query
+	// should be very fast even without index on terms_expired.
+	const stmt = `SELECT COUNT(*) FROM abm_tokens WHERE terms_expired = 1`
+
+	var count int
+	if err := sqlx.GetContext(ctx, ds.reader(ctx), &count, stmt); err != nil {
+		return 0, ctxerr.Wrap(ctx, err, "count ABM tokens with terms expired")
+	}
+	return count, nil
+}
+
+func (ds *Datastore) GetABMTokenOrgNamesAssociatedWithTeam(ctx context.Context, teamID *uint) ([]string, error) {
+	stmt := `
+SELECT DISTINCT
+	abmt.organization_name
+FROM
+	abm_tokens abmt
+	JOIN host_dep_assignments hda ON hda.abm_token_id = abmt.id
+	JOIN hosts h ON hda.host_id = h.id
+WHERE
+	%s
+UNION
+SELECT DISTINCT
+	abmt.organization_name
+FROM
+	abm_tokens abmt
+WHERE
+	%s
+`
+	var args []any
+	teamFilter := `h.team_id IS NULL`
+	abmtFilter := `abmt.macos_default_team_id IS NULL OR abmt.ios_default_team_id IS NULL OR abmt.ipados_default_team_id IS NULL`
+	if teamID != nil {
+		teamFilter = `h.team_id = ?`
+		abmtFilter = `abmt.macos_default_team_id = ? OR abmt.ios_default_team_id = ? OR abmt.ipados_default_team_id = ?`
+		args = append(args, *teamID, *teamID, *teamID, *teamID)
+	}
+
+	stmt = fmt.Sprintf(stmt, teamFilter, abmtFilter)
+
+	var orgNames []string
+	if err := sqlx.SelectContext(ctx, ds.reader(ctx), &orgNames, stmt, args...); err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "getting org names for team from db")
+	}
+
+	return orgNames, nil
+}
+
+func (ds *Datastore) AddHostMDMCommands(ctx context.Context, commands []fleet.HostMDMCommand) error {
+	const baseStmt = `
+		INSERT INTO host_mdm_commands (host_id, command_type)
+		VALUES %s
+		ON DUPLICATE KEY UPDATE
+		command_type = VALUES(command_type)`
+
+	for i := 0; i < len(commands); i += addHostMDMCommandsBatchSize {
+		start := i
+		end := i + hostIssuesInsertBatchSize
+		if end > len(commands) {
+			end = len(commands)
+		}
+		totalToProcess := end - start
+		const numberOfArgsPerInsert = 2 // number of ? in each VALUES clause
+		values := strings.TrimSuffix(
+			strings.Repeat("(?,?),", totalToProcess), ",",
+		)
+		stmt := fmt.Sprintf(baseStmt, values)
+		args := make([]interface{}, 0, totalToProcess*numberOfArgsPerInsert)
+		for j := start; j < end; j++ {
+			item := commands[j]
+			args = append(
+				args, item.HostID, item.CommandType,
+			)
+		}
+		if _, err := ds.writer(ctx).ExecContext(ctx, stmt, args...); err != nil {
+			return ctxerr.Wrap(ctx, err, "insert into host_mdm_commands")
+		}
+	}
+
+	return nil
+}
+
+func (ds *Datastore) GetHostMDMCommands(ctx context.Context, hostID uint) (commands []fleet.HostMDMCommand, err error) {
+	const stmt = `SELECT host_id, command_type FROM host_mdm_commands WHERE host_id = ?`
+	if err := sqlx.SelectContext(ctx, ds.reader(ctx), &commands, stmt, hostID); err != nil {
+		return nil, err
+	}
+	return commands, nil
+}
+
+func (ds *Datastore) RemoveHostMDMCommand(ctx context.Context, command fleet.HostMDMCommand) error {
+	const stmt = `
+		DELETE FROM host_mdm_commands
+		WHERE host_id = ? AND command_type = ?`
+	if _, err := ds.writer(ctx).ExecContext(ctx, stmt, command.HostID, command.CommandType); err != nil {
+		return ctxerr.Wrap(ctx, err, "delete from host_mdm_commands")
+	}
+	return nil
+}
+
+func (ds *Datastore) CleanupHostMDMCommands(ctx context.Context) error {
+	// Delete commands that don't have a corresponding host or have been sent over 1 day ago.
+	// We are using 1 day instead of 7 days in case MDM commands fail to be sent or fail to process. They can be resent the next day.
+	const stmt = `
+		DELETE hmc FROM host_mdm_commands AS hmc
+		LEFT JOIN hosts h ON h.id = hmc.host_id
+		WHERE h.id IS NULL OR hmc.updated_at < NOW() - INTERVAL 1 DAY`
+	if _, err := ds.writer(ctx).ExecContext(ctx, stmt); err != nil {
+		return ctxerr.Wrap(ctx, err, "delete from host_mdm_commands")
+	}
+	return nil
+}
+
+func (ds *Datastore) GetMDMAppleOSUpdatesSettingsByHostSerial(ctx context.Context, serial string) (*fleet.AppleOSUpdateSettings, error) {
+	stmt := `
+SELECT 
+	team_id, platform 
+FROM 
+	hosts h 
+JOIN 
+	host_dep_assignments hdep ON h.id = host_id 
+WHERE 
+	hardware_serial = ? AND deleted_at IS NULL 
+LIMIT 1`
+
+	var dest struct {
+		TeamID   *uint  `db:"team_id"`
+		Platform string `db:"platform"`
+	}
+	if err := sqlx.GetContext(ctx, ds.reader(ctx), &dest, stmt, serial); err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "getting team id for host")
+	}
+
+	var settings fleet.AppleOSUpdateSettings
+	if dest.TeamID == nil {
+		// use the global settings
+		ac, err := ds.AppConfig(ctx)
+		if err != nil {
+			return nil, ctxerr.Wrap(ctx, err, "getting app config for os update settings")
+		}
+		switch dest.Platform {
+		case "ios":
+			settings = ac.MDM.IOSUpdates
+		case "ipados":
+			settings = ac.MDM.IPadOSUpdates
+		case "darwin":
+			settings = ac.MDM.MacOSUpdates
+		default:
+			return nil, ctxerr.New(ctx, fmt.Sprintf("unsupported platform %s", dest.Platform))
+		}
+	} else {
+		// use the team settings
+		tm, err := ds.TeamWithoutExtras(ctx, *dest.TeamID)
+		if err != nil {
+			return nil, ctxerr.Wrap(ctx, err, "getting team os update settings")
+		}
+		switch dest.Platform {
+		case "ios":
+			settings = tm.Config.MDM.IOSUpdates
+		case "ipados":
+			settings = tm.Config.MDM.IPadOSUpdates
+		case "darwin":
+			settings = tm.Config.MDM.MacOSUpdates
+		default:
+			return nil, ctxerr.New(ctx, fmt.Sprintf("unsupported platform %s", dest.Platform))
+		}
+	}
+
+	return &settings, nil
+}
diff --git a/server/datastore/mysql/apple_mdm_test.go b/server/datastore/mysql/apple_mdm_test.go
index 35a8a87497..3090bdb04d 100644
--- a/server/datastore/mysql/apple_mdm_test.go
+++ b/server/datastore/mysql/apple_mdm_test.go
@@ -6,6 +6,7 @@ import (
 	"crypto/md5" // nolint:gosec // used only to hash for efficient comparisons
 	"crypto/sha256"
 	"database/sql"
+	"encoding/hex"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -16,6 +17,7 @@ import (
 
 	"github.com/VividCortex/mysqlerr"
 	"github.com/fleetdm/fleet/v4/pkg/optjson"
+	"github.com/fleetdm/fleet/v4/server/datastore/s3"
 	"github.com/fleetdm/fleet/v4/server/fleet"
 	fleetmdm "github.com/fleetdm/fleet/v4/server/mdm"
 	apple_mdm "github.com/fleetdm/fleet/v4/server/mdm/apple"
@@ -81,9 +83,16 @@ func TestMDMApple(t *testing.T) {
 		{"IngestMDMAppleDevicesFromDEPSyncIOSIPadOS", testIngestMDMAppleDevicesFromDEPSyncIOSIPadOS},
 		{"MDMAppleProfilesOnIOSIPadOS", testMDMAppleProfilesOnIOSIPadOS},
 		{"GetHostUUIDsWithPendingMDMAppleCommands", testGetHostUUIDsWithPendingMDMAppleCommands},
+		{"MDMAppleBootstrapPackageWithS3", testMDMAppleBootstrapPackageWithS3},
+		{"GetAndUpdateABMToken", testMDMAppleGetAndUpdateABMToken},
+		{"ABMTokensTermsExpired", testMDMAppleABMTokensTermsExpired},
+		{"TestMDMGetABMTokenOrgNamesAssociatedWithTeam", testMDMGetABMTokenOrgNamesAssociatedWithTeam},
+		{"HostMDMCommands", testHostMDMCommands},
+		{"IngestMDMAppleDeviceFromOTAEnrollment", testIngestMDMAppleDeviceFromOTAEnrollment},
 	}
 
 	for _, c := range cases {
+		t.Helper()
 		t.Run(c.name, func(t *testing.T) {
 			defer TruncateTables(t, ds)
 
@@ -617,10 +626,14 @@ func TestIngestMDMAppleDevicesFromDEPSync(t *testing.T) {
 	}
 	wantSerials = append(wantSerials, "abc", "xyz", "ijk", "tuv")
 
-	n, tmID, err := ds.IngestMDMAppleDevicesFromDEPSync(ctx, depDevices)
+	encTok := uuid.NewString()
+	abmToken, err := ds.InsertABMToken(ctx, &fleet.ABMToken{OrganizationName: "unused", EncryptedToken: []byte(encTok)})
+	require.NoError(t, err)
+	require.NotEmpty(t, abmToken.ID)
+
+	n, err := ds.IngestMDMAppleDevicesFromDEPSync(ctx, depDevices, abmToken.ID, nil, nil, nil)
 	require.NoError(t, err)
 	require.EqualValues(t, 4, n) // 4 new hosts ("abc", "xyz", "ijk", "tuv")
-	require.Nil(t, tmID)
 
 	hosts = listHostsCheckCount(t, ds, fleet.TeamFilter{User: test.UserAdmin}, fleet.HostListOptions{}, len(wantSerials))
 	gotSerials := []string{}
@@ -643,9 +656,13 @@ func TestDEPSyncTeamAssignment(t *testing.T) {
 		{SerialNumber: "def", Model: "MacBook Pro", OS: "OSX", OpType: "added"},
 	}
 
-	n, tmID, err := ds.IngestMDMAppleDevicesFromDEPSync(ctx, depDevices)
+	encTok := uuid.NewString()
+	abmToken, err := ds.InsertABMToken(ctx, &fleet.ABMToken{OrganizationName: "unused", EncryptedToken: []byte(encTok)})
+	require.NoError(t, err)
+	require.NotEmpty(t, abmToken.ID)
+
+	n, err := ds.IngestMDMAppleDevicesFromDEPSync(ctx, depDevices, abmToken.ID, nil, nil, nil)
 	require.NoError(t, err)
-	require.Nil(t, tmID)
 	require.Equal(t, int64(2), n)
 
 	hosts := listHostsCheckCount(t, ds, fleet.TeamFilter{User: test.UserAdmin}, fleet.HostListOptions{}, 2)
@@ -660,7 +677,7 @@ func TestDEPSyncTeamAssignment(t *testing.T) {
 	// assign the team as the default team for DEP devices
 	ac, err := ds.AppConfig(context.Background())
 	require.NoError(t, err)
-	ac.MDM.AppleBMDefaultTeam = team.Name
+	ac.MDM.DeprecatedAppleBMDefaultTeam = team.Name
 	err = ds.SaveAppConfig(context.Background(), ac)
 	require.NoError(t, err)
 
@@ -669,11 +686,9 @@ func TestDEPSyncTeamAssignment(t *testing.T) {
 		{SerialNumber: "xyz", Model: "MacBook Pro", OS: "OSX", OpType: "added"},
 	}
 
-	n, tmID, err = ds.IngestMDMAppleDevicesFromDEPSync(ctx, depDevices)
+	n, err = ds.IngestMDMAppleDevicesFromDEPSync(ctx, depDevices, abmToken.ID, team, team, team)
 	require.NoError(t, err)
 	require.Equal(t, int64(1), n)
-	require.NotNil(t, tmID)
-	require.Equal(t, team.ID, *tmID)
 
 	hosts = listHostsCheckCount(t, ds, fleet.TeamFilter{User: test.UserAdmin}, fleet.HostListOptions{}, 3)
 	for _, h := range hosts {
@@ -684,18 +699,14 @@ func TestDEPSyncTeamAssignment(t *testing.T) {
 		}
 	}
 
-	ac.MDM.AppleBMDefaultTeam = "non-existent"
-	err = ds.SaveAppConfig(context.Background(), ac)
-	require.NoError(t, err)
-
+	nonExistentTeam := &fleet.Team{ID: 8888}
 	depDevices = []godep.Device{
 		{SerialNumber: "jqk", Model: "MacBook Pro", OS: "OSX", OpType: "added"},
 	}
 
-	n, tmID, err = ds.IngestMDMAppleDevicesFromDEPSync(ctx, depDevices)
+	n, err = ds.IngestMDMAppleDevicesFromDEPSync(ctx, depDevices, abmToken.ID, nonExistentTeam, nonExistentTeam, nonExistentTeam)
 	require.NoError(t, err)
 	require.EqualValues(t, n, 1)
-	require.Nil(t, tmID)
 
 	hosts = listHostsCheckCount(t, ds, fleet.TeamFilter{User: test.UserAdmin}, fleet.HostListOptions{}, 4)
 	for _, h := range hosts {
@@ -817,13 +828,17 @@ func testIngestMDMAppleIngestAfterDEPSync(t *testing.T, ds *Datastore) {
 	testUUID := "test-uuid"
 	testModel := "MacBook Pro"
 
+	encTok := uuid.NewString()
+	abmToken, err := ds.InsertABMToken(ctx, &fleet.ABMToken{OrganizationName: "unused", EncryptedToken: []byte(encTok)})
+	require.NoError(t, err)
+	require.NotEmpty(t, abmToken.ID)
+
 	// simulate a host that is first ingested via DEP (e.g., the device was added via Apple Business Manager)
-	n, tmID, err := ds.IngestMDMAppleDevicesFromDEPSync(ctx, []godep.Device{
+	n, err := ds.IngestMDMAppleDevicesFromDEPSync(ctx, []godep.Device{
 		{SerialNumber: testSerial, Model: testModel, OS: "OSX", OpType: "added"},
-	})
+	}, abmToken.ID, nil, nil, nil)
 	require.NoError(t, err)
 	require.Equal(t, int64(1), n)
-	require.Nil(t, tmID)
 
 	hosts := listHostsCheckCount(t, ds, fleet.TeamFilter{User: test.UserAdmin}, fleet.HostListOptions{}, 1)
 	// hosts that are first ingested via DEP will have a serial number but not a UUID because UUID
@@ -864,13 +879,17 @@ func testIngestMDMAppleCheckinBeforeDEPSync(t *testing.T, ds *Datastore) {
 	require.Equal(t, testUUID, hosts[0].UUID)
 	checkMDMHostRelatedTables(t, ds, hosts[0].ID, testSerial, testModel)
 
+	encTok := uuid.NewString()
+	abmToken, err := ds.InsertABMToken(ctx, &fleet.ABMToken{OrganizationName: "unused", EncryptedToken: []byte(encTok)})
+	require.NoError(t, err)
+	require.NotEmpty(t, abmToken.ID)
+
 	// no effect if same host appears in DEP sync
-	n, tmID, err := ds.IngestMDMAppleDevicesFromDEPSync(ctx, []godep.Device{
+	n, err := ds.IngestMDMAppleDevicesFromDEPSync(ctx, []godep.Device{
 		{SerialNumber: testSerial, Model: testModel, OS: "OSX", OpType: "added"},
-	})
+	}, abmToken.ID, nil, nil, nil)
 	require.NoError(t, err)
 	require.Equal(t, int64(0), n)
-	require.Nil(t, tmID)
 
 	hosts = listHostsCheckCount(t, ds, fleet.TeamFilter{User: test.UserAdmin}, fleet.HostListOptions{}, 1)
 	require.Equal(t, testSerial, hosts[0].HardwareSerial)
@@ -1040,7 +1059,9 @@ func expectAppleDeclarations(
 	var got []*fleet.MDMAppleDeclaration
 	ExecAdhocSQL(t, ds, func(q sqlx.ExtContext) error {
 		ctx := context.Background()
-		return sqlx.SelectContext(ctx, q, &got, `SELECT * FROM mdm_apple_declarations WHERE team_id = ?`, tmID)
+		return sqlx.SelectContext(ctx, q, &got,
+			`SELECT declaration_uuid, team_id, identifier, name, raw_json, checksum, created_at, uploaded_at FROM mdm_apple_declarations WHERE team_id = ?`,
+			tmID)
 	})
 
 	// create map of expected declarations keyed by identifier
@@ -1325,16 +1346,20 @@ func teamConfigProfileForTest(t *testing.T, name, identifier, uuid string, teamI
 }
 
 func testMDMAppleProfileManagementBatch2(t *testing.T, ds *Datastore) {
+	ds.testSelectMDMProfilesBatchSize = 2
 	ds.testUpsertMDMDesiredProfilesBatchSize = 2
 	t.Cleanup(func() {
+		ds.testSelectMDMProfilesBatchSize = 0
 		ds.testUpsertMDMDesiredProfilesBatchSize = 0
 	})
 	testMDMAppleProfileManagement(t, ds)
 }
 
 func testMDMAppleProfileManagementBatch3(t *testing.T, ds *Datastore) {
+	ds.testSelectMDMProfilesBatchSize = 3
 	ds.testUpsertMDMDesiredProfilesBatchSize = 3
 	t.Cleanup(func() {
+		ds.testSelectMDMProfilesBatchSize = 0
 		ds.testUpsertMDMDesiredProfilesBatchSize = 0
 	})
 	testMDMAppleProfileManagement(t, ds)
@@ -3140,7 +3165,7 @@ func testMDMAppleBootstrapPackageCRUD(t *testing.T, ds *Datastore) {
 	var nfe fleet.NotFoundError
 	var aerr fleet.AlreadyExistsError
 
-	err := ds.InsertMDMAppleBootstrapPackage(ctx, &fleet.MDMAppleBootstrapPackage{})
+	err := ds.InsertMDMAppleBootstrapPackage(ctx, &fleet.MDMAppleBootstrapPackage{}, nil)
 	require.Error(t, err)
 
 	bp1 := &fleet.MDMAppleBootstrapPackage{
@@ -3150,10 +3175,10 @@ func testMDMAppleBootstrapPackageCRUD(t *testing.T, ds *Datastore) {
 		Bytes:  []byte("content"),
 		Token:  uuid.New().String(),
 	}
-	err = ds.InsertMDMAppleBootstrapPackage(ctx, bp1)
+	err = ds.InsertMDMAppleBootstrapPackage(ctx, bp1, nil)
 	require.NoError(t, err)
 
-	err = ds.InsertMDMAppleBootstrapPackage(ctx, bp1)
+	err = ds.InsertMDMAppleBootstrapPackage(ctx, bp1, nil)
 	require.ErrorAs(t, err, &aerr)
 
 	bp2 := &fleet.MDMAppleBootstrapPackage{
@@ -3163,7 +3188,7 @@ func testMDMAppleBootstrapPackageCRUD(t *testing.T, ds *Datastore) {
 		Bytes:  []byte("content"),
 		Token:  uuid.New().String(),
 	}
-	err = ds.InsertMDMAppleBootstrapPackage(ctx, bp2)
+	err = ds.InsertMDMAppleBootstrapPackage(ctx, bp2, nil)
 	require.NoError(t, err)
 
 	meta, err := ds.GetMDMAppleBootstrapPackageMeta(ctx, 0)
@@ -3177,11 +3202,11 @@ func testMDMAppleBootstrapPackageCRUD(t *testing.T, ds *Datastore) {
 	require.ErrorAs(t, err, &nfe)
 	require.Nil(t, meta)
 
-	bytes, err := ds.GetMDMAppleBootstrapPackageBytes(ctx, bp1.Token)
+	bytes, err := ds.GetMDMAppleBootstrapPackageBytes(ctx, bp1.Token, nil)
 	require.NoError(t, err)
 	require.Equal(t, bp1.Bytes, bytes.Bytes)
 
-	bytes, err = ds.GetMDMAppleBootstrapPackageBytes(ctx, "fake")
+	bytes, err = ds.GetMDMAppleBootstrapPackageBytes(ctx, "fake", nil)
 	require.ErrorAs(t, err, &nfe)
 	require.Nil(t, bytes)
 
@@ -3453,6 +3478,10 @@ func testMDMAppleSetupAssistant(t *testing.T, ds *Datastore) {
 	require.Error(t, err)
 	require.ErrorIs(t, err, sql.ErrNoRows)
 	require.True(t, fleet.IsNotFound(err))
+	_, _, err = ds.GetMDMAppleSetupAssistantProfileForABMToken(ctx, nil, "no-such-token")
+	require.Error(t, err)
+	require.ErrorIs(t, err, sql.ErrNoRows)
+	require.True(t, fleet.IsNotFound(err))
 
 	// create for no team
 	noTeamAsst, err := ds.SetOrUpdateMDMAppleSetupAssistant(ctx, &fleet.MDMAppleSetupAssistant{Name: "test", Profile: json.RawMessage("{}")})
@@ -3492,7 +3521,59 @@ func testMDMAppleSetupAssistant(t *testing.T, ds *Datastore) {
 	require.NoError(t, err)
 	require.Equal(t, tmAsst, getAsst)
 
-	// upsert team
+	// create an ABM token and set a profile uuid for no team
+	tok1, err := ds.InsertABMToken(ctx, &fleet.ABMToken{OrganizationName: "o1", EncryptedToken: []byte(uuid.NewString())})
+	require.NoError(t, err)
+	require.NotZero(t, tok1.ID)
+	profUUID1 := uuid.NewString()
+	err = ds.SetMDMAppleSetupAssistantProfileUUID(ctx, nil, profUUID1, "o1")
+	require.NoError(t, err)
+	gotProf, gotTs, err := ds.GetMDMAppleSetupAssistantProfileForABMToken(ctx, nil, "o1")
+	require.NoError(t, err)
+	require.Equal(t, profUUID1, gotProf)
+	require.NotZero(t, gotTs)
+
+	// set a profile uuid for an unknown token, no error but nothing inserted
+	err = ds.SetMDMAppleSetupAssistantProfileUUID(ctx, nil, profUUID1, "no-such-token")
+	require.NoError(t, err)
+	_, _, err = ds.GetMDMAppleSetupAssistantProfileForABMToken(ctx, nil, "no-such-token")
+	require.Error(t, err)
+	require.ErrorIs(t, err, sql.ErrNoRows)
+	require.True(t, fleet.IsNotFound(err))
+
+	// create another ABM token and set a profile uuid for the team assistant
+	// with both tokens
+	tok2, err := ds.InsertABMToken(ctx, &fleet.ABMToken{OrganizationName: "o2", EncryptedToken: []byte(uuid.NewString())})
+	require.NoError(t, err)
+	require.NotZero(t, tok2.ID)
+	profUUID2 := uuid.NewString()
+	err = ds.SetMDMAppleSetupAssistantProfileUUID(ctx, &tm.ID, profUUID1, "o1")
+	require.NoError(t, err)
+	err = ds.SetMDMAppleSetupAssistantProfileUUID(ctx, &tm.ID, profUUID2, "o2")
+	require.NoError(t, err)
+	gotProf, gotTs, err = ds.GetMDMAppleSetupAssistantProfileForABMToken(ctx, &tm.ID, "o1")
+	require.NoError(t, err)
+	require.Equal(t, profUUID1, gotProf)
+	require.NotZero(t, gotTs)
+	gotProf, gotTs, err = ds.GetMDMAppleSetupAssistantProfileForABMToken(ctx, &tm.ID, "o2")
+	require.NoError(t, err)
+	require.Equal(t, profUUID2, gotProf)
+	require.NotZero(t, gotTs)
+
+	// update the profile uuid for o2 only
+	profUUID3 := uuid.NewString()
+	err = ds.SetMDMAppleSetupAssistantProfileUUID(ctx, &tm.ID, profUUID3, "o2")
+	require.NoError(t, err)
+	gotProf, gotTs, err = ds.GetMDMAppleSetupAssistantProfileForABMToken(ctx, &tm.ID, "o1")
+	require.NoError(t, err)
+	require.Equal(t, profUUID1, gotProf)
+	require.NotZero(t, gotTs)
+	gotProf, gotTs, err = ds.GetMDMAppleSetupAssistantProfileForABMToken(ctx, &tm.ID, "o2")
+	require.NoError(t, err)
+	require.Equal(t, profUUID3, gotProf)
+	require.NotZero(t, gotTs)
+
+	// upsert team assistant
 	tmAsst2, err := ds.SetOrUpdateMDMAppleSetupAssistant(ctx, &fleet.MDMAppleSetupAssistant{TeamID: &tm.ID, Name: "test2", Profile: json.RawMessage(`{"x":2}`)})
 	require.NoError(t, err)
 	require.Equal(t, tmAsst2.ID, tmAsst.ID)
@@ -3501,7 +3582,13 @@ func testMDMAppleSetupAssistant(t *testing.T, ds *Datastore) {
 	require.Equal(t, "test2", tmAsst2.Name)
 	require.JSONEq(t, `{"x": 2}`, string(tmAsst2.Profile))
 
-	// upsert no team
+	// profile uuids have been cleared
+	_, _, err = ds.GetMDMAppleSetupAssistantProfileForABMToken(ctx, &tm.ID, "o1")
+	require.ErrorIs(t, err, sql.ErrNoRows)
+	_, _, err = ds.GetMDMAppleSetupAssistantProfileForABMToken(ctx, &tm.ID, "o2")
+	require.ErrorIs(t, err, sql.ErrNoRows)
+
+	// upsert no team assistant
 	noTeamAsst2, err := ds.SetOrUpdateMDMAppleSetupAssistant(ctx, &fleet.MDMAppleSetupAssistant{Name: "test3", Profile: json.RawMessage(`{"x": 3}`)})
 	require.NoError(t, err)
 	require.Equal(t, noTeamAsst2.ID, noTeamAsst.ID)
@@ -3510,74 +3597,52 @@ func testMDMAppleSetupAssistant(t *testing.T, ds *Datastore) {
 	require.Equal(t, "test3", noTeamAsst2.Name)
 	require.JSONEq(t, `{"x": 3}`, string(noTeamAsst2.Profile))
 
+	// profile uuid has been cleared
+	_, _, err = ds.GetMDMAppleSetupAssistantProfileForABMToken(ctx, nil, "o1")
+	require.ErrorIs(t, err, sql.ErrNoRows)
+
 	time.Sleep(time.Second) // ensures the timestamp checks are not by chance
 
+	// set profile uuids for team and no team (one each)
+	err = ds.SetMDMAppleSetupAssistantProfileUUID(ctx, nil, profUUID1, "o1")
+	require.NoError(t, err)
+	err = ds.SetMDMAppleSetupAssistantProfileUUID(ctx, &tm.ID, profUUID2, "o2")
+	require.NoError(t, err)
+
 	// upsert team no change, uploaded at timestamp does not change
 	tmAsst3, err := ds.SetOrUpdateMDMAppleSetupAssistant(ctx, &fleet.MDMAppleSetupAssistant{TeamID: &tm.ID, Name: "test2", Profile: json.RawMessage(`{"x":2}`)})
 	require.NoError(t, err)
 	require.Equal(t, tmAsst2, tmAsst3)
 
-	// set a profile uuid for the team assistant
-	err = ds.SetMDMAppleSetupAssistantProfileUUID(ctx, &tm.ID, "abcd")
-	require.NoError(t, err)
-
-	// get for team returns the same data, but now with a profile uuid
-	getAsst, err = ds.GetMDMAppleSetupAssistant(ctx, &tm.ID)
-	require.NoError(t, err)
-	require.Equal(t, "abcd", getAsst.ProfileUUID)
-	getAsst.ProfileUUID = ""
-	require.Equal(t, tmAsst3, getAsst)
-
-	time.Sleep(time.Second) // ensures the timestamp checks are not by chance
-
-	// upsert again the team with no change, uploaded at timestamp does not change nor does the profile uuid
-	tmAsst4, err := ds.SetOrUpdateMDMAppleSetupAssistant(ctx, &fleet.MDMAppleSetupAssistant{TeamID: &tm.ID, Name: "test2", Profile: json.RawMessage(`{"x":2}`)})
-	require.NoError(t, err)
-	require.Equal(t, "abcd", tmAsst4.ProfileUUID)
-	tmAsst4.ProfileUUID = ""
-	require.Equal(t, tmAsst3, tmAsst4)
+	// TODO(mna): ideally the profiles would not be cleared when the profile
+	// stayed the same, but does not work at the moment and we're pressed by
+	// time.
+	// gotProf, gotTs, err = ds.GetMDMAppleSetupAssistantProfileForABMToken(ctx, &tm.ID, "o2")
+	// require.NoError(t, err)
+	// require.Equal(t, profUUID2, gotProf)
+	// require.Equal(t, tmAsst3.UploadedAt, gotTs)
 
 	time.Sleep(time.Second) // ensures the timestamp checks are not by chance
 
 	// upsert team with a change, clears the profile uuid and updates the uploaded at timestamp
-	tmAsst5, err := ds.SetOrUpdateMDMAppleSetupAssistant(ctx, &fleet.MDMAppleSetupAssistant{TeamID: &tm.ID, Name: "test2", Profile: json.RawMessage(`{"x":3}`)})
+	tmAsst4, err := ds.SetOrUpdateMDMAppleSetupAssistant(ctx, &fleet.MDMAppleSetupAssistant{TeamID: &tm.ID, Name: "test2", Profile: json.RawMessage(`{"x":3}`)})
 	require.NoError(t, err)
-	require.Equal(t, tmAsst4.ID, tmAsst5.ID)
-	require.True(t, tmAsst5.UploadedAt.After(tmAsst4.UploadedAt))
-	require.Equal(t, tmAsst4.TeamID, tmAsst5.TeamID)
-	require.Equal(t, "test2", tmAsst5.Name)
-	require.Empty(t, tmAsst5.ProfileUUID)
-	require.JSONEq(t, `{"x": 3}`, string(tmAsst5.Profile))
+	require.Equal(t, tmAsst3.ID, tmAsst4.ID)
+	require.True(t, tmAsst4.UploadedAt.After(tmAsst3.UploadedAt))
+	require.Equal(t, tmAsst3.TeamID, tmAsst4.TeamID)
+	require.Equal(t, "test2", tmAsst4.Name)
+	require.JSONEq(t, `{"x": 3}`, string(tmAsst4.Profile))
 
-	// set a profile uuid for the team assistant
-	err = ds.SetMDMAppleSetupAssistantProfileUUID(ctx, &tm.ID, "efgh")
-	require.NoError(t, err)
-
-	time.Sleep(time.Second) // ensures the timestamp checks are not by chance
-
-	// upsert again the team with no change
-	tmAsst6, err := ds.SetOrUpdateMDMAppleSetupAssistant(ctx, &fleet.MDMAppleSetupAssistant{TeamID: &tm.ID, Name: "test2", Profile: json.RawMessage(`{"x":3}`)})
-	require.NoError(t, err)
-	require.Equal(t, "efgh", tmAsst6.ProfileUUID)
-	tmAsst6.ProfileUUID = ""
-	require.Equal(t, tmAsst5, tmAsst6)
-
-	time.Sleep(time.Second) // ensures the timestamp checks are not by chance
-
-	// upsert team with a name change
-	tmAsst7, err := ds.SetOrUpdateMDMAppleSetupAssistant(ctx, &fleet.MDMAppleSetupAssistant{TeamID: &tm.ID, Name: "test3", Profile: json.RawMessage(`{"x":3}`)})
-	require.NoError(t, err)
-	require.Equal(t, tmAsst6.ID, tmAsst7.ID)
-	require.True(t, tmAsst7.UploadedAt.After(tmAsst6.UploadedAt))
-	require.Equal(t, tmAsst6.TeamID, tmAsst7.TeamID)
-	require.Equal(t, "test3", tmAsst7.Name)
-	require.Empty(t, tmAsst7.ProfileUUID)
-	require.JSONEq(t, `{"x": 3}`, string(tmAsst7.Profile))
+	_, _, err = ds.GetMDMAppleSetupAssistantProfileForABMToken(ctx, &tm.ID, "o2")
+	require.ErrorIs(t, err, sql.ErrNoRows)
 
 	// delete no team
 	err = ds.DeleteMDMAppleSetupAssistant(ctx, nil)
 	require.NoError(t, err)
 
+	_, _, err = ds.GetMDMAppleSetupAssistantProfileForABMToken(ctx, nil, "o1")
+	require.ErrorIs(t, err, sql.ErrNoRows)
+
 	// delete the team, which will cascade delete the setup assistant
 	err = ds.DeleteTeam(ctx, tm.ID)
 	require.NoError(t, err)
@@ -3648,6 +3713,11 @@ func testMDMAppleEnrollmentProfile(t *testing.T, ds *Datastore) {
 func testListMDMAppleSerials(t *testing.T, ds *Datastore) {
 	ctx := context.Background()
 
+	encTok := uuid.NewString()
+	abmToken, err := ds.InsertABMToken(ctx, &fleet.ABMToken{OrganizationName: "unused", EncryptedToken: []byte(encTok)})
+	require.NoError(t, err)
+	require.NotEmpty(t, abmToken.ID)
+
 	// create a mix of DEP-enrolled hosts, non-Fleet-MDM, pending DEP-enrollment
 	hosts := make([]*fleet.Host, 7)
 	for i := 0; i < len(hosts); i++ {
@@ -3667,19 +3737,19 @@ func testListMDMAppleSerials(t *testing.T, ds *Datastore) {
 		switch {
 		case i <= 3:
 			// assigned in ABM to Fleet
-			err = ds.UpsertMDMAppleHostDEPAssignments(ctx, []fleet.Host{*h})
+			err = ds.UpsertMDMAppleHostDEPAssignments(ctx, []fleet.Host{*h}, abmToken.ID)
 			require.NoError(t, err)
 		case i == 4:
 			// not ABM assigned
 		case i == 5:
 			// ABM assignment was deleted
-			err = ds.UpsertMDMAppleHostDEPAssignments(ctx, []fleet.Host{*h})
+			err = ds.UpsertMDMAppleHostDEPAssignments(ctx, []fleet.Host{*h}, abmToken.ID)
 			require.NoError(t, err)
 			err = ds.DeleteHostDEPAssignments(ctx, []string{h.HardwareSerial})
 			require.NoError(t, err)
 		case i == 6:
 			// assigned in ABM, but we don't have a serial
-			err = ds.UpsertMDMAppleHostDEPAssignments(ctx, []fleet.Host{*h})
+			err = ds.UpsertMDMAppleHostDEPAssignments(ctx, []fleet.Host{*h}, abmToken.ID)
 			require.NoError(t, err)
 		}
 		hosts[i] = h
@@ -3738,28 +3808,36 @@ func testListMDMAppleSerials(t *testing.T, ds *Datastore) {
 func testMDMAppleDefaultSetupAssistant(t *testing.T, ds *Datastore) {
 	ctx := context.Background()
 
+	// create a couple ABM tokens
+	tok1, err := ds.InsertABMToken(ctx, &fleet.ABMToken{OrganizationName: "o1", EncryptedToken: []byte(uuid.NewString())})
+	require.NoError(t, err)
+	require.NotEmpty(t, tok1.ID)
+	tok2, err := ds.InsertABMToken(ctx, &fleet.ABMToken{OrganizationName: "o2", EncryptedToken: []byte(uuid.NewString())})
+	require.NoError(t, err)
+	require.NotEmpty(t, tok2.ID)
+
 	// get non-existing
-	_, _, err := ds.GetMDMAppleDefaultSetupAssistant(ctx, nil)
+	_, _, err = ds.GetMDMAppleDefaultSetupAssistant(ctx, nil, "no-such-token")
 	require.ErrorIs(t, err, sql.ErrNoRows)
 	require.True(t, fleet.IsNotFound(err))
 
 	// set for no team
-	err = ds.SetMDMAppleDefaultSetupAssistantProfileUUID(ctx, nil, "no-team")
+	err = ds.SetMDMAppleDefaultSetupAssistantProfileUUID(ctx, nil, "no-team", "o1")
 	require.NoError(t, err)
 
 	// get for no team returns the same data
-	uuid, ts, err := ds.GetMDMAppleDefaultSetupAssistant(ctx, nil)
+	uuid, ts, err := ds.GetMDMAppleDefaultSetupAssistant(ctx, nil, "o1")
 	require.NoError(t, err)
 	require.Equal(t, "no-team", uuid)
 	require.NotZero(t, ts)
 
 	// set for non-existing team fails
-	err = ds.SetMDMAppleDefaultSetupAssistantProfileUUID(ctx, ptr.Uint(123), "xyz")
+	err = ds.SetMDMAppleDefaultSetupAssistantProfileUUID(ctx, ptr.Uint(123), "xyz", "o2")
 	require.Error(t, err)
 	require.ErrorContains(t, err, "foreign key constraint fails")
 
 	// get for non-existing team fails
-	_, _, err = ds.GetMDMAppleDefaultSetupAssistant(ctx, ptr.Uint(123))
+	_, _, err = ds.GetMDMAppleDefaultSetupAssistant(ctx, ptr.Uint(123), "o2")
 	require.ErrorIs(t, err, sql.ErrNoRows)
 	require.True(t, fleet.IsNotFound(err))
 
@@ -3767,15 +3845,35 @@ func testMDMAppleDefaultSetupAssistant(t *testing.T, ds *Datastore) {
 	tm, err := ds.NewTeam(ctx, &fleet.Team{Name: "tm"})
 	require.NoError(t, err)
 
-	// set for existing team
-	err = ds.SetMDMAppleDefaultSetupAssistantProfileUUID(ctx, &tm.ID, "tm")
+	// set a couple profiles for existing team
+	err = ds.SetMDMAppleDefaultSetupAssistantProfileUUID(ctx, &tm.ID, "tm1", "o1")
+	require.NoError(t, err)
+	err = ds.SetMDMAppleDefaultSetupAssistantProfileUUID(ctx, &tm.ID, "tm2", "o2")
 	require.NoError(t, err)
 
 	// get for existing team
-	uuid, ts, err = ds.GetMDMAppleDefaultSetupAssistant(ctx, &tm.ID)
+	uuid, ts, err = ds.GetMDMAppleDefaultSetupAssistant(ctx, &tm.ID, "o1")
 	require.NoError(t, err)
-	require.Equal(t, "tm", uuid)
+	require.Equal(t, "tm1", uuid)
 	require.NotZero(t, ts)
+	uuid, ts, err = ds.GetMDMAppleDefaultSetupAssistant(ctx, &tm.ID, "o2")
+	require.NoError(t, err)
+	require.Equal(t, "tm2", uuid)
+	require.NotZero(t, ts)
+	// get for unknown abm token
+	_, _, err = ds.GetMDMAppleDefaultSetupAssistant(ctx, &tm.ID, "no-such-token")
+	require.ErrorIs(t, err, sql.ErrNoRows)
+	require.True(t, fleet.IsNotFound(err))
+
+	// clear all profiles for team
+	err = ds.SetMDMAppleDefaultSetupAssistantProfileUUID(ctx, &tm.ID, "", "")
+	require.NoError(t, err)
+	_, _, err = ds.GetMDMAppleDefaultSetupAssistant(ctx, &tm.ID, "o1")
+	require.ErrorIs(t, err, sql.ErrNoRows)
+	require.True(t, fleet.IsNotFound(err))
+	_, _, err = ds.GetMDMAppleDefaultSetupAssistant(ctx, &tm.ID, "o2")
+	require.ErrorIs(t, err, sql.ErrNoRows)
+	require.True(t, fleet.IsNotFound(err))
 }
 
 func testSetVerifiedMacOSProfiles(t *testing.T, ds *Datastore) {
@@ -4061,7 +4159,7 @@ func TestCopyDefaultMDMAppleBootstrapPackage(t *testing.T) {
 		Bytes:  []byte("content"),
 		Token:  uuid.New().String(),
 	}
-	err = ds.InsertMDMAppleBootstrapPackage(ctx, defaultBP)
+	err = ds.InsertMDMAppleBootstrapPackage(ctx, defaultBP, nil)
 	require.NoError(t, err)
 	checkStoredBP(noTeamID, nil, false, defaultBP)   // default bootstrap package is stored
 	checkStoredBP(teamID, sql.ErrNoRows, false, nil) // no bootstrap package yet for team
@@ -4091,7 +4189,7 @@ func TestCopyDefaultMDMAppleBootstrapPackage(t *testing.T) {
 		Bytes:  []byte("new content"),
 		Token:  uuid.New().String(),
 	}
-	err = ds.InsertMDMAppleBootstrapPackage(ctx, defaultBP2)
+	err = ds.InsertMDMAppleBootstrapPackage(ctx, defaultBP2, nil)
 	require.NoError(t, err)
 	checkStoredBP(noTeamID, nil, false, defaultBP2)
 	// set bootstrap package url in app config
@@ -4185,13 +4283,18 @@ func TestHostDEPAssignments(t *testing.T) {
 	expectedMDMServerURL, err := apple_mdm.ResolveAppleEnrollMDMURL(ac.ServerSettings.ServerURL)
 	require.NoError(t, err)
 
+	encTok := uuid.NewString()
+	abmToken, err := ds.InsertABMToken(ctx, &fleet.ABMToken{OrganizationName: "unused", EncryptedToken: []byte(encTok)})
+	require.NoError(t, err)
+	require.NotEmpty(t, abmToken.ID)
+
 	t.Run("DEP enrollment", func(t *testing.T) {
 		depSerial := "dep-serial"
 		depUUID := "dep-uuid"
 		depOrbitNodeKey := "dep-orbit-node-key"
 		depDeviceTok := "dep-device-token"
 
-		n, _, err := ds.IngestMDMAppleDevicesFromDEPSync(ctx, []godep.Device{{SerialNumber: depSerial}})
+		n, err := ds.IngestMDMAppleDevicesFromDEPSync(ctx, []godep.Device{{SerialNumber: depSerial}}, abmToken.ID, nil, nil, nil)
 		require.NoError(t, err)
 		require.Equal(t, int64(1), n)
 
@@ -4214,6 +4317,8 @@ func TestHostDEPAssignments(t *testing.T) {
 		require.Equal(t, depHostID, depAssignment.HostID)
 		require.Nil(t, depAssignment.DeletedAt)
 		require.WithinDuration(t, time.Now(), depAssignment.AddedAt, 5*time.Second)
+		require.NotNil(t, depAssignment.ABMTokenID)
+		require.Equal(t, *depAssignment.ABMTokenID, abmToken.ID)
 
 		// simulate initial osquery enrollment via Orbit
 		testHost, err := ds.EnrollOrbit(ctx, true, fleet.OrbitHostInfo{HardwareSerial: depSerial, Platform: "darwin", HardwareUUID: depUUID, Hostname: "dep-host"}, depOrbitNodeKey, nil)
@@ -4511,7 +4616,7 @@ func testMDMAppleResetEnrollment(t *testing.T, ds *Datastore) {
 		Sha256: sha256.New().Sum(nil),
 		Bytes:  []byte("content"),
 		Token:  uuid.New().String(),
-	})
+	}, nil)
 	require.NoError(t, err)
 	err = ds.RecordHostBootstrapPackage(ctx, "command-uuid", host.UUID)
 	require.NoError(t, err)
@@ -4549,6 +4654,11 @@ func testMDMAppleResetEnrollment(t *testing.T, ds *Datastore) {
 func testMDMAppleDeleteHostDEPAssignments(t *testing.T, ds *Datastore) {
 	ctx := context.Background()
 
+	encTok := uuid.NewString()
+	abmToken, err := ds.InsertABMToken(ctx, &fleet.ABMToken{OrganizationName: "unused", EncryptedToken: []byte(encTok)})
+	require.NoError(t, err)
+	require.NotEmpty(t, abmToken.ID)
+
 	cases := []struct {
 		name string
 		in   []string
@@ -4568,7 +4678,7 @@ func testMDMAppleDeleteHostDEPAssignments(t *testing.T, ds *Datastore) {
 				{SerialNumber: "bar"},
 				{SerialNumber: "baz"},
 			}
-			_, _, err := ds.IngestMDMAppleDevicesFromDEPSync(ctx, devices)
+			_, err := ds.IngestMDMAppleDevicesFromDEPSync(ctx, devices, abmToken.ID, nil, nil, nil)
 			require.NoError(t, err)
 
 			err = ds.DeleteHostDEPAssignments(ctx, tt.in)
@@ -4755,8 +4865,11 @@ func testMDMAppleDDMDeclarationsToken(t *testing.T, ds *Datastore) {
 		Name:       "decl-1",
 	})
 	require.NoError(t, err)
-	err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, nil, []string{decl.DeclarationUUID}, nil)
+	updates, err := ds.BulkSetPendingMDMHostProfiles(ctx, nil, nil, []string{decl.DeclarationUUID}, nil)
 	require.NoError(t, err)
+	assert.False(t, updates.AppleConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
+	assert.False(t, updates.WindowsConfigProfile)
 
 	toks, err = ds.MDMAppleDDMDeclarationsToken(ctx, "not-exists")
 	require.NoError(t, err)
@@ -4773,8 +4886,11 @@ func testMDMAppleDDMDeclarationsToken(t *testing.T, ds *Datastore) {
 	})
 	require.NoError(t, err)
 	nanoEnroll(t, ds, host1, true)
-	err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, nil, []string{decl.DeclarationUUID}, nil)
+	updates, err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, nil, []string{decl.DeclarationUUID}, nil)
 	require.NoError(t, err)
+	assert.False(t, updates.AppleConfigProfile)
+	assert.True(t, updates.AppleDeclaration)
+	assert.False(t, updates.WindowsConfigProfile)
 
 	toks, err = ds.MDMAppleDDMDeclarationsToken(ctx, host1.UUID)
 	require.NoError(t, err)
@@ -4787,8 +4903,11 @@ func testMDMAppleDDMDeclarationsToken(t *testing.T, ds *Datastore) {
 		Name:       "decl-2",
 	})
 	require.NoError(t, err)
-	err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, nil, []string{decl2.DeclarationUUID}, nil)
+	updates, err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, nil, []string{decl2.DeclarationUUID}, nil)
 	require.NoError(t, err)
+	assert.False(t, updates.AppleConfigProfile)
+	assert.True(t, updates.AppleDeclaration)
+	assert.False(t, updates.WindowsConfigProfile)
 
 	toks, err = ds.MDMAppleDDMDeclarationsToken(ctx, host1.UUID)
 	require.NoError(t, err)
@@ -4799,8 +4918,11 @@ func testMDMAppleDDMDeclarationsToken(t *testing.T, ds *Datastore) {
 
 	err = ds.DeleteMDMAppleConfigProfile(ctx, decl.DeclarationUUID)
 	require.NoError(t, err)
-	err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, nil, []string{decl2.DeclarationUUID}, nil)
+	updates, err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, nil, []string{decl2.DeclarationUUID}, nil)
 	require.NoError(t, err)
+	assert.False(t, updates.AppleConfigProfile)
+	assert.True(t, updates.AppleDeclaration)
+	assert.False(t, updates.WindowsConfigProfile)
 
 	toks, err = ds.MDMAppleDDMDeclarationsToken(ctx, host1.UUID)
 	require.NoError(t, err)
@@ -5368,6 +5490,11 @@ func TestRestorePendingDEPHost(t *testing.T) {
 	expectedMDMServerURL, err := apple_mdm.ResolveAppleEnrollMDMURL(ac.ServerSettings.ServerURL)
 	require.NoError(t, err)
 
+	encTok := uuid.NewString()
+	abmToken, err := ds.InsertABMToken(ctx, &fleet.ABMToken{OrganizationName: "unused", EncryptedToken: []byte(encTok)})
+	require.NoError(t, err)
+	require.NotEmpty(t, abmToken.ID)
+
 	t.Run("DEP enrollment", func(t *testing.T) {
 		checkHostExistsInTable := func(t *testing.T, tableName string, hostID uint, expected bool, where ...string) {
 			stmt := "SELECT 1 FROM " + tableName + " WHERE host_id = ?"
@@ -5419,7 +5546,7 @@ func TestRestorePendingDEPHost(t *testing.T) {
 			depUUID := "dep-uuid"
 			depOrbitNodeKey := "dep-orbit-node-key"
 
-			n, _, err := ds.IngestMDMAppleDevicesFromDEPSync(ctx, []godep.Device{{SerialNumber: depSerial}})
+			n, err := ds.IngestMDMAppleDevicesFromDEPSync(ctx, []godep.Device{{SerialNumber: depSerial}}, abmToken.ID, nil, nil, nil)
 			require.NoError(t, err)
 			require.Equal(t, int64(1), n)
 
@@ -5501,10 +5628,15 @@ func testMDMAppleDEPAssignmentUpdates(t *testing.T, ds *Datastore) {
 	})
 	require.NoError(t, err)
 
+	encTok := uuid.NewString()
+	abmToken, err := ds.InsertABMToken(ctx, &fleet.ABMToken{OrganizationName: "unused", EncryptedToken: []byte(encTok)})
+	require.NoError(t, err)
+	require.NotEmpty(t, abmToken.ID)
+
 	_, err = ds.GetHostDEPAssignment(ctx, h.ID)
 	require.ErrorIs(t, err, sql.ErrNoRows)
 
-	err = ds.UpsertMDMAppleHostDEPAssignments(ctx, []fleet.Host{*h})
+	err = ds.UpsertMDMAppleHostDEPAssignments(ctx, []fleet.Host{*h}, abmToken.ID)
 	require.NoError(t, err)
 
 	assignment, err := ds.GetHostDEPAssignment(ctx, h.ID)
@@ -5520,7 +5652,7 @@ func testMDMAppleDEPAssignmentUpdates(t *testing.T, ds *Datastore) {
 	require.Equal(t, h.ID, assignment.HostID)
 	require.NotNil(t, assignment.DeletedAt)
 
-	err = ds.UpsertMDMAppleHostDEPAssignments(ctx, []fleet.Host{*h})
+	err = ds.UpsertMDMAppleHostDEPAssignments(ctx, []fleet.Host{*h}, abmToken.ID)
 	require.NoError(t, err)
 	assignment, err = ds.GetHostDEPAssignment(ctx, h.ID)
 	require.NoError(t, err)
@@ -5691,10 +5823,15 @@ func testListIOSAndIPadOSToRefetch(t *testing.T, ds *Datastore) {
 		return h
 	}
 
-	// Test with no hosts.
-	uuids, err := ds.ListIOSAndIPadOSToRefetch(ctx, refetchInterval)
+	encTok := uuid.NewString()
+	abmToken, err := ds.InsertABMToken(ctx, &fleet.ABMToken{OrganizationName: "unused", EncryptedToken: []byte(encTok)})
 	require.NoError(t, err)
-	require.Empty(t, uuids)
+	require.NotEmpty(t, abmToken.ID)
+
+	// Test with no hosts.
+	devices, err := ds.ListIOSAndIPadOSToRefetch(ctx, refetchInterval)
+	require.NoError(t, err)
+	require.Empty(t, devices)
 
 	// Create a placeholder macOS host.
 	_ = newHost("darwin")
@@ -5704,14 +5841,14 @@ func testListIOSAndIPadOSToRefetch(t *testing.T, ds *Datastore) {
 		{SerialNumber: "iOS0_SERIAL", DeviceFamily: "iPhone", OpType: "added"},
 		{SerialNumber: "iPadOS0_SERIAL", DeviceFamily: "iPad", OpType: "added"},
 	}
-	n, _, err := ds.IngestMDMAppleDevicesFromDEPSync(ctx, depDevices)
+	n, err := ds.IngestMDMAppleDevicesFromDEPSync(ctx, depDevices, abmToken.ID, nil, nil, nil)
 	require.NoError(t, err)
 	require.Equal(t, int64(2), n)
 
 	// Hosts are not enrolled yet (e.g. DEP enrolled)
-	uuids, err = ds.ListIOSAndIPadOSToRefetch(ctx, refetchInterval)
+	devices, err = ds.ListIOSAndIPadOSToRefetch(ctx, refetchInterval)
 	require.NoError(t, err)
-	require.Empty(t, uuids)
+	require.Empty(t, devices)
 
 	// Now simulate the initial MDM checkin of the devices.
 	err = ds.MDMAppleUpsertHost(ctx, &fleet.Host{
@@ -5738,13 +5875,16 @@ func testListIOSAndIPadOSToRefetch(t *testing.T, ds *Datastore) {
 	nanoEnroll(t, ds, iPadOS0, false)
 
 	// Test with hosts but empty state in nanomdm command tables.
-	uuids, err = ds.ListIOSAndIPadOSToRefetch(ctx, refetchInterval)
+	devices, err = ds.ListIOSAndIPadOSToRefetch(ctx, refetchInterval)
 	require.NoError(t, err)
-	require.Len(t, uuids, 2)
+	require.Len(t, devices, 2)
+	uuids := []string{devices[0].UUID, devices[1].UUID}
 	sort.Slice(uuids, func(i, j int) bool {
 		return uuids[i] < uuids[j]
 	})
-	require.Equal(t, uuids, []string{"iOS0_UUID", "iPadOS0_UUID"})
+	assert.Equal(t, uuids, []string{"iOS0_UUID", "iPadOS0_UUID"})
+	assert.Empty(t, devices[0].CommandsAlreadySent)
+	assert.Empty(t, devices[1].CommandsAlreadySent)
 
 	// Set iOS detail_updated_at as 30 minutes in the past.
 	ExecAdhocSQL(t, ds, func(q sqlx.ExtContext) error {
@@ -5753,10 +5893,10 @@ func testListIOSAndIPadOSToRefetch(t *testing.T, ds *Datastore) {
 	})
 
 	// iOS device should not be returned because it was refetched recently
-	uuids, err = ds.ListIOSAndIPadOSToRefetch(ctx, refetchInterval)
+	devices, err = ds.ListIOSAndIPadOSToRefetch(ctx, refetchInterval)
 	require.NoError(t, err)
-	require.Len(t, uuids, 1)
-	require.Equal(t, uuids[0], "iPadOS0_UUID")
+	require.Len(t, devices, 1)
+	require.Equal(t, devices[0].UUID, "iPadOS0_UUID")
 
 	// Set iPadOS detail_updated_at as 30 minutes in the past.
 	ExecAdhocSQL(t, ds, func(q sqlx.ExtContext) error {
@@ -5765,9 +5905,9 @@ func testListIOSAndIPadOSToRefetch(t *testing.T, ds *Datastore) {
 	})
 
 	// Both devices are up-to-date thus none should be returned.
-	uuids, err = ds.ListIOSAndIPadOSToRefetch(ctx, refetchInterval)
+	devices, err = ds.ListIOSAndIPadOSToRefetch(ctx, refetchInterval)
 	require.NoError(t, err)
-	require.Empty(t, uuids)
+	require.Empty(t, devices)
 
 	// Set iOS detail_updated_at as 2 hours in the past.
 	ExecAdhocSQL(t, ds, func(q sqlx.ExtContext) error {
@@ -5776,10 +5916,23 @@ func testListIOSAndIPadOSToRefetch(t *testing.T, ds *Datastore) {
 	})
 
 	// iOS device be returned because it is out of date.
-	uuids, err = ds.ListIOSAndIPadOSToRefetch(ctx, refetchInterval)
+	devices, err = ds.ListIOSAndIPadOSToRefetch(ctx, refetchInterval)
 	require.NoError(t, err)
-	require.Len(t, uuids, 1)
-	require.Equal(t, uuids[0], "iOS0_UUID")
+	require.Len(t, devices, 1)
+	require.Equal(t, devices[0].UUID, "iOS0_UUID")
+	assert.Empty(t, devices[0].CommandsAlreadySent)
+
+	// Update commands already sent to the devices and check that they are returned.
+	require.NoError(t, ds.AddHostMDMCommands(ctx, []fleet.HostMDMCommand{{
+		HostID:      iOS0.ID,
+		CommandType: "my-command",
+	}}))
+	devices, err = ds.ListIOSAndIPadOSToRefetch(ctx, refetchInterval)
+	require.NoError(t, err)
+	require.Len(t, devices, 1)
+	require.Equal(t, devices[0].UUID, "iOS0_UUID")
+	require.Len(t, devices[0].CommandsAlreadySent, 1)
+	assert.Equal(t, "my-command", devices[0].CommandsAlreadySent[0])
 }
 
 func testMDMAppleUpsertHostIOSIPadOS(t *testing.T, ds *Datastore) {
@@ -5869,7 +6022,12 @@ func testIngestMDMAppleDevicesFromDEPSyncIOSIPadOS(t *testing.T, ds *Datastore)
 		{SerialNumber: "iPadOS0_SERIAL", DeviceFamily: "iPad", OpType: "added"},
 	}
 
-	n, _, err := ds.IngestMDMAppleDevicesFromDEPSync(ctx, depDevices)
+	encTok := uuid.NewString()
+	abmToken, err := ds.InsertABMToken(ctx, &fleet.ABMToken{OrganizationName: "unused", EncryptedToken: []byte(encTok)})
+	require.NoError(t, err)
+	require.NotEmpty(t, abmToken.ID)
+
+	n, err := ds.IngestMDMAppleDevicesFromDEPSync(ctx, depDevices, abmToken.ID, nil, nil, nil)
 	require.NoError(t, err)
 	require.Equal(t, int64(2), n)
 
@@ -5942,8 +6100,11 @@ func testMDMAppleProfilesOnIOSIPadOS(t *testing.T, ds *Datastore) {
 	someProfile, err := ds.NewMDMAppleConfigProfile(ctx, *generateCP("a", "a", 0))
 	require.NoError(t, err)
 
-	err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{0}, nil, nil)
+	updates, err := ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{0}, nil, nil)
 	require.NoError(t, err)
+	assert.True(t, updates.AppleConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
+	assert.False(t, updates.WindowsConfigProfile)
 
 	profiles, err := ds.GetHostMDMAppleProfiles(ctx, "iOS0_UUID")
 	require.NoError(t, err)
@@ -6001,6 +6162,7 @@ func testGetHostUUIDsWithPendingMDMAppleCommands(t *testing.T, ds *Datastore) {
 	require.NoError(t, err)
 	require.ElementsMatch(t, []string{hosts[1].UUID, hosts[2].UUID}, uuids)
 }
+
 func testHostDetailsMDMProfilesIOSIPadOS(t *testing.T, ds *Datastore) {
 	ctx := context.Background()
 
@@ -6143,3 +6305,797 @@ func testHostDetailsMDMProfilesIOSIPadOS(t *testing.T, ds *Datastore) {
 		require.Equal(t, fleet.MDMDeliveryVerified, *gotProfs[0].Status)
 	}
 }
+
+func testMDMAppleBootstrapPackageWithS3(t *testing.T, ds *Datastore) {
+	ctx := context.Background()
+	var nfe fleet.NotFoundError
+	var aerr fleet.AlreadyExistsError
+
+	hashContent := func(content string) []byte {
+		h := sha256.New()
+		_, err := h.Write([]byte(content))
+		require.NoError(t, err)
+		return h.Sum(nil)
+	}
+
+	bpMatchesWithoutContent := func(want, got *fleet.MDMAppleBootstrapPackage) {
+		// make local copies so we don't alter the caller's structs
+		w, g := *want, *got
+		w.Bytes, g.Bytes = nil, nil
+		w.CreatedAt, g.CreatedAt = time.Time{}, time.Time{}
+		w.UpdatedAt, g.UpdatedAt = time.Time{}, time.Time{}
+		require.Equal(t, w, g)
+	}
+
+	pkgStore := s3.SetupTestBootstrapPackageStore(t, "mdm-apple-bootstrap-package-test", "")
+
+	err := ds.InsertMDMAppleBootstrapPackage(ctx, &fleet.MDMAppleBootstrapPackage{}, pkgStore)
+	require.Error(t, err)
+
+	// associate bp1 with no team
+	bp1 := &fleet.MDMAppleBootstrapPackage{
+		TeamID: uint(0),
+		Name:   "bp1",
+		Sha256: hashContent("bp1"),
+		Bytes:  []byte("bp1"),
+		Token:  uuid.New().String(),
+	}
+	err = ds.InsertMDMAppleBootstrapPackage(ctx, bp1, pkgStore)
+	require.NoError(t, err)
+
+	// try to store bp1 again, fails as it already exists
+	err = ds.InsertMDMAppleBootstrapPackage(ctx, bp1, pkgStore)
+	require.ErrorAs(t, err, &aerr)
+
+	// associate bp2 with team id 2
+	bp2 := &fleet.MDMAppleBootstrapPackage{
+		TeamID: uint(2),
+		Name:   "bp2",
+		Sha256: hashContent("bp2"),
+		Bytes:  []byte("bp2"),
+		Token:  uuid.New().String(),
+	}
+	err = ds.InsertMDMAppleBootstrapPackage(ctx, bp2, pkgStore)
+	require.NoError(t, err)
+
+	// associate the same content as bp1 with team id 1, via a copy
+	err = ds.CopyDefaultMDMAppleBootstrapPackage(ctx, &fleet.AppConfig{}, 1)
+	require.NoError(t, err)
+
+	// get bp for no team
+	meta, err := ds.GetMDMAppleBootstrapPackageMeta(ctx, 0)
+	require.NoError(t, err)
+	bpMatchesWithoutContent(bp1, meta)
+
+	// get for team 1, token differs due to the copy, rest is the same
+	meta, err = ds.GetMDMAppleBootstrapPackageMeta(ctx, 1)
+	require.NoError(t, err)
+	require.NotEqual(t, bp1.Token, meta.Token)
+	bp1b := *bp1
+	bp1b.Token = meta.Token
+	bp1b.TeamID = 1
+	bpMatchesWithoutContent(&bp1b, meta)
+
+	// get for team 2
+	meta, err = ds.GetMDMAppleBootstrapPackageMeta(ctx, 2)
+	require.NoError(t, err)
+	bpMatchesWithoutContent(bp2, meta)
+
+	// get for team 3, does not exist
+	meta, err = ds.GetMDMAppleBootstrapPackageMeta(ctx, 3)
+	require.ErrorAs(t, err, &nfe)
+	require.Nil(t, meta)
+
+	// get content for no team
+	bpContent, err := ds.GetMDMAppleBootstrapPackageBytes(ctx, bp1.Token, pkgStore)
+	require.NoError(t, err)
+	require.Equal(t, bp1.Bytes, bpContent.Bytes)
+
+	// get content for team 1 (copy of no team)
+	bpContent, err = ds.GetMDMAppleBootstrapPackageBytes(ctx, bp1b.Token, pkgStore)
+	require.NoError(t, err)
+	require.Equal(t, bp1b.Bytes, bpContent.Bytes)
+	require.Equal(t, bp1.Bytes, bpContent.Bytes)
+
+	// get content for team 2
+	bpContent, err = ds.GetMDMAppleBootstrapPackageBytes(ctx, bp2.Token, pkgStore)
+	require.NoError(t, err)
+	require.Equal(t, bp2.Bytes, bpContent.Bytes)
+
+	// get content with invalid token
+	bpContent, err = ds.GetMDMAppleBootstrapPackageBytes(ctx, "no-such-token", pkgStore)
+	require.ErrorAs(t, err, &nfe)
+	require.Nil(t, bpContent)
+
+	// delete bp for no team and team 2
+	err = ds.DeleteMDMAppleBootstrapPackage(ctx, 0)
+	require.NoError(t, err)
+	err = ds.DeleteMDMAppleBootstrapPackage(ctx, 2)
+	require.NoError(t, err)
+
+	// run the cleanup job
+	err = ds.CleanupUnusedBootstrapPackages(ctx, pkgStore, time.Now())
+	require.NoError(t, err)
+
+	// team 1 can still be retrieved (it shares the same contents)
+	bpContent, err = ds.GetMDMAppleBootstrapPackageBytes(ctx, bp1b.Token, pkgStore)
+	require.NoError(t, err)
+	require.Equal(t, bp1b.Bytes, bpContent.Bytes)
+
+	// team 0 and 2 don't exist anymore
+	meta, err = ds.GetMDMAppleBootstrapPackageMeta(ctx, 0)
+	require.ErrorAs(t, err, &nfe)
+	require.Nil(t, meta)
+	meta, err = ds.GetMDMAppleBootstrapPackageMeta(ctx, 2)
+	require.ErrorAs(t, err, &nfe)
+	require.Nil(t, meta)
+
+	ok, err := pkgStore.Exists(ctx, hex.EncodeToString(bp1.Sha256))
+	require.NoError(t, err)
+	require.True(t, ok)
+	ok, err = pkgStore.Exists(ctx, hex.EncodeToString(bp2.Sha256))
+	require.NoError(t, err)
+	require.False(t, ok)
+
+	// delete team 1
+	err = ds.DeleteMDMAppleBootstrapPackage(ctx, 1)
+	require.NoError(t, err)
+
+	// force a team 3 bp to be saved in the DB (simulates upgrading to the new
+	// S3-based storage with already-saved bps in the DB)
+	bp3 := &fleet.MDMAppleBootstrapPackage{
+		TeamID: uint(3),
+		Name:   "bp3",
+		Sha256: hashContent("bp3"),
+		Bytes:  []byte("bp3"),
+		Token:  uuid.New().String(),
+	}
+	err = ds.InsertMDMAppleBootstrapPackage(ctx, bp3, nil) // passing a nil pkgStore to force save in the DB
+	require.NoError(t, err)
+
+	// metadata can be read
+	meta, err = ds.GetMDMAppleBootstrapPackageMeta(ctx, 3)
+	require.NoError(t, err)
+	bpMatchesWithoutContent(bp3, meta)
+
+	// content will be retrieved correctly from the DB even if we pass a pkgStore
+	bpContent, err = ds.GetMDMAppleBootstrapPackageBytes(ctx, bp3.Token, pkgStore)
+	require.NoError(t, err)
+	require.Equal(t, bp3.Bytes, bpContent.Bytes)
+
+	// run the cleanup job
+	err = ds.CleanupUnusedBootstrapPackages(ctx, pkgStore, time.Now())
+	require.NoError(t, err)
+
+	ok, err = pkgStore.Exists(ctx, hex.EncodeToString(bp1.Sha256))
+	require.NoError(t, err)
+	require.False(t, ok)
+	ok, err = pkgStore.Exists(ctx, hex.EncodeToString(bp2.Sha256))
+	require.NoError(t, err)
+	require.False(t, ok)
+	// bp3 does not exist in the S3 store
+	ok, err = pkgStore.Exists(ctx, hex.EncodeToString(bp3.Sha256))
+	require.NoError(t, err)
+	require.False(t, ok)
+
+	// so it can still be retrieved from the DB
+	bpContent, err = ds.GetMDMAppleBootstrapPackageBytes(ctx, bp3.Token, pkgStore)
+	require.NoError(t, err)
+	require.Equal(t, bp3.Bytes, bpContent.Bytes)
+
+	// it can be deleted without problem
+	err = ds.DeleteMDMAppleBootstrapPackage(ctx, 3)
+	require.NoError(t, err)
+
+	bpContent, err = ds.GetMDMAppleBootstrapPackageBytes(ctx, bp3.Token, pkgStore)
+	require.ErrorAs(t, err, &nfe)
+	require.Nil(t, bpContent)
+}
+
+func testMDMAppleGetAndUpdateABMToken(t *testing.T, ds *Datastore) {
+	ctx := context.Background()
+
+	// get a non-existing token
+	tok, err := ds.GetABMTokenByOrgName(ctx, "no-such-token")
+	var nfe fleet.NotFoundError
+	require.ErrorAs(t, err, &nfe)
+	require.Nil(t, tok)
+
+	// create some teams
+	tm1, err := ds.NewTeam(ctx, &fleet.Team{Name: "team1"})
+	require.NoError(t, err)
+	tm2, err := ds.NewTeam(ctx, &fleet.Team{Name: "team2"})
+	require.NoError(t, err)
+	tm3, err := ds.NewTeam(ctx, &fleet.Team{Name: "team3"})
+	require.NoError(t, err)
+
+	// create a token with an empty name and no team set, and another that will be unused
+	encTok := uuid.NewString()
+
+	t1, err := ds.InsertABMToken(ctx, &fleet.ABMToken{OrganizationName: "unused", EncryptedToken: []byte(encTok)})
+	require.NoError(t, err)
+	require.NotEmpty(t, t1.ID)
+	t2, err := ds.InsertABMToken(ctx, &fleet.ABMToken{EncryptedToken: []byte(encTok)})
+	require.NoError(t, err)
+	require.NotEmpty(t, t2.ID)
+
+	toks, err := ds.ListABMTokens(ctx)
+	require.NoError(t, err)
+	require.Len(t, toks, 2)
+
+	// get that token
+	tok, err = ds.GetABMTokenByOrgName(ctx, "")
+	require.NoError(t, err)
+	require.NotZero(t, tok.ID)
+	require.Equal(t, encTok, string(tok.EncryptedToken))
+	require.Empty(t, tok.OrganizationName)
+	require.Empty(t, tok.AppleID)
+	require.Equal(t, fleet.TeamNameNoTeam, tok.MacOSTeamName)
+	require.Equal(t, fleet.TeamNameNoTeam, tok.IOSTeamName)
+	require.Equal(t, fleet.TeamNameNoTeam, tok.IPadOSTeamName)
+
+	// update the token with a name and teams
+	tok.OrganizationName = "org-name"
+	tok.AppleID = "name@example.com"
+	tok.MacOSDefaultTeamID = &tm1.ID
+	tok.IOSDefaultTeamID = &tm2.ID
+	err = ds.SaveABMToken(ctx, tok)
+	require.NoError(t, err)
+
+	// reload that token
+	tokReload, err := ds.GetABMTokenByOrgName(ctx, "org-name")
+	require.NoError(t, err)
+	require.Equal(t, tok.ID, tokReload.ID)
+	require.Equal(t, encTok, string(tokReload.EncryptedToken))
+	require.Equal(t, "org-name", tokReload.OrganizationName)
+	require.Equal(t, "name@example.com", tokReload.AppleID)
+	require.Equal(t, tm1.Name, tokReload.MacOSTeamName)
+	require.Equal(t, tm1.Name, tokReload.MacOSTeam.Name)
+	require.Equal(t, tm1.ID, tokReload.MacOSTeam.ID)
+	require.Equal(t, tm2.Name, tokReload.IOSTeamName)
+	require.Equal(t, tm2.Name, tokReload.IOSTeam.Name)
+	require.Equal(t, tm2.ID, tokReload.IOSTeam.ID)
+	require.Equal(t, fleet.TeamNameNoTeam, tokReload.IPadOSTeamName)
+	require.Equal(t, fleet.TeamNameNoTeam, tokReload.IPadOSTeam.Name)
+	require.Equal(t, uint(0), tokReload.IPadOSTeam.ID)
+
+	// empty name token now doesn't exist
+	_, err = ds.GetABMTokenByOrgName(ctx, "")
+	require.ErrorAs(t, err, &nfe)
+
+	// update some teams
+	tok.MacOSDefaultTeamID = nil
+	tok.IPadOSDefaultTeamID = &tm3.ID
+	err = ds.SaveABMToken(ctx, tok)
+	require.NoError(t, err)
+
+	// reload that token
+	tokReload, err = ds.GetABMTokenByOrgName(ctx, "org-name")
+	require.NoError(t, err)
+	require.Equal(t, tok.ID, tokReload.ID)
+	require.Equal(t, encTok, string(tokReload.EncryptedToken))
+	require.Equal(t, "org-name", tokReload.OrganizationName)
+	require.Equal(t, "name@example.com", tokReload.AppleID)
+	require.Equal(t, fleet.TeamNameNoTeam, tokReload.MacOSTeamName)
+	require.Equal(t, fleet.TeamNameNoTeam, tokReload.MacOSTeam.Name)
+	require.Equal(t, uint(0), tokReload.MacOSTeam.ID)
+	require.Equal(t, tm2.Name, tokReload.IOSTeamName)
+	require.Equal(t, tm3.Name, tokReload.IPadOSTeamName)
+
+	// change just the encrypted token
+	encTok2 := uuid.NewString()
+	tok.EncryptedToken = []byte(encTok2)
+	err = ds.SaveABMToken(ctx, tok)
+	require.NoError(t, err)
+
+	tokReload, err = ds.GetABMTokenByOrgName(ctx, "org-name")
+	require.NoError(t, err)
+	require.Equal(t, tok.ID, tokReload.ID)
+	require.Equal(t, encTok2, string(tokReload.EncryptedToken))
+	require.Equal(t, "org-name", tokReload.OrganizationName)
+	require.Equal(t, "name@example.com", tokReload.AppleID)
+	require.Equal(t, fleet.TeamNameNoTeam, tokReload.MacOSTeamName)
+	require.Equal(t, fleet.TeamNameNoTeam, tokReload.MacOSTeam.Name)
+	require.Equal(t, uint(0), tokReload.MacOSTeam.ID)
+	require.Equal(t, tm2.Name, tokReload.IOSTeamName)
+	require.Equal(t, tm2.Name, tokReload.IOSTeam.Name)
+	require.Equal(t, tm2.ID, tokReload.IOSTeam.ID)
+	require.Equal(t, tm3.Name, tokReload.IPadOSTeamName)
+	require.Equal(t, tm3.Name, tokReload.IPadOSTeam.Name)
+	require.Equal(t, tm3.ID, tokReload.IPadOSTeam.ID)
+
+	// Remove unused token
+	require.NoError(t, ds.DeleteABMToken(ctx, t1.ID))
+
+	toks, err = ds.ListABMTokens(ctx)
+	require.NoError(t, err)
+	require.Len(t, toks, 1)
+	expTok := toks[0]
+	require.Equal(t, "org-name", expTok.OrganizationName)
+	require.Equal(t, "name@example.com", expTok.AppleID)
+	require.Equal(t, fleet.TeamNameNoTeam, expTok.MacOSTeamName)
+	require.Equal(t, fleet.TeamNameNoTeam, expTok.MacOSTeam.Name)
+	require.Equal(t, uint(0), expTok.MacOSTeam.ID)
+	require.Equal(t, tm2.Name, expTok.IOSTeamName)
+	require.Equal(t, tm3.Name, expTok.IPadOSTeamName)
+}
+
+func testMDMAppleABMTokensTermsExpired(t *testing.T, ds *Datastore) {
+	ctx := context.Background()
+
+	// count works with no token
+	count, err := ds.CountABMTokensWithTermsExpired(ctx)
+	require.NoError(t, err)
+	require.Zero(t, count)
+
+	// create a few tokens
+	encTok1 := uuid.NewString()
+	t1, err := ds.InsertABMToken(ctx, &fleet.ABMToken{OrganizationName: "abm1", EncryptedToken: []byte(encTok1)})
+	require.NoError(t, err)
+	require.NotEmpty(t, t1.ID)
+	encTok2 := uuid.NewString()
+	t2, err := ds.InsertABMToken(ctx, &fleet.ABMToken{OrganizationName: "abm2", EncryptedToken: []byte(encTok2)})
+	require.NoError(t, err)
+	require.NotEmpty(t, t2.ID)
+	// this one simulates a mirated token - empty name
+	encTok3 := uuid.NewString()
+	t3, err := ds.InsertABMToken(ctx, &fleet.ABMToken{OrganizationName: "", EncryptedToken: []byte(encTok3)})
+	require.NoError(t, err)
+	require.NotEmpty(t, t3.ID)
+
+	// none have terms expired yet
+	count, err = ds.CountABMTokensWithTermsExpired(ctx)
+	require.NoError(t, err)
+	require.Zero(t, count)
+
+	// set t1 terms expired
+	was, err := ds.SetABMTokenTermsExpiredForOrgName(ctx, t1.OrganizationName, true)
+	require.NoError(t, err)
+	require.False(t, was)
+
+	// set t2 terms not expired, no-op
+	was, err = ds.SetABMTokenTermsExpiredForOrgName(ctx, t2.OrganizationName, false)
+	require.NoError(t, err)
+	require.False(t, was)
+
+	// set t3 terms expired
+	was, err = ds.SetABMTokenTermsExpiredForOrgName(ctx, t3.OrganizationName, true)
+	require.NoError(t, err)
+	require.False(t, was)
+
+	// count is now 2
+	count, err = ds.CountABMTokensWithTermsExpired(ctx)
+	require.NoError(t, err)
+	require.EqualValues(t, 2, count)
+
+	// set t1 terms not expired
+	was, err = ds.SetABMTokenTermsExpiredForOrgName(ctx, t1.OrganizationName, false)
+	require.NoError(t, err)
+	require.True(t, was)
+
+	// set t3 terms still expired
+	was, err = ds.SetABMTokenTermsExpiredForOrgName(ctx, t3.OrganizationName, true)
+	require.NoError(t, err)
+	require.True(t, was)
+
+	// count is now 1
+	count, err = ds.CountABMTokensWithTermsExpired(ctx)
+	require.NoError(t, err)
+	require.EqualValues(t, 1, count)
+
+	// setting the expired flag of a non-existing token always returns as if it
+	// did not update (which is fine, it will only be called after a DEP API call
+	// that used this token, so if the token does not exist it would fail the
+	// call).
+	was, err = ds.SetABMTokenTermsExpiredForOrgName(ctx, "no-such-token", false)
+	require.NoError(t, err)
+	require.False(t, was)
+	was, err = ds.SetABMTokenTermsExpiredForOrgName(ctx, "no-such-token", true)
+	require.NoError(t, err)
+	require.True(t, was)
+
+	// count is unaffected
+	count, err = ds.CountABMTokensWithTermsExpired(ctx)
+	require.NoError(t, err)
+	require.EqualValues(t, 1, count)
+}
+
+func testMDMGetABMTokenOrgNamesAssociatedWithTeam(t *testing.T, ds *Datastore) {
+	ctx := context.Background()
+
+	// Create some teams
+	tm1, err := ds.NewTeam(ctx, &fleet.Team{Name: "team1"})
+	require.NoError(t, err)
+
+	tm2, err := ds.NewTeam(ctx, &fleet.Team{Name: "team2"})
+	require.NoError(t, err)
+
+	encTok := uuid.NewString()
+
+	tok1, err := ds.InsertABMToken(ctx, &fleet.ABMToken{OrganizationName: "org1", EncryptedToken: []byte(encTok)})
+	require.NoError(t, err)
+	require.NotEmpty(t, tok1.ID)
+
+	tok2, err := ds.InsertABMToken(ctx, &fleet.ABMToken{OrganizationName: "org2", EncryptedToken: []byte(encTok)})
+	require.NoError(t, err)
+	require.NotEmpty(t, tok1.ID)
+
+	tok3, err := ds.InsertABMToken(ctx, &fleet.ABMToken{OrganizationName: "org3", EncryptedToken: []byte(encTok), MacOSDefaultTeamID: &tm2.ID})
+	require.NoError(t, err)
+	require.NotEmpty(t, tok1.ID)
+
+	// Create some hosts and add to teams (and one for no team)
+	h1, err := ds.NewHost(ctx, &fleet.Host{
+		Hostname:      "test-host1-name",
+		OsqueryHostID: ptr.String("1"),
+		NodeKey:       ptr.String("1"),
+		UUID:          "test-uuid-1",
+		TeamID:        &tm1.ID,
+		Platform:      "darwin",
+	})
+	require.NoError(t, err)
+
+	h2, err := ds.NewHost(ctx, &fleet.Host{
+		Hostname:      "test-host2-name",
+		OsqueryHostID: ptr.String("2"),
+		NodeKey:       ptr.String("2"),
+		UUID:          "test-uuid-2",
+		TeamID:        &tm1.ID,
+		Platform:      "darwin",
+	})
+	require.NoError(t, err)
+
+	h3, err := ds.NewHost(ctx, &fleet.Host{
+		Hostname:      "test-host3-name",
+		OsqueryHostID: ptr.String("3"),
+		NodeKey:       ptr.String("3"),
+		UUID:          "test-uuid-3",
+		TeamID:        nil,
+		Platform:      "darwin",
+	})
+	require.NoError(t, err)
+
+	h4, err := ds.NewHost(ctx, &fleet.Host{
+		Hostname:      "test-host4-name",
+		OsqueryHostID: ptr.String("4"),
+		NodeKey:       ptr.String("4"),
+		UUID:          "test-uuid-4",
+		TeamID:        &tm1.ID,
+		Platform:      "darwin",
+	})
+	require.NoError(t, err)
+
+	// Insert host DEP assignment
+	require.NoError(t, ds.UpsertMDMAppleHostDEPAssignments(ctx, []fleet.Host{*h1, *h4}, tok1.ID))
+	require.NoError(t, ds.UpsertMDMAppleHostDEPAssignments(ctx, []fleet.Host{*h2}, tok3.ID))
+	require.NoError(t, ds.UpsertMDMAppleHostDEPAssignments(ctx, []fleet.Host{*h3}, tok2.ID))
+
+	// Should return the 2 unique org names [org1, org3]
+	orgNames, err := ds.GetABMTokenOrgNamesAssociatedWithTeam(ctx, &tm1.ID)
+	require.NoError(t, err)
+	sort.Strings(orgNames)
+	require.Len(t, orgNames, 2)
+	require.Equal(t, orgNames[0], "org1")
+	require.Equal(t, orgNames[1], "org3")
+
+	// all tokens default to no team in one way or another
+	orgNames, err = ds.GetABMTokenOrgNamesAssociatedWithTeam(ctx, nil)
+	require.NoError(t, err)
+	sort.Strings(orgNames)
+	require.Len(t, orgNames, 3)
+	require.Equal(t, orgNames[0], "org1")
+	require.Equal(t, orgNames[1], "org2")
+	require.Equal(t, orgNames[2], "org3")
+
+	// No orgs for this team except org3 which uses it as a default team
+	orgNames, err = ds.GetABMTokenOrgNamesAssociatedWithTeam(ctx, &tm2.ID)
+	require.NoError(t, err)
+	sort.Strings(orgNames)
+	require.Len(t, orgNames, 1)
+	require.Equal(t, orgNames[0], "org3")
+}
+
+func testHostMDMCommands(t *testing.T, ds *Datastore) {
+	ctx := context.Background()
+
+	addHostMDMCommandsBatchSizeOrig := addHostMDMCommandsBatchSize
+	addHostMDMCommandsBatchSize = 2
+	t.Cleanup(func() {
+		addHostMDMCommandsBatchSize = addHostMDMCommandsBatchSizeOrig
+	})
+
+	// create a host
+	h, err := ds.NewHost(ctx, &fleet.Host{
+		DetailUpdatedAt: time.Now(),
+		LabelUpdatedAt:  time.Now(),
+		PolicyUpdatedAt: time.Now(),
+		SeenTime:        time.Now(),
+		OsqueryHostID:   ptr.String("host0-osquery-id"),
+		NodeKey:         ptr.String("host0-node-key"),
+		UUID:            "host0-test-mdm-profiles",
+		Hostname:        "hostname0",
+	})
+	require.NoError(t, err)
+
+	hostCommands := []fleet.HostMDMCommand{
+		{
+			HostID:      h.ID,
+			CommandType: "command-1",
+		},
+		{
+			HostID:      h.ID,
+			CommandType: "command-2",
+		},
+		{
+			HostID:      h.ID,
+			CommandType: "command-3",
+		},
+	}
+
+	badHostID := h.ID + 1
+	allCommands := append(hostCommands, fleet.HostMDMCommand{
+		HostID:      badHostID,
+		CommandType: "command-1",
+	})
+	err = ds.AddHostMDMCommands(ctx, allCommands)
+	require.NoError(t, err)
+
+	commands, err := ds.GetHostMDMCommands(ctx, h.ID)
+	require.NoError(t, err)
+	assert.ElementsMatch(t, hostCommands, commands)
+
+	// Remove a command
+	require.NoError(t, ds.RemoveHostMDMCommand(ctx, hostCommands[0]))
+
+	commands, err = ds.GetHostMDMCommands(ctx, h.ID)
+	require.NoError(t, err)
+	assert.ElementsMatch(t, hostCommands[1:], commands)
+
+	// Clean up commands, and make sure badHost commands have been removed, but others remain.
+	commands, err = ds.GetHostMDMCommands(ctx, badHostID)
+	require.NoError(t, err)
+	assert.Len(t, commands, 1)
+
+	require.NoError(t, ds.CleanupHostMDMCommands(ctx))
+	commands, err = ds.GetHostMDMCommands(ctx, badHostID)
+	require.NoError(t, err)
+	assert.Empty(t, commands)
+
+	commands, err = ds.GetHostMDMCommands(ctx, h.ID)
+	require.NoError(t, err)
+	assert.ElementsMatch(t, hostCommands[1:], commands)
+}
+
+func testIngestMDMAppleDeviceFromOTAEnrollment(t *testing.T, ds *Datastore) {
+	ctx := context.Background()
+	createBuiltinLabels(t, ds)
+
+	for i := 0; i < 10; i++ {
+		_, err := ds.NewHost(ctx, &fleet.Host{
+			Hostname:        fmt.Sprintf("hostname_%d", i),
+			DetailUpdatedAt: time.Now(),
+			LabelUpdatedAt:  time.Now(),
+			PolicyUpdatedAt: time.Now(),
+			SeenTime:        time.Now().Add(-time.Duration(i) * time.Minute),
+			OsqueryHostID:   ptr.String(fmt.Sprintf("osquery-host-id_%d", i)),
+			NodeKey:         ptr.String(fmt.Sprintf("node-key_%d", i)),
+			UUID:            fmt.Sprintf("uuid_%d", i),
+			HardwareSerial:  fmt.Sprintf("serial_%d", i),
+		})
+		require.NoError(t, err)
+	}
+
+	hosts := listHostsCheckCount(t, ds, fleet.TeamFilter{User: test.UserAdmin}, fleet.HostListOptions{}, 10)
+	wantSerials := []string{}
+	for _, h := range hosts {
+		wantSerials = append(wantSerials, h.HardwareSerial)
+	}
+
+	// mock results incoming from OTA enrollments
+	otaDevices := []fleet.MDMAppleMachineInfo{
+		{Serial: "abc", Product: "MacBook Pro"},
+		{Serial: "abc", Product: "MacBook Pro"},
+		{Serial: hosts[0].HardwareSerial, Product: "MacBook Pro"},
+		{Serial: "ijk", Product: "iPad13,16"},
+		{Serial: "tuv", Product: "iPhone14,6"},
+		{Serial: hosts[1].HardwareSerial, Product: "MacBook Pro"},
+		{Serial: "xyz", Product: "MacBook Pro"},
+		{Serial: "xyz", Product: "MacBook Pro"},
+		{Serial: "xyz", Product: "MacBook Pro"},
+	}
+	wantSerials = append(wantSerials, "abc", "xyz", "ijk", "tuv")
+
+	for _, d := range otaDevices {
+		err := ds.IngestMDMAppleDeviceFromOTAEnrollment(ctx, nil, d)
+		require.NoError(t, err)
+	}
+
+	hosts = listHostsCheckCount(t, ds, fleet.TeamFilter{User: test.UserAdmin}, fleet.HostListOptions{}, len(wantSerials))
+	gotSerials := []string{}
+	for _, h := range hosts {
+		gotSerials = append(gotSerials, h.HardwareSerial)
+
+		switch h.HardwareSerial {
+		case "abc", "xyz":
+			checkMDMHostRelatedTables(t, ds, h.ID, h.HardwareSerial, "MacBook Pro")
+		case "ijk":
+			checkMDMHostRelatedTables(t, ds, h.ID, h.HardwareSerial, "iPad13,16")
+		case "tuv":
+			checkMDMHostRelatedTables(t, ds, h.ID, h.HardwareSerial, "iPhone14,6")
+
+		}
+	}
+	require.ElementsMatch(t, wantSerials, gotSerials)
+}
+
+func TestGetMDMAppleOSUpdatesSettingsByHostSerial(t *testing.T) {
+	ds := CreateMySQLDS(t)
+	defer ds.Close()
+
+	keys := []string{"ios", "ipados", "macos"}
+	devicesByKey := map[string]godep.Device{
+		"ios":    {SerialNumber: "dep-serial-ios-updates", DeviceFamily: "iPhone"},
+		"ipados": {SerialNumber: "dep-serial-ipados-updates", DeviceFamily: "iPad"},
+		"macos":  {SerialNumber: "dep-serial-macos-updates", DeviceFamily: "Mac"},
+	}
+
+	getConfigSettings := func(teamID uint, key string) *fleet.AppleOSUpdateSettings {
+		var settings fleet.AppleOSUpdateSettings
+		ExecAdhocSQL(t, ds, func(q sqlx.ExtContext) error {
+			stmt := fmt.Sprintf(`SELECT json_value->'$.mdm.%s_updates' FROM app_config_json`, key)
+			if teamID > 0 {
+				stmt = fmt.Sprintf(`SELECT config->'$.mdm.%s_updates' FROM teams WHERE id = %d`, key, teamID)
+			}
+			var raw json.RawMessage
+			if err := sqlx.GetContext(context.Background(), q, &raw, stmt); err != nil {
+				return err
+			}
+			if err := json.Unmarshal(raw, &settings); err != nil {
+				return err
+			}
+			return nil
+		})
+		return &settings
+	}
+
+	setConfigSettings := func(teamID uint, key string, minVersion string) {
+		var mv *string
+		if minVersion != "" {
+			mv = &minVersion
+		}
+		ExecAdhocSQL(t, ds, func(q sqlx.ExtContext) error {
+			stmt := fmt.Sprintf(`UPDATE app_config_json SET json_value = JSON_SET(json_value, '$.mdm.%s_updates.minimum_version', ?)`, key)
+			if teamID > 0 {
+				stmt = fmt.Sprintf(`UPDATE teams SET config = JSON_SET(config, '$.mdm.%s_updates.minimum_version', ?) WHERE id = %d`, key, teamID)
+			}
+			if _, err := q.ExecContext(context.Background(), stmt, mv); err != nil {
+				return err
+			}
+			return nil
+		})
+	}
+
+	checkExpectedVersion := func(t *testing.T, gotSettings *fleet.AppleOSUpdateSettings, expectedVersion string) {
+		if expectedVersion == "" {
+			require.True(t, gotSettings.MinimumVersion.Set)
+			require.False(t, gotSettings.MinimumVersion.Valid)
+			require.Empty(t, gotSettings.MinimumVersion.Value)
+		} else {
+			require.True(t, gotSettings.MinimumVersion.Set)
+			require.True(t, gotSettings.MinimumVersion.Valid)
+			require.Equal(t, expectedVersion, gotSettings.MinimumVersion.Value)
+		}
+	}
+
+	checkDevice := func(t *testing.T, teamID uint, key string, wantVersion string) {
+		checkExpectedVersion(t, getConfigSettings(teamID, key), wantVersion)
+		gotSettings, err := ds.GetMDMAppleOSUpdatesSettingsByHostSerial(context.Background(), devicesByKey[key].SerialNumber)
+		require.NoError(t, err)
+		checkExpectedVersion(t, gotSettings, wantVersion)
+	}
+
+	// empty global settings to start
+	for _, key := range keys {
+		checkExpectedVersion(t, getConfigSettings(0, key), "")
+	}
+
+	encTok := uuid.NewString()
+	abmToken, err := ds.InsertABMToken(context.Background(), &fleet.ABMToken{OrganizationName: "unused", EncryptedToken: []byte(encTok)})
+	require.NoError(t, err)
+	require.NotEmpty(t, abmToken.ID)
+
+	// ingest some test devices
+	n, err := ds.IngestMDMAppleDevicesFromDEPSync(context.Background(), []godep.Device{devicesByKey["ios"], devicesByKey["ipados"], devicesByKey["macos"]}, abmToken.ID, nil, nil, nil)
+	require.NoError(t, err)
+	require.Equal(t, int64(3), n)
+	hostIDsByKey := map[string]uint{}
+	for key, device := range devicesByKey {
+		ExecAdhocSQL(t, ds, func(q sqlx.ExtContext) error {
+			var hid uint
+			err = sqlx.GetContext(context.Background(), q, &hid, "SELECT id FROM hosts WHERE hardware_serial = ?", device.SerialNumber)
+			require.NoError(t, err)
+			hostIDsByKey[key] = hid
+			return nil
+		})
+	}
+
+	// not set in global config, so devics should return empty
+	checkDevice(t, 0, "ios", "")
+	checkDevice(t, 0, "ipados", "")
+	checkDevice(t, 0, "macos", "")
+
+	// set the minimum version for ios
+	setConfigSettings(0, "ios", "17.1")
+	checkDevice(t, 0, "ios", "17.1")
+	checkDevice(t, 0, "ipados", "") // no change
+	checkDevice(t, 0, "macos", "")  // no change
+
+	// set the minimum version for ipados
+	setConfigSettings(0, "ipados", "17.2")
+	checkDevice(t, 0, "ios", "17.1") // no change
+	checkDevice(t, 0, "ipados", "17.2")
+	checkDevice(t, 0, "macos", "") // no change
+
+	// set the minimum version for macos
+	setConfigSettings(0, "macos", "14.5")
+	checkDevice(t, 0, "ios", "17.1")    // no change
+	checkDevice(t, 0, "ipados", "17.2") // no change
+	checkDevice(t, 0, "macos", "14.5")
+
+	// create a team
+	team, err := ds.NewTeam(context.Background(), &fleet.Team{Name: "team1"})
+	require.NoError(t, err)
+
+	// empty team settings to start
+	for _, key := range keys {
+		checkExpectedVersion(t, getConfigSettings(team.ID, key), "")
+	}
+
+	// transfer ios and ipados to the team
+	err = ds.AddHostsToTeam(context.Background(), &team.ID, []uint{hostIDsByKey["ios"], hostIDsByKey["ipados"]})
+	require.NoError(t, err)
+
+	checkDevice(t, team.ID, "ios", "")    // team settings are empty to start
+	checkDevice(t, team.ID, "ipados", "") // team settings are empty to start
+	checkDevice(t, 0, "macos", "14.5")    // no change, still global
+
+	setConfigSettings(team.ID, "ios", "17.3")
+	checkDevice(t, team.ID, "ios", "17.3") // team settings are set for ios
+	checkDevice(t, team.ID, "ipados", "")  // team settings are empty for ipados
+	checkDevice(t, 0, "macos", "14.5")     // no change, still global
+
+	setConfigSettings(team.ID, "ipados", "17.4")
+	checkDevice(t, team.ID, "ios", "17.3")    // no change in team settings for ios
+	checkDevice(t, team.ID, "ipados", "17.4") // team settings are set for ipados
+	checkDevice(t, 0, "macos", "14.5")        // no change, still global
+
+	// transfer macos to the team
+	err = ds.AddHostsToTeam(context.Background(), &team.ID, []uint{hostIDsByKey["macos"]})
+	require.NoError(t, err)
+	checkDevice(t, team.ID, "macos", "") // team settings are empty for macos
+
+	setConfigSettings(team.ID, "macos", "14.6")
+	checkDevice(t, team.ID, "macos", "14.6") // team settings are set for macos
+
+	// create a non-DEP host
+	_, err = ds.NewHost(context.Background(), &fleet.Host{
+		OsqueryHostID:  ptr.String("non-dep-osquery-id"),
+		NodeKey:        ptr.String("non-dep-node-key"),
+		UUID:           "non-dep-uuid",
+		Hostname:       "non-dep-hostname",
+		Platform:       "macos",
+		HardwareSerial: "non-dep-serial",
+	})
+
+	// non-DEP host should return not found
+	_, err = ds.GetMDMAppleOSUpdatesSettingsByHostSerial(context.Background(), "non-dep-serial")
+	require.ErrorIs(t, err, sql.ErrNoRows)
+
+	// deleted DEP host should return not found
+	ExecAdhocSQL(t, ds, func(q sqlx.ExtContext) error {
+		_, err := q.ExecContext(context.Background(), "UPDATE host_dep_assignments SET deleted_at = NOW() WHERE host_id = ?", hostIDsByKey["macos"])
+		return err
+	})
+	_, err = ds.GetMDMAppleOSUpdatesSettingsByHostSerial(context.Background(), devicesByKey["macos"].SerialNumber)
+	require.ErrorIs(t, err, sql.ErrNoRows)
+}
diff --git a/server/datastore/mysql/calendar_events.go b/server/datastore/mysql/calendar_events.go
index af8200b2b0..21004cf83a 100644
--- a/server/datastore/mysql/calendar_events.go
+++ b/server/datastore/mysql/calendar_events.go
@@ -64,7 +64,7 @@ func (ds *Datastore) CreateOrUpdateCalendarEvent(
 			return ctxerr.Wrap(ctx, err, "insert calendar event")
 		}
 
-		if insertOnDuplicateDidInsert(result) {
+		if insertOnDuplicateDidInsertOrUpdate(result) {
 			id, _ = result.LastInsertId()
 		} else {
 			stmt := `SELECT id FROM calendar_events WHERE email = ?`
diff --git a/server/datastore/mysql/errors.go b/server/datastore/mysql/errors.go
index 673a4701fc..fa9bbac282 100644
--- a/server/datastore/mysql/errors.go
+++ b/server/datastore/mysql/errors.go
@@ -191,6 +191,12 @@ func isMySQLAccessDenied(err error) bool {
 	return false
 }
 
+func isMySQLUnknownStatement(err error) bool {
+	err = ctxerr.Cause(err)
+	var mySQLErr *mysql.MySQLError
+	return errors.As(err, &mySQLErr) && (mySQLErr.Number == mysqlerr.ER_UNKNOWN_STMT_HANDLER)
+}
+
 // ErrPartialResult indicates that a batch operation was completed,
 // but some of the results are missing or incomplete.
 var ErrPartialResult = errors.New("batch operation completed with partial results")
diff --git a/server/datastore/mysql/hosts.go b/server/datastore/mysql/hosts.go
index fb4b88f077..0b3a0e4983 100644
--- a/server/datastore/mysql/hosts.go
+++ b/server/datastore/mysql/hosts.go
@@ -1042,7 +1042,7 @@ func (ds *Datastore) applyHostFilters(
 			meta, err := ds.GetSoftwareInstallerMetadataByTeamAndTitleID(ctx, opt.TeamFilter, *opt.SoftwareTitleIDFilter, false)
 			switch {
 			case fleet.IsNotFound(err):
-				vppApp, err := ds.GetVPPAppByTeamAndTitleID(ctx, opt.TeamFilter, *opt.SoftwareTitleIDFilter, false)
+				vppApp, err := ds.GetVPPAppByTeamAndTitleID(ctx, opt.TeamFilter, *opt.SoftwareTitleIDFilter)
 				if err != nil {
 					return "", nil, ctxerr.Wrap(ctx, err, "get vpp app by team and title id")
 				}
@@ -2147,14 +2147,27 @@ func (ds *Datastore) EnrollHost(ctx context.Context, isMDMEnabled bool, osqueryH
 // to update their MySQL configurations when additional prepare statements are added.
 // For more detail, see: https://github.com/fleetdm/fleet/issues/15476
 func (ds *Datastore) getContextTryStmt(ctx context.Context, dest interface{}, query string, args ...interface{}) error {
-	var err error
 	// nolint the statements are closed in Datastore.Close.
 	if stmt := ds.loadOrPrepareStmt(ctx, query); stmt != nil {
-		err = stmt.GetContext(ctx, dest, args...)
-	} else {
-		err = sqlx.GetContext(ctx, ds.reader(ctx), dest, query, args...)
+		err := stmt.GetContext(ctx, dest, args...)
+		if err == nil || !isMySQLUnknownStatement(err) {
+			return err
+		}
+
+		// if the statement is unknown to the MySQL server, delete it
+		// from the cache and fallback to the regular statement call
+		// bellow. This function will get called again eventually and
+		// we will store a new prepared statement in the cache.
+		//
+		// - see https://github.com/fleetdm/fleet/issues/20781 for an
+		// example of when this can happen.
+		//
+		// - see https://github.com/go-sql-driver/mysql/issues/1555 for
+		// a related open bug in the driver
+		ds.deleteCachedStmt(query)
 	}
-	return err
+
+	return sqlx.GetContext(ctx, ds.reader(ctx), dest, query, args...)
 }
 
 // LoadHostByNodeKey loads the whole host identified by the node key.
@@ -2961,7 +2974,7 @@ func (ds *Datastore) ListPoliciesForHost(ctx context.Context, host *fleet.Host)
 	FROM policies p
 	LEFT JOIN policy_membership pm ON (p.id=pm.policy_id AND host_id=?)
 	LEFT JOIN users u ON p.author_id = u.id
-	WHERE (p.team_id IS NULL OR p.team_id = (select team_id from hosts WHERE id = ?))
+	WHERE (p.team_id IS NULL OR p.team_id = COALESCE((SELECT team_id FROM hosts WHERE id = ?), 0))
 	AND (p.platforms IS NULL OR p.platforms = '' OR FIND_IN_SET(?, p.platforms) != 0)
 	ORDER BY FIELD(response, 'fail', '', 'pass'), p.name`
 
@@ -3642,6 +3655,18 @@ func (ds *Datastore) SetOrUpdateMDMData(
 	)
 }
 
+func (ds *Datastore) UpdateMDMData(
+	ctx context.Context,
+	hostID uint,
+	enrolled bool,
+) error {
+	_, err := ds.writer(ctx).ExecContext(ctx, `UPDATE host_mdm SET enrolled = ? WHERE host_id = ?`, enrolled, hostID)
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "update host_mdm.enrolled")
+	}
+	return nil
+}
+
 func (ds *Datastore) SetOrUpdateHostEmailsFromMdmIdpAccounts(
 	ctx context.Context,
 	hostID uint,
@@ -5022,6 +5047,18 @@ func amountHostsByOsqueryVersionDB(ctx context.Context, db sqlx.QueryerContext)
 	return counts, nil
 }
 
+func numHostsFleetDesktopEnabledDB(ctx context.Context, db sqlx.QueryerContext) (int, error) {
+	var count int
+	const stmt = `
+		SELECT count(*) FROM host_orbit_info WHERE desktop_version IS NOT NULL
+  	`
+	if err := sqlx.GetContext(ctx, db, &count, stmt); err != nil {
+		return 0, err
+	}
+
+	return count, nil
+}
+
 func (ds *Datastore) GetMatchingHostSerials(ctx context.Context, serials []string) (map[string]*fleet.Host, error) {
 	result := map[string]*fleet.Host{}
 	if len(serials) == 0 {
diff --git a/server/datastore/mysql/hosts_test.go b/server/datastore/mysql/hosts_test.go
index 379adf166d..2edc5ab393 100644
--- a/server/datastore/mysql/hosts_test.go
+++ b/server/datastore/mysql/hosts_test.go
@@ -1245,13 +1245,17 @@ func testHostsListMDM(t *testing.T, ds *Datastore) {
 		hostIDs = append(hostIDs, h.ID)
 	}
 
+	encTok := uuid.NewString()
+	abmToken, err := ds.InsertABMToken(ctx, &fleet.ABMToken{OrganizationName: "unused", EncryptedToken: []byte(encTok)})
+	require.NoError(t, err)
+	require.NotEmpty(t, abmToken.ID)
+
 	// enrollment: pending (with Fleet mdm)
-	n, tmID, err := ds.IngestMDMAppleDevicesFromDEPSync(ctx, []godep.Device{
+	n, err := ds.IngestMDMAppleDevicesFromDEPSync(ctx, []godep.Device{
 		{SerialNumber: "532141num832", Model: "MacBook Pro", OS: "OSX", OpType: "added"},
-	})
+	}, abmToken.ID, nil, nil, nil)
 	require.NoError(t, err)
 	require.Equal(t, int64(1), n)
-	require.Nil(t, tmID)
 
 	const simpleMDM, kandji, unknown = "https://simplemdm.com", "https://kandji.io", "https://url.com"
 	err = ds.SetOrUpdateMDMData(ctx, hostIDs[0], false, true, simpleMDM, true, fleet.WellKnownMDMSimpleMDM, "") // enrollment: automatic
@@ -6683,7 +6687,7 @@ func testHostsDeleteHosts(t *testing.T, ds *Datastore) {
 		Sha256: sha256.New().Sum(nil),
 		Bytes:  []byte("content"),
 		Token:  uuid.New().String(),
-	})
+	}, nil)
 	require.NoError(t, err)
 	err = ds.RecordHostBootstrapPackage(context.Background(), "command-uuid", host.UUID)
 	require.NoError(t, err)
@@ -6747,6 +6751,7 @@ func testHostsDeleteHosts(t *testing.T, ds *Datastore) {
 		InstallScript:   "",
 		PreInstallQuery: "",
 		Title:           "ChocolateRain",
+		UserID:          user1.ID,
 	})
 	require.NoError(t, err)
 	_, err = ds.InsertSoftwareInstallRequest(context.Background(), host.ID, softwareInstaller, false)
@@ -7555,6 +7560,11 @@ func testHostsGetHostMDMCheckinInfo(t *testing.T, ds *Datastore) {
 	})
 	require.NoError(t, err)
 
+	encTok := uuid.NewString()
+	abmToken, err := ds.InsertABMToken(ctx, &fleet.ABMToken{OrganizationName: "unused", EncryptedToken: []byte(encTok)})
+	require.NoError(t, err)
+	require.NotEmpty(t, abmToken.ID)
+
 	host, err := ds.NewHost(context.Background(), &fleet.Host{
 		DetailUpdatedAt: time.Now(),
 		LabelUpdatedAt:  time.Now(),
@@ -7583,7 +7593,7 @@ func testHostsGetHostMDMCheckinInfo(t *testing.T, ds *Datastore) {
 	require.True(t, info.OsqueryEnrolled)
 	require.Equal(t, "darwin", info.Platform)
 
-	err = ds.UpsertMDMAppleHostDEPAssignments(ctx, []fleet.Host{*host})
+	err = ds.UpsertMDMAppleHostDEPAssignments(ctx, []fleet.Host{*host}, abmToken.ID)
 	require.NoError(t, err)
 	info, err = ds.GetHostMDMCheckinInfo(ctx, host.UUID)
 	require.NoError(t, err)
@@ -7610,6 +7620,11 @@ func testHostsGetHostMDMCheckinInfo(t *testing.T, ds *Datastore) {
 func testHostsLoadHostByOrbitNodeKey(t *testing.T, ds *Datastore) {
 	ctx := context.Background()
 
+	encTok := uuid.NewString()
+	abmToken, err := ds.InsertABMToken(ctx, &fleet.ABMToken{OrganizationName: "unused", EncryptedToken: []byte(encTok)})
+	require.NoError(t, err)
+	require.NotEmpty(t, abmToken.ID)
+
 	for _, tt := range enrollTests {
 		h, err := ds.EnrollHost(ctx, false, tt.uuid, tt.uuid, "", tt.nodeKey, nil, 0)
 		require.NoError(t, err)
@@ -7636,7 +7651,7 @@ func testHostsLoadHostByOrbitNodeKey(t *testing.T, ds *Datastore) {
 	}
 
 	// test loading an unknown orbit key
-	_, err := ds.LoadHostByOrbitNodeKey(ctx, uuid.New().String())
+	_, err = ds.LoadHostByOrbitNodeKey(ctx, uuid.New().String())
 	require.Error(t, err)
 	require.True(t, fleet.IsNotFound(err))
 
@@ -7710,7 +7725,7 @@ func testHostsLoadHostByOrbitNodeKey(t *testing.T, ds *Datastore) {
 	require.True(t, *loadFleet.DiskEncryptionEnabled)
 
 	// simulate the device being assigned to Fleet in ABM
-	err = ds.UpsertMDMAppleHostDEPAssignments(ctx, []fleet.Host{*hFleet})
+	err = ds.UpsertMDMAppleHostDEPAssignments(ctx, []fleet.Host{*hFleet}, abmToken.ID)
 	require.NoError(t, err)
 	loadFleet, err = ds.LoadHostByOrbitNodeKey(ctx, *hFleet.OrbitNodeKey)
 	require.NoError(t, err)
diff --git a/server/datastore/mysql/labels.go b/server/datastore/mysql/labels.go
index 2f654ebe33..d604b286a4 100644
--- a/server/datastore/mysql/labels.go
+++ b/server/datastore/mysql/labels.go
@@ -227,6 +227,14 @@ func (ds *Datastore) SaveLabel(ctx context.Context, label *fleet.Label, teamFilt
 	if err != nil {
 		return nil, nil, ctxerr.Wrap(ctx, err, "saving label")
 	}
+
+	// Update the label name in mdm_configuration_profile_labels
+	query = `UPDATE mdm_configuration_profile_labels SET label_name = ? WHERE label_id = ?`
+	_, err = ds.writer(ctx).ExecContext(ctx, query, label.Name, label.ID)
+	if err != nil {
+		return nil, nil, ctxerr.Wrap(ctx, err, "updating mdm configuration profile label")
+	}
+
 	return ds.labelDB(ctx, label.ID, teamFilter, ds.writer(ctx))
 }
 
diff --git a/server/datastore/mysql/labels_test.go b/server/datastore/mysql/labels_test.go
index 17d97278cd..ca01edfdda 100644
--- a/server/datastore/mysql/labels_test.go
+++ b/server/datastore/mysql/labels_test.go
@@ -673,6 +673,31 @@ func testLabelsChangeDetails(t *testing.T, db *Datastore) {
 	saved, _, err := db.Label(context.Background(), label.ID, filter)
 	require.Nil(t, err)
 	assert.Equal(t, label.Name, saved.Name)
+	assert.Equal(t, label.Description, saved.Description)
+
+	// Create an Apple config profile, which should reflect a change in label's name
+	profA, err := db.NewMDMAppleConfigProfile(context.Background(), *generateCP("a", "a", 0))
+	require.NoError(t, err)
+	ExecAdhocSQL(t, db, func(q sqlx.ExtContext) error {
+		_, err := q.ExecContext(context.Background(),
+			"INSERT INTO mdm_configuration_profile_labels (apple_profile_uuid, label_name, label_id) VALUES (?, ?, ?)",
+			profA.ProfileUUID, label.Name, label.ID)
+		return err
+	})
+	label.Name = "changed name"
+	// ApplyLabelSpecs can't update the name -- it simply creates a new label, so we need to call SaveLabel.
+	saved.Name = label.Name
+	saved2, _, err := db.SaveLabel(context.Background(), saved, filter)
+	require.NoError(t, err)
+	assert.Equal(t, label.Name, saved2.Name)
+	assert.Equal(t, label.Description, saved2.Description)
+
+	var configProfileLabelName string
+	ExecAdhocSQL(t, db, func(q sqlx.ExtContext) error {
+		return sqlx.GetContext(context.Background(), q, &configProfileLabelName,
+			"SELECT label_name FROM mdm_configuration_profile_labels WHERE label_id = ?", label.ID)
+	})
+	assert.Equal(t, label.Name, configProfileLabelName)
 }
 
 func setupLabelSpecsTest(t *testing.T, ds fleet.Datastore) []*fleet.LabelSpec {
@@ -806,6 +831,17 @@ func testLabelsSave(t *testing.T, db *Datastore) {
 	}
 	label, err = db.NewLabel(context.Background(), label)
 	require.NoError(t, err)
+
+	// Create an Apple config profile
+	profA, err := db.NewMDMAppleConfigProfile(context.Background(), *generateCP("a", "a", 0))
+	require.NoError(t, err)
+	ExecAdhocSQL(t, db, func(q sqlx.ExtContext) error {
+		_, err := q.ExecContext(context.Background(),
+			"INSERT INTO mdm_configuration_profile_labels (apple_profile_uuid, label_name, label_id) VALUES (?, ?, ?)",
+			profA.ProfileUUID, label.Name, label.ID)
+		return err
+	})
+
 	label.Name = "changed name"
 	label.Description = "changed description"
 
@@ -819,6 +855,13 @@ func testLabelsSave(t *testing.T, db *Datastore) {
 	assert.Equal(t, label.Name, saved.Name)
 	assert.Equal(t, label.Description, saved.Description)
 	assert.Equal(t, 1, saved.HostCount)
+
+	var configProfileLabelName string
+	ExecAdhocSQL(t, db, func(q sqlx.ExtContext) error {
+		return sqlx.GetContext(context.Background(), q, &configProfileLabelName,
+			"SELECT label_name FROM mdm_configuration_profile_labels WHERE label_id = ?", label.ID)
+	})
+	assert.Equal(t, label.Name, configProfileLabelName)
 }
 
 func testLabelsQueriesForCentOSHost(t *testing.T, db *Datastore) {
diff --git a/server/datastore/mysql/mdm.go b/server/datastore/mysql/mdm.go
index eefce6091d..d3bbba82de 100644
--- a/server/datastore/mysql/mdm.go
+++ b/server/datastore/mysql/mdm.go
@@ -13,6 +13,7 @@ import (
 	"github.com/fleetdm/fleet/v4/server/mdm/apple/mobileconfig"
 	microsoft_mdm "github.com/fleetdm/fleet/v4/server/mdm/microsoft"
 	"github.com/go-kit/log/level"
+	"github.com/google/go-cmp/cmp"
 	"github.com/jmoiron/sqlx"
 )
 
@@ -121,22 +122,26 @@ func (ds *Datastore) getMDMCommand(ctx context.Context, q sqlx.QueryerContext, c
 	return &cmd, nil
 }
 
-func (ds *Datastore) BatchSetMDMProfiles(ctx context.Context, tmID *uint, macProfiles []*fleet.MDMAppleConfigProfile, winProfiles []*fleet.MDMWindowsConfigProfile, macDeclarations []*fleet.MDMAppleDeclaration) error {
-	return ds.withRetryTxx(ctx, func(tx sqlx.ExtContext) error {
-		if err := ds.batchSetMDMWindowsProfilesDB(ctx, tx, tmID, winProfiles); err != nil {
+func (ds *Datastore) BatchSetMDMProfiles(ctx context.Context, tmID *uint, macProfiles []*fleet.MDMAppleConfigProfile,
+	winProfiles []*fleet.MDMWindowsConfigProfile, macDeclarations []*fleet.MDMAppleDeclaration) (updates fleet.MDMProfilesUpdates,
+	err error) {
+	err = ds.withRetryTxx(ctx, func(tx sqlx.ExtContext) error {
+		var err error
+		if updates.WindowsConfigProfile, err = ds.batchSetMDMWindowsProfilesDB(ctx, tx, tmID, winProfiles); err != nil {
 			return ctxerr.Wrap(ctx, err, "batch set windows profiles")
 		}
 
-		if err := ds.batchSetMDMAppleProfilesDB(ctx, tx, tmID, macProfiles); err != nil {
+		if updates.AppleConfigProfile, err = ds.batchSetMDMAppleProfilesDB(ctx, tx, tmID, macProfiles); err != nil {
 			return ctxerr.Wrap(ctx, err, "batch set apple profiles")
 		}
 
-		if _, err := ds.batchSetMDMAppleDeclarations(ctx, tx, tmID, macDeclarations); err != nil {
+		if _, updates.AppleDeclaration, err = ds.batchSetMDMAppleDeclarations(ctx, tx, tmID, macDeclarations); err != nil {
 			return ctxerr.Wrap(ctx, err, "batch set apple declarations")
 		}
 
 		return nil
 	})
+	return updates, err
 }
 
 func (ds *Datastore) ListMDMConfigProfiles(ctx context.Context, teamID *uint, opt fleet.ListOptions) ([]*fleet.MDMConfigProfilePayload, *fleet.PaginationMetadata, error) {
@@ -335,10 +340,12 @@ func (ds *Datastore) BulkSetPendingMDMHostProfiles(
 	ctx context.Context,
 	hostIDs, teamIDs []uint,
 	profileUUIDs, hostUUIDs []string,
-) error {
-	return ds.withRetryTxx(ctx, func(tx sqlx.ExtContext) error {
-		return ds.bulkSetPendingMDMHostProfilesDB(ctx, tx, hostIDs, teamIDs, profileUUIDs, hostUUIDs)
+) (updates fleet.MDMProfilesUpdates, err error) {
+	err = ds.withRetryTxx(ctx, func(tx sqlx.ExtContext) error {
+		updates, err = ds.bulkSetPendingMDMHostProfilesDB(ctx, tx, hostIDs, teamIDs, profileUUIDs, hostUUIDs)
+		return err
 	})
+	return updates, err
 }
 
 // Note that team ID 0 is used for profiles that apply to hosts in no team
@@ -349,7 +356,7 @@ func (ds *Datastore) bulkSetPendingMDMHostProfilesDB(
 	tx sqlx.ExtContext,
 	hostIDs, teamIDs []uint,
 	profileUUIDs, hostUUIDs []string,
-) error {
+) (updates fleet.MDMProfilesUpdates, err error) {
 	var (
 		countArgs     int
 		macProfUUIDs  []string
@@ -384,10 +391,10 @@ func (ds *Datastore) bulkSetPendingMDMHostProfilesDB(
 		countArgs++
 	}
 	if countArgs > 1 {
-		return errors.New("only one of hostIDs, teamIDs, profileUUIDs or hostUUIDs can be provided")
+		return updates, errors.New("only one of hostIDs, teamIDs, profileUUIDs or hostUUIDs can be provided")
 	}
 	if countArgs == 0 {
-		return nil
+		return updates, nil
 	}
 
 	var countProfUUIDs int
@@ -401,7 +408,7 @@ func (ds *Datastore) bulkSetPendingMDMHostProfilesDB(
 		countProfUUIDs++
 	}
 	if countProfUUIDs > 1 {
-		return errors.New("profile uuids must be all Apple profiles, all Apple declarations, or all Windows profiles")
+		return updates, errors.New("profile uuids must be all Apple profiles, all Apple declarations, or all Windows profiles")
 	}
 
 	var (
@@ -471,10 +478,10 @@ WHERE
 	if len(hosts) == 0 && !hasAppleDecls {
 		uuidStmt, args, err := sqlx.In(uuidStmt, args...)
 		if err != nil {
-			return ctxerr.Wrap(ctx, err, "prepare query to load host UUIDs")
+			return updates, ctxerr.Wrap(ctx, err, "prepare query to load host UUIDs")
 		}
 		if err := sqlx.SelectContext(ctx, tx, &hosts, uuidStmt, args...); err != nil {
-			return ctxerr.Wrap(ctx, err, "execute query to load host UUIDs")
+			return updates, ctxerr.Wrap(ctx, err, "execute query to load host UUIDs")
 		}
 	}
 
@@ -495,12 +502,14 @@ WHERE
 		}
 	}
 
-	if err := ds.bulkSetPendingMDMAppleHostProfilesDB(ctx, tx, appleHosts); err != nil {
-		return ctxerr.Wrap(ctx, err, "bulk set pending apple host profiles")
+	updates.AppleConfigProfile, err = ds.bulkSetPendingMDMAppleHostProfilesDB(ctx, tx, appleHosts)
+	if err != nil {
+		return updates, ctxerr.Wrap(ctx, err, "bulk set pending apple host profiles")
 	}
 
-	if err := ds.bulkSetPendingMDMWindowsHostProfilesDB(ctx, tx, winHosts); err != nil {
-		return ctxerr.Wrap(ctx, err, "bulk set pending windows host profiles")
+	updates.WindowsConfigProfile, err = ds.bulkSetPendingMDMWindowsHostProfilesDB(ctx, tx, winHosts)
+	if err != nil {
+		return updates, ctxerr.Wrap(ctx, err, "bulk set pending windows host profiles")
 	}
 
 	const defaultBatchSize = 1000
@@ -513,11 +522,12 @@ WHERE
 	// (and my hunch is that we could even do the same for
 	// profiles) but this could be optimized to use only a provided
 	// set of host uuids.
-	if _, err := mdmAppleBatchSetHostDeclarationStateDB(ctx, tx, batchSize, nil); err != nil {
-		return ctxerr.Wrap(ctx, err, "bulk set pending apple declarations")
+	_, updates.AppleDeclaration, err = mdmAppleBatchSetHostDeclarationStateDB(ctx, tx, batchSize, nil)
+	if err != nil {
+		return updates, ctxerr.Wrap(ctx, err, "bulk set pending apple declarations")
 	}
 
-	return nil
+	return updates, nil
 }
 
 func (ds *Datastore) UpdateHostMDMProfilesVerification(ctx context.Context, host *fleet.Host, toVerify, toFail, toRetry []string) error {
@@ -984,9 +994,9 @@ func batchSetProfileLabelAssociationsDB(
 	tx sqlx.ExtContext,
 	profileLabels []fleet.ConfigurationProfileLabel,
 	platform string,
-) error {
+) (updatedDB bool, err error) {
 	if len(profileLabels) == 0 {
-		return nil
+		return false, nil
 	}
 
 	var platformPrefix string
@@ -1001,7 +1011,7 @@ func batchSetProfileLabelAssociationsDB(
 	case "windows":
 		platformPrefix = "windows"
 	default:
-		return fmt.Errorf("unsupported platform %s", platform)
+		return false, fmt.Errorf("unsupported platform %s", platform)
 	}
 
 	// delete any profile+label tuple that is NOT in the list of provided tuples
@@ -1023,38 +1033,72 @@ func batchSetProfileLabelAssociationsDB(
               exclude = VALUES(exclude)
 	`
 
+	selectStmt := `
+		SELECT %s_profile_uuid as profile_uuid, label_id, label_name, exclude FROM mdm_configuration_profile_labels
+		WHERE (%s_profile_uuid, label_name) IN (%s)
+	`
+
 	var (
-		insertBuilder strings.Builder
-		deleteBuilder strings.Builder
-		insertParams  []any
-		deleteParams  []any
+		insertBuilder         strings.Builder
+		selectOrDeleteBuilder strings.Builder
+		selectParams          []any
+		insertParams          []any
+		deleteParams          []any
 
 		setProfileUUIDs = make(map[string]struct{})
 	)
+	labelsToInsert := make(map[string]*fleet.ConfigurationProfileLabel, len(profileLabels))
 	for i, pl := range profileLabels {
+		labelsToInsert[fmt.Sprintf("%s\n%s", pl.ProfileUUID, pl.LabelName)] = &profileLabels[i]
 		if i > 0 {
 			insertBuilder.WriteString(",")
-			deleteBuilder.WriteString(",")
+			selectOrDeleteBuilder.WriteString(",")
 		}
 		insertBuilder.WriteString("(?, ?, ?, ?)")
-		deleteBuilder.WriteString("(?, ?)")
+		selectOrDeleteBuilder.WriteString("(?, ?)")
+		selectParams = append(selectParams, pl.ProfileUUID, pl.LabelName)
 		insertParams = append(insertParams, pl.ProfileUUID, pl.LabelID, pl.LabelName, pl.Exclude)
 		deleteParams = append(deleteParams, pl.ProfileUUID, pl.LabelID)
 
 		setProfileUUIDs[pl.ProfileUUID] = struct{}{}
 	}
 
-	_, err := tx.ExecContext(ctx, fmt.Sprintf(upsertStmt, platformPrefix, insertBuilder.String()), insertParams...)
+	// Determine if we need to update the database
+	var existingProfileLabels []fleet.ConfigurationProfileLabel
+	err = sqlx.SelectContext(ctx, tx, &existingProfileLabels,
+		fmt.Sprintf(selectStmt, platformPrefix, platformPrefix, selectOrDeleteBuilder.String()), selectParams...)
 	if err != nil {
-		if isChildForeignKeyError(err) {
-			// one of the provided labels doesn't exist
-			return foreignKey("mdm_configuration_profile_labels", fmt.Sprintf("(profile, label)=(%v)", insertParams))
-		}
-
-		return ctxerr.Wrap(ctx, err, "setting label associations for profile")
+		return false, ctxerr.Wrap(ctx, err, "selecting existing profile labels")
 	}
 
-	deleteStmt = fmt.Sprintf(deleteStmt, platformPrefix, deleteBuilder.String(), platformPrefix)
+	updateNeeded := false
+	if len(existingProfileLabels) == len(labelsToInsert) {
+		for _, existing := range existingProfileLabels {
+			toInsert, ok := labelsToInsert[fmt.Sprintf("%s\n%s", existing.ProfileUUID, existing.LabelName)]
+			// The fleet.ConfigurationProfileLabel struct has no pointers, so we can use standard cmp.Equal
+			if !ok || !cmp.Equal(existing, *toInsert) {
+				updateNeeded = true
+				break
+			}
+		}
+	} else {
+		updateNeeded = true
+	}
+
+	if updateNeeded {
+		_, err := tx.ExecContext(ctx, fmt.Sprintf(upsertStmt, platformPrefix, insertBuilder.String()), insertParams...)
+		if err != nil {
+			if isChildForeignKeyError(err) {
+				// one of the provided labels doesn't exist
+				return false, foreignKey("mdm_configuration_profile_labels", fmt.Sprintf("(profile, label)=(%v)", insertParams))
+			}
+
+			return false, ctxerr.Wrap(ctx, err, "setting label associations for profile")
+		}
+		updatedDB = true
+	}
+
+	deleteStmt = fmt.Sprintf(deleteStmt, platformPrefix, selectOrDeleteBuilder.String(), platformPrefix)
 
 	profUUIDs := make([]string, 0, len(setProfileUUIDs))
 	for k := range setProfileUUIDs {
@@ -1064,13 +1108,18 @@ func batchSetProfileLabelAssociationsDB(
 
 	deleteStmt, args, err := sqlx.In(deleteStmt, deleteArgs...)
 	if err != nil {
-		return ctxerr.Wrap(ctx, err, "sqlx.In delete labels for profiles")
+		return false, ctxerr.Wrap(ctx, err, "sqlx.In delete labels for profiles")
 	}
-	if _, err := tx.ExecContext(ctx, deleteStmt, args...); err != nil {
-		return ctxerr.Wrap(ctx, err, "deleting labels for profiles")
+	var result sql.Result
+	if result, err = tx.ExecContext(ctx, deleteStmt, args...); err != nil {
+		return false, ctxerr.Wrap(ctx, err, "deleting labels for profiles")
+	}
+	if result != nil {
+		rows, _ := result.RowsAffected()
+		updatedDB = updatedDB || rows > 0
 	}
 
-	return nil
+	return updatedDB, nil
 }
 
 func (ds *Datastore) MDMGetEULAMetadata(ctx context.Context) (*fleet.MDMEULA, error) {
diff --git a/server/datastore/mysql/mdm_test.go b/server/datastore/mysql/mdm_test.go
index 2f0d294121..a8d765baca 100644
--- a/server/datastore/mysql/mdm_test.go
+++ b/server/datastore/mysql/mdm_test.go
@@ -21,6 +21,7 @@ import (
 	"github.com/fleetdm/fleet/v4/server/test"
 	"github.com/google/uuid"
 	"github.com/jmoiron/sqlx"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -358,13 +359,15 @@ func testBatchSetMDMProfiles(t *testing.T, ds *Datastore) {
 		wantApple []*fleet.MDMAppleConfigProfile,
 		wantWindows []*fleet.MDMWindowsConfigProfile,
 		wantAppleDecl []*fleet.MDMAppleDeclaration,
+		wantUpdates fleet.MDMProfilesUpdates,
 	) {
 		ctx := context.Background()
-		err := ds.BatchSetMDMProfiles(ctx, tmID, newAppleSet, newWindowsSet, newAppleDeclSet)
+		updates, err := ds.BatchSetMDMProfiles(ctx, tmID, newAppleSet, newWindowsSet, newAppleDeclSet)
 		require.NoError(t, err)
 		expectAppleProfiles(t, ds, tmID, wantApple)
 		expectWindowsProfiles(t, ds, tmID, wantWindows)
 		expectAppleDeclarations(t, ds, tmID, wantAppleDecl)
+		assert.Equal(t, wantUpdates, updates)
 	}
 
 	withTeamIDApple := func(p *fleet.MDMAppleConfigProfile, tmID uint) *fleet.MDMAppleConfigProfile {
@@ -383,7 +386,7 @@ func testBatchSetMDMProfiles(t *testing.T, ds *Datastore) {
 	}
 
 	// empty set for no team (both Apple and Windows)
-	applyAndExpect(nil, nil, nil, nil, nil, nil, nil)
+	applyAndExpect(nil, nil, nil, nil, nil, nil, nil, fleet.MDMProfilesUpdates{})
 
 	// single Apple and Windows profile set for a specific team
 	applyAndExpect(
@@ -398,6 +401,7 @@ func testBatchSetMDMProfiles(t *testing.T, ds *Datastore) {
 			withTeamIDWindows(windowsConfigProfileForTest(t, "W1", "l1"), 1),
 		},
 		[]*fleet.MDMAppleDeclaration{withTeamIDDecl(declForTest("D1", "D1", "foo"), 1)},
+		fleet.MDMProfilesUpdates{AppleConfigProfile: true, WindowsConfigProfile: true, AppleDeclaration: true},
 	)
 
 	// single Apple and Windows profile set for no team
@@ -409,6 +413,7 @@ func testBatchSetMDMProfiles(t *testing.T, ds *Datastore) {
 		[]*fleet.MDMAppleConfigProfile{configProfileForTest(t, "N1", "I1", "a")},
 		[]*fleet.MDMWindowsConfigProfile{windowsConfigProfileForTest(t, "W1", "l1")},
 		[]*fleet.MDMAppleDeclaration{declForTest("D1", "D1", "foo")},
+		fleet.MDMProfilesUpdates{AppleConfigProfile: true, WindowsConfigProfile: true, AppleDeclaration: true},
 	)
 
 	// new Apple and Windows profile sets for a specific team
@@ -438,6 +443,7 @@ func testBatchSetMDMProfiles(t *testing.T, ds *Datastore) {
 			withTeamIDDecl(declForTest("D1", "D1", "foo"), 1),
 			withTeamIDDecl(declForTest("D2", "D2", "foo"), 1),
 		},
+		fleet.MDMProfilesUpdates{AppleConfigProfile: true, WindowsConfigProfile: true, AppleDeclaration: true},
 	)
 
 	// edited profiles, unchanged profiles, and new profiles for a specific team
@@ -473,6 +479,7 @@ func testBatchSetMDMProfiles(t *testing.T, ds *Datastore) {
 			withTeamIDDecl(declForTest("D2", "D2", "foo"), 1),
 			withTeamIDDecl(declForTest("D3", "D3", "bar"), 1),
 		},
+		fleet.MDMProfilesUpdates{AppleConfigProfile: true, WindowsConfigProfile: true, AppleDeclaration: true},
 	)
 
 	// new Apple and Windows profiles to no team
@@ -502,10 +509,43 @@ func testBatchSetMDMProfiles(t *testing.T, ds *Datastore) {
 			declForTest("D5", "D4", "foo"),
 			declForTest("D4", "D5", "foo"),
 		},
+		fleet.MDMProfilesUpdates{AppleConfigProfile: true, WindowsConfigProfile: true, AppleDeclaration: true},
+	)
+
+	// Apply the same profiles again -- no update should be detected
+	applyAndExpect(
+		[]*fleet.MDMAppleConfigProfile{
+			configProfileForTest(t, "N4", "I4", "d"),
+			configProfileForTest(t, "N5", "I5", "e"),
+		},
+		[]*fleet.MDMWindowsConfigProfile{
+			windowsConfigProfileForTest(t, "W4", "l4"),
+			windowsConfigProfileForTest(t, "W5", "l5"),
+		},
+		[]*fleet.MDMAppleDeclaration{
+			declForTest("D5", "D4", "foo"),
+			declForTest("D4", "D5", "foo"),
+		},
+		nil,
+		[]*fleet.MDMAppleConfigProfile{
+			configProfileForTest(t, "N4", "I4", "d"),
+			configProfileForTest(t, "N5", "I5", "e"),
+		},
+		[]*fleet.MDMWindowsConfigProfile{
+			windowsConfigProfileForTest(t, "W4", "l4"),
+			windowsConfigProfileForTest(t, "W5", "l5"),
+		},
+		[]*fleet.MDMAppleDeclaration{
+			declForTest("D5", "D4", "foo"),
+			declForTest("D4", "D5", "foo"),
+		},
+		fleet.MDMProfilesUpdates{AppleConfigProfile: false, WindowsConfigProfile: false, AppleDeclaration: false},
 	)
 
 	// Test Case 8: Clear profiles for a specific team
-	applyAndExpect(nil, nil, nil, ptr.Uint(1), nil, nil, nil)
+	applyAndExpect(nil, nil, nil, ptr.Uint(1), nil, nil, nil,
+		fleet.MDMProfilesUpdates{AppleConfigProfile: true, WindowsConfigProfile: true, AppleDeclaration: true},
+	)
 }
 
 func testListMDMConfigProfiles(t *testing.T, ds *Datastore) {
@@ -1063,17 +1103,24 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 	}
 
 	// bulk set for no target ids, does nothing
-	err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, nil, nil, nil)
+	updates, err := ds.BulkSetPendingMDMHostProfiles(ctx, nil, nil, nil, nil)
 	require.NoError(t, err)
+	assert.False(t, updates.AppleConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
+	assert.False(t, updates.WindowsConfigProfile)
+
 	// bulk set for combination of target ids, not allowed
-	err = ds.BulkSetPendingMDMHostProfiles(ctx, []uint{1}, []uint{2}, nil, nil)
+	_, err = ds.BulkSetPendingMDMHostProfiles(ctx, []uint{1}, []uint{2}, nil, nil)
 	require.Error(t, err)
 
 	// bulk set for all created hosts, no profiles yet so nothing changed
 	allHosts := append(darwinHosts, unenrolledHost, linuxHost)
 	allHosts = append(allHosts, windowsHosts...)
-	err = ds.BulkSetPendingMDMHostProfiles(ctx, hostIDsFromHosts(allHosts...), nil, nil, nil)
+	updates, err = ds.BulkSetPendingMDMHostProfiles(ctx, hostIDsFromHosts(allHosts...), nil, nil, nil)
 	require.NoError(t, err)
+	assert.False(t, updates.AppleConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
+	assert.False(t, updates.WindowsConfigProfile)
 	assertHostProfiles(t, ds, map[*fleet.Host][]anyProfile{
 		darwinHosts[0]:  {},
 		darwinHosts[1]:  {},
@@ -1100,7 +1147,7 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 		windowsConfigProfileForTest(t, "G2w", "L2"),
 		windowsConfigProfileForTest(t, "G3w", "L3"),
 	}
-	err = ds.BatchSetMDMProfiles(
+	updates, err = ds.BatchSetMDMProfiles(
 		ctx,
 		nil,
 		macGlobalProfiles,
@@ -1113,6 +1160,9 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 	require.Len(t, macGlobalProfiles, 3)
 	globalProfiles := getProfs(nil)
 	require.Len(t, globalProfiles, 8)
+	assert.True(t, updates.AppleConfigProfile)
+	assert.True(t, updates.AppleDeclaration)
+	assert.True(t, updates.WindowsConfigProfile)
 
 	// list profiles to install, should result in the global profiles for all
 	// enrolled hosts
@@ -1132,8 +1182,11 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 	require.Len(t, toRemoveWindows, 0)
 
 	// bulk set for all created hosts, enrolled hosts get the no-team profiles
-	err = ds.BulkSetPendingMDMHostProfiles(ctx, hostIDsFromHosts(allHosts...), nil, nil, nil)
+	updates, err = ds.BulkSetPendingMDMHostProfiles(ctx, hostIDsFromHosts(allHosts...), nil, nil, nil)
 	require.NoError(t, err)
+	assert.True(t, updates.AppleConfigProfile)
+	assert.True(t, updates.AppleDeclaration)
+	assert.True(t, updates.WindowsConfigProfile)
 	assertHostProfiles(t, ds, map[*fleet.Host][]anyProfile{
 		darwinHosts[0]: {
 			{
@@ -1311,7 +1364,7 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 	require.Len(t, toRemoveWindows, 3)
 
 	// update status of the moved host (team has no profiles)
-	err = ds.BulkSetPendingMDMHostProfiles(
+	updates, err = ds.BulkSetPendingMDMHostProfiles(
 		ctx,
 		hostIDsFromHosts(darwinHosts[0], windowsHosts[0]),
 		nil,
@@ -1319,6 +1372,9 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 		nil,
 	)
 	require.NoError(t, err)
+	assert.True(t, updates.AppleConfigProfile)
+	assert.True(t, updates.AppleDeclaration)
+	assert.True(t, updates.WindowsConfigProfile)
 	assertHostProfiles(t, ds, map[*fleet.Host][]anyProfile{
 		darwinHosts[0]: {
 			{
@@ -1482,7 +1538,7 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 	require.Len(t, toRemoveWindows, 3)
 
 	// update status of the moved host via its uuid (team has no profiles)
-	err = ds.BulkSetPendingMDMHostProfiles(
+	updates, err = ds.BulkSetPendingMDMHostProfiles(
 		ctx,
 		nil,
 		nil,
@@ -1490,6 +1546,9 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 		[]string{darwinHosts[1].UUID, windowsHosts[1].UUID},
 	)
 	require.NoError(t, err)
+	assert.True(t, updates.AppleConfigProfile)
+	assert.True(t, updates.AppleDeclaration)
+	assert.True(t, updates.WindowsConfigProfile)
 	assertHostProfiles(t, ds, map[*fleet.Host][]anyProfile{
 		darwinHosts[0]: {
 			{
@@ -1620,8 +1679,11 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 		windowsConfigProfileForTest(t, "T1.1w", "T1.1"),
 		windowsConfigProfileForTest(t, "T1.2w", "T1.2"),
 	}
-	err = ds.BatchSetMDMProfiles(ctx, &team1.ID, tm1DarwinProfiles, tm1WindowsProfiles, nil)
+	updates, err = ds.BatchSetMDMProfiles(ctx, &team1.ID, tm1DarwinProfiles, tm1WindowsProfiles, nil)
 	require.NoError(t, err)
+	assert.True(t, updates.AppleConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
+	assert.True(t, updates.WindowsConfigProfile)
 
 	tm1Profiles := getProfs(&team1.ID)
 	require.Len(t, tm1Profiles, 4)
@@ -1644,8 +1706,11 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 	require.Len(t, toRemoveWindows, 0)
 
 	// update status of the affected team
-	err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{team1.ID}, nil, nil)
+	updates, err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{team1.ID}, nil, nil)
 	require.NoError(t, err)
+	assert.True(t, updates.AppleConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
+	assert.True(t, updates.WindowsConfigProfile)
 	assertHostProfiles(t, ds, map[*fleet.Host][]anyProfile{
 		darwinHosts[0]: {
 			{
@@ -1827,15 +1892,21 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 		windowsConfigProfileForTest(t, "T1.3w", "T1.3"),
 	}
 
-	err = ds.BatchSetMDMProfiles(ctx, &team1.ID, newTm1DarwinProfiles, newTm1WindowsProfiles, nil)
+	updates, err = ds.BatchSetMDMProfiles(ctx, &team1.ID, newTm1DarwinProfiles, newTm1WindowsProfiles, nil)
 	require.NoError(t, err)
+	assert.True(t, updates.AppleConfigProfile)
+	assert.True(t, updates.WindowsConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
 
 	newTm1Profiles := getProfs(&team1.ID)
 	require.Len(t, newTm1Profiles, 4)
 
 	// update status of the affected team
-	err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{team1.ID}, nil, nil)
+	updates, err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{team1.ID}, nil, nil)
 	require.NoError(t, err)
+	assert.True(t, updates.AppleConfigProfile)
+	assert.True(t, updates.WindowsConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
 
 	assertHostProfiles(t, ds, map[*fleet.Host][]anyProfile{
 		darwinHosts[0]: {
@@ -1974,6 +2045,13 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 		},
 	})
 
+	// update again -- nothing should change
+	updates, err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{team1.ID}, nil, nil)
+	require.NoError(t, err)
+	assert.False(t, updates.AppleConfigProfile)
+	assert.False(t, updates.WindowsConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
+
 	// re-add tm1Profiles[0] to list of team1 profiles (T1.1 on Apple, T1.2 on Windows)
 	// NOTE: even though it is the same profile, it's unique DB ID is different because
 	// it got deleted and re-inserted from the team's profiles, so this is reflected in
@@ -1989,14 +2067,20 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 		windowsConfigProfileForTest(t, "T1.3w", "T1.3"),
 	}
 
-	err = ds.BatchSetMDMProfiles(ctx, &team1.ID, newTm1DarwinProfiles, newTm1WindowsProfiles, nil)
+	updates, err = ds.BatchSetMDMProfiles(ctx, &team1.ID, newTm1DarwinProfiles, newTm1WindowsProfiles, nil)
 	require.NoError(t, err)
 	newTm1Profiles = getProfs(&team1.ID)
 	require.Len(t, newTm1Profiles, 6)
+	assert.True(t, updates.AppleConfigProfile)
+	assert.True(t, updates.WindowsConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
 
 	// update status of the affected team
-	err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{team1.ID}, nil, nil)
+	updates, err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{team1.ID}, nil, nil)
 	require.NoError(t, err)
+	assert.True(t, updates.AppleConfigProfile)
+	assert.True(t, updates.WindowsConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
 
 	assertHostProfiles(t, ds, map[*fleet.Host][]anyProfile{
 		darwinHosts[0]: {
@@ -2154,15 +2238,21 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 	}
 
 	// TODO(roberto): add new darwin declarations for this and all subsequent assertions
-	err = ds.BatchSetMDMProfiles(ctx, nil, newDarwinGlobalProfiles, newWindowsGlobalProfiles, nil)
+	updates, err = ds.BatchSetMDMProfiles(ctx, nil, newDarwinGlobalProfiles, newWindowsGlobalProfiles, nil)
 	require.NoError(t, err)
+	assert.True(t, updates.AppleConfigProfile)
+	assert.True(t, updates.WindowsConfigProfile)
+	assert.True(t, updates.AppleDeclaration)
 
 	newGlobalProfiles := getProfs(nil)
 	require.Len(t, newGlobalProfiles, 6)
 
 	// update status of the affected "no-team"
-	err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{0}, nil, nil)
+	updates, err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{0}, nil, nil)
 	require.NoError(t, err)
+	assert.True(t, updates.AppleConfigProfile)
+	assert.True(t, updates.WindowsConfigProfile)
+	assert.True(t, updates.AppleDeclaration)
 
 	require.NoError(t, ds.MDMAppleStoreDDMStatusReport(ctx, darwinHosts[0].UUID, nil))
 	require.NoError(t, ds.MDMAppleStoreDDMStatusReport(ctx, darwinHosts[1].UUID, nil))
@@ -2289,15 +2379,21 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 		windowsConfigProfileForTest(t, "G5w", "G5"),
 	}
 
-	err = ds.BatchSetMDMProfiles(ctx, nil, newDarwinGlobalProfiles, newWindowsGlobalProfiles, nil)
+	updates, err = ds.BatchSetMDMProfiles(ctx, nil, newDarwinGlobalProfiles, newWindowsGlobalProfiles, nil)
 	require.NoError(t, err)
 	newGlobalProfiles = getProfs(nil)
 	require.Len(t, newGlobalProfiles, 8)
+	assert.True(t, updates.AppleConfigProfile)
+	assert.True(t, updates.WindowsConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
 
 	// bulk-set only those affected by the new Apple global profile
 	newDarwinProfileUUID := newGlobalProfiles[3].ProfileUUID
-	err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, nil, []string{newDarwinProfileUUID}, nil)
+	updates, err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, nil, []string{newDarwinProfileUUID}, nil)
 	require.NoError(t, err)
+	assert.True(t, updates.AppleConfigProfile)
+	assert.False(t, updates.WindowsConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
 
 	assertHostProfiles(t, ds, map[*fleet.Host][]anyProfile{
 		darwinHosts[0]: {
@@ -2407,8 +2503,11 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 
 	// bulk-set only those affected by the new Apple global profile
 	newWindowsProfileUUID := newGlobalProfiles[7].ProfileUUID
-	err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, nil, []string{newWindowsProfileUUID}, nil)
+	updates, err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, nil, []string{newWindowsProfileUUID}, nil)
 	require.NoError(t, err)
+	assert.False(t, updates.AppleConfigProfile)
+	assert.True(t, updates.WindowsConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
 
 	assertHostProfiles(t, ds, map[*fleet.Host][]anyProfile{
 		darwinHosts[0]: {
@@ -2531,14 +2630,20 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 		windowsConfigProfileForTest(t, "T2.1w", "T2.1"),
 	}
 
-	err = ds.BatchSetMDMProfiles(ctx, &team2.ID, tm2DarwinProfiles, tm2WindowsProfiles, nil)
+	updates, err = ds.BatchSetMDMProfiles(ctx, &team2.ID, tm2DarwinProfiles, tm2WindowsProfiles, nil)
 	require.NoError(t, err)
 	tm2Profiles := getProfs(&team2.ID)
 	require.Len(t, tm2Profiles, 2)
+	assert.True(t, updates.AppleConfigProfile)
+	assert.True(t, updates.WindowsConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
 
 	// update status via tm2 id and the global 0 id to test that custom sql statement
-	err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{team2.ID, 0}, nil, nil)
+	updates, err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{team2.ID, 0}, nil, nil)
 	require.NoError(t, err)
+	assert.True(t, updates.AppleConfigProfile)
+	assert.True(t, updates.WindowsConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
 
 	assertHostProfiles(t, ds, map[*fleet.Host][]anyProfile{
 		darwinHosts[0]: {
@@ -2714,7 +2819,7 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 		windowsConfigProfileForTest(t, "G7w", "G7", labels[5]),
 	}
 
-	err = ds.BatchSetMDMProfiles(ctx, nil, newDarwinGlobalProfiles, newWindowsGlobalProfiles, nil)
+	updates, err = ds.BatchSetMDMProfiles(ctx, nil, newDarwinGlobalProfiles, newWindowsGlobalProfiles, nil)
 	require.NoError(t, err)
 	newGlobalProfiles = getProfs(nil)
 	require.Len(t, newGlobalProfiles, 12)
@@ -2723,6 +2828,9 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 	setProfileLabels(t, newGlobalProfiles[5], labels[2])
 	setProfileLabels(t, newGlobalProfiles[10], labels[3], labels[4])
 	setProfileLabels(t, newGlobalProfiles[11], labels[5])
+	assert.True(t, updates.AppleConfigProfile)
+	assert.True(t, updates.WindowsConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
 
 	// simulate an entry with some values set to NULL
 	ExecAdhocSQL(t, ds, func(q sqlx.ExtContext) error {
@@ -2737,7 +2845,7 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 	// do a sync of all hosts, should not change anything as no host is a member
 	// of the new label-based profiles (indices change due to new Apple and
 	// Windows profiles)
-	err = ds.BulkSetPendingMDMHostProfiles(
+	updates, err = ds.BulkSetPendingMDMHostProfiles(
 		ctx,
 		hostIDsFromHosts(
 			append(darwinHosts, append(windowsHosts, unenrolledHost, linuxHost)...)...),
@@ -2746,6 +2854,9 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 		nil,
 	)
 	require.NoError(t, err)
+	assert.False(t, updates.AppleConfigProfile)
+	assert.False(t, updates.WindowsConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
 
 	assertHostProfiles(t, ds, map[*fleet.Host][]anyProfile{
 		darwinHosts[0]: {
@@ -2912,7 +3023,7 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 
 	// do a full sync, the new global hosts get the standard global profiles and
 	// also the label-based profile that they are a member of
-	err = ds.BulkSetPendingMDMHostProfiles(
+	updates, err = ds.BulkSetPendingMDMHostProfiles(
 		ctx,
 		hostIDsFromHosts(
 			append(darwinHosts, append(windowsHosts, unenrolledHost, linuxHost)...)...),
@@ -2921,6 +3032,9 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 		nil,
 	)
 	require.NoError(t, err)
+	assert.True(t, updates.AppleConfigProfile)
+	assert.True(t, updates.WindowsConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
 
 	assertHostProfiles(t, ds, map[*fleet.Host][]anyProfile{
 		darwinHosts[0]: {
@@ -3117,7 +3231,7 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 	require.NoError(t, err)
 
 	// do a sync of those hosts, they will get the two label-based profiles of their platform
-	err = ds.BulkSetPendingMDMHostProfiles(
+	updates, err = ds.BulkSetPendingMDMHostProfiles(
 		ctx,
 		hostIDsFromHosts(darwinHosts[2], windowsHosts[2]),
 		nil,
@@ -3125,6 +3239,9 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 		nil,
 	)
 	require.NoError(t, err)
+	assert.True(t, updates.AppleConfigProfile)
+	assert.True(t, updates.WindowsConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
 
 	assertHostProfiles(t, ds, map[*fleet.Host][]anyProfile{
 		darwinHosts[0]: {
@@ -3327,7 +3444,7 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 	require.NoError(t, ds.DeleteLabel(ctx, labels[3].Name))
 
 	// sync the affected profiles
-	err = ds.BulkSetPendingMDMHostProfiles(
+	updates, err = ds.BulkSetPendingMDMHostProfiles(
 		ctx,
 		nil,
 		nil,
@@ -3335,7 +3452,10 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 		nil,
 	)
 	require.NoError(t, err)
-	err = ds.BulkSetPendingMDMHostProfiles(
+	assert.False(t, updates.AppleConfigProfile)
+	assert.False(t, updates.WindowsConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
+	updates, err = ds.BulkSetPendingMDMHostProfiles(
 		ctx,
 		nil,
 		nil,
@@ -3343,6 +3463,9 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 		nil,
 	)
 	require.NoError(t, err)
+	assert.False(t, updates.AppleConfigProfile)
+	assert.False(t, updates.WindowsConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
 
 	// nothing changes - broken label-based profiles are simply ignored
 	assertHostProfiles(t, ds, map[*fleet.Host][]anyProfile{
@@ -3551,7 +3674,7 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 	})
 	require.NoError(t, err)
 
-	err = ds.BulkSetPendingMDMHostProfiles(
+	updates, err = ds.BulkSetPendingMDMHostProfiles(
 		ctx,
 		hostIDsFromHosts(darwinHosts[2], windowsHosts[2]),
 		nil,
@@ -3559,6 +3682,9 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 		nil,
 	)
 	require.NoError(t, err)
+	assert.True(t, updates.AppleConfigProfile)
+	assert.True(t, updates.WindowsConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
 
 	assertHostProfiles(t, ds, map[*fleet.Host][]anyProfile{
 		darwinHosts[0]: {
@@ -3756,7 +3882,7 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 	setProfileLabels(t, newGlobalProfiles[4], labels[1])
 	setProfileLabels(t, newGlobalProfiles[10], labels[4])
 
-	err = ds.BulkSetPendingMDMHostProfiles(
+	updates, err = ds.BulkSetPendingMDMHostProfiles(
 		ctx,
 		nil,
 		nil,
@@ -3764,7 +3890,10 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 		nil,
 	)
 	require.NoError(t, err)
-	err = ds.BulkSetPendingMDMHostProfiles(
+	assert.True(t, updates.AppleConfigProfile)
+	assert.False(t, updates.WindowsConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
+	updates, err = ds.BulkSetPendingMDMHostProfiles(
 		ctx,
 		nil,
 		nil,
@@ -3772,6 +3901,9 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 		nil,
 	)
 	require.NoError(t, err)
+	assert.False(t, updates.AppleConfigProfile)
+	assert.True(t, updates.WindowsConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
 
 	assertHostProfiles(t, ds, map[*fleet.Host][]anyProfile{
 		darwinHosts[0]: {
@@ -3969,18 +4101,24 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 		windowsConfigProfileForTest(t, "T2.2w", "T2.2", labels[4], labels[5]),
 	}
 
-	err = ds.BatchSetMDMProfiles(ctx, &team2.ID, tm2DarwinProfiles, tm2WindowsProfiles, nil)
+	updates, err = ds.BatchSetMDMProfiles(ctx, &team2.ID, tm2DarwinProfiles, tm2WindowsProfiles, nil)
 	require.NoError(t, err)
 	tm2Profiles = getProfs(&team2.ID)
 	require.Len(t, tm2Profiles, 4)
 	// TODO(mna): temporary until BatchSetMDMProfiles supports labels
 	setProfileLabels(t, tm2Profiles[1], labels[1], labels[2])
 	setProfileLabels(t, tm2Profiles[3], labels[4], labels[5])
+	assert.True(t, updates.AppleConfigProfile)
+	assert.True(t, updates.WindowsConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
 
 	// sync team 2, no changes because no host is a member of the labels (except
 	// index change due to new profiles)
-	err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{team2.ID}, nil, nil)
+	updates, err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{team2.ID}, nil, nil)
 	require.NoError(t, err)
+	assert.False(t, updates.AppleConfigProfile)
+	assert.False(t, updates.WindowsConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
 
 	assertHostProfiles(t, ds, map[*fleet.Host][]anyProfile{
 		darwinHosts[0]: {
@@ -4178,8 +4316,11 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 	require.NoError(t, err)
 
 	// sync team 2, the label-based profile of team2 is now pending install
-	err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{team2.ID}, nil, nil)
+	updates, err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{team2.ID}, nil, nil)
 	require.NoError(t, err)
+	assert.True(t, updates.AppleConfigProfile)
+	assert.True(t, updates.WindowsConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
 
 	assertHostProfiles(t, ds, map[*fleet.Host][]anyProfile{
 		darwinHosts[0]: {
@@ -4388,8 +4529,11 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 
 	// sync team 2, the label-based profile of team2 is left untouched (broken
 	// profiles are ignored)
-	err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{team2.ID}, nil, nil)
+	updates, err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{team2.ID}, nil, nil)
 	require.NoError(t, err)
+	assert.False(t, updates.AppleConfigProfile)
+	assert.False(t, updates.WindowsConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
 
 	assertHostProfiles(t, ds, map[*fleet.Host][]anyProfile{
 		darwinHosts[0]: {
@@ -4603,8 +4747,11 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 
 	// sync team 2, the label-based profile of team2 is still left untouched
 	// because even if the hosts are not members anymore, the profile is broken
-	err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{team2.ID}, nil, nil)
+	updates, err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{team2.ID}, nil, nil)
 	require.NoError(t, err)
+	assert.False(t, updates.AppleConfigProfile)
+	assert.False(t, updates.WindowsConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
 
 	assertHostProfiles(t, ds, map[*fleet.Host][]anyProfile{
 		darwinHosts[0]: {
@@ -4808,8 +4955,11 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 
 	// sync team 2, now it sees that the hosts are not members and the profile
 	// gets removed
-	err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{team2.ID}, nil, nil)
+	updates, err = ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{team2.ID}, nil, nil)
 	require.NoError(t, err)
+	assert.True(t, updates.AppleConfigProfile)
+	assert.True(t, updates.WindowsConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
 
 	assertHostProfiles(t, ds, map[*fleet.Host][]anyProfile{
 		darwinHosts[0]: {
@@ -5003,7 +5153,7 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 	})
 
 	// sanity-check, a full sync does not change anything
-	err = ds.BulkSetPendingMDMHostProfiles(
+	updates, err = ds.BulkSetPendingMDMHostProfiles(
 		ctx,
 		hostIDsFromHosts(
 			append(darwinHosts, append(windowsHosts, unenrolledHost, linuxHost)...)...),
@@ -5012,6 +5162,9 @@ func testBulkSetPendingMDMHostProfiles(t *testing.T, ds *Datastore) {
 		nil,
 	)
 	require.NoError(t, err)
+	assert.False(t, updates.AppleConfigProfile)
+	assert.False(t, updates.WindowsConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
 
 	assertHostProfiles(t, ds, map[*fleet.Host][]anyProfile{
 		darwinHosts[0]: {
@@ -5237,8 +5390,11 @@ func testGetHostMDMProfilesExpectedForVerification(t *testing.T, ds *Datastore)
 			configProfileForTest(t, "T1.2", "T1.2", "e"),
 		}
 
-		err = ds.BatchSetMDMProfiles(ctx, &team.ID, profiles, nil, nil)
+		updates, err := ds.BatchSetMDMProfiles(ctx, &team.ID, profiles, nil, nil)
 		require.NoError(t, err)
+		assert.True(t, updates.AppleConfigProfile)
+		assert.False(t, updates.WindowsConfigProfile)
+		assert.False(t, updates.AppleDeclaration)
 
 		profs, _, err := ds.ListMDMConfigProfiles(ctx, &team.ID, fleet.ListOptions{})
 		require.NoError(t, err)
@@ -5275,8 +5431,11 @@ func testGetHostMDMProfilesExpectedForVerification(t *testing.T, ds *Datastore)
 		label, err := ds.NewLabel(ctx, &fleet.Label{Name: "test_label_1"})
 		require.NoError(t, err)
 
-		err = ds.BatchSetMDMProfiles(ctx, &team.ID, profiles, nil, nil)
+		updates, err := ds.BatchSetMDMProfiles(ctx, &team.ID, profiles, nil, nil)
 		require.NoError(t, err)
+		assert.True(t, updates.AppleConfigProfile)
+		assert.False(t, updates.WindowsConfigProfile)
+		assert.False(t, updates.AppleDeclaration)
 
 		var uid string
 		ExecAdhocSQL(t, ds, func(q sqlx.ExtContext) error {
@@ -5354,8 +5513,11 @@ func testGetHostMDMProfilesExpectedForVerification(t *testing.T, ds *Datastore)
 		testLabel3, err := ds.NewLabel(ctx, &fleet.Label{Name: "test_label_3"})
 		require.NoError(t, err)
 
-		err = ds.BatchSetMDMProfiles(ctx, &team.ID, profiles, nil, nil)
+		updates, err := ds.BatchSetMDMProfiles(ctx, &team.ID, profiles, nil, nil)
 		require.NoError(t, err)
+		assert.True(t, updates.AppleConfigProfile)
+		assert.False(t, updates.WindowsConfigProfile)
+		assert.False(t, updates.AppleDeclaration)
 
 		var uid string
 		ExecAdhocSQL(t, ds, func(q sqlx.ExtContext) error {
@@ -5444,8 +5606,11 @@ func testGetHostMDMProfilesExpectedForVerification(t *testing.T, ds *Datastore)
 		testLabel4, err := ds.NewLabel(ctx, &fleet.Label{Name: "test_label_4"})
 		require.NoError(t, err)
 
-		err = ds.BatchSetMDMProfiles(ctx, &team.ID, profiles, nil, nil)
+		updates, err := ds.BatchSetMDMProfiles(ctx, &team.ID, profiles, nil, nil)
 		require.NoError(t, err)
+		assert.True(t, updates.AppleConfigProfile)
+		assert.False(t, updates.WindowsConfigProfile)
+		assert.False(t, updates.AppleDeclaration)
 
 		var uid string
 		ExecAdhocSQL(t, ds, func(q sqlx.ExtContext) error {
@@ -5524,8 +5689,11 @@ func testGetHostMDMProfilesExpectedForVerification(t *testing.T, ds *Datastore)
 			windowsConfigProfileForTest(t, "T5.2", "T5.2"),
 		}
 
-		err = ds.BatchSetMDMProfiles(ctx, &team.ID, nil, profiles, nil)
+		updates, err := ds.BatchSetMDMProfiles(ctx, &team.ID, nil, profiles, nil)
 		require.NoError(t, err)
+		assert.False(t, updates.AppleConfigProfile)
+		assert.True(t, updates.WindowsConfigProfile)
+		assert.False(t, updates.AppleDeclaration)
 
 		profs, _, err := ds.ListMDMConfigProfiles(ctx, &team.ID, fleet.ListOptions{})
 		require.NoError(t, err)
@@ -5562,8 +5730,11 @@ func testGetHostMDMProfilesExpectedForVerification(t *testing.T, ds *Datastore)
 		label, err := ds.NewLabel(ctx, &fleet.Label{Name: "test_label_6"})
 		require.NoError(t, err)
 
-		err = ds.BatchSetMDMProfiles(ctx, &team.ID, nil, profiles, nil)
+		updates, err := ds.BatchSetMDMProfiles(ctx, &team.ID, nil, profiles, nil)
 		require.NoError(t, err)
+		assert.False(t, updates.AppleConfigProfile)
+		assert.True(t, updates.WindowsConfigProfile)
+		assert.False(t, updates.AppleDeclaration)
 
 		var uid string
 		ExecAdhocSQL(t, ds, func(q sqlx.ExtContext) error {
@@ -5641,8 +5812,11 @@ func testGetHostMDMProfilesExpectedForVerification(t *testing.T, ds *Datastore)
 		testLabel3, err := ds.NewLabel(ctx, &fleet.Label{Name: uuid.NewString()})
 		require.NoError(t, err)
 
-		err = ds.BatchSetMDMProfiles(ctx, &team.ID, nil, profiles, nil)
+		updates, err := ds.BatchSetMDMProfiles(ctx, &team.ID, nil, profiles, nil)
 		require.NoError(t, err)
+		assert.False(t, updates.AppleConfigProfile)
+		assert.True(t, updates.WindowsConfigProfile)
+		assert.False(t, updates.AppleDeclaration)
 
 		var uid string
 		ExecAdhocSQL(t, ds, func(q sqlx.ExtContext) error {
@@ -5731,8 +5905,11 @@ func testGetHostMDMProfilesExpectedForVerification(t *testing.T, ds *Datastore)
 		label, err := ds.NewLabel(ctx, &fleet.Label{Name: uuid.NewString()})
 		require.NoError(t, err)
 
-		err = ds.BatchSetMDMProfiles(ctx, &team.ID, nil, profiles, nil)
+		updates, err := ds.BatchSetMDMProfiles(ctx, &team.ID, nil, profiles, nil)
 		require.NoError(t, err)
+		assert.False(t, updates.AppleConfigProfile)
+		assert.True(t, updates.WindowsConfigProfile)
+		assert.False(t, updates.AppleDeclaration)
 
 		var uid string
 		ExecAdhocSQL(t, ds, func(q sqlx.ExtContext) error {
@@ -5947,18 +6124,16 @@ func testBatchSetProfileLabelAssociations(t *testing.T, ds *Datastore) {
 	wantOtherWin := []fleet.ConfigurationProfileLabel{
 		{ProfileUUID: otherWinProfile.ProfileUUID, LabelName: label.Name, LabelID: label.ID},
 	}
-	require.NoError(
-		t,
-		batchSetProfileLabelAssociationsDB(ctx, ds.writer(ctx), wantOtherWin, "windows"),
-	)
+	updatedDB, err := batchSetProfileLabelAssociationsDB(ctx, ds.writer(ctx), wantOtherWin, "windows")
+	require.NoError(t, err)
+	assert.True(t, updatedDB)
 	// make it an "exclude" label on the other macos profile
 	wantOtherMac := []fleet.ConfigurationProfileLabel{
 		{ProfileUUID: otherMacProfile.ProfileUUID, LabelName: label.Name, LabelID: label.ID, Exclude: true},
 	}
-	require.NoError(
-		t,
-		batchSetProfileLabelAssociationsDB(ctx, ds.writer(ctx), wantOtherMac, "darwin"),
-	)
+	updatedDB, err = batchSetProfileLabelAssociationsDB(ctx, ds.writer(ctx), wantOtherMac, "darwin")
+	require.NoError(t, err)
+	assert.True(t, updatedDB)
 
 	platforms := map[string]string{
 		"darwin":  macOSProfile.ProfileUUID,
@@ -5991,7 +6166,10 @@ func testBatchSetProfileLabelAssociations(t *testing.T, ds *Datastore) {
 		t.Run("empty input "+platform, func(t *testing.T) {
 			want := []fleet.ConfigurationProfileLabel{}
 			err := ds.withTx(ctx, func(tx sqlx.ExtContext) error {
-				return batchSetProfileLabelAssociationsDB(ctx, tx, want, platform)
+				updatedDB, err := batchSetProfileLabelAssociationsDB(ctx, tx, want, platform)
+				require.NoError(t, err)
+				assert.False(t, updatedDB)
+				return err
 			})
 			require.NoError(t, err)
 			expectLabels(t, uuid, platform, want)
@@ -6005,7 +6183,10 @@ func testBatchSetProfileLabelAssociations(t *testing.T, ds *Datastore) {
 				{ProfileUUID: uuid, LabelName: label.Name, LabelID: label.ID},
 			}
 			err := ds.withTx(ctx, func(tx sqlx.ExtContext) error {
-				return batchSetProfileLabelAssociationsDB(ctx, tx, profileLabels, platform)
+				updatedDB, err := batchSetProfileLabelAssociationsDB(ctx, tx, profileLabels, platform)
+				require.NoError(t, err)
+				assert.True(t, updatedDB)
+				return err
 			})
 			require.NoError(t, err)
 			expectLabels(t, uuid, platform, profileLabels)
@@ -6018,7 +6199,10 @@ func testBatchSetProfileLabelAssociations(t *testing.T, ds *Datastore) {
 				{ProfileUUID: uuid, LabelName: label.Name, LabelID: label.ID, Exclude: true},
 			}
 			err = ds.withTx(ctx, func(tx sqlx.ExtContext) error {
-				return batchSetProfileLabelAssociationsDB(ctx, tx, profileLabels, platform)
+				updatedDB, err := batchSetProfileLabelAssociationsDB(ctx, tx, profileLabels, platform)
+				require.NoError(t, err)
+				assert.True(t, updatedDB)
+				return err
 			})
 			require.NoError(t, err)
 			expectLabels(t, uuid, platform, profileLabels)
@@ -6033,7 +6217,8 @@ func testBatchSetProfileLabelAssociations(t *testing.T, ds *Datastore) {
 			}
 
 			err := ds.withTx(ctx, func(tx sqlx.ExtContext) error {
-				return batchSetProfileLabelAssociationsDB(ctx, tx, invalidProfileLabels, platform)
+				_, err := batchSetProfileLabelAssociationsDB(ctx, tx, invalidProfileLabels, platform)
+				return err
 			})
 			require.Error(t, err)
 		})
@@ -6044,7 +6229,8 @@ func testBatchSetProfileLabelAssociations(t *testing.T, ds *Datastore) {
 				{ProfileUUID: uuid, LabelName: label.Name, LabelID: 12345},
 			}
 			err := ds.withTx(ctx, func(tx sqlx.ExtContext) error {
-				return batchSetProfileLabelAssociationsDB(ctx, tx, invalidProfileLabels, platform)
+				_, err := batchSetProfileLabelAssociationsDB(ctx, tx, invalidProfileLabels, platform)
+				return err
 			})
 			require.Error(t, err)
 
@@ -6053,7 +6239,8 @@ func testBatchSetProfileLabelAssociations(t *testing.T, ds *Datastore) {
 				{ProfileUUID: uuid, LabelName: "xyz", LabelID: 1235},
 			}
 			err = ds.withTx(ctx, func(tx sqlx.ExtContext) error {
-				return batchSetProfileLabelAssociationsDB(ctx, tx, invalidProfileLabels, platform)
+				_, err := batchSetProfileLabelAssociationsDB(ctx, tx, invalidProfileLabels, platform)
+				return err
 			})
 			require.Error(t, err)
 		})
@@ -6074,7 +6261,10 @@ func testBatchSetProfileLabelAssociations(t *testing.T, ds *Datastore) {
 				{ProfileUUID: uuid, LabelName: newLabel.Name, LabelID: newLabel.ID, Exclude: true},
 			}
 			err = ds.withTx(ctx, func(tx sqlx.ExtContext) error {
-				return batchSetProfileLabelAssociationsDB(ctx, tx, profileLabels, platform)
+				updatedDB, err := batchSetProfileLabelAssociationsDB(ctx, tx, profileLabels, platform)
+				require.NoError(t, err)
+				assert.True(t, updatedDB)
+				return err
 			})
 			require.NoError(t, err)
 			// both are stored in the DB
@@ -6085,7 +6275,10 @@ func testBatchSetProfileLabelAssociations(t *testing.T, ds *Datastore) {
 				{ProfileUUID: uuid, LabelName: label.Name, LabelID: label.ID},
 			}
 			err = ds.withTx(ctx, func(tx sqlx.ExtContext) error {
-				return batchSetProfileLabelAssociationsDB(ctx, tx, profileLabels, platform)
+				updatedDB, err := batchSetProfileLabelAssociationsDB(ctx, tx, profileLabels, platform)
+				require.NoError(t, err)
+				assert.True(t, updatedDB)
+				return err
 			})
 			require.NoError(t, err)
 			expectLabels(t, uuid, platform, profileLabels)
@@ -6098,12 +6291,13 @@ func testBatchSetProfileLabelAssociations(t *testing.T, ds *Datastore) {
 
 	t.Run("unsupported platform", func(t *testing.T) {
 		err := ds.withTx(ctx, func(tx sqlx.ExtContext) error {
-			return batchSetProfileLabelAssociationsDB(
+			_, err := batchSetProfileLabelAssociationsDB(
 				ctx,
 				tx,
 				[]fleet.ConfigurationProfileLabel{{}},
 				"unsupported",
 			)
+			return err
 		})
 		require.Error(t, err)
 	})
@@ -6185,7 +6379,7 @@ func testBatchSetMDMProfilesTransactionError(t *testing.T, ds *Datastore) {
 				windowsConfigProfileForTest(t, "W2", "l2"),
 			}
 			// set the initial profiles without error
-			err := ds.BatchSetMDMProfiles(ctx, nil, appleProfs, winProfs, nil)
+			_, err := ds.BatchSetMDMProfiles(ctx, nil, appleProfs, winProfs, nil)
 			require.NoError(t, err)
 
 			// now ensure all steps are required (add a profile, delete a profile, set labels)
@@ -6201,7 +6395,7 @@ func testBatchSetMDMProfilesTransactionError(t *testing.T, ds *Datastore) {
 			ds.testBatchSetMDMAppleProfilesErr = c.appleErr
 			ds.testBatchSetMDMWindowsProfilesErr = c.windowsErr
 
-			err = ds.BatchSetMDMProfiles(ctx, nil, appleProfs, winProfs, nil)
+			_, err = ds.BatchSetMDMProfiles(ctx, nil, appleProfs, winProfs, nil)
 			require.ErrorContains(t, err, c.wantErr)
 		})
 	}
@@ -7139,8 +7333,11 @@ func testBulkSetPendingMDMHostProfilesExcludeAny(t *testing.T, ds *Datastore) {
 		declForTest("D1", "D1", "{}", labels[3], labels[4], labels[5]),
 	}
 
-	err := ds.BatchSetMDMProfiles(ctx, nil, appleProfs, windowsProfs, appleDecls)
+	updates, err := ds.BatchSetMDMProfiles(ctx, nil, appleProfs, windowsProfs, appleDecls)
 	require.NoError(t, err)
+	assert.True(t, updates.AppleConfigProfile)
+	assert.True(t, updates.WindowsConfigProfile)
+	assert.True(t, updates.AppleDeclaration)
 
 	// must reload them to get the profile/declaration uuid
 	getProfs := func(teamID *uint) []*fleet.MDMConfigProfilePayload {
@@ -7185,8 +7382,11 @@ func testBulkSetPendingMDMHostProfilesExcludeAny(t *testing.T, ds *Datastore) {
 
 	// do a sync, they get all platform-specific profiles since they are not part
 	// of any label
-	err = ds.BulkSetPendingMDMHostProfiles(ctx, []uint{winHost.ID, appleHost.ID}, nil, nil, nil)
+	updates, err = ds.BulkSetPendingMDMHostProfiles(ctx, []uint{winHost.ID, appleHost.ID}, nil, nil, nil)
 	require.NoError(t, err)
+	assert.True(t, updates.AppleConfigProfile)
+	assert.True(t, updates.WindowsConfigProfile)
+	assert.True(t, updates.AppleDeclaration)
 
 	assertHostProfiles(t, ds, map[*fleet.Host][]anyProfile{
 		appleHost: {
@@ -7225,8 +7425,11 @@ func testBulkSetPendingMDMHostProfilesExcludeAny(t *testing.T, ds *Datastore) {
 	})
 	require.NoError(t, err)
 
-	err = ds.BulkSetPendingMDMHostProfiles(ctx, []uint{winHost.ID, appleHost.ID}, nil, nil, nil)
+	updates, err = ds.BulkSetPendingMDMHostProfiles(ctx, []uint{winHost.ID, appleHost.ID}, nil, nil, nil)
 	require.NoError(t, err)
+	assert.True(t, updates.AppleConfigProfile)
+	assert.True(t, updates.WindowsConfigProfile)
+	assert.True(t, updates.AppleDeclaration)
 
 	assertHostProfiles(t, ds, map[*fleet.Host][]anyProfile{
 		appleHost: {
@@ -7257,8 +7460,11 @@ func testBulkSetPendingMDMHostProfilesExcludeAny(t *testing.T, ds *Datastore) {
 	})
 	require.NoError(t, err)
 
-	err = ds.BulkSetPendingMDMHostProfiles(ctx, []uint{winHost.ID, appleHost.ID}, nil, nil, nil)
+	updates, err = ds.BulkSetPendingMDMHostProfiles(ctx, []uint{winHost.ID, appleHost.ID}, nil, nil, nil)
 	require.NoError(t, err)
+	assert.True(t, updates.AppleConfigProfile)
+	assert.True(t, updates.WindowsConfigProfile)
+	assert.True(t, updates.AppleDeclaration)
 
 	assertHostProfiles(t, ds, map[*fleet.Host][]anyProfile{
 		appleHost: {
@@ -7293,8 +7499,11 @@ func testBulkSetPendingMDMHostProfilesExcludeAny(t *testing.T, ds *Datastore) {
 	err = ds.DeleteLabel(ctx, labels[3].Name)
 	require.NoError(t, err)
 
-	err = ds.BulkSetPendingMDMHostProfiles(ctx, []uint{winHost.ID, appleHost.ID}, nil, nil, nil)
+	updates, err = ds.BulkSetPendingMDMHostProfiles(ctx, []uint{winHost.ID, appleHost.ID}, nil, nil, nil)
 	require.NoError(t, err)
+	assert.False(t, updates.AppleConfigProfile)
+	assert.False(t, updates.WindowsConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
 
 	// broken profiles do not get reported as "to remove"
 	assertHostProfiles(t, ds, map[*fleet.Host][]anyProfile{
@@ -7345,8 +7554,11 @@ func testBulkSetPendingMDMHostProfilesExcludeAny(t *testing.T, ds *Datastore) {
 	require.NoError(t, err)
 	nanoEnroll(t, ds, appleHost2, false)
 
-	err = ds.BulkSetPendingMDMHostProfiles(ctx, []uint{winHost.ID, appleHost.ID, winHost2.ID, appleHost2.ID}, nil, nil, nil)
+	updates, err = ds.BulkSetPendingMDMHostProfiles(ctx, []uint{winHost.ID, appleHost.ID, winHost2.ID, appleHost2.ID}, nil, nil, nil)
 	require.NoError(t, err)
+	assert.False(t, updates.AppleConfigProfile)
+	assert.False(t, updates.WindowsConfigProfile)
+	assert.False(t, updates.AppleDeclaration)
 
 	// broken profiles do not get reported as "to install"
 	assertHostProfiles(t, ds, map[*fleet.Host][]anyProfile{
diff --git a/server/datastore/mysql/microsoft_mdm.go b/server/datastore/mysql/microsoft_mdm.go
index b7426bff00..112d60b868 100644
--- a/server/datastore/mysql/microsoft_mdm.go
+++ b/server/datastore/mysql/microsoft_mdm.go
@@ -172,7 +172,7 @@ func (ds *Datastore) mdmWindowsInsertCommandForHostsDB(ctx context.Context, tx s
 func (ds *Datastore) mdmWindowsInsertHostCommandDB(ctx context.Context, tx sqlx.ExecerContext, hostUUIDOrDeviceID, commandUUID string) error {
 	stmt := `
 INSERT INTO windows_mdm_command_queue (enrollment_id, command_uuid)
-VALUES ((SELECT id FROM mdm_windows_enrollments WHERE host_uuid = ? OR mdm_device_id = ?), ?)
+VALUES ((SELECT id FROM mdm_windows_enrollments WHERE host_uuid = ? OR mdm_device_id = ? ORDER BY created_at DESC LIMIT 1), ?)
 `
 
 	if _, err := tx.ExecContext(ctx, stmt, hostUUIDOrDeviceID, hostUUIDOrDeviceID, commandUUID); err != nil {
@@ -1581,7 +1581,7 @@ INSERT INTO
 			cp.LabelsExcludeAny[i].Exclude = true
 			labels = append(labels, cp.LabelsExcludeAny[i])
 		}
-		if err := batchSetProfileLabelAssociationsDB(ctx, tx, labels, "windows"); err != nil {
+		if _, err := batchSetProfileLabelAssociationsDB(ctx, tx, labels, "windows"); err != nil {
 			return ctxerr.Wrap(ctx, err, "inserting windows profile label associations")
 		}
 
@@ -1653,7 +1653,7 @@ func (ds *Datastore) batchSetMDMWindowsProfilesDB(
 	tx sqlx.ExtContext,
 	tmID *uint,
 	profiles []*fleet.MDMWindowsConfigProfile,
-) error {
+) (updatedDB bool, err error) {
 	const loadExistingProfiles = `
 SELECT
   name,
@@ -1721,13 +1721,13 @@ ON DUPLICATE KEY UPDATE
 			if err == nil {
 				err = errors.New(ds.testBatchSetMDMWindowsProfilesErr)
 			}
-			return ctxerr.Wrap(ctx, err, "build query to load existing profiles")
+			return false, ctxerr.Wrap(ctx, err, "build query to load existing profiles")
 		}
 		if err := sqlx.SelectContext(ctx, tx, &existingProfiles, stmt, args...); err != nil || strings.HasPrefix(ds.testBatchSetMDMWindowsProfilesErr, "select") {
 			if err == nil {
 				err = errors.New(ds.testBatchSetMDMWindowsProfilesErr)
 			}
-			return ctxerr.Wrap(ctx, err, "load existing profiles")
+			return false, ctxerr.Wrap(ctx, err, "load existing profiles")
 		}
 	}
 
@@ -1748,40 +1748,48 @@ ON DUPLICATE KEY UPDATE
 	var (
 		stmt string
 		args []interface{}
-		err  error
 	)
 	// delete the obsolete profiles (all those that are not in keepNames)
+	var result sql.Result
 	if len(keepNames) > 0 {
 		stmt, args, err = sqlx.In(deleteProfilesNotInList, profTeamID, keepNames)
 		if err != nil || strings.HasPrefix(ds.testBatchSetMDMWindowsProfilesErr, "indelete") {
 			if err == nil {
 				err = errors.New(ds.testBatchSetMDMWindowsProfilesErr)
 			}
-			return ctxerr.Wrap(ctx, err, "build statement to delete obsolete profiles")
+			return false, ctxerr.Wrap(ctx, err, "build statement to delete obsolete profiles")
 		}
-		if _, err := tx.ExecContext(ctx, stmt, args...); err != nil || strings.HasPrefix(ds.testBatchSetMDMWindowsProfilesErr, "delete") {
+		if result, err = tx.ExecContext(ctx, stmt, args...); err != nil || strings.HasPrefix(ds.testBatchSetMDMWindowsProfilesErr,
+			"delete") {
 			if err == nil {
 				err = errors.New(ds.testBatchSetMDMWindowsProfilesErr)
 			}
-			return ctxerr.Wrap(ctx, err, "delete obsolete profiles")
+			return false, ctxerr.Wrap(ctx, err, "delete obsolete profiles")
 		}
 	} else {
-		if _, err := tx.ExecContext(ctx, deleteAllProfilesForTeam, profTeamID); err != nil || strings.HasPrefix(ds.testBatchSetMDMWindowsProfilesErr, "delete") {
+		if result, err = tx.ExecContext(ctx, deleteAllProfilesForTeam,
+			profTeamID); err != nil || strings.HasPrefix(ds.testBatchSetMDMWindowsProfilesErr, "delete") {
 			if err == nil {
 				err = errors.New(ds.testBatchSetMDMWindowsProfilesErr)
 			}
-			return ctxerr.Wrap(ctx, err, "delete all profiles for team")
+			return false, ctxerr.Wrap(ctx, err, "delete all profiles for team")
 		}
 	}
+	if result != nil {
+		rows, _ := result.RowsAffected()
+		updatedDB = rows > 0
+	}
 
 	// insert the new profiles and the ones that have changed
 	for _, p := range incomingProfs {
-		if _, err := tx.ExecContext(ctx, insertNewOrEditedProfile, profTeamID, p.Name, p.SyncML); err != nil || strings.HasPrefix(ds.testBatchSetMDMWindowsProfilesErr, "insert") {
+		if result, err = tx.ExecContext(ctx, insertNewOrEditedProfile, profTeamID, p.Name,
+			p.SyncML); err != nil || strings.HasPrefix(ds.testBatchSetMDMWindowsProfilesErr, "insert") {
 			if err == nil {
 				err = errors.New(ds.testBatchSetMDMWindowsProfilesErr)
 			}
-			return ctxerr.Wrapf(ctx, err, "insert new/edited profile with name %q", p.Name)
+			return false, ctxerr.Wrapf(ctx, err, "insert new/edited profile with name %q", p.Name)
 		}
+		updatedDB = updatedDB || insertOnDuplicateDidInsertOrUpdate(result)
 	}
 
 	// build a list of labels so the associations can be batch-set all at once
@@ -1797,19 +1805,19 @@ ON DUPLICATE KEY UPDATE
 			if err == nil {
 				err = errors.New(ds.testBatchSetMDMWindowsProfilesErr)
 			}
-			return ctxerr.Wrap(ctx, err, "build query to load newly inserted profiles")
+			return false, ctxerr.Wrap(ctx, err, "build query to load newly inserted profiles")
 		}
 		if err := sqlx.SelectContext(ctx, tx, &newlyInsertedProfs, stmt, args...); err != nil || strings.HasPrefix(ds.testBatchSetMDMWindowsProfilesErr, "reselect") {
 			if err == nil {
 				err = errors.New(ds.testBatchSetMDMWindowsProfilesErr)
 			}
-			return ctxerr.Wrap(ctx, err, "load newly inserted profiles")
+			return false, ctxerr.Wrap(ctx, err, "load newly inserted profiles")
 		}
 
 		for _, newlyInsertedProf := range newlyInsertedProfs {
 			incomingProf, ok := incomingProfs[newlyInsertedProf.Name]
 			if !ok {
-				return ctxerr.Wrapf(ctx, err, "profile %q is in the database but was not incoming", newlyInsertedProf.Name)
+				return false, ctxerr.Wrapf(ctx, err, "profile %q is in the database but was not incoming", newlyInsertedProf.Name)
 			}
 
 			for _, label := range incomingProf.LabelsIncludeAll {
@@ -1825,47 +1833,56 @@ ON DUPLICATE KEY UPDATE
 	}
 
 	// insert/delete the label associations
-	if err := batchSetProfileLabelAssociationsDB(ctx, tx, incomingLabels, "windows"); err != nil || strings.HasPrefix(ds.testBatchSetMDMWindowsProfilesErr, "labels") {
+	var updatedLabels bool
+	if updatedLabels, err = batchSetProfileLabelAssociationsDB(ctx, tx, incomingLabels,
+		"windows"); err != nil || strings.HasPrefix(ds.testBatchSetMDMWindowsProfilesErr, "labels") {
 		if err == nil {
 			err = errors.New(ds.testBatchSetMDMWindowsProfilesErr)
 		}
-		return ctxerr.Wrap(ctx, err, "inserting windows profile label associations")
+		return false, ctxerr.Wrap(ctx, err, "inserting windows profile label associations")
 	}
 
-	return nil
+	return updatedDB || updatedLabels, nil
 }
 
 func (ds *Datastore) bulkSetPendingMDMWindowsHostProfilesDB(
 	ctx context.Context,
 	tx sqlx.ExtContext,
 	uuids []string,
-) error {
+) (updatedDB bool, err error) {
 	if len(uuids) == 0 {
-		return nil
+		return false, nil
 	}
 
 	profilesToInstall, err := listMDMWindowsProfilesToInstallDB(ctx, tx, uuids)
 	if err != nil {
-		return ctxerr.Wrap(ctx, err, "list profiles to install")
+		return false, ctxerr.Wrap(ctx, err, "list profiles to install")
 	}
 
 	profilesToRemove, err := listMDMWindowsProfilesToRemoveDB(ctx, tx, uuids)
 	if err != nil {
-		return ctxerr.Wrap(ctx, err, "list profiles to remove")
+		return false, ctxerr.Wrap(ctx, err, "list profiles to remove")
 	}
 
 	if len(profilesToInstall) == 0 && len(profilesToRemove) == 0 {
-		return nil
+		return false, nil
 	}
 
-	if err := ds.bulkDeleteMDMWindowsHostsConfigProfilesDB(ctx, tx, profilesToRemove); err != nil {
-		return ctxerr.Wrap(ctx, err, "bulk delete profiles to remove")
+	if len(profilesToRemove) > 0 {
+		if err := ds.bulkDeleteMDMWindowsHostsConfigProfilesDB(ctx, tx, profilesToRemove); err != nil {
+			return false, ctxerr.Wrap(ctx, err, "bulk delete profiles to remove")
+		}
+		updatedDB = true
+	}
+	if len(profilesToInstall) == 0 {
+		return updatedDB, nil
 	}
 
 	var (
-		pargs      []any
-		psb        strings.Builder
-		batchCount int
+		pargs            []any
+		profilesToInsert = make(map[string]*fleet.MDMWindowsProfilePayload)
+		psb              strings.Builder
+		batchCount       int
 	)
 
 	const defaultBatchSize = 1000
@@ -1877,10 +1894,48 @@ func (ds *Datastore) bulkSetPendingMDMWindowsHostProfilesDB(
 	resetBatch := func() {
 		batchCount = 0
 		pargs = pargs[:0]
+		clear(profilesToInsert)
 		psb.Reset()
 	}
 
 	executeUpsertBatch := func(valuePart string, args []any) error {
+		// Check if the update needs to be done at all.
+		selectStmt := fmt.Sprintf(`
+			SELECT
+				profile_uuid,
+				host_uuid,
+				status,
+				COALESCE(operation_type, '') AS operation_type,
+				COALESCE(detail, '') AS detail,
+				COALESCE(command_uuid, '') AS command_uuid,
+				COALESCE(profile_name, '') AS profile_name
+			FROM host_mdm_windows_profiles WHERE (profile_uuid, host_uuid) IN (%s)`,
+			strings.TrimSuffix(strings.Repeat("(?,?),", len(profilesToInsert)), ","))
+		var selectArgs []any
+		for _, p := range profilesToInsert {
+			selectArgs = append(selectArgs, p.ProfileUUID, p.HostUUID)
+		}
+		var existingProfiles []fleet.MDMWindowsProfilePayload
+		if err := sqlx.SelectContext(ctx, tx, &existingProfiles, selectStmt, selectArgs...); err != nil {
+			return ctxerr.Wrap(ctx, err, "bulk set pending profile status select existing")
+		}
+		var updateNeeded bool
+		if len(existingProfiles) == len(profilesToInsert) {
+			for _, exist := range existingProfiles {
+				insert, ok := profilesToInsert[fmt.Sprintf("%s\n%s", exist.ProfileUUID, exist.HostUUID)]
+				if !ok || !exist.Equal(*insert) {
+					updateNeeded = true
+					break
+				}
+			}
+		} else {
+			updateNeeded = true
+		}
+		if !updateNeeded {
+			// All profiles are already in the database, no need to update.
+			return nil
+		}
+
 		baseStmt := fmt.Sprintf(`
 				INSERT INTO host_mdm_windows_profiles (
 					profile_uuid,
@@ -1898,11 +1953,25 @@ func (ds *Datastore) bulkSetPendingMDMWindowsHostProfilesDB(
 					detail = ''
 			`, strings.TrimSuffix(valuePart, ","))
 
-		_, err = tx.ExecContext(ctx, baseStmt, args...)
-		return ctxerr.Wrap(ctx, err, "bulk set pending profile status execute batch")
+		_, err := tx.ExecContext(ctx, baseStmt, args...)
+		if err != nil {
+			return ctxerr.Wrap(ctx, err, "bulk set pending profile status execute batch")
+		}
+		updatedDB = true
+		return nil
 	}
 
 	for _, p := range profilesToInstall {
+		profilesToInsert[fmt.Sprintf("%s\n%s", p.ProfileUUID, p.HostUUID)] = &fleet.MDMWindowsProfilePayload{
+			ProfileUUID:   p.ProfileUUID,
+			ProfileName:   p.ProfileName,
+			HostUUID:      p.HostUUID,
+			Status:        nil,
+			OperationType: fleet.MDMOperationTypeInstall,
+			Detail:        p.Detail,
+			CommandUUID:   p.CommandUUID,
+			Retries:       p.Retries,
+		}
 		pargs = append(
 			pargs, p.ProfileUUID, p.HostUUID, p.ProfileName,
 			fleet.MDMOperationTypeInstall)
@@ -1910,7 +1979,7 @@ func (ds *Datastore) bulkSetPendingMDMWindowsHostProfilesDB(
 		batchCount++
 		if batchCount >= batchSize {
 			if err := executeUpsertBatch(psb.String(), pargs); err != nil {
-				return err
+				return false, err
 			}
 			resetBatch()
 		}
@@ -1918,11 +1987,11 @@ func (ds *Datastore) bulkSetPendingMDMWindowsHostProfilesDB(
 
 	if batchCount > 0 {
 		if err := executeUpsertBatch(psb.String(), pargs); err != nil {
-			return err
+			return false, err
 		}
 	}
 
-	return nil
+	return updatedDB, nil
 }
 
 func (ds *Datastore) GetHostMDMWindowsProfiles(ctx context.Context, hostUUID string) ([]fleet.HostMDMWindowsProfile, error) {
diff --git a/server/datastore/mysql/microsoft_mdm_test.go b/server/datastore/mysql/microsoft_mdm_test.go
index 02a4c9d149..a4ee1749c0 100644
--- a/server/datastore/mysql/microsoft_mdm_test.go
+++ b/server/datastore/mysql/microsoft_mdm_test.go
@@ -15,6 +15,7 @@ import (
 	"github.com/fleetdm/fleet/v4/server/test"
 	"github.com/google/uuid"
 	"github.com/jmoiron/sqlx"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -1155,6 +1156,45 @@ func testMDMWindowsInsertCommandForHosts(t *testing.T, ds *Datastore) {
 	cmds, err = ds.MDMWindowsGetPendingCommands(ctx, d2.MDMDeviceID)
 	require.NoError(t, err)
 	require.Len(t, cmds, 2)
+
+	// create a device that enrolls with the same device id and uuid as d1
+	// but a different hardware id (simulates the issue in #20764).
+	d3 := &fleet.MDMWindowsEnrolledDevice{
+		MDMDeviceID:            d1.MDMDeviceID,
+		MDMHardwareID:          uuid.New().String() + uuid.New().String(),
+		MDMDeviceState:         microsoft_mdm.MDMDeviceStateEnrolled,
+		MDMDeviceType:          "CIMClient_Windows",
+		MDMDeviceName:          "DESKTOP-1C3ARC1",
+		MDMEnrollType:          "ProgrammaticEnrollment",
+		MDMEnrollUserID:        "",
+		MDMEnrollProtoVersion:  "5.0",
+		MDMEnrollClientVersion: "10.0.19045.2965",
+		MDMNotInOOBE:           false,
+		HostUUID:               d1.HostUUID,
+	}
+
+	time.Sleep(time.Second) // ensure it gets a latest created_at
+	err = ds.MDMWindowsInsertEnrolledDevice(ctx, d3)
+	require.NoError(t, err)
+	err = ds.UpdateMDMWindowsEnrollmentsHostUUID(ctx, d3.HostUUID, d3.MDMDeviceID)
+	require.NoError(t, err)
+
+	// commands can still be enqueued, will be enqueued for the latest enrolled device
+	// when a duplicate host uuid/device id exists (i.e. for d3 even if d2 is passed -
+	// they have the same ids).
+	cmd.CommandUUID = uuid.NewString()
+	err = ds.MDMWindowsInsertCommandForHosts(ctx, []string{d1.MDMDeviceID, d2.MDMDeviceID}, cmd)
+	require.NoError(t, err)
+	// command enqueued and created
+	cmds, err = ds.MDMWindowsGetPendingCommands(ctx, d1.MDMDeviceID)
+	require.NoError(t, err)
+	require.Len(t, cmds, 3)
+	cmds, err = ds.MDMWindowsGetPendingCommands(ctx, d2.MDMDeviceID)
+	require.NoError(t, err)
+	require.Len(t, cmds, 3) // d2 sees the new command as we retrieve by device_id and they share the same
+	cmds, err = ds.MDMWindowsGetPendingCommands(ctx, d3.MDMDeviceID)
+	require.NoError(t, err)
+	require.Len(t, cmds, 3)
 }
 
 func testMDMWindowsGetPendingCommands(t *testing.T, ds *Datastore) {
@@ -1885,7 +1925,7 @@ func testSetOrReplaceMDMWindowsConfigProfile(t *testing.T, ds *Datastore) {
 		}
 		ExecAdhocSQL(t, ds, func(q sqlx.ExtContext) error {
 			return sqlx.GetContext(ctx, q, &prof,
-				`SELECT * FROM mdm_windows_configuration_profiles WHERE team_id = ? AND name = ?`,
+				`SELECT profile_uuid, team_id, name, syncml, created_at, uploaded_at FROM mdm_windows_configuration_profiles WHERE team_id = ? AND name = ?`,
 				teamID, name)
 		})
 		return &prof
@@ -1983,7 +2023,9 @@ func expectWindowsProfiles(
 	var got []*fleet.MDMWindowsConfigProfile
 	ExecAdhocSQL(t, ds, func(q sqlx.ExtContext) error {
 		ctx := context.Background()
-		return sqlx.SelectContext(ctx, q, &got, `SELECT * FROM mdm_windows_configuration_profiles WHERE team_id = ?`, tmID)
+		return sqlx.SelectContext(ctx, q, &got,
+			`SELECT profile_uuid, team_id, name, syncml, created_at, uploaded_at FROM mdm_windows_configuration_profiles WHERE team_id = ?`,
+			tmID)
 	})
 
 	// create map of expected profiles keyed by name
@@ -2025,9 +2067,13 @@ func expectWindowsProfiles(
 func testBatchSetMDMWindowsProfiles(t *testing.T, ds *Datastore) {
 	ctx := context.Background()
 
-	applyAndExpect := func(newSet []*fleet.MDMWindowsConfigProfile, tmID *uint, want []*fleet.MDMWindowsConfigProfile) map[string]string {
+	applyAndExpect := func(newSet []*fleet.MDMWindowsConfigProfile, tmID *uint, want []*fleet.MDMWindowsConfigProfile,
+		wantUpdated bool) map[string]string {
 		err := ds.withRetryTxx(ctx, func(tx sqlx.ExtContext) error {
-			return ds.batchSetMDMWindowsProfilesDB(ctx, tx, tmID, newSet)
+			updatedDB, err := ds.batchSetMDMWindowsProfilesDB(ctx, tx, tmID, newSet)
+			require.NoError(t, err)
+			assert.Equal(t, wantUpdated, updatedDB)
+			return err
 		})
 		require.NoError(t, err)
 		return expectWindowsProfiles(t, ds, tmID, want)
@@ -2041,7 +2087,7 @@ func testBatchSetMDMWindowsProfiles(t *testing.T, ds *Datastore) {
 		}
 		ExecAdhocSQL(t, ds, func(q sqlx.ExtContext) error {
 			return sqlx.GetContext(ctx, q, &prof,
-				`SELECT * FROM mdm_windows_configuration_profiles WHERE team_id = ? AND name = ?`,
+				`SELECT profile_uuid, team_id, name, syncml, created_at, uploaded_at FROM mdm_windows_configuration_profiles WHERE team_id = ? AND name = ?`,
 				teamID, name)
 		})
 		return &prof
@@ -2057,14 +2103,14 @@ func testBatchSetMDMWindowsProfiles(t *testing.T, ds *Datastore) {
 	}
 
 	// apply empty set for no-team
-	applyAndExpect(nil, nil, nil)
+	applyAndExpect(nil, nil, nil, false)
 
 	// apply single profile set for tm1
 	mTm1 := applyAndExpect([]*fleet.MDMWindowsConfigProfile{
 		windowsConfigProfileForTest(t, "N1", "l1"),
 	}, ptr.Uint(1), []*fleet.MDMWindowsConfigProfile{
 		withTeamID(windowsConfigProfileForTest(t, "N1", "l1"), 1),
-	})
+	}, true)
 	profTm1N1 := getProfileByTeamAndName(ptr.Uint(1), "N1")
 
 	// apply single profile set for no-team
@@ -2072,7 +2118,7 @@ func testBatchSetMDMWindowsProfiles(t *testing.T, ds *Datastore) {
 		windowsConfigProfileForTest(t, "N1", "l1"),
 	}, nil, []*fleet.MDMWindowsConfigProfile{
 		windowsConfigProfileForTest(t, "N1", "l1"),
-	})
+	}, true)
 
 	// wait a second to ensure timestamps in the DB change
 	time.Sleep(time.Second)
@@ -2084,7 +2130,7 @@ func testBatchSetMDMWindowsProfiles(t *testing.T, ds *Datastore) {
 	}, ptr.Uint(1), []*fleet.MDMWindowsConfigProfile{
 		withUploadedAt(withTeamID(windowsConfigProfileForTest(t, "N1", "l1"), 1), profTm1N1.UploadedAt),
 		withTeamID(windowsConfigProfileForTest(t, "N2", "l2"), 1),
-	})
+	}, true)
 	// uuid for N1-I1 is unchanged
 	require.Equal(t, mTm1["I1"], mTm1b["I1"])
 	profTm1N2 := getProfileByTeamAndName(ptr.Uint(1), "N2")
@@ -2102,7 +2148,7 @@ func testBatchSetMDMWindowsProfiles(t *testing.T, ds *Datastore) {
 		withTeamID(windowsConfigProfileForTest(t, "N1", "l1b"), 1),
 		withUploadedAt(withTeamID(windowsConfigProfileForTest(t, "N2", "l2"), 1), profTm1N2.UploadedAt),
 		withTeamID(windowsConfigProfileForTest(t, "N3", "l3"), 1),
-	})
+	}, true)
 	// uuid for N1-I1 is unchanged
 	require.Equal(t, mTm1b["I1"], mTm1c["I1"])
 	// uuid for N2-I2 is unchanged
@@ -2119,10 +2165,19 @@ func testBatchSetMDMWindowsProfiles(t *testing.T, ds *Datastore) {
 	}, nil, []*fleet.MDMWindowsConfigProfile{
 		windowsConfigProfileForTest(t, "N4", "l4"),
 		windowsConfigProfileForTest(t, "N5", "l5"),
-	})
+	}, true)
+
+	// apply the same thing again -- nothing updated
+	applyAndExpect([]*fleet.MDMWindowsConfigProfile{
+		windowsConfigProfileForTest(t, "N4", "l4"),
+		windowsConfigProfileForTest(t, "N5", "l5"),
+	}, nil, []*fleet.MDMWindowsConfigProfile{
+		windowsConfigProfileForTest(t, "N4", "l4"),
+		windowsConfigProfileForTest(t, "N5", "l5"),
+	}, false)
 
 	// clear profiles for tm1
-	applyAndExpect(nil, ptr.Uint(1), nil)
+	applyAndExpect(nil, ptr.Uint(1), nil, true)
 }
 
 // if the label name starts with "exclude-", the label is considered an "exclude-any", otherwise
diff --git a/server/datastore/mysql/migrations/tables/20220915165115_AppleMDMTables.go b/server/datastore/mysql/migrations/tables/20220915165115_AppleMDMTables.go
index 6c4916ab5b..cc8ecaedda 100644
--- a/server/datastore/mysql/migrations/tables/20220915165115_AppleMDMTables.go
+++ b/server/datastore/mysql/migrations/tables/20220915165115_AppleMDMTables.go
@@ -29,13 +29,13 @@ func Up_20220915165115(tx *sql.Tx) error {
 	// Apply MDM Core schema.
 	_, err = tx.Exec(nanoSchema)
 	if err != nil {
-		return fmt.Errorf("failed to apply nanomdm schema: %w", err)
+		return fmt.Errorf("failed to apply nanomdm core schema: %w", err)
 	}
 
 	// Apply MDM DEP schema.
 	_, err = tx.Exec(depSchema)
 	if err != nil {
-		return fmt.Errorf("failed to apply nanomdm schema: %w", err)
+		return fmt.Errorf("failed to apply nanomdm dep schema: %w", err)
 	}
 
 	// Add Fleet domain tables.
diff --git a/server/datastore/mysql/migrations/tables/20220915165115_AppleMDMTables_nanomdm.sql b/server/datastore/mysql/migrations/tables/20220915165115_AppleMDMTables_nanomdm.sql
index 1b058459fb..d446aa5e7d 100644
--- a/server/datastore/mysql/migrations/tables/20220915165115_AppleMDMTables_nanomdm.sql
+++ b/server/datastore/mysql/migrations/tables/20220915165115_AppleMDMTables_nanomdm.sql
@@ -79,6 +79,7 @@ CREATE TABLE nano_users (
     CHECK (user_authenticate_digest IS NULL OR user_authenticate_digest != '')
 );
 
+ALTER TABLE nano_users ADD CONSTRAINT idx_unique_id UNIQUE (id);
 
 /* This table represents enrollments which are an amalgamation of
  * both device and user enrollments.
diff --git a/server/datastore/mysql/migrations/tables/20240730374423_AddPlatformToVPPApps.go b/server/datastore/mysql/migrations/tables/20240730374423_AddPlatformToVPPApps.go
index cff1b47efe..71bb7fa129 100644
--- a/server/datastore/mysql/migrations/tables/20240730374423_AddPlatformToVPPApps.go
+++ b/server/datastore/mysql/migrations/tables/20240730374423_AddPlatformToVPPApps.go
@@ -28,6 +28,19 @@ func Up_20240730374423(tx *sql.Tx) error {
 		return fmt.Errorf("updating platform in vpp_apps: %w", err)
 	}
 
+	// Drop foreign keys first so they don't interfere with updating primary key.
+	_, err = tx.Exec(`ALTER TABLE vpp_apps_teams DROP FOREIGN KEY vpp_apps_teams_ibfk_1`)
+	if err != nil {
+		return fmt.Errorf("updating foreign key in vpp_apps: %w", err)
+	}
+
+	// We drop this foreign key in this migration (for MySQL 8.4). It will be added back in the next migration.
+	_, err = tx.Exec(`
+		ALTER TABLE host_vpp_software_installs DROP FOREIGN KEY host_vpp_software_installs_ibfk_2`)
+	if err != nil {
+		return fmt.Errorf("drop foreign key in host_vpp_software_installs: %w", err)
+	}
+
 	_, err = tx.Exec(`ALTER TABLE vpp_apps DROP PRIMARY KEY, ADD PRIMARY KEY (adam_id, platform)`)
 	if err != nil {
 		return fmt.Errorf("updating primary key in vpp_apps: %w", err)
@@ -57,7 +70,7 @@ func Up_20240730374423(tx *sql.Tx) error {
 	if err != nil {
 		return fmt.Errorf("updating key in vpp_apps: %w", err)
 	}
-	_, err = tx.Exec(`ALTER TABLE vpp_apps_teams DROP FOREIGN KEY vpp_apps_teams_ibfk_1, ADD FOREIGN KEY vpp_apps_teams_ibfk_1 (adam_id, platform) REFERENCES vpp_apps (adam_id, platform) ON DELETE CASCADE`)
+	_, err = tx.Exec(`ALTER TABLE vpp_apps_teams ADD FOREIGN KEY vpp_apps_teams_ibfk_3 (adam_id, platform) REFERENCES vpp_apps (adam_id, platform) ON DELETE CASCADE`)
 	if err != nil {
 		return fmt.Errorf("updating foreign key in vpp_apps: %w", err)
 	}
diff --git a/server/datastore/mysql/migrations/tables/20240801115359_AddPlatformToHostVPPSoftwareInstalls.go b/server/datastore/mysql/migrations/tables/20240801115359_AddPlatformToHostVPPSoftwareInstalls.go
index 6b70578339..aadd49fe80 100644
--- a/server/datastore/mysql/migrations/tables/20240801115359_AddPlatformToHostVPPSoftwareInstalls.go
+++ b/server/datastore/mysql/migrations/tables/20240801115359_AddPlatformToHostVPPSoftwareInstalls.go
@@ -45,9 +45,16 @@ func Up_20240801115359(tx *sql.Tx) error {
 	if err != nil {
 		return fmt.Errorf("updating key in host_vpp_software_installs: %w", err)
 	}
+	if indexExistsTx(tx, "host_vpp_software_installs", "host_vpp_software_installs_ibfk_2") {
+		_, err = tx.Exec(`
+		ALTER TABLE host_vpp_software_installs DROP FOREIGN KEY host_vpp_software_installs_ibfk_2`)
+		if err != nil {
+			return fmt.Errorf("updating foreign key in host_vpp_software_installs: %w", err)
+		}
+	}
 	_, err = tx.Exec(`
-		ALTER TABLE host_vpp_software_installs DROP FOREIGN KEY host_vpp_software_installs_ibfk_2,
-			ADD FOREIGN KEY host_vpp_software_installs_ibfk_3 (adam_id, platform) REFERENCES vpp_apps (adam_id, platform) ON DELETE CASCADE`)
+		ALTER TABLE host_vpp_software_installs
+			ADD CONSTRAINT host_vpp_software_installs_ibfk_3 FOREIGN KEY (adam_id, platform) REFERENCES vpp_apps (adam_id, platform) ON DELETE CASCADE`)
 	if err != nil {
 		return fmt.Errorf("updating foreign key in host_vpp_software_installs: %w", err)
 	}
diff --git a/server/datastore/mysql/migrations/tables/20240729120947_AddSoftwareInstallResultDeletedAt.go b/server/datastore/mysql/migrations/tables/20240802101043_AddSoftwareInstallResultDeletedAt.go
similarity index 75%
rename from server/datastore/mysql/migrations/tables/20240729120947_AddSoftwareInstallResultDeletedAt.go
rename to server/datastore/mysql/migrations/tables/20240802101043_AddSoftwareInstallResultDeletedAt.go
index bd4219364d..b5f7e79213 100644
--- a/server/datastore/mysql/migrations/tables/20240729120947_AddSoftwareInstallResultDeletedAt.go
+++ b/server/datastore/mysql/migrations/tables/20240802101043_AddSoftwareInstallResultDeletedAt.go
@@ -6,10 +6,11 @@ import (
 )
 
 func init() {
-	MigrationClient.AddMigration(Up_20240729120947, Down_20240729120947)
+	MigrationClient.AddMigration(Up_20240802101043, Down_20240802101043)
 }
 
-func Up_20240729120947(tx *sql.Tx) error {
+// This is a new copy of a previous out-of-order migration
+func Up_20240802101043(tx *sql.Tx) error {
 	_, err := tx.Exec("ALTER TABLE host_software_installs ADD COLUMN host_deleted_at timestamp NULL DEFAULT NULL")
 	if err != nil {
 		return fmt.Errorf("failed to create host_deleted_at column on host_software_installs table: %w", err)
@@ -33,6 +34,6 @@ AND
 	return nil
 }
 
-func Down_20240729120947(tx *sql.Tx) error {
+func Down_20240802101043(tx *sql.Tx) error {
 	return nil
 }
diff --git a/server/datastore/mysql/migrations/tables/20240802113716_UpdateSoftwareGitopsConfig.go b/server/datastore/mysql/migrations/tables/20240802113716_UpdateSoftwareGitopsConfig.go
new file mode 100644
index 0000000000..c91e99099e
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240802113716_UpdateSoftwareGitopsConfig.go
@@ -0,0 +1,67 @@
+package tables
+
+import (
+	"database/sql"
+	"encoding/json"
+	"fmt"
+	"reflect"
+
+	"github.com/jmoiron/sqlx"
+	"github.com/jmoiron/sqlx/reflectx"
+)
+
+func init() {
+	MigrationClient.AddMigration(Up_20240802113716, Down_20240802113716)
+}
+
+func Up_20240802113716(tx *sql.Tx) error {
+	txx := sqlx.Tx{Tx: tx, Mapper: reflectx.NewMapperFunc("db", sqlx.NameMapper)}
+
+	type row struct {
+		Config json.RawMessage `db:"config"`
+		ID     uint            `db:"id"`
+	}
+
+	var rows []row
+	if err := txx.Select(&rows, "SELECT config, id FROM teams"); err != nil {
+		return fmt.Errorf("selecting team configs: %w", err)
+	}
+
+	for _, r := range rows {
+
+		config := make(map[string]any)
+		if err := json.Unmarshal(r.Config, &config); err != nil {
+			return fmt.Errorf("unmarshal team config: %w", err)
+		}
+		softwareData, ok := config["software"]
+		if !ok {
+			continue
+		}
+
+		rt := reflect.TypeOf(config["software"])
+		if rt == nil {
+			continue
+		}
+
+		if rt.Kind() == reflect.Slice {
+			// then we have an older config without the new fields
+			// Note: we are setting the new key to be whatever the old key was (if it was null, then
+			// it's set to null, if it was empty array, then it's set to empty array)
+			config["software"] = map[string]any{"packages": softwareData}
+			b, err := json.Marshal(config)
+			if err != nil {
+				return fmt.Errorf("marshal updated team config: %w", err)
+			}
+			if _, err := tx.Exec(`UPDATE teams SET config = ? WHERE id = ?`, b, r.ID); err != nil {
+				return fmt.Errorf("updating config for team %d: %w", r.ID, err)
+			}
+		}
+
+	}
+
+	return nil
+}
+
+func Down_20240802113716(tx *sql.Tx) error {
+	return nil
+}
diff --git a/server/datastore/mysql/migrations/tables/20240802113716_UpdateSoftwareGitopsConfig_test.go b/server/datastore/mysql/migrations/tables/20240802113716_UpdateSoftwareGitopsConfig_test.go
new file mode 100644
index 0000000000..0bd2edcab4
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240802113716_UpdateSoftwareGitopsConfig_test.go
@@ -0,0 +1,268 @@
+package tables
+
+import (
+	"testing"
+
+	"github.com/fleetdm/fleet/v4/server/fleet"
+	"github.com/stretchr/testify/require"
+)
+
+func TestUp_20240802113716(t *testing.T) {
+	db := applyUpToPrev(t)
+
+	badCfg := `
+{
+  "mdm": {
+    "ios_updates": {
+      "deadline": "",
+      "minimum_version": ""
+    },
+    "macos_setup": {
+      "bootstrap_package": "",
+      "macos_setup_assistant": "",
+      "enable_end_user_authentication": false,
+      "enable_release_device_manually": false
+    },
+    "macos_updates": {
+      "deadline": "",
+      "minimum_version": ""
+    },
+    "ipados_updates": {
+      "deadline": "",
+      "minimum_version": ""
+    },
+    "macos_settings": {
+      "custom_settings": []
+    },
+    "windows_updates": {
+      "deadline_days": null,
+      "grace_period_days": null
+    },
+    "windows_settings": {
+      "custom_settings": []
+    },
+    "enable_disk_encryption": false
+  },
+  "scripts": [],
+  "features": {
+    "enable_host_users": true,
+    "enable_software_inventory": true
+  },
+  "software": [
+      {
+        "url": "http://localhost:8100/1Password.pkg",
+        "self_service": true,
+        "install_script": {
+          "path": ""
+        },
+        "pre_install_query": {
+          "path": ""
+        },
+        "post_install_script": {
+          "path": ""
+        }
+      }
+    ],
+  "integrations": {
+    "jira": null,
+    "zendesk": null,
+    "google_calendar": {
+      "webhook_url": "",
+      "enable_calendar_events": false
+    }
+  },
+  "webhook_settings": {
+    "host_status_webhook": {
+      "days_count": 0,
+      "destination_url": "",
+      "host_percentage": 0,
+      "enable_host_status_webhook": false
+    },
+    "failing_policies_webhook": {
+      "policy_ids": null,
+      "destination_url": "",
+      "host_batch_size": 0,
+      "enable_failing_policies_webhook": false
+    }
+  },
+  "host_expiry_settings": {
+    "host_expiry_window": 30,
+    "host_expiry_enabled": true
+  }
+}
+
+`
+
+	badCfgEmptyArr := `
+{
+  "mdm": {
+    "ios_updates": {
+      "deadline": "",
+      "minimum_version": ""
+    },
+    "macos_setup": {
+      "bootstrap_package": "",
+      "macos_setup_assistant": "",
+      "enable_end_user_authentication": false,
+      "enable_release_device_manually": false
+    },
+    "macos_updates": {
+      "deadline": "",
+      "minimum_version": ""
+    },
+    "ipados_updates": {
+      "deadline": "",
+      "minimum_version": ""
+    },
+    "macos_settings": {
+      "custom_settings": []
+    },
+    "windows_updates": {
+      "deadline_days": null,
+      "grace_period_days": null
+    },
+    "windows_settings": {
+      "custom_settings": []
+    },
+    "enable_disk_encryption": false
+  },
+  "scripts": [],
+  "features": {
+    "enable_host_users": true,
+    "enable_software_inventory": true
+  },
+  "software": [],
+  "integrations": {
+    "jira": null,
+    "zendesk": null,
+    "google_calendar": {
+      "webhook_url": "",
+      "enable_calendar_events": false
+    }
+  },
+  "webhook_settings": {
+    "host_status_webhook": {
+      "days_count": 0,
+      "destination_url": "",
+      "host_percentage": 0,
+      "enable_host_status_webhook": false
+    },
+    "failing_policies_webhook": {
+      "policy_ids": null,
+      "destination_url": "",
+      "host_batch_size": 0,
+      "enable_failing_policies_webhook": false
+    }
+  },
+  "host_expiry_settings": {
+    "host_expiry_window": 30,
+    "host_expiry_enabled": true
+  }
+}
+`
+
+	badCfgNoSoftwareField := `
+{
+  "mdm": {
+    "ios_updates": {
+      "deadline": "",
+      "minimum_version": ""
+    },
+    "macos_setup": {
+      "bootstrap_package": "",
+      "macos_setup_assistant": "",
+      "enable_end_user_authentication": false,
+      "enable_release_device_manually": false
+    },
+    "macos_updates": {
+      "deadline": "",
+      "minimum_version": ""
+    },
+    "ipados_updates": {
+      "deadline": "",
+      "minimum_version": ""
+    },
+    "macos_settings": {
+      "custom_settings": []
+    },
+    "windows_updates": {
+      "deadline_days": null,
+      "grace_period_days": null
+    },
+    "windows_settings": {
+      "custom_settings": []
+    },
+    "enable_disk_encryption": false
+  },
+  "scripts": [],
+  "features": {
+    "enable_host_users": true,
+    "enable_software_inventory": true
+  },
+  "integrations": {
+    "jira": null,
+    "zendesk": null,
+    "google_calendar": {
+      "webhook_url": "",
+      "enable_calendar_events": false
+    }
+  },
+  "webhook_settings": {
+    "host_status_webhook": {
+      "days_count": 0,
+      "destination_url": "",
+      "host_percentage": 0,
+      "enable_host_status_webhook": false
+    },
+    "failing_policies_webhook": {
+      "policy_ids": null,
+      "destination_url": "",
+      "host_batch_size": 0,
+      "enable_failing_policies_webhook": false
+    }
+  },
+  "host_expiry_settings": {
+    "host_expiry_window": 30,
+    "host_expiry_enabled": true
+  }
+}
+`
+
+	tid1 := execNoErrLastID(t, db, `INSERT INTO teams (name, config) VALUES (?,?)`, "team 1", badCfg)
+	tid2 := execNoErrLastID(t, db, `INSERT INTO teams (name, config) VALUES (?,?)`, "team 2", badCfgEmptyArr)
+	tid3 := execNoErrLastID(t, db, `INSERT INTO teams (name, config) VALUES (?,?)`, "team 3", badCfgNoSoftwareField)
+
+	// Apply current migration.
+	applyNext(t, db)
+
+	var team fleet.Team
+	require.NoError(t, db.Get(&team, "SELECT id, config FROM teams WHERE id = ?", tid1))
+
+	// Team with a package should see it in the new field
+	require.NotNil(t, team.Config.Software)
+	require.True(t, team.Config.Software.Packages.Set)
+	require.True(t, team.Config.Software.Packages.Valid)
+	require.Len(t, team.Config.Software.Packages.Value, 1)
+
+	require.False(t, team.Config.Software.AppStoreApps.Set)
+	require.False(t, team.Config.Software.AppStoreApps.Valid)
+	require.Len(t, team.Config.Software.AppStoreApps.Value, 0)
+
+	team = fleet.Team{}
+	require.NoError(t, db.Get(&team, "SELECT id, config FROM teams WHERE id = ?", tid2))
+
+	// Team with an empty array originally should have JSON null set for packages
+	require.NotNil(t, team.Config.Software)
+	require.True(t, team.Config.Software.Packages.Set)
+	require.True(t, team.Config.Software.Packages.Valid)
+	require.Len(t, team.Config.Software.Packages.Value, 0)
+
+	require.False(t, team.Config.Software.AppStoreApps.Set)
+	require.False(t, team.Config.Software.AppStoreApps.Valid)
+	require.Len(t, team.Config.Software.AppStoreApps.Value, 0)
+
+	team = fleet.Team{}
+	require.NoError(t, db.Get(&team, "SELECT id, config FROM teams WHERE id = ?", tid3))
+
+	require.Nil(t, team.Config.Software)
+}
diff --git a/server/datastore/mysql/migrations/tables/20240814135330_AddIndexToQueryResults.go b/server/datastore/mysql/migrations/tables/20240814135330_AddIndexToQueryResults.go
new file mode 100644
index 0000000000..6a21013806
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240814135330_AddIndexToQueryResults.go
@@ -0,0 +1,22 @@
+package tables
+
+import (
+	"database/sql"
+	"fmt"
+)
+
+func init() {
+	MigrationClient.AddMigration(Up_20240814135330, Down_20240814135330)
+}
+
+func Up_20240814135330(tx *sql.Tx) error {
+	// This index optimizes finding the most recent query result for a given query and host
+	if _, err := tx.Exec(`ALTER TABLE query_results ADD INDEX idx_query_id_host_id_last_fetched (query_id, host_id, last_fetched)`); err != nil {
+		return fmt.Errorf("creating query_results index: %w", err)
+	}
+	return nil
+}
+
+func Down_20240814135330(_ *sql.Tx) error {
+	return nil
+}
diff --git a/server/datastore/mysql/migrations/tables/20240814135330_AddIndexToQueryResults_test.go b/server/datastore/mysql/migrations/tables/20240814135330_AddIndexToQueryResults_test.go
new file mode 100644
index 0000000000..74afe0c49b
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240814135330_AddIndexToQueryResults_test.go
@@ -0,0 +1,27 @@
+package tables
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestUp_20240814135330(t *testing.T) {
+	db := applyUpToPrev(t)
+
+	// Apply current migration
+	applyNext(t, db)
+
+	// Check if the index exists
+	var indexExists bool
+	err := db.QueryRow(`
+		SELECT 1 FROM information_schema.statistics
+		WHERE table_schema = DATABASE()
+		AND table_name = 'query_results'
+		AND index_name = 'idx_query_id_host_id_last_fetched'
+	`).Scan(&indexExists)
+
+	require.NoError(t, err)
+	require.True(t, indexExists, "Index idx_query_id_host_id_last_fetched should exist")
+
+}
diff --git a/server/datastore/mysql/migrations/tables/20240815000000_AddJobsIndex.go b/server/datastore/mysql/migrations/tables/20240815000000_AddJobsIndex.go
new file mode 100644
index 0000000000..5af70f0154
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240815000000_AddJobsIndex.go
@@ -0,0 +1,21 @@
+package tables
+
+import (
+	"database/sql"
+	"fmt"
+)
+
+func init() {
+	MigrationClient.AddMigration(Up_20240815000000, Down_20240815000000)
+}
+
+func Up_20240815000000(tx *sql.Tx) error {
+	if _, err := tx.Exec(`CREATE INDEX idx_jobs_state_not_before_updated_at ON jobs (state, not_before, updated_at);`); err != nil {
+		return fmt.Errorf("creating jobs index: %w", err)
+	}
+	return nil
+}
+
+func Down_20240815000000(tx *sql.Tx) error {
+	return nil
+}
diff --git a/server/datastore/mysql/migrations/tables/20240815000000_AddJobsIndex_test.go b/server/datastore/mysql/migrations/tables/20240815000000_AddJobsIndex_test.go
new file mode 100644
index 0000000000..bc923ad3a6
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240815000000_AddJobsIndex_test.go
@@ -0,0 +1,27 @@
+package tables
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestUp_20240815000000(t *testing.T) {
+	db := applyUpToPrev(t)
+
+	// Apply current migration
+	applyNext(t, db)
+
+	// Check if the index exists
+	var indexExists bool
+	err := db.QueryRow(`
+		SELECT 1 FROM information_schema.statistics
+		WHERE table_schema = DATABASE()
+		AND table_name = 'jobs'
+		AND index_name = 'idx_jobs_state_not_before_updated_at'
+	`).Scan(&indexExists)
+
+	require.NoError(t, err)
+	require.True(t, indexExists, "Index idx_jobs_state_not_before_updated_at should exist")
+
+}
diff --git a/server/datastore/mysql/migrations/tables/20240815000001_AddSelfServiceToVPPAppsTeams.go b/server/datastore/mysql/migrations/tables/20240815000001_AddSelfServiceToVPPAppsTeams.go
new file mode 100644
index 0000000000..83333db387
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240815000001_AddSelfServiceToVPPAppsTeams.go
@@ -0,0 +1,21 @@
+package tables
+
+import (
+	"database/sql"
+	"fmt"
+)
+
+func init() {
+	MigrationClient.AddMigration(Up_20240815000001, Down_20240815000001)
+}
+
+func Up_20240815000001(tx *sql.Tx) error {
+	if _, err := tx.Exec("ALTER TABLE vpp_apps_teams ADD COLUMN self_service bool NOT NULL DEFAULT false"); err != nil {
+		return fmt.Errorf("Failed to add self_service to vpp_apps_teams: %w", err)
+	}
+	return nil
+}
+
+func Down_20240815000001(tx *sql.Tx) error {
+	return nil
+}
diff --git a/server/datastore/mysql/migrations/tables/20240816103247_AddIndexToNanoUsers.go b/server/datastore/mysql/migrations/tables/20240816103247_AddIndexToNanoUsers.go
new file mode 100644
index 0000000000..28ffb331ec
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240816103247_AddIndexToNanoUsers.go
@@ -0,0 +1,27 @@
+package tables
+
+import (
+	"database/sql"
+	"fmt"
+)
+
+func init() {
+	MigrationClient.AddMigration(Up_20240816103247, Down_20240816103247)
+}
+
+func Up_20240816103247(tx *sql.Tx) error {
+
+	// This constraint is required for MySQL 8.4.2 because nano_enrollments foreign key expects nano_users.id to be unique.
+	if !indexExistsTx(tx, "nano_users", "idx_unique_id") {
+		_, err := tx.Exec(`ALTER TABLE nano_users ADD CONSTRAINT idx_unique_id UNIQUE (id)`)
+		if err != nil {
+			return fmt.Errorf("adding unique index to nano_users: %w", err)
+		}
+	}
+
+	return nil
+}
+
+func Down_20240816103247(tx *sql.Tx) error {
+	return nil
+}
diff --git a/server/datastore/mysql/migrations/tables/20240816103247_AddIndexToNanoUsers_test.go b/server/datastore/mysql/migrations/tables/20240816103247_AddIndexToNanoUsers_test.go
new file mode 100644
index 0000000000..f63bcf2995
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240816103247_AddIndexToNanoUsers_test.go
@@ -0,0 +1,26 @@
+package tables
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestUp_20240816103247(t *testing.T) {
+	db := applyUpToPrev(t)
+
+	// Apply current migration
+	applyNext(t, db)
+
+	// Check if the index exists
+	var indexExists bool
+	err := db.QueryRow(`
+		SELECT 1 FROM information_schema.statistics
+		WHERE table_schema = DATABASE()
+		AND table_name = 'nano_users'
+		AND index_name = 'idx_unique_id'
+	`).Scan(&indexExists)
+
+	require.NoError(t, err)
+	require.True(t, indexExists, "Index idx_unique_id should exist")
+}
diff --git a/server/datastore/mysql/migrations/tables/20240820091218_AddHostMDMCommands.go b/server/datastore/mysql/migrations/tables/20240820091218_AddHostMDMCommands.go
new file mode 100644
index 0000000000..5ab9a7e791
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240820091218_AddHostMDMCommands.go
@@ -0,0 +1,37 @@
+package tables
+
+import (
+	"database/sql"
+	"fmt"
+)
+
+func init() {
+	MigrationClient.AddMigration(Up_20240820091218, Down_20240820091218)
+}
+
+func Up_20240820091218(tx *sql.Tx) error {
+	if tableExists(tx, "host_mdm_commands") {
+		return nil
+	}
+
+	_, err := tx.Exec(`
+-- This table is used to track the MDM commands that have been sent to a host.
+-- For example, if 'refetch apps' command was already sent to a host, we don't want
+-- to send it again.
+CREATE TABLE host_mdm_commands (
+	host_id int unsigned NOT NULL,
+	command_type VARCHAR(31) COLLATE utf8mb4_unicode_ci NOT NULL,
+	created_at TIMESTAMP(6) DEFAULT CURRENT_TIMESTAMP(6),
+	updated_at TIMESTAMP(6) NULL DEFAULT CURRENT_TIMESTAMP(6) ON UPDATE CURRENT_TIMESTAMP(6),
+	PRIMARY KEY (host_id, command_type)
+)`)
+	if err != nil {
+		return fmt.Errorf("failed to create table host_mdm_commands: %w", err)
+	}
+
+	return nil
+}
+
+func Down_20240820091218(_ *sql.Tx) error {
+	return nil
+}
diff --git a/server/datastore/mysql/migrations/tables/20240826111228_AdjustHostIndexes.go b/server/datastore/mysql/migrations/tables/20240826111228_AdjustHostIndexes.go
new file mode 100644
index 0000000000..e6ceeae9d1
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240826111228_AdjustHostIndexes.go
@@ -0,0 +1,41 @@
+package tables
+
+import (
+	"database/sql"
+	"fmt"
+)
+
+func init() {
+	MigrationClient.AddMigration(Up_20240826111228, Down_20240826111228)
+}
+
+func Up_20240826111228(tx *sql.Tx) error {
+	_, err := tx.Exec(`
+	    ALTER TABLE hosts
+	    DROP INDEX host_ip_mac_search
+	`)
+	if err != nil {
+		return fmt.Errorf("dropping host_ip_mac_search index: %w", err)
+	}
+
+	_, err = tx.Exec(`
+	    ALTER TABLE hosts
+	    DROP INDEX hosts_search
+	`)
+	if err != nil {
+		return fmt.Errorf("dropping hosts_search index: %w", err)
+	}
+
+	_, err = tx.Exec(`
+	    ALTER TABLE hosts
+	    ADD INDEX idx_hosts_uuid (uuid);
+	`)
+	if err != nil {
+		return fmt.Errorf("adding hosts_uuid index: %w", err)
+	}
+	return nil
+}
+
+func Down_20240826111228(tx *sql.Tx) error {
+	return nil
+}
diff --git a/server/datastore/mysql/migrations/tables/20240826160025_AddRemovedToInstalls.go b/server/datastore/mysql/migrations/tables/20240826160025_AddRemovedToInstalls.go
new file mode 100644
index 0000000000..6a99216cac
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240826160025_AddRemovedToInstalls.go
@@ -0,0 +1,103 @@
+package tables
+
+import (
+	"database/sql"
+	"fmt"
+
+	"github.com/jmoiron/sqlx"
+	"github.com/jmoiron/sqlx/reflectx"
+)
+
+func init() {
+	MigrationClient.AddMigration(Up_20240826160025, Down_20240826160025)
+}
+
+func Up_20240826160025(tx *sql.Tx) error {
+	if !columnExists(tx, "host_software_installs", "removed") {
+		if _, err := tx.Exec("ALTER TABLE host_software_installs ADD COLUMN removed TINYINT NOT NULL DEFAULT 0"); err != nil {
+			return fmt.Errorf("failed to add removed to host_software_installs: %w", err)
+		}
+	}
+
+	if !columnExists(tx, "host_vpp_software_installs", "removed") {
+		if _, err := tx.Exec("ALTER TABLE host_vpp_software_installs ADD COLUMN removed TINYINT NOT NULL DEFAULT 0"); err != nil {
+			return fmt.Errorf("failed to add removed to host_vpp_software_installs: %w", err)
+		}
+	}
+
+	// Mark software installs as removed if the software is no longer installed on the host.
+	// Note that some software never shows up in software table after being installed (because software detail query can't find it).
+	// So, we will only mark software as removed if it shows up in the software table (for another host).
+	getPackagesRemovedStmt := `
+	SELECT DISTINCT hsi.id
+	FROM host_software_installs hsi
+	INNER JOIN software_installers si ON hsi.software_installer_id = si.id
+	INNER JOIN software_titles st ON si.title_id = st.id
+	-- software is installed on some host
+	INNER JOIN software s ON s.title_id = st.id
+	INNER JOIN hosts h ON hsi.host_id = h.id
+	WHERE NOT EXISTS (
+		-- software is not installed on this specific host
+		SELECT 1 FROM host_software hs
+		INNER JOIN software s2 ON hs.software_id = s2.id AND s2.title_id = st.id
+		WHERE hs.host_id = hsi.host_id
+	) AND (
+		-- software status is: Installed
+		(hsi.post_install_script_exit_code IS NOT NULL AND hsi.post_install_script_exit_code = 0) OR
+		(hsi.post_install_script_exit_code IS NULL AND hsi.install_script_exit_code IS NOT NULL AND hsi.install_script_exit_code = 0)
+	) AND
+		-- software was refetched after it was installed
+		hsi.updated_at < h.detail_updated_at
+`
+	var ids []uint
+	txx := sqlx.Tx{Tx: tx, Mapper: reflectx.NewMapperFunc("db", sqlx.NameMapper)}
+	if err := txx.Select(&ids, getPackagesRemovedStmt); err != nil {
+		return fmt.Errorf("failed to find host_software_installs to remove: %w", err)
+	}
+	if len(ids) > 0 {
+		stmt, args, err := sqlx.In("UPDATE host_software_installs SET removed = 1	WHERE id IN (?)", ids)
+		if err != nil {
+			return fmt.Errorf("failed to expand slice value for host_software_installs: %w", err)
+		}
+		if _, err := tx.Exec(stmt, args...); err != nil {
+			return fmt.Errorf("failed to mark host_software_installs as removed: %w", err)
+		}
+	}
+
+	// Mark VPP installs as removed if the software is no longer installed on the host.
+	getVppRemovedStmt := `
+	SELECT DISTINCT hvsi.id
+	FROM host_vpp_software_installs hvsi
+	INNER JOIN vpp_apps vap ON hvsi.adam_id = vap.adam_id AND hvsi.platform = vap.platform
+	INNER JOIN software_titles st ON vap.title_id = st.id
+	INNER JOIN hosts h ON hvsi.host_id = h.id
+	WHERE NOT EXISTS (
+		-- software is not installed on this specific host
+		SELECT 1 FROM host_software hs
+		INNER JOIN software s2 ON hs.software_id = s2.id AND s2.title_id = st.id
+		WHERE hs.host_id = hvsi.host_id
+	) AND
+		-- software was refetched after it was installed
+		hvsi.updated_at < h.detail_updated_at
+`
+
+	var vppIDs []uint
+	if err := txx.Select(&vppIDs, getVppRemovedStmt); err != nil {
+		return fmt.Errorf("failed to find host_vpp_software_installs to remove: %w", err)
+	}
+	if len(vppIDs) > 0 {
+		stmt, args, err := sqlx.In("UPDATE host_vpp_software_installs SET removed = 1	WHERE id IN (?)", vppIDs)
+		if err != nil {
+			return fmt.Errorf("failed to expand slice value for host_vpp_software_installs: %w", err)
+		}
+		if _, err := tx.Exec(stmt, args...); err != nil {
+			return fmt.Errorf("failed to mark host_vpp_software_installs as removed: %w", err)
+		}
+	}
+
+	return nil
+}
+
+func Down_20240826160025(_ *sql.Tx) error {
+	return nil
+}
diff --git a/server/datastore/mysql/migrations/tables/20240826160025_AddRemovedToInstalls_test.go b/server/datastore/mysql/migrations/tables/20240826160025_AddRemovedToInstalls_test.go
new file mode 100644
index 0000000000..1077183917
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240826160025_AddRemovedToInstalls_test.go
@@ -0,0 +1,142 @@
+package tables
+
+import (
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestUp_20240826160025(t *testing.T) {
+	db := applyUpToPrev(t)
+
+	// Create user
+	u1 := execNoErrLastID(t, db, `INSERT INTO users (name, email, password, salt) VALUES (?, ?, ?, ?)`, "u1", "u1@b.c", "1234", "salt")
+	// Create host
+	insertHostStmt := `
+		INSERT INTO hosts (
+			hostname, uuid, platform, osquery_version, os_version, build, platform_like, code_name,
+			cpu_type, cpu_subtype, cpu_brand, hardware_vendor, hardware_model, hardware_version,
+			hardware_serial, computer_name, team_id
+		) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+	`
+	hostName := "Dummy Hostname"
+	hostUUID := "12345678-1234-1234-1234-123456789012"
+	hostPlatform := "ios"
+	osqueryVer := "5.9.1"
+	osVersion := "Windows 10"
+	buildVersion := "10.0.19042.1234"
+	platformLike := "apple"
+	codeName := "20H2"
+	cpuType := "x86_64"
+	cpuSubtype := "x86_64"
+	cpuBrand := "Intel"
+	hwVendor := "Dell Inc."
+	hwModel := "OptiPlex 7090"
+	hwVersion := "1.0"
+	hwSerial := "ABCDEFGHIJ"
+	computerName := "DESKTOP-TEST"
+
+	hostID1 := execNoErrLastID(t, db, insertHostStmt, hostName, hostUUID, hostPlatform, osqueryVer,
+		osVersion, buildVersion, platformLike, codeName, cpuType, cpuSubtype, cpuBrand, hwVendor, hwModel, hwVersion, hwSerial,
+		computerName, nil)
+	hostID2 := execNoErrLastID(t, db, insertHostStmt, hostName, hostUUID, hostPlatform, osqueryVer,
+		osVersion, buildVersion, platformLike, codeName, cpuType, cpuSubtype, cpuBrand, hwVendor, hwModel, hwVersion, hwSerial,
+		computerName, nil)
+
+	// Insert data into software_titles
+	title1 := execNoErrLastID(t, db, "INSERT INTO software_titles (name, source, browser) VALUES (?, ?, ?)", "sw1", "src1", "")
+	title2 := execNoErrLastID(t, db, "INSERT INTO software_titles (name, source, browser) VALUES (?, ?, ?)", "sw2", "src2", "")
+	title3 := execNoErrLastID(t, db, "INSERT INTO software_titles (name, source, browser) VALUES (?, ?, ?)", "sw3", "src3", "")
+	title4 := execNoErrLastID(t, db, "INSERT INTO software_titles (name, source, browser) VALUES (?, ?, ?)", "sw4", "src4", "")
+
+	// Insert software
+	const insertStmt = `INSERT INTO software
+		(name, version, source, browser, checksum, title_id)
+	VALUES
+		(?, ?, ?, ?, ?, ?)`
+	execNoErr(t, db, insertStmt, "sw1", "1.0", "src1", "", "1", title1)
+	sw2 := execNoErrLastID(t, db, insertStmt, "sw2", "2.0", "src2", "", "2", title2)
+	sw3 := execNoErrLastID(t, db, insertStmt, "sw3", "3.0", "src3", "", "3", title3)
+	// sw4 is not in software table
+
+	// Insert host_software
+	execNoErr(t, db, "INSERT INTO host_software (host_id, software_id) VALUES (?, ?)", hostID2, sw2)
+	execNoErr(t, db, "INSERT INTO host_software (host_id, software_id) VALUES (?, ?)", hostID2, sw3)
+
+	// Create package apps
+	// 1 app will remain because it is not in the software table (sw1)
+	// 1 app will remain because it is still installed
+	// 1 app will be removed on host 1 but remain on host 2
+	execNoErr(t, db, `INSERT INTO script_contents (id, md5_checksum, contents) VALUES (1, 'checksum', 'script content')`)
+	siStmt := `INSERT INTO software_installers
+	    (title_id, filename, version, platform, install_script_content_id, storage_id)
+	  VALUES
+		(?,?,?,?,?,?)`
+	si1 := execNoErrLastID(t, db, siStmt, title1, "sw1-installer.pkg", "1.2", hostPlatform, 1, "storage-id1")
+	si2 := execNoErrLastID(t, db, siStmt, title2, "sw2-installer.pkg", "2.2", hostPlatform, 1, "storage-id2")
+	si3 := execNoErrLastID(t, db, siStmt, title3, "sw3-installer.pkg", "3.2", hostPlatform, 1, "storage-id3")
+	si4 := execNoErrLastID(t, db, siStmt, title4, "sw3-installer.pkg", "4.2", hostPlatform, 1, "storage-id4")
+
+	hsiStmt := `
+	INSERT INTO host_software_installs (
+		host_id,
+		execution_id,
+		software_installer_id,
+		install_script_exit_code,
+		post_install_script_exit_code
+	) VALUES (?, ?, ?, ?, ?)`
+	hsi1 := execNoErrLastID(t, db, hsiStmt, hostID1, "execution-id1", si1, 0, nil)       // will be removed
+	hsi2_1 := execNoErrLastID(t, db, hsiStmt, hostID2, "execution-id2_1", si2, nil, nil) // remains because it is still being installed
+	hsi2_2 := execNoErrLastID(t, db, hsiStmt, hostID2, "execution-id2_2", si2, 0, nil)
+	hsi3_1 := execNoErrLastID(t, db, hsiStmt, hostID1, "execution-id3_1", si3, 0, 0) // will be removed because it is not in host_software
+	hsi3_2 := execNoErrLastID(t, db, hsiStmt, hostID2, "execution-id3_2", si3, 0, 0)
+	hsi4 := execNoErrLastID(t, db, hsiStmt, hostID1, "execution-id4", si4, 0, 0) // remains because it is not in software table
+
+	// Create VPP apps -- 1 VPP app will be removed, 1 will remain
+	adamID1 := "removed"
+	execNoErr(
+		t, db, `INSERT INTO vpp_apps (adam_id, platform, title_id) VALUES (?,?,?)`, adamID1, hostPlatform, title1,
+	)
+	adamID2 := "kept"
+	execNoErr(
+		t, db, `INSERT INTO vpp_apps (adam_id, platform, title_id) VALUES (?,?,?)`, adamID2, hostPlatform, title2,
+	)
+
+	// create VPP installs
+	hvsi1 := execNoErrLastID(t, db,
+		`INSERT INTO host_vpp_software_installs (host_id, adam_id, platform, command_uuid, user_id) VALUES (?,?,?,?,?)`,
+		hostID1, adamID1, hostPlatform, "command_uuid", u1)
+	hvsi2 := execNoErrLastID(t, db,
+		`INSERT INTO host_vpp_software_installs (host_id, adam_id, platform, command_uuid, user_id) VALUES (?,?,?,?,?)`,
+		hostID2, adamID2, hostPlatform, "command_uuid2", u1)
+
+	time.Sleep(1 * time.Second) // because we are not using max timestamp precision
+	execNoErr(t, db, `UPDATE hosts SET detail_updated_at = NOW()`)
+
+	// Apply current migration.
+	applyNext(t, db)
+	var removed bool
+
+	// Check packages
+	require.NoError(t, db.Get(&removed, `SELECT removed from host_software_installs WHERE id = ?`, hsi1))
+	assert.True(t, removed)
+	require.NoError(t, db.Get(&removed, `SELECT removed from host_software_installs WHERE id = ?`, hsi2_1))
+	assert.False(t, removed)
+	require.NoError(t, db.Get(&removed, `SELECT removed from host_software_installs WHERE id = ?`, hsi2_2))
+	assert.False(t, removed)
+	require.NoError(t, db.Get(&removed, `SELECT removed from host_software_installs WHERE id = ?`, hsi3_1))
+	assert.True(t, removed)
+	require.NoError(t, db.Get(&removed, `SELECT removed from host_software_installs WHERE id = ?`, hsi3_2))
+	assert.False(t, removed)
+	require.NoError(t, db.Get(&removed, `SELECT removed from host_software_installs WHERE id = ?`, hsi4))
+	assert.False(t, removed)
+
+	// Check VPP
+	require.NoError(t, db.Get(&removed, `SELECT removed from host_vpp_software_installs WHERE id = ?`, hvsi1))
+	assert.True(t, removed)
+	require.NoError(t, db.Get(&removed, `SELECT removed from host_vpp_software_installs WHERE id = ?`, hvsi2))
+	assert.False(t, removed)
+
+}
diff --git a/server/datastore/mysql/migrations/tables/20240829165448_SupportMultipleABMTokens.go b/server/datastore/mysql/migrations/tables/20240829165448_SupportMultipleABMTokens.go
new file mode 100644
index 0000000000..f7b010210b
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240829165448_SupportMultipleABMTokens.go
@@ -0,0 +1,196 @@
+package tables
+
+import (
+	"database/sql"
+	"encoding/json"
+	"fmt"
+
+	"github.com/fleetdm/fleet/v4/server/fleet"
+	"github.com/google/uuid"
+	"github.com/jmoiron/sqlx"
+	"github.com/jmoiron/sqlx/reflectx"
+	"github.com/pkg/errors"
+)
+
+func init() {
+	MigrationClient.AddMigration(Up_20240829165448, Down_20240829165448)
+}
+
+func Up_20240829165448(tx *sql.Tx) error {
+	_, err := tx.Exec(`
+CREATE TABLE abm_tokens (
+	id                     int(10) UNSIGNED NOT NULL AUTO_INCREMENT,
+	organization_name      varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
+	apple_id               varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
+	terms_expired          tinyint(1) NOT NULL DEFAULT '0',
+	renew_at               timestamp NOT NULL,
+	-- encrypted token, encrypted with the ABM cert and key and encrypted again
+	-- with the FleetConfig.Server.PrivateKey
+	token                  blob NOT NULL,
+
+	-- those team_id fields are the default teams where devices from this ABM
+	-- will be enrolled during the DEP process, based on the device's platform
+	-- (NULL means "no team").
+	macos_default_team_id  int(10) UNSIGNED DEFAULT NULL,
+	ios_default_team_id    int(10) UNSIGNED DEFAULT NULL,
+	ipados_default_team_id int(10) UNSIGNED DEFAULT NULL,
+
+	created_at             TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+	updated_at             TIMESTAMP NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+
+	PRIMARY KEY (id),
+
+	UNIQUE KEY idx_abm_tokens_organization_name (organization_name),
+
+	CONSTRAINT fk_abm_tokens_macos_default_team_id
+		FOREIGN KEY (macos_default_team_id) REFERENCES teams (id) ON DELETE SET NULL,
+	CONSTRAINT fk_abm_tokens_ios_default_team_id
+		FOREIGN KEY (ios_default_team_id) REFERENCES teams (id) ON DELETE SET NULL,
+	CONSTRAINT fk_abm_tokens_ipados_default_team_id
+		FOREIGN KEY (ipados_default_team_id) REFERENCES teams (id) ON DELETE SET NULL
+)`)
+	if err != nil {
+		return fmt.Errorf("failed to create table abm_tokens: %w", err)
+	}
+
+	_, err = tx.Exec(`
+ALTER TABLE host_dep_assignments
+	ADD COLUMN abm_token_id int(10) UNSIGNED NULL,
+	ADD CONSTRAINT fk_host_dep_assignments_abm_token_id
+		FOREIGN KEY (abm_token_id) REFERENCES abm_tokens(id) ON DELETE SET NULL
+`)
+	if err != nil {
+		return fmt.Errorf("failed to alter table host_dep_assignments: %w", err)
+	}
+
+	// migrate the existing ABM token (if any) to the new abm_tokens table
+	const getABM = `
+SELECT
+	value
+FROM
+	mdm_config_assets
+WHERE
+	name = ? AND deletion_uuid = ''
+`
+	txx := sqlx.Tx{Tx: tx, Mapper: reflectx.NewMapperFunc("db", sqlx.NameMapper)}
+	var token []byte
+	if err := txx.Get(&token, getABM, fleet.MDMAssetABMTokenDeprecated); err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			// nothing to migrate, exit early
+			return nil
+		}
+		return fmt.Errorf("selecting existing ABM token: %w", err)
+	}
+
+	// get the current ABM configuration from the app config
+	const getABMCfg = `
+SELECT
+	json_value->"$.mdm"
+FROM
+	app_config_json
+LIMIT 1
+`
+	var raw sql.Null[json.RawMessage]
+	if err := txx.Get(&raw, getABMCfg); err != nil {
+		return fmt.Errorf("select MDM config from app_config_json: %w", err)
+	}
+
+	var (
+		abmTermsExpired bool
+		abmDefaultTeam  string
+	)
+	// decode if we did get an object
+	if raw.Valid && len(raw.V) > 0 && raw.V[0] == '{' {
+		var config map[string]interface{}
+		if err := json.Unmarshal(raw.V, &config); err != nil {
+			return fmt.Errorf("unmarshal appconfig: %w", err)
+		}
+
+		if s, ok := config["apple_bm_default_team"].(string); ok {
+			abmDefaultTeam = s
+		}
+		if b, ok := config["apple_bm_terms_expired"].(bool); ok {
+			abmTermsExpired = b
+		}
+	}
+
+	var defaultTeamID *uint
+	if abmDefaultTeam != "" {
+		// get the default team id
+		var id uint
+		if err := txx.Get(&id, "SELECT id FROM teams WHERE name = ?", abmDefaultTeam); err != nil {
+			if !errors.Is(err, sql.ErrNoRows) {
+				return fmt.Errorf("select default ABM team id: %w", err)
+			}
+		}
+		// only use it if the team exists
+		if id > 0 {
+			defaultTeamID = &id
+		}
+	}
+
+	// NOTE: we don't know the organization_name, apple_id and renew_at of the
+	// existing token - the only way to know is to make an Apple API call and to
+	// decrypt the token, two operations that are not safe to do in a DB
+	// migration. Instead, insert with empty values and we have a check in the
+	// cron job ("apple_mdm_dep_profile_assigner") that runs regularly (and
+	// ~immediately at Fleet startup) to ensure the token's information is
+	// filled.
+	// https://github.com/fleetdm/fleet/pull/21287#discussion_r1715891448
+
+	// insert the token in the new table
+	const insABM = `
+INSERT INTO abm_tokens
+	(
+		organization_name,
+		apple_id,
+		terms_expired,
+		renew_at,
+		token,
+		macos_default_team_id,
+		ios_default_team_id,
+		ipados_default_team_id
+	)
+VALUES
+	('', '', ?, DATE('2000-01-01'), ?, ?, ?, ?)
+`
+	res, err := tx.Exec(insABM, abmTermsExpired, token, defaultTeamID, defaultTeamID, defaultTeamID)
+	if err != nil {
+		return fmt.Errorf("insert existing ABM token into abm_tokens: %w", err)
+	}
+	tokenID, _ := res.LastInsertId()
+
+	// soft-delete the token from the deprecated storage
+	const delABM = `
+UPDATE
+	mdm_config_assets
+SET
+	deleted_at = CURRENT_TIMESTAMP(),
+	deletion_uuid = ?
+WHERE
+	name = ? AND deletion_uuid = ''
+`
+	deletionUUID := uuid.New().String()
+	if _, err = tx.Exec(delABM, deletionUUID, fleet.MDMAssetABMTokenDeprecated); err != nil {
+		return fmt.Errorf("delete ABM token from mdm_config_assets: %w", err)
+	}
+
+	// associate all existing host DEP enrollments with the existing token
+	const updDEP = `
+UPDATE
+	host_dep_assignments
+SET
+	abm_token_id = ?
+WHERE
+	deleted_at IS NULL
+`
+	if _, err = tx.Exec(updDEP, tokenID); err != nil {
+		return fmt.Errorf("update ABM token link in host_dep_assignments: %w", err)
+	}
+
+	return nil
+}
+
+func Down_20240829165448(tx *sql.Tx) error {
+	return nil
+}
diff --git a/server/datastore/mysql/migrations/tables/20240829165448_SupportMultipleABMTokens_test.go b/server/datastore/mysql/migrations/tables/20240829165448_SupportMultipleABMTokens_test.go
new file mode 100644
index 0000000000..07804074fd
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240829165448_SupportMultipleABMTokens_test.go
@@ -0,0 +1,272 @@
+package tables
+
+import (
+	"crypto/md5" //nolint:gosec
+	"database/sql"
+	"testing"
+	"time"
+
+	"github.com/fleetdm/fleet/v4/server/ptr"
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/require"
+)
+
+func TestUp_20240829165448(t *testing.T) {
+	createTokenAndHash := func() (string, []byte) {
+		tok := uuid.NewString()
+		h := md5.New() //nolint:gosec
+		_, _ = h.Write([]byte(tok))
+		md5Checksum := h.Sum(nil)
+		return tok, md5Checksum
+	}
+
+	type abmToken struct {
+		ID                  uint      `db:"id"`
+		OrganizationName    string    `db:"organization_name"`
+		AppleID             string    `db:"apple_id"`
+		TermsExpired        bool      `db:"terms_expired"`
+		RenewAt             time.Time `db:"renew_at"`
+		Token               []byte    `db:"token"`
+		MacOSDefaultTeamID  *uint     `db:"macos_default_team_id"`
+		IOSDefaultTeamID    *uint     `db:"ios_default_team_id"`
+		IPadOSDefaultTeamID *uint     `db:"ipados_default_team_id"`
+	}
+
+	t.Run("NoExistingToken", func(t *testing.T) {
+		db := applyUpToPrev(t)
+
+		// create a host with a DEP assignment (should not exist when there is no
+		// ABM, but maybe ABM was setup then removed)
+		hostID := insertHost(t, db, nil)
+		execNoErr(t, db, `INSERT INTO host_dep_assignments (host_id) VALUES (?)`, hostID)
+
+		// Apply current migration.
+		applyNext(t, db)
+
+		var exists int
+		// no ABM token in the old storage
+		err := db.Get(&exists, `SELECT 1 FROM mdm_config_assets WHERE name = 'abm_token'`)
+		require.ErrorIs(t, err, sql.ErrNoRows)
+		// no ABM token in the new storage
+		err = db.Get(&exists, `SELECT 1 FROM abm_tokens`)
+		require.ErrorIs(t, err, sql.ErrNoRows)
+
+		// the existing host DEP assignment is still not linked to any token
+		var hostTokenID *uint
+		err = db.Get(&hostTokenID, `SELECT abm_token_id FROM host_dep_assignments WHERE host_id = ?`, hostID)
+		require.NoError(t, err)
+		require.Nil(t, hostTokenID)
+	})
+
+	t.Run("ExistingTokenWithTeamTermsFalse", func(t *testing.T) {
+		db := applyUpToPrev(t)
+
+		// create an existing ABM token
+		existingToken, md5Checksum := createTokenAndHash()
+		execNoErr(t, db, `INSERT INTO mdm_config_assets (name, value, md5_checksum) VALUES ('abm_token', ?, ?)`, existingToken, md5Checksum)
+
+		// set a config for ABM
+		execNoErr(t, db, `UPDATE app_config_json SET json_value = JSON_SET(json_value, '$.mdm', JSON_OBJECT('apple_bm_default_team', 'team1'))`)
+
+		// create the corresponding team
+		tmID := execNoErrLastID(t, db, `INSERT INTO teams (name) VALUES (?)`, "team1")
+
+		// create a host with a DEP assignment
+		hostID := insertHost(t, db, ptr.Uint(uint(tmID)))
+		execNoErr(t, db, `INSERT INTO host_dep_assignments (host_id) VALUES (?)`, hostID)
+
+		// Apply current migration.
+		applyNext(t, db)
+
+		// ABM token is now soft-deleted in the old storage
+		var assetDeletedUUID string
+		err := db.Get(&assetDeletedUUID, `SELECT deletion_uuid FROM mdm_config_assets WHERE name = 'abm_token'`)
+		require.NoError(t, err)
+		require.NotEmpty(t, assetDeletedUUID)
+
+		// ABM token is stored in the new storage, with the expected config
+		var storedToken abmToken
+		err = db.Get(&storedToken, `
+SELECT
+	id, organization_name, apple_id, terms_expired, renew_at, token, macos_default_team_id, ios_default_team_id, ipados_default_team_id
+FROM
+	abm_tokens
+LIMIT 1`)
+		require.NoError(t, err)
+
+		// we don't have those fields during DB migration
+		require.Empty(t, storedToken.OrganizationName)
+		require.Empty(t, storedToken.AppleID)
+		require.Equal(t, time.Date(2000, 1, 1, 0, 0, 0, 0, time.UTC), storedToken.RenewAt)
+		// terms were not set as expired in appconfig
+		require.False(t, storedToken.TermsExpired)
+		// token matches
+		require.Equal(t, existingToken, string(storedToken.Token))
+		// all platform default teams are set to the configured team
+		require.NotNil(t, storedToken.MacOSDefaultTeamID)
+		require.EqualValues(t, tmID, *storedToken.MacOSDefaultTeamID)
+		require.NotNil(t, storedToken.IOSDefaultTeamID)
+		require.EqualValues(t, tmID, *storedToken.IOSDefaultTeamID)
+		require.NotNil(t, storedToken.IPadOSDefaultTeamID)
+		require.EqualValues(t, tmID, *storedToken.IPadOSDefaultTeamID)
+
+		// the existing host DEP assignment is linked to the token
+		var hostTokenID *uint
+		err = db.Get(&hostTokenID, `SELECT abm_token_id FROM host_dep_assignments WHERE host_id = ?`, hostID)
+		require.NoError(t, err)
+		require.NotNil(t, hostTokenID)
+		require.EqualValues(t, storedToken.ID, *hostTokenID)
+	})
+
+	t.Run("ExistingTokenWithInvalidTeamTermsTrue", func(t *testing.T) {
+		db := applyUpToPrev(t)
+
+		// create an existing ABM token
+		existingToken, md5Checksum := createTokenAndHash()
+		execNoErr(t, db, `INSERT INTO mdm_config_assets (name, value, md5_checksum) VALUES ('abm_token', ?, ?)`, existingToken, md5Checksum)
+
+		// set a config for ABM
+		execNoErr(t, db, `UPDATE app_config_json SET json_value = JSON_SET(json_value, '$.mdm', JSON_OBJECT('apple_bm_default_team', 'no-such-team', 'apple_bm_terms_expired', true))`)
+
+		// create a team, but not one matching the default team name
+		tmID := execNoErrLastID(t, db, `INSERT INTO teams (name) VALUES (?)`, "team1")
+
+		// create a host with a DEP assignment
+		hostID := insertHost(t, db, ptr.Uint(uint(tmID)))
+		execNoErr(t, db, `INSERT INTO host_dep_assignments (host_id) VALUES (?)`, hostID)
+
+		// Apply current migration.
+		applyNext(t, db)
+
+		// ABM token is now soft-deleted in the old storage
+		var assetDeletedUUID string
+		err := db.Get(&assetDeletedUUID, `SELECT deletion_uuid FROM mdm_config_assets WHERE name = 'abm_token'`)
+		require.NoError(t, err)
+		require.NotEmpty(t, assetDeletedUUID)
+
+		// ABM token is stored in the new storage, with the expected config
+		var storedToken abmToken
+		err = db.Get(&storedToken, `
+SELECT
+	id, organization_name, apple_id, terms_expired, renew_at, token, macos_default_team_id, ios_default_team_id, ipados_default_team_id
+FROM
+	abm_tokens
+LIMIT 1`)
+		require.NoError(t, err)
+
+		// we don't have those fields during DB migration
+		require.Empty(t, storedToken.OrganizationName)
+		require.Empty(t, storedToken.AppleID)
+		require.Equal(t, time.Date(2000, 1, 1, 0, 0, 0, 0, time.UTC), storedToken.RenewAt)
+		// terms were set as expired in appconfig
+		require.True(t, storedToken.TermsExpired)
+		// token matches
+		require.Equal(t, existingToken, string(storedToken.Token))
+		// all platform default teams are set to nil as the team did not exist
+		require.Nil(t, storedToken.MacOSDefaultTeamID)
+		require.Nil(t, storedToken.IOSDefaultTeamID)
+		require.Nil(t, storedToken.IPadOSDefaultTeamID)
+
+		// the existing host DEP assignment is linked to the token
+		var hostTokenID *uint
+		err = db.Get(&hostTokenID, `SELECT abm_token_id FROM host_dep_assignments WHERE host_id = ?`, hostID)
+		require.NoError(t, err)
+		require.NotNil(t, hostTokenID)
+		require.EqualValues(t, storedToken.ID, *hostTokenID)
+	})
+
+	t.Run("ExistingTokenNoMDMConfig", func(t *testing.T) {
+		db := applyUpToPrev(t)
+
+		// create an existing ABM token
+		existingToken, md5Checksum := createTokenAndHash()
+		execNoErr(t, db, `INSERT INTO mdm_config_assets (name, value, md5_checksum) VALUES ('abm_token', ?, ?)`, existingToken, md5Checksum)
+
+		// app config does not have the MDM object
+		execNoErr(t, db, `UPDATE app_config_json SET json_value = JSON_REMOVE(json_value, '$.mdm')`)
+
+		// create a host with a DEP assignment
+		hostID := insertHost(t, db, nil)
+		execNoErr(t, db, `INSERT INTO host_dep_assignments (host_id) VALUES (?)`, hostID)
+
+		// Apply current migration.
+		applyNext(t, db)
+
+		// ABM token is now soft-deleted in the old storage
+		var assetDeletedUUID string
+		err := db.Get(&assetDeletedUUID, `SELECT deletion_uuid FROM mdm_config_assets WHERE name = 'abm_token'`)
+		require.NoError(t, err)
+		require.NotEmpty(t, assetDeletedUUID)
+
+		// ABM token is stored in the new storage, with the default config
+		var storedToken abmToken
+		err = db.Get(&storedToken, `
+SELECT
+	id, organization_name, apple_id, terms_expired, renew_at, token, macos_default_team_id, ios_default_team_id, ipados_default_team_id
+FROM
+	abm_tokens
+LIMIT 1`)
+		require.NoError(t, err)
+
+		// we don't have those fields during DB migration
+		require.Empty(t, storedToken.OrganizationName)
+		require.Empty(t, storedToken.AppleID)
+		require.Equal(t, time.Date(2000, 1, 1, 0, 0, 0, 0, time.UTC), storedToken.RenewAt)
+		require.False(t, storedToken.TermsExpired)
+		// token matches
+		require.Equal(t, existingToken, string(storedToken.Token))
+		// all platform default teams are set to nil
+		require.Nil(t, storedToken.MacOSDefaultTeamID)
+		require.Nil(t, storedToken.IOSDefaultTeamID)
+		require.Nil(t, storedToken.IPadOSDefaultTeamID)
+
+		// the existing host DEP assignment is linked to the token
+		var hostTokenID *uint
+		err = db.Get(&hostTokenID, `SELECT abm_token_id FROM host_dep_assignments WHERE host_id = ?`, hostID)
+		require.NoError(t, err)
+		require.NotNil(t, hostTokenID)
+		require.EqualValues(t, storedToken.ID, *hostTokenID)
+	})
+
+	t.Run("ExistingTokenCorruptedJSONConfig", func(t *testing.T) {
+		db := applyUpToPrev(t)
+
+		// create an existing ABM token
+		existingToken, md5Checksum := createTokenAndHash()
+		execNoErr(t, db, `INSERT INTO mdm_config_assets (name, value, md5_checksum) VALUES ('abm_token', ?, ?)`, existingToken, md5Checksum)
+
+		// set a corrupted JSON config for ABM
+		execNoErr(t, db, `UPDATE app_config_json SET json_value = JSON_SET(json_value, '$.mdm', JSON_OBJECT('apple_bm_default_team', 123, 'apple_bm_terms_expired', 'abc'))`)
+
+		// Apply current migration.
+		applyNext(t, db)
+
+		// ABM token is now soft-deleted in the old storage
+		var assetDeletedUUID string
+		err := db.Get(&assetDeletedUUID, `SELECT deletion_uuid FROM mdm_config_assets WHERE name = 'abm_token'`)
+		require.NoError(t, err)
+		require.NotEmpty(t, assetDeletedUUID)
+
+		// ABM token is stored in the new storage, with the default config (as the existing one was invalid)
+		var storedToken abmToken
+		err = db.Get(&storedToken, `
+SELECT
+	id, organization_name, apple_id, terms_expired, renew_at, token, macos_default_team_id, ios_default_team_id, ipados_default_team_id
+FROM
+	abm_tokens
+LIMIT 1`)
+		require.NoError(t, err)
+
+		// we don't have those fields during DB migration
+		require.Empty(t, storedToken.OrganizationName)
+		require.Empty(t, storedToken.AppleID)
+		require.Equal(t, time.Date(2000, 1, 1, 0, 0, 0, 0, time.UTC), storedToken.RenewAt)
+		require.False(t, storedToken.TermsExpired)
+		// token matches
+		require.Equal(t, existingToken, string(storedToken.Token))
+		// all platform default teams are set to nil
+		require.Nil(t, storedToken.MacOSDefaultTeamID)
+		require.Nil(t, storedToken.IOSDefaultTeamID)
+		require.Nil(t, storedToken.IPadOSDefaultTeamID)
+	})
+}
diff --git a/server/datastore/mysql/migrations/tables/20240829165605_SupportMultipleVPPTokens.go b/server/datastore/mysql/migrations/tables/20240829165605_SupportMultipleVPPTokens.go
new file mode 100644
index 0000000000..de2fb9157b
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240829165605_SupportMultipleVPPTokens.go
@@ -0,0 +1,181 @@
+package tables
+
+import (
+	"database/sql"
+	"encoding/json"
+	"fmt"
+	"time"
+
+	"github.com/fleetdm/fleet/v4/server/fleet"
+	"github.com/google/uuid"
+	"github.com/jmoiron/sqlx"
+	"github.com/jmoiron/sqlx/reflectx"
+	"github.com/pkg/errors"
+)
+
+func init() {
+	MigrationClient.AddMigration(Up_20240829165605, Down_20240829165605)
+}
+
+func Up_20240829165605(tx *sql.Tx) error {
+	_, err := tx.Exec(`
+CREATE TABLE vpp_tokens (
+	id                     int(10) UNSIGNED NOT NULL AUTO_INCREMENT,
+	organization_name      varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
+	location               varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
+	renew_at               timestamp NOT NULL,
+	-- encrypted token, encrypted with the FleetConfig.Server.PrivateKey value
+	token                  blob NOT NULL,
+
+	-- Note that as per a Slack discussion [1], we opted not to enforce the constraint
+	-- of team uniqueness in the DB as it quickly got hairy - we'd need a distinct
+	-- global_or_team_id NOT NULL to be able to enforce it along with the enum, and even
+	-- then we want to allow multiple entries for a NULL team id with the enum set to 'none'
+	-- (inactive tokens), and we need to handle the team deletion which only sets team_id
+	-- automatically via the FK ON DELETE clause. We thought about using a trigger but
+	-- decided against it given the impacts [2]. We'll instead enforce the constraint in
+	-- the Go code.
+	-- [1]: https://fleetdm.slack.com/archives/C03C41L5YEL/p1724073772972669
+	-- [2]: https://www.percona.com/blog/how-triggers-may-significantly-affect-the-amount-of-memory-allocated-to-your-mysql-server/
+	team_id                int(10) UNSIGNED DEFAULT NULL,
+
+	-- null_team_type indicates the special team represented when team_id is NULL,
+	-- which can be none (VPP token is inactive), "all teams" or the "no team" team.
+	-- It is important, when setting a non-NULL team_id, to always update this field
+	-- to "none" so that if the team is deleted, via the ON DELETE SET NULL constraint,
+	-- the VPP token automatically becomes inactive (and not, e.g. "all teams" which
+	-- would introduce data inconsistency).
+	null_team_type         ENUM('none', 'allteams', 'noteam') DEFAULT 'none',
+
+	created_at             TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+	updated_at             TIMESTAMP NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+
+	PRIMARY KEY (id),
+
+	UNIQUE KEY idx_vpp_tokens_location (location),
+
+	CONSTRAINT fk_vpp_tokens_team_id
+		FOREIGN KEY (team_id) REFERENCES teams (id) ON DELETE SET NULL
+)`)
+	if err != nil {
+		return fmt.Errorf("failed to create table vpp_tokens: %w", err)
+	}
+
+	_, err = tx.Exec(`
+ALTER TABLE host_vpp_software_installs
+	ADD COLUMN vpp_token_id int(10) UNSIGNED NULL,
+	ADD CONSTRAINT fk_host_vpp_software_installs_vpp_token_id
+		FOREIGN KEY (vpp_token_id) REFERENCES vpp_tokens(id) ON DELETE SET NULL
+`)
+	if err != nil {
+		return fmt.Errorf("failed to alter table host_vpp_software_installs: %w", err)
+	}
+
+	// migrate the existing VPP token (if any) to the new vpp_tokens table
+	const getVPP = `
+SELECT
+	value
+FROM
+	mdm_config_assets
+WHERE
+	name = ? AND deletion_uuid = ''
+`
+	txx := sqlx.Tx{Tx: tx, Mapper: reflectx.NewMapperFunc("db", sqlx.NameMapper)}
+	var token []byte
+	if err := txx.Get(&token, getVPP, fleet.MDMAssetVPPTokenDeprecated); err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			// nothing to migrate, exit early
+			return nil
+		}
+		return fmt.Errorf("selecting existing VPP token: %w", err)
+	}
+
+	// insert the token in the new table, defaulting to "all teams"
+	const insVPP = `
+INSERT INTO vpp_tokens
+	(
+		organization_name,
+		location,
+		renew_at,
+		token,
+		team_id,
+		null_team_type
+	)
+VALUES
+	('', '', DATE('2000-01-01'), ?, NULL, 'allteams')
+`
+	res, err := tx.Exec(insVPP, token)
+	if err != nil {
+		return fmt.Errorf("insert existing VPP token into vpp_tokens: %w", err)
+	}
+	tokenID, _ := res.LastInsertId()
+
+	// soft-delete the token from the deprecated storage
+	const delVPP = `
+UPDATE
+	mdm_config_assets
+SET
+	deleted_at = CURRENT_TIMESTAMP(),
+	deletion_uuid = ?
+WHERE
+	name = ? AND deletion_uuid = ''
+`
+	deletionUUID := uuid.New().String()
+	if _, err = tx.Exec(delVPP, deletionUUID, fleet.MDMAssetVPPTokenDeprecated); err != nil {
+		return fmt.Errorf("delete VPP token from mdm_config_assets: %w", err)
+	}
+
+	// associate all existing host VPP install requests with the existing token
+	const updHost = `
+UPDATE
+	host_vpp_software_installs
+SET
+	vpp_token_id = ?,
+	updated_at = updated_at
+`
+	if _, err = tx.Exec(updHost, tokenID); err != nil {
+		return fmt.Errorf("update VPP token link in host_vpp_software_installs: %w", err)
+	}
+
+	// NOTE: we can't add the token's metadata during migration because we don't
+	// have the Server.PrivateKey value to decrypt the data from
+	// mdm_config_assets (the VPP token, once decrypted, contains the metadata we
+	// need). Enqueue a worker job to complete the migration, back-filling the
+	// metadata for the migrated token.
+	const (
+		jobName        = "db_migration"
+		taskName       = "migrate_vpp_token"
+		jobStateQueued = "queued"
+	)
+
+	type migrateArgs struct {
+		Task string `json:"task"`
+	}
+	argsJSON, err := json.Marshal(migrateArgs{Task: taskName})
+	if err != nil {
+		return fmt.Errorf("failed to JSON marshal the job arguments: %w", err)
+	}
+
+	// hard-coded timestamps are used so that schema.sql is stable
+	const query = `
+INSERT INTO jobs (
+    name,
+    args,
+    state,
+		error,
+    not_before,
+		created_at,
+		updated_at
+)
+VALUES (?, ?, ?, '', ?, ?, ?)
+`
+	ts := time.Date(2024, 8, 19, 0, 0, 0, 0, time.UTC)
+	if _, err := tx.Exec(query, jobName, argsJSON, jobStateQueued, ts, ts, ts); err != nil {
+		return fmt.Errorf("failed to insert worker job: %w", err)
+	}
+	return nil
+}
+
+func Down_20240829165605(tx *sql.Tx) error {
+	return nil
+}
diff --git a/server/datastore/mysql/migrations/tables/20240829165605_SupportMultipleVPPTokens_test.go b/server/datastore/mysql/migrations/tables/20240829165605_SupportMultipleVPPTokens_test.go
new file mode 100644
index 0000000000..42ef63fdba
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240829165605_SupportMultipleVPPTokens_test.go
@@ -0,0 +1,163 @@
+package tables
+
+import (
+	"crypto/md5" //nolint:gosec
+	"database/sql"
+	"encoding/json"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/require"
+)
+
+func TestUp_20240829165605(t *testing.T) {
+	createTokenAndHash := func() (string, []byte) {
+		tok := uuid.NewString()
+		h := md5.New() //nolint:gosec
+		_, _ = h.Write([]byte(tok))
+		md5Checksum := h.Sum(nil)
+		return tok, md5Checksum
+	}
+
+	type job struct {
+		ID        uint             `json:"id" db:"id"`
+		CreatedAt time.Time        `json:"created_at" db:"created_at"`
+		UpdatedAt *time.Time       `json:"updated_at" db:"updated_at"`
+		Name      string           `json:"name" db:"name"`
+		Args      *json.RawMessage `json:"args" db:"args"`
+		State     string           `json:"state" db:"state"`
+		Retries   int              `json:"retries" db:"retries"`
+		Error     string           `json:"error" db:"error"`
+		NotBefore time.Time        `json:"not_before" db:"not_before"`
+	}
+
+	type vppToken struct {
+		ID               uint      `db:"id"`
+		OrganizationName string    `db:"organization_name"`
+		Location         string    `db:"location"`
+		RenewAt          time.Time `db:"renew_at"`
+		Token            []byte    `db:"token"`
+		TeamID           *uint     `db:"team_id"`
+		NullTeamType     string    `db:"null_team_type"`
+	}
+
+	type jobArgs struct {
+		Task string `json:"task"`
+	}
+
+	t.Run("NoExistingToken", func(t *testing.T) {
+		db := applyUpToPrev(t)
+
+		// create a vpp app
+		adamID := "abcdEFGH"
+		execNoErr(t, db, `INSERT INTO vpp_apps (adam_id, platform) VALUES (?, ?)`, adamID, "darwin")
+		execNoErr(t, db, `INSERT INTO vpp_apps_teams (adam_id, platform) VALUES (?, ?)`, adamID, "darwin")
+
+		// create a host with a VPP install request
+		hostID := insertHost(t, db, nil)
+		execNoErr(t, db, `INSERT INTO host_vpp_software_installs (host_id, adam_id, command_uuid, platform) VALUES (?, ?, ?, ?)`, hostID, adamID, uuid.NewString(), "darwin")
+
+		// there is no pending job of that type at the moment
+		var jobs []*job
+		err := db.Select(&jobs, `SELECT id, name, args, state, retries, error, not_before FROM jobs WHERE name = 'db_migration'`)
+		require.NoError(t, err)
+		require.Empty(t, jobs)
+
+		// Apply current migration.
+		applyNext(t, db)
+
+		var exists int
+		// no VPP token in the old storage
+		err = db.Get(&exists, `SELECT 1 FROM mdm_config_assets WHERE name = 'vpp_token'`)
+		require.ErrorIs(t, err, sql.ErrNoRows)
+		// no VPP token in the new storage
+		err = db.Get(&exists, `SELECT 1 FROM vpp_tokens`)
+		require.ErrorIs(t, err, sql.ErrNoRows)
+
+		// the existing host install request is not linked
+		var hostTokenID *uint
+		err = db.Get(&hostTokenID, `SELECT vpp_token_id FROM host_vpp_software_installs WHERE host_id = ?`, hostID)
+		require.NoError(t, err)
+		require.Nil(t, hostTokenID)
+
+		// there is still no pending job of that type
+		err = db.Select(&jobs, `SELECT id, name, args, state, retries, error, not_before FROM jobs WHERE name = 'db_migration'`)
+		require.NoError(t, err)
+		require.Empty(t, jobs)
+	})
+
+	t.Run("ExistingTokenAndInstallRequest", func(t *testing.T) {
+		db := applyUpToPrev(t)
+
+		// create an existing VPP token
+		existingToken, md5Checksum := createTokenAndHash()
+		execNoErr(t, db, `INSERT INTO mdm_config_assets (name, value, md5_checksum) VALUES ('vpp_token', ?, ?)`, existingToken, md5Checksum)
+
+		// create a vpp app
+		adamID := "abcdEFGH"
+		execNoErr(t, db, `INSERT INTO vpp_apps (adam_id, platform) VALUES (?, ?)`, adamID, "darwin")
+		execNoErr(t, db, `INSERT INTO vpp_apps_teams (adam_id, platform) VALUES (?, ?)`, adamID, "darwin")
+
+		// create a host with a VPP install request
+		hostID := insertHost(t, db, nil)
+		execNoErr(t, db, `INSERT INTO host_vpp_software_installs (host_id, adam_id, command_uuid, platform) VALUES (?, ?, ?, ?)`, hostID, adamID, uuid.NewString(), "darwin")
+
+		// there is no pending job of that type at the moment
+		var jobs []*job
+		err := db.Select(&jobs, `SELECT id, name, args, state, retries, error, not_before FROM jobs WHERE name = 'db_migration'`)
+		require.NoError(t, err)
+		require.Empty(t, jobs)
+
+		// Apply current migration.
+		applyNext(t, db)
+
+		// VPP token is now soft-deleted in the old storage
+		var assetDeletedUUID string
+		err = db.Get(&assetDeletedUUID, `SELECT deletion_uuid FROM mdm_config_assets WHERE name = 'vpp_token'`)
+		require.NoError(t, err)
+		require.NotEmpty(t, assetDeletedUUID)
+
+		// VPP token is stored in the new storage, with the expected config
+		var storedToken vppToken
+		err = db.Get(&storedToken, `
+SELECT
+	id, organization_name, location, renew_at, token, team_id, null_team_type
+FROM
+	vpp_tokens
+LIMIT 1`)
+		require.NoError(t, err)
+
+		// we don't have those fields during DB migration
+		require.NotZero(t, storedToken.ID)
+		require.Empty(t, storedToken.OrganizationName)
+		require.Empty(t, storedToken.Location)
+		require.Equal(t, time.Date(2000, 1, 1, 0, 0, 0, 0, time.UTC), storedToken.RenewAt)
+		// token matches
+		require.Equal(t, existingToken, string(storedToken.Token))
+		require.Nil(t, storedToken.TeamID)
+		require.Equal(t, "allteams", storedToken.NullTeamType)
+
+		// the existing host install request is linked to the token
+		var hostTokenID *uint
+		err = db.Get(&hostTokenID, `SELECT vpp_token_id FROM host_vpp_software_installs WHERE host_id = ?`, hostID)
+		require.NoError(t, err)
+		require.NotNil(t, hostTokenID)
+		require.EqualValues(t, storedToken.ID, *hostTokenID)
+
+		// the job was enqueued to finish migrating the token
+		err = db.Select(&jobs, `SELECT id, name, args, state, retries, error, not_before FROM jobs WHERE name = 'db_migration'`)
+		require.NoError(t, err)
+		require.Len(t, jobs, 1)
+
+		require.Equal(t, "db_migration", jobs[0].Name)
+		require.Equal(t, 0, jobs[0].Retries)
+		require.LessOrEqual(t, jobs[0].NotBefore, time.Now().UTC())
+		require.NotNil(t, jobs[0].Args)
+
+		var args jobArgs
+		err = json.Unmarshal(*jobs[0].Args, &args)
+		require.NoError(t, err)
+		require.Equal(t, "migrate_vpp_token", args.Task)
+	})
+}
diff --git a/server/datastore/mysql/migrations/tables/20240829165715_AddUniqueTeamIDToVPPTokens.go b/server/datastore/mysql/migrations/tables/20240829165715_AddUniqueTeamIDToVPPTokens.go
new file mode 100644
index 0000000000..3eb8214530
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240829165715_AddUniqueTeamIDToVPPTokens.go
@@ -0,0 +1,22 @@
+package tables
+
+import (
+	"database/sql"
+	"fmt"
+)
+
+func init() {
+	MigrationClient.AddMigration(Up_20240829165715, Down_20240829165715)
+}
+
+func Up_20240829165715(tx *sql.Tx) error {
+	stmt := `ALTER TABLE vpp_tokens ADD UNIQUE KEY idx_vpp_tokens_team_id (team_id)`
+	if _, err := tx.Exec(stmt); err != nil {
+		return fmt.Errorf("adding unique constraint to team_id on vpp_tokens: %w", err)
+	}
+	return nil
+}
+
+func Down_20240829165715(tx *sql.Tx) error {
+	return nil
+}
diff --git a/server/datastore/mysql/migrations/tables/20240829165930_SupportMultipleTokensForSetupAssistants.go b/server/datastore/mysql/migrations/tables/20240829165930_SupportMultipleTokensForSetupAssistants.go
new file mode 100644
index 0000000000..7ccb27b06b
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240829165930_SupportMultipleTokensForSetupAssistants.go
@@ -0,0 +1,117 @@
+package tables
+
+import (
+	"database/sql"
+	"errors"
+	"fmt"
+)
+
+func init() {
+	MigrationClient.AddMigration(Up_20240829165930, Down_20240829165930)
+}
+
+func Up_20240829165930(tx *sql.Tx) error {
+	// mdm_apple_default_setup_assistants will now track profile_uuids per team
+	// AND ABM token.
+	const alterDefaultStmt = `
+	ALTER TABLE mdm_apple_default_setup_assistants
+		ADD COLUMN abm_token_id int unsigned DEFAULT NULL,
+		DROP KEY idx_mdm_default_setup_assistant_global_or_team_id,
+		ADD CONSTRAINT idx_mdm_default_setup_assistant_global_or_team_id_abm_token_id
+			UNIQUE (global_or_team_id, abm_token_id),
+		ADD CONSTRAINT fk_mdm_default_setup_assistant_abm_token_id
+			FOREIGN KEY (abm_token_id) REFERENCES abm_tokens(id) ON DELETE CASCADE
+`
+	if _, err := tx.Exec(alterDefaultStmt); err != nil {
+		return fmt.Errorf("alter mdm_apple_default_setup_assistants to track per ABM token: %w", err)
+	}
+
+	var abmTokenID uint
+	if err := tx.QueryRow("SELECT id FROM abm_tokens LIMIT 1").Scan(&abmTokenID); err != nil {
+		if !errors.Is(err, sql.ErrNoRows) {
+			return fmt.Errorf("get existing ABM token ID: %w", err)
+		}
+	}
+
+	if abmTokenID > 0 {
+		// there should only be one ABM token (or none) when this migration runs.
+		// Timestamp is important in the code logic (it triggers a full DEP sync if
+		// recently changed), so we ensure it stays the same.
+		const updateDefaultStmt = `
+	UPDATE mdm_apple_default_setup_assistants SET
+		abm_token_id = ?,
+		updated_at = updated_at
+`
+		if _, err := tx.Exec(updateDefaultStmt, abmTokenID); err != nil {
+			return fmt.Errorf("update mdm_apple_default_setup_assistants to set abm token id: %w", err)
+		}
+	}
+	// TODO: should we delete entries without an ABM token ID at this point? And
+	// make the column NOT NULL?
+
+	const createCustomStmt = `
+CREATE TABLE mdm_apple_setup_assistant_profiles (
+	id int unsigned NOT NULL AUTO_INCREMENT,
+
+	-- the corresponding custom setup assistant in mdm_apple_setup_assistants,
+	-- which is already associated with a team.
+	setup_assistant_id int unsigned NOT NULL,
+
+	-- the ABM token used to define this profile in the Apple API.
+	abm_token_id int unsigned NOT NULL,
+
+	-- the profile UUID returned by the Apple API when defined with this ABM
+	-- token.
+	profile_uuid varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
+
+	created_at timestamp NULL DEFAULT CURRENT_TIMESTAMP,
+  updated_at timestamp NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+
+	PRIMARY KEY (id),
+	UNIQUE KEY idx_mdm_apple_setup_assistant_profiles_asst_id_tok_id (setup_assistant_id, abm_token_id),
+	CONSTRAINT fk_mdm_apple_setup_assistant_profiles_setup_assistant_id
+		FOREIGN KEY (setup_assistant_id) REFERENCES mdm_apple_setup_assistants (id) ON DELETE CASCADE,
+	CONSTRAINT fk_mdm_apple_setup_assistant_profiles_abm_token_id
+		FOREIGN KEY (abm_token_id) REFERENCES abm_tokens (id) ON DELETE CASCADE
+)
+`
+	if _, err := tx.Exec(createCustomStmt); err != nil {
+		return fmt.Errorf("create mdm_apple_setup_assistant_profiles table: %w", err)
+	}
+
+	if abmTokenID > 0 {
+		// migrate any existing profile_uuid to the new table
+		const insertCustomStmt = `
+		INSERT INTO mdm_apple_setup_assistant_profiles (
+			setup_assistant_id,
+			abm_token_id,
+			profile_uuid,
+			updated_at
+		)
+		SELECT
+			mas.id,
+			?,
+			mas.profile_uuid,
+			mas.updated_at
+		FROM
+			mdm_apple_setup_assistants mas
+`
+		if _, err := tx.Exec(insertCustomStmt, abmTokenID); err != nil {
+			return fmt.Errorf("create mdm_apple_setup_assistant_profiles table: %w", err)
+		}
+	}
+
+	const alterCustomStmt = `
+	ALTER TABLE mdm_apple_setup_assistants
+		DROP COLUMN profile_uuid
+`
+	if _, err := tx.Exec(alterCustomStmt); err != nil {
+		return fmt.Errorf("alter mdm_apple_setup_assistants to drop profile_uuid: %w", err)
+	}
+
+	return nil
+}
+
+func Down_20240829165930(tx *sql.Tx) error {
+	return nil
+}
diff --git a/server/datastore/mysql/migrations/tables/20240829165930_SupportMultipleTokensForSetupAssistants_test.go b/server/datastore/mysql/migrations/tables/20240829165930_SupportMultipleTokensForSetupAssistants_test.go
new file mode 100644
index 0000000000..f496d918f7
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240829165930_SupportMultipleTokensForSetupAssistants_test.go
@@ -0,0 +1,101 @@
+package tables
+
+import (
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/jmoiron/sqlx"
+	"github.com/stretchr/testify/require"
+)
+
+func TestUp_20240829165930_None(t *testing.T) {
+	db := applyUpToPrev(t)
+
+	// Apply current migration.
+	applyNext(t, db)
+
+	// nothing in the default setup assistant
+	var count int
+	err := sqlx.Get(db, &count, `SELECT COUNT(*) FROM mdm_apple_default_setup_assistants`)
+	require.NoError(t, err)
+	require.Zero(t, count)
+
+	// nothing in the custom setup assistants
+	err = sqlx.Get(db, &count, `SELECT COUNT(*) FROM mdm_apple_setup_assistants`)
+	require.NoError(t, err)
+	require.Zero(t, count)
+
+	// nothing in the new custom setup table
+	err = sqlx.Get(db, &count, `SELECT COUNT(*) FROM mdm_apple_setup_assistant_profiles`)
+	require.NoError(t, err)
+	require.Zero(t, count)
+}
+
+func TestUp_20240829165930_Existing(t *testing.T) {
+	db := applyUpToPrev(t)
+
+	// create the single ABM token (can only have 1 when this migration runs)
+	abmTokID := execNoErrLastID(t, db, "INSERT INTO abm_tokens (organization_name, apple_id, renew_at, token) VALUES (?, ?, ?, ?)", "org", "apple", time.Now(), uuid.NewString())
+
+	// create a couple teams
+	tm1 := execNoErrLastID(t, db, "INSERT INTO teams (name) VALUES ('team1')")
+	tm2 := execNoErrLastID(t, db, "INSERT INTO teams (name) VALUES ('team2')")
+
+	// setup the default assistant
+	execNoErr(t, db, `INSERT INTO mdm_apple_enrollment_profiles (token, type, dep_profile) VALUES (?, ?, ?)`, uuid.NewString(), "automatic", "{}")
+	defProfUUID := uuid.NewString()
+	execNoErr(t, db, `INSERT INTO mdm_apple_default_setup_assistants (team_id, global_or_team_id, profile_uuid) VALUES (?, ?, ?)`, nil, 0, defProfUUID)
+	execNoErr(t, db, `INSERT INTO mdm_apple_default_setup_assistants (team_id, global_or_team_id, profile_uuid) VALUES (?, ?, ?)`, tm1, tm1, defProfUUID)
+	// no profile registered for team 2
+	execNoErr(t, db, `INSERT INTO mdm_apple_default_setup_assistants (team_id, global_or_team_id, profile_uuid) VALUES (?, ?, ?)`, tm2, tm2, "")
+
+	// load the default assistant timestamps (ordered by global or team id)
+	var defTs []time.Time
+	err := sqlx.Select(db, &defTs, `SELECT updated_at FROM mdm_apple_default_setup_assistants ORDER BY global_or_team_id`)
+	require.NoError(t, err)
+
+	// create a custom setup assistant for tm1
+	asst1ProfUUID := uuid.NewString()
+	asst1 := execNoErrLastID(t, db, `INSERT INTO mdm_apple_setup_assistants (team_id, global_or_team_id, name, profile, profile_uuid) VALUES (?, ?, ?, ?, ?)`, tm1, tm1, "asst1", "{}", asst1ProfUUID)
+
+	// load the custom assistant timestamp
+	var asst1Ts time.Time
+	err = sqlx.Get(db, &asst1Ts, `SELECT updated_at FROM mdm_apple_setup_assistants WHERE id = ?`, asst1)
+	require.NoError(t, err)
+
+	// Apply current migration.
+	applyNext(t, db)
+
+	// the default assistants have the ABM token stored, otherwise unchanged
+	var postDefTs []time.Time
+	err = sqlx.Select(db, &postDefTs, `SELECT updated_at FROM mdm_apple_default_setup_assistants ORDER BY global_or_team_id`)
+	require.NoError(t, err)
+	require.ElementsMatch(t, defTs, postDefTs)
+
+	var count int
+	err = sqlx.Get(db, &count, `SELECT COUNT(*) FROM mdm_apple_default_setup_assistants WHERE abm_token_id = ?`, abmTokID)
+	require.NoError(t, err)
+	require.Equal(t, len(postDefTs), count)
+	require.Equal(t, 3, count)
+
+	// inserting another default assistant with an existing team+token fails (new unique constraint)
+	_, err = db.Exec(`INSERT INTO mdm_apple_default_setup_assistants (team_id, global_or_team_id, abm_token_id) VALUES (?, ?, ?)`, nil, 0, abmTokID)
+	require.Error(t, err)
+	require.ErrorContains(t, err, "Duplicate entry")
+
+	// the custom assistant entry has been created in the new table with the same timestamp and correct token ID
+	var customAssts []struct {
+		SetupAssistantID uint      `db:"setup_assistant_id"`
+		ABMTokenID       uint      `db:"abm_token_id"`
+		ProfileUUID      string    `db:"profile_uuid"`
+		UpdatedAt        time.Time `db:"updated_at"`
+	}
+	err = sqlx.Select(db, &customAssts, `SELECT setup_assistant_id, abm_token_id, profile_uuid, updated_at FROM mdm_apple_setup_assistant_profiles`)
+	require.NoError(t, err)
+	require.Len(t, customAssts, 1)
+	require.EqualValues(t, asst1, customAssts[0].SetupAssistantID)
+	require.EqualValues(t, abmTokID, customAssts[0].ABMTokenID)
+	require.Equal(t, asst1ProfUUID, customAssts[0].ProfileUUID)
+	require.Equal(t, asst1Ts, customAssts[0].UpdatedAt)
+}
diff --git a/server/datastore/mysql/migrations/tables/20240829170023_CreateVPPTokenTeamsJoinTable.go b/server/datastore/mysql/migrations/tables/20240829170023_CreateVPPTokenTeamsJoinTable.go
new file mode 100644
index 0000000000..c4c92b203b
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240829170023_CreateVPPTokenTeamsJoinTable.go
@@ -0,0 +1,51 @@
+package tables
+
+import (
+	"database/sql"
+	"fmt"
+)
+
+func init() {
+	MigrationClient.AddMigration(Up_20240829170023, Down_20240829170023)
+}
+
+func Up_20240829170023(tx *sql.Tx) error {
+	_, err := tx.Exec(`
+CREATE TABLE vpp_token_teams (
+	id int unsigned NOT NULL PRIMARY KEY AUTO_INCREMENT,
+    vpp_token_id int unsigned NOT NULL,
+	team_id int unsigned,
+	null_team_type enum('none','allteams','noteam') COLLATE utf8mb4_unicode_ci DEFAULT 'none',
+	UNIQUE KEY idx_vpp_token_teams_team_id (team_id),
+	-- Note that this is only a partial constraint. There can be only
+	-- one token per team, but the team "No team" and "all teams" have
+	-- to be checked manually in go code
+	CONSTRAINT fk_vpp_token_teams_team_id FOREIGN KEY (team_id) REFERENCES teams (id) ON DELETE CASCADE,
+	CONSTRAINT fk_vpp_token_teams_vpp_token_id FOREIGN KEY (vpp_token_id) REFERENCES vpp_tokens (id) ON DELETE CASCADE
+);
+
+INSERT INTO vpp_token_teams (
+	vpp_token_id,
+	team_id,
+	null_team_type
+) SELECT
+	id,
+	team_id,
+	null_team_type
+FROM vpp_tokens;
+
+ALTER TABLE vpp_tokens DROP FOREIGN KEY fk_vpp_tokens_team_id;
+ALTER TABLE vpp_tokens DROP CONSTRAINT idx_vpp_tokens_team_id;
+ALTER TABLE vpp_tokens DROP COLUMN team_id;
+ALTER TABLE vpp_tokens DROP COLUMN null_team_type;
+`)
+	if err != nil {
+		return fmt.Errorf("migrating vpp_tokens associations to join table: %w", err)
+	}
+
+	return nil
+}
+
+func Down_20240829170023(tx *sql.Tx) error {
+	return nil
+}
diff --git a/server/datastore/mysql/migrations/tables/20240829170023_CreateVPPTokenTeamsJoinTable_test.go b/server/datastore/mysql/migrations/tables/20240829170023_CreateVPPTokenTeamsJoinTable_test.go
new file mode 100644
index 0000000000..8d4d65e544
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240829170023_CreateVPPTokenTeamsJoinTable_test.go
@@ -0,0 +1,118 @@
+package tables
+
+import (
+	"testing"
+
+	"github.com/fleetdm/fleet/v4/server/ptr"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestUp_20240829170023(t *testing.T) {
+	db := applyUpToPrev(t)
+
+	_, err := db.Exec("INSERT INTO teams (name) VALUES (?)", "team1")
+	require.NoError(t, err)
+
+	_, err = db.Exec(`
+	INSERT INTO vpp_tokens (
+		organization_name,
+		location,
+		renew_at,
+		token,
+		team_id,
+		null_team_type
+	) VALUES
+		(?, ?, ?, ?, ?, ?),
+		(?, ?, ?, ?, ?, ?),
+		(?, ?, ?, ?, ?, ?)
+	`,
+		"org1", "loc1", "2030-01-01 10:10:10", "blob1", 1, "none",
+		"org2", "loc2", "2030-02-01 10:10:10", "blob2", nil, "noteam",
+		"org3", "loc3", "2030-03-01 10:10:10", "blob3", nil, "allteams",
+	)
+	require.NoError(t, err)
+
+	var count []int
+	err = db.Select(&count, "SELECT COUNT(*) FROM vpp_tokens")
+	require.NoError(t, err)
+	require.Equal(t, 3, count[0])
+
+	// Apply current migration.
+	applyNext(t, db)
+
+	var sel []selresult
+
+	err = db.Select(&sel, `
+	SELECT
+		v.organization_name,
+		v.token,
+		j.vpp_token_id,
+		j.team_id,
+		j.null_team_type
+	FROM
+		vpp_tokens v
+	LEFT OUTER JOIN
+		vpp_token_teams j
+	ON
+		v.id = j.vpp_token_id
+	`)
+	require.NoError(t, err)
+	require.Len(t, sel, 3)
+
+	expected := []selresult{
+		{
+			// Make assumptions about autoincrement IDs
+			TokenID:  1,
+			Org:      "org1",
+			Token:    "blob1",
+			TeamID:   ptr.Int(1),
+			NullTeam: "none",
+		},
+		{
+			TokenID:  2,
+			Org:      "org2",
+			Token:    "blob2",
+			TeamID:   nil,
+			NullTeam: "noteam",
+		},
+		{
+			TokenID:  3,
+			Org:      "org3",
+			Token:    "blob3",
+			TeamID:   nil,
+			NullTeam: "allteams",
+		},
+	}
+
+	for _, exp := range expected {
+		actual := find(t, sel, exp.TokenID)
+		assert.Equal(t, exp.Org, actual.Org)
+		assert.Equal(t, exp.Token, actual.Token)
+		if exp.TeamID == nil {
+			assert.Nil(t, actual.TeamID)
+		} else {
+			assert.Equal(t, *exp.TeamID, *actual.TeamID)
+		}
+		assert.Equal(t, exp.NullTeam, actual.NullTeam)
+	}
+}
+
+type selresult struct {
+	TokenID  int    `db:"vpp_token_id"`
+	Org      string `db:"organization_name"`
+	Token    string `db:"token"`
+	TeamID   *int   `db:"team_id"`
+	NullTeam string `db:"null_team_type"`
+}
+
+func find(t *testing.T, arr []selresult, tokenID int) selresult {
+	for _, thing := range arr {
+		if thing.TokenID == tokenID {
+			return thing
+		}
+	}
+
+	t.Errorf("failed to find result with tokenID %d", tokenID)
+	return selresult{}
+}
diff --git a/server/datastore/mysql/migrations/tables/20240829170033_AddVPPTokenIDToVppAppsTeams.go b/server/datastore/mysql/migrations/tables/20240829170033_AddVPPTokenIDToVppAppsTeams.go
new file mode 100644
index 0000000000..ea367f59ea
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240829170033_AddVPPTokenIDToVppAppsTeams.go
@@ -0,0 +1,43 @@
+package tables
+
+import (
+	"database/sql"
+	"fmt"
+)
+
+func init() {
+	MigrationClient.AddMigration(Up_20240829170033, Down_20240829170033)
+}
+
+func Up_20240829170033(tx *sql.Tx) error {
+	stmtAddColumn := `
+ALTER TABLE vpp_apps_teams
+	ADD COLUMN vpp_token_id int(10) UNSIGNED NOT NULL`
+
+	stmtAssociate := `UPDATE vpp_apps_teams SET vpp_token_id = (SELECT id FROM vpp_tokens LIMIT 1)`
+
+	stmtAddConstraint := `
+ALTER TABLE vpp_apps_teams
+	ADD CONSTRAINT fk_vpp_apps_teams_vpp_token_id
+		FOREIGN KEY (vpp_token_id) REFERENCES vpp_tokens(id) ON DELETE CASCADE`
+
+	if _, err := tx.Exec(stmtAddColumn); err != nil {
+		return fmt.Errorf("failed to add vpp_token_id column to table: %w", err)
+	}
+
+	// Associate apps with the first token available. If we're
+	// migrating from single-token VPP this should be correct.
+	if _, err := tx.Exec(stmtAssociate); err != nil {
+		return fmt.Errorf("failed to associate vpp apps with first token: %w", err)
+	}
+
+	if _, err := tx.Exec(stmtAddConstraint); err != nil {
+		return fmt.Errorf("failed to add vpp token id constraint: %w", err)
+	}
+
+	return nil
+}
+
+func Down_20240829170033(tx *sql.Tx) error {
+	return nil
+}
diff --git a/server/datastore/mysql/migrations/tables/20240829170044_PolicyAutomaticInstallSoftware.go b/server/datastore/mysql/migrations/tables/20240829170044_PolicyAutomaticInstallSoftware.go
new file mode 100644
index 0000000000..ac1fd41802
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240829170044_PolicyAutomaticInstallSoftware.go
@@ -0,0 +1,37 @@
+package tables
+
+import (
+	"database/sql"
+	"fmt"
+)
+
+func init() {
+	MigrationClient.AddMigration(Up_20240829170044, Down_20240829170044)
+}
+
+func Up_20240829170044(tx *sql.Tx) error {
+	if _, err := tx.Exec(`
+		ALTER TABLE policies
+		ADD COLUMN software_installer_id INT UNSIGNED DEFAULT NULL,
+		ADD FOREIGN KEY fk_policies_software_installer_id (software_installer_id) REFERENCES software_installers (id);
+	`); err != nil {
+		return fmt.Errorf("failed to add software_installer_id to policies: %w", err)
+	}
+
+	// We store `user_name` and `user_email` in case the user is deleted from Fleet (`user_id` set to NULL).
+	if _, err := tx.Exec(`
+		ALTER TABLE software_installers
+		ADD COLUMN user_id INT(10) UNSIGNED DEFAULT NULL,
+		ADD COLUMN user_name VARCHAR(255) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
+		ADD COLUMN user_email VARCHAR(255) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
+		ADD CONSTRAINT fk_software_installers_user_id FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE SET NULL;
+	`); err != nil {
+		return fmt.Errorf("failed to add user_id to software_installers: %w", err)
+	}
+
+	return nil
+}
+
+func Down_20240829170044(tx *sql.Tx) error {
+	return nil
+}
diff --git a/server/datastore/mysql/migrations/tables/20240905105135_AddAutoIncrementColumnToProfiles.go b/server/datastore/mysql/migrations/tables/20240905105135_AddAutoIncrementColumnToProfiles.go
new file mode 100644
index 0000000000..19eed6bee7
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240905105135_AddAutoIncrementColumnToProfiles.go
@@ -0,0 +1,40 @@
+package tables
+
+import (
+	"database/sql"
+	"fmt"
+)
+
+func init() {
+	MigrationClient.AddMigration(Up_20240905105135, Down_20240905105135)
+}
+
+func Up_20240905105135(tx *sql.Tx) error {
+	// The AUTO_INCREMENT columns are used to determine if a row was updated by an INSERT ... ON DUPLICATE KEY UPDATE statement.
+	// This is needed because we are currently using CLIENT_FOUND_ROWS option to determine if a row was found.
+	// And in order to find if the row was updated, we need to check LAST_INSERT_ID().
+	// MySQL docs: https://dev.mysql.com/doc/refman/8.4/en/insert-on-duplicate.html
+
+	if !columnExists(tx, "mdm_windows_configuration_profiles", "auto_increment") {
+		if _, err := tx.Exec(`
+ALTER TABLE mdm_windows_configuration_profiles
+ADD COLUMN auto_increment BIGINT NOT NULL AUTO_INCREMENT UNIQUE
+`); err != nil {
+			return fmt.Errorf("failed to add auto_increment to mdm_windows_configuration_profiles: %w", err)
+		}
+	}
+
+	if !columnExists(tx, "mdm_apple_declarations", "auto_increment") {
+		if _, err := tx.Exec(`
+ALTER TABLE mdm_apple_declarations
+ADD COLUMN auto_increment BIGINT NOT NULL AUTO_INCREMENT UNIQUE
+`); err != nil {
+			return fmt.Errorf("failed to add auto_increment to mdm_apple_declarations: %w", err)
+		}
+	}
+	return nil
+}
+
+func Down_20240905105135(tx *sql.Tx) error {
+	return nil
+}
diff --git a/server/datastore/mysql/migrations/tables/20240905140514_AddURLToSoftwareInstallers.go b/server/datastore/mysql/migrations/tables/20240905140514_AddURLToSoftwareInstallers.go
new file mode 100644
index 0000000000..2da6ca5bdb
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240905140514_AddURLToSoftwareInstallers.go
@@ -0,0 +1,25 @@
+package tables
+
+import (
+	"database/sql"
+	"fmt"
+)
+
+func init() {
+	MigrationClient.AddMigration(Up_20240905140514, Down_20240905140514)
+}
+
+func Up_20240905140514(tx *sql.Tx) error {
+	// The new 'url' column will only be set for software uploaded in batch via GitOps.
+	if _, err := tx.Exec(`
+		ALTER TABLE software_installers
+		ADD COLUMN url VARCHAR(255) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '';
+	`); err != nil {
+		return fmt.Errorf("failed to add url to software_installers: %w", err)
+	}
+	return nil
+}
+
+func Down_20240905140514(tx *sql.Tx) error {
+	return nil
+}
diff --git a/server/datastore/mysql/migrations/tables/20240905200000_UninstallPackages.go b/server/datastore/mysql/migrations/tables/20240905200000_UninstallPackages.go
new file mode 100644
index 0000000000..e9596f5359
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240905200000_UninstallPackages.go
@@ -0,0 +1,153 @@
+package tables
+
+import (
+	"database/sql"
+	"fmt"
+
+	"github.com/jmoiron/sqlx"
+	"github.com/jmoiron/sqlx/reflectx"
+)
+
+func init() {
+	MigrationClient.AddMigration(Up_20240905200000, Down_20240905200000)
+}
+
+const placeholderUninstallScript = "# This script will be automatically updated within the next hour\nexit 1"
+const placeholderUninstallScriptWindows = "# This script will be automatically updated within the next hour\nExit 1"
+
+func Up_20240905200000(tx *sql.Tx) error {
+	if _, err := tx.Exec(`
+ALTER TABLE software_installers 
+ADD COLUMN package_ids TEXT COLLATE utf8mb4_unicode_ci NOT NULL,
+ADD COLUMN extension VARCHAR(32) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
+ADD COLUMN uninstall_script_content_id int unsigned NOT NULL,
+ADD COLUMN updated_at TIMESTAMP(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6) ON UPDATE CURRENT_TIMESTAMP(6),
+MODIFY COLUMN uploaded_at TIMESTAMP(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6)
+		`); err != nil {
+		return fmt.Errorf("failed to alter software_installers: %w", err)
+	}
+
+	txx := sqlx.Tx{Tx: tx, Mapper: reflectx.NewMapperFunc("db", sqlx.NameMapper)}
+
+	// Add dummy uninstall scripts if needed -- these will be updated later by a cron job
+	var result []int
+	if err := txx.Select(&result, `SELECT 1 FROM software_installers WHERE platform IN ('linux', 'darwin')`); err != nil {
+		return fmt.Errorf("failed to check software installers for linux or darwin: %w", err)
+	}
+	if len(result) > 0 {
+		linuxScriptID, err := getOrInsertScript(txx, placeholderUninstallScript)
+		if err != nil {
+			return err
+		}
+		// Update software installers with the scripts
+		if _, err := tx.Exec(`UPDATE software_installers SET uninstall_script_content_id = ? WHERE platform IN ('linux', 'darwin')`,
+			linuxScriptID); err != nil {
+			return fmt.Errorf("failed to update software installers: %w", err)
+		}
+	}
+
+	if err := txx.Select(&result, `SELECT 1 FROM software_installers WHERE platform IN ('windows')`); err != nil {
+		return fmt.Errorf("failed to check software installers for windows: %w", err)
+	}
+	if len(result) > 0 {
+		windowsScriptID, err := getOrInsertScript(txx, placeholderUninstallScriptWindows)
+		if err != nil {
+			return err
+		}
+		// Update software installers with the scripts
+		if _, err := tx.Exec(`UPDATE software_installers SET uninstall_script_content_id = ? WHERE platform IN ('windows')`,
+			windowsScriptID); err != nil {
+			return fmt.Errorf("failed to update windows software installers: %w", err)
+		}
+	}
+
+	// Add best-guess installer extensions if needed -- these will be updated later by a cron job to file contents based types
+	// Also set existing updated_at timestamps to uploaded_at since installers were previously immutable
+	if _, err := tx.Exec(`UPDATE software_installers SET extension = SUBSTRING_INDEX(filename,'.',-1), updated_at = uploaded_at`); err != nil {
+		return fmt.Errorf("failed to backfill best-guess installer extensions: %w", err)
+	}
+
+	// Add foreign key
+	if _, err := tx.Exec(`
+ALTER TABLE software_installers
+ADD CONSTRAINT fk_uninstall_script_content_id 
+	FOREIGN KEY (uninstall_script_content_id)
+	REFERENCES script_contents(id)
+	ON DELETE RESTRICT ON UPDATE CASCADE`); err != nil {
+		return fmt.Errorf("failed to add foreign key to software_installers: %w", err)
+	}
+
+	if _, err := tx.Exec(`
+ALTER TABLE host_software_installs
+ADD COLUMN uninstall_script_output TEXT COLLATE utf8mb4_unicode_ci,
+ADD COLUMN uninstall_script_exit_code INT DEFAULT NULL,
+ADD COLUMN uninstall TINYINT UNSIGNED NOT NULL DEFAULT 0,
+ADD COLUMN status ENUM('pending_install', 'failed_install', 'installed', 'pending_uninstall', 'failed_uninstall')
+GENERATED ALWAYS AS (
+CASE
+	WHEN removed = 1 THEN NULL
+
+	WHEN post_install_script_exit_code IS NOT NULL AND
+		post_install_script_exit_code = 0 THEN 'installed'
+
+	WHEN post_install_script_exit_code IS NOT NULL AND
+		post_install_script_exit_code != 0 THEN 'failed_install'
+
+	WHEN install_script_exit_code IS NOT NULL AND
+		install_script_exit_code = 0 THEN 'installed'
+
+	WHEN install_script_exit_code IS NOT NULL AND
+		install_script_exit_code != 0 THEN 'failed_install'
+
+	WHEN pre_install_query_output IS NOT NULL AND
+		pre_install_query_output = '' THEN 'failed_install'
+
+	WHEN host_id IS NOT NULL AND uninstall = 0 THEN 'pending_install'
+
+	WHEN uninstall_script_exit_code IS NOT NULL AND
+		uninstall_script_exit_code != 0 THEN 'failed_uninstall'
+
+	WHEN uninstall_script_exit_code IS NOT NULL AND
+		uninstall_script_exit_code = 0 THEN NULL -- available for install again
+
+	WHEN host_id IS NOT NULL AND uninstall = 1 THEN 'pending_uninstall'
+
+	ELSE NULL -- not installed from Fleet installer or successfully uninstalled
+END
+) STORED NULL,
+MODIFY COLUMN created_at TIMESTAMP(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6),
+MODIFY COLUMN updated_at TIMESTAMP(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6) ON UPDATE CURRENT_TIMESTAMP(6),
+MODIFY COLUMN host_deleted_at TIMESTAMP(6) NULL DEFAULT NULL
+		`); err != nil {
+		return fmt.Errorf("failed to alter host_software_installs: %w", err)
+	}
+
+	return nil
+}
+
+func getOrInsertScript(txx sqlx.Tx, script string) (int64, error) {
+	var ids []int64
+	// check is script already exists
+	csum := md5ChecksumScriptContent(script)
+	if err := txx.Select(&ids, `SELECT id FROM script_contents WHERE md5_checksum = UNHEX(?)`, csum); err != nil {
+		return 0, fmt.Errorf("failed to find script contents: %w", err)
+	}
+	var scriptID int64
+	if len(ids) > 0 {
+		scriptID = ids[0]
+	} else {
+		// create new script
+		var result sql.Result
+		var err error
+		if result, err = txx.Exec(`INSERT INTO script_contents (md5_checksum, contents) VALUES (UNHEX(?), ?)`, csum,
+			script); err != nil {
+			return 0, fmt.Errorf("failed to insert script contents: %w", err)
+		}
+		scriptID, _ = result.LastInsertId()
+	}
+	return scriptID, nil
+}
+
+func Down_20240905200000(_ *sql.Tx) error {
+	return nil
+}
diff --git a/server/datastore/mysql/migrations/tables/20240905200000_UninstallPackages_test.go b/server/datastore/mysql/migrations/tables/20240905200000_UninstallPackages_test.go
new file mode 100644
index 0000000000..0a9af607bc
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240905200000_UninstallPackages_test.go
@@ -0,0 +1,106 @@
+package tables
+
+import (
+	"testing"
+
+	"github.com/jmoiron/sqlx"
+	"github.com/jmoiron/sqlx/reflectx"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestUp_20240905200000(t *testing.T) {
+	db := applyUpToPrev(t)
+
+	// Create host
+	insertHostStmt := `
+		INSERT INTO hosts (
+			hostname, uuid, platform, osquery_version, os_version, build, platform_like, code_name,
+			cpu_type, cpu_subtype, cpu_brand, hardware_vendor, hardware_model, hardware_version,
+			hardware_serial, computer_name, team_id
+		) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+	`
+	hostName := "Dummy Hostname"
+	hostUUID := "12345678-1234-1234-1234-123456789012"
+	hostPlatform := "darwin"
+	osqueryVer := "5.9.1"
+	osVersion := "Windows 10"
+	buildVersion := "10.0.19042.1234"
+	platformLike := "apple"
+	codeName := "20H2"
+	cpuType := "x86_64"
+	cpuSubtype := "x86_64"
+	cpuBrand := "Intel"
+	hwVendor := "Dell Inc."
+	hwModel := "OptiPlex 7090"
+	hwVersion := "1.0"
+	hwSerial := "ABCDEFGHIJ"
+	computerName := "DESKTOP-TEST"
+
+	hostID1 := execNoErrLastID(t, db, insertHostStmt, hostName, hostUUID, hostPlatform, osqueryVer,
+		osVersion, buildVersion, platformLike, codeName, cpuType, cpuSubtype, cpuBrand, hwVendor, hwModel, hwVersion, hwSerial,
+		computerName, nil)
+
+	dataStmts := `
+	  INSERT INTO script_contents (id, md5_checksum, contents) VALUES
+	    (1, 'checksum', 'script content');
+
+	  INSERT INTO software_titles (id, name, source, browser) VALUES
+	    (1, 'Foo.app', 'apps', ''),
+	    (2, 'Go', 'deb_packages', ''),
+	    (3, 'Microsoft Teams.exe', 'programs', '');
+
+	  INSERT INTO software_installers
+	    (id, title_id, filename, version, platform, install_script_content_id, storage_id)
+	  VALUES
+	    (1, 1, 'foo-installer.pkg', '1.1', 'darwin', 1, 'storage-id'),
+	    (2, 2, 'go-installer.deb', '2.2', 'linux', 1, 'storage-id'),
+	    (3, 3, 'teams-installer.exe', '3.3', 'windows', 1, 'storage-id');
+	`
+	_, err := db.Exec(dataStmts)
+	require.NoError(t, err)
+
+	tx, err := db.Begin()
+	require.NoError(t, err)
+	txx := sqlx.Tx{Tx: tx, Mapper: reflectx.NewMapperFunc("db", sqlx.NameMapper)}
+	scriptID, err := getOrInsertScript(txx, placeholderUninstallScript)
+	require.NoError(t, err)
+	err = tx.Commit()
+	require.NoError(t, err)
+
+	hsiStmt := `
+	INSERT INTO host_software_installs (
+		host_id,
+		execution_id,
+		software_installer_id,
+		install_script_exit_code
+	) VALUES (?, ?, ?, ?)`
+	hsi1 := execNoErrLastID(t, db, hsiStmt, hostID1, "execution-id1", 1, 0)
+
+	// Apply current migration.
+	applyNext(t, db)
+
+	var scriptIDs []int64
+	err = db.Select(&scriptIDs, "SELECT uninstall_script_content_id FROM software_installers WHERE id IN (1, 2)")
+	require.NoError(t, err)
+	require.ElementsMatch(t, []int64{scriptID, scriptID}, scriptIDs)
+
+	var windowsScript string
+	err = db.Get(&windowsScript, `
+		SELECT contents FROM script_contents sc
+		INNER JOIN software_installers si ON sc.id = si.uninstall_script_content_id
+		WHERE si.id = 3`)
+	require.NoError(t, err)
+	assert.Equal(t, placeholderUninstallScriptWindows, windowsScript)
+
+	var extension string
+	err = db.Get(&extension, `SELECT extension FROM software_installers si WHERE si.id = 3 AND updated_at = uploaded_at`)
+	require.NoError(t, err)
+	assert.Equal(t, "exe", extension)
+
+	var status string
+	err = db.Get(&status, "SELECT status FROM host_software_installs WHERE id = ?", hsi1)
+	require.NoError(t, err)
+	assert.Equal(t, "installed", status)
+
+}
diff --git a/server/datastore/mysql/migrations/tables/20240905200001_AddPoliciesToNoTeam.go b/server/datastore/mysql/migrations/tables/20240905200001_AddPoliciesToNoTeam.go
new file mode 100644
index 0000000000..d24592b9f0
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240905200001_AddPoliciesToNoTeam.go
@@ -0,0 +1,78 @@
+package tables
+
+import (
+	"database/sql"
+	"fmt"
+
+	"github.com/pkg/errors"
+)
+
+func init() {
+	MigrationClient.AddMigration(Up_20240905200001, Down_20240905200001)
+}
+
+func Up_20240905200001(tx *sql.Tx) error {
+	//
+	// Changes in `policies` and `policy_stats` to support policies for "No team".
+	// "No team" here means policies that run on hosts that belong to no team (hosts.team_id = NULL)
+	//
+	// `policies`:
+	//	- team_id = NULL means the policy is a "Global policy" (aka "All teams" policy).
+	//	- team_id > 0 means the policy is a team policy.
+	//	- team_id = 0 means the policy is a "No team" policy.
+	//
+	// `policy_stats`:
+	// 	- For "Global policies":
+	//	  - inherited_team_id_char = 'global', inherited_team_id = NULL are the stats for the policy's global domain.
+	//	  - inherited_team_id_char = '<TEAM_ID>', inherited_team_id = <TEAM_ID> are the stats of the policy on a specific team domain.
+	//	  - inherited_team_id_car = '0', inherited_team_id = 0 are the stats of the policy on the "No team" domain.
+	//	- For "Team policies" (for team policies there's always just one row in this table):
+	//	  - inherited_team_id_char = 'global', inherited_team_id = NULL are the stats for the team policy.
+	//
+
+	// Drop foreign key on policies table to teams to allow for team_id = 0 to represent "No team".
+	referencedTables := map[string]struct{}{"teams": {}}
+	table := "policies"
+	constraints, err := constraintsForTable(tx, table, referencedTables)
+	if err != nil {
+		return err
+	}
+	if len(constraints) != 1 {
+		return errors.New("policies foreign key to teams not found")
+	}
+	if _, err := tx.Exec(fmt.Sprintf(`
+		ALTER TABLE policies
+		DROP FOREIGN KEY %s;
+	`, constraints[0])); err != nil {
+		return fmt.Errorf("failed to drop policies foreign key to teams: %w", err)
+	}
+
+	// Allow `inherited_team_id` to be NULL to represent global policy stats on the global domain, and `inherited_team_id = 0`
+	// to represent global policy stats on the "No team" domain.
+	// Add `inherited_team_id_char` as generated column to add uniqueness constraint to the table for policies on each domain.
+	if _, err := tx.Exec(`
+		ALTER TABLE policy_stats
+		DROP INDEX policy_team_unique,
+		MODIFY inherited_team_id INT UNSIGNED NULL,
+		ADD COLUMN inherited_team_id_char char(10) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci
+			GENERATED ALWAYS AS (IF(inherited_team_id IS NULL, 'global', CONVERT(inherited_team_id, CHAR))),
+		ADD UNIQUE KEY (policy_id, inherited_team_id_char);
+	`); err != nil {
+		return fmt.Errorf("failed to modify inherited_team_id in policy_stats: %w", err)
+	}
+
+	// Update inherited_team_id from `0` to `NULL` to allow storing stats for the "No team" domain as `inherited_team_id = 0`.
+	if _, err := tx.Exec(`
+		UPDATE policy_stats
+		SET inherited_team_id = NULL
+		WHERE inherited_team_id = 0;
+	`); err != nil {
+		return fmt.Errorf("failed to update policy_stats: %w", err)
+	}
+
+	return nil
+}
+
+func Down_20240905200001(tx *sql.Tx) error {
+	return nil
+}
diff --git a/server/datastore/mysql/migrations/tables/20240905200001_AddPoliciesToNoTeam_test.go b/server/datastore/mysql/migrations/tables/20240905200001_AddPoliciesToNoTeam_test.go
new file mode 100644
index 0000000000..90a2495ea5
--- /dev/null
+++ b/server/datastore/mysql/migrations/tables/20240905200001_AddPoliciesToNoTeam_test.go
@@ -0,0 +1,86 @@
+package tables
+
+import (
+	"strconv"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestUp_20240905200001(t *testing.T) {
+	db := applyUpToPrev(t)
+
+	team1ID := uint(execNoErrLastID(t, db, `INSERT INTO teams (name) VALUES ('team1');`))
+	globalPolicy0 := uint(execNoErrLastID(t, db,
+		`INSERT INTO policies (name, query, description, checksum) VALUES
+		('globalPolicy0', 'SELECT 0', 'Description', 'checksum');`,
+	))
+	policy1Team1 := uint(execNoErrLastID(t, db,
+		`INSERT INTO policies (name, query, description, team_id, checksum)
+		VALUES ('policy1Team1', 'SELECT 1', 'Description', ?, 'checksum2');`,
+		team1ID,
+	))
+
+	// Insert policy stats for a global policy.
+	execNoErr(t, db,
+		`INSERT INTO policy_stats
+			(policy_id, inherited_team_id, passing_host_count, failing_host_count)
+		VALUES 
+			(?, ?, 1, 2), (?, ?, 3, 4);`,
+		globalPolicy0,
+		0,
+		globalPolicy0,
+		policy1Team1,
+	)
+	// Insert policy stats for a team policy.
+	execNoErr(t, db,
+		`INSERT INTO policy_stats (policy_id, inherited_team_id, passing_host_count, failing_host_count)
+		VALUES (?, ?, 5, 6);`,
+		policy1Team1,
+		0,
+	)
+
+	applyNext(t, db)
+
+	// Check the policy_stats for global have been migrated correctly.
+	var results []struct {
+		PolicyID            uint   `db:"policy_id"`
+		InheritedTeamID     *uint  `db:"inherited_team_id"`
+		InheritedTeamIDChar string `db:"inherited_team_id_char"`
+		PassingHostCount    uint   `db:"passing_host_count"`
+		FailingHostCount    uint   `db:"failing_host_count"`
+	}
+	err := db.Select(&results,
+		`SELECT policy_id, inherited_team_id, inherited_team_id_char, passing_host_count, failing_host_count
+		FROM policy_stats ORDER BY policy_id ASC;`,
+	)
+	require.NoError(t, err)
+	require.Len(t, results, 3)
+
+	require.Equal(t, globalPolicy0, results[0].PolicyID)
+	require.Nil(t, results[0].InheritedTeamID)
+	require.Equal(t, "global", results[0].InheritedTeamIDChar)
+	require.Equal(t, uint(1), results[0].PassingHostCount)
+	require.Equal(t, uint(2), results[0].FailingHostCount)
+
+	require.Equal(t, globalPolicy0, results[1].PolicyID)
+	require.NotNil(t, results[1].InheritedTeamID)
+	require.Equal(t, policy1Team1, *results[1].InheritedTeamID)
+	require.Equal(t, strconv.FormatUint(uint64(policy1Team1), 10), results[1].InheritedTeamIDChar)
+	require.Equal(t, uint(3), results[1].PassingHostCount)
+	require.Equal(t, uint(4), results[1].FailingHostCount)
+
+	require.Equal(t, policy1Team1, results[2].PolicyID)
+	require.Nil(t, results[2].InheritedTeamID)
+	require.Equal(t, "global", results[2].InheritedTeamIDChar)
+	require.Equal(t, uint(5), results[2].PassingHostCount)
+	require.Equal(t, uint(6), results[2].FailingHostCount)
+
+	// The team can be deleted, and the policy won't be automatically deleted.
+	execNoErr(t, db,
+		`DELETE FROM teams;`,
+	)
+	var ok bool
+	err = db.Get(&ok, `SELECT 1 FROM policies WHERE id = ?;`, policy1Team1)
+	require.NoError(t, err)
+}
diff --git a/server/datastore/mysql/migrations/tables/migration.go b/server/datastore/mysql/migrations/tables/migration.go
index a7872b5f7b..ca62d5cd9b 100644
--- a/server/datastore/mysql/migrations/tables/migration.go
+++ b/server/datastore/mysql/migrations/tables/migration.go
@@ -50,6 +50,27 @@ WHERE
 	return count > 0
 }
 
+func tableExists(tx *sql.Tx, table string) bool {
+	var count int
+	err := tx.QueryRow(
+		`
+SELECT
+    count(*)
+FROM
+    information_schema.columns
+WHERE
+    TABLE_SCHEMA = DATABASE()
+    AND TABLE_NAME = ?
+`,
+		table,
+	).Scan(&count)
+	if err != nil {
+		return false
+	}
+
+	return count > 0
+}
+
 func indexExists(tx *sqlx.DB, table, index string) bool {
 	var count int
 	err := tx.QueryRow(`
@@ -66,6 +87,22 @@ AND index_name = ?
 	return count > 0
 }
 
+func indexExistsTx(tx *sql.Tx, table, index string) bool {
+	var count int
+	err := tx.QueryRow(`
+SELECT COUNT(1)
+FROM INFORMATION_SCHEMA.STATISTICS
+WHERE table_schema = DATABASE()
+AND table_name = ?
+AND index_name = ?
+`, table, index).Scan(&count)
+	if err != nil {
+		return false
+	}
+
+	return count > 0
+}
+
 // updateAppConfigJSON updates the `json_value` stored in the `app_config_json` after applying the
 // supplied callback to the current config object.
 func updateAppConfigJSON(tx *sql.Tx, fn func(config *fleet.AppConfig) error) error {
diff --git a/server/datastore/mysql/migrations/tables/migration_test.go b/server/datastore/mysql/migrations/tables/migration_test.go
index ffe2d16866..6ea84ec50c 100644
--- a/server/datastore/mysql/migrations/tables/migration_test.go
+++ b/server/datastore/mysql/migrations/tables/migration_test.go
@@ -48,7 +48,9 @@ func newDBConnForTests(t *testing.T) *sqlx.DB {
 		fmt.Sprintf("%s:%s@tcp(%s)/?charset=utf8mb4&parseTime=true&loc=UTC&multiStatements=true", testUsername, testPassword, testAddress),
 	)
 	require.NoError(t, err)
-	_, err = db.Exec(fmt.Sprintf("DROP DATABASE IF EXISTS %s; CREATE DATABASE %s; USE %s;", t.Name(), t.Name(), t.Name()))
+
+	name := strings.ReplaceAll(strings.ReplaceAll(t.Name(), "/", "_"), " ", "_")
+	_, err = db.Exec(fmt.Sprintf("DROP DATABASE IF EXISTS %s; CREATE DATABASE %s; USE %s;", name, name, name))
 	require.NoError(t, err)
 	return db
 }
@@ -56,8 +58,25 @@ func newDBConnForTests(t *testing.T) *sqlx.DB {
 func getMigrationVersion(t *testing.T) int64 {
 	// Migration test functions look like this:
 	//   func TestUp_20231109115838(t *testing.T)
-	// so this extracts the timestamp part only.
-	v, err := strconv.Atoi(strings.TrimPrefix(t.Name(), "TestUp_"))
+	//
+	// and multiple unit tests for the same migration version can be done by
+	// following this naming pattern:
+	//   func TestUp_20231109115838_scenario1(t *testing.T)
+	//   func TestUp_20231109115838_scenario2(t *testing.T)
+	//
+	// Note that sub-tests can also be used, so:
+	//   func TestUp_20231109115838(t *testing.T) {
+	//     t.Run("scenario1", func(t *testing.T) {...}
+	//   }
+	// also works (calling applyUpToPrev in each sub-test to create a new test
+	// database).
+	//
+	// This extracts the migration version (timestamp) from the test name.
+
+	baseName, _, _ := strings.Cut(t.Name(), "/")
+	withoutPrefix := strings.TrimPrefix(baseName, "TestUp_")
+	timestampPart, _, _ := strings.Cut(withoutPrefix, "_")
+	v, err := strconv.Atoi(timestampPart)
 	require.NoError(t, err)
 	return int64(v)
 }
diff --git a/server/datastore/mysql/migrations_test.go b/server/datastore/mysql/migrations_test.go
index a8a010dc8f..e782e0d2b2 100644
--- a/server/datastore/mysql/migrations_test.go
+++ b/server/datastore/mysql/migrations_test.go
@@ -64,7 +64,7 @@ func TestMigrations(t *testing.T) {
 
 	// Dump schema to dumpfile
 	cmd := exec.Command(
-		"docker-compose", "exec", "-T", "mysql_test",
+		"docker", "compose", "exec", "-T", "mysql_test",
 		// Command run inside container
 		"mysqldump", "-u"+testUsername, "-p"+testPassword, "TestMigrations", "--compact", "--skip-comments",
 	)
diff --git a/server/datastore/mysql/mysql.go b/server/datastore/mysql/mysql.go
index 76c67a34e2..3acfa46f63 100644
--- a/server/datastore/mysql/mysql.go
+++ b/server/datastore/mysql/mysql.go
@@ -82,6 +82,8 @@ type Datastore struct {
 	testDeleteMDMProfilesBatchSize int
 	// for tests, set to override the default batch size.
 	testUpsertMDMDesiredProfilesBatchSize int
+	// for tests set to override the default batch size.
+	testSelectMDMProfilesBatchSize int
 
 	// set this in tests to simulate an error at various stages in the
 	// batchSetMDMAppleProfilesDB execution: if the string starts with "insert", it
@@ -160,6 +162,22 @@ func (ds *Datastore) loadOrPrepareStmt(ctx context.Context, query string) *sqlx.
 	return stmt
 }
 
+func (ds *Datastore) deleteCachedStmt(query string) {
+	ds.stmtCacheMu.Lock()
+	defer ds.stmtCacheMu.Unlock()
+	stmt, ok := ds.stmtCache[query]
+	if ok {
+		if err := stmt.Close(); err != nil {
+			level.Error(ds.logger).Log(
+				"msg", "failed to close prepared statement before deleting it",
+				"query", query,
+				"err", err,
+			)
+		}
+		delete(ds.stmtCache, query)
+	}
+}
+
 // NewMDMAppleSCEPDepot returns a scep_depot.Depot that uses the Datastore
 // underlying MySQL writer *sql.DB.
 func (ds *Datastore) NewSCEPDepot() (scep_depot.Depot, error) {
@@ -1224,21 +1242,7 @@ func (ds *Datastore) ProcessList(ctx context.Context) ([]fleet.MySQLProcess, err
 	return processList, nil
 }
 
-func insertOnDuplicateDidInsert(res sql.Result) bool {
-	// Note that connection string sets CLIENT_FOUND_ROWS (see
-	// generateMysqlConnectionString in this package), so LastInsertId is 0
-	// and RowsAffected 1 when a row is set to its current values.
-	//
-	// See [the docs][1] or @mna's comment in `insertOnDuplicateDidUpdate`
-	// below for more details
-	//
-	// [1]: https://dev.mysql.com/doc/refman/5.7/en/insert-on-duplicate.html
-	lastID, _ := res.LastInsertId()
-	affected, _ := res.RowsAffected()
-	return lastID != 0 && affected == 1
-}
-
-func insertOnDuplicateDidUpdate(res sql.Result) bool {
+func insertOnDuplicateDidInsertOrUpdate(res sql.Result) bool {
 	// From mysql's documentation:
 	//
 	// With ON DUPLICATE KEY UPDATE, the affected-rows value per row is 1 if
@@ -1248,7 +1252,10 @@ func insertOnDuplicateDidUpdate(res sql.Result) bool {
 	// connecting to mysqld, the affected-rows value is 1 (not 0) if an
 	// existing row is set to its current values.
 	//
-	// https://dev.mysql.com/doc/refman/5.7/en/insert-on-duplicate.html
+	// If a table contains an AUTO_INCREMENT column and INSERT ... ON DUPLICATE KEY UPDATE
+	// inserts or updates a row, the LAST_INSERT_ID() function returns the AUTO_INCREMENT value.
+	//
+	// https://dev.mysql.com/doc/refman/8.4/en/insert-on-duplicate.html
 	//
 	// Note that connection string sets CLIENT_FOUND_ROWS (see
 	// generateMysqlConnectionString in this package), so it does return 1 when
@@ -1263,7 +1270,8 @@ func insertOnDuplicateDidUpdate(res sql.Result) bool {
 
 	lastID, _ := res.LastInsertId()
 	aff, _ := res.RowsAffected()
-	return lastID == 0 || aff != 1
+	// something was updated (lastID != 0) AND row was found (aff == 1 or higher if more rows were found)
+	return lastID != 0 && aff > 0
 }
 
 type parameterizedStmt struct {
diff --git a/server/datastore/mysql/mysql_test.go b/server/datastore/mysql/mysql_test.go
index 1218d4650d..228715ffff 100644
--- a/server/datastore/mysql/mysql_test.go
+++ b/server/datastore/mysql/mysql_test.go
@@ -1301,3 +1301,85 @@ func TestBatchProcessDB(t *testing.T) {
 		require.Equal(t, 2, callCount)
 	})
 }
+
+func TestGetContextTryStmt(t *testing.T) {
+	ctx := context.Background()
+
+	dbMock, ds := mockDatastore(t)
+	ds.stmtCache = map[string]*sqlx.Stmt{}
+
+	t.Run("get with unknown statement error", func(t *testing.T) {
+		count := 0
+		query := "SELECT 1"
+
+		// first call to cache the statement
+		dbMock.ExpectPrepare(query)
+		mockResult := sqlmock.NewRows([]string{query})
+		mockResult.AddRow("1")
+		dbMock.ExpectQuery(query).WillReturnRows(mockResult)
+		err := ds.getContextTryStmt(ctx, &count, query)
+		require.NoError(t, err)
+		require.NoError(t, dbMock.ExpectationsWereMet())
+
+		// verify that the statement was cached
+		stmt := ds.loadOrPrepareStmt(ctx, query)
+		require.NotNil(t, stmt)
+
+		// call again to trigger the unknown statement error and ensure it retries
+		// first query, make it fail
+		queryMock := dbMock.ExpectQuery(query)
+		mySQLErr := &mysql.MySQLError{
+			Number: mysqlerr.ER_UNKNOWN_STMT_HANDLER,
+		}
+		queryMock.WillReturnError(mySQLErr)
+
+		// after the failure, a second call is made, this time without
+		// the prepared statement
+		mockResult = sqlmock.NewRows([]string{query})
+		mockResult.AddRow("1")
+		dbMock.ExpectQuery(query).WillReturnRows(mockResult)
+
+		// make the call and verify we removed the prepared statement
+		err = ds.getContextTryStmt(ctx, &count, query)
+		require.NoError(t, err)
+		require.NoError(t, dbMock.ExpectationsWereMet())
+		stmt = ds.loadOrPrepareStmt(ctx, query)
+		require.Nil(t, stmt)
+	})
+
+	t.Run("get with other error", func(t *testing.T) {
+		dbMock, ds := mockDatastore(t)
+		ds.stmtCache = map[string]*sqlx.Stmt{}
+		count := 0
+		query := "SELECT 1"
+
+		// first call to cache the statement
+		dbMock.ExpectPrepare(query)
+		mockResult := sqlmock.NewRows([]string{query})
+		mockResult.AddRow("1")
+		dbMock.ExpectQuery(query).WillReturnRows(mockResult)
+		err := ds.getContextTryStmt(ctx, &count, query)
+		require.NoError(t, err)
+		require.Equal(t, 1, count)
+		require.NoError(t, dbMock.ExpectationsWereMet())
+
+		// verify that the statement was cached
+		stmt := ds.loadOrPrepareStmt(ctx, query)
+		require.NotNil(t, stmt)
+
+		// return a duplicate error
+		queryMock := dbMock.ExpectQuery(query)
+		mySQLErr := &mysql.MySQLError{
+			Number: mysqlerr.ER_DUP_ENTRY,
+		}
+		queryMock.WillReturnError(mySQLErr)
+
+		count = 0
+		err = ds.getContextTryStmt(ctx, &count, query)
+		require.ErrorIs(t, mySQLErr, err)
+		require.NoError(t, dbMock.ExpectationsWereMet())
+		stmt = ds.loadOrPrepareStmt(ctx, query)
+		require.NotNil(t, stmt)
+	})
+
+}
diff --git a/server/datastore/mysql/nanomdm_storage.go b/server/datastore/mysql/nanomdm_storage.go
index 2d89ac3f1c..e032cab539 100644
--- a/server/datastore/mysql/nanomdm_storage.go
+++ b/server/datastore/mysql/nanomdm_storage.go
@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"strings"
 
+	abmctx "github.com/fleetdm/fleet/v4/server/contexts/apple_bm"
 	"github.com/fleetdm/fleet/v4/server/contexts/ctxerr"
 	"github.com/fleetdm/fleet/v4/server/fleet"
 	"github.com/fleetdm/fleet/v4/server/mdm/assets"
@@ -135,6 +136,10 @@ func (s *NanoMDMStorage) GetAllMDMConfigAssetsByName(ctx context.Context, assetN
 	return s.ds.GetAllMDMConfigAssetsByName(ctx, assetNames)
 }
 
+func (s *NanoMDMStorage) GetABMTokenByOrgName(ctx context.Context, orgName string) (*fleet.ABMToken, error) {
+	return s.ds.GetABMTokenByOrgName(ctx, orgName)
+}
+
 // NewMDMAppleDEPStorage returns a MySQL nanodep storage that uses the Datastore
 // underlying MySQL writer *sql.DB.
 func (ds *Datastore) NewMDMAppleDEPStorage() (*NanoDEPStorage, error) {
@@ -156,9 +161,16 @@ type NanoDEPStorage struct {
 	ds fleet.Datastore
 }
 
-// RetrieveAuthTokens partially implements nanodep.AuthTokensRetriever.
+// RetrieveAuthTokens partially implements nanodep.AuthTokensRetriever. NOTE: this method will first
+// check the context for an ABM token; if it doesn't find one, it will fall back to checking the DB.
+// This is so we can use the existing DEP client machinery without major changes. See
+// https://github.com/fleetdm/fleet/issues/21177 for more details.
 func (s *NanoDEPStorage) RetrieveAuthTokens(ctx context.Context, name string) (*nanodep_client.OAuth1Tokens, error) {
-	token, err := assets.ABMToken(ctx, s.ds)
+	if ctxTok, ok := abmctx.FromContext(ctx); ok {
+		return ctxTok, nil
+	}
+
+	token, err := assets.ABMToken(ctx, s.ds, name)
 	if err != nil {
 		return nil, fmt.Errorf("retrieving token in nano dep storage: %w", err)
 	}
diff --git a/server/datastore/mysql/operating_system_vulnerabilities.go b/server/datastore/mysql/operating_system_vulnerabilities.go
index c7598e0464..8a6a30dec0 100644
--- a/server/datastore/mysql/operating_system_vulnerabilities.go
+++ b/server/datastore/mysql/operating_system_vulnerabilities.go
@@ -123,7 +123,7 @@ func (ds *Datastore) InsertOSVulnerability(ctx context.Context, v fleet.OSVulner
 		return false, ctxerr.Wrap(ctx, err, "insert operating system vulnerability")
 	}
 
-	return insertOnDuplicateDidInsert(res), nil
+	return insertOnDuplicateDidInsertOrUpdate(res), nil
 }
 
 func (ds *Datastore) DeleteOSVulnerabilities(ctx context.Context, vulnerabilities []fleet.OSVulnerability) error {
diff --git a/server/datastore/mysql/operating_system_vulnerabilities_test.go b/server/datastore/mysql/operating_system_vulnerabilities_test.go
index 715d8eada3..0b477091cb 100644
--- a/server/datastore/mysql/operating_system_vulnerabilities_test.go
+++ b/server/datastore/mysql/operating_system_vulnerabilities_test.go
@@ -7,6 +7,7 @@ import (
 
 	"github.com/fleetdm/fleet/v4/server/fleet"
 	"github.com/fleetdm/fleet/v4/server/ptr"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -233,10 +234,15 @@ func testInsertOSVulnerability(t *testing.T, ds *Datastore) {
 	require.NoError(t, err)
 	require.True(t, didInsert)
 
-	// Inserting the same vulnerability should not insert
-	didInsert, err = ds.InsertOSVulnerability(ctx, vulnsUpdate, fleet.MSRCSource)
+	// Inserting the same vulnerability should not insert, but update
+	didInsertOrUpdate, err := ds.InsertOSVulnerability(ctx, vulnsUpdate, fleet.MSRCSource)
 	require.NoError(t, err)
-	require.Equal(t, false, didInsert)
+	assert.True(t, didInsertOrUpdate)
+
+	// Inserting the exact same vulnerability again should not insert and not update
+	didInsertOrUpdate, err = ds.InsertOSVulnerability(ctx, vulnsUpdate, fleet.MSRCSource)
+	require.NoError(t, err)
+	assert.False(t, didInsertOrUpdate)
 
 	expected := vulnsUpdate
 	expected.Source = fleet.MSRCSource
diff --git a/server/datastore/mysql/policies.go b/server/datastore/mysql/policies.go
index 4df1f9324a..7ca49d3564 100644
--- a/server/datastore/mysql/policies.go
+++ b/server/datastore/mysql/policies.go
@@ -12,9 +12,9 @@ import (
 
 	"golang.org/x/text/unicode/norm"
 
-	"github.com/doug-martin/goqu/v9"
 	"github.com/fleetdm/fleet/v4/server/contexts/ctxerr"
 	"github.com/fleetdm/fleet/v4/server/fleet"
+	"github.com/fleetdm/fleet/v4/server/ptr"
 	kitlog "github.com/go-kit/log"
 	"github.com/go-kit/log/level"
 	"github.com/jmoiron/sqlx"
@@ -22,12 +22,18 @@ import (
 
 const policyCols = `
 	p.id, p.team_id, p.resolution, p.name, p.query, p.description,
-	p.author_id, p.platforms, p.created_at, p.updated_at, p.critical, p.calendar_events_enabled
+	p.author_id, p.platforms, p.created_at, p.updated_at, p.critical,
+	p.calendar_events_enabled, p.software_installer_id
 `
 
+var errSoftwareTitleIDOnGlobalPolicy = errors.New("install software title id can be set on team policies only")
+
 var policySearchColumns = []string{"p.name"}
 
 func (ds *Datastore) NewGlobalPolicy(ctx context.Context, authorID *uint, args fleet.PolicyPayload) (*fleet.Policy, error) {
+	if args.SoftwareInstallerID != nil {
+		return nil, ctxerr.Wrap(ctx, errSoftwareTitleIDOnGlobalPolicy, "create policy")
+	}
 	if args.QueryID != nil {
 		q, err := ds.Query(ctx, *args.QueryID)
 		if err != nil {
@@ -97,8 +103,7 @@ func policyDB(ctx context.Context, q sqlx.QueryerContext, id uint, teamID *uint)
 		FROM policies p
 		LEFT JOIN users u ON p.author_id = u.id
 		LEFT JOIN policy_stats ps ON p.id = ps.policy_id
-		AND ((p.team_id IS NULL AND ps.inherited_team_id = 0)
-			OR (p.team_id IS NOT NULL AND ps.inherited_team_id = p.team_id))
+		AND ((p.team_id IS NULL AND ps.inherited_team_id IS NULL) OR (p.team_id IS NOT NULL))
 		WHERE p.id=? AND %s`, policyCols, teamWhere),
 		args...)
 	if err != nil {
@@ -129,15 +134,18 @@ func (ds *Datastore) PolicyLite(ctx context.Context, id uint) (*fleet.PolicyLite
 //
 // Currently, SavePolicy does not allow updating the team of an existing policy.
 func (ds *Datastore) SavePolicy(ctx context.Context, p *fleet.Policy, shouldRemoveAllPolicyMemberships bool, removePolicyStats bool) error {
+	if p.TeamID == nil && p.SoftwareInstallerID != nil {
+		return ctxerr.Wrap(ctx, errSoftwareTitleIDOnGlobalPolicy, "save policy")
+	}
 	// We must normalize the name for full Unicode support (Unicode equivalence).
 	p.Name = norm.NFC.String(p.Name)
 	sql := `
 		UPDATE policies
-			SET name = ?, query = ?, description = ?, resolution = ?, platforms = ?, critical = ?, calendar_events_enabled = ?, checksum = ` + policiesChecksumComputedColumn() + `
+			SET name = ?, query = ?, description = ?, resolution = ?, platforms = ?, critical = ?, calendar_events_enabled = ?, software_installer_id = ?, checksum = ` + policiesChecksumComputedColumn() + `
 			WHERE id = ?
 	`
 	result, err := ds.writer(ctx).ExecContext(
-		ctx, sql, p.Name, p.Query, p.Description, p.Resolution, p.Platform, p.Critical, p.CalendarEventsEnabled, p.ID,
+		ctx, sql, p.Name, p.Query, p.Description, p.Resolution, p.Platform, p.Critical, p.CalendarEventsEnabled, p.SoftwareInstallerID, p.ID,
 	)
 	if err != nil {
 		return ctxerr.Wrap(ctx, err, "updating policy")
@@ -372,7 +380,7 @@ func listPoliciesDB(ctx context.Context, q sqlx.QueryerContext, teamID *uint, op
 			COALESCE(ps.failing_host_count, 0) AS failing_host_count
 		FROM policies p
 		LEFT JOIN users u ON p.author_id = u.id
-		LEFT JOIN policy_stats ps ON p.id = ps.policy_id AND ps.inherited_team_id = 0
+		LEFT JOIN policy_stats ps ON p.id = ps.policy_id AND ps.inherited_team_id IS NULL
 	`
 
 	if teamID != nil {
@@ -484,12 +492,12 @@ func (ds *Datastore) PoliciesByID(ctx context.Context, ids []uint) (map[uint]*fl
 	  COALESCE(u.email, '') AS author_email,
 	  ps.updated_at as host_count_updated_at,
 	  COALESCE(ps.passing_host_count, 0) as passing_host_count,
-	  COALESCE(ps.failing_host_count, 0) as failing_host_count
+	  COALESCE(ps.failing_host_count, 0) as failing_host_count,
+	  p.software_installer_id
 	  FROM policies p
 	  LEFT JOIN users u ON p.author_id = u.id
 	  LEFT JOIN policy_stats ps ON p.id = ps.policy_id
-	  	AND ((p.team_id IS NULL AND ps.inherited_team_id = 0)
-				OR (p.team_id IS NOT NULL AND ps.inherited_team_id = p.team_id))
+	  	AND ((p.team_id IS NULL AND ps.inherited_team_id IS NULL) OR (p.team_id IS NOT NULL))
 	  WHERE p.id IN (?)`
 	query, args, err := sqlx.In(sql, ids)
 	if err != nil {
@@ -546,38 +554,25 @@ func deletePolicyDB(ctx context.Context, q sqlx.ExtContext, ids []uint, teamID *
 
 // PolicyQueriesForHost returns the policy queries that are to be executed on the given host.
 func (ds *Datastore) PolicyQueriesForHost(ctx context.Context, host *fleet.Host) (map[string]string, error) {
-	var rows []struct {
-		ID    string `db:"id"`
-		Query string `db:"query"`
-	}
 	if host.FleetPlatform() == "" {
 		// We log to help troubleshooting in case this happens, as the host
 		// won't be receiving any policies targeted for specific platforms.
 		level.Error(ds.logger).Log("err", "unrecognized platform", "hostID", host.ID, "platform", host.Platform) //nolint:errcheck
 	}
-	q := dialect.From("policies").Select(
-		goqu.I("id"),
-		goqu.I("query"),
-	).Where(
-		goqu.And(
-			goqu.Or(
-				goqu.I("platforms").Eq(""),
-				goqu.L("FIND_IN_SET(?, ?)",
-					host.FleetPlatform(),
-					goqu.I("platforms"),
-				).Neq(0),
-			),
-			goqu.Or(
-				goqu.I("team_id").IsNull(),        // global policies
-				goqu.I("team_id").Eq(host.TeamID), // team policies
-			),
-		),
-	)
-	sql, args, err := q.ToSQL()
-	if err != nil {
-		return nil, ctxerr.Wrap(ctx, err, "selecting policies sql build")
+	const stmt = `
+		SELECT id, query
+		FROM policies
+		WHERE
+			-- team_id == NULL are global policies that apply to all hosts
+			-- team_id == 0 are policies that apply to hosts in "No team"
+			-- team_id > 0 are policies that apply to hosts in teams
+			(team_id IS NULL OR team_id = COALESCE(?, 0)) AND
+			(platforms = '' OR FIND_IN_SET(?, platforms))`
+	var rows []struct {
+		ID    string `db:"id"`
+		Query string `db:"query"`
 	}
-	if err := sqlx.SelectContext(ctx, ds.reader(ctx), &rows, sql, args...); err != nil {
+	if err := sqlx.SelectContext(ctx, ds.reader(ctx), &rows, stmt, host.TeamID, host.FleetPlatform()); err != nil {
 		return nil, ctxerr.Wrap(ctx, err, "selecting policies for host")
 	}
 	results := make(map[string]string)
@@ -597,15 +592,27 @@ func (ds *Datastore) NewTeamPolicy(ctx context.Context, teamID uint, authorID *u
 		args.Query = q.Query
 		args.Description = q.Description
 	}
+	// Check team exists.
+	if teamID > 0 {
+		var ok bool
+		err := ds.writer(ctx).GetContext(ctx, &ok, `SELECT COUNT(*) = 1 FROM teams WHERE id = ?`, teamID)
+		if err != nil {
+			return nil, ctxerr.Wrap(ctx, err, "get team id")
+		}
+		if !ok {
+			return nil, ctxerr.Wrap(ctx, notFound("Team").WithID(teamID), "get team id")
+		}
+
+	}
 	// We must normalize the name for full Unicode support (Unicode equivalence).
 	nameUnicode := norm.NFC.String(args.Name)
 	res, err := ds.writer(ctx).ExecContext(ctx,
 		fmt.Sprintf(
-			`INSERT INTO policies (name, query, description, team_id, resolution, author_id, platforms, critical, calendar_events_enabled, checksum) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, %s)`,
+			`INSERT INTO policies (name, query, description, team_id, resolution, author_id, platforms, critical, calendar_events_enabled, software_installer_id, checksum) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, %s)`,
 			policiesChecksumComputedColumn(),
 		),
 		nameUnicode, args.Query, args.Description, teamID, args.Resolution, authorID, args.Platform, args.Critical,
-		args.CalendarEventsEnabled,
+		args.CalendarEventsEnabled, args.SoftwareInstallerID,
 	)
 	switch {
 	case err == nil:
@@ -649,7 +656,7 @@ func (ds *Datastore) ListMergedTeamPolicies(ctx context.Context, teamID uint, op
 		FROM policies p
 		LEFT JOIN users u ON p.author_id = u.id
 		LEFT JOIN policy_stats ps ON p.id = ps.policy_id
-		AND ps.inherited_team_id = IF(p.team_id IS NULL, ?, 0)
+		AND (p.team_id IS NOT NULL OR ps.inherited_team_id = ?)
 		WHERE (p.team_id = ? OR p.team_id IS NULL)
     `
 
@@ -689,8 +696,9 @@ func (ds *Datastore) ApplyPolicySpecs(ctx context.Context, authorID uint, specs
 	queryerContext := ds.writer(ctx)
 
 	// Preprocess specs and group them by team
-	teamNameToID := make(map[string]uint, 1)
-	teamIDToPolicies := make(map[uint][]*fleet.PolicySpec, 1)
+	teamNameToID := make(map[string]*uint, 1)
+	teamIDToPolicies := make(map[*uint][]*fleet.PolicySpec, 1)
+	softwareInstallerIDs := make(map[*uint]map[uint]*uint) // teamID -> titleID -> softwareInstallerID
 
 	// Get the team IDs
 	for _, spec := range specs {
@@ -700,13 +708,18 @@ func (ds *Datastore) ApplyPolicySpecs(ctx context.Context, authorID uint, specs
 		teamID, ok := teamNameToID[spec.Team]
 		if !ok {
 			if spec.Team != "" {
-				// if team name is not empty, it must have a team ID; otherwise teamID defaults to 0 value
-				err := sqlx.GetContext(ctx, queryerContext, &teamID, `SELECT id FROM teams WHERE name = ?`, spec.Team)
-				if err != nil {
-					if errors.Is(err, sql.ErrNoRows) {
-						return ctxerr.Wrap(ctx, notFound("Team").WithName(spec.Team), "get team id")
+				if spec.Team == "No team" {
+					teamID = ptr.Uint(0)
+				} else {
+					var tmID uint
+					err := sqlx.GetContext(ctx, queryerContext, &tmID, `SELECT id FROM teams WHERE name = ?`, spec.Team)
+					if err != nil {
+						if errors.Is(err, sql.ErrNoRows) {
+							return ctxerr.Wrap(ctx, notFound("Team").WithName(spec.Team), "get team id")
+						}
+						return ctxerr.Wrap(ctx, err, "get team id")
 					}
-					return ctxerr.Wrap(ctx, err, "get team id")
+					teamID = &tmID
 				}
 			}
 			teamNameToID[spec.Team] = teamID
@@ -714,13 +727,38 @@ func (ds *Datastore) ApplyPolicySpecs(ctx context.Context, authorID uint, specs
 		teamIDToPolicies[teamID] = append(teamIDToPolicies[teamID], spec)
 	}
 
+	// Get software installer ids from software title ids.
+	for _, spec := range specs {
+		if spec.SoftwareTitleID == nil || *spec.SoftwareTitleID == 0 {
+			continue
+		}
+		if spec.Team == "" {
+			return ctxerr.Wrap(ctx, errSoftwareTitleIDOnGlobalPolicy, "create policy from spec")
+		}
+		var softwareInstallerID uint
+		err := sqlx.GetContext(ctx, queryerContext, &softwareInstallerID,
+			`SELECT id FROM software_installers WHERE global_or_team_id = ? AND title_id = ?`,
+			teamNameToID[spec.Team], spec.SoftwareTitleID)
+		if err != nil {
+			if errors.Is(err, sql.ErrNoRows) {
+				return ctxerr.Wrap(ctx, notFound("SoftwareInstaller").WithID(*spec.SoftwareTitleID), "get software installer id")
+			}
+			return ctxerr.Wrap(ctx, err, "get software installer id")
+		}
+		if len(softwareInstallerIDs[teamNameToID[spec.Team]]) == 0 {
+			softwareInstallerIDs[teamNameToID[spec.Team]] = make(map[uint]*uint)
+		}
+		softwareInstallerIDs[teamNameToID[spec.Team]][*spec.SoftwareTitleID] = &softwareInstallerID
+	}
+
 	// Get the query and platforms of the current policies so that we can check if query or platform changed later, if needed
 	type policyLite struct {
-		Name      string `db:"name"`
-		Query     string `db:"query"`
-		Platforms string `db:"platforms"`
+		Name                string `db:"name"`
+		Query               string `db:"query"`
+		Platforms           string `db:"platforms"`
+		SoftwareInstallerID *uint  `db:"software_installer_id"`
 	}
-	teamIDToPoliciesByName := make(map[uint]map[string]policyLite, len(teamIDToPolicies))
+	teamIDToPoliciesByName := make(map[*uint]map[string]policyLite, len(teamIDToPolicies))
 	for teamID, teamPolicySpecs := range teamIDToPolicies {
 		teamIDToPoliciesByName[teamID] = make(map[string]policyLite, len(teamPolicySpecs))
 		policyNames := make([]string, 0, len(teamPolicySpecs))
@@ -731,11 +769,11 @@ func (ds *Datastore) ApplyPolicySpecs(ctx context.Context, authorID uint, specs
 		var query string
 		var args []interface{}
 		var err error
-		if teamID == 0 {
-			query, args, err = sqlx.In("SELECT name, query, platforms FROM policies WHERE team_id IS NULL AND name IN (?)", policyNames)
+		if teamID == nil {
+			query, args, err = sqlx.In("SELECT name, query, platforms, software_installer_id FROM policies WHERE team_id IS NULL AND name IN (?)", policyNames)
 		} else {
 			query, args, err = sqlx.In(
-				"SELECT name, query, platforms FROM policies WHERE team_id = ? AND name IN (?)", &teamID, policyNames,
+				"SELECT name, query, platforms, software_installer_id FROM policies WHERE team_id = ? AND name IN (?)", *teamID, policyNames,
 			)
 		}
 		if err != nil {
@@ -764,8 +802,9 @@ func (ds *Datastore) ApplyPolicySpecs(ctx context.Context, authorID uint, specs
 			platforms,
 			critical,
 			calendar_events_enabled,
+			software_installer_id,
 			checksum
-		) VALUES ( ?, ?, ?, ?, ?, ?, ?, ?, ?, %s)
+		) VALUES ( ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, %s)
 		ON DUPLICATE KEY UPDATE
 			query = VALUES(query),
 			description = VALUES(description),
@@ -773,26 +812,26 @@ func (ds *Datastore) ApplyPolicySpecs(ctx context.Context, authorID uint, specs
 			resolution = VALUES(resolution),
 			platforms = VALUES(platforms),
 			critical = VALUES(critical),
-			calendar_events_enabled = VALUES(calendar_events_enabled)
+			calendar_events_enabled = VALUES(calendar_events_enabled),
+			software_installer_id = VALUES(software_installer_id)
 		`, policiesChecksumComputedColumn(),
 		)
 		for teamID, teamPolicySpecs := range teamIDToPolicies {
-			var teamIDPtr *uint
-			if teamID != 0 {
-				teamIDPtr = &teamID
-			}
 			for _, spec := range teamPolicySpecs {
-
+				var softwareInstallerID *uint
+				if spec.SoftwareTitleID != nil {
+					softwareInstallerID = softwareInstallerIDs[teamNameToID[spec.Team]][*spec.SoftwareTitleID]
+				}
 				res, err := tx.ExecContext(
 					ctx,
-					query, spec.Name, spec.Query, spec.Description, authorID, spec.Resolution, teamIDPtr, spec.Platform, spec.Critical,
-					spec.CalendarEventsEnabled,
+					query, spec.Name, spec.Query, spec.Description, authorID, spec.Resolution, teamID, spec.Platform, spec.Critical,
+					spec.CalendarEventsEnabled, softwareInstallerID,
 				)
 				if err != nil {
 					return ctxerr.Wrap(ctx, err, "exec ApplyPolicySpecs insert")
 				}
 
-				if insertOnDuplicateDidUpdate(res) {
+				if insertOnDuplicateDidInsertOrUpdate(res) {
 					// when the upsert results in an UPDATE that *did* change some values,
 					// it returns the updated ID as last inserted id.
 					if lastID, _ := res.LastInsertId(); lastID > 0 {
@@ -800,12 +839,21 @@ func (ds *Datastore) ApplyPolicySpecs(ctx context.Context, authorID uint, specs
 							shouldRemoveAllPolicyMemberships bool
 							removePolicyStats                bool
 						)
-						// Figure out if the query or platform changed
+						// Figure out if the query, platform or software installer changed.
+						var softwareInstallerID *uint
+						if spec.SoftwareTitleID != nil {
+							softwareInstallerID = softwareInstallerIDs[teamID][*spec.SoftwareTitleID]
+						}
 						if prev, ok := teamIDToPoliciesByName[teamID][spec.Name]; ok {
 							switch {
 							case prev.Query != spec.Query:
 								shouldRemoveAllPolicyMemberships = true
 								removePolicyStats = true
+							case teamID != nil &&
+								((prev.SoftwareInstallerID == nil && spec.SoftwareTitleID != nil) ||
+									(prev.SoftwareInstallerID != nil && softwareInstallerID != nil && *prev.SoftwareInstallerID != *softwareInstallerID)):
+								shouldRemoveAllPolicyMemberships = true
+								removePolicyStats = true
 							case prev.Platforms != spec.Platform:
 								removePolicyStats = true
 							}
@@ -1368,7 +1416,7 @@ func (ds *Datastore) UpdateHostPolicyCounts(ctx context.Context) error {
 			WHERE p.team_id IS NULL AND p.id = ?
 			GROUP BY t.id, p.id`
 			err = sqlx.SelectContext(ctx, db, &policyStats, selectStmt, policy.ID)
-			if err != nil && !errors.Is(err, sql.ErrNoRows) {
+			if err != nil {
 				if errors.Is(err, sql.ErrNoRows) {
 					// Policy or team was deleted by a parallel process. We proceed.
 					level.Error(ds.logger).Log(
@@ -1378,6 +1426,38 @@ func (ds *Datastore) UpdateHostPolicyCounts(ctx context.Context) error {
 				}
 				return ctxerr.Wrap(ctx, err, "select policy counts for inherited global policies")
 			}
+
+			noTeamStmt := `SELECT
+				p.id as policy_id,
+				0 AS inherited_team_id, -- 0 means "No team"
+				(
+					SELECT COUNT(*)
+					FROM policy_membership pm
+					INNER JOIN hosts h ON pm.host_id = h.id
+					WHERE pm.policy_id = p.id AND pm.passes = true AND h.team_id IS NULL
+				) AS passing_host_count,
+				(
+					SELECT COUNT(*)
+					FROM policy_membership pm
+					INNER JOIN hosts h ON pm.host_id = h.id
+					WHERE pm.policy_id = p.id AND pm.passes = false AND h.team_id IS NULL
+				) AS failing_host_count
+			FROM policies p
+			WHERE p.team_id IS NULL AND p.id = ?`
+			var noTeamPolicyStats []policyStat
+			err = sqlx.SelectContext(ctx, db, &noTeamPolicyStats, noTeamStmt, policy.ID)
+			if err != nil {
+				if errors.Is(err, sql.ErrNoRows) {
+					// Policy was deleted by a parallel process. We proceed.
+					level.Error(ds.logger).Log(
+						"msg", "'No team' policy not found for inherited global policies. Was policy deleted?", "policy_id", policy.ID,
+					)
+					continue
+				}
+				return ctxerr.Wrap(ctx, err, "select policy counts for inherited global policies for 'no team' policies")
+			}
+			policyStats = append(policyStats, noTeamPolicyStats...)
+
 			insertStmt := `INSERT INTO policy_stats (policy_id, inherited_team_id, passing_host_count, failing_host_count)
 			VALUES (:policy_id, :inherited_team_id, :passing_host_count, :failing_host_count)
 			ON DUPLICATE KEY UPDATE
@@ -1401,7 +1481,7 @@ func (ds *Datastore) UpdateHostPolicyCounts(ctx context.Context) error {
 		INSERT INTO policy_stats (policy_id, inherited_team_id, passing_host_count, failing_host_count)
 		SELECT
 			p.id,
-			0 AS inherited_team_id, -- using 0 to represent global scope
+			NULL AS inherited_team_id, -- using NULL to represent global scope
 			COALESCE(SUM(IF(pm.passes IS NULL, 0, pm.passes = 1)), 0), 
 			COALESCE(SUM(IF(pm.passes IS NULL, 0, pm.passes = 0)), 0)
 		FROM policies p
@@ -1429,6 +1509,22 @@ func (ds *Datastore) GetCalendarPolicies(ctx context.Context, teamID uint) ([]fl
 	return policies, nil
 }
 
+func (ds *Datastore) GetPoliciesWithAssociatedInstaller(ctx context.Context, teamID uint, policyIDs []uint) ([]fleet.PolicySoftwareInstallerData, error) {
+	if len(policyIDs) == 0 {
+		return nil, nil
+	}
+	query := `SELECT id, software_installer_id FROM policies WHERE team_id = ? AND software_installer_id IS NOT NULL AND id IN (?);`
+	query, args, err := sqlx.In(query, teamID, policyIDs)
+	if err != nil {
+		return nil, ctxerr.Wrapf(ctx, err, "build sqlx.In for get policies with associated installer")
+	}
+	var policies []fleet.PolicySoftwareInstallerData
+	if err := sqlx.SelectContext(ctx, ds.reader(ctx), &policies, query, args...); err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "get policies with associated installer")
+	}
+	return policies, nil
+}
+
 func (ds *Datastore) GetTeamHostsPolicyMemberships(
 	ctx context.Context,
 	domain string,
diff --git a/server/datastore/mysql/policies_test.go b/server/datastore/mysql/policies_test.go
index d3b9bdb93a..96392e494f 100644
--- a/server/datastore/mysql/policies_test.go
+++ b/server/datastore/mysql/policies_test.go
@@ -1,6 +1,7 @@
 package mysql
 
 import (
+	"bytes"
 	"context"
 	"crypto/md5" //nolint:gosec // (only used for tests)
 	"encoding/hex"
@@ -63,6 +64,10 @@ func TestPolicies(t *testing.T) {
 		{"TestPoliciesNameSort", testPoliciesNameSort},
 		{"TestGetCalendarPolicies", testGetCalendarPolicies},
 		{"GetTeamHostsPolicyMemberships", testGetTeamHostsPolicyMemberships},
+		{"TestPoliciesNewGlobalPolicyWithInstaller", testNewGlobalPolicyWithInstaller},
+		{"TestPoliciesTeamPoliciesWithInstaller", testTeamPoliciesWithInstaller},
+		{"ApplyPolicySpecWithInstallers", testApplyPolicySpecWithInstallers},
+		{"TeamPoliciesNoTeam", testTeamPoliciesNoTeam},
 	}
 	for _, c := range cases {
 		t.Run(c.name, func(t *testing.T) {
@@ -1219,9 +1224,29 @@ func testPolicyQueriesForHost(t *testing.T, ds *Datastore) {
 func testPoliciesByID(t *testing.T, ds *Datastore) {
 	user1 := test.NewUser(t, ds, "Alice", "alice@example.com", true)
 	policy1 := newTestPolicy(t, ds, user1, "policy1", "darwin", nil)
-	_ = newTestPolicy(t, ds, user1, "policy2", "darwin", nil)
+	team1, err := ds.NewTeam(context.Background(), &fleet.Team{Name: "team1"})
+	require.NoError(t, err)
+	policy2 := newTestPolicy(t, ds, user1, "policy2", "darwin", &team1.ID)
 	host1 := newTestHostWithPlatform(t, ds, "host1", "darwin", nil)
 
+	// Associate an installer to policy2
+	installerID, err := ds.MatchOrCreateSoftwareInstaller(context.Background(), &fleet.UploadSoftwareInstallerPayload{
+		InstallScript:     "hello",
+		PreInstallQuery:   "SELECT 1",
+		PostInstallScript: "world",
+		InstallerFile:     bytes.NewReader([]byte("hello")),
+		StorageID:         "storage1",
+		Filename:          "file1",
+		Title:             "file1",
+		Version:           "1.0",
+		Source:            "apps",
+		UserID:            user1.ID,
+	})
+	require.NoError(t, err)
+	policy2.SoftwareInstallerID = ptr.Uint(installerID)
+	err = ds.SavePolicy(context.Background(), policy2, false, false)
+	require.NoError(t, err)
+
 	require.NoError(t, ds.RecordPolicyQueryExecutions(context.Background(), host1, map[uint]*bool{policy1.ID: ptr.Bool(true)}, time.Now(), false))
 	require.NoError(t, ds.UpdateHostPolicyCounts(context.Background()))
 
@@ -1230,9 +1255,12 @@ func testPoliciesByID(t *testing.T, ds *Datastore) {
 	assert.Equal(t, len(policiesByID), 2)
 	assert.Equal(t, policiesByID[1].ID, policy1.ID)
 	assert.Equal(t, policiesByID[1].Name, policy1.Name)
+	assert.Nil(t, policiesByID[1].SoftwareInstallerID)
+	assert.Equal(t, uint(1), policiesByID[1].PassingHostCount)
 	assert.Equal(t, policiesByID[2].ID, uint(2))
 	assert.Equal(t, policiesByID[2].Name, "policy2")
-	assert.Equal(t, uint(1), policiesByID[1].PassingHostCount)
+	assert.NotNil(t, policiesByID[2].SoftwareInstallerID)
+	assert.Equal(t, uint(1), *policiesByID[2].SoftwareInstallerID)
 
 	_, err = ds.PoliciesByID(context.Background(), []uint{1, 2, 3})
 	require.Error(t, err)
@@ -1386,6 +1414,14 @@ func testApplyPolicySpec(t *testing.T, ds *Datastore) {
 			Team:        "team1",
 			Platform:    "windows,linux",
 		},
+		{
+			Name:        "query4",
+			Query:       "select 4;",
+			Description: "query4 desc",
+			Resolution:  "some other good resolution 2",
+			Team:        "No team",
+			Platform:    "",
+		},
 	}))
 
 	policies, err := ds.ListGlobalPolicies(ctx, fleet.ListOptions{})
@@ -1423,6 +1459,21 @@ func testApplyPolicySpec(t *testing.T, ds *Datastore) {
 	assert.Equal(t, "windows,linux", teamPolicies[1].Platform)
 	assert.False(t, teamPolicies[1].CalendarEventsEnabled)
 
+	noTeamPolicies, _, err := ds.ListTeamPolicies(ctx, fleet.PolicyNoTeamID, fleet.ListOptions{}, fleet.ListOptions{})
+	require.NoError(t, err)
+	require.Len(t, noTeamPolicies, 1)
+	assert.Equal(t, "query4", noTeamPolicies[0].Name)
+	assert.Equal(t, "select 4;", noTeamPolicies[0].Query)
+	assert.Equal(t, "query4 desc", noTeamPolicies[0].Description)
+	require.NotNil(t, noTeamPolicies[0].AuthorID)
+	assert.Equal(t, user1.ID, *noTeamPolicies[0].AuthorID)
+	require.NotNil(t, noTeamPolicies[0].Resolution)
+	assert.Equal(t, "some other good resolution 2", *noTeamPolicies[0].Resolution)
+	assert.Equal(t, "", noTeamPolicies[0].Platform)
+	assert.False(t, noTeamPolicies[0].CalendarEventsEnabled)
+	assert.NotNil(t, noTeamPolicies[0].TeamID)
+	assert.Zero(t, *noTeamPolicies[0].TeamID)
+
 	// Make sure apply is idempotent
 	require.NoError(t, ds.ApplyPolicySpecs(ctx, user1.ID, []*fleet.PolicySpec{
 		{
@@ -1450,6 +1501,14 @@ func testApplyPolicySpec(t *testing.T, ds *Datastore) {
 			Team:        "team1",
 			Platform:    "windows,linux",
 		},
+		{
+			Name:        "query4",
+			Query:       "select 4;",
+			Description: "query4 desc",
+			Resolution:  "some other good resolution 2",
+			Team:        "No team",
+			Platform:    "",
+		},
 	}))
 
 	policies, err = ds.ListGlobalPolicies(ctx, fleet.ListOptions{})
@@ -1458,6 +1517,9 @@ func testApplyPolicySpec(t *testing.T, ds *Datastore) {
 	teamPolicies, _, err = ds.ListTeamPolicies(ctx, team1.ID, fleet.ListOptions{}, fleet.ListOptions{})
 	require.NoError(t, err)
 	require.Len(t, teamPolicies, 2)
+	noTeamPolicies, _, err = ds.ListTeamPolicies(ctx, fleet.PolicyNoTeamID, fleet.ListOptions{}, fleet.ListOptions{})
+	require.NoError(t, err)
+	require.Len(t, noTeamPolicies, 1)
 
 	// Test policy updating.
 	require.NoError(t, ds.ApplyPolicySpecs(ctx, user1.ID, []*fleet.PolicySpec{
@@ -3875,3 +3937,894 @@ func testGetTeamHostsPolicyMemberships(t *testing.T, ds *Datastore) {
 	require.Equal(t, "serial2", hostsTeam2[0].HostHardwareSerial)
 	require.Equal(t, "display_name2", hostsTeam2[0].HostDisplayName)
 }
+
+func testNewGlobalPolicyWithInstaller(t *testing.T, ds *Datastore) {
+	user1 := test.NewUser(t, ds, "Alice", "alice@example.com", true)
+	_, err := ds.NewGlobalPolicy(context.Background(), &user1.ID, fleet.PolicyPayload{
+		Query:               "SELECT 1;",
+		SoftwareInstallerID: ptr.Uint(1),
+	})
+	require.Error(t, err)
+	require.ErrorIs(t, err, errSoftwareTitleIDOnGlobalPolicy)
+}
+
+func testTeamPoliciesWithInstaller(t *testing.T, ds *Datastore) {
+	ctx := context.Background()
+
+	user1 := test.NewUser(t, ds, "Alice", "alice@example.com", true)
+	team1, err := ds.NewTeam(ctx, &fleet.Team{Name: "team1"})
+	require.NoError(t, err)
+	team2, err := ds.NewTeam(ctx, &fleet.Team{Name: "team2"}) // team2 has no policies
+	require.NoError(t, err)
+
+	// Policy p1 has no associated installer.
+	p1, err := ds.NewTeamPolicy(ctx, team1.ID, &user1.ID, fleet.PolicyPayload{
+		Name:                "p1",
+		Query:               "SELECT 1;",
+		SoftwareInstallerID: nil,
+	})
+	require.NoError(t, err)
+	// Create and associate an installer to p2.
+	installerID, err := ds.MatchOrCreateSoftwareInstaller(context.Background(), &fleet.UploadSoftwareInstallerPayload{
+		InstallScript:     "hello",
+		PreInstallQuery:   "SELECT 1",
+		PostInstallScript: "world",
+		InstallerFile:     bytes.NewReader([]byte("hello")),
+		StorageID:         "storage1",
+		Filename:          "file1",
+		Title:             "file1",
+		Version:           "1.0",
+		Source:            "apps",
+		UserID:            user1.ID,
+	})
+	require.NoError(t, err)
+	require.Nil(t, p1.SoftwareInstallerID)
+	p2, err := ds.NewTeamPolicy(ctx, team1.ID, &user1.ID, fleet.PolicyPayload{
+		Name:                "p2",
+		Query:               "SELECT 1;",
+		SoftwareInstallerID: ptr.Uint(installerID),
+	})
+	require.NoError(t, err)
+	require.NotNil(t, p2.SoftwareInstallerID)
+	require.Equal(t, installerID, *p2.SoftwareInstallerID)
+	// Create p3 as global policy.
+	_, err = ds.NewGlobalPolicy(ctx, &user1.ID, fleet.PolicyPayload{
+		Name:  "p3",
+		Query: "SELECT 1;",
+	})
+	require.NoError(t, err)
+
+	p2, err = ds.Policy(ctx, p2.ID)
+	require.NoError(t, err)
+	require.NotNil(t, p2.SoftwareInstallerID)
+	require.Equal(t, installerID, *p2.SoftwareInstallerID)
+
+	// Policy p4 in "No team" with associated installer.
+	p4, err := ds.NewTeamPolicy(ctx, fleet.PolicyNoTeamID, &user1.ID, fleet.PolicyPayload{
+		Name:                "p4",
+		Query:               "SELECT 4;",
+		SoftwareInstallerID: ptr.Uint(installerID),
+	})
+	require.NoError(t, err)
+	policiesWithInstallers, err := ds.GetPoliciesWithAssociatedInstaller(ctx, fleet.PolicyNoTeamID, []uint{p4.ID})
+	require.NoError(t, err)
+	require.Len(t, policiesWithInstallers, 1)
+	require.Equal(t, p4.ID, policiesWithInstallers[0].ID)
+
+	policiesWithInstallers, err = ds.GetPoliciesWithAssociatedInstaller(ctx, team1.ID, []uint{})
+	require.NoError(t, err)
+	require.Empty(t, policiesWithInstallers)
+
+	// p1 has no associated installers.
+	policiesWithInstallers, err = ds.GetPoliciesWithAssociatedInstaller(ctx, team1.ID, []uint{p1.ID})
+	require.NoError(t, err)
+	require.Empty(t, policiesWithInstallers)
+
+	policiesWithInstallers, err = ds.GetPoliciesWithAssociatedInstaller(ctx, team1.ID, []uint{p2.ID})
+	require.NoError(t, err)
+	require.Len(t, policiesWithInstallers, 1)
+	require.Equal(t, p2.ID, policiesWithInstallers[0].ID)
+	require.Equal(t, installerID, policiesWithInstallers[0].InstallerID)
+
+	// p2 has associated installer but belongs to team1.
+	policiesWithInstallers, err = ds.GetPoliciesWithAssociatedInstaller(ctx, team2.ID, []uint{p2.ID})
+	require.NoError(t, err)
+	require.Empty(t, policiesWithInstallers)
+
+	p1.SoftwareInstallerID = ptr.Uint(installerID)
+	err = ds.SavePolicy(ctx, p1, false, false)
+	require.NoError(t, err)
+
+	p2, err = ds.Policy(ctx, p2.ID)
+	require.NoError(t, err)
+	require.NotNil(t, p2.SoftwareInstallerID)
+	require.Equal(t, installerID, *p2.SoftwareInstallerID)
+
+	policiesWithInstallers, err = ds.GetPoliciesWithAssociatedInstaller(ctx, team1.ID, []uint{p1.ID, p2.ID})
+	require.NoError(t, err)
+	require.Len(t, policiesWithInstallers, 2)
+	require.Equal(t, p1.ID, policiesWithInstallers[0].ID)
+	require.Equal(t, installerID, policiesWithInstallers[0].InstallerID)
+	require.Equal(t, p2.ID, policiesWithInstallers[1].ID)
+	require.Equal(t, installerID, policiesWithInstallers[1].InstallerID)
+
+	policiesWithInstallers, err = ds.GetPoliciesWithAssociatedInstaller(ctx, team2.ID, []uint{p1.ID, p2.ID})
+	require.NoError(t, err)
+	require.Empty(t, policiesWithInstallers)
+}
+
+func testApplyPolicySpecWithInstallers(t *testing.T, ds *Datastore) {
+	ctx := context.Background()
+
+	user1 := test.NewUser(t, ds, "User1", "user1@example.com", true)
+	team1, err := ds.NewTeam(ctx, &fleet.Team{Name: "team1"})
+	require.NoError(t, err)
+	team2, err := ds.NewTeam(ctx, &fleet.Team{Name: "team2"})
+	require.NoError(t, err)
+	newHost := func(name string, teamID *uint, platform string) *fleet.Host {
+		h, err := ds.NewHost(ctx, &fleet.Host{
+			OsqueryHostID:   ptr.String(uuid.New().String()),
+			DetailUpdatedAt: time.Now(),
+			LabelUpdatedAt:  time.Now(),
+			PolicyUpdatedAt: time.Now(),
+			SeenTime:        time.Now(),
+			NodeKey:         ptr.String(uuid.New().String()),
+			UUID:            uuid.New().String(),
+			Hostname:        name,
+			TeamID:          teamID,
+			Platform:        platform,
+		})
+		require.NoError(t, err)
+		return h
+	}
+
+	host1Team1 := newHost("host1Team1", &team1.ID, "darwin")
+
+	installer1ID, err := ds.MatchOrCreateSoftwareInstaller(ctx, &fleet.UploadSoftwareInstallerPayload{
+		InstallScript:     "hello",
+		PreInstallQuery:   "SELECT 1;",
+		PostInstallScript: "world1",
+		InstallerFile:     bytes.NewReader([]byte("hello1")),
+		StorageID:         "storage1",
+		Filename:          "file1",
+		Title:             "file1",
+		Version:           "1.0",
+		Source:            "apps",
+		UserID:            user1.ID,
+		TeamID:            &team1.ID,
+	})
+	require.NoError(t, err)
+	installer1, err := ds.GetSoftwareInstallerMetadataByID(ctx, installer1ID)
+	require.NoError(t, err)
+	require.NotNil(t, installer1.TitleID)
+	installer2ID, err := ds.MatchOrCreateSoftwareInstaller(ctx, &fleet.UploadSoftwareInstallerPayload{
+		InstallScript:     "hello2",
+		PreInstallQuery:   "SELECT 2;",
+		PostInstallScript: "world2",
+		InstallerFile:     bytes.NewReader([]byte("hello2")),
+		StorageID:         "storage2",
+		Filename:          "file2",
+		Title:             "file2",
+		Version:           "1.0",
+		Source:            "deb_packages",
+		UserID:            user1.ID,
+		TeamID:            &team2.ID,
+	})
+	require.NoError(t, err)
+	installer2, err := ds.GetSoftwareInstallerMetadataByID(ctx, installer2ID)
+	require.NoError(t, err)
+	require.NotNil(t, installer2.TitleID)
+	installer3ID, err := ds.MatchOrCreateSoftwareInstaller(ctx, &fleet.UploadSoftwareInstallerPayload{
+		InstallScript:     "hello3",
+		PreInstallQuery:   "SELECT 3;",
+		PostInstallScript: "world3",
+		InstallerFile:     bytes.NewReader([]byte("hello3")),
+		StorageID:         "storage3",
+		Filename:          "file3",
+		Title:             "file3",
+		Version:           "1.0",
+		Source:            "rpm_packages",
+		UserID:            user1.ID,
+		TeamID:            nil,
+	})
+	require.NoError(t, err)
+	installer3, err := ds.GetSoftwareInstallerMetadataByID(ctx, installer3ID)
+	require.NoError(t, err)
+	require.NotNil(t, installer3.TitleID)
+	// Another installer on team1 to test changing installers.
+	installer5ID, err := ds.MatchOrCreateSoftwareInstaller(ctx, &fleet.UploadSoftwareInstallerPayload{
+		InstallScript:     "hello5",
+		PreInstallQuery:   "SELECT 5;",
+		PostInstallScript: "world5",
+		InstallerFile:     bytes.NewReader([]byte("hello5")),
+		StorageID:         "storage5",
+		Filename:          "file5",
+		Title:             "file5",
+		Version:           "1.0",
+		Source:            "programs",
+		UserID:            user1.ID,
+		TeamID:            &team1.ID,
+	})
+	require.NoError(t, err)
+	installer5, err := ds.GetSoftwareInstallerMetadataByID(ctx, installer5ID)
+	require.NoError(t, err)
+	require.NotNil(t, installer5.TitleID)
+
+	// Installers cannot be assigned to global policies.
+	err = ds.ApplyPolicySpecs(ctx, user1.ID, []*fleet.PolicySpec{
+		{
+			Name:            "Global policy",
+			Query:           "SELECT 1;",
+			Description:     "Description",
+			Resolution:      "Resolution",
+			Team:            "",
+			Platform:        "darwin",
+			SoftwareTitleID: installer1.TitleID,
+		},
+	})
+	require.Error(t, err)
+	require.ErrorIs(t, err, errSoftwareTitleIDOnGlobalPolicy)
+
+	// Apply two team policies associated to two installers and a "No team" policy associated to an installer.
+	err = ds.ApplyPolicySpecs(ctx, user1.ID, []*fleet.PolicySpec{
+		{
+			Name:            "Team policy 1",
+			Query:           "SELECT 1;",
+			Description:     "Description 1",
+			Resolution:      "Resolution 1",
+			Team:            "team1",
+			Platform:        "darwin",
+			SoftwareTitleID: installer1.TitleID,
+		},
+		{
+			Name:            "Team policy 2",
+			Query:           "SELECT 2;",
+			Description:     "Description 2",
+			Resolution:      "Resolution 2",
+			Team:            "team2",
+			Platform:        "linux",
+			SoftwareTitleID: installer2.TitleID,
+		},
+		{
+			Name:            "No team policy 3",
+			Query:           "SELECT 3;",
+			Description:     "Description 3",
+			Resolution:      "Resolution 3",
+			Team:            "No team",
+			Platform:        "linux",
+			SoftwareTitleID: installer3.TitleID,
+		},
+	})
+	require.NoError(t, err)
+	team1Policies, _, err := ds.ListTeamPolicies(ctx, team1.ID, fleet.ListOptions{}, fleet.ListOptions{})
+	require.NoError(t, err)
+	require.Len(t, team1Policies, 1)
+	require.NotNil(t, team1Policies[0].SoftwareInstallerID)
+	policy1Team1 := team1Policies[0]
+	require.Equal(t, installer1.InstallerID, *team1Policies[0].SoftwareInstallerID)
+	team2Policies, _, err := ds.ListTeamPolicies(ctx, team2.ID, fleet.ListOptions{}, fleet.ListOptions{})
+	require.NoError(t, err)
+	require.Len(t, team2Policies, 1)
+	require.NotNil(t, team2Policies[0].SoftwareInstallerID)
+	require.Equal(t, installer2.InstallerID, *team2Policies[0].SoftwareInstallerID)
+	noTeamPolicies, _, err := ds.ListTeamPolicies(ctx, fleet.PolicyNoTeamID, fleet.ListOptions{}, fleet.ListOptions{})
+	require.NoError(t, err)
+	require.Len(t, noTeamPolicies, 1)
+	require.NotNil(t, noTeamPolicies[0].SoftwareInstallerID)
+	require.Equal(t, installer3.InstallerID, *noTeamPolicies[0].SoftwareInstallerID)
+
+	// Record policy execution on policy1Team1.
+	err = ds.RecordPolicyQueryExecutions(ctx, host1Team1, map[uint]*bool{
+		policy1Team1.ID: ptr.Bool(false),
+	}, time.Now(), false)
+	require.NoError(t, err)
+	err = ds.UpdateHostPolicyCounts(ctx)
+	require.NoError(t, err)
+
+	// Unset software installer from "Team policy 1".
+	err = ds.ApplyPolicySpecs(ctx, user1.ID, []*fleet.PolicySpec{
+		{
+			Name:            "Team policy 1",
+			Query:           "SELECT 1;",
+			Description:     "Description 1",
+			Resolution:      "Resolution 1",
+			Team:            "team1",
+			Platform:        "darwin",
+			SoftwareTitleID: nil,
+		},
+	})
+	require.NoError(t, err)
+	team1Policies, _, err = ds.ListTeamPolicies(ctx, team1.ID, fleet.ListOptions{}, fleet.ListOptions{})
+	require.NoError(t, err)
+	require.Len(t, team1Policies, 1)
+	require.Nil(t, team1Policies[0].SoftwareInstallerID)
+	// Should not clear results because we've cleared not changed/set-new installer.
+	require.Equal(t, uint(1), team1Policies[0].FailingHostCount)
+
+	// Set "Team policy 1" to a software installer on team2.
+	err = ds.ApplyPolicySpecs(ctx, user1.ID, []*fleet.PolicySpec{
+		{
+			Name:            "Team policy 1",
+			Query:           "SELECT 1;",
+			Description:     "Description 1",
+			Resolution:      "Resolution 1",
+			Team:            "team1",
+			Platform:        "darwin",
+			SoftwareTitleID: installer2.TitleID,
+		},
+	})
+	require.Error(t, err)
+	var notFoundErr *notFoundError
+	require.ErrorAs(t, err, &notFoundErr)
+
+	// Set "No team policy 3" to a software installer on team2.
+	err = ds.ApplyPolicySpecs(ctx, user1.ID, []*fleet.PolicySpec{
+		{
+			Name:            "No team policy 3",
+			Query:           "SELECT 3;",
+			Description:     "Description 3",
+			Resolution:      "Resolution 3",
+			Team:            "No team",
+			Platform:        "darwin",
+			SoftwareTitleID: installer2.TitleID,
+		},
+	})
+	require.Error(t, err)
+	require.ErrorAs(t, err, &notFoundErr)
+
+	// Set "Team policy 1" to a software title that doesn't exist.
+	err = ds.ApplyPolicySpecs(ctx, user1.ID, []*fleet.PolicySpec{
+		{
+			Name:            "Team policy 1",
+			Query:           "SELECT 1;",
+			Description:     "Description 1",
+			Resolution:      "Resolution 1",
+			Team:            "team1",
+			Platform:        "darwin",
+			SoftwareTitleID: ptr.Uint(999_999),
+		},
+	})
+	require.Error(t, err)
+	require.ErrorAs(t, err, &notFoundErr)
+
+	// Set "No team policy 3" to a software title that doesn't exist.
+	err = ds.ApplyPolicySpecs(ctx, user1.ID, []*fleet.PolicySpec{
+		{
+			Name:            "No team policy 3",
+			Query:           "SELECT 3;",
+			Description:     "Description 3",
+			Resolution:      "Resolution 3",
+			Team:            "No team",
+			Platform:        "darwin",
+			SoftwareTitleID: ptr.Uint(999_999),
+		},
+	})
+	require.Error(t, err)
+	require.ErrorAs(t, err, &notFoundErr)
+
+	// Unset software installer from "Team policy 2" using 0.
+	err = ds.ApplyPolicySpecs(ctx, user1.ID, []*fleet.PolicySpec{
+		{
+			Name:            "Team policy 2",
+			Query:           "SELECT 2;",
+			Description:     "Description 2",
+			Resolution:      "Resolution 2",
+			Team:            "team2",
+			Platform:        "linux",
+			SoftwareTitleID: ptr.Uint(0),
+		},
+	})
+	require.NoError(t, err)
+	team2Policies, _, err = ds.ListTeamPolicies(ctx, team2.ID, fleet.ListOptions{}, fleet.ListOptions{})
+	require.NoError(t, err)
+	require.Len(t, team2Policies, 1)
+	require.Nil(t, team2Policies[0].SoftwareInstallerID)
+
+	// Apply team policies associated to two installers (again, with two installers with the same title).
+	installer4ID, err := ds.MatchOrCreateSoftwareInstaller(ctx, &fleet.UploadSoftwareInstallerPayload{
+		InstallScript:     "hello3",
+		PreInstallQuery:   "SELECT 3;",
+		PostInstallScript: "world3",
+		InstallerFile:     bytes.NewReader([]byte("hello3")),
+		StorageID:         "storage3",
+		Filename:          "file1",
+		Title:             "file1", // same title as installer1.
+		Version:           "1.0",
+		Source:            "apps",
+		UserID:            user1.ID,
+		TeamID:            &team2.ID,
+	})
+	require.NoError(t, err)
+	installer4, err := ds.GetSoftwareInstallerMetadataByID(ctx, installer4ID)
+	require.NoError(t, err)
+	require.NotNil(t, installer2.TitleID)
+	err = ds.ApplyPolicySpecs(ctx, user1.ID, []*fleet.PolicySpec{
+		{
+			Name:            "Team policy 1",
+			Query:           "SELECT 1;",
+			Description:     "Description 1",
+			Resolution:      "Resolution 1",
+			Team:            "team1",
+			Platform:        "darwin",
+			SoftwareTitleID: installer1.TitleID,
+		},
+		{
+			Name:            "Team policy 2",
+			Query:           "SELECT 2;",
+			Description:     "Description 2",
+			Resolution:      "Resolution 2",
+			Team:            "team2",
+			Platform:        "linux",
+			SoftwareTitleID: installer4.TitleID,
+		},
+	})
+	require.NoError(t, err)
+	team1Policies, _, err = ds.ListTeamPolicies(ctx, team1.ID, fleet.ListOptions{}, fleet.ListOptions{})
+	require.NoError(t, err)
+	require.Len(t, team1Policies, 1)
+	require.NotNil(t, team1Policies[0].SoftwareInstallerID)
+	require.Equal(t, installer1.InstallerID, *team1Policies[0].SoftwareInstallerID)
+	// Should clear results because we've are setting an installer.
+	require.Equal(t, uint(0), team1Policies[0].FailingHostCount)
+	countBiggerThanZero := true
+	ExecAdhocSQL(t, ds, func(q sqlx.ExtContext) error {
+		return sqlx.GetContext(ctx, q,
+			&countBiggerThanZero,
+			`SELECT COUNT(*) > 0 FROM policy_membership WHERE policy_id = ?`,
+			team1Policies[0].ID,
+		)
+	})
+	require.False(t, countBiggerThanZero)
+	team2Policies, _, err = ds.ListTeamPolicies(ctx, team2.ID, fleet.ListOptions{}, fleet.ListOptions{})
+	require.NoError(t, err)
+	require.Len(t, team2Policies, 1)
+	require.NotNil(t, team2Policies[0].SoftwareInstallerID)
+	require.Equal(t, installer4.InstallerID, *team2Policies[0].SoftwareInstallerID)
+
+	// Record policy execution on policy1Team1 to test that setting the same installer won't clear results.
+	err = ds.RecordPolicyQueryExecutions(ctx, host1Team1, map[uint]*bool{
+		policy1Team1.ID: ptr.Bool(false),
+	}, time.Now(), false)
+	require.NoError(t, err)
+	err = ds.UpdateHostPolicyCounts(ctx)
+	require.NoError(t, err)
+	err = ds.ApplyPolicySpecs(ctx, user1.ID, []*fleet.PolicySpec{
+		{
+			Name:            "Team policy 1",
+			Query:           "SELECT 1;",
+			Description:     "Description 1",
+			Resolution:      "Resolution 1",
+			Team:            "team1",
+			Platform:        "darwin",
+			SoftwareTitleID: installer1.TitleID,
+		},
+	})
+	require.NoError(t, err)
+	team1Policies, _, err = ds.ListTeamPolicies(ctx, team1.ID, fleet.ListOptions{}, fleet.ListOptions{})
+	require.NoError(t, err)
+	require.Len(t, team1Policies, 1)
+	require.Equal(t, uint(1), team1Policies[0].FailingHostCount)
+	countBiggerThanZero = false
+	ExecAdhocSQL(t, ds, func(q sqlx.ExtContext) error {
+		return sqlx.GetContext(ctx, q,
+			&countBiggerThanZero,
+			`SELECT COUNT(*) > 0 FROM policy_membership WHERE policy_id = ?`,
+			team1Policies[0].ID,
+		)
+	})
+	require.True(t, countBiggerThanZero)
+
+	// Now change the installer, should clear results.
+	err = ds.ApplyPolicySpecs(ctx, user1.ID, []*fleet.PolicySpec{
+		{
+			Name:            "Team policy 1",
+			Query:           "SELECT 1;",
+			Description:     "Description 1",
+			Resolution:      "Resolution 1",
+			Team:            "team1",
+			Platform:        "darwin",
+			SoftwareTitleID: installer5.TitleID,
+		},
+	})
+	require.NoError(t, err)
+	team1Policies, _, err = ds.ListTeamPolicies(ctx, team1.ID, fleet.ListOptions{}, fleet.ListOptions{})
+	require.NoError(t, err)
+	require.Len(t, team1Policies, 1)
+	require.Equal(t, uint(0), team1Policies[0].FailingHostCount)
+	countBiggerThanZero = true
+	ExecAdhocSQL(t, ds, func(q sqlx.ExtContext) error {
+		return sqlx.GetContext(ctx, q,
+			&countBiggerThanZero,
+			`SELECT COUNT(*) > 0 FROM policy_membership WHERE policy_id = ?`,
+			team1Policies[0].ID,
+		)
+	})
+	require.False(t, countBiggerThanZero)
+}
+
+func testTeamPoliciesNoTeam(t *testing.T, ds *Datastore) {
+	ctx := context.Background()
+
+	user1 := test.NewUser(t, ds, "Alice", "alice@example.com", true)
+	team1, err := ds.NewTeam(ctx, &fleet.Team{Name: "team1"})
+	require.NoError(t, err)
+	team2, err := ds.NewTeam(ctx, &fleet.Team{Name: "team2"})
+	require.NoError(t, err)
+
+	newHost := func(name string, teamID *uint, platform string) *fleet.Host {
+		h, err := ds.NewHost(ctx, &fleet.Host{
+			OsqueryHostID:   ptr.String(uuid.New().String()),
+			DetailUpdatedAt: time.Now(),
+			LabelUpdatedAt:  time.Now(),
+			PolicyUpdatedAt: time.Now(),
+			SeenTime:        time.Now(),
+			NodeKey:         ptr.String(uuid.New().String()),
+			UUID:            uuid.New().String(),
+			Hostname:        name,
+			TeamID:          teamID,
+			Platform:        platform,
+		})
+		require.NoError(t, err)
+		return h
+	}
+
+	host0NoTeam := newHost("host0NoTeam", nil, "darwin")
+	host1Team1 := newHost("host1Team1", &team1.ID, "darwin")
+	host2Team1 := newHost("host2Team1", &team1.ID, "linux")
+	host3Team2 := newHost("host1Team1", &team2.ID, "windows")
+	host5NoTeam := newHost("host5NoTeam", nil, "windows")
+
+	policy0NoTeam, err := ds.NewTeamPolicy(ctx, fleet.PolicyNoTeamID, &user1.ID, fleet.PolicyPayload{
+		Name:  "policy0NoTeam",
+		Query: "SELECT 0;",
+	})
+	require.NoError(t, err)
+	require.NotNil(t, policy0NoTeam.TeamID)
+	require.Equal(t, fleet.PolicyNoTeamID, *policy0NoTeam.TeamID)
+	tp, err := ds.TeamPolicy(ctx, fleet.PolicyNoTeamID, policy0NoTeam.ID)
+	require.NoError(t, err)
+	require.Equal(t, tp, policy0NoTeam)
+
+	policy1Team1, err := ds.NewTeamPolicy(ctx, team1.ID, &user1.ID, fleet.PolicyPayload{
+		Name:  "policy1Team1",
+		Query: "SELECT 1;",
+	})
+	require.NoError(t, err)
+	policy2Team2, err := ds.NewTeamPolicy(ctx, team2.ID, &user1.ID, fleet.PolicyPayload{
+		Name:  "policy2Team2",
+		Query: "SELECT 2;",
+	})
+	require.NoError(t, err)
+	policy3NoTeam, err := ds.NewTeamPolicy(ctx, fleet.PolicyNoTeamID, &user1.ID, fleet.PolicyPayload{
+		Name:  "policy3NoTeam",
+		Query: "SELECT 3;",
+	})
+	require.NoError(t, err)
+	policy4Team2, err := ds.NewTeamPolicy(ctx, team2.ID, &user1.ID, fleet.PolicyPayload{
+		Name:  "policy4Team2",
+		Query: "SELECT 4;",
+	})
+	require.NoError(t, err)
+
+	globalPolicy1, err := ds.NewGlobalPolicy(ctx, &user1.ID, fleet.PolicyPayload{
+		Name:  "globalPolicy1",
+		Query: "SELECT gp1;",
+	})
+	require.NoError(t, err)
+	globalPolicy2, err := ds.NewGlobalPolicy(ctx, &user1.ID, fleet.PolicyPayload{
+		Name:  "globalPolicy2",
+		Query: "SELECT gp2;",
+	})
+	require.NoError(t, err)
+
+	// Results for host0NoTeam
+	err = ds.RecordPolicyQueryExecutions(ctx, host0NoTeam, map[uint]*bool{
+		globalPolicy1.ID: ptr.Bool(false),
+		globalPolicy2.ID: ptr.Bool(false),
+		policy0NoTeam.ID: ptr.Bool(true),
+		policy3NoTeam.ID: ptr.Bool(false),
+	}, time.Now(), false)
+	require.NoError(t, err)
+
+	// Results for host1Team1
+	err = ds.RecordPolicyQueryExecutions(ctx, host1Team1, map[uint]*bool{
+		globalPolicy1.ID: ptr.Bool(true),
+		globalPolicy2.ID: nil, // failed to execute, e.g. typo on SQL.
+		policy1Team1.ID:  ptr.Bool(true),
+	}, time.Now(), false)
+	require.NoError(t, err)
+
+	// Results for host2Team1
+	err = ds.RecordPolicyQueryExecutions(ctx, host2Team1, map[uint]*bool{
+		globalPolicy1.ID: ptr.Bool(false),
+		globalPolicy2.ID: ptr.Bool(true),
+		policy1Team1.ID:  ptr.Bool(false),
+	}, time.Now(), false)
+	require.NoError(t, err)
+
+	// Results for host3Team2
+	err = ds.RecordPolicyQueryExecutions(ctx, host3Team2, map[uint]*bool{
+		globalPolicy1.ID: ptr.Bool(true),
+		policy2Team2.ID:  ptr.Bool(true),
+		policy4Team2.ID:  ptr.Bool(false),
+	}, time.Now(), false)
+	require.NoError(t, err)
+
+	// Results for host5NoTeam
+	err = ds.RecordPolicyQueryExecutions(ctx, host5NoTeam, map[uint]*bool{
+		globalPolicy1.ID: ptr.Bool(true),
+		globalPolicy2.ID: ptr.Bool(false),
+		policy0NoTeam.ID: ptr.Bool(false),
+		policy3NoTeam.ID: ptr.Bool(false),
+	}, time.Now(), false)
+	require.NoError(t, err)
+
+	err = ds.UpdateHostPolicyCounts(ctx)
+	require.NoError(t, err)
+
+	// Tests on global domain.
+	globalPolicies, err := ds.ListGlobalPolicies(ctx, fleet.ListOptions{})
+	require.NoError(t, err)
+	require.Len(t, globalPolicies, 2)
+	require.Equal(t, globalPolicy1.ID, globalPolicies[0].ID)
+	require.Equal(t, uint(2), globalPolicies[0].FailingHostCount)
+	require.Equal(t, uint(3), globalPolicies[0].PassingHostCount)
+	require.Equal(t, globalPolicy2.ID, globalPolicies[1].ID)
+	require.Equal(t, uint(2), globalPolicies[1].FailingHostCount)
+	require.Equal(t, uint(1), globalPolicies[1].PassingHostCount)
+	ids := make([]uint, 0, len(globalPolicies))
+	for _, globalPolicy := range globalPolicies {
+		p, err := ds.Policy(ctx, globalPolicy.ID)
+		require.NoError(t, err)
+		require.Equal(t, p, globalPolicy)
+		ids = append(ids, globalPolicy.ID)
+	}
+	c, err := ds.CountPolicies(ctx, nil, "")
+	require.NoError(t, err)
+	require.Equal(t, 2, c)
+	globalPoliciesByID, err := ds.PoliciesByID(ctx, ids)
+	require.NoError(t, err)
+	require.Len(t, globalPoliciesByID, 2)
+	require.Equal(t, globalPoliciesByID[globalPolicies[0].ID], globalPolicies[0])
+	require.Equal(t, globalPoliciesByID[globalPolicies[1].ID], globalPolicies[1])
+
+	// Tests on team1 domain.
+	teamPolicies, inheritedPolicies, err := ds.ListTeamPolicies(ctx, team1.ID, fleet.ListOptions{}, fleet.ListOptions{})
+	require.NoError(t, err)
+	require.Len(t, teamPolicies, 1)
+	require.Equal(t, policy1Team1.ID, teamPolicies[0].ID)
+	require.Equal(t, uint(1), teamPolicies[0].FailingHostCount)
+	require.Equal(t, uint(1), teamPolicies[0].PassingHostCount)
+	require.Len(t, inheritedPolicies, 2)
+	require.Equal(t, globalPolicy1.ID, inheritedPolicies[0].ID)
+	require.Equal(t, uint(1), inheritedPolicies[0].FailingHostCount)
+	require.Equal(t, uint(1), inheritedPolicies[0].PassingHostCount)
+	require.Equal(t, globalPolicy2.ID, inheritedPolicies[1].ID)
+	require.Equal(t, uint(0), inheritedPolicies[1].FailingHostCount)
+	require.Equal(t, uint(1), inheritedPolicies[1].PassingHostCount)
+	ids = make([]uint, 0, len(teamPolicies))
+	for _, teamPolicy := range teamPolicies {
+		p, err := ds.Policy(ctx, teamPolicy.ID)
+		require.NoError(t, err)
+		require.Equal(t, p, teamPolicy)
+		ids = append(ids, teamPolicy.ID)
+	}
+	teamPoliciesByID, err := ds.PoliciesByID(ctx, ids)
+	require.NoError(t, err)
+	require.Len(t, teamPoliciesByID, 1)
+	require.Equal(t, teamPoliciesByID[teamPolicies[0].ID], teamPolicies[0])
+	c, err = ds.CountMergedTeamPolicies(ctx, team1.ID, "")
+	require.NoError(t, err)
+	require.Equal(t, 3, c)
+	c, err = ds.CountPolicies(ctx, &team1.ID, "")
+	require.NoError(t, err)
+	require.Equal(t, 1, c)
+	mergedTeamPolicies, err := ds.ListMergedTeamPolicies(ctx, team1.ID, fleet.ListOptions{})
+	require.NoError(t, err)
+	require.Len(t, mergedTeamPolicies, 3)
+	require.Equal(t, policy1Team1.ID, mergedTeamPolicies[0].ID)
+	require.Equal(t, uint(1), mergedTeamPolicies[0].FailingHostCount)
+	require.Equal(t, uint(1), mergedTeamPolicies[0].PassingHostCount)
+	require.Equal(t, globalPolicy1.ID, mergedTeamPolicies[1].ID)
+	require.Equal(t, uint(1), mergedTeamPolicies[1].FailingHostCount)
+	require.Equal(t, uint(1), mergedTeamPolicies[1].PassingHostCount)
+	require.Equal(t, globalPolicy2.ID, mergedTeamPolicies[2].ID)
+	require.Equal(t, uint(0), mergedTeamPolicies[2].FailingHostCount)
+	require.Equal(t, uint(1), mergedTeamPolicies[2].PassingHostCount)
+
+	// Tests on team2 domain.
+	teamPolicies, inheritedPolicies, err = ds.ListTeamPolicies(ctx, team2.ID, fleet.ListOptions{}, fleet.ListOptions{})
+	require.NoError(t, err)
+	require.Len(t, teamPolicies, 2)
+	require.Equal(t, policy2Team2.ID, teamPolicies[0].ID)
+	require.Equal(t, uint(0), teamPolicies[0].FailingHostCount)
+	require.Equal(t, uint(1), teamPolicies[0].PassingHostCount)
+	require.Equal(t, policy4Team2.ID, teamPolicies[1].ID)
+	require.Equal(t, uint(1), teamPolicies[1].FailingHostCount)
+	require.Equal(t, uint(0), teamPolicies[1].PassingHostCount)
+	require.Len(t, inheritedPolicies, 2)
+	require.Equal(t, globalPolicy1.ID, inheritedPolicies[0].ID)
+	require.Equal(t, uint(0), inheritedPolicies[0].FailingHostCount)
+	require.Equal(t, uint(1), inheritedPolicies[0].PassingHostCount)
+	require.Equal(t, globalPolicy2.ID, inheritedPolicies[1].ID)
+	require.Equal(t, uint(0), inheritedPolicies[1].FailingHostCount)
+	require.Equal(t, uint(0), inheritedPolicies[1].PassingHostCount)
+	ids = make([]uint, 0, len(teamPolicies))
+	for _, teamPolicy := range teamPolicies {
+		p, err := ds.Policy(ctx, teamPolicy.ID)
+		require.NoError(t, err)
+		require.Equal(t, p, teamPolicy)
+		ids = append(ids, teamPolicy.ID)
+	}
+	teamPoliciesByID, err = ds.PoliciesByID(ctx, ids)
+	require.NoError(t, err)
+	require.Len(t, teamPoliciesByID, 2)
+	require.Equal(t, teamPoliciesByID[teamPolicies[0].ID], teamPolicies[0])
+	require.Equal(t, teamPoliciesByID[teamPolicies[1].ID], teamPolicies[1])
+	c, err = ds.CountMergedTeamPolicies(ctx, team2.ID, "")
+	require.NoError(t, err)
+	require.Equal(t, 4, c)
+	c, err = ds.CountPolicies(ctx, &team2.ID, "")
+	require.NoError(t, err)
+	require.Equal(t, 2, c)
+	mergedTeamPolicies, err = ds.ListMergedTeamPolicies(ctx, team2.ID, fleet.ListOptions{})
+	require.NoError(t, err)
+	require.Len(t, mergedTeamPolicies, 4)
+	require.Equal(t, policy2Team2.ID, mergedTeamPolicies[0].ID)
+	require.Equal(t, uint(0), mergedTeamPolicies[0].FailingHostCount)
+	require.Equal(t, uint(1), mergedTeamPolicies[0].PassingHostCount)
+	require.Equal(t, policy4Team2.ID, mergedTeamPolicies[1].ID)
+	require.Equal(t, uint(1), mergedTeamPolicies[1].FailingHostCount)
+	require.Equal(t, uint(0), mergedTeamPolicies[1].PassingHostCount)
+	require.Equal(t, globalPolicy1.ID, mergedTeamPolicies[2].ID)
+	require.Equal(t, uint(0), mergedTeamPolicies[2].FailingHostCount)
+	require.Equal(t, uint(1), mergedTeamPolicies[2].PassingHostCount)
+	require.Equal(t, globalPolicy2.ID, mergedTeamPolicies[3].ID)
+	require.Equal(t, uint(0), mergedTeamPolicies[3].FailingHostCount)
+	require.Equal(t, uint(0), mergedTeamPolicies[3].PassingHostCount)
+
+	// Tests on "No team" domain.
+	teamPolicies, inheritedPolicies, err = ds.ListTeamPolicies(ctx, fleet.PolicyNoTeamID, fleet.ListOptions{}, fleet.ListOptions{})
+	require.NoError(t, err)
+	require.Len(t, teamPolicies, 2)
+	require.Equal(t, policy0NoTeam.ID, teamPolicies[0].ID)
+	require.Equal(t, uint(1), teamPolicies[0].FailingHostCount)
+	require.Equal(t, uint(1), teamPolicies[0].PassingHostCount)
+	require.Equal(t, policy3NoTeam.ID, teamPolicies[1].ID)
+	require.Equal(t, uint(2), teamPolicies[1].FailingHostCount)
+	require.Equal(t, uint(0), teamPolicies[1].PassingHostCount)
+	require.Len(t, inheritedPolicies, 2)
+	require.Equal(t, globalPolicy1.ID, inheritedPolicies[0].ID)
+	require.Equal(t, uint(1), inheritedPolicies[0].FailingHostCount)
+	require.Equal(t, uint(1), inheritedPolicies[0].PassingHostCount)
+	require.Equal(t, globalPolicy2.ID, inheritedPolicies[1].ID)
+	require.Equal(t, uint(2), inheritedPolicies[1].FailingHostCount)
+	require.Equal(t, uint(0), inheritedPolicies[1].PassingHostCount)
+	ids = make([]uint, 0, len(teamPolicies))
+	for _, teamPolicy := range teamPolicies {
+		p, err := ds.Policy(ctx, teamPolicy.ID)
+		require.NoError(t, err)
+		require.Equal(t, p, teamPolicy)
+		ids = append(ids, teamPolicy.ID)
+	}
+	teamPoliciesByID, err = ds.PoliciesByID(ctx, ids)
+	require.NoError(t, err)
+	require.Len(t, teamPoliciesByID, 2)
+	require.Equal(t, teamPoliciesByID[teamPolicies[0].ID], teamPolicies[0])
+	require.Equal(t, teamPoliciesByID[teamPolicies[1].ID], teamPolicies[1])
+	c, err = ds.CountMergedTeamPolicies(ctx, fleet.PolicyNoTeamID, "")
+	require.NoError(t, err)
+	require.Equal(t, 4, c)
+	c, err = ds.CountPolicies(ctx, ptr.Uint(fleet.PolicyNoTeamID), "")
+	require.NoError(t, err)
+	require.Equal(t, 2, c)
+	mergedTeamPolicies, err = ds.ListMergedTeamPolicies(ctx, fleet.PolicyNoTeamID, fleet.ListOptions{})
+	require.NoError(t, err)
+	require.Len(t, mergedTeamPolicies, 4)
+	require.Equal(t, policy0NoTeam.ID, mergedTeamPolicies[0].ID)
+	require.Equal(t, uint(1), mergedTeamPolicies[0].FailingHostCount)
+	require.Equal(t, uint(1), mergedTeamPolicies[0].PassingHostCount)
+	require.Equal(t, policy3NoTeam.ID, mergedTeamPolicies[1].ID)
+	require.Equal(t, uint(2), mergedTeamPolicies[1].FailingHostCount)
+	require.Equal(t, uint(0), mergedTeamPolicies[1].PassingHostCount)
+	require.Equal(t, globalPolicy1.ID, mergedTeamPolicies[2].ID)
+	require.Equal(t, uint(1), mergedTeamPolicies[2].FailingHostCount)
+	require.Equal(t, uint(1), mergedTeamPolicies[2].PassingHostCount)
+	require.Equal(t, globalPolicy2.ID, mergedTeamPolicies[3].ID)
+	require.Equal(t, uint(2), mergedTeamPolicies[3].FailingHostCount)
+	require.Equal(t, uint(0), mergedTeamPolicies[3].PassingHostCount)
+
+	// Test ListPoliciesForHost and PolicyQueriesForHost for host0NoTeam.
+	host0Policies, err := ds.ListPoliciesForHost(ctx, host0NoTeam)
+	require.NoError(t, err)
+	require.Len(t, host0Policies, 4)
+	require.Equal(t, globalPolicy1.ID, host0Policies[0].ID)
+	require.Equal(t, "fail", host0Policies[0].Response)
+	require.Equal(t, globalPolicy2.ID, host0Policies[1].ID)
+	require.Equal(t, "fail", host0Policies[1].Response)
+	require.Equal(t, policy3NoTeam.ID, host0Policies[2].ID)
+	require.Equal(t, "fail", host0Policies[2].Response)
+	require.Equal(t, policy0NoTeam.ID, host0Policies[3].ID)
+	require.Equal(t, "pass", host0Policies[3].Response)
+	host0PolicyQueries, err := ds.PolicyQueriesForHost(ctx, host0NoTeam)
+	require.NoError(t, err)
+	require.Len(t, host0PolicyQueries, 4)
+	require.Equal(t, "SELECT gp1;", host0PolicyQueries[strconv.FormatUint(uint64(globalPolicy1.ID), 10)])
+	require.Equal(t, "SELECT gp2;", host0PolicyQueries[strconv.FormatUint(uint64(globalPolicy2.ID), 10)])
+	require.Equal(t, "SELECT 0;", host0PolicyQueries[strconv.FormatUint(uint64(policy0NoTeam.ID), 10)])
+	require.Equal(t, "SELECT 3;", host0PolicyQueries[strconv.FormatUint(uint64(policy3NoTeam.ID), 10)])
+
+	// Test ListPoliciesForHost and PolicyQueriesForHost for host1Team1.
+	host1Policies, err := ds.ListPoliciesForHost(ctx, host1Team1)
+	require.NoError(t, err)
+	require.Len(t, host1Policies, 3)
+	require.Equal(t, globalPolicy2.ID, host1Policies[0].ID)
+	require.Equal(t, "", host1Policies[0].Response)
+	require.Equal(t, globalPolicy1.ID, host1Policies[1].ID)
+	require.Equal(t, "pass", host1Policies[1].Response)
+	require.Equal(t, policy1Team1.ID, host1Policies[2].ID)
+	require.Equal(t, "pass", host1Policies[2].Response)
+	host1PolicyQueries, err := ds.PolicyQueriesForHost(ctx, host1Team1)
+	require.NoError(t, err)
+	require.Len(t, host1PolicyQueries, 3)
+	require.Equal(t, "SELECT gp1;", host1PolicyQueries[strconv.FormatUint(uint64(globalPolicy1.ID), 10)])
+	require.Equal(t, "SELECT gp2;", host1PolicyQueries[strconv.FormatUint(uint64(globalPolicy2.ID), 10)])
+	require.Equal(t, "SELECT 1;", host1PolicyQueries[strconv.FormatUint(uint64(policy1Team1.ID), 10)])
+
+	// Test ListPoliciesForHost and PolicyQueriesForHost for host2Team1.
+	host2Policies, err := ds.ListPoliciesForHost(ctx, host2Team1)
+	require.NoError(t, err)
+	require.Len(t, host2Policies, 3)
+	require.Equal(t, globalPolicy1.ID, host2Policies[0].ID)
+	require.Equal(t, "fail", host2Policies[0].Response)
+	require.Equal(t, policy1Team1.ID, host2Policies[1].ID)
+	require.Equal(t, "fail", host2Policies[1].Response)
+	require.Equal(t, globalPolicy2.ID, host2Policies[2].ID)
+	require.Equal(t, "pass", host2Policies[2].Response)
+	host2PolicyQueries, err := ds.PolicyQueriesForHost(ctx, host2Team1)
+	require.NoError(t, err)
+	require.Len(t, host2PolicyQueries, 3)
+	require.Equal(t, "SELECT gp1;", host2PolicyQueries[strconv.FormatUint(uint64(globalPolicy1.ID), 10)])
+	require.Equal(t, "SELECT gp2;", host2PolicyQueries[strconv.FormatUint(uint64(globalPolicy2.ID), 10)])
+	require.Equal(t, "SELECT 1;", host2PolicyQueries[strconv.FormatUint(uint64(policy1Team1.ID), 10)])
+
+	// Test ListPoliciesForHost and PolicyQueriesForHost for host3Team2.
+	host3Policies, err := ds.ListPoliciesForHost(ctx, host3Team2)
+	require.NoError(t, err)
+	require.Len(t, host3Policies, 4)
+	require.Equal(t, policy4Team2.ID, host3Policies[0].ID)
+	require.Equal(t, "fail", host3Policies[0].Response)
+	require.Equal(t, globalPolicy2.ID, host3Policies[1].ID)
+	require.Equal(t, "", host3Policies[1].Response)
+	require.Equal(t, globalPolicy1.ID, host3Policies[2].ID)
+	require.Equal(t, "pass", host3Policies[2].Response)
+	require.Equal(t, policy2Team2.ID, host3Policies[3].ID)
+	require.Equal(t, "pass", host3Policies[3].Response)
+	host3PolicyQueries, err := ds.PolicyQueriesForHost(ctx, host3Team2)
+	require.NoError(t, err)
+	require.Len(t, host3PolicyQueries, 4)
+	require.Equal(t, "SELECT gp1;", host3PolicyQueries[strconv.FormatUint(uint64(globalPolicy1.ID), 10)])
+	require.Equal(t, "SELECT gp2;", host3PolicyQueries[strconv.FormatUint(uint64(globalPolicy2.ID), 10)])
+	require.Equal(t, "SELECT 2;", host3PolicyQueries[strconv.FormatUint(uint64(policy2Team2.ID), 10)])
+	require.Equal(t, "SELECT 4;", host3PolicyQueries[strconv.FormatUint(uint64(policy4Team2.ID), 10)])
+
+	// Test ListPoliciesForHost and PolicyQueriesForHost for host5NoTeam.
+	host5Policies, err := ds.ListPoliciesForHost(ctx, host5NoTeam)
+	require.NoError(t, err)
+	require.Len(t, host5Policies, 4)
+	require.Equal(t, globalPolicy2.ID, host5Policies[0].ID)
+	require.Equal(t, "fail", host5Policies[0].Response)
+	require.Equal(t, policy0NoTeam.ID, host5Policies[1].ID)
+	require.Equal(t, "fail", host5Policies[1].Response)
+	require.Equal(t, policy3NoTeam.ID, host5Policies[2].ID)
+	require.Equal(t, "fail", host5Policies[2].Response)
+	require.Equal(t, globalPolicy1.ID, host5Policies[3].ID)
+	require.Equal(t, "pass", host5Policies[3].Response)
+	host5PolicyQueries, err := ds.PolicyQueriesForHost(ctx, host5NoTeam)
+	require.NoError(t, err)
+	require.Len(t, host5PolicyQueries, 4)
+	require.Equal(t, "SELECT gp1;", host5PolicyQueries[strconv.FormatUint(uint64(globalPolicy1.ID), 10)])
+	require.Equal(t, "SELECT gp2;", host5PolicyQueries[strconv.FormatUint(uint64(globalPolicy2.ID), 10)])
+	require.Equal(t, "SELECT 0;", host5PolicyQueries[strconv.FormatUint(uint64(policy0NoTeam.ID), 10)])
+	require.Equal(t, "SELECT 3;", host5PolicyQueries[strconv.FormatUint(uint64(policy3NoTeam.ID), 10)])
+}
diff --git a/server/datastore/mysql/schema.sql b/server/datastore/mysql/schema.sql
index 73e02ac322..8fb66675fb 100644
--- a/server/datastore/mysql/schema.sql
+++ b/server/datastore/mysql/schema.sql
@@ -1,5 +1,29 @@
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
 /*!50503 SET character_set_client = utf8mb4 */;
+CREATE TABLE `abm_tokens` (
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
+  `organization_name` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
+  `apple_id` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
+  `terms_expired` tinyint(1) NOT NULL DEFAULT '0',
+  `renew_at` timestamp NOT NULL,
+  `token` blob NOT NULL,
+  `macos_default_team_id` int unsigned DEFAULT NULL,
+  `ios_default_team_id` int unsigned DEFAULT NULL,
+  `ipados_default_team_id` int unsigned DEFAULT NULL,
+  `created_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP,
+  `updated_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+  PRIMARY KEY (`id`),
+  UNIQUE KEY `idx_abm_tokens_organization_name` (`organization_name`),
+  KEY `fk_abm_tokens_macos_default_team_id` (`macos_default_team_id`),
+  KEY `fk_abm_tokens_ios_default_team_id` (`ios_default_team_id`),
+  KEY `fk_abm_tokens_ipados_default_team_id` (`ipados_default_team_id`),
+  CONSTRAINT `fk_abm_tokens_ios_default_team_id` FOREIGN KEY (`ios_default_team_id`) REFERENCES `teams` (`id`) ON DELETE SET NULL,
+  CONSTRAINT `fk_abm_tokens_ipados_default_team_id` FOREIGN KEY (`ipados_default_team_id`) REFERENCES `teams` (`id`) ON DELETE SET NULL,
+  CONSTRAINT `fk_abm_tokens_macos_default_team_id` FOREIGN KEY (`macos_default_team_id`) REFERENCES `teams` (`id`) ON DELETE SET NULL
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+/*!40101 SET character_set_client = @saved_cs_client */;
+/*!40101 SET @saved_cs_client     = @@character_set_client */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `activities` (
   `id` int unsigned NOT NULL AUTO_INCREMENT,
   `created_at` timestamp(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6),
@@ -41,7 +65,7 @@ CREATE TABLE `app_config_json` (
   UNIQUE KEY `id` (`id`)
 ) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
-INSERT INTO `app_config_json` VALUES (1,'{\"mdm\": {\"ios_updates\": {\"deadline\": null, \"minimum_version\": null}, \"macos_setup\": {\"bootstrap_package\": null, \"macos_setup_assistant\": null, \"enable_end_user_authentication\": false, \"enable_release_device_manually\": false}, \"macos_updates\": {\"deadline\": null, \"minimum_version\": null}, \"ipados_updates\": {\"deadline\": null, \"minimum_version\": null}, \"macos_settings\": {\"custom_settings\": null}, \"macos_migration\": {\"mode\": \"\", \"enable\": false, \"webhook_url\": \"\"}, \"windows_updates\": {\"deadline_days\": null, \"grace_period_days\": null}, \"windows_settings\": {\"custom_settings\": null}, \"apple_bm_default_team\": \"\", \"apple_bm_terms_expired\": false, \"enable_disk_encryption\": false, \"enabled_and_configured\": false, \"end_user_authentication\": {\"idp_name\": \"\", \"metadata\": \"\", \"entity_id\": \"\", \"issuer_uri\": \"\", \"metadata_url\": \"\"}, \"windows_enabled_and_configured\": false, \"apple_bm_enabled_and_configured\": false}, \"scripts\": null, \"features\": {\"enable_host_users\": true, \"enable_software_inventory\": false}, \"org_info\": {\"org_name\": \"\", \"contact_url\": \"\", \"org_logo_url\": \"\", \"org_logo_url_light_background\": \"\"}, \"integrations\": {\"jira\": null, \"zendesk\": null, \"google_calendar\": null}, \"sso_settings\": {\"idp_name\": \"\", \"metadata\": \"\", \"entity_id\": \"\", \"enable_sso\": false, \"issuer_uri\": \"\", \"metadata_url\": \"\", \"idp_image_url\": \"\", \"enable_jit_role_sync\": false, \"enable_sso_idp_login\": false, \"enable_jit_provisioning\": false}, \"agent_options\": {\"config\": {\"options\": {\"logger_plugin\": \"tls\", \"pack_delimiter\": \"/\", \"logger_tls_period\": 10, \"distributed_plugin\": \"tls\", \"disable_distributed\": false, \"logger_tls_endpoint\": \"/api/osquery/log\", \"distributed_interval\": 10, \"distributed_tls_max_attempts\": 3}, \"decorators\": {\"load\": [\"SELECT uuid AS host_uuid FROM system_info;\", \"SELECT hostname AS hostname FROM system_info;\"]}}, \"overrides\": {}}, \"fleet_desktop\": {\"transparency_url\": \"\"}, \"smtp_settings\": {\"port\": 587, \"domain\": \"\", \"server\": \"\", \"password\": \"\", \"user_name\": \"\", \"configured\": false, \"enable_smtp\": false, \"enable_ssl_tls\": true, \"sender_address\": \"\", \"enable_start_tls\": true, \"verify_ssl_certs\": true, \"authentication_type\": \"0\", \"authentication_method\": \"0\"}, \"server_settings\": {\"server_url\": \"\", \"enable_analytics\": false, \"query_report_cap\": 0, \"scripts_disabled\": false, \"deferred_save_host\": false, \"live_query_disabled\": false, \"ai_features_disabled\": false, \"query_reports_disabled\": false}, \"webhook_settings\": {\"interval\": \"0s\", \"activities_webhook\": {\"destination_url\": \"\", \"enable_activities_webhook\": false}, \"host_status_webhook\": {\"days_count\": 0, \"destination_url\": \"\", \"host_percentage\": 0, \"enable_host_status_webhook\": false}, \"vulnerabilities_webhook\": {\"destination_url\": \"\", \"host_batch_size\": 0, \"enable_vulnerabilities_webhook\": false}, \"failing_policies_webhook\": {\"policy_ids\": null, \"destination_url\": \"\", \"host_batch_size\": 0, \"enable_failing_policies_webhook\": false}}, \"host_expiry_settings\": {\"host_expiry_window\": 0, \"host_expiry_enabled\": false}, \"vulnerability_settings\": {\"databases_path\": \"\"}, \"activity_expiry_settings\": {\"activity_expiry_window\": 0, \"activity_expiry_enabled\": false}}','2020-01-01 01:01:01','2020-01-01 01:01:01');
+INSERT INTO `app_config_json` VALUES (1,'{\"mdm\": {\"ios_updates\": {\"deadline\": null, \"minimum_version\": null}, \"macos_setup\": {\"bootstrap_package\": null, \"macos_setup_assistant\": null, \"enable_end_user_authentication\": false, \"enable_release_device_manually\": false}, \"macos_updates\": {\"deadline\": null, \"minimum_version\": null}, \"ipados_updates\": {\"deadline\": null, \"minimum_version\": null}, \"macos_settings\": {\"custom_settings\": null}, \"macos_migration\": {\"mode\": \"\", \"enable\": false, \"webhook_url\": \"\"}, \"windows_updates\": {\"deadline_days\": null, \"grace_period_days\": null}, \"windows_settings\": {\"custom_settings\": null}, \"apple_bm_terms_expired\": false, \"apple_business_manager\": null, \"enable_disk_encryption\": false, \"enabled_and_configured\": false, \"end_user_authentication\": {\"idp_name\": \"\", \"metadata\": \"\", \"entity_id\": \"\", \"issuer_uri\": \"\", \"metadata_url\": \"\"}, \"volume_purchasing_program\": null, \"windows_enabled_and_configured\": false, \"apple_bm_enabled_and_configured\": false}, \"scripts\": null, \"features\": {\"enable_host_users\": true, \"enable_software_inventory\": false}, \"org_info\": {\"org_name\": \"\", \"contact_url\": \"\", \"org_logo_url\": \"\", \"org_logo_url_light_background\": \"\"}, \"integrations\": {\"jira\": null, \"zendesk\": null, \"google_calendar\": null}, \"sso_settings\": {\"idp_name\": \"\", \"metadata\": \"\", \"entity_id\": \"\", \"enable_sso\": false, \"issuer_uri\": \"\", \"metadata_url\": \"\", \"idp_image_url\": \"\", \"enable_jit_role_sync\": false, \"enable_sso_idp_login\": false, \"enable_jit_provisioning\": false}, \"agent_options\": {\"config\": {\"options\": {\"logger_plugin\": \"tls\", \"pack_delimiter\": \"/\", \"logger_tls_period\": 10, \"distributed_plugin\": \"tls\", \"disable_distributed\": false, \"logger_tls_endpoint\": \"/api/osquery/log\", \"distributed_interval\": 10, \"distributed_tls_max_attempts\": 3}, \"decorators\": {\"load\": [\"SELECT uuid AS host_uuid FROM system_info;\", \"SELECT hostname AS hostname FROM system_info;\"]}}, \"overrides\": {}}, \"fleet_desktop\": {\"transparency_url\": \"\"}, \"smtp_settings\": {\"port\": 587, \"domain\": \"\", \"server\": \"\", \"password\": \"\", \"user_name\": \"\", \"configured\": false, \"enable_smtp\": false, \"enable_ssl_tls\": true, \"sender_address\": \"\", \"enable_start_tls\": true, \"verify_ssl_certs\": true, \"authentication_type\": \"0\", \"authentication_method\": \"0\"}, \"server_settings\": {\"server_url\": \"\", \"enable_analytics\": false, \"query_report_cap\": 0, \"scripts_disabled\": false, \"deferred_save_host\": false, \"live_query_disabled\": false, \"ai_features_disabled\": false, \"query_reports_disabled\": false}, \"webhook_settings\": {\"interval\": \"0s\", \"activities_webhook\": {\"destination_url\": \"\", \"enable_activities_webhook\": false}, \"host_status_webhook\": {\"days_count\": 0, \"destination_url\": \"\", \"host_percentage\": 0, \"enable_host_status_webhook\": false}, \"vulnerabilities_webhook\": {\"destination_url\": \"\", \"host_batch_size\": 0, \"enable_vulnerabilities_webhook\": false}, \"failing_policies_webhook\": {\"policy_ids\": null, \"destination_url\": \"\", \"host_batch_size\": 0, \"enable_failing_policies_webhook\": false}}, \"host_expiry_settings\": {\"host_expiry_window\": 0, \"host_expiry_enabled\": false}, \"vulnerability_settings\": {\"databases_path\": \"\"}, \"activity_expiry_settings\": {\"activity_expiry_window\": 0, \"activity_expiry_enabled\": false}}','2020-01-01 01:01:01','2020-01-01 01:01:01');
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
 /*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `calendar_events` (
@@ -233,8 +257,11 @@ CREATE TABLE `host_dep_assignments` (
   `assign_profile_response` varchar(15) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci DEFAULT NULL,
   `response_updated_at` timestamp NULL DEFAULT NULL,
   `retry_job_id` int unsigned NOT NULL DEFAULT '0',
+  `abm_token_id` int unsigned DEFAULT NULL,
   PRIMARY KEY (`host_id`),
-  KEY `idx_hdep_response` (`assign_profile_response`,`response_updated_at`)
+  KEY `idx_hdep_response` (`assign_profile_response`,`response_updated_at`),
+  KEY `fk_host_dep_assignments_abm_token_id` (`abm_token_id`),
+  CONSTRAINT `fk_host_dep_assignments_abm_token_id` FOREIGN KEY (`abm_token_id`) REFERENCES `abm_tokens` (`id`) ON DELETE SET NULL
 ) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
@@ -389,6 +416,16 @@ CREATE TABLE `host_mdm_apple_profiles` (
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
 /*!50503 SET character_set_client = utf8mb4 */;
+CREATE TABLE `host_mdm_commands` (
+  `host_id` int unsigned NOT NULL,
+  `command_type` varchar(31) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
+  `created_at` timestamp(6) NULL DEFAULT CURRENT_TIMESTAMP(6),
+  `updated_at` timestamp(6) NULL DEFAULT CURRENT_TIMESTAMP(6) ON UPDATE CURRENT_TIMESTAMP(6),
+  PRIMARY KEY (`host_id`,`command_type`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+/*!40101 SET character_set_client = @saved_cs_client */;
+/*!40101 SET @saved_cs_client     = @@character_set_client */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `host_mdm_windows_profiles` (
   `host_uuid` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL,
   `status` varchar(20) COLLATE utf8mb4_unicode_ci DEFAULT NULL,
@@ -516,10 +553,15 @@ CREATE TABLE `host_software_installs` (
   `post_install_script_output` text CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci,
   `post_install_script_exit_code` int DEFAULT NULL,
   `user_id` int unsigned DEFAULT NULL,
-  `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
-  `updated_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+  `created_at` timestamp(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6),
+  `updated_at` timestamp(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6) ON UPDATE CURRENT_TIMESTAMP(6),
   `self_service` tinyint(1) NOT NULL DEFAULT '0',
-  `host_deleted_at` timestamp NULL DEFAULT NULL,
+  `host_deleted_at` timestamp(6) NULL DEFAULT NULL,
+  `removed` tinyint NOT NULL DEFAULT '0',
+  `uninstall_script_output` text CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci,
+  `uninstall_script_exit_code` int DEFAULT NULL,
+  `uninstall` tinyint unsigned NOT NULL DEFAULT '0',
+  `status` enum('pending_install','failed_install','installed','pending_uninstall','failed_uninstall') COLLATE utf8mb4_unicode_ci GENERATED ALWAYS AS ((case when (`removed` = 1) then NULL when ((`post_install_script_exit_code` is not null) and (`post_install_script_exit_code` = 0)) then _utf8mb4'installed' when ((`post_install_script_exit_code` is not null) and (`post_install_script_exit_code` <> 0)) then _utf8mb4'failed_install' when ((`install_script_exit_code` is not null) and (`install_script_exit_code` = 0)) then _utf8mb4'installed' when ((`install_script_exit_code` is not null) and (`install_script_exit_code` <> 0)) then _utf8mb4'failed_install' when ((`pre_install_query_output` is not null) and (`pre_install_query_output` = _utf8mb4'')) then _utf8mb4'failed_install' when ((`host_id` is not null) and (`uninstall` = 0)) then _utf8mb4'pending_install' when ((`uninstall_script_exit_code` is not null) and (`uninstall_script_exit_code` <> 0)) then _utf8mb4'failed_uninstall' when ((`uninstall_script_exit_code` is not null) and (`uninstall_script_exit_code` = 0)) then NULL when ((`host_id` is not null) and (`uninstall` = 1)) then _utf8mb4'pending_uninstall' else NULL end)) STORED,
   PRIMARY KEY (`id`),
   UNIQUE KEY `idx_host_software_installs_execution_id` (`execution_id`),
   KEY `fk_host_software_installs_installer_id` (`software_installer_id`),
@@ -565,10 +607,14 @@ CREATE TABLE `host_vpp_software_installs` (
   `created_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP,
   `updated_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
   `platform` varchar(10) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
+  `removed` tinyint NOT NULL DEFAULT '0',
+  `vpp_token_id` int unsigned DEFAULT NULL,
   PRIMARY KEY (`id`),
   UNIQUE KEY `idx_host_vpp_software_installs_command_uuid` (`command_uuid`),
   KEY `user_id` (`user_id`),
   KEY `adam_id` (`adam_id`,`platform`),
+  KEY `fk_host_vpp_software_installs_vpp_token_id` (`vpp_token_id`),
+  CONSTRAINT `fk_host_vpp_software_installs_vpp_token_id` FOREIGN KEY (`vpp_token_id`) REFERENCES `vpp_tokens` (`id`) ON DELETE SET NULL,
   CONSTRAINT `host_vpp_software_installs_ibfk_1` FOREIGN KEY (`user_id`) REFERENCES `users` (`id`) ON DELETE SET NULL,
   CONSTRAINT `host_vpp_software_installs_ibfk_3` FOREIGN KEY (`adam_id`, `platform`) REFERENCES `vpp_apps` (`adam_id`, `platform`) ON DELETE CASCADE
 ) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
@@ -623,8 +669,7 @@ CREATE TABLE `hosts` (
   KEY `fk_hosts_team_id` (`team_id`),
   KEY `hosts_platform_idx` (`platform`),
   KEY `idx_hosts_hardware_serial` (`hardware_serial`),
-  FULLTEXT KEY `host_ip_mac_search` (`primary_ip`,`primary_mac`),
-  FULLTEXT KEY `hosts_search` (`hostname`,`uuid`,`computer_name`),
+  KEY `idx_hosts_uuid` (`uuid`),
   CONSTRAINT `hosts_ibfk_1` FOREIGN KEY (`team_id`) REFERENCES `teams` (`id`) ON DELETE SET NULL
 ) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
@@ -670,7 +715,8 @@ CREATE TABLE `jobs` (
   `retries` int NOT NULL DEFAULT '0',
   `error` text COLLATE utf8mb4_unicode_ci,
   `not_before` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
-  PRIMARY KEY (`id`)
+  PRIMARY KEY (`id`),
+  KEY `idx_jobs_state_not_before_updated_at` (`state`,`not_before`,`updated_at`)
 ) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB AUTO_INCREMENT=2 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 INSERT INTO `jobs` VALUES (1,'2024-03-20 00:00:00','2024-03-20 00:00:00','macos_setup_assistant','{\"task\": \"update_all_profiles\"}','queued',0,'','2024-03-20 00:00:00');
@@ -768,10 +814,12 @@ CREATE TABLE `mdm_apple_declarations` (
   `checksum` binary(16) NOT NULL,
   `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
   `uploaded_at` timestamp NULL DEFAULT NULL,
+  `auto_increment` bigint NOT NULL AUTO_INCREMENT,
   PRIMARY KEY (`declaration_uuid`),
   UNIQUE KEY `idx_mdm_apple_declaration_team_identifier` (`team_id`,`identifier`),
-  UNIQUE KEY `idx_mdm_apple_declaration_team_name` (`team_id`,`name`)
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+  UNIQUE KEY `idx_mdm_apple_declaration_team_name` (`team_id`,`name`),
+  UNIQUE KEY `auto_increment` (`auto_increment`)
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
 /*!50503 SET character_set_client = utf8mb4 */;
@@ -795,11 +843,14 @@ CREATE TABLE `mdm_apple_default_setup_assistants` (
   `profile_uuid` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
   `created_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP,
   `updated_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+  `abm_token_id` int unsigned DEFAULT NULL,
   PRIMARY KEY (`id`),
-  UNIQUE KEY `idx_mdm_default_setup_assistant_global_or_team_id` (`global_or_team_id`),
+  UNIQUE KEY `idx_mdm_default_setup_assistant_global_or_team_id_abm_token_id` (`global_or_team_id`,`abm_token_id`),
   KEY `fk_mdm_default_setup_assistant_team_id` (`team_id`),
+  KEY `fk_mdm_default_setup_assistant_abm_token_id` (`abm_token_id`),
+  CONSTRAINT `fk_mdm_default_setup_assistant_abm_token_id` FOREIGN KEY (`abm_token_id`) REFERENCES `abm_tokens` (`id`) ON DELETE CASCADE,
   CONSTRAINT `mdm_apple_default_setup_assistants_ibfk_1` FOREIGN KEY (`team_id`) REFERENCES `teams` (`id`) ON DELETE CASCADE ON UPDATE CASCADE
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
 /*!50503 SET character_set_client = utf8mb4 */;
@@ -829,6 +880,22 @@ CREATE TABLE `mdm_apple_installers` (
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
 /*!50503 SET character_set_client = utf8mb4 */;
+CREATE TABLE `mdm_apple_setup_assistant_profiles` (
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
+  `setup_assistant_id` int unsigned NOT NULL,
+  `abm_token_id` int unsigned NOT NULL,
+  `profile_uuid` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
+  `created_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP,
+  `updated_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+  PRIMARY KEY (`id`),
+  UNIQUE KEY `idx_mdm_apple_setup_assistant_profiles_asst_id_tok_id` (`setup_assistant_id`,`abm_token_id`),
+  KEY `fk_mdm_apple_setup_assistant_profiles_abm_token_id` (`abm_token_id`),
+  CONSTRAINT `fk_mdm_apple_setup_assistant_profiles_abm_token_id` FOREIGN KEY (`abm_token_id`) REFERENCES `abm_tokens` (`id`) ON DELETE CASCADE,
+  CONSTRAINT `fk_mdm_apple_setup_assistant_profiles_setup_assistant_id` FOREIGN KEY (`setup_assistant_id`) REFERENCES `mdm_apple_setup_assistants` (`id`) ON DELETE CASCADE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+/*!40101 SET character_set_client = @saved_cs_client */;
+/*!40101 SET @saved_cs_client     = @@character_set_client */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `mdm_apple_setup_assistants` (
   `id` int unsigned NOT NULL AUTO_INCREMENT,
   `team_id` int unsigned DEFAULT NULL,
@@ -837,7 +904,6 @@ CREATE TABLE `mdm_apple_setup_assistants` (
   `profile` json NOT NULL,
   `created_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP,
   `updated_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
-  `profile_uuid` varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
   PRIMARY KEY (`id`),
   UNIQUE KEY `idx_mdm_setup_assistant_global_or_team_id` (`global_or_team_id`),
   KEY `fk_mdm_setup_assistant_team_id` (`team_id`),
@@ -934,8 +1000,10 @@ CREATE TABLE `mdm_windows_configuration_profiles` (
   `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
   `uploaded_at` timestamp NULL DEFAULT NULL,
   `profile_uuid` varchar(37) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
+  `auto_increment` bigint NOT NULL AUTO_INCREMENT,
   PRIMARY KEY (`profile_uuid`),
-  UNIQUE KEY `idx_mdm_windows_configuration_profiles_team_id_name` (`team_id`,`name`)
+  UNIQUE KEY `idx_mdm_windows_configuration_profiles_team_id_name` (`team_id`,`name`),
+  UNIQUE KEY `auto_increment` (`auto_increment`)
 ) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
@@ -970,9 +1038,9 @@ CREATE TABLE `migration_status_tables` (
   `tstamp` timestamp NULL DEFAULT CURRENT_TIMESTAMP,
   PRIMARY KEY (`id`),
   UNIQUE KEY `id` (`id`)
-) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB AUTO_INCREMENT=294 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB AUTO_INCREMENT=313 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
-INSERT INTO `migration_status_tables` VALUES (1,0,1,'2020-01-01 01:01:01'),(2,20161118193812,1,'2020-01-01 01:01:01'),(3,20161118211713,1,'2020-01-01 01:01:01'),(4,20161118212436,1,'2020-01-01 01:01:01'),(5,20161118212515,1,'2020-01-01 01:01:01'),(6,20161118212528,1,'2020-01-01 01:01:01'),(7,20161118212538,1,'2020-01-01 01:01:01'),(8,20161118212549,1,'2020-01-01 01:01:01'),(9,20161118212557,1,'2020-01-01 01:01:01'),(10,20161118212604,1,'2020-01-01 01:01:01'),(11,20161118212613,1,'2020-01-01 01:01:01'),(12,20161118212621,1,'2020-01-01 01:01:01'),(13,20161118212630,1,'2020-01-01 01:01:01'),(14,20161118212641,1,'2020-01-01 01:01:01'),(15,20161118212649,1,'2020-01-01 01:01:01'),(16,20161118212656,1,'2020-01-01 01:01:01'),(17,20161118212758,1,'2020-01-01 01:01:01'),(18,20161128234849,1,'2020-01-01 01:01:01'),(19,20161230162221,1,'2020-01-01 01:01:01'),(20,20170104113816,1,'2020-01-01 01:01:01'),(21,20170105151732,1,'2020-01-01 01:01:01'),(22,20170108191242,1,'2020-01-01 01:01:01'),(23,20170109094020,1,'2020-01-01 01:01:01'),(24,20170109130438,1,'2020-01-01 01:01:01'),(25,20170110202752,1,'2020-01-01 01:01:01'),(26,20170111133013,1,'2020-01-01 01:01:01'),(27,20170117025759,1,'2020-01-01 01:01:01'),(28,20170118191001,1,'2020-01-01 01:01:01'),(29,20170119234632,1,'2020-01-01 01:01:01'),(30,20170124230432,1,'2020-01-01 01:01:01'),(31,20170127014618,1,'2020-01-01 01:01:01'),(32,20170131232841,1,'2020-01-01 01:01:01'),(33,20170223094154,1,'2020-01-01 01:01:01'),(34,20170306075207,1,'2020-01-01 01:01:01'),(35,20170309100733,1,'2020-01-01 01:01:01'),(36,20170331111922,1,'2020-01-01 01:01:01'),(37,20170502143928,1,'2020-01-01 01:01:01'),(38,20170504130602,1,'2020-01-01 01:01:01'),(39,20170509132100,1,'2020-01-01 01:01:01'),(40,20170519105647,1,'2020-01-01 01:01:01'),(41,20170519105648,1,'2020-01-01 01:01:01'),(42,20170831234300,1,'2020-01-01 01:01:01'),(43,20170831234301,1,'2020-01-01 01:01:01'),(44,20170831234303,1,'2020-01-01 01:01:01'),(45,20171116163618,1,'2020-01-01 01:01:01'),(46,20171219164727,1,'2020-01-01 01:01:01'),(47,20180620164811,1,'2020-01-01 01:01:01'),(48,20180620175054,1,'2020-01-01 01:01:01'),(49,20180620175055,1,'2020-01-01 01:01:01'),(50,20191010101639,1,'2020-01-01 01:01:01'),(51,20191010155147,1,'2020-01-01 01:01:01'),(52,20191220130734,1,'2020-01-01 01:01:01'),(53,20200311140000,1,'2020-01-01 01:01:01'),(54,20200405120000,1,'2020-01-01 01:01:01'),(55,20200407120000,1,'2020-01-01 01:01:01'),(56,20200420120000,1,'2020-01-01 01:01:01'),(57,20200504120000,1,'2020-01-01 01:01:01'),(58,20200512120000,1,'2020-01-01 01:01:01'),(59,20200707120000,1,'2020-01-01 01:01:01'),(60,20201011162341,1,'2020-01-01 01:01:01'),(61,20201021104586,1,'2020-01-01 01:01:01'),(62,20201102112520,1,'2020-01-01 01:01:01'),(63,20201208121729,1,'2020-01-01 01:01:01'),(64,20201215091637,1,'2020-01-01 01:01:01'),(65,20210119174155,1,'2020-01-01 01:01:01'),(66,20210326182902,1,'2020-01-01 01:01:01'),(67,20210421112652,1,'2020-01-01 01:01:01'),(68,20210506095025,1,'2020-01-01 01:01:01'),(69,20210513115729,1,'2020-01-01 01:01:01'),(70,20210526113559,1,'2020-01-01 01:01:01'),(71,20210601000001,1,'2020-01-01 01:01:01'),(72,20210601000002,1,'2020-01-01 01:01:01'),(73,20210601000003,1,'2020-01-01 01:01:01'),(74,20210601000004,1,'2020-01-01 01:01:01'),(75,20210601000005,1,'2020-01-01 01:01:01'),(76,20210601000006,1,'2020-01-01 01:01:01'),(77,20210601000007,1,'2020-01-01 01:01:01'),(78,20210601000008,1,'2020-01-01 01:01:01'),(79,20210606151329,1,'2020-01-01 01:01:01'),(80,20210616163757,1,'2020-01-01 01:01:01'),(81,20210617174723,1,'2020-01-01 01:01:01'),(82,20210622160235,1,'2020-01-01 01:01:01'),(83,20210623100031,1,'2020-01-01 01:01:01'),(84,20210623133615,1,'2020-01-01 01:01:01'),(85,20210708143152,1,'2020-01-01 01:01:01'),(86,20210709124443,1,'2020-01-01 01:01:01'),(87,20210712155608,1,'2020-01-01 01:01:01'),(88,20210714102108,1,'2020-01-01 01:01:01'),(89,20210719153709,1,'2020-01-01 01:01:01'),(90,20210721171531,1,'2020-01-01 01:01:01'),(91,20210723135713,1,'2020-01-01 01:01:01'),(92,20210802135933,1,'2020-01-01 01:01:01'),(93,20210806112844,1,'2020-01-01 01:01:01'),(94,20210810095603,1,'2020-01-01 01:01:01'),(95,20210811150223,1,'2020-01-01 01:01:01'),(96,20210818151827,1,'2020-01-01 01:01:01'),(97,20210818151828,1,'2020-01-01 01:01:01'),(98,20210818182258,1,'2020-01-01 01:01:01'),(99,20210819131107,1,'2020-01-01 01:01:01'),(100,20210819143446,1,'2020-01-01 01:01:01'),(101,20210903132338,1,'2020-01-01 01:01:01'),(102,20210915144307,1,'2020-01-01 01:01:01'),(103,20210920155130,1,'2020-01-01 01:01:01'),(104,20210927143115,1,'2020-01-01 01:01:01'),(105,20210927143116,1,'2020-01-01 01:01:01'),(106,20211013133706,1,'2020-01-01 01:01:01'),(107,20211013133707,1,'2020-01-01 01:01:01'),(108,20211102135149,1,'2020-01-01 01:01:01'),(109,20211109121546,1,'2020-01-01 01:01:01'),(110,20211110163320,1,'2020-01-01 01:01:01'),(111,20211116184029,1,'2020-01-01 01:01:01'),(112,20211116184030,1,'2020-01-01 01:01:01'),(113,20211202092042,1,'2020-01-01 01:01:01'),(114,20211202181033,1,'2020-01-01 01:01:01'),(115,20211207161856,1,'2020-01-01 01:01:01'),(116,20211216131203,1,'2020-01-01 01:01:01'),(117,20211221110132,1,'2020-01-01 01:01:01'),(118,20220107155700,1,'2020-01-01 01:01:01'),(119,20220125105650,1,'2020-01-01 01:01:01'),(120,20220201084510,1,'2020-01-01 01:01:01'),(121,20220208144830,1,'2020-01-01 01:01:01'),(122,20220208144831,1,'2020-01-01 01:01:01'),(123,20220215152203,1,'2020-01-01 01:01:01'),(124,20220223113157,1,'2020-01-01 01:01:01'),(125,20220307104655,1,'2020-01-01 01:01:01'),(126,20220309133956,1,'2020-01-01 01:01:01'),(127,20220316155700,1,'2020-01-01 01:01:01'),(128,20220323152301,1,'2020-01-01 01:01:01'),(129,20220330100659,1,'2020-01-01 01:01:01'),(130,20220404091216,1,'2020-01-01 01:01:01'),(131,20220419140750,1,'2020-01-01 01:01:01'),(132,20220428140039,1,'2020-01-01 01:01:01'),(133,20220503134048,1,'2020-01-01 01:01:01'),(134,20220524102918,1,'2020-01-01 01:01:01'),(135,20220526123327,1,'2020-01-01 01:01:01'),(136,20220526123328,1,'2020-01-01 01:01:01'),(137,20220526123329,1,'2020-01-01 01:01:01'),(138,20220608113128,1,'2020-01-01 01:01:01'),(139,20220627104817,1,'2020-01-01 01:01:01'),(140,20220704101843,1,'2020-01-01 01:01:01'),(141,20220708095046,1,'2020-01-01 01:01:01'),(142,20220713091130,1,'2020-01-01 01:01:01'),(143,20220802135510,1,'2020-01-01 01:01:01'),(144,20220818101352,1,'2020-01-01 01:01:01'),(145,20220822161445,1,'2020-01-01 01:01:01'),(146,20220831100036,1,'2020-01-01 01:01:01'),(147,20220831100151,1,'2020-01-01 01:01:01'),(148,20220908181826,1,'2020-01-01 01:01:01'),(149,20220914154915,1,'2020-01-01 01:01:01'),(150,20220915165115,1,'2020-01-01 01:01:01'),(151,20220915165116,1,'2020-01-01 01:01:01'),(152,20220928100158,1,'2020-01-01 01:01:01'),(153,20221014084130,1,'2020-01-01 01:01:01'),(154,20221027085019,1,'2020-01-01 01:01:01'),(155,20221101103952,1,'2020-01-01 01:01:01'),(156,20221104144401,1,'2020-01-01 01:01:01'),(157,20221109100749,1,'2020-01-01 01:01:01'),(158,20221115104546,1,'2020-01-01 01:01:01'),(159,20221130114928,1,'2020-01-01 01:01:01'),(160,20221205112142,1,'2020-01-01 01:01:01'),(161,20221216115820,1,'2020-01-01 01:01:01'),(162,20221220195934,1,'2020-01-01 01:01:01'),(163,20221220195935,1,'2020-01-01 01:01:01'),(164,20221223174807,1,'2020-01-01 01:01:01'),(165,20221227163855,1,'2020-01-01 01:01:01'),(166,20221227163856,1,'2020-01-01 01:01:01'),(167,20230202224725,1,'2020-01-01 01:01:01'),(168,20230206163608,1,'2020-01-01 01:01:01'),(169,20230214131519,1,'2020-01-01 01:01:01'),(170,20230303135738,1,'2020-01-01 01:01:01'),(171,20230313135301,1,'2020-01-01 01:01:01'),(172,20230313141819,1,'2020-01-01 01:01:01'),(173,20230315104937,1,'2020-01-01 01:01:01'),(174,20230317173844,1,'2020-01-01 01:01:01'),(175,20230320133602,1,'2020-01-01 01:01:01'),(176,20230330100011,1,'2020-01-01 01:01:01'),(177,20230330134823,1,'2020-01-01 01:01:01'),(178,20230405232025,1,'2020-01-01 01:01:01'),(179,20230408084104,1,'2020-01-01 01:01:01'),(180,20230411102858,1,'2020-01-01 01:01:01'),(181,20230421155932,1,'2020-01-01 01:01:01'),(182,20230425082126,1,'2020-01-01 01:01:01'),(183,20230425105727,1,'2020-01-01 01:01:01'),(184,20230501154913,1,'2020-01-01 01:01:01'),(185,20230503101418,1,'2020-01-01 01:01:01'),(186,20230515144206,1,'2020-01-01 01:01:01'),(187,20230517140952,1,'2020-01-01 01:01:01'),(188,20230517152807,1,'2020-01-01 01:01:01'),(189,20230518114155,1,'2020-01-01 01:01:01'),(190,20230520153236,1,'2020-01-01 01:01:01'),(191,20230525151159,1,'2020-01-01 01:01:01'),(192,20230530122103,1,'2020-01-01 01:01:01'),(193,20230602111827,1,'2020-01-01 01:01:01'),(194,20230608103123,1,'2020-01-01 01:01:01'),(195,20230629140529,1,'2020-01-01 01:01:01'),(196,20230629140530,1,'2020-01-01 01:01:01'),(197,20230711144622,1,'2020-01-01 01:01:01'),(198,20230721135421,1,'2020-01-01 01:01:01'),(199,20230721161508,1,'2020-01-01 01:01:01'),(200,20230726115701,1,'2020-01-01 01:01:01'),(201,20230807100822,1,'2020-01-01 01:01:01'),(202,20230814150442,1,'2020-01-01 01:01:01'),(203,20230823122728,1,'2020-01-01 01:01:01'),(204,20230906152143,1,'2020-01-01 01:01:01'),(205,20230911163618,1,'2020-01-01 01:01:01'),(206,20230912101759,1,'2020-01-01 01:01:01'),(207,20230915101341,1,'2020-01-01 01:01:01'),(208,20230918132351,1,'2020-01-01 01:01:01'),(209,20231004144339,1,'2020-01-01 01:01:01'),(210,20231009094541,1,'2020-01-01 01:01:01'),(211,20231009094542,1,'2020-01-01 01:01:01'),(212,20231009094543,1,'2020-01-01 01:01:01'),(213,20231009094544,1,'2020-01-01 01:01:01'),(214,20231016091915,1,'2020-01-01 01:01:01'),(215,20231024174135,1,'2020-01-01 01:01:01'),(216,20231025120016,1,'2020-01-01 01:01:01'),(217,20231025160156,1,'2020-01-01 01:01:01'),(218,20231031165350,1,'2020-01-01 01:01:01'),(219,20231106144110,1,'2020-01-01 01:01:01'),(220,20231107130934,1,'2020-01-01 01:01:01'),(221,20231109115838,1,'2020-01-01 01:01:01'),(222,20231121054530,1,'2020-01-01 01:01:01'),(223,20231122101320,1,'2020-01-01 01:01:01'),(224,20231130132828,1,'2020-01-01 01:01:01'),(225,20231130132931,1,'2020-01-01 01:01:01'),(226,20231204155427,1,'2020-01-01 01:01:01'),(227,20231206142340,1,'2020-01-01 01:01:01'),(228,20231207102320,1,'2020-01-01 01:01:01'),(229,20231207102321,1,'2020-01-01 01:01:01'),(230,20231207133731,1,'2020-01-01 01:01:01'),(231,20231212094238,1,'2020-01-01 01:01:01'),(232,20231212095734,1,'2020-01-01 01:01:01'),(233,20231212161121,1,'2020-01-01 01:01:01'),(234,20231215122713,1,'2020-01-01 01:01:01'),(235,20231219143041,1,'2020-01-01 01:01:01'),(236,20231224070653,1,'2020-01-01 01:01:01'),(237,20240110134315,1,'2020-01-01 01:01:01'),(238,20240119091637,1,'2020-01-01 01:01:01'),(239,20240126020642,1,'2020-01-01 01:01:01'),(240,20240126020643,1,'2020-01-01 01:01:01'),(241,20240129162819,1,'2020-01-01 01:01:01'),(242,20240130115133,1,'2020-01-01 01:01:01'),(243,20240131083822,1,'2020-01-01 01:01:01'),(244,20240205095928,1,'2020-01-01 01:01:01'),(245,20240205121956,1,'2020-01-01 01:01:01'),(246,20240209110212,1,'2020-01-01 01:01:01'),(247,20240212111533,1,'2020-01-01 01:01:01'),(248,20240221112844,1,'2020-01-01 01:01:01'),(249,20240222073518,1,'2020-01-01 01:01:01'),(250,20240222135115,1,'2020-01-01 01:01:01'),(251,20240226082255,1,'2020-01-01 01:01:01'),(252,20240228082706,1,'2020-01-01 01:01:01'),(253,20240301173035,1,'2020-01-01 01:01:01'),(254,20240302111134,1,'2020-01-01 01:01:01'),(255,20240312103753,1,'2020-01-01 01:01:01'),(256,20240313143416,1,'2020-01-01 01:01:01'),(257,20240314085226,1,'2020-01-01 01:01:01'),(258,20240314151747,1,'2020-01-01 01:01:01'),(259,20240320145650,1,'2020-01-01 01:01:01'),(260,20240327115530,1,'2020-01-01 01:01:01'),(261,20240327115617,1,'2020-01-01 01:01:01'),(262,20240408085837,1,'2020-01-01 01:01:01'),(263,20240415104633,1,'2020-01-01 01:01:01'),(264,20240430111727,1,'2020-01-01 01:01:01'),(265,20240515200020,1,'2020-01-01 01:01:01'),(266,20240521143023,1,'2020-01-01 01:01:01'),(267,20240521143024,1,'2020-01-01 01:01:01'),(268,20240601174138,1,'2020-01-01 01:01:01'),(269,20240607133721,1,'2020-01-01 01:01:01'),(270,20240612150059,1,'2020-01-01 01:01:01'),(271,20240613162201,1,'2020-01-01 01:01:01'),(272,20240613172616,1,'2020-01-01 01:01:01'),(273,20240618142419,1,'2020-01-01 01:01:01'),(274,20240625093543,1,'2020-01-01 01:01:01'),(275,20240626195531,1,'2020-01-01 01:01:01'),(276,20240702123921,1,'2020-01-01 01:01:01'),(277,20240703154849,1,'2020-01-01 01:01:01'),(278,20240707134035,1,'2020-01-01 01:01:01'),(279,20240707134036,1,'2020-01-01 01:01:01'),(280,20240709124958,1,'2020-01-01 01:01:01'),(281,20240709132642,1,'2020-01-01 01:01:01'),(282,20240709183940,1,'2020-01-01 01:01:01'),(283,20240710155623,1,'2020-01-01 01:01:01'),(284,20240723102712,1,'2020-01-01 01:01:01'),(285,20240725152735,1,'2020-01-01 01:01:01'),(286,20240725182118,1,'2020-01-01 01:01:01'),(287,20240726100517,1,'2020-01-01 01:01:01'),(288,20240729120947,1,'2020-01-01 01:01:01'),(289,20240730171504,1,'2020-01-01 01:01:01'),(290,20240730174056,1,'2020-01-01 01:01:01'),(291,20240730215453,1,'2020-01-01 01:01:01'),(292,20240730374423,1,'2020-01-01 01:01:01'),(293,20240801115359,1,'2020-01-01 01:01:01');
+INSERT INTO `migration_status_tables` VALUES (1,0,1,'2020-01-01 01:01:01'),(2,20161118193812,1,'2020-01-01 01:01:01'),(3,20161118211713,1,'2020-01-01 01:01:01'),(4,20161118212436,1,'2020-01-01 01:01:01'),(5,20161118212515,1,'2020-01-01 01:01:01'),(6,20161118212528,1,'2020-01-01 01:01:01'),(7,20161118212538,1,'2020-01-01 01:01:01'),(8,20161118212549,1,'2020-01-01 01:01:01'),(9,20161118212557,1,'2020-01-01 01:01:01'),(10,20161118212604,1,'2020-01-01 01:01:01'),(11,20161118212613,1,'2020-01-01 01:01:01'),(12,20161118212621,1,'2020-01-01 01:01:01'),(13,20161118212630,1,'2020-01-01 01:01:01'),(14,20161118212641,1,'2020-01-01 01:01:01'),(15,20161118212649,1,'2020-01-01 01:01:01'),(16,20161118212656,1,'2020-01-01 01:01:01'),(17,20161118212758,1,'2020-01-01 01:01:01'),(18,20161128234849,1,'2020-01-01 01:01:01'),(19,20161230162221,1,'2020-01-01 01:01:01'),(20,20170104113816,1,'2020-01-01 01:01:01'),(21,20170105151732,1,'2020-01-01 01:01:01'),(22,20170108191242,1,'2020-01-01 01:01:01'),(23,20170109094020,1,'2020-01-01 01:01:01'),(24,20170109130438,1,'2020-01-01 01:01:01'),(25,20170110202752,1,'2020-01-01 01:01:01'),(26,20170111133013,1,'2020-01-01 01:01:01'),(27,20170117025759,1,'2020-01-01 01:01:01'),(28,20170118191001,1,'2020-01-01 01:01:01'),(29,20170119234632,1,'2020-01-01 01:01:01'),(30,20170124230432,1,'2020-01-01 01:01:01'),(31,20170127014618,1,'2020-01-01 01:01:01'),(32,20170131232841,1,'2020-01-01 01:01:01'),(33,20170223094154,1,'2020-01-01 01:01:01'),(34,20170306075207,1,'2020-01-01 01:01:01'),(35,20170309100733,1,'2020-01-01 01:01:01'),(36,20170331111922,1,'2020-01-01 01:01:01'),(37,20170502143928,1,'2020-01-01 01:01:01'),(38,20170504130602,1,'2020-01-01 01:01:01'),(39,20170509132100,1,'2020-01-01 01:01:01'),(40,20170519105647,1,'2020-01-01 01:01:01'),(41,20170519105648,1,'2020-01-01 01:01:01'),(42,20170831234300,1,'2020-01-01 01:01:01'),(43,20170831234301,1,'2020-01-01 01:01:01'),(44,20170831234303,1,'2020-01-01 01:01:01'),(45,20171116163618,1,'2020-01-01 01:01:01'),(46,20171219164727,1,'2020-01-01 01:01:01'),(47,20180620164811,1,'2020-01-01 01:01:01'),(48,20180620175054,1,'2020-01-01 01:01:01'),(49,20180620175055,1,'2020-01-01 01:01:01'),(50,20191010101639,1,'2020-01-01 01:01:01'),(51,20191010155147,1,'2020-01-01 01:01:01'),(52,20191220130734,1,'2020-01-01 01:01:01'),(53,20200311140000,1,'2020-01-01 01:01:01'),(54,20200405120000,1,'2020-01-01 01:01:01'),(55,20200407120000,1,'2020-01-01 01:01:01'),(56,20200420120000,1,'2020-01-01 01:01:01'),(57,20200504120000,1,'2020-01-01 01:01:01'),(58,20200512120000,1,'2020-01-01 01:01:01'),(59,20200707120000,1,'2020-01-01 01:01:01'),(60,20201011162341,1,'2020-01-01 01:01:01'),(61,20201021104586,1,'2020-01-01 01:01:01'),(62,20201102112520,1,'2020-01-01 01:01:01'),(63,20201208121729,1,'2020-01-01 01:01:01'),(64,20201215091637,1,'2020-01-01 01:01:01'),(65,20210119174155,1,'2020-01-01 01:01:01'),(66,20210326182902,1,'2020-01-01 01:01:01'),(67,20210421112652,1,'2020-01-01 01:01:01'),(68,20210506095025,1,'2020-01-01 01:01:01'),(69,20210513115729,1,'2020-01-01 01:01:01'),(70,20210526113559,1,'2020-01-01 01:01:01'),(71,20210601000001,1,'2020-01-01 01:01:01'),(72,20210601000002,1,'2020-01-01 01:01:01'),(73,20210601000003,1,'2020-01-01 01:01:01'),(74,20210601000004,1,'2020-01-01 01:01:01'),(75,20210601000005,1,'2020-01-01 01:01:01'),(76,20210601000006,1,'2020-01-01 01:01:01'),(77,20210601000007,1,'2020-01-01 01:01:01'),(78,20210601000008,1,'2020-01-01 01:01:01'),(79,20210606151329,1,'2020-01-01 01:01:01'),(80,20210616163757,1,'2020-01-01 01:01:01'),(81,20210617174723,1,'2020-01-01 01:01:01'),(82,20210622160235,1,'2020-01-01 01:01:01'),(83,20210623100031,1,'2020-01-01 01:01:01'),(84,20210623133615,1,'2020-01-01 01:01:01'),(85,20210708143152,1,'2020-01-01 01:01:01'),(86,20210709124443,1,'2020-01-01 01:01:01'),(87,20210712155608,1,'2020-01-01 01:01:01'),(88,20210714102108,1,'2020-01-01 01:01:01'),(89,20210719153709,1,'2020-01-01 01:01:01'),(90,20210721171531,1,'2020-01-01 01:01:01'),(91,20210723135713,1,'2020-01-01 01:01:01'),(92,20210802135933,1,'2020-01-01 01:01:01'),(93,20210806112844,1,'2020-01-01 01:01:01'),(94,20210810095603,1,'2020-01-01 01:01:01'),(95,20210811150223,1,'2020-01-01 01:01:01'),(96,20210818151827,1,'2020-01-01 01:01:01'),(97,20210818151828,1,'2020-01-01 01:01:01'),(98,20210818182258,1,'2020-01-01 01:01:01'),(99,20210819131107,1,'2020-01-01 01:01:01'),(100,20210819143446,1,'2020-01-01 01:01:01'),(101,20210903132338,1,'2020-01-01 01:01:01'),(102,20210915144307,1,'2020-01-01 01:01:01'),(103,20210920155130,1,'2020-01-01 01:01:01'),(104,20210927143115,1,'2020-01-01 01:01:01'),(105,20210927143116,1,'2020-01-01 01:01:01'),(106,20211013133706,1,'2020-01-01 01:01:01'),(107,20211013133707,1,'2020-01-01 01:01:01'),(108,20211102135149,1,'2020-01-01 01:01:01'),(109,20211109121546,1,'2020-01-01 01:01:01'),(110,20211110163320,1,'2020-01-01 01:01:01'),(111,20211116184029,1,'2020-01-01 01:01:01'),(112,20211116184030,1,'2020-01-01 01:01:01'),(113,20211202092042,1,'2020-01-01 01:01:01'),(114,20211202181033,1,'2020-01-01 01:01:01'),(115,20211207161856,1,'2020-01-01 01:01:01'),(116,20211216131203,1,'2020-01-01 01:01:01'),(117,20211221110132,1,'2020-01-01 01:01:01'),(118,20220107155700,1,'2020-01-01 01:01:01'),(119,20220125105650,1,'2020-01-01 01:01:01'),(120,20220201084510,1,'2020-01-01 01:01:01'),(121,20220208144830,1,'2020-01-01 01:01:01'),(122,20220208144831,1,'2020-01-01 01:01:01'),(123,20220215152203,1,'2020-01-01 01:01:01'),(124,20220223113157,1,'2020-01-01 01:01:01'),(125,20220307104655,1,'2020-01-01 01:01:01'),(126,20220309133956,1,'2020-01-01 01:01:01'),(127,20220316155700,1,'2020-01-01 01:01:01'),(128,20220323152301,1,'2020-01-01 01:01:01'),(129,20220330100659,1,'2020-01-01 01:01:01'),(130,20220404091216,1,'2020-01-01 01:01:01'),(131,20220419140750,1,'2020-01-01 01:01:01'),(132,20220428140039,1,'2020-01-01 01:01:01'),(133,20220503134048,1,'2020-01-01 01:01:01'),(134,20220524102918,1,'2020-01-01 01:01:01'),(135,20220526123327,1,'2020-01-01 01:01:01'),(136,20220526123328,1,'2020-01-01 01:01:01'),(137,20220526123329,1,'2020-01-01 01:01:01'),(138,20220608113128,1,'2020-01-01 01:01:01'),(139,20220627104817,1,'2020-01-01 01:01:01'),(140,20220704101843,1,'2020-01-01 01:01:01'),(141,20220708095046,1,'2020-01-01 01:01:01'),(142,20220713091130,1,'2020-01-01 01:01:01'),(143,20220802135510,1,'2020-01-01 01:01:01'),(144,20220818101352,1,'2020-01-01 01:01:01'),(145,20220822161445,1,'2020-01-01 01:01:01'),(146,20220831100036,1,'2020-01-01 01:01:01'),(147,20220831100151,1,'2020-01-01 01:01:01'),(148,20220908181826,1,'2020-01-01 01:01:01'),(149,20220914154915,1,'2020-01-01 01:01:01'),(150,20220915165115,1,'2020-01-01 01:01:01'),(151,20220915165116,1,'2020-01-01 01:01:01'),(152,20220928100158,1,'2020-01-01 01:01:01'),(153,20221014084130,1,'2020-01-01 01:01:01'),(154,20221027085019,1,'2020-01-01 01:01:01'),(155,20221101103952,1,'2020-01-01 01:01:01'),(156,20221104144401,1,'2020-01-01 01:01:01'),(157,20221109100749,1,'2020-01-01 01:01:01'),(158,20221115104546,1,'2020-01-01 01:01:01'),(159,20221130114928,1,'2020-01-01 01:01:01'),(160,20221205112142,1,'2020-01-01 01:01:01'),(161,20221216115820,1,'2020-01-01 01:01:01'),(162,20221220195934,1,'2020-01-01 01:01:01'),(163,20221220195935,1,'2020-01-01 01:01:01'),(164,20221223174807,1,'2020-01-01 01:01:01'),(165,20221227163855,1,'2020-01-01 01:01:01'),(166,20221227163856,1,'2020-01-01 01:01:01'),(167,20230202224725,1,'2020-01-01 01:01:01'),(168,20230206163608,1,'2020-01-01 01:01:01'),(169,20230214131519,1,'2020-01-01 01:01:01'),(170,20230303135738,1,'2020-01-01 01:01:01'),(171,20230313135301,1,'2020-01-01 01:01:01'),(172,20230313141819,1,'2020-01-01 01:01:01'),(173,20230315104937,1,'2020-01-01 01:01:01'),(174,20230317173844,1,'2020-01-01 01:01:01'),(175,20230320133602,1,'2020-01-01 01:01:01'),(176,20230330100011,1,'2020-01-01 01:01:01'),(177,20230330134823,1,'2020-01-01 01:01:01'),(178,20230405232025,1,'2020-01-01 01:01:01'),(179,20230408084104,1,'2020-01-01 01:01:01'),(180,20230411102858,1,'2020-01-01 01:01:01'),(181,20230421155932,1,'2020-01-01 01:01:01'),(182,20230425082126,1,'2020-01-01 01:01:01'),(183,20230425105727,1,'2020-01-01 01:01:01'),(184,20230501154913,1,'2020-01-01 01:01:01'),(185,20230503101418,1,'2020-01-01 01:01:01'),(186,20230515144206,1,'2020-01-01 01:01:01'),(187,20230517140952,1,'2020-01-01 01:01:01'),(188,20230517152807,1,'2020-01-01 01:01:01'),(189,20230518114155,1,'2020-01-01 01:01:01'),(190,20230520153236,1,'2020-01-01 01:01:01'),(191,20230525151159,1,'2020-01-01 01:01:01'),(192,20230530122103,1,'2020-01-01 01:01:01'),(193,20230602111827,1,'2020-01-01 01:01:01'),(194,20230608103123,1,'2020-01-01 01:01:01'),(195,20230629140529,1,'2020-01-01 01:01:01'),(196,20230629140530,1,'2020-01-01 01:01:01'),(197,20230711144622,1,'2020-01-01 01:01:01'),(198,20230721135421,1,'2020-01-01 01:01:01'),(199,20230721161508,1,'2020-01-01 01:01:01'),(200,20230726115701,1,'2020-01-01 01:01:01'),(201,20230807100822,1,'2020-01-01 01:01:01'),(202,20230814150442,1,'2020-01-01 01:01:01'),(203,20230823122728,1,'2020-01-01 01:01:01'),(204,20230906152143,1,'2020-01-01 01:01:01'),(205,20230911163618,1,'2020-01-01 01:01:01'),(206,20230912101759,1,'2020-01-01 01:01:01'),(207,20230915101341,1,'2020-01-01 01:01:01'),(208,20230918132351,1,'2020-01-01 01:01:01'),(209,20231004144339,1,'2020-01-01 01:01:01'),(210,20231009094541,1,'2020-01-01 01:01:01'),(211,20231009094542,1,'2020-01-01 01:01:01'),(212,20231009094543,1,'2020-01-01 01:01:01'),(213,20231009094544,1,'2020-01-01 01:01:01'),(214,20231016091915,1,'2020-01-01 01:01:01'),(215,20231024174135,1,'2020-01-01 01:01:01'),(216,20231025120016,1,'2020-01-01 01:01:01'),(217,20231025160156,1,'2020-01-01 01:01:01'),(218,20231031165350,1,'2020-01-01 01:01:01'),(219,20231106144110,1,'2020-01-01 01:01:01'),(220,20231107130934,1,'2020-01-01 01:01:01'),(221,20231109115838,1,'2020-01-01 01:01:01'),(222,20231121054530,1,'2020-01-01 01:01:01'),(223,20231122101320,1,'2020-01-01 01:01:01'),(224,20231130132828,1,'2020-01-01 01:01:01'),(225,20231130132931,1,'2020-01-01 01:01:01'),(226,20231204155427,1,'2020-01-01 01:01:01'),(227,20231206142340,1,'2020-01-01 01:01:01'),(228,20231207102320,1,'2020-01-01 01:01:01'),(229,20231207102321,1,'2020-01-01 01:01:01'),(230,20231207133731,1,'2020-01-01 01:01:01'),(231,20231212094238,1,'2020-01-01 01:01:01'),(232,20231212095734,1,'2020-01-01 01:01:01'),(233,20231212161121,1,'2020-01-01 01:01:01'),(234,20231215122713,1,'2020-01-01 01:01:01'),(235,20231219143041,1,'2020-01-01 01:01:01'),(236,20231224070653,1,'2020-01-01 01:01:01'),(237,20240110134315,1,'2020-01-01 01:01:01'),(238,20240119091637,1,'2020-01-01 01:01:01'),(239,20240126020642,1,'2020-01-01 01:01:01'),(240,20240126020643,1,'2020-01-01 01:01:01'),(241,20240129162819,1,'2020-01-01 01:01:01'),(242,20240130115133,1,'2020-01-01 01:01:01'),(243,20240131083822,1,'2020-01-01 01:01:01'),(244,20240205095928,1,'2020-01-01 01:01:01'),(245,20240205121956,1,'2020-01-01 01:01:01'),(246,20240209110212,1,'2020-01-01 01:01:01'),(247,20240212111533,1,'2020-01-01 01:01:01'),(248,20240221112844,1,'2020-01-01 01:01:01'),(249,20240222073518,1,'2020-01-01 01:01:01'),(250,20240222135115,1,'2020-01-01 01:01:01'),(251,20240226082255,1,'2020-01-01 01:01:01'),(252,20240228082706,1,'2020-01-01 01:01:01'),(253,20240301173035,1,'2020-01-01 01:01:01'),(254,20240302111134,1,'2020-01-01 01:01:01'),(255,20240312103753,1,'2020-01-01 01:01:01'),(256,20240313143416,1,'2020-01-01 01:01:01'),(257,20240314085226,1,'2020-01-01 01:01:01'),(258,20240314151747,1,'2020-01-01 01:01:01'),(259,20240320145650,1,'2020-01-01 01:01:01'),(260,20240327115530,1,'2020-01-01 01:01:01'),(261,20240327115617,1,'2020-01-01 01:01:01'),(262,20240408085837,1,'2020-01-01 01:01:01'),(263,20240415104633,1,'2020-01-01 01:01:01'),(264,20240430111727,1,'2020-01-01 01:01:01'),(265,20240515200020,1,'2020-01-01 01:01:01'),(266,20240521143023,1,'2020-01-01 01:01:01'),(267,20240521143024,1,'2020-01-01 01:01:01'),(268,20240601174138,1,'2020-01-01 01:01:01'),(269,20240607133721,1,'2020-01-01 01:01:01'),(270,20240612150059,1,'2020-01-01 01:01:01'),(271,20240613162201,1,'2020-01-01 01:01:01'),(272,20240613172616,1,'2020-01-01 01:01:01'),(273,20240618142419,1,'2020-01-01 01:01:01'),(274,20240625093543,1,'2020-01-01 01:01:01'),(275,20240626195531,1,'2020-01-01 01:01:01'),(276,20240702123921,1,'2020-01-01 01:01:01'),(277,20240703154849,1,'2020-01-01 01:01:01'),(278,20240707134035,1,'2020-01-01 01:01:01'),(279,20240707134036,1,'2020-01-01 01:01:01'),(280,20240709124958,1,'2020-01-01 01:01:01'),(281,20240709132642,1,'2020-01-01 01:01:01'),(282,20240709183940,1,'2020-01-01 01:01:01'),(283,20240710155623,1,'2020-01-01 01:01:01'),(284,20240723102712,1,'2020-01-01 01:01:01'),(285,20240725152735,1,'2020-01-01 01:01:01'),(286,20240725182118,1,'2020-01-01 01:01:01'),(287,20240726100517,1,'2020-01-01 01:01:01'),(288,20240730171504,1,'2020-01-01 01:01:01'),(289,20240730174056,1,'2020-01-01 01:01:01'),(290,20240730215453,1,'2020-01-01 01:01:01'),(291,20240730374423,1,'2020-01-01 01:01:01'),(292,20240801115359,1,'2020-01-01 01:01:01'),(293,20240802101043,1,'2020-01-01 01:01:01'),(294,20240802113716,1,'2020-01-01 01:01:01'),(295,20240814135330,1,'2020-01-01 01:01:01'),(296,20240815000000,1,'2020-01-01 01:01:01'),(297,20240815000001,1,'2020-01-01 01:01:01'),(298,20240816103247,1,'2020-01-01 01:01:01'),(299,20240820091218,1,'2020-01-01 01:01:01'),(300,20240826111228,1,'2020-01-01 01:01:01'),(301,20240826160025,1,'2020-01-01 01:01:01'),(302,20240829165448,1,'2020-01-01 01:01:01'),(303,20240829165605,1,'2020-01-01 01:01:01'),(304,20240829165715,1,'2020-01-01 01:01:01'),(305,20240829165930,1,'2020-01-01 01:01:01'),(306,20240829170023,1,'2020-01-01 01:01:01'),(307,20240829170033,1,'2020-01-01 01:01:01'),(308,20240829170044,1,'2020-01-01 01:01:01'),(309,20240905105135,1,'2020-01-01 01:01:01'),(310,20240905140514,1,'2020-01-01 01:01:01'),(311,20240905200000,1,'2020-01-01 01:01:01'),(312,20240905200001,1,'2020-01-01 01:01:01');
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
 /*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `mobile_device_management_solutions` (
@@ -1171,6 +1239,7 @@ CREATE TABLE `nano_users` (
   `created_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP,
   `updated_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
   PRIMARY KEY (`id`,`device_id`),
+  UNIQUE KEY `idx_unique_id` (`id`),
   KEY `device_id` (`device_id`),
   CONSTRAINT `nano_users_ibfk_1` FOREIGN KEY (`device_id`) REFERENCES `nano_devices` (`id`) ON DELETE CASCADE ON UPDATE CASCADE,
   CONSTRAINT `nano_users_chk_1` CHECK (((`user_short_name` is null) or (`user_short_name` <> _utf8mb4''))),
@@ -1319,11 +1388,13 @@ CREATE TABLE `policies` (
   `critical` tinyint(1) NOT NULL DEFAULT '0',
   `checksum` binary(16) NOT NULL,
   `calendar_events_enabled` tinyint unsigned NOT NULL DEFAULT '0',
+  `software_installer_id` int unsigned DEFAULT NULL,
   PRIMARY KEY (`id`),
   UNIQUE KEY `idx_policies_checksum` (`checksum`),
   KEY `idx_policies_author_id` (`author_id`),
   KEY `idx_policies_team_id` (`team_id`),
-  CONSTRAINT `policies_ibfk_2` FOREIGN KEY (`team_id`) REFERENCES `teams` (`id`) ON DELETE CASCADE ON UPDATE CASCADE,
+  KEY `fk_policies_software_installer_id` (`software_installer_id`),
+  CONSTRAINT `policies_ibfk_3` FOREIGN KEY (`software_installer_id`) REFERENCES `software_installers` (`id`),
   CONSTRAINT `policies_queries_ibfk_1` FOREIGN KEY (`author_id`) REFERENCES `users` (`id`) ON DELETE SET NULL
 ) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
@@ -1357,15 +1428,16 @@ CREATE TABLE `policy_membership` (
 CREATE TABLE `policy_stats` (
   `id` int unsigned NOT NULL AUTO_INCREMENT,
   `policy_id` int unsigned NOT NULL,
-  `inherited_team_id` int unsigned NOT NULL DEFAULT '0',
+  `inherited_team_id` int unsigned DEFAULT NULL,
   `passing_host_count` mediumint unsigned NOT NULL DEFAULT '0',
   `failing_host_count` mediumint unsigned NOT NULL DEFAULT '0',
   `created_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
   `updated_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+  `inherited_team_id_char` char(10) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci GENERATED ALWAYS AS (if((`inherited_team_id` is null),_utf8mb4'global',cast(`inherited_team_id` as char charset utf8mb4))) VIRTUAL,
   PRIMARY KEY (`id`),
-  UNIQUE KEY `policy_team_unique` (`policy_id`,`inherited_team_id`),
+  UNIQUE KEY `policy_id` (`policy_id`,`inherited_team_id_char`),
   CONSTRAINT `policy_stats_ibfk_1` FOREIGN KEY (`policy_id`) REFERENCES `policies` (`id`) ON DELETE CASCADE
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
 /*!50503 SET character_set_client = utf8mb4 */;
@@ -1407,7 +1479,7 @@ CREATE TABLE `query_results` (
   `last_fetched` timestamp NOT NULL,
   `data` json DEFAULT NULL,
   PRIMARY KEY (`id`),
-  KEY `query_id` (`query_id`)
+  KEY `idx_query_id_host_id_last_fetched` (`query_id`,`host_id`,`last_fetched`)
 ) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
@@ -1604,8 +1676,16 @@ CREATE TABLE `software_installers` (
   `install_script_content_id` int unsigned NOT NULL,
   `post_install_script_content_id` int unsigned DEFAULT NULL,
   `storage_id` varchar(64) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
-  `uploaded_at` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  `uploaded_at` timestamp(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6),
   `self_service` tinyint(1) NOT NULL DEFAULT '0',
+  `user_id` int unsigned DEFAULT NULL,
+  `user_name` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
+  `user_email` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
+  `url` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
+  `package_ids` text CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
+  `extension` varchar(32) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT '',
+  `uninstall_script_content_id` int unsigned NOT NULL,
+  `updated_at` timestamp(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6) ON UPDATE CURRENT_TIMESTAMP(6),
   PRIMARY KEY (`id`),
   UNIQUE KEY `idx_software_installers_team_id_title_id` (`global_or_team_id`,`title_id`),
   KEY `fk_software_installers_title` (`title_id`),
@@ -1613,10 +1693,14 @@ CREATE TABLE `software_installers` (
   KEY `fk_software_installers_post_install_script_content_id` (`post_install_script_content_id`),
   KEY `fk_software_installers_team_id` (`team_id`),
   KEY `idx_software_installers_platform_title_id` (`platform`,`title_id`),
+  KEY `fk_software_installers_user_id` (`user_id`),
+  KEY `fk_uninstall_script_content_id` (`uninstall_script_content_id`),
   CONSTRAINT `fk_software_installers_install_script_content_id` FOREIGN KEY (`install_script_content_id`) REFERENCES `script_contents` (`id`) ON DELETE RESTRICT ON UPDATE CASCADE,
   CONSTRAINT `fk_software_installers_post_install_script_content_id` FOREIGN KEY (`post_install_script_content_id`) REFERENCES `script_contents` (`id`) ON DELETE RESTRICT ON UPDATE CASCADE,
   CONSTRAINT `fk_software_installers_team_id` FOREIGN KEY (`team_id`) REFERENCES `teams` (`id`) ON DELETE CASCADE ON UPDATE CASCADE,
-  CONSTRAINT `fk_software_installers_title` FOREIGN KEY (`title_id`) REFERENCES `software_titles` (`id`) ON DELETE SET NULL ON UPDATE CASCADE
+  CONSTRAINT `fk_software_installers_title` FOREIGN KEY (`title_id`) REFERENCES `software_titles` (`id`) ON DELETE SET NULL ON UPDATE CASCADE,
+  CONSTRAINT `fk_software_installers_user_id` FOREIGN KEY (`user_id`) REFERENCES `users` (`id`) ON DELETE SET NULL,
+  CONSTRAINT `fk_uninstall_script_content_id` FOREIGN KEY (`uninstall_script_content_id`) REFERENCES `script_contents` (`id`) ON DELETE RESTRICT ON UPDATE CASCADE
 ) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
@@ -1729,16 +1813,48 @@ CREATE TABLE `vpp_apps_teams` (
   `team_id` int unsigned DEFAULT NULL,
   `global_or_team_id` int NOT NULL DEFAULT '0',
   `platform` varchar(10) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
+  `self_service` tinyint(1) NOT NULL DEFAULT '0',
+  `vpp_token_id` int unsigned NOT NULL,
   PRIMARY KEY (`id`),
   UNIQUE KEY `idx_global_or_team_id_adam_id` (`global_or_team_id`,`adam_id`,`platform`),
   KEY `team_id` (`team_id`),
   KEY `adam_id` (`adam_id`,`platform`),
+  KEY `fk_vpp_apps_teams_vpp_token_id` (`vpp_token_id`),
+  CONSTRAINT `fk_vpp_apps_teams_vpp_token_id` FOREIGN KEY (`vpp_token_id`) REFERENCES `vpp_tokens` (`id`) ON DELETE CASCADE,
   CONSTRAINT `vpp_apps_teams_ibfk_2` FOREIGN KEY (`team_id`) REFERENCES `teams` (`id`) ON DELETE CASCADE,
   CONSTRAINT `vpp_apps_teams_ibfk_3` FOREIGN KEY (`adam_id`, `platform`) REFERENCES `vpp_apps` (`adam_id`, `platform`) ON DELETE CASCADE
 ) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
 /*!40101 SET @saved_cs_client     = @@character_set_client */;
 /*!50503 SET character_set_client = utf8mb4 */;
+CREATE TABLE `vpp_token_teams` (
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
+  `vpp_token_id` int unsigned NOT NULL,
+  `team_id` int unsigned DEFAULT NULL,
+  `null_team_type` enum('none','allteams','noteam') CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci DEFAULT 'none',
+  PRIMARY KEY (`id`),
+  UNIQUE KEY `idx_vpp_token_teams_team_id` (`team_id`),
+  KEY `fk_vpp_token_teams_vpp_token_id` (`vpp_token_id`),
+  CONSTRAINT `fk_vpp_token_teams_team_id` FOREIGN KEY (`team_id`) REFERENCES `teams` (`id`) ON DELETE CASCADE,
+  CONSTRAINT `fk_vpp_token_teams_vpp_token_id` FOREIGN KEY (`vpp_token_id`) REFERENCES `vpp_tokens` (`id`) ON DELETE CASCADE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+/*!40101 SET character_set_client = @saved_cs_client */;
+/*!40101 SET @saved_cs_client     = @@character_set_client */;
+/*!50503 SET character_set_client = utf8mb4 */;
+CREATE TABLE `vpp_tokens` (
+  `id` int unsigned NOT NULL AUTO_INCREMENT,
+  `organization_name` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
+  `location` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL,
+  `renew_at` timestamp NOT NULL,
+  `token` blob NOT NULL,
+  `created_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP,
+  `updated_at` timestamp NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+  PRIMARY KEY (`id`),
+  UNIQUE KEY `idx_vpp_tokens_location` (`location`)
+) /*!50100 TABLESPACE `innodb_system` */ ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+/*!40101 SET character_set_client = @saved_cs_client */;
+/*!40101 SET @saved_cs_client     = @@character_set_client */;
+/*!50503 SET character_set_client = utf8mb4 */;
 CREATE TABLE `vulnerability_host_counts` (
   `cve` varchar(20) COLLATE utf8mb4_unicode_ci NOT NULL,
   `team_id` int unsigned NOT NULL DEFAULT '0',
diff --git a/server/datastore/mysql/scripts.go b/server/datastore/mysql/scripts.go
index e9acb25254..f0ad52acb0 100644
--- a/server/datastore/mysql/scripts.go
+++ b/server/datastore/mysql/scripts.go
@@ -80,7 +80,8 @@ func truncateScriptResult(output string) string {
 	return output
 }
 
-func (ds *Datastore) SetHostScriptExecutionResult(ctx context.Context, result *fleet.HostScriptResultPayload) (*fleet.HostScriptResult, error) {
+func (ds *Datastore) SetHostScriptExecutionResult(ctx context.Context, result *fleet.HostScriptResultPayload) (*fleet.HostScriptResult,
+	string, error) {
 	const resultExistsStmt = `
 	SELECT
 		1
@@ -105,20 +106,27 @@ func (ds *Datastore) SetHostScriptExecutionResult(ctx context.Context, result *f
 	const hostMDMActionsStmt = `
   SELECT
     CASE
-      WHEN lock_ref = ? THEN 'lock_ref'
-      WHEN unlock_ref = ? THEN 'unlock_ref'
-      WHEN wipe_ref = ? THEN 'wipe_ref'
+      WHEN lock_ref = :execution_id THEN 'lock_ref'
+      WHEN unlock_ref = :execution_id THEN 'unlock_ref'
+      WHEN wipe_ref = :execution_id THEN 'wipe_ref'
       ELSE ''
-    END AS ref_col
+    END AS action
   FROM
     host_mdm_actions
   WHERE
-    host_id = ?
+    host_id = :host_id
+  UNION
+  SELECT 'uninstall' AS action
+  FROM
+	host_software_installs
+  WHERE
+	execution_id = :execution_id AND host_id = :host_id
 `
 
 	output := truncateScriptResult(result.Output)
 
 	var hsr *fleet.HostScriptResult
+	var action string
 	err := ds.withRetryTxx(ctx, func(tx sqlx.ExtContext) error {
 		var resultExists bool
 		err := sqlx.GetContext(ctx, tx, &resultExists, resultExistsStmt, result.HostID, result.ExecutionID)
@@ -154,15 +162,31 @@ func (ds *Datastore) SetHostScriptExecutionResult(ctx context.Context, result *f
 				return ctxerr.Wrap(ctx, err, "load updated host script result")
 			}
 
-			// look up if that script was a lock/unlock/wipe script for that host,
+			// look up if that script was a lock/unlock/wipe/uninstall script for that host,
 			// and if so update the host_mdm_actions table accordingly.
-			var refCol string
-			err = sqlx.GetContext(ctx, tx, &refCol, hostMDMActionsStmt, result.ExecutionID, result.ExecutionID, result.ExecutionID, result.HostID)
+			namedArgs := map[string]any{
+				"host_id":      result.HostID,
+				"execution_id": result.ExecutionID,
+			}
+			stmt, args, err := sqlx.Named(hostMDMActionsStmt, namedArgs)
+			if err != nil {
+				return ctxerr.Wrap(ctx, err, "build named query for host mdm actions")
+			}
+			err = sqlx.GetContext(ctx, tx, &action, stmt, args...)
 			if err != nil && !errors.Is(err, sql.ErrNoRows) { // ignore ErrNoRows, refCol will be empty
 				return ctxerr.Wrap(ctx, err, "lookup host script corresponding mdm action")
 			}
-			if refCol != "" {
-				err = updateHostLockWipeStatusFromResult(ctx, tx, result.HostID, refCol, result.ExitCode == 0)
+
+			switch action {
+			case "":
+				// do nothing
+			case "uninstall":
+				err = updateUninstallStatusFromResult(ctx, tx, result.HostID, result.ExecutionID, result.ExitCode)
+				if err != nil {
+					return ctxerr.Wrap(ctx, err, "update host uninstall action based on script result")
+				}
+			default: // lock/unlock/wipe
+				err = updateHostLockWipeStatusFromResult(ctx, tx, result.HostID, action, result.ExitCode == 0)
 				if err != nil {
 					return ctxerr.Wrap(ctx, err, "update host mdm action based on script result")
 				}
@@ -171,9 +195,9 @@ func (ds *Datastore) SetHostScriptExecutionResult(ctx context.Context, result *f
 		return nil
 	})
 	if err != nil {
-		return nil, err
+		return nil, "", err
 	}
-	return hsr, nil
+	return hsr, action, nil
 }
 
 func (ds *Datastore) ListPendingHostScriptExecutions(ctx context.Context, hostID uint) ([]*fleet.HostScriptResult, error) {
@@ -392,6 +416,25 @@ WHERE
 	return contents, nil
 }
 
+func (ds *Datastore) GetAnyScriptContents(ctx context.Context, id uint) ([]byte, error) {
+	const getStmt = `
+SELECT
+  sc.contents
+FROM
+  script_contents sc
+WHERE
+  sc.id = ?
+`
+	var contents []byte
+	if err := sqlx.GetContext(ctx, ds.reader(ctx), &contents, getStmt, id); err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			return nil, notFound("Script").WithID(id)
+		}
+		return nil, ctxerr.Wrap(ctx, err, "get any script contents")
+	}
+	return contents, nil
+}
+
 func (ds *Datastore) DeleteScript(ctx context.Context, id uint) error {
 	_, err := ds.writer(ctx).ExecContext(ctx, `DELETE FROM scripts WHERE id = ?`, id)
 	if err != nil {
@@ -1100,6 +1143,16 @@ func updateHostLockWipeStatusFromResult(ctx context.Context, tx sqlx.ExtContext,
 	return ctxerr.Wrap(ctx, err, "update host lock/wipe status from result")
 }
 
+func updateUninstallStatusFromResult(ctx context.Context, tx sqlx.ExtContext, hostID uint, executionID string, exitCode int) error {
+	stmt := `
+	UPDATE host_software_installs SET uninstall_script_exit_code = ? WHERE execution_id = ? AND host_id = ?
+	`
+	if _, err := tx.ExecContext(ctx, stmt, exitCode, executionID, hostID); err != nil {
+		return ctxerr.Wrap(ctx, err, "update uninstall status from result")
+	}
+	return nil
+}
+
 func (ds *Datastore) CleanupUnusedScriptContents(ctx context.Context) error {
 	deleteStmt := `
 DELETE FROM
@@ -1111,7 +1164,7 @@ WHERE
     SELECT 1 FROM scripts WHERE script_content_id = script_contents.id)
   AND NOT EXISTS (
     SELECT 1 FROM software_installers si
-    WHERE script_contents.id IN (si.install_script_content_id, si.post_install_script_content_id)
+    WHERE script_contents.id IN (si.install_script_content_id, si.post_install_script_content_id, si.uninstall_script_content_id)
   )
 		`
 	_, err := ds.writer(ctx).ExecContext(ctx, deleteStmt)
diff --git a/server/datastore/mysql/scripts_test.go b/server/datastore/mysql/scripts_test.go
index b3ccd430a4..7666f0ae4f 100644
--- a/server/datastore/mysql/scripts_test.go
+++ b/server/datastore/mysql/scripts_test.go
@@ -37,6 +37,7 @@ func TestScripts(t *testing.T) {
 		{"TestLockUnlockManually", testLockUnlockManually},
 		{"TestInsertScriptContents", testInsertScriptContents},
 		{"TestCleanupUnusedScriptContents", testCleanupUnusedScriptContents},
+		{"TestGetAnyScriptContents", testGetAnyScriptContents},
 	}
 	for _, c := range cases {
 		t.Run(c.name, func(t *testing.T) {
@@ -87,7 +88,7 @@ func testHostScriptResult(t *testing.T, ds *Datastore) {
 	require.Equal(t, createdScript.ID, pending[0].ID)
 
 	// record a result for this execution
-	_, err = ds.SetHostScriptExecutionResult(ctx, &fleet.HostScriptResultPayload{
+	hsr, action, err := ds.SetHostScriptExecutionResult(ctx, &fleet.HostScriptResultPayload{
 		HostID:      1,
 		ExecutionID: createdScript.ExecutionID,
 		Output:      "foo",
@@ -96,9 +97,11 @@ func testHostScriptResult(t *testing.T, ds *Datastore) {
 		Timeout:     300,
 	})
 	require.NoError(t, err)
+	assert.Empty(t, action)
+	assert.NotNil(t, hsr)
 
 	// record a duplicate result for this execution, will be ignored
-	hsr, err := ds.SetHostScriptExecutionResult(ctx, &fleet.HostScriptResultPayload{
+	hsr, _, err = ds.SetHostScriptExecutionResult(ctx, &fleet.HostScriptResultPayload{
 		HostID:      1,
 		ExecutionID: createdScript.ExecutionID,
 		Output:      "foobarbaz",
@@ -163,7 +166,7 @@ func testHostScriptResult(t *testing.T, ds *Datastore) {
 		strings.Repeat("j", 1000) +
 		strings.Repeat("k", 1000)
 
-	_, err = ds.SetHostScriptExecutionResult(ctx, &fleet.HostScriptResultPayload{
+	_, _, err = ds.SetHostScriptExecutionResult(ctx, &fleet.HostScriptResultPayload{
 		HostID:      1,
 		ExecutionID: createdScript.ExecutionID,
 		Output:      largeOutput,
@@ -238,7 +241,7 @@ func testHostScriptResult(t *testing.T, ds *Datastore) {
 	})
 	require.NoError(t, err)
 
-	unsignedScriptResult, err := ds.SetHostScriptExecutionResult(ctx, &fleet.HostScriptResultPayload{
+	unsignedScriptResult, _, err := ds.SetHostScriptExecutionResult(ctx, &fleet.HostScriptResultPayload{
 		HostID:      1,
 		ExecutionID: createdUnsignedScript.ExecutionID,
 		Output:      "foo",
@@ -261,6 +264,8 @@ func testScripts(t *testing.T, ds *Datastore) {
 	// get unknown script contents
 	_, err = ds.GetScriptContents(ctx, 123)
 	require.ErrorAs(t, err, &nfe)
+	_, err = ds.GetAnyScriptContents(ctx, 123)
+	require.ErrorAs(t, err, &nfe)
 
 	// create global scriptGlobal
 	scriptGlobal, err := ds.NewScript(ctx, &fleet.Script{
@@ -282,6 +287,9 @@ func testScripts(t *testing.T, ds *Datastore) {
 	contents, err := ds.GetScriptContents(ctx, scriptGlobal.ID)
 	require.NoError(t, err)
 	require.Equal(t, "echo", string(contents))
+	contents, err = ds.GetAnyScriptContents(ctx, scriptGlobal.ID)
+	require.NoError(t, err)
+	require.Equal(t, "echo", string(contents))
 
 	// create team script but team does not exist
 	_, err = ds.NewScript(ctx, &fleet.Script{
@@ -315,6 +323,9 @@ func testScripts(t *testing.T, ds *Datastore) {
 	contents, err = ds.GetScriptContents(ctx, scriptTeam.ID)
 	require.NoError(t, err)
 	require.Equal(t, "echo 'team'", string(contents))
+	contents, err = ds.GetAnyScriptContents(ctx, scriptTeam.ID)
+	require.NoError(t, err)
+	require.Equal(t, "echo 'team'", string(contents))
 
 	// try to create another team script with the same name
 	_, err = ds.NewScript(ctx, &fleet.Script{
@@ -781,12 +792,13 @@ func testLockHostViaScript(t *testing.T, ds *Datastore) {
 	require.True(t, status.IsPendingLock())
 
 	// simulate a successful result for the lock script execution
-	_, err = ds.SetHostScriptExecutionResult(ctx, &fleet.HostScriptResultPayload{
+	_, action, err := ds.SetHostScriptExecutionResult(ctx, &fleet.HostScriptResultPayload{
 		HostID:      s.HostID,
 		ExecutionID: s.ExecutionID,
 		ExitCode:    0,
 	})
 	require.NoError(t, err)
+	assert.Equal(t, "lock_ref", action)
 
 	status, err = ds.GetHostLockWipeStatus(ctx, &fleet.Host{ID: windowsHostID, Platform: "windows", UUID: "uuid"})
 	require.NoError(t, err)
@@ -832,12 +844,13 @@ func testUnlockHostViaScript(t *testing.T, ds *Datastore) {
 	require.True(t, status.IsPendingUnlock())
 
 	// simulate a successful result for the unlock script execution
-	_, err = ds.SetHostScriptExecutionResult(ctx, &fleet.HostScriptResultPayload{
+	_, action, err := ds.SetHostScriptExecutionResult(ctx, &fleet.HostScriptResultPayload{
 		HostID:      s.HostID,
 		ExecutionID: s.ExecutionID,
 		ExitCode:    0,
 	})
 	require.NoError(t, err)
+	assert.Equal(t, "unlock_ref", action)
 
 	status, err = ds.GetHostLockWipeStatus(ctx, &fleet.Host{ID: hostID, Platform: "windows", UUID: "uuid"})
 	require.NoError(t, err)
@@ -874,12 +887,13 @@ func testLockUnlockWipeViaScripts(t *testing.T, ds *Datastore) {
 			checkLockWipeState(t, status, true, false, false, false, true, false)
 
 			// simulate a successful result for the lock script execution
-			_, err = ds.SetHostScriptExecutionResult(ctx, &fleet.HostScriptResultPayload{
+			_, action, err := ds.SetHostScriptExecutionResult(ctx, &fleet.HostScriptResultPayload{
 				HostID:      hostID,
 				ExecutionID: status.LockScript.ExecutionID,
 				ExitCode:    0,
 			})
 			require.NoError(t, err)
+			assert.Equal(t, "lock_ref", action)
 
 			status, err = ds.GetHostLockWipeStatus(ctx, &fleet.Host{ID: hostID, Platform: platform, UUID: "uuid"})
 			require.NoError(t, err)
@@ -899,12 +913,13 @@ func testLockUnlockWipeViaScripts(t *testing.T, ds *Datastore) {
 			checkLockWipeState(t, status, false, true, false, true, false, false)
 
 			// simulate a failed result for the unlock script execution
-			_, err = ds.SetHostScriptExecutionResult(ctx, &fleet.HostScriptResultPayload{
+			_, action, err = ds.SetHostScriptExecutionResult(ctx, &fleet.HostScriptResultPayload{
 				HostID:      hostID,
 				ExecutionID: status.UnlockScript.ExecutionID,
 				ExitCode:    -1,
 			})
 			require.NoError(t, err)
+			assert.Equal(t, "unlock_ref", action)
 
 			// still locked
 			status, err = ds.GetHostLockWipeStatus(ctx, &fleet.Host{ID: hostID, Platform: platform, UUID: "uuid"})
@@ -925,12 +940,13 @@ func testLockUnlockWipeViaScripts(t *testing.T, ds *Datastore) {
 			checkLockWipeState(t, status, false, true, false, true, false, false)
 
 			// this time simulate a successful result for the unlock script execution
-			_, err = ds.SetHostScriptExecutionResult(ctx, &fleet.HostScriptResultPayload{
+			_, action, err = ds.SetHostScriptExecutionResult(ctx, &fleet.HostScriptResultPayload{
 				HostID:      hostID,
 				ExecutionID: status.UnlockScript.ExecutionID,
 				ExitCode:    0,
 			})
 			require.NoError(t, err)
+			assert.Equal(t, "unlock_ref", action)
 
 			// host is now unlocked
 			status, err = ds.GetHostLockWipeStatus(ctx, &fleet.Host{ID: hostID, Platform: platform, UUID: "uuid"})
@@ -951,12 +967,13 @@ func testLockUnlockWipeViaScripts(t *testing.T, ds *Datastore) {
 			checkLockWipeState(t, status, true, false, false, false, true, false)
 
 			// simulate a failed result for the lock script execution
-			_, err = ds.SetHostScriptExecutionResult(ctx, &fleet.HostScriptResultPayload{
+			_, action, err = ds.SetHostScriptExecutionResult(ctx, &fleet.HostScriptResultPayload{
 				HostID:      hostID,
 				ExecutionID: status.LockScript.ExecutionID,
 				ExitCode:    2,
 			})
 			require.NoError(t, err)
+			assert.Equal(t, "lock_ref", action)
 
 			status, err = ds.GetHostLockWipeStatus(ctx, &fleet.Host{ID: hostID, Platform: platform, UUID: "uuid"})
 			require.NoError(t, err)
@@ -1009,12 +1026,13 @@ func testLockUnlockWipeViaScripts(t *testing.T, ds *Datastore) {
 				checkLockWipeState(t, status, true, false, false, false, false, true)
 
 				// simulate a failed result for the wipe script execution
-				_, err = ds.SetHostScriptExecutionResult(ctx, &fleet.HostScriptResultPayload{
+				_, action, err = ds.SetHostScriptExecutionResult(ctx, &fleet.HostScriptResultPayload{
 					HostID:      hostID,
 					ExecutionID: status.WipeScript.ExecutionID,
 					ExitCode:    1,
 				})
 				require.NoError(t, err)
+				assert.Equal(t, "wipe_ref", action)
 
 				status, err = ds.GetHostLockWipeStatus(ctx, &fleet.Host{ID: hostID, Platform: platform, UUID: "uuid"})
 				require.NoError(t, err)
@@ -1034,12 +1052,13 @@ func testLockUnlockWipeViaScripts(t *testing.T, ds *Datastore) {
 				checkLockWipeState(t, status, true, false, false, false, false, true)
 
 				// simulate a successful result for the wipe script execution
-				_, err = ds.SetHostScriptExecutionResult(ctx, &fleet.HostScriptResultPayload{
+				_, action, err = ds.SetHostScriptExecutionResult(ctx, &fleet.HostScriptResultPayload{
 					HostID:      hostID,
 					ExecutionID: status.WipeScript.ExecutionID,
 					ExitCode:    0,
 				})
 				require.NoError(t, err)
+				assert.Equal(t, "wipe_ref", action)
 
 				status, err = ds.GetHostLockWipeStatus(ctx, &fleet.Host{ID: hostID, Platform: platform, UUID: "uuid"})
 				require.NoError(t, err)
@@ -1138,6 +1157,8 @@ func testCleanupUnusedScriptContents(t *testing.T, ds *Datastore) {
 	s, err := ds.NewScript(ctx, s)
 	require.NoError(t, err)
 
+	user1 := test.NewUser(t, ds, "Bob", "bob@example.com", true)
+
 	// create a sync script execution
 	res, err := ds.NewHostScriptExecutionRequest(ctx, &fleet.HostScriptRequestPayload{ScriptContents: "echo something_else", SyncRequest: true})
 	require.NoError(t, err)
@@ -1145,6 +1166,7 @@ func testCleanupUnusedScriptContents(t *testing.T, ds *Datastore) {
 	// create a software install that references scripts
 	swi, err := ds.MatchOrCreateSoftwareInstaller(ctx, &fleet.UploadSoftwareInstallerPayload{
 		InstallScript:     "install-script",
+		UninstallScript:   "uninstall-script",
 		PreInstallQuery:   "SELECT 1",
 		PostInstallScript: "post-install-script",
 		InstallerFile:     bytes.NewReader([]byte("hello")),
@@ -1153,6 +1175,7 @@ func testCleanupUnusedScriptContents(t *testing.T, ds *Datastore) {
 		Title:             "file1",
 		Version:           "1.0",
 		Source:            "apps",
+		UserID:            user1.ID,
 	})
 	require.NoError(t, err)
 
@@ -1164,7 +1187,7 @@ func testCleanupUnusedScriptContents(t *testing.T, ds *Datastore) {
 	stmt := `SELECT id, HEX(md5_checksum) as md5_checksum FROM script_contents`
 	err = sqlx.SelectContext(ctx, ds.reader(ctx), &sc, stmt)
 	require.NoError(t, err)
-	require.Len(t, sc, 4)
+	require.Len(t, sc, 5)
 
 	// this should only remove the script_contents of the saved script, since the sync script is
 	// still "in use" by the script execution
@@ -1173,15 +1196,17 @@ func testCleanupUnusedScriptContents(t *testing.T, ds *Datastore) {
 	sc = []scriptContents{}
 	err = sqlx.SelectContext(ctx, ds.reader(ctx), &sc, stmt)
 	require.NoError(t, err)
-	require.Len(t, sc, 3)
+	require.Len(t, sc, 4)
 	require.ElementsMatch(t, []string{
 		md5ChecksumScriptContent(res.ScriptContents),
 		md5ChecksumScriptContent("install-script"),
 		md5ChecksumScriptContent("post-install-script"),
+		md5ChecksumScriptContent("uninstall-script"),
 	}, []string{
 		sc[0].Checksum,
 		sc[1].Checksum,
 		sc[2].Checksum,
+		sc[3].Checksum,
 	})
 
 	// remove the software installer from the DB
@@ -1201,12 +1226,14 @@ func testCleanupUnusedScriptContents(t *testing.T, ds *Datastore) {
 	swi, err = ds.MatchOrCreateSoftwareInstaller(ctx, &fleet.UploadSoftwareInstallerPayload{
 		PreInstallQuery: "SELECT 1",
 		InstallScript:   "install-script",
+		UninstallScript: "uninstall-script",
 		InstallerFile:   bytes.NewReader([]byte("hello")),
 		StorageID:       "storage1",
 		Filename:        "file1",
 		Title:           "file1",
 		Version:         "1.0",
 		Source:          "apps",
+		UserID:          user1.ID,
 	})
 	require.NoError(t, err)
 
@@ -1215,7 +1242,7 @@ func testCleanupUnusedScriptContents(t *testing.T, ds *Datastore) {
 	sc = []scriptContents{}
 	err = sqlx.SelectContext(ctx, ds.reader(ctx), &sc, stmt)
 	require.NoError(t, err)
-	require.Len(t, sc, 2)
+	require.Len(t, sc, 3)
 
 	// remove the software installer from the DB
 	err = ds.DeleteSoftwareInstaller(ctx, swi)
@@ -1229,3 +1256,15 @@ func testCleanupUnusedScriptContents(t *testing.T, ds *Datastore) {
 	require.Len(t, sc, 1)
 	require.Equal(t, md5ChecksumScriptContent(res.ScriptContents), sc[0].Checksum)
 }
+
+func testGetAnyScriptContents(t *testing.T, ds *Datastore) {
+	ctx := context.Background()
+	contents := `echo foobar;`
+	res, err := insertScriptContents(ctx, ds.writer(ctx), contents)
+	require.NoError(t, err)
+	id, _ := res.LastInsertId()
+
+	result, err := ds.GetAnyScriptContents(ctx, uint(id))
+	require.NoError(t, err)
+	require.Equal(t, contents, string(result))
+}
diff --git a/server/datastore/mysql/software.go b/server/datastore/mysql/software.go
index 76ab0da294..1c112c07c0 100644
--- a/server/datastore/mysql/software.go
+++ b/server/datastore/mysql/software.go
@@ -367,6 +367,10 @@ func (ds *Datastore) applyChangesForNewSoftwareDB(
 			}
 			r.Inserted = inserted
 
+			if err = checkForDeletedInstalledSoftware(ctx, tx, deleted, inserted, hostID); err != nil {
+				return err
+			}
+
 			if err = updateModifiedHostSoftwareDB(ctx, tx, hostID, current, incoming, ds.minLastOpenedAtDiff); err != nil {
 				return err
 			}
@@ -383,6 +387,76 @@ func (ds *Datastore) applyChangesForNewSoftwareDB(
 	return r, err
 }
 
+func checkForDeletedInstalledSoftware(ctx context.Context, tx sqlx.ExtContext, deleted []fleet.Software, inserted []fleet.Software,
+	hostID uint,
+) error {
+	// Between deleted and inserted software, check which software titles were deleted.
+	// If software titles were deleted, get the software titles of the installed software.
+	// See if deleted titles match installed software titles.
+	// If so, mark the installed software as removed.
+	var deletedTitles map[string]struct{}
+	if len(deleted) > 0 {
+		deletedTitles = make(map[string]struct{}, len(deleted))
+		for _, d := range deleted {
+			// We don't support installing browser plugins as of 2024/08/22
+			if d.Browser == "" {
+				deletedTitles[UniqueSoftwareTitleStr(d.Name, d.Source, d.BundleIdentifier)] = struct{}{}
+			}
+		}
+		for _, i := range inserted {
+			// We don't support installing browser plugins as of 2024/08/22
+			if i.Browser == "" {
+				key := UniqueSoftwareTitleStr(i.Name, i.Source, i.BundleIdentifier)
+				if _, ok := deletedTitles[key]; ok {
+					delete(deletedTitles, key)
+				}
+			}
+		}
+	}
+	if len(deletedTitles) > 0 {
+		installedTitles, err := getInstalledByFleetSoftwareTitles(ctx, tx, hostID)
+		if err != nil {
+			return err
+		}
+		type deletedValue struct {
+			vpp bool
+		}
+		deletedTitleIDs := make(map[uint]deletedValue, 0)
+		for _, title := range installedTitles {
+			bundleIdentifier := ""
+			if title.BundleIdentifier != nil {
+				bundleIdentifier = *title.BundleIdentifier
+			}
+			key := UniqueSoftwareTitleStr(title.Name, title.Source, bundleIdentifier)
+			if _, ok := deletedTitles[key]; ok {
+				deletedTitleIDs[title.ID] = deletedValue{vpp: title.VPPAppsCount > 0}
+			}
+		}
+		if len(deletedTitleIDs) > 0 {
+			IDs := make([]uint, 0, len(deletedTitleIDs))
+			vppIDs := make([]uint, 0, len(deletedTitleIDs))
+			for id, value := range deletedTitleIDs {
+				if value.vpp {
+					vppIDs = append(vppIDs, id)
+				} else {
+					IDs = append(IDs, id)
+				}
+			}
+			if len(IDs) > 0 {
+				if err = markHostSoftwareInstallsRemoved(ctx, tx, hostID, IDs); err != nil {
+					return err
+				}
+			}
+			if len(vppIDs) > 0 {
+				if err = markHostVPPSoftwareInstallsRemoved(ctx, tx, hostID, vppIDs); err != nil {
+					return err
+				}
+			}
+		}
+	}
+	return nil
+}
+
 func (ds *Datastore) getExistingSoftware(
 	ctx context.Context, current map[string]fleet.Software, incoming map[string]fleet.Software,
 ) (
@@ -640,7 +714,7 @@ func (ds *Datastore) insertNewInstalledHostSoftwareDB(
 				      UPDATE software s
 				      JOIN software_titles st
 				      ON s.bundle_identifier = st.bundle_identifier AND
-				          IF(s.source IN ('ios_apps', 'ipados_apps'), s.source = st.source, 1)
+				          IF(s.source IN ('apps', 'ios_apps', 'ipados_apps'), s.source = st.source, 1)
 				      SET s.title_id = st.id
 				      WHERE s.title_id IS NULL
 				      OR s.title_id != st.id
@@ -979,19 +1053,46 @@ func selectSoftwareSQL(opts fleet.SoftwareListOptions) (string, []interface{}, e
 	}
 
 	if opts.IncludeCVEScores {
-		ds = ds.
-			LeftJoin(
+
+		baseJoinConditions := goqu.Ex{
+			"c.cve": goqu.I("scv.cve"),
+		}
+
+		if opts.KnownExploit || opts.MinimumCVSS > 0 || opts.MaximumCVSS > 0 {
+
+			if opts.KnownExploit {
+				baseJoinConditions["c.cisa_known_exploit"] = true
+			}
+
+			if opts.MinimumCVSS > 0 {
+				baseJoinConditions["c.cvss_score"] = goqu.Op{"gte": opts.MinimumCVSS}
+			}
+
+			if opts.MaximumCVSS > 0 {
+				baseJoinConditions["c.cvss_score"] = goqu.Op{"lte": opts.MaximumCVSS}
+			}
+
+			ds = ds.InnerJoin(
 				goqu.I("cve_meta").As("c"),
-				goqu.On(goqu.I("c.cve").Eq(goqu.I("scv.cve"))),
-			).
-			SelectAppend(
-				goqu.MAX("c.cvss_score").As("cvss_score"),                     // for ordering
-				goqu.MAX("c.epss_probability").As("epss_probability"),         // for ordering
-				goqu.MAX("c.cisa_known_exploit").As("cisa_known_exploit"),     // for ordering
-				goqu.MAX("c.published").As("cve_published"),                   // for ordering
-				goqu.MAX("c.description").As("description"),                   // for ordering
-				goqu.MAX("scv.resolved_in_version").As("resolved_in_version"), // for ordering
+				goqu.On(baseJoinConditions),
 			)
+
+		} else {
+			ds = ds.
+				LeftJoin(
+					goqu.I("cve_meta").As("c"),
+					goqu.On(baseJoinConditions),
+				)
+		}
+
+		ds = ds.SelectAppend(
+			goqu.MAX("c.cvss_score").As("cvss_score"),                     // for ordering
+			goqu.MAX("c.epss_probability").As("epss_probability"),         // for ordering
+			goqu.MAX("c.cisa_known_exploit").As("cisa_known_exploit"),     // for ordering
+			goqu.MAX("c.published").As("cve_published"),                   // for ordering
+			goqu.MAX("c.description").As("description"),                   // for ordering
+			goqu.MAX("scv.resolved_in_version").As("resolved_in_version"), // for ordering
+		)
 	}
 
 	if match := opts.ListOptions.MatchQuery; match != "" {
@@ -1294,6 +1395,12 @@ func (ds *Datastore) ListSoftwareCPEs(ctx context.Context) ([]fleet.SoftwareCPE,
 }
 
 func (ds *Datastore) ListSoftware(ctx context.Context, opt fleet.SoftwareListOptions) ([]fleet.Software, *fleet.PaginationMetadata, error) {
+	if !opt.VulnerableOnly && (opt.MinimumCVSS > 0 || opt.MaximumCVSS > 0 || opt.KnownExploit) {
+		return nil, nil, fleet.NewInvalidArgumentError(
+			"query", "min_cvss_score, max_cvss_score, and exploit can only be provided with vulnerable=true",
+		)
+	}
+
 	software, err := listSoftwareDB(ctx, ds.reader(ctx), opt)
 	if err != nil {
 		return nil, nil, err
@@ -1429,8 +1536,6 @@ func (ds *Datastore) SoftwareByID(ctx context.Context, id uint, teamID *uint, in
 		return nil, err
 	}
 
-	fmt.Println(sql, args)
-
 	var results []softwareCVE
 	err = sqlx.SelectContext(ctx, ds.reader(ctx), &results, sql, args...)
 	if err != nil {
@@ -1667,7 +1772,7 @@ FROM (
         NOT EXISTS (
             SELECT 1 FROM software_titles st
             WHERE s.bundle_identifier = st.bundle_identifier AND
-				IF(s.source IN ('ios_apps', 'ipados_apps'), s.source = st.source, 1)
+				IF(s.source IN ('apps', 'ios_apps', 'ipados_apps'), s.source = st.source, 1)
         )
         AND COALESCE(bundle_identifier, '') != ''
 
@@ -1718,7 +1823,7 @@ AND COALESCE(s.bundle_identifier, '') = '';
 UPDATE software s
 JOIN software_titles st
 ON s.bundle_identifier = st.bundle_identifier AND
-    IF(s.source IN ('ios_apps', 'ipados_apps'), s.source = st.source, 1)
+    IF(s.source IN ('apps', 'ios_apps', 'ipados_apps'), s.source = st.source, 1)
 SET s.title_id = st.id
 WHERE s.title_id IS NULL
 OR s.title_id != st.id;
@@ -1916,7 +2021,7 @@ func (ds *Datastore) InsertSoftwareVulnerability(
 		return false, ctxerr.Wrap(ctx, err, "insert software vulnerability")
 	}
 
-	return insertOnDuplicateDidInsert(res), nil
+	return insertOnDuplicateDidInsertOrUpdate(res), nil
 }
 
 func (ds *Datastore) ListSoftwareVulnerabilitiesByHostIDsSource(
@@ -2051,56 +2156,38 @@ func (ds *Datastore) ListCVEs(ctx context.Context, maxAge time.Duration) ([]flee
 	return result, nil
 }
 
-// tblAlias is the table alias to use as prefix for the host_software_installs
-// column names, no prefix used if empty.
-// colAlias is the name to be assigned to the computed status column, pass
-// empty to have the value only, no column alias set.
-func softwareInstallerHostStatusNamedQuery(tblAlias, colAlias string) string {
-	if tblAlias != "" {
-		tblAlias += "."
-	}
-	if colAlias != "" {
-		colAlias = " AS " + colAlias
-	}
-	// the computed column assumes that all results (pre, install and post) are
-	// stored at once, so that if there is an exit code for the install script
-	// and none for the post-install, it is because there is no post-install.
-	return fmt.Sprintf(`
-			CASE
-				WHEN %[1]spost_install_script_exit_code IS NOT NULL AND
-					%[1]spost_install_script_exit_code = 0 THEN :software_status_installed
-
-				WHEN %[1]spost_install_script_exit_code IS NOT NULL AND
-					%[1]spost_install_script_exit_code != 0 THEN :software_status_failed
-
-				WHEN %[1]sinstall_script_exit_code IS NOT NULL AND
-					%[1]sinstall_script_exit_code = 0 THEN :software_status_installed
-
-				WHEN %[1]sinstall_script_exit_code IS NOT NULL AND
-					%[1]sinstall_script_exit_code != 0 THEN :software_status_failed
-
-				WHEN %[1]spre_install_query_output IS NOT NULL AND
-					%[1]spre_install_query_output = '' THEN :software_status_failed
-
-				WHEN %[1]shost_id IS NOT NULL THEN :software_status_pending
-
-				ELSE NULL -- not installed from Fleet installer
-			END %[2]s `, tblAlias, colAlias)
-}
-
 func (ds *Datastore) ListHostSoftware(ctx context.Context, host *fleet.Host, opts fleet.HostSoftwareTitleListOptions) ([]*fleet.HostSoftwareWithInstaller, *fleet.PaginationMetadata, error) {
 	var onlySelfServiceClause string
 	if opts.SelfServiceOnly {
-		onlySelfServiceClause = ` AND si.self_service = 1 `
+		onlySelfServiceClause = ` AND ( si.self_service = 1 OR vat.self_service = 1 ) `
 	}
 
-	var onlyVulnerableClause string
+	var onlyVulnerableJoin string
 	if opts.VulnerableOnly {
-		onlyVulnerableClause = `
-AND EXISTS (SELECT 1 FROM software s JOIN software_cve scve ON scve.software_id = s.id WHERE s.title_id = st.id)
+		onlyVulnerableJoin = `
+INNER JOIN software_cve scve ON scve.software_id = s.id
 		`
 	}
 
+	softwareIsInstalledOnHostClause := fmt.Sprintf(`
+			EXISTS (
+				SELECT 1
+				FROM
+					host_software hs
+				INNER JOIN
+					software s ON hs.software_id = s.id
+					%s
+				WHERE
+					hs.host_id = :host_id AND
+					s.title_id = st.id
+			) OR `, onlyVulnerableJoin)
+	status := fmt.Sprintf(`COALESCE(%s, %s)`, "hsi.last_status", vppAppHostStatusNamedQuery("hvsi", "ncr", ""))
+	if opts.OnlyAvailableForInstall {
+		// Get software that has a package/VPP installer but was not installed with Fleet
+		softwareIsInstalledOnHostClause = fmt.Sprintf(` %s IS NULL AND (si.id IS NOT NULL OR vat.adam_id IS NOT NULL) AND %s`, status,
+			softwareIsInstalledOnHostClause)
+	}
+
 	// this statement lists only the software that is reported as installed on
 	// the host or has been attempted to be installed on the host.
 	stmtInstalled := fmt.Sprintf(`
@@ -2111,57 +2198,91 @@ AND EXISTS (SELECT 1 FROM software s JOIN software_cve scve ON scve.software_id
 			si.self_service as package_self_service,
 			si.filename as package_name,
 			si.version as package_version,
-			-- in a future iteration, will be supported for VPP apps
-			NULL as vpp_app_self_service,
-			vap.adam_id as vpp_app_adam_id,
+			vat.self_service as vpp_app_self_service,
+			vat.adam_id as vpp_app_adam_id,
 			vap.latest_version as vpp_app_version,
 			NULLIF(vap.icon_url, '') as vpp_app_icon_url,
-			COALESCE(hsi.created_at, hvsi.created_at) as last_install_installed_at,
-			COALESCE(hsi.execution_id, hvsi.command_uuid) as last_install_install_uuid,
-			-- get either the softare installer status or the vpp app status
-			COALESCE(%s, %s) as status
+			COALESCE(hsi.last_installed_at, hvsi.created_at) as last_install_installed_at,
+			COALESCE(hsi.last_install_execution_id, hvsi.command_uuid) as last_install_install_uuid,
+			hsi.last_uninstalled_at as last_uninstall_uninstalled_at,
+			hsi.last_uninstall_execution_id as last_uninstall_script_execution_id,
+			-- get either the software installer status or the vpp app status
+			%s as status
 		FROM
 			software_titles st
 		LEFT OUTER JOIN
-			software_installers si ON st.id = si.title_id
+			software_installers si ON st.id = si.title_id AND si.global_or_team_id = :global_or_team_id
+		LEFT OUTER JOIN -- get the latest status and install/uninstall attempts (merge 3 host_software_installs rows into 1)
+			(
+				SELECT
+					hsi_group.host_id,
+					hsi_group.software_installer_id,
+					TIMESTAMP(GROUP_CONCAT(hsi_installed_at)) as last_installed_at,
+					GROUP_CONCAT(hsi_install_execution_id) as last_install_execution_id,
+					TIMESTAMP(GROUP_CONCAT(hsi_uninstalled_at)) as last_uninstalled_at,
+					GROUP_CONCAT(hsi_uninstall_execution_id) as last_uninstall_execution_id,
+					IF(GROUP_CONCAT(hsi_status) = '', NULL, GROUP_CONCAT(hsi_status)) as last_status
+				FROM (
+					-- get latest install/uninstall status
+					SELECT
+						host_id, software_installer_id,
+						NULL as hsi_installed_at, NULL as hsi_install_execution_id,
+						NULL as hsi_uninstalled_at, NULL as hsi_uninstall_execution_id,
+						-- get the status of the latest attempt; 27-1 is the length of the timestamp
+					    SUBSTRING(MAX(CONCAT(created_at, COALESCE(status, ''))), 27) AS hsi_status
+					FROM host_software_installs
+					WHERE host_id = :host_id AND removed = 0
+					GROUP BY host_id, software_installer_id
+					UNION
+					-- get latest install attempt
+					SELECT
+						host_id, software_installer_id,
+						MAX(created_at) as hsi_installed_at,
+						-- get the execution_id of the latest attempt; 27-1 is the length of the timestamp
+					    SUBSTRING(MAX(CONCAT(created_at, execution_id)), 27) AS hsi_install_execution_id,
+						NULL as hsi_uninstalled_at, NULL as hsi_uninstall_execution_id,
+						NULL as hsi_status
+					FROM host_software_installs
+					WHERE host_id = :host_id AND removed = 0 AND uninstall = 0
+					GROUP BY host_id, software_installer_id
+					UNION
+					-- get latest uninstall attempt
+					SELECT
+						host_id, software_installer_id,
+						NULL as hsi_installed_at, NULL as hsi_install_execution_id,
+						MAX(created_at) as hsi_uninstalled_at,
+						-- get the execution_id of the latest attempt; 27-1 is the length of the timestamp
+					    SUBSTRING(MAX(CONCAT(created_at, execution_id)), 27) AS hsi_uninstall_execution_id,
+						NULL as hsi_status
+						FROM host_software_installs
+					WHERE host_id = :host_id AND removed = 0 AND uninstall = 1
+					GROUP BY host_id, software_installer_id
+				) as hsi_group
+				GROUP BY hsi_group.host_id, hsi_group.software_installer_id
+			) as hsi ON si.id = hsi.software_installer_id
 		LEFT OUTER JOIN
-			host_software_installs hsi ON si.id = hsi.software_installer_id AND hsi.host_id = :host_id
+			vpp_apps vap ON st.id = vap.title_id AND vap.platform = :host_platform
 		LEFT OUTER JOIN
-			vpp_apps vap ON st.id = vap.title_id
+			vpp_apps_teams vat ON vap.adam_id = vat.adam_id AND vap.platform = vat.platform AND vat.global_or_team_id = :global_or_team_id
 		LEFT OUTER JOIN
-			host_vpp_software_installs hvsi ON vap.adam_id = hvsi.adam_id AND vap.platform = hvsi.platform AND hvsi.host_id = :host_id
+			host_vpp_software_installs hvsi ON vat.adam_id = hvsi.adam_id AND hvsi.host_id = :host_id AND hvsi.removed = 0
 		LEFT OUTER JOIN
 			nano_command_results ncr ON ncr.command_uuid = hvsi.command_uuid
 		WHERE
-			-- use the latest install only
-			( hsi.id IS NULL OR hsi.id = (
-				SELECT hsi2.id
-				FROM host_software_installs hsi2
-				WHERE hsi2.host_id = hsi.host_id AND hsi2.software_installer_id = hsi.software_installer_id
-				ORDER BY hsi2.created_at DESC
-				LIMIT 1 ) ) AND
+			-- use the latest VPP install attempt only
 			( hvsi.id IS NULL OR hvsi.id = (
 				SELECT hvsi2.id
 				FROM host_vpp_software_installs hvsi2
-				WHERE hvsi2.host_id = hvsi.host_id AND hvsi2.adam_id = hvsi.adam_id AND hvsi2.platform = hvsi.platform
+				WHERE hvsi2.host_id = hvsi.host_id AND hvsi2.adam_id = hvsi.adam_id AND hvsi2.platform = hvsi.platform AND hvsi2.removed = 0
 				ORDER BY hvsi2.created_at DESC
 				LIMIT 1 ) ) AND
-			-- software is installed on host
-			( EXISTS (
-				SELECT 1
-				FROM
-					host_software hs
-				INNER JOIN
-					software s ON hs.software_id = s.id
-				WHERE
-					hs.host_id = :host_id AND
-					s.title_id = st.id
-			) OR
-			-- or software install has been attempted on host (via installer or VPP app)
-			hsi.host_id IS NOT NULL OR hvsi.host_id IS NOT NULL )
+
+			-- software is installed on host or software install has been attempted
+			-- on host (via installer or VPP app). If only available for install is
+			-- requested, then the software installed on host clause is empty.
+			( %s hsi.host_id IS NOT NULL OR hvsi.host_id IS NOT NULL )
 			%s
-			%s
-`, softwareInstallerHostStatusNamedQuery("hsi", ""), vppAppHostStatusNamedQuery("hvsi", "ncr", ""), onlySelfServiceClause, onlyVulnerableClause)
+`, status, softwareIsInstalledOnHostClause, onlySelfServiceClause)
 
 	// this statement lists only the software that has never been installed nor
 	// attempted to be installed on the host, but that is available to be
@@ -2174,13 +2295,14 @@ AND EXISTS (SELECT 1 FROM software s JOIN software_cve scve ON scve.software_id
 			si.self_service as package_self_service,
 			si.filename as package_name,
 			si.version as package_version,
-			-- in a future iteration, will be supported for VPP apps
-			NULL as vpp_app_self_service,
-			vap.adam_id as vpp_app_adam_id,
+			vat.self_service as vpp_app_self_service,
+			vat.adam_id as vpp_app_adam_id,
 			vap.latest_version as vpp_app_version,
 			NULLIF(vap.icon_url, '') as vpp_app_icon_url,
 			NULL as last_install_installed_at,
 			NULL as last_install_install_uuid,
+			NULL as last_uninstall_uninstalled_at,
+			NULL as last_uninstall_script_execution_id,
 			NULL as status
 		FROM
 			software_titles st
@@ -2211,7 +2333,8 @@ AND EXISTS (SELECT 1 FROM software s JOIN software_cve scve ON scve.software_id
 					host_software_installs hsi
 				WHERE
 					hsi.host_id = :host_id AND
-					hsi.software_installer_id = si.id
+					hsi.software_installer_id = si.id AND
+					hsi.removed = 0
 			) AND
 			NOT EXISTS (
 				SELECT 1
@@ -2219,7 +2342,8 @@ AND EXISTS (SELECT 1 FROM software s JOIN software_cve scve ON scve.software_id
 					host_vpp_software_installs hvsi
 				WHERE
 					hvsi.host_id = :host_id AND
-					hvsi.adam_id = vat.adam_id
+					hvsi.adam_id = vat.adam_id AND
+					hvsi.removed = 0
 			) AND
 			-- either the software installer or the vpp app exists for the host's team
 			( si.id IS NOT NULL OR vat.platform = :host_platform )
@@ -2242,6 +2366,8 @@ AND EXISTS (SELECT 1 FROM software s JOIN software_cve scve ON scve.software_id
 		vpp_app_icon_url,
 		last_install_installed_at,
 		last_install_install_uuid,
+		last_uninstall_uninstalled_at,
+		last_uninstall_script_execution_id,
 		status
 `
 
@@ -2252,9 +2378,9 @@ AND EXISTS (SELECT 1 FROM software s JOIN software_cve scve ON scve.software_id
 	namedArgs := map[string]any{
 		"host_id":                   host.ID,
 		"host_platform":             host.FleetPlatform(),
-		"software_status_failed":    fleet.SoftwareInstallerFailed,
-		"software_status_pending":   fleet.SoftwareInstallerPending,
-		"software_status_installed": fleet.SoftwareInstallerInstalled,
+		"software_status_failed":    fleet.SoftwareInstallFailed,
+		"software_status_pending":   fleet.SoftwareInstallPending,
+		"software_status_installed": fleet.SoftwareInstalled,
 		"mdm_status_acknowledged":   fleet.MDMAppleStatusAcknowledged,
 		"mdm_status_error":          fleet.MDMAppleStatusError,
 		"mdm_status_format_error":   fleet.MDMAppleStatusCommandFormatError,
@@ -2262,20 +2388,14 @@ AND EXISTS (SELECT 1 FROM software s JOIN software_cve scve ON scve.software_id
 	}
 
 	stmt := stmtInstalled
-	if opts.AvailableForInstall || (opts.IncludeAvailableForInstall && !opts.VulnerableOnly) {
-		namedArgs["vpp_apps_platforms"] = []fleet.AppleDevicePlatform{fleet.IOSPlatform, fleet.IPadOSPlatform, fleet.MacOSPlatform}
+	if opts.OnlyAvailableForInstall || (opts.IncludeAvailableForInstall && !opts.VulnerableOnly) {
+		namedArgs["vpp_apps_platforms"] = fleet.VPPAppsPlatforms
 		if fleet.IsLinux(host.Platform) {
 			namedArgs["host_compatible_platforms"] = fleet.HostLinuxOSs
 		} else {
 			namedArgs["host_compatible_platforms"] = []string{host.FleetPlatform()}
 		}
-		if opts.AvailableForInstall {
-			// Only available for install software
-			stmt = stmtAvailable
-		} else {
-			// All software, including available for install
-			stmt += ` UNION ` + stmtAvailable
-		}
+		stmt += ` UNION ` + stmtAvailable
 	}
 
 	// must resolve the named bindings here, before adding the searchLike which
@@ -2308,15 +2428,17 @@ AND EXISTS (SELECT 1 FROM software s JOIN software_cve scve ON scve.software_id
 
 	type hostSoftware struct {
 		fleet.HostSoftwareWithInstaller
-		LastInstallInstalledAt *time.Time `db:"last_install_installed_at"`
-		LastInstallInstallUUID *string    `db:"last_install_install_uuid"`
-		PackageSelfService     *bool      `db:"package_self_service"`
-		PackageName            *string    `db:"package_name"`
-		PackageVersion         *string    `db:"package_version"`
-		VPPAppSelfService      *bool      `db:"vpp_app_self_service"`
-		VPPAppAdamID           *string    `db:"vpp_app_adam_id"`
-		VPPAppVersion          *string    `db:"vpp_app_version"`
-		VPPAppIconURL          *string    `db:"vpp_app_icon_url"`
+		LastInstallInstalledAt         *time.Time `db:"last_install_installed_at"`
+		LastInstallInstallUUID         *string    `db:"last_install_install_uuid"`
+		LastUninstallUninstalledAt     *time.Time `db:"last_uninstall_uninstalled_at"`
+		LastUninstallScriptExecutionID *string    `db:"last_uninstall_script_execution_id"`
+		PackageSelfService             *bool      `db:"package_self_service"`
+		PackageName                    *string    `db:"package_name"`
+		PackageVersion                 *string    `db:"package_version"`
+		VPPAppSelfService              *bool      `db:"vpp_app_self_service"`
+		VPPAppAdamID                   *string    `db:"vpp_app_adam_id"`
+		VPPAppVersion                  *string    `db:"vpp_app_version"`
+		VPPAppIconURL                  *string    `db:"vpp_app_icon_url"`
 	}
 	var hostSoftwareList []*hostSoftware
 	if err := sqlx.SelectContext(ctx, ds.reader(ctx), &hostSoftwareList, stmt, args...); err != nil {
@@ -2350,6 +2472,16 @@ AND EXISTS (SELECT 1 FROM software s JOIN software_cve scve ON scve.software_id
 					hs.SoftwarePackage.LastInstall.InstalledAt = *hs.LastInstallInstalledAt
 				}
 			}
+
+			// promote the last uninstall info to the proper destination fields
+			if hs.LastUninstallScriptExecutionID != nil && *hs.LastUninstallScriptExecutionID != "" {
+				hs.SoftwarePackage.LastUninstall = &fleet.HostSoftwareUninstall{
+					ExecutionID: *hs.LastUninstallScriptExecutionID,
+				}
+				if hs.LastUninstallUninstalledAt != nil {
+					hs.SoftwarePackage.LastUninstall.UninstalledAt = *hs.LastUninstallUninstalledAt
+				}
+			}
 		}
 
 		// promote the VPP app id and version to the proper destination fields
@@ -2544,3 +2676,85 @@ func (ds *Datastore) SetHostSoftwareInstallResult(ctx context.Context, result *f
 	}
 	return nil
 }
+
+func getInstalledByFleetSoftwareTitles(ctx context.Context, qc sqlx.QueryerContext, hostID uint) ([]fleet.SoftwareTitle, error) {
+	// We are overloading vpp_apps_count to indicate whether installed title is a VPP app or not.
+	const stmt = `
+SELECT
+	st.id,
+	st.name,
+	st.source,
+	st.browser,
+	st.bundle_identifier,
+	0 as vpp_apps_count
+FROM software_titles st
+INNER JOIN software_installers si ON si.title_id = st.id
+INNER JOIN host_software_installs hsi ON hsi.host_id = :host_id AND hsi.software_installer_id = si.id
+WHERE hsi.removed = 0 AND hsi.status = :software_status_installed
+
+UNION
+
+SELECT
+	st.id,
+	st.name,
+	st.source,
+	st.browser,
+	st.bundle_identifier,
+	1 as vpp_apps_count
+FROM software_titles st
+INNER JOIN vpp_apps vap ON vap.title_id = st.id
+INNER JOIN host_vpp_software_installs hvsi ON hvsi.host_id = :host_id AND hvsi.adam_id = vap.adam_id AND hvsi.platform = vap.platform
+INNER JOIN nano_command_results ncr ON ncr.command_uuid = hvsi.command_uuid
+WHERE hvsi.removed = 0 AND ncr.status = :mdm_status_acknowledged
+`
+	selectStmt, args, err := sqlx.Named(stmt, map[string]interface{}{
+		"host_id":                   hostID,
+		"software_status_installed": fleet.SoftwareInstalled,
+		"mdm_status_acknowledged":   fleet.MDMAppleStatusAcknowledged,
+	})
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "build query to get installed software titles")
+	}
+
+	var titles []fleet.SoftwareTitle
+	if err := sqlx.SelectContext(ctx, qc, &titles, selectStmt, args...); err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "get installed software titles")
+	}
+	return titles, nil
+}
+
+func markHostSoftwareInstallsRemoved(ctx context.Context, ex sqlx.ExtContext, hostID uint, titleIDs []uint) error {
+	const stmt = `
+UPDATE host_software_installs hsi
+INNER JOIN software_installers si ON hsi.software_installer_id = si.id
+INNER JOIN software_titles st ON si.title_id = st.id
+SET hsi.removed = 1
+WHERE hsi.host_id = ? AND st.id IN (?)
+`
+	stmtExpanded, args, err := sqlx.In(stmt, hostID, titleIDs)
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "build query args to mark host software install removed")
+	}
+	if _, err := ex.ExecContext(ctx, stmtExpanded, args...); err != nil {
+		return ctxerr.Wrap(ctx, err, "mark host software install removed")
+	}
+	return nil
+}
+
+func markHostVPPSoftwareInstallsRemoved(ctx context.Context, ex sqlx.ExtContext, hostID uint, titleIDs []uint) error {
+	const stmt = `
+UPDATE host_vpp_software_installs hvsi
+INNER JOIN vpp_apps vap ON hvsi.adam_id = vap.adam_id AND hvsi.platform = vap.platform
+INNER JOIN software_titles st ON vap.title_id = st.id
+SET hvsi.removed = 1
+WHERE hvsi.host_id = ? AND st.id IN (?)
+`
+	stmtExpanded, args, err := sqlx.In(stmt, hostID, titleIDs)
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "build query args to mark host vpp software install removed")
+	}
+	if _, err := ex.ExecContext(ctx, stmtExpanded, args...); err != nil {
+		return ctxerr.Wrap(ctx, err, "mark host vpp software install removed")
+	}
+	return nil
+}
diff --git a/server/datastore/mysql/software_installers.go b/server/datastore/mysql/software_installers.go
index c491d38139..7d7f0169e3 100644
--- a/server/datastore/mysql/software_installers.go
+++ b/server/datastore/mysql/software_installers.go
@@ -6,6 +6,7 @@ import (
 	"errors"
 	"fmt"
 	"strings"
+	"time"
 
 	"github.com/fleetdm/fleet/v4/server/authz"
 	"github.com/fleetdm/fleet/v4/server/contexts/ctxerr"
@@ -23,14 +24,12 @@ func (ds *Datastore) ListPendingSoftwareInstalls(ctx context.Context, hostID uin
   WHERE
     host_id = ?
   AND
-    install_script_exit_code IS NULL
-  AND
-    pre_install_query_output IS NULL
+	status = ?
   ORDER BY
     created_at ASC
 `
 	var results []string
-	if err := sqlx.SelectContext(ctx, ds.reader(ctx), &results, stmt, hostID); err != nil {
+	if err := sqlx.SelectContext(ctx, ds.reader(ctx), &results, stmt, hostID, fleet.SoftwareInstallPending); err != nil {
 		return nil, ctxerr.Wrap(ctx, err, "list pending software installs")
 	}
 	return results, nil
@@ -45,6 +44,7 @@ func (ds *Datastore) GetSoftwareInstallDetails(ctx context.Context, executionId
     hsi.self_service AS self_service,
     COALESCE(si.pre_install_query, '') AS pre_install_condition,
     inst.contents AS install_script,
+    uninst.contents AS uninstall_script,
     COALESCE(pisnt.contents, '') AS post_install_script
   FROM
     host_software_installs hsi
@@ -54,6 +54,9 @@ func (ds *Datastore) GetSoftwareInstallDetails(ctx context.Context, executionId
   LEFT OUTER JOIN
     script_contents inst
     ON inst.id = si.install_script_content_id
+  LEFT OUTER JOIN
+    script_contents uninst
+    ON uninst.id = si.uninstall_script_content_id
   LEFT OUTER JOIN
     script_contents pisnt
     ON pisnt.id = si.post_install_script_content_id
@@ -85,6 +88,11 @@ func (ds *Datastore) MatchOrCreateSoftwareInstaller(ctx context.Context, payload
 		return 0, ctxerr.Wrap(ctx, err, "get or generate install script contents ID")
 	}
 
+	uninstallScriptID, err := ds.getOrGenerateScriptContentsID(ctx, payload.UninstallScript)
+	if err != nil {
+		return 0, ctxerr.Wrap(ctx, err, "get or generate uninstall script contents ID")
+	}
+
 	var postInstallScriptID *uint
 	if payload.PostInstallScript != "" {
 		sid, err := ds.getOrGenerateScriptContentsID(ctx, payload.PostInstallScript)
@@ -111,13 +119,19 @@ INSERT INTO software_installers (
 	title_id,
 	storage_id,
 	filename,
+	extension,
 	version,
+	package_ids,
 	install_script_content_id,
 	pre_install_query,
 	post_install_script_content_id,
+    uninstall_script_content_id,
 	platform,
-    self_service
-) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+    self_service,
+	user_id,
+	user_name,
+	user_email
+) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, (SELECT name FROM users WHERE id = ?), (SELECT email FROM users WHERE id = ?))`
 
 	args := []interface{}{
 		tid,
@@ -125,12 +139,18 @@ INSERT INTO software_installers (
 		titleID,
 		payload.StorageID,
 		payload.Filename,
+		payload.Extension,
 		payload.Version,
+		strings.Join(payload.PackageIDs, ","),
 		installScriptID,
 		payload.PreInstallQuery,
 		postInstallScriptID,
+		uninstallScriptID,
 		payload.Platform,
 		payload.SelfService,
+		payload.UserID,
+		payload.UserID,
+		payload.UserID,
 	}
 
 	res, err := ds.writer(ctx).ExecContext(ctx, stmt, args...)
@@ -196,6 +216,106 @@ func (ds *Datastore) addSoftwareTitleToMatchingSoftware(ctx context.Context, tit
 	return ctxerr.Wrap(ctx, err, "adding fk reference in software to software_titles")
 }
 
+func (ds *Datastore) UpdateInstallerSelfServiceFlag(ctx context.Context, selfService bool, id uint) error {
+	_, err := ds.writer(ctx).ExecContext(ctx, `UPDATE software_installers SET self_service = ? WHERE id = ?`, selfService, id)
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "update software installer")
+	}
+
+	return nil
+}
+
+func (ds *Datastore) SaveInstallerUpdates(ctx context.Context, payload *fleet.UpdateSoftwareInstallerPayload) error {
+	if payload.InstallScript == nil || payload.UninstallScript == nil || payload.PreInstallQuery == nil || payload.SelfService == nil {
+		return ctxerr.Wrap(ctx, errors.New("missing installer update payload fields"), "update installer record")
+	}
+
+	installScriptID, err := ds.getOrGenerateScriptContentsID(ctx, *payload.InstallScript)
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "get or generate install script contents ID")
+	}
+
+	uninstallScriptID, err := ds.getOrGenerateScriptContentsID(ctx, *payload.UninstallScript)
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "get or generate uninstall script contents ID")
+	}
+
+	var postInstallScriptID *uint
+	if payload.PostInstallScript != nil && *payload.PostInstallScript != "" { // pointer because optional
+		sid, err := ds.getOrGenerateScriptContentsID(ctx, *payload.PostInstallScript)
+		if err != nil {
+			return ctxerr.Wrap(ctx, err, "get or generate post-install script contents ID")
+		}
+		postInstallScriptID = &sid
+	}
+
+	touchUploaded := ""
+	if payload.InstallerFile != nil {
+		touchUploaded = ", uploaded_at = NOW()"
+	}
+
+	stmt := fmt.Sprintf(`UPDATE software_installers SET
+	storage_id = ?,
+	filename = ?,
+	version = ?,
+	package_ids = ?,
+	install_script_content_id = ?,
+	pre_install_query = ?,
+	post_install_script_content_id = ?,
+    uninstall_script_content_id = ?,
+    self_service = ?,
+	user_id = ?,
+	user_name = (SELECT name FROM users WHERE id = ?),
+	user_email = (SELECT email FROM users WHERE id = ?) %s
+	WHERE id = ?`, touchUploaded)
+
+	args := []interface{}{
+		payload.StorageID,
+		payload.Filename,
+		payload.Version,
+		strings.Join(payload.PackageIDs, ","),
+		installScriptID,
+		*payload.PreInstallQuery,
+		postInstallScriptID,
+		uninstallScriptID,
+		*payload.SelfService,
+		payload.UserID,
+		payload.UserID,
+		payload.UserID,
+		payload.InstallerID,
+	}
+
+	_, err = ds.writer(ctx).ExecContext(ctx, stmt, args...)
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "update software installer")
+	}
+
+	return nil
+}
+
+func (ds *Datastore) ValidateOrbitSoftwareInstallerAccess(ctx context.Context, hostID uint, installerID uint) (bool, error) {
+	query := `
+    SELECT 1
+    FROM
+      host_software_installs
+    WHERE
+      software_installer_id = ?
+    AND
+      host_id = ?
+    AND
+      install_script_exit_code IS NULL
+`
+	var access bool
+	err := sqlx.GetContext(ctx, ds.reader(ctx), &access, query, installerID, hostID)
+	if err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			return false, nil
+		}
+		return false, ctxerr.Wrap(ctx, err, "check software installer association to host")
+	}
+	return true, nil
+}
+
 func (ds *Datastore) GetSoftwareInstallerMetadataByID(ctx context.Context, id uint) (*fleet.SoftwareInstaller, error) {
 	query := `
 SELECT
@@ -203,13 +323,17 @@ SELECT
 	si.team_id,
 	si.title_id,
 	si.storage_id,
+	si.package_ids,
 	si.filename,
+	si.extension,
 	si.version,
 	si.install_script_content_id,
 	si.pre_install_query,
 	si.post_install_script_content_id,
+	si.uninstall_script_content_id,
 	si.uploaded_at,
-	COALESCE(st.name, '') AS software_title
+	COALESCE(st.name, '') AS software_title,
+	si.platform
 FROM
 	software_installers si
 	LEFT OUTER JOIN software_titles st ON st.id = si.title_id
@@ -231,9 +355,10 @@ WHERE
 func (ds *Datastore) GetSoftwareInstallerMetadataByTeamAndTitleID(ctx context.Context, teamID *uint, titleID uint, withScriptContents bool) (*fleet.SoftwareInstaller, error) {
 	var scriptContentsSelect, scriptContentsFrom string
 	if withScriptContents {
-		scriptContentsSelect = ` , inst.contents AS install_script, COALESCE(pisnt.contents, '') AS post_install_script `
+		scriptContentsSelect = ` , inst.contents AS install_script, COALESCE(pinst.contents, '') AS post_install_script, uninst.contents AS uninstall_script `
 		scriptContentsFrom = ` LEFT OUTER JOIN script_contents inst ON inst.id = si.install_script_content_id
-		LEFT OUTER JOIN script_contents pisnt ON pisnt.id = si.post_install_script_content_id `
+		LEFT OUTER JOIN script_contents pinst ON pinst.id = si.post_install_script_content_id
+		LEFT OUTER JOIN script_contents uninst ON uninst.id = si.uninstall_script_content_id`
 	}
 
 	query := fmt.Sprintf(`
@@ -242,11 +367,14 @@ SELECT
   si.team_id,
   si.title_id,
   si.storage_id,
+  si.package_ids,
   si.filename,
+  si.extension,
   si.version,
   si.install_script_content_id,
   si.pre_install_query,
   si.post_install_script_content_id,
+  si.uninstall_script_content_id,
   si.uploaded_at,
   si.self_service,
   COALESCE(st.name, '') AS software_title
@@ -276,9 +404,21 @@ WHERE
 	return &dest, nil
 }
 
+var errDeleteInstallerWithAssociatedPolicy = errors.New("Couldn't delete. Policy automation uses this software. Please disable policy automation for this software and try again.")
+
 func (ds *Datastore) DeleteSoftwareInstaller(ctx context.Context, id uint) error {
 	res, err := ds.writer(ctx).ExecContext(ctx, `DELETE FROM software_installers WHERE id = ?`, id)
 	if err != nil {
+		if isMySQLForeignKey(err) {
+			// Check if the software installer is referenced by a policy automation.
+			var count int
+			if err := sqlx.GetContext(ctx, ds.reader(ctx), &count, `SELECT COUNT(*) FROM policies WHERE software_installer_id = ?`, id); err != nil {
+				return ctxerr.Wrapf(ctx, err, "getting reference from policies")
+			}
+			if count > 0 {
+				return ctxerr.Wrap(ctx, errDeleteInstallerWithAssociatedPolicy, "delete software installer")
+			}
+		}
 		return ctxerr.Wrap(ctx, err, "delete software installer")
 	}
 
@@ -329,6 +469,75 @@ func (ds *Datastore) InsertSoftwareInstallRequest(ctx context.Context, hostID ui
 	return installID, ctxerr.Wrap(ctx, err, "inserting new install software request")
 }
 
+func (ds *Datastore) ProcessInstallerUpdateSideEffects(ctx context.Context, installerID uint, wasMetadataUpdated bool, wasPackageUpdated bool) error {
+	return ds.withTx(ctx, func(tx sqlx.ExtContext) error {
+		return ds.runInstallerUpdateSideEffectsInTransaction(ctx, tx, installerID, wasMetadataUpdated, wasPackageUpdated)
+	})
+}
+
+func (ds *Datastore) runInstallerUpdateSideEffectsInTransaction(ctx context.Context, tx sqlx.ExtContext, installerID uint, wasMetadataUpdated bool, wasPackageUpdated bool) error {
+	if wasMetadataUpdated || wasPackageUpdated { // cancel pending installs/uninstalls
+		// TODO make this less naive; this assumes that installs/uninstalls execute and report back immediately
+		_, err := tx.ExecContext(ctx, `DELETE FROM host_script_results WHERE execution_id IN (
+				SELECT execution_id FROM host_software_installs WHERE software_installer_id = ? AND status = 'pending_uninstall'
+			)`, installerID)
+		if err != nil {
+			return ctxerr.Wrap(ctx, err, "delete pending uninstall scripts")
+		}
+
+		_, err = tx.ExecContext(ctx, `DELETE FROM host_software_installs
+			   WHERE software_installer_id = ? AND status IN('pending_install', 'pending_uninstall')`, installerID)
+		if err != nil {
+			return ctxerr.Wrap(ctx, err, "delete pending host software installs/uninstalls")
+		}
+	}
+
+	if wasPackageUpdated { // hide existing install counts
+		_, err := tx.ExecContext(ctx, `UPDATE host_software_installs SET removed = TRUE
+	  			WHERE software_installer_id = ? AND status IS NOT NULL AND host_deleted_at IS NULL`, installerID)
+		if err != nil {
+			return ctxerr.Wrap(ctx, err, "hide existing install counts")
+		}
+	}
+
+	return nil
+}
+
+func (ds *Datastore) InsertSoftwareUninstallRequest(ctx context.Context, executionID string, hostID uint, softwareInstallerID uint) error {
+	const (
+		insertStmt = `
+		  INSERT INTO host_software_installs
+		    (execution_id, host_id, software_installer_id, user_id, uninstall)
+		  VALUES
+		    (?, ?, ?, ?, 1)
+		    `
+		hostExistsStmt = `SELECT 1 FROM hosts WHERE id = ?`
+	)
+
+	// we need to explicitly do this check here because we can't set a FK constraint on the schema
+	var hostExists bool
+	err := sqlx.GetContext(ctx, ds.reader(ctx), &hostExists, hostExistsStmt, hostID)
+	if err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			return notFound("Host").WithID(hostID)
+		}
+		return ctxerr.Wrap(ctx, err, "checking if host exists")
+	}
+
+	var userID *uint
+	if ctxUser := authz.UserFromContext(ctx); ctxUser != nil {
+		userID = &ctxUser.ID
+	}
+	_, err = ds.writer(ctx).ExecContext(ctx, insertStmt,
+		executionID,
+		hostID,
+		softwareInstallerID,
+		userID,
+	)
+
+	return ctxerr.Wrap(ctx, err, "inserting new uninstall software request")
+}
+
 func (ds *Datastore) GetSoftwareInstallResults(ctx context.Context, resultsUUID string) (*fleet.HostSoftwareInstallerResult, error) {
 	query := fmt.Sprintf(`
 SELECT
@@ -339,26 +548,27 @@ SELECT
 	hsi.host_id AS host_id,
 	st.name AS software_title,
 	st.id AS software_title_id,
-	COALESCE(%s, '') AS status,
+	COALESCE(hsi.status, '') AS status,
 	si.filename AS software_package,
 	hsi.user_id AS user_id,
 	hsi.post_install_script_exit_code,
 	hsi.install_script_exit_code,
-    hsi.self_service,
-    hsi.host_deleted_at
+	hsi.self_service,
+	hsi.host_deleted_at,
+	hsi.created_at as created_at,
+	si.user_id AS software_installer_user_id,
+	si.user_name AS software_installer_user_name,
+	si.user_email AS software_installer_user_email
 FROM
 	host_software_installs hsi
 	JOIN software_installers si ON si.id = hsi.software_installer_id
 	JOIN software_titles st ON si.title_id = st.id
 WHERE
 	hsi.execution_id = :execution_id
-	`, softwareInstallerHostStatusNamedQuery("hsi", ""))
+	`)
 
 	stmt, args, err := sqlx.Named(query, map[string]any{
-		"execution_id":              resultsUUID,
-		"software_status_failed":    fleet.SoftwareInstallerFailed,
-		"software_status_pending":   fleet.SoftwareInstallerPending,
-		"software_status_installed": fleet.SoftwareInstallerInstalled,
+		"execution_id": resultsUUID,
 	})
 	if err != nil {
 		return nil, ctxerr.Wrap(ctx, err, "build named query for get software install results")
@@ -381,13 +591,15 @@ func (ds *Datastore) GetSummaryHostSoftwareInstalls(ctx context.Context, install
 
 	stmt := fmt.Sprintf(`
 SELECT
-	COALESCE(SUM( IF(status = :software_status_pending, 1, 0)), 0) AS pending,
-	COALESCE(SUM( IF(status = :software_status_failed, 1, 0)), 0) AS failed,
+	COALESCE(SUM( IF(status = :software_status_pending_install, 1, 0)), 0) AS pending_install,
+	COALESCE(SUM( IF(status = :software_status_failed_install, 1, 0)), 0) AS failed_install,
+	COALESCE(SUM( IF(status = :software_status_pending_uninstall, 1, 0)), 0) AS pending_uninstall,
+	COALESCE(SUM( IF(status = :software_status_failed_uninstall, 1, 0)), 0) AS failed_uninstall,
 	COALESCE(SUM( IF(status = :software_status_installed, 1, 0)), 0) AS installed
 FROM (
 SELECT
 	software_installer_id,
-	%s
+	status
 FROM
 	host_software_installs hsi
 WHERE
@@ -399,14 +611,17 @@ WHERE
 		WHERE
 			software_installer_id = :installer_id
 			AND host_deleted_at IS NULL
+			AND removed = 0
 		GROUP BY
-			host_id)) s`, softwareInstallerHostStatusNamedQuery("hsi", "status"))
+			host_id)) s`)
 
 	query, args, err := sqlx.Named(stmt, map[string]interface{}{
-		"installer_id":              installerID,
-		"software_status_pending":   fleet.SoftwareInstallerPending,
-		"software_status_failed":    fleet.SoftwareInstallerFailed,
-		"software_status_installed": fleet.SoftwareInstallerInstalled,
+		"installer_id":                      installerID,
+		"software_status_pending_install":   fleet.SoftwareInstallPending,
+		"software_status_failed_install":    fleet.SoftwareInstallFailed,
+		"software_status_pending_uninstall": fleet.SoftwareUninstallPending,
+		"software_status_failed_uninstall":  fleet.SoftwareUninstallFailed,
+		"software_status_installed":         fleet.SoftwareInstalled,
 	})
 	if err != nil {
 		return nil, ctxerr.Wrap(ctx, err, "get summary host software installs: named query")
@@ -421,6 +636,15 @@ WHERE
 }
 
 func (ds *Datastore) vppAppJoin(appID fleet.VPPAppID, status fleet.SoftwareInstallerStatus) (string, []interface{}, error) {
+	// Since VPP does not have uninstaller yet, we map the generic pending/failed statuses to the install statuses
+	switch status {
+	case fleet.SoftwarePending:
+		status = fleet.SoftwareInstallPending
+	case fleet.SoftwareFailed:
+		status = fleet.SoftwareInstallFailed
+	default:
+		// no change
+	}
 	stmt := fmt.Sprintf(`JOIN (
 SELECT
 	host_id
@@ -445,9 +669,9 @@ WHERE
 		"status":                    status,
 		"adam_id":                   appID.AdamID,
 		"platform":                  appID.Platform,
-		"software_status_installed": fleet.SoftwareInstallerInstalled,
-		"software_status_failed":    fleet.SoftwareInstallerFailed,
-		"software_status_pending":   fleet.SoftwareInstallerPending,
+		"software_status_installed": fleet.SoftwareInstalled,
+		"software_status_failed":    fleet.SoftwareInstallFailed,
+		"software_status_pending":   fleet.SoftwareInstallPending,
 		"mdm_status_acknowledged":   fleet.MDMAppleStatusAcknowledged,
 		"mdm_status_error":          fleet.MDMAppleStatusError,
 		"mdm_status_format_error":   fleet.MDMAppleStatusCommandFormatError,
@@ -455,6 +679,21 @@ WHERE
 }
 
 func (ds *Datastore) softwareInstallerJoin(installerID uint, status fleet.SoftwareInstallerStatus) (string, []interface{}, error) {
+	statusFilter := "hsi.status = :status"
+	var status2 fleet.SoftwareInstallerStatus
+	switch status {
+	case fleet.SoftwarePending:
+		status = fleet.SoftwareInstallPending
+		status2 = fleet.SoftwareUninstallPending
+	case fleet.SoftwareFailed:
+		status = fleet.SoftwareInstallFailed
+		status2 = fleet.SoftwareUninstallFailed
+	default:
+		// no change
+	}
+	if status2 != "" {
+		statusFilter = "hsi.status IN (:status, :status2)"
+	}
 	stmt := fmt.Sprintf(`JOIN (
 SELECT
 	host_id
@@ -468,21 +707,52 @@ WHERE
 			FROM host_software_installs
 		WHERE
 			software_installer_id = :installer_id
+			AND removed = 0
 		GROUP BY
 			host_id, software_installer_id)
-	AND (%s) = :status) hss ON hss.host_id = h.id
-`, softwareInstallerHostStatusNamedQuery("hsi", ""))
+	AND %s) hss ON hss.host_id = h.id
+`, statusFilter)
 
 	return sqlx.Named(stmt, map[string]interface{}{
-		"status":                    status,
-		"installer_id":              installerID,
-		"software_status_installed": fleet.SoftwareInstallerInstalled,
-		"software_status_failed":    fleet.SoftwareInstallerFailed,
-		"software_status_pending":   fleet.SoftwareInstallerPending,
+		"status":       status,
+		"status2":      status2,
+		"installer_id": installerID,
 	})
 }
 
-func (ds *Datastore) CleanupUnusedSoftwareInstallers(ctx context.Context, softwareInstallStore fleet.SoftwareInstallerStore) error {
+func (ds *Datastore) GetHostLastInstallData(ctx context.Context, hostID, installerID uint) (*fleet.HostLastInstallData, error) {
+	stmt := fmt.Sprintf(`
+		SELECT execution_id, hsi.status
+		FROM host_software_installs hsi
+		WHERE hsi.id = (
+			SELECT
+				MAX(id)
+			FROM host_software_installs
+			WHERE
+				software_installer_id = :installer_id AND host_id = :host_id
+			GROUP BY
+				host_id, software_installer_id)
+`)
+
+	stmt, args, err := sqlx.Named(stmt, map[string]interface{}{
+		"host_id":      hostID,
+		"installer_id": installerID,
+	})
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "build named query to get host last install data")
+	}
+
+	var hostLastInstall fleet.HostLastInstallData
+	if err := sqlx.GetContext(ctx, ds.reader(ctx), &hostLastInstall, stmt, args...); err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			return nil, nil
+		}
+		return nil, ctxerr.Wrap(ctx, err, "get host last install data")
+	}
+	return &hostLastInstall, nil
+}
+
+func (ds *Datastore) CleanupUnusedSoftwareInstallers(ctx context.Context, softwareInstallStore fleet.SoftwareInstallerStore, removeCreatedBefore time.Time) error {
 	if softwareInstallStore == nil {
 		// no-op in this case, possible if not running with a Premium license
 		return nil
@@ -494,7 +764,7 @@ func (ds *Datastore) CleanupUnusedSoftwareInstallers(ctx context.Context, softwa
 		return ctxerr.Wrap(ctx, err, "get list of software installers in use")
 	}
 
-	_, err := softwareInstallStore.Cleanup(ctx, storageIDs)
+	_, err := softwareInstallStore.Cleanup(ctx, storageIDs, removeCreatedBefore)
 	return ctxerr.Wrap(ctx, err, "cleanup unused software installers")
 }
 
@@ -517,6 +787,16 @@ FROM
   software_titles
 WHERE (name, source, browser) IN (%s)
 `
+
+	const unsetAllInstallersFromPolicies = `
+UPDATE
+  policies
+SET
+  software_installer_id = NULL
+WHERE
+  team_id = ?
+`
+
 	const deleteAllInstallersInTeam = `
 DELETE FROM
   software_installers
@@ -524,6 +804,19 @@ WHERE
   global_or_team_id = ?
 `
 
+	const unsetInstallersNotInListFromPolicies = `
+UPDATE
+  policies
+SET
+  software_installer_id = NULL
+WHERE
+  software_installer_id IN (
+    SELECT id FROM software_installers
+    WHERE global_or_team_id = ? AND
+    title_id NOT IN (?)
+  )
+`
+
 	const deleteInstallersNotInList = `
 DELETE FROM
   software_installers
@@ -532,32 +825,57 @@ WHERE
   title_id NOT IN (?)
 `
 
+	const checkExistingInstaller = `
+SELECT id,
+storage_id != ? is_package_modified,
+install_script_content_id != ? OR uninstall_script_content_id != ? OR pre_install_query != ? OR
+COALESCE(post_install_script_content_id != ? OR 
+	(post_install_script_content_id IS NULL AND ? IS NOT NULL) OR
+	(? IS NULL AND post_install_script_content_id IS NOT NULL)
+, FALSE) is_metadata_modified FROM software_installers
+WHERE global_or_team_id = ?	AND title_id IN (SELECT id FROM software_titles WHERE name = ? AND source = ? AND browser = '')
+`
+
 	const insertNewOrEditedInstaller = `
 INSERT INTO software_installers (
 	team_id,
 	global_or_team_id,
 	storage_id,
-	filename,
+	filename, 
+	extension,
 	version,
 	install_script_content_id,
+	uninstall_script_content_id,
 	pre_install_query,
 	post_install_script_content_id,
 	platform,
 	self_service,
-	title_id
+	title_id,
+	user_id,
+	user_name,
+	user_email,
+	url,
+	package_ids
 ) VALUES (
-  ?, ?, ?, ?, ?, ?, ?, ?, ?, ?,
-  (SELECT id FROM software_titles WHERE name = ? AND source = ? AND browser = '')
+  ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?,
+  (SELECT id FROM software_titles WHERE name = ? AND source = ? AND browser = ''),
+  ?, (SELECT name FROM users WHERE id = ?), (SELECT email FROM users WHERE id = ?), ?, ?
 )
 ON DUPLICATE KEY UPDATE
   install_script_content_id = VALUES(install_script_content_id),
+  uninstall_script_content_id = VALUES(uninstall_script_content_id),
   post_install_script_content_id = VALUES(post_install_script_content_id),
   storage_id = VALUES(storage_id),
   filename = VALUES(filename),
+  extension = VALUES(extension),
   version = VALUES(version),
   pre_install_query = VALUES(pre_install_query),
   platform = VALUES(platform),
-  self_service = VALUES(self_service)
+  self_service = VALUES(self_service),
+  user_id = VALUES(user_id),
+  user_name = VALUES(user_name),
+  user_email = VALUES(user_email),
+  url = VALUES(url)
 `
 
 	// use a team id of 0 if no-team
@@ -566,12 +884,17 @@ ON DUPLICATE KEY UPDATE
 		globalOrTeamID = *tmID
 	}
 
-	return ds.withRetryTxx(ctx, func(tx sqlx.ExtContext) error {
+	if err := ds.withRetryTxx(ctx, func(tx sqlx.ExtContext) error {
 		// if no installers are provided, just delete whatever was in
 		// the table
 		if len(installers) == 0 {
-			_, err := tx.ExecContext(ctx, deleteAllInstallersInTeam, globalOrTeamID)
-			return ctxerr.Wrap(ctx, err, "delete obsolete software installers")
+			if _, err := tx.ExecContext(ctx, unsetAllInstallersFromPolicies, globalOrTeamID); err != nil {
+				return ctxerr.Wrap(ctx, err, "unset all obsolete installers in policies")
+			}
+			if _, err := tx.ExecContext(ctx, deleteAllInstallersInTeam, globalOrTeamID); err != nil {
+				return ctxerr.Wrap(ctx, err, "delete obsolete software installers")
+			}
+			return nil
 		}
 
 		var args []any
@@ -592,7 +915,15 @@ ON DUPLICATE KEY UPDATE
 			return ctxerr.Wrap(ctx, err, "load existing titles")
 		}
 
-		stmt, args, err := sqlx.In(deleteInstallersNotInList, globalOrTeamID, titleIDs)
+		stmt, args, err := sqlx.In(unsetInstallersNotInListFromPolicies, globalOrTeamID, titleIDs)
+		if err != nil {
+			return ctxerr.Wrap(ctx, err, "build statement to unset obsolete installers from policies")
+		}
+		if _, err := tx.ExecContext(ctx, stmt, args...); err != nil {
+			return ctxerr.Wrap(ctx, err, "unset obsolete software installers from policies")
+		}
+
+		stmt, args, err = sqlx.In(deleteInstallersNotInList, globalOrTeamID, titleIDs)
 		if err != nil {
 			return ctxerr.Wrap(ctx, err, "build statement to delete obsolete installers")
 		}
@@ -607,6 +938,12 @@ ON DUPLICATE KEY UPDATE
 			}
 			installScriptID, _ := isRes.LastInsertId()
 
+			uisRes, err := insertScriptContents(ctx, tx, installer.UninstallScript)
+			if err != nil {
+				return ctxerr.Wrapf(ctx, err, "inserting uninstall script contents for software installer with name %q", installer.Filename)
+			}
+			uninstallScriptID, _ := uisRes.LastInsertId()
+
 			var postInstallScriptID *int64
 			if installer.PostInstallScript != "" {
 				pisRes, err := insertScriptContents(ctx, tx, installer.PostInstallScript)
@@ -618,39 +955,106 @@ ON DUPLICATE KEY UPDATE
 				postInstallScriptID = &insertID
 			}
 
+			wasUpdatedArgs := []interface{}{
+				// package update
+				installer.StorageID,
+				// metadata update
+				installScriptID,
+				uninstallScriptID,
+				installer.PreInstallQuery,
+				postInstallScriptID,
+				postInstallScriptID,
+				postInstallScriptID,
+				// WHERE clause
+				globalOrTeamID,
+				installer.Title,
+				installer.Source,
+			}
+
+			// pull existing installer state if it exists so we can diff for side effects post-update
+			type existingInstallerUpdateCheckResult struct {
+				InstallerID        uint `db:"id"`
+				IsPackageModified  bool `db:"is_package_modified"`
+				IsMetadataModified bool `db:"is_metadata_modified"`
+			}
+			var existing []existingInstallerUpdateCheckResult
+			err = sqlx.SelectContext(ctx, tx, &existing, checkExistingInstaller, wasUpdatedArgs...)
+			if err != nil {
+				if !errors.Is(err, sql.ErrNoRows) {
+					return ctxerr.Wrapf(ctx, err, "checking for existing installer with name %q", installer.Filename)
+				}
+			}
+
 			args := []interface{}{
 				tmID,
 				globalOrTeamID,
 				installer.StorageID,
 				installer.Filename,
+				installer.Extension,
 				installer.Version,
 				installScriptID,
+				uninstallScriptID,
 				installer.PreInstallQuery,
 				postInstallScriptID,
 				installer.Platform,
 				installer.SelfService,
 				installer.Title,
 				installer.Source,
+				installer.UserID,
+				installer.UserID,
+				installer.UserID,
+				installer.URL,
+				strings.Join(installer.PackageIDs, ","),
+			}
+			upsertQuery := insertNewOrEditedInstaller
+			if len(existing) > 0 && existing[0].IsPackageModified { // update uploaded_at for updated installer package
+				upsertQuery = fmt.Sprintf("%s, uploaded_at = NOW()", upsertQuery)
 			}
 
-			if _, err := tx.ExecContext(ctx, insertNewOrEditedInstaller, args...); err != nil {
+			if _, err := tx.ExecContext(ctx, upsertQuery, args...); err != nil {
 				return ctxerr.Wrapf(ctx, err, "insert new/edited installer with name %q", installer.Filename)
 			}
+
+			// perform side effects if this was an update
+			if len(existing) > 0 {
+				if err := ds.runInstallerUpdateSideEffectsInTransaction(
+					ctx,
+					tx,
+					existing[0].InstallerID,
+					existing[0].IsMetadataModified,
+					existing[0].IsPackageModified,
+				); err != nil {
+					return ctxerr.Wrapf(ctx, err, "processing installer with name %q", installer.Filename)
+				}
+			}
 		}
+
 		return nil
-	})
+	}); err != nil {
+		return err
+	}
+	return nil
 }
 
 func (ds *Datastore) HasSelfServiceSoftwareInstallers(ctx context.Context, hostPlatform string, hostTeamID *uint) (bool, error) {
 	if fleet.IsLinux(hostPlatform) {
 		hostPlatform = "linux"
 	}
-	stmt := `SELECT 1 FROM software_installers WHERE self_service = 1 AND platform = ? AND global_or_team_id = ?`
+	stmt := `SELECT 1
+		WHERE EXISTS (
+			SELECT 1
+			FROM software_installers
+			WHERE self_service = 1 AND platform = ? AND global_or_team_id = ?
+		) OR EXISTS (
+			SELECT 1
+			FROM vpp_apps_teams
+			WHERE self_service = 1 AND platform = ? AND global_or_team_id = ?
+		)`
 	var globalOrTeamID uint
 	if hostTeamID != nil {
 		globalOrTeamID = *hostTeamID
 	}
-	args := []interface{}{hostPlatform, globalOrTeamID}
+	args := []interface{}{hostPlatform, globalOrTeamID, hostPlatform, globalOrTeamID}
 	var hasInstallers bool
 	err := sqlx.GetContext(ctx, ds.reader(ctx), &hasInstallers, stmt, args...)
 	if err != nil && !errors.Is(err, sql.ErrNoRows) {
@@ -658,3 +1062,79 @@ func (ds *Datastore) HasSelfServiceSoftwareInstallers(ctx context.Context, hostP
 	}
 	return hasInstallers, nil
 }
+
+func (ds *Datastore) GetSoftwareTitleNameFromExecutionID(ctx context.Context, executionID string) (string, error) {
+	stmt := `
+	SELECT name
+	FROM software_titles st
+	INNER JOIN software_installers si ON si.title_id = st.id
+	INNER JOIN host_software_installs hsi ON hsi.software_installer_id = si.id
+	WHERE hsi.execution_id = ?
+	`
+	var name string
+	err := sqlx.GetContext(ctx, ds.reader(ctx), &name, stmt, executionID)
+	if err != nil {
+		return "", ctxerr.Wrap(ctx, err, "get software title name from execution ID")
+	}
+	return name, nil
+}
+
+func (ds *Datastore) GetSoftwareInstallersWithoutPackageIDs(ctx context.Context) (map[uint]string, error) {
+	query := `
+		SELECT id, storage_id FROM software_installers WHERE package_ids = ''
+	`
+	type result struct {
+		ID        uint   `db:"id"`
+		StorageID string `db:"storage_id"`
+	}
+
+	var results []result
+	if err := sqlx.SelectContext(ctx, ds.reader(ctx), &results, query); err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "get software installers without package ID")
+	}
+	if len(results) == 0 {
+		return nil, nil
+	}
+	idMap := make(map[uint]string, len(results))
+	for _, r := range results {
+		idMap[r.ID] = r.StorageID
+	}
+	return idMap, nil
+}
+
+func (ds *Datastore) UpdateSoftwareInstallerWithoutPackageIDs(ctx context.Context, id uint,
+	payload fleet.UploadSoftwareInstallerPayload,
+) error {
+	uninstallScriptID, err := ds.getOrGenerateScriptContentsID(ctx, payload.UninstallScript)
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "get or generate uninstall script contents ID")
+	}
+	query := `
+		UPDATE software_installers
+		SET package_ids = ?, uninstall_script_content_id = ?, extension = ?
+		WHERE id = ?
+	`
+	_, err = ds.writer(ctx).ExecContext(ctx, query, strings.Join(payload.PackageIDs, ","), uninstallScriptID, payload.Extension, id)
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "update software installer without package ID")
+	}
+	return nil
+}
+
+func (ds *Datastore) GetSoftwareInstallers(ctx context.Context, teamID uint) ([]fleet.SoftwarePackageResponse, error) {
+	const loadInsertedSoftwareInstallers = `
+SELECT
+  team_id,
+  title_id,
+  url
+FROM
+  software_installers
+WHERE global_or_team_id = ?
+`
+	var softwarePackages []fleet.SoftwarePackageResponse
+	// Using ds.writer(ctx) on purpose because this method is to be called after applying software.
+	if err := sqlx.SelectContext(ctx, ds.writer(ctx), &softwarePackages, loadInsertedSoftwareInstallers, teamID); err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "get software installers")
+	}
+	return softwarePackages, nil
+}
diff --git a/server/datastore/mysql/software_installers_test.go b/server/datastore/mysql/software_installers_test.go
index f2630770a7..178b858071 100644
--- a/server/datastore/mysql/software_installers_test.go
+++ b/server/datastore/mysql/software_installers_test.go
@@ -13,6 +13,7 @@ import (
 	"github.com/fleetdm/fleet/v4/server/ptr"
 	"github.com/fleetdm/fleet/v4/server/test"
 	"github.com/google/uuid"
+	"github.com/jmoiron/sqlx"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -31,6 +32,8 @@ func TestSoftwareInstallers(t *testing.T) {
 		{"BatchSetSoftwareInstallers", testBatchSetSoftwareInstallers},
 		{"GetSoftwareInstallerMetadataByTeamAndTitleID", testGetSoftwareInstallerMetadataByTeamAndTitleID},
 		{"HasSelfServiceSoftwareInstallers", testHasSelfServiceSoftwareInstallers},
+		{"DeleteSoftwareInstallersAssignedToPolicy", testDeleteSoftwareInstallersAssignedToPolicy},
+		{"GetHostLastInstallData", testGetHostLastInstallData},
 	}
 
 	for _, c := range cases {
@@ -46,17 +49,20 @@ func testListPendingSoftwareInstalls(t *testing.T, ds *Datastore) {
 
 	host1 := test.NewHost(t, ds, "host1", "1", "host1key", "host1uuid", time.Now())
 	host2 := test.NewHost(t, ds, "host2", "2", "host2key", "host2uuid", time.Now())
+	user1 := test.NewUser(t, ds, "Alice", "alice@example.com", true)
 
 	installerID1, err := ds.MatchOrCreateSoftwareInstaller(ctx, &fleet.UploadSoftwareInstallerPayload{
 		InstallScript:     "hello",
 		PreInstallQuery:   "SELECT 1",
 		PostInstallScript: "world",
+		UninstallScript:   "goodbye",
 		InstallerFile:     bytes.NewReader([]byte("hello")),
 		StorageID:         "storage1",
 		Filename:          "file1",
 		Title:             "file1",
 		Version:           "1.0",
 		Source:            "apps",
+		UserID:            user1.ID,
 	})
 	require.NoError(t, err)
 
@@ -70,6 +76,7 @@ func testListPendingSoftwareInstalls(t *testing.T, ds *Datastore) {
 		Title:             "file2",
 		Version:           "2.0",
 		Source:            "apps",
+		UserID:            user1.ID,
 	})
 	require.NoError(t, err)
 
@@ -84,6 +91,7 @@ func testListPendingSoftwareInstalls(t *testing.T, ds *Datastore) {
 		Version:           "3.0",
 		Source:            "apps",
 		SelfService:       true,
+		UserID:            user1.ID,
 	})
 	require.NoError(t, err)
 
@@ -112,7 +120,7 @@ func testListPendingSoftwareInstalls(t *testing.T, ds *Datastore) {
 	err = ds.SetHostSoftwareInstallResult(ctx, &fleet.HostSoftwareInstallResultPayload{
 		HostID:                    host2.ID,
 		InstallUUID:               hostInstall5,
-		PreInstallConditionOutput: ptr.String("output"),
+		PreInstallConditionOutput: ptr.String(""), // pre-install query did not return results, so install failed
 	})
 	require.NoError(t, err)
 
@@ -139,6 +147,7 @@ func testListPendingSoftwareInstalls(t *testing.T, ds *Datastore) {
 	require.Equal(t, installerID1, exec1.InstallerID)
 	require.Equal(t, "SELECT 1", exec1.PreInstallCondition)
 	require.False(t, exec1.SelfService)
+	assert.Equal(t, "goodbye", exec1.UninstallScript)
 
 	hostInstall6, err := ds.InsertSoftwareInstallRequest(ctx, host1.ID, installerID3, true)
 	require.NoError(t, err)
@@ -169,6 +178,8 @@ func testSoftwareInstallRequests(t *testing.T, ds *Datastore) {
 	team, err := ds.NewTeam(ctx, &fleet.Team{Name: "team 2"})
 	require.NoError(t, err)
 
+	user1 := test.NewUser(t, ds, "Alice", "alice@example.com", true)
+
 	cases := map[string]*uint{
 		"no team": nil,
 		"team":    &team.ID,
@@ -188,6 +199,7 @@ func testSoftwareInstallRequests(t *testing.T, ds *Datastore) {
 				InstallScript: "echo",
 				TeamID:        teamID,
 				Filename:      "foo.pkg",
+				UserID:        user1.ID,
 			})
 			require.NoError(t, err)
 			installerMeta, err := ds.GetSoftwareInstallerMetadataByID(ctx, installerID)
@@ -202,24 +214,128 @@ func testSoftwareInstallRequests(t *testing.T, ds *Datastore) {
 			_, err = ds.InsertSoftwareInstallRequest(ctx, 12, si.InstallerID, false)
 			require.ErrorAs(t, err, &nfe)
 
-			// successful insert
-			host, err := ds.NewHost(ctx, &fleet.Host{
-				Hostname:      "macos-test" + tc,
-				OsqueryHostID: ptr.String("osquery-macos" + tc),
-				NodeKey:       ptr.String("node-key-macos" + tc),
+			// Host with software install pending
+			tag := "-pending_install"
+			hostPendingInstall, err := ds.NewHost(ctx, &fleet.Host{
+				Hostname:      "macos-test" + tag + tc,
+				OsqueryHostID: ptr.String("osquery-macos" + tag + tc),
+				NodeKey:       ptr.String("node-key-macos" + tag + tc),
 				UUID:          uuid.NewString(),
 				Platform:      "darwin",
 				TeamID:        teamID,
 			})
 			require.NoError(t, err)
-			_, err = ds.InsertSoftwareInstallRequest(ctx, host.ID, si.InstallerID, false)
+			_, err = ds.InsertSoftwareInstallRequest(ctx, hostPendingInstall.ID, si.InstallerID, false)
 			require.NoError(t, err)
 
-			// list hosts with software install requests
+			// Host with software install failed
+			tag = "-failed_install"
+			hostFailedInstall, err := ds.NewHost(ctx, &fleet.Host{
+				Hostname:      "macos-test" + tag + tc,
+				OsqueryHostID: ptr.String("osquery-macos" + tag + tc),
+				NodeKey:       ptr.String("node-key-macos" + tag + tc),
+				UUID:          uuid.NewString(),
+				Platform:      "darwin",
+				TeamID:        teamID,
+			})
+			require.NoError(t, err)
+			_, err = ds.InsertSoftwareInstallRequest(ctx, hostFailedInstall.ID, si.InstallerID, false)
+			require.NoError(t, err)
+			ExecAdhocSQL(t, ds, func(q sqlx.ExtContext) error {
+				_, err = q.ExecContext(ctx, `
+					UPDATE host_software_installs SET install_script_exit_code = 1 WHERE host_id = ? AND software_installer_id = ?`,
+					hostFailedInstall.ID, si.InstallerID)
+				require.NoError(t, err)
+				return nil
+			})
+
+			// Host with software install successful
+			tag = "-installed"
+			hostInstalled, err := ds.NewHost(ctx, &fleet.Host{
+				Hostname:      "macos-test" + tag + tc,
+				OsqueryHostID: ptr.String("osquery-macos" + tag + tc),
+				NodeKey:       ptr.String("node-key-macos" + tag + tc),
+				UUID:          uuid.NewString(),
+				Platform:      "darwin",
+				TeamID:        teamID,
+			})
+			require.NoError(t, err)
+			_, err = ds.InsertSoftwareInstallRequest(ctx, hostInstalled.ID, si.InstallerID, false)
+			require.NoError(t, err)
+			ExecAdhocSQL(t, ds, func(q sqlx.ExtContext) error {
+				_, err = q.ExecContext(ctx, `
+					UPDATE host_software_installs SET install_script_exit_code = 0 WHERE host_id = ? AND software_installer_id = ?`,
+					hostInstalled.ID, si.InstallerID)
+				require.NoError(t, err)
+				return nil
+			})
+
+			// Host with pending uninstall
+			tag = "-pending_uninstall"
+			hostPendingUninstall, err := ds.NewHost(ctx, &fleet.Host{
+				Hostname:      "macos-test" + tag + tc,
+				OsqueryHostID: ptr.String("osquery-macos" + tag + tc),
+				NodeKey:       ptr.String("node-key-macos" + tag + tc),
+				UUID:          uuid.NewString(),
+				Platform:      "darwin",
+				TeamID:        teamID,
+			})
+			require.NoError(t, err)
+			err = ds.InsertSoftwareUninstallRequest(ctx, "uuid"+tag+tc, hostPendingUninstall.ID, si.InstallerID)
+			require.NoError(t, err)
+
+			// Host with failed uninstall
+			tag = "-failed_uninstall"
+			hostFailedUninstall, err := ds.NewHost(ctx, &fleet.Host{
+				Hostname:      "macos-test" + tag + tc,
+				OsqueryHostID: ptr.String("osquery-macos" + tag + tc),
+				NodeKey:       ptr.String("node-key-macos" + tag + tc),
+				UUID:          uuid.NewString(),
+				Platform:      "darwin",
+				TeamID:        teamID,
+			})
+			require.NoError(t, err)
+			err = ds.InsertSoftwareUninstallRequest(ctx, "uuid"+tag+tc, hostFailedUninstall.ID, si.InstallerID)
+			require.NoError(t, err)
+			ExecAdhocSQL(t, ds, func(q sqlx.ExtContext) error {
+				_, err = q.ExecContext(ctx, `
+					UPDATE host_software_installs SET uninstall_script_exit_code = 1 WHERE host_id = ? AND software_installer_id = ?`,
+					hostFailedUninstall.ID, si.InstallerID)
+				require.NoError(t, err)
+				return nil
+			})
+
+			// Host with successful uninstall
+			tag = "-uninstalled"
+			hostUninstalled, err := ds.NewHost(ctx, &fleet.Host{
+				Hostname:      "macos-test" + tag + tc,
+				OsqueryHostID: ptr.String("osquery-macos" + tag + tc),
+				NodeKey:       ptr.String("node-key-macos" + tag + tc),
+				UUID:          uuid.NewString(),
+				Platform:      "darwin",
+				TeamID:        teamID,
+			})
+			require.NoError(t, err)
+			err = ds.InsertSoftwareUninstallRequest(ctx, "uuid"+tag+tc, hostUninstalled.ID, si.InstallerID)
+			require.NoError(t, err)
+			ExecAdhocSQL(t, ds, func(q sqlx.ExtContext) error {
+				_, err = q.ExecContext(ctx, `
+					UPDATE host_software_installs SET uninstall_script_exit_code = 0 WHERE host_id = ? AND software_installer_id = ?`,
+					hostUninstalled.ID, si.InstallerID)
+				require.NoError(t, err)
+				return nil
+			})
+
+			// Uninstall request with unknown host
+			err = ds.InsertSoftwareUninstallRequest(ctx, "uuid"+tag+tc, 99999, si.InstallerID)
+			assert.ErrorContains(t, err, "Host")
+
 			userTeamFilter := fleet.TeamFilter{
 				User: &fleet.User{GlobalRole: ptr.String("admin")},
 			}
-			expectStatus := fleet.SoftwareInstallerPending
+
+			// list hosts with software install pending requests
+			expectStatus := fleet.SoftwareInstallPending
 			hosts, err := ds.ListHosts(ctx, userTeamFilter, fleet.HostListOptions{
 				ListOptions:           fleet.ListOptions{PerPage: 100},
 				SoftwareTitleIDFilter: installerMeta.TitleID,
@@ -228,15 +344,98 @@ func testSoftwareInstallRequests(t *testing.T, ds *Datastore) {
 			})
 			require.NoError(t, err)
 			require.Len(t, hosts, 1)
-			require.Equal(t, host.ID, hosts[0].ID)
+			require.Equal(t, hostPendingInstall.ID, hosts[0].ID)
+
+			// list hosts with all pending requests
+			expectStatus = fleet.SoftwarePending
+			hosts, err = ds.ListHosts(ctx, userTeamFilter, fleet.HostListOptions{
+				ListOptions:           fleet.ListOptions{PerPage: 100},
+				SoftwareTitleIDFilter: installerMeta.TitleID,
+				SoftwareStatusFilter:  &expectStatus,
+				TeamFilter:            teamID,
+			})
+			require.NoError(t, err)
+			require.Len(t, hosts, 2)
+			assert.ElementsMatch(t, []uint{hostPendingInstall.ID, hostPendingUninstall.ID}, []uint{hosts[0].ID, hosts[1].ID})
+
+			// list hosts with software install failed requests
+			expectStatus = fleet.SoftwareInstallFailed
+			hosts, err = ds.ListHosts(ctx, userTeamFilter, fleet.HostListOptions{
+				ListOptions:           fleet.ListOptions{PerPage: 100},
+				SoftwareTitleIDFilter: installerMeta.TitleID,
+				SoftwareStatusFilter:  &expectStatus,
+				TeamFilter:            teamID,
+			})
+			require.NoError(t, err)
+			require.Len(t, hosts, 1)
+			assert.ElementsMatch(t, []uint{hostFailedInstall.ID}, []uint{hosts[0].ID})
+
+			// list hosts with all failed requests
+			expectStatus = fleet.SoftwareFailed
+			hosts, err = ds.ListHosts(ctx, userTeamFilter, fleet.HostListOptions{
+				ListOptions:           fleet.ListOptions{PerPage: 100},
+				SoftwareTitleIDFilter: installerMeta.TitleID,
+				SoftwareStatusFilter:  &expectStatus,
+				TeamFilter:            teamID,
+			})
+			require.NoError(t, err)
+			require.Len(t, hosts, 2)
+			assert.ElementsMatch(t, []uint{hostFailedInstall.ID, hostFailedUninstall.ID}, []uint{hosts[0].ID, hosts[1].ID})
+
+			// list hosts with software installed
+			expectStatus = fleet.SoftwareInstalled
+			hosts, err = ds.ListHosts(ctx, userTeamFilter, fleet.HostListOptions{
+				ListOptions:           fleet.ListOptions{PerPage: 100},
+				SoftwareTitleIDFilter: installerMeta.TitleID,
+				SoftwareStatusFilter:  &expectStatus,
+				TeamFilter:            teamID,
+			})
+			require.NoError(t, err)
+			require.Len(t, hosts, 1)
+			assert.ElementsMatch(t, []uint{hostInstalled.ID}, []uint{hosts[0].ID})
+
+			// list hosts with pending software uninstall requests
+			expectStatus = fleet.SoftwareUninstallPending
+			hosts, err = ds.ListHosts(ctx, userTeamFilter, fleet.HostListOptions{
+				ListOptions:           fleet.ListOptions{PerPage: 100},
+				SoftwareTitleIDFilter: installerMeta.TitleID,
+				SoftwareStatusFilter:  &expectStatus,
+				TeamFilter:            teamID,
+			})
+			require.NoError(t, err)
+			require.Len(t, hosts, 1)
+			assert.ElementsMatch(t, []uint{hostPendingUninstall.ID}, []uint{hosts[0].ID})
+
+			// list hosts with failed software uninstall requests
+			expectStatus = fleet.SoftwareUninstallFailed
+			hosts, err = ds.ListHosts(ctx, userTeamFilter, fleet.HostListOptions{
+				ListOptions:           fleet.ListOptions{PerPage: 100},
+				SoftwareTitleIDFilter: installerMeta.TitleID,
+				SoftwareStatusFilter:  &expectStatus,
+				TeamFilter:            teamID,
+			})
+			require.NoError(t, err)
+			require.Len(t, hosts, 1)
+			assert.ElementsMatch(t, []uint{hostFailedUninstall.ID}, []uint{hosts[0].ID})
+
+			// list all hosts with the software title that shows up in host_software (after fleetd software query is run)
+			hosts, err = ds.ListHosts(ctx, userTeamFilter, fleet.HostListOptions{
+				ListOptions:           fleet.ListOptions{PerPage: 100},
+				SoftwareTitleIDFilter: installerMeta.TitleID,
+				TeamFilter:            teamID,
+			})
+			require.NoError(t, err)
+			assert.Empty(t, hosts)
 
 			// get software title includes status
 			summary, err := ds.GetSummaryHostSoftwareInstalls(ctx, installerMeta.InstallerID)
 			require.NoError(t, err)
 			require.Equal(t, fleet.SoftwareInstallerStatusSummary{
-				Installed: 0,
-				Pending:   1,
-				Failed:    0,
+				Installed:        1,
+				PendingInstall:   1,
+				FailedInstall:    1,
+				PendingUninstall: 1,
+				FailedUninstall:  1,
 			}, *summary)
 		})
 	}
@@ -249,6 +448,8 @@ func testGetSoftwareInstallResult(t *testing.T, ds *Datastore) {
 	require.NoError(t, err)
 	teamID := team.ID
 
+	user1 := test.NewUser(t, ds, "Alice", "alice@example.com", true)
+
 	for _, tc := range []struct {
 		name                    string
 		expectedStatus          fleet.SoftwareInstallerStatus
@@ -260,27 +461,27 @@ func testGetSoftwareInstallResult(t *testing.T, ds *Datastore) {
 	}{
 		{
 			name:                    "pending install",
-			expectedStatus:          fleet.SoftwareInstallerPending,
+			expectedStatus:          fleet.SoftwareInstallPending,
 			postInstallScriptOutput: ptr.String("post install output"),
 			installScriptOutput:     ptr.String("install output"),
 		},
 		{
 			name:                    "failing install post install script",
-			expectedStatus:          fleet.SoftwareInstallerFailed,
+			expectedStatus:          fleet.SoftwareInstallFailed,
 			postInstallScriptEC:     ptr.Int(1),
 			postInstallScriptOutput: ptr.String("post install output"),
 			installScriptOutput:     ptr.String("install output"),
 		},
 		{
 			name:                    "failing install install script",
-			expectedStatus:          fleet.SoftwareInstallerFailed,
+			expectedStatus:          fleet.SoftwareInstallFailed,
 			installScriptEC:         ptr.Int(1),
 			postInstallScriptOutput: ptr.String("post install output"),
 			installScriptOutput:     ptr.String("install output"),
 		},
 		{
 			name:                    "failing install pre install query",
-			expectedStatus:          fleet.SoftwareInstallerFailed,
+			expectedStatus:          fleet.SoftwareInstallFailed,
 			preInstallQueryOutput:   ptr.String(""),
 			postInstallScriptOutput: ptr.String("post install output"),
 			installScriptOutput:     ptr.String("install output"),
@@ -295,6 +496,7 @@ func testGetSoftwareInstallResult(t *testing.T, ds *Datastore) {
 				InstallScript: "echo " + tc.name,
 				TeamID:        &teamID,
 				Filename:      swFilename,
+				UserID:        user1.ID,
 			})
 			require.NoError(t, err)
 			host, err := ds.NewHost(ctx, &fleet.Host{
@@ -342,6 +544,8 @@ func testCleanupUnusedSoftwareInstallers(t *testing.T, ds *Datastore) {
 	store, err := filesystem.NewSoftwareInstallerStore(dir)
 	require.NoError(t, err)
 
+	user1 := test.NewUser(t, ds, "Alice", "alice@example.com", true)
+
 	assertExisting := func(want []string) {
 		dirEnts, err := os.ReadDir(filepath.Join(dir, "software-installers"))
 		require.NoError(t, err)
@@ -355,7 +559,7 @@ func testCleanupUnusedSoftwareInstallers(t *testing.T, ds *Datastore) {
 	}
 
 	// cleanup an empty store
-	err = ds.CleanupUnusedSoftwareInstallers(ctx, store)
+	err = ds.CleanupUnusedSoftwareInstallers(ctx, store, time.Now())
 	require.NoError(t, err)
 	assertExisting(nil)
 
@@ -373,11 +577,12 @@ func testCleanupUnusedSoftwareInstallers(t *testing.T, ds *Datastore) {
 		Filename:      "installer0",
 		Title:         "ins0",
 		Source:        "apps",
+		UserID:        user1.ID,
 	})
 	require.NoError(t, err)
 
 	assertExisting([]string{ins0})
-	err = ds.CleanupUnusedSoftwareInstallers(ctx, store)
+	err = ds.CleanupUnusedSoftwareInstallers(ctx, store, time.Now())
 	require.NoError(t, err)
 	assertExisting([]string{ins0})
 
@@ -385,7 +590,13 @@ func testCleanupUnusedSoftwareInstallers(t *testing.T, ds *Datastore) {
 	err = ds.DeleteSoftwareInstaller(ctx, swi)
 	require.NoError(t, err)
 
-	err = ds.CleanupUnusedSoftwareInstallers(ctx, store)
+	// would clean up, but not created before 1m ago
+	err = ds.CleanupUnusedSoftwareInstallers(ctx, store, time.Now().Add(-time.Minute))
+	require.NoError(t, err)
+	assertExisting([]string{ins0})
+
+	// do actual cleanup
+	err = ds.CleanupUnusedSoftwareInstallers(ctx, store, time.Now().Add(time.Minute))
 	require.NoError(t, err)
 	assertExisting(nil)
 }
@@ -397,6 +608,8 @@ func testBatchSetSoftwareInstallers(t *testing.T, ds *Datastore) {
 	team, err := ds.NewTeam(ctx, &fleet.Team{Name: t.Name()})
 	require.NoError(t, err)
 
+	user1 := test.NewUser(t, ds, "Alice", "alice@example.com", true)
+
 	// TODO(roberto): perform better assertions, we should have evertything
 	// to check that the actual values of everything match.
 	assertSoftware := func(wantTitles []fleet.SoftwareTitle) {
@@ -419,9 +632,15 @@ func testBatchSetSoftwareInstallers(t *testing.T, ds *Datastore) {
 	// batch set with everything empty
 	err = ds.BatchSetSoftwareInstallers(ctx, &team.ID, nil)
 	require.NoError(t, err)
+	softwareInstallers, err := ds.GetSoftwareInstallers(ctx, team.ID)
+	require.NoError(t, err)
+	require.Empty(t, softwareInstallers)
 	assertSoftware(nil)
 	err = ds.BatchSetSoftwareInstallers(ctx, &team.ID, []*fleet.UploadSoftwareInstallerPayload{})
 	require.NoError(t, err)
+	softwareInstallers, err = ds.GetSoftwareInstallers(ctx, team.ID)
+	require.NoError(t, err)
+	require.Empty(t, softwareInstallers)
 	assertSoftware(nil)
 
 	// add a single installer
@@ -436,8 +655,18 @@ func testBatchSetSoftwareInstallers(t *testing.T, ds *Datastore) {
 		Source:          "apps",
 		Version:         "1",
 		PreInstallQuery: "foo",
+		UserID:          user1.ID,
+		Platform:        "darwin",
+		URL:             "https://example.com",
 	}})
 	require.NoError(t, err)
+	softwareInstallers, err = ds.GetSoftwareInstallers(ctx, team.ID)
+	require.NoError(t, err)
+	require.Len(t, softwareInstallers, 1)
+	require.NotNil(t, softwareInstallers[0].TeamID)
+	require.Equal(t, team.ID, *softwareInstallers[0].TeamID)
+	require.NotNil(t, softwareInstallers[0].TitleID)
+	require.Equal(t, "https://example.com", softwareInstallers[0].URL)
 	assertSoftware([]fleet.SoftwareTitle{
 		{Name: ins0, Source: "apps", Browser: ""},
 	})
@@ -455,6 +684,9 @@ func testBatchSetSoftwareInstallers(t *testing.T, ds *Datastore) {
 			Source:          "apps",
 			Version:         "1",
 			PreInstallQuery: "select 0 from foo;",
+			UserID:          user1.ID,
+			Platform:        "darwin",
+			URL:             "https://example.com",
 		},
 		{
 			InstallScript:     "install",
@@ -466,9 +698,23 @@ func testBatchSetSoftwareInstallers(t *testing.T, ds *Datastore) {
 			Source:            "apps",
 			Version:           "2",
 			PreInstallQuery:   "select 1 from bar;",
+			UserID:            user1.ID,
+			Platform:          "darwin",
+			URL:               "https://example2.com",
 		},
 	})
 	require.NoError(t, err)
+	softwareInstallers, err = ds.GetSoftwareInstallers(ctx, team.ID)
+	require.NoError(t, err)
+	require.Len(t, softwareInstallers, 2)
+	require.NotNil(t, softwareInstallers[0].TitleID)
+	require.NotNil(t, softwareInstallers[0].TeamID)
+	require.Equal(t, team.ID, *softwareInstallers[0].TeamID)
+	require.Equal(t, "https://example.com", softwareInstallers[0].URL)
+	require.NotNil(t, softwareInstallers[1].TitleID)
+	require.NotNil(t, softwareInstallers[1].TeamID)
+	require.Equal(t, team.ID, *softwareInstallers[1].TeamID)
+	require.Equal(t, "https://example2.com", softwareInstallers[1].URL)
 	assertSoftware([]fleet.SoftwareTitle{
 		{Name: ins0, Source: "apps", Browser: ""},
 		{Name: ins1, Source: "apps", Browser: ""},
@@ -486,9 +732,16 @@ func testBatchSetSoftwareInstallers(t *testing.T, ds *Datastore) {
 			Source:            "apps",
 			Version:           "2",
 			PreInstallQuery:   "select 1 from bar;",
+			UserID:            user1.ID,
 		},
 	})
 	require.NoError(t, err)
+	softwareInstallers, err = ds.GetSoftwareInstallers(ctx, team.ID)
+	require.NoError(t, err)
+	require.Len(t, softwareInstallers, 1)
+	require.NotNil(t, softwareInstallers[0].TitleID)
+	require.NotNil(t, softwareInstallers[0].TeamID)
+	require.Empty(t, softwareInstallers[0].URL)
 	assertSoftware([]fleet.SoftwareTitle{
 		{Name: ins1, Source: "apps", Browser: ""},
 	})
@@ -496,6 +749,9 @@ func testBatchSetSoftwareInstallers(t *testing.T, ds *Datastore) {
 	// remove everything
 	err = ds.BatchSetSoftwareInstallers(ctx, &team.ID, []*fleet.UploadSoftwareInstallerPayload{})
 	require.NoError(t, err)
+	softwareInstallers, err = ds.GetSoftwareInstallers(ctx, team.ID)
+	require.NoError(t, err)
+	require.Empty(t, softwareInstallers)
 	assertSoftware([]fleet.SoftwareTitle{})
 }
 
@@ -503,6 +759,7 @@ func testGetSoftwareInstallerMetadataByTeamAndTitleID(t *testing.T, ds *Datastor
 	ctx := context.Background()
 	team, err := ds.NewTeam(ctx, &fleet.Team{Name: "team 2"})
 	require.NoError(t, err)
+	user1 := test.NewUser(t, ds, "Alice", "alice@example.com", true)
 
 	installerID, err := ds.MatchOrCreateSoftwareInstaller(ctx, &fleet.UploadSoftwareInstallerPayload{
 		Title:             "foo",
@@ -512,10 +769,13 @@ func testGetSoftwareInstallerMetadataByTeamAndTitleID(t *testing.T, ds *Datastor
 		PreInstallQuery:   "SELECT 1",
 		TeamID:            &team.ID,
 		Filename:          "foo.pkg",
+		Platform:          "darwin",
+		UserID:            user1.ID,
 	})
 	require.NoError(t, err)
 	installerMeta, err := ds.GetSoftwareInstallerMetadataByID(ctx, installerID)
 	require.NoError(t, err)
+	require.Equal(t, "darwin", installerMeta.Platform)
 
 	metaByTeamAndTitle, err := ds.GetSoftwareInstallerMetadataByTeamAndTitleID(ctx, &team.ID, *installerMeta.TitleID, true)
 	require.NoError(t, err)
@@ -530,6 +790,7 @@ func testGetSoftwareInstallerMetadataByTeamAndTitleID(t *testing.T, ds *Datastor
 		InstallScript: "echo install",
 		TeamID:        &team.ID,
 		Filename:      "foo.pkg",
+		UserID:        user1.ID,
 	})
 	require.NoError(t, err)
 	installerMeta, err = ds.GetSoftwareInstallerMetadataByID(ctx, installerID)
@@ -548,6 +809,9 @@ func testHasSelfServiceSoftwareInstallers(t *testing.T, ds *Datastore) {
 
 	team, err := ds.NewTeam(ctx, &fleet.Team{Name: "team 2"})
 	require.NoError(t, err)
+	user1 := test.NewUser(t, ds, "Alice", "alice@example.com", true)
+
+	test.CreateInsertGlobalVPPToken(t, ds)
 
 	const platform = "linux"
 	// No installers
@@ -567,6 +831,7 @@ func testHasSelfServiceSoftwareInstallers(t *testing.T, ds *Datastore) {
 		Filename:      "foo.pkg",
 		Platform:      platform,
 		SelfService:   false,
+		UserID:        user1.ID,
 	})
 	require.NoError(t, err)
 	hasSelfService, err = ds.HasSelfServiceSoftwareInstallers(ctx, platform, nil)
@@ -585,6 +850,7 @@ func testHasSelfServiceSoftwareInstallers(t *testing.T, ds *Datastore) {
 		Filename:      "foo2.pkg",
 		Platform:      platform,
 		SelfService:   true,
+		UserID:        user1.ID,
 	})
 	require.NoError(t, err)
 	hasSelfService, err = ds.HasSelfServiceSoftwareInstallers(ctx, platform, nil)
@@ -594,6 +860,26 @@ func testHasSelfServiceSoftwareInstallers(t *testing.T, ds *Datastore) {
 	require.NoError(t, err)
 	assert.True(t, hasSelfService)
 
+	// Create a non self-service VPP for global/linux (not truly possible as VPP is Apple but for testing)
+	_, err = ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_1", Platform: platform}}, Name: "vpp1", BundleIdentifier: "com.app.vpp1"}, nil)
+	require.NoError(t, err)
+	hasSelfService, err = ds.HasSelfServiceSoftwareInstallers(ctx, platform, nil)
+	require.NoError(t, err)
+	assert.False(t, hasSelfService)
+	hasSelfService, err = ds.HasSelfServiceSoftwareInstallers(ctx, platform, &team.ID)
+	require.NoError(t, err)
+	assert.True(t, hasSelfService)
+
+	// Create a self-service VPP for global/linux (not truly possible as VPP is Apple but for testing)
+	_, err = ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_2", Platform: platform}, SelfService: true}, Name: "vpp2", BundleIdentifier: "com.app.vpp2"}, nil)
+	require.NoError(t, err)
+	hasSelfService, err = ds.HasSelfServiceSoftwareInstallers(ctx, platform, nil)
+	require.NoError(t, err)
+	assert.True(t, hasSelfService)
+	hasSelfService, err = ds.HasSelfServiceSoftwareInstallers(ctx, platform, &team.ID)
+	require.NoError(t, err)
+	assert.True(t, hasSelfService)
+
 	// Create a global self-service installer
 	_, err = ds.MatchOrCreateSoftwareInstaller(ctx, &fleet.UploadSoftwareInstallerPayload{
 		Title:         "foo global",
@@ -603,6 +889,7 @@ func testHasSelfServiceSoftwareInstallers(t *testing.T, ds *Datastore) {
 		Filename:      "foo global.pkg",
 		Platform:      platform,
 		SelfService:   true,
+		UserID:        user1.ID,
 	})
 	require.NoError(t, err)
 	hasSelfService, err = ds.HasSelfServiceSoftwareInstallers(ctx, "ubuntu", nil)
@@ -612,11 +899,202 @@ func testHasSelfServiceSoftwareInstallers(t *testing.T, ds *Datastore) {
 	require.NoError(t, err)
 	assert.True(t, hasSelfService)
 
-	// Check another platform
+	// Create a self-service VPP for team/darwin
+	_, err = ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_3", Platform: fleet.MacOSPlatform}, SelfService: true}, Name: "vpp3", BundleIdentifier: "com.app.vpp3"}, &team.ID)
+	require.NoError(t, err)
+	// Check darwin
 	hasSelfService, err = ds.HasSelfServiceSoftwareInstallers(ctx, "darwin", nil)
 	require.NoError(t, err)
 	assert.False(t, hasSelfService)
 	hasSelfService, err = ds.HasSelfServiceSoftwareInstallers(ctx, "darwin", &team.ID)
 	require.NoError(t, err)
-	assert.False(t, hasSelfService)
+	assert.True(t, hasSelfService)
+}
+
+func testDeleteSoftwareInstallersAssignedToPolicy(t *testing.T, ds *Datastore) {
+	ctx := context.Background()
+
+	dir := t.TempDir()
+	store, err := filesystem.NewSoftwareInstallerStore(dir)
+	require.NoError(t, err)
+
+	user1 := test.NewUser(t, ds, "Alice", "alice@example.com", true)
+
+	// put an installer and save it in the DB
+	ins0 := "installer.pkg"
+	ins0File := bytes.NewReader([]byte("installer0"))
+	err = store.Put(ctx, ins0, ins0File)
+	require.NoError(t, err)
+
+	team1, err := ds.NewTeam(ctx, &fleet.Team{Name: "team1"})
+	require.NoError(t, err)
+
+	softwareInstallerID, err := ds.MatchOrCreateSoftwareInstaller(ctx, &fleet.UploadSoftwareInstallerPayload{
+		InstallScript: "install",
+		InstallerFile: ins0File,
+		StorageID:     ins0,
+		Filename:      "installer.pkg",
+		Title:         "ins0",
+		Source:        "apps",
+		Platform:      "darwin",
+		TeamID:        &team1.ID,
+		UserID:        user1.ID,
+	})
+	require.NoError(t, err)
+
+	p1, err := ds.NewTeamPolicy(ctx, team1.ID, &user1.ID, fleet.PolicyPayload{
+		Name:                "p1",
+		Query:               "SELECT 1;",
+		SoftwareInstallerID: &softwareInstallerID,
+	})
+	require.NoError(t, err)
+
+	err = ds.DeleteSoftwareInstaller(ctx, softwareInstallerID)
+	require.Error(t, err)
+	require.ErrorIs(t, err, errDeleteInstallerWithAssociatedPolicy)
+
+	_, err = ds.DeleteTeamPolicies(ctx, team1.ID, []uint{p1.ID})
+	require.NoError(t, err)
+
+	err = ds.DeleteSoftwareInstaller(ctx, softwareInstallerID)
+	require.NoError(t, err)
+}
+
+func testGetHostLastInstallData(t *testing.T, ds *Datastore) {
+	ctx := context.Background()
+
+	team1, err := ds.NewTeam(ctx, &fleet.Team{Name: "team1"})
+	require.NoError(t, err)
+	user1 := test.NewUser(t, ds, "Alice", "alice@example.com", true)
+
+	host1 := test.NewHost(t, ds, "host1", "1", "host1key", "host1uuid", time.Now(), test.WithTeamID(team1.ID))
+	host2 := test.NewHost(t, ds, "host2", "2", "host2key", "host2uuid", time.Now(), test.WithTeamID(team1.ID))
+
+	dir := t.TempDir()
+	store, err := filesystem.NewSoftwareInstallerStore(dir)
+	require.NoError(t, err)
+
+	// put an installer and save it in the DB
+	ins0 := "installer.pkg"
+	ins0File := bytes.NewReader([]byte("installer0"))
+	err = store.Put(ctx, ins0, ins0File)
+	require.NoError(t, err)
+
+	softwareInstallerID1, err := ds.MatchOrCreateSoftwareInstaller(ctx, &fleet.UploadSoftwareInstallerPayload{
+		InstallScript: "install",
+		InstallerFile: ins0File,
+		StorageID:     ins0,
+		Filename:      "installer.pkg",
+		Title:         "ins1",
+		Source:        "apps",
+		Platform:      "darwin",
+		TeamID:        &team1.ID,
+		UserID:        user1.ID,
+	})
+	require.NoError(t, err)
+	softwareInstallerID2, err := ds.MatchOrCreateSoftwareInstaller(ctx, &fleet.UploadSoftwareInstallerPayload{
+		InstallScript: "install2",
+		InstallerFile: ins0File,
+		StorageID:     ins0,
+		Filename:      "installer2.pkg",
+		Title:         "ins2",
+		Source:        "apps",
+		Platform:      "darwin",
+		TeamID:        &team1.ID,
+		UserID:        user1.ID,
+	})
+	require.NoError(t, err)
+
+	// No installations on host1 yet.
+	host1LastInstall, err := ds.GetHostLastInstallData(ctx, host1.ID, softwareInstallerID1)
+	require.NoError(t, err)
+	require.Nil(t, host1LastInstall)
+
+	// Install installer.pkg on host1.
+	installUUID1, err := ds.InsertSoftwareInstallRequest(ctx, host1.ID, softwareInstallerID1, false)
+	require.NoError(t, err)
+	require.NotEmpty(t, installUUID1)
+
+	// Last installation should be pending.
+	host1LastInstall, err = ds.GetHostLastInstallData(ctx, host1.ID, softwareInstallerID1)
+	require.NoError(t, err)
+	require.NotNil(t, host1LastInstall)
+	require.Equal(t, installUUID1, host1LastInstall.ExecutionID)
+	require.NotNil(t, host1LastInstall.Status)
+	require.Equal(t, fleet.SoftwareInstallPending, *host1LastInstall.Status)
+
+	// Set result of last installation.
+	err = ds.SetHostSoftwareInstallResult(ctx, &fleet.HostSoftwareInstallResultPayload{
+		HostID:      host1.ID,
+		InstallUUID: installUUID1,
+
+		InstallScriptExitCode: ptr.Int(0),
+	})
+	require.NoError(t, err)
+
+	// Last installation should be "installed".
+	host1LastInstall, err = ds.GetHostLastInstallData(ctx, host1.ID, softwareInstallerID1)
+	require.NoError(t, err)
+	require.NotNil(t, host1LastInstall)
+	require.Equal(t, installUUID1, host1LastInstall.ExecutionID)
+	require.NotNil(t, host1LastInstall.Status)
+	require.Equal(t, fleet.SoftwareInstalled, *host1LastInstall.Status)
+
+	// Install installer2.pkg on host1.
+	installUUID2, err := ds.InsertSoftwareInstallRequest(ctx, host1.ID, softwareInstallerID2, false)
+	require.NoError(t, err)
+	require.NotEmpty(t, installUUID2)
+
+	// Last installation for installer1.pkg should be "installed".
+	host1LastInstall, err = ds.GetHostLastInstallData(ctx, host1.ID, softwareInstallerID1)
+	require.NoError(t, err)
+	require.NotNil(t, host1LastInstall)
+	require.Equal(t, installUUID1, host1LastInstall.ExecutionID)
+	require.NotNil(t, host1LastInstall.Status)
+	require.Equal(t, fleet.SoftwareInstalled, *host1LastInstall.Status)
+	// Last installation for installer2.pkg should be "pending".
+	host1LastInstall, err = ds.GetHostLastInstallData(ctx, host1.ID, softwareInstallerID2)
+	require.NoError(t, err)
+	require.NotNil(t, host1LastInstall)
+	require.Equal(t, installUUID2, host1LastInstall.ExecutionID)
+	require.NotNil(t, host1LastInstall.Status)
+	require.Equal(t, fleet.SoftwareInstallPending, *host1LastInstall.Status)
+
+	// Perform another installation of installer1.pkg.
+	installUUID3, err := ds.InsertSoftwareInstallRequest(ctx, host1.ID, softwareInstallerID1, false)
+	require.NoError(t, err)
+	require.NotEmpty(t, installUUID3)
+
+	// Last installation for installer1.pkg should be "pending" again.
+	host1LastInstall, err = ds.GetHostLastInstallData(ctx, host1.ID, softwareInstallerID1)
+	require.NoError(t, err)
+	require.NotNil(t, host1LastInstall)
+	require.Equal(t, installUUID3, host1LastInstall.ExecutionID)
+	require.NotNil(t, host1LastInstall.Status)
+	require.Equal(t, fleet.SoftwareInstallPending, *host1LastInstall.Status)
+
+	// Set result of last installer1.pkg installation.
+	err = ds.SetHostSoftwareInstallResult(ctx, &fleet.HostSoftwareInstallResultPayload{
+		HostID:      host1.ID,
+		InstallUUID: installUUID3,
+
+		InstallScriptExitCode: ptr.Int(1),
+	})
+	require.NoError(t, err)
+
+	// Last installation for installer1.pkg should be "failed".
+	host1LastInstall, err = ds.GetHostLastInstallData(ctx, host1.ID, softwareInstallerID1)
+	require.NoError(t, err)
+	require.NotNil(t, host1LastInstall)
+	require.Equal(t, installUUID3, host1LastInstall.ExecutionID)
+	require.NotNil(t, host1LastInstall.Status)
+	require.Equal(t, fleet.SoftwareInstallFailed, *host1LastInstall.Status)
+
+	// No installations on host2.
+	host2LastInstall, err := ds.GetHostLastInstallData(ctx, host2.ID, softwareInstallerID1)
+	require.NoError(t, err)
+	require.Nil(t, host2LastInstall)
+	host2LastInstall, err = ds.GetHostLastInstallData(ctx, host2.ID, softwareInstallerID2)
+	require.NoError(t, err)
+	require.Nil(t, host2LastInstall)
 }
diff --git a/server/datastore/mysql/software_test.go b/server/datastore/mysql/software_test.go
index b069975f9c..0fabe761f7 100644
--- a/server/datastore/mysql/software_test.go
+++ b/server/datastore/mysql/software_test.go
@@ -1,6 +1,7 @@
 package mysql
 
 import (
+	"bytes"
 	"context"
 	"database/sql"
 	"encoding/hex"
@@ -66,6 +67,9 @@ func TestSoftware(t *testing.T) {
 		{"ListHostSoftware", testListHostSoftware},
 		{"ListIOSHostSoftware", testListIOSHostSoftware},
 		{"SetHostSoftwareInstallResult", testSetHostSoftwareInstallResult},
+		{"ListHostSoftwareInstallThenTransferTeam", testListHostSoftwareInstallThenTransferTeam},
+		{"ListHostSoftwareInstallThenDeleteInstallers", testListHostSoftwareInstallThenDeleteInstallers},
+		{"ListSoftwareVersionsVulnerabilityFilters", testListSoftwareVersionsVulnerabilityFilters},
 	}
 	for _, c := range cases {
 		t.Run(c.name, func(t *testing.T) {
@@ -1954,11 +1958,14 @@ func testInsertSoftwareVulnerability(t *testing.T, ds *Datastore) {
 		require.NoError(t, err)
 		require.True(t, inserted)
 
-		inserted, err = ds.InsertSoftwareVulnerability(ctx, fleet.SoftwareVulnerability{
+		// Sleep so that the updated_at timestamp is guaranteed to be updated.
+		time.Sleep(1 * time.Second)
+		insertedOrUpdated, err := ds.InsertSoftwareVulnerability(ctx, fleet.SoftwareVulnerability{
 			SoftwareID: host.Software[0].ID, CVE: "cve-1",
 		}, fleet.UbuntuOVALSource)
 		require.NoError(t, err)
-		require.False(t, inserted)
+		// This will always return true because we always update the timestamp
+		assert.True(t, insertedOrUpdated)
 
 		storedVulns, err := ds.ListSoftwareVulnerabilitiesByHostIDsSource(ctx, []uint{host.ID}, fleet.UbuntuOVALSource)
 		require.NoError(t, err)
@@ -1997,9 +2004,12 @@ func testInsertSoftwareVulnerability(t *testing.T, ds *Datastore) {
 		require.NoError(t, err)
 		require.True(t, inserted)
 
-		inserted, err = ds.InsertSoftwareVulnerability(ctx, vulns[0], fleet.UbuntuOVALSource)
+		// Sleep so that the updated_at timestamp is guaranteed to be updated.
+		time.Sleep(1 * time.Second)
+		insertedOrUpdated, err := ds.InsertSoftwareVulnerability(ctx, vulns[0], fleet.UbuntuOVALSource)
 		require.NoError(t, err)
-		require.False(t, inserted)
+		// This will always return true because we always update the timestamp
+		assert.True(t, insertedOrUpdated)
 
 		storedVulns, err := ds.ListSoftwareVulnerabilitiesByHostIDsSource(ctx, []uint{host.ID}, fleet.UbuntuOVALSource)
 		require.NoError(t, err)
@@ -2563,9 +2573,9 @@ func testDeleteOutOfDateVulnerabilities(t *testing.T, ds *Datastore) {
 	require.NoError(t, err)
 
 	// This should update the 'updated_at' timestamp.
-	inserted, err = ds.InsertSoftwareVulnerability(ctx, vulns[0], fleet.NVDSource)
+	insertedOrUpdated, err := ds.InsertSoftwareVulnerability(ctx, vulns[0], fleet.NVDSource)
 	require.NoError(t, err)
-	require.False(t, inserted)
+	assert.True(t, insertedOrUpdated)
 
 	err = ds.DeleteOutOfDateVulnerabilities(ctx, fleet.NVDSource, 2*time.Hour)
 	require.NoError(t, err)
@@ -3157,7 +3167,7 @@ func testListHostSoftware(t *testing.T, ds *Datastore) {
 	host := test.NewHost(t, ds, "host1", "", "host1key", "host1uuid", time.Now(), test.WithPlatform("darwin"))
 	nanoEnroll(t, ds, host, false)
 	otherHost := test.NewHost(t, ds, "host2", "", "host2key", "host2uuid", time.Now(), test.WithPlatform("linux"))
-	opts := fleet.HostSoftwareTitleListOptions{ListOptions: fleet.ListOptions{PerPage: 10, IncludeMetadata: true, OrderKey: "name", TestSecondaryOrderKey: "source"}}
+	opts := fleet.HostSoftwareTitleListOptions{ListOptions: fleet.ListOptions{PerPage: 11, IncludeMetadata: true, OrderKey: "name", TestSecondaryOrderKey: "source"}}
 
 	user, err := ds.NewUser(ctx, &fleet.User{
 		Password:   []byte("p4ssw0rd.123"),
@@ -3167,6 +3177,8 @@ func testListHostSoftware(t *testing.T, ds *Datastore) {
 	})
 	require.NoError(t, err)
 
+	test.CreateInsertGlobalVPPToken(t, ds)
+
 	expectStatus := func(s fleet.SoftwareInstallerStatus) *fleet.SoftwareInstallerStatus {
 		return &s
 	}
@@ -3185,14 +3197,14 @@ func testListHostSoftware(t *testing.T, ds *Datastore) {
 	require.Equal(t, &fleet.PaginationMetadata{}, meta)
 
 	// available for install only works too
-	opts.AvailableForInstall = true
+	opts.OnlyAvailableForInstall = true
 	sw, meta, err = ds.ListHostSoftware(ctx, host, opts)
 	require.NoError(t, err)
 	assert.Empty(t, sw)
 	assert.Equal(t, &fleet.PaginationMetadata{}, meta)
 
 	// self-service only works too
-	opts.AvailableForInstall = false
+	opts.OnlyAvailableForInstall = false
 	opts.SelfServiceOnly = true
 	opts.IncludeAvailableForInstall = true
 	sw, meta, err = ds.ListHostSoftware(ctx, host, opts)
@@ -3214,6 +3226,7 @@ func testListHostSoftware(t *testing.T, ds *Datastore) {
 		{Name: "c", Version: "0.0.4", Source: "deb_packages"},
 		{Name: "c", Version: "0.0.5", Source: "deb_packages"},
 		{Name: "d", Version: "0.0.6", Source: "deb_packages"},
+		{Name: "e", Version: "0.0.2", Source: "deb_packages"}, // not vulnerable version
 	}
 	byNSV := map[string]fleet.Software{}
 	for _, s := range software {
@@ -3251,9 +3264,21 @@ func testListHostSoftware(t *testing.T, ds *Datastore) {
 	otherSoftware := []fleet.Software{
 		{Name: "a", Version: "0.0.7", Source: "chrome_extensions"},
 		{Name: "f", Version: "0.0.8", Source: "chrome_extensions"},
+		{Name: "e", Version: "0.0.1", Source: "deb_packages"}, // vulnerable version
 	}
-	_, err = ds.UpdateHostSoftware(ctx, otherHost.ID, otherSoftware)
+	otherSoftwareByNSV := map[string]fleet.Software{}
+	for _, s := range otherSoftware {
+		otherSoftwareByNSV[s.Name+s.Source+s.Version] = s
+	}
+	otherMutationResults, err := ds.UpdateHostSoftware(ctx, otherHost.ID, otherSoftware)
 	require.NoError(t, err)
+	for _, m := range otherMutationResults.Inserted {
+		s, ok := otherSoftwareByNSV[m.Name+m.Source+m.Version]
+		require.True(t, ok)
+		s.ID = m.ID
+		otherSoftwareByNSV[s.Name+s.Source+s.Version] = s
+	}
+	require.NoError(t, ds.LoadHostSoftware(ctx, otherHost, false))
 
 	// shorthand keys for expected software
 	a1 := software[0].Name + software[0].Source + software[0].Version
@@ -3262,6 +3287,10 @@ func testListHostSoftware(t *testing.T, ds *Datastore) {
 	c1 := software[3].Name + software[3].Source + software[3].Version
 	c2 := software[4].Name + software[4].Source + software[4].Version
 	d := software[5].Name + software[5].Source + software[5].Version
+	e2 := software[6].Name + software[6].Source + software[6].Version
+
+	// shorthand keys for other software
+	e1 := otherSoftware[2].Name + otherSoftware[2].Source + otherSoftware[2].Version
 
 	// add some vulnerabilities and installed paths
 	vulns := []fleet.SoftwareVulnerability{
@@ -3269,6 +3298,7 @@ func testListHostSoftware(t *testing.T, ds *Datastore) {
 		{SoftwareID: byNSV[a1].ID, CVE: "CVE-a-0002"},
 		{SoftwareID: byNSV[a1].ID, CVE: "CVE-a-0003"},
 		{SoftwareID: byNSV[b].ID, CVE: "CVE-b-0001"},
+		{SoftwareID: otherSoftwareByNSV[e1].ID, CVE: "CVE-e-0001"},
 	}
 	for _, v := range vulns {
 		_, err = ds.InsertSoftwareVulnerability(ctx, v, fleet.NVDSource)
@@ -3308,14 +3338,33 @@ func testListHostSoftware(t *testing.T, ds *Datastore) {
 		byNSV[d].Name + byNSV[d].Source: {Name: byNSV[d].Name, Source: byNSV[d].Source, InstalledVersions: []*fleet.HostSoftwareInstalledVersion{
 			{Version: byNSV[d].Version, InstalledPaths: []string{installPaths[5]}},
 		}},
+		byNSV[e2].Name + byNSV[e2].Source: {Name: byNSV[e2].Name, Source: byNSV[e2].Source, InstalledVersions: []*fleet.HostSoftwareInstalledVersion{
+			{Version: byNSV[e2].Version, InstalledPaths: []string{installPaths[6]}},
+		}},
 	}
 
 	compareResults := func(expected map[string]fleet.HostSoftwareWithInstaller, got []*fleet.HostSoftwareWithInstaller, expectAsc bool, expectOmitted ...string) {
-		require.Len(t, got, len(expected)-len(expectOmitted))
+		gotToString := func() string {
+			var builder strings.Builder
+			builder.WriteString("Got:\n")
+			for _, g := range got {
+				builder.WriteString(fmt.Sprintf("%+v\n", g))
+			}
+			return builder.String()
+		}
+		require.Len(t, got, len(expected)-len(expectOmitted), gotToString())
 		prev := ""
 		for _, g := range got {
+
+			for _, omit := range expectOmitted {
+				if g.Name+g.Source == omit {
+					t.Errorf("Did not expect %s in results", omit)
+					continue
+				}
+			}
+
 			e, ok := expected[g.Name+g.Source]
-			require.True(t, ok)
+			require.True(t, ok, "unexpected software %s%s", g.Name, g.Source)
 			require.Equal(t, e.Name, g.Name)
 			require.Equal(t, e.Source, g.Source)
 			if e.SoftwarePackage != nil {
@@ -3329,6 +3378,10 @@ func testListHostSoftware(t *testing.T, ds *Datastore) {
 					require.Equal(t, e.SoftwarePackage.LastInstall.InstallUUID, g.SoftwarePackage.LastInstall.InstallUUID)
 					require.NotNil(t, g.SoftwarePackage.LastInstall.InstalledAt)
 				}
+				if e.SoftwarePackage.LastUninstall != nil {
+					assert.Equal(t, e.SoftwarePackage.LastUninstall.ExecutionID, g.SoftwarePackage.LastUninstall.ExecutionID)
+					assert.NotNil(t, g.SoftwarePackage.LastUninstall.UninstalledAt)
+				}
 			}
 
 			if e.AppStoreApp != nil {
@@ -3375,30 +3428,31 @@ func testListHostSoftware(t *testing.T, ds *Datastore) {
 	opts.IncludeAvailableForInstall = false
 	sw, meta, err = ds.ListHostSoftware(ctx, host, opts)
 	require.NoError(t, err)
-	require.Equal(t, &fleet.PaginationMetadata{TotalResults: 5}, meta)
+	require.Equal(t, &fleet.PaginationMetadata{TotalResults: 6}, meta)
 	compareResults(expected, sw, true)
 
 	opts.VulnerableOnly = true
 	sw, meta, err = ds.ListHostSoftware(ctx, host, opts)
 	require.NoError(t, err)
 	require.Equal(t, &fleet.PaginationMetadata{TotalResults: 2}, meta)
-	compareResults(expected, sw, true, byNSV[a2].Name+byNSV[a2].Source, byNSV[c1].Name+byNSV[c1].Source, byNSV[d].Name+byNSV[d].Source)
+	compareResults(expected, sw, true, byNSV[a2].Name+byNSV[a2].Source, byNSV[c1].Name+byNSV[c1].Source, byNSV[d].Name+byNSV[d].Source, byNSV[e2].Name+byNSV[e2].Source)
 	opts.VulnerableOnly = false
 
 	// No software that is available for install
-	opts.AvailableForInstall = true
+	opts.OnlyAvailableForInstall = true
 	sw, meta, err = ds.ListHostSoftware(ctx, host, opts)
 	require.NoError(t, err)
 	assert.Empty(t, sw)
 	assert.Equal(t, &fleet.PaginationMetadata{}, meta)
-	opts.AvailableForInstall = false
+	opts.OnlyAvailableForInstall = false
 
 	// create some Fleet installers and map them to a software title,
 	// including one for a team
 	tm, err := ds.NewTeam(ctx, &fleet.Team{Name: "team1"})
 	require.NoError(t, err)
 
-	var swi1Pending, swi2Installed, swi3Failed, swi4Available, swi5Tm uint
+	const numberOfSoftwareInstallers = 8
+	var swi1Pending, swi2Installed, swi3Failed, swi4Available, swi5Tm, swi6PendingUninstall, swi7FailedUninstall, swi8Uninstalled uint
 	var otherHostI1UUID, otherHostI2UUID string
 	ExecAdhocSQL(t, ds, func(q sqlx.ExtContext) error {
 		// keep title id of software B, will use it to associate an installer with it
@@ -3416,10 +3470,19 @@ func testListHostSoftware(t *testing.T, ds *Datastore) {
 		}
 		scriptContentID, _ := res.LastInsertId()
 
+		// create the uninstall script content (same for all installers, doesn't matter)
+		uninstallScript := `echo 'bar'`
+		resUninstall, err := q.ExecContext(ctx, `INSERT INTO script_contents (md5_checksum, contents) VALUES (UNHEX(md5(?)), ?)`,
+			uninstallScript, uninstallScript)
+		if err != nil {
+			return err
+		}
+		uninstallScriptContentID, _ := resUninstall.LastInsertId()
+
 		// create software titles for all but swi1Pending (will be linked to
 		// existing software title b)
 		var titleIDs []uint
-		for i := 0; i < 4; i++ {
+		for i := 0; i < numberOfSoftwareInstallers-1; i++ {
 			res, err := q.ExecContext(ctx, `INSERT INTO software_titles (name, source) VALUES (?, 'apps')`, fmt.Sprintf("i%d", i))
 			if err != nil {
 				return err
@@ -3429,7 +3492,7 @@ func testListHostSoftware(t *testing.T, ds *Datastore) {
 		}
 
 		var swiIDs []uint
-		for i := 0; i < 5; i++ {
+		for i := 0; i < numberOfSoftwareInstallers; i++ {
 			var (
 				titleID        uint
 				teamID         *uint
@@ -3446,10 +3509,12 @@ func testListHostSoftware(t *testing.T, ds *Datastore) {
 			}
 			res, err := q.ExecContext(ctx, `
 						INSERT INTO software_installers
-							(team_id, global_or_team_id, title_id, filename, version, install_script_content_id, storage_id, platform, self_service)
+							(team_id, global_or_team_id, title_id, filename, extension, version, install_script_content_id, uninstall_script_content_id, storage_id, platform, self_service)
 						VALUES
-							(?, ?, ?, ?, ?, ?, unhex(?), ?, ?)`,
-				teamID, globalOrTeamID, titleID, fmt.Sprintf("installer-%d.pkg", i), fmt.Sprintf("v%d.0.0", i), scriptContentID, hex.EncodeToString([]byte("test")), "darwin", i < 2)
+							(?, ?, ?, ?, ?, ?, ?, ?, unhex(?), ?, ?)`,
+				teamID, globalOrTeamID, titleID, fmt.Sprintf("installer-%d.pkg", i), "pkg", fmt.Sprintf("v%d.0.0", i), scriptContentID,
+				uninstallScriptContentID,
+				hex.EncodeToString([]byte("test")), "darwin", i < 2)
 			if err != nil {
 				return err
 			}
@@ -3457,7 +3522,8 @@ func testListHostSoftware(t *testing.T, ds *Datastore) {
 			swiIDs = append(swiIDs, uint(id))
 		}
 		// sw1Pending and swi2Installed are self-service installers
-		swi1Pending, swi2Installed, swi3Failed, swi4Available, swi5Tm = swiIDs[0], swiIDs[1], swiIDs[2], swiIDs[3], swiIDs[4]
+		swi1Pending, swi2Installed, swi3Failed, swi4Available, swi5Tm,
+			swi6PendingUninstall, swi7FailedUninstall, swi8Uninstalled = swiIDs[0], swiIDs[1], swiIDs[2], swiIDs[3], swiIDs[4], swiIDs[5], swiIDs[6], swiIDs[7]
 
 		// create the results for the host
 
@@ -3506,21 +3572,31 @@ func testListHostSoftware(t *testing.T, ds *Datastore) {
 		// swi5 is for another team
 		_ = swi5Tm
 
-		// add another installer for a different platform, should be always omitted
-		res, err = q.ExecContext(ctx, `INSERT INTO software_titles (name, source) VALUES ('windows-title', 'programs')`)
-		if err != nil {
-			return err
-		}
-		lid, _ := res.LastInsertId()
+		// swi6 has been installed, and is pending uninstall
 		_, err = q.ExecContext(ctx, `
-						INSERT INTO software_installers
-							(team_id, global_or_team_id, title_id, filename, version, install_script_content_id, storage_id, platform)
-						VALUES
-							(?, ?, ?, ?, ?, ?, unhex(?), ?)`,
-			nil, 0, lid, "windows-installer-6.msi", "v6.0.0", scriptContentID, hex.EncodeToString([]byte("test")), "windows")
-		if err != nil {
-			return err
-		}
+							INSERT INTO host_software_installs (execution_id, host_id, software_installer_id, pre_install_query_output, install_script_exit_code, post_install_script_exit_code)
+							VALUES (?, ?, ?, ?, ?, ?)`,
+			"uuid6-pre", host.ID, swi6PendingUninstall, "ok", 0, 0)
+		require.NoError(t, err)
+		_, err = q.ExecContext(ctx, `
+							INSERT INTO host_software_installs (execution_id, host_id, software_installer_id, uninstall)
+							VALUES (?, ?, ?, ?)`,
+			"uuid6", host.ID, swi6PendingUninstall, 1)
+		require.NoError(t, err)
+
+		// swi7 is failed uninstall
+		_, err = q.ExecContext(ctx, `
+							INSERT INTO host_software_installs (execution_id, host_id, software_installer_id, uninstall, uninstall_script_exit_code)
+							VALUES (?, ?, ?, ?, ?)`,
+			"uuid7", host.ID, swi7FailedUninstall, 1, 1)
+		require.NoError(t, err)
+
+		// swi8 is successful uninstall
+		_, err = q.ExecContext(ctx, `
+							INSERT INTO host_software_installs (execution_id, host_id, software_installer_id, uninstall, uninstall_script_exit_code)
+							VALUES (?, ?, ?, ?, ?)`,
+			"uuid8", host.ID, swi8Uninstalled, 1, 0)
+		require.NoError(t, err)
 
 		return nil
 	})
@@ -3529,7 +3605,7 @@ func testListHostSoftware(t *testing.T, ds *Datastore) {
 	expected[byNSV[b].Name+byNSV[b].Source] = fleet.HostSoftwareWithInstaller{
 		Name:            "b",
 		Source:          "apps",
-		Status:          expectStatus(fleet.SoftwareInstallerPending),
+		Status:          expectStatus(fleet.SoftwareInstallPending),
 		SoftwarePackage: &fleet.SoftwarePackageOrApp{Name: "installer-0.pkg", Version: "v0.0.0", SelfService: ptr.Bool(true), LastInstall: &fleet.HostSoftwareInstall{InstallUUID: "uuid1"}},
 		InstalledVersions: []*fleet.HostSoftwareInstalledVersion{
 			{Version: byNSV[b].Version, Vulnerabilities: []string{vulns[3].CVE}, InstalledPaths: []string{installPaths[2]}},
@@ -3538,7 +3614,7 @@ func testListHostSoftware(t *testing.T, ds *Datastore) {
 	i0 := fleet.HostSoftwareWithInstaller{
 		Name:            "i0",
 		Source:          "apps",
-		Status:          expectStatus(fleet.SoftwareInstallerInstalled),
+		Status:          expectStatus(fleet.SoftwareInstalled),
 		SoftwarePackage: &fleet.SoftwarePackageOrApp{Name: "installer-1.pkg", Version: "v1.0.0", SelfService: ptr.Bool(true), LastInstall: &fleet.HostSoftwareInstall{InstallUUID: "uuid2"}},
 	}
 	expected[i0.Name+i0.Source] = i0
@@ -3546,16 +3622,50 @@ func testListHostSoftware(t *testing.T, ds *Datastore) {
 	i1 := fleet.HostSoftwareWithInstaller{
 		Name:            "i1",
 		Source:          "apps",
-		Status:          expectStatus(fleet.SoftwareInstallerFailed),
+		Status:          expectStatus(fleet.SoftwareInstallFailed),
 		SoftwarePackage: &fleet.SoftwarePackageOrApp{Name: "installer-2.pkg", Version: "v2.0.0", SelfService: ptr.Bool(false), LastInstall: &fleet.HostSoftwareInstall{InstallUUID: "uuid3"}},
 	}
 	expected[i1.Name+i1.Source] = i1
 
+	i4 := fleet.HostSoftwareWithInstaller{
+		Name:   "i4",
+		Source: "apps",
+		Status: expectStatus(fleet.SoftwareUninstallPending),
+		SoftwarePackage: &fleet.SoftwarePackageOrApp{
+			Name: "installer-5.pkg", Version: "v5.0.0", SelfService: ptr.Bool(false),
+			LastInstall:   &fleet.HostSoftwareInstall{InstallUUID: "uuid6-pre"},
+			LastUninstall: &fleet.HostSoftwareUninstall{ExecutionID: "uuid6"},
+		},
+	}
+	expected[i4.Name+i4.Source] = i4
+
+	i5 := fleet.HostSoftwareWithInstaller{
+		Name:   "i5",
+		Source: "apps",
+		Status: expectStatus(fleet.SoftwareUninstallFailed),
+		SoftwarePackage: &fleet.SoftwarePackageOrApp{
+			Name: "installer-6.pkg", Version: "v6.0.0", SelfService: ptr.Bool(false),
+			LastUninstall: &fleet.HostSoftwareUninstall{ExecutionID: "uuid7"},
+		},
+	}
+	expected[i5.Name+i5.Source] = i5
+
+	i6 := fleet.HostSoftwareWithInstaller{
+		Name:   "i6",
+		Source: "apps",
+		Status: nil,
+		SoftwarePackage: &fleet.SoftwarePackageOrApp{
+			Name: "installer-7.pkg", Version: "v7.0.0", SelfService: ptr.Bool(false),
+			LastUninstall: &fleet.HostSoftwareUninstall{ExecutionID: "uuid8"},
+		},
+	}
+	expected[i6.Name+i6.Source] = i6
+
 	// request without available software
 	opts.IncludeAvailableForInstall = false
 	sw, meta, err = ds.ListHostSoftware(ctx, host, opts)
 	require.NoError(t, err)
-	require.Equal(t, &fleet.PaginationMetadata{TotalResults: 7}, meta)
+	require.Equal(t, &fleet.PaginationMetadata{TotalResults: uint(len(expected))}, meta)
 	compareResults(expected, sw, true)
 
 	// request with available software
@@ -3579,18 +3689,24 @@ func testListHostSoftware(t *testing.T, ds *Datastore) {
 	opts.ListOptions.PerPage = 20
 	sw, meta, err = ds.ListHostSoftware(ctx, host, opts)
 	require.NoError(t, err)
-	require.Equal(t, &fleet.PaginationMetadata{TotalResults: 8}, meta)
+	require.Equal(t, &fleet.PaginationMetadata{TotalResults: uint(len(expected)) - 1}, meta)
 	compareResults(expected, sw, true, i3.Name+i3.Source)
 
-	// request with available software only
+	// request with available software only (attempted to install and never attempted to install)
 	expectedAvailableOnly := map[string]fleet.HostSoftwareWithInstaller{}
+	expectedAvailableOnly[byNSV[b].Name+byNSV[b].Source] = expected[byNSV[b].Name+byNSV[b].Source]
+	expectedAvailableOnly[i0.Name+i0.Source] = i0
+	expectedAvailableOnly[i1.Name+i1.Source] = i1
 	expectedAvailableOnly[i2.Name+i2.Source] = i2
-	opts.AvailableForInstall = true
+	expectedAvailableOnly[i4.Name+i4.Source] = i4
+	expectedAvailableOnly[i5.Name+i5.Source] = i5
+	expectedAvailableOnly[i6.Name+i6.Source] = i6
+	opts.OnlyAvailableForInstall = true
 	sw, meta, err = ds.ListHostSoftware(ctx, host, opts)
 	require.NoError(t, err)
-	assert.Equal(t, &fleet.PaginationMetadata{TotalResults: 1}, meta)
+	assert.Equal(t, &fleet.PaginationMetadata{TotalResults: uint(len(expectedAvailableOnly))}, meta)
 	compareResults(expectedAvailableOnly, sw, true)
-	opts.AvailableForInstall = false
+	opts.OnlyAvailableForInstall = false
 
 	// request in descending order
 	opts.ListOptions.OrderDirection = fleet.OrderDescending
@@ -3598,7 +3714,7 @@ func testListHostSoftware(t *testing.T, ds *Datastore) {
 	opts.IncludeAvailableForInstall = false
 	sw, meta, err = ds.ListHostSoftware(ctx, host, opts)
 	require.NoError(t, err)
-	require.Equal(t, &fleet.PaginationMetadata{TotalResults: 7}, meta)
+	require.Equal(t, &fleet.PaginationMetadata{TotalResults: uint(len(expected)) - 2}, meta)
 	compareResults(expected, sw, false, i2.Name+i2.Source, i3.Name+i3.Source)
 	opts.ListOptions.OrderDirection = fleet.OrderAscending
 	opts.ListOptions.TestSecondaryOrderDirection = fleet.OrderAscending
@@ -3627,7 +3743,7 @@ func testListHostSoftware(t *testing.T, ds *Datastore) {
 	expected[byNSV[b].Name+byNSV[b].Source] = fleet.HostSoftwareWithInstaller{
 		Name:            "b",
 		Source:          "apps",
-		Status:          expectStatus(fleet.SoftwareInstallerFailed),
+		Status:          expectStatus(fleet.SoftwareInstallFailed),
 		SoftwarePackage: &fleet.SoftwarePackageOrApp{Name: "installer-0.pkg", Version: "v0.0.0", SelfService: ptr.Bool(true), LastInstall: &fleet.HostSoftwareInstall{InstallUUID: "uuid1"}},
 		InstalledVersions: []*fleet.HostSoftwareInstalledVersion{
 			{Version: byNSV[b].Version, Vulnerabilities: []string{vulns[3].CVE}, InstalledPaths: []string{installPaths[2]}},
@@ -3636,22 +3752,24 @@ func testListHostSoftware(t *testing.T, ds *Datastore) {
 	expected[i1.Name+i1.Source] = fleet.HostSoftwareWithInstaller{
 		Name:            "i1",
 		Source:          "apps",
-		Status:          expectStatus(fleet.SoftwareInstallerPending),
+		Status:          expectStatus(fleet.SoftwareInstallPending),
 		SoftwarePackage: &fleet.SoftwarePackageOrApp{Name: "installer-2.pkg", Version: "v2.0.0", SelfService: ptr.Bool(false), LastInstall: &fleet.HostSoftwareInstall{InstallUUID: "uuid4"}},
 	}
+	expectedAvailableOnly[byNSV[b].Name+byNSV[b].Source] = expected[byNSV[b].Name+byNSV[b].Source]
+	expectedAvailableOnly[i1.Name+i1.Source] = expected[i1.Name+i1.Source]
 
 	// request without available software
 	opts.IncludeAvailableForInstall = false
 	sw, meta, err = ds.ListHostSoftware(ctx, host, opts)
 	require.NoError(t, err)
-	require.Equal(t, &fleet.PaginationMetadata{TotalResults: 7}, meta)
+	require.Equal(t, &fleet.PaginationMetadata{TotalResults: uint(len(expected)) - 2}, meta)
 	compareResults(expected, sw, true, i2.Name+i2.Source, i3.Name+i3.Source)
 
-	// request with available software)
+	// request with available software
 	opts.IncludeAvailableForInstall = true
 	sw, meta, err = ds.ListHostSoftware(ctx, host, opts)
 	require.NoError(t, err)
-	require.Equal(t, &fleet.PaginationMetadata{TotalResults: 8}, meta)
+	require.Equal(t, &fleet.PaginationMetadata{TotalResults: uint(len(expected)) - 1}, meta)
 	compareResults(expected, sw, true, i3.Name+i3.Source)
 
 	// create a new host in the team, with no software
@@ -3706,25 +3824,36 @@ func testListHostSoftware(t *testing.T, ds *Datastore) {
 
 	// add VPP apps, one for both no team and team, and two for no-team only.
 	va1, err := ds.InsertVPPAppWithTeam(ctx,
-		&fleet.VPPApp{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_1", Platform: fleet.MacOSPlatform}, Name: "vpp1",
-			BundleIdentifier: "com.app.vpp1"}, nil)
+		&fleet.VPPApp{
+			VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_1", Platform: fleet.MacOSPlatform}}, Name: "vpp1",
+			BundleIdentifier: "com.app.vpp1",
+		}, nil)
 	require.NoError(t, err)
 	_, err = ds.InsertVPPAppWithTeam(ctx,
-		&fleet.VPPApp{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_1", Platform: fleet.IOSPlatform}, Name: "vpp1",
-			BundleIdentifier: "com.app.vpp1"}, nil)
+		&fleet.VPPApp{
+			VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_1", Platform: fleet.IOSPlatform}}, Name: "vpp1",
+			BundleIdentifier: "com.app.vpp1",
+		}, nil)
 	require.NoError(t, err)
 	_, err = ds.InsertVPPAppWithTeam(ctx,
-		&fleet.VPPApp{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_1", Platform: fleet.MacOSPlatform}, Name: "vpp1",
-			BundleIdentifier: "com.app.vpp1"}, &tm.ID)
+		&fleet.VPPApp{
+			VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_1", Platform: fleet.MacOSPlatform}}, Name: "vpp1",
+			BundleIdentifier: "com.app.vpp1",
+		}, &tm.ID)
 	require.NoError(t, err)
 	vpp1 := va1.AdamID
 	va2, err := ds.InsertVPPAppWithTeam(ctx,
-		&fleet.VPPApp{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_2", Platform: fleet.MacOSPlatform}, Name: "vpp2",
-			BundleIdentifier: "com.app.vpp2"}, nil)
+		&fleet.VPPApp{
+			VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_2", Platform: fleet.MacOSPlatform}}, Name: "vpp2",
+			BundleIdentifier: "com.app.vpp2",
+		}, nil)
 	require.NoError(t, err)
+	// create vpp3 app that allows self-service
 	va3, err := ds.InsertVPPAppWithTeam(ctx,
-		&fleet.VPPApp{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_3", Platform: fleet.MacOSPlatform}, Name: "vpp3",
-			BundleIdentifier: "com.app.vpp3"}, nil)
+		&fleet.VPPApp{
+			VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_3", Platform: fleet.MacOSPlatform}, SelfService: true}, Name: "vpp3",
+			BundleIdentifier: "com.app.vpp3",
+		}, nil)
 	require.NoError(t, err)
 	vpp2, vpp3 := va2.AdamID, va3.AdamID
 
@@ -3747,44 +3876,46 @@ func testListHostSoftware(t *testing.T, ds *Datastore) {
 	expected["vpp1apps"] = fleet.HostSoftwareWithInstaller{
 		Name:        "vpp1",
 		Source:      "apps",
-		Status:      expectStatus(fleet.SoftwareInstallerInstalled),
-		AppStoreApp: &fleet.SoftwarePackageOrApp{AppStoreID: vpp1, LastInstall: &fleet.HostSoftwareInstall{CommandUUID: vpp1CmdUUID}},
+		Status:      expectStatus(fleet.SoftwareInstalled),
+		AppStoreApp: &fleet.SoftwarePackageOrApp{AppStoreID: vpp1, SelfService: ptr.Bool(false), LastInstall: &fleet.HostSoftwareInstall{CommandUUID: vpp1CmdUUID}},
 	}
 	expected["vpp2apps"] = fleet.HostSoftwareWithInstaller{
 		Name:        "vpp2",
 		Source:      "apps",
-		Status:      expectStatus(fleet.SoftwareInstallerPending),
-		AppStoreApp: &fleet.SoftwarePackageOrApp{AppStoreID: vpp2, LastInstall: &fleet.HostSoftwareInstall{CommandUUID: vpp2bCmdUUID}},
+		Status:      expectStatus(fleet.SoftwareInstallPending),
+		AppStoreApp: &fleet.SoftwarePackageOrApp{AppStoreID: vpp2, SelfService: ptr.Bool(false), LastInstall: &fleet.HostSoftwareInstall{CommandUUID: vpp2bCmdUUID}},
 	}
 
 	opts.IncludeAvailableForInstall = false
 	opts.ListOptions.MatchQuery = ""
 	sw, meta, err = ds.ListHostSoftware(ctx, host, opts)
 	require.NoError(t, err)
-	require.Equal(t, &fleet.PaginationMetadata{TotalResults: 9}, meta)
+	require.Equal(t, &fleet.PaginationMetadata{TotalResults: uint(len(expected)) - 2}, meta)
 	compareResults(expected, sw, true, i3.Name+i3.Source, i2.Name+i2.Source) // i3 is for team, i2 is available (excluded)
 
 	expected["vpp3apps"] = fleet.HostSoftwareWithInstaller{
 		Name:        "vpp3",
 		Source:      "apps",
 		Status:      nil,
-		AppStoreApp: &fleet.SoftwarePackageOrApp{AppStoreID: vpp3},
+		AppStoreApp: &fleet.SoftwarePackageOrApp{AppStoreID: vpp3, SelfService: ptr.Bool(true)},
 	}
+	expectedAvailableOnly["vpp1apps"] = expected["vpp1apps"]
+	expectedAvailableOnly["vpp2apps"] = expected["vpp2apps"]
 	expectedAvailableOnly["vpp3apps"] = expected["vpp3apps"]
 	opts.IncludeAvailableForInstall = true
 	opts.ListOptions.PerPage = 20
 	sw, meta, err = ds.ListHostSoftware(ctx, host, opts)
 	require.NoError(t, err)
-	require.Equal(t, &fleet.PaginationMetadata{TotalResults: 11}, meta)
+	require.Equal(t, &fleet.PaginationMetadata{TotalResults: uint(len(expected)) - 1}, meta)
 	compareResults(expected, sw, true, i3.Name+i3.Source) // i3 is for team
 
 	// Available for install only
-	opts.AvailableForInstall = true
+	opts.OnlyAvailableForInstall = true
 	sw, meta, err = ds.ListHostSoftware(ctx, host, opts)
 	require.NoError(t, err)
-	assert.Equal(t, &fleet.PaginationMetadata{TotalResults: 2}, meta)
+	assert.Equal(t, &fleet.PaginationMetadata{TotalResults: uint(len(expectedAvailableOnly))}, meta)
 	compareResults(expectedAvailableOnly, sw, true)
-	opts.AvailableForInstall = false
+	opts.OnlyAvailableForInstall = false
 
 	// team host sees available i3 and pending vpp1
 	opts.IncludeAvailableForInstall = true
@@ -3796,8 +3927,8 @@ func testListHostSoftware(t *testing.T, ds *Datastore) {
 		"vpp1apps": {
 			Name:        "vpp1",
 			Source:      "apps",
-			Status:      expectStatus(fleet.SoftwareInstallerPending),
-			AppStoreApp: &fleet.SoftwarePackageOrApp{AppStoreID: vpp1, LastInstall: &fleet.HostSoftwareInstall{CommandUUID: vpp1TmCmdUUID}},
+			Status:      expectStatus(fleet.SoftwareInstallPending),
+			AppStoreApp: &fleet.SoftwarePackageOrApp{AppStoreID: vpp1, SelfService: ptr.Bool(false), LastInstall: &fleet.HostSoftwareInstall{CommandUUID: vpp1TmCmdUUID}},
 		},
 	}, sw, true)
 
@@ -3805,7 +3936,7 @@ func testListHostSoftware(t *testing.T, ds *Datastore) {
 	opts.IncludeAvailableForInstall = true
 	sw, meta, err = ds.ListHostSoftware(ctx, otherHost, opts)
 	require.NoError(t, err)
-	require.Equal(t, &fleet.PaginationMetadata{TotalResults: 4}, meta)
+	require.Equal(t, &fleet.PaginationMetadata{TotalResults: 5}, meta)
 
 	expectedOther := map[string]fleet.HostSoftwareWithInstaller{
 		otherSoftware[0].Name + otherSoftware[0].Source: {Name: otherSoftware[0].Name, Source: otherSoftware[0].Source, InstalledVersions: []*fleet.HostSoftwareInstalledVersion{
@@ -3814,16 +3945,19 @@ func testListHostSoftware(t *testing.T, ds *Datastore) {
 		otherSoftware[1].Name + otherSoftware[1].Source: {Name: otherSoftware[1].Name, Source: otherSoftware[1].Source, InstalledVersions: []*fleet.HostSoftwareInstalledVersion{
 			{Version: otherSoftware[1].Version},
 		}},
+		otherSoftware[2].Name + otherSoftware[2].Source: {Name: otherSoftware[2].Name, Source: otherSoftware[2].Source, InstalledVersions: []*fleet.HostSoftwareInstalledVersion{
+			{Version: otherSoftware[2].Version, Vulnerabilities: []string{vulns[4].CVE}},
+		}},
 		"i1apps": {
 			Name:            "i1",
 			Source:          "apps",
-			Status:          expectStatus(fleet.SoftwareInstallerPending),
+			Status:          expectStatus(fleet.SoftwareInstallPending),
 			SoftwarePackage: &fleet.SoftwarePackageOrApp{Name: "installer-2.pkg", Version: "v2.0.0", SelfService: ptr.Bool(false), LastInstall: &fleet.HostSoftwareInstall{InstallUUID: otherHostI1UUID}},
 		},
 		"i2apps": {
 			Name:            "i2",
 			Source:          "apps",
-			Status:          expectStatus(fleet.SoftwareInstallerPending),
+			Status:          expectStatus(fleet.SoftwareInstallPending),
 			SoftwarePackage: &fleet.SoftwarePackageOrApp{Name: "installer-3.pkg", Version: "v3.0.0", SelfService: ptr.Bool(false), LastInstall: &fleet.HostSoftwareInstall{InstallUUID: otherHostI2UUID}},
 		},
 	}
@@ -3831,68 +3965,94 @@ func testListHostSoftware(t *testing.T, ds *Datastore) {
 
 	// test the pagination
 	cases := []struct {
+		name      string
 		opts      fleet.HostSoftwareTitleListOptions
 		wantNames []string
 		wantMeta  *fleet.PaginationMetadata
 	}{
 		{
-			opts:      fleet.HostSoftwareTitleListOptions{ListOptions: fleet.ListOptions{PerPage: 3}, IncludeAvailableForInstall: false},
-			wantNames: []string{byNSV[a1].Name, byNSV[a2].Name, byNSV[b].Name},
-			wantMeta:  &fleet.PaginationMetadata{HasNextResults: true, HasPreviousResults: false, TotalResults: 9},
+			name:      "No available for install software, page 0",
+			opts:      fleet.HostSoftwareTitleListOptions{ListOptions: fleet.ListOptions{PerPage: 5}, IncludeAvailableForInstall: false},
+			wantNames: []string{byNSV[a1].Name, byNSV[a2].Name, byNSV[b].Name, byNSV[c1].Name, byNSV[d].Name},
+			wantMeta:  &fleet.PaginationMetadata{HasNextResults: true, HasPreviousResults: false, TotalResults: 13},
 		},
 		{
-			opts:      fleet.HostSoftwareTitleListOptions{ListOptions: fleet.ListOptions{Page: 1, PerPage: 3}, IncludeAvailableForInstall: false},
-			wantNames: []string{byNSV[c1].Name, byNSV[d].Name, i0.Name},
-			wantMeta:  &fleet.PaginationMetadata{HasNextResults: true, HasPreviousResults: true, TotalResults: 9},
+			name:      "No available for install software, page 1",
+			opts:      fleet.HostSoftwareTitleListOptions{ListOptions: fleet.ListOptions{Page: 1, PerPage: 5}, IncludeAvailableForInstall: false},
+			wantNames: []string{byNSV[e2].Name, i0.Name, i1.Name, i4.Name, i5.Name},
+			wantMeta:  &fleet.PaginationMetadata{HasNextResults: true, HasPreviousResults: true, TotalResults: 13},
 		},
 		{
-			opts:      fleet.HostSoftwareTitleListOptions{ListOptions: fleet.ListOptions{Page: 2, PerPage: 3}, IncludeAvailableForInstall: false},
-			wantNames: []string{i1.Name, "vpp1", "vpp2"},
-			wantMeta:  &fleet.PaginationMetadata{HasNextResults: false, HasPreviousResults: true, TotalResults: 9},
+			name:      "No available for install software, page 2",
+			opts:      fleet.HostSoftwareTitleListOptions{ListOptions: fleet.ListOptions{Page: 2, PerPage: 5}, IncludeAvailableForInstall: false},
+			wantNames: []string{i6.Name, "vpp1", "vpp2"},
+			wantMeta:  &fleet.PaginationMetadata{HasNextResults: false, HasPreviousResults: true, TotalResults: 13},
 		},
 		{
-			opts:      fleet.HostSoftwareTitleListOptions{ListOptions: fleet.ListOptions{Page: 3, PerPage: 3}, IncludeAvailableForInstall: false},
+			name:      "No available for install software, page 3",
+			opts:      fleet.HostSoftwareTitleListOptions{ListOptions: fleet.ListOptions{Page: 3, PerPage: 5}, IncludeAvailableForInstall: false},
 			wantNames: []string{},
-			wantMeta:  &fleet.PaginationMetadata{HasNextResults: false, HasPreviousResults: true, TotalResults: 9},
+			wantMeta:  &fleet.PaginationMetadata{HasNextResults: false, HasPreviousResults: true, TotalResults: 13},
 		},
 		{
-			opts:      fleet.HostSoftwareTitleListOptions{ListOptions: fleet.ListOptions{PerPage: 4}, IncludeAvailableForInstall: true},
-			wantNames: []string{byNSV[a1].Name, byNSV[a2].Name, byNSV[b].Name, byNSV[c1].Name},
-			wantMeta:  &fleet.PaginationMetadata{HasNextResults: true, HasPreviousResults: false, TotalResults: 11},
+			name:      "Include Available for install software, page 0",
+			opts:      fleet.HostSoftwareTitleListOptions{ListOptions: fleet.ListOptions{PerPage: 5}, IncludeAvailableForInstall: true},
+			wantNames: []string{byNSV[a1].Name, byNSV[a2].Name, byNSV[b].Name, byNSV[c1].Name, byNSV[d].Name},
+			wantMeta:  &fleet.PaginationMetadata{HasNextResults: true, HasPreviousResults: false, TotalResults: 15},
 		},
 		{
-			opts:      fleet.HostSoftwareTitleListOptions{ListOptions: fleet.ListOptions{Page: 1, PerPage: 4}, IncludeAvailableForInstall: true},
-			wantNames: []string{byNSV[d].Name, i0.Name, i1.Name, i2.Name},
-			wantMeta:  &fleet.PaginationMetadata{HasNextResults: true, HasPreviousResults: true, TotalResults: 11},
+			name:      "Include Available for install software, page 1",
+			opts:      fleet.HostSoftwareTitleListOptions{ListOptions: fleet.ListOptions{Page: 1, PerPage: 5}, IncludeAvailableForInstall: true},
+			wantNames: []string{byNSV[e2].Name, i0.Name, i1.Name, i2.Name, i4.Name},
+			wantMeta:  &fleet.PaginationMetadata{HasNextResults: true, HasPreviousResults: true, TotalResults: 15},
 		},
 		{
-			opts:      fleet.HostSoftwareTitleListOptions{ListOptions: fleet.ListOptions{Page: 2, PerPage: 4}, IncludeAvailableForInstall: true},
-			wantNames: []string{"vpp1", "vpp2", "vpp3"},
-			wantMeta:  &fleet.PaginationMetadata{HasNextResults: false, HasPreviousResults: true, TotalResults: 11},
+			name: "Include Available for install software, page 2",
+			opts: fleet.HostSoftwareTitleListOptions{
+				ListOptions:                fleet.ListOptions{Page: 2, PerPage: 5},
+				IncludeAvailableForInstall: true,
+			},
+			wantNames: []string{i5.Name, i6.Name, "vpp1", "vpp2", "vpp3"},
+			wantMeta:  &fleet.PaginationMetadata{HasNextResults: false, HasPreviousResults: true, TotalResults: 15},
 		},
 		{
-			opts:      fleet.HostSoftwareTitleListOptions{ListOptions: fleet.ListOptions{PerPage: 2}, IncludeAvailableForInstall: true, SelfServiceOnly: true},
-			wantNames: []string{byNSV[b].Name, i0.Name},
-			wantMeta:  &fleet.PaginationMetadata{HasNextResults: false, HasPreviousResults: false, TotalResults: 2},
-		},
-		{
-			opts:      fleet.HostSoftwareTitleListOptions{ListOptions: fleet.ListOptions{Page: 1, PerPage: 2}, IncludeAvailableForInstall: true, SelfServiceOnly: true},
+			name: "Include Available for install software, page 3",
+			opts: fleet.HostSoftwareTitleListOptions{
+				ListOptions:                fleet.ListOptions{Page: 3, PerPage: 5},
+				IncludeAvailableForInstall: true,
+			},
 			wantNames: []string{},
-			wantMeta:  &fleet.PaginationMetadata{HasNextResults: false, HasPreviousResults: true, TotalResults: 2},
+			wantMeta:  &fleet.PaginationMetadata{HasNextResults: false, HasPreviousResults: true, TotalResults: 15},
 		},
 		{
-			opts:      fleet.HostSoftwareTitleListOptions{ListOptions: fleet.ListOptions{Page: 0, PerPage: 2}, AvailableForInstall: true},
-			wantNames: []string{"i2", "vpp3"},
-			wantMeta:  &fleet.PaginationMetadata{HasNextResults: false, HasPreviousResults: false, TotalResults: 2},
+			name:      "Available for install and self-service only software, page 0",
+			opts:      fleet.HostSoftwareTitleListOptions{ListOptions: fleet.ListOptions{PerPage: 3}, IncludeAvailableForInstall: true, SelfServiceOnly: true},
+			wantNames: []string{byNSV[b].Name, i0.Name, "vpp3"},
+			wantMeta:  &fleet.PaginationMetadata{HasNextResults: false, HasPreviousResults: false, TotalResults: 3},
 		},
 		{
-			opts:      fleet.HostSoftwareTitleListOptions{ListOptions: fleet.ListOptions{Page: 1, PerPage: 1}, AvailableForInstall: true},
-			wantNames: []string{"vpp3"},
-			wantMeta:  &fleet.PaginationMetadata{HasNextResults: false, HasPreviousResults: true, TotalResults: 2},
+			name:      "Available for install and self-service only software, page 1",
+			opts:      fleet.HostSoftwareTitleListOptions{ListOptions: fleet.ListOptions{Page: 1, PerPage: 3}, IncludeAvailableForInstall: true, SelfServiceOnly: true},
+			wantNames: []string{},
+			wantMeta:  &fleet.PaginationMetadata{HasNextResults: false, HasPreviousResults: true, TotalResults: 3},
+		},
+		{
+			name:      "Only available for install software, page 0",
+			opts:      fleet.HostSoftwareTitleListOptions{ListOptions: fleet.ListOptions{Page: 0, PerPage: 4}, OnlyAvailableForInstall: true},
+			wantNames: []string{byNSV[b].Name, "i0", "i1", "i2"},
+			wantMeta:  &fleet.PaginationMetadata{HasNextResults: true, HasPreviousResults: false, TotalResults: 10},
+		},
+		{
+			opts: fleet.HostSoftwareTitleListOptions{
+				ListOptions:             fleet.ListOptions{Page: 2, PerPage: 4},
+				OnlyAvailableForInstall: true,
+			},
+			wantNames: []string{"vpp2", "vpp3"},
+			wantMeta:  &fleet.PaginationMetadata{HasNextResults: false, HasPreviousResults: true, TotalResults: 10},
 		},
 	}
 	for _, c := range cases {
-		t.Run(fmt.Sprintf("%#v", c.opts), func(t *testing.T) {
+		t.Run(fmt.Sprintf("%s", c.name), func(t *testing.T) {
 			// always include metadata
 			c.opts.ListOptions.IncludeMetadata = true
 			c.opts.ListOptions.OrderKey = "name"
@@ -3915,8 +4075,12 @@ func testListIOSHostSoftware(t *testing.T, ds *Datastore) {
 	ctx := context.Background()
 	host := test.NewHost(t, ds, "host1", "", "host1key", "host1uuid", time.Now(), test.WithPlatform("ios"))
 	nanoEnroll(t, ds, host, false)
-	opts := fleet.HostSoftwareTitleListOptions{ListOptions: fleet.ListOptions{PerPage: 10, IncludeMetadata: true, OrderKey: "name",
-		TestSecondaryOrderKey: "source"}}
+	opts := fleet.HostSoftwareTitleListOptions{ListOptions: fleet.ListOptions{
+		PerPage: 10, IncludeMetadata: true, OrderKey: "name",
+		TestSecondaryOrderKey: "source",
+	}}
+
+	test.CreateInsertGlobalVPPToken(t, ds)
 
 	user, err := ds.NewUser(ctx, &fleet.User{
 		Password:   []byte("p4ssw0rd.123"),
@@ -4000,24 +4164,31 @@ func testListIOSHostSoftware(t *testing.T, ds *Datastore) {
 	require.NoError(t, err)
 
 	expected := map[string]fleet.HostSoftwareWithInstaller{
-		byNSV[a1].Name + byNSV[a1].Source: {Name: byNSV[a1].Name, Source: byNSV[a1].Source,
+		byNSV[a1].Name + byNSV[a1].Source: {
+			Name: byNSV[a1].Name, Source: byNSV[a1].Source,
 			InstalledVersions: []*fleet.HostSoftwareInstalledVersion{
 				{Version: byNSV[a1].Version, Vulnerabilities: []string{vulns[0].CVE, vulns[1].CVE, vulns[2].CVE}},
-			}},
-		byNSV[b].Name + byNSV[b].Source: {Name: byNSV[b].Name, Source: byNSV[b].Source,
+			},
+		},
+		byNSV[b].Name + byNSV[b].Source: {
+			Name: byNSV[b].Name, Source: byNSV[b].Source,
 			InstalledVersions: []*fleet.HostSoftwareInstalledVersion{
 				{Version: byNSV[b].Version, Vulnerabilities: []string{vulns[3].CVE}},
-			}},
+			},
+		},
 		// c1 and c2 are the same software title because they have the same name and source
-		byNSV[c1].Name + byNSV[c1].Source: {Name: byNSV[c1].Name, Source: byNSV[c1].Source,
+		byNSV[c1].Name + byNSV[c1].Source: {
+			Name: byNSV[c1].Name, Source: byNSV[c1].Source,
 			InstalledVersions: []*fleet.HostSoftwareInstalledVersion{
 				{Version: byNSV[c1].Version},
 				{Version: byNSV[c2].Version},
-			}},
+			},
+		},
 	}
 
 	compareResults := func(expected map[string]fleet.HostSoftwareWithInstaller, got []*fleet.HostSoftwareWithInstaller, expectAsc bool,
-		expectOmitted ...string) {
+		expectOmitted ...string,
+	) {
 		require.Len(t, got, len(expected)-len(expectOmitted))
 		prev := ""
 		for _, g := range got {
@@ -4091,12 +4262,12 @@ func testListIOSHostSoftware(t *testing.T, ds *Datastore) {
 	opts.VulnerableOnly = false
 
 	// No software that is available for install
-	opts.AvailableForInstall = true
+	opts.OnlyAvailableForInstall = true
 	sw, meta, err = ds.ListHostSoftware(ctx, host, opts)
 	require.NoError(t, err)
 	assert.Empty(t, sw)
 	assert.Equal(t, &fleet.PaginationMetadata{}, meta)
-	opts.AvailableForInstall = false
+	opts.OnlyAvailableForInstall = false
 
 	// Create a team
 	tm, err := ds.NewTeam(ctx, &fleet.Team{Name: "mobile team"})
@@ -4104,33 +4275,47 @@ func testListIOSHostSoftware(t *testing.T, ds *Datastore) {
 
 	// add VPP apps, one for both no team and team, and three for no-team only.
 	va1, err := ds.InsertVPPAppWithTeam(ctx,
-		&fleet.VPPApp{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_1", Platform: fleet.IOSPlatform}, Name: "vpp1",
-			BundleIdentifier: "com.app.vpp1"}, nil)
+		&fleet.VPPApp{
+			VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_1", Platform: fleet.IOSPlatform}}, Name: "vpp1",
+			BundleIdentifier: "com.app.vpp1",
+		}, nil)
 	require.NoError(t, err)
 	_, err = ds.InsertVPPAppWithTeam(ctx,
-		&fleet.VPPApp{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_1", Platform: fleet.MacOSPlatform}, Name: "vpp1",
-			BundleIdentifier: "com.app.vpp1"}, nil)
+		&fleet.VPPApp{
+			VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_1", Platform: fleet.MacOSPlatform}}, Name: "vpp1",
+			BundleIdentifier: "com.app.vpp1",
+		}, nil)
 	require.NoError(t, err)
 	_, err = ds.InsertVPPAppWithTeam(ctx,
-		&fleet.VPPApp{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_1", Platform: fleet.IPadOSPlatform}, Name: "vpp1",
-			BundleIdentifier: "com.app.vpp1"}, nil)
+		&fleet.VPPApp{
+			VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_1", Platform: fleet.IPadOSPlatform}}, Name: "vpp1",
+			BundleIdentifier: "com.app.vpp1",
+		}, nil)
 	require.NoError(t, err)
 	_, err = ds.InsertVPPAppWithTeam(ctx,
-		&fleet.VPPApp{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_1", Platform: fleet.IPadOSPlatform}, Name: "vpp1",
-			BundleIdentifier: "com.app.vpp1"}, &tm.ID)
+		&fleet.VPPApp{
+			VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_1", Platform: fleet.IPadOSPlatform}}, Name: "vpp1",
+			BundleIdentifier: "com.app.vpp1",
+		}, &tm.ID)
 	require.NoError(t, err)
 	vpp1 := va1.AdamID
 	va2, err := ds.InsertVPPAppWithTeam(ctx,
-		&fleet.VPPApp{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_2", Platform: fleet.IOSPlatform}, Name: "vpp2",
-			BundleIdentifier: "com.app.vpp2"}, nil)
+		&fleet.VPPApp{
+			VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_2", Platform: fleet.IOSPlatform}}, Name: "vpp2",
+			BundleIdentifier: "com.app.vpp2",
+		}, nil)
 	require.NoError(t, err)
 	va3, err := ds.InsertVPPAppWithTeam(ctx,
-		&fleet.VPPApp{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_3", Platform: fleet.IOSPlatform}, Name: "vpp3",
-			BundleIdentifier: "com.app.vpp3"}, nil)
+		&fleet.VPPApp{
+			VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_3", Platform: fleet.IOSPlatform}}, Name: "vpp3",
+			BundleIdentifier: "com.app.vpp3",
+		}, nil)
 	require.NoError(t, err)
 	va4, err := ds.InsertVPPAppWithTeam(ctx,
-		&fleet.VPPApp{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_4", Platform: fleet.IOSPlatform}, Name: "vpp4",
-			BundleIdentifier: "com.app.vpp4"}, nil)
+		&fleet.VPPApp{
+			VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_4", Platform: fleet.IOSPlatform}}, Name: "vpp4",
+			BundleIdentifier: "com.app.vpp4",
+		}, nil)
 	require.NoError(t, err)
 	vpp2, vpp3, vpp4 := va2.AdamID, va3.AdamID, va4.AdamID
 
@@ -4149,14 +4334,14 @@ func testListIOSHostSoftware(t *testing.T, ds *Datastore) {
 	expected["vpp1ios_apps"] = fleet.HostSoftwareWithInstaller{
 		Name:        "vpp1",
 		Source:      "ios_apps",
-		Status:      expectStatus(fleet.SoftwareInstallerInstalled),
-		AppStoreApp: &fleet.SoftwarePackageOrApp{AppStoreID: vpp1, LastInstall: &fleet.HostSoftwareInstall{CommandUUID: vpp1CmdUUID}},
+		Status:      expectStatus(fleet.SoftwareInstalled),
+		AppStoreApp: &fleet.SoftwarePackageOrApp{AppStoreID: vpp1, SelfService: ptr.Bool(false), LastInstall: &fleet.HostSoftwareInstall{CommandUUID: vpp1CmdUUID}},
 	}
 	expected["vpp2ios_apps"] = fleet.HostSoftwareWithInstaller{
 		Name:        "vpp2",
 		Source:      "ios_apps",
-		Status:      expectStatus(fleet.SoftwareInstallerPending),
-		AppStoreApp: &fleet.SoftwarePackageOrApp{AppStoreID: vpp2, LastInstall: &fleet.HostSoftwareInstall{CommandUUID: vpp2bCmdUUID}},
+		Status:      expectStatus(fleet.SoftwareInstallPending),
+		AppStoreApp: &fleet.SoftwarePackageOrApp{AppStoreID: vpp2, SelfService: ptr.Bool(false), LastInstall: &fleet.HostSoftwareInstall{CommandUUID: vpp2bCmdUUID}},
 	}
 
 	opts.IncludeAvailableForInstall = false
@@ -4170,15 +4355,17 @@ func testListIOSHostSoftware(t *testing.T, ds *Datastore) {
 		Name:        "vpp3",
 		Source:      "ios_apps",
 		Status:      nil,
-		AppStoreApp: &fleet.SoftwarePackageOrApp{AppStoreID: vpp3},
+		AppStoreApp: &fleet.SoftwarePackageOrApp{AppStoreID: vpp3, SelfService: ptr.Bool(false)},
 	}
 	expected["vpp4ios_apps"] = fleet.HostSoftwareWithInstaller{
 		Name:        "vpp4",
 		Source:      "ios_apps",
 		Status:      nil,
-		AppStoreApp: &fleet.SoftwarePackageOrApp{AppStoreID: vpp4},
+		AppStoreApp: &fleet.SoftwarePackageOrApp{AppStoreID: vpp4, SelfService: ptr.Bool(false)},
 	}
 	expectedAvailableOnly := map[string]fleet.HostSoftwareWithInstaller{}
+	expectedAvailableOnly["vpp1ios_apps"] = expected["vpp1ios_apps"]
+	expectedAvailableOnly["vpp2ios_apps"] = expected["vpp2ios_apps"]
 	expectedAvailableOnly["vpp3ios_apps"] = expected["vpp3ios_apps"]
 	expectedAvailableOnly["vpp4ios_apps"] = expected["vpp4ios_apps"]
 	opts.IncludeAvailableForInstall = true
@@ -4189,13 +4376,12 @@ func testListIOSHostSoftware(t *testing.T, ds *Datastore) {
 	compareResults(expected, sw, true)
 
 	// Available for install only
-	opts.AvailableForInstall = true
+	opts.OnlyAvailableForInstall = true
 	sw, meta, err = ds.ListHostSoftware(ctx, host, opts)
 	require.NoError(t, err)
 	assert.Equal(t, &fleet.PaginationMetadata{TotalResults: uint(len(expectedAvailableOnly))}, meta)
 	compareResults(expectedAvailableOnly, sw, true)
-	opts.AvailableForInstall = false
-
+	opts.OnlyAvailableForInstall = false
 }
 
 func testSetHostSoftwareInstallResult(t *testing.T, ds *Datastore) {
@@ -4211,6 +4397,14 @@ func testSetHostSoftwareInstallResult(t *testing.T, ds *Datastore) {
 		}
 		scriptContentID, _ := res.LastInsertId()
 
+		uninstallScript := `echo 'bar'`
+		resUninstall, err := q.ExecContext(ctx, `INSERT INTO script_contents (md5_checksum, contents) VALUES (UNHEX(md5(?)), ?)`,
+			uninstallScript, uninstallScript)
+		if err != nil {
+			return err
+		}
+		uninstallScriptContentID, _ := resUninstall.LastInsertId()
+
 		res, err = q.ExecContext(ctx, `INSERT INTO software_titles (name, source) VALUES ('foo', 'apps')`)
 		if err != nil {
 			return err
@@ -4219,10 +4413,10 @@ func testSetHostSoftwareInstallResult(t *testing.T, ds *Datastore) {
 
 		res, err = q.ExecContext(ctx, `
 			INSERT INTO software_installers
-				(title_id, filename, version, install_script_content_id, storage_id)
+				(title_id, filename, extension, version, install_script_content_id, uninstall_script_content_id, storage_id)
 			VALUES
-				(?, ?, ?, ?, unhex(?))`,
-			titleID, "installer.pkg", "v1.0.0", scriptContentID, hex.EncodeToString([]byte("test")))
+				(?, ?, ?, ?, ?, ?, unhex(?))`,
+			titleID, "installer.pkg", "pkg", "v1.0.0", scriptContentID, uninstallScriptContentID, hex.EncodeToString([]byte("test")))
 		if err != nil {
 			return err
 		}
@@ -4334,3 +4528,663 @@ func testSetHostSoftwareInstallResult(t *testing.T, ds *Datastore) {
 	require.Error(t, err)
 	require.True(t, fleet.IsNotFound(err))
 }
+
+func testListHostSoftwareInstallThenTransferTeam(t *testing.T, ds *Datastore) {
+	ctx := context.Background()
+	user := test.NewUser(t, ds, "user1", "user1@example.com", false)
+	host := test.NewHost(t, ds, "host1", "", "host1key", "host1uuid", time.Now(), test.WithPlatform("darwin"))
+	nanoEnroll(t, ds, host, false)
+	opts := fleet.HostSoftwareTitleListOptions{
+		ListOptions:                fleet.ListOptions{PerPage: 10, IncludeMetadata: true, OrderKey: "name", TestSecondaryOrderKey: "source"},
+		IncludeAvailableForInstall: true,
+	}
+
+	test.CreateInsertGlobalVPPToken(t, ds)
+
+	team1, err := ds.NewTeam(ctx, &fleet.Team{Name: "team 1"})
+	require.NoError(t, err)
+	team2, err := ds.NewTeam(ctx, &fleet.Team{Name: "team 2"})
+	require.NoError(t, err)
+
+	err = ds.AddHostsToTeam(ctx, &team1.ID, []uint{host.ID})
+	require.NoError(t, err)
+	host.TeamID = &team1.ID
+
+	// add a single "externally-installed" software for that host
+	software := []fleet.Software{
+		{Name: "a", Version: "0.0.1", Source: "chrome_extensions"},
+	}
+	_, err = ds.UpdateHostSoftware(ctx, host.ID, software)
+	require.NoError(t, err)
+
+	// create a software installer for team 1
+	installerTm1, err := ds.MatchOrCreateSoftwareInstaller(ctx, &fleet.UploadSoftwareInstallerPayload{
+		InstallScript: "hello",
+		InstallerFile: bytes.NewReader([]byte("hello")),
+		StorageID:     "storage1",
+		Filename:      "file1",
+		Title:         "file1",
+		Version:       "1.0",
+		Source:        "apps",
+		TeamID:        &team1.ID,
+		UserID:        user.ID,
+	})
+	require.NoError(t, err)
+
+	// install it on the host
+	hostInstall1, err := ds.InsertSoftwareInstallRequest(ctx, host.ID, installerTm1, false)
+	require.NoError(t, err)
+	err = ds.SetHostSoftwareInstallResult(ctx, &fleet.HostSoftwareInstallResultPayload{
+		HostID:                host.ID,
+		InstallUUID:           hostInstall1,
+		InstallScriptExitCode: ptr.Int(0),
+	})
+	require.NoError(t, err)
+
+	// add a VPP app for team 1
+	vppTm1, err := ds.InsertVPPAppWithTeam(ctx,
+		&fleet.VPPApp{
+			VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_1", Platform: fleet.MacOSPlatform}}, Name: "vpp1",
+			BundleIdentifier: "com.app.vpp1",
+		}, &team1.ID)
+	require.NoError(t, err)
+
+	// fail to install it on the host
+	vpp1CmdUUID := createVPPAppInstallRequest(t, ds, host, vppTm1.AdamID, user.ID)
+	createVPPAppInstallResult(t, ds, host, vpp1CmdUUID, fleet.MDMAppleStatusError)
+
+	// add the successful installer to the reported installed software
+	software = []fleet.Software{
+		{Name: "a", Version: "0.0.1", Source: "chrome_extensions"},
+		{Name: "file1", Version: "1.0", Source: "apps"},
+	}
+	_, err = ds.UpdateHostSoftware(ctx, host.ID, software)
+	require.NoError(t, err)
+
+	// listing the host's software (including available for install) at this
+	// point lists "a", "file1" and "vpp1" (because of the install attempt)
+	sw, meta, err := ds.ListHostSoftware(ctx, host, opts)
+	require.NoError(t, err)
+	require.Len(t, sw, 3)
+	require.EqualValues(t, 3, meta.TotalResults)
+	require.Equal(t, sw[0].Name, "a")
+	require.Nil(t, sw[0].AppStoreApp)
+	require.Nil(t, sw[0].SoftwarePackage)
+	require.Equal(t, sw[1].Name, "file1")
+	require.Nil(t, sw[1].AppStoreApp)
+	require.NotNil(t, sw[1].SoftwarePackage)
+	require.Equal(t, sw[2].Name, "vpp1")
+	require.NotNil(t, sw[2].AppStoreApp)
+	require.Nil(t, sw[2].SoftwarePackage)
+
+	// move host to team 2
+	err = ds.AddHostsToTeam(ctx, &team2.ID, []uint{host.ID})
+	require.NoError(t, err)
+	host.TeamID = &team2.ID
+
+	// listing the host's software (including available for install) should now
+	// only list "a" and "file1" (because they are actually installed) and not
+	// link them to the installer/VPP app. With and without available software
+	// should result in the same rows (no available software in that new team).
+	for _, b := range []bool{true, false} {
+		opts.IncludeAvailableForInstall = b
+		sw, meta, err = ds.ListHostSoftware(ctx, host, opts)
+		require.NoError(t, err)
+		require.Len(t, sw, 2)
+		require.EqualValues(t, 2, meta.TotalResults)
+		require.Equal(t, sw[0].Name, "a")
+		require.Nil(t, sw[0].AppStoreApp)
+		require.Nil(t, sw[0].SoftwarePackage)
+		require.Equal(t, sw[1].Name, "file1")
+		require.Nil(t, sw[1].AppStoreApp)
+		require.Nil(t, sw[1].SoftwarePackage)
+	}
+}
+
+func testListHostSoftwareInstallThenDeleteInstallers(t *testing.T, ds *Datastore) {
+	ctx := context.Background()
+	user := test.NewUser(t, ds, "user1", "user1@example.com", false)
+	host := test.NewHost(t, ds, "host1", "", "host1key", "host1uuid", time.Now(), test.WithPlatform("darwin"))
+	nanoEnroll(t, ds, host, false)
+	opts := fleet.HostSoftwareTitleListOptions{
+		ListOptions:                fleet.ListOptions{PerPage: 10, IncludeMetadata: true, OrderKey: "name", TestSecondaryOrderKey: "source"},
+		IncludeAvailableForInstall: true,
+	}
+
+	test.CreateInsertGlobalVPPToken(t, ds)
+
+	team1, err := ds.NewTeam(ctx, &fleet.Team{Name: "team 1"})
+	require.NoError(t, err)
+
+	err = ds.AddHostsToTeam(ctx, &team1.ID, []uint{host.ID})
+	require.NoError(t, err)
+	host.TeamID = &team1.ID
+
+	// add a single "externally-installed" software for that host
+	software := []fleet.Software{
+		{Name: "a", Version: "0.0.1", Source: "chrome_extensions"},
+	}
+	_, err = ds.UpdateHostSoftware(ctx, host.ID, software)
+	require.NoError(t, err)
+
+	// create a software installer for team 1
+	installerTm1, err := ds.MatchOrCreateSoftwareInstaller(ctx, &fleet.UploadSoftwareInstallerPayload{
+		InstallScript: "hello",
+		InstallerFile: bytes.NewReader([]byte("hello")),
+		StorageID:     "storage1",
+		Filename:      "file1",
+		Title:         "file1",
+		Version:       "1.0",
+		Source:        "apps",
+		TeamID:        &team1.ID,
+		UserID:        user.ID,
+	})
+	require.NoError(t, err)
+
+	// fail to install it on the host
+	hostInstall1, err := ds.InsertSoftwareInstallRequest(ctx, host.ID, installerTm1, false)
+	require.NoError(t, err)
+	err = ds.SetHostSoftwareInstallResult(ctx, &fleet.HostSoftwareInstallResultPayload{
+		HostID:                host.ID,
+		InstallUUID:           hostInstall1,
+		InstallScriptExitCode: ptr.Int(1),
+	})
+	require.NoError(t, err)
+
+	// add a VPP app for team 1
+	vppTm1, err := ds.InsertVPPAppWithTeam(ctx,
+		&fleet.VPPApp{
+			VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_1", Platform: fleet.MacOSPlatform}}, Name: "vpp1",
+			BundleIdentifier: "com.app.vpp1", LatestVersion: "1.0",
+		}, &team1.ID)
+	require.NoError(t, err)
+
+	// install it on the host
+	vpp1CmdUUID := createVPPAppInstallRequest(t, ds, host, vppTm1.AdamID, user.ID)
+	createVPPAppInstallResult(t, ds, host, vpp1CmdUUID, fleet.MDMAppleStatusAcknowledged)
+
+	// add the successful VPP app to the reported installed software
+	software = []fleet.Software{
+		{Name: "a", Version: "0.0.1", Source: "chrome_extensions"},
+		{Name: "vpp1", Version: "1.0", Source: "apps", BundleIdentifier: "com.app.vpp1"},
+	}
+	_, err = ds.UpdateHostSoftware(ctx, host.ID, software)
+	require.NoError(t, err)
+
+	// listing the host's software (including available for install) at this
+	// point lists "a", "file1" and "vpp1" (because of the install attempt)
+	sw, meta, err := ds.ListHostSoftware(ctx, host, opts)
+	require.NoError(t, err)
+	require.Len(t, sw, 3)
+	require.EqualValues(t, 3, meta.TotalResults)
+	require.Equal(t, sw[0].Name, "a")
+	require.Nil(t, sw[0].AppStoreApp)
+	require.Nil(t, sw[0].SoftwarePackage)
+	require.Equal(t, sw[1].Name, "file1")
+	require.Nil(t, sw[1].AppStoreApp)
+	require.NotNil(t, sw[1].SoftwarePackage)
+	require.Equal(t, sw[2].Name, "vpp1")
+	require.NotNil(t, sw[2].AppStoreApp)
+	require.Nil(t, sw[2].SoftwarePackage)
+
+	// delete both installers
+	err = ds.DeleteSoftwareInstaller(ctx, installerTm1)
+	require.NoError(t, err)
+	err = ds.DeleteVPPAppFromTeam(ctx, &team1.ID, vppTm1.VPPAppID)
+	require.NoError(t, err)
+
+	// listing the host's software (including available for install) should now
+	// only list "a" and "vpp1" (because they are actually installed) and not
+	// link them to the installer/VPP app. With and without available software
+	// should result in the same rows (no available software anymore).
+	for _, b := range []bool{true, false} {
+		opts.IncludeAvailableForInstall = b
+		sw, meta, err = ds.ListHostSoftware(ctx, host, opts)
+		require.NoError(t, err)
+		require.Len(t, sw, 2)
+		require.EqualValues(t, 2, meta.TotalResults)
+		require.Equal(t, sw[0].Name, "a")
+		require.Nil(t, sw[0].AppStoreApp)
+		require.Nil(t, sw[0].SoftwarePackage)
+		require.Equal(t, sw[1].Name, "vpp1")
+		require.Nil(t, sw[1].AppStoreApp)
+		require.Nil(t, sw[1].SoftwarePackage)
+	}
+}
+
+func testListSoftwareVersionsVulnerabilityFilters(t *testing.T, ds *Datastore) {
+	ctx := context.Background()
+	host := test.NewHost(t, ds, "host", "", "hostkey", "hostuuid", time.Now())
+
+	software := []fleet.Software{
+		{Name: "chrome", Version: "0.0.1", Source: "apps"},
+		{Name: "chrome", Version: "0.0.3", Source: "apps"},
+		{Name: "safari", Version: "0.0.3", Source: "apps"},
+		{Name: "safari", Version: "0.0.1", Source: "apps"},
+		{Name: "firefox", Version: "0.0.3", Source: "apps"},
+		{Name: "edge", Version: "0.0.3", Source: "apps"},
+		{Name: "brave", Version: "0.0.3", Source: "apps"},
+		{Name: "opera", Version: "0.0.3", Source: "apps"},
+		{Name: "internet explorer", Version: "0.0.3", Source: "apps"},
+		{Name: "netscape", Version: "0.0.3", Source: "apps"},
+	}
+
+	sw, err := ds.UpdateHostSoftware(ctx, host.ID, software)
+	require.NoError(t, err)
+
+	var chrome001 uint
+	var safari001 uint
+	var firefox003 uint
+	var edge003 uint
+	var brave003 uint
+	var opera003 uint
+	var ie003 uint
+	for s := range sw.Inserted {
+		switch {
+		case sw.Inserted[s].Name == "chrome" && sw.Inserted[s].Version == "0.0.1":
+			chrome001 = sw.Inserted[s].ID
+		case sw.Inserted[s].Name == "safari" && sw.Inserted[s].Version == "0.0.1":
+			safari001 = sw.Inserted[s].ID
+		case sw.Inserted[s].Name == "firefox" && sw.Inserted[s].Version == "0.0.3":
+			firefox003 = sw.Inserted[s].ID
+		case sw.Inserted[s].Name == "edge" && sw.Inserted[s].Version == "0.0.3":
+			edge003 = sw.Inserted[s].ID
+		case sw.Inserted[s].Name == "brave" && sw.Inserted[s].Version == "0.0.3":
+			brave003 = sw.Inserted[s].ID
+		case sw.Inserted[s].Name == "opera" && sw.Inserted[s].Version == "0.0.3":
+			opera003 = sw.Inserted[s].ID
+		case sw.Inserted[s].Name == "internet explorer" && sw.Inserted[s].Version == "0.0.3":
+			ie003 = sw.Inserted[s].ID
+		}
+	}
+
+	_, err = ds.InsertSoftwareVulnerability(ctx, fleet.SoftwareVulnerability{
+		SoftwareID: chrome001,
+		CVE:        "CVE-2024-1234",
+	}, fleet.NVDSource)
+	require.NoError(t, err)
+	_, err = ds.InsertSoftwareVulnerability(ctx, fleet.SoftwareVulnerability{
+		SoftwareID: safari001,
+		CVE:        "CVE-2024-1235",
+	}, fleet.NVDSource)
+	require.NoError(t, err)
+	_, err = ds.InsertSoftwareVulnerability(ctx, fleet.SoftwareVulnerability{
+		SoftwareID: firefox003,
+		CVE:        "CVE-2024-1236",
+	}, fleet.NVDSource)
+	require.NoError(t, err)
+	_, err = ds.InsertSoftwareVulnerability(ctx, fleet.SoftwareVulnerability{
+		SoftwareID: edge003,
+		CVE:        "CVE-2024-1237",
+	}, fleet.NVDSource)
+	require.NoError(t, err)
+	_, err = ds.InsertSoftwareVulnerability(ctx, fleet.SoftwareVulnerability{
+		SoftwareID: brave003,
+		CVE:        "CVE-2024-1238",
+	}, fleet.NVDSource)
+	require.NoError(t, err)
+	_, err = ds.InsertSoftwareVulnerability(ctx, fleet.SoftwareVulnerability{
+		SoftwareID: opera003,
+		CVE:        "CVE-2024-1239",
+	}, fleet.NVDSource)
+	require.NoError(t, err)
+	_, err = ds.InsertSoftwareVulnerability(ctx, fleet.SoftwareVulnerability{
+		SoftwareID: ie003,
+		CVE:        "CVE-2024-1240",
+	}, fleet.NVDSource)
+	require.NoError(t, err)
+
+	err = ds.InsertCVEMeta(ctx, []fleet.CVEMeta{
+		{
+			// chrome
+			CVE:              "CVE-2024-1234",
+			CVSSScore:        ptr.Float64(7.5),
+			CISAKnownExploit: ptr.Bool(true),
+		},
+		{
+			// safari
+			CVE:              "CVE-2024-1235",
+			CVSSScore:        ptr.Float64(7.5),
+			CISAKnownExploit: ptr.Bool(false),
+		},
+		{
+			// firefox
+			CVE:              "CVE-2024-1236",
+			CVSSScore:        ptr.Float64(8.0),
+			CISAKnownExploit: ptr.Bool(true),
+		},
+		{
+			// edge
+			CVE:              "CVE-2024-1237",
+			CVSSScore:        ptr.Float64(8.0),
+			CISAKnownExploit: ptr.Bool(false),
+		},
+		{
+			// brave
+			CVE:              "CVE-2024-1238",
+			CVSSScore:        ptr.Float64(9.0),
+			CISAKnownExploit: ptr.Bool(true),
+		},
+		// CVE-2024-1239 for opera has no CVE Meta
+		{
+			// internet explorer
+			CVE:              "CVE-2024-1240",
+			CVSSScore:        nil,
+			CISAKnownExploit: nil,
+		},
+	})
+	require.NoError(t, err)
+
+	require.NoError(t, ds.SyncHostsSoftware(ctx, time.Now()))
+	require.NoError(t, ds.ReconcileSoftwareTitles(ctx))
+	require.NoError(t, ds.SyncHostsSoftwareTitles(ctx, time.Now()))
+
+	type swVersion struct {
+		Name    string
+		Version string
+	}
+
+	tc := []struct {
+		name     string
+		opts     fleet.SoftwareListOptions
+		expected []swVersion
+		err      error
+	}{
+		{
+			name: "vulnerable only",
+			opts: fleet.SoftwareListOptions{
+				ListOptions:    fleet.ListOptions{OrderKey: "name"},
+				VulnerableOnly: true,
+			},
+			expected: []swVersion{
+				{
+					Name:    "brave",
+					Version: "0.0.3",
+				},
+				{
+					Name:    "chrome",
+					Version: "0.0.1",
+				},
+				{
+					Name:    "edge",
+					Version: "0.0.3",
+				},
+				{
+					Name:    "firefox",
+					Version: "0.0.3",
+				},
+				{
+					Name:    "internet explorer",
+					Version: "0.0.3",
+				},
+				{
+					Name:    "opera",
+					Version: "0.0.3",
+				},
+				{
+					Name:    "safari",
+					Version: "0.0.1",
+				},
+			},
+		},
+		{
+			name: "known exploit true",
+			opts: fleet.SoftwareListOptions{
+				ListOptions:      fleet.ListOptions{OrderKey: "name", OrderDirection: fleet.OrderAscending},
+				IncludeCVEScores: true,
+				VulnerableOnly:   true,
+				KnownExploit:     true,
+			},
+			expected: []swVersion{
+				{
+					Name:    "brave",
+					Version: "0.0.3",
+				},
+				{
+					Name:    "chrome",
+					Version: "0.0.1",
+				},
+				{
+					Name:    "firefox",
+					Version: "0.0.3",
+				},
+			},
+		},
+		{
+			name: "minimum cvss 8.0",
+			opts: fleet.SoftwareListOptions{
+				ListOptions:      fleet.ListOptions{OrderKey: "name", OrderDirection: fleet.OrderAscending},
+				IncludeCVEScores: true,
+				VulnerableOnly:   true,
+				MinimumCVSS:      8.0,
+			},
+			expected: []swVersion{
+				{
+					Name:    "brave",
+					Version: "0.0.3",
+				},
+				{
+					Name:    "edge",
+					Version: "0.0.3",
+				},
+				{
+					Name:    "firefox",
+					Version: "0.0.3",
+				},
+			},
+		},
+		{
+			name: "minimum cvss 7.9",
+			opts: fleet.SoftwareListOptions{
+				ListOptions:      fleet.ListOptions{OrderKey: "name", OrderDirection: fleet.OrderAscending},
+				IncludeCVEScores: true,
+				VulnerableOnly:   true,
+				MinimumCVSS:      7.9,
+			},
+			expected: []swVersion{
+				{
+					Name:    "brave",
+					Version: "0.0.3",
+				},
+				{
+					Name:    "edge",
+					Version: "0.0.3",
+				},
+				{
+					Name:    "firefox",
+					Version: "0.0.3",
+				},
+			},
+		},
+		{
+			name: "minimum cvss 8.0 and known exploit",
+			opts: fleet.SoftwareListOptions{
+				ListOptions:      fleet.ListOptions{OrderKey: "name", OrderDirection: fleet.OrderAscending},
+				IncludeCVEScores: true,
+				VulnerableOnly:   true,
+				MinimumCVSS:      8.0,
+				KnownExploit:     true,
+			},
+			expected: []swVersion{
+				{
+					Name:    "brave",
+					Version: "0.0.3",
+				},
+				{
+					Name:    "firefox",
+					Version: "0.0.3",
+				},
+			},
+		},
+		{
+			name: "minimum cvss 7.5 and known exploit",
+			opts: fleet.SoftwareListOptions{
+				ListOptions:      fleet.ListOptions{OrderKey: "name", OrderDirection: fleet.OrderAscending},
+				IncludeCVEScores: true,
+				VulnerableOnly:   true,
+				MinimumCVSS:      7.5,
+				KnownExploit:     true,
+			},
+			expected: []swVersion{
+				{
+					Name:    "brave",
+					Version: "0.0.3",
+				},
+				{
+					Name:    "chrome",
+					Version: "0.0.1",
+				},
+				{
+					Name:    "firefox",
+					Version: "0.0.3",
+				},
+			},
+		},
+		{
+			name: "maximum cvss 7.5",
+			opts: fleet.SoftwareListOptions{
+				ListOptions:      fleet.ListOptions{OrderKey: "name", OrderDirection: fleet.OrderAscending},
+				IncludeCVEScores: true,
+				VulnerableOnly:   true,
+				MaximumCVSS:      7.5,
+			},
+			expected: []swVersion{
+				{
+					Name:    "chrome",
+					Version: "0.0.1",
+				},
+				{
+					Name:    "safari",
+					Version: "0.0.1",
+				},
+			},
+		},
+		{
+			name: "maximum cvss 7.6",
+			opts: fleet.SoftwareListOptions{
+				ListOptions:      fleet.ListOptions{OrderKey: "name", OrderDirection: fleet.OrderAscending},
+				IncludeCVEScores: true,
+				VulnerableOnly:   true,
+				MaximumCVSS:      7.6,
+			},
+			expected: []swVersion{
+				{
+					Name:    "chrome",
+					Version: "0.0.1",
+				},
+				{
+					Name:    "safari",
+					Version: "0.0.1",
+				},
+			},
+		},
+		{
+			name: "maximum cvss 7.5 and known exploit",
+			opts: fleet.SoftwareListOptions{
+				ListOptions:      fleet.ListOptions{OrderKey: "name", OrderDirection: fleet.OrderAscending},
+				IncludeCVEScores: true,
+				VulnerableOnly:   true,
+				MaximumCVSS:      7.5,
+				KnownExploit:     true,
+			},
+			expected: []swVersion{
+				{
+					Name:    "chrome",
+					Version: "0.0.1",
+				},
+			},
+		},
+		{
+			name: "minimum cvss 7.5 and maximum cvss 8.0",
+			opts: fleet.SoftwareListOptions{
+				ListOptions:      fleet.ListOptions{OrderKey: "name", OrderDirection: fleet.OrderAscending},
+				IncludeCVEScores: true,
+				VulnerableOnly:   true,
+				MinimumCVSS:      7.5,
+				MaximumCVSS:      8.0,
+			},
+			expected: []swVersion{
+				{
+					Name:    "chrome",
+					Version: "0.0.1",
+				},
+				{
+					Name:    "edge",
+					Version: "0.0.3",
+				},
+				{
+					Name:    "firefox",
+					Version: "0.0.3",
+				},
+				{
+					Name:    "safari",
+					Version: "0.0.1",
+				},
+			},
+		},
+		{
+			name: "minimum cvss 7.5 and maximum cvss 8.0 and known exploit",
+			opts: fleet.SoftwareListOptions{
+				ListOptions:      fleet.ListOptions{OrderKey: "name", OrderDirection: fleet.OrderAscending},
+				IncludeCVEScores: true,
+				VulnerableOnly:   true,
+				MinimumCVSS:      7.5,
+				MaximumCVSS:      8.0,
+				KnownExploit:     true,
+			},
+			expected: []swVersion{
+				{
+					Name:    "chrome",
+					Version: "0.0.1",
+				},
+				{
+					Name:    "firefox",
+					Version: "0.0.3",
+				},
+			},
+		},
+		{
+			name: "err if vulnerableOnly is not set with MinimumCVSS",
+			opts: fleet.SoftwareListOptions{
+				ListOptions: fleet.ListOptions{},
+				MinimumCVSS: 7.5,
+			},
+			err: fleet.NewInvalidArgumentError("query", "min_cvss_score, max_cvss_score, and exploit can only be provided with vulnerable=true"),
+		},
+		{
+			name: "err if vulnerableOnly is not set with MaximumCVSS",
+			opts: fleet.SoftwareListOptions{
+				ListOptions: fleet.ListOptions{},
+				MaximumCVSS: 7.5,
+			},
+			err: fleet.NewInvalidArgumentError("query", "min_cvss_score, max_cvss_score, and exploit can only be provided with vulnerable=true"),
+		},
+		{
+			name: "err if vulnerableOnly is not set with KnownExploit",
+			opts: fleet.SoftwareListOptions{
+				ListOptions:  fleet.ListOptions{},
+				KnownExploit: true,
+			},
+			err: fleet.NewInvalidArgumentError("query", "min_cvss_score, max_cvss_score, and exploit can only be provided with vulnerable=true"),
+		},
+	}
+
+	for _, tt := range tc {
+		t.Run(tt.name, func(t *testing.T) {
+			sw, _, err := ds.ListSoftware(ctx, tt.opts)
+			if tt.err != nil {
+				require.Error(t, err)
+				require.Equal(t, tt.err, err)
+				return
+			}
+			require.Len(t, sw, len(tt.expected))
+			for i, s := range sw {
+				require.Equal(t, tt.expected[i].Name, s.Name)
+				require.Equal(t, tt.expected[i].Version, s.Version)
+			}
+			count, err := ds.CountSoftware(ctx, tt.opts)
+			require.NoError(t, err)
+			require.Equal(t, len(tt.expected), count)
+		})
+	}
+}
diff --git a/server/datastore/mysql/software_titles.go b/server/datastore/mysql/software_titles.go
index 2c214616dc..b4e2bb6e60 100644
--- a/server/datastore/mysql/software_titles.go
+++ b/server/datastore/mysql/software_titles.go
@@ -13,18 +13,24 @@ import (
 )
 
 func (ds *Datastore) SoftwareTitleByID(ctx context.Context, id uint, teamID *uint, tmFilter fleet.TeamFilter) (*fleet.SoftwareTitle, error) {
-	var teamFilter string // used to filter software titles host counts by team
+	var (
+		teamFilter                            string // used to filter software titles host counts by team
+		softwareInstallerGlobalOrTeamIDFilter string
+		vppAppsTeamsGlobalOrTeamIDFilter      string
+	)
+
 	if teamID != nil {
 		teamFilter = fmt.Sprintf("sthc.team_id = %d AND sthc.global_stats = 0", *teamID)
+		softwareInstallerGlobalOrTeamIDFilter = fmt.Sprintf("si.global_or_team_id = %d", *teamID)
+		vppAppsTeamsGlobalOrTeamIDFilter = fmt.Sprintf("vat.global_or_team_id = %d", *teamID)
 	} else {
 		teamFilter = ds.whereFilterGlobalOrTeamIDByTeams(tmFilter, "sthc")
+		softwareInstallerGlobalOrTeamIDFilter = "TRUE"
+		vppAppsTeamsGlobalOrTeamIDFilter = "TRUE"
 	}
 
-	var tmID uint // used to filter software installers by team
-	if teamID != nil {
-		tmID = *teamID
-	}
-
+	// Select software title but filter out if the software has zero host counts
+	// and it's not an installer or VPP app.
 	selectSoftwareTitleStmt := fmt.Sprintf(`
 SELECT
 	st.id,
@@ -32,27 +38,27 @@ SELECT
 	st.source,
 	st.browser,
 	st.bundle_identifier,
-	COALESCE(SUM(sthc.hosts_count), 0) as hosts_count,
-	MAX(sthc.updated_at)  as counts_updated_at,
+	COALESCE(SUM(sthc.hosts_count), 0) AS hosts_count,
+	MAX(sthc.updated_at) AS counts_updated_at,
 	COUNT(si.id) as software_installers_count,
-	COUNT(vat.adam_id) as vpp_apps_count
+	COUNT(vat.adam_id) AS vpp_apps_count
 FROM software_titles st
-LEFT JOIN software_titles_host_counts sthc ON sthc.software_title_id = st.id
-LEFT JOIN software_installers si ON si.title_id = st.id AND si.global_or_team_id = ?
+LEFT JOIN software_titles_host_counts sthc ON sthc.software_title_id = st.id AND sthc.hosts_count > 0 AND (%s)
+LEFT JOIN software_installers si ON si.title_id = st.id AND %s
 LEFT JOIN vpp_apps vap ON vap.title_id = st.id
-LEFT JOIN vpp_apps_teams vat ON vat.global_or_team_id = ? AND vat.adam_id = vap.adam_id AND vat.platform = vap.platform
+LEFT JOIN vpp_apps_teams vat ON vat.adam_id = vap.adam_id AND vat.platform = vap.platform AND %s
 WHERE st.id = ? AND
-	((sthc.hosts_count > 0 AND %s) OR vat.adam_id IS NOT NULL OR si.id IS NOT NULL)
+	(sthc.hosts_count > 0 OR vat.adam_id IS NOT NULL OR si.id IS NOT NULL)
 GROUP BY
 	st.id,
 	st.name,
 	st.source,
 	st.browser,
 	st.bundle_identifier
-	`, teamFilter,
+	`, teamFilter, softwareInstallerGlobalOrTeamIDFilter, vppAppsTeamsGlobalOrTeamIDFilter,
 	)
 	var title fleet.SoftwareTitle
-	if err := sqlx.GetContext(ctx, ds.reader(ctx), &title, selectSoftwareTitleStmt, tmID, tmID, id); err != nil {
+	if err := sqlx.GetContext(ctx, ds.reader(ctx), &title, selectSoftwareTitleStmt, id); err != nil {
 		if err == sql.ErrNoRows {
 			return nil, notFound("SoftwareTitle").WithID(id)
 		}
@@ -90,8 +96,8 @@ func (ds *Datastore) ListSoftwareTitles(
 		opt.ListOptions.OrderDirection = fleet.OrderDescending
 	}
 
-	if opt.AvailableForInstall && opt.VulnerableOnly {
-		return nil, 0, nil, fleet.NewInvalidArgumentError("query", "available_for_install and vulnerable can't be provided together")
+	if (opt.MinimumCVSS > 0 || opt.MaximumCVSS > 0 || opt.KnownExploit) && !opt.VulnerableOnly {
+		return nil, 0, nil, fleet.NewInvalidArgumentError("query", "min_cvss_score, max_cvss_score, and exploit can only be provided with vulnerable=true")
 	}
 
 	dbReader := ds.reader(ctx)
@@ -105,6 +111,7 @@ func (ds *Datastore) ListSoftwareTitles(
 		PackageSelfService *bool   `db:"package_self_service"`
 		PackageName        *string `db:"package_name"`
 		PackageVersion     *string `db:"package_version"`
+		PackageURL         *string `db:"package_url"`
 		VPPAppSelfService  *bool   `db:"vpp_app_self_service"`
 		VPPAppAdamID       *string `db:"vpp_app_adam_id"`
 		VPPAppVersion      *string `db:"vpp_app_version"`
@@ -146,6 +153,7 @@ func (ds *Datastore) ListSoftwareTitles(
 				Name:        *title.PackageName,
 				Version:     version,
 				SelfService: title.PackageSelfService,
+				PackageURL:  title.PackageURL,
 			}
 		}
 
@@ -256,32 +264,53 @@ SELECT
 	si.self_service as package_self_service,
 	si.filename as package_name,
 	si.version as package_version,
-	-- in a future iteration, will be supported for VPP apps
-	0 as vpp_app_self_service,
+	si.url AS package_url,
+	vat.self_service as vpp_app_self_service,
 	vat.adam_id as vpp_app_adam_id,
 	vap.latest_version as vpp_app_version,
 	vap.icon_url as vpp_app_icon_url
 FROM software_titles st
-LEFT JOIN software_installers si ON si.title_id = st.id AND si.global_or_team_id = ?
-LEFT JOIN vpp_apps vap ON vap.title_id = st.id
-LEFT JOIN vpp_apps_teams vat ON vat.global_or_team_id = ? AND vat.adam_id = vap.adam_id AND vat.platform = vap.platform
-LEFT JOIN software_titles_host_counts sthc ON sthc.software_title_id = st.id AND sthc.team_id = ?
+LEFT JOIN software_installers si ON si.title_id = st.id AND %s
+LEFT JOIN vpp_apps vap ON vap.title_id = st.id AND %s
+LEFT JOIN vpp_apps_teams vat ON vat.adam_id = vap.adam_id AND vat.platform = vap.platform AND %s
+LEFT JOIN software_titles_host_counts sthc ON sthc.software_title_id = st.id AND (%s)
 -- placeholder for JOIN on software/software_cve
 %s
 -- placeholder for optional extra WHERE filter
 WHERE %s
 -- placeholder for filter based on software installed on hosts + software installers
 AND (%s)
-GROUP BY st.id, package_self_service, package_name, package_version, vpp_app_self_service, vpp_app_adam_id, vpp_app_version, vpp_app_icon_url`
+GROUP BY st.id, package_self_service, package_name, package_version, package_url, vpp_app_self_service, vpp_app_adam_id, vpp_app_version, vpp_app_icon_url`
 
 	cveJoinType := "LEFT"
 	if opt.VulnerableOnly {
 		cveJoinType = "INNER"
 	}
 
-	args := []any{0, 0, 0}
-	if opt.TeamID != nil {
-		args[0], args[1], args[2] = *opt.TeamID, *opt.TeamID, *opt.TeamID
+	countsJoin := "TRUE"
+	softwareInstallersJoinCond := "TRUE"
+	vppAppsJoinCond := "TRUE"
+	vppAppsTeamsJoinCond := "TRUE"
+	includeVPPAppsAndSoftwareInstallers := "TRUE"
+	switch {
+	case opt.TeamID == nil:
+		countsJoin = "sthc.team_id = 0 AND sthc.global_stats = 1"
+		// When opt.TeamID is nil (aka "All teams") we do not include VPP-apps/installers
+		// that are not installed on any host.
+		includeVPPAppsAndSoftwareInstallers = "FALSE"
+	case *opt.TeamID == 0:
+		countsJoin = "sthc.team_id = 0 AND sthc.global_stats = 0"
+		softwareInstallersJoinCond = fmt.Sprintf("si.global_or_team_id = %d", *opt.TeamID)
+		vppAppsTeamsJoinCond = fmt.Sprintf("vat.global_or_team_id = %d", *opt.TeamID)
+	case *opt.TeamID > 0:
+		countsJoin = fmt.Sprintf("sthc.team_id = %d AND sthc.global_stats = 0", *opt.TeamID)
+		softwareInstallersJoinCond = fmt.Sprintf("si.global_or_team_id = %d", *opt.TeamID)
+		vppAppsTeamsJoinCond = fmt.Sprintf("vat.global_or_team_id = %d", *opt.TeamID)
+	}
+
+	if opt.PackagesOnly {
+		vppAppsJoinCond = "FALSE"
+		vppAppsTeamsJoinCond = "FALSE"
 	}
 
 	additionalWhere := "TRUE"
@@ -299,6 +328,31 @@ GROUP BY st.id, package_self_service, package_name, package_version, vpp_app_sel
 		`, cveJoinType)
 	}
 
+	var args []any
+	if opt.VulnerableOnly && (opt.KnownExploit || opt.MinimumCVSS > 0 || opt.MaximumCVSS > 0) {
+		softwareJoin += `
+			INNER JOIN cve_meta cm ON scve.cve = cm.cve
+		`
+		if opt.KnownExploit {
+			softwareJoin += `
+				AND cm.cisa_known_exploit = 1
+			`
+		}
+		if opt.MinimumCVSS > 0 {
+			softwareJoin += `
+				AND cm.cvss_score >= ?
+			`
+			args = append(args, opt.MinimumCVSS)
+		}
+
+		if opt.MaximumCVSS > 0 {
+			softwareJoin += `
+				AND cm.cvss_score <= ?
+			`
+			args = append(args, opt.MaximumCVSS)
+		}
+	}
+
 	if match != "" {
 		additionalWhere = " (st.name LIKE ? OR scve.cve LIKE ?)"
 		match = likePattern(match)
@@ -306,22 +360,19 @@ GROUP BY st.id, package_self_service, package_name, package_version, vpp_app_sel
 	}
 
 	// default to "a software installer or VPP app exists", and see next condition.
-	defaultFilter := `
-		(si.id IS NOT NULL OR vat.adam_id IS NOT NULL)
-	`
+	defaultFilter := fmt.Sprintf(`
+		((si.id IS NOT NULL OR vat.adam_id IS NOT NULL) AND %s)
+	`, includeVPPAppsAndSoftwareInstallers)
 
-	// add software installed for hosts if any of this is true:
-	//
-	// - we're not filtering for "available for install" only
-	// - we're filtering by vulnerable only
-	if !opt.AvailableForInstall || opt.VulnerableOnly {
+	// add software installed for hosts if we're not filtering for "available for install" only
+	if !opt.AvailableForInstall {
 		defaultFilter = ` ( ` + defaultFilter + ` OR sthc.hosts_count > 0 ) `
 	}
 	if opt.SelfServiceOnly {
-		defaultFilter += ` AND si.self_service = 1 `
+		defaultFilter += ` AND ( si.self_service = 1 OR vat.self_service = 1 ) `
 	}
 
-	stmt = fmt.Sprintf(stmt, softwareJoin, additionalWhere, defaultFilter)
+	stmt = fmt.Sprintf(stmt, softwareInstallersJoinCond, vppAppsJoinCond, vppAppsTeamsJoinCond, countsJoin, softwareJoin, additionalWhere, defaultFilter)
 	return stmt, args
 }
 
diff --git a/server/datastore/mysql/software_titles_test.go b/server/datastore/mysql/software_titles_test.go
index 4bb20acfd8..c0cfa2020f 100644
--- a/server/datastore/mysql/software_titles_test.go
+++ b/server/datastore/mysql/software_titles_test.go
@@ -28,7 +28,9 @@ func TestSoftwareTitles(t *testing.T) {
 		{"TeamFilterSoftwareTitles", testTeamFilterSoftwareTitles},
 		{"ListSoftwareTitlesInstallersOnly", testListSoftwareTitlesInstallersOnly},
 		{"ListSoftwareTitlesAvailableForInstallFilter", testListSoftwareTitlesAvailableForInstallFilter},
+		{"ListSoftwareTitlesAllTeams", testListSoftwareTitlesAllTeams},
 		{"UploadedSoftwareExists", testUploadedSoftwareExists},
+		{"ListSoftwareTitlesVulnerabilityFilters", testListSoftwareTitlesVulnerabilityFilters},
 	}
 	for _, c := range cases {
 		t.Run(c.name, func(t *testing.T) {
@@ -259,12 +261,18 @@ func testSoftwareSyncHostsSoftwareTitles(t *testing.T, ds *Datastore) {
 }
 
 func testOrderSoftwareTitles(t *testing.T, ds *Datastore) {
+	//
+	// All tests below are in hosts in "No team".
+	//
+
 	ctx := context.Background()
 
 	host1 := test.NewHost(t, ds, "host1", "", "host1key", "host1uuid", time.Now())
 	host2 := test.NewHost(t, ds, "host2", "", "host2key", "host2uuid", time.Now())
 	host3 := test.NewHost(t, ds, "host3", "", "host3key", "host3uuid", time.Now())
 
+	user1 := test.NewUser(t, ds, "Alice", "alice@example.com", true)
+
 	software1 := []fleet.Software{
 		{Name: "foo", Version: "0.0.1", Source: "chrome_extensions", Browser: "chrome"},
 		{Name: "foo", Version: "0.0.3", Source: "chrome_extensions", Browser: "chrome"},
@@ -297,6 +305,7 @@ func testOrderSoftwareTitles(t *testing.T, ds *Datastore) {
 		Source:        "apps",
 		InstallScript: "echo",
 		Filename:      "installer1.pkg",
+		UserID:        user1.ID,
 	})
 	require.NoError(t, err)
 	require.NotZero(t, installer1)
@@ -311,13 +320,19 @@ func testOrderSoftwareTitles(t *testing.T, ds *Datastore) {
 		Source:        "apps",
 		InstallScript: "echo",
 		Filename:      "installer2.pkg",
+		UserID:        user1.ID,
 	})
 	require.NoError(t, err)
 	_, err = ds.InsertSoftwareInstallRequest(ctx, host1.ID, installer2, false)
 	require.NoError(t, err)
+
+	test.CreateInsertGlobalVPPToken(t, ds)
+
 	// create a VPP app not installed anywhere
-	_, err = ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{Name: "vpp1", BundleIdentifier: "com.app.vpp1",
-		VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_app_1", Platform: fleet.IPadOSPlatform}}, nil)
+	_, err = ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{
+		Name: "vpp1", BundleIdentifier: "com.app.vpp1",
+		VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_app_1", Platform: fleet.IPadOSPlatform}},
+	}, nil)
 	require.NoError(t, err)
 
 	require.NoError(t, ds.SyncHostsSoftware(ctx, time.Now()))
@@ -325,10 +340,13 @@ func testOrderSoftwareTitles(t *testing.T, ds *Datastore) {
 	require.NoError(t, ds.SyncHostsSoftwareTitles(ctx, time.Now()))
 
 	// primary sort is "hosts_count DESC", followed by "name ASC, source ASC, browser ASC"
-	titles, _, _, err := ds.ListSoftwareTitles(ctx, fleet.SoftwareTitleListOptions{ListOptions: fleet.ListOptions{
-		OrderKey:       "hosts_count",
-		OrderDirection: fleet.OrderDescending,
-	}}, fleet.TeamFilter{User: &fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)}})
+	titles, _, _, err := ds.ListSoftwareTitles(ctx, fleet.SoftwareTitleListOptions{
+		ListOptions: fleet.ListOptions{
+			OrderKey:       "hosts_count",
+			OrderDirection: fleet.OrderDescending,
+		},
+		TeamID: ptr.Uint(0),
+	}, fleet.TeamFilter{User: &fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)}})
 	require.NoError(t, err)
 	require.Len(t, titles, 10)
 	i := 0
@@ -385,10 +403,13 @@ func testOrderSoftwareTitles(t *testing.T, ds *Datastore) {
 	require.NotNil(t, titles[i].AppStoreApp)
 
 	// primary sort is "hosts_count ASC", followed by "name ASC, source ASC, browser ASC"
-	titles, _, _, err = ds.ListSoftwareTitles(ctx, fleet.SoftwareTitleListOptions{ListOptions: fleet.ListOptions{
-		OrderKey:       "hosts_count",
-		OrderDirection: fleet.OrderAscending,
-	}}, fleet.TeamFilter{User: &fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)}})
+	titles, _, _, err = ds.ListSoftwareTitles(ctx, fleet.SoftwareTitleListOptions{
+		ListOptions: fleet.ListOptions{
+			OrderKey:       "hosts_count",
+			OrderDirection: fleet.OrderAscending,
+		},
+		TeamID: ptr.Uint(0),
+	}, fleet.TeamFilter{User: &fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)}})
 	require.NoError(t, err)
 	require.Len(t, titles, 10)
 	i = 0
@@ -425,10 +446,13 @@ func testOrderSoftwareTitles(t *testing.T, ds *Datastore) {
 	require.Equal(t, "deb_packages", titles[i].Source)
 
 	// primary sort is "name ASC", followed by "host_count DESC, source ASC, browser ASC"
-	titles, _, _, err = ds.ListSoftwareTitles(ctx, fleet.SoftwareTitleListOptions{ListOptions: fleet.ListOptions{
-		OrderKey:       "name",
-		OrderDirection: fleet.OrderAscending,
-	}}, fleet.TeamFilter{User: &fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)}})
+	titles, _, _, err = ds.ListSoftwareTitles(ctx, fleet.SoftwareTitleListOptions{
+		ListOptions: fleet.ListOptions{
+			OrderKey:       "name",
+			OrderDirection: fleet.OrderAscending,
+		},
+		TeamID: ptr.Uint(0),
+	}, fleet.TeamFilter{User: &fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)}})
 	require.NoError(t, err)
 	require.Len(t, titles, 10)
 	i = 0
@@ -465,10 +489,13 @@ func testOrderSoftwareTitles(t *testing.T, ds *Datastore) {
 	assert.Equal(t, "ipados_apps", titles[i].Source)
 
 	// primary sort is "name DESC", followed by "host_count DESC, source ASC, browser ASC"
-	titles, _, _, err = ds.ListSoftwareTitles(ctx, fleet.SoftwareTitleListOptions{ListOptions: fleet.ListOptions{
-		OrderKey:       "name",
-		OrderDirection: fleet.OrderDescending,
-	}}, fleet.TeamFilter{User: &fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)}})
+	titles, _, _, err = ds.ListSoftwareTitles(ctx, fleet.SoftwareTitleListOptions{
+		ListOptions: fleet.ListOptions{
+			OrderKey:       "name",
+			OrderDirection: fleet.OrderDescending,
+		},
+		TeamID: ptr.Uint(0),
+	}, fleet.TeamFilter{User: &fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)}})
 	require.NoError(t, err)
 	require.Len(t, titles, 10)
 	i = 0
@@ -505,11 +532,14 @@ func testOrderSoftwareTitles(t *testing.T, ds *Datastore) {
 	require.Equal(t, "apps", titles[i].Source)
 
 	// using a match query
-	titles, _, _, err = ds.ListSoftwareTitles(ctx, fleet.SoftwareTitleListOptions{ListOptions: fleet.ListOptions{
-		OrderKey:       "name",
-		OrderDirection: fleet.OrderDescending,
-		MatchQuery:     "ba",
-	}}, fleet.TeamFilter{User: &fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)}})
+	titles, _, _, err = ds.ListSoftwareTitles(ctx, fleet.SoftwareTitleListOptions{
+		ListOptions: fleet.ListOptions{
+			OrderKey:       "name",
+			OrderDirection: fleet.OrderDescending,
+			MatchQuery:     "ba",
+		},
+		TeamID: ptr.Uint(0),
+	}, fleet.TeamFilter{User: &fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)}})
 	require.NoError(t, err)
 	require.Len(t, titles, 4)
 	require.Equal(t, "baz", titles[0].Name)
@@ -524,11 +554,14 @@ func testOrderSoftwareTitles(t *testing.T, ds *Datastore) {
 	require.Equal(t, "apps", titles[3].Source)
 
 	// using another (installer-only) match query
-	titles, _, _, err = ds.ListSoftwareTitles(ctx, fleet.SoftwareTitleListOptions{ListOptions: fleet.ListOptions{
-		OrderKey:       "name",
-		OrderDirection: fleet.OrderDescending,
-		MatchQuery:     "insta",
-	}}, fleet.TeamFilter{User: &fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)}})
+	titles, _, _, err = ds.ListSoftwareTitles(ctx, fleet.SoftwareTitleListOptions{
+		ListOptions: fleet.ListOptions{
+			OrderKey:       "name",
+			OrderDirection: fleet.OrderDescending,
+			MatchQuery:     "insta",
+		},
+		TeamID: ptr.Uint(0),
+	}, fleet.TeamFilter{User: &fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)}})
 	require.NoError(t, err)
 	require.Len(t, titles, 2)
 	require.Equal(t, "installer2", titles[0].Name)
@@ -537,10 +570,14 @@ func testOrderSoftwareTitles(t *testing.T, ds *Datastore) {
 	require.Equal(t, "apps", titles[1].Source)
 
 	// filter on self-service only
-	titles, _, _, err = ds.ListSoftwareTitles(ctx, fleet.SoftwareTitleListOptions{ListOptions: fleet.ListOptions{
-		OrderKey:       "name",
-		OrderDirection: fleet.OrderDescending,
-	}, SelfServiceOnly: true}, fleet.TeamFilter{User: &fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)}})
+	titles, _, _, err = ds.ListSoftwareTitles(ctx, fleet.SoftwareTitleListOptions{
+		ListOptions: fleet.ListOptions{
+			OrderKey:       "name",
+			OrderDirection: fleet.OrderDescending,
+		},
+		TeamID:          ptr.Uint(0),
+		SelfServiceOnly: true,
+	}, fleet.TeamFilter{User: &fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)}})
 	require.NoError(t, err)
 	require.Len(t, titles, 1)
 	require.Equal(t, "installer1", titles[0].Name)
@@ -564,6 +601,10 @@ func testTeamFilterSoftwareTitles(t *testing.T, ds *Datastore) {
 	team2, err := ds.NewTeam(ctx, &fleet.Team{Name: "team2"})
 	require.NoError(t, err)
 
+	test.CreateInsertGlobalVPPToken(t, ds)
+
+	user1 := test.NewUser(t, ds, "Alice", "alice@example.com", true)
+
 	host1 := test.NewHost(t, ds, "host1", "", "host1key", "host1uuid", time.Now())
 	require.NoError(t, ds.AddHostsToTeam(ctx, &team1.ID, []uint{host1.ID}))
 	host2 := test.NewHost(t, ds, "host2", "", "host2key", "host2uuid", time.Now())
@@ -597,6 +638,7 @@ func testTeamFilterSoftwareTitles(t *testing.T, ds *Datastore) {
 		Filename:         "installer1.pkg",
 		BundleIdentifier: "foo.bar",
 		TeamID:           &team1.ID,
+		UserID:           user1.ID,
 	})
 	require.NoError(t, err)
 	require.NotZero(t, installer1)
@@ -612,35 +654,43 @@ func testTeamFilterSoftwareTitles(t *testing.T, ds *Datastore) {
 		InstallScript: "echo",
 		Filename:      "installer2.pkg",
 		TeamID:        &team2.ID,
+		UserID:        user1.ID,
 	})
 	require.NoError(t, err)
 	require.NotZero(t, installer2)
+
 	// create a VPP app for team2
-	_, err = ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{Name: "vpp2", BundleIdentifier: "com.app.vpp2",
-		VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_app_2", Platform: fleet.IOSPlatform}}, &team2.ID)
+	_, err = ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{
+		Name: "vpp2", BundleIdentifier: "com.app.vpp2",
+		VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_app_2", Platform: fleet.IOSPlatform}},
+	}, &team2.ID)
 	require.NoError(t, err)
 
-	// create a VPP app for No Team
-	_, err = ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{Name: "vpp3", BundleIdentifier: "com.app.vpp3",
-		VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_app_3", Platform: fleet.MacOSPlatform}}, ptr.Uint(0))
+	// create a VPP app for "No team", allowing self-service
+	_, err = ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{
+		Name: "vpp3", BundleIdentifier: "com.app.vpp3",
+		VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_app_3", Platform: fleet.MacOSPlatform}, SelfService: true},
+	}, ptr.Uint(0))
 	require.NoError(t, err)
 
 	require.NoError(t, ds.SyncHostsSoftware(ctx, time.Now()))
 	require.NoError(t, ds.ReconcileSoftwareTitles(ctx))
 	require.NoError(t, ds.SyncHostsSoftwareTitles(ctx, time.Now()))
 
-	// Testing the global user (for no team)
+	// Testing the global user (for "All teams")
+	// Should not return VPP apps or software installers (because they are not installed yet).
 	globalTeamFilter := fleet.TeamFilter{User: userGlobalAdmin, IncludeObserver: true}
 	titles, count, _, err := ds.ListSoftwareTitles(
-		context.Background(), fleet.SoftwareTitleListOptions{ListOptions: fleet.ListOptions{}}, globalTeamFilter,
+		context.Background(), fleet.SoftwareTitleListOptions{
+			ListOptions: fleet.ListOptions{},
+			TeamID:      nil,
+		}, globalTeamFilter,
 	)
 	sortTitlesByName(titles)
-	// software installers are associated with a team, so they don't show up in
-	// this request for no team, but other titles do because software titles are
-	// not associated with a team.
 	require.NoError(t, err)
-	require.Len(t, titles, 3)
-	require.Equal(t, 3, count)
+	require.Len(t, titles, 2)
+	require.Equal(t, 2, count)
+
 	require.Equal(t, "bar", titles[0].Name)
 	require.Equal(t, "deb_packages", titles[0].Source)
 	require.Equal(t, "foo", titles[1].Name)
@@ -653,19 +703,39 @@ func testTeamFilterSoftwareTitles(t *testing.T, ds *Datastore) {
 	assert.Equal(t, uint(2), titles[1].HostsCount)
 	require.Nil(t, titles[1].SoftwarePackage)
 	require.Nil(t, titles[1].AppStoreApp)
-	require.Equal(t, uint(0), titles[2].VersionsCount)
-	require.Nil(t, titles[2].SoftwarePackage)
-	require.Equal(t, "vpp3", titles[2].Name)
+	barTitle := titles[0]
+	fooTitle := titles[1]
 
-	title, err := ds.SoftwareTitleByID(context.Background(), titles[0].ID, nil, globalTeamFilter)
+	// Testing the global user (for "No team")
+	// should only return vpp3 because it's the only app in the "No team".
+	titles, count, _, err = ds.ListSoftwareTitles(
+		context.Background(), fleet.SoftwareTitleListOptions{
+			ListOptions: fleet.ListOptions{},
+			TeamID:      ptr.Uint(0),
+		}, globalTeamFilter,
+	)
+	sortTitlesByName(titles)
+	require.NoError(t, err)
+	require.Len(t, titles, 1)
+	require.Equal(t, 1, count)
+	require.Equal(t, uint(0), titles[0].VersionsCount)
+	require.Nil(t, titles[0].SoftwarePackage)
+	require.Equal(t, "vpp3", titles[0].Name)
+	require.NotNil(t, titles[0].AppStoreApp)
+	require.NotNil(t, titles[0].AppStoreApp.SelfService)
+	require.True(t, *titles[0].AppStoreApp.SelfService)
+
+	// Get title of bar software.
+	title, err := ds.SoftwareTitleByID(context.Background(), barTitle.ID, nil, globalTeamFilter)
 	require.NoError(t, err)
 	require.Zero(t, title.SoftwareInstallersCount)
 	require.Zero(t, title.VPPAppsCount)
+
 	// ListSoftwareTitles does not populate version host counts, so we do that manually
-	titles[0].Versions[0].HostsCount = ptr.Uint(1)
+	barTitle.Versions[0].HostsCount = ptr.Uint(1)
 	assert.Equal(
 		t,
-		titles[0],
+		barTitle,
 		fleet.SoftwareTitleListResult{
 			ID:              title.ID,
 			Name:            title.Name,
@@ -679,11 +749,11 @@ func testTeamFilterSoftwareTitles(t *testing.T, ds *Datastore) {
 	)
 
 	// Testing with team filter -- this team does not contain this software title
-	_, err = ds.SoftwareTitleByID(context.Background(), titles[0].ID, &team1.ID, globalTeamFilter)
+	_, err = ds.SoftwareTitleByID(context.Background(), barTitle.ID, &team1.ID, globalTeamFilter)
 	assert.ErrorIs(t, err, sql.ErrNoRows)
 
 	// Testing with team filter -- this team does contain this software title
-	title, err = ds.SoftwareTitleByID(context.Background(), titles[1].ID, &team1.ID, globalTeamFilter)
+	title, err = ds.SoftwareTitleByID(context.Background(), fooTitle.ID, &team1.ID, globalTeamFilter)
 	require.NoError(t, err)
 	require.Zero(t, title.SoftwareInstallersCount)
 	require.Zero(t, title.VPPAppsCount)
@@ -781,6 +851,15 @@ func testTeamFilterSoftwareTitles(t *testing.T, ds *Datastore) {
 	})
 	require.NoError(t, err)
 	require.Len(t, titles, 0)
+
+	// Testing the no-team filter with self-service only
+	titles, _, _, err = ds.ListSoftwareTitles(context.Background(), fleet.SoftwareTitleListOptions{ListOptions: fleet.ListOptions{}, SelfServiceOnly: true, TeamID: ptr.Uint(0)}, fleet.TeamFilter{
+		User:            userGlobalAdmin,
+		IncludeObserver: true,
+	})
+	require.NoError(t, err)
+	require.Len(t, titles, 1)
+	require.Equal(t, "vpp3", titles[0].Name)
 }
 
 func sortTitlesByName(titles []fleet.SoftwareTitleListResult) {
@@ -790,12 +869,17 @@ func sortTitlesByName(titles []fleet.SoftwareTitleListResult) {
 func testListSoftwareTitlesInstallersOnly(t *testing.T, ds *Datastore) {
 	ctx := context.Background()
 
+	user1 := test.NewUser(t, ds, "Alice", "alice@example.com", true)
+
+	test.CreateInsertGlobalVPPToken(t, ds)
+
 	// create a couple software installers not installed on any host
 	installer1, err := ds.MatchOrCreateSoftwareInstaller(ctx, &fleet.UploadSoftwareInstallerPayload{
 		Title:         "installer1",
 		Source:        "apps",
 		InstallScript: "echo",
 		Filename:      "installer1.pkg",
+		UserID:        user1.ID,
 	})
 	require.NoError(t, err)
 	require.NotZero(t, installer1)
@@ -804,18 +888,24 @@ func testListSoftwareTitlesInstallersOnly(t *testing.T, ds *Datastore) {
 		Source:        "apps",
 		InstallScript: "echo",
 		Filename:      "installer2.pkg",
+		UserID:        user1.ID,
 	})
 	require.NoError(t, err)
 	require.NotZero(t, installer2)
 	// create a VPP app not installed on a host
-	_, err = ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{Name: "vpp1", BundleIdentifier: "com.app,vpp1",
-		VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_app_1", Platform: fleet.MacOSPlatform}}, nil)
+	_, err = ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{
+		Name: "vpp1", BundleIdentifier: "com.app,vpp1",
+		VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_app_1", Platform: fleet.MacOSPlatform}},
+	}, nil)
 	require.NoError(t, err)
 
-	titles, counts, _, err := ds.ListSoftwareTitles(ctx, fleet.SoftwareTitleListOptions{ListOptions: fleet.ListOptions{
-		OrderKey:       "name",
-		OrderDirection: fleet.OrderAscending,
-	}}, fleet.TeamFilter{User: &fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)}})
+	titles, counts, _, err := ds.ListSoftwareTitles(ctx, fleet.SoftwareTitleListOptions{
+		ListOptions: fleet.ListOptions{
+			OrderKey:       "name",
+			OrderDirection: fleet.OrderAscending,
+		},
+		TeamID: ptr.Uint(0),
+	}, fleet.TeamFilter{User: &fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)}})
 	require.NoError(t, err)
 	require.EqualValues(t, 3, counts)
 	require.Len(t, titles, 3)
@@ -834,11 +924,14 @@ func testListSoftwareTitlesInstallersOnly(t *testing.T, ds *Datastore) {
 	require.NoError(t, ds.SyncHostsSoftwareTitles(ctx, time.Now()))
 
 	// match installer1 name
-	titles, counts, _, err = ds.ListSoftwareTitles(ctx, fleet.SoftwareTitleListOptions{ListOptions: fleet.ListOptions{
-		OrderKey:       "name",
-		OrderDirection: fleet.OrderAscending,
-		MatchQuery:     "installer1",
-	}}, fleet.TeamFilter{User: &fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)}})
+	titles, counts, _, err = ds.ListSoftwareTitles(ctx, fleet.SoftwareTitleListOptions{
+		ListOptions: fleet.ListOptions{
+			OrderKey:       "name",
+			OrderDirection: fleet.OrderAscending,
+			MatchQuery:     "installer1",
+		},
+		TeamID: ptr.Uint(0),
+	}, fleet.TeamFilter{User: &fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)}})
 	require.NoError(t, err)
 	require.EqualValues(t, 1, counts)
 	require.Len(t, titles, 1)
@@ -847,11 +940,15 @@ func testListSoftwareTitlesInstallersOnly(t *testing.T, ds *Datastore) {
 	require.True(t, titles[0].CountsUpdatedAt.IsZero())
 
 	// vulnerable only returns nothing
-	titles, counts, _, err = ds.ListSoftwareTitles(ctx, fleet.SoftwareTitleListOptions{ListOptions: fleet.ListOptions{
-		OrderKey:       "name",
-		OrderDirection: fleet.OrderAscending,
-		MatchQuery:     "installer1",
-	}, VulnerableOnly: true}, fleet.TeamFilter{User: &fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)}})
+	titles, counts, _, err = ds.ListSoftwareTitles(ctx, fleet.SoftwareTitleListOptions{
+		ListOptions: fleet.ListOptions{
+			OrderKey:       "name",
+			OrderDirection: fleet.OrderAscending,
+			MatchQuery:     "installer1",
+		},
+		TeamID:         ptr.Uint(0),
+		VulnerableOnly: true,
+	}, fleet.TeamFilter{User: &fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)}})
 	require.NoError(t, err)
 	require.EqualValues(t, 0, counts)
 	require.Len(t, titles, 0)
@@ -865,6 +962,7 @@ func testListSoftwareTitlesInstallersOnly(t *testing.T, ds *Datastore) {
 				OrderDirection: fleet.OrderAscending,
 			},
 			AvailableForInstall: true,
+			TeamID:              ptr.Uint(0),
 		},
 		fleet.TeamFilter{User: &fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)}},
 	)
@@ -876,13 +974,17 @@ func testListSoftwareTitlesInstallersOnly(t *testing.T, ds *Datastore) {
 
 func testListSoftwareTitlesAvailableForInstallFilter(t *testing.T, ds *Datastore) {
 	ctx := context.Background()
+	user1 := test.NewUser(t, ds, "Alice", "alice@example.com", true)
 
-	// create a 2 software installers
+	test.CreateInsertGlobalVPPToken(t, ds)
+
+	// create 2 software installers
 	installer1, err := ds.MatchOrCreateSoftwareInstaller(ctx, &fleet.UploadSoftwareInstallerPayload{
 		Title:         "installer1",
 		Source:        "apps",
 		InstallScript: "echo",
 		Filename:      "installer1.pkg",
+		UserID:        user1.ID,
 	})
 	require.NoError(t, err)
 	require.NotZero(t, installer1)
@@ -891,22 +993,31 @@ func testListSoftwareTitlesAvailableForInstallFilter(t *testing.T, ds *Datastore
 		Source:        "apps",
 		InstallScript: "echo",
 		Filename:      "installer2.pkg",
+		UserID:        user1.ID,
 	})
 	require.NoError(t, err)
 	require.NotZero(t, installer2)
 
 	// create a 4 VPP apps
-	_, err = ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{Name: "vpp1", BundleIdentifier: "com.example.vpp1",
-		VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_app_1", Platform: fleet.MacOSPlatform}}, nil)
+	_, err = ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{
+		Name: "vpp1", BundleIdentifier: "com.example.vpp1",
+		VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_app_1", Platform: fleet.MacOSPlatform}},
+	}, nil)
 	require.NoError(t, err)
-	_, err = ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{Name: "vpp2", BundleIdentifier: "com.example.vpp2",
-		VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_app_2", Platform: fleet.IPadOSPlatform}}, nil)
+	_, err = ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{
+		Name: "vpp2", BundleIdentifier: "com.example.vpp2",
+		VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_app_2", Platform: fleet.IPadOSPlatform}},
+	}, nil)
 	require.NoError(t, err)
-	_, err = ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{Name: "vpp2", BundleIdentifier: "com.example.vpp2",
-		VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_app_2", Platform: fleet.MacOSPlatform}}, nil)
+	_, err = ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{
+		Name: "vpp2", BundleIdentifier: "com.example.vpp2",
+		VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_app_2", Platform: fleet.MacOSPlatform}},
+	}, nil)
 	require.NoError(t, err)
-	_, err = ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{Name: "vpp2", BundleIdentifier: "com.example.vpp2",
-		VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_app_2", Platform: fleet.IOSPlatform}}, nil)
+	_, err = ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{
+		Name: "vpp2", BundleIdentifier: "com.example.vpp2",
+		VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_app_2", Platform: fleet.IOSPlatform}},
+	}, nil)
 	require.NoError(t, err)
 
 	host := test.NewHost(t, ds, "host", "", "hostkey", "hostuuid", time.Now())
@@ -914,6 +1025,8 @@ func testListSoftwareTitlesAvailableForInstallFilter(t *testing.T, ds *Datastore
 		{Name: "foo", Version: "0.0.1", Source: "chrome_extensions"},
 		{Name: "foo", Version: "0.0.3", Source: "chrome_extensions"},
 		{Name: "bar", Version: "0.0.3", Source: "deb_packages"},
+		{Name: "vpp1", Version: "0.0.1", Source: "apps"},
+		{Name: "installer1", Version: "0.0.1", Source: "apps"},
 	}
 	_, err = ds.UpdateHostSoftware(ctx, host.ID, software)
 	require.NoError(t, err)
@@ -929,6 +1042,7 @@ func testListSoftwareTitlesAvailableForInstallFilter(t *testing.T, ds *Datastore
 				OrderKey:       "name",
 				OrderDirection: fleet.OrderAscending,
 			},
+			TeamID: ptr.Uint(0),
 		},
 		fleet.TeamFilter{User: &fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)}},
 	)
@@ -954,6 +1068,63 @@ func testListSoftwareTitlesAvailableForInstallFilter(t *testing.T, ds *Datastore
 		{name: "vpp2", source: "apps"},
 	}, names)
 
+	var vppVersionID uint
+	var installer1ID uint
+	var fooID uint
+	for _, title := range titles {
+		switch title.Name {
+		case "vpp1":
+			vppVersionID = title.Versions[0].ID
+		case "installer1":
+			installer1ID = title.Versions[0].ID
+		case "foo":
+			fooID = title.Versions[0].ID
+		}
+	}
+
+	_, err = ds.InsertSoftwareVulnerability(ctx, fleet.SoftwareVulnerability{
+		SoftwareID: vppVersionID,
+		CVE:        "CVE-2021-1234",
+	}, fleet.NVDSource)
+	require.NoError(t, err)
+
+	_, err = ds.InsertSoftwareVulnerability(ctx, fleet.SoftwareVulnerability{
+		SoftwareID: installer1ID,
+		CVE:        "CVE-2021-1234",
+	}, fleet.NVDSource)
+	require.NoError(t, err)
+
+	_, err = ds.InsertSoftwareVulnerability(ctx, fleet.SoftwareVulnerability{
+		SoftwareID: fooID,
+		CVE:        "CVE-2021-1234",
+	}, fleet.NVDSource)
+	require.NoError(t, err)
+
+	titles, counts, _, err = ds.ListSoftwareTitles(
+		ctx,
+		fleet.SoftwareTitleListOptions{
+			ListOptions: fleet.ListOptions{
+				OrderKey:       "name",
+				OrderDirection: fleet.OrderAscending,
+			},
+			TeamID:              ptr.Uint(0),
+			AvailableForInstall: true,
+			VulnerableOnly:      true,
+		},
+		fleet.TeamFilter{User: &fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)}},
+	)
+	require.NoError(t, err)
+	require.EqualValues(t, 2, counts)
+	require.Len(t, titles, 2)
+	names = make([]nameSource, 0, len(titles))
+	for _, title := range titles {
+		names = append(names, nameSource{name: title.Name, source: title.Source})
+	}
+	assert.ElementsMatch(t, []nameSource{
+		{name: "installer1", source: "apps"},
+		{name: "vpp1", source: "apps"},
+	}, names)
+
 	// with filter returns only available for install
 	titles, counts, _, err = ds.ListSoftwareTitles(
 		ctx,
@@ -963,6 +1134,7 @@ func testListSoftwareTitlesAvailableForInstallFilter(t *testing.T, ds *Datastore
 				OrderDirection: fleet.OrderAscending,
 			},
 			AvailableForInstall: true,
+			TeamID:              ptr.Uint(0),
 		},
 		fleet.TeamFilter{User: &fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)}},
 	)
@@ -984,11 +1156,202 @@ func testListSoftwareTitlesAvailableForInstallFilter(t *testing.T, ds *Datastore
 	}, names)
 }
 
+func testListSoftwareTitlesAllTeams(t *testing.T, ds *Datastore) {
+	ctx := context.Background()
+
+	test.CreateInsertGlobalVPPToken(t, ds)
+
+	team1, err := ds.NewTeam(ctx, &fleet.Team{Name: "team1"})
+	require.NoError(t, err)
+	team2, err := ds.NewTeam(ctx, &fleet.Team{Name: "team2"})
+	require.NoError(t, err)
+
+	user1 := test.NewUser(t, ds, "Alice", "alice@example.com", true)
+
+	// Create a macOS software foobar installer on "No team".
+	macOSInstallerNoTeam, err := ds.MatchOrCreateSoftwareInstaller(ctx, &fleet.UploadSoftwareInstallerPayload{
+		Title:            "foobar",
+		BundleIdentifier: "com.foo.bar",
+		Source:           "apps",
+		InstallScript:    "echo",
+		Filename:         "foobar.pkg",
+		TeamID:           nil,
+		UserID:           user1.ID,
+	})
+	require.NoError(t, err)
+
+	// Create an iOS Canva installer on "team1".
+	require.NotZero(t, macOSInstallerNoTeam)
+	_, err = ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{
+		Name: "Canva", BundleIdentifier: "com.example.canva",
+		VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_app_canva", Platform: fleet.IOSPlatform}},
+	}, &team1.ID)
+	require.NoError(t, err)
+
+	// Create a macOS Canva installer on "team1".
+	require.NotZero(t, macOSInstallerNoTeam)
+	_, err = ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{
+		Name: "Canva", BundleIdentifier: "com.example.canva",
+		VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_app_canva", Platform: fleet.MacOSPlatform}},
+	}, &team1.ID)
+	require.NoError(t, err)
+
+	// Create an iPadOS Canva installer on "team2".
+	require.NotZero(t, macOSInstallerNoTeam)
+	_, err = ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{
+		Name: "Canva", BundleIdentifier: "com.example.canva",
+		VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_app_canva", Platform: fleet.IPadOSPlatform}},
+	}, &team2.ID)
+	require.NoError(t, err)
+
+	// Add a macOS host on "No team" with some software.
+	host := test.NewHost(t, ds, "host", "", "hostkey", "hostuuid", time.Now())
+	software := []fleet.Software{
+		{Name: "foo", Version: "0.0.1", Source: "chrome_extensions"},
+		{Name: "foo", Version: "0.0.3", Source: "chrome_extensions"},
+		{Name: "bar", Version: "0.0.3", Source: "deb_packages"},
+	}
+	_, err = ds.UpdateHostSoftware(ctx, host.ID, software)
+	require.NoError(t, err)
+
+	// Simulate vulnerabilities cron
+	require.NoError(t, ds.SyncHostsSoftware(ctx, time.Now()))
+	require.NoError(t, ds.ReconcileSoftwareTitles(ctx))
+	require.NoError(t, ds.SyncHostsSoftwareTitles(ctx, time.Now()))
+
+	// List software titles for "All teams", should only return the host software titles
+	// and no installers/VPP-apps because none is installed yet.
+	titles, counts, _, err := ds.ListSoftwareTitles(
+		ctx,
+		fleet.SoftwareTitleListOptions{
+			ListOptions: fleet.ListOptions{
+				OrderKey:       "name",
+				OrderDirection: fleet.OrderAscending,
+			},
+			TeamID: nil,
+		},
+		fleet.TeamFilter{User: &fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)}},
+	)
+	require.NoError(t, err)
+	assert.EqualValues(t, 2, counts)
+	assert.Len(t, titles, 2)
+	type nameSource struct {
+		name   string
+		source string
+	}
+	names := make([]nameSource, 0, len(titles))
+	for _, title := range titles {
+		names = append(names, nameSource{name: title.Name, source: title.Source})
+	}
+	assert.ElementsMatch(t, []nameSource{
+		{name: "bar", source: "deb_packages"},
+		{name: "foo", source: "chrome_extensions"},
+	}, names)
+
+	// List software for "No team". Should list the host's software + the macOS installer.
+	titles, counts, _, err = ds.ListSoftwareTitles(
+		ctx,
+		fleet.SoftwareTitleListOptions{
+			ListOptions: fleet.ListOptions{
+				OrderKey:       "name",
+				OrderDirection: fleet.OrderAscending,
+			},
+			TeamID: ptr.Uint(0),
+		},
+		fleet.TeamFilter{User: &fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)}},
+	)
+	require.NoError(t, err)
+	assert.EqualValues(t, 3, counts)
+	assert.Len(t, titles, 3)
+	names = make([]nameSource, 0, len(titles))
+	for _, title := range titles {
+		names = append(names, nameSource{name: title.Name, source: title.Source})
+	}
+	assert.ElementsMatch(t, []nameSource{
+		{name: "bar", source: "deb_packages"},
+		{name: "foo", source: "chrome_extensions"},
+		{name: "foobar", source: "apps"},
+	}, names)
+
+	// List software for "team1". Should list Canva for iOS and macOS.
+	titles, counts, _, err = ds.ListSoftwareTitles(
+		ctx,
+		fleet.SoftwareTitleListOptions{
+			ListOptions: fleet.ListOptions{
+				OrderKey:       "name",
+				OrderDirection: fleet.OrderAscending,
+			},
+			TeamID: &team1.ID,
+		},
+		fleet.TeamFilter{User: &fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)}},
+	)
+	require.NoError(t, err)
+	assert.EqualValues(t, 2, counts)
+	assert.Len(t, titles, 2)
+	names = make([]nameSource, 0, len(titles))
+	for _, title := range titles {
+		names = append(names, nameSource{name: title.Name, source: title.Source})
+	}
+	assert.ElementsMatch(t, []nameSource{
+		{name: "Canva", source: "ios_apps"},
+		{name: "Canva", source: "apps"},
+	}, names)
+
+	// List software for "team2". Should list Canva for iPadOS.
+	titles, counts, _, err = ds.ListSoftwareTitles(
+		ctx,
+		fleet.SoftwareTitleListOptions{
+			ListOptions: fleet.ListOptions{
+				OrderKey:       "name",
+				OrderDirection: fleet.OrderAscending,
+			},
+			TeamID: &team2.ID,
+		},
+		fleet.TeamFilter{User: &fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)}},
+	)
+	require.NoError(t, err)
+	assert.EqualValues(t, 1, counts)
+	assert.Len(t, titles, 1)
+	names = make([]nameSource, 0, len(titles))
+	for _, title := range titles {
+		names = append(names, nameSource{name: title.Name, source: title.Source})
+	}
+	assert.ElementsMatch(t, []nameSource{
+		{name: "Canva", source: "ipados_apps"},
+	}, names)
+
+	// List software available for install on "No team". Should list "foobar" package only.
+	titles, counts, _, err = ds.ListSoftwareTitles(
+		ctx,
+		fleet.SoftwareTitleListOptions{
+			ListOptions: fleet.ListOptions{
+				OrderKey:       "name",
+				OrderDirection: fleet.OrderAscending,
+			},
+			AvailableForInstall: true,
+			TeamID:              ptr.Uint(0),
+		},
+		fleet.TeamFilter{User: &fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)}},
+	)
+	require.NoError(t, err)
+	require.EqualValues(t, 1, counts)
+	require.Len(t, titles, 1)
+
+	names = make([]nameSource, 0, len(titles))
+	for _, title := range titles {
+		names = append(names, nameSource{name: title.Name, source: title.Source})
+	}
+	assert.ElementsMatch(t, []nameSource{
+		{name: "foobar", source: "apps"},
+	}, names)
+}
+
 func testUploadedSoftwareExists(t *testing.T, ds *Datastore) {
 	ctx := context.Background()
 
 	tm, err := ds.NewTeam(ctx, &fleet.Team{Name: "Team Foo"})
 	require.NoError(t, err)
+	user1 := test.NewUser(t, ds, "Alice", "alice@example.com", true)
 
 	installer1, err := ds.MatchOrCreateSoftwareInstaller(ctx, &fleet.UploadSoftwareInstallerPayload{
 		Title:            "installer1",
@@ -996,6 +1359,7 @@ func testUploadedSoftwareExists(t *testing.T, ds *Datastore) {
 		InstallScript:    "echo",
 		Filename:         "installer1.pkg",
 		BundleIdentifier: "com.foo.installer1",
+		UserID:           user1.ID,
 	})
 	require.NoError(t, err)
 	require.NotZero(t, installer1)
@@ -1006,6 +1370,7 @@ func testUploadedSoftwareExists(t *testing.T, ds *Datastore) {
 		Filename:         "installer2.pkg",
 		TeamID:           &tm.ID,
 		BundleIdentifier: "com.foo.installer2",
+		UserID:           user1.ID,
 	})
 	require.NoError(t, err)
 	require.NotZero(t, installer2)
@@ -1022,3 +1387,289 @@ func testUploadedSoftwareExists(t *testing.T, ds *Datastore) {
 	require.NoError(t, err)
 	require.True(t, exists)
 }
+
+func testListSoftwareTitlesVulnerabilityFilters(t *testing.T, ds *Datastore) {
+	ctx := context.Background()
+	host := test.NewHost(t, ds, "host", "", "hostkey", "hostuuid", time.Now())
+
+	software := []fleet.Software{
+		{Name: "chrome", Version: "0.0.1", Source: "apps"},
+		{Name: "chrome", Version: "0.0.3", Source: "apps"},
+		{Name: "safari", Version: "0.0.3", Source: "apps"},
+		{Name: "safari", Version: "0.0.1", Source: "apps"},
+		{Name: "firefox", Version: "0.0.3", Source: "apps"},
+		{Name: "edge", Version: "0.0.3", Source: "apps"},
+		{Name: "brave", Version: "0.0.3", Source: "apps"},
+		{Name: "opera", Version: "0.0.3", Source: "apps"},
+		{Name: "internet explorer", Version: "0.0.3", Source: "apps"},
+		{Name: "netscape", Version: "0.0.3", Source: "apps"},
+	}
+
+	sw, err := ds.UpdateHostSoftware(ctx, host.ID, software)
+	require.NoError(t, err)
+
+	var chrome001 uint
+	var safari001 uint
+	var firefox003 uint
+	var edge003 uint
+	var brave003 uint
+	var opera003 uint
+	var ie003 uint
+	for s := range sw.Inserted {
+		switch {
+		case sw.Inserted[s].Name == "chrome" && sw.Inserted[s].Version == "0.0.1":
+			chrome001 = sw.Inserted[s].ID
+		case sw.Inserted[s].Name == "safari" && sw.Inserted[s].Version == "0.0.1":
+			safari001 = sw.Inserted[s].ID
+		case sw.Inserted[s].Name == "firefox" && sw.Inserted[s].Version == "0.0.3":
+			firefox003 = sw.Inserted[s].ID
+		case sw.Inserted[s].Name == "edge" && sw.Inserted[s].Version == "0.0.3":
+			edge003 = sw.Inserted[s].ID
+		case sw.Inserted[s].Name == "brave" && sw.Inserted[s].Version == "0.0.3":
+			brave003 = sw.Inserted[s].ID
+		case sw.Inserted[s].Name == "opera" && sw.Inserted[s].Version == "0.0.3":
+			opera003 = sw.Inserted[s].ID
+		case sw.Inserted[s].Name == "internet explorer" && sw.Inserted[s].Version == "0.0.3":
+			ie003 = sw.Inserted[s].ID
+		}
+	}
+
+	_, err = ds.InsertSoftwareVulnerability(ctx, fleet.SoftwareVulnerability{
+		SoftwareID: chrome001,
+		CVE:        "CVE-2024-1234",
+	}, fleet.NVDSource)
+	require.NoError(t, err)
+	_, err = ds.InsertSoftwareVulnerability(ctx, fleet.SoftwareVulnerability{
+		SoftwareID: safari001,
+		CVE:        "CVE-2024-1235",
+	}, fleet.NVDSource)
+	require.NoError(t, err)
+	_, err = ds.InsertSoftwareVulnerability(ctx, fleet.SoftwareVulnerability{
+		SoftwareID: firefox003,
+		CVE:        "CVE-2024-1236",
+	}, fleet.NVDSource)
+	require.NoError(t, err)
+	_, err = ds.InsertSoftwareVulnerability(ctx, fleet.SoftwareVulnerability{
+		SoftwareID: edge003,
+		CVE:        "CVE-2024-1237",
+	}, fleet.NVDSource)
+	require.NoError(t, err)
+	_, err = ds.InsertSoftwareVulnerability(ctx, fleet.SoftwareVulnerability{
+		SoftwareID: brave003,
+		CVE:        "CVE-2024-1238",
+	}, fleet.NVDSource)
+	require.NoError(t, err)
+	_, err = ds.InsertSoftwareVulnerability(ctx, fleet.SoftwareVulnerability{
+		SoftwareID: opera003,
+		CVE:        "CVE-2024-1239",
+	}, fleet.NVDSource)
+	require.NoError(t, err)
+	_, err = ds.InsertSoftwareVulnerability(ctx, fleet.SoftwareVulnerability{
+		SoftwareID: ie003,
+		CVE:        "CVE-2024-1240",
+	}, fleet.NVDSource)
+	require.NoError(t, err)
+
+	err = ds.InsertCVEMeta(ctx, []fleet.CVEMeta{
+		{
+			// chrome
+			CVE:              "CVE-2024-1234",
+			CVSSScore:        ptr.Float64(7.5),
+			CISAKnownExploit: ptr.Bool(true),
+		},
+		{
+			// safari
+			CVE:              "CVE-2024-1235",
+			CVSSScore:        ptr.Float64(7.5),
+			CISAKnownExploit: ptr.Bool(false),
+		},
+		{
+			// firefox
+			CVE:              "CVE-2024-1236",
+			CVSSScore:        ptr.Float64(8.0),
+			CISAKnownExploit: ptr.Bool(true),
+		},
+		{
+			// edge
+			CVE:              "CVE-2024-1237",
+			CVSSScore:        ptr.Float64(8.0),
+			CISAKnownExploit: ptr.Bool(false),
+		},
+		{
+			// brave
+			CVE:              "CVE-2024-1238",
+			CVSSScore:        ptr.Float64(9.0),
+			CISAKnownExploit: ptr.Bool(true),
+		},
+		// CVE-2024-1239 for opera has no CVE Meta
+		{
+			// internet explorer
+			CVE:              "CVE-2024-1240",
+			CVSSScore:        nil,
+			CISAKnownExploit: nil,
+		},
+	})
+	require.NoError(t, err)
+
+	require.NoError(t, ds.SyncHostsSoftware(ctx, time.Now()))
+	require.NoError(t, ds.ReconcileSoftwareTitles(ctx))
+	require.NoError(t, ds.SyncHostsSoftwareTitles(ctx, time.Now()))
+
+	globalUser := &fleet.User{GlobalRole: ptr.String(fleet.RoleAdmin)}
+
+	tc := []struct {
+		name           string
+		opts           fleet.SoftwareTitleListOptions
+		expectedTitles []string
+		err            error
+	}{
+		{
+			name: "vulnerable only",
+			opts: fleet.SoftwareTitleListOptions{
+				ListOptions:    fleet.ListOptions{},
+				VulnerableOnly: true,
+			},
+			expectedTitles: []string{"chrome", "safari", "firefox", "edge", "brave", "opera", "internet explorer"},
+		},
+		{
+			name: "known exploit true",
+			opts: fleet.SoftwareTitleListOptions{
+				ListOptions:    fleet.ListOptions{},
+				VulnerableOnly: true,
+				KnownExploit:   true,
+			},
+			expectedTitles: []string{"chrome", "firefox", "brave"},
+		},
+		{
+			name: "minimum cvss 8.0",
+			opts: fleet.SoftwareTitleListOptions{
+				ListOptions:    fleet.ListOptions{},
+				VulnerableOnly: true,
+				MinimumCVSS:    8.0,
+			},
+			expectedTitles: []string{"edge", "firefox", "brave"},
+		},
+		{
+			name: "minimum cvss 7.9",
+			opts: fleet.SoftwareTitleListOptions{
+				ListOptions:    fleet.ListOptions{},
+				VulnerableOnly: true,
+				MinimumCVSS:    7.9,
+			},
+			expectedTitles: []string{"edge", "firefox", "brave"},
+		},
+		{
+			name: "minimum cvss 8.0 and known exploit",
+			opts: fleet.SoftwareTitleListOptions{
+				ListOptions:    fleet.ListOptions{},
+				VulnerableOnly: true,
+				MinimumCVSS:    8.0,
+				KnownExploit:   true,
+			},
+			expectedTitles: []string{"firefox", "brave"},
+		},
+		{
+			name: "minimum cvss 7.5 and known exploit",
+			opts: fleet.SoftwareTitleListOptions{
+				ListOptions:    fleet.ListOptions{},
+				VulnerableOnly: true,
+				MinimumCVSS:    7.5,
+				KnownExploit:   true,
+			},
+			expectedTitles: []string{"chrome", "firefox", "brave"},
+		},
+		{
+			name: "maximum cvss 7.5",
+			opts: fleet.SoftwareTitleListOptions{
+				ListOptions:    fleet.ListOptions{},
+				VulnerableOnly: true,
+				MaximumCVSS:    7.5,
+			},
+			expectedTitles: []string{"chrome", "safari"},
+		},
+		{
+			name: "maximum cvss 7.6",
+			opts: fleet.SoftwareTitleListOptions{
+				ListOptions:    fleet.ListOptions{},
+				VulnerableOnly: true,
+				MaximumCVSS:    7.6,
+			},
+			expectedTitles: []string{"chrome", "safari"},
+		},
+		{
+			name: "maximum cvss 7.5 and known exploit",
+			opts: fleet.SoftwareTitleListOptions{
+				ListOptions:    fleet.ListOptions{},
+				VulnerableOnly: true,
+				MaximumCVSS:    7.5,
+				KnownExploit:   true,
+			},
+			expectedTitles: []string{"chrome"},
+		},
+		{
+			name: "minimum cvss 7.5 and maximum cvss 8.0",
+			opts: fleet.SoftwareTitleListOptions{
+				ListOptions:    fleet.ListOptions{},
+				VulnerableOnly: true,
+				MinimumCVSS:    7.5,
+				MaximumCVSS:    8.0,
+			},
+			expectedTitles: []string{"chrome", "safari", "firefox", "edge"},
+		},
+		{
+			name: "minimum cvss 7.5 and maximum cvss 8.0 and known exploit",
+			opts: fleet.SoftwareTitleListOptions{
+				ListOptions:    fleet.ListOptions{},
+				VulnerableOnly: true,
+				MinimumCVSS:    7.5,
+				MaximumCVSS:    8.0,
+				KnownExploit:   true,
+			},
+			expectedTitles: []string{"chrome", "firefox"},
+		},
+		{
+			name: "err if vulnerableOnly is not set with MinimumCVSS",
+			opts: fleet.SoftwareTitleListOptions{
+				ListOptions: fleet.ListOptions{},
+				MinimumCVSS: 7.5,
+			},
+			err: fleet.NewInvalidArgumentError("query", "min_cvss_score, max_cvss_score, and exploit can only be provided with vulnerable=true"),
+		},
+		{
+			name: "err if vulnerableOnly is not set with MaximumCVSS",
+			opts: fleet.SoftwareTitleListOptions{
+				ListOptions: fleet.ListOptions{},
+				MaximumCVSS: 7.5,
+			},
+			err: fleet.NewInvalidArgumentError("query", "min_cvss_score, max_cvss_score, and exploit can only be provided with vulnerable=true"),
+		},
+		{
+			name: "err if vulnerableOnly is not set with KnownExploit",
+			opts: fleet.SoftwareTitleListOptions{
+				ListOptions:  fleet.ListOptions{},
+				KnownExploit: true,
+			},
+			err: fleet.NewInvalidArgumentError("query", "min_cvss_score, max_cvss_score, and exploit can only be provided with vulnerable=true"),
+		},
+	}
+
+	assertTitles := func(t *testing.T, titles []fleet.SoftwareTitleListResult, expectedTitles []string) {
+		t.Helper()
+		require.Len(t, titles, len(expectedTitles))
+		for _, title := range titles {
+			require.Contains(t, expectedTitles, title.Name)
+		}
+	}
+
+	for _, tt := range tc {
+		t.Run(tt.name, func(t *testing.T) {
+			titles, _, _, err := ds.ListSoftwareTitles(ctx, tt.opts, fleet.TeamFilter{User: globalUser})
+			if tt.err != nil {
+				require.Error(t, err)
+				require.Equal(t, tt.err, err)
+				return
+			}
+			assertTitles(t, titles, tt.expectedTitles)
+		})
+	}
+}
diff --git a/server/datastore/mysql/statistics.go b/server/datastore/mysql/statistics.go
index 55e9b9e4ee..31b65429fe 100644
--- a/server/datastore/mysql/statistics.go
+++ b/server/datastore/mysql/statistics.go
@@ -10,6 +10,7 @@ import (
 	"github.com/fleetdm/fleet/v4/server/contexts/ctxerr"
 	"github.com/fleetdm/fleet/v4/server/contexts/license"
 	"github.com/fleetdm/fleet/v4/server/fleet"
+	"github.com/fleetdm/fleet/v4/server/ptr"
 	"github.com/fleetdm/fleet/v4/server/version"
 	"github.com/go-kit/log/level"
 	"github.com/jmoiron/sqlx"
@@ -98,6 +99,10 @@ func (ds *Datastore) ShouldSendStatistics(ctx context.Context, frequency time.Du
 		if err != nil {
 			return ctxerr.Wrap(ctx, err, "amount hosts by osquery version")
 		}
+		numHostsFleetDesktopEnabled, err := numHostsFleetDesktopEnabledDB(ctx, ds.reader(ctx))
+		if err != nil {
+			return ctxerr.Wrap(ctx, err, "number of hosts with Fleet desktop installed")
+		}
 
 		stats.NumHostsEnrolled = amountEnrolledHosts
 		stats.NumUsers = amountUsers
@@ -130,6 +135,23 @@ func (ds *Datastore) ShouldSendStatistics(ctx context.Context, frequency time.Du
 		if lic != nil && lic.IsPremium() {
 			stats.Organization = lic.Organization
 		}
+		stats.AIFeaturesDisabled = appConfig.ServerSettings.AIFeaturesDisabled
+		stats.MaintenanceWindowsConfigured = len(appConfig.Integrations.GoogleCalendar) > 0 && appConfig.Integrations.GoogleCalendar[0].Domain != "" && len(appConfig.Integrations.GoogleCalendar[0].ApiKey) > 0
+
+		stats.MaintenanceWindowsEnabled = false
+		teams, err := ds.ListTeams(ctx, fleet.TeamFilter{User: &fleet.User{
+			GlobalRole: ptr.String(fleet.RoleAdmin),
+		}}, fleet.ListOptions{})
+		if err != nil {
+			return ctxerr.Wrap(ctx, err, "list teams")
+		}
+		for _, team := range teams {
+			if team.Config.Integrations.GoogleCalendar != nil && team.Config.Integrations.GoogleCalendar.Enable {
+				stats.MaintenanceWindowsEnabled = true
+				break
+			}
+		}
+		stats.NumHostsFleetDesktopEnabled = numHostsFleetDesktopEnabled
 		return nil
 	}
 
diff --git a/server/datastore/mysql/statistics_test.go b/server/datastore/mysql/statistics_test.go
index 0f8e5b426a..c152e03429 100644
--- a/server/datastore/mysql/statistics_test.go
+++ b/server/datastore/mysql/statistics_test.go
@@ -87,6 +87,10 @@ func testStatisticsShouldSend(t *testing.T, ds *Datastore) {
 	assert.Equal(t, false, stats.HostExpiryEnabled)
 	assert.Equal(t, false, stats.MDMWindowsEnabled)
 	assert.Equal(t, false, stats.LiveQueryDisabled)
+	assert.Equal(t, false, stats.AIFeaturesDisabled)
+	assert.Equal(t, false, stats.MaintenanceWindowsEnabled)
+	assert.Equal(t, false, stats.MaintenanceWindowsConfigured)
+	assert.Equal(t, 0, stats.NumHostsFleetDesktopEnabled)
 
 	firstIdentifier := stats.AnonymousIdentifier
 
@@ -227,6 +231,10 @@ func testStatisticsShouldSend(t *testing.T, ds *Datastore) {
 	assert.Equal(t, `[{"count":10,"loc":["a","b","c"]}]`, string(stats.StoredErrors))
 	assert.Equal(t, []fleet.HostsCountByOsqueryVersion{{OsqueryVersion: "4.9.0", NumHosts: 1}}, stats.HostsEnrolledByOsqueryVersion)
 	assert.Equal(t, []fleet.HostsCountByOrbitVersion{{OrbitVersion: "1.1.0", NumHosts: 1}}, stats.HostsEnrolledByOrbitVersion)
+	assert.Equal(t, false, stats.AIFeaturesDisabled)
+	assert.Equal(t, false, stats.MaintenanceWindowsEnabled)
+	assert.Equal(t, false, stats.MaintenanceWindowsConfigured)
+	assert.Equal(t, 1, stats.NumHostsFleetDesktopEnabled)
 
 	err = ds.RecordStatisticsSent(ctx)
 	require.NoError(t, err)
@@ -332,6 +340,10 @@ func testStatisticsShouldSend(t *testing.T, ds *Datastore) {
 		{Version: "", NumEnrolled: 1},
 	}, stats.HostsEnrolledByOperatingSystem[""])
 	assert.Equal(t, `[{"count":10,"loc":["a","b","c"]}]`, string(stats.StoredErrors))
+	assert.Equal(t, false, stats.AIFeaturesDisabled)
+	assert.Equal(t, false, stats.MaintenanceWindowsEnabled)
+	assert.Equal(t, false, stats.MaintenanceWindowsConfigured)
+	assert.Equal(t, 1, stats.NumHostsFleetDesktopEnabled)
 
 	// Create multiple new sessions for a single user
 	_, err = ds.NewSession(ctx, u1.ID, "session_key2")
@@ -366,6 +378,10 @@ func testStatisticsShouldSend(t *testing.T, ds *Datastore) {
 	assert.Equal(t, 0, stats.NumWeeklyPolicyViolationDaysActual)
 	assert.Equal(t, 0, stats.NumWeeklyPolicyViolationDaysPossible)
 	assert.Equal(t, `[{"count":10,"loc":["a","b","c"]}]`, string(stats.StoredErrors))
+	assert.Equal(t, false, stats.AIFeaturesDisabled)
+	assert.Equal(t, false, stats.MaintenanceWindowsEnabled)
+	assert.Equal(t, false, stats.MaintenanceWindowsConfigured)
+	assert.Equal(t, 1, stats.NumHostsFleetDesktopEnabled)
 
 	// Add host to test hosts not responding stats
 	_, err = ds.NewHost(ctx, &fleet.Host{
diff --git a/server/datastore/mysql/teams.go b/server/datastore/mysql/teams.go
index c25b4a791c..c0d1b8b61b 100644
--- a/server/datastore/mysql/teams.go
+++ b/server/datastore/mysql/teams.go
@@ -106,7 +106,14 @@ func saveTeamSecretsDB(ctx context.Context, q sqlx.ExtContext, team *fleet.Team)
 
 func (ds *Datastore) DeleteTeam(ctx context.Context, tid uint) error {
 	return ds.withRetryTxx(ctx, func(tx sqlx.ExtContext) error {
-		_, err := tx.ExecContext(ctx, `DELETE FROM teams WHERE id = ?`, tid)
+		// Delete team policies first, because policies can have associated installers which may be deleted on cascade
+		// before deleting the policies (which are also deleted on cascade).
+		_, err := tx.ExecContext(ctx, `DELETE FROM policies WHERE team_id = ?`, tid)
+		if err != nil {
+			return ctxerr.Wrapf(ctx, err, "deleting policies for team %d", tid)
+		}
+
+		_, err = tx.ExecContext(ctx, `DELETE FROM teams WHERE id = ?`, tid)
 		if err != nil {
 			return ctxerr.Wrapf(ctx, err, "delete team %d", tid)
 		}
diff --git a/server/datastore/mysql/testing_utils.go b/server/datastore/mysql/testing_utils.go
index 5fdc6a9082..f3940eda31 100644
--- a/server/datastore/mysql/testing_utils.go
+++ b/server/datastore/mysql/testing_utils.go
@@ -33,8 +33,8 @@ import (
 	"github.com/go-kit/log"
 	"github.com/google/uuid"
 	"github.com/jmoiron/sqlx"
+	"github.com/smallstep/pkcs7"
 	"github.com/stretchr/testify/require"
-	"go.mozilla.org/pkcs7"
 )
 
 const (
@@ -235,14 +235,14 @@ func setupRealReplica(t testing.TB, testName string, ds *Datastore, options *dbO
 
 	t.Cleanup(
 		func() {
-			// Stop slave
+			// Stop replica
 			if out, err := exec.Command(
-				"docker-compose", "exec", "-T", "mysql_replica_test",
+				"docker", "compose", "exec", "-T", "mysql_replica_test",
 				// Command run inside container
 				"mysql",
 				"-u"+testUsername, "-p"+testPassword,
 				"-e",
-				"STOP SLAVE; RESET SLAVE ALL;",
+				"STOP REPLICA; RESET REPLICA ALL;",
 			).CombinedOutput(); err != nil {
 				t.Log(err)
 				t.Log(string(out))
@@ -262,45 +262,54 @@ func setupRealReplica(t testing.TB, testName string, ds *Datastore, options *dbO
 	_, err = ds.primary.ExecContext(ctx, "FLUSH PRIVILEGES")
 	require.NoError(t, err)
 
-	// Retrieve master binary log coordinates
-	ms, err := ds.MasterStatus(ctx)
-	require.NoError(t, err)
-
-	// Get MySQL version
 	var version string
 	err = ds.primary.GetContext(ctx, &version, "SELECT VERSION()")
 	require.NoError(t, err)
-	using57 := strings.HasPrefix(version, "5.7")
-	extraMasterOptions := ""
-	if !using57 {
-		extraMasterOptions = "GET_MASTER_PUBLIC_KEY=1," // needed for MySQL 8.0 caching_sha2_password authentication
-	}
+
+	// Retrieve master binary log coordinates
+	ms, err := ds.MasterStatus(ctx, version)
+	require.NoError(t, err)
 
 	mu.Lock()
 	databasesToReplicate = strings.TrimPrefix(databasesToReplicate+fmt.Sprintf(", `%s`", testName), ",")
 	mu.Unlock()
 
-	// Configure slave and start replication
+	setSourceStmt := fmt.Sprintf(`
+			CHANGE REPLICATION SOURCE TO
+				GET_SOURCE_PUBLIC_KEY=1,
+				SOURCE_HOST='mysql_test',
+				SOURCE_USER='%s',
+				SOURCE_PASSWORD='%s',
+				SOURCE_LOG_FILE='%s',
+				SOURCE_LOG_POS=%d
+		`, replicaUser, replicaPassword, ms.File, ms.Position)
+	if strings.HasPrefix(version, "8.0") {
+		setSourceStmt = fmt.Sprintf(`
+			CHANGE MASTER TO
+				GET_MASTER_PUBLIC_KEY=1,
+				MASTER_HOST='mysql_test',
+				MASTER_USER='%s',
+				MASTER_PASSWORD='%s',
+				MASTER_LOG_FILE='%s',
+				MASTER_LOG_POS=%d
+		`, replicaUser, replicaPassword, ms.File, ms.Position)
+	}
+
+	// Configure replica and start replication
 	if out, err := exec.Command(
-		"docker-compose", "exec", "-T", "mysql_replica_test",
+		"docker", "compose", "exec", "-T", "mysql_replica_test",
 		// Command run inside container
 		"mysql",
 		"-u"+testUsername, "-p"+testPassword,
 		"-e",
 		fmt.Sprintf(
 			`
-			STOP SLAVE;
-			RESET SLAVE ALL;
+			STOP REPLICA;
+			RESET REPLICA ALL;
 			CHANGE REPLICATION FILTER REPLICATE_DO_DB = ( %s );
-			CHANGE MASTER TO
-				%s
-				MASTER_HOST='mysql_test',
-				MASTER_USER='%s',
-				MASTER_PASSWORD='%s',
-				MASTER_LOG_FILE='%s',
-				MASTER_LOG_POS=%d;
-			START SLAVE;
-			`, databasesToReplicate, extraMasterOptions, replicaUser, replicaPassword, ms.File, ms.Position,
+			%s;
+			START REPLICA;
+			`, databasesToReplicate, setSourceStmt,
 		),
 	).CombinedOutput(); err != nil {
 		t.Error(err)
@@ -348,7 +357,7 @@ func initializeDatabase(t testing.TB, testName string, opts *DatastoreTestOption
 		)
 
 		cmd := exec.Command(
-			"docker-compose", "exec", "-T", "mysql_test",
+			"docker", "compose", "exec", "-T", "mysql_test",
 			// Command run inside container
 			"mysql",
 			"-u"+testUsername, "-p"+testPassword,
@@ -369,7 +378,7 @@ func initializeDatabase(t testing.TB, testName string, opts *DatastoreTestOption
 		)
 
 		cmd := exec.Command(
-			"docker-compose", "exec", "-T", "mysql_replica_test",
+			"docker", "compose", "exec", "-T", "mysql_replica_test",
 			// Command run inside container
 			"mysql",
 			"-u"+testUsername, "-p"+testPassword,
@@ -454,7 +463,7 @@ func CreateMySQLDSWithReplica(t *testing.T, opts *DatastoreTestOptions) *Datasto
 		ds = createMySQLDSWithOptions(t, opts)
 		status, err := ds.ReplicaStatus(context.Background())
 		require.NoError(t, err)
-		if status["Replica_SQL_Running"] != "Yes" && status["Slave_SQL_Running"] != "Yes" {
+		if status["Replica_SQL_Running"] != "Yes" {
 			t.Logf("create replica attempt: %d replica status: %+v", attempt, status)
 			if lastErr, ok := status["Last_Error"]; ok && lastErr != "" {
 				t.Logf("replica not running after attempt %d; Last_Error: %s", attempt, lastErr)
@@ -486,6 +495,7 @@ func CreateNamedMySQLDS(t *testing.T, name string) *Datastore {
 }
 
 func ExecAdhocSQL(tb testing.TB, ds *Datastore, fn func(q sqlx.ExtContext) error) {
+	tb.Helper()
 	err := fn(ds.primary)
 	require.NoError(tb, err)
 }
@@ -494,6 +504,12 @@ func ExecAdhocSQLWithError(ds *Datastore, fn func(q sqlx.ExtContext) error) erro
 	return fn(ds.primary)
 }
 
+// EncryptWithPrivateKey encrypts data with the server private key associated
+// with the Datastore.
+func EncryptWithPrivateKey(tb testing.TB, ds *Datastore, data []byte) ([]byte, error) {
+	return encrypt(data, ds.serverPrivateKey)
+}
+
 // TruncateTables truncates the specified tables, in order, using ds.writer.
 // Note that the order is typically not important because FK checks are
 // disabled while truncating. If no table is provided, all tables (except
@@ -674,7 +690,7 @@ func GetAggregatedStats(ctx context.Context, ds *Datastore, aggregate fleet.Aggr
 func SetOrderedCreatedAtTimestamps(t testing.TB, ds *Datastore, afterTime time.Time, table, keyCol string, keys ...any) time.Time {
 	now := afterTime
 	for i := 0; i < len(keys); i++ {
-		now = afterTime.Add(time.Second)
+		now = now.Add(time.Second)
 		ExecAdhocSQL(t, ds, func(q sqlx.ExtContext) error {
 			_, err := q.ExecContext(context.Background(),
 				fmt.Sprintf(`UPDATE %s SET created_at=? WHERE %s=?`, table, keyCol), now, keys[i])
@@ -684,7 +700,83 @@ func SetOrderedCreatedAtTimestamps(t testing.TB, ds *Datastore, afterTime time.T
 	return now
 }
 
-func SetTestABMAssets(t testing.TB, ds *Datastore) {
+func CreateABMKeyCertIfNotExists(t testing.TB, ds *Datastore) {
+	certPEM, keyPEM, _, err := GenerateTestABMAssets(t)
+	require.NoError(t, err)
+	var assets []fleet.MDMConfigAsset
+	_, err = ds.GetAllMDMConfigAssetsByName(context.Background(), []fleet.MDMAssetName{
+		fleet.MDMAssetABMKey,
+	})
+	if err != nil {
+		var nfe fleet.NotFoundError
+		require.ErrorAs(t, err, &nfe)
+		assets = append(assets, fleet.MDMConfigAsset{Name: fleet.MDMAssetABMKey, Value: keyPEM})
+	}
+
+	_, err = ds.GetAllMDMConfigAssetsByName(context.Background(), []fleet.MDMAssetName{
+		fleet.MDMAssetABMCert,
+	})
+	if err != nil {
+		var nfe fleet.NotFoundError
+		require.ErrorAs(t, err, &nfe)
+		assets = append(assets, fleet.MDMConfigAsset{Name: fleet.MDMAssetABMCert, Value: certPEM})
+	}
+
+	if len(assets) != 0 {
+		err = ds.InsertMDMConfigAssets(context.Background(), assets)
+		require.NoError(t, err)
+	}
+}
+
+// CreateAndSetABMToken creates a new ABM token (using an existing ABM key/cert) and stores it in the DB.
+func CreateAndSetABMToken(t testing.TB, ds *Datastore, orgName string) *fleet.ABMToken {
+	assets, err := ds.GetAllMDMConfigAssetsByName(context.Background(), []fleet.MDMAssetName{
+		fleet.MDMAssetABMKey,
+		fleet.MDMAssetABMCert,
+	})
+	require.NoError(t, err)
+
+	certPEM := assets[fleet.MDMAssetABMCert].Value
+
+	testBMToken := &nanodep_client.OAuth1Tokens{
+		ConsumerKey:       "test_consumer",
+		ConsumerSecret:    "test_secret",
+		AccessToken:       "test_access_token",
+		AccessSecret:      "test_access_secret",
+		AccessTokenExpiry: time.Date(2999, 1, 1, 0, 0, 0, 0, time.UTC),
+	}
+
+	rawToken, err := json.Marshal(testBMToken)
+	require.NoError(t, err)
+
+	smimeToken := fmt.Sprintf(
+		"Content-Type: text/plain;charset=UTF-8\r\n"+
+			"Content-Transfer-Encoding: 7bit\r\n"+
+			"\r\n%s", rawToken,
+	)
+
+	block, _ := pem.Decode(certPEM)
+	require.NotNil(t, block)
+	require.Equal(t, "CERTIFICATE", block.Type)
+	cert, err := x509.ParseCertificate(block.Bytes)
+	require.NoError(t, err)
+
+	encryptedToken, err := pkcs7.Encrypt([]byte(smimeToken), []*x509.Certificate{cert})
+	require.NoError(t, err)
+
+	tokenBytes := fmt.Sprintf(
+		"Content-Type: application/pkcs7-mime; name=\"smime.p7m\"; smime-type=enveloped-data\r\n"+
+			"Content-Transfer-Encoding: base64\r\n"+
+			"Content-Disposition: attachment; filename=\"smime.p7m\"\r\n"+
+			"Content-Description: S/MIME Encrypted Message\r\n"+
+			"\r\n%s", base64.StdEncoding.EncodeToString(encryptedToken))
+
+	tok, err := ds.InsertABMToken(context.Background(), &fleet.ABMToken{EncryptedToken: []byte(tokenBytes), OrganizationName: orgName})
+	require.NoError(t, err)
+	return tok
+}
+
+func SetTestABMAssets(t testing.TB, ds *Datastore, orgName string) *fleet.ABMToken {
 	apnsCert, apnsKey, err := GenerateTestCertBytes()
 	require.NoError(t, err)
 
@@ -693,7 +785,6 @@ func SetTestABMAssets(t testing.TB, ds *Datastore) {
 	assets := []fleet.MDMConfigAsset{
 		{Name: fleet.MDMAssetABMCert, Value: certPEM},
 		{Name: fleet.MDMAssetABMKey, Value: keyPEM},
-		{Name: fleet.MDMAssetABMToken, Value: tokenBytes},
 		{Name: fleet.MDMAssetAPNSCert, Value: apnsCert},
 		{Name: fleet.MDMAssetAPNSKey, Value: apnsKey},
 		{Name: fleet.MDMAssetCACert, Value: certPEM},
@@ -703,12 +794,17 @@ func SetTestABMAssets(t testing.TB, ds *Datastore) {
 	err = ds.InsertMDMConfigAssets(context.Background(), assets)
 	require.NoError(t, err)
 
+	tok, err := ds.InsertABMToken(context.Background(), &fleet.ABMToken{EncryptedToken: tokenBytes, OrganizationName: orgName})
+	require.NoError(t, err)
+
 	appCfg, err := ds.AppConfig(context.Background())
 	require.NoError(t, err)
 	appCfg.MDM.EnabledAndConfigured = true
 	appCfg.MDM.AppleBMEnabledAndConfigured = true
 	err = ds.SaveAppConfig(context.Background(), appCfg)
 	require.NoError(t, err)
+
+	return tok
 }
 
 func GenerateTestABMAssets(t testing.TB) ([]byte, []byte, []byte, error) {
@@ -793,10 +889,15 @@ type MasterStatus struct {
 	Position uint64
 }
 
-func (ds *Datastore) MasterStatus(ctx context.Context) (MasterStatus, error) {
-	rows, err := ds.writer(ctx).Query("SHOW MASTER STATUS")
+func (ds *Datastore) MasterStatus(ctx context.Context, mysqlVersion string) (MasterStatus, error) {
+	stmt := "SHOW BINARY LOG STATUS"
+	if strings.HasPrefix(mysqlVersion, "8.0") {
+		stmt = "SHOW MASTER STATUS"
+	}
+
+	rows, err := ds.writer(ctx).Query(stmt)
 	if err != nil {
-		return MasterStatus{}, ctxerr.Wrap(ctx, err, "show master status")
+		return MasterStatus{}, ctxerr.Wrap(ctx, err, stmt)
 	}
 	defer rows.Close()
 
@@ -841,7 +942,7 @@ func (ds *Datastore) MasterStatus(ctx context.Context) (MasterStatus, error) {
 }
 
 func (ds *Datastore) ReplicaStatus(ctx context.Context) (map[string]interface{}, error) {
-	rows, err := ds.reader(ctx).QueryContext(ctx, "SHOW SLAVE STATUS")
+	rows, err := ds.reader(ctx).QueryContext(ctx, "SHOW REPLICA STATUS")
 	if err != nil {
 		return nil, ctxerr.Wrap(ctx, err, "show replica status")
 	}
diff --git a/server/datastore/mysql/vpp.go b/server/datastore/mysql/vpp.go
index 72bc53ecd7..1127497f88 100644
--- a/server/datastore/mysql/vpp.go
+++ b/server/datastore/mysql/vpp.go
@@ -1,15 +1,22 @@
 package mysql
 
 import (
+	"cmp"
 	"context"
 	"database/sql"
+	"encoding/base64"
+	"encoding/json"
 	"errors"
 	"fmt"
+	"slices"
 	"strings"
+	"time"
 
+	"github.com/fleetdm/fleet/v4/server/authz"
 	"github.com/fleetdm/fleet/v4/server/contexts/ctxerr"
 	"github.com/fleetdm/fleet/v4/server/fleet"
 	"github.com/fleetdm/fleet/v4/server/mdm/nanomdm/mdm"
+	"github.com/go-sql-driver/mysql"
 	"github.com/jmoiron/sqlx"
 )
 
@@ -20,21 +27,24 @@ SELECT
 	vap.platform,
 	vap.name,
 	vap.latest_version,
+	vat.self_service,
 	NULLIF(vap.icon_url, '') AS icon_url
 FROM
 	vpp_apps vap
 	INNER JOIN vpp_apps_teams vat ON vat.adam_id = vap.adam_id AND vat.platform = vap.platform
 WHERE
-	vap.title_id = ? AND
-	vat.global_or_team_id = ?`
+	vap.title_id = ? %s`
 
-	var tmID uint
+	// when team id is not nil, we need to filter by the global or team id given.
+	args := []any{titleID}
+	teamFilter := ""
 	if teamID != nil {
-		tmID = *teamID
+		args = append(args, *teamID)
+		teamFilter = "AND vat.global_or_team_id = ?"
 	}
 
 	var app fleet.VPPAppStoreApp
-	err := sqlx.GetContext(ctx, ds.reader(ctx), &app, query, titleID, tmID)
+	err := sqlx.GetContext(ctx, ds.reader(ctx), &app, fmt.Sprintf(query, teamFilter), args...)
 	if err != nil {
 		if err == sql.ErrNoRows {
 			return nil, ctxerr.Wrap(ctx, notFound("VPPApp"), "get VPP app metadata")
@@ -46,7 +56,8 @@ WHERE
 }
 
 func (ds *Datastore) GetSummaryHostVPPAppInstalls(ctx context.Context, teamID *uint, appID fleet.VPPAppID) (*fleet.VPPAppStatusSummary,
-	error) {
+	error,
+) {
 	var dest fleet.VPPAppStatusSummary
 
 	stmt := fmt.Sprintf(`
@@ -90,9 +101,9 @@ WHERE
 		"mdm_status_acknowledged":   fleet.MDMAppleStatusAcknowledged,
 		"mdm_status_error":          fleet.MDMAppleStatusError,
 		"mdm_status_format_error":   fleet.MDMAppleStatusCommandFormatError,
-		"software_status_pending":   fleet.SoftwareInstallerPending,
-		"software_status_failed":    fleet.SoftwareInstallerFailed,
-		"software_status_installed": fleet.SoftwareInstallerInstalled,
+		"software_status_pending":   fleet.SoftwareInstallPending,
+		"software_status_failed":    fleet.SoftwareInstallFailed,
+		"software_status_installed": fleet.SoftwareInstalled,
 	})
 	if err != nil {
 		return nil, ctxerr.Wrap(ctx, err, "get summary host vpp installs: named query")
@@ -152,19 +163,20 @@ func (ds *Datastore) BatchInsertVPPApps(ctx context.Context, apps []*fleet.VPPAp
 	})
 }
 
-func (ds *Datastore) SetTeamVPPApps(ctx context.Context, teamID *uint, appIDs []fleet.VPPAppID) error {
+func (ds *Datastore) SetTeamVPPApps(ctx context.Context, teamID *uint, appFleets []fleet.VPPAppTeam) error {
 	existingApps, err := ds.GetAssignedVPPApps(ctx, teamID)
 	if err != nil {
 		return ctxerr.Wrap(ctx, err, "SetTeamVPPApps getting list of existing apps")
 	}
 
-	var missingApps []fleet.VPPAppID
+	var toAddApps []fleet.VPPAppTeam
 	var toRemoveApps []fleet.VPPAppID
 
 	for existingApp := range existingApps {
 		var found bool
-		for _, adamID := range appIDs {
-			if adamID == existingApp {
+		for _, appFleet := range appFleets {
+			// Self service value doesn't matter for removing app from team
+			if existingApp == appFleet.VPPAppID {
 				found = true
 			}
 		}
@@ -173,15 +185,23 @@ func (ds *Datastore) SetTeamVPPApps(ctx context.Context, teamID *uint, appIDs []
 		}
 	}
 
-	for _, adamID := range appIDs {
-		if _, ok := existingApps[adamID]; !ok {
-			missingApps = append(missingApps, adamID)
+	for _, appFleet := range appFleets {
+		if existingFleet, ok := existingApps[appFleet.VPPAppID]; !ok || existingFleet.SelfService != appFleet.SelfService {
+			toAddApps = append(toAddApps, appFleet)
+		}
+	}
+
+	var vppToken *fleet.VPPTokenDB
+	if len(appFleets) > 0 {
+		vppToken, err = ds.GetVPPTokenByTeamID(ctx, teamID)
+		if err != nil {
+			return ctxerr.Wrap(ctx, err, "SetTeamVPPApps retrieve VPP token ID")
 		}
 	}
 
 	return ds.withRetryTxx(ctx, func(tx sqlx.ExtContext) error {
-		for _, toAdd := range missingApps {
-			if err := insertVPPAppTeams(ctx, tx, toAdd, teamID); err != nil {
+		for _, toAdd := range toAddApps {
+			if err := insertVPPAppTeams(ctx, tx, toAdd, teamID, vppToken.ID); err != nil {
 				return ctxerr.Wrap(ctx, err, "SetTeamVPPApps inserting vpp app into team")
 			}
 		}
@@ -197,7 +217,12 @@ func (ds *Datastore) SetTeamVPPApps(ctx context.Context, teamID *uint, appIDs []
 }
 
 func (ds *Datastore) InsertVPPAppWithTeam(ctx context.Context, app *fleet.VPPApp, teamID *uint) (*fleet.VPPApp, error) {
-	err := ds.withRetryTxx(ctx, func(tx sqlx.ExtContext) error {
+	vppToken, err := ds.GetVPPTokenByTeamID(ctx, teamID)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "InsertVPPAppWithTeam unable to get VPP Token ID")
+	}
+
+	err = ds.withRetryTxx(ctx, func(tx sqlx.ExtContext) error {
 		titleID, err := ds.getOrInsertSoftwareTitleForVPPApp(ctx, tx, app)
 		if err != nil {
 			return err
@@ -209,23 +234,23 @@ func (ds *Datastore) InsertVPPAppWithTeam(ctx context.Context, app *fleet.VPPApp
 			return ctxerr.Wrap(ctx, err, "InsertVPPAppWithTeam insertVPPApps transaction")
 		}
 
-		if err := insertVPPAppTeams(ctx, tx, app.VPPAppID, teamID); err != nil {
+		if err := insertVPPAppTeams(ctx, tx, app.VPPAppTeam, teamID, vppToken.ID); err != nil {
 			return ctxerr.Wrap(ctx, err, "InsertVPPAppWithTeam insertVPPAppTeams transaction")
 		}
 
 		return nil
 	})
 	if err != nil {
-		return nil, err
+		return nil, ctxerr.Wrap(ctx, err, "InsertVPPAppWithTeam")
 	}
 
 	return app, nil
 }
 
-func (ds *Datastore) GetAssignedVPPApps(ctx context.Context, teamID *uint) (map[fleet.VPPAppID]struct{}, error) {
+func (ds *Datastore) GetAssignedVPPApps(ctx context.Context, teamID *uint) (map[fleet.VPPAppID]fleet.VPPAppTeam, error) {
 	stmt := `
 SELECT
-	adam_id, platform
+	adam_id, platform, self_service
 FROM
 	vpp_apps_teams vat
 WHERE
@@ -236,14 +261,14 @@ WHERE
 		tmID = *teamID
 	}
 
-	var results []fleet.VPPAppID
+	var results []fleet.VPPAppTeam
 	if err := sqlx.SelectContext(ctx, ds.reader(ctx), &results, stmt, tmID); err != nil {
 		return nil, ctxerr.Wrap(ctx, err, "get assigned VPP apps")
 	}
 
-	appSet := make(map[fleet.VPPAppID]struct{})
+	appSet := make(map[fleet.VPPAppID]fleet.VPPAppTeam)
 	for _, r := range results {
-		appSet[r] = struct{}{}
+		appSet[r.VPPAppID] = r
 	}
 
 	return appSet, nil
@@ -277,12 +302,13 @@ ON DUPLICATE KEY UPDATE
 	return ctxerr.Wrap(ctx, err, "insert VPP apps")
 }
 
-func insertVPPAppTeams(ctx context.Context, tx sqlx.ExtContext, appID fleet.VPPAppID, teamID *uint) error {
+func insertVPPAppTeams(ctx context.Context, tx sqlx.ExtContext, appID fleet.VPPAppTeam, teamID *uint, vppTokenID uint) error {
 	stmt := `
 INSERT INTO vpp_apps_teams
-	(adam_id, global_or_team_id, team_id, platform)
+	(adam_id, global_or_team_id, team_id, platform, self_service, vpp_token_id)
 VALUES
-	(?, ?, ?, ?)
+	(?, ?, ?, ?, ?, ?)
+ON DUPLICATE KEY UPDATE self_service = VALUES(self_service)
 	`
 
 	var globalOrTmID uint
@@ -294,10 +320,10 @@ VALUES
 		}
 	}
 
-	_, err := tx.ExecContext(ctx, stmt, appID.AdamID, globalOrTmID, teamID, appID.Platform)
+	_, err := tx.ExecContext(ctx, stmt, appID.AdamID, globalOrTmID, teamID, appID.Platform, appID.SelfService, vppTokenID)
 	if IsDuplicate(err) {
 		err = &existsError{
-			Identifier:   fmt.Sprintf("%s %s", appID.AdamID, appID.Platform),
+			Identifier:   fmt.Sprintf("%s %s self_service: %v", appID.AdamID, appID.Platform, appID.SelfService),
 			TeamID:       teamID,
 			ResourceType: "VPPAppID",
 		}
@@ -373,7 +399,7 @@ func (ds *Datastore) getOrInsertSoftwareTitleForVPPApp(ctx context.Context, tx s
 		},
 	)
 	if err != nil {
-		return 0, err
+		return 0, ctxerr.Wrap(ctx, err, "optimistic get or insert VPP app")
 	}
 
 	return titleID, nil
@@ -399,7 +425,7 @@ func (ds *Datastore) DeleteVPPAppFromTeam(ctx context.Context, teamID *uint, app
 	return nil
 }
 
-func (ds *Datastore) GetVPPAppByTeamAndTitleID(ctx context.Context, teamID *uint, titleID uint, withScriptContents bool) (*fleet.VPPApp, error) {
+func (ds *Datastore) GetVPPAppByTeamAndTitleID(ctx context.Context, teamID *uint, titleID uint) (*fleet.VPPApp, error) {
 	stmt := `
 SELECT
   va.adam_id,
@@ -409,7 +435,8 @@ SELECT
   va.title_id,
   va.platform,
   va.created_at,
-  va.updated_at
+  va.updated_at,
+  vat.self_service
 FROM vpp_apps va
 JOIN vpp_apps_teams vat ON va.adam_id = vat.adam_id AND va.platform = vat.platform
 WHERE vat.global_or_team_id = ? AND va.title_id = ?
@@ -432,17 +459,23 @@ WHERE vat.global_or_team_id = ? AND va.title_id = ?
 	return &dest, nil
 }
 
-func (ds *Datastore) InsertHostVPPSoftwareInstall(ctx context.Context, hostID, userID uint, appID fleet.VPPAppID,
-	commandUUID, associatedEventID string) error {
+func (ds *Datastore) InsertHostVPPSoftwareInstall(ctx context.Context, hostID uint, appID fleet.VPPAppID,
+	commandUUID, associatedEventID string, selfService bool,
+) error {
 	stmt := `
 INSERT INTO host_vpp_software_installs
-  (host_id, adam_id, platform, command_uuid, user_id, associated_event_id)
+  (host_id, adam_id, platform, command_uuid, user_id, associated_event_id, self_service)
 VALUES
-  (?,?,?,?,?,?)
+  (?,?,?,?,?,?,?)
 	`
 
+	var userID *uint
+	if ctxUser := authz.UserFromContext(ctx); ctxUser != nil {
+		userID = &ctxUser.ID
+	}
+
 	if _, err := ds.writer(ctx).ExecContext(ctx, stmt, hostID, appID.AdamID, appID.Platform, commandUUID, userID,
-		associatedEventID); err != nil {
+		associatedEventID, selfService); err != nil {
 		return ctxerr.Wrap(ctx, err, "insert into host_vpp_software_installs")
 	}
 
@@ -463,7 +496,8 @@ SELECT
 	hdn.display_name AS host_display_name,
 	st.name AS software_title,
 	hvsi.adam_id AS app_store_id,
-	hvsi.command_uuid AS command_uuid
+	hvsi.command_uuid AS command_uuid,
+	hvsi.self_service AS self_service
 FROM
 	host_vpp_software_installs hvsi
 	LEFT OUTER JOIN users u ON hvsi.user_id = u.id
@@ -475,20 +509,21 @@ WHERE
 	`
 
 	type result struct {
-		HostID          uint   `db:"host_id"`
-		HostDisplayName string `db:"host_display_name"`
-		SoftwareTitle   string `db:"software_title"`
-		AppStoreID      string `db:"app_store_id"`
-		CommandUUID     string `db:"command_uuid"`
-		UserName        string `db:"user_name"`
-		UserID          uint   `db:"user_id"`
-		UserEmail       string `db:"user_email"`
+		HostID          uint    `db:"host_id"`
+		HostDisplayName string  `db:"host_display_name"`
+		SoftwareTitle   string  `db:"software_title"`
+		AppStoreID      string  `db:"app_store_id"`
+		CommandUUID     string  `db:"command_uuid"`
+		UserName        *string `db:"user_name"`
+		UserID          *uint   `db:"user_id"`
+		UserEmail       *string `db:"user_email"`
+		SelfService     bool    `db:"self_service"`
 	}
 
 	listStmt, args, err := sqlx.Named(stmt, map[string]any{
 		"command_uuid":              commandResults.CommandUUID,
-		"software_status_failed":    string(fleet.SoftwareInstallerFailed),
-		"software_status_installed": string(fleet.SoftwareInstallerInstalled),
+		"software_status_failed":    string(fleet.SoftwareInstallFailed),
+		"software_status_installed": string(fleet.SoftwareInstalled),
 	})
 	if err != nil {
 		return nil, nil, ctxerr.Wrap(ctx, err, "build list query from named args")
@@ -503,23 +538,26 @@ WHERE
 		return nil, nil, ctxerr.Wrap(ctx, err, "select past activity data for VPP app install")
 	}
 
-	user := &fleet.User{
-		ID:    res.UserID,
-		Name:  res.UserName,
-		Email: res.UserEmail,
+	var user *fleet.User
+	if res.UserID != nil {
+		user = &fleet.User{
+			ID:    *res.UserID,
+			Name:  *res.UserName,
+			Email: *res.UserEmail,
+		}
 	}
 
 	var status string
 	switch commandResults.Status {
 	case fleet.MDMAppleStatusAcknowledged:
-		status = string(fleet.SoftwareInstallerInstalled)
+		status = string(fleet.SoftwareInstalled)
 	case fleet.MDMAppleStatusCommandFormatError:
 	case fleet.MDMAppleStatusError:
-		status = string(fleet.SoftwareInstallerFailed)
+		status = string(fleet.SoftwareInstallFailed)
 	default:
 		// This case shouldn't happen (we should only be doing this check if the command is in a
 		// "terminal" state, but adding it so we have a default
-		status = string(fleet.SoftwareInstallerPending)
+		status = string(fleet.SoftwareInstallPending)
 	}
 
 	act := &fleet.ActivityInstalledAppStoreApp{
@@ -528,8 +566,597 @@ WHERE
 		SoftwareTitle:   res.SoftwareTitle,
 		AppStoreID:      res.AppStoreID,
 		CommandUUID:     res.CommandUUID,
+		SelfService:     res.SelfService,
 		Status:          status,
 	}
 
 	return user, act, nil
 }
+
+func (ds *Datastore) GetVPPTokenByLocation(ctx context.Context, loc string) (*fleet.VPPTokenDB, error) {
+	stmt := `SELECT id FROM vpp_tokens WHERE location = ?`
+	var tokenID uint
+	if err := sqlx.GetContext(ctx, ds.reader(ctx), &tokenID, stmt, loc); err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			return nil, ctxerr.Wrap(ctx, notFound("VPPToken"), "retrieve vpp token by location")
+		}
+		return nil, ctxerr.Wrap(ctx, err, "retrieve vpp token by location")
+	}
+	return ds.GetVPPToken(ctx, tokenID)
+}
+
+func (ds *Datastore) InsertVPPToken(ctx context.Context, tok *fleet.VPPTokenData) (*fleet.VPPTokenDB, error) {
+	insertStmt := `
+	INSERT INTO
+		vpp_tokens (
+			organization_name,
+			location,
+			renew_at,
+			token
+		)
+	VALUES (?, ?, ?, ?)
+`
+
+	vppTokenDB, err := vppTokenDataToVppTokenDB(ctx, tok)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "translating vpp token to db representation")
+	}
+
+	tokEnc, err := encrypt([]byte(vppTokenDB.Token), ds.serverPrivateKey)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "encrypt token with datastore.serverPrivateKey")
+	}
+
+	res, err := ds.writer(ctx).ExecContext(
+		ctx,
+		insertStmt,
+		vppTokenDB.OrgName,
+		vppTokenDB.Location,
+		vppTokenDB.RenewDate,
+		tokEnc,
+	)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "inserting vpp token")
+	}
+
+	id, _ := res.LastInsertId()
+
+	vppTokenDB.ID = uint(id)
+
+	return vppTokenDB, nil
+}
+
+func (ds *Datastore) UpdateVPPToken(ctx context.Context, tokenID uint, tok *fleet.VPPTokenData) (*fleet.VPPTokenDB, error) {
+	stmt := `
+	UPDATE vpp_tokens
+	SET
+		organization_name = ?,
+		location = ?,
+		renew_at = ?,
+		token = ?
+	WHERE
+		id = ?
+`
+
+	vppTokenDB, err := vppTokenDataToVppTokenDB(ctx, tok)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "translating vpp token to db representation")
+	}
+
+	tokEnc, err := encrypt([]byte(vppTokenDB.Token), ds.serverPrivateKey)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "encrypt token with datastore.serverPrivateKey")
+	}
+
+	_, err = ds.writer(ctx).ExecContext(
+		ctx,
+		stmt,
+		vppTokenDB.OrgName,
+		vppTokenDB.Location,
+		vppTokenDB.RenewDate,
+		tokEnc,
+		tokenID,
+	)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "inserting vpp token")
+	}
+
+	return ds.GetVPPToken(ctx, tokenID)
+}
+
+func vppTokenDataToVppTokenDB(ctx context.Context, tok *fleet.VPPTokenData) (*fleet.VPPTokenDB, error) {
+	tokRawBytes, err := base64.StdEncoding.DecodeString(tok.Token)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "decoding raw vpp token data")
+	}
+
+	var tokRaw fleet.VPPTokenRaw
+	if err := json.Unmarshal(tokRawBytes, &tokRaw); err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "unmarshalling raw vpp token")
+	}
+
+	exp, err := time.Parse(fleet.VPPTimeFormat, tokRaw.ExpDate)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "parsing vpp token expiration date")
+	}
+	exp = exp.UTC()
+
+	vppTokenDB := &fleet.VPPTokenDB{
+		OrgName:   tokRaw.OrgName,
+		Location:  tok.Location,
+		RenewDate: exp,
+		Token:     tok.Token,
+	}
+
+	return vppTokenDB, nil
+}
+
+func (ds *Datastore) GetVPPToken(ctx context.Context, tokenID uint) (*fleet.VPPTokenDB, error) {
+	stmt := `
+	SELECT
+		id,
+		organization_name,
+		location,
+		renew_at,
+		token
+	FROM
+		vpp_tokens v
+	WHERE
+		id = ?
+`
+	stmtTeams := `
+	SELECT
+		vt.team_id,
+		vt.null_team_type,
+		COALESCE(t.name, '') AS name
+	FROM
+		vpp_token_teams vt
+	LEFT OUTER JOIN
+		teams t
+	ON t.id = vt.team_id
+	WHERE
+		vpp_token_id = ?
+`
+
+	var tokEnc fleet.VPPTokenDB
+
+	var tokTeams []struct {
+		TeamID   *uint              `db:"team_id"`
+		NullTeam fleet.NullTeamType `db:"null_team_type"`
+		Name     string             `db:"name"`
+	}
+
+	if err := sqlx.GetContext(ctx, ds.reader(ctx), &tokEnc, stmt, tokenID); err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			return nil, ctxerr.Wrap(ctx, notFound("VPPToken"), "selecting vpp token from db")
+		}
+		return nil, ctxerr.Wrap(ctx, err, "selecting vpp token from db")
+	}
+
+	tokDec, err := decrypt([]byte(tokEnc.Token), ds.serverPrivateKey)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "decrypting vpp token with serverPrivateKey")
+	}
+
+	if err := sqlx.SelectContext(ctx, ds.reader(ctx), &tokTeams, stmtTeams, tokenID); err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "selecting vpp token teams from db")
+	}
+
+	tok := &fleet.VPPTokenDB{
+		ID:        tokEnc.ID,
+		OrgName:   tokEnc.OrgName,
+		Location:  tokEnc.Location,
+		RenewDate: tokEnc.RenewDate,
+		Token:     string(tokDec),
+	}
+
+	if tokTeams == nil {
+		// Not assigned, no need to loop over teams
+		return tok, nil
+	}
+
+TEAMLOOP:
+	for _, team := range tokTeams {
+		switch team.NullTeam {
+		case fleet.NullTeamAllTeams:
+			// This should only be possible if there are no other teams
+			// Make sure something array is non-nil
+			if len(tokTeams) != 1 {
+				return nil, ctxerr.Errorf(ctx, "team \"%s\" belongs to All teams, and %d other team(s)", tok.OrgName, len(tokTeams)-1)
+			}
+			tok.Teams = []fleet.TeamTuple{}
+			break TEAMLOOP
+		case fleet.NullTeamNoTeam:
+			tok.Teams = append(tok.Teams, fleet.TeamTuple{
+				ID:   0,
+				Name: fleet.TeamNameNoTeam,
+			})
+		case fleet.NullTeamNone:
+			// Regular team
+			tok.Teams = append(tok.Teams, fleet.TeamTuple{
+				ID:   *team.TeamID,
+				Name: team.Name,
+			})
+		}
+	}
+
+	return tok, nil
+}
+
+func (ds *Datastore) UpdateVPPTokenTeams(ctx context.Context, id uint, teams []uint) (*fleet.VPPTokenDB, error) {
+	stmtTeamName := `SELECT name FROM teams WHERE id = ?`
+	stmtRemove := `DELETE FROM vpp_token_teams WHERE vpp_token_id = ?`
+	stmtInsert := `
+	INSERT INTO
+		vpp_token_teams (
+			vpp_token_id,
+			team_id,
+			null_team_type
+	) VALUES `
+	stmtValues := `(?, ?, ?)`
+	// Delete all apps associated with a token if we change its team
+	stmtDeleteApps := `DELETE FROM vpp_apps_teams WHERE vpp_token_id = ?`
+	deleteArgs := []any{id}
+
+	var values string
+	var args []any
+	// No DB constraint for null_team_type, if no team or all teams
+	// comes up we have to check it in go
+	var nullTeamCheck fleet.NullTeamType
+
+	if len(teams) > 0 {
+		for _, team := range teams {
+			team := team
+			if values == "" {
+				values = stmtValues
+			} else {
+				values = strings.Join([]string{values, stmtValues}, ",")
+			}
+			var teamptr *uint
+			nullTeam := fleet.NullTeamNone
+			if team != 0 {
+				// Regular team
+				teamptr = &team
+			} else {
+				// NoTeam team
+				nullTeam = fleet.NullTeamNoTeam
+				nullTeamCheck = fleet.NullTeamNoTeam
+			}
+			args = append(args, id, teamptr, nullTeam)
+		}
+	} else if teams != nil {
+		// Empty but not nil, All Teams!
+		values = stmtValues
+		args = append(args, id, nil, fleet.NullTeamAllTeams)
+		nullTeamCheck = fleet.NullTeamAllTeams
+	}
+
+	stmtInsertFull := stmtInsert + values
+
+	err := ds.withRetryTxx(ctx, func(tx sqlx.ExtContext) error {
+		// NOTE This is not optimal, and has the potential to
+		// introduce race conditions. Ideally we would insert and
+		// check the constraints in a single query.
+		if err := checkVPPNullTeam(ctx, tx, &id, nullTeamCheck); err != nil {
+			return ctxerr.Wrap(ctx, err, "vpp token null team check")
+		}
+
+		if _, err := tx.ExecContext(ctx, stmtDeleteApps, deleteArgs...); err != nil {
+			return ctxerr.Wrap(ctx, err, "deleting old vpp team apps associations")
+		}
+
+		if _, err := tx.ExecContext(ctx, stmtRemove, id); err != nil {
+			return ctxerr.Wrap(ctx, err, "removing old vpp team associations")
+		}
+
+		if len(args) > 0 {
+			if _, err := tx.ExecContext(ctx, stmtInsertFull, args...); err != nil {
+				if isChildForeignKeyError(err) {
+					return foreignKey("team", fmt.Sprintf("(team_id)=(%v)", values))
+				}
+
+				return ctxerr.Wrap(ctx, err, "updating vpp token team")
+			}
+		}
+
+		return nil
+	})
+	if err != nil {
+		var mysqlErr *mysql.MySQLError
+		// https://dev.mysql.com/doc/mysql-errors/8.4/en/server-error-reference.html#error_er_dup_entry
+		if errors.As(err, &mysqlErr) && IsDuplicate(err) {
+			var dupeTeamID uint
+			var dupeTeamName string
+			fmt.Sscanf(mysqlErr.Message, "Duplicate entry '%d' for", &dupeTeamID)
+			if err := sqlx.GetContext(ctx, ds.reader(ctx), &dupeTeamName, stmtTeamName, dupeTeamID); err != nil {
+				return nil, ctxerr.Wrap(ctx, err, "getting team name for vpp token conflict error")
+			}
+			return nil, ctxerr.Wrap(ctx, fleet.ErrVPPTokenTeamConstraint{Name: dupeTeamName, ID: &dupeTeamID})
+		}
+		return nil, ctxerr.Wrap(ctx, err, "modifying vpp token team associations")
+	}
+
+	return ds.GetVPPToken(ctx, id)
+}
+
+func (ds *Datastore) DeleteVPPToken(ctx context.Context, tokenID uint) error {
+	_, err := ds.writer(ctx).ExecContext(ctx, `DELETE FROM vpp_tokens WHERE id = ?`, tokenID)
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "deleting vpp token")
+	}
+
+	return nil
+}
+
+func (ds *Datastore) ListVPPTokens(ctx context.Context) ([]*fleet.VPPTokenDB, error) {
+	// linter false positive on the word "token" (gosec G101)
+	//nolint:gosec
+	stmtTokens := `
+	SELECT
+		id,
+		organization_name,
+		location,
+		renew_at,
+		token
+	FROM
+		vpp_tokens v
+`
+
+	stmtTeams := `
+	SELECT
+		vt.id,
+		vt.vpp_token_id,
+		vt.team_id,
+		vt.null_team_type,
+		COALESCE(t.name, '') AS name
+	FROM
+		vpp_token_teams vt
+	LEFT OUTER JOIN
+		teams t
+	ON vt.team_id = t.id
+`
+	var tokEncs []fleet.VPPTokenDB
+
+	var teams []struct {
+		ID         string             `db:"id"`
+		VPPTokenID uint               `db:"vpp_token_id"`
+		TeamID     *uint              `db:"team_id"`
+		TeamName   string             `db:"name"`
+		NullTeam   fleet.NullTeamType `db:"null_team_type"`
+	}
+
+	if err := sqlx.SelectContext(ctx, ds.reader(ctx), &tokEncs, stmtTokens); err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "selecting vpp tokens from db")
+	}
+
+	if err := sqlx.SelectContext(ctx, ds.reader(ctx), &teams, stmtTeams); err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "selecting vpp token teams from db")
+	}
+
+	tokens := map[uint]*fleet.VPPTokenDB{}
+
+	for _, tokEnc := range tokEncs {
+		tokDec, err := decrypt([]byte(tokEnc.Token), ds.serverPrivateKey)
+		if err != nil {
+			return nil, ctxerr.Wrap(ctx, err, "decrypting vpp token with serverPrivateKey")
+		}
+
+		tokens[tokEnc.ID] = &fleet.VPPTokenDB{
+			ID:        tokEnc.ID,
+			OrgName:   tokEnc.OrgName,
+			Location:  tokEnc.Location,
+			RenewDate: tokEnc.RenewDate,
+			Token:     string(tokDec),
+		}
+	}
+
+	for _, team := range teams {
+		token := tokens[team.VPPTokenID]
+		if token.Teams != nil && len(token.Teams) == 0 {
+			// Token was already assigned to All Teams, we should not
+			// see it again in a loop
+			return nil, fmt.Errorf("vpp token \"%s\" has been assigned to All teams, and another team", token.OrgName)
+		}
+		switch team.NullTeam {
+		case fleet.NullTeamAllTeams:
+			// All teams, there should be no other teams.
+			// Make sure array is non-nil
+			if token.Teams != nil {
+				// This team has already been assigned something, this
+				// should not happen
+				return nil, fmt.Errorf("vpp token \"%s\" has been asssigned to All teams, and another team", token.OrgName)
+			}
+			token.Teams = []fleet.TeamTuple{}
+		case fleet.NullTeamNoTeam:
+			token.Teams = append(token.Teams, fleet.TeamTuple{ID: 0, Name: fleet.TeamNameNoTeam})
+		case fleet.NullTeamNone:
+			// Regular team
+			token.Teams = append(token.Teams, fleet.TeamTuple{ID: *team.TeamID, Name: team.TeamName})
+		}
+	}
+
+	var outTokens []*fleet.VPPTokenDB
+	for _, token := range tokens {
+		outTokens = append(outTokens, token)
+	}
+
+	slices.SortFunc(outTokens, func(a, b *fleet.VPPTokenDB) int {
+		return cmp.Compare(a.OrgName, b.OrgName)
+	})
+
+	return outTokens, nil
+}
+
+func (ds *Datastore) GetVPPTokenByTeamID(ctx context.Context, teamID *uint) (*fleet.VPPTokenDB, error) {
+	stmtTeam := `
+	SELECT
+		v.id,
+		v.organization_name,
+		v.location,
+		v.renew_at,
+		v.token
+	FROM
+		vpp_token_teams vt
+	INNER JOIN
+		vpp_tokens v
+	ON vt.vpp_token_id = v.id
+	WHERE
+		vt.team_id = ?
+`
+	stmtTeamNames := `
+	SELECT
+		vt.team_id,
+		vt.null_team_type,
+		COALESCE(t.name, '') AS name
+	FROM
+		vpp_token_teams vt
+	LEFT OUTER JOIN
+		teams t
+	ON t.id = vt.team_id
+	WHERE
+		vt.vpp_token_id = ?
+`
+	stmtNullTeam := `
+	SELECT
+		v.id,
+		v.organization_name,
+		v.location,
+		v.renew_at,
+		v.token
+	FROM
+		vpp_tokens v
+	INNER JOIN
+		vpp_token_teams vt
+	ON v.id = vt.vpp_token_id
+	WHERE
+		vt.team_id IS NULL
+	AND
+		vt.null_team_type = ?
+`
+
+	var tokEnc fleet.VPPTokenDB
+
+	var tokTeams []struct {
+		TeamID   *uint              `db:"team_id"`
+		NullTeam fleet.NullTeamType `db:"null_team_type"`
+		Name     string             `db:"name"`
+	}
+
+	var err error
+	if teamID != nil && *teamID != 0 {
+		err = sqlx.GetContext(ctx, ds.reader(ctx), &tokEnc, stmtTeam, teamID)
+	} else {
+		err = sqlx.GetContext(ctx, ds.reader(ctx), &tokEnc, stmtNullTeam, fleet.NullTeamNoTeam)
+	}
+	if err != nil {
+		if errors.Is(sql.ErrNoRows, err) {
+			if err := sqlx.GetContext(ctx, ds.reader(ctx), &tokEnc, stmtNullTeam, fleet.NullTeamAllTeams); err != nil {
+				if errors.Is(err, sql.ErrNoRows) {
+					return nil, ctxerr.Wrap(ctx, notFound("VPPToken"), "retrieving vpp token by team")
+				}
+				return nil, ctxerr.Wrap(ctx, err, "retrieving vpp token by team")
+			}
+		} else {
+			return nil, ctxerr.Wrap(ctx, err, "retrieving vpp token by team")
+		}
+	}
+
+	tokDec, err := decrypt([]byte(tokEnc.Token), ds.serverPrivateKey)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "decrypting vpp token with serverPrivateKey")
+	}
+
+	if err := sqlx.SelectContext(ctx, ds.reader(ctx), &tokTeams, stmtTeamNames, tokEnc.ID); err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "retrieving vpp token team information")
+	}
+
+	tok := &fleet.VPPTokenDB{
+		ID:        tokEnc.ID,
+		OrgName:   tokEnc.OrgName,
+		Location:  tokEnc.Location,
+		RenewDate: tokEnc.RenewDate,
+		Token:     string(tokDec),
+	}
+
+	if tokTeams == nil {
+		// Not assigned, no need to loop over teams
+		return tok, nil
+	}
+
+TEAMLOOP:
+	for _, team := range tokTeams {
+		switch team.NullTeam {
+		case fleet.NullTeamAllTeams:
+			// This should only be possible if there are no other teams
+			// Make sure something array is non-nil
+			if len(tokTeams) != 1 {
+				return nil, ctxerr.Errorf(ctx, "team \"%s\" belongs to All teams, and %d other team(s)", tok.OrgName, len(tokTeams)-1)
+			}
+			tok.Teams = []fleet.TeamTuple{}
+			break TEAMLOOP
+		case fleet.NullTeamNoTeam:
+			tok.Teams = append(tok.Teams, fleet.TeamTuple{
+				ID:   0,
+				Name: fleet.TeamNameNoTeam,
+			})
+		case fleet.NullTeamNone:
+			// Regular team
+			tok.Teams = append(tok.Teams, fleet.TeamTuple{
+				ID:   *team.TeamID,
+				Name: team.Name,
+			})
+		}
+	}
+
+	return tok, nil
+}
+
+func checkVPPNullTeam(ctx context.Context, tx sqlx.ExtContext, currentID *uint, nullTeam fleet.NullTeamType) error {
+	nullTeamStmt := `SELECT vpp_token_id FROM vpp_token_teams WHERE null_team_type = ?`
+	anyTeamStmt := `SELECT vpp_token_id FROM vpp_token_teams WHERE null_team_type = 'allteams' OR null_team_type = 'noteam' OR team_id IS NOT NULL`
+
+	if nullTeam == fleet.NullTeamAllTeams {
+		var ids []uint
+		if err := sqlx.SelectContext(ctx, tx, &ids, anyTeamStmt); err != nil {
+			return ctxerr.Wrap(ctx, err, "scanning row in check vpp token null team")
+		}
+
+		if len(ids) > 0 {
+			if len(ids) > 1 {
+				return ctxerr.Wrap(ctx, errors.New("Cannot assign token to All teams, other teams have tokens"))
+			}
+			if currentID == nil || ids[0] != *currentID {
+				return ctxerr.Wrap(ctx, errors.New("Cannot assign token to All teams, other teams have tokens"))
+			}
+		}
+	}
+
+	var id uint
+	allTeamsFound := true
+	if err := sqlx.GetContext(ctx, tx, &id, nullTeamStmt, fleet.NullTeamAllTeams); err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			allTeamsFound = false
+		} else {
+			return ctxerr.Wrap(ctx, err, "scanning row in check vpp token null team")
+		}
+	}
+
+	if allTeamsFound && currentID != nil && *currentID != id {
+		return ctxerr.Wrap(ctx, fleet.ErrVPPTokenTeamConstraint{Name: fleet.ReservedNameAllTeams})
+	}
+
+	if nullTeam != fleet.NullTeamNone {
+		var id uint
+		if err := sqlx.GetContext(ctx, tx, &id, nullTeamStmt, nullTeam); err != nil {
+			if errors.Is(err, sql.ErrNoRows) {
+				return nil
+			}
+			return ctxerr.Wrap(ctx, err, "scanning row in check vpp token null team")
+		}
+		if currentID == nil || *currentID != id {
+			return ctxerr.Wrap(ctx, fleet.ErrVPPTokenTeamConstraint{Name: nullTeam.PrettyName()})
+		}
+	}
+
+	return nil
+}
diff --git a/server/datastore/mysql/vpp_test.go b/server/datastore/mysql/vpp_test.go
index 27fce609d3..9a6c6796ce 100644
--- a/server/datastore/mysql/vpp_test.go
+++ b/server/datastore/mysql/vpp_test.go
@@ -3,10 +3,13 @@ package mysql
 import (
 	"context"
 	"testing"
+	"time"
 
+	"github.com/fleetdm/fleet/v4/server/contexts/viewer"
 	"github.com/fleetdm/fleet/v4/server/fleet"
 	"github.com/fleetdm/fleet/v4/server/mdm/nanomdm/mdm"
 	"github.com/fleetdm/fleet/v4/server/ptr"
+	"github.com/fleetdm/fleet/v4/server/test"
 	"github.com/google/uuid"
 	"github.com/jmoiron/sqlx"
 	"github.com/stretchr/testify/assert"
@@ -25,6 +28,8 @@ func TestVPP(t *testing.T) {
 		{"VPPAppStatus", testVPPAppStatus},
 		{"VPPApps", testVPPApps},
 		{"GetVPPAppByTeamAndTitleID", testGetVPPAppByTeamAndTitleID},
+		{"VPPTokensCRUD", testVPPTokensCRUD},
+		{"VPPTokenAppTeamAssociations", testVPPTokenAppTeamAssociations},
 	}
 
 	for _, c := range cases {
@@ -47,6 +52,8 @@ func testVPPAppMetadata(t *testing.T, ds *Datastore) {
 	require.NoError(t, err)
 	require.NotNil(t, team2)
 
+	test.CreateInsertGlobalVPPToken(t, ds)
+
 	// get for non-existing title
 	meta, err := ds.GetVPPAppMetadataByTeamAndTitleID(ctx, nil, 1)
 	require.Error(t, err)
@@ -55,8 +62,10 @@ func testVPPAppMetadata(t *testing.T, ds *Datastore) {
 	require.Nil(t, meta)
 
 	// create no-team app
-	va1, err := ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{Name: "vpp1", BundleIdentifier: "com.app.vpp1",
-		VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_app_1", Platform: fleet.MacOSPlatform}}, nil)
+	va1, err := ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{
+		Name: "vpp1", BundleIdentifier: "com.app.vpp1",
+		VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_app_1", Platform: fleet.MacOSPlatform}},
+	}, nil)
 	require.NoError(t, err)
 	vpp1, titleID1 := va1.VPPAppID, va1.TitleID
 
@@ -65,16 +74,23 @@ func testVPPAppMetadata(t *testing.T, ds *Datastore) {
 	require.NoError(t, err)
 	require.Equal(t, &fleet.VPPAppStoreApp{Name: "vpp1", VPPAppID: vpp1}, meta)
 
-	// try to add the same app again, fails
-	var existsErr *existsError
-	_, err = ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{Name: "vpp1", BundleIdentifier: "com.app.vpp1",
-		VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_app_1", Platform: fleet.MacOSPlatform}}, nil)
-	require.Error(t, err)
-	require.ErrorAs(t, err, &existsErr)
+	// try to add the same app again, update self_service field
+	_, err = ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{
+		Name: "vpp1", BundleIdentifier: "com.app.vpp1",
+		VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_app_1", Platform: fleet.MacOSPlatform}, SelfService: true},
+	}, nil)
+	require.NoError(t, err)
+
+	// get no-team app
+	meta, err = ds.GetVPPAppMetadataByTeamAndTitleID(ctx, nil, titleID1)
+	require.NoError(t, err)
+	require.Equal(t, &fleet.VPPAppStoreApp{Name: "vpp1", VPPAppID: vpp1, SelfService: true}, meta)
 
 	// create team1 app
-	va2, err := ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{Name: "vpp2", BundleIdentifier: "com.app.vpp2",
-		VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_app_2", Platform: fleet.MacOSPlatform}}, &team1.ID)
+	va2, err := ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{
+		Name: "vpp2", BundleIdentifier: "com.app.vpp2",
+		VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_app_2", Platform: fleet.MacOSPlatform}},
+	}, &team1.ID)
 	require.NoError(t, err)
 	vpp2, titleID2 := va2.VPPAppID, va2.TitleID
 
@@ -83,11 +99,22 @@ func testVPPAppMetadata(t *testing.T, ds *Datastore) {
 	require.NoError(t, err)
 	require.Equal(t, &fleet.VPPAppStoreApp{Name: "vpp2", VPPAppID: vpp2}, meta)
 
+	// get it for all teams
+	meta, err = ds.GetVPPAppMetadataByTeamAndTitleID(ctx, nil, titleID2)
+	require.NoError(t, err)
+	require.Equal(t, &fleet.VPPAppStoreApp{Name: "vpp2", VPPAppID: vpp2}, meta)
+
 	// try to add the same app again, fails
-	_, err = ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{Name: "vpp2", BundleIdentifier: "com.app.vpp2",
-		VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_app_2", Platform: fleet.MacOSPlatform}}, &team1.ID)
-	require.Error(t, err)
-	require.ErrorAs(t, err, &existsErr)
+	_, err = ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{
+		Name: "vpp2", BundleIdentifier: "com.app.vpp2",
+		VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_app_2", Platform: fleet.MacOSPlatform}, SelfService: true},
+	}, &team1.ID)
+	require.NoError(t, err)
+
+	// get it for team 1
+	meta, err = ds.GetVPPAppMetadataByTeamAndTitleID(ctx, &team1.ID, titleID2)
+	require.NoError(t, err)
+	require.Equal(t, &fleet.VPPAppStoreApp{Name: "vpp2", VPPAppID: vpp2, SelfService: true}, meta)
 
 	// get it for team 2, does not exist
 	meta, err = ds.GetVPPAppMetadataByTeamAndTitleID(ctx, &team2.ID, titleID2)
@@ -96,21 +123,25 @@ func testVPPAppMetadata(t *testing.T, ds *Datastore) {
 	require.Nil(t, meta)
 
 	// create the same app for team2
-	_, err = ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{Name: "vpp2", BundleIdentifier: "com.app.vpp2",
-		VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_app_2", Platform: fleet.MacOSPlatform}}, &team2.ID)
+	_, err = ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{
+		Name: "vpp2", BundleIdentifier: "com.app.vpp2",
+		VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_app_2", Platform: fleet.MacOSPlatform}},
+	}, &team2.ID)
 	require.NoError(t, err)
 
 	// get it for team 1 and team 2, both work
 	meta, err = ds.GetVPPAppMetadataByTeamAndTitleID(ctx, &team1.ID, titleID2)
 	require.NoError(t, err)
-	require.Equal(t, &fleet.VPPAppStoreApp{Name: "vpp2", VPPAppID: vpp2}, meta)
+	require.Equal(t, &fleet.VPPAppStoreApp{Name: "vpp2", VPPAppID: vpp2, SelfService: true}, meta)
 	meta, err = ds.GetVPPAppMetadataByTeamAndTitleID(ctx, &team2.ID, titleID2)
 	require.NoError(t, err)
 	require.Equal(t, &fleet.VPPAppStoreApp{Name: "vpp2", VPPAppID: vpp2}, meta)
 
 	// create another no-team app
-	va3, err := ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{Name: "vpp3", BundleIdentifier: "com.app.vpp3",
-		VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_app_3", Platform: fleet.MacOSPlatform}}, nil)
+	va3, err := ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{
+		Name: "vpp3", BundleIdentifier: "com.app.vpp3",
+		VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_app_3", Platform: fleet.MacOSPlatform}},
+	}, nil)
 	require.NoError(t, err)
 	vpp3, titleID3 := va3.VPPAppID, va3.TitleID
 
@@ -184,21 +215,31 @@ func testVPPAppStatus(t *testing.T, ds *Datastore) {
 	require.NoError(t, err)
 	require.NotNil(t, team1)
 
+	test.CreateInsertGlobalVPPToken(t, ds)
+
 	// create some apps, one for no-team, one for team1, and one in both
-	va1, err := ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{Name: "vpp1", BundleIdentifier: "com.app.vpp1",
-		VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_app_1", Platform: fleet.MacOSPlatform}}, nil)
+	va1, err := ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{
+		Name: "vpp1", BundleIdentifier: "com.app.vpp1",
+		VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_app_1", Platform: fleet.MacOSPlatform}},
+	}, nil)
 	require.NoError(t, err)
 	vpp1 := va1.VPPAppID
-	va2, err := ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{Name: "vpp2", BundleIdentifier: "com.app.vpp2",
-		VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_app_2", Platform: fleet.MacOSPlatform}}, &team1.ID)
+	va2, err := ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{
+		Name: "vpp2", BundleIdentifier: "com.app.vpp2",
+		VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_app_2", Platform: fleet.MacOSPlatform}},
+	}, &team1.ID)
 	require.NoError(t, err)
 	vpp2 := va2.VPPAppID
-	va3, err := ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{Name: "vpp3", BundleIdentifier: "com.app.vpp3",
-		VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_app_3", Platform: fleet.MacOSPlatform}}, nil)
+	va3, err := ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{
+		Name: "vpp3", BundleIdentifier: "com.app.vpp3",
+		VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_app_3", Platform: fleet.MacOSPlatform}},
+	}, nil)
 	require.NoError(t, err)
 	vpp3 := va3.VPPAppID
-	_, err = ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{Name: "vpp3", BundleIdentifier: "com.app.vpp3",
-		VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_app_3", Platform: fleet.MacOSPlatform}}, &team1.ID)
+	_, err = ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{
+		Name: "vpp3", BundleIdentifier: "com.app.vpp3",
+		VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "adam_vpp_app_3", Platform: fleet.MacOSPlatform}},
+	}, &team1.ID)
 	require.NoError(t, err)
 
 	// for now they all return zeroes
@@ -275,6 +316,7 @@ func testVPPAppStatus(t *testing.T, ds *Datastore) {
 	require.Equal(t, user.ID, actUser.ID)
 	require.Equal(t, user.Name, actUser.Name)
 	require.Equal(t, cmd3, act.CommandUUID)
+	require.False(t, act.SelfService)
 
 	summary, err = ds.GetSummaryHostVPPAppInstalls(ctx, nil, vpp1)
 	require.NoError(t, err)
@@ -317,6 +359,19 @@ func testVPPAppStatus(t *testing.T, ds *Datastore) {
 	summary, err = ds.GetSummaryHostVPPAppInstalls(ctx, &team1.ID, vpp3)
 	require.NoError(t, err)
 	require.Equal(t, &fleet.VPPAppStatusSummary{Pending: 0, Failed: 0, Installed: 1}, summary)
+
+	// simulate a self-service request
+	ExecAdhocSQL(t, ds, func(q sqlx.ExtContext) error {
+		_, err := q.ExecContext(ctx,
+			`UPDATE host_vpp_software_installs SET self_service = true, user_id = NULL WHERE command_uuid = ?`,
+			cmd3)
+		return err
+	})
+	actUser, act, err = ds.GetPastActivityDataForVPPAppInstall(ctx, &mdm.CommandResults{CommandUUID: cmd3})
+	require.NoError(t, err)
+	require.Nil(t, actUser)
+	require.Equal(t, cmd3, act.CommandUUID)
+	require.True(t, act.SelfService)
 }
 
 // simulates creating the VPP app install request on the host, returns the command UUID.
@@ -355,6 +410,8 @@ func testVPPApps(t *testing.T, ds *Datastore) {
 	team, err := ds.NewTeam(ctx, &fleet.Team{Name: "foobar"})
 	require.NoError(t, err)
 
+	test.CreateInsertGlobalVPPToken(t, ds)
+
 	// create a host with some non-VPP software
 	h1, err := ds.NewHost(ctx, &fleet.Host{
 		Hostname:       "macos-test-1",
@@ -376,8 +433,8 @@ func testVPPApps(t *testing.T, ds *Datastore) {
 	require.NoError(t, err)
 
 	// Insert some VPP apps for the team, "vpp_app_1" should match the existing "foo" title
-	app1 := &fleet.VPPApp{Name: "vpp_app_1", VPPAppID: fleet.VPPAppID{AdamID: "1", Platform: fleet.MacOSPlatform}, BundleIdentifier: "b1"}
-	app2 := &fleet.VPPApp{Name: "vpp_app_2", VPPAppID: fleet.VPPAppID{AdamID: "2", Platform: fleet.MacOSPlatform}, BundleIdentifier: "b2"}
+	app1 := &fleet.VPPApp{Name: "vpp_app_1", VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "1", Platform: fleet.MacOSPlatform}}, BundleIdentifier: "b1"}
+	app2 := &fleet.VPPApp{Name: "vpp_app_2", VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "2", Platform: fleet.MacOSPlatform}}, BundleIdentifier: "b2"}
 	_, err = ds.InsertVPPAppWithTeam(ctx, app1, &team.ID)
 	require.NoError(t, err)
 
@@ -385,10 +442,14 @@ func testVPPApps(t *testing.T, ds *Datastore) {
 	require.NoError(t, err)
 
 	// Insert some VPP apps for no team
-	appNoTeam1 := &fleet.VPPApp{Name: "vpp_no_team_app_1", VPPAppID: fleet.VPPAppID{AdamID: "3", Platform: fleet.MacOSPlatform},
-		BundleIdentifier: "b3"}
-	appNoTeam2 := &fleet.VPPApp{Name: "vpp_no_team_app_2", VPPAppID: fleet.VPPAppID{AdamID: "4", Platform: fleet.MacOSPlatform},
-		BundleIdentifier: "b4"}
+	appNoTeam1 := &fleet.VPPApp{
+		Name: "vpp_no_team_app_1", VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "3", Platform: fleet.MacOSPlatform}},
+		BundleIdentifier: "b3",
+	}
+	appNoTeam2 := &fleet.VPPApp{
+		Name: "vpp_no_team_app_2", VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "4", Platform: fleet.MacOSPlatform}},
+		BundleIdentifier: "b4",
+	}
 	_, err = ds.InsertVPPAppWithTeam(ctx, appNoTeam1, nil)
 	require.NoError(t, err)
 	_, err = ds.InsertVPPAppWithTeam(ctx, appNoTeam2, nil)
@@ -402,43 +463,47 @@ func testVPPApps(t *testing.T, ds *Datastore) {
 		GlobalRole: ptr.String(fleet.RoleAdmin),
 	})
 	require.NoError(t, err)
-	err = ds.InsertHostVPPSoftwareInstall(ctx, 1, u.ID, app1.VPPAppID, "a", "b")
+	ctx = viewer.NewContext(ctx, viewer.Viewer{User: u})
+	err = ds.InsertHostVPPSoftwareInstall(ctx, 1, app1.VPPAppID, "a", "b", false)
 	require.NoError(t, err)
 
-	err = ds.InsertHostVPPSoftwareInstall(ctx, 2, u.ID, app2.VPPAppID, "c", "d")
+	err = ds.InsertHostVPPSoftwareInstall(ctx, 2, app2.VPPAppID, "c", "d", true)
 	require.NoError(t, err)
 
 	var results []struct {
 		HostID            uint   `db:"host_id"`
-		UserID            uint   `db:"user_id"`
+		UserID            *uint  `db:"user_id"`
 		AdamID            string `db:"adam_id"`
 		CommandUUID       string `db:"command_uuid"`
 		AssociatedEventID string `db:"associated_event_id"`
+		SelfService       bool   `db:"self_service"`
 	}
-	err = sqlx.SelectContext(ctx, ds.reader(ctx), &results, `SELECT host_id, user_id, adam_id, command_uuid, associated_event_id FROM host_vpp_software_installs ORDER BY adam_id`)
+	err = sqlx.SelectContext(ctx, ds.reader(ctx), &results, `SELECT host_id, user_id, adam_id, command_uuid, associated_event_id, self_service FROM host_vpp_software_installs ORDER BY adam_id`)
 	require.NoError(t, err)
 	require.Len(t, results, 2)
 	a1 := results[0]
 	a2 := results[1]
 	require.Equal(t, a1.HostID, uint(1))
-	require.Equal(t, a1.UserID, u.ID)
+	require.Equal(t, a1.UserID, ptr.Uint(u.ID))
 	require.Equal(t, a1.AdamID, app1.AdamID)
 	require.Equal(t, a1.CommandUUID, "a")
 	require.Equal(t, a1.AssociatedEventID, "b")
+	require.False(t, a1.SelfService)
 	require.Equal(t, a2.HostID, uint(2))
-	require.Equal(t, a2.UserID, u.ID)
+	require.Equal(t, a2.UserID, ptr.Uint(u.ID))
 	require.Equal(t, a2.AdamID, app2.AdamID)
 	require.Equal(t, a2.CommandUUID, "c")
 	require.Equal(t, a2.AssociatedEventID, "d")
+	require.True(t, a2.SelfService)
 
 	// Check that getting the assigned apps works
 	appSet, err := ds.GetAssignedVPPApps(ctx, &team.ID)
 	require.NoError(t, err)
-	assert.Equal(t, map[fleet.VPPAppID]struct{}{app1.VPPAppID: {}, app2.VPPAppID: {}}, appSet)
+	assert.Equal(t, map[fleet.VPPAppID]fleet.VPPAppTeam{app1.VPPAppID: {VPPAppID: app1.VPPAppID}, app2.VPPAppID: {VPPAppID: app2.VPPAppID}}, appSet)
 
 	appSet, err = ds.GetAssignedVPPApps(ctx, nil)
 	require.NoError(t, err)
-	assert.Equal(t, map[fleet.VPPAppID]struct{}{appNoTeam1.VPPAppID: {}, appNoTeam2.VPPAppID: {}}, appSet)
+	assert.Equal(t, map[fleet.VPPAppID]fleet.VPPAppTeam{appNoTeam1.VPPAppID: {VPPAppID: appNoTeam1.VPPAppID}, appNoTeam2.VPPAppID: {VPPAppID: appNoTeam2.VPPAppID}}, appSet)
 
 	var appTitles []fleet.SoftwareTitle
 	err = sqlx.SelectContext(ctx, ds.reader(ctx), &appTitles, `SELECT name, bundle_identifier FROM software_titles WHERE bundle_identifier IN (?,?) ORDER BY bundle_identifier`, app1.BundleIdentifier, app2.BundleIdentifier)
@@ -457,17 +522,24 @@ func testSetTeamVPPApps(t *testing.T, ds *Datastore) {
 	team, err := ds.NewTeam(ctx, &fleet.Team{Name: "vpp gang"})
 	require.NoError(t, err)
 
+	dataToken, err := test.CreateVPPTokenData(time.Now().Add(24*time.Hour), "Donkey Kong", "Jungle")
+	require.NoError(t, err)
+	tok1, err := ds.InsertVPPToken(ctx, dataToken)
+	assert.NoError(t, err)
+	_, err = ds.UpdateVPPTokenTeams(ctx, tok1.ID, []uint{})
+	assert.NoError(t, err)
+
 	// Insert some VPP apps for the team
-	app1 := &fleet.VPPApp{Name: "vpp_app_1", VPPAppID: fleet.VPPAppID{AdamID: "1", Platform: fleet.MacOSPlatform}, BundleIdentifier: "b1"}
+	app1 := &fleet.VPPApp{Name: "vpp_app_1", VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "1", Platform: fleet.MacOSPlatform}}, BundleIdentifier: "b1"}
 	_, err = ds.InsertVPPAppWithTeam(ctx, app1, nil)
 	require.NoError(t, err)
-	app2 := &fleet.VPPApp{Name: "vpp_app_2", VPPAppID: fleet.VPPAppID{AdamID: "2", Platform: fleet.MacOSPlatform}, BundleIdentifier: "b2"}
+	app2 := &fleet.VPPApp{Name: "vpp_app_2", VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "2", Platform: fleet.MacOSPlatform}}, BundleIdentifier: "b2"}
 	_, err = ds.InsertVPPAppWithTeam(ctx, app2, nil)
 	require.NoError(t, err)
-	app3 := &fleet.VPPApp{Name: "vpp_app_3", VPPAppID: fleet.VPPAppID{AdamID: "3", Platform: fleet.MacOSPlatform}, BundleIdentifier: "b3"}
+	app3 := &fleet.VPPApp{Name: "vpp_app_3", VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "3", Platform: fleet.MacOSPlatform}}, BundleIdentifier: "b3"}
 	_, err = ds.InsertVPPAppWithTeam(ctx, app3, nil)
 	require.NoError(t, err)
-	app4 := &fleet.VPPApp{Name: "vpp_app_4", VPPAppID: fleet.VPPAppID{AdamID: "4", Platform: fleet.MacOSPlatform}, BundleIdentifier: "b4"}
+	app4 := &fleet.VPPApp{Name: "vpp_app_4", VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "4", Platform: fleet.MacOSPlatform}}, BundleIdentifier: "b4"}
 	_, err = ds.InsertVPPAppWithTeam(ctx, app4, nil)
 	require.NoError(t, err)
 
@@ -476,7 +548,10 @@ func testSetTeamVPPApps(t *testing.T, ds *Datastore) {
 	require.Len(t, assigned, 0)
 
 	// Assign 2 apps
-	err = ds.SetTeamVPPApps(ctx, &team.ID, []fleet.VPPAppID{app1.VPPAppID, app2.VPPAppID})
+	err = ds.SetTeamVPPApps(ctx, &team.ID, []fleet.VPPAppTeam{
+		{VPPAppID: app1.VPPAppID},
+		{VPPAppID: app2.VPPAppID, SelfService: true},
+	})
 	require.NoError(t, err)
 
 	assigned, err = ds.GetAssignedVPPApps(ctx, &team.ID)
@@ -484,9 +559,14 @@ func testSetTeamVPPApps(t *testing.T, ds *Datastore) {
 	require.Len(t, assigned, 2)
 	assert.Contains(t, assigned, app1.VPPAppID)
 	assert.Contains(t, assigned, app2.VPPAppID)
+	assert.True(t, assigned[app2.VPPAppID].SelfService)
 
 	// Assign an additional app
-	err = ds.SetTeamVPPApps(ctx, &team.ID, []fleet.VPPAppID{app1.VPPAppID, app2.VPPAppID, app3.VPPAppID})
+	err = ds.SetTeamVPPApps(ctx, &team.ID, []fleet.VPPAppTeam{
+		{VPPAppID: app1.VPPAppID},
+		{VPPAppID: app2.VPPAppID},
+		{VPPAppID: app3.VPPAppID},
+	})
 	require.NoError(t, err)
 
 	assigned, err = ds.GetAssignedVPPApps(ctx, &team.ID)
@@ -495,9 +575,14 @@ func testSetTeamVPPApps(t *testing.T, ds *Datastore) {
 	require.Contains(t, assigned, app1.VPPAppID)
 	require.Contains(t, assigned, app2.VPPAppID)
 	require.Contains(t, assigned, app3.VPPAppID)
+	assert.False(t, assigned[app2.VPPAppID].SelfService)
 
 	// Swap one app out for another
-	err = ds.SetTeamVPPApps(ctx, &team.ID, []fleet.VPPAppID{app1.VPPAppID, app2.VPPAppID, app4.VPPAppID})
+	err = ds.SetTeamVPPApps(ctx, &team.ID, []fleet.VPPAppTeam{
+		{VPPAppID: app1.VPPAppID},
+		{VPPAppID: app2.VPPAppID, SelfService: true},
+		{VPPAppID: app4.VPPAppID},
+	})
 	require.NoError(t, err)
 
 	assigned, err = ds.GetAssignedVPPApps(ctx, &team.ID)
@@ -506,9 +591,10 @@ func testSetTeamVPPApps(t *testing.T, ds *Datastore) {
 	require.Contains(t, assigned, app1.VPPAppID)
 	require.Contains(t, assigned, app2.VPPAppID)
 	require.Contains(t, assigned, app4.VPPAppID)
+	assert.True(t, assigned[app2.VPPAppID].SelfService)
 
 	// Remove all apps
-	err = ds.SetTeamVPPApps(ctx, &team.ID, []fleet.VPPAppID{})
+	err = ds.SetTeamVPPApps(ctx, &team.ID, []fleet.VPPAppTeam{})
 	require.NoError(t, err)
 
 	assigned, err = ds.GetAssignedVPPApps(ctx, &team.ID)
@@ -521,33 +607,597 @@ func testGetVPPAppByTeamAndTitleID(t *testing.T, ds *Datastore) {
 	team, err := ds.NewTeam(ctx, &fleet.Team{Name: "team 2"})
 	require.NoError(t, err)
 
+	test.CreateInsertGlobalVPPToken(t, ds)
+
 	var nfe fleet.NotFoundError
 
 	fooApp, err := ds.InsertVPPAppWithTeam(ctx,
-		&fleet.VPPApp{VPPAppID: fleet.VPPAppID{AdamID: "foo", Platform: fleet.MacOSPlatform}, BundleIdentifier: "b1", Name: "Foo"},
+		&fleet.VPPApp{VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "foo", Platform: fleet.MacOSPlatform}}, BundleIdentifier: "b1", Name: "Foo"},
 		&team.ID)
 	require.NoError(t, err)
 
 	fooTitleID := fooApp.TitleID
-	gotVPPApp, err := ds.GetVPPAppByTeamAndTitleID(ctx, &team.ID, fooTitleID, true)
+	gotVPPApp, err := ds.GetVPPAppByTeamAndTitleID(ctx, &team.ID, fooTitleID)
 	require.NoError(t, err)
 	require.Equal(t, "foo", gotVPPApp.AdamID)
 	require.Equal(t, fooTitleID, gotVPPApp.TitleID)
 	// title that doesn't exist
-	gotVPPApp, err = ds.GetVPPAppByTeamAndTitleID(ctx, &team.ID, 999, true)
+	gotVPPApp, err = ds.GetVPPAppByTeamAndTitleID(ctx, &team.ID, 999)
 	require.ErrorAs(t, err, &nfe)
 
 	// create an entry for the global team
 	barApp, err := ds.InsertVPPAppWithTeam(ctx,
-		&fleet.VPPApp{VPPAppID: fleet.VPPAppID{AdamID: "bar", Platform: fleet.MacOSPlatform}, BundleIdentifier: "b2", Name: "Bar"}, nil)
+		&fleet.VPPApp{VPPAppTeam: fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "bar", Platform: fleet.MacOSPlatform}}, BundleIdentifier: "b2", Name: "Bar"}, nil)
 	require.NoError(t, err)
 	barTitleID := barApp.TitleID
 	// not found providing the team id
-	gotVPPApp, err = ds.GetVPPAppByTeamAndTitleID(ctx, &team.ID, barTitleID, true)
+	gotVPPApp, err = ds.GetVPPAppByTeamAndTitleID(ctx, &team.ID, barTitleID)
 	require.ErrorAs(t, err, &nfe)
 	// found for the global team
-	gotVPPApp, err = ds.GetVPPAppByTeamAndTitleID(ctx, nil, barTitleID, true)
+	gotVPPApp, err = ds.GetVPPAppByTeamAndTitleID(ctx, nil, barTitleID)
 	require.NoError(t, err)
 	require.Equal(t, "bar", gotVPPApp.AdamID)
 	require.Equal(t, barTitleID, gotVPPApp.TitleID)
 }
+
+func testVPPTokensCRUD(t *testing.T, ds *Datastore) {
+	ctx := context.Background()
+
+	team, err := ds.NewTeam(ctx, &fleet.Team{Name: "Kritters"})
+	assert.NoError(t, err)
+
+	team2, err := ds.NewTeam(ctx, &fleet.Team{Name: "Zingers"})
+	assert.NoError(t, err)
+
+	tokens, err := ds.ListVPPTokens(ctx)
+	assert.NoError(t, err)
+	assert.Len(t, tokens, 0)
+
+	orgName := "Donkey Kong"
+	location := "Jungle"
+	dataToken, err := test.CreateVPPTokenData(time.Now().Add(24*time.Hour), orgName, location)
+	require.NoError(t, err)
+
+	orgName2 := "Diddy Kong"
+	location2 := "Mines"
+	dataToken2, err := test.CreateVPPTokenData(time.Now().Add(24*time.Hour), orgName2, location2)
+	require.NoError(t, err)
+
+	orgName3 := "Cranky Cong"
+	location3 := "Cranky's Cabin"
+	dataToken3, err := test.CreateVPPTokenData(time.Now().Add(24*time.Hour), orgName3, location3)
+	require.NoError(t, err)
+
+	orgName4 := "Funky Kong"
+	location4 := "Funky's Fishing Shack"
+	dataToken4, err := test.CreateVPPTokenData(time.Now().Add(24*time.Hour), orgName4, location4)
+	require.NoError(t, err)
+
+	orgName5 := "Lanky Kong"
+	location5 := "Lanky Kong's Pool"
+	dataToken5, err := test.CreateVPPTokenData(time.Now().Add(24*time.Hour), orgName5, location5)
+	require.NoError(t, err)
+
+	orgName6 := "Dixie Kong"
+	location6 := "Dixie's Island"
+	dataToken6, err := test.CreateVPPTokenData(time.Now().Add(24*time.Hour), orgName6, location6)
+	require.NoError(t, err)
+
+	// No assignments / disabled token
+	tok, err := ds.InsertVPPToken(ctx, dataToken)
+	tokID := tok.ID
+	assert.NoError(t, err)
+	assert.Equal(t, dataToken.Location, tok.Location)
+	assert.Equal(t, dataToken.Token, tok.Token)
+	assert.Equal(t, orgName, tok.OrgName)
+	assert.Equal(t, location, tok.Location)
+	assert.Nil(t, tok.Teams) // No team assigned
+
+	tok, err = ds.GetVPPToken(ctx, tokID)
+	assert.NoError(t, err)
+	assert.Equal(t, tokID, tok.ID)
+	assert.Equal(t, dataToken.Location, tok.Location)
+	assert.Equal(t, dataToken.Token, tok.Token)
+	assert.Equal(t, orgName, tok.OrgName)
+	assert.Equal(t, location, tok.Location)
+	assert.Nil(t, tok.Teams)
+
+	toks, err := ds.ListVPPTokens(ctx)
+	assert.NoError(t, err)
+	assert.Len(t, toks, 1)
+	assert.Equal(t, tokID, toks[0].ID)
+	assert.Equal(t, dataToken.Location, toks[0].Location)
+	assert.Equal(t, dataToken.Token, toks[0].Token)
+	assert.Equal(t, orgName, toks[0].OrgName)
+	assert.Equal(t, location, toks[0].Location)
+	assert.Nil(t, toks[0].Teams)
+
+	teamTok, err := ds.GetVPPTokenByTeamID(ctx, nil)
+	assert.Error(t, err)
+	assert.True(t, fleet.IsNotFound(err))
+	assert.Nil(t, teamTok)
+
+	teamTok, err = ds.GetVPPTokenByTeamID(ctx, &team.ID)
+	assert.Error(t, err)
+	assert.True(t, fleet.IsNotFound(err))
+	assert.Nil(t, teamTok)
+
+	// Assign to all teams
+	upTok, err := ds.UpdateVPPTokenTeams(ctx, tok.ID, []uint{})
+	assert.NoError(t, err)
+	assert.Equal(t, tokID, upTok.ID)
+	assert.Equal(t, dataToken.Location, upTok.Location)
+	assert.Equal(t, dataToken.Token, upTok.Token)
+	assert.Equal(t, orgName, upTok.OrgName)
+	assert.Equal(t, location, upTok.Location)
+	assert.NotNil(t, upTok.Teams) // "All Teams" teamm array is non-nil but empty
+	assert.Len(t, upTok.Teams, 0)
+
+	tok, err = ds.GetVPPToken(ctx, tok.ID)
+	assert.NoError(t, err)
+	assert.Equal(t, tokID, tok.ID)
+	assert.Equal(t, dataToken.Location, tok.Location)
+	assert.Equal(t, dataToken.Token, tok.Token)
+	assert.Equal(t, orgName, tok.OrgName)
+	assert.Equal(t, location, tok.Location)
+	assert.NotNil(t, tok.Teams) // "All Teams" teams array is non-nil but empty
+	assert.Len(t, tok.Teams, 0)
+
+	toks, err = ds.ListVPPTokens(ctx)
+	assert.NoError(t, err)
+	assert.Len(t, toks, 1)
+	assert.Equal(t, dataToken.Location, toks[0].Location)
+	assert.Equal(t, dataToken.Token, toks[0].Token)
+	assert.Equal(t, orgName, toks[0].OrgName)
+	assert.Equal(t, location, toks[0].Location)
+	assert.NotNil(t, toks[0].Teams)
+	assert.Len(t, toks[0].Teams, 0)
+
+	teamTok, err = ds.GetVPPTokenByTeamID(ctx, nil)
+	assert.NoError(t, err)
+	assert.Equal(t, tokID, teamTok.ID)
+	assert.Equal(t, dataToken.Location, teamTok.Location)
+	assert.Equal(t, dataToken.Token, teamTok.Token)
+	assert.Equal(t, orgName, teamTok.OrgName)
+	assert.Equal(t, location, teamTok.Location)
+	assert.NotNil(t, teamTok.Teams)
+	assert.Len(t, teamTok.Teams, 0)
+
+	teamTok, err = ds.GetVPPTokenByTeamID(ctx, &team.ID)
+	assert.NoError(t, err)
+	assert.Equal(t, tokID, teamTok.ID)
+	assert.Equal(t, dataToken.Location, teamTok.Location)
+	assert.Equal(t, dataToken.Token, teamTok.Token)
+	assert.Equal(t, orgName, teamTok.OrgName)
+	assert.Equal(t, location, teamTok.Location)
+	assert.NotNil(t, teamTok.Teams)
+	assert.Len(t, teamTok.Teams, 0)
+
+	// Assign to team "No Team"
+	upTok, err = ds.UpdateVPPTokenTeams(ctx, tok.ID, []uint{0})
+	require.NoError(t, err)
+	assert.Len(t, upTok.Teams, 1)
+	assert.Equal(t, tokID, upTok.ID)
+	assert.Equal(t, uint(0), upTok.Teams[0].ID)
+	assert.Equal(t, fleet.TeamNameNoTeam, upTok.Teams[0].Name)
+
+	tok, err = ds.GetVPPToken(ctx, tok.ID)
+	assert.NoError(t, err)
+	assert.Len(t, tok.Teams, 1)
+	assert.Equal(t, tokID, tok.ID)
+	assert.Equal(t, uint(0), tok.Teams[0].ID)
+	assert.Equal(t, fleet.TeamNameNoTeam, tok.Teams[0].Name)
+
+	toks, err = ds.ListVPPTokens(ctx)
+	assert.NoError(t, err)
+	assert.Len(t, toks, 1)
+	assert.Len(t, toks[0].Teams, 1)
+	assert.Equal(t, tokID, toks[0].ID)
+	assert.Equal(t, uint(0), toks[0].Teams[0].ID)
+	assert.Equal(t, fleet.TeamNameNoTeam, toks[0].Teams[0].Name)
+
+	teamTok, err = ds.GetVPPTokenByTeamID(ctx, nil)
+	assert.NoError(t, err)
+	assert.Equal(t, tokID, teamTok.ID)
+	assert.Equal(t, dataToken.Location, teamTok.Location)
+	assert.Equal(t, dataToken.Token, teamTok.Token)
+	assert.Equal(t, orgName, teamTok.OrgName)
+	assert.Equal(t, location, teamTok.Location)
+	assert.Len(t, teamTok.Teams, 1)
+	assert.Equal(t, uint(0), teamTok.Teams[0].ID)
+	assert.Equal(t, fleet.TeamNameNoTeam, teamTok.Teams[0].Name)
+
+	teamTok, err = ds.GetVPPTokenByTeamID(ctx, &team.ID)
+	assert.Error(t, err)
+	assert.True(t, fleet.IsNotFound(err))
+
+	// Assign to normal team
+	upTok, err = ds.UpdateVPPTokenTeams(ctx, tok.ID, []uint{team.ID})
+	assert.NoError(t, err)
+	assert.Len(t, upTok.Teams, 1)
+	assert.Equal(t, team.ID, upTok.Teams[0].ID)
+	assert.Equal(t, team.Name, upTok.Teams[0].Name)
+
+	tok, err = ds.GetVPPToken(ctx, tok.ID)
+	assert.NoError(t, err)
+	assert.Len(t, tok.Teams, 1)
+	assert.Equal(t, team.ID, tok.Teams[0].ID)
+	assert.Equal(t, team.Name, tok.Teams[0].Name)
+
+	toks, err = ds.ListVPPTokens(ctx)
+	assert.NoError(t, err)
+	assert.Len(t, toks, 1)
+	assert.Len(t, toks[0].Teams, 1)
+	assert.Equal(t, team.ID, toks[0].Teams[0].ID)
+	assert.Equal(t, team.Name, toks[0].Teams[0].Name)
+
+	teamTok, err = ds.GetVPPTokenByTeamID(ctx, nil)
+	assert.Error(t, err)
+	assert.True(t, fleet.IsNotFound(err))
+
+	teamTok, err = ds.GetVPPTokenByTeamID(ctx, &team.ID)
+	assert.NoError(t, err)
+	assert.Equal(t, tokID, teamTok.ID)
+	assert.Equal(t, dataToken.Location, teamTok.Location)
+	assert.Equal(t, dataToken.Token, teamTok.Token)
+	assert.Equal(t, orgName, teamTok.OrgName)
+	assert.Equal(t, location, teamTok.Location)
+	assert.NotNil(t, teamTok.Teams)
+	assert.Len(t, teamTok.Teams, 1)
+	assert.Equal(t, team.ID, teamTok.Teams[0].ID)
+	assert.Equal(t, team.Name, teamTok.Teams[0].Name)
+
+	// Renew flow
+	upTok, err = ds.UpdateVPPToken(ctx, tokID, dataToken6)
+	assert.NoError(t, err)
+	assert.Equal(t, tokID, upTok.ID)
+	assert.Equal(t, dataToken6.Location, upTok.Location)
+	assert.Equal(t, dataToken6.Token, upTok.Token)
+	assert.Equal(t, orgName6, upTok.OrgName)
+	assert.Equal(t, location6, upTok.Location)
+	assert.NotNil(t, upTok.Teams)
+	assert.Len(t, upTok.Teams, 1)
+	assert.Equal(t, team.ID, upTok.Teams[0].ID)
+	assert.Equal(t, team.Name, upTok.Teams[0].Name)
+
+	tok, err = ds.GetVPPToken(ctx, tok.ID)
+	assert.NoError(t, err)
+	assert.Equal(t, tokID, tok.ID)
+	assert.Equal(t, dataToken6.Location, tok.Location)
+	assert.Equal(t, dataToken6.Token, tok.Token)
+	assert.Equal(t, orgName6, tok.OrgName)
+	assert.Equal(t, location6, tok.Location)
+	assert.NotNil(t, tok.Teams)
+	assert.Len(t, tok.Teams, 1)
+	assert.Equal(t, team.ID, tok.Teams[0].ID)
+	assert.Equal(t, team.Name, tok.Teams[0].Name)
+
+	// Assign back to no team / disabled
+	upTok, err = ds.UpdateVPPTokenTeams(ctx, tokID, nil)
+	assert.NoError(t, err)
+	assert.Nil(t, upTok.Teams)
+
+	toks, err = ds.ListVPPTokens(ctx)
+	assert.NoError(t, err)
+	assert.Len(t, toks, 1)
+
+	teamTok, err = ds.GetVPPTokenByTeamID(ctx, &team.ID)
+	assert.Error(t, err)
+	assert.True(t, fleet.IsNotFound(err))
+
+	teamTok, err = ds.GetVPPTokenByTeamID(ctx, nil)
+	assert.Error(t, err)
+	assert.True(t, fleet.IsNotFound(err))
+
+	// Delete
+	err = ds.DeleteVPPToken(ctx, tokID)
+	assert.NoError(t, err)
+
+	toks, err = ds.ListVPPTokens(ctx)
+	assert.NoError(t, err)
+	assert.Len(t, toks, 0)
+
+	// Multiple tokens and constraints tests
+	tokNone, err := ds.InsertVPPToken(ctx, dataToken)
+	assert.NoError(t, err)
+	_, err = ds.UpdateVPPTokenTeams(ctx, tokNone.ID, nil)
+	assert.NoError(t, err)
+
+	toks, err = ds.ListVPPTokens(ctx)
+	assert.NoError(t, err)
+	assert.Len(t, toks, 1)
+
+	_, err = ds.InsertVPPToken(ctx, dataToken)
+	assert.Error(t, err)
+
+	tokAll, err := ds.InsertVPPToken(ctx, dataToken2)
+	assert.NoError(t, err)
+	_, err = ds.UpdateVPPTokenTeams(ctx, tokAll.ID, []uint{})
+	assert.NoError(t, err)
+	_, err = ds.UpdateVPPTokenTeams(ctx, tokAll.ID, []uint{})
+	assert.NoError(t, err)
+
+	toks, err = ds.ListVPPTokens(ctx)
+	assert.NoError(t, err)
+	assert.Len(t, toks, 2)
+
+	// Remove tokAll from All teams
+	tokAll, err = ds.UpdateVPPTokenTeams(ctx, tokAll.ID, nil)
+	assert.NoError(t, err)
+
+	tokTeam, err := ds.InsertVPPToken(ctx, dataToken3)
+	assert.NoError(t, err)
+
+	_, err = ds.UpdateVPPTokenTeams(ctx, tokTeam.ID, []uint{team.ID})
+	assert.NoError(t, err)
+	_, err = ds.UpdateVPPTokenTeams(ctx, tokTeam.ID, []uint{team.ID, team.ID})
+	assert.Error(t, err)
+
+	// Cannot move tokAll to all teams now
+	_, err = ds.UpdateVPPTokenTeams(ctx, tokAll.ID, []uint{})
+	assert.Error(t, err)
+
+	_, err = ds.UpdateVPPTokenTeams(ctx, tokTeam.ID, []uint{0})
+	assert.NoError(t, err)
+
+	_, err = ds.UpdateVPPTokenTeams(ctx, tokAll.ID, []uint{})
+	assert.Error(t, err)
+
+	_, err = ds.UpdateVPPTokenTeams(ctx, tokTeam.ID, []uint{team.ID})
+	assert.NoError(t, err)
+
+	///
+
+	toks, err = ds.ListVPPTokens(ctx)
+	assert.NoError(t, err)
+	assert.Len(t, toks, 3)
+
+	tokTeams, err := ds.InsertVPPToken(ctx, dataToken4)
+	assert.NoError(t, err)
+	_, err = ds.UpdateVPPTokenTeams(ctx, tokTeams.ID, []uint{team.ID, team2.ID})
+	assert.Error(t, err)
+	_, err = ds.UpdateVPPTokenTeams(ctx, tokTeams.ID, []uint{team2.ID})
+	assert.NoError(t, err)
+	_, err = ds.UpdateVPPTokenTeams(ctx, tokTeams.ID, []uint{team.ID, team2.ID})
+	assert.Error(t, err)
+	_, err = ds.UpdateVPPTokenTeams(ctx, tokTeams.ID, []uint{team.ID, 0})
+	assert.Error(t, err)
+	_, err = ds.UpdateVPPTokenTeams(ctx, tokTeams.ID, []uint{team2.ID, 0})
+	assert.NoError(t, err)
+
+	toks, err = ds.ListVPPTokens(ctx)
+	assert.NoError(t, err)
+	assert.Len(t, toks, 4)
+
+	tokTeams, err = ds.GetVPPToken(ctx, tokTeams.ID)
+	assert.NoError(t, err)
+	assert.Len(t, tokTeams.Teams, 2)
+	assert.Contains(t, tokTeams.Teams, fleet.TeamTuple{ID: team2.ID, Name: team2.Name})
+	assert.Contains(t, tokTeams.Teams, fleet.TeamTuple{ID: 0, Name: fleet.TeamNameNoTeam})
+
+	tokBadConstraint, err := ds.InsertVPPToken(ctx, dataToken5)
+	assert.NoError(t, err)
+	_, err = ds.UpdateVPPTokenTeams(ctx, tokBadConstraint.ID, []uint{})
+	assert.Error(t, err)
+	_, err = ds.UpdateVPPTokenTeams(ctx, tokBadConstraint.ID, []uint{team.ID})
+	assert.Error(t, err)
+	assert.ErrorContains(t, err, "\"Kritters\" team already has a VPP token.")
+	_, err = ds.UpdateVPPTokenTeams(ctx, tokBadConstraint.ID, []uint{0})
+	assert.Error(t, err)
+	assert.ErrorContains(t, err, "\"No team\" team already has a VPP token.")
+
+	toks, err = ds.ListVPPTokens(ctx)
+	assert.NoError(t, err)
+	assert.Len(t, toks, 5)
+
+	///
+	tokNil, err := ds.GetVPPTokenByTeamID(ctx, nil)
+	assert.NoError(t, err)
+	assert.Equal(t, tokTeams.ID, tokNil.ID)
+
+	tokTeam1, err := ds.GetVPPTokenByTeamID(ctx, &team.ID)
+	assert.NoError(t, err)
+	assert.Equal(t, tokTeam.ID, tokTeam1.ID)
+
+	tokTeam2, err := ds.GetVPPTokenByTeamID(ctx, &team2.ID)
+	assert.NoError(t, err)
+	assert.Equal(t, tokTeam2.ID, tokTeam2.ID)
+	assert.Len(t, tokTeam2.Teams, 2)
+	assert.Contains(t, tokTeam2.Teams, fleet.TeamTuple{ID: team2.ID, Name: team2.Name})
+	assert.Contains(t, tokTeam2.Teams, fleet.TeamTuple{ID: 0, Name: fleet.TeamNameNoTeam})
+
+	////
+	err = ds.DeleteVPPToken(ctx, tokTeam.ID)
+	assert.NoError(t, err)
+
+	tokNil, err = ds.GetVPPTokenByTeamID(ctx, nil)
+	assert.NoError(t, err)
+	assert.Equal(t, tokTeams.ID, tokNil.ID)
+
+	tokTeam1, err = ds.GetVPPTokenByTeamID(ctx, &team.ID)
+	assert.Error(t, err)
+
+	tokTeam2, err = ds.GetVPPTokenByTeamID(ctx, &team2.ID)
+	assert.NoError(t, err)
+	assert.Equal(t, tokTeams.ID, tokTeam2.ID)
+
+	////
+	err = ds.DeleteVPPToken(ctx, tokTeams.ID)
+	assert.NoError(t, err)
+
+	tokNil, err = ds.GetVPPTokenByTeamID(ctx, nil)
+	assert.Error(t, err)
+	assert.True(t, fleet.IsNotFound(err))
+
+	tokTeam1, err = ds.GetVPPTokenByTeamID(ctx, &team.ID)
+	assert.Error(t, err)
+	assert.True(t, fleet.IsNotFound(err))
+
+	tokTeam2, err = ds.GetVPPTokenByTeamID(ctx, &team2.ID)
+	assert.Error(t, err)
+	assert.True(t, fleet.IsNotFound(err))
+
+	////
+	tokAll, err = ds.UpdateVPPTokenTeams(ctx, tokAll.ID, []uint{})
+	assert.NoError(t, err)
+
+	tokNil, err = ds.GetVPPTokenByTeamID(ctx, nil)
+	assert.NoError(t, err)
+	assert.Equal(t, tokAll.ID, tokNil.ID)
+
+	tokTeam1, err = ds.GetVPPTokenByTeamID(ctx, &team.ID)
+	assert.NoError(t, err)
+	assert.Equal(t, tokAll.ID, tokTeam1.ID)
+
+	tokTeam2, err = ds.GetVPPTokenByTeamID(ctx, &team2.ID)
+	assert.NoError(t, err)
+	assert.Equal(t, tokAll.ID, tokTeam2.ID)
+
+	err = ds.DeleteVPPToken(ctx, tokAll.ID)
+	assert.NoError(t, err)
+
+	////
+	_, err = ds.UpdateVPPTokenTeams(ctx, tokNone.ID, []uint{0, team.ID, team2.ID})
+	assert.NoError(t, err)
+
+	tokNil, err = ds.GetVPPTokenByTeamID(ctx, nil)
+	assert.NoError(t, err)
+	assert.Equal(t, tokNone.ID, tokNil.ID)
+
+	tokTeam1, err = ds.GetVPPTokenByTeamID(ctx, &team.ID)
+	assert.NoError(t, err)
+	assert.Equal(t, tokNone.ID, tokTeam1.ID)
+
+	tokTeam2, err = ds.GetVPPTokenByTeamID(ctx, &team2.ID)
+	assert.NoError(t, err)
+	assert.Equal(t, tokNone.ID, tokTeam2.ID)
+
+	////
+	err = ds.DeleteVPPToken(ctx, tokNone.ID)
+	assert.NoError(t, err)
+
+}
+
+func testVPPTokenAppTeamAssociations(t *testing.T, ds *Datastore) {
+	ctx := context.Background()
+
+	team1, err := ds.NewTeam(ctx, &fleet.Team{Name: "Kritters"})
+	assert.NoError(t, err)
+
+	team2, err := ds.NewTeam(ctx, &fleet.Team{Name: "Zingers"})
+	assert.NoError(t, err)
+
+	dataToken, err := test.CreateVPPTokenData(time.Now().Add(24*time.Hour), "Donkey Kong", "Jungle")
+	require.NoError(t, err)
+
+	dataToken2, err := test.CreateVPPTokenData(time.Now().Add(24*time.Hour), "Diddy Kong", "Mines")
+	require.NoError(t, err)
+
+	tok1, err := ds.InsertVPPToken(ctx, dataToken)
+	assert.NoError(t, err)
+
+	tok2, err := ds.InsertVPPToken(ctx, dataToken2)
+	assert.NoError(t, err)
+
+	_, err = ds.UpdateVPPTokenTeams(ctx, tok1.ID, []uint{team1.ID})
+	assert.NoError(t, err)
+
+	_, err = ds.UpdateVPPTokenTeams(ctx, tok2.ID, []uint{team2.ID})
+	assert.NoError(t, err)
+
+	app1 := &fleet.VPPApp{
+		Name: "app1",
+		VPPAppTeam: fleet.VPPAppTeam{
+			VPPAppID: fleet.VPPAppID{
+				AdamID:   "1",
+				Platform: fleet.MacOSPlatform,
+			},
+		},
+		BundleIdentifier: "app1",
+	}
+	_, err = ds.InsertVPPAppWithTeam(ctx, app1, &team1.ID)
+	assert.NoError(t, err)
+	_, err = ds.InsertVPPAppWithTeam(ctx, app1, &team2.ID)
+	assert.NoError(t, err)
+
+	app2 := &fleet.VPPApp{
+		Name: "app2",
+		VPPAppTeam: fleet.VPPAppTeam{
+			VPPAppID: fleet.VPPAppID{
+				AdamID:   "2",
+				Platform: fleet.MacOSPlatform,
+			},
+		},
+		BundleIdentifier: "app2",
+	}
+	vppApp2, err := ds.InsertVPPAppWithTeam(ctx, app2, &team1.ID)
+	_ = vppApp2
+	assert.NoError(t, err)
+
+	// team1: token 1, app1, app2
+	// team2: token 2, app 1
+
+	apps, err := ds.GetAssignedVPPApps(ctx, &team1.ID)
+	assert.NoError(t, err)
+	assert.Len(t, apps, 2)
+	assert.Contains(t, apps, app1.VPPAppID)
+	assert.Contains(t, apps, app2.VPPAppID)
+
+	apps, err = ds.GetAssignedVPPApps(ctx, &team2.ID)
+	assert.NoError(t, err)
+	assert.Len(t, apps, 1)
+	assert.Contains(t, apps, app1.VPPAppID)
+
+	/// Try to move team 1 token to team 2
+
+	_, err = ds.UpdateVPPTokenTeams(ctx, tok1.ID, []uint{team2.ID})
+	assert.Error(t, err)
+
+	// team1: token 1, app1, app2
+	// team2: token 2, app 1
+
+	apps, err = ds.GetAssignedVPPApps(ctx, &team1.ID)
+	assert.NoError(t, err)
+	assert.Len(t, apps, 2)
+
+	apps, err = ds.GetAssignedVPPApps(ctx, &team2.ID)
+	assert.NoError(t, err)
+	assert.Len(t, apps, 1)
+	assert.Contains(t, apps, app1.VPPAppID)
+
+	_, err = ds.UpdateVPPTokenTeams(ctx, tok1.ID, nil)
+	assert.NoError(t, err)
+
+	// team1: no token, no apps
+	// team2: token 2, app 1
+
+	apps, err = ds.GetAssignedVPPApps(ctx, &team1.ID)
+	assert.NoError(t, err)
+	assert.Len(t, apps, 0)
+
+	apps, err = ds.GetAssignedVPPApps(ctx, &team2.ID)
+	assert.NoError(t, err)
+	assert.Len(t, apps, 1)
+	assert.Contains(t, apps, app1.VPPAppID)
+
+	// Move team 2 token to team 1
+
+	_, err = ds.UpdateVPPTokenTeams(ctx, tok2.ID, []uint{team1.ID})
+	assert.NoError(t, err)
+
+	// team1: token 2, app 1
+	// team2: no token, no apps
+
+	apps, err = ds.GetAssignedVPPApps(ctx, &team1.ID)
+	assert.NoError(t, err)
+	assert.Len(t, apps, 0)
+
+	apps, err = ds.GetAssignedVPPApps(ctx, &team2.ID)
+	assert.NoError(t, err)
+	assert.Len(t, apps, 0)
+
+	/// Can't assaign apps with no token
+
+	_, err = ds.InsertVPPAppWithTeam(ctx, app1, &team2.ID)
+	assert.Error(t, err)
+}
diff --git a/server/datastore/mysql/vulnerabilities.go b/server/datastore/mysql/vulnerabilities.go
index db63bac01b..81a26ea58b 100644
--- a/server/datastore/mysql/vulnerabilities.go
+++ b/server/datastore/mysql/vulnerabilities.go
@@ -3,6 +3,7 @@ package mysql
 import (
 	"context"
 	"database/sql"
+	"errors"
 	"fmt"
 	"strings"
 	"time"
@@ -496,3 +497,12 @@ func (ds *Datastore) batchInsertHostCounts(ctx context.Context, counts []hostCou
 
 	return nil
 }
+
+func (ds *Datastore) IsCVEKnownToFleet(ctx context.Context, cve string) (bool, error) {
+	var count uint
+	err := sqlx.GetContext(ctx, ds.reader(ctx), &count, "SELECT 1 FROM cve_meta WHERE cve = ?", cve)
+	if err != nil && !errors.Is(err, sql.ErrNoRows) {
+		return false, err
+	}
+	return count > 0, nil
+}
diff --git a/server/datastore/s3/bootstrap_package.go b/server/datastore/s3/bootstrap_package.go
new file mode 100644
index 0000000000..28a41f51ef
--- /dev/null
+++ b/server/datastore/s3/bootstrap_package.go
@@ -0,0 +1,25 @@
+package s3
+
+import "github.com/fleetdm/fleet/v4/server/config"
+
+const bootstrapPackagePrefix = "bootstrap-packages"
+
+type BootstrapPackageStore struct {
+	*commonFileStore
+}
+
+// NewBootstrapPackageStore creates a new instance with the given S3 config.
+func NewBootstrapPackageStore(config config.S3Config) (*BootstrapPackageStore, error) {
+	// bootstrap packages use the same S3 config as software installers
+	s3store, err := newS3store(config.SoftwareInstallersToInternalCfg())
+	if err != nil {
+		return nil, err
+	}
+	return &BootstrapPackageStore{
+		&commonFileStore{
+			s3store:    s3store,
+			pathPrefix: bootstrapPackagePrefix,
+			fileLabel:  "bootstrap package",
+		},
+	}, nil
+}
diff --git a/server/datastore/s3/bootstrap_package_test.go b/server/datastore/s3/bootstrap_package_test.go
new file mode 100644
index 0000000000..11c4b1fe61
--- /dev/null
+++ b/server/datastore/s3/bootstrap_package_test.go
@@ -0,0 +1,149 @@
+package s3
+
+import (
+	"bytes"
+	"context"
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	"io"
+	"path"
+	"testing"
+	"time"
+
+	"github.com/aws/aws-sdk-go/service/s3"
+	"github.com/fleetdm/fleet/v4/server/fleet"
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/require"
+)
+
+func TestBootstrapPackage(t *testing.T) {
+	ctx := context.Background()
+	store := SetupTestBootstrapPackageStore(t, "bootstrap-packages-unit-test", "prefix")
+
+	// get a non-existing package
+	blob, length, err := store.Get(ctx, "no-such-package")
+	require.Error(t, err)
+	require.True(t, fleet.IsNotFound(err))
+	require.Nil(t, blob)
+	require.Zero(t, length)
+
+	exists, err := store.Exists(ctx, "no-such-package")
+	require.NoError(t, err)
+	require.False(t, exists)
+
+	createPackageAndHash := func() ([]byte, string) {
+		b := make([]byte, 1024)
+		_, err = rand.Read(b)
+		require.NoError(t, err)
+
+		h := sha256.New()
+		_, err = h.Write(b)
+		require.NoError(t, err)
+		fileID := hex.EncodeToString(h.Sum(nil))
+
+		return b, fileID
+	}
+
+	getAndCheck := func(fileID string, expected []byte) {
+		rc, sz, err := store.Get(ctx, fileID)
+		require.NoError(t, err)
+		require.EqualValues(t, len(expected), sz)
+		defer rc.Close()
+
+		got, err := io.ReadAll(rc)
+		require.NoError(t, err)
+		require.Equal(t, expected, got)
+
+		exists, err := store.Exists(ctx, fileID)
+		require.NoError(t, err)
+		require.True(t, exists)
+	}
+
+	// store a package
+	b0, id0 := createPackageAndHash()
+	err = store.Put(ctx, id0, bytes.NewReader(b0))
+	require.NoError(t, err)
+
+	// read it back, it should match
+	getAndCheck(id0, b0)
+
+	// store another one
+	b1, id1 := createPackageAndHash()
+	err = store.Put(ctx, id1, bytes.NewReader(b1))
+	require.NoError(t, err)
+
+	// read it back, it should match
+	getAndCheck(id1, b1)
+
+	// replace the first one
+	err = store.Put(ctx, id0, bytes.NewReader(b0))
+	require.NoError(t, err)
+
+	// read it back, it should still match
+	getAndCheck(id0, b0)
+}
+
+func TestBootstrapPackageCleanup(t *testing.T) {
+	ctx := context.Background()
+	store := SetupTestBootstrapPackageStore(t, "bootstrap-packages-unit-test", "prefix")
+
+	assertExisting := func(want []string) {
+		prefix := path.Join(store.prefix, bootstrapPackagePrefix)
+		page, err := store.s3client.ListObjectsV2(&s3.ListObjectsV2Input{
+			Bucket: &store.bucket,
+			Prefix: &prefix,
+		})
+		require.NoError(t, err)
+
+		got := make([]string, 0, len(page.Contents))
+		for _, item := range page.Contents {
+			got = append(got, path.Base(*item.Key))
+		}
+		require.ElementsMatch(t, want, got)
+	}
+
+	// cleanup an empty store
+	n, err := store.Cleanup(ctx, nil, time.Now())
+	require.NoError(t, err)
+	require.Equal(t, 0, n)
+
+	// put a package
+	ins0 := uuid.NewString()
+	err = store.Put(ctx, ins0, bytes.NewReader([]byte("package0")))
+	require.NoError(t, err)
+
+	// cleanup but mark it as used
+	n, err = store.Cleanup(ctx, []string{ins0}, time.Now())
+	require.NoError(t, err)
+	require.Equal(t, 0, n)
+
+	assertExisting([]string{ins0})
+
+	// cleanup but mark it as unused
+	n, err = store.Cleanup(ctx, []string{}, time.Now())
+	require.NoError(t, err)
+	require.Equal(t, 1, n)
+
+	assertExisting(nil)
+
+	// put a few packages
+	packages := []string{uuid.NewString(), uuid.NewString(), uuid.NewString(), uuid.NewString()}
+	for i, ins := range packages {
+		err = store.Put(ctx, ins, bytes.NewReader([]byte("package"+fmt.Sprint(i))))
+		require.NoError(t, err)
+	}
+
+	// cleanup with a time in the past, nothing gets removed
+	n, err = store.Cleanup(ctx, []string{}, time.Now().Add(-time.Minute))
+	require.NoError(t, err)
+	require.Equal(t, 0, n)
+	assertExisting([]string{packages[0], packages[1], packages[2], packages[3]})
+
+	// cleanup in the future, all unused get removed
+	n, err = store.Cleanup(ctx, []string{packages[0], packages[2]}, time.Now().Add(time.Minute))
+	require.NoError(t, err)
+	require.Equal(t, 2, n)
+	assertExisting([]string{packages[0], packages[2]})
+}
diff --git a/server/datastore/s3/common_file_store.go b/server/datastore/s3/common_file_store.go
new file mode 100644
index 0000000000..2a37c741a3
--- /dev/null
+++ b/server/datastore/s3/common_file_store.go
@@ -0,0 +1,140 @@
+package s3
+
+import (
+	"context"
+	"errors"
+	"io"
+	"path"
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/service/s3"
+	"github.com/fleetdm/fleet/v4/server/contexts/ctxerr"
+)
+
+// commonFileStore implements the common Get, Put, Exists and Cleanup
+// operations typical for storage of files in the SoftwareInstallers S3 bucket
+// configuration. It is used by the SoftwareInstallerStore and the
+// BootstrapPackageStore. The only variable thing is the path prefix inside
+// the configured bucket, e.g. for software installers it is:
+//
+//	<bucket>/<prefix>/software-installers/<fileID>
+//
+// and for the bootstrap packages it is:
+//
+//	<bucket>/<prefix>/bootstrap-packages/<fileID>
+type commonFileStore struct {
+	*s3store
+	pathPrefix string
+	fileLabel  string // how to call the file in error messages
+}
+
+// Get retrieves the requested file from S3.
+// It is important that the caller closes the reader when done.
+func (s *commonFileStore) Get(ctx context.Context, fileID string) (io.ReadCloser, int64, error) {
+	key := s.keyForFile(fileID)
+
+	req, err := s.s3client.GetObject(&s3.GetObjectInput{Bucket: &s.bucket, Key: &key})
+	if err != nil {
+		if aerr, ok := err.(awserr.Error); ok {
+			switch aerr.Code() {
+			case s3.ErrCodeNoSuchKey, s3.ErrCodeNoSuchBucket, "NotFound":
+				return nil, int64(0), installerNotFoundError{}
+			}
+		}
+		return nil, int64(0), ctxerr.Wrapf(ctx, err, "retrieving %s from S3 store", s.fileLabel)
+	}
+	return req.Body, *req.ContentLength, nil
+}
+
+// Put uploads a file to S3.
+func (s *commonFileStore) Put(ctx context.Context, fileID string, content io.ReadSeeker) error {
+	if fileID == "" {
+		return errors.New("S3 file identifier is empty")
+	}
+
+	key := s.keyForFile(fileID)
+	_, err := s.s3client.PutObject(&s3.PutObjectInput{
+		Bucket: &s.bucket,
+		Body:   content,
+		Key:    &key,
+	})
+	return err
+}
+
+// Exists checks if a file exists in the S3 bucket for the ID.
+func (s *commonFileStore) Exists(ctx context.Context, fileID string) (bool, error) {
+	key := s.keyForFile(fileID)
+
+	_, err := s.s3client.HeadObject(&s3.HeadObjectInput{Bucket: &s.bucket, Key: &key})
+	if err != nil {
+		if aerr, ok := err.(awserr.Error); ok {
+			switch aerr.Code() {
+			case s3.ErrCodeNoSuchKey, s3.ErrCodeNoSuchBucket, "NotFound":
+				return false, nil
+			}
+		}
+		return false, ctxerr.Wrapf(ctx, err, "checking existence of %s in S3 store", s.fileLabel)
+	}
+	return true, nil
+}
+
+func (s *commonFileStore) Cleanup(ctx context.Context, usedFileIDs []string, removeCreatedBefore time.Time) (int, error) {
+	removeCreatedBefore = removeCreatedBefore.UTC()
+
+	usedSet := make(map[string]struct{}, len(usedFileIDs))
+	for _, id := range usedFileIDs {
+		usedSet[id] = struct{}{}
+	}
+
+	// ListObjectsV2 defaults to a max of 1000 keys, which is sufficient for the
+	// cleanup task - if more files are present, the next run will get another
+	// 1000 and will periodically complete the cleanups.
+	//
+	// Iterating over all pages would potentially take a long time and would make
+	// it more likely that a conflict arises, where an unused file becomes used
+	// again. This approach makes it only two API requests between the read of
+	// used files and the deletions.
+	prefix := path.Join(s.prefix, s.pathPrefix)
+	page, err := s.s3client.ListObjectsV2(&s3.ListObjectsV2Input{
+		Bucket: &s.bucket,
+		Prefix: &prefix,
+	})
+	if err != nil {
+		return 0, ctxerr.Wrapf(ctx, err, "listing %s in S3 store", s.fileLabel)
+	}
+
+	// NOTE: there is an inherent risk that we could delete files that were added
+	// between the query to list used IDs and now. We minimize that risk by
+	// checking that the S3 file was created before removeCreatedBefore.
+	var toDeleteKeys []*s3.ObjectIdentifier
+	for _, item := range page.Contents {
+		if item.Key == nil {
+			continue
+		}
+		if _, ok := usedSet[path.Base(*item.Key)]; ok {
+			continue
+		}
+		if item.LastModified == nil || !item.LastModified.UTC().After(removeCreatedBefore) {
+			// default to doing the cleanup if we don't have the timestamp information
+			toDeleteKeys = append(toDeleteKeys, &s3.ObjectIdentifier{Key: item.Key})
+		}
+	}
+
+	if len(toDeleteKeys) == 0 {
+		return 0, nil
+	}
+
+	res, err := s.s3client.DeleteObjects(&s3.DeleteObjectsInput{
+		Bucket: &s.bucket,
+		Delete: &s3.Delete{
+			Objects: toDeleteKeys,
+		},
+	})
+	return len(res.Deleted), ctxerr.Wrapf(ctx, err, "deleting %s in S3 store", s.fileLabel)
+}
+
+// keyForFile builds an S3 key to identify the file.
+func (s *commonFileStore) keyForFile(fileID string) string {
+	return path.Join(s.prefix, s.pathPrefix, fileID)
+}
diff --git a/server/datastore/s3/software_installer.go b/server/datastore/s3/software_installer.go
index 5b33d10127..03b390a5c1 100644
--- a/server/datastore/s3/software_installer.go
+++ b/server/datastore/s3/software_installer.go
@@ -1,22 +1,13 @@
 package s3
 
 import (
-	"context"
-	"io"
-	"path"
-
-	"github.com/aws/aws-sdk-go/aws/awserr"
-	"github.com/aws/aws-sdk-go/service/s3"
 	"github.com/fleetdm/fleet/v4/server/config"
-	"github.com/fleetdm/fleet/v4/server/contexts/ctxerr"
 )
 
 const softwareInstallersPrefix = "software-installers"
 
-// SoftwareInstallerStore implements the fleet.SoftwareInstallerStore to store
-// and retrieve software installers from S3.
 type SoftwareInstallerStore struct {
-	*s3store
+	*commonFileStore
 }
 
 // NewSoftwareInstallerStore creates a new instance with the given S3 config.
@@ -25,103 +16,11 @@ func NewSoftwareInstallerStore(config config.S3Config) (*SoftwareInstallerStore,
 	if err != nil {
 		return nil, err
 	}
-	return &SoftwareInstallerStore{s3store}, nil
-}
-
-// Get retrieves the requested software installer from S3.
-// It is important that the caller closes the reader when done.
-func (i *SoftwareInstallerStore) Get(ctx context.Context, installerID string) (io.ReadCloser, int64, error) {
-	key := i.keyForInstaller(installerID)
-
-	req, err := i.s3client.GetObject(&s3.GetObjectInput{Bucket: &i.bucket, Key: &key})
-	if err != nil {
-		if aerr, ok := err.(awserr.Error); ok {
-			switch aerr.Code() {
-			case s3.ErrCodeNoSuchKey, s3.ErrCodeNoSuchBucket, "NotFound":
-				return nil, int64(0), installerNotFoundError{}
-			}
-		}
-		return nil, int64(0), ctxerr.Wrap(ctx, err, "retrieving software installer from S3 store")
-	}
-	return req.Body, *req.ContentLength, nil
-}
-
-// Put uploads a software installer to S3.
-func (i *SoftwareInstallerStore) Put(ctx context.Context, installerID string, content io.ReadSeeker) error {
-	key := i.keyForInstaller(installerID)
-	_, err := i.s3client.PutObject(&s3.PutObjectInput{
-		Bucket: &i.bucket,
-		Body:   content,
-		Key:    &key,
-	})
-	return err
-}
-
-// Exists checks if a software installer exists in the S3 bucket for the ID.
-func (i *SoftwareInstallerStore) Exists(ctx context.Context, installerID string) (bool, error) {
-	key := i.keyForInstaller(installerID)
-
-	_, err := i.s3client.HeadObject(&s3.HeadObjectInput{Bucket: &i.bucket, Key: &key})
-	if err != nil {
-		if aerr, ok := err.(awserr.Error); ok {
-			switch aerr.Code() {
-			case s3.ErrCodeNoSuchKey, s3.ErrCodeNoSuchBucket, "NotFound":
-				return false, nil
-			}
-		}
-		return false, ctxerr.Wrap(ctx, err, "checking existence of software installer in S3 store")
-	}
-	return true, nil
-}
-
-func (i *SoftwareInstallerStore) Cleanup(ctx context.Context, usedInstallerIDs []string) (int, error) {
-	usedSet := make(map[string]struct{}, len(usedInstallerIDs))
-	for _, id := range usedInstallerIDs {
-		usedSet[id] = struct{}{}
-	}
-
-	// ListObjectsV2 defaults to a max of 1000 keys, which is sufficient for the
-	// cleanup task - if more software installers are present, the next run will
-	// get another 1000 and will periodically complete the cleanups.
-	//
-	// Iterating over all pages would potentially take a long time and would make
-	// it more likely that a conflict arises, where an unused software installer
-	// becomes used again. This approach makes it only two API requests between
-	// the read of used installers and the deletions.
-	prefix := path.Join(i.prefix, softwareInstallersPrefix)
-	page, err := i.s3client.ListObjectsV2(&s3.ListObjectsV2Input{
-		Bucket: &i.bucket,
-		Prefix: &prefix,
-	})
-	if err != nil {
-		return 0, ctxerr.Wrap(ctx, err, "listing software installers in S3 store")
-	}
-
-	var toDeleteKeys []*s3.ObjectIdentifier
-	for _, item := range page.Contents {
-		if item.Key == nil {
-			continue
-		}
-		if _, ok := usedSet[path.Base(*item.Key)]; ok {
-			continue
-		}
-		toDeleteKeys = append(toDeleteKeys, &s3.ObjectIdentifier{Key: item.Key})
-	}
-
-	if len(toDeleteKeys) == 0 {
-		return 0, nil
-	}
-
-	res, err := i.s3client.DeleteObjects(&s3.DeleteObjectsInput{
-		Bucket: &i.bucket,
-		Delete: &s3.Delete{
-			Objects: toDeleteKeys,
+	return &SoftwareInstallerStore{
+		&commonFileStore{
+			s3store:    s3store,
+			pathPrefix: softwareInstallersPrefix,
+			fileLabel:  "software installer",
 		},
-	})
-	return len(res.Deleted), ctxerr.Wrap(ctx, err, "deleting software installers in S3 store")
-}
-
-// keyForInstaller builds an S3 key to identify the software installer.
-func (i *SoftwareInstallerStore) keyForInstaller(installerID string) string {
-	return path.Join(i.prefix, softwareInstallersPrefix, installerID)
+	}, nil
 }
diff --git a/server/datastore/s3/software_installer_test.go b/server/datastore/s3/software_installer_test.go
index 9292a6ed7a..f049121468 100644
--- a/server/datastore/s3/software_installer_test.go
+++ b/server/datastore/s3/software_installer_test.go
@@ -10,6 +10,7 @@ import (
 	"io"
 	"path"
 	"testing"
+	"time"
 
 	"github.com/aws/aws-sdk-go/service/s3"
 	"github.com/fleetdm/fleet/v4/server/fleet"
@@ -104,7 +105,7 @@ func TestSoftwareInstallerCleanup(t *testing.T) {
 	}
 
 	// cleanup an empty store
-	n, err := store.Cleanup(ctx, nil)
+	n, err := store.Cleanup(ctx, nil, time.Now())
 	require.NoError(t, err)
 	require.Equal(t, 0, n)
 
@@ -114,14 +115,14 @@ func TestSoftwareInstallerCleanup(t *testing.T) {
 	require.NoError(t, err)
 
 	// cleanup but mark it as used
-	n, err = store.Cleanup(ctx, []string{ins0})
+	n, err = store.Cleanup(ctx, []string{ins0}, time.Now())
 	require.NoError(t, err)
 	require.Equal(t, 0, n)
 
 	assertExisting([]string{ins0})
 
 	// cleanup but mark it as unused
-	n, err = store.Cleanup(ctx, []string{})
+	n, err = store.Cleanup(ctx, []string{}, time.Now())
 	require.NoError(t, err)
 	require.Equal(t, 1, n)
 
@@ -134,9 +135,15 @@ func TestSoftwareInstallerCleanup(t *testing.T) {
 		require.NoError(t, err)
 	}
 
-	n, err = store.Cleanup(ctx, []string{installers[0], installers[2]})
+	// cleanup with a time in the past, nothing gets removed
+	n, err = store.Cleanup(ctx, []string{}, time.Now().Add(-time.Minute))
+	require.NoError(t, err)
+	require.Equal(t, 0, n)
+	assertExisting([]string{installers[0], installers[1], installers[2], installers[3]})
+
+	// cleanup in the future, all unused get removed
+	n, err = store.Cleanup(ctx, []string{installers[0], installers[2]}, time.Now().Add(time.Minute))
 	require.NoError(t, err)
 	require.Equal(t, 2, n)
-
 	assertExisting([]string{installers[0], installers[2]})
 }
diff --git a/server/datastore/s3/testing_utils.go b/server/datastore/s3/testing_utils.go
index 7854d3b34f..76366031a0 100644
--- a/server/datastore/s3/testing_utils.go
+++ b/server/datastore/s3/testing_utils.go
@@ -7,6 +7,7 @@ import (
 	"testing"
 
 	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
 	"github.com/aws/aws-sdk-go/service/s3"
 	"github.com/fleetdm/fleet/v4/server/config"
 	"github.com/fleetdm/fleet/v4/server/fleet"
@@ -26,6 +27,12 @@ func SetupTestSoftwareInstallerStore(tb testing.TB, bucket, prefix string) *Soft
 	return store
 }
 
+func SetupTestBootstrapPackageStore(tb testing.TB, bucket, prefix string) *BootstrapPackageStore {
+	store := setupTestStore(tb, bucket, prefix, NewBootstrapPackageStore)
+	tb.Cleanup(func() { cleanupStore(tb, store.s3store) })
+	return store
+}
+
 // SetupTestInstallerStore creates a new store with minio as a back-end
 // for local testing
 func SetupTestInstallerStore(tb testing.TB, bucket, prefix string) *InstallerStore {
@@ -105,6 +112,12 @@ func cleanupStore(tb testing.TB, store *s3store) {
 	resp, err := store.s3client.ListObjects(&s3.ListObjectsInput{
 		Bucket: &store.bucket,
 	})
+	if aerr, ok := err.(awserr.Error); ok {
+		if aerr.Code() == s3.ErrCodeNoSuchBucket {
+			// fine, nothing to clean-up if the bucket no longer exists, no error
+			return
+		}
+	}
 	require.NoError(tb, err)
 
 	var objs []*s3.ObjectIdentifier
diff --git a/server/docs/patterns.md b/server/docs/patterns.md
new file mode 100644
index 0000000000..2249b447dd
--- /dev/null
+++ b/server/docs/patterns.md
@@ -0,0 +1,32 @@
+# Backend patterns
+
+The backend software patterns that we follow in Fleet.
+
+> NOTE: There are always exceptions to the rules, but we try to follow these patterns as much as possible unless a specific use case calls
+> for something else. These should be discussed within the team and documented before merging.
+
+## MySQL
+
+Use high precision for all time fields. Precise timestamps make sure that we can accurately track when records were created and updated,
+keep records in order with a reliable sort, and speed up testing by not having to wait for the time to
+update. [MySQL reference](https://dev.mysql.com/doc/refman/8.4/en/date-and-time-type-syntax.html). [Backend sync where discussed](https://us-65885.app.gong.io/call?id=8041045095900447703).
+Example:
+
+```sql
+CREATE TABLE `sample` (
+  `id` INT UNSIGNED NOT NULL AUTO_INCREMENT,
+  `created_at` TIMESTAMP(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6),
+  `updated_at` TIMESTAMP(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6) ON UPDATE CURRENT_TIMESTAMP(6),
+  PRIMARY KEY (`id`)
+);
+```
+
+Do not use [goqu](https://github.com/doug-martin/goqu); use MySQL queries directly. Searching for, understanding, and debugging direct MySQL
+queries is easier. If needing to modify an existing `goqu` query, try to rewrite it in
+MySQL. [Backend sync where discussed](https://us-65885.app.gong.io/call?id=8041045095900447703).
+
+### Data retention
+
+Sometimes we need data from rows that have been deleted from DB. For example, the activity feed may be retained forever, and it needs user info (or host info) that may not exist anymore.
+Going forward, we need to keep this data in a dedicated table(s). A reference unmerged PR is [here](https://github.com/fleetdm/fleet/pull/17472/files#diff-57a635e42320a87dd15a3ae03d66834f2cbc4fcdb5f3ebb7075d966b96f760afR16).
+The `id` may be the same as that of the original table. For example, if the `user` row is deleted, a new entry with the same `user.id` can be added to `user_persistent_info`.
diff --git a/server/fleet/activities.go b/server/fleet/activities.go
index ccaf96d51e..373aa5b720 100644
--- a/server/fleet/activities.go
+++ b/server/fleet/activities.go
@@ -5,7 +5,7 @@ import (
 	"encoding/json"
 )
 
-//go:generate go run gen_activity_doc.go "../../docs/Using Fleet/Audit-logs.md"
+//go:generate go run gen_activity_doc.go "../../docs/Contributing/Audit-logs.md"
 
 type ContextKey string
 
@@ -99,7 +99,9 @@ var ActivityDetailsList = []ActivityDetails{
 	ActivityTypeResentConfigurationProfile{},
 
 	ActivityTypeInstalledSoftware{},
+	ActivityTypeUninstalledSoftware{},
 	ActivityTypeAddedSoftware{},
+	ActivityTypeEditedSoftware{},
 	ActivityTypeDeletedSoftware{},
 	ActivityEnabledVPP{},
 	ActivityDisabledVPP{},
@@ -1521,6 +1523,38 @@ func (a ActivityTypeInstalledSoftware) Documentation() (activity, details, detai
 }`
 }
 
+type ActivityTypeUninstalledSoftware struct {
+	HostID          uint   `json:"host_id"`
+	HostDisplayName string `json:"host_display_name"`
+	SoftwareTitle   string `json:"software_title"`
+	ExecutionID     string `json:"script_execution_id"`
+	Status          string `json:"status"`
+}
+
+func (a ActivityTypeUninstalledSoftware) ActivityName() string {
+	return "uninstalled_software"
+}
+
+func (a ActivityTypeUninstalledSoftware) HostIDs() []uint {
+	return []uint{a.HostID}
+}
+
+func (a ActivityTypeUninstalledSoftware) Documentation() (activity, details, detailsExample string) {
+	return `Generated when a software is uninstalled on a host.`,
+		`This activity contains the following fields:
+- "host_id": ID of the host.
+- "host_display_name": Display name of the host.
+- "software_title": Name of the software.
+- "script_execution_id": ID of the software uninstall script.
+- "status": Status of the software uninstallation.`, `{
+  "host_id": 1,
+  "host_display_name": "Anna's MacBook Pro",
+  "software_title": "Falcon.app",
+  "script_execution_id": "ece8d99d-4313-446a-9af2-e152cd1bad1e",
+  "status": "uninstalled"
+}`
+}
+
 type ActivityTypeAddedSoftware struct {
 	SoftwareTitle   string  `json:"software_title"`
 	SoftwarePackage string  `json:"software_package"`
@@ -1548,6 +1582,33 @@ func (a ActivityTypeAddedSoftware) Documentation() (string, string, string) {
 }`
 }
 
+type ActivityTypeEditedSoftware struct {
+	SoftwareTitle   string  `json:"software_title"`
+	SoftwarePackage *string `json:"software_package"`
+	TeamName        *string `json:"team_name"`
+	TeamID          *uint   `json:"team_id"`
+	SelfService     bool    `json:"self_service"`
+}
+
+func (a ActivityTypeEditedSoftware) ActivityName() string {
+	return "edited_software"
+}
+
+func (a ActivityTypeEditedSoftware) Documentation() (string, string, string) {
+	return `Generated when a software installer is updated in Fleet.`, `This activity contains the following fields:
+- "software_title": Name of the software.
+- "software_package": Filename of the installer as of this update (including if unchanged).
+- "team_name": Name of the team on which this software was updated.` + " `null` " + `if it was updated on no team.
+- "team_id": The ID of the team on which this software was updated.` + " `null` " + `if it was updated on no team.
+- "self_service": Whether the software is available for installation by the end user.`, `{
+  "software_title": "Falcon.app",
+  "software_package": "FalconSensor-6.44.pkg",
+  "team_name": "Workstations",
+  "team_id": 123,
+  "self_service": true
+}`
+}
+
 type ActivityTypeDeletedSoftware struct {
 	SoftwareTitle   string  `json:"software_title"`
 	SoftwarePackage string  `json:"software_package"`
@@ -1656,24 +1717,34 @@ func LogRoleChangeActivities(
 	return nil
 }
 
-type ActivityEnabledVPP struct{}
+type ActivityEnabledVPP struct {
+	Location string `json:"location"`
+}
 
 func (a ActivityEnabledVPP) ActivityName() string {
 	return "enabled_vpp"
 }
 
 func (a ActivityEnabledVPP) Documentation() (activity string, details string, detailsExample string) {
-	return "Generated when the VPP feature is enabled in Fleet.", "", ""
+	return "Generated when VPP features are enabled in Fleet.", `This activity contains the following fields:
+- "location": Location associated with the VPP content token for the enabled VPP features.`, `{
+  "location": "Acme Inc."
+}`
 }
 
-type ActivityDisabledVPP struct{}
+type ActivityDisabledVPP struct {
+	Location string `json:"location"`
+}
 
 func (a ActivityDisabledVPP) ActivityName() string {
 	return "disabled_vpp"
 }
 
 func (a ActivityDisabledVPP) Documentation() (activity string, details string, detailsExample string) {
-	return "Generated when the VPP feature is disabled in Fleet.", "", ""
+	return "Generated when VPP features are disabled in Fleet.", `This activity contains the following fields:
+- "location": Location associated with the VPP content token for the disabled VPP features.`, `{
+  "location": "Acme Inc."
+}`
 }
 
 type ActivityAddedAppStoreApp struct {
@@ -1682,6 +1753,7 @@ type ActivityAddedAppStoreApp struct {
 	TeamName      *string             `json:"team_name"`
 	TeamID        *uint               `json:"team_id"`
 	Platform      AppleDevicePlatform `json:"platform"`
+	SelfService   bool                `json:"self_service"`
 }
 
 func (a ActivityAddedAppStoreApp) ActivityName() string {
@@ -1693,11 +1765,13 @@ func (a ActivityAddedAppStoreApp) Documentation() (activity string, details stri
 - "software_title": Name of the App Store app.
 - "app_store_id": ID of the app on the Apple App Store.
 - "platform": Platform of the app (` + "`darwin`, `ios`, or `ipados`" + `).
+- "self_service": App installation can be initiated by device owner.
 - "team_name": Name of the team to which this App Store app was added, or ` + "`null`" + ` if it was added to no team.
 - "team_id": ID of the team to which this App Store app was added, or ` + "`null`" + `if it was added to no team.`, `{
   "software_title": "Logic Pro",
   "app_store_id": "1234567",
   "platform": "darwin",
+  "self_service": false,
   "team_name": "Workstations",
   "team_id": 1
 }`
@@ -1737,6 +1811,7 @@ type ActivityInstalledAppStoreApp struct {
 	AppStoreID      string `json:"app_store_id"`
 	CommandUUID     string `json:"command_uuid"`
 	Status          string `json:"status,omitempty"`
+	SelfService     bool   `json:"self_service"`
 }
 
 func (a ActivityInstalledAppStoreApp) HostIDs() []uint {
@@ -1750,11 +1825,13 @@ func (a ActivityInstalledAppStoreApp) ActivityName() string {
 func (a ActivityInstalledAppStoreApp) Documentation() (string, string, string) {
 	return "Generated when an App Store app is installed on a device.", `This activity contains the following fields:
 - host_id: ID of the host on which the app was installed.
+- self_service: App installation was initiated by device owner.
 - host_display_name: Display name of the host.
 - software_title: Name of the App Store app.
 - app_store_id: ID of the app on the Apple App Store.
 - command_uuid: UUID of the MDM command used to install the app.`, `{
   "host_id": 42,
+  "self_service": true,
   "host_display_name": "Anna's MacBook Pro",
   "software_title": "Logic Pro",
   "app_store_id": "1234567",
diff --git a/server/fleet/app.go b/server/fleet/app.go
index b9227dd8bb..603ba2e0ab 100644
--- a/server/fleet/app.go
+++ b/server/fleet/app.go
@@ -120,9 +120,31 @@ type VulnerabilitySettings struct {
 	DatabasesPath string `json:"databases_path"`
 }
 
+// MDMAppleABMAssignmentInfo represents an user definition of the association
+// between an ABM token (via organization name) and the teams used to associate
+// hosts when they're ingested during the ABM sync.
+type MDMAppleABMAssignmentInfo struct {
+	OrganizationName string `json:"organization_name"`
+	MacOSTeam        string `json:"macos_team"`
+	IOSTeam          string `json:"ios_team"`
+	IpadOSTeam       string `json:"ipados_team"`
+}
+
+// MDMAppleVolumePurchasingProgramInfo represents an user definition of the association
+// between a VPP token (via location) and the team associations.
+type MDMAppleVolumePurchasingProgramInfo struct {
+	Location string   `json:"location"`
+	Teams    []string `json:"teams"`
+}
+
 // MDM is part of AppConfig and defines the mdm settings.
 type MDM struct {
-	AppleBMDefaultTeam string `json:"apple_bm_default_team"`
+	// Deprecated: use AppleBussinessManager instead
+	DeprecatedAppleBMDefaultTeam string `json:"apple_bm_default_team,omitempty"`
+
+	// AppleBusinessManager defines the associations between ABM tokens
+	// and the teams used to assign hosts when they're ingested from ABM.
+	AppleBusinessManager optjson.Slice[MDMAppleABMAssignmentInfo] `json:"apple_business_manager"`
 
 	// AppleBMEnabledAndConfigured is set to true if Fleet has been
 	// configured with the required Apple BM key pair or token. It can't be set
@@ -136,6 +158,10 @@ type MDM struct {
 	// PATCH /config API, it is only set automatically, internally, by detecting
 	// the 403 Forbidden error with body T_C_NOT_SIGNED returned by the Apple BM
 	// API.
+	//
+	// It is set to true as soon as one of the ABM tokens receives this error
+	// code, and is set to false only once all ABM tokens have agreed to the new
+	// terms.
 	AppleBMTermsExpired bool `json:"apple_bm_terms_expired"`
 
 	// EnabledAndConfigured is set to true if Fleet has been
@@ -172,6 +198,8 @@ type MDM struct {
 
 	WindowsSettings WindowsSettings `json:"windows_settings"`
 
+	VolumePurchasingProgram optjson.Slice[MDMAppleVolumePurchasingProgramInfo] `json:"volume_purchasing_program"`
+
 	/////////////////////////////////////////////////////////////////
 	// WARNING: If you add to this struct make sure it's taken into
 	// account in the AppConfig Clone implementation!
@@ -607,6 +635,25 @@ func (c *AppConfig) Copy() *AppConfig {
 		clone.MDM.WindowsSettings.CustomSettings = optjson.SetSlice(windowsSettings)
 	}
 
+	if c.MDM.AppleBusinessManager.Set {
+		abm := make([]MDMAppleABMAssignmentInfo, len(c.MDM.AppleBusinessManager.Value))
+		for i, s := range c.MDM.AppleBusinessManager.Value {
+			abm[i] = s
+		}
+		clone.MDM.AppleBusinessManager = optjson.SetSlice(abm)
+
+	}
+
+	if c.MDM.VolumePurchasingProgram.Set {
+		vpp := make([]MDMAppleVolumePurchasingProgramInfo, len(c.MDM.VolumePurchasingProgram.Value))
+		for i, s := range c.MDM.VolumePurchasingProgram.Value {
+			vpp[i].Location = s.Location
+			vpp[i].Teams = make([]string, len(s.Teams))
+			copy(vpp[i].Teams, s.Teams)
+		}
+		clone.MDM.VolumePurchasingProgram = optjson.SetSlice(vpp)
+	}
+
 	return &clone
 }
 
@@ -831,7 +878,6 @@ func (c AppConfig) MarshalJSON() ([]byte, error) {
 	if !c.MDM.MacOSSetup.EnableReleaseDeviceManually.Valid {
 		c.MDM.MacOSSetup.EnableReleaseDeviceManually = optjson.SetBool(false)
 	}
-
 	type aliasConfig AppConfig
 	aa := aliasConfig(c)
 	return json.Marshal(aa)
diff --git a/server/fleet/apple_mdm.go b/server/fleet/apple_mdm.go
index e1cabf2533..832ee5d237 100644
--- a/server/fleet/apple_mdm.go
+++ b/server/fleet/apple_mdm.go
@@ -1,11 +1,13 @@
 package fleet
 
 import (
+	"bytes"
 	"context"
 	"crypto/md5" // nolint: gosec
 	"encoding/hex"
 	"encoding/json"
 	"fmt"
+	"io"
 	"net/http"
 	"strings"
 	"time"
@@ -203,6 +205,13 @@ type MDMAppleConfigProfile struct {
 	UploadedAt       time.Time                   `db:"uploaded_at" json:"updated_at"` // NOTE: JSON field is still `updated_at` for historical reasons, would be an API breaking change
 }
 
+// MDMProfilesUpdates flags updates that were done during batch processing of profiles.
+type MDMProfilesUpdates struct {
+	AppleConfigProfile   bool
+	WindowsConfigProfile bool
+	AppleDeclaration     bool
+}
+
 // ConfigurationProfileLabel represents the many-to-many relationship between
 // profiles and labels.
 //
@@ -302,10 +311,24 @@ type MDMAppleProfilePayload struct {
 	CommandUUID       string             `db:"command_uuid"`
 }
 
-// FailedToInstallOnHost indicates whether this profile failed to be installed on the host (and
+// DidNotInstallOnHost indicates whether this profile was not installed on the host (and
 // therefore is not, as far as Fleet knows, currently on the host).
-func (p *MDMAppleProfilePayload) FailedToInstallOnHost() bool {
-	return p.Status != nil && *p.Status == MDMDeliveryFailed && p.OperationType == MDMOperationTypeInstall
+func (p *MDMAppleProfilePayload) DidNotInstallOnHost() bool {
+	return p.Status != nil && (*p.Status == MDMDeliveryFailed || *p.Status == MDMDeliveryPending) && p.OperationType == MDMOperationTypeInstall
+}
+
+func (p MDMAppleProfilePayload) Equal(other MDMAppleProfilePayload) bool {
+	statusEqual := p.Status == nil && other.Status == nil || p.Status != nil && other.Status != nil && *p.Status == *other.Status
+	return p.ProfileUUID == other.ProfileUUID &&
+		p.ProfileIdentifier == other.ProfileIdentifier &&
+		p.ProfileName == other.ProfileName &&
+		p.HostUUID == other.HostUUID &&
+		p.HostPlatform == other.HostPlatform &&
+		bytes.Equal(p.Checksum, other.Checksum) &&
+		statusEqual &&
+		p.OperationType == other.OperationType &&
+		p.Detail == other.Detail &&
+		p.CommandUUID == other.CommandUUID
 }
 
 type MDMAppleBulkUpsertHostProfilePayload struct {
@@ -434,6 +457,8 @@ type HostDEPAssignment struct {
 	// DeletedAt is the timestamp  when Fleet was notified that device was deleted from the Fleet
 	// MDM server in Apple Busines Manager (ABM).
 	DeletedAt *time.Time `db:"deleted_at"`
+	// ABMTokenID is the ID of the ABM token that was used to make this DEP assignment.
+	ABMTokenID *uint `db:"abm_token_id"`
 }
 
 func (h *HostDEPAssignment) IsDEPAssignedToFleet() bool {
@@ -496,12 +521,11 @@ type MDMAppleCommand struct {
 // MDMAppleSetupAssistant represents the setup assistant set for a given team
 // or no team.
 type MDMAppleSetupAssistant struct {
-	ID          uint            `json:"-" db:"id"`
-	TeamID      *uint           `json:"team_id" db:"team_id"`
-	Name        string          `json:"name" db:"name"`
-	Profile     json.RawMessage `json:"enrollment_profile" db:"profile"`
-	ProfileUUID string          `json:"-" db:"profile_uuid"`
-	UploadedAt  time.Time       `json:"uploaded_at" db:"uploaded_at"`
+	ID         uint            `json:"-" db:"id"`
+	TeamID     *uint           `json:"team_id" db:"team_id"`
+	Name       string          `json:"name" db:"name"`
+	Profile    json.RawMessage `json:"enrollment_profile" db:"profile"`
+	UploadedAt time.Time       `json:"uploaded_at" db:"uploaded_at"`
 }
 
 // AuthzType implements authz.AuthzTyper.
@@ -658,6 +682,18 @@ type MDMAppleHostDeclaration struct {
 	Checksum string `db:"checksum" json:"-"`
 }
 
+func (p MDMAppleHostDeclaration) Equal(other MDMAppleHostDeclaration) bool {
+	statusEqual := p.Status == nil && other.Status == nil || p.Status != nil && other.Status != nil && *p.Status == *other.Status
+	return statusEqual &&
+		p.HostUUID == other.HostUUID &&
+		p.DeclarationUUID == other.DeclarationUUID &&
+		p.Name == other.Name &&
+		p.Identifier == other.Identifier &&
+		p.OperationType == other.OperationType &&
+		p.Detail == other.Detail &&
+		p.Checksum == other.Checksum
+}
+
 func NewMDMAppleDeclaration(raw []byte, teamID *uint, name string, declType, ident string) *MDMAppleDeclaration {
 	var decl MDMAppleDeclaration
 
@@ -841,3 +877,67 @@ type MDMAppleDDMActivation struct {
 	ServerToken string                       `json:"ServerToken"`
 	Type        string                       `json:"Type"` // "com.apple.activation.simple"
 }
+
+// MDMBootstrapPackageStore is the interface to store and retrieve bootstrap
+// package files. Fleet supports storing to the database and to an S3 bucket.
+type MDMBootstrapPackageStore interface {
+	Get(ctx context.Context, packageID string) (io.ReadCloser, int64, error)
+	Put(ctx context.Context, packageID string, content io.ReadSeeker) error
+	Exists(ctx context.Context, packageID string) (bool, error)
+	Cleanup(ctx context.Context, usedPackageIDs []string, removeCreatedBefore time.Time) (int, error)
+}
+
+// MDMAppleMachineInfo is a [device's information][1] sent as part of an MDM enrollment profile request
+//
+// [1]: https://developer.apple.com/documentation/devicemanagement/machineinfo
+type MDMAppleMachineInfo struct {
+	IMEI                        string `plist:"IMEI,omitempty"`
+	Language                    string `plist:"LANGUAGE,omitempty"`
+	MDMCanRequestSoftwareUpdate bool   `plist:"MDM_CAN_REQUEST_SOFTWARE_UPDATE"`
+	MEID                        string `plist:"MEID,omitempty"`
+	OSVersion                   string `plist:"OS_VERSION"`
+	PairingToken                string `plist:"PAIRING_TOKEN,omitempty"`
+	Product                     string `plist:"PRODUCT"`
+	Serial                      string `plist:"SERIAL"`
+	SoftwareUpdateDeviceID      string `plist:"SOFTWARE_UPDATE_DEVICE_ID,omitempty"`
+	SupplementalBuildVersion    string `plist:"SUPPLEMENTAL_BUILD_VERSION,omitempty"`
+	SupplementalOSVersionExtra  string `plist:"SUPPLEMENTAL_OS_VERSION_EXTRA,omitempty"`
+	UDID                        string `plist:"UDID"`
+	Version                     string `plist:"VERSION"`
+}
+
+// MDMAppleSoftwareUpdateRequiredCode is the [code][1] specified by Apple to indicate that the device
+// needs to perform a software update before enrollment and setup can proceed.
+//
+// [1]: https://developer.apple.com/documentation/devicemanagement/errorcodesoftwareupdaterequired
+const MDMAppleSoftwareUpdateRequiredCode = "com.apple.softwareupdate.required"
+
+// MDMAppleSoftwareUpdateRequiredDetails is the [details][1] specified by Apple for the
+// required software update.
+//
+// [1]: https://developer.apple.com/documentation/devicemanagement/errorcodesoftwareupdaterequired/details
+type MDMAppleSoftwareUpdateRequiredDetails struct {
+	OSVersion    string `json:"OSVersion"`
+	BuildVersion string `json:"BuildVersion"`
+}
+
+// MDMAppleSoftwareUpdateRequired is the [error response][1] specified by Apple to indicate that the device
+// needs to perform a software update before enrollment and setup can proceed.
+//
+// [1]: https://developer.apple.com/documentation/devicemanagement/errorcodesoftwareupdaterequired
+type MDMAppleSoftwareUpdateRequired struct {
+	Code    string                                `json:"code"` // "com.apple.softwareupdate.required"
+	Details MDMAppleSoftwareUpdateRequiredDetails `json:"details"`
+}
+
+func NewMDMAppleSoftwareUpdateRequired(asset MDMAppleSoftwareUpdateAsset) *MDMAppleSoftwareUpdateRequired {
+	return &MDMAppleSoftwareUpdateRequired{
+		Code:    MDMAppleSoftwareUpdateRequiredCode,
+		Details: MDMAppleSoftwareUpdateRequiredDetails{OSVersion: asset.ProductVersion, BuildVersion: asset.Build},
+	}
+}
+
+type MDMAppleSoftwareUpdateAsset struct {
+	ProductVersion string `json:"ProductVersion"`
+	Build          string `json:"Build"`
+}
diff --git a/server/fleet/apple_mdm_test.go b/server/fleet/apple_mdm_test.go
index 16799f6cc3..240c37c9d7 100644
--- a/server/fleet/apple_mdm_test.go
+++ b/server/fleet/apple_mdm_test.go
@@ -7,18 +7,20 @@ import (
 	"crypto/x509"
 	"encoding/json"
 	"fmt"
+	"reflect"
 	"strings"
 	"testing"
 	"time"
 
 	"github.com/fleetdm/fleet/v4/server/mdm"
 	"github.com/fleetdm/fleet/v4/server/mdm/apple/mobileconfig"
-	"github.com/fleetdm/fleet/v4/server/ptr"
-	"github.com/google/uuid"
-	"github.com/stretchr/testify/require"
-	"go.mozilla.org/pkcs7"
-
 	"github.com/fleetdm/fleet/v4/server/mdm/scep/depot"
+	"github.com/fleetdm/fleet/v4/server/ptr"
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/uuid"
+	"github.com/smallstep/pkcs7"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestMDMAppleConfigProfile(t *testing.T) {
@@ -416,3 +418,199 @@ func TestMDMProfileIsWithinGracePeriod(t *testing.T) {
 		})
 	}
 }
+
+func TestMDMAppleHostDeclarationEqual(t *testing.T) {
+	t.Parallel()
+
+	// This test is intended to ensure that the Equal method on MDMAppleHostDeclaration is updated when new fields are added.
+	// The Equal method is used to identify whether database update is needed.
+
+	items := [...]MDMAppleHostDeclaration{{}, {}}
+
+	numberOfFields := 0
+	for i := 0; i < len(items); i++ {
+		rValue := reflect.ValueOf(&items[i]).Elem()
+		numberOfFields = rValue.NumField()
+		for j := 0; j < numberOfFields; j++ {
+			field := rValue.Field(j)
+			switch field.Kind() {
+			case reflect.String:
+				valueToSet := fmt.Sprintf("test %d", i)
+				field.SetString(valueToSet)
+			case reflect.Int:
+				field.SetInt(int64(i))
+			case reflect.Bool:
+				field.SetBool(i%2 == 0)
+			case reflect.Pointer:
+				field.Set(reflect.New(field.Type().Elem()))
+			default:
+				t.Fatalf("unhandled field type %s", field.Kind())
+			}
+		}
+	}
+
+	status0 := MDMDeliveryStatus("status")
+	status1 := MDMDeliveryStatus("status")
+	items[0].Status = &status0
+	assert.False(t, items[0].Equal(items[1]))
+
+	// Set known fields to be equal
+	fieldsInEqualMethod := 0
+	items[1].HostUUID = items[0].HostUUID
+	fieldsInEqualMethod++
+	items[1].DeclarationUUID = items[0].DeclarationUUID
+	fieldsInEqualMethod++
+	items[1].Name = items[0].Name
+	fieldsInEqualMethod++
+	items[1].Identifier = items[0].Identifier
+	fieldsInEqualMethod++
+	items[1].OperationType = items[0].OperationType
+	fieldsInEqualMethod++
+	items[1].Detail = items[0].Detail
+	fieldsInEqualMethod++
+	items[1].Checksum = items[0].Checksum
+	fieldsInEqualMethod++
+	items[1].Status = &status1
+	fieldsInEqualMethod++
+	assert.Equal(t, fieldsInEqualMethod, numberOfFields, "MDMAppleHostDeclaration.Equal needs to be updated for new/updated field(s)")
+	assert.True(t, items[0].Equal(items[1]))
+
+	// Set pointers to nil
+	items[0].Status = nil
+	items[1].Status = nil
+	assert.True(t, items[0].Equal(items[1]))
+
+}
+
+func TestMDMAppleProfilePayloadEqual(t *testing.T) {
+	t.Parallel()
+
+	// This test is intended to ensure that the Equal method on MDMAppleProfilePayload is updated when new fields are added.
+	// The Equal method is used to identify whether database update is needed.
+
+	items := [...]MDMAppleProfilePayload{{}, {}}
+
+	numberOfFields := 0
+	for i := 0; i < len(items); i++ {
+		rValue := reflect.ValueOf(&items[i]).Elem()
+		numberOfFields = rValue.NumField()
+		for j := 0; j < numberOfFields; j++ {
+			field := rValue.Field(j)
+			switch field.Kind() {
+			case reflect.String:
+				valueToSet := fmt.Sprintf("test %d", i)
+				field.SetString(valueToSet)
+			case reflect.Int:
+				field.SetInt(int64(i))
+			case reflect.Bool:
+				field.SetBool(i%2 == 0)
+			case reflect.Pointer:
+				field.Set(reflect.New(field.Type().Elem()))
+			case reflect.Slice:
+				switch field.Type().Elem().Kind() {
+				case reflect.Uint8:
+					valueToSet := []byte("test")
+					field.Set(reflect.ValueOf(valueToSet))
+				default:
+					t.Fatalf("unhandled slice type %s", field.Type().Elem().Kind())
+				}
+			default:
+				t.Fatalf("unhandled field type %s", field.Kind())
+			}
+		}
+	}
+
+	status0 := MDMDeliveryStatus("status")
+	status1 := MDMDeliveryStatus("status")
+	items[0].Status = &status0
+	checksum0 := []byte("checksum")
+	checksum1 := []byte("checksum")
+	items[0].Checksum = checksum0
+	assert.False(t, items[0].Equal(items[1]))
+
+	// Set known fields to be equal
+	fieldsInEqualMethod := 0
+	items[1].ProfileUUID = items[0].ProfileUUID
+	fieldsInEqualMethod++
+	items[1].ProfileIdentifier = items[0].ProfileIdentifier
+	fieldsInEqualMethod++
+	items[1].ProfileName = items[0].ProfileName
+	fieldsInEqualMethod++
+	items[1].HostUUID = items[0].HostUUID
+	fieldsInEqualMethod++
+	items[1].HostPlatform = items[0].HostPlatform
+	fieldsInEqualMethod++
+	items[1].Checksum = checksum1
+	fieldsInEqualMethod++
+	items[1].Status = &status1
+	fieldsInEqualMethod++
+	items[1].OperationType = items[0].OperationType
+	fieldsInEqualMethod++
+	items[1].Detail = items[0].Detail
+	fieldsInEqualMethod++
+	items[1].CommandUUID = items[0].CommandUUID
+	fieldsInEqualMethod++
+	assert.Equal(t, fieldsInEqualMethod, numberOfFields, "MDMAppleProfilePayload.Equal needs to be updated for new/updated field(s)")
+	assert.True(t, items[0].Equal(items[1]))
+
+	// Set pointers and slices to nil
+	items[0].Status = nil
+	items[1].Status = nil
+	items[0].Checksum = nil
+	items[1].Checksum = nil
+	assert.True(t, items[0].Equal(items[1]))
+
+}
+
+func TestConfigurationProfileLabelEqual(t *testing.T) {
+	t.Parallel()
+
+	// This test is intended to ensure that the cmp.Equal method on ConfigurationProfileLabel is updated when new fields are added.
+	// The cmp.Equal method is used to identify whether database update is needed.
+
+	items := [...]ConfigurationProfileLabel{{}, {}}
+
+	numberOfFields := 0
+	for i := 0; i < len(items); i++ {
+		rValue := reflect.ValueOf(&items[i]).Elem()
+		numberOfFields = rValue.NumField()
+		for j := 0; j < numberOfFields; j++ {
+			field := rValue.Field(j)
+			switch field.Kind() {
+			case reflect.String:
+				valueToSet := fmt.Sprintf("test %d", i)
+				field.SetString(valueToSet)
+			case reflect.Int:
+				field.SetInt(int64(i))
+			case reflect.Uint:
+				field.SetUint(uint64(i))
+			case reflect.Bool:
+				field.SetBool(i%2 == 0)
+			case reflect.Pointer:
+				field.Set(reflect.New(field.Type().Elem()))
+			default:
+				t.Fatalf("unhandled field type %s", field.Kind())
+			}
+		}
+	}
+
+	assert.False(t, cmp.Equal(items[0], items[1]))
+
+	// Set known fields to be equal
+	fieldsInEqualMethod := 0
+	items[1].ProfileUUID = items[0].ProfileUUID
+	fieldsInEqualMethod++
+	items[1].LabelName = items[0].LabelName
+	fieldsInEqualMethod++
+	items[1].LabelID = items[0].LabelID
+	fieldsInEqualMethod++
+	items[1].Broken = items[0].Broken
+	fieldsInEqualMethod++
+	items[1].Exclude = items[0].Exclude
+	fieldsInEqualMethod++
+
+	assert.Equal(t, fieldsInEqualMethod, numberOfFields,
+		"Does cmp.Equal for ConfigurationProfileLabel needs to be updated for new/updated field(s)?")
+	assert.True(t, cmp.Equal(items[0], items[1]))
+
+}
diff --git a/server/fleet/calendar.go b/server/fleet/calendar.go
index 72c3e9e0ba..b5edacc676 100644
--- a/server/fleet/calendar.go
+++ b/server/fleet/calendar.go
@@ -42,8 +42,8 @@ type UserCalendar interface {
 	GetAndUpdateEvent(event *CalendarEvent, genBodyFn CalendarGenBodyFn,
 		opts CalendarGetAndUpdateEventOpts) (updatedEvent *CalendarEvent,
 		updated bool, err error)
-	// UpdateEventBody updates the body of the calendar event.
-	UpdateEventBody(event *CalendarEvent, genBodyFn CalendarGenBodyFn) error
+	// UpdateEventBody updates the body of the calendar event and returns new ETag
+	UpdateEventBody(event *CalendarEvent, genBodyFn CalendarGenBodyFn) (string, error)
 	// DeleteEvent deletes the event with the given ID.
 	DeleteEvent(event *CalendarEvent) error
 	// StopEventChannel stops the event's callback channel.
@@ -54,15 +54,17 @@ type UserCalendar interface {
 
 // Lock interface for managing distributed locks.
 type Lock interface {
-	// AcquireLock attempts to acquire a lock with the given key. value is the value to set for the key, which is used to release the lock.
+	// SetIfNotExist attempts to set an item with the given key. value is the value to set for the key, which is used to release the lock.
 	// expireMs is the time in milliseconds after which the lock is automatically released. expireMs=0 means a default expiration time is used.
 	// Returns true if the lock was acquired, false otherwise.
-	AcquireLock(ctx context.Context, key string, value string, expireMs uint64) (ok bool, err error)
+	SetIfNotExist(ctx context.Context, key string, value string, expireMs uint64) (ok bool, err error)
 	// ReleaseLock attempts to release a lock with the given key and value. If key does not exist or value does not match, the lock is not released.
 	// Returns true if the lock was released, false otherwise.
 	ReleaseLock(ctx context.Context, key string, value string) (ok bool, err error)
 	// Get retrieves the value of the given key. If the key does not exist, nil is returned.
 	Get(ctx context.Context, key string) (*string, error)
+	// GetAndDelete retrieves the value of the given key and deletes the key. If the key does not exist, nil is returned.
+	GetAndDelete(ctx context.Context, key string) (*string, error)
 	// AddToSet adds the value to the set identified by the given key.
 	AddToSet(ctx context.Context, key string, value string) error
 	// RemoveFromSet removes the value from the set identified by the given key.
diff --git a/server/fleet/calendar_events.go b/server/fleet/calendar_events.go
index 44d11306fc..5e730e283b 100644
--- a/server/fleet/calendar_events.go
+++ b/server/fleet/calendar_events.go
@@ -2,6 +2,7 @@ package fleet
 
 import (
 	"encoding/json"
+	"errors"
 	"fmt"
 	"time"
 )
@@ -30,7 +31,10 @@ func (ce *CalendarEvent) GetBodyTag() string {
 	return d.BodyTag
 }
 
-func (ce *CalendarEvent) SaveBodyTag(bodyTag string) error {
+func (ce *CalendarEvent) SaveDataItems(keysAndValues ...string) error {
+	if len(keysAndValues)%2 != 0 {
+		return errors.New("SaveDataItem requires an even number of arguments")
+	}
 	var result map[string]any
 	if len(ce.Data) > 0 {
 		err := json.Unmarshal(ce.Data, &result)
@@ -40,7 +44,11 @@ func (ce *CalendarEvent) SaveBodyTag(bodyTag string) error {
 	} else {
 		result = make(map[string]any, 1)
 	}
-	result["body_tag"] = bodyTag
+	for i := 0; i < len(keysAndValues); i += 2 {
+		key := keysAndValues[i]
+		value := keysAndValues[i+1]
+		result[key] = value
+	}
 	data, err := json.Marshal(result)
 	if err != nil {
 		return fmt.Errorf("could not marshal event data: %w", err)
diff --git a/server/fleet/calendar_events_test.go b/server/fleet/calendar_events_test.go
index 3e79bd6bb4..931cd3889f 100644
--- a/server/fleet/calendar_events_test.go
+++ b/server/fleet/calendar_events_test.go
@@ -8,7 +8,7 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-func TestBodyTag(t *testing.T) {
+func TestSaveDataItems(t *testing.T) {
 	t.Parallel()
 
 	var event CalendarEvent
@@ -16,7 +16,7 @@ func TestBodyTag(t *testing.T) {
 	assert.Equal(t, "", event.GetBodyTag())
 
 	bodyTag := "bodyTag"
-	require.NoError(t, event.SaveBodyTag(bodyTag))
+	require.NoError(t, event.SaveDataItems("body_tag", bodyTag))
 	assert.Equal(t, bodyTag, event.GetBodyTag())
 
 	testMap := make(map[string]any, 5)
@@ -29,11 +29,11 @@ func TestBodyTag(t *testing.T) {
 	event.Data = data
 	assert.Equal(t, oldBodyTag, event.GetBodyTag())
 
-	require.NoError(t, event.SaveBodyTag(bodyTag))
+	require.NoError(t, event.SaveDataItems("body_tag", bodyTag))
 	assert.Equal(t, bodyTag, event.GetBodyTag())
 
 	// Make sure data was not modified
-	require.NoError(t, event.SaveBodyTag(oldBodyTag))
+	require.NoError(t, event.SaveDataItems("body_tag", oldBodyTag))
 	var result map[string]any
 	require.NoError(t, json.Unmarshal(event.Data, &result))
 	assert.Equal(t, testMap, result)
diff --git a/server/fleet/capabilities.go b/server/fleet/capabilities.go
index be397bcc32..2e12810be8 100644
--- a/server/fleet/capabilities.go
+++ b/server/fleet/capabilities.go
@@ -99,5 +99,11 @@ func GetServerDeviceCapabilities() CapabilityMap {
 	return capabilities
 }
 
+func GetOrbitClientCapabilities() CapabilityMap {
+	return CapabilityMap{
+		CapabilityEscrowBuddy: {},
+	}
+}
+
 // CapabilitiesHeader is the header name used to communicate the capabilities.
 const CapabilitiesHeader = "X-Fleet-Capabilities"
diff --git a/server/fleet/cron_schedules.go b/server/fleet/cron_schedules.go
index 250a8dc3b5..937fb85a51 100644
--- a/server/fleet/cron_schedules.go
+++ b/server/fleet/cron_schedules.go
@@ -24,6 +24,7 @@ const (
 	CronAppleMDMIPhoneIPadRefetcher CronScheduleName = "apple_mdm_iphone_ipad_refetcher"
 	CronAppleMDMAPNsPusher          CronScheduleName = "apple_mdm_apns_pusher"
 	CronCalendar                    CronScheduleName = "calendar"
+	CronUninstallSoftwareMigration  CronScheduleName = "uninstall_software_migration"
 )
 
 type CronSchedulesService interface {
diff --git a/server/fleet/datastore.go b/server/fleet/datastore.go
index 6847f398af..99b2cdb7d2 100644
--- a/server/fleet/datastore.go
+++ b/server/fleet/datastore.go
@@ -336,7 +336,15 @@ type Datastore interface {
 
 	// ListIOSAndIPadOSToRefetch returns the UUIDs of iPhones/iPads that should be refetched (their details haven't been
 	// updated in the given `interval`).
-	ListIOSAndIPadOSToRefetch(ctx context.Context, refetchInterval time.Duration) (uuids []string, err error)
+	ListIOSAndIPadOSToRefetch(ctx context.Context, refetchInterval time.Duration) (devices []AppleDevicesToRefetch, err error)
+	// AddHostMDMCommands adds the provided MDM commands to the host to track which commands have been sent.
+	AddHostMDMCommands(ctx context.Context, commands []HostMDMCommand) error
+	// GetHostMDMCommands returns the MDM commands that have been sent to the host.
+	GetHostMDMCommands(ctx context.Context, hostID uint) (commands []HostMDMCommand, err error)
+	// RemoveHostMDMCommand removes the provided MDM command from the host, indicating that it has been processed.
+	RemoveHostMDMCommand(ctx context.Context, command HostMDMCommand) error
+	// CleanupHostMDMCommands removes invalid and stale MDM commands sent to hosts.
+	CleanupHostMDMCommands(ctx context.Context) error
 
 	// IsHostConnectedToFleetMDM verifies if the host has an active Fleet MDM enrollment with this server
 	IsHostConnectedToFleetMDM(ctx context.Context, host *Host) (bool, error)
@@ -523,7 +531,12 @@ type Datastore interface {
 	// InsertSoftwareInstallRequest tracks a new request to install the provided
 	// software installer in the host. It returns the auto-generated installation
 	// uuid.
-	InsertSoftwareInstallRequest(ctx context.Context, hostID uint, softwareTitleID uint, selfService bool) (string, error)
+	InsertSoftwareInstallRequest(ctx context.Context, hostID uint, softwareInstallerID uint, selfService bool) (string, error)
+	// InsertSoftwareUninstallRequest tracks a new request to uninstall the provided
+	// software installer on the host. executionID is the script execution ID corresponding to uninstall script
+	InsertSoftwareUninstallRequest(ctx context.Context, executionID string, hostID uint, softwareInstallerID uint) error
+	// GetSoftwareTitleNameFromExecutionID returns the software title name associated with the provided software install execution ID.
+	GetSoftwareTitleNameFromExecutionID(ctx context.Context, executionID string) (string, error)
 
 	///////////////////////////////////////////////////////////////////////////////
 	// SoftwareStore
@@ -671,6 +684,8 @@ type Datastore interface {
 	//	  and have a calendar event scheduled.
 	GetTeamHostsPolicyMemberships(ctx context.Context, domain string, teamID uint, policyIDs []uint,
 		hostID *uint) ([]HostPolicyMembershipData, error)
+	// GetPoliciesWithAssociatedInstaller returns team policies that have an associated installer.
+	GetPoliciesWithAssociatedInstaller(ctx context.Context, teamID uint, policyIDs []uint) ([]PolicySoftwareInstallerData, error)
 	GetCalendarPolicies(ctx context.Context, teamID uint) ([]PolicyCalendarData, error)
 
 	// Methods used for async processing of host policy query results.
@@ -865,6 +880,8 @@ type Datastore interface {
 
 	SetOrUpdateMunkiInfo(ctx context.Context, hostID uint, version string, errors, warnings []string) error
 	SetOrUpdateMDMData(ctx context.Context, hostID uint, isServer, enrolled bool, serverURL string, installedFromDep bool, name string, fleetEnrollRef string) error
+	// UpdateMDMData updates the `enrolled` field of the host with the given ID.
+	UpdateMDMData(ctx context.Context, hostID uint, enrolled bool) error
 	// SetOrUpdateHostEmailsFromMdmIdpAccounts sets or updates the host emails associated with the provided
 	// host based on the MDM IdP account information associated with the provided fleet enrollment reference.
 	SetOrUpdateHostEmailsFromMdmIdpAccounts(ctx context.Context, hostID uint, fleetEnrollmentRef string) error
@@ -989,6 +1006,8 @@ type Datastore interface {
 	CountVulnerabilities(ctx context.Context, opt VulnListOptions) (uint, error)
 	// UpdateVulnerabilityHostCounts updates hosts counts for all vulnerabilities.
 	UpdateVulnerabilityHostCounts(ctx context.Context) error
+	// IsCVEKnownToFleet checks if the provided CVE is known to Fleet.
+	IsCVEKnownToFleet(ctx context.Context, cve string) (bool, error)
 
 	///////////////////////////////////////////////////////////////////////////////
 	// Apple MDM
@@ -1092,12 +1111,15 @@ type Datastore interface {
 
 	// UpsertMDMAppleHostDEPAssignments ensures there's an entry in
 	// `host_dep_assignments` for all the provided hosts.
-	UpsertMDMAppleHostDEPAssignments(ctx context.Context, hosts []Host) error
+	UpsertMDMAppleHostDEPAssignments(ctx context.Context, hosts []Host, abmTokenID uint) error
 
 	// IngestMDMAppleDevicesFromDEPSync creates new Fleet host records for MDM-enrolled devices that are
-	// not already enrolled in Fleet. It returns the number of hosts created, the team id that they
-	// joined (nil for no team), and an error.
-	IngestMDMAppleDevicesFromDEPSync(ctx context.Context, devices []godep.Device) (int64, *uint, error)
+	// not already enrolled in Fleet. It returns the number of hosts created, and an error.
+	IngestMDMAppleDevicesFromDEPSync(ctx context.Context, devices []godep.Device, abmTokenID uint, macOSTeam, iosTeam, ipadTeam *Team) (int64, error)
+
+	// IngestMDMAppleDeviceFromOTAEnrollment creates new host records for
+	// MDM-enrolled devices via OTA that are not already enrolled in Fleet.
+	IngestMDMAppleDeviceFromOTAEnrollment(ctx context.Context, teamID *uint, deviceInfo MDMAppleMachineInfo) error
 
 	// MDMAppleUpsertHost creates or matches a Fleet host record for an
 	// MDM-enrolled device.
@@ -1150,7 +1172,9 @@ type Datastore interface {
 	// remove for each affected host to pending for the provided criteria, which
 	// may be either a list of hostIDs, teamIDs, profileUUIDs or hostUUIDs (only
 	// one of those ID types can be provided).
-	BulkSetPendingMDMHostProfiles(ctx context.Context, hostIDs, teamIDs []uint, profileUUIDs, hostUUIDs []string) error
+	BulkSetPendingMDMHostProfiles(ctx context.Context, hostIDs, teamIDs []uint,
+		profileUUIDs, hostUUIDs []string) (updates MDMProfilesUpdates,
+		err error)
 
 	// GetMDMAppleProfilesContents retrieves the XML contents of the
 	// profiles requested.
@@ -1183,25 +1207,32 @@ type Datastore interface {
 	// to any team).
 	GetMDMAppleFileVaultSummary(ctx context.Context, teamID *uint) (*MDMAppleFileVaultSummary, error)
 
-	// InsertMDMAppleBootstrapPackage insterts a new bootstrap package in the database
-	InsertMDMAppleBootstrapPackage(ctx context.Context, bp *MDMAppleBootstrapPackage) error
+	// InsertMDMAppleBootstrapPackage insterts a new bootstrap package in the
+	// database (or S3 if configured).
+	InsertMDMAppleBootstrapPackage(ctx context.Context, bp *MDMAppleBootstrapPackage, pkgStore MDMBootstrapPackageStore) error
 	// CopyMDMAppleBootstrapPackage copies the bootstrap package specified in the app config (if any)
 	// specified team (and a new token is assigned). It also updates the team config with the default bootstrap package URL.
 	CopyDefaultMDMAppleBootstrapPackage(ctx context.Context, ac *AppConfig, toTeamID uint) error
-	// DeleteMDMAppleBootstrapPackage deletes the bootstrap package for the given team id
+	// DeleteMDMAppleBootstrapPackage deletes the bootstrap package for the given team id.
 	DeleteMDMAppleBootstrapPackage(ctx context.Context, teamID uint) error
-	// GetMDMAppleBootstrapPackageMeta returns metadata about the bootstrap package for a team
+	// GetMDMAppleBootstrapPackageMeta returns metadata about the bootstrap
+	// package for a team.
 	GetMDMAppleBootstrapPackageMeta(ctx context.Context, teamID uint) (*MDMAppleBootstrapPackage, error)
-	// GetMDMAppleBootstrapPackageBytes returns the bytes of a bootstrap package with the given token
-	GetMDMAppleBootstrapPackageBytes(ctx context.Context, token string) (*MDMAppleBootstrapPackage, error)
-	// GetMDMAppleBootstrapPackageSummary returns an aggregated summary of
-	// the status of the bootstrap package for hosts in a team.
+	// GetMDMAppleBootstrapPackageBytes returns the bytes of a bootstrap package
+	// with the given token.
+	GetMDMAppleBootstrapPackageBytes(ctx context.Context, token string, pkgStore MDMBootstrapPackageStore) (*MDMAppleBootstrapPackage, error)
+	// GetMDMAppleBootstrapPackageSummary returns an aggregated summary of the
+	// status of the bootstrap package for hosts in a team.
 	GetMDMAppleBootstrapPackageSummary(ctx context.Context, teamID uint) (*MDMAppleBootstrapPackageSummary, error)
 
 	// RecordHostBootstrapPackage records a command used to install a
 	// bootstrap package in a host.
 	RecordHostBootstrapPackage(ctx context.Context, commandUUID string, hostUUID string) error
 
+	// CleanupUnusedBootstrapPackages will remove bootstrap packages that have no
+	// references to them from the mdm_apple_bootstrap_packages table.
+	CleanupUnusedBootstrapPackages(ctx context.Context, pkgStore MDMBootstrapPackageStore, removeCreatedBefore time.Time) error
+
 	// GetHostMDMMacOSSetup returns the MDM macOS setup information for the specified host id.
 	GetHostMDMMacOSSetup(ctx context.Context, hostID uint) (*HostMDMMacOSSetup, error)
 
@@ -1221,11 +1252,18 @@ type Datastore interface {
 	SetOrUpdateMDMAppleSetupAssistant(ctx context.Context, asst *MDMAppleSetupAssistant) (*MDMAppleSetupAssistant, error)
 	// Get the MDM Apple Setup Assistant for the provided team or no team.
 	GetMDMAppleSetupAssistant(ctx context.Context, teamID *uint) (*MDMAppleSetupAssistant, error)
+	// Get the MDM Apple Setup Assistant profile uuid and timestamp for the
+	// specified ABM token identified by organization name.
+	GetMDMAppleSetupAssistantProfileForABMToken(ctx context.Context, teamID *uint, abmTokenOrgName string) (string, time.Time, error)
 	// Delete the MDM Apple Setup Assistant for the provided team or no team.
 	DeleteMDMAppleSetupAssistant(ctx context.Context, teamID *uint) error
 	// Set the profile UUID generated by the call to Apple's DefineProfile API of
 	// the setup assistant for a team or no team.
-	SetMDMAppleSetupAssistantProfileUUID(ctx context.Context, teamID *uint, profileUUID string) error
+	//
+	// With multi-ABM token support, this profileUUID is stored along with the
+	// ABM token used to register it. The token is identified by its organization
+	// name.
+	SetMDMAppleSetupAssistantProfileUUID(ctx context.Context, teamID *uint, profileUUID, abmTokenOrgName string) error
 
 	// Set the profile UUID generated by the call to Apple's DefineProfile API
 	// of the default setup assistant for a team or no team. The default
@@ -1233,11 +1271,16 @@ type Datastore interface {
 	// the end-user authentication which may be configured per-team and affects
 	// the JSON registered with Apple's API, possibly resulting in different
 	// profile UUIDs for the same profile depending on the team.
-	SetMDMAppleDefaultSetupAssistantProfileUUID(ctx context.Context, teamID *uint, profileUUID string) error
+	//
+	// With multi-ABM token support, this profileUUID is stored along with the
+	// ABM token used to register it. The token is identified by its organization
+	// name.
+	SetMDMAppleDefaultSetupAssistantProfileUUID(ctx context.Context, teamID *uint, profileUUID, abmTokenOrgName string) error
 
 	// Get the profile UUID and last update timestamp for the default setup
-	// assistant for a team or no team.
-	GetMDMAppleDefaultSetupAssistant(ctx context.Context, teamID *uint) (profileUUID string, updatedAt time.Time, err error)
+	// assistant for a team or no team, as registered with the ABM token
+	// represented by the organization name.
+	GetMDMAppleDefaultSetupAssistant(ctx context.Context, teamID *uint, abmTokenOrgName string) (profileUUID string, updatedAt time.Time, err error)
 
 	// GetMatchingHostSerials receives a list of serial numbers and returns
 	// a map that only contains the serials that have a matching row in the `hosts` table.
@@ -1254,7 +1297,7 @@ type Datastore interface {
 	// ScreenDEPAssignProfileSerialsForCooldown returns the serials that are still in cooldown and the
 	// ones that are ready to be assigned a profile. If `screenRetryJobs` is true, it will also skip
 	// any serials that have a non-zero `retry_job_id`.
-	ScreenDEPAssignProfileSerialsForCooldown(ctx context.Context, serials []string) (skipSerials []string, assignSerials []string, err error)
+	ScreenDEPAssignProfileSerialsForCooldown(ctx context.Context, serials []string) (skipSerialsByOrgName map[string][]string, serialsByOrgName map[string][]string, err error)
 	// GetDEPAssignProfileExpiredCooldowns returns the serials of the hosts that have expired
 	// cooldowns, grouped by team.
 	GetDEPAssignProfileExpiredCooldowns(ctx context.Context) (map[uint][]string, error)
@@ -1286,6 +1329,10 @@ type Datastore interface {
 	// the provided value.
 	MDMAppleSetPendingDeclarationsAs(ctx context.Context, hostUUID string, status *MDMDeliveryStatus, detail string) error
 
+	// GetMDMAppleOSUpdatesSettingsByHostSerial returns applicable Apple OS update settings (if any)
+	// for the host with the given serial number. The host must be DEP assigned to Fleet.
+	GetMDMAppleOSUpdatesSettingsByHostSerial(ctx context.Context, hostSerial string) (*AppleOSUpdateSettings, error)
+
 	// InsertMDMConfigAssets inserts MDM related config assets, such as SCEP and APNS certs and keys.
 	InsertMDMConfigAssets(ctx context.Context, assets []MDMConfigAsset) error
 
@@ -1309,6 +1356,54 @@ type Datastore interface {
 	// generated ones.
 	ReplaceMDMConfigAssets(ctx context.Context, assets []MDMConfigAsset) error
 
+	// GetABMTokenByOrgName retrieves the Apple Business Manager token identified by
+	// its unique name (the organization name).
+	GetABMTokenByOrgName(ctx context.Context, orgName string) (*ABMToken, error)
+
+	// SaveABMToken updates the ABM token using the provided struct.
+	SaveABMToken(ctx context.Context, tok *ABMToken) error
+
+	InsertVPPToken(ctx context.Context, tok *VPPTokenData) (*VPPTokenDB, error)
+	ListVPPTokens(ctx context.Context) ([]*VPPTokenDB, error)
+	GetVPPToken(ctx context.Context, tokenID uint) (*VPPTokenDB, error)
+	GetVPPTokenByTeamID(ctx context.Context, teamID *uint) (*VPPTokenDB, error)
+	// UpdateVPPTokenTeams sets the teams associated with this token.
+	// Note that updating the token's associations removes all
+	// apps-team associations using this token
+	UpdateVPPTokenTeams(ctx context.Context, id uint, teams []uint) (*VPPTokenDB, error)
+	UpdateVPPToken(ctx context.Context, id uint, tok *VPPTokenData) (*VPPTokenDB, error)
+	DeleteVPPToken(ctx context.Context, tokenID uint) error
+
+	// SetABMTokenTermsExpiredForOrgName is a specialized method to set only the
+	// terms_expired flag of the ABM token identified by the organization name.
+	// It returns whether that flag was previously set for this token.
+	SetABMTokenTermsExpiredForOrgName(ctx context.Context, orgName string, expired bool) (wasSet bool, err error)
+
+	// CountABMTokensWithTermsExpired returns a count of ABM tokens that are
+	// flagged with the Apple BM terms expired.
+	CountABMTokensWithTermsExpired(ctx context.Context) (int, error)
+
+	// InsertABMToken inserts a new ABM token into the datastore.
+	InsertABMToken(ctx context.Context, tok *ABMToken) (*ABMToken, error)
+
+	// ListABMTokens lists all of the ABM tokens.
+	ListABMTokens(ctx context.Context) ([]*ABMToken, error)
+
+	// DeleteABMToken deletes the given ABM token from the datastore.
+	DeleteABMToken(ctx context.Context, tokenID uint) error
+
+	// GetABMTokenByID retrieves the ABM token with the given ID.
+	GetABMTokenByID(ctx context.Context, tokenID uint) (*ABMToken, error)
+
+	// GetABMTokenCount returns the number of ABM tokens in the DB.
+	GetABMTokenCount(ctx context.Context) (int, error)
+
+	// GetABMTokenOrgNamesAssociatedWithTeam returns the set of ABM organization
+	// names that correspond to the union of
+	// - the tokens used to create each of the DEP hosts in that team.
+	// - the tokens targeting that team as default for any platform.
+	GetABMTokenOrgNamesAssociatedWithTeam(ctx context.Context, teamID *uint) ([]string, error)
+
 	///////////////////////////////////////////////////////////////////////////////
 	// Microsoft MDM
 
@@ -1434,7 +1529,8 @@ type Datastore interface {
 
 	// BatchSetMDMProfiles sets the MDM Apple or Windows profiles for the given team or
 	// no team in a single transaction.
-	BatchSetMDMProfiles(ctx context.Context, tmID *uint, macProfiles []*MDMAppleConfigProfile, winProfiles []*MDMWindowsConfigProfile, macDeclarations []*MDMAppleDeclaration) error
+	BatchSetMDMProfiles(ctx context.Context, tmID *uint, macProfiles []*MDMAppleConfigProfile, winProfiles []*MDMWindowsConfigProfile,
+		macDeclarations []*MDMAppleDeclaration) (updates MDMProfilesUpdates, err error)
 
 	// NewMDMAppleDeclaration creates and returns a new MDM Apple declaration.
 	NewMDMAppleDeclaration(ctx context.Context, declaration *MDMAppleDeclaration) (*MDMAppleDeclaration, error)
@@ -1451,8 +1547,8 @@ type Datastore interface {
 	// SetHostScriptExecutionResult stores the result of a host script execution
 	// and returns the updated host script result record. Note that it does not
 	// fail if the script execution request does not exist, in this case it will
-	// return nil, nil.
-	SetHostScriptExecutionResult(ctx context.Context, result *HostScriptResultPayload) (*HostScriptResult, error)
+	// return nil, "", nil. action is populated if this script was an MDM action (lock/unlock/wipe/uninstall).
+	SetHostScriptExecutionResult(ctx context.Context, result *HostScriptResultPayload) (hsr *HostScriptResult, action string, err error)
 	// GetHostScriptExecutionResult returns the result of a host script
 	// execution. It returns the host script results even if no results have been
 	// received, it is the caller's responsibility to check if that was the case
@@ -1472,6 +1568,10 @@ type Datastore interface {
 	// script.
 	GetScriptContents(ctx context.Context, id uint) ([]byte, error)
 
+	// GetAnyScriptContents returns the raw script contents of the corresponding
+	// script, regardless whether it is present in the scripts table.
+	GetAnyScriptContents(ctx context.Context, id uint) ([]byte, error)
+
 	// DeleteScript deletes the script identified by its id.
 	DeleteScript(ctx context.Context, id uint) error
 
@@ -1542,19 +1642,49 @@ type Datastore interface {
 	// installer execution IDs that have not yet been run for a given host
 	ListPendingSoftwareInstalls(ctx context.Context, hostID uint) ([]string, error)
 
+	// GetHostLastInstallData returns the data for the last installation of a package on a host.
+	GetHostLastInstallData(ctx context.Context, hostID, installerID uint) (*HostLastInstallData, error)
+
 	// MatchOrCreateSoftwareInstaller matches or creates a new software installer.
 	MatchOrCreateSoftwareInstaller(ctx context.Context, payload *UploadSoftwareInstallerPayload) (uint, error)
 
 	// GetSoftwareInstallerMetadataByID returns the software installer corresponding to the installer id.
 	GetSoftwareInstallerMetadataByID(ctx context.Context, id uint) (*SoftwareInstaller, error)
 
+	// ValidateSoftwareInstallerAccess checks if a host has access to
+	// an installer. Access is granted if there is currently an unfinished
+	// install request present in host_software_installs
+	ValidateOrbitSoftwareInstallerAccess(ctx context.Context, hostID uint, installerID uint) (bool, error)
+
 	// GetSoftwareInstallerMetadataByTeamAndTitleID returns the software
 	// installer corresponding to the specified team and title ids. If
 	// withScriptContents is true, also returns the contents of the install and
 	// (if set) post-install scripts, otherwise those fields are left empty.
 	GetSoftwareInstallerMetadataByTeamAndTitleID(ctx context.Context, teamID *uint, titleID uint, withScriptContents bool) (*SoftwareInstaller, error)
 
-	GetVPPAppByTeamAndTitleID(ctx context.Context, teamID *uint, titleID uint, withScriptContents bool) (*VPPApp, error)
+	// GetSoftwareInstallersWithoutPackageIDs returns a map of software installers to storage ids that do not have a package ID.
+	GetSoftwareInstallersWithoutPackageIDs(ctx context.Context) (map[uint]string, error)
+
+	// UpdateSoftwareInstallerWithoutPackageIDs updates the software installer corresponding to the id. Used to add uninstall scripts.
+	UpdateSoftwareInstallerWithoutPackageIDs(ctx context.Context, id uint, payload UploadSoftwareInstallerPayload) error
+
+	// ProcessInstallerUpdateSideEffects handles, in a transaction, the following based on whether metadata
+	// or package are dirty:
+	// 1. If metadata or package were updated, removes host_software_installer and queued script records for
+	// pending non-VPP installs and uninstalls for an installer by its ID. See implementation for caveats.
+	// 2. If package was updated, marks host software installer rows for the supplied installer
+	// as removed, hiding them from stats calculations (note that this will null out installer statuses due
+	// to how the virtual column works).
+	ProcessInstallerUpdateSideEffects(ctx context.Context, installerID uint, wasMetadataUpdated bool, wasPackageUpdated bool) error
+
+	// SaveInstallerUpdates persists new values to an existing installer. See comments in the payload struct
+	// for which fields must be set.
+	SaveInstallerUpdates(ctx context.Context, payload *UpdateSoftwareInstallerPayload) error
+
+	// UpdateInstallerSelfServiceFlag sets an installer's self-service flag without modifying anything else
+	UpdateInstallerSelfServiceFlag(ctx context.Context, selfService bool, id uint) error
+
+	GetVPPAppByTeamAndTitleID(ctx context.Context, teamID *uint, titleID uint) (*VPPApp, error)
 	// GetVPPAppMetadataByTeamAndTitleID returns the VPP app corresponding to the
 	// specified team and title ids.
 	GetVPPAppMetadataByTeamAndTitleID(ctx context.Context, teamID *uint, titleID uint) (*VPPAppStoreApp, error)
@@ -1578,21 +1708,24 @@ type Datastore interface {
 
 	// CleanupUnusedSoftwareInstallers will remove software installers that have
 	// no references to them from the software_installers table.
-	CleanupUnusedSoftwareInstallers(ctx context.Context, softwareInstallStore SoftwareInstallerStore) error
+	CleanupUnusedSoftwareInstallers(ctx context.Context, softwareInstallStore SoftwareInstallerStore, removeCreatedBefore time.Time) error
 
 	// BatchSetSoftwareInstallers sets the software installers for the given team or no team.
 	BatchSetSoftwareInstallers(ctx context.Context, tmID *uint, installers []*UploadSoftwareInstallerPayload) error
+	GetSoftwareInstallers(ctx context.Context, tmID uint) ([]SoftwarePackageResponse, error)
 
 	// HasSelfServiceSoftwareInstallers returns true if self-service software installers are available for the team or globally.
 	HasSelfServiceSoftwareInstallers(ctx context.Context, platform string, teamID *uint) (bool, error)
 
 	BatchInsertVPPApps(ctx context.Context, apps []*VPPApp) error
-	GetAssignedVPPApps(ctx context.Context, teamID *uint) (map[VPPAppID]struct{}, error)
-	SetTeamVPPApps(ctx context.Context, teamID *uint, appIDs []VPPAppID) error
+	GetAssignedVPPApps(ctx context.Context, teamID *uint) (map[VPPAppID]VPPAppTeam, error)
+	SetTeamVPPApps(ctx context.Context, teamID *uint, appIDs []VPPAppTeam) error
 	InsertVPPAppWithTeam(ctx context.Context, app *VPPApp, teamID *uint) (*VPPApp, error)
 
-	InsertHostVPPSoftwareInstall(ctx context.Context, hostID, userID uint, appID VPPAppID, commandUUID, associatedEventID string) error
+	InsertHostVPPSoftwareInstall(ctx context.Context, hostID uint, appID VPPAppID, commandUUID, associatedEventID string, selfService bool) error
 	GetPastActivityDataForVPPAppInstall(ctx context.Context, commandResults *mdm.CommandResults) (*User, *ActivityInstalledAppStoreApp, error)
+
+	GetVPPTokenByLocation(ctx context.Context, loc string) (*VPPTokenDB, error)
 }
 
 // MDMAppleStore wraps nanomdm's storage and adds methods to deal with
@@ -1606,6 +1739,7 @@ type MDMAppleStore interface {
 
 type MDMAssetRetriever interface {
 	GetAllMDMConfigAssetsByName(ctx context.Context, assetNames []MDMAssetName) (map[MDMAssetName]MDMConfigAsset, error)
+	GetABMTokenByOrgName(ctx context.Context, orgName string) (*ABMToken, error)
 }
 
 // Cloner represents any type that can clone itself. Used for the cached_mysql
diff --git a/server/fleet/errors.go b/server/fleet/errors.go
index aee72fd458..2d3b53260b 100644
--- a/server/fleet/errors.go
+++ b/server/fleet/errors.go
@@ -20,9 +20,10 @@ var (
 	ErrMissingLicense        = &licenseError{}
 	ErrMDMNotConfigured      = &MDMNotConfiguredError{}
 
-	MDMNotConfiguredMessage        = "MDM features aren't turned on in Fleet. For more information about setting up MDM, please visit https://fleetdm.com/docs/using-fleet"
-	WindowsMDMNotConfiguredMessage = "Windows MDM isn't turned on. Visit https://fleetdm.com/docs/using-fleet to learn how to turn on MDM."
-	AppleMDMNotConfiguredMessage   = "macOS MDM isn't turned on. Visit https://fleetdm.com/docs/using-fleet to learn how to turn on MDM."
+	MDMNotConfiguredMessage              = "MDM features aren't turned on in Fleet. For more information about setting up MDM, please visit https://fleetdm.com/docs/using-fleet"
+	WindowsMDMNotConfiguredMessage       = "Windows MDM isn't turned on. Visit https://fleetdm.com/docs/using-fleet to learn how to turn on MDM."
+	AppleMDMNotConfiguredMessage         = "macOS MDM isn't turned on. Visit https://fleetdm.com/docs/using-fleet to learn how to turn on MDM."
+	AppleABMDefaultTeamDeprecatedMessage = "mdm.apple_bm_default_team has been deprecated. Please use the new mdm.apple_business_manager key documented here: https://fleetdm.com/learn-more-about/apple-business-manager-gitops"
 )
 
 // ErrWithStatusCode is an interface for errors that should set a specific HTTP
@@ -278,6 +279,36 @@ func (e PermissionError) PermissionError() []map[string]string {
 	return forbidden
 }
 
+// OTAForbiddenError is a special kind of forbidden error that intentionally
+// exposes information about the error so it can be shown in iPad/iPhone native
+// dialogs during OTA enrollment.
+//
+// I couldn't find any documentation but the way it works is:
+//
+// - if the response has a status code 403
+// - and the body has a `message` field
+//
+// the content of `message` will be displayed to the end user.
+type OTAForbiddenError struct {
+	ErrorWithUUID
+	InternalErr error
+}
+
+func (e OTAForbiddenError) Error() string {
+	return "Couldn't install the profile. Invalid enroll secret. Please contact your IT admin."
+}
+
+func (e OTAForbiddenError) StatusCode() int {
+	return http.StatusForbidden
+}
+
+func (e OTAForbiddenError) Internal() string {
+	if e.InternalErr == nil {
+		return ""
+	}
+	return e.InternalErr.Error()
+}
+
 // licenseError is returned when the application is not properly licensed.
 type licenseError struct {
 	ErrorWithUUID
diff --git a/server/fleet/hosts.go b/server/fleet/hosts.go
index ac0e86723d..2f07240b16 100644
--- a/server/fleet/hosts.go
+++ b/server/fleet/hosts.go
@@ -7,6 +7,8 @@ import (
 	"fmt"
 	"strings"
 	"time"
+
+	"github.com/Masterminds/semver"
 )
 
 type HostStatus string
@@ -1222,3 +1224,46 @@ func IsEligibleForDEPMigration(host *Host, mdmInfo *HostMDM, isConnectedToFleetM
 		// the checkout message from the host.
 		(!isConnectedToFleetMDM || mdmInfo.Name != WellKnownMDMFleet)
 }
+
+var macOSADEMigrationOnlyLastVersion = semver.MustParse("14")
+
+// IsEligibleForManualMigration returns true if the host is manually enrolled into a 3rd party MDM
+// and is able to migrate to Fleet.
+func IsEligibleForManualMigration(host *Host, mdmInfo *HostMDM, isConnectedToFleetMDM bool) (bool, error) {
+	goodVersion, err := IsMacOSMajorVersionOK(host)
+	if err != nil {
+		return false, fmt.Errorf("checking macOS version for manual migration eligibility: %w", err)
+	}
+
+	return goodVersion &&
+		host.IsOsqueryEnrolled() &&
+		!host.IsDEPAssignedToFleet() &&
+		mdmInfo != nil &&
+		!mdmInfo.InstalledFromDep &&
+		!mdmInfo.HasJSONProfileAssigned() &&
+		mdmInfo.Enrolled &&
+		(!isConnectedToFleetMDM || mdmInfo.Name != WellKnownMDMFleet), nil
+}
+
+func IsMacOSMajorVersionOK(host *Host) (bool, error) {
+	if host == nil {
+		return false, nil
+	}
+
+	parts := strings.Split(host.OSVersion, " ")
+
+	if len(parts) < 2 || parts[0] != "macOS" {
+		return false, nil
+	}
+
+	version, err := semver.NewVersion(parts[1])
+	if err != nil {
+		return false, fmt.Errorf("parsing macOS version \"%s\": %w", parts[1], err)
+	}
+
+	if version.GreaterThan(macOSADEMigrationOnlyLastVersion) {
+		return true, nil
+	}
+
+	return false, nil
+}
diff --git a/server/fleet/hosts_test.go b/server/fleet/hosts_test.go
index 94d0cd40a0..49c781e81f 100644
--- a/server/fleet/hosts_test.go
+++ b/server/fleet/hosts_test.go
@@ -222,6 +222,8 @@ func TestIsEligibleForDEPMigration(t *testing.T) {
 		depProfileResponse      DEPAssignProfileResponseStatus
 		enrolledInThirdPartyMDM bool
 		expected                bool
+		expectedManual          bool
+		hostOS                  string
 	}{
 		{
 			name:                    "Eligible for DEP migration",
@@ -230,6 +232,7 @@ func TestIsEligibleForDEPMigration(t *testing.T) {
 			depProfileResponse:      DEPAssignProfileResponseSuccess,
 			enrolledInThirdPartyMDM: true,
 			expected:                true,
+			expectedManual:          false,
 		},
 		{
 			name:                    "Not eligible - osqueryHostID nil",
@@ -238,6 +241,7 @@ func TestIsEligibleForDEPMigration(t *testing.T) {
 			depProfileResponse:      DEPAssignProfileResponseSuccess,
 			enrolledInThirdPartyMDM: true,
 			expected:                false,
+			expectedManual:          false,
 		},
 		{
 			name:                    "Not eligible - not DEP assigned to Fleet",
@@ -246,6 +250,7 @@ func TestIsEligibleForDEPMigration(t *testing.T) {
 			depProfileResponse:      DEPAssignProfileResponseSuccess,
 			enrolledInThirdPartyMDM: true,
 			expected:                false,
+			expectedManual:          false,
 		},
 		{
 			name:                    "Not eligible - not enrolled in third-party MDM",
@@ -254,6 +259,7 @@ func TestIsEligibleForDEPMigration(t *testing.T) {
 			depProfileResponse:      DEPAssignProfileResponseSuccess,
 			enrolledInThirdPartyMDM: false,
 			expected:                false,
+			expectedManual:          false,
 		},
 		{
 			name:                    "Not eligible - not DEP assigned and DEP profile failed",
@@ -262,6 +268,8 @@ func TestIsEligibleForDEPMigration(t *testing.T) {
 			depProfileResponse:      DEPAssignProfileResponseNotAccessible,
 			enrolledInThirdPartyMDM: true,
 			expected:                false,
+			expectedManual:          true,
+			hostOS:                  "macOS 14.5",
 		},
 		{
 			name:                    "Not eligible - DEP assigned and DEP profile failed",
@@ -270,6 +278,7 @@ func TestIsEligibleForDEPMigration(t *testing.T) {
 			depProfileResponse:      DEPAssignProfileResponseFailed,
 			enrolledInThirdPartyMDM: true,
 			expected:                false,
+			expectedManual:          false,
 		},
 		{
 			name:                    "Not eligible - DEP assigned but not response yet",
@@ -278,6 +287,7 @@ func TestIsEligibleForDEPMigration(t *testing.T) {
 			depProfileResponse:      "",
 			enrolledInThirdPartyMDM: true,
 			expected:                false,
+			expectedManual:          false,
 		},
 		{
 			name:                    "Not eligible - DEP assigned but not accessible",
@@ -286,6 +296,27 @@ func TestIsEligibleForDEPMigration(t *testing.T) {
 			depProfileResponse:      DEPAssignProfileResponseNotAccessible,
 			enrolledInThirdPartyMDM: true,
 			expected:                false,
+			expectedManual:          false,
+		},
+		{
+			name:                    "Manual migration eligible - enrolled in 3rd party, but not DEP",
+			osqueryHostID:           ptr.String("some-id"),
+			depAssignedToFleet:      ptr.Bool(false),
+			depProfileResponse:      "",
+			enrolledInThirdPartyMDM: true,
+			expected:                false,
+			expectedManual:          true,
+			hostOS:                  "macOS 14.5",
+		},
+		{
+			name:                    "Manual migration ineligible - enrolled in 3rd party, not DEP, but OS version too low",
+			osqueryHostID:           ptr.String("some-id"),
+			depAssignedToFleet:      ptr.Bool(false),
+			depProfileResponse:      "",
+			enrolledInThirdPartyMDM: true,
+			expected:                false,
+			expectedManual:          false,
+			hostOS:                  "macOS 13.9",
 		},
 	}
 
@@ -294,6 +325,7 @@ func TestIsEligibleForDEPMigration(t *testing.T) {
 			host := &Host{
 				OsqueryHostID:      tc.osqueryHostID,
 				DEPAssignedToFleet: tc.depAssignedToFleet,
+				OSVersion:          tc.hostOS,
 			}
 
 			mdmInfo := &HostMDM{
@@ -303,6 +335,9 @@ func TestIsEligibleForDEPMigration(t *testing.T) {
 			}
 
 			require.Equal(t, tc.expected, IsEligibleForDEPMigration(host, mdmInfo, false))
+			manual, err := IsEligibleForManualMigration(host, mdmInfo, false)
+			require.NoError(t, err)
+			require.Equal(t, tc.expectedManual, manual)
 		})
 	}
 }
diff --git a/server/fleet/mdm.go b/server/fleet/mdm.go
index a1e51f8ca7..0e5cf32971 100644
--- a/server/fleet/mdm.go
+++ b/server/fleet/mdm.go
@@ -43,6 +43,42 @@ func (a AppleBM) AuthzType() string {
 	return "mdm_apple"
 }
 
+// TODO: during API implementation, remove AppleBM above or reconciliate those
+// two types. We'll likely need a new authz type for the ABM token.
+type ABMToken struct {
+	ID                  uint      `db:"id" json:"id"`
+	AppleID             string    `db:"apple_id" json:"apple_id"`
+	OrganizationName    string    `db:"organization_name" json:"org_name"`
+	RenewAt             time.Time `db:"renew_at" json:"renew_date"`
+	TermsExpired        bool      `db:"terms_expired" json:"terms_expired"`
+	MacOSDefaultTeamID  *uint     `db:"macos_default_team_id" json:"-"`
+	IOSDefaultTeamID    *uint     `db:"ios_default_team_id" json:"-"`
+	IPadOSDefaultTeamID *uint     `db:"ipados_default_team_id" json:"-"`
+	EncryptedToken      []byte    `db:"token" json:"-"`
+
+	// MDMServerURL is not a database field, it is computed from the AppConfig's
+	// Server URL and the static path to the MDM endpoint (using
+	// apple_mdm.ResolveAppleMDMURL).
+	MDMServerURL string `db:"-" json:"mdm_server_url"`
+
+	// the following fields are not in the abm_tokens table, they must be queried
+	// by a LEFT JOIN on the corresponding team, coalesced to "No team" if
+	// null (no team).
+	MacOSTeamName  string `db:"macos_team" json:"-"`
+	IOSTeamName    string `db:"ios_team" json:"-"`
+	IPadOSTeamName string `db:"ipados_team" json:"-"`
+
+	// These fields are composed of the ID and name fields above, and are used in API responses.
+	MacOSTeam  ABMTokenTeam `json:"macos_team"`
+	IOSTeam    ABMTokenTeam `json:"ios_team"`
+	IPadOSTeam ABMTokenTeam `json:"ipados_team"`
+}
+
+type ABMTokenTeam struct {
+	Name string `json:"name"`
+	ID   uint   `json:"team_id"`
+}
+
 type AppleCSR struct {
 	// NOTE: []byte automatically JSON-encodes as a base64-encoded string
 	APNsKey  []byte `json:"apns_key"`
@@ -54,13 +90,15 @@ func (a AppleCSR) AuthzType() string {
 	return "mdm_apple"
 }
 
-// AppConfigUpdated is the minimal interface required to get and update the
-// AppConfig, as required to handle the DEP API errors to flag that Apple's
-// terms have changed and must be accepted. The Fleet Datastore satisfies
-// this interface.
-type AppConfigUpdater interface {
+// ABMTermsUpdater is the minimal interface required to get and update the
+// AppConfig, and set an ABM token's terms_expired flag as required to handle
+// the DEP API errors to indicate that Apple's terms have changed and must be
+// accepted. The Fleet Datastore satisfies this interface.
+type ABMTermsUpdater interface {
 	AppConfig(ctx context.Context) (*AppConfig, error)
 	SaveAppConfig(ctx context.Context, info *AppConfig) error
+	SetABMTokenTermsExpiredForOrgName(ctx context.Context, orgName string, expired bool) (wasSet bool, err error)
+	CountABMTokensWithTermsExpired(ctx context.Context) (int, error)
 }
 
 // MDMIdPAccount contains account information of a third-party IdP that can be
@@ -625,14 +663,19 @@ const (
 	// MDMAssetABMCert is the name of the ABM (Apple Business Manager)
 	// private key used to encrypt MDMAssetABMToken
 	MDMAssetABMCert MDMAssetName = "abm_cert"
-	// MDMAssetABMToken is an encrypted JSON file that contains a token
-	// that can be used for the authentication process with the ABM API
-	MDMAssetABMToken MDMAssetName = "abm_token"
+	// MDMAssetABMTokenDeprecated is an encrypted JSON file that contains a token
+	// that can be used for the authentication process with the ABM API.
+	// Deprecated: ABM tokens are now stored in the abm_tokens table, they are
+	// not in mdm_config_assets anymore.
+	MDMAssetABMTokenDeprecated MDMAssetName = "abm_token"
 	// MDMAssetSCEPChallenge defines the shared secret used to issue SCEP
 	// certificatges to Apple devices.
 	MDMAssetSCEPChallenge MDMAssetName = "scep_challenge"
-	// MDMAssetVPPToken is the name of the token used by MDM to authenticate to Apple's VPP service.
-	MDMAssetVPPToken MDMAssetName = "vpp_token"
+	// MDMAssetVPPTokenDeprecated is the name of the token used by MDM to
+	// authenticate to Apple's VPP service.
+	// Deprecated: VPP tokens are now stored in the vpp_tokens table, they are
+	// not in mdm_config_assets anymore.
+	MDMAssetVPPTokenDeprecated MDMAssetName = "vpp_token"
 )
 
 type MDMConfigAsset struct {
@@ -695,9 +738,10 @@ func FilterMacOSOnlyProfilesFromIOSIPadOS(profiles []*MDMAppleProfilePayload) []
 	return profiles[:i]
 }
 
-// RefetchCommandUUIDPrefix is the prefix used for MDM commands used to refetch information from iOS/iPadOS devices.
-const RefetchCommandUUIDPrefix = "REFETCH-"
-const RefetchAppsCommandUUIDPrefix = "REFETCH-APPS-"
+// RefetchBaseCommandUUIDPrefix and below command prefixes are the prefixes used for MDM commands used to refetch information from iOS/iPadOS devices.
+const RefetchBaseCommandUUIDPrefix = "REFETCH-"
+const RefetchDeviceCommandUUIDPrefix = RefetchBaseCommandUUIDPrefix + "DEVICE-"
+const RefetchAppsCommandUUIDPrefix = RefetchBaseCommandUUIDPrefix + "APPS-"
 
 // VPPTokenInfo is the representation of the VPP token that we send out via API.
 type VPPTokenInfo struct {
@@ -724,6 +768,50 @@ type VPPTokenData struct {
 	// structure of `VPPTokenRaw`.
 	Token string `json:"token"`
 }
+
+const VPPTimeFormat = "2006-01-02T15:04:05Z0700"
+
+// VPPTokenDB represents a VPP token record in the DB
+type VPPTokenDB struct {
+	ID        uint      `db:"id" json:"id"`
+	OrgName   string    `db:"organization_name" json:"org_name"`
+	Location  string    `db:"location" json:"location"`
+	RenewDate time.Time `db:"renew_at" json:"renew_date"`
+	// Token is the token dowloaded from ABM. It is the base64 encoded
+	// JSON object with the structure of `VPPTokenRaw`
+	Token string      `db:"token" json:"-"`
+	Teams []TeamTuple `json:"teams"`
+	// CreatedAt    time.Time `json:"created_at" db:"created_at"`
+	// UpdatedAt    time.Time `json:"updated_at" db:"updated_at"`
+}
+
+type TeamTuple struct {
+	ID   uint   `json:"team_id"`
+	Name string `json:"name"`
+}
+
+type NullTeamType string
+
+const (
+	// VPP token is inactive, only valid option if teamID is set.
+	NullTeamNone NullTeamType = "none"
+	// VPP token is available for all teams.
+	NullTeamAllTeams NullTeamType = "allteams"
+	// VPP token is available only for "No team" team.
+	NullTeamNoTeam NullTeamType = "noteam"
+)
+
+func (n NullTeamType) PrettyName() string {
+	switch n {
+	case NullTeamAllTeams:
+		return ReservedNameAllTeams
+	case NullTeamNoTeam:
+		return ReservedNameNoTeam
+	default:
+		return string(n)
+	}
+}
+
 type AppleDevice int
 
 const (
@@ -739,3 +827,42 @@ const (
 	IOSPlatform    AppleDevicePlatform = "ios"
 	IPadOSPlatform AppleDevicePlatform = "ipados"
 )
+
+var VPPAppsPlatforms = []AppleDevicePlatform{IOSPlatform, IPadOSPlatform, MacOSPlatform}
+
+type AppleDevicesToRefetch struct {
+	HostID              uint                   `db:"host_id"`
+	UUID                string                 `db:"uuid"`
+	CommandsAlreadySent MDMCommandsAlreadySent `db:"commands_already_sent"`
+}
+
+type MDMCommandsAlreadySent []string
+
+func (c *MDMCommandsAlreadySent) Scan(src interface{}) error {
+	if src == nil {
+		return nil
+	}
+
+	raw, ok := src.([]byte)
+	if !ok {
+		return fmt.Errorf("unexpected type for MDMCommandsAlreadySent: %T", src)
+	}
+	// Filter out [null] command types which MySQL returns when there are no commands_already_sent.
+	// For details, see: https://dev.mysql.com/doc/refman/8.4/en/aggregate-functions.html#function_json-arrayagg
+	if string(raw) == "[null]" {
+		*c = nil
+		return nil
+	}
+
+	var commands MDMCommandsAlreadySent
+	if err := json.Unmarshal(raw, &commands); err != nil {
+		return err
+	}
+	*c = commands
+	return nil
+}
+
+type HostMDMCommand struct {
+	HostID      uint   `db:"host_id"`
+	CommandType string `db:"command_type"`
+}
diff --git a/server/fleet/mdm_test.go b/server/fleet/mdm_test.go
index a1dd3d49d5..256b65be64 100644
--- a/server/fleet/mdm_test.go
+++ b/server/fleet/mdm_test.go
@@ -8,6 +8,7 @@ import (
 	"regexp"
 	"testing"
 
+	ctxabm "github.com/fleetdm/fleet/v4/server/contexts/apple_bm"
 	"github.com/fleetdm/fleet/v4/server/fleet"
 	fleetmdm "github.com/fleetdm/fleet/v4/server/mdm"
 	apple_mdm "github.com/fleetdm/fleet/v4/server/mdm/apple"
@@ -20,8 +21,6 @@ import (
 )
 
 func TestDEPClient(t *testing.T) {
-	ctx := context.Background()
-
 	rxToken := regexp.MustCompile(`oauth_token="(\w+)"`)
 	const (
 		validToken                 = "OK"
@@ -79,49 +78,116 @@ func TestDEPClient(t *testing.T) {
 		return nil
 	}
 
-	checkDSCalled := func(readInvoked, writeInvoked bool) {
+	termsExpiredByOrgName := map[string]bool{
+		"org1": false,
+		"org2": false,
+	}
+	ds.SetABMTokenTermsExpiredForOrgNameFunc = func(ctx context.Context, orgName string, expired bool) (wasSet bool, err error) {
+		was, ok := termsExpiredByOrgName[orgName]
+		if !ok {
+			return expired, nil
+		}
+		termsExpiredByOrgName[orgName] = expired
+		return was, nil
+	}
+	ds.CountABMTokensWithTermsExpiredFunc = func(ctx context.Context) (int, error) {
+		count := 0
+		for _, expired := range termsExpiredByOrgName {
+			if expired {
+				count++
+			}
+		}
+		return count, nil
+	}
+
+	checkDSCalled := func(readInvoked, writeTokInvoked, writeAppCfgInvoked bool) {
 		require.Equal(t, readInvoked, ds.AppConfigFuncInvoked)
-		require.Equal(t, writeInvoked, ds.SaveAppConfigFuncInvoked)
+		require.Equal(t, readInvoked, ds.CountABMTokensWithTermsExpiredFuncInvoked)
+		require.Equal(t, writeTokInvoked, ds.SetABMTokenTermsExpiredForOrgNameFuncInvoked)
+		require.Equal(t, writeAppCfgInvoked, ds.SaveAppConfigFuncInvoked)
 		ds.AppConfigFuncInvoked = false
+		ds.CountABMTokensWithTermsExpiredFuncInvoked = false
 		ds.SaveAppConfigFuncInvoked = false
+		ds.SetABMTokenTermsExpiredForOrgNameFuncInvoked = false
 	}
 
 	cases := []struct {
-		token        string
-		wantErr      bool
-		readInvoked  bool
-		writeInvoked bool
-		termsFlag    bool
+		token               string
+		orgName             string
+		wantErr             bool
+		readInvoked         bool
+		writeTokInvoked     bool
+		writeAppCfgInvoked  bool
+		wantAppCfgTermsFlag bool
+		wantToksTermsFlags  map[string]bool
 	}{
 		// use a valid token, appconfig should not be updated (already unflagged)
-		{token: validToken, wantErr: false, readInvoked: true, writeInvoked: false, termsFlag: false},
+		{token: validToken, orgName: "org1", wantErr: false, readInvoked: true, writeTokInvoked: false,
+			writeAppCfgInvoked: false, wantAppCfgTermsFlag: false, wantToksTermsFlags: map[string]bool{"org1": false, "org2": false}},
+
+		// use a valid token without org, nothing is checked
+		{token: validToken, orgName: "", wantErr: false, readInvoked: false, writeTokInvoked: false,
+			writeAppCfgInvoked: false, wantAppCfgTermsFlag: false, wantToksTermsFlags: map[string]bool{"org1": false, "org2": false}},
+
+		// use an invalid token without org, call fails but nothing is checked because this is an unsaved token
+		{token: invalidToken, orgName: "", wantErr: true, readInvoked: false, writeTokInvoked: false,
+			writeAppCfgInvoked: false, wantAppCfgTermsFlag: false, wantToksTermsFlags: map[string]bool{"org1": false, "org2": false}},
 
 		// use an invalid token, appconfig should not even be read (not a terms error)
-		{token: invalidToken, wantErr: true, readInvoked: false, writeInvoked: false, termsFlag: false},
+		{token: invalidToken, orgName: "org1", wantErr: true, readInvoked: false, writeTokInvoked: false,
+			writeAppCfgInvoked: false, wantAppCfgTermsFlag: false, wantToksTermsFlags: map[string]bool{"org1": false, "org2": false}},
 
-		// terms changed during the auth request
-		{token: termsChangedToken, wantErr: true, readInvoked: true, writeInvoked: true, termsFlag: true},
+		// terms changed for org1 during the auth request
+		{token: termsChangedToken, orgName: "org1", wantErr: true, readInvoked: true, writeTokInvoked: true,
+			writeAppCfgInvoked: true, wantAppCfgTermsFlag: true, wantToksTermsFlags: map[string]bool{"org1": true, "org2": false}},
 
 		// use of an invalid token does not update the flag
-		{token: invalidToken, wantErr: true, readInvoked: false, writeInvoked: false, termsFlag: true},
+		{token: invalidToken, orgName: "org1", wantErr: true, readInvoked: false, writeTokInvoked: false,
+			writeAppCfgInvoked: false, wantAppCfgTermsFlag: true, wantToksTermsFlags: map[string]bool{"org1": true, "org2": false}},
 
-		// use of a valid token resets the flag
-		{token: validToken, wantErr: false, readInvoked: true, writeInvoked: true, termsFlag: false},
+		// use of a valid token for org1 resets the flags
+		{token: validToken, orgName: "org1", wantErr: false, readInvoked: true, writeTokInvoked: true,
+			writeAppCfgInvoked: true, wantAppCfgTermsFlag: false, wantToksTermsFlags: map[string]bool{"org1": false, "org2": false}},
 
-		// use of a valid token again does not update the appConfig
-		{token: validToken, wantErr: false, readInvoked: true, writeInvoked: false, termsFlag: false},
+		// use of a valid token again with org2 does not update anything
+		{token: validToken, orgName: "org2", wantErr: false, readInvoked: true, writeTokInvoked: false,
+			writeAppCfgInvoked: false, wantAppCfgTermsFlag: false, wantToksTermsFlags: map[string]bool{"org1": false, "org2": false}},
 
-		// terms changed during the actual account request, after auth
-		{token: termsChangedAfterAuthToken, wantErr: true, readInvoked: true, writeInvoked: true, termsFlag: true},
+		// terms changed for org2 during the actual account request, after auth
+		{token: termsChangedAfterAuthToken, orgName: "org2", wantErr: true, readInvoked: true, writeTokInvoked: true,
+			writeAppCfgInvoked: true, wantAppCfgTermsFlag: true, wantToksTermsFlags: map[string]bool{"org1": false, "org2": true}},
 
-		// again terms changed after auth, doesn't update appConfig
-		{token: termsChangedAfterAuthToken, wantErr: true, readInvoked: true, writeInvoked: false, termsFlag: true},
+		// again terms changed after auth for org2, doesn't update appConfig
+		{token: termsChangedAfterAuthToken, orgName: "org2", wantErr: true, readInvoked: true, writeTokInvoked: true,
+			writeAppCfgInvoked: false, wantAppCfgTermsFlag: true, wantToksTermsFlags: map[string]bool{"org1": false, "org2": true}},
 
-		// terms changed during auth, doesn't update appConfig
-		{token: termsChangedToken, wantErr: true, readInvoked: true, writeInvoked: false, termsFlag: true},
+		// terms changed during auth for org2, doesn't update appConfig
+		{token: termsChangedToken, orgName: "org2", wantErr: true, readInvoked: true, writeTokInvoked: true,
+			writeAppCfgInvoked: false, wantAppCfgTermsFlag: true, wantToksTermsFlags: map[string]bool{"org1": false, "org2": true}},
 
-		// valid token, resets the flag
-		{token: validToken, wantErr: false, readInvoked: true, writeInvoked: true, termsFlag: false},
+		// terms changed during auth for org1, now both tokens have the flag, doesn't update appConfig
+		{token: termsChangedToken, orgName: "org1", wantErr: true, readInvoked: true, writeTokInvoked: true,
+			writeAppCfgInvoked: false, wantAppCfgTermsFlag: true, wantToksTermsFlags: map[string]bool{"org1": true, "org2": true}},
+
+		// use a valid token without org, nothing is checked
+		{token: validToken, orgName: "", wantErr: false, readInvoked: false, writeTokInvoked: false,
+			writeAppCfgInvoked: false, wantAppCfgTermsFlag: true, wantToksTermsFlags: map[string]bool{"org1": true, "org2": true}},
+
+		// use an invalid token without org, call fails but nothing is checked because this is an unsaved token
+		{token: invalidToken, orgName: "", wantErr: true, readInvoked: false, writeTokInvoked: false,
+			writeAppCfgInvoked: false, wantAppCfgTermsFlag: true, wantToksTermsFlags: map[string]bool{"org1": true, "org2": true}},
+
+		// valid token for org1, resets that token's flag but not appConfig
+		{token: validToken, orgName: "org1", wantErr: false, readInvoked: true, writeTokInvoked: true,
+			writeAppCfgInvoked: false, wantAppCfgTermsFlag: true, wantToksTermsFlags: map[string]bool{"org1": false, "org2": true}},
+
+		// valid token again for org1, still no write to appConfig
+		{token: validToken, orgName: "org1", wantErr: false, readInvoked: true, writeTokInvoked: true,
+			writeAppCfgInvoked: false, wantAppCfgTermsFlag: true, wantToksTermsFlags: map[string]bool{"org1": false, "org2": true}},
+
+		// valid token again for org2, this time resets appConfig
+		{token: validToken, orgName: "org2", wantErr: false, readInvoked: true, writeTokInvoked: true,
+			writeAppCfgInvoked: true, wantAppCfgTermsFlag: false, wantToksTermsFlags: map[string]bool{"org1": false, "org2": false}},
 	}
 
 	// order of calls is important, and test must not be parallelized as it would
@@ -130,6 +196,8 @@ func TestDEPClient(t *testing.T) {
 	for i, c := range cases {
 		t.Logf("case %d", i)
 
+		ctx := context.Background()
+
 		store := &nanodep_mock.Storage{}
 		store.RetrieveAuthTokensFunc = func(ctx context.Context, name string) (*nanodep_client.OAuth1Tokens, error) {
 			return &nanodep_client.OAuth1Tokens{AccessToken: c.token}, nil
@@ -139,7 +207,14 @@ func TestDEPClient(t *testing.T) {
 		}
 
 		dep := apple_mdm.NewDEPClient(store, ds, logger)
-		res, err := dep.AccountDetail(ctx, apple_mdm.DEPName)
+		orgName := c.orgName
+		if orgName == "" {
+			// simulate using a new token, not yet saved in the DB, so we pass the
+			// token directly in the context
+			ctx = ctxabm.NewContext(ctx, &nanodep_client.OAuth1Tokens{AccessToken: c.token})
+			orgName = apple_mdm.UnsavedABMTokenOrgName
+		}
+		res, err := dep.AccountDetail(ctx, orgName)
 
 		if c.wantErr {
 			var httpErr *godep.HTTPError
@@ -162,8 +237,9 @@ func TestDEPClient(t *testing.T) {
 			require.True(t, store.RetrieveAuthTokensFuncInvoked)
 			require.True(t, store.RetrieveConfigFuncInvoked)
 		}
-		checkDSCalled(c.readInvoked, c.writeInvoked)
-		require.Equal(t, c.termsFlag, appCfg.MDM.AppleBMTermsExpired)
+		checkDSCalled(c.readInvoked, c.writeTokInvoked, c.writeAppCfgInvoked)
+		require.Equal(t, c.wantAppCfgTermsFlag, appCfg.MDM.AppleBMTermsExpired)
+		require.Equal(t, c.wantToksTermsFlags, termsExpiredByOrgName)
 	}
 }
 
diff --git a/server/fleet/policies.go b/server/fleet/policies.go
index 6ce5e38097..53849a6227 100644
--- a/server/fleet/policies.go
+++ b/server/fleet/policies.go
@@ -30,8 +30,44 @@ type PolicyPayload struct {
 	//
 	// Empty string targets all platforms.
 	Platform string
-	// CalendarEventsEnabled indicates whether calendar events are enabled for the policy. Only applies to team policies.
+	// CalendarEventsEnabled indicates whether calendar events are enabled for the policy.
+	//
+	// Only applies to team policies.
 	CalendarEventsEnabled bool
+	// SoftwareInstallerID is the ID of the software installer that will be installed if the policy fails.
+	//
+	// Only applies to team policies.
+	SoftwareInstallerID *uint
+}
+
+// NewTeamPolicyPayload holds data for team policy creation.
+//
+// If QueryID is not nil, then Name, Query and Description are ignored
+// (such fields are fetched from the queries table).
+type NewTeamPolicyPayload struct {
+	// QueryID allows creating a policy from an existing query.
+	//
+	// Using QueryID is the old way of creating policies.
+	// Use Query, Name and Description instead.
+	QueryID *uint
+	// Name is the name of the policy (ignored if QueryID != nil).
+	Name string
+	// Query is the policy query (ignored if QueryID != nil).
+	Query string
+	// Critical marks the policy as high impact.
+	Critical bool
+	// Description is the policy description text (ignored if QueryID != nil).
+	Description string
+	// Resolution indicates the steps needed to solve a failing policy.
+	Resolution string
+	// Platform is a comma-separated string to indicate the target platforms.
+	//
+	// Empty string targets all platforms.
+	Platform string
+	// CalendarEventsEnabled indicates whether calendar events are enabled for the policy.
+	CalendarEventsEnabled bool
+	// SoftwareTitleID is the ID of the software title that will be installed if the policy fails.
+	SoftwareTitleID *uint
 }
 
 var (
@@ -41,6 +77,9 @@ var (
 	errPolicyInvalidPlatform = errors.New("invalid policy platform")
 )
 
+// PolicyNoTeamID is the team ID of "No team" policies.
+const PolicyNoTeamID = uint(0)
+
 // Verify verifies the policy payload is valid.
 func (p PolicyPayload) Verify() error {
 	if p.QueryID != nil {
@@ -109,8 +148,15 @@ type ModifyPolicyPayload struct {
 	Platform *string `json:"platform"`
 	// Critical marks the policy as high impact.
 	Critical *bool `json:"critical" premium:"true"`
-	// CalendarEventsEnabled indicates whether calendar events are enabled for the policy. Only applies to team policies.
+	// CalendarEventsEnabled indicates whether calendar events are enabled for the policy.
+	//
+	// Only applies to team policies.
 	CalendarEventsEnabled *bool `json:"calendar_events_enabled" premium:"true"`
+	// SoftwareTitleID is the ID of the software title that will be installed if the policy fails.
+	// Value 0 will unset the current installer from the policy.
+	//
+	// Only applies to team policies.
+	SoftwareTitleID *uint `json:"software_title_id" premium:"true"`
 }
 
 // Verify verifies the policy payload is valid.
@@ -163,7 +209,8 @@ type PolicyData struct {
 	// Empty string targets all platforms.
 	Platform string `json:"platform" db:"platforms"`
 
-	CalendarEventsEnabled bool `json:"calendar_events_enabled" db:"calendar_events_enabled"`
+	CalendarEventsEnabled bool  `json:"calendar_events_enabled" db:"calendar_events_enabled"`
+	SoftwareInstallerID   *uint `json:"-" db:"software_installer_id"`
 
 	UpdateCreateTimestamps
 }
@@ -177,6 +224,14 @@ type Policy struct {
 	// FailingHostCount is the number of hosts this policy fails on.
 	FailingHostCount   uint       `json:"failing_host_count" db:"failing_host_count"`
 	HostCountUpdatedAt *time.Time `json:"host_count_updated_at" db:"host_count_updated_at"`
+
+	// InstallSoftware is used to trigger installation of a software title
+	// when this policy fails.
+	//
+	// Only applies to team policies.
+	//
+	// This field is populated from PolicyData.SoftwareInstallerID.
+	InstallSoftware *PolicySoftwareTitle `json:"install_software,omitempty"`
 }
 
 type PolicyCalendarData struct {
@@ -184,6 +239,11 @@ type PolicyCalendarData struct {
 	Name string `db:"name" json:"name"`
 }
 
+type PolicySoftwareInstallerData struct {
+	ID          uint `db:"id"`
+	InstallerID uint `db:"software_installer_id"`
+}
+
 // PolicyLite is a stripped down version of the policy.
 type PolicyLite struct {
 	ID uint `db:"id"`
@@ -232,8 +292,22 @@ type PolicySpec struct {
 	//
 	// Empty string targets all platforms.
 	Platform string `json:"platform,omitempty"`
-	// CalendarEventsEnabled indicates whether calendar events are enabled for the policy. Only applies to team policies.
+	// CalendarEventsEnabled indicates whether calendar events are enabled for the policy.
+	//
+	// Only applies to team policies.
 	CalendarEventsEnabled bool `json:"calendar_events_enabled"`
+	// SoftwareTitleID is the title ID of the installer associated with this policy.
+	// When editing a policy, if this is nil or 0 then the title ID is unset from the policy.
+	SoftwareTitleID *uint `json:"software_title_id"`
+}
+
+// PolicySoftwareTitle contains software title data for policies.
+type PolicySoftwareTitle struct {
+	// SoftwareTitleID is the ID of the title associated to the policy.
+	SoftwareTitleID uint `json:"software_title_id"`
+	// Name is the associated installer title name
+	// (not the package name, but the installed software title).
+	Name string `json:"name"`
 }
 
 // Verify verifies the policy data is valid.
diff --git a/server/fleet/scripts.go b/server/fleet/scripts.go
index 95e585aaf3..c6aeeaa934 100644
--- a/server/fleet/scripts.go
+++ b/server/fleet/scripts.go
@@ -372,6 +372,7 @@ type SoftwareInstallerPayload struct {
 	URL               string `json:"url"`
 	PreInstallQuery   string `json:"pre_install_query"`
 	InstallScript     string `json:"install_script"`
+	UninstallScript   string `json:"uninstall_script"`
 	PostInstallScript string `json:"post_install_script"`
 	SelfService       bool   `json:"self_service"`
 }
diff --git a/server/fleet/service.go b/server/fleet/service.go
index 0148eb4162..24756ebb6d 100644
--- a/server/fleet/service.go
+++ b/server/fleet/service.go
@@ -637,12 +637,21 @@ type Service interface {
 	// InstallSoftwareTitle installs a software title in the given host.
 	InstallSoftwareTitle(ctx context.Context, hostID uint, softwareTitleID uint) error
 
+	// UninstallSoftwareTitle uninstalls a software title in the given host.
+	UninstallSoftwareTitle(ctx context.Context, hostID uint, softwareTitleID uint) error
+
 	// GetSoftwareInstallResults gets the results for a particular software install attempt.
 	GetSoftwareInstallResults(ctx context.Context, installUUID string) (*HostSoftwareInstallerResult, error)
 
-	// BatchSetSoftwareInstallers replaces the software installers for a
-	// specified team
-	BatchSetSoftwareInstallers(ctx context.Context, tmName string, payloads []SoftwareInstallerPayload, dryRun bool) error
+	// BatchSetSoftwareInstallers asynchronously replaces the software installers for a specified team.
+	// Returns a request UUID that can be used to track an ongoing batch request (with GetBatchSetSoftwareInstallersResult).
+	BatchSetSoftwareInstallers(ctx context.Context, tmName string, payloads []SoftwareInstallerPayload, dryRun bool) (string, error)
+	// GetBatchSetSoftwareInstallersResult polls for the status of a batch-apply started by BatchSetSoftwareInstallers.
+	// Return values:
+	//	- 'status': status of the batch-apply which can be "processing", "completed" or "failed".
+	//	- 'message': which contains error information when the status is "failed".
+	//	- 'packages': Contains the list of the applied software packages (when status is "completed"). This is always empty for a dry run.
+	GetBatchSetSoftwareInstallersResult(ctx context.Context, tmName string, requestUUID string, dryRun bool) (status string, message string, packages []SoftwarePackageResponse, err error)
 
 	// SelfServiceInstallSoftwareTitle installs a software title
 	// initiated by the user
@@ -653,7 +662,33 @@ type Service interface {
 
 	GetAppStoreApps(ctx context.Context, teamID *uint) ([]*VPPApp, error)
 
-	AddAppStoreApp(ctx context.Context, teamID *uint, appID VPPAppID) error
+	AddAppStoreApp(ctx context.Context, teamID *uint, appTeam VPPAppTeam) error
+
+	// MDMAppleProcessOTAEnrollment handles OTA enrollment requests.
+	//
+	// Per the [spec][1] OTA enrollment is composed of two phases, each
+	// phase is a request sent by the host to the same endpoint, but it
+	// must be handled differently depending on the signatures of the
+	// request body:
+	//
+	// 1. First request has a certificate signed by Apple's CA as the root
+	// certificate. The server must return a SCEP payload that the device
+	// will use to get a keypair. Note that this keypair is _different_
+	// from the "SCEP identity certificate" that will be generated during
+	// MDM enrollment, and only used for OTA.
+	//
+	// 2. Second request has the SCEP certificate generated in `1` as the
+	// root certificate, the server responds with a "classic" enrollment
+	// profile and the device starts the regular enrollment process from there.
+	//
+	// The extra steps allows us to grab device information like the serial
+	// number and hardware uuid to perform operations before the host even
+	// enrolls in MDM. Currently, this method creates a host records and
+	// assigns a pre-defined team (based on the enrollSecret provided) to
+	// the host.
+	//
+	// [1]: https://developer.apple.com/library/archive/documentation/NetworkingInternet/Conceptual/iPhoneOTAConfiguration/Introduction/Introduction.html#//apple_ref/doc/uid/TP40009505-CH1-SW1
+	MDMAppleProcessOTAEnrollment(ctx context.Context, certificates []*x509.Certificate, rootSigner *x509.Certificate, enrollSecret string, deviceInfo MDMAppleMachineInfo) ([]byte, error)
 
 	// /////////////////////////////////////////////////////////////////////////////
 	// Vulnerabilities
@@ -661,7 +696,7 @@ type Service interface {
 	// ListVulnerabilities returns a list of vulnerabilities based on the provided options.
 	ListVulnerabilities(ctx context.Context, opt VulnListOptions) ([]VulnerabilityWithMetadata, *PaginationMetadata, error)
 	// ListVulnerability returns a vulnerability based on the provided CVE.
-	Vulnerability(ctx context.Context, cve string, teamID *uint, useCVSScores bool) (*VulnerabilityWithMetadata, error)
+	Vulnerability(ctx context.Context, cve string, teamID *uint, useCVSScores bool) (vuln *VulnerabilityWithMetadata, known bool, err error)
 	// CountVulnerabilities returns the number of vulnerabilities based on the provided options.
 	CountVulnerabilities(ctx context.Context, opt VulnListOptions) (uint, error)
 	// ListOSVersionsByCVE returns a list of OS versions affected by the provided CVE.
@@ -672,7 +707,7 @@ type Service interface {
 	// /////////////////////////////////////////////////////////////////////////////
 	// Team Policies
 
-	NewTeamPolicy(ctx context.Context, teamID uint, p PolicyPayload) (*Policy, error)
+	NewTeamPolicy(ctx context.Context, teamID uint, p NewTeamPolicyPayload) (*Policy, error)
 	ListTeamPolicies(ctx context.Context, teamID uint, opts ListOptions, iopts ListOptions, mergeInherited bool) (teamPolicies, inheritedPolicies []*Policy, err error)
 	DeleteTeamPolicies(ctx context.Context, teamID uint, ids []uint) ([]uint, error)
 	ModifyTeamPolicy(ctx context.Context, teamID uint, id uint, p ModifyPolicyPayload) (*Policy, error)
@@ -710,9 +745,12 @@ type Service interface {
 	UploadMDMAppleAPNSCert(ctx context.Context, cert io.ReadSeeker) error
 	DeleteMDMAppleAPNSCert(ctx context.Context) error
 
-	UploadMDMAppleVPPToken(ctx context.Context, token io.ReadSeeker) error
-	GetMDMAppleVPPToken(ctx context.Context) (*VPPTokenInfo, error)
-	DeleteMDMAppleVPPToken(ctx context.Context) error
+	UploadVPPToken(ctx context.Context, token io.ReadSeeker) (*VPPTokenDB, error)
+	UpdateVPPToken(ctx context.Context, id uint, token io.ReadSeeker) (*VPPTokenDB, error)
+	UpdateVPPTokenTeams(ctx context.Context, tokenID uint, teamIDs []uint) (*VPPTokenDB, error)
+	GetVPPTokens(ctx context.Context) ([]*VPPTokenDB, error)
+	DeleteVPPToken(ctx context.Context, tokenID uint) error
+
 	BatchAssociateVPPApps(ctx context.Context, teamName string, payloads []VPPBatchPayload, dryRun bool) error
 
 	// GetHostDEPAssignment retrieves the host DEP assignment for the specified host.
@@ -794,9 +832,6 @@ type Service interface {
 	// ListMDMAppleDevices lists all the MDM enrolled Apple devices.
 	ListMDMAppleDevices(ctx context.Context) ([]MDMAppleDevice, error)
 
-	// ListMDMAppleDEPDevices lists all the devices added to this MDM server in Apple Business Manager (ABM).
-	ListMDMAppleDEPDevices(ctx context.Context) ([]MDMAppleDEPDevice, error)
-
 	// NewMDMAppleDEPKeyPair creates a public private key pair for use with the Apple MDM DEP token.
 	//
 	// Deprecated: NewMDMAppleDEPKeyPair exists only to support a deprecated endpoint.
@@ -806,12 +841,21 @@ type Service interface {
 	// private keys to use in ABM to generate an encrypted auth token.
 	GenerateABMKeyPair(ctx context.Context) (*MDMAppleDEPKeyPair, error)
 
-	// SaveABMToken reads and validates if the provided token can be
+	// UploadABMToken reads and validates if the provided token can be
 	// decrypted using the keys stored in the database, then saves the token.
-	SaveABMToken(ctx context.Context, token io.Reader) error
+	UploadABMToken(ctx context.Context, token io.Reader) (*ABMToken, error)
 
-	// DisableABM disables ABM by soft-deleting the relevant assets
-	DisableABM(ctx context.Context) error
+	// ListABMTokens lists all the ABM tokens in Fleet.
+	ListABMTokens(ctx context.Context) ([]*ABMToken, error)
+
+	// UpdateABMTokenTeams updates the default macOS, iOS, and iPadOS team IDs for a given ABM token.
+	UpdateABMTokenTeams(ctx context.Context, tokenID uint, macOSTeamID, iOSTeamID, iPadOSTeamID *uint) (*ABMToken, error)
+
+	// DeleteABMToken deletes the given ABM token.
+	DeleteABMToken(ctx context.Context, tokenID uint) error
+
+	// RenewABMToken replaces the contents of the given ABM token with the given bytes.
+	RenewABMToken(ctx context.Context, token io.Reader, tokenID uint) (*ABMToken, error)
 
 	// EnqueueMDMAppleCommand enqueues a command for execution on the given
 	// devices. Note that a deviceID is the same as a host's UUID.
@@ -918,6 +962,12 @@ type Service interface {
 
 	GetMDMManualEnrollmentProfile(ctx context.Context) ([]byte, error)
 
+	// CheckMDMAppleEnrollmentWithMinimumOSVersion checks if the minimum OS version is met for a MDM enrollment
+	CheckMDMAppleEnrollmentWithMinimumOSVersion(ctx context.Context, m *MDMAppleMachineInfo) (*MDMAppleSoftwareUpdateRequired, error)
+
+	// GetOTAProfile gets the OTA (over-the-air) profile for a given team based on the enroll secret provided.
+	GetOTAProfile(ctx context.Context, enrollSecret string) ([]byte, error)
+
 	///////////////////////////////////////////////////////////////////////////////
 	// CronSchedulesService
 
@@ -1061,9 +1111,13 @@ type Service interface {
 	//
 
 	UploadSoftwareInstaller(ctx context.Context, payload *UploadSoftwareInstallerPayload) error
+	UpdateSoftwareInstaller(ctx context.Context, payload *UpdateSoftwareInstallerPayload) (*SoftwareInstaller, error)
 	DeleteSoftwareInstaller(ctx context.Context, titleID uint, teamID *uint) error
-	GetSoftwareInstallerMetadata(ctx context.Context, titleID uint, teamID *uint) (*SoftwareInstaller, error)
-	DownloadSoftwareInstaller(ctx context.Context, titleID uint, teamID *uint) (*DownloadSoftwareInstallerPayload, error)
+	GenerateSoftwareInstallerToken(ctx context.Context, alt string, titleID uint, teamID *uint) (string, error)
+	GetSoftwareInstallerTokenMetadata(ctx context.Context, token string, titleID uint) (*SoftwareInstallerTokenMetadata, error)
+	GetSoftwareInstallerMetadata(ctx context.Context, skipAuthz bool, titleID uint, teamID *uint) (*SoftwareInstaller, error)
+	DownloadSoftwareInstaller(ctx context.Context, skipAuthz bool, alt string, titleID uint,
+		teamID *uint) (*DownloadSoftwareInstallerPayload, error)
 	OrbitDownloadSoftwareInstaller(ctx context.Context, installerID uint) (*DownloadSoftwareInstallerPayload, error)
 
 	// /////////////////////////////////////////////////////////////////////////////
@@ -1072,3 +1126,17 @@ type Service interface {
 	// CalendarWebhook handles incoming calendar callback requests.
 	CalendarWebhook(ctx context.Context, eventUUID string, channelID string, resourceState string) error
 }
+
+type KeyValueStore interface {
+	Set(ctx context.Context, key string, value string, expireTime time.Duration) error
+	Get(ctx context.Context, key string) (*string, error)
+}
+
+const (
+	// BatchSetSoftwareInstallerStatusProcessing is the value returned for an ongoing BatchSetSoftwareInstallers operation.
+	BatchSetSoftwareInstallersStatusProcessing = "processing"
+	// BatchSetSoftwareInstallerStatusCompleted is the value returned for a completed BatchSetSoftwareInstallers operation.
+	BatchSetSoftwareInstallersStatusCompleted = "completed"
+	// BatchSetSoftwareInstallerStatusFailed is the value returned for a failed BatchSetSoftwareInstallers operation.
+	BatchSetSoftwareInstallersStatusFailed = "failed"
+)
diff --git a/server/fleet/software.go b/server/fleet/software.go
index efc004ffc5..9045d7e375 100644
--- a/server/fleet/software.go
+++ b/server/fleet/software.go
@@ -220,10 +220,14 @@ type SoftwareTitleListOptions struct {
 	// ListOptions cannot be embedded in order to unmarshall with validation.
 	ListOptions ListOptions `url:"list_options"`
 
-	TeamID              *uint `query:"team_id,optional"`
-	VulnerableOnly      bool  `query:"vulnerable,optional"`
-	AvailableForInstall bool  `query:"available_for_install,optional"`
-	SelfServiceOnly     bool  `query:"self_service,optional"`
+	TeamID              *uint   `query:"team_id,optional"`
+	VulnerableOnly      bool    `query:"vulnerable,optional"`
+	AvailableForInstall bool    `query:"available_for_install,optional"`
+	SelfServiceOnly     bool    `query:"self_service,optional"`
+	KnownExploit        bool    `query:"exploit,optional"`
+	MinimumCVSS         float64 `query:"min_cvss_score,optional"`
+	MaximumCVSS         float64 `query:"max_cvss_score,optional"`
+	PackagesOnly        bool    `query:"packages_only,optional"`
 }
 
 type HostSoftwareTitleListOptions struct {
@@ -240,9 +244,10 @@ type HostSoftwareTitleListOptions struct {
 	// install (but not currently installed on the host) should be returned.
 	IncludeAvailableForInstall bool
 
-	// AvailableForInstall is a query argument that limits the returned software
-	// titles to those that are available for install on the host.
-	AvailableForInstall bool `query:"available_for_install,optional"`
+	// OnlyAvailableForInstall is set via a query argument that limits the
+	// returned software titles to only those that are available for install on
+	// the host.
+	OnlyAvailableForInstall bool `query:"available_for_install,optional"`
 
 	VulnerableOnly bool `query:"vulnerable,optional"`
 }
@@ -291,6 +296,9 @@ type SoftwareListOptions struct {
 	TeamID           *uint `query:"team_id,optional"`
 	VulnerableOnly   bool  `query:"vulnerable,optional"`
 	IncludeCVEScores bool
+	KnownExploit     bool    `query:"exploit,optional"`
+	MinimumCVSS      float64 `query:"min_cvss_score,optional"`
+	MaximumCVSS      float64 `query:"max_cvss_score,optional"`
 
 	// WithHostCounts indicates that the list of software should include the
 	// counts of hosts per software, and include only those software that have
@@ -419,10 +427,12 @@ func SoftwareFromOsqueryRow(name, version, source, vendor, installedPath, releas
 }
 
 type VPPBatchPayload struct {
-	AppStoreID string `json:"app_store_id"`
+	AppStoreID  string `json:"app_store_id"`
+	SelfService bool   `json:"self_service"`
 }
 
 type VPPBatchPayloadWithPlatform struct {
-	AppStoreID string              `json:"app_store_id"`
-	Platform   AppleDevicePlatform `json:"platform"`
+	AppStoreID  string              `json:"app_store_id"`
+	SelfService bool                `json:"self_service"`
+	Platform    AppleDevicePlatform `json:"platform"`
 }
diff --git a/server/fleet/software_installer.go b/server/fleet/software_installer.go
index d542840989..09debe0695 100644
--- a/server/fleet/software_installer.go
+++ b/server/fleet/software_installer.go
@@ -9,6 +9,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/fleetdm/fleet/v4/pkg/optjson"
 	"github.com/fleetdm/fleet/v4/server/ptr"
 )
 
@@ -19,7 +20,7 @@ type SoftwareInstallerStore interface {
 	Get(ctx context.Context, installerID string) (io.ReadCloser, int64, error)
 	Put(ctx context.Context, installerID string, content io.ReadSeeker) error
 	Exists(ctx context.Context, installerID string) (bool, error)
-	Cleanup(ctx context.Context, usedInstallerIDs []string) (int, error)
+	Cleanup(ctx context.Context, usedInstallerIDs []string, removeCreatedBefore time.Time) (int, error)
 }
 
 // FailingSoftwareInstallerStore is an implementation of SoftwareInstallerStore
@@ -39,14 +40,14 @@ func (FailingSoftwareInstallerStore) Exists(ctx context.Context, installerID str
 	return false, errors.New("software installer store not properly configured")
 }
 
-func (FailingSoftwareInstallerStore) Cleanup(ctx context.Context, usedInstallerIDs []string) (int, error) {
+func (FailingSoftwareInstallerStore) Cleanup(ctx context.Context, usedInstallerIDs []string, removeCreatedBefore time.Time) (int, error) {
 	// do not fail for the failing store's cleanup, as unlike the other store
 	// methods, this will be called even if software installers are otherwise not
 	// used (by the cron job).
 	return 0, nil
 }
 
-// SoftwareInstallDetailsResult contains all of the information
+// SoftwareInstallDetails contains all of the information
 // required for a client to pull in and install software from the fleet server
 type SoftwareInstallDetails struct {
 	// HostID is used for authentication on the backend and should not
@@ -60,6 +61,8 @@ type SoftwareInstallDetails struct {
 	PreInstallCondition string `json:"pre_install_condition" db:"pre_install_condition"`
 	// InstallScript is the script to run to install the software package.
 	InstallScript string `json:"install_script" db:"install_script"`
+	// UninstallScript is the script to run to uninstall the software package.
+	UninstallScript string `json:"uninstall_script" db:"uninstall_script"`
 	// PostInstallScript is the script to run after installing the software package.
 	PostInstallScript string `json:"post_install_script" db:"post_install_script"`
 	// SelfService indicates the install was initiated by the device user
@@ -73,11 +76,17 @@ type SoftwareInstaller struct {
 	// no team.
 	TeamID *uint `json:"team_id" db:"team_id"`
 	// TitleID is the id of the software title associated with the software installer.
-	TitleID *uint `json:"-" db:"title_id"`
+	TitleID *uint `json:"title_id" db:"title_id"`
 	// Name is the name of the software package.
 	Name string `json:"name" db:"filename"`
+	// Extension is the file extension of the software package, inferred from package contents.
+	Extension string `json:"-" db:"extension"`
 	// Version is the version of the software package.
 	Version string `json:"version" db:"version"`
+	// Platform can be "darwin" (for pkgs), "windows" (for exes/msis) or "linux" (for debs).
+	Platform string `json:"platform" db:"platform"`
+	// PackageIDList is a comma-separated list of packages extracted from the installer
+	PackageIDList string `json:"-" db:"package_ids"`
 	// UploadedAt is the time the software package was uploaded.
 	UploadedAt time.Time `json:"uploaded_at" db:"uploaded_at"`
 	// InstallerID is the unique identifier for the software package metadata in Fleet.
@@ -86,10 +95,14 @@ type SoftwareInstaller struct {
 	InstallScript string `json:"install_script" db:"install_script"`
 	// InstallScriptContentID is the ID of the install script content.
 	InstallScriptContentID uint `json:"-" db:"install_script_content_id"`
+	// UninstallScriptContentID is the ID of the uninstall script content.
+	UninstallScriptContentID uint `json:"-" db:"uninstall_script_content_id"`
 	// PreInstallQuery is the query to run as a condition to installing the software package.
 	PreInstallQuery string `json:"pre_install_query" db:"pre_install_query"`
 	// PostInstallScript is the script to run after installing the software package.
 	PostInstallScript string `json:"post_install_script" db:"post_install_script"`
+	// UninstallScript is the script to run to uninstall the software package.
+	UninstallScript string `json:"uninstall_script" db:"uninstall_script"`
 	// PostInstallScriptContentID is the ID of the post-install script content.
 	PostInstallScriptContentID *uint `json:"-" db:"post_install_script_content_id"`
 	// StorageID is the unique identifier for the software package in the software installer store.
@@ -101,6 +114,19 @@ type SoftwareInstaller struct {
 	// SelfService indicates that the software can be installed by the
 	// end user without admin intervention
 	SelfService bool `json:"self_service" db:"self_service"`
+	// URL is the source URL for this installer (set when uploading via batch/gitops).
+	URL string `json:"url" db:"url"`
+}
+
+// SoftwarePackageResponse is the response type used when applying software by batch.
+type SoftwarePackageResponse struct {
+	// TeamID is the ID of the team.
+	// A value of nil means it is scoped to hosts that are assigned to "No team".
+	TeamID *uint `json:"team_id" db:"team_id"`
+	// TitleID is the id of the software title associated with the software installer.
+	TitleID *uint `json:"title_id" db:"title_id"`
+	// URL is the source URL for this installer (set when uploading via batch/gitops).
+	URL string `json:"url" db:"url"`
 }
 
 // AuthzType implements authz.AuthzTyper.
@@ -108,37 +134,67 @@ func (s *SoftwareInstaller) AuthzType() string {
 	return "installable_entity"
 }
 
+// PackageIDs turns the comma-separated string from the database into a list (potentially zero-length) of string package IDs
+func (s *SoftwareInstaller) PackageIDs() []string {
+	if s.PackageIDList == "" {
+		return []string{}
+	}
+
+	return strings.Split(s.PackageIDList, ",")
+}
+
 // SoftwareInstallerStatusSummary represents aggregated status metrics for a software installer package.
 type SoftwareInstallerStatusSummary struct {
 	// Installed is the number of hosts that have the software package installed.
 	Installed uint `json:"installed" db:"installed"`
-	// Pending is the number of hosts that have the software package pending installation.
-	Pending uint `json:"pending" db:"pending"`
-	// Failed is the number of hosts that have the software package installation failed.
-	Failed uint `json:"failed" db:"failed"`
+	// PendingInstall is the number of hosts that have the software package pending installation.
+	PendingInstall uint `json:"pending_install" db:"pending_install"`
+	// FailedInstall is the number of hosts that have the software package installation failed.
+	FailedInstall uint `json:"failed_install" db:"failed_install"`
+	// PendingUninstall is the number of hosts that have the software package pending installation.
+	PendingUninstall uint `json:"pending_uninstall" db:"pending_uninstall"`
+	// FailedInstall is the number of hosts that have the software package installation failed.
+	FailedUninstall uint `json:"failed_uninstall" db:"failed_uninstall"`
 }
 
 // SoftwareInstallerStatus represents the status of a software installer package on a host.
 type SoftwareInstallerStatus string
 
 const (
-	SoftwareInstallerPending   SoftwareInstallerStatus = "pending"
-	SoftwareInstallerFailed    SoftwareInstallerStatus = "failed"
-	SoftwareInstallerInstalled SoftwareInstallerStatus = "installed"
+	SoftwareInstallPending   SoftwareInstallerStatus = "pending_install"
+	SoftwareInstallFailed    SoftwareInstallerStatus = "failed_install"
+	SoftwareInstalled        SoftwareInstallerStatus = "installed"
+	SoftwareUninstallPending SoftwareInstallerStatus = "pending_uninstall"
+	SoftwareUninstallFailed  SoftwareInstallerStatus = "failed_uninstall"
+	// SoftwarePending and SoftwareFailed statuses are only used as filters in the API and are not stored in the database.
+	SoftwarePending SoftwareInstallerStatus = "pending" // either pending_install or pending_uninstall
+	SoftwareFailed  SoftwareInstallerStatus = "failed"  // either failed_install or failed_uninstall
 )
 
 func (s SoftwareInstallerStatus) IsValid() bool {
 	switch s {
 	case
-		SoftwareInstallerFailed,
-		SoftwareInstallerInstalled,
-		SoftwareInstallerPending:
+		SoftwarePending,
+		SoftwareFailed,
+		SoftwareUninstallPending,
+		SoftwareUninstallFailed,
+		SoftwareInstallFailed,
+		SoftwareInstalled,
+		SoftwareInstallPending:
 		return true
 	default:
 		return false
 	}
 }
 
+// HostLastInstallData contains data for the last installation of a package on a host.
+type HostLastInstallData struct {
+	// ExecutionID is the installation ID of the package on the host.
+	ExecutionID string `db:"execution_id"`
+	// Status is the status of the installation on the host.
+	Status *SoftwareInstallerStatus `db:"status"`
+}
+
 // HostSoftwareInstaller represents a software installer package that has been installed on a host.
 type HostSoftwareInstallerResult struct {
 	// ID is the unique numerical ID of the result assigned by the datastore.
@@ -182,6 +238,12 @@ type HostSoftwareInstallerResult struct {
 	// HostDeletedAt indicates if the data is associated with a
 	// deleted host
 	HostDeletedAt *time.Time `json:"-" db:"host_deleted_at"`
+	// SoftwareInstallerUserID is the ID of the user that uploaded the software installer.
+	SoftwareInstallerUserID *uint `json:"-" db:"software_installer_user_id"`
+	// SoftwareInstallerUserID is the name of the user that uploaded the software installer.
+	SoftwareInstallerUserName string `json:"-" db:"software_installer_user_name"`
+	// SoftwareInstallerUserEmail is the email of the user that uploaded the software installer.
+	SoftwareInstallerUserEmail string `json:"-" db:"software_installer_user_email"`
 }
 
 const (
@@ -191,19 +253,16 @@ const (
 	SoftwareInstallerInstallFailCopy        = "Installing software...\nFailed\n%s"
 	SoftwareInstallerInstallSuccessCopy     = "Installing software...\nSuccess\n%s"
 	SoftwareInstallerPostInstallSuccessCopy = "Running script...\nExit code: 0 (Success)\n%s"
-	// TODO(roberto): this is not true, how do we know that the rollback script was successful?
-	SoftwareInstallerPostInstallFailCopy = `Running script...
+	SoftwareInstallerPostInstallFailCopy    = `Running script...
 Exit code: %d (Failed)
 %s
-Rolling back software install...
-Rolled back successfully
 `
 )
 
 // EnhanceOutputDetails is used to add extra boilerplate/information to the
 // output fields so they're easier to consume by users.
 func (h *HostSoftwareInstallerResult) EnhanceOutputDetails() {
-	if h.Status == SoftwareInstallerPending {
+	if h.Status == SoftwareInstallPending {
 		return
 	}
 
@@ -261,6 +320,35 @@ type UploadSoftwareInstallerPayload struct {
 	Platform          string
 	BundleIdentifier  string
 	SelfService       bool
+	UserID            uint
+	URL               string
+	PackageIDs        []string
+	UninstallScript   string
+	Extension         string
+}
+
+type UpdateSoftwareInstallerPayload struct {
+	// find the installer via these fields
+	TitleID     uint
+	TeamID      *uint
+	InstallerID uint
+	// used for authorization and persisted as author
+	UserID uint
+	// optional; used for pulling metadata + persisting new installer package to file system
+	InstallerFile io.ReadSeeker
+	// update the installer with these fields (*not* PATCH semantics at that point; while the
+	// associated endpoint is a PATCH, the entire row will be updated to these values, including
+	// blanks, so make sure they're set from either user input or the existing installer row
+	// before saving)
+	InstallScript     *string
+	PreInstallQuery   *string
+	PostInstallScript *string
+	SelfService       *bool
+	UninstallScript   *string
+	StorageID         string
+	Filename          string
+	Version           string
+	PackageIDs        []string
 }
 
 // DownloadSoftwareInstallerPayload is the payload for downloading a software installer.
@@ -328,10 +416,26 @@ type SoftwarePackageOrApp struct {
 	// Name is only present for software installer packages.
 	Name string `json:"name,omitempty"`
 
-	Version     string               `json:"version"`
-	SelfService *bool                `json:"self_service,omitempty"`
-	IconURL     *string              `json:"icon_url"`
-	LastInstall *HostSoftwareInstall `json:"last_install"`
+	Version       string                 `json:"version"`
+	SelfService   *bool                  `json:"self_service,omitempty"`
+	IconURL       *string                `json:"icon_url"`
+	LastInstall   *HostSoftwareInstall   `json:"last_install"`
+	LastUninstall *HostSoftwareUninstall `json:"last_uninstall"`
+	PackageURL    *string                `json:"package_url"`
+}
+
+type SoftwarePackageSpec struct {
+	URL               string                `json:"url"`
+	SelfService       bool                  `json:"self_service"`
+	PreInstallQuery   TeamSpecSoftwareAsset `json:"pre_install_query"`
+	InstallScript     TeamSpecSoftwareAsset `json:"install_script"`
+	PostInstallScript TeamSpecSoftwareAsset `json:"post_install_script"`
+	UninstallScript   TeamSpecSoftwareAsset `json:"uninstall_script"`
+}
+
+type SoftwareSpec struct {
+	Packages     optjson.Slice[SoftwarePackageSpec] `json:"packages,omitempty"`
+	AppStoreApps optjson.Slice[TeamSpecAppStoreApp] `json:"app_store_apps,omitempty"`
 }
 
 // HostSoftwareInstall represents installation of software on a host from a
@@ -349,6 +453,14 @@ type HostSoftwareInstall struct {
 	InstalledAt time.Time `json:"installed_at"`
 }
 
+// HostSoftwareUninstall represents uninstallation of software from a host with a
+// Fleet software installer.
+type HostSoftwareUninstall struct {
+	// ExecutionID is the UUID of the script execution that uninstalled the software.
+	ExecutionID   string    `json:"script_execution_id,omitempty"`
+	UninstalledAt time.Time `json:"uninstalled_at"`
+}
+
 // HostSoftwareInstalledVersion represents a version of software installed on a
 // host.
 type HostSoftwareInstalledVersion struct {
@@ -382,16 +494,24 @@ type HostSoftwareInstallResultPayload struct {
 func (h *HostSoftwareInstallResultPayload) Status() SoftwareInstallerStatus {
 	switch {
 	case h.PostInstallScriptExitCode != nil && *h.PostInstallScriptExitCode == 0:
-		return SoftwareInstallerInstalled
+		return SoftwareInstalled
 	case h.PostInstallScriptExitCode != nil && *h.PostInstallScriptExitCode != 0:
-		return SoftwareInstallerFailed
+		return SoftwareInstallFailed
 	case h.InstallScriptExitCode != nil && *h.InstallScriptExitCode == 0:
-		return SoftwareInstallerInstalled
+		return SoftwareInstalled
 	case h.InstallScriptExitCode != nil && *h.InstallScriptExitCode != 0:
-		return SoftwareInstallerFailed
+		return SoftwareInstallFailed
 	case h.PreInstallConditionOutput != nil && *h.PreInstallConditionOutput == "":
-		return SoftwareInstallerFailed
+		return SoftwareInstallFailed
 	default:
-		return SoftwareInstallerPending
+		return SoftwareInstallPending
 	}
 }
+
+// SoftwareInstallerTokenMetadata is the metadata stored in Redis for a software installer token.
+type SoftwareInstallerTokenMetadata struct {
+	TitleID uint `json:"title_id"`
+	TeamID  uint `json:"team_id"`
+}
+
+const SoftwareInstallerURLMaxLength = 255
diff --git a/server/fleet/software_test.go b/server/fleet/software_test.go
index 236eb896a3..34b583f66f 100644
--- a/server/fleet/software_test.go
+++ b/server/fleet/software_test.go
@@ -89,7 +89,7 @@ func TestEnhanceOutputDetails(t *testing.T) {
 		{
 			name: "pending status",
 			initial: HostSoftwareInstallerResult{
-				Status: SoftwareInstallerPending,
+				Status: SoftwareInstallPending,
 			},
 			expectedPreInstallQueryOutput:   nil,
 			expectedOutput:                  nil,
@@ -98,7 +98,7 @@ func TestEnhanceOutputDetails(t *testing.T) {
 		{
 			name: "non-pending status with empty PreInstallQueryOutput",
 			initial: HostSoftwareInstallerResult{
-				Status:                SoftwareInstallerInstalled,
+				Status:                SoftwareInstalled,
 				PreInstallQueryOutput: ptr.String(""),
 			},
 			expectedPreInstallQueryOutput:   ptr.String(SoftwareInstallerQueryFailCopy),
@@ -108,7 +108,7 @@ func TestEnhanceOutputDetails(t *testing.T) {
 		{
 			name: "non-pending status with non-empty PreInstallQueryOutput",
 			initial: HostSoftwareInstallerResult{
-				Status:                SoftwareInstallerInstalled,
+				Status:                SoftwareInstalled,
 				PreInstallQueryOutput: ptr.String("Some output"),
 			},
 			expectedPreInstallQueryOutput:   ptr.String(SoftwareInstallerQuerySuccessCopy),
@@ -118,7 +118,7 @@ func TestEnhanceOutputDetails(t *testing.T) {
 		{
 			name: "non-pending status with nil PreInstallQueryOutput",
 			initial: HostSoftwareInstallerResult{
-				Status: SoftwareInstallerInstalled,
+				Status: SoftwareInstalled,
 			},
 			expectedPreInstallQueryOutput:   nil,
 			expectedOutput:                  nil,
@@ -127,7 +127,7 @@ func TestEnhanceOutputDetails(t *testing.T) {
 		{
 			name: "non-pending status with install scripts disabled",
 			initial: HostSoftwareInstallerResult{
-				Status:                SoftwareInstallerInstalled,
+				Status:                SoftwareInstalled,
 				InstallScriptExitCode: ptr.Int(-2),
 				Output:                ptr.String(""),
 			},
@@ -138,7 +138,7 @@ func TestEnhanceOutputDetails(t *testing.T) {
 		{
 			name: "non-pending status with failed install script",
 			initial: HostSoftwareInstallerResult{
-				Status:                SoftwareInstallerFailed,
+				Status:                SoftwareInstallFailed,
 				InstallScriptExitCode: ptr.Int(1),
 				Output:                ptr.String("Some install output"),
 			},
@@ -149,7 +149,7 @@ func TestEnhanceOutputDetails(t *testing.T) {
 		{
 			name: "non-pending status with successful install script",
 			initial: HostSoftwareInstallerResult{
-				Status:                SoftwareInstallerInstalled,
+				Status:                SoftwareInstalled,
 				InstallScriptExitCode: ptr.Int(0),
 				Output:                ptr.String("Some install output"),
 			},
@@ -160,7 +160,7 @@ func TestEnhanceOutputDetails(t *testing.T) {
 		{
 			name: "non-pending status with successful post install script",
 			initial: HostSoftwareInstallerResult{
-				Status:                    SoftwareInstallerInstalled,
+				Status:                    SoftwareInstalled,
 				InstallScriptExitCode:     ptr.Int(0),
 				Output:                    ptr.String("Some install output"),
 				PostInstallScriptExitCode: ptr.Int(0),
@@ -173,7 +173,7 @@ func TestEnhanceOutputDetails(t *testing.T) {
 		{
 			name: "non-pending status with failed post install script",
 			initial: HostSoftwareInstallerResult{
-				Status:                    SoftwareInstallerInstalled,
+				Status:                    SoftwareInstalled,
 				InstallScriptExitCode:     ptr.Int(0),
 				Output:                    ptr.String("Some install output"),
 				PostInstallScriptExitCode: ptr.Int(1),
diff --git a/server/fleet/statistics.go b/server/fleet/statistics.go
index 11a7feeb66..0d88d52def 100644
--- a/server/fleet/statistics.go
+++ b/server/fleet/statistics.go
@@ -47,6 +47,16 @@ type StatisticsPayload struct {
 	StoredErrors                  json.RawMessage              `json:"storedErrors"`
 	// NumHostsNotResponding is a count of hosts that connect to Fleet successfully but fail to submit results for distributed queries.
 	NumHostsNotResponding int `json:"numHostsNotResponding"`
+	// Whether server_settings.ai_features_disabled is set to true in the config.
+	AIFeaturesDisabled bool `json:"aiFeaturesDisabled"`
+	// Whether at least one team has integrations.google_calendar.enable_calendar_events set to true
+	MaintenanceWindowsEnabled bool `json:"maintenanceWindowsEnabled"`
+	// Maintenance windows are considered "configured" if:
+	// configuration has value set for integrations.google_calendar[0].domain
+	// configuration has value set for integrations.google_calendar[0].api_key_json
+	MaintenanceWindowsConfigured bool `json:"maintenanceWindowsConfigured"`
+	// The number of hosts with Fleet desktop installed.
+	NumHostsFleetDesktopEnabled int `json:"numHostsFleetDesktopEnabled"`
 }
 
 type HostsCountByOrbitVersion struct {
diff --git a/server/fleet/teams.go b/server/fleet/teams.go
index d5eaa71f8b..68cde3072d 100644
--- a/server/fleet/teams.go
+++ b/server/fleet/teams.go
@@ -8,6 +8,7 @@ import (
 
 	"github.com/fleetdm/fleet/v4/pkg/optjson"
 	"github.com/fleetdm/fleet/v4/server/ptr"
+	"golang.org/x/text/unicode/norm"
 )
 
 const (
@@ -16,8 +17,21 @@ const (
 	RoleObserver     = "observer"
 	RoleObserverPlus = "observer_plus"
 	RoleGitOps       = "gitops"
+	TeamNameNoTeam   = "No team"
+	TeamNameAllTeams = "All teams"
 )
 
+const (
+	ReservedNameAllTeams = "All teams"
+	ReservedNameNoTeam   = "No team"
+)
+
+// IsReservedTeamName checks if the name provided is a reserved team name
+func IsReservedTeamName(name string) bool {
+	normalizedName := norm.NFC.String(name)
+	return normalizedName == ReservedNameAllTeams || normalizedName == ReservedNameNoTeam
+}
+
 type TeamPayload struct {
 	Name               *string              `json:"name"`
 	Description        *string              `json:"description"`
@@ -155,7 +169,7 @@ type TeamConfig struct {
 	Features           Features              `json:"features"`
 	MDM                TeamMDM               `json:"mdm"`
 	Scripts            optjson.Slice[string] `json:"scripts,omitempty"`
-	Software           *TeamSpecSoftware     `json:"software,omitempty"`
+	Software           *SoftwareSpec         `json:"software,omitempty"`
 }
 
 type TeamWebhookSettings struct {
@@ -168,21 +182,9 @@ type TeamSpecSoftwareAsset struct {
 	Path string `json:"path"`
 }
 
-type TeamSpecSoftware struct {
-	Packages     optjson.Slice[TeamSpecSoftwarePackage] `json:"packages,omitempty"`
-	AppStoreApps optjson.Slice[TeamSpecAppStoreApp]     `json:"app_store_apps,omitempty"`
-}
-
 type TeamSpecAppStoreApp struct {
-	AppStoreID string `json:"app_store_id"`
-}
-
-type TeamSpecSoftwarePackage struct {
-	URL               string                `json:"url"`
-	SelfService       bool                  `json:"self_service"`
-	PreInstallQuery   TeamSpecSoftwareAsset `json:"pre_install_query"`
-	InstallScript     TeamSpecSoftwareAsset `json:"install_script"`
-	PostInstallScript TeamSpecSoftwareAsset `json:"post_install_script"`
+	AppStoreID  string `json:"app_store_id"`
+	SelfService bool   `json:"self_service"`
 }
 
 type TeamMDM struct {
@@ -450,7 +452,7 @@ type TeamSpec struct {
 	Scripts            optjson.Slice[string]   `json:"scripts"`
 	WebhookSettings    TeamSpecWebhookSettings `json:"webhook_settings"`
 	Integrations       TeamSpecIntegrations    `json:"integrations"`
-	Software           *TeamSpecSoftware       `json:"software,omitempty"`
+	Software           *SoftwareSpec           `json:"software,omitempty"`
 }
 
 type TeamSpecWebhookSettings struct {
diff --git a/server/fleet/vpp.go b/server/fleet/vpp.go
index 01f869645a..4e0803edfe 100644
--- a/server/fleet/vpp.go
+++ b/server/fleet/vpp.go
@@ -1,6 +1,9 @@
 package fleet
 
-import "time"
+import (
+	"fmt"
+	"time"
+)
 
 type VPPAppID struct {
 	// AdamID is a unique identifier assigned to each app in
@@ -9,11 +12,18 @@ type VPPAppID struct {
 	Platform AppleDevicePlatform `db:"platform" json:"platform"`
 }
 
+// VPPAppTeam contains extra metadata injected by fleet
+type VPPAppTeam struct {
+	VPPAppID
+
+	SelfService bool `db:"self_service" json:"self_service"`
+}
+
 // VPPApp represents a VPP (Volume Purchase Program) application,
 // this is used by Apple MDM to manage applications via Apple
 // Business Manager.
 type VPPApp struct {
-	VPPAppID
+	VPPAppTeam
 	// BundleIdentifier is the unique bundle identifier of the
 	// Application.
 	BundleIdentifier string `db:"bundle_identifier" json:"bundle_identifier"`
@@ -23,8 +33,11 @@ type VPPApp struct {
 	Name string `db:"name" json:"name"`
 	// LatestVersion is the latest version of this app.
 	LatestVersion string `db:"latest_version" json:"latest_version"`
-	TeamID        *uint  `db:"-" json:"-"`
-	TitleID       uint   `db:"title_id" json:"-"`
+	// TeamID is used for authorization, it must be json serialized to be available
+	// to the rego script. We don't set it outside authorization anyway, so it
+	// won't render otherwise.
+	TeamID  *uint `db:"-" json:"team_id,omitempty"`
+	TitleID uint  `db:"title_id" json:"-"`
 
 	CreatedAt time.Time `db:"created_at" json:"-"`
 	UpdatedAt time.Time `db:"updated_at" json:"-"`
@@ -43,6 +56,7 @@ type VPPAppStoreApp struct {
 	LatestVersion string               `db:"latest_version" json:"latest_version"`
 	IconURL       *string              `db:"icon_url" json:"icon_url"`
 	Status        *VPPAppStatusSummary `db:"-" json:"status"`
+	SelfService   bool                 `db:"self_service" json:"self_service"`
 }
 
 // VPPAppStatusSummary represents aggregated status metrics for a VPP app.
@@ -54,3 +68,12 @@ type VPPAppStatusSummary struct {
 	// Failed is the number of hosts that have the VPP app installation failed.
 	Failed uint `json:"failed" db:"failed"`
 }
+
+type ErrVPPTokenTeamConstraint struct {
+	Name string
+	ID   *uint
+}
+
+func (e ErrVPPTokenTeamConstraint) Error() string {
+	return fmt.Sprintf("Error: %q team already has a VPP token. Each team can only have one VPP token.", e.Name)
+}
diff --git a/server/fleet/vulnerabilities.go b/server/fleet/vulnerabilities.go
index a2242f1fbf..9e92fce4a0 100644
--- a/server/fleet/vulnerabilities.go
+++ b/server/fleet/vulnerabilities.go
@@ -127,6 +127,7 @@ const (
 	MSRCSource
 	MacOfficeReleaseNotesSource
 	CustomSource
+	GovalDictionarySource
 )
 
 type VulnerabilityWithMetadata struct {
diff --git a/server/fleet/windows_mdm.go b/server/fleet/windows_mdm.go
index 4487765008..acc90b3a51 100644
--- a/server/fleet/windows_mdm.go
+++ b/server/fleet/windows_mdm.go
@@ -158,6 +158,18 @@ type MDMWindowsProfilePayload struct {
 	Retries       int                `db:"retries"`
 }
 
+func (p MDMWindowsProfilePayload) Equal(other MDMWindowsProfilePayload) bool {
+	statusEqual := p.Status == nil && other.Status == nil || p.Status != nil && other.Status != nil && *p.Status == *other.Status
+	return statusEqual &&
+		p.ProfileUUID == other.ProfileUUID &&
+		p.HostUUID == other.HostUUID &&
+		p.ProfileName == other.ProfileName &&
+		p.OperationType == other.OperationType &&
+		p.Detail == other.Detail &&
+		p.CommandUUID == other.CommandUUID &&
+		p.Retries == other.Retries
+}
+
 type MDMWindowsBulkUpsertHostProfilePayload struct {
 	ProfileUUID   string
 	ProfileName   string
diff --git a/server/live_query/live_query_test.go b/server/live_query/live_query_test.go
index f7d684963e..73f64593de 100644
--- a/server/live_query/live_query_test.go
+++ b/server/live_query/live_query_test.go
@@ -3,6 +3,7 @@ package live_query
 import (
 	"context"
 	"testing"
+	"time"
 
 	"github.com/fleetdm/fleet/v4/server/datastore/redis"
 	"github.com/fleetdm/fleet/v4/server/fleet"
@@ -112,9 +113,14 @@ func testLiveQueryExpiredQuery(t *testing.T, store fleet.LiveQueryStore) {
 	assert.Len(t, queries, 1)
 	assert.Equal(t, map[string]string{"test": "select 1"}, queries)
 
-	activeNames, err := redigo.Strings(conn.Do("SMEMBERS", activeQueriesKey))
-	require.NoError(t, err)
-	require.Equal(t, []string{"test"}, activeNames)
+	assert.Eventually(t, func() bool {
+		activeNames, err := redigo.Strings(conn.Do("SMEMBERS", activeQueriesKey))
+		require.NoError(t, err)
+		if len(activeNames) == 1 && activeNames[0] == "test" {
+			return true
+		}
+		return false
+	}, 5*time.Second, 100*time.Millisecond)
 }
 
 func testLiveQueryOnlyExpired(t *testing.T, store fleet.LiveQueryStore) {
@@ -133,9 +139,11 @@ func testLiveQueryOnlyExpired(t *testing.T, store fleet.LiveQueryStore) {
 	require.NoError(t, err)
 	assert.Len(t, queries, 0)
 
-	activeNames, err := redigo.Strings(conn.Do("SMEMBERS", activeQueriesKey))
-	require.NoError(t, err)
-	require.Len(t, activeNames, 0)
+	assert.Eventually(t, func() bool {
+		activeNames, err := redigo.Strings(conn.Do("SMEMBERS", activeQueriesKey))
+		require.NoError(t, err)
+		return len(activeNames) == 0
+	}, 5*time.Second, 100*time.Millisecond)
 }
 
 func testLiveQueryCleanupInactive(t *testing.T, store fleet.LiveQueryStore) {
diff --git a/server/live_query/redis_live_query.go b/server/live_query/redis_live_query.go
index 8b424ba635..b54c1c1f3a 100644
--- a/server/live_query/redis_live_query.go
+++ b/server/live_query/redis_live_query.go
@@ -50,11 +50,14 @@ import (
 	"fmt"
 	"strconv"
 	"strings"
+	"sync"
 	"time"
 
 	"github.com/fleetdm/fleet/v4/server/contexts/ctxerr"
 	"github.com/fleetdm/fleet/v4/server/datastore/redis"
 	"github.com/fleetdm/fleet/v4/server/fleet"
+	kitlog "github.com/go-kit/log"
+	"github.com/go-kit/log/level"
 	redigo "github.com/gomodule/redigo/redis"
 )
 
@@ -69,12 +72,56 @@ const (
 type redisLiveQuery struct {
 	// connection pool
 	pool fleet.RedisPool
+	// in memory cache
+	cache memCache
+	// in memory cache expiration
+	cacheExpiration time.Duration
+
+	logger kitlog.Logger
+}
+
+// memCache is an in-memory cache for live queries. It stores the SQL of the
+// queries and the active queries set. It also stores the expiration time of the
+// cache.
+type memCache struct {
+	sqlCache           map[string]string
+	activeQueriesCache []string
+	cacheExp           time.Time
+	mu                 sync.RWMutex
+}
+
+// cacheIsExpired is a thread-safe method to check if the cache is expired.
+func (r *redisLiveQuery) cacheIsExpired() bool {
+	r.cache.mu.RLock()
+	defer r.cache.mu.RUnlock()
+	return r.cache.cacheExp.Before(time.Now())
+}
+
+// getSQLByCampaignID is a thread-safe method to get the SQL of a live query by its
+// campaign ID.
+func (r *redisLiveQuery) getSQLByCampaignID(campaignID string) (string, bool) {
+	r.cache.mu.RLock()
+	defer r.cache.mu.RUnlock()
+	sql, found := r.cache.sqlCache[campaignID]
+	return sql, found
 }
 
 // NewRedisQueryResults creates a new Redis implementation of the
 // QueryResultStore interface using the provided Redis connection pool.
-func NewRedisLiveQuery(pool fleet.RedisPool) *redisLiveQuery {
-	return &redisLiveQuery{pool: pool}
+func NewRedisLiveQuery(pool fleet.RedisPool, logger kitlog.Logger, memCacheExp time.Duration) *redisLiveQuery {
+	return &redisLiveQuery{
+		pool:            pool,
+		cache:           newMemCache(),
+		cacheExpiration: memCacheExp,
+		logger:          logger,
+	}
+}
+
+func newMemCache() memCache {
+	return memCache{
+		sqlCache:           make(map[string]string),
+		activeQueriesCache: make([]string, 0),
+	}
 }
 
 // generate keys for the bitfield and sql of a query - those always go in pair
@@ -147,55 +194,39 @@ func (r *redisLiveQuery) QueriesForHost(hostID uint) (map[string]string, error)
 	}
 
 	// convert the query name (campaign id) to the key name
-	for i, name := range names {
+	keyNames := make([]string, 0, len(names))
+	for _, name := range names {
 		tkey, _ := generateKeys(name)
-		names[i] = tkey
+		keyNames = append(keyNames, tkey)
 	}
 
-	keysBySlot := redis.SplitKeysBySlot(r.pool, names...)
+	keysBySlot := redis.SplitKeysBySlot(r.pool, keyNames...)
 	queries := make(map[string]string)
-	expired := make(map[string]struct{})
 	for _, qkeys := range keysBySlot {
-		if err := r.collectBatchQueriesForHost(hostID, qkeys, queries, expired); err != nil {
+		if err := r.collectBatchQueriesForHost(hostID, qkeys, queries); err != nil {
 			return nil, err
 		}
 	}
 
-	if len(expired) > 0 {
-		// a certain percentage of the time so that we don't overwhelm redis with a
-		// bunch of similar deletion commands at the same time, clean up the
-		// expired queries.
-		if time.Now().UnixNano()%cleanupExpiredQueriesModulo == 0 {
-			names := make([]string, 0, len(expired))
-			for k := range expired {
-				names = append(names, k)
-			}
-			// ignore error, best effort removal
-			_ = r.removeQueryNames(names...)
-		}
-	}
-
 	return queries, nil
 }
 
-func (r *redisLiveQuery) collectBatchQueriesForHost(hostID uint, queryKeys []string, queriesByHost map[string]string, expiredQueries map[string]struct{}) error {
+func (r *redisLiveQuery) collectBatchQueriesForHost(hostID uint, queryKeys []string, queriesByHost map[string]string) error {
 	conn := redis.ReadOnlyConn(r.pool, r.pool.Get())
 	defer conn.Close()
 
+	if r.cacheIsExpired() {
+		if err := r.loadCache(); err != nil {
+			return fmt.Errorf("load cache: %w", err)
+		}
+	}
+
 	// Pipeline redis calls to check for this host in the bitfield of the
 	// targets of the query.
 	for _, key := range queryKeys {
 		if err := conn.Send("GETBIT", key, hostID); err != nil {
 			return fmt.Errorf("getbit query targets: %w", err)
 		}
-
-		// Additionally get SQL even though we don't yet know whether this query
-		// is targeted to the host. This allows us to avoid an additional
-		// roundtrip to the Redis server and likely has little cost due to the
-		// small number of queries and limited size of SQL
-		if err := conn.Send("GET", sqlKeyPrefix+key); err != nil {
-			return fmt.Errorf("get query sql: %w", err)
-		}
 	}
 
 	// Flush calls to begin receiving results.
@@ -215,27 +246,13 @@ func (r *redisLiveQuery) collectBatchQueriesForHost(hostID uint, queryKeys []str
 			return fmt.Errorf("receive target: %w", err)
 		}
 
-		// Be sure to read SQL even if we are not going to include this query.
-		// Otherwise we will read an incorrect number of returned results from
-		// the pipeline.
-		sql, err := redigo.String(conn.Receive())
-		if err != nil {
-			if err != redigo.ErrNil {
-				return fmt.Errorf("receive sql: %w", err)
+		if targeted == 1 {
+			if sql, found := r.getSQLByCampaignID(name); found {
+				queriesByHost[name] = sql
+			} else {
+				level.Warn(r.logger).Log("msg", "live query not found in cache", "name", name)
 			}
-
-			// It is possible the livequery key has expired but was still in the set
-			// - handle this gracefully by collecting the keys to remove them from
-			// the set and keep going.
-			expiredQueries[name] = struct{}{}
-			continue
 		}
-
-		if targeted == 0 {
-			// Host not targeted with this query
-			continue
-		}
-		queriesByHost[name] = sql
 	}
 	return nil
 }
@@ -316,14 +333,96 @@ func (r *redisLiveQuery) removeQueryNames(names ...string) error {
 }
 
 func (r *redisLiveQuery) LoadActiveQueryNames() ([]string, error) {
+	// copyActiveQueries returns a copy of the active queries cache to
+	// ensure thread safety.
+	copyActiveQueries := func() []string {
+		r.cache.mu.RLock()
+		defer r.cache.mu.RUnlock()
+
+		names := make([]string, len(r.cache.activeQueriesCache))
+		copy(names, r.cache.activeQueriesCache)
+
+		return names
+	}
+
+	if !r.cacheIsExpired() {
+		return copyActiveQueries(), nil
+	}
+
+	if err := r.loadCache(); err != nil {
+		return nil, fmt.Errorf("load cache: %w", err)
+	}
+
+	return copyActiveQueries(), nil
+}
+
+func (r *redisLiveQuery) loadCache() error {
+	expiredQueries := make(map[string]struct{})
+	sqlCache := make(map[string]string)
 	conn := redis.ConfigureDoer(r.pool, r.pool.Get())
 	defer conn.Close()
 
-	names, err := redigo.Strings(conn.Do("SMEMBERS", activeQueriesKey))
+	activeIDs, err := redigo.Strings(conn.Do("SMEMBERS", activeQueriesKey))
 	if err != nil && err != redigo.ErrNil {
-		return nil, err
+		return fmt.Errorf("get active queries: %w", err)
 	}
-	return names, nil
+
+	for _, id := range activeIDs {
+		_, sqlKey := generateKeys(id)
+
+		sql, err := redigo.String(conn.Do("GET", sqlKey))
+		if err != nil {
+			if err != redigo.ErrNil {
+				return fmt.Errorf("get query sql: %w", err)
+			}
+
+			// It is possible the livequery key has expired but was still in the set
+			// - handle this gracefully by collecting the keys to remove them from
+			// the set and keep going.
+			expiredQueries[id] = struct{}{}
+			continue
+		}
+
+		sqlCache[id] = sql
+	}
+
+	// remove expired queries from the names list
+	if len(expiredQueries) > 0 {
+		trimmedIDs := make([]string, 0, len(activeIDs)-len(expiredQueries))
+		for _, name := range activeIDs {
+			if _, found := expiredQueries[name]; !found {
+				trimmedIDs = append(trimmedIDs, name)
+			}
+		}
+		activeIDs = trimmedIDs
+	}
+
+	r.cache.mu.Lock()
+	r.cache.sqlCache = sqlCache
+	r.cache.activeQueriesCache = activeIDs
+	r.cache.cacheExp = time.Now().Add(r.cacheExpiration)
+	r.cache.mu.Unlock()
+
+	if len(expiredQueries) > 0 {
+		// a certain percentage of the time so that we don't overwhelm redis with a
+		// bunch of similar deletion commands at the same time, clean up the
+		// expired queries.
+		if time.Now().UnixNano()%cleanupExpiredQueriesModulo == 0 {
+			names := make([]string, 0, len(expiredQueries))
+			for k := range expiredQueries {
+				names = append(names, k)
+			}
+
+			go func() {
+				err = r.removeQueryNames(names...)
+				if err != nil {
+					level.Warn(r.logger).Log("msg", "removing expired live queries", "err", err)
+				}
+			}()
+		}
+	}
+
+	return nil
 }
 
 func (r *redisLiveQuery) CleanupInactiveQueries(ctx context.Context, inactiveCampaignIDs []uint) error {
diff --git a/server/live_query/redis_live_query_test.go b/server/live_query/redis_live_query_test.go
index d0fe5a91cd..75c6d2cf91 100644
--- a/server/live_query/redis_live_query_test.go
+++ b/server/live_query/redis_live_query_test.go
@@ -5,6 +5,7 @@ import (
 
 	"github.com/fleetdm/fleet/v4/server/datastore/redis/redistest"
 	"github.com/fleetdm/fleet/v4/server/test"
+	"github.com/go-kit/log"
 	"github.com/stretchr/testify/assert"
 )
 
@@ -26,7 +27,7 @@ func TestRedisLiveQuery(t *testing.T) {
 
 func setupRedisLiveQuery(t *testing.T, cluster bool) *redisLiveQuery {
 	pool := redistest.SetupRedis(t, "*livequery", cluster, true, true)
-	return NewRedisLiveQuery(pool)
+	return NewRedisLiveQuery(pool, log.NewNopLogger(), 0)
 }
 
 func TestMapBitfield(t *testing.T) {
diff --git a/server/mdm/apple/AppleIncRootCertificate.cer b/server/mdm/apple/AppleIncRootCertificate.cer
new file mode 100644
index 0000000000..8a9ff24741
Binary files /dev/null and b/server/mdm/apple/AppleIncRootCertificate.cer differ
diff --git a/server/mdm/apple/AppleIphoneDeviceCA.cer b/server/mdm/apple/AppleIphoneDeviceCA.cer
new file mode 100644
index 0000000000..fac79ff89d
Binary files /dev/null and b/server/mdm/apple/AppleIphoneDeviceCA.cer differ
diff --git a/server/mdm/apple/apple_bm.go b/server/mdm/apple/apple_bm.go
new file mode 100644
index 0000000000..eeb2eeddff
--- /dev/null
+++ b/server/mdm/apple/apple_bm.go
@@ -0,0 +1,89 @@
+package apple_mdm
+
+import (
+	"context"
+	"errors"
+	"net/http"
+
+	abmctx "github.com/fleetdm/fleet/v4/server/contexts/apple_bm"
+	"github.com/fleetdm/fleet/v4/server/contexts/ctxerr"
+	"github.com/fleetdm/fleet/v4/server/fleet"
+	"github.com/fleetdm/fleet/v4/server/mdm/assets"
+	depclient "github.com/fleetdm/fleet/v4/server/mdm/nanodep/client"
+	"github.com/fleetdm/fleet/v4/server/mdm/nanodep/storage"
+	kitlog "github.com/go-kit/log"
+)
+
+// SetABMTokenMetadata uses the provided ABM token to fetch the associated
+// metadata and use it to update the rest of the abmToken fields (org name,
+// apple ID, renew date). It only sets the data on the struct, it does not
+// save it in the DB.
+func SetABMTokenMetadata(
+	ctx context.Context,
+	abmToken *fleet.ABMToken,
+	depStorage storage.AllDEPStorage,
+	ds fleet.Datastore,
+	logger kitlog.Logger,
+) error {
+	decryptedToken, err := assets.ABMToken(ctx, ds, abmToken.OrganizationName)
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "getting ABM token")
+	}
+
+	return SetDecryptedABMTokenMetadata(ctx, abmToken, decryptedToken, depStorage, ds, logger)
+}
+
+const UnsavedABMTokenOrgName = "new_abm_token" //nolint:gosec
+
+func SetDecryptedABMTokenMetadata(
+	ctx context.Context,
+	abmToken *fleet.ABMToken,
+	decryptedToken *depclient.OAuth1Tokens,
+	depStorage storage.AllDEPStorage,
+	ds fleet.Datastore,
+	logger kitlog.Logger,
+) error {
+	depClient := NewDEPClient(depStorage, ds, logger)
+
+	orgName := abmToken.OrganizationName
+	if orgName == "" {
+		// Then this is a newly uploaded token (or one migrated from the
+		// single-token world), which will not be found in the datastore when
+		// RetrieveAuthTokens tries to find it. Set the token in the context so
+		// that downstream we know it's not in the datastore.
+		ctx = abmctx.NewContext(ctx, decryptedToken)
+		// We don't have an org name, but the depClient expects an org name, so we set this fake one.
+		orgName = UnsavedABMTokenOrgName
+	}
+
+	res, err := depClient.AccountDetail(ctx, orgName)
+	if err != nil {
+		var authErr *depclient.AuthError
+		if errors.As(err, &authErr) {
+			// authentication failure with 401 unauthorized means that the configured
+			// Apple BM certificate and/or token are invalid. Fail with a 400 Bad
+			// Request.
+			msg := err.Error()
+			if authErr.StatusCode == http.StatusUnauthorized {
+				msg = "The Apple Business Manager certificate or server token is invalid. Restart Fleet with a valid certificate and token. See https://fleetdm.com/learn-more-about/setup-abm for help."
+			}
+			return ctxerr.Wrap(ctx, &fleet.BadRequestError{
+				Message:     msg,
+				InternalErr: err,
+			}, "apple GET /account request failed with authentication error")
+		}
+		return ctxerr.Wrap(ctx, err, "apple GET /account request failed")
+	}
+
+	if res.AdminID == "" {
+		// fallback to facilitator ID, as this is the same information but for
+		// older versions of the Apple API.
+		// https://github.com/fleetdm/fleet/issues/7515#issuecomment-1346579398
+		res.AdminID = res.FacilitatorID
+	}
+
+	abmToken.OrganizationName = res.OrgName
+	abmToken.AppleID = res.AdminID
+	abmToken.RenewAt = decryptedToken.AccessTokenExpiry.UTC()
+	return nil
+}
diff --git a/server/mdm/apple/apple_mdm.go b/server/mdm/apple/apple_mdm.go
index 4faa9af1be..81ec4c8f52 100644
--- a/server/mdm/apple/apple_mdm.go
+++ b/server/mdm/apple/apple_mdm.go
@@ -4,14 +4,16 @@ import (
 	"bytes"
 	"context"
 	"encoding/json"
-	"encoding/xml"
+	"errors"
 	"fmt"
 	"net/url"
+	"slices"
 	"strings"
 	"text/template"
 	"time"
 
 	"github.com/fleetdm/fleet/v4/pkg/fleethttp"
+	ctxabm "github.com/fleetdm/fleet/v4/server/contexts/apple_bm"
 	"github.com/fleetdm/fleet/v4/server/contexts/ctxerr"
 	"github.com/fleetdm/fleet/v4/server/fleet"
 	"github.com/fleetdm/fleet/v4/server/logging"
@@ -21,18 +23,14 @@ import (
 	"github.com/fleetdm/fleet/v4/server/ptr"
 	"github.com/go-kit/log/level"
 	"github.com/google/uuid"
+	"github.com/hashicorp/go-multierror"
 
+	depclient "github.com/fleetdm/fleet/v4/server/mdm/nanodep/client"
 	nanodep_storage "github.com/fleetdm/fleet/v4/server/mdm/nanodep/storage"
 	depsync "github.com/fleetdm/fleet/v4/server/mdm/nanodep/sync"
 	kitlog "github.com/go-kit/log"
 )
 
-// DEPName is the identifier/name used in nanodep MySQL storage which
-// holds the DEP configuration.
-//
-// Fleet uses only one DEP configuration set for the whole deployment.
-const DEPName = "fleet"
-
 const (
 	// SCEPPath is Fleet's HTTP path for the SCEP service.
 	SCEPPath = "/mdm/apple/scep"
@@ -80,7 +78,7 @@ func ResolveAppleSCEPURL(serverURL string) (string, error) {
 type DEPService struct {
 	ds         fleet.Datastore
 	depStorage nanodep_storage.AllDEPStorage
-	syncer     *depsync.Syncer
+	depClient  *godep.Client
 	logger     kitlog.Logger
 }
 
@@ -142,41 +140,16 @@ func (d *DEPService) createDefaultAutomaticProfile(ctx context.Context) error {
 	return nil
 }
 
-// RegisterProfileWithAppleDEPServer registers the enrollment profile in
-// Apple's servers via the DEP API, so it can be used for assignment. If
-// setupAsst is nil, the default profile is registered. It assigns the
-// up-to-date dynamic settings such as the server URL and MDM SSO URL if
-// end-user authentication is enabled for that team/no-team.
-func (d *DEPService) RegisterProfileWithAppleDEPServer(ctx context.Context, team *fleet.Team, setupAsst *fleet.MDMAppleSetupAssistant) error {
-	appCfg, err := d.ds.AppConfig(ctx)
-	if err != nil {
-		return ctxerr.Wrap(ctx, err, "fetching app config")
-	}
-
-	// must always get the default profile, because the authentication token is
-	// defined on that profile.
-	defaultProf, err := d.ds.GetMDMAppleEnrollmentProfileByType(ctx, fleet.MDMAppleEnrollmentTypeAutomatic)
-	if err != nil {
-		return ctxerr.Wrap(ctx, err, "fetching default profile")
-	}
-
-	enrollURL, err := EnrollURL(defaultProf.Token, appCfg)
-	if err != nil {
-		return ctxerr.Wrap(ctx, err, "generating enroll URL")
-	}
-
-	var rawJSON json.RawMessage
-	if defaultProf.DEPProfile != nil {
-		rawJSON = *defaultProf.DEPProfile
-	}
-	if setupAsst != nil {
-		rawJSON = setupAsst.Profile
-	}
+// CreateDefaultAutomaticProfile creates the default automatic enrollment profile in the DB.
+func (d *DEPService) CreateDefaultAutomaticProfile(ctx context.Context) error {
+	return d.createDefaultAutomaticProfile(ctx)
+}
 
+func (d *DEPService) buildJSONProfile(ctx context.Context, setupAsstJSON json.RawMessage, appCfg *fleet.AppConfig, team *fleet.Team, enrollURL string) (*godep.Profile, error) {
 	var jsonProf godep.Profile
 	jsonProf.IsMDMRemovable = true // the default value defined by Apple is true
-	if err := json.Unmarshal(rawJSON, &jsonProf); err != nil {
-		return ctxerr.Wrap(ctx, err, "unmarshalling DEP profile")
+	if err := json.Unmarshal(setupAsstJSON, &jsonProf); err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "unmarshalling DEP profile")
 	}
 
 	// if configuration_web_url is set, this setting is completely managed by the
@@ -207,34 +180,174 @@ func (d *DEPService) RegisterProfileWithAppleDEPServer(ctx context.Context, team
 	// enable_release_device_manually is true.
 	jsonProf.AwaitDeviceConfigured = true
 
-	depClient := NewDEPClient(d.depStorage, d.ds, d.logger)
-	res, err := depClient.DefineProfile(ctx, DEPName, &jsonProf)
+	return &jsonProf, nil
+}
+
+// RegisterProfileWithAppleDEPServer registers the enrollment profile in
+// Apple's servers via the DEP API, so it can be used for assignment. If
+// setupAsst is nil, the default profile is registered. It assigns the
+// up-to-date dynamic settings such as the server URL and MDM SSO URL if
+// end-user authentication is enabled for that team/no-team.
+//
+// It does that registration for all tokens associated in any way with that
+// team - that is, if DEP hosts are part of that team then the token used to
+// discover those hosts will be used to register the profile, and if a token
+// has that team as default team for a platform, it will also be used to
+// register the profile.
+//
+// On success, it returns the profile uuid and timestamp for the specific token
+// of interest to the caller (identified by its organization name).
+func (d *DEPService) RegisterProfileWithAppleDEPServer(ctx context.Context, team *fleet.Team, setupAsst *fleet.MDMAppleSetupAssistant, abmTokenOrgName string) (string, time.Time, error) {
+	appCfg, err := d.ds.AppConfig(ctx)
 	if err != nil {
-		return ctxerr.Wrap(ctx, err, "apple POST /profile request failed")
+		return "", time.Time{}, ctxerr.Wrap(ctx, err, "fetching app config")
 	}
 
+	// must always get the default profile, because the authentication token is
+	// defined on that profile.
+	defaultProf, err := d.ds.GetMDMAppleEnrollmentProfileByType(ctx, fleet.MDMAppleEnrollmentTypeAutomatic)
+	if err != nil {
+		return "", time.Time{}, ctxerr.Wrap(ctx, err, "fetching default profile")
+	}
+
+	enrollURL, err := EnrollURL(defaultProf.Token, appCfg)
+	if err != nil {
+		return "", time.Time{}, ctxerr.Wrap(ctx, err, "generating enroll URL")
+	}
+
+	var rawJSON json.RawMessage
+	var requestedTokenModTime time.Time
+	if defaultProf.DEPProfile != nil {
+		rawJSON = *defaultProf.DEPProfile
+		requestedTokenModTime = defaultProf.UpdatedAt
+	}
 	if setupAsst != nil {
-		setupAsst.ProfileUUID = res.ProfileUUID
-		if err := d.ds.SetMDMAppleSetupAssistantProfileUUID(ctx, setupAsst.TeamID, res.ProfileUUID); err != nil {
-			return ctxerr.Wrap(ctx, err, "save setup assistant profile UUID")
+		rawJSON = setupAsst.Profile
+		requestedTokenModTime = setupAsst.UploadedAt
+	}
+
+	jsonProf, err := d.buildJSONProfile(ctx, rawJSON, appCfg, team, enrollURL)
+	if err != nil {
+		return "", time.Time{}, ctxerr.Wrap(ctx, err, "building json profile")
+	}
+
+	depClient := NewDEPClient(d.depStorage, d.ds, d.logger)
+	// Get all relevant org names
+	var tmID *uint
+	if team != nil {
+		tmID = &team.ID
+	}
+
+	orgNames, err := d.ds.GetABMTokenOrgNamesAssociatedWithTeam(ctx, tmID)
+	if err != nil {
+		return "", time.Time{}, ctxerr.Wrap(ctx, err, "getting org names for team to register profile")
+	}
+
+	if len(orgNames) == 0 {
+		d.logger.Log("msg", "skipping defining profile for team with no relevant ABM token")
+		return "", time.Time{}, nil
+	}
+
+	var requestedTokenProfileUUID string
+	for _, orgName := range orgNames {
+		res, err := depClient.DefineProfile(ctx, orgName, jsonProf)
+		if err != nil {
+			return "", time.Time{}, ctxerr.Wrap(ctx, err, "apple POST /profile request failed")
 		}
-	} else {
-		var tmID *uint
-		if team != nil {
-			tmID = &team.ID
+
+		if setupAsst != nil {
+			if err := d.ds.SetMDMAppleSetupAssistantProfileUUID(ctx, setupAsst.TeamID, res.ProfileUUID, orgName); err != nil {
+				return "", time.Time{}, ctxerr.Wrap(ctx, err, "save setup assistant profile UUID")
+			}
+		} else {
+			if err := d.ds.SetMDMAppleDefaultSetupAssistantProfileUUID(ctx, tmID, res.ProfileUUID, orgName); err != nil {
+				return "", time.Time{}, ctxerr.Wrap(ctx, err, "save default setup assistant profile UUID")
+			}
 		}
-		if err := d.ds.SetMDMAppleDefaultSetupAssistantProfileUUID(ctx, tmID, res.ProfileUUID); err != nil {
-			return ctxerr.Wrap(ctx, err, "save default setup assistant profile UUID")
+		if orgName == abmTokenOrgName {
+			requestedTokenProfileUUID = res.ProfileUUID
 		}
 	}
+	return requestedTokenProfileUUID, requestedTokenModTime, nil
+}
+
+// ValidateSetupAssistant validates the setup assistant by sending the profile to the DefineProfile
+// Apple API.
+func (d *DEPService) ValidateSetupAssistant(ctx context.Context, team *fleet.Team, setupAsst *fleet.MDMAppleSetupAssistant, abmTokenOrgName string) error {
+	appCfg, err := d.ds.AppConfig(ctx)
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "fetching app config")
+	}
+
+	// must always get the default profile, because the authentication token is
+	// defined on that profile.
+	defaultProf, err := d.ds.GetMDMAppleEnrollmentProfileByType(ctx, fleet.MDMAppleEnrollmentTypeAutomatic)
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "fetching default profile")
+	}
+
+	enrollURL, err := EnrollURL(defaultProf.Token, appCfg)
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "generating enroll URL")
+	}
+
+	rawJSON := setupAsst.Profile
+
+	jsonProf, err := d.buildJSONProfile(ctx, rawJSON, appCfg, team, enrollURL)
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "building json profile")
+	}
+
+	depClient := NewDEPClient(d.depStorage, d.ds, d.logger)
+	// Get all relevant org names
+	var tmID *uint
+	if team != nil {
+		tmID = &team.ID
+	}
+
+	orgNames, err := d.ds.GetABMTokenOrgNamesAssociatedWithTeam(ctx, tmID)
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "getting org names for team to register profile")
+	}
+
+	if len(orgNames) == 0 {
+		// Then check to see if there are any tokens at all. If there is only 1, we assume we can
+		// use it (the vast majority of deployments will only have a single token).
+		toks, err := d.ds.ListABMTokens(ctx)
+		if err != nil {
+			return ctxerr.Wrap(ctx, err, "listing ABM tokens")
+		}
+
+		if len(toks) != 1 {
+			return ctxerr.New(ctx, "No relevant ABM tokens found. Please set this team as a default team for an ABM token.")
+		}
+
+		orgNames = append(orgNames, toks[0].OrganizationName)
+	}
+
+	for _, orgName := range orgNames {
+		_, err := depClient.DefineProfile(ctx, orgName, jsonProf)
+		if err != nil {
+			var httpErr *godep.HTTPError
+			if errors.As(err, &httpErr) {
+				// We can count on this working because of how the godep.HTTPerror Error() method
+				// formats its output.
+				return ctxerr.Errorf(ctx, "Couldn't upload. %s", string(httpErr.Body))
+			}
+
+			return ctxerr.Wrap(ctx, err, "sending profile to Apple failed")
+		}
+	}
+
 	return nil
 }
 
 // EnsureDefaultSetupAssistant ensures that the default Setup Assistant profile
 // is created and registered with Apple for the provided team/no-team (if team
-// is nil), and returns its profile UUID. It does not re-define the profile if
-// it already exists and registered.
-func (d *DEPService) EnsureDefaultSetupAssistant(ctx context.Context, team *fleet.Team) (string, time.Time, error) {
+// is nil) using the specified ABM token, and returns its profile UUID. It does
+// not re-define the profile if it already exists and registered for that
+// token.
+func (d *DEPService) EnsureDefaultSetupAssistant(ctx context.Context, team *fleet.Team, abmTokenOrgName string) (string, time.Time, error) {
 	// the first step is to ensure that the default profile entry exists in the
 	// mdm_apple_enrollment_profiles table. When we create it there we also
 	// create the authentication token to retrieve enrollment profiles, and
@@ -250,23 +363,20 @@ func (d *DEPService) EnsureDefaultSetupAssistant(ctx context.Context, team *flee
 	}
 
 	// now that the default automatic profile is created and a token generated,
-	// check if the default profile was registered with Apple for that team.
+	// check if the default profile was registered with Apple for the ABM token.
 	var tmID *uint
 	if team != nil {
 		tmID = &team.ID
 	}
-	profUUID, modTime, err := d.ds.GetMDMAppleDefaultSetupAssistant(ctx, tmID)
+	profUUID, modTime, err := d.ds.GetMDMAppleDefaultSetupAssistant(ctx, tmID, abmTokenOrgName)
 	if err != nil && !fleet.IsNotFound(err) {
 		return "", time.Time{}, ctxerr.Wrap(ctx, err, "get default setup assistant profile uuid")
 	}
 	if profUUID == "" {
 		d.logger.Log("msg", "default DEP profile not set, registering")
-		if err := d.RegisterProfileWithAppleDEPServer(ctx, team, nil); err != nil {
-			return "", time.Time{}, ctxerr.Wrap(ctx, err, "register default setup assistant with Apple")
-		}
-		profUUID, modTime, err = d.ds.GetMDMAppleDefaultSetupAssistant(ctx, tmID)
+		profUUID, modTime, err = d.RegisterProfileWithAppleDEPServer(ctx, team, nil, abmTokenOrgName)
 		if err != nil {
-			return "", time.Time{}, ctxerr.Wrap(ctx, err, "get default setup assistant profile uuid after registering")
+			return "", time.Time{}, ctxerr.Wrap(ctx, err, "register default setup assistant with Apple")
 		}
 	}
 	return profUUID, modTime, nil
@@ -274,14 +384,16 @@ func (d *DEPService) EnsureDefaultSetupAssistant(ctx context.Context, team *flee
 
 // EnsureCustomSetupAssistantIfExists ensures that the custom Setup Assistant
 // profile associated with the provided team (or no team) is registered with
-// Apple, and returns its profile UUID. It does not re-define the profile if it
-// is already registered. If no custom setup assistant exists, it returns an
-// empty string and timestamp and no error.
-func (d *DEPService) EnsureCustomSetupAssistantIfExists(ctx context.Context, team *fleet.Team) (string, time.Time, error) {
+// Apple for the specified ABM token, and returns its profile UUID. It does not
+// re-define the profile if it is already registered for that token. If no
+// custom setup assistant exists, it returns an empty string and timestamp and
+// no error.
+func (d *DEPService) EnsureCustomSetupAssistantIfExists(ctx context.Context, team *fleet.Team, abmTokenOrgName string) (string, time.Time, error) {
 	var tmID *uint
 	if team != nil {
 		tmID = &team.ID
 	}
+
 	asst, err := d.ds.GetMDMAppleSetupAssistant(ctx, tmID)
 	if err != nil {
 		if fleet.IsNotFound(err) {
@@ -291,63 +403,124 @@ func (d *DEPService) EnsureCustomSetupAssistantIfExists(ctx context.Context, tea
 		return "", time.Time{}, err
 	}
 
-	if asst.ProfileUUID == "" {
-		if err := d.RegisterProfileWithAppleDEPServer(ctx, team, asst); err != nil {
+	// if we get here, there IS a custom setup assistant, so get its profile UUID
+	profileUUID, modTime, err := d.ds.GetMDMAppleSetupAssistantProfileForABMToken(ctx, tmID, abmTokenOrgName)
+	if err != nil && !fleet.IsNotFound(err) {
+		return "", time.Time{}, err
+	}
+
+	if profileUUID == "" {
+		// registers the profile for all tokens associated with the team
+		profileUUID, modTime, err = d.RegisterProfileWithAppleDEPServer(ctx, team, asst, abmTokenOrgName)
+		if err != nil {
 			return "", time.Time{}, err
 		}
 	}
-	return asst.ProfileUUID, asst.UploadedAt, nil
+	return profileUUID, modTime, nil
 }
 
 func (d *DEPService) RunAssigner(ctx context.Context) error {
-	// get the Apple BM default team
-	appCfg, err := d.ds.AppConfig(ctx)
+	syncerLogger := logging.NewNanoDEPLogger(kitlog.With(d.logger, "component", "nanodep-syncer"))
+	teams, err := d.ds.ListTeams(
+		ctx, fleet.TeamFilter{
+			User: &fleet.User{
+				GlobalRole: ptr.String(fleet.RoleAdmin),
+			},
+		}, fleet.ListOptions{},
+	)
 	if err != nil {
-		return err
+		return ctxerr.Wrap(ctx, err, "listing teams")
 	}
-	var appleBMTeam *fleet.Team
-	if appCfg.MDM.AppleBMDefaultTeam != "" {
-		tm, err := d.ds.TeamByName(ctx, appCfg.MDM.AppleBMDefaultTeam)
-		if err != nil && !fleet.IsNotFound(err) {
-			return err
+
+	teamsByID := make(map[uint]*fleet.Team, len(teams))
+	for _, tm := range teams {
+		teamsByID[tm.ID] = tm
+	}
+
+	tokens, err := d.ds.ListABMTokens(ctx)
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "listing ABM tokens")
+	}
+
+	var result error
+	for _, token := range tokens {
+		var macOSTeam, iosTeam, ipadTeam *fleet.Team
+
+		if token.MacOSDefaultTeamID != nil {
+			macOSTeam = teamsByID[*token.MacOSDefaultTeamID]
 		}
-		appleBMTeam = tm
-	}
 
-	// ensure the default (fallback) setup assistant profile exists, registered
-	// with Apple DEP.
-	_, defModTime, err := d.EnsureDefaultSetupAssistant(ctx, appleBMTeam)
-	if err != nil {
-		return err
-	}
+		if token.IOSDefaultTeamID != nil {
+			iosTeam = teamsByID[*token.IOSDefaultTeamID]
+		}
 
-	// if the team/no-team has a custom setup assistant, ensure it is registered
-	// with Apple DEP.
-	customUUID, customModTime, err := d.EnsureCustomSetupAssistantIfExists(ctx, appleBMTeam)
-	if err != nil {
-		return err
-	}
+		if token.IPadOSDefaultTeamID != nil {
+			ipadTeam = teamsByID[*token.IPadOSDefaultTeamID]
+		}
 
-	// get the modification timestamp of the effective profile (custom or default)
-	effectiveProfModTime := defModTime
-	if customUUID != "" {
-		effectiveProfModTime = customModTime
-	}
+		teams := []*fleet.Team{macOSTeam, iosTeam, ipadTeam}
+		for _, team := range teams {
+			// ensure the default (fallback) setup assistant profile exists, registered
+			// with Apple DEP.
+			_, defModTime, err := d.EnsureDefaultSetupAssistant(ctx, team, token.OrganizationName)
+			if err != nil {
+				result = multierror.Append(result, err)
+				continue
+			}
 
-	cursor, cursorModTime, err := d.depStorage.RetrieveCursor(ctx, DEPName)
-	if err != nil {
-		return err
-	}
+			// if the team/no-team has a custom setup assistant, ensure it is registered
+			// with Apple DEP.
+			customUUID, customModTime, err := d.EnsureCustomSetupAssistantIfExists(ctx, team, token.OrganizationName)
+			if err != nil {
+				result = multierror.Append(result, err)
+				continue
+			}
 
-	// If the effective profile was changed since last sync then we clear
-	// the cursor and perform a full sync of all devices and profile assigning.
-	if cursor != "" && effectiveProfModTime.After(cursorModTime) {
-		d.logger.Log("msg", "clearing device syncer cursor")
-		if err := d.depStorage.StoreCursor(ctx, DEPName, ""); err != nil {
-			return err
+			// get the modification timestamp of the effective profile (custom or default)
+			effectiveProfModTime := defModTime
+			if customUUID != "" {
+				effectiveProfModTime = customModTime
+			}
+
+			cursor, cursorModTime, err := d.depStorage.RetrieveCursor(ctx, token.OrganizationName)
+			if err != nil {
+				result = multierror.Append(result, err)
+				continue
+			}
+
+			if cursor != "" && effectiveProfModTime.After(cursorModTime) {
+				d.logger.Log("msg", "clearing device syncer cursor", "org_name", token.OrganizationName)
+				if err := d.depStorage.StoreCursor(ctx, token.OrganizationName, ""); err != nil {
+					result = multierror.Append(result, err)
+					continue
+				}
+			}
+
+		}
+
+		syncer := depsync.NewSyncer(
+			d.depClient,
+			token.OrganizationName,
+			d.depStorage,
+			depsync.WithLogger(syncerLogger),
+			depsync.WithCallback(func(ctx context.Context, isFetch bool, resp *godep.DeviceResponse) error {
+				// the nanodep syncer just logs the error of the callback, so in order to
+				// capture it we need to do this here.
+				err := d.processDeviceResponse(ctx, resp, token.ID, token.OrganizationName, macOSTeam, iosTeam, ipadTeam)
+				if err != nil {
+					ctxerr.Handle(ctx, err)
+				}
+				return err
+			}),
+		)
+
+		if err := syncer.Run(ctx); err != nil {
+			result = multierror.Append(result, err)
+			continue
 		}
 	}
-	return d.syncer.Run(ctx)
+
+	return result
 }
 
 func NewDEPService(
@@ -355,36 +528,28 @@ func NewDEPService(
 	depStorage nanodep_storage.AllDEPStorage,
 	logger kitlog.Logger,
 ) *DEPService {
-	depClient := NewDEPClient(depStorage, ds, logger)
 	depSvc := &DEPService{
 		depStorage: depStorage,
 		logger:     logger,
 		ds:         ds,
+		depClient:  NewDEPClient(depStorage, ds, logger),
 	}
 
-	depSvc.syncer = depsync.NewSyncer(
-		depClient,
-		DEPName,
-		depStorage,
-		depsync.WithLogger(logging.NewNanoDEPLogger(kitlog.With(logger, "component", "nanodep-syncer"))),
-		depsync.WithCallback(func(ctx context.Context, isFetch bool, resp *godep.DeviceResponse) error {
-			// the nanodep syncer just logs the error of the callback, so in order to
-			// capture it we need to do this here.
-			err := depSvc.processDeviceResponse(ctx, depClient, resp)
-			if err != nil {
-				ctxerr.Handle(ctx, err)
-			}
-			return err
-		}),
-	)
-
 	return depSvc
 }
 
 // processDeviceResponse processes the device response from the device sync
 // DEP API endpoints and assigns the profile UUID associated with the DEP
 // client DEP name.
-func (d *DEPService) processDeviceResponse(ctx context.Context, depClient *godep.Client, resp *godep.DeviceResponse) error {
+func (d *DEPService) processDeviceResponse(
+	ctx context.Context,
+	resp *godep.DeviceResponse,
+	abmTokenID uint,
+	abmOrganizationName string,
+	macOSTeam *fleet.Team,
+	iosTeam *fleet.Team,
+	ipadTeam *fleet.Team,
+) error {
 	if len(resp.Devices) < 1 {
 		// no devices means we can't assign anything
 		return nil
@@ -452,7 +617,7 @@ func (d *DEPService) processDeviceResponse(ctx context.Context, depClient *godep
 		return ctxerr.Wrap(ctx, err, "deleting DEP assignments")
 	}
 
-	n, defaultABMTeamID, err := d.ds.IngestMDMAppleDevicesFromDEPSync(ctx, addedDevices)
+	n, err := d.ds.IngestMDMAppleDevicesFromDEPSync(ctx, addedDevices, abmTokenID, macOSTeam, iosTeam, ipadTeam)
 	switch {
 	case err != nil:
 		level.Error(kitlog.With(d.logger)).Log("err", err)
@@ -463,54 +628,68 @@ func (d *DEPService) processDeviceResponse(ctx context.Context, depClient *godep
 		level.Debug(kitlog.With(d.logger)).Log("msg", "no DEP hosts to add")
 	}
 
+	level.Debug(kitlog.With(d.logger)).Log("msg", "devices to assign DEP profiles", "to_add", len(addedDevices), "to_remove", deletedSerials, "to_modify", modifiedSerials)
+
 	// at this point, the hosts rows are created for the devices, with the
 	// correct team_id, so we know what team-specific profile needs to be applied.
 	//
 	// collect a map of all the profiles => serials we need to assign.
 	profileToDevices := map[string][]godep.Device{}
+	var iosTeamID, macOSTeamID, ipadTeamID *uint
+	if iosTeam != nil {
+		iosTeamID = &iosTeam.ID
+	}
+	if macOSTeam != nil {
+		macOSTeamID = &macOSTeam.ID
+	}
+	if ipadTeam != nil {
+		ipadTeamID = &ipadTeam.ID
+	}
 
 	// each new device should be assigned the DEP profile of the default
 	// ABM team as configured by the IT admin.
-	if len(addedDevices) > 0 {
-		level.Debug(kitlog.With(d.logger)).Log("msg", "gathering added serials to assign devices", "len", len(addedDevices))
-		profUUID, err := d.getProfileUUIDForTeam(ctx, defaultABMTeamID)
-		if err != nil {
-			return ctxerr.Wrapf(ctx, err, "getting profile for default team with id: %v", defaultABMTeamID)
+	devicesByTeam := map[*uint][]godep.Device{}
+	for _, newDevice := range addedDevices {
+		var teamID *uint
+		switch newDevice.DeviceFamily {
+		case "iPhone":
+			teamID = iosTeamID
+		case "iPad":
+			teamID = ipadTeamID
+		default:
+			teamID = macOSTeamID
 		}
+		devicesByTeam[teamID] = append(devicesByTeam[teamID], newDevice)
 
-		profileToDevices[profUUID] = addedDevices
-	} else {
-		level.Debug(kitlog.With(d.logger)).Log("msg", "no added devices to assign DEP profiles")
 	}
 
-	// for all other hosts we received, find out the right DEP profile to assign, based on the team.
-	if len(existingSerials) > 0 {
-		level.Debug(kitlog.With(d.logger)).Log("msg", "gathering existing serials to assign devices", "len", len(existingSerials))
-		devicesByTeam := map[*uint][]godep.Device{}
-		hosts := []fleet.Host{}
-		for _, host := range existingSerials {
-			dd, ok := modifiedDevices[host.HardwareSerial]
-			if !ok {
-				return ctxerr.Errorf(ctx, "serial %s coming from ABM is in the databse, but it's not in the list of modified devices", host.HardwareSerial)
-			}
-			hosts = append(hosts, *host)
-			devicesByTeam[host.TeamID] = append(devicesByTeam[host.TeamID], dd)
+	// for all other hosts we received, find out the right DEP profile to
+	// assign, based on the team.
+	existingHosts := []fleet.Host{}
+	for _, existingHost := range existingSerials {
+		dd, ok := modifiedDevices[existingHost.HardwareSerial]
+		if !ok {
+			level.Error(kitlog.With(d.logger)).Log("msg", "serial coming from ABM is in the databse, but it's not in the list of modified devices", "serial", existingHost.HardwareSerial)
+			continue
 		}
-		for team, devices := range devicesByTeam {
-			profUUID, err := d.getProfileUUIDForTeam(ctx, team)
-			if err != nil {
-				return ctxerr.Wrapf(ctx, err, "getting profile for team with id: %v", team)
-			}
+		existingHosts = append(existingHosts, *existingHost)
+		devicesByTeam[existingHost.TeamID] = append(devicesByTeam[existingHost.TeamID], dd)
+	}
 
-			profileToDevices[profUUID] = append(profileToDevices[profUUID], devices...)
+	// assign the profile to each device
+	for team, devices := range devicesByTeam {
+		profUUID, err := d.getProfileUUIDForTeam(ctx, team, abmOrganizationName)
+		if err != nil {
+			return ctxerr.Wrapf(ctx, err, "getting profile for team with id: %v", team)
 		}
 
-		if err := d.ds.UpsertMDMAppleHostDEPAssignments(ctx, hosts); err != nil {
-			return ctxerr.Wrap(ctx, err, "upserting dep assignment for existing device")
-		}
+		profileToDevices[profUUID] = append(profileToDevices[profUUID], devices...)
+	}
 
-	} else {
-		level.Debug(kitlog.With(d.logger)).Log("msg", "no existing devices to assign DEP profiles")
+	if len(existingHosts) > 0 {
+		if err := d.ds.UpsertMDMAppleHostDEPAssignments(ctx, existingHosts, abmTokenID); err != nil {
+			return ctxerr.Wrap(ctx, err, "upserting dep assignment for existing devices")
+		}
 	}
 
 	// keep track of the serials we're going to skip for all profiles in
@@ -531,7 +710,6 @@ func (d *DEPService) processDeviceResponse(ctx context.Context, depClient *godep
 		}
 
 		logger := kitlog.With(d.logger, "profile_uuid", profUUID)
-		level.Info(logger).Log("msg", "calling DEP client to assign profile", "profile_uuid", profUUID)
 
 		skipSerials, assignSerials, err := d.ds.ScreenDEPAssignProfileSerialsForCooldown(ctx, serials)
 		if err != nil {
@@ -547,25 +725,29 @@ func (d *DEPService) processDeviceResponse(ctx context.Context, depClient *godep
 			continue
 		}
 
-		apiResp, err := depClient.AssignProfile(ctx, DEPName, profUUID, assignSerials...)
-		if err != nil {
-			level.Error(logger).Log(
-				"msg", "assign profile",
+		for orgName, serials := range assignSerials {
+			apiResp, err := d.depClient.AssignProfile(ctx, orgName, profUUID, serials...)
+			if err != nil {
+				// only log the error so the failure can be recorded
+				// below in UpdateHostDEPAssignProfileResponses and
+				// the proper cooldowns are applied
+				level.Error(logger).Log(
+					"msg", "assign profile",
+					"devices", len(assignSerials),
+					"err", err,
+				)
+			}
+
+			logs := []interface{}{
+				"msg", "profile assigned",
 				"devices", len(assignSerials),
-				"err", err,
-			)
-			return fmt.Errorf("assign profile: %w", err)
-		}
+			}
+			logs = append(logs, logCountsForResults(apiResp.Devices)...)
+			level.Info(logger).Log(logs...)
 
-		logs := []interface{}{
-			"msg", "profile assigned",
-			"devices", len(assignSerials),
-		}
-		logs = append(logs, logCountsForResults(apiResp.Devices)...)
-		level.Info(logger).Log(logs...)
-
-		if err := d.ds.UpdateHostDEPAssignProfileResponses(ctx, apiResp); err != nil {
-			return ctxerr.Wrap(ctx, err, "update host dep assign profile responses")
+			if err := d.ds.UpdateHostDEPAssignProfileResponses(ctx, apiResp); err != nil {
+				return ctxerr.Wrap(ctx, err, "update host dep assign profile responses")
+			}
 		}
 	}
 
@@ -576,7 +758,7 @@ func (d *DEPService) processDeviceResponse(ctx context.Context, depClient *godep
 	return nil
 }
 
-func (d *DEPService) getProfileUUIDForTeam(ctx context.Context, tmID *uint) (string, error) {
+func (d *DEPService) getProfileUUIDForTeam(ctx context.Context, tmID *uint, abmTokenOrgName string) (string, error) {
 	var appleBMTeam *fleet.Team
 	if tmID != nil {
 		tm, err := d.ds.Team(ctx, *tmID)
@@ -587,12 +769,12 @@ func (d *DEPService) getProfileUUIDForTeam(ctx context.Context, tmID *uint) (str
 	}
 
 	// get profile uuid of team or default
-	profUUID, _, err := d.EnsureCustomSetupAssistantIfExists(ctx, appleBMTeam)
+	profUUID, _, err := d.EnsureCustomSetupAssistantIfExists(ctx, appleBMTeam, abmTokenOrgName)
 	if err != nil {
-		return "", fmt.Errorf("ensure setup assistant for team %v: %w", tmID, err)
+		return "", fmt.Errorf("ensure setup assistant for team: %w", err)
 	}
 	if profUUID == "" {
-		profUUID, _, err = d.EnsureDefaultSetupAssistant(ctx, appleBMTeam)
+		profUUID, _, err = d.EnsureDefaultSetupAssistant(ctx, appleBMTeam, abmTokenOrgName)
 		if err != nil {
 			return "", fmt.Errorf("ensure default setup assistant: %w", err)
 		}
@@ -620,34 +802,76 @@ func logCountsForResults(deviceResults map[string]string) (out []interface{}) {
 }
 
 // NewDEPClient creates an Apple DEP API HTTP client based on the provided
-// storage that will flag the AppConfig's AppleBMTermsExpired field
-// whenever the status of the terms changes.
-func NewDEPClient(storage godep.ClientStorage, appCfgUpdater fleet.AppConfigUpdater, logger kitlog.Logger) *godep.Client {
+// storage that will flag the ABM token's terms expired field and the
+// AppConfig's AppleBMTermsExpired field whenever the status of the terms
+// changes.
+func NewDEPClient(storage godep.ClientStorage, updater fleet.ABMTermsUpdater, logger kitlog.Logger) *godep.Client {
 	return godep.NewClient(storage, fleethttp.NewClient(), godep.WithAfterHook(func(ctx context.Context, reqErr error) error {
+		// to check for ABM terms expired, we must have an ABM token organization
+		// name and NOT a raw ABM token in the context (as the presence of a raw
+		// ABM token means that the token is new, hasn't been saved in the DB yet
+		// so no point checking for the terms expired as we don't have a row in
+		// abm_tokens to save that flag).
+		orgName := depclient.GetName(ctx)
+		if _, rawTokenPresent := ctxabm.FromContext(ctx); rawTokenPresent || orgName == "" {
+			return reqErr
+		}
+
 		// if the request failed due to terms not signed, or if it succeeded,
-		// update the app config flag accordingly. If it failed for any other
-		// reason, do not update the flag.
+		// update the ABM token's (and possibly the app config's) flag accordingly.
+		// If it failed for any other reason, do not update the flag.
 		termsExpired := reqErr != nil && godep.IsTermsNotSigned(reqErr)
 		if reqErr == nil || termsExpired {
-			appCfg, err := appCfgUpdater.AppConfig(ctx)
+			// get the count of tokens with the flag still set
+			count, err := updater.CountABMTokensWithTermsExpired(ctx)
+			if err != nil {
+				level.Error(logger).Log("msg", "Apple DEP client: failed to get count of tokens with terms expired", "err", err)
+				return reqErr
+			}
+
+			// get the appconfig for the global flag
+			appCfg, err := updater.AppConfig(ctx)
 			if err != nil {
 				level.Error(logger).Log("msg", "Apple DEP client: failed to get app config", "err", err)
 				return reqErr
 			}
 
+			// on API call success, if the global terms expired flag is not set and
+			// the count is 0, no need to do anything else (it means this ABM token
+			// already had the flag cleared).
+			if reqErr == nil && count == 0 && !appCfg.MDM.AppleBMTermsExpired {
+				return reqErr
+			}
+
+			// otherwise, update the specific ABM token's flag
+			wasSet, err := updater.SetABMTokenTermsExpiredForOrgName(ctx, orgName, termsExpired)
+			if err != nil {
+				level.Error(logger).Log("msg", "Apple DEP client: failed to update terms expired of ABM token", "err", err)
+				return reqErr
+			}
+
+			// update the count of ABM tokens with the flag set accordingly
+			stillSetCount := count
+			if wasSet && !termsExpired {
+				stillSetCount--
+			} else if !wasSet && termsExpired {
+				stillSetCount++
+			}
+
 			var mustSaveAppCfg bool
-			if termsExpired && !appCfg.MDM.AppleBMTermsExpired {
+			if stillSetCount > 0 && !appCfg.MDM.AppleBMTermsExpired {
 				// flag the AppConfig that the terms have changed and must be accepted
+				// for at least one token
 				appCfg.MDM.AppleBMTermsExpired = true
 				mustSaveAppCfg = true
-			} else if reqErr == nil && appCfg.MDM.AppleBMTermsExpired {
-				// flag the AppConfig that the terms have been accepted
+			} else if stillSetCount == 0 && appCfg.MDM.AppleBMTermsExpired {
+				// flag the AppConfig that the terms have been accepted for all tokens
 				appCfg.MDM.AppleBMTermsExpired = false
 				mustSaveAppCfg = true
 			}
 
 			if mustSaveAppCfg {
-				if err := appCfgUpdater.SaveAppConfig(ctx, appCfg); err != nil {
+				if err := updater.SaveAppConfig(ctx, appCfg); err != nil {
 					level.Error(logger).Log("msg", "Apple DEP client: failed to save app config", "err", err)
 				}
 				level.Info(logger).Log("msg", "Apple DEP client: updated app config Terms Expired flag",
@@ -658,11 +882,71 @@ func NewDEPClient(storage godep.ClientStorage, appCfgUpdater fleet.AppConfigUpda
 	}))
 }
 
+var funcMap = map[string]any{
+	"xml": mobileconfig.XMLEscapeString,
+}
+
+var OTASCEPTemplate = template.Must(template.New("").Funcs(funcMap).Parse(`<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple Inc//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+  <dict>
+    <key>PayloadVersion</key>
+    <integer>1</integer>
+    <key>PayloadType</key>
+    <string>Configuration</string>
+    <key>PayloadIdentifier</key>
+    <string>Ignored</string>
+    <key>PayloadUUID</key>
+    <string>Ignored</string>
+    <key>PayloadContent</key>
+    <array>
+      <dict>
+        <key>PayloadContent</key>
+        <dict>
+          <key>Key Type</key>
+          <string>RSA</string>
+          <key>Challenge</key>
+          <string>{{ .SCEPChallenge | xml }}</string>
+          <key>Key Usage</key>
+          <integer>5</integer>
+          <key>Keysize</key>
+          <integer>2048</integer>
+          <key>URL</key>
+          <string>{{ .SCEPURL }}</string>
+          <key>Subject</key>
+          <array>
+            <array>
+              <array>
+                <string>O</string>
+                <string>Fleet</string>
+              </array>
+            </array>
+            <array>
+              <array>
+                <string>CN</string>
+                <string>Fleet Identity</string>
+              </array>
+            </array>
+          </array>
+        </dict>
+        <key>PayloadIdentifier</key>
+        <string>com.fleetdm.fleet.mdm.apple.scep</string>
+        <key>PayloadType</key>
+        <string>com.apple.security.scep</string>
+        <key>PayloadUUID</key>
+        <string>BCA53F9D-5DD2-494D-98D3-0D0F20FF6BA1</string>
+        <key>PayloadVersion</key>
+        <integer>1</integer>
+      </dict>
+    </array>
+  </dict>
+</plist>`))
+
 // enrollmentProfileMobileconfigTemplate is the template Fleet uses to assemble a .mobileconfig enrollment profile to serve to devices.
 //
 // During a profile replacement, the system updates payloads with the same PayloadIdentifier and
 // PayloadUUID in the old and new profiles.
-var enrollmentProfileMobileconfigTemplate = template.Must(template.New("").Parse(`
+var enrollmentProfileMobileconfigTemplate = template.Must(template.New("").Funcs(funcMap).Parse(`
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -675,7 +959,7 @@ var enrollmentProfileMobileconfigTemplate = template.Must(template.New("").Parse
 				<key>Key Type</key>
 				<string>RSA</string>
 				<key>Challenge</key>
-				<string>{{ .SCEPChallenge }}</string>
+				<string>{{ .SCEPChallenge | xml }}</string>
 				<key>Key Usage</key>
 				<integer>5</integer>
 				<key>Keysize</key>
@@ -726,11 +1010,11 @@ var enrollmentProfileMobileconfigTemplate = template.Must(template.New("").Parse
 		</dict>
 	</array>
 	<key>PayloadDisplayName</key>
-	<string>{{ .Organization }} enrollment</string>
+	<string>{{ .Organization | xml }} enrollment</string>
 	<key>PayloadIdentifier</key>
 	<string>` + FleetPayloadIdentifier + `</string>
 	<key>PayloadOrganization</key>
-	<string>{{ .Organization }}</string>
+	<string>{{ .Organization | xml }}</string>
 	<key>PayloadScope</key>
 	<string>System</string>
 	<key>PayloadType</key>
@@ -752,13 +1036,8 @@ func GenerateEnrollmentProfileMobileconfig(orgName, fleetURL, scepChallenge, top
 		return nil, fmt.Errorf("resolve Apple MDM url: %w", err)
 	}
 
-	var escaped strings.Builder
-	if err := xml.EscapeText(&escaped, []byte(scepChallenge)); err != nil {
-		return nil, fmt.Errorf("escape SCEP challenge for XML: %w", err)
-	}
-
 	var buf bytes.Buffer
-	if err := enrollmentProfileMobileconfigTemplate.Execute(&buf, struct {
+	if err := enrollmentProfileMobileconfigTemplate.Funcs(funcMap).Execute(&buf, struct {
 		Organization  string
 		SCEPURL       string
 		SCEPChallenge string
@@ -767,7 +1046,7 @@ func GenerateEnrollmentProfileMobileconfig(orgName, fleetURL, scepChallenge, top
 	}{
 		Organization:  orgName,
 		SCEPURL:       scepURL,
-		SCEPChallenge: escaped.String(),
+		SCEPChallenge: scepChallenge,
 		Topic:         topic,
 		ServerURL:     serverURL,
 	}); err != nil {
@@ -840,3 +1119,101 @@ func (pb *ProfileBimap) add(wantedProfile, currentProfile *fleet.MDMAppleProfile
 	pb.wantedState[wantedProfile] = currentProfile
 	pb.currentState[currentProfile] = wantedProfile
 }
+
+func IOSiPadOSRefetch(ctx context.Context, ds fleet.Datastore, commander *MDMAppleCommander, logger kitlog.Logger) error {
+	appCfg, err := ds.AppConfig(ctx)
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "fetching app config")
+	}
+
+	if !appCfg.MDM.EnabledAndConfigured {
+		level.Debug(logger).Log("msg", "apple mdm is not configured, skipping run")
+		return nil
+	}
+
+	start := time.Now()
+	devices, err := ds.ListIOSAndIPadOSToRefetch(ctx, 1*time.Hour)
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "list ios and ipad devices to refetch")
+	}
+	if len(devices) == 0 {
+		return nil
+	}
+	logger.Log("msg", "sending commands to refetch", "count", len(devices), "lookup-duration", time.Since(start))
+	commandUUID := uuid.NewString()
+
+	hostMDMCommands := make([]fleet.HostMDMCommand, 0, 2*len(devices))
+	installedAppsUUIDs := make([]string, 0, len(devices))
+	for _, device := range devices {
+		if !slices.Contains(device.CommandsAlreadySent, fleet.RefetchAppsCommandUUIDPrefix) {
+			installedAppsUUIDs = append(installedAppsUUIDs, device.UUID)
+			hostMDMCommands = append(hostMDMCommands, fleet.HostMDMCommand{
+				HostID:      device.HostID,
+				CommandType: fleet.RefetchAppsCommandUUIDPrefix,
+			})
+		}
+	}
+	if len(installedAppsUUIDs) > 0 {
+		err = commander.InstalledApplicationList(ctx, installedAppsUUIDs, fleet.RefetchAppsCommandUUIDPrefix+commandUUID)
+		if err != nil {
+			return ctxerr.Wrap(ctx, err, "send InstalledApplicationList commands to ios and ipados devices")
+		}
+	}
+
+	// DeviceInformation is last because the refetch response clears the refetch_requested flag
+	deviceInfoUUIDs := make([]string, 0, len(devices))
+	for _, device := range devices {
+		if !slices.Contains(device.CommandsAlreadySent, fleet.RefetchDeviceCommandUUIDPrefix) {
+			deviceInfoUUIDs = append(deviceInfoUUIDs, device.UUID)
+			hostMDMCommands = append(hostMDMCommands, fleet.HostMDMCommand{
+				HostID:      device.HostID,
+				CommandType: fleet.RefetchDeviceCommandUUIDPrefix,
+			})
+		}
+	}
+	if len(deviceInfoUUIDs) > 0 {
+		if err := commander.DeviceInformation(ctx, deviceInfoUUIDs, fleet.RefetchDeviceCommandUUIDPrefix+commandUUID); err != nil {
+			return ctxerr.Wrap(ctx, err, "send DeviceInformation commands to ios and ipados devices")
+		}
+	}
+
+	// Add commands to the database to track the commands sent
+	err = ds.AddHostMDMCommands(ctx, hostMDMCommands)
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "add host mdm commands")
+	}
+	return nil
+}
+
+func GenerateOTAEnrollmentProfileMobileconfig(orgName, fleetURL, enrollSecret string) ([]byte, error) {
+	path, err := url.JoinPath(fleetURL, "/api/v1/fleet/ota_enrollment")
+	if err != nil {
+		return nil, fmt.Errorf("creating path for ota enrollment url: %w", err)
+	}
+
+	enrollURL, err := url.Parse(path)
+	if err != nil {
+		return nil, fmt.Errorf("parsing ota enrollment url: %w", err)
+	}
+
+	q := enrollURL.Query()
+	q.Set("enroll_secret", enrollSecret)
+	enrollURL.RawQuery = q.Encode()
+
+	var profileBuf bytes.Buffer
+	tmplArgs := struct {
+		Organization string
+		URL          string
+		EnrollSecret string
+	}{
+		Organization: orgName,
+		URL:          enrollURL.String(),
+	}
+
+	err = mobileconfig.OTAMobileConfigTemplate.Execute(&profileBuf, tmplArgs)
+	if err != nil {
+		return nil, fmt.Errorf("executing ota profile template: %w", err)
+	}
+
+	return profileBuf.Bytes(), nil
+}
diff --git a/server/mdm/apple/apple_mdm_external_test.go b/server/mdm/apple/apple_mdm_external_test.go
index c0a63fd2a8..30287b0a32 100644
--- a/server/mdm/apple/apple_mdm_external_test.go
+++ b/server/mdm/apple/apple_mdm_external_test.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"database/sql"
 	"encoding/json"
+	"fmt"
 	"io"
 	"net/http"
 	"net/http/httptest"
@@ -24,6 +25,7 @@ func TestDEPService_RunAssigner(t *testing.T) {
 	ctx := context.Background()
 	ds := mysql.CreateMySQLDS(t)
 
+	const abmTokenOrgName = "test_org"
 	depStorage, err := ds.NewMDMAppleDEPStorage()
 	require.NoError(t, err)
 
@@ -33,10 +35,10 @@ func TestDEPService_RunAssigner(t *testing.T) {
 		t.Cleanup(srv.Close)
 		t.Cleanup(func() { mysql.TruncateTables(t, ds) })
 
-		err = depStorage.StoreConfig(ctx, apple_mdm.DEPName, &nanodep_client.Config{BaseURL: srv.URL})
+		err = depStorage.StoreConfig(ctx, abmTokenOrgName, &nanodep_client.Config{BaseURL: srv.URL})
 		require.NoError(t, err)
 
-		mysql.SetTestABMAssets(t, ds)
+		mysql.SetTestABMAssets(t, ds, abmTokenOrgName)
 
 		logger := log.NewNopLogger()
 		return apple_mdm.NewDEPService(ds, depStorage, logger)
@@ -52,7 +54,7 @@ func TestDEPService_RunAssigner(t *testing.T) {
 			case "/session":
 				_, _ = w.Write([]byte(`{"auth_session_token": "session123"}`))
 			case "/account":
-				_, _ = w.Write([]byte(`{"admin_id": "admin123", "org_name": "test_org"}`))
+				_, _ = w.Write([]byte(fmt.Sprintf(`{"admin_id": "admin123", "org_name": "%s"}`, abmTokenOrgName)))
 			case "/profile":
 				err := encoder.Encode(godep.ProfileResponse{ProfileUUID: "profile123"})
 				require.NoError(t, err)
@@ -76,7 +78,7 @@ func TestDEPService_RunAssigner(t *testing.T) {
 		require.NotEmpty(t, defProf.Token)
 
 		// a profile UUID was assigned for no-team
-		profUUID, modTime, err := ds.GetMDMAppleDefaultSetupAssistant(ctx, nil)
+		profUUID, modTime, err := ds.GetMDMAppleDefaultSetupAssistant(ctx, nil, abmTokenOrgName)
 		require.NoError(t, err)
 		require.Equal(t, "profile123", profUUID)
 		require.False(t, modTime.Before(start))
@@ -84,7 +86,12 @@ func TestDEPService_RunAssigner(t *testing.T) {
 		// no team to assign to
 		appCfg, err := ds.AppConfig(ctx)
 		require.NoError(t, err)
-		require.Empty(t, appCfg.MDM.AppleBMDefaultTeam)
+		require.Empty(t, appCfg.MDM.DeprecatedAppleBMDefaultTeam)
+		abmTok, err := ds.GetABMTokenByOrgName(ctx, abmTokenOrgName)
+		require.NoError(t, err)
+		require.Nil(t, abmTok.MacOSDefaultTeamID)
+		require.Nil(t, abmTok.IPadOSDefaultTeamID)
+		require.Nil(t, abmTok.IOSDefaultTeamID)
 
 		// no teams, so no team-specific custom setup assistants
 		teams, err := ds.ListTeams(ctx, fleet.TeamFilter{User: test.UserAdmin}, fleet.ListOptions{})
@@ -118,7 +125,7 @@ func TestDEPService_RunAssigner(t *testing.T) {
 			case "/session":
 				_, _ = w.Write([]byte(`{"auth_session_token": "session123"}`))
 			case "/account":
-				_, _ = w.Write([]byte(`{"admin_id": "admin123", "org_name": "test_org"}`))
+				_, _ = w.Write([]byte(fmt.Sprintf(`{"admin_id": "admin123", "org_name": "%s"}`, abmTokenOrgName)))
 			case "/profile":
 				err := encoder.Encode(godep.ProfileResponse{ProfileUUID: "profile123"})
 				require.NoError(t, err)
@@ -156,7 +163,7 @@ func TestDEPService_RunAssigner(t *testing.T) {
 		require.NotEmpty(t, defProf.Token)
 
 		// a profile UUID was assigned to no-team
-		profUUID, modTime, err := ds.GetMDMAppleDefaultSetupAssistant(ctx, nil)
+		profUUID, modTime, err := ds.GetMDMAppleDefaultSetupAssistant(ctx, nil, abmTokenOrgName)
 		require.NoError(t, err)
 		require.Equal(t, "profile123", profUUID)
 		require.False(t, modTime.Before(start))
@@ -190,7 +197,7 @@ func TestDEPService_RunAssigner(t *testing.T) {
 			case "/session":
 				_, _ = w.Write([]byte(`{"auth_session_token": "session123"}`))
 			case "/account":
-				_, _ = w.Write([]byte(`{"admin_id": "admin123", "org_name": "test_org"}`))
+				_, _ = w.Write([]byte(fmt.Sprintf(`{"admin_id": "admin123", "org_name": "%s"}`, abmTokenOrgName)))
 			case "/profile":
 				reqBody, err := io.ReadAll(r.Body)
 				require.NoError(t, err)
@@ -234,12 +241,11 @@ func TestDEPService_RunAssigner(t *testing.T) {
 		tm, err := ds.NewTeam(ctx, &fleet.Team{Name: "test_team"})
 		require.NoError(t, err)
 
-		appCfg, err := ds.AppConfig(ctx)
+		// set that team as default assignment for new macOS devices
+		tok, err := ds.GetABMTokenByOrgName(ctx, abmTokenOrgName)
 		require.NoError(t, err)
-
-		// set that team as default assignment for new devices
-		appCfg.MDM.AppleBMDefaultTeam = tm.Name
-		err = ds.SaveAppConfig(ctx, appCfg)
+		tok.MacOSDefaultTeamID = &tm.ID
+		err = ds.SaveABMToken(ctx, tok)
 		require.NoError(t, err)
 
 		// create a custom setup assistant for that team
@@ -262,7 +268,7 @@ func TestDEPService_RunAssigner(t *testing.T) {
 		require.NotEmpty(t, defProf.Token)
 
 		// a profile UUID was assigned to the team
-		profUUID, modTime, err := ds.GetMDMAppleDefaultSetupAssistant(ctx, &tm.ID)
+		profUUID, modTime, err := ds.GetMDMAppleDefaultSetupAssistant(ctx, &tm.ID, abmTokenOrgName)
 		require.NoError(t, err)
 		require.Equal(t, "profile123", profUUID)
 		require.False(t, modTime.Before(start))
@@ -270,8 +276,11 @@ func TestDEPService_RunAssigner(t *testing.T) {
 		// the team-specific custom profile was registered
 		tmAsst, err = ds.GetMDMAppleSetupAssistant(ctx, tmAsst.TeamID)
 		require.NoError(t, err)
-		require.Equal(t, "profile456", tmAsst.ProfileUUID)
 		require.False(t, tmAsst.UploadedAt.Before(start))
+		profileUUID, modTime, err := ds.GetMDMAppleSetupAssistantProfileForABMToken(ctx, &tm.ID, abmTokenOrgName)
+		require.NoError(t, err)
+		require.Equal(t, "profile456", profileUUID)
+		require.True(t, tmAsst.UploadedAt.Equal(modTime))
 
 		// a couple hosts were created and assigned to the team (except the op_type ignored)
 		hosts, err := ds.ListHosts(ctx, fleet.TeamFilter{User: test.UserAdmin}, fleet.HostListOptions{})
diff --git a/server/mdm/apple/apple_mdm_test.go b/server/mdm/apple/apple_mdm_test.go
index a03b5030d7..156736ecd4 100644
--- a/server/mdm/apple/apple_mdm_test.go
+++ b/server/mdm/apple/apple_mdm_test.go
@@ -16,6 +16,7 @@ import (
 	"github.com/fleetdm/fleet/v4/server/mock"
 	nanodep_mock "github.com/fleetdm/fleet/v4/server/mock/nanodep"
 	"github.com/go-kit/log"
+	"github.com/groob/plist"
 	"github.com/stretchr/testify/require"
 )
 
@@ -67,6 +68,9 @@ func TestDEPService(t *testing.T) {
 				Token:      p.Token,
 				Type:       p.Type,
 				DEPProfile: p.DEPProfile,
+				UpdateCreateTimestamps: fleet.UpdateCreateTimestamps{
+					UpdateTimestamp: fleet.UpdateTimestamp{UpdatedAt: time.Now()},
+				},
 			}
 			savedProfile = res
 			return res, nil
@@ -81,14 +85,14 @@ func TestDEPService(t *testing.T) {
 		}
 
 		var defaultProfileUUID string
-		ds.GetMDMAppleDefaultSetupAssistantFunc = func(ctx context.Context, teamID *uint) (profileUUID string, updatedAt time.Time, err error) {
+		ds.GetMDMAppleDefaultSetupAssistantFunc = func(ctx context.Context, teamID *uint, orgName string) (profileUUID string, updatedAt time.Time, err error) {
 			if defaultProfileUUID == "" {
 				return "", time.Time{}, nil
 			}
 			return defaultProfileUUID, time.Now(), nil
 		}
 
-		ds.SetMDMAppleDefaultSetupAssistantProfileUUIDFunc = func(ctx context.Context, teamID *uint, profileUUID string) error {
+		ds.SetMDMAppleDefaultSetupAssistantProfileUUIDFunc = func(ctx context.Context, teamID *uint, profileUUID, orgName string) error {
 			require.Nil(t, teamID)
 			defaultProfileUUID = profileUUID
 			return nil
@@ -107,12 +111,19 @@ func TestDEPService(t *testing.T) {
 		}
 
 		depStorage.StoreAssignerProfileFunc = func(ctx context.Context, name string, profileUUID string) error {
-			require.Equal(t, name, DEPName)
 			require.NotEmpty(t, profileUUID)
 			return nil
 		}
 
-		profUUID, modTime, err := depSvc.EnsureDefaultSetupAssistant(ctx, nil)
+		ds.GetABMTokenOrgNamesAssociatedWithTeamFunc = func(ctx context.Context, teamID *uint) ([]string, error) {
+			return []string{"org1"}, nil
+		}
+
+		ds.CountABMTokensWithTermsExpiredFunc = func(ctx context.Context) (int, error) {
+			return 0, nil
+		}
+
+		profUUID, modTime, err := depSvc.EnsureDefaultSetupAssistant(ctx, nil, "org1")
 		require.NoError(t, err)
 		require.Equal(t, "abcd", profUUID)
 		require.NotZero(t, modTime)
@@ -183,6 +194,79 @@ func TestAddEnrollmentRefToFleetURL(t *testing.T) {
 	}
 }
 
+func TestGenerateEnrollmentProfileMobileconfig(t *testing.T) {
+	type scepPayload struct {
+		Challenge string
+		URL       string
+	}
+
+	type enrollmentPayload struct {
+		PayloadType    string
+		ServerURL      string      // used by the enrollment payload
+		PayloadContent scepPayload // scep contains a nested payload content dict
+	}
+
+	type enrollmentProfile struct {
+		PayloadIdentifier string
+		PayloadContent    []enrollmentPayload
+	}
+
+	tests := []struct {
+		name          string
+		orgName       string
+		fleetURL      string
+		scepChallenge string
+		expectError   bool
+	}{
+		{
+			name:          "valid input with simple values",
+			orgName:       "Fleet",
+			fleetURL:      "https://example.com",
+			scepChallenge: "testChallenge",
+			expectError:   false,
+		},
+		{
+			name:          "organization name and enroll secret with special characters",
+			orgName:       `Fleet & Co. "Special" <Org>`,
+			fleetURL:      "https://example.com",
+			scepChallenge: "test/&Challenge",
+			expectError:   false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result, err := GenerateEnrollmentProfileMobileconfig(tt.orgName, tt.fleetURL, tt.scepChallenge, "com.foo.bar")
+			if tt.expectError {
+				require.Error(t, err)
+			} else {
+				require.NoError(t, err)
+				require.NotNil(t, result)
+
+				var profile enrollmentProfile
+
+				require.NoError(t, plist.Unmarshal(result, &profile))
+
+				for _, p := range profile.PayloadContent {
+					switch p.PayloadType {
+					case "com.apple.security.scep":
+						scepURL, err := ResolveAppleSCEPURL(tt.fleetURL)
+						require.NoError(t, err)
+						require.Equal(t, scepURL, p.PayloadContent.URL)
+						require.Equal(t, tt.scepChallenge, p.PayloadContent.Challenge)
+					case "com.apple.mdm":
+						mdmURL, err := ResolveAppleMDMURL(tt.fleetURL)
+						require.NoError(t, err)
+						require.Contains(t, mdmURL, p.ServerURL)
+					default:
+						require.Failf(t, "unrecognized payload type in enrollment profile: %s", p.PayloadType)
+					}
+				}
+			}
+		})
+	}
+}
+
 type notFoundError struct{}
 
 func (e notFoundError) IsNotFound() bool { return true }
diff --git a/server/mdm/apple/commander.go b/server/mdm/apple/commander.go
index 68bd90c82e..6a098a5284 100644
--- a/server/mdm/apple/commander.go
+++ b/server/mdm/apple/commander.go
@@ -5,6 +5,8 @@ import (
 	"encoding/base64"
 	"fmt"
 	"net/http"
+	"sort"
+	"strings"
 
 	"github.com/fleetdm/fleet/v4/server/contexts/ctxerr"
 	"github.com/fleetdm/fleet/v4/server/fleet"
@@ -383,14 +385,15 @@ func (svc *MDMAppleCommander) SendNotifications(ctx context.Context, hostUUIDs [
 
 	// Even if we didn't get an error, some of the APNs
 	// responses might have failed, signal that to the caller.
-	var failed []string
+	failed := map[string]error{}
 	for uuid, response := range apnsResponses {
 		if response.Err != nil {
-			failed = append(failed, uuid)
+			failed[uuid] = response.Err
 		}
 	}
+
 	if len(failed) > 0 {
-		return &APNSDeliveryError{FailedUUIDs: failed, Err: err}
+		return &APNSDeliveryError{errorsByUUID: failed}
 	}
 
 	return nil
@@ -399,14 +402,38 @@ func (svc *MDMAppleCommander) SendNotifications(ctx context.Context, hostUUIDs [
 // APNSDeliveryError records an error and the associated host UUIDs in which it
 // occurred.
 type APNSDeliveryError struct {
-	FailedUUIDs []string
-	Err         error
+	errorsByUUID map[string]error
 }
 
 func (e *APNSDeliveryError) Error() string {
-	return fmt.Sprintf("APNS delivery failed with: %s, for UUIDs: %v", e.Err, e.FailedUUIDs)
+	var uuids []string
+	for uuid := range e.errorsByUUID {
+		uuids = append(uuids, uuid)
+	}
+
+	// sort UUIDs alphabetically for deterministic output
+	sort.Strings(uuids)
+
+	var errStrings []string
+	for _, uuid := range uuids {
+		errStrings = append(errStrings, fmt.Sprintf("UUID: %s, Error: %v", uuid, e.errorsByUUID[uuid]))
+	}
+
+	return fmt.Sprintf(
+		"APNS delivery failed with the following errors:\n%s",
+		strings.Join(errStrings, "\n"),
+	)
 }
 
-func (e *APNSDeliveryError) Unwrap() error { return e.Err }
+func (e *APNSDeliveryError) FailedUUIDs() []string {
+	var uuids []string
+	for uuid := range e.errorsByUUID {
+		uuids = append(uuids, uuid)
+	}
+
+	// sort UUIDs alphabetically for deterministic output
+	sort.Strings(uuids)
+	return uuids
+}
 
 func (e *APNSDeliveryError) StatusCode() int { return http.StatusBadGateway }
diff --git a/server/mdm/apple/commander_test.go b/server/mdm/apple/commander_test.go
index 5978944b52..29138179f4 100644
--- a/server/mdm/apple/commander_test.go
+++ b/server/mdm/apple/commander_test.go
@@ -3,7 +3,9 @@ package apple_mdm
 import (
 	"context"
 	"crypto/tls"
+	"errors"
 	"fmt"
+	"net/http"
 	"os"
 	"testing"
 
@@ -17,8 +19,8 @@ import (
 	"github.com/google/uuid"
 	"github.com/groob/plist"
 	micromdm "github.com/micromdm/micromdm/mdm/mdm"
+	"github.com/smallstep/pkcs7"
 	"github.com/stretchr/testify/require"
-	"go.mozilla.org/pkcs7"
 )
 
 func TestMDMAppleCommander(t *testing.T) {
@@ -200,3 +202,50 @@ func mobileconfigForTest(name, identifier string) []byte {
 </plist>
 `, name, identifier, uuid.New().String()))
 }
+
+func TestAPNSDeliveryError(t *testing.T) {
+	tests := []struct {
+		name                string
+		errorsByUUID        map[string]error
+		expectedError       string
+		expectedFailedUUIDs []string
+		expectedStatusCode  int
+	}{
+		{
+			name: "single error",
+			errorsByUUID: map[string]error{
+				"uuid1": errors.New("network error"),
+			},
+			expectedError: `APNS delivery failed with the following errors:
+UUID: uuid1, Error: network error`,
+			expectedFailedUUIDs: []string{"uuid1"},
+			expectedStatusCode:  http.StatusBadGateway,
+		},
+		{
+			name: "multiple errors, sorted",
+			errorsByUUID: map[string]error{
+				"uuid3": errors.New("timeout error"),
+				"uuid1": errors.New("network error"),
+				"uuid2": errors.New("certificate error"),
+			},
+			expectedError: `APNS delivery failed with the following errors:
+UUID: uuid1, Error: network error
+UUID: uuid2, Error: certificate error
+UUID: uuid3, Error: timeout error`,
+			expectedFailedUUIDs: []string{"uuid1", "uuid2", "uuid3"},
+			expectedStatusCode:  http.StatusBadGateway,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			apnsErr := &APNSDeliveryError{
+				errorsByUUID: tt.errorsByUUID,
+			}
+
+			require.Equal(t, tt.expectedError, apnsErr.Error())
+			require.Equal(t, tt.expectedFailedUUIDs, apnsErr.FailedUUIDs())
+			require.Equal(t, tt.expectedStatusCode, apnsErr.StatusCode())
+		})
+	}
+}
diff --git a/server/mdm/apple/deviceinfo.go b/server/mdm/apple/deviceinfo.go
new file mode 100644
index 0000000000..2f53fe3862
--- /dev/null
+++ b/server/mdm/apple/deviceinfo.go
@@ -0,0 +1,207 @@
+// The contents of this file have been copied and modified pursuant to the following
+// license from the original source:
+// https://github.com/korylprince/dep-webview-oidc/blob/2dd846a54fed04c16dd227b8c6c31665b4d0ebd8/header/header.go
+//
+// MIT License
+//
+// Copyright (c) 2023 Kory Prince
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in all
+// copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+// SOFTWARE.
+
+package apple_mdm
+
+import (
+	"bytes"
+	"crypto"
+	"crypto/rsa"
+	"crypto/sha1" // nolint:gosec // See comments regarding Apple's Root CA below
+	"crypto/x509"
+	_ "embed"
+	"encoding/base64"
+	"errors"
+	"fmt"
+	"os"
+
+	"github.com/fleetdm/fleet/v4/server/fleet"
+	"github.com/groob/plist"
+	"github.com/smallstep/pkcs7"
+)
+
+const DeviceInfoHeader = "x-apple-aspen-deviceinfo"
+
+// appleRootCert is https://www.apple.com/appleca/AppleIncRootCertificate.cer
+//
+//go:embed AppleIncRootCertificate.cer
+var appleRootCert []byte
+
+// appleRootCA is Apple's Root CA parsed to an *x509.Certificate
+var appleRootCA = newAppleCert(appleRootCert)
+
+// appleIphoneDeviceCA is the PEM data defined here converted to DER:
+// https://developer.apple.com/library/archive/documentation/NetworkingInternet/Conceptual/iPhoneOTAConfiguration/profile-service/profile-service.html#//apple_ref/doc/uid/TP40009505-CH2-SW24
+//
+//go:embed AppleIphoneDeviceCA.cer
+var appleIphoneDeviceCACert []byte
+
+// appleIphoneDeviceCA is Apple's Iphone Device CA parsed to an *x509.Certificate
+var appleIphoneDeviceCA = newAppleCert(appleIphoneDeviceCACert)
+
+func newAppleCert(crt []byte) *x509.Certificate {
+	cert, err := x509.ParseCertificate(crt)
+	if err != nil {
+		panic(fmt.Errorf("could not parse cert: %w", err))
+	}
+	return cert
+}
+
+// verifyPKCS7SHA1RSA performs a manual SHA1withRSA verification, since it's deprecated in Go 1.18.
+// If verifyChain is true, the signer certificate and its chain of certificates is verified against Apple's Root CA.
+// Also note that the certificate validity time window of the signing cert is not checked, since the cert is expired.
+// This follows guidance from Apple on the expired certificate.
+func verifyPKCS7SHA1RSA(p7 *pkcs7.PKCS7, verifyChain bool) error {
+	if len(p7.Signers) == 0 {
+		return errors.New("not signed")
+	}
+
+	// get signing cert
+	issuer := p7.Signers[0].IssuerAndSerialNumber
+	var signer *x509.Certificate
+	for _, cert := range p7.Certificates {
+		if bytes.Equal(cert.RawIssuer, issuer.IssuerName.FullBytes) && cert.SerialNumber.Cmp(issuer.SerialNumber) == 0 {
+			signer = cert
+		}
+	}
+
+	// get sha1 hash of content
+	hashed := sha1.Sum(p7.Content) // nolint:gosec
+
+	// verify content signature
+	signature := p7.Signers[0].EncryptedDigest
+	if err := rsa.VerifyPKCS1v15(signer.PublicKey.(*rsa.PublicKey), crypto.SHA1, hashed[:], signature); err != nil {
+		return fmt.Errorf("signature could not be verified: %w", err)
+	}
+
+	if !verifyChain {
+		return nil
+	}
+
+	// verify chain from signer to root
+	cert := signer
+outer:
+	for {
+		// check if cert is signed by root
+		if bytes.Equal(cert.RawIssuer, appleRootCA.RawSubject) {
+			hashed := sha1.Sum(cert.RawTBSCertificate) // nolint:gosec
+			// check signature
+			if err := rsa.VerifyPKCS1v15(appleRootCA.PublicKey.(*rsa.PublicKey), crypto.SHA1, hashed[:], cert.Signature); err != nil {
+				return fmt.Errorf("could not verify root CA signature: %w", err)
+			}
+			return nil
+		}
+		for _, c := range p7.Certificates {
+			if cert == c {
+				continue
+			}
+			// check if cert is signed by intermediate cert in chain
+			if bytes.Equal(cert.RawIssuer, c.RawSubject) {
+				// check signature
+				hashed := sha1.Sum(cert.RawTBSCertificate) // nolint:gosec
+				if err := rsa.VerifyPKCS1v15(c.PublicKey.(*rsa.PublicKey), crypto.SHA1, hashed[:], cert.Signature); err != nil {
+					return fmt.Errorf("could not verify chained certificate signature: %w", err)
+				}
+				cert = c
+				continue outer
+			}
+		}
+		return errors.New("certificate root not found")
+	}
+}
+
+// ParseDeviceinfo attempts to parse the provided string, assuming it to be the base64-encoded value
+// of an x-apple-aspen-deviceinfo header. If successful, it returns the parsed *fleet.MDMAppleMachineInfo. If the
+// verify parameter is specified as true, the signature is also verified against Apple's Root CA and
+// an error will be returned if the signature is invalid.
+//
+// Warning: The information in this header, despite being signed by Apple PKI, shouldn't be trusted
+// for device attestation or other security purposes. See the related [documentation] and referenced
+// [article] for more information.
+//
+// [documentation]: https://github.com/korylprince/dep-webview-oidc/blob/2dd846a54fed04c16dd227b8c6c31665b4d0ebd8/docs/Architecture.md#x-apple-aspen-deviceinfo-header
+// [article]: https://duo.com/labs/research/mdm-me-maybe
+func ParseDeviceinfo(b64 string, verify bool) (*fleet.MDMAppleMachineInfo, error) {
+	buf, err := base64.StdEncoding.DecodeString(b64)
+	if err != nil {
+		return nil, fmt.Errorf("could not decode base64: %w", err)
+	}
+
+	p7, err := pkcs7.Parse(buf)
+	if err != nil {
+		return nil, fmt.Errorf("could not decode pkcs7: %w", err)
+	}
+
+	// verify signature and certificate chain
+	if verify {
+		if err = verifyPKCS7SHA1RSA(p7, verify); err != nil {
+			return nil, fmt.Errorf("could not verify signature: %w", err)
+		}
+	}
+
+	info := new(fleet.MDMAppleMachineInfo)
+	if err = plist.Unmarshal(p7.Content, info); err != nil {
+		return nil, fmt.Errorf("could not decode plist: %w", err)
+	}
+
+	return info, nil
+}
+
+// VerifyFromAppleIphoneDeviceCA verifies a certificate was signed by Apple's iPhone Device CA.
+// Manually verify the certificate since Go has deprecated verifying SHA1WithRSA x509 certificates.
+//
+// NOTE: most of this code was taken from micromdm.
+func VerifyFromAppleIphoneDeviceCA(c *x509.Certificate) error {
+	if os.Getenv("FLEET_DEV_MDM_APPLE_DISABLE_DEVICE_INFO_CERT_VERIFY") == "1" {
+		return nil
+	}
+
+	var hashType crypto.Hash
+
+	switch c.SignatureAlgorithm {
+	case x509.SHA1WithRSA:
+		hashType = crypto.SHA1
+	case x509.SHA256WithRSA:
+		hashType = crypto.SHA256
+	default:
+		return fmt.Errorf("%w: %s", x509.ErrUnsupportedAlgorithm, c.SignatureAlgorithm)
+	}
+
+	hasher := hashType.New()
+	hasher.Write(c.RawTBSCertificate)
+	hashed := hasher.Sum(nil)
+
+	key, ok := appleIphoneDeviceCA.PublicKey.(*rsa.PublicKey)
+	if !ok {
+		panic("appleIphoneDeviceCA: invalid key type")
+	}
+
+	if err := rsa.VerifyPKCS1v15(key, hashType, hashed, c.Signature); err != nil {
+		return fmt.Errorf("verifying signature: %w", err)
+	}
+
+	return nil
+}
diff --git a/server/mdm/apple/gdmf/api.go b/server/mdm/apple/gdmf/api.go
new file mode 100644
index 0000000000..ee8c671814
--- /dev/null
+++ b/server/mdm/apple/gdmf/api.go
@@ -0,0 +1,198 @@
+package gdmf
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"os"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/cenkalti/backoff"
+	"github.com/fleetdm/fleet/v4/pkg/fleethttp"
+	"github.com/fleetdm/fleet/v4/server/fleet"
+	apple_mdm "github.com/fleetdm/fleet/v4/server/mdm/apple"
+)
+
+const baseURL = "https://gdmf.apple.com/v2/pmv"
+
+// Asset represents the metadata for an asset in the Apple Software Lookup Service[1][2].
+// Example:
+//
+//	{
+//	    "ProductVersion": "14.6.1",
+//	    "Build": "23G93",
+//	    "PostingDate": "2024-08-07",
+//	    "ExpirationDate": "2024-11-11",
+//	    "SupportedDevices": [
+//	        "J132AP",
+//	        "VMA2MACOSAP",
+//	        "VMM-x86_64"
+//	    ]
+//	}
+//
+// [1]: http://gdmf.apple.com/v2/pmv
+// [2]:
+// https://support.apple.com/guide/deployment/use-mdm-to-deploy-software-updates-depafd2fad80/web
+type Asset struct {
+	ProductVersion   string   `json:"ProductVersion"`
+	Build            string   `json:"Build"`
+	PostingDate      string   `json:"PostingDate"`
+	ExpirationDate   string   `json:"ExpirationDate"`
+	SupportedDevices []string `json:"SupportedDevices"`
+}
+
+// AssetSets represents the metadata for a set of assets in the Apple Software Lookup Service[1][2].
+// [1]: http://gdmf.apple.com/v2/pmv
+// [2]: https://support.apple.com/guide/deployment/use-mdm-to-deploy-software-updates-depafd2fad80/web
+type AssetSets struct {
+	IOS   []Asset `json:"iOS"`
+	MacOS []Asset `json:"macOS"`
+	// VisionOS []Asset `json:"visionOS"` // Fleet doesn't support visionOS yet
+	// XROS     []Asset `json:"xrOS"`    // Fleet doesn't support xrOS yet
+}
+
+// APIResponse represents the response from the Apple Software Lookup Service[1][2].
+// [1]: http://gdmf.apple.com/v2/pmv
+// [2]: https://support.apple.com/guide/deployment/use-mdm-to-deploy-software-updates-depafd2fad80/web
+type APIResponse struct {
+	PublicAssetSets AssetSets `json:"PublicAssetSets"`
+	AssetSets       AssetSets `json:"AssetSets"`
+	// PublicRapidSecurityResponses interface{} `json:"PublicRapidSecurityResponses"` // Fleet doesn't support PublicRapidSecurityResponses yet
+}
+
+// GetLatestOSVersion returns the latest OS version for the given device. The device is matched
+// against the Apple Software Update Lookup Service[1][2] to find the latest version. If no matching
+// asset is found, an error is returned.
+// [1]: http://gdmf.apple.com/v2/pmv
+// [2]: https://support.apple.com/guide/deployment/use-mdm-to-deploy-software-updates-depafd2fad80/web
+func GetLatestOSVersion(device fleet.MDMAppleMachineInfo) (*Asset, error) {
+	r, err := GetAssetMetadata()
+	if err != nil {
+		return nil, fmt.Errorf("retrieving asset metadata: %w", err)
+	}
+
+	assetSet := r.PublicAssetSets.MacOS // default to public asset set; note that if the device is not macOS, iPhone, or iPad, we'll fail to match the supported device and return an error below
+	if strings.HasPrefix(device.Product, "iPhone") ||
+		strings.HasPrefix(device.Product, "iPad") ||
+		strings.HasPrefix(device.SoftwareUpdateDeviceID, "iPhone") ||
+		strings.HasPrefix(device.SoftwareUpdateDeviceID, "iPad") {
+		assetSet = r.PublicAssetSets.IOS
+	}
+	latestIdx := -1
+	for i, s := range assetSet {
+		for _, d := range s.SupportedDevices {
+			if d == device.Product || d == device.SoftwareUpdateDeviceID {
+				if latestIdx == -1 {
+					latestIdx = i // first match found, update the index
+					continue
+				}
+				if apple_mdm.CompareVersions(assetSet[latestIdx].ProductVersion, s.ProductVersion) < 0 {
+					latestIdx = i // found a later version, update the index
+				}
+			}
+		}
+	}
+	if latestIdx == -1 {
+		return nil, fmt.Errorf("no matching asset found for device %s", device.Product)
+	}
+	return &assetSet[latestIdx], nil
+}
+
+// client is a package-level client (similar to http.DefaultClient) so it can
+// be reused instead of created as needed, as the internal Transport typically
+// has internal state (cached connections, etc) and it's safe for concurrent
+// use.
+var client = fleethttp.NewClient(fleethttp.WithTimeout(10 * time.Second))
+
+// GetAssetMetadata retrieves the asset metadata from the Apple Software Lookup Service[1][2].
+// [1]: http://gdmf.apple.com/v2/pmv
+// [2]: https://support.apple.com/guide/deployment/use-mdm-to-deploy-software-updates-depafd2fad80/web
+func GetAssetMetadata() (*APIResponse, error) {
+	baseURL := getBaseURL()
+	reqURL, err := url.Parse(baseURL)
+	if err != nil {
+		return nil, fmt.Errorf("parsing base URL: %w", err)
+	}
+
+	req, err := http.NewRequest(http.MethodGet, reqURL.String(), nil)
+	if err != nil {
+		return nil, fmt.Errorf("creating request to Apple endpoint: %w", err)
+	}
+	req.Header.Set("User-Agent", "fleet-device-management")
+
+	resp, err := doWithRetry(req)
+	if err != nil {
+		return nil, fmt.Errorf("retrieving asset metadata: %w", err)
+	}
+	defer resp.Body.Close()
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, fmt.Errorf("reading response body from Apple endpoint: %w", err)
+	}
+	var dest APIResponse
+	if err := json.Unmarshal(body, &dest); err != nil {
+		return nil, fmt.Errorf("decoding response data from Apple endpoint: %w", err)
+	}
+
+	return &dest, nil
+}
+
+func doWithRetry(req *http.Request) (*http.Response, error) {
+	const (
+		maxRetries           = 3
+		retryBackoff         = 1 * time.Second
+		maxWaitForRetryAfter = 10 * time.Second
+	)
+	var resp *http.Response
+	var err error
+	op := func() error {
+		resp, err = client.Do(req)
+		if err != nil {
+			return err
+		}
+
+		defer func() {
+			if resp != nil && resp.StatusCode >= http.StatusBadRequest {
+				// consume and close the body for retried requests to prevent resource leaks
+				_, _ = io.ReadAll(resp.Body)
+				resp.Body.Close()
+			}
+		}()
+
+		if resp.StatusCode == http.StatusTooManyRequests {
+			// handle 429 rate-limits
+			rawAfter := resp.Header.Get("Retry-After")
+			afterSecs, err := strconv.ParseInt(rawAfter, 10, 0)
+			if err == nil && (time.Duration(afterSecs)*time.Second) < maxWaitForRetryAfter {
+				// the retry-after duration is reasonable, wait for it and return a
+				// retryable error so that we try again.
+				time.Sleep(time.Duration(afterSecs) * time.Second)
+				return errors.New("retry after requested delay")
+			}
+		}
+		if resp.StatusCode >= http.StatusBadRequest {
+			// 400+ status can be worth retrying
+			return fmt.Errorf("calling gdmf endpoint failed with status %d", resp.StatusCode)
+		}
+		return nil
+	}
+
+	if err := backoff.Retry(op, backoff.WithMaxRetries(backoff.NewConstantBackOff(retryBackoff), uint64(maxRetries))); err != nil {
+		return nil, err
+	}
+
+	return resp, err
+}
+
+func getBaseURL() string {
+	devURL := os.Getenv("FLEET_DEV_GDMF_URL")
+	if devURL != "" {
+		return devURL
+	}
+	return baseURL
+}
diff --git a/server/mdm/apple/gdmf/api_test.go b/server/mdm/apple/gdmf/api_test.go
new file mode 100644
index 0000000000..14bc7d8061
--- /dev/null
+++ b/server/mdm/apple/gdmf/api_test.go
@@ -0,0 +1,247 @@
+package gdmf
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"testing"
+
+	"github.com/fleetdm/fleet/v4/server/fleet"
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/require"
+)
+
+func TestGetLatest(t *testing.T) {
+	// test GetLatestOSVersion using a mock server that returns a known response
+	// and ensure the response is parsed correctly
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		// load the test data from the file
+		b, err := os.ReadFile("./testdata/gdmf.json")
+		require.NoError(t, err)
+		_, err = w.Write(b)
+		require.NoError(t, err)
+	}))
+	defer srv.Close()
+	t.Setenv("FLEET_DEV_GDMF_URL", srv.URL)
+
+	// test the function
+	d := fleet.MDMAppleMachineInfo{
+		MDMCanRequestSoftwareUpdate: true,
+		OSVersion:                   "14.4.1",
+		Product:                     "Mac15,7",
+		Serial:                      "TESTSERIAL",
+		SoftwareUpdateDeviceID:      "J516sAP",
+		SupplementalBuildVersion:    "23E224",
+		UDID:                        uuid.New().String(),
+		Version:                     "23E224",
+	}
+
+	latestMacOSVersion := "14.6.1"
+	latestMacOSBuild := "23G93"
+	latestIOSVersion := "17.6.1"
+	latestIOSBuild := "21G93"
+
+	resp, err := GetLatestOSVersion(d)
+	require.NoError(t, err)
+	require.Equal(t, latestMacOSVersion, resp.ProductVersion)
+	require.Equal(t, latestMacOSBuild, resp.Build)
+
+	// NOTE: GetLatestOSVersion does not depend on the value of MDMCanRequestSoftwareUpdate. It is
+	// expected that the caller has already verified this value before calling GetLatestOSVersion.
+
+	tests := []struct {
+		name            string
+		machineInfo     fleet.MDMAppleMachineInfo
+		expectedVersion string
+		expectedBuild   string
+		expectError     bool
+	}{
+		{
+			name: "macOS matching software update device ID",
+			machineInfo: fleet.MDMAppleMachineInfo{
+				OSVersion:                "14.4.1",
+				Product:                  "Mac15,7",
+				Serial:                   "TESTSERIAL",
+				SoftwareUpdateDeviceID:   "J516sAP",
+				SupplementalBuildVersion: "23E224",
+				UDID:                     uuid.New().String(),
+				Version:                  "23E224",
+			},
+			expectedVersion: latestMacOSVersion,
+			expectedBuild:   latestMacOSBuild,
+			expectError:     false,
+		},
+		{
+			// macOS generally relies on the SoftwareUpdateDeviceID field and not the Product field
+			name: "macOS non-matching software update device ID",
+			machineInfo: fleet.MDMAppleMachineInfo{
+				OSVersion:                "14.4.1",
+				Product:                  "Mac15,7",
+				Serial:                   "TESTSERIAL",
+				SoftwareUpdateDeviceID:   "INVALID",
+				SupplementalBuildVersion: "23E224",
+				UDID:                     uuid.New().String(),
+				Version:                  "23E224",
+			},
+			expectedVersion: latestMacOSVersion,
+			expectedBuild:   latestMacOSBuild,
+			expectError:     true,
+		},
+		{
+			// this should never happen in practice, but by default we still check macOS assets to
+			// match the software update device ID
+			name: "non-matching product but matching software update device ID",
+			machineInfo: fleet.MDMAppleMachineInfo{
+				OSVersion:                "14.4.1",
+				Product:                  "INVALID",
+				Serial:                   "TESTSERIAL",
+				SoftwareUpdateDeviceID:   "J516sAP",
+				SupplementalBuildVersion: "23E224",
+				UDID:                     uuid.New().String(),
+				Version:                  "23E224",
+			},
+			expectedVersion: latestMacOSVersion,
+			expectedBuild:   latestMacOSBuild,
+			expectError:     false,
+		},
+		{
+			name: "non-matching product and software update device ID",
+			machineInfo: fleet.MDMAppleMachineInfo{
+				OSVersion:                "14.4.1",
+				Product:                  "INVALID",
+				Serial:                   "TESTSERIAL",
+				SoftwareUpdateDeviceID:   "INVALID",
+				SupplementalBuildVersion: "23E224",
+				UDID:                     uuid.New().String(),
+				Version:                  "23E224",
+			},
+			expectedVersion: "",
+			expectedBuild:   "",
+			expectError:     true,
+		},
+		{
+			// missing other fields is not an error, this function always returns the latest
+			// version and only depends on the Product and SoftwareUpdateDeviceID fields
+			name: "missing other fields",
+			machineInfo: fleet.MDMAppleMachineInfo{
+				OSVersion:              "",
+				Product:                "Mac15,7",
+				SoftwareUpdateDeviceID: "J516sAP",
+			},
+			expectedVersion: latestMacOSVersion,
+			expectedBuild:   latestMacOSBuild,
+			expectError:     false,
+		},
+		{
+			name: "iphone matching product and software update device ID",
+			machineInfo: fleet.MDMAppleMachineInfo{
+				OSVersion:                "17.5.1",
+				Product:                  "iPhone14,6",
+				Serial:                   "TESTSERIAL",
+				SoftwareUpdateDeviceID:   "iPhone14,6",
+				SupplementalBuildVersion: "21F90",
+				UDID:                     uuid.New().String(),
+				Version:                  "21F90",
+			},
+			expectedVersion: latestIOSVersion,
+			expectedBuild:   latestIOSBuild,
+			expectError:     false,
+		},
+		{
+			// iOS generally relies on the Product field and not the SoftwareUpdateDeviceID field so
+			// this won't error even though the SoftwareUpdateDeviceID is invalid
+			name: "iphone non-matching software update device ID",
+			machineInfo: fleet.MDMAppleMachineInfo{
+				OSVersion:                "17.5.1",
+				Product:                  "iPhone14,6",
+				Serial:                   "TESTSERIAL",
+				SoftwareUpdateDeviceID:   "INVALID",
+				SupplementalBuildVersion: "21F90",
+				UDID:                     uuid.New().String(),
+				Version:                  "21F90",
+			},
+			expectedVersion: latestIOSVersion,
+			expectedBuild:   latestIOSBuild,
+			expectError:     false,
+		},
+		{
+			// this should never happen in practice, but we'll still try to match iOS assets if the
+			// software update device ID starts with "iPhone" or "iPad"
+			name: "missing product but valid iphone software update device ID",
+			machineInfo: fleet.MDMAppleMachineInfo{
+				OSVersion:                "17.5.1",
+				Product:                  "",
+				Serial:                   "TESTSERIAL",
+				SoftwareUpdateDeviceID:   "iPhone14,6",
+				SupplementalBuildVersion: "21F90",
+				UDID:                     uuid.New().String(),
+				Version:                  "21F90",
+			},
+			expectedVersion: latestIOSVersion,
+			expectedBuild:   latestIOSBuild,
+			expectError:     false,
+		},
+		{
+			// we don't support other Apple products yet, so this should always error
+			// because we we default to the macOS asset set and we won't find a matching asset there
+			name: "unsupported product",
+			machineInfo: fleet.MDMAppleMachineInfo{
+				OSVersion:                "8.8.1",
+				Product:                  "Watch3,1",
+				Serial:                   "TESTSERIAL",
+				SoftwareUpdateDeviceID:   "Watch3,1",
+				SupplementalBuildVersion: "19U512",
+				UDID:                     uuid.New().String(),
+				Version:                  "19U512",
+			},
+			expectedVersion: "",
+			expectedBuild:   "",
+			expectError:     true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			resp, err := GetLatestOSVersion(tt.machineInfo)
+			if tt.expectError {
+				require.Error(t, err)
+			} else {
+				require.NoError(t, err)
+				require.Equal(t, tt.expectedVersion, resp.ProductVersion)
+				require.Equal(t, tt.expectedBuild, resp.Build)
+			}
+		})
+	}
+}
+
+func TestRetries(t *testing.T) {
+	retryCount := 0
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		retryCount++
+		w.WriteHeader(http.StatusBadRequest)
+		_, err := w.Write([]byte(`{"error": "bad request"}`))
+		require.NoError(t, err)
+	}))
+	os.Setenv("FLEET_DEV_GDMF_URL", srv.URL)
+	t.Cleanup(func() {
+		srv.Close()
+		os.Unsetenv("FLEET_DEV_GDMF_URL")
+	})
+
+	latest, err := GetLatestOSVersion(fleet.MDMAppleMachineInfo{
+		OSVersion:                "14.4.1",
+		Product:                  "Mac15,7",
+		Serial:                   "TESTSERIAL",
+		SoftwareUpdateDeviceID:   "J516sAP",
+		SupplementalBuildVersion: "23E224",
+		UDID:                     uuid.New().String(),
+		Version:                  "23E224",
+	})
+
+	require.Error(t, err)
+	require.ErrorContains(t, err, "calling gdmf endpoint failed with status 400")
+	require.Nil(t, latest)
+	require.Equal(t, 4, retryCount)
+}
diff --git a/server/mdm/apple/gdmf/testdata/gdmf.json b/server/mdm/apple/gdmf/testdata/gdmf.json
new file mode 100644
index 0000000000..7993d37b4d
--- /dev/null
+++ b/server/mdm/apple/gdmf/testdata/gdmf.json
@@ -0,0 +1,3325 @@
+{
+  "PublicAssetSets": {
+    "iOS": [
+      {
+        "ProductVersion": "6.3",
+        "Build": "17U6208",
+        "PostingDate": "2024-07-29",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": ["Watch2,3", "Watch2,4", "Watch2,6", "Watch2,7"]
+      },
+      {
+        "ProductVersion": "1.3",
+        "Build": "21O771",
+        "PostingDate": "2024-08-05",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": ["RealityDevice14,1"]
+      },
+      {
+        "ProductVersion": "10.6",
+        "Build": "21U6577",
+        "PostingDate": "2024-07-29",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "Watch4,1",
+          "Watch4,2",
+          "Watch4,3",
+          "Watch4,4",
+          "Watch5,1",
+          "Watch5,10",
+          "Watch5,11",
+          "Watch5,12",
+          "Watch5,2",
+          "Watch5,3",
+          "Watch5,4",
+          "Watch5,9",
+          "Watch6,1",
+          "Watch6,10",
+          "Watch6,11",
+          "Watch6,12",
+          "Watch6,13",
+          "Watch6,14",
+          "Watch6,15",
+          "Watch6,16",
+          "Watch6,17",
+          "Watch6,18",
+          "Watch6,2",
+          "Watch6,3",
+          "Watch6,4",
+          "Watch6,6",
+          "Watch6,7",
+          "Watch6,8",
+          "Watch6,9",
+          "Watch7,1",
+          "Watch7,2",
+          "Watch7,3",
+          "Watch7,4",
+          "Watch7,5"
+        ]
+      },
+      {
+        "ProductVersion": "1.3",
+        "Build": "21O6771",
+        "PostingDate": "2024-08-05",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": ["RealityDevice14,1"]
+      },
+      {
+        "ProductVersion": "17.6",
+        "Build": "21M71",
+        "PostingDate": "2024-08-05",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "AppleTV11,1",
+          "AppleTV14,1",
+          "AppleTV5,3",
+          "AppleTV6,2"
+        ]
+      },
+      {
+        "ProductVersion": "17.6",
+        "Build": "21M71",
+        "PostingDate": "2024-07-29",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "AudioAccessory1,1",
+          "AudioAccessory5,1",
+          "AudioAccessory6,1"
+        ]
+      },
+      {
+        "ProductVersion": "8.8.1",
+        "Build": "19U6512",
+        "PostingDate": "2024-07-29",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "Watch3,1",
+          "Watch3,2",
+          "Watch3,3",
+          "Watch3,4",
+          "Watch4,1",
+          "Watch4,2",
+          "Watch4,3",
+          "Watch4,4",
+          "Watch5,1",
+          "Watch5,10",
+          "Watch5,11",
+          "Watch5,12",
+          "Watch5,2",
+          "Watch5,3",
+          "Watch5,4",
+          "Watch5,9",
+          "Watch6,1",
+          "Watch6,2",
+          "Watch6,3",
+          "Watch6,4",
+          "Watch6,6",
+          "Watch6,7",
+          "Watch6,8",
+          "Watch6,9"
+        ]
+      },
+      {
+        "ProductVersion": "16.7.10",
+        "Build": "20H6350",
+        "PostingDate": "2024-08-07",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "iPad6,11",
+          "iPad6,12",
+          "iPad6,3",
+          "iPad6,4",
+          "iPad6,7",
+          "iPad6,8",
+          "iPhone10,1",
+          "iPhone10,2",
+          "iPhone10,3",
+          "iPhone10,4",
+          "iPhone10,5",
+          "iPhone10,6"
+        ]
+      },
+      {
+        "ProductVersion": "16.7.2",
+        "Build": "20H115",
+        "PostingDate": "2023-10-25",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "iPad11,1",
+          "iPad11,2",
+          "iPad11,3",
+          "iPad11,4",
+          "iPad11,6",
+          "iPad11,7",
+          "iPad12,1",
+          "iPad12,2",
+          "iPad13,1",
+          "iPad13,10",
+          "iPad13,11",
+          "iPad13,16",
+          "iPad13,17",
+          "iPad13,18",
+          "iPad13,19",
+          "iPad13,2",
+          "iPad13,4",
+          "iPad13,5",
+          "iPad13,6",
+          "iPad13,7",
+          "iPad13,8",
+          "iPad13,9",
+          "iPad14,1",
+          "iPad14,2",
+          "iPad14,3",
+          "iPad14,4",
+          "iPad14,5",
+          "iPad14,6",
+          "iPad7,1",
+          "iPad7,11",
+          "iPad7,12",
+          "iPad7,2",
+          "iPad7,3",
+          "iPad7,4",
+          "iPad7,5",
+          "iPad7,6",
+          "iPad8,1",
+          "iPad8,10",
+          "iPad8,11",
+          "iPad8,12",
+          "iPad8,2",
+          "iPad8,3",
+          "iPad8,4",
+          "iPad8,5",
+          "iPad8,6",
+          "iPad8,7",
+          "iPad8,8",
+          "iPad8,9",
+          "iPhone11,2",
+          "iPhone11,6",
+          "iPhone11,8",
+          "iPhone12,1",
+          "iPhone12,3",
+          "iPhone12,5",
+          "iPhone12,8",
+          "iPhone13,1",
+          "iPhone13,2",
+          "iPhone13,3",
+          "iPhone13,4",
+          "iPhone14,2",
+          "iPhone14,3",
+          "iPhone14,4",
+          "iPhone14,5",
+          "iPhone14,6",
+          "iPhone14,7",
+          "iPhone14,8",
+          "iPhone15,2",
+          "iPhone15,3"
+        ]
+      },
+      {
+        "ProductVersion": "17.6.1",
+        "Build": "21G93",
+        "PostingDate": "2024-08-07",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "iPad11,1",
+          "iPad11,2",
+          "iPad11,3",
+          "iPad11,4",
+          "iPad11,6",
+          "iPad11,7",
+          "iPad12,1",
+          "iPad12,2",
+          "iPad13,1",
+          "iPad13,10",
+          "iPad13,11",
+          "iPad13,16",
+          "iPad13,17",
+          "iPad13,18",
+          "iPad13,19",
+          "iPad13,2",
+          "iPad13,4",
+          "iPad13,5",
+          "iPad13,6",
+          "iPad13,7",
+          "iPad13,8",
+          "iPad13,9",
+          "iPad14,1",
+          "iPad14,10",
+          "iPad14,11",
+          "iPad14,2",
+          "iPad14,3",
+          "iPad14,4",
+          "iPad14,5",
+          "iPad14,6",
+          "iPad14,8",
+          "iPad14,9",
+          "iPad16,3",
+          "iPad16,4",
+          "iPad16,5",
+          "iPad16,6",
+          "iPad7,1",
+          "iPad7,11",
+          "iPad7,12",
+          "iPad7,2",
+          "iPad7,3",
+          "iPad7,4",
+          "iPad7,5",
+          "iPad7,6",
+          "iPad8,1",
+          "iPad8,10",
+          "iPad8,11",
+          "iPad8,12",
+          "iPad8,2",
+          "iPad8,3",
+          "iPad8,4",
+          "iPad8,5",
+          "iPad8,6",
+          "iPad8,7",
+          "iPad8,8",
+          "iPad8,9",
+          "iPhone11,2",
+          "iPhone11,4",
+          "iPhone11,6",
+          "iPhone11,8",
+          "iPhone12,1",
+          "iPhone12,3",
+          "iPhone12,5",
+          "iPhone12,8",
+          "iPhone13,1",
+          "iPhone13,2",
+          "iPhone13,3",
+          "iPhone13,4",
+          "iPhone14,2",
+          "iPhone14,3",
+          "iPhone14,4",
+          "iPhone14,5",
+          "iPhone14,6",
+          "iPhone14,7",
+          "iPhone14,8",
+          "iPhone15,2",
+          "iPhone15,3",
+          "iPhone15,4",
+          "iPhone15,5",
+          "iPhone16,1",
+          "iPhone16,2"
+        ]
+      },
+      {
+        "ProductVersion": "16.7.2",
+        "Build": "20H6115",
+        "PostingDate": "2023-10-25",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "iPad11,1",
+          "iPad11,2",
+          "iPad11,3",
+          "iPad11,4",
+          "iPad11,6",
+          "iPad11,7",
+          "iPad12,1",
+          "iPad12,2",
+          "iPad13,1",
+          "iPad13,10",
+          "iPad13,11",
+          "iPad13,16",
+          "iPad13,17",
+          "iPad13,18",
+          "iPad13,19",
+          "iPad13,2",
+          "iPad13,4",
+          "iPad13,5",
+          "iPad13,6",
+          "iPad13,7",
+          "iPad13,8",
+          "iPad13,9",
+          "iPad14,1",
+          "iPad14,2",
+          "iPad14,3",
+          "iPad14,4",
+          "iPad14,5",
+          "iPad14,6",
+          "iPad7,1",
+          "iPad7,11",
+          "iPad7,12",
+          "iPad7,2",
+          "iPad7,3",
+          "iPad7,4",
+          "iPad7,5",
+          "iPad7,6",
+          "iPad8,1",
+          "iPad8,10",
+          "iPad8,11",
+          "iPad8,12",
+          "iPad8,2",
+          "iPad8,3",
+          "iPad8,4",
+          "iPad8,5",
+          "iPad8,6",
+          "iPad8,7",
+          "iPad8,8",
+          "iPad8,9",
+          "iPhone11,2",
+          "iPhone11,6",
+          "iPhone11,8",
+          "iPhone12,1",
+          "iPhone12,3",
+          "iPhone12,5",
+          "iPhone12,8",
+          "iPhone13,1",
+          "iPhone13,2",
+          "iPhone13,3",
+          "iPhone13,4",
+          "iPhone14,2",
+          "iPhone14,3",
+          "iPhone14,4",
+          "iPhone14,5",
+          "iPhone14,6",
+          "iPhone14,7",
+          "iPhone14,8",
+          "iPhone15,2",
+          "iPhone15,3"
+        ]
+      },
+      {
+        "ProductVersion": "16.7.10",
+        "Build": "20H350",
+        "PostingDate": "2024-08-07",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "iPad6,11",
+          "iPad6,12",
+          "iPad6,3",
+          "iPad6,4",
+          "iPad6,7",
+          "iPad6,8",
+          "iPhone10,1",
+          "iPhone10,2",
+          "iPhone10,3",
+          "iPhone10,4",
+          "iPhone10,5",
+          "iPhone10,6"
+        ]
+      },
+      {
+        "ProductVersion": "9.6.3",
+        "Build": "20U502",
+        "PostingDate": "2024-07-29",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "Watch4,1",
+          "Watch4,2",
+          "Watch4,3",
+          "Watch4,4",
+          "Watch5,1",
+          "Watch5,10",
+          "Watch5,11",
+          "Watch5,12",
+          "Watch5,2",
+          "Watch5,3",
+          "Watch5,4",
+          "Watch5,9",
+          "Watch6,1",
+          "Watch6,10",
+          "Watch6,11",
+          "Watch6,12",
+          "Watch6,13",
+          "Watch6,14",
+          "Watch6,15",
+          "Watch6,16",
+          "Watch6,17",
+          "Watch6,18",
+          "Watch6,2",
+          "Watch6,3",
+          "Watch6,4",
+          "Watch6,6",
+          "Watch6,7",
+          "Watch6,8",
+          "Watch6,9"
+        ]
+      },
+      {
+        "ProductVersion": "6.3",
+        "Build": "17U208",
+        "PostingDate": "2024-07-29",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": ["Watch2,3", "Watch2,4", "Watch2,6", "Watch2,7"]
+      },
+      {
+        "ProductVersion": "8.8.1",
+        "Build": "19U512",
+        "PostingDate": "2024-07-29",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "Watch3,1",
+          "Watch3,2",
+          "Watch3,3",
+          "Watch3,4",
+          "Watch4,1",
+          "Watch4,2",
+          "Watch4,3",
+          "Watch4,4",
+          "Watch5,1",
+          "Watch5,10",
+          "Watch5,11",
+          "Watch5,12",
+          "Watch5,2",
+          "Watch5,3",
+          "Watch5,4",
+          "Watch5,9",
+          "Watch6,1",
+          "Watch6,2",
+          "Watch6,3",
+          "Watch6,4",
+          "Watch6,6",
+          "Watch6,7",
+          "Watch6,8",
+          "Watch6,9"
+        ]
+      },
+      {
+        "ProductVersion": "17.6",
+        "Build": "21M6071",
+        "PostingDate": "2024-08-05",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "AppleTV11,1",
+          "AppleTV14,1",
+          "AppleTV5,3",
+          "AppleTV6,2"
+        ]
+      },
+      {
+        "ProductVersion": "17.6",
+        "Build": "21M6071",
+        "PostingDate": "2024-07-29",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "AudioAccessory1,1",
+          "AudioAccessory5,1",
+          "AudioAccessory6,1"
+        ]
+      },
+      {
+        "ProductVersion": "17.6.1",
+        "Build": "21G6093",
+        "PostingDate": "2024-08-07",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "iPad11,1",
+          "iPad11,2",
+          "iPad11,3",
+          "iPad11,4",
+          "iPad11,6",
+          "iPad11,7",
+          "iPad12,1",
+          "iPad12,2",
+          "iPad13,1",
+          "iPad13,10",
+          "iPad13,11",
+          "iPad13,16",
+          "iPad13,17",
+          "iPad13,18",
+          "iPad13,19",
+          "iPad13,2",
+          "iPad13,4",
+          "iPad13,5",
+          "iPad13,6",
+          "iPad13,7",
+          "iPad13,8",
+          "iPad13,9",
+          "iPad14,1",
+          "iPad14,10",
+          "iPad14,11",
+          "iPad14,2",
+          "iPad14,3",
+          "iPad14,4",
+          "iPad14,5",
+          "iPad14,6",
+          "iPad14,8",
+          "iPad14,9",
+          "iPad16,3",
+          "iPad16,4",
+          "iPad16,5",
+          "iPad16,6",
+          "iPad7,1",
+          "iPad7,11",
+          "iPad7,12",
+          "iPad7,2",
+          "iPad7,3",
+          "iPad7,4",
+          "iPad7,5",
+          "iPad7,6",
+          "iPad8,1",
+          "iPad8,10",
+          "iPad8,11",
+          "iPad8,12",
+          "iPad8,2",
+          "iPad8,3",
+          "iPad8,4",
+          "iPad8,5",
+          "iPad8,6",
+          "iPad8,7",
+          "iPad8,8",
+          "iPad8,9",
+          "iPhone11,2",
+          "iPhone11,4",
+          "iPhone11,6",
+          "iPhone11,8",
+          "iPhone12,1",
+          "iPhone12,3",
+          "iPhone12,5",
+          "iPhone12,8",
+          "iPhone13,1",
+          "iPhone13,2",
+          "iPhone13,3",
+          "iPhone13,4",
+          "iPhone14,2",
+          "iPhone14,3",
+          "iPhone14,4",
+          "iPhone14,5",
+          "iPhone14,6",
+          "iPhone14,7",
+          "iPhone14,8",
+          "iPhone15,2",
+          "iPhone15,3",
+          "iPhone15,4",
+          "iPhone15,5",
+          "iPhone16,1",
+          "iPhone16,2"
+        ]
+      },
+      {
+        "ProductVersion": "12.5.7",
+        "Build": "16H81",
+        "PostingDate": "2024-08-07",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "iPad4,1",
+          "iPad4,2",
+          "iPad4,3",
+          "iPad4,4",
+          "iPad4,5",
+          "iPad4,6",
+          "iPad4,7",
+          "iPad4,8",
+          "iPad4,9",
+          "iPhone6,1",
+          "iPhone6,2",
+          "iPhone7,1",
+          "iPhone7,2",
+          "iPod7,1"
+        ]
+      },
+      {
+        "ProductVersion": "12.5.7",
+        "Build": "16H6081",
+        "PostingDate": "2024-08-07",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "iPad4,1",
+          "iPad4,2",
+          "iPad4,3",
+          "iPad4,4",
+          "iPad4,5",
+          "iPad4,6",
+          "iPad4,7",
+          "iPad4,8",
+          "iPad4,9",
+          "iPhone6,1",
+          "iPhone6,2",
+          "iPhone7,1",
+          "iPhone7,2",
+          "iPod7,1"
+        ]
+      },
+      {
+        "ProductVersion": "15.8.3",
+        "Build": "19H386",
+        "PostingDate": "2024-08-07",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "iPad5,1",
+          "iPad5,2",
+          "iPad5,3",
+          "iPad5,4",
+          "iPhone8,1",
+          "iPhone8,2",
+          "iPhone8,4",
+          "iPhone9,1",
+          "iPhone9,2",
+          "iPhone9,3",
+          "iPhone9,4",
+          "iPod9,1"
+        ]
+      },
+      {
+        "ProductVersion": "10.6",
+        "Build": "21U577",
+        "PostingDate": "2024-07-29",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "Watch4,1",
+          "Watch4,2",
+          "Watch4,3",
+          "Watch4,4",
+          "Watch5,1",
+          "Watch5,10",
+          "Watch5,11",
+          "Watch5,12",
+          "Watch5,2",
+          "Watch5,3",
+          "Watch5,4",
+          "Watch5,9",
+          "Watch6,1",
+          "Watch6,10",
+          "Watch6,11",
+          "Watch6,12",
+          "Watch6,13",
+          "Watch6,14",
+          "Watch6,15",
+          "Watch6,16",
+          "Watch6,17",
+          "Watch6,18",
+          "Watch6,2",
+          "Watch6,3",
+          "Watch6,4",
+          "Watch6,6",
+          "Watch6,7",
+          "Watch6,8",
+          "Watch6,9",
+          "Watch7,1",
+          "Watch7,2",
+          "Watch7,3",
+          "Watch7,4",
+          "Watch7,5"
+        ]
+      },
+      {
+        "ProductVersion": "5.3.9",
+        "Build": "16U693",
+        "PostingDate": "2024-07-29",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "Watch2,3",
+          "Watch2,4",
+          "Watch2,6",
+          "Watch2,7",
+          "Watch3,1",
+          "Watch3,2",
+          "Watch3,3",
+          "Watch3,4",
+          "Watch4,1",
+          "Watch4,2",
+          "Watch4,3",
+          "Watch4,4"
+        ]
+      },
+      {
+        "ProductVersion": "15.8.3",
+        "Build": "19H6386",
+        "PostingDate": "2024-08-07",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "iPad5,1",
+          "iPad5,2",
+          "iPad5,3",
+          "iPad5,4",
+          "iPhone8,1",
+          "iPhone8,2",
+          "iPhone8,4",
+          "iPhone9,1",
+          "iPhone9,2",
+          "iPhone9,3",
+          "iPhone9,4",
+          "iPod9,1"
+        ]
+      },
+      {
+        "ProductVersion": "9.6.3",
+        "Build": "20U6502",
+        "PostingDate": "2024-07-29",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "Watch4,1",
+          "Watch4,2",
+          "Watch4,3",
+          "Watch4,4",
+          "Watch5,1",
+          "Watch5,10",
+          "Watch5,11",
+          "Watch5,12",
+          "Watch5,2",
+          "Watch5,3",
+          "Watch5,4",
+          "Watch5,9",
+          "Watch6,1",
+          "Watch6,10",
+          "Watch6,11",
+          "Watch6,12",
+          "Watch6,13",
+          "Watch6,14",
+          "Watch6,15",
+          "Watch6,16",
+          "Watch6,17",
+          "Watch6,18",
+          "Watch6,2",
+          "Watch6,3",
+          "Watch6,4",
+          "Watch6,6",
+          "Watch6,7",
+          "Watch6,8",
+          "Watch6,9"
+        ]
+      }
+    ],
+    "visionOS": [
+      {
+        "ProductVersion": "1.1.2",
+        "Build": "21O231",
+        "PostingDate": "2024-04-12",
+        "ExpirationDate": "2024-09-08",
+        "SupportedDevices": ["RealityDevice14,1"]
+      },
+      {
+        "ProductVersion": "1.1.2",
+        "Build": "21O6231",
+        "PostingDate": "2024-04-12",
+        "ExpirationDate": "2024-09-08",
+        "SupportedDevices": ["RealityDevice14,1"]
+      }
+    ],
+    "xrOS": [
+      {
+        "ProductVersion": "1.0.3",
+        "Build": "21N333",
+        "PostingDate": "2024-02-12",
+        "ExpirationDate": "2024-06-05",
+        "SupportedDevices": ["RealityDevice14,1"]
+      }
+    ],
+    "macOS": [
+      {
+        "ProductVersion": "14.6.1",
+        "Build": "23G93",
+        "PostingDate": "2024-08-07",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "J132AP",
+          "J137AP",
+          "J140AAP",
+          "J140KAP",
+          "J152FAP",
+          "J160AP",
+          "J174AP",
+          "J180dAP",
+          "J185AP",
+          "J185FAP",
+          "J213AP",
+          "J214KAP",
+          "J215AP",
+          "J223AP",
+          "J230KAP",
+          "J274AP",
+          "J293AP",
+          "J313AP",
+          "J314cAP",
+          "J314sAP",
+          "J316cAP",
+          "J316sAP",
+          "J375cAP",
+          "J375dAP",
+          "J413AP",
+          "J414cAP",
+          "J414sAP",
+          "J415AP",
+          "J416cAP",
+          "J416sAP",
+          "J433AP",
+          "J434AP",
+          "J456AP",
+          "J457AP",
+          "J473AP",
+          "J474sAP",
+          "J475cAP",
+          "J475dAP",
+          "J493AP",
+          "J504AP",
+          "J514cAP",
+          "J514mAP",
+          "J514sAP",
+          "J516cAP",
+          "J516mAP",
+          "J516sAP",
+          "J613AP",
+          "J615AP",
+          "J680AP",
+          "J780AP",
+          "Mac-1E7E29AD0135F9BC",
+          "Mac-63001698E7A34814",
+          "Mac-937A206F2EE63C01",
+          "Mac-AA95B1DDAB278B95",
+          "VMA2MACOSAP",
+          "VMM-x86_64"
+        ]
+      },
+      {
+        "ProductVersion": "13.6.9",
+        "Build": "22G830",
+        "PostingDate": "2024-08-07",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "J132AP",
+          "J137AP",
+          "J140AAP",
+          "J140KAP",
+          "J152FAP",
+          "J160AP",
+          "J174AP",
+          "J180dAP",
+          "J185AP",
+          "J185FAP",
+          "J213AP",
+          "J214KAP",
+          "J215AP",
+          "J223AP",
+          "J230KAP",
+          "J274AP",
+          "J293AP",
+          "J313AP",
+          "J314cAP",
+          "J314sAP",
+          "J316cAP",
+          "J316sAP",
+          "J375cAP",
+          "J375dAP",
+          "J413AP",
+          "J414cAP",
+          "J414sAP",
+          "J415AP",
+          "J416cAP",
+          "J416sAP",
+          "J433AP",
+          "J434AP",
+          "J456AP",
+          "J457AP",
+          "J473AP",
+          "J474sAP",
+          "J475cAP",
+          "J475dAP",
+          "J493AP",
+          "J504AP",
+          "J680AP",
+          "J780AP",
+          "Mac-1E7E29AD0135F9BC",
+          "Mac-4B682C642B45593E",
+          "Mac-551B86E5744E2388",
+          "Mac-63001698E7A34814",
+          "Mac-77F17D7DA9285301",
+          "Mac-937A206F2EE63C01",
+          "Mac-AA95B1DDAB278B95",
+          "Mac-B4831CEBD52A0C4C",
+          "Mac-BE088AF8C5EB4FA2",
+          "Mac-CAD6701F7CEA0921",
+          "Mac-EE2EBD4B90B839A8",
+          "VMA2MACOSAP",
+          "VMM-x86_64"
+        ]
+      },
+      {
+        "ProductVersion": "12.7.6",
+        "Build": "21H1320",
+        "PostingDate": "2024-08-07",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "J132AP",
+          "J137AP",
+          "J140AAP",
+          "J140KAP",
+          "J152FAP",
+          "J160AP",
+          "J174AP",
+          "J185AP",
+          "J185FAP",
+          "J213AP",
+          "J214KAP",
+          "J215AP",
+          "J223AP",
+          "J230KAP",
+          "J274AP",
+          "J293AP",
+          "J313AP",
+          "J314cAP",
+          "J314sAP",
+          "J316cAP",
+          "J316sAP",
+          "J375cAP",
+          "J375dAP",
+          "J413AP",
+          "J456AP",
+          "J457AP",
+          "J493AP",
+          "J680AP",
+          "J780AP",
+          "Mac-06F11F11946D27C5",
+          "Mac-06F11FD93F0323C5",
+          "Mac-1E7E29AD0135F9BC",
+          "Mac-35C5E08120C7EEAF",
+          "Mac-473D31EABEB93F9B",
+          "Mac-4B682C642B45593E",
+          "Mac-551B86E5744E2388",
+          "Mac-63001698E7A34814",
+          "Mac-65CE76090165799A",
+          "Mac-66E35819EE2D0D05",
+          "Mac-77F17D7DA9285301",
+          "Mac-937A206F2EE63C01",
+          "Mac-937CB26E2E02BB01",
+          "Mac-9AE82516C7C6B903",
+          "Mac-9F18E312C5C2BF0B",
+          "Mac-A369DDC4E67F1C45",
+          "Mac-A5C67F76ED83108C",
+          "Mac-AA95B1DDAB278B95",
+          "Mac-B4831CEBD52A0C4C",
+          "Mac-B809C3757DA9BB8D",
+          "Mac-BE088AF8C5EB4FA2",
+          "Mac-CAD6701F7CEA0921",
+          "Mac-DB15BD556843C820",
+          "Mac-E43C1C25D4880AD6",
+          "Mac-EE2EBD4B90B839A8",
+          "Mac-F60DEB81FF30ACF6",
+          "Mac-FFE5EF870D7BA81A",
+          "VMA2MACOSAP",
+          "VMM-x86_64"
+        ]
+      },
+      {
+        "ProductVersion": "11.7.10",
+        "Build": "20G1427",
+        "PostingDate": "2024-08-07",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "J132AP",
+          "J137AP",
+          "J140AAP",
+          "J140KAP",
+          "J152FAP",
+          "J160AP",
+          "J174AP",
+          "J185AP",
+          "J185FAP",
+          "J213AP",
+          "J214AP",
+          "J214KAP",
+          "J215AP",
+          "J223AP",
+          "J230AP",
+          "J230KAP",
+          "J274AP",
+          "J293AP",
+          "J313AP",
+          "J456AP",
+          "J457AP",
+          "J680AP",
+          "J780AP",
+          "Mac-06F11F11946D27C5",
+          "Mac-06F11FD93F0323C5",
+          "Mac-0CFF9C7C2B63DF8D",
+          "Mac-112818653D3AABFC",
+          "Mac-112B0A653D3AAB9C",
+          "Mac-189A3D4F975D5FFC",
+          "Mac-1E7E29AD0135F9BC",
+          "Mac-226CB3C6A851A671",
+          "Mac-27AD2F918AE68F61",
+          "Mac-2BD1B31983FE1663",
+          "Mac-35C1E88140C3E6CF",
+          "Mac-35C5E08120C7EEAF",
+          "Mac-36B6B6DA9CFCD881",
+          "Mac-3CBD00234E554E41",
+          "Mac-42FD25EABCABB274",
+          "Mac-473D31EABEB93F9B",
+          "Mac-4B682C642B45593E",
+          "Mac-50619A408DB004DA",
+          "Mac-53FDB3D8DB8CA971",
+          "Mac-551B86E5744E2388",
+          "Mac-5A49A77366F81C72",
+          "Mac-5F9802EFE386AA28",
+          "Mac-63001698E7A34814",
+          "Mac-65CE76090165799A",
+          "Mac-66E35819EE2D0D05",
+          "Mac-747B1AEFF11738BE",
+          "Mac-77F17D7DA9285301",
+          "Mac-7BA5B2D9E42DDD94",
+          "Mac-7BA5B2DFE22DDD8C",
+          "Mac-7DF21CB3ED6977E5",
+          "Mac-81E3E92DD6088272",
+          "Mac-827FAC58A8FDFA22",
+          "Mac-827FB448E656EC26",
+          "Mac-90BE64C3CB5A9AEB",
+          "Mac-937A206F2EE63C01",
+          "Mac-937CB26E2E02BB01",
+          "Mac-9394BDF4BF862EE7",
+          "Mac-9AE82516C7C6B903",
+          "Mac-9F18E312C5C2BF0B",
+          "Mac-A369DDC4E67F1C45",
+          "Mac-A5C67F76ED83108C",
+          "Mac-A61BADE1FDAD7B05",
+          "Mac-AA95B1DDAB278B95",
+          "Mac-AF89B6D9451A490B",
+          "Mac-B4831CEBD52A0C4C",
+          "Mac-B809C3757DA9BB8D",
+          "Mac-BE088AF8C5EB4FA2",
+          "Mac-BE0E8AC46FE800CC",
+          "Mac-C6F71043CEAA02A6",
+          "Mac-CAD6701F7CEA0921",
+          "Mac-CF21D135A7D34AA6",
+          "Mac-CFF7D910A743CAAF",
+          "Mac-DB15BD556843C820",
+          "Mac-E1008331FDC96864",
+          "Mac-E43C1C25D4880AD6",
+          "Mac-E7203C0F68AA0004",
+          "Mac-EE2EBD4B90B839A8",
+          "Mac-F305150B0C7DEEEF",
+          "Mac-F60DEB81FF30ACF6",
+          "Mac-FA842E06C61E91C5",
+          "Mac-FFE5EF870D7BA81A",
+          "VMM-x86_64",
+          "X589AMLUAP",
+          "X589ICLYAP",
+          "X86LEGACYAP"
+        ]
+      }
+    ]
+  },
+  "AssetSets": {
+    "iOS": [
+      {
+        "ProductVersion": "6.3",
+        "Build": "17U6208",
+        "PostingDate": "2024-05-13",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": ["Watch2,3", "Watch2,4", "Watch2,6", "Watch2,7"]
+      },
+      {
+        "ProductVersion": "17.5",
+        "Build": "21L569",
+        "PostingDate": "2024-05-13",
+        "ExpirationDate": "2024-10-27",
+        "SupportedDevices": [
+          "AudioAccessory1,1",
+          "AudioAccessory5,1",
+          "AudioAccessory6,1"
+        ]
+      },
+      {
+        "ProductVersion": "17.5",
+        "Build": "21L569",
+        "PostingDate": "2024-05-13",
+        "ExpirationDate": "2024-08-19",
+        "SupportedDevices": [
+          "AppleTV11,1",
+          "AppleTV14,1",
+          "AppleTV5,3",
+          "AppleTV6,2"
+        ]
+      },
+      {
+        "ProductVersion": "10.6",
+        "Build": "21U6577",
+        "PostingDate": "2024-07-29",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "Watch4,1",
+          "Watch4,2",
+          "Watch4,3",
+          "Watch4,4",
+          "Watch5,1",
+          "Watch5,10",
+          "Watch5,11",
+          "Watch5,12",
+          "Watch5,2",
+          "Watch5,3",
+          "Watch5,4",
+          "Watch5,9",
+          "Watch6,1",
+          "Watch6,10",
+          "Watch6,11",
+          "Watch6,12",
+          "Watch6,13",
+          "Watch6,14",
+          "Watch6,15",
+          "Watch6,16",
+          "Watch6,17",
+          "Watch6,18",
+          "Watch6,2",
+          "Watch6,3",
+          "Watch6,4",
+          "Watch6,6",
+          "Watch6,7",
+          "Watch6,8",
+          "Watch6,9",
+          "Watch7,1",
+          "Watch7,2",
+          "Watch7,3",
+          "Watch7,4",
+          "Watch7,5"
+        ]
+      },
+      {
+        "ProductVersion": "17.5",
+        "Build": "21F6079",
+        "PostingDate": "2024-05-14",
+        "ExpirationDate": "2024-08-18",
+        "SupportedDevices": [
+          "iPad11,1",
+          "iPad11,2",
+          "iPad11,3",
+          "iPad11,4",
+          "iPad11,6",
+          "iPad11,7",
+          "iPad12,1",
+          "iPad12,2",
+          "iPad13,1",
+          "iPad13,10",
+          "iPad13,11",
+          "iPad13,16",
+          "iPad13,17",
+          "iPad13,18",
+          "iPad13,19",
+          "iPad13,2",
+          "iPad13,4",
+          "iPad13,5",
+          "iPad13,6",
+          "iPad13,7",
+          "iPad13,8",
+          "iPad13,9",
+          "iPad14,1",
+          "iPad14,2",
+          "iPad14,3",
+          "iPad14,4",
+          "iPad14,5",
+          "iPad14,6",
+          "iPad7,1",
+          "iPad7,11",
+          "iPad7,12",
+          "iPad7,2",
+          "iPad7,3",
+          "iPad7,4",
+          "iPad7,5",
+          "iPad7,6",
+          "iPad8,1",
+          "iPad8,10",
+          "iPad8,11",
+          "iPad8,12",
+          "iPad8,2",
+          "iPad8,3",
+          "iPad8,4",
+          "iPad8,5",
+          "iPad8,6",
+          "iPad8,7",
+          "iPad8,8",
+          "iPad8,9",
+          "iPhone11,2",
+          "iPhone11,4",
+          "iPhone11,6",
+          "iPhone11,8",
+          "iPhone12,1",
+          "iPhone12,3",
+          "iPhone12,5",
+          "iPhone12,8",
+          "iPhone13,1",
+          "iPhone13,2",
+          "iPhone13,3",
+          "iPhone13,4",
+          "iPhone14,2",
+          "iPhone14,3",
+          "iPhone14,4",
+          "iPhone14,5",
+          "iPhone14,6",
+          "iPhone14,7",
+          "iPhone14,8",
+          "iPhone15,2",
+          "iPhone15,3",
+          "iPhone15,4",
+          "iPhone15,5",
+          "iPhone16,1",
+          "iPhone16,2"
+        ]
+      },
+      {
+        "ProductVersion": "17.6",
+        "Build": "21G6080",
+        "PostingDate": "2024-07-29",
+        "ExpirationDate": "2024-11-05",
+        "SupportedDevices": [
+          "iPad11,1",
+          "iPad11,2",
+          "iPad11,3",
+          "iPad11,4",
+          "iPad11,6",
+          "iPad11,7",
+          "iPad12,1",
+          "iPad12,2",
+          "iPad13,1",
+          "iPad13,10",
+          "iPad13,11",
+          "iPad13,16",
+          "iPad13,17",
+          "iPad13,18",
+          "iPad13,19",
+          "iPad13,2",
+          "iPad13,4",
+          "iPad13,5",
+          "iPad13,6",
+          "iPad13,7",
+          "iPad13,8",
+          "iPad13,9",
+          "iPad14,1",
+          "iPad14,10",
+          "iPad14,11",
+          "iPad14,2",
+          "iPad14,3",
+          "iPad14,4",
+          "iPad14,5",
+          "iPad14,6",
+          "iPad14,8",
+          "iPad14,9",
+          "iPad16,3",
+          "iPad16,4",
+          "iPad16,5",
+          "iPad16,6",
+          "iPad7,1",
+          "iPad7,11",
+          "iPad7,12",
+          "iPad7,2",
+          "iPad7,3",
+          "iPad7,4",
+          "iPad7,5",
+          "iPad7,6",
+          "iPad8,1",
+          "iPad8,10",
+          "iPad8,11",
+          "iPad8,12",
+          "iPad8,2",
+          "iPad8,3",
+          "iPad8,4",
+          "iPad8,5",
+          "iPad8,6",
+          "iPad8,7",
+          "iPad8,8",
+          "iPad8,9",
+          "iPhone11,2",
+          "iPhone11,4",
+          "iPhone11,6",
+          "iPhone11,8",
+          "iPhone12,1",
+          "iPhone12,3",
+          "iPhone12,5",
+          "iPhone12,8",
+          "iPhone13,1",
+          "iPhone13,2",
+          "iPhone13,3",
+          "iPhone13,4",
+          "iPhone14,2",
+          "iPhone14,3",
+          "iPhone14,4",
+          "iPhone14,5",
+          "iPhone14,6",
+          "iPhone14,7",
+          "iPhone14,8",
+          "iPhone15,2",
+          "iPhone15,3",
+          "iPhone15,4",
+          "iPhone15,5",
+          "iPhone16,1",
+          "iPhone16,2"
+        ]
+      },
+      {
+        "ProductVersion": "17.6",
+        "Build": "21M71",
+        "PostingDate": "2024-07-29",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "AppleTV11,1",
+          "AppleTV14,1",
+          "AppleTV5,3",
+          "AppleTV6,2",
+          "AudioAccessory1,1",
+          "AudioAccessory5,1",
+          "AudioAccessory6,1"
+        ]
+      },
+      {
+        "ProductVersion": "16.7.10",
+        "Build": "20H6350",
+        "PostingDate": "2024-08-07",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "iPad6,11",
+          "iPad6,12",
+          "iPad6,3",
+          "iPad6,4",
+          "iPad6,7",
+          "iPad6,8",
+          "iPhone10,1",
+          "iPhone10,2",
+          "iPhone10,3",
+          "iPhone10,4",
+          "iPhone10,5",
+          "iPhone10,6"
+        ]
+      },
+      {
+        "ProductVersion": "16.7.2",
+        "Build": "20H115",
+        "PostingDate": "2023-10-25",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "iPad11,1",
+          "iPad11,2",
+          "iPad11,3",
+          "iPad11,4",
+          "iPad11,6",
+          "iPad11,7",
+          "iPad12,1",
+          "iPad12,2",
+          "iPad13,1",
+          "iPad13,10",
+          "iPad13,11",
+          "iPad13,16",
+          "iPad13,17",
+          "iPad13,18",
+          "iPad13,19",
+          "iPad13,2",
+          "iPad13,4",
+          "iPad13,5",
+          "iPad13,6",
+          "iPad13,7",
+          "iPad13,8",
+          "iPad13,9",
+          "iPad14,1",
+          "iPad14,2",
+          "iPad14,3",
+          "iPad14,4",
+          "iPad14,5",
+          "iPad14,6",
+          "iPad7,1",
+          "iPad7,11",
+          "iPad7,12",
+          "iPad7,2",
+          "iPad7,3",
+          "iPad7,4",
+          "iPad7,5",
+          "iPad7,6",
+          "iPad8,1",
+          "iPad8,10",
+          "iPad8,11",
+          "iPad8,12",
+          "iPad8,2",
+          "iPad8,3",
+          "iPad8,4",
+          "iPad8,5",
+          "iPad8,6",
+          "iPad8,7",
+          "iPad8,8",
+          "iPad8,9",
+          "iPhone11,2",
+          "iPhone11,6",
+          "iPhone11,8",
+          "iPhone12,1",
+          "iPhone12,3",
+          "iPhone12,5",
+          "iPhone12,8",
+          "iPhone13,1",
+          "iPhone13,2",
+          "iPhone13,3",
+          "iPhone13,4",
+          "iPhone14,2",
+          "iPhone14,3",
+          "iPhone14,4",
+          "iPhone14,5",
+          "iPhone14,6",
+          "iPhone14,7",
+          "iPhone14,8",
+          "iPhone15,2",
+          "iPhone15,3"
+        ]
+      },
+      {
+        "ProductVersion": "10.5",
+        "Build": "21T576",
+        "PostingDate": "2024-05-13",
+        "ExpirationDate": "2024-10-27",
+        "SupportedDevices": [
+          "Watch4,1",
+          "Watch4,2",
+          "Watch4,3",
+          "Watch4,4",
+          "Watch5,1",
+          "Watch5,10",
+          "Watch5,11",
+          "Watch5,12",
+          "Watch5,2",
+          "Watch5,3",
+          "Watch5,4",
+          "Watch5,9",
+          "Watch6,1",
+          "Watch6,10",
+          "Watch6,11",
+          "Watch6,12",
+          "Watch6,13",
+          "Watch6,14",
+          "Watch6,15",
+          "Watch6,16",
+          "Watch6,17",
+          "Watch6,18",
+          "Watch6,2",
+          "Watch6,3",
+          "Watch6,4",
+          "Watch6,6",
+          "Watch6,7",
+          "Watch6,8",
+          "Watch6,9",
+          "Watch7,1",
+          "Watch7,2",
+          "Watch7,3",
+          "Watch7,4",
+          "Watch7,5"
+        ]
+      },
+      {
+        "ProductVersion": "17.5",
+        "Build": "21F6084",
+        "PostingDate": "2024-05-14",
+        "ExpirationDate": "2024-08-18",
+        "SupportedDevices": [
+          "iPad14,10",
+          "iPad14,11",
+          "iPad14,8",
+          "iPad14,9",
+          "iPad16,3",
+          "iPad16,4",
+          "iPad16,5",
+          "iPad16,6"
+        ]
+      },
+      {
+        "ProductVersion": "16.7.2",
+        "Build": "20H6115",
+        "PostingDate": "2023-10-25",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "iPad11,1",
+          "iPad11,2",
+          "iPad11,3",
+          "iPad11,4",
+          "iPad11,6",
+          "iPad11,7",
+          "iPad12,1",
+          "iPad12,2",
+          "iPad13,1",
+          "iPad13,10",
+          "iPad13,11",
+          "iPad13,16",
+          "iPad13,17",
+          "iPad13,18",
+          "iPad13,19",
+          "iPad13,2",
+          "iPad13,4",
+          "iPad13,5",
+          "iPad13,6",
+          "iPad13,7",
+          "iPad13,8",
+          "iPad13,9",
+          "iPad14,1",
+          "iPad14,2",
+          "iPad14,3",
+          "iPad14,4",
+          "iPad14,5",
+          "iPad14,6",
+          "iPad7,1",
+          "iPad7,11",
+          "iPad7,12",
+          "iPad7,2",
+          "iPad7,3",
+          "iPad7,4",
+          "iPad7,5",
+          "iPad7,6",
+          "iPad8,1",
+          "iPad8,10",
+          "iPad8,11",
+          "iPad8,12",
+          "iPad8,2",
+          "iPad8,3",
+          "iPad8,4",
+          "iPad8,5",
+          "iPad8,6",
+          "iPad8,7",
+          "iPad8,8",
+          "iPad8,9",
+          "iPhone11,2",
+          "iPhone11,6",
+          "iPhone11,8",
+          "iPhone12,1",
+          "iPhone12,3",
+          "iPhone12,5",
+          "iPhone12,8",
+          "iPhone13,1",
+          "iPhone13,2",
+          "iPhone13,3",
+          "iPhone13,4",
+          "iPhone14,2",
+          "iPhone14,3",
+          "iPhone14,4",
+          "iPhone14,5",
+          "iPhone14,6",
+          "iPhone14,7",
+          "iPhone14,8",
+          "iPhone15,2",
+          "iPhone15,3"
+        ]
+      },
+      {
+        "ProductVersion": "16.7.10",
+        "Build": "20H350",
+        "PostingDate": "2024-08-07",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "iPad6,11",
+          "iPad6,12",
+          "iPad6,3",
+          "iPad6,4",
+          "iPad6,7",
+          "iPad6,8",
+          "iPhone10,1",
+          "iPhone10,2",
+          "iPhone10,3",
+          "iPhone10,4",
+          "iPhone10,5",
+          "iPhone10,6"
+        ]
+      },
+      {
+        "ProductVersion": "10.5",
+        "Build": "21T6576",
+        "PostingDate": "2024-05-13",
+        "ExpirationDate": "2024-10-27",
+        "SupportedDevices": [
+          "Watch4,1",
+          "Watch4,2",
+          "Watch4,3",
+          "Watch4,4",
+          "Watch5,1",
+          "Watch5,10",
+          "Watch5,11",
+          "Watch5,12",
+          "Watch5,2",
+          "Watch5,3",
+          "Watch5,4",
+          "Watch5,9",
+          "Watch6,1",
+          "Watch6,10",
+          "Watch6,11",
+          "Watch6,12",
+          "Watch6,13",
+          "Watch6,14",
+          "Watch6,15",
+          "Watch6,16",
+          "Watch6,17",
+          "Watch6,18",
+          "Watch6,2",
+          "Watch6,3",
+          "Watch6,4",
+          "Watch6,6",
+          "Watch6,7",
+          "Watch6,8",
+          "Watch6,9",
+          "Watch7,1",
+          "Watch7,2",
+          "Watch7,3",
+          "Watch7,4",
+          "Watch7,5"
+        ]
+      },
+      {
+        "ProductVersion": "6.3",
+        "Build": "17U208",
+        "PostingDate": "2024-05-13",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": ["Watch2,3", "Watch2,4", "Watch2,6", "Watch2,7"]
+      },
+      {
+        "ProductVersion": "8.8.1",
+        "Build": "19U512",
+        "PostingDate": "2024-05-13",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "Watch3,1",
+          "Watch3,2",
+          "Watch3,3",
+          "Watch3,4",
+          "Watch4,1",
+          "Watch4,2",
+          "Watch4,3",
+          "Watch4,4",
+          "Watch5,1",
+          "Watch5,10",
+          "Watch5,11",
+          "Watch5,12",
+          "Watch5,2",
+          "Watch5,3",
+          "Watch5,4",
+          "Watch5,9",
+          "Watch6,1",
+          "Watch6,2",
+          "Watch6,3",
+          "Watch6,4",
+          "Watch6,6",
+          "Watch6,7",
+          "Watch6,8",
+          "Watch6,9"
+        ]
+      },
+      {
+        "ProductVersion": "17.6.1",
+        "Build": "21G6093",
+        "PostingDate": "2024-08-07",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "iPad11,1",
+          "iPad11,2",
+          "iPad11,3",
+          "iPad11,4",
+          "iPad11,6",
+          "iPad11,7",
+          "iPad12,1",
+          "iPad12,2",
+          "iPad13,1",
+          "iPad13,10",
+          "iPad13,11",
+          "iPad13,16",
+          "iPad13,17",
+          "iPad13,18",
+          "iPad13,19",
+          "iPad13,2",
+          "iPad13,4",
+          "iPad13,5",
+          "iPad13,6",
+          "iPad13,7",
+          "iPad13,8",
+          "iPad13,9",
+          "iPad14,1",
+          "iPad14,10",
+          "iPad14,11",
+          "iPad14,2",
+          "iPad14,3",
+          "iPad14,4",
+          "iPad14,5",
+          "iPad14,6",
+          "iPad14,8",
+          "iPad14,9",
+          "iPad16,3",
+          "iPad16,4",
+          "iPad16,5",
+          "iPad16,6",
+          "iPad7,1",
+          "iPad7,11",
+          "iPad7,12",
+          "iPad7,2",
+          "iPad7,3",
+          "iPad7,4",
+          "iPad7,5",
+          "iPad7,6",
+          "iPad8,1",
+          "iPad8,10",
+          "iPad8,11",
+          "iPad8,12",
+          "iPad8,2",
+          "iPad8,3",
+          "iPad8,4",
+          "iPad8,5",
+          "iPad8,6",
+          "iPad8,7",
+          "iPad8,8",
+          "iPad8,9",
+          "iPhone11,2",
+          "iPhone11,4",
+          "iPhone11,6",
+          "iPhone11,8",
+          "iPhone12,1",
+          "iPhone12,3",
+          "iPhone12,5",
+          "iPhone12,8",
+          "iPhone13,1",
+          "iPhone13,2",
+          "iPhone13,3",
+          "iPhone13,4",
+          "iPhone14,2",
+          "iPhone14,3",
+          "iPhone14,4",
+          "iPhone14,5",
+          "iPhone14,6",
+          "iPhone14,7",
+          "iPhone14,8",
+          "iPhone15,2",
+          "iPhone15,3",
+          "iPhone15,4",
+          "iPhone15,5",
+          "iPhone16,1",
+          "iPhone16,2"
+        ]
+      },
+      {
+        "ProductVersion": "15.8.2",
+        "Build": "19H384",
+        "PostingDate": "2024-05-14",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "iPad5,1",
+          "iPad5,2",
+          "iPad5,3",
+          "iPad5,4",
+          "iPhone8,1",
+          "iPhone8,2",
+          "iPhone8,4",
+          "iPhone9,1",
+          "iPhone9,2",
+          "iPhone9,3",
+          "iPhone9,4",
+          "iPod9,1"
+        ]
+      },
+      {
+        "ProductVersion": "1.2",
+        "Build": "21O589",
+        "PostingDate": "2024-06-10",
+        "ExpirationDate": "2024-10-27",
+        "SupportedDevices": ["RealityDevice14,1"]
+      },
+      {
+        "ProductVersion": "17.5.1",
+        "Build": "21F6090",
+        "PostingDate": "2024-05-20",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "iPad11,1",
+          "iPad11,2",
+          "iPad11,3",
+          "iPad11,4",
+          "iPad11,6",
+          "iPad11,7",
+          "iPad12,1",
+          "iPad12,2",
+          "iPad13,1",
+          "iPad13,10",
+          "iPad13,11",
+          "iPad13,16",
+          "iPad13,17",
+          "iPad13,18",
+          "iPad13,19",
+          "iPad13,2",
+          "iPad13,4",
+          "iPad13,5",
+          "iPad13,6",
+          "iPad13,7",
+          "iPad13,8",
+          "iPad13,9",
+          "iPad14,1",
+          "iPad14,10",
+          "iPad14,11",
+          "iPad14,2",
+          "iPad14,3",
+          "iPad14,4",
+          "iPad14,5",
+          "iPad14,6",
+          "iPad14,8",
+          "iPad14,9",
+          "iPad16,3",
+          "iPad16,4",
+          "iPad16,5",
+          "iPad16,6",
+          "iPad7,1",
+          "iPad7,11",
+          "iPad7,12",
+          "iPad7,2",
+          "iPad7,3",
+          "iPad7,4",
+          "iPad7,5",
+          "iPad7,6",
+          "iPad8,1",
+          "iPad8,10",
+          "iPad8,11",
+          "iPad8,12",
+          "iPad8,2",
+          "iPad8,3",
+          "iPad8,4",
+          "iPad8,5",
+          "iPad8,6",
+          "iPad8,7",
+          "iPad8,8",
+          "iPad8,9",
+          "iPhone11,2",
+          "iPhone11,4",
+          "iPhone11,6",
+          "iPhone11,8",
+          "iPhone12,1",
+          "iPhone12,3",
+          "iPhone12,5",
+          "iPhone12,8",
+          "iPhone13,1",
+          "iPhone13,2",
+          "iPhone13,3",
+          "iPhone13,4",
+          "iPhone14,2",
+          "iPhone14,3",
+          "iPhone14,4",
+          "iPhone14,5",
+          "iPhone14,6",
+          "iPhone14,7",
+          "iPhone14,8",
+          "iPhone15,2",
+          "iPhone15,3",
+          "iPhone15,4",
+          "iPhone15,5",
+          "iPhone16,1",
+          "iPhone16,2"
+        ]
+      },
+      {
+        "ProductVersion": "12.5.7",
+        "Build": "16H81",
+        "PostingDate": "2024-05-14",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "iPad4,1",
+          "iPad4,2",
+          "iPad4,3",
+          "iPad4,4",
+          "iPad4,5",
+          "iPad4,6",
+          "iPad4,7",
+          "iPad4,8",
+          "iPad4,9",
+          "iPhone6,1",
+          "iPhone6,2",
+          "iPhone7,1",
+          "iPhone7,2",
+          "iPod7,1"
+        ]
+      },
+      {
+        "ProductVersion": "12.5.7",
+        "Build": "16H6081",
+        "PostingDate": "2024-05-14",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "iPad4,1",
+          "iPad4,2",
+          "iPad4,3",
+          "iPad4,4",
+          "iPad4,5",
+          "iPad4,6",
+          "iPad4,7",
+          "iPad4,8",
+          "iPad4,9",
+          "iPhone6,1",
+          "iPhone6,2",
+          "iPhone7,1",
+          "iPhone7,2",
+          "iPod7,1"
+        ]
+      },
+      {
+        "ProductVersion": "10.6",
+        "Build": "21U577",
+        "PostingDate": "2024-07-29",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "Watch4,1",
+          "Watch4,2",
+          "Watch4,3",
+          "Watch4,4",
+          "Watch5,1",
+          "Watch5,10",
+          "Watch5,11",
+          "Watch5,12",
+          "Watch5,2",
+          "Watch5,3",
+          "Watch5,4",
+          "Watch5,9",
+          "Watch6,1",
+          "Watch6,10",
+          "Watch6,11",
+          "Watch6,12",
+          "Watch6,13",
+          "Watch6,14",
+          "Watch6,15",
+          "Watch6,16",
+          "Watch6,17",
+          "Watch6,18",
+          "Watch6,2",
+          "Watch6,3",
+          "Watch6,4",
+          "Watch6,6",
+          "Watch6,7",
+          "Watch6,8",
+          "Watch6,9",
+          "Watch7,1",
+          "Watch7,2",
+          "Watch7,3",
+          "Watch7,4",
+          "Watch7,5"
+        ]
+      },
+      {
+        "ProductVersion": "15.8.3",
+        "Build": "19H386",
+        "PostingDate": "2024-07-29",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "iPad5,1",
+          "iPad5,2",
+          "iPad5,3",
+          "iPad5,4",
+          "iPhone8,1",
+          "iPhone8,2",
+          "iPhone8,4",
+          "iPhone9,1",
+          "iPhone9,2",
+          "iPhone9,3",
+          "iPhone9,4",
+          "iPod9,1"
+        ]
+      },
+      {
+        "ProductVersion": "16.7.8",
+        "Build": "20H6343",
+        "PostingDate": "2024-05-14",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "iPad6,11",
+          "iPad6,12",
+          "iPad6,3",
+          "iPad6,4",
+          "iPad6,7",
+          "iPad6,8",
+          "iPhone10,1",
+          "iPhone10,2",
+          "iPhone10,3",
+          "iPhone10,4",
+          "iPhone10,5",
+          "iPhone10,6"
+        ]
+      },
+      {
+        "ProductVersion": "17.6",
+        "Build": "21G80",
+        "PostingDate": "2024-07-29",
+        "ExpirationDate": "2024-11-05",
+        "SupportedDevices": [
+          "iPad11,1",
+          "iPad11,2",
+          "iPad11,3",
+          "iPad11,4",
+          "iPad11,6",
+          "iPad11,7",
+          "iPad12,1",
+          "iPad12,2",
+          "iPad13,1",
+          "iPad13,10",
+          "iPad13,11",
+          "iPad13,16",
+          "iPad13,17",
+          "iPad13,18",
+          "iPad13,19",
+          "iPad13,2",
+          "iPad13,4",
+          "iPad13,5",
+          "iPad13,6",
+          "iPad13,7",
+          "iPad13,8",
+          "iPad13,9",
+          "iPad14,1",
+          "iPad14,10",
+          "iPad14,11",
+          "iPad14,2",
+          "iPad14,3",
+          "iPad14,4",
+          "iPad14,5",
+          "iPad14,6",
+          "iPad14,8",
+          "iPad14,9",
+          "iPad16,3",
+          "iPad16,4",
+          "iPad16,5",
+          "iPad16,6",
+          "iPad7,1",
+          "iPad7,11",
+          "iPad7,12",
+          "iPad7,2",
+          "iPad7,3",
+          "iPad7,4",
+          "iPad7,5",
+          "iPad7,6",
+          "iPad8,1",
+          "iPad8,10",
+          "iPad8,11",
+          "iPad8,12",
+          "iPad8,2",
+          "iPad8,3",
+          "iPad8,4",
+          "iPad8,5",
+          "iPad8,6",
+          "iPad8,7",
+          "iPad8,8",
+          "iPad8,9",
+          "iPhone11,2",
+          "iPhone11,4",
+          "iPhone11,6",
+          "iPhone11,8",
+          "iPhone12,1",
+          "iPhone12,3",
+          "iPhone12,5",
+          "iPhone12,8",
+          "iPhone13,1",
+          "iPhone13,2",
+          "iPhone13,3",
+          "iPhone13,4",
+          "iPhone14,2",
+          "iPhone14,3",
+          "iPhone14,4",
+          "iPhone14,5",
+          "iPhone14,6",
+          "iPhone14,7",
+          "iPhone14,8",
+          "iPhone15,2",
+          "iPhone15,3",
+          "iPhone15,4",
+          "iPhone15,5",
+          "iPhone16,1",
+          "iPhone16,2"
+        ]
+      },
+      {
+        "ProductVersion": "17.5.1",
+        "Build": "21L6580",
+        "PostingDate": "2024-05-21",
+        "ExpirationDate": "2024-10-27",
+        "SupportedDevices": [
+          "AppleTV11,1",
+          "AppleTV14,1",
+          "AppleTV5,3",
+          "AppleTV6,2"
+        ]
+      },
+      {
+        "ProductVersion": "16.7.9",
+        "Build": "20H6348",
+        "PostingDate": "2024-07-29",
+        "ExpirationDate": "2024-11-05",
+        "SupportedDevices": [
+          "iPad6,11",
+          "iPad6,12",
+          "iPad6,3",
+          "iPad6,4",
+          "iPad6,7",
+          "iPad6,8",
+          "iPhone10,1",
+          "iPhone10,2",
+          "iPhone10,3",
+          "iPhone10,4",
+          "iPhone10,5",
+          "iPhone10,6"
+        ]
+      },
+      {
+        "ProductVersion": "5.3.9",
+        "Build": "16U693",
+        "PostingDate": "2024-05-13",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "Watch2,3",
+          "Watch2,4",
+          "Watch2,6",
+          "Watch2,7",
+          "Watch3,1",
+          "Watch3,2",
+          "Watch3,3",
+          "Watch3,4",
+          "Watch4,1",
+          "Watch4,2",
+          "Watch4,3",
+          "Watch4,4"
+        ]
+      },
+      {
+        "ProductVersion": "17.5.1",
+        "Build": "21L580",
+        "PostingDate": "2024-05-21",
+        "ExpirationDate": "2024-10-27",
+        "SupportedDevices": [
+          "AppleTV11,1",
+          "AppleTV14,1",
+          "AppleTV5,3",
+          "AppleTV6,2"
+        ]
+      },
+      {
+        "ProductVersion": "1.3",
+        "Build": "21O771",
+        "PostingDate": "2024-07-29",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": ["RealityDevice14,1"]
+      },
+      {
+        "ProductVersion": "1.3",
+        "Build": "21O6771",
+        "PostingDate": "2024-07-29",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": ["RealityDevice14,1"]
+      },
+      {
+        "ProductVersion": "8.8.1",
+        "Build": "19U6512",
+        "PostingDate": "2024-05-13",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "Watch3,1",
+          "Watch3,2",
+          "Watch3,3",
+          "Watch3,4",
+          "Watch4,1",
+          "Watch4,2",
+          "Watch4,3",
+          "Watch4,4",
+          "Watch5,1",
+          "Watch5,10",
+          "Watch5,11",
+          "Watch5,12",
+          "Watch5,2",
+          "Watch5,3",
+          "Watch5,4",
+          "Watch5,9",
+          "Watch6,1",
+          "Watch6,2",
+          "Watch6,3",
+          "Watch6,4",
+          "Watch6,6",
+          "Watch6,7",
+          "Watch6,8",
+          "Watch6,9"
+        ]
+      },
+      {
+        "ProductVersion": "17.6.1",
+        "Build": "21G93",
+        "PostingDate": "2024-08-07",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "iPad11,1",
+          "iPad11,2",
+          "iPad11,3",
+          "iPad11,4",
+          "iPad11,6",
+          "iPad11,7",
+          "iPad12,1",
+          "iPad12,2",
+          "iPad13,1",
+          "iPad13,10",
+          "iPad13,11",
+          "iPad13,16",
+          "iPad13,17",
+          "iPad13,18",
+          "iPad13,19",
+          "iPad13,2",
+          "iPad13,4",
+          "iPad13,5",
+          "iPad13,6",
+          "iPad13,7",
+          "iPad13,8",
+          "iPad13,9",
+          "iPad14,1",
+          "iPad14,10",
+          "iPad14,11",
+          "iPad14,2",
+          "iPad14,3",
+          "iPad14,4",
+          "iPad14,5",
+          "iPad14,6",
+          "iPad14,8",
+          "iPad14,9",
+          "iPad16,3",
+          "iPad16,4",
+          "iPad16,5",
+          "iPad16,6",
+          "iPad7,1",
+          "iPad7,11",
+          "iPad7,12",
+          "iPad7,2",
+          "iPad7,3",
+          "iPad7,4",
+          "iPad7,5",
+          "iPad7,6",
+          "iPad8,1",
+          "iPad8,10",
+          "iPad8,11",
+          "iPad8,12",
+          "iPad8,2",
+          "iPad8,3",
+          "iPad8,4",
+          "iPad8,5",
+          "iPad8,6",
+          "iPad8,7",
+          "iPad8,8",
+          "iPad8,9",
+          "iPhone11,2",
+          "iPhone11,4",
+          "iPhone11,6",
+          "iPhone11,8",
+          "iPhone12,1",
+          "iPhone12,3",
+          "iPhone12,5",
+          "iPhone12,8",
+          "iPhone13,1",
+          "iPhone13,2",
+          "iPhone13,3",
+          "iPhone13,4",
+          "iPhone14,2",
+          "iPhone14,3",
+          "iPhone14,4",
+          "iPhone14,5",
+          "iPhone14,6",
+          "iPhone14,7",
+          "iPhone14,8",
+          "iPhone15,2",
+          "iPhone15,3",
+          "iPhone15,4",
+          "iPhone15,5",
+          "iPhone16,1",
+          "iPhone16,2"
+        ]
+      },
+      {
+        "ProductVersion": "17.5",
+        "Build": "21F79",
+        "PostingDate": "2024-05-14",
+        "ExpirationDate": "2024-08-18",
+        "SupportedDevices": [
+          "iPad11,1",
+          "iPad11,2",
+          "iPad11,3",
+          "iPad11,4",
+          "iPad11,6",
+          "iPad11,7",
+          "iPad12,1",
+          "iPad12,2",
+          "iPad13,1",
+          "iPad13,10",
+          "iPad13,11",
+          "iPad13,16",
+          "iPad13,17",
+          "iPad13,18",
+          "iPad13,19",
+          "iPad13,2",
+          "iPad13,4",
+          "iPad13,5",
+          "iPad13,6",
+          "iPad13,7",
+          "iPad13,8",
+          "iPad13,9",
+          "iPad14,1",
+          "iPad14,2",
+          "iPad14,3",
+          "iPad14,4",
+          "iPad14,5",
+          "iPad14,6",
+          "iPad7,1",
+          "iPad7,11",
+          "iPad7,12",
+          "iPad7,2",
+          "iPad7,3",
+          "iPad7,4",
+          "iPad7,5",
+          "iPad7,6",
+          "iPad8,1",
+          "iPad8,10",
+          "iPad8,11",
+          "iPad8,12",
+          "iPad8,2",
+          "iPad8,3",
+          "iPad8,4",
+          "iPad8,5",
+          "iPad8,6",
+          "iPad8,7",
+          "iPad8,8",
+          "iPad8,9",
+          "iPhone11,2",
+          "iPhone11,4",
+          "iPhone11,6",
+          "iPhone11,8",
+          "iPhone12,1",
+          "iPhone12,3",
+          "iPhone12,5",
+          "iPhone12,8",
+          "iPhone13,1",
+          "iPhone13,2",
+          "iPhone13,3",
+          "iPhone13,4",
+          "iPhone14,2",
+          "iPhone14,3",
+          "iPhone14,4",
+          "iPhone14,5",
+          "iPhone14,6",
+          "iPhone14,7",
+          "iPhone14,8",
+          "iPhone15,2",
+          "iPhone15,3",
+          "iPhone15,4",
+          "iPhone15,5",
+          "iPhone16,1",
+          "iPhone16,2"
+        ]
+      },
+      {
+        "ProductVersion": "9.6.3",
+        "Build": "20U502",
+        "PostingDate": "2024-05-13",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "Watch4,1",
+          "Watch4,2",
+          "Watch4,3",
+          "Watch4,4",
+          "Watch5,1",
+          "Watch5,10",
+          "Watch5,11",
+          "Watch5,12",
+          "Watch5,2",
+          "Watch5,3",
+          "Watch5,4",
+          "Watch5,9",
+          "Watch6,1",
+          "Watch6,10",
+          "Watch6,11",
+          "Watch6,12",
+          "Watch6,13",
+          "Watch6,14",
+          "Watch6,15",
+          "Watch6,16",
+          "Watch6,17",
+          "Watch6,18",
+          "Watch6,2",
+          "Watch6,3",
+          "Watch6,4",
+          "Watch6,6",
+          "Watch6,7",
+          "Watch6,8",
+          "Watch6,9"
+        ]
+      },
+      {
+        "ProductVersion": "17.5.1",
+        "Build": "21F90",
+        "PostingDate": "2024-05-20",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "iPad11,1",
+          "iPad11,2",
+          "iPad11,3",
+          "iPad11,4",
+          "iPad11,6",
+          "iPad11,7",
+          "iPad12,1",
+          "iPad12,2",
+          "iPad13,1",
+          "iPad13,10",
+          "iPad13,11",
+          "iPad13,16",
+          "iPad13,17",
+          "iPad13,18",
+          "iPad13,19",
+          "iPad13,2",
+          "iPad13,4",
+          "iPad13,5",
+          "iPad13,6",
+          "iPad13,7",
+          "iPad13,8",
+          "iPad13,9",
+          "iPad14,1",
+          "iPad14,10",
+          "iPad14,11",
+          "iPad14,2",
+          "iPad14,3",
+          "iPad14,4",
+          "iPad14,5",
+          "iPad14,6",
+          "iPad14,8",
+          "iPad14,9",
+          "iPad16,3",
+          "iPad16,4",
+          "iPad16,5",
+          "iPad16,6",
+          "iPad7,1",
+          "iPad7,11",
+          "iPad7,12",
+          "iPad7,2",
+          "iPad7,3",
+          "iPad7,4",
+          "iPad7,5",
+          "iPad7,6",
+          "iPad8,1",
+          "iPad8,10",
+          "iPad8,11",
+          "iPad8,12",
+          "iPad8,2",
+          "iPad8,3",
+          "iPad8,4",
+          "iPad8,5",
+          "iPad8,6",
+          "iPad8,7",
+          "iPad8,8",
+          "iPad8,9",
+          "iPhone11,2",
+          "iPhone11,4",
+          "iPhone11,6",
+          "iPhone11,8",
+          "iPhone12,1",
+          "iPhone12,3",
+          "iPhone12,5",
+          "iPhone12,8",
+          "iPhone13,1",
+          "iPhone13,2",
+          "iPhone13,3",
+          "iPhone13,4",
+          "iPhone14,2",
+          "iPhone14,3",
+          "iPhone14,4",
+          "iPhone14,5",
+          "iPhone14,6",
+          "iPhone14,7",
+          "iPhone14,8",
+          "iPhone15,2",
+          "iPhone15,3",
+          "iPhone15,4",
+          "iPhone15,5",
+          "iPhone16,1",
+          "iPhone16,2"
+        ]
+      },
+      {
+        "ProductVersion": "17.6",
+        "Build": "21M6071",
+        "PostingDate": "2024-07-29",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "AppleTV11,1",
+          "AppleTV14,1",
+          "AppleTV5,3",
+          "AppleTV6,2",
+          "AudioAccessory1,1",
+          "AudioAccessory5,1",
+          "AudioAccessory6,1"
+        ]
+      },
+      {
+        "ProductVersion": "16.7.8",
+        "Build": "20H343",
+        "PostingDate": "2024-05-14",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "iPad6,11",
+          "iPad6,12",
+          "iPad6,3",
+          "iPad6,4",
+          "iPad6,7",
+          "iPad6,8",
+          "iPhone10,1",
+          "iPhone10,2",
+          "iPhone10,3",
+          "iPhone10,4",
+          "iPhone10,5",
+          "iPhone10,6"
+        ]
+      },
+      {
+        "ProductVersion": "17.5",
+        "Build": "21L6569",
+        "PostingDate": "2024-05-13",
+        "ExpirationDate": "2024-10-27",
+        "SupportedDevices": [
+          "AudioAccessory1,1",
+          "AudioAccessory5,1",
+          "AudioAccessory6,1"
+        ]
+      },
+      {
+        "ProductVersion": "17.5",
+        "Build": "21L6569",
+        "PostingDate": "2024-05-13",
+        "ExpirationDate": "2024-08-19",
+        "SupportedDevices": [
+          "AppleTV11,1",
+          "AppleTV14,1",
+          "AppleTV5,3",
+          "AppleTV6,2"
+        ]
+      },
+      {
+        "ProductVersion": "17.5",
+        "Build": "21F84",
+        "PostingDate": "2024-05-14",
+        "ExpirationDate": "2024-08-18",
+        "SupportedDevices": [
+          "iPad14,10",
+          "iPad14,11",
+          "iPad14,8",
+          "iPad14,9",
+          "iPad16,3",
+          "iPad16,4",
+          "iPad16,5",
+          "iPad16,6"
+        ]
+      },
+      {
+        "ProductVersion": "16.7.9",
+        "Build": "20H348",
+        "PostingDate": "2024-07-29",
+        "ExpirationDate": "2024-11-05",
+        "SupportedDevices": [
+          "iPad6,11",
+          "iPad6,12",
+          "iPad6,3",
+          "iPad6,4",
+          "iPad6,7",
+          "iPad6,8",
+          "iPhone10,1",
+          "iPhone10,2",
+          "iPhone10,3",
+          "iPhone10,4",
+          "iPhone10,5",
+          "iPhone10,6"
+        ]
+      },
+      {
+        "ProductVersion": "1.2",
+        "Build": "21O6589",
+        "PostingDate": "2024-06-10",
+        "ExpirationDate": "2024-10-27",
+        "SupportedDevices": ["RealityDevice14,1"]
+      },
+      {
+        "ProductVersion": "15.8.2",
+        "Build": "19H6384",
+        "PostingDate": "2024-05-14",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "iPad5,1",
+          "iPad5,2",
+          "iPad5,3",
+          "iPad5,4",
+          "iPhone8,1",
+          "iPhone8,2",
+          "iPhone8,4",
+          "iPhone9,1",
+          "iPhone9,2",
+          "iPhone9,3",
+          "iPhone9,4",
+          "iPod9,1"
+        ]
+      },
+      {
+        "ProductVersion": "15.8.3",
+        "Build": "19H6386",
+        "PostingDate": "2024-07-29",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "iPad5,1",
+          "iPad5,2",
+          "iPad5,3",
+          "iPad5,4",
+          "iPhone8,1",
+          "iPhone8,2",
+          "iPhone8,4",
+          "iPhone9,1",
+          "iPhone9,2",
+          "iPhone9,3",
+          "iPhone9,4",
+          "iPod9,1"
+        ]
+      },
+      {
+        "ProductVersion": "9.6.3",
+        "Build": "20U6502",
+        "PostingDate": "2024-05-13",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "Watch4,1",
+          "Watch4,2",
+          "Watch4,3",
+          "Watch4,4",
+          "Watch5,1",
+          "Watch5,10",
+          "Watch5,11",
+          "Watch5,12",
+          "Watch5,2",
+          "Watch5,3",
+          "Watch5,4",
+          "Watch5,9",
+          "Watch6,1",
+          "Watch6,10",
+          "Watch6,11",
+          "Watch6,12",
+          "Watch6,13",
+          "Watch6,14",
+          "Watch6,15",
+          "Watch6,16",
+          "Watch6,17",
+          "Watch6,18",
+          "Watch6,2",
+          "Watch6,3",
+          "Watch6,4",
+          "Watch6,6",
+          "Watch6,7",
+          "Watch6,8",
+          "Watch6,9"
+        ]
+      }
+    ],
+    "visionOS": [
+      {
+        "ProductVersion": "1.1.2",
+        "Build": "21O231",
+        "PostingDate": "2024-04-12",
+        "ExpirationDate": "2024-09-08",
+        "SupportedDevices": ["RealityDevice14,1"]
+      },
+      {
+        "ProductVersion": "1.1.2",
+        "Build": "21O6231",
+        "PostingDate": "2024-04-12",
+        "ExpirationDate": "2024-09-08",
+        "SupportedDevices": ["RealityDevice14,1"]
+      }
+    ],
+    "xrOS": [
+      {
+        "ProductVersion": "1.0.3",
+        "Build": "21N333",
+        "PostingDate": "2024-02-12",
+        "ExpirationDate": "2024-06-05",
+        "SupportedDevices": ["RealityDevice14,1"]
+      }
+    ],
+    "macOS": [
+      {
+        "ProductVersion": "14.6.1",
+        "Build": "23G93",
+        "PostingDate": "2024-08-07",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "J132AP",
+          "J137AP",
+          "J140AAP",
+          "J140KAP",
+          "J152FAP",
+          "J160AP",
+          "J174AP",
+          "J180dAP",
+          "J185AP",
+          "J185FAP",
+          "J213AP",
+          "J214KAP",
+          "J215AP",
+          "J223AP",
+          "J230KAP",
+          "J274AP",
+          "J293AP",
+          "J313AP",
+          "J314cAP",
+          "J314sAP",
+          "J316cAP",
+          "J316sAP",
+          "J375cAP",
+          "J375dAP",
+          "J413AP",
+          "J414cAP",
+          "J414sAP",
+          "J415AP",
+          "J416cAP",
+          "J416sAP",
+          "J433AP",
+          "J434AP",
+          "J456AP",
+          "J457AP",
+          "J473AP",
+          "J474sAP",
+          "J475cAP",
+          "J475dAP",
+          "J493AP",
+          "J504AP",
+          "J514cAP",
+          "J514mAP",
+          "J514sAP",
+          "J516cAP",
+          "J516mAP",
+          "J516sAP",
+          "J613AP",
+          "J615AP",
+          "J680AP",
+          "J780AP",
+          "Mac-1E7E29AD0135F9BC",
+          "Mac-63001698E7A34814",
+          "Mac-937A206F2EE63C01",
+          "Mac-AA95B1DDAB278B95",
+          "VMA2MACOSAP",
+          "VMM-x86_64"
+        ]
+      },
+      {
+        "ProductVersion": "13.6.9",
+        "Build": "22G830",
+        "PostingDate": "2024-08-07",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "J132AP",
+          "J137AP",
+          "J140AAP",
+          "J140KAP",
+          "J152FAP",
+          "J160AP",
+          "J174AP",
+          "J180dAP",
+          "J185AP",
+          "J185FAP",
+          "J213AP",
+          "J214KAP",
+          "J215AP",
+          "J223AP",
+          "J230KAP",
+          "J274AP",
+          "J293AP",
+          "J313AP",
+          "J314cAP",
+          "J314sAP",
+          "J316cAP",
+          "J316sAP",
+          "J375cAP",
+          "J375dAP",
+          "J413AP",
+          "J414cAP",
+          "J414sAP",
+          "J415AP",
+          "J416cAP",
+          "J416sAP",
+          "J433AP",
+          "J434AP",
+          "J456AP",
+          "J457AP",
+          "J473AP",
+          "J474sAP",
+          "J475cAP",
+          "J475dAP",
+          "J493AP",
+          "J504AP",
+          "J680AP",
+          "J780AP",
+          "Mac-1E7E29AD0135F9BC",
+          "Mac-4B682C642B45593E",
+          "Mac-551B86E5744E2388",
+          "Mac-63001698E7A34814",
+          "Mac-77F17D7DA9285301",
+          "Mac-937A206F2EE63C01",
+          "Mac-AA95B1DDAB278B95",
+          "Mac-B4831CEBD52A0C4C",
+          "Mac-BE088AF8C5EB4FA2",
+          "Mac-CAD6701F7CEA0921",
+          "Mac-EE2EBD4B90B839A8",
+          "VMA2MACOSAP",
+          "VMM-x86_64"
+        ]
+      },
+      {
+        "ProductVersion": "14.5",
+        "Build": "23F79",
+        "PostingDate": "2024-05-13",
+        "ExpirationDate": "2024-10-27",
+        "SupportedDevices": [
+          "J132AP",
+          "J137AP",
+          "J140AAP",
+          "J140KAP",
+          "J152FAP",
+          "J160AP",
+          "J174AP",
+          "J180dAP",
+          "J185AP",
+          "J185FAP",
+          "J213AP",
+          "J214KAP",
+          "J215AP",
+          "J223AP",
+          "J230KAP",
+          "J274AP",
+          "J293AP",
+          "J313AP",
+          "J314cAP",
+          "J314sAP",
+          "J316cAP",
+          "J316sAP",
+          "J375cAP",
+          "J375dAP",
+          "J413AP",
+          "J414cAP",
+          "J414sAP",
+          "J415AP",
+          "J416cAP",
+          "J416sAP",
+          "J433AP",
+          "J434AP",
+          "J456AP",
+          "J457AP",
+          "J473AP",
+          "J474sAP",
+          "J475cAP",
+          "J475dAP",
+          "J493AP",
+          "J504AP",
+          "J514cAP",
+          "J514mAP",
+          "J514sAP",
+          "J516cAP",
+          "J516mAP",
+          "J516sAP",
+          "J613AP",
+          "J615AP",
+          "J680AP",
+          "J780AP",
+          "Mac-1E7E29AD0135F9BC",
+          "Mac-63001698E7A34814",
+          "Mac-937A206F2EE63C01",
+          "Mac-AA95B1DDAB278B95",
+          "VMA2MACOSAP",
+          "VMM-x86_64"
+        ]
+      },
+      {
+        "ProductVersion": "12.7.5",
+        "Build": "21H1222",
+        "PostingDate": "2024-05-13",
+        "ExpirationDate": "2024-10-27",
+        "SupportedDevices": [
+          "J132AP",
+          "J137AP",
+          "J140AAP",
+          "J140KAP",
+          "J152FAP",
+          "J160AP",
+          "J174AP",
+          "J185AP",
+          "J185FAP",
+          "J213AP",
+          "J214KAP",
+          "J215AP",
+          "J223AP",
+          "J230KAP",
+          "J274AP",
+          "J293AP",
+          "J313AP",
+          "J314cAP",
+          "J314sAP",
+          "J316cAP",
+          "J316sAP",
+          "J375cAP",
+          "J375dAP",
+          "J413AP",
+          "J456AP",
+          "J457AP",
+          "J493AP",
+          "J680AP",
+          "J780AP",
+          "Mac-06F11F11946D27C5",
+          "Mac-06F11FD93F0323C5",
+          "Mac-1E7E29AD0135F9BC",
+          "Mac-35C5E08120C7EEAF",
+          "Mac-473D31EABEB93F9B",
+          "Mac-4B682C642B45593E",
+          "Mac-551B86E5744E2388",
+          "Mac-63001698E7A34814",
+          "Mac-65CE76090165799A",
+          "Mac-66E35819EE2D0D05",
+          "Mac-77F17D7DA9285301",
+          "Mac-937A206F2EE63C01",
+          "Mac-937CB26E2E02BB01",
+          "Mac-9AE82516C7C6B903",
+          "Mac-9F18E312C5C2BF0B",
+          "Mac-A369DDC4E67F1C45",
+          "Mac-A5C67F76ED83108C",
+          "Mac-AA95B1DDAB278B95",
+          "Mac-B4831CEBD52A0C4C",
+          "Mac-B809C3757DA9BB8D",
+          "Mac-BE088AF8C5EB4FA2",
+          "Mac-CAD6701F7CEA0921",
+          "Mac-DB15BD556843C820",
+          "Mac-E43C1C25D4880AD6",
+          "Mac-EE2EBD4B90B839A8",
+          "Mac-F60DEB81FF30ACF6",
+          "Mac-FFE5EF870D7BA81A",
+          "VMA2MACOSAP",
+          "VMM-x86_64"
+        ]
+      },
+      {
+        "ProductVersion": "11.7.10",
+        "Build": "20G1427",
+        "PostingDate": "2024-05-13",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "J132AP",
+          "J137AP",
+          "J140AAP",
+          "J140KAP",
+          "J152FAP",
+          "J160AP",
+          "J174AP",
+          "J185AP",
+          "J185FAP",
+          "J213AP",
+          "J214AP",
+          "J214KAP",
+          "J215AP",
+          "J223AP",
+          "J230AP",
+          "J230KAP",
+          "J274AP",
+          "J293AP",
+          "J313AP",
+          "J456AP",
+          "J457AP",
+          "J680AP",
+          "J780AP",
+          "Mac-06F11F11946D27C5",
+          "Mac-06F11FD93F0323C5",
+          "Mac-0CFF9C7C2B63DF8D",
+          "Mac-112818653D3AABFC",
+          "Mac-112B0A653D3AAB9C",
+          "Mac-189A3D4F975D5FFC",
+          "Mac-1E7E29AD0135F9BC",
+          "Mac-226CB3C6A851A671",
+          "Mac-27AD2F918AE68F61",
+          "Mac-2BD1B31983FE1663",
+          "Mac-35C1E88140C3E6CF",
+          "Mac-35C5E08120C7EEAF",
+          "Mac-36B6B6DA9CFCD881",
+          "Mac-3CBD00234E554E41",
+          "Mac-42FD25EABCABB274",
+          "Mac-473D31EABEB93F9B",
+          "Mac-4B682C642B45593E",
+          "Mac-50619A408DB004DA",
+          "Mac-53FDB3D8DB8CA971",
+          "Mac-551B86E5744E2388",
+          "Mac-5A49A77366F81C72",
+          "Mac-5F9802EFE386AA28",
+          "Mac-63001698E7A34814",
+          "Mac-65CE76090165799A",
+          "Mac-66E35819EE2D0D05",
+          "Mac-747B1AEFF11738BE",
+          "Mac-77F17D7DA9285301",
+          "Mac-7BA5B2D9E42DDD94",
+          "Mac-7BA5B2DFE22DDD8C",
+          "Mac-7DF21CB3ED6977E5",
+          "Mac-81E3E92DD6088272",
+          "Mac-827FAC58A8FDFA22",
+          "Mac-827FB448E656EC26",
+          "Mac-90BE64C3CB5A9AEB",
+          "Mac-937A206F2EE63C01",
+          "Mac-937CB26E2E02BB01",
+          "Mac-9394BDF4BF862EE7",
+          "Mac-9AE82516C7C6B903",
+          "Mac-9F18E312C5C2BF0B",
+          "Mac-A369DDC4E67F1C45",
+          "Mac-A5C67F76ED83108C",
+          "Mac-A61BADE1FDAD7B05",
+          "Mac-AA95B1DDAB278B95",
+          "Mac-AF89B6D9451A490B",
+          "Mac-B4831CEBD52A0C4C",
+          "Mac-B809C3757DA9BB8D",
+          "Mac-BE088AF8C5EB4FA2",
+          "Mac-BE0E8AC46FE800CC",
+          "Mac-C6F71043CEAA02A6",
+          "Mac-CAD6701F7CEA0921",
+          "Mac-CF21D135A7D34AA6",
+          "Mac-CFF7D910A743CAAF",
+          "Mac-DB15BD556843C820",
+          "Mac-E1008331FDC96864",
+          "Mac-E43C1C25D4880AD6",
+          "Mac-E7203C0F68AA0004",
+          "Mac-EE2EBD4B90B839A8",
+          "Mac-F305150B0C7DEEEF",
+          "Mac-F60DEB81FF30ACF6",
+          "Mac-FA842E06C61E91C5",
+          "Mac-FFE5EF870D7BA81A",
+          "VMM-x86_64",
+          "X589AMLUAP",
+          "X589ICLYAP",
+          "X86LEGACYAP"
+        ]
+      },
+      {
+        "ProductVersion": "13.6.8",
+        "Build": "22G820",
+        "PostingDate": "2024-07-29",
+        "ExpirationDate": "2024-11-05",
+        "SupportedDevices": [
+          "J132AP",
+          "J137AP",
+          "J140AAP",
+          "J140KAP",
+          "J152FAP",
+          "J160AP",
+          "J174AP",
+          "J180dAP",
+          "J185AP",
+          "J185FAP",
+          "J213AP",
+          "J214KAP",
+          "J215AP",
+          "J223AP",
+          "J230KAP",
+          "J274AP",
+          "J293AP",
+          "J313AP",
+          "J314cAP",
+          "J314sAP",
+          "J316cAP",
+          "J316sAP",
+          "J375cAP",
+          "J375dAP",
+          "J413AP",
+          "J414cAP",
+          "J414sAP",
+          "J415AP",
+          "J416cAP",
+          "J416sAP",
+          "J433AP",
+          "J434AP",
+          "J456AP",
+          "J457AP",
+          "J473AP",
+          "J474sAP",
+          "J475cAP",
+          "J475dAP",
+          "J493AP",
+          "J504AP",
+          "J680AP",
+          "J780AP",
+          "Mac-1E7E29AD0135F9BC",
+          "Mac-4B682C642B45593E",
+          "Mac-551B86E5744E2388",
+          "Mac-63001698E7A34814",
+          "Mac-77F17D7DA9285301",
+          "Mac-937A206F2EE63C01",
+          "Mac-AA95B1DDAB278B95",
+          "Mac-B4831CEBD52A0C4C",
+          "Mac-BE088AF8C5EB4FA2",
+          "Mac-CAD6701F7CEA0921",
+          "Mac-EE2EBD4B90B839A8",
+          "VMA2MACOSAP",
+          "VMM-x86_64"
+        ]
+      },
+      {
+        "ProductVersion": "14.6",
+        "Build": "23G80",
+        "PostingDate": "2024-07-29",
+        "ExpirationDate": "2024-11-05",
+        "SupportedDevices": [
+          "J132AP",
+          "J137AP",
+          "J140AAP",
+          "J140KAP",
+          "J152FAP",
+          "J160AP",
+          "J174AP",
+          "J180dAP",
+          "J185AP",
+          "J185FAP",
+          "J213AP",
+          "J214KAP",
+          "J215AP",
+          "J223AP",
+          "J230KAP",
+          "J274AP",
+          "J293AP",
+          "J313AP",
+          "J314cAP",
+          "J314sAP",
+          "J316cAP",
+          "J316sAP",
+          "J375cAP",
+          "J375dAP",
+          "J413AP",
+          "J414cAP",
+          "J414sAP",
+          "J415AP",
+          "J416cAP",
+          "J416sAP",
+          "J433AP",
+          "J434AP",
+          "J456AP",
+          "J457AP",
+          "J473AP",
+          "J474sAP",
+          "J475cAP",
+          "J475dAP",
+          "J493AP",
+          "J504AP",
+          "J514cAP",
+          "J514mAP",
+          "J514sAP",
+          "J516cAP",
+          "J516mAP",
+          "J516sAP",
+          "J613AP",
+          "J615AP",
+          "J680AP",
+          "J780AP",
+          "Mac-1E7E29AD0135F9BC",
+          "Mac-63001698E7A34814",
+          "Mac-937A206F2EE63C01",
+          "Mac-AA95B1DDAB278B95",
+          "VMA2MACOSAP",
+          "VMM-x86_64"
+        ]
+      },
+      {
+        "ProductVersion": "12.7.6",
+        "Build": "21H1320",
+        "PostingDate": "2024-07-29",
+        "ExpirationDate": "2024-11-11",
+        "SupportedDevices": [
+          "J132AP",
+          "J137AP",
+          "J140AAP",
+          "J140KAP",
+          "J152FAP",
+          "J160AP",
+          "J174AP",
+          "J185AP",
+          "J185FAP",
+          "J213AP",
+          "J214KAP",
+          "J215AP",
+          "J223AP",
+          "J230KAP",
+          "J274AP",
+          "J293AP",
+          "J313AP",
+          "J314cAP",
+          "J314sAP",
+          "J316cAP",
+          "J316sAP",
+          "J375cAP",
+          "J375dAP",
+          "J413AP",
+          "J456AP",
+          "J457AP",
+          "J493AP",
+          "J680AP",
+          "J780AP",
+          "Mac-06F11F11946D27C5",
+          "Mac-06F11FD93F0323C5",
+          "Mac-1E7E29AD0135F9BC",
+          "Mac-35C5E08120C7EEAF",
+          "Mac-473D31EABEB93F9B",
+          "Mac-4B682C642B45593E",
+          "Mac-551B86E5744E2388",
+          "Mac-63001698E7A34814",
+          "Mac-65CE76090165799A",
+          "Mac-66E35819EE2D0D05",
+          "Mac-77F17D7DA9285301",
+          "Mac-937A206F2EE63C01",
+          "Mac-937CB26E2E02BB01",
+          "Mac-9AE82516C7C6B903",
+          "Mac-9F18E312C5C2BF0B",
+          "Mac-A369DDC4E67F1C45",
+          "Mac-A5C67F76ED83108C",
+          "Mac-AA95B1DDAB278B95",
+          "Mac-B4831CEBD52A0C4C",
+          "Mac-B809C3757DA9BB8D",
+          "Mac-BE088AF8C5EB4FA2",
+          "Mac-CAD6701F7CEA0921",
+          "Mac-DB15BD556843C820",
+          "Mac-E43C1C25D4880AD6",
+          "Mac-EE2EBD4B90B839A8",
+          "Mac-F60DEB81FF30ACF6",
+          "Mac-FFE5EF870D7BA81A",
+          "VMA2MACOSAP",
+          "VMM-x86_64"
+        ]
+      },
+      {
+        "ProductVersion": "13.6.7",
+        "Build": "22G720",
+        "PostingDate": "2024-05-13",
+        "ExpirationDate": "2024-10-27",
+        "SupportedDevices": [
+          "J132AP",
+          "J137AP",
+          "J140AAP",
+          "J140KAP",
+          "J152FAP",
+          "J160AP",
+          "J174AP",
+          "J180dAP",
+          "J185AP",
+          "J185FAP",
+          "J213AP",
+          "J214KAP",
+          "J215AP",
+          "J223AP",
+          "J230KAP",
+          "J274AP",
+          "J293AP",
+          "J313AP",
+          "J314cAP",
+          "J314sAP",
+          "J316cAP",
+          "J316sAP",
+          "J375cAP",
+          "J375dAP",
+          "J413AP",
+          "J414cAP",
+          "J414sAP",
+          "J415AP",
+          "J416cAP",
+          "J416sAP",
+          "J433AP",
+          "J434AP",
+          "J456AP",
+          "J457AP",
+          "J473AP",
+          "J474sAP",
+          "J475cAP",
+          "J475dAP",
+          "J493AP",
+          "J504AP",
+          "J680AP",
+          "J780AP",
+          "Mac-1E7E29AD0135F9BC",
+          "Mac-4B682C642B45593E",
+          "Mac-551B86E5744E2388",
+          "Mac-63001698E7A34814",
+          "Mac-77F17D7DA9285301",
+          "Mac-937A206F2EE63C01",
+          "Mac-AA95B1DDAB278B95",
+          "Mac-B4831CEBD52A0C4C",
+          "Mac-BE088AF8C5EB4FA2",
+          "Mac-CAD6701F7CEA0921",
+          "Mac-EE2EBD4B90B839A8",
+          "VMA2MACOSAP",
+          "VMM-x86_64"
+        ]
+      }
+    ]
+  },
+  "PublicRapidSecurityResponses": {}
+}
diff --git a/server/mdm/apple/mobileconfig/mobileconfig.go b/server/mdm/apple/mobileconfig/mobileconfig.go
index 31edd44399..690b15c796 100644
--- a/server/mdm/apple/mobileconfig/mobileconfig.go
+++ b/server/mdm/apple/mobileconfig/mobileconfig.go
@@ -2,6 +2,7 @@ package mobileconfig
 
 import (
 	"bytes"
+	"encoding/xml"
 	"errors"
 	"fmt"
 	"strings"
@@ -264,3 +265,17 @@ var (
 	ErrEmptyPayloadContent     = errors.New("empty PayloadContent")
 	ErrEncryptedPayloadContent = errors.New("encrypted PayloadContent")
 )
+
+// XMLEscapeString returns the escaped XML equivalent of the plain text data s.
+func XMLEscapeString(s string) (string, error) {
+	// avoid allocation if we can.
+	if !strings.ContainsAny(s, "'\"&<>\t\n\r") {
+		return s, nil
+	}
+	var b strings.Builder
+	if err := xml.EscapeText(&b, []byte(s)); err != nil {
+		return "", err
+	}
+
+	return b.String(), nil
+}
diff --git a/server/mdm/apple/mobileconfig/mobileconfig_test.go b/server/mdm/apple/mobileconfig/mobileconfig_test.go
new file mode 100644
index 0000000000..793503a438
--- /dev/null
+++ b/server/mdm/apple/mobileconfig/mobileconfig_test.go
@@ -0,0 +1,36 @@
+package mobileconfig
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestXMLEscapeString(t *testing.T) {
+	tests := []struct {
+		input    string
+		expected string
+	}{
+		// characters that should be escaped
+		{"hello & world", "hello &amp; world"},
+		{"this is a <test>", "this is a &lt;test&gt;"},
+		{"\"quotes\" and 'single quotes'", "&#34;quotes&#34; and &#39;single quotes&#39;"},
+		{"special chars: \t\n\r", "special chars: &#x9;&#xA;&#xD;"},
+		// no special characters
+		{"plain string", "plain string"},
+		// string that already contains escaped characters
+		{"already &lt;escaped&gt;", "already &amp;lt;escaped&amp;gt;"},
+		// empty string
+		{"", ""},
+		// multiple special characters
+		{"A&B<C>D\"'E\tF\nG\r", "A&amp;B&lt;C&gt;D&#34;&#39;E&#x9;F&#xA;G&#xD;"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.input, func(t *testing.T) {
+			out, err := XMLEscapeString(tt.input)
+			require.NoError(t, err)
+			require.Equal(t, tt.expected, out)
+		})
+	}
+}
diff --git a/server/mdm/apple/mobileconfig/profiles.go b/server/mdm/apple/mobileconfig/profiles.go
index 24bf6479ba..247c653617 100644
--- a/server/mdm/apple/mobileconfig/profiles.go
+++ b/server/mdm/apple/mobileconfig/profiles.go
@@ -1,6 +1,12 @@
 package mobileconfig
 
-import "text/template"
+import (
+	"text/template"
+)
+
+var funcMap = map[string]any{
+	"xml": XMLEscapeString,
+}
 
 // FleetdProfileOptions are the keys required to execute a
 // FleetdProfileTemplate.
@@ -20,7 +26,7 @@ type FleetdProfileOptions struct {
 //
 // Internally, this is used by Fleet MDM to configure the installer delivered
 // to hosts during DEP enrollment.
-var FleetdProfileTemplate = template.Must(template.New("").Option("missingkey=error").Parse(`<?xml version="1.0" encoding="UTF-8"?>
+var FleetdProfileTemplate = template.Must(template.New("").Funcs(funcMap).Option("missingkey=error").Parse(`<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
   <dict>
@@ -28,7 +34,7 @@ var FleetdProfileTemplate = template.Must(template.New("").Option("missingkey=er
     <array>
       <dict>
         <key>EnrollSecret</key>
-        <string>{{ .EnrollSecret }}</string>
+        <string>{{ .EnrollSecret | xml }}</string>
         <key>FleetURL</key>
         <string>{{ .ServerURL }}</string>
         <key>EnableScripts</key>
@@ -109,3 +115,34 @@ var FleetCARootTemplate = template.Must(template.New("").Option("missingkey=erro
   </dict>
 </plist>
 `))
+
+var OTAMobileConfigTemplate = template.Must(template.New("").Funcs(funcMap).Option("missingkey=error").Parse(`<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple Inc//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+  <dict>
+    <key>PayloadContent</key>
+    <dict>
+      <key>URL</key>
+      <string>{{ .URL }}</string>
+      <key>DeviceAttributes</key>
+      <array>
+        <string>UDID</string>
+        <string>VERSION</string>
+        <string>PRODUCT</string>
+	<string>SERIAL</string>
+      </array>
+    </dict>
+    <key>PayloadOrganization</key>
+    <string>{{ xml .Organization }}</string>
+    <key>PayloadDisplayName</key>
+    <string>{{ xml .Organization }} enrollment</string>
+    <key>PayloadVersion</key>
+    <integer>1</integer>
+    <key>PayloadUUID</key>
+    <string>fdb376e5-b5bb-4d8c-829e-e90865f990c9</string>
+    <key>PayloadIdentifier</key>
+    <string>com.fleetdm.fleet.mdm.apple.ota</string>
+    <key>PayloadType</key>
+    <string>Profile Service</string>
+  </dict>
+</plist>`))
diff --git a/server/mdm/apple/util.go b/server/mdm/apple/util.go
index 40b669da93..c98dcc48d8 100644
--- a/server/mdm/apple/util.go
+++ b/server/mdm/apple/util.go
@@ -14,6 +14,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/Masterminds/semver"
 	"github.com/fleetdm/fleet/v4/server/fleet"
 	"github.com/fleetdm/fleet/v4/server/mdm/nanomdm/mdm"
 )
@@ -108,3 +109,37 @@ func EnrollURL(token string, appConfig *fleet.AppConfig) (string, error) {
 	enrollURL.RawQuery = q.Encode()
 	return enrollURL.String(), nil
 }
+
+// IsLessThanVersion returns true if the current version is less than the target version.
+// If either version is invalid, an error is returned.
+func IsLessThanVersion(current string, target string) (bool, error) {
+	cv, err := semver.NewVersion(current)
+	if err != nil {
+		return false, fmt.Errorf("invalid current version: %w", err)
+	}
+	tv, err := semver.NewVersion(target)
+	if err != nil {
+		return false, fmt.Errorf("invalid target version: %w", err)
+	}
+
+	return cv.LessThan(tv), nil
+}
+
+// CompareVersions returns an integer comparing two versions according to semantic version
+// precedence. The result will be 0 if a == b, -1 if a < b, or +1 if a > b.
+// An invalid semantic version string is considered less than a valid one. All invalid semantic
+// version strings compare equal to each other.
+func CompareVersions(a string, b string) int {
+	verA, errA := semver.NewVersion(a)
+	verB, errB := semver.NewVersion(b)
+	switch {
+	case errA != nil && errB != nil:
+		return 0
+	case errA != nil:
+		return -1
+	case errB != nil:
+		return 1
+	default:
+		return verA.Compare(verB)
+	}
+}
diff --git a/server/mdm/assets/assets.go b/server/mdm/assets/assets.go
index f1ca889ab8..af303b65ce 100644
--- a/server/mdm/assets/assets.go
+++ b/server/mdm/assets/assets.go
@@ -72,16 +72,20 @@ func APNSTopic(ctx context.Context, ds fleet.MDMAssetRetriever) (string, error)
 	return mdmPushCertTopic, nil
 }
 
-func ABMToken(ctx context.Context, ds fleet.MDMAssetRetriever) (*nanodep_client.OAuth1Tokens, error) {
+func ABMToken(ctx context.Context, ds fleet.MDMAssetRetriever, abmOrgName string) (*nanodep_client.OAuth1Tokens, error) {
 	assets, err := ds.GetAllMDMConfigAssetsByName(ctx, []fleet.MDMAssetName{
 		fleet.MDMAssetABMKey,
 		fleet.MDMAssetABMCert,
-		fleet.MDMAssetABMToken,
 	})
 	if err != nil {
 		return nil, fmt.Errorf("loading ABM assets from the database: %w", err)
 	}
 
+	abmTok, err := ds.GetABMTokenByOrgName(ctx, abmOrgName)
+	if err != nil {
+		return nil, fmt.Errorf("get ABM token by name: %w", err)
+	}
+
 	cert, err := tls.X509KeyPair(assets[fleet.MDMAssetABMCert].Value, assets[fleet.MDMAssetABMKey].Value)
 	if err != nil {
 		return nil, fmt.Errorf("parsing ABM keypair: %w", err)
@@ -92,11 +96,16 @@ func ABMToken(ctx context.Context, ds fleet.MDMAssetRetriever) (*nanodep_client.
 		return nil, fmt.Errorf("parsing ABM certificate: %w", err)
 	}
 
-	return DecryptRawABMToken(
-		assets[fleet.MDMAssetABMToken].Value,
+	oAuthTok, err := DecryptRawABMToken(
+		abmTok.EncryptedToken,
 		leaf,
 		assets[fleet.MDMAssetABMKey].Value,
 	)
+	if err != nil {
+		return nil, fmt.Errorf("decrypting ABM token: %w", err)
+	}
+
+	return oAuthTok, nil
 }
 
 func DecryptRawABMToken(tokenBytes []byte, cert *x509.Certificate, keyPEM []byte) (*nanodep_client.OAuth1Tokens, error) {
diff --git a/server/mdm/assets/assets_test.go b/server/mdm/assets/assets_test.go
index 42aaa9f006..b6484fd4b0 100644
--- a/server/mdm/assets/assets_test.go
+++ b/server/mdm/assets/assets_test.go
@@ -18,8 +18,8 @@ import (
 	"github.com/fleetdm/fleet/v4/server/fleet"
 	nanodep_client "github.com/fleetdm/fleet/v4/server/mdm/nanodep/client"
 	"github.com/fleetdm/fleet/v4/server/mock"
+	"github.com/smallstep/pkcs7"
 	"github.com/stretchr/testify/require"
-	"go.mozilla.org/pkcs7"
 )
 
 // generateTestCert generates a test certificate and key.
@@ -185,22 +185,31 @@ func TestABMToken(t *testing.T) {
 			"\r\n%s", base64.StdEncoding.EncodeToString(encryptedToken))
 
 	assets := map[fleet.MDMAssetName]fleet.MDMConfigAsset{
-		fleet.MDMAssetABMCert:  {Value: certPEM},
-		fleet.MDMAssetABMKey:   {Value: keyPEM},
-		fleet.MDMAssetABMToken: {Value: []byte(tokenBytes)},
+		fleet.MDMAssetABMCert: {Value: certPEM},
+		fleet.MDMAssetABMKey:  {Value: keyPEM},
 	}
 	ds.GetAllMDMConfigAssetsByNameFunc = func(ctx context.Context, assetNames []fleet.MDMAssetName) (map[fleet.MDMAssetName]fleet.MDMConfigAsset, error) {
 		require.ElementsMatch(t, []fleet.MDMAssetName{
 			fleet.MDMAssetABMCert,
 			fleet.MDMAssetABMKey,
-			fleet.MDMAssetABMToken,
 		}, assetNames)
 		return assets, nil
 	}
+	const testOrgName = "test-org"
 
-	tokens, err := ABMToken(ctx, ds)
+	ds.GetABMTokenByOrgNameFunc = func(ctx context.Context, orgName string) (*fleet.ABMToken, error) {
+		require.Equal(t, testOrgName, orgName)
+		return &fleet.ABMToken{
+			ID:               1,
+			OrganizationName: testOrgName,
+			EncryptedToken:   []byte(tokenBytes),
+		}, nil
+	}
+
+	tokens, err := ABMToken(ctx, ds, testOrgName)
 	require.NoError(t, err)
 	require.NotNil(t, tokens)
 	require.Equal(t, "test_access_secret", tokens.AccessSecret)
 	require.True(t, ds.GetAllMDMConfigAssetsByNameFuncInvoked)
+	require.True(t, ds.GetABMTokenByOrgNameFuncInvoked)
 }
diff --git a/server/mdm/crypto/scep.go b/server/mdm/crypto/scep.go
index 1367030bf4..2ba39d37d6 100644
--- a/server/mdm/crypto/scep.go
+++ b/server/mdm/crypto/scep.go
@@ -7,6 +7,7 @@ import (
 	"fmt"
 
 	"github.com/fleetdm/fleet/v4/server/fleet"
+	"github.com/fleetdm/fleet/v4/server/mdm/assets"
 	"github.com/fleetdm/fleet/v4/server/mdm/nanomdm/http/mdm"
 )
 
@@ -33,15 +34,21 @@ func (s *SCEPVerifier) Verify(cert *x509.Certificate) error {
 	}
 
 	// TODO(roberto): nano interfaces don't allow to pass a context to this function
-	assets, err := s.ds.GetAllMDMConfigAssetsByName(context.Background(), []fleet.MDMAssetName{
-		fleet.MDMAssetCACert,
-	})
+	rootCert, err := assets.X509Cert(context.Background(), s.ds, fleet.MDMAssetCACert)
 	if err != nil {
 		return fmt.Errorf("loading existing assets from the database: %w", err)
 	}
+	opts.Roots.AddCert(rootCert)
 
-	if ok := opts.Roots.AppendCertsFromPEM(assets[fleet.MDMAssetCACert].Value); !ok {
-		return errors.New("unable to append cerver SCEP cert to pool verifier")
+	// the default SCEP cert issued by fleet doesn't have any extra key
+	// usages, however, customers might configure the server with any
+	// certificate they want (generally for touchless MDM migrations)
+	//
+	// given that go verifies ext key usages on the whole chain, we relax
+	// the constraints when the provided certificate has any ext key usage
+	// that would cause a failure.
+	if hasOtherKeyUsages(rootCert, x509.ExtKeyUsageClientAuth) {
+		opts.KeyUsages = []x509.ExtKeyUsage{x509.ExtKeyUsageAny}
 	}
 
 	if _, err := cert.Verify(opts); err != nil {
@@ -50,3 +57,12 @@ func (s *SCEPVerifier) Verify(cert *x509.Certificate) error {
 
 	return nil
 }
+
+func hasOtherKeyUsages(cert *x509.Certificate, usage x509.ExtKeyUsage) bool {
+	for _, u := range cert.ExtKeyUsage {
+		if u != usage {
+			return true
+		}
+	}
+	return false
+}
diff --git a/server/mdm/crypto/scep_test.go b/server/mdm/crypto/scep_test.go
index a8865b58f9..179864b9d3 100644
--- a/server/mdm/crypto/scep_test.go
+++ b/server/mdm/crypto/scep_test.go
@@ -1,8 +1,20 @@
 package mdmcrypto
 
 import (
+	"context"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/pem"
+	"errors"
+	"math/big"
 	"testing"
+	"time"
 
+	"github.com/fleetdm/fleet/v4/server/fleet"
+	"github.com/fleetdm/fleet/v4/server/mock"
 	"github.com/stretchr/testify/require"
 )
 
@@ -11,3 +23,130 @@ func TestSCEPVerifierVerifyEmptyCerts(t *testing.T) {
 	err := v.Verify(nil)
 	require.ErrorContains(t, err, "no certificate provided")
 }
+
+func TestVerify(t *testing.T) {
+	ds := new(mock.Store)
+	verifier := NewSCEPVerifier(ds)
+
+	// generate a valid root certificate with ExtKeyUsageClientAuth
+	validRootCertBytes, validRootCert, rootKey := generateRootCertificate(t, []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth})
+	_, validClientCert := generateClientCertificate(t, validRootCert, rootKey)
+
+	// generate a root certificate with an unrelated ExtKeyUsage
+	rootWithOtherUsagesBytes, rootWithOtherUsageCert, rootWithOtherUsageKey := generateRootCertificate(t, []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth})
+	_, validClientCertFromMultipleUsageRoot := generateClientCertificate(t, rootWithOtherUsageCert, rootWithOtherUsageKey)
+
+	cases := []struct {
+		name         string
+		rootCert     []byte
+		certToVerify *x509.Certificate
+		wantErr      string
+	}{
+		{
+			name:         "no certificate provided",
+			rootCert:     nil,
+			certToVerify: nil,
+			wantErr:      "no certificate provided",
+		},
+		{
+			name:         "error loading root cert from database",
+			rootCert:     nil,
+			certToVerify: validClientCert,
+			wantErr:      "loading existing assets from the database",
+		},
+		{
+			name:         "valid certificate verification succeeds",
+			rootCert:     validRootCertBytes,
+			certToVerify: validClientCert,
+			wantErr:      "",
+		},
+		{
+			name:         "valid certificate with unrelated key usage in root cert",
+			rootCert:     rootWithOtherUsagesBytes,
+			certToVerify: validClientCertFromMultipleUsageRoot,
+			wantErr:      "",
+		},
+		{
+			name:         "mismatched certificate presented",
+			rootCert:     rootWithOtherUsagesBytes,
+			certToVerify: validClientCert,
+			wantErr:      "certificate signed by unknown authority",
+		},
+	}
+
+	for _, tt := range cases {
+		t.Run(tt.name, func(t *testing.T) {
+			ds.GetAllMDMConfigAssetsByNameFunc = func(ctx context.Context, assetNames []fleet.MDMAssetName) (map[fleet.MDMAssetName]fleet.MDMConfigAsset, error) {
+				if tt.rootCert == nil {
+					return nil, errors.New("test error")
+				}
+
+				return map[fleet.MDMAssetName]fleet.MDMConfigAsset{
+					fleet.MDMAssetCACert: {Value: tt.rootCert},
+				}, nil
+			}
+
+			err := verifier.Verify(tt.certToVerify)
+			if tt.wantErr == "" {
+				require.NoError(t, err)
+			} else {
+				require.ErrorContains(t, err, tt.wantErr)
+			}
+		})
+	}
+}
+
+func generateRootCertificate(t *testing.T, extKeyUsages []x509.ExtKeyUsage) ([]byte, *x509.Certificate, *ecdsa.PrivateKey) {
+	priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	require.NoError(t, err)
+
+	rootCertTemplate := &x509.Certificate{
+		SerialNumber: big.NewInt(1),
+		Subject: pkix.Name{
+			Organization: []string{"Test Root CA"},
+		},
+		NotBefore:             time.Now(),
+		NotAfter:              time.Now().Add(10 * 365 * 24 * time.Hour),
+		IsCA:                  true,
+		KeyUsage:              x509.KeyUsageCertSign | x509.KeyUsageDigitalSignature,
+		ExtKeyUsage:           extKeyUsages,
+		BasicConstraintsValid: true,
+	}
+
+	rootCertDER, err := x509.CreateCertificate(rand.Reader, rootCertTemplate, rootCertTemplate, &priv.PublicKey, priv)
+	require.NoError(t, err)
+
+	rootCertPEM := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: rootCertDER})
+
+	rootCert, err := x509.ParseCertificate(rootCertDER)
+	require.NoError(t, err)
+
+	return rootCertPEM, rootCert, priv
+}
+
+func generateClientCertificate(t *testing.T, rootCert *x509.Certificate, rootKey *ecdsa.PrivateKey) ([]byte, *x509.Certificate) {
+	clientPriv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	require.NoError(t, err)
+
+	clientCertTemplate := &x509.Certificate{
+		SerialNumber: big.NewInt(2),
+		Subject: pkix.Name{
+			Organization: []string{"Test Client"},
+		},
+		NotBefore:             time.Now(),
+		NotAfter:              time.Now().Add(1 * 365 * 24 * time.Hour),
+		KeyUsage:              x509.KeyUsageDigitalSignature,
+		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
+		BasicConstraintsValid: true,
+	}
+
+	clientCertDER, err := x509.CreateCertificate(rand.Reader, clientCertTemplate, rootCert, &clientPriv.PublicKey, rootKey)
+	require.NoError(t, err)
+
+	clientCertPEM := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: clientCertDER})
+
+	clientCert, err := x509.ParseCertificate(clientCertDER)
+	require.NoError(t, err)
+
+	return clientCertPEM, clientCert
+}
diff --git a/server/mdm/lifecycle/lifecycle.go b/server/mdm/lifecycle/lifecycle.go
index 5587e71f4b..33658a2367 100644
--- a/server/mdm/lifecycle/lifecycle.go
+++ b/server/mdm/lifecycle/lifecycle.go
@@ -224,7 +224,7 @@ func (t *HostLifecycle) deleteDarwin(ctx context.Context, opts HostOptions) erro
 	}
 
 	if dep != nil && dep.DeletedAt == nil {
-		return t.restorePendingDEPHost(ctx, opts.Host, ac)
+		return t.restorePendingDEPHost(ctx, opts.Host, dep.ABMTokenID)
 	}
 
 	// no DEP assignment was found or the DEP assignment was deleted in ABM
@@ -232,8 +232,12 @@ func (t *HostLifecycle) deleteDarwin(ctx context.Context, opts HostOptions) erro
 	return nil
 }
 
-func (t *HostLifecycle) restorePendingDEPHost(ctx context.Context, host *fleet.Host, appCfg *fleet.AppConfig) error {
-	tmID, err := t.getConfigAppleBMDefaultTeamID(ctx, appCfg)
+func (t *HostLifecycle) restorePendingDEPHost(ctx context.Context, host *fleet.Host, abmTokenID *uint) error {
+	if abmTokenID == nil {
+		return ctxerr.New(ctx, "cannot restore pending dep host without valid ABM token id")
+	}
+
+	tmID, err := t.getDefaultTeamForABMToken(ctx, host, *abmTokenID)
 	if err != nil {
 		return ctxerr.Wrap(ctx, err, "restore pending dep host")
 	}
@@ -251,25 +255,43 @@ func (t *HostLifecycle) restorePendingDEPHost(ctx context.Context, host *fleet.H
 	return nil
 }
 
-func (t *HostLifecycle) getConfigAppleBMDefaultTeamID(ctx context.Context, appCfg *fleet.AppConfig) (*uint, error) {
-	var tmID *uint
-	if name := appCfg.MDM.AppleBMDefaultTeam; name != "" {
-		team, err := t.ds.TeamByName(ctx, name)
-		switch {
-		case fleet.IsNotFound(err):
-			level.Debug(t.logger).Log(
-				"msg",
-				"unable to find default team assigned in config, mdm devices won't be assigned to a team",
-				"team_name",
-				name,
-			)
-			return nil, nil
-		case err != nil:
-			return nil, ctxerr.Wrap(ctx, err, "get default team for mdm devices")
-		case team != nil:
-			tmID = &team.ID
-		}
+func (t *HostLifecycle) getDefaultTeamForABMToken(ctx context.Context, host *fleet.Host, abmTokenID uint) (*uint, error) {
+	var abmDefaultTeamID *uint
+	tok, err := t.ds.GetABMTokenByID(ctx, abmTokenID)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "getting ABM token by id")
 	}
 
-	return tmID, nil
+	switch host.FleetPlatform() {
+	case "darwin":
+		abmDefaultTeamID = tok.MacOSDefaultTeamID
+	case "ios":
+		abmDefaultTeamID = tok.IOSDefaultTeamID
+	case "ipados":
+		abmDefaultTeamID = tok.IPadOSDefaultTeamID
+	default:
+		return nil, ctxerr.NewWithData(ctx, "attempting to get default ABM team for host with invalid platform", map[string]any{"host_platform": host.FleetPlatform(), "host_id": host.ID})
+	}
+
+	if abmDefaultTeamID == nil {
+		// The default team is "No team", so we can return nil
+		return nil, nil
+	}
+
+	exists, err := t.ds.TeamExists(ctx, *abmDefaultTeamID)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "get default team for mdm devices")
+	}
+
+	if !exists {
+		level.Debug(t.logger).Log(
+			"msg",
+			"unable to find default team assigned to abm token, mdm devices won't be assigned to a team",
+			"team_id",
+			abmDefaultTeamID,
+		)
+		return nil, nil
+	}
+
+	return abmDefaultTeamID, nil
 }
diff --git a/server/mdm/mdm.go b/server/mdm/mdm.go
index 93af98eb3d..5aaae483d8 100644
--- a/server/mdm/mdm.go
+++ b/server/mdm/mdm.go
@@ -6,7 +6,7 @@ import (
 	"crypto/x509"
 	"encoding/base64"
 
-	"go.mozilla.org/pkcs7"
+	"github.com/smallstep/pkcs7"
 )
 
 // MaxProfileRetries is the maximum times an install profile command may be
diff --git a/server/mdm/microsoft/microsoft_mdm.go b/server/mdm/microsoft/microsoft_mdm.go
index a8a9254bd8..bc56572ee1 100644
--- a/server/mdm/microsoft/microsoft_mdm.go
+++ b/server/mdm/microsoft/microsoft_mdm.go
@@ -5,7 +5,7 @@ import (
 	"encoding/base64"
 
 	"github.com/fleetdm/fleet/v4/server/mdm/internal/commonmdm"
-	"go.mozilla.org/pkcs7"
+	"github.com/smallstep/pkcs7"
 )
 
 const (
diff --git a/server/mdm/microsoft/wstep.go b/server/mdm/microsoft/wstep.go
index 68346cde4f..beb0c01ac2 100644
--- a/server/mdm/microsoft/wstep.go
+++ b/server/mdm/microsoft/wstep.go
@@ -21,7 +21,7 @@ import (
 	"github.com/fleetdm/fleet/v4/server/mdm/microsoft/syncml"
 	"github.com/fleetdm/fleet/v4/server/mdm/nanomdm/cryptoutil"
 	"github.com/golang-jwt/jwt/v4"
-	"go.mozilla.org/pkcs7"
+	"github.com/smallstep/pkcs7"
 )
 
 // CertManager is an interface for certificate management tasks associated with Microsoft MDM (e.g.,
diff --git a/server/mdm/nanodep/godep/client.go b/server/mdm/nanodep/godep/client.go
index 874db7546b..2d80a3dfd6 100644
--- a/server/mdm/nanodep/godep/client.go
+++ b/server/mdm/nanodep/godep/client.go
@@ -119,8 +119,14 @@ func NewClient(store ClientStorage, client *http.Client, opts ...ClientOption) *
 }
 
 func (c *Client) doWithAfterHook(ctx context.Context, name, method, path string, in interface{}, out interface{}) error {
-	err := c.do(ctx, name, method, path, in, out)
+	req, err := c.do(ctx, name, method, path, in, out)
 	if c.afterHook != nil {
+		// ensure the afterHook is always called with the same context as the one
+		// used for the request (the DEP client will add the name argument to that
+		// context, which we care about in the after hook).
+		if req != nil {
+			ctx = req.Context()
+		}
 		err = c.afterHook(ctx, err)
 	}
 	return err
@@ -130,19 +136,19 @@ func (c *Client) doWithAfterHook(ctx context.Context, name, method, path string,
 // should be using the NanoDEP transport (which handles authentication).
 // This frees us to only be concerned about the actual DEP API request.
 // We encode in to JSON and decode any returned body as JSON to out.
-func (c *Client) do(ctx context.Context, name, method, path string, in interface{}, out interface{}) error {
+func (c *Client) do(ctx context.Context, name, method, path string, in interface{}, out interface{}) (*http.Request, error) {
 	var body io.Reader
 	if in != nil {
 		bodyBytes, err := json.Marshal(in)
 		if err != nil {
-			return err
+			return nil, err
 		}
 		body = bytes.NewBuffer(bodyBytes)
 	}
 
 	req, err := depclient.NewRequestWithContext(ctx, name, c.store, method, path, body)
 	if err != nil {
-		return err
+		return nil, err
 	}
 	req.Header.Set("User-Agent", userAgent)
 	if body != nil {
@@ -154,22 +160,22 @@ func (c *Client) do(ctx context.Context, name, method, path string, in interface
 
 	resp, err := c.client.Do(req)
 	if err != nil {
-		return err
+		return req, err
 	}
 	defer resp.Body.Close()
 
 	if resp.StatusCode == http.StatusUnauthorized {
-		return fmt.Errorf("unhandled auth error: %w", depclient.NewAuthError(resp))
+		return req, fmt.Errorf("unhandled auth error: %w", depclient.NewAuthError(resp))
 	} else if resp.StatusCode != http.StatusOK {
-		return NewHTTPError(resp)
+		return req, NewHTTPError(resp)
 	}
 
 	if out != nil {
 		err := json.NewDecoder(resp.Body).Decode(out)
 		if err != nil {
-			return err
+			return req, err
 		}
 	}
 
-	return nil
+	return req, nil
 }
diff --git a/server/mdm/nanodep/tokenpki/parse.go b/server/mdm/nanodep/tokenpki/parse.go
index 6d254403f1..296dc43edf 100644
--- a/server/mdm/nanodep/tokenpki/parse.go
+++ b/server/mdm/nanodep/tokenpki/parse.go
@@ -11,7 +11,7 @@ import (
 	"io"
 	"net/textproto"
 
-	"go.mozilla.org/pkcs7"
+	"github.com/smallstep/pkcs7"
 )
 
 // UnwrapSMIME removes the S/MIME-like header wrapper around the raw encrypted
diff --git a/server/mdm/nanomdm/cryptoutil/cryptoutil.go b/server/mdm/nanomdm/cryptoutil/cryptoutil.go
index d7e41fcf10..ad62b4587a 100644
--- a/server/mdm/nanomdm/cryptoutil/cryptoutil.go
+++ b/server/mdm/nanomdm/cryptoutil/cryptoutil.go
@@ -10,7 +10,7 @@ import (
 	"fmt"
 	"strings"
 
-	"go.mozilla.org/pkcs7"
+	"github.com/smallstep/pkcs7"
 )
 
 // OID for UID (User ID) attribute
diff --git a/server/mdm/nanomdm/cryptoutil/cryptoutil_test.go b/server/mdm/nanomdm/cryptoutil/cryptoutil_test.go
index 0c3eda3296..5b5291709c 100644
--- a/server/mdm/nanomdm/cryptoutil/cryptoutil_test.go
+++ b/server/mdm/nanomdm/cryptoutil/cryptoutil_test.go
@@ -4,7 +4,7 @@ import (
 	"encoding/base64"
 	"testing"
 
-	"go.mozilla.org/pkcs7"
+	"github.com/smallstep/pkcs7"
 )
 
 func TestPKCS7ParseTagLengthError(t *testing.T) {
diff --git a/server/mdm/scep/scep/scep.go b/server/mdm/scep/scep/scep.go
index 25fa1de349..dc2bb1fcc8 100644
--- a/server/mdm/scep/scep/scep.go
+++ b/server/mdm/scep/scep/scep.go
@@ -19,7 +19,7 @@ import (
 
 	"github.com/go-kit/log"
 	"github.com/go-kit/log/level"
-	"go.mozilla.org/pkcs7"
+	"github.com/smallstep/pkcs7"
 )
 
 // errors
diff --git a/server/mock/datastore_mock.go b/server/mock/datastore_mock.go
index e062476d60..a592559bdf 100644
--- a/server/mock/datastore_mock.go
+++ b/server/mock/datastore_mock.go
@@ -250,7 +250,15 @@ type GetHostMDMFunc func(ctx context.Context, hostID uint) (*fleet.HostMDM, erro
 
 type GetHostMDMCheckinInfoFunc func(ctx context.Context, hostUUID string) (*fleet.HostMDMCheckinInfo, error)
 
-type ListIOSAndIPadOSToRefetchFunc func(ctx context.Context, refetchInterval time.Duration) (uuids []string, err error)
+type ListIOSAndIPadOSToRefetchFunc func(ctx context.Context, refetchInterval time.Duration) (devices []fleet.AppleDevicesToRefetch, err error)
+
+type AddHostMDMCommandsFunc func(ctx context.Context, commands []fleet.HostMDMCommand) error
+
+type GetHostMDMCommandsFunc func(ctx context.Context, hostID uint) (commands []fleet.HostMDMCommand, err error)
+
+type RemoveHostMDMCommandFunc func(ctx context.Context, command fleet.HostMDMCommand) error
+
+type CleanupHostMDMCommandsFunc func(ctx context.Context) error
 
 type IsHostConnectedToFleetMDMFunc func(ctx context.Context, host *fleet.Host) (bool, error)
 
@@ -388,7 +396,11 @@ type ListSoftwareTitlesFunc func(ctx context.Context, opt fleet.SoftwareTitleLis
 
 type SoftwareTitleByIDFunc func(ctx context.Context, id uint, teamID *uint, tmFilter fleet.TeamFilter) (*fleet.SoftwareTitle, error)
 
-type InsertSoftwareInstallRequestFunc func(ctx context.Context, hostID uint, softwareTitleID uint, selfService bool) (string, error)
+type InsertSoftwareInstallRequestFunc func(ctx context.Context, hostID uint, softwareInstallerID uint, selfService bool) (string, error)
+
+type InsertSoftwareUninstallRequestFunc func(ctx context.Context, executionID string, hostID uint, softwareInstallerID uint) error
+
+type GetSoftwareTitleNameFromExecutionIDFunc func(ctx context.Context, executionID string) (string, error)
 
 type ListSoftwareForVulnDetectionFunc func(ctx context.Context, filter fleet.VulnSoftwareFilter) ([]fleet.Software, error)
 
@@ -486,6 +498,8 @@ type PolicyQueriesForHostFunc func(ctx context.Context, host *fleet.Host) (map[s
 
 type GetTeamHostsPolicyMembershipsFunc func(ctx context.Context, domain string, teamID uint, policyIDs []uint, hostID *uint) ([]fleet.HostPolicyMembershipData, error)
 
+type GetPoliciesWithAssociatedInstallerFunc func(ctx context.Context, teamID uint, policyIDs []uint) ([]fleet.PolicySoftwareInstallerData, error)
+
 type GetCalendarPoliciesFunc func(ctx context.Context, teamID uint) ([]fleet.PolicyCalendarData, error)
 
 type AsyncBatchInsertPolicyMembershipFunc func(ctx context.Context, batch []fleet.PolicyMembershipResult) error
@@ -604,6 +618,8 @@ type SetOrUpdateMunkiInfoFunc func(ctx context.Context, hostID uint, version str
 
 type SetOrUpdateMDMDataFunc func(ctx context.Context, hostID uint, isServer bool, enrolled bool, serverURL string, installedFromDep bool, name string, fleetEnrollRef string) error
 
+type UpdateMDMDataFunc func(ctx context.Context, hostID uint, enrolled bool) error
+
 type SetOrUpdateHostEmailsFromMdmIdpAccountsFunc func(ctx context.Context, hostID uint, fleetEnrollmentRef string) error
 
 type SetOrUpdateHostDisksSpaceFunc func(ctx context.Context, hostID uint, gigsAvailable float64, percentAvailable float64, gigsTotal float64) error
@@ -684,6 +700,8 @@ type CountVulnerabilitiesFunc func(ctx context.Context, opt fleet.VulnListOption
 
 type UpdateVulnerabilityHostCountsFunc func(ctx context.Context) error
 
+type IsCVEKnownToFleetFunc func(ctx context.Context, cve string) (bool, error)
+
 type NewMDMAppleConfigProfileFunc func(ctx context.Context, p fleet.MDMAppleConfigProfile) (*fleet.MDMAppleConfigProfile, error)
 
 type BulkUpsertMDMAppleConfigProfilesFunc func(ctx context.Context, payload []*fleet.MDMAppleConfigProfile) error
@@ -738,9 +756,11 @@ type BatchSetMDMAppleProfilesFunc func(ctx context.Context, tmID *uint, profiles
 
 type MDMAppleListDevicesFunc func(ctx context.Context) ([]fleet.MDMAppleDevice, error)
 
-type UpsertMDMAppleHostDEPAssignmentsFunc func(ctx context.Context, hosts []fleet.Host) error
+type UpsertMDMAppleHostDEPAssignmentsFunc func(ctx context.Context, hosts []fleet.Host, abmTokenID uint) error
 
-type IngestMDMAppleDevicesFromDEPSyncFunc func(ctx context.Context, devices []godep.Device) (int64, *uint, error)
+type IngestMDMAppleDevicesFromDEPSyncFunc func(ctx context.Context, devices []godep.Device, abmTokenID uint, macOSTeam *fleet.Team, iosTeam *fleet.Team, ipadTeam *fleet.Team) (int64, error)
+
+type IngestMDMAppleDeviceFromOTAEnrollmentFunc func(ctx context.Context, teamID *uint, deviceInfo fleet.MDMAppleMachineInfo) error
 
 type MDMAppleUpsertHostFunc func(ctx context.Context, mdmHost *fleet.Host) error
 
@@ -766,7 +786,7 @@ type ListMDMAppleProfilesToRemoveFunc func(ctx context.Context) ([]*fleet.MDMApp
 
 type BulkUpsertMDMAppleHostProfilesFunc func(ctx context.Context, payload []*fleet.MDMAppleBulkUpsertHostProfilePayload) error
 
-type BulkSetPendingMDMHostProfilesFunc func(ctx context.Context, hostIDs []uint, teamIDs []uint, profileUUIDs []string, hostUUIDs []string) error
+type BulkSetPendingMDMHostProfilesFunc func(ctx context.Context, hostIDs []uint, teamIDs []uint, profileUUIDs []string, hostUUIDs []string) (updates fleet.MDMProfilesUpdates, err error)
 
 type GetMDMAppleProfilesContentsFunc func(ctx context.Context, profileUUIDs []string) (map[string]mobileconfig.Mobileconfig, error)
 
@@ -784,7 +804,7 @@ type GetMDMIdPAccountByEmailFunc func(ctx context.Context, email string) (*fleet
 
 type GetMDMAppleFileVaultSummaryFunc func(ctx context.Context, teamID *uint) (*fleet.MDMAppleFileVaultSummary, error)
 
-type InsertMDMAppleBootstrapPackageFunc func(ctx context.Context, bp *fleet.MDMAppleBootstrapPackage) error
+type InsertMDMAppleBootstrapPackageFunc func(ctx context.Context, bp *fleet.MDMAppleBootstrapPackage, pkgStore fleet.MDMBootstrapPackageStore) error
 
 type CopyDefaultMDMAppleBootstrapPackageFunc func(ctx context.Context, ac *fleet.AppConfig, toTeamID uint) error
 
@@ -792,12 +812,14 @@ type DeleteMDMAppleBootstrapPackageFunc func(ctx context.Context, teamID uint) e
 
 type GetMDMAppleBootstrapPackageMetaFunc func(ctx context.Context, teamID uint) (*fleet.MDMAppleBootstrapPackage, error)
 
-type GetMDMAppleBootstrapPackageBytesFunc func(ctx context.Context, token string) (*fleet.MDMAppleBootstrapPackage, error)
+type GetMDMAppleBootstrapPackageBytesFunc func(ctx context.Context, token string, pkgStore fleet.MDMBootstrapPackageStore) (*fleet.MDMAppleBootstrapPackage, error)
 
 type GetMDMAppleBootstrapPackageSummaryFunc func(ctx context.Context, teamID uint) (*fleet.MDMAppleBootstrapPackageSummary, error)
 
 type RecordHostBootstrapPackageFunc func(ctx context.Context, commandUUID string, hostUUID string) error
 
+type CleanupUnusedBootstrapPackagesFunc func(ctx context.Context, pkgStore fleet.MDMBootstrapPackageStore, removeCreatedBefore time.Time) error
+
 type GetHostMDMMacOSSetupFunc func(ctx context.Context, hostID uint) (*fleet.HostMDMMacOSSetup, error)
 
 type MDMGetEULAMetadataFunc func(ctx context.Context) (*fleet.MDMEULA, error)
@@ -812,13 +834,15 @@ type SetOrUpdateMDMAppleSetupAssistantFunc func(ctx context.Context, asst *fleet
 
 type GetMDMAppleSetupAssistantFunc func(ctx context.Context, teamID *uint) (*fleet.MDMAppleSetupAssistant, error)
 
+type GetMDMAppleSetupAssistantProfileForABMTokenFunc func(ctx context.Context, teamID *uint, abmTokenOrgName string) (string, time.Time, error)
+
 type DeleteMDMAppleSetupAssistantFunc func(ctx context.Context, teamID *uint) error
 
-type SetMDMAppleSetupAssistantProfileUUIDFunc func(ctx context.Context, teamID *uint, profileUUID string) error
+type SetMDMAppleSetupAssistantProfileUUIDFunc func(ctx context.Context, teamID *uint, profileUUID string, abmTokenOrgName string) error
 
-type SetMDMAppleDefaultSetupAssistantProfileUUIDFunc func(ctx context.Context, teamID *uint, profileUUID string) error
+type SetMDMAppleDefaultSetupAssistantProfileUUIDFunc func(ctx context.Context, teamID *uint, profileUUID string, abmTokenOrgName string) error
 
-type GetMDMAppleDefaultSetupAssistantFunc func(ctx context.Context, teamID *uint) (profileUUID string, updatedAt time.Time, err error)
+type GetMDMAppleDefaultSetupAssistantFunc func(ctx context.Context, teamID *uint, abmTokenOrgName string) (profileUUID string, updatedAt time.Time, err error)
 
 type GetMatchingHostSerialsFunc func(ctx context.Context, serials []string) (map[string]*fleet.Host, error)
 
@@ -826,7 +850,7 @@ type DeleteHostDEPAssignmentsFunc func(ctx context.Context, serials []string) er
 
 type UpdateHostDEPAssignProfileResponsesFunc func(ctx context.Context, resp *godep.ProfileResponse) error
 
-type ScreenDEPAssignProfileSerialsForCooldownFunc func(ctx context.Context, serials []string) (skipSerials []string, assignSerials []string, err error)
+type ScreenDEPAssignProfileSerialsForCooldownFunc func(ctx context.Context, serials []string) (skipSerialsByOrgName map[string][]string, serialsByOrgName map[string][]string, err error)
 
 type GetDEPAssignProfileExpiredCooldownsFunc func(ctx context.Context) (map[uint][]string, error)
 
@@ -846,6 +870,8 @@ type MDMAppleStoreDDMStatusReportFunc func(ctx context.Context, hostUUID string,
 
 type MDMAppleSetPendingDeclarationsAsFunc func(ctx context.Context, hostUUID string, status *fleet.MDMDeliveryStatus, detail string) error
 
+type GetMDMAppleOSUpdatesSettingsByHostSerialFunc func(ctx context.Context, hostSerial string) (*fleet.AppleOSUpdateSettings, error)
+
 type InsertMDMConfigAssetsFunc func(ctx context.Context, assets []fleet.MDMConfigAsset) error
 
 type GetAllMDMConfigAssetsByNameFunc func(ctx context.Context, assetNames []fleet.MDMAssetName) (map[fleet.MDMAssetName]fleet.MDMConfigAsset, error)
@@ -856,6 +882,40 @@ type DeleteMDMConfigAssetsByNameFunc func(ctx context.Context, assetNames []flee
 
 type ReplaceMDMConfigAssetsFunc func(ctx context.Context, assets []fleet.MDMConfigAsset) error
 
+type GetABMTokenByOrgNameFunc func(ctx context.Context, orgName string) (*fleet.ABMToken, error)
+
+type SaveABMTokenFunc func(ctx context.Context, tok *fleet.ABMToken) error
+
+type InsertVPPTokenFunc func(ctx context.Context, tok *fleet.VPPTokenData) (*fleet.VPPTokenDB, error)
+
+type ListVPPTokensFunc func(ctx context.Context) ([]*fleet.VPPTokenDB, error)
+
+type GetVPPTokenFunc func(ctx context.Context, tokenID uint) (*fleet.VPPTokenDB, error)
+
+type GetVPPTokenByTeamIDFunc func(ctx context.Context, teamID *uint) (*fleet.VPPTokenDB, error)
+
+type UpdateVPPTokenTeamsFunc func(ctx context.Context, id uint, teams []uint) (*fleet.VPPTokenDB, error)
+
+type UpdateVPPTokenFunc func(ctx context.Context, id uint, tok *fleet.VPPTokenData) (*fleet.VPPTokenDB, error)
+
+type DeleteVPPTokenFunc func(ctx context.Context, tokenID uint) error
+
+type SetABMTokenTermsExpiredForOrgNameFunc func(ctx context.Context, orgName string, expired bool) (wasSet bool, err error)
+
+type CountABMTokensWithTermsExpiredFunc func(ctx context.Context) (int, error)
+
+type InsertABMTokenFunc func(ctx context.Context, tok *fleet.ABMToken) (*fleet.ABMToken, error)
+
+type ListABMTokensFunc func(ctx context.Context) ([]*fleet.ABMToken, error)
+
+type DeleteABMTokenFunc func(ctx context.Context, tokenID uint) error
+
+type GetABMTokenByIDFunc func(ctx context.Context, tokenID uint) (*fleet.ABMToken, error)
+
+type GetABMTokenCountFunc func(ctx context.Context) (int, error)
+
+type GetABMTokenOrgNamesAssociatedWithTeamFunc func(ctx context.Context, teamID *uint) ([]string, error)
+
 type WSTEPStoreCertificateFunc func(ctx context.Context, name string, crt *x509.Certificate) error
 
 type WSTEPNewSerialFunc func(ctx context.Context) (*big.Int, error)
@@ -918,7 +978,7 @@ type NewMDMWindowsConfigProfileFunc func(ctx context.Context, cp fleet.MDMWindow
 
 type SetOrUpdateMDMWindowsConfigProfileFunc func(ctx context.Context, cp fleet.MDMWindowsConfigProfile) error
 
-type BatchSetMDMProfilesFunc func(ctx context.Context, tmID *uint, macProfiles []*fleet.MDMAppleConfigProfile, winProfiles []*fleet.MDMWindowsConfigProfile, macDeclarations []*fleet.MDMAppleDeclaration) error
+type BatchSetMDMProfilesFunc func(ctx context.Context, tmID *uint, macProfiles []*fleet.MDMAppleConfigProfile, winProfiles []*fleet.MDMWindowsConfigProfile, macDeclarations []*fleet.MDMAppleDeclaration) (updates fleet.MDMProfilesUpdates, err error)
 
 type NewMDMAppleDeclarationFunc func(ctx context.Context, declaration *fleet.MDMAppleDeclaration) (*fleet.MDMAppleDeclaration, error)
 
@@ -926,7 +986,7 @@ type SetOrUpdateMDMAppleDeclarationFunc func(ctx context.Context, declaration *f
 
 type NewHostScriptExecutionRequestFunc func(ctx context.Context, request *fleet.HostScriptRequestPayload) (*fleet.HostScriptResult, error)
 
-type SetHostScriptExecutionResultFunc func(ctx context.Context, result *fleet.HostScriptResultPayload) (*fleet.HostScriptResult, error)
+type SetHostScriptExecutionResultFunc func(ctx context.Context, result *fleet.HostScriptResultPayload) (hsr *fleet.HostScriptResult, action string, err error)
 
 type GetHostScriptExecutionResultFunc func(ctx context.Context, execID string) (*fleet.HostScriptResult, error)
 
@@ -938,6 +998,8 @@ type ScriptFunc func(ctx context.Context, id uint) (*fleet.Script, error)
 
 type GetScriptContentsFunc func(ctx context.Context, id uint) ([]byte, error)
 
+type GetAnyScriptContentsFunc func(ctx context.Context, id uint) ([]byte, error)
+
 type DeleteScriptFunc func(ctx context.Context, id uint) error
 
 type ListScriptsFunc func(ctx context.Context, teamID *uint, opt fleet.ListOptions) ([]*fleet.Script, *fleet.PaginationMetadata, error)
@@ -972,13 +1034,27 @@ type GetSoftwareInstallDetailsFunc func(ctx context.Context, executionId string)
 
 type ListPendingSoftwareInstallsFunc func(ctx context.Context, hostID uint) ([]string, error)
 
+type GetHostLastInstallDataFunc func(ctx context.Context, hostID uint, installerID uint) (*fleet.HostLastInstallData, error)
+
 type MatchOrCreateSoftwareInstallerFunc func(ctx context.Context, payload *fleet.UploadSoftwareInstallerPayload) (uint, error)
 
 type GetSoftwareInstallerMetadataByIDFunc func(ctx context.Context, id uint) (*fleet.SoftwareInstaller, error)
 
+type ValidateOrbitSoftwareInstallerAccessFunc func(ctx context.Context, hostID uint, installerID uint) (bool, error)
+
 type GetSoftwareInstallerMetadataByTeamAndTitleIDFunc func(ctx context.Context, teamID *uint, titleID uint, withScriptContents bool) (*fleet.SoftwareInstaller, error)
 
-type GetVPPAppByTeamAndTitleIDFunc func(ctx context.Context, teamID *uint, titleID uint, withScriptContents bool) (*fleet.VPPApp, error)
+type GetSoftwareInstallersWithoutPackageIDsFunc func(ctx context.Context) (map[uint]string, error)
+
+type UpdateSoftwareInstallerWithoutPackageIDsFunc func(ctx context.Context, id uint, payload fleet.UploadSoftwareInstallerPayload) error
+
+type ProcessInstallerUpdateSideEffectsFunc func(ctx context.Context, installerID uint, wasMetadataUpdated bool, wasPackageUpdated bool) error
+
+type SaveInstallerUpdatesFunc func(ctx context.Context, payload *fleet.UpdateSoftwareInstallerPayload) error
+
+type UpdateInstallerSelfServiceFlagFunc func(ctx context.Context, selfService bool, id uint) error
+
+type GetVPPAppByTeamAndTitleIDFunc func(ctx context.Context, teamID *uint, titleID uint) (*fleet.VPPApp, error)
 
 type GetVPPAppMetadataByTeamAndTitleIDFunc func(ctx context.Context, teamID *uint, titleID uint) (*fleet.VPPAppStoreApp, error)
 
@@ -992,24 +1068,28 @@ type GetSummaryHostVPPAppInstallsFunc func(ctx context.Context, teamID *uint, ap
 
 type GetSoftwareInstallResultsFunc func(ctx context.Context, resultsUUID string) (*fleet.HostSoftwareInstallerResult, error)
 
-type CleanupUnusedSoftwareInstallersFunc func(ctx context.Context, softwareInstallStore fleet.SoftwareInstallerStore) error
+type CleanupUnusedSoftwareInstallersFunc func(ctx context.Context, softwareInstallStore fleet.SoftwareInstallerStore, removeCreatedBefore time.Time) error
 
 type BatchSetSoftwareInstallersFunc func(ctx context.Context, tmID *uint, installers []*fleet.UploadSoftwareInstallerPayload) error
 
+type GetSoftwareInstallersFunc func(ctx context.Context, tmID uint) ([]fleet.SoftwarePackageResponse, error)
+
 type HasSelfServiceSoftwareInstallersFunc func(ctx context.Context, platform string, teamID *uint) (bool, error)
 
 type BatchInsertVPPAppsFunc func(ctx context.Context, apps []*fleet.VPPApp) error
 
-type GetAssignedVPPAppsFunc func(ctx context.Context, teamID *uint) (map[fleet.VPPAppID]struct{}, error)
+type GetAssignedVPPAppsFunc func(ctx context.Context, teamID *uint) (map[fleet.VPPAppID]fleet.VPPAppTeam, error)
 
-type SetTeamVPPAppsFunc func(ctx context.Context, teamID *uint, appIDs []fleet.VPPAppID) error
+type SetTeamVPPAppsFunc func(ctx context.Context, teamID *uint, appIDs []fleet.VPPAppTeam) error
 
 type InsertVPPAppWithTeamFunc func(ctx context.Context, app *fleet.VPPApp, teamID *uint) (*fleet.VPPApp, error)
 
-type InsertHostVPPSoftwareInstallFunc func(ctx context.Context, hostID uint, userID uint, appID fleet.VPPAppID, commandUUID string, associatedEventID string) error
+type InsertHostVPPSoftwareInstallFunc func(ctx context.Context, hostID uint, appID fleet.VPPAppID, commandUUID string, associatedEventID string, selfService bool) error
 
 type GetPastActivityDataForVPPAppInstallFunc func(ctx context.Context, commandResults *mdm.CommandResults) (*fleet.User, *fleet.ActivityInstalledAppStoreApp, error)
 
+type GetVPPTokenByLocationFunc func(ctx context.Context, loc string) (*fleet.VPPTokenDB, error)
+
 type DataStore struct {
 	HealthCheckFunc        HealthCheckFunc
 	HealthCheckFuncInvoked bool
@@ -1359,6 +1439,18 @@ type DataStore struct {
 	ListIOSAndIPadOSToRefetchFunc        ListIOSAndIPadOSToRefetchFunc
 	ListIOSAndIPadOSToRefetchFuncInvoked bool
 
+	AddHostMDMCommandsFunc        AddHostMDMCommandsFunc
+	AddHostMDMCommandsFuncInvoked bool
+
+	GetHostMDMCommandsFunc        GetHostMDMCommandsFunc
+	GetHostMDMCommandsFuncInvoked bool
+
+	RemoveHostMDMCommandFunc        RemoveHostMDMCommandFunc
+	RemoveHostMDMCommandFuncInvoked bool
+
+	CleanupHostMDMCommandsFunc        CleanupHostMDMCommandsFunc
+	CleanupHostMDMCommandsFuncInvoked bool
+
 	IsHostConnectedToFleetMDMFunc        IsHostConnectedToFleetMDMFunc
 	IsHostConnectedToFleetMDMFuncInvoked bool
 
@@ -1566,6 +1658,12 @@ type DataStore struct {
 	InsertSoftwareInstallRequestFunc        InsertSoftwareInstallRequestFunc
 	InsertSoftwareInstallRequestFuncInvoked bool
 
+	InsertSoftwareUninstallRequestFunc        InsertSoftwareUninstallRequestFunc
+	InsertSoftwareUninstallRequestFuncInvoked bool
+
+	GetSoftwareTitleNameFromExecutionIDFunc        GetSoftwareTitleNameFromExecutionIDFunc
+	GetSoftwareTitleNameFromExecutionIDFuncInvoked bool
+
 	ListSoftwareForVulnDetectionFunc        ListSoftwareForVulnDetectionFunc
 	ListSoftwareForVulnDetectionFuncInvoked bool
 
@@ -1710,6 +1808,9 @@ type DataStore struct {
 	GetTeamHostsPolicyMembershipsFunc        GetTeamHostsPolicyMembershipsFunc
 	GetTeamHostsPolicyMembershipsFuncInvoked bool
 
+	GetPoliciesWithAssociatedInstallerFunc        GetPoliciesWithAssociatedInstallerFunc
+	GetPoliciesWithAssociatedInstallerFuncInvoked bool
+
 	GetCalendarPoliciesFunc        GetCalendarPoliciesFunc
 	GetCalendarPoliciesFuncInvoked bool
 
@@ -1887,6 +1988,9 @@ type DataStore struct {
 	SetOrUpdateMDMDataFunc        SetOrUpdateMDMDataFunc
 	SetOrUpdateMDMDataFuncInvoked bool
 
+	UpdateMDMDataFunc        UpdateMDMDataFunc
+	UpdateMDMDataFuncInvoked bool
+
 	SetOrUpdateHostEmailsFromMdmIdpAccountsFunc        SetOrUpdateHostEmailsFromMdmIdpAccountsFunc
 	SetOrUpdateHostEmailsFromMdmIdpAccountsFuncInvoked bool
 
@@ -2007,6 +2111,9 @@ type DataStore struct {
 	UpdateVulnerabilityHostCountsFunc        UpdateVulnerabilityHostCountsFunc
 	UpdateVulnerabilityHostCountsFuncInvoked bool
 
+	IsCVEKnownToFleetFunc        IsCVEKnownToFleetFunc
+	IsCVEKnownToFleetFuncInvoked bool
+
 	NewMDMAppleConfigProfileFunc        NewMDMAppleConfigProfileFunc
 	NewMDMAppleConfigProfileFuncInvoked bool
 
@@ -2094,6 +2201,9 @@ type DataStore struct {
 	IngestMDMAppleDevicesFromDEPSyncFunc        IngestMDMAppleDevicesFromDEPSyncFunc
 	IngestMDMAppleDevicesFromDEPSyncFuncInvoked bool
 
+	IngestMDMAppleDeviceFromOTAEnrollmentFunc        IngestMDMAppleDeviceFromOTAEnrollmentFunc
+	IngestMDMAppleDeviceFromOTAEnrollmentFuncInvoked bool
+
 	MDMAppleUpsertHostFunc        MDMAppleUpsertHostFunc
 	MDMAppleUpsertHostFuncInvoked bool
 
@@ -2178,6 +2288,9 @@ type DataStore struct {
 	RecordHostBootstrapPackageFunc        RecordHostBootstrapPackageFunc
 	RecordHostBootstrapPackageFuncInvoked bool
 
+	CleanupUnusedBootstrapPackagesFunc        CleanupUnusedBootstrapPackagesFunc
+	CleanupUnusedBootstrapPackagesFuncInvoked bool
+
 	GetHostMDMMacOSSetupFunc        GetHostMDMMacOSSetupFunc
 	GetHostMDMMacOSSetupFuncInvoked bool
 
@@ -2199,6 +2312,9 @@ type DataStore struct {
 	GetMDMAppleSetupAssistantFunc        GetMDMAppleSetupAssistantFunc
 	GetMDMAppleSetupAssistantFuncInvoked bool
 
+	GetMDMAppleSetupAssistantProfileForABMTokenFunc        GetMDMAppleSetupAssistantProfileForABMTokenFunc
+	GetMDMAppleSetupAssistantProfileForABMTokenFuncInvoked bool
+
 	DeleteMDMAppleSetupAssistantFunc        DeleteMDMAppleSetupAssistantFunc
 	DeleteMDMAppleSetupAssistantFuncInvoked bool
 
@@ -2250,6 +2366,9 @@ type DataStore struct {
 	MDMAppleSetPendingDeclarationsAsFunc        MDMAppleSetPendingDeclarationsAsFunc
 	MDMAppleSetPendingDeclarationsAsFuncInvoked bool
 
+	GetMDMAppleOSUpdatesSettingsByHostSerialFunc        GetMDMAppleOSUpdatesSettingsByHostSerialFunc
+	GetMDMAppleOSUpdatesSettingsByHostSerialFuncInvoked bool
+
 	InsertMDMConfigAssetsFunc        InsertMDMConfigAssetsFunc
 	InsertMDMConfigAssetsFuncInvoked bool
 
@@ -2265,6 +2384,57 @@ type DataStore struct {
 	ReplaceMDMConfigAssetsFunc        ReplaceMDMConfigAssetsFunc
 	ReplaceMDMConfigAssetsFuncInvoked bool
 
+	GetABMTokenByOrgNameFunc        GetABMTokenByOrgNameFunc
+	GetABMTokenByOrgNameFuncInvoked bool
+
+	SaveABMTokenFunc        SaveABMTokenFunc
+	SaveABMTokenFuncInvoked bool
+
+	InsertVPPTokenFunc        InsertVPPTokenFunc
+	InsertVPPTokenFuncInvoked bool
+
+	ListVPPTokensFunc        ListVPPTokensFunc
+	ListVPPTokensFuncInvoked bool
+
+	GetVPPTokenFunc        GetVPPTokenFunc
+	GetVPPTokenFuncInvoked bool
+
+	GetVPPTokenByTeamIDFunc        GetVPPTokenByTeamIDFunc
+	GetVPPTokenByTeamIDFuncInvoked bool
+
+	UpdateVPPTokenTeamsFunc        UpdateVPPTokenTeamsFunc
+	UpdateVPPTokenTeamsFuncInvoked bool
+
+	UpdateVPPTokenFunc        UpdateVPPTokenFunc
+	UpdateVPPTokenFuncInvoked bool
+
+	DeleteVPPTokenFunc        DeleteVPPTokenFunc
+	DeleteVPPTokenFuncInvoked bool
+
+	SetABMTokenTermsExpiredForOrgNameFunc        SetABMTokenTermsExpiredForOrgNameFunc
+	SetABMTokenTermsExpiredForOrgNameFuncInvoked bool
+
+	CountABMTokensWithTermsExpiredFunc        CountABMTokensWithTermsExpiredFunc
+	CountABMTokensWithTermsExpiredFuncInvoked bool
+
+	InsertABMTokenFunc        InsertABMTokenFunc
+	InsertABMTokenFuncInvoked bool
+
+	ListABMTokensFunc        ListABMTokensFunc
+	ListABMTokensFuncInvoked bool
+
+	DeleteABMTokenFunc        DeleteABMTokenFunc
+	DeleteABMTokenFuncInvoked bool
+
+	GetABMTokenByIDFunc        GetABMTokenByIDFunc
+	GetABMTokenByIDFuncInvoked bool
+
+	GetABMTokenCountFunc        GetABMTokenCountFunc
+	GetABMTokenCountFuncInvoked bool
+
+	GetABMTokenOrgNamesAssociatedWithTeamFunc        GetABMTokenOrgNamesAssociatedWithTeamFunc
+	GetABMTokenOrgNamesAssociatedWithTeamFuncInvoked bool
+
 	WSTEPStoreCertificateFunc        WSTEPStoreCertificateFunc
 	WSTEPStoreCertificateFuncInvoked bool
 
@@ -2388,6 +2558,9 @@ type DataStore struct {
 	GetScriptContentsFunc        GetScriptContentsFunc
 	GetScriptContentsFuncInvoked bool
 
+	GetAnyScriptContentsFunc        GetAnyScriptContentsFunc
+	GetAnyScriptContentsFuncInvoked bool
+
 	DeleteScriptFunc        DeleteScriptFunc
 	DeleteScriptFuncInvoked bool
 
@@ -2439,15 +2612,36 @@ type DataStore struct {
 	ListPendingSoftwareInstallsFunc        ListPendingSoftwareInstallsFunc
 	ListPendingSoftwareInstallsFuncInvoked bool
 
+	GetHostLastInstallDataFunc        GetHostLastInstallDataFunc
+	GetHostLastInstallDataFuncInvoked bool
+
 	MatchOrCreateSoftwareInstallerFunc        MatchOrCreateSoftwareInstallerFunc
 	MatchOrCreateSoftwareInstallerFuncInvoked bool
 
 	GetSoftwareInstallerMetadataByIDFunc        GetSoftwareInstallerMetadataByIDFunc
 	GetSoftwareInstallerMetadataByIDFuncInvoked bool
 
+	ValidateOrbitSoftwareInstallerAccessFunc        ValidateOrbitSoftwareInstallerAccessFunc
+	ValidateOrbitSoftwareInstallerAccessFuncInvoked bool
+
 	GetSoftwareInstallerMetadataByTeamAndTitleIDFunc        GetSoftwareInstallerMetadataByTeamAndTitleIDFunc
 	GetSoftwareInstallerMetadataByTeamAndTitleIDFuncInvoked bool
 
+	GetSoftwareInstallersWithoutPackageIDsFunc        GetSoftwareInstallersWithoutPackageIDsFunc
+	GetSoftwareInstallersWithoutPackageIDsFuncInvoked bool
+
+	UpdateSoftwareInstallerWithoutPackageIDsFunc        UpdateSoftwareInstallerWithoutPackageIDsFunc
+	UpdateSoftwareInstallerWithoutPackageIDsFuncInvoked bool
+
+	ProcessInstallerUpdateSideEffectsFunc        ProcessInstallerUpdateSideEffectsFunc
+	ProcessInstallerUpdateSideEffectsFuncInvoked bool
+
+	SaveInstallerUpdatesFunc        SaveInstallerUpdatesFunc
+	SaveInstallerUpdatesFuncInvoked bool
+
+	UpdateInstallerSelfServiceFlagFunc        UpdateInstallerSelfServiceFlagFunc
+	UpdateInstallerSelfServiceFlagFuncInvoked bool
+
 	GetVPPAppByTeamAndTitleIDFunc        GetVPPAppByTeamAndTitleIDFunc
 	GetVPPAppByTeamAndTitleIDFuncInvoked bool
 
@@ -2475,6 +2669,9 @@ type DataStore struct {
 	BatchSetSoftwareInstallersFunc        BatchSetSoftwareInstallersFunc
 	BatchSetSoftwareInstallersFuncInvoked bool
 
+	GetSoftwareInstallersFunc        GetSoftwareInstallersFunc
+	GetSoftwareInstallersFuncInvoked bool
+
 	HasSelfServiceSoftwareInstallersFunc        HasSelfServiceSoftwareInstallersFunc
 	HasSelfServiceSoftwareInstallersFuncInvoked bool
 
@@ -2496,6 +2693,9 @@ type DataStore struct {
 	GetPastActivityDataForVPPAppInstallFunc        GetPastActivityDataForVPPAppInstallFunc
 	GetPastActivityDataForVPPAppInstallFuncInvoked bool
 
+	GetVPPTokenByLocationFunc        GetVPPTokenByLocationFunc
+	GetVPPTokenByLocationFuncInvoked bool
+
 	mu sync.Mutex
 }
 
@@ -3304,13 +3504,41 @@ func (s *DataStore) GetHostMDMCheckinInfo(ctx context.Context, hostUUID string)
 	return s.GetHostMDMCheckinInfoFunc(ctx, hostUUID)
 }
 
-func (s *DataStore) ListIOSAndIPadOSToRefetch(ctx context.Context, refetchInterval time.Duration) (uuids []string, err error) {
+func (s *DataStore) ListIOSAndIPadOSToRefetch(ctx context.Context, refetchInterval time.Duration) (devices []fleet.AppleDevicesToRefetch, err error) {
 	s.mu.Lock()
 	s.ListIOSAndIPadOSToRefetchFuncInvoked = true
 	s.mu.Unlock()
 	return s.ListIOSAndIPadOSToRefetchFunc(ctx, refetchInterval)
 }
 
+func (s *DataStore) AddHostMDMCommands(ctx context.Context, commands []fleet.HostMDMCommand) error {
+	s.mu.Lock()
+	s.AddHostMDMCommandsFuncInvoked = true
+	s.mu.Unlock()
+	return s.AddHostMDMCommandsFunc(ctx, commands)
+}
+
+func (s *DataStore) GetHostMDMCommands(ctx context.Context, hostID uint) (commands []fleet.HostMDMCommand, err error) {
+	s.mu.Lock()
+	s.GetHostMDMCommandsFuncInvoked = true
+	s.mu.Unlock()
+	return s.GetHostMDMCommandsFunc(ctx, hostID)
+}
+
+func (s *DataStore) RemoveHostMDMCommand(ctx context.Context, command fleet.HostMDMCommand) error {
+	s.mu.Lock()
+	s.RemoveHostMDMCommandFuncInvoked = true
+	s.mu.Unlock()
+	return s.RemoveHostMDMCommandFunc(ctx, command)
+}
+
+func (s *DataStore) CleanupHostMDMCommands(ctx context.Context) error {
+	s.mu.Lock()
+	s.CleanupHostMDMCommandsFuncInvoked = true
+	s.mu.Unlock()
+	return s.CleanupHostMDMCommandsFunc(ctx)
+}
+
 func (s *DataStore) IsHostConnectedToFleetMDM(ctx context.Context, host *fleet.Host) (bool, error) {
 	s.mu.Lock()
 	s.IsHostConnectedToFleetMDMFuncInvoked = true
@@ -3787,11 +4015,25 @@ func (s *DataStore) SoftwareTitleByID(ctx context.Context, id uint, teamID *uint
 	return s.SoftwareTitleByIDFunc(ctx, id, teamID, tmFilter)
 }
 
-func (s *DataStore) InsertSoftwareInstallRequest(ctx context.Context, hostID uint, softwareTitleID uint, selfService bool) (string, error) {
+func (s *DataStore) InsertSoftwareInstallRequest(ctx context.Context, hostID uint, softwareInstallerID uint, selfService bool) (string, error) {
 	s.mu.Lock()
 	s.InsertSoftwareInstallRequestFuncInvoked = true
 	s.mu.Unlock()
-	return s.InsertSoftwareInstallRequestFunc(ctx, hostID, softwareTitleID, selfService)
+	return s.InsertSoftwareInstallRequestFunc(ctx, hostID, softwareInstallerID, selfService)
+}
+
+func (s *DataStore) InsertSoftwareUninstallRequest(ctx context.Context, executionID string, hostID uint, softwareInstallerID uint) error {
+	s.mu.Lock()
+	s.InsertSoftwareUninstallRequestFuncInvoked = true
+	s.mu.Unlock()
+	return s.InsertSoftwareUninstallRequestFunc(ctx, executionID, hostID, softwareInstallerID)
+}
+
+func (s *DataStore) GetSoftwareTitleNameFromExecutionID(ctx context.Context, executionID string) (string, error) {
+	s.mu.Lock()
+	s.GetSoftwareTitleNameFromExecutionIDFuncInvoked = true
+	s.mu.Unlock()
+	return s.GetSoftwareTitleNameFromExecutionIDFunc(ctx, executionID)
 }
 
 func (s *DataStore) ListSoftwareForVulnDetection(ctx context.Context, filter fleet.VulnSoftwareFilter) ([]fleet.Software, error) {
@@ -4130,6 +4372,13 @@ func (s *DataStore) GetTeamHostsPolicyMemberships(ctx context.Context, domain st
 	return s.GetTeamHostsPolicyMembershipsFunc(ctx, domain, teamID, policyIDs, hostID)
 }
 
+func (s *DataStore) GetPoliciesWithAssociatedInstaller(ctx context.Context, teamID uint, policyIDs []uint) ([]fleet.PolicySoftwareInstallerData, error) {
+	s.mu.Lock()
+	s.GetPoliciesWithAssociatedInstallerFuncInvoked = true
+	s.mu.Unlock()
+	return s.GetPoliciesWithAssociatedInstallerFunc(ctx, teamID, policyIDs)
+}
+
 func (s *DataStore) GetCalendarPolicies(ctx context.Context, teamID uint) ([]fleet.PolicyCalendarData, error) {
 	s.mu.Lock()
 	s.GetCalendarPoliciesFuncInvoked = true
@@ -4543,6 +4792,13 @@ func (s *DataStore) SetOrUpdateMDMData(ctx context.Context, hostID uint, isServe
 	return s.SetOrUpdateMDMDataFunc(ctx, hostID, isServer, enrolled, serverURL, installedFromDep, name, fleetEnrollRef)
 }
 
+func (s *DataStore) UpdateMDMData(ctx context.Context, hostID uint, enrolled bool) error {
+	s.mu.Lock()
+	s.UpdateMDMDataFuncInvoked = true
+	s.mu.Unlock()
+	return s.UpdateMDMDataFunc(ctx, hostID, enrolled)
+}
+
 func (s *DataStore) SetOrUpdateHostEmailsFromMdmIdpAccounts(ctx context.Context, hostID uint, fleetEnrollmentRef string) error {
 	s.mu.Lock()
 	s.SetOrUpdateHostEmailsFromMdmIdpAccountsFuncInvoked = true
@@ -4823,6 +5079,13 @@ func (s *DataStore) UpdateVulnerabilityHostCounts(ctx context.Context) error {
 	return s.UpdateVulnerabilityHostCountsFunc(ctx)
 }
 
+func (s *DataStore) IsCVEKnownToFleet(ctx context.Context, cve string) (bool, error) {
+	s.mu.Lock()
+	s.IsCVEKnownToFleetFuncInvoked = true
+	s.mu.Unlock()
+	return s.IsCVEKnownToFleetFunc(ctx, cve)
+}
+
 func (s *DataStore) NewMDMAppleConfigProfile(ctx context.Context, p fleet.MDMAppleConfigProfile) (*fleet.MDMAppleConfigProfile, error) {
 	s.mu.Lock()
 	s.NewMDMAppleConfigProfileFuncInvoked = true
@@ -5012,18 +5275,25 @@ func (s *DataStore) MDMAppleListDevices(ctx context.Context) ([]fleet.MDMAppleDe
 	return s.MDMAppleListDevicesFunc(ctx)
 }
 
-func (s *DataStore) UpsertMDMAppleHostDEPAssignments(ctx context.Context, hosts []fleet.Host) error {
+func (s *DataStore) UpsertMDMAppleHostDEPAssignments(ctx context.Context, hosts []fleet.Host, abmTokenID uint) error {
 	s.mu.Lock()
 	s.UpsertMDMAppleHostDEPAssignmentsFuncInvoked = true
 	s.mu.Unlock()
-	return s.UpsertMDMAppleHostDEPAssignmentsFunc(ctx, hosts)
+	return s.UpsertMDMAppleHostDEPAssignmentsFunc(ctx, hosts, abmTokenID)
 }
 
-func (s *DataStore) IngestMDMAppleDevicesFromDEPSync(ctx context.Context, devices []godep.Device) (int64, *uint, error) {
+func (s *DataStore) IngestMDMAppleDevicesFromDEPSync(ctx context.Context, devices []godep.Device, abmTokenID uint, macOSTeam *fleet.Team, iosTeam *fleet.Team, ipadTeam *fleet.Team) (int64, error) {
 	s.mu.Lock()
 	s.IngestMDMAppleDevicesFromDEPSyncFuncInvoked = true
 	s.mu.Unlock()
-	return s.IngestMDMAppleDevicesFromDEPSyncFunc(ctx, devices)
+	return s.IngestMDMAppleDevicesFromDEPSyncFunc(ctx, devices, abmTokenID, macOSTeam, iosTeam, ipadTeam)
+}
+
+func (s *DataStore) IngestMDMAppleDeviceFromOTAEnrollment(ctx context.Context, teamID *uint, deviceInfo fleet.MDMAppleMachineInfo) error {
+	s.mu.Lock()
+	s.IngestMDMAppleDeviceFromOTAEnrollmentFuncInvoked = true
+	s.mu.Unlock()
+	return s.IngestMDMAppleDeviceFromOTAEnrollmentFunc(ctx, teamID, deviceInfo)
 }
 
 func (s *DataStore) MDMAppleUpsertHost(ctx context.Context, mdmHost *fleet.Host) error {
@@ -5110,7 +5380,7 @@ func (s *DataStore) BulkUpsertMDMAppleHostProfiles(ctx context.Context, payload
 	return s.BulkUpsertMDMAppleHostProfilesFunc(ctx, payload)
 }
 
-func (s *DataStore) BulkSetPendingMDMHostProfiles(ctx context.Context, hostIDs []uint, teamIDs []uint, profileUUIDs []string, hostUUIDs []string) error {
+func (s *DataStore) BulkSetPendingMDMHostProfiles(ctx context.Context, hostIDs []uint, teamIDs []uint, profileUUIDs []string, hostUUIDs []string) (updates fleet.MDMProfilesUpdates, err error) {
 	s.mu.Lock()
 	s.BulkSetPendingMDMHostProfilesFuncInvoked = true
 	s.mu.Unlock()
@@ -5173,11 +5443,11 @@ func (s *DataStore) GetMDMAppleFileVaultSummary(ctx context.Context, teamID *uin
 	return s.GetMDMAppleFileVaultSummaryFunc(ctx, teamID)
 }
 
-func (s *DataStore) InsertMDMAppleBootstrapPackage(ctx context.Context, bp *fleet.MDMAppleBootstrapPackage) error {
+func (s *DataStore) InsertMDMAppleBootstrapPackage(ctx context.Context, bp *fleet.MDMAppleBootstrapPackage, pkgStore fleet.MDMBootstrapPackageStore) error {
 	s.mu.Lock()
 	s.InsertMDMAppleBootstrapPackageFuncInvoked = true
 	s.mu.Unlock()
-	return s.InsertMDMAppleBootstrapPackageFunc(ctx, bp)
+	return s.InsertMDMAppleBootstrapPackageFunc(ctx, bp, pkgStore)
 }
 
 func (s *DataStore) CopyDefaultMDMAppleBootstrapPackage(ctx context.Context, ac *fleet.AppConfig, toTeamID uint) error {
@@ -5201,11 +5471,11 @@ func (s *DataStore) GetMDMAppleBootstrapPackageMeta(ctx context.Context, teamID
 	return s.GetMDMAppleBootstrapPackageMetaFunc(ctx, teamID)
 }
 
-func (s *DataStore) GetMDMAppleBootstrapPackageBytes(ctx context.Context, token string) (*fleet.MDMAppleBootstrapPackage, error) {
+func (s *DataStore) GetMDMAppleBootstrapPackageBytes(ctx context.Context, token string, pkgStore fleet.MDMBootstrapPackageStore) (*fleet.MDMAppleBootstrapPackage, error) {
 	s.mu.Lock()
 	s.GetMDMAppleBootstrapPackageBytesFuncInvoked = true
 	s.mu.Unlock()
-	return s.GetMDMAppleBootstrapPackageBytesFunc(ctx, token)
+	return s.GetMDMAppleBootstrapPackageBytesFunc(ctx, token, pkgStore)
 }
 
 func (s *DataStore) GetMDMAppleBootstrapPackageSummary(ctx context.Context, teamID uint) (*fleet.MDMAppleBootstrapPackageSummary, error) {
@@ -5222,6 +5492,13 @@ func (s *DataStore) RecordHostBootstrapPackage(ctx context.Context, commandUUID
 	return s.RecordHostBootstrapPackageFunc(ctx, commandUUID, hostUUID)
 }
 
+func (s *DataStore) CleanupUnusedBootstrapPackages(ctx context.Context, pkgStore fleet.MDMBootstrapPackageStore, removeCreatedBefore time.Time) error {
+	s.mu.Lock()
+	s.CleanupUnusedBootstrapPackagesFuncInvoked = true
+	s.mu.Unlock()
+	return s.CleanupUnusedBootstrapPackagesFunc(ctx, pkgStore, removeCreatedBefore)
+}
+
 func (s *DataStore) GetHostMDMMacOSSetup(ctx context.Context, hostID uint) (*fleet.HostMDMMacOSSetup, error) {
 	s.mu.Lock()
 	s.GetHostMDMMacOSSetupFuncInvoked = true
@@ -5271,6 +5548,13 @@ func (s *DataStore) GetMDMAppleSetupAssistant(ctx context.Context, teamID *uint)
 	return s.GetMDMAppleSetupAssistantFunc(ctx, teamID)
 }
 
+func (s *DataStore) GetMDMAppleSetupAssistantProfileForABMToken(ctx context.Context, teamID *uint, abmTokenOrgName string) (string, time.Time, error) {
+	s.mu.Lock()
+	s.GetMDMAppleSetupAssistantProfileForABMTokenFuncInvoked = true
+	s.mu.Unlock()
+	return s.GetMDMAppleSetupAssistantProfileForABMTokenFunc(ctx, teamID, abmTokenOrgName)
+}
+
 func (s *DataStore) DeleteMDMAppleSetupAssistant(ctx context.Context, teamID *uint) error {
 	s.mu.Lock()
 	s.DeleteMDMAppleSetupAssistantFuncInvoked = true
@@ -5278,25 +5562,25 @@ func (s *DataStore) DeleteMDMAppleSetupAssistant(ctx context.Context, teamID *ui
 	return s.DeleteMDMAppleSetupAssistantFunc(ctx, teamID)
 }
 
-func (s *DataStore) SetMDMAppleSetupAssistantProfileUUID(ctx context.Context, teamID *uint, profileUUID string) error {
+func (s *DataStore) SetMDMAppleSetupAssistantProfileUUID(ctx context.Context, teamID *uint, profileUUID string, abmTokenOrgName string) error {
 	s.mu.Lock()
 	s.SetMDMAppleSetupAssistantProfileUUIDFuncInvoked = true
 	s.mu.Unlock()
-	return s.SetMDMAppleSetupAssistantProfileUUIDFunc(ctx, teamID, profileUUID)
+	return s.SetMDMAppleSetupAssistantProfileUUIDFunc(ctx, teamID, profileUUID, abmTokenOrgName)
 }
 
-func (s *DataStore) SetMDMAppleDefaultSetupAssistantProfileUUID(ctx context.Context, teamID *uint, profileUUID string) error {
+func (s *DataStore) SetMDMAppleDefaultSetupAssistantProfileUUID(ctx context.Context, teamID *uint, profileUUID string, abmTokenOrgName string) error {
 	s.mu.Lock()
 	s.SetMDMAppleDefaultSetupAssistantProfileUUIDFuncInvoked = true
 	s.mu.Unlock()
-	return s.SetMDMAppleDefaultSetupAssistantProfileUUIDFunc(ctx, teamID, profileUUID)
+	return s.SetMDMAppleDefaultSetupAssistantProfileUUIDFunc(ctx, teamID, profileUUID, abmTokenOrgName)
 }
 
-func (s *DataStore) GetMDMAppleDefaultSetupAssistant(ctx context.Context, teamID *uint) (profileUUID string, updatedAt time.Time, err error) {
+func (s *DataStore) GetMDMAppleDefaultSetupAssistant(ctx context.Context, teamID *uint, abmTokenOrgName string) (profileUUID string, updatedAt time.Time, err error) {
 	s.mu.Lock()
 	s.GetMDMAppleDefaultSetupAssistantFuncInvoked = true
 	s.mu.Unlock()
-	return s.GetMDMAppleDefaultSetupAssistantFunc(ctx, teamID)
+	return s.GetMDMAppleDefaultSetupAssistantFunc(ctx, teamID, abmTokenOrgName)
 }
 
 func (s *DataStore) GetMatchingHostSerials(ctx context.Context, serials []string) (map[string]*fleet.Host, error) {
@@ -5320,7 +5604,7 @@ func (s *DataStore) UpdateHostDEPAssignProfileResponses(ctx context.Context, res
 	return s.UpdateHostDEPAssignProfileResponsesFunc(ctx, resp)
 }
 
-func (s *DataStore) ScreenDEPAssignProfileSerialsForCooldown(ctx context.Context, serials []string) (skipSerials []string, assignSerials []string, err error) {
+func (s *DataStore) ScreenDEPAssignProfileSerialsForCooldown(ctx context.Context, serials []string) (skipSerialsByOrgName map[string][]string, serialsByOrgName map[string][]string, err error) {
 	s.mu.Lock()
 	s.ScreenDEPAssignProfileSerialsForCooldownFuncInvoked = true
 	s.mu.Unlock()
@@ -5390,6 +5674,13 @@ func (s *DataStore) MDMAppleSetPendingDeclarationsAs(ctx context.Context, hostUU
 	return s.MDMAppleSetPendingDeclarationsAsFunc(ctx, hostUUID, status, detail)
 }
 
+func (s *DataStore) GetMDMAppleOSUpdatesSettingsByHostSerial(ctx context.Context, hostSerial string) (*fleet.AppleOSUpdateSettings, error) {
+	s.mu.Lock()
+	s.GetMDMAppleOSUpdatesSettingsByHostSerialFuncInvoked = true
+	s.mu.Unlock()
+	return s.GetMDMAppleOSUpdatesSettingsByHostSerialFunc(ctx, hostSerial)
+}
+
 func (s *DataStore) InsertMDMConfigAssets(ctx context.Context, assets []fleet.MDMConfigAsset) error {
 	s.mu.Lock()
 	s.InsertMDMConfigAssetsFuncInvoked = true
@@ -5425,6 +5716,125 @@ func (s *DataStore) ReplaceMDMConfigAssets(ctx context.Context, assets []fleet.M
 	return s.ReplaceMDMConfigAssetsFunc(ctx, assets)
 }
 
+func (s *DataStore) GetABMTokenByOrgName(ctx context.Context, orgName string) (*fleet.ABMToken, error) {
+	s.mu.Lock()
+	s.GetABMTokenByOrgNameFuncInvoked = true
+	s.mu.Unlock()
+	return s.GetABMTokenByOrgNameFunc(ctx, orgName)
+}
+
+func (s *DataStore) SaveABMToken(ctx context.Context, tok *fleet.ABMToken) error {
+	s.mu.Lock()
+	s.SaveABMTokenFuncInvoked = true
+	s.mu.Unlock()
+	return s.SaveABMTokenFunc(ctx, tok)
+}
+
+func (s *DataStore) InsertVPPToken(ctx context.Context, tok *fleet.VPPTokenData) (*fleet.VPPTokenDB, error) {
+	s.mu.Lock()
+	s.InsertVPPTokenFuncInvoked = true
+	s.mu.Unlock()
+	return s.InsertVPPTokenFunc(ctx, tok)
+}
+
+func (s *DataStore) ListVPPTokens(ctx context.Context) ([]*fleet.VPPTokenDB, error) {
+	s.mu.Lock()
+	s.ListVPPTokensFuncInvoked = true
+	s.mu.Unlock()
+	return s.ListVPPTokensFunc(ctx)
+}
+
+func (s *DataStore) GetVPPToken(ctx context.Context, tokenID uint) (*fleet.VPPTokenDB, error) {
+	s.mu.Lock()
+	s.GetVPPTokenFuncInvoked = true
+	s.mu.Unlock()
+	return s.GetVPPTokenFunc(ctx, tokenID)
+}
+
+func (s *DataStore) GetVPPTokenByTeamID(ctx context.Context, teamID *uint) (*fleet.VPPTokenDB, error) {
+	s.mu.Lock()
+	s.GetVPPTokenByTeamIDFuncInvoked = true
+	s.mu.Unlock()
+	return s.GetVPPTokenByTeamIDFunc(ctx, teamID)
+}
+
+func (s *DataStore) UpdateVPPTokenTeams(ctx context.Context, id uint, teams []uint) (*fleet.VPPTokenDB, error) {
+	s.mu.Lock()
+	s.UpdateVPPTokenTeamsFuncInvoked = true
+	s.mu.Unlock()
+	return s.UpdateVPPTokenTeamsFunc(ctx, id, teams)
+}
+
+func (s *DataStore) UpdateVPPToken(ctx context.Context, id uint, tok *fleet.VPPTokenData) (*fleet.VPPTokenDB, error) {
+	s.mu.Lock()
+	s.UpdateVPPTokenFuncInvoked = true
+	s.mu.Unlock()
+	return s.UpdateVPPTokenFunc(ctx, id, tok)
+}
+
+func (s *DataStore) DeleteVPPToken(ctx context.Context, tokenID uint) error {
+	s.mu.Lock()
+	s.DeleteVPPTokenFuncInvoked = true
+	s.mu.Unlock()
+	return s.DeleteVPPTokenFunc(ctx, tokenID)
+}
+
+func (s *DataStore) SetABMTokenTermsExpiredForOrgName(ctx context.Context, orgName string, expired bool) (wasSet bool, err error) {
+	s.mu.Lock()
+	s.SetABMTokenTermsExpiredForOrgNameFuncInvoked = true
+	s.mu.Unlock()
+	return s.SetABMTokenTermsExpiredForOrgNameFunc(ctx, orgName, expired)
+}
+
+func (s *DataStore) CountABMTokensWithTermsExpired(ctx context.Context) (int, error) {
+	s.mu.Lock()
+	s.CountABMTokensWithTermsExpiredFuncInvoked = true
+	s.mu.Unlock()
+	return s.CountABMTokensWithTermsExpiredFunc(ctx)
+}
+
+func (s *DataStore) InsertABMToken(ctx context.Context, tok *fleet.ABMToken) (*fleet.ABMToken, error) {
+	s.mu.Lock()
+	s.InsertABMTokenFuncInvoked = true
+	s.mu.Unlock()
+	return s.InsertABMTokenFunc(ctx, tok)
+}
+
+func (s *DataStore) ListABMTokens(ctx context.Context) ([]*fleet.ABMToken, error) {
+	s.mu.Lock()
+	s.ListABMTokensFuncInvoked = true
+	s.mu.Unlock()
+	return s.ListABMTokensFunc(ctx)
+}
+
+func (s *DataStore) DeleteABMToken(ctx context.Context, tokenID uint) error {
+	s.mu.Lock()
+	s.DeleteABMTokenFuncInvoked = true
+	s.mu.Unlock()
+	return s.DeleteABMTokenFunc(ctx, tokenID)
+}
+
+func (s *DataStore) GetABMTokenByID(ctx context.Context, tokenID uint) (*fleet.ABMToken, error) {
+	s.mu.Lock()
+	s.GetABMTokenByIDFuncInvoked = true
+	s.mu.Unlock()
+	return s.GetABMTokenByIDFunc(ctx, tokenID)
+}
+
+func (s *DataStore) GetABMTokenCount(ctx context.Context) (int, error) {
+	s.mu.Lock()
+	s.GetABMTokenCountFuncInvoked = true
+	s.mu.Unlock()
+	return s.GetABMTokenCountFunc(ctx)
+}
+
+func (s *DataStore) GetABMTokenOrgNamesAssociatedWithTeam(ctx context.Context, teamID *uint) ([]string, error) {
+	s.mu.Lock()
+	s.GetABMTokenOrgNamesAssociatedWithTeamFuncInvoked = true
+	s.mu.Unlock()
+	return s.GetABMTokenOrgNamesAssociatedWithTeamFunc(ctx, teamID)
+}
+
 func (s *DataStore) WSTEPStoreCertificate(ctx context.Context, name string, crt *x509.Certificate) error {
 	s.mu.Lock()
 	s.WSTEPStoreCertificateFuncInvoked = true
@@ -5642,7 +6052,7 @@ func (s *DataStore) SetOrUpdateMDMWindowsConfigProfile(ctx context.Context, cp f
 	return s.SetOrUpdateMDMWindowsConfigProfileFunc(ctx, cp)
 }
 
-func (s *DataStore) BatchSetMDMProfiles(ctx context.Context, tmID *uint, macProfiles []*fleet.MDMAppleConfigProfile, winProfiles []*fleet.MDMWindowsConfigProfile, macDeclarations []*fleet.MDMAppleDeclaration) error {
+func (s *DataStore) BatchSetMDMProfiles(ctx context.Context, tmID *uint, macProfiles []*fleet.MDMAppleConfigProfile, winProfiles []*fleet.MDMWindowsConfigProfile, macDeclarations []*fleet.MDMAppleDeclaration) (updates fleet.MDMProfilesUpdates, err error) {
 	s.mu.Lock()
 	s.BatchSetMDMProfilesFuncInvoked = true
 	s.mu.Unlock()
@@ -5670,7 +6080,7 @@ func (s *DataStore) NewHostScriptExecutionRequest(ctx context.Context, request *
 	return s.NewHostScriptExecutionRequestFunc(ctx, request)
 }
 
-func (s *DataStore) SetHostScriptExecutionResult(ctx context.Context, result *fleet.HostScriptResultPayload) (*fleet.HostScriptResult, error) {
+func (s *DataStore) SetHostScriptExecutionResult(ctx context.Context, result *fleet.HostScriptResultPayload) (hsr *fleet.HostScriptResult, action string, err error) {
 	s.mu.Lock()
 	s.SetHostScriptExecutionResultFuncInvoked = true
 	s.mu.Unlock()
@@ -5712,6 +6122,13 @@ func (s *DataStore) GetScriptContents(ctx context.Context, id uint) ([]byte, err
 	return s.GetScriptContentsFunc(ctx, id)
 }
 
+func (s *DataStore) GetAnyScriptContents(ctx context.Context, id uint) ([]byte, error) {
+	s.mu.Lock()
+	s.GetAnyScriptContentsFuncInvoked = true
+	s.mu.Unlock()
+	return s.GetAnyScriptContentsFunc(ctx, id)
+}
+
 func (s *DataStore) DeleteScript(ctx context.Context, id uint) error {
 	s.mu.Lock()
 	s.DeleteScriptFuncInvoked = true
@@ -5831,6 +6248,13 @@ func (s *DataStore) ListPendingSoftwareInstalls(ctx context.Context, hostID uint
 	return s.ListPendingSoftwareInstallsFunc(ctx, hostID)
 }
 
+func (s *DataStore) GetHostLastInstallData(ctx context.Context, hostID uint, installerID uint) (*fleet.HostLastInstallData, error) {
+	s.mu.Lock()
+	s.GetHostLastInstallDataFuncInvoked = true
+	s.mu.Unlock()
+	return s.GetHostLastInstallDataFunc(ctx, hostID, installerID)
+}
+
 func (s *DataStore) MatchOrCreateSoftwareInstaller(ctx context.Context, payload *fleet.UploadSoftwareInstallerPayload) (uint, error) {
 	s.mu.Lock()
 	s.MatchOrCreateSoftwareInstallerFuncInvoked = true
@@ -5845,6 +6269,13 @@ func (s *DataStore) GetSoftwareInstallerMetadataByID(ctx context.Context, id uin
 	return s.GetSoftwareInstallerMetadataByIDFunc(ctx, id)
 }
 
+func (s *DataStore) ValidateOrbitSoftwareInstallerAccess(ctx context.Context, hostID uint, installerID uint) (bool, error) {
+	s.mu.Lock()
+	s.ValidateOrbitSoftwareInstallerAccessFuncInvoked = true
+	s.mu.Unlock()
+	return s.ValidateOrbitSoftwareInstallerAccessFunc(ctx, hostID, installerID)
+}
+
 func (s *DataStore) GetSoftwareInstallerMetadataByTeamAndTitleID(ctx context.Context, teamID *uint, titleID uint, withScriptContents bool) (*fleet.SoftwareInstaller, error) {
 	s.mu.Lock()
 	s.GetSoftwareInstallerMetadataByTeamAndTitleIDFuncInvoked = true
@@ -5852,11 +6283,46 @@ func (s *DataStore) GetSoftwareInstallerMetadataByTeamAndTitleID(ctx context.Con
 	return s.GetSoftwareInstallerMetadataByTeamAndTitleIDFunc(ctx, teamID, titleID, withScriptContents)
 }
 
-func (s *DataStore) GetVPPAppByTeamAndTitleID(ctx context.Context, teamID *uint, titleID uint, withScriptContents bool) (*fleet.VPPApp, error) {
+func (s *DataStore) GetSoftwareInstallersWithoutPackageIDs(ctx context.Context) (map[uint]string, error) {
+	s.mu.Lock()
+	s.GetSoftwareInstallersWithoutPackageIDsFuncInvoked = true
+	s.mu.Unlock()
+	return s.GetSoftwareInstallersWithoutPackageIDsFunc(ctx)
+}
+
+func (s *DataStore) UpdateSoftwareInstallerWithoutPackageIDs(ctx context.Context, id uint, payload fleet.UploadSoftwareInstallerPayload) error {
+	s.mu.Lock()
+	s.UpdateSoftwareInstallerWithoutPackageIDsFuncInvoked = true
+	s.mu.Unlock()
+	return s.UpdateSoftwareInstallerWithoutPackageIDsFunc(ctx, id, payload)
+}
+
+func (s *DataStore) ProcessInstallerUpdateSideEffects(ctx context.Context, installerID uint, wasMetadataUpdated bool, wasPackageUpdated bool) error {
+	s.mu.Lock()
+	s.ProcessInstallerUpdateSideEffectsFuncInvoked = true
+	s.mu.Unlock()
+	return s.ProcessInstallerUpdateSideEffectsFunc(ctx, installerID, wasMetadataUpdated, wasPackageUpdated)
+}
+
+func (s *DataStore) SaveInstallerUpdates(ctx context.Context, payload *fleet.UpdateSoftwareInstallerPayload) error {
+	s.mu.Lock()
+	s.SaveInstallerUpdatesFuncInvoked = true
+	s.mu.Unlock()
+	return s.SaveInstallerUpdatesFunc(ctx, payload)
+}
+
+func (s *DataStore) UpdateInstallerSelfServiceFlag(ctx context.Context, selfService bool, id uint) error {
+	s.mu.Lock()
+	s.UpdateInstallerSelfServiceFlagFuncInvoked = true
+	s.mu.Unlock()
+	return s.UpdateInstallerSelfServiceFlagFunc(ctx, selfService, id)
+}
+
+func (s *DataStore) GetVPPAppByTeamAndTitleID(ctx context.Context, teamID *uint, titleID uint) (*fleet.VPPApp, error) {
 	s.mu.Lock()
 	s.GetVPPAppByTeamAndTitleIDFuncInvoked = true
 	s.mu.Unlock()
-	return s.GetVPPAppByTeamAndTitleIDFunc(ctx, teamID, titleID, withScriptContents)
+	return s.GetVPPAppByTeamAndTitleIDFunc(ctx, teamID, titleID)
 }
 
 func (s *DataStore) GetVPPAppMetadataByTeamAndTitleID(ctx context.Context, teamID *uint, titleID uint) (*fleet.VPPAppStoreApp, error) {
@@ -5901,11 +6367,11 @@ func (s *DataStore) GetSoftwareInstallResults(ctx context.Context, resultsUUID s
 	return s.GetSoftwareInstallResultsFunc(ctx, resultsUUID)
 }
 
-func (s *DataStore) CleanupUnusedSoftwareInstallers(ctx context.Context, softwareInstallStore fleet.SoftwareInstallerStore) error {
+func (s *DataStore) CleanupUnusedSoftwareInstallers(ctx context.Context, softwareInstallStore fleet.SoftwareInstallerStore, removeCreatedBefore time.Time) error {
 	s.mu.Lock()
 	s.CleanupUnusedSoftwareInstallersFuncInvoked = true
 	s.mu.Unlock()
-	return s.CleanupUnusedSoftwareInstallersFunc(ctx, softwareInstallStore)
+	return s.CleanupUnusedSoftwareInstallersFunc(ctx, softwareInstallStore, removeCreatedBefore)
 }
 
 func (s *DataStore) BatchSetSoftwareInstallers(ctx context.Context, tmID *uint, installers []*fleet.UploadSoftwareInstallerPayload) error {
@@ -5915,6 +6381,13 @@ func (s *DataStore) BatchSetSoftwareInstallers(ctx context.Context, tmID *uint,
 	return s.BatchSetSoftwareInstallersFunc(ctx, tmID, installers)
 }
 
+func (s *DataStore) GetSoftwareInstallers(ctx context.Context, tmID uint) ([]fleet.SoftwarePackageResponse, error) {
+	s.mu.Lock()
+	s.GetSoftwareInstallersFuncInvoked = true
+	s.mu.Unlock()
+	return s.GetSoftwareInstallersFunc(ctx, tmID)
+}
+
 func (s *DataStore) HasSelfServiceSoftwareInstallers(ctx context.Context, platform string, teamID *uint) (bool, error) {
 	s.mu.Lock()
 	s.HasSelfServiceSoftwareInstallersFuncInvoked = true
@@ -5929,14 +6402,14 @@ func (s *DataStore) BatchInsertVPPApps(ctx context.Context, apps []*fleet.VPPApp
 	return s.BatchInsertVPPAppsFunc(ctx, apps)
 }
 
-func (s *DataStore) GetAssignedVPPApps(ctx context.Context, teamID *uint) (map[fleet.VPPAppID]struct{}, error) {
+func (s *DataStore) GetAssignedVPPApps(ctx context.Context, teamID *uint) (map[fleet.VPPAppID]fleet.VPPAppTeam, error) {
 	s.mu.Lock()
 	s.GetAssignedVPPAppsFuncInvoked = true
 	s.mu.Unlock()
 	return s.GetAssignedVPPAppsFunc(ctx, teamID)
 }
 
-func (s *DataStore) SetTeamVPPApps(ctx context.Context, teamID *uint, appIDs []fleet.VPPAppID) error {
+func (s *DataStore) SetTeamVPPApps(ctx context.Context, teamID *uint, appIDs []fleet.VPPAppTeam) error {
 	s.mu.Lock()
 	s.SetTeamVPPAppsFuncInvoked = true
 	s.mu.Unlock()
@@ -5950,11 +6423,11 @@ func (s *DataStore) InsertVPPAppWithTeam(ctx context.Context, app *fleet.VPPApp,
 	return s.InsertVPPAppWithTeamFunc(ctx, app, teamID)
 }
 
-func (s *DataStore) InsertHostVPPSoftwareInstall(ctx context.Context, hostID uint, userID uint, appID fleet.VPPAppID, commandUUID string, associatedEventID string) error {
+func (s *DataStore) InsertHostVPPSoftwareInstall(ctx context.Context, hostID uint, appID fleet.VPPAppID, commandUUID string, associatedEventID string, selfService bool) error {
 	s.mu.Lock()
 	s.InsertHostVPPSoftwareInstallFuncInvoked = true
 	s.mu.Unlock()
-	return s.InsertHostVPPSoftwareInstallFunc(ctx, hostID, userID, appID, commandUUID, associatedEventID)
+	return s.InsertHostVPPSoftwareInstallFunc(ctx, hostID, appID, commandUUID, associatedEventID, selfService)
 }
 
 func (s *DataStore) GetPastActivityDataForVPPAppInstall(ctx context.Context, commandResults *mdm.CommandResults) (*fleet.User, *fleet.ActivityInstalledAppStoreApp, error) {
@@ -5963,3 +6436,10 @@ func (s *DataStore) GetPastActivityDataForVPPAppInstall(ctx context.Context, com
 	s.mu.Unlock()
 	return s.GetPastActivityDataForVPPAppInstallFunc(ctx, commandResults)
 }
+
+func (s *DataStore) GetVPPTokenByLocation(ctx context.Context, loc string) (*fleet.VPPTokenDB, error) {
+	s.mu.Lock()
+	s.GetVPPTokenByLocationFuncInvoked = true
+	s.mu.Unlock()
+	return s.GetVPPTokenByLocationFunc(ctx, loc)
+}
diff --git a/server/mock/mdm/datastore_mdm_mock.go b/server/mock/mdm/datastore_mdm_mock.go
index 05d9db687d..78141b2525 100644
--- a/server/mock/mdm/datastore_mdm_mock.go
+++ b/server/mock/mdm/datastore_mdm_mock.go
@@ -56,6 +56,8 @@ type RetrieveTokenUpdateTallyFunc func(ctx context.Context, id string) (int, err
 
 type GetAllMDMConfigAssetsByNameFunc func(ctx context.Context, assetNames []fleet.MDMAssetName) (map[fleet.MDMAssetName]fleet.MDMConfigAsset, error)
 
+type GetABMTokenByOrgNameFunc func(ctx context.Context, orgName string) (*fleet.ABMToken, error)
+
 type EnqueueDeviceLockCommandFunc func(ctx context.Context, host *fleet.Host, cmd *mdm.Command, pin string) error
 
 type EnqueueDeviceWipeCommandFunc func(ctx context.Context, host *fleet.Host, cmd *mdm.Command) error
@@ -124,6 +126,9 @@ type MDMAppleStore struct {
 	GetAllMDMConfigAssetsByNameFunc        GetAllMDMConfigAssetsByNameFunc
 	GetAllMDMConfigAssetsByNameFuncInvoked bool
 
+	GetABMTokenByOrgNameFunc        GetABMTokenByOrgNameFunc
+	GetABMTokenByOrgNameFuncInvoked bool
+
 	EnqueueDeviceLockCommandFunc        EnqueueDeviceLockCommandFunc
 	EnqueueDeviceLockCommandFuncInvoked bool
 
@@ -280,6 +285,13 @@ func (fs *MDMAppleStore) GetAllMDMConfigAssetsByName(ctx context.Context, assetN
 	return fs.GetAllMDMConfigAssetsByNameFunc(ctx, assetNames)
 }
 
+func (fs *MDMAppleStore) GetABMTokenByOrgName(ctx context.Context, orgName string) (*fleet.ABMToken, error) {
+	fs.mu.Lock()
+	fs.GetABMTokenByOrgNameFuncInvoked = true
+	fs.mu.Unlock()
+	return fs.GetABMTokenByOrgNameFunc(ctx, orgName)
+}
+
 func (fs *MDMAppleStore) EnqueueDeviceLockCommand(ctx context.Context, host *fleet.Host, cmd *mdm.Command, pin string) error {
 	fs.mu.Lock()
 	fs.EnqueueDeviceLockCommandFuncInvoked = true
diff --git a/server/service/activities.go b/server/service/activities.go
index cdab1837f1..861c873095 100644
--- a/server/service/activities.go
+++ b/server/service/activities.go
@@ -85,7 +85,12 @@ func newActivity(ctx context.Context, user *fleet.User, activity fleet.ActivityD
 		var userName *string
 		var userEmail *string
 		if user != nil {
-			userID = &user.ID
+			// To support creating activities with users that were deleted. This can happen
+			// for automatically installed software which uses the author of the upload as the author of
+			// the installation.
+			if user.ID != 0 {
+				userID = &user.ID
+			}
 			userName = &user.Name
 			userEmail = &user.Email
 		}
diff --git a/server/service/appconfig.go b/server/service/appconfig.go
index 04079821f7..17b83dcbbf 100644
--- a/server/service/appconfig.go
+++ b/server/service/appconfig.go
@@ -25,6 +25,7 @@ import (
 	"github.com/fleetdm/fleet/v4/server/fleet"
 	"github.com/fleetdm/fleet/v4/server/version"
 	"github.com/go-kit/log/level"
+	"golang.org/x/text/unicode/norm"
 )
 
 ////////////////////////////////////////////////////////////////////////////////
@@ -413,6 +414,16 @@ func (svc *Service) ModifyAppConfig(ctx context.Context, p []byte, applyOpts fle
 		return nil, ctxerr.Wrap(ctx, err, "validating MDM config")
 	}
 
+	abmAssignments, err := svc.validateABMAssignments(ctx, &newAppConfig.MDM, &oldAppConfig.MDM, invalid, license)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "validating ABM token assignments")
+	}
+
+	vppAssignments, err := svc.validateVPPAssignments(ctx, &newAppConfig.MDM, invalid, license)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "validating VPP token assignments")
+	}
+
 	if invalid.HasErrors() {
 		return nil, ctxerr.Wrap(ctx, invalid)
 	}
@@ -534,6 +545,27 @@ func (svc *Service) ModifyAppConfig(ctx context.Context, p []byte, applyOpts fle
 		}
 	}
 
+	if (appConfig.MDM.AppleBusinessManager.Set && appConfig.MDM.AppleBusinessManager.Valid) || appConfig.MDM.DeprecatedAppleBMDefaultTeam != "" {
+		for _, tok := range abmAssignments {
+			fmt.Println(tok.EncryptedToken)
+			if err := svc.ds.SaveABMToken(ctx, tok); err != nil {
+				return nil, ctxerr.Wrap(ctx, err, "saving ABM token assignments")
+			}
+		}
+	}
+
+	if appConfig.MDM.VolumePurchasingProgram.Set && appConfig.MDM.VolumePurchasingProgram.Valid {
+		for tokenID, tokenTeams := range vppAssignments {
+			if _, err := svc.ds.UpdateVPPTokenTeams(ctx, tokenID, tokenTeams); err != nil {
+				var errTokConstraint fleet.ErrVPPTokenTeamConstraint
+				if errors.As(err, &errTokConstraint) {
+					return nil, ctxerr.Wrap(ctx, fleet.NewUserMessageError(errTokConstraint, http.StatusConflict))
+				}
+				return nil, ctxerr.Wrap(ctx, err, "saving ABM token assignments")
+			}
+		}
+	}
+
 	// retrieve new app config with obfuscated secrets
 	obfuscatedAppConfig, err := svc.ds.AppConfig(ctx)
 	if err != nil {
@@ -808,21 +840,11 @@ func (svc *Service) validateMDM(
 			len(mdm.WindowsSettings.CustomSettings.Value) > 0 &&
 			!fleet.MDMProfileSpecsMatch(mdm.WindowsSettings.CustomSettings.Value, oldMdm.WindowsSettings.CustomSettings.Value) {
 			invalid.Append("windows_settings.custom_settings",
-				`Couldn’t edit windows_settings.custom_settings. Windows MDM isn’t turned on. Visit https://fleetdm.com/docs/using-fleet to learn how to turn on MDM.`)
+				`Couldn’t edit windows_settings.custom_settings. Windows MDM isn’t turned on. This can be enabled by setting "controls.windows_enabled_and_configured: true" in the default configuration. Visit https://fleetdm.com/guides/windows-mdm-setup and https://fleetdm.com/docs/configuration/yaml-files#controls to learn more about enabling MDM.`)
 		}
 	}
 	checkCustomSettings("windows", mdm.WindowsSettings.CustomSettings.Value)
 
-	if name := mdm.AppleBMDefaultTeam; name != "" && name != oldMdm.AppleBMDefaultTeam {
-		if !license.IsPremium() {
-			invalid.Append("mdm.apple_bm_default_team", ErrMissingLicense.Error())
-			return nil
-		}
-		if _, err := svc.ds.TeamByName(ctx, name); err != nil {
-			invalid.Append("apple_bm_default_team", "team name not found")
-		}
-	}
-
 	// MacOSUpdates
 	updatingMacOSVersion := mdm.MacOSUpdates.MinimumVersion.Value != "" &&
 		mdm.MacOSUpdates.MinimumVersion != oldMdm.MacOSUpdates.MinimumVersion
@@ -947,6 +969,182 @@ func (svc *Service) validateMDM(
 	return nil
 }
 
+func (svc *Service) validateABMAssignments(
+	ctx context.Context,
+	mdm, oldMdm *fleet.MDM,
+	invalid *fleet.InvalidArgumentError,
+	license *fleet.LicenseInfo,
+) ([]*fleet.ABMToken, error) {
+	if mdm.DeprecatedAppleBMDefaultTeam != "" && mdm.AppleBusinessManager.Set && mdm.AppleBusinessManager.Valid {
+		invalid.Append("mdm.apple_bm_default_team", fleet.AppleABMDefaultTeamDeprecatedMessage)
+		return nil, nil
+	}
+
+	if name := mdm.DeprecatedAppleBMDefaultTeam; name != "" && name != oldMdm.DeprecatedAppleBMDefaultTeam {
+		if !license.IsPremium() {
+			invalid.Append("mdm.apple_bm_default_team", ErrMissingLicense.Error())
+			return nil, nil
+		}
+		team, err := svc.ds.TeamByName(ctx, name)
+		if err != nil {
+			invalid.Append("mdm.apple_bm_default_team", "team name not found")
+			return nil, nil
+		}
+		tokens, err := svc.ds.ListABMTokens(ctx)
+		if err != nil {
+			return nil, err
+		}
+
+		if len(tokens) > 1 {
+			invalid.Append("mdm.apple_bm_default_team", fleet.AppleABMDefaultTeamDeprecatedMessage)
+			return nil, nil
+		}
+
+		if len(tokens) == 0 {
+			invalid.Append("mdm.apple_bm_default_team", "no ABM tokens found")
+			return nil, nil
+		}
+
+		tok := tokens[0]
+		tok.MacOSDefaultTeamID = &team.ID
+		tok.IOSDefaultTeamID = &team.ID
+		tok.IPadOSDefaultTeamID = &team.ID
+
+		return []*fleet.ABMToken{tok}, nil
+	}
+
+	if mdm.AppleBusinessManager.Set && mdm.AppleBusinessManager.Valid {
+		if !license.IsPremium() {
+			invalid.Append("mdm.apple_business_manager", ErrMissingLicense.Error())
+			return nil, nil
+		}
+
+		teams, err := svc.ds.TeamsSummary(ctx)
+		if err != nil {
+			return nil, err
+		}
+		teamsByName := map[string]*uint{"": nil, "No team": nil}
+		for _, tm := range teams {
+			teamsByName[tm.Name] = &tm.ID
+		}
+		tokens, err := svc.ds.ListABMTokens(ctx)
+		if err != nil {
+			return nil, err
+		}
+		tokensByName := map[string]*fleet.ABMToken{}
+		for _, token := range tokens {
+			// The default assignments for all tokens is "no team"
+			// (ie: team_id IS NULL), here we reset the assignments
+			// for all tokens, those will be re-added below.
+			//
+			// This ensures any unassignments are properly handled.
+			token.MacOSDefaultTeamID = nil
+			token.IOSDefaultTeamID = nil
+			token.IPadOSDefaultTeamID = nil
+			tokensByName[token.OrganizationName] = token
+		}
+
+		var tokensToSave []*fleet.ABMToken
+		for _, bm := range mdm.AppleBusinessManager.Value {
+			for _, tmName := range []string{bm.MacOSTeam, bm.IOSTeam, bm.IpadOSTeam} {
+				if _, ok := teamsByName[norm.NFC.String(tmName)]; !ok {
+					invalid.Appendf("mdm.apple_business_manager", "team %s doesn't exist", tmName)
+					return nil, nil
+				}
+			}
+
+			if _, ok := tokensByName[norm.NFC.String(bm.OrganizationName)]; !ok {
+				invalid.Appendf("mdm.apple_business_manager", "token with organization name %s doesn't exist", bm.OrganizationName)
+				return nil, nil
+			}
+
+			tok := tokensByName[bm.OrganizationName]
+			tok.MacOSDefaultTeamID = teamsByName[bm.MacOSTeam]
+			tok.IOSDefaultTeamID = teamsByName[bm.IOSTeam]
+			tok.IPadOSDefaultTeamID = teamsByName[bm.IpadOSTeam]
+			tokensToSave = append(tokensToSave, tok)
+		}
+
+		return tokensToSave, nil
+	}
+
+	return nil, nil
+}
+
+func (svc *Service) validateVPPAssignments(
+	ctx context.Context,
+	mdm *fleet.MDM,
+	invalid *fleet.InvalidArgumentError,
+	license *fleet.LicenseInfo,
+) (map[uint][]uint, error) {
+	if mdm.VolumePurchasingProgram.Set && mdm.VolumePurchasingProgram.Valid {
+		if !license.IsPremium() {
+			invalid.Append("mdm.volume_purchasing_program", ErrMissingLicense.Error())
+			return nil, nil
+		}
+
+		teams, err := svc.ds.TeamsSummary(ctx)
+		if err != nil {
+			return nil, err
+		}
+		teamsByName := map[string]uint{fleet.TeamNameNoTeam: 0}
+		for _, tm := range teams {
+			teamsByName[tm.Name] = tm.ID
+		}
+		tokens, err := svc.ds.ListVPPTokens(ctx)
+		if err != nil {
+			return nil, err
+		}
+		tokensByLocation := map[string]*fleet.VPPTokenDB{}
+		for _, token := range tokens {
+			// The default assignments for all tokens is "no team"
+			// (ie: team_id IS NULL), here we reset the assignments
+			// for all tokens, those will be re-added below.
+			//
+			// This ensures any unassignments are properly handled.
+			tokensByLocation[token.Location] = token
+			token.Teams = nil
+		}
+
+		tokensToSave := make(map[uint][]uint, len(mdm.VolumePurchasingProgram.Value))
+		for _, vpp := range mdm.VolumePurchasingProgram.Value {
+			for _, tmName := range vpp.Teams {
+				if _, ok := teamsByName[norm.NFC.String(tmName)]; !ok && tmName != fleet.TeamNameAllTeams {
+					invalid.Appendf("mdm.volume_purchasing_program", "team %s doesn't exist", tmName)
+					return nil, nil
+				}
+			}
+
+			loc := norm.NFC.String(vpp.Location)
+			if _, ok := tokensByLocation[loc]; !ok {
+				invalid.Appendf("mdm.volume_purchasing_program", "token with location %s doesn't exist", vpp.Location)
+				return nil, nil
+			}
+
+			var tokenTeams []uint
+			for _, teamName := range vpp.Teams {
+				if teamName == fleet.TeamNameAllTeams {
+					if len(vpp.Teams) > 1 {
+						invalid.Appendf("mdm.volume_purchasing_program", "token cannot belong to %s and other teams", fleet.TeamNameAllTeams)
+						return nil, nil
+					}
+					tokenTeams = []uint{}
+					break
+				}
+				teamID := teamsByName[teamName]
+				tokenTeams = append(tokenTeams, teamID)
+			}
+
+			tok := tokensByLocation[loc]
+			tokensToSave[tok.ID] = tokenTeams
+		}
+
+		return tokensToSave, nil
+	}
+
+	return nil, nil
+}
+
 func validateSSOProviderSettings(incoming, existing fleet.SSOProviderSettings, invalid *fleet.InvalidArgumentError) {
 	if incoming.Metadata == "" && incoming.MetadataURL == "" {
 		if existing.Metadata == "" && existing.MetadataURL == "" {
diff --git a/server/service/appconfig_test.go b/server/service/appconfig_test.go
index 8a2905458d..0fb0d318d2 100644
--- a/server/service/appconfig_test.go
+++ b/server/service/appconfig_test.go
@@ -858,11 +858,13 @@ func TestMDMAppleConfig(t *testing.T) {
 			name:        "nochange",
 			licenseTier: "free",
 			expectedMDM: fleet.MDM{
-				MacOSSetup:     fleet.MacOSSetup{BootstrapPackage: optjson.String{Set: true}, MacOSSetupAssistant: optjson.String{Set: true}, EnableReleaseDeviceManually: optjson.SetBool(false)},
-				MacOSUpdates:   fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
-				IOSUpdates:     fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
-				IPadOSUpdates:  fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
-				WindowsUpdates: fleet.WindowsUpdates{DeadlineDays: optjson.Int{Set: true}, GracePeriodDays: optjson.Int{Set: true}},
+				AppleBusinessManager:    optjson.Slice[fleet.MDMAppleABMAssignmentInfo]{Set: true, Value: []fleet.MDMAppleABMAssignmentInfo{}},
+				MacOSSetup:              fleet.MacOSSetup{BootstrapPackage: optjson.String{Set: true}, MacOSSetupAssistant: optjson.String{Set: true}, EnableReleaseDeviceManually: optjson.SetBool(false)},
+				MacOSUpdates:            fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
+				IOSUpdates:              fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
+				IPadOSUpdates:           fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
+				VolumePurchasingProgram: optjson.Slice[fleet.MDMAppleVolumePurchasingProgramInfo]{Set: true, Value: []fleet.MDMAppleVolumePurchasingProgramInfo{}},
+				WindowsUpdates:          fleet.WindowsUpdates{DeadlineDays: optjson.Int{Set: true}, GracePeriodDays: optjson.Int{Set: true}},
 				WindowsSettings: fleet.WindowsSettings{
 					CustomSettings: optjson.Slice[fleet.MDMProfileSpec]{Set: true, Value: []fleet.MDMProfileSpec{}},
 				},
@@ -870,31 +872,33 @@ func TestMDMAppleConfig(t *testing.T) {
 		}, {
 			name:          "newDefaultTeamNoLicense",
 			licenseTier:   "free",
-			newMDM:        fleet.MDM{AppleBMDefaultTeam: "foobar"},
+			newMDM:        fleet.MDM{DeprecatedAppleBMDefaultTeam: "foobar"},
 			expectedError: licenseErr,
 		}, {
 			name:          "notFoundNew",
 			licenseTier:   "premium",
-			newMDM:        fleet.MDM{AppleBMDefaultTeam: "foobar"},
+			newMDM:        fleet.MDM{DeprecatedAppleBMDefaultTeam: "foobar"},
 			expectedError: notFoundErr,
 		}, {
 			name:          "notFoundEdit",
 			licenseTier:   "premium",
-			oldMDM:        fleet.MDM{AppleBMDefaultTeam: "foobar"},
-			newMDM:        fleet.MDM{AppleBMDefaultTeam: "bar"},
+			oldMDM:        fleet.MDM{DeprecatedAppleBMDefaultTeam: "foobar"},
+			newMDM:        fleet.MDM{DeprecatedAppleBMDefaultTeam: "bar"},
 			expectedError: notFoundErr,
 		}, {
 			name:        "foundNew",
 			licenseTier: "premium",
 			findTeam:    true,
-			newMDM:      fleet.MDM{AppleBMDefaultTeam: "foobar"},
+			newMDM:      fleet.MDM{DeprecatedAppleBMDefaultTeam: "foobar"},
 			expectedMDM: fleet.MDM{
-				AppleBMDefaultTeam: "foobar",
-				MacOSSetup:         fleet.MacOSSetup{BootstrapPackage: optjson.String{Set: true}, MacOSSetupAssistant: optjson.String{Set: true}, EnableReleaseDeviceManually: optjson.SetBool(false)},
-				MacOSUpdates:       fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
-				IOSUpdates:         fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
-				IPadOSUpdates:      fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
-				WindowsUpdates:     fleet.WindowsUpdates{DeadlineDays: optjson.Int{Set: true}, GracePeriodDays: optjson.Int{Set: true}},
+				AppleBusinessManager:         optjson.Slice[fleet.MDMAppleABMAssignmentInfo]{Set: true, Value: []fleet.MDMAppleABMAssignmentInfo{}},
+				DeprecatedAppleBMDefaultTeam: "foobar",
+				MacOSSetup:                   fleet.MacOSSetup{BootstrapPackage: optjson.String{Set: true}, MacOSSetupAssistant: optjson.String{Set: true}, EnableReleaseDeviceManually: optjson.SetBool(false)},
+				MacOSUpdates:                 fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
+				IOSUpdates:                   fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
+				IPadOSUpdates:                fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
+				VolumePurchasingProgram:      optjson.Slice[fleet.MDMAppleVolumePurchasingProgramInfo]{Set: true, Value: []fleet.MDMAppleVolumePurchasingProgramInfo{}},
+				WindowsUpdates:               fleet.WindowsUpdates{DeadlineDays: optjson.Int{Set: true}, GracePeriodDays: optjson.Int{Set: true}},
 				WindowsSettings: fleet.WindowsSettings{
 					CustomSettings: optjson.Slice[fleet.MDMProfileSpec]{Set: true, Value: []fleet.MDMProfileSpec{}},
 				},
@@ -903,15 +907,17 @@ func TestMDMAppleConfig(t *testing.T) {
 			name:        "foundEdit",
 			licenseTier: "premium",
 			findTeam:    true,
-			oldMDM:      fleet.MDM{AppleBMDefaultTeam: "bar"},
-			newMDM:      fleet.MDM{AppleBMDefaultTeam: "foobar"},
+			oldMDM:      fleet.MDM{DeprecatedAppleBMDefaultTeam: "bar"},
+			newMDM:      fleet.MDM{DeprecatedAppleBMDefaultTeam: "foobar"},
 			expectedMDM: fleet.MDM{
-				AppleBMDefaultTeam: "foobar",
-				MacOSSetup:         fleet.MacOSSetup{BootstrapPackage: optjson.String{Set: true}, MacOSSetupAssistant: optjson.String{Set: true}, EnableReleaseDeviceManually: optjson.SetBool(false)},
-				MacOSUpdates:       fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
-				IOSUpdates:         fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
-				IPadOSUpdates:      fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
-				WindowsUpdates:     fleet.WindowsUpdates{DeadlineDays: optjson.Int{Set: true}, GracePeriodDays: optjson.Int{Set: true}},
+				AppleBusinessManager:         optjson.Slice[fleet.MDMAppleABMAssignmentInfo]{Set: true, Value: []fleet.MDMAppleABMAssignmentInfo{}},
+				DeprecatedAppleBMDefaultTeam: "foobar",
+				MacOSSetup:                   fleet.MacOSSetup{BootstrapPackage: optjson.String{Set: true}, MacOSSetupAssistant: optjson.String{Set: true}, EnableReleaseDeviceManually: optjson.SetBool(false)},
+				MacOSUpdates:                 fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
+				IOSUpdates:                   fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
+				IPadOSUpdates:                fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
+				VolumePurchasingProgram:      optjson.Slice[fleet.MDMAppleVolumePurchasingProgramInfo]{Set: true, Value: []fleet.MDMAppleVolumePurchasingProgramInfo{}},
+				WindowsUpdates:               fleet.WindowsUpdates{DeadlineDays: optjson.Int{Set: true}, GracePeriodDays: optjson.Int{Set: true}},
 				WindowsSettings: fleet.WindowsSettings{
 					CustomSettings: optjson.Slice[fleet.MDMProfileSpec]{Set: true, Value: []fleet.MDMProfileSpec{}},
 				},
@@ -929,12 +935,14 @@ func TestMDMAppleConfig(t *testing.T) {
 			newMDM:      fleet.MDM{EndUserAuthentication: fleet.MDMEndUserAuthentication{SSOProviderSettings: fleet.SSOProviderSettings{EntityID: "foo"}}},
 			oldMDM:      fleet.MDM{EndUserAuthentication: fleet.MDMEndUserAuthentication{SSOProviderSettings: fleet.SSOProviderSettings{EntityID: "foo"}}},
 			expectedMDM: fleet.MDM{
-				EndUserAuthentication: fleet.MDMEndUserAuthentication{SSOProviderSettings: fleet.SSOProviderSettings{EntityID: "foo"}},
-				MacOSSetup:            fleet.MacOSSetup{BootstrapPackage: optjson.String{Set: true}, MacOSSetupAssistant: optjson.String{Set: true}, EnableReleaseDeviceManually: optjson.SetBool(false)},
-				MacOSUpdates:          fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
-				IOSUpdates:            fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
-				IPadOSUpdates:         fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
-				WindowsUpdates:        fleet.WindowsUpdates{DeadlineDays: optjson.Int{Set: true}, GracePeriodDays: optjson.Int{Set: true}},
+				AppleBusinessManager:    optjson.Slice[fleet.MDMAppleABMAssignmentInfo]{Set: true, Value: []fleet.MDMAppleABMAssignmentInfo{}},
+				EndUserAuthentication:   fleet.MDMEndUserAuthentication{SSOProviderSettings: fleet.SSOProviderSettings{EntityID: "foo"}},
+				MacOSSetup:              fleet.MacOSSetup{BootstrapPackage: optjson.String{Set: true}, MacOSSetupAssistant: optjson.String{Set: true}, EnableReleaseDeviceManually: optjson.SetBool(false)},
+				MacOSUpdates:            fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
+				IOSUpdates:              fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
+				IPadOSUpdates:           fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
+				VolumePurchasingProgram: optjson.Slice[fleet.MDMAppleVolumePurchasingProgramInfo]{Set: true, Value: []fleet.MDMAppleVolumePurchasingProgramInfo{}},
+				WindowsUpdates:          fleet.WindowsUpdates{DeadlineDays: optjson.Int{Set: true}, GracePeriodDays: optjson.Int{Set: true}},
 				WindowsSettings: fleet.WindowsSettings{
 					CustomSettings: optjson.Slice[fleet.MDMProfileSpec]{Set: true, Value: []fleet.MDMProfileSpec{}},
 				},
@@ -950,17 +958,19 @@ func TestMDMAppleConfig(t *testing.T) {
 				IDPName:     "onelogin",
 			}}},
 			expectedMDM: fleet.MDM{
+				AppleBusinessManager: optjson.Slice[fleet.MDMAppleABMAssignmentInfo]{Set: true, Value: []fleet.MDMAppleABMAssignmentInfo{}},
 				EndUserAuthentication: fleet.MDMEndUserAuthentication{SSOProviderSettings: fleet.SSOProviderSettings{
 					EntityID:    "fleet",
 					IssuerURI:   "http://issuer.idp.com",
 					MetadataURL: "http://isser.metadata.com",
 					IDPName:     "onelogin",
 				}},
-				MacOSSetup:     fleet.MacOSSetup{BootstrapPackage: optjson.String{Set: true}, MacOSSetupAssistant: optjson.String{Set: true}, EnableReleaseDeviceManually: optjson.SetBool(false)},
-				MacOSUpdates:   fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
-				IOSUpdates:     fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
-				IPadOSUpdates:  fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
-				WindowsUpdates: fleet.WindowsUpdates{DeadlineDays: optjson.Int{Set: true}, GracePeriodDays: optjson.Int{Set: true}},
+				MacOSSetup:              fleet.MacOSSetup{BootstrapPackage: optjson.String{Set: true}, MacOSSetupAssistant: optjson.String{Set: true}, EnableReleaseDeviceManually: optjson.SetBool(false)},
+				MacOSUpdates:            fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
+				IOSUpdates:              fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
+				IPadOSUpdates:           fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
+				VolumePurchasingProgram: optjson.Slice[fleet.MDMAppleVolumePurchasingProgramInfo]{Set: true, Value: []fleet.MDMAppleVolumePurchasingProgramInfo{}},
+				WindowsUpdates:          fleet.WindowsUpdates{DeadlineDays: optjson.Int{Set: true}, GracePeriodDays: optjson.Int{Set: true}},
 				WindowsSettings: fleet.WindowsSettings{
 					CustomSettings: optjson.Slice[fleet.MDMProfileSpec]{Set: true, Value: []fleet.MDMProfileSpec{}},
 				},
@@ -1015,12 +1025,14 @@ func TestMDMAppleConfig(t *testing.T) {
 				EnableDiskEncryption: optjson.SetBool(false),
 			},
 			expectedMDM: fleet.MDM{
-				EnableDiskEncryption: optjson.Bool{Set: true, Valid: true, Value: false},
-				MacOSSetup:           fleet.MacOSSetup{BootstrapPackage: optjson.String{Set: true}, MacOSSetupAssistant: optjson.String{Set: true}, EnableReleaseDeviceManually: optjson.SetBool(false)},
-				MacOSUpdates:         fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
-				IOSUpdates:           fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
-				IPadOSUpdates:        fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
-				WindowsUpdates:       fleet.WindowsUpdates{DeadlineDays: optjson.Int{Set: true}, GracePeriodDays: optjson.Int{Set: true}},
+				AppleBusinessManager:    optjson.Slice[fleet.MDMAppleABMAssignmentInfo]{Set: true, Value: []fleet.MDMAppleABMAssignmentInfo{}},
+				EnableDiskEncryption:    optjson.Bool{Set: true, Valid: true, Value: false},
+				MacOSSetup:              fleet.MacOSSetup{BootstrapPackage: optjson.String{Set: true}, MacOSSetupAssistant: optjson.String{Set: true}, EnableReleaseDeviceManually: optjson.SetBool(false)},
+				MacOSUpdates:            fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
+				IOSUpdates:              fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
+				IPadOSUpdates:           fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
+				VolumePurchasingProgram: optjson.Slice[fleet.MDMAppleVolumePurchasingProgramInfo]{Set: true, Value: []fleet.MDMAppleVolumePurchasingProgramInfo{}},
+				WindowsUpdates:          fleet.WindowsUpdates{DeadlineDays: optjson.Int{Set: true}, GracePeriodDays: optjson.Int{Set: true}},
 				WindowsSettings: fleet.WindowsSettings{
 					CustomSettings: optjson.Slice[fleet.MDMProfileSpec]{Set: true, Value: []fleet.MDMProfileSpec{}},
 				},
@@ -1063,6 +1075,12 @@ func TestMDMAppleConfig(t *testing.T) {
 			ds.NewJobFunc = func(ctx context.Context, job *fleet.Job) (*fleet.Job, error) {
 				return job, nil
 			}
+			ds.ListABMTokensFunc = func(ctx context.Context) ([]*fleet.ABMToken, error) {
+				return []*fleet.ABMToken{{ID: 1}}, nil
+			}
+			ds.SaveABMTokenFunc = func(ctx context.Context, token *fleet.ABMToken) error {
+				return nil
+			}
 			depStorage.RetrieveConfigFunc = func(p0 context.Context, p1 string) (*nanodep_client.Config, error) {
 				return &nanodep_client.Config{BaseURL: depSrv.URL}, nil
 			}
diff --git a/server/service/apple_mdm.go b/server/service/apple_mdm.go
index 3f1ef747a3..4387367ef0 100644
--- a/server/service/apple_mdm.go
+++ b/server/service/apple_mdm.go
@@ -31,11 +31,11 @@ import (
 	mdm_types "github.com/fleetdm/fleet/v4/server/mdm"
 	apple_mdm "github.com/fleetdm/fleet/v4/server/mdm/apple"
 	"github.com/fleetdm/fleet/v4/server/mdm/apple/appmanifest"
+	"github.com/fleetdm/fleet/v4/server/mdm/apple/gdmf"
 	"github.com/fleetdm/fleet/v4/server/mdm/apple/mobileconfig"
 	"github.com/fleetdm/fleet/v4/server/mdm/assets"
 	mdmcrypto "github.com/fleetdm/fleet/v4/server/mdm/crypto"
 	mdmlifecycle "github.com/fleetdm/fleet/v4/server/mdm/lifecycle"
-	"github.com/fleetdm/fleet/v4/server/mdm/nanodep/godep"
 	"github.com/fleetdm/fleet/v4/server/mdm/nanomdm/cryptoutil"
 	"github.com/fleetdm/fleet/v4/server/mdm/nanomdm/mdm"
 	nano_service "github.com/fleetdm/fleet/v4/server/mdm/nanomdm/service"
@@ -44,6 +44,7 @@ import (
 	"github.com/go-kit/log/level"
 	"github.com/google/uuid"
 	"github.com/groob/plist"
+	"go.mozilla.org/pkcs7"
 )
 
 type getMDMAppleCommandResultsRequest struct {
@@ -380,7 +381,7 @@ func (svc *Service) NewMDMAppleConfigProfile(ctx context.Context, teamID uint, r
 		}
 		return nil, ctxerr.Wrap(ctx, err)
 	}
-	if err := svc.ds.BulkSetPendingMDMHostProfiles(ctx, nil, nil, []string{newCP.ProfileUUID}, nil); err != nil {
+	if _, err := svc.ds.BulkSetPendingMDMHostProfiles(ctx, nil, nil, []string{newCP.ProfileUUID}, nil); err != nil {
 		return nil, ctxerr.Wrap(ctx, err, "bulk set pending host profiles")
 	}
 
@@ -470,7 +471,7 @@ func (svc *Service) NewMDMAppleDeclaration(ctx context.Context, teamID uint, r i
 		return nil, err
 	}
 
-	if err := svc.ds.BulkSetPendingMDMHostProfiles(ctx, nil, nil, []string{decl.DeclarationUUID}, nil); err != nil {
+	if _, err := svc.ds.BulkSetPendingMDMHostProfiles(ctx, nil, nil, []string{decl.DeclarationUUID}, nil); err != nil {
 		return nil, ctxerr.Wrap(ctx, err, "bulk set pending host declarations")
 	}
 
@@ -773,7 +774,7 @@ func (svc *Service) DeleteMDMAppleConfigProfile(ctx context.Context, profileUUID
 		return ctxerr.Wrap(ctx, err)
 	}
 	// cannot use the profile ID as it is now deleted
-	if err := svc.ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{teamID}, nil, nil); err != nil {
+	if _, err := svc.ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{teamID}, nil, nil); err != nil {
 		return ctxerr.Wrap(ctx, err, "bulk set pending host profiles")
 	}
 
@@ -853,7 +854,7 @@ func (svc *Service) DeleteMDMAppleDeclaration(ctx context.Context, declUUID stri
 		return ctxerr.Wrap(ctx, err)
 	}
 
-	if err := svc.ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{teamID}, nil, nil); err != nil {
+	if _, err := svc.ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{teamID}, nil, nil); err != nil {
 		return ctxerr.Wrap(ctx, err, "bulk set pending host profiles")
 	}
 
@@ -1154,45 +1155,6 @@ func (svc *Service) ListMDMAppleDevices(ctx context.Context) ([]fleet.MDMAppleDe
 	return svc.ds.MDMAppleListDevices(ctx)
 }
 
-type listMDMAppleDEPDevicesRequest struct{}
-
-type listMDMAppleDEPDevicesResponse struct {
-	Devices []fleet.MDMAppleDEPDevice `json:"devices"`
-	Err     error                     `json:"error,omitempty"`
-}
-
-func (r listMDMAppleDEPDevicesResponse) error() error { return r.Err }
-
-func listMDMAppleDEPDevicesEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (errorer, error) {
-	devices, err := svc.ListMDMAppleDEPDevices(ctx)
-	if err != nil {
-		return listMDMAppleDEPDevicesResponse{Err: err}, nil
-	}
-	return &listMDMAppleDEPDevicesResponse{
-		Devices: devices,
-	}, nil
-}
-
-func (svc *Service) ListMDMAppleDEPDevices(ctx context.Context) ([]fleet.MDMAppleDEPDevice, error) {
-	if err := svc.authz.Authorize(ctx, &fleet.MDMAppleDEPDevice{}, fleet.ActionWrite); err != nil {
-		return nil, ctxerr.Wrap(ctx, err)
-	}
-	depClient := apple_mdm.NewDEPClient(svc.depStorage, svc.ds, svc.logger)
-
-	// TODO(lucas): Use cursors and limit to fetch in multiple requests.
-	// This single-request version supports up to 1000 devices (max to return in one call).
-	fetchDevicesResponse, err := depClient.FetchDevices(ctx, apple_mdm.DEPName, godep.WithLimit(1000))
-	if err != nil {
-		return nil, ctxerr.Wrap(ctx, err)
-	}
-
-	devices := make([]fleet.MDMAppleDEPDevice, len(fetchDevicesResponse.Devices))
-	for i := range fetchDevicesResponse.Devices {
-		devices[i] = fleet.MDMAppleDEPDevice{Device: fetchDevicesResponse.Devices[i]}
-	}
-	return devices, nil
-}
-
 type newMDMAppleDEPKeyPairResponse struct {
 	PublicKey  []byte `json:"public_key,omitempty"`
 	PrivateKey []byte `json:"private_key,omitempty"`
@@ -1287,6 +1249,38 @@ func (svc *Service) EnqueueMDMAppleCommand(
 type mdmAppleEnrollRequest struct {
 	Token               string `query:"token"`
 	EnrollmentReference string `query:"enrollment_reference,optional"`
+	MachineInfo         *fleet.MDMAppleMachineInfo
+}
+
+func (mdmAppleEnrollRequest) DecodeRequest(ctx context.Context, r *http.Request) (interface{}, error) {
+	decoded := mdmAppleEnrollRequest{}
+
+	tok := r.URL.Query().Get("token")
+	if tok == "" {
+		return nil, &fleet.BadRequestError{
+			Message: "token is required",
+		}
+	}
+	decoded.Token = tok
+
+	er := r.URL.Query().Get("enrollment_reference")
+	decoded.EnrollmentReference = er
+
+	// Parse the machine info from the request body
+	di := r.Header.Get("x-apple-aspen-deviceinfo")
+	if di != "" {
+		// extract x-apple-aspen-deviceinfo custom header from request
+		parsed, err := apple_mdm.ParseDeviceinfo(di, false) // FIXME: use verify=true when we have better parsing for various Apple certs (https://github.com/fleetdm/fleet/issues/20879)
+		if err != nil {
+			return nil, &fleet.BadRequestError{
+				Message:     "unable to parse deviceinfo header",
+				InternalErr: err,
+			}
+		}
+		decoded.MachineInfo = parsed
+	}
+
+	return &decoded, nil
 }
 
 func (r mdmAppleEnrollResponse) error() error { return r.Err }
@@ -1296,9 +1290,20 @@ type mdmAppleEnrollResponse struct {
 
 	// Profile field is used in hijackRender for the response.
 	Profile []byte
+
+	SoftwareUpdateRequired *fleet.MDMAppleSoftwareUpdateRequired
 }
 
 func (r mdmAppleEnrollResponse) hijackRender(ctx context.Context, w http.ResponseWriter) {
+	if r.SoftwareUpdateRequired != nil {
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusForbidden)
+		if err := json.NewEncoder(w).Encode(r.SoftwareUpdateRequired); err != nil {
+			encodeError(ctx, ctxerr.New(ctx, "failed to encode software update required"), w)
+		}
+		return
+	}
+
 	w.Header().Set("Content-Length", strconv.FormatInt(int64(len(r.Profile)), 10))
 	w.Header().Set("Content-Type", "application/x-apple-aspen-config")
 	w.Header().Set("X-Content-Type-Options", "nosniff")
@@ -1316,6 +1321,16 @@ func (r mdmAppleEnrollResponse) hijackRender(ctx context.Context, w http.Respons
 func mdmAppleEnrollEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (errorer, error) {
 	req := request.(*mdmAppleEnrollRequest)
 
+	sur, err := svc.CheckMDMAppleEnrollmentWithMinimumOSVersion(ctx, req.MachineInfo)
+	if err != nil {
+		return mdmAppleEnrollResponse{Err: err}, nil
+	}
+	if sur != nil {
+		return mdmAppleEnrollResponse{
+			SoftwareUpdateRequired: sur,
+		}, nil
+	}
+
 	profile, err := svc.GetMDMAppleEnrollmentProfileByToken(ctx, req.Token, req.EnrollmentReference)
 	if err != nil {
 		return mdmAppleEnrollResponse{Err: err}, nil
@@ -1376,6 +1391,89 @@ func (svc *Service) GetMDMAppleEnrollmentProfileByToken(ctx context.Context, tok
 	return signed, nil
 }
 
+func (svc *Service) CheckMDMAppleEnrollmentWithMinimumOSVersion(ctx context.Context, m *fleet.MDMAppleMachineInfo) (*fleet.MDMAppleSoftwareUpdateRequired, error) {
+	// skipauth: The enroll profile endpoint is unauthenticated.
+	svc.authz.SkipAuthorization(ctx)
+
+	if m == nil {
+		level.Debug(svc.logger).Log("msg", "no machine info, skipping os version check")
+		return nil, nil
+	}
+
+	level.Debug(svc.logger).Log("msg", "checking os version", "serial", m.Serial, "current_version", m.OSVersion)
+
+	if !m.MDMCanRequestSoftwareUpdate {
+		level.Debug(svc.logger).Log("msg", "mdm cannot request software update, skipping os version check", "serial", m.Serial)
+		return nil, nil
+	}
+
+	needsUpdate, err := svc.needsOSUpdateForDEPEnrollment(ctx, *m)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "checking os updates settings", "serial", m.Serial)
+	}
+
+	if !needsUpdate {
+		level.Debug(svc.logger).Log("msg", "device is above minimum, skipping os version check", "serial", m.Serial)
+		return nil, nil
+	}
+
+	sur, err := svc.getAppleSoftwareUpdateRequiredForDEPEnrollment(*m)
+	if err != nil {
+		// log for debugging but allow enrollment to proceed
+		level.Info(svc.logger).Log("msg", "getting apple software update required", "serial", m.Serial, "err", err)
+		return nil, nil
+	}
+
+	return sur, nil
+}
+
+func (svc *Service) needsOSUpdateForDEPEnrollment(ctx context.Context, m fleet.MDMAppleMachineInfo) (bool, error) {
+	// NOTE: Under the hood, the datastore is joining host_dep_assignments to the hosts table to
+	// look up DEP hosts by serial number. It grabs the team id and platform from the
+	// hosts table. Then it uses the team id to get either the global config or team config.
+	// Finally, it uses the platform to get os updates settings from the config for
+	// one of ios, ipados, or darwin, as applicable. There's a lot of assumptions going on here, not
+	// least of which is that the platform is correct in the hosts table. If the platform is wrong,
+	// we'll end up with a meaningless comparison of unrelated versions. We could potentially add
+	// some cross-check against the machine info to ensure that the platform of the host aligns with
+	// what we expect from the machine info. But that would involve work to derive the platform from
+	// the machine info (presumably from the product name, but that's not a 1:1 mapping).
+	settings, err := svc.ds.GetMDMAppleOSUpdatesSettingsByHostSerial(ctx, m.Serial)
+	if err != nil {
+		if fleet.IsNotFound(err) {
+			level.Info(svc.logger).Log("msg", "checking os updates settings, settings not found", "serial", m.Serial)
+			return false, nil
+		}
+		return false, err
+	}
+	// TODO: confirm what this check should do
+	if !settings.MinimumVersion.Set || !settings.MinimumVersion.Valid || settings.MinimumVersion.Value == "" {
+		level.Info(svc.logger).Log("msg", "checking os updates settings, minimum version not set", "serial", m.Serial, "current_version", m.OSVersion, "minimum_version", settings.MinimumVersion.Value)
+		return false, nil
+	}
+
+	return apple_mdm.IsLessThanVersion(m.OSVersion, settings.MinimumVersion.Value)
+}
+
+func (svc *Service) getAppleSoftwareUpdateRequiredForDEPEnrollment(m fleet.MDMAppleMachineInfo) (*fleet.MDMAppleSoftwareUpdateRequired, error) {
+	latest, err := gdmf.GetLatestOSVersion(m)
+	if err != nil {
+		return nil, err
+	}
+
+	needsUpdate, err := apple_mdm.IsLessThanVersion(m.OSVersion, latest.ProductVersion)
+	if err != nil {
+		return nil, err
+	} else if !needsUpdate {
+		return nil, nil
+	}
+
+	return fleet.NewMDMAppleSoftwareUpdateRequired(fleet.MDMAppleSoftwareUpdateAsset{
+		ProductVersion: latest.ProductVersion,
+		Build:          latest.Build,
+	}), nil
+}
+
 func (svc *Service) mdmPushCertTopic(ctx context.Context) (string, error) {
 	assets, err := svc.ds.GetAllMDMConfigAssetsByName(ctx, []fleet.MDMAssetName{
 		fleet.MDMAssetAPNSCert,
@@ -1472,47 +1570,17 @@ func (svc *Service) EnqueueMDMAppleCommandRemoveEnrollmentProfile(ctx context.Co
 		return ctxerr.Wrap(ctx, err, "logging activity for mdm apple remove profile command")
 	}
 
-	return svc.pollResultMDMAppleCommandRemoveEnrollmentProfile(ctx, cmdUUID, h.UUID, info.Platform)
-}
-
-func (svc *Service) pollResultMDMAppleCommandRemoveEnrollmentProfile(ctx context.Context, cmdUUID string, deviceID string, platform string) error {
-	ctx, cancelFn := context.WithDeadline(ctx, time.Now().Add(5*time.Second))
-	ticker := time.NewTicker(300 * time.Millisecond)
-	defer func() {
-		ticker.Stop()
-		cancelFn()
-	}()
-
-	for {
-		select {
-		case <-ctx.Done():
-			// time out after 5 seconds
-			return fleet.MDMAppleCommandTimeoutError{}
-		case <-ticker.C:
-			nanoEnroll, err := svc.ds.GetNanoMDMEnrollment(ctx, deviceID)
-			if err != nil {
-				level.Error(svc.logger).Log("err", "get nanomdm enrollment status", "details", err, "id", deviceID, "command_uuid", cmdUUID)
-				return err
-			}
-			if nanoEnroll != nil && nanoEnroll.Enabled {
-				// check again on the next tick
-				continue
-			}
-			// success, mdm enrollment is no longer enabled for the device
-			level.Info(svc.logger).Log("msg", "mdm disabled for device", "id", deviceID, "command_uuid", cmdUUID)
-
-			mdmLifecycle := mdmlifecycle.New(svc.ds, svc.logger)
-			err = mdmLifecycle.Do(ctx, mdmlifecycle.HostOptions{
-				Action:   mdmlifecycle.HostActionTurnOff,
-				Platform: platform,
-				UUID:     deviceID,
-			})
-			if err != nil {
-				return err
-			}
-			return nil
-		}
+	mdmLifecycle := mdmlifecycle.New(svc.ds, svc.logger)
+	err = mdmLifecycle.Do(ctx, mdmlifecycle.HostOptions{
+		Action:   mdmlifecycle.HostActionTurnOff,
+		Platform: info.Platform,
+		UUID:     h.UUID,
+	})
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "running turn off action in mdm lifecycle")
 	}
+
+	return nil
 }
 
 type mdmAppleGetInstallerRequest struct {
@@ -1880,7 +1948,7 @@ func (svc *Service) BatchSetMDMAppleProfiles(ctx context.Context, tmID *uint, tm
 	}
 
 	if !skipBulkPending {
-		if err := svc.ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{bulkTeamID}, nil, nil); err != nil {
+		if _, err := svc.ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{bulkTeamID}, nil, nil); err != nil {
 			return ctxerr.Wrap(ctx, err, "bulk set pending host profiles")
 		}
 	}
@@ -2716,7 +2784,7 @@ func (svc *MDMAppleCheckinAndCommandService) CommandAndReportResults(r *mdm.Requ
 
 	// Check if this is a result of a "refetch" command sent to iPhones/iPads
 	// to fetch their device information periodically.
-	if strings.HasPrefix(cmdResult.CommandUUID, fleet.RefetchCommandUUIDPrefix) {
+	if strings.HasPrefix(cmdResult.CommandUUID, fleet.RefetchBaseCommandUUIDPrefix) {
 		return svc.handleRefetch(r, cmdResult)
 	}
 
@@ -2793,6 +2861,15 @@ func (svc *MDMAppleCheckinAndCommandService) handleRefetch(r *mdm.Request, cmdRe
 	}
 
 	if strings.HasPrefix(cmdResult.CommandUUID, fleet.RefetchAppsCommandUUIDPrefix) {
+		// We remove pending command first in case there is an error processing the results, so that we don't prevent another refetch.
+		err = svc.ds.RemoveHostMDMCommand(ctx, fleet.HostMDMCommand{
+			HostID:      host.ID,
+			CommandType: fleet.RefetchAppsCommandUUIDPrefix,
+		})
+		if err != nil {
+			return nil, ctxerr.Wrap(ctx, err, "remove refetch apps command")
+		}
+
 		if host.Platform != "ios" && host.Platform != "ipados" {
 			return nil, ctxerr.New(ctx, "refetch apps command sent to non-iOS/non-iPadOS host")
 		}
@@ -2814,6 +2891,16 @@ func (svc *MDMAppleCheckinAndCommandService) handleRefetch(r *mdm.Request, cmdRe
 		return nil, nil
 	}
 
+	// Otherwise, the command has prefix fleet.RefetchDeviceCommandUUIDPrefix, which is a refetch device command.
+	// We remove pending command first in case there is an error processing the results, so that we don't prevent another refetch.
+	err = svc.ds.RemoveHostMDMCommand(ctx, fleet.HostMDMCommand{
+		HostID:      host.ID,
+		CommandType: fleet.RefetchDeviceCommandUUIDPrefix,
+	})
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "remove refetch device command")
+	}
+
 	var deviceInformationResponse struct {
 		QueryResponses map[string]interface{} `plist:"QueryResponses"`
 	}
@@ -2860,11 +2947,20 @@ func (svc *MDMAppleCheckinAndCommandService) handleRefetch(r *mdm.Request, cmdRe
 	}); err != nil {
 		return nil, ctxerr.Wrap(r.Context, err, "failed to update host operating system")
 	}
+
+	if host.MDM.EnrollmentStatus != nil && *host.MDM.EnrollmentStatus == "Pending" {
+		// Since the device has been refetched, we can assume it's enrolled.
+		err = svc.ds.UpdateMDMData(ctx, host.ID, true)
+		if err != nil {
+			return nil, ctxerr.Wrap(r.Context, err, "failed to update MDM data")
+		}
+	}
 	return nil, nil
 }
 
 func unmarshalAppList(ctx context.Context, response []byte, source string) ([]fleet.Software,
-	error) {
+	error,
+) {
 	var appsResponse struct {
 		InstalledApplicationList []map[string]interface{} `plist:"InstalledApplicationList"`
 	}
@@ -3023,7 +3119,7 @@ func SendPushesToPendingDevices(
 	if err := commander.SendNotifications(ctx, uuids); err != nil {
 		var apnsErr *apple_mdm.APNSDeliveryError
 		if errors.As(err, &apnsErr) {
-			level.Info(logger).Log("msg", "failed to send APNs notification to some hosts", "host_uuids", apnsErr.FailedUUIDs)
+			level.Info(logger).Log("msg", "failed to send APNs notification to some hosts", "error", apnsErr.Error())
 			return nil
 		}
 
@@ -3202,8 +3298,8 @@ func ReconcileAppleProfiles(
 			continue
 		}
 
-		if p.FailedToInstallOnHost() {
-			// then we shouldn't send an additional remove command since it failed to install on the
+		if p.DidNotInstallOnHost() {
+			// then we shouldn't send an additional remove command since it wasn't installed on the
 			// host.
 			hostProfilesToCleanup = append(hostProfilesToCleanup, p)
 			continue
@@ -3463,9 +3559,13 @@ func RenewSCEPCertificates(
 		}
 	}
 
-	migrationEnrollmentProfile := os.Getenv("FLEET_SILENT_MIGRATION_ENROLLMENT_PROFILE")
+	decodedMigrationEnrollmentProfile, err := base64.StdEncoding.DecodeString(os.Getenv("FLEET_SILENT_MIGRATION_ENROLLMENT_PROFILE"))
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "failed to decode silent migration enrollment profile")
+	}
 	hasAssocsFromMigration := len(assocsFromMigration) > 0
 
+	migrationEnrollmentProfile := string(decodedMigrationEnrollmentProfile)
 	if migrationEnrollmentProfile == "" && hasAssocsFromMigration {
 		level.Debug(logger).Log("msg", "found devices from migration that need SCEP renewals but FLEET_SILENT_MIGRATION_ENROLLMENT_PROFILE is empty")
 	}
@@ -3847,7 +3947,8 @@ func (uploadABMTokenRequest) DecodeRequest(ctx context.Context, r *http.Request)
 }
 
 type uploadABMTokenResponse struct {
-	Err error `json:"error,omitempty"`
+	Token *fleet.ABMToken `json:"abm_token,omitempty"`
+	Err   error           `json:"error,omitempty"`
 }
 
 func (r uploadABMTokenResponse) error() error { return r.Err }
@@ -3860,125 +3961,412 @@ func uploadABMTokenEndpoint(ctx context.Context, request interface{}, svc fleet.
 	}
 	defer ff.Close()
 
-	if err := svc.SaveABMToken(ctx, ff); err != nil {
+	token, err := svc.UploadABMToken(ctx, ff)
+	if err != nil {
 		return uploadABMTokenResponse{
 			Err: err,
 		}, nil
 	}
 
-	return uploadABMTokenResponse{}, nil
+	return uploadABMTokenResponse{Token: token}, nil
 }
 
-func (svc *Service) SaveABMToken(ctx context.Context, token io.Reader) error {
-	// first check for reads as we need to load the cert/key from the db. We will
-	// do another write check below.
-	if err := svc.authz.Authorize(ctx, &fleet.AppleBM{}, fleet.ActionRead); err != nil {
-		return err
-	}
+func (svc *Service) UploadABMToken(ctx context.Context, token io.Reader) (*fleet.ABMToken, error) {
+	// skipauth: No authorization check needed due to implementation returning
+	// only license error.
+	svc.authz.SkipAuthorization(ctx)
 
-	pair, err := svc.ds.GetAllMDMConfigAssetsByName(ctx, []fleet.MDMAssetName{
-		fleet.MDMAssetABMCert,
-		fleet.MDMAssetABMKey,
-	})
-	if err != nil {
-		if fleet.IsNotFound(err) {
-			return ctxerr.Wrap(ctx, &fleet.BadRequestError{
-				Message: "Please generate a keypair first.",
-			}, "saving ABM token")
-		}
-
-		return ctxerr.Wrap(ctx, err, "retrieving stored ABM assets")
-	}
-
-	tokenBytes, err := io.ReadAll(token)
-	if err != nil {
-		return ctxerr.Wrap(ctx, err, "reading token bytes")
-	}
-
-	derCert, _ := pem.Decode(pair[fleet.MDMAssetABMCert].Value)
-	if derCert == nil {
-		return ctxerr.Wrap(ctx, err, "ABM certificate in the database cannot be parsed")
-	}
-
-	cert, err := x509.ParseCertificate(derCert.Bytes)
-	if err != nil {
-		return ctxerr.Wrap(ctx, err, "parsing ABM certificate")
-	}
-
-	if _, err := assets.DecryptRawABMToken(tokenBytes, cert, pair[fleet.MDMAssetABMKey].Value); err != nil {
-		return ctxerr.Wrap(ctx, &fleet.BadRequestError{
-			Message:     "Invalid token. Please provide a valid token from Apple Business Manager.",
-			InternalErr: err,
-		}, "validating ABM token")
-	}
-
-	if err := svc.authz.Authorize(ctx, &fleet.AppleBM{}, fleet.ActionWrite); err != nil {
-		return err
-	}
-
-	// delete the old token and insert the new one
-	// TODO(roberto): replacing the token should be done in a single transaction in the DB
-	err = svc.ds.DeleteMDMConfigAssetsByName(ctx, []fleet.MDMAssetName{fleet.MDMAssetABMToken})
-	if err != nil {
-		return ctxerr.Wrap(ctx, err, "deleting old ABM token in database")
-	}
-	err = svc.ds.InsertMDMConfigAssets(ctx, []fleet.MDMConfigAsset{
-		{Name: fleet.MDMAssetABMToken, Value: tokenBytes},
-	})
-	if err != nil {
-		return ctxerr.Wrap(ctx, err, "saving ABM token in database")
-	}
-
-	// flip the app config flag
-	appCfg, err := svc.ds.AppConfig(ctx)
-	if err != nil {
-		return ctxerr.Wrap(ctx, err, "retrieving app config")
-	}
-
-	appCfg.MDM.AppleBMEnabledAndConfigured = true
-
-	return svc.ds.SaveAppConfig(ctx, appCfg)
+	return nil, fleet.ErrMissingLicense
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // Disable ABM endpoint
 ////////////////////////////////////////////////////////////////////////////////
 
-type disableABMResponse struct {
+type deleteABMTokenRequest struct {
+	TokenID uint `url:"id"`
+}
+
+type deleteABMTokenResponse struct {
 	Err error `json:"error,omitempty"`
 }
 
-func (r disableABMResponse) error() error { return r.Err }
-func (r disableABMResponse) Status() int  { return http.StatusNoContent }
+func (r deleteABMTokenResponse) error() error { return r.Err }
+func (r deleteABMTokenResponse) Status() int  { return http.StatusNoContent }
 
-func disableABMEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (errorer, error) {
-	if err := svc.DisableABM(ctx); err != nil {
-		return disableABMResponse{Err: err}, nil
+func deleteABMTokenEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (errorer, error) {
+	req := request.(*deleteABMTokenRequest)
+	if err := svc.DeleteABMToken(ctx, req.TokenID); err != nil {
+		return deleteABMTokenResponse{Err: err}, nil
 	}
 
-	return disableABMResponse{}, nil
+	return deleteABMTokenResponse{}, nil
 }
 
-func (svc *Service) DisableABM(ctx context.Context) error {
-	if err := svc.authz.Authorize(ctx, &fleet.AppleBM{}, fleet.ActionWrite); err != nil {
-		return err
+func (svc *Service) DeleteABMToken(ctx context.Context, tokenID uint) error {
+	// skipauth: No authorization check needed due to implementation returning
+	// only license error.
+	svc.authz.SkipAuthorization(ctx)
+
+	return fleet.ErrMissingLicense
+}
+
+////////////////////////////////////////////////////////////////////////////////
+// List ABM tokens endpoint
+////////////////////////////////////////////////////////////////////////////////
+
+type listABMTokensResponse struct {
+	Err    error             `json:"error,omitempty"`
+	Tokens []*fleet.ABMToken `json:"abm_tokens"`
+}
+
+func (r listABMTokensResponse) error() error { return r.Err }
+
+func listABMTokensEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (errorer, error) {
+	tokens, err := svc.ListABMTokens(ctx)
+	if err != nil {
+		return &listABMTokensResponse{Err: err}, nil
 	}
 
-	err := svc.ds.DeleteMDMConfigAssetsByName(ctx, []fleet.MDMAssetName{
-		fleet.MDMAssetABMCert,
-		fleet.MDMAssetABMKey,
-		fleet.MDMAssetABMToken,
+	if tokens == nil {
+		tokens = []*fleet.ABMToken{}
+	}
+
+	return &listABMTokensResponse{Tokens: tokens}, nil
+}
+
+func (svc *Service) ListABMTokens(ctx context.Context) ([]*fleet.ABMToken, error) {
+	// skipauth: No authorization check needed due to implementation returning
+	// only license error.
+	svc.authz.SkipAuthorization(ctx)
+
+	return nil, fleet.ErrMissingLicense
+}
+
+////////////////////////////////////////////////////////////////////////////////
+// Update ABM token teams endpoint
+////////////////////////////////////////////////////////////////////////////////
+
+type updateABMTokenTeamsRequest struct {
+	TokenID      uint  `url:"id"`
+	MacOSTeamID  *uint `json:"macos_team_id"`
+	IOSTeamID    *uint `json:"ios_team_id"`
+	IPadOSTeamID *uint `json:"ipados_team_id"`
+}
+
+type updateABMTokenTeamsResponse struct {
+	ABMToken *fleet.ABMToken `json:"abm_token,omitempty"`
+	Err      error           `json:"error,omitempty"`
+}
+
+func (r updateABMTokenTeamsResponse) error() error { return r.Err }
+
+func updateABMTokenTeamsEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (errorer, error) {
+	req := request.(*updateABMTokenTeamsRequest)
+
+	tok, err := svc.UpdateABMTokenTeams(ctx, req.TokenID, req.MacOSTeamID, req.IOSTeamID, req.IPadOSTeamID)
+	if err != nil {
+		return &updateABMTokenTeamsResponse{Err: err}, nil
+	}
+
+	return &updateABMTokenTeamsResponse{ABMToken: tok}, nil
+}
+
+func (svc *Service) UpdateABMTokenTeams(ctx context.Context, tokenID uint, macOSTeamID, iOSTeamID, iPadOSTeamID *uint) (*fleet.ABMToken, error) {
+	// skipauth: No authorization check needed due to implementation returning
+	// only license error.
+	svc.authz.SkipAuthorization(ctx)
+
+	return nil, fleet.ErrMissingLicense
+}
+
+////////////////////////////////////////////////////////////////////////////////
+// Renew ABM token endpoint
+////////////////////////////////////////////////////////////////////////////////
+
+type renewABMTokenRequest struct {
+	TokenID uint `url:"id"`
+	Token   *multipart.FileHeader
+}
+
+func (renewABMTokenRequest) DecodeRequest(ctx context.Context, r *http.Request) (interface{}, error) {
+	err := r.ParseMultipartForm(512 * units.MiB)
+	if err != nil {
+		return nil, &fleet.BadRequestError{
+			Message:     "failed to parse multipart form",
+			InternalErr: err,
+		}
+	}
+
+	token, ok := r.MultipartForm.File["token"]
+	if !ok || len(token) < 1 {
+		return nil, &fleet.BadRequestError{Message: "no file headers for token"}
+	}
+
+	// because we are in this method, we know that the path has 7 parts, e.g:
+	// /api/latest/fleet/abm_tokens/19/renew
+
+	id, err := intFromRequest(r, "id")
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "failed to parse abm token id")
+	}
+
+	return &renewABMTokenRequest{
+		Token:   token[0],
+		TokenID: uint(id),
+	}, nil
+}
+
+type renewABMTokenResponse struct {
+	ABMToken *fleet.ABMToken `json:"abm_token,omitempty"`
+	Err      error           `json:"error,omitempty"`
+}
+
+func (r renewABMTokenResponse) error() error { return r.Err }
+
+func renewABMTokenEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (errorer, error) {
+	req := request.(*renewABMTokenRequest)
+	ff, err := req.Token.Open()
+	if err != nil {
+		return &renewABMTokenResponse{Err: err}, nil
+	}
+	defer ff.Close()
+
+	tok, err := svc.RenewABMToken(ctx, ff, req.TokenID)
+	if err != nil {
+		return &renewABMTokenResponse{Err: err}, nil
+	}
+
+	return &renewABMTokenResponse{ABMToken: tok}, nil
+}
+
+func (svc *Service) RenewABMToken(ctx context.Context, token io.Reader, tokenID uint) (*fleet.ABMToken, error) {
+	// skipauth: No authorization check needed due to implementation returning
+	// only license error.
+	svc.authz.SkipAuthorization(ctx)
+
+	return nil, fleet.ErrMissingLicense
+}
+
+////////////////////////////////////////////////////////////////////////////////
+// GET /enrollment_profiles/ota
+////////////////////////////////////////////////////////////////////////////////
+
+type getOTAProfileRequest struct {
+	EnrollSecret string `query:"enroll_secret"`
+}
+
+func getOTAProfileEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (errorer, error) {
+	req := request.(*getOTAProfileRequest)
+	profile, err := svc.GetOTAProfile(ctx, req.EnrollSecret)
+	if err != nil {
+		return &getMDMAppleConfigProfileResponse{Err: err}, err
+	}
+
+	reader := bytes.NewReader(profile)
+	return &getMDMAppleConfigProfileResponse{fileReader: io.NopCloser(reader), fileLength: reader.Size(), fileName: "fleet-mdm-enrollment-profile"}, nil
+}
+
+func (svc *Service) GetOTAProfile(ctx context.Context, enrollSecret string) ([]byte, error) {
+	// Skip authz as this endpoint is used by end users from their iPhones or iPads; authz is done
+	// by the enroll secret verification below
+	svc.authz.SkipAuthorization(ctx)
+
+	cfg, err := svc.ds.AppConfig(ctx)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "getting app config to get org name")
+	}
+
+	profBytes, err := apple_mdm.GenerateOTAEnrollmentProfileMobileconfig(cfg.OrgInfo.OrgName, cfg.ServerSettings.ServerURL, enrollSecret)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "generating ota mobileconfig file")
+	}
+
+	signed, err := mdmcrypto.Sign(ctx, profBytes, svc.ds)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "signing profile")
+	}
+
+	return signed, nil
+}
+
+////////////////////////////////////////////////////////////////////////////////
+// POST /ota_enrollment?enroll_secret=xyz
+////////////////////////////////////////////////////////////////////////////////
+
+type mdmAppleOTARequest struct {
+	EnrollSecret string `query:"enroll_secret"`
+	Certificates []*x509.Certificate
+	RootSigner   *x509.Certificate
+	DeviceInfo   fleet.MDMAppleMachineInfo
+}
+
+func (mdmAppleOTARequest) DecodeRequest(ctx context.Context, r *http.Request) (interface{}, error) {
+	enrollSecret := r.URL.Query().Get("enroll_secret")
+	if enrollSecret == "" {
+		return nil, &fleet.OTAForbiddenError{
+			InternalErr: errors.New("enroll_secret query parameter was empty"),
+		}
+	}
+
+	rawData, err := io.ReadAll(r.Body)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "reading body from request")
+	}
+
+	p7, err := pkcs7.Parse(rawData)
+	if err != nil {
+		return nil, &fleet.BadRequestError{
+			Message:     "invalid request body",
+			InternalErr: err,
+		}
+	}
+
+	var request mdmAppleOTARequest
+	err = plist.Unmarshal(p7.Content, &request.DeviceInfo)
+	if err != nil {
+		return nil, &fleet.BadRequestError{
+			Message:     "invalid request body",
+			InternalErr: err,
+		}
+	}
+
+	if request.DeviceInfo.Serial == "" {
+		return nil, &fleet.BadRequestError{
+			Message: "SERIAL is required",
+		}
+	}
+
+	request.EnrollSecret = enrollSecret
+	request.Certificates = p7.Certificates
+	request.RootSigner = p7.GetOnlySigner()
+	return &request, nil
+}
+
+type mdmAppleOTAResponse struct {
+	Err error `json:"error,omitempty"`
+	xml []byte
+}
+
+func (r mdmAppleOTAResponse) error() error { return r.Err }
+
+func (r mdmAppleOTAResponse) hijackRender(ctx context.Context, w http.ResponseWriter) {
+	w.Header().Set("Content-Length", fmt.Sprintf("%d", len(r.xml)))
+	w.Header().Set("Content-Type", "application/x-apple-aspen-config")
+	w.Header().Set("X-Content-Type-Options", "nosniff")
+	if _, err := w.Write(r.xml); err != nil {
+		w.WriteHeader(http.StatusInternalServerError)
+		return
+	}
+}
+
+func mdmAppleOTAEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (errorer, error) {
+	req := request.(*mdmAppleOTARequest)
+	xml, err := svc.MDMAppleProcessOTAEnrollment(ctx, req.Certificates, req.RootSigner, req.EnrollSecret, req.DeviceInfo)
+	if err != nil {
+		return mdmAppleGetInstallerResponse{Err: err}, nil
+	}
+	return mdmAppleOTAResponse{xml: xml}, nil
+}
+
+// NOTE: this method and how OTA works is documented in full in the interface definition.
+func (svc *Service) MDMAppleProcessOTAEnrollment(
+	ctx context.Context,
+	certificates []*x509.Certificate,
+	rootSigner *x509.Certificate,
+	enrollSecret string,
+	deviceInfo fleet.MDMAppleMachineInfo,
+) ([]byte, error) {
+	// authorization is performed via the enroll secret and the provided certificates
+	svc.authz.SkipAuthorization(ctx)
+
+	if len(certificates) == 0 {
+		return nil, authz.ForbiddenWithInternal("no certificates provided", nil, nil, nil)
+	}
+
+	// first check is for the enroll secret, we'll only let the host
+	// through if it has a valid secret.
+	enrollSecretInfo, err := svc.ds.VerifyEnrollSecret(ctx, enrollSecret)
+	if err != nil {
+		if fleet.IsNotFound(err) {
+			return nil, &fleet.OTAForbiddenError{
+				InternalErr: err,
+			}
+		}
+
+		return nil, ctxerr.Wrap(ctx, err, "validating enroll secret")
+	}
+
+	assets, err := svc.ds.GetAllMDMConfigAssetsByName(ctx, []fleet.MDMAssetName{
+		fleet.MDMAssetSCEPChallenge,
 	})
 	if err != nil {
-		return ctxerr.Wrap(ctx, err, "disabling ABM config")
+		return nil, fmt.Errorf("loading SCEP challenge from the database: %w", err)
 	}
+	scepChallenge := string(assets[fleet.MDMAssetSCEPChallenge].Value)
 
-	// flip the app config flag
 	appCfg, err := svc.ds.AppConfig(ctx)
 	if err != nil {
-		return ctxerr.Wrap(ctx, err, "retrieving app config")
+		return nil, ctxerr.Wrap(ctx, err, "reading app config")
+	}
+	fleetURL := appCfg.ServerSettings.ServerURL
+
+	// if the root signer was issued by Apple's CA, it means we're in the
+	// first phase and we should return a SCEP payload.
+	if err := apple_mdm.VerifyFromAppleIphoneDeviceCA(rootSigner); err == nil {
+		scepURL, err := apple_mdm.ResolveAppleSCEPURL(fleetURL)
+		if err != nil {
+			return nil, ctxerr.Wrap(ctx, err, "resolve Apple SCEP url")
+		}
+
+		var buf bytes.Buffer
+		if err := apple_mdm.OTASCEPTemplate.Execute(&buf, struct {
+			SCEPURL       string
+			SCEPChallenge string
+		}{
+			SCEPURL:       scepURL,
+			SCEPChallenge: scepChallenge,
+		}); err != nil {
+			return nil, ctxerr.Wrap(ctx, err, "execute template")
+		}
+		return buf.Bytes(), nil
 	}
 
-	appCfg.MDM.AppleBMEnabledAndConfigured = false
-	return svc.ds.SaveAppConfig(ctx, appCfg)
+	// otherwise we might be in the second phase, check if the signing cert
+	// was issued by Fleet, only let the enrollment through if so.
+	certVerifier := mdmcrypto.NewSCEPVerifier(svc.ds)
+	if err := certVerifier.Verify(rootSigner); err != nil {
+		return nil, authz.ForbiddenWithInternal(fmt.Sprintf("payload signed with invalid certificate: %s", err), nil, nil, nil)
+	}
+
+	topic, err := svc.mdmPushCertTopic(ctx)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "extracting topic from APNs cert")
+	}
+
+	enrollmentProf, err := apple_mdm.GenerateEnrollmentProfileMobileconfig(
+		appCfg.OrgInfo.OrgName,
+		appCfg.ServerSettings.ServerURL,
+		string(assets[fleet.MDMAssetSCEPChallenge].Value),
+		topic,
+	)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "generating manual enrollment profile")
+	}
+
+	// before responding, create a host record, and assign the host to the
+	// team that matches the enroll secret provided.
+	err = svc.ds.IngestMDMAppleDeviceFromOTAEnrollment(ctx, enrollSecretInfo.TeamID, deviceInfo)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "creating new host record")
+	}
+
+	// at this point we know the device can be enrolled, so we respond with
+	// a signed enrollment profile
+	signed, err := mdmcrypto.Sign(ctx, enrollmentProf, svc.ds)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "signing profile")
+	}
+
+	return signed, nil
 }
diff --git a/server/service/apple_mdm_test.go b/server/service/apple_mdm_test.go
index 545de31a0a..aeabb3542b 100644
--- a/server/service/apple_mdm_test.go
+++ b/server/service/apple_mdm_test.go
@@ -24,6 +24,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/fleetdm/fleet/v4/pkg/optjson"
 	"github.com/fleetdm/fleet/v4/server/authz"
 	"github.com/fleetdm/fleet/v4/server/config"
 	"github.com/fleetdm/fleet/v4/server/contexts/license"
@@ -48,9 +49,9 @@ import (
 	"github.com/google/uuid"
 	"github.com/groob/plist"
 	micromdm "github.com/micromdm/micromdm/mdm/mdm"
+	"github.com/smallstep/pkcs7"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"go.mozilla.org/pkcs7"
 )
 
 type nopProfileMatcher struct{}
@@ -79,6 +80,9 @@ func setupAppleMDMService(t *testing.T, license *fleet.LicenseInfo) (fleet.Servi
 			_, err := w.Write([]byte(`{"auth_session_token": "yoo"}`))
 			require.NoError(t, err)
 			return
+		case strings.Contains(r.URL.Path, "/profile"):
+			_, err := w.Write([]byte(`{"profile_uuid": "profile123"}`))
+			require.NoError(t, err)
 		}
 	}))
 
@@ -217,12 +221,32 @@ func setupAppleMDMService(t *testing.T, license *fleet.LicenseInfo) (fleet.Servi
 		}, nil
 	}
 
+	ds.GetABMTokenOrgNamesAssociatedWithTeamFunc = func(ctx context.Context, teamID *uint) ([]string, error) {
+		return []string{"foobar"}, nil
+	}
+	ds.ListABMTokensFunc = func(ctx context.Context) ([]*fleet.ABMToken, error) {
+		return []*fleet.ABMToken{{ID: 1}}, nil
+	}
+
 	return svc, ctx, ds
 }
 
 func TestAppleMDMAuthorization(t *testing.T) {
 	svc, ctx, ds := setupAppleMDMService(t, &fleet.LicenseInfo{Tier: fleet.TierPremium})
 
+	ds.GetEnrollSecretsFunc = func(ctx context.Context, teamID *uint) ([]*fleet.EnrollSecret, error) {
+		return []*fleet.EnrollSecret{
+			{
+				Secret: "abcd",
+				TeamID: nil,
+			},
+			{
+				Secret: "efgh",
+				TeamID: nil,
+			},
+		}, nil
+	}
+
 	checkAuthErr := func(t *testing.T, err error, shouldFailWithAuth bool) {
 		t.Helper()
 
@@ -246,8 +270,6 @@ func TestAppleMDMAuthorization(t *testing.T) {
 		checkAuthErr(t, err, shouldFailWithAuth)
 		_, err = svc.ListMDMAppleDevices(ctx)
 		checkAuthErr(t, err, shouldFailWithAuth)
-		_, err = svc.ListMDMAppleDEPDevices(ctx)
-		checkAuthErr(t, err, shouldFailWithAuth)
 
 		// check EULA routes
 		_, err = svc.MDMGetEULAMetadata(ctx)
@@ -600,8 +622,9 @@ func TestMDMAppleConfigProfileAuthz(t *testing.T) {
 	ds.GetMDMAppleProfilesSummaryFunc = func(context.Context, *uint) (*fleet.MDMProfilesSummary, error) {
 		return nil, nil
 	}
-	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hids, tids []uint, puuids, uuids []string) error {
-		return nil
+	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hids, tids []uint, puuids, uuids []string,
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 	mockGetFuncWithTeamID := func(teamID uint) mock.GetMDMAppleConfigProfileFunc {
 		return func(ctx context.Context, puid string) (*fleet.MDMAppleConfigProfile, error) {
@@ -707,8 +730,9 @@ func TestNewMDMAppleConfigProfile(t *testing.T) {
 	ds.NewActivityFunc = func(context.Context, *fleet.User, fleet.ActivityDetails, []byte, time.Time) error {
 		return nil
 	}
-	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hids, tids []uint, puuids, uuids []string) error {
-		return nil
+	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hids, tids []uint, puuids, uuids []string,
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 
 	cp, err := svc.NewMDMAppleConfigProfile(ctx, 0, r, nil, false)
@@ -1500,8 +1524,9 @@ func TestMDMBatchSetAppleProfiles(t *testing.T) {
 	) error {
 		return nil
 	}
-	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hids, tids []uint, puuids, uuids []string) error {
-		return nil
+	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hids, tids []uint, puuids, uuids []string,
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 	ds.ListMDMConfigProfilesFunc = func(ctx context.Context, tid *uint, opt fleet.ListOptions) ([]*fleet.MDMConfigProfilePayload, *fleet.PaginationMetadata, error) {
 		return nil, nil, nil
@@ -1816,8 +1841,9 @@ func TestMDMBatchSetAppleProfilesBoolArgs(t *testing.T) {
 	) error {
 		return nil
 	}
-	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hids, tids []uint, profileUUIDs, uuids []string) error {
-		return nil
+	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hids, tids []uint, profileUUIDs, uuids []string,
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 	ds.ListMDMConfigProfilesFunc = func(ctx context.Context, tid *uint, opt fleet.ListOptions) ([]*fleet.MDMConfigProfilePayload, *fleet.PaginationMetadata, error) {
 		return nil, nil, nil
@@ -2592,7 +2618,7 @@ func TestEnsureFleetdConfig(t *testing.T) {
 		ds.AppConfigFunc = func(ctx context.Context) (*fleet.AppConfig, error) {
 			appCfg := &fleet.AppConfig{}
 			appCfg.ServerSettings.ServerURL = testURL
-			appCfg.MDM.AppleBMDefaultTeam = testTeamName
+			appCfg.MDM.DeprecatedAppleBMDefaultTeam = testTeamName
 			return appCfg, nil
 		}
 		ds.AggregateEnrollSecretPerTeamFunc = func(ctx context.Context) ([]*fleet.EnrollSecret, error) {
@@ -2636,7 +2662,7 @@ func TestEnsureFleetdConfig(t *testing.T) {
 		ds.AppConfigFunc = func(ctx context.Context) (*fleet.AppConfig, error) {
 			appCfg := &fleet.AppConfig{}
 			appCfg.ServerSettings.ServerURL = testURL
-			appCfg.MDM.AppleBMDefaultTeam = testTeamName
+			appCfg.MDM.DeprecatedAppleBMDefaultTeam = testTeamName
 			return appCfg, nil
 		}
 		ds.AggregateEnrollSecretPerTeamFunc = func(ctx context.Context) ([]*fleet.EnrollSecret, error) {
@@ -2743,6 +2769,12 @@ func TestMDMAppleSetupAssistant(t *testing.T) {
 	ds.TeamFunc = func(ctx context.Context, id uint) (*fleet.Team, error) {
 		return &fleet.Team{ID: id}, nil
 	}
+	ds.GetMDMAppleEnrollmentProfileByTypeFunc = func(ctx context.Context, typ fleet.MDMAppleEnrollmentType) (*fleet.MDMAppleEnrollmentProfile, error) {
+		return &fleet.MDMAppleEnrollmentProfile{Token: "foobar"}, nil
+	}
+	ds.CountABMTokensWithTermsExpiredFunc = func(ctx context.Context) (int, error) {
+		return 0, nil
+	}
 
 	testCases := []struct {
 		name            string
@@ -3211,7 +3243,7 @@ func TestMDMCommandAndReportResultsIOSIPadOSRefetch(t *testing.T) {
 	ctx := context.Background()
 	hostID := uint(42)
 	hostUUID := "ABC-DEF-GHI"
-	commandUUID := "REFETCH-COMMAND-UUID"
+	commandUUID := fleet.RefetchDeviceCommandUUIDPrefix + "UUID"
 
 	ds := new(mock.Store)
 	svc := MDMAppleCheckinAndCommandService{ds: ds}
@@ -3245,6 +3277,11 @@ func TestMDMCommandAndReportResultsIOSIPadOSRefetch(t *testing.T) {
 		require.Equal(t, "ipados", hostOS.Platform)
 		return nil
 	}
+	ds.RemoveHostMDMCommandFunc = func(ctx context.Context, command fleet.HostMDMCommand) error {
+		assert.Equal(t, hostID, command.HostID)
+		assert.Equal(t, fleet.RefetchDeviceCommandUUIDPrefix, command.CommandType)
+		return nil
+	}
 
 	_, err := svc.CommandAndReportResults(
 		&mdm.Request{Context: ctx},
@@ -3286,6 +3323,7 @@ func TestMDMCommandAndReportResultsIOSIPadOSRefetch(t *testing.T) {
 	require.True(t, ds.HostByIdentifierFuncInvoked)
 	require.True(t, ds.SetOrUpdateHostDisksSpaceFuncInvoked)
 	require.True(t, ds.UpdateHostOperatingSystemFuncInvoked)
+	assert.True(t, ds.RemoveHostMDMCommandFuncInvoked)
 }
 
 func TestUnmarshalAppList(t *testing.T) {
@@ -3371,3 +3409,246 @@ func TestUnmarshalAppList(t *testing.T) {
 	require.NoError(t, err)
 	assert.ElementsMatch(t, expectedSoftware, software)
 }
+
+func TestCheckMDMAppleEnrollmentWithMinimumOSVersion(t *testing.T) {
+	svc, ctx, ds := setupAppleMDMService(t, &fleet.LicenseInfo{Tier: fleet.TierPremium})
+
+	gdmf := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		// load the test data from the file
+		b, err := os.ReadFile("../mdm/apple/gdmf/testdata/gdmf.json")
+		require.NoError(t, err)
+		_, err = w.Write(b)
+		require.NoError(t, err)
+	}))
+	defer gdmf.Close()
+	t.Setenv("FLEET_DEV_GDMF_URL", gdmf.URL)
+
+	latestMacOSVersion := "14.6.1"
+	latestMacOSBuild := "23G93"
+
+	testCases := []struct {
+		name           string
+		machineInfo    *fleet.MDMAppleMachineInfo
+		updateRequired *fleet.MDMAppleSoftwareUpdateRequiredDetails
+		err            string
+	}{
+		{
+			name: "OS version is greater than latest",
+			machineInfo: &fleet.MDMAppleMachineInfo{
+				MDMCanRequestSoftwareUpdate: true,
+				Product:                     "Mac15,7",
+				OSVersion:                   "14.6.2",
+				SupplementalBuildVersion:    "IRRELEVANT",
+				SoftwareUpdateDeviceID:      "J516sAP",
+			},
+			updateRequired: nil,
+		},
+		{
+			name: "OS version is equal to latest",
+			machineInfo: &fleet.MDMAppleMachineInfo{
+				MDMCanRequestSoftwareUpdate: true,
+				Product:                     "Mac15,7",
+				OSVersion:                   latestMacOSVersion,
+				SupplementalBuildVersion:    "IRRELEVANT",
+				SoftwareUpdateDeviceID:      "J516sAP",
+			},
+			updateRequired: nil,
+		},
+		{
+			name: "OS version is less than latest",
+			machineInfo: &fleet.MDMAppleMachineInfo{
+				MDMCanRequestSoftwareUpdate: true,
+				Product:                     "Mac15,7",
+				OSVersion:                   "14.4",
+				SupplementalBuildVersion:    "IRRELEVANT",
+				SoftwareUpdateDeviceID:      "J516sAP",
+			},
+			updateRequired: &fleet.MDMAppleSoftwareUpdateRequiredDetails{
+				OSVersion:    latestMacOSVersion,
+				BuildVersion: latestMacOSBuild,
+			},
+		},
+		{
+			name: "OS version is less than latest but MDM cannot request software update",
+			machineInfo: &fleet.MDMAppleMachineInfo{
+				MDMCanRequestSoftwareUpdate: false,
+				Product:                     "Mac15,7",
+				OSVersion:                   "14.4",
+				SupplementalBuildVersion:    "IRRELEVANT",
+				SoftwareUpdateDeviceID:      "J516sAP",
+			},
+			updateRequired: nil,
+		},
+		{
+			name: "no match for software update device ID",
+			machineInfo: &fleet.MDMAppleMachineInfo{
+				MDMCanRequestSoftwareUpdate: true,
+				Product:                     "Mac15,7",
+				OSVersion:                   "14.4",
+				SupplementalBuildVersion:    "IRRELEVANT",
+				SoftwareUpdateDeviceID:      "INVALID",
+			},
+			updateRequired: nil,
+			err:            "", // no error, allow enrollment to proceed without software update
+		},
+		{
+			name:           "no machine info",
+			machineInfo:    nil,
+			updateRequired: nil,
+			err:            "", // no error, allow enrollment to proceed without software update
+		},
+		{
+			name: "cannot parse OS version",
+			machineInfo: &fleet.MDMAppleMachineInfo{
+				MDMCanRequestSoftwareUpdate: true,
+				Product:                     "Mac15,7",
+				OSVersion:                   "INVALID",
+				SupplementalBuildVersion:    "IRRELEVANT",
+				SoftwareUpdateDeviceID:      "J516sAP",
+			},
+			updateRequired: nil,
+			err:            "invalid current version",
+		},
+	}
+
+	for _, tt := range testCases {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Run("settings minimum equal to latest", func(t *testing.T) {
+				ds.GetMDMAppleOSUpdatesSettingsByHostSerialFunc = func(ctx context.Context, serial string) (*fleet.AppleOSUpdateSettings, error) {
+					return &fleet.AppleOSUpdateSettings{
+						MinimumVersion: optjson.SetString(latestMacOSVersion),
+					}, nil
+				}
+				sur, err := svc.CheckMDMAppleEnrollmentWithMinimumOSVersion(ctx, tt.machineInfo)
+				if tt.err != "" {
+					require.Error(t, err)
+					require.Contains(t, err.Error(), tt.err)
+				} else {
+					require.NoError(t, err)
+				}
+				if tt.updateRequired != nil {
+					require.Equal(t, &fleet.MDMAppleSoftwareUpdateRequired{
+						Code:    fleet.MDMAppleSoftwareUpdateRequiredCode,
+						Details: *tt.updateRequired,
+					}, sur)
+				} else {
+					require.Nil(t, sur)
+				}
+			})
+
+			t.Run("settings minimum below latest", func(t *testing.T) {
+				ds.GetMDMAppleOSUpdatesSettingsByHostSerialFunc = func(ctx context.Context, serial string) (*fleet.AppleOSUpdateSettings, error) {
+					return &fleet.AppleOSUpdateSettings{
+						MinimumVersion: optjson.SetString("14.5"),
+					}, nil
+				}
+				sur, err := svc.CheckMDMAppleEnrollmentWithMinimumOSVersion(ctx, tt.machineInfo)
+				if tt.err != "" {
+					require.Error(t, err)
+					require.Contains(t, err.Error(), tt.err)
+				} else {
+					require.NoError(t, err)
+				}
+				if tt.updateRequired != nil {
+					require.Equal(t, &fleet.MDMAppleSoftwareUpdateRequired{
+						Code:    fleet.MDMAppleSoftwareUpdateRequiredCode,
+						Details: *tt.updateRequired,
+					}, sur)
+				} else {
+					require.Nil(t, sur)
+				}
+			})
+
+			t.Run("settings minimum above latest", func(t *testing.T) {
+				// edge case, but in practice it would get treated as if minimum was equal to latest
+				ds.GetMDMAppleOSUpdatesSettingsByHostSerialFunc = func(ctx context.Context, serial string) (*fleet.AppleOSUpdateSettings, error) {
+					return &fleet.AppleOSUpdateSettings{
+						MinimumVersion: optjson.SetString("14.7"),
+					}, nil
+				}
+				sur, err := svc.CheckMDMAppleEnrollmentWithMinimumOSVersion(ctx, tt.machineInfo)
+				if tt.err != "" {
+					require.Error(t, err)
+					require.Contains(t, err.Error(), tt.err)
+				} else {
+					require.NoError(t, err)
+				}
+				if tt.updateRequired != nil {
+					require.Equal(t, &fleet.MDMAppleSoftwareUpdateRequired{
+						Code:    fleet.MDMAppleSoftwareUpdateRequiredCode,
+						Details: *tt.updateRequired,
+					}, sur)
+				} else {
+					require.Nil(t, sur)
+				}
+			})
+
+			t.Run("device above settings minimum", func(t *testing.T) {
+				ds.GetMDMAppleOSUpdatesSettingsByHostSerialFunc = func(ctx context.Context, serial string) (*fleet.AppleOSUpdateSettings, error) {
+					return &fleet.AppleOSUpdateSettings{
+						MinimumVersion: optjson.SetString("14.1"),
+					}, nil
+				}
+				sur, err := svc.CheckMDMAppleEnrollmentWithMinimumOSVersion(ctx, tt.machineInfo)
+				if tt.err != "" {
+					require.Error(t, err)
+					require.Contains(t, err.Error(), tt.err)
+				} else {
+					require.NoError(t, err)
+				}
+
+				require.Nil(t, sur)
+			})
+
+			t.Run("minimum not set", func(t *testing.T) {
+				ds.GetMDMAppleOSUpdatesSettingsByHostSerialFunc = func(ctx context.Context, serial string) (*fleet.AppleOSUpdateSettings, error) {
+					return &fleet.AppleOSUpdateSettings{}, nil
+				}
+				sur, err := svc.CheckMDMAppleEnrollmentWithMinimumOSVersion(ctx, tt.machineInfo)
+				require.NoError(t, err)
+				require.Nil(t, sur)
+
+				ds.GetMDMAppleOSUpdatesSettingsByHostSerialFunc = func(ctx context.Context, serial string) (*fleet.AppleOSUpdateSettings, error) {
+					return &fleet.AppleOSUpdateSettings{
+						MinimumVersion: optjson.SetString(""),
+					}, nil
+				}
+				sur, err = svc.CheckMDMAppleEnrollmentWithMinimumOSVersion(ctx, tt.machineInfo)
+				require.NoError(t, err)
+				require.Nil(t, sur)
+			})
+
+			t.Run("minimum not found", func(t *testing.T) {
+				ds.GetMDMAppleOSUpdatesSettingsByHostSerialFunc = func(ctx context.Context, serial string) (*fleet.AppleOSUpdateSettings, error) {
+					return nil, &notFoundError{}
+				}
+				sur, err := svc.CheckMDMAppleEnrollmentWithMinimumOSVersion(ctx, tt.machineInfo)
+				require.NoError(t, err)
+				require.Nil(t, sur)
+			})
+		})
+	}
+
+	t.Run("gdmf server is down", func(t *testing.T) {
+		gdmf.Close()
+
+		for _, tt := range testCases {
+			t.Run(tt.name, func(t *testing.T) {
+				ds.GetMDMAppleOSUpdatesSettingsByHostSerialFunc = func(ctx context.Context, serial string) (*fleet.AppleOSUpdateSettings, error) {
+					return &fleet.AppleOSUpdateSettings{MinimumVersion: optjson.SetString(latestMacOSVersion)}, nil
+				}
+
+				sur, err := svc.CheckMDMAppleEnrollmentWithMinimumOSVersion(ctx, tt.machineInfo)
+				if tt.err != "" {
+					require.Error(t, err)
+					require.Contains(t, err.Error(), tt.err) // still can get errors parsing the versions from the device info header or config settings
+				} else {
+					require.NoError(t, err)
+				}
+
+				require.Nil(t, sur) // if gdmf server is down, we don't enforce os updates for DEP
+			})
+		}
+	})
+}
diff --git a/server/service/client.go b/server/service/client.go
index 09ab08e031..8924707784 100644
--- a/server/service/client.go
+++ b/server/service/client.go
@@ -21,6 +21,7 @@ import (
 	"github.com/fleetdm/fleet/v4/server/contexts/ctxerr"
 	"github.com/fleetdm/fleet/v4/server/fleet"
 	"github.com/fleetdm/fleet/v4/server/mdm"
+	"github.com/fleetdm/fleet/v4/server/ptr"
 	kithttp "github.com/go-kit/kit/transport/http"
 )
 
@@ -394,8 +395,11 @@ func (c *Client) ApplyGroup(
 	specs *spec.Group,
 	baseDir string,
 	logf func(format string, args ...interface{}),
+	appconfig *fleet.EnrichedAppConfig,
 	opts fleet.ApplyClientSpecOptions,
-) (map[string]uint, error) {
+) (map[string]uint, map[string][]fleet.SoftwarePackageResponse, error) {
+	teamSoftwareInstallers := make(map[string][]fleet.SoftwarePackageResponse)
+
 	logfn := func(format string, args ...interface{}) {
 		if logf != nil {
 			logf(format, args...)
@@ -408,7 +412,7 @@ func (c *Client) ApplyGroup(
 			logfn("[!] ignoring queries, dry run mode only supported for 'config' and 'team' specs\n")
 		} else {
 			if err := c.ApplyQueries(specs.Queries); err != nil {
-				return nil, fmt.Errorf("applying queries: %w", err)
+				return nil, nil, fmt.Errorf("applying queries: %w", err)
 			}
 			logfn("[+] applied %d queries\n", len(specs.Queries))
 		}
@@ -419,42 +423,18 @@ func (c *Client) ApplyGroup(
 			logfn("[!] ignoring labels, dry run mode only supported for 'config' and 'team' specs\n")
 		} else {
 			if err := c.ApplyLabels(specs.Labels); err != nil {
-				return nil, fmt.Errorf("applying labels: %w", err)
+				return nil, nil, fmt.Errorf("applying labels: %w", err)
 			}
 			logfn("[+] applied %d labels\n", len(specs.Labels))
 		}
 	}
 
-	if len(specs.Policies) > 0 {
-		if opts.DryRun {
-			logfn("[!] ignoring policies, dry run mode only supported for 'config' and 'team' specs\n")
-		} else {
-			// Policy names must be unique, return error if duplicate policy names are found
-			if policyName := fleet.FirstDuplicatePolicySpecName(specs.Policies); policyName != "" {
-				return nil, fmt.Errorf(
-					"applying policies: policy names must be unique. Please correct policy %q and try again.", policyName,
-				)
-			}
-
-			// If set, override the team in all the policies.
-			if opts.TeamForPolicies != "" {
-				for _, policySpec := range specs.Policies {
-					policySpec.Team = opts.TeamForPolicies
-				}
-			}
-			if err := c.ApplyPolicies(specs.Policies); err != nil {
-				return nil, fmt.Errorf("applying policies: %w", err)
-			}
-			logfn("[+] applied %d policies\n", len(specs.Policies))
-		}
-	}
-
 	if len(specs.Packs) > 0 {
 		if opts.DryRun {
 			logfn("[!] ignoring packs, dry run mode only supported for 'config' and 'team' specs\n")
 		} else {
 			if err := c.ApplyPacks(specs.Packs); err != nil {
-				return nil, fmt.Errorf("applying packs: %w", err)
+				return nil, nil, fmt.Errorf("applying packs: %w", err)
 			}
 			logfn("[+] applied %d packs\n", len(specs.Packs))
 		}
@@ -474,7 +454,7 @@ func (c *Client) ApplyGroup(
 		if (windowsCustomSettings != nil && macosCustomSettings != nil) || len(windowsCustomSettings)+len(macosCustomSettings) > 0 {
 			fileContents, err := getProfilesContents(baseDir, macosCustomSettings, windowsCustomSettings, opts.ExpandEnvConfigProfiles)
 			if err != nil {
-				return nil, err
+				return nil, nil, err
 			}
 			// Figure out if MDM should be enabled.
 			assumeEnabled := false
@@ -488,30 +468,30 @@ func (c *Client) ApplyGroup(
 				}
 			}
 			if err := c.ApplyNoTeamProfiles(fileContents, opts.ApplySpecOptions, assumeEnabled); err != nil {
-				return nil, fmt.Errorf("applying custom settings: %w", err)
+				return nil, nil, fmt.Errorf("applying custom settings: %w", err)
 			}
 		}
 		if macosSetup := extractAppCfgMacOSSetup(specs.AppConfig); macosSetup != nil {
 			if macosSetup.BootstrapPackage.Value != "" {
 				pkg, err := c.ValidateBootstrapPackageFromURL(macosSetup.BootstrapPackage.Value)
 				if err != nil {
-					return nil, fmt.Errorf("applying fleet config: %w", err)
+					return nil, nil, fmt.Errorf("applying fleet config: %w", err)
 				}
 
 				if !opts.DryRun {
 					if err := c.EnsureBootstrapPackage(pkg, uint(0)); err != nil {
-						return nil, fmt.Errorf("applying fleet config: %w", err)
+						return nil, nil, fmt.Errorf("applying fleet config: %w", err)
 					}
 				}
 			}
 			if macosSetup.MacOSSetupAssistant.Value != "" {
 				content, err := c.validateMacOSSetupAssistant(resolveApplyRelativePath(baseDir, macosSetup.MacOSSetupAssistant.Value))
 				if err != nil {
-					return nil, fmt.Errorf("applying fleet config: %w", err)
+					return nil, nil, fmt.Errorf("applying fleet config: %w", err)
 				}
 				if !opts.DryRun {
 					if err := c.uploadMacOSSetupAssistant(content, nil, macosSetup.MacOSSetupAssistant.Value); err != nil {
-						return nil, fmt.Errorf("applying fleet config: %w", err)
+						return nil, nil, fmt.Errorf("applying fleet config: %w", err)
 					}
 				}
 			}
@@ -522,7 +502,7 @@ func (c *Client) ApplyGroup(
 			for i, f := range files {
 				b, err := os.ReadFile(f)
 				if err != nil {
-					return nil, fmt.Errorf("applying fleet config: %w", err)
+					return nil, nil, fmt.Errorf("applying fleet config: %w", err)
 				}
 				scriptPayloads[i] = fleet.ScriptPayload{
 					ScriptContents: b,
@@ -530,11 +510,11 @@ func (c *Client) ApplyGroup(
 				}
 			}
 			if err := c.ApplyNoTeamScripts(scriptPayloads, opts.ApplySpecOptions); err != nil {
-				return nil, fmt.Errorf("applying custom settings: %w", err)
+				return nil, nil, fmt.Errorf("applying custom settings: %w", err)
 			}
 		}
 		if err := c.ApplyAppConfig(specs.AppConfig, opts.ApplySpecOptions); err != nil {
-			return nil, fmt.Errorf("applying fleet config: %w", err)
+			return nil, nil, fmt.Errorf("applying fleet config: %w", err)
 		}
 		if opts.DryRun {
 			logfn("[+] would've applied fleet config\n")
@@ -545,7 +525,7 @@ func (c *Client) ApplyGroup(
 
 	if specs.EnrollSecret != nil {
 		if err := c.ApplyEnrollSecretSpec(specs.EnrollSecret, opts.ApplySpecOptions); err != nil {
-			return nil, fmt.Errorf("applying enroll secrets: %w", err)
+			return nil, nil, fmt.Errorf("applying enroll secrets: %w", err)
 		}
 		if opts.DryRun {
 			logfn("[+] would've applied enroll secrets\n")
@@ -564,7 +544,7 @@ func (c *Client) ApplyGroup(
 		for k, profileSpecs := range tmMDMSettings {
 			fileContents, err := getProfilesContents(baseDir, profileSpecs.macos, profileSpecs.windows, opts.ExpandEnvConfigProfiles)
 			if err != nil {
-				return nil, fmt.Errorf("Team %s: %w", k, err) // TODO: consider adding team name to improve error messages generally for other parts of the config because multiple team configs can be processed at once
+				return nil, nil, fmt.Errorf("Team %s: %w", k, err) // TODO: consider adding team name to improve error messages generally for other parts of the config because multiple team configs can be processed at once
 			}
 			tmFileContents[k] = fileContents
 		}
@@ -576,14 +556,14 @@ func (c *Client) ApplyGroup(
 			if setup.BootstrapPackage.Value != "" {
 				bp, err := c.ValidateBootstrapPackageFromURL(setup.BootstrapPackage.Value)
 				if err != nil {
-					return nil, fmt.Errorf("applying teams: %w", err)
+					return nil, nil, fmt.Errorf("applying teams: %w", err)
 				}
 				tmBootstrapPackages[k] = bp
 			}
 			if setup.MacOSSetupAssistant.Value != "" {
 				b, err := c.validateMacOSSetupAssistant(resolveApplyRelativePath(baseDir, setup.MacOSSetupAssistant.Value))
 				if err != nil {
-					return nil, fmt.Errorf("applying teams: %w", err)
+					return nil, nil, fmt.Errorf("applying teams: %w", err)
 				}
 				tmMacSetupAssistants[k] = b
 			}
@@ -597,7 +577,7 @@ func (c *Client) ApplyGroup(
 			for i, f := range files {
 				b, err := os.ReadFile(f)
 				if err != nil {
-					return nil, fmt.Errorf("applying fleet config: %w", err)
+					return nil, nil, fmt.Errorf("applying fleet config: %w", err)
 				}
 				scriptPayloads[i] = fleet.ScriptPayload{
 					ScriptContents: b,
@@ -608,92 +588,12 @@ func (c *Client) ApplyGroup(
 		}
 
 		tmSoftwarePackages := extractTmSpecsSoftwarePackages(specs.Teams)
-		tmSoftwarePackagesPayloads := make(map[string][]fleet.SoftwareInstallerPayload, len(tmScripts))
+		tmSoftwarePackagesPayloads := make(map[string][]fleet.SoftwareInstallerPayload, len(tmSoftwarePackages))
 		for tmName, software := range tmSoftwarePackages {
-			softwarePayloads := make([]fleet.SoftwareInstallerPayload, len(software))
-			for i, si := range software {
-				var qc string
-				var err error
-				if si.PreInstallQuery.Path != "" {
-					queryFile := resolveApplyRelativePath(baseDir, si.PreInstallQuery.Path)
-					rawSpec, err := os.ReadFile(queryFile)
-					if err != nil {
-						return nil, fmt.Errorf("reading pre-install query: %w", err)
-					}
-
-					rawSpecExpanded, err := spec.ExpandEnvBytes(rawSpec)
-					if err != nil {
-						return nil, fmt.Errorf("Couldn't exit software (%s). Unable to expand environment variable in YAML file %s: %w", si.URL, queryFile, err)
-					}
-
-					var top any
-
-					if err := yaml.Unmarshal(rawSpecExpanded, &top); err != nil {
-						return nil, fmt.Errorf("Couldn't exit software (%s). Unable to expand environment variable in YAML file %s: %w", si.URL, queryFile, err)
-					}
-
-					if _, ok := top.(map[any]any); ok {
-						// Old apply format
-						group, err := spec.GroupFromBytes(rawSpecExpanded)
-						if err != nil {
-							return nil, fmt.Errorf("Couldn't edit software (%s). Unable to parse pre-install apply format query YAML file %s: %w", si.URL, queryFile, err)
-						}
-
-						if len(group.Queries) > 1 {
-							return nil, fmt.Errorf("Couldn't edit software (%s). Pre-install query YAML file %s should have only one query.", si.URL, queryFile)
-						}
-
-						if len(group.Queries) == 0 {
-							return nil, fmt.Errorf("Couldn't edit software (%s). Pre-install query YAML file %s doesn't have a query defined.", si.URL, queryFile)
-						}
-
-						qc = group.Queries[0].Query
-					} else {
-						// Gitops format
-						var querySpecs []fleet.QuerySpec
-						if err := yaml.Unmarshal(rawSpecExpanded, &querySpecs); err != nil {
-							return nil, fmt.Errorf("Couldn't edit software (%s). Unable to parse pre-install query YAML file %s: %w", si.URL, queryFile, err)
-						}
-
-						if len(querySpecs) > 1 {
-							return nil, fmt.Errorf("Couldn't edit software (%s). Pre-install query YAML file %s should have only one query.", si.URL, queryFile)
-						}
-
-						if len(querySpecs) == 0 {
-							return nil, fmt.Errorf("Couldn't edit software (%s). Pre-install query YAML file %s doesn't have a query defined.", si.URL, queryFile)
-						}
-
-						qc = querySpecs[0].Query
-					}
-				}
-
-				var ic []byte
-				if si.InstallScript.Path != "" {
-					installScriptFile := resolveApplyRelativePath(baseDir, si.InstallScript.Path)
-					ic, err = os.ReadFile(installScriptFile)
-					if err != nil {
-						return nil, fmt.Errorf("Couldn't edit software (%s). Unable to read install script file %s: %w", si.URL, si.InstallScript.Path, err)
-					}
-				}
-
-				var pc []byte
-				if si.PostInstallScript.Path != "" {
-					postInstallScriptFile := resolveApplyRelativePath(baseDir, si.PostInstallScript.Path)
-					pc, err = os.ReadFile(postInstallScriptFile)
-					if err != nil {
-						return nil, fmt.Errorf("Couldn't edit software (%s). Unable to read post-install script file %s: %w", si.URL, si.PostInstallScript.Path, err)
-					}
-				}
-
-				softwarePayloads[i] = fleet.SoftwareInstallerPayload{
-					URL:               si.URL,
-					SelfService:       si.SelfService,
-					PreInstallQuery:   qc,
-					InstallScript:     string(ic),
-					PostInstallScript: string(pc),
-				}
+			softwarePayloads, err := buildSoftwarePackagesPayload(baseDir, software)
+			if err != nil {
+				return nil, nil, fmt.Errorf("applying software installers for team %q: %w", tmName, err)
 			}
-
 			tmSoftwarePackagesPayloads[tmName] = softwarePayloads
 		}
 
@@ -702,7 +602,7 @@ func (c *Client) ApplyGroup(
 		for tmName, apps := range tmSoftwareApps {
 			appPayloads := make([]fleet.VPPBatchPayload, 0, len(apps))
 			for _, app := range apps {
-				appPayloads = append(appPayloads, fleet.VPPBatchPayload{AppStoreID: app.AppStoreID})
+				appPayloads = append(appPayloads, fleet.VPPBatchPayload{AppStoreID: app.AppStoreID, SelfService: app.SelfService})
 			}
 			tmSoftwareAppsPayloads[tmName] = appPayloads
 		}
@@ -717,7 +617,7 @@ func (c *Client) ApplyGroup(
 		// In dry-run, the team names returned are the old team names (when team name is modified via gitops)
 		teamIDsByName, err = c.ApplyTeams(specs.Teams, teamOpts)
 		if err != nil {
-			return nil, fmt.Errorf("applying teams: %w", err)
+			return nil, nil, fmt.Errorf("applying teams: %w", err)
 		}
 
 		// When using GitOps, the team name could change, so we need to check for that
@@ -744,7 +644,7 @@ func (c *Client) ApplyGroup(
 				} else {
 					logfn("[+] applying MDM profiles for team %s\n", tmName)
 					if err := c.ApplyTeamProfiles(currentTeamName, profs, teamOpts); err != nil {
-						return nil, fmt.Errorf("applying custom settings for team %q: %w", tmName, err)
+						return nil, nil, fmt.Errorf("applying custom settings for team %q: %w", tmName, err)
 					}
 				}
 			}
@@ -753,12 +653,23 @@ func (c *Client) ApplyGroup(
 			for tmName, tmID := range teamIDsByName {
 				if bp, ok := tmBootstrapPackages[tmName]; ok {
 					if err := c.EnsureBootstrapPackage(bp, tmID); err != nil {
-						return nil, fmt.Errorf("uploading bootstrap package for team %q: %w", tmName, err)
+						return nil, nil, fmt.Errorf("uploading bootstrap package for team %q: %w", tmName, err)
 					}
 				}
 				if b, ok := tmMacSetupAssistants[tmName]; ok {
 					if err := c.uploadMacOSSetupAssistant(b, &tmID, tmMacSetup[tmName].MacOSSetupAssistant.Value); err != nil {
-						return nil, fmt.Errorf("uploading macOS setup assistant for team %q: %w", tmName, err)
+						if strings.Contains(err.Error(), "Couldn't upload") {
+							// Then the error should look something like this:
+							// "Couldn't upload. CONFIG_NAME_INVALID"
+							// We want the part after the period (this is the error name from Apple)
+							// to render a more helpful error message.
+							parts := strings.Split(err.Error(), ".")
+							if len(parts) < 2 {
+								return nil, nil, fmt.Errorf("unexpected error while uploading macOS setup assistant for team %q: %w", tmName, err)
+							}
+							return nil, nil, fmt.Errorf("Couldn't edit macos_setup_assistant. Response from Apple: %s. Learn more at %s", strings.Trim(parts[1], " "), "https://fleetdm.com/learn-more-about/dep-profile")
+						}
+						return nil, nil, fmt.Errorf("uploading macOS setup assistant for team %q: %w", tmName, err)
 					}
 				}
 			}
@@ -768,7 +679,7 @@ func (c *Client) ApplyGroup(
 				// For non-dry run, currentTeamName and tmName are the same
 				currentTeamName := getTeamName(tmName)
 				if err := c.ApplyTeamScripts(currentTeamName, scripts, opts.ApplySpecOptions); err != nil {
-					return nil, fmt.Errorf("applying scripts for team %q: %w", tmName, err)
+					return nil, nil, fmt.Errorf("applying scripts for team %q: %w", tmName, err)
 				}
 			}
 		}
@@ -776,9 +687,12 @@ func (c *Client) ApplyGroup(
 			for tmName, software := range tmSoftwarePackagesPayloads {
 				// For non-dry run, currentTeamName and tmName are the same
 				currentTeamName := getTeamName(tmName)
-				if err := c.ApplyTeamSoftwareInstallers(currentTeamName, software, opts.ApplySpecOptions); err != nil {
-					return nil, fmt.Errorf("applying software installers for team %q: %w", tmName, err)
+				logfn("[+] applying %d software packages for team %s\n", len(software), tmName)
+				installers, err := c.ApplyTeamSoftwareInstallers(currentTeamName, software, opts.ApplySpecOptions)
+				if err != nil {
+					return nil, nil, fmt.Errorf("applying software installers for team %q: %w", tmName, err)
 				}
+				teamSoftwareInstallers[tmName] = installers
 			}
 		}
 		if len(tmSoftwareAppsPayloads) > 0 {
@@ -786,7 +700,7 @@ func (c *Client) ApplyGroup(
 				// For non-dry run, currentTeamName and tmName are the same
 				currentTeamName := getTeamName(tmName)
 				if err := c.ApplyTeamAppStoreAppsAssociation(currentTeamName, apps, opts.ApplySpecOptions); err != nil {
-					return nil, fmt.Errorf("applying app store apps for team: %q: %w", tmName, err)
+					return nil, nil, fmt.Errorf("applying app store apps for team: %q: %w", tmName, err)
 				}
 			}
 		}
@@ -797,17 +711,142 @@ func (c *Client) ApplyGroup(
 		}
 	}
 
+	// Policies can reference software installers thus they are applied at this point.
+	if len(specs.Policies) > 0 {
+		// Policy names must be unique, return error if duplicate policy names are found
+		if policyName := fleet.FirstDuplicatePolicySpecName(specs.Policies); policyName != "" {
+			return nil, nil, fmt.Errorf(
+				"applying policies: policy names must be unique. Please correct policy %q and try again.", policyName,
+			)
+		}
+		if opts.DryRun {
+			logfn("[!] ignoring policies, dry run mode only supported for 'config' and 'team' specs\n")
+		} else {
+			// If set, override the team in all the policies.
+			if opts.TeamForPolicies != "" {
+				for _, policySpec := range specs.Policies {
+					policySpec.Team = opts.TeamForPolicies
+				}
+			}
+			if err := c.ApplyPolicies(specs.Policies); err != nil {
+				return nil, nil, fmt.Errorf("applying policies: %w", err)
+			}
+			logfn("[+] applied %d policies\n", len(specs.Policies))
+		}
+	}
+
 	if specs.UsersRoles != nil {
 		if opts.DryRun {
 			logfn("[!] ignoring user roles, dry run mode only supported for 'config' and 'team' specs\n")
 		} else {
 			if err := c.ApplyUsersRoleSecretSpec(specs.UsersRoles); err != nil {
-				return nil, fmt.Errorf("applying user roles: %w", err)
+				return nil, nil, fmt.Errorf("applying user roles: %w", err)
 			}
 			logfn("[+] applied user roles\n")
 		}
 	}
-	return teamIDsByName, nil
+
+	return teamIDsByName, teamSoftwareInstallers, nil
+}
+
+func buildSoftwarePackagesPayload(baseDir string, specs []fleet.SoftwarePackageSpec) ([]fleet.SoftwareInstallerPayload, error) {
+	softwarePayloads := make([]fleet.SoftwareInstallerPayload, len(specs))
+	for i, si := range specs {
+		var qc string
+		var err error
+		if si.PreInstallQuery.Path != "" {
+			queryFile := resolveApplyRelativePath(baseDir, si.PreInstallQuery.Path)
+			rawSpec, err := os.ReadFile(queryFile)
+			if err != nil {
+				return nil, fmt.Errorf("reading pre-install query: %w", err)
+			}
+
+			rawSpecExpanded, err := spec.ExpandEnvBytes(rawSpec)
+			if err != nil {
+				return nil, fmt.Errorf("Couldn't exit software (%s). Unable to expand environment variable in YAML file %s: %w", si.URL, queryFile, err)
+			}
+
+			var top any
+
+			if err := yaml.Unmarshal(rawSpecExpanded, &top); err != nil {
+				return nil, fmt.Errorf("Couldn't exit software (%s). Unable to expand environment variable in YAML file %s: %w", si.URL, queryFile, err)
+			}
+
+			if _, ok := top.(map[any]any); ok {
+				// Old apply format
+				group, err := spec.GroupFromBytes(rawSpecExpanded)
+				if err != nil {
+					return nil, fmt.Errorf("Couldn't edit software (%s). Unable to parse pre-install apply format query YAML file %s: %w", si.URL, queryFile, err)
+				}
+
+				if len(group.Queries) > 1 {
+					return nil, fmt.Errorf("Couldn't edit software (%s). Pre-install query YAML file %s should have only one query.", si.URL, queryFile)
+				}
+
+				if len(group.Queries) == 0 {
+					return nil, fmt.Errorf("Couldn't edit software (%s). Pre-install query YAML file %s doesn't have a query defined.", si.URL, queryFile)
+				}
+
+				qc = group.Queries[0].Query
+			} else {
+				// Gitops format
+				var querySpecs []fleet.QuerySpec
+				if err := yaml.Unmarshal(rawSpecExpanded, &querySpecs); err != nil {
+					return nil, fmt.Errorf("Couldn't edit software (%s). Unable to parse pre-install query YAML file %s: %w", si.URL, queryFile, err)
+				}
+
+				if len(querySpecs) > 1 {
+					return nil, fmt.Errorf("Couldn't edit software (%s). Pre-install query YAML file %s should have only one query.", si.URL, queryFile)
+				}
+
+				if len(querySpecs) == 0 {
+					return nil, fmt.Errorf("Couldn't edit software (%s). Pre-install query YAML file %s doesn't have a query defined.", si.URL, queryFile)
+				}
+
+				qc = querySpecs[0].Query
+			}
+		}
+
+		var ic []byte
+		if si.InstallScript.Path != "" {
+			installScriptFile := resolveApplyRelativePath(baseDir, si.InstallScript.Path)
+			ic, err = os.ReadFile(installScriptFile)
+			if err != nil {
+				return nil, fmt.Errorf("Couldn't edit software (%s). Unable to read install script file %s: %w", si.URL, si.InstallScript.Path, err)
+			}
+		}
+
+		var pc []byte
+		if si.PostInstallScript.Path != "" {
+			postInstallScriptFile := resolveApplyRelativePath(baseDir, si.PostInstallScript.Path)
+			pc, err = os.ReadFile(postInstallScriptFile)
+			if err != nil {
+				return nil, fmt.Errorf("Couldn't edit software (%s). Unable to read post-install script file %s: %w", si.URL, si.PostInstallScript.Path, err)
+			}
+		}
+
+		var us []byte
+		if si.UninstallScript.Path != "" {
+			uninstallScriptFile := resolveApplyRelativePath(baseDir, si.UninstallScript.Path)
+			us, err = os.ReadFile(uninstallScriptFile)
+			if err != nil {
+				return nil, fmt.Errorf("Couldn't edit software (%s). Unable to read uninstall script file %s: %w", si.URL,
+					si.UninstallScript.Path, err)
+			}
+		}
+
+		softwarePayloads[i] = fleet.SoftwareInstallerPayload{
+			URL:               si.URL,
+			SelfService:       si.SelfService,
+			PreInstallQuery:   qc,
+			InstallScript:     string(ic),
+			PostInstallScript: string(pc),
+			UninstallScript:   string(us),
+		}
+
+	}
+
+	return softwarePayloads, nil
 }
 
 func extractAppCfgMacOSSetup(appCfg any) *fleet.MacOSSetup {
@@ -1045,8 +1084,8 @@ func extractTmSpecsMDMCustomSettings(tmSpecs []json.RawMessage) map[string]profi
 	return m
 }
 
-func extractTmSpecsSoftwarePackages(tmSpecs []json.RawMessage) map[string][]fleet.TeamSpecSoftwarePackage {
-	var m map[string][]fleet.TeamSpecSoftwarePackage
+func extractTmSpecsSoftwarePackages(tmSpecs []json.RawMessage) map[string][]fleet.SoftwarePackageSpec {
+	var m map[string][]fleet.SoftwarePackageSpec
 	for _, tm := range tmSpecs {
 		var spec struct {
 			Name     string          `json:"name"`
@@ -1059,10 +1098,10 @@ func extractTmSpecsSoftwarePackages(tmSpecs []json.RawMessage) map[string][]flee
 		spec.Name = norm.NFC.String(spec.Name)
 		if spec.Name != "" && len(spec.Software) > 0 {
 			if m == nil {
-				m = make(map[string][]fleet.TeamSpecSoftwarePackage)
+				m = make(map[string][]fleet.SoftwarePackageSpec)
 			}
-			var software fleet.TeamSpecSoftware
-			var packages []fleet.TeamSpecSoftwarePackage
+			var software fleet.SoftwareSpec
+			var packages []fleet.SoftwarePackageSpec
 			if err := json.Unmarshal(spec.Software, &software); err != nil {
 				// ignore, will fail in apply team specs call
 				continue
@@ -1070,7 +1109,7 @@ func extractTmSpecsSoftwarePackages(tmSpecs []json.RawMessage) map[string][]flee
 			if !software.Packages.Valid {
 				// to be consistent with the AppConfig custom settings, set it to an
 				// empty slice if the provided custom settings are present but empty.
-				packages = []fleet.TeamSpecSoftwarePackage{}
+				packages = []fleet.SoftwarePackageSpec{}
 			} else {
 				packages = software.Packages.Value
 			}
@@ -1096,7 +1135,7 @@ func extractTmSpecsSoftwareApps(tmSpecs []json.RawMessage) map[string][]fleet.Te
 			if m == nil {
 				m = make(map[string][]fleet.TeamSpecAppStoreApp)
 			}
-			var software fleet.TeamSpecSoftware
+			var software fleet.SoftwareSpec
 			var apps []fleet.TeamSpecAppStoreApp
 			if err := json.Unmarshal(spec.Software, &software); err != nil {
 				// ignore, will fail in apply team specs call
@@ -1255,7 +1294,7 @@ func (c *Client) DoGitOps(
 			}
 		}
 		group.AppConfig.(map[string]interface{})["scripts"] = scripts
-	} else {
+	} else if !config.IsNoTeam() {
 		team = make(map[string]interface{})
 		team["name"] = *config.TeamName
 		team["agent_options"] = config.AgentOptions
@@ -1273,9 +1312,13 @@ func (c *Client) DoGitOps(
 		team["webhook_settings"] = map[string]interface{}{}
 		clearHostStatusWebhook := true
 		if webhookSettings, ok := config.TeamSettings["webhook_settings"]; ok {
-			if hostStatusWebhook, ok := webhookSettings.(map[string]interface{})["host_status_webhook"]; ok {
-				clearHostStatusWebhook = false
-				team["webhook_settings"].(map[string]interface{})["host_status_webhook"] = hostStatusWebhook
+			if _, ok := webhookSettings.(map[string]interface{}); ok {
+				if hostStatusWebhook, ok := webhookSettings.(map[string]interface{})["host_status_webhook"]; ok {
+					clearHostStatusWebhook = false
+					team["webhook_settings"].(map[string]interface{})["host_status_webhook"] = hostStatusWebhook
+				}
+			} else if webhookSettings != nil {
+				return nil, fmt.Errorf("team_settings.webhook_settings config is not a map but a %T", webhookSettings)
 			}
 		}
 		if clearHostStatusWebhook {
@@ -1305,115 +1348,119 @@ func (c *Client) DoGitOps(
 		team["mdm"] = map[string]interface{}{}
 		mdmAppConfig = team["mdm"].(map[string]interface{})
 	}
-	// Common controls settings between org and team settings
-	// Put in default values for macos_settings
-	if config.Controls.MacOSSettings != nil {
-		mdmAppConfig["macos_settings"] = config.Controls.MacOSSettings
-	} else {
-		mdmAppConfig["macos_settings"] = map[string]interface{}{}
-	}
-	macOSSettings := mdmAppConfig["macos_settings"].(map[string]interface{})
-	if customSettings, ok := macOSSettings["custom_settings"]; !ok || customSettings == nil {
-		macOSSettings["custom_settings"] = []interface{}{}
-	}
-	// Put in default values for macos_updates
-	if config.Controls.MacOSUpdates != nil {
-		mdmAppConfig["macos_updates"] = config.Controls.MacOSUpdates
-	} else {
-		mdmAppConfig["macos_updates"] = map[string]interface{}{}
-	}
-	macOSUpdates := mdmAppConfig["macos_updates"].(map[string]interface{})
-	if minimumVersion, ok := macOSUpdates["minimum_version"]; !ok || minimumVersion == nil {
-		macOSUpdates["minimum_version"] = ""
-	}
-	if deadline, ok := macOSUpdates["deadline"]; !ok || deadline == nil {
-		macOSUpdates["deadline"] = ""
-	}
-	// Put in default values for ios_updates
-	if config.Controls.IOSUpdates != nil {
-		mdmAppConfig["ios_updates"] = config.Controls.IOSUpdates
-	} else {
-		mdmAppConfig["ios_updates"] = map[string]interface{}{}
-	}
-	iOSUpdates := mdmAppConfig["ios_updates"].(map[string]interface{})
-	if minimumVersion, ok := iOSUpdates["minimum_version"]; !ok || minimumVersion == nil {
-		iOSUpdates["minimum_version"] = ""
-	}
-	if deadline, ok := iOSUpdates["deadline"]; !ok || deadline == nil {
-		iOSUpdates["deadline"] = ""
-	}
-	// Put in default values for ipados_updates
-	if config.Controls.IPadOSUpdates != nil {
-		mdmAppConfig["ipados_updates"] = config.Controls.IPadOSUpdates
-	} else {
-		mdmAppConfig["ipados_updates"] = map[string]interface{}{}
-	}
-	iPadOSUpdates := mdmAppConfig["ipados_updates"].(map[string]interface{})
-	if minimumVersion, ok := iPadOSUpdates["minimum_version"]; !ok || minimumVersion == nil {
-		iPadOSUpdates["minimum_version"] = ""
-	}
-	if deadline, ok := iPadOSUpdates["deadline"]; !ok || deadline == nil {
-		iPadOSUpdates["deadline"] = ""
-	}
-	// Put in default values for macos_setup
-	if config.Controls.MacOSSetup != nil {
-		mdmAppConfig["macos_setup"] = config.Controls.MacOSSetup
-	} else {
-		mdmAppConfig["macos_setup"] = map[string]interface{}{}
-	}
-	macOSSetup := mdmAppConfig["macos_setup"].(map[string]interface{})
-	if bootstrapPackage, ok := macOSSetup["bootstrap_package"]; !ok || bootstrapPackage == nil {
-		macOSSetup["bootstrap_package"] = ""
-	}
-	if enableEndUserAuthentication, ok := macOSSetup["enable_end_user_authentication"]; !ok || enableEndUserAuthentication == nil {
-		macOSSetup["enable_end_user_authentication"] = false
-	}
-	if macOSSetupAssistant, ok := macOSSetup["macos_setup_assistant"]; !ok || macOSSetupAssistant == nil {
-		macOSSetup["macos_setup_assistant"] = ""
-	}
-	// Put in default values for windows_settings
-	if config.Controls.WindowsSettings != nil {
-		mdmAppConfig["windows_settings"] = config.Controls.WindowsSettings
-	} else {
-		mdmAppConfig["windows_settings"] = map[string]interface{}{}
-	}
-	windowsSettings := mdmAppConfig["windows_settings"].(map[string]interface{})
-	if customSettings, ok := windowsSettings["custom_settings"]; !ok || customSettings == nil {
-		windowsSettings["custom_settings"] = []interface{}{}
-	}
-	// Put in default values for windows_updates
-	if config.Controls.WindowsUpdates != nil {
-		mdmAppConfig["windows_updates"] = config.Controls.WindowsUpdates
-	} else {
-		mdmAppConfig["windows_updates"] = map[string]interface{}{}
-	}
-	if appConfig.License.IsPremium() {
-		windowsUpdates := mdmAppConfig["windows_updates"].(map[string]interface{})
-		if deadlineDays, ok := windowsUpdates["deadline_days"]; !ok || deadlineDays == nil {
-			windowsUpdates["deadline_days"] = nil
+
+	if !config.IsNoTeam() {
+		// Common controls settings between org and team settings
+		// Put in default values for macos_settings
+		if config.Controls.MacOSSettings != nil {
+			mdmAppConfig["macos_settings"] = config.Controls.MacOSSettings
+		} else {
+			mdmAppConfig["macos_settings"] = map[string]interface{}{}
 		}
-		if gracePeriodDays, ok := windowsUpdates["grace_period_days"]; !ok || gracePeriodDays == nil {
-			windowsUpdates["grace_period_days"] = nil
+		macOSSettings := mdmAppConfig["macos_settings"].(map[string]interface{})
+		if customSettings, ok := macOSSettings["custom_settings"]; !ok || customSettings == nil {
+			macOSSettings["custom_settings"] = []interface{}{}
 		}
-	}
-	// Put in default value for enable_disk_encryption
-	if config.Controls.EnableDiskEncryption != nil {
-		mdmAppConfig["enable_disk_encryption"] = config.Controls.EnableDiskEncryption
-	} else {
-		mdmAppConfig["enable_disk_encryption"] = false
-	}
-	if config.TeamName != nil {
-		team["gitops_filename"] = filename
-		rawTeam, err := json.Marshal(team)
-		if err != nil {
-			return nil, fmt.Errorf("error marshalling team spec: %w", err)
+		// Put in default values for macos_updates
+		if config.Controls.MacOSUpdates != nil {
+			mdmAppConfig["macos_updates"] = config.Controls.MacOSUpdates
+		} else {
+			mdmAppConfig["macos_updates"] = map[string]interface{}{}
+		}
+		macOSUpdates := mdmAppConfig["macos_updates"].(map[string]interface{})
+		if minimumVersion, ok := macOSUpdates["minimum_version"]; !ok || minimumVersion == nil {
+			macOSUpdates["minimum_version"] = ""
+		}
+		if deadline, ok := macOSUpdates["deadline"]; !ok || deadline == nil {
+			macOSUpdates["deadline"] = ""
+		}
+		// Put in default values for ios_updates
+		if config.Controls.IOSUpdates != nil {
+			mdmAppConfig["ios_updates"] = config.Controls.IOSUpdates
+		} else {
+			mdmAppConfig["ios_updates"] = map[string]interface{}{}
+		}
+		iOSUpdates := mdmAppConfig["ios_updates"].(map[string]interface{})
+		if minimumVersion, ok := iOSUpdates["minimum_version"]; !ok || minimumVersion == nil {
+			iOSUpdates["minimum_version"] = ""
+		}
+		if deadline, ok := iOSUpdates["deadline"]; !ok || deadline == nil {
+			iOSUpdates["deadline"] = ""
+		}
+		// Put in default values for ipados_updates
+		if config.Controls.IPadOSUpdates != nil {
+			mdmAppConfig["ipados_updates"] = config.Controls.IPadOSUpdates
+		} else {
+			mdmAppConfig["ipados_updates"] = map[string]interface{}{}
+		}
+		iPadOSUpdates := mdmAppConfig["ipados_updates"].(map[string]interface{})
+		if minimumVersion, ok := iPadOSUpdates["minimum_version"]; !ok || minimumVersion == nil {
+			iPadOSUpdates["minimum_version"] = ""
+		}
+		if deadline, ok := iPadOSUpdates["deadline"]; !ok || deadline == nil {
+			iPadOSUpdates["deadline"] = ""
+		}
+		// Put in default values for macos_setup
+		if config.Controls.MacOSSetup != nil {
+			mdmAppConfig["macos_setup"] = config.Controls.MacOSSetup
+		} else {
+			mdmAppConfig["macos_setup"] = map[string]interface{}{}
+		}
+		macOSSetup := mdmAppConfig["macos_setup"].(map[string]interface{})
+		if bootstrapPackage, ok := macOSSetup["bootstrap_package"]; !ok || bootstrapPackage == nil {
+			macOSSetup["bootstrap_package"] = ""
+		}
+		if enableEndUserAuthentication, ok := macOSSetup["enable_end_user_authentication"]; !ok || enableEndUserAuthentication == nil {
+			macOSSetup["enable_end_user_authentication"] = false
+		}
+		if macOSSetupAssistant, ok := macOSSetup["macos_setup_assistant"]; !ok || macOSSetupAssistant == nil {
+			macOSSetup["macos_setup_assistant"] = ""
+		}
+		// Put in default values for windows_settings
+		if config.Controls.WindowsSettings != nil {
+			mdmAppConfig["windows_settings"] = config.Controls.WindowsSettings
+		} else {
+			mdmAppConfig["windows_settings"] = map[string]interface{}{}
+		}
+		windowsSettings := mdmAppConfig["windows_settings"].(map[string]interface{})
+		if customSettings, ok := windowsSettings["custom_settings"]; !ok || customSettings == nil {
+			windowsSettings["custom_settings"] = []interface{}{}
+		}
+		// Put in default values for windows_updates
+		if config.Controls.WindowsUpdates != nil {
+			mdmAppConfig["windows_updates"] = config.Controls.WindowsUpdates
+		} else {
+			mdmAppConfig["windows_updates"] = map[string]interface{}{}
+		}
+		if appConfig.License.IsPremium() {
+			windowsUpdates := mdmAppConfig["windows_updates"].(map[string]interface{})
+			if deadlineDays, ok := windowsUpdates["deadline_days"]; !ok || deadlineDays == nil {
+				windowsUpdates["deadline_days"] = nil
+			}
+			if gracePeriodDays, ok := windowsUpdates["grace_period_days"]; !ok || gracePeriodDays == nil {
+				windowsUpdates["grace_period_days"] = nil
+			}
+		}
+		// Put in default value for enable_disk_encryption
+		if config.Controls.EnableDiskEncryption != nil {
+			mdmAppConfig["enable_disk_encryption"] = config.Controls.EnableDiskEncryption
+		} else {
+			mdmAppConfig["enable_disk_encryption"] = false
+		}
+
+		if config.TeamName != nil {
+			team["gitops_filename"] = filename
+			rawTeam, err := json.Marshal(team)
+			if err != nil {
+				return nil, fmt.Errorf("error marshalling team spec: %w", err)
+			}
+			group.Teams = []json.RawMessage{rawTeam}
+			group.TeamsDryRunAssumptions = teamDryRunAssumptions
 		}
-		group.Teams = []json.RawMessage{rawTeam}
-		group.TeamsDryRunAssumptions = teamDryRunAssumptions
 	}
 
-	// Apply org settings, scripts, enroll secrets, and controls
-	teamIDsByName, err := c.ApplyGroup(ctx, &group, baseDir, logf, fleet.ApplyClientSpecOptions{
+	// Apply org settings, scripts, enroll secrets, team entities (software, scripts, etc.), and controls.
+	teamIDsByName, teamsSoftwareInstallers, err := c.ApplyGroup(ctx, &group, baseDir, logf, appConfig, fleet.ApplyClientSpecOptions{
 		ApplySpecOptions: fleet.ApplySpecOptions{
 			DryRun: dryRun,
 		},
@@ -1422,42 +1469,127 @@ func (c *Client) DoGitOps(
 	if err != nil {
 		return nil, err
 	}
+
+	var teamSoftwareInstallers []fleet.SoftwarePackageResponse
 	if config.TeamName != nil {
-		if len(teamIDsByName) != 1 {
-			return nil, fmt.Errorf("expected 1 team spec to be applied, got %d", len(teamIDsByName))
-		}
-		teamID, ok := teamIDsByName[*config.TeamName]
-		if ok && teamID == 0 {
-			if dryRun {
-				logFn("[+] would've added any policies/queries to new team %s\n", *config.TeamName)
-				return nil, nil
+		if !config.IsNoTeam() {
+			if len(teamIDsByName) != 1 {
+				return nil, fmt.Errorf("expected 1 team spec to be applied, got %d", len(teamIDsByName))
 			}
-			return nil, fmt.Errorf("team %s not created", *config.TeamName)
-		}
-		for _, teamID = range teamIDsByName {
-			config.TeamID = &teamID
+			teamID, ok := teamIDsByName[*config.TeamName]
+			if ok && teamID == 0 {
+				if dryRun {
+					logFn("[+] would've added any policies/queries to new team %s\n", *config.TeamName)
+					return nil, nil
+				}
+				return nil, fmt.Errorf("team %s not created", *config.TeamName)
+			}
+			for _, teamID = range teamIDsByName {
+				config.TeamID = &teamID
+			}
+			teamSoftwareInstallers = teamsSoftwareInstallers[*config.TeamName]
+		} else {
+			noTeamSoftwareInstallers, err := c.doGitOpsNoTeamSoftware(config, baseDir, appConfig, logFn, dryRun)
+			if err != nil {
+				return nil, err
+			}
+			teamSoftwareInstallers = noTeamSoftwareInstallers
 		}
 	}
 
-	err = c.doGitOpsPolicies(config, logFn, dryRun)
+	err = c.doGitOpsPolicies(config, teamSoftwareInstallers, logFn, dryRun)
 	if err != nil {
 		return nil, err
 	}
 
-	err = c.doGitOpsQueries(config, logFn, dryRun)
-	if err != nil {
-		return nil, err
+	// We currently don't support queries for "No team" thus
+	// we just do GitOps for queries for global and team files.
+	if !config.IsNoTeam() {
+		err = c.doGitOpsQueries(config, logFn, dryRun)
+		if err != nil {
+			return nil, err
+		}
 	}
 
 	return teamAssumptions, nil
 }
 
-func (c *Client) doGitOpsPolicies(config *spec.GitOps, logFn func(format string, args ...interface{}), dryRun bool) error {
+func (c *Client) doGitOpsNoTeamSoftware(config *spec.GitOps, baseDir string, appconfig *fleet.EnrichedAppConfig, logFn func(format string, args ...interface{}), dryRun bool) ([]fleet.SoftwarePackageResponse, error) {
+	var softwareInstallers []fleet.SoftwarePackageResponse
+	if config.IsNoTeam() && appconfig != nil && appconfig.License.IsPremium() {
+		packages := make([]fleet.SoftwarePackageSpec, 0, len(config.Software.Packages))
+		for _, software := range config.Software.Packages {
+			if software != nil {
+				packages = append(packages, *software)
+			}
+		}
+		payload, err := buildSoftwarePackagesPayload(baseDir, packages)
+		if err != nil {
+			return nil, fmt.Errorf("applying software installers: %w", err)
+		}
+		logFn("[+] applying %d software packages for 'No team'\n", len(payload))
+		softwareInstallers, err = c.ApplyNoTeamSoftwareInstallers(payload, fleet.ApplySpecOptions{DryRun: dryRun})
+		if err != nil {
+			return nil, fmt.Errorf("applying software installers: %w", err)
+		}
+
+		if dryRun {
+			logFn("[+] would've applied 'No Team' software packages\n")
+		} else {
+			logFn("[+] applied 'No Team' software packages\n")
+		}
+	}
+	return softwareInstallers, nil
+}
+
+func (c *Client) doGitOpsPolicies(config *spec.GitOps, teamSoftwareInstallers []fleet.SoftwarePackageResponse, logFn func(format string, args ...interface{}), dryRun bool) error {
+	var teamID *uint // Global policies (nil)
+	switch {
+	case config.TeamID != nil: // Team policies
+		teamID = config.TeamID
+	case config.IsNoTeam(): // "No team" policies
+		teamID = ptr.Uint(0)
+	}
+	// Get software titles of packages for the team.
+	if teamID != nil {
+		softwareTitleURLs := make(map[string]uint)
+		for _, softwareInstaller := range teamSoftwareInstallers {
+			if softwareInstaller.TitleID == nil {
+				// Should not happen, but to not panic we just log a warning.
+				logFn("[!] software installer without title id: team_id=%d, url=%s\n", *teamID, softwareInstaller.URL)
+				continue
+			}
+			if softwareInstaller.URL == "" {
+				// Should not happen because we previously applied packages via gitops, but to not panic we just log a warning.
+				logFn("[!] software installer without url: team_id=%d, title_id=%d\n", *teamID, *softwareInstaller.TitleID)
+				continue
+			}
+			softwareTitleURLs[softwareInstaller.URL] = *softwareInstaller.TitleID
+		}
+		for i := range config.Policies {
+			config.Policies[i].SoftwareTitleID = ptr.Uint(0) // 0 unsets the installer
+
+			if config.Policies[i].InstallSoftware == nil {
+				continue
+			}
+			softwareTitleID, ok := softwareTitleURLs[config.Policies[i].InstallSoftwareURL]
+			if !ok {
+				// Should not happen because software packages are uploaded first.
+				if !dryRun {
+					logFn("[!] software URL without software title id: %s\n", config.Policies[i].InstallSoftwareURL)
+				}
+				continue
+			}
+			config.Policies[i].SoftwareTitleID = &softwareTitleID
+		}
+	}
+
 	// Get the ids and names of current policies to figure out which ones to delete
-	policies, err := c.GetPolicies(config.TeamID)
+	policies, err := c.GetPolicies(teamID)
 	if err != nil {
 		return fmt.Errorf("error getting current policies: %w", err)
 	}
+
 	if len(config.Policies) > 0 {
 		numPolicies := len(config.Policies)
 		logFn("[+] syncing %d policies\n", numPolicies)
@@ -1470,7 +1602,12 @@ func (c *Client) doGitOpsPolicies(config *spec.GitOps, logFn func(format string,
 				}
 				totalApplied += end - i
 				// Note: We are reusing the spec flow here for adding/updating policies, instead of creating a new flow for GitOps.
-				if err := c.ApplyPolicies(config.Policies[i:end]); err != nil {
+				policiesToApply := config.Policies[i:end]
+				policiesSpec := make([]*fleet.PolicySpec, len(policiesToApply))
+				for i := range policiesToApply {
+					policiesSpec[i] = &policiesToApply[i].PolicySpec
+				}
+				if err := c.ApplyPolicies(policiesSpec); err != nil {
 					return fmt.Errorf("error applying policies: %w", err)
 				}
 				logFn("[+] synced %d policies\n", totalApplied)
@@ -1488,7 +1625,11 @@ func (c *Client) doGitOpsPolicies(config *spec.GitOps, logFn func(format string,
 		}
 		if !found {
 			policiesToDelete = append(policiesToDelete, oldItem.ID)
-			fmt.Printf("[-] deleting policy %s\n", oldItem.Name)
+			if !dryRun {
+				logFn("[-] deleting policy %s\n", oldItem.Name)
+			} else {
+				logFn("[-] would've deleted policy %s\n", oldItem.Name)
+			}
 		}
 	}
 	if len(policiesToDelete) > 0 {
@@ -1501,7 +1642,16 @@ func (c *Client) doGitOpsPolicies(config *spec.GitOps, logFn func(format string,
 					end = len(policiesToDelete)
 				}
 				totalDeleted += end - i
-				if err := c.DeletePolicies(config.TeamID, policiesToDelete[i:end]); err != nil {
+				var teamID *uint
+				switch {
+				case config.TeamID != nil: // Team policies
+					teamID = config.TeamID
+				case config.IsNoTeam(): // No team policies
+					teamID = ptr.Uint(fleet.PolicyNoTeamID)
+				default: // Global policies
+					teamID = nil
+				}
+				if err := c.DeletePolicies(teamID, policiesToDelete[i:end]); err != nil {
 					return fmt.Errorf("error deleting policies: %w", err)
 				}
 				logFn("[-] deleted %d policies\n", totalDeleted)
diff --git a/server/service/client_policies.go b/server/service/client_policies.go
index a8425bebf5..089e6a2d47 100644
--- a/server/service/client_policies.go
+++ b/server/service/client_policies.go
@@ -2,6 +2,7 @@ package service
 
 import (
 	"fmt"
+
 	"github.com/fleetdm/fleet/v4/server/fleet"
 )
 
diff --git a/server/service/client_software.go b/server/service/client_software.go
index 22c602e96c..60a0911093 100644
--- a/server/service/client_software.go
+++ b/server/service/client_software.go
@@ -1,6 +1,11 @@
 package service
 
 import (
+	"errors"
+	"fmt"
+	"net/url"
+	"time"
+
 	"github.com/fleetdm/fleet/v4/server/fleet"
 )
 
@@ -25,3 +30,40 @@ func (c *Client) ListSoftwareTitles(query string) ([]fleet.SoftwareTitleListResu
 	}
 	return responseBody.SoftwareTitles, nil
 }
+
+func (c *Client) ApplyNoTeamSoftwareInstallers(softwareInstallers []fleet.SoftwareInstallerPayload, opts fleet.ApplySpecOptions) ([]fleet.SoftwarePackageResponse, error) {
+	query, err := url.ParseQuery(opts.RawQuery())
+	if err != nil {
+		return nil, err
+	}
+	return c.applySoftwareInstallers(softwareInstallers, query, opts.DryRun)
+}
+
+func (c *Client) applySoftwareInstallers(softwareInstallers []fleet.SoftwareInstallerPayload, query url.Values, dryRun bool) ([]fleet.SoftwarePackageResponse, error) {
+	path := "/api/latest/fleet/software/batch"
+	var resp batchSetSoftwareInstallersResponse
+	if err := c.authenticatedRequestWithQuery(map[string]interface{}{"software": softwareInstallers}, "POST", path, &resp, query.Encode()); err != nil {
+		return nil, err
+	}
+	if dryRun && resp.RequestUUID == "" {
+		return nil, nil
+	}
+
+	requestUUID := resp.RequestUUID
+	for {
+		var resp batchSetSoftwareInstallersResultResponse
+		if err := c.authenticatedRequestWithQuery(nil, "GET", path+"/"+requestUUID, &resp, query.Encode()); err != nil {
+			return nil, err
+		}
+		switch {
+		case resp.Status == fleet.BatchSetSoftwareInstallersStatusProcessing:
+			time.Sleep(5 * time.Second)
+		case resp.Status == fleet.BatchSetSoftwareInstallersStatusFailed:
+			return nil, errors.New(resp.Message)
+		case resp.Status == fleet.BatchSetSoftwareInstallersStatusCompleted:
+			return resp.Packages, nil
+		default:
+			return nil, fmt.Errorf("unknown status: %q", resp.Status)
+		}
+	}
+}
diff --git a/server/service/client_teams.go b/server/service/client_teams.go
index e2edc217a0..5d541e903c 100644
--- a/server/service/client_teams.go
+++ b/server/service/client_teams.go
@@ -93,14 +93,13 @@ func (c *Client) ApplyTeamScripts(tmName string, scripts []fleet.ScriptPayload,
 	return c.authenticatedRequestWithQuery(map[string]interface{}{"scripts": scripts}, verb, path, nil, query.Encode())
 }
 
-func (c *Client) ApplyTeamSoftwareInstallers(tmName string, softwareInstallers []fleet.SoftwareInstallerPayload, opts fleet.ApplySpecOptions) error {
-	verb, path := "POST", "/api/latest/fleet/software/batch"
+func (c *Client) ApplyTeamSoftwareInstallers(tmName string, softwareInstallers []fleet.SoftwareInstallerPayload, opts fleet.ApplySpecOptions) ([]fleet.SoftwarePackageResponse, error) {
 	query, err := url.ParseQuery(opts.RawQuery())
 	if err != nil {
-		return err
+		return nil, err
 	}
 	query.Add("team_name", tmName)
-	return c.authenticatedRequestWithQuery(map[string]interface{}{"software": softwareInstallers}, verb, path, nil, query.Encode())
+	return c.applySoftwareInstallers(softwareInstallers, query, opts.DryRun)
 }
 
 func (c *Client) ApplyTeamAppStoreAppsAssociation(tmName string, vppBatchPayload []fleet.VPPBatchPayload, opts fleet.ApplySpecOptions) error {
diff --git a/server/service/devices.go b/server/service/devices.go
index 288fbb304e..9eb1ba3a3a 100644
--- a/server/service/devices.go
+++ b/server/service/devices.go
@@ -3,8 +3,9 @@ package service
 import (
 	"context"
 	"crypto/x509"
+	"database/sql"
 	"encoding/json"
-	"fmt"
+	"errors"
 	"io"
 	"net/http"
 	"net/url"
@@ -529,34 +530,37 @@ func (svc *Service) GetDeviceMDMAppleEnrollmentProfile(ctx context.Context) ([]b
 		return nil, ctxerr.Wrap(ctx, fleet.NewPermissionError("forbidden: only device-authenticated hosts can access this endpoint"))
 	}
 
-	appConfig, err := svc.ds.AppConfig(ctx)
+	cfg, err := svc.ds.AppConfig(ctx)
 	if err != nil {
-		return nil, ctxerr.Wrap(ctx, err)
+		return nil, ctxerr.Wrap(ctx, err, "fetching app config")
 	}
 
-	topic, err := svc.mdmPushCertTopic(ctx)
-	if err != nil {
-		return nil, ctxerr.Wrap(ctx, err, "extracting topic from APNs cert")
+	host, ok := hostctx.FromContext(ctx)
+	if !ok {
+		return nil, ctxerr.Wrap(ctx, fleet.NewAuthRequiredError("internal error: missing host from request context"))
 	}
 
-	assets, err := svc.ds.GetAllMDMConfigAssetsByName(ctx, []fleet.MDMAssetName{
-		fleet.MDMAssetSCEPChallenge,
-	})
-	if err != nil {
-		return nil, fmt.Errorf("loading SCEP challenge from the database: %w", err)
+	tmSecrets, err := svc.ds.GetEnrollSecrets(ctx, host.TeamID)
+	if err != nil && !errors.Is(err, sql.ErrNoRows) {
+		return nil, ctxerr.Wrap(ctx, err, "getting host team enroll secrets")
+	}
+	if len(tmSecrets) == 0 && host.TeamID != nil {
+		tmSecrets, err = svc.ds.GetEnrollSecrets(ctx, nil)
+		if err != nil && !errors.Is(err, sql.ErrNoRows) {
+			return nil, ctxerr.Wrap(ctx, err, "getting no team enroll secrets")
+		}
+	}
+	if len(tmSecrets) == 0 {
+		return nil, &fleet.BadRequestError{Message: "unable to find an enroll secret to generate enrollment profile"}
 	}
 
-	enrollmentProf, err := apple_mdm.GenerateEnrollmentProfileMobileconfig(
-		appConfig.OrgInfo.OrgName,
-		appConfig.ServerSettings.ServerURL,
-		string(assets[fleet.MDMAssetSCEPChallenge].Value),
-		topic,
-	)
+	enrollSecret := tmSecrets[0].Secret
+	profBytes, err := apple_mdm.GenerateOTAEnrollmentProfileMobileconfig(cfg.OrgInfo.OrgName, cfg.ServerSettings.ServerURL, enrollSecret)
 	if err != nil {
-		return nil, ctxerr.Wrap(ctx, err, "generating manual enrollment profile")
+		return nil, ctxerr.Wrap(ctx, err, "generating ota mobileconfig file for manual enrollment")
 	}
 
-	signed, err := mdmcrypto.Sign(ctx, enrollmentProf, svc.ds)
+	signed, err := mdmcrypto.Sign(ctx, profBytes, svc.ds)
 	if err != nil {
 		return nil, ctxerr.Wrap(ctx, err, "signing profile")
 	}
diff --git a/server/service/endpoint_utils.go b/server/service/endpoint_utils.go
index 13d4f00568..055eb2cba1 100644
--- a/server/service/endpoint_utils.go
+++ b/server/service/endpoint_utils.go
@@ -273,6 +273,12 @@ func makeDecoder(iface interface{}) kithttp.DecodeRequestFunc {
 						return nil, badRequestErr("parsing uint from query", err)
 					}
 					field.SetUint(uint64(queryValUint))
+				case reflect.Float64:
+					queryValFloat, err := strconv.ParseFloat(queryVal, 64)
+					if err != nil {
+						return nil, badRequestErr("parsing float from query", err)
+					}
+					field.SetFloat(queryValFloat)
 				case reflect.Bool:
 					field.SetBool(queryVal == "1" || queryVal == "true")
 				case reflect.Int:
@@ -442,9 +448,12 @@ var pathReplacer = strings.NewReplacer(
 	"}", "_",
 )
 
-func getNameFromPathAndVerb(verb, path string) string {
-	return strings.ToLower(verb) + "_" +
-		pathReplacer.Replace(strings.TrimPrefix(strings.TrimRight(path, "/"), "/api/_version_/fleet/"))
+func getNameFromPathAndVerb(verb, path, startAt string) string {
+	prefix := strings.ToLower(verb) + "_"
+	if startAt != "" {
+		prefix += pathReplacer.Replace(startAt) + "_"
+	}
+	return prefix + pathReplacer.Replace(strings.TrimPrefix(strings.TrimRight(path, "/"), "/api/_version_/fleet/"))
 }
 
 func capabilitiesResponseFunc(capabilities fleet.CapabilityMap) kithttp.ServerOption {
@@ -554,14 +563,14 @@ func (e *authEndpointer) handlePathHandler(path string, pathHandler func(path st
 	}
 
 	versionedPath := strings.Replace(path, "/_version_/", fmt.Sprintf("/{fleetversion:(?:%s)}/", strings.Join(versions, "|")), 1)
-	nameAndVerb := getNameFromPathAndVerb(verb, path)
+	nameAndVerb := getNameFromPathAndVerb(verb, path, e.startingAtVersion)
 	if e.usePathPrefix {
 		e.r.PathPrefix(versionedPath).Handler(pathHandler(versionedPath)).Name(nameAndVerb).Methods(verb)
 	} else {
 		e.r.Handle(versionedPath, pathHandler(versionedPath)).Name(nameAndVerb).Methods(verb)
 	}
 	for _, alias := range e.alternativePaths {
-		nameAndVerb := getNameFromPathAndVerb(verb, alias)
+		nameAndVerb := getNameFromPathAndVerb(verb, alias, e.startingAtVersion)
 		versionedPath := strings.Replace(alias, "/_version_/", fmt.Sprintf("/{fleetversion:(?:%s)}/", strings.Join(versions, "|")), 1)
 		if e.usePathPrefix {
 			e.r.PathPrefix(versionedPath).Handler(pathHandler(versionedPath)).Name(nameAndVerb).Methods(verb)
diff --git a/server/service/frontend.go b/server/service/frontend.go
index f5d884ec1f..a2a6058b54 100644
--- a/server/service/frontend.go
+++ b/server/service/frontend.go
@@ -1,9 +1,11 @@
 package service
 
 import (
+	"fmt"
 	"html/template"
 	"io"
 	"net/http"
+	"net/url"
 
 	assetfs "github.com/elazarl/go-bindata-assetfs"
 	"github.com/fleetdm/fleet/v4/server/bindata"
@@ -68,6 +70,69 @@ func ServeFrontend(urlPrefix string, sandbox bool, logger log.Logger) http.Handl
 	})
 }
 
+func ServeEndUserEnrollOTA(urlPrefix string, logger log.Logger) http.Handler {
+	herr := func(w http.ResponseWriter, err string) {
+		logger.Log("err", err)
+		http.Error(w, err, http.StatusInternalServerError)
+	}
+
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		writeBrowserSecurityHeaders(w)
+
+		fs := newBinaryFileSystem("/frontend")
+		file, err := fs.Open("templates/enroll-ota.html")
+		if err != nil {
+			herr(w, "load enroll ota template: "+err.Error())
+			return
+		}
+
+		data, err := io.ReadAll(file)
+		if err != nil {
+			herr(w, "read bindata file: "+err.Error())
+			return
+		}
+
+		t, err := template.New("enroll-ota").Parse(string(data))
+		if err != nil {
+			herr(w, "create react template: "+err.Error())
+			return
+		}
+
+		enrollURL, err := generateEnrollOTAURL(urlPrefix, r.URL.Query().Get("enroll_secret"))
+		if err != nil {
+			herr(w, "generate enroll ota url: "+err.Error())
+			return
+		}
+		if err := t.Execute(w, struct {
+			EnrollURL string
+			URLPrefix string
+		}{
+			URLPrefix: urlPrefix,
+			EnrollURL: enrollURL,
+		}); err != nil {
+			herr(w, "execute react template: "+err.Error())
+			return
+		}
+	})
+}
+
+func generateEnrollOTAURL(fleetURL string, enrollSecret string) (string, error) {
+	path, err := url.JoinPath(fleetURL, "/api/v1/fleet/enrollment_profiles/ota")
+	if err != nil {
+		return "", fmt.Errorf("creating path for end user ota enrollment url: %w", err)
+	}
+
+	enrollURL, err := url.Parse(path)
+	if err != nil {
+		return "", fmt.Errorf("parsing end user ota enrollment url: %w", err)
+	}
+
+	q := enrollURL.Query()
+	q.Set("enroll_secret", enrollSecret)
+	enrollURL.RawQuery = q.Encode()
+	return enrollURL.String(), nil
+}
+
 func ServeStaticAssets(path string) http.Handler {
 	return http.StripPrefix(path, http.FileServer(newBinaryFileSystem("/assets")))
 }
diff --git a/server/service/frontend_test.go b/server/service/frontend_test.go
index 32363d6dd8..22df31872a 100644
--- a/server/service/frontend_test.go
+++ b/server/service/frontend_test.go
@@ -2,6 +2,7 @@ package service
 
 import (
 	"bytes"
+	"io"
 	"net/http"
 	"net/http/httptest"
 	"os"
@@ -40,3 +41,28 @@ func TestServeFrontend(t *testing.T) {
 	require.NoError(t, err)
 	require.Equal(t, http.StatusMethodNotAllowed, response.StatusCode)
 }
+
+func TestServeEndUserEnrollOTA(t *testing.T) {
+	if !hasBuildTag("full") {
+		t.Skip("This test requires running with -tags full")
+	}
+	logger := log.NewLogfmtLogger(os.Stdout)
+	h := ServeEndUserEnrollOTA("", logger)
+	ts := httptest.NewServer(h)
+	t.Cleanup(func() {
+		ts.Close()
+	})
+
+	// assert html is returned
+	response, err := http.DefaultClient.Get(ts.URL + "?enroll_secret=foo")
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, response.StatusCode)
+	require.Equal(t, response.Header.Get("Content-Type"), "text/html; charset=utf-8")
+
+	// assert it contains the content we expect
+	defer response.Body.Close()
+	bodyBytes, err := io.ReadAll(response.Body)
+	require.NoError(t, err)
+	bodyString := string(bodyBytes)
+	require.Contains(t, bodyString, "api/v1/fleet/enrollment_profiles/ota?enroll_secret=foo")
+}
diff --git a/server/service/global_policies.go b/server/service/global_policies.go
index c7d03e9695..87c1d67152 100644
--- a/server/service/global_policies.go
+++ b/server/service/global_policies.go
@@ -6,12 +6,12 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"github.com/fleetdm/fleet/v4/pkg/fleethttp"
 	"io"
 	"net/http"
 	"strings"
 	"time"
 
+	"github.com/fleetdm/fleet/v4/pkg/fleethttp"
 	"github.com/fleetdm/fleet/v4/server/authz"
 	"github.com/fleetdm/fleet/v4/server/contexts/ctxerr"
 	"github.com/fleetdm/fleet/v4/server/contexts/license"
@@ -155,6 +155,9 @@ func (svc Service) GetPolicyByIDQueries(ctx context.Context, policyID uint) (*fl
 	if err != nil {
 		return nil, err
 	}
+	if err := svc.populatePolicyInstallSoftware(ctx, policy); err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "populate install_software")
+	}
 
 	return policy, nil
 }
@@ -484,7 +487,7 @@ func applyPolicySpecsEndpoint(ctx context.Context, request interface{}, svc flee
 func (svc *Service) checkPolicySpecAuthorization(ctx context.Context, policies []*fleet.PolicySpec) error {
 	checkGlobalPolicyAuth := false
 	for _, policy := range policies {
-		if policy.Team != "" {
+		if policy.Team != "" && policy.Team != "No team" {
 			team, err := svc.ds.TeamByName(ctx, policy.Team)
 			if err != nil {
 				// This is so that the proper HTTP status code is returned
@@ -583,8 +586,10 @@ func autofillPoliciesEndpoint(ctx context.Context, request interface{}, svc flee
 }
 
 // Exposing external URL and timeout for testing purposes
-var getHumanInterpretationFromOsquerySqlUrl = "https://fleetdm.com/api/v1/get-human-interpretation-from-osquery-sql"
-var getHumanInterpretationFromOsquerySqlTimeout = 30 * time.Second
+var (
+	getHumanInterpretationFromOsquerySqlUrl     = "https://fleetdm.com/api/v1/get-human-interpretation-from-osquery-sql"
+	getHumanInterpretationFromOsquerySqlTimeout = 30 * time.Second
+)
 
 type AutofillError struct {
 	Message     string
diff --git a/server/service/handler.go b/server/service/handler.go
index 3d606bd159..7012393952 100644
--- a/server/service/handler.go
+++ b/server/service/handler.go
@@ -367,14 +367,24 @@ func attachFleetAPIRoutes(r *mux.Router, svc fleet.Service, config config.FleetC
 
 	ue.GET("/api/_version_/fleet/software/titles", listSoftwareTitlesEndpoint, listSoftwareTitlesRequest{})
 	ue.GET("/api/_version_/fleet/software/titles/{id:[0-9]+}", getSoftwareTitleEndpoint, getSoftwareTitleRequest{})
-	ue.POST("/api/_version_/fleet/hosts/{host_id:[0-9]+}/software/install/{software_title_id:[0-9]+}", installSoftwareTitleEndpoint, installSoftwareRequest{})
+	ue.POST("/api/_version_/fleet/hosts/{host_id:[0-9]+}/software/{software_title_id:[0-9]+}/install", installSoftwareTitleEndpoint,
+		installSoftwareRequest{})
+	ue.POST("/api/_version_/fleet/hosts/{host_id:[0-9]+}/software/{software_title_id:[0-9]+}/uninstall", uninstallSoftwareTitleEndpoint,
+		uninstallSoftwareRequest{})
 
-	// Sofware installers
+	// Software installers
 	ue.GET("/api/_version_/fleet/software/titles/{title_id:[0-9]+}/package", getSoftwareInstallerEndpoint, getSoftwareInstallerRequest{})
+	ue.POST("/api/_version_/fleet/software/titles/{title_id:[0-9]+}/package/token", getSoftwareInstallerTokenEndpoint,
+		getSoftwareInstallerRequest{})
 	ue.POST("/api/_version_/fleet/software/package", uploadSoftwareInstallerEndpoint, uploadSoftwareInstallerRequest{})
+	ue.PATCH("/api/_version_/fleet/software/titles/{id:[0-9]+}/package", updateSoftwareInstallerEndpoint, updateSoftwareInstallerRequest{})
 	ue.DELETE("/api/_version_/fleet/software/titles/{title_id:[0-9]+}/available_for_install", deleteSoftwareInstallerEndpoint, deleteSoftwareInstallerRequest{})
-	ue.GET("/api/_version_/fleet/software/install/results/{install_uuid}", getSoftwareInstallResultsEndpoint, getSoftwareInstallResultsRequest{})
+	ue.GET("/api/_version_/fleet/software/install/{install_uuid}/results", getSoftwareInstallResultsEndpoint,
+		getSoftwareInstallResultsRequest{})
+	// POST /api/_version_/fleet/software/batch is asynchronous, meaning it will start the process of software download+upload in the background
+	// and will return a request UUID to be used in GET /api/_version_/fleet/software/batch/{request_uuid} to query for the status of the operation.
 	ue.POST("/api/_version_/fleet/software/batch", batchSetSoftwareInstallersEndpoint, batchSetSoftwareInstallersRequest{})
+	ue.GET("/api/_version_/fleet/software/batch/{request_uuid}", batchSetSoftwareInstallersResultEndpoint, batchSetSoftwareInstallersResultRequest{})
 
 	// App store software
 	ue.GET("/api/_version_/fleet/software/app_store_apps", getAppStoreAppsEndpoint, getAppStoreAppsRequest{})
@@ -559,7 +569,6 @@ func attachFleetAPIRoutes(r *mux.Router, svc fleet.Service, config config.FleetC
 	mdmAppleMW.DELETE("/api/_version_/fleet/mdm/apple/installers/{installer_id:[0-9]+}", deleteAppleInstallerEndpoint, deleteAppleInstallerDetailsRequest{})
 	mdmAppleMW.GET("/api/_version_/fleet/mdm/apple/installers", listMDMAppleInstallersEndpoint, listMDMAppleInstallersRequest{})
 	mdmAppleMW.GET("/api/_version_/fleet/mdm/apple/devices", listMDMAppleDevicesEndpoint, listMDMAppleDevicesRequest{})
-	mdmAppleMW.GET("/api/_version_/fleet/mdm/apple/dep/devices", listMDMAppleDEPDevicesEndpoint, listMDMAppleDEPDevicesRequest{})
 
 	// Deprecated: GET /mdm/manual_enrollment_profile is now deprecated, replaced by the
 	// GET /enrollment_profiles/manual endpoint.
@@ -721,21 +730,30 @@ func attachFleetAPIRoutes(r *mux.Router, svc fleet.Service, config config.FleetC
 	// new flow described in https://github.com/fleetdm/fleet/issues/10383
 	ue.POST("/api/_version_/fleet/mdm/apple/dep/key_pair", newMDMAppleDEPKeyPairEndpoint, nil)
 	ue.GET("/api/_version_/fleet/mdm/apple/abm_public_key", generateABMKeyPairEndpoint, nil)
-	ue.POST("/api/_version_/fleet/mdm/apple/abm_token", uploadABMTokenEndpoint, uploadABMTokenRequest{})
-	ue.DELETE("/api/_version_/fleet/mdm/apple/abm_token", disableABMEndpoint, nil)
+	ue.POST("/api/_version_/fleet/abm_tokens", uploadABMTokenEndpoint, uploadABMTokenRequest{})
+	ue.DELETE("/api/_version_/fleet/abm_tokens/{id:[0-9]+}", deleteABMTokenEndpoint, deleteABMTokenRequest{})
+	ue.GET("/api/_version_/fleet/abm_tokens", listABMTokensEndpoint, nil)
+	ue.PATCH("/api/_version_/fleet/abm_tokens/{id:[0-9]+}/teams", updateABMTokenTeamsEndpoint, updateABMTokenTeamsRequest{})
+	ue.PATCH("/api/_version_/fleet/abm_tokens/{id:[0-9]+}/renew", renewABMTokenEndpoint, renewABMTokenRequest{})
 
 	ue.GET("/api/_version_/fleet/mdm/apple/request_csr", getMDMAppleCSREndpoint, getMDMAppleCSRRequest{})
 	ue.POST("/api/_version_/fleet/mdm/apple/apns_certificate", uploadMDMAppleAPNSCertEndpoint, uploadMDMAppleAPNSCertRequest{})
 	ue.DELETE("/api/_version_/fleet/mdm/apple/apns_certificate", deleteMDMAppleAPNSCertEndpoint, deleteMDMAppleAPNSCertRequest{})
 
-	ue.POST("/api/_version_/fleet/mdm/apple/vpp_token", uploadMDMAppleVPPTokenEndpoint, uploadMDMAppleVPPTokenRequest{})
-	ue.GET("/api/_version_/fleet/vpp", getMDMAppleVPPTokenEndpoint, getMDMAppleVPPTokenRequest{})
-	ue.DELETE("/api/_version_/fleet/mdm/apple/vpp_token", deleteMDMAppleVPPTokenEndpoint, deleteMDMAppleVPPTokenRequest{})
+	// VPP Tokens
+	ue.GET("/api/_version_/fleet/vpp_tokens", getVPPTokens, getVPPTokensRequest{})
+	ue.POST("/api/_version_/fleet/vpp_tokens", uploadVPPTokenEndpoint, uploadVPPTokenRequest{})
+	ue.PATCH("/api/_version_/fleet/vpp_tokens/{id}/teams", patchVPPTokensTeams, patchVPPTokensTeamsRequest{})
+	ue.PATCH("/api/_version_/fleet/vpp_tokens/{id}/renew", patchVPPTokenRenewEndpoint, patchVPPTokenRenewRequest{})
+	ue.DELETE("/api/_version_/fleet/vpp_tokens/{id}", deleteVPPToken, deleteVPPTokenRequest{})
+
+	// Batch VPP Associations
 	ue.POST("/api/_version_/fleet/software/app_store_apps/batch", batchAssociateAppStoreAppsEndpoint, batchAssociateAppStoreAppsRequest{})
 
 	// Deprecated: GET /mdm/apple_bm is now deprecated, replaced by the
 	// GET /abm endpoint.
 	ue.GET("/api/_version_/fleet/mdm/apple_bm", getAppleBMEndpoint, nil)
+	// Deprecated: GET /abm is now deprecated, replaced by the GET /abm_tokens endpoint.
 	ue.GET("/api/_version_/fleet/abm", getAppleBMEndpoint, nil)
 
 	// Deprecated: POST /mdm/apple/profiles/batch is now deprecated, replaced by the
@@ -860,6 +878,7 @@ func attachFleetAPIRoutes(r *mux.Router, svc fleet.Service, config config.FleetC
 	neAppleMDM.GET(apple_mdm.EnrollPath, mdmAppleEnrollEndpoint, mdmAppleEnrollRequest{})
 	neAppleMDM.GET(apple_mdm.InstallerPath, mdmAppleGetInstallerEndpoint, mdmAppleGetInstallerRequest{})
 	neAppleMDM.HEAD(apple_mdm.InstallerPath, mdmAppleHeadInstallerEndpoint, mdmAppleHeadInstallerRequest{})
+	neAppleMDM.POST("/api/_version_/fleet/ota_enrollment", mdmAppleOTAEndpoint, mdmAppleOTARequest{})
 
 	// Deprecated: GET /mdm/bootstrap is now deprecated, replaced by the
 	// GET /bootstrap endpoint.
@@ -877,6 +896,9 @@ func attachFleetAPIRoutes(r *mux.Router, svc fleet.Service, config config.FleetC
 	// Deprecated: GET /mdm/apple/setup/eula/:token is now deprecated, replaced by the platform agnostic /mdm/setup/eula/:token
 	neAppleMDM.GET("/api/_version_/fleet/mdm/apple/setup/eula/{token}", getMDMEULAEndpoint, getMDMEULARequest{})
 
+	// Get OTA profile
+	neAppleMDM.GET("/api/_version_/fleet/enrollment_profiles/ota", getOTAProfileEndpoint, getOTAProfileRequest{})
+
 	// These endpoint are used by Microsoft devices during MDM device enrollment phase
 	neWindowsMDM := ne.WithCustomMiddleware(mdmConfiguredMiddleware.VerifyWindowsMDM())
 
@@ -907,6 +929,9 @@ func attachFleetAPIRoutes(r *mux.Router, svc fleet.Service, config config.FleetC
 	ne.WithAltPaths("/api/v1/osquery/carve/block").
 		POST("/api/osquery/carve/block", carveBlockEndpoint, carveBlockRequest{})
 
+	ne.GET("/api/_version_/fleet/software/titles/{title_id:[0-9]+}/package/token/{token}", downloadSoftwareInstallerEndpoint,
+		downloadSoftwareInstallerRequest{})
+
 	ne.POST("/api/_version_/fleet/perform_required_password_reset", performRequiredPasswordResetEndpoint, performRequiredPasswordResetRequest{})
 	ne.POST("/api/_version_/fleet/users", createUserFromInviteEndpoint, createUserRequest{})
 	ne.GET("/api/_version_/fleet/invites/{token}", verifyInviteEndpoint, verifyInviteRequest{})
diff --git a/server/service/handler_test.go b/server/service/handler_test.go
index df7ff9e04d..116b155ac9 100644
--- a/server/service/handler_test.go
+++ b/server/service/handler_test.go
@@ -76,7 +76,6 @@ func TestAPIRoutesConflicts(t *testing.T) {
 }
 
 func TestAPIRoutesMetrics(t *testing.T) {
-	t.Skip()
 	ds := new(mock.Store)
 
 	svc, _ := newTestService(t, ds, nil, nil)
@@ -108,7 +107,8 @@ func TestAPIRoutesMetrics(t *testing.T) {
 	routeNames := make(map[string]bool)
 	err = router.Walk(func(route *mux.Route, _ *mux.Router, _ []*mux.Route) error {
 		if _, ok := routeNames[route.GetName()]; ok {
-			t.Errorf("duplicate route name: %s", route.GetName())
+			path, _ := route.GetPathTemplate()
+			t.Errorf("duplicate route name: %s (%s)", route.GetName(), path)
 		}
 		routeNames[route.GetName()] = true
 		return nil
@@ -194,7 +194,7 @@ func TestAPIRoutesMetrics(t *testing.T) {
 		"go_memstats_alloc_bytes_total":              1,
 		"go_memstats_buck_hash_sys_bytes":            1,
 		"go_memstats_frees_total":                    1,
-		"go_memstats_gc_cpu_fraction":                1,
+		"go_memstats_gc_cpu_fraction":                0, // does not appear to be reported anymore
 		"go_memstats_gc_sys_bytes":                   1,
 		"go_memstats_heap_alloc_bytes":               1,
 		"go_memstats_heap_idle_bytes":                1,
diff --git a/server/service/hosts.go b/server/service/hosts.go
index a60348f39d..a4db5b73dc 100644
--- a/server/service/hosts.go
+++ b/server/service/hosts.go
@@ -826,7 +826,7 @@ func (svc *Service) AddHostsToTeam(ctx context.Context, teamID *uint, hostIDs []
 		return err
 	}
 	if !skipBulkPending {
-		if err := svc.ds.BulkSetPendingMDMHostProfiles(ctx, hostIDs, nil, nil, nil); err != nil {
+		if _, err := svc.ds.BulkSetPendingMDMHostProfiles(ctx, hostIDs, nil, nil, nil); err != nil {
 			return ctxerr.Wrap(ctx, err, "bulk set pending host profiles")
 		}
 	}
@@ -962,7 +962,7 @@ func (svc *Service) AddHostsToTeamByFilter(ctx context.Context, teamID *uint, fi
 	if err := svc.ds.AddHostsToTeam(ctx, teamID, hostIDs); err != nil {
 		return err
 	}
-	if err := svc.ds.BulkSetPendingMDMHostProfiles(ctx, hostIDs, nil, nil, nil); err != nil {
+	if _, err := svc.ds.BulkSetPendingMDMHostProfiles(ctx, hostIDs, nil, nil, nil); err != nil {
 		return ctxerr.Wrap(ctx, err, "bulk set pending host profiles")
 	}
 	serials, err := svc.ds.ListMDMAppleDEPSerialsInHostIDs(ctx, hostIDs)
@@ -1036,19 +1036,56 @@ func (svc *Service) RefetchHost(ctx context.Context, id uint) error {
 	}
 
 	if host != nil && (host.Platform == "ios" || host.Platform == "ipados") {
-		err := svc.verifyMDMConfiguredAndConnected(ctx, host)
+		// Get MDM commands already sent
+		commands, err := svc.ds.GetHostMDMCommands(ctx, host.ID)
+		if err != nil {
+			return ctxerr.Wrap(ctx, err, "get host MDM commands")
+		}
+		doAppRefetch := true
+		doDeviceInfoRefetch := true
+		for _, cmd := range commands {
+			switch cmd.CommandType {
+			case fleet.RefetchDeviceCommandUUIDPrefix:
+				doDeviceInfoRefetch = false
+			case fleet.RefetchAppsCommandUUIDPrefix:
+				doAppRefetch = false
+			}
+		}
+		if !doAppRefetch && !doDeviceInfoRefetch {
+			// Nothing to do.
+			return nil
+		}
+		err = svc.verifyMDMConfiguredAndConnected(ctx, host)
 		if err != nil {
 			return err
 		}
+		hostMDMCommands := make([]fleet.HostMDMCommand, 0, 2)
 		cmdUUID := uuid.NewString()
-		err = svc.mdmAppleCommander.InstalledApplicationList(ctx, []string{host.UUID}, fleet.RefetchAppsCommandUUIDPrefix+cmdUUID)
-		if err != nil {
-			return ctxerr.Wrap(ctx, err, "refetch apps with MDM")
+		if doAppRefetch {
+			err = svc.mdmAppleCommander.InstalledApplicationList(ctx, []string{host.UUID}, fleet.RefetchAppsCommandUUIDPrefix+cmdUUID)
+			if err != nil {
+				return ctxerr.Wrap(ctx, err, "refetch apps with MDM")
+			}
+			hostMDMCommands = append(hostMDMCommands, fleet.HostMDMCommand{
+				HostID:      host.ID,
+				CommandType: fleet.RefetchAppsCommandUUIDPrefix,
+			})
 		}
-		// DeviceInformation is last because the refetch response clears the refetch_requested flag
-		err = svc.mdmAppleCommander.DeviceInformation(ctx, []string{host.UUID}, fleet.RefetchCommandUUIDPrefix+cmdUUID)
+		if doDeviceInfoRefetch {
+			// DeviceInformation is last because the refetch response clears the refetch_requested flag
+			err = svc.mdmAppleCommander.DeviceInformation(ctx, []string{host.UUID}, fleet.RefetchDeviceCommandUUIDPrefix+cmdUUID)
+			if err != nil {
+				return ctxerr.Wrap(ctx, err, "refetch host with MDM")
+			}
+			hostMDMCommands = append(hostMDMCommands, fleet.HostMDMCommand{
+				HostID:      host.ID,
+				CommandType: fleet.RefetchDeviceCommandUUIDPrefix,
+			})
+		}
+		// Add commands to the database to track the commands sent
+		err = svc.ds.AddHostMDMCommands(ctx, hostMDMCommands)
 		if err != nil {
-			return ctxerr.Wrap(ctx, err, "refetch host with MDM")
+			return ctxerr.Wrap(ctx, err, "add host mdm commands")
 		}
 	}
 
diff --git a/server/service/hosts_test.go b/server/service/hosts_test.go
index b2765516e2..26611cb829 100644
--- a/server/service/hosts_test.go
+++ b/server/service/hosts_test.go
@@ -6,6 +6,7 @@ import (
 	"encoding/base64"
 	"errors"
 	"fmt"
+	"net/http"
 	"strconv"
 	"testing"
 	"time"
@@ -13,6 +14,7 @@ import (
 	"github.com/WatchBeam/clock"
 	"github.com/fleetdm/fleet/v4/server/authz"
 	"github.com/fleetdm/fleet/v4/server/config"
+	"github.com/fleetdm/fleet/v4/server/contexts/capabilities"
 	"github.com/fleetdm/fleet/v4/server/contexts/license"
 	"github.com/fleetdm/fleet/v4/server/contexts/viewer"
 	"github.com/fleetdm/fleet/v4/server/datastore/mysql"
@@ -23,9 +25,10 @@ import (
 	"github.com/fleetdm/fleet/v4/server/mock"
 	"github.com/fleetdm/fleet/v4/server/ptr"
 	"github.com/fleetdm/fleet/v4/server/test"
+	kitlog "github.com/go-kit/log"
+	"github.com/smallstep/pkcs7"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"go.mozilla.org/pkcs7"
 )
 
 func TestHostDetails(t *testing.T) {
@@ -607,8 +610,9 @@ func TestHostAuth(t *testing.T) {
 		}
 		return nil
 	}
-	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hids, tids []uint, puuids, uuids []string) error {
-		return nil
+	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hids, tids []uint, puuids, uuids []string,
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 	ds.ListMDMAppleDEPSerialsInHostIDsFunc = func(ctx context.Context, hids []uint) ([]string, error) {
 		return nil, nil
@@ -886,8 +890,9 @@ func TestAddHostsToTeamByFilter(t *testing.T) {
 		assert.Equal(t, expectedHostIDs, hostIDs)
 		return nil
 	}
-	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hids, tids []uint, puuids, uuids []string) error {
-		return nil
+	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hids, tids []uint, puuids, uuids []string,
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 	ds.ListMDMAppleDEPSerialsInHostIDsFunc = func(ctx context.Context, hids []uint) ([]string, error) {
 		return nil, nil
@@ -928,8 +933,9 @@ func TestAddHostsToTeamByFilterLabel(t *testing.T) {
 		assert.Equal(t, expectedHostIDs, hostIDs)
 		return nil
 	}
-	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hids, tids []uint, puuids, uuids []string) error {
-		return nil
+	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hids, tids []uint, puuids, uuids []string,
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 	ds.ListMDMAppleDEPSerialsInHostIDsFunc = func(ctx context.Context, hids []uint) ([]string, error) {
 		return nil, nil
@@ -960,8 +966,9 @@ func TestAddHostsToTeamByFilterEmptyHosts(t *testing.T) {
 	ds.AddHostsToTeamFunc = func(ctx context.Context, teamID *uint, hostIDs []uint) error {
 		return nil
 	}
-	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hids, tids []uint, puuids, uuids []string) error {
-		return nil
+	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hids, tids []uint, puuids, uuids []string,
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 
 	emptyFilter := &map[string]interface{}{}
@@ -1861,7 +1868,7 @@ func TestBulkOperationFilterValidation(t *testing.T) {
 func TestSetDiskEncryptionNotifications(t *testing.T) {
 	ds := new(mock.Store)
 	ctx := context.Background()
-	svc := &Service{ds: ds}
+	svc := &Service{ds: ds, logger: kitlog.NewNopLogger()}
 
 	tests := []struct {
 		name                     string
@@ -1873,6 +1880,7 @@ func TestSetDiskEncryptionNotifications(t *testing.T) {
 		getHostDiskEncryptionKey func(context.Context, uint) (*fleet.HostDiskEncryptionKey, error)
 		expectedNotifications    *fleet.OrbitConfigNotifications
 		expectedError            bool
+		disableCapability        bool
 	}{
 		{
 			name: "no MDM configured",
@@ -1943,6 +1951,24 @@ func TestSetDiskEncryptionNotifications(t *testing.T) {
 			},
 			expectedError: false,
 		},
+		{
+			name: "darwin needs rotation but client is old",
+			host: &fleet.Host{ID: 1, Platform: "darwin", OsqueryHostID: ptr.String("foo")},
+			appConfig: &fleet.AppConfig{
+				MDM: fleet.MDM{EnabledAndConfigured: true},
+			},
+			diskEncryptionConfigured: true,
+			isConnectedToFleetMDM:    true,
+			mdmInfo:                  nil,
+			getHostDiskEncryptionKey: func(ctx context.Context, id uint) (*fleet.HostDiskEncryptionKey, error) {
+				return &fleet.HostDiskEncryptionKey{Decryptable: ptr.Bool(false)}, nil
+			},
+			expectedNotifications: &fleet.OrbitConfigNotifications{
+				RotateDiskEncryptionKey: true,
+			},
+			expectedError:     false,
+			disableCapability: true,
+		},
 		{
 			name: "darwin needs rotation",
 			host: &fleet.Host{ID: 1, Platform: "darwin", OsqueryHostID: ptr.String("foo")},
@@ -2056,6 +2082,13 @@ func TestSetDiskEncryptionNotifications(t *testing.T) {
 				return tt.appConfig, nil
 			}
 
+			if !tt.disableCapability {
+				r := http.Request{
+					Header: http.Header{fleet.CapabilitiesHeader: []string{string(fleet.CapabilityEscrowBuddy)}},
+				}
+				ctx = capabilities.NewContext(ctx, &r)
+			}
+
 			notifs := &fleet.OrbitConfigNotifications{}
 			err := svc.setDiskEncryptionNotifications(ctx, notifs, tt.host, tt.appConfig, tt.diskEncryptionConfigured, tt.isConnectedToFleetMDM, tt.mdmInfo)
 			if tt.expectedError {
diff --git a/server/service/integration_core_test.go b/server/service/integration_core_test.go
index e1a9a5150b..8b1f848205 100644
--- a/server/service/integration_core_test.go
+++ b/server/service/integration_core_test.go
@@ -4048,21 +4048,28 @@ func (s *integrationTestSuite) TestLabels() {
 
 	// modify manual label 1 without modifying its hosts
 	modResp = modifyLabelResponse{}
-	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/labels/%d", manualLbl1.ID), &fleet.ModifyLabelPayload{Name: ptr.String("modified_manual_label1")}, http.StatusOK, &modResp)
+	newName := "modified_manual_label1"
+	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/labels/%d", manualLbl1.ID), &fleet.ModifyLabelPayload{Name: &newName}, http.StatusOK,
+		&modResp)
 	assert.Equal(t, manualLbl1.ID, modResp.Label.ID)
 	assert.Equal(t, fleet.LabelTypeRegular, modResp.Label.LabelType)
 	assert.Equal(t, fleet.LabelMembershipTypeManual, modResp.Label.LabelMembershipType)
 	assert.ElementsMatch(t, []uint{manualHosts[0].ID, manualHosts[1].ID, manualHosts[2].ID}, modResp.Label.HostIDs)
 	assert.EqualValues(t, 3, modResp.Label.HostCount)
+	assert.Equal(t, newName, modResp.Label.Name)
 
 	// modify manual label 2 adding some hosts
 	modResp = modifyLabelResponse{}
-	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/labels/%d", manualLbl2.ID), &fleet.ModifyLabelPayload{Hosts: []string{manualHosts[0].UUID}}, http.StatusOK, &modResp)
+	newName = "modified_manual_label2"
+	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/labels/%d", manualLbl2.ID),
+		&fleet.ModifyLabelPayload{Name: &newName, Hosts: []string{manualHosts[0].UUID}}, http.StatusOK, &modResp)
 	assert.Equal(t, manualLbl2.ID, modResp.Label.ID)
 	assert.Equal(t, fleet.LabelTypeRegular, modResp.Label.LabelType)
 	assert.Equal(t, fleet.LabelMembershipTypeManual, modResp.Label.LabelMembershipType)
 	assert.ElementsMatch(t, []uint{manualHosts[0].ID}, modResp.Label.HostIDs)
 	assert.EqualValues(t, 1, modResp.Label.HostCount)
+	assert.Equal(t, newName, modResp.Label.Name)
+	manualLbl2.Name = newName
 
 	// modify manual label 2 clearing its hosts
 	modResp = modifyLabelResponse{}
@@ -6162,6 +6169,55 @@ func (s *integrationTestSuite) TestPremiumEndpointsWithoutLicense() {
 		"team_id", "1",
 	)
 
+	// a request with a premium vulnerability filter returns a license error
+	resp = listSoftwareTitlesResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/titles",
+		listSoftwareTitlesRequest{fleet.SoftwareTitleListOptions{VulnerableOnly: true, MinimumCVSS: 7.5}}, http.StatusPaymentRequired, &resp,
+	)
+	verResp := listSoftwareVersionsResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/versions",
+		listSoftwareRequest{fleet.SoftwareListOptions{VulnerableOnly: true, MinimumCVSS: 7.5}}, http.StatusPaymentRequired, &verResp,
+	)
+	countResp := countSoftwareResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/count",
+		listSoftwareRequest{fleet.SoftwareListOptions{VulnerableOnly: true, MinimumCVSS: 7.5}}, http.StatusPaymentRequired, &countResp,
+	)
+
+	resp = listSoftwareTitlesResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/titles",
+		listSoftwareTitlesRequest{fleet.SoftwareTitleListOptions{VulnerableOnly: true, MaximumCVSS: 7.5}}, http.StatusPaymentRequired, &resp,
+	)
+	verResp = listSoftwareVersionsResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/versions",
+		listSoftwareRequest{fleet.SoftwareListOptions{VulnerableOnly: true, MaximumCVSS: 7.5}}, http.StatusPaymentRequired, &verResp,
+	)
+	countResp = countSoftwareResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/count",
+		listSoftwareRequest{fleet.SoftwareListOptions{VulnerableOnly: true, MaximumCVSS: 7.5}}, http.StatusPaymentRequired, &countResp,
+	)
+
+	resp = listSoftwareTitlesResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/titles",
+		listSoftwareTitlesRequest{fleet.SoftwareTitleListOptions{VulnerableOnly: true, KnownExploit: true}}, http.StatusPaymentRequired, &resp,
+	)
+	verResp = listSoftwareVersionsResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/versions",
+		listSoftwareRequest{fleet.SoftwareListOptions{VulnerableOnly: true, KnownExploit: true}}, http.StatusPaymentRequired, &verResp,
+	)
+	countResp = countSoftwareResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/count",
+		listSoftwareRequest{fleet.SoftwareListOptions{VulnerableOnly: true, KnownExploit: true}}, http.StatusPaymentRequired, &countResp,
+	)
+
 	// lock/unlock/wipe a host
 	s.Do("POST", "/api/v1/fleet/hosts/123/lock", nil, http.StatusPaymentRequired)
 	s.Do("POST", "/api/v1/fleet/hosts/123/unlock", nil, http.StatusPaymentRequired)
@@ -8605,7 +8661,7 @@ func (s *integrationTestSuite) TestListVulnerabilities() {
 
 	_, err = s.ds.InsertOSVulnerability(context.Background(), fleet.OSVulnerability{
 		OSID:              os.ID,
-		CVE:               "CVE-2021-1234",
+		CVE:               "CVE-2021-12345",
 		ResolvedInVersion: *ptr.StringPtr("10.0.19043.2013"),
 	}, fleet.MSRCSource)
 	require.NoError(t, err)
@@ -8662,15 +8718,16 @@ func (s *integrationTestSuite) TestListVulnerabilities() {
 	require.NoError(t, err)
 
 	// insert CVEMeta
+	knownCVE := "cve-2021-12999"
 	mockTime := time.Date(2021, 1, 1, 0, 0, 0, 0, time.UTC)
 	err = s.ds.InsertCVEMeta(context.Background(), []fleet.CVEMeta{
 		{
-			CVE:              "CVE-2021-1234",
+			CVE:              "CVE-2021-12345",
 			CVSSScore:        ptr.Float64(7.5),
 			EPSSProbability:  ptr.Float64(0.5),
 			CISAKnownExploit: ptr.Bool(true),
 			Published:        ptr.Time(mockTime),
-			Description:      "Test CVE 2021-1234",
+			Description:      "Test CVE 2021-12345",
 		},
 		{
 			CVE:              "CVE-2021-1235",
@@ -8688,6 +8745,14 @@ func (s *integrationTestSuite) TestListVulnerabilities() {
 			Published:        ptr.Time(mockTime),
 			Description:      "Test CVE 2021-1246",
 		},
+		{
+			CVE:              knownCVE,
+			CVSSScore:        ptr.Float64(6.4),
+			EPSSProbability:  ptr.Float64(0.61),
+			CISAKnownExploit: ptr.Bool(true),
+			Published:        ptr.Time(mockTime),
+			Description:      fmt.Sprintf("Test %s", knownCVE),
+		},
 	})
 	require.NoError(t, err)
 
@@ -8708,9 +8773,9 @@ func (s *integrationTestSuite) TestListVulnerabilities() {
 		DetailsLink string
 		Source      fleet.VulnerabilitySource
 	}{
-		"CVE-2021-1234": {
+		"CVE-2021-12345": {
 			HostCount:   1,
-			DetailsLink: "https://nvd.nist.gov/vuln/detail/CVE-2021-1234",
+			DetailsLink: "https://nvd.nist.gov/vuln/detail/CVE-2021-12345",
 		},
 		"CVE-2021-1235": {
 			HostCount:   1,
@@ -8724,7 +8789,7 @@ func (s *integrationTestSuite) TestListVulnerabilities() {
 
 	for _, vuln := range resp.Vulnerabilities {
 		expectedVuln, ok := expected[vuln.CVE.CVE]
-		require.True(t, ok)
+		require.True(t, ok, vuln.CVE.CVE)
 		require.Equal(t, expectedVuln.HostCount, vuln.HostsCount)
 		require.Equal(t, expectedVuln.DetailsLink, vuln.DetailsLink)
 		require.Empty(t, vuln.CVSSScore)
@@ -8745,9 +8810,9 @@ func (s *integrationTestSuite) TestListVulnerabilities() {
 		DetailsLink string
 		Source      fleet.VulnerabilitySource
 	}{
-		"CVE-2021-1234": {
+		"CVE-2021-12345": {
 			HostCount:   1,
-			DetailsLink: "https://nvd.nist.gov/vuln/detail/CVE-2021-1234",
+			DetailsLink: "https://nvd.nist.gov/vuln/detail/CVE-2021-12345",
 		},
 		"CVE-2021-1235": {
 			HostCount:   1,
@@ -8772,6 +8837,23 @@ func (s *integrationTestSuite) TestListVulnerabilities() {
 	require.False(t, resp.Meta.HasPreviousResults)
 	require.False(t, resp.Meta.HasNextResults)
 
+	// test with a known CVE that does not match on software/OS
+	s.DoJSON("GET", "/api/latest/fleet/vulnerabilities", nil, http.StatusOK, &resp, "query", knownCVE)
+	require.Empty(t, resp.Err)
+	assert.Len(s.T(), resp.Vulnerabilities, 0)
+	assert.Equal(t, resp.Count, uint(0))
+	assert.False(t, resp.Meta.HasPreviousResults)
+	assert.False(t, resp.Meta.HasNextResults)
+
+	// test with a substring of a known CVE -- results are returned
+	s.DoJSON("GET", "/api/latest/fleet/vulnerabilities", nil, http.StatusOK, &resp, "query", "CVE-2021-1234")
+	require.Empty(t, resp.Err)
+	assert.Len(s.T(), resp.Vulnerabilities, 1)
+	assert.Equal(t, resp.Count, uint(1))
+	assert.False(t, resp.Meta.HasPreviousResults)
+	assert.False(t, resp.Meta.HasNextResults)
+	_ = s.Do("GET", "/api/latest/fleet/vulnerabilities/CVE-2021-1234", nil, http.StatusNotFound)
+
 	// Team 1 Filter
 	s.DoJSON("GET", "/api/latest/fleet/vulnerabilities", nil, http.StatusOK, &resp, "team_id", "1")
 	require.Len(s.T(), resp.Vulnerabilities, 0)
@@ -8819,26 +8901,27 @@ func (s *integrationTestSuite) TestListVulnerabilities() {
 
 	var gResp getVulnerabilityResponse
 	// invalid cve
-	s.DoJSON("GET", "/api/latest/fleet/vulnerabilities/foobar", nil, http.StatusNotFound, &gResp)
+	s.DoJSON("GET", "/api/latest/fleet/vulnerabilities/foobar", nil, http.StatusBadRequest, &gResp)
 
 	// Valid CVE but not in team scope
-	s.DoJSON("GET", "/api/latest/fleet/vulnerabilities/CVE-2021-1246", nil, http.StatusNotFound, &gResp, "team_id", fmt.Sprintf("%d", team.ID))
+	s.Do("GET", "/api/latest/fleet/vulnerabilities/CVE-2021-1246", nil, http.StatusNoContent, "team_id",
+		fmt.Sprintf("%d", team.ID))
 
 	// Valid CVE in "no team" scope
 	s.DoJSON("GET", "/api/latest/fleet/vulnerabilities/CVE-2021-1246", nil, http.StatusOK, &gResp, "team_id", "0")
 
-	// Valid CVD not in "no team" scope
-	s.DoJSON("GET", "/api/latest/fleet/vulnerabilities/CVE-2021-1234", nil, http.StatusNotFound, &gResp, "team_id", "0")
+	// Valid CVE not in "no team" scope
+	s.Do("GET", "/api/latest/fleet/vulnerabilities/CVE-2021-12345", nil, http.StatusNoContent, "team_id", "0")
 
 	// Invalid TeamID
-	s.DoJSON("GET", "/api/latest/fleet/vulnerabilities/CVE-2021-1234", nil, http.StatusForbidden, &gResp, "team_id", "100")
+	s.Do("GET", "/api/latest/fleet/vulnerabilities/CVE-2021-12345", nil, http.StatusForbidden, "team_id", "100")
 
 	// Valid Global Request
-	s.DoJSON("GET", "/api/latest/fleet/vulnerabilities/CVE-2021-1234", nil, http.StatusOK, &gResp)
+	s.DoJSON("GET", "/api/latest/fleet/vulnerabilities/CVE-2021-12345", nil, http.StatusOK, &gResp)
 	require.Empty(t, gResp.Err)
-	require.Equal(t, "CVE-2021-1234", gResp.Vulnerability.CVE.CVE)
+	require.Equal(t, "CVE-2021-12345", gResp.Vulnerability.CVE.CVE)
 	require.Equal(t, uint(1), gResp.Vulnerability.HostsCount)
-	require.Equal(t, "https://nvd.nist.gov/vuln/detail/CVE-2021-1234", gResp.Vulnerability.DetailsLink)
+	require.Equal(t, "https://nvd.nist.gov/vuln/detail/CVE-2021-12345", gResp.Vulnerability.DetailsLink)
 	require.Empty(t, gResp.Vulnerability.Description)
 	require.Empty(t, gResp.Vulnerability.CVSSScore)
 	require.Empty(t, gResp.Vulnerability.CISAKnownExploit)
@@ -9146,7 +9229,11 @@ func (s *integrationTestSuite) TestOrbitConfigNotifications() {
 	require.False(t, resp.Notifications.RenewEnrollmentProfile)
 
 	// simulate ABM assignment
-	err = s.ds.UpsertMDMAppleHostDEPAssignments(ctx, []fleet.Host{*hFleetMDM})
+	encTok := uuid.NewString()
+	abmToken, err := s.ds.InsertABMToken(ctx, &fleet.ABMToken{OrganizationName: "unused", EncryptedToken: []byte(encTok)})
+	require.NoError(t, err)
+	require.NotEmpty(t, abmToken.ID)
+	err = s.ds.UpsertMDMAppleHostDEPAssignments(ctx, []fleet.Host{*hFleetMDM}, abmToken.ID)
 	require.NoError(t, err)
 	err = s.ds.SetOrUpdateMDMData(context.Background(), hSimpleMDM.ID, false, true, "https://simplemdm.com", false, fleet.WellKnownMDMSimpleMDM, "")
 	require.NoError(t, err)
@@ -11508,6 +11595,9 @@ func (s *integrationTestSuite) TestListHostUpcomingActivities() {
 	t := s.T()
 	ctx := context.Background()
 
+	adminUser, err := s.ds.UserByEmail(ctx, "admin1@example.com")
+	require.NoError(t, err)
+
 	// there is already a datastore-layer test that verifies that correct values
 	// are returned for users, saved scripts, etc. so this is more focused on
 	// verifying that the service layer passes the proper options and the
@@ -11552,6 +11642,7 @@ func (s *integrationTestSuite) TestListHostUpcomingActivities() {
 		Title:         "foo",
 		Source:        "apps",
 		Version:       "0.0.1",
+		UserID:        adminUser.ID,
 	})
 	require.NoError(t, err)
 	s1Meta, err := s.ds.GetSoftwareInstallerMetadataByID(ctx, sw1)
diff --git a/server/service/integration_ds_only_test.go b/server/service/integration_ds_only_test.go
index 7275e5bc10..0d456a9c1e 100644
--- a/server/service/integration_ds_only_test.go
+++ b/server/service/integration_ds_only_test.go
@@ -15,9 +15,9 @@ type integrationDSTestSuite struct {
 	suite.Suite
 }
 
-func TestIntegrationDSTestSuite(t *testing.T) {
+func TestIntegrationsDSTestSuite(t *testing.T) {
 	testingSuite := new(integrationDSTestSuite)
-	testingSuite.s = &testingSuite.Suite
+	testingSuite.withDS.s = &testingSuite.Suite
 	suite.Run(t, testingSuite)
 }
 
diff --git a/server/service/integration_enterprise_test.go b/server/service/integration_enterprise_test.go
index 32420f39d6..cb2a979668 100644
--- a/server/service/integration_enterprise_test.go
+++ b/server/service/integration_enterprise_test.go
@@ -24,11 +24,14 @@ import (
 	"time"
 
 	"github.com/fleetdm/fleet/v4/ee/server/calendar"
+	eeservice "github.com/fleetdm/fleet/v4/ee/server/service"
+	"github.com/fleetdm/fleet/v4/pkg/file"
 	"github.com/fleetdm/fleet/v4/pkg/optjson"
 	"github.com/fleetdm/fleet/v4/pkg/scripts"
 	"github.com/fleetdm/fleet/v4/server/config"
 	"github.com/fleetdm/fleet/v4/server/contexts/license"
 	"github.com/fleetdm/fleet/v4/server/cron"
+	"github.com/fleetdm/fleet/v4/server/datastore/filesystem"
 	"github.com/fleetdm/fleet/v4/server/datastore/mysql"
 	"github.com/fleetdm/fleet/v4/server/datastore/redis/redistest"
 	"github.com/fleetdm/fleet/v4/server/fleet"
@@ -60,8 +63,9 @@ func TestIntegrationsEnterprise(t *testing.T) {
 type integrationEnterpriseTestSuite struct {
 	withServer
 	suite.Suite
-	redisPool        fleet.RedisPool
-	calendarSchedule *schedule.Schedule
+	redisPool            fleet.RedisPool
+	calendarSchedule     *schedule.Schedule
+	softwareInstallStore fleet.SoftwareInstallerStore
 
 	lq *live_query_mock.MockLiveQuery
 }
@@ -72,6 +76,13 @@ func (s *integrationEnterpriseTestSuite) SetupSuite() {
 	s.redisPool = redistest.SetupRedis(s.T(), "integration_enterprise", false, false, false)
 	s.lq = live_query_mock.New(s.T())
 	var calendarSchedule *schedule.Schedule
+
+	// Create a software install store
+	dir := s.T().TempDir()
+	softwareInstallStore, err := filesystem.NewSoftwareInstallerStore(dir)
+	require.NoError(s.T(), err)
+	s.softwareInstallStore = softwareInstallStore
+
 	config := TestServerOpts{
 		License: &fleet.LicenseInfo{
 			Tier: fleet.TierPremium,
@@ -98,6 +109,7 @@ func (s *integrationEnterpriseTestSuite) SetupSuite() {
 				}
 			},
 		},
+		SoftwareInstallStore: softwareInstallStore,
 	}
 	if os.Getenv("FLEET_INTEGRATION_TESTS_DISABLE_LOG") != "" {
 		config.Logger = kitlog.NewNopLogger()
@@ -938,6 +950,141 @@ func (s *integrationEnterpriseTestSuite) TestTeamPolicies() {
 	require.Len(t, ts.Policies, 0)
 }
 
+func (s *integrationEnterpriseTestSuite) TestNoTeamPolicies() {
+	t := s.T()
+	ctx := context.Background()
+
+	//
+	// Test a global admin can read and write "No team" policies.
+	//
+
+	// List "No team" policies.
+	ts := listTeamPoliciesResponse{}
+	s.DoJSON("GET", "/api/latest/fleet/teams/0/policies", nil, http.StatusOK, &ts)
+	require.Len(t, ts.Policies, 0)
+	require.Len(t, ts.InheritedPolicies, 0)
+	// Create a placeholder global policy.
+	_, err := s.ds.NewGlobalPolicy(ctx, nil, fleet.PolicyPayload{
+		Name:  "globalPolicy1",
+		Query: "SELECT 0;",
+	})
+	require.NoError(t, err)
+	// Create a "No team" policy.
+	tpParams := teamPolicyRequest{
+		Name:  "noTeamPolicy1",
+		Query: "SELECT 1;",
+	}
+	r := teamPolicyResponse{}
+	s.DoJSON("POST", "/api/latest/fleet/teams/0/policies", tpParams, http.StatusOK, &r)
+	require.NotNil(t, r.Policy.TeamID)
+	require.Zero(t, *r.Policy.TeamID)
+	// Test that we can't create a policy with the same name under "No team" domain.
+	s.DoJSON("POST", "/api/latest/fleet/teams/0/policies", tpParams, http.StatusConflict, &r)
+	// Create a second "No team" policy.
+	tpParams = teamPolicyRequest{
+		Name:  "noTeamPolicy2",
+		Query: "SELECT 2;",
+	}
+	r = teamPolicyResponse{}
+	s.DoJSON("POST", "/api/latest/fleet/teams/0/policies", tpParams, http.StatusOK, &r)
+	require.NotNil(t, r.Policy.TeamID)
+	require.Zero(t, *r.Policy.TeamID)
+	// List "No team" policies.
+	ts = listTeamPoliciesResponse{}
+	s.DoJSON("GET", "/api/latest/fleet/teams/0/policies", nil, http.StatusOK, &ts)
+	require.Len(t, ts.Policies, 2)
+	assert.Equal(t, "noTeamPolicy1", ts.Policies[0].Name)
+	assert.Equal(t, "SELECT 1;", ts.Policies[0].Query)
+	require.NotNil(t, ts.Policies[0].TeamID)
+	require.Zero(t, *ts.Policies[0].TeamID)
+	assert.Equal(t, "noTeamPolicy2", ts.Policies[1].Name)
+	assert.Equal(t, "SELECT 2;", ts.Policies[1].Query)
+	require.NotNil(t, ts.Policies[1].TeamID)
+	require.Zero(t, *ts.Policies[1].TeamID)
+	require.Len(t, ts.InheritedPolicies, 1)
+	assert.Equal(t, "globalPolicy1", ts.InheritedPolicies[0].Name)
+	assert.Equal(t, "SELECT 0;", ts.InheritedPolicies[0].Query)
+	assert.Nil(t, ts.InheritedPolicies[0].TeamID)
+	// Test policy count for "No team" policies.
+	tc := countTeamPoliciesResponse{}
+	s.DoJSON("GET", "/api/latest/fleet/teams/0/policies/count", nil, http.StatusOK, &tc)
+	require.Equal(t, 2, tc.Count)
+	// Test merge inherited for "No team" policies.
+	ts = listTeamPoliciesResponse{}
+	s.DoJSON("GET", "/api/latest/fleet/teams/0/policies", nil, http.StatusOK, &ts, "merge_inherited", "true", "order_key", "team_id", "order_direction", "desc")
+	require.Len(t, ts.Policies, 3)
+	require.Nil(t, ts.InheritedPolicies)
+	assert.Equal(t, "noTeamPolicy1", ts.Policies[0].Name)
+	assert.Equal(t, "SELECT 1;", ts.Policies[0].Query)
+	assert.Equal(t, "noTeamPolicy2", ts.Policies[1].Name)
+	assert.Equal(t, "SELECT 2;", ts.Policies[1].Query)
+	assert.Equal(t, "globalPolicy1", ts.Policies[2].Name)
+	assert.Equal(t, "SELECT 0;", ts.Policies[2].Query)
+	// Test merge inherited count for "No team" policies.
+	countResp := countTeamPoliciesResponse{}
+	s.DoJSON("GET", "/api/latest/fleet/teams/0/policies/count", nil, http.StatusOK, &countResp, "merge_inherited", "true")
+	require.Nil(t, countResp.Err)
+	require.Equal(t, 3, countResp.Count)
+	// Test deleting "No team" policies.
+	deletePolicyParams := deleteTeamPoliciesRequest{
+		IDs: []uint{ts.Policies[0].ID},
+	}
+	deletePolicyResp := deleteTeamPoliciesResponse{}
+	s.DoJSON("POST", "/api/latest/fleet/teams/0/policies/delete", deletePolicyParams, http.StatusOK, &deletePolicyResp)
+	ts = listTeamPoliciesResponse{}
+	s.DoJSON("GET", "/api/latest/fleet/teams/0/policies", nil, http.StatusOK, &ts)
+	require.Len(t, ts.Policies, 1)
+	assert.Equal(t, "noTeamPolicy2", ts.Policies[0].Name)
+	assert.Equal(t, "SELECT 2;", ts.Policies[0].Query)
+	noTeamPolicy2 := ts.Policies[0]
+
+	//
+	// Test that a team admin is not allowed to access "No team" policies.
+	//
+
+	team1, err := s.ds.NewTeam(context.Background(), &fleet.Team{
+		Name: "team1",
+	})
+	require.NoError(t, err)
+	oldToken := s.token
+	t.Cleanup(func() {
+		s.token = oldToken
+	})
+	password := test.GoodPassword
+	email := "testteam@user.com"
+	team1Admin := &fleet.User{
+		Name:       "test team user",
+		Email:      email,
+		GlobalRole: nil,
+		Teams: []fleet.UserTeam{
+			{
+				Team: *team1,
+				Role: fleet.RoleAdmin,
+			},
+		},
+	}
+	require.NoError(t, team1Admin.SetPassword(password, 10, 10))
+	_, err = s.ds.NewUser(context.Background(), team1Admin)
+	require.NoError(t, err)
+
+	s.token = s.getTestToken(email, password)
+
+	ts = listTeamPoliciesResponse{}
+	s.DoJSON("GET", "/api/latest/fleet/teams/0/policies", nil, http.StatusForbidden, &ts)
+	tpParams = teamPolicyRequest{
+		Name:  "noTeamPolicy1",
+		Query: "SELECT 1;",
+	}
+	r = teamPolicyResponse{}
+	s.DoJSON("POST", "/api/latest/fleet/teams/0/policies", tpParams, http.StatusForbidden, &r)
+	tc = countTeamPoliciesResponse{}
+	s.DoJSON("GET", "/api/latest/fleet/teams/0/policies/count", nil, http.StatusForbidden, &tc)
+	deletePolicyParams = deleteTeamPoliciesRequest{
+		IDs: []uint{noTeamPolicy2.ID},
+	}
+	s.DoJSON("POST", "/api/latest/fleet/teams/0/policies/delete", deletePolicyParams, http.StatusForbidden, &deleteTeamPoliciesResponse{})
+}
+
 func (s *integrationEnterpriseTestSuite) TestTeamQueries() {
 	t := s.T()
 
@@ -1120,6 +1267,20 @@ func (s *integrationEnterpriseTestSuite) TestTeamEndpoints() {
 	tmResp.Team = nil
 	s.DoJSON("POST", "/api/latest/fleet/teams", team2, http.StatusConflict, &tmResp)
 
+	// create a team with reserved team names; should be case-insensitive
+	teamReserved := &fleet.Team{
+		Name:        "no TeAm",
+		Description: "description",
+		Secrets:     []*fleet.EnrollSecret{{Secret: "foobar"}},
+	}
+
+	r := s.Do("POST", "/api/latest/fleet/teams", teamReserved, http.StatusUnprocessableEntity)
+	require.Contains(t, extractServerErrorText(r.Body), `"No team" is a reserved team name`)
+
+	teamReserved.Name = "AlL TeaMS"
+	r = s.Do("POST", "/api/latest/fleet/teams", teamReserved, http.StatusUnprocessableEntity)
+	require.Contains(t, extractServerErrorText(r.Body), `"All teams" is a reserved team name`)
+
 	// create a team with too many secrets
 	team3 := &fleet.Team{
 		Name:        name + "lots_of_secrets",
@@ -1219,6 +1380,13 @@ func (s *integrationEnterpriseTestSuite) TestTeamEndpoints() {
 	modifyExpiry.HostExpirySettings.HostExpiryWindow = 0
 	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/teams/%d", tm1ID), modifyExpiry, http.StatusUnprocessableEntity, &tmResp)
 
+	// try to rename to reserved names
+	r = s.Do("PATCH", fmt.Sprintf("/api/latest/fleet/teams/%d", tm1ID), fleet.TeamPayload{Name: ptr.String("no TEAM")}, http.StatusUnprocessableEntity)
+	require.Contains(t, extractServerErrorText(r.Body), `"No team" is a reserved team name`)
+
+	r = s.Do("PATCH", fmt.Sprintf("/api/latest/fleet/teams/%d", tm1ID), fleet.TeamPayload{Name: ptr.String("ALL teAMs")}, http.StatusUnprocessableEntity)
+	require.Contains(t, extractServerErrorText(r.Body), `"All teams" is a reserved team name`)
+
 	// Modify team's calendar config
 	modifyCalendar := fleet.TeamPayload{
 		Integrations: &fleet.TeamIntegrations{
@@ -2890,44 +3058,6 @@ func (s *integrationEnterpriseTestSuite) TestCustomTransparencyURL() {
 	require.Equal(t, fleet.DefaultTransparencyURL, rawResp.Header.Get("Location"))
 }
 
-func (s *integrationEnterpriseTestSuite) TestDefaultAppleBMTeam() {
-	t := s.T()
-
-	tm, err := s.ds.NewTeam(context.Background(), &fleet.Team{
-		Name:        t.Name(),
-		Description: "desc",
-	})
-	require.NoError(s.T(), err)
-
-	var acResp appConfigResponse
-
-	// try to set an invalid team name
-	s.DoJSON("PATCH", "/api/latest/fleet/config", json.RawMessage(`{
-		"mdm": {
-			"apple_bm_default_team": "xyz"
-		}
-	}`), http.StatusUnprocessableEntity, &acResp)
-
-	// get the appconfig, nothing changed
-	acResp = appConfigResponse{}
-	s.DoJSON("GET", "/api/latest/fleet/config", nil, http.StatusOK, &acResp)
-	require.Empty(t, acResp.MDM.AppleBMDefaultTeam)
-
-	// set to a valid team name
-	acResp = appConfigResponse{}
-	s.DoJSON("PATCH", "/api/latest/fleet/config", json.RawMessage(fmt.Sprintf(`{
-		"mdm": {
-			"apple_bm_default_team": %q
-		}
-	}`, tm.Name)), http.StatusOK, &acResp)
-	require.Equal(t, tm.Name, acResp.MDM.AppleBMDefaultTeam)
-
-	// get the appconfig, set to that team name
-	acResp = appConfigResponse{}
-	s.DoJSON("GET", "/api/latest/fleet/config", nil, http.StatusOK, &acResp)
-	require.Equal(t, tm.Name, acResp.MDM.AppleBMDefaultTeam)
-}
-
 func (s *integrationEnterpriseTestSuite) TestMDMWindowsUpdates() {
 	t := s.T()
 
@@ -4704,6 +4834,13 @@ func createHostAndDeviceToken(t *testing.T, ds *mysql.Datastore, token string) *
 	return host
 }
 
+func updateDeviceTokenForHost(t *testing.T, ds *mysql.Datastore, hostID uint, token string) {
+	mysql.ExecAdhocSQL(t, ds, func(db sqlx.ExtContext) error {
+		_, err := db.ExecContext(context.Background(), `UPDATE host_device_auth SET token = ? WHERE host_id = ?`, token, hostID)
+		return err
+	})
+}
+
 func createDeviceTokenForHost(t *testing.T, ds *mysql.Datastore, hostID uint, token string) {
 	mysql.ExecAdhocSQL(t, ds, func(db sqlx.ExtContext) error {
 		_, err := db.ExecContext(context.Background(), `INSERT INTO host_device_auth (host_id, token) VALUES (?, ?)`, hostID, token)
@@ -4815,6 +4952,108 @@ func (s *integrationEnterpriseTestSuite) TestListSoftware() {
 	require.Equal(t, barPayload.Vulnerabilities[0].CVEPublished, ptr.TimePtr(now))
 	require.Equal(t, barPayload.Vulnerabilities[0].Description, ptr.StringPtr("a long description of the cve"))
 	require.Equal(t, barPayload.Vulnerabilities[0].ResolvedInVersion, ptr.StringPtr("1.2.3"))
+
+	// vulnerable param required when using vulnerability filters
+	respVersions = listSoftwareVersionsResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/versions",
+		listSoftwareRequest{},
+		http.StatusUnprocessableEntity, &respVersions,
+		"exploit", "true",
+	)
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/versions",
+		listSoftwareRequest{},
+		http.StatusUnprocessableEntity, &respVersions,
+		"min_cvss_score", "1.1",
+	)
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/versions",
+		listSoftwareRequest{},
+		http.StatusUnprocessableEntity, &respVersions,
+		"max_cvss_score", "10.0",
+	)
+
+	// vulnerability filters
+	respVersions = listSoftwareVersionsResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/versions",
+		listSoftwareRequest{},
+		http.StatusOK, &respVersions,
+		"exploit", "true",
+		"vulnerable", "true",
+	)
+	require.Len(t, respVersions.Software, 1)
+	require.NotEmpty(t, respVersions.CountsUpdatedAt)
+
+	respVersions = listSoftwareVersionsResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/versions",
+		listSoftwareRequest{},
+		http.StatusOK, &respVersions,
+		"min_cvss_score", "1",
+		"vulnerable", "true",
+	)
+	require.Len(t, respVersions.Software, 1)
+	require.NotEmpty(t, respVersions.CountsUpdatedAt)
+
+	respVersions = listSoftwareVersionsResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/versions",
+		listSoftwareRequest{},
+		http.StatusOK, &respVersions,
+		"min_cvss_score", "10",
+		"vulnerable", "true",
+	)
+	require.Len(t, respVersions.Software, 0)
+	require.Nil(t, respVersions.CountsUpdatedAt)
+
+	respVersions = listSoftwareVersionsResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/versions",
+		listSoftwareRequest{},
+		http.StatusOK, &respVersions,
+		"max_cvss_score", "10",
+		"vulnerable", "true",
+	)
+	require.Len(t, respVersions.Software, 1)
+	require.NotEmpty(t, respVersions.CountsUpdatedAt)
+
+	respVersions = listSoftwareVersionsResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/versions",
+		listSoftwareRequest{},
+		http.StatusOK, &respVersions,
+		"max_cvss_score", "1",
+		"vulnerable", "true",
+	)
+	require.Len(t, respVersions.Software, 0)
+	require.Nil(t, respVersions.CountsUpdatedAt)
+
+	respVersions = listSoftwareVersionsResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/versions",
+		listSoftwareRequest{},
+		http.StatusOK, &respVersions,
+		"min_cvss_score", "1",
+		"max_cvss_score", "10",
+		"vulnerable", "true",
+	)
+	require.Len(t, respVersions.Software, 1)
+	require.NotEmpty(t, respVersions.CountsUpdatedAt)
+
+	respVersions = listSoftwareVersionsResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/versions",
+		listSoftwareRequest{},
+		http.StatusOK, &respVersions,
+		"min_cvss_score", "1",
+		"max_cvss_score", "10",
+		"exploit", "true",
+		"vulnerable", "true",
+	)
+	require.Len(t, respVersions.Software, 1)
+	require.NotEmpty(t, respVersions.CountsUpdatedAt)
 }
 
 // TestGitOpsUserActions tests the MDM permissions listed in ../../docs/Using\ Fleet/manage-access.md
@@ -5814,7 +6053,7 @@ func (s *integrationEnterpriseTestSuite) TestRunHostScript() {
 				case r := <-resultsCh:
 					r.ExecutionID = pending[0].ExecutionID
 					// ignoring errors in this goroutine, the HTTP request below will fail if this fails
-					_, err = s.ds.SetHostScriptExecutionResult(ctx, r)
+					_, _, err = s.ds.SetHostScriptExecutionResult(ctx, r)
 					if err != nil {
 						t.Log(err)
 					}
@@ -7684,6 +7923,15 @@ func (s *integrationEnterpriseTestSuite) TestAllSoftwareTitles() {
 	require.NoError(t, err)
 	require.True(t, inserted)
 
+	err = s.ds.InsertCVEMeta(context.Background(), []fleet.CVEMeta{
+		{
+			CVE:              "cve-123-123-132",
+			CVSSScore:        ptr.Float64(7.8),
+			CISAKnownExploit: ptr.Bool(true),
+		},
+	})
+	require.NoError(t, err)
+
 	// calculate hosts counts
 	hostsCountTs := time.Now().UTC()
 	require.NoError(t, s.ds.SyncHostsSoftware(ctx, hostsCountTs))
@@ -7786,16 +8034,7 @@ func (s *integrationEnterpriseTestSuite) TestAllSoftwareTitles() {
 	softwareTitleListResultsMatch([]fleet.SoftwareTitleListResult{}, resp.SoftwareTitles)
 
 	// asking for vulnerable only software returns the expected values
-	resp = listSoftwareTitlesResponse{}
-	s.DoJSON(
-		"GET", "/api/latest/fleet/software/titles",
-		listSoftwareTitlesRequest{},
-		http.StatusOK, &resp,
-		"vulnerable", "true",
-	)
-	require.Equal(t, 1, resp.Count)
-	require.NotEmpty(t, resp.CountsUpdatedAt)
-	softwareTitleListResultsMatch([]fleet.SoftwareTitleListResult{
+	expectedVulnSoftware := []fleet.SoftwareTitleListResult{
 		{
 			Name:          "bar",
 			Source:        "apps",
@@ -7805,7 +8044,127 @@ func (s *integrationEnterpriseTestSuite) TestAllSoftwareTitles() {
 				{Version: "0.0.4", Vulnerabilities: &fleet.SliceString{"cve-123-123-132"}},
 			},
 		},
-	}, resp.SoftwareTitles)
+	}
+
+	resp = listSoftwareTitlesResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/titles",
+		listSoftwareTitlesRequest{},
+		http.StatusOK, &resp,
+		"vulnerable", "true",
+	)
+	require.Equal(t, 1, resp.Count)
+	require.NotEmpty(t, resp.CountsUpdatedAt)
+	softwareTitleListResultsMatch(expectedVulnSoftware, resp.SoftwareTitles)
+
+	// vulnerable param required when using vulnerability filters
+	resp = listSoftwareTitlesResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/titles",
+		listSoftwareTitlesRequest{},
+		http.StatusUnprocessableEntity, &resp,
+		"exploit", "true",
+	)
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/titles",
+		listSoftwareTitlesRequest{},
+		http.StatusUnprocessableEntity, &resp,
+		"min_cvss_score", "1",
+	)
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/titles",
+		listSoftwareTitlesRequest{},
+		http.StatusUnprocessableEntity, &resp,
+		"max_cvss_score", "10",
+	)
+
+	// vulnerability filters
+	resp = listSoftwareTitlesResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/titles",
+		listSoftwareTitlesRequest{},
+		http.StatusOK, &resp,
+		"exploit", "true",
+		"vulnerable", "true",
+	)
+	require.Equal(t, 1, resp.Count)
+	require.NotEmpty(t, resp.CountsUpdatedAt)
+	softwareTitleListResultsMatch(expectedVulnSoftware, resp.SoftwareTitles)
+
+	resp = listSoftwareTitlesResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/titles",
+		listSoftwareTitlesRequest{},
+		http.StatusOK, &resp,
+		"min_cvss_score", "1",
+		"vulnerable", "true",
+	)
+	require.Equal(t, 1, resp.Count)
+	require.NotEmpty(t, resp.CountsUpdatedAt)
+	softwareTitleListResultsMatch(expectedVulnSoftware, resp.SoftwareTitles)
+
+	resp = listSoftwareTitlesResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/titles",
+		listSoftwareTitlesRequest{},
+		http.StatusOK, &resp,
+		"min_cvss_score", "10",
+		"vulnerable", "true",
+	)
+	require.Zero(t, resp.Count)
+	require.Nil(t, resp.CountsUpdatedAt)
+	softwareTitleListResultsMatch([]fleet.SoftwareTitleListResult{}, resp.SoftwareTitles)
+
+	resp = listSoftwareTitlesResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/titles",
+		listSoftwareTitlesRequest{},
+		http.StatusOK, &resp,
+		"max_cvss_score", "10",
+		"vulnerable", "true",
+	)
+	require.Equal(t, 1, resp.Count)
+	require.NotEmpty(t, resp.CountsUpdatedAt)
+	softwareTitleListResultsMatch(expectedVulnSoftware, resp.SoftwareTitles)
+
+	resp = listSoftwareTitlesResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/titles",
+		listSoftwareTitlesRequest{},
+		http.StatusOK, &resp,
+		"max_cvss_score", "1",
+		"vulnerable", "true",
+	)
+	require.Zero(t, resp.Count)
+	require.Nil(t, resp.CountsUpdatedAt)
+	softwareTitleListResultsMatch([]fleet.SoftwareTitleListResult{}, resp.SoftwareTitles)
+
+	resp = listSoftwareTitlesResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/titles",
+		listSoftwareTitlesRequest{},
+		http.StatusOK, &resp,
+		"min_cvss_score", "1",
+		"max_cvss_score", "10",
+		"vulnerable", "true",
+	)
+	require.Equal(t, 1, resp.Count)
+	require.NotEmpty(t, resp.CountsUpdatedAt)
+	softwareTitleListResultsMatch(expectedVulnSoftware, resp.SoftwareTitles)
+
+	resp = listSoftwareTitlesResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/titles",
+		listSoftwareTitlesRequest{},
+		http.StatusOK, &resp,
+		"min_cvss_score", "1",
+		"max_cvss_score", "10",
+		"exploit", "true",
+		"vulnerable", "true",
+	)
+	require.Equal(t, 1, resp.Count)
+	require.NotEmpty(t, resp.CountsUpdatedAt)
+	softwareTitleListResultsMatch(expectedVulnSoftware, resp.SoftwareTitles)
 
 	// request titles for team1, nothing there yet
 	resp = listSoftwareTitlesResponse{}
@@ -8299,7 +8658,7 @@ func (s *integrationEnterpriseTestSuite) TestAllSoftwareTitles() {
 	require.NotNil(t, resp.SoftwareTitles[0].SoftwarePackage.SelfService)
 	require.True(t, *resp.SoftwareTitles[0].SoftwarePackage.SelfService)
 
-	// no team but self-service returns the emacs software (technically impossible via the UI)
+	// "All teams" returns no software because the self-service software it's not installed (host_counts == 0).
 	resp = listSoftwareTitlesResponse{}
 	s.DoJSON(
 		"GET", "/api/latest/fleet/software/titles",
@@ -8308,15 +8667,9 @@ func (s *integrationEnterpriseTestSuite) TestAllSoftwareTitles() {
 		"self_service", "true",
 	)
 
-	require.Len(t, resp.SoftwareTitles, 2)
-	require.NotNil(t, resp.SoftwareTitles[0].SoftwarePackage)
-	require.NotNil(t, resp.SoftwareTitles[0].SoftwarePackage.SelfService)
-	require.True(t, *resp.SoftwareTitles[0].SoftwarePackage.SelfService)
-	require.NotNil(t, resp.SoftwareTitles[1].SoftwarePackage)
-	require.NotNil(t, resp.SoftwareTitles[1].SoftwarePackage.SelfService)
-	require.True(t, *resp.SoftwareTitles[1].SoftwarePackage.SelfService)
+	require.Empty(t, resp.SoftwareTitles, 0)
 
-	// team 0 returns the emacs software
+	// "No team" returns the emacs software
 	resp = listSoftwareTitlesResponse{}
 	s.DoJSON(
 		"GET", "/api/latest/fleet/software/titles",
@@ -9754,7 +10107,7 @@ func (s *integrationEnterpriseTestSuite) TestListHostSoftware() {
 
 	// request installation on the host
 	var installResp installSoftwareResponse
-	s.DoJSON("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/software/install/%d",
+	s.DoJSON("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/software/%d/install",
 		host.ID, titleID), nil, http.StatusAccepted, &installResp)
 
 	// still returned by user-authenticated endpoint, now pending
@@ -9768,7 +10121,7 @@ func (s *integrationEnterpriseTestSuite) TestListHostSoftware() {
 	require.NotNil(t, getHostSw.Software[2].SoftwarePackage)
 	require.Equal(t, "ruby.deb", getHostSw.Software[2].SoftwarePackage.Name)
 	require.NotNil(t, getHostSw.Software[2].Status)
-	require.Equal(t, fleet.SoftwareInstallerPending, *getHostSw.Software[2].Status)
+	require.Equal(t, fleet.SoftwareInstallPending, *getHostSw.Software[2].Status)
 	require.NotNil(t, getHostSw.Software[2].SoftwarePackage.SelfService)
 	require.True(t, *getHostSw.Software[2].SoftwarePackage.SelfService)
 
@@ -9789,7 +10142,7 @@ func (s *integrationEnterpriseTestSuite) TestListHostSoftware() {
 	require.Equal(t, getDeviceSw.Software[2].Name, "ruby")
 	require.Len(t, getDeviceSw.Software[1].InstalledVersions, 2)
 	require.NotNil(t, getDeviceSw.Software[2].Status)
-	require.Equal(t, fleet.SoftwareInstallerPending, *getDeviceSw.Software[2].Status)
+	require.Equal(t, fleet.SoftwareInstallPending, *getDeviceSw.Software[2].Status)
 	require.NotNil(t, getDeviceSw.Software[2].SoftwarePackage)
 	require.Nil(t, getDeviceSw.Software[2].AppStoreApp)
 	require.NotNil(t, getDeviceSw.Software[2].SoftwarePackage.SelfService)
@@ -9821,6 +10174,36 @@ func (s *integrationEnterpriseTestSuite) TestListHostSoftware() {
 	require.Len(t, getDeviceSw.Software, 1) // bar only
 	require.Equal(t, getDeviceSw.Software[0].Name, "bar")
 	require.Len(t, getDeviceSw.Software[0].InstalledVersions, 1)
+
+	// Add new software to host -- installed on host, but not by Fleet
+	installedVersion := "1.0.1"
+	softwareAlreadyInstalled := fleet.Software{
+		Name: "DummyApp.app", Version: installedVersion, Source: "apps",
+		BundleIdentifier: "com.example.dummy",
+	}
+	software = append(software, softwareAlreadyInstalled)
+	_, err = s.ds.UpdateHostSoftware(ctx, host.ID, software)
+	require.NoError(t, err)
+	err = s.ds.ReconcileSoftwareTitles(ctx)
+	require.NoError(t, err)
+	// Add installer for software that is already installed on host
+	payload = &fleet.UploadSoftwareInstallerPayload{
+		InstallScript: "install",
+		Filename:      "dummy_installer.pkg",
+		Version:       "0.0.2", // The version can be anything -- we match on title
+	}
+	s.uploadSoftwareInstaller(payload, http.StatusOK, "")
+
+	// Get software available for install
+	getHostSw = getHostSoftwareResponse{}
+	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/hosts/%d/software", host.ID), nil, http.StatusOK, &getHostSw, "available_for_install",
+		"true", "order_key", "name", "order_direction", "asc")
+	require.Len(t, getHostSw.Software, 2) // DummyApp.app and ruby
+	assert.Equal(t, softwareAlreadyInstalled.Name, getHostSw.Software[0].Name)
+	require.Len(t, getHostSw.Software[0].InstalledVersions, 1)
+	assert.Equal(t, installedVersion, getHostSw.Software[0].InstalledVersions[0].Version)
+	assert.NotNil(t, getHostSw.Software[0].SoftwarePackage)
+	assert.Nil(t, getHostSw.Software[0].Status)
 }
 
 func (s *integrationEnterpriseTestSuite) TestSoftwareInstallerUploadDownloadAndDelete() {
@@ -9892,7 +10275,7 @@ func (s *integrationEnterpriseTestSuite) TestSoftwareInstallerUploadDownloadAndD
 		meta, err := s.ds.GetSoftwareInstallerMetadataByID(context.Background(), id)
 		require.NoError(t, err)
 
-		if payload.TeamID != nil {
+		if payload.TeamID != nil && *payload.TeamID > 0 {
 			require.Equal(t, *payload.TeamID, *meta.TeamID)
 		} else {
 			require.Nil(t, meta.TeamID)
@@ -9951,8 +10334,11 @@ func (s *integrationEnterpriseTestSuite) TestSoftwareInstallerUploadDownloadAndD
 		// download the installer
 		s.Do("GET", fmt.Sprintf("/api/latest/fleet/software/titles/%d/package?alt=media", titleID), nil, http.StatusBadRequest)
 
-		// delete the installer
+		// delete the installer from nil team fails
 		s.Do("DELETE", fmt.Sprintf("/api/latest/fleet/software/titles/%d/available_for_install", titleID), nil, http.StatusBadRequest)
+
+		// delete from team 0 succeeds
+		s.Do("DELETE", fmt.Sprintf("/api/latest/fleet/software/titles/%d/available_for_install", titleID), nil, http.StatusNoContent, "team_id", "0")
 	})
 
 	t.Run("create team software installer", func(t *testing.T) {
@@ -9991,18 +10377,44 @@ func (s *integrationEnterpriseTestSuite) TestSoftwareInstallerUploadDownloadAndD
 		r := s.Do("GET", fmt.Sprintf("/api/latest/fleet/software/titles/%d/package?alt=media", titleID), nil, http.StatusOK, "team_id", fmt.Sprintf("%d", *payload.TeamID))
 		checkDownloadResponse(t, r, payload.Filename)
 
+		// download the installer by getting token first
+		tokenResp := getSoftwareInstallerTokenResponse{}
+		s.DoJSON("POST", fmt.Sprintf("/api/latest/fleet/software/titles/%d/package/token?alt=media", titleID), nil, http.StatusOK,
+			&tokenResp, "team_id", fmt.Sprintf("%d", *payload.TeamID))
+		require.NotEmpty(t, tokenResp.Token)
+		r = s.DoRawNoAuth("GET", fmt.Sprintf("/api/latest/fleet/software/titles/%d/package/token/%s", titleID, tokenResp.Token), nil,
+			http.StatusOK)
+		checkDownloadResponse(t, r, payload.Filename)
+
+		// downloading a second time using the same token should fail
+		_ = s.DoRawNoAuth("GET", fmt.Sprintf("/api/latest/fleet/software/titles/%d/package/token/%s", titleID, tokenResp.Token), nil,
+			http.StatusForbidden)
+
+		// alt != media should fail
+		s.DoJSON("POST", fmt.Sprintf("/api/latest/fleet/software/titles/%d/package/token?alt=bozo", titleID), nil,
+			http.StatusUnprocessableEntity,
+			&tokenResp, "team_id", fmt.Sprintf("%d", *payload.TeamID))
+
+		// missing team_id should fail
+		s.DoJSON("POST", fmt.Sprintf("/api/latest/fleet/software/titles/%d/package/token?alt=media", titleID), nil,
+			http.StatusBadRequest,
+			&tokenResp)
+
 		// create an orbit host that is not in the team
 		hostNotInTeam := createOrbitEnrolledHost(t, "windows", "orbit-host-no-team", s.ds)
-		// downloading installer still works because we allow it explicitly
+		// downloading installer doesn't work if the host doesn't have a pending install request
 		s.Do("POST", "/api/fleet/orbit/software_install/package?alt=media", orbitDownloadSoftwareInstallerRequest{
 			InstallerID:  installerID,
 			OrbitNodeKey: *hostNotInTeam.OrbitNodeKey,
-		}, http.StatusOK)
+		}, http.StatusForbidden)
 
 		// create an orbit host, assign to team
-		hostInTeam := createOrbitEnrolledHost(t, "windows", "orbit-host-team", s.ds)
+		hostInTeam := createOrbitEnrolledHost(t, "linux", "orbit-host-team", s.ds)
 		require.NoError(t, s.ds.AddHostsToTeam(context.Background(), &createTeamResp.Team.ID, []uint{hostInTeam.ID}))
 
+		// Create a software installation request
+		s.Do("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/software/%d/install", hostInTeam.ID, titleID), installSoftwareRequest{}, http.StatusAccepted)
+
 		// requesting download with alt != media fails
 		r = s.Do("POST", "/api/fleet/orbit/software_install/package?alt=FOOBAR", orbitDownloadSoftwareInstallerRequest{
 			InstallerID:  installerID,
@@ -10018,6 +10430,28 @@ func (s *integrationEnterpriseTestSuite) TestSoftwareInstallerUploadDownloadAndD
 		}, http.StatusOK)
 		checkDownloadResponse(t, r, payload.Filename)
 
+		// Get execution ID, normally comes from orbit config
+		var installUUID string
+		mysql.ExecAdhocSQL(t, s.ds, func(q sqlx.ExtContext) error {
+			return sqlx.GetContext(context.Background(), q, &installUUID, "SELECT execution_id FROM host_software_installs WHERE host_id = ? AND install_script_exit_code IS NULL", hostInTeam.ID)
+		})
+
+		// Installation complete, host no longer has access to software
+		s.Do("POST", "/api/fleet/orbit/software_install/result", orbitPostSoftwareInstallResultRequest{
+			OrbitNodeKey: *hostInTeam.OrbitNodeKey,
+			HostSoftwareInstallResultPayload: &fleet.HostSoftwareInstallResultPayload{
+				HostID:                hostInTeam.ID,
+				InstallUUID:           installUUID,
+				InstallScriptExitCode: ptr.Int(0),
+				InstallScriptOutput:   ptr.String("done"),
+			},
+		}, http.StatusNoContent)
+
+		r = s.Do("POST", "/api/fleet/orbit/software_install/package?alt=media", orbitDownloadSoftwareInstallerRequest{
+			InstallerID:  installerID,
+			OrbitNodeKey: *hostInTeam.OrbitNodeKey,
+		}, http.StatusForbidden)
+
 		// delete the installer
 		s.Do("DELETE", fmt.Sprintf("/api/latest/fleet/software/titles/%d/available_for_install", titleID), nil, http.StatusNoContent, "team_id", fmt.Sprintf("%d", *payload.TeamID))
 
@@ -10027,6 +10461,200 @@ func (s *integrationEnterpriseTestSuite) TestSoftwareInstallerUploadDownloadAndD
 		// download the installer, not found anymore
 		s.Do("GET", fmt.Sprintf("/api/latest/fleet/software/titles/%d/package?alt=media", titleID), nil, http.StatusNotFound, "team_id", fmt.Sprintf("%d", *payload.TeamID))
 	})
+
+	t.Run("create team 0 software installer", func(t *testing.T) {
+		payload := &fleet.UploadSoftwareInstallerPayload{
+			TeamID:            ptr.Uint(0),
+			InstallScript:     "another install script",
+			PreInstallQuery:   "another pre install query",
+			PostInstallScript: "another post install script",
+			Filename:          "ruby.deb",
+			// additional fields below are pre-populated so we can re-use the payload later for the test assertions
+			Title:       "ruby",
+			Version:     "1:2.5.1",
+			Source:      "deb_packages",
+			StorageID:   "df06d9ce9e2090d9cb2e8cd1f4d7754a803dc452bf93e3204e3acd3b95508628",
+			Platform:    "linux",
+			SelfService: true,
+		}
+		s.uploadSoftwareInstaller(payload, http.StatusOK, "")
+
+		// check the software installer
+		installerID, titleID := checkSoftwareInstaller(t, payload)
+
+		// check activity
+		s.lastActivityOfTypeMatches(fleet.ActivityTypeAddedSoftware{}.ActivityName(), fmt.Sprintf(`{"software_title": "ruby", "software_package": "ruby.deb", "team_name": null, "team_id": 0, "self_service": true}`), 0)
+
+		// upload again fails
+		s.uploadSoftwareInstaller(payload, http.StatusConflict, "already exists")
+
+		// download the installer
+		r := s.Do("GET", fmt.Sprintf("/api/latest/fleet/software/titles/%d/package?alt=media", titleID), nil, http.StatusOK, "team_id", fmt.Sprintf("%d", 0))
+		checkDownloadResponse(t, r, payload.Filename)
+
+		// create an orbit host that is not in the team
+		hostNotInTeam := createOrbitEnrolledHost(t, "windows", "orbit-host-no-team", s.ds)
+		// downloading installer fails because there's no install request
+		s.Do("POST", "/api/fleet/orbit/software_install/package?alt=media", orbitDownloadSoftwareInstallerRequest{
+			InstallerID:  installerID,
+			OrbitNodeKey: *hostNotInTeam.OrbitNodeKey,
+		}, http.StatusForbidden)
+
+		// create an orbit host, assign to team
+		hostInTeam := createOrbitEnrolledHost(t, "linux", "orbit-host-team", s.ds)
+
+		// requesting download with alt != media fails
+		r = s.Do("POST", "/api/fleet/orbit/software_install/package?alt=FOOBAR", orbitDownloadSoftwareInstallerRequest{
+			InstallerID:  installerID,
+			OrbitNodeKey: *hostInTeam.OrbitNodeKey,
+		}, http.StatusBadRequest)
+		errMsg := extractServerErrorText(r.Body)
+		require.Contains(t, errMsg, "only alt=media is supported")
+
+		// Create a software installation request
+		s.Do("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/software/%d/install", hostInTeam.ID, titleID), installSoftwareRequest{}, http.StatusAccepted)
+
+		// valid download
+		r = s.Do("POST", "/api/fleet/orbit/software_install/package?alt=media", orbitDownloadSoftwareInstallerRequest{
+			InstallerID:  installerID,
+			OrbitNodeKey: *hostInTeam.OrbitNodeKey,
+		}, http.StatusOK)
+		checkDownloadResponse(t, r, payload.Filename)
+
+		// Get execution ID, normally comes from orbit config
+		var installUUID string
+		mysql.ExecAdhocSQL(t, s.ds, func(q sqlx.ExtContext) error {
+			return sqlx.GetContext(context.Background(), q, &installUUID, "SELECT execution_id FROM host_software_installs WHERE host_id = ? AND install_script_exit_code IS NULL", hostInTeam.ID)
+		})
+
+		// Installation complete, host no longer has access to software
+		s.Do("POST", "/api/fleet/orbit/software_install/result", orbitPostSoftwareInstallResultRequest{
+			OrbitNodeKey: *hostInTeam.OrbitNodeKey,
+			HostSoftwareInstallResultPayload: &fleet.HostSoftwareInstallResultPayload{
+				HostID:                hostInTeam.ID,
+				InstallUUID:           installUUID,
+				InstallScriptExitCode: ptr.Int(0),
+				InstallScriptOutput:   ptr.String("done"),
+			},
+		}, http.StatusNoContent)
+
+		r = s.Do("POST", "/api/fleet/orbit/software_install/package?alt=media", orbitDownloadSoftwareInstallerRequest{
+			InstallerID:  installerID,
+			OrbitNodeKey: *hostInTeam.OrbitNodeKey,
+		}, http.StatusForbidden)
+
+		// delete the installer
+		s.Do("DELETE", fmt.Sprintf("/api/latest/fleet/software/titles/%d/available_for_install", titleID), nil, http.StatusNoContent, "team_id", "0")
+
+		// check activity
+		s.lastActivityOfTypeMatches(fleet.ActivityTypeDeletedSoftware{}.ActivityName(), fmt.Sprintf(`{"software_title": "ruby", "software_package": "ruby.deb", "team_name": null, "team_id": 0, "self_service": true}`), 0)
+
+		// download the installer, not found anymore
+		s.Do("GET", fmt.Sprintf("/api/latest/fleet/software/titles/%d/package?alt=media", titleID), nil, http.StatusNotFound, "team_id", fmt.Sprintf("%d", 0))
+	})
+
+	t.Run("uninstall migration for software installer", func(t *testing.T) {
+		var createTeamResp teamResponse
+		s.DoJSON("POST", "/api/latest/fleet/teams", &fleet.Team{
+			Name: t.Name(),
+		}, http.StatusOK, &createTeamResp)
+		require.NotZero(t, createTeamResp.Team.ID)
+
+		payload := &fleet.UploadSoftwareInstallerPayload{
+			TeamID:          &createTeamResp.Team.ID,
+			InstallScript:   "another install script",
+			UninstallScript: "exit 1",
+			Filename:        "ruby.deb",
+			// additional fields below are pre-populated so we can re-use the payload later for the test assertions
+			Title:     "ruby",
+			Version:   "1:2.5.1",
+			Source:    "deb_packages",
+			StorageID: "df06d9ce9e2090d9cb2e8cd1f4d7754a803dc452bf93e3204e3acd3b95508628",
+			Platform:  "linux",
+		}
+		s.uploadSoftwareInstaller(payload, http.StatusOK, "")
+
+		logger := kitlog.NewLogfmtLogger(os.Stderr)
+
+		// Run the migration when nothing is to be done
+		err = eeservice.UninstallSoftwareMigration(context.Background(), s.ds, s.softwareInstallStore, logger)
+		require.NoError(t, err)
+
+		// check the software installer
+		installerID, titleID := checkSoftwareInstaller(t, payload)
+
+		var origPackageIDs string
+		var origExtension string
+		// Update DB by clearing package id and tweaking extension
+		mysql.ExecAdhocSQL(t, s.ds, func(q sqlx.ExtContext) error {
+			if err := sqlx.GetContext(context.Background(), q, &origPackageIDs, `SELECT package_ids FROM software_installers WHERE id = ?`,
+				installerID); err != nil {
+				return err
+			}
+			require.NotEmpty(t, origPackageIDs)
+
+			if err := sqlx.GetContext(context.Background(), q, &origExtension, `SELECT extension FROM software_installers WHERE id = ?`,
+				installerID); err != nil {
+				return err
+			}
+			require.NotEmpty(t, origExtension)
+
+			if _, err = q.ExecContext(context.Background(), `UPDATE software_installers SET package_ids = '', extension = 'rb' WHERE id = ?`,
+				installerID); err != nil {
+				return err
+			}
+			return nil
+		})
+
+		// Check title to make it works without package id
+		respTitle := getSoftwareTitleResponse{}
+		s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/software/titles/%d", titleID), nil, http.StatusOK, &respTitle, "team_id",
+			fmt.Sprintf("%d", createTeamResp.Team.ID))
+		require.NotNil(t, respTitle.SoftwareTitle.SoftwarePackage)
+		assert.Equal(t, "another install script", respTitle.SoftwareTitle.SoftwarePackage.InstallScript)
+		assert.Equal(t, "exit 1", respTitle.SoftwareTitle.SoftwarePackage.UninstallScript)
+
+		// Run the migration
+		err = eeservice.UninstallSoftwareMigration(context.Background(), s.ds, s.softwareInstallStore, logger)
+		require.NoError(t, err)
+
+		// Check package ID and extension
+		mysql.ExecAdhocSQL(t, s.ds, func(q sqlx.ExtContext) error {
+			var packageIDs string
+			if err := sqlx.GetContext(context.Background(), q, &packageIDs, `SELECT package_ids FROM software_installers WHERE id = ?`,
+				installerID); err != nil {
+				return err
+			}
+			assert.Equal(t, origPackageIDs, packageIDs)
+
+			var extension string
+			if err := sqlx.GetContext(context.Background(), q, &extension, `SELECT extension FROM software_installers WHERE id = ?`,
+				installerID); err != nil {
+				return err
+			}
+			assert.Equal(t, origExtension, extension)
+
+			return nil
+		})
+
+		// Check uninstall script
+		uninstallScript := file.GetUninstallScript("deb")
+		uninstallScript = strings.ReplaceAll(uninstallScript, "$PACKAGE_ID", "\"ruby\"")
+		respTitle = getSoftwareTitleResponse{}
+		s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/software/titles/%d", titleID), nil, http.StatusOK, &respTitle, "team_id",
+			fmt.Sprintf("%d", createTeamResp.Team.ID))
+		require.NotNil(t, respTitle.SoftwareTitle.SoftwarePackage)
+		assert.Equal(t, "another install script", respTitle.SoftwareTitle.SoftwarePackage.InstallScript)
+		assert.Equal(t, uninstallScript, respTitle.SoftwareTitle.SoftwarePackage.UninstallScript)
+
+		// Running the migration again causes no issues.
+		err = eeservice.UninstallSoftwareMigration(context.Background(), s.ds, s.softwareInstallStore, logger)
+		require.NoError(t, err)
+
+		// delete the installer
+		s.Do("DELETE", fmt.Sprintf("/api/latest/fleet/software/titles/%d/available_for_install", titleID), nil, http.StatusNoContent,
+			"team_id", fmt.Sprintf("%d", *payload.TeamID))
+	})
 }
 
 func (s *integrationEnterpriseTestSuite) TestApplyTeamsSoftwareConfig() {
@@ -10092,7 +10720,7 @@ func (s *integrationEnterpriseTestSuite) TestApplyTeamsSoftwareConfig() {
 	}
 	s.Do("POST", "/api/latest/fleet/spec/teams", teamSpecs, http.StatusOK)
 
-	wantSoftwarePackages := []fleet.TeamSpecSoftwarePackage{
+	wantSoftwarePackages := []fleet.SoftwarePackageSpec{
 		{
 			URL:               "http://foo.com",
 			SelfService:       true,
@@ -10251,9 +10879,6 @@ func (s *integrationEnterpriseTestSuite) TestApplyTeamsSoftwareConfig() {
 func (s *integrationEnterpriseTestSuite) TestBatchSetSoftwareInstallers() {
 	t := s.T()
 
-	// a team name is required (we don't allow installers for "no team")
-	s.Do("POST", "/api/latest/fleet/software/batch", batchSetSoftwareInstallersRequest{}, http.StatusBadRequest)
-
 	// non-existent team
 	s.Do("POST", "/api/latest/fleet/software/batch", batchSetSoftwareInstallersRequest{}, http.StatusNotFound, "team_name", "foo")
 
@@ -10270,8 +10895,18 @@ func (s *integrationEnterpriseTestSuite) TestBatchSetSoftwareInstallers() {
 	}
 	s.Do("POST", "/api/latest/fleet/software/batch", batchSetSoftwareInstallersRequest{Software: softwareToInstall}, http.StatusUnprocessableEntity, "team_name", tm.Name)
 
+	// software with a too big URL
+	softwareToInstall = []fleet.SoftwareInstallerPayload{
+		{URL: "https://ftp.mozilla.org/" + strings.Repeat("a", 233)},
+	}
+	s.Do("POST", "/api/latest/fleet/software/batch", batchSetSoftwareInstallersRequest{Software: softwareToInstall}, http.StatusUnprocessableEntity, "team_name", tm.Name)
+
 	// create an HTTP server to host the software installer
 	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/ruby.deb" {
+			w.WriteHeader(http.StatusNotFound)
+			return
+		}
 		file, err := os.Open(filepath.Join("testdata", "software-installers", "ruby.deb"))
 		require.NoError(t, err)
 		defer file.Close()
@@ -10283,11 +10918,28 @@ func (s *integrationEnterpriseTestSuite) TestBatchSetSoftwareInstallers() {
 	srv := httptest.NewServer(handler)
 	t.Cleanup(srv.Close)
 
-	// do a request with a valid URL
+	// do a request with a URL that returns a 404.
 	softwareToInstall = []fleet.SoftwareInstallerPayload{
-		{URL: srv.URL},
+		{URL: srv.URL + "/not_found.pkg"},
 	}
-	s.Do("POST", "/api/latest/fleet/software/batch", batchSetSoftwareInstallersRequest{Software: softwareToInstall}, http.StatusNoContent, "team_name", tm.Name)
+	var batchResponse batchSetSoftwareInstallersResponse
+	s.DoJSON("POST", "/api/latest/fleet/software/batch", batchSetSoftwareInstallersRequest{Software: softwareToInstall}, http.StatusOK, &batchResponse, "team_name", tm.Name)
+	message := waitBatchSetSoftwareInstallersFailed(t, s, tm.Name, batchResponse.RequestUUID)
+	require.NotEmpty(t, message)
+	require.Contains(t, message, fmt.Sprintf("validation failed: software.url Couldn't edit software. URL (\"%s/not_found.pkg\") returned \"Not Found\". Please make sure that URLs are reachable from your Fleet server.", srv.URL))
+
+	// do a request with a valid URL
+	rubyURL := srv.URL + "/ruby.deb"
+	softwareToInstall = []fleet.SoftwareInstallerPayload{
+		{URL: rubyURL},
+	}
+	s.DoJSON("POST", "/api/latest/fleet/software/batch", batchSetSoftwareInstallersRequest{Software: softwareToInstall}, http.StatusOK, &batchResponse, "team_name", tm.Name)
+	packages := waitBatchSetSoftwareInstallersCompleted(t, s, tm.Name, batchResponse.RequestUUID)
+	require.Len(t, packages, 1)
+	require.NotNil(t, packages[0].TitleID)
+	require.Equal(t, rubyURL, packages[0].URL)
+	require.NotNil(t, packages[0].TeamID)
+	require.Equal(t, tm.ID, *packages[0].TeamID)
 
 	// TODO(roberto): test with a variety of response codes
 
@@ -10296,6 +10948,9 @@ func (s *integrationEnterpriseTestSuite) TestBatchSetSoftwareInstallers() {
 	s.DoJSON("GET", "/api/v1/fleet/software/titles", nil, http.StatusOK, &titlesResp, "available_for_install", "true", "team_id", strconv.Itoa(int(tm.ID)))
 	require.Equal(t, 1, titlesResp.Count)
 	require.Len(t, titlesResp.SoftwareTitles, 1)
+	// Check that the URL is set to software installers uploaded via batch.
+	require.NotNil(t, titlesResp.SoftwareTitles[0].SoftwarePackage.PackageURL)
+	require.Equal(t, rubyURL, *titlesResp.SoftwareTitles[0].SoftwarePackage.PackageURL)
 
 	// check that platform is set when the installer is created
 	mysql.ExecAdhocSQL(t, s.ds, func(q sqlx.ExtContext) error {
@@ -10308,14 +10963,26 @@ func (s *integrationEnterpriseTestSuite) TestBatchSetSoftwareInstallers() {
 	})
 
 	// same payload doesn't modify anything
-	s.Do("POST", "/api/latest/fleet/software/batch", batchSetSoftwareInstallersRequest{Software: softwareToInstall}, http.StatusNoContent, "team_name", tm.Name)
+	s.DoJSON("POST", "/api/latest/fleet/software/batch", batchSetSoftwareInstallersRequest{Software: softwareToInstall}, http.StatusOK, &batchResponse, "team_name", tm.Name)
+	packages = waitBatchSetSoftwareInstallersCompleted(t, s, tm.Name, batchResponse.RequestUUID)
+	require.Len(t, packages, 1)
+	require.NotNil(t, packages[0].TitleID)
+	require.Equal(t, rubyURL, packages[0].URL)
+	require.NotNil(t, packages[0].TeamID)
+	require.Equal(t, tm.ID, *packages[0].TeamID)
 	newTitlesResp := listSoftwareTitlesResponse{}
 	s.DoJSON("GET", "/api/v1/fleet/software/titles", nil, http.StatusOK, &newTitlesResp, "available_for_install", "true", "team_id", strconv.Itoa(int(tm.ID)))
 	require.Equal(t, titlesResp, newTitlesResp)
 
 	// setting self-service to true updates the software title metadata
 	softwareToInstall[0].SelfService = true
-	s.Do("POST", "/api/latest/fleet/software/batch", batchSetSoftwareInstallersRequest{Software: softwareToInstall}, http.StatusNoContent, "team_name", tm.Name)
+	s.DoJSON("POST", "/api/latest/fleet/software/batch", batchSetSoftwareInstallersRequest{Software: softwareToInstall}, http.StatusOK, &batchResponse, "team_name", tm.Name)
+	packages = waitBatchSetSoftwareInstallersCompleted(t, s, tm.Name, batchResponse.RequestUUID)
+	require.Len(t, packages, 1)
+	require.NotNil(t, packages[0].TitleID)
+	require.Equal(t, rubyURL, packages[0].URL)
+	require.NotNil(t, packages[0].TeamID)
+	require.Equal(t, tm.ID, *packages[0].TeamID)
 	newTitlesResp = listSoftwareTitlesResponse{}
 	s.DoJSON("GET", "/api/v1/fleet/software/titles", nil, http.StatusOK, &newTitlesResp, "available_for_install", "true", "team_id", strconv.Itoa(int(tm.ID)))
 	titlesResp.SoftwareTitles[0].SoftwarePackage.SelfService = ptr.Bool(true)
@@ -10323,11 +10990,420 @@ func (s *integrationEnterpriseTestSuite) TestBatchSetSoftwareInstallers() {
 
 	// empty payload cleans the software items
 	softwareToInstall = []fleet.SoftwareInstallerPayload{}
-	s.Do("POST", "/api/latest/fleet/software/batch", batchSetSoftwareInstallersRequest{Software: softwareToInstall}, http.StatusNoContent, "team_name", tm.Name)
+	s.DoJSON("POST", "/api/latest/fleet/software/batch", batchSetSoftwareInstallersRequest{Software: softwareToInstall}, http.StatusOK, &batchResponse, "team_name", tm.Name)
+	packages = waitBatchSetSoftwareInstallersCompleted(t, s, tm.Name, batchResponse.RequestUUID)
+	require.Empty(t, packages)
 	titlesResp = listSoftwareTitlesResponse{}
 	s.DoJSON("GET", "/api/v1/fleet/software/titles", nil, http.StatusOK, &titlesResp, "available_for_install", "true", "team_id", strconv.Itoa(int(tm.ID)))
 	require.Equal(t, 0, titlesResp.Count)
 	require.Len(t, titlesResp.SoftwareTitles, 0)
+
+	//////////////////////////
+	// Do a request with a valid URL with no team
+	//////////////////////////
+	softwareToInstall = []fleet.SoftwareInstallerPayload{
+		{URL: rubyURL},
+	}
+	s.DoJSON("POST", "/api/latest/fleet/software/batch", batchSetSoftwareInstallersRequest{Software: softwareToInstall}, http.StatusOK, &batchResponse)
+	packages = waitBatchSetSoftwareInstallersCompleted(t, s, "", batchResponse.RequestUUID)
+	require.Len(t, packages, 1)
+	require.NotNil(t, packages[0].TitleID)
+	require.Equal(t, rubyURL, packages[0].URL)
+	require.Nil(t, packages[0].TeamID)
+
+	// check the application status on team 0
+	titlesResp = listSoftwareTitlesResponse{}
+	s.DoJSON("GET", "/api/v1/fleet/software/titles", nil, http.StatusOK, &titlesResp, "available_for_install", "true", "team_id", strconv.Itoa(int(0)))
+	require.Equal(t, 1, titlesResp.Count)
+	require.Len(t, titlesResp.SoftwareTitles, 1)
+
+	// same payload doesn't modify anything
+	s.DoJSON("POST", "/api/latest/fleet/software/batch", batchSetSoftwareInstallersRequest{Software: softwareToInstall}, http.StatusOK, &batchResponse)
+	packages = waitBatchSetSoftwareInstallersCompleted(t, s, "", batchResponse.RequestUUID)
+	require.Len(t, packages, 1)
+	require.NotNil(t, packages[0].TitleID)
+	require.Equal(t, rubyURL, packages[0].URL)
+	require.Nil(t, packages[0].TeamID)
+	newTitlesResp = listSoftwareTitlesResponse{}
+	s.DoJSON("GET", "/api/v1/fleet/software/titles", nil, http.StatusOK, &newTitlesResp, "available_for_install", "true", "team_id", strconv.Itoa(int(0)))
+	require.Equal(t, titlesResp, newTitlesResp)
+
+	// setting self-service to true updates the software title metadata
+	softwareToInstall[0].SelfService = true
+	s.DoJSON("POST", "/api/latest/fleet/software/batch", batchSetSoftwareInstallersRequest{Software: softwareToInstall}, http.StatusOK, &batchResponse)
+	packages = waitBatchSetSoftwareInstallersCompleted(t, s, "", batchResponse.RequestUUID)
+	require.Len(t, packages, 1)
+	require.NotNil(t, packages[0].TitleID)
+	require.Equal(t, rubyURL, packages[0].URL)
+	require.Nil(t, packages[0].TeamID)
+	newTitlesResp = listSoftwareTitlesResponse{}
+	s.DoJSON("GET", "/api/v1/fleet/software/titles", nil, http.StatusOK, &newTitlesResp, "available_for_install", "true", "team_id", strconv.Itoa(int(0)))
+	titlesResp.SoftwareTitles[0].SoftwarePackage.SelfService = ptr.Bool(true)
+	require.Equal(t, titlesResp, newTitlesResp)
+
+	// empty payload cleans the software items
+	softwareToInstall = []fleet.SoftwareInstallerPayload{}
+	s.DoJSON("POST", "/api/latest/fleet/software/batch", batchSetSoftwareInstallersRequest{Software: softwareToInstall}, http.StatusOK, &batchResponse)
+	packages = waitBatchSetSoftwareInstallersCompleted(t, s, "", batchResponse.RequestUUID)
+	require.Empty(t, packages)
+	titlesResp = listSoftwareTitlesResponse{}
+	s.DoJSON("GET", "/api/v1/fleet/software/titles", nil, http.StatusOK, &titlesResp, "available_for_install", "true", "team_id", strconv.Itoa(int(0)))
+	require.Equal(t, 0, titlesResp.Count)
+	require.Len(t, titlesResp.SoftwareTitles, 0)
+}
+
+func waitBatchSetSoftwareInstallersCompleted(t *testing.T, s *integrationEnterpriseTestSuite, teamName string, requestUUID string) []fleet.SoftwarePackageResponse {
+	timeout := time.After(1 * time.Minute)
+	for {
+		var batchResultResponse batchSetSoftwareInstallersResultResponse
+		s.DoJSON("GET", "/api/latest/fleet/software/batch/"+requestUUID, nil, http.StatusOK, &batchResultResponse, "team_name", teamName)
+		if batchResultResponse.Status == fleet.BatchSetSoftwareInstallersStatusCompleted {
+			return batchResultResponse.Packages
+		}
+		select {
+		case <-timeout:
+			t.Fatalf("timeout: %s, %s", teamName, requestUUID)
+		case <-time.After(500 * time.Millisecond):
+			// OK, continue
+		}
+	}
+}
+
+func waitBatchSetSoftwareInstallersFailed(t *testing.T, s *integrationEnterpriseTestSuite, teamName string, requestUUID string) string {
+	timeout := time.After(1 * time.Minute)
+	for {
+		var batchResultResponse batchSetSoftwareInstallersResultResponse
+		s.DoJSON("GET", "/api/latest/fleet/software/batch/"+requestUUID, nil, http.StatusOK, &batchResultResponse, "team_name", teamName)
+		if batchResultResponse.Status == fleet.BatchSetSoftwareInstallersStatusFailed {
+			require.Empty(t, batchResultResponse.Packages)
+			return batchResultResponse.Message
+		}
+		select {
+		case <-timeout:
+			t.Fatalf("timeout: %s, %s", teamName, requestUUID)
+		case <-time.After(500 * time.Millisecond):
+			// OK, continue
+		}
+	}
+}
+
+func (s *integrationEnterpriseTestSuite) TestBatchSetSoftwareInstallersSideEffects() {
+	t := s.T()
+
+	// create a team
+	tm, err := s.ds.NewTeam(context.Background(), &fleet.Team{
+		Name:        t.Name(),
+		Description: "desc",
+	})
+	require.NoError(t, err)
+
+	// create an HTTP server to host the software installer
+	trailer := ""
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		file, err := os.Open(filepath.Join("testdata", "software-installers", "ruby.deb"))
+		require.NoError(t, err)
+		defer file.Close()
+		w.Header().Set("Content-Type", "application/vnd.debian.binary-package")
+		_, err = io.Copy(w, file)
+		require.NoError(t, err)
+		_, err = w.Write([]byte(trailer))
+		require.NoError(t, err)
+	})
+
+	srv := httptest.NewServer(handler)
+	t.Cleanup(srv.Close)
+
+	// set up software to install
+	softwareToInstall := []fleet.SoftwareInstallerPayload{
+		{URL: srv.URL},
+	}
+	var batchResponse batchSetSoftwareInstallersResponse
+	s.DoJSON("POST", "/api/latest/fleet/software/batch", batchSetSoftwareInstallersRequest{Software: softwareToInstall}, http.StatusOK, &batchResponse, "team_name", tm.Name)
+	packages := waitBatchSetSoftwareInstallersCompleted(t, s, tm.Name, batchResponse.RequestUUID)
+	require.Len(t, packages, 1)
+	require.NotNil(t, packages[0].TitleID)
+	require.NotNil(t, packages[0].TeamID)
+	require.Equal(t, tm.ID, *packages[0].TeamID)
+	require.Equal(t, srv.URL, packages[0].URL)
+	titlesResp := listSoftwareTitlesResponse{}
+	s.DoJSON("GET", "/api/v1/fleet/software/titles", nil, http.StatusOK, &titlesResp, "available_for_install", "true", "team_id", strconv.Itoa(int(tm.ID)))
+	titleResponse := getSoftwareTitleResponse{}
+	s.DoJSON("GET", fmt.Sprintf("/api/v1/fleet/software/titles/%d", titlesResp.SoftwareTitles[0].ID), nil, http.StatusOK, &titleResponse, "team_id", strconv.Itoa(int(tm.ID)))
+	uploadedAt := titleResponse.SoftwareTitle.SoftwarePackage.UploadedAt
+
+	// create a host that doesn't have fleetd installed
+	h, err := s.ds.NewHost(context.Background(), &fleet.Host{
+		DetailUpdatedAt: time.Now(),
+		LabelUpdatedAt:  time.Now(),
+		PolicyUpdatedAt: time.Now(),
+		SeenTime:        time.Now().Add(-1 * time.Minute),
+		OsqueryHostID:   ptr.String(t.Name() + uuid.New().String()),
+		NodeKey:         ptr.String(t.Name() + uuid.New().String()),
+		Hostname:        fmt.Sprintf("%sfoo.local", t.Name()),
+		Platform:        "linux",
+	})
+	require.NoError(t, err)
+	err = s.ds.AddHostsToTeam(context.Background(), &tm.ID, []uint{h.ID})
+	require.NoError(t, err)
+	h.TeamID = &tm.ID
+
+	// host installs fleetd
+	orbitKey := setOrbitEnrollment(t, h, s.ds)
+	h.OrbitNodeKey = &orbitKey
+
+	// install software
+	installResp := installSoftwareResponse{}
+	s.DoJSON("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/software/%d/install", h.ID, titlesResp.SoftwareTitles[0].ID), nil, http.StatusAccepted, &installResp)
+
+	// Get the install response, should be pending
+	getHostSoftwareResp := getHostSoftwareResponse{}
+	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/hosts/%d/software", h.ID), nil, http.StatusOK, &getHostSoftwareResp)
+	require.Equal(t, fleet.SoftwareInstallPending, *getHostSoftwareResp.Software[0].Status)
+
+	// Switch self-service flag
+	softwareToInstall[0].SelfService = true
+	s.DoJSON("POST", "/api/latest/fleet/software/batch", batchSetSoftwareInstallersRequest{Software: softwareToInstall}, http.StatusOK, &batchResponse, "team_name", tm.Name)
+	packages = waitBatchSetSoftwareInstallersCompleted(t, s, tm.Name, batchResponse.RequestUUID)
+	require.Len(t, packages, 1)
+	require.NotNil(t, packages[0].TitleID)
+	require.NotNil(t, packages[0].TeamID)
+	require.Equal(t, tm.ID, *packages[0].TeamID)
+	require.Equal(t, srv.URL, packages[0].URL)
+	newTitlesResp := listSoftwareTitlesResponse{}
+	s.DoJSON("GET", "/api/v1/fleet/software/titles", nil, http.StatusOK, &newTitlesResp, "available_for_install", "true", "team_id", strconv.Itoa(int(tm.ID)))
+	require.Equal(t, true, *newTitlesResp.SoftwareTitles[0].SoftwarePackage.SelfService)
+
+	// Install should still be pending
+	afterSelfServiceHostResp := getHostSoftwareResponse{}
+	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/hosts/%d/software", h.ID), nil, http.StatusOK, &afterSelfServiceHostResp)
+	require.Equal(t, fleet.SoftwareInstallPending, *getHostSoftwareResp.Software[0].Status)
+
+	// update pre-install query
+	withUpdatedPreinstallQuery := []fleet.SoftwareInstallerPayload{
+		{URL: srv.URL, PreInstallQuery: "SELECT * FROM os_version"},
+	}
+	s.DoJSON("POST", "/api/latest/fleet/software/batch", batchSetSoftwareInstallersRequest{Software: withUpdatedPreinstallQuery}, http.StatusOK, &batchResponse, "team_name", tm.Name)
+	packages = waitBatchSetSoftwareInstallersCompleted(t, s, tm.Name, batchResponse.RequestUUID)
+	require.Len(t, packages, 1)
+	require.NotNil(t, packages[0].TitleID)
+	require.NotNil(t, packages[0].TeamID)
+	require.Equal(t, tm.ID, *packages[0].TeamID)
+	require.Equal(t, srv.URL, packages[0].URL)
+	titleResponse = getSoftwareTitleResponse{}
+	s.DoJSON("GET", fmt.Sprintf("/api/v1/fleet/software/titles/%d", newTitlesResp.SoftwareTitles[0].ID), nil, http.StatusOK, &titleResponse, "team_id", strconv.Itoa(int(tm.ID)))
+	require.Equal(t, "SELECT * FROM os_version", titleResponse.SoftwareTitle.SoftwarePackage.PreInstallQuery)
+	require.Equal(t, uint(0), titleResponse.SoftwareTitle.SoftwarePackage.Status.PendingInstall)
+
+	// install should no longer be pending
+	afterPreinstallHostResp := getHostSoftwareResponse{}
+	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/hosts/%d/software", h.ID), nil, http.StatusOK, &afterPreinstallHostResp)
+	require.Nil(t, afterPreinstallHostResp.Software[0].Status)
+
+	// install software fully
+	s.DoJSON("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/software/%d/install", h.ID, titlesResp.SoftwareTitles[0].ID), nil, http.StatusAccepted, &installResp)
+	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/hosts/%d/software", h.ID), nil, http.StatusOK, &getHostSoftwareResp)
+	installUUID := getHostSoftwareResp.Software[0].SoftwarePackage.LastInstall.InstallUUID
+	s.Do("POST", "/api/fleet/orbit/software_install/result", json.RawMessage(fmt.Sprintf(`{
+			"orbit_node_key": %q,
+			"install_uuid": %q,
+			"pre_install_condition_output": "ok",
+			"install_script_exit_code": 0,
+			"install_script_output": "ok"
+		}`, *h.OrbitNodeKey, installUUID)), http.StatusNoContent)
+
+	// ensure install count is updated
+	s.DoJSON("GET", fmt.Sprintf("/api/v1/fleet/software/titles/%d", newTitlesResp.SoftwareTitles[0].ID), nil, http.StatusOK, &titleResponse, "team_id", strconv.Itoa(int(tm.ID)))
+	require.Equal(t, uint(1), titleResponse.SoftwareTitle.SoftwarePackage.Status.Installed)
+	require.Equal(t, uint(0), titleResponse.SoftwareTitle.SoftwarePackage.Status.PendingInstall)
+
+	// install should show as complete
+	hostResp := getHostSoftwareResponse{}
+	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/hosts/%d/software", h.ID), nil, http.StatusOK, &hostResp)
+	require.Equal(t, fleet.SoftwareInstalled, *hostResp.Software[0].Status)
+
+	// update install script
+	withUpdatedInstallScript := []fleet.SoftwareInstallerPayload{
+		{URL: srv.URL, InstallScript: "apt install ruby"},
+	}
+	s.DoJSON("POST", "/api/latest/fleet/software/batch", batchSetSoftwareInstallersRequest{Software: withUpdatedInstallScript}, http.StatusOK, &batchResponse, "team_name", tm.Name)
+	packages = waitBatchSetSoftwareInstallersCompleted(t, s, tm.Name, batchResponse.RequestUUID)
+	require.Len(t, packages, 1)
+	require.NotNil(t, packages[0].TitleID)
+	require.NotNil(t, packages[0].TeamID)
+	require.Equal(t, tm.ID, *packages[0].TeamID)
+	require.Equal(t, srv.URL, packages[0].URL)
+
+	// ensure install count is the same, and uploaded_at hasn't changed
+	s.DoJSON("GET", fmt.Sprintf("/api/v1/fleet/software/titles/%d", newTitlesResp.SoftwareTitles[0].ID), nil, http.StatusOK, &titleResponse, "team_id", strconv.Itoa(int(tm.ID)))
+	require.Equal(t, uint(1), titleResponse.SoftwareTitle.SoftwarePackage.Status.Installed)
+	require.Equal(t, uint(0), titleResponse.SoftwareTitle.SoftwarePackage.Status.PendingInstall)
+	require.Equal(t, uploadedAt, titleResponse.SoftwareTitle.SoftwarePackage.UploadedAt)
+
+	// install should still show as complete
+	hostResp = getHostSoftwareResponse{}
+	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/hosts/%d/software", h.ID), nil, http.StatusOK, &hostResp)
+	require.Equal(t, fleet.SoftwareInstalled, *hostResp.Software[0].Status)
+
+	trailer = " " // add a character to the response for the installer HTTP call to ensure the file hashes differently
+	// update package
+	s.DoJSON("POST", "/api/latest/fleet/software/batch", batchSetSoftwareInstallersRequest{Software: withUpdatedInstallScript}, http.StatusOK, &batchResponse, "team_name", tm.Name)
+	packages = waitBatchSetSoftwareInstallersCompleted(t, s, tm.Name, batchResponse.RequestUUID)
+	require.Len(t, packages, 1)
+	require.NotNil(t, packages[0].TitleID)
+	require.NotNil(t, packages[0].TeamID)
+	require.Equal(t, tm.ID, *packages[0].TeamID)
+	require.Equal(t, srv.URL, packages[0].URL)
+
+	// ensure install count is zeroed and uploaded_at HAS changed
+	s.DoJSON("GET", fmt.Sprintf("/api/v1/fleet/software/titles/%d", newTitlesResp.SoftwareTitles[0].ID), nil, http.StatusOK, &titleResponse, "team_id", strconv.Itoa(int(tm.ID)))
+	require.Equal(t, uint(0), titleResponse.SoftwareTitle.SoftwarePackage.Status.Installed)
+	require.Equal(t, uint(0), titleResponse.SoftwareTitle.SoftwarePackage.Status.PendingInstall)
+	require.NotEqual(t, uploadedAt, titleResponse.SoftwareTitle.SoftwarePackage.UploadedAt)
+
+	// install should be nulled out
+	hostResp = getHostSoftwareResponse{}
+	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/hosts/%d/software", h.ID), nil, http.StatusOK, &hostResp)
+	require.Nil(t, hostResp.Software[0].Status)
+}
+
+func (s *integrationEnterpriseTestSuite) TestBatchSetSoftwareInstallersWithPoliciesAssociated() {
+	ctx := context.Background()
+	t := s.T()
+
+	team1, err := s.ds.NewTeam(ctx, &fleet.Team{Name: "team1"})
+	require.NoError(t, err)
+	team2, err := s.ds.NewTeam(ctx, &fleet.Team{Name: "team2"})
+	require.NoError(t, err)
+	policy1Team1, err := s.ds.NewTeamPolicy(
+		ctx, team1.ID, nil, fleet.PolicyPayload{
+			Name:  "team1Policy1",
+			Query: "SELECT 1;",
+		},
+	)
+	require.NoError(t, err)
+	policy2Team2, err := s.ds.NewTeamPolicy(
+		ctx, team2.ID, nil, fleet.PolicyPayload{
+			Name:  "team2Policy2",
+			Query: "SELECT 2;",
+		},
+	)
+	require.NoError(t, err)
+
+	// create an HTTP server to host software installers
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		var fileName string
+		switch r.URL.Path {
+		case "/ruby.deb", "/dummy_installer.pkg":
+			fileName = strings.TrimPrefix(r.URL.Path, "/")
+		default:
+			w.WriteHeader(http.StatusNotFound)
+			return
+		}
+		file, err := os.Open(filepath.Join("testdata", "software-installers", fileName))
+		require.NoError(t, err)
+		defer file.Close()
+		w.Header().Set("Content-Type", "application/vnd.debian.binary-package")
+		_, err = io.Copy(w, file)
+		require.NoError(t, err)
+	})
+
+	srv := httptest.NewServer(handler)
+	t.Cleanup(srv.Close)
+
+	// team1 has ruby.deb
+	softwareToInstall := []fleet.SoftwareInstallerPayload{
+		{
+			URL: srv.URL + "/ruby.deb",
+		},
+	}
+	var batchResponse batchSetSoftwareInstallersResponse
+	s.DoJSON("POST", "/api/latest/fleet/software/batch", batchSetSoftwareInstallersRequest{Software: softwareToInstall}, http.StatusOK, &batchResponse, "team_name", team1.Name)
+	packages := waitBatchSetSoftwareInstallersCompleted(t, s, team1.Name, batchResponse.RequestUUID)
+	require.Len(t, packages, 1)
+	require.NotNil(t, packages[0].TitleID)
+	require.NotNil(t, packages[0].TeamID)
+	require.Equal(t, team1.ID, *packages[0].TeamID)
+	require.Equal(t, srv.URL+"/ruby.deb", packages[0].URL)
+
+	// team2 has dummy_installer.pkg and ruby.deb.
+	softwareToInstall = []fleet.SoftwareInstallerPayload{
+		{
+			URL: srv.URL + "/dummy_installer.pkg",
+		},
+		{
+			URL: srv.URL + "/ruby.deb",
+		},
+	}
+	s.DoJSON("POST", "/api/latest/fleet/software/batch", batchSetSoftwareInstallersRequest{Software: softwareToInstall}, http.StatusOK, &batchResponse, "team_name", team2.Name)
+	packages = waitBatchSetSoftwareInstallersCompleted(t, s, team2.Name, batchResponse.RequestUUID)
+	sort.Slice(packages, func(i, j int) bool {
+		return packages[i].URL < packages[j].URL
+	})
+	require.Len(t, packages, 2)
+	require.NotNil(t, packages[0].TitleID)
+	require.NotNil(t, packages[0].TeamID)
+	require.Equal(t, team2.ID, *packages[0].TeamID)
+	require.Equal(t, srv.URL+"/dummy_installer.pkg", packages[0].URL)
+	require.NotNil(t, packages[1].TitleID)
+	require.NotNil(t, packages[1].TeamID)
+	require.Equal(t, team2.ID, *packages[1].TeamID)
+	require.Equal(t, srv.URL+"/ruby.deb", packages[1].URL)
+
+	// Associate ruby.deb to policy1Team1.
+	resp := listSoftwareTitlesResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/titles",
+		listSoftwareTitlesRequest{},
+		http.StatusOK, &resp,
+		"query", "ruby",
+		"team_id", fmt.Sprintf("%d", team1.ID),
+	)
+	require.Len(t, resp.SoftwareTitles, 1)
+	require.NotNil(t, resp.SoftwareTitles[0].SoftwarePackage)
+	rubyDebTitleID := resp.SoftwareTitles[0].ID
+	mtplr := modifyTeamPolicyResponse{}
+	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/teams/%d/policies/%d", team1.ID, policy1Team1.ID), modifyTeamPolicyRequest{
+		ModifyPolicyPayload: fleet.ModifyPolicyPayload{
+			SoftwareTitleID: &rubyDebTitleID,
+		},
+	}, http.StatusOK, &mtplr)
+
+	// Associate ruby.deb in team2 to policy2Team2.
+	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/teams/%d/policies/%d", team2.ID, policy2Team2.ID), modifyTeamPolicyRequest{
+		ModifyPolicyPayload: fleet.ModifyPolicyPayload{
+			SoftwareTitleID: &rubyDebTitleID,
+		},
+	}, http.StatusOK, &mtplr)
+
+	// Get rid of all installers in team1.
+	softwareToInstall = []fleet.SoftwareInstallerPayload{}
+	s.DoJSON("POST", "/api/latest/fleet/software/batch", batchSetSoftwareInstallersRequest{Software: softwareToInstall}, http.StatusOK, &batchResponse, "team_name", team1.Name)
+	packages = waitBatchSetSoftwareInstallersCompleted(t, s, team1.Name, batchResponse.RequestUUID)
+	require.Len(t, packages, 0)
+
+	// policy1Team1 should not be associated to any installer.
+	policy1Team1, err = s.ds.Policy(ctx, policy1Team1.ID)
+	require.NoError(t, err)
+	require.Nil(t, policy1Team1.SoftwareInstallerID)
+	// team1 should be empty.
+	titlesResp := listSoftwareTitlesResponse{}
+	s.DoJSON("GET", "/api/v1/fleet/software/titles", nil, http.StatusOK, &titlesResp, "available_for_install", "true", "team_id", strconv.Itoa(int(team1.ID)))
+	require.Equal(t, 0, titlesResp.Count)
+
+	// team2 should be untouched.
+	titlesResp = listSoftwareTitlesResponse{}
+	s.DoJSON("GET", "/api/v1/fleet/software/titles", nil, http.StatusOK, &titlesResp, "available_for_install", "true", "team_id", strconv.Itoa(int(team2.ID)))
+	require.Equal(t, 2, titlesResp.Count)
+	require.Len(t, titlesResp.SoftwareTitles, 2)
+	require.NotNil(t, titlesResp.SoftwareTitles[0].SoftwarePackage.PackageURL)
+	require.Equal(t, srv.URL+"/dummy_installer.pkg", *titlesResp.SoftwareTitles[0].SoftwarePackage.PackageURL)
+	require.NotNil(t, titlesResp.SoftwareTitles[1].SoftwarePackage.PackageURL)
+	require.Equal(t, srv.URL+"/ruby.deb", *titlesResp.SoftwareTitles[1].SoftwarePackage.PackageURL)
+
+	// policy2Team2 should still be associated to ruby.deb of team2.
+	policy2Team2, err = s.ds.Policy(ctx, policy2Team2.ID)
+	require.NoError(t, err)
+	require.NotNil(t, policy2Team2.SoftwareInstallerID)
 }
 
 func (s *integrationEnterpriseTestSuite) TestSoftwareInstallerNewInstallRequestPlatformValidation() {
@@ -10379,6 +11455,14 @@ func (s *integrationEnterpriseTestSuite) TestSoftwareInstallerNewInstallRequestP
 			}
 			scriptContentID, _ := res.LastInsertId()
 
+			uninstallScript := fmt.Sprintf(`echo uninstall '%s'`, kind)
+			resUninstall, err := q.ExecContext(ctx, `INSERT INTO script_contents (md5_checksum, contents) VALUES (UNHEX(md5(?)), ?)`,
+				uninstallScript, uninstallScript)
+			if err != nil {
+				return err
+			}
+			uninstallScriptContentID, _ := resUninstall.LastInsertId()
+
 			res, err = q.ExecContext(ctx, `INSERT INTO software_titles (name, source) VALUES ('foo', ?)`, kind)
 			if err != nil {
 				return err
@@ -10388,10 +11472,11 @@ func (s *integrationEnterpriseTestSuite) TestSoftwareInstallerNewInstallRequestP
 
 			_, err = q.ExecContext(ctx, `
 			INSERT INTO software_installers
-				(title_id, filename, version, install_script_content_id, storage_id, team_id, global_or_team_id, pre_install_query)
+				(title_id, filename, extension, version, install_script_content_id, uninstall_script_content_id, storage_id, team_id, global_or_team_id, pre_install_query)
 			VALUES
-				(?, ?, ?, ?, unhex(?), ?, ?, ?)`,
-				titleID, fmt.Sprintf("installer.%s", kind), "v1.0.0", scriptContentID, hex.EncodeToString([]byte("test")), tm.ID, tm.ID, "foo")
+				(?, ?, ?, ?, ?, ?, unhex(?), ?, ?, ?)`,
+				titleID, fmt.Sprintf("installer.%s", kind), kind, "v1.0.0", scriptContentID, uninstallScriptContentID,
+				hex.EncodeToString([]byte("test")), tm.ID, tm.ID, "foo")
 			return err
 		})
 	}
@@ -10414,7 +11499,8 @@ func (s *integrationEnterpriseTestSuite) TestSoftwareInstallerNewInstallRequestP
 				}
 
 				var resp installSoftwareResponse
-				s.DoJSON("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/software/install/%d", host.ID, softwareTitles[kind]), nil, wantStatus, &resp)
+				s.DoJSON("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/software/%d/install", host.ID, softwareTitles[kind]), nil,
+					wantStatus, &resp)
 			}
 		}
 	}
@@ -10423,6 +11509,14 @@ func (s *integrationEnterpriseTestSuite) TestSoftwareInstallerNewInstallRequestP
 func (s *integrationEnterpriseTestSuite) TestSoftwareInstallerHostRequests() {
 	t := s.T()
 
+	// Enabling software inventory globally, which will be inherited by the team
+	appConf, err := s.ds.AppConfig(context.Background())
+	require.NoError(s.T(), err)
+	appConf.Features.EnableSoftwareInventory = true
+	err = s.ds.SaveAppConfig(context.Background(), appConf)
+	require.NoError(s.T(), err)
+	time.Sleep(2 * time.Second) // Wait for the app config cache to clear
+
 	var createTeamResp teamResponse
 	s.DoJSON("POST", "/api/latest/fleet/teams", &fleet.Team{
 		Name: t.Name(),
@@ -10432,7 +11526,8 @@ func (s *integrationEnterpriseTestSuite) TestSoftwareInstallerHostRequests() {
 
 	var resp installSoftwareResponse
 	// non-existent host
-	s.DoJSON("POST", "/api/latest/fleet/hosts/1/software/install/1", nil, http.StatusNotFound, &resp)
+	s.DoJSON("POST", "/api/latest/fleet/hosts/1/software/1/install", nil, http.StatusNotFound, &resp)
+	s.DoJSON("POST", "/api/latest/fleet/hosts/1/software/1/uninstall", nil, http.StatusNotFound, &resp)
 
 	// create a host that doesn't have fleetd installed
 	h, err := s.ds.NewHost(context.Background(), &fleet.Host{
@@ -10452,29 +11547,65 @@ func (s *integrationEnterpriseTestSuite) TestSoftwareInstallerHostRequests() {
 
 	// request fails
 	resp = installSoftwareResponse{}
-	s.DoJSON("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/software/install/1", h.ID), nil, http.StatusUnprocessableEntity, &resp)
+	s.DoJSON("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/software/1/install", h.ID), nil, http.StatusUnprocessableEntity, &resp)
+	s.DoJSON("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/software/1/uninstall", h.ID), nil, http.StatusUnprocessableEntity, &resp)
 
 	// host installs fleetd
-	setOrbitEnrollment(t, h, s.ds)
+	orbitKey := setOrbitEnrollment(t, h, s.ds)
+	h.OrbitNodeKey = &orbitKey
 
 	// request fails because of non-existent title
 	resp = installSoftwareResponse{}
-	s.DoJSON("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/software/install/1", h.ID), nil, http.StatusBadRequest, &resp)
+	s.DoJSON("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/software/1/install", h.ID), nil, http.StatusBadRequest, &resp)
+	s.DoJSON("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/software/1/uninstall", h.ID), nil, http.StatusBadRequest, &resp)
 
 	payload := &fleet.UploadSoftwareInstallerPayload{
 		InstallScript:     "another install script",
 		PreInstallQuery:   "another pre install query",
 		PostInstallScript: "another post install script",
+		UninstallScript:   "another uninstall script with $PACKAGE_ID",
 		Filename:          "ruby.deb",
 		Title:             "ruby",
 		TeamID:            teamID,
 	}
 	s.uploadSoftwareInstaller(payload, http.StatusOK, "")
+	titleID := getSoftwareTitleID(t, s.ds, payload.Title, "deb_packages")
+
+	// Get title with software installer
+	respTitle := getSoftwareTitleResponse{}
+	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/software/titles/%d", titleID), nil, http.StatusOK, &respTitle, "team_id",
+		fmt.Sprintf("%d", *teamID))
+	require.NotNil(t, respTitle.SoftwareTitle.SoftwarePackage)
+	assert.Equal(t, "another install script", respTitle.SoftwareTitle.SoftwarePackage.InstallScript)
+	assert.Equal(t, `another uninstall script with "ruby"`, respTitle.SoftwareTitle.SoftwarePackage.UninstallScript)
+
+	// Upload another package for another platform
+	payloadDummy := &fleet.UploadSoftwareInstallerPayload{
+		Filename: "dummy_installer.pkg",
+		Title:    "DummyApp.app",
+		TeamID:   teamID,
+	}
+	s.uploadSoftwareInstaller(payloadDummy, http.StatusOK, "")
+	pkgTitleID := getSoftwareTitleID(t, s.ds, payloadDummy.Title, "apps")
+	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/software/titles/%d", pkgTitleID), nil, http.StatusOK, &respTitle, "team_id",
+		fmt.Sprintf("%d", *teamID))
+	require.NotNil(t, respTitle.SoftwareTitle.SoftwarePackage)
+	assert.NotEmpty(t, respTitle.SoftwareTitle.SoftwarePackage.InstallScript)
+	assert.NotEmpty(t, respTitle.SoftwareTitle.SoftwarePackage.UninstallScript)
+	assert.NotContains(t, respTitle.SoftwareTitle.SoftwarePackage.UninstallScript, "$PACKAGE_ID")
+	assert.Contains(t, respTitle.SoftwareTitle.SoftwarePackage.UninstallScript, "com.example.dummy")
+
+	// install/uninstall request fails for the wrong platform
+	s.DoJSON("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/software/%d/install", h.ID, pkgTitleID), nil, http.StatusBadRequest, &resp)
+	s.DoJSON("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/software/%d/uninstall", h.ID, pkgTitleID), nil, http.StatusBadRequest, &resp)
+
+	// delete software installer which we will not use
+	s.Do("DELETE", fmt.Sprintf("/api/latest/fleet/software/titles/%d/available_for_install", pkgTitleID), nil, http.StatusNoContent,
+		"team_id", fmt.Sprintf("%d", *teamID))
 
 	// install script request succeeds
-	titleID := getSoftwareTitleID(t, s.ds, payload.Title, "deb_packages")
 	resp = installSoftwareResponse{}
-	s.DoJSON("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/software/install/%d", h.ID, titleID), nil, http.StatusAccepted, &resp)
+	s.DoJSON("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/software/%d/install", h.ID, titleID), nil, http.StatusAccepted, &resp)
 
 	// Get the results, should be pending
 	getHostSoftwareResp := getHostSoftwareResponse{}
@@ -10483,16 +11614,21 @@ func (s *integrationEnterpriseTestSuite) TestSoftwareInstallerHostRequests() {
 	require.NotNil(t, getHostSoftwareResp.Software[0].SoftwarePackage)
 	require.NotNil(t, getHostSoftwareResp.Software[0].SoftwarePackage.LastInstall)
 	require.NotNil(t, getHostSoftwareResp.Software[0].Status)
-	require.Equal(t, fleet.SoftwareInstallerPending, *getHostSoftwareResp.Software[0].Status)
+	require.Equal(t, fleet.SoftwareInstallPending, *getHostSoftwareResp.Software[0].Status)
+	assert.Nil(t, getHostSoftwareResp.Software[0].SoftwarePackage.LastUninstall)
 	installUUID := getHostSoftwareResp.Software[0].SoftwarePackage.LastInstall.InstallUUID
 
 	gsirr := getSoftwareInstallResultsResponse{}
-	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/software/install/results/%s", installUUID), nil, http.StatusOK, &gsirr)
+	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/software/install/%s/results", installUUID), nil, http.StatusOK, &gsirr)
 	require.NoError(t, gsirr.Err)
 	require.NotNil(t, gsirr.Results)
 	results := gsirr.Results
 	require.Equal(t, installUUID, results.InstallUUID)
-	require.Equal(t, fleet.SoftwareInstallerPending, results.Status)
+	require.Equal(t, fleet.SoftwareInstallPending, results.Status)
+
+	// Can't install/uninstall if software install is pending
+	s.DoJSON("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/software/%d/install", h.ID, titleID), nil, http.StatusBadRequest, &resp)
+	s.DoJSON("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/software/%d/uninstall", h.ID, titleID), nil, http.StatusBadRequest, &resp)
 
 	// create 3 more hosts, will have statuses installed, failed and one with two
 	// install requests - one failed and the latest install pending
@@ -10502,7 +11638,7 @@ func (s *integrationEnterpriseTestSuite) TestSoftwareInstallerHostRequests() {
 	err = s.ds.AddHostsToTeam(context.Background(), teamID, []uint{h2.ID, h3.ID, h4.ID})
 	require.NoError(t, err)
 
-	s.DoJSON("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/software/install/%d", h2.ID, titleID), nil, http.StatusAccepted, &resp)
+	s.DoJSON("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/software/%d/install", h2.ID, titleID), nil, http.StatusAccepted, &resp)
 	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/hosts/%d/software", h2.ID), nil, http.StatusOK, &getHostSoftwareResp)
 	require.Len(t, getHostSoftwareResp.Software, 1)
 	installUUID2 := getHostSoftwareResp.Software[0].SoftwarePackage.LastInstall.InstallUUID
@@ -10514,7 +11650,7 @@ func (s *integrationEnterpriseTestSuite) TestSoftwareInstallerHostRequests() {
 			"install_script_output": "ok"
 		}`, *h2.OrbitNodeKey, installUUID2)), http.StatusNoContent)
 
-	s.DoJSON("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/software/install/%d", h3.ID, titleID), nil, http.StatusAccepted, &resp)
+	s.DoJSON("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/software/%d/install", h3.ID, titleID), nil, http.StatusAccepted, &resp)
 	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/hosts/%d/software", h3.ID), nil, http.StatusOK, &getHostSoftwareResp)
 	require.Len(t, getHostSoftwareResp.Software, 1)
 	installUUID3 := getHostSoftwareResp.Software[0].SoftwarePackage.LastInstall.InstallUUID
@@ -10526,7 +11662,7 @@ func (s *integrationEnterpriseTestSuite) TestSoftwareInstallerHostRequests() {
 			"install_script_output": "failed"
 		}`, *h3.OrbitNodeKey, installUUID3)), http.StatusNoContent)
 
-	s.DoJSON("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/software/install/%d", h4.ID, titleID), nil, http.StatusAccepted, &resp)
+	s.DoJSON("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/software/%d/install", h4.ID, titleID), nil, http.StatusAccepted, &resp)
 	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/hosts/%d/software", h4.ID), nil, http.StatusOK, &getHostSoftwareResp)
 	require.Len(t, getHostSoftwareResp.Software, 1)
 	installUUID4a := getHostSoftwareResp.Software[0].SoftwarePackage.LastInstall.InstallUUID
@@ -10536,7 +11672,7 @@ func (s *integrationEnterpriseTestSuite) TestSoftwareInstallerHostRequests() {
 			"pre_install_condition_output": ""
 		}`, *h4.OrbitNodeKey, installUUID4a)), http.StatusNoContent)
 
-	s.DoJSON("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/software/install/%d", h4.ID, titleID), nil, http.StatusAccepted, &resp)
+	s.DoJSON("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/software/%d/install", h4.ID, titleID), nil, http.StatusAccepted, &resp)
 	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/hosts/%d/software", h4.ID), nil, http.StatusOK, &getHostSoftwareResp)
 	require.Len(t, getHostSoftwareResp.Software, 1)
 	installUUID4b := getHostSoftwareResp.Software[0].SoftwarePackage.LastInstall.InstallUUID
@@ -10552,9 +11688,9 @@ func (s *integrationEnterpriseTestSuite) TestSoftwareInstallerHostRequests() {
 	require.Equal(t, "ruby.deb", titleResp.SoftwareTitle.SoftwarePackage.Name)
 	require.NotNil(t, titleResp.SoftwareTitle.SoftwarePackage.Status)
 	require.Equal(t, fleet.SoftwareInstallerStatusSummary{
-		Installed: 1,
-		Pending:   2,
-		Failed:    1,
+		Installed:      1,
+		PendingInstall: 2,
+		FailedInstall:  1,
 	}, *titleResp.SoftwareTitle.SoftwarePackage.Status)
 
 	// status is reflected in list hosts responses and counts when filtering by software title and status
@@ -10620,7 +11756,145 @@ func (s *integrationEnterpriseTestSuite) TestSoftwareInstallerHostRequests() {
 	r = s.Do("GET", "/api/latest/fleet/hosts", nil, http.StatusBadRequest, "software_status", "installed", "team_id", "1", "software_title_id", "1", "software_id", "1")
 	require.Contains(t, extractServerErrorText(r.Body), "Invalid parameters. The combination of software_id and software_title_id is not allowed.")
 
-	// Access software install result after host is deleted
+	// Return installed app with software detail query
+	distributedReq := submitDistributedQueryResultsRequestShim{
+		NodeKey: *h2.NodeKey,
+		Results: map[string]json.RawMessage{
+			hostDetailQueryPrefix + "software_linux": json.RawMessage(fmt.Sprintf(
+				`[{"name": "%s", "version": "1.0", "type": "Package (deb)",
+					"source": "deb_packages", "last_opened_at": "",
+					"installed_path": "/bin/ruby"}]`, payload.Title)),
+		},
+		Statuses: map[string]interface{}{
+			hostDistributedQueryPrefix + "software_linux": 0,
+		},
+		Messages: map[string]string{},
+		Stats:    map[string]*fleet.Stats{},
+	}
+	distributedResp := submitDistributedQueryResultsResponse{}
+	s.DoJSON("POST", "/api/osquery/distributed/write", distributedReq, http.StatusOK, &distributedResp)
+	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/hosts/%d/software", h2.ID), nil, http.StatusOK, &getHostSoftwareResp)
+	require.Len(t, getHostSoftwareResp.Software, 1)
+	assert.NotNil(t, getHostSoftwareResp.Software[0].Status)
+	assert.NotNil(t, getHostSoftwareResp.Software[0].SoftwarePackage.LastInstall)
+	assert.NotEmpty(t, getHostSoftwareResp.Software[0].InstalledVersions, "Installed versions should exist")
+
+	// Remove the installed app by not returning it
+	distributedReq = submitDistributedQueryResultsRequestShim{
+		NodeKey: *h2.NodeKey,
+		Results: map[string]json.RawMessage{
+			hostDetailQueryPrefix + "software_linux": json.RawMessage(`[]`),
+		},
+		Statuses: map[string]interface{}{
+			hostDistributedQueryPrefix + "software_linux": 0,
+		},
+		Messages: map[string]string{},
+		Stats:    map[string]*fleet.Stats{},
+	}
+	distributedResp = submitDistributedQueryResultsResponse{}
+	s.DoJSON("POST", "/api/osquery/distributed/write", distributedReq, http.StatusOK, &distributedResp)
+
+	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/hosts/%d/software", h2.ID), nil, http.StatusOK, &getHostSoftwareResp)
+	require.Len(t, getHostSoftwareResp.Software, 1)
+	assert.Nil(t, getHostSoftwareResp.Software[0].Status)
+	assert.Nil(t, getHostSoftwareResp.Software[0].SoftwarePackage.LastInstall)
+	assert.Empty(t, getHostSoftwareResp.Software[0].InstalledVersions, "Installed versions should now not exist")
+
+	// Mark original install successful
+	s.Do("POST", "/api/fleet/orbit/software_install/result", json.RawMessage(fmt.Sprintf(`{
+			"orbit_node_key": %q,
+			"install_uuid": %q,
+			"pre_install_condition_output": "ok",
+			"install_script_exit_code": 0,
+			"install_script_output": "ok"
+		}`, *h.OrbitNodeKey, installUUID)), http.StatusNoContent)
+
+	// Do uninstall
+	s.DoJSON("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/software/%d/uninstall", h.ID, titleID), nil, http.StatusAccepted, &resp)
+	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/hosts/%d/software", h.ID), nil, http.StatusOK, &getHostSoftwareResp)
+	require.Len(t, getHostSoftwareResp.Software, 1)
+	assert.NotNil(t, getHostSoftwareResp.Software[0].SoftwarePackage.LastInstall)
+	assert.Equal(t, fleet.SoftwareUninstallPending, *getHostSoftwareResp.Software[0].Status)
+	require.NotNil(t, getHostSoftwareResp.Software[0].SoftwarePackage.LastUninstall)
+	uninstallExecutionID := getHostSoftwareResp.Software[0].SoftwarePackage.LastUninstall.ExecutionID
+
+	// Uninstall should show up as a pending activity
+	var listUpcomingAct listHostUpcomingActivitiesResponse
+	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/hosts/%d/activities/upcoming", h.ID), nil, http.StatusOK, &listUpcomingAct)
+	require.Len(t, listUpcomingAct.Activities, 1)
+	assert.Equal(t, fleet.ActivityTypeUninstalledSoftware{}.ActivityName(), listUpcomingAct.Activities[0].Type)
+	details := make(map[string]interface{}, 5)
+	require.NoError(t, json.Unmarshal(*listUpcomingAct.Activities[0].Details, &details))
+	assert.EqualValues(t, fleet.SoftwareUninstallPending, details["status"])
+
+	// Check that status is reflected in software title response
+	titleResp = getSoftwareTitleResponse{}
+	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/software/titles/%d", titleID), nil, http.StatusOK, &titleResp, "team_id",
+		strconv.Itoa(int(*teamID)))
+	require.NotNil(t, titleResp.SoftwareTitle.SoftwarePackage)
+	assert.Equal(t, "ruby.deb", titleResp.SoftwareTitle.SoftwarePackage.Name)
+	require.NotNil(t, titleResp.SoftwareTitle.SoftwarePackage.Status)
+	assert.Equal(t, fleet.SoftwareInstallerStatusSummary{
+		PendingInstall:   1,
+		FailedInstall:    1,
+		PendingUninstall: 1,
+	}, *titleResp.SoftwareTitle.SoftwarePackage.Status)
+
+	// Another install/uninstall cannot be send once an uninstall is pending
+	s.DoJSON("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/software/%d/install", h.ID, titleID), nil, http.StatusBadRequest, &resp)
+	s.DoJSON("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/software/%d/uninstall", h.ID, titleID), nil, http.StatusBadRequest, &resp)
+
+	// Host sends successful uninstall result
+	var orbitPostScriptResp orbitPostScriptResultResponse
+	s.DoJSON("POST", "/api/fleet/orbit/scripts/result",
+		json.RawMessage(fmt.Sprintf(`{"orbit_node_key": %q, "execution_id": %q, "exit_code": 0, "output": "ok"}`, *h.OrbitNodeKey,
+			uninstallExecutionID)),
+		http.StatusOK, &orbitPostScriptResp)
+
+	// Check activity feed
+	var activitiesResp listActivitiesResponse
+	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/hosts/%d/activities", h.ID), nil, http.StatusOK, &activitiesResp, "order_key", "a.id",
+		"order_direction", "desc")
+	require.NotEmpty(t, activitiesResp.Activities)
+	assert.Equal(t, fleet.ActivityTypeUninstalledSoftware{}.ActivityName(), activitiesResp.Activities[0].Type)
+	details = make(map[string]interface{}, 5)
+	require.NoError(t, json.Unmarshal(*activitiesResp.Activities[0].Details, &details))
+	assert.Equal(t, "uninstalled", details["status"])
+
+	// Software should be available for install again
+	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/hosts/%d/software", h.ID), nil, http.StatusOK, &getHostSoftwareResp)
+	require.Len(t, getHostSoftwareResp.Software, 1)
+	assert.NotNil(t, getHostSoftwareResp.Software[0].SoftwarePackage.LastInstall)
+	require.NotNil(t, getHostSoftwareResp.Software[0].SoftwarePackage.LastUninstall)
+	assert.Nil(t, getHostSoftwareResp.Software[0].Status)
+
+	// Uninstall again, but this time with a failed result
+	beforeUninstall := time.Now()
+	// Since host_script_results does not use fine-grained timestamps yet, we adjust
+	beforeUninstall = beforeUninstall.Add(-time.Second)
+	s.DoJSON("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/software/%d/uninstall", h.ID, titleID), nil, http.StatusAccepted, &resp)
+	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/hosts/%d/software", h.ID), nil, http.StatusOK, &getHostSoftwareResp)
+	require.Len(t, getHostSoftwareResp.Software, 1)
+	assert.NotNil(t, getHostSoftwareResp.Software[0].SoftwarePackage.LastInstall)
+	assert.Equal(t, fleet.SoftwareUninstallPending, *getHostSoftwareResp.Software[0].Status)
+	require.NotNil(t, getHostSoftwareResp.Software[0].SoftwarePackage.LastUninstall)
+	uninstallExecutionID = getHostSoftwareResp.Software[0].SoftwarePackage.LastUninstall.ExecutionID
+	// Host sends failed uninstall result
+	s.DoJSON("POST", "/api/fleet/orbit/scripts/result",
+		json.RawMessage(fmt.Sprintf(`{"orbit_node_key": %q, "execution_id": %q, "exit_code": 1, "output": "not ok"}`, *h.OrbitNodeKey,
+			uninstallExecutionID)),
+		http.StatusOK, &orbitPostScriptResp)
+
+	// Check activity feed
+	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/hosts/%d/activities", h.ID), nil, http.StatusOK, &activitiesResp, "order_key", "a.id",
+		"order_direction", "desc")
+	require.NotEmpty(t, activitiesResp.Activities)
+	assert.Equal(t, fleet.ActivityTypeUninstalledSoftware{}.ActivityName(), activitiesResp.Activities[0].Type)
+	details = make(map[string]interface{}, 5)
+	require.NoError(t, json.Unmarshal(*activitiesResp.Activities[0].Details, &details))
+	assert.Equal(t, "failed", details["status"])
+
+	// Access software install/uninstall result after host is deleted
 	err = s.ds.DeleteHost(context.Background(), h.ID)
 	require.NoError(t, err)
 
@@ -10629,12 +11903,21 @@ func (s *integrationEnterpriseTestSuite) TestSoftwareInstallerHostRequests() {
 	require.NotNil(t, instResult.HostDeletedAt)
 
 	gsirr = getSoftwareInstallResultsResponse{}
-	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/software/install/results/%s", installUUID), nil, http.StatusOK, &gsirr)
+	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/software/install/%s/results", installUUID), nil, http.StatusOK, &gsirr)
 	require.NoError(t, gsirr.Err)
 	require.NotNil(t, gsirr.Results)
 	results = gsirr.Results
 	require.Equal(t, installUUID, results.InstallUUID)
-	require.Equal(t, fleet.SoftwareInstallerPending, results.Status)
+	require.Equal(t, fleet.SoftwareInstalled, results.Status)
+
+	var scriptResultResp getScriptResultResponse
+	s.DoJSON("GET", "/api/latest/fleet/scripts/results/"+uninstallExecutionID, nil, http.StatusOK, &scriptResultResp)
+	assert.Equal(t, h.ID, scriptResultResp.HostID)
+	assert.NotEmpty(t, scriptResultResp.ScriptContents)
+	require.NotNil(t, scriptResultResp.ExitCode)
+	assert.EqualValues(t, 1, *scriptResultResp.ExitCode)
+	assert.Equal(t, "not ok", scriptResultResp.Output)
+	assert.Less(t, beforeUninstall, scriptResultResp.CreatedAt)
 }
 
 func (s *integrationEnterpriseTestSuite) TestSelfServiceSoftwareInstall() {
@@ -10686,7 +11969,7 @@ func (s *integrationEnterpriseTestSuite) TestSelfServiceSoftwareInstall() {
 	require.Equal(t, host1.ID, details.HostID)
 	require.Equal(t, details.SoftwareTitle, payloadSS.Title)
 	require.True(t, details.SelfService)
-	require.EqualValues(t, fleet.SoftwareInstallerPending, details.Status)
+	require.EqualValues(t, fleet.SoftwareInstallPending, details.Status)
 	installID := details.InstallUUID
 
 	// record the installation results
@@ -10716,7 +11999,7 @@ func (s *integrationEnterpriseTestSuite) TestSelfServiceSoftwareInstall() {
 	require.Equal(t, host1.ID, details.HostID)
 	require.Equal(t, details.SoftwareTitle, payloadSS.Title)
 	require.True(t, details.SelfService)
-	require.EqualValues(t, fleet.SoftwareInstallerInstalled, details.Status)
+	require.EqualValues(t, fleet.SoftwareInstalled, details.Status)
 }
 
 func (s *integrationEnterpriseTestSuite) TestHostSoftwareInstallResult() {
@@ -10725,7 +12008,7 @@ func (s *integrationEnterpriseTestSuite) TestHostSoftwareInstallResult() {
 
 	host := createOrbitEnrolledHost(t, "linux", "", s.ds)
 
-	// create a software installer and some host install requests
+	// Create software installers and corresponding host install requests.
 	payload := &fleet.UploadSoftwareInstallerPayload{
 		InstallScript:     "install script",
 		PreInstallQuery:   "pre install query",
@@ -10735,6 +12018,24 @@ func (s *integrationEnterpriseTestSuite) TestHostSoftwareInstallResult() {
 	}
 	s.uploadSoftwareInstaller(payload, http.StatusOK, "")
 	titleID := getSoftwareTitleID(t, s.ds, payload.Title, "deb_packages")
+	payload2 := &fleet.UploadSoftwareInstallerPayload{
+		InstallScript:     "install script 2",
+		PreInstallQuery:   "pre install query 2",
+		PostInstallScript: "post install script 2",
+		Filename:          "vim.deb",
+		Title:             "vim",
+	}
+	s.uploadSoftwareInstaller(payload2, http.StatusOK, "")
+	titleID2 := getSoftwareTitleID(t, s.ds, payload2.Title, "deb_packages")
+	payload3 := &fleet.UploadSoftwareInstallerPayload{
+		InstallScript:     "install script 3",
+		PreInstallQuery:   "pre install query 3",
+		PostInstallScript: "post install script 3",
+		Filename:          "emacs.deb",
+		Title:             "emacs",
+	}
+	s.uploadSoftwareInstaller(payload3, http.StatusOK, "")
+	titleID3 := getSoftwareTitleID(t, s.ds, payload3.Title, "deb_packages")
 
 	latestInstallUUID := func() string {
 		var id string
@@ -10745,10 +12046,12 @@ func (s *integrationEnterpriseTestSuite) TestHostSoftwareInstallResult() {
 	}
 
 	// create some install requests for the host
+	beforeInstall := time.Now()
 	installUUIDs := make([]string, 3)
+	titleIDs := []uint{titleID, titleID2, titleID3}
 	for i := 0; i < len(installUUIDs); i++ {
 		resp := installSoftwareResponse{}
-		s.DoJSON("POST", fmt.Sprintf("/api/v1/fleet/hosts/%d/software/install/%d", host.ID, titleID), nil, http.StatusAccepted, &resp)
+		s.DoJSON("POST", fmt.Sprintf("/api/v1/fleet/hosts/%d/software/%d/install", host.ID, titleIDs[i]), nil, http.StatusAccepted, &resp)
 		installUUIDs[i] = latestInstallUUID()
 	}
 
@@ -10762,7 +12065,7 @@ func (s *integrationEnterpriseTestSuite) TestHostSoftwareInstallResult() {
 	}
 	checkResults := func(want result) {
 		var resp getSoftwareInstallResultsResponse
-		s.DoJSON("GET", "/api/v1/fleet/software/install/results/"+want.InstallUUID, nil, http.StatusOK, &resp)
+		s.DoJSON("GET", fmt.Sprintf("/api/v1/fleet/software/install/%s/results", want.InstallUUID), nil, http.StatusOK, &resp)
 
 		assert.Equal(t, want.HostID, resp.Results.HostID)
 		assert.Equal(t, want.InstallUUID, resp.Results.InstallUUID)
@@ -10770,6 +12073,8 @@ func (s *integrationEnterpriseTestSuite) TestHostSoftwareInstallResult() {
 		assert.Equal(t, want.PreInstallQueryOutput, resp.Results.PreInstallQueryOutput)
 		assert.Equal(t, want.Output, resp.Results.Output)
 		assert.Equal(t, want.PostInstallScriptOutput, resp.Results.PostInstallScriptOutput)
+		assert.Less(t, beforeInstall, resp.Results.CreatedAt)
+		assert.Greater(t, time.Now(), resp.Results.CreatedAt)
 	}
 
 	s.Do("POST", "/api/fleet/orbit/software_install/result",
@@ -10784,7 +12089,7 @@ func (s *integrationEnterpriseTestSuite) TestHostSoftwareInstallResult() {
 	checkResults(result{
 		HostID:                host.ID,
 		InstallUUID:           installUUIDs[0],
-		Status:                fleet.SoftwareInstallerFailed,
+		Status:                fleet.SoftwareInstallFailed,
 		PreInstallQueryOutput: ptr.String(fleet.SoftwareInstallerQuerySuccessCopy),
 		Output:                ptr.String(fmt.Sprintf(fleet.SoftwareInstallerInstallFailCopy, "failed")),
 	})
@@ -10794,7 +12099,7 @@ func (s *integrationEnterpriseTestSuite) TestHostSoftwareInstallResult() {
 		SoftwareTitle:   payload.Title,
 		SoftwarePackage: payload.Filename,
 		InstallUUID:     installUUIDs[0],
-		Status:          string(fleet.SoftwareInstallerFailed),
+		Status:          string(fleet.SoftwareInstallFailed),
 	}
 	s.lastActivityMatches(wantAct.ActivityName(), string(jsonMustMarshal(t, wantAct)), 0)
 
@@ -10808,10 +12113,17 @@ func (s *integrationEnterpriseTestSuite) TestHostSoftwareInstallResult() {
 	checkResults(result{
 		HostID:                host.ID,
 		InstallUUID:           installUUIDs[1],
-		Status:                fleet.SoftwareInstallerFailed,
+		Status:                fleet.SoftwareInstallFailed,
 		PreInstallQueryOutput: ptr.String(fleet.SoftwareInstallerQueryFailCopy),
 	})
-	wantAct.InstallUUID = installUUIDs[1]
+	wantAct = fleet.ActivityTypeInstalledSoftware{
+		HostID:          host.ID,
+		HostDisplayName: host.DisplayName(),
+		SoftwareTitle:   payload2.Title,
+		SoftwarePackage: payload2.Filename,
+		InstallUUID:     installUUIDs[1],
+		Status:          string(fleet.SoftwareInstallFailed),
+	}
 	s.lastActivityOfTypeMatches(wantAct.ActivityName(), string(jsonMustMarshal(t, wantAct)), 0)
 
 	s.Do("POST", "/api/fleet/orbit/software_install/result",
@@ -10828,13 +12140,19 @@ func (s *integrationEnterpriseTestSuite) TestHostSoftwareInstallResult() {
 	checkResults(result{
 		HostID:                  host.ID,
 		InstallUUID:             installUUIDs[2],
-		Status:                  fleet.SoftwareInstallerInstalled,
+		Status:                  fleet.SoftwareInstalled,
 		PreInstallQueryOutput:   ptr.String(fleet.SoftwareInstallerQuerySuccessCopy),
 		Output:                  ptr.String(fmt.Sprintf(fleet.SoftwareInstallerInstallSuccessCopy, "success")),
 		PostInstallScriptOutput: ptr.String(fmt.Sprintf(fleet.SoftwareInstallerPostInstallSuccessCopy, "ok")),
 	})
-	wantAct.InstallUUID = installUUIDs[2]
-	wantAct.Status = string(fleet.SoftwareInstallerInstalled)
+	wantAct = fleet.ActivityTypeInstalledSoftware{
+		HostID:          host.ID,
+		HostDisplayName: host.DisplayName(),
+		SoftwareTitle:   payload3.Title,
+		SoftwarePackage: payload3.Filename,
+		InstallUUID:     installUUIDs[2],
+		Status:          string(fleet.SoftwareInstalled),
+	}
 	lastActID := s.lastActivityOfTypeMatches(wantAct.ActivityName(), string(jsonMustMarshal(t, wantAct)), 0)
 
 	// non-existing installation uuid
@@ -10952,7 +12270,11 @@ func (s *integrationEnterpriseTestSuite) TestHostScriptSoftDelete() {
 	require.EqualValues(t, 0, *scriptRes.ExitCode)
 }
 
-func (s *integrationEnterpriseTestSuite) uploadSoftwareInstaller(payload *fleet.UploadSoftwareInstallerPayload, expectedStatus int, expectedError string) {
+func (s *integrationEnterpriseTestSuite) uploadSoftwareInstaller(
+	payload *fleet.UploadSoftwareInstallerPayload,
+	expectedStatus int,
+	expectedError string,
+) {
 	t := s.T()
 	t.Helper()
 	openFile := func(name string) *os.File {
@@ -10984,6 +12306,7 @@ func (s *integrationEnterpriseTestSuite) uploadSoftwareInstaller(payload *fleet.
 	require.NoError(t, w.WriteField("install_script", payload.InstallScript))
 	require.NoError(t, w.WriteField("pre_install_query", payload.PreInstallQuery))
 	require.NoError(t, w.WriteField("post_install_script", payload.PostInstallScript))
+	require.NoError(t, w.WriteField("uninstall_script", payload.UninstallScript))
 	if payload.SelfService {
 		require.NoError(t, w.WriteField("self_service", "true"))
 	}
@@ -10997,6 +12320,8 @@ func (s *integrationEnterpriseTestSuite) uploadSoftwareInstaller(payload *fleet.
 	}
 
 	r := s.DoRawWithHeaders("POST", "/api/latest/fleet/software/package", b.Bytes(), expectedStatus, headers)
+	defer r.Body.Close()
+
 	if expectedError != "" {
 		errMsg := extractServerErrorText(r.Body)
 		require.Contains(t, errMsg, expectedError)
@@ -11320,6 +12645,21 @@ func (s *integrationEnterpriseTestSuite) TestPKGNewSoftwareTitleFlow() {
 	)
 }
 
+func (s *integrationEnterpriseTestSuite) TestPKGNoVersion() {
+	t := s.T()
+	ctx := context.Background()
+
+	team, err := s.ds.NewTeam(ctx, &fleet.Team{Name: t.Name() + "team1"})
+	require.NoError(t, err)
+
+	payload := &fleet.UploadSoftwareInstallerPayload{
+		InstallScript: "some installer script",
+		Filename:      "no_version.pkg",
+		TeamID:        &team.ID,
+	}
+	s.uploadSoftwareInstaller(payload, http.StatusBadRequest, "Couldn't add. Fleet couldn't read the version from no_version.pkg.")
+}
+
 // 1. host reports software
 // 2. reconciler runs, creates title
 // 3. installer is uploaded, matches existing software title
@@ -11659,11 +12999,15 @@ func (s *integrationEnterpriseTestSuite) TestCalendarCallback() {
 	require.NotZero(t, event.StartTime)
 	require.NotZero(t, event.EndTime)
 	require.NotEmpty(t, event.UUID)
+	bodyTag := event.GetBodyTag()
+	assert.NotEmpty(t, bodyTag)
 	assert.Equal(t, 1, calendar.MockChannelsCount())
 
 	// Get channel ID
 	type eventDetails struct {
 		ChannelID string `json:"channel_id"`
+		BodyTag   string `json:"body_tag"`
+		ETag      string `json:"etag"`
 	}
 	var details eventDetails
 	err = json.Unmarshal(event.Data, &details)
@@ -11693,7 +13037,7 @@ func (s *integrationEnterpriseTestSuite) TestCalendarCallback() {
 	// Grab the distributed lock for this event
 	distributedLock := redis_lock.NewLock(s.redisPool)
 	lockValue := uuid.New().String()
-	result, err := distributedLock.AcquireLock(ctx, commonCalendar.LockKeyPrefix+event.UUID, lockValue, 0)
+	result, err := distributedLock.SetIfNotExist(ctx, commonCalendar.LockKeyPrefix+event.UUID, lockValue, 0)
 	require.NoError(t, err)
 	assert.NotEmpty(t, result)
 
@@ -11717,7 +13061,7 @@ func (s *integrationEnterpriseTestSuite) TestCalendarCallback() {
 	ok, err := distributedLock.ReleaseLock(ctx, commonCalendar.LockKeyPrefix+event.UUID, lockValue)
 	require.NoError(t, err)
 	assert.True(t, ok)
-	result, err = distributedLock.AcquireLock(ctx, commonCalendar.ReservedLockKeyPrefix+event.UUID, lockValue, 0)
+	result, err = distributedLock.SetIfNotExist(ctx, commonCalendar.ReservedLockKeyPrefix+event.UUID, lockValue, 0)
 	require.NoError(t, err)
 	assert.NotEmpty(t, result)
 
@@ -11735,7 +13079,7 @@ func (s *integrationEnterpriseTestSuite) TestCalendarCallback() {
 
 	// We grab the normal lock again.
 	lockValue2 := uuid.New().String()
-	result, err = distributedLock.AcquireLock(ctx, commonCalendar.LockKeyPrefix+event.UUID, lockValue2, 0)
+	result, err = distributedLock.SetIfNotExist(ctx, commonCalendar.LockKeyPrefix+event.UUID, lockValue2, 0)
 	require.NoError(t, err)
 	assert.NotEmpty(t, result)
 	// We release the reserve lock.
@@ -11786,6 +13130,8 @@ func (s *integrationEnterpriseTestSuite) TestCalendarCallback() {
 
 	err = json.Unmarshal(eventRecreated.Data, &details)
 	require.NoError(t, err)
+	assert.NotEmpty(t, details.BodyTag)
+	bodyTag = details.BodyTag
 
 	// New event callback should work
 	_ = s.DoRawWithHeaders("POST", "/api/v1/fleet/calendar/webhook/"+eventRecreated.UUID, []byte(""), http.StatusOK,
@@ -11822,6 +13168,30 @@ func (s *integrationEnterpriseTestSuite) TestCalendarCallback() {
 	assert.Greater(t, eventUpdated.StartTime, eventRecreated.StartTime)
 	assert.Equal(t, eventRecreated.EndTime, eventUpdated.EndTime)
 	assert.Equal(t, 1, calendar.MockChannelsCount())
+	assert.Equal(t, bodyTag, eventRecreated.GetBodyTag())
+
+	// Change the body contents of event.
+	events = calendar.ListGoogleMockEvents()
+	require.Len(t, events, 1)
+	eTag := "description change etag"
+	for _, e := range events {
+		e.Etag = eTag
+		e.Description = "new description"
+	}
+	// New event callback should cause Etag to update but Body tag to remain the same
+	_ = s.DoRawWithHeaders("POST", "/api/v1/fleet/calendar/webhook/"+eventRecreated.UUID, []byte(""), http.StatusOK,
+		map[string]string{
+			"X-Goog-Channel-Id":     details.ChannelID,
+			"X-Goog-Resource-State": "exists",
+		})
+	team1CalendarEvents, err = s.ds.ListCalendarEvents(ctx, &team1.ID)
+	require.NoError(t, err)
+	require.Len(t, team1CalendarEvents, 1)
+	eventDescUpdated := team1CalendarEvents[0]
+	err = json.Unmarshal(eventDescUpdated.Data, &details)
+	require.NoError(t, err)
+	assert.Equal(t, bodyTag, details.BodyTag)
+	assert.Equal(t, eTag, details.ETag)
 
 	// Update the time of the event again
 	events = calendar.ListGoogleMockEvents()
@@ -11831,12 +13201,13 @@ func (s *integrationEnterpriseTestSuite) TestCalendarCallback() {
 		require.NoError(t, err)
 		newStartTime := st.Add(5 * time.Minute).Format(time.RFC3339)
 		e.Start.DateTime = newStartTime
+		e.Etag = e.Etag + "1"
 	}
 
 	// Grab the lock
 	event = eventUpdated
 	lockValue = uuid.New().String()
-	result, err = distributedLock.AcquireLock(ctx, commonCalendar.LockKeyPrefix+event.UUID, lockValue, 0)
+	result, err = distributedLock.SetIfNotExist(ctx, commonCalendar.LockKeyPrefix+event.UUID, lockValue, 0)
 	require.NoError(t, err)
 	assert.NotEmpty(t, result)
 
@@ -11881,6 +13252,9 @@ func (s *integrationEnterpriseTestSuite) TestCalendarCallback() {
 			require.NoError(t, err)
 			if len(team1CalendarEvents) == 1 && team1CalendarEvents[0].UUID == event.UUID &&
 				team1CalendarEvents[0].StartTime.After(event.StartTime) {
+				err = json.Unmarshal(team1CalendarEvents[0].Data, &details)
+				require.NoError(t, err)
+				assert.NotEqual(t, eTag, details.ETag, "ETag should have updated")
 				done <- struct{}{}
 				return
 			}
@@ -11906,7 +13280,7 @@ func (s *integrationEnterpriseTestSuite) TestCalendarCallback() {
 	), http.StatusOK, &distributedResp)
 
 	// We set a flag that event was updated recently. Callback shouldn't do anything since event was updated recently
-	_, err = distributedLock.AcquireLock(ctx, commonCalendar.RecentUpdateKeyPrefix+event.UUID, commonCalendar.RecentCalendarUpdateValue,
+	_, err = distributedLock.SetIfNotExist(ctx, commonCalendar.RecentUpdateKeyPrefix+event.UUID, commonCalendar.RecentCalendarUpdateValue,
 		1000)
 	require.NoError(t, err)
 	_ = s.DoRawWithHeaders("POST", "/api/v1/fleet/calendar/webhook/"+eventRecreated.UUID, []byte(""), http.StatusOK,
@@ -12243,7 +13617,6 @@ func (s *integrationEnterpriseTestSuite) TestCalendarEventBodyUpdate() {
 	require.Len(t, calEvents, 1)
 	assert.Contains(t, calEvents[0].Description, fleet.CalendarDefaultDescription)
 	assert.Contains(t, calEvents[0].Description, fleet.CalendarDefaultResolution)
-
 }
 
 func (s *integrationEnterpriseTestSuite) TestVPPAppsWithoutMDM() {
@@ -12253,6 +13626,8 @@ func (s *integrationEnterpriseTestSuite) TestVPPAppsWithoutMDM() {
 	// Create host
 	orbitHost := createOrbitEnrolledHost(t, "darwin", "nonmdm", s.ds)
 
+	test.CreateInsertGlobalVPPToken(t, s.ds)
+
 	// Create team and add host to team
 	var newTeamResp teamResponse
 	s.DoJSON("POST", "/api/latest/fleet/teams", &createTeamRequest{TeamPayload: fleet.TeamPayload{Name: ptr.String("Team 1")}}, http.StatusOK, &newTeamResp)
@@ -12264,13 +13639,730 @@ func (s *integrationEnterpriseTestSuite) TestVPPAppsWithoutMDM() {
 	app, err := s.ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{
 		Name:             "App " + t.Name(),
 		BundleIdentifier: "bid_" + t.Name(),
-		VPPAppID: fleet.VPPAppID{
-			AdamID:   "adam_" + t.Name(),
-			Platform: fleet.MacOSPlatform,
+		VPPAppTeam: fleet.VPPAppTeam{
+			VPPAppID: fleet.VPPAppID{
+				AdamID:   "adam_" + t.Name(),
+				Platform: fleet.MacOSPlatform,
+			},
 		},
 	}, &team.ID)
 	require.NoError(t, err)
 
-	r := s.Do("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/software/install/%d", orbitHost.ID, app.TitleID), &installSoftwareRequest{}, http.StatusUnprocessableEntity)
+	r := s.Do("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/software/%d/install", orbitHost.ID, app.TitleID), &installSoftwareRequest{},
+		http.StatusUnprocessableEntity)
 	require.Contains(t, extractServerErrorText(r.Body), "Couldn't install. MDM is turned off. Please make sure that MDM is turned on to install App Store apps.")
 }
+
+func (s *integrationEnterpriseTestSuite) TestPolicyAutomationsSoftwareInstallers() {
+	t := s.T()
+	ctx := context.Background()
+	test.CreateInsertGlobalVPPToken(t, s.ds)
+
+	team1, err := s.ds.NewTeam(ctx, &fleet.Team{Name: t.Name() + "team1"})
+	require.NoError(t, err)
+	team2, err := s.ds.NewTeam(ctx, &fleet.Team{Name: t.Name() + "team2"})
+	require.NoError(t, err)
+
+	newHost := func(name string, teamID *uint, platform string) *fleet.Host {
+		h, err := s.ds.NewHost(ctx, &fleet.Host{
+			DetailUpdatedAt: time.Now(),
+			LabelUpdatedAt:  time.Now(),
+			PolicyUpdatedAt: time.Now(),
+			SeenTime:        time.Now().Add(-1 * time.Minute),
+			OsqueryHostID:   ptr.String(t.Name() + name),
+			NodeKey:         ptr.String(t.Name() + name),
+			UUID:            uuid.New().String(),
+			Hostname:        fmt.Sprintf("%s.%s.local", name, t.Name()),
+			Platform:        platform,
+			TeamID:          teamID,
+		})
+		require.NoError(t, err)
+		return h
+	}
+	newFleetdHost := func(name string, teamID *uint, platform string) *fleet.Host {
+		h := newHost(name, teamID, platform)
+		orbitKey := setOrbitEnrollment(t, h, s.ds)
+		h.OrbitNodeKey = &orbitKey
+		return h
+	}
+
+	host0NoTeam := newFleetdHost("host1NoTeam", nil, "darwin")
+	host1Team1 := newFleetdHost("host1Team1", &team1.ID, "darwin")
+	host2Team1 := newFleetdHost("host2Team1", &team1.ID, "ubuntu")
+	host3Team2 := newFleetdHost("host3Team2", &team2.ID, "windows")
+	hostVanillaOsquery5Team1 := newHost("hostVanillaOsquery5Team2", &team1.ID, "darwin")
+
+	// Upload dummy_installer.pkg to team1.
+	pkgPayload := &fleet.UploadSoftwareInstallerPayload{
+		InstallScript: "some pkg install script",
+		Filename:      "dummy_installer.pkg",
+		TeamID:        &team1.ID,
+	}
+	s.uploadSoftwareInstaller(pkgPayload, http.StatusOK, "")
+	// Get software title ID of the uploaded installer.
+	resp := listSoftwareTitlesResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/titles",
+		listSoftwareTitlesRequest{},
+		http.StatusOK, &resp,
+		"query", "DummyApp.app",
+		"team_id", fmt.Sprintf("%d", team1.ID),
+	)
+	require.Len(t, resp.SoftwareTitles, 1)
+	require.NotNil(t, resp.SoftwareTitles[0].SoftwarePackage)
+	dummyInstallerPkgTitleID := resp.SoftwareTitles[0].ID
+	var dummyInstallerPkg struct {
+		ID        uint   `db:"id"`
+		UserID    *uint  `db:"user_id"`
+		UserName  string `db:"user_name"`
+		UserEmail string `db:"user_email"`
+	}
+	mysql.ExecAdhocSQL(t, s.ds, func(q sqlx.ExtContext) error {
+		return sqlx.GetContext(ctx, q,
+			&dummyInstallerPkg,
+			`SELECT id, user_id, user_name, user_email FROM software_installers WHERE global_or_team_id = ? AND filename = ?`,
+			team1.ID, "dummy_installer.pkg",
+		)
+	})
+	dummyInstallerPkgInstallerID := dummyInstallerPkg.ID
+	require.NotZero(t, dummyInstallerPkgInstallerID)
+	require.NotNil(t, dummyInstallerPkg.UserID)
+	globalAdmin, err := s.ds.UserByEmail(ctx, "admin1@example.com")
+	require.NoError(t, err)
+	require.Equal(t, globalAdmin.ID, *dummyInstallerPkg.UserID)
+	require.Equal(t, "Test Name admin1@example.com", dummyInstallerPkg.UserName)
+	require.Equal(t, "admin1@example.com", dummyInstallerPkg.UserEmail)
+
+	// Upload ruby.deb to team1 by a user who will be deleted.
+	u2 := &fleet.User{
+		Name:       "admin team1",
+		Email:      "admin_team1@example.com",
+		GlobalRole: nil,
+		Teams: []fleet.UserTeam{
+			{
+				Team: *team1,
+				Role: fleet.RoleAdmin,
+			},
+		},
+	}
+	require.NoError(t, u2.SetPassword(test.GoodPassword, 10, 10))
+	adminTeam1, err := s.ds.NewUser(context.Background(), u2)
+	require.NoError(t, err)
+	rubyPayload := &fleet.UploadSoftwareInstallerPayload{
+		InstallScript: "some deb install script",
+		Filename:      "ruby.deb",
+		TeamID:        &team1.ID,
+	}
+	sessionKey := uuid.New().String()
+	adminTeam1Session, err := s.ds.NewSession(ctx, adminTeam1.ID, sessionKey)
+	require.NoError(t, err)
+	adminToken := s.token
+	t.Cleanup(func() {
+		s.token = adminToken
+	})
+	s.token = adminTeam1Session.Key
+	s.uploadSoftwareInstaller(rubyPayload, http.StatusOK, "")
+	s.token = adminToken
+	err = s.ds.DeleteUser(ctx, adminTeam1.ID)
+	require.NoError(t, err)
+	// Get software title ID of the uploaded installer.
+	resp = listSoftwareTitlesResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/titles",
+		listSoftwareTitlesRequest{},
+		http.StatusOK, &resp,
+		"query", "ruby",
+		"team_id", fmt.Sprintf("%d", team1.ID),
+	)
+	require.Len(t, resp.SoftwareTitles, 1)
+	require.NotNil(t, resp.SoftwareTitles[0].SoftwarePackage)
+	rubyDebTitleID := resp.SoftwareTitles[0].ID
+	var rubyDeb struct {
+		ID        uint   `db:"id"`
+		UserID    *uint  `db:"user_id"`
+		UserName  string `db:"user_name"`
+		UserEmail string `db:"user_email"`
+	}
+	mysql.ExecAdhocSQL(t, s.ds, func(q sqlx.ExtContext) error {
+		return sqlx.GetContext(ctx, q,
+			&rubyDeb,
+			`SELECT id, user_id, user_name, user_email FROM software_installers WHERE global_or_team_id = ? AND filename = ?`,
+			team1.ID, "ruby.deb",
+		)
+	})
+	rubyDebInstallerID := rubyDeb.ID
+	require.NotZero(t, rubyDebInstallerID)
+	require.Nil(t, rubyDeb.UserID)
+	require.Equal(t, "admin team1", rubyDeb.UserName)
+	require.Equal(t, "admin_team1@example.com", rubyDeb.UserEmail)
+
+	// Upload fleet-osquery.msi to team2.
+	fleetOsqueryPayload := &fleet.UploadSoftwareInstallerPayload{
+		InstallScript: "some msi install script",
+		Filename:      "fleet-osquery.msi",
+		TeamID:        &team2.ID,
+		// Set as Self-service to check that the generated host_software_installs
+		// is generated with self_service=false and the activity has the correct
+		// author (the admin that uploaded the installer).
+		SelfService: true,
+	}
+	s.uploadSoftwareInstaller(fleetOsqueryPayload, http.StatusOK, "")
+	// Get software title ID of the uploaded installer.
+	resp = listSoftwareTitlesResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/titles",
+		listSoftwareTitlesRequest{},
+		http.StatusOK, &resp,
+		"query", "Fleet osquery",
+		"team_id", fmt.Sprintf("%d", team2.ID),
+	)
+	require.Len(t, resp.SoftwareTitles, 1)
+	require.NotNil(t, resp.SoftwareTitles[0].SoftwarePackage)
+	fleetOsqueryMSITitleID := resp.SoftwareTitles[0].ID
+	var fleetOsqueryMSIInstallerID uint
+	mysql.ExecAdhocSQL(t, s.ds, func(q sqlx.ExtContext) error {
+		return sqlx.GetContext(ctx, q,
+			&fleetOsqueryMSIInstallerID,
+			`SELECT id FROM software_installers WHERE global_or_team_id = ? AND filename = ?`,
+			team2.ID, "fleet-osquery.msi",
+		)
+	})
+	require.NotZero(t, fleetOsqueryMSIInstallerID)
+
+	// Create a VPP app to test that policies cannot be assigned to them.
+	_, err = s.ds.InsertVPPAppWithTeam(ctx, &fleet.VPPApp{
+		Name:             "App123 " + t.Name(),
+		BundleIdentifier: "bid_" + t.Name(),
+		VPPAppTeam: fleet.VPPAppTeam{
+			VPPAppID: fleet.VPPAppID{
+				AdamID:   "adam_" + t.Name(),
+				Platform: fleet.MacOSPlatform,
+			},
+		},
+	}, &team1.ID)
+	require.NoError(t, err)
+	// Get software title ID of the uploaded VPP app.
+	resp = listSoftwareTitlesResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/titles",
+		listSoftwareTitlesRequest{},
+		http.StatusOK, &resp,
+		"query", "App123",
+		"team_id", fmt.Sprintf("%d", team1.ID),
+	)
+	require.Len(t, resp.SoftwareTitles, 1)
+	require.NotNil(t, resp.SoftwareTitles[0].AppStoreApp)
+	vppAppTitleID := resp.SoftwareTitles[0].ID
+
+	// Populate software for host1Team1 (to have a software title
+	// that doesn't have an associated installer)
+	software := []fleet.Software{
+		{Name: "Foobar.app", Version: "0.0.1", Source: "apps"},
+	}
+	_, err = s.ds.UpdateHostSoftware(ctx, host1Team1.ID, software)
+	require.NoError(t, err)
+	require.NoError(t, s.ds.SyncHostsSoftware(ctx, time.Now()))
+	require.NoError(t, s.ds.ReconcileSoftwareTitles(ctx))
+	require.NoError(t, s.ds.SyncHostsSoftwareTitles(ctx, time.Now()))
+	// Get software title ID of the software.
+	resp = listSoftwareTitlesResponse{}
+	s.DoJSON(
+		"GET", "/api/latest/fleet/software/titles",
+		listSoftwareTitlesRequest{},
+		http.StatusOK, &resp,
+		"query", "Foobar.app",
+		"team_id", fmt.Sprintf("%d", team1.ID),
+	)
+	require.Len(t, resp.SoftwareTitles, 1)
+	require.Nil(t, resp.SoftwareTitles[0].SoftwarePackage)
+	foobarAppTitleID := resp.SoftwareTitles[0].ID
+
+	// policy0AllTeams is a global policy that runs on all devices.
+	policy0AllTeams, err := s.ds.NewGlobalPolicy(ctx, nil, fleet.PolicyPayload{
+		Name:     "policy0AllTeams",
+		Query:    "SELECT 1;",
+		Platform: "darwin",
+	})
+	require.NoError(t, err)
+	// policy1Team1 runs on macOS devices.
+	policy1Team1, err := s.ds.NewTeamPolicy(ctx, team1.ID, nil, fleet.PolicyPayload{
+		Name:     "policy1Team1",
+		Query:    "SELECT 1;",
+		Platform: "darwin",
+	})
+	require.NoError(t, err)
+	// policy2Team1 runs on macOS and Linux devices.
+	policy2Team1, err := s.ds.NewTeamPolicy(ctx, team1.ID, nil, fleet.PolicyPayload{
+		Name:     "policy2Team1",
+		Query:    "SELECT 2;",
+		Platform: "linux,darwin",
+	})
+	require.NoError(t, err)
+	// policy3Team1 runs on all devices in team1 (will have no associated installers).
+	policy3Team1, err := s.ds.NewTeamPolicy(ctx, team1.ID, nil, fleet.PolicyPayload{
+		Name:  "policy3Team1",
+		Query: "SELECT 3;",
+	})
+	require.NoError(t, err)
+	// policy4Team2 runs on Windows devices.
+	policy4Team2, err := s.ds.NewTeamPolicy(ctx, team2.ID, nil, fleet.PolicyPayload{
+		Name:     "policy4Team2",
+		Query:    "SELECT 4;",
+		Platform: "windows",
+	})
+	require.NoError(t, err)
+
+	// Attempt to associate to an unknown software title.
+	mtplr := modifyTeamPolicyResponse{}
+	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/teams/%d/policies/%d", team1.ID, policy1Team1.ID), modifyTeamPolicyRequest{
+		ModifyPolicyPayload: fleet.ModifyPolicyPayload{
+			SoftwareTitleID: ptr.Uint(999_999),
+		},
+	}, http.StatusBadRequest, &mtplr)
+	// Attempt to associate to a software title without associated installer.
+	mtplr = modifyTeamPolicyResponse{}
+	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/teams/%d/policies/%d", team1.ID, policy1Team1.ID), modifyTeamPolicyRequest{
+		ModifyPolicyPayload: fleet.ModifyPolicyPayload{
+			SoftwareTitleID: ptr.Uint(foobarAppTitleID),
+		},
+	}, http.StatusBadRequest, &mtplr)
+	// Attempt to associate vppApp to policy1Team1 which should fail because we only allow associating software installers.
+	mtplr = modifyTeamPolicyResponse{}
+	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/teams/%d/policies/%d", team1.ID, policy1Team1.ID), modifyTeamPolicyRequest{
+		ModifyPolicyPayload: fleet.ModifyPolicyPayload{
+			SoftwareTitleID: &vppAppTitleID,
+		},
+	}, http.StatusBadRequest, &mtplr)
+	// Associate dummy_installer.pkg to policy1Team1.
+	mtplr = modifyTeamPolicyResponse{}
+	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/teams/%d/policies/%d", team1.ID, policy1Team1.ID), modifyTeamPolicyRequest{
+		ModifyPolicyPayload: fleet.ModifyPolicyPayload{
+			SoftwareTitleID: &dummyInstallerPkgTitleID,
+		},
+	}, http.StatusOK, &mtplr)
+	// Change name only (to test not setting a software_title_id).
+	mtplr = modifyTeamPolicyResponse{}
+	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/teams/%d/policies/%d", team1.ID, policy1Team1.ID),
+		json.RawMessage(`{"name": "policy1Team1_Renamed"}`), http.StatusOK, &mtplr,
+	)
+	policy1Team1, err = s.ds.Policy(ctx, policy1Team1.ID)
+	require.NoError(t, err)
+	require.NotNil(t, policy1Team1.SoftwareInstallerID)
+	require.Equal(t, dummyInstallerPkgInstallerID, *policy1Team1.SoftwareInstallerID)
+	require.Equal(t, "policy1Team1_Renamed", *&policy1Team1.Name)
+	// Explicit set to 0 to disable.
+	mtplr = modifyTeamPolicyResponse{}
+	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/teams/%d/policies/%d", team1.ID, policy1Team1.ID), modifyTeamPolicyRequest{
+		ModifyPolicyPayload: fleet.ModifyPolicyPayload{
+			SoftwareTitleID: ptr.Uint(0),
+		},
+	}, http.StatusOK, &mtplr)
+	policy1Team1, err = s.ds.Policy(ctx, policy1Team1.ID)
+	require.NoError(t, err)
+	require.Nil(t, policy1Team1.SoftwareInstallerID)
+
+	host1LastInstall, err := s.ds.GetHostLastInstallData(ctx, host1Team1.ID, dummyInstallerPkgInstallerID)
+	require.NoError(t, err)
+	require.Nil(t, host1LastInstall)
+
+	// Add some results and stats that should be cleared after setting an installer again.
+	distributedResp := submitDistributedQueryResultsResponse{}
+	s.DoJSONWithoutAuth("POST", "/api/osquery/distributed/write", genDistributedReqWithPolicyResults(
+		host1Team1,
+		map[uint]*bool{
+			policy1Team1.ID: ptr.Bool(false),
+		},
+	), http.StatusOK, &distributedResp)
+	err = s.ds.UpdateHostPolicyCounts(ctx)
+	require.NoError(t, err)
+	policy1Team1, err = s.ds.Policy(ctx, policy1Team1.ID)
+	require.NoError(t, err)
+	require.Equal(t, uint(0), policy1Team1.PassingHostCount)
+	require.Equal(t, uint(1), policy1Team1.FailingHostCount)
+	passes := true
+	mysql.ExecAdhocSQL(t, s.ds, func(q sqlx.ExtContext) error {
+		return sqlx.GetContext(ctx, q,
+			&passes,
+			`SELECT passes FROM policy_membership WHERE policy_id = ? AND host_id = ?`,
+			policy1Team1.ID, host1Team1.ID,
+		)
+	})
+	require.False(t, passes)
+
+	// Back to associating dummy_installer.pkg to policy1Team1.
+	mtplr = modifyTeamPolicyResponse{}
+	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/teams/%d/policies/%d", team1.ID, policy1Team1.ID), modifyTeamPolicyRequest{
+		ModifyPolicyPayload: fleet.ModifyPolicyPayload{
+			SoftwareTitleID: &dummyInstallerPkgTitleID,
+		},
+	}, http.StatusOK, &mtplr)
+	policy1Team1, err = s.ds.Policy(ctx, policy1Team1.ID)
+	require.NoError(t, err)
+	require.NotNil(t, policy1Team1.SoftwareInstallerID)
+	require.Equal(t, dummyInstallerPkgInstallerID, *policy1Team1.SoftwareInstallerID)
+	// Policy stats and membership should be cleared from policy1Team1.
+	require.Equal(t, uint(0), policy1Team1.PassingHostCount)
+	require.Equal(t, uint(0), policy1Team1.FailingHostCount)
+	countBiggerThanZero := true
+	mysql.ExecAdhocSQL(t, s.ds, func(q sqlx.ExtContext) error {
+		return sqlx.GetContext(ctx, q,
+			&countBiggerThanZero,
+			`SELECT COUNT(*) > 0 FROM policy_membership WHERE policy_id = ?`,
+			policy1Team1.ID,
+		)
+	})
+	require.False(t, countBiggerThanZero)
+
+	// Add (again) some results and stats that should be cleared after changing an existing installer.
+	distributedResp = submitDistributedQueryResultsResponse{}
+	s.DoJSONWithoutAuth("POST", "/api/osquery/distributed/write", genDistributedReqWithPolicyResults(
+		host1Team1,
+		map[uint]*bool{
+			policy1Team1.ID: ptr.Bool(false),
+		},
+	), http.StatusOK, &distributedResp)
+	err = s.ds.UpdateHostPolicyCounts(ctx)
+	require.NoError(t, err)
+	policy1Team1, err = s.ds.Policy(ctx, policy1Team1.ID)
+	require.NoError(t, err)
+	require.Equal(t, uint(0), policy1Team1.PassingHostCount)
+	require.Equal(t, uint(1), policy1Team1.FailingHostCount)
+	passes = true
+	mysql.ExecAdhocSQL(t, s.ds, func(q sqlx.ExtContext) error {
+		return sqlx.GetContext(ctx, q,
+			&passes,
+			`SELECT passes FROM policy_membership WHERE policy_id = ? AND host_id = ?`,
+			policy1Team1.ID, host1Team1.ID,
+		)
+	})
+	require.False(t, passes)
+
+	// Change the installer (temporarily to test that changing an installer will clear results)
+	// Associate ruby.deb to policy1Team1.
+	mtplr = modifyTeamPolicyResponse{}
+	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/teams/%d/policies/%d", team1.ID, policy1Team1.ID), modifyTeamPolicyRequest{
+		ModifyPolicyPayload: fleet.ModifyPolicyPayload{
+			SoftwareTitleID: &rubyDebTitleID,
+		},
+	}, http.StatusOK, &mtplr)
+
+	// After changing the installer, membership and stats should be cleared.
+	policy1Team1, err = s.ds.Policy(ctx, policy1Team1.ID)
+	require.NoError(t, err)
+	require.NotNil(t, policy1Team1.SoftwareInstallerID)
+	require.Equal(t, rubyDebInstallerID, *policy1Team1.SoftwareInstallerID)
+	// Policy stats and membership should be cleared from policy1Team1.
+	require.Equal(t, uint(0), policy1Team1.PassingHostCount)
+	require.Equal(t, uint(0), policy1Team1.FailingHostCount)
+	countBiggerThanZero = true
+	mysql.ExecAdhocSQL(t, s.ds, func(q sqlx.ExtContext) error {
+		return sqlx.GetContext(ctx, q,
+			&countBiggerThanZero,
+			`SELECT COUNT(*) > 0 FROM policy_membership WHERE policy_id = ?`,
+			policy1Team1.ID,
+		)
+	})
+	require.False(t, countBiggerThanZero)
+
+	// Back to (again) associating dummy_installer.pkg to policy1Team1.
+	mtplr = modifyTeamPolicyResponse{}
+	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/teams/%d/policies/%d", team1.ID, policy1Team1.ID), modifyTeamPolicyRequest{
+		ModifyPolicyPayload: fleet.ModifyPolicyPayload{
+			SoftwareTitleID: &dummyInstallerPkgTitleID,
+		},
+	}, http.StatusOK, &mtplr)
+
+	// Associate ruby.deb to policy2Team1.
+	mtplr = modifyTeamPolicyResponse{}
+	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/teams/%d/policies/%d", team1.ID, policy2Team1.ID), modifyTeamPolicyRequest{
+		ModifyPolicyPayload: fleet.ModifyPolicyPayload{
+			SoftwareTitleID: &rubyDebTitleID,
+		},
+	}, http.StatusOK, &mtplr)
+
+	// We use DoJSONWithoutAuth for distributed/write because we want the requests to not have the
+	// current user's "Authorization: Bearer <API_TOKEN>" header.
+
+	// host1Team1 fails all policies on the first report.
+	// Failing policy1Team1 means an install request must be generated.
+	// Failing policy2Team1 should not trigger a install request because it has a .deb attached to it (does not apply to macOS hosts).
+	// Failing policy3Team1 should do nothing because it doesn't have any installers associated to it.
+	distributedResp = submitDistributedQueryResultsResponse{}
+	s.DoJSONWithoutAuth("POST", "/api/osquery/distributed/write", genDistributedReqWithPolicyResults(
+		host1Team1,
+		map[uint]*bool{
+			policy1Team1.ID: ptr.Bool(false),
+			policy2Team1.ID: ptr.Bool(false),
+			policy3Team1.ID: ptr.Bool(false),
+		},
+	), http.StatusOK, &distributedResp)
+
+	host1LastInstall, err = s.ds.GetHostLastInstallData(ctx, host1Team1.ID, dummyInstallerPkgInstallerID)
+	require.NoError(t, err)
+	require.NotNil(t, host1LastInstall)
+	require.NotEmpty(t, host1LastInstall.ExecutionID)
+	require.NotNil(t, host1LastInstall.Status)
+	require.Equal(t, fleet.SoftwareInstallPending, *host1LastInstall.Status)
+	prevExecutionID := host1LastInstall.ExecutionID
+
+	// Request a manual installation on the host for the same installer, which should fail.
+	var installResp installSoftwareResponse
+	s.DoJSON("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/software/%d/install",
+		host1Team1.ID, dummyInstallerPkgTitleID), nil, http.StatusBadRequest, &installResp)
+
+	// Submit same results as before, which should not trigger a installation because the policy is already failing.
+	distributedResp = submitDistributedQueryResultsResponse{}
+	s.DoJSONWithoutAuth("POST", "/api/osquery/distributed/write", genDistributedReqWithPolicyResults(
+		host1Team1,
+		map[uint]*bool{
+			policy1Team1.ID: ptr.Bool(false),
+			policy2Team1.ID: ptr.Bool(false),
+			policy3Team1.ID: ptr.Bool(false),
+		},
+	), http.StatusOK, &distributedResp)
+
+	host1LastInstall, err = s.ds.GetHostLastInstallData(ctx, host1Team1.ID, dummyInstallerPkgInstallerID)
+	require.NoError(t, err)
+	require.NotNil(t, host1LastInstall)
+	require.Equal(t, prevExecutionID, host1LastInstall.ExecutionID)
+	require.NotNil(t, host1LastInstall.Status)
+	require.Equal(t, fleet.SoftwareInstallPending, *host1LastInstall.Status)
+
+	// Submit same results but policy1Team1 now passes,
+	// and then submit again but policy1Team1 fails.
+	distributedResp = submitDistributedQueryResultsResponse{}
+	s.DoJSONWithoutAuth("POST", "/api/osquery/distributed/write", genDistributedReqWithPolicyResults(
+		host1Team1,
+		map[uint]*bool{
+			policy1Team1.ID: ptr.Bool(true),
+			policy2Team1.ID: ptr.Bool(false),
+			policy3Team1.ID: ptr.Bool(false),
+		},
+	), http.StatusOK, &distributedResp)
+	distributedResp = submitDistributedQueryResultsResponse{}
+	s.DoJSONWithoutAuth("POST", "/api/osquery/distributed/write", genDistributedReqWithPolicyResults(
+		host1Team1,
+		map[uint]*bool{
+			policy1Team1.ID: ptr.Bool(false),
+			policy2Team1.ID: ptr.Bool(false),
+			policy3Team1.ID: ptr.Bool(false),
+		},
+	), http.StatusOK, &distributedResp)
+
+	// Another installation should not be triggered because the last installation is pending.
+	host1LastInstall, err = s.ds.GetHostLastInstallData(ctx, host1Team1.ID, dummyInstallerPkgInstallerID)
+	require.NoError(t, err)
+	require.NotNil(t, host1LastInstall)
+	require.Equal(t, prevExecutionID, host1LastInstall.ExecutionID)
+	require.NotNil(t, host1LastInstall.Status)
+	require.Equal(t, fleet.SoftwareInstallPending, *host1LastInstall.Status)
+
+	// host2Team1 is failing policy2Team1 and policy3Team1 policies.
+	distributedResp = submitDistributedQueryResultsResponse{}
+	s.DoJSONWithoutAuth("POST", "/api/osquery/distributed/write", genDistributedReqWithPolicyResults(
+		host2Team1,
+		map[uint]*bool{
+			policy2Team1.ID: ptr.Bool(false),
+			policy3Team1.ID: ptr.Bool(false),
+		},
+	), http.StatusOK, &distributedResp)
+
+	host2LastInstall, err := s.ds.GetHostLastInstallData(ctx, host2Team1.ID, rubyDebInstallerID)
+	require.NoError(t, err)
+	require.NotNil(t, host2LastInstall)
+	require.NotEmpty(t, host2LastInstall.ExecutionID)
+	require.NotNil(t, host2LastInstall.Status)
+	require.Equal(t, fleet.SoftwareInstallPending, *host2LastInstall.Status)
+
+	// Associate fleet-osquery.msi to policy4Team2.
+	mtplr = modifyTeamPolicyResponse{}
+	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/teams/%d/policies/%d", team2.ID, policy4Team2.ID), modifyTeamPolicyRequest{
+		ModifyPolicyPayload: fleet.ModifyPolicyPayload{
+			SoftwareTitleID: &fleetOsqueryMSITitleID,
+		},
+	}, http.StatusOK, &mtplr)
+
+	// host3Team2 reports a failing result for policy4Team2, which should trigger an installation.
+	distributedResp = submitDistributedQueryResultsResponse{}
+	s.DoJSONWithoutAuth("POST", "/api/osquery/distributed/write", genDistributedReqWithPolicyResults(
+		host3Team2,
+		map[uint]*bool{
+			policy4Team2.ID: ptr.Bool(false),
+		},
+	), http.StatusOK, &distributedResp)
+
+	host3LastInstall, err := s.ds.GetHostLastInstallData(ctx, host3Team2.ID, fleetOsqueryMSIInstallerID)
+	require.NoError(t, err)
+	require.NotNil(t, host3LastInstall)
+	require.NotEmpty(t, host3LastInstall.ExecutionID)
+	require.NotNil(t, host3LastInstall.Status)
+	require.Equal(t, fleet.SoftwareInstallPending, *host3LastInstall.Status)
+	host3LastInstallDetails, err := s.ds.GetSoftwareInstallDetails(ctx, host3LastInstall.ExecutionID)
+	require.NoError(t, err)
+	// Even if fleet-osquery.msi was uploaded as Self-service, it was installed by Fleet, so
+	// host3LastInstallDetails.SelfService should be false.
+	require.False(t, host3LastInstallDetails.SelfService)
+
+	//
+	// The following increase coverage of policies result processing in distributed/write.
+	//
+
+	// host3Team2 reports a passing result for policy0AllTeams which is a global policy.
+	distributedResp = submitDistributedQueryResultsResponse{}
+	s.DoJSONWithoutAuth("POST", "/api/osquery/distributed/write", genDistributedReqWithPolicyResults(
+		host3Team2,
+		map[uint]*bool{
+			policy0AllTeams.ID: ptr.Bool(true),
+		},
+	), http.StatusOK, &distributedResp)
+
+	// host0NoTeam reports a failing result for policy0AllTeams which is a global policy.
+	distributedResp = submitDistributedQueryResultsResponse{}
+	s.DoJSONWithoutAuth("POST", "/api/osquery/distributed/write", genDistributedReqWithPolicyResults(
+		host0NoTeam,
+		map[uint]*bool{
+			policy0AllTeams.ID: ptr.Bool(false),
+		},
+	), http.StatusOK, &distributedResp)
+
+	// host3Team2 reports a failing result for policy0AllTeams which is a global policy.
+	distributedResp = submitDistributedQueryResultsResponse{}
+	s.DoJSONWithoutAuth("POST", "/api/osquery/distributed/write", genDistributedReqWithPolicyResults(
+		host3Team2,
+		map[uint]*bool{
+			policy0AllTeams.ID: ptr.Bool(false),
+		},
+	), http.StatusOK, &distributedResp)
+
+	// Unassociate policy4Team2 from installer.
+	mtplr = modifyTeamPolicyResponse{}
+	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/teams/%d/policies/%d", team2.ID, policy4Team2.ID), modifyTeamPolicyRequest{
+		ModifyPolicyPayload: fleet.ModifyPolicyPayload{
+			SoftwareTitleID: ptr.Uint(0),
+		},
+	}, http.StatusOK, &mtplr)
+
+	// host3Team2 reports a failing result for policy4Team2.
+	distributedResp = submitDistributedQueryResultsResponse{}
+	s.DoJSONWithoutAuth("POST", "/api/osquery/distributed/write", genDistributedReqWithPolicyResults(
+		host3Team2,
+		map[uint]*bool{
+			policy4Team2.ID: ptr.Bool(false),
+		},
+	), http.StatusOK, &distributedResp)
+
+	// Upcoming activities for host1Team1 should show the automatic installation of dummy_installer.pkg.
+	// Check the author should be the admin that uploaded the installer.
+	var listUpcomingAct listHostUpcomingActivitiesResponse
+	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/hosts/%d/activities/upcoming", host1Team1.ID), nil, http.StatusOK, &listUpcomingAct)
+	require.Len(t, listUpcomingAct.Activities, 1)
+	require.NotNil(t, listUpcomingAct.Activities[0].ActorID)
+	require.Equal(t, globalAdmin.ID, *listUpcomingAct.Activities[0].ActorID)
+	require.Equal(t, globalAdmin.Name, *listUpcomingAct.Activities[0].ActorFullName)
+	require.Equal(t, globalAdmin.Email, *listUpcomingAct.Activities[0].ActorEmail)
+
+	//
+	// Finally have orbit install the packages and check activities.
+	//
+
+	// host1Team1 posts the installation result for dummy_installer.pkg.
+	s.Do("POST", "/api/fleet/orbit/software_install/result", json.RawMessage(fmt.Sprintf(`{
+			"orbit_node_key": %q,
+			"install_uuid": %q,
+			"pre_install_condition_output": "ok",
+			"install_script_exit_code": 0,
+			"install_script_output": "ok"
+		}`, *host1Team1.OrbitNodeKey, host1LastInstall.ExecutionID)), http.StatusNoContent)
+	s.lastActivityMatches(fleet.ActivityTypeInstalledSoftware{}.ActivityName(), fmt.Sprintf(`{
+		"host_id": %d,
+		"host_display_name": "%s",
+		"software_title": "%s",
+		"software_package": "%s",
+		"self_service": false,
+		"install_uuid": "%s",
+		"status": "installed"
+	}`, host1Team1.ID, host1Team1.DisplayName(), "DummyApp.app", "dummy_installer.pkg", host1LastInstall.ExecutionID), 0)
+
+	// host2Team1 posts the installation result for ruby.deb.
+	s.Do("POST", "/api/fleet/orbit/software_install/result", json.RawMessage(fmt.Sprintf(`{
+			"orbit_node_key": %q,
+			"install_uuid": %q,
+			"pre_install_condition_output": "ok",
+			"install_script_exit_code": 1,
+			"install_script_output": "failed"
+		}`, *host2Team1.OrbitNodeKey, host2LastInstall.ExecutionID)), http.StatusNoContent)
+	activityID := s.lastActivityMatches(fleet.ActivityTypeInstalledSoftware{}.ActivityName(), fmt.Sprintf(`{
+		"host_id": %d,
+		"host_display_name": "%s",
+		"software_title": "%s",
+		"software_package": "%s",
+		"self_service": false,
+		"install_uuid": "%s",
+		"status": "%s"
+	}`, host2Team1.ID, host2Team1.DisplayName(), "ruby", "ruby.deb", host2LastInstall.ExecutionID, fleet.SoftwareInstallFailed), 0)
+
+	// Check that the activity item generated for ruby.deb installation has a null user,
+	// but has name and email set.
+	var actor struct {
+		UserID    *uint   `db:"user_id"`
+		UserName  *string `db:"user_name"`
+		UserEmail string  `db:"user_email"`
+	}
+	mysql.ExecAdhocSQL(t, s.ds, func(q sqlx.ExtContext) error {
+		return sqlx.GetContext(ctx, q,
+			&actor,
+			`SELECT user_id, user_name, user_email FROM activities WHERE id = ?`,
+			activityID,
+		)
+	})
+	require.Nil(t, actor.UserID)
+	require.NotNil(t, actor.UserName)
+	require.Equal(t, "admin team1", *actor.UserName)
+	require.Equal(t, "admin_team1@example.com", actor.UserEmail)
+
+	// host3Team2 posts the installation result for fleet-osquery.msi.
+	s.Do("POST", "/api/fleet/orbit/software_install/result", json.RawMessage(fmt.Sprintf(`{
+			"orbit_node_key": %q,
+			"install_uuid": %q,
+			"pre_install_condition_output": "ok",
+			"install_script_exit_code": 1,
+			"install_script_output": "failed"
+		}`, *host3Team2.OrbitNodeKey, host3LastInstall.ExecutionID)), http.StatusNoContent)
+	activityID = s.lastActivityMatches(fleet.ActivityTypeInstalledSoftware{}.ActivityName(), fmt.Sprintf(`{
+		"host_id": %d,
+		"host_display_name": "%s",
+		"software_title": "%s",
+		"software_package": "%s",
+		"self_service": false,
+		"install_uuid": "%s",
+		"status": "%s"
+	}`, host3Team2.ID, host3Team2.DisplayName(), "Fleet osquery", "fleet-osquery.msi", host3LastInstall.ExecutionID,
+		fleet.SoftwareInstallFailed), 0)
+
+	// Check that the activity item generated for fleet-osquery.msi installation has the admin user set as author.
+	mysql.ExecAdhocSQL(t, s.ds, func(q sqlx.ExtContext) error {
+		return sqlx.GetContext(ctx, q,
+			&actor,
+			`SELECT user_id, user_name, user_email FROM activities WHERE id = ?`,
+			activityID,
+		)
+	})
+	require.NotNil(t, actor.UserID)
+	require.Equal(t, globalAdmin.ID, *actor.UserID)
+	require.NotNil(t, actor.UserName)
+	require.Equal(t, "Test Name admin1@example.com", *actor.UserName)
+	require.Equal(t, "admin1@example.com", actor.UserEmail)
+
+	// hostVanillaOsquery5Team1 sends policy results with failed policies with associated installers.
+	// Fleet should not queue an install for vanilla osquery hosts.
+	distributedResp = submitDistributedQueryResultsResponse{}
+	s.DoJSONWithoutAuth("POST", "/api/osquery/distributed/write", genDistributedReqWithPolicyResults(
+		hostVanillaOsquery5Team1,
+		map[uint]*bool{
+			policy1Team1.ID: ptr.Bool(false),
+		},
+	), http.StatusOK, &distributedResp)
+	hostVanillaOsquery5Team1LastInstall, err := s.ds.GetHostLastInstallData(ctx, hostVanillaOsquery5Team1.ID, dummyInstallerPkgInstallerID)
+	require.NoError(t, err)
+	require.Nil(t, hostVanillaOsquery5Team1LastInstall)
+}
diff --git a/server/service/integration_live_queries_test.go b/server/service/integration_live_queries_test.go
index b5ba57ae68..7d3cfef7f1 100644
--- a/server/service/integration_live_queries_test.go
+++ b/server/service/integration_live_queries_test.go
@@ -31,7 +31,7 @@ import (
 	"github.com/stretchr/testify/suite"
 )
 
-func TestIntegrationLiveQueriesTestSuite(t *testing.T) {
+func TestIntegrationsLiveQueriesTestSuite(t *testing.T) {
 	testingSuite := new(liveQueriesTestSuite)
 	testingSuite.withServer.s = &testingSuite.Suite
 	suite.Run(t, testingSuite)
diff --git a/server/service/integration_logger_test.go b/server/service/integration_logger_test.go
index 8831d2e304..6a6f7be931 100644
--- a/server/service/integration_logger_test.go
+++ b/server/service/integration_logger_test.go
@@ -22,9 +22,9 @@ import (
 	"github.com/stretchr/testify/suite"
 )
 
-func TestIntegrationLoggerTestSuite(t *testing.T) {
+func TestIntegrationsLoggerTestSuite(t *testing.T) {
 	testingSuite := new(integrationLoggerTestSuite)
-	testingSuite.s = &testingSuite.Suite
+	testingSuite.withDS.s = &testingSuite.Suite
 	suite.Run(t, testingSuite)
 }
 
diff --git a/server/service/integration_mdm_dep_test.go b/server/service/integration_mdm_dep_test.go
index f23b1858e4..95bd4a5b35 100644
--- a/server/service/integration_mdm_dep_test.go
+++ b/server/service/integration_mdm_dep_test.go
@@ -39,6 +39,19 @@ type profileAssignmentReq struct {
 func (s *integrationMDMTestSuite) TestDEPEnrollReleaseDeviceGlobal() {
 	t := s.T()
 	ctx := context.Background()
+	s.enableABM(t.Name())
+	s.mockDEPResponse(t.Name(), http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		encoder := json.NewEncoder(w)
+		switch r.URL.Path {
+		case "/session":
+			_, _ = w.Write([]byte(`{"auth_session_token": "session123"}`))
+		case "/account":
+			_, _ = w.Write([]byte(fmt.Sprintf(`{"admin_id": "admin123", "org_name": "%s"}`, "foo")))
+		case "/profile":
+			w.WriteHeader(http.StatusOK)
+			require.NoError(t, encoder.Encode(godep.ProfileResponse{ProfileUUID: "profile123"}))
+		}
+	}))
 
 	globalDevice := godep.Device{SerialNumber: uuid.New().String(), Model: "MacBook Pro", OS: "osx", OpType: "added"}
 
@@ -94,6 +107,7 @@ func (s *integrationMDMTestSuite) TestDEPEnrollReleaseDeviceGlobal() {
 	// enable FileVault
 	s.Do("PATCH", "/api/latest/fleet/config", json.RawMessage([]byte(`{"mdm":{"macos_settings":{"enable_disk_encryption":true}}}`)), http.StatusOK)
 
+	s.enableABM("fleet_ade_test")
 	for _, enableReleaseManually := range []bool{false, true} {
 		t.Run(fmt.Sprintf("enableReleaseManually=%t", enableReleaseManually), func(t *testing.T) {
 			s.runDEPEnrollReleaseDeviceTest(t, globalDevice, enableReleaseManually, nil, "I1")
@@ -105,6 +119,20 @@ func (s *integrationMDMTestSuite) TestDEPEnrollReleaseDeviceTeam() {
 	t := s.T()
 	ctx := context.Background()
 
+	// Set up a mock DEP Apple API
+	s.enableABM(t.Name())
+	s.mockDEPResponse(t.Name(), http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		encoder := json.NewEncoder(w)
+		switch r.URL.Path {
+		case "/session":
+			_, _ = w.Write([]byte(`{"auth_session_token": "session123"}`))
+		case "/account":
+			_, _ = w.Write([]byte(fmt.Sprintf(`{"admin_id": "admin123", "org_name": "%s"}`, "foo")))
+		case "/profile":
+			require.NoError(t, encoder.Encode(godep.ProfileResponse{ProfileUUID: "profile123"}))
+		}
+	}))
+
 	teamDevice := godep.Device{SerialNumber: uuid.New().String(), Model: "MacBook Pro", OS: "osx", OpType: "added"}
 
 	tm, err := s.ds.NewTeam(ctx, &fleet.Team{Name: "test-team-device-release"})
@@ -137,9 +165,15 @@ func (s *integrationMDMTestSuite) TestDEPEnrollReleaseDeviceTeam() {
 
 	// setup IdP so that AccountConfiguration profile is sent after DEP enrollment
 	var acResp appConfigResponse
+	s.enableABM("fleet_ade_test")
 	s.DoJSON("PATCH", "/api/latest/fleet/config", json.RawMessage(fmt.Sprintf(`{
 			"mdm": {
-				"apple_bm_default_team": %q,
+			       "apple_business_manager": [{
+			         "organization_name": %q,
+			         "macos_team": %q,
+			         "ios_team": %q,
+			         "ipados_team": %q
+			       }],
 				"end_user_authentication": {
 					"entity_id": "https://localhost:8080",
 					"issuer_uri": "http://localhost:8080/simplesaml/saml2/idp/SSOService.php",
@@ -150,7 +184,7 @@ func (s *integrationMDMTestSuite) TestDEPEnrollReleaseDeviceTeam() {
 					"enable_end_user_authentication": true
 				}
 			}
-		}`, tm.Name)), http.StatusOK, &acResp)
+		}`, "fleet_ade_test", tm.Name, tm.Name, tm.Name)), http.StatusOK, &acResp)
 	require.NotEmpty(t, acResp.MDM.EndUserAuthentication)
 
 	// TODO(mna): how/where to pass an enroll_reference so that
@@ -191,7 +225,7 @@ func (s *integrationMDMTestSuite) runDEPEnrollReleaseDeviceTest(t *testing.T, de
 		return map[string]*push.Response{}, nil
 	}
 
-	s.mockDEPResponse(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	s.mockDEPResponse("fleet_ade_test", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		encoder := json.NewEncoder(w)
 		switch r.URL.Path {
 		case "/session":
@@ -537,7 +571,9 @@ func (s *integrationMDMTestSuite) TestDEPProfileAssignment() {
 
 	expectAssignProfileResponseFailed := ""        // set to device serial when testing the failed profile assignment flow
 	expectAssignProfileResponseNotAccessible := "" // set to device serial when testing the not accessible profile assignment flow
-	s.mockDEPResponse(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+
+	s.enableABM(t.Name())
+	s.mockDEPResponse(t.Name(), http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.WriteHeader(http.StatusOK)
 		encoder := json.NewEncoder(w)
 		switch r.URL.Path {
@@ -919,6 +955,7 @@ func (s *integrationMDMTestSuite) TestDEPProfileAssignment() {
 		addHostsToTeamRequest{TeamID: &dummyTeam.ID, HostIDs: []uint{eHost.ID}}, http.StatusOK)
 	checkPendingMacOSSetupAssistantJob("hosts_transferred", &dummyTeam.ID, []string{eHost.HardwareSerial}, 0)
 
+	s.runWorker()
 	// expect no assign profile request during cooldown
 	profileAssignmentReqs = []profileAssignmentReq{}
 	s.runIntegrationsSchedule()
@@ -985,7 +1022,7 @@ func (s *integrationMDMTestSuite) TestDEPProfileAssignment() {
 	checkPendingMacOSSetupAssistantJob("hosts_cooldown", nil, []string{eHost.HardwareSerial}, jobID)
 	checkListHostDEPError(eHost.HardwareSerial, "On (automatic)", true)
 
-	// run the inregration schedule and expect success
+	// run the integration schedule and expect success
 	expectAssignProfileResponseFailed = ""
 	profileAssignmentReqs = []profileAssignmentReq{}
 	s.runIntegrationsSchedule()
@@ -1121,3 +1158,53 @@ func (s *integrationMDMTestSuite) TestDEPProfileAssignment() {
 	s.runDEPSchedule()
 	require.Empty(t, profileAssignmentReqs)
 }
+
+func (s *integrationMDMTestSuite) TestDeprecatedDefaultAppleBMTeam() {
+	t := s.T()
+
+	s.enableABM(t.Name())
+
+	tm, err := s.ds.NewTeam(context.Background(), &fleet.Team{
+		Name:        t.Name(),
+		Description: "desc",
+	})
+	require.NoError(s.T(), err)
+
+	var acResp appConfigResponse
+
+	defer func() {
+		acResp = appConfigResponse{}
+		s.DoJSON("PATCH", "/api/latest/fleet/config", json.RawMessage(`{
+		    "mdm": {
+			    "apple_bm_default_team": ""
+		    }
+		}`), http.StatusOK, &acResp)
+		require.Empty(t, acResp.MDM.DeprecatedAppleBMDefaultTeam)
+	}()
+
+	// try to set an invalid team name
+	s.DoJSON("PATCH", "/api/latest/fleet/config", json.RawMessage(`{
+		"mdm": {
+			"apple_bm_default_team": "xyz"
+		}
+	}`), http.StatusUnprocessableEntity, &acResp)
+
+	// get the appconfig, nothing changed
+	acResp = appConfigResponse{}
+	s.DoJSON("GET", "/api/latest/fleet/config", nil, http.StatusOK, &acResp)
+	require.Empty(t, acResp.MDM.DeprecatedAppleBMDefaultTeam)
+
+	// set to a valid team name
+	acResp = appConfigResponse{}
+	s.DoJSON("PATCH", "/api/latest/fleet/config", json.RawMessage(fmt.Sprintf(`{
+		"mdm": {
+			"apple_bm_default_team": %q
+		}
+	}`, tm.Name)), http.StatusOK, &acResp)
+	require.Equal(t, tm.Name, acResp.MDM.DeprecatedAppleBMDefaultTeam)
+
+	// get the appconfig, set to that team name
+	acResp = appConfigResponse{}
+	s.DoJSON("GET", "/api/latest/fleet/config", nil, http.StatusOK, &acResp)
+	require.Equal(t, tm.Name, acResp.MDM.DeprecatedAppleBMDefaultTeam)
+}
diff --git a/server/service/integration_mdm_lifecycle_test.go b/server/service/integration_mdm_lifecycle_test.go
index 5dce43108d..27c1458c40 100644
--- a/server/service/integration_mdm_lifecycle_test.go
+++ b/server/service/integration_mdm_lifecycle_test.go
@@ -3,6 +3,7 @@ package service
 import (
 	"context"
 	"crypto/x509"
+	"encoding/base64"
 	"encoding/json"
 	"encoding/xml"
 	"fmt"
@@ -27,8 +28,8 @@ import (
 	"github.com/groob/plist"
 	"github.com/jmoiron/sqlx"
 	micromdm "github.com/micromdm/micromdm/mdm/mdm"
+	"github.com/smallstep/pkcs7"
 	"github.com/stretchr/testify/require"
-	"go.mozilla.org/pkcs7"
 )
 
 // NOTE: the mantra for lifecycle events is:
@@ -226,7 +227,8 @@ func (s *integrationMDMTestSuite) TestTurnOnLifecycleEventsApple() {
 
 			t.Run("automatic enrollment", func(t *testing.T) {
 				device := mdmtest.NewTestMDMClientAppleDEP(s.server.URL, "")
-				s.mockDEPResponse(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				s.enableABM(t.Name())
+				s.mockDEPResponse(t.Name(), http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 					w.WriteHeader(http.StatusOK)
 					encoder := json.NewEncoder(w)
 					switch r.URL.Path {
@@ -590,10 +592,7 @@ func (s *integrationMDMTestSuite) TestLifecycleSCEPCertExpiration() {
 	t := s.T()
 	ctx := context.Background()
 	// ensure there's a token for automatic enrollments
-	s.mockDEPResponse(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.WriteHeader(http.StatusOK)
-		_, _ = w.Write([]byte(`{"auth_session_token": "xyz"}`))
-	}))
+	s.enableABM(t.Name())
 	s.runDEPSchedule()
 
 	// add a device that's manually enrolled
@@ -772,7 +771,7 @@ func (s *integrationMDMTestSuite) TestLifecycleSCEPCertExpiration() {
 	require.NoError(t, err)
 
 	// set the env var, and run the cron
-	t.Setenv("FLEET_SILENT_MIGRATION_ENROLLMENT_PROFILE", "<foo></foo>")
+	t.Setenv("FLEET_SILENT_MIGRATION_ENROLLMENT_PROFILE", base64.StdEncoding.EncodeToString([]byte("<foo></foo>")))
 	err = RenewSCEPCertificates(ctx, logger, s.ds, &fleetCfg, s.mdmCommander)
 	require.NoError(t, err)
 	checkRenewCertCommand(migratedDevice, "", "<foo></foo>")
diff --git a/server/service/integration_mdm_profiles_test.go b/server/service/integration_mdm_profiles_test.go
index 318f615ad0..49a1f6eab0 100644
--- a/server/service/integration_mdm_profiles_test.go
+++ b/server/service/integration_mdm_profiles_test.go
@@ -10,6 +10,7 @@ import (
 	"fmt"
 	"io"
 	"net/http"
+	"net/url"
 	"sort"
 	"strconv"
 	"strings"
@@ -25,13 +26,14 @@ import (
 	"github.com/fleetdm/fleet/v4/server/mdm/apple/mobileconfig"
 	microsoft_mdm "github.com/fleetdm/fleet/v4/server/mdm/microsoft"
 	"github.com/fleetdm/fleet/v4/server/mdm/microsoft/syncml"
+	"github.com/fleetdm/fleet/v4/server/mdm/nanodep/godep"
 	"github.com/fleetdm/fleet/v4/server/ptr"
 	"github.com/fleetdm/fleet/v4/server/test"
 	"github.com/google/uuid"
 	"github.com/jmoiron/sqlx"
+	"github.com/smallstep/pkcs7"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"go.mozilla.org/pkcs7"
 )
 
 func (s *integrationMDMTestSuite) signedProfilesMatch(want, got [][]byte) {
@@ -949,6 +951,9 @@ func (s *integrationMDMTestSuite) TestPuppetMatchPreassignProfiles() {
 	ctx := context.Background()
 	t := s.T()
 
+	// before we switch to a gitops token, ensure ABM is setup
+	s.enableABM(t.Name())
+
 	// Use a gitops user for all Puppet actions
 	u := &fleet.User{
 		Name:       "GitOps",
@@ -982,7 +987,7 @@ func (s *integrationMDMTestSuite) TestPuppetMatchPreassignProfiles() {
 	// create a setup assistant for no team, for this we need to:
 	// 1. mock the ABM API, as it gets called to set the profile
 	// 2. run the DEP schedule, as this registers the default profile
-	s.mockDEPResponse(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	s.mockDEPResponse(t.Name(), http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.WriteHeader(http.StatusOK)
 		_, _ = w.Write([]byte(`{"auth_session_token": "xyz"}`))
 	}))
@@ -1154,18 +1159,16 @@ func (s *integrationMDMTestSuite) TestPuppetMatchPreassignProfiles() {
 	s.awaitTriggerProfileSchedule(t)
 
 	// useful for debugging
-	//mysql.ExecAdhocSQL(t, s.ds, func(q sqlx.ExtContext) error {
-	//	mysql.DumpTable(t, q, "host_mdm_apple_profiles")
-	//	return nil
-	//})
+	// mysql.ExecAdhocSQL(t, s.ds, func(q sqlx.ExtContext) error {
+	// 	mysql.DumpTable(t, q, "host_mdm_apple_profiles")
+	// 	return nil
+	// })
 	s.assertHostAppleConfigProfiles(map[*fleet.Host][]fleet.HostMDMAppleProfile{
 		mdmHost: {
 			{Identifier: "i1", OperationType: fleet.MDMOperationTypeInstall, Status: &fleet.MDMDeliveryPending},
-			{Identifier: "i2", OperationType: fleet.MDMOperationTypeRemove, Status: &fleet.MDMDeliveryPending},
 			{Identifier: "i4", OperationType: fleet.MDMOperationTypeInstall, Status: &fleet.MDMDeliveryPending},
 			{Identifier: mobileconfig.FleetdConfigPayloadIdentifier, OperationType: fleet.MDMOperationTypeInstall, Status: &fleet.MDMDeliveryPending},
 			{Identifier: mobileconfig.FleetCARootConfigPayloadIdentifier, OperationType: fleet.MDMOperationTypeInstall, Status: &fleet.MDMDeliveryPending},
-			{Identifier: mobileconfig.FleetFileVaultPayloadIdentifier, OperationType: fleet.MDMOperationTypeRemove, Status: &fleet.MDMDeliveryPending},
 		},
 	})
 
@@ -1232,6 +1235,21 @@ func (s *integrationMDMTestSuite) TestPuppetRun() {
 	host3, _ := createHostThenEnrollMDM(s.ds, s.server.URL, t)
 	s.runWorker()
 
+	// Set up a mock Apple DEP API
+	s.enableABM(t.Name())
+	s.mockDEPResponse(t.Name(), http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		encoder := json.NewEncoder(w)
+		switch r.URL.Path {
+		case "/session":
+			_, _ = w.Write([]byte(`{"auth_session_token": "session123"}`))
+		case "/account":
+			_, _ = w.Write([]byte(fmt.Sprintf(`{"admin_id": "admin123", "org_name": "%s"}`, "foo")))
+		case "/profile":
+			w.WriteHeader(http.StatusOK)
+			require.NoError(t, encoder.Encode(godep.ProfileResponse{ProfileUUID: "profile123"}))
+		}
+	}))
+
 	// Use a gitops user for all Puppet actions
 	u := &fleet.User{
 		Name:       "GitOps",
@@ -3779,17 +3797,18 @@ func (s *integrationMDMTestSuite) TestBatchSetMDMProfiles() {
 
 	// apply an empty set to no-team
 	s.Do("POST", "/api/v1/fleet/mdm/profiles/batch", batchSetMDMProfilesRequest{Profiles: nil}, http.StatusNoContent)
-	s.lastActivityOfTypeMatches(
+	// Nothing changed, so no activity items
+	s.lastActivityOfTypeDoesNotMatch(
 		fleet.ActivityTypeEditedMacosProfile{}.ActivityName(),
 		`{"team_id": null, "team_name": null}`,
 		0,
 	)
-	s.lastActivityOfTypeMatches(
+	s.lastActivityOfTypeDoesNotMatch(
 		fleet.ActivityTypeEditedWindowsProfile{}.ActivityName(),
 		`{"team_id": null, "team_name": null}`,
 		0,
 	)
-	s.lastActivityOfTypeMatches(
+	s.lastActivityOfTypeDoesNotMatch(
 		fleet.ActivityTypeEditedDeclarationProfile{}.ActivityName(),
 		`{"team_id": null, "team_name": null}`,
 		0,
@@ -4059,12 +4078,13 @@ func (s *integrationMDMTestSuite) TestBatchSetMDMProfilesBackwardsCompat() {
 
 	// apply an empty set to no-team
 	s.Do("POST", "/api/v1/fleet/mdm/profiles/batch", map[string]any{"profiles": nil}, http.StatusNoContent)
-	s.lastActivityOfTypeMatches(
+	// Nothing changed, so no activity
+	s.lastActivityOfTypeDoesNotMatch(
 		fleet.ActivityTypeEditedMacosProfile{}.ActivityName(),
 		`{"team_id": null, "team_name": null}`,
 		0,
 	)
-	s.lastActivityOfTypeMatches(
+	s.lastActivityOfTypeDoesNotMatch(
 		fleet.ActivityTypeEditedWindowsProfile{}.ActivityName(),
 		`{"team_id": null, "team_name": null}`,
 		0,
@@ -4176,10 +4196,6 @@ func (s *integrationMDMTestSuite) TestBatchSetMDMProfilesBackwardsCompat() {
 	)
 }
 
-func (s *integrationMDMTestSuite) TestGetManualEnrollmentProfile() {
-	s.downloadAndVerifyEnrollmentProfile("/api/latest/fleet/enrollment_profiles/manual")
-}
-
 func (s *integrationMDMTestSuite) TestMDMBatchSetProfilesKeepsReservedNames() {
 	t := s.T()
 	ctx := context.Background()
@@ -4810,3 +4826,36 @@ func (s *integrationMDMTestSuite) TestHostMDMProfilesExcludeLabels() {
 		},
 	})
 }
+
+func (s *integrationMDMTestSuite) TestOTAProfile() {
+	t := s.T()
+	ctx := context.Background()
+
+	// Getting profile for non-existent secret it's ok
+	s.Do("GET", "/api/latest/fleet/enrollment_profiles/ota", getOTAProfileRequest{}, http.StatusOK, "enroll_secret", "not-real")
+
+	// Create an enroll secret; has some special characters that should be escaped in the profile
+	globalEnrollSec := "global_enroll+_/sec"
+	escSec := url.QueryEscape(globalEnrollSec)
+	s.Do("POST", "/api/latest/fleet/spec/enroll_secret", applyEnrollSecretSpecRequest{
+		Spec: &fleet.EnrollSecretSpec{
+			Secrets: []*fleet.EnrollSecret{{Secret: globalEnrollSec}},
+		},
+	}, http.StatusOK)
+
+	cfg, err := s.ds.AppConfig(ctx)
+	require.NoError(t, err)
+
+	// Get profile with that enroll secret
+	resp := s.Do("GET", "/api/latest/fleet/enrollment_profiles/ota", getOTAProfileRequest{}, http.StatusOK, "enroll_secret", globalEnrollSec)
+	require.NotZero(t, resp.ContentLength)
+	require.Contains(t, resp.Header.Get("Content-Disposition"), `attachment;filename="fleet-mdm-enrollment-profile.mobileconfig"`)
+	require.Contains(t, resp.Header.Get("Content-Type"), "application/x-apple-aspen-config")
+	require.Contains(t, resp.Header.Get("X-Content-Type-Options"), "nosniff")
+	b, err := io.ReadAll(resp.Body)
+	require.NoError(t, err)
+	require.Equal(t, resp.ContentLength, int64(len(b)))
+	require.Contains(t, string(b), "com.fleetdm.fleet.mdm.apple.ota")
+	require.Contains(t, string(b), fmt.Sprintf("%s/api/v1/fleet/ota_enrollment?enroll_secret=%s", cfg.ServerSettings.ServerURL, escSec))
+	require.Contains(t, string(b), cfg.OrgInfo.OrgName)
+}
diff --git a/server/service/integration_mdm_test.go b/server/service/integration_mdm_test.go
index b4180fb2b2..ce134a2bd5 100644
--- a/server/service/integration_mdm_test.go
+++ b/server/service/integration_mdm_test.go
@@ -39,6 +39,7 @@ import (
 	"github.com/fleetdm/fleet/v4/server/config"
 	"github.com/fleetdm/fleet/v4/server/datastore/mysql"
 	"github.com/fleetdm/fleet/v4/server/datastore/redis/redistest"
+	"github.com/fleetdm/fleet/v4/server/datastore/s3"
 	"github.com/fleetdm/fleet/v4/server/fleet"
 	"github.com/fleetdm/fleet/v4/server/live_query/live_query_mock"
 	servermdm "github.com/fleetdm/fleet/v4/server/mdm"
@@ -65,10 +66,10 @@ import (
 	"github.com/groob/plist"
 	"github.com/jmoiron/sqlx"
 	micromdm "github.com/micromdm/micromdm/mdm/mdm"
+	"github.com/smallstep/pkcs7"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"github.com/stretchr/testify/suite"
-	"go.mozilla.org/pkcs7"
 )
 
 func TestIntegrationsMDM(t *testing.T) {
@@ -84,11 +85,9 @@ type integrationMDMTestSuite struct {
 	fleetDMNextCSRStatus       atomic.Value
 	pushProvider               *mock.APNSPushProvider
 	depStorage                 nanodep_storage.AllDEPStorage
-	depSchedule                *schedule.Schedule
 	profileSchedule            *schedule.Schedule
 	integrationsSchedule       *schedule.Schedule
 	onProfileJobDone           func() // function called when profileSchedule.Trigger() job completed
-	onDEPScheduleDone          func() // function called when depSchedule.Trigger() job completed
 	onIntegrationsScheduleDone func() // function called when integrationsSchedule.Trigger() job completed
 	mdmStorage                 *mysql.NanoMDMStorage
 	worker                     *worker.Worker
@@ -98,6 +97,7 @@ type integrationMDMTestSuite struct {
 	appleVPPConfigSrv          *httptest.Server
 	appleVPPConfigSrvConfig    *appleVPPConfigSrvConf
 	appleITunesSrv             *httptest.Server
+	appleGDMFSrv               *httptest.Server
 	mockedDownloadFleetdmMeta  fleetdbase.Metadata
 }
 
@@ -105,6 +105,7 @@ type integrationMDMTestSuite struct {
 type appleVPPConfigSrvConf struct {
 	Assets        []vpp.Asset
 	SerialNumbers []string
+	Location      string
 }
 
 func (s *integrationMDMTestSuite) SetupSuite() {
@@ -174,7 +175,6 @@ func (s *integrationMDMTestSuite) SetupSuite() {
 		return err
 	})
 
-	var depSchedule *schedule.Schedule
 	var integrationsSchedule *schedule.Schedule
 	var profileSchedule *schedule.Schedule
 	cronLog := kitlog.NewJSONLogger(os.Stdout)
@@ -185,39 +185,33 @@ func (s *integrationMDMTestSuite) SetupSuite() {
 	if os.Getenv("FLEET_INTEGRATION_TESTS_DISABLE_LOG") != "" {
 		serverLogger = kitlog.NewNopLogger()
 	}
+
+	var softwareInstallerStore fleet.SoftwareInstallerStore
+	var bootstrapPackageStore fleet.MDMBootstrapPackageStore
+	_, minioEnabled := os.LookupEnv("MINIO_STORAGE_TEST")
+	if wantStore := os.Getenv("FLEET_INTEGRATION_TESTS_SOFTWARE_INSTALLER_STORE"); minioEnabled &&
+		(wantStore == "s3" || (wantStore == "" && time.Now().UnixNano()%2 == 0)) {
+
+		s.T().Log(">>> using S3/minio software installer store")
+		softwareInstallerStore = s3.SetupTestSoftwareInstallerStore(s.T(), "integration-tests", "")
+		bootstrapPackageStore = s3.SetupTestBootstrapPackageStore(s.T(), "integration-tests", "")
+	}
+
 	config := TestServerOpts{
 		License: &fleet.LicenseInfo{
 			Tier: fleet.TierPremium,
 		},
-		Logger:      serverLogger,
-		FleetConfig: &fleetCfg,
-		MDMStorage:  mdmStorage,
-		DEPStorage:  depStorage,
-		SCEPStorage: scepStorage,
-		MDMPusher:   mdmPushService,
-		Pool:        redisPool,
-		Lq:          s.lq,
+		Logger:                serverLogger,
+		FleetConfig:           &fleetCfg,
+		MDMStorage:            mdmStorage,
+		DEPStorage:            depStorage,
+		SCEPStorage:           scepStorage,
+		MDMPusher:             mdmPushService,
+		Pool:                  redisPool,
+		Lq:                    s.lq,
+		SoftwareInstallStore:  softwareInstallerStore,
+		BootstrapPackageStore: bootstrapPackageStore,
 		StartCronSchedules: []TestNewScheduleFunc{
-			func(ctx context.Context, ds fleet.Datastore) fleet.NewCronScheduleFunc {
-				return func() (fleet.CronSchedule, error) {
-					const name = string(fleet.CronAppleMDMDEPProfileAssigner)
-					logger := cronLog
-					fleetSyncer := apple_mdm.NewDEPService(ds, depStorage, logger)
-					depSchedule = schedule.New(
-						ctx, name, s.T().Name(), 1*time.Hour, ds, ds,
-						schedule.WithLogger(logger),
-						schedule.WithJob("dep_syncer", func(ctx context.Context) error {
-							if s.onDEPScheduleDone != nil {
-								defer s.onDEPScheduleDone()
-							}
-							err := fleetSyncer.RunAssigner(ctx)
-							require.NoError(s.T(), err)
-							return err
-						}),
-					)
-					return depSchedule, nil
-				}
-			},
 			func(ctx context.Context, ds fleet.Datastore) fleet.NewCronScheduleFunc {
 				return func() (fleet.CronSchedule, error) {
 					const name = string(fleet.CronMDMAppleProfileManager)
@@ -274,11 +268,26 @@ func (s *integrationMDMTestSuite) SetupSuite() {
 					return integrationsSchedule, nil
 				}
 			},
+			func(ctx context.Context, ds fleet.Datastore) fleet.NewCronScheduleFunc {
+				return func() (fleet.CronSchedule, error) {
+					const name = string(fleet.CronAppleMDMIPhoneIPadRefetcher)
+					logger := cronLog
+					refetcherSchedule := schedule.New(
+						ctx, name, s.T().Name(), 1*time.Hour, ds, ds,
+						schedule.WithLogger(logger),
+						schedule.WithJob("cron_iphone_ipad_refetcher", func(ctx context.Context) error {
+							return apple_mdm.IOSiPadOSRefetch(ctx, ds, mdmCommander, logger)
+						}),
+					)
+					return refetcherSchedule, nil
+				}
+			},
 		},
 		APNSTopic: "com.apple.mgmt.External.10ac3ce5-4668-4e58-b69a-b2b5ce667589",
 	}
 
-	s.scepChallenge = "scepchallenge"
+	// ensure all our tests support challenges with invalid XML characters
+	s.scepChallenge = "scepcha/><llenge"
 	err = s.ds.InsertMDMConfigAssets(context.Background(), []fleet.MDMConfigAsset{
 		{Name: fleet.MDMAssetSCEPChallenge, Value: []byte(s.scepChallenge)},
 	})
@@ -291,7 +300,6 @@ func (s *integrationMDMTestSuite) SetupSuite() {
 	s.fleetCfg = fleetCfg
 	s.pushProvider = pushProvider
 	s.depStorage = depStorage
-	s.depSchedule = depSchedule
 	s.integrationsSchedule = integrationsSchedule
 	s.profileSchedule = profileSchedule
 	s.mdmStorage = mdmStorage
@@ -341,6 +349,7 @@ func (s *integrationMDMTestSuite) SetupSuite() {
 				},
 			},
 			SerialNumbers: []string{"123", "456"},
+			Location:      "Fleet Location One",
 		}
 	}
 
@@ -462,7 +471,7 @@ func (s *integrationMDMTestSuite) SetupSuite() {
 		}
 
 		// Handle /client/config
-		resp := []byte(`{"locationName": "Fleet Location One"}`)
+		resp := []byte(fmt.Sprintf(`{"locationName": "%s"}`, s.appleVPPConfigSrvConfig.Location))
 		if strings.Contains(r.URL.RawQuery, "invalidToken") {
 			// This replicates the response sent back from Apple's VPP endpoints when an invalid
 			// token is passed. For more details see:
@@ -505,6 +514,16 @@ func (s *integrationMDMTestSuite) SetupSuite() {
 		_, _ = w.Write([]byte(fmt.Sprintf(`{"results": [%s]}`, strings.Join(objs, ","))))
 	}))
 
+	s.appleGDMFSrv = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		// load the test data from the file
+		b, err := os.ReadFile("../mdm/apple/gdmf/testdata/gdmf.json")
+		require.NoError(s.T(), err)
+		_, err = w.Write(b)
+		require.NoError(s.T(), err)
+	}))
+
+	s.T().Setenv("FLEET_DEV_GDMF_URL", s.appleGDMFSrv.URL)
 	s.T().Setenv("TEST_FLEETDM_API_URL", fleetdmSrv.URL)
 	s.T().Setenv("FLEET_DEV_ITUNES_URL", s.appleITunesSrv.URL)
 
@@ -530,16 +549,25 @@ func (s *integrationMDMTestSuite) SetupSuite() {
 	appConf, err = s.ds.AppConfig(context.Background())
 	require.NoError(s.T(), err)
 	appConf.ServerSettings.ServerURL = server.URL
+	appConf.Features.EnableSoftwareInventory = true
 	err = s.ds.SaveAppConfig(context.Background(), appConf)
 	require.NoError(s.T(), err)
 
 	// enable MDM flows
 	s.appleCoreCertsSetup()
-	s.enableABM()
+
+	// create a global enroll secret
+	var applyResp applyEnrollSecretSpecResponse
+	s.DoJSON("POST", "/api/latest/fleet/spec/enroll_secret", applyEnrollSecretSpecRequest{
+		Spec: &fleet.EnrollSecretSpec{
+			Secrets: []*fleet.EnrollSecret{{Secret: "global-secret"}},
+		},
+	}, http.StatusOK, &applyResp)
 
 	s.T().Cleanup(fleetdmSrv.Close)
 	s.T().Cleanup(s.appleVPPConfigSrv.Close)
 	s.T().Cleanup(s.appleITunesSrv.Close)
+	s.T().Cleanup(s.appleGDMFSrv.Close)
 }
 
 func (s *integrationMDMTestSuite) TearDownSuite() {
@@ -629,16 +657,26 @@ func (s *integrationMDMTestSuite) TearDownTest() {
 		_, err := tx.ExecContext(ctx, "DELETE FROM host_mdm;")
 		return err
 	})
+	mysql.ExecAdhocSQL(t, s.ds, func(tx sqlx.ExtContext) error {
+		_, err := tx.ExecContext(ctx, "DELETE FROM abm_tokens;")
+		return err
+	})
+	mysql.ExecAdhocSQL(t, s.ds, func(tx sqlx.ExtContext) error {
+		_, err := tx.ExecContext(ctx, "DELETE FROM vpp_tokens;")
+		return err
+	})
 }
 
-func (s *integrationMDMTestSuite) mockDEPResponse(handler http.Handler) {
+func (s *integrationMDMTestSuite) mockDEPResponse(orgName string, handler http.Handler) {
 	t := s.T()
 	srv := httptest.NewServer(handler)
-	err := s.depStorage.StoreConfig(context.Background(), apple_mdm.DEPName, &nanodep_client.Config{BaseURL: srv.URL})
+	err := s.depStorage.StoreConfig(context.Background(), orgName, &nanodep_client.Config{BaseURL: srv.URL})
+	depSvc := apple_mdm.NewDEPService(s.ds, s.depStorage, s.logger)
+	require.NoError(t, depSvc.CreateDefaultAutomaticProfile(context.Background()))
 	require.NoError(t, err)
 	t.Cleanup(func() {
 		srv.Close()
-		err := s.depStorage.StoreConfig(context.Background(), apple_mdm.DEPName, &nanodep_client.Config{BaseURL: nanodep_client.DefaultBaseURL})
+		err := s.depStorage.StoreConfig(context.Background(), orgName, &nanodep_client.Config{BaseURL: nanodep_client.DefaultBaseURL})
 		require.NoError(t, err)
 	})
 }
@@ -771,22 +809,36 @@ func (s *integrationMDMTestSuite) TestAppleGetAppleMDM() {
 	require.Equal(t, "Fleet", mdmResp.CommonName)
 	require.NotZero(t, mdmResp.RenewDate)
 
-	s.mockDEPResponse(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.WriteHeader(http.StatusOK)
-		switch r.URL.Path {
-		case "/session":
-			_, _ = w.Write([]byte(`{"auth_session_token": "xyz"}`))
-		case "/account":
-			_, _ = w.Write([]byte(`{"admin_id": "abc", "org_name": "test_org"}`))
-		}
-	}))
-	var getAppleBMResp getAppleBMResponse
-	s.DoJSON("GET", "/api/latest/fleet/abm", nil, http.StatusOK, &getAppleBMResp)
-	require.NoError(t, getAppleBMResp.Err)
-	require.Equal(t, "abc", getAppleBMResp.AppleID)
-	require.Equal(t, "test_org", getAppleBMResp.OrgName)
-	require.Equal(t, s.server.URL+"/mdm/apple/mdm", getAppleBMResp.MDMServerURL)
-	require.Empty(t, getAppleBMResp.DefaultTeam)
+	// set up multiple ABM tokens with different org names
+	defaultOrgName := "fleet_test"
+	s.enableABM(defaultOrgName)
+	tmOrgName := t.Name()
+	s.enableABM(tmOrgName)
+
+	var tokensResp listABMTokensResponse
+	s.DoJSON("GET", "/api/latest/fleet/abm_tokens", nil, http.StatusOK, &tokensResp)
+
+	// for t.Name()
+	tok := s.getABMTokenByName(defaultOrgName, tokensResp.Tokens)
+	require.NotNil(t, tok)
+	require.False(t, tok.TermsExpired)
+	require.Equal(t, "abc", tok.AppleID)
+	require.Equal(t, defaultOrgName, tok.OrganizationName)
+	require.Equal(t, s.server.URL+"/mdm/apple/mdm", tok.MDMServerURL)
+	require.Equal(t, fleet.TeamNameNoTeam, tok.MacOSTeam.Name)
+	require.Equal(t, fleet.TeamNameNoTeam, tok.IOSTeam.Name)
+	require.Equal(t, fleet.TeamNameNoTeam, tok.IPadOSTeam.Name)
+
+	// for tmOrgName
+	tok = s.getABMTokenByName(tmOrgName, tokensResp.Tokens)
+	require.NotNil(t, tok)
+	require.False(t, tok.TermsExpired)
+	require.Equal(t, "abc", tok.AppleID)
+	require.Equal(t, tmOrgName, tok.OrganizationName)
+	require.Equal(t, s.server.URL+"/mdm/apple/mdm", tok.MDMServerURL)
+	require.Equal(t, fleet.TeamNameNoTeam, tok.MacOSTeam.Name)
+	require.Equal(t, fleet.TeamNameNoTeam, tok.IOSTeam.Name)
+	require.Equal(t, fleet.TeamNameNoTeam, tok.IPadOSTeam.Name)
 
 	// create a new team
 	tm, err := s.ds.NewTeam(context.Background(), &fleet.Team{
@@ -794,28 +846,58 @@ func (s *integrationMDMTestSuite) TestAppleGetAppleMDM() {
 		Description: "desc",
 	})
 	require.NoError(t, err)
-	// set the default bm assignment to that team
+	// set the default bm assignment for that token to that team
 	acResp := appConfigResponse{}
 	s.DoJSON("PATCH", "/api/latest/fleet/config", json.RawMessage(fmt.Sprintf(`{
 		"mdm": {
-			"apple_bm_default_team": %q
+			"apple_business_manager": [{
+			  "organization_name": %q,
+			  "macos_team": %q,
+			  "ios_team": %q,
+			  "ipados_team": %q
+			}]
 		}
-	}`, tm.Name)), http.StatusOK, &acResp)
+	}`, tmOrgName, tm.Name, tm.Name, tm.Name)), http.StatusOK, &acResp)
+	t.Cleanup(func() {
+		s.DoJSON("PATCH", "/api/latest/fleet/config", json.RawMessage(`{
+			"mdm": {
+				"apple_business_manager": []
+			}
+		}`), http.StatusOK, &acResp)
+	})
 
-	// try again, this time we get a default team in the response
-	getAppleBMResp = getAppleBMResponse{}
-	s.DoJSON("GET", "/api/latest/fleet/abm", nil, http.StatusOK, &getAppleBMResp)
-	require.NoError(t, getAppleBMResp.Err)
-	require.Equal(t, "abc", getAppleBMResp.AppleID)
-	require.Equal(t, "test_org", getAppleBMResp.OrgName)
-	require.Equal(t, s.server.URL+"/mdm/apple/mdm", getAppleBMResp.MDMServerURL)
-	require.Equal(t, tm.Name, getAppleBMResp.DefaultTeam)
+	// try again, this time we get team assignments in the response
+	tokensResp = listABMTokensResponse{}
+	s.DoJSON("GET", "/api/latest/fleet/abm_tokens", nil, http.StatusOK, &tokensResp)
+
+	tok = s.getABMTokenByName(tmOrgName, tokensResp.Tokens)
+	require.NotNil(t, tok)
+	require.False(t, tok.TermsExpired)
+	require.Equal(t, "abc", tok.AppleID)
+	require.Equal(t, tmOrgName, tok.OrganizationName)
+	require.Equal(t, s.server.URL+"/mdm/apple/mdm", tok.MDMServerURL)
+	require.Equal(t, tm.Name, tok.MacOSTeam.Name)
+	require.Equal(t, tm.Name, tok.IOSTeam.Name)
+	require.Equal(t, tm.Name, tok.IPadOSTeam.Name)
+}
+
+func (s *integrationMDMTestSuite) getABMTokenByName(orgName string, tokens []*fleet.ABMToken) *fleet.ABMToken {
+	for _, tok := range tokens {
+		if tok.OrganizationName == orgName {
+			return tok
+		}
+	}
+
+	return nil
 }
 
 func (s *integrationMDMTestSuite) TestABMExpiredToken() {
 	t := s.T()
+
+	s.enableABM(t.Name())
+
 	var returnType string
-	s.mockDEPResponse(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	s.mockDEPResponse(t.Name(), http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		switch returnType {
 		case "not_signed":
 			w.WriteHeader(http.StatusForbidden)
@@ -834,27 +916,43 @@ func (s *integrationMDMTestSuite) TestABMExpiredToken() {
 	config := s.getConfig()
 	require.False(t, config.MDM.AppleBMTermsExpired)
 
+	ctx := context.Background()
+	fleetSyncer := apple_mdm.NewDEPService(s.ds, s.depStorage, s.logger)
+
 	// not signed error flips the AppleBMTermsExpired flag
 	returnType = "not_signed"
-	res := s.DoRaw("GET", "/api/latest/fleet/abm", nil, http.StatusBadRequest)
-	errMsg := extractServerErrorText(res.Body)
-	require.Contains(t, errMsg, "DEP auth error: 403 Forbidden")
-
+	err := fleetSyncer.RunAssigner(ctx)
+	require.ErrorContains(t, err, "T_C_NOT_SIGNED")
+	var tokensResp listABMTokensResponse
+	s.DoJSON("GET", "/api/latest/fleet/abm_tokens", nil, http.StatusOK, &tokensResp)
+	tok := s.getABMTokenByName(t.Name(), tokensResp.Tokens)
+	require.NotNil(t, tok)
+	require.True(t, tok.TermsExpired)
 	config = s.getConfig()
 	require.True(t, config.MDM.AppleBMTermsExpired)
 
 	// a successful call clears it
 	returnType = "success"
-	s.DoRaw("GET", "/api/latest/fleet/abm", nil, http.StatusOK)
+	err = fleetSyncer.RunAssigner(ctx)
+	require.NoError(t, err)
+	tokensResp = listABMTokensResponse{}
+	s.DoJSON("GET", "/api/latest/fleet/abm_tokens", nil, http.StatusOK, &tokensResp)
+	tok = s.getABMTokenByName(t.Name(), tokensResp.Tokens)
+	require.NotNil(t, tok)
+	require.False(t, tok.TermsExpired)
 
 	config = s.getConfig()
 	require.False(t, config.MDM.AppleBMTermsExpired)
 
-	// an unauthorized call returns 400 but does not flip the terms expired flag
+	// an unauthorized call does not flip the terms expired flag
 	returnType = "unauthorized"
-	res = s.DoRaw("GET", "/api/latest/fleet/abm", nil, http.StatusBadRequest)
-	errMsg = extractServerErrorText(res.Body)
-	require.Contains(t, errMsg, "Apple Business Manager certificate or server token is invalid")
+	err = fleetSyncer.RunAssigner(ctx)
+	require.ErrorContains(t, err, "DEP auth error")
+	tokensResp = listABMTokensResponse{}
+	s.DoJSON("GET", "/api/latest/fleet/abm_tokens", nil, http.StatusOK, &tokensResp)
+	tok = s.getABMTokenByName(t.Name(), tokensResp.Tokens)
+	require.NotNil(t, tok)
+	require.False(t, tok.TermsExpired)
 
 	config = s.getConfig()
 	require.False(t, config.MDM.AppleBMTermsExpired)
@@ -955,6 +1053,7 @@ func createHostThenEnrollMDM(ds fleet.Datastore, fleetServerURL string, t *testi
 		NodeKey:         ptr.String(t.Name() + uuid.New().String()),
 		Hostname:        fmt.Sprintf("%sfoo.local", t.Name()),
 		Platform:        "darwin",
+		HardwareModel:   "MacBookPro16,1",
 
 		UUID:           mdmDevice.UUID,
 		HardwareSerial: mdmDevice.SerialNumber,
@@ -1004,7 +1103,6 @@ func (s *integrationMDMTestSuite) createAppleMobileHostThenEnrollMDM(platform st
 	require.NoError(t, err)
 
 	return fleetHost, mdmDevice
-
 }
 
 func createWindowsHostThenEnrollMDM(ds fleet.Datastore, fleetServerURL string, t *testing.T) (*fleet.Host, *mdmtest.TestWindowsMDMClient) {
@@ -1038,7 +1136,7 @@ func (s *integrationMDMTestSuite) TestDeviceMDMManualEnroll() {
 	s.DoRaw("GET", "/api/latest/fleet/device/invalid_token/mdm/apple/manual_enrollment_profile", nil, http.StatusUnauthorized)
 
 	// valid token downloads the profile
-	s.downloadAndVerifyEnrollmentProfile("/api/latest/fleet/device/" + token + "/mdm/apple/manual_enrollment_profile")
+	s.downloadAndVerifyOTAEnrollmentProfile("/api/latest/fleet/device/" + token + "/mdm/apple/manual_enrollment_profile")
 }
 
 func (s *integrationMDMTestSuite) TestAppleMDMDeviceEnrollment() {
@@ -1213,7 +1311,7 @@ func (s *integrationMDMTestSuite) TestGetMDMCSR() {
 	// Validate errors if no private key is set
 	testSetEmptyPrivateKey = true
 	t.Cleanup(func() { testSetEmptyPrivateKey = false })
-	s.uploadDataViaForm("/api/latest/fleet/mdm/apple/apns_certificate", "certificate", "certificate.pem", []byte("-----BEGIN CERTIFICATE-----\nZm9vCg==\n-----END CERTIFICATE-----"), http.StatusInternalServerError, "Couldn't upload APNs certificate. Missing required private key. Learn how to configure the private key here: https://fleetdm.com/learn-more-about/fleet-server-private-key")
+	s.uploadDataViaForm("/api/latest/fleet/mdm/apple/apns_certificate", "certificate", "certificate.pem", []byte("-----BEGIN CERTIFICATE-----\nZm9vCg==\n-----END CERTIFICATE-----"), http.StatusInternalServerError, "Couldn't upload APNs certificate. Missing required private key. Learn how to configure the private key here: https://fleetdm.com/learn-more-about/fleet-server-private-key", nil)
 
 	r := s.Do("GET", "/api/latest/fleet/mdm/apple/request_csr", getMDMAppleCSRRequest{}, http.StatusInternalServerError)
 	require.Contains(t, extractServerErrorText(r.Body), "Couldn't download signed CSR. Missing required private key. Learn how to configure the private key here: https://fleetdm.com/learn-more-about/fleet-server-private-key")
@@ -1231,7 +1329,7 @@ func (s *integrationMDMTestSuite) TestGetMDMCSR() {
 	require.Nil(t, assets)
 
 	// trying to upload a certificate without generating a private key first is not allowed
-	s.uploadDataViaForm("/api/latest/fleet/mdm/apple/apns_certificate", "certificate", "certificate.pem", []byte("-----BEGIN CERTIFICATE-----\nZm9vCg==\n-----END CERTIFICATE-----"), http.StatusBadRequest, "Please generate a private key first.")
+	s.uploadDataViaForm("/api/latest/fleet/mdm/apple/apns_certificate", "certificate", "certificate.pem", []byte("-----BEGIN CERTIFICATE-----\nZm9vCg==\n-----END CERTIFICATE-----"), http.StatusBadRequest, "Please generate a private key first.", nil)
 
 	// Check that we return bad gateway if the website API errors
 	s.FailNextCSRRequestWith(http.StatusInternalServerError)
@@ -1240,14 +1338,22 @@ func (s *integrationMDMTestSuite) TestGetMDMCSR() {
 	require.Len(t, errResp.Errors, 1)
 	require.Contains(t, errResp.Errors[0].Reason, "FleetDM CSR request failed")
 
+	// Check that we return bad request if the website API does (it will do this in case of an
+	// invalid email address
+	s.FailNextCSRRequestWith(http.StatusUnprocessableEntity)
+	errResp = validationErrResp{}
+	s.DoJSON("GET", "/api/latest/fleet/mdm/apple/request_csr", getMDMAppleCSRRequest{}, http.StatusUnprocessableEntity, &errResp)
+	require.Len(t, errResp.Errors, 1)
+	require.Contains(t, errResp.Errors[0].Reason, "this email address is not valid")
+
 	// Invalid APNS cert upload attempt
-	s.uploadDataViaForm("/api/latest/fleet/mdm/apple/apns_certificate", "certificate", "certificate.pem", []byte("invalid-cert"), http.StatusUnprocessableEntity, "Invalid certificate. Please provide a valid certificate from Apple Push Certificate Portal.")
+	s.uploadDataViaForm("/api/latest/fleet/mdm/apple/apns_certificate", "certificate", "certificate.pem", []byte("invalid-cert"), http.StatusUnprocessableEntity, "Invalid certificate. Please provide a valid certificate from Apple Push Certificate Portal.", nil)
 
 	// simulate a renew flow
 	s.appleCoreCertsSetup()
 }
 
-func (s *integrationMDMTestSuite) uploadDataViaForm(endpoint, fieldName, fileName string, data []byte, expectedStatus int, wantErr string) {
+func (s *integrationMDMTestSuite) uploadDataViaForm(endpoint, fieldName, fileName string, data []byte, expectedStatus int, wantErr string, response any) {
 	t := s.T()
 
 	var b bytes.Buffer
@@ -1272,6 +1378,11 @@ func (s *integrationMDMTestSuite) uploadDataViaForm(endpoint, fieldName, fileNam
 		errMsg := extractServerErrorText(res.Body)
 		assert.Contains(t, errMsg, wantErr)
 	}
+
+	if response != nil {
+		err := json.NewDecoder(res.Body).Decode(&response)
+		require.NoError(t, err)
+	}
 }
 
 func (s *integrationMDMTestSuite) TestMDMAppleUnenroll() {
@@ -1326,8 +1437,8 @@ func (s *integrationMDMTestSuite) TestMDMAppleUnenroll() {
 	// 3 profiles added + 1 profile with fleetd configuration + 1 root CA config
 	require.Len(t, *hostResp.Host.MDM.Profiles, 5)
 
-	// try to unenroll the host, fails since the host doesn't respond
-	s.Do("DELETE", fmt.Sprintf("/api/latest/fleet/hosts/%d/mdm", h.ID), nil, http.StatusGatewayTimeout)
+	// returns success, but this is effectively a no-op because the host isn't enrolled yet.
+	s.Do("DELETE", fmt.Sprintf("/api/latest/fleet/hosts/%d/mdm", h.ID), nil, http.StatusOK)
 
 	// we're going to modify this mock, make sure we restore its default
 	originalPushMock := s.pushProvider.PushFunc
@@ -1624,6 +1735,42 @@ func (s *integrationMDMTestSuite) TestDiskEncryptionSharedSetting() {
 	checkConfigSetSucceeds()
 }
 
+func (s *integrationMDMTestSuite) TestEscrowBuddyBackwardsCompat() {
+	t := s.T()
+	ctx := context.Background()
+
+	// create a host
+	host, _ := createHostThenEnrollMDM(s.ds, s.server.URL, t)
+	orbitKey := setOrbitEnrollment(t, host, s.ds)
+	host.OrbitNodeKey = &orbitKey
+
+	// install a filevault profile for that host
+	acResp := appConfigResponse{}
+	s.DoJSON("PATCH", "/api/latest/fleet/config", json.RawMessage(`{
+		"mdm": { "enable_disk_encryption": true }
+  }`), http.StatusOK, &acResp)
+	assert.True(t, acResp.MDM.EnableDiskEncryption.Value)
+
+	// set the status as non-decryptable so a notification should be sent
+	err := s.ds.SetOrUpdateHostDiskEncryptionKey(ctx, host.ID, "", "", ptr.Bool(false))
+	require.NoError(t, err)
+
+	// notification is false because the escrow buddy capability is not set
+	orbitConfigResp := orbitGetConfigResponse{}
+	s.DoJSON("POST", "/api/fleet/orbit/config", json.RawMessage(fmt.Sprintf(`{"orbit_node_key": %q}`, *host.OrbitNodeKey)), http.StatusOK, &orbitConfigResp)
+	require.False(t, orbitConfigResp.Notifications.RotateDiskEncryptionKey)
+
+	// send the request again, this time with the right header
+	orbitConfigResp = orbitGetConfigResponse{}
+	res := s.DoRawWithHeaders("POST", "/api/fleet/orbit/config", json.RawMessage(fmt.Sprintf(`{"orbit_node_key": %q}`, *host.OrbitNodeKey)), http.StatusOK, map[string]string{
+		"Authorization":          fmt.Sprintf("Bearer %s", s.token),
+		fleet.CapabilitiesHeader: string(fleet.CapabilityEscrowBuddy),
+	})
+	err = json.NewDecoder(res.Body).Decode(&orbitConfigResp)
+	require.NoError(t, err)
+	require.True(t, orbitConfigResp.Notifications.RotateDiskEncryptionKey)
+}
+
 func (s *integrationMDMTestSuite) TestMDMAppleHostDiskEncryption() {
 	t := s.T()
 	ctx := context.Background()
@@ -2544,13 +2691,28 @@ func (s *integrationMDMTestSuite) TestFleetdConfiguration() {
 	require.NoError(t, err)
 	s.assertConfigProfilesByIdentifier(&tm.ID, mobileconfig.FleetdConfigPayloadIdentifier, false)
 
+	// upload an ABM token
+	s.enableABM(t.Name())
+
 	// set the default bm assignment to that team
 	acResp := appConfigResponse{}
 	s.DoJSON("PATCH", "/api/latest/fleet/config", json.RawMessage(fmt.Sprintf(`{
 		"mdm": {
-			"apple_bm_default_team": %q
+			"apple_business_manager": [{
+			  "organization_name": %q,
+			  "macos_team": %q,
+			  "ios_team": %q,
+			  "ipados_team": %q
+			}]
 		}
-	}`, tm.Name)), http.StatusOK, &acResp)
+	}`, t.Name(), tm.Name, tm.Name, tm.Name)), http.StatusOK, &acResp)
+	t.Cleanup(func() {
+		s.DoJSON("PATCH", "/api/latest/fleet/config", json.RawMessage(`{
+			"mdm": {
+				"apple_business_manager": []
+			}
+		}`), http.StatusOK, &acResp)
+	})
 
 	// the team doesn't have any enroll secrets yet, a profile is created using the global enroll secret
 	s.awaitTriggerProfileSchedule(t)
@@ -2951,6 +3113,10 @@ func (s *integrationMDMTestSuite) TestBootstrapPackage() {
 
 func (s *integrationMDMTestSuite) TestBootstrapPackageStatus() {
 	t := s.T()
+
+	abmOrgName := "abm_org"
+	s.enableABM(abmOrgName)
+
 	pkg, err := os.ReadFile(filepath.Join("testdata", "bootstrap-packages", "signed.pkg"))
 	require.NoError(t, err)
 
@@ -3063,9 +3229,8 @@ func (s *integrationMDMTestSuite) TestBootstrapPackageStatus() {
 	})
 	require.NoError(t, err)
 
-	ch := make(chan bool)
 	mockRespDevices := noTeamDevices
-	s.mockDEPResponse(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	s.mockDEPResponse(abmOrgName, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.WriteHeader(http.StatusOK)
 		encoder := json.NewEncoder(w)
 		switch r.URL.Path {
@@ -3086,7 +3251,6 @@ func (s *integrationMDMTestSuite) TestBootstrapPackageStatus() {
 			err := encoder.Encode(godep.DeviceResponse{Devices: depResp})
 			require.NoError(t, err)
 		case "/profile/devices":
-			ch <- true
 			_, _ = w.Write([]byte(`{}`))
 		default:
 			_, _ = w.Write([]byte(`{}`))
@@ -3094,9 +3258,7 @@ func (s *integrationMDMTestSuite) TestBootstrapPackageStatus() {
 	}))
 
 	// trigger a dep sync
-	_, err = s.depSchedule.Trigger()
-	require.NoError(t, err)
-	<-ch
+	s.runDEPSchedule()
 
 	var summaryResp getMDMAppleBootstrapPackageSummaryResponse
 	s.DoJSON("GET", "/api/latest/fleet/bootstrap/summary", nil, http.StatusOK, &summaryResp)
@@ -3110,15 +3272,25 @@ func (s *integrationMDMTestSuite) TestBootstrapPackageStatus() {
 	acResp := appConfigResponse{}
 	s.DoJSON("PATCH", "/api/latest/fleet/config", json.RawMessage(fmt.Sprintf(`{
 		"mdm": {
-			"apple_bm_default_team": %q
+			"apple_business_manager": [{
+			  "organization_name": %q,
+			  "macos_team": %q,
+			  "ios_team": %q,
+			  "ipados_team": %q
+			}]
 		}
-	}`, team.Name)), http.StatusOK, &acResp)
+	}`, abmOrgName, team.Name, team.Name, team.Name)), http.StatusOK, &acResp)
+	t.Cleanup(func() {
+		s.DoJSON("PATCH", "/api/latest/fleet/config", json.RawMessage(`{
+			"mdm": {
+				"apple_business_manager": []
+			}
+		}`), http.StatusOK, &acResp)
+	})
 
 	// trigger a dep sync
 	mockRespDevices = teamDevices
-	_, err = s.depSchedule.Trigger()
-	require.NoError(t, err)
-	<-ch
+	s.runDEPSchedule()
 
 	summaryResp = getMDMAppleBootstrapPackageSummaryResponse{}
 	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/bootstrap/summary?team_id=%d", team.ID), nil, http.StatusOK, &summaryResp)
@@ -3381,11 +3553,6 @@ func (s *integrationMDMTestSuite) TestMigrateMDMDeviceWebhook() {
 	s.Do("POST", fmt.Sprintf("/api/v1/fleet/device/%s/migrate_mdm", "good-token"), nil, http.StatusBadRequest)
 	require.False(t, webhookCalled)
 
-	// host is not DEP so migration is not allowed
-	require.NoError(t, s.ds.SetOrUpdateMDMData(context.Background(), h.ID, !isServer, enrolled, mdmURL, !installedFromDEP, mdmName, ""))
-	s.Do("POST", fmt.Sprintf("/api/v1/fleet/device/%s/migrate_mdm", "good-token"), nil, http.StatusBadRequest)
-	require.False(t, webhookCalled)
-
 	// host is not enrolled to MDM so migration is not allowed
 	require.NoError(t, s.ds.SetOrUpdateMDMData(context.Background(), h.ID, !isServer, !enrolled, mdmURL, installedFromDEP, mdmName, ""))
 	s.Do("POST", fmt.Sprintf("/api/v1/fleet/device/%s/migrate_mdm", "good-token"), nil, http.StatusBadRequest)
@@ -3408,8 +3575,10 @@ func (s *integrationMDMTestSuite) TestMigrateMDMDeviceWebhook() {
 	s.Do("POST", fmt.Sprintf("/api/v1/fleet/device/%s/migrate_mdm", "good-token"), nil, http.StatusBadRequest)
 	require.False(t, webhookCalled)
 
+	s.enableABM(t.Name())
+
 	// simulate that the device is assigned to Fleet in ABM
-	s.mockDEPResponse(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	s.mockDEPResponse(t.Name(), http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.WriteHeader(http.StatusOK)
 		switch r.URL.Path {
 		case "/session":
@@ -3473,6 +3642,16 @@ func (s *integrationMDMTestSuite) TestMigrateMDMDeviceWebhook() {
 	require.True(t, webhookCalled)
 	webhookCalled = false
 
+	// host is manually enrolled, which is allowed
+	h.RefetchCriticalQueriesUntil = ptr.Time(time.Now().Add(-1 * time.Minute))
+	err = s.ds.UpdateHost(context.Background(), h)
+	require.NoError(t, err)
+
+	require.NoError(t, s.ds.SetOrUpdateMDMData(context.Background(), h.ID, !isServer, enrolled, mdmURL, !installedFromDEP, mdmName, ""))
+	s.Do("POST", fmt.Sprintf("/api/v1/fleet/device/%s/migrate_mdm", "good-token"), nil, http.StatusNoContent)
+	require.True(t, webhookCalled)
+	webhookCalled = false
+
 	// the refetch critical queries timestamp has been updated to the future
 	h, err = s.ds.Host(context.Background(), h.ID)
 	require.NoError(t, err)
@@ -3537,8 +3716,9 @@ func (s *integrationMDMTestSuite) TestMigrateMDMDeviceWebhookErrors() {
 	s.Do("POST", fmt.Sprintf("/api/v1/fleet/device/%s/migrate_mdm", "good-token"), nil, http.StatusBadRequest)
 	require.False(t, webhookCalled)
 
+	s.enableABM(t.Name())
 	// simulate that the device is assigned to Fleet in ABM
-	s.mockDEPResponse(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	s.mockDEPResponse(t.Name(), http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.WriteHeader(http.StatusOK)
 		switch r.URL.Path {
 		case "/session":
@@ -3587,7 +3767,7 @@ func (s *integrationMDMTestSuite) TestMigrateMDMDeviceWebhookErrors() {
 func (s *integrationMDMTestSuite) TestMDMMacOSSetup() {
 	t := s.T()
 
-	s.mockDEPResponse(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	s.mockDEPResponse(t.Name(), http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.WriteHeader(http.StatusOK)
 		encoder := json.NewEncoder(w)
 		switch r.URL.Path {
@@ -4005,15 +4185,156 @@ func (s *integrationMDMTestSuite) TestMacosSetupAssistant() {
 	ctx := context.Background()
 	t := s.T()
 
+	const defaultProf = `{
+	"profile_name": "%s",
+	"allow_pairing": true,
+	"is_mdm_removable": true,
+	"org_magic": "1",
+	"language": "en",
+	"region": "US",
+	"skip_setup_items": [
+		"Accessibility",
+		"Appearance",
+		"AppleID",
+		"AppStore",
+		"Biometric",
+		"Diagnostics",
+		"FileVault",
+		"iCloudDiagnostics",
+		"iCloudStorage",
+		"Location",
+		"Payment",
+		"Privacy",
+		"Restore",
+		"ScreenTime",
+		"Siri",
+		"TermsOfAddress",
+		"TOS",
+		"UnlockWithWatch"
+	]
+}
+`
+
+	// Associate the token with the team
+	s.enableABM(t.Name())
+	// start a server that will mock the Apple DEP API
+	s.mockDEPResponse(t.Name(), http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		encoder := json.NewEncoder(w)
+		switch r.URL.Path {
+		case "/session":
+			_, _ = w.Write([]byte(`{"auth_session_token": "session123"}`))
+		case "/account":
+			_, _ = w.Write([]byte(fmt.Sprintf(`{"admin_id": "admin123", "org_name": "%s"}`, "foo")))
+		case "/profile":
+			body, err := io.ReadAll(r.Body)
+			require.NoError(t, err)
+			var prof godep.Profile
+			require.NoError(t, json.Unmarshal(body, &prof))
+			switch {
+			case len(prof.ProfileName) > 125:
+				w.WriteHeader(http.StatusBadRequest)
+				require.NoError(t, encoder.Encode(map[string]any{"error": "CONFIG_NAME_INVALID"}))
+			case prof.ProfileName == "":
+				w.WriteHeader(http.StatusBadRequest)
+				require.NoError(t, encoder.Encode(map[string]any{"error": "CONFIG_NAME_REQUIRED"}))
+			case len(prof.ConfigurationWebURL) > 125:
+				w.WriteHeader(http.StatusBadRequest)
+				require.NoError(t, encoder.Encode(map[string]any{"error": "CONFIG_URL_INVALID"}))
+			case len(prof.Department) > 125:
+				w.WriteHeader(http.StatusBadRequest)
+				require.NoError(t, encoder.Encode(map[string]any{"error": "DEPARTMENT_INVALID"}))
+			case len(prof.SupportPhoneNumber) > 50:
+				w.WriteHeader(http.StatusBadRequest)
+				require.NoError(t, encoder.Encode(map[string]any{"error": "SUPPORT_PHONE_INVALID"}))
+			case len(prof.SupportEmailAddress) > 250:
+				w.WriteHeader(http.StatusBadRequest)
+				require.NoError(t, encoder.Encode(map[string]any{"error": "SUPPORT_EMAIL_INVALID"}))
+			case len(prof.OrgMagic) > 256:
+				w.WriteHeader(http.StatusBadRequest)
+				require.NoError(t, encoder.Encode(map[string]any{"error": "MAGIC_INVALID"}))
+			case !prof.IsMDMRemovable && !prof.IsSupervised:
+				w.WriteHeader(http.StatusBadRequest)
+				require.NoError(t, encoder.Encode(map[string]any{"error": "FLAGS_INVALID"}))
+			default:
+				w.WriteHeader(http.StatusOK)
+				require.NoError(t, encoder.Encode(godep.ProfileResponse{ProfileUUID: "profile123"}))
+			}
+		}
+	}))
+
 	// get for no team returns 404
 	var getResp getMDMAppleSetupAssistantResponse
 	s.DoJSON("GET", "/api/latest/fleet/enrollment_profiles/automatic", nil, http.StatusNotFound, &getResp)
 	// get for non-existing team returns 404
 	s.DoJSON("GET", "/api/latest/fleet/enrollment_profiles/automatic", nil, http.StatusNotFound, &getResp, "team_id", "123")
 
-	// create a setup assistant for no team
-	noTeamProf := `{"x": 1}`
+	// Profile name too long
 	var createResp createMDMAppleSetupAssistantResponse
+	r := s.Do("POST", "/api/latest/fleet/enrollment_profiles/automatic", createMDMAppleSetupAssistantRequest{
+		TeamID:            nil,
+		Name:              "profile_name_too_long",
+		EnrollmentProfile: json.RawMessage(fmt.Sprintf(`{"profile_name": "%s"}`, strings.Repeat("a", 126))),
+	}, http.StatusUnprocessableEntity)
+	require.Contains(t, extractServerErrorText(r.Body), "CONFIG_NAME_INVALID")
+
+	// Profile name missing
+	r = s.Do("POST", "/api/latest/fleet/enrollment_profiles/automatic", createMDMAppleSetupAssistantRequest{
+		TeamID:            nil,
+		Name:              "profile_name_missing",
+		EnrollmentProfile: json.RawMessage(`{"profile_name": ""}`),
+	}, http.StatusUnprocessableEntity)
+	require.Contains(t, extractServerErrorText(r.Body), "CONFIG_NAME_REQUIRED")
+
+	// Config URL invalid
+	r = s.Do("POST", "/api/latest/fleet/enrollment_profiles/automatic", createMDMAppleSetupAssistantRequest{
+		TeamID:            nil,
+		Name:              "profile_name_missing",
+		EnrollmentProfile: json.RawMessage(fmt.Sprintf(`{"profile_name": "prof_name", "configuration_web_url": "%s"}`, strings.Repeat("a", 126))),
+	}, http.StatusUnprocessableEntity)
+	require.Contains(t, extractServerErrorText(r.Body), "CONFIG_URL_INVALID")
+
+	// Department invalid
+	r = s.Do("POST", "/api/latest/fleet/enrollment_profiles/automatic", createMDMAppleSetupAssistantRequest{
+		TeamID:            nil,
+		Name:              "profile_name_missing",
+		EnrollmentProfile: json.RawMessage(fmt.Sprintf(`{"profile_name": "prof_name", "configuration_web_url": "https://example.com", "department": "%s"}`, strings.Repeat("a", 126))),
+	}, http.StatusUnprocessableEntity)
+	require.Contains(t, extractServerErrorText(r.Body), "DEPARTMENT_INVALID")
+
+	// Invalid support phone
+	r = s.Do("POST", "/api/latest/fleet/enrollment_profiles/automatic", createMDMAppleSetupAssistantRequest{
+		TeamID:            nil,
+		Name:              "profile_name_missing",
+		EnrollmentProfile: json.RawMessage(fmt.Sprintf(`{"profile_name": "prof_name", "configuration_web_url": "https://example.com", "department": "foo", "support_phone_number": "%s"}`, strings.Repeat("1", 51))),
+	}, http.StatusUnprocessableEntity)
+	require.Contains(t, extractServerErrorText(r.Body), "SUPPORT_PHONE_INVALID")
+
+	// Invalid support email
+	r = s.Do("POST", "/api/latest/fleet/enrollment_profiles/automatic", createMDMAppleSetupAssistantRequest{
+		TeamID:            nil,
+		Name:              "profile_name_missing",
+		EnrollmentProfile: json.RawMessage(fmt.Sprintf(`{"profile_name": "prof_name", "configuration_web_url": "https://example.com", "department": "foo", "support_phone_number": "555-123-4567", "support_email_address": "%s"}`, strings.Repeat("1", 251))),
+	}, http.StatusUnprocessableEntity)
+	require.Contains(t, extractServerErrorText(r.Body), "SUPPORT_EMAIL_INVALID")
+
+	// Invalid magic
+	r = s.Do("POST", "/api/latest/fleet/enrollment_profiles/automatic", createMDMAppleSetupAssistantRequest{
+		TeamID:            nil,
+		Name:              "profile_name_missing",
+		EnrollmentProfile: json.RawMessage(fmt.Sprintf(`{"profile_name": "prof_name", "configuration_web_url": "https://example.com", "department": "foo", "support_phone_number": "555-123-4567", "support_email_address": "support@example.com", "org_magic": "%s"}`, strings.Repeat("1", 257))),
+	}, http.StatusUnprocessableEntity)
+	require.Contains(t, extractServerErrorText(r.Body), "MAGIC_INVALID")
+
+	// Invalid flag combo
+	r = s.Do("POST", "/api/latest/fleet/enrollment_profiles/automatic", createMDMAppleSetupAssistantRequest{
+		TeamID:            nil,
+		Name:              "profile_name_missing",
+		EnrollmentProfile: json.RawMessage(`{"profile_name": "prof_name", "configuration_web_url": "https://example.com", "department": "foo", "support_phone_number": "555-123-4567", "support_email_address": "support@example.com", "org_magic": "1", "is_mdm_removable": false, "is_supervised": false}`),
+	}, http.StatusUnprocessableEntity)
+	require.Contains(t, extractServerErrorText(r.Body), "FLAGS_INVALID")
+
+	// create a setup assistant for no team
+	noTeamProf := fmt.Sprintf(defaultProf, "no-team")
 	s.DoJSON("POST", "/api/latest/fleet/enrollment_profiles/automatic", createMDMAppleSetupAssistantRequest{
 		TeamID:            nil,
 		Name:              "no-team",
@@ -4033,7 +4354,7 @@ func (s *integrationMDMTestSuite) TestMacosSetupAssistant() {
 		Description: "desc",
 	})
 	require.NoError(t, err)
-	tmProf := `{"y": 1}`
+	tmProf := fmt.Sprintf(defaultProf, "team1")
 	s.DoJSON("POST", "/api/latest/fleet/enrollment_profiles/automatic", createMDMAppleSetupAssistantRequest{
 		TeamID:            &tm.ID,
 		Name:              "team1",
@@ -4049,7 +4370,7 @@ func (s *integrationMDMTestSuite) TestMacosSetupAssistant() {
 		fmt.Sprintf(`{"name": "team1", "team_id": %d, "team_name": %q}`, tm.ID, tm.Name), 0)
 
 	// update no-team
-	noTeamProf = `{"x": 2}`
+	noTeamProf = fmt.Sprintf(defaultProf, "no-team2")
 	s.DoJSON("POST", "/api/latest/fleet/enrollment_profiles/automatic", createMDMAppleSetupAssistantRequest{
 		TeamID:            nil,
 		Name:              "no-team2",
@@ -4059,7 +4380,7 @@ func (s *integrationMDMTestSuite) TestMacosSetupAssistant() {
 		`{"name": "no-team2", "team_id": null, "team_name": null}`, 0)
 
 	// update team
-	tmProf = `{"y": 2}`
+	tmProf = fmt.Sprintf(defaultProf, "team2")
 	s.DoJSON("POST", "/api/latest/fleet/enrollment_profiles/automatic", createMDMAppleSetupAssistantRequest{
 		TeamID:            &tm.ID,
 		Name:              "team2",
@@ -4094,7 +4415,7 @@ func (s *integrationMDMTestSuite) TestMacosSetupAssistant() {
 
 	// update team with only a setup assistant JSON change, should detect it
 	// and create a new activity (name is the same)
-	tmProf = `{"y": 3}`
+	tmProf = fmt.Sprintf(defaultProf, "update")
 	s.DoJSON("POST", "/api/latest/fleet/enrollment_profiles/automatic", createMDMAppleSetupAssistantRequest{
 		TeamID:            &tm.ID,
 		Name:              "team2",
@@ -4170,7 +4491,7 @@ func (s *integrationMDMTestSuite) TestMacosSetupAssistant() {
 		Description: "desc2",
 	})
 	require.NoError(t, err)
-	tm2Prof := `{"z": 1}`
+	tm2Prof := fmt.Sprintf(defaultProf, "teamB")
 	s.DoJSON("POST", "/api/latest/fleet/enrollment_profiles/automatic", createMDMAppleSetupAssistantRequest{
 		TeamID:            &tm2.ID,
 		Name:              "teamB",
@@ -4183,6 +4504,40 @@ func (s *integrationMDMTestSuite) TestMacosSetupAssistant() {
 	s.Do("DELETE", "/api/latest/fleet/enrollment_profiles/automatic", nil, http.StatusNoContent, "team_id", fmt.Sprint(tm2.ID))
 	s.lastActivityMatches(fleet.ActivityTypeDeletedMacosSetupAssistant{}.ActivityName(),
 		fmt.Sprintf(`{"name": "teamB", "team_id": %d, "team_name": %q}`, tm2.ID, tm2.Name), 0)
+
+	// Try with a team that has no relevant ABM tokens
+	teamNoABM, err := s.ds.NewTeam(ctx, &fleet.Team{
+		Name:        t.Name() + "no_abm",
+		Description: "no abm",
+	})
+	require.NoError(t, err)
+	// Adding another, unrelated token to the DB means that this team (which has no hosts and is not
+	// a default team for any token) will not have any relevant tokens and thus we don't know which
+	// token to use to hit the Apple APIs.
+	otherOrg := t.Name() + "some_other_org"
+	s.enableABM(otherOrg)
+	// mysql.CreateABMKeyCertIfNotExists(t, s.ds)
+	// mysql.CreateAndSetABMToken(t, s.ds, "nurv")
+	// err = s.depStorage.StoreConfig(ctx, "nurv", &nanodep_client.Config{BaseURL: srv.URL})
+	s.mockDEPResponse(otherOrg, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		encoder := json.NewEncoder(w)
+		switch r.URL.Path {
+		case "/session":
+			_, _ = w.Write([]byte(`{"auth_session_token": "session123"}`))
+		case "/account":
+			_, _ = w.Write([]byte(fmt.Sprintf(`{"admin_id": "admin123", "org_name": "%s"}`, "foo")))
+		case "/profile":
+			w.WriteHeader(http.StatusOK)
+			require.NoError(t, encoder.Encode(godep.ProfileResponse{ProfileUUID: "profile123"}))
+		}
+	}))
+	require.NoError(t, err)
+	r = s.Do("POST", "/api/latest/fleet/enrollment_profiles/automatic", createMDMAppleSetupAssistantRequest{
+		TeamID:            &teamNoABM.ID,
+		Name:              "profile_name_missing",
+		EnrollmentProfile: json.RawMessage(fmt.Sprintf(defaultProf, "no_abm")),
+	}, http.StatusUnprocessableEntity)
+	require.Contains(t, extractServerErrorText(r.Body), "No relevant ABM tokens found. Please set this team as a default team for an ABM token.")
 }
 
 // only asserts the profile identifier, status and operation (per host)
@@ -4327,7 +4682,9 @@ func (s *integrationMDMTestSuite) assertWindowsConfigProfilesByName(teamID *uint
 	}
 	var cfgProfs []*fleet.MDMWindowsConfigProfile
 	mysql.ExecAdhocSQL(t, s.ds, func(q sqlx.ExtContext) error {
-		return sqlx.SelectContext(context.Background(), q, &cfgProfs, `SELECT * FROM mdm_windows_configuration_profiles WHERE team_id = ?`, teamID)
+		return sqlx.SelectContext(context.Background(), q, &cfgProfs,
+			`SELECT profile_uuid, team_id, name, syncml, created_at, uploaded_at FROM mdm_windows_configuration_profiles WHERE team_id = ?`,
+			teamID)
 	})
 
 	label := "exist"
@@ -4657,8 +5014,9 @@ func (s *integrationMDMTestSuite) TestSSO() {
 	mdmDevice := mdmtest.NewTestMDMClientAppleDirect(mdmtest.AppleEnrollInfo{
 		SCEPChallenge: s.scepChallenge,
 	}, "MacBookPro16,1")
+	s.enableABM(t.Name())
 	var lastSubmittedProfile *godep.Profile
-	s.mockDEPResponse(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	s.mockDEPResponse(t.Name(), http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.WriteHeader(http.StatusOK)
 		switch r.URL.Path {
 		case "/session":
@@ -5148,6 +5506,45 @@ func (s *integrationMDMTestSuite) downloadAndVerifyEnrollmentProfile(path string
 	return s.verifyEnrollmentProfile(body, "")
 }
 
+func (s *integrationMDMTestSuite) downloadAndVerifyOTAEnrollmentProfile(path string) {
+	t := s.T()
+
+	resp := s.DoRaw("GET", path, nil, http.StatusOK)
+	rawProfile, err := io.ReadAll(resp.Body)
+	resp.Body.Close()
+	require.NoError(t, err)
+	require.Contains(t, resp.Header, "Content-Disposition")
+	require.Contains(t, resp.Header, "Content-Type")
+	require.Contains(t, resp.Header, "X-Content-Type-Options")
+	require.Contains(t, resp.Header.Get("Content-Disposition"), "attachment;")
+	require.Contains(t, resp.Header.Get("Content-Type"), "application/x-apple-aspen-config")
+	require.Contains(t, resp.Header.Get("X-Content-Type-Options"), "nosniff")
+	headerLen, err := strconv.Atoi(resp.Header.Get("Content-Length"))
+	require.NoError(t, err)
+	require.Equal(t, len(rawProfile), headerLen)
+
+	p7, err := pkcs7.Parse(rawProfile)
+	require.NoError(t, err)
+	rootCA := x509.NewCertPool()
+
+	assets, err := s.ds.GetAllMDMConfigAssetsByName(context.Background(), []fleet.MDMAssetName{
+		fleet.MDMAssetCACert,
+	})
+	require.NoError(t, err)
+
+	require.True(t, rootCA.AppendCertsFromPEM(assets[fleet.MDMAssetCACert].Value))
+	require.NoError(t, p7.VerifyWithChain(rootCA))
+
+	var otaEnrollmentProfile struct {
+		PayloadContent struct {
+			URL string `plist:"URL"`
+		} `plist:"PayloadContent"`
+	}
+	err = plist.Unmarshal(p7.Content, &otaEnrollmentProfile)
+	require.NoError(t, err)
+	require.Contains(t, otaEnrollmentProfile.PayloadContent.URL, s.getConfig().ServerSettings.ServerURL+"/api/v1/fleet/ota_enrollment")
+}
+
 func (s *integrationMDMTestSuite) verifyEnrollmentProfile(rawProfile []byte, enrollmentRef string) *enrollmentProfile {
 	t := s.T()
 	var profile enrollmentProfile
@@ -5196,6 +5593,8 @@ func (s *integrationMDMTestSuite) TestMDMMigration() {
 		"mdm": { "macos_migration": { "enable": true, "mode": "voluntary", "webhook_url": "https://example.com" } }
 	}`), http.StatusOK, &acResp)
 
+	s.enableABM(t.Name())
+
 	checkMigrationResponses := func(host *fleet.Host, token string) {
 		getDesktopResp := fleetDesktopResponse{}
 		res := s.DoRawNoAuth("GET", "/api/latest/fleet/device/"+token+"/desktop", nil, http.StatusOK)
@@ -5218,7 +5617,7 @@ func (s *integrationMDMTestSuite) TestMDMMigration() {
 
 		// simulate that the device is assigned to Fleet in ABM
 		profileAssignmentStatusResponse := fleet.DEPAssignProfileResponseSuccess
-		s.mockDEPResponse(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		s.mockDEPResponse(t.Name(), http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			w.WriteHeader(http.StatusOK)
 			switch r.URL.Path {
 			case "/session":
@@ -5449,6 +5848,37 @@ func (s *integrationMDMTestSuite) TestMDMMigration() {
 		require.True(t, orbitConfigResp.Notifications.NeedsMDMMigration)
 		require.False(t, orbitConfigResp.Notifications.RenewEnrollmentProfile)
 
+		// simulate a device that is manually enrolled to 3rd party
+		err = s.ds.SetOrUpdateMDMData(
+			ctx,
+			host.ID,
+			false,
+			true,
+			"https://simplemdm.com",
+			false,
+			fleet.WellKnownMDMSimpleMDM,
+			"",
+		)
+		require.NoError(t, err)
+		getDesktopResp = fleetDesktopResponse{}
+		res = s.DoRawNoAuth("GET", "/api/latest/fleet/device/"+token+"/desktop", nil, http.StatusOK)
+		require.NoError(t, json.NewDecoder(res.Body).Decode(&getDesktopResp))
+		require.NoError(t, res.Body.Close())
+		require.NoError(t, getDesktopResp.Err)
+		require.Zero(t, *getDesktopResp.FailingPolicies)
+		require.True(t, getDesktopResp.Notifications.NeedsMDMMigration)
+		require.False(t, getDesktopResp.Notifications.RenewEnrollmentProfile)
+		require.Equal(t, acResp.OrgInfo.OrgLogoURL, getDesktopResp.Config.OrgInfo.OrgLogoURL)
+		require.Equal(t, acResp.OrgInfo.OrgLogoURLLightBackground, getDesktopResp.Config.OrgInfo.OrgLogoURLLightBackground)
+		require.Equal(t, acResp.OrgInfo.ContactURL, getDesktopResp.Config.OrgInfo.ContactURL)
+		require.Equal(t, acResp.OrgInfo.OrgName, getDesktopResp.Config.OrgInfo.OrgName)
+		require.Equal(t, acResp.MDM.MacOSMigration.Mode, getDesktopResp.Config.MDM.MacOSMigration.Mode)
+
+		orbitConfigResp = orbitGetConfigResponse{}
+		s.DoJSON("POST", "/api/fleet/orbit/config", json.RawMessage(fmt.Sprintf(`{"orbit_node_key": %q}`, *host.OrbitNodeKey)), http.StatusOK, &orbitConfigResp)
+		require.True(t, orbitConfigResp.Notifications.NeedsMDMMigration)
+		require.False(t, orbitConfigResp.Notifications.RenewEnrollmentProfile)
+
 		// clean up nano tables
 		mysql.ExecAdhocSQL(t, s.ds, func(q sqlx.ExtContext) error {
 			_, err := q.ExecContext(context.Background(), `
@@ -7083,14 +7513,13 @@ func (s *integrationMDMTestSuite) TestMDMEnabledAndConfigured() {
 			Token:  uuid.New().String(),
 			Bytes:  []byte("foo"),
 			Sha256: []byte("foo-sha256"),
-		}))
+		}, nil))
 
 		// add new setup assistant
 		_, err := s.ds.SetOrUpdateMDMAppleSetupAssistant(ctx, &fleet.MDMAppleSetupAssistant{
-			TeamID:      teamID,
-			Name:        "bar",
-			ProfileUUID: uuid.New().String(),
-			Profile:     []byte("{}"),
+			TeamID:  teamID,
+			Name:    "bar",
+			Profile: []byte("{}"),
 		})
 		require.NoError(t, err)
 	}
@@ -7768,11 +8197,10 @@ func (s *integrationMDMTestSuite) runWorker() {
 }
 
 func (s *integrationMDMTestSuite) runDEPSchedule() {
-	ch := make(chan bool)
-	s.onDEPScheduleDone = func() { close(ch) }
-	_, err := s.depSchedule.Trigger()
+	ctx := context.Background()
+	fleetSyncer := apple_mdm.NewDEPService(s.ds, s.depStorage, s.logger)
+	err := fleetSyncer.RunAssigner(ctx)
 	require.NoError(s.T(), err)
-	<-ch
 }
 
 func (s *integrationMDMTestSuite) runIntegrationsSchedule() {
@@ -8505,18 +8933,38 @@ func (s *integrationMDMTestSuite) TestLockUnlockWipeMacOS() {
 	s.Do("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/lock", host.ID), nil, http.StatusNoContent)
 }
 
-func (s *integrationMDMTestSuite) TestZCustomConfigurationWebURL() {
+func (s *integrationMDMTestSuite) TestCustomConfigurationWebURL() {
 	t := s.T()
 
 	acResp := appConfigResponse{}
 	s.DoJSON("GET", "/api/latest/fleet/config", nil, http.StatusOK, &acResp)
 
+	s.enableABM(t.Name())
 	var lastSubmittedProfile *godep.Profile
-	s.mockDEPResponse(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	s.mockDEPResponse(t.Name(), http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.WriteHeader(http.StatusOK)
 		encoder := json.NewEncoder(w)
 
 		switch r.URL.Path {
+		case "/server/devices", "/devices/sync":
+			encoder := json.NewEncoder(w)
+			err := encoder.Encode(godep.DeviceResponse{
+				Devices: []godep.Device{
+					{
+						SerialNumber: "FAKE-1",
+						Model:        "Mac Mini",
+						OS:           "osx",
+						OpType:       "added",
+					},
+					{
+						SerialNumber: "FAKE-2",
+						Model:        "Mac Mini",
+						OS:           "osx",
+						OpType:       "added",
+					},
+				},
+			})
+			require.NoError(t, err)
 		case "/profile":
 			lastSubmittedProfile = &godep.Profile{}
 			rawProfile, err := io.ReadAll(r.Body)
@@ -8535,6 +8983,9 @@ func (s *integrationMDMTestSuite) TestZCustomConfigurationWebURL() {
 		}
 	}))
 
+	// run once to ingest the devices
+	s.runDEPSchedule()
+
 	// disable first to make sure we start in the desired state
 	acResp = appConfigResponse{}
 	s.DoJSON("PATCH", "/api/latest/fleet/config", json.RawMessage(`{
@@ -8563,6 +9014,7 @@ func (s *integrationMDMTestSuite) TestZCustomConfigurationWebURL() {
 
 	// assign the DEP profile and assert that contains the right values for the URL
 	s.runWorker()
+	require.NotNil(t, lastSubmittedProfile)
 	require.Contains(t, lastSubmittedProfile.ConfigurationWebURL, acResp.ServerSettings.ServerURL+"/mdm/sso")
 
 	// trying to set a custom configuration_web_url fails because end user authentication is enabled
@@ -8592,6 +9044,7 @@ func (s *integrationMDMTestSuite) TestZCustomConfigurationWebURL() {
 
 	// assign the DEP profile and assert that contains the right values for the URL
 	s.runWorker()
+	require.NotNil(t, lastSubmittedProfile)
 	require.Contains(t, lastSubmittedProfile.ConfigurationWebURL, acResp.ServerSettings.ServerURL+"/api/mdm/apple/enroll?token=")
 
 	// setting a custom configuration_web_url succeeds because user authentication is disabled
@@ -8604,6 +9057,7 @@ func (s *integrationMDMTestSuite) TestZCustomConfigurationWebURL() {
 
 	// assign the DEP profile and assert that contains the right values for the URL
 	s.runWorker()
+	require.NotNil(t, lastSubmittedProfile)
 	require.Contains(t, lastSubmittedProfile.ConfigurationWebURL, "https://foo.example.com")
 
 	// try to enable end user auth again, it fails because configuration_web_url is set
@@ -8640,8 +9094,13 @@ func (s *integrationMDMTestSuite) TestZCustomConfigurationWebURL() {
 	require.Len(t, applyResp.TeamIDsByName, 1)
 	teamID := applyResp.TeamIDsByName[t.Name()]
 
+	// transfer a host to the team to ensure all ABM calls are made
+	h, err := s.ds.HostByIdentifier(context.Background(), "FAKE-1")
+	require.NoError(t, err)
+	s.DoJSON("POST", "/api/latest/fleet/hosts/transfer", addHostsToTeamRequest{TeamID: &teamID, HostIDs: []uint{h.ID}}, http.StatusOK, &addHostsToTeamResponse{})
+
 	// re-set the global state to configure MDM SSO
-	err := s.ds.DeleteMDMAppleSetupAssistant(context.Background(), nil)
+	err = s.ds.DeleteMDMAppleSetupAssistant(context.Background(), nil)
 	require.NoError(t, err)
 	acResp = appConfigResponse{}
 	s.DoJSON("PATCH", "/api/latest/fleet/config", json.RawMessage(`{
@@ -8924,32 +9383,34 @@ func (s *integrationMDMTestSuite) TestRemoveFailedProfiles() {
 
 	ident := uuid.NewString()
 
+	mdmDeviceRespond := func(device *mdmtest.TestAppleMDMClient) {
+		cmd, err := device.Idle()
+		require.NoError(t, err)
+		for cmd != nil {
+			if cmd.Command.RequestType == "InstallProfile" {
+				var fullCmd micromdm.CommandPayload
+				require.NoError(t, plist.Unmarshal(cmd.Raw, &fullCmd))
+
+				if strings.Contains(string(fullCmd.Command.InstallProfile.Payload), ident) {
+					var errChain []mdm.ErrorChain
+					errChain = append(errChain, mdm.ErrorChain{ErrorCode: -102, ErrorDomain: "CPProfile", USEnglishDescription: "The profile is either missing some required information, or contains information in an invalid format."})
+					cmd, err = device.Err(cmd.CommandUUID, errChain)
+					require.NoError(t, err)
+					continue
+				}
+			}
+			cmd, err = device.Acknowledge(cmd.CommandUUID)
+			require.NoError(t, err)
+		}
+	}
+
 	globalProfiles := [][]byte{
 		mobileconfigForTest("N1", ident),
 		mobileconfigForTest("N2", "I2"),
 	}
 	s.Do("POST", "/api/v1/fleet/mdm/apple/profiles/batch", batchSetMDMAppleProfilesRequest{Profiles: globalProfiles}, http.StatusNoContent)
 	s.awaitTriggerProfileSchedule(t)
-
-	cmd, err := mdmDevice.Idle()
-	require.NoError(t, err)
-	for cmd != nil {
-		if cmd.Command.RequestType == "InstallProfile" {
-			var fullCmd micromdm.CommandPayload
-			require.NoError(t, plist.Unmarshal(cmd.Raw, &fullCmd))
-
-			if strings.Contains(string(fullCmd.Command.InstallProfile.Payload), ident) {
-				var errChain []mdm.ErrorChain
-				errChain = append(errChain, mdm.ErrorChain{ErrorCode: -102, ErrorDomain: "CPProfile", USEnglishDescription: "The profile is either missing some required information, or contains information in an invalid format."})
-				cmd, err = mdmDevice.Err(cmd.CommandUUID, errChain)
-				require.NoError(t, err)
-				continue
-			}
-		}
-		cmd, err = mdmDevice.Acknowledge(cmd.CommandUUID)
-		require.NoError(t, err)
-	}
-
+	mdmDeviceRespond(mdmDevice)
 	require.NoError(t, apple_mdm.VerifyHostMDMProfiles(context.Background(), s.ds, host, map[string]*fleet.HostMacOSProfile{
 		"I2": {Identifier: "I2", DisplayName: "I2", InstallDate: time.Now()},
 		"I1": {Identifier: "I1", DisplayName: "I1", InstallDate: time.Now()},
@@ -8957,24 +9418,7 @@ func (s *integrationMDMTestSuite) TestRemoveFailedProfiles() {
 
 	// Do another trigger + command fetching cycle, since we retry when a profile fails on install.
 	s.awaitTriggerProfileSchedule(t)
-	cmd, err = mdmDevice.Idle()
-	require.NoError(t, err)
-	for cmd != nil {
-		if cmd.Command.RequestType == "InstallProfile" {
-			var fullCmd micromdm.CommandPayload
-			require.NoError(t, plist.Unmarshal(cmd.Raw, &fullCmd))
-
-			if strings.Contains(string(fullCmd.Command.InstallProfile.Payload), ident) {
-				var errChain []mdm.ErrorChain
-				errChain = append(errChain, mdm.ErrorChain{ErrorCode: -102, ErrorDomain: "CPProfile", USEnglishDescription: "The profile is either missing some required information, or contains information in an invalid format."})
-				cmd, err = mdmDevice.Err(cmd.CommandUUID, errChain)
-				require.NoError(t, err)
-				continue
-			}
-		}
-		cmd, err = mdmDevice.Acknowledge(cmd.CommandUUID)
-		require.NoError(t, err)
-	}
+	mdmDeviceRespond(mdmDevice)
 
 	require.NoError(t, apple_mdm.VerifyHostMDMProfiles(context.Background(), s.ds, host, map[string]*fleet.HostMacOSProfile{
 		"I1": {Identifier: "I1", DisplayName: "I1", InstallDate: time.Now()},
@@ -9009,14 +9453,47 @@ func (s *integrationMDMTestSuite) TestRemoveFailedProfiles() {
 	for _, hm := range *getHostResp.Host.MDM.Profiles {
 		require.NotEqual(t, "N1", hm.Name)
 	}
+
+	// Test case where the profile never makes it to the host at all
+	host, _ = createHostThenEnrollMDM(s.ds, s.server.URL, t)
+	ident = uuid.NewString()
+
+	globalProfiles = [][]byte{
+		mobileconfigForTest("N3", ident),
+	}
+	s.Do("POST", "/api/v1/fleet/mdm/apple/profiles/batch", batchSetMDMAppleProfilesRequest{Profiles: globalProfiles}, http.StatusNoContent)
+	s.awaitTriggerProfileSchedule(t)
+
+	getHostResp = getHostResponse{}
+	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/hosts/%d", host.ID), nil, http.StatusOK, &getHostResp)
+	require.NotNil(t, getHostResp.Host.MDM.Profiles)
+	require.Len(t, *getHostResp.Host.MDM.Profiles, 3)
+	var profUUID string
+	for _, hm := range *getHostResp.Host.MDM.Profiles {
+		require.Equal(t, fleet.MDMDeliveryPending, *hm.Status)
+		if hm.Name == "N3" {
+			profUUID = hm.ProfileUUID
+		}
+	}
+
+	// delete the custom profile
+	s.Do("DELETE", fmt.Sprintf("/api/latest/fleet/mdm/profiles/%s", profUUID), &deleteMDMAppleConfigProfileRequest{}, http.StatusOK)
+	s.awaitTriggerProfileSchedule(t)
+
+	getHostResp = getHostResponse{}
+	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/hosts/%d", host.ID), nil, http.StatusOK, &getHostResp)
+	require.NotNil(t, getHostResp.Host.MDM.Profiles)
+	require.Len(t, *getHostResp.Host.MDM.Profiles, 2)
+	for _, hm := range *getHostResp.Host.MDM.Profiles {
+		require.Equal(t, fleet.MDMDeliveryPending, *hm.Status)
+	}
 }
 
 func (s *integrationMDMTestSuite) TestABMAssetManagement() {
 	t := s.T()
 	ctx := context.Background()
 
-	// ensure enable ABM again for other tests
-	t.Cleanup(s.enableABM)
+	s.enableABM(t.Name())
 
 	// Validate error when server private key not set
 	testSetEmptyPrivateKey = true
@@ -9032,21 +9509,21 @@ func (s *integrationMDMTestSuite) TestABMAssetManagement() {
 	require.Nil(t, abmResp.Err)
 	require.NotEmpty(t, abmResp.PublicKey)
 
+	var tokensResp listABMTokensResponse
+	s.DoJSON("GET", "/api/latest/fleet/abm_tokens", nil, http.StatusOK, &tokensResp)
+	tok := s.getABMTokenByName(t.Name(), tokensResp.Tokens)
+
 	// disable ABM
-	s.Do("DELETE", "/api/latest/fleet/mdm/apple/abm_token", nil, http.StatusNoContent)
-	assets, err := s.ds.GetAllMDMConfigAssetsByName(ctx, []fleet.MDMAssetName{
-		fleet.MDMAssetABMCert,
-		fleet.MDMAssetABMKey,
-		fleet.MDMAssetABMToken,
-	})
+	s.Do("DELETE", fmt.Sprintf("/api/latest/fleet/abm_tokens/%d", tok.ID), nil, http.StatusNoContent)
+	tok, err := s.ds.GetABMTokenByOrgName(ctx, t.Name())
 	var nfe fleet.NotFoundError
 	require.ErrorAs(t, err, &nfe)
-	require.Nil(t, assets)
+	require.Nil(t, tok)
 
-	// try to upload a token without a keypair
-	s.uploadABMToken([]byte("foo"), http.StatusBadRequest, "Please generate a keypair first.")
+	// try to upload an invalid token
+	s.uploadABMToken([]byte("foo"), http.StatusBadRequest, "Please provide a valid token from Apple Business Manager")
 
-	// enable ABM again, creates a new keypair because the previous one was deleted
+	// enable ABM again
 	var newABMResp generateABMKeyPairResponse
 	s.DoJSON("GET", "/api/latest/fleet/mdm/apple/abm_public_key", nil, http.StatusOK, &newABMResp)
 	require.Nil(t, newABMResp.Err)
@@ -9054,9 +9531,8 @@ func (s *integrationMDMTestSuite) TestABMAssetManagement() {
 	block, _ := pem.Decode(newABMResp.PublicKey)
 	require.NotNil(t, block)
 	require.Equal(t, "CERTIFICATE", block.Type)
-	require.NotEqual(t, abmResp.PublicKey, newABMResp.PublicKey)
 
-	// as long as the certs are not deleted, we should return the same values to support renewing the token
+	// we should always return the same values to support renewing the token
 	var renewABMResp generateABMKeyPairResponse
 	s.DoJSON("GET", "/api/latest/fleet/mdm/apple/abm_public_key", nil, http.StatusOK, &renewABMResp)
 	require.Nil(t, renewABMResp.Err)
@@ -9064,10 +9540,10 @@ func (s *integrationMDMTestSuite) TestABMAssetManagement() {
 	require.Equal(t, renewABMResp.PublicKey, newABMResp.PublicKey)
 
 	// simulate a renew flow
-	s.enableABM()
+	s.enableABM(t.Name())
 }
 
-func (s *integrationMDMTestSuite) enableABM() {
+func (s *integrationMDMTestSuite) enableABM(orgName string) {
 	t := s.T()
 	var abmResp generateABMKeyPairResponse
 	s.DoJSON("GET", "/api/latest/fleet/mdm/apple/abm_public_key", nil, http.StatusOK, &abmResp)
@@ -9104,6 +9580,16 @@ func (s *integrationMDMTestSuite) enableABM() {
 	encryptedToken, err := pkcs7.Encrypt([]byte(smimeToken), []*x509.Certificate{cert})
 	require.NoError(t, err)
 
+	s.mockDEPResponse(apple_mdm.UnsavedABMTokenOrgName, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		switch r.URL.Path {
+		case "/session":
+			_, _ = w.Write([]byte(`{"auth_session_token": "xyz"}`))
+		case "/account":
+			_, _ = w.Write([]byte(fmt.Sprintf(`{"admin_id": "abc", "org_name": %q}`, orgName)))
+		}
+	}))
+
 	// upload the encrypted token
 	smimeMessage := fmt.Sprintf(
 		"Content-Type: application/pkcs7-mime; name=\"smime.p7m\"; smime-type=enveloped-data\r\n"+
@@ -9118,12 +9604,31 @@ func (s *integrationMDMTestSuite) enableABM() {
 	assets, err := s.ds.GetAllMDMConfigAssetsByName(ctx, []fleet.MDMAssetName{
 		fleet.MDMAssetABMCert,
 		fleet.MDMAssetABMKey,
-		fleet.MDMAssetABMToken,
 	})
 	require.NoError(t, err)
-	require.Len(t, assets, 3)
-	require.Equal(t, smimeMessage, string(assets[fleet.MDMAssetABMToken].Value))
+	require.Len(t, assets, 2)
 	require.Equal(t, abmResp.PublicKey, assets[fleet.MDMAssetABMCert].Value)
+
+	tok, err := s.ds.GetABMTokenByOrgName(ctx, orgName)
+	require.NoError(t, err)
+	require.Equal(t, orgName, tok.OrganizationName)
+
+	// do a dummy call so the nanodep client updates the org name in
+	// nano_dep_names, and leave the mock set with a dummy response
+	s.mockDEPResponse(orgName, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		switch r.URL.Path {
+		case "/session":
+			_, _ = w.Write([]byte(`{"auth_session_token": "xyz"}`))
+		case "/account":
+			_, _ = w.Write([]byte(fmt.Sprintf(`{"admin_id": "abc", "org_name": %q}`, orgName)))
+		default:
+			_, _ = w.Write([]byte(`{}`))
+		}
+	}))
+	depClient := apple_mdm.NewDEPClient(s.depStorage, s.ds, s.logger)
+	_, err = depClient.AccountDetail(ctx, orgName)
+	require.NoError(t, err)
 }
 
 func (s *integrationMDMTestSuite) appleCoreCertsSetup() {
@@ -9184,7 +9689,7 @@ func (s *integrationMDMTestSuite) appleCoreCertsSetup() {
 	certDER, err := x509.CreateCertificate(rand.Reader, certTemplate, testCert, csr.PublicKey, testKey)
 	require.NoError(t, err)
 	certPEM := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: certDER})
-	s.uploadDataViaForm("/api/latest/fleet/mdm/apple/apns_certificate", "certificate", "certificate.pem", certPEM, http.StatusAccepted, "")
+	s.uploadDataViaForm("/api/latest/fleet/mdm/apple/apns_certificate", "certificate", "certificate.pem", certPEM, http.StatusAccepted, "", nil)
 
 	assets, err = s.ds.GetAllMDMConfigAssetsByName(ctx, []fleet.MDMAssetName{fleet.MDMAssetCACert, fleet.MDMAssetCAKey, fleet.MDMAssetAPNSKey, fleet.MDMAssetAPNSCert})
 	require.NoError(t, err)
@@ -9211,7 +9716,7 @@ func (s *integrationMDMTestSuite) uploadABMToken(encryptedToken []byte, expected
 		"Authorization": fmt.Sprintf("Bearer %s", s.token),
 	}
 
-	res := s.DoRawWithHeaders("POST", "/api/latest/fleet/mdm/apple/abm_token", b.Bytes(), expectedStatus, headers)
+	res := s.DoRawWithHeaders("POST", "/api/latest/fleet/abm_tokens", b.Bytes(), expectedStatus, headers)
 	if wantErr != "" {
 		errMsg := extractServerErrorText(res.Body)
 		assert.Contains(t, errMsg, wantErr)
@@ -9234,7 +9739,8 @@ func (s *integrationMDMTestSuite) TestSilentMigrationGotchas() {
 	require.False(t, *hostResp.Host.MDM.ConnectedToFleet)
 
 	// simulate that the device is assigned to Fleet in ABM
-	s.mockDEPResponse(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	s.enableABM(t.Name())
+	s.mockDEPResponse(t.Name(), http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.WriteHeader(http.StatusOK)
 		switch r.URL.Path {
 		case "/session":
@@ -9389,7 +9895,10 @@ func (s *integrationMDMTestSuite) TestAPNsPushCron() {
 	defer func() { s.pushProvider.PushFunc = originalPushMock }()
 
 	var recordedPushes []*mdm.Push
+	var mu sync.Mutex
 	s.pushProvider.PushFunc = func(pushes []*mdm.Push) (map[string]*push.Response, error) {
+		mu.Lock()
+		defer mu.Unlock()
 		recordedPushes = pushes
 		return mockSuccessfulPush(pushes)
 	}
@@ -9535,11 +10044,12 @@ func (s *integrationMDMTestSuite) TestBatchAssociateAppStoreApps() {
 	})
 	require.NoError(t, err)
 
-	// No vpp token set, no association
+	// No vpp token set, but request is empty so it succeeds (clears VPP apps for the team).
 	s.Do("POST", batchURL, batchAssociateAppStoreAppsRequest{}, http.StatusNoContent, "team_name", tmGood.Name)
 
 	// No vpp token set, try association
-	s.Do("POST", batchURL, batchAssociateAppStoreAppsRequest{Apps: []fleet.VPPBatchPayload{{AppStoreID: s.appleVPPConfigSrvConfig.Assets[0].AdamID}}}, http.StatusUnprocessableEntity, "team_name", tmGood.Name)
+	// FIXME
+	// s.Do("POST", batchURL, batchAssociateAppStoreAppsRequest{Apps: []fleet.VPPBatchPayload{{AppStoreID: s.appleVPPConfigSrvConfig.Assets[0].AdamID}}}, http.StatusUnprocessableEntity, "team_name", tmGood.Name)
 
 	// Valid token
 	orgName := "Fleet Device Management Inc."
@@ -9547,7 +10057,12 @@ func (s *integrationMDMTestSuite) TestBatchAssociateAppStoreApps() {
 	expDate := "2025-06-24T15:50:50+0000"
 	tokenJSON := fmt.Sprintf(`{"expDate":"%s","token":"%s","orgName":"%s"}`, expDate, token, orgName)
 	t.Setenv("FLEET_DEV_VPP_URL", s.appleVPPConfigSrv.URL)
-	s.uploadDataViaForm("/api/latest/fleet/mdm/apple/vpp_token", "token", "token.vpptoken", []byte(base64.StdEncoding.EncodeToString([]byte(tokenJSON))), http.StatusAccepted, "")
+	var vppRes uploadVPPTokenResponse
+	s.uploadDataViaForm("/api/latest/fleet/vpp_tokens", "token", "token.vpptoken", []byte(base64.StdEncoding.EncodeToString([]byte(tokenJSON))), http.StatusAccepted, "", &vppRes)
+
+	var resPatchVPP patchVPPTokensTeamsResponse
+	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/vpp_tokens/%d/teams", vppRes.Token.ID), patchVPPTokensTeamsRequest{TeamIDs: []uint{}}, http.StatusOK, &resPatchVPP)
+
 	// Remove all vpp associations from team with no members
 	s.Do("POST", batchURL, batchAssociateAppStoreAppsRequest{}, http.StatusNoContent, "team_name", tmGood.Name)
 
@@ -9576,6 +10091,26 @@ func (s *integrationMDMTestSuite) TestBatchAssociateAppStoreApps() {
 	// Remove all vpp associations from team with no members
 	s.Do("POST", batchURL, batchAssociateAppStoreAppsRequest{}, http.StatusNoContent, "team_name", tmGood.Name)
 
+	// Incorrect type check
+	incorrectTypes := struct {
+		Apps []struct {
+			AppStoreID  int  `json:"app_store_id"`
+			SelfService bool `json:"self_service"`
+		} `json:"app_store_apps"`
+	}{
+		Apps: []struct {
+			AppStoreID  int  `json:"app_store_id"`
+			SelfService bool `json:"self_service"`
+		}{
+			{
+				AppStoreID: 1,
+			},
+		},
+	}
+	badTypeReq := s.Do("POST", batchURL, incorrectTypes, http.StatusBadRequest, "team_name", tmGood.Name)
+	badTypeBody := extractServerErrorText(badTypeReq.Body)
+	assert.Contains(t, badTypeBody, "must be a string")
+
 	// Associating an app we don't own
 	s.Do("POST", batchURL, batchAssociateAppStoreAppsRequest{Apps: []fleet.VPPBatchPayload{{AppStoreID: "fake-app"}}}, http.StatusUnprocessableEntity, "team_name", tmGood.Name)
 
@@ -9610,7 +10145,7 @@ func (s *integrationMDMTestSuite) TestBatchAssociateAppStoreApps() {
 		batchAssociateAppStoreAppsRequest{
 			Apps: []fleet.VPPBatchPayload{
 				{AppStoreID: s.appleVPPConfigSrvConfig.Assets[0].AdamID},
-				{AppStoreID: s.appleVPPConfigSrvConfig.Assets[1].AdamID},
+				{AppStoreID: s.appleVPPConfigSrvConfig.Assets[1].AdamID, SelfService: true},
 			},
 		}, http.StatusNoContent, "team_name", tmGood.Name,
 	)
@@ -9620,7 +10155,28 @@ func (s *integrationMDMTestSuite) TestBatchAssociateAppStoreApps() {
 	assert.Contains(t, assoc, fleet.VPPAppID{AdamID: s.appleVPPConfigSrvConfig.Assets[0].AdamID, Platform: fleet.MacOSPlatform})
 	assert.Contains(t, assoc, fleet.VPPAppID{AdamID: s.appleVPPConfigSrvConfig.Assets[1].AdamID, Platform: fleet.IOSPlatform})
 	assert.Contains(t, assoc, fleet.VPPAppID{AdamID: s.appleVPPConfigSrvConfig.Assets[1].AdamID, Platform: fleet.IPadOSPlatform})
-	assert.Contains(t, assoc, fleet.VPPAppID{AdamID: s.appleVPPConfigSrvConfig.Assets[1].AdamID, Platform: fleet.MacOSPlatform})
+	// Only macOS version should be self-service
+	assert.Equal(t, fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: s.appleVPPConfigSrvConfig.Assets[1].AdamID, Platform: fleet.MacOSPlatform}, SelfService: true},
+		assoc[fleet.VPPAppID{AdamID: s.appleVPPConfigSrvConfig.Assets[1].AdamID, Platform: fleet.MacOSPlatform}])
+
+	// Reverse self-service associations
+	// Associating two apps we own
+	s.Do("POST",
+		batchURL,
+		batchAssociateAppStoreAppsRequest{
+			Apps: []fleet.VPPBatchPayload{
+				{AppStoreID: s.appleVPPConfigSrvConfig.Assets[0].AdamID, SelfService: true},
+				{AppStoreID: s.appleVPPConfigSrvConfig.Assets[1].AdamID, SelfService: false},
+			},
+		}, http.StatusNoContent, "team_name", tmGood.Name,
+	)
+	assoc, err = s.ds.GetAssignedVPPApps(ctx, &tmGood.ID)
+	require.NoError(t, err)
+	require.Len(t, assoc, 4)
+	assert.Equal(t, fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: s.appleVPPConfigSrvConfig.Assets[0].AdamID, Platform: fleet.MacOSPlatform}, SelfService: true}, assoc[fleet.VPPAppID{AdamID: s.appleVPPConfigSrvConfig.Assets[0].AdamID, Platform: fleet.MacOSPlatform}])
+	assert.Equal(t, fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: s.appleVPPConfigSrvConfig.Assets[1].AdamID, Platform: fleet.IOSPlatform}}, assoc[fleet.VPPAppID{AdamID: s.appleVPPConfigSrvConfig.Assets[1].AdamID, Platform: fleet.IOSPlatform}])
+	assert.Equal(t, fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: s.appleVPPConfigSrvConfig.Assets[1].AdamID, Platform: fleet.IPadOSPlatform}}, assoc[fleet.VPPAppID{AdamID: s.appleVPPConfigSrvConfig.Assets[1].AdamID, Platform: fleet.IPadOSPlatform}])
+	assert.Equal(t, fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: s.appleVPPConfigSrvConfig.Assets[1].AdamID, Platform: fleet.MacOSPlatform}}, assoc[fleet.VPPAppID{AdamID: s.appleVPPConfigSrvConfig.Assets[1].AdamID, Platform: fleet.MacOSPlatform}])
 
 	// Associate an app with a team with no team members
 	s.Do("POST", batchURL, batchAssociateAppStoreAppsRequest{Apps: []fleet.VPPBatchPayload{{AppStoreID: s.appleVPPConfigSrvConfig.Assets[0].AdamID}}}, http.StatusNoContent, "team_name", tmEmpty.Name)
@@ -9667,7 +10223,6 @@ func (s *integrationMDMTestSuite) TestEnrollAfterDEPSyncIOSIPadOS() {
 	var listCmdResp listMDMAppleCommandsResponse
 	s.DoJSON("GET", "/api/latest/fleet/mdm/apple/commands", nil, http.StatusOK, &listCmdResp)
 	require.Empty(t, listCmdResp.Results)
-
 }
 
 func (s *integrationMDMTestSuite) TestRefetchIOSIPadOS() {
@@ -9689,6 +10244,7 @@ func (s *integrationMDMTestSuite) TestRefetchIOSIPadOS() {
 
 	// Enroll host
 	host, mdmClient := s.createAppleMobileHostThenEnrollMDM("ios")
+	require.NoError(t, s.ds.SetOrUpdateMDMData(context.Background(), host.ID, false, true, "https://foo.com", true, "", ""))
 
 	// Refetch host
 	_ = s.Do("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/refetch", host.ID), nil, http.StatusOK)
@@ -9700,6 +10256,17 @@ func (s *integrationMDMTestSuite) TestRefetchIOSIPadOS() {
 	assert.Equal(t, host.ID, hostResp.Host.ID)
 	assert.True(t, hostResp.Host.RefetchRequested)
 
+	commands, err := s.ds.GetHostMDMCommands(context.Background(), host.ID)
+	require.NoError(t, err)
+	require.Len(t, commands, commandsSent)
+	assert.ElementsMatch(t, []fleet.HostMDMCommand{
+		{HostID: host.ID, CommandType: fleet.RefetchAppsCommandUUIDPrefix},
+		{HostID: host.ID, CommandType: fleet.RefetchDeviceCommandUUIDPrefix},
+	}, commands)
+
+	// Since refetch is already queued up, doing another refetch is a no-op and will not add more MDM commands
+	_ = s.Do("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/refetch", host.ID), nil, http.StatusOK)
+
 	// Check the MDM commands and send response
 	cmd, err := mdmClient.Idle()
 	require.NoError(t, err)
@@ -9724,6 +10291,10 @@ func (s *integrationMDMTestSuite) TestRefetchIOSIPadOS() {
 	cmd, err = mdmClient.AcknowledgeDeviceInformation(mdmClient.UUID, cmd.CommandUUID, deviceName, "iPhone SE")
 	require.NoError(t, err)
 
+	commands, err = s.ds.GetHostMDMCommands(context.Background(), host.ID)
+	require.NoError(t, err)
+	require.Empty(t, commands)
+
 	hostResp = getHostResponse{}
 	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/hosts/%d", host.ID), nil, http.StatusOK, &hostResp)
 	assert.Equal(t, host.ID, hostResp.Host.ID)
@@ -9857,61 +10428,110 @@ func (s *integrationMDMTestSuite) TestRefetchIOSIPadOS() {
 	assert.Equal(t, deviceNameRenamed, hostResp.Host.ComputerName)
 	assert.Empty(t, hostResp.Host.Software)
 
+	// Mark host as unenrolled and refetch.
+	require.NoError(t, s.ds.UpdateMDMData(ctx, host.ID, false))
+	hostResp = getHostResponse{}
+	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/hosts/%d", host.ID), nil, http.StatusOK, &hostResp)
+	require.NoError(t, err)
+	require.NotNil(t, hostResp.Host.MDM.EnrollmentStatus)
+	assert.Equal(t, "Pending", *hostResp.Host.MDM.EnrollmentStatus)
+
+	// Set iOS detail_updated_at as 2 hours in the past.
+	mysql.ExecAdhocSQL(t, s.ds, func(q sqlx.ExtContext) error {
+		_, err := q.ExecContext(ctx, `UPDATE hosts SET detail_updated_at = DATE_SUB(NOW(), INTERVAL 2 HOUR) WHERE id = ?`, host.ID)
+		return err
+	})
+	trigger := triggerRequest{
+		Name: string(fleet.CronAppleMDMIPhoneIPadRefetcher),
+	}
+	_ = s.Do("POST", "/api/latest/fleet/trigger", trigger, http.StatusOK)
+	commandsSent += commandsSentPerRefetch
+
+	// Wait until MDM commands are set up
+	done := make(chan struct{})
+	go func() {
+		ticker := time.NewTicker(100 * time.Millisecond)
+		defer ticker.Stop()
+		for range ticker.C {
+			commands, err = s.ds.GetHostMDMCommands(context.Background(), host.ID)
+			require.NoError(t, err)
+			if len(commands) == commandsSentPerRefetch {
+				done <- struct{}{}
+				return
+			}
+		}
+	}()
+	select {
+	case <-done:
+	case <-time.After(10 * time.Second):
+		t.Error("Timeout: MDM commands not queued up")
+	}
+
+	// Check the MDM commands and send response
+	cmd, err = mdmClient.Idle()
+	require.NoError(t, err)
+	require.NotNil(t, cmd)
+	require.Equal(t, "InstalledApplicationList", cmd.Command.RequestType)
+	cmd, err = mdmClient.AcknowledgeInstalledApplicationList(mdmClient.UUID, cmd.CommandUUID, []fleet.Software{})
+	require.NoError(t, err)
+	require.Equal(t, "DeviceInformation", cmd.Command.RequestType)
+	cmd, err = mdmClient.AcknowledgeDeviceInformation(mdmClient.UUID, cmd.CommandUUID, deviceNameRenamed, "iPhone SE")
+	require.NoError(t, err)
+	require.Nil(t, cmd)
+
+	hostResp = getHostResponse{}
+	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/hosts/%d", host.ID), nil, http.StatusOK, &hostResp)
+	assert.Equal(t, host.ID, hostResp.Host.ID)
+	assert.False(t, hostResp.Host.RefetchRequested)
+	require.NotNil(t, hostResp.Host.MDM.EnrollmentStatus)
+	assert.Equal(t, "On (automatic)", *hostResp.Host.MDM.EnrollmentStatus)
+
 	// list commands should return all the commands we sent
 	var listCmdResp listMDMAppleCommandsResponse
 	s.DoJSON("GET", "/api/latest/fleet/mdm/apple/commands", nil, http.StatusOK, &listCmdResp)
 	require.Len(t, listCmdResp.Results, commandsSent)
-
 }
 
 func (s *integrationMDMTestSuite) TestVPPApps() {
 	t := s.T()
 	// Invalid token
 	t.Setenv("FLEET_DEV_VPP_URL", s.appleVPPConfigSrv.URL+"?invalidToken")
-	s.uploadDataViaForm("/api/latest/fleet/mdm/apple/vpp_token", "token", "token.vpptoken", []byte("foobar"), http.StatusUnprocessableEntity, "Invalid token. Please provide a valid content token from Apple Business Manager.")
+	s.uploadDataViaForm("/api/latest/fleet/vpp_tokens", "token", "token.vpptoken", []byte("foobar"), http.StatusUnprocessableEntity, "Invalid token. Please provide a valid content token from Apple Business Manager.", nil)
 
 	// Simulate a server error from the Apple API
 	t.Setenv("FLEET_DEV_VPP_URL", s.appleVPPConfigSrv.URL+"?serverError")
-	s.uploadDataViaForm("/api/latest/fleet/mdm/apple/vpp_token", "token", "token.vpptoken", []byte("foobar"), http.StatusInternalServerError, "Apple VPP endpoint returned error: Internal server error (error number: 9603)")
+	s.uploadDataViaForm("/api/latest/fleet/vpp_tokens", "token", "token.vpptoken", []byte("foobar"), http.StatusInternalServerError, "Apple VPP endpoint returned error: Internal server error (error number: 9603)", nil)
 
 	// Valid token
 	orgName := "Fleet Device Management Inc."
 	location := "Fleet Location One"
 	token := "mycooltoken"
-	expDate := "2025-06-24T15:50:50+0000"
+	expTime := time.Now().Add(200 * time.Hour).UTC().Round(time.Second)
+	expDate := expTime.Format(fleet.VPPTimeFormat)
 	tokenJSON := fmt.Sprintf(`{"expDate":"%s","token":"%s","orgName":"%s"}`, expDate, token, orgName)
 	t.Setenv("FLEET_DEV_VPP_URL", s.appleVPPConfigSrv.URL)
-	s.uploadDataViaForm("/api/latest/fleet/mdm/apple/vpp_token", "token", "token.vpptoken", []byte(base64.StdEncoding.EncodeToString([]byte(tokenJSON))), http.StatusAccepted, "")
+	var validToken uploadVPPTokenResponse
+	s.uploadDataViaForm("/api/latest/fleet/vpp_tokens", "token", "token.vpptoken", []byte(base64.StdEncoding.EncodeToString([]byte(tokenJSON))), http.StatusAccepted, "", &validToken)
 
 	s.lastActivityMatches(fleet.ActivityEnabledVPP{}.ActivityName(), "", 0)
 
 	// Get the token
-	var resp getMDMAppleVPPTokenResponse
-	s.DoJSON("GET", "/api/latest/fleet/vpp", &getMDMAppleVPPTokenRequest{}, http.StatusOK, &resp)
+	var resp getVPPTokensResponse
+	s.DoJSON("GET", "/api/latest/fleet/vpp_tokens", &getVPPTokensRequest{}, http.StatusOK, &resp)
 	require.NoError(t, resp.Err)
-	require.Equal(t, orgName, resp.OrgName)
-	require.Equal(t, location, resp.Location)
-	require.Equal(t, expDate, resp.RenewDate)
-
-	// Simulate renewal flow
-	orgName = "Fleet Device Management Inc. New Org Name"
-	token = "myothercooltoken"
-	expDate = "2026-06-24T15:50:50+0000"
-	tokenJSON = fmt.Sprintf(`{"expDate":"%s","token":"%s","orgName":"%s"}`, expDate, token, orgName)
-	s.uploadDataViaForm("/api/latest/fleet/mdm/apple/vpp_token", "token", "token.vpptoken", []byte(base64.StdEncoding.EncodeToString([]byte(tokenJSON))), http.StatusAccepted, "")
-
-	resp = getMDMAppleVPPTokenResponse{}
-	s.DoJSON("GET", "/api/latest/fleet/vpp", &getMDMAppleVPPTokenRequest{}, http.StatusOK, &resp)
-	require.NoError(t, resp.Err)
-	require.Equal(t, orgName, resp.OrgName)
-	require.Equal(t, location, resp.Location)
-	require.Equal(t, expDate, resp.RenewDate)
+	require.Len(t, resp.Tokens, 1)
+	require.Equal(t, orgName, resp.Tokens[0].OrgName)
+	require.Equal(t, location, resp.Tokens[0].Location)
+	require.Equal(t, expTime, resp.Tokens[0].RenewDate)
 
 	// Create a team
 	var newTeamResp teamResponse
 	s.DoJSON("POST", "/api/latest/fleet/teams", &createTeamRequest{TeamPayload: fleet.TeamPayload{Name: ptr.String("Team 1")}}, http.StatusOK, &newTeamResp)
 	team := newTeamResp.Team
 
+	var resPatchVPP patchVPPTokensTeamsResponse
+	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/vpp_tokens/%d/teams", resp.Tokens[0].ID), patchVPPTokensTeamsRequest{TeamIDs: []uint{}}, http.StatusOK, &resPatchVPP)
+
 	// Get list of VPP apps from "Apple"
 	// We're passing team 1 here, but we haven't added any app store apps to that team, so we get
 	// back all available apps in our VPP location.
@@ -9919,9 +10539,11 @@ func (s *integrationMDMTestSuite) TestVPPApps() {
 	s.DoJSON("GET", "/api/latest/fleet/software/app_store_apps", &getAppStoreAppsRequest{}, http.StatusOK, &appResp, "team_id", strconv.Itoa(int(team.ID)))
 	require.NoError(t, appResp.Err)
 	macOSApp := fleet.VPPApp{
-		VPPAppID: fleet.VPPAppID{
-			AdamID:   "1",
-			Platform: fleet.MacOSPlatform,
+		VPPAppTeam: fleet.VPPAppTeam{
+			VPPAppID: fleet.VPPAppID{
+				AdamID:   "1",
+				Platform: fleet.MacOSPlatform,
+			},
 		},
 		Name:             "App 1",
 		BundleIdentifier: "a-1",
@@ -9929,9 +10551,11 @@ func (s *integrationMDMTestSuite) TestVPPApps() {
 		LatestVersion:    "1.0.0",
 	}
 	iPadOSApp := fleet.VPPApp{
-		VPPAppID: fleet.VPPAppID{
-			AdamID:   "2",
-			Platform: fleet.IPadOSPlatform,
+		VPPAppTeam: fleet.VPPAppTeam{
+			VPPAppID: fleet.VPPAppID{
+				AdamID:   "2",
+				Platform: fleet.IPadOSPlatform,
+			},
 		},
 		Name:             "App 2",
 		BundleIdentifier: "b-2",
@@ -9939,9 +10563,11 @@ func (s *integrationMDMTestSuite) TestVPPApps() {
 		LatestVersion:    "2.0.0",
 	}
 	iOSApp := fleet.VPPApp{
-		VPPAppID: fleet.VPPAppID{
-			AdamID:   "2",
-			Platform: fleet.IOSPlatform,
+		VPPAppTeam: fleet.VPPAppTeam{
+			VPPAppID: fleet.VPPAppID{
+				AdamID:   "2",
+				Platform: fleet.IOSPlatform,
+			},
 		},
 		Name:             "App 2",
 		BundleIdentifier: "b-2",
@@ -9953,9 +10579,11 @@ func (s *integrationMDMTestSuite) TestVPPApps() {
 		&iPadOSApp,
 		&iOSApp,
 		{
-			VPPAppID: fleet.VPPAppID{
-				AdamID:   "2",
-				Platform: fleet.MacOSPlatform,
+			VPPAppTeam: fleet.VPPAppTeam{
+				VPPAppID: fleet.VPPAppID{
+					AdamID:   "2",
+					Platform: fleet.MacOSPlatform,
+				},
 			},
 			Name:             "App 2",
 			BundleIdentifier: "b-2",
@@ -9963,9 +10591,11 @@ func (s *integrationMDMTestSuite) TestVPPApps() {
 			LatestVersion:    "2.0.0",
 		},
 		{
-			VPPAppID: fleet.VPPAppID{
-				AdamID:   "3",
-				Platform: fleet.IPadOSPlatform,
+			VPPAppTeam: fleet.VPPAppTeam{
+				VPPAppID: fleet.VPPAppID{
+					AdamID:   "3",
+					Platform: fleet.IPadOSPlatform,
+				},
 			},
 			Name:             "App 3",
 			BundleIdentifier: "c-3",
@@ -9982,9 +10612,9 @@ func (s *integrationMDMTestSuite) TestVPPApps() {
 	// Add an app store app to non-existent team
 	s.DoJSON("POST", "/api/latest/fleet/software/app_store_apps", &addAppStoreAppRequest{TeamID: ptr.Uint(9999), AppStoreID: addedApp.AdamID}, http.StatusNotFound, &addAppResp)
 
-	s.DoJSON("POST", "/api/latest/fleet/software/app_store_apps", &addAppStoreAppRequest{TeamID: &team.ID, AppStoreID: addedApp.AdamID}, http.StatusOK, &addAppResp)
+	s.DoJSON("POST", "/api/latest/fleet/software/app_store_apps", &addAppStoreAppRequest{TeamID: &team.ID, AppStoreID: addedApp.AdamID, SelfService: true}, http.StatusOK, &addAppResp)
 	s.lastActivityMatches(fleet.ActivityAddedAppStoreApp{}.ActivityName(),
-		fmt.Sprintf(`{"team_name": "%s", "software_title": "%s", "app_store_id": "%s", "team_id": %d, "platform": "%s"}`, team.Name,
+		fmt.Sprintf(`{"team_name": "%s", "software_title": "%s", "app_store_id": "%s", "team_id": %d, "platform": "%s", "self_service": true}`, team.Name,
 			addedApp.Name, addedApp.AdamID, team.ID, addedApp.Platform), 0)
 
 	// Now we should be filtering out the app we added to team 1
@@ -9997,8 +10627,15 @@ func (s *integrationMDMTestSuite) TestVPPApps() {
 	var listSw listSoftwareTitlesResponse
 	s.DoJSON("GET", "/api/latest/fleet/software/titles", nil, http.StatusOK, &listSw, "team_id", fmt.Sprint(team.ID), "available_for_install", "true")
 	require.Len(t, listSw.SoftwareTitles, 1)
+	require.True(t, *listSw.SoftwareTitles[0].AppStoreApp.SelfService)
 	macOSTitleID := listSw.SoftwareTitles[0].ID
 
+	// listing with the self-service filter also returns it
+	listSw = listSoftwareTitlesResponse{}
+	s.DoJSON("GET", "/api/latest/fleet/software/titles", nil, http.StatusOK, &listSw, "team_id", fmt.Sprint(team.ID), "self_service", "true")
+	require.Len(t, listSw.SoftwareTitles, 1)
+	require.Equal(t, macOSTitleID, listSw.SoftwareTitles[0].ID)
+
 	// delete the app store app for team 1
 	s.Do("DELETE", fmt.Sprintf("/api/latest/fleet/software/titles/%d/available_for_install", macOSTitleID), nil, http.StatusNoContent,
 		"team_id", fmt.Sprint(team.ID))
@@ -10019,11 +10656,15 @@ func (s *integrationMDMTestSuite) TestVPPApps() {
 	// Insert/deletion flow for iPadOS app
 	addedApp = expectedApps[1]
 	addAppResp = addAppStoreAppResponse{}
+	// No self-service for iPadOS
+	s.DoJSON("POST", "/api/latest/fleet/software/app_store_apps",
+		&addAppStoreAppRequest{TeamID: &team.ID, AppStoreID: addedApp.AdamID, Platform: addedApp.Platform, SelfService: true},
+		http.StatusBadRequest, &addAppResp)
 	s.DoJSON("POST", "/api/latest/fleet/software/app_store_apps",
 		&addAppStoreAppRequest{TeamID: &team.ID, AppStoreID: addedApp.AdamID, Platform: addedApp.Platform},
 		http.StatusOK, &addAppResp)
 	s.lastActivityMatches(fleet.ActivityAddedAppStoreApp{}.ActivityName(),
-		fmt.Sprintf(`{"team_name": "%s", "software_title": "%s", "app_store_id": "%s", "team_id": %d, "platform": "%s"}`, team.Name,
+		fmt.Sprintf(`{"team_name": "%s", "software_title": "%s", "app_store_id": "%s", "team_id": %d, "platform": "%s", "self_service": false}`, team.Name,
 			addedApp.Name, addedApp.AdamID, team.ID, addedApp.Platform), 0)
 
 	// Now we should be filtering out the app we added to team 1
@@ -10041,6 +10682,12 @@ func (s *integrationMDMTestSuite) TestVPPApps() {
 	macOSTitleID = listSw.SoftwareTitles[0].ID
 	assert.Equal(t, "ipados_apps", listSw.SoftwareTitles[0].Source)
 
+	// filtering by self-service returns nothing
+	listSw = listSoftwareTitlesResponse{}
+	s.DoJSON("GET", "/api/latest/fleet/software/titles", nil, http.StatusOK, &listSw, "team_id", fmt.Sprint(team.ID),
+		"self_service", "true")
+	require.Len(t, listSw.SoftwareTitles, 0)
+
 	// delete the app store app for team 1
 	s.Do("DELETE", fmt.Sprintf("/api/latest/fleet/software/titles/%d/available_for_install", macOSTitleID), nil, http.StatusNoContent,
 		"team_id",
@@ -10066,6 +10713,11 @@ func (s *integrationMDMTestSuite) TestVPPApps() {
 	orbitHost := createOrbitEnrolledHost(t, "darwin", "nonmdm", s.ds)
 	mdmHost, mdmDevice := createHostThenEnrollMDM(s.ds, s.server.URL, t)
 	setOrbitEnrollment(t, mdmHost, s.ds)
+	selfServiceHost, selfServiceDevice := createHostThenEnrollMDM(s.ds, s.server.URL, t)
+	setOrbitEnrollment(t, selfServiceHost, s.ds)
+	selfServiceToken := "selfservicetoken"
+	updateDeviceTokenForHost(t, s.ds, selfServiceHost.ID, selfServiceToken)
+	s.appleVPPConfigSrvConfig.SerialNumbers = append(s.appleVPPConfigSrvConfig.SerialNumbers, selfServiceDevice.SerialNumber)
 	iOSHost, iOSMdmClient := s.createAppleMobileHostThenEnrollMDM("ios")
 	iPadOSHost, iPadOSMdmClient := s.createAppleMobileHostThenEnrollMDM("ipados")
 
@@ -10073,19 +10725,35 @@ func (s *integrationMDMTestSuite) TestVPPApps() {
 	s.appleVPPConfigSrvConfig.SerialNumbers = append(s.appleVPPConfigSrvConfig.SerialNumbers, mdmHost.HardwareSerial,
 		iOSHost.HardwareSerial, iPadOSHost.HardwareSerial)
 	s.Do("POST", "/api/latest/fleet/hosts/transfer",
-		&addHostsToTeamRequest{HostIDs: []uint{mdmHost.ID, orbitHost.ID, iOSHost.ID, iPadOSHost.ID}, TeamID: &team.ID}, http.StatusOK)
+		&addHostsToTeamRequest{HostIDs: []uint{mdmHost.ID, orbitHost.ID, iOSHost.ID, iPadOSHost.ID, selfServiceHost.ID}, TeamID: &team.ID}, http.StatusOK)
 
 	// Add all apps to the team
 	addedApp = expectedApps[0]
 	errApp := expectedApps[3]
-	for _, app := range expectedApps {
+	appSelfService := expectedApps[0]
+	// Add app 1 as self-service
+	addAppResp = addAppStoreAppResponse{}
+	s.DoJSON("POST", "/api/latest/fleet/software/app_store_apps",
+		&addAppStoreAppRequest{TeamID: &team.ID, AppStoreID: appSelfService.AdamID, Platform: appSelfService.Platform, SelfService: true},
+		http.StatusOK, &addAppResp)
+	s.lastActivityMatches(
+		fleet.ActivityAddedAppStoreApp{}.ActivityName(),
+		fmt.Sprintf(`{"team_name": "%s", "software_title": "%s", "app_store_id": "%s", "team_id": %d, "platform": "%s", "self_service": true}`, team.Name,
+			appSelfService.Name, appSelfService.AdamID, team.ID, appSelfService.Platform),
+		0,
+	)
+	listSw = listSoftwareTitlesResponse{}
+	s.DoJSON("GET", "/api/latest/fleet/software/titles", nil, http.StatusOK, &listSw, "team_id", fmt.Sprint(team.ID),
+		"available_for_install", "true")
+	// Add remaining as non-self-service
+	for _, app := range expectedApps[1:] {
 		addAppResp = addAppStoreAppResponse{}
 		s.DoJSON("POST", "/api/latest/fleet/software/app_store_apps",
 			&addAppStoreAppRequest{TeamID: &team.ID, AppStoreID: app.AdamID, Platform: app.Platform},
 			http.StatusOK, &addAppResp)
 		s.lastActivityMatches(
 			fleet.ActivityAddedAppStoreApp{}.ActivityName(),
-			fmt.Sprintf(`{"team_name": "%s", "software_title": "%s", "app_store_id": "%s", "team_id": %d, "platform": "%s"}`, team.Name,
+			fmt.Sprintf(`{"team_name": "%s", "software_title": "%s", "app_store_id": "%s", "team_id": %d, "platform": "%s", "self_service": false}`, team.Name,
 				app.Name, app.AdamID, team.ID, app.Platform),
 			0,
 		)
@@ -10117,27 +10785,61 @@ func (s *integrationMDMTestSuite) TestVPPApps() {
 
 	// attempt to install a VPP app on the non-MDM enrolled host
 	installResp := installSoftwareResponse{}
-	s.DoJSON("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/software/install/%d", orbitHost.ID, macOSTitleID), &installSoftwareRequest{},
+	s.DoJSON("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/software/%d/install", orbitHost.ID, macOSTitleID), &installSoftwareRequest{},
 		http.StatusBadRequest, &installResp)
 
+	// Disable all teams token
+	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/vpp_tokens/%d/teams", validToken.Token.ID), patchVPPTokensTeamsRequest{}, http.StatusOK, &resPatchVPP)
+
 	// Spoof an expired VPP token and attempt to install VPP app
-	tokenJSON = fmt.Sprintf(`{"expDate":"%s","token":"%s","orgName":"%s"}`, "2020-06-24T15:50:50+0000", token, orgName)
-	s.uploadDataViaForm("/api/latest/fleet/mdm/apple/vpp_token", "token", "token.vpptoken", []byte(base64.StdEncoding.EncodeToString([]byte(tokenJSON))), http.StatusAccepted, "")
+	tokenJSONBad := fmt.Sprintf(`{"expDate":"%s","token":"%s","orgName":"%s"}`, "2099-06-24T15:50:50+0000", "badtoken", "Evil Fleet")
+	s.appleVPPConfigSrvConfig.Location = "Spooky Haunted House"
+	var vppRes uploadVPPTokenResponse
+	s.uploadDataViaForm("/api/latest/fleet/vpp_tokens", "token", "token.vpptoken", []byte(base64.StdEncoding.EncodeToString([]byte(tokenJSONBad))), http.StatusAccepted, "", &vppRes)
 
-	r := s.Do("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/software/install/%d", mdmHost.ID, errTitleID), &installSoftwareRequest{}, http.StatusUnprocessableEntity)
-	require.Contains(t, extractServerErrorText(r.Body), "VPP token expired")
+	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/vpp_tokens/%d/teams", vppRes.Token.ID), patchVPPTokensTeamsRequest{TeamIDs: []uint{team.ID, 99}}, http.StatusUnprocessableEntity, &resPatchVPP)
 
-	// Put a valid token back in
-	tokenJSON = fmt.Sprintf(`{"expDate":"%s","token":"%s","orgName":"%s"}`, "2050-06-24T15:50:50+0000", token, orgName)
-	s.uploadDataViaForm("/api/latest/fleet/mdm/apple/vpp_token", "token", "token.vpptoken", []byte(base64.StdEncoding.EncodeToString([]byte(tokenJSON))), http.StatusAccepted, "")
+	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/vpp_tokens/%d/teams", vppRes.Token.ID), patchVPPTokensTeamsRequest{TeamIDs: []uint{team.ID}}, http.StatusOK, &resPatchVPP)
+
+	// mysql.ExecAdhocSQL(t, s.ds, func(q sqlx.ExtContext) error {
+	// 	_, err := q.ExecContext(context.Background(), "UPDATE vpp_tokens SET renew_at = ? WHERE organization_name = ?", time.Now().Add(-1*time.Hour), "badtoken")
+	// 	return err
+	// })
+
+	// r := s.Do("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/software/install/%d", mdmHost.ID, errTitleID), &installSoftwareRequest{}, http.StatusUnprocessableEntity)
+	// require.Contains(t, extractServerErrorText(r.Body), "VPP token expired")
+
+	// Disable the token
+	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/vpp_tokens/%d/teams", vppRes.Token.ID), patchVPPTokensTeamsRequest{}, http.StatusOK, &resPatchVPP)
+
+	// Enable all teams token
+	s.DoJSON("PATCH", fmt.Sprintf("/api/latest/fleet/vpp_tokens/%d/teams", validToken.Token.ID), patchVPPTokensTeamsRequest{TeamIDs: []uint{}}, http.StatusOK, &resPatchVPP)
 
 	// Attempt to install non-existent app
-	r = s.Do("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/software/install/%d", mdmHost.ID, 99999), &installSoftwareRequest{}, http.StatusBadRequest)
+	r := s.Do("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/software/%d/install", mdmHost.ID, 99999), &installSoftwareRequest{},
+		http.StatusBadRequest)
 	require.Contains(t, extractServerErrorText(r.Body), "Couldn't install software. Software title is not available for install. Please add software package or App Store app to install.")
 
+	// Add app 1 as self-service
+	addAppResp = addAppStoreAppResponse{}
+	s.DoJSON("POST", "/api/latest/fleet/software/app_store_apps",
+		&addAppStoreAppRequest{TeamID: &team.ID, AppStoreID: errApp.AdamID, Platform: errApp.Platform, SelfService: true},
+		http.StatusOK, &addAppResp)
+
+	// Add remaining apps without self-service
+	for _, app := range expectedApps {
+		addAppResp = addAppStoreAppResponse{}
+		s.DoJSON("POST", "/api/latest/fleet/software/app_store_apps",
+			&addAppStoreAppRequest{TeamID: &team.ID, AppStoreID: app.AdamID, Platform: app.Platform, SelfService: app.AdamID == macOSApp.AdamID},
+			http.StatusOK, &addAppResp)
+	}
+
 	// Trigger install to the host
 	installResp = installSoftwareResponse{}
-	s.DoJSON("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/software/install/%d", mdmHost.ID, errTitleID), &installSoftwareRequest{}, http.StatusAccepted, &installResp)
+	s.DoJSON("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/software/%d/install", mdmHost.ID, errTitleID), &installSoftwareRequest{},
+		http.StatusAccepted, &installResp)
+
+	s.Do("DELETE", fmt.Sprintf("/api/latest/fleet/vpp_tokens/%d", vppRes.Token.ID), &deleteVPPTokenRequest{}, http.StatusNoContent)
 
 	// Check if the host is listed as pending
 	var listResp listHostsResponse
@@ -10174,20 +10876,20 @@ func (s *integrationMDMTestSuite) TestVPPApps() {
 	s.lastActivityMatches(
 		fleet.ActivityInstalledAppStoreApp{}.ActivityName(),
 		fmt.Sprintf(
-			`{"host_id": %d, "host_display_name": "%s", "software_title": "%s", "app_store_id": "%s", "command_uuid": "%s", "status": "%s"}`,
+			`{"host_id": %d, "host_display_name": "%s", "software_title": "%s", "app_store_id": "%s", "command_uuid": "%s", "status": "%s", "self_service": false}`,
 			mdmHost.ID,
 			mdmHost.DisplayName(),
 			errApp.Name,
 			errApp.AdamID,
 			failedCmdUUID,
-			fleet.SoftwareInstallerFailed,
+			fleet.SoftwareInstallFailed,
 		),
 		0,
 	)
 
 	// Trigger install to the host
 	installResp = installSoftwareResponse{}
-	s.DoJSON("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/software/install/%d", mdmHost.ID, macOSTitleID), &installSoftwareRequest{},
+	s.DoJSON("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/software/%d/install", mdmHost.ID, macOSTitleID), &installSoftwareRequest{},
 		http.StatusAccepted, &installResp)
 	countResp = countHostsResponse{}
 	s.DoJSON("GET", "/api/latest/fleet/hosts/count", nil, http.StatusOK, &countResp, "software_status", "pending", "team_id",
@@ -10221,13 +10923,13 @@ func (s *integrationMDMTestSuite) TestVPPApps() {
 	s.lastActivityMatches(
 		fleet.ActivityInstalledAppStoreApp{}.ActivityName(),
 		fmt.Sprintf(
-			`{"host_id": %d, "host_display_name": "%s", "software_title": "%s", "app_store_id": "%s", "command_uuid": "%s", "status": "%s"}`,
+			`{"host_id": %d, "host_display_name": "%s", "software_title": "%s", "app_store_id": "%s", "command_uuid": "%s", "status": "%s", "self_service": false}`,
 			mdmHost.ID,
 			mdmHost.DisplayName(),
 			addedApp.Name,
 			addedApp.AdamID,
 			cmdUUID,
-			fleet.SoftwareInstallerInstalled,
+			fleet.SoftwareInstalled,
 		),
 		0,
 	)
@@ -10245,13 +10947,13 @@ func (s *integrationMDMTestSuite) TestVPPApps() {
 	require.Equal(t, got1.AppStoreApp.IconURL, ptr.String(addedApp.IconURL))
 	require.Empty(t, got1.AppStoreApp.Name) // Name is only present for installer packages
 	require.Equal(t, got1.AppStoreApp.Version, addedApp.LatestVersion)
-	require.NotNil(t, *got1.Status)
-	require.Equal(t, *got1.Status, fleet.SoftwareInstallerInstalled)
+	require.NotNil(t, got1.Status)
+	require.Equal(t, *got1.Status, fleet.SoftwareInstalled)
 	require.Equal(t, got1.AppStoreApp.LastInstall.CommandUUID, cmdUUID)
 	require.NotNil(t, got1.AppStoreApp.LastInstall.InstalledAt)
 	require.Equal(t, got2.Name, "App 2")
-	require.NotNil(t, *got2.Status)
-	require.Equal(t, *got2.Status, fleet.SoftwareInstallerFailed)
+	require.NotNil(t, got2.Status)
+	require.Equal(t, *got2.Status, fleet.SoftwareInstallFailed)
 	require.NotNil(t, got2.AppStoreApp)
 	require.Equal(t, got2.AppStoreApp.AppStoreID, errApp.AdamID)
 	require.Equal(t, got2.AppStoreApp.IconURL, ptr.String(errApp.IconURL))
@@ -10272,11 +10974,65 @@ func (s *integrationMDMTestSuite) TestVPPApps() {
 	require.Equal(t, got1.AppStoreApp.IconURL, ptr.String(addedApp.IconURL))
 	require.Empty(t, got1.AppStoreApp.Name)
 	require.Equal(t, got1.AppStoreApp.Version, addedApp.LatestVersion)
-	require.NotNil(t, *got1.Status)
-	require.Equal(t, *got1.Status, fleet.SoftwareInstallerInstalled)
+	require.NotNil(t, got1.Status)
+	require.Equal(t, *got1.Status, fleet.SoftwareInstalled)
 	require.Equal(t, got1.AppStoreApp.LastInstall.CommandUUID, cmdUUID)
 	require.NotNil(t, got1.AppStoreApp.LastInstall.InstalledAt)
 
+	// Filter the self-service apps for that host
+	getHostSw = getHostSoftwareResponse{}
+	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/hosts/%d/software", mdmHost.ID), nil, http.StatusOK, &getHostSw, "self_service", "true")
+	require.Len(t, getHostSw.Software, 1)
+	require.Equal(t, appSelfService.Name, got1.Name)
+
+	// Return installed app with software detail query
+	distributedReq := submitDistributedQueryResultsRequestShim{
+		NodeKey: *mdmHost.NodeKey,
+		Results: map[string]json.RawMessage{
+			hostDetailQueryPrefix + "software_macos": json.RawMessage(fmt.Sprintf(
+				`[{"name": "%s", "version": "%s", "type": "Application (macOS)",
+					"bundle_identifier": "%s", "source": "apps", "last_opened_at": "",
+					"installed_path": "/Applications/a.app"}]`, addedApp.Name, addedApp.LatestVersion, addedApp.BundleIdentifier)),
+		},
+		Statuses: map[string]interface{}{
+			hostDistributedQueryPrefix + "software_macos": 0,
+		},
+		Messages: map[string]string{},
+		Stats:    map[string]*fleet.Stats{},
+	}
+	distributedResp := submitDistributedQueryResultsResponse{}
+	s.DoJSON("POST", "/api/osquery/distributed/write", distributedReq, http.StatusOK, &distributedResp)
+
+	// Remove the installed app by not returning it
+	distributedReq = submitDistributedQueryResultsRequestShim{
+		NodeKey: *mdmHost.NodeKey,
+		Results: map[string]json.RawMessage{
+			hostDetailQueryPrefix + "software_macos": json.RawMessage(`[]`),
+		},
+		Statuses: map[string]interface{}{
+			hostDistributedQueryPrefix + "software_macos": 0,
+		},
+		Messages: map[string]string{},
+		Stats:    map[string]*fleet.Stats{},
+	}
+	distributedResp = submitDistributedQueryResultsResponse{}
+	s.DoJSON("POST", "/api/osquery/distributed/write", distributedReq, http.StatusOK, &distributedResp)
+
+	// Check list host software
+	getHostSw = getHostSoftwareResponse{}
+	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/hosts/%d/software", mdmHost.ID), nil, http.StatusOK, &getHostSw)
+	gotSW = getHostSw.Software
+	require.Len(t, gotSW, 2) // App 1 and App 2
+	got1, got2 = gotSW[0], gotSW[1]
+	require.Equal(t, got1.Name, "App 1")
+	require.NotNil(t, got1.AppStoreApp)
+	require.Equal(t, got1.AppStoreApp.AppStoreID, addedApp.AdamID)
+	require.Equal(t, got1.AppStoreApp.IconURL, ptr.String(addedApp.IconURL))
+	require.Empty(t, got1.AppStoreApp.Name) // Name is only present for installer packages
+	require.Equal(t, got1.AppStoreApp.Version, addedApp.LatestVersion)
+	assert.Nil(t, got1.Status)
+	assert.Nil(t, got1.AppStoreApp.LastInstall)
+
 	// Install on iOS and iPadOS devices
 	installs := map[string]struct {
 		installHost    *fleet.Host
@@ -10284,28 +11040,49 @@ func (s *integrationMDMTestSuite) TestVPPApps() {
 		mdmClient      *mdmtest.TestAppleMDMClient
 		app            fleet.VPPApp
 		extraAvailable int
+		hostCount      int
+		deviceToken    string
 	}{
-		"iOS app install": {installHost: iOSHost, titleID: iOSTitleID, mdmClient: iOSMdmClient, app: iOSApp},
-		"iPadOS app install": {installHost: iPadOSHost, titleID: iPadOSTitleID, mdmClient: iPadOSMdmClient, app: iPadOSApp,
-			extraAvailable: 1},
+		"iOS app install": {installHost: iOSHost, titleID: iOSTitleID, mdmClient: iOSMdmClient, app: iOSApp, hostCount: 1},
+		"iPadOS app install": {
+			installHost: iPadOSHost, titleID: iPadOSTitleID, mdmClient: iPadOSMdmClient, app: iPadOSApp,
+			extraAvailable: 1, hostCount: 1,
+		},
+		"macOS app install": {
+			installHost: selfServiceHost, titleID: macOSTitleID, mdmClient: selfServiceDevice, app: macOSApp,
+			hostCount: 2, deviceToken: selfServiceToken,
+		},
 	}
 
 	for name, install := range installs {
 		t.Run(name, func(t *testing.T) {
-
 			installHost := install.installHost
 			titleID := install.titleID
 			mdmClient := install.mdmClient
 			app := install.app
 
-			installResp = installSoftwareResponse{}
-			s.DoJSON("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/software/install/%d", installHost.ID, titleID),
-				&installSoftwareRequest{}, http.StatusAccepted, &installResp)
+			// Self-service install
+			if install.deviceToken != "" {
+				var ssInstallResp submitSelfServiceSoftwareInstallResponse
+				s.DoJSON("POST", fmt.Sprintf("/api/latest/fleet/device/%s/software/install/%d", install.deviceToken, install.titleID),
+					&fleetSelfServiceSoftwareInstallRequest{}, http.StatusAccepted, &ssInstallResp)
+			} else {
+				installResp = installSoftwareResponse{}
+				s.DoJSON("POST", fmt.Sprintf("/api/latest/fleet/hosts/%d/software/%d/install", installHost.ID, titleID),
+					&installSoftwareRequest{}, http.StatusAccepted, &installResp)
+			}
 			countResp = countHostsResponse{}
 			s.DoJSON("GET", "/api/latest/fleet/hosts/count", nil, http.StatusOK, &countResp, "software_status", "pending", "team_id",
 				strconv.Itoa(int(team.ID)), "software_title_id", strconv.Itoa(int(titleID)))
 			require.Equal(t, 1, countResp.Count)
 
+			// send an idle request to grab the command uuid
+			cmd, err = mdmClient.Idle()
+			require.NoError(t, err)
+			var fullCmd micromdm.CommandPayload
+			require.NoError(t, plist.Unmarshal(cmd.Raw, &fullCmd))
+			cmdUUID = cmd.CommandUUID
+
 			// Get pending activity
 			var hostActivitiesResp listHostUpcomingActivitiesResponse
 			s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/hosts/%d/activities/upcoming", installHost.ID),
@@ -10320,40 +11097,45 @@ func (s *integrationMDMTestSuite) TestVPPApps() {
 			require.Len(t, hostActivitiesResp.Activities, 1, "got activities: %v", activitiesToString(hostActivitiesResp.Activities))
 			assert.Equal(t, hostActivitiesResp.Activities[0].Type, fleet.ActivityInstalledAppStoreApp{}.ActivityName())
 			assert.EqualValues(t, 1, hostActivitiesResp.Count)
-
-			// Simulate successful installation on the host
-			cmd, err = mdmClient.Idle()
-			require.NoError(t, err)
-			for cmd != nil {
-				var fullCmd micromdm.CommandPayload
-				switch cmd.Command.RequestType {
-				case "InstallApplication":
-					require.NoError(t, plist.Unmarshal(cmd.Raw, &fullCmd))
-					cmdUUID = cmd.CommandUUID
-					cmd, err = mdmClient.Acknowledge(cmd.CommandUUID)
-					require.NoError(t, err)
-				}
-			}
-
-			listResp = listHostsResponse{}
-			s.DoJSON("GET", "/api/latest/fleet/hosts", nil, http.StatusOK, &listResp, "software_status", "installed", "team_id",
-				strconv.Itoa(int(team.ID)), "software_title_id", strconv.Itoa(int(titleID)))
-			assert.Len(t, listResp.Hosts, 1)
-			countResp = countHostsResponse{}
-			s.DoJSON("GET", "/api/latest/fleet/hosts/count", nil, http.StatusOK, &countResp, "software_status", "installed", "team_id",
-				strconv.Itoa(int(team.ID)), "software_title_id", strconv.Itoa(int(titleID)))
-			assert.Equal(t, 1, countResp.Count)
-
-			s.lastActivityMatches(
-				fleet.ActivityInstalledAppStoreApp{}.ActivityName(),
+			assert.JSONEq(
+				t,
 				fmt.Sprintf(
-					`{"host_id": %d, "host_display_name": "%s", "software_title": "%s", "app_store_id": "%s", "command_uuid": "%s", "status": "%s"}`,
+					`{"host_id": %d, "host_display_name": "%s", "software_title": "%s", "app_store_id": "%s", "command_uuid": "%s", "status": "%s", "self_service": %v}`,
 					installHost.ID,
 					installHost.DisplayName(),
 					app.Name,
 					app.AdamID,
 					cmdUUID,
-					fleet.SoftwareInstallerInstalled,
+					fleet.SoftwareInstallPending,
+					install.deviceToken != "",
+				),
+				string(*hostActivitiesResp.Activities[0].Details),
+			)
+
+			// Simulate successful installation on the host
+			cmd, err = mdmClient.Acknowledge(cmd.CommandUUID)
+			require.NoError(t, err)
+
+			listResp = listHostsResponse{}
+			s.DoJSON("GET", "/api/latest/fleet/hosts", nil, http.StatusOK, &listResp, "software_status", "installed", "team_id",
+				strconv.Itoa(int(team.ID)), "software_title_id", strconv.Itoa(int(titleID)))
+			assert.Len(t, listResp.Hosts, install.hostCount)
+			countResp = countHostsResponse{}
+			s.DoJSON("GET", "/api/latest/fleet/hosts/count", nil, http.StatusOK, &countResp, "software_status", "installed", "team_id",
+				strconv.Itoa(int(team.ID)), "software_title_id", strconv.Itoa(int(titleID)))
+			assert.Equal(t, install.hostCount, countResp.Count)
+
+			s.lastActivityMatches(
+				fleet.ActivityInstalledAppStoreApp{}.ActivityName(),
+				fmt.Sprintf(
+					`{"host_id": %d, "host_display_name": "%s", "software_title": "%s", "app_store_id": "%s", "command_uuid": "%s", "status": "%s", "self_service": %v}`,
+					installHost.ID,
+					installHost.DisplayName(),
+					app.Name,
+					app.AdamID,
+					cmdUUID,
+					fleet.SoftwareInstalled,
+					install.deviceToken != "",
 				),
 				0,
 			)
@@ -10361,7 +11143,7 @@ func (s *integrationMDMTestSuite) TestVPPApps() {
 			// Check list host software
 			getHostSw = getHostSoftwareResponse{}
 			s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/hosts/%d/software", installHost.ID), nil, http.StatusOK, &getHostSw)
-			require.Len(t, getHostSw.Software, 1+install.extraAvailable)
+			require.Len(t, getHostSw.Software, install.hostCount+install.extraAvailable)
 			var foundInstalledApp bool
 			for index := range getHostSw.Software {
 				got1 = getHostSw.Software[index]
@@ -10372,7 +11154,7 @@ func (s *integrationMDMTestSuite) TestVPPApps() {
 					require.Equal(t, got1.AppStoreApp.IconURL, ptr.String(app.IconURL))
 					require.Empty(t, got1.AppStoreApp.Name) // Name is only present for installer packages
 					require.Equal(t, got1.AppStoreApp.Version, app.LatestVersion)
-					require.Equal(t, *got1.Status, fleet.SoftwareInstallerInstalled)
+					require.Equal(t, *got1.Status, fleet.SoftwareInstalled)
 					require.Equal(t, got1.AppStoreApp.LastInstall.CommandUUID, cmdUUID)
 					require.NotNil(t, got1.AppStoreApp.LastInstall.InstalledAt)
 					foundInstalledApp = true
@@ -10382,8 +11164,231 @@ func (s *integrationMDMTestSuite) TestVPPApps() {
 		})
 	}
 
+	// Attempt (and fail) to self-service install iPad and iOS titles
+	var ssInstallResp submitSelfServiceSoftwareInstallResponse
+	s.DoJSON("POST", fmt.Sprintf("/api/latest/fleet/device/%s/software/install/%d", selfServiceToken, iPadOSTitleID), &fleetSelfServiceSoftwareInstallRequest{},
+		http.StatusBadRequest, &ssInstallResp)
+	s.DoJSON("POST", fmt.Sprintf("/api/latest/fleet/device/%s/software/install/%d", selfServiceToken, iOSTitleID), &fleetSelfServiceSoftwareInstallRequest{},
+		http.StatusBadRequest, &ssInstallResp)
+
 	// Delete VPP token and check that it's not appearing anymore
-	s.Do("DELETE", "/api/latest/fleet/mdm/apple/vpp_token", &deleteMDMAppleVPPTokenRequest{}, http.StatusNoContent)
-	s.DoJSON("GET", "/api/latest/fleet/vpp", &getMDMAppleVPPTokenRequest{}, http.StatusNotFound, &resp)
-	s.lastActivityMatches(fleet.ActivityDisabledVPP{}.ActivityName(), "", 0)
+
+	s.Do("DELETE", fmt.Sprintf("/api/latest/fleet/vpp_tokens/%d", validToken.Token.ID), &deleteVPPTokenResponse{}, http.StatusNoContent)
+	s.DoJSON("GET", "/api/latest/fleet/vpp_tokens", &getVPPTokensRequest{}, http.StatusOK, &resp)
+}
+
+func (s *integrationMDMTestSuite) TestEnrollmentProfilesWithSpecialChars() {
+	t := s.T()
+	ctx := context.Background()
+
+	initialConfig, err := s.ds.AppConfig(ctx)
+	require.NoError(t, err)
+	initialSecrets, err := s.ds.GetEnrollSecrets(ctx, nil)
+	require.NoError(t, err)
+
+	nameWithInvalidChars := "Fleet & Device <3 Management"
+	/* #nosec G101 -- this is a made up value for tests */
+	enrollSecretWithInvalidChars := "1<2>3&4&/"
+
+	acResp := appConfigResponse{}
+	s.DoJSON("PATCH", "/api/latest/fleet/config", json.RawMessage(fmt.Sprintf(`{
+		"org_info": {
+			"org_name": %q
+		}
+	}`, nameWithInvalidChars)), http.StatusOK, &acResp)
+	enrollSecretResp := applyEnrollSecretSpecResponse{}
+	s.DoJSON("POST", "/api/latest/fleet/spec/enroll_secret", applyEnrollSecretSpecRequest{
+		Spec: &fleet.EnrollSecretSpec{
+			Secrets: []*fleet.EnrollSecret{{Secret: enrollSecretWithInvalidChars}},
+		},
+	}, http.StatusOK, &enrollSecretResp)
+	t.Cleanup(func() {
+		acResp := appConfigResponse{}
+		s.DoJSON("PATCH", "/api/latest/fleet/config", json.RawMessage(fmt.Sprintf(`{
+		  "org_info": {
+			  "org_name": %q
+		  }
+		}`, initialConfig.OrgInfo.OrgName)), http.StatusOK, &acResp)
+		s.DoJSON("POST", "/api/latest/fleet/spec/enroll_secret", applyEnrollSecretSpecRequest{
+			Spec: &fleet.EnrollSecretSpec{
+				Secrets: initialSecrets,
+			},
+		}, http.StatusOK, &enrollSecretResp)
+	})
+
+	// manual enrollment from My Device
+	token := "token_test_manual_enroll"
+	createHostAndDeviceToken(t, s.ds, token)
+	s.downloadAndVerifyOTAEnrollmentProfile("/api/latest/fleet/device/" + token + "/mdm/apple/manual_enrollment_profile")
+
+	// automatic enrollment by token
+	rawMsg := json.RawMessage(`{"allow_pairing": true}`)
+	_, err = s.ds.NewMDMAppleEnrollmentProfile(ctx, fleet.MDMAppleEnrollmentProfilePayload{
+		Type:       "automatic",
+		DEPProfile: &rawMsg,
+		Token:      "abcd",
+	})
+	require.NoError(t, err)
+	s.downloadAndVerifyEnrollmentProfile(apple_mdm.EnrollPath + "?token=abcd")
+
+	// unsigned manual enrollment profile for IT admins
+	s.downloadAndVerifyEnrollmentProfile("/api/latest/fleet/enrollment_profiles/manual")
+
+	// ensure the fleetd profile sends a good enroll secret too
+	s.awaitTriggerProfileSchedule(t)
+	prof := s.assertConfigProfilesByIdentifier(nil, mobileconfig.FleetdConfigPayloadIdentifier, true)
+
+	type fleetdPlist struct {
+		PayloadContent []struct {
+			EnrollSecret string `plist:"EnrollSecret"`
+		} `plist:"PayloadContent"`
+	}
+
+	// Parse the plist data
+	var parsedData fleetdPlist
+	err = plist.NewDecoder(bytes.NewReader(prof.Mobileconfig)).Decode(&parsedData)
+	require.NoError(t, err)
+	require.Equal(t, enrollSecretWithInvalidChars, parsedData.PayloadContent[0].EnrollSecret)
+}
+
+func (s *integrationMDMTestSuite) TestOTAEnrollment() {
+	t := s.T()
+
+	// create a global enroll secret
+	globalSecret := "global_secret"
+	var applyResp applyEnrollSecretSpecResponse
+	s.DoJSON("POST", "/api/latest/fleet/spec/enroll_secret", applyEnrollSecretSpecRequest{
+		Spec: &fleet.EnrollSecretSpec{
+			Secrets: []*fleet.EnrollSecret{{Secret: globalSecret}},
+		},
+	}, http.StatusOK, &applyResp)
+
+	reqBody := []byte(`<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>PRODUCT</key>
+	<string></string>
+	<key>SERIAL</key>
+	<string>foo</string>
+	<key>UDID</key>
+	<string></string>
+	<key>VERSION</key>
+	<string></string>
+</dict>
+</plist>`)
+
+	// request with no enroll secret
+	httpResp := s.DoRawNoAuth("POST", "/api/latest/fleet/ota_enrollment", reqBody, http.StatusForbidden)
+	errMsg := extractServerErrorText(httpResp.Body)
+	require.Contains(t, errMsg, "Couldn't install the profile. Invalid enroll secret. Please contact your IT admin.")
+	require.NoError(t, httpResp.Body.Close())
+
+	// request with no body
+	httpResp = s.DoRawNoAuth("POST", "/api/latest/fleet/ota_enrollment?enroll_secret=foo", nil, http.StatusBadRequest)
+	errMsg = extractServerErrorText(httpResp.Body)
+	require.Contains(t, errMsg, "invalid request body")
+	require.NoError(t, httpResp.Body.Close())
+
+	// request with unsigned body
+	httpResp = s.DoRawNoAuth("POST", "/api/latest/fleet/ota_enrollment?enroll_secret=foo", reqBody, http.StatusBadRequest)
+	errMsg = extractServerErrorText(httpResp.Body)
+	require.Contains(t, errMsg, "invalid request body")
+	require.NoError(t, httpResp.Body.Close())
+
+	cert, key, err := apple_mdm.NewSCEPCACertKey()
+	require.NoError(t, err)
+	signedData, err := pkcs7.NewSignedData(reqBody)
+	require.NoError(t, err)
+	require.NoError(t, signedData.AddSigner(cert, key, pkcs7.SignerInfoConfig{}))
+	signedReqBody, err := signedData.Finish()
+	require.NoError(t, err)
+
+	// request with invalid apple signature
+	httpResp = s.DoRawNoAuth("POST", "/api/latest/fleet/ota_enrollment?enroll_secret=foo", signedReqBody, http.StatusForbidden)
+	errMsg = extractServerErrorText(httpResp.Body)
+	require.Contains(t, errMsg, "Couldn't install the profile. Invalid enroll secret. Please contact your IT admin.")
+	require.NoError(t, httpResp.Body.Close())
+
+	// request with invalid device signature
+	os.Setenv("FLEET_DEV_MDM_APPLE_DISABLE_DEVICE_INFO_CERT_VERIFY", "1")
+	httpResp = s.DoRawNoAuth("POST", "/api/latest/fleet/ota_enrollment?enroll_secret=foo", signedReqBody, http.StatusForbidden)
+	errMsg = extractServerErrorText(httpResp.Body)
+	require.Contains(t, errMsg, "Couldn't install the profile. Invalid enroll secret. Please contact your IT admin.")
+	require.NoError(t, httpResp.Body.Close())
+
+	// request without serial number
+	signedData, err = pkcs7.NewSignedData([]byte(`<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>SERIAL</key>
+	<string></string>
+</dict>
+</plist>`))
+	require.NoError(t, err)
+	require.NoError(t, signedData.AddSigner(cert, key, pkcs7.SignerInfoConfig{}))
+	signedReqBody, err = signedData.Finish()
+	require.NoError(t, err)
+	httpResp = s.DoRawNoAuth("POST", "/api/latest/fleet/ota_enrollment?enroll_secret=foo", signedReqBody, http.StatusBadRequest)
+	errMsg = extractServerErrorText(httpResp.Body)
+	require.Contains(t, errMsg, "SERIAL is required")
+	require.NoError(t, httpResp.Body.Close())
+
+	checkInstallFleetdCommandSent := func(mdmDevice *mdmtest.TestAppleMDMClient, wantCommand bool) {
+		foundInstallFleetdCommand := false
+		cmd, err := mdmDevice.Idle()
+		require.NoError(t, err)
+		for cmd != nil {
+			var fullCmd micromdm.CommandPayload
+			require.NoError(t, plist.Unmarshal(cmd.Raw, &fullCmd))
+			if manifest := fullCmd.Command.InstallEnterpriseApplication.ManifestURL; manifest != nil {
+				foundInstallFleetdCommand = true
+				require.Equal(t, "InstallEnterpriseApplication", cmd.Command.RequestType)
+				require.Contains(t, *fullCmd.Command.InstallEnterpriseApplication.ManifestURL, fleetdbase.GetPKGManifestURL())
+			}
+			cmd, err = mdmDevice.Acknowledge(cmd.CommandUUID)
+			require.NoError(t, err)
+		}
+		require.Equal(t, wantCommand, foundInstallFleetdCommand)
+	}
+
+	hwModel := "MacBookPro16,1"
+	mdmDevice := mdmtest.NewTestMDMClientAppleOTA(
+		s.server.URL,
+		globalSecret,
+		hwModel,
+	)
+	require.NoError(t, mdmDevice.Enroll())
+	s.runWorker()
+	checkInstallFleetdCommandSent(mdmDevice, true)
+
+	var hostByIdentifierResp getHostResponse
+	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/hosts/identifier/%s", mdmDevice.UUID), nil, http.StatusOK, &hostByIdentifierResp)
+	require.Equal(t, hwModel, hostByIdentifierResp.Host.HardwareModel)
+	require.Equal(t, "darwin", hostByIdentifierResp.Host.Platform)
+	require.Nil(t, hostByIdentifierResp.Host.TeamID)
+
+	// create a team with a different enroll secret
+	var specResp applyTeamSpecsResponse
+	teamSecret := "team_secret"
+	teamSpecs := applyTeamSpecsRequest{Specs: []*fleet.TeamSpec{{Name: "newteam", Secrets: &[]fleet.EnrollSecret{{Secret: teamSecret}}}}}
+	s.DoJSON("POST", "/api/latest/fleet/spec/teams", teamSpecs, http.StatusOK, &specResp)
+
+	hwModel = "iPad13,16"
+	mdmDevice = mdmtest.NewTestMDMClientAppleOTA(
+		s.server.URL,
+		teamSecret,
+		hwModel,
+	)
+	require.NoError(t, mdmDevice.Enroll())
+	s.runWorker()
+	checkInstallFleetdCommandSent(mdmDevice, false)
+
+	hostByIdentifierResp = getHostResponse{}
+	s.DoJSON("GET", fmt.Sprintf("/api/latest/fleet/hosts/identifier/%s", mdmDevice.UUID), nil, http.StatusOK, &hostByIdentifierResp)
+	require.Equal(t, hwModel, hostByIdentifierResp.Host.HardwareModel)
+	require.Equal(t, "ipados", hostByIdentifierResp.Host.Platform)
+	require.NotNil(t, hostByIdentifierResp.Host.TeamID)
+	require.Equal(t, specResp.TeamIDsByName["newteam"], *hostByIdentifierResp.Host.TeamID)
 }
diff --git a/server/service/labels.go b/server/service/labels.go
index c79e8fadb9..2922ec51d8 100644
--- a/server/service/labels.go
+++ b/server/service/labels.go
@@ -165,6 +165,7 @@ func (svc *Service) ModifyLabel(ctx context.Context, id uint, payload fleet.Modi
 	if label.LabelType == fleet.LabelTypeBuiltIn {
 		return nil, nil, fleet.NewInvalidArgumentError("label_type", fmt.Sprintf("cannot modify built-in label '%s'", label.Name))
 	}
+	originalLabelName := label.Name
 	if payload.Name != nil {
 		// Check if the new name is a reserved label name
 		for name := range fleet.ReservedLabelNames() {
@@ -188,7 +189,7 @@ func (svc *Service) ModifyLabel(ctx context.Context, id uint, payload fleet.Modi
 	// hostnames).
 	if label.LabelMembershipType == fleet.LabelMembershipTypeManual && payload.Hosts != nil {
 		spec := fleet.LabelSpec{
-			Name:                label.Name,
+			Name:                originalLabelName,
 			Description:         label.Description,
 			Query:               label.Query,
 			Platform:            label.Platform,
@@ -200,11 +201,16 @@ func (svc *Service) ModifyLabel(ctx context.Context, id uint, payload fleet.Modi
 			return nil, nil, err
 		}
 		spec.Hosts = hostnames
+		// Note: ApplyLabelSpecs cannot update label name since it uses the name as a key.
+		// So, we must handle it later.
 		if err := svc.ds.ApplyLabelSpecs(ctx, []*fleet.LabelSpec{&spec}); err != nil {
 			return nil, nil, err
 		}
-
-		// must reload it to get the host counts information
+		// If the label name has changed, we must update it.
+		if originalLabelName != label.Name {
+			return svc.ds.SaveLabel(ctx, label, filter)
+		}
+		// Otherwise, simply reload label to get the host counts information
 		return svc.ds.Label(ctx, id, filter)
 	}
 	return svc.ds.SaveLabel(ctx, label, filter)
diff --git a/server/service/mdm.go b/server/service/mdm.go
index bd80e45562..7a06c015cd 100644
--- a/server/service/mdm.go
+++ b/server/service/mdm.go
@@ -6,7 +6,6 @@ import (
 	"crypto/rsa"
 	"crypto/tls"
 	"crypto/x509"
-	"encoding/base64"
 	"encoding/json"
 	"encoding/pem"
 	"errors"
@@ -31,7 +30,6 @@ import (
 	"github.com/fleetdm/fleet/v4/server/fleet"
 	"github.com/fleetdm/fleet/v4/server/mdm"
 	apple_mdm "github.com/fleetdm/fleet/v4/server/mdm/apple"
-	"github.com/fleetdm/fleet/v4/server/mdm/apple/vpp"
 	"github.com/fleetdm/fleet/v4/server/mdm/assets"
 	nanomdm "github.com/fleetdm/fleet/v4/server/mdm/nanomdm/mdm"
 	"github.com/fleetdm/fleet/v4/server/ptr"
@@ -568,13 +566,14 @@ func (svc *Service) enqueueAppleMDMCommand(ctx context.Context, rawXMLCmd []byte
 		var apnsErr *apple_mdm.APNSDeliveryError
 		var mysqlErr *mysql.MySQLError
 		if errors.As(err, &apnsErr) {
-			if len(apnsErr.FailedUUIDs) < len(deviceIDs) {
+			failedUUIDs := apnsErr.FailedUUIDs()
+			if len(failedUUIDs) < len(deviceIDs) {
 				// some hosts properly received the command, so return success, with the list
 				// of failed uuids.
 				return &fleet.CommandEnqueueResult{
 					CommandUUID: cmd.CommandUUID,
 					RequestType: cmd.Command.RequestType,
-					FailedUUIDs: apnsErr.FailedUUIDs,
+					FailedUUIDs: failedUUIDs,
 				}, nil
 			}
 			// push failed for all hosts
@@ -1168,7 +1167,7 @@ func (svc *Service) DeleteMDMWindowsConfigProfile(ctx context.Context, profileUU
 	}
 
 	// cannot use the profile ID as it is now deleted
-	if err := svc.ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{teamID}, nil, nil); err != nil {
+	if _, err := svc.ds.BulkSetPendingMDMHostProfiles(ctx, nil, []uint{teamID}, nil, nil); err != nil {
 		return ctxerr.Wrap(ctx, err, "bulk set pending host profiles")
 	}
 
@@ -1413,7 +1412,7 @@ func (svc *Service) NewMDMWindowsConfigProfile(ctx context.Context, teamID uint,
 		return nil, ctxerr.Wrap(ctx, err)
 	}
 
-	if err := svc.ds.BulkSetPendingMDMHostProfiles(ctx, nil, nil, []string{newCP.ProfileUUID}, nil); err != nil {
+	if _, err := svc.ds.BulkSetPendingMDMHostProfiles(ctx, nil, nil, []string{newCP.ProfileUUID}, nil); err != nil {
 		return nil, ctxerr.Wrap(ctx, err, "bulk set pending host profiles")
 	}
 
@@ -1601,7 +1600,8 @@ func (svc *Service) BatchSetMDMProfiles(
 		return nil
 	}
 
-	if err := svc.ds.BatchSetMDMProfiles(ctx, tmID, appleProfiles, windowsProfiles, appleDecls); err != nil {
+	var profUpdates fleet.MDMProfilesUpdates
+	if profUpdates, err = svc.ds.BatchSetMDMProfiles(ctx, tmID, appleProfiles, windowsProfiles, appleDecls); err != nil {
 		return ctxerr.Wrap(ctx, err, "setting config profiles")
 	}
 
@@ -1610,7 +1610,8 @@ func (svc *Service) BatchSetMDMProfiles(
 	for _, p := range windowsProfiles {
 		winProfUUIDs = append(winProfUUIDs, p.ProfileUUID)
 	}
-	if err := svc.ds.BulkSetPendingMDMHostProfiles(ctx, nil, nil, winProfUUIDs, nil); err != nil {
+	winUpdates, err := svc.ds.BulkSetPendingMDMHostProfiles(ctx, nil, nil, winProfUUIDs, nil)
+	if err != nil {
 		return ctxerr.Wrap(ctx, err, "bulk set pending windows host profiles")
 	}
 
@@ -1619,33 +1620,42 @@ func (svc *Service) BatchSetMDMProfiles(
 	for _, p := range appleProfiles {
 		appleProfUUIDs = append(appleProfUUIDs, p.ProfileUUID)
 	}
-	if err := svc.ds.BulkSetPendingMDMHostProfiles(ctx, nil, nil, appleProfUUIDs, nil); err != nil {
+	appleUpdates, err := svc.ds.BulkSetPendingMDMHostProfiles(ctx, nil, nil, appleProfUUIDs, nil)
+	if err != nil {
 		return ctxerr.Wrap(ctx, err, "bulk set pending apple host profiles")
 	}
+	updates := fleet.MDMProfilesUpdates{
+		AppleConfigProfile:   profUpdates.AppleConfigProfile || winUpdates.AppleConfigProfile || appleUpdates.AppleConfigProfile,
+		WindowsConfigProfile: profUpdates.WindowsConfigProfile || winUpdates.WindowsConfigProfile || appleUpdates.WindowsConfigProfile,
+		AppleDeclaration:     profUpdates.AppleDeclaration || winUpdates.AppleDeclaration || appleUpdates.AppleDeclaration,
+	}
 
-	// TODO(roberto): should we generate activities only of any profiles were
-	// changed? this is the existing behavior for macOS profiles so I'm
-	// leaving it as-is for now.
-	if err := svc.NewActivity(
-		ctx, authz.UserFromContext(ctx), &fleet.ActivityTypeEditedMacosProfile{
-			TeamID:   tmID,
-			TeamName: tmName,
-		}); err != nil {
-		return ctxerr.Wrap(ctx, err, "logging activity for edited macos profile")
+	if updates.AppleConfigProfile {
+		if err := svc.NewActivity(
+			ctx, authz.UserFromContext(ctx), &fleet.ActivityTypeEditedMacosProfile{
+				TeamID:   tmID,
+				TeamName: tmName,
+			}); err != nil {
+			return ctxerr.Wrap(ctx, err, "logging activity for edited macos profile")
+		}
 	}
-	if err := svc.NewActivity(
-		ctx, authz.UserFromContext(ctx), &fleet.ActivityTypeEditedWindowsProfile{
-			TeamID:   tmID,
-			TeamName: tmName,
-		}); err != nil {
-		return ctxerr.Wrap(ctx, err, "logging activity for edited windows profile")
+	if updates.WindowsConfigProfile {
+		if err := svc.NewActivity(
+			ctx, authz.UserFromContext(ctx), &fleet.ActivityTypeEditedWindowsProfile{
+				TeamID:   tmID,
+				TeamName: tmName,
+			}); err != nil {
+			return ctxerr.Wrap(ctx, err, "logging activity for edited windows profile")
+		}
 	}
-	if err := svc.NewActivity(
-		ctx, authz.UserFromContext(ctx), &fleet.ActivityTypeEditedDeclarationProfile{
-			TeamID:   tmID,
-			TeamName: tmName,
-		}); err != nil {
-		return ctxerr.Wrap(ctx, err, "logging activity for edited macos declarations")
+	if updates.AppleDeclaration {
+		if err := svc.NewActivity(
+			ctx, authz.UserFromContext(ctx), &fleet.ActivityTypeEditedDeclarationProfile{
+				TeamID:   tmID,
+				TeamName: tmName,
+			}); err != nil {
+			return ctxerr.Wrap(ctx, err, "logging activity for edited macos declarations")
+		}
 	}
 
 	return nil
@@ -2341,6 +2351,16 @@ func (svc *Service) GetMDMAppleCSR(ctx context.Context) ([]byte, error) {
 	if err != nil {
 		var fwe apple_mdm.FleetWebsiteError
 		if errors.As(err, &fwe) {
+			// From svc.RequestMDMAppleCSR: fleetdm.com returns a bad request here if the email is invalid.
+			if fwe.Status >= 400 && fwe.Status <= 499 {
+				return nil, ctxerr.Wrap(
+					ctx,
+					fleet.NewInvalidArgumentError(
+						"email_address",
+						fmt.Sprintf("this email address is not valid: %v", err),
+					),
+				)
+			}
 			return nil, ctxerr.Wrap(
 				ctx,
 				fleet.NewUserMessageError(
@@ -2532,216 +2552,3 @@ func (svc *Service) DeleteMDMAppleAPNSCert(ctx context.Context) error {
 
 	return svc.ds.SaveAppConfig(ctx, appCfg)
 }
-
-////////////////////////////////////////////////////////////////////////////////
-// POST /mdm/apple/vpp_token
-////////////////////////////////////////////////////////////////////////////////
-
-type uploadMDMAppleVPPTokenRequest struct {
-	File *multipart.FileHeader
-}
-
-func (uploadMDMAppleVPPTokenRequest) DecodeRequest(ctx context.Context, r *http.Request) (interface{}, error) {
-	decoded := uploadMDMAppleVPPTokenRequest{}
-
-	err := r.ParseMultipartForm(512 * units.MiB)
-	if err != nil {
-		return nil, &fleet.BadRequestError{
-			Message:     "failed to parse multipart form",
-			InternalErr: err,
-		}
-	}
-
-	if r.MultipartForm.File["token"] == nil || len(r.MultipartForm.File["token"]) == 0 {
-		return nil, &fleet.BadRequestError{
-			Message:     "token multipart field is required",
-			InternalErr: err,
-		}
-	}
-
-	decoded.File = r.MultipartForm.File["token"][0]
-
-	return &decoded, nil
-}
-
-type uploadMDMAppleVPPTokenResponse struct {
-	Err error `json:"error,omitempty"`
-}
-
-func (r uploadMDMAppleVPPTokenResponse) Status() int { return http.StatusAccepted }
-
-func (r uploadMDMAppleVPPTokenResponse) error() error {
-	return r.Err
-}
-
-func uploadMDMAppleVPPTokenEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (errorer, error) {
-	req := request.(*uploadMDMAppleVPPTokenRequest)
-	file, err := req.File.Open()
-	if err != nil {
-		return uploadMDMAppleAPNSCertResponse{Err: err}, nil
-	}
-	defer file.Close()
-
-	if err := svc.UploadMDMAppleVPPToken(ctx, file); err != nil {
-		return &uploadMDMAppleVPPTokenResponse{Err: err}, nil
-	}
-
-	return &uploadMDMAppleVPPTokenResponse{}, nil
-}
-
-func (svc *Service) UploadMDMAppleVPPToken(ctx context.Context, token io.ReadSeeker) error {
-	if err := svc.authz.Authorize(ctx, &fleet.AppleCSR{}, fleet.ActionWrite); err != nil {
-		return err
-	}
-
-	privateKey := svc.config.Server.PrivateKey
-	if testSetEmptyPrivateKey {
-		privateKey = ""
-	}
-
-	if len(privateKey) == 0 {
-		return ctxerr.New(ctx, "Couldn't upload content token. Missing required private key. Learn how to configure the private key here: https://fleetdm.com/learn-more-about/fleet-server-private-key")
-	}
-
-	if token == nil {
-		return ctxerr.Wrap(ctx, fleet.NewInvalidArgumentError("token", "Invalid token. Please provide a valid content token from Apple Business Manager."))
-	}
-
-	tokenBytes, err := io.ReadAll(token)
-	if err != nil {
-		return ctxerr.Wrap(ctx, err, "reading VPP token")
-	}
-
-	locName, err := vpp.GetConfig(string(tokenBytes))
-	if err != nil {
-		var vppErr *vpp.ErrorResponse
-		if errors.As(err, &vppErr) {
-			// Per https://developer.apple.com/documentation/devicemanagement/app_and_book_management/app_and_book_management_legacy/interpreting_error_codes
-			if vppErr.ErrorNumber == 9622 {
-				return ctxerr.Wrap(ctx, fleet.NewInvalidArgumentError("token", "Invalid token. Please provide a valid content token from Apple Business Manager."))
-			}
-		}
-		return ctxerr.Wrap(ctx, err, "validating VPP token with Apple")
-	}
-
-	data := fleet.VPPTokenData{
-		Token:    string(tokenBytes),
-		Location: locName,
-	}
-
-	dataBytes, err := json.Marshal(data)
-	if err != nil {
-		return ctxerr.Wrap(ctx, err, "creating VPP data object for storage")
-	}
-
-	err = svc.ds.ReplaceMDMConfigAssets(ctx, []fleet.MDMConfigAsset{
-		{Name: fleet.MDMAssetVPPToken, Value: dataBytes},
-	})
-	if err != nil {
-		return ctxerr.Wrap(ctx, err, "writing VPP token to db")
-	}
-
-	act := fleet.ActivityEnabledVPP{}
-	if err := svc.NewActivity(ctx, authz.UserFromContext(ctx), act); err != nil {
-		return ctxerr.Wrap(ctx, err, "create activity for upload VPP token")
-	}
-
-	return nil
-}
-
-////////////////////////////////////////////////////////////////////////////////
-// GET /vpp
-////////////////////////////////////////////////////////////////////////////////
-
-type getMDMAppleVPPTokenRequest struct{}
-
-type getMDMAppleVPPTokenResponse struct {
-	*fleet.VPPTokenInfo
-	Err error `json:"error,omitempty"`
-}
-
-func (r getMDMAppleVPPTokenResponse) error() error {
-	return r.Err
-}
-
-func getMDMAppleVPPTokenEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (errorer, error) {
-	vpp, err := svc.GetMDMAppleVPPToken(ctx)
-	if err != nil {
-		return &getMDMAppleVPPTokenResponse{Err: err}, nil
-	}
-
-	return &getMDMAppleVPPTokenResponse{VPPTokenInfo: vpp}, nil
-}
-
-func (svc *Service) GetMDMAppleVPPToken(ctx context.Context) (*fleet.VPPTokenInfo, error) {
-	if err := svc.authz.Authorize(ctx, &fleet.AppleCSR{}, fleet.ActionRead); err != nil {
-		return nil, err
-	}
-
-	assetMap, err := svc.ds.GetAllMDMConfigAssetsByName(ctx, []fleet.MDMAssetName{fleet.MDMAssetVPPToken})
-	if err != nil {
-		return nil, ctxerr.Wrap(ctx, err, "get mdm config assets by name VPP token")
-	}
-
-	var tokenData fleet.VPPTokenData
-	if err := json.Unmarshal(assetMap[fleet.MDMAssetVPPToken].Value, &tokenData); err != nil {
-		return nil, ctxerr.Wrap(ctx, err, "unmarshaling VPP token data")
-	}
-
-	var rawToken fleet.VPPTokenRaw
-	decodedBytes, err := base64.StdEncoding.DecodeString(tokenData.Token)
-	if err != nil {
-		return nil, ctxerr.Wrap(ctx, err, "decoding VPP token")
-	}
-
-	if err := json.Unmarshal(decodedBytes, &rawToken); err != nil {
-		return nil, ctxerr.Wrap(ctx, err, "unmarshaling VPP token")
-	}
-
-	info := fleet.VPPTokenInfo{
-		Location:  tokenData.Location,
-		RenewDate: rawToken.ExpDate,
-		OrgName:   rawToken.OrgName,
-	}
-
-	return &info, nil
-}
-
-////////////////////////////////////////////////////////////////////////////////
-// DELETE /mdm/apple/vpp_token
-////////////////////////////////////////////////////////////////////////////////
-
-type deleteMDMAppleVPPTokenRequest struct{}
-
-type deleteMDMAppleVPPTokenResponse struct {
-	Err error `json:"error,omitempty"`
-}
-
-func (r deleteMDMAppleVPPTokenResponse) error() error { return r.Err }
-
-func (r deleteMDMAppleVPPTokenResponse) Status() int { return http.StatusNoContent }
-
-func deleteMDMAppleVPPTokenEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (errorer, error) {
-	if err := svc.DeleteMDMAppleVPPToken(ctx); err != nil {
-		return &deleteMDMAppleVPPTokenResponse{Err: err}, nil
-	}
-
-	return &deleteMDMAppleVPPTokenResponse{}, nil
-}
-
-func (svc *Service) DeleteMDMAppleVPPToken(ctx context.Context) error {
-	if err := svc.authz.Authorize(ctx, &fleet.AppleCSR{}, fleet.ActionWrite); err != nil {
-		return err
-	}
-
-	if err := svc.ds.DeleteMDMConfigAssetsByName(ctx, []fleet.MDMAssetName{fleet.MDMAssetVPPToken}); err != nil {
-		return ctxerr.Wrap(ctx, err, "delete VPP token")
-	}
-
-	act := fleet.ActivityDisabledVPP{}
-	if err := svc.NewActivity(ctx, authz.UserFromContext(ctx), act); err != nil {
-		return ctxerr.Wrap(ctx, err, "create activity for delete VPP token")
-	}
-
-	return nil
-}
diff --git a/server/service/mdm_test.go b/server/service/mdm_test.go
index 92e3b3db31..3a626af027 100644
--- a/server/service/mdm_test.go
+++ b/server/service/mdm_test.go
@@ -123,6 +123,16 @@ func TestMDMAppleAuthorization(t *testing.T) {
 		return nil
 	}
 
+	ds.ListABMTokensFunc = func(ctx context.Context) ([]*fleet.ABMToken, error) {
+		return nil, nil
+	}
+	ds.ListVPPTokensFunc = func(ctx context.Context) ([]*fleet.VPPTokenDB, error) {
+		return nil, nil
+	}
+	ds.GetVPPTokenFunc = func(ctx context.Context, id uint) (*fleet.VPPTokenDB, error) {
+		return nil, &notFoundErr{}
+	}
+
 	ds.DeleteMDMConfigAssetsByNameFunc = func(ctx context.Context, assetNames []fleet.MDMAssetName) error { return nil }
 
 	// use a custom implementation of checkAuthErr as the service call will fail
@@ -158,13 +168,13 @@ func TestMDMAppleAuthorization(t *testing.T) {
 		err = svc.DeleteMDMAppleAPNSCert(ctx) // Don't expect anything other than an authz error here, since this is pretty much just a DB wrapper.
 		checkAuthErr(t, shouldFailWithAuth, err)
 
-		err = svc.UploadMDMAppleVPPToken(ctx, nil)
+		_, err = svc.UploadVPPToken(ctx, nil)
 		checkAuthErr(t, shouldFailWithAuth, err)
 
-		_, err = svc.GetMDMAppleVPPToken(ctx)
+		_, err = svc.GetVPPTokens(ctx)
 		checkAuthErr(t, shouldFailWithAuth, err)
 
-		err = svc.DeleteMDMAppleVPPToken(ctx)
+		err = svc.DeleteVPPToken(ctx, 0)
 		checkAuthErr(t, shouldFailWithAuth, err)
 	}
 
@@ -1066,8 +1076,10 @@ func TestMDMWindowsConfigProfileAuthz(t *testing.T) {
 	ds.ListMDMConfigProfilesFunc = func(ctx context.Context, teamID *uint, opt fleet.ListOptions) ([]*fleet.MDMConfigProfilePayload, *fleet.PaginationMetadata, error) {
 		return nil, nil, nil
 	}
-	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hostIDs []uint, teamIDs []uint, profileUUIDs []string, hostUUIDs []string) error {
-		return nil
+	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hostIDs []uint, teamIDs []uint, profileUUIDs []string,
+		hostUUIDs []string,
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 
 	checkShouldFail := func(t *testing.T, err error, shouldFail bool) {
@@ -1140,8 +1152,10 @@ func TestUploadWindowsMDMConfigProfileValidations(t *testing.T) {
 		cp.ProfileUUID = uuid.New().String()
 		return &cp, nil
 	}
-	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hostIDs []uint, teamIDs []uint, profileUUIDs []string, hostUUIDs []string) error {
-		return nil
+	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hostIDs []uint, teamIDs []uint, profileUUIDs []string,
+		hostUUIDs []string,
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 
 	cases := []struct {
@@ -1223,16 +1237,20 @@ func TestMDMBatchSetProfiles(t *testing.T) {
 	ds.TeamFunc = func(ctx context.Context, id uint) (*fleet.Team, error) {
 		return &fleet.Team{ID: id, Name: "team"}, nil
 	}
-	ds.BatchSetMDMProfilesFunc = func(ctx context.Context, tmID *uint, macProfiles []*fleet.MDMAppleConfigProfile, winProfiles []*fleet.MDMWindowsConfigProfile, macDecls []*fleet.MDMAppleDeclaration) error {
-		return nil
+	ds.BatchSetMDMProfilesFunc = func(ctx context.Context, tmID *uint, macProfiles []*fleet.MDMAppleConfigProfile,
+		winProfiles []*fleet.MDMWindowsConfigProfile, macDecls []*fleet.MDMAppleDeclaration,
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 	ds.NewActivityFunc = func(
 		ctx context.Context, user *fleet.User, activity fleet.ActivityDetails, details []byte, createdAt time.Time,
 	) error {
 		return nil
 	}
-	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hostIDs []uint, teamIDs []uint, profileUUIDs []string, hostUUIDs []string) error {
-		return nil
+	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hostIDs []uint, teamIDs []uint, profileUUIDs []string,
+		hostUUIDs []string,
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 
 	testCases := []struct {
diff --git a/server/service/orbit.go b/server/service/orbit.go
index 1ee8725a08..bbc6c437e0 100644
--- a/server/service/orbit.go
+++ b/server/service/orbit.go
@@ -10,6 +10,7 @@ import (
 	"net/url"
 
 	"github.com/fleetdm/fleet/v4/server"
+	"github.com/fleetdm/fleet/v4/server/contexts/capabilities"
 	"github.com/fleetdm/fleet/v4/server/contexts/ctxerr"
 	hostctx "github.com/fleetdm/fleet/v4/server/contexts/host"
 	"github.com/fleetdm/fleet/v4/server/contexts/license"
@@ -202,8 +203,13 @@ func (svc *Service) GetOrbitConfig(ctx context.Context) (fleet.OrbitConfig, erro
 			notifs.RenewEnrollmentProfile = true
 		}
 
+		manualMigrationEligible, err := fleet.IsEligibleForManualMigration(host, mdmInfo, isConnectedToFleetMDM)
+		if err != nil {
+			return fleet.OrbitConfig{}, ctxerr.Wrap(ctx, err, "checking manual migration eligibility")
+		}
+
 		if appConfig.MDM.MacOSMigration.Enable &&
-			fleet.IsEligibleForDEPMigration(host, mdmInfo, isConnectedToFleetMDM) {
+			(fleet.IsEligibleForDEPMigration(host, mdmInfo, isConnectedToFleetMDM) || manualMigrationEligible) {
 			notifs.NeedsMDMMigration = true
 		}
 
@@ -428,6 +434,17 @@ func (svc *Service) setDiskEncryptionNotifications(
 
 	switch host.FleetPlatform() {
 	case "darwin":
+		mp, ok := capabilities.FromContext(ctx)
+		if !ok {
+			level.Debug(svc.logger).Log("msg", "no capabilities in context, skipping disk encryption notification")
+			return nil
+		}
+
+		if !mp.Has(fleet.CapabilityEscrowBuddy) {
+			level.Debug(svc.logger).Log("msg", "host doesn't support Escrow Buddy, skipping disk encryption notification", "host_uuid", host.UUID)
+			return nil
+		}
+
 		notifs.RotateDiskEncryptionKey = encryptionKey != nil && encryptionKey.Decryptable != nil && !*encryptionKey.Decryptable
 	case "windows":
 		isServer := mdmInfo != nil && mdmInfo.IsServer
@@ -668,7 +685,7 @@ func (svc *Service) SaveHostScriptResult(ctx context.Context, result *fleet.Host
 
 	// always use the authenticated host's ID as host_id
 	result.HostID = host.ID
-	hsr, err := svc.ds.SetHostScriptExecutionResult(ctx, result)
+	hsr, action, err := svc.ds.SetHostScriptExecutionResult(ctx, result)
 	if err != nil {
 		return ctxerr.Wrap(ctx, err, "save host script result")
 	}
@@ -690,20 +707,47 @@ func (svc *Service) SaveHostScriptResult(ctx context.Context, result *fleet.Host
 			scriptName = scr.Name
 		}
 
-		// TODO(sarah): We may need to special case lock/unlock script results here?
-		if err := svc.NewActivity(
-			ctx,
-			user,
-			fleet.ActivityTypeRanScript{
-				HostID:            host.ID,
-				HostDisplayName:   host.DisplayName(),
-				ScriptExecutionID: hsr.ExecutionID,
-				ScriptName:        scriptName,
-				Async:             !hsr.SyncRequest,
-			},
-		); err != nil {
-			return ctxerr.Wrap(ctx, err, "create activity for script execution request")
+		switch action {
+		case "uninstall":
+			// Get software title from execution ID
+			softwareTitleName, err := svc.ds.GetSoftwareTitleNameFromExecutionID(ctx, hsr.ExecutionID)
+			if err != nil {
+				return ctxerr.Wrap(ctx, err, "get software title from execution ID")
+			}
+			activityStatus := "failed"
+			if hsr.ExitCode != nil && *hsr.ExitCode == 0 {
+				activityStatus = "uninstalled"
+			}
+			if err := svc.NewActivity(
+				ctx,
+				user,
+				fleet.ActivityTypeUninstalledSoftware{
+					HostID:          host.ID,
+					HostDisplayName: host.DisplayName(),
+					SoftwareTitle:   softwareTitleName,
+					ExecutionID:     hsr.ExecutionID,
+					Status:          activityStatus,
+				},
+			); err != nil {
+				return ctxerr.Wrap(ctx, err, "create activity for script execution request")
+			}
+		default:
+			// TODO(sarah): We may need to special case lock/unlock script results here?
+			if err := svc.NewActivity(
+				ctx,
+				user,
+				fleet.ActivityTypeRanScript{
+					HostID:            host.ID,
+					HostDisplayName:   host.DisplayName(),
+					ScriptExecutionID: hsr.ExecutionID,
+					ScriptName:        scriptName,
+					Async:             !hsr.SyncRequest,
+				},
+			); err != nil {
+				return ctxerr.Wrap(ctx, err, "create activity for script execution request")
+			}
 		}
+
 	}
 	return nil
 }
@@ -975,17 +1019,37 @@ func (svc *Service) SaveHostSoftwareInstallResult(ctx context.Context, result *f
 		return ctxerr.Wrap(ctx, err, "save host software installation result")
 	}
 
-	if status := result.Status(); status != fleet.SoftwareInstallerPending {
+	if status := result.Status(); status != fleet.SoftwareInstallPending {
 		hsi, err := svc.ds.GetSoftwareInstallResults(ctx, result.InstallUUID)
 		if err != nil {
 			return ctxerr.Wrap(ctx, err, "get host software installation result information")
 		}
 
+		// Self-Service packages will have a nil author for the activity.
 		var user *fleet.User
-		if hsi.UserID != nil && !hsi.SelfService {
-			user, err = svc.ds.UserByID(ctx, *hsi.UserID)
-			if err != nil {
-				return ctxerr.Wrap(ctx, err, "get host software installation user")
+		if !hsi.SelfService {
+			if hsi.UserID != nil {
+				user, err = svc.ds.UserByID(ctx, *hsi.UserID)
+				if err != nil {
+					return ctxerr.Wrap(ctx, err, "get host software installation user")
+				}
+			} else {
+				// hsi.UserID can be nil if the user was deleted and/or if the installation was
+				// triggered by Fleet (policy automation). Thus we set the author of the installation
+				// to be the user that uploaded the package (by design).
+				var userID uint
+				if hsi.SoftwareInstallerUserID != nil {
+					userID = *hsi.SoftwareInstallerUserID
+				}
+				// If there's no name or email then this may be a package uploaded
+				// before we added authorship to uploaded packages.
+				if hsi.SoftwareInstallerUserName != "" && hsi.SoftwareInstallerUserEmail != "" {
+					user = &fleet.User{
+						ID:    userID,
+						Name:  hsi.SoftwareInstallerUserName,
+						Email: hsi.SoftwareInstallerUserEmail,
+					}
+				}
 			}
 		}
 
diff --git a/server/service/orbit_client.go b/server/service/orbit_client.go
index fb4fe0aa2f..5b67a08f45 100644
--- a/server/service/orbit_client.go
+++ b/server/service/orbit_client.go
@@ -7,7 +7,9 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"io"
 	"io/fs"
+	"mime"
 	"net"
 	"net/http"
 	"net/http/httptrace"
@@ -146,7 +148,7 @@ func NewOrbitClient(
 	orbitHostInfo fleet.OrbitHostInfo,
 	onGetConfigErrFns *OnGetConfigErrFuncs,
 ) (*OrbitClient, error) {
-	orbitCapabilities := fleet.CapabilityMap{}
+	orbitCapabilities := fleet.GetOrbitClientCapabilities()
 	bc, err := newBaseClient(addr, insecureSkipVerify, rootCA, "", fleetClientCert, orbitCapabilities)
 	if err != nil {
 		return nil, err
@@ -410,6 +412,31 @@ func (oc *OrbitClient) DownloadSoftwareInstaller(installerID uint, downloadDirec
 	return resp.GetFilePath(), nil
 }
 
+type NullFileResponse struct {
+}
+
+func (f *NullFileResponse) Handle(resp *http.Response) error {
+	_, _, err := mime.ParseMediaType(resp.Header.Get("Content-Disposition"))
+	if err != nil {
+		return fmt.Errorf("parsing media type from response header: %w", err)
+	}
+	_, err = io.Copy(io.Discard, resp.Body)
+	if err != nil {
+		return fmt.Errorf("copying from http stream to io.Discard: %w", err)
+	}
+	return nil
+}
+
+// DownloadAndDiscardSoftwareInstaller downloads the software installer and discards it.
+// This method is used during load testing by osquery-perf.
+func (oc *OrbitClient) DownloadAndDiscardSoftwareInstaller(installerID uint) error {
+	verb, path := "POST", "/api/fleet/orbit/software_install/package?alt=media"
+	resp := NullFileResponse{}
+	return oc.authenticatedRequest(verb, path, &orbitDownloadSoftwareInstallerRequest{
+		InstallerID: installerID,
+	}, &resp)
+}
+
 // Ping sends a ping request to the orbit/ping endpoint.
 func (oc *OrbitClient) Ping() error {
 	verb, path := "HEAD", "/api/fleet/orbit/ping"
diff --git a/server/service/osquery.go b/server/service/osquery.go
index c4112f7d0d..de5c1e2e26 100644
--- a/server/service/osquery.go
+++ b/server/service/osquery.go
@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"net/http"
 	"regexp"
+	"sort"
 	"strconv"
 	"strings"
 	"sync/atomic"
@@ -81,7 +82,7 @@ func (svc *Service) AuthenticateHost(ctx context.Context, nodeKey string) (*flee
 	case err == nil:
 		// OK
 	case fleet.IsNotFound(err):
-		return nil, false, newOsqueryErrorWithInvalidNode("authentication error: invalid node key: " + nodeKey)
+		return nil, false, newOsqueryErrorWithInvalidNode("authentication error: invalid node key")
 	default:
 		return nil, false, newOsqueryError("authentication error: " + err.Error())
 	}
@@ -955,7 +956,7 @@ func (svc *Service) SubmitDistributedQueryResults(
 
 	svc.maybeDebugHost(ctx, host, results, statuses, messages, stats)
 
-	preProcessSoftwareResults(host.ID, &results, &statuses, &messages, osquery_utils.SoftwareOverrideQueries, svc.logger)
+	preProcessSoftwareResults(host, &results, &statuses, &messages, osquery_utils.SoftwareOverrideQueries, svc.logger)
 
 	var hostWithoutPolicies bool
 	for query, rows := range results {
@@ -1008,6 +1009,10 @@ func (svc *Service) SubmitDistributedQueryResults(
 			logging.WithErr(ctx, err)
 		}
 
+		if err := svc.processSoftwareForNewlyFailingPolicies(ctx, host.ID, host.TeamID, host.Platform, host.OrbitNodeKey, policyResults); err != nil {
+			logging.WithErr(ctx, err)
+		}
+
 		// filter policy results for webhooks
 		var policyIDs []uint
 		if globalPolicyAutomationsEnabled(ac.WebhookSettings, ac.Integrations) {
@@ -1038,6 +1043,7 @@ func (svc *Service) SubmitDistributedQueryResults(
 				}()
 			}
 		}
+
 		// NOTE(mna): currently, failing policies webhook wouldn't see the new
 		// flipped policies on the next run if async processing is enabled and the
 		// collection has not been done yet (not persisted in mysql). Should
@@ -1227,20 +1233,100 @@ func getFailingCalendarPolicies(policyResults map[uint]*bool, calendarPolicies [
 // We do this to not grow the main software queries and to ingest
 // all software together (one direct ingest function for all software).
 func preProcessSoftwareResults(
-	hostID uint,
+	host *fleet.Host,
 	results *fleet.OsqueryDistributedQueryResults,
 	statuses *map[string]fleet.OsqueryStatus,
 	messages *map[string]string,
 	overrides map[string]osquery_utils.DetailQuery,
 	logger log.Logger,
 ) {
+	//
 	vsCodeExtensionsExtraQuery := hostDetailQueryPrefix + "software_vscode_extensions"
-	preProcessSoftwareExtraResults(vsCodeExtensionsExtraQuery, hostID, results, statuses, messages, osquery_utils.DetailQuery{}, logger)
+	preProcessSoftwareExtraResults(vsCodeExtensionsExtraQuery, host.ID, results, statuses, messages, osquery_utils.DetailQuery{}, logger)
 
 	for name, query := range overrides {
 		fullQueryName := hostDetailQueryPrefix + "software_" + name
-		preProcessSoftwareExtraResults(fullQueryName, hostID, results, statuses, messages, query, logger)
+		preProcessSoftwareExtraResults(fullQueryName, host.ID, results, statuses, messages, query, logger)
 	}
+
+	// Filter out python packages that are also deb packages on ubuntu
+	pythonPackageFilter(host.Platform, results, statuses)
+}
+
+// pythonPackageFilter filters out duplicate python_packages that are installed under deb_packages on Ubuntu.
+// python_packages not matching a Debian package names are updated to "python3-packagename" to match OVAL definitions.
+func pythonPackageFilter(platform string, results *fleet.OsqueryDistributedQueryResults, statuses *map[string]fleet.OsqueryStatus) {
+	const pythonPrefix = "python3-"
+	const pythonSource = "python_packages"
+	const debSource = "deb_packages"
+	const linuxSoftware = hostDetailQueryPrefix + "software_linux"
+
+	// Return early if platform is not Ubuntu
+	// We may need to add more platforms in the future
+	if platform != "ubuntu" {
+		return
+	}
+
+	// Check the 'software_linux' result and status
+	sw, ok := (*results)[linuxSoftware]
+	if !ok {
+		return
+	}
+	if status, ok := (*statuses)[linuxSoftware]; !ok || status != fleet.StatusOK {
+		return
+	}
+
+	// Extract the Python and Debian packages from the software list for filtering
+	// pre-allocating space for 40 packages based on number of package found in
+	// a fresh ubuntu 24.04 install
+	pythonPackages := make(map[string]int, 40)
+	debPackages := make(map[string]struct{}, 40)
+
+	// Track indexes of rows to remove
+	indexesToRemove := []int{}
+
+	for i, row := range sw {
+		switch row["source"] {
+		case pythonSource:
+			loweredName := strings.ToLower(row["name"])
+			pythonPackages[loweredName] = i
+			row["name"] = loweredName
+		case debSource:
+			// Only append python3 deb packages
+			if strings.HasPrefix(row["name"], pythonPrefix) {
+				debPackages[row["name"]] = struct{}{}
+			}
+		}
+	}
+
+	// Return early if there are no Python packages to process
+	if len(pythonPackages) == 0 {
+		return
+	}
+
+	// Loop through pythonPackages map to identify any that should be removed
+	for name, index := range pythonPackages {
+		convertedName := pythonPrefix + name
+
+		// Filter out Python packages that are also Debian packages
+		if _, found := debPackages[convertedName]; found {
+			indexesToRemove = append(indexesToRemove, index)
+		} else {
+			// Update remaining Python package names to match OVAL definitions
+			sw[index]["name"] = convertedName
+		}
+	}
+
+	// Sort indexes to remove in descending order
+	sort.Sort(sort.Reverse(sort.IntSlice(indexesToRemove)))
+
+	// Remove rows from sw in descending order of indexes
+	for _, index := range indexesToRemove {
+		sw = append(sw[:index], sw[index+1:]...)
+	}
+
+	// Store the updated software result back in the results map
+	(*results)[linuxSoftware] = sw
 }
 
 func preProcessSoftwareExtraResults(
@@ -1606,6 +1692,144 @@ func (svc *Service) registerFlippedPolicies(ctx context.Context, hostID uint, ho
 	return nil
 }
 
+func (svc *Service) processSoftwareForNewlyFailingPolicies(
+	ctx context.Context,
+	hostID uint,
+	hostTeamID *uint,
+	hostPlatform string,
+	hostOrbitNodeKey *string,
+	incomingPolicyResults map[uint]*bool,
+) error {
+	if hostOrbitNodeKey == nil || *hostOrbitNodeKey == "" {
+		// We do not want to queue software installations on vanilla osquery hosts.
+		return nil
+	}
+
+	var policyTeamID uint
+	if hostTeamID == nil {
+		policyTeamID = fleet.PolicyNoTeamID
+	} else {
+		policyTeamID = *hostTeamID
+	}
+
+	// Filter out results that are not failures (we are only interested on failing policies,
+	// we don't care about passing policies or policies that failed to execute).
+	incomingFailingPolicies := make(map[uint]*bool)
+	var incomingFailingPoliciesIDs []uint
+	for policyID, policyResult := range incomingPolicyResults {
+		if policyResult != nil && !*policyResult {
+			incomingFailingPolicies[policyID] = policyResult
+			incomingFailingPoliciesIDs = append(incomingFailingPoliciesIDs, policyID)
+		}
+	}
+	if len(incomingFailingPolicies) == 0 {
+		return nil
+	}
+
+	// Get policies with associated installers for the team.
+	policiesWithInstaller, err := svc.ds.GetPoliciesWithAssociatedInstaller(ctx, policyTeamID, incomingFailingPoliciesIDs)
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "failed to get policies with installer")
+	}
+	if len(policiesWithInstaller) == 0 {
+		return nil
+	}
+
+	// Filter out results of policies that are not associated to installers.
+	policiesWithInstallersMap := make(map[uint]fleet.PolicySoftwareInstallerData)
+	for _, policyWithInstaller := range policiesWithInstaller {
+		policiesWithInstallersMap[policyWithInstaller.ID] = policyWithInstaller
+	}
+	policyResultsOfPoliciesWithInstallers := make(map[uint]*bool)
+	for policyID, passes := range incomingFailingPolicies {
+		if _, ok := policiesWithInstallersMap[policyID]; !ok {
+			continue
+		}
+		policyResultsOfPoliciesWithInstallers[policyID] = passes
+	}
+	if len(policyResultsOfPoliciesWithInstallers) == 0 {
+		return nil
+	}
+
+	// Get the policies associated with installers that are flipping from passing to failing on this host.
+	policyIDsOfNewlyFailingPoliciesWithInstallers, _, err := svc.ds.FlippingPoliciesForHost(
+		ctx, hostID, policyResultsOfPoliciesWithInstallers,
+	)
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "failed to get flipping policies for host")
+	}
+	if len(policyIDsOfNewlyFailingPoliciesWithInstallers) == 0 {
+		return nil
+	}
+	policyIDsOfNewlyFailingPoliciesWithInstallersSet := make(map[uint]struct{})
+	for _, policyID := range policyIDsOfNewlyFailingPoliciesWithInstallers {
+		policyIDsOfNewlyFailingPoliciesWithInstallersSet[policyID] = struct{}{}
+	}
+
+	// Finally filter out policies with installers that are not newly failing.
+	var failingPoliciesWithInstaller []fleet.PolicySoftwareInstallerData
+	for _, policyWithInstaller := range policiesWithInstaller {
+		if _, ok := policyIDsOfNewlyFailingPoliciesWithInstallersSet[policyWithInstaller.ID]; ok {
+			failingPoliciesWithInstaller = append(failingPoliciesWithInstaller, policyWithInstaller)
+		}
+	}
+
+	for _, failingPolicyWithInstaller := range failingPoliciesWithInstaller {
+		installerMetadata, err := svc.ds.GetSoftwareInstallerMetadataByID(ctx, failingPolicyWithInstaller.InstallerID)
+		if err != nil {
+			return ctxerr.Wrap(ctx, err, "get software installer metadata by id")
+		}
+		logger := log.With(svc.logger,
+			"host_id", hostID,
+			"host_platform", hostPlatform,
+			"policy_id", failingPolicyWithInstaller.ID,
+			"software_installer_id", failingPolicyWithInstaller.InstallerID,
+			"software_title_id", installerMetadata.TitleID,
+			"software_installer_platform", installerMetadata.Platform,
+		)
+		if fleet.PlatformFromHost(hostPlatform) != installerMetadata.Platform {
+			level.Debug(logger).Log("msg", "installer platform does not match host platform")
+			continue
+		}
+		hostLastInstall, err := svc.ds.GetHostLastInstallData(ctx, hostID, installerMetadata.InstallerID)
+		if err != nil {
+			return ctxerr.Wrap(ctx, err, "get host last install data")
+		}
+		// hostLastInstall.Status == nil can happen when a software is installed by Fleet and later removed.
+		if hostLastInstall != nil && hostLastInstall.Status != nil &&
+			*hostLastInstall.Status == fleet.SoftwareInstallPending {
+			// There's a pending install for this host and installer,
+			// thus we do not queue another install request.
+			level.Debug(svc.logger).Log(
+				"msg", "found pending install request for this host and installer",
+				"pending_execution_id", hostLastInstall.ExecutionID,
+			)
+			continue
+		}
+		// NOTE(lucas): The user_id set in this software install will be NULL
+		// so this means that when generating the activity for this action
+		// (in SaveHostSoftwareInstallResult)
+		// the author will be set to the user that uploaded the software (we want this
+		// by design).
+		installUUID, err := svc.ds.InsertSoftwareInstallRequest(
+			ctx, hostID,
+			installerMetadata.InstallerID,
+			false, // Set Self-service as false because this is triggered by Fleet.
+		)
+		if err != nil {
+			return ctxerr.Wrapf(ctx, err,
+				"insert software install request: host_id=%d, software_installer_id=%d",
+				hostID, installerMetadata.InstallerID,
+			)
+		}
+		level.Debug(logger).Log(
+			"msg", "install request sent",
+			"install_uuid", installUUID,
+		)
+	}
+	return nil
+}
+
 func (svc *Service) maybeDebugHost(
 	ctx context.Context,
 	host *fleet.Host,
diff --git a/server/service/osquery_test.go b/server/service/osquery_test.go
index 8ceb4ec77b..0697c7de69 100644
--- a/server/service/osquery_test.go
+++ b/server/service/osquery_test.go
@@ -3678,8 +3678,8 @@ func TestPreProcessSoftwareResults(t *testing.T) {
 	}
 
 	for _, tc := range []struct {
-		name string
-
+		name       string
+		host       *fleet.Host
 		resultsIn  fleet.OsqueryDistributedQueryResults
 		statusesIn map[string]fleet.OsqueryStatus
 		messagesIn map[string]string
@@ -3898,10 +3898,134 @@ func TestPreProcessSoftwareResults(t *testing.T) {
 				},
 			},
 		},
+		{
+			name: "ubuntu dpkg installed python packages are filtered out",
+			host: &fleet.Host{ID: 1, Platform: "ubuntu"},
+			statusesIn: map[string]fleet.OsqueryStatus{
+				hostDetailQueryPrefix + "software_linux": fleet.StatusOK,
+			},
+			resultsIn: fleet.OsqueryDistributedQueryResults{
+				hostDetailQueryPrefix + "software_linux": []map[string]string{
+					{
+						"name":    "python3-twisted",
+						"version": "20.3.0-2",
+						"source":  "deb_packages",
+					},
+					{
+						"name":    "Twisted", // duplicate of python3-twisted
+						"version": "20.3.0-2",
+						"source":  "python_packages",
+					},
+					{
+						"name":    "python3-setuptools",
+						"version": "50.3.2",
+						"source":  "deb_packages",
+					},
+					{
+						"name":    "setuptools",
+						"version": "50.3.2",
+						"source":  "python_packages",
+					},
+					{
+						"name":    "pillow",
+						"version": "8.1.0",
+						"source":  "python_packages",
+					},
+					{
+						"name":    "python3-urllib3",
+						"version": "1.26.2-2",
+						"source":  "deb_packages",
+					},
+				},
+			},
+			resultsOut: fleet.OsqueryDistributedQueryResults{
+				hostDetailQueryPrefix + "software_linux": []map[string]string{
+					{
+						"name":    "python3-twisted",
+						"version": "20.3.0-2",
+						"source":  "deb_packages",
+					},
+					{
+						"name":    "python3-setuptools",
+						"version": "50.3.2",
+						"source":  "deb_packages",
+					},
+					{
+						"name":    "python3-pillow", // renamed from pillow
+						"version": "8.1.0",
+						"source":  "python_packages",
+					},
+					{
+						"name":    "python3-urllib3",
+						"version": "1.26.2-2",
+						"source":  "deb_packages",
+					},
+				},
+			},
+		},
+		{
+			name: "non-ubuntu installed python packages are NOT filtered out",
+			host: &fleet.Host{ID: 1, Platform: "rhel"},
+			statusesIn: map[string]fleet.OsqueryStatus{
+				hostDetailQueryPrefix + "software_linux": fleet.StatusOK,
+			},
+			resultsIn: fleet.OsqueryDistributedQueryResults{
+				hostDetailQueryPrefix + "software_linux": []map[string]string{
+					{
+						"name":    "python3-twisted",
+						"version": "20.3.0-2",
+						"source":  "rpm_packages",
+					},
+					{
+						"name":    "twisted", // duplicate of python3-twisted
+						"version": "20.3.0-2",
+						"source":  "python_packages",
+					},
+					{
+						"name":    "pillow",
+						"version": "8.1.0",
+						"source":  "python_packages",
+					},
+					{
+						"name":    "python3-urllib3",
+						"version": "1.26.2-2",
+						"source":  "rpm_packages",
+					},
+				},
+			},
+			resultsOut: fleet.OsqueryDistributedQueryResults{
+				hostDetailQueryPrefix + "software_linux": []map[string]string{
+					{
+						"name":    "python3-twisted",
+						"version": "20.3.0-2",
+						"source":  "rpm_packages",
+					},
+					{
+						"name":    "twisted", // duplicate of python3-twisted
+						"version": "20.3.0-2",
+						"source":  "python_packages",
+					},
+					{
+						"name":    "pillow",
+						"version": "8.1.0",
+						"source":  "python_packages",
+					},
+					{
+						"name":    "python3-urllib3",
+						"version": "1.26.2-2",
+						"source":  "rpm_packages",
+					},
+				},
+			},
+		},
 	} {
 		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
-			preProcessSoftwareResults(1, &tc.resultsIn, &tc.statusesIn, &tc.messagesIn, tc.overrides, log.NewNopLogger())
+			host := &fleet.Host{ID: 1}
+			if tc.host != nil {
+				host = tc.host
+			}
+			preProcessSoftwareResults(host, &tc.resultsIn, &tc.statusesIn, &tc.messagesIn, tc.overrides, log.NewNopLogger())
 			require.Equal(t, tc.resultsOut, tc.resultsIn)
 		})
 	}
@@ -3943,3 +4067,47 @@ func BenchmarkFindPackDelimiterStringTeamPack(b *testing.B) {
 		findPackDelimiterString(input)
 	}
 }
+
+func mockUbuntuResults() *fleet.OsqueryDistributedQueryResults {
+	results := &fleet.OsqueryDistributedQueryResults{
+		hostDetailQueryPrefix + "software_linux": make([]map[string]string, 0),
+	}
+
+	// Adding 40 python packages with matching deb packages
+	// Adding 2 python packages without matching deb packages
+	for i := 1; i <= 42; i++ {
+		pythonPkg := fmt.Sprintf("package%d", i)
+		(*results)[hostDetailQueryPrefix+"software_linux"] = append((*results)[hostDetailQueryPrefix+"software_linux"], map[string]string{
+			"source": "python_packages",
+			"name":   pythonPkg,
+		})
+	}
+
+	// Adding 1500 deb packages, with the first 40 matching python packages
+	for i := 1; i <= 1500; i++ {
+		var debPkg string
+		if i <= 38 { // Match first 38 python packages
+			debPkg = fmt.Sprintf("python3-package%d", i)
+		} else { // Non-python packages
+			debPkg = fmt.Sprintf("unrelated_package%d", i)
+		}
+		(*results)[hostDetailQueryPrefix+"software_linux"] = append((*results)[hostDetailQueryPrefix+"software_linux"], map[string]string{
+			"source": "deb_packages",
+			"name":   debPkg,
+		})
+	}
+
+	return results
+}
+
+func BenchmarkPreprocessUbuntuPythonPackageFilter(b *testing.B) {
+	platform := "ubuntu"
+	results := mockUbuntuResults()
+	statuses := &map[string]fleet.OsqueryStatus{
+		hostDetailQueryPrefix + "software_linux": fleet.StatusOK,
+	}
+
+	for i := 0; i < b.N; i++ {
+		preProcessSoftwareResults(&fleet.Host{ID: 1, Platform: platform}, results, statuses, nil, nil, log.NewNopLogger())
+	}
+}
diff --git a/server/service/osquery_utils/queries.go b/server/service/osquery_utils/queries.go
index 59b2430b54..f13454b2d1 100644
--- a/server/service/osquery_utils/queries.go
+++ b/server/service/osquery_utils/queries.go
@@ -1599,6 +1599,31 @@ func sanitizeSoftware(h *fleet.Host, s *fleet.Software, logger log.Logger) {
 				s.Version = strings.Join(newParts, ".")
 			},
 		},
+		{
+			// Trim the "RELEASE." prefix from Minio versions.
+			checkSoftware: func(h *fleet.Host, s *fleet.Software) bool {
+				return s.Name == "minio" && strings.Contains(s.Version, "RELEASE.")
+			},
+			mutateSoftware: func(s *fleet.Software) {
+				s.Version = strings.TrimPrefix(s.Version, "RELEASE.")
+			},
+		},
+		{
+			// Convert the timestamp to NVD's format for Minio versions.
+			checkSoftware: func(h *fleet.Host, s *fleet.Software) bool {
+				regex := regexp.MustCompile(`^\d{14}$`)
+
+				return s.Name == "minio" && regex.MatchString(s.Version)
+			},
+			mutateSoftware: func(s *fleet.Software) {
+				timestamp, err := time.Parse("20060102150405", s.Version)
+				if err != nil {
+					level.Debug(logger).Log("msg", "failed to parse software version", "name", s.Name, "version", s.Version, "err", err)
+					return
+				}
+				s.Version = timestamp.Format("2006-01-02T15-04-05Z")
+			},
+		},
 	}
 
 	for _, softwareSanitizer := range softwareSanitizers {
@@ -2006,7 +2031,7 @@ func directIngestMDMDeviceIDWindows(ctx context.Context, logger log.Logger, host
 	return ds.UpdateMDMWindowsEnrollmentsHostUUID(ctx, host.UUID, rows[0]["data"])
 }
 
-//go:generate go run gen_queries_doc.go "../../../docs/Using Fleet/Understanding-host-vitals.md"
+//go:generate go run gen_queries_doc.go "../../../docs/Contributing/Understanding-host-vitals.md"
 
 func GetDetailQueries(
 	ctx context.Context,
diff --git a/server/service/osquery_utils/queries_test.go b/server/service/osquery_utils/queries_test.go
index 8fb86bcc1f..8a29314470 100644
--- a/server/service/osquery_utils/queries_test.go
+++ b/server/service/osquery_utils/queries_test.go
@@ -1830,6 +1830,30 @@ func TestSanitizeSoftware(t *testing.T) {
 				Version: "1.6.00.34263",
 			},
 		},
+		{
+			name: "minio",
+			h:    &fleet.Host{},
+			s: &fleet.Software{
+				Name:    "minio",
+				Version: "RELEASE.2022-03-10T00-00-00Z",
+			},
+			sanitized: &fleet.Software{
+				Name:    "minio",
+				Version: "2022-03-10T00-00-00Z",
+			},
+		},
+		{
+			name: "minio",
+			h:    &fleet.Host{},
+			s: &fleet.Software{
+				Name:    "minio",
+				Version: "20200310000000",
+			},
+			sanitized: &fleet.Software{
+				Name:    "minio",
+				Version: "2020-03-10T00-00-00Z",
+			},
+		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			sanitizeSoftware(tc.h, tc.s, log.NewNopLogger())
diff --git a/server/service/redis_key_value/redis_key_value.go b/server/service/redis_key_value/redis_key_value.go
new file mode 100644
index 0000000000..010c24c19c
--- /dev/null
+++ b/server/service/redis_key_value/redis_key_value.go
@@ -0,0 +1,58 @@
+// Package redis_key_value implements a most basic SET & GET key/value store
+// where both the key and the value are strings.
+package redis_key_value
+
+import (
+	"context"
+	"errors"
+	"time"
+
+	"github.com/fleetdm/fleet/v4/server/contexts/ctxerr"
+	"github.com/fleetdm/fleet/v4/server/datastore/redis"
+	"github.com/fleetdm/fleet/v4/server/fleet"
+	redigo "github.com/gomodule/redigo/redis"
+)
+
+// RedisKeyValue is a basic key/value store with SET and GET operations
+// Items are removed via expiration (defined in the SET operation).
+type RedisKeyValue struct {
+	pool       fleet.RedisPool
+	testPrefix string // for tests, the key prefix to use to avoid conflicts
+}
+
+// New creates a new RedisKeyValue store.
+func New(pool fleet.RedisPool) *RedisKeyValue {
+	return &RedisKeyValue{pool: pool}
+}
+
+// prefix is used to not collide with other key domains (like live queries or calendar locks).
+const prefix = "key_value_"
+
+// Set creates or overrides the given key with the given value.
+// Argument expireTime is used to set the expiration of the item
+// (when updating, the expiration of the item is updated).
+func (r *RedisKeyValue) Set(ctx context.Context, key string, value string, expireTime time.Duration) error {
+	conn := redis.ConfigureDoer(r.pool, r.pool.Get())
+	defer conn.Close()
+
+	if _, err := redigo.String(conn.Do("SET", r.testPrefix+prefix+key, value, "PX", expireTime.Milliseconds())); err != nil {
+		return ctxerr.Wrap(ctx, err, "redis failed to set")
+	}
+	return nil
+}
+
+// Get returns the value for a given key.
+// It returns (nil, nil) if the key doesn't exist.
+func (r *RedisKeyValue) Get(ctx context.Context, key string) (*string, error) {
+	conn := redis.ConfigureDoer(r.pool, r.pool.Get())
+	defer conn.Close()
+
+	res, err := redigo.String(conn.Do("GET", r.testPrefix+prefix+key))
+	if errors.Is(err, redigo.ErrNil) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "redis failed to get")
+	}
+	return &res, nil
+}
diff --git a/server/service/redis_key_value/redis_key_value_test.go b/server/service/redis_key_value/redis_key_value_test.go
new file mode 100644
index 0000000000..5f410e4a49
--- /dev/null
+++ b/server/service/redis_key_value/redis_key_value_test.go
@@ -0,0 +1,92 @@
+package redis_key_value
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/fleetdm/fleet/v4/server/datastore/redis/redistest"
+	"github.com/fleetdm/fleet/v4/server/fleet"
+	"github.com/fleetdm/fleet/v4/server/test"
+	"github.com/stretchr/testify/require"
+)
+
+func TestRedisKeyValue(t *testing.T) {
+	for _, f := range []func(*testing.T, *RedisKeyValue){
+		testSetGet,
+	} {
+		t.Run(test.FunctionName(f), func(t *testing.T) {
+			t.Run("standalone", func(t *testing.T) {
+				kv := setupRedis(t, false, false)
+				f(t, kv)
+			})
+			t.Run("cluster", func(t *testing.T) {
+				kv := setupRedis(t, true, true)
+				f(t, kv)
+			})
+		})
+	}
+}
+
+func setupRedis(t testing.TB, cluster, redir bool) *RedisKeyValue {
+	pool := redistest.SetupRedis(t, t.Name(), cluster, redir, true)
+	return newRedisKeyValueForTest(t, pool)
+}
+
+type testName interface {
+	Name() string
+}
+
+func newRedisKeyValueForTest(t testName, pool fleet.RedisPool) *RedisKeyValue {
+	return &RedisKeyValue{
+		pool:       pool,
+		testPrefix: t.Name() + ":",
+	}
+}
+
+func testSetGet(t *testing.T, kv *RedisKeyValue) {
+	ctx := context.Background()
+
+	result, err := kv.Get(ctx, "foo")
+	require.NoError(t, err)
+	require.Nil(t, result)
+
+	err = kv.Set(ctx, "foo", "bar", 5*time.Second)
+	require.NoError(t, err)
+
+	result, err = kv.Get(ctx, "foo")
+	require.NoError(t, err)
+	require.NotNil(t, result)
+	require.Equal(t, "bar", *result)
+
+	err = kv.Set(ctx, "foo", "zoo", 5*time.Second)
+	require.NoError(t, err)
+
+	result, err = kv.Get(ctx, "foo")
+	require.NoError(t, err)
+	require.NotNil(t, result)
+	require.Equal(t, "zoo", *result)
+
+	err = kv.Set(ctx, "boo", "bar", 2*time.Second)
+	require.NoError(t, err)
+	result, err = kv.Get(ctx, "boo")
+	require.NoError(t, err)
+	require.NotNil(t, result)
+	require.Equal(t, "bar", *result)
+
+	time.Sleep(3 * time.Second)
+	result, err = kv.Get(ctx, "boo")
+	require.NoError(t, err)
+	require.Nil(t, result)
+
+	// Updating an item, updates the expiration time.
+	err = kv.Set(ctx, "test", "foo", 2*time.Second)
+	require.NoError(t, err)
+	err = kv.Set(ctx, "test", "foo", 10*time.Second)
+	require.NoError(t, err)
+	time.Sleep(5 * time.Second)
+	result, err = kv.Get(ctx, "test")
+	require.NoError(t, err)
+	require.NotNil(t, result)
+	require.Equal(t, "foo", *result)
+}
diff --git a/server/service/redis_lock/redis_lock.go b/server/service/redis_lock/redis_lock.go
index a5443f1df8..0c5e17db17 100644
--- a/server/service/redis_lock/redis_lock.go
+++ b/server/service/redis_lock/redis_lock.go
@@ -29,7 +29,7 @@ func NewLock(pool fleet.RedisPool) fleet.Lock {
 	return fleet.Lock(lock)
 }
 
-func (r *redisLock) AcquireLock(ctx context.Context, key string, value string, expireMs uint64) (ok bool, err error) {
+func (r *redisLock) SetIfNotExist(ctx context.Context, key string, value string, expireMs uint64) (ok bool, err error) {
 	conn := redis.ConfigureDoer(r.pool, r.pool.Get())
 	defer conn.Close()
 
@@ -116,3 +116,25 @@ func (r *redisLock) Get(ctx context.Context, key string) (*string, error) {
 	}
 	return &res, nil
 }
+
+func (r *redisLock) GetAndDelete(ctx context.Context, key string) (*string, error) {
+	conn := redis.ConfigureDoer(r.pool, r.pool.Get())
+	defer conn.Close()
+
+	// Note: In Redis 6.2.0, this can be accomplished with a single command: GETDEL.
+
+	res, err := redigo.String(conn.Do("GET", r.testPrefix+key))
+	if errors.Is(err, redigo.ErrNil) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "redis GET")
+	}
+
+	_, err = conn.Do("DEL", r.testPrefix+key)
+	if err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "redis DEL")
+	}
+
+	return &res, nil
+}
diff --git a/server/service/redis_lock/redis_lock_test.go b/server/service/redis_lock/redis_lock_test.go
index 74df2a8334..c6663cded4 100644
--- a/server/service/redis_lock/redis_lock_test.go
+++ b/server/service/redis_lock/redis_lock_test.go
@@ -2,13 +2,14 @@ package redis_lock
 
 import (
 	"context"
+	"testing"
+	"time"
+
 	"github.com/fleetdm/fleet/v4/server/datastore/redis/redistest"
 	"github.com/fleetdm/fleet/v4/server/fleet"
 	"github.com/fleetdm/fleet/v4/server/test"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"testing"
-	"time"
 )
 
 func TestRedisLock(t *testing.T) {
@@ -50,12 +51,12 @@ func NewLockTest(t TestName, pool fleet.RedisPool) fleet.Lock {
 
 func testRedisAcquireLock(t *testing.T, lock fleet.Lock) {
 	ctx := context.Background()
-	result, err := lock.AcquireLock(ctx, "test", "1", 0)
+	result, err := lock.SetIfNotExist(ctx, "test", "1", 0)
 	require.NoError(t, err)
 	assert.True(t, result)
 
 	// Try to acquire the same lock
-	result, err = lock.AcquireLock(ctx, "test", "1", 0)
+	result, err = lock.SetIfNotExist(ctx, "test", "1", 0)
 	assert.NoError(t, err)
 	assert.False(t, result)
 
@@ -75,7 +76,7 @@ func testRedisAcquireLock(t *testing.T, lock fleet.Lock) {
 	assert.True(t, ok)
 
 	// Acquire the lock again
-	result, err = lock.AcquireLock(ctx, "test", "1", 0)
+	result, err = lock.SetIfNotExist(ctx, "test", "1", 0)
 	require.NoError(t, err)
 	assert.True(t, result)
 
@@ -87,14 +88,14 @@ func testRedisAcquireLock(t *testing.T, lock fleet.Lock) {
 
 	// Try to set lock with expiration
 	var expire uint64 = 10
-	result, err = lock.AcquireLock(ctx, "testE", "1", expire)
+	result, err = lock.SetIfNotExist(ctx, "testE", "1", expire)
 	require.NoError(t, err)
 	assert.True(t, result)
 
 	// Try to acquire the same lock after waiting
 	duration := time.Duration(expire+1) * time.Millisecond
 	time.Sleep(duration)
-	result, err = lock.AcquireLock(ctx, "testE", "1", 0)
+	result, err = lock.SetIfNotExist(ctx, "testE", "1", 0)
 	require.NoError(t, err)
 	assert.True(t, result)
 
@@ -103,6 +104,26 @@ func testRedisAcquireLock(t *testing.T, lock fleet.Lock) {
 	assert.NoError(t, err)
 	assert.Nil(t, getResult)
 
+	// Get and delete non-existent key
+	getResult, err = lock.GetAndDelete(ctx, "testNonExistent")
+	assert.NoError(t, err)
+	assert.Nil(t, getResult)
+
+	// Set a new item
+	result, err = lock.SetIfNotExist(ctx, "test2", "2", 0)
+	require.NoError(t, err)
+	assert.True(t, result)
+
+	// Get and delete the item
+	getResult, err = lock.GetAndDelete(ctx, "test2")
+	assert.NoError(t, err)
+	require.NotNil(t, getResult)
+	assert.Equal(t, "2", *getResult)
+
+	// Item was deleted, so we can't get it again
+	getResult, err = lock.Get(ctx, "test2")
+	assert.NoError(t, err)
+	assert.Nil(t, getResult)
 }
 
 func testRedisSet(t *testing.T, lock fleet.Lock) {
diff --git a/server/service/schedule/schedule.go b/server/service/schedule/schedule.go
index 8965416a64..be6377c91b 100644
--- a/server/service/schedule/schedule.go
+++ b/server/service/schedule/schedule.go
@@ -47,6 +47,8 @@ type Schedule struct {
 	jobs []Job
 
 	statsStore CronStatsStore
+
+	runOnce bool
 }
 
 // JobFn is the signature of a Job.
@@ -120,6 +122,13 @@ func WithJob(id string, fn JobFn) Option {
 	}
 }
 
+// WithRunOnce sets the Schedule to run only once.
+func WithRunOnce(once bool) Option {
+	return func(s *Schedule) {
+		s.runOnce = once
+	}
+}
+
 // New creates and returns a Schedule.
 // Jobs are added with the WithJob Option.
 //
@@ -167,7 +176,16 @@ func (s *Schedule) Start() {
 		level.Error(s.logger).Log("err", "start schedule", "details", err)
 		ctxerr.Handle(s.ctx, err)
 	}
-	s.setIntervalStartedAt(prevScheduledRun.CreatedAt)
+
+	// if there is no previous run, set the start time to the current time.
+	startedAt := prevScheduledRun.CreatedAt
+	if startedAt.IsZero() {
+		startedAt = time.Now()
+	} else if s.runOnce && prevScheduledRun.Status == fleet.CronStatsStatusCompleted {
+		// If job is set to run once, and it already ran, then nothing to do
+		return
+	}
+	s.setIntervalStartedAt(startedAt)
 
 	initialWait := 10 * time.Second
 	if schedInterval := s.getSchedInterval(); schedInterval < initialWait {
diff --git a/server/service/schedule/schedule_test.go b/server/service/schedule/schedule_test.go
index ccbe80d1c0..c54bd807fa 100644
--- a/server/service/schedule/schedule_test.go
+++ b/server/service/schedule/schedule_test.go
@@ -590,6 +590,7 @@ func TestMultipleScheduleInstancesConfigChangesDS(t *testing.T) {
 }
 
 func TestTriggerSingleInstance(t *testing.T) {
+	t.Parallel()
 	ctx, cancelFn := context.WithCancel(context.Background())
 
 	name := "test_trigger_single_instance"
diff --git a/server/service/scripts.go b/server/service/scripts.go
index 9629b78a09..14d39e4964 100644
--- a/server/service/scripts.go
+++ b/server/service/scripts.go
@@ -349,16 +349,17 @@ type getScriptResultRequest struct {
 }
 
 type getScriptResultResponse struct {
-	ScriptContents string `json:"script_contents"`
-	ScriptID       *uint  `json:"script_id"`
-	ExitCode       *int64 `json:"exit_code"`
-	Output         string `json:"output"`
-	Message        string `json:"message"`
-	HostName       string `json:"hostname"`
-	HostTimeout    bool   `json:"host_timeout"`
-	HostID         uint   `json:"host_id"`
-	ExecutionID    string `json:"execution_id"`
-	Runtime        int    `json:"runtime"`
+	ScriptContents string    `json:"script_contents"`
+	ScriptID       *uint     `json:"script_id"`
+	ExitCode       *int64    `json:"exit_code"`
+	Output         string    `json:"output"`
+	Message        string    `json:"message"`
+	HostName       string    `json:"hostname"`
+	HostTimeout    bool      `json:"host_timeout"`
+	HostID         uint      `json:"host_id"`
+	ExecutionID    string    `json:"execution_id"`
+	Runtime        int       `json:"runtime"`
+	CreatedAt      time.Time `json:"created_at"`
 
 	Err error `json:"error,omitempty"`
 }
@@ -388,6 +389,7 @@ func getScriptResultEndpoint(ctx context.Context, request interface{}, svc fleet
 		HostID:         scriptResult.HostID,
 		ExecutionID:    scriptResult.ExecutionID,
 		Runtime:        scriptResult.Runtime,
+		CreatedAt:      scriptResult.CreatedAt,
 	}, nil
 }
 
diff --git a/server/service/service_campaign_test.go b/server/service/service_campaign_test.go
index d7ae34c98c..0878b0a9bc 100644
--- a/server/service/service_campaign_test.go
+++ b/server/service/service_campaign_test.go
@@ -3,7 +3,6 @@ package service
 import (
 	"context"
 	"crypto/tls"
-	"github.com/fleetdm/fleet/v4/server/contexts/ctxdb"
 	"math/rand"
 	"net/http"
 	"net/http/httptest"
@@ -14,6 +13,7 @@ import (
 
 	"github.com/WatchBeam/clock"
 	"github.com/fleetdm/fleet/v4/server/config"
+	"github.com/fleetdm/fleet/v4/server/contexts/ctxdb"
 	"github.com/fleetdm/fleet/v4/server/contexts/viewer"
 	"github.com/fleetdm/fleet/v4/server/datastore/mysql"
 	"github.com/fleetdm/fleet/v4/server/fleet"
@@ -398,7 +398,7 @@ func TestUpdateStats(t *testing.T) {
 	testUpdateStats(t, ds, false)
 }
 
-func TestUpdateStatsOnReplica(t *testing.T) {
+func TestIntegrationsUpdateStatsOnReplica(t *testing.T) {
 	ds := mysql.CreateMySQLDSWithReplica(t, nil)
 	defer mysql.TruncateTables(t, ds)
 	testUpdateStats(t, ds, true)
diff --git a/server/service/software.go b/server/service/software.go
index 5289c951f5..e589ac7fe6 100644
--- a/server/service/software.go
+++ b/server/service/software.go
@@ -105,6 +105,11 @@ func (svc *Service) ListSoftware(ctx context.Context, opt fleet.SoftwareListOpti
 		return nil, nil, err
 	}
 
+	// Vulnerability filters are only available in premium (opt.IncludeCVEScores is only true in premium)
+	if !opt.IncludeCVEScores && (opt.MaximumCVSS > 0 || opt.MinimumCVSS > 0 || opt.KnownExploit) {
+		return nil, nil, fleet.ErrMissingLicense
+	}
+
 	// default sort order to hosts_count descending
 	if opt.ListOptions.OrderKey == "" {
 		opt.ListOptions.OrderKey = "hosts_count"
@@ -226,5 +231,20 @@ func (svc Service) CountSoftware(ctx context.Context, opt fleet.SoftwareListOpti
 		return 0, err
 	}
 
+	lic, err := svc.License(ctx)
+	if err != nil {
+		return 0, ctxerr.Wrap(ctx, err, "get license")
+	}
+
+	// Vulnerability filters are only available in premium
+	if !lic.IsPremium() && (opt.MaximumCVSS > 0 || opt.MinimumCVSS > 0 || opt.KnownExploit) {
+		return 0, fleet.ErrMissingLicense
+	}
+
+	// required for vulnerability filters
+	if lic.IsPremium() {
+		opt.IncludeCVEScores = true
+	}
+
 	return svc.ds.CountSoftware(ctx, opt)
 }
diff --git a/server/service/software_installers.go b/server/service/software_installers.go
index 5de426c2d6..b10b6a6f4c 100644
--- a/server/service/software_installers.go
+++ b/server/service/software_installers.go
@@ -2,12 +2,15 @@ package service
 
 import (
 	"context"
+	"crypto/x509"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
 	"mime/multipart"
 	"net"
 	"net/http"
+	"net/url"
 	"strconv"
 
 	"github.com/docker/go-units"
@@ -26,6 +29,18 @@ type uploadSoftwareInstallerRequest struct {
 	PreInstallQuery   string
 	PostInstallScript string
 	SelfService       bool
+	UninstallScript   string
+}
+
+type updateSoftwareInstallerRequest struct {
+	TitleID           uint `url:"id"`
+	File              *multipart.FileHeader
+	TeamID            *uint
+	InstallScript     *string
+	PreInstallQuery   *string
+	PostInstallScript *string
+	UninstallScript   *string
+	SelfService       *bool
 }
 
 type uploadSoftwareInstallerResponse struct {
@@ -33,13 +48,139 @@ type uploadSoftwareInstallerResponse struct {
 }
 
 // MaxSoftwareInstallerSize is the maximum size allowed for software
-// installers. This is enforced by the endpoint that uploads installers.
+// installers. This is enforced by the endpoints that upload installers.
 const MaxSoftwareInstallerSize = 500 * units.MiB
 
+// TODO: We parse the whole body before running svc.authz.Authorize.
+// An authenticated but unauthorized user could abuse this.
+func (updateSoftwareInstallerRequest) DecodeRequest(ctx context.Context, r *http.Request) (interface{}, error) {
+	decoded := updateSoftwareInstallerRequest{}
+
+	// populate software title ID since we're overriding the decoder that would do it for us
+	titleID, err := uint32FromRequest(r, "id")
+	if err != nil {
+		return nil, badRequestErr("intFromRequest", err)
+	}
+	decoded.TitleID = uint(titleID)
+
+	err = r.ParseMultipartForm(512 * units.MiB)
+	if err != nil {
+		var mbe *http.MaxBytesError
+		if errors.As(err, &mbe) {
+			return nil, &fleet.BadRequestError{
+				Message:     "The maximum file size is 500 MB.",
+				InternalErr: err,
+			}
+		}
+		var nerr net.Error
+		if errors.As(err, &nerr) && nerr.Timeout() {
+			return nil, fleet.NewUserMessageError(
+				ctxerr.New(ctx, "Couldn't upload. Please ensure your internet connection speed is sufficient and stable."),
+				http.StatusRequestTimeout,
+			)
+		}
+		return nil, &fleet.BadRequestError{
+			Message:     "failed to parse multipart form: " + err.Error(),
+			InternalErr: err,
+		}
+	}
+
+	// unlike for uploadSoftwareInstallerRequest, every field is optional, including the file upload
+	if r.MultipartForm.File["software"] != nil || len(r.MultipartForm.File["software"]) > 0 {
+		decoded.File = r.MultipartForm.File["software"][0]
+		if decoded.File.Size > MaxSoftwareInstallerSize {
+			// Should never happen here since the request's body is limited to the maximum size.
+			return nil, &fleet.BadRequestError{
+				Message: "The maximum file size is 500 MB.",
+			}
+		}
+	}
+
+	// default is no team
+	val, ok := r.MultipartForm.Value["team_id"]
+	if ok {
+		teamID, err := strconv.ParseUint(val[0], 10, 32)
+		if err != nil {
+			return nil, &fleet.BadRequestError{Message: fmt.Sprintf("Invalid team_id: %s", val[0])}
+		}
+		decoded.TeamID = ptr.Uint(uint(teamID))
+	}
+
+	installScriptMultipart, ok := r.MultipartForm.Value["install_script"]
+	if ok && len(installScriptMultipart) > 0 {
+		decoded.InstallScript = &installScriptMultipart[0]
+	}
+
+	preinstallQueryMultipart, ok := r.MultipartForm.Value["pre_install_query"]
+	if ok && len(preinstallQueryMultipart) > 0 {
+		decoded.PreInstallQuery = &preinstallQueryMultipart[0]
+	}
+
+	postInstallScriptMultipart, ok := r.MultipartForm.Value["post_install_script"]
+	if ok && len(postInstallScriptMultipart) > 0 {
+		decoded.PostInstallScript = &postInstallScriptMultipart[0]
+	}
+
+	uninstallScriptMultipart, ok := r.MultipartForm.Value["uninstall_script"]
+	if ok && len(uninstallScriptMultipart) > 0 {
+		decoded.UninstallScript = &uninstallScriptMultipart[0]
+	}
+
+	val, ok = r.MultipartForm.Value["self_service"]
+	if ok && len(val) > 0 && val[0] != "" {
+		parsed, err := strconv.ParseBool(val[0])
+		if err != nil {
+			return nil, &fleet.BadRequestError{Message: fmt.Sprintf("failed to decode self_service bool in multipart form: %s", err.Error())}
+		}
+		decoded.SelfService = &parsed
+	}
+
+	return &decoded, nil
+}
+
+func updateSoftwareInstallerEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (errorer, error) {
+	req := request.(*updateSoftwareInstallerRequest)
+
+	payload := &fleet.UpdateSoftwareInstallerPayload{
+		TitleID:           req.TitleID,
+		TeamID:            req.TeamID,
+		InstallScript:     req.InstallScript,
+		PreInstallQuery:   req.PreInstallQuery,
+		PostInstallScript: req.PostInstallScript,
+		UninstallScript:   req.UninstallScript,
+		SelfService:       req.SelfService,
+	}
+	if req.File != nil {
+		ff, err := req.File.Open()
+		if err != nil {
+			return uploadSoftwareInstallerResponse{Err: err}, nil
+		}
+		defer ff.Close()
+		payload.InstallerFile = ff
+		payload.Filename = req.File.Filename
+	}
+
+	installer, err := svc.UpdateSoftwareInstaller(ctx, payload)
+	if err != nil {
+		return uploadSoftwareInstallerResponse{Err: err}, nil
+	}
+
+	return getSoftwareInstallerResponse{SoftwareInstaller: installer}, nil
+}
+
+func (svc *Service) UpdateSoftwareInstaller(ctx context.Context, payload *fleet.UpdateSoftwareInstallerPayload) (*fleet.SoftwareInstaller, error) {
+	// skipauth: No authorization check needed due to implementation returning
+	// only license error.
+	svc.authz.SkipAuthorization(ctx)
+
+	return nil, fleet.ErrMissingLicense
+}
+
 // TODO: We parse the whole body before running svc.authz.Authorize.
 // An authenticated but unauthorized user could abuse this.
 func (uploadSoftwareInstallerRequest) DecodeRequest(ctx context.Context, r *http.Request) (interface{}, error) {
 	decoded := uploadSoftwareInstallerRequest{}
+
 	err := r.ParseMultipartForm(512 * units.MiB)
 	if err != nil {
 		var mbe *http.MaxBytesError
@@ -93,6 +234,11 @@ func (uploadSoftwareInstallerRequest) DecodeRequest(ctx context.Context, r *http
 		decoded.InstallScript = val[0]
 	}
 
+	val, ok = r.MultipartForm.Value["uninstall_script"]
+	if ok && len(val) > 0 {
+		decoded.UninstallScript = val[0]
+	}
+
 	val, ok = r.MultipartForm.Value["pre_install_query"]
 	if ok && len(val) > 0 {
 		decoded.PreInstallQuery = val[0]
@@ -133,6 +279,7 @@ func uploadSoftwareInstallerEndpoint(ctx context.Context, request interface{}, s
 		InstallerFile:     ff,
 		Filename:          req.File.Filename,
 		SelfService:       req.SelfService,
+		UninstallScript:   req.UninstallScript,
 	}
 
 	if err := svc.UploadSoftwareInstaller(ctx, payload); err != nil {
@@ -184,23 +331,15 @@ type getSoftwareInstallerRequest struct {
 	TitleID uint   `url:"title_id"`
 }
 
-type getSoftwareInstallerResponse struct {
-	// meta *fleet.SoftwareInstaller // NOTE: API design currently only supports downloading the
-	Err error `json:"error,omitempty"`
+type downloadSoftwareInstallerRequest struct {
+	TitleID uint   `url:"title_id"`
+	Token   string `url:"token"`
 }
 
-func (r getSoftwareInstallerResponse) error() error { return r.Err }
-
 func getSoftwareInstallerEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (errorer, error) {
 	req := request.(*getSoftwareInstallerRequest)
 
-	downloadRequested := req.Alt == "media"
-	if !downloadRequested {
-		// TODO: confirm error handling
-		return getSoftwareInstallerResponse{Err: &fleet.BadRequestError{Message: "only alt=media is supported"}}, nil
-	}
-
-	payload, err := svc.DownloadSoftwareInstaller(ctx, req.TitleID, req.TeamID)
+	payload, err := svc.DownloadSoftwareInstaller(ctx, false, req.Alt, req.TitleID, req.TeamID)
 	if err != nil {
 		return orbitDownloadSoftwareInstallerResponse{Err: err}, nil
 	}
@@ -208,7 +347,43 @@ func getSoftwareInstallerEndpoint(ctx context.Context, request interface{}, svc
 	return orbitDownloadSoftwareInstallerResponse{payload: payload}, nil
 }
 
-func (svc *Service) GetSoftwareInstallerMetadata(ctx context.Context, titleID uint, teamID *uint) (*fleet.SoftwareInstaller, error) {
+func getSoftwareInstallerTokenEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (errorer, error) {
+	req := request.(*getSoftwareInstallerRequest)
+
+	token, err := svc.GenerateSoftwareInstallerToken(ctx, req.Alt, req.TitleID, req.TeamID)
+	if err != nil {
+		return getSoftwareInstallerTokenResponse{Err: err}, nil
+	}
+	return getSoftwareInstallerTokenResponse{Token: token}, nil
+}
+
+func downloadSoftwareInstallerEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (errorer, error) {
+	req := request.(*downloadSoftwareInstallerRequest)
+
+	meta, err := svc.GetSoftwareInstallerTokenMetadata(ctx, req.Token, req.TitleID)
+	if err != nil {
+		return orbitDownloadSoftwareInstallerResponse{Err: err}, nil
+	}
+
+	payload, err := svc.DownloadSoftwareInstaller(ctx, true, "media", meta.TitleID, &meta.TeamID)
+	if err != nil {
+		return orbitDownloadSoftwareInstallerResponse{Err: err}, nil
+	}
+
+	return orbitDownloadSoftwareInstallerResponse{payload: payload}, nil
+}
+
+func (svc *Service) GenerateSoftwareInstallerToken(ctx context.Context, _ string, _ uint, _ *uint) (string, error) {
+	// skipauth: No authorization check needed due to implementation returning
+	// only license error.
+	svc.authz.SkipAuthorization(ctx)
+
+	return "", fleet.ErrMissingLicense
+}
+
+func (svc *Service) GetSoftwareInstallerTokenMetadata(ctx context.Context, _ string, _ uint) (*fleet.SoftwareInstallerTokenMetadata,
+	error,
+) {
 	// skipauth: No authorization check needed due to implementation returning
 	// only license error.
 	svc.authz.SkipAuthorization(ctx)
@@ -216,6 +391,28 @@ func (svc *Service) GetSoftwareInstallerMetadata(ctx context.Context, titleID ui
 	return nil, fleet.ErrMissingLicense
 }
 
+func (svc *Service) GetSoftwareInstallerMetadata(ctx context.Context, _ bool, _ uint, _ *uint) (*fleet.SoftwareInstaller, error) {
+	// skipauth: No authorization check needed due to implementation returning
+	// only license error.
+	svc.authz.SkipAuthorization(ctx)
+
+	return nil, fleet.ErrMissingLicense
+}
+
+type getSoftwareInstallerResponse struct {
+	SoftwareInstaller *fleet.SoftwareInstaller `json:"software_installer,omitempty"`
+	Err               error                    `json:"error,omitempty"`
+}
+
+func (r getSoftwareInstallerResponse) error() error { return r.Err }
+
+type getSoftwareInstallerTokenResponse struct {
+	Err   error  `json:"error,omitempty"`
+	Token string `json:"token"`
+}
+
+func (r getSoftwareInstallerTokenResponse) error() error { return r.Err }
+
 type orbitDownloadSoftwareInstallerResponse struct {
 	Err error `json:"error,omitempty"`
 	// fields used by hijackRender for the response.
@@ -239,7 +436,10 @@ func (r orbitDownloadSoftwareInstallerResponse) hijackRender(ctx context.Context
 	r.payload.Installer.Close()
 }
 
-func (svc *Service) DownloadSoftwareInstaller(ctx context.Context, titleID uint, teamID *uint) (*fleet.DownloadSoftwareInstallerPayload, error) {
+func (svc *Service) DownloadSoftwareInstaller(ctx context.Context, _ bool, _ string, _ uint,
+	_ *uint) (*fleet.DownloadSoftwareInstallerPayload,
+	error,
+) {
 	// skipauth: No authorization check needed due to implementation returning
 	// only license error.
 	svc.authz.SkipAuthorization(ctx)
@@ -283,6 +483,28 @@ func (svc *Service) InstallSoftwareTitle(ctx context.Context, hostID uint, softw
 	return fleet.ErrMissingLicense
 }
 
+type uninstallSoftwareRequest struct {
+	HostID          uint `url:"host_id"`
+	SoftwareTitleID uint `url:"software_title_id"`
+}
+
+func uninstallSoftwareTitleEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (errorer, error) {
+	req := request.(*uninstallSoftwareRequest)
+
+	err := svc.UninstallSoftwareTitle(ctx, req.HostID, req.SoftwareTitleID)
+	if err != nil {
+		return installSoftwareResponse{Err: err}, nil
+	}
+
+	return installSoftwareResponse{}, nil
+}
+
+func (svc *Service) UninstallSoftwareTitle(ctx context.Context, _ uint, _ uint) error {
+	// skipauth: No authorization check needed due to implementation returning only license error.
+	svc.authz.SkipAuthorization(ctx)
+	return fleet.ErrMissingLicense
+}
+
 type getSoftwareInstallResultsRequest struct {
 	InstallUUID string `url:"install_uuid"`
 }
@@ -318,33 +540,70 @@ func (svc *Service) GetSoftwareInstallResults(ctx context.Context, resultUUID st
 ////////////////////////////////////////////////////////////////////////////////
 
 type batchSetSoftwareInstallersRequest struct {
-	TeamName string                           `json:"-" query:"team_name"`
+	TeamName string                           `json:"-" query:"team_name,optional"`
 	DryRun   bool                             `json:"-" query:"dry_run,optional"` // if true, apply validation but do not save changes
 	Software []fleet.SoftwareInstallerPayload `json:"software"`
 }
 
 type batchSetSoftwareInstallersResponse struct {
-	Err error `json:"error,omitempty"`
+	RequestUUID string `json:"request_uuid"`
+	Err         error  `json:"error,omitempty"`
 }
 
 func (r batchSetSoftwareInstallersResponse) error() error { return r.Err }
 
-func (r batchSetSoftwareInstallersResponse) Status() int { return http.StatusNoContent }
-
 func batchSetSoftwareInstallersEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (errorer, error) {
 	req := request.(*batchSetSoftwareInstallersRequest)
-	if err := svc.BatchSetSoftwareInstallers(ctx, req.TeamName, req.Software, req.DryRun); err != nil {
+	requestUUID, err := svc.BatchSetSoftwareInstallers(ctx, req.TeamName, req.Software, req.DryRun)
+	if err != nil {
 		return batchSetSoftwareInstallersResponse{Err: err}, nil
 	}
-	return batchSetSoftwareInstallersResponse{}, nil
+	return batchSetSoftwareInstallersResponse{RequestUUID: requestUUID}, nil
 }
 
-func (svc *Service) BatchSetSoftwareInstallers(ctx context.Context, tmName string, payloads []fleet.SoftwareInstallerPayload, dryRun bool) error {
+func (svc *Service) BatchSetSoftwareInstallers(ctx context.Context, tmName string, payloads []fleet.SoftwareInstallerPayload, dryRun bool) (string, error) {
 	// skipauth: No authorization check needed due to implementation returning
 	// only license error.
 	svc.authz.SkipAuthorization(ctx)
 
-	return fleet.ErrMissingLicense
+	return "", fleet.ErrMissingLicense
+}
+
+type batchSetSoftwareInstallersResultRequest struct {
+	RequestUUID string `url:"request_uuid"`
+	TeamName    string `query:"team_name,optional"`
+	DryRun      bool   `query:"dry_run,optional"` // if true, apply validation but do not save changes
+}
+
+type batchSetSoftwareInstallersResultResponse struct {
+	Status   string                          `json:"status"`
+	Message  string                          `json:"message"`
+	Packages []fleet.SoftwarePackageResponse `json:"packages"`
+
+	Err error `json:"error,omitempty"`
+}
+
+func (r batchSetSoftwareInstallersResultResponse) error() error { return r.Err }
+
+func batchSetSoftwareInstallersResultEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (errorer, error) {
+	req := request.(*batchSetSoftwareInstallersResultRequest)
+	status, message, packages, err := svc.GetBatchSetSoftwareInstallersResult(ctx, req.TeamName, req.RequestUUID, req.DryRun)
+	if err != nil {
+		return batchSetSoftwareInstallersResultResponse{Err: err}, nil
+	}
+	return batchSetSoftwareInstallersResultResponse{
+		Status:   status,
+		Message:  message,
+		Packages: packages,
+	}, nil
+}
+
+func (svc *Service) GetBatchSetSoftwareInstallersResult(ctx context.Context, tmName string, requestUUID string, dryRun bool) (string, string, []fleet.SoftwarePackageResponse, error) {
+	// skipauth: No authorization check needed due to implementation returning
+	// only license error.
+	svc.authz.SkipAuthorization(ctx)
+
+	return "", "", nil, fleet.ErrMissingLicense
 }
 
 //////////////////////////////////////////////////////////////////////////////
@@ -411,6 +670,17 @@ type batchAssociateAppStoreAppsRequest struct {
 	Apps     []fleet.VPPBatchPayload `json:"app_store_apps"`
 }
 
+func (b *batchAssociateAppStoreAppsRequest) DecodeBody(ctx context.Context, r io.Reader, u url.Values, c []*x509.Certificate) error {
+	if err := json.NewDecoder(r).Decode(b); err != nil {
+		var typeErr *json.UnmarshalTypeError
+		if errors.As(err, &typeErr) {
+			return ctxerr.Wrap(ctx, fleet.NewUserMessageError(fmt.Errorf("Couldn't edit software. %q must be a %s, found %s", typeErr.Field, typeErr.Type.String(), typeErr.Value), http.StatusBadRequest))
+		}
+	}
+
+	return nil
+}
+
 type batchAssociateAppStoreAppsResponse struct {
 	Err error `json:"error,omitempty"`
 }
diff --git a/server/service/software_installers_test.go b/server/service/software_installers_test.go
index 2dc965d139..722cecda7a 100644
--- a/server/service/software_installers_test.go
+++ b/server/service/software_installers_test.go
@@ -79,6 +79,20 @@ func TestSoftwareInstallersAuth(t *testing.T) {
 				return nil
 			}
 
+			tokenExpiration := time.Now().Add(24 * time.Hour)
+			token, err := test.CreateVPPTokenEncoded(tokenExpiration, "fleet", "ca")
+			require.NoError(t, err)
+			ds.GetVPPTokenByTeamIDFunc = func(ctx context.Context, teamID *uint) (*fleet.VPPTokenDB, error) {
+				return &fleet.VPPTokenDB{
+					ID:        1,
+					OrgName:   "Fleet",
+					Location:  "Earth",
+					RenewDate: tokenExpiration,
+					Token:     string(token),
+					Teams:     nil,
+				}, nil
+			}
+
 			ds.AppConfigFunc = func(ctx context.Context) (*fleet.AppConfig, error) {
 				return &fleet.AppConfig{}, nil
 			}
@@ -104,7 +118,7 @@ func TestSoftwareInstallersAuth(t *testing.T) {
 				return map[fleet.MDMAssetName]fleet.MDMConfigAsset{}, nil
 			}
 
-			_, err := svc.DownloadSoftwareInstaller(ctx, 1, tt.teamID)
+			_, err = svc.DownloadSoftwareInstaller(ctx, false, "media", 1, tt.teamID)
 			if tt.teamID == nil {
 				require.Error(t, err)
 			} else {
@@ -129,7 +143,7 @@ func TestSoftwareInstallersAuth(t *testing.T) {
 				}
 			}
 
-			err = svc.AddAppStoreApp(ctx, tt.teamID, fleet.VPPAppID{AdamID: "123", Platform: fleet.IOSPlatform})
+			err = svc.AddAppStoreApp(ctx, tt.teamID, fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "123", Platform: fleet.IOSPlatform}})
 			if tt.teamID == nil {
 				require.Error(t, err)
 			} else {
diff --git a/server/service/software_titles.go b/server/service/software_titles.go
index 39f38177ae..91c5ce98e0 100644
--- a/server/service/software_titles.go
+++ b/server/service/software_titles.go
@@ -68,14 +68,17 @@ func (svc *Service) ListSoftwareTitles(
 		return nil, 0, nil, err
 	}
 
-	if opt.TeamID != nil && *opt.TeamID != 0 {
-		lic, err := svc.License(ctx)
-		if err != nil {
-			return nil, 0, nil, ctxerr.Wrap(ctx, err, "get license")
-		}
-		if !lic.IsPremium() {
-			return nil, 0, nil, fleet.ErrMissingLicense
-		}
+	lic, err := svc.License(ctx)
+	if err != nil {
+		return nil, 0, nil, ctxerr.Wrap(ctx, err, "get license")
+	}
+
+	if opt.TeamID != nil && *opt.TeamID != 0 && !lic.IsPremium() {
+		return nil, 0, nil, fleet.ErrMissingLicense
+	}
+
+	if !lic.IsPremium() && (opt.MaximumCVSS > 0 || opt.MinimumCVSS > 0 || opt.KnownExploit) {
+		return nil, 0, nil, fleet.ErrMissingLicense
 	}
 
 	// always include metadata for software titles
diff --git a/server/service/team_policies.go b/server/service/team_policies.go
index 81ebee7d40..14cea750e1 100644
--- a/server/service/team_policies.go
+++ b/server/service/team_policies.go
@@ -29,6 +29,7 @@ type teamPolicyRequest struct {
 	Platform              string `json:"platform"`
 	Critical              bool   `json:"critical" premium:"true"`
 	CalendarEventsEnabled bool   `json:"calendar_events_enabled"`
+	SoftwareTitleID       *uint  `json:"software_title_id"`
 }
 
 type teamPolicyResponse struct {
@@ -40,7 +41,7 @@ func (r teamPolicyResponse) error() error { return r.Err }
 
 func teamPolicyEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (errorer, error) {
 	req := request.(*teamPolicyRequest)
-	resp, err := svc.NewTeamPolicy(ctx, req.TeamID, fleet.PolicyPayload{
+	resp, err := svc.NewTeamPolicy(ctx, req.TeamID, fleet.NewTeamPolicyPayload{
 		QueryID:               req.QueryID,
 		Name:                  req.Name,
 		Query:                 req.Query,
@@ -49,6 +50,7 @@ func teamPolicyEndpoint(ctx context.Context, request interface{}, svc fleet.Serv
 		Platform:              req.Platform,
 		Critical:              req.Critical,
 		CalendarEventsEnabled: req.CalendarEventsEnabled,
+		SoftwareTitleID:       req.SoftwareTitleID,
 	})
 	if err != nil {
 		return teamPolicyResponse{Err: err}, nil
@@ -56,7 +58,7 @@ func teamPolicyEndpoint(ctx context.Context, request interface{}, svc fleet.Serv
 	return teamPolicyResponse{Policy: resp}, nil
 }
 
-func (svc Service) NewTeamPolicy(ctx context.Context, teamID uint, p fleet.PolicyPayload) (*fleet.Policy, error) {
+func (svc Service) NewTeamPolicy(ctx context.Context, teamID uint, tp fleet.NewTeamPolicyPayload) (*fleet.Policy, error) {
 	if err := svc.authz.Authorize(ctx, &fleet.Policy{
 		PolicyData: fleet.PolicyData{
 			TeamID: ptr.Uint(teamID),
@@ -70,6 +72,11 @@ func (svc Service) NewTeamPolicy(ctx context.Context, teamID uint, p fleet.Polic
 		return nil, errors.New("user must be authenticated to create team policies")
 	}
 
+	p, err := svc.newTeamPolicyPayloadToPolicyPayload(ctx, teamID, tp)
+	if err != nil {
+		return nil, err
+	}
+
 	if err := p.Verify(); err != nil {
 		return nil, ctxerr.Wrap(ctx, &fleet.BadRequestError{
 			Message: fmt.Sprintf("policy payload verification: %s", err),
@@ -80,6 +87,10 @@ func (svc Service) NewTeamPolicy(ctx context.Context, teamID uint, p fleet.Polic
 		return nil, ctxerr.Wrap(ctx, err, "creating policy")
 	}
 
+	if err := svc.populatePolicyInstallSoftware(ctx, policy); err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "populate install_software")
+	}
+
 	// Note: Issue #4191 proposes that we move to SQL transactions for actions so that we can
 	// rollback an action in the event of an error writing the associated activity
 	if err := svc.NewActivity(
@@ -95,6 +106,39 @@ func (svc Service) NewTeamPolicy(ctx context.Context, teamID uint, p fleet.Polic
 	return policy, nil
 }
 
+func (svc *Service) populatePolicyInstallSoftware(ctx context.Context, p *fleet.Policy) error {
+	if p.SoftwareInstallerID == nil {
+		return nil
+	}
+	installerMetadata, err := svc.ds.GetSoftwareInstallerMetadataByID(ctx, *p.SoftwareInstallerID)
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "get software installer metadata by id")
+	}
+	p.InstallSoftware = &fleet.PolicySoftwareTitle{
+		SoftwareTitleID: *installerMetadata.TitleID,
+		Name:            installerMetadata.SoftwareTitle,
+	}
+	return nil
+}
+
+func (svc *Service) newTeamPolicyPayloadToPolicyPayload(ctx context.Context, teamID uint, p fleet.NewTeamPolicyPayload) (fleet.PolicyPayload, error) {
+	softwareInstallerID, err := svc.deduceSoftwareInstallerIDFromTitleID(ctx, &teamID, p.SoftwareTitleID)
+	if err != nil {
+		return fleet.PolicyPayload{}, err
+	}
+	return fleet.PolicyPayload{
+		QueryID:               p.QueryID,
+		Name:                  p.Name,
+		Query:                 p.Query,
+		Critical:              p.Critical,
+		Description:           p.Description,
+		Resolution:            p.Resolution,
+		Platform:              p.Platform,
+		CalendarEventsEnabled: p.CalendarEventsEnabled,
+		SoftwareInstallerID:   softwareInstallerID,
+	}, nil
+}
+
 /////////////////////////////////////////////////////////////////////////////////
 // List
 /////////////////////////////////////////////////////////////////////////////////
@@ -143,16 +187,34 @@ func (svc *Service) ListTeamPolicies(ctx context.Context, teamID uint, opts flee
 		return nil, nil, err
 	}
 
-	if _, err := svc.ds.Team(ctx, teamID); err != nil {
-		return nil, nil, ctxerr.Wrapf(ctx, err, "loading team %d", teamID)
+	if teamID > 0 {
+		if _, err := svc.ds.Team(ctx, teamID); err != nil {
+			return nil, nil, ctxerr.Wrapf(ctx, err, "loading team %d", teamID)
+		}
 	}
 
 	if mergeInherited {
-		p, err := svc.ds.ListMergedTeamPolicies(ctx, teamID, opts)
-		return p, nil, err
+		policies, err := svc.ds.ListMergedTeamPolicies(ctx, teamID, opts)
+		for i := range policies {
+			if err := svc.populatePolicyInstallSoftware(ctx, policies[i]); err != nil {
+				return nil, nil, ctxerr.Wrapf(ctx, err, "populate install_software for policy_id: %d", policies[i].ID)
+			}
+		}
+		return policies, nil, err
 	}
 
-	return svc.ds.ListTeamPolicies(ctx, teamID, opts, iopts)
+	teamPolicies, inheritedPolicies, err = svc.ds.ListTeamPolicies(ctx, teamID, opts, iopts)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	for i := range teamPolicies {
+		if err := svc.populatePolicyInstallSoftware(ctx, teamPolicies[i]); err != nil {
+			return nil, nil, ctxerr.Wrapf(ctx, err, "populate install_software for policy_id: %d", teamPolicies[i].ID)
+		}
+	}
+
+	return teamPolicies, inheritedPolicies, nil
 }
 
 /////////////////////////////////////////////////////////////////////////////////
@@ -190,8 +252,10 @@ func (svc *Service) CountTeamPolicies(ctx context.Context, teamID uint, matchQue
 		return 0, err
 	}
 
-	if _, err := svc.ds.Team(ctx, teamID); err != nil {
-		return 0, ctxerr.Wrapf(ctx, err, "loading team %d", teamID)
+	if teamID > 0 {
+		if _, err := svc.ds.Team(ctx, teamID); err != nil {
+			return 0, ctxerr.Wrapf(ctx, err, "loading team %d", teamID)
+		}
 	}
 
 	if mergeInherited {
@@ -240,6 +304,10 @@ func (svc Service) GetTeamPolicyByIDQueries(ctx context.Context, teamID uint, po
 		return nil, err
 	}
 
+	if err := svc.populatePolicyInstallSoftware(ctx, teamPolicy); err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "populate install_software")
+	}
+
 	return teamPolicy, nil
 }
 
@@ -277,8 +345,10 @@ func (svc Service) DeleteTeamPolicies(ctx context.Context, teamID uint, ids []ui
 		return nil, err
 	}
 
-	if _, err := svc.ds.Team(ctx, teamID); err != nil {
-		return nil, ctxerr.Wrapf(ctx, err, "loading team %d", teamID)
+	if teamID > 0 {
+		if _, err := svc.ds.Team(ctx, teamID); err != nil {
+			return nil, ctxerr.Wrapf(ctx, err, "loading team %d", teamID)
+		}
 	}
 
 	if len(ids) == 0 {
@@ -418,6 +488,21 @@ func (svc *Service) modifyPolicy(ctx context.Context, teamID *uint, id uint, p f
 		policy.FailingHostCount = 0
 		policy.PassingHostCount = 0
 	}
+	if p.SoftwareTitleID != nil {
+		softwareInstallerID, err := svc.deduceSoftwareInstallerIDFromTitleID(ctx, teamID, p.SoftwareTitleID)
+		if err != nil {
+			return nil, err
+		}
+		// If the associated installer is changed (or it's set and the policy didn't have an associated installer)
+		// then we clear the results of the policy so that automation can be triggered upon failure
+		// (automation is currently triggered on the first failure or when it goes from passing to failure).
+		if softwareInstallerID != nil && (policy.SoftwareInstallerID == nil || *policy.SoftwareInstallerID != *softwareInstallerID) {
+			removeAllMemberships = true
+			removeStats = true
+		}
+		policy.SoftwareInstallerID = softwareInstallerID
+	}
+
 	logging.WithExtras(ctx, "name", policy.Name, "sql", policy.Query)
 
 	err = svc.ds.SavePolicy(ctx, policy, removeAllMemberships, removeStats)
@@ -425,6 +510,10 @@ func (svc *Service) modifyPolicy(ctx context.Context, teamID *uint, id uint, p f
 		return nil, ctxerr.Wrap(ctx, err, "saving policy")
 	}
 
+	if err := svc.populatePolicyInstallSoftware(ctx, policy); err != nil {
+		return nil, ctxerr.Wrap(ctx, err, "populate install_software")
+	}
+
 	// Note: Issue #4191 proposes that we move to SQL transactions for actions so that we can
 	// rollback an action in the event of an error writing the associated activity
 	if err := svc.NewActivity(
@@ -440,3 +529,44 @@ func (svc *Service) modifyPolicy(ctx context.Context, teamID *uint, id uint, p f
 
 	return policy, nil
 }
+
+func (svc *Service) deduceSoftwareInstallerIDFromTitleID(ctx context.Context, teamID *uint, softwareTitleID *uint) (*uint, error) {
+	if softwareTitleID == nil {
+		return nil, nil
+	}
+
+	// If *p.SoftwareTitleID with value 0 is used to unset the current installer from the policy.
+	if *softwareTitleID == 0 {
+		return nil, nil
+	}
+
+	if teamID == nil {
+		return nil, ctxerr.Wrap(ctx, &fleet.BadRequestError{
+			Message: "software_title_id cannot be set on global policies",
+		})
+	}
+
+	softwareTitle, err := svc.SoftwareTitleByID(ctx, *softwareTitleID, teamID)
+	if err != nil {
+		if fleet.IsNotFound(err) {
+			return nil, ctxerr.Wrap(ctx, &fleet.BadRequestError{
+				Message: fmt.Sprintf("software_title_id %d on team_id %d not found", *softwareTitleID, *teamID),
+			})
+		}
+		return nil, ctxerr.Wrap(ctx, err, "software title by id")
+	}
+	if softwareTitle.AppStoreApp != nil {
+		return nil, ctxerr.Wrap(ctx, &fleet.BadRequestError{
+			Message: fmt.Sprintf("software_title_id %d on team_id %d is assocated to a VPP app, only software installers are supported", *softwareTitleID, *teamID),
+		})
+	}
+	if softwareTitle.SoftwarePackage == nil {
+		return nil, ctxerr.Wrap(ctx, &fleet.BadRequestError{
+			Message: fmt.Sprintf("software_title_id %d on team_id %d does not have associated package", *softwareTitleID, *teamID),
+		})
+	}
+
+	// At this point we assume *softwareTitle.SoftwarePackage.TeamID == *teamID,
+	// because SoftwareTitleByID above receives the teamID.
+	return ptr.Uint(softwareTitle.SoftwarePackage.InstallerID), nil
+}
diff --git a/server/service/team_policies_test.go b/server/service/team_policies_test.go
index 5c6c25ff8c..551e6e567c 100644
--- a/server/service/team_policies_test.go
+++ b/server/service/team_policies_test.go
@@ -32,7 +32,7 @@ func TestTeamPoliciesAuth(t *testing.T) {
 		return nil, nil
 	}
 	ds.TeamPolicyFunc = func(ctx context.Context, teamID uint, policyID uint) (*fleet.Policy, error) {
-		return nil, nil
+		return &fleet.Policy{}, nil
 	}
 	ds.PolicyFunc = func(ctx context.Context, id uint) (*fleet.Policy, error) {
 		if id == 1 {
@@ -68,6 +68,9 @@ func TestTeamPoliciesAuth(t *testing.T) {
 	ds.TeamFunc = func(ctx context.Context, tid uint) (*fleet.Team, error) {
 		return &fleet.Team{ID: 1}, nil
 	}
+	ds.GetSoftwareInstallerMetadataByIDFunc = func(ctx context.Context, id uint) (*fleet.SoftwareInstaller, error) {
+		return &fleet.SoftwareInstaller{}, nil
+	}
 
 	testCases := []struct {
 		name            string
@@ -149,7 +152,7 @@ func TestTeamPoliciesAuth(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			ctx := viewer.NewContext(ctx, viewer.Viewer{User: tt.user})
 
-			_, err := svc.NewTeamPolicy(ctx, 1, fleet.PolicyPayload{
+			_, err := svc.NewTeamPolicy(ctx, 1, fleet.NewTeamPolicyPayload{
 				Name:  "query1",
 				Query: "select 1;",
 			})
diff --git a/server/service/teams.go b/server/service/teams.go
index 1d8a30032d..d2bcf6a994 100644
--- a/server/service/teams.go
+++ b/server/service/teams.go
@@ -5,11 +5,12 @@ import (
 	"crypto/x509"
 	"encoding/json"
 	"fmt"
-	"golang.org/x/text/unicode/norm"
 	"io"
 	"net/http"
 	"net/url"
 
+	"golang.org/x/text/unicode/norm"
+
 	"github.com/fleetdm/fleet/v4/server/contexts/ctxerr"
 	"github.com/fleetdm/fleet/v4/server/fleet"
 )
diff --git a/server/service/teams_test.go b/server/service/teams_test.go
index 9011e8bce7..cf71aab795 100644
--- a/server/service/teams_test.go
+++ b/server/service/teams_test.go
@@ -53,8 +53,9 @@ func TestTeamAuth(t *testing.T) {
 	ds.ApplyEnrollSecretsFunc = func(ctx context.Context, teamID *uint, secrets []*fleet.EnrollSecret) error {
 		return nil
 	}
-	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hids, tids []uint, puuids, uuids []string) error {
-		return nil
+	ds.BulkSetPendingMDMHostProfilesFunc = func(ctx context.Context, hids, tids []uint, puuids, uuids []string,
+	) (updates fleet.MDMProfilesUpdates, err error) {
+		return fleet.MDMProfilesUpdates{}, nil
 	}
 	ds.ListHostsFunc = func(ctx context.Context, filter fleet.TeamFilter, opt fleet.HostListOptions) ([]*fleet.Host, error) {
 		return []*fleet.Host{}, nil
diff --git a/server/service/testdata/software-installers/README.md b/server/service/testdata/software-installers/README.md
new file mode 100644
index 0000000000..b5a59d9daf
--- /dev/null
+++ b/server/service/testdata/software-installers/README.md
@@ -0,0 +1,3 @@
+# testdata
+
+- `fleet-osquery.msi` is a dummy MSI installer created by `packaging.BuildMSI` with a fake `orbit.exe` that just has `hello world` in it. Its software title is `Fleet osquery` and its version is `1.0.0`.
\ No newline at end of file
diff --git a/server/service/testdata/software-installers/fleet-osquery.msi b/server/service/testdata/software-installers/fleet-osquery.msi
new file mode 100644
index 0000000000..cc52ad5d4e
Binary files /dev/null and b/server/service/testdata/software-installers/fleet-osquery.msi differ
diff --git a/server/service/testdata/software-installers/no_version.pkg b/server/service/testdata/software-installers/no_version.pkg
new file mode 100644
index 0000000000..c649ebf17b
Binary files /dev/null and b/server/service/testdata/software-installers/no_version.pkg differ
diff --git a/server/service/testing_client.go b/server/service/testing_client.go
index b5232c2b1c..48476f7162 100644
--- a/server/service/testing_client.go
+++ b/server/service/testing_client.go
@@ -118,12 +118,6 @@ func (ts *withServer) commonTearDownTest(t *testing.T) {
 		require.NoError(t, ts.ds.DeleteHost(ctx, host.ID))
 	}
 
-	// clean up any software installers
-	mysql.ExecAdhocSQL(t, ts.ds, func(q sqlx.ExtContext) error {
-		_, err := q.ExecContext(ctx, `DELETE FROM software_installers`)
-		return err
-	})
-
 	lbls, err := ts.ds.ListLabels(ctx, fleet.TeamFilter{}, fleet.ListOptions{})
 	require.NoError(t, err)
 	for _, lbl := range lbls {
@@ -161,6 +155,12 @@ func (ts *withServer) commonTearDownTest(t *testing.T) {
 		require.NoError(t, err)
 	}
 
+	// Clean software installers in "No team" (the others are deleted in ts.ds.DeleteTeam above).
+	mysql.ExecAdhocSQL(t, ts.ds, func(q sqlx.ExtContext) error {
+		_, err := q.ExecContext(ctx, `DELETE FROM software_installers WHERE global_or_team_id = 0;`)
+		return err
+	})
+
 	globalPolicies, err := ts.ds.ListGlobalPolicies(ctx, fleet.ListOptions{})
 	require.NoError(t, err)
 	if len(globalPolicies) > 0 {
@@ -198,6 +198,11 @@ func (ts *withServer) commonTearDownTest(t *testing.T) {
 		_, err := q.ExecContext(ctx, `DELETE FROM host_script_results`)
 		return err
 	})
+
+	mysql.ExecAdhocSQL(t, ts.ds, func(tx sqlx.ExtContext) error {
+		_, err := tx.ExecContext(ctx, "DELETE FROM vpp_tokens;")
+		return err
+	})
 }
 
 func (ts *withServer) Do(verb, path string, params interface{}, expectedStatusCode int, queryParams ...string) *http.Response {
@@ -279,6 +284,21 @@ func (ts *withServer) DoJSON(verb, path string, params interface{}, expectedStat
 	}
 }
 
+func (ts *withServer) DoJSONWithoutAuth(verb, path string, params interface{}, expectedStatusCode int, v interface{}, queryParams ...string) {
+	t := ts.s.T()
+	rawBytes, err := json.Marshal(params)
+	require.NoError(t, err)
+	resp := ts.DoRawWithHeaders(verb, path, rawBytes, expectedStatusCode, map[string]string{}, queryParams...)
+	t.Cleanup(func() {
+		resp.Body.Close()
+	})
+	err = json.NewDecoder(resp.Body).Decode(v)
+	require.NoError(ts.s.T(), err)
+	if e, ok := v.(errorer); ok {
+		require.NoError(ts.s.T(), e.error())
+	}
+}
+
 func (ts *withServer) getTestAdminToken() string {
 	testUser := testUsers["admin1"]
 
@@ -480,3 +500,24 @@ func (ts *withServer) lastActivityOfTypeMatches(name, details string, id uint) u
 	t.Fatalf("no activity of type %s found in the last %d activities", name, len(listActivities.Activities))
 	return 0
 }
+
+func (ts *withServer) lastActivityOfTypeDoesNotMatch(name, details string, id uint) {
+	t := ts.s.T()
+
+	var listActivities listActivitiesResponse
+	ts.DoJSON("GET", "/api/latest/fleet/activities", nil, http.StatusOK,
+		&listActivities, "order_key", "a.id", "order_direction", "desc", "per_page", "10")
+	require.True(t, len(listActivities.Activities) > 0)
+
+	for _, act := range listActivities.Activities {
+		if act.Type == name {
+			if details != "" {
+				require.NotNil(t, act.Details)
+				assert.NotEqual(t, details, string(*act.Details))
+			}
+			if id > 0 {
+				assert.NotEqual(t, id, act.ID)
+			}
+		}
+	}
+}
diff --git a/server/service/testing_utils.go b/server/service/testing_utils.go
index ce7a82ea9e..7e5937c56c 100644
--- a/server/service/testing_utils.go
+++ b/server/service/testing_utils.go
@@ -34,6 +34,7 @@ import (
 	"github.com/fleetdm/fleet/v4/server/ptr"
 	"github.com/fleetdm/fleet/v4/server/service/async"
 	"github.com/fleetdm/fleet/v4/server/service/mock"
+	"github.com/fleetdm/fleet/v4/server/service/redis_key_value"
 	"github.com/fleetdm/fleet/v4/server/service/redis_lock"
 	"github.com/fleetdm/fleet/v4/server/sso"
 	"github.com/fleetdm/fleet/v4/server/test"
@@ -64,13 +65,15 @@ func newTestServiceWithConfig(t *testing.T, ds fleet.Datastore, fleetConfig conf
 		mailer            fleet.MailService             = &mockMailService{SendEmailFn: func(e fleet.Email) error { return nil }}
 		c                 clock.Clock                   = clock.C
 
-		is                   fleet.InstallerStore
-		mdmStorage           fleet.MDMAppleStore
-		mdmPusher            nanomdm_push.Pusher
-		ssoStore             sso.SessionStore
-		profMatcher          fleet.ProfileMatcher
-		softwareInstallStore fleet.SoftwareInstallerStore
-		distributedLock      fleet.Lock
+		is                    fleet.InstallerStore
+		mdmStorage            fleet.MDMAppleStore
+		mdmPusher             nanomdm_push.Pusher
+		ssoStore              sso.SessionStore
+		profMatcher           fleet.ProfileMatcher
+		softwareInstallStore  fleet.SoftwareInstallerStore
+		bootstrapPackageStore fleet.MDMBootstrapPackageStore
+		distributedLock       fleet.Lock
+		keyValueStore         fleet.KeyValueStore
 	)
 	if len(opts) > 0 {
 		if opts[0].Clock != nil {
@@ -78,6 +81,10 @@ func newTestServiceWithConfig(t *testing.T, ds fleet.Datastore, fleetConfig conf
 		}
 	}
 
+	if len(opts) > 0 && opts[0].KeyValueStore != nil {
+		keyValueStore = opts[0].KeyValueStore
+	}
+
 	task := async.NewTask(ds, nil, c, config.OsqueryConfig{})
 	if len(opts) > 0 {
 		if opts[0].Task != nil {
@@ -98,6 +105,7 @@ func newTestServiceWithConfig(t *testing.T, ds fleet.Datastore, fleetConfig conf
 			ssoStore = sso.NewSessionStore(opts[0].Pool)
 			profMatcher = apple_mdm.NewProfileMatcher(opts[0].Pool)
 			distributedLock = redis_lock.NewLock(opts[0].Pool)
+			keyValueStore = redis_key_value.New(opts[0].Pool)
 		}
 		if opts[0].ProfileMatcher != nil {
 			profMatcher = opts[0].ProfileMatcher
@@ -115,6 +123,9 @@ func newTestServiceWithConfig(t *testing.T, ds fleet.Datastore, fleetConfig conf
 		if opts[0].SoftwareInstallStore != nil {
 			softwareInstallStore = opts[0].SoftwareInstallStore
 		}
+		if opts[0].BootstrapPackageStore != nil {
+			bootstrapPackageStore = opts[0].BootstrapPackageStore
+		}
 
 		// allow to explicitly set installer store to nil
 		is = opts[0].Is
@@ -197,7 +208,9 @@ func newTestServiceWithConfig(t *testing.T, ds fleet.Datastore, fleetConfig conf
 			ssoStore,
 			profMatcher,
 			softwareInstallStore,
+			bootstrapPackageStore,
 			distributedLock,
+			keyValueStore,
 		)
 		if err != nil {
 			panic(err)
@@ -287,30 +300,32 @@ func (svc *mockMailService) SendEmail(e fleet.Email) error {
 type TestNewScheduleFunc func(ctx context.Context, ds fleet.Datastore) fleet.NewCronScheduleFunc
 
 type TestServerOpts struct {
-	Logger               kitlog.Logger
-	License              *fleet.LicenseInfo
-	SkipCreateTestUsers  bool
-	Rs                   fleet.QueryResultStore
-	Lq                   fleet.LiveQueryStore
-	Pool                 fleet.RedisPool
-	FailingPolicySet     fleet.FailingPolicySet
-	Clock                clock.Clock
-	Task                 *async.Task
-	EnrollHostLimiter    fleet.EnrollHostLimiter
-	Is                   fleet.InstallerStore
-	FleetConfig          *config.FleetConfig
-	MDMStorage           fleet.MDMAppleStore
-	DEPStorage           nanodep_storage.AllDEPStorage
-	SCEPStorage          scep_depot.Depot
-	MDMPusher            nanomdm_push.Pusher
-	HTTPServerConfig     *http.Server
-	StartCronSchedules   []TestNewScheduleFunc
-	UseMailService       bool
-	APNSTopic            string
-	ProfileMatcher       fleet.ProfileMatcher
-	EnableCachedDS       bool
-	NoCacheDatastore     bool
-	SoftwareInstallStore fleet.SoftwareInstallerStore
+	Logger                kitlog.Logger
+	License               *fleet.LicenseInfo
+	SkipCreateTestUsers   bool
+	Rs                    fleet.QueryResultStore
+	Lq                    fleet.LiveQueryStore
+	Pool                  fleet.RedisPool
+	FailingPolicySet      fleet.FailingPolicySet
+	Clock                 clock.Clock
+	Task                  *async.Task
+	EnrollHostLimiter     fleet.EnrollHostLimiter
+	Is                    fleet.InstallerStore
+	FleetConfig           *config.FleetConfig
+	MDMStorage            fleet.MDMAppleStore
+	DEPStorage            nanodep_storage.AllDEPStorage
+	SCEPStorage           scep_depot.Depot
+	MDMPusher             nanomdm_push.Pusher
+	HTTPServerConfig      *http.Server
+	StartCronSchedules    []TestNewScheduleFunc
+	UseMailService        bool
+	APNSTopic             string
+	ProfileMatcher        fleet.ProfileMatcher
+	EnableCachedDS        bool
+	NoCacheDatastore      bool
+	SoftwareInstallStore  fleet.SoftwareInstallerStore
+	BootstrapPackageStore fleet.MDMBootstrapPackageStore
+	KeyValueStore         fleet.KeyValueStore
 }
 
 func RunServerForTestsWithDS(t *testing.T, ds fleet.Datastore, opts ...*TestServerOpts) (map[string]fleet.User, *httptest.Server) {
@@ -373,6 +388,10 @@ func RunServerForTestsWithDS(t *testing.T, ds fleet.Datastore, opts ...*TestServ
 
 	server := httptest.NewUnstartedServer(rootMux)
 	server.Config = cfg.Server.DefaultHTTPServer(ctx, rootMux)
+	// WriteTimeout is set for security purposes.
+	// If we don't set it, (bugy or malignant) clients making long running
+	// requests could DDOS Fleet.
+	require.NotZero(t, server.Config.WriteTimeout)
 	if len(opts) > 0 && opts[0].HTTPServerConfig != nil {
 		server.Config = opts[0].HTTPServerConfig
 		// make sure we use the application handler we just created
@@ -626,7 +645,6 @@ func mdmConfigurationRequiredEndpoints() []struct {
 		{"DELETE", "/api/latest/fleet/mdm/apple/installers/1", false, false},
 		{"GET", "/api/latest/fleet/mdm/apple/installers", false, false},
 		{"GET", "/api/latest/fleet/mdm/apple/devices", false, false},
-		{"GET", "/api/latest/fleet/mdm/apple/dep/devices", false, false},
 		{"GET", "/api/latest/fleet/mdm/apple/profiles", false, false},
 		{"GET", "/api/latest/fleet/mdm/apple/profiles/1", false, false},
 		{"DELETE", "/api/latest/fleet/mdm/apple/profiles/1", false, false},
diff --git a/server/service/transport.go b/server/service/transport.go
index 4e9d9df562..145fa78c1f 100644
--- a/server/service/transport.go
+++ b/server/service/transport.go
@@ -87,6 +87,19 @@ func uintFromRequest(r *http.Request, name string) (uint64, error) {
 	return u, nil
 }
 
+func uint32FromRequest(r *http.Request, name string) (uint32, error) {
+	vars := mux.Vars(r)
+	s, ok := vars[name]
+	if !ok {
+		return 0, errBadRoute
+	}
+	u, err := strconv.ParseUint(s, 10, 32)
+	if err != nil {
+		return 0, ctxerr.Wrap(r.Context(), err, "uint32FromRequest")
+	}
+	return uint32(u), nil
+}
+
 func intFromRequest(r *http.Request, name string) (int64, error) {
 	vars := mux.Vars(r)
 	s, ok := vars[name]
diff --git a/server/service/vpp.go b/server/service/vpp.go
index 4f2827edbb..c2e25eddc0 100644
--- a/server/service/vpp.go
+++ b/server/service/vpp.go
@@ -2,7 +2,11 @@ package service
 
 import (
 	"context"
+	"io"
+	"mime/multipart"
+	"net/http"
 
+	"github.com/docker/go-units"
 	"github.com/fleetdm/fleet/v4/server/fleet"
 )
 
@@ -44,9 +48,10 @@ func (svc *Service) GetAppStoreApps(ctx context.Context, teamID *uint) ([]*fleet
 //////////////////////////////////////////////////////////////////////////////
 
 type addAppStoreAppRequest struct {
-	TeamID     *uint                     `json:"team_id"`
-	AppStoreID string                    `json:"app_store_id"`
-	Platform   fleet.AppleDevicePlatform `json:"platform"`
+	TeamID      *uint                     `json:"team_id"`
+	AppStoreID  string                    `json:"app_store_id"`
+	Platform    fleet.AppleDevicePlatform `json:"platform"`
+	SelfService bool                      `json:"self_service"`
 }
 
 type addAppStoreAppResponse struct {
@@ -57,7 +62,7 @@ func (r addAppStoreAppResponse) error() error { return r.Err }
 
 func addAppStoreAppEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (errorer, error) {
 	req := request.(*addAppStoreAppRequest)
-	err := svc.AddAppStoreApp(ctx, req.TeamID, fleet.VPPAppID{AdamID: req.AppStoreID, Platform: req.Platform})
+	err := svc.AddAppStoreApp(ctx, req.TeamID, fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: req.AppStoreID, Platform: req.Platform}, SelfService: req.SelfService})
 	if err != nil {
 		return &addAppStoreAppResponse{Err: err}, nil
 	}
@@ -65,7 +70,243 @@ func addAppStoreAppEndpoint(ctx context.Context, request interface{}, svc fleet.
 	return &addAppStoreAppResponse{}, nil
 }
 
-func (svc *Service) AddAppStoreApp(ctx context.Context, _ *uint, _ fleet.VPPAppID) error {
+func (svc *Service) AddAppStoreApp(ctx context.Context, _ *uint, _ fleet.VPPAppTeam) error {
+	// skipauth: No authorization check needed due to implementation returning
+	// only license error.
+	svc.authz.SkipAuthorization(ctx)
+
+	return fleet.ErrMissingLicense
+}
+
+////////////////////////////////////////////////////////////////////////////////
+// POST /api/_version_/vpp_tokens
+////////////////////////////////////////////////////////////////////////////////
+
+type uploadVPPTokenRequest struct {
+	File *multipart.FileHeader
+}
+
+func (uploadVPPTokenRequest) DecodeRequest(ctx context.Context, r *http.Request) (interface{}, error) {
+	decoded := uploadVPPTokenRequest{}
+
+	err := r.ParseMultipartForm(512 * units.MiB)
+	if err != nil {
+		return nil, &fleet.BadRequestError{
+			Message:     "failed to parse multipart form",
+			InternalErr: err,
+		}
+	}
+
+	if r.MultipartForm.File["token"] == nil || len(r.MultipartForm.File["token"]) == 0 {
+		return nil, &fleet.BadRequestError{
+			Message:     "token multipart field is required",
+			InternalErr: err,
+		}
+	}
+
+	decoded.File = r.MultipartForm.File["token"][0]
+
+	return &decoded, nil
+}
+
+type uploadVPPTokenResponse struct {
+	Err   error             `json:"error,omitempty"`
+	Token *fleet.VPPTokenDB `json:"token,omitempty"`
+}
+
+func (r uploadVPPTokenResponse) Status() int { return http.StatusAccepted }
+
+func (r uploadVPPTokenResponse) error() error {
+	return r.Err
+}
+
+func uploadVPPTokenEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (errorer, error) {
+	req := request.(*uploadVPPTokenRequest)
+	file, err := req.File.Open()
+	if err != nil {
+		return uploadVPPTokenResponse{Err: err}, nil
+	}
+	defer file.Close()
+
+	tok, err := svc.UploadVPPToken(ctx, file)
+	if err != nil {
+		return uploadVPPTokenResponse{Err: err}, nil
+	}
+
+	return uploadVPPTokenResponse{Token: tok}, nil
+}
+
+func (svc *Service) UploadVPPToken(ctx context.Context, file io.ReadSeeker) (*fleet.VPPTokenDB, error) {
+	// skipauth: No authorization check needed due to implementation returning
+	// only license error.
+	svc.authz.SkipAuthorization(ctx)
+
+	return nil, fleet.ErrMissingLicense
+}
+
+////////////////////////////////////////////////////
+// PATCH /api/_version_/fleet/vpp_tokens/%d/renew //
+////////////////////////////////////////////////////
+
+type patchVPPTokenRenewRequest struct {
+	ID   uint `url:"id"`
+	File *multipart.FileHeader
+}
+
+func (patchVPPTokenRenewRequest) DecodeRequest(ctx context.Context, r *http.Request) (interface{}, error) {
+	decoded := patchVPPTokenRenewRequest{}
+
+	err := r.ParseMultipartForm(512 * units.MiB)
+	if err != nil {
+		return nil, &fleet.BadRequestError{
+			Message:     "failed to parse multipart form",
+			InternalErr: err,
+		}
+	}
+
+	if r.MultipartForm.File["token"] == nil || len(r.MultipartForm.File["token"]) == 0 {
+		return nil, &fleet.BadRequestError{
+			Message:     "token multipart field is required",
+			InternalErr: err,
+		}
+	}
+
+	decoded.File = r.MultipartForm.File["token"][0]
+
+	return &decoded, nil
+}
+
+type patchVPPTokenRenewResponse struct {
+	Err   error             `json:"error,omitempty"`
+	Token *fleet.VPPTokenDB `json:"token,omitempty"`
+}
+
+func (r patchVPPTokenRenewResponse) Status() int { return http.StatusAccepted }
+
+func (r patchVPPTokenRenewResponse) error() error {
+	return r.Err
+}
+
+func patchVPPTokenRenewEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (errorer, error) {
+	req := request.(*patchVPPTokenRenewRequest)
+	file, err := req.File.Open()
+	if err != nil {
+		return patchVPPTokenRenewResponse{Err: err}, nil
+	}
+	defer file.Close()
+
+	tok, err := svc.UpdateVPPToken(ctx, req.ID, file)
+	if err != nil {
+		return patchVPPTokenRenewResponse{Err: err}, nil
+	}
+
+	return patchVPPTokenRenewResponse{Token: tok}, nil
+}
+
+func (svc *Service) UpdateVPPToken(ctx context.Context, tokenID uint, token io.ReadSeeker) (*fleet.VPPTokenDB, error) {
+	// skipauth: No authorization check needed due to implementation returning
+	// only license error.
+	svc.authz.SkipAuthorization(ctx)
+
+	return nil, fleet.ErrMissingLicense
+}
+
+////////////////////////////////////////////////////
+// PATCH /api/_version_/fleet/vpp_tokens/%d/teams //
+////////////////////////////////////////////////////
+
+type patchVPPTokensTeamsRequest struct {
+	ID      uint   `url:"id"`
+	TeamIDs []uint `json:"teams"`
+}
+
+type patchVPPTokensTeamsResponse struct {
+	Token *fleet.VPPTokenDB `json:"token,omitempty"`
+	Err   error             `json:"error,omitempty"`
+}
+
+func (r patchVPPTokensTeamsResponse) error() error { return r.Err }
+
+func patchVPPTokensTeams(ctx context.Context, request any, svc fleet.Service) (errorer, error) {
+	req := request.(*patchVPPTokensTeamsRequest)
+
+	tok, err := svc.UpdateVPPTokenTeams(ctx, req.ID, req.TeamIDs)
+	if err != nil {
+		return patchVPPTokensTeamsResponse{Err: err}, nil
+	}
+	return patchVPPTokensTeamsResponse{Token: tok}, nil
+}
+
+func (svc *Service) UpdateVPPTokenTeams(ctx context.Context, tokenID uint, teamIDs []uint) (*fleet.VPPTokenDB, error) {
+	// skipauth: No authorization check needed due to implementation returning
+	// only license error.
+	svc.authz.SkipAuthorization(ctx)
+
+	return nil, fleet.ErrMissingLicense
+}
+
+/////////////////////////////////////////
+// GET /api/_version_/fleet/vpp_tokens //
+/////////////////////////////////////////
+
+type getVPPTokensRequest struct{}
+
+type getVPPTokensResponse struct {
+	Tokens []*fleet.VPPTokenDB `json:"vpp_tokens"`
+	Err    error               `json:"error,omitempty"`
+}
+
+func (r getVPPTokensResponse) error() error { return r.Err }
+
+func getVPPTokens(ctx context.Context, request any, svc fleet.Service) (errorer, error) {
+	tokens, err := svc.GetVPPTokens(ctx)
+	if err != nil {
+		return getVPPTokensResponse{Err: err}, nil
+	}
+
+	if tokens == nil {
+		tokens = []*fleet.VPPTokenDB{}
+	}
+
+	return getVPPTokensResponse{Tokens: tokens}, nil
+}
+
+func (svc *Service) GetVPPTokens(ctx context.Context) ([]*fleet.VPPTokenDB, error) {
+	// skipauth: No authorization check needed due to implementation returning
+	// only license error.
+	svc.authz.SkipAuthorization(ctx)
+
+	return nil, fleet.ErrMissingLicense
+}
+
+///////////////////////////////////////////////
+// DELETE /api/_version_/fleet/vpp_tokens/%d //
+///////////////////////////////////////////////
+
+type deleteVPPTokenRequest struct {
+	ID uint `url:"id"`
+}
+
+type deleteVPPTokenResponse struct {
+	Err error `json:"error,omitempty"`
+}
+
+func (r deleteVPPTokenResponse) error() error { return r.Err }
+
+func (r deleteVPPTokenResponse) Status() int { return http.StatusNoContent }
+
+func deleteVPPToken(ctx context.Context, request any, svc fleet.Service) (errorer, error) {
+	req := request.(*deleteVPPTokenRequest)
+
+	err := svc.DeleteVPPToken(ctx, req.ID)
+	if err != nil {
+		return deleteVPPTokenResponse{Err: err}, nil
+	}
+
+	return deleteVPPTokenResponse{}, nil
+}
+
+func (svc *Service) DeleteVPPToken(ctx context.Context, tokenID uint) error {
 	// skipauth: No authorization check needed due to implementation returning
 	// only license error.
 	svc.authz.SkipAuthorization(ctx)
diff --git a/server/service/vpp_test.go b/server/service/vpp_test.go
index 4ad375636e..95b9c65ed0 100644
--- a/server/service/vpp_test.go
+++ b/server/service/vpp_test.go
@@ -5,6 +5,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/fleetdm/fleet/v4/server/authz"
 	"github.com/fleetdm/fleet/v4/server/contexts/viewer"
 	"github.com/fleetdm/fleet/v4/server/fleet"
 	"github.com/fleetdm/fleet/v4/server/mock"
@@ -20,6 +21,18 @@ func TestVPPAuth(t *testing.T) {
 
 	svc, ctx := newTestService(t, ds, nil, nil, &TestServerOpts{License: license})
 
+	// use a custom implementation of checkAuthErr as the service call will fail
+	// with a different error for in case of authorization success and the
+	// package-wide checkAuthErr requires no error.
+	checkAuthErr := func(t *testing.T, shouldFail bool, err error) {
+		if shouldFail {
+			require.Error(t, err)
+			require.Equal(t, (&authz.Forbidden{}).Error(), err.Error())
+		} else if err != nil {
+			require.NotEqual(t, (&authz.Forbidden{}).Error(), err.Error())
+		}
+	}
+
 	testCases := []struct {
 		name            string
 		user            *fleet.User
@@ -63,14 +76,15 @@ func TestVPPAuth(t *testing.T) {
 			ds.TeamExistsFunc = func(ctx context.Context, teamID uint) (bool, error) {
 				return false, nil
 			}
-
 			ds.GetAllMDMConfigAssetsByNameFunc = func(ctx context.Context, assetNames []fleet.MDMAssetName) (map[fleet.MDMAssetName]fleet.MDMConfigAsset, error) {
 				return map[fleet.MDMAssetName]fleet.MDMConfigAsset{}, nil
 			}
-
 			ds.TeamFunc = func(ctx context.Context, tid uint) (*fleet.Team, error) {
 				return &fleet.Team{ID: 1}, nil
 			}
+			ds.GetVPPTokenByTeamIDFunc = func(ctx context.Context, teamID *uint) (*fleet.VPPTokenDB, error) {
+				return &fleet.VPPTokenDB{ID: 1, OrgName: "org", Teams: []fleet.TeamTuple{{ID: 1}}}, nil
+			}
 
 			// Note: these calls always return an error because they're attempting to unmarshal a
 			// non-existent VPP token.
@@ -78,18 +92,14 @@ func TestVPPAuth(t *testing.T) {
 			if tt.teamID == nil {
 				require.Error(t, err)
 			} else {
-				if tt.shouldFailRead {
-					checkAuthErr(t, true, err)
-				}
+				checkAuthErr(t, tt.shouldFailRead, err)
 			}
 
-			err = svc.AddAppStoreApp(ctx, tt.teamID, fleet.VPPAppID{AdamID: "123", Platform: fleet.IOSPlatform})
+			err = svc.AddAppStoreApp(ctx, tt.teamID, fleet.VPPAppTeam{VPPAppID: fleet.VPPAppID{AdamID: "123", Platform: fleet.IOSPlatform}})
 			if tt.teamID == nil {
 				require.Error(t, err)
 			} else {
-				if tt.shouldFailWrite {
-					checkAuthErr(t, true, err)
-				}
+				checkAuthErr(t, tt.shouldFailWrite, err)
 			}
 		})
 	}
diff --git a/server/service/vulnerabilities.go b/server/service/vulnerabilities.go
index 62cfd3dcfe..cf301c77c9 100644
--- a/server/service/vulnerabilities.go
+++ b/server/service/vulnerabilities.go
@@ -3,6 +3,8 @@ package service
 import (
 	"context"
 	"fmt"
+	"net/http"
+	"regexp"
 	"time"
 
 	"github.com/fleetdm/fleet/v4/server/authz"
@@ -17,6 +19,18 @@ var freeValidVulnSortColumns = []string{
 	"created_at",
 }
 
+type cveNotFoundError struct{}
+
+var _ fleet.NotFoundError = (*cveNotFoundError)(nil)
+
+func (p cveNotFoundError) Error() string {
+	return "This is not a known CVE. None of Fleet’s vulnerability sources are aware of this CVE."
+}
+
+func (p cveNotFoundError) IsNotFound() bool {
+	return true
+}
+
 type listVulnerabilitiesRequest struct {
 	fleet.VulnListOptions
 }
@@ -29,6 +43,9 @@ type listVulnerabilitiesResponse struct {
 	Err             error                             `json:"error,omitempty"`
 }
 
+// Allow formats like: CVE-2017-12345, cve-2017-12345
+var cveRegex = regexp.MustCompile(`(?i)^CVE-\d{4}-\d{4}\d*$`)
+
 func (r listVulnerabilitiesResponse) error() error { return r.Err }
 
 func listVulnerabilitiesEndpoint(ctx context.Context, req interface{}, svc fleet.Service) (errorer, error) {
@@ -99,6 +116,10 @@ func (svc *Service) CountVulnerabilities(ctx context.Context, opts fleet.VulnLis
 	return svc.ds.CountVulnerabilities(ctx, opts)
 }
 
+func (svc *Service) IsCVEKnownToFleet(ctx context.Context, cve string) (bool, error) {
+	return svc.ds.IsCVEKnownToFleet(ctx, cve)
+}
+
 type getVulnerabilityRequest struct {
 	CVE    string `url:"cve"`
 	TeamID *uint  `query:"team_id,optional"`
@@ -109,17 +130,29 @@ type getVulnerabilityResponse struct {
 	OSVersions    []*fleet.VulnerableOS            `json:"os_versions"`
 	Software      []*fleet.VulnerableSoftware      `json:"software"`
 	Err           error                            `json:"error,omitempty"`
+	statusCode    int
 }
 
 func (r getVulnerabilityResponse) error() error { return r.Err }
 
+func (r getVulnerabilityResponse) Status() int {
+	if r.statusCode == 0 {
+		return http.StatusOK
+	}
+	return r.statusCode
+}
+
 func getVulnerabilityEndpoint(ctx context.Context, req interface{}, svc fleet.Service) (errorer, error) {
 	request := req.(*getVulnerabilityRequest)
 
-	vuln, err := svc.Vulnerability(ctx, request.CVE, request.TeamID, false)
+	vuln, known, err := svc.Vulnerability(ctx, request.CVE, request.TeamID, false)
 	if err != nil {
 		return getVulnerabilityResponse{Err: err}, nil
 	}
+	if vuln == nil && known {
+		// Return 204 status code if the vulnerability is known to Fleet but does not match any host software/OS
+		return getVulnerabilityResponse{statusCode: http.StatusNoContent}, nil
+	}
 
 	vuln.DetailsLink = fmt.Sprintf("https://nvd.nist.gov/vuln/detail/%s", vuln.CVE.CVE)
 
@@ -140,30 +173,48 @@ func getVulnerabilityEndpoint(ctx context.Context, req interface{}, svc fleet.Se
 	}, nil
 }
 
-func (svc *Service) Vulnerability(ctx context.Context, cve string, teamID *uint, useCVSScores bool) (*fleet.VulnerabilityWithMetadata, error) {
+func (svc *Service) Vulnerability(ctx context.Context, cve string, teamID *uint, useCVSScores bool) (vuln *fleet.VulnerabilityWithMetadata,
+	known bool, err error,
+) {
 	if err := svc.authz.Authorize(ctx, &fleet.AuthzSoftwareInventory{TeamID: teamID}, fleet.ActionRead); err != nil {
-		return nil, err
+		return nil, false, err
 	}
 
 	if err := svc.authz.Authorize(ctx, &fleet.Host{TeamID: teamID}, fleet.ActionRead); err != nil {
-		return nil, err
+		return nil, false, err
+	}
+
+	if !cveRegex.Match([]byte(cve)) {
+		return nil, false, badRequest("That vulnerability (CVE) is not valid. Try updating your search to use CVE format: \"CVE-YYYY-<4 or more digits>\"")
 	}
 
 	if teamID != nil && *teamID != 0 {
 		exists, err := svc.ds.TeamExists(ctx, *teamID)
 		if err != nil {
-			return nil, ctxerr.Wrap(ctx, err, "checking if team exists")
+			return nil, false, ctxerr.Wrap(ctx, err, "checking if team exists")
 		} else if !exists {
-			return nil, authz.ForbiddenWithInternal("team does not exist", nil, nil, nil)
+			return nil, false, authz.ForbiddenWithInternal("team does not exist", nil, nil, nil)
 		}
 	}
 
-	vuln, err := svc.ds.Vulnerability(ctx, cve, teamID, useCVSScores)
-	if err != nil {
-		return nil, err
+	vuln, err = svc.ds.Vulnerability(ctx, cve, teamID, useCVSScores)
+	switch {
+	case fleet.IsNotFound(err):
+		var errKnown error
+		known, errKnown = svc.ds.IsCVEKnownToFleet(ctx, cve)
+		if errKnown != nil {
+			return nil, false, errKnown
+		}
+		if !known {
+			return nil, false, cveNotFoundError{}
+		}
+	case err != nil:
+		return nil, false, err
+	default:
+		known = true
 	}
 
-	return vuln, nil
+	return vuln, known, nil
 }
 
 func (svc *Service) ListOSVersionsByCVE(ctx context.Context, cve string, teamID *uint) (result []*fleet.VulnerableOS, updatedAt time.Time, err error) {
diff --git a/server/service/vulnerabilities_test.go b/server/service/vulnerabilities_test.go
index 48b6303d98..fcef3ede9a 100644
--- a/server/service/vulnerabilities_test.go
+++ b/server/service/vulnerabilities_test.go
@@ -173,10 +173,10 @@ func TestVulnerabilitesAuth(t *testing.T) {
 			})
 			checkAuthErr(t, tc.shouldFailTeamRead, err)
 
-			_, err = svc.Vulnerability(ctx, "CVE-2019-1234", nil, false)
+			_, _, err = svc.Vulnerability(ctx, "CVE-2019-1234", nil, false)
 			checkAuthErr(t, tc.shouldFailGlobalRead, err)
 
-			_, err = svc.Vulnerability(ctx, "CVE-2019-1234", ptr.Uint(1), false)
+			_, _, err = svc.Vulnerability(ctx, "CVE-2019-1234", ptr.Uint(1), false)
 			checkAuthErr(t, tc.shouldFailTeamRead, err)
 		})
 	}
diff --git a/server/shellquote/shellquote.go b/server/shellquote/shellquote.go
new file mode 100644
index 0000000000..8960a427c3
--- /dev/null
+++ b/server/shellquote/shellquote.go
@@ -0,0 +1,156 @@
+// Based on https://github.com/kballard/go-shellquote
+
+package shellquote
+
+import (
+	"bytes"
+	"errors"
+	"strings"
+	"unicode/utf8"
+)
+
+var (
+	UnterminatedSingleQuoteError = errors.New("unterminated single-quoted string")
+	UnterminatedDoubleQuoteError = errors.New("unterminated double-quoted string")
+	UnterminatedEscapeError      = errors.New("unterminated backslash-escape")
+)
+
+var (
+	splitChars        = " \n\t"
+	singleChar        = '\''
+	doubleChar        = '"'
+	escapeChar        = '\\'
+	doubleEscapeChars = "$`\"\n\\"
+)
+
+// Split splits a string according to /bin/sh's word-splitting rules. It
+// supports backslash-escapes, single-quotes, and double-quotes. Notably it does
+// not support the $” style of quoting. It also doesn't attempt to perform any
+// other sort of expansion, including brace expansion, shell expansion, or
+// pathname expansion.
+//
+// If the given input has an unterminated quoted string or ends in a
+// backslash-escape, one of UnterminatedSingleQuoteError,
+// UnterminatedDoubleQuoteError, or UnterminatedEscapeError is returned.
+func Split(input string) (words []string, err error) {
+	var buf bytes.Buffer
+	words = make([]string, 0)
+
+	for len(input) > 0 {
+		// skip any splitChars at the start
+		c, l := utf8.DecodeRuneInString(input)
+		if strings.ContainsRune(splitChars, c) {
+			input = input[l:]
+			continue
+		} else if c == escapeChar {
+			// Look ahead for escaped newline, so we can skip over it
+			next := input[l:]
+			if len(next) == 0 {
+				err = UnterminatedEscapeError
+				return
+			}
+			c2, l2 := utf8.DecodeRuneInString(next)
+			if c2 == '\n' {
+				input = next[l2:]
+				continue
+			}
+		}
+
+		var word string
+		word, input, err = splitWord(input, &buf)
+		if err != nil {
+			return
+		}
+		words = append(words, word)
+	}
+	return
+}
+
+func splitWord(input string, buf *bytes.Buffer) (word string, remainder string, err error) {
+	buf.Reset()
+
+raw:
+	{
+		cur := input
+		for len(cur) > 0 {
+			c, l := utf8.DecodeRuneInString(cur)
+			cur = cur[l:]
+			if c == singleChar {
+				buf.WriteString(input[0 : len(input)-len(cur)-l])
+				input = cur
+				goto single
+			} else if c == doubleChar {
+				buf.WriteString(input[0 : len(input)-len(cur)-l])
+				input = cur
+				goto double
+			} else if c == escapeChar {
+				buf.WriteString(input[0 : len(input)-len(cur)-l])
+				input = cur
+				goto escape
+			} else if strings.ContainsRune(splitChars, c) {
+				buf.WriteString(input[0 : len(input)-len(cur)-l])
+				return buf.String(), cur, nil
+			}
+		}
+		if len(input) > 0 {
+			buf.WriteString(input)
+			input = ""
+		}
+		goto done
+	}
+
+escape:
+	{
+		if len(input) == 0 {
+			return "", "", UnterminatedEscapeError
+		}
+		c, l := utf8.DecodeRuneInString(input)
+		// a backslash-escaped newline is elided from the output entirely
+		if c != '\n' {
+			buf.WriteString(input[:l])
+		}
+		input = input[l:]
+	}
+	goto raw
+
+single:
+	{
+		i := strings.IndexRune(input, singleChar)
+		if i == -1 {
+			return "", "", UnterminatedSingleQuoteError
+		}
+		buf.WriteString(input[0:i])
+		input = input[i+1:]
+		goto raw
+	}
+
+double:
+	{
+		cur := input
+		for len(cur) > 0 {
+			c, l := utf8.DecodeRuneInString(cur)
+			cur = cur[l:]
+			if c == doubleChar {
+				buf.WriteString(input[0 : len(input)-len(cur)-l])
+				input = cur
+				goto raw
+			} else if c == escapeChar {
+				// bash only supports certain escapes in double-quoted strings
+				c2, l2 := utf8.DecodeRuneInString(cur)
+				cur = cur[l2:]
+				if strings.ContainsRune(doubleEscapeChars, c2) {
+					buf.WriteString(input[0 : len(input)-len(cur)-l-l2])
+					// newline is special, skip the backslash entirely
+					if c2 != '\n' {
+						buf.WriteRune(c2)
+					}
+					input = cur
+				}
+			}
+		}
+		return "", "", UnterminatedDoubleQuoteError
+	}
+
+done:
+	return buf.String(), input, nil
+}
diff --git a/server/shellquote/shellquote_test.go b/server/shellquote/shellquote_test.go
new file mode 100644
index 0000000000..0c59a48fd7
--- /dev/null
+++ b/server/shellquote/shellquote_test.go
@@ -0,0 +1,61 @@
+// Based on https://github.com/kballard/go-shellquote
+
+package shellquote
+
+import (
+	"errors"
+	"reflect"
+	"testing"
+)
+
+func TestSimpleSplit(t *testing.T) {
+	t.Parallel()
+	for _, elem := range simpleSplitTest {
+		output, err := Split(elem.input)
+		if err != nil {
+			t.Errorf("Input %q, got error %#v", elem.input, err)
+		} else if !reflect.DeepEqual(output, elem.output) {
+			t.Errorf("Input %q, got %q, expected %q", elem.input, output, elem.output)
+		}
+	}
+}
+
+func TestErrorSplit(t *testing.T) {
+	t.Parallel()
+	for _, elem := range errorSplitTest {
+		_, err := Split(elem.input)
+		if !errors.Is(err, elem.error) {
+			t.Errorf("Input %q, got error %#v, expected error %#v", elem.input, err, elem.error)
+		}
+	}
+}
+
+var simpleSplitTest = []struct {
+	input  string
+	output []string
+}{
+	{"hello", []string{"hello"}},
+	{"hello goodbye", []string{"hello", "goodbye"}},
+	{"hello   goodbye", []string{"hello", "goodbye"}},
+	{"glob* test?", []string{"glob*", "test?"}},
+	{"don\\'t you know the dewey decimal system\\?", []string{"don't", "you", "know", "the", "dewey", "decimal", "system?"}},
+	{"'don'\\''t you know the dewey decimal system?'", []string{"don't you know the dewey decimal system?"}},
+	{"one '' two", []string{"one", "", "two"}},
+	{"text with\\\na backslash-escaped newline", []string{"text", "witha", "backslash-escaped", "newline"}},
+	{"text \"with\na\" quoted newline", []string{"text", "with\na", "quoted", "newline"}},
+	{"\"quoted\\d\\\\\\\" text with\\\na backslash-escaped newline\"", []string{"quoted\\d\\\" text witha backslash-escaped newline"}},
+	{"text with an escaped \\\n newline in the middle", []string{"text", "with", "an", "escaped", "newline", "in", "the", "middle"}},
+	{"foo\"bar\"baz", []string{"foobarbaz"}},
+	{"--foo 6mI74pVBAidu1bALjY0F+wN4mPQyu8DUap/9M/kHp8I=", []string{"--foo", "6mI74pVBAidu1bALjY0F+wN4mPQyu8DUap/9M/kHp8I="}},
+}
+
+var errorSplitTest = []struct {
+	input string
+	error error
+}{
+	{"don't worry", UnterminatedSingleQuoteError},
+	{"'test'\\''ing", UnterminatedSingleQuoteError},
+	{"\"foo'bar", UnterminatedDoubleQuoteError},
+	{"foo\\", UnterminatedEscapeError},
+	{"   \\", UnterminatedEscapeError},
+}
diff --git a/server/test/mdm.go b/server/test/mdm.go
new file mode 100644
index 0000000000..0b5e8a5760
--- /dev/null
+++ b/server/test/mdm.go
@@ -0,0 +1,69 @@
+package test
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/fleetdm/fleet/v4/server/fleet"
+	"github.com/stretchr/testify/require"
+	"github.com/tj/assert"
+)
+
+func CreateVPPTokenData(expiration time.Time, orgName, location string) (*fleet.VPPTokenData, error) {
+	var randBytes [32]byte
+	_, err := rand.Read(randBytes[:])
+	if err != nil {
+		return nil, fmt.Errorf("generating random bytes: %w", err)
+	}
+	token := base64.StdEncoding.EncodeToString(randBytes[:])
+	raw := fleet.VPPTokenRaw{
+		OrgName: orgName,
+		Token:   token,
+		ExpDate: expiration.Format("2006-01-02T15:04:05Z0700"),
+	}
+	rawJson, err := json.Marshal(raw)
+	if err != nil {
+		return nil, fmt.Errorf("marshalling vpp raw token: %w", err)
+	}
+
+	base64Token := base64.StdEncoding.EncodeToString(rawJson)
+	return &fleet.VPPTokenData{Token: base64Token, Location: location}, nil
+}
+
+func CreateInsertGlobalVPPToken(t *testing.T, ds fleet.Datastore) *fleet.VPPTokenDB {
+	ctx := context.Background()
+	dataToken, err := CreateVPPTokenData(time.Now().Add(24*time.Hour), "Donkey Kong", "Jungle")
+	require.NoError(t, err)
+	tok1, err := ds.InsertVPPToken(ctx, dataToken)
+	assert.NoError(t, err)
+	tok1New, err := ds.UpdateVPPTokenTeams(ctx, tok1.ID, []uint{})
+	assert.NoError(t, err)
+
+	return tok1New
+}
+
+func CreateVPPTokenEncoded(expiration time.Time, orgName, location string) ([]byte, error) {
+	dataToken, err := CreateVPPTokenData(expiration, orgName, location)
+	if err != nil {
+		return nil, err
+	}
+	return []byte(dataToken.Token), nil
+}
+
+func CreateVPPTokenEncodedAfterMigration(expiration time.Time, orgName, location string) ([]byte, error) {
+	dataToken, err := CreateVPPTokenData(expiration, orgName, location)
+	if err != nil {
+		return nil, err
+	}
+
+	dataTokenJson, err := json.Marshal(dataToken)
+	if err != nil {
+		return nil, fmt.Errorf("marshalling vpp data token: %w", err)
+	}
+	return dataTokenJson, nil
+}
diff --git a/server/test/new_objects.go b/server/test/new_objects.go
index 099b7a0e57..f8a2de578c 100644
--- a/server/test/new_objects.go
+++ b/server/test/new_objects.go
@@ -210,6 +210,12 @@ func WithPlatform(s string) NewHostOption {
 	}
 }
 
+func WithTeamID(teamID uint) NewHostOption {
+	return func(h *fleet.Host) {
+		h.TeamID = &teamID
+	}
+}
+
 func NewHost(tb testing.TB, ds fleet.Datastore, name, ip, key, uuid string, now time.Time, options ...NewHostOption) *fleet.Host {
 	osqueryHostID, _ := server.GenerateRandomText(10)
 	h := &fleet.Host{
diff --git a/server/vulnerabilities/customcve/matching_rules.go b/server/vulnerabilities/customcve/matching_rules.go
index d4bc2d255c..88a0dc7bbd 100644
--- a/server/vulnerabilities/customcve/matching_rules.go
+++ b/server/vulnerabilities/customcve/matching_rules.go
@@ -43,6 +43,30 @@ func getCVEMatchingRules() CVEMatchingRules {
 			CVEs:              []string{"CVE-2024-30101", "CVE-2024-30102", "CVE-2024-30103", "CVE-2024-30104"},
 			ResolvedInVersion: "16.0.17628.20144",
 		},
+		// July 9 2024 Office 365 Vulnerabilities
+		// https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates
+		{
+			NameLikeMatch:     "Microsoft 365",
+			SourceMatch:       "programs",
+			CVEs:              []string{"CVE-2023-38545", "CVE-2024-38020", "CVE-2024-38021"},
+			ResolvedInVersion: "16.0.17726.20160",
+		},
+		// August 13 2024 Office 365 Vulnerabilities
+		// https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates
+		{
+			NameLikeMatch: "Microsoft 365",
+			SourceMatch:   "programs",
+			CVEs: []string{
+				"CVE-2024-38172",
+				"CVE-2024-38170",
+				"CVE-2024-38173",
+				"CVE-2024-38171",
+				"CVE-2024-38189",
+				"CVE-2024-38169",
+				"CVE-2024-38200",
+			},
+			ResolvedInVersion: "16.0.17830.20166",
+		},
 	}
 }
 
diff --git a/server/vulnerabilities/customcve/matching_rules_test.go b/server/vulnerabilities/customcve/matching_rules_test.go
index ee8eec9dc8..042ba68ef0 100644
--- a/server/vulnerabilities/customcve/matching_rules_test.go
+++ b/server/vulnerabilities/customcve/matching_rules_test.go
@@ -2,6 +2,7 @@ package customcve
 
 import (
 	"context"
+	"sort"
 	"testing"
 	"time"
 
@@ -193,22 +194,32 @@ func TestValidateAll(t *testing.T) {
 func TestCheckCustomVulnerabilities(t *testing.T) {
 	ds := new(mock.Store)
 	sw := []fleet.Software{
+		// Very old version should match all custom matching rules.
 		{
 			ID:      1,
 			Name:    "Microsoft 365 - en-us",
 			Version: "16.0.17531.20152",
 			Source:  "programs",
 		},
+		// This version should match June matching rules but not July and August.
 		{
 			ID:      2,
 			Name:    "Microsoft 365 - en-us",
-			Version: "16.0.17425.20176",
+			Version: "16.0.17628.20144",
 			Source:  "programs",
 		},
+		// This version should match June and July, but not August.
 		{
 			ID:      3,
 			Name:    "Microsoft 365 - en-us",
-			Version: "16.0.17628.20144",
+			Version: "16.0.17726.20161",
+			Source:  "programs",
+		},
+		// This version should have no CVEs.
+		{
+			ID:      4,
+			Name:    "Microsoft 365 - en-us",
+			Version: "16.0.17830.20167",
 			Source:  "programs",
 		},
 	}
@@ -233,8 +244,8 @@ func TestCheckCustomVulnerabilities(t *testing.T) {
 		ctx := context.Background()
 		vulns, err := CheckCustomVulnerabilities(ctx, ds, log.NewNopLogger(), 1*time.Hour)
 		require.NoError(t, err)
-		require.Equal(t, 8, insertCount)
-		require.Len(t, vulns, 8)
+		require.Equal(t, 31, insertCount)
+		require.Len(t, vulns, 31)
 		require.True(t, ds.DeleteOutOfDateVulnerabilitiesFuncInvoked)
 
 		expected := []fleet.SoftwareVulnerability{
@@ -259,27 +270,155 @@ func TestCheckCustomVulnerabilities(t *testing.T) {
 				ResolvedInVersion: ptr.String("16.0.17628.20144"),
 			},
 			{
-				SoftwareID:        2,
-				CVE:               "CVE-2024-30101",
-				ResolvedInVersion: ptr.String("16.0.17628.20144"),
+				SoftwareID:        1,
+				CVE:               "CVE-2023-38545",
+				ResolvedInVersion: ptr.String("16.0.17726.20160"),
+			},
+			{
+				SoftwareID:        1,
+				CVE:               "CVE-2024-38020",
+				ResolvedInVersion: ptr.String("16.0.17726.20160"),
+			},
+			{
+				SoftwareID:        1,
+				CVE:               "CVE-2024-38021",
+				ResolvedInVersion: ptr.String("16.0.17726.20160"),
+			},
+			{
+				SoftwareID:        1,
+				CVE:               "CVE-2024-38172",
+				ResolvedInVersion: ptr.String("16.0.17830.20166"),
+			},
+			{
+				SoftwareID:        1,
+				CVE:               "CVE-2024-38170",
+				ResolvedInVersion: ptr.String("16.0.17830.20166"),
+			},
+			{
+				SoftwareID:        1,
+				CVE:               "CVE-2024-38173",
+				ResolvedInVersion: ptr.String("16.0.17830.20166"),
+			},
+			{
+				SoftwareID:        1,
+				CVE:               "CVE-2024-38171",
+				ResolvedInVersion: ptr.String("16.0.17830.20166"),
+			},
+			{
+				SoftwareID:        1,
+				CVE:               "CVE-2024-38189",
+				ResolvedInVersion: ptr.String("16.0.17830.20166"),
+			},
+			{
+				SoftwareID:        1,
+				CVE:               "CVE-2024-38169",
+				ResolvedInVersion: ptr.String("16.0.17830.20166"),
+			},
+			{
+				SoftwareID:        1,
+				CVE:               "CVE-2024-38200",
+				ResolvedInVersion: ptr.String("16.0.17830.20166"),
 			},
 			{
 				SoftwareID:        2,
-				CVE:               "CVE-2024-30102",
-				ResolvedInVersion: ptr.String("16.0.17628.20144"),
+				CVE:               "CVE-2023-38545",
+				ResolvedInVersion: ptr.String("16.0.17726.20160"),
 			},
 			{
 				SoftwareID:        2,
-				CVE:               "CVE-2024-30103",
-				ResolvedInVersion: ptr.String("16.0.17628.20144"),
+				CVE:               "CVE-2024-38020",
+				ResolvedInVersion: ptr.String("16.0.17726.20160"),
 			},
 			{
 				SoftwareID:        2,
-				CVE:               "CVE-2024-30104",
-				ResolvedInVersion: ptr.String("16.0.17628.20144"),
+				CVE:               "CVE-2024-38021",
+				ResolvedInVersion: ptr.String("16.0.17726.20160"),
+			},
+			{
+				SoftwareID:        2,
+				CVE:               "CVE-2024-38172",
+				ResolvedInVersion: ptr.String("16.0.17830.20166"),
+			},
+			{
+				SoftwareID:        2,
+				CVE:               "CVE-2024-38170",
+				ResolvedInVersion: ptr.String("16.0.17830.20166"),
+			},
+			{
+				SoftwareID:        2,
+				CVE:               "CVE-2024-38173",
+				ResolvedInVersion: ptr.String("16.0.17830.20166"),
+			},
+			{
+				SoftwareID:        2,
+				CVE:               "CVE-2024-38171",
+				ResolvedInVersion: ptr.String("16.0.17830.20166"),
+			},
+			{
+				SoftwareID:        2,
+				CVE:               "CVE-2024-38189",
+				ResolvedInVersion: ptr.String("16.0.17830.20166"),
+			},
+			{
+				SoftwareID:        2,
+				CVE:               "CVE-2024-38169",
+				ResolvedInVersion: ptr.String("16.0.17830.20166"),
+			},
+			{
+				SoftwareID:        2,
+				CVE:               "CVE-2024-38200",
+				ResolvedInVersion: ptr.String("16.0.17830.20166"),
+			},
+			{
+				SoftwareID:        3,
+				CVE:               "CVE-2024-38172",
+				ResolvedInVersion: ptr.String("16.0.17830.20166"),
+			},
+			{
+				SoftwareID:        3,
+				CVE:               "CVE-2024-38170",
+				ResolvedInVersion: ptr.String("16.0.17830.20166"),
+			},
+			{
+				SoftwareID:        3,
+				CVE:               "CVE-2024-38173",
+				ResolvedInVersion: ptr.String("16.0.17830.20166"),
+			},
+			{
+				SoftwareID:        3,
+				CVE:               "CVE-2024-38171",
+				ResolvedInVersion: ptr.String("16.0.17830.20166"),
+			},
+			{
+				SoftwareID:        3,
+				CVE:               "CVE-2024-38189",
+				ResolvedInVersion: ptr.String("16.0.17830.20166"),
+			},
+			{
+				SoftwareID:        3,
+				CVE:               "CVE-2024-38169",
+				ResolvedInVersion: ptr.String("16.0.17830.20166"),
+			},
+			{
+				SoftwareID:        3,
+				CVE:               "CVE-2024-38200",
+				ResolvedInVersion: ptr.String("16.0.17830.20166"),
 			},
 		}
 
+		cmpSoftwareVulnerability := func(v []fleet.SoftwareVulnerability) func(i, j int) bool {
+			return func(i, j int) bool {
+				if v[i].SoftwareID <= v[j].SoftwareID {
+					if v[i].SoftwareID == v[j].SoftwareID {
+						return v[i].CVE < v[j].CVE
+					}
+					return true
+				}
+				return false
+			}
+		}
+		sort.Slice(expected, cmpSoftwareVulnerability(expected))
+		sort.Slice(vulns, cmpSoftwareVulnerability(vulns))
 		require.Equal(t, expected, vulns)
 	})
 
@@ -306,7 +445,7 @@ func TestCheckCustomVulnerabilities(t *testing.T) {
 		vulns, err := CheckCustomVulnerabilities(ctx, ds, log.NewNopLogger(), 1*time.Hour)
 		require.NoError(t, err)
 		require.True(t, ds.DeleteOutOfDateVulnerabilitiesFuncInvoked)
-		require.Equal(t, 8, insertCount)
+		require.Equal(t, 31, insertCount)
 		require.Len(t, vulns, 0)
 	})
 }
diff --git a/server/vulnerabilities/goval_dictionary/analyzer.go b/server/vulnerabilities/goval_dictionary/analyzer.go
new file mode 100644
index 0000000000..d4b6414e53
--- /dev/null
+++ b/server/vulnerabilities/goval_dictionary/analyzer.go
@@ -0,0 +1,139 @@
+package goval_dictionary
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"fmt"
+	"github.com/fleetdm/fleet/v4/server/fleet"
+	"github.com/fleetdm/fleet/v4/server/vulnerabilities/oval"
+	"github.com/fleetdm/fleet/v4/server/vulnerabilities/utils"
+	kitlog "github.com/go-kit/log"
+)
+
+const (
+	hostsBatchSize = 500
+	vulnBatchSize  = 500
+)
+
+var ErrUnsupportedPlatform = errors.New("unsupported platform")
+
+// Analyze scans all hosts for vulnerabilities based on the sqlite output of goval-dictionary
+// for their platform,  inserting any new vulnerabilities and deleting anything patched.
+// Returns nil, nil when the platform isn't supported.
+func Analyze(
+	ctx context.Context,
+	ds fleet.Datastore,
+	ver fleet.OSVersion,
+	vulnPath string,
+	collectVulns bool,
+	logger kitlog.Logger,
+) ([]fleet.SoftwareVulnerability, error) {
+	platform := oval.NewPlatform(ver.Platform, ver.Name)
+	source := fleet.GovalDictionarySource
+	if !platform.IsGovalDictionarySupported() {
+		return nil, ErrUnsupportedPlatform
+	}
+	db, err := loadDb(platform, vulnPath)
+	if err != nil {
+		return nil, err
+	}
+
+	// Since hosts and software have a M:N relationship, the following sets are used to
+	// avoid doing duplicated inserts/delete operations (a vulnerable software might be
+	// present in many hosts).
+	toInsertSet := make(map[string]fleet.SoftwareVulnerability)
+	toDeleteSet := make(map[string]fleet.SoftwareVulnerability)
+
+	var offset int
+	for {
+		hostIDs, err := ds.HostIDsByOSVersion(ctx, ver, offset, hostsBatchSize)
+		if err != nil {
+			return nil, err
+		}
+
+		if len(hostIDs) == 0 {
+			break
+		}
+		offset += hostsBatchSize
+
+		foundInBatch := make(map[uint][]fleet.SoftwareVulnerability)
+		for _, hostID := range hostIDs {
+			hostID := hostID
+			software, err := ds.ListSoftwareForVulnDetection(ctx, fleet.VulnSoftwareFilter{HostID: &hostID})
+			if err != nil {
+				return nil, err
+			}
+
+			vulnerabilities := db.Eval(software, logger)
+			foundInBatch[hostID] = vulnerabilities
+		}
+
+		existingInBatch, err := ds.ListSoftwareVulnerabilitiesByHostIDsSource(ctx, hostIDs, source)
+		if err != nil {
+			return nil, err
+		}
+
+		for _, hostID := range hostIDs {
+			inserts, deletes := utils.VulnsDelta(foundInBatch[hostID], existingInBatch[hostID])
+			for _, i := range inserts {
+				toInsertSet[i.Key()] = i
+			}
+			for _, d := range deletes {
+				toDeleteSet[d.Key()] = d
+			}
+		}
+	}
+
+	err = utils.BatchProcess(toDeleteSet, func(v []fleet.SoftwareVulnerability) error {
+		return ds.DeleteSoftwareVulnerabilities(ctx, v)
+	}, vulnBatchSize)
+	if err != nil {
+		return nil, err
+	}
+
+	var inserted []fleet.SoftwareVulnerability
+	if collectVulns {
+		inserted = make([]fleet.SoftwareVulnerability, 0, len(toInsertSet))
+	}
+
+	err = utils.BatchProcess(toInsertSet, func(vulns []fleet.SoftwareVulnerability) error {
+		for _, v := range vulns {
+			ok, err := ds.InsertSoftwareVulnerability(ctx, v, source)
+			if err != nil {
+				return err
+			}
+
+			if collectVulns && ok {
+				inserted = append(inserted, v)
+			}
+		}
+		return nil
+	}, vulnBatchSize)
+	if err != nil {
+		return nil, err
+	}
+
+	return inserted, nil
+}
+
+// loadDb returns the latest goval_dictionary database for the given platform.
+func loadDb(platform oval.Platform, vulnPath string) (*Database, error) {
+	if !platform.IsGovalDictionarySupported() {
+		return nil, fmt.Errorf("platform %q not supported", platform)
+	}
+
+	fileName := platform.ToGovalDictionaryFilename()
+	latest, err := utils.LatestFile(fileName, vulnPath)
+	if err != nil {
+		return nil, err
+	}
+
+	sqlite, err := sql.Open("sqlite3", latest)
+	if err != nil {
+		return nil, err
+	}
+
+	db := NewDB(sqlite, platform)
+	return db, nil
+}
diff --git a/server/vulnerabilities/goval_dictionary/database.go b/server/vulnerabilities/goval_dictionary/database.go
new file mode 100644
index 0000000000..1cb8e46ef6
--- /dev/null
+++ b/server/vulnerabilities/goval_dictionary/database.go
@@ -0,0 +1,87 @@
+package goval_dictionary
+
+import (
+	"database/sql"
+	"fmt"
+	"github.com/fleetdm/fleet/v4/server/fleet"
+	"github.com/fleetdm/fleet/v4/server/vulnerabilities/oval"
+	"github.com/fleetdm/fleet/v4/server/vulnerabilities/utils"
+	kitlog "github.com/go-kit/log"
+	"github.com/go-kit/log/level"
+	"strings"
+)
+
+func NewDB(db *sql.DB, platform oval.Platform) *Database {
+	return &Database{sqlite: db, platform: platform}
+}
+
+type Database struct {
+	sqlite   *sql.DB
+	platform oval.Platform
+}
+
+// Eval evaluates the current goval_dictionary database against an OS version and a list of installed software,
+// returns all software vulnerabilities found. Logs on any errors so we return as many vulnerabilities as we can.
+func (db Database) Eval(software []fleet.Software, logger kitlog.Logger) []fleet.SoftwareVulnerability {
+	searchStmt := `SELECT packages.version, cves.cve_id 
+		FROM packages join definitions on definitions.id = packages.definition_id
+		JOIN advisories ON advisories.definition_id = definitions.id JOIN cves ON cves.advisory_id = advisories.id
+		WHERE packages.name = ? AND packages.arch = ? ORDER BY cve_id, version`
+	vulnerabilities := make([]fleet.SoftwareVulnerability, 0)
+
+	for _, swItem := range software {
+		err := func() error {
+			affectedSoftwareRows, err := db.sqlite.Query(searchStmt, swItem.Name, swItem.Arch)
+			if err != nil {
+				return fmt.Errorf("could not query database: %w", err)
+			}
+			defer affectedSoftwareRows.Close()
+			for affectedSoftwareRows.Next() {
+				var fixedVersionWithEpochPrefix, cve string
+				if err := affectedSoftwareRows.Scan(&fixedVersionWithEpochPrefix, &cve); err != nil {
+					level.Error(logger).Log(
+						"msg", "could not read package vulnerability result",
+						"package", swItem.Name,
+						"arch", swItem.Arch,
+						"platform", db.platform,
+						"err", err,
+					)
+					continue
+				}
+
+				var currentVersion string
+				if swItem.Release != "" {
+					currentVersion = fmt.Sprintf("%s-%s", swItem.Version, swItem.Release)
+				} else {
+					currentVersion = swItem.Version
+				}
+				fixedVersion := strings.Split(fixedVersionWithEpochPrefix, ":")[1]
+
+				if utils.Rpmvercmp(currentVersion, fixedVersion) < 0 {
+					vulnerabilities = append(vulnerabilities, fleet.SoftwareVulnerability{
+						SoftwareID:        swItem.ID,
+						CVE:               cve,
+						ResolvedInVersion: &fixedVersion,
+					})
+				}
+			}
+
+			if affectedSoftwareRows.Err() != nil {
+				return affectedSoftwareRows.Err()
+			}
+
+			return nil
+		}()
+		if err != nil {
+			level.Error(logger).Log(
+				"msg", "could not read package vulnerabilities",
+				"package", swItem.Name,
+				"arch", swItem.Arch,
+				"platform", db.platform,
+				"err", err,
+			)
+		}
+	}
+
+	return vulnerabilities
+}
diff --git a/server/vulnerabilities/goval_dictionary/database_test.go b/server/vulnerabilities/goval_dictionary/database_test.go
new file mode 100644
index 0000000000..ed00326cbb
--- /dev/null
+++ b/server/vulnerabilities/goval_dictionary/database_test.go
@@ -0,0 +1,93 @@
+package goval_dictionary
+
+import (
+	"database/sql"
+	"github.com/fleetdm/fleet/v4/server/fleet"
+	"github.com/fleetdm/fleet/v4/server/vulnerabilities/oval"
+	kitlog "github.com/go-kit/log"
+	"github.com/stretchr/testify/require"
+	"testing"
+)
+
+func TestDatabase(t *testing.T) {
+	// build minimal slice of goval-dictionary sqlite schema
+	sqlite, err := sql.Open("sqlite3", ":memory:")
+	if err != nil {
+		t.Fatal(err)
+	}
+	dbSetupQueries := []string{
+		// create schema
+		"CREATE TABLE packages (name TEXT NOT NULL, arch TEXT NOT NULL, version TEXT NOT NULL, definition_id INTEGER NOT NULL)",
+		"CREATE TABLE definitions (id INTEGER NOT NULL PRIMARY KEY)",
+		"CREATE TABLE advisories (id INTEGER NOT NULL PRIMARY KEY, definition_id INTEGER NOT NULL)",
+		"CREATE TABLE cves (cve_id TEXT NOT NULL, advisory_id INTEGER NOT NULL)",
+		// insert records
+		`INSERT INTO packages (name, arch, version, definition_id) VALUES
+		  ('expat', 'aarch64', '0:2.1.0-15.amzn2.0.3', 1), ('krb5-server', 'aarch64', '0:1.15.1-55.amzn2.2.8', 2)`,
+		"INSERT INTO definitions (id) VALUES (1), (2)",
+		"INSERT INTO advisories (id, definition_id) VALUES (1, 1), (2, 2)",
+		`INSERT INTO cves (cve_id, advisory_id) VALUES
+		   ('CVE-2022-23990', 1), ('CVE-2022-25313', 1), ('CVE-2024-37370', 2), ('CVE-2024-37371', 2)`,
+	}
+	for _, query := range dbSetupQueries {
+		if _, err := sqlite.Exec(query); err != nil {
+			t.Fatal(err)
+		}
+	}
+	db := NewDB(sqlite, oval.NewPlatform("amzn", "Amazon Linux 2.0.0"))
+	logger := kitlog.NewNopLogger()
+
+	t.Run("Non-matching architecture", func(t *testing.T) {
+		require.Len(t, db.Eval([]fleet.Software{{Name: "expat", Version: "2.1.0", Release: "", Arch: "x86_64"}}, logger), 0)
+	})
+
+	t.Run("Non-matching package name", func(t *testing.T) {
+		require.Len(t, db.Eval([]fleet.Software{{Name: "expath", Version: "2.1.0", Release: "", Arch: "aarch64"}}, logger), 0)
+	})
+
+	t.Run("Fixed version", func(t *testing.T) {
+		require.Len(t, db.Eval([]fleet.Software{{Name: "expath", Version: "2.1.0", Release: "15.amzn2.0.3", Arch: "aarch64"}}, logger), 0)
+	})
+
+	t.Run("Newer than fixed version", func(t *testing.T) {
+		require.Len(t, db.Eval([]fleet.Software{{Name: "expath", Version: "2.1.0", Release: "15.amzn2.0.5", Arch: "aarch64"}}, logger), 0)
+	})
+
+	t.Run("Older than fixed version", func(t *testing.T) {
+		vulns := db.Eval([]fleet.Software{{Name: "expat", Version: "2.1.0", Release: "", Arch: "aarch64", ID: 123}}, logger)
+		require.Len(t, vulns, 2)
+		require.Equal(t, "2.1.0-15.amzn2.0.3", *vulns[0].ResolvedInVersion)
+		require.Equal(t, "2.1.0-15.amzn2.0.3", *vulns[1].ResolvedInVersion)
+		require.Equal(t, "CVE-2022-23990", vulns[0].CVE)
+		require.Equal(t, "CVE-2022-25313", vulns[1].CVE)
+		require.Equal(t, uint(123), vulns[0].SoftwareID)
+		require.Equal(t, uint(123), vulns[1].SoftwareID)
+	})
+
+	t.Run("Multiple packages, fixed version", func(t *testing.T) {
+		require.Len(t, db.Eval([]fleet.Software{
+			{Name: "expat", Version: "2.1.0", Release: "15.amzn2.1.0", Arch: "aarch64"},
+			{Name: "krb5-server", Version: "1.15.1", Release: "55.amzn2.2.8", Arch: "aarch64"},
+		}, logger), 0)
+	})
+
+	t.Run("Multiple packages, multiple vulnerabilities", func(t *testing.T) {
+		vulns := db.Eval([]fleet.Software{
+			{Name: "expat", Version: "2.1.0", Release: "15.amzn2.0.2", Arch: "aarch64", ID: 234},
+			{Name: "krb5-server", Version: "1.15.1", Release: "55.amzn2.2.7", Arch: "aarch64", ID: 235},
+		}, logger)
+		require.Len(t, vulns, 4)
+
+		require.Equal(t, "2.1.0-15.amzn2.0.3", *vulns[0].ResolvedInVersion)
+		require.Equal(t, "2.1.0-15.amzn2.0.3", *vulns[1].ResolvedInVersion)
+		require.Equal(t, "1.15.1-55.amzn2.2.8", *vulns[2].ResolvedInVersion)
+		require.Equal(t, "CVE-2022-23990", vulns[0].CVE)
+		require.Equal(t, "CVE-2022-25313", vulns[1].CVE)
+		require.Equal(t, "CVE-2024-37370", vulns[2].CVE)
+		require.Equal(t, "CVE-2024-37371", vulns[3].CVE)
+		require.Equal(t, uint(234), vulns[0].SoftwareID)
+		require.Equal(t, uint(234), vulns[1].SoftwareID)
+		require.Equal(t, uint(235), vulns[2].SoftwareID)
+		require.Equal(t, uint(235), vulns[3].SoftwareID)
+	})
+}
diff --git a/server/vulnerabilities/goval_dictionary/sync.go b/server/vulnerabilities/goval_dictionary/sync.go
new file mode 100644
index 0000000000..e89fab5120
--- /dev/null
+++ b/server/vulnerabilities/goval_dictionary/sync.go
@@ -0,0 +1,89 @@
+package goval_dictionary
+
+import (
+	"fmt"
+	"github.com/fleetdm/fleet/v4/pkg/download"
+	"github.com/fleetdm/fleet/v4/pkg/fleethttp"
+	"github.com/fleetdm/fleet/v4/server/fleet"
+	"github.com/fleetdm/fleet/v4/server/vulnerabilities/nvd"
+	"github.com/fleetdm/fleet/v4/server/vulnerabilities/oval"
+	kitlog "github.com/go-kit/log"
+	"github.com/go-kit/log/level"
+	"net/http"
+	"net/url"
+	"path/filepath"
+)
+
+func Refresh(
+	versions *fleet.OSVersions,
+	vulnPath string,
+	logger kitlog.Logger,
+) ([]oval.Platform, error) {
+	toDownload := whatToDownload(versions)
+	if len(toDownload) > 0 {
+		level.Debug(logger).Log("msg", "goval_dictionary-sync-downloading")
+		err := Sync(vulnPath, toDownload)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	return toDownload, nil
+}
+
+func Sync(dstDir string, platforms []oval.Platform) error {
+	client := fleethttp.NewClient()
+	dwn := downloadDecompressed(client)
+	basePath, err := nvd.GetGitHubCVEAssetPath()
+	if err != nil {
+		return err
+	}
+
+	for _, platform := range platforms {
+		if err := downloadDatabase(platform, dwn, basePath, dstDir); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func downloadDatabase(
+	platform oval.Platform,
+	downloader func(string, string) error,
+	basePath string,
+	vulnDir string,
+) error {
+	dstPath := filepath.Join(vulnDir, platform.ToGovalDictionaryFilename())
+	if err := downloader(basePath+string(platform)+".sqlite3.xz", dstPath); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func downloadDecompressed(client *http.Client) func(string, string) error {
+	return func(u, dstPath string) error {
+		parsedUrl, err := url.Parse(u)
+		if err != nil {
+			return fmt.Errorf("url parse: %w", err)
+		}
+
+		if err = download.DownloadAndExtract(client, parsedUrl, dstPath); err != nil {
+			return fmt.Errorf("download and extract url %s: %w", parsedUrl, err)
+		}
+
+		return nil
+	}
+}
+
+func whatToDownload(osVers *fleet.OSVersions) []oval.Platform {
+	var r []oval.Platform
+	for _, os := range osVers.OSVersions {
+		platform := oval.NewPlatform(os.Platform, os.Name)
+		if platform.IsGovalDictionarySupported() {
+			r = append(r, platform)
+		}
+	}
+
+	return r
+}
diff --git a/server/vulnerabilities/goval_dictionary/sync_test.go b/server/vulnerabilities/goval_dictionary/sync_test.go
new file mode 100644
index 0000000000..cec05521c3
--- /dev/null
+++ b/server/vulnerabilities/goval_dictionary/sync_test.go
@@ -0,0 +1,34 @@
+package goval_dictionary
+
+import (
+	"github.com/fleetdm/fleet/v4/server/fleet"
+	"github.com/fleetdm/fleet/v4/server/vulnerabilities/oval"
+	"github.com/stretchr/testify/require"
+	"testing"
+	"time"
+)
+
+func TestSync(t *testing.T) {
+	t.Run("#whatToDownload", func(t *testing.T) {
+		osVersions := fleet.OSVersions{
+			CountsUpdatedAt: time.Now(),
+			OSVersions: []fleet.OSVersion{
+				{
+					HostsCount: 1,
+					Platform:   "ubuntu",
+					Name:       "Ubuntu 20.4.0",
+				},
+				{
+					HostsCount: 1,
+					Platform:   "amzn",
+					Name:       "Amazon Linux 2.0.0",
+				},
+			},
+		}
+
+		result := whatToDownload(&osVersions)
+		require.Len(t, result, 1)
+		require.Contains(t, result, oval.NewPlatform("amzn", "Amazon Linux 2.0.0"))
+		require.NotContains(t, result, oval.NewPlatform("ubuntu", "Ubuntu 20.4.0"))
+	})
+}
diff --git a/server/vulnerabilities/io/github_test.go b/server/vulnerabilities/io/github_test.go
index 9b627c4ebb..5735daa9dc 100644
--- a/server/vulnerabilities/io/github_test.go
+++ b/server/vulnerabilities/io/github_test.go
@@ -168,7 +168,8 @@ func (m mockGHReleaseLister) ListReleases(
 	return releases, res, nil
 }
 
-func TestGithubClient(t *testing.T) {
+func TestIntegrationsGithubClient(t *testing.T) {
+	t.Parallel()
 	ctx := context.Background()
 
 	t.Run("MacOfficeReleaseNotes", func(t *testing.T) {
diff --git a/server/vulnerabilities/macoffice/integration_analyzer_test.go b/server/vulnerabilities/macoffice/integration_analyzer_test.go
index b36592f656..3808605dd9 100644
--- a/server/vulnerabilities/macoffice/integration_analyzer_test.go
+++ b/server/vulnerabilities/macoffice/integration_analyzer_test.go
@@ -12,7 +12,7 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-func TestIntegrationAnalyzer(t *testing.T) {
+func TestIntegrationsAnalyzer(t *testing.T) {
 	ds := mysql.CreateMySQLDS(t)
 	vulnPath := t.TempDir()
 	releaseNotes := macoffice.ReleaseNotes{
diff --git a/server/vulnerabilities/macoffice/integration_parser_test.go b/server/vulnerabilities/macoffice/integration_parser_test.go
index 9aa92c8ee4..d8f218d326 100644
--- a/server/vulnerabilities/macoffice/integration_parser_test.go
+++ b/server/vulnerabilities/macoffice/integration_parser_test.go
@@ -653,7 +653,7 @@ var expected = []macoffice.ReleaseNote{
 	},
 }
 
-func TestIntegrationParseReleaseHTML(t *testing.T) {
+func TestIntegrationsParseReleaseHTML(t *testing.T) {
 	nettest.Run(t)
 
 	res, err := http.Get(macoffice.RelNotesURL)
diff --git a/server/vulnerabilities/macoffice/integration_sync_test.go b/server/vulnerabilities/macoffice/integration_sync_test.go
index 3fd55c80e5..1dc6dbfec0 100644
--- a/server/vulnerabilities/macoffice/integration_sync_test.go
+++ b/server/vulnerabilities/macoffice/integration_sync_test.go
@@ -11,7 +11,7 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-func TestIntegrationSync(t *testing.T) {
+func TestIntegrationsSync(t *testing.T) {
 	nettest.Run(t)
 
 	vulnPath := t.TempDir()
diff --git a/server/vulnerabilities/nvd/cpe.go b/server/vulnerabilities/nvd/cpe.go
index 9d20820d08..d1d9f1944a 100644
--- a/server/vulnerabilities/nvd/cpe.go
+++ b/server/vulnerabilities/nvd/cpe.go
@@ -9,6 +9,7 @@ import (
 	"os"
 	"path/filepath"
 	"regexp"
+	"slices"
 	"strings"
 	"time"
 	"unicode"
@@ -439,11 +440,12 @@ func TranslateSoftwareToCPE(
 	vulnPath string,
 	logger kitlog.Logger,
 ) error {
-	// Skip software from sources for which we will be using OVAL for vulnerability detection.
+	// Skip software from sources for which we will be using OVAL or goval-dictionary for vulnerability detection.
 	nonOvalIterator, err := ds.AllSoftwareIterator(
 		ctx,
 		fleet.SoftwareIterQueryOptions{
-			ExcludedSources: oval.SupportedSoftwareSources,
+			// Also exclude iOS and iPadOS apps until we enable vulnerabilities support for them.
+			ExcludedSources: append(oval.SupportedSoftwareSources, "ios_apps", "ipados_apps"),
 		},
 	)
 	if err != nil {
@@ -566,9 +568,14 @@ func translateSoftwareToCPEWithIterator(
 	return nil
 }
 
+var allowedNonASCII = []int32{
+	'–', // en dash
+	'—', // em dash
+}
+
 func containsNonASCII(s string) bool {
 	for _, char := range s {
-		if char > unicode.MaxASCII {
+		if char > unicode.MaxASCII && !slices.Contains(allowedNonASCII, char) {
 			return true
 		}
 	}
diff --git a/server/vulnerabilities/nvd/cpe_matching_rules.go b/server/vulnerabilities/nvd/cpe_matching_rules.go
index d7f0e60deb..48821344d0 100644
--- a/server/vulnerabilities/nvd/cpe_matching_rules.go
+++ b/server/vulnerabilities/nvd/cpe_matching_rules.go
@@ -240,6 +240,15 @@ func GetKnownNVDBugRules() (CPEMatchingRules, error) {
 			},
 			IgnoreAll: true,
 		},
+		// CVE-2024-4030 only targets windows operating systems
+		CPEMatchingRule{
+			CVEs: map[string]struct{}{
+				"CVE-2024-4030": {},
+			},
+			IgnoreIf: func(cpeMeta *wfn.Attributes) bool {
+				return cpeMeta.TargetSW != "windows"
+			},
+		},
 	}
 
 	for i, rule := range rules {
diff --git a/server/vulnerabilities/nvd/cpe_test.go b/server/vulnerabilities/nvd/cpe_test.go
index dc2f598fa8..386234d8ac 100644
--- a/server/vulnerabilities/nvd/cpe_test.go
+++ b/server/vulnerabilities/nvd/cpe_test.go
@@ -676,7 +676,7 @@ func TestCPEFromSoftwareIntegration(t *testing.T) {
 		},
 		{
 			software: fleet.Software{
-				Name:             "1Password - Password Manager",
+				Name:             "1Password – Password Manager",
 				Source:           "chrome_extensions",
 				Version:          "2.3.8",
 				Vendor:           "",
@@ -762,7 +762,7 @@ func TestCPEFromSoftwareIntegration(t *testing.T) {
 				Version:          "18.9.0",
 				Vendor:           "",
 				BundleIdentifier: "",
-			}, cpe: "cpe:2.3:a:nodejs:node.js:18.9.0:*:*:*:*:*:*:*",
+			}, cpe: "cpe:2.3:a:nodejs:node.js:18.9.0:*:*:*:*:macos:*:*",
 		},
 		{
 			software: fleet.Software{
@@ -1342,7 +1342,7 @@ func TestCPEFromSoftwareIntegration(t *testing.T) {
 				Vendor:           "",
 				BundleIdentifier: "",
 			},
-			cpe: "cpe:2.3:a:jetbrains:intellij_idea:2023.3.2.233.13135.103:*:*:*:*:*:*:*",
+			cpe: "cpe:2.3:a:jetbrains:intellij_idea:2023.3.2.233.13135.103:*:*:*:*:macos:*:*",
 		},
 		{
 			software: fleet.Software{
@@ -1643,7 +1643,7 @@ func TestCPEFromSoftwareIntegration(t *testing.T) {
 				Version: "3.9.18_2",
 				Vendor:  "",
 			},
-			cpe: `cpe:2.3:a:python:python:3.9.18_2:*:*:*:*:*:*:*`,
+			cpe: `cpe:2.3:a:python:python:3.9.18_2:*:*:*:*:macos:*:*`,
 		},
 		{
 			software: fleet.Software{
@@ -1654,6 +1654,15 @@ func TestCPEFromSoftwareIntegration(t *testing.T) {
 			},
 			cpe: "cpe:2.3:o:linux:linux_kernel:5.4.0-105.118:*:*:*:*:*:*:*",
 		},
+		{
+			software: fleet.Software{
+				Name:             "VirtualBox.app",
+				Source:           "apps",
+				Version:          "7.0.12",
+				BundleIdentifier: "org.virtualbox.app.VirtualBox",
+			},
+			cpe: "cpe:2.3:a:oracle:virtualbox:7.0.12:*:*:*:*:macos:*:*",
+		},
 	}
 
 	// NVD_TEST_CPEDB_PATH can be used to speed up development (sync cpe.sqlite only once).
@@ -1693,7 +1702,7 @@ func TestContainsNonASCII(t *testing.T) {
 	}{
 		{"hello", false},
 		{"hello world", false},
-		{"hello world!", false},
+		{"hello – world!", false},
 		{"😊👍", true},
 		{"hello world! 😊👍", true},
 		{"Девушка Фонарём", true},
diff --git a/server/vulnerabilities/nvd/cpe_translations.json b/server/vulnerabilities/nvd/cpe_translations.json
index 73d64cd787..ec03b2e26c 100644
--- a/server/vulnerabilities/nvd/cpe_translations.json
+++ b/server/vulnerabilities/nvd/cpe_translations.json
@@ -407,5 +407,24 @@
       "vendor": ["linux"],
       "part": "o"
     }
+  },
+  {
+    "software": {
+      "name": ["git"],
+      "source": ["homebrew_packages"]
+    },
+    "filter": {
+      "product": ["git"],
+      "vendor": ["git"]
+    }
+  },
+  {
+    "software": {
+      "bundle_identifier": ["org.virtualbox.app.VirtualBox"]
+    },
+    "filter": {
+      "product": ["virtualbox"],
+      "vendor": ["oracle"]
+    }
   }
-]
+]
\ No newline at end of file
diff --git a/server/vulnerabilities/nvd/cve.go b/server/vulnerabilities/nvd/cve.go
index f7bc5fa49c..7b321ef947 100644
--- a/server/vulnerabilities/nvd/cve.go
+++ b/server/vulnerabilities/nvd/cve.go
@@ -588,6 +588,14 @@ func expandCPEAliases(cpeItem *wfn.Attributes) []*wfn.Attributes {
 		}
 	}
 
+	for _, cpeItem := range cpeItems {
+		if cpeItem.Vendor == "oracle" && cpeItem.Product == "virtualbox" {
+			cpeItem2 := *cpeItem
+			cpeItem2.Product = "vm_virtualbox"
+			cpeItems = append(cpeItems, &cpeItem2)
+		}
+	}
+
 	return cpeItems
 }
 
diff --git a/server/vulnerabilities/nvd/cve_test.go b/server/vulnerabilities/nvd/cve_test.go
index c69897179d..691f3e321a 100644
--- a/server/vulnerabilities/nvd/cve_test.go
+++ b/server/vulnerabilities/nvd/cve_test.go
@@ -320,6 +320,7 @@ func TestTranslateCPEToCVE(t *testing.T) {
 			},
 			excludedCVEs: []string{
 				"CVE-2023-28205", // This vulnerability is for Safari 16.4.0
+				"CVE-2024-23252", // Rejected CVE
 			},
 			continuesToUpdate: true,
 		},
@@ -336,6 +337,24 @@ func TestTranslateCPEToCVE(t *testing.T) {
 			excludedCVEs:      []string{"CVE-2011-5049"}, // OS vulnerability
 			continuesToUpdate: true,
 		},
+		"cpe:2.3:a:python:python:3.9.6:*:*:*:*:macos:*:*": {
+			excludedCVEs:      []string{"CVE-2024-4030"},
+			continuesToUpdate: true,
+		},
+		"cpe:2.3:a:python:python:3.9.6:*:*:*:*:windows:*:*": {
+			includedCVEs: []cve{
+				{ID: "CVE-2024-4030", resolvedInVersion: "3.12.4"},
+			},
+			continuesToUpdate: true,
+		},
+		// Tests the expandCPEAliases rule for virtualbox on macOS
+		"cpe:2.3:a:oracle:virtualbox:7.0.6:*:*:*:*:macos:*:*": {
+			includedCVEs: []cve{
+				{ID: "CVE-2023-21989", resolvedInVersion: "7.0.8"},
+				{ID: "CVE-2024-21141", resolvedInVersion: "7.0.20"},
+			},
+			continuesToUpdate: true,
+		},
 	}
 
 	cveOSTests := []struct {
diff --git a/server/vulnerabilities/nvd/sanitize.go b/server/vulnerabilities/nvd/sanitize.go
index 40e0be0ddc..dce39c36a3 100644
--- a/server/vulnerabilities/nvd/sanitize.go
+++ b/server/vulnerabilities/nvd/sanitize.go
@@ -222,6 +222,8 @@ func targetSW(s *fleet.Software) string {
 	switch s.Source {
 	case "apps":
 		return "macos"
+	case "homebrew_packages":
+		return "macos" // osquery homebrew_packages table is currently only for macOS (2024/08/12)
 	case "python_packages":
 		return "python"
 	case "chrome_extensions":
diff --git a/server/vulnerabilities/nvd/sync.go b/server/vulnerabilities/nvd/sync.go
index c2e52cc40a..65174e721b 100644
--- a/server/vulnerabilities/nvd/sync.go
+++ b/server/vulnerabilities/nvd/sync.go
@@ -216,9 +216,10 @@ func LoadCVEMeta(ctx context.Context, logger log.Logger, vulnPath string, ds fle
 			}
 			schema := vuln.Schema()
 
-			meta := fleet.CVEMeta{
-				CVE:         cve,
-				Description: schema.CVE.Description.DescriptionData[0].Value,
+			meta := fleet.CVEMeta{CVE: cve}
+
+			if len(schema.CVE.Description.DescriptionData) > 0 {
+				meta.Description = schema.CVE.Description.DescriptionData[0].Value
 			}
 
 			if schema.Impact.BaseMetricV3 != nil {
diff --git a/server/vulnerabilities/nvd/sync/cve_syncer.go b/server/vulnerabilities/nvd/sync/cve_syncer.go
index bad1289a36..8ecdb8e8da 100644
--- a/server/vulnerabilities/nvd/sync/cve_syncer.go
+++ b/server/vulnerabilities/nvd/sync/cve_syncer.go
@@ -780,16 +780,35 @@ func convertAPI20CVEToLegacy(cve nvdapi.CVE, logger log.Logger) *schema.NVDCVEFe
 
 	descriptions := make([]*schema.CVEJSON40LangString, 0, len(cve.Descriptions))
 	for _, description := range cve.Descriptions {
-		// Keep only english descriptions to match the legacy.
-		if description.Lang != "en" {
+		// Keep only English descriptions to match the legacy format.
+		var lang string
+		switch description.Lang {
+		case "en":
+			lang = description.Lang
+		case "en-US": // This occurred starting with Microsoft CVE-2024-38200.
+			lang = "en"
+		// non-English descriptions with known language tags are ignored.
+		case "es": // This occurred in a number of 2004 CVEs
+			continue
+		// non-English descriptions with unknown language tags are ignored and warned.
+		default:
+			level.Warn(logger).Log("msg", "Unknown CVE description language tag", "lang", description.Lang)
 			continue
 		}
 		descriptions = append(descriptions, &schema.CVEJSON40LangString{
-			Lang:  description.Lang,
+			Lang:  lang,
 			Value: description.Value,
 		})
 	}
 
+	if len(descriptions) == 0 {
+		// Populate a blank description to prevent Fleet cron job from crashing: https://github.com/fleetdm/fleet/issues/21239
+		descriptions = append(descriptions, &schema.CVEJSON40LangString{
+			Lang:  "en",
+			Value: "",
+		})
+	}
+
 	problemtypeData := make([]*schema.CVEJSON40ProblemtypeProblemtypeData, 0, len(cve.Weaknesses))
 	if len(cve.Weaknesses) == 0 {
 		problemtypeData = append(problemtypeData, &schema.CVEJSON40ProblemtypeProblemtypeData{
diff --git a/server/vulnerabilities/nvd/sync/cve_syncer_test.go b/server/vulnerabilities/nvd/sync/cve_syncer_test.go
index b25e0fbefc..acbc0656f0 100644
--- a/server/vulnerabilities/nvd/sync/cve_syncer_test.go
+++ b/server/vulnerabilities/nvd/sync/cve_syncer_test.go
@@ -31,6 +31,7 @@ var (
 )
 
 func TestStoreCVEsLegacyFormat(t *testing.T) {
+	t.Parallel()
 	year := 2023
 	t.Run(fmt.Sprintf("%d", year), func(t *testing.T) {
 		// Load CVEs from legacy feed.
diff --git a/server/vulnerabilities/oval/analyzer.go b/server/vulnerabilities/oval/analyzer.go
index f64d97b141..427761c16a 100644
--- a/server/vulnerabilities/oval/analyzer.go
+++ b/server/vulnerabilities/oval/analyzer.go
@@ -3,6 +3,7 @@ package oval
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"os"
 	"time"
@@ -17,8 +18,11 @@ const (
 	vulnBatchSize  = 500
 )
 
+var ErrUnsupportedPlatform = errors.New("unsupported platform")
+
 // Analyze scans all hosts for vulnerabilities based on the OVAL definitions for their platform,
-// inserting any new vulnerabilities and deleting anything patched.
+// inserting any new vulnerabilities and deleting anything patched. Returns nil, nil when
+// the platform isn't supported.
 func Analyze(
 	ctx context.Context,
 	ds fleet.Datastore,
@@ -34,7 +38,7 @@ func Analyze(
 	}
 
 	if !platform.IsSupported() {
-		return nil, nil
+		return nil, ErrUnsupportedPlatform
 	}
 
 	defs, err := loadDef(platform, vulnPath)
diff --git a/server/vulnerabilities/oval/analyzer_test.go b/server/vulnerabilities/oval/analyzer_test.go
index c978a85a47..415c1ca4e6 100644
--- a/server/vulnerabilities/oval/analyzer_test.go
+++ b/server/vulnerabilities/oval/analyzer_test.go
@@ -121,7 +121,7 @@ func extractFixtures(
 	extract(srcCvesPath, dstCvesPath, t)
 }
 
-func withTestFixutre(
+func withTestFixture(
 	version fleet.OSVersion,
 	ovalFixtureDir string,
 	softwareFixtureDir string,
@@ -218,7 +218,7 @@ func BenchmarkTestOvalAnalyzer(b *testing.B) {
 
 		for _, v := range systems {
 			b.Run(fmt.Sprintf("for %s %s", v.Platform, v.Name), func(b *testing.B) {
-				withTestFixutre(v, ovalFixtureDir, softwareFixtureDir, vulnPath, ds, func(h *fleet.Host) {
+				withTestFixture(v, ovalFixtureDir, softwareFixtureDir, vulnPath, ds, func(h *fleet.Host) {
 					b.ResetTimer()
 					for i := 0; i < b.N; i++ {
 						_, err := Analyze(context.Background(), ds, v, vulnPath, true)
@@ -269,7 +269,7 @@ func BenchmarkTestOvalAnalyzer(b *testing.B) {
 
 		for _, v := range systems {
 			b.Run(fmt.Sprintf("for %s %s", v.version.Platform, v.version.Name), func(b *testing.B) {
-				withTestFixutre(v.version, v.ovalFixtureDir, v.softwareFixtureDir, vulnPath, ds, func(h *fleet.Host) {
+				withTestFixture(v.version, v.ovalFixtureDir, v.softwareFixtureDir, vulnPath, ds, func(h *fleet.Host) {
 					b.ResetTimer()
 					for i := 0; i < b.N; i++ {
 						_, err := Analyze(context.Background(), ds, v.version, vulnPath, true)
@@ -323,7 +323,7 @@ func TestOvalAnalyzer(t *testing.T) {
 		}
 
 		for _, s := range systems {
-			withTestFixutre(s.version, s.ovalFixtureDir, s.softwareFixtureDir, vulnPath, ds, func(h *fleet.Host) {
+			withTestFixture(s.version, s.ovalFixtureDir, s.softwareFixtureDir, vulnPath, ds, func(h *fleet.Host) {
 				_, err := Analyze(ctx, ds, s.version, vulnPath, true)
 				require.NoError(t, err)
 				p := NewPlatform(s.version.Platform, s.version.Name)
@@ -355,7 +355,7 @@ func TestOvalAnalyzer(t *testing.T) {
 		ovalFixtureDir := "ubuntu"
 		softwareFixtureDir := filepath.Join("ubuntu", "software")
 		for _, v := range systems {
-			withTestFixutre(v, ovalFixtureDir, softwareFixtureDir, vulnPath, ds, func(h *fleet.Host) {
+			withTestFixture(v, ovalFixtureDir, softwareFixtureDir, vulnPath, ds, func(h *fleet.Host) {
 				_, err := Analyze(ctx, ds, v, vulnPath, true)
 				require.NoError(t, err)
 
diff --git a/server/vulnerabilities/oval/oval_platform.go b/server/vulnerabilities/oval/oval_platform.go
index 4b7c4a4923..c9fcc7ba1b 100644
--- a/server/vulnerabilities/oval/oval_platform.go
+++ b/server/vulnerabilities/oval/oval_platform.go
@@ -13,8 +13,9 @@ type Platform string
 
 // OvalFilePrefix is the file prefix used when saving an OVAL artifact.
 const OvalFilePrefix = "fleet_oval"
+const GovalDictionaryFilePrefix = "fleet_goval_dictionary"
 
-// SupportedSoftwareSources are the software sources for which we are using OVAL for vulnerability detection.
+// SupportedSoftwareSources are the software sources for which we are using OVAL or goval-dictionary for vulnerability detection.
 var SupportedSoftwareSources = []string{"deb_packages", "rpm_packages"}
 
 // getMajorMinorVer returns the major and minor version of an 'os_version'.
@@ -69,6 +70,10 @@ func (op Platform) ToFilename(date time.Time, extension string) string {
 	return fmt.Sprintf("%s_%s-%d_%02d_%02d.%s", OvalFilePrefix, op, date.Year(), date.Month(), date.Day(), extension)
 }
 
+func (op Platform) ToGovalDictionaryFilename() string {
+	return fmt.Sprintf("%s_%s.sqlite3", GovalDictionaryFilePrefix, op)
+}
+
 // IsSupported returns whether the given platform is currently supported.
 func (op Platform) IsSupported() bool {
 	supported := []string{
@@ -89,7 +94,6 @@ func (op Platform) IsSupported() bool {
 		"rhel_07",
 		"rhel_08",
 		"rhel_09",
-		"amzn_02",
 	}
 	for _, p := range supported {
 		if strings.HasPrefix(string(op), p) {
@@ -99,6 +103,22 @@ func (op Platform) IsSupported() bool {
 	return false
 }
 
+func (op Platform) IsGovalDictionarySupported() bool {
+	supported := []string{
+		"amzn_01",
+		"amzn_02",
+		"amzn_2022",
+		"amzn_2023",
+	}
+
+	for _, p := range supported {
+		if strings.HasPrefix(string(op), p) {
+			return true
+		}
+	}
+	return false
+}
+
 // IsUbuntu checks whether the current Platform targets Ubuntu.
 func (op Platform) IsUbuntu() bool {
 	return strings.HasPrefix(string(op), "ubuntu")
diff --git a/server/vulnerabilities/oval/oval_platform_test.go b/server/vulnerabilities/oval/oval_platform_test.go
index bf9a5e4a41..86f402f885 100644
--- a/server/vulnerabilities/oval/oval_platform_test.go
+++ b/server/vulnerabilities/oval/oval_platform_test.go
@@ -27,6 +27,7 @@ func TestOvalPlatform(t *testing.T) {
 			{"ubuntu", "Ubuntu 18.4.0 LTS asdfasd", "ubuntu_1804"},
 			{"rhel", "CentOS Linux 7.9.2009", "rhel_07"},
 			{"amzn", "Amazon Linux 2.0.0", "amzn_02"},
+			{"amzn", "Amazon Linux 2023.0.0", "amzn_2023"},
 			{"rhel", "Fedora Linux 12.0.0", "rhel_06"},
 			{"rhel", "Fedora Linux 13.0.0", "rhel_06"},
 			{"rhel", "Fedora Linux 14.0.0", "rhel_06"},
@@ -73,4 +74,18 @@ func TestOvalPlatform(t *testing.T) {
 			require.Equal(t, c.expected, plat.ToFilename(c.date, "json"))
 		}
 	})
+
+	t.Run("ToGovalDictionaryFilename", func(t *testing.T) {
+		cases := []struct {
+			version  string
+			expected string
+		}{
+			{"Amazon Linux 2.0.0", "fleet_goval_dictionary_amzn_02.sqlite3"},
+			{"Amazon Linux 2023.0.0", "fleet_goval_dictionary_amzn_2023.sqlite3"},
+		}
+		for _, c := range cases {
+			plat := NewPlatform("amzn", c.version)
+			require.Equal(t, c.expected, plat.ToGovalDictionaryFilename())
+		}
+	})
 }
diff --git a/server/webhooks/failing_policies.go b/server/webhooks/failing_policies.go
index 53c1b112a8..7af7610d04 100644
--- a/server/webhooks/failing_policies.go
+++ b/server/webhooks/failing_policies.go
@@ -36,6 +36,12 @@ func SendFailingPoliciesBatchedPOSTs(
 		level.Debug(logger).Log("msg", "no hosts", "policyID", policy.ID)
 		return nil
 	}
+	// The count may be out of date since it is only updated during the hourly cleanups_then_aggregation cron.
+	// Take care of the case where the count is less than the actual number of hosts we are returning.
+	hostsCount := uint(len(hosts))
+	if hostsCount > policy.FailingHostCount {
+		policy.FailingHostCount = hostsCount
+	}
 	sort.Slice(hosts, func(i, j int) bool {
 		return hosts[i].ID < hosts[j].ID
 	})
diff --git a/server/webhooks/failing_policies_test.go b/server/webhooks/failing_policies_test.go
index 28b9048ea4..4a75d4758e 100644
--- a/server/webhooks/failing_policies_test.go
+++ b/server/webhooks/failing_policies_test.go
@@ -122,7 +122,7 @@ func TestTriggerFailingPoliciesWebhookBasic(t *testing.T) {
         "created_at": "0001-01-01T00:00:00Z",
         "updated_at": "0001-01-01T00:00:00Z",
         "passing_host_count": 0,
-        "failing_host_count": 0,
+        "failing_host_count": 2,
         "host_count_updated_at": null,
 		"critical": true,
 		"calendar_events_enabled": false
@@ -309,7 +309,7 @@ func TestTriggerFailingPoliciesWebhookTeam(t *testing.T) {
         "created_at": "0001-01-01T00:00:00Z",
         "updated_at": "0001-01-01T00:00:00Z",
         "passing_host_count": 0,
-        "failing_host_count": 0,
+        "failing_host_count": 1,
         "host_count_updated_at": null,
 		"critical": false,
 		"calendar_events_enabled": true
diff --git a/server/worker/apple_mdm_test.go b/server/worker/apple_mdm_test.go
index 66d47070ba..fadd38dd24 100644
--- a/server/worker/apple_mdm_test.go
+++ b/server/worker/apple_mdm_test.go
@@ -51,6 +51,8 @@ func TestAppleMDM(t *testing.T) {
 	// use this to debug/verify details of calls
 	nopLog := kitlog.NewJSONLogger(os.Stdout)
 
+	testOrgName := "fleet-test"
+
 	createEnrolledHost := func(t *testing.T, i int, teamID *uint, depAssignedToFleet bool) *fleet.Host {
 		// create the host
 		h, err := ds.NewHost(ctx, &fleet.Host{
@@ -65,6 +67,7 @@ func TestAppleMDM(t *testing.T) {
 		require.NoError(t, err)
 
 		// create the nano_device and enrollment
+		var abmTokenID uint
 		mysql.ExecAdhocSQL(t, ds, func(q sqlx.ExtContext) error {
 			_, err := q.ExecContext(ctx, `INSERT INTO nano_devices (id, serial_number, authenticate) VALUES (?, ?, ?)`, h.UUID, h.HardwareSerial, "test")
 			if err != nil {
@@ -72,10 +75,18 @@ func TestAppleMDM(t *testing.T) {
 			}
 			_, err = q.ExecContext(ctx, `INSERT INTO nano_enrollments (id, device_id, type, topic, push_magic, token_hex)
 				VALUES (?, ?, ?, ?, ?, ?)`, h.UUID, h.UUID, "device", "topic", "push_magic", "token_hex")
+			if err != nil {
+				return err
+			}
+
+			encTok := uuid.NewString()
+			abmToken, err := ds.InsertABMToken(ctx, &fleet.ABMToken{OrganizationName: "unused", EncryptedToken: []byte(encTok)})
+			abmTokenID = abmToken.ID
+
 			return err
 		})
 		if depAssignedToFleet {
-			err := ds.UpsertMDMAppleHostDEPAssignments(ctx, []fleet.Host{*h})
+			err := ds.UpsertMDMAppleHostDEPAssignments(ctx, []fleet.Host{*h}, abmTokenID)
 			require.NoError(t, err)
 		}
 		err = ds.SetOrUpdateMDMData(ctx, h.ID, false, true, "http://example.com", depAssignedToFleet, fleet.WellKnownMDMFleet, "")
@@ -118,7 +129,7 @@ func TestAppleMDM(t *testing.T) {
 	}
 
 	t.Run("no-op with nil commander", func(t *testing.T) {
-		mysql.SetTestABMAssets(t, ds)
+		mysql.SetTestABMAssets(t, ds, testOrgName)
 		defer mysql.TruncateTables(t, ds)
 
 		mdmWorker := &AppleMDM{
@@ -147,7 +158,7 @@ func TestAppleMDM(t *testing.T) {
 	})
 
 	t.Run("fails with unknown task", func(t *testing.T) {
-		mysql.SetTestABMAssets(t, ds)
+		mysql.SetTestABMAssets(t, ds, testOrgName)
 		defer mysql.TruncateTables(t, ds)
 
 		mdmWorker := &AppleMDM{
@@ -179,7 +190,7 @@ func TestAppleMDM(t *testing.T) {
 	})
 
 	t.Run("installs default manifest", func(t *testing.T) {
-		mysql.SetTestABMAssets(t, ds)
+		mysql.SetTestABMAssets(t, ds, testOrgName)
 		defer mysql.TruncateTables(t, ds)
 
 		h := createEnrolledHost(t, 1, nil, true)
@@ -217,7 +228,7 @@ func TestAppleMDM(t *testing.T) {
 	})
 
 	t.Run("installs default manifest, manual release", func(t *testing.T) {
-		mysql.SetTestABMAssets(t, ds)
+		mysql.SetTestABMAssets(t, ds, testOrgName)
 		t.Cleanup(func() { mysql.TruncateTables(t, ds) })
 
 		h := createEnrolledHost(t, 1, nil, true)
@@ -252,7 +263,7 @@ func TestAppleMDM(t *testing.T) {
 	})
 
 	t.Run("installs custom bootstrap manifest", func(t *testing.T) {
-		mysql.SetTestABMAssets(t, ds)
+		mysql.SetTestABMAssets(t, ds, testOrgName)
 		defer mysql.TruncateTables(t, ds)
 
 		h := createEnrolledHost(t, 1, nil, true)
@@ -262,7 +273,7 @@ func TestAppleMDM(t *testing.T) {
 			Bytes:  []byte("test"),
 			Sha256: []byte("test"),
 			Token:  "token",
-		})
+		}, nil)
 		require.NoError(t, err)
 
 		mdmWorker := &AppleMDM{
@@ -301,7 +312,7 @@ func TestAppleMDM(t *testing.T) {
 	})
 
 	t.Run("installs custom bootstrap manifest of a team", func(t *testing.T) {
-		mysql.SetTestABMAssets(t, ds)
+		mysql.SetTestABMAssets(t, ds, testOrgName)
 		defer mysql.TruncateTables(t, ds)
 
 		tm, err := ds.NewTeam(ctx, &fleet.Team{Name: "test"})
@@ -314,7 +325,7 @@ func TestAppleMDM(t *testing.T) {
 			Bytes:  []byte("test"),
 			Sha256: []byte("test"),
 			Token:  "token",
-		})
+		}, nil)
 		require.NoError(t, err)
 
 		mdmWorker := &AppleMDM{
@@ -353,7 +364,7 @@ func TestAppleMDM(t *testing.T) {
 	})
 
 	t.Run("installs custom bootstrap manifest of a team, manual release", func(t *testing.T) {
-		mysql.SetTestABMAssets(t, ds)
+		mysql.SetTestABMAssets(t, ds, testOrgName)
 		t.Cleanup(func() { mysql.TruncateTables(t, ds) })
 
 		tm, err := ds.NewTeam(ctx, &fleet.Team{Name: "test"})
@@ -367,7 +378,7 @@ func TestAppleMDM(t *testing.T) {
 			Bytes:  []byte("test"),
 			Sha256: []byte("test"),
 			Token:  "token",
-		})
+		}, nil)
 		require.NoError(t, err)
 
 		mdmWorker := &AppleMDM{
@@ -403,7 +414,7 @@ func TestAppleMDM(t *testing.T) {
 	})
 
 	t.Run("unknown enroll reference", func(t *testing.T) {
-		mysql.SetTestABMAssets(t, ds)
+		mysql.SetTestABMAssets(t, ds, testOrgName)
 		defer mysql.TruncateTables(t, ds)
 
 		h := createEnrolledHost(t, 1, nil, true)
@@ -436,7 +447,7 @@ func TestAppleMDM(t *testing.T) {
 	})
 
 	t.Run("enroll reference but SSO disabled", func(t *testing.T) {
-		mysql.SetTestABMAssets(t, ds)
+		mysql.SetTestABMAssets(t, ds, testOrgName)
 		defer mysql.TruncateTables(t, ds)
 
 		err := ds.InsertMDMIdPAccount(ctx, &fleet.MDMIdPAccount{
@@ -484,7 +495,7 @@ func TestAppleMDM(t *testing.T) {
 	})
 
 	t.Run("enroll reference with SSO enabled", func(t *testing.T) {
-		mysql.SetTestABMAssets(t, ds)
+		mysql.SetTestABMAssets(t, ds, testOrgName)
 		defer mysql.TruncateTables(t, ds)
 
 		err := ds.InsertMDMIdPAccount(ctx, &fleet.MDMIdPAccount{
@@ -539,7 +550,7 @@ func TestAppleMDM(t *testing.T) {
 	})
 
 	t.Run("installs fleetd for manual enrollments", func(t *testing.T) {
-		mysql.SetTestABMAssets(t, ds)
+		mysql.SetTestABMAssets(t, ds, testOrgName)
 		defer mysql.TruncateTables(t, ds)
 
 		h := createEnrolledHost(t, 1, nil, true)
diff --git a/server/worker/db_migrations.go b/server/worker/db_migrations.go
new file mode 100644
index 0000000000..88d0839d19
--- /dev/null
+++ b/server/worker/db_migrations.go
@@ -0,0 +1,130 @@
+package worker
+
+import (
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"time"
+
+	"github.com/fleetdm/fleet/v4/server/contexts/ctxerr"
+	"github.com/fleetdm/fleet/v4/server/fleet"
+	kitlog "github.com/go-kit/log"
+)
+
+// Name of the DB migration job as registered in the worker. Note that although
+// it is a single job, it can process a number of different-but-related tasks,
+// identified by the Task field in the job's payload. This is deliberately
+// general so other one-off migration tasks that can't be done during the
+// "fleet prepare db" command can reuse this job.
+const dbMigrationJobName = "db_migration"
+
+type DBMigrationTask string
+
+// List of supported tasks.
+const (
+	DBMigrateVPPTokenTask DBMigrationTask = "migrate_vpp_token" //nolint: gosec
+)
+
+// DBMigration is the job processor for the db_migration job.
+type DBMigration struct {
+	Datastore fleet.Datastore
+	Log       kitlog.Logger
+}
+
+// Name returns the name of the job.
+func (m *DBMigration) Name() string {
+	return dbMigrationJobName
+}
+
+// dbMigrationArgs is the payload for the DB migration job.
+type dbMigrationArgs struct {
+	Task DBMigrationTask `json:"task"`
+}
+
+// Run executes the db_migration job. Note that unlike for other worker jobs,
+// there is no QueueDBMigrationJob function - it is expected that this job will
+// always be enqueued by a database migration, which use a direct INSERT into
+// the jobs table to avoid depending on code that may change over time.
+func (m *DBMigration) Run(ctx context.Context, argsJSON json.RawMessage) error {
+	var args dbMigrationArgs
+	if err := json.Unmarshal(argsJSON, &args); err != nil {
+		return ctxerr.Wrap(ctx, err, "unmarshal args")
+	}
+
+	switch args.Task {
+	case DBMigrateVPPTokenTask:
+		err := m.migrateVPPToken(ctx)
+		return ctxerr.Wrap(ctx, err, "running migrate VPP token task")
+
+	default:
+		return ctxerr.Errorf(ctx, "unknown task: %v", args.Task)
+	}
+}
+
+func (m *DBMigration) migrateVPPToken(ctx context.Context) error {
+	// get the VPP token with an empty location, this is the one to migrate
+	tok, err := m.Datastore.GetVPPTokenByLocation(ctx, "")
+	if err != nil {
+		if fleet.IsNotFound(err) {
+			// nothing to migrate, exit successfully
+			return nil
+		}
+		return ctxerr.Wrap(ctx, err, "get VPP token to migrate")
+	}
+
+	tokenData, didUpdate, err := extractVPPTokenFromMigration(tok)
+	if err != nil {
+		return ctxerr.Wrap(ctx, err, "extract VPP token metadata")
+	}
+	if !didUpdate {
+		// it should've updated, as the location, org name and renew date were all
+		// dummy values after the DB migration. Log something, but otherwise
+		// continue as retrying won't change the result.
+		m.Log.Log("info", "VPP token metadata was not updated")
+	}
+
+	if _, err := m.Datastore.UpdateVPPToken(ctx, tok.ID, tokenData); err != nil {
+		return ctxerr.Wrap(ctx, err, "update VPP token")
+	}
+	// the migated token should target "All teams"
+	_, err = m.Datastore.UpdateVPPTokenTeams(ctx, tok.ID, []uint{})
+	return ctxerr.Wrap(ctx, err, "update VPP token teams")
+}
+
+func extractVPPTokenFromMigration(migratedToken *fleet.VPPTokenDB) (tokData *fleet.VPPTokenData, didUpdateMetadata bool, err error) {
+	var vppTokenData fleet.VPPTokenData
+	if err := json.Unmarshal([]byte(migratedToken.Token), &vppTokenData); err != nil {
+		return nil, false, fmt.Errorf("unmarshaling VPP token data: %w", err)
+	}
+
+	vppTokenRawBytes, err := base64.StdEncoding.DecodeString(vppTokenData.Token)
+	if err != nil {
+		return nil, false, fmt.Errorf("decoding raw vpp token data: %w", err)
+	}
+
+	var vppTokenRaw fleet.VPPTokenRaw
+	if err := json.Unmarshal(vppTokenRawBytes, &vppTokenRaw); err != nil {
+		return nil, false, fmt.Errorf("unmarshaling raw vpp token data: %w", err)
+	}
+
+	exp, err := time.Parse("2006-01-02T15:04:05Z0700", vppTokenRaw.ExpDate)
+	if err != nil {
+		return nil, false, fmt.Errorf("parsing vpp token expiration date: %w", err)
+	}
+
+	if vppTokenData.Location != migratedToken.Location {
+		migratedToken.Location = vppTokenData.Location
+		didUpdateMetadata = true
+	}
+	if vppTokenRaw.OrgName != migratedToken.OrgName {
+		migratedToken.OrgName = vppTokenRaw.OrgName
+		didUpdateMetadata = true
+	}
+	if !exp.Equal(migratedToken.RenewDate) {
+		migratedToken.RenewDate = exp.UTC()
+		didUpdateMetadata = true
+	}
+
+	return &vppTokenData, didUpdateMetadata, nil
+}
diff --git a/server/worker/db_migrations_test.go b/server/worker/db_migrations_test.go
new file mode 100644
index 0000000000..1aeeb697e9
--- /dev/null
+++ b/server/worker/db_migrations_test.go
@@ -0,0 +1,136 @@
+package worker
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/fleetdm/fleet/v4/server/datastore/mysql"
+	"github.com/fleetdm/fleet/v4/server/fleet"
+	"github.com/fleetdm/fleet/v4/server/test"
+	kitlog "github.com/go-kit/log"
+	"github.com/jmoiron/sqlx"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestDBMigrationsVPPToken(t *testing.T) {
+	ctx := context.Background()
+
+	ds := mysql.CreateMySQLDS(t)
+	// call TruncateTables immediately as a DB migration may have created jobs
+	mysql.TruncateTables(t, ds)
+
+	nopLog := kitlog.NewNopLogger()
+	// use this to debug/verify details of calls
+	// nopLog := kitlog.NewJSONLogger(os.Stdout)
+
+	// create and register the worker
+	processor := &DBMigration{
+		Datastore: ds,
+		Log:       nopLog,
+	}
+	w := NewWorker(ds, nopLog)
+	w.Register(processor)
+
+	// create the migrated token and enqueue the job
+	expDate := time.Date(2024, 8, 27, 0, 0, 0, 0, time.UTC)
+	tok, err := test.CreateVPPTokenEncodedAfterMigration(expDate, "test-org", "test-loc")
+	require.NoError(t, err)
+	encTok, err := mysql.EncryptWithPrivateKey(t, ds, tok)
+	require.NoError(t, err)
+
+	const insVPP = `
+INSERT INTO vpp_tokens
+	(
+		organization_name,
+		location,
+		renew_at,
+		token
+	)
+VALUES
+	('', '', DATE('2000-01-01'), ?)
+`
+
+	const insJob = `
+INSERT INTO jobs (
+		name,
+		args,
+		state,
+		error,
+		not_before,
+		created_at,
+		updated_at
+)
+VALUES (?, ?, ?, '', ?, ?, ?)
+`
+	mysql.ExecAdhocSQL(t, ds, func(q sqlx.ExtContext) error {
+		_, err := q.ExecContext(ctx, insVPP, encTok)
+		if err != nil {
+			return err
+		}
+
+		argsJSON, err := json.Marshal(dbMigrationArgs{Task: DBMigrateVPPTokenTask})
+		if err != nil {
+			return fmt.Errorf("failed to JSON marshal the job arguments: %w", err)
+		}
+		ts := time.Date(2024, 8, 26, 0, 0, 0, 0, time.UTC)
+		if _, err := q.ExecContext(ctx, insJob, dbMigrationJobName, argsJSON, fleet.JobStateQueued, ts, ts, ts); err != nil {
+			return err
+		}
+		return nil
+	})
+
+	// run the worker, should mark the job as done
+	err = w.ProcessJobs(ctx)
+	require.NoError(t, err)
+
+	// nothing more to run
+	jobs, err := ds.GetQueuedJobs(ctx, 1, time.Now().UTC().Add(time.Minute)) // look in the future to catch any delayed job
+	require.NoError(t, err)
+	if !assert.Empty(t, jobs) {
+		t.Logf(">>> %#+v", jobs[0])
+	}
+
+	// token should've been updated
+	vppTok, err := ds.GetVPPTokenByLocation(ctx, "test-loc")
+	require.NoError(t, err)
+	require.Equal(t, "test-org", vppTok.OrgName)
+	require.Equal(t, "test-loc", vppTok.Location)
+	require.Equal(t, expDate, vppTok.RenewDate)
+	require.Contains(t, string(tok), `"token":"`+vppTok.Token+`"`) // the DB-stored token is the "token" JSON field in the raw tok
+	require.NotNil(t, vppTok.Teams)
+	require.Len(t, vppTok.Teams, 0)
+
+	// empty-location token should not exist anymore
+	_, err = ds.GetVPPTokenByLocation(ctx, "")
+	require.Error(t, err)
+	var nfe fleet.NotFoundError
+	require.ErrorAs(t, err, &nfe)
+
+	// enqueue a DB migration job with an unknown task
+	mysql.ExecAdhocSQL(t, ds, func(q sqlx.ExtContext) error {
+		argsJSON, err := json.Marshal(dbMigrationArgs{Task: DBMigrationTask("no-such-task")})
+		if err != nil {
+			return fmt.Errorf("failed to JSON marshal the job arguments: %w", err)
+		}
+		ts := time.Date(2024, 8, 26, 0, 0, 0, 0, time.UTC)
+		if _, err := q.ExecContext(ctx, insJob, dbMigrationJobName, argsJSON, fleet.JobStateQueued, ts, ts, ts); err != nil {
+			return err
+		}
+		return nil
+	})
+
+	// run the worker, will fail but still queued for a retry
+	err = w.ProcessJobs(ctx)
+	require.NoError(t, err)
+
+	jobs, err = ds.GetQueuedJobs(ctx, 1, time.Now().UTC().Add(time.Minute)) // look in the future to catch any delayed job
+	require.NoError(t, err)
+	require.Len(t, jobs, 1)
+	require.Equal(t, fleet.JobStateQueued, jobs[0].State)
+	require.Equal(t, 1, jobs[0].Retries)
+	require.Contains(t, jobs[0].Error, "unknown task: no-such-task")
+}
diff --git a/server/worker/macos_setup_assistant.go b/server/worker/macos_setup_assistant.go
index 55f808c4ea..d473917138 100644
--- a/server/worker/macos_setup_assistant.go
+++ b/server/worker/macos_setup_assistant.go
@@ -96,20 +96,6 @@ func (m *MacosSetupAssistant) runProfileChanged(ctx context.Context, args macosS
 		return ctxerr.Wrap(ctx, err, "get team")
 	}
 
-	// re-generate and register the profile with Apple. Since the profile has been
-	// updated, then its profile UUID will have been cleared, so this single call
-	// will do both tasks.
-	profUUID, _, err := m.DEPService.EnsureCustomSetupAssistantIfExists(ctx, team)
-	if err != nil {
-		return ctxerr.Wrap(ctx, err, "ensure custom setup assistant")
-	}
-	if profUUID == "" {
-		// the custom setup assistant profile may have been deleted since the job
-		// was enqueued, if so another job will take care of assigning the default
-		// profile to the hosts, nothing to do.
-		return nil
-	}
-
 	// get the team's mdm-enrolled hosts, assign the profile to all of that
 	// team's hosts serials.
 	serials, err := m.Datastore.ListMDMAppleDEPSerialsInTeam(ctx, args.TeamID)
@@ -131,12 +117,25 @@ func (m *MacosSetupAssistant) runProfileChanged(ctx context.Context, args macosS
 			return nil
 		}
 
-		resp, err := m.DEPClient.AssignProfile(ctx, apple_mdm.DEPName, profUUID, assignSerials...)
-		if err != nil {
-			return ctxerr.Wrap(ctx, err, "assign profile")
-		}
-		if err := m.Datastore.UpdateHostDEPAssignProfileResponses(ctx, resp); err != nil {
-			return ctxerr.Wrap(ctx, err, "worker: run profile changed")
+		for orgName, serials := range assignSerials {
+			profUUID, _, err := m.DEPService.EnsureCustomSetupAssistantIfExists(ctx, team, orgName)
+			if err != nil {
+				return ctxerr.Wrapf(ctx, err, "ensure custom setup assistant for ABM org name %q", orgName)
+			}
+			if profUUID == "" {
+				// the custom setup assistant profile may have been deleted since the job
+				// was enqueued, if so another job will take care of assigning the default
+				// profile to the hosts, nothing to do.
+				continue
+			}
+
+			resp, err := m.DEPClient.AssignProfile(ctx, orgName, profUUID, serials...)
+			if err != nil {
+				return ctxerr.Wrap(ctx, err, "assign profile")
+			}
+			if err := m.Datastore.UpdateHostDEPAssignProfileResponses(ctx, resp); err != nil {
+				return ctxerr.Wrap(ctx, err, "worker: run profile changed")
+			}
 		}
 	}
 	return nil
@@ -156,11 +155,11 @@ func (m *MacosSetupAssistant) runProfileDeleted(ctx context.Context, args macosS
 	// get the team's setup assistant, to make sure it is still absent. If it is
 	// not, then it was re-created before this job ran, so nothing to do (another
 	// job will take care of assigning the profile to the hosts).
-	customProfUUID, _, err := m.DEPService.EnsureCustomSetupAssistantIfExists(ctx, team)
-	if err != nil {
-		return ctxerr.Wrap(ctx, err, "ensure custom setup assistant")
+	_, err = m.Datastore.GetMDMAppleSetupAssistant(ctx, args.TeamID)
+	if err != nil && !fleet.IsNotFound(err) {
+		return ctxerr.Wrap(ctx, err, "check if setup assistant exists")
 	}
-	if customProfUUID != "" {
+	if !fleet.IsNotFound(err) {
 		// a custom setup assistant was re-created, so nothing to do.
 		return nil
 	}
@@ -169,14 +168,6 @@ func (m *MacosSetupAssistant) runProfileDeleted(ctx context.Context, args macosS
 	// of the default profile and assign it to all of the team's hosts. No need
 	// to force a re-generate of the default profile, if it is already registered
 	// with Apple this is fine and we use that profile uuid.
-	profUUID, _, err := m.DEPService.EnsureDefaultSetupAssistant(ctx, team)
-	if err != nil {
-		return ctxerr.Wrap(ctx, err, "ensure default setup assistant")
-	}
-	if profUUID == "" {
-		// this should not happen, return an error
-		return ctxerr.Errorf(ctx, "default setup assistant profile uuid is empty")
-	}
 
 	// get the team's mdm-enrolled hosts, assign the profile to all of that
 	// team's hosts serials.
@@ -199,12 +190,23 @@ func (m *MacosSetupAssistant) runProfileDeleted(ctx context.Context, args macosS
 			return nil
 		}
 
-		resp, err := m.DEPClient.AssignProfile(ctx, apple_mdm.DEPName, profUUID, assignSerials...)
-		if err != nil {
-			return ctxerr.Wrap(ctx, err, "assign profile")
-		}
-		if err := m.Datastore.UpdateHostDEPAssignProfileResponses(ctx, resp); err != nil {
-			return ctxerr.Wrap(ctx, err, "worker: run profile deleted")
+		for orgName, serials := range assignSerials {
+			profUUID, _, err := m.DEPService.EnsureDefaultSetupAssistant(ctx, team, orgName)
+			if err != nil {
+				return ctxerr.Wrapf(ctx, err, "ensure default setup assistant for ABM organization %q", orgName)
+			}
+			if profUUID == "" {
+				// this should not happen, return an error
+				return ctxerr.Errorf(ctx, "default setup assistant profile uuid is empty for ABM organization %q", orgName)
+			}
+
+			resp, err := m.DEPClient.AssignProfile(ctx, orgName, profUUID, serials...)
+			if err != nil {
+				return ctxerr.Wrap(ctx, err, "assign profile")
+			}
+			if err := m.Datastore.UpdateHostDEPAssignProfileResponses(ctx, resp); err != nil {
+				return ctxerr.Wrap(ctx, err, "worker: run profile deleted")
+			}
 		}
 	}
 	return nil
@@ -227,51 +229,54 @@ func (m *MacosSetupAssistant) runHostsTransferred(ctx context.Context, args maco
 		return ctxerr.Wrap(ctx, err, "get team")
 	}
 
-	// get the new team's setup assistant if it exists.
-	profUUID, _, err := m.DEPService.EnsureCustomSetupAssistantIfExists(ctx, team)
+	cooldownSerials, assignSerials, err := m.Datastore.ScreenDEPAssignProfileSerialsForCooldown(ctx, args.HostSerialNumbers)
 	if err != nil {
-		return ctxerr.Wrap(ctx, err, "ensure custom setup assistant")
-	}
-	if profUUID == "" {
-		// get the default setup assistant.
-		defProfUUID, _, err := m.DEPService.EnsureDefaultSetupAssistant(ctx, team)
-		if err != nil {
-			return ctxerr.Wrap(ctx, err, "ensure default setup assistant")
-		}
-		profUUID = defProfUUID
-		if profUUID == "" {
-			// this should not happen, return an error
-			return ctxerr.Errorf(ctx, "default setup assistant profile uuid is empty")
-		}
+		return ctxerr.Wrap(ctx, err, "run hosts transferred")
 	}
 
-	serials := args.HostSerialNumbers
-	if !fromCooldown {
-		// if not a retry, then we need to screen the serials for cooldown
-		skipSerials, assignSerials, err := m.Datastore.ScreenDEPAssignProfileSerialsForCooldown(ctx, serials)
-		if err != nil {
-			return ctxerr.Wrap(ctx, err, "run hosts transferred")
+	// if it's a retry, serials on cooldown need to be assigned as well.
+	if fromCooldown {
+		for k, v := range cooldownSerials {
+			assignSerials[k] = append(assignSerials[k], v...)
 		}
-		if len(skipSerials) > 0 {
-			// NOTE: the `dep_cooldown` job of the `integrations` cron picks up the assignments
-			// after the cooldown period is over
-			level.Info(m.Log).Log("msg", "run hosts transferred: skipping assign profile for devices on cooldown", "serials", fmt.Sprintf("%s", skipSerials))
-		}
-		serials = assignSerials
+	} else if len(cooldownSerials) > 0 {
+		// NOTE: the `dep_cooldown` job of the `integrations` cron picks up the assignments
+		// after the cooldown period is over
+		level.Info(m.Log).Log("msg", "run hosts transferred: skipping assign profile for devices on cooldown", "serials", fmt.Sprintf("%s", cooldownSerials))
 	}
 
-	if len(serials) == 0 {
+	if len(assignSerials) == 0 {
 		level.Info(m.Log).Log("msg", "run hosts transferred: no devices to assign profile")
 		return nil
 	}
 
-	resp, err := m.DEPClient.AssignProfile(ctx, apple_mdm.DEPName, profUUID, serials...)
-	if err != nil {
-		return ctxerr.Wrap(ctx, err, "assign profile")
-	}
-	if err := m.Datastore.UpdateHostDEPAssignProfileResponses(ctx, resp); err != nil {
-		return ctxerr.Wrap(ctx, err, "worker: run hosts transferred")
+	for orgName, serials := range assignSerials {
+		profUUID, _, err := m.DEPService.EnsureCustomSetupAssistantIfExists(ctx, team, orgName)
+		if err != nil {
+			return ctxerr.Wrapf(ctx, err, "ensure custom setup assistant for ABM organization %q", orgName)
+		}
+		if profUUID == "" {
+			// get the default setup assistant.
+			defProfUUID, _, err := m.DEPService.EnsureDefaultSetupAssistant(ctx, team, orgName)
+			if err != nil {
+				return ctxerr.Wrapf(ctx, err, "ensure default setup assistant for ABM organization %q", orgName)
+			}
+			profUUID = defProfUUID
+			if profUUID == "" {
+				// this should not happen, return an error
+				return ctxerr.Errorf(ctx, "default setup assistant profile uuid is empty for ABM organization %q", orgName)
+			}
+		}
+
+		resp, err := m.DEPClient.AssignProfile(ctx, orgName, profUUID, serials...)
+		if err != nil {
+			return ctxerr.Wrap(ctx, err, "assign profile")
+		}
+		if err := m.Datastore.UpdateHostDEPAssignProfileResponses(ctx, resp); err != nil {
+			return ctxerr.Wrap(ctx, err, "worker: run hosts transferred")
+		}
 	}
+
 	return nil
 }
 
@@ -291,6 +296,7 @@ func (m *MacosSetupAssistant) runUpdateAllProfiles(ctx context.Context, args mac
 		if _, err := QueueMacosSetupAssistantJob(ctx, m.Datastore, m.Log, MacosSetupAssistantUpdateProfile, teamID); err != nil {
 			return ctxerr.Wrap(ctx, err, "queue macos setup assistant update profile job")
 		}
+
 		return nil
 	}
 
@@ -308,25 +314,31 @@ func (m *MacosSetupAssistant) runUpdateAllProfiles(ctx context.Context, args mac
 
 func (m *MacosSetupAssistant) runUpdateProfile(ctx context.Context, args macosSetupAssistantArgs) error {
 	// clear the profile uuid for the default setup assistant for that team/no-team
-	if err := m.Datastore.SetMDMAppleDefaultSetupAssistantProfileUUID(ctx, args.TeamID, ""); err != nil {
+	if err := m.Datastore.SetMDMAppleDefaultSetupAssistantProfileUUID(ctx, args.TeamID, "", ""); err != nil {
 		return ctxerr.Wrap(ctx, err, "clear default setup assistant profile uuid")
 	}
 
-	// clear the profile uuid for the custom setup assistant
-	if err := m.Datastore.SetMDMAppleSetupAssistantProfileUUID(ctx, args.TeamID, ""); err != nil {
-		if fleet.IsNotFound(err) {
-			// no setup assistant for that team, enqueue a profile deleted task so
-			// the default profile is assigned to the hosts.
-			if _, err := QueueMacosSetupAssistantJob(ctx, m.Datastore, m.Log, MacosSetupAssistantProfileDeleted, args.TeamID); err != nil {
-				return ctxerr.Wrap(ctx, err, "queue macos setup assistant profile deleted job")
-			}
-			return nil
+	// check if there is a custom setup assistant for that team
+	_, err := m.Datastore.GetMDMAppleSetupAssistant(ctx, args.TeamID)
+	if err != nil && !fleet.IsNotFound(err) {
+		return ctxerr.Wrap(ctx, err, "check if setup assistant exists")
+	}
+	if fleet.IsNotFound(err) {
+		// no setup assistant for that team, enqueue a profile deleted task so
+		// the default profile is assigned to the hosts.
+		if _, err := QueueMacosSetupAssistantJob(ctx, m.Datastore, m.Log, MacosSetupAssistantProfileDeleted, args.TeamID); err != nil {
+			return ctxerr.Wrap(ctx, err, "queue macos setup assistant profile deleted job")
 		}
+		return nil
+	}
+
+	// clear the profile uuid for the custom setup assistant
+	if err := m.Datastore.SetMDMAppleSetupAssistantProfileUUID(ctx, args.TeamID, "", ""); err != nil {
 		return ctxerr.Wrap(ctx, err, "clear custom setup assistant profile uuid")
 	}
 
-	// no error means that the setup assistant existed for that team, enqueue a profile
-	// changed task so the custom profile is assigned to the hosts.
+	// the setup assistant existed for that team, enqueue a profile changed task
+	// so the custom profile is assigned to the hosts.
 	if _, err := QueueMacosSetupAssistantJob(ctx, m.Datastore, m.Log, MacosSetupAssistantProfileChanged, args.TeamID); err != nil {
 		return ctxerr.Wrap(ctx, err, "queue macos setup assistant profile changed job")
 	}
@@ -379,17 +391,17 @@ func QueueMacosSetupAssistantJob(
 }
 
 func ProcessDEPCooldowns(ctx context.Context, ds fleet.Datastore, logger kitlog.Logger) error {
-	serialsByTeamId, err := ds.GetDEPAssignProfileExpiredCooldowns(ctx)
+	serialsByTeamID, err := ds.GetDEPAssignProfileExpiredCooldowns(ctx)
 	if err != nil {
 		return ctxerr.Wrap(ctx, err, "getting cooldowns")
 	}
-	if len(serialsByTeamId) == 0 {
+	if len(serialsByTeamID) == 0 {
 		level.Info(logger).Log("msg", "no cooldowns to process")
 		return nil
 	}
 
 	// queue job for each team so that macOS setup assistant worker can pick it up and process it
-	for teamID, serials := range serialsByTeamId {
+	for teamID, serials := range serialsByTeamID {
 		if len(serials) == 0 {
 			logger.Log("msg", "no cooldowns", "team_id", teamID)
 			continue
diff --git a/server/worker/macos_setup_assistant_test.go b/server/worker/macos_setup_assistant_test.go
index 333362460c..f137b418bb 100644
--- a/server/worker/macos_setup_assistant_test.go
+++ b/server/worker/macos_setup_assistant_test.go
@@ -8,6 +8,7 @@ import (
 	"io"
 	"net/http"
 	"net/http/httptest"
+	"strconv"
 	"strings"
 	"testing"
 	"time"
@@ -28,6 +29,13 @@ func TestMacosSetupAssistant(t *testing.T) {
 	// call TruncateTables immediately as some DB migrations may create jobs
 	mysql.TruncateTables(t, ds)
 
+	org1Name := "org1"
+	org2Name := "org2"
+
+	mysql.SetTestABMAssets(t, ds, "fleet")
+	tok := mysql.CreateAndSetABMToken(t, ds, org1Name)
+	tok2 := mysql.CreateAndSetABMToken(t, ds, org2Name)
+
 	// create a couple hosts for no team, team 1 and team 2 (none for team 3)
 	hosts := make([]*fleet.Host, 6)
 	for i := 0; i < len(hosts); i++ {
@@ -40,10 +48,16 @@ func TestMacosSetupAssistant(t *testing.T) {
 			HardwareSerial: fmt.Sprintf("serial-%d", i),
 		})
 		require.NoError(t, err)
-		err = ds.UpsertMDMAppleHostDEPAssignments(ctx, []fleet.Host{*h})
+
+		tokID := tok.ID
+		if i%2 == 0 {
+			tokID = tok2.ID
+		}
+
+		err = ds.UpsertMDMAppleHostDEPAssignments(ctx, []fleet.Host{*h}, tokID)
 		require.NoError(t, err)
 		hosts[i] = h
-		t.Logf("host [%d]: %s - %s", i, h.UUID, h.HardwareSerial)
+		t.Logf("host [%d]: %s - %s - %d", i, h.UUID, h.HardwareSerial, tokID)
 	}
 
 	// create teams
@@ -60,8 +74,6 @@ func TestMacosSetupAssistant(t *testing.T) {
 	err = ds.AddHostsToTeam(ctx, &tm2.ID, []uint{hosts[4].ID, hosts[5].ID})
 	require.NoError(t, err)
 
-	mysql.SetTestABMAssets(t, ds)
-
 	logger := kitlog.NewNopLogger()
 	depStorage, err := ds.NewMDMAppleDEPStorage()
 	require.NoError(t, err)
@@ -126,7 +138,11 @@ func TestMacosSetupAssistant(t *testing.T) {
 		}
 	}))
 	defer srv.Close()
-	err = depStorage.StoreConfig(ctx, apple_mdm.DEPName, &nanodep_client.Config{BaseURL: srv.URL})
+	err = depStorage.StoreConfig(ctx, "fleet", &nanodep_client.Config{BaseURL: srv.URL})
+	require.NoError(t, err)
+	err = depStorage.StoreConfig(ctx, org1Name, &nanodep_client.Config{BaseURL: srv.URL})
+	require.NoError(t, err)
+	err = depStorage.StoreConfig(ctx, org2Name, &nanodep_client.Config{BaseURL: srv.URL})
 	require.NoError(t, err)
 
 	w := NewWorker(ds, logger)
@@ -160,12 +176,22 @@ func TestMacosSetupAssistant(t *testing.T) {
 	require.NoError(t, err)
 	require.NotEmpty(t, autoProf.Token)
 
-	tmIDs := []*uint{nil, ptr.Uint(tm1.ID), ptr.Uint(tm2.ID), ptr.Uint(tm3.ID)}
+	getTeamID := func(tmID *uint) string {
+		if tmID == nil {
+			return "null"
+		}
+
+		return strconv.Itoa(int(*tmID))
+	}
+
+	tmIDs := []*uint{nil, ptr.Uint(tm1.ID), ptr.Uint(tm2.ID)}
 	for _, tmID := range tmIDs {
-		profUUID, modTime, err := ds.GetMDMAppleDefaultSetupAssistant(ctx, tmID)
-		require.NoError(t, err)
-		require.Equal(t, defaultProfileName, profUUID)
-		require.False(t, modTime.Before(start))
+		for _, org := range []string{org1Name, org2Name} {
+			profUUID, modTime, err := ds.GetMDMAppleDefaultSetupAssistant(ctx, tmID, org)
+			require.NoError(t, err)
+			require.Equal(t, defaultProfileName, profUUID, "tmID", getTeamID(tmID))
+			require.False(t, modTime.Before(start))
+		}
 	}
 	require.Equal(t, map[string]string{
 		"serial-0": defaultProfileName,
@@ -190,16 +216,24 @@ func TestMacosSetupAssistant(t *testing.T) {
 
 	// default profile is unchanged
 	for _, tmID := range tmIDs {
-		profUUID, modTime, err := ds.GetMDMAppleDefaultSetupAssistant(ctx, tmID)
-		require.NoError(t, err)
-		require.Equal(t, defaultProfileName, profUUID)
-		require.False(t, modTime.Before(start))
+		for _, org := range []string{org1Name, org2Name} {
+			profUUID, modTime, err := ds.GetMDMAppleDefaultSetupAssistant(ctx, tmID, org)
+			require.NoError(t, err)
+			require.Equal(t, defaultProfileName, profUUID)
+			require.False(t, modTime.Before(start))
+		}
 	}
 
-	// team 1 setup assistant is registered
+	// team 1 setup assistant is registered for both tokens
 	tm1Asst, err = ds.GetMDMAppleSetupAssistant(ctx, &tm1.ID)
 	require.NoError(t, err)
-	require.Equal(t, "team1", tm1Asst.ProfileUUID)
+	require.NotNil(t, tm1Asst)
+	for _, org := range []string{org1Name, org2Name} {
+		profUUID, modTime, err := ds.GetMDMAppleSetupAssistantProfileForABMToken(ctx, &tm1.ID, org)
+		require.NoError(t, err)
+		require.Equal(t, "team1", profUUID)
+		require.False(t, modTime.Before(start))
+	}
 
 	require.Equal(t, map[string]string{
 		"serial-0": defaultProfileName,
@@ -323,20 +357,40 @@ func TestMacosSetupAssistant(t *testing.T) {
 		"serial-5": "no-team", // became a no-team host when team2 got deleted
 	}, serialsToProfile)
 
-	// check that profiles get re-generated
-	reset := time.Now().Truncate(time.Second)
-	time.Sleep(time.Second)
-
+	// check that profiles get re-generated (note that timestamps are not
+	// impacted as the content of the profiles did not change)
 	_, err = QueueMacosSetupAssistantJob(ctx, ds, logger, MacosSetupAssistantUpdateAllProfiles, nil)
 	require.NoError(t, err)
 	runCheckDone()
 
 	// team 2 got deleted, update the list of team IDs
 	tmIDs = []*uint{nil, ptr.Uint(tm1.ID), ptr.Uint(tm3.ID)}
-	for _, tmID := range tmIDs {
-		_, modTime, err := ds.GetMDMAppleDefaultSetupAssistant(ctx, tmID)
-		require.NoError(t, err)
-		require.True(t, modTime.After(reset))
+	for i, tmID := range tmIDs {
+		for _, org := range []string{org1Name, org2Name} {
+			// no team and team 3 have a custom setup assistant
+			switch i {
+			case 0: // no team
+				// custom profile defined for both orgs
+				_, _, err := ds.GetMDMAppleSetupAssistantProfileForABMToken(ctx, tmID, org)
+				require.NoError(t, err, "%v - %v", i, org)
+			case 1: // tm1
+				// team 1 uses the default setup assistant, and it is only defined for org1
+				_, _, err := ds.GetMDMAppleDefaultSetupAssistant(ctx, tmID, org)
+				if org == org1Name {
+					require.NoError(t, err, "%v - %v", i, org)
+				} else {
+					require.ErrorIs(t, err, sql.ErrNoRows, "%v - %v", i, org)
+				}
+			case 2: // tm3
+				_, _, err := ds.GetMDMAppleSetupAssistantProfileForABMToken(ctx, tmID, org)
+				// custom setup assistant only defined for org2
+				if org == org2Name {
+					require.NoError(t, err, "%v - %v", i, org)
+				} else {
+					require.ErrorIs(t, err, sql.ErrNoRows, "%v - %v", i, org)
+				}
+			}
+		}
 	}
 
 	require.Equal(t, map[string]string{
diff --git a/terraform/README.md b/terraform/README.md
index 76e36faf88..f8015f428c 100644
--- a/terraform/README.md
+++ b/terraform/README.md
@@ -75,9 +75,9 @@ No resources.
 | <a name="input_alb_config"></a> [alb\_config](#input\_alb\_config) | n/a | <pre>object({<br>    name                 = optional(string, "fleet")<br>    security_groups      = optional(list(string), [])<br>    access_logs          = optional(map(string), {})<br>    allowed_cidrs        = optional(list(string), ["0.0.0.0/0"])<br>    allowed_ipv6_cidrs   = optional(list(string), ["::/0"])<br>    egress_cidrs         = optional(list(string), ["0.0.0.0/0"])<br>    egress_ipv6_cidrs    = optional(list(string), ["::/0"])<br>    extra_target_groups  = optional(any, [])<br>    https_listener_rules = optional(any, [])<br>    tls_policy           = optional(string, "ELBSecurityPolicy-TLS-1-2-2017-01")<br>    idle_timeout         = optional(number, 60)<br>  })</pre> | `{}` | no |
 | <a name="input_certificate_arn"></a> [certificate\_arn](#input\_certificate\_arn) | n/a | `string` | n/a | yes |
 | <a name="input_ecs_cluster"></a> [ecs\_cluster](#input\_ecs\_cluster) | The config for the terraform-aws-modules/ecs/aws module | <pre>object({<br>    autoscaling_capacity_providers = optional(any, {})<br>    cluster_configuration = optional(any, {<br>      execute_command_configuration = {<br>        logging = "OVERRIDE"<br>        log_configuration = {<br>          cloud_watch_log_group_name = "/aws/ecs/aws-ec2"<br>        }<br>      }<br>    })<br>    cluster_name = optional(string, "fleet")<br>    cluster_settings = optional(map(string), {<br>      "name" : "containerInsights",<br>      "value" : "enabled",<br>    })<br>    create                                = optional(bool, true)<br>    default_capacity_provider_use_fargate = optional(bool, true)<br>    fargate_capacity_providers = optional(any, {<br>      FARGATE = {<br>        default_capacity_provider_strategy = {<br>          weight = 100<br>        }<br>      }<br>      FARGATE_SPOT = {<br>        default_capacity_provider_strategy = {<br>          weight = 0<br>        }<br>      }<br>    })<br>    tags = optional(map(string))<br>  })</pre> | <pre>{<br>  "autoscaling_capacity_providers": {},<br>  "cluster_configuration": {<br>    "execute_command_configuration": {<br>      "log_configuration": {<br>        "cloud_watch_log_group_name": "/aws/ecs/aws-ec2"<br>      },<br>      "logging": "OVERRIDE"<br>    }<br>  },<br>  "cluster_name": "fleet",<br>  "cluster_settings": {<br>    "name": "containerInsights",<br>    "value": "enabled"<br>  },<br>  "create": true,<br>  "default_capacity_provider_use_fargate": true,<br>  "fargate_capacity_providers": {<br>    "FARGATE": {<br>      "default_capacity_provider_strategy": {<br>        "weight": 100<br>      }<br>    },<br>    "FARGATE_SPOT": {<br>      "default_capacity_provider_strategy": {<br>        "weight": 0<br>      }<br>    }<br>  },<br>  "tags": {}<br>}</pre> | no |
-| <a name="input_fleet_config"></a> [fleet\_config](#input\_fleet\_config) | The configuration object for Fleet itself. Fields that default to null will have their respective resources created if not specified. | <pre>object({<br>    task_mem                     = optional(number, null)<br>    task_cpu                     = optional(number, null)<br>    mem                          = optional(number, 4096)<br>    cpu                          = optional(number, 512)<br>    pid_mode                     = optional(string, null)<br>    image                        = optional(string, "fleetdm/fleet:v4.54.1")<br>    family                       = optional(string, "fleet")<br>    sidecars                     = optional(list(any), [])<br>    depends_on                   = optional(list(any), [])<br>    mount_points                 = optional(list(any), [])<br>    volumes                      = optional(list(any), [])<br>    extra_environment_variables  = optional(map(string), {})<br>    extra_iam_policies           = optional(list(string), [])<br>    extra_execution_iam_policies = optional(list(string), [])<br>    extra_secrets                = optional(map(string), {})<br>    security_groups              = optional(list(string), null)<br>    security_group_name          = optional(string, "fleet")<br>    iam_role_arn                 = optional(string, null)<br>    repository_credentials       = optional(string, "")<br>    private_key_secret_name      = optional(string, "fleet-server-private-key")<br>    service = optional(object({<br>      name = optional(string, "fleet")<br>      }), {<br>      name = "fleet"<br>    })<br>    database = optional(object({<br>      password_secret_arn = string<br>      user                = string<br>      database            = string<br>      address             = string<br>      rr_address          = optional(string, null)<br>      }), {<br>      password_secret_arn = null<br>      user                = null<br>      database            = null<br>      address             = null<br>      rr_address          = null<br>    })<br>    redis = optional(object({<br>      address = string<br>      use_tls = optional(bool, true)<br>      }), {<br>      address = null<br>      use_tls = true<br>    })<br>    awslogs = optional(object({<br>      name      = optional(string, null)<br>      region    = optional(string, null)<br>      create    = optional(bool, true)<br>      prefix    = optional(string, "fleet")<br>      retention = optional(number, 5)<br>      }), {<br>      name      = null<br>      region    = null<br>      prefix    = "fleet"<br>      retention = 5<br>    })<br>    loadbalancer = optional(object({<br>      arn = string<br>      }), {<br>      arn = null<br>    })<br>    extra_load_balancers = optional(list(any), [])<br>    networking = optional(object({<br>      subnets         = optional(list(string), null)<br>      security_groups = optional(list(string), null)<br>      ingress_sources = optional(object({<br>        cidr_blocks      = optional(list(string), [])<br>        ipv6_cidr_blocks = optional(list(string), [])<br>        security_groups  = optional(list(string), [])<br>        prefix_list_ids  = optional(list(string), [])<br>        }), {<br>        cidr_blocks      = []<br>        ipv6_cidr_blocks = []<br>        security_groups  = []<br>        prefix_list_ids  = []<br>      })<br>      }), {<br>      subnets         = null<br>      security_groups = null<br>      ingress_sources = {<br>        cidr_blocks      = []<br>        ipv6_cidr_blocks = []<br>        security_groups  = []<br>        prefix_list_ids  = []<br>      }<br>    })<br>    autoscaling = optional(object({<br>      max_capacity                 = optional(number, 5)<br>      min_capacity                 = optional(number, 1)<br>      memory_tracking_target_value = optional(number, 80)<br>      cpu_tracking_target_value    = optional(number, 80)<br>      }), {<br>      max_capacity                 = 5<br>      min_capacity                 = 1<br>      memory_tracking_target_value = 80<br>      cpu_tracking_target_value    = 80<br>    })<br>    iam = optional(object({<br>      role = optional(object({<br>        name        = optional(string, "fleet-role")<br>        policy_name = optional(string, "fleet-iam-policy")<br>        }), {<br>        name        = "fleet-role"<br>        policy_name = "fleet-iam-policy"<br>      })<br>      execution = optional(object({<br>        name        = optional(string, "fleet-execution-role")<br>        policy_name = optional(string, "fleet-execution-role")<br>        }), {<br>        name        = "fleet-execution-role"<br>        policy_name = "fleet-iam-policy-execution"<br>      })<br>      }), {<br>      name = "fleetdm-execution-role"<br>    })<br>    software_installers = optional(object({<br>      create_bucket    = optional(bool, true)<br>      bucket_name      = optional(string, null)<br>      bucket_prefix    = optional(string, "fleet-software-installers-")<br>      s3_object_prefix = optional(string, "")<br>      }), {<br>      create_bucket    = true<br>      bucket_name      = null<br>      bucket_prefix    = "fleet-software-installers-"<br>      s3_object_prefix = ""<br>    })<br>  })</pre> | <pre>{<br>  "autoscaling": {<br>    "cpu_tracking_target_value": 80,<br>    "max_capacity": 5,<br>    "memory_tracking_target_value": 80,<br>    "min_capacity": 1<br>  },<br>  "awslogs": {<br>    "create": true,<br>    "name": null,<br>    "prefix": "fleet",<br>    "region": null,<br>    "retention": 5<br>  },<br>  "cpu": 256,<br>  "database": {<br>    "address": null,<br>    "database": null,<br>    "password_secret_arn": null,<br>    "rr_address": null,<br>    "user": null<br>  },<br>  "depends_on": [],<br>  "extra_environment_variables": {},<br>  "extra_execution_iam_policies": [],<br>  "extra_iam_policies": [],<br>  "extra_load_balancers": [],<br>  "extra_secrets": {},<br>  "family": "fleet",<br>  "iam": {<br>    "execution": {<br>      "name": "fleet-execution-role",<br>      "policy_name": "fleet-iam-policy-execution"<br>    },<br>    "role": {<br>      "name": "fleet-role",<br>      "policy_name": "fleet-iam-policy"<br>    }<br>  },<br>  "iam_role_arn": null,<br>  "image": "fleetdm/fleet:v4.54.1",<br>  "loadbalancer": {<br>    "arn": null<br>  },<br>  "mem": 512,<br>  "mount_points": [],<br>  "networking": {<br>    "ingress_sources": {<br>      "cidr_blocks": [],<br>      "ipv6_cidr_blocks": [],<br>      "prefix_list_ids": [],<br>      "security_groups": []<br>    },<br>    "security_groups": null,<br>    "subnets": null<br>  },<br>  "pid_mode": null,<br>  "private_key_secret_name": "fleet-server-private-key",<br>  "redis": {<br>    "address": null,<br>    "use_tls": true<br>  },<br>  "repository_credentials": "",<br>  "security_group_name": "fleet",<br>  "security_groups": null,<br>  "service": {<br>    "name": "fleet"<br>  },<br>  "sidecars": [],<br>  "software_installers": {<br>    "bucket_name": null,<br>    "bucket_prefix": "fleet-software-installers-",<br>    "create_bucket": true,<br>    "s3_object_prefix": ""<br>  },<br>  "task_cpu": null,<br>  "task_mem": null,<br>  "volumes": []<br>}</pre> | no |
+| <a name="input_fleet_config"></a> [fleet\_config](#input\_fleet\_config) | The configuration object for Fleet itself. Fields that default to null will have their respective resources created if not specified. | <pre>object({<br>    task_mem                     = optional(number, null)<br>    task_cpu                     = optional(number, null)<br>    mem                          = optional(number, 4096)<br>    cpu                          = optional(number, 512)<br>    pid_mode                     = optional(string, null)<br>    image                        = optional(string, "fleetdm/fleet:v4.54.1")<br>    family                       = optional(string, "fleet")<br>    sidecars                     = optional(list(any), [])<br>    depends_on                   = optional(list(any), [])<br>    mount_points                 = optional(list(any), [])<br>    volumes                      = optional(list(any), [])<br>    extra_environment_variables  = optional(map(string), {})<br>    extra_iam_policies           = optional(list(string), [])<br>    extra_execution_iam_policies = optional(list(string), [])<br>    extra_secrets                = optional(map(string), {})<br>    security_group_name          = optional(string, "fleet")<br>    iam_role_arn                 = optional(string, null)<br>    repository_credentials       = optional(string, "")<br>    private_key_secret_name      = optional(string, "fleet-server-private-key")<br>    service = optional(object({<br>      name = optional(string, "fleet")<br>      }), {<br>      name = "fleet"<br>    })<br>    database = optional(object({<br>      password_secret_arn = string<br>      user                = string<br>      database            = string<br>      address             = string<br>      rr_address          = optional(string, null)<br>      }), {<br>      password_secret_arn = null<br>      user                = null<br>      database            = null<br>      address             = null<br>      rr_address          = null<br>    })<br>    redis = optional(object({<br>      address = string<br>      use_tls = optional(bool, true)<br>      }), {<br>      address = null<br>      use_tls = true<br>    })<br>    awslogs = optional(object({<br>      name      = optional(string, null)<br>      region    = optional(string, null)<br>      create    = optional(bool, true)<br>      prefix    = optional(string, "fleet")<br>      retention = optional(number, 5)<br>      }), {<br>      name      = null<br>      region    = null<br>      prefix    = "fleet"<br>      retention = 5<br>    })<br>    loadbalancer = optional(object({<br>      arn = string<br>      }), {<br>      arn = null<br>    })<br>    extra_load_balancers = optional(list(any), [])<br>    networking = optional(object({<br>      subnets         = optional(list(string), null)<br>      security_groups = optional(list(string), null)<br>      ingress_sources = optional(object({<br>        cidr_blocks      = optional(list(string), [])<br>        ipv6_cidr_blocks = optional(list(string), [])<br>        security_groups  = optional(list(string), [])<br>        prefix_list_ids  = optional(list(string), [])<br>        }), {<br>        cidr_blocks      = []<br>        ipv6_cidr_blocks = []<br>        security_groups  = []<br>        prefix_list_ids  = []<br>      })<br>      }), {<br>      subnets         = null<br>      security_groups = null<br>      ingress_sources = {<br>        cidr_blocks      = []<br>        ipv6_cidr_blocks = []<br>        security_groups  = []<br>        prefix_list_ids  = []<br>      }<br>    })<br>    autoscaling = optional(object({<br>      max_capacity                 = optional(number, 5)<br>      min_capacity                 = optional(number, 1)<br>      memory_tracking_target_value = optional(number, 80)<br>      cpu_tracking_target_value    = optional(number, 80)<br>      }), {<br>      max_capacity                 = 5<br>      min_capacity                 = 1<br>      memory_tracking_target_value = 80<br>      cpu_tracking_target_value    = 80<br>    })<br>    iam = optional(object({<br>      role = optional(object({<br>        name        = optional(string, "fleet-role")<br>        policy_name = optional(string, "fleet-iam-policy")<br>        }), {<br>        name        = "fleet-role"<br>        policy_name = "fleet-iam-policy"<br>      })<br>      execution = optional(object({<br>        name        = optional(string, "fleet-execution-role")<br>        policy_name = optional(string, "fleet-execution-role")<br>        }), {<br>        name        = "fleet-execution-role"<br>        policy_name = "fleet-iam-policy-execution"<br>      })<br>      }), {<br>      name = "fleetdm-execution-role"<br>    })<br>    software_installers = optional(object({<br>      create_bucket    = optional(bool, true)<br>      bucket_name      = optional(string, null)<br>      bucket_prefix    = optional(string, "fleet-software-installers-")<br>      s3_object_prefix = optional(string, "")<br>      }), {<br>      create_bucket    = true<br>      bucket_name      = null<br>      bucket_prefix    = "fleet-software-installers-"<br>      s3_object_prefix = ""<br>    })<br>  })</pre> | <pre>{<br>  "autoscaling": {<br>    "cpu_tracking_target_value": 80,<br>    "max_capacity": 5,<br>    "memory_tracking_target_value": 80,<br>    "min_capacity": 1<br>  },<br>  "awslogs": {<br>    "create": true,<br>    "name": null,<br>    "prefix": "fleet",<br>    "region": null,<br>    "retention": 5<br>  },<br>  "cpu": 256,<br>  "database": {<br>    "address": null,<br>    "database": null,<br>    "password_secret_arn": null,<br>    "rr_address": null,<br>    "user": null<br>  },<br>  "depends_on": [],<br>  "extra_environment_variables": {},<br>  "extra_execution_iam_policies": [],<br>  "extra_iam_policies": [],<br>  "extra_load_balancers": [],<br>  "extra_secrets": {},<br>  "family": "fleet",<br>  "iam": {<br>    "execution": {<br>      "name": "fleet-execution-role",<br>      "policy_name": "fleet-iam-policy-execution"<br>    },<br>    "role": {<br>      "name": "fleet-role",<br>      "policy_name": "fleet-iam-policy"<br>    }<br>  },<br>  "iam_role_arn": null,<br>  "image": "fleetdm/fleet:v4.54.1",<br>  "loadbalancer": {<br>    "arn": null<br>  },<br>  "mem": 512,<br>  "mount_points": [],<br>  "networking": {<br>    "ingress_sources": {<br>      "cidr_blocks": [],<br>      "ipv6_cidr_blocks": [],<br>      "prefix_list_ids": [],<br>      "security_groups": []<br>    },<br>    "security_groups": null,<br>    "subnets": null<br>  },<br>  "pid_mode": null,<br>  "private_key_secret_name": "fleet-server-private-key",<br>  "redis": {<br>    "address": null,<br>    "use_tls": true<br>  },<br>  "repository_credentials": "",<br>  "security_group_name": "fleet",<br>  "security_groups": null,<br>  "service": {<br>    "name": "fleet"<br>  },<br>  "sidecars": [],<br>  "software_installers": {<br>    "bucket_name": null,<br>    "bucket_prefix": "fleet-software-installers-",<br>    "create_bucket": true,<br>    "s3_object_prefix": ""<br>  },<br>  "task_cpu": null,<br>  "task_mem": null,<br>  "volumes": []<br>}</pre> | no |
 | <a name="input_migration_config"></a> [migration\_config](#input\_migration\_config) | The configuration object for Fleet's migration task. | <pre>object({<br>    mem = number<br>    cpu = number<br>  })</pre> | <pre>{<br>  "cpu": 1024,<br>  "mem": 2048<br>}</pre> | no |
-| <a name="input_rds_config"></a> [rds\_config](#input\_rds\_config) | The config for the terraform-aws-modules/rds-aurora/aws module | <pre>object({<br>    name                            = optional(string, "fleet")<br>    engine_version                  = optional(string, "8.0.mysql_aurora.3.04.2")<br>    instance_class                  = optional(string, "db.t4g.large")<br>    subnets                         = optional(list(string), [])<br>    allowed_security_groups         = optional(list(string), [])<br>    allowed_cidr_blocks             = optional(list(string), [])<br>    apply_immediately               = optional(bool, true)<br>    monitoring_interval             = optional(number, 10)<br>    db_parameter_group_name         = optional(string)<br>    db_parameters                   = optional(map(string), {})<br>    db_cluster_parameter_group_name = optional(string)<br>    db_cluster_parameters           = optional(map(string), {})<br>    enabled_cloudwatch_logs_exports = optional(list(string), [])<br>    master_username                 = optional(string, "fleet")<br>    snapshot_identifier             = optional(string)<br>    cluster_tags                    = optional(map(string), {})<br>  })</pre> | <pre>{<br>  "allowed_cidr_blocks": [],<br>  "allowed_security_groups": [],<br>  "apply_immediately": true,<br>  "cluster_tags": {},<br>  "db_cluster_parameter_group_name": null,<br>  "db_cluster_parameters": {},<br>  "db_parameter_group_name": null,<br>  "db_parameters": {},<br>  "enabled_cloudwatch_logs_exports": [],<br>  "engine_version": "8.0.mysql_aurora.3.04.2",<br>  "instance_class": "db.t4g.large",<br>  "master_username": "fleet",<br>  "monitoring_interval": 10,<br>  "name": "fleet",<br>  "snapshot_identifier": null,<br>  "subnets": []<br>}</pre> | no |
+| <a name="input_rds_config"></a> [rds\_config](#input\_rds\_config) | The config for the terraform-aws-modules/rds-aurora/aws module | <pre>object({<br>    name                            = optional(string, "fleet")<br>    engine_version                  = optional(string, "8.0.mysql_aurora.3.07.1")<br>    instance_class                  = optional(string, "db.t4g.large")<br>    subnets                         = optional(list(string), [])<br>    allowed_security_groups         = optional(list(string), [])<br>    allowed_cidr_blocks             = optional(list(string), [])<br>    apply_immediately               = optional(bool, true)<br>    monitoring_interval             = optional(number, 10)<br>    db_parameter_group_name         = optional(string)<br>    db_parameters                   = optional(map(string), {})<br>    db_cluster_parameter_group_name = optional(string)<br>    db_cluster_parameters           = optional(map(string), {})<br>    enabled_cloudwatch_logs_exports = optional(list(string), [])<br>    master_username                 = optional(string, "fleet")<br>    snapshot_identifier             = optional(string)<br>    cluster_tags                    = optional(map(string), {})<br>  })</pre> | <pre>{<br>  "allowed_cidr_blocks": [],<br>  "allowed_security_groups": [],<br>  "apply_immediately": true,<br>  "cluster_tags": {},<br>  "db_cluster_parameter_group_name": null,<br>  "db_cluster_parameters": {},<br>  "db_parameter_group_name": null,<br>  "db_parameters": {},<br>  "enabled_cloudwatch_logs_exports": [],<br>  "engine_version": "8.0.mysql_aurora.3.07.1",<br>  "instance_class": "db.t4g.large",<br>  "master_username": "fleet",<br>  "monitoring_interval": 10,<br>  "name": "fleet",<br>  "snapshot_identifier": null,<br>  "subnets": []<br>}</pre> | no |
 | <a name="input_redis_config"></a> [redis\_config](#input\_redis\_config) | n/a | <pre>object({<br>    name                          = optional(string, "fleet")<br>    replication_group_id          = optional(string)<br>    elasticache_subnet_group_name = optional(string)<br>    allowed_security_group_ids    = optional(list(string), [])<br>    subnets                       = optional(list(string))<br>    availability_zones            = optional(list(string))<br>    cluster_size                  = optional(number, 3)<br>    instance_type                 = optional(string, "cache.m5.large")<br>    apply_immediately             = optional(bool, true)<br>    automatic_failover_enabled    = optional(bool, false)<br>    engine_version                = optional(string, "6.x")<br>    family                        = optional(string, "redis6.x")<br>    at_rest_encryption_enabled    = optional(bool, true)<br>    transit_encryption_enabled    = optional(bool, true)<br>    parameter = optional(list(object({<br>      name  = string<br>      value = string<br>    })), [])<br>    log_delivery_configuration = optional(list(map(any)), [])<br>    tags                       = optional(map(string), {})<br>  })</pre> | <pre>{<br>  "allowed_security_group_ids": [],<br>  "apply_immediately": true,<br>  "at_rest_encryption_enabled": true,<br>  "automatic_failover_enabled": false,<br>  "availability_zones": null,<br>  "cluster_size": 3,<br>  "elasticache_subnet_group_name": null,<br>  "engine_version": "6.x",<br>  "family": "redis6.x",<br>  "instance_type": "cache.m5.large",<br>  "log_delivery_configuration": [],<br>  "name": "fleet",<br>  "parameter": [],<br>  "replication_group_id": null,<br>  "subnets": null,<br>  "tags": {},<br>  "transit_encryption_enabled": true<br>}</pre> | no |
 | <a name="input_vpc"></a> [vpc](#input\_vpc) | n/a | <pre>object({<br>    name                = optional(string, "fleet")<br>    cidr                = optional(string, "10.10.0.0/16")<br>    azs                 = optional(list(string), ["us-east-2a", "us-east-2b", "us-east-2c"])<br>    private_subnets     = optional(list(string), ["10.10.1.0/24", "10.10.2.0/24", "10.10.3.0/24"])<br>    public_subnets      = optional(list(string), ["10.10.11.0/24", "10.10.12.0/24", "10.10.13.0/24"])<br>    database_subnets    = optional(list(string), ["10.10.21.0/24", "10.10.22.0/24", "10.10.23.0/24"])<br>    elasticache_subnets = optional(list(string), ["10.10.31.0/24", "10.10.32.0/24", "10.10.33.0/24"])<br><br>    create_database_subnet_group              = optional(bool, false)<br>    create_database_subnet_route_table        = optional(bool, true)<br>    create_elasticache_subnet_group           = optional(bool, true)<br>    create_elasticache_subnet_route_table     = optional(bool, true)<br>    enable_vpn_gateway                        = optional(bool, false)<br>    one_nat_gateway_per_az                    = optional(bool, false)<br>    single_nat_gateway                        = optional(bool, true)<br>    enable_nat_gateway                        = optional(bool, true)<br>    enable_dns_hostnames                      = optional(bool, false)<br>    enable_dns_support                        = optional(bool, true)<br>    enable_flow_log                           = optional(bool, false)<br>    create_flow_log_cloudwatch_log_group      = optional(bool, false)<br>    create_flow_log_cloudwatch_iam_role       = optional(bool, false)<br>    flow_log_max_aggregation_interval         = optional(number, 600)<br>    flow_log_cloudwatch_log_group_name_prefix = optional(string, "/aws/vpc-flow-log/")<br>    flow_log_cloudwatch_log_group_name_suffix = optional(string, "")<br>    vpc_flow_log_tags                         = optional(map(string), {})<br>  })</pre> | <pre>{<br>  "azs": [<br>    "us-east-2a",<br>    "us-east-2b",<br>    "us-east-2c"<br>  ],<br>  "cidr": "10.10.0.0/16",<br>  "create_database_subnet_group": false,<br>  "create_database_subnet_route_table": true,<br>  "create_elasticache_subnet_group": true,<br>  "create_elasticache_subnet_route_table": true,<br>  "create_flow_log_cloudwatch_iam_role": false,<br>  "create_flow_log_cloudwatch_log_group": false,<br>  "database_subnets": [<br>    "10.10.21.0/24",<br>    "10.10.22.0/24",<br>    "10.10.23.0/24"<br>  ],<br>  "elasticache_subnets": [<br>    "10.10.31.0/24",<br>    "10.10.32.0/24",<br>    "10.10.33.0/24"<br>  ],<br>  "enable_dns_hostnames": false,<br>  "enable_dns_support": true,<br>  "enable_flow_log": false,<br>  "enable_nat_gateway": true,<br>  "enable_vpn_gateway": false,<br>  "flow_log_cloudwatch_log_group_name_prefix": "/aws/vpc-flow-log/",<br>  "flow_log_cloudwatch_log_group_name_suffix": "",<br>  "flow_log_max_aggregation_interval": 600,<br>  "name": "fleet",<br>  "one_nat_gateway_per_az": false,<br>  "private_subnets": [<br>    "10.10.1.0/24",<br>    "10.10.2.0/24",<br>    "10.10.3.0/24"<br>  ],<br>  "public_subnets": [<br>    "10.10.11.0/24",<br>    "10.10.12.0/24",<br>    "10.10.13.0/24"<br>  ],<br>  "single_nat_gateway": true,<br>  "vpc_flow_log_tags": {}<br>}</pre> | no |
 
diff --git a/terraform/addons/mdm/README.md b/terraform/addons/mdm/README.md
index 0cb04aac59..4acccf3d9b 100644
--- a/terraform/addons/mdm/README.md
+++ b/terraform/addons/mdm/README.md
@@ -1,7 +1,7 @@
 # MDM addon
 
 Notice: Previous versions of this module referred to `dep`, but to reduce confusion that has been replaces with `abm`
-to mach the change to the newer Apple Busines Manager.  For each key/value pair below, the key names have been changed
+to mach the change to the newer Apple Business Manager.  For each key/value pair below, the key names have been changed
 from previous version to match the name of the env var for easier usability.  Older unused env vars were also removed
 for simplification.  This includes removing the need for `extra_environment_variables` completely.
 
diff --git a/terraform/addons/mdmproxy/main.tf b/terraform/addons/mdmproxy/main.tf
index 4e57a0dcfe..5d4a7ca51a 100644
--- a/terraform/addons/mdmproxy/main.tf
+++ b/terraform/addons/mdmproxy/main.tf
@@ -140,6 +140,11 @@ resource "aws_ecs_service" "mdmproxy" {
   desired_count                      = var.config.desired_count
   deployment_minimum_healthy_percent = 100
   deployment_maximum_percent         = 200
+  force_new_deployment               = true
+
+  triggers = {
+    redeployment = md5(jsonencode(aws_secretsmanager_secret_version.mdmproxy.secret_string))
+  }
 
   load_balancer {
     target_group_arn = module.alb.target_group_arns[0]
diff --git a/terraform/addons/monitoring/lambda/go.mod b/terraform/addons/monitoring/lambda/go.mod
index 5e7c002f41..bd2389b8ef 100644
--- a/terraform/addons/monitoring/lambda/go.mod
+++ b/terraform/addons/monitoring/lambda/go.mod
@@ -1,6 +1,6 @@
 module github.com/fleetdm/fleet/terraform/addons/monitoring/lambda
 
-go 1.22.4
+go 1.23.1
 
 require (
 	github.com/aws/aws-lambda-go v1.41.0
diff --git a/terraform/addons/saml-auth-proxy/README.md b/terraform/addons/saml-auth-proxy/README.md
index cae388b2b3..baaa39bac4 100644
--- a/terraform/addons/saml-auth-proxy/README.md
+++ b/terraform/addons/saml-auth-proxy/README.md
@@ -32,6 +32,7 @@ No requirements.
 
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
+| <a name="input_alb_access_logs"></a> [alb\_access\_logs](#input\_alb\_access\_logs) | n/a | `map(string)` | `{}` | no |
 | <a name="input_alb_target_group_arn"></a> [alb\_target\_group\_arn](#input\_alb\_target\_group\_arn) | n/a | `string` | n/a | yes |
 | <a name="input_base_url"></a> [base\_url](#input\_base\_url) | n/a | `string` | n/a | yes |
 | <a name="input_cookie_max_age"></a> [cookie\_max\_age](#input\_cookie\_max\_age) | n/a | `string` | `"1h"` | no |
@@ -53,6 +54,7 @@ No requirements.
 |------|-------------|
 | <a name="output_fleet_extra_execution_policies"></a> [fleet\_extra\_execution\_policies](#output\_fleet\_extra\_execution\_policies) | n/a |
 | <a name="output_lb"></a> [lb](#output\_lb) | n/a |
+| <a name="output_lb_security_group"></a> [lb\_security\_group](#output\_lb\_security\_group) | n/a |
 | <a name="output_lb_target_group_arn"></a> [lb\_target\_group\_arn](#output\_lb\_target\_group\_arn) | Keep for legacy support for now |
 | <a name="output_name"></a> [name](#output\_name) | n/a |
 | <a name="output_secretsmanager_secret_id"></a> [secretsmanager\_secret\_id](#output\_secretsmanager\_secret\_id) | n/a |
diff --git a/terraform/addons/saml-auth-proxy/main.tf b/terraform/addons/saml-auth-proxy/main.tf
index 2148e41c4f..6daa975d44 100644
--- a/terraform/addons/saml-auth-proxy/main.tf
+++ b/terraform/addons/saml-auth-proxy/main.tf
@@ -82,7 +82,7 @@ module "saml_auth_proxy_alb" {
   subnets         = var.subnets
   security_groups = [aws_security_group.saml_auth_proxy_alb.id]
   # FIXME: Get this working eventually.
-  # access_logs     = var.alb_config.access_logs
+  access_logs = var.alb_access_logs
 
   internal = true
   target_groups = [
diff --git a/terraform/addons/saml-auth-proxy/outputs.tf b/terraform/addons/saml-auth-proxy/outputs.tf
index cea09cf5b3..afc268f9c8 100644
--- a/terraform/addons/saml-auth-proxy/outputs.tf
+++ b/terraform/addons/saml-auth-proxy/outputs.tf
@@ -17,6 +17,10 @@ output "lb" {
   value = module.saml_auth_proxy_alb
 }
 
+output "lb_security_group" {
+  value = aws_security_group.saml_auth_proxy_alb.id
+}
+
 output "secretsmanager_secret_id" {
   value = aws_secretsmanager_secret.saml_auth_proxy_cert.id
 }
diff --git a/terraform/addons/saml-auth-proxy/variables.tf b/terraform/addons/saml-auth-proxy/variables.tf
index 66aa6677d7..f441c643e3 100644
--- a/terraform/addons/saml-auth-proxy/variables.tf
+++ b/terraform/addons/saml-auth-proxy/variables.tf
@@ -7,6 +7,11 @@ variable "alb_target_group_arn" {
   type = string
 }
 
+variable "alb_access_logs" {
+  type    = map(string)
+  default = {}
+}
+
 # variable "public_alb_security_group_id" {
 #   type = string
 # }
diff --git a/terraform/addons/ses/main.tf b/terraform/addons/ses/main.tf
index 6c7304f1ba..00aec19fe0 100644
--- a/terraform/addons/ses/main.tf
+++ b/terraform/addons/ses/main.tf
@@ -1,3 +1,10 @@
+locals {
+  spf_domains = [
+    aws_ses_domain_identity.default.domain,
+    "_amazonses.${aws_ses_domain_identity.default.domain}"
+  ]
+}
+
 resource "aws_ses_domain_identity" "default" {
   domain = var.domain
 }
@@ -19,11 +26,12 @@ resource "aws_route53_record" "amazonses_dkim_record" {
 
 
 resource "aws_route53_record" "spf_domain" {
-  zone_id = var.zone_id
-  name    = "_amazonses.${aws_ses_domain_identity.default.domain}"
-  type    = "TXT"
-  ttl     = "600"
-  records = ["v=spf1 include:amazonses.com -all"]
+  for_each = toset(local.spf_domains)
+  zone_id  = var.zone_id
+  name     = each.key
+  type     = "TXT"
+  ttl      = "600"
+  records  = ["v=spf1 include:amazonses.com -all"]
 }
 
 resource "aws_iam_policy" "main" {
diff --git a/terraform/addons/ses/variables.tf b/terraform/addons/ses/variables.tf
index be93f34ccf..a174e55f0a 100644
--- a/terraform/addons/ses/variables.tf
+++ b/terraform/addons/ses/variables.tf
@@ -4,6 +4,6 @@ variable "domain" {
 }
 
 variable "zone_id" {
-  type = string
+  type        = string
   description = "Route53 Zone ID"
 }
diff --git a/terraform/addons/vuln-processing/variables.tf b/terraform/addons/vuln-processing/variables.tf
index eaea7243fa..feb850667d 100644
--- a/terraform/addons/vuln-processing/variables.tf
+++ b/terraform/addons/vuln-processing/variables.tf
@@ -24,7 +24,7 @@ variable "fleet_config" {
     vuln_processing_cpu                  = optional(number, 2048)
     vuln_data_stream_mem                 = optional(number, 1024)
     vuln_data_stream_cpu                 = optional(number, 512)
-    image                                = optional(string, "fleetdm/fleet:v4.54.1")
+    image                                = optional(string, "fleetdm/fleet:v4.56.0")
     family                               = optional(string, "fleet-vuln-processing")
     sidecars                             = optional(list(any), [])
     extra_environment_variables          = optional(map(string), {})
@@ -82,7 +82,7 @@ variable "fleet_config" {
     vuln_processing_cpu                  = 2048
     vuln_data_stream_mem                 = 1024
     vuln_data_stream_cpu                 = 512
-    image                                = "fleetdm/fleet:v4.54.1"
+    image                                = "fleetdm/fleet:v4.56.0"
     family                               = "fleet-vuln-processing"
     sidecars                             = []
     extra_environment_variables          = {}
diff --git a/terraform/addons/waf-alb/main.tf b/terraform/addons/waf-alb/main.tf
index 01099156cd..a62daf3e1b 100644
--- a/terraform/addons/waf-alb/main.tf
+++ b/terraform/addons/waf-alb/main.tf
@@ -1,4 +1,9 @@
-resource "aws_wafv2_rule_group" "main" {
+locals {
+  default_action = var.waf_type == "blocklist" ? "block" : "allow"
+}
+
+resource "aws_wafv2_rule_group" "blocked" {
+  count    = var.waf_type == "blocklist" ? 1 : 0
   name     = var.name
   scope    = "REGIONAL"
   capacity = 2
@@ -34,7 +39,7 @@ resource "aws_wafv2_rule_group" "main" {
 
     statement {
       ip_set_reference_statement {
-        arn = aws_wafv2_ip_set.main.arn
+        arn = aws_wafv2_ip_set.blocked[0].arn
       }
     }
 
@@ -52,19 +57,61 @@ resource "aws_wafv2_rule_group" "main" {
   }
 }
 
-resource "aws_wafv2_ip_set" "main" {
+resource "aws_wafv2_ip_set" "blocked" {
+  count              = var.waf_type == "blocklist" ? 1 : 0
   name               = var.name
   scope              = "REGIONAL"
   ip_address_version = "IPV4"
   addresses          = var.blocked_addresses
 }
 
+resource "aws_wafv2_rule_group" "allowed" {
+  count    = var.waf_type == "allowlist" ? 1 : 0
+  name     = var.name
+  scope    = "REGIONAL"
+  capacity = 2
+
+  rule {
+    name     = "specific"
+    priority = 1
+
+    action {
+      allow {}
+    }
+
+    statement {
+      ip_set_reference_statement {
+        arn = aws_wafv2_ip_set.allowed[0].arn
+      }
+    }
+
+    visibility_config {
+      cloudwatch_metrics_enabled = false
+      metric_name                = var.name
+      sampled_requests_enabled   = false
+    }
+  }
+
+  visibility_config {
+    cloudwatch_metrics_enabled = false
+    metric_name                = var.name
+    sampled_requests_enabled   = false
+  }
+}
+
 resource "aws_wafv2_web_acl" "main" {
   name  = var.name
   scope = "REGIONAL"
 
   default_action {
-    allow {}
+    dynamic "block" {
+      for_each = var.waf_type == "allowlist" ? [true] : []
+      content {}
+    }
+    dynamic "allow" {
+      for_each = var.waf_type == "blocklist" ? [true] : []
+      content {}
+    }
   }
 
   rule {
@@ -77,7 +124,7 @@ resource "aws_wafv2_web_acl" "main" {
 
     statement {
       rule_group_reference_statement {
-        arn = aws_wafv2_rule_group.main.arn
+        arn = var.waf_type == "blocklist" ? aws_wafv2_rule_group.blocked[0].arn : aws_wafv2_rule_group.allowed[0].arn
       }
     }
 
@@ -95,6 +142,15 @@ resource "aws_wafv2_web_acl" "main" {
   }
 }
 
+resource "aws_wafv2_ip_set" "allowed" {
+  count              = var.waf_type == "allowlist" ? 1 : 0
+  name               = var.name
+  scope              = "REGIONAL"
+  ip_address_version = "IPV4"
+  addresses          = var.allowed_addresses
+}
+
+
 resource "aws_wafv2_web_acl_association" "main" {
   resource_arn = var.lb_arn
   web_acl_arn  = aws_wafv2_web_acl.main.arn
diff --git a/terraform/addons/waf-alb/variables.tf b/terraform/addons/waf-alb/variables.tf
index 4afd23e80e..2c16acc653 100644
--- a/terraform/addons/waf-alb/variables.tf
+++ b/terraform/addons/waf-alb/variables.tf
@@ -2,6 +2,11 @@ variable "name" {}
 
 variable "lb_arn" {}
 
+variable "waf_type" {
+  type    = string
+  default = "blocklist"
+}
+
 variable "blocked_countries" {
   type    = list(string)
   default = ["BI", "BY", "CD", "CF", "CU", "IQ", "IR", "LB", "LY", "SD", "SO", "SS", "SY", "VE", "ZW", "RU"]
@@ -11,3 +16,8 @@ variable "blocked_addresses" {
   type    = list(string)
   default = []
 }
+
+variable "allowed_addresses" {
+  type    = list(string)
+  default = []
+}
diff --git a/terraform/byo-vpc/README.md b/terraform/byo-vpc/README.md
index 06dd43631b..16998b14b1 100644
--- a/terraform/byo-vpc/README.md
+++ b/terraform/byo-vpc/README.md
@@ -33,9 +33,9 @@ No requirements.
 |------|-------------|------|---------|:--------:|
 | <a name="input_alb_config"></a> [alb\_config](#input\_alb\_config) | n/a | <pre>object({<br>    name                 = optional(string, "fleet")<br>    subnets              = list(string)<br>    security_groups      = optional(list(string), [])<br>    access_logs          = optional(map(string), {})<br>    certificate_arn      = string<br>    allowed_cidrs        = optional(list(string), ["0.0.0.0/0"])<br>    allowed_ipv6_cidrs   = optional(list(string), ["::/0"])<br>    egress_cidrs         = optional(list(string), ["0.0.0.0/0"])<br>    egress_ipv6_cidrs    = optional(list(string), ["::/0"])<br>    extra_target_groups  = optional(any, [])<br>    https_listener_rules = optional(any, [])<br>    tls_policy           = optional(string, "ELBSecurityPolicy-TLS-1-2-2017-01")<br>    idle_timeout         = optional(number, 60)<br>  })</pre> | n/a | yes |
 | <a name="input_ecs_cluster"></a> [ecs\_cluster](#input\_ecs\_cluster) | The config for the terraform-aws-modules/ecs/aws module | <pre>object({<br>    autoscaling_capacity_providers = optional(any, {})<br>    cluster_configuration = optional(any, {<br>      execute_command_configuration = {<br>        logging = "OVERRIDE"<br>        log_configuration = {<br>          cloud_watch_log_group_name = "/aws/ecs/aws-ec2"<br>        }<br>      }<br>    })<br>    cluster_name = optional(string, "fleet")<br>    cluster_settings = optional(map(string), {<br>      "name" : "containerInsights",<br>      "value" : "enabled",<br>    })<br>    create                                = optional(bool, true)<br>    default_capacity_provider_use_fargate = optional(bool, true)<br>    fargate_capacity_providers = optional(any, {<br>      FARGATE = {<br>        default_capacity_provider_strategy = {<br>          weight = 100<br>        }<br>      }<br>      FARGATE_SPOT = {<br>        default_capacity_provider_strategy = {<br>          weight = 0<br>        }<br>      }<br>    })<br>    tags = optional(map(string))<br>  })</pre> | <pre>{<br>  "autoscaling_capacity_providers": {},<br>  "cluster_configuration": {<br>    "execute_command_configuration": {<br>      "log_configuration": {<br>        "cloud_watch_log_group_name": "/aws/ecs/aws-ec2"<br>      },<br>      "logging": "OVERRIDE"<br>    }<br>  },<br>  "cluster_name": "fleet",<br>  "cluster_settings": {<br>    "name": "containerInsights",<br>    "value": "enabled"<br>  },<br>  "create": true,<br>  "default_capacity_provider_use_fargate": true,<br>  "fargate_capacity_providers": {<br>    "FARGATE": {<br>      "default_capacity_provider_strategy": {<br>        "weight": 100<br>      }<br>    },<br>    "FARGATE_SPOT": {<br>      "default_capacity_provider_strategy": {<br>        "weight": 0<br>      }<br>    }<br>  },<br>  "tags": {}<br>}</pre> | no |
-| <a name="input_fleet_config"></a> [fleet\_config](#input\_fleet\_config) | The configuration object for Fleet itself. Fields that default to null will have their respective resources created if not specified. | <pre>object({<br>    task_mem                     = optional(number, null)<br>    task_cpu                     = optional(number, null)<br>    mem                          = optional(number, 4096)<br>    cpu                          = optional(number, 512)<br>    pid_mode                     = optional(string, null)<br>    image                        = optional(string, "fleetdm/fleet:v4.54.1")<br>    family                       = optional(string, "fleet")<br>    sidecars                     = optional(list(any), [])<br>    depends_on                   = optional(list(any), [])<br>    mount_points                 = optional(list(any), [])<br>    volumes                      = optional(list(any), [])<br>    extra_environment_variables  = optional(map(string), {})<br>    extra_iam_policies           = optional(list(string), [])<br>    extra_execution_iam_policies = optional(list(string), [])<br>    extra_secrets                = optional(map(string), {})<br>    security_groups              = optional(list(string), null)<br>    security_group_name          = optional(string, "fleet")<br>    iam_role_arn                 = optional(string, null)<br>    repository_credentials       = optional(string, "")<br>    private_key_secret_name      = optional(string, "fleet-server-private-key")<br>    service = optional(object({<br>      name = optional(string, "fleet")<br>      }), {<br>      name = "fleet"<br>    })<br>    database = optional(object({<br>      password_secret_arn = string<br>      user                = string<br>      database            = string<br>      address             = string<br>      rr_address          = optional(string, null)<br>      }), {<br>      password_secret_arn = null<br>      user                = null<br>      database            = null<br>      address             = null<br>      rr_address          = null<br>    })<br>    redis = optional(object({<br>      address = string<br>      use_tls = optional(bool, true)<br>      }), {<br>      address = null<br>      use_tls = true<br>    })<br>    awslogs = optional(object({<br>      name      = optional(string, null)<br>      region    = optional(string, null)<br>      create    = optional(bool, true)<br>      prefix    = optional(string, "fleet")<br>      retention = optional(number, 5)<br>      }), {<br>      name      = null<br>      region    = null<br>      prefix    = "fleet"<br>      retention = 5<br>    })<br>    loadbalancer = optional(object({<br>      arn = string<br>      }), {<br>      arn = null<br>    })<br>    extra_load_balancers = optional(list(any), [])<br>    networking = optional(object({<br>      subnets         = optional(list(string), null)<br>      security_groups = optional(list(string), null)<br>      ingress_sources = optional(object({<br>        cidr_blocks      = optional(list(string), [])<br>        ipv6_cidr_blocks = optional(list(string), [])<br>        security_groups  = optional(list(string), [])<br>        prefix_list_ids  = optional(list(string), [])<br>        }), {<br>        cidr_blocks      = []<br>        ipv6_cidr_blocks = []<br>        security_groups  = []<br>        prefix_list_ids  = []<br>      })<br>      }), {<br>      subnets         = null<br>      security_groups = null<br>      ingress_sources = {<br>        cidr_blocks      = []<br>        ipv6_cidr_blocks = []<br>        security_groups  = []<br>        prefix_list_ids  = []<br>      }<br>    })<br>    autoscaling = optional(object({<br>      max_capacity                 = optional(number, 5)<br>      min_capacity                 = optional(number, 1)<br>      memory_tracking_target_value = optional(number, 80)<br>      cpu_tracking_target_value    = optional(number, 80)<br>      }), {<br>      max_capacity                 = 5<br>      min_capacity                 = 1<br>      memory_tracking_target_value = 80<br>      cpu_tracking_target_value    = 80<br>    })<br>    iam = optional(object({<br>      role = optional(object({<br>        name        = optional(string, "fleet-role")<br>        policy_name = optional(string, "fleet-iam-policy")<br>        }), {<br>        name        = "fleet-role"<br>        policy_name = "fleet-iam-policy"<br>      })<br>      execution = optional(object({<br>        name        = optional(string, "fleet-execution-role")<br>        policy_name = optional(string, "fleet-execution-role")<br>        }), {<br>        name        = "fleet-execution-role"<br>        policy_name = "fleet-iam-policy-execution"<br>      })<br>      }), {<br>      name = "fleetdm-execution-role"<br>    })<br>    software_installers = optional(object({<br>      create_bucket    = optional(bool, true)<br>      bucket_name      = optional(string, null)<br>      bucket_prefix    = optional(string, "fleet-software-installers-")<br>      s3_object_prefix = optional(string, "")<br>      }), {<br>      create_bucket    = true<br>      bucket_name      = null<br>      bucket_prefix    = "fleet-software-installers-"<br>      s3_object_prefix = ""<br>    })<br>  })</pre> | <pre>{<br>  "autoscaling": {<br>    "cpu_tracking_target_value": 80,<br>    "max_capacity": 5,<br>    "memory_tracking_target_value": 80,<br>    "min_capacity": 1<br>  },<br>  "awslogs": {<br>    "create": true,<br>    "name": null,<br>    "prefix": "fleet",<br>    "region": null,<br>    "retention": 5<br>  },<br>  "cpu": 256,<br>  "database": {<br>    "address": null,<br>    "database": null,<br>    "password_secret_arn": null,<br>    "rr_address": null,<br>    "user": null<br>  },<br>  "depends_on": [],<br>  "extra_environment_variables": {},<br>  "extra_execution_iam_policies": [],<br>  "extra_iam_policies": [],<br>  "extra_load_balancers": [],<br>  "extra_secrets": {},<br>  "family": "fleet",<br>  "iam": {<br>    "execution": {<br>      "name": "fleet-execution-role",<br>      "policy_name": "fleet-iam-policy-execution"<br>    },<br>    "role": {<br>      "name": "fleet-role",<br>      "policy_name": "fleet-iam-policy"<br>    }<br>  },<br>  "iam_role_arn": null,<br>  "image": "fleetdm/fleet:v4.54.1",<br>  "loadbalancer": {<br>    "arn": null<br>  },<br>  "mem": 512,<br>  "mount_points": [],<br>  "networking": {<br>    "ingress_sources": {<br>      "cidr_blocks": [],<br>      "ipv6_cidr_blocks": [],<br>      "prefix_list_ids": [],<br>      "security_groups": []<br>    },<br>    "security_groups": null,<br>    "subnets": null<br>  },<br>  "pid_mode": null,<br>  "private_key_secret_name": "fleet-server-private-key",<br>  "redis": {<br>    "address": null,<br>    "use_tls": true<br>  },<br>  "repository_credentials": "",<br>  "security_group_name": "fleet",<br>  "security_groups": null,<br>  "service": {<br>    "name": "fleet"<br>  },<br>  "sidecars": [],<br>  "software_installers": {<br>    "bucket_name": null,<br>    "bucket_prefix": "fleet-software-installers-",<br>    "create_bucket": true,<br>    "s3_object_prefix": ""<br>  },<br>  "task_cpu": null,<br>  "task_mem": null,<br>  "volumes": []<br>}</pre> | no |
+| <a name="input_fleet_config"></a> [fleet\_config](#input\_fleet\_config) | The configuration object for Fleet itself. Fields that default to null will have their respective resources created if not specified. | <pre>object({<br>    task_mem                     = optional(number, null)<br>    task_cpu                     = optional(number, null)<br>    mem                          = optional(number, 4096)<br>    cpu                          = optional(number, 512)<br>    pid_mode                     = optional(string, null)<br>    image                        = optional(string, "fleetdm/fleet:v4.54.1")<br>    family                       = optional(string, "fleet")<br>    sidecars                     = optional(list(any), [])<br>    depends_on                   = optional(list(any), [])<br>    mount_points                 = optional(list(any), [])<br>    volumes                      = optional(list(any), [])<br>    extra_environment_variables  = optional(map(string), {})<br>    extra_iam_policies           = optional(list(string), [])<br>    extra_execution_iam_policies = optional(list(string), [])<br>    extra_secrets                = optional(map(string), {})<br>    security_group_name          = optional(string, "fleet")<br>    iam_role_arn                 = optional(string, null)<br>    repository_credentials       = optional(string, "")<br>    private_key_secret_name      = optional(string, "fleet-server-private-key")<br>    service = optional(object({<br>      name = optional(string, "fleet")<br>      }), {<br>      name = "fleet"<br>    })<br>    database = optional(object({<br>      password_secret_arn = string<br>      user                = string<br>      database            = string<br>      address             = string<br>      rr_address          = optional(string, null)<br>      }), {<br>      password_secret_arn = null<br>      user                = null<br>      database            = null<br>      address             = null<br>      rr_address          = null<br>    })<br>    redis = optional(object({<br>      address = string<br>      use_tls = optional(bool, true)<br>      }), {<br>      address = null<br>      use_tls = true<br>    })<br>    awslogs = optional(object({<br>      name      = optional(string, null)<br>      region    = optional(string, null)<br>      create    = optional(bool, true)<br>      prefix    = optional(string, "fleet")<br>      retention = optional(number, 5)<br>      }), {<br>      name      = null<br>      region    = null<br>      prefix    = "fleet"<br>      retention = 5<br>    })<br>    loadbalancer = optional(object({<br>      arn = string<br>      }), {<br>      arn = null<br>    })<br>    extra_load_balancers = optional(list(any), [])<br>    networking = optional(object({<br>      subnets         = optional(list(string), null)<br>      security_groups = optional(list(string), null)<br>      ingress_sources = optional(object({<br>        cidr_blocks      = optional(list(string), [])<br>        ipv6_cidr_blocks = optional(list(string), [])<br>        security_groups  = optional(list(string), [])<br>        prefix_list_ids  = optional(list(string), [])<br>        }), {<br>        cidr_blocks      = []<br>        ipv6_cidr_blocks = []<br>        security_groups  = []<br>        prefix_list_ids  = []<br>      })<br>      }), {<br>      subnets         = null<br>      security_groups = null<br>      ingress_sources = {<br>        cidr_blocks      = []<br>        ipv6_cidr_blocks = []<br>        security_groups  = []<br>        prefix_list_ids  = []<br>      }<br>    })<br>    autoscaling = optional(object({<br>      max_capacity                 = optional(number, 5)<br>      min_capacity                 = optional(number, 1)<br>      memory_tracking_target_value = optional(number, 80)<br>      cpu_tracking_target_value    = optional(number, 80)<br>      }), {<br>      max_capacity                 = 5<br>      min_capacity                 = 1<br>      memory_tracking_target_value = 80<br>      cpu_tracking_target_value    = 80<br>    })<br>    iam = optional(object({<br>      role = optional(object({<br>        name        = optional(string, "fleet-role")<br>        policy_name = optional(string, "fleet-iam-policy")<br>        }), {<br>        name        = "fleet-role"<br>        policy_name = "fleet-iam-policy"<br>      })<br>      execution = optional(object({<br>        name        = optional(string, "fleet-execution-role")<br>        policy_name = optional(string, "fleet-execution-role")<br>        }), {<br>        name        = "fleet-execution-role"<br>        policy_name = "fleet-iam-policy-execution"<br>      })<br>      }), {<br>      name = "fleetdm-execution-role"<br>    })<br>    software_installers = optional(object({<br>      create_bucket    = optional(bool, true)<br>      bucket_name      = optional(string, null)<br>      bucket_prefix    = optional(string, "fleet-software-installers-")<br>      s3_object_prefix = optional(string, "")<br>      }), {<br>      create_bucket    = true<br>      bucket_name      = null<br>      bucket_prefix    = "fleet-software-installers-"<br>      s3_object_prefix = ""<br>    })<br>  })</pre> | <pre>{<br>  "autoscaling": {<br>    "cpu_tracking_target_value": 80,<br>    "max_capacity": 5,<br>    "memory_tracking_target_value": 80,<br>    "min_capacity": 1<br>  },<br>  "awslogs": {<br>    "create": true,<br>    "name": null,<br>    "prefix": "fleet",<br>    "region": null,<br>    "retention": 5<br>  },<br>  "cpu": 256,<br>  "database": {<br>    "address": null,<br>    "database": null,<br>    "password_secret_arn": null,<br>    "rr_address": null,<br>    "user": null<br>  },<br>  "depends_on": [],<br>  "extra_environment_variables": {},<br>  "extra_execution_iam_policies": [],<br>  "extra_iam_policies": [],<br>  "extra_load_balancers": [],<br>  "extra_secrets": {},<br>  "family": "fleet",<br>  "iam": {<br>    "execution": {<br>      "name": "fleet-execution-role",<br>      "policy_name": "fleet-iam-policy-execution"<br>    },<br>    "role": {<br>      "name": "fleet-role",<br>      "policy_name": "fleet-iam-policy"<br>    }<br>  },<br>  "iam_role_arn": null,<br>  "image": "fleetdm/fleet:v4.54.1",<br>  "loadbalancer": {<br>    "arn": null<br>  },<br>  "mem": 512,<br>  "mount_points": [],<br>  "networking": {<br>    "ingress_sources": {<br>      "cidr_blocks": [],<br>      "ipv6_cidr_blocks": [],<br>      "prefix_list_ids": [],<br>      "security_groups": []<br>    },<br>    "security_groups": null,<br>    "subnets": null<br>  },<br>  "pid_mode": null,<br>  "private_key_secret_name": "fleet-server-private-key",<br>  "redis": {<br>    "address": null,<br>    "use_tls": true<br>  },<br>  "repository_credentials": "",<br>  "security_group_name": "fleet",<br>  "security_groups": null,<br>  "service": {<br>    "name": "fleet"<br>  },<br>  "sidecars": [],<br>  "software_installers": {<br>    "bucket_name": null,<br>    "bucket_prefix": "fleet-software-installers-",<br>    "create_bucket": true,<br>    "s3_object_prefix": ""<br>  },<br>  "task_cpu": null,<br>  "task_mem": null,<br>  "volumes": []<br>}</pre> | no |
 | <a name="input_migration_config"></a> [migration\_config](#input\_migration\_config) | The configuration object for Fleet's migration task. | <pre>object({<br>    mem = number<br>    cpu = number<br>  })</pre> | <pre>{<br>  "cpu": 1024,<br>  "mem": 2048<br>}</pre> | no |
-| <a name="input_rds_config"></a> [rds\_config](#input\_rds\_config) | The config for the terraform-aws-modules/rds-aurora/aws module | <pre>object({<br>    name                            = optional(string, "fleet")<br>    engine_version                  = optional(string, "8.0.mysql_aurora.3.04.2")<br>    instance_class                  = optional(string, "db.t4g.large")<br>    subnets                         = optional(list(string), [])<br>    allowed_security_groups         = optional(list(string), [])<br>    allowed_cidr_blocks             = optional(list(string), [])<br>    apply_immediately               = optional(bool, true)<br>    monitoring_interval             = optional(number, 10)<br>    db_parameter_group_name         = optional(string)<br>    db_parameters                   = optional(map(string), {})<br>    db_cluster_parameter_group_name = optional(string)<br>    db_cluster_parameters           = optional(map(string), {})<br>    enabled_cloudwatch_logs_exports = optional(list(string), [])<br>    master_username                 = optional(string, "fleet")<br>    snapshot_identifier             = optional(string)<br>    cluster_tags                    = optional(map(string), {})<br>    preferred_maintenance_window    = optional(string, "thu:23:00-fri:00:00")<br>  })</pre> | <pre>{<br>  "allowed_cidr_blocks": [],<br>  "allowed_security_groups": [],<br>  "apply_immediately": true,<br>  "cluster_tags": {},<br>  "db_cluster_parameter_group_name": null,<br>  "db_cluster_parameters": {},<br>  "db_parameter_group_name": null,<br>  "db_parameters": {},<br>  "enabled_cloudwatch_logs_exports": [],<br>  "engine_version": "8.0.mysql_aurora.3.04.2",<br>  "instance_class": "db.t4g.large",<br>  "master_username": "fleet",<br>  "monitoring_interval": 10,<br>  "name": "fleet",<br>  "preferred_maintenance_window": "thu:23:00-fri:00:00",<br>  "snapshot_identifier": null,<br>  "subnets": []<br>}</pre> | no |
+| <a name="input_rds_config"></a> [rds\_config](#input\_rds\_config) | The config for the terraform-aws-modules/rds-aurora/aws module | <pre>object({<br>    name                            = optional(string, "fleet")<br>    engine_version                  = optional(string, "8.0.mysql_aurora.3.07.1")<br>    instance_class                  = optional(string, "db.t4g.large")<br>    subnets                         = optional(list(string), [])<br>    allowed_security_groups         = optional(list(string), [])<br>    allowed_cidr_blocks             = optional(list(string), [])<br>    apply_immediately               = optional(bool, true)<br>    monitoring_interval             = optional(number, 10)<br>    db_parameter_group_name         = optional(string)<br>    db_parameters                   = optional(map(string), {})<br>    db_cluster_parameter_group_name = optional(string)<br>    db_cluster_parameters           = optional(map(string), {})<br>    enabled_cloudwatch_logs_exports = optional(list(string), [])<br>    master_username                 = optional(string, "fleet")<br>    snapshot_identifier             = optional(string)<br>    cluster_tags                    = optional(map(string), {})<br>    preferred_maintenance_window    = optional(string, "thu:23:00-fri:00:00")<br>  })</pre> | <pre>{<br>  "allowed_cidr_blocks": [],<br>  "allowed_security_groups": [],<br>  "apply_immediately": true,<br>  "cluster_tags": {},<br>  "db_cluster_parameter_group_name": null,<br>  "db_cluster_parameters": {},<br>  "db_parameter_group_name": null,<br>  "db_parameters": {},<br>  "enabled_cloudwatch_logs_exports": [],<br>  "engine_version": "8.0.mysql_aurora.3.07.1",<br>  "instance_class": "db.t4g.large",<br>  "master_username": "fleet",<br>  "monitoring_interval": 10,<br>  "name": "fleet",<br>  "preferred_maintenance_window": "thu:23:00-fri:00:00",<br>  "snapshot_identifier": null,<br>  "subnets": []<br>}</pre> | no |
 | <a name="input_redis_config"></a> [redis\_config](#input\_redis\_config) | n/a | <pre>object({<br>    name                          = optional(string, "fleet")<br>    replication_group_id          = optional(string)<br>    elasticache_subnet_group_name = optional(string, "")<br>    allowed_security_group_ids    = optional(list(string), [])<br>    subnets                       = list(string)<br>    allowed_cidrs                 = list(string)<br>    availability_zones            = optional(list(string), [])<br>    cluster_size                  = optional(number, 3)<br>    instance_type                 = optional(string, "cache.m5.large")<br>    apply_immediately             = optional(bool, true)<br>    automatic_failover_enabled    = optional(bool, false)<br>    engine_version                = optional(string, "6.x")<br>    family                        = optional(string, "redis6.x")<br>    at_rest_encryption_enabled    = optional(bool, true)<br>    transit_encryption_enabled    = optional(bool, true)<br>    parameter = optional(list(object({<br>      name  = string<br>      value = string<br>    })), [])<br>    log_delivery_configuration = optional(list(map(any)), [])<br>    tags                       = optional(map(string), {})<br>  })</pre> | <pre>{<br>  "allowed_cidrs": null,<br>  "allowed_security_group_ids": [],<br>  "apply_immediately": true,<br>  "at_rest_encryption_enabled": true,<br>  "automatic_failover_enabled": false,<br>  "availability_zones": [],<br>  "cluster_size": 3,<br>  "elasticache_subnet_group_name": "",<br>  "engine_version": "6.x",<br>  "family": "redis6.x",<br>  "instance_type": "cache.m5.large",<br>  "log_delivery_configuration": [],<br>  "name": "fleet",<br>  "parameter": [],<br>  "replication_group_id": null,<br>  "subnets": null,<br>  "tags": {},<br>  "transit_encryption_enabled": true<br>}</pre> | no |
 | <a name="input_vpc_config"></a> [vpc\_config](#input\_vpc\_config) | n/a | <pre>object({<br>    vpc_id = string<br>    networking = object({<br>      subnets = list(string)<br>    })<br>  })</pre> | n/a | yes |
 
diff --git a/terraform/byo-vpc/byo-db/README.md b/terraform/byo-vpc/byo-db/README.md
index ef98aec823..60d1444489 100644
--- a/terraform/byo-vpc/byo-db/README.md
+++ b/terraform/byo-vpc/byo-db/README.md
@@ -28,7 +28,7 @@ No requirements.
 |------|-------------|------|---------|:--------:|
 | <a name="input_alb_config"></a> [alb\_config](#input\_alb\_config) | n/a | <pre>object({<br>    name                 = optional(string, "fleet")<br>    subnets              = list(string)<br>    security_groups      = optional(list(string), [])<br>    access_logs          = optional(map(string), {})<br>    certificate_arn      = string<br>    allowed_cidrs        = optional(list(string), ["0.0.0.0/0"])<br>    allowed_ipv6_cidrs   = optional(list(string), ["::/0"])<br>    egress_cidrs         = optional(list(string), ["0.0.0.0/0"])<br>    egress_ipv6_cidrs    = optional(list(string), ["::/0"])<br>    extra_target_groups  = optional(any, [])<br>    https_listener_rules = optional(any, [])<br>    tls_policy           = optional(string, "ELBSecurityPolicy-TLS-1-2-2017-01")<br>    idle_timeout         = optional(number, 60)<br>  })</pre> | n/a | yes |
 | <a name="input_ecs_cluster"></a> [ecs\_cluster](#input\_ecs\_cluster) | The config for the terraform-aws-modules/ecs/aws module | <pre>object({<br>    autoscaling_capacity_providers = optional(any, {})<br>    cluster_configuration = optional(any, {<br>      execute_command_configuration = {<br>        logging = "OVERRIDE"<br>        log_configuration = {<br>          cloud_watch_log_group_name = "/aws/ecs/aws-ec2"<br>        }<br>      }<br>    })<br>    cluster_name = optional(string, "fleet")<br>    cluster_settings = optional(map(string), {<br>      "name" : "containerInsights",<br>      "value" : "enabled",<br>    })<br>    create                                = optional(bool, true)<br>    default_capacity_provider_use_fargate = optional(bool, true)<br>    fargate_capacity_providers = optional(any, {<br>      FARGATE = {<br>        default_capacity_provider_strategy = {<br>          weight = 100<br>        }<br>      }<br>      FARGATE_SPOT = {<br>        default_capacity_provider_strategy = {<br>          weight = 0<br>        }<br>      }<br>    })<br>    tags = optional(map(string))<br>  })</pre> | <pre>{<br>  "autoscaling_capacity_providers": {},<br>  "cluster_configuration": {<br>    "execute_command_configuration": {<br>      "log_configuration": {<br>        "cloud_watch_log_group_name": "/aws/ecs/aws-ec2"<br>      },<br>      "logging": "OVERRIDE"<br>    }<br>  },<br>  "cluster_name": "fleet",<br>  "cluster_settings": {<br>    "name": "containerInsights",<br>    "value": "enabled"<br>  },<br>  "create": true,<br>  "default_capacity_provider_use_fargate": true,<br>  "fargate_capacity_providers": {<br>    "FARGATE": {<br>      "default_capacity_provider_strategy": {<br>        "weight": 100<br>      }<br>    },<br>    "FARGATE_SPOT": {<br>      "default_capacity_provider_strategy": {<br>        "weight": 0<br>      }<br>    }<br>  },<br>  "tags": {}<br>}</pre> | no |
-| <a name="input_fleet_config"></a> [fleet\_config](#input\_fleet\_config) | The configuration object for Fleet itself. Fields that default to null will have their respective resources created if not specified. | <pre>object({<br>    task_mem                     = optional(number, null)<br>    task_cpu                     = optional(number, null)<br>    mem                          = optional(number, 4096)<br>    cpu                          = optional(number, 512)<br>    pid_mode                     = optional(string, null)<br>    image                        = optional(string, "fleetdm/fleet:v4.54.1")<br>    family                       = optional(string, "fleet")<br>    sidecars                     = optional(list(any), [])<br>    depends_on                   = optional(list(any), [])<br>    mount_points                 = optional(list(any), [])<br>    volumes                      = optional(list(any), [])<br>    extra_environment_variables  = optional(map(string), {})<br>    extra_iam_policies           = optional(list(string), [])<br>    extra_execution_iam_policies = optional(list(string), [])<br>    extra_secrets                = optional(map(string), {})<br>    security_groups              = optional(list(string), null)<br>    security_group_name          = optional(string, "fleet")<br>    iam_role_arn                 = optional(string, null)<br>    repository_credentials       = optional(string, "")<br>    private_key_secret_name      = optional(string, "fleet-server-private-key")<br>    service = optional(object({<br>      name = optional(string, "fleet")<br>      }), {<br>      name = "fleet"<br>    })<br>    database = optional(object({<br>      password_secret_arn = string<br>      user                = string<br>      database            = string<br>      address             = string<br>      rr_address          = optional(string, null)<br>      }), {<br>      password_secret_arn = null<br>      user                = null<br>      database            = null<br>      address             = null<br>      rr_address          = null<br>    })<br>    redis = optional(object({<br>      address = string<br>      use_tls = optional(bool, true)<br>      }), {<br>      address = null<br>      use_tls = true<br>    })<br>    awslogs = optional(object({<br>      name      = optional(string, null)<br>      region    = optional(string, null)<br>      create    = optional(bool, true)<br>      prefix    = optional(string, "fleet")<br>      retention = optional(number, 5)<br>      }), {<br>      name      = null<br>      region    = null<br>      prefix    = "fleet"<br>      retention = 5<br>    })<br>    loadbalancer = optional(object({<br>      arn = string<br>      }), {<br>      arn = null<br>    })<br>    extra_load_balancers = optional(list(any), [])<br>    networking = optional(object({<br>      subnets         = optional(list(string), null)<br>      security_groups = optional(list(string), null)<br>      ingress_sources = optional(object({<br>        cidr_blocks      = optional(list(string), [])<br>        ipv6_cidr_blocks = optional(list(string), [])<br>        security_groups  = optional(list(string), [])<br>        prefix_list_ids  = optional(list(string), [])<br>        }), {<br>        cidr_blocks      = []<br>        ipv6_cidr_blocks = []<br>        security_groups  = []<br>        prefix_list_ids  = []<br>      })<br>      }), {<br>      subnets         = null<br>      security_groups = null<br>      ingress_sources = {<br>        cidr_blocks      = []<br>        ipv6_cidr_blocks = []<br>        security_groups  = []<br>        prefix_list_ids  = []<br>      }<br>    })<br>    autoscaling = optional(object({<br>      max_capacity                 = optional(number, 5)<br>      min_capacity                 = optional(number, 1)<br>      memory_tracking_target_value = optional(number, 80)<br>      cpu_tracking_target_value    = optional(number, 80)<br>      }), {<br>      max_capacity                 = 5<br>      min_capacity                 = 1<br>      memory_tracking_target_value = 80<br>      cpu_tracking_target_value    = 80<br>    })<br>    iam = optional(object({<br>      role = optional(object({<br>        name        = optional(string, "fleet-role")<br>        policy_name = optional(string, "fleet-iam-policy")<br>        }), {<br>        name        = "fleet-role"<br>        policy_name = "fleet-iam-policy"<br>      })<br>      execution = optional(object({<br>        name        = optional(string, "fleet-execution-role")<br>        policy_name = optional(string, "fleet-execution-role")<br>        }), {<br>        name        = "fleet-execution-role"<br>        policy_name = "fleet-iam-policy-execution"<br>      })<br>      }), {<br>      name = "fleetdm-execution-role"<br>    })<br>    software_installers = optional(object({<br>      create_bucket    = optional(bool, true)<br>      bucket_name      = optional(string, null)<br>      bucket_prefix    = optional(string, "fleet-software-installers-")<br>      s3_object_prefix = optional(string, "")<br>      }), {<br>      create_bucket    = true<br>      bucket_name      = null<br>      bucket_prefix    = "fleet-software-installers-"<br>      s3_object_prefix = ""<br>    })<br>  })</pre> | <pre>{<br>  "autoscaling": {<br>    "cpu_tracking_target_value": 80,<br>    "max_capacity": 5,<br>    "memory_tracking_target_value": 80,<br>    "min_capacity": 1<br>  },<br>  "awslogs": {<br>    "create": true,<br>    "name": null,<br>    "prefix": "fleet",<br>    "region": null,<br>    "retention": 5<br>  },<br>  "cpu": 256,<br>  "database": {<br>    "address": null,<br>    "database": null,<br>    "password_secret_arn": null,<br>    "rr_address": null,<br>    "user": null<br>  },<br>  "depends_on": [],<br>  "extra_environment_variables": {},<br>  "extra_execution_iam_policies": [],<br>  "extra_iam_policies": [],<br>  "extra_load_balancers": [],<br>  "extra_secrets": {},<br>  "family": "fleet",<br>  "iam": {<br>    "execution": {<br>      "name": "fleet-execution-role",<br>      "policy_name": "fleet-iam-policy-execution"<br>    },<br>    "role": {<br>      "name": "fleet-role",<br>      "policy_name": "fleet-iam-policy"<br>    }<br>  },<br>  "iam_role_arn": null,<br>  "image": "fleetdm/fleet:v4.54.1",<br>  "loadbalancer": {<br>    "arn": null<br>  },<br>  "mem": 512,<br>  "mount_points": [],<br>  "networking": {<br>    "ingress_sources": {<br>      "cidr_blocks": [],<br>      "ipv6_cidr_blocks": [],<br>      "prefix_list_ids": [],<br>      "security_groups": []<br>    },<br>    "security_groups": null,<br>    "subnets": null<br>  },<br>  "pid_mode": null,<br>  "private_key_secret_name": "fleet-server-private-key",<br>  "redis": {<br>    "address": null,<br>    "use_tls": true<br>  },<br>  "repository_credentials": "",<br>  "security_group_name": "fleet",<br>  "security_groups": null,<br>  "service": {<br>    "name": "fleet"<br>  },<br>  "sidecars": [],<br>  "software_installers": {<br>    "bucket_name": null,<br>    "bucket_prefix": "fleet-software-installers-",<br>    "create_bucket": true,<br>    "s3_object_prefix": ""<br>  },<br>  "task_cpu": null,<br>  "task_mem": null,<br>  "volumes": []<br>}</pre> | no |
+| <a name="input_fleet_config"></a> [fleet\_config](#input\_fleet\_config) | The configuration object for Fleet itself. Fields that default to null will have their respective resources created if not specified. | <pre>object({<br>    task_mem                     = optional(number, null)<br>    task_cpu                     = optional(number, null)<br>    mem                          = optional(number, 4096)<br>    cpu                          = optional(number, 512)<br>    pid_mode                     = optional(string, null)<br>    image                        = optional(string, "fleetdm/fleet:v4.54.1")<br>    family                       = optional(string, "fleet")<br>    sidecars                     = optional(list(any), [])<br>    depends_on                   = optional(list(any), [])<br>    mount_points                 = optional(list(any), [])<br>    volumes                      = optional(list(any), [])<br>    extra_environment_variables  = optional(map(string), {})<br>    extra_iam_policies           = optional(list(string), [])<br>    extra_execution_iam_policies = optional(list(string), [])<br>    extra_secrets                = optional(map(string), {})<br>    security_group_name          = optional(string, "fleet")<br>    iam_role_arn                 = optional(string, null)<br>    repository_credentials       = optional(string, "")<br>    private_key_secret_name      = optional(string, "fleet-server-private-key")<br>    service = optional(object({<br>      name = optional(string, "fleet")<br>      }), {<br>      name = "fleet"<br>    })<br>    database = optional(object({<br>      password_secret_arn = string<br>      user                = string<br>      database            = string<br>      address             = string<br>      rr_address          = optional(string, null)<br>      }), {<br>      password_secret_arn = null<br>      user                = null<br>      database            = null<br>      address             = null<br>      rr_address          = null<br>    })<br>    redis = optional(object({<br>      address = string<br>      use_tls = optional(bool, true)<br>      }), {<br>      address = null<br>      use_tls = true<br>    })<br>    awslogs = optional(object({<br>      name      = optional(string, null)<br>      region    = optional(string, null)<br>      create    = optional(bool, true)<br>      prefix    = optional(string, "fleet")<br>      retention = optional(number, 5)<br>      }), {<br>      name      = null<br>      region    = null<br>      prefix    = "fleet"<br>      retention = 5<br>    })<br>    loadbalancer = optional(object({<br>      arn = string<br>      }), {<br>      arn = null<br>    })<br>    extra_load_balancers = optional(list(any), [])<br>    networking = optional(object({<br>      subnets         = optional(list(string), null)<br>      security_groups = optional(list(string), null)<br>      ingress_sources = optional(object({<br>        cidr_blocks      = optional(list(string), [])<br>        ipv6_cidr_blocks = optional(list(string), [])<br>        security_groups  = optional(list(string), [])<br>        prefix_list_ids  = optional(list(string), [])<br>        }), {<br>        cidr_blocks      = []<br>        ipv6_cidr_blocks = []<br>        security_groups  = []<br>        prefix_list_ids  = []<br>      })<br>      }), {<br>      subnets         = null<br>      security_groups = null<br>      ingress_sources = {<br>        cidr_blocks      = []<br>        ipv6_cidr_blocks = []<br>        security_groups  = []<br>        prefix_list_ids  = []<br>      }<br>    })<br>    autoscaling = optional(object({<br>      max_capacity                 = optional(number, 5)<br>      min_capacity                 = optional(number, 1)<br>      memory_tracking_target_value = optional(number, 80)<br>      cpu_tracking_target_value    = optional(number, 80)<br>      }), {<br>      max_capacity                 = 5<br>      min_capacity                 = 1<br>      memory_tracking_target_value = 80<br>      cpu_tracking_target_value    = 80<br>    })<br>    iam = optional(object({<br>      role = optional(object({<br>        name        = optional(string, "fleet-role")<br>        policy_name = optional(string, "fleet-iam-policy")<br>        }), {<br>        name        = "fleet-role"<br>        policy_name = "fleet-iam-policy"<br>      })<br>      execution = optional(object({<br>        name        = optional(string, "fleet-execution-role")<br>        policy_name = optional(string, "fleet-execution-role")<br>        }), {<br>        name        = "fleet-execution-role"<br>        policy_name = "fleet-iam-policy-execution"<br>      })<br>      }), {<br>      name = "fleetdm-execution-role"<br>    })<br>    software_installers = optional(object({<br>      create_bucket    = optional(bool, true)<br>      bucket_name      = optional(string, null)<br>      bucket_prefix    = optional(string, "fleet-software-installers-")<br>      s3_object_prefix = optional(string, "")<br>      }), {<br>      create_bucket    = true<br>      bucket_name      = null<br>      bucket_prefix    = "fleet-software-installers-"<br>      s3_object_prefix = ""<br>    })<br>  })</pre> | <pre>{<br>  "autoscaling": {<br>    "cpu_tracking_target_value": 80,<br>    "max_capacity": 5,<br>    "memory_tracking_target_value": 80,<br>    "min_capacity": 1<br>  },<br>  "awslogs": {<br>    "create": true,<br>    "name": null,<br>    "prefix": "fleet",<br>    "region": null,<br>    "retention": 5<br>  },<br>  "cpu": 256,<br>  "database": {<br>    "address": null,<br>    "database": null,<br>    "password_secret_arn": null,<br>    "rr_address": null,<br>    "user": null<br>  },<br>  "depends_on": [],<br>  "extra_environment_variables": {},<br>  "extra_execution_iam_policies": [],<br>  "extra_iam_policies": [],<br>  "extra_load_balancers": [],<br>  "extra_secrets": {},<br>  "family": "fleet",<br>  "iam": {<br>    "execution": {<br>      "name": "fleet-execution-role",<br>      "policy_name": "fleet-iam-policy-execution"<br>    },<br>    "role": {<br>      "name": "fleet-role",<br>      "policy_name": "fleet-iam-policy"<br>    }<br>  },<br>  "iam_role_arn": null,<br>  "image": "fleetdm/fleet:v4.54.1",<br>  "loadbalancer": {<br>    "arn": null<br>  },<br>  "mem": 512,<br>  "mount_points": [],<br>  "networking": {<br>    "ingress_sources": {<br>      "cidr_blocks": [],<br>      "ipv6_cidr_blocks": [],<br>      "prefix_list_ids": [],<br>      "security_groups": []<br>    },<br>    "security_groups": null,<br>    "subnets": null<br>  },<br>  "pid_mode": null,<br>  "private_key_secret_name": "fleet-server-private-key",<br>  "redis": {<br>    "address": null,<br>    "use_tls": true<br>  },<br>  "repository_credentials": "",<br>  "security_group_name": "fleet",<br>  "security_groups": null,<br>  "service": {<br>    "name": "fleet"<br>  },<br>  "sidecars": [],<br>  "software_installers": {<br>    "bucket_name": null,<br>    "bucket_prefix": "fleet-software-installers-",<br>    "create_bucket": true,<br>    "s3_object_prefix": ""<br>  },<br>  "task_cpu": null,<br>  "task_mem": null,<br>  "volumes": []<br>}</pre> | no |
 | <a name="input_migration_config"></a> [migration\_config](#input\_migration\_config) | The configuration object for Fleet's migration task. | <pre>object({<br>    mem = number<br>    cpu = number<br>  })</pre> | <pre>{<br>  "cpu": 1024,<br>  "mem": 2048<br>}</pre> | no |
 | <a name="input_vpc_id"></a> [vpc\_id](#input\_vpc\_id) | n/a | `string` | n/a | yes |
 
diff --git a/terraform/byo-vpc/byo-db/byo-ecs/README.md b/terraform/byo-vpc/byo-db/byo-ecs/README.md
index ac2a39774f..fc701fb07c 100644
--- a/terraform/byo-vpc/byo-db/byo-ecs/README.md
+++ b/terraform/byo-vpc/byo-db/byo-ecs/README.md
@@ -52,7 +52,7 @@ No modules.
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
 | <a name="input_ecs_cluster"></a> [ecs\_cluster](#input\_ecs\_cluster) | The name of the ECS cluster to use | `string` | n/a | yes |
-| <a name="input_fleet_config"></a> [fleet\_config](#input\_fleet\_config) | The configuration object for Fleet itself. Fields that default to null will have their respective resources created if not specified. | <pre>object({<br>    task_mem                     = optional(number, null)<br>    task_cpu                     = optional(number, null)<br>    mem                          = optional(number, 4096)<br>    cpu                          = optional(number, 512)<br>    pid_mode                     = optional(string, null)<br>    image                        = optional(string, "fleetdm/fleet:v4.54.1")<br>    family                       = optional(string, "fleet")<br>    sidecars                     = optional(list(any), [])<br>    depends_on                   = optional(list(any), [])<br>    mount_points                 = optional(list(any), [])<br>    volumes                      = optional(list(any), [])<br>    extra_environment_variables  = optional(map(string), {})<br>    extra_iam_policies           = optional(list(string), [])<br>    extra_execution_iam_policies = optional(list(string), [])<br>    extra_secrets                = optional(map(string), {})<br>    security_groups              = optional(list(string), null)<br>    security_group_name          = optional(string, "fleet")<br>    iam_role_arn                 = optional(string, null)<br>    repository_credentials       = optional(string, "")<br>    private_key_secret_name      = optional(string, "fleet-server-private-key")<br>    service = optional(object({<br>      name = optional(string, "fleet")<br>      }), {<br>      name = "fleet"<br>    })<br>    database = object({<br>      password_secret_arn = string<br>      user                = string<br>      database            = string<br>      address             = string<br>      rr_address          = optional(string, null)<br>    })<br>    redis = object({<br>      address = string<br>      use_tls = optional(bool, true)<br>    })<br>    awslogs = optional(object({<br>      name      = optional(string, null)<br>      region    = optional(string, null)<br>      create    = optional(bool, true)<br>      prefix    = optional(string, "fleet")<br>      retention = optional(number, 5)<br>      }), {<br>      name      = null<br>      region    = null<br>      prefix    = "fleet"<br>      retention = 5<br>    })<br>    loadbalancer = object({<br>      arn = string<br>    })<br>    extra_load_balancers = optional(list(any), [])<br>    networking = object({<br>      subnets         = optional(list(string), null)<br>      security_groups = optional(list(string), null)<br>      ingress_sources = object({<br>        cidr_blocks      = optional(list(string), [])<br>        ipv6_cidr_blocks = optional(list(string), [])<br>        security_groups  = optional(list(string), [])<br>        prefix_list_ids  = optional(list(string), [])<br>      })<br>    })<br>    autoscaling = optional(object({<br>      max_capacity                 = optional(number, 5)<br>      min_capacity                 = optional(number, 1)<br>      memory_tracking_target_value = optional(number, 80)<br>      cpu_tracking_target_value    = optional(number, 80)<br>      }), {<br>      max_capacity                 = 5<br>      min_capacity                 = 1<br>      memory_tracking_target_value = 80<br>      cpu_tracking_target_value    = 80<br>    })<br>    iam = optional(object({<br>      role = optional(object({<br>        name        = optional(string, "fleet-role")<br>        policy_name = optional(string, "fleet-iam-policy")<br>        }), {<br>        name        = "fleet-role"<br>        policy_name = "fleet-iam-policy"<br>      })<br>      execution = optional(object({<br>        name        = optional(string, "fleet-execution-role")<br>        policy_name = optional(string, "fleet-execution-role")<br>        }), {<br>        name        = "fleet-execution-role"<br>        policy_name = "fleet-iam-policy-execution"<br>      })<br>      }), {<br>      name = "fleetdm-execution-role"<br>    })<br>    software_installers = optional(object({<br>      create_bucket    = optional(bool, true)<br>      bucket_name      = optional(string, null)<br>      bucket_prefix    = optional(string, "fleet-software-installers-")<br>      s3_object_prefix = optional(string, "")<br>      }), {<br>      create_bucket    = true<br>      bucket_name      = null<br>      bucket_prefix    = "fleet-software-installers-"<br>      s3_object_prefix = ""<br>    })<br>  })</pre> | <pre>{<br>  "autoscaling": {<br>    "cpu_tracking_target_value": 80,<br>    "max_capacity": 5,<br>    "memory_tracking_target_value": 80,<br>    "min_capacity": 1<br>  },<br>  "awslogs": {<br>    "create": true,<br>    "name": null,<br>    "prefix": "fleet",<br>    "region": null,<br>    "retention": 5<br>  },<br>  "cpu": 256,<br>  "database": {<br>    "address": null,<br>    "database": null,<br>    "password_secret_arn": null,<br>    "rr_address": null,<br>    "user": null<br>  },<br>  "depends_on": [],<br>  "extra_environment_variables": {},<br>  "extra_execution_iam_policies": [],<br>  "extra_iam_policies": [],<br>  "extra_load_balacners": [],<br>  "extra_secrets": {},<br>  "family": "fleet",<br>  "iam": {<br>    "execution": {<br>      "name": "fleet-execution-role",<br>      "policy_name": "fleet-iam-policy-execution"<br>    },<br>    "role": {<br>      "name": "fleet-role",<br>      "policy_name": "fleet-iam-policy"<br>    }<br>  },<br>  "iam_role_arn": null,<br>  "image": "fleetdm/fleet:v4.54.1",<br>  "loadbalancer": {<br>    "arn": null<br>  },<br>  "mem": 512,<br>  "mount_points": [],<br>  "networking": {<br>    "ingress_sources": {<br>      "cidr_blocks": [],<br>      "ipv6_cidr_blocks": [],<br>      "prefix_list_ids": [],<br>      "security_groups": []<br>    },<br>    "security_groups": null,<br>    "subnets": null<br>  },<br>  "pid_mode": null,<br>  "private_key_secret_name": "fleet-server-private-key",<br>  "redis": {<br>    "address": null,<br>    "use_tls": true<br>  },<br>  "repository_credentials": "",<br>  "security_group_name": "fleet",<br>  "security_groups": null,<br>  "service": {<br>    "name": "fleet"<br>  },<br>  "sidecars": [],<br>  "software_installers": {<br>    "bucket_name": null,<br>    "bucket_prefix": "fleet-software-installers-",<br>    "create_bucket": true,<br>    "s3_object_prefix": ""<br>  },<br>  "task_cpu": null,<br>  "task_mem": null,<br>  "volumes": []<br>}</pre> | no |
+| <a name="input_fleet_config"></a> [fleet\_config](#input\_fleet\_config) | The configuration object for Fleet itself. Fields that default to null will have their respective resources created if not specified. | <pre>object({<br>    task_mem                     = optional(number, null)<br>    task_cpu                     = optional(number, null)<br>    mem                          = optional(number, 4096)<br>    cpu                          = optional(number, 512)<br>    pid_mode                     = optional(string, null)<br>    image                        = optional(string, "fleetdm/fleet:v4.54.1")<br>    family                       = optional(string, "fleet")<br>    sidecars                     = optional(list(any), [])<br>    depends_on                   = optional(list(any), [])<br>    mount_points                 = optional(list(any), [])<br>    volumes                      = optional(list(any), [])<br>    extra_environment_variables  = optional(map(string), {})<br>    extra_iam_policies           = optional(list(string), [])<br>    extra_execution_iam_policies = optional(list(string), [])<br>    extra_secrets                = optional(map(string), {})<br>    security_group_name          = optional(string, "fleet")<br>    iam_role_arn                 = optional(string, null)<br>    repository_credentials       = optional(string, "")<br>    private_key_secret_name      = optional(string, "fleet-server-private-key")<br>    service = optional(object({<br>      name = optional(string, "fleet")<br>      }), {<br>      name = "fleet"<br>    })<br>    database = object({<br>      password_secret_arn = string<br>      user                = string<br>      database            = string<br>      address             = string<br>      rr_address          = optional(string, null)<br>    })<br>    redis = object({<br>      address = string<br>      use_tls = optional(bool, true)<br>    })<br>    awslogs = optional(object({<br>      name      = optional(string, null)<br>      region    = optional(string, null)<br>      create    = optional(bool, true)<br>      prefix    = optional(string, "fleet")<br>      retention = optional(number, 5)<br>      }), {<br>      name      = null<br>      region    = null<br>      prefix    = "fleet"<br>      retention = 5<br>    })<br>    loadbalancer = object({<br>      arn = string<br>    })<br>    extra_load_balancers = optional(list(any), [])<br>    networking = object({<br>      subnets         = optional(list(string), null)<br>      security_groups = optional(list(string), null)<br>      ingress_sources = object({<br>        cidr_blocks      = optional(list(string), [])<br>        ipv6_cidr_blocks = optional(list(string), [])<br>        security_groups  = optional(list(string), [])<br>        prefix_list_ids  = optional(list(string), [])<br>      })<br>    })<br>    autoscaling = optional(object({<br>      max_capacity                 = optional(number, 5)<br>      min_capacity                 = optional(number, 1)<br>      memory_tracking_target_value = optional(number, 80)<br>      cpu_tracking_target_value    = optional(number, 80)<br>      }), {<br>      max_capacity                 = 5<br>      min_capacity                 = 1<br>      memory_tracking_target_value = 80<br>      cpu_tracking_target_value    = 80<br>    })<br>    iam = optional(object({<br>      role = optional(object({<br>        name        = optional(string, "fleet-role")<br>        policy_name = optional(string, "fleet-iam-policy")<br>        }), {<br>        name        = "fleet-role"<br>        policy_name = "fleet-iam-policy"<br>      })<br>      execution = optional(object({<br>        name        = optional(string, "fleet-execution-role")<br>        policy_name = optional(string, "fleet-execution-role")<br>        }), {<br>        name        = "fleet-execution-role"<br>        policy_name = "fleet-iam-policy-execution"<br>      })<br>      }), {<br>      name = "fleetdm-execution-role"<br>    })<br>    software_installers = optional(object({<br>      create_bucket    = optional(bool, true)<br>      bucket_name      = optional(string, null)<br>      bucket_prefix    = optional(string, "fleet-software-installers-")<br>      s3_object_prefix = optional(string, "")<br>      }), {<br>      create_bucket    = true<br>      bucket_name      = null<br>      bucket_prefix    = "fleet-software-installers-"<br>      s3_object_prefix = ""<br>    })<br>  })</pre> | <pre>{<br>  "autoscaling": {<br>    "cpu_tracking_target_value": 80,<br>    "max_capacity": 5,<br>    "memory_tracking_target_value": 80,<br>    "min_capacity": 1<br>  },<br>  "awslogs": {<br>    "create": true,<br>    "name": null,<br>    "prefix": "fleet",<br>    "region": null,<br>    "retention": 5<br>  },<br>  "cpu": 256,<br>  "database": {<br>    "address": null,<br>    "database": null,<br>    "password_secret_arn": null,<br>    "rr_address": null,<br>    "user": null<br>  },<br>  "depends_on": [],<br>  "extra_environment_variables": {},<br>  "extra_execution_iam_policies": [],<br>  "extra_iam_policies": [],<br>  "extra_load_balacners": [],<br>  "extra_secrets": {},<br>  "family": "fleet",<br>  "iam": {<br>    "execution": {<br>      "name": "fleet-execution-role",<br>      "policy_name": "fleet-iam-policy-execution"<br>    },<br>    "role": {<br>      "name": "fleet-role",<br>      "policy_name": "fleet-iam-policy"<br>    }<br>  },<br>  "iam_role_arn": null,<br>  "image": "fleetdm/fleet:v4.54.1",<br>  "loadbalancer": {<br>    "arn": null<br>  },<br>  "mem": 512,<br>  "mount_points": [],<br>  "networking": {<br>    "ingress_sources": {<br>      "cidr_blocks": [],<br>      "ipv6_cidr_blocks": [],<br>      "prefix_list_ids": [],<br>      "security_groups": []<br>    },<br>    "security_groups": null,<br>    "subnets": null<br>  },<br>  "pid_mode": null,<br>  "private_key_secret_name": "fleet-server-private-key",<br>  "redis": {<br>    "address": null,<br>    "use_tls": true<br>  },<br>  "repository_credentials": "",<br>  "security_group_name": "fleet",<br>  "security_groups": null,<br>  "service": {<br>    "name": "fleet"<br>  },<br>  "sidecars": [],<br>  "software_installers": {<br>    "bucket_name": null,<br>    "bucket_prefix": "fleet-software-installers-",<br>    "create_bucket": true,<br>    "s3_object_prefix": ""<br>  },<br>  "task_cpu": null,<br>  "task_mem": null,<br>  "volumes": []<br>}</pre> | no |
 | <a name="input_migration_config"></a> [migration\_config](#input\_migration\_config) | The configuration object for Fleet's migration task. | <pre>object({<br>    mem = number<br>    cpu = number<br>  })</pre> | <pre>{<br>  "cpu": 1024,<br>  "mem": 2048<br>}</pre> | no |
 | <a name="input_vpc_id"></a> [vpc\_id](#input\_vpc\_id) | n/a | `string` | `null` | no |
 
diff --git a/terraform/byo-vpc/byo-db/byo-ecs/main.tf b/terraform/byo-vpc/byo-db/byo-ecs/main.tf
index 3d2fb7191d..ab56fe80fa 100644
--- a/terraform/byo-vpc/byo-db/byo-ecs/main.tf
+++ b/terraform/byo-vpc/byo-db/byo-ecs/main.tf
@@ -232,7 +232,7 @@ resource "aws_cloudwatch_log_group" "main" { #tfsec:ignore:aws-cloudwatch-log-gr
 }
 
 resource "aws_security_group" "main" {
-  count       = var.fleet_config.security_groups == null ? 1 : 0
+  count       = var.fleet_config.networking.security_groups == null ? 1 : 0
   name        = var.fleet_config.security_group_name
   description = "Fleet ECS Service Security Group"
   vpc_id      = var.vpc_id
diff --git a/terraform/byo-vpc/byo-db/byo-ecs/variables.tf b/terraform/byo-vpc/byo-db/byo-ecs/variables.tf
index 44ca11ffc1..0270c8fb52 100644
--- a/terraform/byo-vpc/byo-db/byo-ecs/variables.tf
+++ b/terraform/byo-vpc/byo-db/byo-ecs/variables.tf
@@ -16,7 +16,7 @@ variable "fleet_config" {
     mem                          = optional(number, 4096)
     cpu                          = optional(number, 512)
     pid_mode                     = optional(string, null)
-    image                        = optional(string, "fleetdm/fleet:v4.54.1")
+    image                        = optional(string, "fleetdm/fleet:v4.56.0")
     family                       = optional(string, "fleet")
     sidecars                     = optional(list(any), [])
     depends_on                   = optional(list(any), [])
@@ -26,7 +26,6 @@ variable "fleet_config" {
     extra_iam_policies           = optional(list(string), [])
     extra_execution_iam_policies = optional(list(string), [])
     extra_secrets                = optional(map(string), {})
-    security_groups              = optional(list(string), null)
     security_group_name          = optional(string, "fleet")
     iam_role_arn                 = optional(string, null)
     repository_credentials       = optional(string, "")
@@ -120,7 +119,7 @@ variable "fleet_config" {
     mem                          = 512
     cpu                          = 256
     pid_mode                     = null
-    image                        = "fleetdm/fleet:v4.54.1"
+    image                        = "fleetdm/fleet:v4.56.0"
     family                       = "fleet"
     sidecars                     = []
     depends_on                   = []
@@ -130,7 +129,6 @@ variable "fleet_config" {
     extra_iam_policies           = []
     extra_execution_iam_policies = []
     extra_secrets                = {}
-    security_groups              = null
     security_group_name          = "fleet"
     iam_role_arn                 = null
     repository_credentials       = ""
diff --git a/terraform/byo-vpc/byo-db/variables.tf b/terraform/byo-vpc/byo-db/variables.tf
index 37bca0a2af..0044e48e5c 100644
--- a/terraform/byo-vpc/byo-db/variables.tf
+++ b/terraform/byo-vpc/byo-db/variables.tf
@@ -77,7 +77,7 @@ variable "fleet_config" {
     mem                          = optional(number, 4096)
     cpu                          = optional(number, 512)
     pid_mode                     = optional(string, null)
-    image                        = optional(string, "fleetdm/fleet:v4.54.1")
+    image                        = optional(string, "fleetdm/fleet:v4.56.0")
     family                       = optional(string, "fleet")
     sidecars                     = optional(list(any), [])
     depends_on                   = optional(list(any), [])
@@ -87,7 +87,6 @@ variable "fleet_config" {
     extra_iam_policies           = optional(list(string), [])
     extra_execution_iam_policies = optional(list(string), [])
     extra_secrets                = optional(map(string), {})
-    security_groups              = optional(list(string), null)
     security_group_name          = optional(string, "fleet")
     iam_role_arn                 = optional(string, null)
     repository_credentials       = optional(string, "")
@@ -206,7 +205,7 @@ variable "fleet_config" {
     mem                          = 512
     cpu                          = 256
     pid_mode                     = null
-    image                        = "fleetdm/fleet:v4.54.1"
+    image                        = "fleetdm/fleet:v4.56.0"
     family                       = "fleet"
     sidecars                     = []
     depends_on                   = []
diff --git a/terraform/byo-vpc/example/main.tf b/terraform/byo-vpc/example/main.tf
index 4a34edd6f3..887b907b30 100644
--- a/terraform/byo-vpc/example/main.tf
+++ b/terraform/byo-vpc/example/main.tf
@@ -17,7 +17,7 @@ provider "aws" {
 }
 
 locals {
-  fleet_image = "fleetdm/fleet:v4.54.1"
+  fleet_image = "fleetdm/fleet:v4.56.0"
   domain_name = "example.com"
 }
 
diff --git a/terraform/byo-vpc/variables.tf b/terraform/byo-vpc/variables.tf
index d53ddedd6d..cba22bf845 100644
--- a/terraform/byo-vpc/variables.tf
+++ b/terraform/byo-vpc/variables.tf
@@ -10,7 +10,7 @@ variable "vpc_config" {
 variable "rds_config" {
   type = object({
     name                            = optional(string, "fleet")
-    engine_version                  = optional(string, "8.0.mysql_aurora.3.04.2")
+    engine_version                  = optional(string, "8.0.mysql_aurora.3.07.1")
     instance_class                  = optional(string, "db.t4g.large")
     subnets                         = optional(list(string), [])
     allowed_security_groups         = optional(list(string), [])
@@ -29,7 +29,7 @@ variable "rds_config" {
   })
   default = {
     name                            = "fleet"
-    engine_version                  = "8.0.mysql_aurora.3.04.2"
+    engine_version                  = "8.0.mysql_aurora.3.07.1"
     instance_class                  = "db.t4g.large"
     subnets                         = []
     allowed_security_groups         = []
@@ -170,7 +170,7 @@ variable "fleet_config" {
     mem                          = optional(number, 4096)
     cpu                          = optional(number, 512)
     pid_mode                     = optional(string, null)
-    image                        = optional(string, "fleetdm/fleet:v4.54.1")
+    image                        = optional(string, "fleetdm/fleet:v4.56.0")
     family                       = optional(string, "fleet")
     sidecars                     = optional(list(any), [])
     depends_on                   = optional(list(any), [])
@@ -180,7 +180,6 @@ variable "fleet_config" {
     extra_iam_policies           = optional(list(string), [])
     extra_execution_iam_policies = optional(list(string), [])
     extra_secrets                = optional(map(string), {})
-    security_groups              = optional(list(string), null)
     security_group_name          = optional(string, "fleet")
     iam_role_arn                 = optional(string, null)
     repository_credentials       = optional(string, "")
@@ -299,7 +298,7 @@ variable "fleet_config" {
     mem                          = 512
     cpu                          = 256
     pid_mode                     = null
-    image                        = "fleetdm/fleet:v4.54.1"
+    image                        = "fleetdm/fleet:v4.56.0"
     family                       = "fleet"
     sidecars                     = []
     depends_on                   = []
diff --git a/terraform/example/main.tf b/terraform/example/main.tf
index cb425779ba..33b6f5221e 100644
--- a/terraform/example/main.tf
+++ b/terraform/example/main.tf
@@ -50,7 +50,7 @@ locals {
 }
 
 module "fleet" {
-  source          = "github.com/fleetdm/fleet//terraform?ref=tf-mod-root-v1.10.0"
+  source          = "github.com/fleetdm/fleet//terraform?ref=tf-mod-root-v1.11.1"
   certificate_arn = module.acm.acm_certificate_arn
 
   vpc = {
@@ -63,8 +63,8 @@ module "fleet" {
 
   fleet_config = {
     # To avoid pull-rate limiting from dockerhub, consider using our quay.io mirror
-    # for the Fleet image. e.g. "quay.io/fleetdm/fleet:v4.54.1"
-    image = "fleetdm/fleet:v4.54.1" # override default to deploy the image you desire
+    # for the Fleet image. e.g. "quay.io/fleetdm/fleet:v4.56.0"
+    image = "fleetdm/fleet:v4.56.0" # override default to deploy the image you desire
     # See https://fleetdm.com/docs/deploy/reference-architectures#aws for appropriate scaling
     # memory and cpu.
     autoscaling = {
@@ -91,6 +91,8 @@ module "fleet" {
       # 8mb up from 262144 (256k) default
       sort_buffer_size = 8388608
     }
+    # Uncomment to specify the RDS engine version
+    # engine_version = "8.0.mysql_aurora.3.07.1"
   }
   redis_config = {
     # See https://fleetdm.com/docs/deploy/reference-architectures#aws for instance types.
diff --git a/terraform/variables.tf b/terraform/variables.tf
index 25f7aa77e2..5933307f11 100644
--- a/terraform/variables.tf
+++ b/terraform/variables.tf
@@ -62,7 +62,7 @@ variable "certificate_arn" {
 variable "rds_config" {
   type = object({
     name                            = optional(string, "fleet")
-    engine_version                  = optional(string, "8.0.mysql_aurora.3.04.2")
+    engine_version                  = optional(string, "8.0.mysql_aurora.3.07.1")
     instance_class                  = optional(string, "db.t4g.large")
     subnets                         = optional(list(string), [])
     allowed_security_groups         = optional(list(string), [])
@@ -80,7 +80,7 @@ variable "rds_config" {
   })
   default = {
     name                            = "fleet"
-    engine_version                  = "8.0.mysql_aurora.3.04.2"
+    engine_version                  = "8.0.mysql_aurora.3.07.1"
     instance_class                  = "db.t4g.large"
     subnets                         = []
     allowed_security_groups         = []
@@ -218,7 +218,7 @@ variable "fleet_config" {
     mem                          = optional(number, 4096)
     cpu                          = optional(number, 512)
     pid_mode                     = optional(string, null)
-    image                        = optional(string, "fleetdm/fleet:v4.54.1")
+    image                        = optional(string, "fleetdm/fleet:v4.56.0")
     family                       = optional(string, "fleet")
     sidecars                     = optional(list(any), [])
     depends_on                   = optional(list(any), [])
@@ -228,7 +228,6 @@ variable "fleet_config" {
     extra_iam_policies           = optional(list(string), [])
     extra_execution_iam_policies = optional(list(string), [])
     extra_secrets                = optional(map(string), {})
-    security_groups              = optional(list(string), null)
     security_group_name          = optional(string, "fleet")
     iam_role_arn                 = optional(string, null)
     repository_credentials       = optional(string, "")
@@ -347,7 +346,7 @@ variable "fleet_config" {
     mem                          = 512
     cpu                          = 256
     pid_mode                     = null
-    image                        = "fleetdm/fleet:v4.54.1"
+    image                        = "fleetdm/fleet:v4.56.0"
     family                       = "fleet"
     sidecars                     = []
     depends_on                   = []
diff --git a/tools/bomutils-docker/Dockerfile b/tools/bomutils-docker/Dockerfile
index 2027428bec..3bcfc3bc58 100644
--- a/tools/bomutils-docker/Dockerfile
+++ b/tools/bomutils-docker/Dockerfile
@@ -1,27 +1,28 @@
-FROM debian:stable-slim@sha256:0f116858482fd8222b4f7e9b4cdc9a054051e67fbb8a57bc22651f0d56b45ad8 AS builder
+FROM debian:stable-slim@sha256:e5365b94db65754594422a8a101c873728711c6a4df029677f4a7f7200d6e1c3 AS builder
 
 RUN apt-get update
-RUN apt-get install -y build-essential autoconf libxml2-dev libssl-dev zlib1g-dev curl
+RUN apt-get install -y build-essential autoconf libxml2-dev libssl-dev zlib1g-dev curl git
 
-# Install bomutils
-RUN curl -L https://github.com/hogliux/bomutils/archive/0.2.tar.gz > bomutils.tar.gz && \
-    echo "fb1f4ae37045eaa034ddd921ef6e16fb961e95f0364e5d76c9867bc8b92eb8a4  bomutils.tar.gz" | sha256sum --check && \
-    tar -xzf bomutils.tar.gz
-RUN cd bomutils-0.2 && make && make install
+# Build bomutils
+RUN git clone -b master \
+    --depth=1 --no-tags --progress \
+    --no-recurse-submodules https://github.com/hogliux/bomutils.git && \
+    cd bomutils && git reset --hard c41ad8b67d82a0071245ce8a5069023d39a885b8 && \
+    make && make install
 
 # Install xar
 RUN curl -L https://github.com/mackyle/xar/archive/refs/tags/xar-1.6.1.tar.gz > xar.tar.gz && \
     echo "5e7d50dab73f5cb1713b49fa67c455c2a0dd2b0a7770cbc81b675e21f6210e25  xar.tar.gz" | sha256sum --check && \
     tar -xzf xar.tar.gz 
+
 # Note this needs patching due to newer version of OpenSSL
 # See https://github.com/mackyle/xar/pull/23
 COPY patch.txt .
 RUN cd xar-xar-1.6.1/xar && patch < ../../patch.txt && autoconf && ./configure && make && make install
 
+FROM debian:stable-slim@sha256:e5365b94db65754594422a8a101c873728711c6a4df029677f4a7f7200d6e1c3
 
-FROM debian:stable-slim@sha256:0f116858482fd8222b4f7e9b4cdc9a054051e67fbb8a57bc22651f0d56b45ad8
-
-RUN apt-get update && apt-get install -y --no-install-recommends libxml2  && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && dpkg --add-architecture i386 && apt-get upgrade -y && apt-get install -y --no-install-recommends libxml2 ca-certificates && rm -rf /var/lib/apt/lists/*
 COPY --from=builder /usr/bin /usr/bin/
 COPY --from=builder /usr/local/bin /usr/local/bin/
 COPY --from=builder /usr/local/lib /usr/local/lib/
diff --git a/tools/cloner-check/generated_files/appconfig.txt b/tools/cloner-check/generated_files/appconfig.txt
index fb717b35d2..86388d153e 100644
--- a/tools/cloner-check/generated_files/appconfig.txt
+++ b/tools/cloner-check/generated_files/appconfig.txt
@@ -96,7 +96,15 @@ github.com/fleetdm/fleet/v4/server/fleet/Integrations	GoogleCalendar	[]*fleet.Go
 github.com/fleetdm/fleet/v4/server/fleet/GoogleCalendarIntegration	Domain	string
 github.com/fleetdm/fleet/v4/server/fleet/GoogleCalendarIntegration	ApiKey	map[string]string
 github.com/fleetdm/fleet/v4/server/fleet/AppConfig	MDM	fleet.MDM
-github.com/fleetdm/fleet/v4/server/fleet/MDM	AppleBMDefaultTeam	string
+github.com/fleetdm/fleet/v4/server/fleet/MDM	DeprecatedAppleBMDefaultTeam	string
+github.com/fleetdm/fleet/v4/server/fleet/MDM	AppleBusinessManager	optjson.Slice[github.com/fleetdm/fleet/v4/server/fleet.MDMAppleABMAssignmentInfo]
+github.com/fleetdm/fleet/v4/pkg/optjson/Slice[github.com/fleetdm/fleet/v4/server/fleet.MDMAppleABMAssignmentInfo]	Set	bool
+github.com/fleetdm/fleet/v4/pkg/optjson/Slice[github.com/fleetdm/fleet/v4/server/fleet.MDMAppleABMAssignmentInfo]	Valid	bool
+github.com/fleetdm/fleet/v4/pkg/optjson/Slice[github.com/fleetdm/fleet/v4/server/fleet.MDMAppleABMAssignmentInfo]	Value	[]fleet.MDMAppleABMAssignmentInfo
+github.com/fleetdm/fleet/v4/server/fleet/MDMAppleABMAssignmentInfo	OrganizationName	string
+github.com/fleetdm/fleet/v4/server/fleet/MDMAppleABMAssignmentInfo	MacOSTeam	string
+github.com/fleetdm/fleet/v4/server/fleet/MDMAppleABMAssignmentInfo	IOSTeam	string
+github.com/fleetdm/fleet/v4/server/fleet/MDMAppleABMAssignmentInfo	IpadOSTeam	string
 github.com/fleetdm/fleet/v4/server/fleet/MDM	AppleBMEnabledAndConfigured	bool
 github.com/fleetdm/fleet/v4/server/fleet/MDM	AppleBMTermsExpired	bool
 github.com/fleetdm/fleet/v4/server/fleet/MDM	EnabledAndConfigured	bool
@@ -142,6 +150,12 @@ github.com/fleetdm/fleet/v4/server/fleet/WindowsSettings	CustomSettings	optjson.
 github.com/fleetdm/fleet/v4/pkg/optjson/Slice[github.com/fleetdm/fleet/v4/server/fleet.MDMProfileSpec]	Set	bool
 github.com/fleetdm/fleet/v4/pkg/optjson/Slice[github.com/fleetdm/fleet/v4/server/fleet.MDMProfileSpec]	Valid	bool
 github.com/fleetdm/fleet/v4/pkg/optjson/Slice[github.com/fleetdm/fleet/v4/server/fleet.MDMProfileSpec]	Value	[]fleet.MDMProfileSpec
+github.com/fleetdm/fleet/v4/server/fleet/MDM	VolumePurchasingProgram	optjson.Slice[github.com/fleetdm/fleet/v4/server/fleet.MDMAppleVolumePurchasingProgramInfo]
+github.com/fleetdm/fleet/v4/pkg/optjson/Slice[github.com/fleetdm/fleet/v4/server/fleet.MDMAppleVolumePurchasingProgramInfo]	Set	bool
+github.com/fleetdm/fleet/v4/pkg/optjson/Slice[github.com/fleetdm/fleet/v4/server/fleet.MDMAppleVolumePurchasingProgramInfo]	Valid	bool
+github.com/fleetdm/fleet/v4/pkg/optjson/Slice[github.com/fleetdm/fleet/v4/server/fleet.MDMAppleVolumePurchasingProgramInfo]	Value	[]fleet.MDMAppleVolumePurchasingProgramInfo
+github.com/fleetdm/fleet/v4/server/fleet/MDMAppleVolumePurchasingProgramInfo	Location	string
+github.com/fleetdm/fleet/v4/server/fleet/MDMAppleVolumePurchasingProgramInfo	Teams	[]string
 github.com/fleetdm/fleet/v4/server/fleet/AppConfig	Scripts	optjson.Slice[string]
 github.com/fleetdm/fleet/v4/pkg/optjson/Slice[string]	Set	bool
 github.com/fleetdm/fleet/v4/pkg/optjson/Slice[string]	Valid	bool
diff --git a/tools/dbutils/schema_generator.go b/tools/dbutils/schema_generator.go
index 2fecce8683..60c01869d3 100644
--- a/tools/dbutils/schema_generator.go
+++ b/tools/dbutils/schema_generator.go
@@ -67,7 +67,7 @@ func main() {
 
 	// Dump schema to dumpfile
 	cmd := exec.Command(
-		"docker-compose", "exec", "-T", "mysql_test",
+		"docker", "compose", "exec", "-T", "mysql_test",
 		// Command run inside container
 		"mysqldump", "-u"+testUsername, "-p"+testPassword, "schemadb", "--compact", "--skip-comments",
 	)
diff --git a/tools/fleetctl-docker/Dockerfile b/tools/fleetctl-docker/Dockerfile
index 7e2e27655b..6b82ed6285 100644
--- a/tools/fleetctl-docker/Dockerfile
+++ b/tools/fleetctl-docker/Dockerfile
@@ -6,7 +6,7 @@ RUN cargo install --version 0.16.0 apple-codesign \
   && curl -sSf $transporter_url -o transporter_install.sh \
   && sh transporter_install.sh --target transporter --accept --noexec
 
-FROM debian:stable-slim@sha256:0f116858482fd8222b4f7e9b4cdc9a054051e67fbb8a57bc22651f0d56b45ad8
+FROM debian:stable-slim@sha256:e5365b94db65754594422a8a101c873728711c6a4df029677f4a7f7200d6e1c3
 
 ARG binpath=build/binary-bundle/linux/fleetctl
 
diff --git a/tools/fleetctl-npm/package.json b/tools/fleetctl-npm/package.json
index 63a49c5208..0db37e98d5 100644
--- a/tools/fleetctl-npm/package.json
+++ b/tools/fleetctl-npm/package.json
@@ -1,6 +1,6 @@
 {
   "name": "fleetctl",
-  "version": "v4.54.1",
+  "version": "v4.56.0",
   "description": "Installer for the fleetctl CLI tool",
   "bin": {
     "fleetctl": "./run.js"
diff --git a/tools/mdm/apple/applebmapi/main.go b/tools/mdm/apple/applebmapi/main.go
index 04cbc198d8..fcc4c8d831 100644
--- a/tools/mdm/apple/applebmapi/main.go
+++ b/tools/mdm/apple/applebmapi/main.go
@@ -18,7 +18,6 @@ import (
 	"github.com/fleetdm/fleet/v4/pkg/fleethttp"
 	"github.com/fleetdm/fleet/v4/server/config"
 	"github.com/fleetdm/fleet/v4/server/datastore/mysql"
-	apple_mdm "github.com/fleetdm/fleet/v4/server/mdm/apple"
 	"github.com/fleetdm/fleet/v4/server/mdm/nanodep/godep"
 	kitlog "github.com/go-kit/log"
 )
@@ -28,12 +27,16 @@ func main() {
 	serverPrivateKey := flag.String("server-private-key", "", "fleet server's private key (to decrypt MDM assets)")
 	profileUUID := flag.String("profile-uuid", "", "the Apple profile UUID to retrieve")
 	serialNum := flag.String("serial-number", "", "serial number of a device to get the device details")
+	orgName := flag.String("org-name", "", "organization name of the token")
 
 	flag.Parse()
 
 	if *serverPrivateKey == "" {
 		log.Fatal("must provide -server-private-key")
 	}
+	if *orgName == "" {
+		log.Fatal("must provide -org-name")
+	}
 	if *profileUUID != "" && *serialNum != "" {
 		log.Fatal("only one of -profile-uuid or -serial-number must be provided")
 	}
@@ -79,11 +82,11 @@ func main() {
 	var res any
 	switch {
 	case *profileUUID != "":
-		res, err = depClient.GetProfile(ctx, apple_mdm.DEPName, *profileUUID)
+		res, err = depClient.GetProfile(ctx, *orgName, *profileUUID)
 	case *serialNum != "":
-		res, err = depClient.GetDeviceDetails(ctx, apple_mdm.DEPName, *serialNum)
+		res, err = depClient.GetDeviceDetails(ctx, *orgName, *serialNum)
 	default:
-		res, err = depClient.AccountDetail(ctx, apple_mdm.DEPName)
+		res, err = depClient.AccountDetail(ctx, *orgName)
 	}
 	if err != nil {
 		log.Fatal(err)
diff --git a/tools/mdm/assets/main.go b/tools/mdm/assets/main.go
index 92021567a5..d91a246f30 100644
--- a/tools/mdm/assets/main.go
+++ b/tools/mdm/assets/main.go
@@ -38,15 +38,15 @@ var (
 	flagExportName  string
 
 	validNames = map[fleet.MDMAssetName]struct{}{
-		fleet.MDMAssetABMCert:       {},
-		fleet.MDMAssetABMToken:      {},
-		fleet.MDMAssetABMKey:        {},
-		fleet.MDMAssetAPNSCert:      {},
-		fleet.MDMAssetAPNSKey:       {},
-		fleet.MDMAssetCACert:        {},
-		fleet.MDMAssetCAKey:         {},
-		fleet.MDMAssetSCEPChallenge: {},
-		fleet.MDMAssetVPPToken:      {},
+		fleet.MDMAssetABMCert:            {},
+		fleet.MDMAssetABMTokenDeprecated: {},
+		fleet.MDMAssetABMKey:             {},
+		fleet.MDMAssetAPNSCert:           {},
+		fleet.MDMAssetAPNSKey:            {},
+		fleet.MDMAssetCACert:             {},
+		fleet.MDMAssetCAKey:              {},
+		fleet.MDMAssetSCEPChallenge:      {},
+		fleet.MDMAssetVPPTokenDeprecated: {},
 	}
 )
 
@@ -114,6 +114,12 @@ func main() {
 			log.Fatal("parsing import flags", err)
 		}
 
+		if len(flagKey) > 32 {
+			// We truncate to 32 bytes because AES-256 requires a 32 byte (256 bit) PK, but some
+			// infra setups generate keys that are longer than 32 bytes.
+			flagKey = flagKey[:32]
+		}
+
 		ds := setupDS(flagKey, flagDBUser, flagDBPass, flagDBAddress, flagDBName)
 		defer ds.Close()
 
@@ -146,14 +152,20 @@ func main() {
 			log.Fatal("parsing export flags", err)
 		}
 
-		ds := setupDS(flagKey, flagDBUser, flagDBPass, flagDBAddress, flagDBName)
-		defer ds.Close()
-
 		// Check required flags
 		if flagKey == "" {
 			log.Fatal("-key flag is required")
 		}
 
+		if len(flagKey) > 32 {
+			// We truncate to 32 bytes because AES-256 requires a 32 byte (256 bit) PK, but some
+			// infra setups generate keys that are longer than 32 bytes.
+			flagKey = flagKey[:32]
+		}
+
+		ds := setupDS(flagKey, flagDBUser, flagDBPass, flagDBAddress, flagDBName)
+		defer ds.Close()
+
 		if flagDir != "" {
 			if err := os.MkdirAll(flagDir, os.ModePerm); err != nil {
 				log.Fatal("ensuring directory: ", err)
@@ -167,9 +179,9 @@ func main() {
 			fleet.MDMAssetAPNSCert,
 			fleet.MDMAssetABMCert,
 			fleet.MDMAssetABMKey,
-			fleet.MDMAssetABMToken,
+			fleet.MDMAssetABMTokenDeprecated,
 			fleet.MDMAssetSCEPChallenge,
-			fleet.MDMAssetVPPToken,
+			fleet.MDMAssetVPPTokenDeprecated,
 		}
 
 		if flagExportName != "" {
@@ -199,6 +211,22 @@ func main() {
 
 			log.Printf("wrote %s in %s", asset.Name, path)
 		}
+
+		flagDir, err = filepath.Abs(flagDir)
+		if err != nil {
+			log.Fatalf("abs path: %s", err)
+		}
+
+		fmt.Printf(`You can set the following on your Fleet configuration:
+export FLEET_MDM_APPLE_APNS_CERT=%[1]s/apns_cert.crt
+export FLEET_MDM_APPLE_APNS_KEY=%[1]s/apns_key.key
+export FLEET_MDM_APPLE_SCEP_CERT=%[1]s/ca_cert.crt
+export FLEET_MDM_APPLE_SCEP_KEY=%[1]s/ca_key.key
+export FLEET_MDM_APPLE_SCEP_CHALLENGE=$(cat %[1]s/scep_challenge)
+export FLEET_MDM_APPLE_BM_SERVER_TOKEN=%[1]s/abm_token
+export FLEET_MDM_APPLE_BM_CERT=%[1]s/abm_cert.crt
+export FLEET_MDM_APPLE_BM_KEY=%[1]s/abm_key.key
+`, flagDir)
 	default:
 		log.Fatalf("invalid subcommand %s, valid subcommands: import, export", os.Args[1])
 	}
diff --git a/tools/mdm/decrypt-disk-encryption-key/main.go b/tools/mdm/decrypt-disk-encryption-key/main.go
new file mode 100644
index 0000000000..22bf6ef714
--- /dev/null
+++ b/tools/mdm/decrypt-disk-encryption-key/main.go
@@ -0,0 +1,56 @@
+// Command decrypt-disk-encryption-key decrypts a base64-encoded encrypted key
+// using the provided X509 certificate and private key. This is typically used
+// to manually decrypt a disk encryption key, e.g. BitLocker on Windows or
+// FileVault on macOS. The certificate and private key used are the SCEP files
+// for a macOS host and the WSTEP files for a Windows host.
+//
+// Example usage (running from the root of this repository):
+//
+//		go run ./tools/mdm/decrypt-disk-encryption-key/main.go -cert path/to/file.crt \
+//	   -key path/to/file.key -value-to-decrypt base64-encoded-value
+package main
+
+import (
+	"errors"
+	"flag"
+	"fmt"
+
+	"github.com/apex/log"
+	"github.com/fleetdm/fleet/v4/server/config"
+	"github.com/fleetdm/fleet/v4/server/mdm"
+)
+
+func main() {
+	var (
+		certFile       = flag.String("cert", "", "The path to the X509 certificate file (required).")
+		keyFile        = flag.String("key", "", "The path to the X509 private key file (required).")
+		valueToDecrypt = flag.String("value-to-decrypt", "", "The base64-encoded value to decrypt (required).")
+	)
+	flag.Parse()
+
+	if *certFile == "" || *keyFile == "" || *valueToDecrypt == "" {
+		flag.Usage()
+		return
+	}
+
+	cfg := config.MDMConfig{
+		WindowsWSTEPIdentityCert: *certFile,
+		WindowsWSTEPIdentityKey:  *keyFile,
+	}
+	cert, _, _, err := cfg.MicrosoftWSTEP()
+	if err != nil {
+		// unwrap the error once to remove "Microsoft WSTEP" from the error
+		// message, as we don't know in this tool if the cert is for WSTEP or SCEP
+		// (it doesn't matter)
+		if uerr := errors.Unwrap(err); uerr != nil {
+			err = uerr
+		}
+		log.Fatalf("Error loading certificate: %v", err)
+	}
+
+	decrypted, err := mdm.DecryptBase64CMS(*valueToDecrypt, cert.Leaf, cert.PrivateKey)
+	if err != nil {
+		log.Fatalf("Error decrypting value: %v", err)
+	}
+	fmt.Printf("Decrypted value: %s\n", string(decrypted))
+}
diff --git a/tools/mdm/migration/mdmproxy/Dockerfile b/tools/mdm/migration/mdmproxy/Dockerfile
index 5d3369304b..6355224466 100644
--- a/tools/mdm/migration/mdmproxy/Dockerfile
+++ b/tools/mdm/migration/mdmproxy/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.22.5-alpine3.20@sha256:8c9183f715b0b4eca05b8b3dbf59766aaedb41ec07477b132ee2891ac0110a07
+FROM golang:1.23.1-alpine3.20@sha256:436e2d978524b15498b98faa367553ba6c3655671226f500c72ceb7afb2ef0b1
 ARG TAG
 RUN apk update && apk add --no-cache git
 RUN git clone -b $TAG --depth=1 --no-tags --progress --no-recurse-submodules https://github.com/fleetdm/fleet.git && cd /go/fleet/tools/mdm/migration/mdmproxy && go build .
diff --git a/tools/mdm/migration/mdmproxy/README.md b/tools/mdm/migration/mdmproxy/README.md
index 3582bf4af4..a1f43be328 100644
--- a/tools/mdm/migration/mdmproxy/README.md
+++ b/tools/mdm/migration/mdmproxy/README.md
@@ -25,4 +25,18 @@ Usage of ./mdmproxy:
 ### Example invocation
 ```
 mdmproxy --migrate-udids '' --auth-token foo --existing-url https://3.14.233.249 --existing-hostname micromdm.example.com --fleet-url https://example.cloud.fleetdm.com --migrate-percentage 0
-```
\ No newline at end of file
+```
+
+### Check migration status
+
+To check the migration status for a given UDID, provide the `--migrate-udids` and
+`--migrate-percentage` flags with the `--check` flag:
+
+```
+$ go run . --migrate-percentage=50 --check E5C6DBBA-D5CC-4DB6-9560-995F17FB7A59
+E5C6DBBA-D5CC-4DB6-9560-995F17FB7A59 IS NOT migrated
+$ go run . --migrate-percentage=50 --check 575424CB-09D7-4CAD-8A7A-D3511FE8A7E2
+575424CB-09D7-4CAD-8A7A-D3511FE8A7E2 IS migrated
+```
+
+When the `--check` flag is used, the program prints the migration status and exits. The server is not started.
\ No newline at end of file
diff --git a/tools/mdm/migration/mdmproxy/mdmproxy.go b/tools/mdm/migration/mdmproxy/mdmproxy.go
index b6f3f18e14..c59bf4b425 100644
--- a/tools/mdm/migration/mdmproxy/mdmproxy.go
+++ b/tools/mdm/migration/mdmproxy/mdmproxy.go
@@ -12,6 +12,7 @@ import (
 	"net/http"
 	"net/http/httputil"
 	"net/url"
+	"os"
 	"strconv"
 	"strings"
 	"sync"
@@ -83,14 +84,6 @@ func (m *mdmProxy) handleProxy(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if !strings.HasPrefix(r.URL.Path, "/mdm") {
-		if m.logSkipped {
-			log.Printf("Forbidden non-mdm request: %s %s", r.Method, r.URL.String())
-		}
-		http.Error(w, "Forbidden", http.StatusForbidden)
-		return
-	}
-
 	// Send all micromdm repo requests to the existing server
 	if strings.HasPrefix(r.URL.Path, "/repo") {
 		log.Printf("%s %s -> Existing (Repo)", r.Method, r.URL.String())
@@ -99,6 +92,14 @@ func (m *mdmProxy) handleProxy(w http.ResponseWriter, r *http.Request) {
 
 	}
 
+	if !strings.HasPrefix(r.URL.Path, "/mdm") {
+		if m.logSkipped {
+			log.Printf("Forbidden non-mdm request: %s %s", r.Method, r.URL.String())
+		}
+		http.Error(w, "Forbidden", http.StatusForbidden)
+		return
+	}
+
 	// Read the body of the request
 	body, err := io.ReadAll(r.Body)
 	_ = r.Body.Close()
@@ -321,35 +322,13 @@ func main() {
 	serverAddr := flag.String("server-address", ":8080", "Address for server to listen on")
 	debug := flag.Bool("debug", false, "Enable debug logging")
 	logSkipped := flag.Bool("log-skipped", false, "Log skipped requests (usually from web scanners)")
+	check := flag.String("check", "", "Print whether the specified UDID is migrated with the current configuration, then exit")
 	flag.Parse()
 
-	// Check required flags
-	if *existingURL == "" {
-		log.Fatal("--existing-url must be set")
-	}
-	if *existingHostname == "" {
-		log.Fatal("--existing-hostname must be set")
-	}
-	if *fleetURL == "" {
-		log.Fatal("--fleet-url must be set")
-	}
-
 	udids, err := processUDIDs(bytes.NewBufferString(*migrateUDIDs))
 	if err != nil {
 		panic(err)
 	}
-	log.Printf("--migrate-udids set: %v", udids)
-	log.Printf("--migrate-percentage set: %d", *migratePercentage)
-	log.Printf("--existing-url set: %s", *existingURL)
-	log.Printf("--existing-hostname set: %s", *existingHostname)
-	log.Printf("--fleet-url set: %s", *fleetURL)
-	log.Printf("--debug set: %v", *debug)
-	log.Printf("--log-skipped set: %v", *logSkipped)
-	if *authToken != "" {
-		log.Printf("--auth-token set. Remote configuration enabled.")
-	} else {
-		log.Printf("--auth-token is empty. Remote configuration disabled.")
-	}
 
 	proxy := mdmProxy{
 		token:             *authToken,
@@ -364,6 +343,39 @@ func main() {
 		logSkipped:        *logSkipped,
 	}
 
+	if len(*check) > 0 {
+		if proxy.isUDIDMigrated(*check) {
+			fmt.Printf("%s IS migrated\n", *check)
+		} else {
+			fmt.Printf("%s IS NOT migrated\n", *check)
+		}
+		os.Exit(0)
+	}
+
+	// Check required flags
+	if *existingURL == "" {
+		log.Fatal("--existing-url must be set")
+	}
+	if *existingHostname == "" {
+		log.Fatal("--existing-hostname must be set")
+	}
+	if *fleetURL == "" {
+		log.Fatal("--fleet-url must be set")
+	}
+
+	log.Printf("--migrate-udids set: %v", udids)
+	log.Printf("--migrate-percentage set: %d", *migratePercentage)
+	log.Printf("--existing-url set: %s", *existingURL)
+	log.Printf("--existing-hostname set: %s", *existingHostname)
+	log.Printf("--fleet-url set: %s", *fleetURL)
+	log.Printf("--debug set: %v", *debug)
+	log.Printf("--log-skipped set: %v", *logSkipped)
+	if *authToken != "" {
+		log.Printf("--auth-token set. Remote configuration enabled.")
+	} else {
+		log.Printf("--auth-token is empty. Remote configuration disabled.")
+	}
+
 	mux := http.NewServeMux()
 	// Health check endpoint used for load balancers
 	mux.HandleFunc("/healthz", func(w http.ResponseWriter, r *http.Request) {
diff --git a/tools/mdm/migration/micromdm/README.md b/tools/mdm/migration/micromdm/README.md
new file mode 100644
index 0000000000..da6d073b8b
--- /dev/null
+++ b/tools/mdm/migration/micromdm/README.md
@@ -0,0 +1,19 @@
+# MicroMDM webhook
+
+A tiny server you can use as a webhook callback for the MDM migration [end user workflow](https://fleetdm.com/docs/using-fleet/mdm-migration-guide#end-user-workflow).
+
+It will try to unenroll the device based on the device UUID/UDID by sending a `RemoveProfile`
+command.
+
+## Usage
+
+1. Find the MicroMDM API token. For the Fly.io hosted MicroMDM server it should be in
+   1Password. If you're having trouble finding it, drop a message in `#g-mdm` on Slack!
+2. Get the MicroMDM server URL.
+3. Start the server with:
+
+```
+go run tools/mdm/migration/micromdm/main.go --api-token=$MICRO_MDM_TOKEN --url=https://micromdm.example.com
+```
+
+4. Configure Fleet to send a webhook to this server.
\ No newline at end of file
diff --git a/tools/mdm/migration/micromdm/main.go b/tools/mdm/migration/micromdm/main.go
new file mode 100644
index 0000000000..87e73246b9
--- /dev/null
+++ b/tools/mdm/migration/micromdm/main.go
@@ -0,0 +1,149 @@
+package main
+
+import (
+	"bytes"
+	"encoding/json"
+	"flag"
+	"fmt"
+	"io"
+	"log"
+	"log/slog"
+	"net/http"
+	"time"
+
+	"github.com/fleetdm/fleet/v4/pkg/fleethttp"
+)
+
+var (
+	apiToken = flag.String("api-token", "", "API token for the MicroMDM instance")
+	url      = flag.String("url", "", "URL of the MicroMDM instance")
+	port     = flag.String("port", "4648", "Port used by the webserver")
+)
+
+func main() {
+	flag.Parse()
+
+	if *apiToken == "" || *url == "" {
+		log.Fatal("--api-token and --url are required.")
+	}
+
+	client := newMicroMDMClient(*apiToken, *url)
+
+	http.HandleFunc("/", func(writer http.ResponseWriter, request *http.Request) {
+		body, err := io.ReadAll(request.Body)
+		if err != nil {
+			slog.With("error", err).Error("reading request body")
+			writer.WriteHeader(http.StatusInternalServerError)
+			return
+		}
+
+		if len(body) == 0 {
+			slog.Error("empty request body")
+			writer.WriteHeader(http.StatusBadRequest)
+			return
+		}
+
+		slog.With("raw_body", string(body)).Debug("got request")
+
+		var deviceInfo struct {
+			Host struct {
+				UUID string `json:"uuid"`
+			} `json:"host"`
+		}
+		if err := json.Unmarshal(body, &deviceInfo); err != nil {
+			slog.With("device_uuid", deviceInfo.Host.UUID, "error", err).Error("failed to unmarshal request body")
+			writer.WriteHeader(http.StatusBadRequest)
+			return
+		}
+
+		slog.With("device_uuid", deviceInfo.Host.UUID).Info("attempting to unenroll from MicroMDM")
+		if err := client.unmanageDevice(deviceInfo.Host.UUID); err != nil {
+			slog.With("device_uuid", deviceInfo.Host.UUID, "error", err).Error("failed to unenroll device")
+			writer.WriteHeader(http.StatusBadRequest)
+			return
+		}
+
+		slog.With("device_uuid", deviceInfo.Host.UUID).Info("device unenrolled")
+	})
+
+	slog.With("address", fmt.Sprintf("http://localhost:%s", *port)).Info("server running")
+	server := &http.Server{
+		Addr:              fmt.Sprintf(":%s", *port),
+		ReadHeaderTimeout: 3 * time.Second,
+	}
+	if err := server.ListenAndServe(); err != nil {
+		log.Fatalf(err.Error())
+	}
+}
+
+type microMDMClient struct {
+	url   string
+	token string
+}
+
+func newMicroMDMClient(apiToken, url string) *microMDMClient {
+	client := &microMDMClient{url: url, token: apiToken}
+	return client
+}
+
+func (m *microMDMClient) doWithRequest(req *http.Request) ([]byte, error) {
+	client := fleethttp.NewClient()
+
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, err
+	}
+
+	if resp.StatusCode > 299 {
+		return body, fmt.Errorf("unexpected status code %d", resp.StatusCode)
+	}
+
+	return body, nil
+}
+
+func (m *microMDMClient) do(method, path string, data any) ([]byte, error) {
+	var body []byte
+	if data != nil {
+		b, err := json.Marshal(data)
+		if err != nil {
+			return nil, fmt.Errorf("marshaling request body: %w", err)
+		}
+		body = b
+	}
+
+	makeReq := func() (*http.Request, error) {
+		if len(body) > 0 {
+			return http.NewRequest(method, path, bytes.NewBuffer(body))
+		}
+
+		return http.NewRequest(method, path, nil)
+	}
+
+	req, err := makeReq()
+	if err != nil {
+		return nil, err
+	}
+	req.Header.Add("accept", "application/json")
+	req.SetBasicAuth("micromdm", m.token)
+	return m.doWithRequest(req)
+}
+
+func (m *microMDMClient) unmanageDevice(UUID string) error {
+	req := struct {
+		RequestType string `json:"request_type"`
+		UDID        string `json:"udid"`
+		Identifier  string `json:"identifier"`
+	}{
+		RequestType: "RemoveProfile",
+		UDID:        UUID,
+		Identifier:  "com.github.micromdm.micromdm.enroll",
+	}
+	_, err := m.do("POST", fmt.Sprintf("%s/v1/commands", m.url), &req)
+	return err
+}
diff --git a/tools/mdm/windows/bitlocker/go.mod b/tools/mdm/windows/bitlocker/go.mod
index 56c33b3236..56ee33f9d0 100755
--- a/tools/mdm/windows/bitlocker/go.mod
+++ b/tools/mdm/windows/bitlocker/go.mod
@@ -1,6 +1,6 @@
 module bitlocker
 
-go 1.22.4
+go 1.23.1
 
 require github.com/go-ole/go-ole v1.3.0
 
diff --git a/tools/nvd/nvdvuln/nvdvuln.go b/tools/nvd/nvdvuln/nvdvuln.go
index 5ba23209b7..41335c6103 100644
--- a/tools/nvd/nvdvuln/nvdvuln.go
+++ b/tools/nvd/nvdvuln/nvdvuln.go
@@ -69,6 +69,12 @@ func main() {
 		}
 	}
 
+	// All macOS apps are expected to have a bundle identifier, which influences CPE generation.
+	if softwareSource != nil && *softwareSource == "apps" && softwareBundleIdentifier != nil && *softwareBundleIdentifier == "" {
+		printf("Must set --software_bundle_identifier for macOS apps when specifying -software_source apps\n")
+		return
+	}
+
 	if err := os.MkdirAll(*dbDir, os.ModePerm); err != nil {
 		panic(err)
 	}
diff --git a/tools/release/README.md b/tools/release/README.md
index b2b1e0dbb7..4812e9ff71 100644
--- a/tools/release/README.md
+++ b/tools/release/README.md
@@ -1,4 +1,3 @@
-
 # Releasing Fleet
 
 ## Setup
@@ -28,7 +27,7 @@ For example no tickets still in Ready / In Progress should be in the milestone w
 
 ## Minor Release (typically end of sprint)
 
-example
+Example:
 ```
 # Build release candidate and changelogs and QA ticket
 ./tools/release/publish_release.sh -m
diff --git a/tools/release/publish_release.sh b/tools/release/publish_release.sh
index 6aec1605e7..6dab83d978 100755
--- a/tools/release/publish_release.sh
+++ b/tools/release/publish_release.sh
@@ -626,6 +626,15 @@ fi
 
 start_ver_tag=fleet-$start_version
 
+# Check if there are updates to fleetctl dependencies (only when doing security updates to base images).
+if [[ $(git diff $start_ver_tag ./tools/wix-docker ./tools/bomutils-docker) ]]; then
+	echo "⚠️  Changes in fleetctl dependencies detected, please run the following before continuing the release:"
+	echo "1. git tag fleetctl-docker-deps-$next_ver && git push origin fleetctl-docker-deps-$next_ver"
+	echo "2. Wait for the triggered https://github.com/fleetdm/fleet/actions/workflows/release-fleetctl-docker-deps.yaml build to finish."
+	echo "3. Smoke test the pushed images by manually running the following action: https://github.com/fleetdm/fleet/actions/workflows/test-packaging.yml"
+	exit 1
+fi
+
 if [[ "$minor" == "true" ]]; then
     echo "Minor release from $start_version to $next_ver"
     # For scheduled minor releases, we want to branch off of main
diff --git a/tools/terraform/go.mod b/tools/terraform/go.mod
index 27d6ebca10..98d450eacc 100644
--- a/tools/terraform/go.mod
+++ b/tools/terraform/go.mod
@@ -1,6 +1,6 @@
 module terraform-provider-fleetdm
 
-go 1.22.4
+go 1.23.1
 
 require (
 	github.com/hashicorp/terraform-plugin-framework v1.7.0
diff --git a/tools/tuf/releaser.sh b/tools/tuf/releaser.sh
index cf669577c2..a3eba3d273 100755
--- a/tools/tuf/releaser.sh
+++ b/tools/tuf/releaser.sh
@@ -321,8 +321,9 @@ print_reminder () {
         elif [[ $COMPONENT == "osqueryd" ]]; then
             prompt "Make sure to install fleetd with '--osqueryd-channel=stable' on a Linux, Windows and macOS VM. (To smoke test the release.)"
         fi
-    else
+    elif [[ $ACTION != "update-timestamp" ]]; then
         echo "Unsupported action: $ACTION"
+        exit 1
     fi
 }
 
diff --git a/tools/tuf/status/tuf-status.go b/tools/tuf/status/tuf-status.go
index 6f8aa6fd36..e62dc14f12 100644
--- a/tools/tuf/status/tuf-status.go
+++ b/tools/tuf/status/tuf-status.go
@@ -186,6 +186,9 @@ func channelVersionCommand() *cli.Command {
 		"swiftDialog": {
 			"macos": "swiftDialog.app.tar.gz",
 		},
+		"escrowBuddy": {
+			"macos": "escrowBuddy.pkg",
+		},
 	}
 	var (
 		channel    string
@@ -208,7 +211,7 @@ func channelVersionCommand() *cli.Command {
 			&cli.StringSliceFlag{
 				Name:        "components",
 				EnvVars:     []string{"TUF_STATUS_COMPONENTS"},
-				Value:       cli.NewStringSlice("orbit", "desktop", "osqueryd", "nudge", "swiftDialog"),
+				Value:       cli.NewStringSlice("orbit", "desktop", "osqueryd", "nudge", "swiftDialog", "escrowBuddy"),
 				Destination: &components,
 				Usage:       "List of components",
 			},
@@ -324,7 +327,7 @@ func channelVersionCommand() *cli.Command {
 					Right:  true,
 				})
 				var rows [][]string
-				componentsInOrder := []string{"orbit", "desktop", "osqueryd", "nudge", "swiftDialog"}
+				componentsInOrder := []string{"orbit", "desktop", "osqueryd", "nudge", "swiftDialog", "escrowBuddy"}
 				setIfEmpty := func(m map[string]string, k string) string {
 					v := m[k]
 					if v == "" {
diff --git a/tools/wix-docker/Dockerfile b/tools/wix-docker/Dockerfile
index cc6889eddc..f9b78915af 100644
--- a/tools/wix-docker/Dockerfile
+++ b/tools/wix-docker/Dockerfile
@@ -1,4 +1,4 @@
-FROM debian:bullseye-slim@sha256:cc4cc29b4ba8182fca324920f64ff68a3b24acefd4c7ba8a2e5bd4e81ac3bacf
+FROM debian:stable-slim@sha256:90128f59a7c6f6fdcb6493f587ea352d5c7507f52a6ddfba66fc56cd3d99dc2b
 
 RUN true \
     && dpkg --add-architecture i386 \
diff --git a/webpack.config.js b/webpack.config.js
index 8b06782811..72e49e6799 100644
--- a/webpack.config.js
+++ b/webpack.config.js
@@ -131,6 +131,7 @@ const config = {
   resolve: {
     extensions: [".tsx", ".ts", ".js", ".jsx", ".json"],
     modules: [path.resolve(path.join(repo, "./frontend")), "node_modules"],
+    fallback: { path: require.resolve("path-browserify") },
   },
 };
 
diff --git a/website/.sailsrc b/website/.sailsrc
index 391fdf869c..0cd59c0714 100644
--- a/website/.sailsrc
+++ b/website/.sailsrc
@@ -7,5 +7,17400 @@
   "_generatedWith": {
     "sails": "1.2.5",
     "sails-generate": "2.0.0"
+  },
+  "builtStaticContent": {
+    "queries": [
+      {
+        "name": "Get OpenSSL versions",
+        "platform": "linux",
+        "description": "Retrieves the OpenSSL version.",
+        "query": "SELECT name AS name, version AS version, 'deb_packages' AS source FROM deb_packages WHERE name LIKE 'openssl%' UNION SELECT name AS name, version AS version, 'apt_sources' AS source FROM apt_sources WHERE name LIKE 'openssl%' UNION SELECT name AS name, version AS version, 'rpm_packages' AS source FROM rpm_packages WHERE name LIKE 'openssl%';",
+        "purpose": "Informational",
+        "tags": [
+          "inventory"
+        ],
+        "contributors": [
+          {
+            "name": "zwass",
+            "handle": "zwass",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/zwass"
+          }
+        ],
+        "kind": "query",
+        "slug": "get-open-ssl-versions",
+        "resolution": "N/A",
+        "requiresMdm": false
+      },
+      {
+        "name": "Get authorized SSH keys",
+        "platform": "darwin, linux",
+        "description": "Presence of authorized SSH keys may be unusual on laptops. Could be completely normal on servers, but may be worth auditing for unusual keys and/or changes.",
+        "query": "SELECT username, authorized_keys. * FROM users CROSS JOIN authorized_keys USING (uid);",
+        "purpose": "Informational",
+        "remediation": "Check out the linked table (https://github.com/fleetdm/fleet/blob/32b4d53e7f1428ce43b0f9fa52838cbe7b413eed/handbook/queries/detect-hosts-with-high-severity-vulnerable-versions-of-openssl.md#table-of-vulnerable-openssl-versions) to determine if the installed version is a high severity vulnerability and view the corresponding CVE(s)",
+        "tags": [
+          "built-in",
+          "ssh"
+        ],
+        "contributors": [
+          {
+            "name": "mike-j-thomas",
+            "handle": "mike-j-thomas",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/mike-j-thomas"
+          }
+        ],
+        "kind": "query",
+        "slug": "get-authorized-ssh-keys",
+        "resolution": "N/A",
+        "requiresMdm": false
+      },
+      {
+        "name": "Get authorized keys for Domain Joined Accounts",
+        "platform": "darwin, linux",
+        "description": "List authorized_keys for each user on the system.",
+        "query": "SELECT *  FROM users CROSS JOIN  authorized_keys USING(uid) WHERE  username IN (SELECT distinct(username) FROM last);",
+        "purpose": "Informational",
+        "tags": [
+          "active directory",
+          "ssh"
+        ],
+        "contributors": [
+          {
+            "name": "anelshaer",
+            "handle": "anelshaer",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/anelshaer"
+          }
+        ],
+        "kind": "query",
+        "slug": "get-authorized-keys-for-domain-joined-accounts",
+        "resolution": "N/A",
+        "requiresMdm": false
+      },
+      {
+        "name": "Get crashes",
+        "platform": "darwin",
+        "description": "Retrieve application, system, and mobile app crash logs.",
+        "query": "SELECT uid, datetime, responsible, exception_type, identifier, version, crash_path FROM users CROSS JOIN crashes USING (uid);",
+        "purpose": "Informational",
+        "tags": [
+          "troubleshooting"
+        ],
+        "contributors": [
+          {
+            "name": "zwass",
+            "handle": "zwass",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/zwass"
+          }
+        ],
+        "kind": "query",
+        "slug": "get-crashes",
+        "resolution": "N/A",
+        "requiresMdm": false
+      },
+      {
+        "name": "Get installed Chrome Extensions",
+        "platform": "darwin, linux, windows",
+        "description": "List installed Chrome Extensions for all users.",
+        "query": "SELECT * FROM users CROSS JOIN chrome_extensions USING (uid);",
+        "purpose": "Informational",
+        "tags": [
+          "browser",
+          "built-in",
+          "inventory"
+        ],
+        "contributors": [
+          {
+            "name": "zwass",
+            "handle": "zwass",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/zwass"
+          }
+        ],
+        "kind": "query",
+        "slug": "get-installed-chrome-extensions",
+        "resolution": "N/A",
+        "requiresMdm": false
+      },
+      {
+        "name": "Get installed Linux software",
+        "platform": "linux",
+        "description": "Get all software installed on a Linux computer, including browser plugins and installed packages. Note that this does not include other running processes in the processes table.",
+        "query": "SELECT name AS name, version AS version, 'Package (APT)' AS type, 'apt_sources' AS source FROM apt_sources UNION SELECT name AS name, version AS version, 'Package (deb)' AS type, 'deb_packages' AS source FROM deb_packages UNION SELECT package AS name, version AS version, 'Package (Portage)' AS type, 'portage_packages' AS source FROM portage_packages UNION SELECT name AS name, version AS version, 'Package (RPM)' AS type, 'rpm_packages' AS source FROM rpm_packages UNION SELECT name AS name, '' AS version, 'Package (YUM)' AS type, 'yum_sources' AS source FROM yum_sources UNION SELECT name AS name, version AS version, 'Package (NPM)' AS type, 'npm_packages' AS source FROM npm_packages UNION SELECT name AS name, version AS version, 'Package (Python)' AS type, 'python_packages' AS source FROM python_packages;",
+        "purpose": "Informational",
+        "tags": [
+          "inventory",
+          "built-in"
+        ],
+        "contributors": [
+          {
+            "name": "zwass",
+            "handle": "zwass",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/zwass"
+          }
+        ],
+        "kind": "query",
+        "slug": "get-installed-linux-software",
+        "resolution": "N/A",
+        "requiresMdm": false
+      },
+      {
+        "name": "Get installed macOS software",
+        "platform": "darwin",
+        "description": "Get all software installed on a macOS computer, including apps, browser plugins, and installed packages. Note that this does not include other running processes in the processes table.",
+        "query": "SELECT name AS name, bundle_short_version AS version, 'Application (macOS)' AS type, 'apps' AS source FROM apps UNION SELECT name AS name, version AS version, 'Package (Python)' AS type, 'python_packages' AS source FROM python_packages UNION SELECT name AS name, version AS version, 'Browser plugin (Chrome)' AS type, 'chrome_extensions' AS source FROM chrome_extensions UNION SELECT name AS name, version AS version, 'Browser plugin (Firefox)' AS type, 'firefox_addons' AS source FROM firefox_addons UNION SELECT name As name, version AS version, 'Browser plugin (Safari)' AS type, 'safari_extensions' AS source FROM safari_extensions UNION SELECT name AS name, version AS version, 'Package (Homebrew)' AS type, 'homebrew_packages' AS source FROM homebrew_packages;",
+        "purpose": "Informational",
+        "tags": [
+          "inventory",
+          "built-in"
+        ],
+        "contributors": [
+          {
+            "name": "zwass",
+            "handle": "zwass",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/zwass"
+          }
+        ],
+        "kind": "query",
+        "slug": "get-installed-mac-os-software",
+        "resolution": "N/A",
+        "requiresMdm": false
+      },
+      {
+        "name": "Get installed Safari extensions",
+        "platform": "darwin",
+        "description": "Retrieves the list of installed Safari Extensions for all users in the target system.",
+        "query": "SELECT safari_extensions.* FROM users join safari_extensions USING (uid);",
+        "purpose": "Informational",
+        "tags": [
+          "browser",
+          "built-in",
+          "inventory"
+        ],
+        "contributors": [
+          {
+            "name": "zwass",
+            "handle": "zwass",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/zwass"
+          }
+        ],
+        "kind": "query",
+        "slug": "get-installed-safari-extensions",
+        "resolution": "N/A",
+        "requiresMdm": false
+      },
+      {
+        "name": "Get installed Windows software",
+        "platform": "windows",
+        "description": "Get all software installed on a Windows computer, including programs, browser plugins, and installed packages. Note that this does not include other running processes in the processes table.",
+        "query": "SELECT name AS name, version AS version, 'Program (Windows)' AS type, 'programs' AS source FROM programs UNION SELECT name AS name, version AS version, 'Package (Python)' AS type, 'python_packages' AS source FROM python_packages UNION SELECT name AS name, version AS version, 'Browser plugin (IE)' AS type, 'ie_extensions' AS source FROM ie_extensions UNION SELECT name AS name, version AS version, 'Browser plugin (Chrome)' AS type, 'chrome_extensions' AS source FROM chrome_extensions UNION SELECT name AS name, version AS version, 'Browser plugin (Firefox)' AS type, 'firefox_addons' AS source FROM firefox_addons UNION SELECT name AS name, version AS version, 'Package (Chocolatey)' AS type, 'chocolatey_packages' AS source FROM chocolatey_packages;",
+        "purpose": "Informational",
+        "tags": [
+          "inventory",
+          "built-in"
+        ],
+        "contributors": [
+          {
+            "name": "zwass",
+            "handle": "zwass",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/zwass"
+          }
+        ],
+        "kind": "query",
+        "slug": "get-installed-windows-software",
+        "resolution": "N/A",
+        "requiresMdm": false
+      },
+      {
+        "name": "Get laptops with failing batteries",
+        "platform": "darwin",
+        "description": "Lists all laptops with under-performing or failing batteries.",
+        "query": "SELECT * FROM battery WHERE health != 'Good' AND condition NOT IN ('', 'Normal');",
+        "purpose": "Informational",
+        "tags": [
+          "troubleshooting",
+          "hardware",
+          "inventory"
+        ],
+        "contributors": [
+          {
+            "name": "zwass",
+            "handle": "zwass",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/zwass"
+          }
+        ],
+        "kind": "query",
+        "slug": "get-laptops-with-failing-batteries",
+        "resolution": "N/A",
+        "requiresMdm": false
+      },
+      {
+        "name": "Get current users with active shell/console on the system",
+        "platform": "darwin, linux, windows",
+        "description": "Get current users with active shell/console on the system and associated process",
+        "query": "SELECT user,host,time, p.name, p.cmdline, p.cwd, p.root FROM logged_in_users liu, processes p WHERE liu.pid = p.pid and liu.type='user' and liu.user <> '' ORDER BY time;",
+        "purpose": "Informational",
+        "tags": [
+          "hunting",
+          "built-in"
+        ],
+        "contributors": [
+          {
+            "name": "anelshaer",
+            "handle": "anelshaer",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/anelshaer"
+          }
+        ],
+        "kind": "query",
+        "slug": "get-current-users-with-active-shell-console-on-the-system",
+        "resolution": "N/A",
+        "requiresMdm": false
+      },
+      {
+        "name": "Get unencrypted SSH keys for local accounts",
+        "platform": "darwin, linux, windows",
+        "description": "Identify SSH keys created without a passphrase which can be used in Lateral Movement (MITRE. TA0008)",
+        "query": "SELECT uid, username, description, path, encrypted FROM users CROSS JOIN user_ssh_keys using (uid) WHERE encrypted=0;",
+        "purpose": "Informational",
+        "tags": [
+          "inventory",
+          "compliance",
+          "ssh",
+          "built-in"
+        ],
+        "remediation": "First, make the user aware about the impact of SSH keys.  Then rotate the unencrypted keys detected.",
+        "contributors": [
+          {
+            "name": "anelshaer",
+            "handle": "anelshaer",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/anelshaer"
+          }
+        ],
+        "kind": "query",
+        "slug": "get-unencrypted-ssh-keys-for-local-accounts",
+        "resolution": "N/A",
+        "requiresMdm": false
+      },
+      {
+        "name": "Get unencrypted SSH keys for domain-joined accounts",
+        "platform": "darwin, linux, windows",
+        "description": "Identify SSH keys created without a passphrase which can be used in Lateral Movement (MITRE. TA0008)",
+        "query": "SELECT uid, username, description, path, encrypted FROM users CROSS JOIN user_ssh_keys using (uid) WHERE encrypted=0 and username in (SELECT distinct(username) FROM last);",
+        "purpose": "Informational",
+        "tags": [
+          "inventory",
+          "compliance",
+          "ssh",
+          "active directory"
+        ],
+        "remediation": "First, make the user aware about the impact of SSH keys.  Then rotate the unencrypted keys detected.",
+        "contributors": [
+          {
+            "name": "anelshaer",
+            "handle": "anelshaer",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/anelshaer"
+          }
+        ],
+        "kind": "query",
+        "slug": "get-unencrypted-ssh-keys-for-domain-joined-accounts",
+        "resolution": "N/A",
+        "requiresMdm": false
+      },
+      {
+        "name": "Get dynamic linker hijacking on Linux (MITRE. T1574.006)",
+        "platform": "linux",
+        "description": "Detect any processes that run with LD_PRELOAD environment variable",
+        "query": "SELECT env.pid, env.key, env.value, p.name,p.path, p.cmdline, p.cwd FROM process_envs env join processes p USING (pid) WHERE key='LD_PRELOAD';",
+        "purpose": "Informational",
+        "tags": [
+          "hunting",
+          "attack",
+          "t1574"
+        ],
+        "remediation": "Identify the process/binary detected and confirm with the system's owner.",
+        "contributors": [
+          {
+            "name": "anelshaer",
+            "handle": "anelshaer",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/anelshaer"
+          }
+        ],
+        "kind": "query",
+        "slug": "get-dynamic-linker-hijacking-on-linux-mitre-t-1574-006",
+        "resolution": "N/A",
+        "requiresMdm": false
+      },
+      {
+        "name": "Get dynamic linker hijacking on macOS (MITRE. T1574.006)",
+        "platform": "darwin",
+        "description": "Detect any processes that run with DYLD_INSERT_LIBRARIES environment variable",
+        "query": "SELECT env.pid, env.key, env.value, p.name,p.path, p.cmdline, p.cwd FROM process_envs env join processes p USING (pid) WHERE key='DYLD_INSERT_LIBRARIES';",
+        "purpose": "Informational",
+        "tags": [
+          "hunting",
+          "attack",
+          "t1574"
+        ],
+        "remediation": "Identify the process/binary detected and confirm with the system's owner.",
+        "contributors": [
+          {
+            "name": "anelshaer",
+            "handle": "anelshaer",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/anelshaer"
+          }
+        ],
+        "kind": "query",
+        "slug": "get-dynamic-linker-hijacking-on-mac-os-mitre-t-1574-006",
+        "resolution": "N/A",
+        "requiresMdm": false
+      },
+      {
+        "name": "Get etc hosts entries",
+        "platform": "darwin, linux",
+        "description": "Line-parsed /etc/hosts",
+        "query": "SELECT * FROM etc_hosts WHERE address not in ('127.0.0.1', '::1');",
+        "purpose": "informational",
+        "tags": [
+          "hunting",
+          "inventory"
+        ],
+        "contributors": [
+          {
+            "name": "anelshaer",
+            "handle": "anelshaer",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/anelshaer"
+          }
+        ],
+        "kind": "query",
+        "slug": "get-etc-hosts-entries",
+        "resolution": "N/A",
+        "requiresMdm": false
+      },
+      {
+        "name": "Get network interfaces",
+        "platform": "darwin, linux, windows",
+        "description": "Network interfaces MAC address",
+        "query": "SELECT a.interface, a.address, d.mac FROM interface_addresses a JOIN interface_details d USING (interface) WHERE address not in ('127.0.0.1', '::1');",
+        "purpose": "informational",
+        "tags": [
+          "hunting",
+          "inventory"
+        ],
+        "contributors": [
+          {
+            "name": "anelshaer",
+            "handle": "anelshaer",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/anelshaer"
+          }
+        ],
+        "kind": "query",
+        "slug": "get-network-interfaces",
+        "resolution": "N/A",
+        "requiresMdm": false
+      },
+      {
+        "name": "Get local user accounts",
+        "platform": "darwin, linux, windows",
+        "description": "Local user accounts (including domain accounts that have logged on locally (Windows)).",
+        "query": "SELECT uid, gid, username, description, directory, shell FROM users;",
+        "purpose": "informational",
+        "tags": [
+          "hunting",
+          "inventory"
+        ],
+        "contributors": [
+          {
+            "name": "anelshaer",
+            "handle": "anelshaer",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/anelshaer"
+          }
+        ],
+        "kind": "query",
+        "slug": "get-local-user-accounts",
+        "resolution": "N/A",
+        "requiresMdm": false
+      },
+      {
+        "name": "Get active user accounts on servers",
+        "platform": "linux",
+        "description": "Domain Joined environments normally have root or other service only accounts and users are SSH-ing using their Domain Accounts.",
+        "query": "SELECT * FROM shadow WHERE password_status='active' and username!='root';",
+        "purpose": "informational",
+        "tags": [
+          "hunting",
+          "inventory",
+          "active directory"
+        ],
+        "contributors": [
+          {
+            "name": "anelshaer",
+            "handle": "anelshaer",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/anelshaer"
+          }
+        ],
+        "kind": "query",
+        "slug": "get-active-user-accounts-on-servers",
+        "resolution": "N/A",
+        "requiresMdm": false
+      },
+      {
+        "name": "Get Nmap scanner",
+        "platform": "darwin, linux, windows",
+        "description": "Get Nmap scanner process, as well as its user, parent, and process details.",
+        "query": "SELECT p.pid, name, p.path, cmdline, cwd, start_time, parent, (SELECT name FROM processes WHERE pid=p.parent) AS parent_name, (SELECT username FROM users WHERE uid=p.uid) AS username FROM processes as p WHERE cmdline like 'nmap%';",
+        "purpose": "Informational",
+        "tags": [
+          "hunting",
+          "attack",
+          "t1046"
+        ],
+        "contributors": [
+          {
+            "name": "anelshaer",
+            "handle": "anelshaer",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/anelshaer"
+          }
+        ],
+        "kind": "query",
+        "slug": "get-nmap-scanner",
+        "resolution": "N/A",
+        "requiresMdm": false
+      },
+      {
+        "name": "Get Docker contained processes on a system",
+        "platform": "darwin, linux",
+        "description": "Docker containers Processes, can be used on normal systems or a kubenode.",
+        "query": "SELECT c.id, c.name, c.image, c.image_id, c.command, c.created, c.state, c.status, p.cmdline  FROM docker_containers c CROSS JOIN docker_container_processes p using(id);",
+        "purpose": "Informational",
+        "tags": [
+          "built-in",
+          "containers",
+          "inventory"
+        ],
+        "contributors": [
+          {
+            "name": "anelshaer",
+            "handle": "anelshaer",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/anelshaer"
+          }
+        ],
+        "kind": "query",
+        "slug": "get-docker-contained-processes-on-a-system",
+        "resolution": "N/A",
+        "requiresMdm": false
+      },
+      {
+        "name": "Get Windows print spooler remote code execution vulnerability",
+        "platform": "windows",
+        "description": "Detects devices that are potentially vulnerable to CVE-2021-1675 because the print spooler service is not disabled.",
+        "query": "SELECT CASE cnt WHEN 2 THEN \"TRUE\" ELSE \"FALSE\" END \"Vulnerable\" FROM (SELECT name start_type, COUNT(name) AS cnt FROM services WHERE name = 'NTDS' or (name = 'Spooler' and start_type <> 'DISABLED')) WHERE cnt = 2;",
+        "purpose": "Informational",
+        "tags": [
+          "vulnerability"
+        ],
+        "contributors": [
+          {
+            "name": "maravedi",
+            "handle": "maravedi",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/maravedi"
+          }
+        ],
+        "kind": "query",
+        "slug": "get-windows-print-spooler-remote-code-execution-vulnerability",
+        "resolution": "N/A",
+        "requiresMdm": false
+      },
+      {
+        "name": "Get local users and their privileges",
+        "platform": "darwin, linux, windows",
+        "description": "Collects the local user accounts and their respective user group.",
+        "query": "SELECT uid, username, type, groupname FROM users u JOIN groups g ON g.gid = u.gid;",
+        "purpose": "informational",
+        "tags": [
+          "inventory"
+        ],
+        "contributors": [
+          {
+            "name": "noahtalerman",
+            "handle": "noahtalerman",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/noahtalerman"
+          }
+        ],
+        "kind": "query",
+        "slug": "get-local-users-and-their-privileges",
+        "resolution": "N/A",
+        "requiresMdm": false
+      },
+      {
+        "name": "Get processes that no longer exist on disk",
+        "platform": "linux, darwin, windows",
+        "description": "Lists all processes of which the binary which launched them no longer exists on disk. Attackers often delete files from disk after launching a process to mask presence.",
+        "query": "SELECT name, path, pid FROM processes WHERE on_disk = 0;",
+        "purpose": "Incident response",
+        "tags": [
+          "hunting",
+          "built-in"
+        ],
+        "contributors": [
+          {
+            "name": "alphabrevity",
+            "handle": "alphabrevity",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/alphabrevity"
+          }
+        ],
+        "kind": "query",
+        "slug": "get-processes-that-no-longer-exist-on-disk",
+        "resolution": "N/A",
+        "requiresMdm": false
+      },
+      {
+        "name": "Get user files matching a specific hash",
+        "platform": "darwin, linux",
+        "description": "Looks for specific hash in the Users/ directories for files that are less than 50MB (osquery file size limitation.)",
+        "query": "SELECT path, sha256 FROM hash WHERE path IN (SELECT path FROM file WHERE size < 50000000 AND path LIKE '/Users/%/Documents/%%') AND sha256 = '16d28cd1d78b823c4f961a6da78d67a8975d66cde68581798778ed1f98a56d75';",
+        "purpose": "Informational",
+        "tags": [
+          "hunting",
+          "built-in"
+        ],
+        "contributors": [
+          {
+            "name": "alphabrevity",
+            "handle": "alphabrevity",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/alphabrevity"
+          }
+        ],
+        "kind": "query",
+        "slug": "get-user-files-matching-a-specific-hash",
+        "resolution": "N/A",
+        "requiresMdm": false
+      },
+      {
+        "name": "Get local administrator accounts on macOS",
+        "platform": "darwin",
+        "description": "The query allows you to check macOS systems for local administrator accounts.",
+        "query": "SELECT uid, username, type FROM users u JOIN groups g ON g.gid = u.gid;",
+        "purpose": "Informational",
+        "tags": [
+          "hunting",
+          "inventory"
+        ],
+        "contributors": [
+          {
+            "name": "alphabrevity",
+            "handle": "alphabrevity",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/alphabrevity"
+          }
+        ],
+        "kind": "query",
+        "slug": "get-local-administrator-accounts-on-mac-os",
+        "resolution": "N/A",
+        "requiresMdm": false
+      },
+      {
+        "name": "Get all listening ports, by process",
+        "platform": "linux, darwin, windows",
+        "description": "List ports that are listening on all interfaces, along with the process to which they are attached.",
+        "query": "SELECT lp.address, lp.pid, lp.port, lp.protocol, p.name, p.path, p.cmdline FROM listening_ports lp JOIN processes p ON lp.pid = p.pid WHERE lp.address = \"0.0.0.0\";",
+        "purpose": "Informational",
+        "tags": [
+          "hunting",
+          "network"
+        ],
+        "contributors": [
+          {
+            "name": "alphabrevity",
+            "handle": "alphabrevity",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/alphabrevity"
+          }
+        ],
+        "kind": "query",
+        "slug": "get-all-listening-ports-by-process",
+        "resolution": "N/A",
+        "requiresMdm": false
+      },
+      {
+        "name": "Get whether TeamViewer is installed/running",
+        "platform": "windows",
+        "description": "Looks for the TeamViewer service running on machines. This is often used when attackers gain access to a machine, running TeamViewer to allow them to access a machine.",
+        "query": "SELECT display_name,status,s.pid,p.path FROM services AS s JOIN processes AS p USING(pid) WHERE s.name LIKE \"%teamviewer%\";",
+        "purpose": "Informational",
+        "tags": [
+          "hunting",
+          "inventory"
+        ],
+        "contributors": [
+          {
+            "name": "alphabrevity",
+            "handle": "alphabrevity",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/alphabrevity"
+          }
+        ],
+        "kind": "query",
+        "slug": "get-whether-team-viewer-is-installed-running",
+        "resolution": "N/A",
+        "requiresMdm": false
+      },
+      {
+        "name": "Get malicious Python backdoors",
+        "platform": "darwin, linux, windows",
+        "description": "Watches for the backdoored Python packages installed on the system. See (http://www.nbu.gov.sk/skcsirt-sa-20170909-pypi/index.html)",
+        "query": "SELECT CASE cnt WHEN 0 THEN \"NONE_INSTALLED\" ELSE \"INSTALLED\" END AS \"Malicious Python Packages\", package_name, package_version FROM (SELECT COUNT(name) AS cnt, name AS package_name, version AS package_version, path AS package_path FROM python_packages WHERE package_name IN ('acquisition', 'apidev-coop', 'bzip', 'crypt', 'django-server', 'pwd', 'setup-tools', 'telnet', 'urlib3', 'urllib'));",
+        "purpose": "Informational",
+        "tags": [
+          "hunting",
+          "inventory",
+          "malware"
+        ],
+        "contributors": [
+          {
+            "name": "alphabrevity",
+            "handle": "alphabrevity",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/alphabrevity"
+          }
+        ],
+        "kind": "query",
+        "slug": "get-malicious-python-backdoors",
+        "resolution": "N/A",
+        "requiresMdm": false
+      },
+      {
+        "name": "Check for artifacts of the Floxif trojan",
+        "platform": "windows",
+        "description": "Checks for artifacts from the Floxif trojan on Windows machines.",
+        "query": "SELECT * FROM registry WHERE path LIKE 'HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Piriform\\\\Agomo%';",
+        "purpose": "Informational",
+        "tags": [
+          "hunting",
+          "malware"
+        ],
+        "contributors": [
+          {
+            "name": "micheal-o",
+            "handle": "micheal-o",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/micheal-o"
+          }
+        ],
+        "kind": "query",
+        "slug": "check-for-artifacts-of-the-floxif-trojan",
+        "resolution": "N/A",
+        "requiresMdm": false
+      },
+      {
+        "name": "Get Shimcache table",
+        "platform": "windows",
+        "description": "Returns forensic data showing evidence of likely file execution, in addition to the last modified timestamp of the file, order of execution, full file path order of execution, and the order in which files were executed.",
+        "query": "select * from Shimcache",
+        "purpose": "Informational",
+        "tags": [
+          "hunting"
+        ],
+        "contributors": [
+          {
+            "name": "puffyCid",
+            "handle": "puffyCid",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/puffyCid"
+          }
+        ],
+        "kind": "query",
+        "slug": "get-shimcache-table",
+        "resolution": "N/A",
+        "requiresMdm": false
+      },
+      {
+        "name": "Get running docker containers",
+        "platform": "darwin, linux",
+        "description": "Returns the running Docker containers",
+        "query": "SELECT id, name, image, image_id, state, status FROM docker_containers WHERE state = \"running\";",
+        "purpose": "Informational",
+        "tags": [
+          "containers",
+          "inventory"
+        ],
+        "contributors": [
+          {
+            "name": "DominusKelvin",
+            "handle": "DominusKelvin",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/DominusKelvin"
+          }
+        ],
+        "kind": "query",
+        "slug": "get-running-docker-containers",
+        "resolution": "N/A",
+        "requiresMdm": false
+      },
+      {
+        "name": "Get applications hogging memory",
+        "platform": "darwin, linux, windows",
+        "description": "Returns top 10 applications or processes hogging memory the most.",
+        "query": "SELECT pid, name, ROUND((total_size * '10e-7'), 2) AS memory_used FROM processes ORDER BY total_size DESC LIMIT 10;",
+        "purpose": "Informational",
+        "tags": [
+          "troubleshooting"
+        ],
+        "contributors": [
+          {
+            "name": "DominusKelvin",
+            "handle": "DominusKelvin",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/DominusKelvin"
+          }
+        ],
+        "kind": "query",
+        "slug": "get-applications-hogging-memory",
+        "resolution": "N/A",
+        "requiresMdm": false
+      },
+      {
+        "name": "Get servers with root login in the last 24 hours",
+        "platform": "darwin, linux, windows",
+        "description": "Returns servers with root login in the last 24 hours and the time the users were logged in.",
+        "query": "SELECT * FROM last WHERE username = \"root\" AND time > (( SELECT unix_time FROM time ) - 86400 );",
+        "purpose": "Informational",
+        "tags": [
+          "hunting"
+        ],
+        "contributors": [
+          {
+            "name": "DominusKelvin",
+            "handle": "DominusKelvin",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/DominusKelvin"
+          }
+        ],
+        "kind": "query",
+        "slug": "get-servers-with-root-login-in-the-last-24-hours",
+        "resolution": "N/A",
+        "requiresMdm": false
+      },
+      {
+        "name": "Detect active processes with Log4j running",
+        "platform": "darwin, linux",
+        "description": "Returns a list of active processes and the Jar paths which are using Log4j. Version numbers are usually within the Jar filename. Note: This query is resource intensive and has caused problems on systems with limited swap space. Test on some systems before running this widely.",
+        "query": "WITH target_jars AS (\n  SELECT DISTINCT path\n  FROM (\n      WITH split(word, str) AS(\n        SELECT '', cmdline || ' '\n        FROM processes\n        UNION ALL\n        SELECT substr(str, 0, instr(str, ' ')), substr(str, instr(str, ' ') + 1)\n        FROM split\n        WHERE str != '')\n      SELECT word AS path\n      FROM split\n      WHERE word LIKE '%.jar'\n    UNION ALL\n      SELECT path\n      FROM process_open_files\n      WHERE path LIKE '%.jar'\n  )\n)\nSELECT path, matches\nFROM yara\nWHERE path IN (SELECT path FROM target_jars)\n  AND count > 0\n  AND sigrule IN (\n    'rule log4jJndiLookup {\n      strings:\n        $jndilookup = \"JndiLookup\"\n      condition:\n        $jndilookup\n    }',\n    'rule log4jJavaClass {\n      strings:\n        $javaclass = \"org/apache/logging/log4j\"\n      condition:\n        $javaclass\n    }'\n  );\n",
+        "purpose": "Detection",
+        "tags": [
+          "vulnerability"
+        ],
+        "contributors": [
+          {
+            "name": "zwass",
+            "handle": "zwass",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/zwass"
+          },
+          {
+            "name": "tgauda",
+            "handle": "tgauda",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/tgauda"
+          }
+        ],
+        "kind": "query",
+        "slug": "detect-active-processes-with-log-4-j-running",
+        "resolution": "N/A",
+        "requiresMdm": false
+      },
+      {
+        "name": "Get applications that were opened within the last 24 hours",
+        "platform": "darwin",
+        "description": "Returns applications that were opened within the last 24 hours starting with the last opened application.",
+        "query": "SELECT * FROM apps WHERE last_opened_time > (( SELECT unix_time FROM time ) - 86400 ) ORDER BY last_opened_time DESC;",
+        "purpose": "Informational",
+        "tags": [
+          "inventory"
+        ],
+        "contributors": [
+          {
+            "name": "DominusKelvin",
+            "handle": "DominusKelvin",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/DominusKelvin"
+          }
+        ],
+        "kind": "query",
+        "slug": "get-applications-that-were-opened-within-the-last-24-hours",
+        "resolution": "N/A",
+        "requiresMdm": false
+      },
+      {
+        "name": "Get applications that are not in the Applications directory",
+        "platform": "darwin",
+        "description": "Returns applications that are not in the `/Applications` directory",
+        "query": "SELECT * FROM apps WHERE path NOT LIKE '/Applications/%';",
+        "purpose": "Informational",
+        "tags": [
+          "hunting",
+          "inventory"
+        ],
+        "contributors": [
+          {
+            "name": "DominusKelvin",
+            "handle": "DominusKelvin",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/DominusKelvin"
+          }
+        ],
+        "kind": "query",
+        "slug": "get-applications-that-are-not-in-the-applications-directory",
+        "resolution": "N/A",
+        "requiresMdm": false
+      },
+      {
+        "name": "Get subscription-based applications that have not been opened for the last 30 days",
+        "platform": "darwin",
+        "description": "Returns applications that are subscription-based and have not been opened for the last 30 days. You can replace the list of applications with those specific to your use case.",
+        "query": "SELECT * FROM apps WHERE path LIKE '/Applications/%' AND name IN (\"Photoshop.app\", \"Adobe XD.app\", \"Sketch.app\", \"Illustrator.app\") AND last_opened_time < (( SELECT unix_time FROM time ) - 2592000000000 );",
+        "purpose": "Informational",
+        "tags": [
+          "inventory"
+        ],
+        "contributors": [
+          {
+            "name": "DominusKelvin",
+            "handle": "DominusKelvin",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/DominusKelvin"
+          }
+        ],
+        "kind": "query",
+        "slug": "get-subscription-based-applications-that-have-not-been-opened-for-the-last-30-days",
+        "resolution": "N/A",
+        "requiresMdm": false
+      },
+      {
+        "name": "Get operating system information",
+        "platform": "darwin, windows, linux",
+        "description": "Returns the operating system name and version on the device.",
+        "query": "SELECT name, version FROM os_version;",
+        "purpose": "Informational",
+        "tags": [
+          "inventory",
+          "built-in"
+        ],
+        "contributors": [
+          {
+            "name": "noahtalerman",
+            "handle": "noahtalerman",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/noahtalerman"
+          }
+        ],
+        "kind": "query",
+        "slug": "get-operating-system-information",
+        "resolution": "N/A",
+        "requiresMdm": false
+      },
+      {
+        "name": "Gatekeeper enabled (macOS)",
+        "query": "SELECT 1 FROM gatekeeper WHERE assessments_enabled = 1;",
+        "description": "Checks to make sure that the Gatekeeper feature is enabled on macOS devices. Gatekeeper tries to ensure only trusted software is run on a mac machine.",
+        "resolution": "To enable Gatekeeper, on the failing device, run the following command in the Terminal app: /usr/sbin/spctl --master-enable.",
+        "tags": [
+          "compliance",
+          "hardening",
+          "built-in",
+          "cis",
+          "cis2.5.2.1"
+        ],
+        "platform": "darwin",
+        "contributors": [
+          {
+            "name": "groob",
+            "handle": "groob",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/groob"
+          }
+        ],
+        "kind": "policy",
+        "slug": "gatekeeper-enabled-mac-os",
+        "requiresMdm": false,
+        "critical": true
+      },
+      {
+        "name": "Full disk encryption enabled (Windows)",
+        "query": "SELECT 1 FROM bitlocker_info WHERE drive_letter='C:' AND protection_status=1;",
+        "description": "Checks to make sure that full disk encryption is enabled on Windows devices.",
+        "resolution": "To get additional information, run the following osquery query on the failing device: SELECT * FROM bitlocker_info. In the query results, if protection_status is 2, then the status cannot be determined. If it is 0, it is considered unprotected. Use the additional results (percent_encrypted, conversion_status, etc.) to help narrow down the specific reason why Windows considers the volume unprotected.",
+        "platform": "windows",
+        "tags": [
+          "compliance",
+          "hardening",
+          "built-in"
+        ],
+        "contributors": [
+          {
+            "name": "defensivedepth",
+            "handle": "defensivedepth",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/defensivedepth"
+          }
+        ],
+        "kind": "policy",
+        "slug": "full-disk-encryption-enabled-windows",
+        "requiresMdm": false,
+        "critical": true
+      },
+      {
+        "name": "Full disk encryption enabled (macOS)",
+        "query": "SELECT 1 FROM disk_encryption WHERE user_uuid IS NOT \"\" AND filevault_status = 'on' LIMIT 1;",
+        "description": "Checks to make sure that full disk encryption (FileVault) is enabled on macOS devices.",
+        "resolution": "To enable full disk encryption, on the failing device, select System Preferences > Security & Privacy > FileVault > Turn On FileVault.",
+        "tags": [
+          "compliance",
+          "hardening",
+          "built-in",
+          "cis",
+          "cis2.5.1.1"
+        ],
+        "platform": "darwin",
+        "contributors": [
+          {
+            "name": "groob",
+            "handle": "groob",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/groob"
+          }
+        ],
+        "kind": "policy",
+        "slug": "full-disk-encryption-enabled-mac-os",
+        "requiresMdm": false,
+        "critical": true
+      },
+      {
+        "name": "Full disk encryption enabled (Linux)",
+        "query": "SELECT 1 FROM disk_encryption WHERE encrypted=1 AND name LIKE '/dev/dm-1';",
+        "description": "Checks if the root drive is encrypted. There are many ways to encrypt Linux systems. This is the default on distributions such as Ubuntu.",
+        "resolution": "Ensure the image deployed to your Linux workstation includes full disk encryption.",
+        "platform": "linux",
+        "tags": [
+          "compliance",
+          "hardening",
+          "built-in"
+        ],
+        "contributors": [
+          {
+            "name": "GuillaumeRoss",
+            "handle": "GuillaumeRoss",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/GuillaumeRoss"
+          }
+        ],
+        "kind": "policy",
+        "slug": "full-disk-encryption-enabled-linux",
+        "requiresMdm": false,
+        "critical": true
+      },
+      {
+        "name": "System Integrity Protection enabled (macOS)",
+        "query": "SELECT 1 FROM sip_config WHERE config_flag = 'sip' AND enabled = 1;",
+        "description": "Checks to make sure that the System Integrity Protection feature is enabled.",
+        "resolution": "To enable System Integrity Protection, on the failing device, run the following command in the Terminal app: /usr/sbin/spctl --master-enable.",
+        "tags": [
+          "compliance",
+          "malware",
+          "hardening",
+          "built-in",
+          "cis",
+          "cis5.1.2"
+        ],
+        "platform": "darwin",
+        "contributors": [
+          {
+            "name": "groob",
+            "handle": "groob",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/groob"
+          }
+        ],
+        "kind": "policy",
+        "slug": "system-integrity-protection-enabled-mac-os",
+        "requiresMdm": false
+      },
+      {
+        "name": "Automatic login disabled (macOS)",
+        "query": "SELECT 1 FROM managed_policies WHERE domain = 'com.apple.loginwindow' AND name = 'com.apple.login.mcx.DisableAutoLoginClient' AND value = 1 LIMIT 1;",
+        "description": "Checks that a mobile device management (MDM) solution configures the Mac to prevent login in without a password.",
+        "resolution": "Contact your IT administrator to ensure your Mac is receiving a profile that disables automatic login.",
+        "tags": [
+          "compliance",
+          "hardening",
+          "built-in"
+        ],
+        "platform": "darwin",
+        "contributors": [
+          {
+            "name": "groob",
+            "handle": "groob",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/groob"
+          }
+        ],
+        "kind": "policy",
+        "slug": "automatic-login-disabled-mac-os",
+        "requiresMdm": true,
+        "critical": true
+      },
+      {
+        "name": "Secure keyboard entry for Terminal application enabled (macOS)",
+        "query": "SELECT 1 FROM managed_policies WHERE domain = 'com.apple.Terminal' AND name = 'SecureKeyboardEntry' AND value = 1 LIMIT 1;",
+        "description": "Checks that a mobile device management (MDM) solution configures the Mac to enabled secure keyboard entry for the Terminal application.",
+        "resolution": "Contact your IT administrator to ensure your Mac is receiving a profile that enables secure keyboard entry for the Terminal application.",
+        "tags": [
+          "compliance",
+          "hardening",
+          "built-in"
+        ],
+        "platform": "darwin",
+        "contributors": [
+          {
+            "name": "groob",
+            "handle": "groob",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/groob"
+          }
+        ],
+        "kind": "policy",
+        "slug": "secure-keyboard-entry-for-terminal-application-enabled-mac-os",
+        "requiresMdm": true
+      },
+      {
+        "name": "Get built-in antivirus status on macOS",
+        "platform": "darwin",
+        "query": "SELECT path, value AS version FROM plist WHERE (key = 'CFBundleShortVersionString' AND path = '/Library/Apple/System/Library/CoreServices/MRT.app/Contents/Info.plist') OR (key = 'CFBundleShortVersionString' AND path = '/Library/Apple/System/Library/CoreServices/XProtect.bundle/Contents/Info.plist');",
+        "description": "Reads the version numbers from the Malware Removal Tool (MRT) and built-in antivirus (XProtect) plists",
+        "purpose": "Informational",
+        "tags": [
+          "compliance",
+          "malware",
+          "hardening",
+          "built-in"
+        ],
+        "contributors": [
+          {
+            "name": "GuillaumeRoss",
+            "handle": "GuillaumeRoss",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/GuillaumeRoss"
+          }
+        ],
+        "kind": "query",
+        "slug": "get-built-in-antivirus-status-on-mac-os",
+        "resolution": "N/A",
+        "requiresMdm": false
+      },
+      {
+        "name": "Get antivirus status from the Windows Security Center",
+        "platform": "windows",
+        "query": "SELECT antivirus, signatures_up_to_date from windows_security_center CROSS JOIN windows_security_products WHERE type = 'Antivirus';",
+        "description": "Selects the antivirus and signatures status from Windows Security Center.",
+        "purpose": "Informational",
+        "tags": [
+          "compliance",
+          "malware",
+          "hardening",
+          "built-in"
+        ],
+        "contributors": [
+          {
+            "name": "GuillaumeRoss",
+            "handle": "GuillaumeRoss",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/GuillaumeRoss"
+          }
+        ],
+        "kind": "query",
+        "slug": "get-antivirus-status-from-the-windows-security-center",
+        "resolution": "N/A",
+        "requiresMdm": false
+      },
+      {
+        "name": "Get antivirus (ClamAV/clamd) and updater (freshclam) process status",
+        "platform": "linux",
+        "query": "SELECT pid, state, cmdline, name FROM processes WHERE name='clamd' OR name='freshclam';",
+        "description": "Selects the clamd and freshclam processes to ensure AV and its updater are running",
+        "purpose": "Informational",
+        "tags": [
+          "compliance",
+          "malware",
+          "hardening",
+          "built-in"
+        ],
+        "contributors": [
+          {
+            "name": "GuillaumeRoss",
+            "handle": "GuillaumeRoss",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/GuillaumeRoss"
+          }
+        ],
+        "kind": "query",
+        "slug": "get-antivirus-clam-av-clamd-and-updater-freshclam-process-status",
+        "resolution": "N/A",
+        "requiresMdm": false
+      },
+      {
+        "name": "Antivirus healthy (macOS)",
+        "query": "SELECT score FROM (SELECT case when COUNT(*) = 2 then 1 ELSE 0 END AS score FROM plist WHERE (key = 'CFBundleShortVersionString' AND path = '/Library/Apple/System/Library/CoreServices/XProtect.bundle/Contents/Info.plist' AND value>=2162) OR (key = 'CFBundleShortVersionString' AND path = '/Library/Apple/System/Library/CoreServices/MRT.app/Contents/Info.plist' and value>=1.93)) WHERE score == 1;",
+        "description": "Checks the version of Malware Removal Tool (MRT) and the built-in macOS AV (Xprotect). Replace version numbers with the latest version regularly.",
+        "resolution": "To enable automatic security definition updates, on the failing device, select System Preferences > Software Update > Advanced > Turn on Install system data files and security updates.",
+        "tags": [
+          "compliance",
+          "malware",
+          "hardening",
+          "built-in",
+          "template"
+        ],
+        "platform": "darwin",
+        "contributors": [
+          {
+            "name": "GuillaumeRoss",
+            "handle": "GuillaumeRoss",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/GuillaumeRoss"
+          }
+        ],
+        "kind": "policy",
+        "slug": "antivirus-healthy-mac-os",
+        "requiresMdm": false
+      },
+      {
+        "name": "Antivirus healthy (Windows)",
+        "query": "SELECT 1 from windows_security_center wsc CROSS JOIN windows_security_products wsp WHERE antivirus = 'Good' AND type = 'Antivirus' AND signatures_up_to_date=1;",
+        "description": "Checks the status of antivirus and signature updates from the Windows Security Center.",
+        "resolution": "Ensure Windows Defender or your third-party antivirus is running, up to date, and visible in the Windows Security Center.",
+        "tags": [
+          "compliance",
+          "malware",
+          "hardening",
+          "built-in"
+        ],
+        "platform": "windows",
+        "contributors": [
+          {
+            "name": "GuillaumeRoss",
+            "handle": "GuillaumeRoss",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/GuillaumeRoss"
+          }
+        ],
+        "kind": "policy",
+        "slug": "antivirus-healthy-windows",
+        "requiresMdm": false
+      },
+      {
+        "name": "Antivirus healthy (Linux)",
+        "query": "SELECT score FROM (SELECT case when COUNT(*) = 2 then 1 ELSE 0 END AS score FROM processes WHERE (name = 'clamd') OR (name = 'freshclam')) WHERE score == 1;",
+        "description": "Checks that both ClamAV's daemon and its updater service (freshclam) are running.",
+        "resolution": "Ensure ClamAV and Freshclam are installed and running.",
+        "tags": [
+          "compliance",
+          "malware",
+          "hardening",
+          "built-in"
+        ],
+        "platform": "linux",
+        "contributors": [
+          {
+            "name": "GuillaumeRoss",
+            "handle": "GuillaumeRoss",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/GuillaumeRoss"
+          }
+        ],
+        "kind": "policy",
+        "slug": "antivirus-healthy-linux",
+        "requiresMdm": false
+      },
+      {
+        "name": "MDM enrolled (macOS)",
+        "query": "SELECT 1 from mdm WHERE enrolled='true';",
+        "description": "Required: osquery deployed with Orbit, or manual installation of macadmins/osquery-extension. Checks that a mac is enrolled to MDM. Add a AND on identity_certificate_uuid to check for a specific MDM.",
+        "resolution": "Enroll device to MDM",
+        "tags": [
+          "compliance",
+          "hardening",
+          "built-in"
+        ],
+        "platform": "darwin",
+        "contributors": [
+          {
+            "name": "GuillaumeRoss",
+            "handle": "GuillaumeRoss",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/GuillaumeRoss"
+          }
+        ],
+        "kind": "policy",
+        "slug": "mdm-enrolled-mac-os",
+        "requiresMdm": false,
+        "critical": true
+      },
+      {
+        "name": "Docker application is up to date or not present (macOS)",
+        "query": "SELECT 1 WHERE EXISTS (SELECT 1 FROM apps a1 WHERE a1.bundle_identifier = 'com.electron.dockerdesktop' AND a1.bundle_short_version>='4.6.1') OR NOT EXISTS (SELECT 1 FROM apps a2 WHERE a2.bundle_identifier = 'com.electron.dockerdesktop');",
+        "description": "Checks if the application (Docker Desktop example) is installed and up to date, or not installed. Fails if the application is installed and on a lower version. You can copy this query and replace the bundle_identifier and bundle_version values to apply the same type of policy to other applications.",
+        "resolution": "Update Docker or remove it if not used.",
+        "tags": [
+          "inventory",
+          "vulnerability",
+          "built-in"
+        ],
+        "platform": "darwin",
+        "contributors": [
+          {
+            "name": "GuillaumeRoss",
+            "handle": "GuillaumeRoss",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/GuillaumeRoss"
+          }
+        ],
+        "kind": "policy",
+        "slug": "docker-application-is-up-to-date-or-not-present-mac-os",
+        "requiresMdm": false
+      },
+      {
+        "name": "SSH keys encrypted",
+        "query": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM users CROSS JOIN user_ssh_keys USING (uid) WHERE encrypted='0');",
+        "description": "Required: osquery must have Full Disk Access. Policy passes if all keys are encrypted, including if no keys are present.",
+        "resolution": "Use this command to encrypt existing SSH keys by providing the path to the file: ssh-keygen -o -p -f /path/to/file",
+        "tags": [
+          "compliance",
+          "ssh",
+          "built-in"
+        ],
+        "contributors": [
+          {
+            "name": "GuillaumeRoss",
+            "handle": "GuillaumeRoss",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/GuillaumeRoss"
+          }
+        ],
+        "platform": "darwin,linux,windows",
+        "kind": "policy",
+        "slug": "ssh-keys-encrypted",
+        "requiresMdm": false
+      },
+      {
+        "name": "Suspicious autostart (Windows)",
+        "query": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM startup_items WHERE path = \"regsvr32\" AND args LIKE \"%http%\");",
+        "description": "Checks for an autostart that is attempting to load a dynamic link library (DLL) from the internet.",
+        "resolution": "Remove the suspicious startup entry.",
+        "tags": [
+          "malware",
+          "hunting"
+        ],
+        "platform": "windows",
+        "contributors": [
+          {
+            "name": "kswagler-rh",
+            "handle": "kswagler-rh",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/kswagler-rh"
+          }
+        ],
+        "kind": "policy",
+        "slug": "suspicious-autostart-windows",
+        "requiresMdm": false
+      },
+      {
+        "name": "Firewall enabled (macOS)",
+        "query": "SELECT 1 FROM alf WHERE global_state >= 1;",
+        "description": "Checks if the firewall is enabled.",
+        "resolution": "In System Preferences, open Security & Privacy, navigate to the Firewall tab and click Turn On Firewall.",
+        "tags": [
+          "hardening",
+          "compliance",
+          "built-in",
+          "cis",
+          "cis2.5.2.2"
+        ],
+        "platform": "darwin",
+        "contributors": [
+          {
+            "name": "GuillaumeRoss",
+            "handle": "GuillaumeRoss",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/GuillaumeRoss"
+          }
+        ],
+        "kind": "policy",
+        "slug": "firewall-enabled-mac-os",
+        "requiresMdm": false
+      },
+      {
+        "name": "Screen lock enabled (macOS)",
+        "query": "SELECT 1 FROM managed_policies WHERE name='askForPassword' AND value='1';",
+        "description": "Checks that a mobile device management (MDM) solution configures the Mac to enable screen lock.",
+        "resolution": "Contact your IT administrator to ensure your Mac is receiving a profile that enables screen lock.",
+        "tags": [
+          "compliance",
+          "hardening",
+          "built-in"
+        ],
+        "platform": "darwin",
+        "contributors": [
+          {
+            "name": "GuillaumeRoss",
+            "handle": "GuillaumeRoss",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/GuillaumeRoss"
+          }
+        ],
+        "kind": "policy",
+        "slug": "screen-lock-enabled-mac-os",
+        "requiresMdm": true
+      },
+      {
+        "name": "Screen lock enabled (Windows)",
+        "query": "SELECT 1 FROM registry WHERE path = 'HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\InactivityTimeoutSecs' AND CAST(data as INTEGER) <= 1800;",
+        "description": "Checks if the screen lock is enabled and configured to lock the system within 30 minutes or less.",
+        "resolution": "Contact your IT administrator to enable the Interactive Logon: Machine inactivity limit setting with a value of 1800 seconds or lower.",
+        "tags": [
+          "compliance",
+          "hardening",
+          "built-in"
+        ],
+        "platform": "windows",
+        "contributors": [
+          {
+            "name": "GuillaumeRoss",
+            "handle": "GuillaumeRoss",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/GuillaumeRoss"
+          }
+        ],
+        "kind": "policy",
+        "slug": "screen-lock-enabled-windows",
+        "requiresMdm": false
+      },
+      {
+        "name": "Password requires 10 or more characters (macOS)",
+        "query": "SELECT 1 FROM (SELECT cast(lengthtxt as integer(2)) minlength FROM (SELECT SUBSTRING(length, 1, 2) AS lengthtxt FROM (SELECT policy_description, policy_identifier, split(policy_content, '{', 1) AS length FROM password_policy WHERE policy_identifier LIKE '%minLength')) WHERE minlength >= 10);",
+        "description": "Checks that the password policy requires at least 10 characters. Requires osquery 5.4.0 or newer.",
+        "resolution": "Contact your IT administrator to make sure your Mac is receiving configuration profiles for password length.",
+        "platform": "darwin",
+        "tags": [
+          "compliance",
+          "hardening",
+          "built-in",
+          "cis",
+          "cis5.2.2"
+        ],
+        "contributors": [
+          {
+            "name": "GuillaumeRoss",
+            "handle": "GuillaumeRoss",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/GuillaumeRoss"
+          }
+        ],
+        "kind": "policy",
+        "slug": "password-requires-10-or-more-characters-mac-os",
+        "requiresMdm": false
+      },
+      {
+        "name": "Operating system up to date (macOS)",
+        "query": "SELECT 1 FROM os_version WHERE version >= '14.1.1';",
+        "description": "Checks that the operating system is up to date.",
+        "resolution": "From the Apple menu () in the corner of your screen choose System Preferences. Then select Software Update and select Upgrade Now. You might be asked to restart or enter your password.",
+        "tags": [
+          "compliance",
+          "cis",
+          "template",
+          "cis1.1"
+        ],
+        "platform": "darwin",
+        "contributors": [
+          {
+            "name": "GuillaumeRoss",
+            "handle": "GuillaumeRoss",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/GuillaumeRoss"
+          }
+        ],
+        "kind": "policy",
+        "slug": "operating-system-up-to-date-mac-os",
+        "requiresMdm": false,
+        "critical": true
+      },
+      {
+        "name": "Automatic updates enabled (macOS)",
+        "query": "SELECT 1 FROM managed_policies WHERE domain='com.apple.SoftwareUpdate' AND name='AutomaticCheckEnabled' AND value=1 LIMIT 1;",
+        "description": "Checks that a mobile device management (MDM) solution configures the Mac to automatically check for updates.",
+        "resolution": "Contact your IT administrator to ensure your Mac is receiving a profile that enables automatic updates.",
+        "tags": [
+          "compliance",
+          "cis",
+          "cis1.2"
+        ],
+        "platform": "darwin",
+        "contributors": [
+          {
+            "name": "GuillaumeRoss",
+            "handle": "GuillaumeRoss",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/GuillaumeRoss"
+          }
+        ],
+        "kind": "policy",
+        "slug": "automatic-updates-enabled-mac-os",
+        "requiresMdm": true
+      },
+      {
+        "name": "Automatic update downloads enabled (macOS)",
+        "query": "SELECT 1 FROM managed_policies WHERE domain='com.apple.SoftwareUpdate' AND name='AutomaticDownload' AND value=1 LIMIT 1;",
+        "description": "Checks that a mobile device management (MDM) solution configures the Mac to automatically download updates.",
+        "resolution": "Contact your IT administrator to ensure your Mac is receiving a profile that enables automatic update downloads.",
+        "tags": [
+          "compliance",
+          "cis",
+          "cis1.3"
+        ],
+        "platform": "darwin",
+        "contributors": [
+          {
+            "name": "GuillaumeRoss",
+            "handle": "GuillaumeRoss",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/GuillaumeRoss"
+          }
+        ],
+        "kind": "policy",
+        "slug": "automatic-update-downloads-enabled-mac-os",
+        "requiresMdm": true
+      },
+      {
+        "name": "Automatic installation of application updates is enabled (macOS)",
+        "query": "SELECT 1 FROM managed_policies WHERE domain='com.apple.SoftwareUpdate' AND name='AutomaticallyInstallAppUpdates' AND value=1 LIMIT 1;",
+        "description": "Checks that a mobile device management (MDM) solution configures the Mac to automatically install updates to App Store applications.",
+        "resolution": "Contact your IT administrator to ensure your Mac is receiving a profile that enables automatic installation of application updates.",
+        "tags": [
+          "compliance",
+          "cis",
+          "cis1.4"
+        ],
+        "platform": "darwin",
+        "contributors": [
+          {
+            "name": "GuillaumeRoss",
+            "handle": "GuillaumeRoss",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/GuillaumeRoss"
+          }
+        ],
+        "kind": "policy",
+        "slug": "automatic-installation-of-application-updates-is-enabled-mac-os",
+        "requiresMdm": true
+      },
+      {
+        "name": "Automatic security and data file updates is enabled (macOS)",
+        "query": "SELECT 1 FROM managed_policies WHERE domain='com.apple.SoftwareUpdate' AND name='CriticalUpdateInstall' AND value=1 LIMIT 1;",
+        "description": "Checks that a mobile device management (MDM) solution configures the Mac to automatically download updates to built-in macOS security tools such as malware removal tools.",
+        "resolution": "Contact your IT administrator to ensure your Mac is receiving a profile that enables automatic security and data update installation.",
+        "tags": [
+          "compliance",
+          "cis",
+          "cis1.5"
+        ],
+        "platform": "darwin",
+        "contributors": [
+          {
+            "name": "GuillaumeRoss",
+            "handle": "GuillaumeRoss",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/GuillaumeRoss"
+          }
+        ],
+        "kind": "policy",
+        "slug": "automatic-security-and-data-file-updates-is-enabled-mac-os",
+        "requiresMdm": true
+      },
+      {
+        "name": "Automatic installation of operating system updates is enabled (macOS)",
+        "query": "SELECT 1 FROM managed_policies WHERE domain='com.apple.SoftwareUpdate' AND name='AutomaticallyInstallMacOSUpdates' AND value=1 LIMIT 1;",
+        "description": "Checks that a mobile device management (MDM) solution configures the Mac to automatically install operating system updates.",
+        "resolution": "Contact your IT administrator to ensure your Mac is receiving a profile that enables automatic installation of operating system updates.",
+        "tags": [
+          "compliance",
+          "cis",
+          "cis1.6"
+        ],
+        "platform": "darwin",
+        "contributors": [
+          {
+            "name": "GuillaumeRoss",
+            "handle": "GuillaumeRoss",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/GuillaumeRoss"
+          }
+        ],
+        "kind": "policy",
+        "slug": "automatic-installation-of-operating-system-updates-is-enabled-mac-os",
+        "requiresMdm": true
+      },
+      {
+        "name": "Time and date are configured to be updated automatically (macOS)",
+        "query": "SELECT 1 FROM managed_policies WHERE domain='com.apple.applicationaccess' AND name='forceAutomaticDateAndTime' AND value=1 LIMIT 1;",
+        "description": "Checks that a mobile device management (MDM) solution configures the Mac to automatically update the time and date.",
+        "resolution": "Contact your IT administrator to ensure your Mac is receiving a profile that enables automatic time and date configuration.",
+        "tags": [
+          "compliance",
+          "cis",
+          "cis2.2.1"
+        ],
+        "platform": "darwin",
+        "contributors": [
+          {
+            "name": "GuillaumeRoss",
+            "handle": "GuillaumeRoss",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/GuillaumeRoss"
+          }
+        ],
+        "kind": "policy",
+        "slug": "time-and-date-are-configured-to-be-updated-automatically-mac-os",
+        "requiresMdm": true
+      },
+      {
+        "name": "Lock screen after inactivity of 20 minutes or less (macOS)",
+        "query": "SELECT 1 WHERE EXISTS (SELECT CAST(value as integer(4)) valueint from managed_policies WHERE domain = 'com.apple.screensaver' AND name = 'askForPasswordDelay' AND valueint <= 60 LIMIT 1) AND EXISTS (SELECT CAST(value as integer(4)) valueint from managed_policies WHERE domain = 'com.apple.screensaver' AND name = 'idleTime' AND valueint <= 1140 LIMIT 1) AND EXISTS (SELECT 1 from managed_policies WHERE domain='com.apple.screensaver' AND name='askForPassword' AND value=1 LIMIT 1);",
+        "description": "Checks that a mobile device management (MDM) solution configures the Mac to lock the screen after 20 minutes or less.",
+        "resolution": "Contact your IT administrator to ensure your Mac is receiving a profile that enables the screen saver after inactivity of 20 minutes or less.",
+        "tags": [
+          "compliance",
+          "cis",
+          "cis2.3.1",
+          "cis5.8"
+        ],
+        "platform": "darwin",
+        "contributors": [
+          {
+            "name": "GuillaumeRoss",
+            "handle": "GuillaumeRoss",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/GuillaumeRoss"
+          }
+        ],
+        "kind": "policy",
+        "slug": "lock-screen-after-inactivity-of-20-minutes-or-less-mac-os",
+        "requiresMdm": true
+      },
+      {
+        "name": "Internet sharing is blocked (macOS)",
+        "query": "SELECT 1 FROM managed_policies WHERE domain='com.apple.MCX' AND name='forceInternetSharingOff' AND value='1' LIMIT 1;",
+        "description": "Checks that a mobile device management (MDM) solution configures the Mac to prevent Internet sharing.",
+        "resolution": "Contact your IT administrator to ensure your Mac is receiving a profile that prevents Internet sharing.",
+        "tags": [
+          "compliance",
+          "cis",
+          "cis2.4.2"
+        ],
+        "platform": "darwin",
+        "contributors": [
+          {
+            "name": "GuillaumeRoss",
+            "handle": "GuillaumeRoss",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/GuillaumeRoss"
+          }
+        ],
+        "kind": "policy",
+        "slug": "internet-sharing-is-blocked-mac-os",
+        "requiresMdm": true
+      },
+      {
+        "name": "Content caching is disabled (macOS)",
+        "query": "SELECT 1 FROM managed_policies WHERE domain='com.apple.applicationaccess' AND name='allowContentCaching' AND value='0' LIMIT 1;",
+        "description": "Checks that a mobile device management (MDM) solution configures the Mac to disable content caching.",
+        "resolution": "Contact your IT administrator to ensure your Mac is receiving a profile that disables content caching.",
+        "tags": [
+          "compliance",
+          "cis",
+          "cis2.4.10"
+        ],
+        "platform": "darwin",
+        "contributors": [
+          {
+            "name": "GuillaumeRoss",
+            "handle": "GuillaumeRoss",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/GuillaumeRoss"
+          }
+        ],
+        "kind": "policy",
+        "slug": "content-caching-is-disabled-mac-os",
+        "requiresMdm": true
+      },
+      {
+        "name": "Ad tracking is limited (macOS)",
+        "query": "SELECT 1 FROM managed_policies WHERE domain='com.apple.AdLib' AND name='forceLimitAdTracking' AND value='1' LIMIT 1;",
+        "description": "Checks that a mobile device management (MDM) solution configures the Mac to limit advertisement tracking.",
+        "resolution": "Contact your IT administrator to ensure your Mac is receiving a profile that disables advertisement tracking.",
+        "tags": [
+          "compliance",
+          "cis",
+          "cis2.5.6"
+        ],
+        "platform": "darwin",
+        "contributors": [
+          {
+            "name": "GuillaumeRoss",
+            "handle": "GuillaumeRoss",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/GuillaumeRoss"
+          }
+        ],
+        "kind": "policy",
+        "slug": "ad-tracking-is-limited-mac-os",
+        "requiresMdm": true
+      },
+      {
+        "name": "iCloud Desktop and Document sync is disabled (macOS)",
+        "query": "SELECT 1 FROM managed_policies WHERE domain='com.apple.icloud.managed' AND name='DisableCloudSync' AND value='1' LIMIT 1;",
+        "description": "Checks that a mobile device management (MDM) solution configures the Mac to prevent iCloud Desktop and Documents sync.",
+        "resolution": "Contact your IT administrator to ensure your Mac is receiving a profile to prevent iCloud Desktop and Documents sync.",
+        "tags": [
+          "compliance",
+          "cis",
+          "cis2.6.1.4"
+        ],
+        "platform": "darwin",
+        "contributors": [
+          {
+            "name": "GuillaumeRoss",
+            "handle": "GuillaumeRoss",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/GuillaumeRoss"
+          }
+        ],
+        "kind": "policy",
+        "slug": "i-cloud-desktop-and-document-sync-is-disabled-mac-os",
+        "requiresMdm": true
+      },
+      {
+        "name": "Firewall logging is enabled (macOS)",
+        "query": "SELECT 1 FROM managed_policies WHERE domain='com.apple.security.firewall' AND name='EnableLogging' AND value='1' LIMIT 1;",
+        "description": "Checks that a mobile device management (MDM) solution configures the Mac to log firewall activity.",
+        "resolution": "Contact your IT administrator to ensure your Mac is receiving a profile that enables firewall logging.",
+        "tags": [
+          "compliance",
+          "cis",
+          "cis3.6"
+        ],
+        "platform": "darwin",
+        "contributors": [
+          {
+            "name": "GuillaumeRoss",
+            "handle": "GuillaumeRoss",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/GuillaumeRoss"
+          }
+        ],
+        "kind": "policy",
+        "slug": "firewall-logging-is-enabled-mac-os",
+        "requiresMdm": true
+      },
+      {
+        "name": "Guest account disabled (macOS)",
+        "query": "SELECT 1 FROM managed_policies WHERE domain='com.apple.loginwindow' AND name='DisableGuestAccount' AND value='1' LIMIT 1;",
+        "description": "Checks that a mobile device management (MDM) solution configures the Mac to prevent the use of a guest account.",
+        "resolution": "Contact your IT administrator to ensure your Mac is receiving a profile that disables the guest account.",
+        "tags": [
+          "compliance",
+          "cis",
+          "cis6.1.3"
+        ],
+        "platform": "darwin",
+        "contributors": [
+          {
+            "name": "GuillaumeRoss",
+            "handle": "GuillaumeRoss",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/GuillaumeRoss"
+          }
+        ],
+        "kind": "policy",
+        "slug": "guest-account-disabled-mac-os",
+        "requiresMdm": true
+      },
+      {
+        "name": "Guest access to shared folders is disabled (macOS)",
+        "query": "SELECT 1 FROM managed_policies WHERE domain='com.apple.AppleFileServer' AND name='guestAccess' AND value='0' LIMIT 1;",
+        "description": "Checks that a mobile device management (MDM) solution configures the Mac to prevent guest access to shared folders.",
+        "resolution": "Contact your IT administrator to ensure your Mac is receiving a profile that prevents guest access to shared folders.",
+        "tags": [
+          "compliance",
+          "cis",
+          "cis6.1.4"
+        ],
+        "platform": "darwin",
+        "contributors": [
+          {
+            "name": "GuillaumeRoss",
+            "handle": "GuillaumeRoss",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/GuillaumeRoss"
+          }
+        ],
+        "kind": "policy",
+        "slug": "guest-access-to-shared-folders-is-disabled-mac-os",
+        "requiresMdm": true
+      },
+      {
+        "name": "No 1Password emergency kit stored in desktop, documents, or downloads folders (macOS)",
+        "query": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM file WHERE filename LIKE '%Emergency Kit%.pdf' AND (path LIKE '/Users/%/Desktop/%' OR path LIKE '/Users/%/Documents/%' OR path LIKE '/Users/%/Downloads/%' OR path LIKE '/Users/Shared/%'));",
+        "description": "Looks for PDF files with file names typically used by 1Password for emergency recovery kits. To protect the performance of your devices, the search is one level deep and limited to the Desktop, Documents, Downloads, and Shared folders.",
+        "resolution": "Delete 1Password emergency kits from your computer, and empty the trash. 1Password emergency kits should only be printed and stored in a physically secure location.",
+        "platform": "darwin",
+        "tags": [
+          "compliance",
+          "built-in"
+        ],
+        "contributors": [
+          {
+            "name": "nonpunctual",
+            "handle": "nonpunctual",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/nonpunctual"
+          }
+        ],
+        "kind": "policy",
+        "slug": "no-1-password-emergency-kit-stored-in-desktop-documents-or-downloads-folders-mac-os",
+        "requiresMdm": false
+      },
+      {
+        "name": "Discover TLS certificates",
+        "platform": "linux, windows, darwin",
+        "description": "Retrieves metadata about TLS certificates for servers listening on the local machine. Enables mTLS adoption analysis and cert expiration notifications.",
+        "query": "SELECT * FROM curl_certificate WHERE hostname IN (SELECT DISTINCT 'localhost:'||port FROM listening_ports WHERE protocol=6 AND address!='127.0.0.1' AND address!='::1');",
+        "purpose": "Informational",
+        "tags": [
+          "network",
+          "tls"
+        ],
+        "contributors": [
+          {
+            "name": "nabilschear",
+            "handle": "nabilschear",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/nabilschear"
+          }
+        ],
+        "kind": "query",
+        "slug": "discover-tls-certificates",
+        "resolution": "N/A",
+        "requiresMdm": false
+      },
+      {
+        "name": "Discover Python Packages from Running Python Interpreters",
+        "platform": "linux, darwin",
+        "description": "Attempt to discover Python environments (in cwd, path to the python binary, and process command line) from running python interpreters and collect Python packages from those environments.",
+        "query": "SELECT * FROM python_packages WHERE directory IN (SELECT DISTINCT directory FROM (SELECT SUBSTR(path,0,INSTR(path,'/bin/'))||'/lib' AS directory FROM processes WHERE path LIKE '%/bin/%' AND path LIKE '%python%' UNION SELECT SUBSTR(cmdline,0,INSTR(cmdline,'/bin/'))||'/lib' AS directory FROM processes WHERE cmdline LIKE '%python%' AND cmdline LIKE '%/bin/%' AND path LIKE '%python%' UNION SELECT cwd||'/lib' AS directory FROM processes WHERE path LIKE '%python%'));",
+        "purpose": "Informational",
+        "tags": [
+          "compliance",
+          "hunting"
+        ],
+        "contributors": [
+          {
+            "name": "nabilschear",
+            "handle": "nabilschear",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/nabilschear"
+          }
+        ],
+        "kind": "query",
+        "slug": "discover-python-packages-from-running-python-interpreters",
+        "resolution": "N/A",
+        "requiresMdm": false
+      },
+      {
+        "name": "Identify the default mail, http and ftp applications",
+        "platforms": "macOS",
+        "platform": "darwin",
+        "description": "Lists the currently enabled applications configured to handle mailto, http and ftp schemes.",
+        "query": "SELECT * FROM app_schemes WHERE (scheme='mailto' OR scheme='http' OR scheme='ftp') AND enabled='1';",
+        "purpose": "Informational",
+        "tags": [
+          "compliance",
+          "hunting"
+        ],
+        "contributors": [
+          {
+            "name": "brunerd",
+            "handle": "brunerd",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/brunerd"
+          }
+        ],
+        "kind": "query",
+        "slug": "identify-the-default-mail-http-and-ftp-applications",
+        "resolution": "N/A",
+        "requiresMdm": false
+      },
+      {
+        "name": "Firewall enabled, domain profile (Windows)",
+        "query": "SELECT 1 FROM registry WHERE path LIKE 'HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\WindowsFirewall\\DomainProfile\\EnableFirewall' AND CAST(data as integer) = 1;",
+        "description": "Checks if a Group Policy configures the computer to enable the domain profile for Windows Firewall. The domain profile applies to networks where the host system can authenticate to a domain controller. Some auditors requires that this setting is configured by a Group Policy.",
+        "resolution": "Contact your IT administrator to ensure your computer is receiving a Group Policy that enables the domain profile for Windows Firewall.",
+        "platforms": "Windows",
+        "tags": [
+          "compliance",
+          "cis",
+          "cis9.1.1"
+        ],
+        "platform": "windows",
+        "contributors": [
+          {
+            "name": "defensivedepth",
+            "handle": "defensivedepth",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/defensivedepth"
+          }
+        ],
+        "kind": "policy",
+        "slug": "firewall-enabled-domain-profile-windows",
+        "requiresMdm": false
+      },
+      {
+        "name": "Firewall enabled, private profile (Windows)",
+        "query": "SELECT 1 FROM registry WHERE path LIKE 'HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\WindowsFirewall\\PrivateProfile\\EnableFirewall' AND CAST(data as integer) = 1;",
+        "description": "Checks if a Group Policy configures the computer to enable the private profile for Windows Firewall. The private profile applies to networks where the host system is connected to a private or home network. Some auditors requires that this setting is configured by a Group Policy.",
+        "resolution": "Contact your IT administrator to ensure your computer is receiving a Group Policy that enables the private profile for Windows Firewall.",
+        "platforms": "Windows",
+        "tags": [
+          "compliance",
+          "cis",
+          "cis9.2.1"
+        ],
+        "platform": "windows",
+        "contributors": [
+          {
+            "name": "defensivedepth",
+            "handle": "defensivedepth",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/defensivedepth"
+          }
+        ],
+        "kind": "policy",
+        "slug": "firewall-enabled-private-profile-windows",
+        "requiresMdm": false
+      },
+      {
+        "name": "Firewall enabled, public profile (Windows)",
+        "query": "SELECT 1 FROM registry WHERE path LIKE 'HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\WindowsFirewall\\PublicProfile\\EnableFirewall' AND CAST(data as integer) = 1;",
+        "description": "Checks if a Group Policy configures the computer to enable the public profile for Windows Firewall. The public profile applies to networks where the host system is connected to public networks such as Wi-Fi hotspots at coffee shops and airports. Some auditors requires that this setting is configured by a Group Policy.",
+        "resolution": "Contact your IT administrator to ensure your computer is receiving a Group Policy that enables the public profile for Windows Firewall.",
+        "platforms": "Windows",
+        "tags": [
+          "compliance",
+          "cis",
+          "cis9.3.1"
+        ],
+        "platform": "windows",
+        "contributors": [
+          {
+            "name": "defensivedepth",
+            "handle": "defensivedepth",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/defensivedepth"
+          }
+        ],
+        "kind": "policy",
+        "slug": "firewall-enabled-public-profile-windows",
+        "requiresMdm": false
+      },
+      {
+        "name": "SMBv1 client driver disabled (Windows)",
+        "query": "SELECT 1 FROM windows_optional_features WHERE name = 'SMB1Protocol-Client' AND state != 1;",
+        "description": "Checks that the SMBv1 client is disabled.",
+        "resolution": "Contact your IT administrator to discuss disabling SMBv1 on your system.",
+        "platforms": "Windows",
+        "tags": [
+          "compliance",
+          "cis",
+          "cis18.3.2",
+          "built-in"
+        ],
+        "platform": "windows",
+        "contributors": [
+          {
+            "name": "defensivedepth",
+            "handle": "defensivedepth",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/defensivedepth"
+          }
+        ],
+        "kind": "policy",
+        "slug": "sm-bv-1-client-driver-disabled-windows",
+        "requiresMdm": false
+      },
+      {
+        "name": "SMBv1 server disabled (Windows)",
+        "query": "SELECT 1 FROM windows_optional_features WHERE name = 'SMB1Protocol-Server' AND state != 1",
+        "description": "Checks that the SMBv1 server is disabled.",
+        "resolution": "Contact your IT administrator to discuss disabling SMBv1 on your system.",
+        "platforms": "Windows",
+        "tags": [
+          "compliance",
+          "cis",
+          "cis18.3.3",
+          "built-in"
+        ],
+        "platform": "windows",
+        "contributors": [
+          {
+            "name": "defensivedepth",
+            "handle": "defensivedepth",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/defensivedepth"
+          }
+        ],
+        "kind": "policy",
+        "slug": "sm-bv-1-server-disabled-windows",
+        "requiresMdm": false
+      },
+      {
+        "name": "Link-Local Multicast Name Resolution (LLMNR) disabled (Windows)",
+        "query": "SELECT 1 FROM registry WHERE path LIKE 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\DNSClient\\EnableMulticast' AND CAST(data as integer) = 0;",
+        "description": "Checks if a Group Policy configures the computer to disable LLMNR. Disabling LLMNR can prevent malicious actors from gaining access to the computer's credentials. Some auditors require that this setting is configured by a Group Policy.",
+        "resolution": "Contact your IT administrator to ensure your computer is receiving a Group Policy that disables LLMNR on your system.",
+        "platforms": "Windows",
+        "tags": [
+          "compliance",
+          "cis",
+          "cis18.5.4.2"
+        ],
+        "platform": "windows",
+        "contributors": [
+          {
+            "name": "defensivedepth",
+            "handle": "defensivedepth",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/defensivedepth"
+          }
+        ],
+        "kind": "policy",
+        "slug": "link-local-multicast-name-resolution-llmnr-disabled-windows",
+        "requiresMdm": false
+      },
+      {
+        "name": "Automatic updates enabled (Windows)",
+        "query": "SELECT 1 FROM registry WHERE path LIKE 'HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU\\NoAutoUpdate' AND CAST(data as integer) = 0;",
+        "description": "Checks if a Group Policy configures the computer to enable Automatic Updates. When enabled, the computer downloads and installs security and other important updates automatically. Some auditors require that this setting is configured by a Group Policy.",
+        "resolution": "Contact your IT administrator to ensure your computer is receiving a Group policy that enables Automatic Updates.",
+        "platforms": "Windows",
+        "tags": [
+          "compliance",
+          "cis",
+          "cis18.9.108.2.1"
+        ],
+        "platform": "windows",
+        "contributors": [
+          {
+            "name": "defensivedepth",
+            "handle": "defensivedepth",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/defensivedepth"
+          }
+        ],
+        "kind": "policy",
+        "slug": "automatic-updates-enabled-windows",
+        "requiresMdm": false
+      },
+      {
+        "name": "Identify Apple development secrets (macOS)",
+        "query": "SELECT * FROM keychain_items WHERE label LIKE '%ABCDEFG%';",
+        "description": "Identifies certificates associated with Apple development signing and notarization. Replace ABCDEFG with your company's identifier.",
+        "resolution": "Ensure your official Apple builds, signing and notarization happen on a centralized system, and remove these certificates from workstations.",
+        "tags": [
+          "compliance",
+          "inventory",
+          "built-in"
+        ],
+        "platform": "darwin",
+        "contributors": [
+          {
+            "name": "GuillaumeRoss",
+            "handle": "GuillaumeRoss",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/GuillaumeRoss"
+          }
+        ],
+        "kind": "policy",
+        "slug": "identify-apple-development-secrets-mac-os",
+        "requiresMdm": false
+      },
+      {
+        "name": "Geolocate via ipapi.co",
+        "platform": "darwin, linux, windows",
+        "description": "Geolocate a host using the [ipapi.co](https://ipapi.co) in an emergency. Requires the curl table. [Learn more](https://fleetdm.com/guides/locate-assets-with-osquery).",
+        "query": "SELECT JSON_EXTRACT(result, '$.ip') AS ip, JSON_EXTRACT(result, '$.city') AS city, JSON_EXTRACT(result, '$.region') AS region, JSON_EXTRACT(result, '$.country') AS country, JSON_EXTRACT(result, '$.latitude') AS latitude, JSON_EXTRACT(result, '$.longitude') AS longitude FROM curl WHERE url = 'http://ipapi.co/json';",
+        "purpose": "inventory",
+        "tags": [
+          "inventory"
+        ],
+        "contributors": [
+          {
+            "name": "zwass",
+            "handle": "zwass",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/zwass"
+          }
+        ],
+        "kind": "query",
+        "slug": "geolocate-via-ipapi-co",
+        "resolution": "N/A",
+        "requiresMdm": false
+      },
+      {
+        "name": "Get Crowdstrike Falcon network content filter status",
+        "platform": "darwin",
+        "description": "Get the status of the Crowdstrike Falcon network content filter (as in \"System Settings\" > \"Network > \"Filters\").",
+        "query": "/* Load up the plist */ WITH extensions_plist AS (SELECT *, rowid FROM plist WHERE path = '/Library/Preferences/com.apple.networkextension.plist') /* Find the first \"Enabled\" key after the key indicating the crowdstrike app */ SELECT value AS enabled FROM extensions_plist WHERE subkey = 'Enabled' AND rowid > (SELECT rowid FROM extensions_plist WHERE value = 'com.crowdstrike.falcon.App') LIMIT 1;",
+        "purpose": "Informational",
+        "tags": [
+          "crowdstrike",
+          "plist",
+          "network",
+          "content filter"
+        ],
+        "contributors": [
+          {
+            "name": "zwass",
+            "handle": "zwass",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/zwass"
+          }
+        ],
+        "kind": "query",
+        "slug": "get-crowdstrike-falcon-network-content-filter-status",
+        "resolution": "N/A",
+        "requiresMdm": false
+      },
+      {
+        "name": "Get a list of Visual Studio Code extensions",
+        "platform": "darwin, linux, windows",
+        "description": "Get a list of installed VS Code extensions (requires osquery > 5.11.0).",
+        "query": "SELECT u.username, vs.* FROM users u CROSS JOIN vscode_extensions vs USING (uid);\n",
+        "purpose": "Informational",
+        "tags": [
+          "inventory"
+        ],
+        "contributors": [
+          {
+            "name": "lucasmrod",
+            "handle": "lucasmrod",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/lucasmrod"
+          },
+          {
+            "name": "sharon-fdm",
+            "handle": "sharon-fdm",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/sharon-fdm"
+          },
+          {
+            "name": "zwass",
+            "handle": "zwass",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/zwass"
+          }
+        ],
+        "kind": "query",
+        "slug": "get-a-list-of-visual-studio-code-extensions",
+        "resolution": "N/A",
+        "requiresMdm": false
+      },
+      {
+        "name": "List osquery table names",
+        "platform": "darwin, linux, windows",
+        "description": "List all table names in the schema of the currently installed version of osquery",
+        "query": "SELECT DISTINCT name FROM osquery_registry;",
+        "purpose": "Informational",
+        "tags": [
+          "fleet",
+          "osquery",
+          "table",
+          "schema"
+        ],
+        "contributors": [
+          {
+            "name": "nonpunctual",
+            "handle": "nonpunctual",
+            "avatarUrl": "https://placekitten.com/200/200",
+            "htmlUrl": "https://github.com/nonpunctual"
+          }
+        ],
+        "kind": "query",
+        "slug": "list-osquery-table-names",
+        "resolution": "N/A",
+        "requiresMdm": false
+      }
+    ],
+    "queryLibraryYmlRepoPath": "docs/01-Using-Fleet/standard-query-library/standard-query-library.yml",
+    "pricingTable": [
+      {
+        "industryName": "Managed cloud",
+        "description": "Have Fleet host it for you (currently only available for customers with 700+ hosts.  PS. Wish we could host for you?  We're working on it!  Please let us know if you know of a good partner.  In the meantime, join fleetdm.com/support and we're happy to help you deploy Fleet yourself.)",
+        "pricingTableCategories": [
+          "Deployment"
+        ],
+        "productCategories": [
+          "Endpoint operations",
+          "Device management",
+          "Vulnerability management"
+        ],
+        "tier": "Premium",
+        "jamfProHasFeature": "yes",
+        "jamfProtectHasFeature": "yes",
+        "name": "Managed cloud"
+      },
+      {
+        "industryName": "Self-hosted",
+        "friendlyName": "Host it yourself",
+        "description": "Deploy Fleet anywhere and host it yourself, even in air-gapped environments except where technologically impossible.",
+        "pricingTableCategories": [
+          "Deployment"
+        ],
+        "documentationUrl": "https://fleetdm.com/docs/deploy/introduction",
+        "productCategories": [
+          "Endpoint operations",
+          "Device management",
+          "Vulnerability management"
+        ],
+        "tier": "Free",
+        "jamfProHasFeature": "yes",
+        "jamfProtectHasFeature": "no",
+        "buzzwords": [
+          "Self-hosted"
+        ],
+        "name": "Self-hosted"
+      },
+      {
+        "industryName": "Multi-tenancy",
+        "description": "For managed service providers to use a single instance of Fleet for multiple customers.",
+        "documentationUrl": "https://github.com/fleetdm/fleet/issues/9956",
+        "productCategories": [
+          "Device management"
+        ],
+        "pricingTableCategories": [
+          "Deployment"
+        ],
+        "usualDepartment": "IT",
+        "buzzwords": [
+          "OEM",
+          "Private label",
+          "House brand",
+          "Clear label",
+          "Multi-tenancy"
+        ],
+        "tier": "Premium",
+        "name": "Multi-tenancy"
+      },
+      {
+        "industryName": "Deployment tools",
+        "description": "Pre-built Terraform modules and Helm charts to help you get up and running.",
+        "documentationUrl": "https://fleetdm.com/docs/deploy/introduction",
+        "usualDepartment": "IT",
+        "tier": "Free",
+        "jamfProHasFeature": "no",
+        "jamfProtectHasFeature": "no",
+        "productCategories": [
+          "Endpoint operations"
+        ],
+        "pricingTableCategories": [
+          "Deployment"
+        ],
+        "name": "Deployment tools"
+      },
+      {
+        "industryName": "Private update registry",
+        "friendlyName": "Update agents from a secret URL",
+        "description": "Load agent code from a secret URL that you manage.",
+        "documentationUrl": "https://fleetdm.com/docs/using-fleet/update-agents",
+        "tier": "Premium",
+        "jamfProHasFeature": "no",
+        "jamfProtectHasFeature": "no",
+        "productCategories": [
+          "Endpoint operations"
+        ],
+        "pricingTableCategories": [
+          "Configuration"
+        ],
+        "usualDepartment": "Security",
+        "name": "Private update registry"
+      },
+      {
+        "industryName": "Control agent versions",
+        "description": "Manage agents remotely by setting different versions per-baseline.",
+        "documentationUrl": "https://fleetdm.com/docs/configuration/agent-configuration#configure-fleetd-update-channels",
+        "tier": "Premium",
+        "jamfProHasFeature": "no",
+        "jamfProtectHasFeature": "no",
+        "productCategories": [
+          "Endpoint operations"
+        ],
+        "pricingTableCategories": [
+          "Configuration"
+        ],
+        "usualDepartment": "IT",
+        "waysToUse": [
+          {
+            "description": "Supply-chain Levels for Software Artifacts (SLSA) attestations for the fleetd binary artifacts and server container image to enable verification that the binaries are built and uploaded using GitHub Actions from the Fleet repository at a particular commit SHA coming soon (2024-12-31)."
+          },
+          {
+            "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/20219"
+          }
+        ],
+        "name": "Control agent versions"
+      },
+      {
+        "industryName": "Command line tool (CLI)",
+        "friendlyName": "fleetctl",
+        "documentationUrl": "https://fleetdm.com/docs/using-fleet/fleetctl-cli",
+        "productCategories": [
+          "Endpoint operations",
+          "Device management"
+        ],
+        "pricingTableCategories": [
+          "Configuration"
+        ],
+        "usualDepartment": "IT",
+        "tier": "Free",
+        "jamfProHasFeature": "yes",
+        "jamfProtectHasFeature": "yes",
+        "name": "Command line tool (CLI)"
+      },
+      {
+        "industryName": "GitOps",
+        "friendlyName": "Manage endpoints in git",
+        "documentationUrl": "https://github.com/fleetdm/fleet-gitops",
+        "description": "Fork the best practices GitHub repo and use the included GitHub Actions to quickly automate Fleet console and configuration workflow management.",
+        "productCategories": [
+          "Endpoint operations",
+          "Device management",
+          "Vulnerability management"
+        ],
+        "pricingTableCategories": [
+          "Configuration"
+        ],
+        "usualDepartment": "IT",
+        "tier": "Free",
+        "jamfProHasFeature": "yes",
+        "jamfProtectHasFeature": "yes",
+        "demos": {
+          "description": "A top savings and investment company wanted workflows and automation so that one bad actor can't brick their fleet.  This way, they have to make a pull request first.",
+          "quote": "I don't want one bad actor to brick my fleet.  I want them to make a pull request first.",
+          "moreInfoUrl": "https://docs.google.com/document/d/1hAQL6P--Tt3syq1MTRONAxhQA_2Vjt3oOJJt_O4xbiE/edit?disco=AAABAVnYvns&usp_dm=true#heading=h.7en766pueek4"
+        },
+        "name": "GitOps"
+      },
+      {
+        "industryName": "Two-factor authentication",
+        "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/5478",
+        "productCategories": [
+          "Endpoint operations",
+          "Device management",
+          "Vulnerability management"
+        ],
+        "pricingTableCategories": [
+          "Configuration"
+        ],
+        "usualDepartment": "IT",
+        "tier": "Free",
+        "jamfProHasFeature": "yes",
+        "jamfProtectHasFeature": "yes",
+        "waysToUse": [
+          {
+            "description": "Enforce two-factor authentication when logging in to Fleet for added security."
+          }
+        ],
+        "comingSoonOn": "2024-12-31",
+        "name": "Two-factor authentication",
+        "comingSoon": true
+      },
+      {
+        "industryName": "Role-based access control",
+        "documentationUrl": "https://fleetdm.com/docs/using-fleet/manage-access#manage-access",
+        "productCategories": [
+          "Endpoint operations",
+          "Device management",
+          "Vulnerability management"
+        ],
+        "pricingTableCategories": [
+          "Configuration"
+        ],
+        "usualDepartment": "IT",
+        "tier": "Premium",
+        "jamfProHasFeature": "yes",
+        "jamfProtectHasFeature": "yes",
+        "name": "Role-based access control"
+      },
+      {
+        "industryName": "Audit logging",
+        "description": "Log all activity, including queries, scripts, access, etc.",
+        "documentationUrl": "https://fleetdm.com/docs/rest-api/rest-api#list-activities",
+        "productCategories": [
+          "Endpoint operations",
+          "Device management"
+        ],
+        "pricingTableCategories": [
+          "Configuration"
+        ],
+        "tier": "Premium",
+        "jamfProHasFeature": "yes",
+        "jamfProtectHasFeature": "yes",
+        "usualDepartment": "Security",
+        "waysToUse": [
+          {
+            "description": "Export activity of Fleet admins to your SIEM or data lake"
+          }
+        ],
+        "name": "Audit logging"
+      },
+      {
+        "industryName": "Scope transparency",
+        "description": "Let end users see the source code for exactly how they are being monitored, and set clear expectations about what is and isn’t acceptable use of work computers.",
+        "tier": "Free",
+        "documentationUrl": "https://fleetdm.com/transparency",
+        "productCategories": [
+          "Endpoint operations"
+        ],
+        "pricingTableCategories": [
+          "Configuration"
+        ],
+        "name": "Scope transparency"
+      },
+      {
+        "industryName": "Cross-platform MDM support",
+        "description": "macOS, Windows, and Linux.",
+        "documentationUrl": "https://fleetdm.com/announcements/fleet-introduces-windows-mdm",
+        "tier": "Premium",
+        "jamfProHasFeature": "appleOnly",
+        "jamfProtectHasFeature": "no",
+        "usualDepartment": "IT",
+        "productCategories": [
+          "Device management"
+        ],
+        "pricingTableCategories": [
+          "Devices"
+        ],
+        "name": "Cross-platform MDM support"
+      },
+      {
+        "industryName": "MDM migration",
+        "description": "Easily move your devices from your current MDM solution to Fleet.",
+        "tier": "Premium",
+        "jamfProHasFeature": "yes",
+        "jamfProtectHasFeature": "no",
+        "documentationUrl": "https://fleetdm.com/docs/using-fleet/mdm-migration-guide",
+        "usualDepartment": "IT",
+        "productCategories": [
+          "Device management"
+        ],
+        "pricingTableCategories": [
+          "Devices"
+        ],
+        "name": "MDM migration"
+      },
+      {
+        "industryName": "Zero-touch setup",
+        "description": "Zero-touch setup for macOS, iOS/iPadOS, and Windows.",
+        "documentationUrl": "https://fleetdm.com/docs/using-fleet/mdm-macos-setup-experience",
+        "tier": "Premium",
+        "jamfProHasFeature": "appleOnly",
+        "jamfProtectHasFeature": "no",
+        "usualDepartment": "IT",
+        "productCategories": [
+          "Device management"
+        ],
+        "pricingTableCategories": [
+          "Devices"
+        ],
+        "waysToUse": [
+          {
+            "description": "Ship a macOS, iOS, or iPadOS device to the end user's home and have them automatically enroll to Fleet during out-of-the-box setup."
+          },
+          {
+            "description": "Ship a Windows workstation to the end user's home and have them automatically enroll to Fleet during out-of-the-box setup."
+          },
+          {
+            "description": "Customize the out-of-the-box setup experience for your end users."
+          },
+          {
+            "description": "Install a bootstrap package to run custom scripts during the setup experience. Store the bootstrap package outside the Fleet database coming soon (2024-09-15)",
+            "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/19037"
+          },
+          {
+            "description": "Require end users to authenticate with your identity provider (IdP) and agree to an end user license agreement (EULA) before they can use their new workstation"
+          }
+        ],
+        "name": "Zero-touch setup"
+      },
+      {
+        "industryName": "Bring your own device (BYOD) enrollment",
+        "description": "BYOD enrollment for macOS, iOS/iPadOS (coming soon), Windows, and Android (coming soon) devices.",
+        "documentationUrl": "https://fleetdm.com/guides/sysadmin-diaries-device-enrollment#byod-enrollment",
+        "tier": "Free",
+        "jamfProHasFeature": "yes",
+        "jamfProtectHasFeature": "no",
+        "usualDepartment": "IT",
+        "productCategories": [
+          "Device management"
+        ],
+        "pricingTableCategories": [
+          "Devices"
+        ],
+        "waysToUse": [
+          {
+            "description": "Support ACME as a protocol for MDM certificate generation. Coming soon (2024-12-31)",
+            "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/15611"
+          }
+        ],
+        "name": "Bring your own device (BYOD) enrollment"
+      },
+      {
+        "industryName": "User account sync",
+        "description": "Sync user accounts via Okta, AD, or any IDP.",
+        "documentationUrl": "https://fleetdm.com/docs/using-fleet/mdm-macos-setup-experience",
+        "productCategories": [
+          "Endpoint operations",
+          "Device management",
+          "Vulnerability management"
+        ],
+        "pricingTableCategories": [
+          "Devices"
+        ],
+        "usualDepartment": "IT",
+        "tier": "Premium",
+        "jamfProHasFeature": "yes",
+        "jamfProtectHasFeature": "yes",
+        "waysToUse": [
+          {
+            "description": "Automatically set admin access to Fleet based on your IDP"
+          }
+        ],
+        "name": "User account sync"
+      },
+      {
+        "industryName": "Human-endpoint mapping",
+        "friendlyName": "See who logs in on every computer",
+        "description": "Identify who logs in to any system, including login history and current sessions.  Look up any host by the email address of the person using it.",
+        "documentationUrl": "https://fleetdm.com/docs/rest-api/rest-api#get-hosts-google-chrome-profiles",
+        "screenshotSrc": null,
+        "tier": "Free",
+        "jamfProHasFeature": "yes",
+        "jamfProtectHasFeature": "yes",
+        "productCategories": [
+          "Endpoint operations"
+        ],
+        "pricingTableCategories": [
+          "Devices"
+        ],
+        "usualDepartment": "IT",
+        "buzzwords": [
+          "Device users",
+          "human-to-device mapping"
+        ],
+        "dri": "mikermcneil",
+        "demos": [
+          {
+            "description": "Security engineers at a top gaming company wanted to get demographics off their macOS, Windows, and Linux machines about who the user is and who's logged in.",
+            "moreInfoUrl": "https://docs.google.com/document/d/1qFYtMoKh3zyERLhbErJOEOo2me6Bc7KOOkjKn482Sqc/edit"
+          },
+          {
+            "description": "Data engineers at a top biotech corporation needed to know who is logged into their devices.",
+            "quote": "So we don't know exactly what's going on after we deploy the device, we know that they are compliant with the security because we are running these stuff, but we don't know certainly who is running, who is logging in the device?",
+            "moreInfoUrl": "https://docs.google.com/document/d/17MNI5ykzlFjdVmQ8SPMrT1oR_hY_vkYAJx31F7l7Pv8/edit#heading=h.7en766pueek4"
+          }
+        ],
+        "waysToUse": [
+          {
+            "description": "Look up computer by ActiveDirectory account"
+          },
+          {
+            "description": "Find device by Google Chrome user"
+          },
+          {
+            "description": "Identify who logs in to any system, including login history and current sessions."
+          },
+          {
+            "description": "Look up any host by the email address of the person using it."
+          },
+          {
+            "description": "Check user login history",
+            "moreInfoUrl": "https://www.lepide.com/how-to/audit-who-logged-into-a-computer-and-when.html#:~:text=To%20find%20out%20the%20details,logs%20in%20%E2%80%9CWindows%20Logs%E2%80%9D."
+          },
+          {
+            "description": "See currently logged in users",
+            "moreInfoUrl": "https://www.top-password.com/blog/see-currently-logged-in-users-in-windows/"
+          },
+          {
+            "description": "Get demographics off of our machines about who the user is and who's logged in",
+            "moreInfoUrl": "https://docs.google.com/document/d/1qFYtMoKh3zyERLhbErJOEOo2me6Bc7KOOkjKn482Sqc/edit"
+          },
+          {
+            "description": "See what servers someone is logged-in on",
+            "moreInfoUrl": "https://community.spiceworks.com/topic/138171-is-there-a-way-to-see-what-servers-someone-is-logged-in-on"
+          }
+        ],
+        "name": "Human-endpoint mapping"
+      },
+      {
+        "industryName": "Device inventory",
+        "description": "Includes a list of all devices and all hardware and software attributes for each device.",
+        "documentationUrl": "https://fleetdm.com/docs/using-fleet/understanding-host-vitals",
+        "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/14415",
+        "tier": "Free",
+        "jamfProHasFeature": "yes",
+        "jamfProtectHasFeature": "yes",
+        "usualDepartment": "IT",
+        "productCategories": [
+          "Endpoint operations",
+          "Device management",
+          "Vulnerability management"
+        ],
+        "pricingTableCategories": [
+          "Devices"
+        ],
+        "waysToUse": [
+          {
+            "description": "Implement software inventory recommendations from the SANS 20 / CIS 18.",
+            "moreInfoUrl": "https://docs.google.com/document/d/1E6EQMMqrsRc6Z3YsR6Q33OaF9eAa8zLNaz4K2YzFdyo/edit#heading=h.7en766pueek4"
+          },
+          {
+            "description": "View a list of all hardware attributes of a device.",
+            "moreInfoUrl": "https://fleetdm.com/tables/system_info"
+          },
+          {
+            "description": "View a list of all software and their versions installed on all your hosts.",
+            "moreInfoUrl": "https://fleetdm.com/docs/get-started/anatomy#software-library"
+          },
+          {
+            "description": "View a list of software rolled up by title.",
+            "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/14674"
+          },
+          {
+            "description": "Implement hardware and infrastructure inventory recommendations from the SANS 20 / CIS 18.",
+            "moreInfoUrl": "https://docs.google.com/document/d/1E6EQMMqrsRc6Z3YsR6Q33OaF9eAa8zLNaz4K2YzFdyo/edit#heading=h.7en766pueek4"
+          }
+        ],
+        "name": "Device inventory"
+      },
+      {
+        "industryName": "Search inventory",
+        "description": "Search devices by IP, serial, hostname, and UUID.",
+        "documentationUrl": "https://fleetdm.com/docs/using-fleet/learn-how-to-use-fleet#how-to-ask-questions-about-your-device",
+        "productCategories": [
+          "Endpoint operations",
+          "Device management"
+        ],
+        "pricingTableCategories": [
+          "Devices"
+        ],
+        "usualDepartment": "IT",
+        "tier": "Free",
+        "jamfProHasFeature": "yes",
+        "jamfProtectHasFeature": "yes",
+        "name": "Search inventory"
+      },
+      {
+        "industryName": "Targeted device scoping",
+        "description": "Organize devices with Teams and Labels.",
+        "documentationUrl": "https://fleetdm.com/guides/managing-labels-in-fleet",
+        "tier": "Premium",
+        "jamfProHasFeature": "yes",
+        "jamfProtectHasFeature": "yes",
+        "usualDepartment": "IT",
+        "productCategories": [
+          "Device management"
+        ],
+        "pricingTableCategories": [
+          "Devices"
+        ],
+        "name": "Targeted device scoping"
+      },
+      {
+        "industryName": "Enforce disk encryption",
+        "description": "Encrypt system drives on macOS and Windows computers, manage escrowed encryption keys, and report on disk encryption status (FileVault, BitLocker).",
+        "documentationUrl": "https://fleetdm.com/docs/using-fleet/mdm-disk-encryption",
+        "friendlyName": "Ensure hard disks are encrypted",
+        "productCategories": [
+          "Device management"
+        ],
+        "pricingTableCategories": [
+          "Devices"
+        ],
+        "usualDepartment": "Security",
+        "tier": "Premium",
+        "jamfProHasFeature": "appleOnly",
+        "jamfProtectHasFeature": "no",
+        "waysToUse": [
+          {
+            "description": "Report on disk encryption status"
+          },
+          {
+            "description": "Encrypt hard disks on macOS with FileVault"
+          },
+          {
+            "description": "Escrow FileVault keys on macOS"
+          },
+          {
+            "description": "Encrypt hard disks on Windows with BitLocker."
+          }
+        ],
+        "name": "Enforce disk encryption"
+      },
+      {
+        "industryName": "Enforce operating system (OS) updates",
+        "description": "Keep operating systems up to date for macOS, iOS/iPadOS, Windows, and Android (coming soon) devices.",
+        "documentationUrl": "https://fleetdm.com/docs/using-fleet/mdm-macos-updates",
+        "tier": "Premium",
+        "jamfProHasFeature": "yes",
+        "jamfProtectHasFeature": "no",
+        "usualDepartment": "IT",
+        "productCategories": [
+          "Device management",
+          "Vulnerability management"
+        ],
+        "pricingTableCategories": [
+          "Devices"
+        ],
+        "waysToUse": [
+          {
+            "description": "Enforce macOS updates via Nudge."
+          },
+          {
+            "description": "Progressively enhance from Nudge to DDM-based OS updates.",
+            "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/17295"
+          },
+          {
+            "description": "Automatically update Windows after the end user reaches a deadline."
+          }
+        ],
+        "name": "Enforce operating system (OS) updates"
+      },
+      {
+        "industryName": "Enforce OS settings",
+        "description": "MDM support for macOS, iOS/iPadOS, Windows, and Android (coming soon) devices. Management support for Linux.",
+        "documentationUrl": "https://fleetdm.com/docs/using-fleet/mdm-custom-os-settings",
+        "usualDepartment": "IT",
+        "tier": "Free",
+        "jamfProHasFeature": "yes",
+        "jamfProtectHasFeature": "no",
+        "waysToUse": [
+          {
+            "description": "Deploy configuration profiles on macOS and Windows and verify that they're installed.",
+            "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/13281"
+          },
+          {
+            "description": "Deploy custom declaration (DDM) profiles on macOS.",
+            "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/14550"
+          },
+          {
+            "description": "Target profiles to specific hosts using SQL.",
+            "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/17315"
+          },
+          {
+            "description": "Automatically re-deploy configuration profiles when they're not installed."
+          },
+          {
+            "description": "Deploy configuration profiles on iOS/iPadOS."
+          },
+          {
+            "description": "See a list of the upcoming MDM commands and scripts in unified queue. Coming soon (2024-07-15)",
+            "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/15920"
+          },
+          {
+            "description": "Send MDM commands to tell end users to update their OS.",
+            "moreInfoUrl": "https://developer.apple.com/documentation/devicemanagement/schedule_an_os_update"
+          },
+          {
+            "description": "Configure agent options remotely, over the air.  (Includes osquery config, and osquery startup flags.).",
+            "moreInfoUrl": "https://fleetdm.com/docs/configuration/agent-configuration"
+          }
+        ],
+        "productCategories": [
+          "Device management"
+        ],
+        "pricingTableCategories": [
+          "Devices"
+        ],
+        "name": "Enforce OS settings"
+      },
+      {
+        "industryName": "Declarative Device Management (DDM) support for configuration profiles",
+        "description": "Full support for Apple DDM configuration profiles.",
+        "documentationUrl": "https://fleetdm.com/docs/using-fleet/mdm-os-updates#macos",
+        "tier": "Free",
+        "jamfProHasFeature": "cloudOnly",
+        "jamfProtectHasFeature": "cloudOnly",
+        "usualDepartment": "IT",
+        "productCategories": [
+          "Device management"
+        ],
+        "pricingTableCategories": [
+          "Devices"
+        ],
+        "name": "Declarative Device Management (DDM) support for configuration profiles"
+      },
+      {
+        "industryName": "Device health",
+        "friendlyName": "Automate device health",
+        "description": "Automatically report system health issues using webhooks or integrations, to notify or quarantine outdated or misconfigured systems that are at higher risk of vulnerabilities or theft.",
+        "documentationUrl": "https://fleetdm.com/docs/using-fleet/automations#automations",
+        "screenshotSrc": null,
+        "tier": "Free",
+        "jamfProHasFeature": "no",
+        "jamfProtectHasFeature": "yes",
+        "productCategories": [
+          "Device management",
+          "Endpoint operations"
+        ],
+        "pricingTableCategories": [
+          "Devices"
+        ],
+        "usualDepartment": "IT",
+        "dri": "mikermcneil",
+        "demos": [
+          {
+            "description": "A large tech company used the Fleet API to block access to corporate apps for outdated operating system versions with certain \"celebrity\" vulnerabilities.",
+            "quote": null,
+            "moreInfoUrl": "https://play.goconsensus.com/s4e490bb9"
+          }
+        ],
+        "buzzwords": [
+          "Device trust",
+          "Zero trust",
+          "Layer 7 device trust",
+          "Beyondcorp",
+          "Device attestation",
+          "Conditional access"
+        ],
+        "waysToUse": [
+          {
+            "description": "Automatically manage the behavior of endpoints that are at higher risk of vulnerabilities or data loss due to their configuration or patch level."
+          },
+          {
+            "description": "Block access to corporate apps for users whose devices with unexpected settings, like disabled screen lock, passwords that are too short, unencrypted hard disks, and more"
+          },
+          {
+            "description": "Quickly implement conditional access based on device health using osquery and a simple device health REST API.",
+            "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/14920"
+          },
+          {
+            "description": "Control and restore access to applications by automatically restricting access when devices do not meet particular security requirements.",
+            "moreInfoUrl": "https://duo.com/docs/device-health"
+          },
+          {
+            "description": "Control which laptop and desktop devices can access corporate apps and websites based on what vulnerabilities it might be exposed to based on how the device is configured, whether it's up to date, its MDM enrollment status, and anything else you can build in a SQL query of Fleet's 300 data tables representing information about enrolled host systems. Coming soon (2024-09-30).",
+            "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/16236"
+          },
+          {
+            "description": "Implement multivariate device trust",
+            "moreInfoUrl": "https://youtu.be/5sFOdpMLXQg?feature=shared&t=1445"
+          },
+          {
+            "description": "Implement your own version of Google's zero trust model (BeyondCorp)",
+            "moreInfoUrl": "https://cloud.google.com/beyondcorp"
+          },
+          {
+            "description": "Get endpoint data into ServiceNow and make your asset management teams happy",
+            "moreInfoUrl": "https://www.youtube.com/watch?v=aVbU6_9JoM0"
+          },
+          {
+            "description": "Monitor devices that don't meet your organization's custom security policies"
+          },
+          {
+            "description": "Quickly report your posture and vulnerabilities to auditors, showing remediation status and timing."
+          },
+          {
+            "description": "Keep your devices compliant with customizable baselines, or use common benchmarks like CIS."
+          },
+          {
+            "description": "Discover security misconfigurations that increase attack surface."
+          },
+          {
+            "description": "Detect suspcious services listening on open ports that should not be connected to the internet, such as Remote Desktop Protocol (RDP).",
+            "moreInfoUrl": "https://paraflare.com/articles/vulnerability-management-via-osquery/#:~:text=WHERE%20statename%20%3D%20%E2%80%9CEnabled%E2%80%9D-,OPEN%20SOCKETS,-Lastly%2C%20an%20examination"
+          },
+          {
+            "description": "Discover potentially unwanted programs that increase attack surface.",
+            "moreInfoUrl": "https://paraflare.com/articles/vulnerability-management-via-osquery/"
+          },
+          {
+            "description": "Detect self-signed certifcates"
+          },
+          {
+            "description": "Detect legacy protocols with safer versions",
+            "moreInfoUrl": "https://paraflare.com/articles/vulnerability-management-via-osquery/#:~:text=WHERE%20self_signed%20%3D%201%3B-,LEGACY%20PROTOCOLS,-This%20section%20will"
+          },
+          {
+            "description": "Detect exposed secrets on the command line",
+            "moreInfoUrl": "https://paraflare.com/articles/vulnerability-management-via-osquery/#:~:text=WDigest%20is%20disabled.-,EXPOSED%20SECRETS,-Often%2C%20to%20create"
+          },
+          {
+            "description": "Detect and surface issues with devices"
+          },
+          {
+            "description": "Share device health reports"
+          },
+          {
+            "description": "Align endpoints with your security policies",
+            "moreInfoUrl": "https://www.axonius.com/use-cases/cmdb-reconciliation"
+          },
+          {
+            "description": "Maximize security control coverage"
+          },
+          {
+            "description": "Uncover gaps in security policies, configurations, and hygiene",
+            "moreInfoUrl": "https://www.axonius.com/use-cases/coverage-gap-discovery"
+          },
+          {
+            "description": "Automatically apply security policies to protect endpoints against attack."
+          },
+          {
+            "description": "Surface security issues in all your deployed endpoints even data centers and factories."
+          },
+          {
+            "description": "Continually validate controls and policies"
+          },
+          {
+            "description": "Block access to corporate apps if your end users are failing a specific number of critical policies.",
+            "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/16206"
+          }
+        ],
+        "name": "Device health"
+      },
+      {
+        "industryName": "Application deployment",
+        "description": "Deploy applications and security agents on macOS, iOS/iPadOS, Linux, Windows, and Android (coming soon) devices. Additionally, install macOS and iOS/iPadOS apps from the App Store (coming soon).",
+        "tier": "Premium",
+        "jamfProHasFeature": "appleOnly",
+        "jamfProtectHasFeature": "no",
+        "isExperimental": "yes",
+        "usualDepartment": "IT",
+        "productCategories": [
+          "Device management"
+        ],
+        "pricingTableCategories": [
+          "Devices"
+        ],
+        "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/18867",
+        "waysToUse": [
+          {
+            "description": "Easily configure and install SentinelOne, Crowdstrike, and other security tools.",
+            "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/14921"
+          },
+          {
+            "description": "Offer licenses for Photoshop and other App Sore apps for your end users."
+          },
+          {
+            "description": "iOS/iPadOS coming soon (2024-08-11).",
+            "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/14899"
+          }
+        ],
+        "name": "Application deployment"
+      },
+      {
+        "industryName": "Self-service application installation",
+        "description": "Allow end users to install apps through Fleet Desktop for macOS, Linux, and Windows.",
+        "tier": "Premium",
+        "jamfProHasFeature": "yes",
+        "jamfProtectHasFeature": "no",
+        "isExperimental": "yes",
+        "usualDepartment": "IT",
+        "productCategories": [
+          "Device management"
+        ],
+        "pricingTableCategories": [
+          "Devices"
+        ],
+        "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/17587",
+        "waysToUse": [
+          {
+            "description": "Build scripts for Ansible deployments",
+            "moreInfoUrl": "https://www.youtube.com/watch?v=qflUfLQCnwY&list=PL6-FgoWOoK2YUR4ADGsxTSL3onb-GzCnM&index=4"
+          },
+          {
+            "description": "Deploy osquery to macOS via Jamf",
+            "moreInfoUrl": "https://www.youtube.com/watch?v=qflUfLQCnwY&list=PL6-FgoWOoK2YUR4ADGsxTSL3onb-GzCnM&index=4"
+          },
+          {
+            "description": "Package osquery for Linux servers via Workspace One and Windows servers via group policies",
+            "moreInfoUrl": "https://www.youtube.com/watch?v=qflUfLQCnwY&list=PL6-FgoWOoK2YUR4ADGsxTSL3onb-GzCnM&index=4"
+          }
+        ],
+        "name": "Self-service application installation"
+      },
+      {
+        "industryName": "Application management",
+        "description": "Manage updates and patches for apps on macOS, Windows, and Linux computers.",
+        "tier": "Premium",
+        "jamfProHasFeature": "appleOnly",
+        "jamfProtectHasFeature": "no",
+        "comingSoonOn": "2024-08-25",
+        "usualDepartment": "IT",
+        "productCategories": [
+          "Device management"
+        ],
+        "pricingTableCategories": [
+          "Devices"
+        ],
+        "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/18865",
+        "name": "Application management",
+        "comingSoon": true
+      },
+      {
+        "industryName": "Script execution",
+        "friendlyName": "Safely execute custom scripts (macOS, Windows, and Linux)",
+        "description": "Deploy and execute custom scripts using a REST API, and manage your library of scripts in the UI or a git repo.",
+        "documentationUrl": "https://fleetdm.com/docs/using-fleet/scripts",
+        "tier": "Free",
+        "jamfProHasFeature": "yes",
+        "jamfProtectHasFeature": "no",
+        "dri": "mikermcneil",
+        "usualDepartment": "IT",
+        "productCategories": [
+          "Endpoint operations",
+          "Device management"
+        ],
+        "pricingTableCategories": [
+          "Devices"
+        ],
+        "demos": [
+          {
+            "description": "A large tech company used scripts to fix issues with their security and compliance agents on workstations."
+          }
+        ],
+        "buzzwords": [
+          "Remote script execution",
+          "PowerShell scripts",
+          "Bash scripts"
+        ],
+        "waysToUse": [
+          {
+            "description": "Execute custom macOS scripts (client platform engineering)",
+            "moreInfoUrl": "https://www.hexnode.com/blogs/executing-custom-mac-scripts-via-mdm/"
+          },
+          {
+            "description": "Execute custom Windows scripts (client platform engineering)",
+            "moreInfoUrl": "https://www.hexnode.com/blogs/executing-custom-windows-scripts-via-mdm/"
+          },
+          {
+            "description": "Use PowerShell scripts on Windows devices",
+            "moreInfoUrl": "https://learn.microsoft.com/en-us/mem/intune/apps/intune-management-extension"
+          },
+          {
+            "description": "Run PowerShell scripts for remediations (security engineering)",
+            "moreInfoUrl": "https://learn.microsoft.com/en-us/mem/intune/fundamentals/powershell-scripts-remediation"
+          },
+          {
+            "description": "Download and run remediation scripts",
+            "moreInfoUrl": "https://help.zscaler.com/deception/downloading-and-running-remediation-script"
+          },
+          {
+            "description": "Deploy custom scripts",
+            "moreInfoUrl": "https://scalefusion.com/custom-scripting"
+          },
+          {
+            "description": "Run scripts on online/offline hosts",
+            "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/15529"
+          },
+          {
+            "description": "Only maintainers and admins can run scripts.",
+            "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/19055"
+          }
+        ],
+        "name": "Script execution"
+      },
+      {
+        "industryName": "Device remediation",
+        "description": "Use Fleet Policies to detect the device state. Automate remediations for issues or allow users to remediate problems in self-service.",
+        "documentationUrl": "https://fleetdm.com/securing/end-user-self-remediation",
+        "tier": "Premium",
+        "jamfProHasFeature": "yes",
+        "jamfProtectHasFeature": "no",
+        "usualDepartment": "IT",
+        "productCategories": [
+          "Device management",
+          "Vulnerability management"
+        ],
+        "pricingTableCategories": [
+          "Devices"
+        ],
+        "waysToUse": [
+          {
+            "description": "Send software vulnerability emails to end users to encourage self-remediation."
+          }
+        ],
+        "name": "Device remediation"
+      },
+      {
+        "industryName": "Maintenance windows",
+        "friendlyName": "Fleet in your calendar",
+        "description": "Create a calendar event to auto-remediate failing policies when your end users are free.",
+        "documentationUrl": "https://github.com/fleetdm/fleet/issues/17230",
+        "tier": "Premium",
+        "jamfProHasFeature": "no",
+        "jamfProtectHasFeature": "no",
+        "isExperimental": "yes",
+        "productCategories": [
+          "Device management",
+          "Endpoint operations"
+        ],
+        "pricingTableCategories": [
+          "Devices"
+        ],
+        "name": "Maintenance windows"
+      },
+      {
+        "industryName": "Send lock and wipe commands",
+        "description": "Secure your devices with remote lock and wipe commands if lost or stolen.",
+        "documentationUrl": "https://fleetdm.com/docs/using-fleet/mdm-commands",
+        "waysToUse": [
+          {
+            "description": "High-level remote lock for macOS, Windows, and Linux.",
+            "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/9949"
+          },
+          {
+            "description": "High-level remote wipe for macOS, Windows, and Linux.",
+            "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/9951"
+          }
+        ],
+        "tier": "Premium",
+        "jamfProHasFeature": "appleOnly",
+        "jamfProtectHasFeature": "no",
+        "usualDepartment": "IT",
+        "productCategories": [
+          "Device management"
+        ],
+        "pricingTableCategories": [
+          "Devices"
+        ],
+        "name": "Send lock and wipe commands"
+      },
+      {
+        "industryName": "Queries",
+        "description": "Scheduled or saved queries with optional AI-generated descriptions, and, live queries for real-time data collection.",
+        "documentationUrl": "https://fleetdm.com/docs/using-fleet/fleet-ui",
+        "tier": "Free",
+        "jamfProHasFeature": "no",
+        "jamfProtectHasFeature": "no",
+        "productCategories": [
+          "Endpoint operations",
+          "Device management",
+          "Vulnerability management"
+        ],
+        "pricingTableCategories": [
+          "Devices"
+        ],
+        "usualDepartment": "IT",
+        "demos": [
+          {
+            "description": "A top financial services company needed to set up rolling deployments for changes to osquery agents running on their production servers.",
+            "moreInfoUrl": "https://docs.google.com/document/d/1UdzZMyBLbs9SUXfSXN2x2wZQCbjZZUetYlNWH6-ryqQ/edit#heading=h.2lh6ehprpvl6"
+          }
+        ],
+        "name": "Queries"
+      },
+      {
+        "industryName": "Query performance monitoring",
+        "documentationUrl": "https://fleetdm.com/docs/get-started/faq#will-fleet-slow-down-my-servers-what-about-my-employee-laptops",
+        "tier": "Free",
+        "jamfProHasFeature": "no",
+        "jamfProtectHasFeature": "no",
+        "productCategories": [
+          "Endpoint operations"
+        ],
+        "pricingTableCategories": [
+          "Devices"
+        ],
+        "demos": [
+          {
+            "description": "A top software company needed to understand the performance impact of osquery queries before running them on all of their production Linux servers.",
+            "moreInfoUrl": "https://docs.google.com/document/d/1WzMc8GJCRU6tTBb6gLsSTzFysqtXO8CtP2sXMPKgYSk/edit?disco=AAAA6xuVxGg"
+          },
+          {
+            "description": "A top software company wanted to detect regressions when adding/changing queries and fail builds if queries were too expensive.",
+            "moreInfoUrl": "https://docs.google.com/document/d/1WzMc8GJCRU6tTBb6gLsSTzFysqtXO8CtP2sXMPKgYSk/edit?disco=AAAA6xuVxGg"
+          }
+        ],
+        "waysToUse": [
+          {
+            "description": "Monitor performance for automated queries."
+          },
+          {
+            "description": "Monitor performance for live queries.",
+            "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/467"
+          }
+        ],
+        "name": "Query performance monitoring"
+      },
+      {
+        "industryName": "Custom tables",
+        "friendlyName": "Add tables to osquery with extensions",
+        "description": "Create your own osquery tables, extensions & automatic table configurations or disable existing tables to maintain PII or privacy.",
+        "documentationUrl": "https://fleetdm.com/docs/configuration/agent-configuration#extensions",
+        "moreInfoUrl": "https://github.com/trailofbits/osquery-extensions/blob/3df2b72ad78549e25344c79dbc9bce6808c4d92a/README.md#extensions",
+        "tier": "Premium",
+        "jamfProHasFeature": "no",
+        "jamfProtectHasFeature": "no",
+        "productCategories": [
+          "Endpoint operations"
+        ],
+        "pricingTableCategories": [
+          "Devices"
+        ],
+        "usualDepartment": "IT",
+        "name": "Custom tables"
+      },
+      {
+        "industryName": "Remote settings",
+        "description": "Configure agent options remotely, over the air.  (Includes osquery config, and osquery startup flags.).",
+        "documentationUrl": "https://fleetdm.com/docs/configuration/agent-configuration",
+        "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/13825",
+        "tier": "Free",
+        "jamfProHasFeature": "no",
+        "jamfProtectHasFeature": "no",
+        "productCategories": [
+          "Endpoint operations"
+        ],
+        "pricingTableCategories": [
+          "Devices"
+        ],
+        "usualDepartment": "Security",
+        "name": "Remote settings"
+      },
+      {
+        "industryName": "Teams",
+        "friendlyName": "Manage different endpoints differently",
+        "documentationUrl": "https://fleetdm.com/docs/using-fleet/segment-hosts",
+        "description": "Teams are what Fleet calls baselines, kinda like security groups or images. Every host in a team matches the same baseline, with minor exceptions. This makes it faster and less risky to maintain computers, leading to faster timelines and fewer tickets.",
+        "tier": "Premium",
+        "jamfProHasFeature": "yes",
+        "jamfProtectHasFeature": "yes",
+        "productCategories": [
+          "Endpoint operations",
+          "Device management",
+          "Vulnerability management"
+        ],
+        "pricingTableCategories": [
+          "Devices"
+        ],
+        "waysToUse": [
+          {
+            "description": "Automate remediation for different applications with different security postures (cloud security engineering)"
+          }
+        ],
+        "name": "Teams"
+      },
+      {
+        "industryName": "Labels",
+        "documentationUrl": "https://fleetdm.com/docs/rest-api/rest-api#add-label",
+        "friendlyName": "Filter hosts using SQL",
+        "productCategories": [
+          "Endpoint operations",
+          "Device management",
+          "Vulnerability management"
+        ],
+        "pricingTableCategories": [
+          "Devices"
+        ],
+        "usualDepartment": "IT",
+        "tier": "Free",
+        "jamfProHasFeature": "no",
+        "jamfProtectHasFeature": "no",
+        "name": "Labels"
+      },
+      {
+        "industryName": "Policies",
+        "description": "A policy is a specific “yes” or “no” query. Use policies to manage security compliance in your organization.",
+        "documentationUrl": "https://fleetdm.com/docs/using-fleet/fleet-ui",
+        "tier": "Free",
+        "jamfProHasFeature": "yes",
+        "jamfProtectHasFeature": "no",
+        "productCategories": [
+          "Endpoint operations",
+          "Device management",
+          "Vulnerability management"
+        ],
+        "pricingTableCategories": [
+          "Devices"
+        ],
+        "usualDepartment": "IT",
+        "demos": [
+          {
+            "description": "A top financial services company needed to set up rolling deployments for changes to osquery agents running on their production servers.",
+            "moreInfoUrl": "https://docs.google.com/document/d/1UdzZMyBLbs9SUXfSXN2x2wZQCbjZZUetYlNWH6-ryqQ/edit#heading=h.2lh6ehprpvl6"
+          }
+        ],
+        "waysToUse": [
+          {
+            "description": "Trigger a workflow based on a failing policy",
+            "moreInfoUrl": "https://fleetdm.com/docs/using-fleet/automations#policy-automations"
+          }
+        ],
+        "name": "Policies"
+      },
+      {
+        "industryName": "File integrity monitoring (FIM)",
+        "friendlyName": "Detect changes to critical files",
+        "description": "Specify files to monitor for changes or deletions, then log those events to your SIEM or data lake, including key information such as filepath and checksum.",
+        "documentationUrl": "https://fleetdm.com/guides/osquery-evented-tables-overview#file-integrity-monitoring-fim",
+        "screenshotSrc": "",
+        "tier": "Free",
+        "jamfProHasFeature": "no",
+        "jamfProtectHasFeature": "yes",
+        "usualDepartment": "Security",
+        "productCategories": [
+          "Endpoint operations"
+        ],
+        "pricingTableCategories": [
+          "Devices"
+        ],
+        "dri": "mikermcneil",
+        "demos": [
+          {
+            "description": "A top gaming company needed a way to monitor critical files on production Debian servers.",
+            "quote": "The FIM features are kind of a top priority.",
+            "moreInfoUrl": "https://docs.google.com/document/d/1pE9U-1E4YDiy6h4TorszrTOiFAauFiORikSUFUqW7Pk/edit"
+          }
+        ],
+        "buzzwords": [
+          "File integrity monitoring (FIM)",
+          "Host-based intrusion detection system (HIDS)",
+          "Anomaly detection"
+        ],
+        "waysToUse": [
+          {
+            "description": "Monitor critical files on production Debian servers"
+          },
+          {
+            "description": "Detect anomalous filesystem activity",
+            "moreInfoUrl": "https://www.beyondtrust.com/resources/glossary/file-integrity-monitoring"
+          },
+          {
+            "description": "Detect unintended changes",
+            "moreInfoUrl": "https://www.beyondtrust.com/resources/glossary/file-integrity-monitoring"
+          },
+          {
+            "description": "Verify update status and monitor system health",
+            "moreInfoUrl": "https://www.beyondtrust.com/resources/glossary/file-integrity-monitoring"
+          },
+          {
+            "description": "Meet compliance mandates",
+            "moreInfoUrl": "https://www.beyondtrust.com/resources/glossary/file-integrity-monitoring"
+          }
+        ],
+        "name": "File integrity monitoring (FIM)"
+      },
+      {
+        "industryName": "File carving",
+        "description": "Write the results of complex queries to AWS S3.",
+        "documentationUrl": "https://fleetdm.com/docs/configuration/fleet-server-configuration#s-3-file-carving-backend",
+        "tier": "Free",
+        "jamfProHasFeature": "no",
+        "jamfProtectHasFeature": "no",
+        "usualDepartment": "Security",
+        "productCategories": [
+          "Endpoint operations"
+        ],
+        "pricingTableCategories": [
+          "Devices"
+        ],
+        "name": "File carving"
+      },
+      {
+        "industryName": "Binary authorization",
+        "friendlyName": "Restrict what programs can run, and what files running programs can access.",
+        "description": null,
+        "documentationUrl": null,
+        "tier": "Free",
+        "jamfProHasFeature": "yes",
+        "jamfProtectHasFeature": "yes",
+        "dri": "mikermcneil",
+        "usualDepartment": "Security",
+        "productCategories": [
+          "Endpoint operations"
+        ],
+        "pricingTableCategories": [
+          "Devices"
+        ],
+        "comingSoonOn": "2025-06-30",
+        "buzzwords": [
+          "Mandatory Access Control (MAC)",
+          "Privilege confinement",
+          "Binary authorization",
+          "Santa",
+          "Binary allowlisting",
+          "Binary whitelisting"
+        ],
+        "demos": [
+          {
+            "description": null,
+            "moreInfoUrl": null
+          }
+        ],
+        "waysToUse": [
+          {
+            "description": "Confine programs to a limited set of resources."
+          },
+          {
+            "description": "Report on AppArmor events",
+            "moreInfoUrl": "https://fleetdm.com/tables/apparmor_events"
+          },
+          {
+            "description": "Confine programs according to a set of rules that specify which files a program can access.",
+            "moreInfoUrl": "https://wiki.debian.org/AppArmor"
+          },
+          {
+            "description": "Proactively protect the system against both known and unknown vulnerabilities."
+          }
+        ],
+        "name": "Binary authorization",
+        "comingSoon": true
+      },
+      {
+        "industryName": "Reporting",
+        "description": "Generate reports based on searchable device attributes",
+        "documentationUrl": "https://fleetdm.com/docs/rest-api/rest-api#get-query-report",
+        "productCategories": [
+          "Endpoint operations",
+          "Device management",
+          "Vulnerability management"
+        ],
+        "pricingTableCategories": [
+          "Devices"
+        ],
+        "usualDepartment": "IT",
+        "tier": "Premium",
+        "jamfProHasFeature": "yes",
+        "jamfProtectHasFeature": "yes",
+        "name": "Reporting"
+      },
+      {
+        "industryName": "Incident response",
+        "friendlyName": "Interrogate hosts in real time",
+        "description": "Live query, triage, figuring out scope of impact, remediate using scripts or MDM commands (e.g. remote wipe), and quarantine or reimage using other systems and APIs (e.g. remove from network, decommission container)",
+        "documentationUrl": "https://fleetdm.com/securing/how-osquery-can-help-cyber-responders#simplifying-endpoint-visibility-with-osquery-and-fleet",
+        "tier": "Free",
+        "jamfProHasFeature": "yes",
+        "jamfProtectHasFeature": "yes",
+        "dri": "mikermcneil",
+        "usualDepartment": "Security",
+        "productCategories": [
+          "Endpoint operations"
+        ],
+        "pricingTableCategories": [
+          "Devices"
+        ],
+        "buzzwords": [],
+        "demos": [
+          {
+            "description": null,
+            "moreInfoUrl": null
+          }
+        ],
+        "waysToUse": [
+          {
+            "description": null
+          }
+        ],
+        "name": "Incident response"
+      },
+      {
+        "industryName": "Custom logging",
+        "description": "Flexible, configurable logging destinations (AWS Kinesis, Lambda, GCP, Kafka).",
+        "documentationUrl": "https://fleetdm.com/docs/using-fleet/log-destinations#log-destinations",
+        "tier": "Free",
+        "jamfProHasFeature": "yes",
+        "jamfProtectHasFeature": "yes",
+        "usualDepartment": "Security",
+        "productCategories": [
+          "Endpoint operations"
+        ],
+        "pricingTableCategories": [
+          "Devices"
+        ],
+        "buzzwords": [
+          "Real-time export",
+          "Ship logs"
+        ],
+        "name": "Custom logging"
+      },
+      {
+        "industryName": "Malware detection (YARA/custom IoCs)",
+        "friendlyName": "Scan files for zero days and malware signatures",
+        "description": "Use YARA signatures to report and trigger automations when zero days, malware, or unexpected files are detected on a host.",
+        "documentationUrl": "https://fleetdm.com/tables/yara",
+        "tier": "Free",
+        "jamfProHasFeature": "no",
+        "jamfProtectHasFeature": "yes",
+        "dri": "mikermcneil",
+        "usualDepartment": "Security",
+        "productCategories": [
+          "Endpoint operations",
+          "Vulnerability management"
+        ],
+        "pricingTableCategories": [
+          "Devices"
+        ],
+        "buzzwords": [
+          "YARA scanning",
+          "Cyber Threat Intelligence (CTI)",
+          "Indicators of compromise (IOCs)",
+          "Antivirus (AV)",
+          "Endpoint protection platform (EPP)",
+          "Endpoint detection and response (EDR)",
+          "Malware detection",
+          "Signature-based malware detection",
+          "Malware scanning",
+          "Malware analysis",
+          "Anomaly detection"
+        ],
+        "demos": [
+          {
+            "description": "A top media company used Fleet policies with YARA rules to continuously scan host filesystems for malware signatures provided by internal and external threat intelligence teams.",
+            "moreInfoUrl": null
+          }
+        ],
+        "waysToUse": [
+          {
+            "description": "Detect suspicious bytecode in JAR files"
+          },
+          {
+            "description": "Identify suspicious patterns in binaries using YARA signatures"
+          },
+          {
+            "description": "Continuously scan host filesystems for malware signatures.",
+            "moreInfoUrl": "https://yara.readthedocs.io/en/stable/writingrules.html"
+          },
+          {
+            "description": "Monitor for relevent filesystem changes (YARA events) and on-demand YARA signature scans.",
+            "moreInfoUrl": "https://osquery.readthedocs.io/en/stable/deployment/yara/"
+          },
+          {
+            "description": "Use YARA for malware detection",
+            "moreInfoUrl": "https://www.cisa.gov/sites/default/files/FactSheets/NCCIC%20ICS_FactSheet_YARA_S508C.pdf"
+          },
+          {
+            "description": "Scan for indicators of compromise (IoC) for common malware.",
+            "moreInfoUrl": "https://github.com/Cisco-Talos/osquery_queries"
+          },
+          {
+            "description": "Analyze malware using data from osquery, such as endpoint certificates and launch daemons (launchd).",
+            "moreInfoUrl": "https://medium.com/hackernoon/malware-analysis-using-osquery-part-3-9dc805b67d16"
+          },
+          {
+            "description": "Detect persistent malware (e.g. WireLurker) in endpoints by generating simple policies that search for their static indicators of compromise (IoCs).",
+            "moreInfoUrl": "https://osquery.readthedocs.io/en/stable/deployment/anomaly-detection/"
+          },
+          {
+            "description": "Run a targeted YARA scan with osquery as a lightweight approach to scan anything on a host filesystem, with minimal performance impact.  Unlike full system YARA scans which consume considerable CPU resources, an equivalent YARA scan targeted in Fleet can be 8x cheaper (CPU %).",
+            "moreInfoUrl": "https://www.tripwire.com/state-of-security/signature-socket-based-malware-detection-osquery-yara"
+          }
+        ],
+        "name": "Malware detection (YARA/custom IoCs)"
+      },
+      {
+        "industryName": "Continuous scanning",
+        "friendlyName": "Detect vulnerable software",
+        "documentationUrl": "https://fleetdm.com/vulnerability-management",
+        "productCategories": [
+          "Vulnerability management"
+        ],
+        "pricingTableCategories": [
+          "Devices"
+        ],
+        "usualDepartment": "Security",
+        "tier": "Free",
+        "jamfProHasFeature": "no",
+        "jamfProtectHasFeature": "yes",
+        "buzzwords": [
+          "Stakeholder-specific vulnerability categorization (SSVC)",
+          "Continuous scanning",
+          "Continuous vulnerability scanning",
+          "Risk-based vulnerability management"
+        ],
+        "waysToUse": [
+          {
+            "description": "Use an SSVC decision tree model to prioritize relevant vulnerabilities into four possible decisions: \"Track\", \"Track*\", \"Attend\", and \"Act\".",
+            "moreInfoUrl": "https://www.cisa.gov/stakeholder-specific-vulnerability-categorization-ssvc"
+          },
+          {
+            "description": "Balint Fazakas: I think what offers a better use of CVSS if you break it down to vectors. You may find that a DoS (High Availability Impact) not as relevant for you, or equally a vulnerability requiring user interaction has a very low likelihood of exploit in another scenario.  If you want to fine tune your SSVC, it worth using the vectors you care about instead of the score itself. But ultimately you would want to read the description of the vulnerabilities to determine the risk they are posing to your environment. SSVC can assist you to do that in a more efficient way.",
+            "moreInfoUrl": "https://www.linkedin.com/feed/update/urn:li:activity:7162614115025215488?commentUrn=urn%3Ali%3Acomment%3A%28activity%3A7162614115025215488%2C7162681703918985216%29&dashCommentUrn=urn%3Ali%3Afsd_comment%3A%287162681703918985216%2Curn%3Ali%3Aactivity%3A7162614115025215488%29"
+          },
+          {
+            "description": "Melissa Bischoping: CVSS is never enough to contextualize the urgency or risk of a vulnerability in your environment. It is one metric that needs to be part of an overall risk calculus, but a CVSS of 6 can be a greater threat in your organization than a CVSS of 10 based on the environmental variables and mitigations. Only two 10.0s here, but several lower severity that are resulting in high-impact breaches.   Getting a handle on managing that public facing infrastructure and being able to rapidly patch the apps and devices with such exposure needs to be part of an overall plan, but must go hand in hand with mitigations and layers of a zero trust design. CVSS isn’t the sole determination of risk, it’s only one partial piece of data to understand the impact of a vulnerability if exploited.",
+            "moreInfoUrl": "https://www.linkedin.com/feed/update/urn:li:activity:7162614115025215488?commentUrn=urn%3Ali%3Acomment%3A%28activity%3A7162614115025215488%2C7162629486344159232%29&dashCommentUrn=urn%3Ali%3Afsd_comment%3A%287162629486344159232%2Curn%3Ali%3Aactivity%3A7162614115025215488%29"
+          }
+        ],
+        "demos": [
+          {
+            "description": "A top gaming company wanted to replace Qualys for infrastructure vulnerability detection.",
+            "quote": "So we have some stuff today through Qualys, but it's just not very good. A lot of it is...it's just really noisy.  I'm trying to find out specifically, actually what packages are installed where, and then the ability to live query them.",
+            "moreInfoUrl": "https://docs.google.com/document/d/1JWtRsW1FUTCkZEESJj9-CvXjLXK4219by-C6vvVVyBY/edit"
+          },
+          {
+            "description": "One of the world's largest, top transportation companies uses Fleet's API to email relevant, actually-installed vulnerabilities to responsible teams so they can fix them.",
+            "moreInfoUrl": "https://docs.google.com/document/d/1oeCmT077o_5nxzLhnxs7kcg_4Qn1Pn1F5zx10nQOAp8/edit"
+          }
+        ],
+        "name": "Continuous scanning"
+      },
+      {
+        "industryName": "Vulnerability scores",
+        "friendlyName": "EPSS and CVSS",
+        "documentationUrl": "https://fleetdm.com/vulnerability-management",
+        "tier": "Premium",
+        "jamfProHasFeature": "no",
+        "jamfProtectHasFeature": "yes",
+        "usualDepartment": "Security",
+        "productCategories": [
+          "Vulnerability management"
+        ],
+        "pricingTableCategories": [
+          "Devices"
+        ],
+        "buzzwords": [
+          "Risk scores",
+          "Cyber risk",
+          "Risk reduction",
+          "Security operations effectiveness",
+          "Peer benchmarking",
+          "Security program effectiveness",
+          "Risk-based exposure scoring",
+          "Threat context",
+          "Cyber exposure",
+          "Exposure quantification and benchmarking",
+          "Optimize security investments",
+          "Vulnerability assessment"
+        ],
+        "demos": [
+          {
+            "description": "Fleet enables a more modern, threat-first prioritization approach to vulnerability management.",
+            "quote": "In reality, across our inventory of devices, it's unlikely to ever be exploited. I'd rather do that legwork on my team and then go and ask and prioritize work on these infrastructure teams that are already busy with things that could or could not be vulnerable. Being able to be more exact allows us to go to these teams less, which saves everybody time.",
+            "moreInfoUrl": "https://www.youtube.com/watch?v=G5Ry_vQPaYc&t=131s"
+          }
+        ],
+        "waysToUse": [
+          {
+            "description": "By leveraging EPSS (Exploit Prediction Scoring System), security professionals gain insight on the true risk behind rated CVEs."
+          },
+          {
+            "description": "An Introduction to EPSS, The Exploit Prediction Scoring System"
+          },
+          {
+            "moreInfoUrl": "https://www.youtube.com/watch?v=vw1RlZCSRcQ"
+          },
+          {
+            "description": "By extracting metadata from the National Vulnerability Database (NVD) and Microsoft Security Response Center (MSRC), we can determine which version of software is no longer vulnerable."
+          }
+        ],
+        "name": "Vulnerability scores"
+      },
+      {
+        "industryName": "CISA KEVs",
+        "description": "Known exploited vulnerabilities",
+        "documentationUrl": "https://fleetdm.com/vulnerability-management",
+        "tier": "Premium",
+        "jamfProHasFeature": "no",
+        "jamfProtectHasFeature": "yes",
+        "usualDepartment": "Security",
+        "productCategories": [
+          "Vulnerability management"
+        ],
+        "pricingTableCategories": [
+          "Devices"
+        ],
+        "demos": [
+          {
+            "description": null,
+            "moreInfoUrl": null
+          }
+        ],
+        "waysToUse": [
+          {
+            "description": "Help teams work on vulnerabilities that have actually been exploited (CISA KEVs) or have a high probability of being exploited (EPSS), or whatever is important in your environment."
+          },
+          {
+            "description": "Use CISA KEVs for vulnerability management"
+          },
+          {
+            "moreInfoUrl": "https://www.youtube.com/watch?v=Z3mw2oxssYk"
+          }
+        ],
+        "name": "CISA KEVs"
+      },
+      {
+        "industryName": "Asset discovery",
+        "documentationUrl": null,
+        "tier": "Premium",
+        "comingSoonOn": "2025-06-30",
+        "usualDepartment": "Security",
+        "productCategories": [
+          "Vulnerability management"
+        ],
+        "pricingTableCategories": [
+          "Devices"
+        ],
+        "name": "Asset discovery",
+        "comingSoon": true
+      },
+      {
+        "industryName": "REST API",
+        "friendlyName": "Automate any feature",
+        "description": null,
+        "productCategories": [
+          "Endpoint operations",
+          "Device management",
+          "Vulnerability management"
+        ],
+        "pricingTableCategories": [
+          "Integrations"
+        ],
+        "usualDepartment": "IT",
+        "documentationUrl": "https://fleetdm.com/docs/rest-api/rest-api",
+        "screenshotSrc": null,
+        "tier": "Free",
+        "jamfProHasFeature": "yes",
+        "jamfProtectHasFeature": "yes",
+        "dri": "rachaelshaw",
+        "name": "REST API"
+      },
+      {
+        "industryName": "Webhooks",
+        "friendlyName": "Automations",
+        "documentationUrl": "https://fleetdm.com/docs/using-fleet/automations#automations",
+        "productCategories": [
+          "Endpoint operations",
+          "Device management",
+          "Vulnerability management"
+        ],
+        "pricingTableCategories": [
+          "Integrations"
+        ],
+        "usualDepartment": "IT",
+        "tier": "Free",
+        "jamfProHasFeature": "yes",
+        "jamfProtectHasFeature": "yes",
+        "name": "Webhooks"
+      },
+      {
+        "industryName": "Grant API-only access",
+        "description": "Grant API-only access to accounts exclusively for automation.",
+        "documentationUrl": "https://fleetdm.com/docs/using-fleet/fleetctl-cli#using-fleetctl-with-an-api-only-user",
+        "productCategories": [
+          "Endpoint operations"
+        ],
+        "pricingTableCategories": [
+          "Integrations"
+        ],
+        "tier": "Free",
+        "jamfProHasFeature": "yes",
+        "jamfProtectHasFeature": "yes",
+        "name": "Grant API-only access"
+      },
+      {
+        "industryName": "Single sign on",
+        "description": "SSO, SAML",
+        "documentationUrl": "https://fleetdm.com/docs/deploy/single-sign-on-sso#single-sign-on-sso",
+        "productCategories": [
+          "Endpoint operations",
+          "Device management",
+          "Vulnerability management"
+        ],
+        "pricingTableCategories": [
+          "Integrations"
+        ],
+        "usualDepartment": "IT",
+        "tier": "Free",
+        "jamfProHasFeature": "yes",
+        "jamfProtectHasFeature": "yes",
+        "name": "Single sign on"
+      },
+      {
+        "industryName": "Automatic user creation (JIT, SCIM)",
+        "description": "Auto-create and manipulate Fleet users from Okta, etc with just-in-time (JIT) provisioning.",
+        "documentationUrl": "https://fleetdm.com/docs/deploy/single-sign-on-sso#just-in-time-jit-user-provisioning",
+        "productCategories": [
+          "Endpoint operations",
+          "Device management",
+          "Vulnerability management"
+        ],
+        "pricingTableCategories": [
+          "Integrations"
+        ],
+        "usualDepartment": "IT",
+        "tier": "Premium",
+        "jamfProHasFeature": "yes",
+        "jamfProtectHasFeature": "no",
+        "name": "Automatic user creation (JIT, SCIM)"
+      },
+      {
+        "industryName": "Third-party automation",
+        "friendlyName": "Borrow off-the-shelf tactics from the community",
+        "documentationUrl": "https://fleetdm.com/integrations",
+        "productCategories": [
+          "Endpoint operations",
+          "Device management",
+          "Vulnerability management"
+        ],
+        "pricingTableCategories": [
+          "Integrations"
+        ],
+        "usualDepartment": "IT",
+        "description": "Plug Fleet into other frameworks and tools like Tines, Snowflake, Terraform, Chronicle, Jira, Zendesk, etc",
+        "moreInfoUrl": "https://fleetdm.com/integrations",
+        "tier": "Free",
+        "jamfProHasFeature": "yes",
+        "jamfProtectHasFeature": "yes",
+        "waysToUse": [
+          {
+            "description": "(ActiveDirectory) Know who opened your computer and check their device posture before you let them log into anything."
+          },
+          {
+            "description": "(Ansible) Easily issue MDM commands and standardize data across operating systems."
+          },
+          {
+            "description": "(AWS) Deploy your own self-managed Fleet in any AWS environment in minutes."
+          },
+          {
+            "description": "(Azure) Deploy your own self-managed Fleet in the Microsoft Cloud in minutes."
+          },
+          {
+            "description": "(Chef) Easily issue MDM commands and standardize data across operating systems."
+          },
+          {
+            "description": "(Elastic) Ingest osquery data and monitor for important changes or events."
+          },
+          {
+            "description": "(GitHub) Version control using git, enabling collaboration and a GitOps workflow."
+          },
+          {
+            "description": "(GitLab) Version control using git, enabling collaboration and a GitOps workflow."
+          },
+          {
+            "description": "(Chronicle) Ingest osquery data and monitor for important changes or events."
+          },
+          {
+            "description": "(Google Cloud) Deploy your own self-managed Fleet in any GCP environment in minutes."
+          },
+          {
+            "description": "(Munki) Easily issue MDM commands and standardize data across operating systems."
+          },
+          {
+            "description": "(Okta) Know who opened your computer and check their device posture before you let them log into anything."
+          },
+          {
+            "description": "(Snowflake) Ingest osquery data and monitor for important changes or events."
+          },
+          {
+            "description": "(Splunk) Ingest osquery data and monitor for important changes or events."
+          },
+          {
+            "description": "(Tines) Build custom workflows that trigger in various situations."
+          },
+          {
+            "description": "(Webhooks) Configure automations that send webhooks to specific URLs when Fleet detects changes to host, policy, and CVE statuses."
+          },
+          {
+            "description": "(Zendesk) Automatically create Zendesk tickets in various situations."
+          },
+          {
+            "description": "(Jira) Automatically create Jira tickets in various situations, including exporting vulnerabilities to Jira and syncing tickets."
+          }
+        ],
+        "buzzwords": [
+          "Snowflake",
+          "Okta",
+          "Tines",
+          "Splunk",
+          "Elastic",
+          "AWS",
+          "ActiveDirectory",
+          "Ansible",
+          "GitHub",
+          "GitLab",
+          "Chronicle",
+          "Google Cloud",
+          "Munki",
+          "Vanta",
+          "Chef",
+          "Zendesk",
+          "Jira"
+        ],
+        "name": "Third-party automation"
+      },
+      {
+        "industryName": "Third-party orchestration",
+        "friendlyName": "Borrow off-the-shelf tactics from legendary brands",
+        "documentationUrl": "https://fleetdm.com/integrations",
+        "description": "Plug Fleet into other frameworks and tools like Puppet, Vanta, etc.",
+        "productCategories": [
+          "Endpoint operations",
+          "Device management",
+          "Vulnerability management"
+        ],
+        "pricingTableCategories": [
+          "Integrations"
+        ],
+        "usualDepartment": "IT",
+        "moreInfoUrl": "https://fleetdm.com/integrations",
+        "tier": "Premium",
+        "waysToUse": [
+          {
+            "description": "(Vanta) Trigger a workflow based on a failing policy."
+          },
+          {
+            "description": "(Puppet) Easily issue MDM commands, standardize data across operating systems, and map macOS+Windows settings to computers with the Puppet module."
+          },
+          {
+            "description": "(Torq) Build custom workflows that trigger in various situations."
+          },
+          {
+            "description": "(Custom IdP) Manage access to Fleet single sign-on (SSO) through any IdP (using SAML)."
+          }
+        ],
+        "buzzwords": [
+          "Vanta",
+          "Puppet",
+          "Custom IdP"
+        ],
+        "name": "Third-party orchestration"
+      },
+      {
+        "industryName": "Munki compatibility + visibility",
+        "tier": "Premium",
+        "jamfProHasFeature": "yes",
+        "jamfProtectHasFeature": "yes",
+        "usualDepartment": "IT",
+        "productCategories": [
+          "Device management"
+        ],
+        "pricingTableCategories": [
+          "Integrations"
+        ],
+        "name": "Munki compatibility + visibility"
+      },
+      {
+        "industryName": "Open-source issue tracker (GitHub)",
+        "documentationUrl": "https://fleetdm.com/support",
+        "productCategories": [
+          "Endpoint operations",
+          "Device management",
+          "Vulnerability management"
+        ],
+        "pricingTableCategories": [
+          "Support"
+        ],
+        "tier": "Free",
+        "jamfProHasFeature": "no",
+        "jamfProtectHasFeature": "no",
+        "name": "Open-source issue tracker (GitHub)"
+      },
+      {
+        "industryName": "Community Slack channel",
+        "documentationUrl": "https://fleetdm.com/support",
+        "productCategories": [
+          "Endpoint operations",
+          "Device management",
+          "Vulnerability management"
+        ],
+        "pricingTableCategories": [
+          "Support"
+        ],
+        "tier": "Free",
+        "jamfProHasFeature": "yes",
+        "jamfProtectHasFeature": "yes",
+        "name": "Community Slack channel"
+      },
+      {
+        "industryName": "Unlimited email support (confidential)",
+        "documentationUrl": "https://fleetdm.com/support",
+        "productCategories": [
+          "Endpoint operations",
+          "Device management",
+          "Vulnerability management"
+        ],
+        "pricingTableCategories": [
+          "Support"
+        ],
+        "tier": "Premium",
+        "jamfProHasFeature": "yes",
+        "jamfProtectHasFeature": "yes",
+        "name": "Unlimited email support (confidential)"
+      },
+      {
+        "industryName": "Phone and video call support",
+        "documentationUrl": "https://fleetdm.com/support",
+        "productCategories": [
+          "Endpoint operations",
+          "Device management",
+          "Vulnerability management"
+        ],
+        "pricingTableCategories": [
+          "Support"
+        ],
+        "tier": "Premium",
+        "jamfProHasFeature": "no",
+        "jamfProtectHasFeature": "no",
+        "name": "Phone and video call support"
+      }
+    ],
+    "markdownPages": [
+      {
+        "url": "/docs",
+        "title": "Readme.md",
+        "lastModifiedAt": 1726839803427,
+        "htmlId": "docs--readme--51292620cf",
+        "docNavCategory": "Uncategorized",
+        "sectionRelativeRepoPath": "README.md",
+        "meta": {}
+      },
+      {
+        "url": "/docs/rest-api/rest-api",
+        "title": "REST API",
+        "lastModifiedAt": 1726839804830,
+        "htmlId": "docs--rest-api--aa8babd202",
+        "pageOrderInSectionPath": 30,
+        "docNavCategory": "Uncategorized",
+        "sectionRelativeRepoPath": "REST API/rest-api.md",
+        "meta": {
+          "description": "Documentation for Fleet's REST API. See example requests and responses for each API endpoint."
+        }
+      },
+      {
+        "url": "/docs/configuration/agent-configuration",
+        "title": "Agent configuration",
+        "lastModifiedAt": 1726839804835,
+        "htmlId": "docs--agent-configuration--ac988306ab",
+        "pageOrderInSectionPath": 300,
+        "docNavCategory": "Uncategorized",
+        "sectionRelativeRepoPath": "Configuration/agent-configuration.md",
+        "meta": {
+          "description": "Learn how to use configuration files and the fleetctl command line tool to configure agent options."
+        }
+      },
+      {
+        "url": "/docs/configuration",
+        "title": "Configuration",
+        "lastModifiedAt": 1726839804836,
+        "htmlId": "docs--readme--71f5513034",
+        "docNavCategory": "Uncategorized",
+        "sectionRelativeRepoPath": "Configuration/README.md",
+        "meta": {}
+      },
+      {
+        "url": "/docs/configuration/fleet-server-configuration",
+        "title": "Fleet server configuration",
+        "lastModifiedAt": 1726839804850,
+        "htmlId": "docs--fleet-server-configu--51d934dc8a",
+        "pageOrderInSectionPath": 100,
+        "docNavCategory": "Uncategorized",
+        "sectionRelativeRepoPath": "Configuration/fleet-server-configuration.md",
+        "meta": {
+          "description": "This page includes resources for configuring the Fleet binary, managing osquery configurations, and running with systemd."
+        }
+      },
+      {
+        "url": "/docs/configuration/yaml-files",
+        "title": "YAML files",
+        "lastModifiedAt": 1726839804856,
+        "htmlId": "docs--yaml-files--1c08b93d5e",
+        "pageOrderInSectionPath": 1500,
+        "docNavCategory": "Uncategorized",
+        "sectionRelativeRepoPath": "Configuration/yaml-files.md",
+        "meta": {
+          "description": "Reference documentation for Fleet's GitOps workflow. See examples and configuration options."
+        }
+      },
+      {
+        "url": "/docs/rest-api",
+        "title": "REST API",
+        "lastModifiedAt": 1726839804857,
+        "htmlId": "docs--readme--1c430dc120",
+        "docNavCategory": "Uncategorized",
+        "sectionRelativeRepoPath": "REST API/README.md",
+        "meta": {}
+      },
+      {
+        "url": "/docs/deploy/reference-architectures",
+        "title": "Reference architectures",
+        "lastModifiedAt": 1726839804860,
+        "htmlId": "docs--reference-architectu--1e6f63e559",
+        "pageOrderInSectionPath": 400,
+        "docNavCategory": "Uncategorized",
+        "sectionRelativeRepoPath": "Deploy/Reference-Architectures.md",
+        "meta": {
+          "description": "An opinionated view of running Fleet in a production environment, and configuration strategies to enable high availability."
+        }
+      },
+      {
+        "url": "/docs/deploy",
+        "title": "Deploy",
+        "lastModifiedAt": 1726839804861,
+        "htmlId": "docs--readme--926e990cf4",
+        "docNavCategory": "Uncategorized",
+        "sectionRelativeRepoPath": "Deploy/README.md",
+        "meta": {
+          "description": "An overview of the deployment documentation for Fleet."
+        }
+      },
+      {
+        "url": "/docs/deploy/deploy-fleet",
+        "title": "Deploy Fleet",
+        "lastModifiedAt": 1726839804863,
+        "htmlId": "docs--deploy-fleet--82212f6ffe",
+        "pageOrderInSectionPath": 100,
+        "docNavCategory": "Uncategorized",
+        "sectionRelativeRepoPath": "Deploy/deploy-fleet.md",
+        "meta": {
+          "description": "Learn how to easily deploy Fleet on Render or AWS with Terraform."
+        }
+      },
+      {
+        "url": "/docs/deploy/single-sign-on-sso",
+        "title": "Single sign-on (SSO)",
+        "lastModifiedAt": 1726839804865,
+        "htmlId": "docs--single-sign-on-sso--89a4f43390",
+        "pageOrderInSectionPath": 200,
+        "docNavCategory": "Uncategorized",
+        "sectionRelativeRepoPath": "Deploy/single-sign-on-sso.md",
+        "meta": {
+          "description": "Learn how to configure single sign-on (SSO)"
+        }
+      },
+      {
+        "url": "/docs/get-started/faq",
+        "title": "FAQ",
+        "lastModifiedAt": 1726839804868,
+        "htmlId": "docs--faq--abab6eff91",
+        "docNavCategory": "Uncategorized",
+        "sectionRelativeRepoPath": "Get started/FAQ.md",
+        "meta": {
+          "description": "Commonly asked questions and answers about deployment from the Fleet community."
+        }
+      },
+      {
+        "url": "/docs/get-started",
+        "title": "Get started",
+        "lastModifiedAt": 1726839804869,
+        "htmlId": "docs--readme--3568e93d97",
+        "docNavCategory": "Uncategorized",
+        "sectionRelativeRepoPath": "Get started/README.md",
+        "meta": {}
+      },
+      {
+        "url": "/docs/get-started/anatomy",
+        "title": "Anatomy",
+        "lastModifiedAt": 1726839804869,
+        "htmlId": "docs--anatomy--1f83ca9de5",
+        "pageOrderInSectionPath": 200,
+        "docNavCategory": "Uncategorized",
+        "sectionRelativeRepoPath": "Get started/anatomy.md",
+        "meta": {}
+      },
+      {
+        "url": "/docs/get-started/why-fleet",
+        "title": "Why Fleet",
+        "lastModifiedAt": 1726839804870,
+        "htmlId": "docs--why-fleet--9ea776ea58",
+        "pageOrderInSectionPath": 100,
+        "docNavCategory": "Uncategorized",
+        "sectionRelativeRepoPath": "Get started/why-fleet.md",
+        "meta": {}
+      },
+      {
+        "url": "/docs/deploy/upgrading-fleet",
+        "title": "Upgrading Fleet",
+        "lastModifiedAt": 1726839804871,
+        "htmlId": "docs--upgrading-fleet--a39ae08550",
+        "pageOrderInSectionPath": 300,
+        "docNavCategory": "Uncategorized",
+        "sectionRelativeRepoPath": "Deploy/Upgrading-Fleet.md",
+        "meta": {
+          "description": "Learn how to upgrade your Fleet instance to the latest version."
+        }
+      },
+      {
+        "url": "/docs/get-started/tutorials-and-guides",
+        "title": "Tutorials and guides",
+        "lastModifiedAt": 1726839804872,
+        "htmlId": "docs--tutorials-and-guides--27a7cc6bcf",
+        "pageOrderInSectionPath": 300,
+        "docNavCategory": "Uncategorized",
+        "sectionRelativeRepoPath": "Get started/tutorials-and-guides.md",
+        "meta": {
+          "description": "Links to deployment tutorials and guides for using Fleet."
+        }
+      },
+      {
+        "url": "/docs/using-fleet",
+        "title": "Using Fleet",
+        "lastModifiedAt": 1726839804873,
+        "htmlId": "docs--readme--d3ac87c2d1",
+        "docNavCategory": "Uncategorized",
+        "sectionRelativeRepoPath": "Using Fleet/README.md",
+        "meta": {}
+      },
+      {
+        "url": "/handbook",
+        "title": "Readme.md",
+        "lastModifiedAt": 1726839804876,
+        "htmlId": "handbook--readme--58c6582576",
+        "sectionRelativeRepoPath": "README.md",
+        "meta": {
+          "maintainedBy": "mikermcneil"
+        },
+        "linksForHandbookIndex": [
+          {
+            "headingText": "Introduction",
+            "hashLink": "/handbook#introduction"
+          }
+        ]
+      },
+      {
+        "url": "/handbook/company",
+        "title": "🔭 Company",
+        "lastModifiedAt": 1726839804878,
+        "htmlId": "handbook--readme--e464663acc",
+        "sectionRelativeRepoPath": "company/README.md",
+        "meta": {
+          "maintainedBy": "mikermcneil"
+        },
+        "linksForHandbookIndex": [
+          {
+            "headingText": "Purpose",
+            "hashLink": "/handbook/company#purpose"
+          },
+          {
+            "headingText": "Culture",
+            "hashLink": "/handbook/company#culture"
+          },
+          {
+            "headingText": "Open positions",
+            "hashLink": "/handbook/company#open-positions"
+          },
+          {
+            "headingText": "Values",
+            "hashLink": "/handbook/company#values"
+          },
+          {
+            "headingText": "History",
+            "hashLink": "/handbook/company#history"
+          },
+          {
+            "headingText": "Org chart",
+            "hashLink": "/handbook/company#org-chart"
+          },
+          {
+            "headingText": "Advisors",
+            "hashLink": "/handbook/company#advisors"
+          }
+        ]
+      },
+      {
+        "url": "/handbook/company/handbook",
+        "title": "Handbook",
+        "lastModifiedAt": 1726839804879,
+        "htmlId": "handbook--handbook--9ae510ce56",
+        "sectionRelativeRepoPath": "company/handbook.md",
+        "meta": {
+          "maintainedBy": "mike-j-thomas"
+        },
+        "linksForHandbookIndex": [
+          {
+            "headingText": "Contributing to the handbook",
+            "hashLink": "/handbook/company/handbook#contributing-to-the-handbook"
+          }
+        ]
+      },
+      {
+        "url": "/handbook/company/communications",
+        "title": "🛰️ Communications",
+        "lastModifiedAt": 1726839804891,
+        "htmlId": "handbook--communications--f0d5a4a053",
+        "sectionRelativeRepoPath": "company/communications.md",
+        "meta": {
+          "maintainedBy": "mikermcneil"
+        },
+        "linksForHandbookIndex": [
+          {
+            "headingText": "All hands",
+            "hashLink": "/handbook/company/communications#all-hands"
+          },
+          {
+            "headingText": "Strategy",
+            "hashLink": "/handbook/company/communications#strategy"
+          },
+          {
+            "headingText": "Directly responsible individuals (DRIs)",
+            "hashLink": "/handbook/company/communications#directly-responsible-individuals-dr-is"
+          },
+          {
+            "headingText": "Tech stack admins",
+            "hashLink": "/handbook/company/communications#tech-stack-admins"
+          },
+          {
+            "headingText": "Fleetdm.com",
+            "hashLink": "/handbook/company/communications#fleetdm-com"
+          },
+          {
+            "headingText": "Marketing programs",
+            "hashLink": "/handbook/company/communications#marketing-programs"
+          },
+          {
+            "headingText": "Meetings",
+            "hashLink": "/handbook/company/communications#meetings"
+          },
+          {
+            "headingText": "Skip-level 1:1 meetings ",
+            "hashLink": "/handbook/company/communications#skip-level-1-1-meetings"
+          },
+          {
+            "headingText": "Zoom",
+            "hashLink": "/handbook/company/communications#zoom"
+          },
+          {
+            "headingText": "Levels of confidentiality",
+            "hashLink": "/handbook/company/communications#levels-of-confidentiality"
+          },
+          {
+            "headingText": "Google Drive",
+            "hashLink": "/handbook/company/communications#google-drive"
+          },
+          {
+            "headingText": "Email relays",
+            "hashLink": "/handbook/company/communications#email-relays"
+          },
+          {
+            "headingText": "Slack",
+            "hashLink": "/handbook/company/communications#slack"
+          },
+          {
+            "headingText": "GitHub",
+            "hashLink": "/handbook/company/communications#git-hub"
+          },
+          {
+            "headingText": "High priority user stories and bugs",
+            "hashLink": "/handbook/company/communications#high-priority-user-stories-and-bugs"
+          },
+          {
+            "headingText": "Figma",
+            "hashLink": "/handbook/company/communications#figma"
+          },
+          {
+            "headingText": "Spending company money",
+            "hashLink": "/handbook/company/communications#spending-company-money"
+          },
+          {
+            "headingText": "Travel",
+            "hashLink": "/handbook/company/communications#travel"
+          },
+          {
+            "headingText": "SOC 2",
+            "hashLink": "/handbook/company/communications#soc-2"
+          },
+          {
+            "headingText": "Vendor questionnaires ",
+            "hashLink": "/handbook/company/communications#vendor-questionnaires"
+          },
+          {
+            "headingText": "Getting a contract signed",
+            "hashLink": "/handbook/company/communications#getting-a-contract-signed"
+          },
+          {
+            "headingText": "Getting a contract reviewed",
+            "hashLink": "/handbook/company/communications#getting-a-contract-reviewed"
+          },
+          {
+            "headingText": "Trust",
+            "hashLink": "/handbook/company/communications#trust"
+          },
+          {
+            "headingText": "Benefits",
+            "hashLink": "/handbook/company/communications#benefits"
+          },
+          {
+            "headingText": "Compensation",
+            "hashLink": "/handbook/company/communications#compensation"
+          },
+          {
+            "headingText": "Team member onboarding",
+            "hashLink": "/handbook/company/communications#team-member-onboarding"
+          },
+          {
+            "headingText": "Performance feedback",
+            "hashLink": "/handbook/company/communications#performance-feedback"
+          },
+          {
+            "headingText": "Equipment",
+            "hashLink": "/handbook/company/communications#equipment"
+          },
+          {
+            "headingText": "Writing",
+            "hashLink": "/handbook/company/communications#writing"
+          },
+          {
+            "headingText": "Writing in Fleet-flavored Markdown",
+            "hashLink": "/handbook/company/communications#writing-in-fleet-flavored-markdown"
+          },
+          {
+            "headingText": "Things",
+            "hashLink": "/handbook/company/communications#things"
+          },
+          {
+            "headingText": "Commonly used terms",
+            "hashLink": "/handbook/company/communications#commonly-used-terms"
+          }
+        ]
+      },
+      {
+        "url": "/handbook/company/leadership",
+        "title": "🛠️ Leadership",
+        "lastModifiedAt": 1726839804898,
+        "htmlId": "handbook--leadership--7d8a02ee64",
+        "sectionRelativeRepoPath": "company/leadership.md",
+        "meta": {
+          "maintainedBy": "mikermcneil"
+        },
+        "linksForHandbookIndex": [
+          {
+            "headingText": "CEO flaws",
+            "hashLink": "/handbook/company/leadership#ceo-flaws"
+          },
+          {
+            "headingText": "Contact the CEO",
+            "hashLink": "/handbook/company/leadership#contact-the-ceo"
+          },
+          {
+            "headingText": "CEO responsibilities",
+            "hashLink": "/handbook/company/leadership#ceo-responsibilities"
+          },
+          {
+            "headingText": "Outline of departmental page structure",
+            "hashLink": "/handbook/company/leadership#outline-of-departmental-page-structure"
+          },
+          {
+            "headingText": "Key reviews",
+            "hashLink": "/handbook/company/leadership#key-reviews"
+          },
+          {
+            "headingText": "Hiring",
+            "hashLink": "/handbook/company/leadership#hiring"
+          },
+          {
+            "headingText": "CEO shadow program",
+            "hashLink": "/handbook/company/leadership#ceo-shadow-program"
+          },
+          {
+            "headingText": "Tracking hours",
+            "hashLink": "/handbook/company/leadership#tracking-hours"
+          },
+          {
+            "headingText": "Communicating departures",
+            "hashLink": "/handbook/company/leadership#communicating-departures"
+          },
+          {
+            "headingText": "Changing someone's position",
+            "hashLink": "/handbook/company/leadership#changing-someone-s-position"
+          },
+          {
+            "headingText": "Delivering performance feedback",
+            "hashLink": "/handbook/company/leadership#delivering-performance-feedback"
+          }
+        ]
+      },
+      {
+        "url": "/handbook/company/product-groups",
+        "title": "🛩️ Product groups",
+        "lastModifiedAt": 1726839804907,
+        "htmlId": "handbook--product-groups--44ec471e19",
+        "sectionRelativeRepoPath": "company/product-groups.md",
+        "meta": {
+          "maintainedBy": "lukeheath"
+        },
+        "linksForHandbookIndex": [
+          {
+            "headingText": "Product roadmap",
+            "hashLink": "/handbook/company/product-groups#product-roadmap"
+          },
+          {
+            "headingText": "What are product groups?",
+            "hashLink": "/handbook/company/product-groups#what-are-product-groups"
+          },
+          {
+            "headingText": "Current product groups",
+            "hashLink": "/handbook/company/product-groups#current-product-groups"
+          },
+          {
+            "headingText": "Making changes",
+            "hashLink": "/handbook/company/product-groups#making-changes"
+          },
+          {
+            "headingText": "Outages",
+            "hashLink": "/handbook/company/product-groups#outages"
+          },
+          {
+            "headingText": "Scaling Fleet",
+            "hashLink": "/handbook/company/product-groups#scaling-fleet"
+          },
+          {
+            "headingText": "Load testing",
+            "hashLink": "/handbook/company/product-groups#load-testing"
+          },
+          {
+            "headingText": "Version support",
+            "hashLink": "/handbook/company/product-groups#version-support"
+          },
+          {
+            "headingText": "Release testing",
+            "hashLink": "/handbook/company/product-groups#release-testing"
+          },
+          {
+            "headingText": "Feature fest",
+            "hashLink": "/handbook/company/product-groups#feature-fest"
+          },
+          {
+            "headingText": "Quality",
+            "hashLink": "/handbook/company/product-groups#quality"
+          },
+          {
+            "headingText": "How to reach the developer on-call",
+            "hashLink": "/handbook/company/product-groups#how-to-reach-the-developer-on-call"
+          },
+          {
+            "headingText": "Wireframes",
+            "hashLink": "/handbook/company/product-groups#wireframes"
+          },
+          {
+            "headingText": "Meetings",
+            "hashLink": "/handbook/company/product-groups#meetings"
+          },
+          {
+            "headingText": "Development best practices",
+            "hashLink": "/handbook/company/product-groups#development-best-practices"
+          },
+          {
+            "headingText": "Product design conventions",
+            "hashLink": "/handbook/company/product-groups#product-design-conventions"
+          },
+          {
+            "headingText": "Scrum at Fleet",
+            "hashLink": "/handbook/company/product-groups#scrum-at-fleet"
+          },
+          {
+            "headingText": "Sprints",
+            "hashLink": "/handbook/company/product-groups#sprints"
+          },
+          {
+            "headingText": "Outside contributions",
+            "hashLink": "/handbook/company/product-groups#outside-contributions"
+          }
+        ]
+      },
+      {
+        "url": "/handbook/company/why-this-way",
+        "title": "💭 Why this way?",
+        "lastModifiedAt": 1726839804912,
+        "htmlId": "handbook--why-this-way--52ff9aa8d3",
+        "sectionRelativeRepoPath": "company/why-this-way.md",
+        "meta": {
+          "maintainedBy": "mikermcneil"
+        },
+        "linksForHandbookIndex": [
+          {
+            "headingText": "Why open source?",
+            "hashLink": "/handbook/company/why-this-way#why-open-source"
+          },
+          {
+            "headingText": "Why handbook-first strategy?",
+            "hashLink": "/handbook/company/why-this-way#why-handbook-first-strategy"
+          },
+          {
+            "headingText": "Why read documentation?",
+            "hashLink": "/handbook/company/why-this-way#why-read-documentation"
+          },
+          {
+            "headingText": "Why the emphasis on training?",
+            "hashLink": "/handbook/company/why-this-way#why-the-emphasis-on-training"
+          },
+          {
+            "headingText": "Why direct responsibility?",
+            "hashLink": "/handbook/company/why-this-way#why-direct-responsibility"
+          },
+          {
+            "headingText": "Why do we use a wireframe-first approach?",
+            "hashLink": "/handbook/company/why-this-way#why-do-we-use-a-wireframe-first-approach"
+          },
+          {
+            "headingText": "Why do we use one repo?",
+            "hashLink": "/handbook/company/why-this-way#why-do-we-use-one-repo"
+          },
+          {
+            "headingText": "Why not continuously generate REST API reference docs from javadoc-style code comments?",
+            "hashLink": "/handbook/company/why-this-way#why-not-continuously-generate-rest-api-reference-docs-from-javadoc-style-code-comments"
+          },
+          {
+            "headingText": "Why group Slack channels?",
+            "hashLink": "/handbook/company/why-this-way#why-group-slack-channels"
+          },
+          {
+            "headingText": "Why make work visible?",
+            "hashLink": "/handbook/company/why-this-way#why-make-work-visible"
+          },
+          {
+            "headingText": "Why agile?",
+            "hashLink": "/handbook/company/why-this-way#why-agile"
+          },
+          {
+            "headingText": "Why a three-week cadence?",
+            "hashLink": "/handbook/company/why-this-way#why-a-three-week-cadence"
+          },
+          {
+            "headingText": "Why spend so much energy responding to every potential production incident?",
+            "hashLink": "/handbook/company/why-this-way#why-spend-so-much-energy-responding-to-every-potential-production-incident"
+          },
+          {
+            "headingText": "Why make it obvious when stuff breaks?",
+            "hashLink": "/handbook/company/why-this-way#why-make-it-obvious-when-stuff-breaks"
+          },
+          {
+            "headingText": "Why keep issue templates simple?",
+            "hashLink": "/handbook/company/why-this-way#why-keep-issue-templates-simple"
+          },
+          {
+            "headingText": "Why spend less?",
+            "hashLink": "/handbook/company/why-this-way#why-spend-less"
+          },
+          {
+            "headingText": "Why don't we sell like everyone else?",
+            "hashLink": "/handbook/company/why-this-way#why-don-t-we-sell-like-everyone-else"
+          },
+          {
+            "headingText": "Why does Fleet support query packs?",
+            "hashLink": "/handbook/company/why-this-way#why-does-fleet-support-query-packs"
+          },
+          {
+            "headingText": "Why does Fleet use sentence case?",
+            "hashLink": "/handbook/company/why-this-way#why-does-fleet-use-sentence-case"
+          },
+          {
+            "headingText": "Why not use superlatives?",
+            "hashLink": "/handbook/company/why-this-way#why-not-use-superlatives"
+          },
+          {
+            "headingText": "Why does Fleet use \"MDM on/off\" instead of \"MDM enrolled/unenrolled\"?",
+            "hashLink": "/handbook/company/why-this-way#why-does-fleet-use-mdm-on-off-instead-of-mdm-enrolled-unenrolled"
+          },
+          {
+            "headingText": "Why not mention the CEO in Slack threads?",
+            "hashLink": "/handbook/company/why-this-way#why-not-mention-the-ceo-in-slack-threads"
+          }
+        ]
+      },
+      {
+        "url": "/handbook/customer-success",
+        "title": "🌦️ Customer Success",
+        "lastModifiedAt": 1726839804915,
+        "htmlId": "handbook--readme--f00a4291b8",
+        "sectionRelativeRepoPath": "customer-success/README.md",
+        "meta": {
+          "maintainedBy": "zayhanlon"
+        },
+        "linksForHandbookIndex": [
+          {
+            "headingText": "Team",
+            "hashLink": "/handbook/customer-success#team"
+          },
+          {
+            "headingText": "Contact us",
+            "hashLink": "/handbook/customer-success#contact-us"
+          },
+          {
+            "headingText": "Responsibilities",
+            "hashLink": "/handbook/customer-success#responsibilities"
+          },
+          {
+            "headingText": "Rituals",
+            "hashLink": "/handbook/customer-success#rituals"
+          }
+        ]
+      },
+      {
+        "url": "/handbook/engineering/debugging",
+        "title": "Debugging",
+        "lastModifiedAt": 1726839804916,
+        "htmlId": "handbook--debugging--72906ebdd6",
+        "sectionRelativeRepoPath": "engineering/Debugging.md",
+        "meta": {
+          "maintainedBy": "lukeheath",
+          "description": "A guide to triaging and diagnosing issues in Fleet."
+        },
+        "linksForHandbookIndex": [
+          {
+            "headingText": "Goals of this guide",
+            "hashLink": "/handbook/engineering/debugging#goals-of-this-guide"
+          },
+          {
+            "headingText": "Basic data that is needed",
+            "hashLink": "/handbook/engineering/debugging#basic-data-that-is-needed"
+          },
+          {
+            "headingText": "Triaging the issue",
+            "hashLink": "/handbook/engineering/debugging#triaging-the-issue"
+          }
+        ]
+      },
+      {
+        "url": "/handbook/engineering/load-testing",
+        "title": "Load testing",
+        "lastModifiedAt": 1726839804917,
+        "htmlId": "handbook--load-testing--5fd9ee04e0",
+        "sectionRelativeRepoPath": "engineering/Load-testing.md",
+        "meta": {
+          "maintainedBy": "lukeheath",
+          "description": "This page outlines the most recent results of a semi-annual load test of the Fleet server."
+        },
+        "linksForHandbookIndex": [
+          {
+            "headingText": "Test parameters",
+            "hashLink": "/handbook/engineering/load-testing#test-parameters"
+          },
+          {
+            "headingText": "Results",
+            "hashLink": "/handbook/engineering/load-testing#results"
+          },
+          {
+            "headingText": "How we are simulating osquery",
+            "hashLink": "/handbook/engineering/load-testing#how-we-are-simulating-osquery"
+          },
+          {
+            "headingText": "Infrastructure setup",
+            "hashLink": "/handbook/engineering/load-testing#infrastructure-setup"
+          },
+          {
+            "headingText": "Limitations",
+            "hashLink": "/handbook/engineering/load-testing#limitations"
+          }
+        ]
+      },
+      {
+        "url": "/handbook/engineering",
+        "title": "🚀 Engineering",
+        "lastModifiedAt": 1726839804924,
+        "htmlId": "handbook--readme--777ccc3e11",
+        "sectionRelativeRepoPath": "engineering/README.md",
+        "meta": {
+          "maintainedBy": "lukeheath"
+        },
+        "linksForHandbookIndex": [
+          {
+            "headingText": "Team",
+            "hashLink": "/handbook/engineering#team"
+          },
+          {
+            "headingText": "Contact us",
+            "hashLink": "/handbook/engineering#contact-us"
+          },
+          {
+            "headingText": "Responsibilities",
+            "hashLink": "/handbook/engineering#responsibilities"
+          },
+          {
+            "headingText": "Rituals",
+            "hashLink": "/handbook/engineering#rituals"
+          }
+        ]
+      },
+      {
+        "url": "/handbook/engineering/scaling-fleet",
+        "title": "Scaling Fleet",
+        "lastModifiedAt": 1726839804925,
+        "htmlId": "handbook--scaling-fleet--7496895e6e",
+        "sectionRelativeRepoPath": "engineering/scaling-fleet.md",
+        "meta": {
+          "maintainedBy": "lukeheath"
+        }
+      },
+      {
+        "url": "/handbook/finance",
+        "title": "💸 Finance",
+        "lastModifiedAt": 1726839804931,
+        "htmlId": "handbook--readme--adb6ad624d",
+        "sectionRelativeRepoPath": "finance/README.md",
+        "meta": {
+          "maintainedBy": "jostableford"
+        },
+        "linksForHandbookIndex": [
+          {
+            "headingText": "Team",
+            "hashLink": "/handbook/finance#team"
+          },
+          {
+            "headingText": "Contact us",
+            "hashLink": "/handbook/finance#contact-us"
+          },
+          {
+            "headingText": "Responsibilities",
+            "hashLink": "/handbook/finance#responsibilities"
+          },
+          {
+            "headingText": "Rituals",
+            "hashLink": "/handbook/finance#rituals"
+          }
+        ]
+      },
+      {
+        "url": "/handbook/demand",
+        "title": "🫧 Demand",
+        "lastModifiedAt": 1726839804935,
+        "htmlId": "handbook--readme--5f95cdc89d",
+        "sectionRelativeRepoPath": "demand/README.md",
+        "meta": {
+          "maintainedBy": "Drew-P-Drawers"
+        },
+        "linksForHandbookIndex": [
+          {
+            "headingText": "Team",
+            "hashLink": "/handbook/demand#team"
+          },
+          {
+            "headingText": "Contact us",
+            "hashLink": "/handbook/demand#contact-us"
+          },
+          {
+            "headingText": "Responsibilities",
+            "hashLink": "/handbook/demand#responsibilities"
+          },
+          {
+            "headingText": "Rituals",
+            "hashLink": "/handbook/demand#rituals"
+          }
+        ]
+      },
+      {
+        "url": "/handbook/product-design",
+        "title": "🦢 Product design",
+        "lastModifiedAt": 1726839804937,
+        "htmlId": "handbook--readme--5ce44066f3",
+        "sectionRelativeRepoPath": "product-design/README.md",
+        "meta": {
+          "maintainedBy": "noahtalerman"
+        },
+        "linksForHandbookIndex": [
+          {
+            "headingText": "Team",
+            "hashLink": "/handbook/product-design#team"
+          },
+          {
+            "headingText": "Contact us",
+            "hashLink": "/handbook/product-design#contact-us"
+          },
+          {
+            "headingText": "Responsibilities",
+            "hashLink": "/handbook/product-design#responsibilities"
+          },
+          {
+            "headingText": "Rituals",
+            "hashLink": "/handbook/product-design#rituals"
+          }
+        ]
+      },
+      {
+        "url": "/handbook/digital-experience/application-security",
+        "title": "Application security",
+        "lastModifiedAt": 1726839804939,
+        "htmlId": "handbook--application-security--60a7adaa5a",
+        "sectionRelativeRepoPath": "digital-experience/application-security.md",
+        "meta": {
+          "description": "Explore Fleet's application security practices, including secure coding, SQL injection prevention, authentication, data encryption, access controls, and more.",
+          "maintainedBy": "hollidayn"
+        }
+      },
+      {
+        "url": "/handbook/digital-experience",
+        "title": "🌐 Digital Experience",
+        "lastModifiedAt": 1726839804945,
+        "htmlId": "handbook--readme--7c78659bd2",
+        "sectionRelativeRepoPath": "digital-experience/README.md",
+        "meta": {
+          "maintainedBy": "Sampfluger88"
+        },
+        "linksForHandbookIndex": [
+          {
+            "headingText": "Team",
+            "hashLink": "/handbook/digital-experience#team"
+          },
+          {
+            "headingText": "Contact us",
+            "hashLink": "/handbook/digital-experience#contact-us"
+          },
+          {
+            "headingText": "Responsibilities",
+            "hashLink": "/handbook/digital-experience#responsibilities"
+          },
+          {
+            "headingText": "Rituals",
+            "hashLink": "/handbook/digital-experience#rituals"
+          }
+        ]
+      },
+      {
+        "url": "/handbook/digital-experience/security-audits",
+        "title": "Security audits",
+        "lastModifiedAt": 1726839804948,
+        "htmlId": "handbook--security-audits--b0d65992c5",
+        "sectionRelativeRepoPath": "digital-experience/security-audits.md",
+        "meta": {
+          "description": "Explanations of the latest external security audits performed on Fleet software.",
+          "maintainedBy": "hollidayn"
+        },
+        "linksForHandbookIndex": [
+          {
+            "headingText": "June 2024 penetration testing of Fleet 4.50.1",
+            "hashLink": "/handbook/digital-experience/security-audits#june-2024-penetration-testing-of-fleet-4-50-1"
+          },
+          {
+            "headingText": "June 2023 penetration testing of Fleet 4.32 ",
+            "hashLink": "/handbook/digital-experience/security-audits#june-2023-penetration-testing-of-fleet-4-32"
+          },
+          {
+            "headingText": "April 2022 penetration testing of Fleet 4.12 ",
+            "hashLink": "/handbook/digital-experience/security-audits#april-2022-penetration-testing-of-fleet-4-12"
+          },
+          {
+            "headingText": "August 2021 security of Orbit auto-updater",
+            "hashLink": "/handbook/digital-experience/security-audits#august-2021-security-of-orbit-auto-updater"
+          }
+        ]
+      },
+      {
+        "url": "/handbook/digital-experience/security-policies",
+        "title": "📜 Security policies",
+        "lastModifiedAt": 1726839804955,
+        "htmlId": "handbook--security-policies--96158a5cf6",
+        "sectionRelativeRepoPath": "digital-experience/security-policies.md",
+        "meta": {
+          "maintainedBy": "jostableford"
+        },
+        "linksForHandbookIndex": [
+          {
+            "headingText": "Information security policy and acceptable use policy",
+            "hashLink": "/handbook/digital-experience/security-policies#information-security-policy-and-acceptable-use-policy"
+          },
+          {
+            "headingText": "Access control policy",
+            "hashLink": "/handbook/digital-experience/security-policies#access-control-policy"
+          },
+          {
+            "headingText": "Asset management policy",
+            "hashLink": "/handbook/digital-experience/security-policies#asset-management-policy"
+          },
+          {
+            "headingText": "Business continuity and disaster recovery policy",
+            "hashLink": "/handbook/digital-experience/security-policies#business-continuity-and-disaster-recovery-policy"
+          },
+          {
+            "headingText": "Data management policy",
+            "hashLink": "/handbook/digital-experience/security-policies#data-management-policy"
+          },
+          {
+            "headingText": "Encryption policy",
+            "hashLink": "/handbook/digital-experience/security-policies#encryption-policy"
+          },
+          {
+            "headingText": "Human resources security policy",
+            "hashLink": "/handbook/digital-experience/security-policies#human-resources-security-policy"
+          },
+          {
+            "headingText": "Incident response policy",
+            "hashLink": "/handbook/digital-experience/security-policies#incident-response-policy"
+          },
+          {
+            "headingText": "Network and system hardening standards",
+            "hashLink": "/handbook/digital-experience/security-policies#network-and-system-hardening-standards"
+          },
+          {
+            "headingText": "Operations security and change management policy",
+            "hashLink": "/handbook/digital-experience/security-policies#operations-security-and-change-management-policy"
+          },
+          {
+            "headingText": "Risk management policy",
+            "hashLink": "/handbook/digital-experience/security-policies#risk-management-policy"
+          },
+          {
+            "headingText": "Secure software development and product security policy ",
+            "hashLink": "/handbook/digital-experience/security-policies#secure-software-development-and-product-security-policy"
+          },
+          {
+            "headingText": "Security policy management policy",
+            "hashLink": "/handbook/digital-experience/security-policies#security-policy-management-policy"
+          },
+          {
+            "headingText": "Third-party management policy",
+            "hashLink": "/handbook/digital-experience/security-policies#third-party-management-policy"
+          },
+          {
+            "headingText": "Anti-corruption policy",
+            "hashLink": "/handbook/digital-experience/security-policies#anti-corruption-policy"
+          }
+        ]
+      },
+      {
+        "url": "/handbook/digital-experience/vendor-questionnaires",
+        "title": "📃 Vendor questionnaires",
+        "lastModifiedAt": 1726839804956,
+        "htmlId": "handbook--vendor-questionnaire--46cac642a1",
+        "sectionRelativeRepoPath": "digital-experience/vendor-questionnaires.md",
+        "meta": {
+          "maintainedBy": "dherder"
+        },
+        "linksForHandbookIndex": [
+          {
+            "headingText": "Scoping",
+            "hashLink": "/handbook/digital-experience/vendor-questionnaires#scoping"
+          },
+          {
+            "headingText": "Application security",
+            "hashLink": "/handbook/digital-experience/vendor-questionnaires#application-security"
+          },
+          {
+            "headingText": "Data security",
+            "hashLink": "/handbook/digital-experience/vendor-questionnaires#data-security"
+          },
+          {
+            "headingText": "Service monitoring and logging",
+            "hashLink": "/handbook/digital-experience/vendor-questionnaires#service-monitoring-and-logging"
+          },
+          {
+            "headingText": "Encryption and key management",
+            "hashLink": "/handbook/digital-experience/vendor-questionnaires#encryption-and-key-management"
+          },
+          {
+            "headingText": "Governance and risk management",
+            "hashLink": "/handbook/digital-experience/vendor-questionnaires#governance-and-risk-management"
+          },
+          {
+            "headingText": "Business continuity",
+            "hashLink": "/handbook/digital-experience/vendor-questionnaires#business-continuity"
+          },
+          {
+            "headingText": "Network security",
+            "hashLink": "/handbook/digital-experience/vendor-questionnaires#network-security"
+          },
+          {
+            "headingText": "Privacy",
+            "hashLink": "/handbook/digital-experience/vendor-questionnaires#privacy"
+          },
+          {
+            "headingText": "Sub-processors",
+            "hashLink": "/handbook/digital-experience/vendor-questionnaires#sub-processors"
+          }
+        ]
+      },
+      {
+        "url": "/handbook/digital-experience/security",
+        "title": "Security",
+        "lastModifiedAt": 1726839804965,
+        "htmlId": "handbook--security--585b03364d",
+        "sectionRelativeRepoPath": "digital-experience/security.md",
+        "meta": {
+          "maintainedBy": "hollidayn"
+        },
+        "linksForHandbookIndex": [
+          {
+            "headingText": "Security policies",
+            "hashLink": "/handbook/digital-experience/security#security-policies"
+          },
+          {
+            "headingText": "Account recovery process",
+            "hashLink": "/handbook/digital-experience/security#account-recovery-process"
+          },
+          {
+            "headingText": "How we protect end-user devices",
+            "hashLink": "/handbook/digital-experience/security#how-we-protect-end-user-devices"
+          },
+          {
+            "headingText": "Hardware security keys",
+            "hashLink": "/handbook/digital-experience/security#hardware-security-keys"
+          },
+          {
+            "headingText": "GitHub security",
+            "hashLink": "/handbook/digital-experience/security#git-hub-security"
+          },
+          {
+            "headingText": "Google Workspace security",
+            "hashLink": "/handbook/digital-experience/security#google-workspace-security"
+          },
+          {
+            "headingText": "Vulnerability management",
+            "hashLink": "/handbook/digital-experience/security#vulnerability-management"
+          },
+          {
+            "headingText": "Trust report",
+            "hashLink": "/handbook/digital-experience/security#trust-report"
+          },
+          {
+            "headingText": "Securtiy audits",
+            "hashLink": "/handbook/digital-experience/security#securtiy-audits"
+          },
+          {
+            "headingText": "Application security",
+            "hashLink": "/handbook/digital-experience/security#application-security"
+          }
+        ]
+      },
+      {
+        "url": "/handbook/sales",
+        "title": "🐋 Sales",
+        "lastModifiedAt": 1726839804968,
+        "htmlId": "handbook--readme--4fe57c451a",
+        "sectionRelativeRepoPath": "sales/README.md",
+        "meta": {
+          "maintainedBy": "alexmitchelliii"
+        },
+        "linksForHandbookIndex": [
+          {
+            "headingText": "Team",
+            "hashLink": "/handbook/sales#team"
+          },
+          {
+            "headingText": "Contact us",
+            "hashLink": "/handbook/sales#contact-us"
+          },
+          {
+            "headingText": "Responsibilities",
+            "hashLink": "/handbook/sales#responsibilities"
+          },
+          {
+            "headingText": "Rituals",
+            "hashLink": "/handbook/sales#rituals"
+          }
+        ]
+      },
+      {
+        "url": "/engineering/tips-for-github-actions-usability",
+        "title": "Tips for github actions usability",
+        "lastModifiedAt": 1726839804972,
+        "htmlId": "articles--4-tips-for-github-ac--c93d8d672b",
+        "sectionRelativeRepoPath": "4-tips-for-github-actions-usability.md",
+        "meta": {
+          "category": "engineering",
+          "authorGitHubUsername": "zwass",
+          "authorFullName": "Zach Wasserman",
+          "publishedOn": "2022-01-03",
+          "articleTitle": "4 tips for GitHub Actions usability (+2 bonus tips for debugging)",
+          "articleImageUrl": "/images/articles/4-tips-for-github-actions-usability-cover-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/guides/apple-developer-certificates-on-linux-for-configuration-profile-signing",
+        "title": "Apple developer certificates on linux for configuration profile signing",
+        "lastModifiedAt": 1726839804973,
+        "htmlId": "articles--apple-developer-cert--3d7bfdf01f",
+        "sectionRelativeRepoPath": "apple-developer-certificates-on-linux-for-configuration-profile-signing.md",
+        "meta": {
+          "articleTitle": "Apple developer certificates on Linux for configuration profile signing",
+          "authorFullName": "Brock Walters",
+          "authorGitHubUsername": "nonpunctual",
+          "category": "guides",
+          "publishedOn": "2024-03-06",
+          "articleImageUrl": "/images/articles/apple-developer-certificates-on-linux-for-configuration-profile-signing-1600x900@2x.png",
+          "description": "This guide walks through the process of adding an Apple signing certificate to a Linux host."
+        }
+      },
+      {
+        "url": "/announcements/a-new-fleet",
+        "title": "A new Fleet",
+        "lastModifiedAt": 1726839804974,
+        "htmlId": "articles--a-new-fleet--0c5af0e434",
+        "sectionRelativeRepoPath": "a-new-fleet.md",
+        "meta": {
+          "category": "announcements",
+          "authorGitHubUsername": "zwass",
+          "authorFullName": "Zach Wasserman",
+          "publishedOn": "2020-01-05",
+          "articleTitle": "A new Fleet",
+          "articleImageUrl": "/images/articles/a-new-fleet-cover-700x340@2x.jpeg"
+        }
+      },
+      {
+        "url": "/securing/apply-byod-to-soothe-supply-chain-pain",
+        "title": "Apply byod to soothe supply chain pain",
+        "lastModifiedAt": 1726839804976,
+        "htmlId": "articles--apply-byod-to-soothe--866604b091",
+        "sectionRelativeRepoPath": "apply-byod-to-soothe-supply-chain-pain.md",
+        "meta": {
+          "category": "security",
+          "authorGitHubUsername": "GuillaumeRoss",
+          "authorFullName": "Guillaume Ross",
+          "publishedOn": "2022-02-10",
+          "articleTitle": "Apply BYOD to soothe supply chain pain",
+          "articleImageUrl": "/images/articles/apply-byod-to-soothe-supply-chain-pain-cover-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/guides/automations",
+        "title": "Automations",
+        "lastModifiedAt": 1726839804976,
+        "htmlId": "articles--automations--ff5e8024a5",
+        "sectionRelativeRepoPath": "automations.md",
+        "meta": {
+          "category": "guides",
+          "authorGitHubUsername": "noahtalerman",
+          "authorFullName": "Noah Talerman",
+          "publishedOn": "2024-07-03",
+          "articleTitle": "Automations",
+          "description": "Configure Fleet automations to trigger webhooks or create tickets in Jira and Zendesk for vulnerability, policy, and host status events."
+        }
+      },
+      {
+        "url": "/guides/building-webhook-flows-with-fleet-and-tines",
+        "title": "Building webhook flows with Fleet and tines",
+        "lastModifiedAt": 1726839804978,
+        "htmlId": "articles--building-webhook-flo--3ffb4a9791",
+        "sectionRelativeRepoPath": "building-webhook-flows-with-fleet-and-tines.md",
+        "meta": {
+          "articleTitle": "Building webhook flows with Fleet and Tines",
+          "authorFullName": "Victor Lyuboslavsky",
+          "authorGitHubUsername": "getvictor",
+          "category": "guides",
+          "publishedOn": "2024-05-30",
+          "articleImageUrl": "/images/articles/building-webhook-flows-with-fleet-and-tines-1600x900@2x.png",
+          "description": "A guide to workflows using Tines and Fleet via webhook to update outdated OS versions."
+        }
+      },
+      {
+        "url": "/guides/building-an-effective-dashboard-with-fleet-rest-api-flask-and-plotly",
+        "title": "Building an effective dashboard with Fleet REST API flask and plotly",
+        "lastModifiedAt": 1726839804979,
+        "htmlId": "articles--building-an-effectiv--d3c30b5cf6",
+        "sectionRelativeRepoPath": "building-an-effective-dashboard-with-fleet-rest-api-flask-and-plotly.md",
+        "meta": {
+          "articleTitle": "Building an effective dashboard with Fleet's REST API, Flask, and Plotly: A step-by-step guide",
+          "authorFullName": "Dave Herder",
+          "authorGitHubUsername": "dherder",
+          "category": "guides",
+          "publishedOn": "2023-05-22",
+          "articleImageUrl": "/images/articles/building-an-effective-dashboard-with-fleet-rest-api-flask-and-plotly@2x.jpg",
+          "description": "Step-by-step guide on building a dynamic dashboard with Fleet's REST API, Flask, and Plotly. Master data visualization with open-source tools!"
+        }
+      },
+      {
+        "url": "/guides/certificates-in-fleetd",
+        "title": "Certificates in fleetd",
+        "lastModifiedAt": 1726839804980,
+        "htmlId": "articles--certificates-in-flee--f860411dcf",
+        "sectionRelativeRepoPath": "certificates-in-fleetd.md",
+        "meta": {
+          "articleTitle": "Certificates in fleetd",
+          "authorFullName": "Lucas Manuel Rodriguez",
+          "authorGitHubUsername": "lucasmrod",
+          "category": "guides",
+          "publishedOn": "2024-07-09",
+          "articleImageUrl": "/images/articles/apple-developer-certificates-on-linux-for-configuration-profile-signing-1600x900@2x.png",
+          "description": "TLS certificates in fleetd"
+        }
+      },
+      {
+        "url": "/guides/chrome-os",
+        "title": "Chrome os",
+        "lastModifiedAt": 1726839804981,
+        "htmlId": "articles--chrome-os--8f9e4f0cca",
+        "sectionRelativeRepoPath": "chrome-os.md",
+        "meta": {
+          "category": "guides",
+          "authorGitHubUsername": "zhumo",
+          "authorFullName": "Mo Zhu",
+          "publishedOn": "2023-11-21",
+          "articleTitle": "ChromeOS",
+          "description": "Learn about ChromeOS and Fleet."
+        }
+      },
+      {
+        "url": "/guides/catch-missed-authorization-checks-during-software-development",
+        "title": "Catch missed authorization checks during software development",
+        "lastModifiedAt": 1726839804981,
+        "htmlId": "articles--catch-missed-authori--74d449dae1",
+        "sectionRelativeRepoPath": "catch-missed-authorization-checks-during-software-development.md",
+        "meta": {
+          "articleTitle": "Catch missed authorization checks during software development",
+          "authorFullName": "Victor Lyuboslavsky",
+          "authorGitHubUsername": "getvictor",
+          "category": "guides",
+          "publishedOn": "2023-12-04",
+          "description": "How to perform authorization checks in a golang codebase for cybersecurity"
+        }
+      },
+      {
+        "url": "/guides/cis-benchmarks",
+        "title": "Cis benchmarks",
+        "lastModifiedAt": 1726839804982,
+        "htmlId": "articles--cis-benchmarks--c493697884",
+        "sectionRelativeRepoPath": "cis-benchmarks.md",
+        "meta": {
+          "category": "guides",
+          "authorGitHubUsername": "lucasmrod",
+          "authorFullName": "Lucas Rodriguez",
+          "publishedOn": "2024-04-02",
+          "articleTitle": "CIS Benchmarks",
+          "description": "Read about how Fleet's implementation of CIS Benchmarks offers consensus-based cybersecurity guidance."
+        }
+      },
+      {
+        "url": "/announcements/comparative-look-at-ws1-and-fleet",
+        "title": "Comparative look at ws1 and Fleet",
+        "lastModifiedAt": 1726839804983,
+        "htmlId": "articles--comparative-look-at---d3aff5bdd7",
+        "sectionRelativeRepoPath": "comparative-look-at-ws1-and-fleet.md",
+        "meta": {
+          "category": "announcements",
+          "authorFullName": "JD Strong",
+          "authorGitHubUsername": "spokanemac",
+          "publishedOn": "2024-02-01",
+          "articleTitle": "A comparative look at VMware Workspace ONE and Fleet Device Management",
+          "articleImageUrl": "/images/articles/comparative-look-at-ws1-and-fleet-1600x900@2x.png"
+        }
+      },
+      {
+        "url": "/guides/config-less-fleetd-agent-deployment",
+        "title": "Config less fleetd agent deployment",
+        "lastModifiedAt": 1726839804984,
+        "htmlId": "articles--config-less-fleetd-a--e5546949d5",
+        "sectionRelativeRepoPath": "config-less-fleetd-agent-deployment.md",
+        "meta": {
+          "articleTitle": "Config-less fleetd agent deployment",
+          "authorFullName": "Noah Talerman",
+          "authorGitHubUsername": "noahtalerman",
+          "category": "guides",
+          "publishedOn": "2024-01-31",
+          "articleImageUrl": "/images/articles/config-less-fleetd-agent-deployment-1600x900@2x.png",
+          "description": "Config-less `fleetd` agent deployment"
+        }
+      },
+      {
+        "url": "/guides/configuring-default-teams-for-devices-in-fleet",
+        "title": "Configuring default teams for devices in Fleet",
+        "lastModifiedAt": 1726839804985,
+        "htmlId": "articles--configuring-default---d9b024f2b7",
+        "sectionRelativeRepoPath": "configuring-default-teams-for-devices-in-fleet.md",
+        "meta": {
+          "articleTitle": "Configuring default teams for macOS, iOS, and iPadOS devices in Fleet",
+          "authorFullName": "JD Strong",
+          "authorGitHubUsername": "spokanemac",
+          "category": "guides",
+          "publishedOn": "2024-09-12",
+          "description": "This guide will walk you through configuring default teams for devices using the Fleet web UI."
+        }
+      },
+      {
+        "url": "/guides/converting-unix-timestamps-with-osquery",
+        "title": "Converting unix timestamps with osquery",
+        "lastModifiedAt": 1726839804986,
+        "htmlId": "articles--converting-unix-time--ace81a16aa",
+        "sectionRelativeRepoPath": "converting-unix-timestamps-with-osquery.md",
+        "meta": {
+          "category": "guides",
+          "authorFullName": "Mike Thomas",
+          "authorGitHubUsername": "mike-j-thomas",
+          "publishedOn": "2021-06-15",
+          "articleTitle": "Converting unix timestamps with osquery",
+          "articleImageUrl": "/images/articles/converting-unix-timestamps-with-osquery-cover-800x450@2x.jpeg"
+        }
+      },
+      {
+        "url": "/guides/correlate-network-connections-with-community-id-in-osquery",
+        "title": "Correlate network connections with community id in osquery",
+        "lastModifiedAt": 1726839804987,
+        "htmlId": "articles--correlate-network-co--10ea0b1641",
+        "sectionRelativeRepoPath": "correlate-network-connections-with-community-id-in-osquery.md",
+        "meta": {
+          "category": "guides",
+          "authorFullName": "Zach Wasserman",
+          "authorGitHubUsername": "zwass",
+          "publishedOn": "2021-06-02",
+          "articleTitle": "Correlate network connections with community ID in osquery.",
+          "articleImageUrl": "/images/articles/correlate-network-connections-with-community-id-in-osquery-cover-800x502@2x.jpeg"
+        }
+      },
+      {
+        "url": "/guides/custom-os-settings",
+        "title": "Custom os settings",
+        "lastModifiedAt": 1726839804988,
+        "htmlId": "articles--custom-os-settings--5e97a43205",
+        "sectionRelativeRepoPath": "custom-os-settings.md",
+        "meta": {
+          "category": "guides",
+          "authorGitHubUsername": "noahtalerman",
+          "authorFullName": "Noah Talerman",
+          "publishedOn": "2024-07-27",
+          "articleTitle": "Custom OS settings",
+          "description": "Learn how to enforce custom settings on macOS and Window hosts using Fleet's configuration profiles."
+        }
+      },
+      {
+        "url": "/announcements/debunk-the-cross-platform-myth",
+        "title": "Debunk the cross platform myth",
+        "lastModifiedAt": 1726839804989,
+        "htmlId": "articles--debunk-the-cross-pla--d46aac3cb4",
+        "sectionRelativeRepoPath": "debunk-the-cross-platform-myth.md",
+        "meta": {
+          "category": "announcements",
+          "authorFullName": "Mike McNeil",
+          "authorGitHubUsername": "mikermcneil",
+          "publishedOn": "2024-08-27",
+          "articleTitle": "Debunk the cross-platform myth",
+          "description": "Debunk the cross-platform myth with MDM"
+        }
+      },
+      {
+        "url": "/guides/delivering-data-to-snowflake-from-fleet-and-osquery",
+        "title": "Delivering data to snowflake from Fleet and osquery",
+        "lastModifiedAt": 1726839804991,
+        "htmlId": "articles--delivering-data-to-s--9677bbe81b",
+        "sectionRelativeRepoPath": "delivering-data-to-snowflake-from-fleet-and-osquery.md",
+        "meta": {
+          "category": "guides",
+          "authorGitHubUsername": "t-lark",
+          "authorFullName": "Tom Larkin",
+          "publishedOn": "2022-02-01",
+          "articleTitle": "Delivering data to Snowflake from Fleet and osquery.",
+          "articleImageUrl": "/images/articles/delivering-data-to-snowflake-from-fleet-and-osquery-cover-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/guides/deploy-fleet-on-aws-ecs",
+        "title": "Deploy Fleet on aws ecs",
+        "lastModifiedAt": 1726839804992,
+        "htmlId": "articles--deploy-fleet-on-aws---ca8c5b2fc4",
+        "sectionRelativeRepoPath": "deploy-fleet-on-aws-ecs.md",
+        "meta": {
+          "articleTitle": "Deploy Fleet on AWS ECS",
+          "authorGitHubUsername": "edwardsb",
+          "authorFullName": "Ben Edwards",
+          "publishedOn": "2021-10-06",
+          "category": "guides",
+          "articleImageUrl": "/images/articles/deploy-fleet-on-aws-ecs-800x450@2x.png",
+          "description": "Information for deploying Fleet on AWS ECS."
+        }
+      },
+      {
+        "url": "/guides/deploy-fleet-on-aws-with-terraform",
+        "title": "Deploy Fleet on aws with terraform",
+        "lastModifiedAt": 1726839804993,
+        "htmlId": "articles--deploy-fleet-on-aws---8b2a9168ab",
+        "sectionRelativeRepoPath": "deploy-fleet-on-aws-with-terraform.md",
+        "meta": {
+          "articleTitle": "Deploy Fleet on AWS with Terraform",
+          "authorGitHubUsername": "edwardsb",
+          "authorFullName": "Ben Edwards",
+          "publishedOn": "2021-11-30",
+          "category": "guides",
+          "articleImageUrl": "/images/articles/deploy-fleet-on-aws-with-terraform-800x450@2x.png",
+          "description": "Learn how to deploy Fleet on AWS."
+        }
+      },
+      {
+        "url": "/guides/deploy-fleet-on-centos",
+        "title": "Deploy Fleet on centos",
+        "lastModifiedAt": 1726839804994,
+        "htmlId": "articles--deploy-fleet-on-cent--4841e96234",
+        "sectionRelativeRepoPath": "deploy-fleet-on-centos.md",
+        "meta": {
+          "articleTitle": "Deploy Fleet on CentOS",
+          "authorGitHubUsername": "marpaia",
+          "authorFullName": "Mike Arpaia",
+          "publishedOn": "2017-09-22",
+          "category": "guides",
+          "articleImageUrl": "/images/articles/deploy-fleet-on-centos-800x450@2x.png",
+          "description": "A guide to deploy Fleet on CentOS."
+        }
+      },
+      {
+        "url": "/guides/deploy-fleet-on-cloudgov",
+        "title": "Deploy Fleet on cloudgov",
+        "lastModifiedAt": 1726839804995,
+        "htmlId": "articles--deploy-fleet-on-clou--ecdaaf656b",
+        "sectionRelativeRepoPath": "deploy-fleet-on-cloudgov.md",
+        "meta": {
+          "articleTitle": "Deploy Fleet on Cloud.gov",
+          "authorGitHubUsername": "JJediny",
+          "authorFullName": "John Jediny",
+          "publishedOn": "2022-09-08",
+          "category": "guides",
+          "articleImageUrl": "/images/articles/deploy-fleet-on-cloudgov-800x450@2x.png",
+          "description": "Information for deploying Fleet on Cloud.gov."
+        }
+      },
+      {
+        "url": "/guides/deploy-fleet-on-hetzner-cloud",
+        "title": "Deploy Fleet on hetzner cloud",
+        "lastModifiedAt": 1726839804999,
+        "htmlId": "articles--deploy-fleet-on-hetz--ab40dd3e5f",
+        "sectionRelativeRepoPath": "deploy-fleet-on-hetzner-cloud.md",
+        "meta": {
+          "articleTitle": "Deploy Fleet on Hetzner Cloud",
+          "authorGitHubUsername": "ksatter",
+          "authorFullName": "Kathy Satterlee",
+          "publishedOn": "2022-06-27",
+          "category": "guides",
+          "articleImageUrl": "/images/articles/deploy-fleet-on-hetzner-cloud-800x450@2x.png",
+          "description": "Learn how to deploy Fleet on Hetzner Cloud using cloud-init and Docker."
+        }
+      },
+      {
+        "url": "/guides/deploy-fleet-on-kubernetes",
+        "title": "Deploy Fleet on kubernetes",
+        "lastModifiedAt": 1726839805000,
+        "htmlId": "articles--deploy-fleet-on-kube--b62fcc97c7",
+        "sectionRelativeRepoPath": "deploy-fleet-on-kubernetes.md",
+        "meta": {
+          "articleTitle": "Deploy Fleet on Kubernetes",
+          "authorGitHubUsername": "marpaia",
+          "authorFullName": "Mike Arpaia",
+          "publishedOn": "2017-11-18",
+          "category": "guides",
+          "articleImageUrl": "/images/articles/deploy-fleet-on-kubernetes-800x450@2x.png",
+          "description": "Learn how to deploy Fleet on Kubernetes."
+        }
+      },
+      {
+        "url": "/guides/deploy-fleet-on-render",
+        "title": "Deploy Fleet on render",
+        "lastModifiedAt": 1726839805001,
+        "htmlId": "articles--deploy-fleet-on-rend--175bce353f",
+        "sectionRelativeRepoPath": "deploy-fleet-on-render.md",
+        "meta": {
+          "articleTitle": "Deploy Fleet on Render",
+          "authorGitHubUsername": "edwardsb",
+          "authorFullName": "Ben Edwards",
+          "publishedOn": "2021-11-21",
+          "category": "guides",
+          "articleImageUrl": "/images/articles/deploy-fleet-on-render-800x450@2x.png",
+          "description": "Learn how to deploy Fleet on Render."
+        }
+      },
+      {
+        "url": "/guides/deploy-fleet-on-ubuntu-with-elastic",
+        "title": "Deploy Fleet on ubuntu with elastic",
+        "lastModifiedAt": 1726839805004,
+        "htmlId": "articles--deploy-fleet-on-ubun--db33029e1f",
+        "sectionRelativeRepoPath": "deploy-fleet-on-ubuntu-with-elastic.md",
+        "meta": {
+          "articleTitle": "Deploy Fleet on Ubuntu",
+          "authorGitHubUsername": "defensivedepth",
+          "authorFullName": "Josh Brower",
+          "publishedOn": "2024-06-12",
+          "category": "guides",
+          "description": "A guide to deploy Fleet and Elastic on Ubuntu.",
+          "articleImageUrl": "/images/articles/deploy-fleet-on-ubuntu-with-elastic-1600x900@2x.png"
+        }
+      },
+      {
+        "url": "/guides/deploy-security-agents",
+        "title": "Deploy security agents",
+        "lastModifiedAt": 1726839805005,
+        "htmlId": "articles--deploy-security-agen--a3a93c715b",
+        "sectionRelativeRepoPath": "deploy-security-agents.md",
+        "meta": {
+          "articleTitle": "Deploy security agents",
+          "authorFullName": "Roberto Dip",
+          "authorGitHubUsername": "roperzh",
+          "category": "guides",
+          "publishedOn": "2024-08-05",
+          "articleImageUrl": "/images/articles/deploy-security-agents-1600x900@2x.png",
+          "description": "This guide will walk you through adding software to Fleet."
+        }
+      },
+      {
+        "url": "/securing/detect-log4j-with-osquery-and-fleet",
+        "title": "Detect log4j with osquery and Fleet",
+        "lastModifiedAt": 1726839805006,
+        "htmlId": "articles--detect-log4j-with-os--812eb5ba15",
+        "sectionRelativeRepoPath": "detect-log4j-with-osquery-and-fleet.md",
+        "meta": {
+          "category": "security",
+          "authorFullName": "Zach Wasserman",
+          "authorGitHubUsername": "zwass",
+          "publishedOn": "2021-12-15",
+          "articleTitle": "Detect Log4j with osquery (and Fleet)",
+          "articleImageUrl": "/images/articles/detect-log4j-with-osquery-and-fleet-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/guides/discovering-chrome-ai-using-fleet",
+        "title": "Discovering chrome ai using Fleet",
+        "lastModifiedAt": 1726839805007,
+        "htmlId": "articles--discovering-chrome-a--4de87d4fb6",
+        "sectionRelativeRepoPath": "discovering-chrome-ai-using-fleet.md",
+        "meta": {
+          "articleTitle": "Discovering Chrome AI using Fleet",
+          "authorFullName": "Brock Walters",
+          "authorGitHubUsername": "nonpunctual",
+          "category": "guides",
+          "publishedOn": "2024-09-06",
+          "articleImageUrl": "/images/articles/discovering-chrome-ai-using-fleet-1600x900@2x.jpg",
+          "description": "Use Fleet to detect and monitor settings enabled in Google Chrome by querying Chrome's preferences JSON file."
+        }
+      },
+      {
+        "url": "/guides/discovering-geacon-using-fleet",
+        "title": "Discovering geacon using Fleet",
+        "lastModifiedAt": 1726839805008,
+        "htmlId": "articles--discovering-geacon-u--bab06239aa",
+        "sectionRelativeRepoPath": "discovering-geacon-using-fleet.md",
+        "meta": {
+          "articleTitle": "Discovering Geacon using Fleet",
+          "authorFullName": "JD Strong",
+          "authorGitHubUsername": "spokanemac",
+          "category": "guides",
+          "publishedOn": "2023-05-18",
+          "articleImageUrl": "/images/articles/discovering-geacon-using-fleet-1600x900@2x.jpg",
+          "description": "Enterprise security teams can use Fleet to identify and locate Geacon payloads and protect their macOS devices from this threat."
+        }
+      },
+      {
+        "url": "/guides/discovering-xz-vulnerability-with-fleet",
+        "title": "Discovering xz vulnerability with Fleet",
+        "lastModifiedAt": 1726839805010,
+        "htmlId": "articles--discovering-xz-vulne--0a7dc5a7f8",
+        "sectionRelativeRepoPath": "discovering-xz-vulnerability-with-fleet.md",
+        "meta": {
+          "articleTitle": "Discovering xz vulnerability with Fleet",
+          "authorFullName": "Brock Walters",
+          "authorGitHubUsername": "nonpunctual",
+          "category": "guides",
+          "publishedOn": "2024-06-03",
+          "articleImageUrl": "/images/articles/discovering-geacon-using-fleet-1600x900@2x.jpg",
+          "description": "Discover and create a comprehensive end-to-end remediation workflow for the xz vulnerability (CVE-2024-3094) with Fleet."
+        }
+      },
+      {
+        "url": "/securing/does-osquery-violate-the-new-york-employee-monitoring-law",
+        "title": "Does osquery violate the new york employee monitoring law",
+        "lastModifiedAt": 1726839805011,
+        "htmlId": "articles--does-osquery-violate--fcac4cc8a5",
+        "sectionRelativeRepoPath": "does-osquery-violate-the-new-york-employee-monitoring-law.md",
+        "meta": {
+          "category": "security",
+          "authorFullName": "JD Strong",
+          "authorGitHubUsername": "spokanemac",
+          "publishedOn": "2023-04-18",
+          "articleTitle": "Does osquery violate the New York employee monitoring law?"
+        }
+      },
+      {
+        "url": "/guides/downgrade-fleet",
+        "title": "Downgrade Fleet",
+        "lastModifiedAt": 1726839805012,
+        "htmlId": "articles--downgrade-fleet--76de2fe679",
+        "sectionRelativeRepoPath": "downgrade-fleet.md",
+        "meta": {
+          "category": "guides",
+          "authorGitHubUsername": "eashaw",
+          "authorFullName": "Eric Shaw",
+          "publishedOn": "2024-01-09",
+          "articleTitle": "Downgrade from Fleet Premium",
+          "description": "Learn how to downgrade from Fleet Premium."
+        }
+      },
+      {
+        "url": "/guides/driving-company-culture-through-ai-haiku-poetry",
+        "title": "Driving company culture through ai haiku poetry",
+        "lastModifiedAt": 1726839805013,
+        "htmlId": "articles--driving-company-cult--52db9708d4",
+        "sectionRelativeRepoPath": "driving-company-culture-through-ai-haiku-poetry.md",
+        "meta": {
+          "articleTitle": "Driving company culture through AI haiku poetry",
+          "authorFullName": "Luke Heath",
+          "authorGitHubUsername": "lukeheath",
+          "category": "guides",
+          "publishedOn": "2024-04-17",
+          "articleImageUrl": "/images/articles/driving-company-culture-through-ai-haiku-poetry-1600x900@2x.png",
+          "description": "Code and verse entwine, Silicon sparks, haikus shine, Art meets design line."
+        }
+      },
+      {
+        "url": "/securing/ebpf-the-future-of-osquery-on-linux",
+        "title": "Ebpf the future of osquery on linux",
+        "lastModifiedAt": 1726839805014,
+        "htmlId": "articles--ebpf-the-future-of-o--cd30e84170",
+        "sectionRelativeRepoPath": "ebpf-the-future-of-osquery-on-linux.md",
+        "meta": {
+          "category": "security",
+          "authorGitHubUsername": "zwass",
+          "authorFullName": "Zach Wasserman",
+          "publishedOn": "2021-01-25",
+          "articleTitle": "eBPF & the future of osquery on Linux",
+          "articleImageUrl": "/images/articles/ebpf-the-future-of-osquery-on-linux-cover-700x394@2x.png"
+        }
+      },
+      {
+        "url": "/announcements/embracing-the-future-declarative-device-management",
+        "title": "Embracing the future declarative device management",
+        "lastModifiedAt": 1726839805015,
+        "htmlId": "articles--embracing-the-future--b3151457e1",
+        "sectionRelativeRepoPath": "embracing-the-future-declarative-device-management.md",
+        "meta": {
+          "category": "announcements",
+          "authorGitHubUsername": "spokanemac",
+          "authorFullName": "JD Strong",
+          "publishedOn": "2023-07-06",
+          "articleTitle": "Embracing the future: Declarative Device Management",
+          "articleImageUrl": "/images/articles/embracing-the-future-declarative-device-management@2x.png",
+          "description": "Explore the transformative impact of Declarative Device Management (DDM), Fleet, and osquery for MacAdmins."
+        }
+      },
+      {
+        "url": "/securing/end-user-self-remediation",
+        "title": "End user self remediation",
+        "lastModifiedAt": 1726839805016,
+        "htmlId": "articles--end-user-self-remedi--1ebc67c784",
+        "sectionRelativeRepoPath": "end-user-self-remediation.md",
+        "meta": {
+          "category": "security",
+          "authorFullName": "Chris McGillicuddy",
+          "authorGitHubUsername": "chris-mcgillicuddy",
+          "publishedOn": "2022-12-15",
+          "articleTitle": "End-user self remediation: empower your employees to fix security issues with Fleet"
+        }
+      },
+      {
+        "url": "/announcements/endpoint-managements-crucial-role-in-healthcare",
+        "title": "Endpoint managements crucial role in healthcare",
+        "lastModifiedAt": 1726839805017,
+        "htmlId": "articles--endpoint-managements--ec90fcd20a",
+        "sectionRelativeRepoPath": "endpoint-managements-crucial-role-in-healthcare.md",
+        "meta": {
+          "category": "announcements",
+          "authorFullName": "Alex Mitchell",
+          "authorGitHubUsername": "alexmitchelliii",
+          "publishedOn": "2024-05-24",
+          "articleTitle": "Endpoint management's crucial role in healthcare",
+          "articleImageUrl": "/images/articles/endpoint-managements-crucial-role-in-healthcare-1600x900@2x.png",
+          "description": "Discover how robust endpoint management is essential for securing healthcare data, ensuring compliance, and building patient trust."
+        }
+      },
+      {
+        "url": "/guides/enforce-disk-encryption",
+        "title": "Enforce disk encryption",
+        "lastModifiedAt": 1726839805018,
+        "htmlId": "articles--enforce-disk-encrypt--0ab61200c1",
+        "sectionRelativeRepoPath": "enforce-disk-encryption.md",
+        "meta": {
+          "category": "guides",
+          "authorGitHubUsername": "noahtalerman",
+          "authorFullName": "Noah Talerman",
+          "publishedOn": "2024-08-14",
+          "articleTitle": "Enforce disk encryption",
+          "description": "Learn how to enforce disk encryption on macOS and Windows hosts and manage encryption keys with Fleet Premium."
+        }
+      },
+      {
+        "url": "/guides/enforce-os-updates",
+        "title": "Enforce os updates",
+        "lastModifiedAt": 1726839805019,
+        "htmlId": "articles--enforce-os-updates--0ddd6f9117",
+        "sectionRelativeRepoPath": "enforce-os-updates.md",
+        "meta": {
+          "category": "guides",
+          "authorGitHubUsername": "noahtalerman",
+          "authorFullName": "Noah Talerman",
+          "publishedOn": "2024-08-10",
+          "articleTitle": "Enforce OS updates",
+          "description": "Learn how to manage OS updates on macOS, Windows, iOS, and iPadOS devices."
+        }
+      },
+      {
+        "url": "/announcements/enhancing-fleets-vulnerability-management-with-vulncheck-integration",
+        "title": "Enhancing fleets vulnerability management with vulncheck integration",
+        "lastModifiedAt": 1726839805020,
+        "htmlId": "articles--enhancing-fleets-vul--3cc4d5cb3a",
+        "sectionRelativeRepoPath": "enhancing-fleets-vulnerability-management-with-vulncheck-integration.md",
+        "meta": {
+          "category": "announcements",
+          "authorFullName": "JD Strong",
+          "authorGitHubUsername": "spokanemac",
+          "publishedOn": "2024-04-23",
+          "articleTitle": "Enhancing Fleet's vulnerability management with VulnCheck integration",
+          "articleImageUrl": "/images/articles/enhancing-fleets-vulnerability-management-with-vulncheck-integration-1600x900@2x.png"
+        }
+      },
+      {
+        "url": "/announcements/enhancing-k-12-cybersecurity-with-fcc-funds-and-fleet",
+        "title": "Enhancing k 12 cybersecurity with fcc funds and Fleet",
+        "lastModifiedAt": 1726839805021,
+        "htmlId": "articles--enhancing-k-12-cyber--90c76b24ef",
+        "sectionRelativeRepoPath": "enhancing-k-12-cybersecurity-with-fcc-funds-and-fleet.md",
+        "meta": {
+          "category": "announcements",
+          "authorFullName": "Alex Mitchell",
+          "authorGitHubUsername": "alexmitchelliii",
+          "publishedOn": "2024-07-25",
+          "articleTitle": "Enhancing K-12 cybersecurity with FCC funds and Fleet",
+          "articleImageUrl": "/images/articles/enhancing-k-12-cybersecurity-with-fcc-funds-and-fleet-1600x900@2x.png"
+        }
+      },
+      {
+        "url": "/guides/enroll-hosts",
+        "title": "Enroll hosts",
+        "lastModifiedAt": 1726839805023,
+        "htmlId": "articles--enroll-hosts--72fecd86ff",
+        "sectionRelativeRepoPath": "enroll-hosts.md",
+        "meta": {
+          "category": "guides",
+          "authorGitHubUsername": "noahtalerman",
+          "authorFullName": "Noah Talerman",
+          "publishedOn": "2024-08-08",
+          "articleTitle": "Enroll hosts",
+          "description": "Learn how to enroll hosts to Fleet."
+        }
+      },
+      {
+        "url": "/guides/enrolling-a-digital-ocean-droplet-on-a-fleet-instance",
+        "title": "Enrolling a digital ocean droplet on a Fleet instance",
+        "lastModifiedAt": 1726839805025,
+        "htmlId": "articles--enrolling-a-digital---6fbc5a61b0",
+        "sectionRelativeRepoPath": "enrolling-a-digital-ocean-droplet-on-a-fleet-instance.md",
+        "meta": {
+          "category": "guides",
+          "authorGitHubUsername": "DominusKelvin",
+          "authorFullName": "Kelvin Omereshone",
+          "publishedOn": "2022-05-26",
+          "articleTitle": "Enrolling a DigitalOcean Droplet on a Fleet instance",
+          "articleImageUrl": "/images/articles/enrolling-a-digitalocean-droplet-server-on-a-fleet-instance-cover-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/podcasts/expeditioners-bradley-chambers",
+        "title": "Expeditioners bradley chambers",
+        "lastModifiedAt": 1726839805026,
+        "htmlId": "articles--expeditioners-bradle--434ed8f62f",
+        "sectionRelativeRepoPath": "expeditioners-bradley-chambers.md",
+        "meta": {
+          "category": "podcasts",
+          "authorGitHubUsername": "zwass",
+          "authorFullName": "Zach Wasserman",
+          "publishedOn": "2023-07-20",
+          "articleTitle": "ExpedITioners podcast with Bradley Chambers",
+          "articleImageUrl": "/images/articles/expeditioners-podcast-ep1-1600x900@2x.png"
+        }
+      },
+      {
+        "url": "/podcasts/expeditioners-charles-edge",
+        "title": "Expeditioners charles edge",
+        "lastModifiedAt": 1726839805027,
+        "htmlId": "articles--expeditioners-charle--078e2e677d",
+        "sectionRelativeRepoPath": "expeditioners-charles-edge.md",
+        "meta": {
+          "category": "podcasts",
+          "authorGitHubUsername": "zwass",
+          "authorFullName": "Zach Wasserman",
+          "publishedOn": "2023-10-23",
+          "articleTitle": "ExpedITioners podcast with Charles Edge",
+          "articleImageUrl": "/images/articles/expeditioners-podcast-ep5-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/podcasts/expeditioners-huxley-barbee",
+        "title": "Expeditioners huxley barbee",
+        "lastModifiedAt": 1726839805027,
+        "htmlId": "articles--expeditioners-huxley--59793f39c1",
+        "sectionRelativeRepoPath": "expeditioners-huxley-barbee.md",
+        "meta": {
+          "category": "podcasts",
+          "authorGitHubUsername": "zwass",
+          "authorFullName": "Zach Wasserman",
+          "publishedOn": "2024-01-30",
+          "articleTitle": "ExpedITioners podcast with Huxley Barbee",
+          "articleImageUrl": "/images/articles/expeditioners-podcast-ep8-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/podcasts/expeditioners-jeff-chao",
+        "title": "Expeditioners jeff chao",
+        "lastModifiedAt": 1726839805028,
+        "htmlId": "articles--expeditioners-jeff-c--69f6b2fce1",
+        "sectionRelativeRepoPath": "expeditioners-jeff-chao.md",
+        "meta": {
+          "category": "podcasts",
+          "authorGitHubUsername": "zwass",
+          "authorFullName": "Zach Wasserman",
+          "publishedOn": "2023-11-15",
+          "articleTitle": "ExpedITioners podcast with Jeff Chao",
+          "articleImageUrl": "/images/articles/expeditioners-podcast-ep6-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/podcasts/expeditioners-john-reynolds",
+        "title": "Expeditioners john reynolds",
+        "lastModifiedAt": 1726839805029,
+        "htmlId": "articles--expeditioners-john-r--2abfb47f0e",
+        "sectionRelativeRepoPath": "expeditioners-john-reynolds.md",
+        "meta": {
+          "category": "podcasts",
+          "authorGitHubUsername": "zwass",
+          "authorFullName": "Zach Wasserman",
+          "publishedOn": "2023-09-21",
+          "articleTitle": "ExpedITioners podcast with John Reynolds",
+          "articleImageUrl": "/images/articles/expeditioners-podcast-ep4-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/podcasts/expeditioners-niels-hofmans",
+        "title": "Expeditioners niels hofmans",
+        "lastModifiedAt": 1726839805030,
+        "htmlId": "articles--expeditioners-niels---d1c8e645af",
+        "sectionRelativeRepoPath": "expeditioners-niels-hofmans.md",
+        "meta": {
+          "category": "podcasts",
+          "authorGitHubUsername": "zwass",
+          "authorFullName": "Zach Wasserman",
+          "publishedOn": "2023-08-22",
+          "articleTitle": "ExpedITioners podcast with Niels Hofmans",
+          "articleImageUrl": "/images/articles/expeditioners-podcast-ep2-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/podcasts/expeditioners-podcast-with-marcus-ransom",
+        "title": "Expeditioners podcast with marcus ransom",
+        "lastModifiedAt": 1726839805031,
+        "htmlId": "articles--expeditioners-podcas--98c32a782f",
+        "sectionRelativeRepoPath": "expeditioners-podcast-with-marcus-ransom.md",
+        "meta": {
+          "category": "podcasts",
+          "authorGitHubUsername": "zwass",
+          "authorFullName": "Zach Wasserman",
+          "publishedOn": "2023-12-11",
+          "articleTitle": "ExpedITioners podcast with Marcus Ransom",
+          "articleImageUrl": "/images/articles/expeditioners-podcast-ep7-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/podcasts/expeditioners-rich-trouton",
+        "title": "Expeditioners rich trouton",
+        "lastModifiedAt": 1726839805032,
+        "htmlId": "articles--expeditioners-rich-t--c394f4ba38",
+        "sectionRelativeRepoPath": "expeditioners-rich-trouton.md",
+        "meta": {
+          "category": "podcasts",
+          "authorGitHubUsername": "zwass",
+          "authorFullName": "Zach Wasserman",
+          "publishedOn": "2023-08-31",
+          "articleTitle": "ExpedITioners podcast with Rich Trouton",
+          "articleImageUrl": "/images/articles/expeditioners-podcast-ep3-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/guides/filtering-software-by-vulnerability",
+        "title": "Filtering software by vulnerability",
+        "lastModifiedAt": 1726839805033,
+        "htmlId": "articles--filtering-software-b--900d8b7307",
+        "sectionRelativeRepoPath": "filtering-software-by-vulnerability.md",
+        "meta": {
+          "articleTitle": "Filtering software by vulnerability in Fleet",
+          "authorFullName": "Tim Lee",
+          "authorGitHubUsername": "mostlikelee",
+          "category": "guides",
+          "publishedOn": "2024-08-30",
+          "articleImageUrl": "/images/articles/discovering-geacon-using-fleet-1600x900@2x.jpg",
+          "description": "Filter software by vulnerability in Fleet to prioritize critical patches and enhance your organization's security posture."
+        }
+      },
+      {
+        "url": "/releases/fleet-3.10.0",
+        "title": "Fleet 3.10.0",
+        "lastModifiedAt": 1726839805034,
+        "htmlId": "articles--fleet-3100--09d2002dcd",
+        "sectionRelativeRepoPath": "fleet-3.10.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "Noah Talerman",
+          "authorGitHubUsername": "noahtalerman",
+          "publishedOn": "2021-04-01",
+          "articleTitle": "Fleet 3.10.0 released with agent auto-updates beta",
+          "articleImageUrl": "/images/articles/fleet-3.10.0-cover-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/releases/fleet-3.11.0",
+        "title": "Fleet 3.11.0",
+        "lastModifiedAt": 1726839805035,
+        "htmlId": "articles--fleet-3110--ad56a464f5",
+        "sectionRelativeRepoPath": "fleet-3.11.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "Noah Talerman",
+          "authorGitHubUsername": "noahtalerman",
+          "publishedOn": "2021-04-29",
+          "articleTitle": "Fleet 3.11.0 released with software inventory",
+          "articleImageUrl": "/images/articles/fleet-3.11.0-cover-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/releases/fleet-3.12.0",
+        "title": "Fleet 3.12.0",
+        "lastModifiedAt": 1726839805036,
+        "htmlId": "articles--fleet-3120--8f3c795b51",
+        "sectionRelativeRepoPath": "fleet-3.12.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "Noah Talerman",
+          "authorGitHubUsername": "noahtalerman",
+          "publishedOn": "2021-05-20",
+          "articleTitle": "Fleet 3.12.0",
+          "articleImageUrl": "/images/articles/fleet-3.12.0-cover-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/releases/fleet-3.5.0",
+        "title": "Fleet 3.5.0",
+        "lastModifiedAt": 1726839805037,
+        "htmlId": "articles--fleet-350--0912885a04",
+        "sectionRelativeRepoPath": "fleet-3.5.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "Noah Talerman",
+          "authorGitHubUsername": "noahtalerman",
+          "publishedOn": "2020-12-12",
+          "articleTitle": "Fleet 3.5.0",
+          "articleImageUrl": "/images/articles/fleet-3.5.0-cover-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/releases/fleet-3.6.0",
+        "title": "Fleet 3.6.0",
+        "lastModifiedAt": 1726839805039,
+        "htmlId": "articles--fleet-360--b415aaaf59",
+        "sectionRelativeRepoPath": "fleet-3.6.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "Noah Talerman",
+          "authorGitHubUsername": "noahtalerman",
+          "publishedOn": "2021-01-09",
+          "articleTitle": "Fleet 3.6.0",
+          "articleImageUrl": "/images/articles/fleet-3.6.0-cover-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/releases/fleet-3.13.0",
+        "title": "Fleet 3.13.0",
+        "lastModifiedAt": 1726839805041,
+        "htmlId": "articles--fleet-3130--6a4b26ee04",
+        "sectionRelativeRepoPath": "fleet-3.13.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "Noah Talerman",
+          "authorGitHubUsername": "noahtalerman",
+          "publishedOn": "2021-06-04",
+          "articleTitle": "Fleet 3.13.0",
+          "articleImageUrl": "/images/articles/fleet-3.13.0-cover-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/releases/fleet-3.7.1",
+        "title": "Fleet 3.7.1",
+        "lastModifiedAt": 1726839805042,
+        "htmlId": "articles--fleet-371--a3099c00cb",
+        "sectionRelativeRepoPath": "fleet-3.7.1.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "Noah Talerman",
+          "authorGitHubUsername": "noahtalerman",
+          "publishedOn": "2021-02-04",
+          "articleTitle": "Fleet 3.7.1",
+          "articleImageUrl": "/images/articles/fleet-3.7.1-cover-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/releases/fleet-3.8.0",
+        "title": "Fleet 3.8.0",
+        "lastModifiedAt": 1726839805042,
+        "htmlId": "articles--fleet-380--681019a9ad",
+        "sectionRelativeRepoPath": "fleet-3.8.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "Noah Talerman",
+          "authorGitHubUsername": "noahtalerman",
+          "publishedOn": "2021-02-26",
+          "articleTitle": "Fleet 3.8.0",
+          "articleImageUrl": "/images/articles/fleet-3.8.0-cover-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/releases/fleet-3.9.0",
+        "title": "Fleet 3.9.0",
+        "lastModifiedAt": 1726839805043,
+        "htmlId": "articles--fleet-390--7ceb277f2f",
+        "sectionRelativeRepoPath": "fleet-3.9.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "Noah Talerman",
+          "authorGitHubUsername": "noahtalerman",
+          "publishedOn": "2021-03-10",
+          "articleTitle": "Fleet 3.9.0",
+          "articleImageUrl": "/images/articles/fleet-3.9.0-cover-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/releases/fleet-4.0.0",
+        "title": "Fleet 4.0.0",
+        "lastModifiedAt": 1726839805044,
+        "htmlId": "articles--fleet-400--33d96e46d6",
+        "sectionRelativeRepoPath": "fleet-4.0.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "Noah Talerman",
+          "authorGitHubUsername": "noahtalerman",
+          "publishedOn": "2021-06-30",
+          "articleTitle": "Fleet 4.0.0 released with Role-based access control and Teams features",
+          "articleImageUrl": "/images/articles/fleet-4.0.0-cover-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/releases/fleet-4.1.0",
+        "title": "Fleet 4.1.0",
+        "lastModifiedAt": 1726839805045,
+        "htmlId": "articles--fleet-410--2f2a288a79",
+        "sectionRelativeRepoPath": "fleet-4.1.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "Noah Talerman",
+          "authorGitHubUsername": "noahtalerman",
+          "publishedOn": "2021-07-27",
+          "articleTitle": "Fleet 4.1.0 released with Schedule and Activity feed features",
+          "articleImageUrl": "/images/articles/fleet-4.1.0-cover-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/releases/fleet-4.10.0",
+        "title": "Fleet 4.10.0",
+        "lastModifiedAt": 1726839805046,
+        "htmlId": "articles--fleet-4100--dd259b5e42",
+        "sectionRelativeRepoPath": "fleet-4.10.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "Mike Thomas",
+          "authorGitHubUsername": "mike-j-thomas",
+          "publishedOn": "2022-02-14",
+          "articleTitle": "Fleet 4.10.0 brings new features and improvements for vulnerability analysts.",
+          "articleImageUrl": "/images/articles/fleet-4.10.0-cover-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/releases/fleet-4.12.0",
+        "title": "Fleet 4.12.0",
+        "lastModifiedAt": 1726839805047,
+        "htmlId": "articles--fleet-4120--150c6e2731",
+        "sectionRelativeRepoPath": "fleet-4.12.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "Mike Thomas",
+          "authorGitHubUsername": "mike-j-thomas",
+          "publishedOn": "2022-03-25",
+          "articleTitle": "Fleet 4.12.0 | Platform-specific policies, and improved query results",
+          "articleImageUrl": "/images/articles/fleet-4.12.0-cover-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/releases/fleet-4.13.0",
+        "title": "Fleet 4.13.0",
+        "lastModifiedAt": 1726839805047,
+        "htmlId": "articles--fleet-4130--771b1f08ac",
+        "sectionRelativeRepoPath": "fleet-4.13.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "Fleet",
+          "authorGitHubUsername": "fleetdm",
+          "publishedOn": "2022-04-19",
+          "articleTitle": "Fleet 4.13.0 | Security fixes, policy automations for teams, and aggregated macOS versions for MacAdmins.",
+          "articleImageUrl": "/images/articles/fleet-4.13.0-cover-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/releases/fleet-4.11.0",
+        "title": "Fleet 4.11.0",
+        "lastModifiedAt": 1726839805048,
+        "htmlId": "articles--fleet-4110--a057b8896f",
+        "sectionRelativeRepoPath": "fleet-4.11.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "Mike Thomas",
+          "authorGitHubUsername": "mike-j-thomas",
+          "publishedOn": "2022-03-07",
+          "articleTitle": "Fleet 4.11.0 brings impact clarity, improvements to vulnerability processing, and performance updates.",
+          "articleImageUrl": "/images/articles/fleet-4.11.0-cover-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/releases/fleet-4.14.0",
+        "title": "Fleet 4.14.0",
+        "lastModifiedAt": 1726839805049,
+        "htmlId": "articles--fleet-4140--e58b7a34f3",
+        "sectionRelativeRepoPath": "fleet-4.14.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "Kathy Satterlee",
+          "authorGitHubUsername": "ksatter",
+          "publishedOn": "2022-05-06",
+          "articleTitle": "Fleet 4.14.0 adds beta support for automatic ticket creation and improves the live query experience.",
+          "articleImageUrl": "/images/articles/fleet-4.14.0-cover-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/releases/fleet-4.16.0",
+        "title": "Fleet 4.16.0",
+        "lastModifiedAt": 1726839805051,
+        "htmlId": "articles--fleet-4160--ac79cd8c59",
+        "sectionRelativeRepoPath": "fleet-4.16.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "Kathy Satterlee",
+          "authorGitHubUsername": "ksatter",
+          "publishedOn": "2022-06-16",
+          "articleTitle": "Fleet 4.16.0 | more customization, beefed up vuln management, Jira added to integrations.",
+          "articleImageUrl": "/images/articles/fleet-4.16.0-cover-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/releases/fleet-4.17.0",
+        "title": "Fleet 4.17.0",
+        "lastModifiedAt": 1726839805052,
+        "htmlId": "articles--fleet-4170--a276e12e2a",
+        "sectionRelativeRepoPath": "fleet-4.17.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "Kathy Satterlee",
+          "authorGitHubUsername": "ksatter",
+          "publishedOn": "2022-07-11",
+          "articleTitle": "Fleet 4.17.0 | Better osquery management, user engagement, improved host vitals.",
+          "articleImageUrl": "/images/articles/fleet-4.17.0-cover-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/releases/fleet-4.15.0",
+        "title": "Fleet 4.15.0",
+        "lastModifiedAt": 1726839805053,
+        "htmlId": "articles--fleet-4150--3865641c1c",
+        "sectionRelativeRepoPath": "fleet-4.15.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "Kathy Satterlee",
+          "authorGitHubUsername": "ksatter",
+          "publishedOn": "2022-05-30",
+          "articleTitle": "Fleet 4.15.0 adds beta support for Self-service, Scope transparency, and brings Zendesk to the party.",
+          "articleImageUrl": "/images/articles/fleet-4.15.0-cover-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/releases/fleet-4.18.0",
+        "title": "Fleet 4.18.0",
+        "lastModifiedAt": 1726839805054,
+        "htmlId": "articles--fleet-4180--9e4ce6c31b",
+        "sectionRelativeRepoPath": "fleet-4.18.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "Kathy Satterlee",
+          "authorGitHubUsername": "ksatter",
+          "publishedOn": "2022-08-03",
+          "articleTitle": "Fleet 4.18.0 | Better security and user messaging in Fleet Desktop",
+          "articleImageUrl": "/images/articles/fleet-4.18.0-cover-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/releases/fleet-4.19.0",
+        "title": "Fleet 4.19.0",
+        "lastModifiedAt": 1726839805055,
+        "htmlId": "articles--fleet-4190--450188c15f",
+        "sectionRelativeRepoPath": "fleet-4.19.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "Noah Talerman",
+          "authorGitHubUsername": "noahtalerman",
+          "publishedOn": "2022-08-22",
+          "articleTitle": "Fleet 4.19.0 | Just-in-time (JIT) user provisioning, remaining disk space, aggregate Windows and mobile device management (MDM) data",
+          "articleImageUrl": "/images/articles/fleet-4.19.0-cover-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/releases/fleet-4.2.0",
+        "title": "Fleet 4.2.0",
+        "lastModifiedAt": 1726839805055,
+        "htmlId": "articles--fleet-420--ead484f1f9",
+        "sectionRelativeRepoPath": "fleet-4.2.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "Noah Talerman",
+          "authorGitHubUsername": "noahtalerman",
+          "publishedOn": "2021-08-12",
+          "articleTitle": "Fleet 4.2.0",
+          "articleImageUrl": "/images/articles/fleet-4.2.0-cover-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/releases/fleet-4.20.0",
+        "title": "Fleet 4.20.0",
+        "lastModifiedAt": 1726839805057,
+        "htmlId": "articles--fleet-4200--3a3e9234b6",
+        "sectionRelativeRepoPath": "fleet-4.20.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "Noah Talerman",
+          "authorGitHubUsername": "noahtalerman",
+          "publishedOn": "2022-09-09",
+          "articleTitle": "Fleet 4.20.0 | Aggregate Munki issues, test features on canary teams, improved macOS vulnerability detection",
+          "articleImageUrl": "/images/articles/fleet-4.20.0-1600x900.jpg"
+        }
+      },
+      {
+        "url": "/releases/fleet-4.21.0",
+        "title": "Fleet 4.21.0",
+        "lastModifiedAt": 1726839805058,
+        "htmlId": "articles--fleet-4210--ef1f69ba72",
+        "sectionRelativeRepoPath": "fleet-4.21.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "Chris McGillicuddy",
+          "authorGitHubUsername": "chris-mcgillicuddy",
+          "publishedOn": "2022-10-05",
+          "articleTitle": "Fleet 4.21.0 | Validate config and teams YAML documents, manage osquery flags remotely with Orbit, view team and global policy compliance",
+          "articleImageUrl": "/images/articles/fleet-4.21.0-1600x900@2x.jpeg"
+        }
+      },
+      {
+        "url": "/releases/fleet-4.22.0",
+        "title": "Fleet 4.22.0",
+        "lastModifiedAt": 1726839805059,
+        "htmlId": "articles--fleet-4220--79ccc66c3c",
+        "sectionRelativeRepoPath": "fleet-4.22.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "Chris McGillicuddy",
+          "authorGitHubUsername": "chris-mcgillicuddy",
+          "publishedOn": "2022-10-21",
+          "articleTitle": "Fleet 4.22.0 | Easier access to host information, better query console UX, and clearer display names",
+          "articleImageUrl": "/images/articles/fleet-4.22.0-cover-800x450@2x.jpg"
+        }
+      },
+      {
+        "url": "/releases/fleet-4.23.0",
+        "title": "Fleet 4.23.0",
+        "lastModifiedAt": 1726839805060,
+        "htmlId": "articles--fleet-4230--653ee52499",
+        "sectionRelativeRepoPath": "fleet-4.23.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "Noah Talerman",
+          "authorGitHubUsername": "noahtalerman",
+          "publishedOn": "2022-11-14",
+          "articleTitle": "Fleet 4.23.0 | Better insight into inherited policies, improved host vitals, and more configuration visibility",
+          "articleImageUrl": "/images/articles/fleet-4.23.0-800x450@2x.jpg"
+        }
+      },
+      {
+        "url": "/releases/fleet-4.24.0",
+        "title": "Fleet 4.24.0",
+        "lastModifiedAt": 1726839805061,
+        "htmlId": "articles--fleet-4240--19516bb4b8",
+        "sectionRelativeRepoPath": "fleet-4.24.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "Noah Talerman",
+          "authorGitHubUsername": "noahtalerman",
+          "publishedOn": "2022-12-06",
+          "articleTitle": "Fleet 4.24.0 | Live query notifications and navigation improvements",
+          "articleImageUrl": "/images/articles/fleet-4.24.0-cover-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/releases/fleet-4.25.0",
+        "title": "Fleet 4.25.0",
+        "lastModifiedAt": 1726839805063,
+        "htmlId": "articles--fleet-4250--9127fac1f2",
+        "sectionRelativeRepoPath": "fleet-4.25.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "Noah Talerman",
+          "authorGitHubUsername": "noahtalerman",
+          "publishedOn": "2023-01-03",
+          "articleTitle": "Fleet 4.25.0 | Extra security and MDM visibility",
+          "articleImageUrl": "/images/articles/fleet-4.25.0-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/releases/fleet-4.26.0",
+        "title": "Fleet 4.26.0",
+        "lastModifiedAt": 1726839805064,
+        "htmlId": "articles--fleet-4260--3ecc26a58f",
+        "sectionRelativeRepoPath": "fleet-4.26.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "Noah Talerman",
+          "authorGitHubUsername": "noahtalerman",
+          "publishedOn": "2023-01-16",
+          "articleTitle": "Fleet 4.26.0 | Easier osquery extensions, external audit log destinations, and cleaner data lakes",
+          "articleImageUrl": "/images/articles/fleet-4.26.0-1600x900@2x.png"
+        }
+      },
+      {
+        "url": "/releases/fleet-4.27.0",
+        "title": "Fleet 4.27.0",
+        "lastModifiedAt": 1726839805065,
+        "htmlId": "articles--fleet-4270--5def591f64",
+        "sectionRelativeRepoPath": "fleet-4.27.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "Noah Talerman",
+          "authorGitHubUsername": "noahtalerman",
+          "publishedOn": "2023-02-14",
+          "articleTitle": "Fleet 4.27.0 | Improved access management and improved search filters",
+          "articleImageUrl": "/images/articles/fleet-4.27.0-1600x900@2x.png"
+        }
+      },
+      {
+        "url": "/releases/fleet-4.28.0",
+        "title": "Fleet 4.28.0",
+        "lastModifiedAt": 1726839805066,
+        "htmlId": "articles--fleet-4280--52f2441fa4",
+        "sectionRelativeRepoPath": "fleet-4.28.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "JD Strong",
+          "authorGitHubUsername": "spokanemac",
+          "publishedOn": "2023-02-28",
+          "articleTitle": "Fleet 4.28.0 | CIS benchmarks for Ventura",
+          "articleImageUrl": "/images/articles/fleet-4.28.0-800x450@2x.png"
+        }
+      },
+      {
+        "url": "/releases/fleet-4.29.0",
+        "title": "Fleet 4.29.0",
+        "lastModifiedAt": 1726839805067,
+        "htmlId": "articles--fleet-4290--507fc72ef3",
+        "sectionRelativeRepoPath": "fleet-4.29.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "JD Strong",
+          "authorGitHubUsername": "spokanemac",
+          "publishedOn": "2023-03-22",
+          "articleTitle": "Fleet 4.29.0 | SSO provides JIT Fleet user roles",
+          "articleImageUrl": "/images/articles/fleet-4.29.0-1600x900@2x.png"
+        }
+      },
+      {
+        "url": "/releases/fleet-4.3.0",
+        "title": "Fleet 4.3.0",
+        "lastModifiedAt": 1726839805068,
+        "htmlId": "articles--fleet-430--f231d44352",
+        "sectionRelativeRepoPath": "fleet-4.3.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "Mike Thomas",
+          "authorGitHubUsername": "mike-j-thomas",
+          "publishedOn": "2021-09-07",
+          "articleTitle": "Fleet 4.3.0",
+          "articleImageUrl": "/images/articles/fleet-4.3.0-cover-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/releases/fleet-4.30.0",
+        "title": "Fleet 4.30.0",
+        "lastModifiedAt": 1726839805069,
+        "htmlId": "articles--fleet-4300--0e053dac25",
+        "sectionRelativeRepoPath": "fleet-4.30.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "JD Strong",
+          "authorGitHubUsername": "spokanemac",
+          "publishedOn": "2023-04-11",
+          "articleTitle": "Fleet 4.30.0 | MDM public beta, Observer+ role, Vulnerability publication dates",
+          "articleImageUrl": "/images/articles/fleet-4.30.0-1600x900@2x.png"
+        }
+      },
+      {
+        "url": "/releases/fleet-4.31.0",
+        "title": "Fleet 4.31.0",
+        "lastModifiedAt": 1726839805071,
+        "htmlId": "articles--fleet-4310--439ea795b4",
+        "sectionRelativeRepoPath": "fleet-4.31.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "JD Strong",
+          "authorGitHubUsername": "spokanemac",
+          "publishedOn": "2023-05-01",
+          "articleTitle": "Fleet 4.31.0 | MDM enrollment workflow, API user role.",
+          "articleImageUrl": "/images/articles/fleet-4.31.0-1600x900@2x.png"
+        }
+      },
+      {
+        "url": "/releases/fleet-4.32.0",
+        "title": "Fleet 4.32.0",
+        "lastModifiedAt": 1726839805073,
+        "htmlId": "articles--fleet-4320--221d90689c",
+        "sectionRelativeRepoPath": "fleet-4.32.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "JD Strong",
+          "authorGitHubUsername": "spokanemac",
+          "publishedOn": "2023-05-24",
+          "articleTitle": "Fleet 4.32.0 | User migration, customizing macOS Setup Assistant.",
+          "articleImageUrl": "/images/articles/fleet-4.32.0-1600x900@2x.png"
+        }
+      },
+      {
+        "url": "/releases/fleet-4.33.0",
+        "title": "Fleet 4.33.0",
+        "lastModifiedAt": 1726839805074,
+        "htmlId": "articles--fleet-4330--3b965c130a",
+        "sectionRelativeRepoPath": "fleet-4.33.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "JD Strong",
+          "authorGitHubUsername": "spokanemac",
+          "publishedOn": "2023-06-13",
+          "articleTitle": "Fleet 4.33.0 | ChromeOS support, new verified status",
+          "articleImageUrl": "/images/articles/fleet-4.33.0-1600x900@2x.png"
+        }
+      },
+      {
+        "url": "/releases/fleet-4.34.0",
+        "title": "Fleet 4.34.0",
+        "lastModifiedAt": 1726839805075,
+        "htmlId": "articles--fleet-4340--aab74d16d2",
+        "sectionRelativeRepoPath": "fleet-4.34.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "JD Strong",
+          "authorGitHubUsername": "spokanemac",
+          "publishedOn": "2023-07-12",
+          "articleTitle": "Fleet 4.34.0 | ChromeOS tables, CIS Benchmark load testing",
+          "articleImageUrl": "/images/articles/fleet-4.34.0-1600x900@2x.png"
+        }
+      },
+      {
+        "url": "/releases/fleet-4.35.0",
+        "title": "Fleet 4.35.0",
+        "lastModifiedAt": 1726839805076,
+        "htmlId": "articles--fleet-4350--d4921e1140",
+        "sectionRelativeRepoPath": "fleet-4.35.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "JD Strong",
+          "authorGitHubUsername": "spokanemac",
+          "publishedOn": "2023-08-01",
+          "articleTitle": "Fleet 4.35.0 | Improvements and bug fixes.",
+          "articleImageUrl": "/images/articles/fleet-4.35.0-1600x900@2x.png"
+        }
+      },
+      {
+        "url": "/releases/fleet-4.37.0",
+        "title": "Fleet 4.37.0",
+        "lastModifiedAt": 1726839805077,
+        "htmlId": "articles--fleet-4370--56524e6b70",
+        "sectionRelativeRepoPath": "fleet-4.37.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "JD Strong",
+          "authorGitHubUsername": "spokanemac",
+          "publishedOn": "2023-09-07",
+          "articleTitle": "Fleet 4.37.0 | Remote script execution & Puppet support.",
+          "articleImageUrl": "/images/articles/fleet-4.37.0-1600x900@2x.png"
+        }
+      },
+      {
+        "url": "/releases/fleet-4.36.0",
+        "title": "Fleet 4.36.0",
+        "lastModifiedAt": 1726839805078,
+        "htmlId": "articles--fleet-4360--0167b9704b",
+        "sectionRelativeRepoPath": "fleet-4.36.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "JD Strong",
+          "authorGitHubUsername": "spokanemac",
+          "publishedOn": "2023-08-18",
+          "articleTitle": "Fleet 4.36.0 | Saved and scheduled queries merge.",
+          "articleImageUrl": "/images/articles/fleet-4.36.0-1600x900@2x.png"
+        }
+      },
+      {
+        "url": "/releases/fleet-4.38.0",
+        "title": "Fleet 4.38.0",
+        "lastModifiedAt": 1726839805080,
+        "htmlId": "articles--fleet-4380--8522df1a2e",
+        "sectionRelativeRepoPath": "fleet-4.38.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "JD Strong",
+          "authorGitHubUsername": "spokanemac",
+          "publishedOn": "2023-09-25",
+          "articleTitle": "Fleet 4.38.0 | Profile redelivery, NVD details, and custom extension label support.",
+          "articleImageUrl": "/images/articles/fleet-4.38.0-1600x900@2x.png"
+        }
+      },
+      {
+        "url": "/releases/fleet-4.39.0",
+        "title": "Fleet 4.39.0",
+        "lastModifiedAt": 1726839805081,
+        "htmlId": "articles--fleet-4390--ad9a535d1c",
+        "sectionRelativeRepoPath": "fleet-4.39.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "JD Strong",
+          "authorGitHubUsername": "spokanemac",
+          "publishedOn": "2023-10-26",
+          "articleTitle": "Fleet 4.39.0 | Sonoma support, script library, query reports.",
+          "articleImageUrl": "/images/articles/fleet-4.39.0-1600x900@2x.png"
+        }
+      },
+      {
+        "url": "/releases/fleet-4.4.0",
+        "title": "Fleet 4.4.0",
+        "lastModifiedAt": 1726839805082,
+        "htmlId": "articles--fleet-440--24061a1eff",
+        "sectionRelativeRepoPath": "fleet-4.4.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "Mike Thomas",
+          "authorGitHubUsername": "mike-j-thomas",
+          "publishedOn": "2021-10-07",
+          "articleTitle": "Fleet 4.4.0 releases aggregated software inventory, team policies, and improved team scheduling",
+          "articleImageUrl": "/images/articles/fleet-4.4.0-cover-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/releases/fleet-4.40.0",
+        "title": "Fleet 4.40.0",
+        "lastModifiedAt": 1726839805083,
+        "htmlId": "articles--fleet-4400--53f1a0954b",
+        "sectionRelativeRepoPath": "fleet-4.40.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "JD Strong",
+          "authorGitHubUsername": "spokanemac",
+          "publishedOn": "2023-11-06",
+          "articleTitle": "Fleet 4.40.0 | More Data, Rapid Security Response, CIS Benchmark updates.",
+          "articleImageUrl": "/images/articles/fleet-4.40.0-1600x900@2x.png"
+        }
+      },
+      {
+        "url": "/releases/fleet-4.41.0",
+        "title": "Fleet 4.41.0",
+        "lastModifiedAt": 1726839805084,
+        "htmlId": "articles--fleet-4410--f4c37d963b",
+        "sectionRelativeRepoPath": "fleet-4.41.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "JD Strong",
+          "authorGitHubUsername": "spokanemac",
+          "publishedOn": "2023-11-28",
+          "articleTitle": "Fleet 4.41.0 | NVD API 2.0, Windows script library.",
+          "articleImageUrl": "/images/articles/fleet-4.41.0-1600x900@2x.png"
+        }
+      },
+      {
+        "url": "/releases/fleet-4.42.0",
+        "title": "Fleet 4.42.0",
+        "lastModifiedAt": 1726839805086,
+        "htmlId": "articles--fleet-4420--8d6641fa28",
+        "sectionRelativeRepoPath": "fleet-4.42.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "JD Strong",
+          "authorGitHubUsername": "spokanemac",
+          "publishedOn": "2023-12-21",
+          "articleTitle": "Fleet 4.42.0 | Query performance reporting, host targeting improvements.",
+          "articleImageUrl": "/images/articles/fleet-4.42.0-1600x900@2x.png"
+        }
+      },
+      {
+        "url": "/releases/fleet-4.43.0",
+        "title": "Fleet 4.43.0",
+        "lastModifiedAt": 1726839805087,
+        "htmlId": "articles--fleet-4430--296526b139",
+        "sectionRelativeRepoPath": "fleet-4.43.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "JD Strong",
+          "authorGitHubUsername": "spokanemac",
+          "publishedOn": "2024-01-09",
+          "articleTitle": "Fleet 4.43.0 | Query performance reporting, host targeting improvements.",
+          "articleImageUrl": "/images/articles/fleet-4.43.0-1600x900@2x.png"
+        }
+      },
+      {
+        "url": "/releases/fleet-4.44.0",
+        "title": "Fleet 4.44.0",
+        "lastModifiedAt": 1726839805089,
+        "htmlId": "articles--fleet-4440--e0c9504248",
+        "sectionRelativeRepoPath": "fleet-4.44.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "JD Strong",
+          "authorGitHubUsername": "spokanemac",
+          "publishedOn": "2024-02-05",
+          "articleTitle": "Fleet 4.44.0 | Script execution, host expiry, and host targeting improvements.",
+          "articleImageUrl": "/images/articles/fleet-4.44.0-1600x900@2x.png"
+        }
+      },
+      {
+        "url": "/releases/fleet-4.45.0",
+        "title": "Fleet 4.45.0",
+        "lastModifiedAt": 1726839805090,
+        "htmlId": "articles--fleet-4450--525bed4841",
+        "sectionRelativeRepoPath": "fleet-4.45.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "JD Strong",
+          "authorGitHubUsername": "spokanemac",
+          "publishedOn": "2024-02-21",
+          "articleTitle": "Fleet 4.45.0 | Remote lock, Linux script library, osquery storage location.",
+          "articleImageUrl": "/images/articles/fleet-4.45.0-1600x900@2x.png"
+        }
+      },
+      {
+        "url": "/releases/fleet-4.46.0",
+        "title": "Fleet 4.46.0",
+        "lastModifiedAt": 1726839805091,
+        "htmlId": "articles--fleet-4460--2bc79fbeb9",
+        "sectionRelativeRepoPath": "fleet-4.46.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "JD Strong",
+          "authorGitHubUsername": "spokanemac",
+          "publishedOn": "2024-02-26",
+          "articleTitle": "Fleet 4.46.0 | Automatic SCEP certificate renewal.",
+          "articleImageUrl": "/images/articles/fleet-4.46.0-1600x900@2x.png"
+        }
+      },
+      {
+        "url": "/releases/fleet-4.47.0",
+        "title": "Fleet 4.47.0",
+        "lastModifiedAt": 1726839805092,
+        "htmlId": "articles--fleet-4470--d61e2e7199",
+        "sectionRelativeRepoPath": "fleet-4.47.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "JD Strong",
+          "authorGitHubUsername": "spokanemac",
+          "publishedOn": "2024-03-12",
+          "articleTitle": "Fleet 4.47.0 | Cross-platform remote wipe, vulnerabilities page, and scripting improvements.",
+          "articleImageUrl": "/images/articles/fleet-4.47.0-1600x900@2x.png"
+        }
+      },
+      {
+        "url": "/releases/fleet-4.48.0",
+        "title": "Fleet 4.48.0",
+        "lastModifiedAt": 1726839805094,
+        "htmlId": "articles--fleet-4480--ecbe7beab5",
+        "sectionRelativeRepoPath": "fleet-4.48.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "JD Strong",
+          "authorGitHubUsername": "spokanemac",
+          "publishedOn": "2024-04-03",
+          "articleTitle": "Fleet 4.48.0 | IdP local account creation, VS Code extensions.",
+          "articleImageUrl": "/images/articles/fleet-4.48.0-1600x900@2x.png"
+        }
+      },
+      {
+        "url": "/releases/fleet-4.49.0",
+        "title": "Fleet 4.49.0",
+        "lastModifiedAt": 1726839805095,
+        "htmlId": "articles--fleet-4490--c90f5fc656",
+        "sectionRelativeRepoPath": "fleet-4.49.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "JD Strong",
+          "authorGitHubUsername": "spokanemac",
+          "publishedOn": "2024-04-23",
+          "articleTitle": "Fleet 4.49.0 | VulnCheck's NVD++, device health API, fleetd data parsing.",
+          "articleImageUrl": "/images/articles/fleet-4.49.0-1600x900@2x.png"
+        }
+      },
+      {
+        "url": "/releases/fleet-4.5.0",
+        "title": "Fleet 4.5.0",
+        "lastModifiedAt": 1726839805096,
+        "htmlId": "articles--fleet-450--2c474c8040",
+        "sectionRelativeRepoPath": "fleet-4.5.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "Mike Thomas",
+          "authorGitHubUsername": "mike-j-thomas",
+          "publishedOn": "2021-11-02",
+          "articleTitle": "Fleet 4.5.0 with new team admin role, live OS compatibility checking, query performance impact, and a new-look dashboard",
+          "articleImageUrl": "/images/articles/fleet-4.5.0-cover-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/releases/fleet-4.50.0",
+        "title": "Fleet 4.50.0",
+        "lastModifiedAt": 1726839805098,
+        "htmlId": "articles--fleet-4500--44757c8700",
+        "sectionRelativeRepoPath": "fleet-4.50.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "JD Strong",
+          "authorGitHubUsername": "spokanemac",
+          "publishedOn": "2024-05-22",
+          "articleTitle": "Fleet 4.50.0 | Security agent deployment, AI descriptions, and Mac Admins SOFA support.",
+          "articleImageUrl": "/images/articles/fleet-4.50.0-1600x900@2x.png"
+        }
+      },
+      {
+        "url": "/releases/fleet-4.53.0",
+        "title": "Fleet 4.53.0",
+        "lastModifiedAt": 1726839805100,
+        "htmlId": "articles--fleet-4530--1cc540fb24",
+        "sectionRelativeRepoPath": "fleet-4.53.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "JD Strong",
+          "authorGitHubUsername": "spokanemac",
+          "publishedOn": "2024-06-25",
+          "articleTitle": "Fleet 4.53.0 | Better vuln matching, multi-issue hosts, & `fleetd` logs as tables",
+          "articleImageUrl": "/images/articles/fleet-4.53.0-1600x900@2x.png"
+        }
+      },
+      {
+        "url": "/releases/fleet-4.54.0",
+        "title": "Fleet 4.54.0",
+        "lastModifiedAt": 1726839805101,
+        "htmlId": "articles--fleet-4540--11b1c848f2",
+        "sectionRelativeRepoPath": "fleet-4.54.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "JD Strong",
+          "authorGitHubUsername": "spokanemac",
+          "publishedOn": "2024-07-17",
+          "articleTitle": "Fleet 4.54.0 | Target hosts via label exclusion, script execution time.",
+          "articleImageUrl": "/images/articles/fleet-4.54.0-1600x900@2x.png"
+        }
+      },
+      {
+        "url": "/releases/fleet-4.51.0",
+        "title": "Fleet 4.51.0",
+        "lastModifiedAt": 1726839805102,
+        "htmlId": "articles--fleet-4510--7274f6fa9d",
+        "sectionRelativeRepoPath": "fleet-4.51.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "JD Strong",
+          "authorGitHubUsername": "spokanemac",
+          "publishedOn": "2024-06-10",
+          "articleTitle": "Fleet 4.51.0 | Global activity webhook, macOS TCC table, and software self-service.",
+          "articleImageUrl": "/images/articles/fleet-4.51.0-1600x900@2x.png"
+        }
+      },
+      {
+        "url": "/releases/fleet-4.55.0",
+        "title": "Fleet 4.55.0",
+        "lastModifiedAt": 1726839805106,
+        "htmlId": "articles--fleet-4550--f7134a8007",
+        "sectionRelativeRepoPath": "fleet-4.55.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "JD Strong",
+          "authorGitHubUsername": "spokanemac",
+          "publishedOn": "2024-08-09",
+          "articleTitle": "Fleet 4.55.0 | MySQL 8, arm64 support, FileVault improvements, VPP support.",
+          "articleImageUrl": "/images/articles/fleet-4.55.0-1600x900@2x.png"
+        }
+      },
+      {
+        "url": "/releases/fleet-4.56.0",
+        "title": "Fleet 4.56.0",
+        "lastModifiedAt": 1726839805108,
+        "htmlId": "articles--fleet-4560--6f2f9c6451",
+        "sectionRelativeRepoPath": "fleet-4.56.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "JD Strong",
+          "authorGitHubUsername": "spokanemac",
+          "publishedOn": "2024-09-07",
+          "articleTitle": "Fleet 4.56.0 | Enhanced MDM migration, Exact CVE Search, and Self-Service VPP Apps.",
+          "articleImageUrl": "/images/articles/fleet-4.56.0-1600x900@2x.png"
+        }
+      },
+      {
+        "url": "/releases/fleet-4.6.0",
+        "title": "Fleet 4.6.0",
+        "lastModifiedAt": 1726839805109,
+        "htmlId": "articles--fleet-460--d71c3386e5",
+        "sectionRelativeRepoPath": "fleet-4.6.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "Mike Thomas",
+          "authorGitHubUsername": "mike-j-thomas",
+          "publishedOn": "2021-11-19",
+          "articleTitle": "Fleet 4.6.0 with osquery installer, enroll secret management, and improved host vitals",
+          "articleImageUrl": "/images/articles/fleet-4.6.0-cover-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/releases/fleet-4.7.0",
+        "title": "Fleet 4.7.0",
+        "lastModifiedAt": 1726839805110,
+        "htmlId": "articles--fleet-470--f6d85e866c",
+        "sectionRelativeRepoPath": "fleet-4.7.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "Mike Thomas",
+          "authorGitHubUsername": "mike-j-thomas",
+          "publishedOn": "2021-12-14",
+          "articleTitle": "Does Fleet 4.7.0 bring more power to your osquery compliance policies? Yes.",
+          "articleImageUrl": "/images/articles/fleet-4.7.0-cover-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/releases/fleet-4.8.0",
+        "title": "Fleet 4.8.0",
+        "lastModifiedAt": 1726839805111,
+        "htmlId": "articles--fleet-480--e0296e324b",
+        "sectionRelativeRepoPath": "fleet-4.8.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "Drew Baker",
+          "authorGitHubUsername": "Drew-P-drawers",
+          "publishedOn": "2021-12-31",
+          "articleTitle": "Looking for policy automations, Google Chrome profile search, and Munki details from your hosts? Upgrade to Fleet 4.8.0",
+          "articleImageUrl": "/images/articles/fleet-4.8.0-cover-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/releases/fleet-4.9.0",
+        "title": "Fleet 4.9.0",
+        "lastModifiedAt": 1726839805112,
+        "htmlId": "articles--fleet-490--d6149315ff",
+        "sectionRelativeRepoPath": "fleet-4.9.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "Mike Thomas",
+          "authorGitHubUsername": "mike-j-thomas",
+          "publishedOn": "2022-01-24",
+          "articleTitle": "Fleet 4.9.0 brings performance updates, paginated live query results, and policy YAML doc support.",
+          "articleImageUrl": "/images/articles/fleet-4.9.0-cover-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/guides/fleet-ai-assisted-policy-descriptions-and-resolutions",
+        "title": "Fleet ai assisted policy descriptions and resolutions",
+        "lastModifiedAt": 1726839805113,
+        "htmlId": "articles--fleet-ai-assisted-po--74a94535fe",
+        "sectionRelativeRepoPath": "fleet-ai-assisted-policy-descriptions-and-resolutions.md",
+        "meta": {
+          "articleTitle": "Fleet’s AI-assisted policy descriptions and resolutions",
+          "authorFullName": "Rachel Perkins",
+          "authorGitHubUsername": "rachelelysia",
+          "category": "guides",
+          "publishedOn": "2024-05-20",
+          "articleImageUrl": "/images/articles/fleet-ai-assisted-policy-descriptions-and-resolutions-1600x900@2x.png",
+          "description": "AI guides our way, Policies clear, secure paths, Compliance shines bright."
+        }
+      },
+      {
+        "url": "/announcements/fleet-adds-support-for-chrome-os",
+        "title": "Fleet adds support for chrome os",
+        "lastModifiedAt": 1726839805114,
+        "htmlId": "articles--fleet-adds-support-f--e846968e31",
+        "sectionRelativeRepoPath": "fleet-adds-support-for-chrome-os.md",
+        "meta": {
+          "category": "announcements",
+          "authorGitHubUsername": "spokanemac",
+          "authorFullName": "JD Strong",
+          "publishedOn": "2023-06-13",
+          "articleTitle": "Fleet enhances device management with ChromeOS support",
+          "articleImageUrl": "/images/articles/fleet-adds-support-for-chrome-os-1600x900@2x.png",
+          "description": "We're thrilled to announce that Fleet has expanded support to include ChromeOS and ChromeOS Flex!"
+        }
+      },
+      {
+        "url": "/announcements/fleet-desktop-says-hello-world",
+        "title": "Fleet desktop says hello world",
+        "lastModifiedAt": 1726839805115,
+        "htmlId": "articles--fleet-desktop-says-h--b773918322",
+        "sectionRelativeRepoPath": "fleet-desktop-says-hello-world.md",
+        "meta": {
+          "category": "announcements",
+          "authorGitHubUsername": "zhumo",
+          "authorFullName": "Mo Zhu",
+          "publishedOn": "2022-08-02",
+          "articleTitle": "Fleet Desktop says “Hello, world!”",
+          "articleImageUrl": "/images/articles/fleet-desktop-says-hello-world-cover-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/guides/fleet-desktop",
+        "title": "Fleet desktop",
+        "lastModifiedAt": 1726839805116,
+        "htmlId": "articles--fleet-desktop--9214a6a67a",
+        "sectionRelativeRepoPath": "fleet-desktop.md",
+        "meta": {
+          "category": "guides",
+          "authorGitHubUsername": "zhumo",
+          "authorFullName": "Mo Zhu",
+          "publishedOn": "2024-04-19",
+          "articleTitle": "Fleet Desktop",
+          "description": "Learn about Fleet Desktop's features for self-remediation and transparency."
+        }
+      },
+      {
+        "url": "/announcements/fleet-in-vegas-2023",
+        "title": "Fleet in vegas 2023",
+        "lastModifiedAt": 1726839805117,
+        "htmlId": "articles--fleet-in-vegas-2023--284818a7ab",
+        "sectionRelativeRepoPath": "fleet-in-vegas-2023.md",
+        "meta": {
+          "category": "announcements",
+          "authorGitHubUsername": "spokanemac",
+          "authorFullName": "JD Strong",
+          "publishedOn": "2023-08-02",
+          "articleTitle": "Fleet takes on Vegas: Exploring cybersecurity's future at Black Hat, B-Sides, and DEF CON 31",
+          "articleImageUrl": "/images/articles/fleet-in-vegas-2023@2x.jpg",
+          "description": "Explore cybersecurity's cutting edge with Fleet at three top-tier conferences - Black Hat, Security B-Sides, and DEF CON."
+        }
+      },
+      {
+        "url": "/releases/fleet-introduces-mdm",
+        "title": "Fleet introduces mdm",
+        "lastModifiedAt": 1726839805118,
+        "htmlId": "articles--fleet-introduces-mdm--e7ec825f3a",
+        "sectionRelativeRepoPath": "fleet-introduces-mdm.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "JD Strong",
+          "authorGitHubUsername": "spokanemac",
+          "publishedOn": "2023-04-11",
+          "articleTitle": "Fleet introduces MDM",
+          "articleImageUrl": "/images/articles/fleet-mdm-launch-cover-800x450@2x.jpg"
+        }
+      },
+      {
+        "url": "/announcements/fleet-in-your-calendar-introducing-maintenance-windows",
+        "title": "Fleet in your calendar introducing maintenance windows",
+        "lastModifiedAt": 1726839805119,
+        "htmlId": "articles--fleet-in-your-calend--35d205d395",
+        "sectionRelativeRepoPath": "fleet-in-your-calendar-introducing-maintenance-windows.md",
+        "meta": {
+          "category": "announcements",
+          "authorFullName": "JD Strong",
+          "authorGitHubUsername": "spokanemac",
+          "publishedOn": "2024-04-30",
+          "articleTitle": "Fleet in your calendar: introducing maintenance windows",
+          "articleImageUrl": "/images/articles/fleet-in-your-calendar-introducing-maintenance-windows-cover-900x450@2x.png",
+          "description": "Like any good colleague, when Fleet needs some of your time, it puts it on your calendar."
+        }
+      },
+      {
+        "url": "/announcements/fleet-introduces-windows-mdm",
+        "title": "Fleet introduces windows mdm",
+        "lastModifiedAt": 1726839805120,
+        "htmlId": "articles--fleet-introduces-win--c7cafc9ba6",
+        "sectionRelativeRepoPath": "fleet-introduces-windows-mdm.md",
+        "meta": {
+          "category": "announcements",
+          "authorFullName": "JD Strong",
+          "authorGitHubUsername": "spokanemac",
+          "publishedOn": "2024-01-24",
+          "articleTitle": "Fleet introduces Windows MDM",
+          "articleImageUrl": "/images/articles/fleet-win-mdm-launch-cover-800x450@2x.png"
+        }
+      },
+      {
+        "url": "/announcements/fleet-is-abuzz-for-macdevops-yvr-2023",
+        "title": "Fleet is abuzz for macdevops yvr 2023",
+        "lastModifiedAt": 1726839805121,
+        "htmlId": "articles--fleet-is-abuzz-for-m--ad5da5f6fb",
+        "sectionRelativeRepoPath": "fleet-is-abuzz-for-macdevops-yvr-2023.md",
+        "meta": {
+          "category": "announcements",
+          "authorGitHubUsername": "spokanemac",
+          "authorFullName": "JD Strong",
+          "publishedOn": "2023-06-07",
+          "articleTitle": "Fleet is abuzz 🐝 for MacDevOps:YVR",
+          "articleImageUrl": "/images/articles/fleet-is-abuzz-for-macdevops-yvr-2023@2x.png",
+          "description": "Fleet is a proud sponsor of MacDevOps:YVR which is back in person in Vancouver, B.C. June 21-22, 2023"
+        }
+      },
+      {
+        "url": "/securing/fleet-osquery-unlocking-the-value-of-axonius-with-open-source-telemetry",
+        "title": "Fleet osquery unlocking the value of axonius with open source telemetry",
+        "lastModifiedAt": 1726839805122,
+        "htmlId": "articles--fleet-osquery-unlock--3d8a42de76",
+        "sectionRelativeRepoPath": "fleet-osquery-unlocking-the-value-of-axonius-with-open-source-telemetry.md",
+        "meta": {
+          "category": "security",
+          "authorFullName": "Brad Macdowall",
+          "authorGitHubUsername": "BradMacd",
+          "publishedOn": "2023-12-28",
+          "articleTitle": "Fleet & osquery: Unlocking the value of Axonius with open-source telemetry",
+          "articleImageUrl": "/images/articles/fleet-osquery-unlocking-the-value-of-axonius-with-open-source-telemetry-1600x900@2x.png"
+        }
+      },
+      {
+        "url": "/guides/fleet-quick-tips-querying-procdump-eula-has-been-accepted",
+        "title": "Fleet quick tips querying procdump eula has been accepted",
+        "lastModifiedAt": 1726839805123,
+        "htmlId": "articles--fleet-quick-tips-que--083c7ab95c",
+        "sectionRelativeRepoPath": "fleet-quick-tips-querying-procdump-eula-has-been-accepted.md",
+        "meta": {
+          "category": "guides",
+          "authorGitHubUsername": "mike-j-thomas",
+          "authorFullName": "Mike Thomas",
+          "publishedOn": "2021-05-11",
+          "articleTitle": "Fleet quick tips — identify systems where the ProcDump EULA has been accepted",
+          "articleImageUrl": "/images/articles/fleet-quick-tips-querying-procdump-eula-has-been-accepted-cover-700x440@2x.png"
+        }
+      },
+      {
+        "url": "/guides/fleet-terraform-byo-vpc-module",
+        "title": "Fleet terraform byo vpc module",
+        "lastModifiedAt": 1726839805124,
+        "htmlId": "articles--fleet-terraform-byo---dc914e6434",
+        "sectionRelativeRepoPath": "fleet-terraform-byo-vpc-module.md",
+        "meta": {
+          "category": "guides",
+          "authorFullName": "Robert Fairburn",
+          "authorGitHubUsername": "rfairburn",
+          "publishedOn": "2023-09-01",
+          "articleTitle": "Using the Fleet Terraform module with an existing VPC"
+        }
+      },
+      {
+        "url": "/announcements/fleet-terraform-module",
+        "title": "Fleet terraform module",
+        "lastModifiedAt": 1726839805125,
+        "htmlId": "articles--fleet-terraform-modu--290ad35faf",
+        "sectionRelativeRepoPath": "fleet-terraform-module.md",
+        "meta": {
+          "category": "announcements",
+          "authorFullName": "Zachary Winnerman",
+          "authorGitHubUsername": "zwinnerman-fleetdm",
+          "publishedOn": "2023-01-09",
+          "articleTitle": "Keep Fleet running smoothly on AWS with the new Terraform module"
+        }
+      },
+      {
+        "url": "/guides/fleet-usage-statistics",
+        "title": "Fleet usage statistics",
+        "lastModifiedAt": 1726839805126,
+        "htmlId": "articles--fleet-usage-statisti--8212e2baf7",
+        "sectionRelativeRepoPath": "fleet-usage-statistics.md",
+        "meta": {
+          "category": "guides",
+          "authorGitHubUsername": "noahtalerman",
+          "authorFullName": "Noah Talerman",
+          "publishedOn": "2024-08-13",
+          "articleTitle": "Fleet usage statistics",
+          "description": "Learn about Fleet's usage statistics and what information is collected."
+        }
+      },
+      {
+        "url": "/success-stories/fleet-user-stories-f100",
+        "title": "Fleet user stories f100",
+        "lastModifiedAt": 1726839805127,
+        "htmlId": "articles--fleet-user-stories-f--869652e2be",
+        "sectionRelativeRepoPath": "fleet-user-stories-f100.md",
+        "meta": {
+          "category": "success stories",
+          "authorGitHubUsername": "mike-j-thomas",
+          "authorFullName": "Mike Thomas",
+          "publishedOn": "2021-09-29",
+          "articleTitle": "Fleet user stories — F100",
+          "articleImageUrl": "/images/articles/fleet-user-stories-f100-cover-800x450@2x.png"
+        }
+      },
+      {
+        "url": "/success-stories/fleet-user-stories-schrodinger",
+        "title": "Fleet user stories schrodinger",
+        "lastModifiedAt": 1726839805127,
+        "htmlId": "articles--fleet-user-stories-s--1486ea1812",
+        "sectionRelativeRepoPath": "fleet-user-stories-schrodinger.md",
+        "meta": {
+          "category": "success stories",
+          "authorGitHubUsername": "mike-j-thomas",
+          "authorFullName": "Mike Thomas",
+          "publishedOn": "2021-09-10",
+          "articleTitle": "Fleet user stories — Schrödinger",
+          "articleImageUrl": "/images/articles/fleet-user-stories-schrodinger-cover-800x450@2x.png"
+        }
+      },
+      {
+        "url": "/success-stories/fleet-user-stories-wayfair",
+        "title": "Fleet user stories wayfair",
+        "lastModifiedAt": 1726839805128,
+        "htmlId": "articles--fleet-user-stories-w--c78d4fa6b9",
+        "sectionRelativeRepoPath": "fleet-user-stories-wayfair.md",
+        "meta": {
+          "category": "success stories",
+          "authorGitHubUsername": "mike-j-thomas",
+          "authorFullName": "Mike Thomas",
+          "publishedOn": "2021-08-20",
+          "articleTitle": "Fleet user stories — Wayfair",
+          "articleImageUrl": "/images/articles/fleet-user-stories-wayfair-cover-800x450@2x.png"
+        }
+      },
+      {
+        "url": "/guides/fleetctl",
+        "title": "Fleetctl",
+        "lastModifiedAt": 1726839805129,
+        "htmlId": "articles--fleetctl--0cb8193ba2",
+        "sectionRelativeRepoPath": "fleetctl.md",
+        "meta": {
+          "category": "guides",
+          "authorGitHubUsername": "noahtalerman",
+          "authorFullName": "Noah Talerman",
+          "publishedOn": "2024-07-04",
+          "articleTitle": "fleetctl",
+          "description": "Read about fleetctl, a CLI tool for managing Fleet and osquery configurations, running queries, generating Fleet's agent (fleetd) and more."
+        }
+      },
+      {
+        "url": "/announcements/from-osquery-to-fleet-planting-the-seed",
+        "title": "From osquery to Fleet planting the seed",
+        "lastModifiedAt": 1726839805130,
+        "htmlId": "articles--from-osquery-to-flee--229a9b9742",
+        "sectionRelativeRepoPath": "from-osquery-to-fleet-planting-the-seed.md",
+        "meta": {
+          "category": "announcements",
+          "authorGitHubUsername": "zwass",
+          "authorFullName": "Zach Wasserman",
+          "publishedOn": "2022-01-20",
+          "articleTitle": "The next step for Fleet: our $5M seed round 🌱",
+          "articleImageUrl": "/images/articles/from-osquery-to-fleet-planting-the-seed-cover-800x450@2x.png"
+        }
+      },
+      {
+        "url": "/guides/fleetd-updates",
+        "title": "Fleetd updates",
+        "lastModifiedAt": 1726839805131,
+        "htmlId": "articles--fleetd-updates--6d4aebafec",
+        "sectionRelativeRepoPath": "fleetd-updates.md",
+        "meta": {
+          "category": "guides",
+          "authorGitHubUsername": "noahtalerman",
+          "authorFullName": "Noah Talerman",
+          "publishedOn": "2024-04-30",
+          "articleTitle": "Fleetd updates",
+          "description": "Information on how to manage and secure Fleet agent updates."
+        }
+      },
+      {
+        "url": "/guides/generate-process-trees-with-osquery",
+        "title": "Generate process trees with osquery",
+        "lastModifiedAt": 1726839805132,
+        "htmlId": "articles--generate-process-tre--d1b0edcce1",
+        "sectionRelativeRepoPath": "generate-process-trees-with-osquery.md",
+        "meta": {
+          "category": "guides",
+          "authorGitHubUsername": "zwass",
+          "authorFullName": "Zach Wasserman",
+          "publishedOn": "2020-03-17",
+          "articleTitle": "Generate process trees with osquery",
+          "articleImageUrl": "/images/articles/generate-process-trees-with-osquery-cover-700x393@2x.jpeg"
+        }
+      },
+      {
+        "url": "/securing/get-and-stay-compliant-across-your-devices-with-fleet",
+        "title": "Get and stay compliant across your devices with Fleet",
+        "lastModifiedAt": 1726839805133,
+        "htmlId": "articles--get-and-stay-complia--2cb805730d",
+        "sectionRelativeRepoPath": "get-and-stay-compliant-across-your-devices-with-fleet.md",
+        "meta": {
+          "category": "security",
+          "authorFullName": "Drew Baker",
+          "authorGitHubUsername": "Drew-P-drawers",
+          "publishedOn": "2022-03-09",
+          "articleTitle": "Get and stay compliant across your devices with Fleet.",
+          "articleImageUrl": "/images/articles/get-and-stay-compliant-across-your-devices-with-fleet-cover-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/guides/get-current-telemetry-from-your-devices-with-live-queries",
+        "title": "Get current telemetry from your devices with live queries",
+        "lastModifiedAt": 1726839805134,
+        "htmlId": "articles--get-current-telemetr--019d64996a",
+        "sectionRelativeRepoPath": "get-current-telemetry-from-your-devices-with-live-queries.md",
+        "meta": {
+          "articleTitle": "Get current telemetry from your devices with live queries",
+          "authorFullName": "Victor Lyuboslavsky",
+          "authorGitHubUsername": "getvictor",
+          "category": "guides",
+          "publishedOn": "2023-12-27",
+          "description": "Learn how live queries work under the hood."
+        }
+      },
+      {
+        "url": "/announcements/government-agencies-need-to-dith-the-mdm-thicket",
+        "title": "Government agencies need to dith the mdm thicket",
+        "lastModifiedAt": 1726839805135,
+        "htmlId": "articles--government-agencies---f0385b3f79",
+        "sectionRelativeRepoPath": "government-agencies-need-to-dith-the-mdm-thicket.md",
+        "meta": {
+          "category": "announcements",
+          "authorFullName": "Keith Barnes",
+          "authorGitHubUsername": "KAB703",
+          "publishedOn": "2024-02-09",
+          "articleTitle": "Government agencies need to ditch the MDM thicket: multiple solutions cost you more than you think",
+          "articleImageUrl": "/images/articles/government-agencies-need-to-dith-the-mdm-thicket-1600x900@2x.png"
+        }
+      },
+      {
+        "url": "/announcements/happy-1st-anniversary-fleet",
+        "title": "Happy 1st anniversary Fleet",
+        "lastModifiedAt": 1726839805135,
+        "htmlId": "articles--happy-1st-anniversar--128480e14b",
+        "sectionRelativeRepoPath": "happy-1st-anniversary-fleet.md",
+        "meta": {
+          "category": "announcements",
+          "authorGitHubUsername": "mike-j-thomas",
+          "authorFullName": "Mike Thomas",
+          "publishedOn": "2021-10-08",
+          "articleTitle": "Happy 1st anniversary, Fleet.",
+          "articleImageUrl": "/images/articles/happy-1st-anniversary-fleet-cover-800x450@2x.png"
+        }
+      },
+      {
+        "url": "/securing/how-fleet-helps-federal-agencies-meet-cisa-bod-23-01",
+        "title": "How Fleet helps federal agencies meet cisa bod 23 01",
+        "lastModifiedAt": 1726839805136,
+        "htmlId": "articles--how-fleet-helps-fede--82d74da10e",
+        "sectionRelativeRepoPath": "how-fleet-helps-federal-agencies-meet-cisa-bod-23-01.md",
+        "meta": {
+          "category": "security",
+          "authorFullName": "Chris McGillicuddy",
+          "authorGitHubUsername": "chris-mcgillicuddy",
+          "publishedOn": "2022-10-28",
+          "articleTitle": "How Fleet helps federal agencies meet CISA BOD 23-01",
+          "articleImageUrl": "/images/articles/BOD-23-01-800x450@2x.jpg"
+        }
+      },
+      {
+        "url": "/securing/how-osquery-can-help-cyber-responders",
+        "title": "How osquery can help cyber responders",
+        "lastModifiedAt": 1726839805138,
+        "htmlId": "articles--how-osquery-can-help--eca2df006d",
+        "sectionRelativeRepoPath": "how-osquery-can-help-cyber-responders.md",
+        "meta": {
+          "category": "security",
+          "authorFullName": "JD Strong",
+          "authorGitHubUsername": "spokanemac",
+          "publishedOn": "2023-11-02",
+          "articleTitle": "How osquery can help cyber responders.",
+          "articleImageUrl": "/images/articles/osquery-for-cyber-responders-1600x900@2x.png"
+        }
+      },
+      {
+        "url": "/guides/how-to-configure-logging-destinations",
+        "title": "How to configure logging destinations",
+        "lastModifiedAt": 1726839805139,
+        "htmlId": "articles--how-to-configure-log--e7ef58a2dc",
+        "sectionRelativeRepoPath": "how-to-configure-logging-destinations.md",
+        "meta": {
+          "category": "guides",
+          "authorFullName": "Grant Bilstad",
+          "authorGitHubUsername": "pacamaster",
+          "publishedOn": "2024-06-28",
+          "articleTitle": "How to configure logging destinations",
+          "articleImageUrl": "/images/articles/how-to-configure-logging-destinations-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/guides/how-to-install-osquery-and-enroll-linux-devices-into-fleet",
+        "title": "How to install osquery and enroll linux devices into Fleet",
+        "lastModifiedAt": 1726839805140,
+        "htmlId": "articles--how-to-install-osque--7ef1932c39",
+        "sectionRelativeRepoPath": "how-to-install-osquery-and-enroll-linux-devices-into-fleet.md",
+        "meta": {
+          "category": "guides",
+          "authorFullName": "Kathy Satterlee",
+          "authorGitHubUsername": "ksatter",
+          "publishedOn": "2022-03-19",
+          "articleTitle": "How to install osquery and enroll Linux devices into Fleet",
+          "articleImageUrl": "/images/articles/install-osquery-and-enroll-linux-devices-into-fleet-cover-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/guides/how-to-install-osquery-and-enroll-macos-devices-into-fleet",
+        "title": "How to install osquery and enroll macos devices into Fleet",
+        "lastModifiedAt": 1726839805142,
+        "htmlId": "articles--how-to-install-osque--9584297736",
+        "sectionRelativeRepoPath": "how-to-install-osquery-and-enroll-macos-devices-into-fleet.md",
+        "meta": {
+          "category": "guides",
+          "authorFullName": "Kelvin Omereshone",
+          "authorGitHubUsername": "dominuskelvin",
+          "publishedOn": "2022-01-13",
+          "articleTitle": "How to install osquery and enroll macOS devices into Fleet",
+          "articleImageUrl": "/images/articles/install-osquery-and-enroll-macos-devices-into-fleet-cover-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/guides/how-to-install-osquery-and-enroll-windows-devices-into-fleet",
+        "title": "How to install osquery and enroll windows devices into Fleet",
+        "lastModifiedAt": 1726839805143,
+        "htmlId": "articles--how-to-install-osque--65750e792f",
+        "sectionRelativeRepoPath": "how-to-install-osquery-and-enroll-windows-devices-into-fleet.md",
+        "meta": {
+          "category": "guides",
+          "authorFullName": "Kelvin Omereshone",
+          "authorGitHubUsername": "dominuskelvin",
+          "publishedOn": "2022-02-03",
+          "articleTitle": "How to install osquery and enroll Windows devices into Fleet",
+          "articleImageUrl": "/images/articles/install-osquery-and-enroll-windows-devices-into-fleet-cover-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/guides/how-to-uninstall-osquery",
+        "title": "How to uninstall osquery",
+        "lastModifiedAt": 1726839805143,
+        "htmlId": "articles--how-to-uninstall-osq--7455ca45fc",
+        "sectionRelativeRepoPath": "how-to-uninstall-osquery.md",
+        "meta": {
+          "category": "guides",
+          "authorFullName": "Eric Shaw",
+          "authorGitHubUsername": "eashaw",
+          "publishedOn": "2021-09-08",
+          "articleTitle": "How to uninstall osquery",
+          "articleImageUrl": "/images/articles/how-to-uninstall-osquery-cover-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/guides/import-and-export-queries-in-fleet",
+        "title": "Import and export queries in Fleet",
+        "lastModifiedAt": 1726839805144,
+        "htmlId": "articles--import-and-export-qu--44b09ee020",
+        "sectionRelativeRepoPath": "import-and-export-queries-in-fleet.md",
+        "meta": {
+          "category": "guides",
+          "authorGitHubUsername": "noahtalerman",
+          "authorFullName": "Noah Talerman",
+          "publishedOn": "2021-02-16",
+          "articleTitle": "Import and export queries in Fleet",
+          "articleImageUrl": "/images/articles/import-and-export-queries-in-Fleet-1600x900@2x.png"
+        }
+      },
+      {
+        "url": "/guides/install-vpp-apps-on-macos-using-fleet",
+        "title": "Install vpp apps on macos using Fleet",
+        "lastModifiedAt": 1726839805145,
+        "htmlId": "articles--install-vpp-apps-on---4e6a161ea8",
+        "sectionRelativeRepoPath": "install-vpp-apps-on-macos-using-fleet.md",
+        "meta": {
+          "articleTitle": "Install VPP apps on macOS, iOS, and iPadOS using Fleet",
+          "authorFullName": "Jahziel Villasana-Espinoza",
+          "authorGitHubUsername": "jahzielv",
+          "category": "guides",
+          "publishedOn": "2024-08-12",
+          "articleImageUrl": "/images/articles/install-vpp-apps-on-macos-using-fleet-1600x900@2x.png",
+          "description": "This guide will walk you through installing VPP apps on macOS, iOS, and iPadOS using Fleet."
+        }
+      },
+      {
+        "url": "/announcements/introducing-cross-platform-script-execution",
+        "title": "Introducing cross platform script execution",
+        "lastModifiedAt": 1726839805147,
+        "htmlId": "articles--introducing-cross-pl--f50031e3db",
+        "sectionRelativeRepoPath": "introducing-cross-platform-script-execution.md",
+        "meta": {
+          "category": "announcements",
+          "authorFullName": "JD Strong",
+          "authorGitHubUsername": "spokanemac",
+          "publishedOn": "2023-10-17",
+          "articleTitle": "Introducing cross-platform script execution",
+          "articleImageUrl": "/images/articles/introducing-cross-platform-script-execution-800x450@2x.png"
+        }
+      },
+      {
+        "url": "/announcements/introducing-fleet-ultimate",
+        "title": "Introducing Fleet ultimate",
+        "lastModifiedAt": 1726839805147,
+        "htmlId": "articles--introducing-fleet-ul--caba265ec4",
+        "sectionRelativeRepoPath": "introducing-fleet-ultimate.md",
+        "meta": {
+          "category": "announcements",
+          "authorGitHubUsername": "jarodreyes",
+          "authorFullName": "Jarod Reyes",
+          "publishedOn": "2023-02-20",
+          "articleTitle": "Introducing CIS benchmarks, managed-cloud hosting and custom calculator in the new Fleet Ultimate plan.",
+          "articleImageUrl": "/images/articles/happy-1st-anniversary-fleet-cover-800x450@2x.png"
+        }
+      },
+      {
+        "url": "/announcements/introducing-orbit-your-fleet-agent-manager",
+        "title": "Introducing orbit your Fleet agent manager",
+        "lastModifiedAt": 1726839805148,
+        "htmlId": "articles--introducing-orbit-yo--1de0ea07ab",
+        "sectionRelativeRepoPath": "introducing-orbit-your-fleet-agent-manager.md",
+        "meta": {
+          "category": "announcements",
+          "authorFullName": "Mo Zhu",
+          "authorGitHubUsername": "zhumo",
+          "publishedOn": "2022-08-18",
+          "articleTitle": "Introducing Orbit, your Fleet agent manager",
+          "articleImageUrl": "/images/articles/fleet-4.17.0-1-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/engineering/linux-vulnerability-detection-with-oval-and-fleet",
+        "title": "Linux vulnerability detection with oval and Fleet",
+        "lastModifiedAt": 1726839805150,
+        "htmlId": "articles--linux-vulnerability---0d4c8fd5ac",
+        "sectionRelativeRepoPath": "linux-vulnerability-detection-with-oval-and-fleet.md",
+        "meta": {
+          "category": "engineering",
+          "authorGitHubUsername": "juan-fdz-hawa",
+          "authorFullName": "Juan Fernandes",
+          "publishedOn": "2022-07-29",
+          "articleTitle": "Linux vulnerability detection with OVAL and Fleet",
+          "articleImageUrl": "/images/articles/linux-vulnerability-detection-with-oval-and-fleet-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/guides/locate-assets-with-osquery",
+        "title": "Locate assets with osquery",
+        "lastModifiedAt": 1726839805150,
+        "htmlId": "articles--locate-assets-with-o--764d2b5f55",
+        "sectionRelativeRepoPath": "locate-assets-with-osquery.md",
+        "meta": {
+          "category": "guides",
+          "authorGitHubUsername": "zwass",
+          "authorFullName": "Zach Wasserman",
+          "publishedOn": "2021-05-11",
+          "articleTitle": "Locate device assets in the event of an emergency.",
+          "articleImageUrl": "/images/articles/locate-assets-with-osquery-cover-700x393@2x.jpeg"
+        }
+      },
+      {
+        "url": "/guides/log-destinations",
+        "title": "Log destinations",
+        "lastModifiedAt": 1726839805152,
+        "htmlId": "articles--log-destinations--9bb62f5aa2",
+        "sectionRelativeRepoPath": "log-destinations.md",
+        "meta": {
+          "category": "guides",
+          "authorGitHubUsername": "rachaelshaw",
+          "authorFullName": "Rachael Shaw",
+          "publishedOn": "2023-11-02",
+          "articleTitle": "Log destinations",
+          "description": "Learn about supported log destinations in Fleet, including Amazon Kinesis, AWS Lambda Snowflake, Splunk, and more."
+        }
+      },
+      {
+        "url": "/securing/lossless-yubikeys-with-yubitrak-and-airtag",
+        "title": "Lossless yubikeys with yubitrak and airtag",
+        "lastModifiedAt": 1726839805153,
+        "htmlId": "articles--lossless-yubikeys-wi--b260bfc20a",
+        "sectionRelativeRepoPath": "lossless-yubiKeys-with-yubitrak-and-airtag.md",
+        "meta": {
+          "category": "security",
+          "authorGitHubUsername": "GuillaumeRoss",
+          "authorFullName": "Guillaume Ross",
+          "publishedOn": "2022-06-16",
+          "articleTitle": "Lossless YubiKeys with Yubitrak and AirTag",
+          "articleImageUrl": "/images/articles/lossless-yubikeys-with-yubitrak-and-airtag-cover-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/guides/macos-mdm-setup",
+        "title": "Macos mdm setup",
+        "lastModifiedAt": 1726839805154,
+        "htmlId": "articles--macos-mdm-setup--66538706f5",
+        "sectionRelativeRepoPath": "macos-mdm-setup.md",
+        "meta": {
+          "category": "guides",
+          "authorGitHubUsername": "zhumo",
+          "authorFullName": "Mo Zhu",
+          "publishedOn": "2024-07-02",
+          "articleTitle": "macOS MDM setup",
+          "description": "Learn how to turn on MDM features in Fleet."
+        }
+      },
+      {
+        "url": "/guides/macos-setup-experience",
+        "title": "Macos setup experience",
+        "lastModifiedAt": 1726839805155,
+        "htmlId": "articles--macos-setup-experien--cca7e9e073",
+        "sectionRelativeRepoPath": "macos-setup-experience.md",
+        "meta": {
+          "category": "guides",
+          "authorGitHubUsername": "noahtalerman",
+          "authorFullName": "Noah Talerman",
+          "publishedOn": "2024-07-03",
+          "articleTitle": "macOS setup experience",
+          "description": "Customize your macOS setup experience with Fleet Premium by managing user authentication, Setup Assistant panes, and installing bootstrap packages."
+        }
+      },
+      {
+        "url": "/guides/managing-labels-in-fleet",
+        "title": "Managing labels in Fleet",
+        "lastModifiedAt": 1726839805156,
+        "htmlId": "articles--managing-labels-in-f--b2e5aed976",
+        "sectionRelativeRepoPath": "managing-labels-in-fleet.md",
+        "meta": {
+          "articleTitle": "Managing labels in Fleet",
+          "authorFullName": "JD Strong",
+          "authorGitHubUsername": "spokanemac",
+          "category": "guides",
+          "publishedOn": "2024-07-18",
+          "articleImageUrl": "/images/articles/managing-labels-in-fleet-1600x900@2x.png",
+          "description": "This guide will walk you through managing labels using the Fleet web UI."
+        }
+      },
+      {
+        "url": "/securing/mapping-fleet-and-osquery-results-to-the-mitre-attck-framework-via-splunk",
+        "title": "Mapping Fleet and osquery results to the mitre attck framework via splunk",
+        "lastModifiedAt": 1726839805157,
+        "htmlId": "articles--mapping-fleet-and-os--7ee9249dc4",
+        "sectionRelativeRepoPath": "mapping-fleet-and-osquery-results-to-the-mitre-attck-framework-via-splunk.md",
+        "meta": {
+          "category": "security",
+          "authorFullName": "Dave Herder",
+          "authorGitHubUsername": "dherder",
+          "publishedOn": "2023-01-30",
+          "articleTitle": "Mapping Fleet and osquery results to the MITRE ATT&CK® framework via Splunk",
+          "articleImageUrl": "/images/articles/mapping-fleet-and-osquery-results-to-the-mitre-attck-framework-via-splunk-1600x900@2x.png"
+        }
+      },
+      {
+        "url": "/guides/mdm-commands",
+        "title": "Mdm commands",
+        "lastModifiedAt": 1726839805158,
+        "htmlId": "articles--mdm-commands--8de440c455",
+        "sectionRelativeRepoPath": "mdm-commands.md",
+        "meta": {
+          "category": "guides",
+          "authorGitHubUsername": "noahtalerman",
+          "authorFullName": "Noah Talerman",
+          "publishedOn": "2024-06-12",
+          "articleTitle": "MDM commands",
+          "description": "Learn how to run custom MDM commands on hosts using Fleet."
+        }
+      },
+      {
+        "url": "/guides/mdm-migration",
+        "title": "Mdm migration",
+        "lastModifiedAt": 1726839805159,
+        "htmlId": "articles--mdm-migration--a500f61869",
+        "sectionRelativeRepoPath": "mdm-migration.md",
+        "meta": {
+          "category": "guides",
+          "authorGitHubUsername": "zhumo",
+          "authorFullName": "Mo Zhu",
+          "publishedOn": "2024-08-14",
+          "articleTitle": "MDM migration",
+          "description": "Instructions for migrating hosts away from an old MDM solution to Fleet."
+        }
+      },
+      {
+        "url": "/announcements/nvd-api-2.0",
+        "title": "Nvd API 2.0",
+        "lastModifiedAt": 1726839805160,
+        "htmlId": "articles--nvd-api-20--a754d441c3",
+        "sectionRelativeRepoPath": "nvd-api-2.0.md",
+        "meta": {
+          "category": "announcements",
+          "authorFullName": "JD Strong",
+          "authorGitHubUsername": "spokanemac",
+          "publishedOn": "2023-11-28",
+          "articleTitle": "NVD API 2.0: An important update for Fleet users",
+          "articleImageUrl": "/images/articles/nvd-api-2.0-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/securing/optimizing-government-cybersecurity-strategies",
+        "title": "Optimizing government cybersecurity strategies",
+        "lastModifiedAt": 1726839805161,
+        "htmlId": "articles--optimizing-governmen--78189d23a6",
+        "sectionRelativeRepoPath": "optimizing-government-cybersecurity-strategies.md",
+        "meta": {
+          "category": "security",
+          "authorFullName": "Keith Barnes",
+          "authorGitHubUsername": "KAB703",
+          "publishedOn": "2023-11-14",
+          "articleTitle": "Optimizing government cybersecurity strategies with Fleet.",
+          "articleImageUrl": "/images/articles/optimizing-government-cybersecurity-strategies-1600x900@2x.png"
+        }
+      },
+      {
+        "url": "/releases/osquery-5.11.0",
+        "title": "Osquery 5.11.0",
+        "lastModifiedAt": 1726839805162,
+        "htmlId": "articles--osquery-5110--5af6435495",
+        "sectionRelativeRepoPath": "osquery-5.11.0.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "JD Strong",
+          "authorGitHubUsername": "spokanemac",
+          "publishedOn": "2024-02-16",
+          "articleTitle": "osquery 5.11.0 | VSCode, Apple silicon, and more",
+          "articleImageUrl": "/images/articles/osquery-5.11.0-cover-1600x900@2x.png"
+        }
+      },
+      {
+        "url": "/guides/osquery-a-tool-to-easily-ask-questions-about-operating-systems",
+        "title": "Osquery a tool to easily ask questions about operating systems",
+        "lastModifiedAt": 1726839805163,
+        "htmlId": "articles--osquery-a-tool-to-ea--424e2ed801",
+        "sectionRelativeRepoPath": "osquery-a-tool-to-easily-ask-questions-about-operating-systems.md",
+        "meta": {
+          "category": "guides",
+          "authorGitHubUsername": "dominuskelvin",
+          "authorFullName": "Kelvin Omereshone",
+          "publishedOn": "2022-04-04",
+          "articleTitle": "Osquery: a tool to easily ask questions about operating systems",
+          "articleImageUrl": "/images/articles/osquery-a-tool-to-easily-ask-questions-about-operating-systems-cover-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/securing/osquery-as-a-threat-hunting-platform",
+        "title": "Osquery as a threat hunting platform",
+        "lastModifiedAt": 1726839805164,
+        "htmlId": "articles--osquery-as-a-threat---d96a59f1dd",
+        "sectionRelativeRepoPath": "osquery-as-a-threat-hunting-platform.md",
+        "meta": {
+          "category": "security",
+          "authorFullName": "Chris McGillicuddy",
+          "authorGitHubUsername": "chris-mcgillicuddy",
+          "publishedOn": "2022-09-16",
+          "articleTitle": "Osquery… as a threat hunting platform?",
+          "articleImageUrl": "/images/articles/osquery-for-threat-hunting-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/guides/osquery-consider-joining-against-the-users-table",
+        "title": "Osquery consider joining against the users table",
+        "lastModifiedAt": 1726839805165,
+        "htmlId": "articles--osquery-consider-joi--b99ae264e4",
+        "sectionRelativeRepoPath": "osquery-consider-joining-against-the-users-table.md",
+        "meta": {
+          "category": "guides",
+          "authorGitHubUsername": "zwass",
+          "authorFullName": "Zach Wasserman",
+          "publishedOn": "2021-05-06",
+          "articleTitle": "Osquery: Consider joining against the users table",
+          "articleImageUrl": "/images/articles/osquery-consider-joining-against-the-users-table-cover-700x437@2x.jpeg"
+        }
+      },
+      {
+        "url": "/releases/osquery-5.8.1",
+        "title": "Osquery 5.8.1",
+        "lastModifiedAt": 1726839805166,
+        "htmlId": "articles--osquery-581--5d3dced550",
+        "sectionRelativeRepoPath": "osquery-5.8.1.md",
+        "meta": {
+          "category": "releases",
+          "authorFullName": "JD Strong",
+          "authorGitHubUsername": "spokanemac",
+          "publishedOn": "2023-03-14",
+          "articleTitle": "osquery 5.8.1 | Process auditing, stats, and additional tables",
+          "articleImageUrl": "/images/articles/osquery-5.8.1-cover-1600x900@2x.png"
+        }
+      },
+      {
+        "url": "/guides/osquery-evented-tables-overview",
+        "title": "Osquery evented tables overview",
+        "lastModifiedAt": 1726839805168,
+        "htmlId": "articles--osquery-evented-tabl--b9b1176562",
+        "sectionRelativeRepoPath": "osquery-evented-tables-overview.md",
+        "meta": {
+          "articleTitle": "How to use osquery evented tables",
+          "authorFullName": "Mo Zhu",
+          "authorGitHubUsername": "zhumo",
+          "category": "guides",
+          "publishedOn": "2022-09-21"
+        }
+      },
+      {
+        "url": "/securing/osquery-vulnerability-management-at-scale",
+        "title": "Osquery vulnerability management at scale",
+        "lastModifiedAt": 1726839805169,
+        "htmlId": "articles--osquery-vulnerabilit--cac605ad18",
+        "sectionRelativeRepoPath": "osquery-vulnerability-management-at-scale.md",
+        "meta": {
+          "category": "security",
+          "authorFullName": "Chris McGillicuddy",
+          "authorGitHubUsername": "chris-mcgillicuddy",
+          "publishedOn": "2022-10-05",
+          "articleTitle": "Vulnerability management at scale: a presentation from osquery Co-creator Zach Wasserman",
+          "articleImageUrl": "/images/articles/vulnerability-management-at-scale-with-osquery_800x450@2x.jpg"
+        }
+      },
+      {
+        "url": "/guides/osquery-watchdog",
+        "title": "Osquery watchdog",
+        "lastModifiedAt": 1726839805170,
+        "htmlId": "articles--osquery-watchdog--6a195970e0",
+        "sectionRelativeRepoPath": "osquery-watchdog.md",
+        "meta": {
+          "category": "guides",
+          "authorGitHubUsername": "juan-fdz-hawa",
+          "authorFullName": "Juan Fernandes",
+          "publishedOn": "2023-07-28",
+          "articleTitle": "Osquery watchdog",
+          "description": "Learn about how osquery process manages child processes and managed extensions in Fleet."
+        }
+      },
+      {
+        "url": "/announcements/psu-macadmins-conference-2023",
+        "title": "Psu macadmins conference 2023",
+        "lastModifiedAt": 1726839805171,
+        "htmlId": "articles--psu-macadmins-confer--175629dfbd",
+        "sectionRelativeRepoPath": "psu-macadmins-conference-2023.md",
+        "meta": {
+          "category": "announcements",
+          "authorGitHubUsername": "spokanemac",
+          "authorFullName": "JD Strong",
+          "publishedOn": "2023-07-13",
+          "articleTitle": "Mac admins summer camp ⛺ at PSU MacAdmins Conference 2023",
+          "articleImageUrl": "/images/articles/psu-macadmins-conference-2023@2x.png",
+          "description": "A look ahead to PSU MacAdmin Conference July 18-21, 2023"
+        }
+      },
+      {
+        "url": "/guides/puppet-module",
+        "title": "Puppet module",
+        "lastModifiedAt": 1726839805172,
+        "htmlId": "articles--puppet-module--c01ecdf2b6",
+        "sectionRelativeRepoPath": "puppet-module.md",
+        "meta": {
+          "category": "guides",
+          "authorGitHubUsername": "noahtalerman",
+          "authorFullName": "Noah Talerman",
+          "publishedOn": "2024-05-24",
+          "articleTitle": "Puppet module",
+          "description": "Learn how to use Fleet's Puppet module to automatically assign custom configuration profiles on your macOS hosts."
+        }
+      },
+      {
+        "url": "/guides/queries",
+        "title": "Queries",
+        "lastModifiedAt": 1726839805173,
+        "htmlId": "articles--queries--ce5c1e3c99",
+        "sectionRelativeRepoPath": "queries.md",
+        "meta": {
+          "category": "guides",
+          "authorGitHubUsername": "noahtalerman",
+          "authorFullName": "Noah Talerman",
+          "publishedOn": "2024-08-09",
+          "articleTitle": "Queries",
+          "description": "Learn how to create, run, and schedule queries, as well as update agent options in the Fleet user interface."
+        }
+      },
+      {
+        "url": "/guides/querying-process-file-events-table-on-centos-7",
+        "title": "Querying process file events table on centos 7",
+        "lastModifiedAt": 1726839805174,
+        "htmlId": "articles--querying-process-fil--5587f39199",
+        "sectionRelativeRepoPath": "querying-process-file-events-table-on-centos-7.md",
+        "meta": {
+          "articleTitle": "Querying process_file_events on CentOS 7",
+          "description": "Learn how to configure and query the process_file_events table on CentOS 7 with Fleet.",
+          "category": "guides",
+          "authorGitHubUsername": "lucasmrod",
+          "authorFullName": "Lucas Rodriguez",
+          "publishedOn": "2023-07-17"
+        }
+      },
+      {
+        "url": "/guides/role-based-access",
+        "title": "Role based access",
+        "lastModifiedAt": 1726839805177,
+        "htmlId": "articles--role-based-access--92a94667b2",
+        "sectionRelativeRepoPath": "role-based-access.md",
+        "meta": {
+          "category": "guides",
+          "authorGitHubUsername": "noahtalerman",
+          "authorFullName": "Noah Talerman",
+          "publishedOn": "2024-08-10",
+          "articleTitle": "Role-based access",
+          "description": "Learn about the different roles and permissions in Fleet."
+        }
+      },
+      {
+        "url": "/engineering/saving-over-100x-on-egress-switching-from-aws-to-hetzner",
+        "title": "Saving over 100x on egress switching from aws to hetzner",
+        "lastModifiedAt": 1726839805179,
+        "htmlId": "articles--saving-over-100x-on---a46f112fc0",
+        "sectionRelativeRepoPath": "saving-over-100x-on-egress-switching-from-aws-to-hetzner.md",
+        "meta": {
+          "category": "engineering",
+          "authorGitHubUsername": "zwass",
+          "authorFullName": "Zach Wasserman",
+          "publishedOn": "2022-01-25",
+          "articleTitle": "Saving over 100x on egress switching from AWS to Hetzner",
+          "articleImageUrl": "/images/articles/saving-over-100x-on-egress-switching-from-aws-to-hetzner-cover-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/guides/scripts",
+        "title": "Scripts",
+        "lastModifiedAt": 1726839805179,
+        "htmlId": "articles--scripts--3a91ba655e",
+        "sectionRelativeRepoPath": "scripts.md",
+        "meta": {
+          "category": "guides",
+          "authorGitHubUsername": "noahtalerman",
+          "authorFullName": "Noah Talerman",
+          "publishedOn": "2024-06-04",
+          "articleTitle": "Scripts",
+          "description": "Learn how to execute a custom script on macOS, Windows, and Linux hosts in Fleet."
+        }
+      },
+      {
+        "url": "/guides/seamless-mdm-migration",
+        "title": "Seamless mdm migration",
+        "lastModifiedAt": 1726839805182,
+        "htmlId": "articles--seamless-mdm-migrati--f0abcf2f23",
+        "sectionRelativeRepoPath": "seamless-mdm-migration.md",
+        "meta": {
+          "category": "guides",
+          "authorFullName": "Zach Wasserman",
+          "authorGitHubUsername": "zwass",
+          "publishedOn": "2024-08-08",
+          "articleTitle": "Seamless MDM migrations to Fleet",
+          "articleImageUrl": "/images/articles/seamless-mdm-migration-1600x900@2x.png",
+          "description": "This guide provides a process for seamlessly migrating macOS devices from an existing MDM solution to Fleet."
+        }
+      },
+      {
+        "url": "/announcements/seattle-bellevue-cyber-security-summit-march-8-2023",
+        "title": "Seattle bellevue cyber security summit march 8 2023",
+        "lastModifiedAt": 1726839805183,
+        "htmlId": "articles--seattle-bellevue-cyb--3b5ca28169",
+        "sectionRelativeRepoPath": "seattle-bellevue-cyber-security-summit-march-8-2023.md",
+        "meta": {
+          "category": "announcements",
+          "authorGitHubUsername": "spokanemac",
+          "authorFullName": "JD Strong",
+          "publishedOn": "2023-03-02",
+          "articleTitle": "Join Fleet at Cyber Security Summit Seattle/Bellevue",
+          "articleImageUrl": "/images/articles/seattle-bellevue-cyber-security-summit-social-post-1200x628@2x.png"
+        }
+      },
+      {
+        "url": "/securing/security-testing-at-fleet-fleet-pentest",
+        "title": "Security testing at Fleet Fleet pentest",
+        "lastModifiedAt": 1726839805184,
+        "htmlId": "articles--security-testing-at---106e7f1999",
+        "sectionRelativeRepoPath": "security-testing-at-fleet-fleet-pentest.md",
+        "meta": {
+          "category": "security",
+          "authorGitHubUsername": "GuillaumeRoss",
+          "authorFullName": "Guillaume Ross",
+          "publishedOn": "2022-05-10",
+          "articleTitle": "Penetration testing of Fleet (April 2022)",
+          "articleImageUrl": "/images/articles/security-testing-at-fleet-fleet-pentest-cover-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/securing/security-testing-at-fleet-orbit-auto-updater-audit",
+        "title": "Security testing at Fleet orbit auto updater audit",
+        "lastModifiedAt": 1726839805185,
+        "htmlId": "articles--security-testing-at---f487015e45",
+        "sectionRelativeRepoPath": "security-testing-at-fleet-orbit-auto-updater-audit.md",
+        "meta": {
+          "category": "security",
+          "authorGitHubUsername": "GuillaumeRoss",
+          "authorFullName": "Guillaume Ross",
+          "publishedOn": "2022-03-30",
+          "articleTitle": "Security testing at Fleet/Orbit auto-updater audit",
+          "articleImageUrl": "/images/articles/security-testing-at-fleet-orbit-auto-updater-audit-cover-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/guides/software-self-service",
+        "title": "Software self service",
+        "lastModifiedAt": 1726839805186,
+        "htmlId": "articles--software-self-servic--9047e7f63d",
+        "sectionRelativeRepoPath": "software-self-service.md",
+        "meta": {
+          "articleTitle": "Software self-service",
+          "authorFullName": "Jahziel Villasana-Espinoza",
+          "authorGitHubUsername": "jahzielv",
+          "category": "guides",
+          "publishedOn": "2024-08-06",
+          "articleImageUrl": "/images/articles/software-self-service-1600x900@2x.png",
+          "description": "This guide will walk you through adding apps to Fleet for user self-service."
+        }
+      },
+      {
+        "url": "/guides/standard-query-library",
+        "title": "Standard query library",
+        "lastModifiedAt": 1726839805187,
+        "htmlId": "articles--standard-query-libra--dccfaa84b4",
+        "sectionRelativeRepoPath": "standard-query-library.md",
+        "meta": {
+          "category": "guides",
+          "authorGitHubUsername": "noahtalerman",
+          "authorFullName": "Noah Talerman",
+          "publishedOn": "2024-04-04",
+          "articleTitle": "Standard query library",
+          "description": "Learn how to use and contribute to Fleet's standard query library."
+        }
+      },
+      {
+        "url": "/report/state-of-device-management",
+        "title": "State of device management",
+        "lastModifiedAt": 1726839805187,
+        "htmlId": "articles--state-of-device-mana--f6254cc69c",
+        "sectionRelativeRepoPath": "state-of-device-management.md",
+        "meta": {
+          "category": "report",
+          "authorFullName": "Mike McNeil",
+          "authorGitHubUsername": "mikermcneil",
+          "publishedOn": "2022-07-07",
+          "articleTitle": "State of Device Management report 2022",
+          "articleImageUrl": "/images/articles/state-of-device-management-report-1600x900@2x.png"
+        }
+      },
+      {
+        "url": "/securing/stay-on-course-with-your-security-compliance-goals",
+        "title": "Stay on course with your security compliance goals",
+        "lastModifiedAt": 1726839805188,
+        "htmlId": "articles--stay-on-course-with---a487f310dc",
+        "sectionRelativeRepoPath": "stay-on-course-with-your-security-compliance-goals.md",
+        "meta": {
+          "category": "security",
+          "authorFullName": "Chris McGillicuddy",
+          "authorGitHubUsername": "chris-mcgillicuddy",
+          "publishedOn": "2022-07-18",
+          "articleTitle": "Stay on course with your security compliance goals",
+          "articleImageUrl": "/images/articles/security-compliance-goals-cover-800x450@2x.jpg"
+        }
+      },
+      {
+        "url": "/guides/sysadmin-diaries-device-enrollment",
+        "title": "Sysadmin diaries device enrollment",
+        "lastModifiedAt": 1726839805189,
+        "htmlId": "articles--sysadmin-diaries-dev--abfda23f04",
+        "sectionRelativeRepoPath": "sysadmin-diaries-device-enrollment.md",
+        "meta": {
+          "articleTitle": "Sysadmin diaries: device enrollment",
+          "authorFullName": "JD Strong",
+          "authorGitHubUsername": "spokanemac",
+          "category": "guides",
+          "publishedOn": "2024-05-03",
+          "articleImageUrl": "/images/articles/sysadmin-diaries-1600x900@2x.png",
+          "description": "In this sysadmin diary, we explore a the differences in device enrollment."
+        }
+      },
+      {
+        "url": "/guides/sysadmin-diaries-exporting-policies",
+        "title": "Sysadmin diaries exporting policies",
+        "lastModifiedAt": 1726839805190,
+        "htmlId": "articles--sysadmin-diaries-exp--a101d98c97",
+        "sectionRelativeRepoPath": "sysadmin-diaries-exporting-policies.md",
+        "meta": {
+          "articleTitle": "Sysadmin diaries: exporting policies",
+          "authorFullName": "JD Strong",
+          "authorGitHubUsername": "spokanemac",
+          "category": "guides",
+          "publishedOn": "2024-06-28",
+          "articleImageUrl": "/images/articles/sysadmin-diaries-1600x900@2x.png",
+          "description": "In this sysadmin diary, we explore extracting existing policies to enable gitops."
+        }
+      },
+      {
+        "url": "/guides/sysadmin-diaries-lost-device",
+        "title": "Sysadmin diaries lost device",
+        "lastModifiedAt": 1726839805191,
+        "htmlId": "articles--sysadmin-diaries-los--3bcb909203",
+        "sectionRelativeRepoPath": "sysadmin-diaries-lost-device.md",
+        "meta": {
+          "articleTitle": "Sysadmin diaries: lost device",
+          "authorFullName": "JD Strong",
+          "authorGitHubUsername": "spokanemac",
+          "category": "guides",
+          "publishedOn": "2024-07-09",
+          "articleImageUrl": "/images/articles/sysadmin-diaries-1600x900@2x.png",
+          "description": "In this sysadmin diary, we explore what actions can be taken with Fleet when a device is lost."
+        }
+      },
+      {
+        "url": "/guides/sysadmin-diaries-passcode-profiles",
+        "title": "Sysadmin diaries passcode profiles",
+        "lastModifiedAt": 1726839805192,
+        "htmlId": "articles--sysadmin-diaries-pas--883471875d",
+        "sectionRelativeRepoPath": "sysadmin-diaries-passcode-profiles.md",
+        "meta": {
+          "articleTitle": "Sysadmin diaries: passcode profiles",
+          "authorFullName": "JD Strong",
+          "authorGitHubUsername": "spokanemac",
+          "category": "guides",
+          "publishedOn": "2024-04-01",
+          "articleImageUrl": "/images/articles/sysadmin-diaries-1600x900@2x.png",
+          "description": "In this sysadmin diary, we explore a missapplied passcode policy."
+        }
+      },
+      {
+        "url": "/guides/sysadmin-diaries-restoring-fleetd",
+        "title": "Sysadmin diaries restoring fleetd",
+        "lastModifiedAt": 1726839805193,
+        "htmlId": "articles--sysadmin-diaries-res--96c547e138",
+        "sectionRelativeRepoPath": "sysadmin-diaries-restoring-fleetd.md",
+        "meta": {
+          "articleTitle": "Sysadmin diaries: restoring fleetd",
+          "authorFullName": "JD Strong",
+          "authorGitHubUsername": "spokanemac",
+          "category": "guides",
+          "publishedOn": "2024-06-14",
+          "articleImageUrl": "/images/articles/sysadmin-diaries-1600x900@2x.png",
+          "description": "In this sysadmin diary, we explore restoring fleetd deleted by a surly employee."
+        }
+      },
+      {
+        "url": "/securing/tales-from-fleet-security-github-configuration-and-openssf-scorecards",
+        "title": "Tales from Fleet security github configuration and openssf scorecards",
+        "lastModifiedAt": 1726839805194,
+        "htmlId": "articles--tales-from-fleet-sec--035c3d6474",
+        "sectionRelativeRepoPath": "tales-from-fleet-security-github-configuration-and-openssf-scorecards.md",
+        "meta": {
+          "category": "security",
+          "authorFullName": "Guillaume Ross",
+          "authorGitHubUsername": "GuillaumeRoss",
+          "publishedOn": "2022-04-15",
+          "articleTitle": "Tales from Fleet security: GitHub configuration and OpenSSF Scorecards",
+          "articleImageUrl": "/images/articles/tales-from-fleet-security-github-configuration-and-openssf-scorecards-cover-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/securing/tales-from-fleet-security-google-groups-scams",
+        "title": "Tales from Fleet security google groups scams",
+        "lastModifiedAt": 1726839805195,
+        "htmlId": "articles--tales-from-fleet-sec--841598a71f",
+        "sectionRelativeRepoPath": "tales-from-fleet-security-google-groups-scams.md",
+        "meta": {
+          "category": "security",
+          "authorFullName": "Guillaume Ross",
+          "authorGitHubUsername": "GuillaumeRoss",
+          "publishedOn": "2022-08-05",
+          "articleTitle": "Tales from Fleet security: scams targeting Google Groups",
+          "articleImageUrl": "/images/articles/tales-from-fleet-security-google-groups-scams-cover-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/securing/tales-from-fleet-security-securing-1password",
+        "title": "Tales from Fleet security securing 1password",
+        "lastModifiedAt": 1726839805196,
+        "htmlId": "articles--tales-from-fleet-sec--d172f39898",
+        "sectionRelativeRepoPath": "tales-from-fleet-security-securing-1password.md",
+        "meta": {
+          "category": "security",
+          "authorFullName": "Guillaume Ross",
+          "authorGitHubUsername": "GuillaumeRoss",
+          "publishedOn": "2022-05-06",
+          "articleTitle": "Tales from Fleet security: securing 1Password",
+          "articleImageUrl": "/images/articles/tales-from-fleet-security-securing-1password-cover-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/securing/tales-from-fleet-security-securing-bank-accounts-from-business-email-compromise",
+        "title": "Tales from Fleet security securing bank accounts from business email compromise",
+        "lastModifiedAt": 1726839805198,
+        "htmlId": "articles--tales-from-fleet-sec--f60a0becab",
+        "sectionRelativeRepoPath": "tales-from-fleet-security-securing-bank-accounts-from-business-email-compromise.md",
+        "meta": {
+          "category": "security",
+          "authorFullName": "Guillaume Ross",
+          "authorGitHubUsername": "GuillaumeRoss",
+          "publishedOn": "2022-07-15",
+          "articleTitle": "Tales from Fleet security: securing bank accounts from business email compromise",
+          "articleImageUrl": "/images/articles/securing-bank-accounts-from-business-email-compromise-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/securing/tales-from-fleet-security-securing-google-workspace",
+        "title": "Tales from Fleet security securing google workspace",
+        "lastModifiedAt": 1726839805199,
+        "htmlId": "articles--tales-from-fleet-sec--72efc9f80f",
+        "sectionRelativeRepoPath": "tales-from-fleet-security-securing-google-workspace.md",
+        "meta": {
+          "category": "security",
+          "authorFullName": "Guillaume Ross",
+          "authorGitHubUsername": "GuillaumeRoss",
+          "publishedOn": "2022-03-25",
+          "articleTitle": "Tales from Fleet security: securing Google Workspace",
+          "articleImageUrl": "/images/articles/tales-from-fleet-security-securing-google-workspace-cover-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/securing/tales-from-fleet-security-securing-the-startup",
+        "title": "Tales from Fleet security securing the startup",
+        "lastModifiedAt": 1726839805200,
+        "htmlId": "articles--tales-from-fleet-sec--a25132f487",
+        "sectionRelativeRepoPath": "tales-from-fleet-security-securing-the-startup.md",
+        "meta": {
+          "category": "security",
+          "authorFullName": "Guillaume Ross",
+          "authorGitHubUsername": "GuillaumeRoss",
+          "publishedOn": "2022-03-17",
+          "articleTitle": "Tales from Fleet security: securing the startup",
+          "articleImageUrl": "/images/articles/tales-from-fleet-security-securing-the-startup-cover-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/securing/tales-from-fleet-security-soc2",
+        "title": "Tales from Fleet security soc2",
+        "lastModifiedAt": 1726839805202,
+        "htmlId": "articles--tales-from-fleet-sec--f537169e1e",
+        "sectionRelativeRepoPath": "tales-from-fleet-security-soc2.md",
+        "meta": {
+          "category": "security",
+          "authorGitHubUsername": "GuillaumeRoss",
+          "authorFullName": "Guillaume Ross",
+          "publishedOn": "2022-06-24",
+          "articleTitle": "Tales from Fleet security: how we achieved our SOC 2 type 1 rapidly",
+          "articleImageUrl": "/images/articles/tales-from-fleet-soc2-type1-report-cover-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/securing/tales-from-fleet-security-speeding-up-macos-updates-with-nudge",
+        "title": "Tales from Fleet security speeding up macos updates with nudge",
+        "lastModifiedAt": 1726839805203,
+        "htmlId": "articles--tales-from-fleet-sec--41bc496d3c",
+        "sectionRelativeRepoPath": "tales-from-fleet-security-speeding-up-macos-updates-with-nudge.md",
+        "meta": {
+          "category": "security",
+          "authorFullName": "Guillaume Ross",
+          "authorGitHubUsername": "GuillaumeRoss",
+          "publishedOn": "2022-07-05",
+          "articleTitle": "Tales from Fleet security: speeding up macOS updates with Nudge",
+          "articleImageUrl": "/images/articles/tales-from-fleet-nudge-cover-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/guides/teams",
+        "title": "Teams",
+        "lastModifiedAt": 1726839805204,
+        "htmlId": "articles--teams--a6aba53335",
+        "sectionRelativeRepoPath": "teams.md",
+        "meta": {
+          "category": "guides",
+          "authorGitHubUsername": "noahtalerman",
+          "authorFullName": "Noah Talerman",
+          "publishedOn": "2024-07-11",
+          "articleTitle": "Teams",
+          "description": "Learn how to group hosts in Fleet to apply specific queries, policies, and agent options using teams."
+        }
+      },
+      {
+        "url": "/announcements/the-device-security-tightrope-balancing-cost-and-protection-in-k-12-schools",
+        "title": "The device security tightrope balancing cost and protection in k 12 schools",
+        "lastModifiedAt": 1726839805205,
+        "htmlId": "articles--the-device-security---cba806f3e1",
+        "sectionRelativeRepoPath": "the-device-security-tightrope-balancing-cost-and-protection-in-K-12-schools.md",
+        "meta": {
+          "category": "announcements",
+          "authorFullName": "Keith Barnes",
+          "authorGitHubUsername": "KAB703",
+          "publishedOn": "2024-03-01",
+          "articleTitle": "The device security tightrope: balancing cost and protection in K-12 schools",
+          "articleImageUrl": "/images/articles/the-device-security-tightrope-balancing-cost-and-protection-in-K-12-schools-1600x900@2x.png"
+        }
+      },
+      {
+        "url": "/podcasts/the-future-of-device-management-ep1",
+        "title": "The future of device management ep1",
+        "lastModifiedAt": 1726839805207,
+        "htmlId": "articles--the-future-of-device--e424a67517",
+        "sectionRelativeRepoPath": "the-future-of-device-management-ep1.md",
+        "meta": {
+          "category": "podcasts",
+          "authorGitHubUsername": "zwass",
+          "authorFullName": "Zach Wasserman",
+          "publishedOn": "2022-06-06",
+          "articleTitle": "Future of device management episode 1",
+          "articleImageUrl": "/images/articles/future-of-device-management-ep1-cover-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/podcasts/the-future-of-device-management-ep2",
+        "title": "The future of device management ep2",
+        "lastModifiedAt": 1726839805208,
+        "htmlId": "articles--the-future-of-device--0b4ec299db",
+        "sectionRelativeRepoPath": "the-future-of-device-management-ep2.md",
+        "meta": {
+          "category": "podcasts",
+          "authorGitHubUsername": "zwass",
+          "authorFullName": "Zach Wasserman",
+          "publishedOn": "2022-06-30",
+          "articleTitle": "Future of device management episode 2",
+          "articleImageUrl": "/images/articles/future-of-device-management-ep2-cover-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/podcasts/the-future-of-device-management-ep3",
+        "title": "The future of device management ep3",
+        "lastModifiedAt": 1726839805209,
+        "htmlId": "articles--the-future-of-device--d7b8d1fbfe",
+        "sectionRelativeRepoPath": "the-future-of-device-management-ep3.md",
+        "meta": {
+          "category": "podcasts",
+          "authorGitHubUsername": "zwass",
+          "authorFullName": "Zach Wasserman",
+          "publishedOn": "2022-07-21",
+          "articleTitle": "Future of device management episode 3",
+          "articleImageUrl": "/images/articles/future-of-device-management-ep3-cover-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/podcasts/the-future-of-device-management-ep4",
+        "title": "The future of device management ep4",
+        "lastModifiedAt": 1726839805210,
+        "htmlId": "articles--the-future-of-device--bd6c88c590",
+        "sectionRelativeRepoPath": "the-future-of-device-management-ep4.md",
+        "meta": {
+          "category": "podcasts",
+          "authorGitHubUsername": "zwass",
+          "authorFullName": "Zach Wasserman",
+          "publishedOn": "2022-08-12",
+          "articleTitle": "Future of device management episode 4",
+          "articleImageUrl": "/images/articles/future-of-device-management-ep4-cover-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/podcasts/the-future-of-device-management-ep5",
+        "title": "The future of device management ep5",
+        "lastModifiedAt": 1726839805210,
+        "htmlId": "articles--the-future-of-device--c5ce4719fa",
+        "sectionRelativeRepoPath": "the-future-of-device-management-ep5.md",
+        "meta": {
+          "category": "podcasts",
+          "authorGitHubUsername": "zwass",
+          "authorFullName": "Zach Wasserman",
+          "publishedOn": "2022-09-01",
+          "articleTitle": "Future of device management episode 5",
+          "articleImageUrl": "/images/articles/future-of-device-management-ep5-cover-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/podcasts/the-future-of-device-management-ep6",
+        "title": "The future of device management ep6",
+        "lastModifiedAt": 1726839805211,
+        "htmlId": "articles--the-future-of-device--141153d341",
+        "sectionRelativeRepoPath": "the-future-of-device-management-ep6.md",
+        "meta": {
+          "category": "podcasts",
+          "authorGitHubUsername": "zwass",
+          "authorFullName": "Zach Wasserman",
+          "publishedOn": "2022-09-23",
+          "articleTitle": "Future of device management episode 6",
+          "articleImageUrl": "/images/articles/future-of-device-management-ep6-cover-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/podcasts/the-future-of-device-management-ep7",
+        "title": "The future of device management ep7",
+        "lastModifiedAt": 1726839805212,
+        "htmlId": "articles--the-future-of-device--52a1db0bde",
+        "sectionRelativeRepoPath": "the-future-of-device-management-ep7.md",
+        "meta": {
+          "category": "podcasts",
+          "authorGitHubUsername": "zwass",
+          "authorFullName": "Zach Wasserman",
+          "publishedOn": "2022-11-03",
+          "articleTitle": "Future of device management episode 7",
+          "articleImageUrl": "/images/articles/future-of-device-management-ep7-cover-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/guides/understanding-the-intricacies-of-fleet-policies",
+        "title": "Understanding the intricacies of Fleet policies",
+        "lastModifiedAt": 1726839805213,
+        "htmlId": "articles--understanding-the-in--edae4ca064",
+        "sectionRelativeRepoPath": "understanding-the-intricacies-of-fleet-policies.md",
+        "meta": {
+          "articleTitle": "Understanding the intricacies of Fleet policies",
+          "authorFullName": "Victor Lyuboslavsky",
+          "authorGitHubUsername": "getvictor",
+          "category": "guides",
+          "publishedOn": "2023-12-29",
+          "description": "Learn how Fleet policies work behind the scenes."
+        }
+      },
+      {
+        "url": "/guides/using-elasticsearch-and-kibana-to-visualize-osquery-performance",
+        "title": "Using elasticsearch and kibana to visualize osquery performance",
+        "lastModifiedAt": 1726839805215,
+        "htmlId": "articles--using-elasticsearch---55019ee35a",
+        "sectionRelativeRepoPath": "using-elasticsearch-and-kibana-to-visualize-osquery-performance.md",
+        "meta": {
+          "category": "guides",
+          "authorFullName": "Zach Wasserman",
+          "authorGitHubUsername": "zwass",
+          "publishedOn": "2021-05-26",
+          "articleTitle": "Using Elasticsearch and Kibana to visualize osquery performance",
+          "articleImageUrl": "/images/articles/using-elasticsearch-and-kibana-to-visualize-osquery-performance-cover-700x393@2x.jpeg"
+        }
+      },
+      {
+        "url": "/guides/using-fleet-and-okta-workflows-to-generate-a-daily-os-report",
+        "title": "Using Fleet and okta workflows to generate a daily os report",
+        "lastModifiedAt": 1726839805218,
+        "htmlId": "articles--using-fleet-and-okta--a4676a8577",
+        "sectionRelativeRepoPath": "using-fleet-and-okta-workflows-to-generate-a-daily-os-report.md",
+        "meta": {
+          "articleTitle": "Using Fleet and Okta Workflows to generate a daily OS report",
+          "authorFullName": "Harrison Ravazzolo",
+          "authorGitHubUsername": "harrisonravazzolo",
+          "category": "guides",
+          "publishedOn": "2023-05-09",
+          "articleImageUrl": "/images/articles/using-fleet-and-okta-workflows-to-generate-a-daily-os-report@2x.jpg",
+          "description": "Learn how to use Fleet to query device OS information through the Fleet REST API and automate daily Slack notifications using Okta Workflows."
+        }
+      },
+      {
+        "url": "/guides/using-fleet-and-tines-together",
+        "title": "Using Fleet and tines together",
+        "lastModifiedAt": 1726839805219,
+        "htmlId": "articles--using-fleet-and-tine--3606f85672",
+        "sectionRelativeRepoPath": "using-fleet-and-tines-together.md",
+        "meta": {
+          "category": "guides",
+          "authorFullName": "Dave Herder",
+          "authorGitHubUsername": "dherder",
+          "publishedOn": "2023-03-08",
+          "articleTitle": "Using Fleet and Tines together",
+          "articleImageUrl": "/images/articles/using-fleet-and-tines-together-1600x900@2x.png"
+        }
+      },
+      {
+        "url": "/guides/using-github-actions-to-apply-configuration-profiles-with-fleet",
+        "title": "Using github actions to apply configuration profiles with Fleet",
+        "lastModifiedAt": 1726839805220,
+        "htmlId": "articles--using-github-actions--d966ed0177",
+        "sectionRelativeRepoPath": "using-github-actions-to-apply-configuration-profiles-with-fleet.md",
+        "meta": {
+          "articleTitle": "Using GitHub Actions to apply configuration profiles with Fleet",
+          "authorFullName": "JD Strong",
+          "authorGitHubUsername": "spokanemac",
+          "category": "guides",
+          "publishedOn": "2023-05-31",
+          "articleImageUrl": "/images/articles/using-github-actions-to-apply-configuration-profiles-with-fleet@2x.jpg",
+          "description": "A guide on using GitHub Actions with Fleet for efficient and automated application of the latest configuration profiles for a GitOps workflow."
+        }
+      },
+      {
+        "url": "/securing/vulnerability-management-the-advantages-of-fleet-to-support-government-agencies",
+        "title": "Vulnerability management the advantages of Fleet to support government agencies",
+        "lastModifiedAt": 1726839805221,
+        "htmlId": "articles--vulnerability-manage--fae19ad566",
+        "sectionRelativeRepoPath": "vulnerability-management-the-advantages-of-fleet-to-support-government-agencies.md",
+        "meta": {
+          "category": "security",
+          "authorFullName": "Keith Barnes",
+          "authorGitHubUsername": "KAB703",
+          "publishedOn": "2023-12-26",
+          "articleTitle": "Vulnerability management: advantages of Fleet to support government agencies",
+          "articleImageUrl": "/images/articles/vulnerability-management-advantages-of-fleet-to-support-government-agencies-1600x900@2x.png"
+        }
+      },
+      {
+        "url": "/guides/vulnerability-processing",
+        "title": "Vulnerability processing",
+        "lastModifiedAt": 1726839805222,
+        "htmlId": "articles--vulnerability-proces--244a2b70ee",
+        "sectionRelativeRepoPath": "vulnerability-processing.md",
+        "meta": {
+          "category": "guides",
+          "authorGitHubUsername": "noahtalerman",
+          "authorFullName": "Noah Talerman",
+          "publishedOn": "2024-07-12",
+          "articleTitle": "Vulnerability processing",
+          "description": "Find out how Fleet detects vulnerabilities and what software it covers."
+        }
+      },
+      {
+        "url": "/guides/what-api-endpoints-to-expose-to-the-public-internet",
+        "title": "What API endpoints to expose to the public internet",
+        "lastModifiedAt": 1726839805223,
+        "htmlId": "articles--what-api-endpoints-t--cd0552d444",
+        "sectionRelativeRepoPath": "what-api-endpoints-to-expose-to-the-public-internet.md",
+        "meta": {
+          "category": "guides",
+          "authorGitHubUsername": "mike-j-thomas",
+          "authorFullName": "Mike Thomas",
+          "publishedOn": "2023-11-13",
+          "articleTitle": "Which API endpoints to expose to the public internet?"
+        }
+      },
+      {
+        "url": "/securing/what-are-fleet-policies",
+        "title": "What are Fleet policies",
+        "lastModifiedAt": 1726839805224,
+        "htmlId": "articles--what-are-fleet-polic--d8ca2da611",
+        "sectionRelativeRepoPath": "what-are-fleet-policies.md",
+        "meta": {
+          "category": "security",
+          "authorGitHubUsername": "Drew-P-drawers",
+          "authorFullName": "Andrew Baker",
+          "publishedOn": "2022-05-20",
+          "articleTitle": "What are Fleet policies?",
+          "articleImageUrl": "/images/articles/what-are-fleet-policies-cover-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/guides/windows-mdm-setup",
+        "title": "Windows mdm setup",
+        "lastModifiedAt": 1726839805226,
+        "htmlId": "articles--windows-mdm-setup--ebf4ebf0ba",
+        "sectionRelativeRepoPath": "windows-mdm-setup.md",
+        "meta": {
+          "articleTitle": "Windows MDM setup",
+          "authorFullName": "Noah Talerman",
+          "authorGitHubUsername": "noahtalerman",
+          "category": "guides",
+          "publishedOn": "2023-10-23",
+          "articleImageUrl": "/images/articles/windows-mdm-fleet-1600x900@2x.png",
+          "description": "Configuring Windows MDM in Fleet."
+        }
+      },
+      {
+        "url": "/guides/zero-trust-attestation-with-fleet",
+        "title": "Zero trust attestation with Fleet",
+        "lastModifiedAt": 1726839805227,
+        "htmlId": "articles--zero-trust-attestati--b892a54252",
+        "sectionRelativeRepoPath": "zero-trust-attestation-with-fleet.md",
+        "meta": {
+          "articleTitle": "How to use Fleet for zero trust attestation",
+          "authorFullName": "Mo Zhu",
+          "authorGitHubUsername": "zhumo",
+          "category": "guides",
+          "publishedOn": "2022-10-14",
+          "articleImageUrl": "/images/articles/fleet-for-zero-trust-attestation-800x450@2x.jpg"
+        }
+      },
+      {
+        "url": "/securing/work-may-be-watching-but-it-might-not-be-as-bad-as-you-think",
+        "title": "Work may be watching but it might not be as bad as you think",
+        "lastModifiedAt": 1726839805227,
+        "htmlId": "articles--work-may-be-watching--420e065d2f",
+        "sectionRelativeRepoPath": "work-may-be-watching-but-it-might-not-be-as-bad-as-you-think.md",
+        "meta": {
+          "category": "security",
+          "authorFullName": "Mike Thomas",
+          "authorGitHubUsername": "mike-j-thomas",
+          "publishedOn": "2021-10-22",
+          "articleTitle": "Work may be watching, but it might not be as bad as you think.",
+          "articleImageUrl": "/images/articles/work-may-be-watching-but-it-might-not-be-as-bad-as-you-think-cover-1600x900@2x.jpg"
+        }
+      },
+      {
+        "url": "/handbook/company/open-positions/software-engineer",
+        "title": "🚀 Software Engineer",
+        "lastModifiedAt": 1726839805228,
+        "htmlId": "handbook--software-engineer--be50029cfb",
+        "sectionRelativeRepoPath": "company/open-positions.yml",
+        "meta": {
+          "maintainedBy": "LukeHeath"
+        }
+      },
+      {
+        "url": "/handbook/company/open-positions/account-executive",
+        "title": "🐋 Account Executive",
+        "lastModifiedAt": 1726839805228,
+        "htmlId": "handbook--account-executive--d5def7dc8f",
+        "sectionRelativeRepoPath": "company/open-positions.yml",
+        "meta": {
+          "maintainedBy": "alexmitchelliii"
+        }
+      },
+      {
+        "url": "/tables/account_policy_data",
+        "title": "account_policy_data",
+        "htmlId": "table--accountpolicydata--31df68b22b",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "account_policy_data",
+          "creation_time",
+          "failed_login_count",
+          "failed_login_timestamp",
+          "password_last_set_time",
+          "uid"
+        ],
+        "sectionRelativeRepoPath": "account_policy_data",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/account_policy_data.yml"
+      },
+      {
+        "url": "/tables/ad_config",
+        "title": "ad_config",
+        "htmlId": "table--adconfig--39d2211d09",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "ad_config",
+          "domain",
+          "name",
+          "option",
+          "value"
+        ],
+        "sectionRelativeRepoPath": "ad_config",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/ad_config.yml"
+      },
+      {
+        "url": "/tables/alf",
+        "title": "alf",
+        "htmlId": "table--alf--4c28031b0f",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "alf",
+          "allow_signed_enabled",
+          "firewall_unload",
+          "global_state",
+          "logging_enabled",
+          "logging_option",
+          "stealth_enabled",
+          "version"
+        ],
+        "sectionRelativeRepoPath": "alf",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/alf.yml"
+      },
+      {
+        "url": "/tables/alf_exceptions",
+        "title": "alf_exceptions",
+        "htmlId": "table--alfexceptions--1fbd2a6157",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "alf_exceptions",
+          "path",
+          "state"
+        ],
+        "sectionRelativeRepoPath": "alf_exceptions",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/alf_exceptions.yml"
+      },
+      {
+        "url": "/tables/alf_explicit_auths",
+        "title": "alf_explicit_auths",
+        "htmlId": "table--alfexplicitauths--4b47436520",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "alf_explicit_auths",
+          "process"
+        ],
+        "sectionRelativeRepoPath": "alf_explicit_auths",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/alf_explicit_auths.yml"
+      },
+      {
+        "url": "/tables/apfs_physical_stores",
+        "title": "apfs_physical_stores",
+        "htmlId": "table--apfsphysicalstores--30af4e1d13",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "apfs_physical_stores",
+          "container_capacity_ceiling",
+          "container_capacity_free",
+          "container_designated_physical_store",
+          "container_fusion",
+          "container_reference",
+          "container_uuid",
+          "identifier",
+          "size",
+          "uuid"
+        ],
+        "sectionRelativeRepoPath": "apfs_physical_stores",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/apfs_physical_stores.yml"
+      },
+      {
+        "url": "/tables/apfs_volumes",
+        "title": "apfs_volumes",
+        "htmlId": "table--apfsvolumes--d8e8cc281d",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "apfs_volumes",
+          "capacity_in_use",
+          "capacity_quota",
+          "capacity_reserve",
+          "container_capacity_ceiling",
+          "container_capacity_free",
+          "container_designated_physical_store",
+          "container_fusion",
+          "container_reference",
+          "container_uuid",
+          "crypto_migration_on",
+          "device_identifier",
+          "encryption",
+          "filevault",
+          "locked",
+          "name",
+          "role",
+          "uuid"
+        ],
+        "sectionRelativeRepoPath": "apfs_volumes",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/apfs_volumes.yml"
+      },
+      {
+        "url": "/tables/app_icons",
+        "title": "app_icons",
+        "htmlId": "table--appicons--93bed0002f",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "app_icons",
+          "hash",
+          "icon",
+          "path"
+        ],
+        "sectionRelativeRepoPath": "app_icons",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/app_icons.yml"
+      },
+      {
+        "url": "/tables/app_schemes",
+        "title": "app_schemes",
+        "htmlId": "table--appschemes--e75c685f8d",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "app_schemes",
+          "enabled",
+          "external",
+          "handler",
+          "protected",
+          "scheme"
+        ],
+        "sectionRelativeRepoPath": "app_schemes",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/app_schemes.yml"
+      },
+      {
+        "url": "/tables/apparmor_events",
+        "title": "apparmor_events",
+        "htmlId": "table--apparmorevents--1b9b1af186",
+        "evented": true,
+        "platforms": [
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "apparmor_events",
+          "apparmor",
+          "capability",
+          "capname",
+          "comm",
+          "denied_mask",
+          "eid",
+          "error",
+          "fsuid",
+          "info",
+          "label",
+          "message",
+          "name",
+          "namespace",
+          "operation",
+          "ouid",
+          "parent",
+          "pid",
+          "profile",
+          "requested_mask",
+          "time",
+          "type",
+          "uptime"
+        ],
+        "sectionRelativeRepoPath": "apparmor_events",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fapparmor_events.yml&value=name%3A%20apparmor_events%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/apparmor_profiles",
+        "title": "apparmor_profiles",
+        "htmlId": "table--apparmorprofiles--49f0f69437",
+        "evented": false,
+        "platforms": [
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "apparmor_profiles",
+          "attach",
+          "mode",
+          "name",
+          "path",
+          "sha1"
+        ],
+        "sectionRelativeRepoPath": "apparmor_profiles",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fapparmor_profiles.yml&value=name%3A%20apparmor_profiles%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/appcompat_shims",
+        "title": "appcompat_shims",
+        "htmlId": "table--appcompatshims--33b5da402f",
+        "evented": false,
+        "platforms": [
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "appcompat_shims",
+          "description",
+          "executable",
+          "install_time",
+          "path",
+          "sdb_id",
+          "type"
+        ],
+        "sectionRelativeRepoPath": "appcompat_shims",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fappcompat_shims.yml&value=name%3A%20appcompat_shims%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/apps",
+        "title": "apps",
+        "htmlId": "table--apps--ccdee150a9",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "apps",
+          "applescript_enabled",
+          "bundle_executable",
+          "bundle_identifier",
+          "bundle_name",
+          "bundle_package_type",
+          "bundle_short_version",
+          "bundle_version",
+          "category",
+          "compiler",
+          "copyright",
+          "development_region",
+          "display_name",
+          "element",
+          "environment",
+          "info_string",
+          "last_opened_time",
+          "minimum_system_version",
+          "name",
+          "path"
+        ],
+        "sectionRelativeRepoPath": "apps",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/apps.yml"
+      },
+      {
+        "url": "/tables/apt_sources",
+        "title": "apt_sources",
+        "htmlId": "table--aptsources--a209051a90",
+        "evented": false,
+        "platforms": [
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "apt_sources",
+          "architectures",
+          "base_uri",
+          "components",
+          "maintainer",
+          "name",
+          "pid_with_namespace",
+          "release",
+          "source",
+          "version"
+        ],
+        "sectionRelativeRepoPath": "apt_sources",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/apt_sources.yml"
+      },
+      {
+        "url": "/tables/arp_cache",
+        "title": "arp_cache",
+        "htmlId": "table--arpcache--83f95510b6",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux",
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "arp_cache",
+          "address",
+          "interface",
+          "mac",
+          "permanent"
+        ],
+        "sectionRelativeRepoPath": "arp_cache",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/arp_cache.yml"
+      },
+      {
+        "url": "/tables/asl",
+        "title": "asl",
+        "htmlId": "table--asl--d2accdbfe3",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "asl",
+          "extra",
+          "facility",
+          "gid",
+          "host",
+          "level",
+          "message",
+          "pid",
+          "ref_pid",
+          "ref_proc",
+          "sender",
+          "time",
+          "time_nano_sec",
+          "uid"
+        ],
+        "sectionRelativeRepoPath": "asl",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/asl.yml"
+      },
+      {
+        "url": "/tables/augeas",
+        "title": "augeas",
+        "htmlId": "table--augeas--b316cda7a7",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "augeas",
+          "label",
+          "node",
+          "path",
+          "value"
+        ],
+        "sectionRelativeRepoPath": "augeas",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/augeas.yml"
+      },
+      {
+        "url": "/tables/authdb",
+        "title": "authdb",
+        "htmlId": "table--authdb--a304d751e5",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "authdb",
+          "json_result",
+          "right_name"
+        ],
+        "sectionRelativeRepoPath": "authdb",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/authdb.yml"
+      },
+      {
+        "url": "/tables/authenticode",
+        "title": "authenticode",
+        "htmlId": "table--authenticode--0de9da48eb",
+        "evented": false,
+        "platforms": [
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "authenticode",
+          "issuer_name",
+          "original_program_name",
+          "path",
+          "result",
+          "serial_number",
+          "subject_name"
+        ],
+        "sectionRelativeRepoPath": "authenticode",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fauthenticode.yml&value=name%3A%20authenticode%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/authorization_mechanisms",
+        "title": "authorization_mechanisms",
+        "htmlId": "table--authorizationmechanisms--d2490cb436",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "authorization_mechanisms",
+          "entry",
+          "label",
+          "mechanism",
+          "plugin",
+          "privileged"
+        ],
+        "sectionRelativeRepoPath": "authorization_mechanisms",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/authorization_mechanisms.yml"
+      },
+      {
+        "url": "/tables/authorizations",
+        "title": "authorizations",
+        "htmlId": "table--authorizations--7fb6b733e8",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "authorizations",
+          "allow_root",
+          "authenticate_user",
+          "class",
+          "comment",
+          "created",
+          "label",
+          "modified",
+          "session_owner",
+          "shared",
+          "timeout",
+          "tries",
+          "version"
+        ],
+        "sectionRelativeRepoPath": "authorizations",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/authorizations.yml"
+      },
+      {
+        "url": "/tables/authorized_keys",
+        "title": "authorized_keys",
+        "htmlId": "table--authorizedkeys--5108700dee",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "authorized_keys",
+          "algorithm",
+          "comment",
+          "key",
+          "key_file",
+          "options",
+          "pid_with_namespace",
+          "uid"
+        ],
+        "sectionRelativeRepoPath": "authorized_keys",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/authorized_keys.yml"
+      },
+      {
+        "url": "/tables/autoexec",
+        "title": "autoexec",
+        "htmlId": "table--autoexec--ab98111b94",
+        "evented": false,
+        "platforms": [
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "autoexec",
+          "name",
+          "path",
+          "source"
+        ],
+        "sectionRelativeRepoPath": "autoexec",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fautoexec.yml&value=name%3A%20autoexec%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/azure_instance_metadata",
+        "title": "azure_instance_metadata",
+        "htmlId": "table--azureinstancemetadata--01df1dde23",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux",
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "azure_instance_metadata",
+          "location",
+          "name",
+          "offer",
+          "os_type",
+          "placement_group_id",
+          "platform_fault_domain",
+          "platform_update_domain",
+          "publisher",
+          "resource_group_name",
+          "sku",
+          "subscription_id",
+          "version",
+          "vm_id",
+          "vm_scale_set_name",
+          "vm_size",
+          "zone"
+        ],
+        "sectionRelativeRepoPath": "azure_instance_metadata",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/azure_instance_metadata.yml"
+      },
+      {
+        "url": "/tables/azure_instance_tags",
+        "title": "azure_instance_tags",
+        "htmlId": "table--azureinstancetags--166e2b6f18",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux",
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "azure_instance_tags",
+          "key",
+          "value",
+          "vm_id"
+        ],
+        "sectionRelativeRepoPath": "azure_instance_tags",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/azure_instance_tags.yml"
+      },
+      {
+        "url": "/tables/background_activities_moderator",
+        "title": "background_activities_moderator",
+        "htmlId": "table--backgroundactivitiesmoderator--12072ab407",
+        "evented": false,
+        "platforms": [
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "background_activities_moderator",
+          "last_execution_time",
+          "path",
+          "sid"
+        ],
+        "sectionRelativeRepoPath": "background_activities_moderator",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fbackground_activities_moderator.yml&value=name%3A%20background_activities_moderator%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/battery",
+        "title": "battery",
+        "htmlId": "table--battery--e54a7e368b",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "battery",
+          "amperage",
+          "charged",
+          "charging",
+          "chemistry",
+          "condition",
+          "current_capacity",
+          "cycle_count",
+          "designed_capacity",
+          "health",
+          "manufacture_date",
+          "manufacturer",
+          "max_capacity",
+          "minutes_to_full_charge",
+          "minutes_until_empty",
+          "model",
+          "percent_remaining",
+          "serial_number",
+          "state",
+          "voltage"
+        ],
+        "sectionRelativeRepoPath": "battery",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/battery.yml"
+      },
+      {
+        "url": "/tables/bitlocker_info",
+        "title": "bitlocker_info",
+        "htmlId": "table--bitlockerinfo--277b4f7713",
+        "evented": false,
+        "platforms": [
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "bitlocker_info",
+          "conversion_status",
+          "device_id",
+          "drive_letter",
+          "encryption_method",
+          "lock_status",
+          "percentage_encrypted",
+          "persistent_volume_id",
+          "protection_status",
+          "version"
+        ],
+        "sectionRelativeRepoPath": "bitlocker_info",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/bitlocker_info.yml"
+      },
+      {
+        "url": "/tables/block_devices",
+        "title": "block_devices",
+        "htmlId": "table--blockdevices--3db1d23d7b",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "block_devices",
+          "block_size",
+          "label",
+          "model",
+          "name",
+          "parent",
+          "size",
+          "type",
+          "uuid",
+          "vendor"
+        ],
+        "sectionRelativeRepoPath": "block_devices",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/block_devices.yml"
+      },
+      {
+        "url": "/tables/bpf_process_events",
+        "title": "bpf_process_events",
+        "htmlId": "table--bpfprocessevents--f98d50f0c4",
+        "evented": true,
+        "platforms": [
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "bpf_process_events",
+          "cid",
+          "cmdline",
+          "cwd",
+          "duration",
+          "eid",
+          "exit_code",
+          "gid",
+          "json_cmdline",
+          "ntime",
+          "parent",
+          "path",
+          "pid",
+          "probe_error",
+          "syscall",
+          "tid",
+          "time",
+          "uid"
+        ],
+        "sectionRelativeRepoPath": "bpf_process_events",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fbpf_process_events.yml&value=name%3A%20bpf_process_events%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/bpf_socket_events",
+        "title": "bpf_socket_events",
+        "htmlId": "table--bpfsocketevents--2bbe58be1b",
+        "evented": true,
+        "platforms": [
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "bpf_socket_events",
+          "cid",
+          "duration",
+          "eid",
+          "exit_code",
+          "family",
+          "fd",
+          "gid",
+          "local_address",
+          "local_port",
+          "ntime",
+          "parent",
+          "path",
+          "pid",
+          "probe_error",
+          "protocol",
+          "remote_address",
+          "remote_port",
+          "syscall",
+          "tid",
+          "time",
+          "type",
+          "uid"
+        ],
+        "sectionRelativeRepoPath": "bpf_socket_events",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fbpf_socket_events.yml&value=name%3A%20bpf_socket_events%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/carbon_black_info",
+        "title": "carbon_black_info",
+        "htmlId": "table--carbonblackinfo--1a7333701d",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux",
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "carbon_black_info",
+          "binary_queue",
+          "collect_cross_processes",
+          "collect_data_file_writes",
+          "collect_emet_events",
+          "collect_file_mods",
+          "collect_module_info",
+          "collect_module_loads",
+          "collect_net_conns",
+          "collect_process_user_context",
+          "collect_processes",
+          "collect_reg_mods",
+          "collect_sensor_operations",
+          "collect_store_files",
+          "config_name",
+          "event_queue",
+          "log_file_disk_quota_mb",
+          "log_file_disk_quota_percentage",
+          "protection_disabled",
+          "sensor_backend_server",
+          "sensor_id",
+          "sensor_ip_addr"
+        ],
+        "sectionRelativeRepoPath": "carbon_black_info",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/carbon_black_info.yml"
+      },
+      {
+        "url": "/tables/carves",
+        "title": "carves",
+        "htmlId": "table--carves--faab2a865e",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux",
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "carves",
+          "carve",
+          "carve_guid",
+          "path",
+          "request_id",
+          "sha256",
+          "size",
+          "status",
+          "time"
+        ],
+        "sectionRelativeRepoPath": "carves",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fcarves.yml&value=name%3A%20carves%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/certificates",
+        "title": "certificates",
+        "htmlId": "table--certificates--e853dcf612",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux",
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "certificates",
+          "authority_key_id",
+          "ca",
+          "common_name",
+          "issuer",
+          "issuer2",
+          "key_algorithm",
+          "key_strength",
+          "key_usage",
+          "not_valid_after",
+          "not_valid_before",
+          "path",
+          "self_signed",
+          "serial",
+          "sha1",
+          "sid",
+          "signing_algorithm",
+          "store",
+          "store_id",
+          "store_location",
+          "subject",
+          "subject2",
+          "subject_key_id",
+          "username"
+        ],
+        "sectionRelativeRepoPath": "certificates",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/certificates.yml"
+      },
+      {
+        "url": "/tables/chassis_info",
+        "title": "chassis_info",
+        "htmlId": "table--chassisinfo--b4f2a373fd",
+        "evented": false,
+        "platforms": [
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "chassis_info",
+          "audible_alarm",
+          "breach_description",
+          "chassis_types",
+          "description",
+          "lock",
+          "manufacturer",
+          "model",
+          "security_breach",
+          "serial",
+          "sku",
+          "smbios_tag",
+          "status",
+          "visible_alarm"
+        ],
+        "sectionRelativeRepoPath": "chassis_info",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fchassis_info.yml&value=name%3A%20chassis_info%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/chocolatey_packages",
+        "title": "chocolatey_packages",
+        "htmlId": "table--chocolateypackages--a948b45942",
+        "evented": false,
+        "platforms": [
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "chocolatey_packages",
+          "author",
+          "license",
+          "name",
+          "path",
+          "summary",
+          "version"
+        ],
+        "sectionRelativeRepoPath": "chocolatey_packages",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fchocolatey_packages.yml&value=name%3A%20chocolatey_packages%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/chrome_extension_content_scripts",
+        "title": "chrome_extension_content_scripts",
+        "htmlId": "table--chromeextensioncontentscripts--90dfc8f7b0",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux",
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "chrome_extension_content_scripts",
+          "browser_type",
+          "identifier",
+          "match",
+          "path",
+          "profile_path",
+          "referenced",
+          "script",
+          "uid",
+          "version"
+        ],
+        "sectionRelativeRepoPath": "chrome_extension_content_scripts",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/chrome_extension_content_scripts.yml"
+      },
+      {
+        "url": "/tables/chrome_extensions",
+        "title": "chrome_extensions",
+        "htmlId": "table--chromeextensions--0b832601b4",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "windows",
+          "linux",
+          "chrome"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "chrome_extensions",
+          "author",
+          "browser_type",
+          "current_locale",
+          "default_locale",
+          "description",
+          "from_webstore",
+          "identifier",
+          "install_time",
+          "install_timestamp",
+          "key",
+          "manifest_hash",
+          "manifest_json",
+          "name",
+          "optional_permissions",
+          "optional_permissions_json",
+          "path",
+          "permissions",
+          "permissions_json",
+          "persistent",
+          "profile",
+          "profile_path",
+          "referenced",
+          "referenced_identifier",
+          "state",
+          "uid",
+          "update_url",
+          "version"
+        ],
+        "sectionRelativeRepoPath": "chrome_extensions",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/chrome_extensions.yml"
+      },
+      {
+        "url": "/tables/cis_audit",
+        "title": "cis_audit",
+        "htmlId": "table--cisaudit--021dcf9746",
+        "evented": false,
+        "platforms": [
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "cis_audit",
+          "item",
+          "value"
+        ],
+        "sectionRelativeRepoPath": "cis_audit",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/cis_audit.yml"
+      },
+      {
+        "url": "/tables/connected_displays",
+        "title": "connected_displays",
+        "htmlId": "table--connecteddisplays--f57653bc5b",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "connected_displays",
+          "ambient_brightness_enabled",
+          "connection_type",
+          "display_id",
+          "display_type",
+          "main",
+          "manufactured_week",
+          "manufactured_year",
+          "mirror",
+          "name",
+          "online",
+          "pixels",
+          "product_id",
+          "resolution",
+          "rotation",
+          "serial_number",
+          "vendor_id"
+        ],
+        "sectionRelativeRepoPath": "connected_displays",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fconnected_displays.yml&value=name%3A%20connected_displays%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/connectivity",
+        "title": "connectivity",
+        "htmlId": "table--connectivity--9bd961f435",
+        "evented": false,
+        "platforms": [
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "connectivity",
+          "disconnected",
+          "ipv4_internet",
+          "ipv4_local_network",
+          "ipv4_no_traffic",
+          "ipv4_subnet",
+          "ipv6_internet",
+          "ipv6_local_network",
+          "ipv6_no_traffic",
+          "ipv6_subnet"
+        ],
+        "sectionRelativeRepoPath": "connectivity",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fconnectivity.yml&value=name%3A%20connectivity%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/corestorage_logical_volume_families",
+        "title": "corestorage_logical_volume_families",
+        "htmlId": "table--corestoragelogicalvolumefamilies--c844b6943f",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "corestorage_logical_volume_families",
+          "EncryptionStatus",
+          "EncryptionType",
+          "HasVisibleUsers",
+          "HasVolumeKey",
+          "IsAcceptingNewUsers",
+          "IsFullySecure",
+          "MayHaveEncryptedEvents",
+          "RequiresPasswordUnlock",
+          "UUID",
+          "vg_FreeSpace",
+          "vg_FusionDrive",
+          "vg_Name",
+          "vg_Sequence",
+          "vg_Size",
+          "vg_Sparse",
+          "vg_Status",
+          "vg_UUID",
+          "vg_Version"
+        ],
+        "sectionRelativeRepoPath": "corestorage_logical_volume_families",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/corestorage_logical_volume_families.yml"
+      },
+      {
+        "url": "/tables/corestorage_logical_volumes",
+        "title": "corestorage_logical_volumes",
+        "htmlId": "table--corestoragelogicalvolumes--b32c10c6c2",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "corestorage_logical_volumes",
+          "ContentHint",
+          "ConversionState",
+          "ConverstionProgressPercent",
+          "DesignatedPhysicalVolume",
+          "DesignatedPhysicalVolumeIdentifier",
+          "Identifier",
+          "Name",
+          "Sequence",
+          "Size",
+          "Status",
+          "UUID",
+          "Version",
+          "VolumeName",
+          "lvf_EncryptionStatus",
+          "lvf_EncryptionType",
+          "lvf_HasVisibleUsers",
+          "lvf_HasVolumeKey",
+          "lvf_IsAcceptingNewUsers",
+          "lvf_IsFullySecure",
+          "lvf_MayHaveEncryptedEvents",
+          "lvf_RequiresPasswordUnlock",
+          "lvf_UUID",
+          "vg_FreeSpace",
+          "vg_FusionDrive",
+          "vg_Name",
+          "vg_Sequence",
+          "vg_Size",
+          "vg_Sparse",
+          "vg_Status",
+          "vg_UUID",
+          "vg_Version"
+        ],
+        "sectionRelativeRepoPath": "corestorage_logical_volumes",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/corestorage_logical_volumes.yml"
+      },
+      {
+        "url": "/tables/cpu_info",
+        "title": "cpu_info",
+        "htmlId": "table--cpuinfo--aa3c0cfb0c",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux",
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "cpu_info",
+          "address_width",
+          "availability",
+          "cpu_status",
+          "current_clock_speed",
+          "device_id",
+          "load_percentage",
+          "logical_processors",
+          "manufacturer",
+          "max_clock_speed",
+          "model",
+          "number_of_cores",
+          "number_of_efficiency_cores",
+          "number_of_performance_cores",
+          "processor_type",
+          "socket_designation"
+        ],
+        "sectionRelativeRepoPath": "cpu_info",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/cpu_info.yml"
+      },
+      {
+        "url": "/tables/cpu_time",
+        "title": "cpu_time",
+        "htmlId": "table--cputime--8f68637ee3",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "cpu_time",
+          "core",
+          "guest",
+          "guest_nice",
+          "idle",
+          "iowait",
+          "irq",
+          "nice",
+          "softirq",
+          "steal",
+          "system",
+          "user"
+        ],
+        "sectionRelativeRepoPath": "cpu_time",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/cpu_time.yml"
+      },
+      {
+        "url": "/tables/cpuid",
+        "title": "cpuid",
+        "htmlId": "table--cpuid--68704a46e7",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux",
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "cpuid",
+          "feature",
+          "input_eax",
+          "output_bit",
+          "output_register",
+          "value"
+        ],
+        "sectionRelativeRepoPath": "cpuid",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/cpuid.yml"
+      },
+      {
+        "url": "/tables/crashes",
+        "title": "crashes",
+        "htmlId": "table--crashes--6bccea7c2f",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "crashes",
+          "crash_path",
+          "crashed_thread",
+          "datetime",
+          "exception_codes",
+          "exception_notes",
+          "exception_type",
+          "identifier",
+          "parent",
+          "path",
+          "pid",
+          "registers",
+          "responsible",
+          "stack_trace",
+          "type",
+          "uid",
+          "version"
+        ],
+        "sectionRelativeRepoPath": "crashes",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/crashes.yml"
+      },
+      {
+        "url": "/tables/crontab",
+        "title": "crontab",
+        "htmlId": "table--crontab--a8fe1b5316",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "crontab",
+          "command",
+          "day_of_month",
+          "day_of_week",
+          "event",
+          "hour",
+          "minute",
+          "month",
+          "path",
+          "pid_with_namespace"
+        ],
+        "sectionRelativeRepoPath": "crontab",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/crontab.yml"
+      },
+      {
+        "url": "/tables/cryptoinfo",
+        "title": "cryptoinfo",
+        "htmlId": "table--cryptoinfo--5e90627c08",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "windows",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "cryptoinfo",
+          "fullkey",
+          "key",
+          "parent",
+          "passphrase",
+          "path",
+          "query",
+          "value"
+        ],
+        "sectionRelativeRepoPath": "cryptoinfo",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/cryptoinfo.yml"
+      },
+      {
+        "url": "/tables/cryptsetup_status",
+        "title": "cryptsetup_status",
+        "htmlId": "table--cryptsetupstatus--3aa1264a26",
+        "evented": false,
+        "platforms": [
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "cryptsetup_status",
+          "fullkey",
+          "key",
+          "name",
+          "parent",
+          "query",
+          "value"
+        ],
+        "sectionRelativeRepoPath": "cryptsetup_status",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/cryptsetup_status.yml"
+      },
+      {
+        "url": "/tables/csrutil_info",
+        "title": "csrutil_info",
+        "htmlId": "table--csrutilinfo--959d823b8e",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "csrutil_info",
+          "ssv_enabled"
+        ],
+        "sectionRelativeRepoPath": "csrutil_info",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/csrutil_info.yml"
+      },
+      {
+        "url": "/tables/cups_destinations",
+        "title": "cups_destinations",
+        "htmlId": "table--cupsdestinations--8ccb3721f2",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "cups_destinations",
+          "name",
+          "option_name",
+          "option_value"
+        ],
+        "sectionRelativeRepoPath": "cups_destinations",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/cups_destinations.yml"
+      },
+      {
+        "url": "/tables/cups_jobs",
+        "title": "cups_jobs",
+        "htmlId": "table--cupsjobs--3268465efb",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "cups_jobs",
+          "completed_time",
+          "creation_time",
+          "destination",
+          "format",
+          "processing_time",
+          "size",
+          "title",
+          "user"
+        ],
+        "sectionRelativeRepoPath": "cups_jobs",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/cups_jobs.yml"
+      },
+      {
+        "url": "/tables/curl",
+        "title": "curl",
+        "htmlId": "table--curl--2ab03fa14d",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux",
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "curl",
+          "bytes",
+          "method",
+          "response_code",
+          "result",
+          "round_trip_time",
+          "url",
+          "user_agent"
+        ],
+        "sectionRelativeRepoPath": "curl",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/curl.yml"
+      },
+      {
+        "url": "/tables/curl_certificate",
+        "title": "curl_certificate",
+        "htmlId": "table--curlcertificate--6d52c798b0",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux",
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "curl_certificate",
+          "authority_key_identifier",
+          "basic_constraint",
+          "common_name",
+          "dump_certificate",
+          "extended_key_usage",
+          "has_expired",
+          "hostname",
+          "info_access",
+          "issuer_alternative_names",
+          "issuer_common_name",
+          "issuer_organization",
+          "issuer_organization_unit",
+          "key_usage",
+          "name_constraints",
+          "organization",
+          "organization_unit",
+          "pem",
+          "policies",
+          "policy_constraints",
+          "policy_mappings",
+          "serial_number",
+          "sha1_fingerprint",
+          "sha256_fingerprint",
+          "signature",
+          "signature_algorithm",
+          "subject_alternative_names",
+          "subject_info_access",
+          "subject_key_identifier",
+          "timeout",
+          "valid_from",
+          "valid_to",
+          "version"
+        ],
+        "sectionRelativeRepoPath": "curl_certificate",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/curl_certificate.yml"
+      },
+      {
+        "url": "/tables/deb_packages",
+        "title": "deb_packages",
+        "htmlId": "table--debpackages--f9f4ca0355",
+        "evented": false,
+        "platforms": [
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "deb_packages",
+          "admindir",
+          "arch",
+          "maintainer",
+          "mount_namespace_id",
+          "name",
+          "pid_with_namespace",
+          "priority",
+          "revision",
+          "section",
+          "size",
+          "source",
+          "status",
+          "version"
+        ],
+        "sectionRelativeRepoPath": "deb_packages",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/deb_packages.yml"
+      },
+      {
+        "url": "/tables/default_environment",
+        "title": "default_environment",
+        "htmlId": "table--defaultenvironment--ccbaea6671",
+        "evented": false,
+        "platforms": [
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "default_environment",
+          "expand",
+          "value",
+          "variable"
+        ],
+        "sectionRelativeRepoPath": "default_environment",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fdefault_environment.yml&value=name%3A%20default_environment%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/device_file",
+        "title": "device_file",
+        "htmlId": "table--devicefile--e5267d9f3e",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "device_file",
+          "atime",
+          "block_size",
+          "ctime",
+          "device",
+          "filename",
+          "gid",
+          "hard_links",
+          "inode",
+          "mode",
+          "mtime",
+          "partition",
+          "path",
+          "size",
+          "type",
+          "uid"
+        ],
+        "sectionRelativeRepoPath": "device_file",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fdevice_file.yml&value=name%3A%20device_file%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/device_firmware",
+        "title": "device_firmware",
+        "htmlId": "table--devicefirmware--ab4ba7dd63",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "device_firmware",
+          "device",
+          "type",
+          "version"
+        ],
+        "sectionRelativeRepoPath": "device_firmware",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/device_firmware.yml"
+      },
+      {
+        "url": "/tables/device_hash",
+        "title": "device_hash",
+        "htmlId": "table--devicehash--c839a630b0",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "device_hash",
+          "device",
+          "inode",
+          "md5",
+          "partition",
+          "sha1",
+          "sha256"
+        ],
+        "sectionRelativeRepoPath": "device_hash",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fdevice_hash.yml&value=name%3A%20device_hash%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/device_partitions",
+        "title": "device_partitions",
+        "htmlId": "table--devicepartitions--3489019e85",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "device_partitions",
+          "blocks",
+          "blocks_size",
+          "device",
+          "flags",
+          "inodes",
+          "label",
+          "offset",
+          "partition",
+          "type"
+        ],
+        "sectionRelativeRepoPath": "device_partitions",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fdevice_partitions.yml&value=name%3A%20device_partitions%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/disk_encryption",
+        "title": "disk_encryption",
+        "htmlId": "table--diskencryption--26d5b55253",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "disk_encryption",
+          "encrypted",
+          "encryption_status",
+          "filevault_status",
+          "name",
+          "type",
+          "uid",
+          "user_uuid",
+          "uuid"
+        ],
+        "sectionRelativeRepoPath": "disk_encryption",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/disk_encryption.yml"
+      },
+      {
+        "url": "/tables/disk_events",
+        "title": "disk_events",
+        "htmlId": "table--diskevents--737534006f",
+        "evented": true,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "disk_events",
+          "action",
+          "checksum",
+          "content",
+          "device",
+          "eid",
+          "ejectable",
+          "filesystem",
+          "media_name",
+          "mountable",
+          "name",
+          "path",
+          "size",
+          "time",
+          "uuid",
+          "vendor",
+          "writable"
+        ],
+        "sectionRelativeRepoPath": "disk_events",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/disk_events.yml"
+      },
+      {
+        "url": "/tables/disk_info",
+        "title": "disk_info",
+        "htmlId": "table--diskinfo--e7393d4e29",
+        "evented": false,
+        "platforms": [
+          "windows",
+          "chrome"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "disk_info",
+          "description",
+          "disk_index",
+          "disk_size",
+          "hardware_model",
+          "id",
+          "manufacturer",
+          "name",
+          "partitions",
+          "pnp_device_id",
+          "serial",
+          "type"
+        ],
+        "sectionRelativeRepoPath": "disk_info",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/disk_info.yml"
+      },
+      {
+        "url": "/tables/dns_cache",
+        "title": "dns_cache",
+        "htmlId": "table--dnscache--dc0e67fdcf",
+        "evented": false,
+        "platforms": [
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "dns_cache",
+          "flags",
+          "name",
+          "type"
+        ],
+        "sectionRelativeRepoPath": "dns_cache",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/dns_cache.yml"
+      },
+      {
+        "url": "/tables/dns_resolvers",
+        "title": "dns_resolvers",
+        "htmlId": "table--dnsresolvers--2c8fb31e5d",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "dns_resolvers",
+          "address",
+          "id",
+          "netmask",
+          "options",
+          "pid_with_namespace",
+          "type"
+        ],
+        "sectionRelativeRepoPath": "dns_resolvers",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/dns_resolvers.yml"
+      },
+      {
+        "url": "/tables/docker_container_envs",
+        "title": "docker_container_envs",
+        "htmlId": "table--dockercontainerenvs--3f92fabef8",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "docker_container_envs",
+          "id",
+          "key",
+          "value"
+        ],
+        "sectionRelativeRepoPath": "docker_container_envs",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/docker_container_envs.yml"
+      },
+      {
+        "url": "/tables/docker_container_fs_changes",
+        "title": "docker_container_fs_changes",
+        "htmlId": "table--dockercontainerfschanges--e8a13529f8",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "docker_container_fs_changes",
+          "change_type",
+          "id",
+          "path"
+        ],
+        "sectionRelativeRepoPath": "docker_container_fs_changes",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fdocker_container_fs_changes.yml&value=name%3A%20docker_container_fs_changes%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/docker_container_labels",
+        "title": "docker_container_labels",
+        "htmlId": "table--dockercontainerlabels--525f815a85",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "docker_container_labels",
+          "id",
+          "key",
+          "value"
+        ],
+        "sectionRelativeRepoPath": "docker_container_labels",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/docker_container_labels.yml"
+      },
+      {
+        "url": "/tables/docker_container_mounts",
+        "title": "docker_container_mounts",
+        "htmlId": "table--dockercontainermounts--feffa9b278",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "docker_container_mounts",
+          "destination",
+          "driver",
+          "id",
+          "mode",
+          "name",
+          "propagation",
+          "rw",
+          "source",
+          "type"
+        ],
+        "sectionRelativeRepoPath": "docker_container_mounts",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/docker_container_mounts.yml"
+      },
+      {
+        "url": "/tables/docker_container_networks",
+        "title": "docker_container_networks",
+        "htmlId": "table--dockercontainernetworks--7482838a3b",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "docker_container_networks",
+          "endpoint_id",
+          "gateway",
+          "id",
+          "ip_address",
+          "ip_prefix_len",
+          "ipv6_address",
+          "ipv6_gateway",
+          "ipv6_prefix_len",
+          "mac_address",
+          "name",
+          "network_id"
+        ],
+        "sectionRelativeRepoPath": "docker_container_networks",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/docker_container_networks.yml"
+      },
+      {
+        "url": "/tables/docker_container_ports",
+        "title": "docker_container_ports",
+        "htmlId": "table--dockercontainerports--8fa613bed0",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "docker_container_ports",
+          "host_ip",
+          "host_port",
+          "id",
+          "port",
+          "type"
+        ],
+        "sectionRelativeRepoPath": "docker_container_ports",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/docker_container_ports.yml"
+      },
+      {
+        "url": "/tables/docker_container_processes",
+        "title": "docker_container_processes",
+        "htmlId": "table--dockercontainerprocesses--3790b40e9b",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "docker_container_processes",
+          "cmdline",
+          "cpu",
+          "egid",
+          "euid",
+          "gid",
+          "id",
+          "mem",
+          "name",
+          "nice",
+          "parent",
+          "pgroup",
+          "pid",
+          "resident_size",
+          "sgid",
+          "start_time",
+          "state",
+          "suid",
+          "threads",
+          "time",
+          "total_size",
+          "uid",
+          "user",
+          "wired_size"
+        ],
+        "sectionRelativeRepoPath": "docker_container_processes",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fdocker_container_processes.yml&value=name%3A%20docker_container_processes%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/docker_container_stats",
+        "title": "docker_container_stats",
+        "htmlId": "table--dockercontainerstats--55f8d1f434",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "docker_container_stats",
+          "cpu_kernelmode_usage",
+          "cpu_total_usage",
+          "cpu_usermode_usage",
+          "disk_read",
+          "disk_write",
+          "id",
+          "interval",
+          "memory_cached",
+          "memory_limit",
+          "memory_max_usage",
+          "memory_usage",
+          "name",
+          "network_rx_bytes",
+          "network_tx_bytes",
+          "num_procs",
+          "online_cpus",
+          "pids",
+          "pre_cpu_kernelmode_usage",
+          "pre_cpu_total_usage",
+          "pre_cpu_usermode_usage",
+          "pre_online_cpus",
+          "pre_system_cpu_usage",
+          "preread",
+          "read",
+          "system_cpu_usage"
+        ],
+        "sectionRelativeRepoPath": "docker_container_stats",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fdocker_container_stats.yml&value=name%3A%20docker_container_stats%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/docker_containers",
+        "title": "docker_containers",
+        "htmlId": "table--dockercontainers--e586f60cb7",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "docker_containers",
+          "cgroup_namespace",
+          "command",
+          "config_entrypoint",
+          "created",
+          "env_variables",
+          "finished_at",
+          "id",
+          "image",
+          "image_id",
+          "ipc_namespace",
+          "mnt_namespace",
+          "name",
+          "net_namespace",
+          "path",
+          "pid",
+          "pid_namespace",
+          "privileged",
+          "readonly_rootfs",
+          "security_options",
+          "started_at",
+          "state",
+          "status",
+          "user_namespace",
+          "uts_namespace"
+        ],
+        "sectionRelativeRepoPath": "docker_containers",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/docker_containers.yml"
+      },
+      {
+        "url": "/tables/docker_image_history",
+        "title": "docker_image_history",
+        "htmlId": "table--dockerimagehistory--77b04426fe",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "docker_image_history",
+          "comment",
+          "created",
+          "created_by",
+          "id",
+          "size",
+          "tags"
+        ],
+        "sectionRelativeRepoPath": "docker_image_history",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fdocker_image_history.yml&value=name%3A%20docker_image_history%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/docker_image_labels",
+        "title": "docker_image_labels",
+        "htmlId": "table--dockerimagelabels--14e0871386",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "docker_image_labels",
+          "id",
+          "key",
+          "value"
+        ],
+        "sectionRelativeRepoPath": "docker_image_labels",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fdocker_image_labels.yml&value=name%3A%20docker_image_labels%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/docker_image_layers",
+        "title": "docker_image_layers",
+        "htmlId": "table--dockerimagelayers--91693c4e4c",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "docker_image_layers",
+          "id",
+          "layer_id",
+          "layer_order"
+        ],
+        "sectionRelativeRepoPath": "docker_image_layers",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fdocker_image_layers.yml&value=name%3A%20docker_image_layers%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/docker_images",
+        "title": "docker_images",
+        "htmlId": "table--dockerimages--6819d40071",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "docker_images",
+          "created",
+          "id",
+          "size_bytes",
+          "tags"
+        ],
+        "sectionRelativeRepoPath": "docker_images",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/docker_images.yml"
+      },
+      {
+        "url": "/tables/docker_info",
+        "title": "docker_info",
+        "htmlId": "table--dockerinfo--2f30b285cd",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "docker_info",
+          "architecture",
+          "bridge_nf_ip6tables",
+          "bridge_nf_iptables",
+          "cgroup_driver",
+          "containers",
+          "containers_paused",
+          "containers_running",
+          "containers_stopped",
+          "cpu_cfs_period",
+          "cpu_cfs_quota",
+          "cpu_set",
+          "cpu_shares",
+          "cpus",
+          "http_proxy",
+          "https_proxy",
+          "id",
+          "images",
+          "ipv4_forwarding",
+          "kernel_memory",
+          "kernel_version",
+          "logging_driver",
+          "memory",
+          "memory_limit",
+          "name",
+          "no_proxy",
+          "oom_kill_disable",
+          "os",
+          "os_type",
+          "root_dir",
+          "server_version",
+          "storage_driver",
+          "swap_limit"
+        ],
+        "sectionRelativeRepoPath": "docker_info",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fdocker_info.yml&value=name%3A%20docker_info%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/docker_network_labels",
+        "title": "docker_network_labels",
+        "htmlId": "table--dockernetworklabels--1f827dc474",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "docker_network_labels",
+          "id",
+          "key",
+          "value"
+        ],
+        "sectionRelativeRepoPath": "docker_network_labels",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fdocker_network_labels.yml&value=name%3A%20docker_network_labels%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/docker_networks",
+        "title": "docker_networks",
+        "htmlId": "table--dockernetworks--2ae40ea518",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "docker_networks",
+          "created",
+          "driver",
+          "enable_ipv6",
+          "gateway",
+          "id",
+          "name",
+          "subnet"
+        ],
+        "sectionRelativeRepoPath": "docker_networks",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fdocker_networks.yml&value=name%3A%20docker_networks%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/docker_version",
+        "title": "docker_version",
+        "htmlId": "table--dockerversion--d5c8b11df6",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "docker_version",
+          "api_version",
+          "arch",
+          "build_time",
+          "git_commit",
+          "go_version",
+          "kernel_version",
+          "min_api_version",
+          "os",
+          "version"
+        ],
+        "sectionRelativeRepoPath": "docker_version",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fdocker_version.yml&value=name%3A%20docker_version%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/docker_volume_labels",
+        "title": "docker_volume_labels",
+        "htmlId": "table--dockervolumelabels--45adc74ba3",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "docker_volume_labels",
+          "key",
+          "name",
+          "value"
+        ],
+        "sectionRelativeRepoPath": "docker_volume_labels",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fdocker_volume_labels.yml&value=name%3A%20docker_volume_labels%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/docker_volumes",
+        "title": "docker_volumes",
+        "htmlId": "table--dockervolumes--cee95f6b90",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "docker_volumes",
+          "driver",
+          "mount_point",
+          "name",
+          "type"
+        ],
+        "sectionRelativeRepoPath": "docker_volumes",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/docker_volumes.yml"
+      },
+      {
+        "url": "/tables/drivers",
+        "title": "drivers",
+        "htmlId": "table--drivers--58290d489f",
+        "evented": false,
+        "platforms": [
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "drivers",
+          "class",
+          "date",
+          "description",
+          "device_id",
+          "device_name",
+          "driver_key",
+          "image",
+          "inf",
+          "manufacturer",
+          "provider",
+          "service",
+          "service_key",
+          "signed",
+          "version"
+        ],
+        "sectionRelativeRepoPath": "drivers",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fdrivers.yml&value=name%3A%20drivers%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/dscl",
+        "title": "dscl",
+        "htmlId": "table--dscl--54e7060384",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "dscl",
+          "command",
+          "key",
+          "path",
+          "value"
+        ],
+        "sectionRelativeRepoPath": "dscl",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/dscl.yml"
+      },
+      {
+        "url": "/tables/ec2_instance_metadata",
+        "title": "ec2_instance_metadata",
+        "htmlId": "table--ec2instancemetadata--8b1828d8f6",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux",
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "ec2_instance_metadata",
+          "account_id",
+          "ami_id",
+          "architecture",
+          "availability_zone",
+          "iam_arn",
+          "instance_id",
+          "instance_type",
+          "local_hostname",
+          "local_ipv4",
+          "mac",
+          "region",
+          "reservation_id",
+          "security_groups",
+          "ssh_public_key"
+        ],
+        "sectionRelativeRepoPath": "ec2_instance_metadata",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fec2_instance_metadata.yml&value=name%3A%20ec2_instance_metadata%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/ec2_instance_tags",
+        "title": "ec2_instance_tags",
+        "htmlId": "table--ec2instancetags--450384158f",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux",
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "ec2_instance_tags",
+          "instance_id",
+          "key",
+          "value"
+        ],
+        "sectionRelativeRepoPath": "ec2_instance_tags",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fec2_instance_tags.yml&value=name%3A%20ec2_instance_tags%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/es_process_events",
+        "title": "es_process_events",
+        "htmlId": "table--esprocessevents--d79d694750",
+        "evented": true,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "es_process_events",
+          "cdhash",
+          "child_pid",
+          "cmdline",
+          "cmdline_count",
+          "codesigning_flags",
+          "cwd",
+          "egid",
+          "eid",
+          "env",
+          "env_count",
+          "euid",
+          "event_type",
+          "exit_code",
+          "gid",
+          "global_seq_num",
+          "original_parent",
+          "parent",
+          "path",
+          "pid",
+          "platform_binary",
+          "seq_num",
+          "signing_id",
+          "team_id",
+          "time",
+          "uid",
+          "username",
+          "version"
+        ],
+        "sectionRelativeRepoPath": "es_process_events",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fes_process_events.yml&value=name%3A%20es_process_events%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/es_process_file_events",
+        "title": "es_process_file_events",
+        "htmlId": "table--esprocessfileevents--e28968a0e8",
+        "evented": true,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "es_process_file_events",
+          "dest_filename",
+          "eid",
+          "event_type",
+          "filename",
+          "global_seq_num",
+          "parent",
+          "path",
+          "pid",
+          "seq_num",
+          "time",
+          "version"
+        ],
+        "sectionRelativeRepoPath": "es_process_file_events",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fes_process_file_events.yml&value=name%3A%20es_process_file_events%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/etc_hosts",
+        "title": "etc_hosts",
+        "htmlId": "table--etchosts--a56205b3f9",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux",
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "etc_hosts",
+          "address",
+          "hostnames",
+          "pid_with_namespace"
+        ],
+        "sectionRelativeRepoPath": "etc_hosts",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/etc_hosts.yml"
+      },
+      {
+        "url": "/tables/etc_protocols",
+        "title": "etc_protocols",
+        "htmlId": "table--etcprotocols--b5ffb257d1",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux",
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "etc_protocols",
+          "alias",
+          "comment",
+          "name",
+          "number"
+        ],
+        "sectionRelativeRepoPath": "etc_protocols",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fetc_protocols.yml&value=name%3A%20etc_protocols%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/etc_services",
+        "title": "etc_services",
+        "htmlId": "table--etcservices--454572c18c",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux",
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "etc_services",
+          "aliases",
+          "comment",
+          "name",
+          "port",
+          "protocol"
+        ],
+        "sectionRelativeRepoPath": "etc_services",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/etc_services.yml"
+      },
+      {
+        "url": "/tables/event_taps",
+        "title": "event_taps",
+        "htmlId": "table--eventtaps--b2afde9ecc",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "event_taps",
+          "enabled",
+          "event_tap_id",
+          "event_tapped",
+          "process_being_tapped",
+          "tapping_process"
+        ],
+        "sectionRelativeRepoPath": "event_taps",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/event_taps.yml"
+      },
+      {
+        "url": "/tables/extended_attributes",
+        "title": "extended_attributes",
+        "htmlId": "table--extendedattributes--9dea030217",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "extended_attributes",
+          "base64",
+          "directory",
+          "key",
+          "path",
+          "value"
+        ],
+        "sectionRelativeRepoPath": "extended_attributes",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fextended_attributes.yml&value=name%3A%20extended_attributes%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/falcon_kernel_check",
+        "title": "falcon_kernel_check",
+        "htmlId": "table--falconkernelcheck--5479232641",
+        "evented": false,
+        "platforms": [
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "falcon_kernel_check",
+          "kernel",
+          "sensor_version",
+          "supported"
+        ],
+        "sectionRelativeRepoPath": "falcon_kernel_check",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/falcon_kernel_check.yml"
+      },
+      {
+        "url": "/tables/falconctl_options",
+        "title": "falconctl_options",
+        "htmlId": "table--falconctloptions--7106491b65",
+        "evented": false,
+        "platforms": [
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "falconctl_options",
+          "options"
+        ],
+        "sectionRelativeRepoPath": "falconctl_options",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/falconctl_options.yml"
+      },
+      {
+        "url": "/tables/fan_speed_sensors",
+        "title": "fan_speed_sensors",
+        "htmlId": "table--fanspeedsensors--32417c8bf6",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "fan_speed_sensors",
+          "actual",
+          "fan",
+          "max",
+          "min",
+          "name",
+          "target"
+        ],
+        "sectionRelativeRepoPath": "fan_speed_sensors",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Ffan_speed_sensors.yml&value=name%3A%20fan_speed_sensors%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/file",
+        "title": "file",
+        "htmlId": "table--file--5f21761417",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux",
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "file",
+          "atime",
+          "attributes",
+          "block_size",
+          "bsd_flags",
+          "btime",
+          "ctime",
+          "device",
+          "directory",
+          "file_id",
+          "file_version",
+          "filename",
+          "gid",
+          "hard_links",
+          "inode",
+          "mode",
+          "mount_namespace_id",
+          "mtime",
+          "original_filename",
+          "path",
+          "pid_with_namespace",
+          "product_version",
+          "shortcut_comment",
+          "shortcut_run",
+          "shortcut_start_in",
+          "shortcut_target_location",
+          "shortcut_target_path",
+          "shortcut_target_type",
+          "size",
+          "symlink",
+          "type",
+          "uid",
+          "volume_serial"
+        ],
+        "sectionRelativeRepoPath": "file",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/file.yml"
+      },
+      {
+        "url": "/tables/file_events",
+        "title": "file_events",
+        "htmlId": "table--fileevents--7d5b0a2d3e",
+        "evented": true,
+        "platforms": [
+          "darwin",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "file_events",
+          "action",
+          "atime",
+          "category",
+          "ctime",
+          "eid",
+          "gid",
+          "hashed",
+          "inode",
+          "md5",
+          "mode",
+          "mtime",
+          "sha1",
+          "sha256",
+          "size",
+          "target_path",
+          "time",
+          "transaction_id",
+          "uid"
+        ],
+        "sectionRelativeRepoPath": "file_events",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Ffile_events.yml&value=name%3A%20file_events%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/file_lines",
+        "title": "file_lines",
+        "htmlId": "table--filelines--66f7e5497f",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "windows",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "file_lines",
+          "line",
+          "path"
+        ],
+        "sectionRelativeRepoPath": "file_lines",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/file_lines.yml"
+      },
+      {
+        "url": "/tables/filevault_prk",
+        "title": "filevault_prk",
+        "htmlId": "table--filevaultprk--4327326014",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "filevault_prk",
+          "base64_encrypted"
+        ],
+        "sectionRelativeRepoPath": "filevault_prk",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/filevault_prk.yml"
+      },
+      {
+        "url": "/tables/filevault_status",
+        "title": "filevault_status",
+        "htmlId": "table--filevaultstatus--808666eddb",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "filevault_status",
+          "status"
+        ],
+        "sectionRelativeRepoPath": "filevault_status",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/filevault_status.yml"
+      },
+      {
+        "url": "/tables/filevault_users",
+        "title": "filevault_users",
+        "htmlId": "table--filevaultusers--283a958213",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "filevault_users",
+          "username",
+          "uuid"
+        ],
+        "sectionRelativeRepoPath": "filevault_users",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/filevault_users.yml"
+      },
+      {
+        "url": "/tables/find_cmd",
+        "title": "find_cmd",
+        "htmlId": "table--findcmd--6d09c7cd5f",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "find_cmd",
+          "directory",
+          "path",
+          "perm",
+          "type"
+        ],
+        "sectionRelativeRepoPath": "find_cmd",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/find_cmd.yml"
+      },
+      {
+        "url": "/tables/firefox_addons",
+        "title": "firefox_addons",
+        "htmlId": "table--firefoxaddons--9eabc39fea",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux",
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "firefox_addons",
+          "active",
+          "autoupdate",
+          "creator",
+          "description",
+          "disabled",
+          "identifier",
+          "location",
+          "name",
+          "path",
+          "source_url",
+          "type",
+          "uid",
+          "version",
+          "visible"
+        ],
+        "sectionRelativeRepoPath": "firefox_addons",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/firefox_addons.yml"
+      },
+      {
+        "url": "/tables/firefox_preferences",
+        "title": "firefox_preferences",
+        "htmlId": "table--firefoxpreferences--2366a56fa1",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "firefox_preferences",
+          "fullkey",
+          "key",
+          "parent",
+          "path",
+          "query",
+          "value"
+        ],
+        "sectionRelativeRepoPath": "firefox_preferences",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/firefox_preferences.yml"
+      },
+      {
+        "url": "/tables/firmware_eficheck_integrity_check",
+        "title": "firmware_eficheck_integrity_check",
+        "htmlId": "table--firmwareeficheckintegritycheck--88da320790",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "firmware_eficheck_integrity_check",
+          "chip",
+          "output"
+        ],
+        "sectionRelativeRepoPath": "firmware_eficheck_integrity_check",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/firmware_eficheck_integrity_check.yml"
+      },
+      {
+        "url": "/tables/firmwarepasswd",
+        "title": "firmwarepasswd",
+        "htmlId": "table--firmwarepasswd--34c47d2dc2",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "firmwarepasswd",
+          "mode",
+          "option_roms_allowed",
+          "password_enabled"
+        ],
+        "sectionRelativeRepoPath": "firmwarepasswd",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/firmwarepasswd.yml"
+      },
+      {
+        "url": "/tables/fleetd_logs",
+        "title": "fleetd_logs",
+        "htmlId": "table--fleetdlogs--04f95fb2e5",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "windows",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "fleetd_logs",
+          "error",
+          "level",
+          "message",
+          "payload",
+          "time"
+        ],
+        "sectionRelativeRepoPath": "fleetd_logs",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/fleetd_logs.yml"
+      },
+      {
+        "url": "/tables/gatekeeper",
+        "title": "gatekeeper",
+        "htmlId": "table--gatekeeper--c48826d081",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "gatekeeper",
+          "assessments_enabled",
+          "dev_id_enabled",
+          "opaque_version",
+          "version"
+        ],
+        "sectionRelativeRepoPath": "gatekeeper",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/gatekeeper.yml"
+      },
+      {
+        "url": "/tables/gatekeeper_approved_apps",
+        "title": "gatekeeper_approved_apps",
+        "htmlId": "table--gatekeeperapprovedapps--ccb2041adc",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "gatekeeper_approved_apps",
+          "ctime",
+          "mtime",
+          "path",
+          "requirement"
+        ],
+        "sectionRelativeRepoPath": "gatekeeper_approved_apps",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fgatekeeper_approved_apps.yml&value=name%3A%20gatekeeper_approved_apps%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/geolocation",
+        "title": "geolocation",
+        "htmlId": "table--geolocation--0338bc3ba9",
+        "evented": false,
+        "platforms": [
+          "chrome"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "geolocation",
+          "city",
+          "country",
+          "ip",
+          "region"
+        ],
+        "sectionRelativeRepoPath": "geolocation",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/geolocation.yml"
+      },
+      {
+        "url": "/tables/google_chrome_profiles",
+        "title": "google_chrome_profiles",
+        "htmlId": "table--googlechromeprofiles--bc22157648",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "windows",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "google_chrome_profiles",
+          "email",
+          "ephemeral",
+          "name",
+          "username"
+        ],
+        "sectionRelativeRepoPath": "google_chrome_profiles",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/google_chrome_profiles.yml"
+      },
+      {
+        "url": "/tables/groups",
+        "title": "groups",
+        "htmlId": "table--groups--05fec1d6ce",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux",
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "groups",
+          "comment",
+          "gid",
+          "gid_signed",
+          "group_sid",
+          "groupname",
+          "is_hidden",
+          "pid_with_namespace"
+        ],
+        "sectionRelativeRepoPath": "groups",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/groups.yml"
+      },
+      {
+        "url": "/tables/hardware_events",
+        "title": "hardware_events",
+        "htmlId": "table--hardwareevents--f7cce3883a",
+        "evented": true,
+        "platforms": [
+          "darwin",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "hardware_events",
+          "action",
+          "driver",
+          "eid",
+          "model",
+          "model_id",
+          "path",
+          "revision",
+          "serial",
+          "time",
+          "type",
+          "vendor",
+          "vendor_id"
+        ],
+        "sectionRelativeRepoPath": "hardware_events",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fhardware_events.yml&value=name%3A%20hardware_events%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/hash",
+        "title": "hash",
+        "htmlId": "table--hash--c08ce91512",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux",
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "hash",
+          "directory",
+          "md5",
+          "mount_namespace_id",
+          "path",
+          "pid_with_namespace",
+          "sha1",
+          "sha256"
+        ],
+        "sectionRelativeRepoPath": "hash",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/hash.yml"
+      },
+      {
+        "url": "/tables/homebrew_packages",
+        "title": "homebrew_packages",
+        "htmlId": "table--homebrewpackages--9c26173ba7",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "homebrew_packages",
+          "name",
+          "path",
+          "prefix",
+          "type",
+          "version"
+        ],
+        "sectionRelativeRepoPath": "homebrew_packages",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/homebrew_packages.yml"
+      },
+      {
+        "url": "/tables/hvci_status",
+        "title": "hvci_status",
+        "htmlId": "table--hvcistatus--46a3ee08e5",
+        "evented": false,
+        "platforms": [
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "hvci_status",
+          "code_integrity_policy_enforcement_status",
+          "instance_identifier",
+          "umci_policy_status",
+          "vbs_status",
+          "version"
+        ],
+        "sectionRelativeRepoPath": "hvci_status",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fhvci_status.yml&value=name%3A%20hvci_status%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/ibridge_info",
+        "title": "ibridge_info",
+        "htmlId": "table--ibridgeinfo--38f5f5d7eb",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "ibridge_info",
+          "boot_uuid",
+          "coprocessor_version",
+          "firmware_version",
+          "unique_chip_id"
+        ],
+        "sectionRelativeRepoPath": "ibridge_info",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fibridge_info.yml&value=name%3A%20ibridge_info%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/icloud_private_relay",
+        "title": "icloud_private_relay",
+        "htmlId": "table--icloudprivaterelay--7cbb9c575c",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "icloud_private_relay",
+          "status"
+        ],
+        "sectionRelativeRepoPath": "icloud_private_relay",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/icloud_private_relay.yml"
+      },
+      {
+        "url": "/tables/ie_extensions",
+        "title": "ie_extensions",
+        "htmlId": "table--ieextensions--412b814817",
+        "evented": false,
+        "platforms": [
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "ie_extensions",
+          "name",
+          "path",
+          "registry_path",
+          "version"
+        ],
+        "sectionRelativeRepoPath": "ie_extensions",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/ie_extensions.yml"
+      },
+      {
+        "url": "/tables/intel_me_info",
+        "title": "intel_me_info",
+        "htmlId": "table--intelmeinfo--fd5eb9626f",
+        "evented": false,
+        "platforms": [
+          "linux",
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "intel_me_info",
+          "version"
+        ],
+        "sectionRelativeRepoPath": "intel_me_info",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fintel_me_info.yml&value=name%3A%20intel_me_info%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/interface_addresses",
+        "title": "interface_addresses",
+        "htmlId": "table--interfaceaddresses--4163068693",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux",
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "interface_addresses",
+          "address",
+          "broadcast",
+          "friendly_name",
+          "interface",
+          "mask",
+          "point_to_point",
+          "type"
+        ],
+        "sectionRelativeRepoPath": "interface_addresses",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/interface_addresses.yml"
+      },
+      {
+        "url": "/tables/interface_details",
+        "title": "interface_details",
+        "htmlId": "table--interfacedetails--c8234f77ad",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux",
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "interface_details",
+          "collisions",
+          "connection_id",
+          "connection_status",
+          "description",
+          "dhcp_enabled",
+          "dhcp_lease_expires",
+          "dhcp_lease_obtained",
+          "dhcp_server",
+          "dns_domain",
+          "dns_domain_suffix_search_order",
+          "dns_host_name",
+          "dns_server_search_order",
+          "enabled",
+          "flags",
+          "friendly_name",
+          "ibytes",
+          "idrops",
+          "ierrors",
+          "interface",
+          "ipackets",
+          "last_change",
+          "link_speed",
+          "mac",
+          "manufacturer",
+          "metric",
+          "mtu",
+          "obytes",
+          "odrops",
+          "oerrors",
+          "opackets",
+          "pci_slot",
+          "physical_adapter",
+          "service",
+          "speed",
+          "type"
+        ],
+        "sectionRelativeRepoPath": "interface_details",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/interface_details.yml"
+      },
+      {
+        "url": "/tables/interface_ipv6",
+        "title": "interface_ipv6",
+        "htmlId": "table--interfaceipv6--48a78776ae",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "interface_ipv6",
+          "forwarding_enabled",
+          "hop_limit",
+          "interface",
+          "redirect_accept",
+          "rtadv_accept"
+        ],
+        "sectionRelativeRepoPath": "interface_ipv6",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/interface_ipv6.yml"
+      },
+      {
+        "url": "/tables/iokit_devicetree",
+        "title": "iokit_devicetree",
+        "htmlId": "table--iokitdevicetree--475d23de81",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "iokit_devicetree",
+          "busy_state",
+          "class",
+          "depth",
+          "device_path",
+          "id",
+          "name",
+          "parent",
+          "retain_count",
+          "service"
+        ],
+        "sectionRelativeRepoPath": "iokit_devicetree",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/iokit_devicetree.yml"
+      },
+      {
+        "url": "/tables/iokit_registry",
+        "title": "iokit_registry",
+        "htmlId": "table--iokitregistry--213523c85d",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "iokit_registry",
+          "busy_state",
+          "class",
+          "depth",
+          "id",
+          "name",
+          "parent",
+          "retain_count"
+        ],
+        "sectionRelativeRepoPath": "iokit_registry",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/iokit_registry.yml"
+      },
+      {
+        "url": "/tables/ioreg",
+        "title": "ioreg",
+        "htmlId": "table--ioreg--64934c5b2c",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "ioreg",
+          "c",
+          "d",
+          "fullkey",
+          "k",
+          "key",
+          "n",
+          "p",
+          "parent",
+          "query",
+          "r",
+          "value"
+        ],
+        "sectionRelativeRepoPath": "ioreg",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/ioreg.yml"
+      },
+      {
+        "url": "/tables/iptables",
+        "title": "iptables",
+        "htmlId": "table--iptables--73fe23ccfd",
+        "evented": false,
+        "platforms": [
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "iptables",
+          "bytes",
+          "chain",
+          "dst_ip",
+          "dst_mask",
+          "dst_port",
+          "filter_name",
+          "iniface",
+          "iniface_mask",
+          "match",
+          "outiface",
+          "outiface_mask",
+          "packets",
+          "policy",
+          "protocol",
+          "src_ip",
+          "src_mask",
+          "src_port",
+          "target"
+        ],
+        "sectionRelativeRepoPath": "iptables",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/iptables.yml"
+      },
+      {
+        "url": "/tables/kernel_extensions",
+        "title": "kernel_extensions",
+        "htmlId": "table--kernelextensions--015ed33cfc",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "kernel_extensions",
+          "idx",
+          "linked_against",
+          "name",
+          "path",
+          "refs",
+          "size",
+          "version"
+        ],
+        "sectionRelativeRepoPath": "kernel_extensions",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/kernel_extensions.yml"
+      },
+      {
+        "url": "/tables/kernel_info",
+        "title": "kernel_info",
+        "htmlId": "table--kernelinfo--e02ab4d886",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux",
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "kernel_info",
+          "arguments",
+          "device",
+          "path",
+          "version"
+        ],
+        "sectionRelativeRepoPath": "kernel_info",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/kernel_info.yml"
+      },
+      {
+        "url": "/tables/kernel_keys",
+        "title": "kernel_keys",
+        "htmlId": "table--kernelkeys--c3a84244c8",
+        "evented": false,
+        "platforms": [
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "kernel_keys",
+          "description",
+          "flags",
+          "gid",
+          "permissions",
+          "serial_number",
+          "timeout",
+          "type",
+          "uid",
+          "usage"
+        ],
+        "sectionRelativeRepoPath": "kernel_keys",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fkernel_keys.yml&value=name%3A%20kernel_keys%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/kernel_modules",
+        "title": "kernel_modules",
+        "htmlId": "table--kernelmodules--c9051ad100",
+        "evented": false,
+        "platforms": [
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "kernel_modules",
+          "address",
+          "name",
+          "size",
+          "status",
+          "used_by"
+        ],
+        "sectionRelativeRepoPath": "kernel_modules",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fkernel_modules.yml&value=name%3A%20kernel_modules%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/kernel_panics",
+        "title": "kernel_panics",
+        "htmlId": "table--kernelpanics--c6cb2cce6e",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "kernel_panics",
+          "dependencies",
+          "frame_backtrace",
+          "kernel_version",
+          "last_loaded",
+          "last_unloaded",
+          "module_backtrace",
+          "name",
+          "os_version",
+          "path",
+          "registers",
+          "system_model",
+          "time",
+          "uptime"
+        ],
+        "sectionRelativeRepoPath": "kernel_panics",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/kernel_panics.yml"
+      },
+      {
+        "url": "/tables/keychain_acls",
+        "title": "keychain_acls",
+        "htmlId": "table--keychainacls--e46564a1f0",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "keychain_acls",
+          "authorizations",
+          "description",
+          "keychain_path",
+          "label",
+          "path"
+        ],
+        "sectionRelativeRepoPath": "keychain_acls",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/keychain_acls.yml"
+      },
+      {
+        "url": "/tables/keychain_items",
+        "title": "keychain_items",
+        "htmlId": "table--keychainitems--ceb19aa966",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "keychain_items",
+          "account",
+          "comment",
+          "created",
+          "description",
+          "label",
+          "modified",
+          "path",
+          "pk_hash",
+          "type"
+        ],
+        "sectionRelativeRepoPath": "keychain_items",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/keychain_items.yml"
+      },
+      {
+        "url": "/tables/known_hosts",
+        "title": "known_hosts",
+        "htmlId": "table--knownhosts--2c508bc3c8",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "known_hosts",
+          "key",
+          "key_file",
+          "uid"
+        ],
+        "sectionRelativeRepoPath": "known_hosts",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/known_hosts.yml"
+      },
+      {
+        "url": "/tables/kva_speculative_info",
+        "title": "kva_speculative_info",
+        "htmlId": "table--kvaspeculativeinfo--aa9ff39cc2",
+        "evented": false,
+        "platforms": [
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "kva_speculative_info",
+          "bp_microcode_disabled",
+          "bp_mitigations",
+          "bp_system_pol_disabled",
+          "cpu_pred_cmd_supported",
+          "cpu_spec_ctrl_supported",
+          "ibrs_support_enabled",
+          "kva_shadow_enabled",
+          "kva_shadow_inv_pcid",
+          "kva_shadow_pcid",
+          "kva_shadow_user_global",
+          "stibp_support_enabled"
+        ],
+        "sectionRelativeRepoPath": "kva_speculative_info",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fkva_speculative_info.yml&value=name%3A%20kva_speculative_info%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/last",
+        "title": "last",
+        "htmlId": "table--last--81b773b51e",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "last",
+          "host",
+          "pid",
+          "time",
+          "tty",
+          "type",
+          "type_name",
+          "username"
+        ],
+        "sectionRelativeRepoPath": "last",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/last.yml"
+      },
+      {
+        "url": "/tables/launchd",
+        "title": "launchd",
+        "htmlId": "table--launchd--e309e31831",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "launchd",
+          "disabled",
+          "groupname",
+          "inetd_compatibility",
+          "keep_alive",
+          "label",
+          "name",
+          "on_demand",
+          "path",
+          "process_type",
+          "program",
+          "program_arguments",
+          "queue_directories",
+          "root_directory",
+          "run_at_load",
+          "start_interval",
+          "start_on_mount",
+          "stderr_path",
+          "stdout_path",
+          "username",
+          "watch_paths",
+          "working_directory"
+        ],
+        "sectionRelativeRepoPath": "launchd",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/launchd.yml"
+      },
+      {
+        "url": "/tables/launchd_overrides",
+        "title": "launchd_overrides",
+        "htmlId": "table--launchdoverrides--89410cb367",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "launchd_overrides",
+          "key",
+          "label",
+          "path",
+          "uid",
+          "value"
+        ],
+        "sectionRelativeRepoPath": "launchd_overrides",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Flaunchd_overrides.yml&value=name%3A%20launchd_overrides%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/listening_ports",
+        "title": "listening_ports",
+        "htmlId": "table--listeningports--de6bf76ec3",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux",
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "listening_ports",
+          "address",
+          "family",
+          "fd",
+          "net_namespace",
+          "path",
+          "pid",
+          "port",
+          "protocol",
+          "socket"
+        ],
+        "sectionRelativeRepoPath": "listening_ports",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/listening_ports.yml"
+      },
+      {
+        "url": "/tables/load_average",
+        "title": "load_average",
+        "htmlId": "table--loadaverage--f5f080e140",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "load_average",
+          "average",
+          "period"
+        ],
+        "sectionRelativeRepoPath": "load_average",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/load_average.yml"
+      },
+      {
+        "url": "/tables/location_services",
+        "title": "location_services",
+        "htmlId": "table--locationservices--f22473f4be",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "location_services",
+          "enabled"
+        ],
+        "sectionRelativeRepoPath": "location_services",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/location_services.yml"
+      },
+      {
+        "url": "/tables/logged_in_users",
+        "title": "logged_in_users",
+        "htmlId": "table--loggedinusers--bd140b0e93",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux",
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "logged_in_users",
+          "host",
+          "pid",
+          "registry_hive",
+          "sid",
+          "time",
+          "tty",
+          "type",
+          "user"
+        ],
+        "sectionRelativeRepoPath": "logged_in_users",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/logged_in_users.yml"
+      },
+      {
+        "url": "/tables/logical_drives",
+        "title": "logical_drives",
+        "htmlId": "table--logicaldrives--e69b777f6c",
+        "evented": false,
+        "platforms": [
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "logical_drives",
+          "boot_partition",
+          "description",
+          "device_id",
+          "file_system",
+          "free_space",
+          "size",
+          "type"
+        ],
+        "sectionRelativeRepoPath": "logical_drives",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Flogical_drives.yml&value=name%3A%20logical_drives%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/logon_sessions",
+        "title": "logon_sessions",
+        "htmlId": "table--logonsessions--54d10b59e8",
+        "evented": false,
+        "platforms": [
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "logon_sessions",
+          "authentication_package",
+          "dns_domain_name",
+          "home_directory",
+          "home_directory_drive",
+          "logon_domain",
+          "logon_id",
+          "logon_script",
+          "logon_server",
+          "logon_sid",
+          "logon_time",
+          "logon_type",
+          "profile_path",
+          "session_id",
+          "upn",
+          "user"
+        ],
+        "sectionRelativeRepoPath": "logon_sessions",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Flogon_sessions.yml&value=name%3A%20logon_sessions%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/lxd_certificates",
+        "title": "lxd_certificates",
+        "htmlId": "table--lxdcertificates--06e045fa14",
+        "evented": false,
+        "platforms": [
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "lxd_certificates",
+          "certificate",
+          "fingerprint",
+          "name",
+          "type"
+        ],
+        "sectionRelativeRepoPath": "lxd_certificates",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Flxd_certificates.yml&value=name%3A%20lxd_certificates%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/lxd_cluster",
+        "title": "lxd_cluster",
+        "htmlId": "table--lxdcluster--a8491b6203",
+        "evented": false,
+        "platforms": [
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "lxd_cluster",
+          "enabled",
+          "member_config_description",
+          "member_config_entity",
+          "member_config_key",
+          "member_config_name",
+          "member_config_value",
+          "server_name"
+        ],
+        "sectionRelativeRepoPath": "lxd_cluster",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Flxd_cluster.yml&value=name%3A%20lxd_cluster%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/lxd_cluster_members",
+        "title": "lxd_cluster_members",
+        "htmlId": "table--lxdclustermembers--7d6e6837d2",
+        "evented": false,
+        "platforms": [
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "lxd_cluster_members",
+          "database",
+          "message",
+          "server_name",
+          "status",
+          "url"
+        ],
+        "sectionRelativeRepoPath": "lxd_cluster_members",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Flxd_cluster_members.yml&value=name%3A%20lxd_cluster_members%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/lxd_images",
+        "title": "lxd_images",
+        "htmlId": "table--lxdimages--55db6fdd97",
+        "evented": false,
+        "platforms": [
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "lxd_images",
+          "aliases",
+          "architecture",
+          "auto_update",
+          "cached",
+          "created_at",
+          "description",
+          "expires_at",
+          "filename",
+          "id",
+          "last_used_at",
+          "os",
+          "public",
+          "release",
+          "size",
+          "update_source_alias",
+          "update_source_certificate",
+          "update_source_protocol",
+          "update_source_server",
+          "uploaded_at"
+        ],
+        "sectionRelativeRepoPath": "lxd_images",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Flxd_images.yml&value=name%3A%20lxd_images%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/lxd_instance_config",
+        "title": "lxd_instance_config",
+        "htmlId": "table--lxdinstanceconfig--54469816ca",
+        "evented": false,
+        "platforms": [
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "lxd_instance_config",
+          "key",
+          "name",
+          "value"
+        ],
+        "sectionRelativeRepoPath": "lxd_instance_config",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Flxd_instance_config.yml&value=name%3A%20lxd_instance_config%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/lxd_instance_devices",
+        "title": "lxd_instance_devices",
+        "htmlId": "table--lxdinstancedevices--f28caba867",
+        "evented": false,
+        "platforms": [
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "lxd_instance_devices",
+          "device",
+          "device_type",
+          "key",
+          "name",
+          "value"
+        ],
+        "sectionRelativeRepoPath": "lxd_instance_devices",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Flxd_instance_devices.yml&value=name%3A%20lxd_instance_devices%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/lxd_instances",
+        "title": "lxd_instances",
+        "htmlId": "table--lxdinstances--77d953ad3e",
+        "evented": false,
+        "platforms": [
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "lxd_instances",
+          "architecture",
+          "base_image",
+          "created_at",
+          "description",
+          "ephemeral",
+          "name",
+          "os",
+          "pid",
+          "processes",
+          "stateful",
+          "status"
+        ],
+        "sectionRelativeRepoPath": "lxd_instances",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Flxd_instances.yml&value=name%3A%20lxd_instances%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/lxd_networks",
+        "title": "lxd_networks",
+        "htmlId": "table--lxdnetworks--7dd5f10782",
+        "evented": false,
+        "platforms": [
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "lxd_networks",
+          "bytes_received",
+          "bytes_sent",
+          "hwaddr",
+          "ipv4_address",
+          "ipv6_address",
+          "managed",
+          "mtu",
+          "name",
+          "packets_received",
+          "packets_sent",
+          "state",
+          "type",
+          "used_by"
+        ],
+        "sectionRelativeRepoPath": "lxd_networks",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Flxd_networks.yml&value=name%3A%20lxd_networks%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/lxd_storage_pools",
+        "title": "lxd_storage_pools",
+        "htmlId": "table--lxdstoragepools--950b575e61",
+        "evented": false,
+        "platforms": [
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "lxd_storage_pools",
+          "driver",
+          "inodes_total",
+          "inodes_used",
+          "name",
+          "size",
+          "source",
+          "space_total",
+          "space_used"
+        ],
+        "sectionRelativeRepoPath": "lxd_storage_pools",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Flxd_storage_pools.yml&value=name%3A%20lxd_storage_pools%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/macadmins_unified_log",
+        "title": "macadmins_unified_log",
+        "htmlId": "table--macadminsunifiedlog--e036df9e57",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "macadmins_unified_log",
+          "activity_identifier",
+          "boot_uuid",
+          "category",
+          "event_message",
+          "event_type",
+          "format_string",
+          "log_level",
+          "parent_activity_identifier",
+          "process_id",
+          "process_image_path",
+          "sender_image_path",
+          "sender_image_uuid",
+          "sender_program_counter",
+          "subsystem",
+          "thread_id",
+          "timestamp",
+          "trace_id"
+        ],
+        "sectionRelativeRepoPath": "macadmins_unified_log",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/macadmins_unified_log.yml"
+      },
+      {
+        "url": "/tables/macos_profiles",
+        "title": "macos_profiles",
+        "htmlId": "table--macosprofiles--cae047dfff",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "macos_profiles",
+          "description",
+          "display_name",
+          "identifier",
+          "install_date",
+          "organization",
+          "type",
+          "uuid",
+          "verification_state"
+        ],
+        "sectionRelativeRepoPath": "macos_profiles",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/macos_profiles.yml"
+      },
+      {
+        "url": "/tables/macos_rsr",
+        "title": "macos_rsr",
+        "htmlId": "table--macosrsr--9c9ef590fd",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "macos_rsr",
+          "full_macos_version",
+          "macos_version",
+          "rsr_supported",
+          "rsr_version"
+        ],
+        "sectionRelativeRepoPath": "macos_rsr",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/macos_rsr.yml"
+      },
+      {
+        "url": "/tables/magic",
+        "title": "magic",
+        "htmlId": "table--magic--2b54571c80",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "magic",
+          "data",
+          "magic_db_files",
+          "mime_encoding",
+          "mime_type",
+          "path"
+        ],
+        "sectionRelativeRepoPath": "magic",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fmagic.yml&value=name%3A%20magic%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/managed_policies",
+        "title": "managed_policies",
+        "htmlId": "table--managedpolicies--494a329dfb",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "managed_policies",
+          "domain",
+          "manual",
+          "name",
+          "username",
+          "uuid",
+          "value"
+        ],
+        "sectionRelativeRepoPath": "managed_policies",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/managed_policies.yml"
+      },
+      {
+        "url": "/tables/md_devices",
+        "title": "md_devices",
+        "htmlId": "table--mddevices--cc18ebf22a",
+        "evented": false,
+        "platforms": [
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "md_devices",
+          "active_disks",
+          "bitmap_chunk_size",
+          "bitmap_external_file",
+          "bitmap_on_mem",
+          "check_array_finish",
+          "check_array_progress",
+          "check_array_speed",
+          "chunk_size",
+          "device_name",
+          "failed_disks",
+          "nr_raid_disks",
+          "other",
+          "raid_disks",
+          "raid_level",
+          "recovery_finish",
+          "recovery_progress",
+          "recovery_speed",
+          "reshape_finish",
+          "reshape_progress",
+          "reshape_speed",
+          "resync_finish",
+          "resync_progress",
+          "resync_speed",
+          "size",
+          "spare_disks",
+          "status",
+          "superblock_state",
+          "superblock_update_time",
+          "superblock_version",
+          "unused_devices",
+          "working_disks"
+        ],
+        "sectionRelativeRepoPath": "md_devices",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fmd_devices.yml&value=name%3A%20md_devices%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/md_drives",
+        "title": "md_drives",
+        "htmlId": "table--mddrives--f529358f7d",
+        "evented": false,
+        "platforms": [
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "md_drives",
+          "drive_name",
+          "md_device_name",
+          "slot",
+          "state"
+        ],
+        "sectionRelativeRepoPath": "md_drives",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fmd_drives.yml&value=name%3A%20md_drives%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/md_personalities",
+        "title": "md_personalities",
+        "htmlId": "table--mdpersonalities--6234b42367",
+        "evented": false,
+        "platforms": [
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "md_personalities",
+          "name"
+        ],
+        "sectionRelativeRepoPath": "md_personalities",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fmd_personalities.yml&value=name%3A%20md_personalities%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/mdfind",
+        "title": "mdfind",
+        "htmlId": "table--mdfind--2061531fab",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "mdfind",
+          "path",
+          "query"
+        ],
+        "sectionRelativeRepoPath": "mdfind",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fmdfind.yml&value=name%3A%20mdfind%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/mdls",
+        "title": "mdls",
+        "htmlId": "table--mdls--8826cff54e",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "mdls",
+          "key",
+          "path",
+          "value",
+          "valuetype"
+        ],
+        "sectionRelativeRepoPath": "mdls",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/mdls.yml"
+      },
+      {
+        "url": "/tables/mdm",
+        "title": "mdm",
+        "htmlId": "table--mdm--4e74952c0b",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "mdm",
+          "access_rights",
+          "checkin_url",
+          "dep_capable",
+          "enrolled",
+          "has_scep_payload",
+          "identity_certificate_uuid",
+          "install_date",
+          "installed_from_dep",
+          "payload_identifier",
+          "server_url",
+          "sign_message",
+          "topic",
+          "user_approved"
+        ],
+        "sectionRelativeRepoPath": "mdm",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/mdm.yml"
+      },
+      {
+        "url": "/tables/mdm_bridge",
+        "title": "mdm_bridge",
+        "htmlId": "table--mdmbridge--6dff726888",
+        "evented": false,
+        "platforms": [
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "mdm_bridge",
+          "enrolled_user",
+          "enrollment_status",
+          "mdm_command_input",
+          "mdm_command_output",
+          "raw_mdm_command_output"
+        ],
+        "sectionRelativeRepoPath": "mdm_bridge",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/mdm_bridge.yml"
+      },
+      {
+        "url": "/tables/memory_array_mapped_addresses",
+        "title": "memory_array_mapped_addresses",
+        "htmlId": "table--memoryarraymappedaddresses--6f656395f7",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "memory_array_mapped_addresses",
+          "ending_address",
+          "handle",
+          "memory_array_handle",
+          "partition_width",
+          "starting_address"
+        ],
+        "sectionRelativeRepoPath": "memory_array_mapped_addresses",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fmemory_array_mapped_addresses.yml&value=name%3A%20memory_array_mapped_addresses%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/memory_arrays",
+        "title": "memory_arrays",
+        "htmlId": "table--memoryarrays--abd1487b4b",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "memory_arrays",
+          "handle",
+          "location",
+          "max_capacity",
+          "memory_error_correction",
+          "memory_error_info_handle",
+          "number_memory_devices",
+          "use"
+        ],
+        "sectionRelativeRepoPath": "memory_arrays",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fmemory_arrays.yml&value=name%3A%20memory_arrays%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/memory_device_mapped_addresses",
+        "title": "memory_device_mapped_addresses",
+        "htmlId": "table--memorydevicemappedaddresses--21aa4bee51",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "memory_device_mapped_addresses",
+          "ending_address",
+          "handle",
+          "interleave_data_depth",
+          "interleave_position",
+          "memory_array_mapped_address_handle",
+          "memory_device_handle",
+          "partition_row_position",
+          "starting_address"
+        ],
+        "sectionRelativeRepoPath": "memory_device_mapped_addresses",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fmemory_device_mapped_addresses.yml&value=name%3A%20memory_device_mapped_addresses%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/memory_devices",
+        "title": "memory_devices",
+        "htmlId": "table--memorydevices--8e8226757f",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux",
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "memory_devices",
+          "array_handle",
+          "asset_tag",
+          "bank_locator",
+          "configured_clock_speed",
+          "configured_voltage",
+          "data_width",
+          "device_locator",
+          "form_factor",
+          "handle",
+          "manufacturer",
+          "max_speed",
+          "max_voltage",
+          "memory_type",
+          "memory_type_details",
+          "min_voltage",
+          "part_number",
+          "serial_number",
+          "set",
+          "size",
+          "total_width"
+        ],
+        "sectionRelativeRepoPath": "memory_devices",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fmemory_devices.yml&value=name%3A%20memory_devices%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/memory_error_info",
+        "title": "memory_error_info",
+        "htmlId": "table--memoryerrorinfo--0e04980533",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "memory_error_info",
+          "device_error_address",
+          "error_granularity",
+          "error_operation",
+          "error_resolution",
+          "error_type",
+          "handle",
+          "memory_array_error_address",
+          "vendor_syndrome"
+        ],
+        "sectionRelativeRepoPath": "memory_error_info",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fmemory_error_info.yml&value=name%3A%20memory_error_info%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/memory_info",
+        "title": "memory_info",
+        "htmlId": "table--memoryinfo--84feac1e17",
+        "evented": false,
+        "platforms": [
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "memory_info",
+          "active",
+          "buffers",
+          "cached",
+          "inactive",
+          "memory_available",
+          "memory_free",
+          "memory_total",
+          "swap_cached",
+          "swap_free",
+          "swap_total"
+        ],
+        "sectionRelativeRepoPath": "memory_info",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fmemory_info.yml&value=name%3A%20memory_info%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/memory_map",
+        "title": "memory_map",
+        "htmlId": "table--memorymap--dbdfd30e2f",
+        "evented": false,
+        "platforms": [
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "memory_map",
+          "end",
+          "name",
+          "start"
+        ],
+        "sectionRelativeRepoPath": "memory_map",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fmemory_map.yml&value=name%3A%20memory_map%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/mounts",
+        "title": "mounts",
+        "htmlId": "table--mounts--9bd193b227",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "mounts",
+          "blocks",
+          "blocks_available",
+          "blocks_free",
+          "blocks_size",
+          "device",
+          "device_alias",
+          "flags",
+          "inodes",
+          "inodes_free",
+          "path",
+          "type"
+        ],
+        "sectionRelativeRepoPath": "mounts",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/mounts.yml"
+      },
+      {
+        "url": "/tables/msr",
+        "title": "msr",
+        "htmlId": "table--msr--ff9484332b",
+        "evented": false,
+        "platforms": [
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "msr",
+          "feature_control",
+          "perf_ctl",
+          "perf_status",
+          "platform_info",
+          "processor_number",
+          "rapl_energy_status",
+          "rapl_power_limit",
+          "rapl_power_units",
+          "turbo_disabled",
+          "turbo_ratio_limit"
+        ],
+        "sectionRelativeRepoPath": "msr",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fmsr.yml&value=name%3A%20msr%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/munki_info",
+        "title": "munki_info",
+        "htmlId": "table--munkiinfo--2e4b112369",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "munki_info",
+          "console_user",
+          "end_time",
+          "errors",
+          "manifest_name",
+          "problem_installs",
+          "start_time",
+          "success",
+          "version",
+          "warnings"
+        ],
+        "sectionRelativeRepoPath": "munki_info",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/munki_info.yml"
+      },
+      {
+        "url": "/tables/munki_installs",
+        "title": "munki_installs",
+        "htmlId": "table--munkiinstalls--b403c42531",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "munki_installs",
+          "end_time",
+          "installed",
+          "installed_version",
+          "name"
+        ],
+        "sectionRelativeRepoPath": "munki_installs",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/munki_installs.yml"
+      },
+      {
+        "url": "/tables/network_interfaces",
+        "title": "network_interfaces",
+        "htmlId": "table--networkinterfaces--ea6f795816",
+        "evented": false,
+        "platforms": [
+          "chrome"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "network_interfaces",
+          "ipv4",
+          "ipv6",
+          "mac"
+        ],
+        "sectionRelativeRepoPath": "network_interfaces",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/network_interfaces.yml"
+      },
+      {
+        "url": "/tables/nfs_shares",
+        "title": "nfs_shares",
+        "htmlId": "table--nfsshares--b4f614d51e",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "nfs_shares",
+          "options",
+          "readonly",
+          "share"
+        ],
+        "sectionRelativeRepoPath": "nfs_shares",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/nfs_shares.yml"
+      },
+      {
+        "url": "/tables/npm_packages",
+        "title": "npm_packages",
+        "htmlId": "table--npmpackages--b2a26bbba0",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux",
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "npm_packages",
+          "author",
+          "description",
+          "directory",
+          "homepage",
+          "license",
+          "mount_namespace_id",
+          "name",
+          "path",
+          "pid_with_namespace",
+          "version"
+        ],
+        "sectionRelativeRepoPath": "npm_packages",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/npm_packages.yml"
+      },
+      {
+        "url": "/tables/ntdomains",
+        "title": "ntdomains",
+        "htmlId": "table--ntdomains--57ef982364",
+        "evented": false,
+        "platforms": [
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "ntdomains",
+          "client_site_name",
+          "dc_site_name",
+          "dns_forest_name",
+          "domain_controller_address",
+          "domain_controller_name",
+          "domain_name",
+          "name",
+          "status"
+        ],
+        "sectionRelativeRepoPath": "ntdomains",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/ntdomains.yml"
+      },
+      {
+        "url": "/tables/ntfs_acl_permissions",
+        "title": "ntfs_acl_permissions",
+        "htmlId": "table--ntfsaclpermissions--2d66c6c45e",
+        "evented": false,
+        "platforms": [
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "ntfs_acl_permissions",
+          "access",
+          "inherited_from",
+          "path",
+          "principal",
+          "type"
+        ],
+        "sectionRelativeRepoPath": "ntfs_acl_permissions",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fntfs_acl_permissions.yml&value=name%3A%20ntfs_acl_permissions%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/ntfs_journal_events",
+        "title": "ntfs_journal_events",
+        "htmlId": "table--ntfsjournalevents--2369d84275",
+        "evented": true,
+        "platforms": [
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "ntfs_journal_events",
+          "action",
+          "category",
+          "drive_letter",
+          "eid",
+          "file_attributes",
+          "node_ref_number",
+          "old_path",
+          "parent_ref_number",
+          "partial",
+          "path",
+          "record_timestamp",
+          "record_usn",
+          "time"
+        ],
+        "sectionRelativeRepoPath": "ntfs_journal_events",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fntfs_journal_events.yml&value=name%3A%20ntfs_journal_events%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/nvram",
+        "title": "nvram",
+        "htmlId": "table--nvram--450a99f968",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "nvram",
+          "name",
+          "type",
+          "value"
+        ],
+        "sectionRelativeRepoPath": "nvram",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/nvram.yml"
+      },
+      {
+        "url": "/tables/nvram_info",
+        "title": "nvram_info",
+        "htmlId": "table--nvraminfo--a99cb280af",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "nvram_info",
+          "amfi_enabled"
+        ],
+        "sectionRelativeRepoPath": "nvram_info",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/nvram_info.yml"
+      },
+      {
+        "url": "/tables/oem_strings",
+        "title": "oem_strings",
+        "htmlId": "table--oemstrings--89f170ddda",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "oem_strings",
+          "handle",
+          "number",
+          "value"
+        ],
+        "sectionRelativeRepoPath": "oem_strings",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Foem_strings.yml&value=name%3A%20oem_strings%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/office_mru",
+        "title": "office_mru",
+        "htmlId": "table--officemru--11e1929c70",
+        "evented": false,
+        "platforms": [
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "office_mru",
+          "application",
+          "last_opened_time",
+          "path",
+          "sid",
+          "version"
+        ],
+        "sectionRelativeRepoPath": "office_mru",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Foffice_mru.yml&value=name%3A%20office_mru%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/orbit_info",
+        "title": "orbit_info",
+        "htmlId": "table--orbitinfo--98fca7c408",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux",
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "orbit_info",
+          "desktop_channel",
+          "desktop_version",
+          "device_auth_token",
+          "enrolled",
+          "last_recorded_error",
+          "orbit_channel",
+          "osqueryd_channel",
+          "scripts_enabled",
+          "uptime",
+          "version"
+        ],
+        "sectionRelativeRepoPath": "orbit_info",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/orbit_info.yml"
+      },
+      {
+        "url": "/tables/os_version",
+        "title": "os_version",
+        "htmlId": "table--osversion--95451301c8",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux",
+          "windows",
+          "chrome"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "os_version",
+          "arch",
+          "build",
+          "codename",
+          "extra",
+          "install_date",
+          "major",
+          "minor",
+          "mount_namespace_id",
+          "name",
+          "patch",
+          "pid_with_namespace",
+          "platform",
+          "platform_like",
+          "revision",
+          "version"
+        ],
+        "sectionRelativeRepoPath": "os_version",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/os_version.yml"
+      },
+      {
+        "url": "/tables/osquery_events",
+        "title": "osquery_events",
+        "htmlId": "table--osqueryevents--3bff81a1b8",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux",
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "osquery_events",
+          "active",
+          "events",
+          "name",
+          "publisher",
+          "refreshes",
+          "subscriptions",
+          "type"
+        ],
+        "sectionRelativeRepoPath": "osquery_events",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/osquery_events.yml"
+      },
+      {
+        "url": "/tables/osquery_extensions",
+        "title": "osquery_extensions",
+        "htmlId": "table--osqueryextensions--56dea82216",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux",
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "osquery_extensions",
+          "name",
+          "path",
+          "sdk_version",
+          "type",
+          "uuid",
+          "version"
+        ],
+        "sectionRelativeRepoPath": "osquery_extensions",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/osquery_extensions.yml"
+      },
+      {
+        "url": "/tables/osquery_flags",
+        "title": "osquery_flags",
+        "htmlId": "table--osqueryflags--27972ebab6",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux",
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "osquery_flags",
+          "default_value",
+          "description",
+          "name",
+          "shell_only",
+          "type",
+          "value"
+        ],
+        "sectionRelativeRepoPath": "osquery_flags",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/osquery_flags.yml"
+      },
+      {
+        "url": "/tables/osquery_info",
+        "title": "osquery_info",
+        "htmlId": "table--osqueryinfo--99ebd3222b",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "windows",
+          "linux",
+          "chrome"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "osquery_info",
+          "build_distro",
+          "build_platform",
+          "config_hash",
+          "config_valid",
+          "extensions",
+          "instance_id",
+          "pid",
+          "platform_mask",
+          "start_time",
+          "uuid",
+          "version",
+          "watcher"
+        ],
+        "sectionRelativeRepoPath": "osquery_info",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/osquery_info.yml"
+      },
+      {
+        "url": "/tables/osquery_packs",
+        "title": "osquery_packs",
+        "htmlId": "table--osquerypacks--c2f0293ed5",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux",
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "osquery_packs",
+          "active",
+          "discovery_cache_hits",
+          "discovery_executions",
+          "name",
+          "platform",
+          "shard",
+          "version"
+        ],
+        "sectionRelativeRepoPath": "osquery_packs",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/osquery_packs.yml"
+      },
+      {
+        "url": "/tables/osquery_registry",
+        "title": "osquery_registry",
+        "htmlId": "table--osqueryregistry--723b93f998",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux",
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "osquery_registry",
+          "active",
+          "internal",
+          "name",
+          "owner_uuid",
+          "registry"
+        ],
+        "sectionRelativeRepoPath": "osquery_registry",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/osquery_registry.yml"
+      },
+      {
+        "url": "/tables/osquery_schedule",
+        "title": "osquery_schedule",
+        "htmlId": "table--osqueryschedule--81eadaf536",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux",
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "osquery_schedule",
+          "average_memory",
+          "denylisted",
+          "executions",
+          "interval",
+          "last_executed",
+          "last_memory",
+          "last_system_time",
+          "last_user_time",
+          "last_wall_time_ms",
+          "name",
+          "output_size",
+          "query",
+          "system_time",
+          "user_time",
+          "wall_time",
+          "wall_time_ms"
+        ],
+        "sectionRelativeRepoPath": "osquery_schedule",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/osquery_schedule.yml"
+      },
+      {
+        "url": "/tables/package_bom",
+        "title": "package_bom",
+        "htmlId": "table--packagebom--8182ed768f",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "package_bom",
+          "filepath",
+          "gid",
+          "mode",
+          "modified_time",
+          "path",
+          "size",
+          "uid"
+        ],
+        "sectionRelativeRepoPath": "package_bom",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/package_bom.yml"
+      },
+      {
+        "url": "/tables/package_install_history",
+        "title": "package_install_history",
+        "htmlId": "table--packageinstallhistory--988f999553",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "package_install_history",
+          "content_type",
+          "name",
+          "package_id",
+          "source",
+          "time",
+          "version"
+        ],
+        "sectionRelativeRepoPath": "package_install_history",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/package_install_history.yml"
+      },
+      {
+        "url": "/tables/package_receipts",
+        "title": "package_receipts",
+        "htmlId": "table--packagereceipts--4d830b5b2d",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "package_receipts",
+          "install_time",
+          "installer_name",
+          "location",
+          "package_filename",
+          "package_id",
+          "path",
+          "version"
+        ],
+        "sectionRelativeRepoPath": "package_receipts",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/package_receipts.yml"
+      },
+      {
+        "url": "/tables/parse_ini",
+        "title": "parse_ini",
+        "htmlId": "table--parseini--4de2377a57",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "windows",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "parse_ini",
+          "fullkey",
+          "key",
+          "parent",
+          "path",
+          "value"
+        ],
+        "sectionRelativeRepoPath": "parse_ini",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/parse_ini.yml"
+      },
+      {
+        "url": "/tables/parse_json",
+        "title": "parse_json",
+        "htmlId": "table--parsejson--c3c9947479",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "windows",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "parse_json",
+          "fullkey",
+          "key",
+          "parent",
+          "path",
+          "value"
+        ],
+        "sectionRelativeRepoPath": "parse_json",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/parse_json.yml"
+      },
+      {
+        "url": "/tables/parse_jsonl",
+        "title": "parse_jsonl",
+        "htmlId": "table--parsejsonl--b71d789467",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "windows",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "parse_jsonl",
+          "fullkey",
+          "key",
+          "parent",
+          "path",
+          "value"
+        ],
+        "sectionRelativeRepoPath": "parse_jsonl",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/parse_jsonl.yml"
+      },
+      {
+        "url": "/tables/parse_xml",
+        "title": "parse_xml",
+        "htmlId": "table--parsexml--15ed589727",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "windows",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "parse_xml",
+          "fullkey",
+          "key",
+          "parent",
+          "path",
+          "value"
+        ],
+        "sectionRelativeRepoPath": "parse_xml",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/parse_xml.yml"
+      },
+      {
+        "url": "/tables/password_policy",
+        "title": "password_policy",
+        "htmlId": "table--passwordpolicy--9a2e1051b8",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "password_policy",
+          "policy_content",
+          "policy_description",
+          "policy_identifier",
+          "uid"
+        ],
+        "sectionRelativeRepoPath": "password_policy",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/password_policy.yml"
+      },
+      {
+        "url": "/tables/patches",
+        "title": "patches",
+        "htmlId": "table--patches--b3f61813f5",
+        "evented": false,
+        "platforms": [
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "patches",
+          "caption",
+          "csname",
+          "description",
+          "fix_comments",
+          "hotfix_id",
+          "install_date",
+          "installed_by",
+          "installed_on"
+        ],
+        "sectionRelativeRepoPath": "patches",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/patches.yml"
+      },
+      {
+        "url": "/tables/pci_devices",
+        "title": "pci_devices",
+        "htmlId": "table--pcidevices--b00adf6d59",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "pci_devices",
+          "driver",
+          "model",
+          "model_id",
+          "pci_class",
+          "pci_class_id",
+          "pci_slot",
+          "pci_subclass",
+          "pci_subclass_id",
+          "subsystem_model",
+          "subsystem_model_id",
+          "subsystem_vendor",
+          "subsystem_vendor_id",
+          "vendor",
+          "vendor_id"
+        ],
+        "sectionRelativeRepoPath": "pci_devices",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/pci_devices.yml"
+      },
+      {
+        "url": "/tables/physical_disk_performance",
+        "title": "physical_disk_performance",
+        "htmlId": "table--physicaldiskperformance--21ffb96328",
+        "evented": false,
+        "platforms": [
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "physical_disk_performance",
+          "avg_disk_bytes_per_read",
+          "avg_disk_bytes_per_write",
+          "avg_disk_read_queue_length",
+          "avg_disk_sec_per_read",
+          "avg_disk_sec_per_write",
+          "avg_disk_write_queue_length",
+          "current_disk_queue_length",
+          "name",
+          "percent_disk_read_time",
+          "percent_disk_time",
+          "percent_disk_write_time",
+          "percent_idle_time"
+        ],
+        "sectionRelativeRepoPath": "physical_disk_performance",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fphysical_disk_performance.yml&value=name%3A%20physical_disk_performance%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/pipes",
+        "title": "pipes",
+        "htmlId": "table--pipes--6c348a0bda",
+        "evented": false,
+        "platforms": [
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "pipes",
+          "flags",
+          "instances",
+          "max_instances",
+          "name",
+          "pid"
+        ],
+        "sectionRelativeRepoPath": "pipes",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/pipes.yml"
+      },
+      {
+        "url": "/tables/platform_info",
+        "title": "platform_info",
+        "htmlId": "table--platforminfo--606b0b07f8",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux",
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "platform_info",
+          "address",
+          "date",
+          "extra",
+          "firmware_type",
+          "revision",
+          "size",
+          "vendor",
+          "version",
+          "volume_size"
+        ],
+        "sectionRelativeRepoPath": "platform_info",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/platform_info.yml"
+      },
+      {
+        "url": "/tables/plist",
+        "title": "plist",
+        "htmlId": "table--plist--10bd270ccc",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "plist",
+          "key",
+          "path",
+          "subkey",
+          "value"
+        ],
+        "sectionRelativeRepoPath": "plist",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/plist.yml"
+      },
+      {
+        "url": "/tables/pmset",
+        "title": "pmset",
+        "htmlId": "table--pmset--5f7c05dca3",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "pmset",
+          "getting",
+          "json_result"
+        ],
+        "sectionRelativeRepoPath": "pmset",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/pmset.yml"
+      },
+      {
+        "url": "/tables/portage_keywords",
+        "title": "portage_keywords",
+        "htmlId": "table--portagekeywords--16048373f7",
+        "evented": false,
+        "platforms": [
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "portage_keywords",
+          "keyword",
+          "mask",
+          "package",
+          "unmask",
+          "version"
+        ],
+        "sectionRelativeRepoPath": "portage_keywords",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fportage_keywords.yml&value=name%3A%20portage_keywords%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/portage_packages",
+        "title": "portage_packages",
+        "htmlId": "table--portagepackages--af336b6b49",
+        "evented": false,
+        "platforms": [
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "portage_packages",
+          "build_time",
+          "eapi",
+          "package",
+          "repository",
+          "size",
+          "slot",
+          "version",
+          "world"
+        ],
+        "sectionRelativeRepoPath": "portage_packages",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fportage_packages.yml&value=name%3A%20portage_packages%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/portage_use",
+        "title": "portage_use",
+        "htmlId": "table--portageuse--61384aa618",
+        "evented": false,
+        "platforms": [
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "portage_use",
+          "package",
+          "use",
+          "version"
+        ],
+        "sectionRelativeRepoPath": "portage_use",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fportage_use.yml&value=name%3A%20portage_use%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/power_sensors",
+        "title": "power_sensors",
+        "htmlId": "table--powersensors--27bd8387f6",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "power_sensors",
+          "category",
+          "key",
+          "name",
+          "value"
+        ],
+        "sectionRelativeRepoPath": "power_sensors",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/power_sensors.yml"
+      },
+      {
+        "url": "/tables/powershell_events",
+        "title": "powershell_events",
+        "htmlId": "table--powershellevents--728605e870",
+        "evented": true,
+        "platforms": [
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "powershell_events",
+          "cosine_similarity",
+          "datetime",
+          "script_block_count",
+          "script_block_id",
+          "script_name",
+          "script_path",
+          "script_text",
+          "time"
+        ],
+        "sectionRelativeRepoPath": "powershell_events",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fpowershell_events.yml&value=name%3A%20powershell_events%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/preferences",
+        "title": "preferences",
+        "htmlId": "table--preferences--96fcf226b3",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "preferences",
+          "domain",
+          "forced",
+          "host",
+          "key",
+          "subkey",
+          "username",
+          "value"
+        ],
+        "sectionRelativeRepoPath": "preferences",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/preferences.yml"
+      },
+      {
+        "url": "/tables/prefetch",
+        "title": "prefetch",
+        "htmlId": "table--prefetch--8592ee7112",
+        "evented": false,
+        "platforms": [
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "prefetch",
+          "accessed_directories",
+          "accessed_directories_count",
+          "accessed_files",
+          "accessed_files_count",
+          "filename",
+          "hash",
+          "last_run_time",
+          "other_run_times",
+          "path",
+          "run_count",
+          "size",
+          "volume_creation",
+          "volume_serial"
+        ],
+        "sectionRelativeRepoPath": "prefetch",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fprefetch.yml&value=name%3A%20prefetch%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/privacy_preferences",
+        "title": "privacy_preferences",
+        "htmlId": "table--privacypreferences--927ea3e9b3",
+        "evented": false,
+        "platforms": [
+          "chrome"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "privacy_preferences",
+          "ad_measurement_enabled",
+          "autofill_address_enabled",
+          "autofill_credit_card_enabled",
+          "autofill_enabled",
+          "do_not_track_enabled",
+          "fledge_enabled",
+          "hyperlink_auditing_enabled",
+          "network_prediction_enabled",
+          "privacy_sandbox_enabled",
+          "protected_content_enabled",
+          "referrers_enabled",
+          "safe_browsing_enabled",
+          "safe_browsing_extended_reporting_enabled",
+          "save_passwords_enabled",
+          "search_suggest_enabled",
+          "spelling_service_enabled",
+          "third_party_cookies_allowed",
+          "topics_enabled",
+          "translation_service_enabled",
+          "web_rtc_ip_handling_policy"
+        ],
+        "sectionRelativeRepoPath": "privacy_preferences",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/privacy_preferences.yml"
+      },
+      {
+        "url": "/tables/process_envs",
+        "title": "process_envs",
+        "htmlId": "table--processenvs--586b20fc53",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "process_envs",
+          "key",
+          "pid",
+          "value"
+        ],
+        "sectionRelativeRepoPath": "process_envs",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/process_envs.yml"
+      },
+      {
+        "url": "/tables/process_etw_events",
+        "title": "process_etw_events",
+        "htmlId": "table--processetwevents--61143eacfc",
+        "evented": true,
+        "platforms": [
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "process_etw_events",
+          "cmdline",
+          "datetime",
+          "eid",
+          "exit_code",
+          "flags",
+          "header_pid",
+          "mandatory_label",
+          "parent_process_sequence_number",
+          "path",
+          "pid",
+          "ppid",
+          "process_sequence_number",
+          "session_id",
+          "time",
+          "time_windows",
+          "token_elevation_status",
+          "token_elevation_type",
+          "type",
+          "username"
+        ],
+        "sectionRelativeRepoPath": "process_etw_events",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fprocess_etw_events.yml&value=name%3A%20process_etw_events%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/process_events",
+        "title": "process_events",
+        "htmlId": "table--processevents--6ae8ba2267",
+        "evented": true,
+        "platforms": [
+          "darwin",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "process_events",
+          "atime",
+          "auid",
+          "btime",
+          "cmdline",
+          "cmdline_size",
+          "ctime",
+          "cwd",
+          "egid",
+          "eid",
+          "env",
+          "env_count",
+          "env_size",
+          "euid",
+          "fsgid",
+          "fsuid",
+          "gid",
+          "mode",
+          "mtime",
+          "overflows",
+          "owner_gid",
+          "owner_uid",
+          "parent",
+          "path",
+          "pid",
+          "sgid",
+          "status",
+          "suid",
+          "syscall",
+          "time",
+          "uid",
+          "uptime"
+        ],
+        "sectionRelativeRepoPath": "process_events",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/process_events.yml"
+      },
+      {
+        "url": "/tables/process_file_events",
+        "title": "process_file_events",
+        "htmlId": "table--processfileevents--67c363ae55",
+        "evented": true,
+        "platforms": [
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "process_file_events",
+          "auid",
+          "cwd",
+          "dest_path",
+          "egid",
+          "eid",
+          "euid",
+          "executable",
+          "fsgid",
+          "fsuid",
+          "gid",
+          "operation",
+          "partial",
+          "path",
+          "pid",
+          "ppid",
+          "sgid",
+          "suid",
+          "time",
+          "uid",
+          "uptime"
+        ],
+        "sectionRelativeRepoPath": "process_file_events",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/process_file_events.yml"
+      },
+      {
+        "url": "/tables/process_memory_map",
+        "title": "process_memory_map",
+        "htmlId": "table--processmemorymap--6bf8d10644",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux",
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "process_memory_map",
+          "device",
+          "end",
+          "inode",
+          "offset",
+          "path",
+          "permissions",
+          "pid",
+          "pseudo",
+          "start"
+        ],
+        "sectionRelativeRepoPath": "process_memory_map",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/process_memory_map.yml"
+      },
+      {
+        "url": "/tables/process_namespaces",
+        "title": "process_namespaces",
+        "htmlId": "table--processnamespaces--d1156621d4",
+        "evented": false,
+        "platforms": [
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "process_namespaces",
+          "cgroup_namespace",
+          "ipc_namespace",
+          "mnt_namespace",
+          "net_namespace",
+          "pid",
+          "pid_namespace",
+          "user_namespace",
+          "uts_namespace"
+        ],
+        "sectionRelativeRepoPath": "process_namespaces",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fprocess_namespaces.yml&value=name%3A%20process_namespaces%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/process_open_files",
+        "title": "process_open_files",
+        "htmlId": "table--processopenfiles--43c8c6bba0",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "process_open_files",
+          "fd",
+          "path",
+          "pid"
+        ],
+        "sectionRelativeRepoPath": "process_open_files",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/process_open_files.yml"
+      },
+      {
+        "url": "/tables/process_open_pipes",
+        "title": "process_open_pipes",
+        "htmlId": "table--processopenpipes--0f49c83994",
+        "evented": false,
+        "platforms": [
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "process_open_pipes",
+          "fd",
+          "inode",
+          "mode",
+          "partner_fd",
+          "partner_mode",
+          "partner_pid",
+          "pid",
+          "type"
+        ],
+        "sectionRelativeRepoPath": "process_open_pipes",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fprocess_open_pipes.yml&value=name%3A%20process_open_pipes%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/process_open_sockets",
+        "title": "process_open_sockets",
+        "htmlId": "table--processopensockets--9dc2c99a67",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux",
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "process_open_sockets",
+          "family",
+          "fd",
+          "local_address",
+          "local_port",
+          "net_namespace",
+          "path",
+          "pid",
+          "protocol",
+          "remote_address",
+          "remote_port",
+          "socket",
+          "state"
+        ],
+        "sectionRelativeRepoPath": "process_open_sockets",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/process_open_sockets.yml"
+      },
+      {
+        "url": "/tables/processes",
+        "title": "processes",
+        "htmlId": "table--processes--3a54ed4992",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux",
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "processes",
+          "cgroup_path",
+          "cmdline",
+          "cpu_subtype",
+          "cpu_type",
+          "cwd",
+          "disk_bytes_read",
+          "disk_bytes_written",
+          "egid",
+          "elapsed_time",
+          "elevated_token",
+          "euid",
+          "gid",
+          "handle_count",
+          "name",
+          "nice",
+          "on_disk",
+          "parent",
+          "path",
+          "percent_processor_time",
+          "pgroup",
+          "pid",
+          "protection_type",
+          "resident_size",
+          "root",
+          "secure_process",
+          "sgid",
+          "start_time",
+          "state",
+          "suid",
+          "system_time",
+          "threads",
+          "total_size",
+          "translated",
+          "uid",
+          "upid",
+          "uppid",
+          "user_time",
+          "virtual_process",
+          "wired_size"
+        ],
+        "sectionRelativeRepoPath": "processes",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/processes.yml"
+      },
+      {
+        "url": "/tables/programs",
+        "title": "programs",
+        "htmlId": "table--programs--f7f76d14a9",
+        "evented": false,
+        "platforms": [
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "programs",
+          "identifying_number",
+          "install_date",
+          "install_location",
+          "install_source",
+          "language",
+          "name",
+          "publisher",
+          "uninstall_string",
+          "version"
+        ],
+        "sectionRelativeRepoPath": "programs",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/programs.yml"
+      },
+      {
+        "url": "/tables/prometheus_metrics",
+        "title": "prometheus_metrics",
+        "htmlId": "table--prometheusmetrics--f6ce409d91",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "prometheus_metrics",
+          "metric_name",
+          "metric_value",
+          "target_name",
+          "timestamp_ms"
+        ],
+        "sectionRelativeRepoPath": "prometheus_metrics",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fprometheus_metrics.yml&value=name%3A%20prometheus_metrics%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/puppet_info",
+        "title": "puppet_info",
+        "htmlId": "table--puppetinfo--ce553a89eb",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "windows",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "puppet_info",
+          "cached_catalog_status",
+          "catalog_uuid",
+          "code_id",
+          "configuration_version",
+          "corrective_change",
+          "environment",
+          "host",
+          "kind",
+          "master_used",
+          "noop",
+          "noop_pending",
+          "puppet_version",
+          "report_format",
+          "status",
+          "time",
+          "transaction_completed",
+          "transaction_uuid"
+        ],
+        "sectionRelativeRepoPath": "puppet_info",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/puppet_info.yml"
+      },
+      {
+        "url": "/tables/puppet_logs",
+        "title": "puppet_logs",
+        "htmlId": "table--puppetlogs--c81bf10f91",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "windows",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "puppet_logs",
+          "file",
+          "level",
+          "line",
+          "message",
+          "source",
+          "time"
+        ],
+        "sectionRelativeRepoPath": "puppet_logs",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/puppet_logs.yml"
+      },
+      {
+        "url": "/tables/puppet_state",
+        "title": "puppet_state",
+        "htmlId": "table--puppetstate--802f52e922",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "windows",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "puppet_state",
+          "change_count",
+          "changed",
+          "corrective_change",
+          "evaluation_time",
+          "failed",
+          "file",
+          "line",
+          "out_of_sync",
+          "out_of_sync_count",
+          "resource",
+          "resource_type",
+          "skipped",
+          "title"
+        ],
+        "sectionRelativeRepoPath": "puppet_state",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/puppet_state.yml"
+      },
+      {
+        "url": "/tables/pwd_policy",
+        "title": "pwd_policy",
+        "htmlId": "table--pwdpolicy--b862a98afa",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "pwd_policy",
+          "days_to_expiration",
+          "expires_every_n_days",
+          "history_depth",
+          "max_failed_attempts",
+          "min_mixed_case_characters"
+        ],
+        "sectionRelativeRepoPath": "pwd_policy",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/pwd_policy.yml"
+      },
+      {
+        "url": "/tables/python_packages",
+        "title": "python_packages",
+        "htmlId": "table--pythonpackages--31ae8c2370",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux",
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "python_packages",
+          "author",
+          "directory",
+          "license",
+          "name",
+          "path",
+          "pid_with_namespace",
+          "summary",
+          "version"
+        ],
+        "sectionRelativeRepoPath": "python_packages",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/python_packages.yml"
+      },
+      {
+        "url": "/tables/quicklook_cache",
+        "title": "quicklook_cache",
+        "htmlId": "table--quicklookcache--19ae561620",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "quicklook_cache",
+          "cache_path",
+          "fs_id",
+          "hit_count",
+          "icon_mode",
+          "inode",
+          "label",
+          "last_hit_date",
+          "mtime",
+          "path",
+          "rowid",
+          "size",
+          "volume_id"
+        ],
+        "sectionRelativeRepoPath": "quicklook_cache",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fquicklook_cache.yml&value=name%3A%20quicklook_cache%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/registry",
+        "title": "registry",
+        "htmlId": "table--registry--415b2b1c89",
+        "evented": false,
+        "platforms": [
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "registry",
+          "data",
+          "key",
+          "mtime",
+          "name",
+          "path",
+          "type"
+        ],
+        "sectionRelativeRepoPath": "registry",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/registry.yml"
+      },
+      {
+        "url": "/tables/routes",
+        "title": "routes",
+        "htmlId": "table--routes--ed00beba43",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux",
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "routes",
+          "destination",
+          "flags",
+          "gateway",
+          "hopcount",
+          "interface",
+          "metric",
+          "mtu",
+          "netmask",
+          "source",
+          "type"
+        ],
+        "sectionRelativeRepoPath": "routes",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/routes.yml"
+      },
+      {
+        "url": "/tables/rpm_package_files",
+        "title": "rpm_package_files",
+        "htmlId": "table--rpmpackagefiles--96e530c921",
+        "evented": false,
+        "platforms": [
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "rpm_package_files",
+          "groupname",
+          "mode",
+          "package",
+          "path",
+          "sha256",
+          "size",
+          "username"
+        ],
+        "sectionRelativeRepoPath": "rpm_package_files",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Frpm_package_files.yml&value=name%3A%20rpm_package_files%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/rpm_packages",
+        "title": "rpm_packages",
+        "htmlId": "table--rpmpackages--e4da8f9f41",
+        "evented": false,
+        "platforms": [
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "rpm_packages",
+          "arch",
+          "epoch",
+          "install_time",
+          "mount_namespace_id",
+          "name",
+          "package_group",
+          "pid_with_namespace",
+          "release",
+          "sha1",
+          "size",
+          "source",
+          "vendor",
+          "version"
+        ],
+        "sectionRelativeRepoPath": "rpm_packages",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/rpm_packages.yml"
+      },
+      {
+        "url": "/tables/running_apps",
+        "title": "running_apps",
+        "htmlId": "table--runningapps--c9443711d8",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "running_apps",
+          "bundle_identifier",
+          "is_active",
+          "pid"
+        ],
+        "sectionRelativeRepoPath": "running_apps",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/running_apps.yml"
+      },
+      {
+        "url": "/tables/safari_extensions",
+        "title": "safari_extensions",
+        "htmlId": "table--safariextensions--75748b2d43",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "safari_extensions",
+          "author",
+          "bundle_version",
+          "copyright",
+          "description",
+          "developer_id",
+          "extension_type",
+          "identifier",
+          "name",
+          "path",
+          "sdk",
+          "uid",
+          "update_url",
+          "version"
+        ],
+        "sectionRelativeRepoPath": "safari_extensions",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/safari_extensions.yml"
+      },
+      {
+        "url": "/tables/sandboxes",
+        "title": "sandboxes",
+        "htmlId": "table--sandboxes--c68d00ef55",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "sandboxes",
+          "build_id",
+          "bundle_path",
+          "enabled",
+          "label",
+          "path",
+          "user"
+        ],
+        "sectionRelativeRepoPath": "sandboxes",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fsandboxes.yml&value=name%3A%20sandboxes%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/scheduled_tasks",
+        "title": "scheduled_tasks",
+        "htmlId": "table--scheduledtasks--a69b6b604d",
+        "evented": false,
+        "platforms": [
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "scheduled_tasks",
+          "action",
+          "enabled",
+          "hidden",
+          "last_run_code",
+          "last_run_message",
+          "last_run_time",
+          "name",
+          "next_run_time",
+          "path",
+          "state"
+        ],
+        "sectionRelativeRepoPath": "scheduled_tasks",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/scheduled_tasks.yml"
+      },
+      {
+        "url": "/tables/screenlock",
+        "title": "screenlock",
+        "htmlId": "table--screenlock--91a400ed71",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "chrome"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "screenlock",
+          "enabled",
+          "grace_period"
+        ],
+        "sectionRelativeRepoPath": "screenlock",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/screenlock.yml"
+      },
+      {
+        "url": "/tables/seccomp_events",
+        "title": "seccomp_events",
+        "htmlId": "table--seccompevents--5cf6060bd9",
+        "evented": true,
+        "platforms": [
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "seccomp_events",
+          "arch",
+          "auid",
+          "code",
+          "comm",
+          "compat",
+          "exe",
+          "gid",
+          "ip",
+          "pid",
+          "ses",
+          "sig",
+          "syscall",
+          "time",
+          "uid",
+          "uptime"
+        ],
+        "sectionRelativeRepoPath": "seccomp_events",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fseccomp_events.yml&value=name%3A%20seccomp_events%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/secureboot",
+        "title": "secureboot",
+        "htmlId": "table--secureboot--299ca9c718",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux",
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "secureboot",
+          "description",
+          "kernel_extensions",
+          "mdm_operations",
+          "secure_boot",
+          "secure_mode",
+          "setup_mode"
+        ],
+        "sectionRelativeRepoPath": "secureboot",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/secureboot.yml"
+      },
+      {
+        "url": "/tables/security_profile_info",
+        "title": "security_profile_info",
+        "htmlId": "table--securityprofileinfo--17121d5fa6",
+        "evented": false,
+        "platforms": [
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "security_profile_info",
+          "audit_account_logon",
+          "audit_account_manage",
+          "audit_ds_access",
+          "audit_logon_events",
+          "audit_object_access",
+          "audit_policy_change",
+          "audit_privilege_use",
+          "audit_process_tracking",
+          "audit_system_events",
+          "clear_text_password",
+          "enable_admin_account",
+          "enable_guest_account",
+          "force_logoff_when_expire",
+          "lockout_bad_count",
+          "logon_to_change_password",
+          "lsa_anonymous_name_lookup",
+          "maximum_password_age",
+          "minimum_password_age",
+          "minimum_password_length",
+          "new_administrator_name",
+          "new_guest_name",
+          "password_complexity",
+          "password_history_size"
+        ],
+        "sectionRelativeRepoPath": "security_profile_info",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fsecurity_profile_info.yml&value=name%3A%20security_profile_info%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/selinux_events",
+        "title": "selinux_events",
+        "htmlId": "table--selinuxevents--cfc47c5cc9",
+        "evented": true,
+        "platforms": [
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "selinux_events",
+          "eid",
+          "message",
+          "time",
+          "type",
+          "uptime"
+        ],
+        "sectionRelativeRepoPath": "selinux_events",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fselinux_events.yml&value=name%3A%20selinux_events%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/selinux_settings",
+        "title": "selinux_settings",
+        "htmlId": "table--selinuxsettings--392476076c",
+        "evented": false,
+        "platforms": [
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "selinux_settings",
+          "key",
+          "scope",
+          "value"
+        ],
+        "sectionRelativeRepoPath": "selinux_settings",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fselinux_settings.yml&value=name%3A%20selinux_settings%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/services",
+        "title": "services",
+        "htmlId": "table--services--a7e374154f",
+        "evented": false,
+        "platforms": [
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "services",
+          "description",
+          "display_name",
+          "module_path",
+          "name",
+          "path",
+          "pid",
+          "service_exit_code",
+          "service_type",
+          "start_type",
+          "status",
+          "user_account",
+          "win32_exit_code"
+        ],
+        "sectionRelativeRepoPath": "services",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fservices.yml&value=name%3A%20services%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/shadow",
+        "title": "shadow",
+        "htmlId": "table--shadow--2a5e749131",
+        "evented": false,
+        "platforms": [
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "shadow",
+          "expire",
+          "flag",
+          "hash_alg",
+          "inactive",
+          "last_change",
+          "max",
+          "min",
+          "password_status",
+          "username",
+          "warning"
+        ],
+        "sectionRelativeRepoPath": "shadow",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fshadow.yml&value=name%3A%20shadow%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/shared_folders",
+        "title": "shared_folders",
+        "htmlId": "table--sharedfolders--edd6c29f21",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "shared_folders",
+          "name",
+          "path"
+        ],
+        "sectionRelativeRepoPath": "shared_folders",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/shared_folders.yml"
+      },
+      {
+        "url": "/tables/shared_memory",
+        "title": "shared_memory",
+        "htmlId": "table--sharedmemory--4632a169c9",
+        "evented": false,
+        "platforms": [
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "shared_memory",
+          "atime",
+          "attached",
+          "creator_pid",
+          "creator_uid",
+          "ctime",
+          "dtime",
+          "locked",
+          "owner_uid",
+          "permissions",
+          "pid",
+          "shmid",
+          "size",
+          "status"
+        ],
+        "sectionRelativeRepoPath": "shared_memory",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fshared_memory.yml&value=name%3A%20shared_memory%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/shared_resources",
+        "title": "shared_resources",
+        "htmlId": "table--sharedresources--1eedd340fb",
+        "evented": false,
+        "platforms": [
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "shared_resources",
+          "allow_maximum",
+          "description",
+          "install_date",
+          "maximum_allowed",
+          "name",
+          "path",
+          "status",
+          "type",
+          "type_name"
+        ],
+        "sectionRelativeRepoPath": "shared_resources",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/shared_resources.yml"
+      },
+      {
+        "url": "/tables/sharing_preferences",
+        "title": "sharing_preferences",
+        "htmlId": "table--sharingpreferences--435a39048e",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "sharing_preferences",
+          "bluetooth_sharing",
+          "content_caching",
+          "disc_sharing",
+          "file_sharing",
+          "internet_sharing",
+          "printer_sharing",
+          "remote_apple_events",
+          "remote_login",
+          "remote_management",
+          "screen_sharing"
+        ],
+        "sectionRelativeRepoPath": "sharing_preferences",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/sharing_preferences.yml"
+      },
+      {
+        "url": "/tables/shell_history",
+        "title": "shell_history",
+        "htmlId": "table--shellhistory--487890df4c",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "shell_history",
+          "command",
+          "history_file",
+          "time",
+          "uid"
+        ],
+        "sectionRelativeRepoPath": "shell_history",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/shell_history.yml"
+      },
+      {
+        "url": "/tables/shellbags",
+        "title": "shellbags",
+        "htmlId": "table--shellbags--ea58c94fcb",
+        "evented": false,
+        "platforms": [
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "shellbags",
+          "accessed_time",
+          "created_time",
+          "mft_entry",
+          "mft_sequence",
+          "modified_time",
+          "path",
+          "sid",
+          "source"
+        ],
+        "sectionRelativeRepoPath": "shellbags",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fshellbags.yml&value=name%3A%20shellbags%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/shimcache",
+        "title": "shimcache",
+        "htmlId": "table--shimcache--78c1808f2a",
+        "evented": false,
+        "platforms": [
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "shimcache",
+          "entry",
+          "execution_flag",
+          "modified_time",
+          "path"
+        ],
+        "sectionRelativeRepoPath": "shimcache",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/shimcache.yml"
+      },
+      {
+        "url": "/tables/signature",
+        "title": "signature",
+        "htmlId": "table--signature--651b5e1a16",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "signature",
+          "arch",
+          "authority",
+          "cdhash",
+          "hash_resources",
+          "identifier",
+          "path",
+          "signed",
+          "team_identifier"
+        ],
+        "sectionRelativeRepoPath": "signature",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/signature.yml"
+      },
+      {
+        "url": "/tables/sip_config",
+        "title": "sip_config",
+        "htmlId": "table--sipconfig--72a4d07300",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "sip_config",
+          "config_flag",
+          "enabled",
+          "enabled_nvram"
+        ],
+        "sectionRelativeRepoPath": "sip_config",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/sip_config.yml"
+      },
+      {
+        "url": "/tables/smbios_tables",
+        "title": "smbios_tables",
+        "htmlId": "table--smbiostables--14a3086ac5",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "smbios_tables",
+          "description",
+          "handle",
+          "header_size",
+          "md5",
+          "number",
+          "size",
+          "type"
+        ],
+        "sectionRelativeRepoPath": "smbios_tables",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/smbios_tables.yml"
+      },
+      {
+        "url": "/tables/smc_keys",
+        "title": "smc_keys",
+        "htmlId": "table--smckeys--65a180be47",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "smc_keys",
+          "hidden",
+          "key",
+          "size",
+          "type",
+          "value"
+        ],
+        "sectionRelativeRepoPath": "smc_keys",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/smc_keys.yml"
+      },
+      {
+        "url": "/tables/sntp_request",
+        "title": "sntp_request",
+        "htmlId": "table--sntprequest--31b3965f95",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "windows",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "sntp_request",
+          "clock_offset_ms",
+          "server",
+          "timestamp_ms"
+        ],
+        "sectionRelativeRepoPath": "sntp_request",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/sntp_request.yml"
+      },
+      {
+        "url": "/tables/socket_events",
+        "title": "socket_events",
+        "htmlId": "table--socketevents--45972f7f3b",
+        "evented": true,
+        "platforms": [
+          "darwin",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "socket_events",
+          "action",
+          "auid",
+          "eid",
+          "family",
+          "fd",
+          "local_address",
+          "local_port",
+          "path",
+          "pid",
+          "protocol",
+          "remote_address",
+          "remote_port",
+          "socket",
+          "status",
+          "success",
+          "time",
+          "uptime"
+        ],
+        "sectionRelativeRepoPath": "socket_events",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fsocket_events.yml&value=name%3A%20socket_events%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/sofa_security_release_info",
+        "title": "sofa_security_release_info",
+        "htmlId": "table--sofasecurityreleaseinfo--b23bdf9329",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "sofa_security_release_info",
+          "days_since_previous_release",
+          "os_version",
+          "product_version",
+          "release_date",
+          "security_info",
+          "unique_cves_count",
+          "update_name"
+        ],
+        "sectionRelativeRepoPath": "sofa_security_release_info",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/sofa_security_release_info.yml"
+      },
+      {
+        "url": "/tables/sofa_unpatched_cves",
+        "title": "sofa_unpatched_cves",
+        "htmlId": "table--sofaunpatchedcves--680ab849b7",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "sofa_unpatched_cves",
+          "actively_exploited",
+          "cve",
+          "os_version",
+          "patched_version"
+        ],
+        "sectionRelativeRepoPath": "sofa_unpatched_cves",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/sofa_unpatched_cves.yml"
+      },
+      {
+        "url": "/tables/software_update",
+        "title": "software_update",
+        "htmlId": "table--softwareupdate--6cb5e63ee6",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "software_update",
+          "software_update_required"
+        ],
+        "sectionRelativeRepoPath": "software_update",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/software_update.yml"
+      },
+      {
+        "url": "/tables/ssh_configs",
+        "title": "ssh_configs",
+        "htmlId": "table--sshconfigs--084b9832a4",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux",
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "ssh_configs",
+          "block",
+          "option",
+          "ssh_config_file",
+          "uid"
+        ],
+        "sectionRelativeRepoPath": "ssh_configs",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/ssh_configs.yml"
+      },
+      {
+        "url": "/tables/startup_items",
+        "title": "startup_items",
+        "htmlId": "table--startupitems--f212a6ad4e",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux",
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "startup_items",
+          "args",
+          "name",
+          "path",
+          "source",
+          "status",
+          "type",
+          "username"
+        ],
+        "sectionRelativeRepoPath": "startup_items",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/startup_items.yml"
+      },
+      {
+        "url": "/tables/sudo_info",
+        "title": "sudo_info",
+        "htmlId": "table--sudoinfo--91f0750d0d",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "sudo_info",
+          "json_result"
+        ],
+        "sectionRelativeRepoPath": "sudo_info",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/sudo_info.yml"
+      },
+      {
+        "url": "/tables/sudoers",
+        "title": "sudoers",
+        "htmlId": "table--sudoers--53cbb8caa7",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "sudoers",
+          "header",
+          "rule_details",
+          "source"
+        ],
+        "sectionRelativeRepoPath": "sudoers",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/sudoers.yml"
+      },
+      {
+        "url": "/tables/suid_bin",
+        "title": "suid_bin",
+        "htmlId": "table--suidbin--12efbe4810",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "suid_bin",
+          "groupname",
+          "path",
+          "permissions",
+          "pid_with_namespace",
+          "username"
+        ],
+        "sectionRelativeRepoPath": "suid_bin",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/suid_bin.yml"
+      },
+      {
+        "url": "/tables/syslog_events",
+        "title": "syslog_events",
+        "htmlId": "table--syslogevents--cc5c3d702f",
+        "evented": true,
+        "platforms": [
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "syslog_events",
+          "datetime",
+          "eid",
+          "facility",
+          "host",
+          "message",
+          "severity",
+          "tag",
+          "time"
+        ],
+        "sectionRelativeRepoPath": "syslog_events",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fsyslog_events.yml&value=name%3A%20syslog_events%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/system_controls",
+        "title": "system_controls",
+        "htmlId": "table--systemcontrols--bc070f5bb2",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "system_controls",
+          "config_value",
+          "current_value",
+          "field_name",
+          "name",
+          "oid",
+          "subsystem",
+          "type"
+        ],
+        "sectionRelativeRepoPath": "system_controls",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/system_controls.yml"
+      },
+      {
+        "url": "/tables/system_extensions",
+        "title": "system_extensions",
+        "htmlId": "table--systemextensions--59019bbb28",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "system_extensions",
+          "UUID",
+          "bundle_path",
+          "category",
+          "identifier",
+          "mdm_managed",
+          "path",
+          "state",
+          "team",
+          "version"
+        ],
+        "sectionRelativeRepoPath": "system_extensions",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/system_extensions.yml"
+      },
+      {
+        "url": "/tables/system_info",
+        "title": "system_info",
+        "htmlId": "table--systeminfo--4f963da54a",
+        "evented": false,
+        "platforms": [
+          "windows",
+          "darwin",
+          "linux",
+          "chrome"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "system_info",
+          "board_model",
+          "board_serial",
+          "board_vendor",
+          "board_version",
+          "computer_name",
+          "cpu_brand",
+          "cpu_logical_cores",
+          "cpu_microcode",
+          "cpu_physical_cores",
+          "cpu_sockets",
+          "cpu_subtype",
+          "cpu_type",
+          "hardware_model",
+          "hardware_serial",
+          "hardware_vendor",
+          "hardware_version",
+          "hostname",
+          "local_hostname",
+          "physical_memory",
+          "uuid"
+        ],
+        "sectionRelativeRepoPath": "system_info",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/system_info.yml"
+      },
+      {
+        "url": "/tables/system_state",
+        "title": "system_state",
+        "htmlId": "table--systemstate--d1ce3bbb0e",
+        "evented": false,
+        "platforms": [
+          "chrome"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "system_state",
+          "idle_state"
+        ],
+        "sectionRelativeRepoPath": "system_state",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/system_state.yml"
+      },
+      {
+        "url": "/tables/systemd_units",
+        "title": "systemd_units",
+        "htmlId": "table--systemdunits--cc47585fcb",
+        "evented": false,
+        "platforms": [
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "systemd_units",
+          "active_state",
+          "description",
+          "following",
+          "fragment_path",
+          "id",
+          "job_id",
+          "job_path",
+          "job_type",
+          "load_state",
+          "object_path",
+          "source_path",
+          "sub_state",
+          "unit_file_state",
+          "user"
+        ],
+        "sectionRelativeRepoPath": "systemd_units",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fsystemd_units.yml&value=name%3A%20systemd_units%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/tcc_access",
+        "title": "tcc_access",
+        "htmlId": "table--tccaccess--103e029af3",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "tcc_access",
+          "auth_reason",
+          "auth_value",
+          "client",
+          "client_type",
+          "indirect_object_identifier",
+          "indirect_object_identifier_type",
+          "last_modified",
+          "policy_id",
+          "service",
+          "source",
+          "uid"
+        ],
+        "sectionRelativeRepoPath": "tcc_access",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/tcc_access.yml"
+      },
+      {
+        "url": "/tables/temperature_sensors",
+        "title": "temperature_sensors",
+        "htmlId": "table--temperaturesensors--952195065c",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "temperature_sensors",
+          "celsius",
+          "fahrenheit",
+          "key",
+          "name"
+        ],
+        "sectionRelativeRepoPath": "temperature_sensors",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/temperature_sensors.yml"
+      },
+      {
+        "url": "/tables/time",
+        "title": "time",
+        "htmlId": "table--time--740a172c2f",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux",
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "time",
+          "datetime",
+          "day",
+          "hour",
+          "iso_8601",
+          "local_timezone",
+          "minutes",
+          "month",
+          "seconds",
+          "timestamp",
+          "timezone",
+          "unix_time",
+          "weekday",
+          "win_timestamp",
+          "year"
+        ],
+        "sectionRelativeRepoPath": "time",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/time.yml"
+      },
+      {
+        "url": "/tables/time_machine_backups",
+        "title": "time_machine_backups",
+        "htmlId": "table--timemachinebackups--6a1cb2e696",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "time_machine_backups",
+          "backup_date",
+          "destination_id"
+        ],
+        "sectionRelativeRepoPath": "time_machine_backups",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/time_machine_backups.yml"
+      },
+      {
+        "url": "/tables/time_machine_destinations",
+        "title": "time_machine_destinations",
+        "htmlId": "table--timemachinedestinations--8c33b4e082",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "time_machine_destinations",
+          "alias",
+          "bytes_available",
+          "bytes_used",
+          "consistency_scan_date",
+          "destination_id",
+          "encryption",
+          "root_volume_uuid"
+        ],
+        "sectionRelativeRepoPath": "time_machine_destinations",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/time_machine_destinations.yml"
+      },
+      {
+        "url": "/tables/tpm_info",
+        "title": "tpm_info",
+        "htmlId": "table--tpminfo--086cc37696",
+        "evented": false,
+        "platforms": [
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "tpm_info",
+          "activated",
+          "enabled",
+          "manufacturer_id",
+          "manufacturer_name",
+          "manufacturer_version",
+          "owned",
+          "physical_presence_version",
+          "product_name",
+          "spec_version"
+        ],
+        "sectionRelativeRepoPath": "tpm_info",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Ftpm_info.yml&value=name%3A%20tpm_info%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/ulimit_info",
+        "title": "ulimit_info",
+        "htmlId": "table--ulimitinfo--9cff90dafb",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "ulimit_info",
+          "hard_limit",
+          "soft_limit",
+          "type"
+        ],
+        "sectionRelativeRepoPath": "ulimit_info",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/ulimit_info.yml"
+      },
+      {
+        "url": "/tables/unified_log",
+        "title": "unified_log",
+        "htmlId": "table--unifiedlog--d971aaf7c9",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "unified_log",
+          "activity",
+          "category",
+          "level",
+          "max_rows",
+          "message",
+          "pid",
+          "predicate",
+          "process",
+          "sender",
+          "storage",
+          "subsystem",
+          "tid",
+          "timestamp"
+        ],
+        "sectionRelativeRepoPath": "unified_log",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Funified_log.yml&value=name%3A%20unified_log%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/uptime",
+        "title": "uptime",
+        "htmlId": "table--uptime--542f2cc52b",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux",
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "uptime",
+          "days",
+          "hours",
+          "minutes",
+          "seconds",
+          "total_seconds"
+        ],
+        "sectionRelativeRepoPath": "uptime",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/uptime.yml"
+      },
+      {
+        "url": "/tables/usb_devices",
+        "title": "usb_devices",
+        "htmlId": "table--usbdevices--12892f9cf7",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "usb_devices",
+          "class",
+          "model",
+          "model_id",
+          "protocol",
+          "removable",
+          "serial",
+          "subclass",
+          "usb_address",
+          "usb_port",
+          "vendor",
+          "vendor_id",
+          "version"
+        ],
+        "sectionRelativeRepoPath": "usb_devices",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/usb_devices.yml"
+      },
+      {
+        "url": "/tables/user_events",
+        "title": "user_events",
+        "htmlId": "table--userevents--8aaee70de1",
+        "evented": true,
+        "platforms": [
+          "darwin",
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "user_events",
+          "address",
+          "auid",
+          "eid",
+          "message",
+          "path",
+          "pid",
+          "terminal",
+          "time",
+          "type",
+          "uid",
+          "uptime"
+        ],
+        "sectionRelativeRepoPath": "user_events",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fuser_events.yml&value=name%3A%20user_events%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/user_groups",
+        "title": "user_groups",
+        "htmlId": "table--usergroups--03e0b1a5e7",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux",
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "user_groups",
+          "gid",
+          "uid"
+        ],
+        "sectionRelativeRepoPath": "user_groups",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fuser_groups.yml&value=name%3A%20user_groups%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/user_interaction_events",
+        "title": "user_interaction_events",
+        "htmlId": "table--userinteractionevents--ed2ac5b181",
+        "evented": true,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "user_interaction_events",
+          "time"
+        ],
+        "sectionRelativeRepoPath": "user_interaction_events",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fuser_interaction_events.yml&value=name%3A%20user_interaction_events%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/user_login_settings",
+        "title": "user_login_settings",
+        "htmlId": "table--userloginsettings--1abbdf6e57",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "user_login_settings",
+          "password_hint_enabled"
+        ],
+        "sectionRelativeRepoPath": "user_login_settings",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/user_login_settings.yml"
+      },
+      {
+        "url": "/tables/user_ssh_keys",
+        "title": "user_ssh_keys",
+        "htmlId": "table--usersshkeys--1ba0f20456",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux",
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "user_ssh_keys",
+          "encrypted",
+          "key_type",
+          "path",
+          "pid_with_namespace",
+          "uid"
+        ],
+        "sectionRelativeRepoPath": "user_ssh_keys",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/user_ssh_keys.yml"
+      },
+      {
+        "url": "/tables/userassist",
+        "title": "userassist",
+        "htmlId": "table--userassist--4e3bbdb293",
+        "evented": false,
+        "platforms": [
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "userassist",
+          "count",
+          "last_execution_time",
+          "path",
+          "sid"
+        ],
+        "sectionRelativeRepoPath": "userassist",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/userassist.yml"
+      },
+      {
+        "url": "/tables/users",
+        "title": "users",
+        "htmlId": "table--users--023e2862dc",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "windows",
+          "linux",
+          "chrome"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "users",
+          "description",
+          "directory",
+          "email",
+          "gid",
+          "gid_signed",
+          "is_hidden",
+          "pid_with_namespace",
+          "shell",
+          "type",
+          "uid",
+          "uid_signed",
+          "username",
+          "uuid"
+        ],
+        "sectionRelativeRepoPath": "users",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/users.yml"
+      },
+      {
+        "url": "/tables/video_info",
+        "title": "video_info",
+        "htmlId": "table--videoinfo--bcca78a3df",
+        "evented": false,
+        "platforms": [
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "video_info",
+          "color_depth",
+          "driver",
+          "driver_date",
+          "driver_version",
+          "manufacturer",
+          "model",
+          "series",
+          "video_mode"
+        ],
+        "sectionRelativeRepoPath": "video_info",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fvideo_info.yml&value=name%3A%20video_info%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/virtual_memory_info",
+        "title": "virtual_memory_info",
+        "htmlId": "table--virtualmemoryinfo--4c4e71449e",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "virtual_memory_info",
+          "active",
+          "anonymous",
+          "compressed",
+          "compressor",
+          "copy",
+          "decompressed",
+          "faults",
+          "file_backed",
+          "free",
+          "inactive",
+          "page_ins",
+          "page_outs",
+          "purgeable",
+          "purged",
+          "reactivated",
+          "speculative",
+          "swap_ins",
+          "swap_outs",
+          "throttled",
+          "uncompressed",
+          "wired",
+          "zero_fill"
+        ],
+        "sectionRelativeRepoPath": "virtual_memory_info",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/virtual_memory_info.yml"
+      },
+      {
+        "url": "/tables/vscode_extensions",
+        "title": "vscode_extensions",
+        "htmlId": "table--vscodeextensions--3122f67e21",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux",
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "vscode_extensions",
+          "installed_at",
+          "name",
+          "path",
+          "prerelease",
+          "publisher",
+          "publisher_id",
+          "uid",
+          "uuid",
+          "version"
+        ],
+        "sectionRelativeRepoPath": "vscode_extensions",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/vscode_extensions.yml"
+      },
+      {
+        "url": "/tables/wifi_networks",
+        "title": "wifi_networks",
+        "htmlId": "table--wifinetworks--196d0fe380",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "wifi_networks",
+          "add_reason",
+          "added_at",
+          "auto_join",
+          "auto_login",
+          "captive_login_date",
+          "captive_portal",
+          "disabled",
+          "last_connected",
+          "network_name",
+          "passpoint",
+          "personal_hotspot",
+          "possibly_hidden",
+          "roaming",
+          "roaming_profile",
+          "security_type",
+          "ssid",
+          "temporarily_disabled",
+          "was_captive_network"
+        ],
+        "sectionRelativeRepoPath": "wifi_networks",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/wifi_networks.yml"
+      },
+      {
+        "url": "/tables/wifi_status",
+        "title": "wifi_status",
+        "htmlId": "table--wifistatus--7d5af734ae",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "wifi_status",
+          "bssid",
+          "channel",
+          "channel_band",
+          "channel_width",
+          "country_code",
+          "interface",
+          "mode",
+          "network_name",
+          "noise",
+          "rssi",
+          "security_type",
+          "ssid",
+          "transmit_rate"
+        ],
+        "sectionRelativeRepoPath": "wifi_status",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/wifi_status.yml"
+      },
+      {
+        "url": "/tables/wifi_survey",
+        "title": "wifi_survey",
+        "htmlId": "table--wifisurvey--86f4a22532",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "wifi_survey",
+          "bssid",
+          "channel",
+          "channel_band",
+          "channel_width",
+          "country_code",
+          "interface",
+          "network_name",
+          "noise",
+          "rssi",
+          "ssid"
+        ],
+        "sectionRelativeRepoPath": "wifi_survey",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/wifi_survey.yml"
+      },
+      {
+        "url": "/tables/winbaseobj",
+        "title": "winbaseobj",
+        "htmlId": "table--winbaseobj--0e0dd909ed",
+        "evented": false,
+        "platforms": [
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "winbaseobj",
+          "object_name",
+          "object_type",
+          "session_id"
+        ],
+        "sectionRelativeRepoPath": "winbaseobj",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fwinbaseobj.yml&value=name%3A%20winbaseobj%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/windows_crashes",
+        "title": "windows_crashes",
+        "htmlId": "table--windowscrashes--3bcda23e6b",
+        "evented": false,
+        "platforms": [
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "windows_crashes",
+          "build_number",
+          "command_line",
+          "crash_path",
+          "current_directory",
+          "datetime",
+          "exception_address",
+          "exception_code",
+          "exception_message",
+          "machine_name",
+          "major_version",
+          "minor_version",
+          "module",
+          "path",
+          "pid",
+          "process_uptime",
+          "registers",
+          "stack_trace",
+          "tid",
+          "type",
+          "username",
+          "version"
+        ],
+        "sectionRelativeRepoPath": "windows_crashes",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fwindows_crashes.yml&value=name%3A%20windows_crashes%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/windows_eventlog",
+        "title": "windows_eventlog",
+        "htmlId": "table--windowseventlog--c368bc9838",
+        "evented": false,
+        "platforms": [
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "windows_eventlog",
+          "channel",
+          "computer_name",
+          "data",
+          "datetime",
+          "eventid",
+          "keywords",
+          "level",
+          "pid",
+          "provider_guid",
+          "provider_name",
+          "task",
+          "tid",
+          "time_range",
+          "timestamp",
+          "xpath"
+        ],
+        "sectionRelativeRepoPath": "windows_eventlog",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/windows_eventlog.yml"
+      },
+      {
+        "url": "/tables/windows_events",
+        "title": "windows_events",
+        "htmlId": "table--windowsevents--b4aae30966",
+        "evented": true,
+        "platforms": [
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "windows_events",
+          "computer_name",
+          "data",
+          "datetime",
+          "eid",
+          "eventid",
+          "keywords",
+          "level",
+          "provider_guid",
+          "provider_name",
+          "source",
+          "task",
+          "time"
+        ],
+        "sectionRelativeRepoPath": "windows_events",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fwindows_events.yml&value=name%3A%20windows_events%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/windows_firewall_rules",
+        "title": "windows_firewall_rules",
+        "htmlId": "table--windowsfirewallrules--54886746d8",
+        "evented": false,
+        "platforms": [
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "windows_firewall_rules",
+          "action",
+          "app_name",
+          "direction",
+          "enabled",
+          "grouping",
+          "icmp_types_codes",
+          "local_addresses",
+          "local_ports",
+          "name",
+          "profile_domain",
+          "profile_private",
+          "profile_public",
+          "protocol",
+          "remote_addresses",
+          "remote_ports",
+          "service_name"
+        ],
+        "sectionRelativeRepoPath": "windows_firewall_rules",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/windows_firewall_rules.yml"
+      },
+      {
+        "url": "/tables/windows_optional_features",
+        "title": "windows_optional_features",
+        "htmlId": "table--windowsoptionalfeatures--7fc389462f",
+        "evented": false,
+        "platforms": [
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "windows_optional_features",
+          "caption",
+          "name",
+          "state",
+          "statename"
+        ],
+        "sectionRelativeRepoPath": "windows_optional_features",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/windows_optional_features.yml"
+      },
+      {
+        "url": "/tables/windows_search",
+        "title": "windows_search",
+        "htmlId": "table--windowssearch--3bc557a530",
+        "evented": false,
+        "platforms": [
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "windows_search",
+          "additional_properties",
+          "date_created",
+          "date_modified",
+          "max_results",
+          "name",
+          "owner",
+          "path",
+          "properties",
+          "query",
+          "size",
+          "sort",
+          "type"
+        ],
+        "sectionRelativeRepoPath": "windows_search",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fwindows_search.yml&value=name%3A%20windows_search%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/windows_security_center",
+        "title": "windows_security_center",
+        "htmlId": "table--windowssecuritycenter--8c6fbc78cd",
+        "evented": false,
+        "platforms": [
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "windows_security_center",
+          "antispyware",
+          "antivirus",
+          "autoupdate",
+          "firewall",
+          "internet_settings",
+          "user_account_control",
+          "windows_security_center_service"
+        ],
+        "sectionRelativeRepoPath": "windows_security_center",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fwindows_security_center.yml&value=name%3A%20windows_security_center%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/windows_security_products",
+        "title": "windows_security_products",
+        "htmlId": "table--windowssecurityproducts--f74ebb0ecc",
+        "evented": false,
+        "platforms": [
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "windows_security_products",
+          "name",
+          "remediation_path",
+          "signatures_up_to_date",
+          "state",
+          "state_timestamp",
+          "type"
+        ],
+        "sectionRelativeRepoPath": "windows_security_products",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fwindows_security_products.yml&value=name%3A%20windows_security_products%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/windows_update_history",
+        "title": "windows_update_history",
+        "htmlId": "table--windowsupdatehistory--ef7bb6c2c1",
+        "evented": false,
+        "platforms": [
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "windows_update_history",
+          "client_app_id",
+          "date",
+          "description",
+          "hresult",
+          "operation",
+          "result_code",
+          "server_selection",
+          "service_id",
+          "support_url",
+          "title",
+          "update_id",
+          "update_revision"
+        ],
+        "sectionRelativeRepoPath": "windows_update_history",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fwindows_update_history.yml&value=name%3A%20windows_update_history%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/windows_updates",
+        "title": "windows_updates",
+        "htmlId": "table--windowsupdates--aa61957cff",
+        "evented": false,
+        "platforms": [
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "windows_updates",
+          "fullkey",
+          "is_default",
+          "key",
+          "locale",
+          "parent",
+          "query",
+          "value"
+        ],
+        "sectionRelativeRepoPath": "windows_updates",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/windows_updates.yml"
+      },
+      {
+        "url": "/tables/wmi_bios_info",
+        "title": "wmi_bios_info",
+        "htmlId": "table--wmibiosinfo--e665577f28",
+        "evented": false,
+        "platforms": [
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "wmi_bios_info",
+          "name",
+          "value"
+        ],
+        "sectionRelativeRepoPath": "wmi_bios_info",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fwmi_bios_info.yml&value=name%3A%20wmi_bios_info%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/wmi_cli_event_consumers",
+        "title": "wmi_cli_event_consumers",
+        "htmlId": "table--wmiclieventconsumers--d43fbe70e9",
+        "evented": false,
+        "platforms": [
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "wmi_cli_event_consumers",
+          "class",
+          "command_line_template",
+          "executable_path",
+          "name",
+          "relative_path"
+        ],
+        "sectionRelativeRepoPath": "wmi_cli_event_consumers",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fwmi_cli_event_consumers.yml&value=name%3A%20wmi_cli_event_consumers%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/wmi_event_filters",
+        "title": "wmi_event_filters",
+        "htmlId": "table--wmieventfilters--04ba1150eb",
+        "evented": false,
+        "platforms": [
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "wmi_event_filters",
+          "class",
+          "name",
+          "query",
+          "query_language",
+          "relative_path"
+        ],
+        "sectionRelativeRepoPath": "wmi_event_filters",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fwmi_event_filters.yml&value=name%3A%20wmi_event_filters%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/wmi_filter_consumer_binding",
+        "title": "wmi_filter_consumer_binding",
+        "htmlId": "table--wmifilterconsumerbinding--c53468b489",
+        "evented": false,
+        "platforms": [
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "wmi_filter_consumer_binding",
+          "class",
+          "consumer",
+          "filter",
+          "relative_path"
+        ],
+        "sectionRelativeRepoPath": "wmi_filter_consumer_binding",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fwmi_filter_consumer_binding.yml&value=name%3A%20wmi_filter_consumer_binding%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/wmi_script_event_consumers",
+        "title": "wmi_script_event_consumers",
+        "htmlId": "table--wmiscripteventconsumers--9275e5f795",
+        "evented": false,
+        "platforms": [
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "wmi_script_event_consumers",
+          "class",
+          "name",
+          "relative_path",
+          "script_file_name",
+          "script_text",
+          "scripting_engine"
+        ],
+        "sectionRelativeRepoPath": "wmi_script_event_consumers",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fwmi_script_event_consumers.yml&value=name%3A%20wmi_script_event_consumers%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/xprotect_entries",
+        "title": "xprotect_entries",
+        "htmlId": "table--xprotectentries--82da15dfc5",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "xprotect_entries",
+          "filename",
+          "filetype",
+          "identity",
+          "launch_type",
+          "name",
+          "optional",
+          "uses_pattern"
+        ],
+        "sectionRelativeRepoPath": "xprotect_entries",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/xprotect_entries.yml"
+      },
+      {
+        "url": "/tables/xprotect_meta",
+        "title": "xprotect_meta",
+        "htmlId": "table--xprotectmeta--d9c759b143",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "xprotect_meta",
+          "developer_id",
+          "identifier",
+          "min_version",
+          "type"
+        ],
+        "sectionRelativeRepoPath": "xprotect_meta",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/xprotect_meta.yml"
+      },
+      {
+        "url": "/tables/xprotect_reports",
+        "title": "xprotect_reports",
+        "htmlId": "table--xprotectreports--ed058eba3f",
+        "evented": false,
+        "platforms": [
+          "darwin"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "xprotect_reports",
+          "name",
+          "time",
+          "user_action"
+        ],
+        "sectionRelativeRepoPath": "xprotect_reports",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/xprotect_reports.yml"
+      },
+      {
+        "url": "/tables/yara",
+        "title": "yara",
+        "htmlId": "table--yara--f7412a4474",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux",
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "yara",
+          "count",
+          "matches",
+          "path",
+          "pid_with_namespace",
+          "sig_group",
+          "sigfile",
+          "sigrule",
+          "sigurl",
+          "strings",
+          "tags"
+        ],
+        "sectionRelativeRepoPath": "yara",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/yara.yml"
+      },
+      {
+        "url": "/tables/yara_events",
+        "title": "yara_events",
+        "htmlId": "table--yaraevents--a3df07297e",
+        "evented": true,
+        "platforms": [
+          "darwin",
+          "linux",
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "yara_events",
+          "action",
+          "category",
+          "count",
+          "eid",
+          "matches",
+          "strings",
+          "tags",
+          "target_path",
+          "time",
+          "transaction_id"
+        ],
+        "sectionRelativeRepoPath": "yara_events",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fyara_events.yml&value=name%3A%20yara_events%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/ycloud_instance_metadata",
+        "title": "ycloud_instance_metadata",
+        "htmlId": "table--ycloudinstancemetadata--91cc1e1945",
+        "evented": false,
+        "platforms": [
+          "darwin",
+          "linux",
+          "windows"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "ycloud_instance_metadata",
+          "cloud_id",
+          "description",
+          "folder_id",
+          "hostname",
+          "instance_id",
+          "metadata_endpoint",
+          "name",
+          "serial_port_enabled",
+          "ssh_public_key",
+          "zone"
+        ],
+        "sectionRelativeRepoPath": "ycloud_instance_metadata",
+        "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fycloud_instance_metadata.yml&value=name%3A%20ycloud_instance_metadata%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table."
+      },
+      {
+        "url": "/tables/yum_sources",
+        "title": "yum_sources",
+        "htmlId": "table--yumsources--866cfa7193",
+        "evented": false,
+        "platforms": [
+          "linux"
+        ],
+        "keywordsForSyntaxHighlighting": [
+          "yum_sources",
+          "baseurl",
+          "enabled",
+          "gpgcheck",
+          "gpgkey",
+          "mirrorlist",
+          "name",
+          "pid_with_namespace"
+        ],
+        "sectionRelativeRepoPath": "yum_sources",
+        "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/yum_sources.yml"
+      }
+    ],
+    "rituals": {
+      "handbook/demand/demand.rituals.yml": [
+        {
+          "task": "Refresh event calendar",
+          "startedOn": "2023-12-31",
+          "frequency": "Quarterly",
+          "description": "https://fleetdm.com/handbook/demand#refresh-event-calendar",
+          "moreInfoUrl": "https://fleetdm.com/handbook/demand#refresh-event-calendar",
+          "dri": "Drew-P-drawers"
+        },
+        {
+          "task": "Prioritize for next sprint",
+          "startedOn": "2023-09-04",
+          "frequency": "Triweekly",
+          "description": "Using your departmental kanban board, prioritize and finalize next sprint's goals for your team by draging the appropriate issues to the top of the 'Not yet' column.",
+          "moreInfoUrl": "https://fleetdm.com/handbook/company/why-this-way#why-make-work-visible",
+          "dri": "mikermcneil",
+          "autoIssue": {
+            "labels": [
+              "#g-demand"
+            ],
+            "repo": "confidential"
+          }
+        },
+        {
+          "task": "Settle event strategy",
+          "startedOn": "2024-01-02",
+          "frequency": "Quarterly (first Tuesday)",
+          "description": "https://fleetdm.com/handbook/demand#settle-event-strategy",
+          "moreInfoUrl": "https://fleetdm.com/handbook/demand#settle-event-strategy",
+          "dri": "Drew-P-drawers"
+        },
+        {
+          "task": "🫧 Pipeline sync",
+          "startedOn": "2024-08-29",
+          "frequency": "Weekly",
+          "description": "Allign with CRO and AEs on pipeline processes and incoming leads",
+          "moreInfoUrl": "",
+          "dri": "Drew-P-drawers"
+        },
+        {
+          "task": "Optimize ads",
+          "startedOn": "2024-02-26",
+          "frequency": "Weekly",
+          "description": "Remove all but the top 5 perfoming ads in each evergreen campaign. Make sure ABM campaigns are using top performing evergreen ads.",
+          "moreInfoUrl": "https://fleetdm.com/handbook/demand#optimize-ads-through-experimentation",
+          "dri": "Drew-P-drawers"
+        },
+        {
+          "task": "Process pending swag requests from the website",
+          "startedOn": "2023-09-20",
+          "frequency": "Weekly",
+          "description": "Complete draft orders.",
+          "moreInfoUrl": "https://fleetdm.com/handbook/demand#process-pending-swag-requests-from-the-website",
+          "dri": "Drew-P-drawers"
+        },
+        {
+          "task": "Engage with the community",
+          "startedOn": "2023-09-20",
+          "frequency": "Daily",
+          "description": "Find relevant conversations with the community and contribute",
+          "moreInfoUrl": "https://fleetdm.com/handbook/demand#engage-with-the-community",
+          "dri": "Drew-P-drawers"
+        },
+        {
+          "task": "Publish ☁️🌈 Sprint demos",
+          "startedOn": "2023-11-03",
+          "frequency": "Triweekly",
+          "description": "Every release cycle, upload the ☁️🌈 Sprint demos video to YouTube",
+          "moreInfoUrl": "https://fleetdm.com/handbook/demand#upload-to-youtube",
+          "dri": "Drew-P-drawers"
+        },
+        {
+          "task": "Measure intent signals",
+          "startedOn": "2024-08-09",
+          "frequency": "Daily",
+          "description": "Measure intent signals and update SalesForce",
+          "moreInfoUrl": "https://fleetdm.com/handbook/demand#measure-intent-signals",
+          "dri": "Drew-P-drawers"
+        },
+        {
+          "task": "Research accounts",
+          "startedOn": "2024-08-09",
+          "frequency": "Daily",
+          "description": "Research SalesForce accounts and begin ABM ads",
+          "moreInfoUrl": "https://fleetdm.com/handbook/demand#warm-up-actions",
+          "dri": "Drew-P-drawers"
+        }
+      ],
+      "handbook/customer-success/customer-success.rituals.yml": [
+        {
+          "task": "Prioritize for next sprint",
+          "startedOn": "2023-09-04",
+          "frequency": "Triweekly",
+          "description": "Using your departmental kanban board, prioritize and finalize next sprint's goals for your team by draging the appropriate issues to the top of the 'Not yet' column.",
+          "moreInfoUrl": "https://fleetdm.com/handbook/company/why-this-way#why-make-work-visible",
+          "dri": "zayhanlon",
+          "autoIssue": {
+            "labels": [
+              "#g-customer-success"
+            ],
+            "repo": "confidential"
+          }
+        },
+        {
+          "task": "Process new requests",
+          "startedOn": "2023-09-04",
+          "frequency": "Daily",
+          "description": "Prioritize all new requests including issues and PRs within one business day.",
+          "moreInfoUrl": "https://fleetdm.com/handbook/company/communications#process-new-requests",
+          "dri": "zayhanlon"
+        },
+        {
+          "task": "Overnight customer feedback",
+          "startedOn": "2024-02-08",
+          "frequency": "Daily",
+          "description": "Respond to messages and alerts",
+          "moreInfoUrl": "https://fleetdm.com/handbook/customer-success#respond-to-messages-and-alerts",
+          "dri": "ksatter"
+        },
+        {
+          "task": "Monitor customer Slack channels ",
+          "startedOn": "2024-02-08",
+          "frequency": "Daily",
+          "description": "Continuously monitor Slack for customer feedback, feature requests, reported bugs, etc., and respond in less than an hour.",
+          "moreInfoUrl": "https://fleetdm.com/handbook/company/communications#customer-support-service-level-agreements-slas",
+          "dri": "ksatter"
+        },
+        {
+          "task": "Follow-up on unresolved customer questions and concerns",
+          "startedOn": "2024-02-08",
+          "frequency": "Daily",
+          "description": "Follow-up with and tag appropriate personnel on customer issues and bugs in progress and items that remain unresolved.",
+          "moreInfoUrl": "https://fleetdm.com/handbook/company/communications#customer-support-service-level-agreements-slas",
+          "dri": "ksatter"
+        },
+        {
+          "task": "Prepare for customer voice",
+          "startedOn": "2024-02-23",
+          "frequency": "Weekly",
+          "description": "Prepare and review the health and latest updates from Fleet's key customers and active proof of concepts (POCs).",
+          "moreInfoUrl": "",
+          "dri": "patagonia121"
+        },
+        {
+          "task": "Prepare customer requests for feature fest",
+          "startedOn": "2024-02-12",
+          "frequency": "Triweekly",
+          "description": "Check-in before the 🗣️ Product Feature Requests meeting to make sure that all information necessary has been gathered before presenting customer requests and feedback to the Product team.",
+          "moreInfoUrl": "",
+          "dri": "nonpunctual"
+        },
+        {
+          "task": "Present customer requests at feature fest",
+          "startedOn": "2024-02-15",
+          "frequency": "Triweekly",
+          "description": "Present and advocate for requests and ideas brought to Fleet's attention by customers that are interesting from a product perspective.",
+          "moreInfoUrl": "",
+          "dri": "nonpunctual"
+        },
+        {
+          "task": "Communicate release notes to stakeholders",
+          "startedOn": "2024-02-21",
+          "frequency": "Triweekly",
+          "description": "Update customers on new features and resolved bugs in an upcoming release.",
+          "moreInfoUrl": "",
+          "dri": "patagonia121"
+        },
+        {
+          "task": "Upgrade Managed Cloud",
+          "startedOn": "2024-02-08",
+          "frequency": "Weekly",
+          "description": "Upgrade each Managed Cloud instance to the latest version of Fleet",
+          "moreInfoUrl": "https://github.com/fleetdm/fleet/releases",
+          "dri": "rfairburn"
+        }
+      ],
+      "handbook/digital-experience/digital-experience.rituals.yml": [
+        {
+          "task": "Complete Digital Experience KPIs",
+          "startedOn": "2024-08-30",
+          "frequency": "Weekly",
+          "description": "Complete Digital Experience KPIs for this week",
+          "moreInfoUrl": "https://docs.google.com/spreadsheets/d/1Hso0LxqwrRVINCyW_n436bNHmoqhoLhC8bcbvLPOs9A/edit?gid=0#gid=0&range=DB1",
+          "dri": "SFriendLee",
+          "autoIssue": {
+            "labels": [
+              "#g-digital-experience"
+            ],
+            "repo": "fleet"
+          }
+        },
+        {
+          "task": "Prep 1:1s for OKR planning",
+          "startedOn": "2024-09-09",
+          "frequency": "Monthly",
+          "description": "Add ”DISCUSS: Mike: Expectations of OKR planning“ to each e-group member's 1:1 document",
+          "moreInfoUrl": "https://docs.google.com/spreadsheets/d/1Hso0LxqwrRVINCyW_n436bNHmoqhoLhC8bcbvLPOs9A/edit",
+          "dri": "SFriendLee",
+          "autoIssue": {
+            "labels": [
+              "#g-digital-experience"
+            ],
+            "repo": "fleet"
+          }
+        },
+        {
+          "task": "Check browser compatibility for fleetdm.com",
+          "startedOn": "2024-03-06",
+          "frequency": "Monthly",
+          "description": "Use Browserstack to manually QA pages on fleetdm.com in each of the earliest supported browser versions",
+          "moreInfoUrl": "https://fleetdm.com/handbook/digital-experience#check-browser-compatibility-for-fleetdm-com",
+          "dri": "eashaw",
+          "autoIssue": {
+            "labels": [
+              "#g-digital-experience"
+            ],
+            "repo": "fleet"
+          }
+        },
+        {
+          "task": "Regenerate messaging framework",
+          "startedOn": "2024-07-15",
+          "frequency": "Quarterly",
+          "description": "Run through the entire website in `?utm_content=clear` mode and build a fresh outline of the headings to make sure they all still make sense.",
+          "moreInfoUrl": "",
+          "dri": "mike-j-thomas"
+        },
+        {
+          "task": "Check brand fronts are up to date",
+          "startedOn": "2024-08-01",
+          "frequency": "Quarterly",
+          "description": "Check all brand fronts for consistancy and update as needed with the current product pitch and graphics.",
+          "moreInfoUrl": "https://fleetdm.com/handbook/digital-experience#update-a-company-brand-front",
+          "dri": "mike-j-thomas"
+        },
+        {
+          "task": "Check production dependencies of fleetdm.com",
+          "startedOn": "2023-11-10",
+          "frequency": "Weekly",
+          "description": "Check for vulnerabilities on the production dependencies of fleetdm.com.",
+          "moreInfoUrl": "https://fleetdm.com/handbook/digital-experience#check-production-dependencies-of-fleetdm-com",
+          "dri": "eashaw",
+          "autoIssue": {
+            "labels": [
+              "#g-digital-experience"
+            ],
+            "repo": "fleet"
+          }
+        },
+        {
+          "task": "Check osquery Slack invitation",
+          "startedOn": "2023-11-10",
+          "frequency": "Monthly",
+          "description": "Check the osquery Slack invitation that is linked to from Fleet and the Fleet website to make sure it is valid.",
+          "moreInfoUrl": "https://fleetdm.com/slack",
+          "dri": "eashaw",
+          "autoIssue": {
+            "labels": [
+              "#g-digital-experience"
+            ],
+            "repo": "fleet"
+          }
+        },
+        {
+          "task": "Prepare for CEO office minutes",
+          "startedOn": "2023-12-18",
+          "frequency": "Daily",
+          "description": "Prepare the CEO office minutes calendar event and meeting agenda",
+          "moreInfoUrl": "https://fleetdm.com/handbook/digital-experience#prepare-for-ceo-office-minutes",
+          "dri": "SFriendLee"
+        },
+        {
+          "task": "Prioritize for next sprint",
+          "startedOn": "2023-08-09",
+          "frequency": "Triweekly",
+          "description": "Using your departmental kanban board, prioritize and finalize next sprint's goals for your team by draging the appropriate issues to the top of the 'Not yet' column.",
+          "moreInfoUrl": "https://fleetdm.com/handbook/company/why-this-way#why-make-work-visible",
+          "dri": "sampfluger88",
+          "autoIssue": {
+            "labels": [
+              "#g-digital-experience"
+            ],
+            "repo": "confidential"
+          }
+        },
+        {
+          "task": "Process the CEO's inbox",
+          "startedOn": "2023-07-29",
+          "frequency": "Daily ⏰",
+          "description": "Process the CEO's inbox",
+          "moreInfoUrl": "https://fleetdm.com/handbook/digital-experience#process-the-ceos-email",
+          "dri": "SFriendLee"
+        },
+        {
+          "task": "Process all \"New requests\" on the #g-digital-experience kanban board",
+          "startedOn": "2023-07-29",
+          "frequency": "Daily ⏰",
+          "description": "Process and prioritize all new issues and PRs",
+          "moreInfoUrl": "https://fleetdm.com/handbook/digital-experience#process-new-requests-from-the-g-ceo-kanban-board",
+          "dri": "sampfluger88"
+        },
+        {
+          "task": "Process the CEO's calendar",
+          "startedOn": "2023-07-29",
+          "frequency": "Daily ⏰",
+          "description": "Process the CEO's calendar",
+          "moreInfoUrl": "https://fleetdm.com/handbook/digital-experience#process-the-ceos-calendar",
+          "dri": "SFriendLee"
+        },
+        {
+          "task": "Send weekly update",
+          "startedOn": "2023-09-15",
+          "frequency": "Weekly",
+          "description": "Send weekly update",
+          "moreInfoUrl": "https://fleetdm.com/handbook/digital-experience#send-the-weekly-update",
+          "dri": "SFriendLee",
+          "autoIssue": {
+            "labels": [
+              "#g-digital-experience"
+            ],
+            "repo": "confidential"
+          }
+        },
+        {
+          "task": "Process and backup E-group agenda",
+          "startedOn": "2023-09-20",
+          "frequency": "Weekly",
+          "description": "Process and backup E-group agenda",
+          "moreInfoUrl": "https://fleetdm.com/handbook/digital-experience#process-and-backup-sid-agenda",
+          "dri": "SFriendLee",
+          "autoIssue": {
+            "labels": [
+              "#g-digital-experience"
+            ],
+            "repo": "confidential"
+          }
+        },
+        {
+          "task": "Process and backup Sid agenda",
+          "startedOn": "2023-09-25",
+          "frequency": "Monthly",
+          "description": "Process and backup Sid agenda",
+          "moreInfoUrl": "https://fleetdm.com/handbook/digital-experience#process-and-backup-e-group-agenda",
+          "dri": "SFriendLee",
+          "autoIssue": {
+            "labels": [
+              "#g-digital-experience"
+            ],
+            "repo": "confidential"
+          }
+        },
+        {
+          "task": "Share recording of all hands meeting",
+          "startedOn": "2023-07-01",
+          "frequency": "Monthly",
+          "description": "Sharing the all hands recording",
+          "moreInfoUrl": "https://fleetdm.com/handbook/digital-experience#share-recording-of-all-hands-meeting",
+          "dri": "SFriendLee",
+          "autoIssue": {
+            "labels": [
+              "#g-digital-experience"
+            ],
+            "repo": "confidential"
+          }
+        },
+        {
+          "task": "Prepare all hands deck",
+          "startedOn": "2023-07-01",
+          "frequency": "Monthly",
+          "description": "Preparing the all hands deck",
+          "moreInfoUrl": "https://fleetdm.com/handbook/digital-experience#preparing-for-the-all-hands",
+          "dri": "sampfluger88",
+          "autoIssue": {
+            "labels": [
+              "#g-digital-experience"
+            ],
+            "repo": "confidential"
+          }
+        },
+        {
+          "task": "Prepare board deck",
+          "startedOn": "2023-09-25",
+          "frequency": "Quarterly",
+          "description": "Prepare slide deck for the next board meeting",
+          "dri": "sampfluger88"
+        },
+        {
+          "task": "Process CEO GitHub review requests, mentions, and outstanding PRs",
+          "startedOn": "2023-07-29",
+          "frequency": "Daily",
+          "description": "Filter all action items from CEO's GitHub notifications",
+          "dri": "SFriendLee"
+        },
+        {
+          "task": "Check LinkedIn for unread messages",
+          "startedOn": "2023-09-25",
+          "frequency": "Daily",
+          "description": "Prevent connections from slipping through the cracks",
+          "moreInfoUrl": "https://fleetdm.com/handbook/digital-experience#check-linkedin-for-unread-messages",
+          "dri": "SFriendLee"
+        },
+        {
+          "task": "Downgrade unused license seats",
+          "startedOn": "2024-03-31",
+          "frequency": "Quarterly",
+          "description": "Downgrade unused or questionable license seats on the first Wednesday of every quarter",
+          "moreInfoUrl": "https://fleetdm.com/handbook/digital-experience#downgrade-an-unused-license-seat",
+          "dri": "sampfluger88"
+        },
+        {
+          "task": "Communicate Fleet's potential energy to stakeholders",
+          "startedOn": "2024-05-01",
+          "frequency": "Monthly",
+          "description": "Via hand or automation, send a monthly update email to all investors that hold 4% equity or greater in Fleet who have opted in to receive emails on the company's progress.",
+          "moreInfoUrl": "https://fleetdm.com/handbook/digital-experience#communicate-fleets-potential-energy-to-stakeholders",
+          "dri": "sampfluger88",
+          "autoIssue": {
+            "labels": [
+              "#g-digital-experience"
+            ],
+            "repo": "confidential"
+          }
+        },
+        {
+          "task": "Vanta check",
+          "startedOn": "2024-04-01",
+          "frequency": "Monthly",
+          "description": "Look for any new actions in Vanta due in the upcoming months and create issues to ensure they're done on time.",
+          "moreInfoUrl": null,
+          "dri": "sampfluger88",
+          "autoIssue": {
+            "labels": [
+              "#g-digital-experience"
+            ],
+            "repo": "confidential"
+          }
+        },
+        {
+          "task": "Recognize and benchmark workiversaries",
+          "startedOn": "2024-07-15",
+          "frequency": "Bimonthly",
+          "description": "Identify workiversaries coming up in the next two months and follow the steps to ensure they're recognized and benchmarked",
+          "moreInfoUrl": "https://fleetdm.com/handbook/digital-experience#recognize-employee-workiversaries",
+          "dri": "sampfluger88"
+        },
+        {
+          "task": "Quarterly grants",
+          "startedOn": "2024-02-01",
+          "frequency": "Quarterly",
+          "description": "Create the equity grants GitHub issue and walk through the steps.",
+          "moreInfoUrl": "https://fleetdm.com/handbook/digital-experience#grant-equity",
+          "dri": "hollidayn"
+        },
+        {
+          "task": "Change password of \"Integrations admin\" Salesforce account",
+          "startedOn": "2024-09-10",
+          "frequency": "Quarterly",
+          "description": "Log into the \"Integrations admin\" account in Salesforce and change the password to prevent a password change being required by Salesforce.",
+          "moreInfoUrl": "https://fleetdm.com/handbook/digital-experience#change-the-integrations-admin-salesforce-account-password",
+          "dri": "eashaw"
+        }
+      ],
+      "handbook/finance/finance.rituals.yml": [
+        {
+          "task": "Communicate the status of customer financial actions",
+          "startedOn": "2024-02-12",
+          "frequency": "Weekly",
+          "description": "At the start of every week, check the Salesforce reports for past due invoices, non-invoiced opportunities, and past due renewals.  Report findings to in the `#g-sales` channel.",
+          "moreInfoUrl": "https://fleetdm.com/handbook/finance#communicate-the-status-of-customer-financial-actions",
+          "dri": "ireedy",
+          "autoIssue": {
+            "labels": [
+              "#g-finance"
+            ],
+            "repo": "confidential"
+          }
+        },
+        {
+          "task": "AP invoice monitoring",
+          "startedOn": "2024-04-01",
+          "frequency": "Weekly",
+          "description": "Look for new accounts payable invoices and make sure that Fleet's suppliers are paid.",
+          "moreInfoUrl": "https://fleetdm.com/handbook/finance#process-a-new-vendor-invoice",
+          "dri": "ireedy",
+          "autoIssue": {
+            "labels": [
+              "#g-finance"
+            ],
+            "repo": "confidential"
+          }
+        },
+        {
+          "task": "Complete Finance KPI inputs",
+          "startedOn": "2024-02-16",
+          "frequency": "Weekly",
+          "description": "Create the weekly team KPI issue, complete the finance update.",
+          "moreInfoUrl": "https://fleetdm.com/handbook/finance#update-weekly-kpis",
+          "dri": "ireedy",
+          "autoIssue": {
+            "labels": [
+              "#g-finance"
+            ],
+            "repo": "confidential"
+          }
+        },
+        {
+          "task": "Key review prep",
+          "startedOn": "2024-02-14",
+          "frequency": "Triweekly",
+          "description": "Prepare for this sprint's Key review meeting.",
+          "moreInfoUrl": "https://fleetdm.com/handbook/company/leadership#key-reviews",
+          "dri": "jostableford",
+          "autoIssue": {
+            "labels": [
+              "#g-finance"
+            ],
+            "repo": "confidential"
+          }
+        },
+        {
+          "task": "Prioritize for next sprint",
+          "startedOn": "2023-08-09",
+          "frequency": "Triweekly",
+          "description": "Using your departmental kanban board, prioritize and finalize next sprint's goals for your team by draging the appropriate issues to the top of the 'Not yet' column.",
+          "moreInfoUrl": "https://fleetdm.com/handbook/company/why-this-way#why-make-work-visible",
+          "dri": "jostableford",
+          "autoIssue": {
+            "labels": [
+              "#g-finance"
+            ],
+            "repo": "confidential"
+          }
+        },
+        {
+          "task": "Reconcile monthly recurring expenses",
+          "startedOn": "2024-02-28",
+          "frequency": "Monthly",
+          "description": "Each month, update the inputs in “The numbers” spreadsheet to reflect the actuals for recurring non-personnel spend, and identify any unexpected increase or decrease in spend.",
+          "moreInfoUrl": "https://fleetdm.com/handbook/finance#reconcile-monthly-recurring-expenses",
+          "dri": "jostableford",
+          "autoIssue": {
+            "labels": [
+              "#g-finance"
+            ],
+            "repo": "confidential"
+          }
+        },
+        {
+          "task": "Monthly accounting",
+          "startedOn": "2024-02-28",
+          "frequency": "Monthly",
+          "description": "Create the monthly close GitHub issue and walk through the steps. This process includes fulfilling the monthly reporting requirement for SVB.",
+          "moreInfoUrl": "https://fleetdm.com/handbook/finance#process-monthly-accounting",
+          "dri": "ireedy",
+          "autoIssue": {
+            "labels": [
+              "#g-finance"
+            ],
+            "repo": "confidential"
+          }
+        },
+        {
+          "task": "Run regular payroll",
+          "startedOn": "2024-02-24",
+          "frequency": "Monthly",
+          "description": "Verify auto-populated payroll for all full time employees is accurate, and approve for processing.",
+          "moreInfoUrl": "https://fleetdm.com/handbook/finance#run-payroll",
+          "dri": "jostableford",
+          "autoIssue": {
+            "labels": [
+              "#g-finance"
+            ],
+            "repo": "confidential"
+          }
+        },
+        {
+          "task": "Monthly mail review",
+          "startedOn": "2024-04-15",
+          "frequency": "Monthly",
+          "description": "Review and clear mail incurring storage fees",
+          "moreInfoUrl": null,
+          "dri": "ireedy",
+          "autoIssue": {
+            "labels": [
+              "#g-finance"
+            ],
+            "repo": "confidential"
+          }
+        },
+        {
+          "task": "Run US contractor payroll",
+          "startedOn": "2024-02-28",
+          "frequency": "Monthly",
+          "description": "Manually process US contractor payroll by verifying and syncing time contractor worked, then processing payment.",
+          "moreInfoUrl": "https://fleetdm.com/handbook/finance#run-us-contractor-payroll",
+          "dri": "jostableford",
+          "autoIssue": {
+            "labels": [
+              "#g-finance"
+            ],
+            "repo": "confidential"
+          }
+        },
+        {
+          "task": "Run US commission payroll",
+          "startedOn": "2024-01-31",
+          "frequency": "Monthly",
+          "description": "Verify closed-won deal amounts, use commission calculators to determine commissions owed, and process payroll.",
+          "moreInfoUrl": "https://fleetdm.com/handbook/finance#run-us-commission-payroll",
+          "dri": "jostableford",
+          "autoIssue": {
+            "labels": [
+              "#g-finance"
+            ],
+            "repo": "confidential"
+          }
+        },
+        {
+          "task": "Run bonus payroll",
+          "startedOn": "2024-01-31",
+          "frequency": "Quarterly",
+          "description": "Verify completion of any objective or outcome based bonus plans, and process payroll.",
+          "moreInfoUrl": "https://fleetdm.com/handbook/finance#run-us-commission-payroll",
+          "dri": "jostableford"
+        },
+        {
+          "task": "Review state filings for the previous quarter",
+          "startedOn": "2024-07-19",
+          "frequency": "Quarterly",
+          "description": "Verify that state filings have been successfully submitted for the previous quarter",
+          "moreInfoUrl": "https://fleetdm.com/handbook/finance#review-state-employment-tax-filings-for-the-previous-quarter",
+          "dri": "ireedy"
+        },
+        {
+          "task": "Investor reporting",
+          "startedOn": "2024-03-31",
+          "frequency": "Quarterly",
+          "description": "Provide updated metrics for CRV in Chronograph.",
+          "moreInfoUrl": "https://fleetdm.com/handbook/finance#report-quarterly-numbers-in-chronograph",
+          "dri": "ireedy"
+        },
+        {
+          "task": "Quartlery finance check",
+          "startedOn": "2024-03-31",
+          "frequency": "Quarterly",
+          "description": "Every quarter, we check Quickbooks Online (QBO) for discrepancies and follow up with accounting providers for any quirks found.",
+          "moreInfoUrl": "https://fleetdm.com/handbook/finance#check-finances-for-quirks",
+          "dri": "jostableford"
+        },
+        {
+          "task": "Deliver annual report for venture line",
+          "startedOn": "2024-12-01",
+          "frequency": "Annually",
+          "description": "Within 60 days of the new year, provide financial statements to SVB, along with board-approved projections for the new year",
+          "moreInfoUrl": "https://fleetdm.com/handbook/finance#deliver-annual-report-for-venture-line",
+          "dri": "jostableford"
+        },
+        {
+          "task": "Tax preparation",
+          "startedOn": "2024-02-01",
+          "frequency": "Annually",
+          "description": "Provide information to tax team with Deloitte and assist with filing and paying state and federal returns",
+          "moreInfoUrl": null,
+          "dri": "jostableford"
+        }
+      ],
+      "handbook/engineering/engineering.rituals.yml": [
+        {
+          "task": "Pull request review",
+          "startedOn": "2023-08-09",
+          "frequency": "Daily",
+          "description": "Engineers go through pull requests for which their review has been requested.",
+          "moreInfoUrl": "https://fleetdm.com/handbook/company/why-this-way#why-make-work-visible",
+          "dri": "lukeheath"
+        },
+        {
+          "task": "Engineering group discussions",
+          "startedOn": "2023-08-09",
+          "frequency": "Daily",
+          "description": "Engineers go through pull requests for which their review has been requested.",
+          "moreInfoUrl": null,
+          "dri": "lukeheath"
+        },
+        {
+          "task": "Oncall handoff",
+          "startedOn": "2023-08-09",
+          "frequency": "Weekly",
+          "description": "Hand off the oncall engineering responsibilities to the next oncall engineer.",
+          "moreInfoUrl": null,
+          "dri": "lukeheath"
+        },
+        {
+          "task": "Vulnerability alerts (fleetdm.com)",
+          "startedOn": "2023-08-09",
+          "frequency": "Weekly",
+          "description": "Review and remediate or dismiss vulnerability alerts for the fleetdm.com codebase on GitHub.",
+          "moreInfoUrl": "https://github.com/fleetdm/fleet/security",
+          "dri": "eashaw"
+        },
+        {
+          "task": "Vulnerability alerts (frontend)",
+          "startedOn": "2023-08-09",
+          "frequency": "Weekly",
+          "description": "Review and remediate or dismiss vulnerability alerts for the Fleet frontend codebase (and related JS) on GitHub.",
+          "moreInfoUrl": "https://github.com/fleetdm/fleet/security",
+          "dri": "lukeheath"
+        },
+        {
+          "task": "Vulnerability alerts (backend)",
+          "startedOn": "2023-08-09",
+          "frequency": "Weekly",
+          "description": "Review and remediate or dismiss vulnerability alerts for the Fleet backend codebase (and all Go code) on GitHub.",
+          "moreInfoUrl": "https://github.com/fleetdm/fleet/security",
+          "dri": "lukeheath"
+        },
+        {
+          "task": "Release candidate ritual",
+          "startedOn": "2023-08-09",
+          "frequency": "Triweekly",
+          "description": "Go through the process of creating a release candidate.",
+          "moreInfoUrl": "https://github.com/fleetdm/fleet/blob/main/tools/release/README.md#minor-release-typically-end-of-sprint",
+          "dri": "lukeheath"
+        },
+        {
+          "task": "Release ritual",
+          "startedOn": "2023-08-09",
+          "frequency": "Triweekly",
+          "description": "Go through the process of releasing the next iteration of Fleet.",
+          "moreInfoUrl": "https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Releasing-Fleet.md",
+          "dri": "lukeheath"
+        },
+        {
+          "task": "Create patch release branch",
+          "startedOn": "2023-08-09",
+          "frequency": "Every patch release",
+          "description": "Go through the process of creating a patch release branch, cherry picking commits, and pushing the branch to github.com/fleetdm/fleet.",
+          "moreInfoUrl": "https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Releasing-Fleet.md#patch-releases",
+          "dri": "lukeheath"
+        },
+        {
+          "task": "Bug review",
+          "startedOn": "2023-08-09",
+          "frequency": "Weekly",
+          "description": "Review bugs that are in QA's inbox.",
+          "moreInfoUrl": "https://www.fleetdm.com/handbook/company/product-groups#inbox",
+          "dri": "xpkoala"
+        },
+        {
+          "task": "QA report",
+          "startedOn": "2023-08-09",
+          "frequency": "Triweekly",
+          "description": "Every release cycle, on the Monday of release week, update the DRI for the release ritual on status of testing.",
+          "moreInfoUrl": null,
+          "dri": "xpkoala"
+        },
+        {
+          "task": "Release QA",
+          "startedOn": "2023-08-09",
+          "frequency": "Triweekly",
+          "description": "Every release cycle, by end of day Friday of release week, move all issues to the ”✅ Ready for release” column on the #g-mdm and #g-endpoint-ops sprint boards.",
+          "moreInfoUrl": null,
+          "dri": "xpkoala"
+        },
+        {
+          "task": "Check ongoing events",
+          "startedOn": "2024-02-09",
+          "frequency": "Daily",
+          "description": "Check event issues and complete steps.",
+          "moreInfoUrl": "https://fleetdm.com/handbook/engineering#book-an-event",
+          "dri": "spokanemac"
+        }
+      ],
+      "handbook/sales/sales.rituals.yml": [
+        {
+          "task": "Close leads contacted ≥7 days ago",
+          "startedOn": "2024-07-05",
+          "frequency": "Daily",
+          "description": "Close all of your leads in the 'Attempted to contact' stage and which have been there for 7 or more days.  If follow-up is appropriate, and won't be bothersome, it can be done after closing the lead.  (A new lead can always be opened for the contact later.)",
+          "moreInfoUrl": "",
+          "dri": "Every AE"
+        },
+        {
+          "task": "Prioritize for next sprint",
+          "startedOn": "2023-09-04",
+          "frequency": "Triweekly",
+          "description": "Using your departmental kanban board, prioritize and finalize next sprint's goals for your team by draging the appropriate issues to the top of the 'Not yet' column.",
+          "moreInfoUrl": "https://fleetdm.com/handbook/company/why-this-way#why-make-work-visible",
+          "dri": "alexmitchelliii",
+          "autoIssue": {
+            "labels": [
+              "#g-sales"
+            ],
+            "repo": "confidential"
+          }
+        },
+        {
+          "task": "g-sales standup",
+          "startedOn": "2023-09-04",
+          "frequency": "Daily",
+          "description": "Review progress on priorities for Sprint. Discuss previous day accomplishments, goals for today and any blockers.",
+          "moreInfoUrl": "https://fleetdm.com/handbook/company/why-this-way#why-make-work-visible",
+          "dri": "alexmitchelliii"
+        },
+        {
+          "task": "Opportunity pipeline review",
+          "startedOn": "2023-09-04",
+          "frequency": "Weekly",
+          "description": "Review status of sales opportunities and discuss next steps.",
+          "moreInfoUrl": "https://fleetdm.com/handbook/customers#review-rep-activity",
+          "dri": "alexmitchelliii",
+          "autoIssue": {
+            "labels": [
+              "#g-sales"
+            ],
+            "repo": "confidential"
+          }
+        },
+        {
+          "task": "Review rep activity",
+          "startedOn": "2023-09-18",
+          "frequency": "Monthly",
+          "description": "https://fleetdm.com/handbook/customers#review-rep-activity",
+          "moreInfoUrl": "https://fleetdm.com/handbook/customers#review-rep-activity",
+          "dri": "alexmitchelliii"
+        }
+      ],
+      "handbook/product-design/product-design.rituals.yml": [
+        {
+          "task": "Design sprint review",
+          "startedOn": "2024-03-07",
+          "frequency": "Triweekly",
+          "description": "Clear out the drafting board of all issues that are not estimated but leave the items we want to take in the next sprint on the drafting board. Record the number of dropped stories for KPIs (all user stories that did not meet the 3 week drafting timeline).",
+          "moreInfoUrl": null,
+          "dri": "noahtalerman"
+        },
+        {
+          "task": "🎁 Feature fest",
+          "startedOn": "2024-03-07",
+          "frequency": "Triweekly",
+          "description": "We make a decision regarding which customer and community feature requests can be committed to in the next six weeks.",
+          "moreInfoUrl": "https://fleetdm.com/handbook/company/product-groups#feature-fest",
+          "dri": "noahtalerman"
+        },
+        {
+          "task": "Design sprint kickoff",
+          "startedOn": "2024-03-07",
+          "frequency": "Triweekly",
+          "description": "Add stories prioritized during Feature fest to Drafting board, assign stories to product designers, and align on priorities.",
+          "moreInfoUrl": null,
+          "dri": "noahtalerman"
+        },
+        {
+          "task": "Sprint kickoff review",
+          "startedOn": "2024-03-07",
+          "frequency": "Triweekly",
+          "description": "Identify stories that did not make it into this sprint and remove them from the board. Notify relevant requesters/stakeholders. Ensure bugs have been effectively prioritized across teams. Recommend highlights for next release notes. Record the number of drops for KPI reporting. Consider product group staffing. Are we scheduling what we prioritized?  Did we finish what we scheduled in the sprint?  (Look at org chart.)",
+          "moreInfoUrl": null,
+          "dri": "noahtalerman"
+        },
+        {
+          "task": "🦢🗣 Design review",
+          "startedOn": "2024-03-07",
+          "frequency": "Daily",
+          "description": "On Mondays, contributors present wireframes in 'Feedback' mode and anyone can give feedback. 'Final review' mode during all other days and only Head of Product Design + CTO + Product Designers give feedback.",
+          "moreInfoUrl": "https://fleetdm.com/handbook/company/product-groups#design-reviews",
+          "dri": "noahtalerman"
+        },
+        {
+          "task": "🦢🔄 Product design sync",
+          "startedOn": "2023-07-11",
+          "frequency": "Weekly",
+          "description": "Weekly time to chat about product design work (design reviews, conventions & best practices, using Figma, etc.)",
+          "moreInfoUrl": "https://docs.google.com/document/d/1GDEcXuTUjHI2CD9Jqega_GyF9DL6-PBmcyJpj55Lmos/edit",
+          "dri": "noahtalerman"
+        },
+        {
+          "task": "🦢🗣 Product office hours",
+          "startedOn": "2023-07-11",
+          "frequency": "Weekly",
+          "description": "Head of Product Design +  any other contributors who would like to attend. 30 minutes reserved to talk about any product.",
+          "moreInfoUrl": "https://docs.google.com/document/d/1Znyp2a9qcM9JdYHrzLudvcPwEdhnCg7RiKi22s8yGWw/edit",
+          "dri": "noahtalerman"
+        },
+        {
+          "task": "Maintenance",
+          "startedOn": "2024-03-01",
+          "frequency": "Weekly",
+          "description": "Head of Product Design checks the latest versions of relevant platforms, updates the maintenance tracker, and notifies the #g-mdm and #g-endpoint-ops Slack channel.",
+          "moreInfoUrl": null,
+          "dri": "noahtalerman"
+        },
+        {
+          "task": "Product confirm and celebrate",
+          "startedOn": "2024-02-27",
+          "frequency": "Weekly",
+          "description": "Review user stories we shipped but haven't closed/ Confirm all the loose ends are tied up: docs, internal and external comms, guides, pricing page, transparency page, user permissions.",
+          "moreInfoUrl": null,
+          "dri": "noahtalerman"
+        },
+        {
+          "task": "Pre-sprint prioritization",
+          "startedOn": "2024-02-27",
+          "frequency": "Triweekly",
+          "description": "Discuss what stories weren't completed in the previous sprint. Record the number of stories in KPIs. Align on priorities for upcoming sprint.",
+          "dri": "noahtalerman"
+        }
+      ]
+    },
+    "testimonials": [
+      {
+        "quote": "Yes Sir. Great tools for the everyday open-source geeks 💯",
+        "quoteAuthorName": "Alvaro Gutierrez",
+        "quoteAuthorProfileImageFilename": "testimonial-authour-alvaro-gutierrez-100x100@2x.png",
+        "quoteLinkUrl": "https://www.linkedin.com/in/aantoniogutierrez/",
+        "quoteAuthorJobTitle": "Technology Evangelist",
+        "productCategories": [
+          "Endpoint operations"
+        ]
+      },
+      {
+        "quote": "Fleet / osquery are some of my favorite open source detection tooling.",
+        "quoteAuthorName": "Joe Pistone",
+        "quoteAuthorProfileImageFilename": "testimonial-author-joe-pistone-100x100@2x.png",
+        "quoteLinkUrl": "https://www.linkedin.com/in/josephpistone/",
+        "quoteAuthorJobTitle": "Manager, Security Operations",
+        "productCategories": [
+          "Endpoint operations"
+        ]
+      },
+      {
+        "quote": "I had to answer some really complex questions for a compliance audit, and I was able to do it in about 15 minutes by munging some data together via a few queries into a csv. It took me longer to remember how to use `xsv` than to actually put together the report. If you aren't using osquery in your environment, you should be.",
+        "quoteAuthorName": "Charles Zaffery",
+        "quoteAuthorProfileImageFilename": "testimonial-author-charles-zaffery-48x48@2x.png",
+        "quoteLinkUrl": "https://www.linkedin.com/in/charleszaffery/",
+        "quoteAuthorJobTitle": "Principle Computer Janitor",
+        "productCategories": [
+          "Vulnerability management"
+        ]
+      },
+      {
+        "quote": "The visibility down into the assets covered by the agent is phenomenal. Fleet has become the central source for a lot of things.",
+        "quoteAuthorName": "Andre Shields",
+        "quoteAuthorProfileImageFilename": "testimonial-author-andre-shields-48x48@2x.png",
+        "quoteLinkUrl": "https://www.linkedin.com/in/andre-shields/",
+        "quoteAuthorJobTitle": "Staff Cybersecurity Engineer, Vulnerability Management",
+        "youtubeVideoUrl": "https://www.youtube.com/watch?v=siXy9aanOu4",
+        "productCategories": [
+          "Endpoint operations",
+          "Vulnerability management"
+        ],
+        "videoIdForEmbed": "siXy9aanOu4"
+      },
+      {
+        "quote": "I love the steady and consistent delivery of features that help teams work how they want to work, not how your product dictates they work.",
+        "quoteImageFilename": "social-proof-logo-atlassian-192x32@2x.png",
+        "quoteLinkUrl": "https://www.linkedin.com/in/danielgrzelak/",
+        "quoteAuthorName": "Dan Grzelak",
+        "quoteAuthorProfileImageFilename": "testimonial-author-daniel-grzelak-48x48@2x.png",
+        "quoteAuthorJobTitle": "Security Chief of Staff",
+        "productCategories": [
+          "Endpoint operations",
+          "Vulnerability management",
+          "Device management"
+        ],
+        "imageHeight": 32
+      },
+      {
+        "quote": "We can build it exactly the way we want it. Which is just not possible on other platforms.",
+        "quoteAuthorName": "Austin Anderson",
+        "quoteAuthorProfileImageFilename": "testimonial-author-austin-anderson-48x48@2x.png",
+        "quoteAuthorJobTitle": "Cybersecurity team senior manager",
+        "quoteLinkUrl": "https://www.linkedin.com/in/austin-anderson-73172185/",
+        "youtubeVideoUrl": "https://www.youtube.com/watch?v=G5Ry_vQPaYc",
+        "productCategories": [
+          "Endpoint operations",
+          "Vulnerability management"
+        ],
+        "videoIdForEmbed": "G5Ry_vQPaYc"
+      },
+      {
+        "quote": "Exciting. This is a team that listens to feedback.",
+        "quoteImageFilename": "social-proof-logo-uber-71x32@2x.png",
+        "quoteLinkUrl": "https://www.linkedin.com/in/eriknicolasgomez/",
+        "quoteAuthorName": "Erik Gomez",
+        "quoteAuthorProfileImageFilename": "testimonial-author-erik-gomez-48x48@2x.png",
+        "quoteAuthorJobTitle": "Staff Client Platform Engineer",
+        "productCategories": [
+          "Endpoint operations",
+          "Device management"
+        ],
+        "imageHeight": 32
+      },
+      {
+        "quote": "Context is king for device data, and Fleet provides a way to surface that information to our other teams and partners.",
+        "quoteAuthorName": "Nick Fohs",
+        "quoteAuthorProfileImageFilename": "testimonial-author-nick-fohs-24x24@2x.png",
+        "quoteLinkUrl": "https://www.linkedin.com/in/nickfohs/",
+        "quoteAuthorJobTitle": "Systems and infrastructure manager",
+        "youtubeVideoUrl": "https://www.youtube.com/watch?v=fs5ULAR4e4A",
+        "productCategories": [
+          "Endpoint operations",
+          "Device management",
+          "Vulnerability management"
+        ],
+        "videoIdForEmbed": "fs5ULAR4e4A"
+      },
+      {
+        "quote": "Keeping up with the latest issues in endpoint security is a never-ending task, because engineers have to regularly ensure every laptop and server is still sufficiently patched and securely configured. The problem is, software vendors release new versions all the time, and no matter how much you lock it down, end users find ways to change things.",
+        "quoteImageFilename": "social-proof-logo-lyft-47x32@2x.png",
+        "quoteLinkUrl": "https://www.linkedin.com/in/nwaisman/",
+        "quoteAuthorName": "Nico Waisman",
+        "quoteAuthorProfileImageFilename": "testimonial-author-nico-waisman-48x48@2x.png",
+        "quoteAuthorJobTitle": "CISO of Lyft",
+        "productCategories": [
+          "Endpoint operations",
+          "Vulnerability management"
+        ],
+        "imageHeight": 32
+      },
+      {
+        "quote": "Having the freedom to take full advantage of the product is one of the reasons why I always support open-source products with a commercially-backed company, like Fleet.",
+        "quoteImageFilename": "social-proof-logo-lyft-47x32@2x.png",
+        "quoteLinkUrl": "https://www.linkedin.com/posts/nwaisman_movingtofleet-activity-7156319785981509632-bk_W",
+        "quoteAuthorName": "Nico Waisman",
+        "quoteAuthorProfileImageFilename": "testimonial-author-nico-waisman-48x48@2x.png",
+        "quoteAuthorJobTitle": "CISO of Lyft",
+        "productCategories": [
+          "Device management"
+        ],
+        "imageHeight": 32
+      },
+      {
+        "quote": "Fleet has been highly effective for our needs. We appreciate your team for always being so open to hearing our feedback.",
+        "quoteAuthorName": "Kenny Botelho",
+        "quoteAuthorProfileImageFilename": "testimonial-author-kenny-botelho-48x48@2x.png",
+        "quoteAuthorJobTitle": "Client Platform IT Engineer / Leader",
+        "quoteLinkUrl": "https://www.linkedin.com/in/kennybotelho/",
+        "productCategories": [
+          "Endpoint operations",
+          "Device management"
+        ]
+      },
+      {
+        "quote": "Mad props to how easy making a deploy pkg of the agent was. I wish everyone made stuff that easy.",
+        "quoteImageFilename": "social-proof-logo-stripe-67x32@2x.png",
+        "quoteAuthorName": "Wes Whetstone",
+        "quoteAuthorProfileImageFilename": "testimonial-author-wes-whetstone-48x48@2x.png",
+        "quoteLinkUrl": "https://www.linkedin.com/in/jckwhet/",
+        "quoteAuthorJobTitle": "Staff CPE at Stripe",
+        "productCategories": [
+          "Endpoint operations",
+          "Device management"
+        ],
+        "imageHeight": 32
+      },
+      {
+        "quote": "Fleet’s come a long way - to now being the top open-source osquery manager.",
+        "quoteImageFilename": "social-proof-logo-atlassian-192x32@2x.png",
+        "quoteLinkUrl": "https://www.linkedin.com/in/bshak/",
+        "quoteAuthorName": "Brendan Shaklovitz",
+        "quoteAuthorProfileImageFilename": "testimonial-author-brendan-shaklovitz-48x48@2x.png",
+        "quoteAuthorJobTitle": "Senior SRE",
+        "productCategories": [
+          "Endpoint operations"
+        ],
+        "imageHeight": 32
+      },
+      {
+        "quote": "It’s great to see the new release of Fleet containing some really cool new features that make osquery much more usable in practical environments. I’m really impressed with the work that Zach Wasserman and the crew are doing at Fleet.",
+        "quoteImageFilename": "social-proof-logo-osquery-124x32@2x.png",
+        "quoteLinkUrl": "https://www.linkedin.com/in/marpaia/",
+        "quoteAuthorName": "Mike Arpaia",
+        "quoteAuthorProfileImageFilename": "testimonial-author-mike-arpaia-48x48@2x.png",
+        "quoteAuthorJobTitle": "Creator of osquery",
+        "productCategories": [
+          "Endpoint operations"
+        ],
+        "imageHeight": 32
+      },
+      {
+        "quote": "Osquery is one of the best tools out there and Fleet makes it even better. Highly recommend it if you want to monitor, detect and investigate threats on a scale and also for infra/sys admin. I have used it on 15k servers and it’s really scalable.",
+        "quoteImageFilename": "social-proof-logo-salesforce-48x32@2x.png",
+        "quoteLinkUrl": "https://www.linkedin.com/in/anelshaer/",
+        "quoteAuthorName": "Ahmed Elshaer",
+        "quoteAuthorProfileImageFilename": "testimonial-author-ahmed-elshaer-48x48@2x.png",
+        "quoteAuthorJobTitle": "DFIR, Blue Teaming, SecOps",
+        "productCategories": [
+          "Endpoint operations"
+        ],
+        "imageHeight": 32
+      },
+      {
+        "quote": "With the power of osquery, you need a scalable & resilient platform to manage your workloads. Fleet is the \"just right\" open-source, enterprise grade solution.",
+        "quoteImageFilename": "social-proof-logo-comcast-91x32@2x.png",
+        "quoteLinkUrl": "https://www.linkedin.com/in/abubakar-yousafzai-b7213659/",
+        "quoteAuthorName": "Abubakar Yousafzai",
+        "quoteAuthorProfileImageFilename": "testimonial-author-abubakar-yousafzai-48x48@2x.png",
+        "quoteAuthorJobTitle": "Security Software Development & Engineering",
+        "productCategories": [
+          "Endpoint operations"
+        ],
+        "imageHeight": 32
+      },
+      {
+        "quote": "One of the best teams out there to go work for and help shape security platforms.",
+        "quoteImageFilename": "social-proof-logo-deloitte-130x32@2x.png",
+        "quoteLinkUrl": "https://www.linkedin.com/in/neondhruv/",
+        "quoteAuthorName": "Dhruv Majumdar",
+        "quoteAuthorProfileImageFilename": "testimonial-author-dhruv-majumdar-48x48@2x.png",
+        "quoteAuthorJobTitle": "Director Of Cyber Risk & Advisory",
+        "productCategories": [
+          "Vulnerability management",
+          "Endpoint operations"
+        ],
+        "imageHeight": 32
+      },
+      {
+        "quote": "Fleet has such a huge amount of use cases. My goal was to get telemetry on endpoints, but then our IR team, our TBM team, and multiple other folks in security started heavily utilizing the system in ways I didn’t expect. It spread so naturally, even our corporate and infrastructure teams want to run it.",
+        "quoteAuthorName": "Charles Zaffery",
+        "quoteLinkUrl": "https://www.linkedin.com/in/charleszaffery/",
+        "quoteAuthorJobTitle": "Principle computer janitor",
+        "quoteAuthorProfileImageFilename": "testimonial-author-charles-zaffery-48x48@2x.png",
+        "youtubeVideoUrl": "https://www.youtube.com/watch?v=nRbZJflWqCo",
+        "productCategories": [
+          "Endpoint operations"
+        ],
+        "videoIdForEmbed": "nRbZJflWqCo"
+      },
+      {
+        "quote": "I don't want one bad actor to brick my fleet, I want them to make a pull request first.",
+        "quoteAuthorName": "Matt Carr",
+        "quoteAuthorJobTitle": "CPE manager",
+        "quoteAuthorProfileImageFilename": "testimonial-author-matt-carr-48x48@2x.png",
+        "quoteLinkUrl": "https://www.linkedin.com/in/mathewcarr/",
+        "productCategories": [
+          "Device management"
+        ]
+      },
+      {
+        "quote": "I wanted an easy way to control osquery configurations, and I wanted to stream data as fast as possible into Snowflake. No other solution jumped out to solve those things except for Fleet.",
+        "quoteAuthorName": "Tom Larkin",
+        "quoteAuthorJobTitle": "IT Engineering Manager",
+        "quoteAuthorProfileImageFilename": "testimonial-author-tom-larkin-48x48@2x.png",
+        "quoteLinkUrl": "https://www.linkedin.com/in/thlarkin/",
+        "youtubeVideoUrl": "https://www.youtube.com/watch?v=nkjg_hNe86Q",
+        "productCategories": [
+          "Endpoint operations"
+        ],
+        "videoIdForEmbed": "nkjg_hNe86Q"
+      },
+      {
+        "quote": "Something I really appreciate about working with you guys is that it doesn't feel like I'm talking to a vendor. It actually feels like I'm talking to my team, and I really appreciate it.",
+        "quoteImageFilename": "social-proof-logo-deloitte-130x32@2x.png",
+        "quoteLinkUrl": "https://www.linkedin.com/in/cmajumdar/",
+        "quoteAuthorName": "Chandra Majumdar",
+        "quoteAuthorProfileImageFilename": "testimonial-author-chandra-majumdar-48x48@2x.png",
+        "quoteAuthorJobTitle": "Partner - Cyber and Strategic Risk",
+        "productCategories": [
+          "Vulnerability management",
+          "Endpoint operations"
+        ],
+        "imageHeight": 32
+      },
+      {
+        "quote": "This is not just production osquery, but actually a way bigger opportunity than even something like Airwatch or Jamf.",
+        "quoteImageFilename": "logo-flock-safety-907x132@2x.png",
+        "quoteLinkUrl": "https://www.linkedin.com/in/mrerictan/",
+        "quoteAuthorName": "Eric Tan",
+        "quoteAuthorProfileImageFilename": "testimonial-author-eric-tan-99x99@2x.png",
+        "quoteAuthorJobTitle": "CIO & Chief Security Officer at Flock Safety",
+        "productCategories": [
+          "Device management",
+          "Endpoint operations"
+        ],
+        "imageHeight": 132
+      }
+    ],
+    "openPositions": [
+      {
+        "jobTitle": "🚀 Software Engineer",
+        "url": "/handbook/company/open-positions/software-engineer"
+      },
+      {
+        "jobTitle": "🐋 Account Executive",
+        "url": "/handbook/company/open-positions/account-executive"
+      }
+    ],
+    "compiledPagePartialsAppPath": "views/partials/built-from-markdown"
   }
 }
diff --git a/website/api/controllers/admin/view-email-template-preview.js b/website/api/controllers/admin/view-email-template-preview.js
index 5692353463..4e13a0cd32 100644
--- a/website/api/controllers/admin/view-email-template-preview.js
+++ b/website/api/controllers/admin/view-email-template-preview.js
@@ -117,19 +117,22 @@ module.exports = {
       case 'email-nurture-stage-three':
         layout = 'layout-nurture-email';
         fakeData = {
-          firstName: 'Sage'
+          firstName: 'Sage',
+          emailAddress: 'sage@example.com',
         };
         break;
       case 'email-nurture-stage-four':
         layout = 'layout-nurture-email';
         fakeData = {
-          firstName: 'Sage'
+          firstName: 'Sage',
+          emailAddress: 'sage@example.com',
         };
         break;
       case 'email-nurture-stage-five':
         layout = 'layout-nurture-email';
         fakeData = {
-          firstName: 'Sage'
+          firstName: 'Sage',
+          emailAddress: 'sage@example.com',
         };
         break;
       case 'email-deal-registration':
@@ -152,6 +155,14 @@ module.exports = {
           notes: 'Fake organization 2 is looking for a managed cloud MDM solution with a name that ends with "eet"',
         };
         break;
+      case 'email-contact-form':
+        fakeData = {
+          firstName: 'Jane',
+          lastName: 'Williamson',
+          emailAddress: 'jane@example.com',
+          message: 'Hi, this is a contact form message!',
+        };
+        break;
       default:
         layout = 'layout-email-newsletter';
         fakeData = {
diff --git a/website/api/controllers/articles/view-articles.js b/website/api/controllers/articles/view-articles.js
index 8f28c6c5c4..b7f11213eb 100644
--- a/website/api/controllers/articles/view-articles.js
+++ b/website/api/controllers/articles/view-articles.js
@@ -48,6 +48,7 @@ module.exports = {
           return page;
         }
       });
+      articles = _.sortBy(articles, 'meta.publishedOn');
     }
 
     let pageTitleForMeta = 'Fleet blog';
@@ -107,6 +108,7 @@ module.exports = {
       currentSection,
       pageTitleForMeta,
       pageDescriptionForMeta,
+      algoliaPublicKey: sails.config.custom.algoliaPublicKey,
     };
 
   }
diff --git a/website/api/controllers/articles/view-basic-article.js b/website/api/controllers/articles/view-basic-article.js
index 17b997f5f7..6648cebc58 100644
--- a/website/api/controllers/articles/view-basic-article.js
+++ b/website/api/controllers/articles/view-basic-article.js
@@ -86,6 +86,7 @@ module.exports = {
       pageImageForMeta: thisPage.meta.articleImageUrl || undefined,
       articleCategorySlug,
       currentSection,
+      algoliaPublicKey: sails.config.custom.algoliaPublicKey,
     };
 
   }
diff --git a/website/api/controllers/customers/save-billing-info-and-subscribe.js b/website/api/controllers/customers/save-billing-info-and-subscribe.js
index 31f6e7df7e..6369ebb06c 100644
--- a/website/api/controllers/customers/save-billing-info-and-subscribe.js
+++ b/website/api/controllers/customers/save-billing-info-and-subscribe.js
@@ -162,6 +162,22 @@ module.exports = {
       }
     });
 
+    let todayOn = new Date();
+    let isoTimestampForDescription = todayOn.toISOString();
+    sails.helpers.salesforce.updateOrCreateContactAndAccount.with({
+      emailAddress: this.req.me.emailAddress,
+      firstName: this.req.me.firstName,
+      lastName: this.req.me.lastName,
+      organization: this.req.me.organization,
+      description: `Purchased a self-service Fleet Premium license on ${isoTimestampForDescription.split('T')[0]} for ${quoteRecord.numberOfHosts} host${quoteRecord.numberOfHosts > 1 ? 's' : ''}.`
+    }).exec((err)=>{
+      if(err){
+        sails.log.warn(`Background task failed: When a user (email: ${this.req.me.emailAddress} purchased a self-service Fleet premium subscription, a Contact and Account record could not be created/updated in the CRM.`, err);
+      }
+      return;
+    });
+
+
   }
 
 
diff --git a/website/api/controllers/deliver-contact-form-message.js b/website/api/controllers/deliver-contact-form-message.js
index bf0a8030fd..37e5693f5c 100644
--- a/website/api/controllers/deliver-contact-form-message.js
+++ b/website/api/controllers/deliver-contact-form-message.js
@@ -67,7 +67,7 @@ module.exports = {
     }
 
     await sails.helpers.http.post(sails.config.custom.slackWebhookUrlForContactForm, {
-      text: `New contact form message: (Remember: we have to email back; can't just reply to this thread.) cc @sales `+
+      text: `New contact form message: (Remember: we have to email back; can't just reply to this thread.)`+
       `Name: ${firstName + ' ' + lastName}, Email: ${emailAddress}, Message: ${message ? message : 'No message.'}`
     });
 
@@ -75,7 +75,7 @@ module.exports = {
       emailAddress: emailAddress,
       firstName: firstName,
       lastName: lastName,
-      leadSource: 'Website - Contact forms',
+      contactSource: 'Website - Contact forms',
       description: `Sent a contact form message: ${message}`,
     }).exec((err)=>{// Use .exec() to run the salesforce helpers in the background.
       if(err) {
diff --git a/website/api/controllers/deliver-talk-to-us-form-submission.js b/website/api/controllers/deliver-talk-to-us-form-submission.js
index 6dd53f88be..a91c7202e3 100644
--- a/website/api/controllers/deliver-talk-to-us-form-submission.js
+++ b/website/api/controllers/deliver-talk-to-us-form-submission.js
@@ -75,15 +75,16 @@ module.exports = {
     }
 
     if(numberOfHosts >= 700){
-      sails.helpers.salesforce.updateOrCreateContactAndAccountAndCreateLead.with({
+      sails.helpers.salesforce.updateOrCreateContactAndAccount.with({
         emailAddress: emailAddress,
         firstName: firstName,
         lastName: lastName,
         organization: organization,
-        numberOfHosts: numberOfHosts,
         primaryBuyingSituation: primaryBuyingSituation === 'eo-security' ? 'Endpoint operations - Security' : primaryBuyingSituation === 'eo-it' ? 'Endpoint operations - IT' : primaryBuyingSituation === 'mdm' ? 'Device management (MDM)' : primaryBuyingSituation === 'vm' ? 'Vulnerability management' : undefined,
-        leadSource: 'Website - Contact forms',
-        leadDescription: `Submitted the "Talk to us" form and was taken to the Calendly page for the "Talk to us" event.`,
+        contactSource: 'Website - Contact forms',
+        description: `Submitted the "Talk to us" form and was taken to the Calendly page for the "Talk to us" event.`,
+        psychologicalStage: '4 - Has use case',
+        psychologicalStageChangeReason: 'Website - Contact forms'
       }).exec((err)=>{
         if(err) {
           sails.log.warn(`Background task failed: When a user submitted the "Talk to us" form, a lead/contact could not be updated in the CRM for this email address: ${emailAddress}.`, err);
@@ -96,7 +97,7 @@ module.exports = {
         lastName: lastName,
         organization: organization,
         primaryBuyingSituation: primaryBuyingSituation === 'eo-security' ? 'Endpoint operations - Security' : primaryBuyingSituation === 'eo-it' ? 'Endpoint operations - IT' : primaryBuyingSituation === 'mdm' ? 'Device management (MDM)' : primaryBuyingSituation === 'vm' ? 'Vulnerability management' : undefined,
-        leadSource: 'Website - Contact forms',
+        contactSource: 'Website - Contact forms',
         description: `Submitted the "Talk to us" form and was taken to the Calendly page for the "Let\'s get you set up!" event.`,
       }).exec((err)=>{
         if(err) {
diff --git a/website/api/controllers/entrance/signup.js b/website/api/controllers/entrance/signup.js
index 8d723cbc46..c9129ac3c6 100644
--- a/website/api/controllers/entrance/signup.js
+++ b/website/api/controllers/entrance/signup.js
@@ -144,7 +144,7 @@ the account verification message.)`,
       firstName: firstName,
       lastName: lastName,
       organization: organization,
-      leadSource: 'Website - Sign up'
+      contactSource: 'Website - Sign up'
     }).exec((err)=>{
       if(err){
         sails.log.warn(`Background task failed: When a user (email: ${newEmailAddress} signed up for a fleetdm.com account, a Contact and Account record could not be created/updated in the CRM.`, err);
diff --git a/website/api/controllers/save-questionnaire-progress.js b/website/api/controllers/save-questionnaire-progress.js
index 4f7b3a2922..62faf37929 100644
--- a/website/api/controllers/save-questionnaire-progress.js
+++ b/website/api/controllers/save-questionnaire-progress.js
@@ -21,6 +21,7 @@ module.exports = {
         'what-does-your-team-manage-eo-it',
         'what-does-your-team-manage-vm',
         'what-do-you-manage-mdm',
+        'cross-platform-mdm',
         'is-it-any-good',
         'what-did-you-think',
         'deploy-fleet-in-your-environment',
@@ -86,28 +87,25 @@ module.exports = {
     // 'how-many-hosts': Stage 4/5/6
     // 'will-you-be-self-hosting': Stage 5/6
     // 'what-are-you-working-on-eo-security'
-    //  - no-use-case-yet: » Stage 2/3 (depends on answer from 'have-you-ever-used-fleet' step)
     //  - All other options » Stage 4
     // 'what-does-your-team-manage-eo-it'
-    //  - no-use-case-yet: » Stage 2/3 (depends on answer from 'have-you-ever-used-fleet' step)
     //  - All other options » Stage 4
     // 'what-does-your-team-manage-vm'
-    //  - no-use-case-yet: » Stage 2/3 (depends on answer from 'have-you-ever-used-fleet' step)
     //  - All other options » Stage 4
     // 'what-do-you-manage-mdm'
-    //  - no-use-case-yet: » Stage 2/3 (depends on answer from 'have-you-ever-used-fleet' step)
+    //  - no-use-case-yet: » Stage 3
     //  - All other options » Stage 4
-    // 'is-it-any-good': Stage 2/3/4 (depends on answer from 'have-you-ever-used-fleet' & the buying situation specific step)
+    // 'is-it-any-good': Stage 3/4 (depends on answer from 'have-you-ever-used-fleet' & the buying situation specific step)
     // 'what-did-you-think'
-    //  - host-fleet-for-me » Stage 4
-    //  - deploy-fleet-in-environment » Stage 4
+    //  - host-fleet-for-me » Stage 5
+    //  - deploy-fleet-in-environment » Stage 5
     //  - let-me-think-about-it »  Stage 2
     // FUTURE: Should the step about deploying fleet in your env be here?  (For same reason is-it-any-good is here: when navigating back then forwards?)
     // 'how-was-your-deployment'
     //  - up-and-running »  Stage 5
-    //  - kinda-stuck »  Stage 4 (...at best!  Still got the use case.)
-    //  - havent-gotten-to-it » Stage 4 (same as above)
-    //  - changed-mind-want-managed-deployment » Stage 4 (same as above)
+    //  - kinda-stuck »  Stage 5
+    //  - havent-gotten-to-it » Stage 5
+    //  - changed-mind-want-managed-deployment » Stage 5
     //  - decided-to-not-use-fleet » Stage 2
     // 'whats-left-to-get-you-set-up'
     //  - need-premium-license-key » No change (Stage ??)
@@ -124,17 +122,13 @@ module.exports = {
     } else if(currentStep === 'what-are-you-using-fleet-for') {
       psychologicalStage = '2 - Aware';
     } else if(currentStep === 'have-you-ever-used-fleet') {
-      if(['yes-deployed'].includes(valueFromFormData)) {
+      if(valueFromFormData === 'yes-deployed') {
         // If the user has Fleet deployed, set their stage to 6.
         psychologicalStage = '6 - Has team buy-in';
-      } else if(valueFromFormData === 'yes-recently-deployed'){
+      } else if(valueFromFormData === 'yes-recently-deployed') {
         psychologicalStage = '5 - Personally confident';
-      } else if(valueFromFormData === 'yes-deployed-local'){
-        // If they've tried Fleet locally, set their stage to 3.
-        psychologicalStage = '3 - Intrigued';
       } else {
-        // Otherwise, we'll just assume liu're only aware.  Maybe liu don't fully grasp what Fleet can do.
-        psychologicalStage = '2 - Aware';
+        psychologicalStage = '3 - Intrigued';
       }
     } else {
       // If the user submitted any other step, we'll set variables using the answers to the previous questions.
@@ -144,28 +138,32 @@ module.exports = {
       let hasUsedFleetAnswer = questionnaireProgress['have-you-ever-used-fleet'].fleetUseStatus;
       if(['what-are-you-working-on-eo-security','what-does-your-team-manage-eo-it','what-does-your-team-manage-vm','what-do-you-manage-mdm'].includes(currentStep)){
         if(valueFromFormData === 'no-use-case-yet') {
-          // Check the user's answer to the previous question
-          if(hasUsedFleetAnswer === 'yes-deployed-local'){
-            // If they've tried Fleet locally, set their stage to 3.
-            psychologicalStage = '3 - Intrigued';
-          } else {
-            psychologicalStage = '2 - Aware';
-          }
+          psychologicalStage = '3 - Intrigued';
         } else {// Otherwise, they have a use case and will be set to stage 4.
           psychologicalStage = '4 - Has use case';
         }
+        // When the user submits the step before the "Is it any good?" step, we will generate them a 30 day Trial key for Fleet Premium that they can use with fleetctl preview
+        if(!userRecord.fleetPremiumTrialLicenseKey) {
+          let thirtyDaysFromNowAt = Date.now() + (1000 * 60 * 60 * 24 * 30);
+          let trialLicenseKeyForThisUser = await sails.helpers.createLicenseKey.with({
+            numberOfHosts: 10,
+            organization: this.req.me.organization ? this.req.me.organization : 'Fleet Premium trial',
+            expiresAt: thirtyDaysFromNowAt,
+          });
+          // Save the trial license key to the DB record for this user.
+          await User.updateOne({id: this.req.me.id})
+          .set({
+            fleetPremiumTrialLicenseKey: trialLicenseKeyForThisUser,
+            fleetPremiumTrialLicenseKeyExpiresAt: thirtyDaysFromNowAt,
+          });
+        }
       } else if(currentStep === 'is-it-any-good') {
         if(currentSelectedBuyingSituation === 'mdm') {
           // Since the mdm use case question is the only buying situation-specific question where a use case can't
           // be selected,  we'll check the user's previous answers before changing their psyStage
           if(questionnaireProgress['what-do-you-manage-mdm'].mdmUseCase === 'no-use-case-yet'){
             // Check the user's answer to the have-you-ever-used-fleet question.
-            if(hasUsedFleetAnswer === 'yes-deployed-local') {
-              // If they've tried Fleet locally, set their stage to 3.
-              psychologicalStage = '3 - Intrigued';
-            } else {
-              psychologicalStage = '2 - Aware';
-            }
+            psychologicalStage = '3 - Intrigued';
           } else {
             psychologicalStage = '4 - Has use case';
           }
@@ -177,27 +175,22 @@ module.exports = {
         // If the user selects "Let me think about it", set their psyStage to 2.
         if(valueFromFormData === 'let-me-think-about-it') {
           psychologicalStage = '2 - Aware';
-        } else if (['deploy-fleet-in-environment','host-fleet-for-me'].includes(valueFromFormData)) {
-          psychologicalStage = '4 - Has use case';
+        } else if (['host-fleet-for-me', 'deploy-fleet-in-environment'].includes(valueFromFormData)) {
+          psychologicalStage = '5 - Personally confident';
         } else { require('assert')(false,'This should never happen.'); }
       } else if(currentStep === 'how-was-your-deployment') {
         if(valueFromFormData === 'decided-to-not-use-fleet') {
           psychologicalStage = '2 - Aware';
-        } else if(valueFromFormData === 'up-and-running'){
+        } else if(['up-and-running', 'changed-mind-want-managed-deployment', 'kinda-stuck', 'havent-gotten-to-it'].includes(valueFromFormData)){
           psychologicalStage = '5 - Personally confident';
-        } else if(['kinda-stuck', 'havent-gotten-to-it', 'changed-mind-want-managed-deployment'].includes(valueFromFormData)){
-          psychologicalStage = '4 - Has use case';
         } else { require('assert')(false,'This should never happen.'); }
       } else if (currentStep === 'whats-left-to-get-you-set-up') {
         // FUTURE: do more stuff (for now this always acts like 'no change')
       } else if(currentStep === 'how-many-hosts') {
         if(['yes-deployed'].includes(hasUsedFleetAnswer)) {
           psychologicalStage = '6 - Has team buy-in';
-        } else if(['yes-recently-deployed'].includes(hasUsedFleetAnswer)){
-          psychologicalStage = '5 - Personally confident';
         } else {
-          // IWMIH then we want Fleet to host for us (either because we wanted that from the get-go, or we backtracked because deploying looked too time-consuming)
-          psychologicalStage = '4 - Has use case';
+          psychologicalStage = '5 - Personally confident';
         }
       } else if(currentStep === 'will-you-be-self-hosting') {
         if(['yes-deployed'].includes(hasUsedFleetAnswer)) {
@@ -209,9 +202,30 @@ module.exports = {
         psychologicalStage = '2 - Aware';
       }//fi
     }//fi
-
+    // Set the user's answer to the current step.
+    questionnaireProgress[currentStep] = formData;
+    // Clone the questionnaireProgress to prevent any mutations from sending it through the updateOne Waterline method.
+    let getStartedProgress = _.clone(questionnaireProgress);
+    let questionnaireProgressAsAFormattedString = undefined;// Default to undefined.
+    // Using a try catch block to handle errors from JSON.stringify.
+    try {
+      questionnaireProgressAsAFormattedString = JSON.stringify(getStartedProgress)
+      .replace(/[\{|\}|"]/g, '')// Remove the curly braces and quotation marks wrapping JSON objects
+      .replace(/,/g, '\n')// Replace commas with newlines.
+      .replace(/:\w+:/g, ':\t');// Replace the key from the formData with a color and tab, (e.g., what-are-you-using-fleet-for:primaryBuyingSituation:eo-security, » what-are-you-using-fleet-for:   eo-security)
+    } catch(err){
+      sails.log.warn(`When converting a user's (email: ${this.req.me.emailAddress}) getStartedQuestionnaireAnswers to a formatted string to send to the CRM, and error occurred`, err);
+    }
     // Only update CRM records if the user's psychological stage changes.
     if(psychologicalStage !== userRecord.psychologicalStage) {
+      let psychologicalStageChangeReason = 'Website - Organic start flow'; // Default psystageChangeReason to "Website - Organic start flow"
+      if(this.req.session.adAttributionString && this.req.session.visitedSiteFromAdAt) {
+        let thirtyMinutesAgoAt = Date.now() - (1000 * 60 * 30);
+        // If this user visited the website from an ad, set the psychologicalStageChangeReason to be the adCampaignId stored in their session.
+        if(this.req.session.visitedSiteFromAdAt > thirtyMinutesAgoAt) {
+          psychologicalStageChangeReason = this.req.session.adAttributionString;
+        }
+      }
       // Update the psychologicalStageLastChangedAt timestamp if the user's psychological stage
       psychologicalStageLastChangedAt = Date.now();
       sails.helpers.salesforce.updateOrCreateContactAndAccount.with({
@@ -221,7 +235,9 @@ module.exports = {
         primaryBuyingSituation: primaryBuyingSituation === 'eo-security' ? 'Endpoint operations - Security' : primaryBuyingSituation === 'eo-it' ? 'Endpoint operations - IT' : primaryBuyingSituation === 'mdm' ? 'Device management (MDM)' : primaryBuyingSituation === 'vm' ? 'Vulnerability management' : undefined,
         organization: this.req.me.organization,
         psychologicalStage,
-        leadSource: 'Website - Sign up',
+        psychologicalStageChangeReason,
+        getStartedResponses: questionnaireProgressAsAFormattedString,
+        contactSource: 'Website - Sign up',
       }).exec((err)=>{
         if(err){
           sails.log.warn(`Background task failed: When a user (email: ${this.req.me.emailAddress} submitted a step of the get started questionnaire, a Contact and Account record could not be created/updated in the CRM.`, err);
@@ -229,11 +245,6 @@ module.exports = {
         return;
       });
     }//fi
-    // TODO: send all other answers to Salesforce (when there are fields for them)
-    // Set the user's answer to the current step.
-    questionnaireProgress[currentStep] = formData;
-    // Clone the questionnaireProgress to prevent any mutations from sending it through the updateOne Waterline method.
-    let getStartedProgress = _.clone(questionnaireProgress);
     // Update the user's database model.
     await User.updateOne({id: userRecord.id})
     .set({
@@ -243,7 +254,7 @@ module.exports = {
       psychologicalStageLastChangedAt,
     });
     // Return the JSON dictionary of form data submitted by this user.
-    return getStartedProgress;
+    return {getStartedProgress, psychologicalStage, primaryBuyingSituation};
   }
 
 
diff --git a/website/api/controllers/unsubscribe-from-marketing-emails.js b/website/api/controllers/unsubscribe-from-marketing-emails.js
new file mode 100644
index 0000000000..26a9b53ee8
--- /dev/null
+++ b/website/api/controllers/unsubscribe-from-marketing-emails.js
@@ -0,0 +1,79 @@
+module.exports = {
+
+
+  friendlyName: 'Unsubscribe from marketing emails',
+
+
+  description: 'Unsubscribes a specified email address from the nurture email automation.',
+
+
+  inputs: {
+    emailAddress: {
+      type: 'string',
+      description: 'The email address of the user who wants to unsubscribe from marketing emails.',
+      required: true,
+    }
+  },
+
+
+  exits: {
+    userNotFound: {
+      description: 'The provided email address could not be matched to a Fleet user account',
+      responseType: 'badRequest',
+    },
+    success: {
+      description: 'The user has opted out of markering emails',
+    }
+  },
+
+
+  fn: async function ({emailAddress}) {
+
+    let userRecord = await User.findOne({emailAddress: emailAddress});
+
+    if(!userRecord){
+      throw 'userNotFound';
+    }
+    // Update the user record for this email address to set their nurture email timestamps to 1
+    // so they are excluded them from future runs of the deliver-nurture-emails script.
+    // FUTURE: update the user model to have a subscribedToNurtureEmails attribute.
+    await User.updateOne({emailAddress: emailAddress}).set({
+      stageThreeNurtureEmailSentAt: 1,
+      stageFourNurtureEmailSentAt: 1,
+      stageFiveNurtureEmailSentAt: 1,
+    });
+
+    // Update the contact record in salesforce for this email address to indicate that they have opted out of marketing emails.
+    if(sails.config.environment === 'production'){
+      require('assert')(sails.config.custom.salesforceIntegrationUsername);
+      require('assert')(sails.config.custom.salesforceIntegrationPasskey);
+
+      // Log in to Salesforce.
+      let jsforce = require('jsforce');
+      let salesforceConnection = new jsforce.Connection({
+        loginUrl : 'https://fleetdm.my.salesforce.com'
+      });
+      await salesforceConnection.login(sails.config.custom.salesforceIntegrationUsername, sails.config.custom.salesforceIntegrationPasskey);
+
+      let existingContactRecord = await salesforceConnection.sobject('Contact')
+      .findOne({
+        Email:  emailAddress,
+      });
+
+      if(existingContactRecord) {
+        //If we found an existing contact record in salesforce, update its status to be "Do not contact"
+        let salesforceContactId = existingContactRecord.Id;
+        await salesforceConnection.sobject('Contact')
+        .update({
+          Id: salesforceContactId,
+          Unsubscribed_from_email_contact__c: true,// eslint-disable-line camelcase
+        });
+      }
+    }
+    // Redirect the user to the homepage with a #unsubscribe hash link.
+    return this.res.redirect('/#unsubscribed');
+
+  }
+
+
+};
diff --git a/website/api/controllers/view-endpoint-ops.js b/website/api/controllers/view-endpoint-ops.js
index c5e2ec892b..7e1f33c5ac 100644
--- a/website/api/controllers/view-endpoint-ops.js
+++ b/website/api/controllers/view-endpoint-ops.js
@@ -22,13 +22,23 @@ module.exports = {
     }
     // Get testimonials for the <scrolalble-tweets> component.
     let testimonialsForScrollableTweets = _.clone(sails.config.builtStaticContent.testimonials);
+    // Default the pagePersonalization to the user's primaryBuyingSituation.
+    let pagePersonalization = this.req.session.primaryBuyingSituation;
+    // If a purpose query parameter is set, update the pagePersonalization value.
+    // Note: This is the only page we're using this method instead of using the primaryBuyingSiutation value set in the users session.
+    // This lets us link to the security and IT versions of the endpoint ops page from the unpersonalized homepage without changing the users primaryBuyingSituation.
+    if(this.req.param('purpose') === 'it'){
+      pagePersonalization = 'eo-it';
+    } else if(this.req.param('purpose') === 'security'){
+      pagePersonalization = 'eo-security';
+    }
 
 
     // Specify an order for the testimonials on this page using the last names of quote authors
-    let testimonialOrderForThisPage = ['Charles Zaffery','Dan Grzelak','Nico Waisman','Tom Larkin','Austin Anderson','Erik Gomez','Nick Fohs','Brendan Shaklovitz','Mike Arpaia','Andre Shields','Dhruv Majumdar','Ahmed Elshaer','Abubakar Yousafzai','Harrison Ravazzolo','Wes Whetstone','Kenny Botelho', 'Chandra Majumdar','Eric Tan', 'Alvaro Gutierrez', 'Joe Pistone'];
-    if(['eo-it', 'mdm'].includes(this.req.session.primaryBuyingSituation)){
-      testimonialOrderForThisPage = [ 'Harrison Ravazzolo', 'Eric Tan','Erik Gomez', 'Tom Larkin', 'Nick Fohs', 'Wes Whetstone', 'Mike Arpaia', 'Kenny Botelho', 'Alvaro Gutierrez'];
-    } else if(['eo-security', 'vm'].includes(this.req.session.primaryBuyingSituation)){
+    let testimonialOrderForThisPage = ['Charles Zaffery','Dan Grzelak','Nico Waisman','Tom Larkin','Austin Anderson','Erik Gomez','Nick Fohs','Brendan Shaklovitz','Mike Arpaia','Andre Shields','Dhruv Majumdar','Ahmed Elshaer','Abubakar Yousafzai','Wes Whetstone','Kenny Botelho', 'Chandra Majumdar','Eric Tan', 'Alvaro Gutierrez', 'Joe Pistone'];
+    if(['eo-it', 'mdm'].includes(pagePersonalization)){
+      testimonialOrderForThisPage = [ 'Eric Tan','Erik Gomez', 'Tom Larkin', 'Nick Fohs', 'Wes Whetstone', 'Mike Arpaia', 'Kenny Botelho', 'Alvaro Gutierrez'];
+    } else if(['eo-security', 'vm'].includes(pagePersonalization)){
       testimonialOrderForThisPage = ['Nico Waisman','Charles Zaffery','Abubakar Yousafzai','Eric Tan','Mike Arpaia','Chandra Majumdar','Ahmed Elshaer','Brendan Shaklovitz','Austin Anderson','Dan Grzelak','Dhruv Majumdar','Alvaro Gutierrez', 'Joe Pistone'];
     }
     // Filter the testimonials by product category and the filtered list we built above.
@@ -48,6 +58,7 @@ module.exports = {
     // Respond with view.
     return {
       testimonialsForScrollableTweets,
+      pagePersonalization,
     };
 
   }
diff --git a/website/api/controllers/view-fleetctl-preview.js b/website/api/controllers/view-fleetctl-preview.js
index 0712b57acb..aa5d0c5600 100644
--- a/website/api/controllers/view-fleetctl-preview.js
+++ b/website/api/controllers/view-fleetctl-preview.js
@@ -30,8 +30,25 @@ module.exports = {
 
   fn: async function ({start}) {
 
+    let trialLicenseKey;
+    // Check to see if this user has a Fleet premium trial license key.
+    let userHasTrialLicense = this.req.me.fleetPremiumTrialLicenseKey;
+    let userHasExpiredTrialLicense = false;
+    if(userHasTrialLicense) {
+      if(this.req.me.fleetPremiumTrialLicenseKeyExpiresAt < Date.now()) {
+        userHasExpiredTrialLicense = true;
+      }
+      trialLicenseKey = this.req.me.fleetPremiumTrialLicenseKey;
+    } else {
+      trialLicenseKey = '';
+    }
+
     // Respond with view.
-    return {hideNextStepsButtons: start};
+    return {
+      hideNextStepsButtons: start,
+      trialLicenseKey,
+      userHasExpiredTrialLicense,
+    };
 
   }
 
diff --git a/website/api/controllers/view-pricing.js b/website/api/controllers/view-pricing.js
index 7d07b6b770..e2b2794d47 100644
--- a/website/api/controllers/view-pricing.js
+++ b/website/api/controllers/view-pricing.js
@@ -29,7 +29,7 @@ module.exports = {
 
     let pricingTable = [];
 
-    let pricingTableCategories = ['Deployment', 'Device management', 'Endpoint operations', 'Vulnerability management', 'Integrations', 'Support'];
+    let pricingTableCategories = ['Devices', 'Deployment', 'Configuration', 'Integrations', 'Support'];
     for(let category of pricingTableCategories) {
       // Get all the features in that have a pricingTableFeatures array that contains this category.
       let featuresInThisCategory = _.filter(pricingTableFeatures, (feature)=>{
@@ -45,7 +45,7 @@ module.exports = {
     }
 
     let pricingTableForSecurity = [];
-    let categoryOrderForSecurityPricingTable = ['Support', 'Deployment', 'Integrations', 'Endpoint operations', 'Vulnerability management'];
+    let categoryOrderForSecurityPricingTable = ['Devices', 'Deployment', 'Configuration', 'Integrations', 'Support'];
     for(let category of categoryOrderForSecurityPricingTable) {
       // Get all the features in that have a pricingTableFeatures array that contains this category.
       let featuresInThisCategory = _.filter(pricingTableFeatures, (feature)=>{
@@ -61,7 +61,7 @@ module.exports = {
     }
 
 
-    let categoryOrderForITPricingTable = [ 'Deployment','Device management', 'Endpoint operations', 'Integrations', 'Support'];
+    let categoryOrderForITPricingTable = ['Devices', 'Deployment', 'Configuration', 'Integrations', 'Support'];
     let pricingTableForIt = [];
     // Sort the IT-focused pricing table from the order of the elements in the categoryOrderForITPricingTable array.
     for(let category of categoryOrderForITPricingTable) {
diff --git a/website/api/controllers/webhooks/receive-from-github.js b/website/api/controllers/webhooks/receive-from-github.js
index 20a5dde537..4dcbad029b 100644
--- a/website/api/controllers/webhooks/receive-from-github.js
+++ b/website/api/controllers/webhooks/receive-from-github.js
@@ -78,7 +78,6 @@ module.exports = {
       'sampfluger88',
       'ireedy',
       'mostlikelee',
-      'pacamaster',
       'AnthonySnyder8',
       'jahzielv',
       'getvictor',
@@ -89,6 +88,9 @@ module.exports = {
       'PezHub',
       'SFriendLee',
       'ddribeiro',
+      'rebeccaui',
+      'allenhouchins',
+      'harrisonravazzolo',
     ];
 
     let GREEN_LABEL_COLOR = 'C2E0C6';// « Used in multiple places below.  (FUTURE: Use the "+" prefix for this instead of color.  2022-05-05)
diff --git a/website/api/controllers/webhooks/receive-usage-analytics.js b/website/api/controllers/webhooks/receive-usage-analytics.js
index 9094c11d79..94f7fec744 100644
--- a/website/api/controllers/webhooks/receive-usage-analytics.js
+++ b/website/api/controllers/webhooks/receive-usage-analytics.js
@@ -39,6 +39,10 @@ module.exports = {
     numHostSoftwareInstalledPaths: {type: 'number', defaultsTo: 0},
     numSoftwareCPEs: {type: 'number', defaultsTo: 0},
     numSoftwareCVEs: {type: 'number', defaultsTo: 0},
+    aiFeaturesDisabled: {type: 'boolean', defaultsTo: false },
+    maintenanceWindowsEnabled: {type: 'boolean', defaultsTo: false },
+    maintenanceWindowsConfigured: {type: 'boolean', defaultsTo: false },
+    numHostsFleetDesktopEnabled: {type: 'number', defaultsTo: 0 },
   },
 
 
diff --git a/website/api/helpers/create-license-key.js b/website/api/helpers/create-license-key.js
index 26c9b8ad84..18e38d6d6a 100644
--- a/website/api/helpers/create-license-key.js
+++ b/website/api/helpers/create-license-key.js
@@ -47,7 +47,7 @@ module.exports = {
 
     let jwt = require('jsonwebtoken');
 
-    let expirationTimestampInSeconds = (expiresAt / 1000);
+    let expirationTimestampInSeconds = Math.floor(expiresAt / 1000);
     let token = jwt.sign(
       {
         iss: 'Fleet Device Management Inc.',
diff --git a/website/api/helpers/get-extended-osquery-schema.js b/website/api/helpers/get-extended-osquery-schema.js
index d19b090b7b..1a697a5847 100644
--- a/website/api/helpers/get-extended-osquery-schema.js
+++ b/website/api/helpers/get-extended-osquery-schema.js
@@ -11,6 +11,10 @@ module.exports = {
       type: 'boolean',
       defaultsTo: false,
       description: 'Whether or not to include a lastModifiedAt value for each table.',
+    },
+    githubAccessToken: {
+      type: 'string',
+      description: 'A github token used to authenticate requests to the GitHub API'
     }
   },
 
@@ -25,11 +29,10 @@ module.exports = {
   },
 
 
-  fn: async function ({includeLastModifiedAtValue}) {
+  fn: async function ({includeLastModifiedAtValue, githubAccessToken}) {
     let path = require('path');
     let YAML = require('yaml');
     let util = require('util');
-
     let topLvlRepoPath = path.resolve(sails.config.appPath, '../');
     require('assert')(sails.config.custom.versionOfOsquerySchemaToUseWhenGeneratingDocumentation, 'Please set sails.config.custom.sails.config.custom.versionOfOsquerySchemaToUseWhenGeneratingDocumentation to the version of osquery to use, for example \'5.8.1\'.');
     let VERSION_OF_OSQUERY_SCHEMA_TO_USE = sails.config.custom.versionOfOsquerySchemaToUseWhenGeneratingDocumentation;
@@ -40,6 +43,14 @@ module.exports = {
     let rawOsqueryTablesLastModifiedAt;
     if(includeLastModifiedAtValue) {
       // If we're including a lastModifiedAt value for schema tables, we'll send a request to the GitHub API to get a timestamp of when the last commit
+      let baseHeadersForGithubRequests = {
+        'User-Agent': 'fleet-schema-builder',
+        'Accept': 'application/vnd.github.v3+json',
+      };
+      // If a GitHub access token was provided, add it to the headers.
+      if(githubAccessToken){
+        baseHeadersForGithubRequests['Authorization'] = `token ${githubAccessToken}`;
+      }
       let responseData = await sails.helpers.http.get.with({// [?]: https://docs.github.com/en/rest/commits/commits?apiVersion=2022-11-28#list-commits
         url: 'https://api.github.com/repos/osquery/osquery-site/commits',
         data: {
@@ -47,10 +58,7 @@ module.exports = {
           page: 1,
           per_page: 1,//eslint-disable-line camelcase
         },
-        headers: {
-          'User-Agent': 'fleet-schema-builder',
-          'Accept': 'application/vnd.github.v3+json',
-        },
+        headers: baseHeadersForGithubRequests
       }).intercept((err)=>{
         return new Error(`When trying to send a request to GitHub get a timestamp of the last commit to the osqeury schema JSON, an error occurred. Full error: ${util.inspect(err)}`);
       });
diff --git a/website/api/helpers/iq/get-enriched.js b/website/api/helpers/iq/get-enriched.js
index f4b56ca88a..d1c4d385b1 100644
--- a/website/api/helpers/iq/get-enriched.js
+++ b/website/api/helpers/iq/get-enriched.js
@@ -252,6 +252,39 @@ module.exports = {
         if (emailDomain && employer.emailDomain && employer.emailDomain !== emailDomain) {
           sails.log.info(`Unexpected result when enriching: Email domain inferred from matched organization website (${employer.emailDomain}) does not equal the parsed email domain (${emailDomain}) that was derived from the provided "emailAddress" (${emailAddress})`);
         }//fi
+
+        // Use OpenAI to try and enrich some additional data, if it's missing.
+        if (!employer.numberOfEmployees) {
+          if (!sails.config.custom.openAiSecret) {
+            throw new Error('sails.config.custom.openAiSecret not set.');
+          }//•
+
+          let prompt = `How many employees does the organization who owns ${emailDomain} have?
+    
+    Please respond in this form (but instead of 0, put the number of employees, as an integer:
+    {
+      "employees": 0
+    }`;
+          let BASE_MODEL = 'gpt-4o';// The base model to use.  https://platform.openai.com/docs/models/gpt-4
+          // [?] API: https://platform.openai.com/docs/api-reference/chat/create
+          let openAiResponse = await sails.helpers.http.post('https://api.openai.com/v1/chat/completions', {
+            model: BASE_MODEL,
+            messages: [ { role: 'user', content: prompt } ],// // https://platform.openai.com/docs/guides/chat/introduction
+            temperature: 0.7,
+            max_tokens: 256//eslint-disable-line camelcase
+          }, {
+            Authorization: `Bearer ${sails.config.custom.openAiSecret}`
+          })
+          .tolerate((unusedErr)=>{});
+
+          if (openAiResponse) {
+            try {
+              employer.numberOfEmployees = JSON.parse(openAiResponse.choices[0].message.content).employees;
+            } catch (unusedErr) {
+              employer.numberOfEmployees = 1;
+            }
+          }//fi
+        }//fi
       }//fi
     }//fi
 
diff --git a/website/api/helpers/salesforce/update-or-create-contact-and-account-and-create-lead.js b/website/api/helpers/salesforce/update-or-create-contact-and-account-and-create-lead.js
index aa13206c48..05e9b29c95 100644
--- a/website/api/helpers/salesforce/update-or-create-contact-and-account-and-create-lead.js
+++ b/website/api/helpers/salesforce/update-or-create-contact-and-account-and-create-lead.js
@@ -30,12 +30,16 @@ module.exports = {
         '6 - Has team buy-in'
       ]
     },
+    psychologicalStageChangeReason: {
+      type: 'string',
+      example: 'Website - Organic start flow'
+    },
     // For new leads.
     leadDescription: {
       type: 'string',
       description: 'A description of what this lead is about; e.g. a contact form message, or the size of t-shirt being requested.'
     },
-    leadSource: {
+    contactSource: {
       type: 'string',
       required: true,
       isIn: [
@@ -58,7 +62,7 @@ module.exports = {
 
 
 
-  fn: async function ({emailAddress, linkedinUrl, firstName, lastName, organization, primaryBuyingSituation, psychologicalStage, leadSource, leadDescription, numberOfHosts}) {
+  fn: async function ({emailAddress, linkedinUrl, firstName, lastName, organization, primaryBuyingSituation, psychologicalStage, psychologicalStageChangeReason, contactSource, leadDescription, numberOfHosts}) {
     if(sails.config.environment !== 'production') {
       sails.log('Skipping Salesforce integration...');
       return;
@@ -72,7 +76,8 @@ module.exports = {
       linkedinUrl,
       primaryBuyingSituation,
       psychologicalStage,
-      leadSource,
+      psychologicalStageChangeReason,
+      contactSource,
       description: leadDescription,
     });
 
@@ -80,7 +85,7 @@ module.exports = {
       salesforceContactId: recordIds.salesforceContactId,
       salesforceAccountId: recordIds.salesforceAccountId,
       leadDescription,
-      leadSource,
+      leadSource: contactSource,
       numberOfHosts,
     });
 
diff --git a/website/api/helpers/salesforce/update-or-create-contact-and-account.js b/website/api/helpers/salesforce/update-or-create-contact-and-account.js
index aea76fd28c..41ebd76efe 100644
--- a/website/api/helpers/salesforce/update-or-create-contact-and-account.js
+++ b/website/api/helpers/salesforce/update-or-create-contact-and-account.js
@@ -30,13 +30,21 @@ module.exports = {
         '6 - Has team buy-in'
       ]
     },
-    leadSource: {
+    psychologicalStageChangeReason: {
+      type: 'string',
+      example: 'Website - Organic start flow'
+    },
+    contactSource: {
       type: 'string',
       isIn: [
         'Website - Contact forms',
         'Website - Sign up',
       ],
     },
+    getStartedResponses: {
+      type: 'string',
+    }
+
   },
 
 
@@ -52,7 +60,7 @@ module.exports = {
   },
 
 
-  fn: async function ({emailAddress, linkedinUrl, firstName, lastName, organization, primaryBuyingSituation, psychologicalStage, leadSource, description}) {
+  fn: async function ({emailAddress, linkedinUrl, firstName, lastName, organization, primaryBuyingSituation, psychologicalStage, psychologicalStageChangeReason, contactSource, description, getStartedResponses}) {
     // Return undefined if we're not running in a production environment.
     if(sails.config.environment !== 'production') {
       sails.log.verbose('Skipping Salesforce integration...');
@@ -96,9 +104,15 @@ module.exports = {
     if(psychologicalStage) {
       valuesToSet.Stage__c = psychologicalStage;// eslint-disable-line camelcase
     }
+    if(getStartedResponses) {
+      valuesToSet.Website_questionnaire_answers__c = getStartedResponses;// eslint-disable-line camelcase
+    }
     if(description) {
       valuesToSet.Description = description;
     }
+    if(psychologicalStageChangeReason) {
+      valuesToSet.Psystage_change_reason__c = psychologicalStageChangeReason;// eslint-disable-line camelcase
+    }
 
     let existingContactRecord;
     // Search for an existing Contact record using the provided email address or linkedIn profile URL.
@@ -119,6 +133,21 @@ module.exports = {
       if(description && existingContactRecord.Description) {
         valuesToSet.Description = existingContactRecord.Description + '\n' + description;
       }
+      // Check the existing contact record's psychologicalStage.
+      if(psychologicalStage) {
+        let recordsCurrentPsyStage = existingContactRecord.Stage__c;
+        // Because each psychological stage starts with a number, we'll get the first character in the record's current psychological stage and the new psychological stage to make comparison easier.
+        let psyStageStageNumberToChangeTo = Number(psychologicalStage[0]);
+        let recordsCurrentPsyStageNumber = Number(recordsCurrentPsyStage[0]);
+        if(psyStageStageNumberToChangeTo < recordsCurrentPsyStageNumber) {
+          // If a psychological stage regression is caused by anything other than the start flow, remove the updated value.
+          // This is done to prevent automated psyStage regressions caused by users taking other action on the website. (e.g, Booking a meeting or requesting Fleet swag.)
+          if(psychologicalStageChangeReason && psychologicalStageChangeReason !== 'Website - Organic start flow') {
+            delete valuesToSet.Stage__c;
+            delete valuesToSet.Psystage_change_reason__c;
+          }
+        }
+      }
       // console.log(`Exisitng contact found! ${existingContactRecord.Id}`);
       // If we found an existing contact, we'll update it with the information provided.
       salesforceContactId = existingContactRecord.Id;
@@ -179,7 +208,7 @@ module.exports = {
           // Create a timestamp to use for the new account's assigned date.
           let today = new Date();
           let nowOn = today.toISOString().replace('Z', '+0000');
-
+          require('assert')(typeof enrichmentData.employer.numberOfEmployees === 'number');
           let newAccountRecord = await salesforceConnection.sobject('Account')
           .create({
             Account_Assigned_date__c: nowOn,// eslint-disable-line camelcase
@@ -198,9 +227,9 @@ module.exports = {
         // console.log('New account created!', salesforceAccountId);
       }//fi
 
-      // Only add leadSource to valuesToSet if we're creating a new contact record.
-      if(leadSource) {
-        valuesToSet.LeadSource = leadSource;
+      // Only add contactSource to valuesToSet if we're creating a new contact record.
+      if(contactSource) {
+        valuesToSet.Contact_source__c = contactSource;// eslint-disable-line camelcase
       }
       // console.log(`creating new Contact record.`)
       // Create a new Contact record for this person.
diff --git a/website/api/helpers/send-template-email.js b/website/api/helpers/send-template-email.js
index 4679719318..ab2f780002 100644
--- a/website/api/helpers/send-template-email.js
+++ b/website/api/helpers/send-template-email.js
@@ -55,6 +55,18 @@ module.exports = {
       example: 'Nola Thacker',
     },
 
+    replyTo: {
+      description: 'The reply to email address.',
+      example: {
+        emailAddress: 'anne.m.martin@example.com',
+        name: 'Anne M. Martin'
+      },
+      type: {
+        emailAddress: 'string',
+        name: 'string',
+      }
+    },
+
     subject: {
       description: 'The subject of the email.',
       example: 'Hello there.',
@@ -122,7 +134,7 @@ module.exports = {
   },
 
 
-  fn: async function({template, templateData, to, toName, subject, from, fromName, layout, ensureAck, bcc, attachments}) {
+  fn: async function({template, templateData, to, toName, subject, from, fromName, layout, replyTo, ensureAck, bcc, attachments}) {
 
     var path = require('path');
     var url = require('url');
@@ -247,6 +259,7 @@ module.exports = {
         subject: subjectLinePrefix+subject,
         from: from,
         fromName: fromName,
+        replyTo: replyTo,
         attachments
       };
 
diff --git a/website/api/hooks/custom/index.js b/website/api/hooks/custom/index.js
index e82a6ba8ab..d2bd549ddb 100644
--- a/website/api/hooks/custom/index.js
+++ b/website/api/hooks/custom/index.js
@@ -147,6 +147,17 @@ will be disabled and/or hidden in the UI.
               res.locals.me = undefined;
             }//fi
 
+            // Check for query parameters set by ad clicks.
+            // This is used to track the reason behind a psychological stage change.
+            // If the user performs any action that causes a stage change
+            // within 30 minutes of visiting the website from an ad, their psychological
+            // stage change will be attributed to the ad campaign that brought them here.
+            if(req.param('utm_source') && req.param('creative_id') && req.param('campaign_id')){
+              req.session.adAttributionString = `${req.param('utm_source')} ads - ${req.param('campaign_id')} - ${_.trim(req.param('creative_id'), '?')}`;// Trim questionmarks from the end of creative_id parameters.
+              // Example adAttributionString: Linkedin - 1245983829 - 41u3985237
+              req.session.visitedSiteFromAdAt = Date.now();
+            }
+
             // Check for website personalization parameter, and if valid, absorb it in the session.
             // (This makes the experience simpler and less confusing for people, prioritizing showing things that matter for them)
             // [?] https://en.wikipedia.org/wiki/UTM_parameters
@@ -289,8 +300,8 @@ will be disabled and/or hidden in the UI.
               // FUTURE: Only show this CTA to users who are below psyStage 6.
               // > The code below is so we don't bother users who have completed the questionnaire
 
-              // Determine if this user should see the CTA to bring them to the /start questionnaire using the user's last submitted questionnaire answer.
-              res.locals.showStartCta = !['how-many-hosts','will-you-be-self-hosting','managed-cloud-for-growing-deployments','self-hosted-deploy', 'whats-left-to-get-you-set-up'].includes(req.me.lastSubmittedGetStartedQuestionnaireStep);
+              // Show this logged-in user a CTA to bring them to the /start questionnaire if they do not have billing information saved.
+              res.locals.showStartCta = !req.me.hasBillingCard;
               //  * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * //
 
               // If an expandCtaAt timestamp is set in the user's sesssion, check the value to see if we should expand the CTA.
diff --git a/website/api/models/HistoricalUsageSnapshot.js b/website/api/models/HistoricalUsageSnapshot.js
index 5481d42e53..1f14b9b291 100644
--- a/website/api/models/HistoricalUsageSnapshot.js
+++ b/website/api/models/HistoricalUsageSnapshot.js
@@ -43,6 +43,10 @@ module.exports = {
     numHostSoftwareInstalledPaths: {required: true, type: 'number'},
     numSoftwareCPEs: {required: true, type: 'number'},
     numSoftwareCVEs: {required: true, type: 'number'},
+    aiFeaturesDisabled: {required: true, type: 'boolean'},
+    maintenanceWindowsEnabled: {required: true, type: 'boolean'},
+    maintenanceWindowsConfigured: {required: true, type: 'boolean'},
+    numHostsFleetDesktopEnabled: {required: true, type: 'number'},
 
     //  ╔═╗╔╦╗╔╗ ╔═╗╔╦╗╔═╗
     //  ║╣ ║║║╠╩╗║╣  ║║╚═╗
diff --git a/website/api/models/User.js b/website/api/models/User.js
index 72b603338d..7f325e3ffa 100644
--- a/website/api/models/User.js
+++ b/website/api/models/User.js
@@ -248,19 +248,28 @@ without necessarily having a billing card.`
 
     stageThreeNurtureEmailSentAt: {
       type: 'number',
-      description: 'A JS timestamp of when the stage 3 nurture email was sent to the user.'
+      description: 'A JS timestamp of when the stage 3 nurture email was sent to the user, or 1 if the user is unsubscribed from automated emails.',
     },
 
     stageFourNurtureEmailSentAt: {
       type: 'number',
-      description: 'A JS timestamp of when the stage 4 nurture email was sent to the user.'
+      description: 'A JS timestamp of when the stage 4 nurture email was sent to the user, or 1 if the user is unsubscribed from automated emails.',
     },
 
     stageFiveNurtureEmailSentAt: {
       type: 'number',
-      description: 'A JS timestamp of when the stage 5 nurture email was sent to the user.'
+      description: 'A JS timestamp of when the stage 5 nurture email was sent to the user, or 1 if the user is unsubscribed from automated emails.',
     },
 
+    fleetPremiumTrialLicenseKey: {
+      type: 'string',
+      description: 'A Fleet Premium license key that was generated for this user when they progressed through the get started questionnaire.',
+    },
+
+    fleetPremiumTrialLicenseKeyExpiresAt: {
+      type: 'number',
+      description: 'A JS timestamp of when this user\'s Fleet Premium trial license key expires.',
+    },
 
     //  ╔═╗╔╦╗╔╗ ╔═╗╔╦╗╔═╗
     //  ║╣ ║║║╠╩╗║╣  ║║╚═╗
diff --git a/website/assets/dependencies/docsearch.min.js b/website/assets/dependencies/docsearch.min.js
index 336fc3e303..1851df2b63 100644
--- a/website/assets/dependencies/docsearch.min.js
+++ b/website/assets/dependencies/docsearch.min.js
@@ -1,4 +1,3 @@
-
-/*! @docsearch/js 3.5.1 | MIT License | © Algolia, Inc. and contributors | https://docsearch.algolia.com */
-!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?module.exports=t():"function"==typeof define&&define.amd?define(t):(e=e||self).docsearch=t()}(this,(function(){"use strict";function e(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function t(t){for(var n=1;n<arguments.length;n++){var o=null!=arguments[n]?arguments[n]:{};n%2?e(Object(o),!0).forEach((function(e){r(t,e,o[e])})):Object.getOwnPropertyDescriptors?Object.defineProperties(t,Object.getOwnPropertyDescriptors(o)):e(Object(o)).forEach((function(e){Object.defineProperty(t,e,Object.getOwnPropertyDescriptor(o,e))}))}return t}function n(e){return n="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},n(e)}function r(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function o(){return o=Object.assign||function(e){for(var t=1;t<arguments.length;t++){var n=arguments[t];for(var r in n)Object.prototype.hasOwnProperty.call(n,r)&&(e[r]=n[r])}return e},o.apply(this,arguments)}function i(e,t){if(null==e)return{};var n,r,o=function(e,t){if(null==e)return{};var n,r,o={},i=Object.keys(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}function c(e,t){return function(e){if(Array.isArray(e))return e}(e)||function(e,t){var n=null==e?null:"undefined"!=typeof Symbol&&e[Symbol.iterator]||e["@@iterator"];if(null==n)return;var r,o,i=[],c=!0,a=!1;try{for(n=n.call(e);!(c=(r=n.next()).done)&&(i.push(r.value),!t||i.length!==t);c=!0);}catch(e){a=!0,o=e}finally{try{c||null==n.return||n.return()}finally{if(a)throw o}}return i}(e,t)||u(e,t)||function(){throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function a(e){return function(e){if(Array.isArray(e))return l(e)}(e)||function(e){if("undefined"!=typeof Symbol&&null!=e[Symbol.iterator]||null!=e["@@iterator"])return Array.from(e)}(e)||u(e)||function(){throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function u(e,t){if(e){if("string"==typeof e)return l(e,t);var n=Object.prototype.toString.call(e).slice(8,-1);return"Object"===n&&e.constructor&&(n=e.constructor.name),"Map"===n||"Set"===n?Array.from(e):"Arguments"===n||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)?l(e,t):void 0}}function l(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,r=new Array(t);n<t;n++)r[n]=e[n];return r}var s,f,p,m,v,d={},h=[],y=/acit|ex(?:s|g|n|p|$)|rph|grid|ows|mnc|ntw|ine[ch]|zoo|^ord|itera/i;function b(e,t){for(var n in t)e[n]=t[n];return e}function _(e){var t=e.parentNode;t&&t.removeChild(e)}function g(e,t,n){var r,o,i,c=arguments,a={};for(i in t)"key"==i?r=t[i]:"ref"==i?o=t[i]:a[i]=t[i];if(arguments.length>3)for(n=[n],i=3;i<arguments.length;i++)n.push(c[i]);if(null!=n&&(a.children=n),"function"==typeof e&&null!=e.defaultProps)for(i in e.defaultProps)void 0===a[i]&&(a[i]=e.defaultProps[i]);return O(e,a,r,o,null)}function O(e,t,n,r,o){var i={type:e,props:t,key:n,ref:r,__k:null,__:null,__b:0,__e:null,__d:void 0,__c:null,__h:null,constructor:void 0,__v:null==o?++s.__v:o};return null!=s.vnode&&s.vnode(i),i}function S(e){return e.children}function j(e,t){this.props=e,this.context=t}function w(e,t){if(null==t)return e.__?w(e.__,e.__.__k.indexOf(e)+1):null;for(var n;t<e.__k.length;t++)if(null!=(n=e.__k[t])&&null!=n.__e)return n.__e;return"function"==typeof e.type?w(e):null}function E(e){var t,n;if(null!=(e=e.__)&&null!=e.__c){for(e.__e=e.__c.base=null,t=0;t<e.__k.length;t++)if(null!=(n=e.__k[t])&&null!=n.__e){e.__e=e.__c.base=n.__e;break}return E(e)}}function P(e){(!e.__d&&(e.__d=!0)&&f.push(e)&&!I.__r++||m!==s.debounceRendering)&&((m=s.debounceRendering)||p)(I)}function I(){for(var e;I.__r=f.length;)e=f.sort((function(e,t){return e.__v.__b-t.__v.__b})),f=[],e.some((function(e){var t,n,r,o,i,c;e.__d&&(i=(o=(t=e).__v).__e,(c=t.__P)&&(n=[],(r=b({},o)).__v=o.__v+1,q(c,o,r,t.__n,void 0!==c.ownerSVGElement,null!=o.__h?[i]:null,n,null==i?w(o):i,o.__h),L(n,o),o.__e!=i&&E(o)))}))}function D(e,t,n,r,o,i,c,a,u,l){var s,f,p,m,v,y,b,_=r&&r.__k||h,g=_.length;for(n.__k=[],s=0;s<t.length;s++)if(null!=(m=n.__k[s]=null==(m=t[s])||"boolean"==typeof m?null:"string"==typeof m||"number"==typeof m?O(null,m,null,null,m):Array.isArray(m)?O(S,{children:m},null,null,null):m.__b>0?O(m.type,m.props,m.key,null,m.__v):m)){if(m.__=n,m.__b=n.__b+1,null===(p=_[s])||p&&m.key==p.key&&m.type===p.type)_[s]=void 0;else for(f=0;f<g;f++){if((p=_[f])&&m.key==p.key&&m.type===p.type){_[f]=void 0;break}p=null}q(e,m,p=p||d,o,i,c,a,u,l),v=m.__e,(f=m.ref)&&p.ref!=f&&(b||(b=[]),p.ref&&b.push(p.ref,null,m),b.push(f,m.__c||v,m)),null!=v?(null==y&&(y=v),"function"==typeof m.type&&null!=m.__k&&m.__k===p.__k?m.__d=u=k(m,u,e):u=C(e,m,p,_,v,u),l||"option"!==n.type?"function"==typeof n.type&&(n.__d=u):e.value=""):u&&p.__e==u&&u.parentNode!=e&&(u=w(p))}for(n.__e=y,s=g;s--;)null!=_[s]&&("function"==typeof n.type&&null!=_[s].__e&&_[s].__e==n.__d&&(n.__d=w(r,s+1)),U(_[s],_[s]));if(b)for(s=0;s<b.length;s++)H(b[s],b[++s],b[++s])}function k(e,t,n){var r,o;for(r=0;r<e.__k.length;r++)(o=e.__k[r])&&(o.__=e,t="function"==typeof o.type?k(o,t,n):C(n,o,o,e.__k,o.__e,t));return t}function A(e,t){return t=t||[],null==e||"boolean"==typeof e||(Array.isArray(e)?e.some((function(e){A(e,t)})):t.push(e)),t}function C(e,t,n,r,o,i){var c,a,u;if(void 0!==t.__d)c=t.__d,t.__d=void 0;else if(null==n||o!=i||null==o.parentNode)e:if(null==i||i.parentNode!==e)e.appendChild(o),c=null;else{for(a=i,u=0;(a=a.nextSibling)&&u<r.length;u+=2)if(a==o)break e;e.insertBefore(o,i),c=i}return void 0!==c?c:o.nextSibling}function x(e,t,n){"-"===t[0]?e.setProperty(t,n):e[t]=null==n?"":"number"!=typeof n||y.test(t)?n:n+"px"}function N(e,t,n,r,o){var i;e:if("style"===t)if("string"==typeof n)e.style.cssText=n;else{if("string"==typeof r&&(e.style.cssText=r=""),r)for(t in r)n&&t in n||x(e.style,t,"");if(n)for(t in n)r&&n[t]===r[t]||x(e.style,t,n[t])}else if("o"===t[0]&&"n"===t[1])i=t!==(t=t.replace(/Capture$/,"")),t=t.toLowerCase()in e?t.toLowerCase().slice(2):t.slice(2),e.l||(e.l={}),e.l[t+i]=n,n?r||e.addEventListener(t,i?R:T,i):e.removeEventListener(t,i?R:T,i);else if("dangerouslySetInnerHTML"!==t){if(o)t=t.replace(/xlink[H:h]/,"h").replace(/sName$/,"s");else if("href"!==t&&"list"!==t&&"form"!==t&&"download"!==t&&t in e)try{e[t]=null==n?"":n;break e}catch(e){}"function"==typeof n||(null!=n&&(!1!==n||"a"===t[0]&&"r"===t[1])?e.setAttribute(t,n):e.removeAttribute(t))}}function T(e){this.l[e.type+!1](s.event?s.event(e):e)}function R(e){this.l[e.type+!0](s.event?s.event(e):e)}function q(e,t,n,r,o,i,c,a,u){var l,f,p,m,v,d,h,y,_,g,O,w=t.type;if(void 0!==t.constructor)return null;null!=n.__h&&(u=n.__h,a=t.__e=n.__e,t.__h=null,i=[a]),(l=s.__b)&&l(t);try{e:if("function"==typeof w){if(y=t.props,_=(l=w.contextType)&&r[l.__c],g=l?_?_.props.value:l.__:r,n.__c?h=(f=t.__c=n.__c).__=f.__E:("prototype"in w&&w.prototype.render?t.__c=f=new w(y,g):(t.__c=f=new j(y,g),f.constructor=w,f.render=F),_&&_.sub(f),f.props=y,f.state||(f.state={}),f.context=g,f.__n=r,p=f.__d=!0,f.__h=[]),null==f.__s&&(f.__s=f.state),null!=w.getDerivedStateFromProps&&(f.__s==f.state&&(f.__s=b({},f.__s)),b(f.__s,w.getDerivedStateFromProps(y,f.__s))),m=f.props,v=f.state,p)null==w.getDerivedStateFromProps&&null!=f.componentWillMount&&f.componentWillMount(),null!=f.componentDidMount&&f.__h.push(f.componentDidMount);else{if(null==w.getDerivedStateFromProps&&y!==m&&null!=f.componentWillReceiveProps&&f.componentWillReceiveProps(y,g),!f.__e&&null!=f.shouldComponentUpdate&&!1===f.shouldComponentUpdate(y,f.__s,g)||t.__v===n.__v){f.props=y,f.state=f.__s,t.__v!==n.__v&&(f.__d=!1),f.__v=t,t.__e=n.__e,t.__k=n.__k,f.__h.length&&c.push(f);break e}null!=f.componentWillUpdate&&f.componentWillUpdate(y,f.__s,g),null!=f.componentDidUpdate&&f.__h.push((function(){f.componentDidUpdate(m,v,d)}))}f.context=g,f.props=y,f.state=f.__s,(l=s.__r)&&l(t),f.__d=!1,f.__v=t,f.__P=e,l=f.render(f.props,f.state,f.context),f.state=f.__s,null!=f.getChildContext&&(r=b(b({},r),f.getChildContext())),p||null==f.getSnapshotBeforeUpdate||(d=f.getSnapshotBeforeUpdate(m,v)),O=null!=l&&l.type===S&&null==l.key?l.props.children:l,D(e,Array.isArray(O)?O:[O],t,n,r,o,i,c,a,u),f.base=t.__e,t.__h=null,f.__h.length&&c.push(f),h&&(f.__E=f.__=null),f.__e=!1}else null==i&&t.__v===n.__v?(t.__k=n.__k,t.__e=n.__e):t.__e=M(n.__e,t,n,r,o,i,c,u);(l=s.diffed)&&l(t)}catch(e){t.__v=null,(u||null!=i)&&(t.__e=a,t.__h=!!u,i[i.indexOf(a)]=null),s.__e(e,t,n)}}function L(e,t){s.__c&&s.__c(t,e),e.some((function(t){try{e=t.__h,t.__h=[],e.some((function(e){e.call(t)}))}catch(e){s.__e(e,t.__v)}}))}function M(e,t,n,r,o,i,c,a){var u,l,s,f,p=n.props,m=t.props,v=t.type,y=0;if("svg"===v&&(o=!0),null!=i)for(;y<i.length;y++)if((u=i[y])&&(u===e||(v?u.localName==v:3==u.nodeType))){e=u,i[y]=null;break}if(null==e){if(null===v)return document.createTextNode(m);e=o?document.createElementNS("http://www.w3.org/2000/svg",v):document.createElement(v,m.is&&m),i=null,a=!1}if(null===v)p===m||a&&e.data===m||(e.data=m);else{if(i=i&&h.slice.call(e.childNodes),l=(p=n.props||d).dangerouslySetInnerHTML,s=m.dangerouslySetInnerHTML,!a){if(null!=i)for(p={},f=0;f<e.attributes.length;f++)p[e.attributes[f].name]=e.attributes[f].value;(s||l)&&(s&&(l&&s.__html==l.__html||s.__html===e.innerHTML)||(e.innerHTML=s&&s.__html||""))}if(function(e,t,n,r,o){var i;for(i in n)"children"===i||"key"===i||i in t||N(e,i,null,n[i],r);for(i in t)o&&"function"!=typeof t[i]||"children"===i||"key"===i||"value"===i||"checked"===i||n[i]===t[i]||N(e,i,t[i],n[i],r)}(e,m,p,o,a),s)t.__k=[];else if(y=t.props.children,D(e,Array.isArray(y)?y:[y],t,n,r,o&&"foreignObject"!==v,i,c,e.firstChild,a),null!=i)for(y=i.length;y--;)null!=i[y]&&_(i[y]);a||("value"in m&&void 0!==(y=m.value)&&(y!==e.value||"progress"===v&&!y)&&N(e,"value",y,p.value,!1),"checked"in m&&void 0!==(y=m.checked)&&y!==e.checked&&N(e,"checked",y,p.checked,!1))}return e}function H(e,t,n){try{"function"==typeof e?e(t):e.current=t}catch(e){s.__e(e,n)}}function U(e,t,n){var r,o,i;if(s.unmount&&s.unmount(e),(r=e.ref)&&(r.current&&r.current!==e.__e||H(r,null,t)),n||"function"==typeof e.type||(n=null!=(o=e.__e)),e.__e=e.__d=void 0,null!=(r=e.__c)){if(r.componentWillUnmount)try{r.componentWillUnmount()}catch(e){s.__e(e,t)}r.base=r.__P=null}if(r=e.__k)for(i=0;i<r.length;i++)r[i]&&U(r[i],t,n);null!=o&&_(o)}function F(e,t,n){return this.constructor(e,n)}function B(e,t,n){var r,o,i;s.__&&s.__(e,t),o=(r="function"==typeof n)?null:n&&n.__k||t.__k,i=[],q(t,e=(!r&&n||t).__k=g(S,null,[e]),o||d,d,void 0!==t.ownerSVGElement,!r&&n?[n]:o?null:t.firstChild?h.slice.call(t.childNodes):null,i,!r&&n?n:o?o.__e:t.firstChild,r),L(i,e)}function V(e,t){B(e,t,V)}function W(e,t,n){var r,o,i,c=arguments,a=b({},e.props);for(i in t)"key"==i?r=t[i]:"ref"==i?o=t[i]:a[i]=t[i];if(arguments.length>3)for(n=[n],i=3;i<arguments.length;i++)n.push(c[i]);return null!=n&&(a.children=n),O(e.type,a,r||e.key,o||e.ref,null)}s={__e:function(e,t){for(var n,r,o;t=t.__;)if((n=t.__c)&&!n.__)try{if((r=n.constructor)&&null!=r.getDerivedStateFromError&&(n.setState(r.getDerivedStateFromError(e)),o=n.__d),null!=n.componentDidCatch&&(n.componentDidCatch(e),o=n.__d),o)return n.__E=n}catch(t){e=t}throw e},__v:0},j.prototype.setState=function(e,t){var n;n=null!=this.__s&&this.__s!==this.state?this.__s:this.__s=b({},this.state),"function"==typeof e&&(e=e(b({},n),this.props)),e&&b(n,e),null!=e&&this.__v&&(t&&this.__h.push(t),P(this))},j.prototype.forceUpdate=function(e){this.__v&&(this.__e=!0,e&&this.__h.push(e),P(this))},j.prototype.render=S,f=[],p="function"==typeof Promise?Promise.prototype.then.bind(Promise.resolve()):setTimeout,I.__r=0,v=0;var K,z,J,$=0,Q=[],Z=s.__b,Y=s.__r,G=s.diffed,X=s.__c,ee=s.unmount;function te(e,t){s.__h&&s.__h(z,e,$||t),$=0;var n=z.__H||(z.__H={__:[],__h:[]});return e>=n.__.length&&n.__.push({}),n.__[e]}function ne(e){return $=1,re(pe,e)}function re(e,t,n){var r=te(K++,2);return r.t=e,r.__c||(r.__=[n?n(t):pe(void 0,t),function(e){var t=r.t(r.__[0],e);r.__[0]!==t&&(r.__=[t,r.__[1]],r.__c.setState({}))}],r.__c=z),r.__}function oe(e,t){var n=te(K++,3);!s.__s&&fe(n.__H,t)&&(n.__=e,n.__H=t,z.__H.__h.push(n))}function ie(e,t){var n=te(K++,4);!s.__s&&fe(n.__H,t)&&(n.__=e,n.__H=t,z.__h.push(n))}function ce(e,t){var n=te(K++,7);return fe(n.__H,t)&&(n.__=e(),n.__H=t,n.__h=e),n.__}function ae(){Q.forEach((function(e){if(e.__P)try{e.__H.__h.forEach(le),e.__H.__h.forEach(se),e.__H.__h=[]}catch(t){e.__H.__h=[],s.__e(t,e.__v)}})),Q=[]}s.__b=function(e){z=null,Z&&Z(e)},s.__r=function(e){Y&&Y(e),K=0;var t=(z=e.__c).__H;t&&(t.__h.forEach(le),t.__h.forEach(se),t.__h=[])},s.diffed=function(e){G&&G(e);var t=e.__c;t&&t.__H&&t.__H.__h.length&&(1!==Q.push(t)&&J===s.requestAnimationFrame||((J=s.requestAnimationFrame)||function(e){var t,n=function(){clearTimeout(r),ue&&cancelAnimationFrame(t),setTimeout(e)},r=setTimeout(n,100);ue&&(t=requestAnimationFrame(n))})(ae)),z=void 0},s.__c=function(e,t){t.some((function(e){try{e.__h.forEach(le),e.__h=e.__h.filter((function(e){return!e.__||se(e)}))}catch(n){t.some((function(e){e.__h&&(e.__h=[])})),t=[],s.__e(n,e.__v)}})),X&&X(e,t)},s.unmount=function(e){ee&&ee(e);var t=e.__c;if(t&&t.__H)try{t.__H.__.forEach(le)}catch(e){s.__e(e,t.__v)}};var ue="function"==typeof requestAnimationFrame;function le(e){var t=z;"function"==typeof e.__c&&e.__c(),z=t}function se(e){var t=z;e.__c=e.__(),z=t}function fe(e,t){return!e||e.length!==t.length||t.some((function(t,n){return t!==e[n]}))}function pe(e,t){return"function"==typeof t?t(e):t}function me(e,t){for(var n in t)e[n]=t[n];return e}function ve(e,t){for(var n in e)if("__source"!==n&&!(n in t))return!0;for(var r in t)if("__source"!==r&&e[r]!==t[r])return!0;return!1}function de(e){this.props=e}(de.prototype=new j).isPureReactComponent=!0,de.prototype.shouldComponentUpdate=function(e,t){return ve(this.props,e)||ve(this.state,t)};var he=s.__b;s.__b=function(e){e.type&&e.type.__f&&e.ref&&(e.props.ref=e.ref,e.ref=null),he&&he(e)};var ye="undefined"!=typeof Symbol&&Symbol.for&&Symbol.for("react.forward_ref")||3911;var be=function(e,t){return null==e?null:A(A(e).map(t))},_e={map:be,forEach:be,count:function(e){return e?A(e).length:0},only:function(e){var t=A(e);if(1!==t.length)throw"Children.only";return t[0]},toArray:A},ge=s.__e;function Oe(){this.__u=0,this.t=null,this.__b=null}function Se(e){var t=e.__.__c;return t&&t.__e&&t.__e(e)}function je(){this.u=null,this.o=null}s.__e=function(e,t,n){if(e.then)for(var r,o=t;o=o.__;)if((r=o.__c)&&r.__c)return null==t.__e&&(t.__e=n.__e,t.__k=n.__k),r.__c(e,t);ge(e,t,n)},(Oe.prototype=new j).__c=function(e,t){var n=t.__c,r=this;null==r.t&&(r.t=[]),r.t.push(n);var o=Se(r.__v),i=!1,c=function(){i||(i=!0,n.componentWillUnmount=n.__c,o?o(a):a())};n.__c=n.componentWillUnmount,n.componentWillUnmount=function(){c(),n.__c&&n.__c()};var a=function(){if(!--r.__u){if(r.state.__e){var e=r.state.__e;r.__v.__k[0]=function e(t,n,r){return t&&(t.__v=null,t.__k=t.__k&&t.__k.map((function(t){return e(t,n,r)})),t.__c&&t.__c.__P===n&&(t.__e&&r.insertBefore(t.__e,t.__d),t.__c.__e=!0,t.__c.__P=r)),t}(e,e.__c.__P,e.__c.__O)}var t;for(r.setState({__e:r.__b=null});t=r.t.pop();)t.forceUpdate()}},u=!0===t.__h;r.__u++||u||r.setState({__e:r.__b=r.__v.__k[0]}),e.then(c,c)},Oe.prototype.componentWillUnmount=function(){this.t=[]},Oe.prototype.render=function(e,t){if(this.__b){if(this.__v.__k){var n=document.createElement("div"),r=this.__v.__k[0].__c;this.__v.__k[0]=function e(t,n,r){return t&&(t.__c&&t.__c.__H&&(t.__c.__H.__.forEach((function(e){"function"==typeof e.__c&&e.__c()})),t.__c.__H=null),null!=(t=me({},t)).__c&&(t.__c.__P===r&&(t.__c.__P=n),t.__c=null),t.__k=t.__k&&t.__k.map((function(t){return e(t,n,r)}))),t}(this.__b,n,r.__O=r.__P)}this.__b=null}var o=t.__e&&g(S,null,e.fallback);return o&&(o.__h=null),[g(S,null,t.__e?null:e.children),o]};var we=function(e,t,n){if(++n[1]===n[0]&&e.o.delete(t),e.props.revealOrder&&("t"!==e.props.revealOrder[0]||!e.o.size))for(n=e.u;n;){for(;n.length>3;)n.pop()();if(n[1]<n[0])break;e.u=n=n[2]}};function Ee(e){return this.getChildContext=function(){return e.context},e.children}function Pe(e){var t=this,n=e.i;t.componentWillUnmount=function(){B(null,t.l),t.l=null,t.i=null},t.i&&t.i!==n&&t.componentWillUnmount(),e.__v?(t.l||(t.i=n,t.l={nodeType:1,parentNode:n,childNodes:[],appendChild:function(e){this.childNodes.push(e),t.i.appendChild(e)},insertBefore:function(e,n){this.childNodes.push(e),t.i.appendChild(e)},removeChild:function(e){this.childNodes.splice(this.childNodes.indexOf(e)>>>1,1),t.i.removeChild(e)}}),B(g(Ee,{context:t.context},e.__v),t.l)):t.l&&t.componentWillUnmount()}function Ie(e,t){return g(Pe,{__v:e,i:t})}(je.prototype=new j).__e=function(e){var t=this,n=Se(t.__v),r=t.o.get(e);return r[0]++,function(o){var i=function(){t.props.revealOrder?(r.push(o),we(t,e,r)):o()};n?n(i):i()}},je.prototype.render=function(e){this.u=null,this.o=new Map;var t=A(e.children);e.revealOrder&&"b"===e.revealOrder[0]&&t.reverse();for(var n=t.length;n--;)this.o.set(t[n],this.u=[1,0,this.u]);return e.children},je.prototype.componentDidUpdate=je.prototype.componentDidMount=function(){var e=this;this.o.forEach((function(t,n){we(e,n,t)}))};var De="undefined"!=typeof Symbol&&Symbol.for&&Symbol.for("react.element")||60103,ke=/^(?:accent|alignment|arabic|baseline|cap|clip(?!PathU)|color|fill|flood|font|glyph(?!R)|horiz|marker(?!H|W|U)|overline|paint|stop|strikethrough|stroke|text(?!L)|underline|unicode|units|v|vector|vert|word|writing|x(?!C))[A-Z]/,Ae=function(e){return("undefined"!=typeof Symbol&&"symbol"==n(Symbol())?/fil|che|rad/i:/fil|che|ra/i).test(e)};function Ce(e,t,n){return null==t.__k&&(t.textContent=""),B(e,t),"function"==typeof n&&n(),e?e.__c:null}j.prototype.isReactComponent={},["componentWillMount","componentWillReceiveProps","componentWillUpdate"].forEach((function(e){Object.defineProperty(j.prototype,e,{configurable:!0,get:function(){return this["UNSAFE_"+e]},set:function(t){Object.defineProperty(this,e,{configurable:!0,writable:!0,value:t})}})}));var xe=s.event;function Ne(){}function Te(){return this.cancelBubble}function Re(){return this.defaultPrevented}s.event=function(e){return xe&&(e=xe(e)),e.persist=Ne,e.isPropagationStopped=Te,e.isDefaultPrevented=Re,e.nativeEvent=e};var qe,Le={configurable:!0,get:function(){return this.class}},Me=s.vnode;s.vnode=function(e){var t=e.type,n=e.props,r=n;if("string"==typeof t){for(var o in r={},n){var i=n[o];"value"===o&&"defaultValue"in n&&null==i||("defaultValue"===o&&"value"in n&&null==n.value?o="value":"download"===o&&!0===i?i="":/ondoubleclick/i.test(o)?o="ondblclick":/^onchange(textarea|input)/i.test(o+t)&&!Ae(n.type)?o="oninput":/^on(Ani|Tra|Tou|BeforeInp)/.test(o)?o=o.toLowerCase():ke.test(o)?o=o.replace(/[A-Z0-9]/,"-$&").toLowerCase():null===i&&(i=void 0),r[o]=i)}"select"==t&&r.multiple&&Array.isArray(r.value)&&(r.value=A(n.children).forEach((function(e){e.props.selected=-1!=r.value.indexOf(e.props.value)}))),"select"==t&&null!=r.defaultValue&&(r.value=A(n.children).forEach((function(e){e.props.selected=r.multiple?-1!=r.defaultValue.indexOf(e.props.value):r.defaultValue==e.props.value}))),e.props=r}t&&n.class!=n.className&&(Le.enumerable="className"in n,null!=n.className&&(r.class=n.className),Object.defineProperty(r,"className",Le)),e.$$typeof=De,Me&&Me(e)};var He=s.__r;s.__r=function(e){He&&He(e),qe=e.__c};var Ue={ReactCurrentDispatcher:{current:{readContext:function(e){return qe.__n[e.__c].props.value}}}};"object"==("undefined"==typeof performance?"undefined":n(performance))&&"function"==typeof performance.now&&performance.now.bind(performance);function Fe(e){return!!e&&e.$$typeof===De}var Be={useState:ne,useReducer:re,useEffect:oe,useLayoutEffect:ie,useRef:function(e){return $=5,ce((function(){return{current:e}}),[])},useImperativeHandle:function(e,t,n){$=6,ie((function(){"function"==typeof e?e(t()):e&&(e.current=t())}),null==n?n:n.concat(e))},useMemo:ce,useCallback:function(e,t){return $=8,ce((function(){return e}),t)},useContext:function(e){var t=z.context[e.__c],n=te(K++,9);return n.__c=e,t?(null==n.__&&(n.__=!0,t.sub(z)),t.props.value):e.__},useDebugValue:function(e,t){s.useDebugValue&&s.useDebugValue(t?t(e):e)},version:"16.8.0",Children:_e,render:Ce,hydrate:function(e,t,n){return V(e,t),"function"==typeof n&&n(),e?e.__c:null},unmountComponentAtNode:function(e){return!!e.__k&&(B(null,e),!0)},createPortal:Ie,createElement:g,createContext:function(e,t){var n={__c:t="__cC"+v++,__:e,Consumer:function(e,t){return e.children(t)},Provider:function(e){var n,r;return this.getChildContext||(n=[],(r={})[t]=this,this.getChildContext=function(){return r},this.shouldComponentUpdate=function(e){this.props.value!==e.value&&n.some(P)},this.sub=function(e){n.push(e);var t=e.componentWillUnmount;e.componentWillUnmount=function(){n.splice(n.indexOf(e),1),t&&t.call(e)}}),e.children}};return n.Provider.__=n.Consumer.contextType=n},createFactory:function(e){return g.bind(null,e)},cloneElement:function(e){return Fe(e)?W.apply(null,arguments):e},createRef:function(){return{current:null}},Fragment:S,isValidElement:Fe,findDOMNode:function(e){return e&&(e.base||1===e.nodeType&&e)||null},Component:j,PureComponent:de,memo:function(e,t){function n(e){var n=this.props.ref,r=n==e.ref;return!r&&n&&(n.call?n(null):n.current=null),t?!t(this.props,e)||!r:ve(this.props,e)}function r(t){return this.shouldComponentUpdate=n,g(e,t)}return r.displayName="Memo("+(e.displayName||e.name)+")",r.prototype.isReactComponent=!0,r.__f=!0,r},forwardRef:function(e){function t(t,r){var o=me({},t);return delete o.ref,e(o,(r=t.ref||r)&&("object"!=n(r)||"current"in r)?r:null)}return t.$$typeof=ye,t.render=t,t.prototype.isReactComponent=t.__f=!0,t.displayName="ForwardRef("+(e.displayName||e.name)+")",t},unstable_batchedUpdates:function(e,t){return e(t)},StrictMode:S,Suspense:Oe,SuspenseList:je,lazy:function(e){var t,n,r;function o(o){if(t||(t=e()).then((function(e){n=e.default||e}),(function(e){r=e})),r)throw r;if(!n)throw t;return g(n,o)}return o.displayName="Lazy",o.__f=!0,o},__SECRET_INTERNALS_DO_NOT_USE_OR_YOU_WILL_BE_FIRED:Ue};function Ve(){return Be.createElement("svg",{width:"15",height:"15",className:"DocSearch-Control-Key-Icon"},Be.createElement("path",{d:"M4.505 4.496h2M5.505 5.496v5M8.216 4.496l.055 5.993M10 7.5c.333.333.5.667.5 1v2M12.326 4.5v5.996M8.384 4.496c1.674 0 2.116 0 2.116 1.5s-.442 1.5-2.116 1.5M3.205 9.303c-.09.448-.277 1.21-1.241 1.203C1 10.5.5 9.513.5 8V7c0-1.57.5-2.5 1.464-2.494.964.006 1.134.598 1.24 1.342M12.553 10.5h1.953",strokeWidth:"1.2",stroke:"currentColor",fill:"none",strokeLinecap:"square"}))}function We(){return Be.createElement("svg",{width:"20",height:"20",className:"DocSearch-Search-Icon",viewBox:"0 0 20 20"},Be.createElement("path",{d:"M14.386 14.386l4.0877 4.0877-4.0877-4.0877c-2.9418 2.9419-7.7115 2.9419-10.6533 0-2.9419-2.9418-2.9419-7.7115 0-10.6533 2.9418-2.9419 7.7115-2.9419 10.6533 0 2.9419 2.9418 2.9419 7.7115 0 10.6533z",stroke:"currentColor",fill:"none",fillRule:"evenodd",strokeLinecap:"round",strokeLinejoin:"round"}))}var Ke=["translations"];function ze(){return ze=Object.assign||function(e){for(var t=1;t<arguments.length;t++){var n=arguments[t];for(var r in n)Object.prototype.hasOwnProperty.call(n,r)&&(e[r]=n[r])}return e},ze.apply(this,arguments)}function Je(e,t){return function(e){if(Array.isArray(e))return e}(e)||function(e,t){var n=null==e?null:"undefined"!=typeof Symbol&&e[Symbol.iterator]||e["@@iterator"];if(null==n)return;var r,o,i=[],c=!0,a=!1;try{for(n=n.call(e);!(c=(r=n.next()).done)&&(i.push(r.value),!t||i.length!==t);c=!0);}catch(e){a=!0,o=e}finally{try{c||null==n.return||n.return()}finally{if(a)throw o}}return i}(e,t)||function(e,t){if(!e)return;if("string"==typeof e)return $e(e,t);var n=Object.prototype.toString.call(e).slice(8,-1);"Object"===n&&e.constructor&&(n=e.constructor.name);if("Map"===n||"Set"===n)return Array.from(e);if("Arguments"===n||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n))return $e(e,t)}(e,t)||function(){throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function $e(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,r=new Array(t);n<t;n++)r[n]=e[n];return r}function Qe(e,t){if(null==e)return{};var n,r,o=function(e,t){if(null==e)return{};var n,r,o={},i=Object.keys(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}var Ze="Ctrl";var Ye=Be.forwardRef((function(e,t){var n=e.translations,r=void 0===n?{}:n,o=Qe(e,Ke),i=r.buttonText,c=void 0===i?"Search":i,a=r.buttonAriaLabel,u=void 0===a?"Search":a,l=Je(ne(null),2),s=l[0],f=l[1];return oe((function(){"undefined"!=typeof navigator&&(/(Mac|iPhone|iPod|iPad)/i.test(navigator.platform)?f("⌘"):f(Ze))}),[]),Be.createElement("button",ze({type:"button",className:"DocSearch DocSearch-Button","aria-label":u},o,{ref:t}),Be.createElement("span",{className:"DocSearch-Button-Container"},Be.createElement(We,null),Be.createElement("span",{className:"DocSearch-Button-Placeholder"},c)),Be.createElement("span",{className:"DocSearch-Button-Keys"},null!==s&&Be.createElement(Be.Fragment,null,Be.createElement("kbd",{className:"DocSearch-Button-Key"},s===Ze?Be.createElement(Ve,null):s),Be.createElement("kbd",{className:"DocSearch-Button-Key"},"K"))))}));function Ge(e,t){var n=void 0;return function(){for(var r=arguments.length,o=new Array(r),i=0;i<r;i++)o[i]=arguments[i];n&&clearTimeout(n),n=setTimeout((function(){return e.apply(void 0,o)}),t)}}function Xe(e){return e.reduce((function(e,t){return e.concat(t)}),[])}var et=0;function tt(e){return 0===e.collections.length?0:e.collections.reduce((function(e,t){return e+t.items.length}),0)}function nt(e){return e!==Object(e)}function rt(e,t){if(e===t)return!0;if(nt(e)||nt(t)||"function"==typeof e||"function"==typeof t)return e===t;if(Object.keys(e).length!==Object.keys(t).length)return!1;for(var n=0,r=Object.keys(e);n<r.length;n++){var o=r[n];if(!(o in t))return!1;if(!rt(e[o],t[o]))return!1}return!0}var ot=function(){};var it=[{segment:"autocomplete-core",version:"1.9.3"}];function ct(e){var t=e.item,n=e.items;return{index:t.__autocomplete_indexName,items:[t],positions:[1+n.findIndex((function(e){return e.objectID===t.objectID}))],queryID:t.__autocomplete_queryID,algoliaSource:["autocomplete"]}}function at(e,t){return function(e){if(Array.isArray(e))return e}(e)||function(e,t){var n=null==e?null:"undefined"!=typeof Symbol&&e[Symbol.iterator]||e["@@iterator"];if(null!=n){var r,o,i,c,a=[],u=!0,l=!1;try{if(i=(n=n.call(e)).next,0===t){if(Object(n)!==n)return;u=!1}else for(;!(u=(r=i.call(n)).done)&&(a.push(r.value),a.length!==t);u=!0);}catch(e){l=!0,o=e}finally{try{if(!u&&null!=n.return&&(c=n.return(),Object(c)!==c))return}finally{if(l)throw o}}return a}}(e,t)||function(e,t){if(!e)return;if("string"==typeof e)return ut(e,t);var n=Object.prototype.toString.call(e).slice(8,-1);"Object"===n&&e.constructor&&(n=e.constructor.name);if("Map"===n||"Set"===n)return Array.from(e);if("Arguments"===n||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n))return ut(e,t)}(e,t)||function(){throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function ut(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,r=new Array(t);n<t;n++)r[n]=e[n];return r}var lt=["items"],st=["items"];function ft(e){return ft="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},ft(e)}function pt(e){return function(e){if(Array.isArray(e))return mt(e)}(e)||function(e){if("undefined"!=typeof Symbol&&null!=e[Symbol.iterator]||null!=e["@@iterator"])return Array.from(e)}(e)||function(e,t){if(!e)return;if("string"==typeof e)return mt(e,t);var n=Object.prototype.toString.call(e).slice(8,-1);"Object"===n&&e.constructor&&(n=e.constructor.name);if("Map"===n||"Set"===n)return Array.from(e);if("Arguments"===n||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n))return mt(e,t)}(e)||function(){throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function mt(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,r=new Array(t);n<t;n++)r[n]=e[n];return r}function vt(e,t){if(null==e)return{};var n,r,o=function(e,t){if(null==e)return{};var n,r,o={},i=Object.keys(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}function dt(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function ht(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?dt(Object(n),!0).forEach((function(t){yt(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):dt(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function yt(e,t,n){return(t=function(e){var t=function(e,t){if("object"!==ft(e)||null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t||"default");if("object"!==ft(r))return r;throw new TypeError("@@toPrimitive must return a primitive value.")}return("string"===t?String:Number)(e)}(e,"string");return"symbol"===ft(t)?t:String(t)}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function bt(e){for(var t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:20,n=[],r=0;r<e.objectIDs.length;r+=t)n.push(ht(ht({},e),{},{objectIDs:e.objectIDs.slice(r,r+t)}));return n}function _t(e){return e.map((function(e){var t=e.items,n=vt(e,lt);return ht(ht({},n),{},{objectIDs:(null==t?void 0:t.map((function(e){return e.objectID})))||n.objectIDs})}))}function gt(e){var t,n,r,o=(t=at((e.version||"").split(".").map(Number),2),n=t[0],r=t[1],n>=3||2===n&&r>=4||1===n&&r>=10);function i(t,n,r){if(o&&void 0!==r){var i=r[0].__autocomplete_algoliaCredentials,c={"X-Algolia-Application-Id":i.appId,"X-Algolia-API-Key":i.apiKey};e.apply(void 0,[t].concat(pt(n),[{headers:c}]))}else e.apply(void 0,[t].concat(pt(n)))}return{init:function(t,n){e("init",{appId:t,apiKey:n})},setUserToken:function(t){e("setUserToken",t)},clickedObjectIDsAfterSearch:function(){for(var e=arguments.length,t=new Array(e),n=0;n<e;n++)t[n]=arguments[n];t.length>0&&i("clickedObjectIDsAfterSearch",_t(t),t[0].items)},clickedObjectIDs:function(){for(var e=arguments.length,t=new Array(e),n=0;n<e;n++)t[n]=arguments[n];t.length>0&&i("clickedObjectIDs",_t(t),t[0].items)},clickedFilters:function(){for(var t=arguments.length,n=new Array(t),r=0;r<t;r++)n[r]=arguments[r];n.length>0&&e.apply(void 0,["clickedFilters"].concat(n))},convertedObjectIDsAfterSearch:function(){for(var e=arguments.length,t=new Array(e),n=0;n<e;n++)t[n]=arguments[n];t.length>0&&i("convertedObjectIDsAfterSearch",_t(t),t[0].items)},convertedObjectIDs:function(){for(var e=arguments.length,t=new Array(e),n=0;n<e;n++)t[n]=arguments[n];t.length>0&&i("convertedObjectIDs",_t(t),t[0].items)},convertedFilters:function(){for(var t=arguments.length,n=new Array(t),r=0;r<t;r++)n[r]=arguments[r];n.length>0&&e.apply(void 0,["convertedFilters"].concat(n))},viewedObjectIDs:function(){for(var e=arguments.length,t=new Array(e),n=0;n<e;n++)t[n]=arguments[n];t.length>0&&t.reduce((function(e,t){var n=t.items,r=vt(t,st);return[].concat(pt(e),pt(bt(ht(ht({},r),{},{objectIDs:(null==n?void 0:n.map((function(e){return e.objectID})))||r.objectIDs})).map((function(e){return{items:n,payload:e}}))))}),[]).forEach((function(e){var t=e.items;return i("viewedObjectIDs",[e.payload],t)}))},viewedFilters:function(){for(var t=arguments.length,n=new Array(t),r=0;r<t;r++)n[r]=arguments[r];n.length>0&&e.apply(void 0,["viewedFilters"].concat(n))}}}function Ot(e){var t=e.items.reduce((function(e,t){var n;return e[t.__autocomplete_indexName]=(null!==(n=e[t.__autocomplete_indexName])&&void 0!==n?n:[]).concat(t),e}),{});return Object.keys(t).map((function(e){return{index:e,items:t[e],algoliaSource:["autocomplete"]}}))}function St(e){return e.objectID&&e.__autocomplete_indexName&&e.__autocomplete_queryID}function jt(e){return jt="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},jt(e)}function wt(e){return function(e){if(Array.isArray(e))return Et(e)}(e)||function(e){if("undefined"!=typeof Symbol&&null!=e[Symbol.iterator]||null!=e["@@iterator"])return Array.from(e)}(e)||function(e,t){if(!e)return;if("string"==typeof e)return Et(e,t);var n=Object.prototype.toString.call(e).slice(8,-1);"Object"===n&&e.constructor&&(n=e.constructor.name);if("Map"===n||"Set"===n)return Array.from(e);if("Arguments"===n||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n))return Et(e,t)}(e)||function(){throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function Et(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,r=new Array(t);n<t;n++)r[n]=e[n];return r}function Pt(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function It(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?Pt(Object(n),!0).forEach((function(t){Dt(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):Pt(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function Dt(e,t,n){return(t=function(e){var t=function(e,t){if("object"!==jt(e)||null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t||"default");if("object"!==jt(r))return r;throw new TypeError("@@toPrimitive must return a primitive value.")}return("string"===t?String:Number)(e)}(e,"string");return"symbol"===jt(t)?t:String(t)}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}var kt="2.6.0",At="https://cdn.jsdelivr.net/npm/search-insights@".concat(kt,"/dist/search-insights.min.js"),Ct=Ge((function(e){var t=e.onItemsChange,n=e.items,r=e.insights,o=e.state;t({insights:r,insightsEvents:Ot({items:n}).map((function(e){return It({eventName:"Items Viewed"},e)})),state:o})}),400);function xt(e){var t=function(e){return It({onItemsChange:function(e){var t=e.insights,n=e.insightsEvents;t.viewedObjectIDs.apply(t,wt(n.map((function(e){return It(It({},e),{},{algoliaSource:[].concat(wt(e.algoliaSource||[]),["autocomplete-internal"])})}))))},onSelect:function(e){var t=e.insights,n=e.insightsEvents;t.clickedObjectIDsAfterSearch.apply(t,wt(n.map((function(e){return It(It({},e),{},{algoliaSource:[].concat(wt(e.algoliaSource||[]),["autocomplete-internal"])})}))))},onActive:ot},e)}(e),n=t.insightsClient,r=t.onItemsChange,o=t.onSelect,i=t.onActive,c=n;n||function(e){if("undefined"!=typeof window)e({window:window})}((function(e){var t=e.window,n=t.AlgoliaAnalyticsObject||"aa";"string"==typeof n&&(c=t[n]),c||(t.AlgoliaAnalyticsObject=n,t[n]||(t[n]=function(){t[n].queue||(t[n].queue=[]);for(var e=arguments.length,r=new Array(e),o=0;o<e;o++)r[o]=arguments[o];t[n].queue.push(r)}),t[n].version=kt,c=t[n],function(e){var t="[Autocomplete]: Could not load search-insights.js. Please load it manually following https://alg.li/insights-autocomplete";try{var n=e.document.createElement("script");n.async=!0,n.src=At,n.onerror=function(){console.error(t)},document.body.appendChild(n)}catch(e){console.error(t)}}(t))}));var a=gt(c),u={current:[]},l=Ge((function(e){var t=e.state;if(t.isOpen){var n=t.collections.reduce((function(e,t){return[].concat(wt(e),wt(t.items))}),[]).filter(St);rt(u.current.map((function(e){return e.objectID})),n.map((function(e){return e.objectID})))||(u.current=n,n.length>0&&Ct({onItemsChange:r,items:n,insights:a,state:t}))}}),0);return{name:"aa.algoliaInsightsPlugin",subscribe:function(e){var t=e.setContext,n=e.onSelect,r=e.onActive;c("addAlgoliaAgent","insights-plugin"),t({algoliaInsightsPlugin:{__algoliaSearchParameters:{clickAnalytics:!0},insights:a}}),n((function(e){var t=e.item,n=e.state,r=e.event;St(t)&&o({state:n,event:r,insights:a,item:t,insightsEvents:[It({eventName:"Item Selected"},ct({item:t,items:u.current}))]})})),r((function(e){var t=e.item,n=e.state,r=e.event;St(t)&&i({state:n,event:r,insights:a,item:t,insightsEvents:[It({eventName:"Item Active"},ct({item:t,items:u.current}))]})}))},onStateChange:function(e){var t=e.state;l({state:t})},__autocomplete_pluginOptions:e}}function Nt(e,t){var n=t;return{then:function(t,r){return Nt(e.then(Rt(t,n,e),Rt(r,n,e)),n)},catch:function(t){return Nt(e.catch(Rt(t,n,e)),n)},finally:function(t){return t&&n.onCancelList.push(t),Nt(e.finally(Rt(t&&function(){return n.onCancelList=[],t()},n,e)),n)},cancel:function(){n.isCanceled=!0;var e=n.onCancelList;n.onCancelList=[],e.forEach((function(e){e()}))},isCanceled:function(){return!0===n.isCanceled}}}function Tt(e){return Nt(e,{isCanceled:!1,onCancelList:[]})}function Rt(e,t,n){return e?function(n){return t.isCanceled?n:e(n)}:n}function qt(e,t,n,r){if(!n)return null;if(e<0&&(null===t||null!==r&&0===t))return n+e;var o=(null===t?-1:t)+e;return o<=-1||o>=n?null===r?null:0:o}function Lt(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function Mt(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?Lt(Object(n),!0).forEach((function(t){Ht(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):Lt(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function Ht(e,t,n){return(t=function(e){var t=function(e,t){if("object"!==Ut(e)||null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t||"default");if("object"!==Ut(r))return r;throw new TypeError("@@toPrimitive must return a primitive value.")}return("string"===t?String:Number)(e)}(e,"string");return"symbol"===Ut(t)?t:String(t)}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function Ut(e){return Ut="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},Ut(e)}function Ft(e){var t=function(e){var t=e.collections.map((function(e){return e.items.length})).reduce((function(e,t,n){var r=(e[n-1]||0)+t;return e.push(r),e}),[]).reduce((function(t,n){return n<=e.activeItemId?t+1:t}),0);return e.collections[t]}(e);if(!t)return null;var n=t.items[function(e){for(var t=e.state,n=e.collection,r=!1,o=0,i=0;!1===r;){var c=t.collections[o];if(c===n){r=!0;break}i+=c.items.length,o++}return t.activeItemId-i}({state:e,collection:t})],r=t.source;return{item:n,itemInputValue:r.getItemInputValue({item:n,state:e}),itemUrl:r.getItemUrl({item:n,state:e}),source:r}}var Bt=/((gt|sm)-|galaxy nexus)|samsung[- ]|samsungbrowser/i;function Vt(e){return Vt="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},Vt(e)}function Wt(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function Kt(e,t,n){return(t=function(e){var t=function(e,t){if("object"!==Vt(e)||null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t||"default");if("object"!==Vt(r))return r;throw new TypeError("@@toPrimitive must return a primitive value.")}return("string"===t?String:Number)(e)}(e,"string");return"symbol"===Vt(t)?t:String(t)}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function zt(e,t,n){var r,o=t.initialState;return{getState:function(){return o},dispatch:function(r,i){var c=function(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?Wt(Object(n),!0).forEach((function(t){Kt(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):Wt(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}({},o);o=e(o,{type:r,props:t,payload:i}),n({state:o,prevState:c})},pendingRequests:(r=[],{add:function(e){return r.push(e),e.finally((function(){r=r.filter((function(t){return t!==e}))}))},cancelAll:function(){r.forEach((function(e){return e.cancel()}))},isEmpty:function(){return 0===r.length}})}}function Jt(e){return Jt="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},Jt(e)}function $t(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function Qt(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?$t(Object(n),!0).forEach((function(t){Zt(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):$t(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function Zt(e,t,n){return(t=function(e){var t=function(e,t){if("object"!==Jt(e)||null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t||"default");if("object"!==Jt(r))return r;throw new TypeError("@@toPrimitive must return a primitive value.")}return("string"===t?String:Number)(e)}(e,"string");return"symbol"===Jt(t)?t:String(t)}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function Yt(e){return Yt="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},Yt(e)}function Gt(e){return function(e){if(Array.isArray(e))return Xt(e)}(e)||function(e){if("undefined"!=typeof Symbol&&null!=e[Symbol.iterator]||null!=e["@@iterator"])return Array.from(e)}(e)||function(e,t){if(!e)return;if("string"==typeof e)return Xt(e,t);var n=Object.prototype.toString.call(e).slice(8,-1);"Object"===n&&e.constructor&&(n=e.constructor.name);if("Map"===n||"Set"===n)return Array.from(e);if("Arguments"===n||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n))return Xt(e,t)}(e)||function(){throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function Xt(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,r=new Array(t);n<t;n++)r[n]=e[n];return r}function en(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function tn(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?en(Object(n),!0).forEach((function(t){nn(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):en(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function nn(e,t,n){return(t=function(e){var t=function(e,t){if("object"!==Yt(e)||null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t||"default");if("object"!==Yt(r))return r;throw new TypeError("@@toPrimitive must return a primitive value.")}return("string"===t?String:Number)(e)}(e,"string");return"symbol"===Yt(t)?t:String(t)}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function rn(e,t){var n,r="undefined"!=typeof window?window:{},o=e.plugins||[];return tn(tn({debug:!1,openOnFocus:!1,placeholder:"",autoFocus:!1,defaultActiveItemId:null,stallThreshold:300,insights:!1,environment:r,shouldPanelOpen:function(e){return tt(e.state)>0},reshape:function(e){return e.sources}},e),{},{id:null!==(n=e.id)&&void 0!==n?n:"autocomplete-".concat(et++),plugins:o,initialState:tn({activeItemId:null,query:"",completion:null,collections:[],isOpen:!1,status:"idle",context:{}},e.initialState),onStateChange:function(t){var n;null===(n=e.onStateChange)||void 0===n||n.call(e,t),o.forEach((function(e){var n;return null===(n=e.onStateChange)||void 0===n?void 0:n.call(e,t)}))},onSubmit:function(t){var n;null===(n=e.onSubmit)||void 0===n||n.call(e,t),o.forEach((function(e){var n;return null===(n=e.onSubmit)||void 0===n?void 0:n.call(e,t)}))},onReset:function(t){var n;null===(n=e.onReset)||void 0===n||n.call(e,t),o.forEach((function(e){var n;return null===(n=e.onReset)||void 0===n?void 0:n.call(e,t)}))},getSources:function(n){return Promise.all([].concat(Gt(o.map((function(e){return e.getSources}))),[e.getSources]).filter(Boolean).map((function(e){return function(e,t){var n=[];return Promise.resolve(e(t)).then((function(e){return Promise.all(e.filter((function(e){return Boolean(e)})).map((function(e){if(e.sourceId,n.includes(e.sourceId))throw new Error("[Autocomplete] The `sourceId` ".concat(JSON.stringify(e.sourceId)," is not unique."));n.push(e.sourceId);var t={getItemInputValue:function(e){return e.state.query},getItemUrl:function(){},onSelect:function(e){(0,e.setIsOpen)(!1)},onActive:ot,onResolve:ot};Object.keys(t).forEach((function(e){t[e].__default=!0}));var r=Mt(Mt({},t),e);return Promise.resolve(r)})))}))}(e,n)}))).then((function(e){return Xe(e)})).then((function(e){return e.map((function(e){return tn(tn({},e),{},{onSelect:function(n){e.onSelect(n),t.forEach((function(e){var t;return null===(t=e.onSelect)||void 0===t?void 0:t.call(e,n)}))},onActive:function(n){e.onActive(n),t.forEach((function(e){var t;return null===(t=e.onActive)||void 0===t?void 0:t.call(e,n)}))},onResolve:function(n){e.onResolve(n),t.forEach((function(e){var t;return null===(t=e.onResolve)||void 0===t?void 0:t.call(e,n)}))}})}))}))},navigator:tn({navigate:function(e){var t=e.itemUrl;r.location.assign(t)},navigateNewTab:function(e){var t=e.itemUrl,n=r.open(t,"_blank","noopener");null==n||n.focus()},navigateNewWindow:function(e){var t=e.itemUrl;r.open(t,"_blank","noopener")}},e.navigator)})}function on(e){return on="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},on(e)}function cn(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function an(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?cn(Object(n),!0).forEach((function(t){un(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):cn(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function un(e,t,n){return(t=function(e){var t=function(e,t){if("object"!==on(e)||null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t||"default");if("object"!==on(r))return r;throw new TypeError("@@toPrimitive must return a primitive value.")}return("string"===t?String:Number)(e)}(e,"string");return"symbol"===on(t)?t:String(t)}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function ln(e){return ln="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},ln(e)}function sn(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function fn(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?sn(Object(n),!0).forEach((function(t){pn(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):sn(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function pn(e,t,n){return(t=function(e){var t=function(e,t){if("object"!==ln(e)||null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t||"default");if("object"!==ln(r))return r;throw new TypeError("@@toPrimitive must return a primitive value.")}return("string"===t?String:Number)(e)}(e,"string");return"symbol"===ln(t)?t:String(t)}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function mn(e){return function(e){if(Array.isArray(e))return vn(e)}(e)||function(e){if("undefined"!=typeof Symbol&&null!=e[Symbol.iterator]||null!=e["@@iterator"])return Array.from(e)}(e)||function(e,t){if(!e)return;if("string"==typeof e)return vn(e,t);var n=Object.prototype.toString.call(e).slice(8,-1);"Object"===n&&e.constructor&&(n=e.constructor.name);if("Map"===n||"Set"===n)return Array.from(e);if("Arguments"===n||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n))return vn(e,t)}(e)||function(){throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function vn(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,r=new Array(t);n<t;n++)r[n]=e[n];return r}function dn(e){return Boolean(e.execute)}function hn(e,t,n){if(o=e,Boolean(null==o?void 0:o.execute)){var r="algolia"===e.requesterId?Object.assign.apply(Object,[{}].concat(mn(Object.keys(n.context).map((function(e){var t;return null===(t=n.context[e])||void 0===t?void 0:t.__algoliaSearchParameters}))))):{};return fn(fn({},e),{},{requests:e.queries.map((function(n){return{query:"algolia"===e.requesterId?fn(fn({},n),{},{params:fn(fn({},r),n.params)}):n,sourceId:t,transformResponse:e.transformResponse}}))})}var o;return{items:e,sourceId:t}}function yn(e){var t=e.reduce((function(e,t){if(!dn(t))return e.push(t),e;var n=t.searchClient,r=t.execute,o=t.requesterId,i=t.requests,c=e.find((function(e){return dn(t)&&dn(e)&&e.searchClient===n&&Boolean(o)&&e.requesterId===o}));if(c){var a;(a=c.items).push.apply(a,mn(i))}else{var u={execute:r,requesterId:o,items:i,searchClient:n};e.push(u)}return e}),[]).map((function(e){if(!dn(e))return Promise.resolve(e);var t=e,n=t.execute,r=t.items;return n({searchClient:t.searchClient,requests:r})}));return Promise.all(t).then((function(e){return Xe(e)}))}function bn(e,t,n){return t.map((function(t){var r,o=e.filter((function(e){return e.sourceId===t.sourceId})),i=o.map((function(e){return e.items})),c=o[0].transformResponse,a=c?c({results:r=i,hits:r.map((function(e){return e.hits})).filter(Boolean),facetHits:r.map((function(e){var t;return null===(t=e.facetHits)||void 0===t?void 0:t.map((function(e){return{label:e.value,count:e.count,_highlightResult:{label:{value:e.highlighted}}}}))})).filter(Boolean)}):i;return t.onResolve({source:t,results:i,items:a,state:n.getState()}),a.every(Boolean),'The `getItems` function from source "'.concat(t.sourceId,'" must return an array of items but returned ').concat(JSON.stringify(void 0),".\n\nDid you forget to return items?\n\nSee: https://www.algolia.com/doc/ui-libraries/autocomplete/core-concepts/sources/#param-getitems"),{source:t,items:a}}))}function _n(e){return _n="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},_n(e)}var gn=["event","nextState","props","query","refresh","store"];function On(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function Sn(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?On(Object(n),!0).forEach((function(t){jn(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):On(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function jn(e,t,n){return(t=function(e){var t=function(e,t){if("object"!==_n(e)||null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t||"default");if("object"!==_n(r))return r;throw new TypeError("@@toPrimitive must return a primitive value.")}return("string"===t?String:Number)(e)}(e,"string");return"symbol"===_n(t)?t:String(t)}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function wn(e,t){if(null==e)return{};var n,r,o=function(e,t){if(null==e)return{};var n,r,o={},i=Object.keys(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}var En,Pn,In,Dn=null,kn=(En=-1,Pn=-1,In=void 0,function(e){var t=++En;return Promise.resolve(e).then((function(e){return In&&t<Pn?In:(Pn=t,In=e,e)}))});function An(e){var t=e.event,n=e.nextState,r=void 0===n?{}:n,o=e.props,i=e.query,c=e.refresh,a=e.store,u=wn(e,gn);Dn&&o.environment.clearTimeout(Dn);var l=u.setCollections,s=u.setIsOpen,f=u.setQuery,p=u.setActiveItemId,m=u.setStatus;if(f(i),p(o.defaultActiveItemId),!i&&!1===o.openOnFocus){var v,d=a.getState().collections.map((function(e){return Sn(Sn({},e),{},{items:[]})}));m("idle"),l(d),s(null!==(v=r.isOpen)&&void 0!==v?v:o.shouldPanelOpen({state:a.getState()}));var h=Tt(kn(d).then((function(){return Promise.resolve()})));return a.pendingRequests.add(h)}m("loading"),Dn=o.environment.setTimeout((function(){m("stalled")}),o.stallThreshold);var y=Tt(kn(o.getSources(Sn({query:i,refresh:c,state:a.getState()},u)).then((function(e){return Promise.all(e.map((function(e){return Promise.resolve(e.getItems(Sn({query:i,refresh:c,state:a.getState()},u))).then((function(t){return hn(t,e.sourceId,a.getState())}))}))).then(yn).then((function(t){return bn(t,e,a)})).then((function(e){return function(e){var t=e.collections,n=e.props,r=e.state,o=t.reduce((function(e,t){return an(an({},e),{},un({},t.source.sourceId,an(an({},t.source),{},{getItems:function(){return Xe(t.items)}})))}),{}),i=n.plugins.reduce((function(e,t){return t.reshape?t.reshape(e):e}),{sourcesBySourceId:o,state:r}).sourcesBySourceId;return Xe(n.reshape({sourcesBySourceId:i,sources:Object.values(i),state:r})).filter(Boolean).map((function(e){return{source:e,items:e.getItems()}}))}({collections:e,props:o,state:a.getState()})}))})))).then((function(e){var n;m("idle"),l(e);var f=o.shouldPanelOpen({state:a.getState()});s(null!==(n=r.isOpen)&&void 0!==n?n:o.openOnFocus&&!i&&f||f);var p=Ft(a.getState());if(null!==a.getState().activeItemId&&p){var v=p.item,d=p.itemInputValue,h=p.itemUrl,y=p.source;y.onActive(Sn({event:t,item:v,itemInputValue:d,itemUrl:h,refresh:c,source:y,state:a.getState()},u))}})).finally((function(){m("idle"),Dn&&o.environment.clearTimeout(Dn)}));return a.pendingRequests.add(y)}function Cn(e){return Cn="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},Cn(e)}var xn=["event","props","refresh","store"];function Nn(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function Tn(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?Nn(Object(n),!0).forEach((function(t){Rn(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):Nn(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function Rn(e,t,n){return(t=function(e){var t=function(e,t){if("object"!==Cn(e)||null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t||"default");if("object"!==Cn(r))return r;throw new TypeError("@@toPrimitive must return a primitive value.")}return("string"===t?String:Number)(e)}(e,"string");return"symbol"===Cn(t)?t:String(t)}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function qn(e,t){if(null==e)return{};var n,r,o=function(e,t){if(null==e)return{};var n,r,o={},i=Object.keys(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}function Ln(e){return Ln="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},Ln(e)}var Mn=["props","refresh","store"],Hn=["inputElement","formElement","panelElement"],Un=["inputElement"],Fn=["inputElement","maxLength"],Bn=["sourceIndex"],Vn=["sourceIndex"],Wn=["item","source","sourceIndex"];function Kn(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function zn(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?Kn(Object(n),!0).forEach((function(t){Jn(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):Kn(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function Jn(e,t,n){return(t=function(e){var t=function(e,t){if("object"!==Ln(e)||null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t||"default");if("object"!==Ln(r))return r;throw new TypeError("@@toPrimitive must return a primitive value.")}return("string"===t?String:Number)(e)}(e,"string");return"symbol"===Ln(t)?t:String(t)}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function $n(e,t){if(null==e)return{};var n,r,o=function(e,t){if(null==e)return{};var n,r,o={},i=Object.keys(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}function Qn(e){var t=e.props,n=e.refresh,r=e.store,o=$n(e,Mn),i=function(e,t){return void 0!==t?"".concat(e,"-").concat(t):e};return{getEnvironmentProps:function(e){var n=e.inputElement,o=e.formElement,i=e.panelElement;function c(e){!r.getState().isOpen&&r.pendingRequests.isEmpty()||e.target===n||!1===[o,i].some((function(t){return n=t,r=e.target,n===r||n.contains(r);var n,r}))&&(r.dispatch("blur",null),t.debug||r.pendingRequests.cancelAll())}return zn({onTouchStart:c,onMouseDown:c,onTouchMove:function(e){!1!==r.getState().isOpen&&n===t.environment.document.activeElement&&e.target!==n&&n.blur()}},$n(e,Hn))},getRootProps:function(e){return zn({role:"combobox","aria-expanded":r.getState().isOpen,"aria-haspopup":"listbox","aria-owns":r.getState().isOpen?"".concat(t.id,"-list"):void 0,"aria-labelledby":"".concat(t.id,"-label")},e)},getFormProps:function(e){e.inputElement;return zn({action:"",noValidate:!0,role:"search",onSubmit:function(i){var c;i.preventDefault(),t.onSubmit(zn({event:i,refresh:n,state:r.getState()},o)),r.dispatch("submit",null),null===(c=e.inputElement)||void 0===c||c.blur()},onReset:function(i){var c;i.preventDefault(),t.onReset(zn({event:i,refresh:n,state:r.getState()},o)),r.dispatch("reset",null),null===(c=e.inputElement)||void 0===c||c.focus()}},$n(e,Un))},getLabelProps:function(e){var n=e||{},r=n.sourceIndex,o=$n(n,Bn);return zn({htmlFor:"".concat(i(t.id,r),"-input"),id:"".concat(i(t.id,r),"-label")},o)},getInputProps:function(e){var i;function c(e){(t.openOnFocus||Boolean(r.getState().query))&&An(zn({event:e,props:t,query:r.getState().completion||r.getState().query,refresh:n,store:r},o)),r.dispatch("focus",null)}var a=e||{},u=(a.inputElement,a.maxLength),l=void 0===u?512:u,s=$n(a,Fn),f=Ft(r.getState()),p=function(e){return Boolean(e&&e.match(Bt))}((null===(i=t.environment.navigator)||void 0===i?void 0:i.userAgent)||""),m=null!=f&&f.itemUrl&&!p?"go":"search";return zn({"aria-autocomplete":"both","aria-activedescendant":r.getState().isOpen&&null!==r.getState().activeItemId?"".concat(t.id,"-item-").concat(r.getState().activeItemId):void 0,"aria-controls":r.getState().isOpen?"".concat(t.id,"-list"):void 0,"aria-labelledby":"".concat(t.id,"-label"),value:r.getState().completion||r.getState().query,id:"".concat(t.id,"-input"),autoComplete:"off",autoCorrect:"off",autoCapitalize:"off",enterKeyHint:m,spellCheck:"false",autoFocus:t.autoFocus,placeholder:t.placeholder,maxLength:l,type:"search",onChange:function(e){An(zn({event:e,props:t,query:e.currentTarget.value.slice(0,l),refresh:n,store:r},o))},onKeyDown:function(e){!function(e){var t=e.event,n=e.props,r=e.refresh,o=e.store,i=qn(e,xn);if("ArrowUp"===t.key||"ArrowDown"===t.key){var c=function(){var e=n.environment.document.getElementById("".concat(n.id,"-item-").concat(o.getState().activeItemId));e&&(e.scrollIntoViewIfNeeded?e.scrollIntoViewIfNeeded(!1):e.scrollIntoView(!1))},a=function(){var e=Ft(o.getState());if(null!==o.getState().activeItemId&&e){var n=e.item,c=e.itemInputValue,a=e.itemUrl,u=e.source;u.onActive(Tn({event:t,item:n,itemInputValue:c,itemUrl:a,refresh:r,source:u,state:o.getState()},i))}};t.preventDefault(),!1===o.getState().isOpen&&(n.openOnFocus||Boolean(o.getState().query))?An(Tn({event:t,props:n,query:o.getState().query,refresh:r,store:o},i)).then((function(){o.dispatch(t.key,{nextActiveItemId:n.defaultActiveItemId}),a(),setTimeout(c,0)})):(o.dispatch(t.key,{}),a(),c())}else if("Escape"===t.key)t.preventDefault(),o.dispatch(t.key,null),o.pendingRequests.cancelAll();else if("Tab"===t.key)o.dispatch("blur",null),o.pendingRequests.cancelAll();else if("Enter"===t.key){if(null===o.getState().activeItemId||o.getState().collections.every((function(e){return 0===e.items.length})))return void(n.debug||o.pendingRequests.cancelAll());t.preventDefault();var u=Ft(o.getState()),l=u.item,s=u.itemInputValue,f=u.itemUrl,p=u.source;if(t.metaKey||t.ctrlKey)void 0!==f&&(p.onSelect(Tn({event:t,item:l,itemInputValue:s,itemUrl:f,refresh:r,source:p,state:o.getState()},i)),n.navigator.navigateNewTab({itemUrl:f,item:l,state:o.getState()}));else if(t.shiftKey)void 0!==f&&(p.onSelect(Tn({event:t,item:l,itemInputValue:s,itemUrl:f,refresh:r,source:p,state:o.getState()},i)),n.navigator.navigateNewWindow({itemUrl:f,item:l,state:o.getState()}));else if(t.altKey);else{if(void 0!==f)return p.onSelect(Tn({event:t,item:l,itemInputValue:s,itemUrl:f,refresh:r,source:p,state:o.getState()},i)),void n.navigator.navigate({itemUrl:f,item:l,state:o.getState()});An(Tn({event:t,nextState:{isOpen:!1},props:n,query:s,refresh:r,store:o},i)).then((function(){p.onSelect(Tn({event:t,item:l,itemInputValue:s,itemUrl:f,refresh:r,source:p,state:o.getState()},i))}))}}}(zn({event:e,props:t,refresh:n,store:r},o))},onFocus:c,onBlur:ot,onClick:function(n){e.inputElement!==t.environment.document.activeElement||r.getState().isOpen||c(n)}},s)},getPanelProps:function(e){return zn({onMouseDown:function(e){e.preventDefault()},onMouseLeave:function(){r.dispatch("mouseleave",null)}},e)},getListProps:function(e){var n=e||{},r=n.sourceIndex,o=$n(n,Vn);return zn({role:"listbox","aria-labelledby":"".concat(i(t.id,r),"-label"),id:"".concat(i(t.id,r),"-list")},o)},getItemProps:function(e){var c=e.item,a=e.source,u=e.sourceIndex,l=$n(e,Wn);return zn({id:"".concat(i(t.id,u),"-item-").concat(c.__autocomplete_id),role:"option","aria-selected":r.getState().activeItemId===c.__autocomplete_id,onMouseMove:function(e){if(c.__autocomplete_id!==r.getState().activeItemId){r.dispatch("mousemove",c.__autocomplete_id);var t=Ft(r.getState());if(null!==r.getState().activeItemId&&t){var i=t.item,a=t.itemInputValue,u=t.itemUrl,l=t.source;l.onActive(zn({event:e,item:i,itemInputValue:a,itemUrl:u,refresh:n,source:l,state:r.getState()},o))}}},onMouseDown:function(e){e.preventDefault()},onClick:function(e){var i=a.getItemInputValue({item:c,state:r.getState()}),u=a.getItemUrl({item:c,state:r.getState()});(u?Promise.resolve():An(zn({event:e,nextState:{isOpen:!1},props:t,query:i,refresh:n,store:r},o))).then((function(){a.onSelect(zn({event:e,item:c,itemInputValue:i,itemUrl:u,refresh:n,source:a,state:r.getState()},o))}))}},l)}}}function Zn(e){return Zn="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},Zn(e)}function Yn(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function Gn(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?Yn(Object(n),!0).forEach((function(t){Xn(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):Yn(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function Xn(e,t,n){return(t=function(e){var t=function(e,t){if("object"!==Zn(e)||null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t||"default");if("object"!==Zn(r))return r;throw new TypeError("@@toPrimitive must return a primitive value.")}return("string"===t?String:Number)(e)}(e,"string");return"symbol"===Zn(t)?t:String(t)}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function er(e){var t,n,r,o,i=e.plugins,c=e.options,a=null===(t=((null===(n=c.__autocomplete_metadata)||void 0===n?void 0:n.userAgents)||[])[0])||void 0===t?void 0:t.segment,u=a?Xn({},a,Object.keys((null===(r=c.__autocomplete_metadata)||void 0===r?void 0:r.options)||{})):{};return{plugins:i.map((function(e){return{name:e.name,options:Object.keys(e.__autocomplete_pluginOptions||[])}})),options:Gn({"autocomplete-core":Object.keys(c)},u),ua:it.concat((null===(o=c.__autocomplete_metadata)||void 0===o?void 0:o.userAgents)||[])}}function tr(e){var t,n=e.state;return!1===n.isOpen||null===n.activeItemId?null:(null===(t=Ft(n))||void 0===t?void 0:t.itemInputValue)||null}function nr(e){return nr="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},nr(e)}function rr(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function or(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?rr(Object(n),!0).forEach((function(t){ir(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):rr(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function ir(e,t,n){return(t=function(e){var t=function(e,t){if("object"!==nr(e)||null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t||"default");if("object"!==nr(r))return r;throw new TypeError("@@toPrimitive must return a primitive value.")}return("string"===t?String:Number)(e)}(e,"string");return"symbol"===nr(t)?t:String(t)}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}var cr=function(e,t){switch(t.type){case"setActiveItemId":case"mousemove":return or(or({},e),{},{activeItemId:t.payload});case"setQuery":return or(or({},e),{},{query:t.payload,completion:null});case"setCollections":return or(or({},e),{},{collections:t.payload});case"setIsOpen":return or(or({},e),{},{isOpen:t.payload});case"setStatus":return or(or({},e),{},{status:t.payload});case"setContext":return or(or({},e),{},{context:or(or({},e.context),t.payload)});case"ArrowDown":var n=or(or({},e),{},{activeItemId:t.payload.hasOwnProperty("nextActiveItemId")?t.payload.nextActiveItemId:qt(1,e.activeItemId,tt(e),t.props.defaultActiveItemId)});return or(or({},n),{},{completion:tr({state:n})});case"ArrowUp":var r=or(or({},e),{},{activeItemId:qt(-1,e.activeItemId,tt(e),t.props.defaultActiveItemId)});return or(or({},r),{},{completion:tr({state:r})});case"Escape":return e.isOpen?or(or({},e),{},{activeItemId:null,isOpen:!1,completion:null}):or(or({},e),{},{activeItemId:null,query:"",status:"idle",collections:[]});case"submit":return or(or({},e),{},{activeItemId:null,isOpen:!1,status:"idle"});case"reset":return or(or({},e),{},{activeItemId:!0===t.props.openOnFocus?t.props.defaultActiveItemId:null,status:"idle",query:""});case"focus":return or(or({},e),{},{activeItemId:t.props.defaultActiveItemId,isOpen:(t.props.openOnFocus||Boolean(e.query))&&t.props.shouldPanelOpen({state:e})});case"blur":return t.props.debug?e:or(or({},e),{},{isOpen:!1,activeItemId:null});case"mouseleave":return or(or({},e),{},{activeItemId:t.props.defaultActiveItemId});default:return"The reducer action ".concat(JSON.stringify(t.type)," is not supported."),e}};function ar(e){return ar="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},ar(e)}function ur(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function lr(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?ur(Object(n),!0).forEach((function(t){sr(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):ur(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function sr(e,t,n){return(t=function(e){var t=function(e,t){if("object"!==ar(e)||null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t||"default");if("object"!==ar(r))return r;throw new TypeError("@@toPrimitive must return a primitive value.")}return("string"===t?String:Number)(e)}(e,"string");return"symbol"===ar(t)?t:String(t)}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function fr(e){var t=[],n=rn(e,t),r=zt(cr,n,(function(e){var t=e.prevState,r=e.state;n.onStateChange(lr({prevState:t,state:r,refresh:c,navigator:n.navigator},o))})),o=function(e){var t=e.store;return{setActiveItemId:function(e){t.dispatch("setActiveItemId",e)},setQuery:function(e){t.dispatch("setQuery",e)},setCollections:function(e){var n=0,r=e.map((function(e){return Qt(Qt({},e),{},{items:Xe(e.items).map((function(e){return Qt(Qt({},e),{},{__autocomplete_id:n++})}))})}));t.dispatch("setCollections",r)},setIsOpen:function(e){t.dispatch("setIsOpen",e)},setStatus:function(e){t.dispatch("setStatus",e)},setContext:function(e){t.dispatch("setContext",e)}}}({store:r}),i=Qn(lr({props:n,refresh:c,store:r,navigator:n.navigator},o));function c(){return An(lr({event:new Event("input"),nextState:{isOpen:r.getState().isOpen},props:n,navigator:n.navigator,query:r.getState().query,refresh:c,store:r},o))}if(e.insights&&!n.plugins.some((function(e){return"aa.algoliaInsightsPlugin"===e.name}))){var a="boolean"==typeof e.insights?{}:e.insights;n.plugins.push(xt(a))}return n.plugins.forEach((function(e){var r;return null===(r=e.subscribe)||void 0===r?void 0:r.call(e,lr(lr({},o),{},{navigator:n.navigator,refresh:c,onSelect:function(e){t.push({onSelect:e})},onActive:function(e){t.push({onActive:e})},onResolve:function(e){t.push({onResolve:e})}}))})),function(e){var t,n,r=e.metadata,o=e.environment;if(null===(t=o.navigator)||void 0===t||null===(n=t.userAgent)||void 0===n?void 0:n.includes("Algolia Crawler")){var i=o.document.createElement("meta"),c=o.document.querySelector("head");i.name="algolia:metadata",setTimeout((function(){i.content=JSON.stringify(r),c.appendChild(i)}),0)}}({metadata:er({plugins:n.plugins,options:e}),environment:n.environment}),lr(lr({refresh:c,navigator:n.navigator},i),o)}function pr(e){var t=e.translations,n=(void 0===t?{}:t).searchByText,r=void 0===n?"Search by":n;return Be.createElement("a",{href:"https://www.algolia.com/ref/docsearch/?utm_source=".concat(window.location.hostname,"&utm_medium=referral&utm_content=powered_by&utm_campaign=docsearch"),target:"_blank",rel:"noopener noreferrer"},Be.createElement("span",{className:"DocSearch-Label"},r),Be.createElement("svg",{width:"77",height:"19","aria-label":"Algolia",role:"img",id:"Layer_1",xmlns:"http://www.w3.org/2000/svg",viewBox:"0 0 2196.2 500"},Be.createElement("defs",null,Be.createElement("style",null,".cls-1,.cls-2{fill:#003dff;}.cls-2{fill-rule:evenodd;}")),Be.createElement("path",{className:"cls-2",d:"M1070.38,275.3V5.91c0-3.63-3.24-6.39-6.82-5.83l-50.46,7.94c-2.87,.45-4.99,2.93-4.99,5.84l.17,273.22c0,12.92,0,92.7,95.97,95.49,3.33,.1,6.09-2.58,6.09-5.91v-40.78c0-2.96-2.19-5.51-5.12-5.84-34.85-4.01-34.85-47.57-34.85-54.72Z"}),Be.createElement("rect",{className:"cls-1",x:"1845.88",y:"104.73",width:"62.58",height:"277.9",rx:"5.9",ry:"5.9"}),Be.createElement("path",{className:"cls-2",d:"M1851.78,71.38h50.77c3.26,0,5.9-2.64,5.9-5.9V5.9c0-3.62-3.24-6.39-6.82-5.83l-50.77,7.95c-2.87,.45-4.99,2.92-4.99,5.83v51.62c0,3.26,2.64,5.9,5.9,5.9Z"}),Be.createElement("path",{className:"cls-2",d:"M1764.03,275.3V5.91c0-3.63-3.24-6.39-6.82-5.83l-50.46,7.94c-2.87,.45-4.99,2.93-4.99,5.84l.17,273.22c0,12.92,0,92.7,95.97,95.49,3.33,.1,6.09-2.58,6.09-5.91v-40.78c0-2.96-2.19-5.51-5.12-5.84-34.85-4.01-34.85-47.57-34.85-54.72Z"}),Be.createElement("path",{className:"cls-2",d:"M1631.95,142.72c-11.14-12.25-24.83-21.65-40.78-28.31-15.92-6.53-33.26-9.85-52.07-9.85-18.78,0-36.15,3.17-51.92,9.85-15.59,6.66-29.29,16.05-40.76,28.31-11.47,12.23-20.38,26.87-26.76,44.03-6.38,17.17-9.24,37.37-9.24,58.36,0,20.99,3.19,36.87,9.55,54.21,6.38,17.32,15.14,32.11,26.45,44.36,11.29,12.23,24.83,21.62,40.6,28.46,15.77,6.83,40.12,10.33,52.4,10.48,12.25,0,36.78-3.82,52.7-10.48,15.92-6.68,29.46-16.23,40.78-28.46,11.29-12.25,20.05-27.04,26.25-44.36,6.22-17.34,9.24-33.22,9.24-54.21,0-20.99-3.34-41.19-10.03-58.36-6.38-17.17-15.14-31.8-26.43-44.03Zm-44.43,163.75c-11.47,15.75-27.56,23.7-48.09,23.7-20.55,0-36.63-7.8-48.1-23.7-11.47-15.75-17.21-34.01-17.21-61.2,0-26.89,5.59-49.14,17.06-64.87,11.45-15.75,27.54-23.52,48.07-23.52,20.55,0,36.63,7.78,48.09,23.52,11.47,15.57,17.36,37.98,17.36,64.87,0,27.19-5.72,45.3-17.19,61.2Z"}),Be.createElement("path",{className:"cls-2",d:"M894.42,104.73h-49.33c-48.36,0-90.91,25.48-115.75,64.1-14.52,22.58-22.99,49.63-22.99,78.73,0,44.89,20.13,84.92,51.59,111.1,2.93,2.6,6.05,4.98,9.31,7.14,12.86,8.49,28.11,13.47,44.52,13.47,1.23,0,2.46-.03,3.68-.09,.36-.02,.71-.05,1.07-.07,.87-.05,1.75-.11,2.62-.2,.34-.03,.68-.08,1.02-.12,.91-.1,1.82-.21,2.73-.34,.21-.03,.42-.07,.63-.1,32.89-5.07,61.56-30.82,70.9-62.81v57.83c0,3.26,2.64,5.9,5.9,5.9h50.42c3.26,0,5.9-2.64,5.9-5.9V110.63c0-3.26-2.64-5.9-5.9-5.9h-56.32Zm0,206.92c-12.2,10.16-27.97,13.98-44.84,15.12-.16,.01-.33,.03-.49,.04-1.12,.07-2.24,.1-3.36,.1-42.24,0-77.12-35.89-77.12-79.37,0-10.25,1.96-20.01,5.42-28.98,11.22-29.12,38.77-49.74,71.06-49.74h49.33v142.83Z"}),Be.createElement("path",{className:"cls-2",d:"M2133.97,104.73h-49.33c-48.36,0-90.91,25.48-115.75,64.1-14.52,22.58-22.99,49.63-22.99,78.73,0,44.89,20.13,84.92,51.59,111.1,2.93,2.6,6.05,4.98,9.31,7.14,12.86,8.49,28.11,13.47,44.52,13.47,1.23,0,2.46-.03,3.68-.09,.36-.02,.71-.05,1.07-.07,.87-.05,1.75-.11,2.62-.2,.34-.03,.68-.08,1.02-.12,.91-.1,1.82-.21,2.73-.34,.21-.03,.42-.07,.63-.1,32.89-5.07,61.56-30.82,70.9-62.81v57.83c0,3.26,2.64,5.9,5.9,5.9h50.42c3.26,0,5.9-2.64,5.9-5.9V110.63c0-3.26-2.64-5.9-5.9-5.9h-56.32Zm0,206.92c-12.2,10.16-27.97,13.98-44.84,15.12-.16,.01-.33,.03-.49,.04-1.12,.07-2.24,.1-3.36,.1-42.24,0-77.12-35.89-77.12-79.37,0-10.25,1.96-20.01,5.42-28.98,11.22-29.12,38.77-49.74,71.06-49.74h49.33v142.83Z"}),Be.createElement("path",{className:"cls-2",d:"M1314.05,104.73h-49.33c-48.36,0-90.91,25.48-115.75,64.1-11.79,18.34-19.6,39.64-22.11,62.59-.58,5.3-.88,10.68-.88,16.14s.31,11.15,.93,16.59c4.28,38.09,23.14,71.61,50.66,94.52,2.93,2.6,6.05,4.98,9.31,7.14,12.86,8.49,28.11,13.47,44.52,13.47h0c17.99,0,34.61-5.93,48.16-15.97,16.29-11.58,28.88-28.54,34.48-47.75v50.26h-.11v11.08c0,21.84-5.71,38.27-17.34,49.36-11.61,11.08-31.04,16.63-58.25,16.63-11.12,0-28.79-.59-46.6-2.41-2.83-.29-5.46,1.5-6.27,4.22l-12.78,43.11c-1.02,3.46,1.27,7.02,4.83,7.53,21.52,3.08,42.52,4.68,54.65,4.68,48.91,0,85.16-10.75,108.89-32.21,21.48-19.41,33.15-48.89,35.2-88.52V110.63c0-3.26-2.64-5.9-5.9-5.9h-56.32Zm0,64.1s.65,139.13,0,143.36c-12.08,9.77-27.11,13.59-43.49,14.7-.16,.01-.33,.03-.49,.04-1.12,.07-2.24,.1-3.36,.1-1.32,0-2.63-.03-3.94-.1-40.41-2.11-74.52-37.26-74.52-79.38,0-10.25,1.96-20.01,5.42-28.98,11.22-29.12,38.77-49.74,71.06-49.74h49.33Z"}),Be.createElement("path",{className:"cls-1",d:"M249.83,0C113.3,0,2,110.09,.03,246.16c-2,138.19,110.12,252.7,248.33,253.5,42.68,.25,83.79-10.19,120.3-30.03,3.56-1.93,4.11-6.83,1.08-9.51l-23.38-20.72c-4.75-4.21-11.51-5.4-17.36-2.92-25.48,10.84-53.17,16.38-81.71,16.03-111.68-1.37-201.91-94.29-200.13-205.96,1.76-110.26,92-199.41,202.67-199.41h202.69V407.41l-115-102.18c-3.72-3.31-9.42-2.66-12.42,1.31-18.46,24.44-48.53,39.64-81.93,37.34-46.33-3.2-83.87-40.5-87.34-86.81-4.15-55.24,39.63-101.52,94-101.52,49.18,0,89.68,37.85,93.91,85.95,.38,4.28,2.31,8.27,5.52,11.12l29.95,26.55c3.4,3.01,8.79,1.17,9.63-3.3,2.16-11.55,2.92-23.58,2.07-35.92-4.82-70.34-61.8-126.93-132.17-131.26-80.68-4.97-148.13,58.14-150.27,137.25-2.09,77.1,61.08,143.56,138.19,145.26,32.19,.71,62.03-9.41,86.14-26.95l150.26,133.2c6.44,5.71,16.61,1.14,16.61-7.47V9.48C499.66,4.25,495.42,0,490.18,0H249.83Z"})))}function mr(e){return Be.createElement("svg",{width:"15",height:"15","aria-label":e.ariaLabel,role:"img"},Be.createElement("g",{fill:"none",stroke:"currentColor",strokeLinecap:"round",strokeLinejoin:"round",strokeWidth:"1.2"},e.children))}function vr(e){var t=e.translations,n=void 0===t?{}:t,r=n.selectText,o=void 0===r?"to select":r,i=n.selectKeyAriaLabel,c=void 0===i?"Enter key":i,a=n.navigateText,u=void 0===a?"to navigate":a,l=n.navigateUpKeyAriaLabel,s=void 0===l?"Arrow up":l,f=n.navigateDownKeyAriaLabel,p=void 0===f?"Arrow down":f,m=n.closeText,v=void 0===m?"to close":m,d=n.closeKeyAriaLabel,h=void 0===d?"Escape key":d,y=n.searchByText,b=void 0===y?"Search by":y;return Be.createElement(Be.Fragment,null,Be.createElement("div",{className:"DocSearch-Logo"},Be.createElement(pr,{translations:{searchByText:b}})),Be.createElement("ul",{className:"DocSearch-Commands"},Be.createElement("li",null,Be.createElement("kbd",{className:"DocSearch-Commands-Key"},Be.createElement(mr,{ariaLabel:c},Be.createElement("path",{d:"M12 3.53088v3c0 1-1 2-2 2H4M7 11.53088l-3-3 3-3"}))),Be.createElement("span",{className:"DocSearch-Label"},o)),Be.createElement("li",null,Be.createElement("kbd",{className:"DocSearch-Commands-Key"},Be.createElement(mr,{ariaLabel:p},Be.createElement("path",{d:"M7.5 3.5v8M10.5 8.5l-3 3-3-3"}))),Be.createElement("kbd",{className:"DocSearch-Commands-Key"},Be.createElement(mr,{ariaLabel:s},Be.createElement("path",{d:"M7.5 11.5v-8M10.5 6.5l-3-3-3 3"}))),Be.createElement("span",{className:"DocSearch-Label"},u)),Be.createElement("li",null,Be.createElement("kbd",{className:"DocSearch-Commands-Key"},Be.createElement(mr,{ariaLabel:h},Be.createElement("path",{d:"M13.6167 8.936c-.1065.3583-.6883.962-1.4875.962-.7993 0-1.653-.9165-1.653-2.1258v-.5678c0-1.2548.7896-2.1016 1.653-2.1016.8634 0 1.3601.4778 1.4875 1.0724M9 6c-.1352-.4735-.7506-.9219-1.46-.8972-.7092.0246-1.344.57-1.344 1.2166s.4198.8812 1.3445.9805C8.465 7.3992 8.968 7.9337 9 8.5c.032.5663-.454 1.398-1.4595 1.398C6.6593 9.898 6 9 5.963 8.4851m-1.4748.5368c-.2635.5941-.8099.876-1.5443.876s-1.7073-.6248-1.7073-2.204v-.4603c0-1.0416.721-2.131 1.7073-2.131.9864 0 1.6425 1.031 1.5443 2.2492h-2.956"}))),Be.createElement("span",{className:"DocSearch-Label"},v))))}function dr(e){var t=e.hit,n=e.children;return Be.createElement("a",{href:t.url},n)}function hr(){return Be.createElement("svg",{viewBox:"0 0 38 38",stroke:"currentColor",strokeOpacity:".5"},Be.createElement("g",{fill:"none",fillRule:"evenodd"},Be.createElement("g",{transform:"translate(1 1)",strokeWidth:"2"},Be.createElement("circle",{strokeOpacity:".3",cx:"18",cy:"18",r:"18"}),Be.createElement("path",{d:"M36 18c0-9.94-8.06-18-18-18"},Be.createElement("animateTransform",{attributeName:"transform",type:"rotate",from:"0 18 18",to:"360 18 18",dur:"1s",repeatCount:"indefinite"})))))}function yr(){return Be.createElement("svg",{width:"20",height:"20",viewBox:"0 0 20 20"},Be.createElement("g",{stroke:"currentColor",fill:"none",fillRule:"evenodd",strokeLinecap:"round",strokeLinejoin:"round"},Be.createElement("path",{d:"M3.18 6.6a8.23 8.23 0 1112.93 9.94h0a8.23 8.23 0 01-11.63 0"}),Be.createElement("path",{d:"M6.44 7.25H2.55V3.36M10.45 6v5.6M10.45 11.6L13 13"})))}function br(){return Be.createElement("svg",{width:"20",height:"20",viewBox:"0 0 20 20"},Be.createElement("path",{d:"M10 10l5.09-5.09L10 10l5.09 5.09L10 10zm0 0L4.91 4.91 10 10l-5.09 5.09L10 10z",stroke:"currentColor",fill:"none",fillRule:"evenodd",strokeLinecap:"round",strokeLinejoin:"round"}))}function _r(){return Be.createElement("svg",{className:"DocSearch-Hit-Select-Icon",width:"20",height:"20",viewBox:"0 0 20 20"},Be.createElement("g",{stroke:"currentColor",fill:"none",fillRule:"evenodd",strokeLinecap:"round",strokeLinejoin:"round"},Be.createElement("path",{d:"M18 3v4c0 2-2 4-4 4H2"}),Be.createElement("path",{d:"M8 17l-6-6 6-6"})))}var gr=function(){return Be.createElement("svg",{width:"20",height:"20",viewBox:"0 0 20 20"},Be.createElement("path",{d:"M17 6v12c0 .52-.2 1-1 1H4c-.7 0-1-.33-1-1V2c0-.55.42-1 1-1h8l5 5zM14 8h-3.13c-.51 0-.87-.34-.87-.87V4",stroke:"currentColor",fill:"none",fillRule:"evenodd",strokeLinejoin:"round"}))};function Or(e){switch(e.type){case"lvl1":return Be.createElement(gr,null);case"content":return Be.createElement(jr,null);default:return Be.createElement(Sr,null)}}function Sr(){return Be.createElement("svg",{width:"20",height:"20",viewBox:"0 0 20 20"},Be.createElement("path",{d:"M13 13h4-4V8H7v5h6v4-4H7V8H3h4V3v5h6V3v5h4-4v5zm-6 0v4-4H3h4z",stroke:"currentColor",fill:"none",fillRule:"evenodd",strokeLinecap:"round",strokeLinejoin:"round"}))}function jr(){return Be.createElement("svg",{width:"20",height:"20",viewBox:"0 0 20 20"},Be.createElement("path",{d:"M17 5H3h14zm0 5H3h14zm0 5H3h14z",stroke:"currentColor",fill:"none",fillRule:"evenodd",strokeLinejoin:"round"}))}function wr(){return Be.createElement("svg",{width:"20",height:"20",viewBox:"0 0 20 20"},Be.createElement("path",{d:"M10 14.2L5 17l1-5.6-4-4 5.5-.7 2.5-5 2.5 5 5.6.8-4 4 .9 5.5z",stroke:"currentColor",fill:"none",fillRule:"evenodd",strokeLinejoin:"round"}))}function Er(){return Be.createElement("svg",{width:"40",height:"40",viewBox:"0 0 20 20",fill:"none",fillRule:"evenodd",stroke:"currentColor",strokeLinecap:"round",strokeLinejoin:"round"},Be.createElement("path",{d:"M19 4.8a16 16 0 00-2-1.2m-3.3-1.2A16 16 0 001.1 4.7M16.7 8a12 12 0 00-2.8-1.4M10 6a12 12 0 00-6.7 2M12.3 14.7a4 4 0 00-4.5 0M14.5 11.4A8 8 0 0010 10M3 16L18 2M10 18h0"}))}function Pr(){return Be.createElement("svg",{width:"40",height:"40",viewBox:"0 0 20 20",fill:"none",fillRule:"evenodd",stroke:"currentColor",strokeLinecap:"round",strokeLinejoin:"round"},Be.createElement("path",{d:"M15.5 4.8c2 3 1.7 7-1 9.7h0l4.3 4.3-4.3-4.3a7.8 7.8 0 01-9.8 1m-2.2-2.2A7.8 7.8 0 0113.2 2.4M2 18L18 2"}))}function Ir(e){var t=e.translations,n=void 0===t?{}:t,r=n.titleText,o=void 0===r?"Unable to fetch results":r,i=n.helpText,c=void 0===i?"You might want to check your network connection.":i;return Be.createElement("div",{className:"DocSearch-ErrorScreen"},Be.createElement("div",{className:"DocSearch-Screen-Icon"},Be.createElement(Er,null)),Be.createElement("p",{className:"DocSearch-Title"},o),Be.createElement("p",{className:"DocSearch-Help"},c))}var Dr=["translations"];function kr(e){return function(e){if(Array.isArray(e))return Ar(e)}(e)||function(e){if("undefined"!=typeof Symbol&&null!=e[Symbol.iterator]||null!=e["@@iterator"])return Array.from(e)}(e)||function(e,t){if(!e)return;if("string"==typeof e)return Ar(e,t);var n=Object.prototype.toString.call(e).slice(8,-1);"Object"===n&&e.constructor&&(n=e.constructor.name);if("Map"===n||"Set"===n)return Array.from(e);if("Arguments"===n||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n))return Ar(e,t)}(e)||function(){throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function Ar(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,r=new Array(t);n<t;n++)r[n]=e[n];return r}function Cr(e,t){if(null==e)return{};var n,r,o=function(e,t){if(null==e)return{};var n,r,o={},i=Object.keys(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}function xr(e){var t=e.translations,n=void 0===t?{}:t,r=Cr(e,Dr),o=n.noResultsText,i=void 0===o?"No results for":o,c=n.suggestedQueryText,a=void 0===c?"Try searching for":c,u=n.reportMissingResultsText,l=void 0===u?"Believe this query should return results?":u,s=n.reportMissingResultsLinkText,f=void 0===s?"Let us know.":s,p=r.state.context.searchSuggestions;return Be.createElement("div",{className:"DocSearch-NoResults"},Be.createElement("div",{className:"DocSearch-Screen-Icon"},Be.createElement(Pr,null)),Be.createElement("p",{className:"DocSearch-Title"},i,' "',Be.createElement("strong",null,r.state.query),'"'),p&&p.length>0&&Be.createElement("div",{className:"DocSearch-NoResults-Prefill-List"},Be.createElement("p",{className:"DocSearch-Help"},a,":"),Be.createElement("ul",null,p.slice(0,3).reduce((function(e,t){return[].concat(kr(e),[Be.createElement("li",{key:t},Be.createElement("button",{className:"DocSearch-Prefill",key:t,type:"button",onClick:function(){r.setQuery(t.toLowerCase()+" "),r.refresh(),r.inputRef.current.focus()}},t))])}),[]))),r.getMissingResultsUrl&&Be.createElement("p",{className:"DocSearch-Help"},"".concat(l," "),Be.createElement("a",{href:r.getMissingResultsUrl({query:r.state.query}),target:"_blank",rel:"noopener noreferrer"},f)))}var Nr=["hit","attribute","tagName"];function Tr(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function Rr(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?Tr(Object(n),!0).forEach((function(t){qr(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):Tr(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function qr(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function Lr(e,t){if(null==e)return{};var n,r,o=function(e,t){if(null==e)return{};var n,r,o={},i=Object.keys(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}function Mr(e,t){return t.split(".").reduce((function(e,t){return null!=e&&e[t]?e[t]:null}),e)}function Hr(e){var t=e.hit,n=e.attribute,r=e.tagName;return g(void 0===r?"span":r,Rr(Rr({},Lr(e,Nr)),{},{dangerouslySetInnerHTML:{__html:Mr(t,"_snippetResult.".concat(n,".value"))||Mr(t,n)}}))}function Ur(e,t){return function(e){if(Array.isArray(e))return e}(e)||function(e,t){var n=null==e?null:"undefined"!=typeof Symbol&&e[Symbol.iterator]||e["@@iterator"];if(null==n)return;var r,o,i=[],c=!0,a=!1;try{for(n=n.call(e);!(c=(r=n.next()).done)&&(i.push(r.value),!t||i.length!==t);c=!0);}catch(e){a=!0,o=e}finally{try{c||null==n.return||n.return()}finally{if(a)throw o}}return i}(e,t)||function(e,t){if(!e)return;if("string"==typeof e)return Fr(e,t);var n=Object.prototype.toString.call(e).slice(8,-1);"Object"===n&&e.constructor&&(n=e.constructor.name);if("Map"===n||"Set"===n)return Array.from(e);if("Arguments"===n||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n))return Fr(e,t)}(e,t)||function(){throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function Fr(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,r=new Array(t);n<t;n++)r[n]=e[n];return r}function Br(){return Br=Object.assign||function(e){for(var t=1;t<arguments.length;t++){var n=arguments[t];for(var r in n)Object.prototype.hasOwnProperty.call(n,r)&&(e[r]=n[r])}return e},Br.apply(this,arguments)}function Vr(e){return e.collection&&0!==e.collection.items.length?Be.createElement("section",{className:"DocSearch-Hits"},Be.createElement("div",{className:"DocSearch-Hit-source"},e.title),Be.createElement("ul",e.getListProps(),e.collection.items.map((function(t,n){return Be.createElement(Wr,Br({key:[e.title,t.objectID].join(":"),item:t,index:n},e))})))):null}function Wr(e){var t=e.item,n=e.index,r=e.renderIcon,o=e.renderAction,i=e.getItemProps,c=e.onItemClick,a=e.collection,u=e.hitComponent,l=Ur(Be.useState(!1),2),s=l[0],f=l[1],p=Ur(Be.useState(!1),2),m=p[0],v=p[1],d=Be.useRef(null),h=u;return Be.createElement("li",Br({className:["DocSearch-Hit",t.__docsearch_parent&&"DocSearch-Hit--Child",s&&"DocSearch-Hit--deleting",m&&"DocSearch-Hit--favoriting"].filter(Boolean).join(" "),onTransitionEnd:function(){d.current&&d.current()}},i({item:t,source:a.source,onClick:function(e){c(t,e)}})),Be.createElement(h,{hit:t},Be.createElement("div",{className:"DocSearch-Hit-Container"},r({item:t,index:n}),t.hierarchy[t.type]&&"lvl1"===t.type&&Be.createElement("div",{className:"DocSearch-Hit-content-wrapper"},Be.createElement(Hr,{className:"DocSearch-Hit-title",hit:t,attribute:"hierarchy.lvl1"}),t.content&&Be.createElement(Hr,{className:"DocSearch-Hit-path",hit:t,attribute:"content"})),t.hierarchy[t.type]&&("lvl2"===t.type||"lvl3"===t.type||"lvl4"===t.type||"lvl5"===t.type||"lvl6"===t.type)&&Be.createElement("div",{className:"DocSearch-Hit-content-wrapper"},Be.createElement(Hr,{className:"DocSearch-Hit-title",hit:t,attribute:"hierarchy.".concat(t.type)}),Be.createElement(Hr,{className:"DocSearch-Hit-path",hit:t,attribute:"hierarchy.lvl1"})),"content"===t.type&&Be.createElement("div",{className:"DocSearch-Hit-content-wrapper"},Be.createElement(Hr,{className:"DocSearch-Hit-title",hit:t,attribute:"content"}),Be.createElement(Hr,{className:"DocSearch-Hit-path",hit:t,attribute:"hierarchy.lvl1"})),o({item:t,runDeleteTransition:function(e){f(!0),d.current=e},runFavoriteTransition:function(e){v(!0),d.current=e}}))))}function Kr(e,t,n){return e.reduce((function(e,r){var o=t(r);return e.hasOwnProperty(o)||(e[o]=[]),e[o].length<(n||5)&&e[o].push(r),e}),{})}function zr(e){return e}function Jr(e){return 1===e.button||e.altKey||e.ctrlKey||e.metaKey||e.shiftKey}function $r(){}var Qr=/(<mark>|<\/mark>)/g,Zr=RegExp(Qr.source);function Yr(e){var t,n,r,o,i,c=e;if(!c.__docsearch_parent&&!e._highlightResult)return e.hierarchy.lvl0;var a=((c.__docsearch_parent?null===(t=c.__docsearch_parent)||void 0===t||null===(n=t._highlightResult)||void 0===n||null===(r=n.hierarchy)||void 0===r?void 0:r.lvl0:null===(o=e._highlightResult)||void 0===o||null===(i=o.hierarchy)||void 0===i?void 0:i.lvl0)||{}).value;return a&&Zr.test(a)?a.replace(Qr,""):a}function Gr(){return Gr=Object.assign||function(e){for(var t=1;t<arguments.length;t++){var n=arguments[t];for(var r in n)Object.prototype.hasOwnProperty.call(n,r)&&(e[r]=n[r])}return e},Gr.apply(this,arguments)}function Xr(e){return Be.createElement("div",{className:"DocSearch-Dropdown-Container"},e.state.collections.map((function(t){if(0===t.items.length)return null;var n=Yr(t.items[0]);return Be.createElement(Vr,Gr({},e,{key:t.source.sourceId,title:n,collection:t,renderIcon:function(e){var n,r=e.item,o=e.index;return Be.createElement(Be.Fragment,null,r.__docsearch_parent&&Be.createElement("svg",{className:"DocSearch-Hit-Tree",viewBox:"0 0 24 54"},Be.createElement("g",{stroke:"currentColor",fill:"none",fillRule:"evenodd",strokeLinecap:"round",strokeLinejoin:"round"},r.__docsearch_parent!==(null===(n=t.items[o+1])||void 0===n?void 0:n.__docsearch_parent)?Be.createElement("path",{d:"M8 6v21M20 27H8.3"}):Be.createElement("path",{d:"M8 6v42M20 27H8.3"}))),Be.createElement("div",{className:"DocSearch-Hit-icon"},Be.createElement(Or,{type:r.type})))},renderAction:function(){return Be.createElement("div",{className:"DocSearch-Hit-action"},Be.createElement(_r,null))}}))})),e.resultsFooterComponent&&Be.createElement("section",{className:"DocSearch-HitsFooter"},Be.createElement(e.resultsFooterComponent,{state:e.state})))}var eo=["translations"];function to(){return to=Object.assign||function(e){for(var t=1;t<arguments.length;t++){var n=arguments[t];for(var r in n)Object.prototype.hasOwnProperty.call(n,r)&&(e[r]=n[r])}return e},to.apply(this,arguments)}function no(e,t){if(null==e)return{};var n,r,o=function(e,t){if(null==e)return{};var n,r,o={},i=Object.keys(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}function ro(e){var t=e.translations,n=void 0===t?{}:t,r=no(e,eo),o=n.recentSearchesTitle,i=void 0===o?"Recent":o,c=n.noRecentSearchesText,a=void 0===c?"No recent searches":c,u=n.saveRecentSearchButtonTitle,l=void 0===u?"Save this search":u,s=n.removeRecentSearchButtonTitle,f=void 0===s?"Remove this search from history":s,p=n.favoriteSearchesTitle,m=void 0===p?"Favorite":p,v=n.removeFavoriteSearchButtonTitle,d=void 0===v?"Remove this search from favorites":v;return"idle"===r.state.status&&!1===r.hasCollections?r.disableUserPersonalization?null:Be.createElement("div",{className:"DocSearch-StartScreen"},Be.createElement("p",{className:"DocSearch-Help"},a)):!1===r.hasCollections?null:Be.createElement("div",{className:"DocSearch-Dropdown-Container"},Be.createElement(Vr,to({},r,{title:i,collection:r.state.collections[0],renderIcon:function(){return Be.createElement("div",{className:"DocSearch-Hit-icon"},Be.createElement(yr,null))},renderAction:function(e){var t=e.item,n=e.runFavoriteTransition,o=e.runDeleteTransition;return Be.createElement(Be.Fragment,null,Be.createElement("div",{className:"DocSearch-Hit-action"},Be.createElement("button",{className:"DocSearch-Hit-action-button",title:l,type:"submit",onClick:function(e){e.preventDefault(),e.stopPropagation(),n((function(){r.favoriteSearches.add(t),r.recentSearches.remove(t),r.refresh()}))}},Be.createElement(wr,null))),Be.createElement("div",{className:"DocSearch-Hit-action"},Be.createElement("button",{className:"DocSearch-Hit-action-button",title:f,type:"submit",onClick:function(e){e.preventDefault(),e.stopPropagation(),o((function(){r.recentSearches.remove(t),r.refresh()}))}},Be.createElement(br,null))))}})),Be.createElement(Vr,to({},r,{title:m,collection:r.state.collections[1],renderIcon:function(){return Be.createElement("div",{className:"DocSearch-Hit-icon"},Be.createElement(wr,null))},renderAction:function(e){var t=e.item,n=e.runDeleteTransition;return Be.createElement("div",{className:"DocSearch-Hit-action"},Be.createElement("button",{className:"DocSearch-Hit-action-button",title:d,type:"submit",onClick:function(e){e.preventDefault(),e.stopPropagation(),n((function(){r.favoriteSearches.remove(t),r.refresh()}))}},Be.createElement(br,null)))}})))}var oo=["translations"];function io(){return io=Object.assign||function(e){for(var t=1;t<arguments.length;t++){var n=arguments[t];for(var r in n)Object.prototype.hasOwnProperty.call(n,r)&&(e[r]=n[r])}return e},io.apply(this,arguments)}function co(e,t){if(null==e)return{};var n,r,o=function(e,t){if(null==e)return{};var n,r,o={},i=Object.keys(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}var ao=Be.memo((function(e){var t=e.translations,n=void 0===t?{}:t,r=co(e,oo);if("error"===r.state.status)return Be.createElement(Ir,{translations:null==n?void 0:n.errorScreen});var o=r.state.collections.some((function(e){return e.items.length>0}));return r.state.query?!1===o?Be.createElement(xr,io({},r,{translations:null==n?void 0:n.noResultsScreen})):Be.createElement(Xr,r):Be.createElement(ro,io({},r,{hasCollections:o,translations:null==n?void 0:n.startScreen}))}),(function(e,t){return"loading"===t.state.status||"stalled"===t.state.status})),uo=["translations"];function lo(){return lo=Object.assign||function(e){for(var t=1;t<arguments.length;t++){var n=arguments[t];for(var r in n)Object.prototype.hasOwnProperty.call(n,r)&&(e[r]=n[r])}return e},lo.apply(this,arguments)}function so(e,t){if(null==e)return{};var n,r,o=function(e,t){if(null==e)return{};var n,r,o={},i=Object.keys(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}function fo(e){var t=e.translations,n=void 0===t?{}:t,r=so(e,uo),o=n.resetButtonTitle,i=void 0===o?"Clear the query":o,c=n.resetButtonAriaLabel,a=void 0===c?"Clear the query":c,u=n.cancelButtonText,l=void 0===u?"Cancel":u,s=n.cancelButtonAriaLabel,f=void 0===s?"Cancel":s,p=r.getFormProps({inputElement:r.inputRef.current}).onReset;return Be.useEffect((function(){r.autoFocus&&r.inputRef.current&&r.inputRef.current.focus()}),[r.autoFocus,r.inputRef]),Be.useEffect((function(){r.isFromSelection&&r.inputRef.current&&r.inputRef.current.select()}),[r.isFromSelection,r.inputRef]),Be.createElement(Be.Fragment,null,Be.createElement("form",{className:"DocSearch-Form",onSubmit:function(e){e.preventDefault()},onReset:p},Be.createElement("label",lo({className:"DocSearch-MagnifierLabel"},r.getLabelProps()),Be.createElement(We,null)),Be.createElement("div",{className:"DocSearch-LoadingIndicator"},Be.createElement(hr,null)),Be.createElement("input",lo({className:"DocSearch-Input",ref:r.inputRef},r.getInputProps({inputElement:r.inputRef.current,autoFocus:r.autoFocus,maxLength:64}))),Be.createElement("button",{type:"reset",title:i,className:"DocSearch-Reset","aria-label":a,hidden:!r.state.query},Be.createElement(br,null))),Be.createElement("button",{className:"DocSearch-Cancel",type:"reset","aria-label":f,onClick:r.onClose},l))}var po=["_highlightResult","_snippetResult"];function mo(e,t){if(null==e)return{};var n,r,o=function(e,t){if(null==e)return{};var n,r,o={},i=Object.keys(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}function vo(e){return!1===function(){var e="__TEST_KEY__";try{return localStorage.setItem(e,""),localStorage.removeItem(e),!0}catch(e){return!1}}()?{setItem:function(){},getItem:function(){return[]}}:{setItem:function(t){return window.localStorage.setItem(e,JSON.stringify(t))},getItem:function(){var t=window.localStorage.getItem(e);return t?JSON.parse(t):[]}}}function ho(e){var t=e.key,n=e.limit,r=void 0===n?5:n,o=vo(t),i=o.getItem().slice(0,r);return{add:function(e){var t=e,n=(t._highlightResult,t._snippetResult,mo(t,po)),c=i.findIndex((function(e){return e.objectID===n.objectID}));c>-1&&i.splice(c,1),i.unshift(n),i=i.slice(0,r),o.setItem(i)},remove:function(e){i=i.filter((function(t){return t.objectID!==e.objectID})),o.setItem(i)},getAll:function(){return i}}}var yo=["facetName","facetQuery"];function bo(e){var t,n="algoliasearch-client-js-".concat(e.key),r=function(){return void 0===t&&(t=e.localStorage||window.localStorage),t},o=function(){return JSON.parse(r().getItem(n)||"{}")};return{get:function(e,t){var n=arguments.length>2&&void 0!==arguments[2]?arguments[2]:{miss:function(){return Promise.resolve()}};return Promise.resolve().then((function(){var n=JSON.stringify(e),r=o()[n];return Promise.all([r||t(),void 0!==r])})).then((function(e){var t=c(e,2),r=t[0],o=t[1];return Promise.all([r,o||n.miss(r)])})).then((function(e){return c(e,1)[0]}))},set:function(e,t){return Promise.resolve().then((function(){var i=o();return i[JSON.stringify(e)]=t,r().setItem(n,JSON.stringify(i)),t}))},delete:function(e){return Promise.resolve().then((function(){var t=o();delete t[JSON.stringify(e)],r().setItem(n,JSON.stringify(t))}))},clear:function(){return Promise.resolve().then((function(){r().removeItem(n)}))}}}function _o(e){var t=a(e.caches),n=t.shift();return void 0===n?{get:function(e,t){var n=arguments.length>2&&void 0!==arguments[2]?arguments[2]:{miss:function(){return Promise.resolve()}};return t().then((function(e){return Promise.all([e,n.miss(e)])})).then((function(e){return c(e,1)[0]}))},set:function(e,t){return Promise.resolve(t)},delete:function(e){return Promise.resolve()},clear:function(){return Promise.resolve()}}:{get:function(e,r){var o=arguments.length>2&&void 0!==arguments[2]?arguments[2]:{miss:function(){return Promise.resolve()}};return n.get(e,r,o).catch((function(){return _o({caches:t}).get(e,r,o)}))},set:function(e,r){return n.set(e,r).catch((function(){return _o({caches:t}).set(e,r)}))},delete:function(e){return n.delete(e).catch((function(){return _o({caches:t}).delete(e)}))},clear:function(){return n.clear().catch((function(){return _o({caches:t}).clear()}))}}}function go(){var e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:{serializable:!0},t={};return{get:function(n,r){var o=arguments.length>2&&void 0!==arguments[2]?arguments[2]:{miss:function(){return Promise.resolve()}},i=JSON.stringify(n);if(i in t)return Promise.resolve(e.serializable?JSON.parse(t[i]):t[i]);var c=r(),a=o&&o.miss||function(){return Promise.resolve()};return c.then((function(e){return a(e)})).then((function(){return c}))},set:function(n,r){return t[JSON.stringify(n)]=e.serializable?JSON.stringify(r):r,Promise.resolve(r)},delete:function(e){return delete t[JSON.stringify(e)],Promise.resolve()},clear:function(){return t={},Promise.resolve()}}}function Oo(e){for(var t=e.length-1;t>0;t--){var n=Math.floor(Math.random()*(t+1)),r=e[t];e[t]=e[n],e[n]=r}return e}function So(e,t){return t?(Object.keys(t).forEach((function(n){e[n]=t[n](e)})),e):e}function jo(e){for(var t=arguments.length,n=new Array(t>1?t-1:0),r=1;r<t;r++)n[r-1]=arguments[r];var o=0;return e.replace(/%s/g,(function(){return encodeURIComponent(n[o++])}))}var wo="4.8.5",Eo={WithinQueryParameters:0,WithinHeaders:1};function Po(e,t){var n=e||{},r=n.data||{};return Object.keys(n).forEach((function(e){-1===["timeout","headers","queryParameters","data","cacheable"].indexOf(e)&&(r[e]=n[e])})),{data:Object.entries(r).length>0?r:void 0,timeout:n.timeout||t,headers:n.headers||{},queryParameters:n.queryParameters||{},cacheable:n.cacheable}}var Io={Read:1,Write:2,Any:3},Do=1,ko=2,Ao=3,Co=12e4;function xo(e){var n=arguments.length>1&&void 0!==arguments[1]?arguments[1]:Do;return t(t({},e),{},{status:n,lastUpdate:Date.now()})}function No(e){return"string"==typeof e?{protocol:"https",url:e,accept:Io.Any}:{protocol:e.protocol||"https",url:e.url,accept:e.accept||Io.Any}}var To="GET",Ro="POST";function qo(e,t){return Promise.all(t.map((function(t){return e.get(t,(function(){return Promise.resolve(xo(t))}))}))).then((function(e){var n=e.filter((function(e){return function(e){return e.status===Do||Date.now()-e.lastUpdate>Co}(e)})),r=e.filter((function(e){return function(e){return e.status===Ao&&Date.now()-e.lastUpdate<=Co}(e)})),o=[].concat(a(n),a(r));return{getTimeout:function(e,t){return(0===r.length&&0===e?1:r.length+3+e)*t},statelessHosts:o.length>0?o.map((function(e){return No(e)})):t}}))}function Lo(e,n,r,o){var i=[],c=function(e,n){if(e.method===To||void 0===e.data&&void 0===n.data)return;var r=Array.isArray(e.data)?e.data:t(t({},e.data),n.data);return JSON.stringify(r)}(r,o),u=function(e,n){var r=t(t({},e.headers),n.headers),o={};return Object.keys(r).forEach((function(e){var t=r[e];o[e.toLowerCase()]=t})),o}(e,o),l=r.method,s=r.method!==To?{}:t(t({},r.data),o.data),f=t(t(t({"x-algolia-agent":e.userAgent.value},e.queryParameters),s),o.queryParameters),p=0,m=function t(n,a){var s=n.pop();if(void 0===s)throw{name:"RetryError",message:"Unreachable hosts - your application id may be incorrect. If the error persists, contact support@algolia.com.",transporterStackTrace:Fo(i)};var m={data:c,headers:u,method:l,url:Ho(s,r.path,f),connectTimeout:a(p,e.timeouts.connect),responseTimeout:a(p,o.timeout)},v=function(e){var t={request:m,response:e,host:s,triesLeft:n.length};return i.push(t),t},d={onSucess:function(e){return function(e){try{return JSON.parse(e.content)}catch(t){throw function(e,t){return{name:"DeserializationError",message:e,response:t}}(t.message,e)}}(e)},onRetry:function(r){var o=v(r);return r.isTimedOut&&p++,Promise.all([e.logger.info("Retryable failure",Bo(o)),e.hostsCache.set(s,xo(s,r.isTimedOut?Ao:ko))]).then((function(){return t(n,a)}))},onFail:function(e){throw v(e),function(e,t){var n=e.content,r=e.status,o=n;try{o=JSON.parse(n).message}catch(e){}return function(e,t,n){return{name:"ApiError",message:e,status:t,transporterStackTrace:n}}(o,r,t)}(e,Fo(i))}};return e.requester.send(m).then((function(e){return function(e,t){return function(e){var t=e.status;return e.isTimedOut||function(e){var t=e.isTimedOut,n=e.status;return!t&&0==~~n}(e)||2!=~~(t/100)&&4!=~~(t/100)}(e)?t.onRetry(e):2==~~(e.status/100)?t.onSucess(e):t.onFail(e)}(e,d)}))};return qo(e.hostsCache,n).then((function(e){return m(a(e.statelessHosts).reverse(),e.getTimeout)}))}function Mo(e){var t={value:"Algolia for JavaScript (".concat(e,")"),add:function(e){var n="; ".concat(e.segment).concat(void 0!==e.version?" (".concat(e.version,")"):"");return-1===t.value.indexOf(n)&&(t.value="".concat(t.value).concat(n)),t}};return t}function Ho(e,t,n){var r=Uo(n),o="".concat(e.protocol,"://").concat(e.url,"/").concat("/"===t.charAt(0)?t.substr(1):t);return r.length&&(o+="?".concat(r)),o}function Uo(e){return Object.keys(e).map((function(t){return jo("%s=%s",t,(n=e[t],"[object Object]"===Object.prototype.toString.call(n)||"[object Array]"===Object.prototype.toString.call(n)?JSON.stringify(e[t]):e[t]));var n})).join("&")}function Fo(e){return e.map((function(e){return Bo(e)}))}function Bo(e){var n=e.request.headers["x-algolia-api-key"]?{"x-algolia-api-key":"*****"}:{};return t(t({},e),{},{request:t(t({},e.request),{},{headers:t(t({},e.request.headers),n)})})}var Vo=function(e){var n=e.appId,r=function(e,t,n){var r={"x-algolia-api-key":n,"x-algolia-application-id":t};return{headers:function(){return e===Eo.WithinHeaders?r:{}},queryParameters:function(){return e===Eo.WithinQueryParameters?r:{}}}}(void 0!==e.authMode?e.authMode:Eo.WithinHeaders,n,e.apiKey),o=function(e){var t=e.hostsCache,n=e.logger,r=e.requester,o=e.requestsCache,i=e.responsesCache,a=e.timeouts,u=e.userAgent,l=e.hosts,s=e.queryParameters,f={hostsCache:t,logger:n,requester:r,requestsCache:o,responsesCache:i,timeouts:a,userAgent:u,headers:e.headers,queryParameters:s,hosts:l.map((function(e){return No(e)})),read:function(e,t){var n=Po(t,f.timeouts.read),r=function(){return Lo(f,f.hosts.filter((function(e){return 0!=(e.accept&Io.Read)})),e,n)};if(!0!==(void 0!==n.cacheable?n.cacheable:e.cacheable))return r();var o={request:e,mappedRequestOptions:n,transporter:{queryParameters:f.queryParameters,headers:f.headers}};return f.responsesCache.get(o,(function(){return f.requestsCache.get(o,(function(){return f.requestsCache.set(o,r()).then((function(e){return Promise.all([f.requestsCache.delete(o),e])}),(function(e){return Promise.all([f.requestsCache.delete(o),Promise.reject(e)])})).then((function(e){var t=c(e,2);return t[0],t[1]}))}))}),{miss:function(e){return f.responsesCache.set(o,e)}})},write:function(e,t){return Lo(f,f.hosts.filter((function(e){return 0!=(e.accept&Io.Write)})),e,Po(t,f.timeouts.write))}};return f}(t(t({hosts:[{url:"".concat(n,"-dsn.algolia.net"),accept:Io.Read},{url:"".concat(n,".algolia.net"),accept:Io.Write}].concat(Oo([{url:"".concat(n,"-1.algolianet.com")},{url:"".concat(n,"-2.algolianet.com")},{url:"".concat(n,"-3.algolianet.com")}]))},e),{},{headers:t(t(t({},r.headers()),{"content-type":"application/x-www-form-urlencoded"}),e.headers),queryParameters:t(t({},r.queryParameters()),e.queryParameters)})),i={transporter:o,appId:n,addAlgoliaAgent:function(e,t){o.userAgent.add({segment:e,version:t})},clearCache:function(){return Promise.all([o.requestsCache.clear(),o.responsesCache.clear()]).then((function(){}))}};return So(i,e.methods)},Wo=function(e){return function(t){var n=arguments.length>1&&void 0!==arguments[1]?arguments[1]:{},r={transporter:e.transporter,appId:e.appId,indexName:t};return So(r,n.methods)}},Ko=function(e){return function(n,r){var o=n.map((function(e){return t(t({},e),{},{params:Uo(e.params||{})})}));return e.transporter.read({method:Ro,path:"1/indexes/*/queries",data:{requests:o},cacheable:!0},r)}},zo=function(e){return function(n,r){return Promise.all(n.map((function(n){var o=n.params,c=o.facetName,a=o.facetQuery,u=i(o,yo);return Wo(e)(n.indexName,{methods:{searchForFacetValues:Qo}}).searchForFacetValues(c,a,t(t({},r),u))})))}},Jo=function(e){return function(t,n,r){return e.transporter.read({method:Ro,path:jo("1/answers/%s/prediction",e.indexName),data:{query:t,queryLanguages:n},cacheable:!0},r)}},$o=function(e){return function(t,n){return e.transporter.read({method:Ro,path:jo("1/indexes/%s/query",e.indexName),data:{query:t},cacheable:!0},n)}},Qo=function(e){return function(t,n,r){return e.transporter.read({method:Ro,path:jo("1/indexes/%s/facets/%s/query",e.indexName,t),data:{facetQuery:n},cacheable:!0},r)}},Zo=1,Yo=2,Go=3;function Xo(e,n,r){var o,i={appId:e,apiKey:n,timeouts:{connect:1,read:2,write:30},requester:{send:function(e){return new Promise((function(t){var n=new XMLHttpRequest;n.open(e.method,e.url,!0),Object.keys(e.headers).forEach((function(t){return n.setRequestHeader(t,e.headers[t])}));var r,o=function(e,r){return setTimeout((function(){n.abort(),t({status:0,content:r,isTimedOut:!0})}),1e3*e)},i=o(e.connectTimeout,"Connection timeout");n.onreadystatechange=function(){n.readyState>n.OPENED&&void 0===r&&(clearTimeout(i),r=o(e.responseTimeout,"Socket timeout"))},n.onerror=function(){0===n.status&&(clearTimeout(i),clearTimeout(r),t({content:n.responseText||"Network request failed",status:n.status,isTimedOut:!1}))},n.onload=function(){clearTimeout(i),clearTimeout(r),t({content:n.responseText,status:n.status,isTimedOut:!1})},n.send(e.data)}))}},logger:(o=Go,{debug:function(e,t){return Zo>=o&&console.debug(e,t),Promise.resolve()},info:function(e,t){return Yo>=o&&console.info(e,t),Promise.resolve()},error:function(e,t){return console.error(e,t),Promise.resolve()}}),responsesCache:go(),requestsCache:go({serializable:!1}),hostsCache:_o({caches:[bo({key:"".concat(wo,"-").concat(e)}),go()]}),userAgent:Mo(wo).add({segment:"Browser",version:"lite"}),authMode:Eo.WithinQueryParameters};return Vo(t(t(t({},i),r),{},{methods:{search:Ko,searchForFacetValues:zo,multipleQueries:Ko,multipleSearchForFacetValues:zo,initIndex:function(e){return function(t){return Wo(e)(t,{methods:{search:$o,searchForFacetValues:Qo,findAnswers:Jo}})}}}}))}Xo.version=wo;var ei="3.5.1";var ti=["footer","searchBox"];function ni(){return ni=Object.assign||function(e){for(var t=1;t<arguments.length;t++){var n=arguments[t];for(var r in n)Object.prototype.hasOwnProperty.call(n,r)&&(e[r]=n[r])}return e},ni.apply(this,arguments)}function ri(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function oi(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?ri(Object(n),!0).forEach((function(t){ii(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):ri(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function ii(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function ci(e,t){return function(e){if(Array.isArray(e))return e}(e)||function(e,t){var n=null==e?null:"undefined"!=typeof Symbol&&e[Symbol.iterator]||e["@@iterator"];if(null==n)return;var r,o,i=[],c=!0,a=!1;try{for(n=n.call(e);!(c=(r=n.next()).done)&&(i.push(r.value),!t||i.length!==t);c=!0);}catch(e){a=!0,o=e}finally{try{c||null==n.return||n.return()}finally{if(a)throw o}}return i}(e,t)||function(e,t){if(!e)return;if("string"==typeof e)return ai(e,t);var n=Object.prototype.toString.call(e).slice(8,-1);"Object"===n&&e.constructor&&(n=e.constructor.name);if("Map"===n||"Set"===n)return Array.from(e);if("Arguments"===n||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n))return ai(e,t)}(e,t)||function(){throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function ai(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,r=new Array(t);n<t;n++)r[n]=e[n];return r}function ui(e,t){if(null==e)return{};var n,r,o=function(e,t){if(null==e)return{};var n,r,o={},i=Object.keys(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}function li(e){var t=e.appId,n=e.apiKey,r=e.indexName,o=e.placeholder,i=void 0===o?"Search docs":o,c=e.searchParameters,a=e.maxResultsPerGroup,u=e.onClose,l=void 0===u?$r:u,s=e.transformItems,f=void 0===s?zr:s,p=e.hitComponent,m=void 0===p?dr:p,v=e.resultsFooterComponent,d=void 0===v?function(){return null}:v,h=e.navigator,y=e.initialScrollY,b=void 0===y?0:y,_=e.transformSearchClient,g=void 0===_?zr:_,O=e.disableUserPersonalization,S=void 0!==O&&O,j=e.initialQuery,w=void 0===j?"":j,E=e.translations,P=void 0===E?{}:E,I=e.getMissingResultsUrl,D=e.insights,k=void 0!==D&&D,A=P.footer,C=P.searchBox,x=ui(P,ti),N=ci(Be.useState({query:"",collections:[],completion:null,context:{},isOpen:!1,activeItemId:null,status:"idle"}),2),T=N[0],R=N[1],q=Be.useRef(null),L=Be.useRef(null),M=Be.useRef(null),H=Be.useRef(null),U=Be.useRef(null),F=Be.useRef(10),B=Be.useRef("undefined"!=typeof window?window.getSelection().toString().slice(0,64):"").current,V=Be.useRef(w||B).current,W=function(e,t,n){return Be.useMemo((function(){var r=Xo(e,t);return r.addAlgoliaAgent("docsearch",ei),!1===/docsearch.js \(.*\)/.test(r.transporter.userAgent.value)&&r.addAlgoliaAgent("docsearch-react",ei),n(r)}),[e,t,n])}(t,n,g),K=Be.useRef(ho({key:"__DOCSEARCH_FAVORITE_SEARCHES__".concat(r),limit:10})).current,z=Be.useRef(ho({key:"__DOCSEARCH_RECENT_SEARCHES__".concat(r),limit:0===K.getAll().length?7:4})).current,J=Be.useCallback((function(e){if(!S){var t="content"===e.type?e.__docsearch_parent:e;t&&-1===K.getAll().findIndex((function(e){return e.objectID===t.objectID}))&&z.add(t)}}),[K,z,S]),$=Be.useCallback((function(e){if(T.context.algoliaInsightsPlugin&&e.__autocomplete_id){var t=e,n={eventName:"Item Selected",index:t.__autocomplete_indexName,items:[t],positions:[e.__autocomplete_id],queryID:t.__autocomplete_queryID};T.context.algoliaInsightsPlugin.insights.clickedObjectIDsAfterSearch(n)}}),[T.context.algoliaInsightsPlugin]),Q=Be.useMemo((function(){return fr({id:"docsearch",defaultActiveItemId:0,placeholder:i,openOnFocus:!0,initialState:{query:V,context:{searchSuggestions:[]}},insights:k,navigator:h,onStateChange:function(e){R(e.state)},getSources:function(e){var o=e.query,i=e.state,u=e.setContext,s=e.setStatus;if(!o)return S?[]:[{sourceId:"recentSearches",onSelect:function(e){var t=e.item,n=e.event;J(t),Jr(n)||l()},getItemUrl:function(e){return e.item.url},getItems:function(){return z.getAll()}},{sourceId:"favoriteSearches",onSelect:function(e){var t=e.item,n=e.event;J(t),Jr(n)||l()},getItemUrl:function(e){return e.item.url},getItems:function(){return K.getAll()}}];var p=Boolean(k);return W.search([{query:o,indexName:r,params:oi({attributesToRetrieve:["hierarchy.lvl0","hierarchy.lvl1","hierarchy.lvl2","hierarchy.lvl3","hierarchy.lvl4","hierarchy.lvl5","hierarchy.lvl6","content","type","url"],attributesToSnippet:["hierarchy.lvl1:".concat(F.current),"hierarchy.lvl2:".concat(F.current),"hierarchy.lvl3:".concat(F.current),"hierarchy.lvl4:".concat(F.current),"hierarchy.lvl5:".concat(F.current),"hierarchy.lvl6:".concat(F.current),"content:".concat(F.current)],snippetEllipsisText:"…",highlightPreTag:"<mark>",highlightPostTag:"</mark>",hitsPerPage:20,clickAnalytics:p},c)}]).catch((function(e){throw"RetryError"===e.name&&s("error"),e})).then((function(e){var o=e.results,c=o[0],s=c.hits,m=c.nbHits,v=Kr(s,(function(e){return Yr(e)}),a);i.context.searchSuggestions.length<Object.keys(v).length&&u({searchSuggestions:Object.keys(v)}),u({nbHits:m});var d={};return p&&(d={__autocomplete_indexName:r,__autocomplete_queryID:o[0].queryID,__autocomplete_algoliaCredentials:{appId:t,apiKey:n}}),Object.values(v).map((function(e,t){return{sourceId:"hits".concat(t),onSelect:function(e){var t=e.item,n=e.event;J(t),Jr(n)||l()},getItemUrl:function(e){return e.item.url},getItems:function(){return Object.values(Kr(e,(function(e){return e.hierarchy.lvl1}),a)).map(f).map((function(e){return e.map((function(t){var n=null,r=e.find((function(e){return"lvl1"===e.type&&e.hierarchy.lvl1===t.hierarchy.lvl1}));return"lvl1"!==t.type&&r&&(n=r),oi(oi({},t),{},{__docsearch_parent:n},d)}))})).flat()}}}))}))}})}),[r,c,a,W,l,z,K,J,V,i,h,f,S,k,t,n]),Z=Q.getEnvironmentProps,Y=Q.getRootProps,G=Q.refresh;return function(e){var t=e.getEnvironmentProps,n=e.panelElement,r=e.formElement,o=e.inputElement;Be.useEffect((function(){if(n&&r&&o){var e=t({panelElement:n,formElement:r,inputElement:o}),i=e.onTouchStart,c=e.onTouchMove;return window.addEventListener("touchstart",i),window.addEventListener("touchmove",c),function(){window.removeEventListener("touchstart",i),window.removeEventListener("touchmove",c)}}}),[t,n,r,o])}({getEnvironmentProps:Z,panelElement:H.current,formElement:M.current,inputElement:U.current}),function(e){var t=e.container;Be.useEffect((function(){if(t){var e=t.querySelectorAll("a[href]:not([disabled]), button:not([disabled]), input:not([disabled])"),n=e[0],r=e[e.length-1];return t.addEventListener("keydown",o),function(){t.removeEventListener("keydown",o)}}function o(e){"Tab"===e.key&&(e.shiftKey?document.activeElement===n&&(e.preventDefault(),r.focus()):document.activeElement===r&&(e.preventDefault(),n.focus()))}}),[t])}({container:q.current}),Be.useEffect((function(){return document.body.classList.add("DocSearch--active"),function(){var e,t;document.body.classList.remove("DocSearch--active"),null===(e=(t=window).scrollTo)||void 0===e||e.call(t,0,b)}}),[]),Be.useEffect((function(){window.matchMedia("(max-width: 768px)").matches&&(F.current=5)}),[]),Be.useEffect((function(){H.current&&(H.current.scrollTop=0)}),[T.query]),Be.useEffect((function(){V.length>0&&(G(),U.current&&U.current.focus())}),[V,G]),Be.useEffect((function(){function e(){if(L.current){var e=.01*window.innerHeight;L.current.style.setProperty("--docsearch-vh","".concat(e,"px"))}}return e(),window.addEventListener("resize",e),function(){window.removeEventListener("resize",e)}}),[]),Be.createElement("div",ni({ref:q},Y({"aria-expanded":!0}),{className:["DocSearch","DocSearch-Container","stalled"===T.status&&"DocSearch-Container--Stalled","error"===T.status&&"DocSearch-Container--Errored"].filter(Boolean).join(" "),role:"button",tabIndex:0,onMouseDown:function(e){e.target===e.currentTarget&&l()}}),Be.createElement("div",{className:"DocSearch-Modal",ref:L},Be.createElement("header",{className:"DocSearch-SearchBar",ref:M},Be.createElement(fo,ni({},Q,{state:T,autoFocus:0===V.length,inputRef:U,isFromSelection:Boolean(V)&&V===B,translations:C,onClose:l}))),Be.createElement("div",{className:"DocSearch-Dropdown",ref:H},Be.createElement(ao,ni({},Q,{indexName:r,state:T,hitComponent:m,resultsFooterComponent:d,disableUserPersonalization:S,recentSearches:z,favoriteSearches:K,inputRef:U,translations:x,getMissingResultsUrl:I,onItemClick:function(e,t){$(e),J(e),Jr(t)||l()}}))),Be.createElement("footer",{className:"DocSearch-Footer"},Be.createElement(vr,{translations:A}))))}function si(){return si=Object.assign||function(e){for(var t=1;t<arguments.length;t++){var n=arguments[t];for(var r in n)Object.prototype.hasOwnProperty.call(n,r)&&(e[r]=n[r])}return e},si.apply(this,arguments)}function fi(e,t){return function(e){if(Array.isArray(e))return e}(e)||function(e,t){var n=null==e?null:"undefined"!=typeof Symbol&&e[Symbol.iterator]||e["@@iterator"];if(null==n)return;var r,o,i=[],c=!0,a=!1;try{for(n=n.call(e);!(c=(r=n.next()).done)&&(i.push(r.value),!t||i.length!==t);c=!0);}catch(e){a=!0,o=e}finally{try{c||null==n.return||n.return()}finally{if(a)throw o}}return i}(e,t)||function(e,t){if(!e)return;if("string"==typeof e)return pi(e,t);var n=Object.prototype.toString.call(e).slice(8,-1);"Object"===n&&e.constructor&&(n=e.constructor.name);if("Map"===n||"Set"===n)return Array.from(e);if("Arguments"===n||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n))return pi(e,t)}(e,t)||function(){throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function pi(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,r=new Array(t);n<t;n++)r[n]=e[n];return r}function mi(e){var t,n,r=Be.useRef(null),o=fi(Be.useState(!1),2),i=o[0],c=o[1],a=fi(Be.useState((null==e?void 0:e.initialQuery)||void 0),2),u=a[0],l=a[1],s=Be.useCallback((function(){c(!0)}),[c]),f=Be.useCallback((function(){c(!1)}),[c]);return function(e){var t=e.isOpen,n=e.onOpen,r=e.onClose,o=e.onInput,i=e.searchButtonRef;Be.useEffect((function(){function e(e){var c;(27===e.keyCode&&t||"k"===(null===(c=e.key)||void 0===c?void 0:c.toLowerCase())&&(e.metaKey||e.ctrlKey)||!function(e){var t=e.target,n=t.tagName;return t.isContentEditable||"INPUT"===n||"SELECT"===n||"TEXTAREA"===n}(e)&&"/"===e.key&&!t)&&(e.preventDefault(),t?r():document.body.classList.contains("DocSearch--active")||document.body.classList.contains("DocSearch--active")||n()),i&&i.current===document.activeElement&&o&&/[a-zA-Z0-9]/.test(String.fromCharCode(e.keyCode))&&o(e)}return window.addEventListener("keydown",e),function(){window.removeEventListener("keydown",e)}}),[t,n,r,o,i])}({isOpen:i,onOpen:s,onClose:f,onInput:Be.useCallback((function(e){c(!0),l(e.key)}),[c,l]),searchButtonRef:r}),Be.createElement(Be.Fragment,null,Be.createElement(Ye,{ref:r,translations:null==e||null===(t=e.translations)||void 0===t?void 0:t.button,onClick:s}),i&&Ie(Be.createElement(li,si({},e,{initialScrollY:window.scrollY,initialQuery:u,translations:null==e||null===(n=e.translations)||void 0===n?void 0:n.modal,onClose:f})),document.body))}return function(e){Ce(Be.createElement(mi,o({},e,{transformSearchClient:function(t){return t.addAlgoliaAgent("docsearch.js",ei),e.transformSearchClient?e.transformSearchClient(t):t}})),function(e){var t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:window;return"string"==typeof e?t.document.querySelector(e):e}(e.container,e.environment))}}));
+/*! @docsearch/js 3.6.1 | MIT License | © Algolia, Inc. and contributors | https://docsearch.algolia.com */
+!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?module.exports=t():"function"==typeof define&&define.amd?define(t):(e=e||self).docsearch=t()}(this,(function(){"use strict";function e(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function t(t){for(var n=1;n<arguments.length;n++){var o=null!=arguments[n]?arguments[n]:{};n%2?e(Object(o),!0).forEach((function(e){r(t,e,o[e])})):Object.getOwnPropertyDescriptors?Object.defineProperties(t,Object.getOwnPropertyDescriptors(o)):e(Object(o)).forEach((function(e){Object.defineProperty(t,e,Object.getOwnPropertyDescriptor(o,e))}))}return t}function n(e){return n="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},n(e)}function r(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function o(){return o=Object.assign||function(e){for(var t=1;t<arguments.length;t++){var n=arguments[t];for(var r in n)Object.prototype.hasOwnProperty.call(n,r)&&(e[r]=n[r])}return e},o.apply(this,arguments)}function i(e,t){if(null==e)return{};var n,r,o=function(e,t){if(null==e)return{};var n,r,o={},i=Object.keys(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}function c(e,t){return function(e){if(Array.isArray(e))return e}(e)||function(e,t){var n=null==e?null:"undefined"!=typeof Symbol&&e[Symbol.iterator]||e["@@iterator"];if(null==n)return;var r,o,i=[],c=!0,a=!1;try{for(n=n.call(e);!(c=(r=n.next()).done)&&(i.push(r.value),!t||i.length!==t);c=!0);}catch(e){a=!0,o=e}finally{try{c||null==n.return||n.return()}finally{if(a)throw o}}return i}(e,t)||u(e,t)||function(){throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function a(e){return function(e){if(Array.isArray(e))return l(e)}(e)||function(e){if("undefined"!=typeof Symbol&&null!=e[Symbol.iterator]||null!=e["@@iterator"])return Array.from(e)}(e)||u(e)||function(){throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function u(e,t){if(e){if("string"==typeof e)return l(e,t);var n=Object.prototype.toString.call(e).slice(8,-1);return"Object"===n&&e.constructor&&(n=e.constructor.name),"Map"===n||"Set"===n?Array.from(e):"Arguments"===n||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)?l(e,t):void 0}}function l(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,r=new Array(t);n<t;n++)r[n]=e[n];return r}var s,f,p,m,d,v={},h=[],y=/acit|ex(?:s|g|n|p|$)|rph|grid|ows|mnc|ntw|ine[ch]|zoo|^ord|itera/i;function _(e,t){for(var n in t)e[n]=t[n];return e}function b(e){var t=e.parentNode;t&&t.removeChild(e)}function g(e,t,n){var r,o,i,c=arguments,a={};for(i in t)"key"==i?r=t[i]:"ref"==i?o=t[i]:a[i]=t[i];if(arguments.length>3)for(n=[n],i=3;i<arguments.length;i++)n.push(c[i]);if(null!=n&&(a.children=n),"function"==typeof e&&null!=e.defaultProps)for(i in e.defaultProps)void 0===a[i]&&(a[i]=e.defaultProps[i]);return S(e,a,r,o,null)}function S(e,t,n,r,o){var i={type:e,props:t,key:n,ref:r,__k:null,__:null,__b:0,__e:null,__d:void 0,__c:null,__h:null,constructor:void 0,__v:null==o?++s.__v:o};return null!=s.vnode&&s.vnode(i),i}function O(e){return e.children}function w(e,t){this.props=e,this.context=t}function E(e,t){if(null==t)return e.__?E(e.__,e.__.__k.indexOf(e)+1):null;for(var n;t<e.__k.length;t++)if(null!=(n=e.__k[t])&&null!=n.__e)return n.__e;return"function"==typeof e.type?E(e):null}function j(e){var t,n;if(null!=(e=e.__)&&null!=e.__c){for(e.__e=e.__c.base=null,t=0;t<e.__k.length;t++)if(null!=(n=e.__k[t])&&null!=n.__e){e.__e=e.__c.base=n.__e;break}return j(e)}}function P(e){(!e.__d&&(e.__d=!0)&&f.push(e)&&!I.__r++||m!==s.debounceRendering)&&((m=s.debounceRendering)||p)(I)}function I(){for(var e;I.__r=f.length;)e=f.sort((function(e,t){return e.__v.__b-t.__v.__b})),f=[],e.some((function(e){var t,n,r,o,i,c;e.__d&&(i=(o=(t=e).__v).__e,(c=t.__P)&&(n=[],(r=_({},o)).__v=o.__v+1,q(c,o,r,t.__n,void 0!==c.ownerSVGElement,null!=o.__h?[i]:null,n,null==i?E(o):i,o.__h),L(n,o),o.__e!=i&&j(o)))}))}function D(e,t,n,r,o,i,c,a,u,l){var s,f,p,m,d,y,_,b=r&&r.__k||h,g=b.length;for(n.__k=[],s=0;s<t.length;s++)if(null!=(m=n.__k[s]=null==(m=t[s])||"boolean"==typeof m?null:"string"==typeof m||"number"==typeof m?S(null,m,null,null,m):Array.isArray(m)?S(O,{children:m},null,null,null):m.__b>0?S(m.type,m.props,m.key,null,m.__v):m)){if(m.__=n,m.__b=n.__b+1,null===(p=b[s])||p&&m.key==p.key&&m.type===p.type)b[s]=void 0;else for(f=0;f<g;f++){if((p=b[f])&&m.key==p.key&&m.type===p.type){b[f]=void 0;break}p=null}q(e,m,p=p||v,o,i,c,a,u,l),d=m.__e,(f=m.ref)&&p.ref!=f&&(_||(_=[]),p.ref&&_.push(p.ref,null,m),_.push(f,m.__c||d,m)),null!=d?(null==y&&(y=d),"function"==typeof m.type&&null!=m.__k&&m.__k===p.__k?m.__d=u=k(m,u,e):u=A(e,m,p,b,d,u),l||"option"!==n.type?"function"==typeof n.type&&(n.__d=u):e.value=""):u&&p.__e==u&&u.parentNode!=e&&(u=E(p))}for(n.__e=y,s=g;s--;)null!=b[s]&&("function"==typeof n.type&&null!=b[s].__e&&b[s].__e==n.__d&&(n.__d=E(r,s+1)),U(b[s],b[s]));if(_)for(s=0;s<_.length;s++)H(_[s],_[++s],_[++s])}function k(e,t,n){var r,o;for(r=0;r<e.__k.length;r++)(o=e.__k[r])&&(o.__=e,t="function"==typeof o.type?k(o,t,n):A(n,o,o,e.__k,o.__e,t));return t}function C(e,t){return t=t||[],null==e||"boolean"==typeof e||(Array.isArray(e)?e.some((function(e){C(e,t)})):t.push(e)),t}function A(e,t,n,r,o,i){var c,a,u;if(void 0!==t.__d)c=t.__d,t.__d=void 0;else if(null==n||o!=i||null==o.parentNode)e:if(null==i||i.parentNode!==e)e.appendChild(o),c=null;else{for(a=i,u=0;(a=a.nextSibling)&&u<r.length;u+=2)if(a==o)break e;e.insertBefore(o,i),c=i}return void 0!==c?c:o.nextSibling}function x(e,t,n){"-"===t[0]?e.setProperty(t,n):e[t]=null==n?"":"number"!=typeof n||y.test(t)?n:n+"px"}function N(e,t,n,r,o){var i;e:if("style"===t)if("string"==typeof n)e.style.cssText=n;else{if("string"==typeof r&&(e.style.cssText=r=""),r)for(t in r)n&&t in n||x(e.style,t,"");if(n)for(t in n)r&&n[t]===r[t]||x(e.style,t,n[t])}else if("o"===t[0]&&"n"===t[1])i=t!==(t=t.replace(/Capture$/,"")),t=t.toLowerCase()in e?t.toLowerCase().slice(2):t.slice(2),e.l||(e.l={}),e.l[t+i]=n,n?r||e.addEventListener(t,i?R:T,i):e.removeEventListener(t,i?R:T,i);else if("dangerouslySetInnerHTML"!==t){if(o)t=t.replace(/xlink[H:h]/,"h").replace(/sName$/,"s");else if("href"!==t&&"list"!==t&&"form"!==t&&"download"!==t&&t in e)try{e[t]=null==n?"":n;break e}catch(e){}"function"==typeof n||(null!=n&&(!1!==n||"a"===t[0]&&"r"===t[1])?e.setAttribute(t,n):e.removeAttribute(t))}}function T(e){this.l[e.type+!1](s.event?s.event(e):e)}function R(e){this.l[e.type+!0](s.event?s.event(e):e)}function q(e,t,n,r,o,i,c,a,u){var l,f,p,m,d,v,h,y,b,g,S,E=t.type;if(void 0!==t.constructor)return null;null!=n.__h&&(u=n.__h,a=t.__e=n.__e,t.__h=null,i=[a]),(l=s.__b)&&l(t);try{e:if("function"==typeof E){if(y=t.props,b=(l=E.contextType)&&r[l.__c],g=l?b?b.props.value:l.__:r,n.__c?h=(f=t.__c=n.__c).__=f.__E:("prototype"in E&&E.prototype.render?t.__c=f=new E(y,g):(t.__c=f=new w(y,g),f.constructor=E,f.render=F),b&&b.sub(f),f.props=y,f.state||(f.state={}),f.context=g,f.__n=r,p=f.__d=!0,f.__h=[]),null==f.__s&&(f.__s=f.state),null!=E.getDerivedStateFromProps&&(f.__s==f.state&&(f.__s=_({},f.__s)),_(f.__s,E.getDerivedStateFromProps(y,f.__s))),m=f.props,d=f.state,p)null==E.getDerivedStateFromProps&&null!=f.componentWillMount&&f.componentWillMount(),null!=f.componentDidMount&&f.__h.push(f.componentDidMount);else{if(null==E.getDerivedStateFromProps&&y!==m&&null!=f.componentWillReceiveProps&&f.componentWillReceiveProps(y,g),!f.__e&&null!=f.shouldComponentUpdate&&!1===f.shouldComponentUpdate(y,f.__s,g)||t.__v===n.__v){f.props=y,f.state=f.__s,t.__v!==n.__v&&(f.__d=!1),f.__v=t,t.__e=n.__e,t.__k=n.__k,f.__h.length&&c.push(f);break e}null!=f.componentWillUpdate&&f.componentWillUpdate(y,f.__s,g),null!=f.componentDidUpdate&&f.__h.push((function(){f.componentDidUpdate(m,d,v)}))}f.context=g,f.props=y,f.state=f.__s,(l=s.__r)&&l(t),f.__d=!1,f.__v=t,f.__P=e,l=f.render(f.props,f.state,f.context),f.state=f.__s,null!=f.getChildContext&&(r=_(_({},r),f.getChildContext())),p||null==f.getSnapshotBeforeUpdate||(v=f.getSnapshotBeforeUpdate(m,d)),S=null!=l&&l.type===O&&null==l.key?l.props.children:l,D(e,Array.isArray(S)?S:[S],t,n,r,o,i,c,a,u),f.base=t.__e,t.__h=null,f.__h.length&&c.push(f),h&&(f.__E=f.__=null),f.__e=!1}else null==i&&t.__v===n.__v?(t.__k=n.__k,t.__e=n.__e):t.__e=M(n.__e,t,n,r,o,i,c,u);(l=s.diffed)&&l(t)}catch(e){t.__v=null,(u||null!=i)&&(t.__e=a,t.__h=!!u,i[i.indexOf(a)]=null),s.__e(e,t,n)}}function L(e,t){s.__c&&s.__c(t,e),e.some((function(t){try{e=t.__h,t.__h=[],e.some((function(e){e.call(t)}))}catch(e){s.__e(e,t.__v)}}))}function M(e,t,n,r,o,i,c,a){var u,l,s,f,p=n.props,m=t.props,d=t.type,y=0;if("svg"===d&&(o=!0),null!=i)for(;y<i.length;y++)if((u=i[y])&&(u===e||(d?u.localName==d:3==u.nodeType))){e=u,i[y]=null;break}if(null==e){if(null===d)return document.createTextNode(m);e=o?document.createElementNS("http://www.w3.org/2000/svg",d):document.createElement(d,m.is&&m),i=null,a=!1}if(null===d)p===m||a&&e.data===m||(e.data=m);else{if(i=i&&h.slice.call(e.childNodes),l=(p=n.props||v).dangerouslySetInnerHTML,s=m.dangerouslySetInnerHTML,!a){if(null!=i)for(p={},f=0;f<e.attributes.length;f++)p[e.attributes[f].name]=e.attributes[f].value;(s||l)&&(s&&(l&&s.__html==l.__html||s.__html===e.innerHTML)||(e.innerHTML=s&&s.__html||""))}if(function(e,t,n,r,o){var i;for(i in n)"children"===i||"key"===i||i in t||N(e,i,null,n[i],r);for(i in t)o&&"function"!=typeof t[i]||"children"===i||"key"===i||"value"===i||"checked"===i||n[i]===t[i]||N(e,i,t[i],n[i],r)}(e,m,p,o,a),s)t.__k=[];else if(y=t.props.children,D(e,Array.isArray(y)?y:[y],t,n,r,o&&"foreignObject"!==d,i,c,e.firstChild,a),null!=i)for(y=i.length;y--;)null!=i[y]&&b(i[y]);a||("value"in m&&void 0!==(y=m.value)&&(y!==e.value||"progress"===d&&!y)&&N(e,"value",y,p.value,!1),"checked"in m&&void 0!==(y=m.checked)&&y!==e.checked&&N(e,"checked",y,p.checked,!1))}return e}function H(e,t,n){try{"function"==typeof e?e(t):e.current=t}catch(e){s.__e(e,n)}}function U(e,t,n){var r,o,i;if(s.unmount&&s.unmount(e),(r=e.ref)&&(r.current&&r.current!==e.__e||H(r,null,t)),n||"function"==typeof e.type||(n=null!=(o=e.__e)),e.__e=e.__d=void 0,null!=(r=e.__c)){if(r.componentWillUnmount)try{r.componentWillUnmount()}catch(e){s.__e(e,t)}r.base=r.__P=null}if(r=e.__k)for(i=0;i<r.length;i++)r[i]&&U(r[i],t,n);null!=o&&b(o)}function F(e,t,n){return this.constructor(e,n)}function B(e,t,n){var r,o,i;s.__&&s.__(e,t),o=(r="function"==typeof n)?null:n&&n.__k||t.__k,i=[],q(t,e=(!r&&n||t).__k=g(O,null,[e]),o||v,v,void 0!==t.ownerSVGElement,!r&&n?[n]:o?null:t.firstChild?h.slice.call(t.childNodes):null,i,!r&&n?n:o?o.__e:t.firstChild,r),L(i,e)}function V(e,t){B(e,t,V)}function K(e,t,n){var r,o,i,c=arguments,a=_({},e.props);for(i in t)"key"==i?r=t[i]:"ref"==i?o=t[i]:a[i]=t[i];if(arguments.length>3)for(n=[n],i=3;i<arguments.length;i++)n.push(c[i]);return null!=n&&(a.children=n),S(e.type,a,r||e.key,o||e.ref,null)}s={__e:function(e,t){for(var n,r,o;t=t.__;)if((n=t.__c)&&!n.__)try{if((r=n.constructor)&&null!=r.getDerivedStateFromError&&(n.setState(r.getDerivedStateFromError(e)),o=n.__d),null!=n.componentDidCatch&&(n.componentDidCatch(e),o=n.__d),o)return n.__E=n}catch(t){e=t}throw e},__v:0},w.prototype.setState=function(e,t){var n;n=null!=this.__s&&this.__s!==this.state?this.__s:this.__s=_({},this.state),"function"==typeof e&&(e=e(_({},n),this.props)),e&&_(n,e),null!=e&&this.__v&&(t&&this.__h.push(t),P(this))},w.prototype.forceUpdate=function(e){this.__v&&(this.__e=!0,e&&this.__h.push(e),P(this))},w.prototype.render=O,f=[],p="function"==typeof Promise?Promise.prototype.then.bind(Promise.resolve()):setTimeout,I.__r=0,d=0;var W,z,J,$=0,Z=[],Q=s.__b,Y=s.__r,G=s.diffed,X=s.__c,ee=s.unmount;function te(e,t){s.__h&&s.__h(z,e,$||t),$=0;var n=z.__H||(z.__H={__:[],__h:[]});return e>=n.__.length&&n.__.push({}),n.__[e]}function ne(e){return $=1,re(pe,e)}function re(e,t,n){var r=te(W++,2);return r.t=e,r.__c||(r.__=[n?n(t):pe(void 0,t),function(e){var t=r.t(r.__[0],e);r.__[0]!==t&&(r.__=[t,r.__[1]],r.__c.setState({}))}],r.__c=z),r.__}function oe(e,t){var n=te(W++,3);!s.__s&&fe(n.__H,t)&&(n.__=e,n.__H=t,z.__H.__h.push(n))}function ie(e,t){var n=te(W++,4);!s.__s&&fe(n.__H,t)&&(n.__=e,n.__H=t,z.__h.push(n))}function ce(e,t){var n=te(W++,7);return fe(n.__H,t)&&(n.__=e(),n.__H=t,n.__h=e),n.__}function ae(){Z.forEach((function(e){if(e.__P)try{e.__H.__h.forEach(le),e.__H.__h.forEach(se),e.__H.__h=[]}catch(t){e.__H.__h=[],s.__e(t,e.__v)}})),Z=[]}s.__b=function(e){z=null,Q&&Q(e)},s.__r=function(e){Y&&Y(e),W=0;var t=(z=e.__c).__H;t&&(t.__h.forEach(le),t.__h.forEach(se),t.__h=[])},s.diffed=function(e){G&&G(e);var t=e.__c;t&&t.__H&&t.__H.__h.length&&(1!==Z.push(t)&&J===s.requestAnimationFrame||((J=s.requestAnimationFrame)||function(e){var t,n=function(){clearTimeout(r),ue&&cancelAnimationFrame(t),setTimeout(e)},r=setTimeout(n,100);ue&&(t=requestAnimationFrame(n))})(ae)),z=void 0},s.__c=function(e,t){t.some((function(e){try{e.__h.forEach(le),e.__h=e.__h.filter((function(e){return!e.__||se(e)}))}catch(n){t.some((function(e){e.__h&&(e.__h=[])})),t=[],s.__e(n,e.__v)}})),X&&X(e,t)},s.unmount=function(e){ee&&ee(e);var t=e.__c;if(t&&t.__H)try{t.__H.__.forEach(le)}catch(e){s.__e(e,t.__v)}};var ue="function"==typeof requestAnimationFrame;function le(e){var t=z;"function"==typeof e.__c&&e.__c(),z=t}function se(e){var t=z;e.__c=e.__(),z=t}function fe(e,t){return!e||e.length!==t.length||t.some((function(t,n){return t!==e[n]}))}function pe(e,t){return"function"==typeof t?t(e):t}function me(e,t){for(var n in t)e[n]=t[n];return e}function de(e,t){for(var n in e)if("__source"!==n&&!(n in t))return!0;for(var r in t)if("__source"!==r&&e[r]!==t[r])return!0;return!1}function ve(e){this.props=e}(ve.prototype=new w).isPureReactComponent=!0,ve.prototype.shouldComponentUpdate=function(e,t){return de(this.props,e)||de(this.state,t)};var he=s.__b;s.__b=function(e){e.type&&e.type.__f&&e.ref&&(e.props.ref=e.ref,e.ref=null),he&&he(e)};var ye="undefined"!=typeof Symbol&&Symbol.for&&Symbol.for("react.forward_ref")||3911;var _e=function(e,t){return null==e?null:C(C(e).map(t))},be={map:_e,forEach:_e,count:function(e){return e?C(e).length:0},only:function(e){var t=C(e);if(1!==t.length)throw"Children.only";return t[0]},toArray:C},ge=s.__e;function Se(){this.__u=0,this.t=null,this.__b=null}function Oe(e){var t=e.__.__c;return t&&t.__e&&t.__e(e)}function we(){this.u=null,this.o=null}s.__e=function(e,t,n){if(e.then)for(var r,o=t;o=o.__;)if((r=o.__c)&&r.__c)return null==t.__e&&(t.__e=n.__e,t.__k=n.__k),r.__c(e,t);ge(e,t,n)},(Se.prototype=new w).__c=function(e,t){var n=t.__c,r=this;null==r.t&&(r.t=[]),r.t.push(n);var o=Oe(r.__v),i=!1,c=function(){i||(i=!0,n.componentWillUnmount=n.__c,o?o(a):a())};n.__c=n.componentWillUnmount,n.componentWillUnmount=function(){c(),n.__c&&n.__c()};var a=function(){if(!--r.__u){if(r.state.__e){var e=r.state.__e;r.__v.__k[0]=function e(t,n,r){return t&&(t.__v=null,t.__k=t.__k&&t.__k.map((function(t){return e(t,n,r)})),t.__c&&t.__c.__P===n&&(t.__e&&r.insertBefore(t.__e,t.__d),t.__c.__e=!0,t.__c.__P=r)),t}(e,e.__c.__P,e.__c.__O)}var t;for(r.setState({__e:r.__b=null});t=r.t.pop();)t.forceUpdate()}},u=!0===t.__h;r.__u++||u||r.setState({__e:r.__b=r.__v.__k[0]}),e.then(c,c)},Se.prototype.componentWillUnmount=function(){this.t=[]},Se.prototype.render=function(e,t){if(this.__b){if(this.__v.__k){var n=document.createElement("div"),r=this.__v.__k[0].__c;this.__v.__k[0]=function e(t,n,r){return t&&(t.__c&&t.__c.__H&&(t.__c.__H.__.forEach((function(e){"function"==typeof e.__c&&e.__c()})),t.__c.__H=null),null!=(t=me({},t)).__c&&(t.__c.__P===r&&(t.__c.__P=n),t.__c=null),t.__k=t.__k&&t.__k.map((function(t){return e(t,n,r)}))),t}(this.__b,n,r.__O=r.__P)}this.__b=null}var o=t.__e&&g(O,null,e.fallback);return o&&(o.__h=null),[g(O,null,t.__e?null:e.children),o]};var Ee=function(e,t,n){if(++n[1]===n[0]&&e.o.delete(t),e.props.revealOrder&&("t"!==e.props.revealOrder[0]||!e.o.size))for(n=e.u;n;){for(;n.length>3;)n.pop()();if(n[1]<n[0])break;e.u=n=n[2]}};function je(e){return this.getChildContext=function(){return e.context},e.children}function Pe(e){var t=this,n=e.i;t.componentWillUnmount=function(){B(null,t.l),t.l=null,t.i=null},t.i&&t.i!==n&&t.componentWillUnmount(),e.__v?(t.l||(t.i=n,t.l={nodeType:1,parentNode:n,childNodes:[],appendChild:function(e){this.childNodes.push(e),t.i.appendChild(e)},insertBefore:function(e,n){this.childNodes.push(e),t.i.appendChild(e)},removeChild:function(e){this.childNodes.splice(this.childNodes.indexOf(e)>>>1,1),t.i.removeChild(e)}}),B(g(je,{context:t.context},e.__v),t.l)):t.l&&t.componentWillUnmount()}function Ie(e,t){return g(Pe,{__v:e,i:t})}(we.prototype=new w).__e=function(e){var t=this,n=Oe(t.__v),r=t.o.get(e);return r[0]++,function(o){var i=function(){t.props.revealOrder?(r.push(o),Ee(t,e,r)):o()};n?n(i):i()}},we.prototype.render=function(e){this.u=null,this.o=new Map;var t=C(e.children);e.revealOrder&&"b"===e.revealOrder[0]&&t.reverse();for(var n=t.length;n--;)this.o.set(t[n],this.u=[1,0,this.u]);return e.children},we.prototype.componentDidUpdate=we.prototype.componentDidMount=function(){var e=this;this.o.forEach((function(t,n){Ee(e,n,t)}))};var De="undefined"!=typeof Symbol&&Symbol.for&&Symbol.for("react.element")||60103,ke=/^(?:accent|alignment|arabic|baseline|cap|clip(?!PathU)|color|fill|flood|font|glyph(?!R)|horiz|marker(?!H|W|U)|overline|paint|stop|strikethrough|stroke|text(?!L)|underline|unicode|units|v|vector|vert|word|writing|x(?!C))[A-Z]/,Ce=function(e){return("undefined"!=typeof Symbol&&"symbol"==n(Symbol())?/fil|che|rad/i:/fil|che|ra/i).test(e)};function Ae(e,t,n){return null==t.__k&&(t.textContent=""),B(e,t),"function"==typeof n&&n(),e?e.__c:null}w.prototype.isReactComponent={},["componentWillMount","componentWillReceiveProps","componentWillUpdate"].forEach((function(e){Object.defineProperty(w.prototype,e,{configurable:!0,get:function(){return this["UNSAFE_"+e]},set:function(t){Object.defineProperty(this,e,{configurable:!0,writable:!0,value:t})}})}));var xe=s.event;function Ne(){}function Te(){return this.cancelBubble}function Re(){return this.defaultPrevented}s.event=function(e){return xe&&(e=xe(e)),e.persist=Ne,e.isPropagationStopped=Te,e.isDefaultPrevented=Re,e.nativeEvent=e};var qe,Le={configurable:!0,get:function(){return this.class}},Me=s.vnode;s.vnode=function(e){var t=e.type,n=e.props,r=n;if("string"==typeof t){for(var o in r={},n){var i=n[o];"value"===o&&"defaultValue"in n&&null==i||("defaultValue"===o&&"value"in n&&null==n.value?o="value":"download"===o&&!0===i?i="":/ondoubleclick/i.test(o)?o="ondblclick":/^onchange(textarea|input)/i.test(o+t)&&!Ce(n.type)?o="oninput":/^on(Ani|Tra|Tou|BeforeInp)/.test(o)?o=o.toLowerCase():ke.test(o)?o=o.replace(/[A-Z0-9]/,"-$&").toLowerCase():null===i&&(i=void 0),r[o]=i)}"select"==t&&r.multiple&&Array.isArray(r.value)&&(r.value=C(n.children).forEach((function(e){e.props.selected=-1!=r.value.indexOf(e.props.value)}))),"select"==t&&null!=r.defaultValue&&(r.value=C(n.children).forEach((function(e){e.props.selected=r.multiple?-1!=r.defaultValue.indexOf(e.props.value):r.defaultValue==e.props.value}))),e.props=r}t&&n.class!=n.className&&(Le.enumerable="className"in n,null!=n.className&&(r.class=n.className),Object.defineProperty(r,"className",Le)),e.$$typeof=De,Me&&Me(e)};var He=s.__r;s.__r=function(e){He&&He(e),qe=e.__c};var Ue={ReactCurrentDispatcher:{current:{readContext:function(e){return qe.__n[e.__c].props.value}}}};"object"==("undefined"==typeof performance?"undefined":n(performance))&&"function"==typeof performance.now&&performance.now.bind(performance);function Fe(e){return!!e&&e.$$typeof===De}var Be={useState:ne,useReducer:re,useEffect:oe,useLayoutEffect:ie,useRef:function(e){return $=5,ce((function(){return{current:e}}),[])},useImperativeHandle:function(e,t,n){$=6,ie((function(){"function"==typeof e?e(t()):e&&(e.current=t())}),null==n?n:n.concat(e))},useMemo:ce,useCallback:function(e,t){return $=8,ce((function(){return e}),t)},useContext:function(e){var t=z.context[e.__c],n=te(W++,9);return n.__c=e,t?(null==n.__&&(n.__=!0,t.sub(z)),t.props.value):e.__},useDebugValue:function(e,t){s.useDebugValue&&s.useDebugValue(t?t(e):e)},version:"16.8.0",Children:be,render:Ae,hydrate:function(e,t,n){return V(e,t),"function"==typeof n&&n(),e?e.__c:null},unmountComponentAtNode:function(e){return!!e.__k&&(B(null,e),!0)},createPortal:Ie,createElement:g,createContext:function(e,t){var n={__c:t="__cC"+d++,__:e,Consumer:function(e,t){return e.children(t)},Provider:function(e){var n,r;return this.getChildContext||(n=[],(r={})[t]=this,this.getChildContext=function(){return r},this.shouldComponentUpdate=function(e){this.props.value!==e.value&&n.some(P)},this.sub=function(e){n.push(e);var t=e.componentWillUnmount;e.componentWillUnmount=function(){n.splice(n.indexOf(e),1),t&&t.call(e)}}),e.children}};return n.Provider.__=n.Consumer.contextType=n},createFactory:function(e){return g.bind(null,e)},cloneElement:function(e){return Fe(e)?K.apply(null,arguments):e},createRef:function(){return{current:null}},Fragment:O,isValidElement:Fe,findDOMNode:function(e){return e&&(e.base||1===e.nodeType&&e)||null},Component:w,PureComponent:ve,memo:function(e,t){function n(e){var n=this.props.ref,r=n==e.ref;return!r&&n&&(n.call?n(null):n.current=null),t?!t(this.props,e)||!r:de(this.props,e)}function r(t){return this.shouldComponentUpdate=n,g(e,t)}return r.displayName="Memo("+(e.displayName||e.name)+")",r.prototype.isReactComponent=!0,r.__f=!0,r},forwardRef:function(e){function t(t,r){var o=me({},t);return delete o.ref,e(o,(r=t.ref||r)&&("object"!=n(r)||"current"in r)?r:null)}return t.$$typeof=ye,t.render=t,t.prototype.isReactComponent=t.__f=!0,t.displayName="ForwardRef("+(e.displayName||e.name)+")",t},unstable_batchedUpdates:function(e,t){return e(t)},StrictMode:O,Suspense:Se,SuspenseList:we,lazy:function(e){var t,n,r;function o(o){if(t||(t=e()).then((function(e){n=e.default||e}),(function(e){r=e})),r)throw r;if(!n)throw t;return g(n,o)}return o.displayName="Lazy",o.__f=!0,o},__SECRET_INTERNALS_DO_NOT_USE_OR_YOU_WILL_BE_FIRED:Ue},Ve=["facetName","facetQuery"];function Ke(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function We(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?Ke(Object(n),!0).forEach((function(t){ze(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):Ke(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function ze(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function Je(){return Je=Object.assign||function(e){for(var t=1;t<arguments.length;t++){var n=arguments[t];for(var r in n)Object.prototype.hasOwnProperty.call(n,r)&&(e[r]=n[r])}return e},Je.apply(this,arguments)}function $e(e,t){if(null==e)return{};var n,r,o=function(e,t){if(null==e)return{};var n,r,o={},i=Object.keys(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}function Ze(e,t){return function(e){if(Array.isArray(e))return e}(e)||function(e,t){var n=null==e?null:"undefined"!=typeof Symbol&&e[Symbol.iterator]||e["@@iterator"];if(null!=n){var r,o,i=[],c=!0,a=!1;try{for(n=n.call(e);!(c=(r=n.next()).done)&&(i.push(r.value),!t||i.length!==t);c=!0);}catch(e){a=!0,o=e}finally{try{c||null==n.return||n.return()}finally{if(a)throw o}}return i}}(e,t)||Qe(e,t)||function(){throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function Qe(e,t){if(e){if("string"==typeof e)return Ye(e,t);var n=Object.prototype.toString.call(e).slice(8,-1);return"Object"===n&&e.constructor&&(n=e.constructor.name),"Map"===n||"Set"===n?Array.from(e):"Arguments"===n||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)?Ye(e,t):void 0}}function Ye(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,r=new Array(t);n<t;n++)r[n]=e[n];return r}function Ge(){return Be.createElement("svg",{width:"15",height:"15",className:"DocSearch-Control-Key-Icon"},Be.createElement("path",{d:"M4.505 4.496h2M5.505 5.496v5M8.216 4.496l.055 5.993M10 7.5c.333.333.5.667.5 1v2M12.326 4.5v5.996M8.384 4.496c1.674 0 2.116 0 2.116 1.5s-.442 1.5-2.116 1.5M3.205 9.303c-.09.448-.277 1.21-1.241 1.203C1 10.5.5 9.513.5 8V7c0-1.57.5-2.5 1.464-2.494.964.006 1.134.598 1.24 1.342M12.553 10.5h1.953",strokeWidth:"1.2",stroke:"currentColor",fill:"none",strokeLinecap:"square"}))}function Xe(){return Be.createElement("svg",{width:"20",height:"20",className:"DocSearch-Search-Icon",viewBox:"0 0 20 20","aria-hidden":"true"},Be.createElement("path",{d:"M14.386 14.386l4.0877 4.0877-4.0877-4.0877c-2.9418 2.9419-7.7115 2.9419-10.6533 0-2.9419-2.9418-2.9419-7.7115 0-10.6533 2.9418-2.9419 7.7115-2.9419 10.6533 0 2.9419 2.9418 2.9419 7.7115 0 10.6533z",stroke:"currentColor",fill:"none",fillRule:"evenodd",strokeLinecap:"round",strokeLinejoin:"round"}))}var et=["translations"],tt=Be.forwardRef((function(e,t){var n=e.translations,r=void 0===n?{}:n,o=$e(e,et),i=r.buttonText,c=void 0===i?"Search":i,a=r.buttonAriaLabel,u=void 0===a?"Search":a,l=Ze(ne(null),2),s=l[0],f=l[1];return oe((function(){"undefined"!=typeof navigator&&(/(Mac|iPhone|iPod|iPad)/i.test(navigator.platform)?f("⌘"):f("Ctrl"))}),[]),Be.createElement("button",Je({type:"button",className:"DocSearch DocSearch-Button","aria-label":u},o,{ref:t}),Be.createElement("span",{className:"DocSearch-Button-Container"},Be.createElement(Xe,null),Be.createElement("span",{className:"DocSearch-Button-Placeholder"},c)),Be.createElement("span",{className:"DocSearch-Button-Keys"},null!==s&&Be.createElement(Be.Fragment,null,Be.createElement(nt,{reactsToKey:"Ctrl"===s?"Ctrl":"Meta"},"Ctrl"===s?Be.createElement(Ge,null):s),Be.createElement(nt,{reactsToKey:"k"},"K"))))}));function nt(e){var t=e.reactsToKey,n=e.children,r=Ze(ne(!1),2),o=r[0],i=r[1];return oe((function(){if(t)return window.addEventListener("keydown",e),window.addEventListener("keyup",n),function(){window.removeEventListener("keydown",e),window.removeEventListener("keyup",n)};function e(e){e.key===t&&i(!0)}function n(e){e.key!==t&&"Meta"!==e.key||i(!1)}}),[t]),Be.createElement("kbd",{className:o?"DocSearch-Button-Key DocSearch-Button-Key--pressed":"DocSearch-Button-Key"},n)}function rt(e,t){var n=void 0;return function(){for(var r=arguments.length,o=new Array(r),i=0;i<r;i++)o[i]=arguments[i];n&&clearTimeout(n),n=setTimeout((function(){return e.apply(void 0,o)}),t)}}function ot(e){return e.reduce((function(e,t){return e.concat(t)}),[])}var it=0;function ct(e){return 0===e.collections.length?0:e.collections.reduce((function(e,t){return e+t.items.length}),0)}function at(e){return e!==Object(e)}function ut(e,t){if(e===t)return!0;if(at(e)||at(t)||"function"==typeof e||"function"==typeof t)return e===t;if(Object.keys(e).length!==Object.keys(t).length)return!1;for(var n=0,r=Object.keys(e);n<r.length;n++){var o=r[n];if(!(o in t))return!1;if(!ut(e[o],t[o]))return!1}return!0}var lt=function(){},st=[{segment:"autocomplete-core",version:"1.9.3"}];function ft(e){var t=e.item,n=e.items;return{index:t.__autocomplete_indexName,items:[t],positions:[1+n.findIndex((function(e){return e.objectID===t.objectID}))],queryID:t.__autocomplete_queryID,algoliaSource:["autocomplete"]}}function pt(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,r=new Array(t);n<t;n++)r[n]=e[n];return r}var mt=["items"],dt=["items"];function vt(e){return vt="function"==typeof Symbol&&"symbol"==n(Symbol.iterator)?function(e){return n(e)}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":n(e)},vt(e)}function ht(e){return function(e){if(Array.isArray(e))return yt(e)}(e)||function(e){if("undefined"!=typeof Symbol&&null!=e[Symbol.iterator]||null!=e["@@iterator"])return Array.from(e)}(e)||function(e,t){if(e){if("string"==typeof e)return yt(e,t);var n=Object.prototype.toString.call(e).slice(8,-1);return"Object"===n&&e.constructor&&(n=e.constructor.name),"Map"===n||"Set"===n?Array.from(e):"Arguments"===n||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)?yt(e,t):void 0}}(e)||function(){throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function yt(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,r=new Array(t);n<t;n++)r[n]=e[n];return r}function _t(e,t){if(null==e)return{};var n,r,o=function(e,t){if(null==e)return{};var n,r,o={},i=Object.keys(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}function bt(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function gt(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?bt(Object(n),!0).forEach((function(t){St(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):bt(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function St(e,t,n){return(t=function(e){var t=function(e,t){if("object"!==vt(e)||null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t);if("object"!==vt(r))return r;throw new TypeError("@@toPrimitive must return a primitive value.")}return String(e)}(e,"string");return"symbol"===vt(t)?t:String(t)}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function Ot(e){for(var t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:20,n=[],r=0;r<e.objectIDs.length;r+=t)n.push(gt(gt({},e),{},{objectIDs:e.objectIDs.slice(r,r+t)}));return n}function wt(e){return e.map((function(e){var t=e.items,n=_t(e,mt);return gt(gt({},n),{},{objectIDs:(null==t?void 0:t.map((function(e){return e.objectID})))||n.objectIDs})}))}function Et(e){var t,n,r,o=(t=function(e,t){return function(e){if(Array.isArray(e))return e}(e)||function(e,t){var n=null==e?null:"undefined"!=typeof Symbol&&e[Symbol.iterator]||e["@@iterator"];if(null!=n){var r,o,i,c,a=[],u=!0,l=!1;try{if(i=(n=n.call(e)).next,0===t){if(Object(n)!==n)return;u=!1}else for(;!(u=(r=i.call(n)).done)&&(a.push(r.value),a.length!==t);u=!0);}catch(e){l=!0,o=e}finally{try{if(!u&&null!=n.return&&(c=n.return(),Object(c)!==c))return}finally{if(l)throw o}}return a}}(e,t)||function(e,t){if(e){if("string"==typeof e)return pt(e,t);var n=Object.prototype.toString.call(e).slice(8,-1);return"Object"===n&&e.constructor&&(n=e.constructor.name),"Map"===n||"Set"===n?Array.from(e):"Arguments"===n||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)?pt(e,t):void 0}}(e,t)||function(){throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}((e.version||"").split(".").map(Number),2),n=t[0],r=t[1],n>=3||2===n&&r>=4||1===n&&r>=10);function i(t,n,r){if(o&&void 0!==r){var i=r[0].__autocomplete_algoliaCredentials,c={"X-Algolia-Application-Id":i.appId,"X-Algolia-API-Key":i.apiKey};e.apply(void 0,[t].concat(ht(n),[{headers:c}]))}else e.apply(void 0,[t].concat(ht(n)))}return{init:function(t,n){e("init",{appId:t,apiKey:n})},setUserToken:function(t){e("setUserToken",t)},clickedObjectIDsAfterSearch:function(){for(var e=arguments.length,t=new Array(e),n=0;n<e;n++)t[n]=arguments[n];t.length>0&&i("clickedObjectIDsAfterSearch",wt(t),t[0].items)},clickedObjectIDs:function(){for(var e=arguments.length,t=new Array(e),n=0;n<e;n++)t[n]=arguments[n];t.length>0&&i("clickedObjectIDs",wt(t),t[0].items)},clickedFilters:function(){for(var t=arguments.length,n=new Array(t),r=0;r<t;r++)n[r]=arguments[r];n.length>0&&e.apply(void 0,["clickedFilters"].concat(n))},convertedObjectIDsAfterSearch:function(){for(var e=arguments.length,t=new Array(e),n=0;n<e;n++)t[n]=arguments[n];t.length>0&&i("convertedObjectIDsAfterSearch",wt(t),t[0].items)},convertedObjectIDs:function(){for(var e=arguments.length,t=new Array(e),n=0;n<e;n++)t[n]=arguments[n];t.length>0&&i("convertedObjectIDs",wt(t),t[0].items)},convertedFilters:function(){for(var t=arguments.length,n=new Array(t),r=0;r<t;r++)n[r]=arguments[r];n.length>0&&e.apply(void 0,["convertedFilters"].concat(n))},viewedObjectIDs:function(){for(var e=arguments.length,t=new Array(e),n=0;n<e;n++)t[n]=arguments[n];t.length>0&&t.reduce((function(e,t){var n=t.items,r=_t(t,dt);return[].concat(ht(e),ht(Ot(gt(gt({},r),{},{objectIDs:(null==n?void 0:n.map((function(e){return e.objectID})))||r.objectIDs})).map((function(e){return{items:n,payload:e}}))))}),[]).forEach((function(e){var t=e.items;return i("viewedObjectIDs",[e.payload],t)}))},viewedFilters:function(){for(var t=arguments.length,n=new Array(t),r=0;r<t;r++)n[r]=arguments[r];n.length>0&&e.apply(void 0,["viewedFilters"].concat(n))}}}function jt(e){var t=e.items.reduce((function(e,t){var n;return e[t.__autocomplete_indexName]=(null!==(n=e[t.__autocomplete_indexName])&&void 0!==n?n:[]).concat(t),e}),{});return Object.keys(t).map((function(e){return{index:e,items:t[e],algoliaSource:["autocomplete"]}}))}function Pt(e){return e.objectID&&e.__autocomplete_indexName&&e.__autocomplete_queryID}function It(e){return It="function"==typeof Symbol&&"symbol"==n(Symbol.iterator)?function(e){return n(e)}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":n(e)},It(e)}function Dt(e){return function(e){if(Array.isArray(e))return kt(e)}(e)||function(e){if("undefined"!=typeof Symbol&&null!=e[Symbol.iterator]||null!=e["@@iterator"])return Array.from(e)}(e)||function(e,t){if(e){if("string"==typeof e)return kt(e,t);var n=Object.prototype.toString.call(e).slice(8,-1);return"Object"===n&&e.constructor&&(n=e.constructor.name),"Map"===n||"Set"===n?Array.from(e):"Arguments"===n||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)?kt(e,t):void 0}}(e)||function(){throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function kt(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,r=new Array(t);n<t;n++)r[n]=e[n];return r}function Ct(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function At(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?Ct(Object(n),!0).forEach((function(t){xt(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):Ct(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function xt(e,t,n){return(t=function(e){var t=function(e,t){if("object"!==It(e)||null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t);if("object"!==It(r))return r;throw new TypeError("@@toPrimitive must return a primitive value.")}return String(e)}(e,"string");return"symbol"===It(t)?t:String(t)}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}var Nt="https://cdn.jsdelivr.net/npm/search-insights@".concat("2.6.0","/dist/search-insights.min.js"),Tt=rt((function(e){var t=e.onItemsChange,n=e.items,r=e.insights,o=e.state;t({insights:r,insightsEvents:jt({items:n}).map((function(e){return At({eventName:"Items Viewed"},e)})),state:o})}),400);function Rt(e){var t=function(e){return At({onItemsChange:function(e){var t=e.insights,n=e.insightsEvents;t.viewedObjectIDs.apply(t,Dt(n.map((function(e){return At(At({},e),{},{algoliaSource:[].concat(Dt(e.algoliaSource||[]),["autocomplete-internal"])})}))))},onSelect:function(e){var t=e.insights,n=e.insightsEvents;t.clickedObjectIDsAfterSearch.apply(t,Dt(n.map((function(e){return At(At({},e),{},{algoliaSource:[].concat(Dt(e.algoliaSource||[]),["autocomplete-internal"])})}))))},onActive:lt},e)}(e),n=t.insightsClient,r=t.onItemsChange,o=t.onSelect,i=t.onActive,c=n;n||"undefined"!=typeof window&&function(e){var t=e.window,n=t.AlgoliaAnalyticsObject||"aa";"string"==typeof n&&(c=t[n]),c||(t.AlgoliaAnalyticsObject=n,t[n]||(t[n]=function(){t[n].queue||(t[n].queue=[]);for(var e=arguments.length,r=new Array(e),o=0;o<e;o++)r[o]=arguments[o];t[n].queue.push(r)}),t[n].version="2.6.0",c=t[n],function(e){var t="[Autocomplete]: Could not load search-insights.js. Please load it manually following https://alg.li/insights-autocomplete";try{var n=e.document.createElement("script");n.async=!0,n.src=Nt,n.onerror=function(){console.error(t)},document.body.appendChild(n)}catch(e){console.error(t)}}(t))}({window:window});var a=Et(c),u={current:[]},l=rt((function(e){var t=e.state;if(t.isOpen){var n=t.collections.reduce((function(e,t){return[].concat(Dt(e),Dt(t.items))}),[]).filter(Pt);ut(u.current.map((function(e){return e.objectID})),n.map((function(e){return e.objectID})))||(u.current=n,n.length>0&&Tt({onItemsChange:r,items:n,insights:a,state:t}))}}),0);return{name:"aa.algoliaInsightsPlugin",subscribe:function(e){var t=e.setContext,n=e.onSelect,r=e.onActive;c("addAlgoliaAgent","insights-plugin"),t({algoliaInsightsPlugin:{__algoliaSearchParameters:{clickAnalytics:!0},insights:a}}),n((function(e){var t=e.item,n=e.state,r=e.event;Pt(t)&&o({state:n,event:r,insights:a,item:t,insightsEvents:[At({eventName:"Item Selected"},ft({item:t,items:u.current}))]})})),r((function(e){var t=e.item,n=e.state,r=e.event;Pt(t)&&i({state:n,event:r,insights:a,item:t,insightsEvents:[At({eventName:"Item Active"},ft({item:t,items:u.current}))]})}))},onStateChange:function(e){var t=e.state;l({state:t})},__autocomplete_pluginOptions:e}}function qt(e,t){var n=t;return{then:function(t,r){return qt(e.then(Mt(t,n,e),Mt(r,n,e)),n)},catch:function(t){return qt(e.catch(Mt(t,n,e)),n)},finally:function(t){return t&&n.onCancelList.push(t),qt(e.finally(Mt(t&&function(){return n.onCancelList=[],t()},n,e)),n)},cancel:function(){n.isCanceled=!0;var e=n.onCancelList;n.onCancelList=[],e.forEach((function(e){e()}))},isCanceled:function(){return!0===n.isCanceled}}}function Lt(e){return qt(e,{isCanceled:!1,onCancelList:[]})}function Mt(e,t,n){return e?function(n){return t.isCanceled?n:e(n)}:n}function Ht(e,t,n,r){if(!n)return null;if(e<0&&(null===t||null!==r&&0===t))return n+e;var o=(null===t?-1:t)+e;return o<=-1||o>=n?null===r?null:0:o}function Ut(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function Ft(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?Ut(Object(n),!0).forEach((function(t){Bt(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):Ut(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function Bt(e,t,n){return(t=function(e){var t=function(e,t){if("object"!==Vt(e)||null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t);if("object"!==Vt(r))return r;throw new TypeError("@@toPrimitive must return a primitive value.")}return String(e)}(e,"string");return"symbol"===Vt(t)?t:String(t)}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function Vt(e){return Vt="function"==typeof Symbol&&"symbol"==n(Symbol.iterator)?function(e){return n(e)}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":n(e)},Vt(e)}function Kt(e){var t=function(e){var t=e.collections.map((function(e){return e.items.length})).reduce((function(e,t,n){var r=(e[n-1]||0)+t;return e.push(r),e}),[]).reduce((function(t,n){return n<=e.activeItemId?t+1:t}),0);return e.collections[t]}(e);if(!t)return null;var n=t.items[function(e){for(var t=e.state,n=e.collection,r=!1,o=0,i=0;!1===r;){var c=t.collections[o];if(c===n){r=!0;break}i+=c.items.length,o++}return t.activeItemId-i}({state:e,collection:t})],r=t.source;return{item:n,itemInputValue:r.getItemInputValue({item:n,state:e}),itemUrl:r.getItemUrl({item:n,state:e}),source:r}}var Wt=/((gt|sm)-|galaxy nexus)|samsung[- ]|samsungbrowser/i;function zt(e){return zt="function"==typeof Symbol&&"symbol"==n(Symbol.iterator)?function(e){return n(e)}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":n(e)},zt(e)}function Jt(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function $t(e,t,n){return(t=function(e){var t=function(e,t){if("object"!==zt(e)||null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t);if("object"!==zt(r))return r;throw new TypeError("@@toPrimitive must return a primitive value.")}return String(e)}(e,"string");return"symbol"===zt(t)?t:String(t)}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function Zt(e){return Zt="function"==typeof Symbol&&"symbol"==n(Symbol.iterator)?function(e){return n(e)}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":n(e)},Zt(e)}function Qt(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function Yt(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?Qt(Object(n),!0).forEach((function(t){Gt(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):Qt(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function Gt(e,t,n){return(t=function(e){var t=function(e,t){if("object"!==Zt(e)||null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t);if("object"!==Zt(r))return r;throw new TypeError("@@toPrimitive must return a primitive value.")}return String(e)}(e,"string");return"symbol"===Zt(t)?t:String(t)}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function Xt(e){return Xt="function"==typeof Symbol&&"symbol"==n(Symbol.iterator)?function(e){return n(e)}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":n(e)},Xt(e)}function en(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,r=new Array(t);n<t;n++)r[n]=e[n];return r}function tn(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function nn(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?tn(Object(n),!0).forEach((function(t){rn(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):tn(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function rn(e,t,n){return(t=function(e){var t=function(e,t){if("object"!==Xt(e)||null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t);if("object"!==Xt(r))return r;throw new TypeError("@@toPrimitive must return a primitive value.")}return String(e)}(e,"string");return"symbol"===Xt(t)?t:String(t)}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function on(e,t){var n,r="undefined"!=typeof window?window:{},o=e.plugins||[];return nn(nn({debug:!1,openOnFocus:!1,placeholder:"",autoFocus:!1,defaultActiveItemId:null,stallThreshold:300,insights:!1,environment:r,shouldPanelOpen:function(e){return ct(e.state)>0},reshape:function(e){return e.sources}},e),{},{id:null!==(n=e.id)&&void 0!==n?n:"autocomplete-".concat(it++),plugins:o,initialState:nn({activeItemId:null,query:"",completion:null,collections:[],isOpen:!1,status:"idle",context:{}},e.initialState),onStateChange:function(t){var n;null===(n=e.onStateChange)||void 0===n||n.call(e,t),o.forEach((function(e){var n;return null===(n=e.onStateChange)||void 0===n?void 0:n.call(e,t)}))},onSubmit:function(t){var n;null===(n=e.onSubmit)||void 0===n||n.call(e,t),o.forEach((function(e){var n;return null===(n=e.onSubmit)||void 0===n?void 0:n.call(e,t)}))},onReset:function(t){var n;null===(n=e.onReset)||void 0===n||n.call(e,t),o.forEach((function(e){var n;return null===(n=e.onReset)||void 0===n?void 0:n.call(e,t)}))},getSources:function(n){return Promise.all([].concat(function(e){return function(e){if(Array.isArray(e))return en(e)}(e)||function(e){if("undefined"!=typeof Symbol&&null!=e[Symbol.iterator]||null!=e["@@iterator"])return Array.from(e)}(e)||function(e,t){if(e){if("string"==typeof e)return en(e,t);var n=Object.prototype.toString.call(e).slice(8,-1);return"Object"===n&&e.constructor&&(n=e.constructor.name),"Map"===n||"Set"===n?Array.from(e):"Arguments"===n||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)?en(e,t):void 0}}(e)||function(){throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}(o.map((function(e){return e.getSources}))),[e.getSources]).filter(Boolean).map((function(e){return function(e,t){var n=[];return Promise.resolve(e(t)).then((function(e){return Promise.all(e.filter((function(e){return Boolean(e)})).map((function(e){if(e.sourceId,n.includes(e.sourceId))throw new Error("[Autocomplete] The `sourceId` ".concat(JSON.stringify(e.sourceId)," is not unique."));n.push(e.sourceId);var t={getItemInputValue:function(e){return e.state.query},getItemUrl:function(){},onSelect:function(e){(0,e.setIsOpen)(!1)},onActive:lt,onResolve:lt};Object.keys(t).forEach((function(e){t[e].__default=!0}));var r=Ft(Ft({},t),e);return Promise.resolve(r)})))}))}(e,n)}))).then((function(e){return ot(e)})).then((function(e){return e.map((function(e){return nn(nn({},e),{},{onSelect:function(n){e.onSelect(n),t.forEach((function(e){var t;return null===(t=e.onSelect)||void 0===t?void 0:t.call(e,n)}))},onActive:function(n){e.onActive(n),t.forEach((function(e){var t;return null===(t=e.onActive)||void 0===t?void 0:t.call(e,n)}))},onResolve:function(n){e.onResolve(n),t.forEach((function(e){var t;return null===(t=e.onResolve)||void 0===t?void 0:t.call(e,n)}))}})}))}))},navigator:nn({navigate:function(e){var t=e.itemUrl;r.location.assign(t)},navigateNewTab:function(e){var t=e.itemUrl,n=r.open(t,"_blank","noopener");null==n||n.focus()},navigateNewWindow:function(e){var t=e.itemUrl;r.open(t,"_blank","noopener")}},e.navigator)})}function cn(e){return cn="function"==typeof Symbol&&"symbol"==n(Symbol.iterator)?function(e){return n(e)}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":n(e)},cn(e)}function an(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function un(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?an(Object(n),!0).forEach((function(t){ln(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):an(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function ln(e,t,n){return(t=function(e){var t=function(e,t){if("object"!==cn(e)||null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t);if("object"!==cn(r))return r;throw new TypeError("@@toPrimitive must return a primitive value.")}return String(e)}(e,"string");return"symbol"===cn(t)?t:String(t)}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function sn(e){return sn="function"==typeof Symbol&&"symbol"==n(Symbol.iterator)?function(e){return n(e)}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":n(e)},sn(e)}function fn(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function pn(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?fn(Object(n),!0).forEach((function(t){mn(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):fn(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function mn(e,t,n){return(t=function(e){var t=function(e,t){if("object"!==sn(e)||null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t);if("object"!==sn(r))return r;throw new TypeError("@@toPrimitive must return a primitive value.")}return String(e)}(e,"string");return"symbol"===sn(t)?t:String(t)}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function dn(e){return function(e){if(Array.isArray(e))return vn(e)}(e)||function(e){if("undefined"!=typeof Symbol&&null!=e[Symbol.iterator]||null!=e["@@iterator"])return Array.from(e)}(e)||function(e,t){if(e){if("string"==typeof e)return vn(e,t);var n=Object.prototype.toString.call(e).slice(8,-1);return"Object"===n&&e.constructor&&(n=e.constructor.name),"Map"===n||"Set"===n?Array.from(e):"Arguments"===n||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)?vn(e,t):void 0}}(e)||function(){throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}function vn(e,t){(null==t||t>e.length)&&(t=e.length);for(var n=0,r=new Array(t);n<t;n++)r[n]=e[n];return r}function hn(e){return Boolean(e.execute)}function yn(e){var t=e.reduce((function(e,t){if(!hn(t))return e.push(t),e;var n=t.searchClient,r=t.execute,o=t.requesterId,i=t.requests,c=e.find((function(e){return hn(t)&&hn(e)&&e.searchClient===n&&Boolean(o)&&e.requesterId===o}));if(c){var a;(a=c.items).push.apply(a,dn(i))}else{var u={execute:r,requesterId:o,items:i,searchClient:n};e.push(u)}return e}),[]).map((function(e){if(!hn(e))return Promise.resolve(e);var t=e,n=t.execute,r=t.items;return n({searchClient:t.searchClient,requests:r})}));return Promise.all(t).then((function(e){return ot(e)}))}function _n(e){return _n="function"==typeof Symbol&&"symbol"==n(Symbol.iterator)?function(e){return n(e)}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":n(e)},_n(e)}var bn=["event","nextState","props","query","refresh","store"];function gn(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function Sn(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?gn(Object(n),!0).forEach((function(t){On(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):gn(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function On(e,t,n){return(t=function(e){var t=function(e,t){if("object"!==_n(e)||null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t);if("object"!==_n(r))return r;throw new TypeError("@@toPrimitive must return a primitive value.")}return String(e)}(e,"string");return"symbol"===_n(t)?t:String(t)}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}var wn,En,jn,Pn=null,In=(wn=-1,En=-1,jn=void 0,function(e){var t=++wn;return Promise.resolve(e).then((function(e){return jn&&t<En?jn:(En=t,jn=e,e)}))});function Dn(e){var t=e.event,n=e.nextState,r=void 0===n?{}:n,o=e.props,i=e.query,c=e.refresh,a=e.store,u=function(e,t){if(null==e)return{};var n,r,o=function(e,t){if(null==e)return{};var n,r,o={},i=Object.keys(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}(e,bn);Pn&&o.environment.clearTimeout(Pn);var l=u.setCollections,s=u.setIsOpen,f=u.setQuery,p=u.setActiveItemId,m=u.setStatus;if(f(i),p(o.defaultActiveItemId),!i&&!1===o.openOnFocus){var d,v=a.getState().collections.map((function(e){return Sn(Sn({},e),{},{items:[]})}));m("idle"),l(v),s(null!==(d=r.isOpen)&&void 0!==d?d:o.shouldPanelOpen({state:a.getState()}));var h=Lt(In(v).then((function(){return Promise.resolve()})));return a.pendingRequests.add(h)}m("loading"),Pn=o.environment.setTimeout((function(){m("stalled")}),o.stallThreshold);var y=Lt(In(o.getSources(Sn({query:i,refresh:c,state:a.getState()},u)).then((function(e){return Promise.all(e.map((function(e){return Promise.resolve(e.getItems(Sn({query:i,refresh:c,state:a.getState()},u))).then((function(t){return function(e,t,n){if(o=e,Boolean(null==o?void 0:o.execute)){var r="algolia"===e.requesterId?Object.assign.apply(Object,[{}].concat(dn(Object.keys(n.context).map((function(e){var t;return null===(t=n.context[e])||void 0===t?void 0:t.__algoliaSearchParameters}))))):{};return pn(pn({},e),{},{requests:e.queries.map((function(n){return{query:"algolia"===e.requesterId?pn(pn({},n),{},{params:pn(pn({},r),n.params)}):n,sourceId:t,transformResponse:e.transformResponse}}))})}var o;return{items:e,sourceId:t}}(t,e.sourceId,a.getState())}))}))).then(yn).then((function(t){return function(e,t,n){return t.map((function(t){var r,o=e.filter((function(e){return e.sourceId===t.sourceId})),i=o.map((function(e){return e.items})),c=o[0].transformResponse,a=c?c({results:r=i,hits:r.map((function(e){return e.hits})).filter(Boolean),facetHits:r.map((function(e){var t;return null===(t=e.facetHits)||void 0===t?void 0:t.map((function(e){return{label:e.value,count:e.count,_highlightResult:{label:{value:e.highlighted}}}}))})).filter(Boolean)}):i;return t.onResolve({source:t,results:i,items:a,state:n.getState()}),a.every(Boolean),'The `getItems` function from source "'.concat(t.sourceId,'" must return an array of items but returned ').concat(JSON.stringify(void 0),".\n\nDid you forget to return items?\n\nSee: https://www.algolia.com/doc/ui-libraries/autocomplete/core-concepts/sources/#param-getitems"),{source:t,items:a}}))}(t,e,a)})).then((function(e){return function(e){var t=e.props,n=e.state,r=e.collections.reduce((function(e,t){return un(un({},e),{},ln({},t.source.sourceId,un(un({},t.source),{},{getItems:function(){return ot(t.items)}})))}),{}),o=t.plugins.reduce((function(e,t){return t.reshape?t.reshape(e):e}),{sourcesBySourceId:r,state:n}).sourcesBySourceId;return ot(t.reshape({sourcesBySourceId:o,sources:Object.values(o),state:n})).filter(Boolean).map((function(e){return{source:e,items:e.getItems()}}))}({collections:e,props:o,state:a.getState()})}))})))).then((function(e){var n;m("idle"),l(e);var f=o.shouldPanelOpen({state:a.getState()});s(null!==(n=r.isOpen)&&void 0!==n?n:o.openOnFocus&&!i&&f||f);var p=Kt(a.getState());if(null!==a.getState().activeItemId&&p){var d=p.item,v=p.itemInputValue,h=p.itemUrl,y=p.source;y.onActive(Sn({event:t,item:d,itemInputValue:v,itemUrl:h,refresh:c,source:y,state:a.getState()},u))}})).finally((function(){m("idle"),Pn&&o.environment.clearTimeout(Pn)}));return a.pendingRequests.add(y)}function kn(e){return kn="function"==typeof Symbol&&"symbol"==n(Symbol.iterator)?function(e){return n(e)}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":n(e)},kn(e)}var Cn=["event","props","refresh","store"];function An(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function xn(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?An(Object(n),!0).forEach((function(t){Nn(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):An(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function Nn(e,t,n){return(t=function(e){var t=function(e,t){if("object"!==kn(e)||null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t);if("object"!==kn(r))return r;throw new TypeError("@@toPrimitive must return a primitive value.")}return String(e)}(e,"string");return"symbol"===kn(t)?t:String(t)}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function Tn(e){return Tn="function"==typeof Symbol&&"symbol"==n(Symbol.iterator)?function(e){return n(e)}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":n(e)},Tn(e)}var Rn=["props","refresh","store"],qn=["inputElement","formElement","panelElement"],Ln=["inputElement"],Mn=["inputElement","maxLength"],Hn=["sourceIndex"],Un=["sourceIndex"],Fn=["item","source","sourceIndex"];function Bn(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function Vn(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?Bn(Object(n),!0).forEach((function(t){Kn(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):Bn(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function Kn(e,t,n){return(t=function(e){var t=function(e,t){if("object"!==Tn(e)||null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t);if("object"!==Tn(r))return r;throw new TypeError("@@toPrimitive must return a primitive value.")}return String(e)}(e,"string");return"symbol"===Tn(t)?t:String(t)}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function Wn(e,t){if(null==e)return{};var n,r,o=function(e,t){if(null==e)return{};var n,r,o={},i=Object.keys(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}function zn(e){var t=e.props,n=e.refresh,r=e.store,o=Wn(e,Rn),i=function(e,t){return void 0!==t?"".concat(e,"-").concat(t):e};return{getEnvironmentProps:function(e){var n=e.inputElement,o=e.formElement,i=e.panelElement;function c(e){!r.getState().isOpen&&r.pendingRequests.isEmpty()||e.target===n||!1===[o,i].some((function(t){return(n=t)===(r=e.target)||n.contains(r);var n,r}))&&(r.dispatch("blur",null),t.debug||r.pendingRequests.cancelAll())}return Vn({onTouchStart:c,onMouseDown:c,onTouchMove:function(e){!1!==r.getState().isOpen&&n===t.environment.document.activeElement&&e.target!==n&&n.blur()}},Wn(e,qn))},getRootProps:function(e){return Vn({role:"combobox","aria-expanded":r.getState().isOpen,"aria-haspopup":"listbox","aria-owns":r.getState().isOpen?"".concat(t.id,"-list"):void 0,"aria-labelledby":"".concat(t.id,"-label")},e)},getFormProps:function(e){return e.inputElement,Vn({action:"",noValidate:!0,role:"search",onSubmit:function(i){var c;i.preventDefault(),t.onSubmit(Vn({event:i,refresh:n,state:r.getState()},o)),r.dispatch("submit",null),null===(c=e.inputElement)||void 0===c||c.blur()},onReset:function(i){var c;i.preventDefault(),t.onReset(Vn({event:i,refresh:n,state:r.getState()},o)),r.dispatch("reset",null),null===(c=e.inputElement)||void 0===c||c.focus()}},Wn(e,Ln))},getLabelProps:function(e){var n=e||{},r=n.sourceIndex,o=Wn(n,Hn);return Vn({htmlFor:"".concat(i(t.id,r),"-input"),id:"".concat(i(t.id,r),"-label")},o)},getInputProps:function(e){var i;function c(e){(t.openOnFocus||Boolean(r.getState().query))&&Dn(Vn({event:e,props:t,query:r.getState().completion||r.getState().query,refresh:n,store:r},o)),r.dispatch("focus",null)}var a=e||{},u=(a.inputElement,a.maxLength),l=void 0===u?512:u,s=Wn(a,Mn),f=Kt(r.getState()),p=function(e){return Boolean(e&&e.match(Wt))}((null===(i=t.environment.navigator)||void 0===i?void 0:i.userAgent)||""),m=null!=f&&f.itemUrl&&!p?"go":"search";return Vn({"aria-autocomplete":"both","aria-activedescendant":r.getState().isOpen&&null!==r.getState().activeItemId?"".concat(t.id,"-item-").concat(r.getState().activeItemId):void 0,"aria-controls":r.getState().isOpen?"".concat(t.id,"-list"):void 0,"aria-labelledby":"".concat(t.id,"-label"),value:r.getState().completion||r.getState().query,id:"".concat(t.id,"-input"),autoComplete:"off",autoCorrect:"off",autoCapitalize:"off",enterKeyHint:m,spellCheck:"false",autoFocus:t.autoFocus,placeholder:t.placeholder,maxLength:l,type:"search",onChange:function(e){Dn(Vn({event:e,props:t,query:e.currentTarget.value.slice(0,l),refresh:n,store:r},o))},onKeyDown:function(e){!function(e){var t=e.event,n=e.props,r=e.refresh,o=e.store,i=function(e,t){if(null==e)return{};var n,r,o=function(e,t){if(null==e)return{};var n,r,o={},i=Object.keys(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||(o[n]=e[n]);return o}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(r=0;r<i.length;r++)n=i[r],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(o[n]=e[n])}return o}(e,Cn);if("ArrowUp"===t.key||"ArrowDown"===t.key){var c=function(){var e=n.environment.document.getElementById("".concat(n.id,"-item-").concat(o.getState().activeItemId));e&&(e.scrollIntoViewIfNeeded?e.scrollIntoViewIfNeeded(!1):e.scrollIntoView(!1))},a=function(){var e=Kt(o.getState());if(null!==o.getState().activeItemId&&e){var n=e.item,c=e.itemInputValue,a=e.itemUrl,u=e.source;u.onActive(xn({event:t,item:n,itemInputValue:c,itemUrl:a,refresh:r,source:u,state:o.getState()},i))}};t.preventDefault(),!1===o.getState().isOpen&&(n.openOnFocus||Boolean(o.getState().query))?Dn(xn({event:t,props:n,query:o.getState().query,refresh:r,store:o},i)).then((function(){o.dispatch(t.key,{nextActiveItemId:n.defaultActiveItemId}),a(),setTimeout(c,0)})):(o.dispatch(t.key,{}),a(),c())}else if("Escape"===t.key)t.preventDefault(),o.dispatch(t.key,null),o.pendingRequests.cancelAll();else if("Tab"===t.key)o.dispatch("blur",null),o.pendingRequests.cancelAll();else if("Enter"===t.key){if(null===o.getState().activeItemId||o.getState().collections.every((function(e){return 0===e.items.length})))return void(n.debug||o.pendingRequests.cancelAll());t.preventDefault();var u=Kt(o.getState()),l=u.item,s=u.itemInputValue,f=u.itemUrl,p=u.source;if(t.metaKey||t.ctrlKey)void 0!==f&&(p.onSelect(xn({event:t,item:l,itemInputValue:s,itemUrl:f,refresh:r,source:p,state:o.getState()},i)),n.navigator.navigateNewTab({itemUrl:f,item:l,state:o.getState()}));else if(t.shiftKey)void 0!==f&&(p.onSelect(xn({event:t,item:l,itemInputValue:s,itemUrl:f,refresh:r,source:p,state:o.getState()},i)),n.navigator.navigateNewWindow({itemUrl:f,item:l,state:o.getState()}));else if(t.altKey);else{if(void 0!==f)return p.onSelect(xn({event:t,item:l,itemInputValue:s,itemUrl:f,refresh:r,source:p,state:o.getState()},i)),void n.navigator.navigate({itemUrl:f,item:l,state:o.getState()});Dn(xn({event:t,nextState:{isOpen:!1},props:n,query:s,refresh:r,store:o},i)).then((function(){p.onSelect(xn({event:t,item:l,itemInputValue:s,itemUrl:f,refresh:r,source:p,state:o.getState()},i))}))}}}(Vn({event:e,props:t,refresh:n,store:r},o))},onFocus:c,onBlur:lt,onClick:function(n){e.inputElement!==t.environment.document.activeElement||r.getState().isOpen||c(n)}},s)},getPanelProps:function(e){return Vn({onMouseDown:function(e){e.preventDefault()},onMouseLeave:function(){r.dispatch("mouseleave",null)}},e)},getListProps:function(e){var n=e||{},r=n.sourceIndex,o=Wn(n,Un);return Vn({role:"listbox","aria-labelledby":"".concat(i(t.id,r),"-label"),id:"".concat(i(t.id,r),"-list")},o)},getItemProps:function(e){var c=e.item,a=e.source,u=e.sourceIndex,l=Wn(e,Fn);return Vn({id:"".concat(i(t.id,u),"-item-").concat(c.__autocomplete_id),role:"option","aria-selected":r.getState().activeItemId===c.__autocomplete_id,onMouseMove:function(e){if(c.__autocomplete_id!==r.getState().activeItemId){r.dispatch("mousemove",c.__autocomplete_id);var t=Kt(r.getState());if(null!==r.getState().activeItemId&&t){var i=t.item,a=t.itemInputValue,u=t.itemUrl,l=t.source;l.onActive(Vn({event:e,item:i,itemInputValue:a,itemUrl:u,refresh:n,source:l,state:r.getState()},o))}}},onMouseDown:function(e){e.preventDefault()},onClick:function(e){var i=a.getItemInputValue({item:c,state:r.getState()}),u=a.getItemUrl({item:c,state:r.getState()});(u?Promise.resolve():Dn(Vn({event:e,nextState:{isOpen:!1},props:t,query:i,refresh:n,store:r},o))).then((function(){a.onSelect(Vn({event:e,item:c,itemInputValue:i,itemUrl:u,refresh:n,source:a,state:r.getState()},o))}))}},l)}}}function Jn(e){return Jn="function"==typeof Symbol&&"symbol"==n(Symbol.iterator)?function(e){return n(e)}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":n(e)},Jn(e)}function $n(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function Zn(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?$n(Object(n),!0).forEach((function(t){Qn(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):$n(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function Qn(e,t,n){return(t=function(e){var t=function(e,t){if("object"!==Jn(e)||null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t);if("object"!==Jn(r))return r;throw new TypeError("@@toPrimitive must return a primitive value.")}return String(e)}(e,"string");return"symbol"===Jn(t)?t:String(t)}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function Yn(e){var t,n,r,o,i=e.plugins,c=e.options,a=null===(t=((null===(n=c.__autocomplete_metadata)||void 0===n?void 0:n.userAgents)||[])[0])||void 0===t?void 0:t.segment,u=a?Qn({},a,Object.keys((null===(r=c.__autocomplete_metadata)||void 0===r?void 0:r.options)||{})):{};return{plugins:i.map((function(e){return{name:e.name,options:Object.keys(e.__autocomplete_pluginOptions||[])}})),options:Zn({"autocomplete-core":Object.keys(c)},u),ua:st.concat((null===(o=c.__autocomplete_metadata)||void 0===o?void 0:o.userAgents)||[])}}function Gn(e){var t,n=e.state;return!1===n.isOpen||null===n.activeItemId?null:(null===(t=Kt(n))||void 0===t?void 0:t.itemInputValue)||null}function Xn(e){return Xn="function"==typeof Symbol&&"symbol"==n(Symbol.iterator)?function(e){return n(e)}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":n(e)},Xn(e)}function er(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function tr(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?er(Object(n),!0).forEach((function(t){nr(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):er(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function nr(e,t,n){return(t=function(e){var t=function(e,t){if("object"!==Xn(e)||null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t);if("object"!==Xn(r))return r;throw new TypeError("@@toPrimitive must return a primitive value.")}return String(e)}(e,"string");return"symbol"===Xn(t)?t:String(t)}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}var rr=function(e,t){switch(t.type){case"setActiveItemId":case"mousemove":return tr(tr({},e),{},{activeItemId:t.payload});case"setQuery":return tr(tr({},e),{},{query:t.payload,completion:null});case"setCollections":return tr(tr({},e),{},{collections:t.payload});case"setIsOpen":return tr(tr({},e),{},{isOpen:t.payload});case"setStatus":return tr(tr({},e),{},{status:t.payload});case"setContext":return tr(tr({},e),{},{context:tr(tr({},e.context),t.payload)});case"ArrowDown":var n=tr(tr({},e),{},{activeItemId:t.payload.hasOwnProperty("nextActiveItemId")?t.payload.nextActiveItemId:Ht(1,e.activeItemId,ct(e),t.props.defaultActiveItemId)});return tr(tr({},n),{},{completion:Gn({state:n})});case"ArrowUp":var r=tr(tr({},e),{},{activeItemId:Ht(-1,e.activeItemId,ct(e),t.props.defaultActiveItemId)});return tr(tr({},r),{},{completion:Gn({state:r})});case"Escape":return e.isOpen?tr(tr({},e),{},{activeItemId:null,isOpen:!1,completion:null}):tr(tr({},e),{},{activeItemId:null,query:"",status:"idle",collections:[]});case"submit":return tr(tr({},e),{},{activeItemId:null,isOpen:!1,status:"idle"});case"reset":return tr(tr({},e),{},{activeItemId:!0===t.props.openOnFocus?t.props.defaultActiveItemId:null,status:"idle",query:""});case"focus":return tr(tr({},e),{},{activeItemId:t.props.defaultActiveItemId,isOpen:(t.props.openOnFocus||Boolean(e.query))&&t.props.shouldPanelOpen({state:e})});case"blur":return t.props.debug?e:tr(tr({},e),{},{isOpen:!1,activeItemId:null});case"mouseleave":return tr(tr({},e),{},{activeItemId:t.props.defaultActiveItemId});default:return"The reducer action ".concat(JSON.stringify(t.type)," is not supported."),e}};function or(e){return or="function"==typeof Symbol&&"symbol"==n(Symbol.iterator)?function(e){return n(e)}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":n(e)},or(e)}function ir(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);t&&(r=r.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,r)}return n}function cr(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?ir(Object(n),!0).forEach((function(t){ar(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):ir(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function ar(e,t,n){return(t=function(e){var t=function(e,t){if("object"!==or(e)||null===e)return e;var n=e[Symbol.toPrimitive];if(void 0!==n){var r=n.call(e,t);if("object"!==or(r))return r;throw new TypeError("@@toPrimitive must return a primitive value.")}return String(e)}(e,"string");return"symbol"===or(t)?t:String(t)}(t))in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function ur(e){var t=[],n=on(e,t),r=function(e,t,n){var r,o=t.initialState;return{getState:function(){return o},dispatch:function(r,i){var c=function(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?Jt(Object(n),!0).forEach((function(t){$t(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):Jt(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}({},o);o=e(o,{type:r,props:t,payload:i}),n({state:o,prevState:c})},pendingRequests:(r=[],{add:function(e){return r.push(e),e.finally((function(){r=r.filter((function(t){return t!==e}))}))},cancelAll:function(){r.forEach((function(e){return e.cancel()}))},isEmpty:function(){return 0===r.length}})}}(rr,n,(function(e){var t=e.prevState,r=e.state;n.onStateChange(cr({prevState:t,state:r,refresh:c,navigator:n.navigator},o))})),o=function(e){var t=e.store;return{setActiveItemId:function(e){t.dispatch("setActiveItemId",e)},setQuery:function(e){t.dispatch("setQuery",e)},setCollections:function(e){var n=0,r=e.map((function(e){return Yt(Yt({},e),{},{items:ot(e.items).map((function(e){return Yt(Yt({},e),{},{__autocomplete_id:n++})}))})}));t.dispatch("setCollections",r)},setIsOpen:function(e){t.dispatch("setIsOpen",e)},setStatus:function(e){t.dispatch("setStatus",e)},setContext:function(e){t.dispatch("setContext",e)}}}({store:r}),i=zn(cr({props:n,refresh:c,store:r,navigator:n.navigator},o));function c(){return Dn(cr({event:new Event("input"),nextState:{isOpen:r.getState().isOpen},props:n,navigator:n.navigator,query:r.getState().query,refresh:c,store:r},o))}if(e.insights&&!n.plugins.some((function(e){return"aa.algoliaInsightsPlugin"===e.name}))){var a="boolean"==typeof e.insights?{}:e.insights;n.plugins.push(Rt(a))}return n.plugins.forEach((function(e){var r;return null===(r=e.subscribe)||void 0===r?void 0:r.call(e,cr(cr({},o),{},{navigator:n.navigator,refresh:c,onSelect:function(e){t.push({onSelect:e})},onActive:function(e){t.push({onActive:e})},onResolve:function(e){t.push({onResolve:e})}}))})),function(e){var t,n,r=e.metadata,o=e.environment;if(null===(t=o.navigator)||void 0===t||null===(n=t.userAgent)||void 0===n?void 0:n.includes("Algolia Crawler")){var i=o.document.createElement("meta"),c=o.document.querySelector("head");i.name="algolia:metadata",setTimeout((function(){i.content=JSON.stringify(r),c.appendChild(i)}),0)}}({metadata:Yn({plugins:n.plugins,options:e}),environment:n.environment}),cr(cr({refresh:c,navigator:n.navigator},i),o)}function lr(e){var t=e.translations,n=(void 0===t?{}:t).searchByText,r=void 0===n?"Search by":n;return Be.createElement("a",{href:"https://www.algolia.com/ref/docsearch/?utm_source=".concat(window.location.hostname,"&utm_medium=referral&utm_content=powered_by&utm_campaign=docsearch"),target:"_blank",rel:"noopener noreferrer"},Be.createElement("span",{className:"DocSearch-Label"},r),Be.createElement("svg",{width:"77",height:"19","aria-label":"Algolia",role:"img",id:"Layer_1",xmlns:"http://www.w3.org/2000/svg",viewBox:"0 0 2196.2 500"},Be.createElement("defs",null,Be.createElement("style",null,".cls-1,.cls-2{fill:#003dff;}.cls-2{fill-rule:evenodd;}")),Be.createElement("path",{className:"cls-2",d:"M1070.38,275.3V5.91c0-3.63-3.24-6.39-6.82-5.83l-50.46,7.94c-2.87,.45-4.99,2.93-4.99,5.84l.17,273.22c0,12.92,0,92.7,95.97,95.49,3.33,.1,6.09-2.58,6.09-5.91v-40.78c0-2.96-2.19-5.51-5.12-5.84-34.85-4.01-34.85-47.57-34.85-54.72Z"}),Be.createElement("rect",{className:"cls-1",x:"1845.88",y:"104.73",width:"62.58",height:"277.9",rx:"5.9",ry:"5.9"}),Be.createElement("path",{className:"cls-2",d:"M1851.78,71.38h50.77c3.26,0,5.9-2.64,5.9-5.9V5.9c0-3.62-3.24-6.39-6.82-5.83l-50.77,7.95c-2.87,.45-4.99,2.92-4.99,5.83v51.62c0,3.26,2.64,5.9,5.9,5.9Z"}),Be.createElement("path",{className:"cls-2",d:"M1764.03,275.3V5.91c0-3.63-3.24-6.39-6.82-5.83l-50.46,7.94c-2.87,.45-4.99,2.93-4.99,5.84l.17,273.22c0,12.92,0,92.7,95.97,95.49,3.33,.1,6.09-2.58,6.09-5.91v-40.78c0-2.96-2.19-5.51-5.12-5.84-34.85-4.01-34.85-47.57-34.85-54.72Z"}),Be.createElement("path",{className:"cls-2",d:"M1631.95,142.72c-11.14-12.25-24.83-21.65-40.78-28.31-15.92-6.53-33.26-9.85-52.07-9.85-18.78,0-36.15,3.17-51.92,9.85-15.59,6.66-29.29,16.05-40.76,28.31-11.47,12.23-20.38,26.87-26.76,44.03-6.38,17.17-9.24,37.37-9.24,58.36,0,20.99,3.19,36.87,9.55,54.21,6.38,17.32,15.14,32.11,26.45,44.36,11.29,12.23,24.83,21.62,40.6,28.46,15.77,6.83,40.12,10.33,52.4,10.48,12.25,0,36.78-3.82,52.7-10.48,15.92-6.68,29.46-16.23,40.78-28.46,11.29-12.25,20.05-27.04,26.25-44.36,6.22-17.34,9.24-33.22,9.24-54.21,0-20.99-3.34-41.19-10.03-58.36-6.38-17.17-15.14-31.8-26.43-44.03Zm-44.43,163.75c-11.47,15.75-27.56,23.7-48.09,23.7-20.55,0-36.63-7.8-48.1-23.7-11.47-15.75-17.21-34.01-17.21-61.2,0-26.89,5.59-49.14,17.06-64.87,11.45-15.75,27.54-23.52,48.07-23.52,20.55,0,36.63,7.78,48.09,23.52,11.47,15.57,17.36,37.98,17.36,64.87,0,27.19-5.72,45.3-17.19,61.2Z"}),Be.createElement("path",{className:"cls-2",d:"M894.42,104.73h-49.33c-48.36,0-90.91,25.48-115.75,64.1-14.52,22.58-22.99,49.63-22.99,78.73,0,44.89,20.13,84.92,51.59,111.1,2.93,2.6,6.05,4.98,9.31,7.14,12.86,8.49,28.11,13.47,44.52,13.47,1.23,0,2.46-.03,3.68-.09,.36-.02,.71-.05,1.07-.07,.87-.05,1.75-.11,2.62-.2,.34-.03,.68-.08,1.02-.12,.91-.1,1.82-.21,2.73-.34,.21-.03,.42-.07,.63-.1,32.89-5.07,61.56-30.82,70.9-62.81v57.83c0,3.26,2.64,5.9,5.9,5.9h50.42c3.26,0,5.9-2.64,5.9-5.9V110.63c0-3.26-2.64-5.9-5.9-5.9h-56.32Zm0,206.92c-12.2,10.16-27.97,13.98-44.84,15.12-.16,.01-.33,.03-.49,.04-1.12,.07-2.24,.1-3.36,.1-42.24,0-77.12-35.89-77.12-79.37,0-10.25,1.96-20.01,5.42-28.98,11.22-29.12,38.77-49.74,71.06-49.74h49.33v142.83Z"}),Be.createElement("path",{className:"cls-2",d:"M2133.97,104.73h-49.33c-48.36,0-90.91,25.48-115.75,64.1-14.52,22.58-22.99,49.63-22.99,78.73,0,44.89,20.13,84.92,51.59,111.1,2.93,2.6,6.05,4.98,9.31,7.14,12.86,8.49,28.11,13.47,44.52,13.47,1.23,0,2.46-.03,3.68-.09,.36-.02,.71-.05,1.07-.07,.87-.05,1.75-.11,2.62-.2,.34-.03,.68-.08,1.02-.12,.91-.1,1.82-.21,2.73-.34,.21-.03,.42-.07,.63-.1,32.89-5.07,61.56-30.82,70.9-62.81v57.83c0,3.26,2.64,5.9,5.9,5.9h50.42c3.26,0,5.9-2.64,5.9-5.9V110.63c0-3.26-2.64-5.9-5.9-5.9h-56.32Zm0,206.92c-12.2,10.16-27.97,13.98-44.84,15.12-.16,.01-.33,.03-.49,.04-1.12,.07-2.24,.1-3.36,.1-42.24,0-77.12-35.89-77.12-79.37,0-10.25,1.96-20.01,5.42-28.98,11.22-29.12,38.77-49.74,71.06-49.74h49.33v142.83Z"}),Be.createElement("path",{className:"cls-2",d:"M1314.05,104.73h-49.33c-48.36,0-90.91,25.48-115.75,64.1-11.79,18.34-19.6,39.64-22.11,62.59-.58,5.3-.88,10.68-.88,16.14s.31,11.15,.93,16.59c4.28,38.09,23.14,71.61,50.66,94.52,2.93,2.6,6.05,4.98,9.31,7.14,12.86,8.49,28.11,13.47,44.52,13.47h0c17.99,0,34.61-5.93,48.16-15.97,16.29-11.58,28.88-28.54,34.48-47.75v50.26h-.11v11.08c0,21.84-5.71,38.27-17.34,49.36-11.61,11.08-31.04,16.63-58.25,16.63-11.12,0-28.79-.59-46.6-2.41-2.83-.29-5.46,1.5-6.27,4.22l-12.78,43.11c-1.02,3.46,1.27,7.02,4.83,7.53,21.52,3.08,42.52,4.68,54.65,4.68,48.91,0,85.16-10.75,108.89-32.21,21.48-19.41,33.15-48.89,35.2-88.52V110.63c0-3.26-2.64-5.9-5.9-5.9h-56.32Zm0,64.1s.65,139.13,0,143.36c-12.08,9.77-27.11,13.59-43.49,14.7-.16,.01-.33,.03-.49,.04-1.12,.07-2.24,.1-3.36,.1-1.32,0-2.63-.03-3.94-.1-40.41-2.11-74.52-37.26-74.52-79.38,0-10.25,1.96-20.01,5.42-28.98,11.22-29.12,38.77-49.74,71.06-49.74h49.33Z"}),Be.createElement("path",{className:"cls-1",d:"M249.83,0C113.3,0,2,110.09,.03,246.16c-2,138.19,110.12,252.7,248.33,253.5,42.68,.25,83.79-10.19,120.3-30.03,3.56-1.93,4.11-6.83,1.08-9.51l-23.38-20.72c-4.75-4.21-11.51-5.4-17.36-2.92-25.48,10.84-53.17,16.38-81.71,16.03-111.68-1.37-201.91-94.29-200.13-205.96,1.76-110.26,92-199.41,202.67-199.41h202.69V407.41l-115-102.18c-3.72-3.31-9.42-2.66-12.42,1.31-18.46,24.44-48.53,39.64-81.93,37.34-46.33-3.2-83.87-40.5-87.34-86.81-4.15-55.24,39.63-101.52,94-101.52,49.18,0,89.68,37.85,93.91,85.95,.38,4.28,2.31,8.27,5.52,11.12l29.95,26.55c3.4,3.01,8.79,1.17,9.63-3.3,2.16-11.55,2.92-23.58,2.07-35.92-4.82-70.34-61.8-126.93-132.17-131.26-80.68-4.97-148.13,58.14-150.27,137.25-2.09,77.1,61.08,143.56,138.19,145.26,32.19,.71,62.03-9.41,86.14-26.95l150.26,133.2c6.44,5.71,16.61,1.14,16.61-7.47V9.48C499.66,4.25,495.42,0,490.18,0H249.83Z"})))}function sr(e){return Be.createElement("svg",{width:"15",height:"15","aria-label":e.ariaLabel,role:"img"},Be.createElement("g",{fill:"none",stroke:"currentColor",strokeLinecap:"round",strokeLinejoin:"round",strokeWidth:"1.2"},e.children))}function fr(e){var t=e.translations,n=void 0===t?{}:t,r=n.selectText,o=void 0===r?"to select":r,i=n.selectKeyAriaLabel,c=void 0===i?"Enter key":i,a=n.navigateText,u=void 0===a?"to navigate":a,l=n.navigateUpKeyAriaLabel,s=void 0===l?"Arrow up":l,f=n.navigateDownKeyAriaLabel,p=void 0===f?"Arrow down":f,m=n.closeText,d=void 0===m?"to close":m,v=n.closeKeyAriaLabel,h=void 0===v?"Escape key":v,y=n.searchByText,_=void 0===y?"Search by":y;return Be.createElement(Be.Fragment,null,Be.createElement("div",{className:"DocSearch-Logo"},Be.createElement(lr,{translations:{searchByText:_}})),Be.createElement("ul",{className:"DocSearch-Commands"},Be.createElement("li",null,Be.createElement("kbd",{className:"DocSearch-Commands-Key"},Be.createElement(sr,{ariaLabel:c},Be.createElement("path",{d:"M12 3.53088v3c0 1-1 2-2 2H4M7 11.53088l-3-3 3-3"}))),Be.createElement("span",{className:"DocSearch-Label"},o)),Be.createElement("li",null,Be.createElement("kbd",{className:"DocSearch-Commands-Key"},Be.createElement(sr,{ariaLabel:p},Be.createElement("path",{d:"M7.5 3.5v8M10.5 8.5l-3 3-3-3"}))),Be.createElement("kbd",{className:"DocSearch-Commands-Key"},Be.createElement(sr,{ariaLabel:s},Be.createElement("path",{d:"M7.5 11.5v-8M10.5 6.5l-3-3-3 3"}))),Be.createElement("span",{className:"DocSearch-Label"},u)),Be.createElement("li",null,Be.createElement("kbd",{className:"DocSearch-Commands-Key"},Be.createElement(sr,{ariaLabel:h},Be.createElement("path",{d:"M13.6167 8.936c-.1065.3583-.6883.962-1.4875.962-.7993 0-1.653-.9165-1.653-2.1258v-.5678c0-1.2548.7896-2.1016 1.653-2.1016.8634 0 1.3601.4778 1.4875 1.0724M9 6c-.1352-.4735-.7506-.9219-1.46-.8972-.7092.0246-1.344.57-1.344 1.2166s.4198.8812 1.3445.9805C8.465 7.3992 8.968 7.9337 9 8.5c.032.5663-.454 1.398-1.4595 1.398C6.6593 9.898 6 9 5.963 8.4851m-1.4748.5368c-.2635.5941-.8099.876-1.5443.876s-1.7073-.6248-1.7073-2.204v-.4603c0-1.0416.721-2.131 1.7073-2.131.9864 0 1.6425 1.031 1.5443 2.2492h-2.956"}))),Be.createElement("span",{className:"DocSearch-Label"},d))))}function pr(e){var t=e.hit,n=e.children;return Be.createElement("a",{href:t.url},n)}function mr(){return Be.createElement("svg",{viewBox:"0 0 38 38",stroke:"currentColor",strokeOpacity:".5"},Be.createElement("g",{fill:"none",fillRule:"evenodd"},Be.createElement("g",{transform:"translate(1 1)",strokeWidth:"2"},Be.createElement("circle",{strokeOpacity:".3",cx:"18",cy:"18",r:"18"}),Be.createElement("path",{d:"M36 18c0-9.94-8.06-18-18-18"},Be.createElement("animateTransform",{attributeName:"transform",type:"rotate",from:"0 18 18",to:"360 18 18",dur:"1s",repeatCount:"indefinite"})))))}function dr(){return Be.createElement("svg",{width:"20",height:"20",viewBox:"0 0 20 20"},Be.createElement("g",{stroke:"currentColor",fill:"none",fillRule:"evenodd",strokeLinecap:"round",strokeLinejoin:"round"},Be.createElement("path",{d:"M3.18 6.6a8.23 8.23 0 1112.93 9.94h0a8.23 8.23 0 01-11.63 0"}),Be.createElement("path",{d:"M6.44 7.25H2.55V3.36M10.45 6v5.6M10.45 11.6L13 13"})))}function vr(){return Be.createElement("svg",{width:"20",height:"20",viewBox:"0 0 20 20"},Be.createElement("path",{d:"M10 10l5.09-5.09L10 10l5.09 5.09L10 10zm0 0L4.91 4.91 10 10l-5.09 5.09L10 10z",stroke:"currentColor",fill:"none",fillRule:"evenodd",strokeLinecap:"round",strokeLinejoin:"round"}))}function hr(){return Be.createElement("svg",{className:"DocSearch-Hit-Select-Icon",width:"20",height:"20",viewBox:"0 0 20 20"},Be.createElement("g",{stroke:"currentColor",fill:"none",fillRule:"evenodd",strokeLinecap:"round",strokeLinejoin:"round"},Be.createElement("path",{d:"M18 3v4c0 2-2 4-4 4H2"}),Be.createElement("path",{d:"M8 17l-6-6 6-6"})))}var yr=function(){return Be.createElement("svg",{width:"20",height:"20",viewBox:"0 0 20 20"},Be.createElement("path",{d:"M17 6v12c0 .52-.2 1-1 1H4c-.7 0-1-.33-1-1V2c0-.55.42-1 1-1h8l5 5zM14 8h-3.13c-.51 0-.87-.34-.87-.87V4",stroke:"currentColor",fill:"none",fillRule:"evenodd",strokeLinejoin:"round"}))};function _r(e){switch(e.type){case"lvl1":return Be.createElement(yr,null);case"content":return Be.createElement(gr,null);default:return Be.createElement(br,null)}}function br(){return Be.createElement("svg",{width:"20",height:"20",viewBox:"0 0 20 20"},Be.createElement("path",{d:"M13 13h4-4V8H7v5h6v4-4H7V8H3h4V3v5h6V3v5h4-4v5zm-6 0v4-4H3h4z",stroke:"currentColor",fill:"none",fillRule:"evenodd",strokeLinecap:"round",strokeLinejoin:"round"}))}function gr(){return Be.createElement("svg",{width:"20",height:"20",viewBox:"0 0 20 20"},Be.createElement("path",{d:"M17 5H3h14zm0 5H3h14zm0 5H3h14z",stroke:"currentColor",fill:"none",fillRule:"evenodd",strokeLinejoin:"round"}))}function Sr(){return Be.createElement("svg",{width:"20",height:"20",viewBox:"0 0 20 20"},Be.createElement("path",{d:"M10 14.2L5 17l1-5.6-4-4 5.5-.7 2.5-5 2.5 5 5.6.8-4 4 .9 5.5z",stroke:"currentColor",fill:"none",fillRule:"evenodd",strokeLinejoin:"round"}))}function Or(){return Be.createElement("svg",{width:"40",height:"40",viewBox:"0 0 20 20",fill:"none",fillRule:"evenodd",stroke:"currentColor",strokeLinecap:"round",strokeLinejoin:"round"},Be.createElement("path",{d:"M19 4.8a16 16 0 00-2-1.2m-3.3-1.2A16 16 0 001.1 4.7M16.7 8a12 12 0 00-2.8-1.4M10 6a12 12 0 00-6.7 2M12.3 14.7a4 4 0 00-4.5 0M14.5 11.4A8 8 0 0010 10M3 16L18 2M10 18h0"}))}function wr(){return Be.createElement("svg",{width:"40",height:"40",viewBox:"0 0 20 20",fill:"none",fillRule:"evenodd",stroke:"currentColor",strokeLinecap:"round",strokeLinejoin:"round"},Be.createElement("path",{d:"M15.5 4.8c2 3 1.7 7-1 9.7h0l4.3 4.3-4.3-4.3a7.8 7.8 0 01-9.8 1m-2.2-2.2A7.8 7.8 0 0113.2 2.4M2 18L18 2"}))}function Er(e){var t=e.translations,n=void 0===t?{}:t,r=n.titleText,o=void 0===r?"Unable to fetch results":r,i=n.helpText,c=void 0===i?"You might want to check your network connection.":i;return Be.createElement("div",{className:"DocSearch-ErrorScreen"},Be.createElement("div",{className:"DocSearch-Screen-Icon"},Be.createElement(Or,null)),Be.createElement("p",{className:"DocSearch-Title"},o),Be.createElement("p",{className:"DocSearch-Help"},c))}var jr=["translations"];function Pr(e){var t=e.translations,n=void 0===t?{}:t,r=$e(e,jr),o=n.noResultsText,i=void 0===o?"No results for":o,c=n.suggestedQueryText,a=void 0===c?"Try searching for":c,u=n.reportMissingResultsText,l=void 0===u?"Believe this query should return results?":u,s=n.reportMissingResultsLinkText,f=void 0===s?"Let us know.":s,p=r.state.context.searchSuggestions;return Be.createElement("div",{className:"DocSearch-NoResults"},Be.createElement("div",{className:"DocSearch-Screen-Icon"},Be.createElement(wr,null)),Be.createElement("p",{className:"DocSearch-Title"},i,' "',Be.createElement("strong",null,r.state.query),'"'),p&&p.length>0&&Be.createElement("div",{className:"DocSearch-NoResults-Prefill-List"},Be.createElement("p",{className:"DocSearch-Help"},a,":"),Be.createElement("ul",null,p.slice(0,3).reduce((function(e,t){return[].concat(function(e){return function(e){if(Array.isArray(e))return Ye(e)}(e)||function(e){if("undefined"!=typeof Symbol&&null!=e[Symbol.iterator]||null!=e["@@iterator"])return Array.from(e)}(e)||Qe(e)||function(){throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}()}(e),[Be.createElement("li",{key:t},Be.createElement("button",{className:"DocSearch-Prefill",key:t,type:"button",onClick:function(){r.setQuery(t.toLowerCase()+" "),r.refresh(),r.inputRef.current.focus()}},t))])}),[]))),r.getMissingResultsUrl&&Be.createElement("p",{className:"DocSearch-Help"},"".concat(l," "),Be.createElement("a",{href:r.getMissingResultsUrl({query:r.state.query}),target:"_blank",rel:"noopener noreferrer"},f)))}var Ir=["hit","attribute","tagName"];function Dr(e,t){return t.split(".").reduce((function(e,t){return null!=e&&e[t]?e[t]:null}),e)}function kr(e){var t=e.hit,n=e.attribute,r=e.tagName;return g(void 0===r?"span":r,We(We({},$e(e,Ir)),{},{dangerouslySetInnerHTML:{__html:Dr(t,"_snippetResult.".concat(n,".value"))||Dr(t,n)}}))}function Cr(e){return e.collection&&0!==e.collection.items.length?Be.createElement("section",{className:"DocSearch-Hits"},Be.createElement("div",{className:"DocSearch-Hit-source"},e.title),Be.createElement("ul",e.getListProps(),e.collection.items.map((function(t,n){return Be.createElement(Ar,Je({key:[e.title,t.objectID].join(":"),item:t,index:n},e))})))):null}function Ar(e){var t=e.item,n=e.index,r=e.renderIcon,o=e.renderAction,i=e.getItemProps,c=e.onItemClick,a=e.collection,u=e.hitComponent,l=Ze(Be.useState(!1),2),s=l[0],f=l[1],p=Ze(Be.useState(!1),2),m=p[0],d=p[1],v=Be.useRef(null),h=u;return Be.createElement("li",Je({className:["DocSearch-Hit",t.__docsearch_parent&&"DocSearch-Hit--Child",s&&"DocSearch-Hit--deleting",m&&"DocSearch-Hit--favoriting"].filter(Boolean).join(" "),onTransitionEnd:function(){v.current&&v.current()}},i({item:t,source:a.source,onClick:function(e){c(t,e)}})),Be.createElement(h,{hit:t},Be.createElement("div",{className:"DocSearch-Hit-Container"},r({item:t,index:n}),t.hierarchy[t.type]&&"lvl1"===t.type&&Be.createElement("div",{className:"DocSearch-Hit-content-wrapper"},Be.createElement(kr,{className:"DocSearch-Hit-title",hit:t,attribute:"hierarchy.lvl1"}),t.content&&Be.createElement(kr,{className:"DocSearch-Hit-path",hit:t,attribute:"content"})),t.hierarchy[t.type]&&("lvl2"===t.type||"lvl3"===t.type||"lvl4"===t.type||"lvl5"===t.type||"lvl6"===t.type)&&Be.createElement("div",{className:"DocSearch-Hit-content-wrapper"},Be.createElement(kr,{className:"DocSearch-Hit-title",hit:t,attribute:"hierarchy.".concat(t.type)}),Be.createElement(kr,{className:"DocSearch-Hit-path",hit:t,attribute:"hierarchy.lvl1"})),"content"===t.type&&Be.createElement("div",{className:"DocSearch-Hit-content-wrapper"},Be.createElement(kr,{className:"DocSearch-Hit-title",hit:t,attribute:"content"}),Be.createElement(kr,{className:"DocSearch-Hit-path",hit:t,attribute:"hierarchy.lvl1"})),o({item:t,runDeleteTransition:function(e){f(!0),v.current=e},runFavoriteTransition:function(e){d(!0),v.current=e}}))))}function xr(e,t,n){return e.reduce((function(e,r){var o=t(r);return e.hasOwnProperty(o)||(e[o]=[]),e[o].length<(n||5)&&e[o].push(r),e}),{})}function Nr(e){return e}function Tr(e){return 1===e.button||e.altKey||e.ctrlKey||e.metaKey||e.shiftKey}function Rr(){}var qr=/(<mark>|<\/mark>)/g,Lr=RegExp(qr.source);function Mr(e){var t,n,r=e;if(!r.__docsearch_parent&&!e._highlightResult)return e.hierarchy.lvl0;var o=((r.__docsearch_parent?null===(t=r.__docsearch_parent)||void 0===t||null===(t=t._highlightResult)||void 0===t||null===(t=t.hierarchy)||void 0===t?void 0:t.lvl0:null===(n=e._highlightResult)||void 0===n||null===(n=n.hierarchy)||void 0===n?void 0:n.lvl0)||{}).value;return o&&Lr.test(o)?o.replace(qr,""):o}function Hr(e){return Be.createElement("div",{className:"DocSearch-Dropdown-Container"},e.state.collections.map((function(t){if(0===t.items.length)return null;var n=Mr(t.items[0]);return Be.createElement(Cr,Je({},e,{key:t.source.sourceId,title:n,collection:t,renderIcon:function(e){var n,r=e.item,o=e.index;return Be.createElement(Be.Fragment,null,r.__docsearch_parent&&Be.createElement("svg",{className:"DocSearch-Hit-Tree",viewBox:"0 0 24 54"},Be.createElement("g",{stroke:"currentColor",fill:"none",fillRule:"evenodd",strokeLinecap:"round",strokeLinejoin:"round"},r.__docsearch_parent!==(null===(n=t.items[o+1])||void 0===n?void 0:n.__docsearch_parent)?Be.createElement("path",{d:"M8 6v21M20 27H8.3"}):Be.createElement("path",{d:"M8 6v42M20 27H8.3"}))),Be.createElement("div",{className:"DocSearch-Hit-icon"},Be.createElement(_r,{type:r.type})))},renderAction:function(){return Be.createElement("div",{className:"DocSearch-Hit-action"},Be.createElement(hr,null))}}))})),e.resultsFooterComponent&&Be.createElement("section",{className:"DocSearch-HitsFooter"},Be.createElement(e.resultsFooterComponent,{state:e.state})))}var Ur=["translations"];function Fr(e){var t=e.translations,n=void 0===t?{}:t,r=$e(e,Ur),o=n.recentSearchesTitle,i=void 0===o?"Recent":o,c=n.noRecentSearchesText,a=void 0===c?"No recent searches":c,u=n.saveRecentSearchButtonTitle,l=void 0===u?"Save this search":u,s=n.removeRecentSearchButtonTitle,f=void 0===s?"Remove this search from history":s,p=n.favoriteSearchesTitle,m=void 0===p?"Favorite":p,d=n.removeFavoriteSearchButtonTitle,v=void 0===d?"Remove this search from favorites":d;return"idle"===r.state.status&&!1===r.hasCollections?r.disableUserPersonalization?null:Be.createElement("div",{className:"DocSearch-StartScreen"},Be.createElement("p",{className:"DocSearch-Help"},a)):!1===r.hasCollections?null:Be.createElement("div",{className:"DocSearch-Dropdown-Container"},Be.createElement(Cr,Je({},r,{title:i,collection:r.state.collections[0],renderIcon:function(){return Be.createElement("div",{className:"DocSearch-Hit-icon"},Be.createElement(dr,null))},renderAction:function(e){var t=e.item,n=e.runFavoriteTransition,o=e.runDeleteTransition;return Be.createElement(Be.Fragment,null,Be.createElement("div",{className:"DocSearch-Hit-action"},Be.createElement("button",{className:"DocSearch-Hit-action-button",title:l,type:"submit",onClick:function(e){e.preventDefault(),e.stopPropagation(),n((function(){r.favoriteSearches.add(t),r.recentSearches.remove(t),r.refresh()}))}},Be.createElement(Sr,null))),Be.createElement("div",{className:"DocSearch-Hit-action"},Be.createElement("button",{className:"DocSearch-Hit-action-button",title:f,type:"submit",onClick:function(e){e.preventDefault(),e.stopPropagation(),o((function(){r.recentSearches.remove(t),r.refresh()}))}},Be.createElement(vr,null))))}})),Be.createElement(Cr,Je({},r,{title:m,collection:r.state.collections[1],renderIcon:function(){return Be.createElement("div",{className:"DocSearch-Hit-icon"},Be.createElement(Sr,null))},renderAction:function(e){var t=e.item,n=e.runDeleteTransition;return Be.createElement("div",{className:"DocSearch-Hit-action"},Be.createElement("button",{className:"DocSearch-Hit-action-button",title:v,type:"submit",onClick:function(e){e.preventDefault(),e.stopPropagation(),n((function(){r.favoriteSearches.remove(t),r.refresh()}))}},Be.createElement(vr,null)))}})))}var Br=["translations"],Vr=Be.memo((function(e){var t=e.translations,n=void 0===t?{}:t,r=$e(e,Br);if("error"===r.state.status)return Be.createElement(Er,{translations:null==n?void 0:n.errorScreen});var o=r.state.collections.some((function(e){return e.items.length>0}));return r.state.query?!1===o?Be.createElement(Pr,Je({},r,{translations:null==n?void 0:n.noResultsScreen})):Be.createElement(Hr,r):Be.createElement(Fr,Je({},r,{hasCollections:o,translations:null==n?void 0:n.startScreen}))}),(function(e,t){return"loading"===t.state.status||"stalled"===t.state.status})),Kr=["translations"];function Wr(e){var t=e.translations,n=void 0===t?{}:t,r=$e(e,Kr),o=n.resetButtonTitle,i=void 0===o?"Clear the query":o,c=n.resetButtonAriaLabel,a=void 0===c?"Clear the query":c,u=n.cancelButtonText,l=void 0===u?"Cancel":u,s=n.cancelButtonAriaLabel,f=void 0===s?"Cancel":s,p=n.searchInputLabel,m=void 0===p?"Search":p,d=r.getFormProps({inputElement:r.inputRef.current}).onReset;return Be.useEffect((function(){r.autoFocus&&r.inputRef.current&&r.inputRef.current.focus()}),[r.autoFocus,r.inputRef]),Be.useEffect((function(){r.isFromSelection&&r.inputRef.current&&r.inputRef.current.select()}),[r.isFromSelection,r.inputRef]),Be.createElement(Be.Fragment,null,Be.createElement("form",{className:"DocSearch-Form",onSubmit:function(e){e.preventDefault()},onReset:d},Be.createElement("label",Je({className:"DocSearch-MagnifierLabel"},r.getLabelProps()),Be.createElement(Xe,null),Be.createElement("span",{className:"DocSearch-VisuallyHiddenForAccessibility"},m)),Be.createElement("div",{className:"DocSearch-LoadingIndicator"},Be.createElement(mr,null)),Be.createElement("input",Je({className:"DocSearch-Input",ref:r.inputRef},r.getInputProps({inputElement:r.inputRef.current,autoFocus:r.autoFocus,maxLength:64}))),Be.createElement("button",{type:"reset",title:i,className:"DocSearch-Reset","aria-label":a,hidden:!r.state.query},Be.createElement(vr,null))),Be.createElement("button",{className:"DocSearch-Cancel",type:"reset","aria-label":f,onClick:r.onClose},l))}var zr=["_highlightResult","_snippetResult"];function Jr(e){var t=e.key,n=e.limit,r=void 0===n?5:n,o=function(e){return!1===function(){var e="__TEST_KEY__";try{return localStorage.setItem(e,""),localStorage.removeItem(e),!0}catch(e){return!1}}()?{setItem:function(){},getItem:function(){return[]}}:{setItem:function(t){return window.localStorage.setItem(e,JSON.stringify(t))},getItem:function(){var t=window.localStorage.getItem(e);return t?JSON.parse(t):[]}}}(t),i=o.getItem().slice(0,r);return{add:function(e){var t=e,n=(t._highlightResult,t._snippetResult,$e(t,zr)),c=i.findIndex((function(e){return e.objectID===n.objectID}));c>-1&&i.splice(c,1),i.unshift(n),i=i.slice(0,r),o.setItem(i)},remove:function(e){i=i.filter((function(t){return t.objectID!==e.objectID})),o.setItem(i)},getAll:function(){return i}}}function $r(e){var t,n="algoliasearch-client-js-".concat(e.key),r=function(){return void 0===t&&(t=e.localStorage||window.localStorage),t},o=function(){return JSON.parse(r().getItem(n)||"{}")},i=function(e){r().setItem(n,JSON.stringify(e))};return{get:function(t,n){var r=arguments.length>2&&void 0!==arguments[2]?arguments[2]:{miss:function(){return Promise.resolve()}};return Promise.resolve().then((function(){!function(){var t=e.timeToLive?1e3*e.timeToLive:null,n=o(),r=Object.fromEntries(Object.entries(n).filter((function(e){return void 0!==c(e,2)[1].timestamp})));if(i(r),t){var a=Object.fromEntries(Object.entries(r).filter((function(e){var n=c(e,2)[1],r=(new Date).getTime();return!(n.timestamp+t<r)})));i(a)}}();var n=JSON.stringify(t);return o()[n]})).then((function(e){return Promise.all([e?e.value:n(),void 0!==e])})).then((function(e){var t=c(e,2),n=t[0],o=t[1];return Promise.all([n,o||r.miss(n)])})).then((function(e){return c(e,1)[0]}))},set:function(e,t){return Promise.resolve().then((function(){var i=o();return i[JSON.stringify(e)]={timestamp:(new Date).getTime(),value:t},r().setItem(n,JSON.stringify(i)),t}))},delete:function(e){return Promise.resolve().then((function(){var t=o();delete t[JSON.stringify(e)],r().setItem(n,JSON.stringify(t))}))},clear:function(){return Promise.resolve().then((function(){r().removeItem(n)}))}}}function Zr(e){var t=a(e.caches),n=t.shift();return void 0===n?{get:function(e,t){var n=arguments.length>2&&void 0!==arguments[2]?arguments[2]:{miss:function(){return Promise.resolve()}};return t().then((function(e){return Promise.all([e,n.miss(e)])})).then((function(e){return c(e,1)[0]}))},set:function(e,t){return Promise.resolve(t)},delete:function(e){return Promise.resolve()},clear:function(){return Promise.resolve()}}:{get:function(e,r){var o=arguments.length>2&&void 0!==arguments[2]?arguments[2]:{miss:function(){return Promise.resolve()}};return n.get(e,r,o).catch((function(){return Zr({caches:t}).get(e,r,o)}))},set:function(e,r){return n.set(e,r).catch((function(){return Zr({caches:t}).set(e,r)}))},delete:function(e){return n.delete(e).catch((function(){return Zr({caches:t}).delete(e)}))},clear:function(){return n.clear().catch((function(){return Zr({caches:t}).clear()}))}}}function Qr(){var e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:{serializable:!0},t={};return{get:function(n,r){var o=arguments.length>2&&void 0!==arguments[2]?arguments[2]:{miss:function(){return Promise.resolve()}},i=JSON.stringify(n);if(i in t)return Promise.resolve(e.serializable?JSON.parse(t[i]):t[i]);var c=r(),a=o&&o.miss||function(){return Promise.resolve()};return c.then((function(e){return a(e)})).then((function(){return c}))},set:function(n,r){return t[JSON.stringify(n)]=e.serializable?JSON.stringify(r):r,Promise.resolve(r)},delete:function(e){return delete t[JSON.stringify(e)],Promise.resolve()},clear:function(){return t={},Promise.resolve()}}}function Yr(e){for(var t=e.length-1;t>0;t--){var n=Math.floor(Math.random()*(t+1)),r=e[t];e[t]=e[n],e[n]=r}return e}function Gr(e,t){return t?(Object.keys(t).forEach((function(n){e[n]=t[n](e)})),e):e}function Xr(e){for(var t=arguments.length,n=new Array(t>1?t-1:0),r=1;r<t;r++)n[r-1]=arguments[r];var o=0;return e.replace(/%s/g,(function(){return encodeURIComponent(n[o++])}))}var eo=0,to=1;function no(e,t){var n=e||{},r=n.data||{};return Object.keys(n).forEach((function(e){-1===["timeout","headers","queryParameters","data","cacheable"].indexOf(e)&&(r[e]=n[e])})),{data:Object.entries(r).length>0?r:void 0,timeout:n.timeout||t,headers:n.headers||{},queryParameters:n.queryParameters||{},cacheable:n.cacheable}}var ro={Read:1,Write:2,Any:3};function oo(e){var n=arguments.length>1&&void 0!==arguments[1]?arguments[1]:1;return t(t({},e),{},{status:n,lastUpdate:Date.now()})}function io(e){return"string"==typeof e?{protocol:"https",url:e,accept:ro.Any}:{protocol:e.protocol||"https",url:e.url,accept:e.accept||ro.Any}}var co="GET",ao="POST";function uo(e,n,r,o){var i=[],c=function(e,n){if(e.method!==co&&(void 0!==e.data||void 0!==n.data)){var r=Array.isArray(e.data)?e.data:t(t({},e.data),n.data);return JSON.stringify(r)}}(r,o),u=function(e,n){var r=t(t({},e.headers),n.headers),o={};return Object.keys(r).forEach((function(e){var t=r[e];o[e.toLowerCase()]=t})),o}(e,o),l=r.method,s=r.method!==co?{}:t(t({},r.data),o.data),f=t(t(t({"x-algolia-agent":e.userAgent.value},e.queryParameters),s),o.queryParameters),p=0,m=function t(n,a){var s=n.pop();if(void 0===s)throw{name:"RetryError",message:"Unreachable hosts - your application id may be incorrect. If the error persists, contact support@algolia.com.",transporterStackTrace:po(i)};var m={data:c,headers:u,method:l,url:so(s,r.path,f),connectTimeout:a(p,e.timeouts.connect),responseTimeout:a(p,o.timeout)},d=function(e){var t={request:m,response:e,host:s,triesLeft:n.length};return i.push(t),t},v={onSuccess:function(e){return function(e){try{return JSON.parse(e.content)}catch(t){throw function(e,t){return{name:"DeserializationError",message:e,response:t}}(t.message,e)}}(e)},onRetry:function(r){var o=d(r);return r.isTimedOut&&p++,Promise.all([e.logger.info("Retryable failure",mo(o)),e.hostsCache.set(s,oo(s,r.isTimedOut?3:2))]).then((function(){return t(n,a)}))},onFail:function(e){throw d(e),function(e,t){var n=e.content,r=e.status,o=n;try{o=JSON.parse(n).message}catch(n){}return function(e,t,n){return{name:"ApiError",message:e,status:t,transporterStackTrace:n}}(o,r,t)}(e,po(i))}};return e.requester.send(m).then((function(e){return function(e,t){return function(e){var t=e.status;return e.isTimedOut||function(e){var t=e.isTimedOut,n=e.status;return!t&&0==~~n}(e)||2!=~~(t/100)&&4!=~~(t/100)}(e)?t.onRetry(e):(n=e,2==~~(n.status/100)?t.onSuccess(e):t.onFail(e));var n}(e,v)}))};return function(e,t){return Promise.all(t.map((function(t){return e.get(t,(function(){return Promise.resolve(oo(t))}))}))).then((function(e){var n=e.filter((function(e){return function(e){return 1===e.status||Date.now()-e.lastUpdate>12e4}(e)})),r=e.filter((function(e){return function(e){return 3===e.status&&Date.now()-e.lastUpdate<=12e4}(e)})),o=[].concat(a(n),a(r));return{getTimeout:function(e,t){return(0===r.length&&0===e?1:r.length+3+e)*t},statelessHosts:o.length>0?o.map((function(e){return io(e)})):t}}))}(e.hostsCache,n).then((function(e){return m(a(e.statelessHosts).reverse(),e.getTimeout)}))}function lo(e){var t={value:"Algolia for JavaScript (".concat(e,")"),add:function(e){var n="; ".concat(e.segment).concat(void 0!==e.version?" (".concat(e.version,")"):"");return-1===t.value.indexOf(n)&&(t.value="".concat(t.value).concat(n)),t}};return t}function so(e,t,n){var r=fo(n),o="".concat(e.protocol,"://").concat(e.url,"/").concat("/"===t.charAt(0)?t.substr(1):t);return r.length&&(o+="?".concat(r)),o}function fo(e){return Object.keys(e).map((function(t){return Xr("%s=%s",t,(n=e[t],"[object Object]"===Object.prototype.toString.call(n)||"[object Array]"===Object.prototype.toString.call(n)?JSON.stringify(e[t]):e[t]));var n})).join("&")}function po(e){return e.map((function(e){return mo(e)}))}function mo(e){var n=e.request.headers["x-algolia-api-key"]?{"x-algolia-api-key":"*****"}:{};return t(t({},e),{},{request:t(t({},e.request),{},{headers:t(t({},e.request.headers),n)})})}var vo=function(e){return function(t,n){return t.method===co?e.transporter.read(t,n):e.transporter.write(t,n)}},ho=function(e){return function(t){var n=arguments.length>1&&void 0!==arguments[1]?arguments[1]:{};return Gr({transporter:e.transporter,appId:e.appId,indexName:t},n.methods)}},yo=function(e){return function(n,r){var o=n.map((function(e){return t(t({},e),{},{params:fo(e.params||{})})}));return e.transporter.read({method:ao,path:"1/indexes/*/queries",data:{requests:o},cacheable:!0},r)}},_o=function(e){return function(n,r){return Promise.all(n.map((function(n){var o=n.params,c=o.facetName,a=o.facetQuery,u=i(o,Ve);return ho(e)(n.indexName,{methods:{searchForFacetValues:So}}).searchForFacetValues(c,a,t(t({},r),u))})))}},bo=function(e){return function(t,n,r){return e.transporter.read({method:ao,path:Xr("1/answers/%s/prediction",e.indexName),data:{query:t,queryLanguages:n},cacheable:!0},r)}},go=function(e){return function(t,n){return e.transporter.read({method:ao,path:Xr("1/indexes/%s/query",e.indexName),data:{query:t},cacheable:!0},n)}},So=function(e){return function(t,n,r){return e.transporter.read({method:ao,path:Xr("1/indexes/%s/facets/%s/query",e.indexName,t),data:{facetQuery:n},cacheable:!0},r)}};function Oo(e,n,r){var o={appId:e,apiKey:n,timeouts:{connect:1,read:2,write:30},requester:{send:function(e){return new Promise((function(t){var n=new XMLHttpRequest;n.open(e.method,e.url,!0),Object.keys(e.headers).forEach((function(t){return n.setRequestHeader(t,e.headers[t])}));var r,o=function(e,r){return setTimeout((function(){n.abort(),t({status:0,content:r,isTimedOut:!0})}),1e3*e)},i=o(e.connectTimeout,"Connection timeout");n.onreadystatechange=function(){n.readyState>n.OPENED&&void 0===r&&(clearTimeout(i),r=o(e.responseTimeout,"Socket timeout"))},n.onerror=function(){0===n.status&&(clearTimeout(i),clearTimeout(r),t({content:n.responseText||"Network request failed",status:n.status,isTimedOut:!1}))},n.onload=function(){clearTimeout(i),clearTimeout(r),t({content:n.responseText,status:n.status,isTimedOut:!1})},n.send(e.data)}))}},logger:(3,{debug:function(e,t){return Promise.resolve()},info:function(e,t){return Promise.resolve()},error:function(e,t){return console.error(e,t),Promise.resolve()}}),responsesCache:Qr(),requestsCache:Qr({serializable:!1}),hostsCache:Zr({caches:[$r({key:"4.19.1-".concat(e)}),Qr()]}),userAgent:lo("4.19.1").add({segment:"Browser",version:"lite"}),authMode:eo};return function(e){var n=e.appId,r=function(e,t,n){var r={"x-algolia-api-key":n,"x-algolia-application-id":t};return{headers:function(){return e===to?r:{}},queryParameters:function(){return e===eo?r:{}}}}(void 0!==e.authMode?e.authMode:to,n,e.apiKey),o=function(e){var t=e.hostsCache,n=e.logger,r=e.requester,o=e.requestsCache,i=e.responsesCache,a=e.timeouts,u=e.userAgent,l=e.hosts,s=e.queryParameters,f={hostsCache:t,logger:n,requester:r,requestsCache:o,responsesCache:i,timeouts:a,userAgent:u,headers:e.headers,queryParameters:s,hosts:l.map((function(e){return io(e)})),read:function(e,t){var n=no(t,f.timeouts.read),r=function(){return uo(f,f.hosts.filter((function(e){return 0!=(e.accept&ro.Read)})),e,n)};if(!0!==(void 0!==n.cacheable?n.cacheable:e.cacheable))return r();var o={request:e,mappedRequestOptions:n,transporter:{queryParameters:f.queryParameters,headers:f.headers}};return f.responsesCache.get(o,(function(){return f.requestsCache.get(o,(function(){return f.requestsCache.set(o,r()).then((function(e){return Promise.all([f.requestsCache.delete(o),e])}),(function(e){return Promise.all([f.requestsCache.delete(o),Promise.reject(e)])})).then((function(e){var t=c(e,2);return t[0],t[1]}))}))}),{miss:function(e){return f.responsesCache.set(o,e)}})},write:function(e,t){return uo(f,f.hosts.filter((function(e){return 0!=(e.accept&ro.Write)})),e,no(t,f.timeouts.write))}};return f}(t(t({hosts:[{url:"".concat(n,"-dsn.algolia.net"),accept:ro.Read},{url:"".concat(n,".algolia.net"),accept:ro.Write}].concat(Yr([{url:"".concat(n,"-1.algolianet.com")},{url:"".concat(n,"-2.algolianet.com")},{url:"".concat(n,"-3.algolianet.com")}]))},e),{},{headers:t(t({},r.headers()),{},{"content-type":"application/x-www-form-urlencoded"},e.headers),queryParameters:t(t({},r.queryParameters()),e.queryParameters)})),i={transporter:o,appId:n,addAlgoliaAgent:function(e,t){o.userAgent.add({segment:e,version:t})},clearCache:function(){return Promise.all([o.requestsCache.clear(),o.responsesCache.clear()]).then((function(){}))}};return Gr(i,e.methods)}(t(t(t({},o),r),{},{methods:{search:yo,searchForFacetValues:_o,multipleQueries:yo,multipleSearchForFacetValues:_o,customRequest:vo,initIndex:function(e){return function(t){return ho(e)(t,{methods:{search:go,searchForFacetValues:So,findAnswers:bo}})}}}}))}Oo.version="4.19.1";var wo=["footer","searchBox"];function Eo(e){var t=e.appId,n=e.apiKey,r=e.indexName,o=e.placeholder,i=void 0===o?"Search docs":o,c=e.searchParameters,a=e.maxResultsPerGroup,u=e.onClose,l=void 0===u?Rr:u,s=e.transformItems,f=void 0===s?Nr:s,p=e.hitComponent,m=void 0===p?pr:p,d=e.resultsFooterComponent,v=void 0===d?function(){return null}:d,h=e.navigator,y=e.initialScrollY,_=void 0===y?0:y,b=e.transformSearchClient,g=void 0===b?Nr:b,S=e.disableUserPersonalization,O=void 0!==S&&S,w=e.initialQuery,E=void 0===w?"":w,j=e.translations,P=void 0===j?{}:j,I=e.getMissingResultsUrl,D=e.insights,k=void 0!==D&&D,C=P.footer,A=P.searchBox,x=$e(P,wo),N=Ze(Be.useState({query:"",collections:[],completion:null,context:{},isOpen:!1,activeItemId:null,status:"idle"}),2),T=N[0],R=N[1],q=Be.useRef(null),L=Be.useRef(null),M=Be.useRef(null),H=Be.useRef(null),U=Be.useRef(null),F=Be.useRef(10),B=Be.useRef("undefined"!=typeof window?window.getSelection().toString().slice(0,64):"").current,V=Be.useRef(E||B).current,K=function(e,t,n){return Be.useMemo((function(){var r=Oo(e,t);return r.addAlgoliaAgent("docsearch","3.6.1"),!1===/docsearch.js \(.*\)/.test(r.transporter.userAgent.value)&&r.addAlgoliaAgent("docsearch-react","3.6.1"),n(r)}),[e,t,n])}(t,n,g),W=Be.useRef(Jr({key:"__DOCSEARCH_FAVORITE_SEARCHES__".concat(r),limit:10})).current,z=Be.useRef(Jr({key:"__DOCSEARCH_RECENT_SEARCHES__".concat(r),limit:0===W.getAll().length?7:4})).current,J=Be.useCallback((function(e){if(!O){var t="content"===e.type?e.__docsearch_parent:e;t&&-1===W.getAll().findIndex((function(e){return e.objectID===t.objectID}))&&z.add(t)}}),[W,z,O]),$=Be.useCallback((function(e){if(T.context.algoliaInsightsPlugin&&e.__autocomplete_id){var t=e,n={eventName:"Item Selected",index:t.__autocomplete_indexName,items:[t],positions:[e.__autocomplete_id],queryID:t.__autocomplete_queryID};T.context.algoliaInsightsPlugin.insights.clickedObjectIDsAfterSearch(n)}}),[T.context.algoliaInsightsPlugin]),Z=Be.useMemo((function(){return ur({id:"docsearch",defaultActiveItemId:0,placeholder:i,openOnFocus:!0,initialState:{query:V,context:{searchSuggestions:[]}},insights:k,navigator:h,onStateChange:function(e){R(e.state)},getSources:function(e){var o=e.query,i=e.state,u=e.setContext,s=e.setStatus;if(!o)return O?[]:[{sourceId:"recentSearches",onSelect:function(e){var t=e.item,n=e.event;J(t),Tr(n)||l()},getItemUrl:function(e){return e.item.url},getItems:function(){return z.getAll()}},{sourceId:"favoriteSearches",onSelect:function(e){var t=e.item,n=e.event;J(t),Tr(n)||l()},getItemUrl:function(e){return e.item.url},getItems:function(){return W.getAll()}}];var p=Boolean(k);return K.search([{query:o,indexName:r,params:We({attributesToRetrieve:["hierarchy.lvl0","hierarchy.lvl1","hierarchy.lvl2","hierarchy.lvl3","hierarchy.lvl4","hierarchy.lvl5","hierarchy.lvl6","content","type","url"],attributesToSnippet:["hierarchy.lvl1:".concat(F.current),"hierarchy.lvl2:".concat(F.current),"hierarchy.lvl3:".concat(F.current),"hierarchy.lvl4:".concat(F.current),"hierarchy.lvl5:".concat(F.current),"hierarchy.lvl6:".concat(F.current),"content:".concat(F.current)],snippetEllipsisText:"…",highlightPreTag:"<mark>",highlightPostTag:"</mark>",hitsPerPage:20,clickAnalytics:p},c)}]).catch((function(e){throw"RetryError"===e.name&&s("error"),e})).then((function(e){var o=e.results[0],c=o.hits,s=o.nbHits,m=xr(c,(function(e){return Mr(e)}),a);i.context.searchSuggestions.length<Object.keys(m).length&&u({searchSuggestions:Object.keys(m)}),u({nbHits:s});var d={};return p&&(d={__autocomplete_indexName:r,__autocomplete_queryID:o.queryID,__autocomplete_algoliaCredentials:{appId:t,apiKey:n}}),Object.values(m).map((function(e,t){return{sourceId:"hits".concat(t),onSelect:function(e){var t=e.item,n=e.event;J(t),Tr(n)||l()},getItemUrl:function(e){return e.item.url},getItems:function(){return Object.values(xr(e,(function(e){return e.hierarchy.lvl1}),a)).map(f).map((function(e){return e.map((function(t){var n=null,r=e.find((function(e){return"lvl1"===e.type&&e.hierarchy.lvl1===t.hierarchy.lvl1}));return"lvl1"!==t.type&&r&&(n=r),We(We({},t),{},{__docsearch_parent:n},d)}))})).flat()}}}))}))}})}),[r,c,a,K,l,z,W,J,V,i,h,f,O,k,t,n]),Q=Z.getEnvironmentProps,Y=Z.getRootProps,G=Z.refresh;return function(e){var t=e.getEnvironmentProps,n=e.panelElement,r=e.formElement,o=e.inputElement;Be.useEffect((function(){if(n&&r&&o){var e=t({panelElement:n,formElement:r,inputElement:o}),i=e.onTouchStart,c=e.onTouchMove;return window.addEventListener("touchstart",i),window.addEventListener("touchmove",c),function(){window.removeEventListener("touchstart",i),window.removeEventListener("touchmove",c)}}}),[t,n,r,o])}({getEnvironmentProps:Q,panelElement:H.current,formElement:M.current,inputElement:U.current}),function(e){var t=e.container;Be.useEffect((function(){if(t){var e=t.querySelectorAll("a[href]:not([disabled]), button:not([disabled]), input:not([disabled])"),n=e[0],r=e[e.length-1];return t.addEventListener("keydown",o),function(){t.removeEventListener("keydown",o)}}function o(e){"Tab"===e.key&&(e.shiftKey?document.activeElement===n&&(e.preventDefault(),r.focus()):document.activeElement===r&&(e.preventDefault(),n.focus()))}}),[t])}({container:q.current}),Be.useEffect((function(){return document.body.classList.add("DocSearch--active"),function(){var e,t;document.body.classList.remove("DocSearch--active"),null===(e=(t=window).scrollTo)||void 0===e||e.call(t,0,_)}}),[]),Be.useEffect((function(){window.matchMedia("(max-width: 768px)").matches&&(F.current=5)}),[]),Be.useEffect((function(){H.current&&(H.current.scrollTop=0)}),[T.query]),Be.useEffect((function(){V.length>0&&(G(),U.current&&U.current.focus())}),[V,G]),Be.useEffect((function(){function e(){if(L.current){var e=.01*window.innerHeight;L.current.style.setProperty("--docsearch-vh","".concat(e,"px"))}}return e(),window.addEventListener("resize",e),function(){window.removeEventListener("resize",e)}}),[]),Be.createElement("div",Je({ref:q},Y({"aria-expanded":!0}),{className:["DocSearch","DocSearch-Container","stalled"===T.status&&"DocSearch-Container--Stalled","error"===T.status&&"DocSearch-Container--Errored"].filter(Boolean).join(" "),role:"button",tabIndex:0,onMouseDown:function(e){e.target===e.currentTarget&&l()}}),Be.createElement("div",{className:"DocSearch-Modal",ref:L},Be.createElement("header",{className:"DocSearch-SearchBar",ref:M},Be.createElement(Wr,Je({},Z,{state:T,autoFocus:0===V.length,inputRef:U,isFromSelection:Boolean(V)&&V===B,translations:A,onClose:l}))),Be.createElement("div",{className:"DocSearch-Dropdown",ref:H},Be.createElement(Vr,Je({},Z,{indexName:r,state:T,hitComponent:m,resultsFooterComponent:v,disableUserPersonalization:O,recentSearches:z,favoriteSearches:W,inputRef:U,translations:x,getMissingResultsUrl:I,onItemClick:function(e,t){$(e),J(e),Tr(t)||l()}}))),Be.createElement("footer",{className:"DocSearch-Footer"},Be.createElement(fr,{translations:C}))))}function jo(e){var t,n,r=Be.useRef(null),o=Ze(Be.useState(!1),2),i=o[0],c=o[1],a=Ze(Be.useState((null==e?void 0:e.initialQuery)||void 0),2),u=a[0],l=a[1],s=Be.useCallback((function(){c(!0)}),[c]),f=Be.useCallback((function(){c(!1)}),[c]);return function(e){var t=e.isOpen,n=e.onOpen,r=e.onClose,o=e.onInput,i=e.searchButtonRef;Be.useEffect((function(){function e(e){var c;(27===e.keyCode&&t||"k"===(null===(c=e.key)||void 0===c?void 0:c.toLowerCase())&&(e.metaKey||e.ctrlKey)||!function(e){var t=e.target,n=t.tagName;return t.isContentEditable||"INPUT"===n||"SELECT"===n||"TEXTAREA"===n}(e)&&"/"===e.key&&!t)&&(e.preventDefault(),t?r():document.body.classList.contains("DocSearch--active")||document.body.classList.contains("DocSearch--active")||n()),i&&i.current===document.activeElement&&o&&/[a-zA-Z0-9]/.test(String.fromCharCode(e.keyCode))&&o(e)}return window.addEventListener("keydown",e),function(){window.removeEventListener("keydown",e)}}),[t,n,r,o,i])}({isOpen:i,onOpen:s,onClose:f,onInput:Be.useCallback((function(e){c(!0),l(e.key)}),[c,l]),searchButtonRef:r}),Be.createElement(Be.Fragment,null,Be.createElement(tt,{ref:r,translations:null==e||null===(t=e.translations)||void 0===t?void 0:t.button,onClick:s}),i&&Ie(Be.createElement(Eo,Je({},e,{initialScrollY:window.scrollY,initialQuery:u,translations:null==e||null===(n=e.translations)||void 0===n?void 0:n.modal,onClose:f})),document.body))}return function(e){Ae(Be.createElement(jo,o({},e,{transformSearchClient:function(t){return t.addAlgoliaAgent("docsearch.js","3.6.1"),e.transformSearchClient?e.transformSearchClient(t):t}})),function(e){var t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:window;return"string"==typeof e?t.document.querySelector(e):e}(e.container,e.environment))}}));
 //# sourceMappingURL=index.js.map
diff --git a/website/assets/images/articles/debunk-the-cross-platform-myth-600x521@2x.png b/website/assets/images/articles/debunk-the-cross-platform-myth-600x521@2x.png
new file mode 100644
index 0000000000..732c38a754
Binary files /dev/null and b/website/assets/images/articles/debunk-the-cross-platform-myth-600x521@2x.png differ
diff --git a/website/assets/images/articles/deploy-security-agents-1600x900@2x.png b/website/assets/images/articles/deploy-security-agents-1600x900@2x.png
new file mode 100644
index 0000000000..60d79cac6c
Binary files /dev/null and b/website/assets/images/articles/deploy-security-agents-1600x900@2x.png differ
diff --git a/website/assets/images/articles/discovering-chrome-ai-using-fleet-1-1472x370@2x.png b/website/assets/images/articles/discovering-chrome-ai-using-fleet-1-1472x370@2x.png
new file mode 100644
index 0000000000..6ff5d63033
Binary files /dev/null and b/website/assets/images/articles/discovering-chrome-ai-using-fleet-1-1472x370@2x.png differ
diff --git a/website/assets/images/articles/discovering-chrome-ai-using-fleet-1600x900@2x.jpg b/website/assets/images/articles/discovering-chrome-ai-using-fleet-1600x900@2x.jpg
new file mode 100644
index 0000000000..e86a679ec5
Binary files /dev/null and b/website/assets/images/articles/discovering-chrome-ai-using-fleet-1600x900@2x.jpg differ
diff --git a/website/assets/images/articles/discovering-chrome-ai-using-fleet-2-1474x276@2x.png b/website/assets/images/articles/discovering-chrome-ai-using-fleet-2-1474x276@2x.png
new file mode 100644
index 0000000000..bb0a530d3e
Binary files /dev/null and b/website/assets/images/articles/discovering-chrome-ai-using-fleet-2-1474x276@2x.png differ
diff --git a/website/assets/images/articles/fleet-4.55.0-1600x900@2x.png b/website/assets/images/articles/fleet-4.55.0-1600x900@2x.png
new file mode 100644
index 0000000000..6d5b25e8f6
Binary files /dev/null and b/website/assets/images/articles/fleet-4.55.0-1600x900@2x.png differ
diff --git a/website/assets/images/articles/fleet-4.56.0-1600x900@2x.png b/website/assets/images/articles/fleet-4.56.0-1600x900@2x.png
new file mode 100644
index 0000000000..697877bc6c
Binary files /dev/null and b/website/assets/images/articles/fleet-4.56.0-1600x900@2x.png differ
diff --git a/website/assets/images/articles/install-vpp-apps-on-macos-using-fleet-1600x900@2x.png b/website/assets/images/articles/install-vpp-apps-on-macos-using-fleet-1600x900@2x.png
new file mode 100644
index 0000000000..514b510e0b
Binary files /dev/null and b/website/assets/images/articles/install-vpp-apps-on-macos-using-fleet-1600x900@2x.png differ
diff --git a/website/assets/images/articles/seamless-mdm-migration-1600x900@2x.png b/website/assets/images/articles/seamless-mdm-migration-1600x900@2x.png
new file mode 100644
index 0000000000..abd44fa01f
Binary files /dev/null and b/website/assets/images/articles/seamless-mdm-migration-1600x900@2x.png differ
diff --git a/website/assets/images/articles/software-self-service-1600x900@2x.png b/website/assets/images/articles/software-self-service-1600x900@2x.png
new file mode 100644
index 0000000000..60d79cac6c
Binary files /dev/null and b/website/assets/images/articles/software-self-service-1600x900@2x.png differ
diff --git a/website/assets/images/continue-thumbnail.png b/website/assets/images/continue-thumbnail.png
deleted file mode 100644
index 4c3f8c39b8..0000000000
Binary files a/website/assets/images/continue-thumbnail.png and /dev/null differ
diff --git a/website/assets/images/cropped-fleet-cloud-city-504x784@2x.png b/website/assets/images/cropped-fleet-cloud-city-504x784@2x.png
new file mode 100644
index 0000000000..5f9c3c7aed
Binary files /dev/null and b/website/assets/images/cropped-fleet-cloud-city-504x784@2x.png differ
diff --git a/website/assets/images/cta-thumbnail-psystage-2-aware-128x128@2x.png b/website/assets/images/cta-thumbnail-psystage-2-aware-128x128@2x.png
new file mode 100644
index 0000000000..abca22f145
Binary files /dev/null and b/website/assets/images/cta-thumbnail-psystage-2-aware-128x128@2x.png differ
diff --git a/website/assets/images/cta-thumbnail-psystage-3-intrigued-128x128@2x.png b/website/assets/images/cta-thumbnail-psystage-3-intrigued-128x128@2x.png
new file mode 100644
index 0000000000..488291df40
Binary files /dev/null and b/website/assets/images/cta-thumbnail-psystage-3-intrigued-128x128@2x.png differ
diff --git a/website/assets/images/cta-thumbnail-psystage-4-has-use-case-128x128@2x.png b/website/assets/images/cta-thumbnail-psystage-4-has-use-case-128x128@2x.png
new file mode 100644
index 0000000000..c00066c408
Binary files /dev/null and b/website/assets/images/cta-thumbnail-psystage-4-has-use-case-128x128@2x.png differ
diff --git a/website/assets/images/cta-thumbnail-psystage-5-100x100@2x.png b/website/assets/images/cta-thumbnail-psystage-5-100x100@2x.png
new file mode 100644
index 0000000000..3fa69407ac
Binary files /dev/null and b/website/assets/images/cta-thumbnail-psystage-5-100x100@2x.png differ
diff --git a/website/assets/images/fleet-profile-image.png b/website/assets/images/fleet-profile-image.png
new file mode 100644
index 0000000000..3d28053398
Binary files /dev/null and b/website/assets/images/fleet-profile-image.png differ
diff --git a/website/assets/images/icon-chevron-fleet-black-75-12x12@2x.png b/website/assets/images/icon-chevron-fleet-black-75-12x12@2x.png
new file mode 100644
index 0000000000..c64bba4ca8
Binary files /dev/null and b/website/assets/images/icon-chevron-fleet-black-75-12x12@2x.png differ
diff --git a/website/assets/images/icon-copy-16x16@2x.png b/website/assets/images/icon-copy-16x16@2x.png
new file mode 100644
index 0000000000..7c2c83b4e8
Binary files /dev/null and b/website/assets/images/icon-copy-16x16@2x.png differ
diff --git a/website/assets/images/icon-copy-clicked-checkmark-32x32@2x.png b/website/assets/images/icon-copy-clicked-checkmark-32x32@2x.png
new file mode 100644
index 0000000000..faebb902aa
Binary files /dev/null and b/website/assets/images/icon-copy-clicked-checkmark-32x32@2x.png differ
diff --git a/website/assets/images/icon-form-success-12x12@2x.png b/website/assets/images/icon-form-success-12x12@2x.png
deleted file mode 100644
index d09d7c9214..0000000000
Binary files a/website/assets/images/icon-form-success-12x12@2x.png and /dev/null differ
diff --git a/website/assets/images/icon-form-success-16x16@2x.png b/website/assets/images/icon-form-success-16x16@2x.png
new file mode 100644
index 0000000000..dd0d96c99b
Binary files /dev/null and b/website/assets/images/icon-form-success-16x16@2x.png differ
diff --git a/website/assets/images/mdm-debunk-cross-platform-myth-528x377@2x.png b/website/assets/images/mdm-debunk-cross-platform-myth-528x377@2x.png
new file mode 100644
index 0000000000..62e14187e2
Binary files /dev/null and b/website/assets/images/mdm-debunk-cross-platform-myth-528x377@2x.png differ
diff --git a/website/assets/images/permanent/mdm-ade-migration-1024x500.png b/website/assets/images/permanent/mdm-ade-migration-1024x500.png
new file mode 100644
index 0000000000..461d1de9b6
Binary files /dev/null and b/website/assets/images/permanent/mdm-ade-migration-1024x500.png differ
diff --git a/website/assets/images/permanent/mdm-manual-migration-1024x500.png b/website/assets/images/permanent/mdm-manual-migration-1024x500.png
new file mode 100644
index 0000000000..f7700d4bde
Binary files /dev/null and b/website/assets/images/permanent/mdm-manual-migration-1024x500.png differ
diff --git a/website/assets/images/permanent/mdm-migration-pre-sonoma-unenroll-1024x500.png b/website/assets/images/permanent/mdm-migration-pre-sonoma-unenroll-1024x500.png
new file mode 100644
index 0000000000..993bcbd72e
Binary files /dev/null and b/website/assets/images/permanent/mdm-migration-pre-sonoma-unenroll-1024x500.png differ
diff --git a/website/assets/images/psystage-1-unaware-558x680@2x.png b/website/assets/images/psystage-1-unaware-558x680@2x.png
new file mode 100644
index 0000000000..af3cf08fcc
Binary files /dev/null and b/website/assets/images/psystage-1-unaware-558x680@2x.png differ
diff --git a/website/assets/images/psystage-2-aware-508x784@2x.png b/website/assets/images/psystage-2-aware-508x784@2x.png
new file mode 100644
index 0000000000..2f3d6b4b00
Binary files /dev/null and b/website/assets/images/psystage-2-aware-508x784@2x.png differ
diff --git a/website/assets/images/psystage-3-intrigued-558x680@2x.png b/website/assets/images/psystage-3-intrigued-558x680@2x.png
new file mode 100644
index 0000000000..c4759ba068
Binary files /dev/null and b/website/assets/images/psystage-3-intrigued-558x680@2x.png differ
diff --git a/website/assets/images/psystage-4-has-use-case-508x784@2x.png b/website/assets/images/psystage-4-has-use-case-508x784@2x.png
new file mode 100644
index 0000000000..74d52db71b
Binary files /dev/null and b/website/assets/images/psystage-4-has-use-case-508x784@2x.png differ
diff --git a/website/assets/images/psystage-6-has-team-buy-in-504x784@2x.png b/website/assets/images/psystage-6-has-team-buy-in-504x784@2x.png
new file mode 100644
index 0000000000..f601641ec4
Binary files /dev/null and b/website/assets/images/psystage-6-has-team-buy-in-504x784@2x.png differ
diff --git a/website/assets/js/pages/articles/articles.page.js b/website/assets/js/pages/articles/articles.page.js
index b4034386e9..8aa5dc2600 100644
--- a/website/assets/js/pages/articles/articles.page.js
+++ b/website/assets/js/pages/articles/articles.page.js
@@ -62,7 +62,22 @@ parasails.registerPage('articles', {
   },
 
   mounted: async function() {
-    //…
+    if(this.category === 'guides') {
+      if(this.algoliaPublicKey) {// Note: Docsearch will only be enabled if sails.config.custom.algoliaPublicKey is set. If the value is undefined, the handbook search will be disabled.
+        docsearch({
+          appId: 'NZXAYZXDGH',
+          apiKey: this.algoliaPublicKey,
+          indexName: 'fleetdm',
+          container: '#docsearch-query',
+          placeholder: 'Search',
+          debug: false,
+          clickAnalytics: true,
+          searchParameters: {
+            facetFilters: ['section:guides']
+          },
+        });
+      }
+    }
   },
 
   //  ╦╔╗╔╔╦╗╔═╗╦═╗╔═╗╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
diff --git a/website/assets/js/pages/articles/basic-article.page.js b/website/assets/js/pages/articles/basic-article.page.js
index 29112e45ac..8a15643666 100644
--- a/website/assets/js/pages/articles/basic-article.page.js
+++ b/website/assets/js/pages/articles/basic-article.page.js
@@ -25,6 +25,20 @@ parasails.registerPage('basic-article', {
       let startValue = parseInt(ol.getAttribute('start'), 10) - 1;
       ol.style.counterReset = 'custom-counter ' + startValue;
     });
+    if(this.algoliaPublicKey) {// Note: Docsearch will only be enabled if sails.config.custom.algoliaPublicKey is set. If the value is undefined, the handbook search will be disabled.
+      docsearch({
+        appId: 'NZXAYZXDGH',
+        apiKey: this.algoliaPublicKey,
+        indexName: 'fleetdm',
+        container: '#docsearch-query',
+        placeholder: 'Search',
+        debug: false,
+        clickAnalytics: true,
+        searchParameters: {
+          facetFilters: ['section:docs']
+        },
+      });
+    }
   },
 
   //  ╦╔╗╔╔╦╗╔═╗╦═╗╔═╗╔═╗╔╦╗╦╔═╗╔╗╔╔═╗
diff --git a/website/assets/js/pages/contact.page.js b/website/assets/js/pages/contact.page.js
index 36571b672a..c7595825ca 100644
--- a/website/assets/js/pages/contact.page.js
+++ b/website/assets/js/pages/contact.page.js
@@ -50,8 +50,8 @@ parasails.registerPage('contact', {
     if(this.formToShow === 'contact'){
       this.formToDisplay = this.formToShow;
     } else if(!this.primaryBuyingSituation){
-      // Default to contact form for users who have no primaryBuyingSituation set.
-      this.formToDisplay = 'contact';
+      // Otherwise, default to the formToShow value from the page's controller.
+      this.formToDisplay = this.formToShow;
     }
     if(this.primaryBuyingSituation){ // If the user has a priamry buying situation set in their sesssion, pre-fill the form.
       // Note: this will be overriden if the user is logged in and has a primaryBuyingSituation set in the database.
diff --git a/website/assets/js/pages/docs/basic-documentation.page.js b/website/assets/js/pages/docs/basic-documentation.page.js
index d09d42f605..1695eb613d 100644
--- a/website/assets/js/pages/docs/basic-documentation.page.js
+++ b/website/assets/js/pages/docs/basic-documentation.page.js
@@ -43,7 +43,7 @@ parasails.registerPage('basic-documentation', {
       return _.startsWith(page.url, '/docs');
     });
     this.pagesBySectionSlug = (() => {
-      const DOCS_SLUGS = ['get-started', 'deploy', 'using-fleet', 'configuration', 'rest-api'];
+      const DOCS_SLUGS = ['get-started', 'deploy', 'configuration', 'rest-api'];
       let sectionSlugs = _.uniq(this.pages.map((page) => page.url.split(/\//).slice(-2)[0]));
       let pagesBySectionSlug = {};
 
@@ -129,13 +129,11 @@ parasails.registerPage('basic-documentation', {
     // console.log(subtopics);
 
     this.subtopics = (() => {
-      let subtopics = $('#body-content').find('h2.markdown-heading').map((_, el) => el.innerText);
-      subtopics = $.makeArray(subtopics).map((title) => {
-        // Removing all apostrophes from the title to keep  _.kebabCase() from turning words like 'user’s' into 'user-s'
-        let kebabCaseFriendlyTitle = title.replace(/[\’\']/g, '');
+      let subtopics = $('#body-content').find('h2.markdown-heading').map((_, el) => el);
+      subtopics = $.makeArray(subtopics).map((subheading) => {
         return {
-          title,
-          url: '#' + _.kebabCase(kebabCaseFriendlyTitle.toLowerCase()),
+          title: subheading.innerText,
+          url: $(subheading).find('a.markdown-link').attr('href'),
         };
       });
       return subtopics;
@@ -258,22 +256,23 @@ parasails.registerPage('basic-documentation', {
       return this.pagesBySectionSlug[slug];
     },
 
-    findAndSortNavSectionsByUrl: function (url='') {
-      let NAV_SECTION_ORDER_BY_DOCS_SLUG = {
-        'using-fleet':['The basics', 'Device management', 'Vuln management', 'Security compliance', 'Osquery management', 'Dig deeper'],
-      };
-      let slug = _.last(url.split(/\//));
-      //
-      if(NAV_SECTION_ORDER_BY_DOCS_SLUG[slug]) {
-        let orderForThisSection = NAV_SECTION_ORDER_BY_DOCS_SLUG[slug];
-        let sortedSection = {};
-        orderForThisSection.map((section)=>{
-          sortedSection[section] = this.navSectionsByDocsSectionSlug[slug][section];
-        });
-        this.navSectionsByDocsSectionSlug[slug] = sortedSection;
-      }
-      return this.navSectionsByDocsSectionSlug[slug];
-    },
+    // FUTURE: remove this function if we do not add subsections to docs sections.
+    // findAndSortNavSectionsByUrl: function (url='') {
+    //   let NAV_SECTION_ORDER_BY_DOCS_SLUG = {
+    //     'using-fleet':['The basics', 'Device management', 'Vuln management', 'Security compliance', 'Osquery management', 'Dig deeper'],
+    //   };
+    //   let slug = _.last(url.split(/\//));
+    //   //
+    //   if(NAV_SECTION_ORDER_BY_DOCS_SLUG[slug]) {
+    //     let orderForThisSection = NAV_SECTION_ORDER_BY_DOCS_SLUG[slug];
+    //     let sortedSection = {};
+    //     orderForThisSection.map((section)=>{
+    //       sortedSection[section] = this.navSectionsByDocsSectionSlug[slug][section];
+    //     });
+    //     this.navSectionsByDocsSectionSlug[slug] = sortedSection;
+    //   }
+    //   return this.navSectionsByDocsSectionSlug[slug];
+    // },
 
     getActiveSubtopicClass: function (currentLocation, url) {
       return _.last(currentLocation.split(/#/)) === _.last(url.split(/#/)) ? 'active' : '';
diff --git a/website/assets/js/pages/fleetctl-preview.page.js b/website/assets/js/pages/fleetctl-preview.page.js
index 48dd281a4b..33938abf58 100644
--- a/website/assets/js/pages/fleetctl-preview.page.js
+++ b/website/assets/js/pages/fleetctl-preview.page.js
@@ -3,7 +3,20 @@ parasails.registerPage('fleetctl-preview', {
   //  ║║║║║ ║ ║╠═╣║    ╚═╗ ║ ╠═╣ ║ ║╣
   //  ╩╝╚╝╩ ╩ ╩╩ ╩╩═╝  ╚═╝ ╩ ╩ ╩ ╩ ╚═╝
   data: {
-    selectedPlatform: 'macos'
+    selectedPlatform: 'macos',
+    installCommands: {
+      macos: 'curl -sSL https://fleetdm.com/resources/install-fleetctl.sh | bash',
+      linux: 'curl -sSL https://fleetdm.com/resources/install-fleetctl.sh | bash',
+      windows: `for /f "tokens=1,* delims=:" %a in ('curl -s https://api.github.com/repos/fleetdm/fleet/releases/latest ^| findstr "browser_download_url" ^| findstr "_windows.zip"') do (curl -kOL %b) && if not exist "%USERPROFILE%\\.fleetctl" mkdir "%USERPROFILE%\\.fleetctl" && for /f "delims=" %a in ('dir /b fleetctl_*_windows.zip') do tar -xf "%a" --strip-components=1 -C "%USERPROFILE%\\.fleetctl" && del "%a"`,
+      npm: 'npm install fleetctl -g',
+    },
+    fleetctlPreviewTerminalCommand: {
+      macos: '~/.fleetctl/fleetctl preview',
+      linux: '~/.fleetctl/fleetctl preview',
+      windows: `%USERPROFILE%\\.fleetctl\\fleetctl preview`,
+      npm: 'fleetctl preview',
+    }
+
   },
 
   //  ╦  ╦╔═╗╔═╗╔═╗╦ ╦╔═╗╦  ╔═╗
@@ -20,6 +33,27 @@ parasails.registerPage('fleetctl-preview', {
   //  ║║║║ ║ ║╣ ╠╦╝╠═╣║   ║ ║║ ║║║║╚═╗
   //  ╩╝╚╝ ╩ ╚═╝╩╚═╩ ╩╚═╝ ╩ ╩╚═╝╝╚╝╚═╝
   methods: {
-    //…
+    clickCopyInstallCommand: async function(platform) {
+      let commandToInstallFleetctl = this.installCommands[platform];
+      // https://caniuse.com/mdn-api_clipboard_writetext
+      $('[purpose="install-copy-button"]').addClass('copied');
+      await setTimeout(()=>{
+        $('[purpose="install-copy-button"]').removeClass('copied');
+      }, 2000);
+      navigator.clipboard.writeText(commandToInstallFleetctl);
+    },
+
+    clickCopyTerminalCommand: async function(platform) {
+      let commandToRunFleetPreview = this.fleetctlPreviewTerminalCommand[platform];
+      if(this.trialLicenseKey && !this.userHasExpiredTrialLicense){
+        commandToRunFleetPreview += ' --license-key '+this.trialLicenseKey;
+      }
+      $('[purpose="command-copy-button"]').addClass('copied');
+      await setTimeout(()=>{
+        $('[purpose="command-copy-button"]').removeClass('copied');
+      }, 2000);
+      // https://caniuse.com/mdn-api_clipboard_writetext
+      navigator.clipboard.writeText(commandToRunFleetPreview);
+    },
   }
 });
diff --git a/website/assets/js/pages/homepage.page.js b/website/assets/js/pages/homepage.page.js
index 5a5100cebc..b9bfc560b4 100644
--- a/website/assets/js/pages/homepage.page.js
+++ b/website/assets/js/pages/homepage.page.js
@@ -12,6 +12,10 @@ parasails.registerPage('homepage', {
   //  ╩═╝╩╚  ╚═╝╚═╝ ╩ ╚═╝╩═╝╚═╝
   beforeMount: function() {
     //…
+    if(window.location.hash === '#unsubscribed'){
+      this.modal = 'unsubscribed';
+      window.location.hash = '';
+    }
   },
   mounted: async function() {
     //…
diff --git a/website/assets/js/pages/pricing.page.js b/website/assets/js/pages/pricing.page.js
index 69b6ba3e74..37a7118abc 100644
--- a/website/assets/js/pages/pricing.page.js
+++ b/website/assets/js/pages/pricing.page.js
@@ -6,6 +6,7 @@ parasails.registerPage('pricing', {
     pricingMode: 'all',
     modal: '',
     selectedFeature: undefined,
+    showExpandedTable: false,
   },
 
   //  ╦  ╦╔═╗╔═╗╔═╗╦ ╦╔═╗╦  ╔═╗
diff --git a/website/assets/js/pages/start.page.js b/website/assets/js/pages/start.page.js
index e6f9514e05..3b95e7218b 100644
--- a/website/assets/js/pages/start.page.js
+++ b/website/assets/js/pages/start.page.js
@@ -18,6 +18,7 @@ parasails.registerPage('start', {
       'what-does-your-team-manage-eo-it': {},
       'what-does-your-team-manage-vm': {},
       'what-do-you-manage-mdm': {},
+      'cross-platform-mdm': {stepCompleted: true},
       'is-it-any-good': {stepCompleted: true},
       'what-did-you-think': {},
       'deploy-fleet-in-your-environment': {stepCompleted: true},
@@ -25,6 +26,8 @@ parasails.registerPage('start', {
       'how-was-your-deployment': {},
       'whats-left-to-get-you-set-up': {},
     },
+
+    psychologicalStage: '2 - Aware',
     // For tracking client-side validation errors in our form.
     // > Has property set to `true` for each invalid property in `formData`.
     formErrors: { /* … */ },
@@ -73,6 +76,7 @@ parasails.registerPage('start', {
 
     // Success state when form has been submitted
     cloudSuccess: false,
+    primaryBuyingSituation: undefined,
   },
 
   //  ╦  ╦╔═╗╔═╗╔═╗╦ ╦╔═╗╦  ╔═╗
@@ -89,6 +93,9 @@ parasails.registerPage('start', {
         this.formData['what-are-you-using-fleet-for'] = {primaryBuyingSituation: this.primaryBuyingSituation};
       }
     }
+    if(this.me.psychologicalStage){
+      this.psychologicalStage = this.me.psychologicalStage;
+    }
     if(window.location.hash) {
       if(typeof analytics !== 'undefined') {
         if(window.location.hash === '#signup') {
@@ -126,11 +133,24 @@ parasails.registerPage('start', {
     handleSubmittingForm: async function(argins) {
       let formDataForThisStep = _.clone(argins);
       let nextStep = this.getNextStep();
-      let getStartedProgress = await Cloud.saveQuestionnaireProgress.with({
+      let questionanireProgress = await Cloud.saveQuestionnaireProgress.with({
         currentStep: this.currentStep,
         formData: formDataForThisStep,
       });
-      this.previouslyAnsweredQuestions[this.currentStep] = getStartedProgress[this.currentStep];
+
+      this.previouslyAnsweredQuestions[this.currentStep] = questionanireProgress.getStartedProgress[this.currentStep];
+      this.psychologicalStage = questionanireProgress.psychologicalStage;
+      this.primaryBuyingSituation = questionanireProgress.primaryBuyingSituation;
+      if(typeof analytics !== 'undefined') {
+        analytics.identify(this.me.id, {
+          email: this.me.emailAddress,
+          firstName: this.me.firstName,
+          lastName: this.me.lastName,
+          company: this.me.organization,
+          primaryBuyingSituation: this.primaryBuyingSituation,
+          psychologicalStage: this.psychologicalStage,
+        });
+      }
       if(_.startsWith(nextStep, '/')){
         this.goto(nextStep);
       } else {
@@ -140,6 +160,9 @@ parasails.registerPage('start', {
     },
     clickGoToPreviousStep: async function() {
       switch(this.currentStep) {
+        case 'what-are-you-using-fleet-for':
+          this.currentStep = 'start';
+          break;
         case 'have-you-ever-used-fleet':
           this.currentStep = 'what-are-you-using-fleet-for';
           break;
@@ -175,9 +198,12 @@ parasails.registerPage('start', {
           } else if(primaryBuyingSituation === 'vm') {
             this.currentStep = 'what-does-your-team-manage-vm';
           } else if(primaryBuyingSituation === 'mdm') {
-            this.currentStep = 'what-do-you-manage-mdm';
+            this.currentStep = 'cross-platform-mdm';
           }
           break;
+        case 'cross-platform-mdm':
+          this.currentStep = 'what-do-you-manage-mdm';
+          break;
         case 'lets-talk-to-your-team':
           this.currentStep = 'how-many-hosts';
           break;
@@ -274,6 +300,9 @@ parasails.registerPage('start', {
           nextStepInForm = 'is-it-any-good';
           break;
         case 'what-do-you-manage-mdm':
+          nextStepInForm = 'cross-platform-mdm';
+          break;
+        case 'cross-platform-mdm':
           nextStepInForm = 'is-it-any-good';
           break;
         case 'is-it-any-good':
@@ -300,7 +329,7 @@ parasails.registerPage('start', {
           } else if(this.formData['how-was-your-deployment'].howWasYourDeployment === 'kinda-stuck'){
             nextStepInForm = '/contact';
           } else if(this.formData['how-was-your-deployment'].howWasYourDeployment === 'havent-gotten-to-it') {
-            nextStepInForm = 'deploy-fleet-in-your-environment';
+            nextStepInForm = '/contact';
           } else if(this.formData['how-was-your-deployment'].howWasYourDeployment === 'changed-mind-want-managed-deployment'){
             nextStepInForm = 'how-many-hosts';
           } else if(this.formData['how-was-your-deployment'].howWasYourDeployment === 'decided-to-not-use-fleet'){
diff --git a/website/assets/resources/install-fleetctl.sh b/website/assets/resources/install-fleetctl.sh
index 4c21a19b11..5f5d4a2774 100644
--- a/website/assets/resources/install-fleetctl.sh
+++ b/website/assets/resources/install-fleetctl.sh
@@ -28,8 +28,8 @@ version_gt() {
 OS="$(uname -s)"
 
 case "${OS}" in
-    Linux*)     OS='linux';;
-    Darwin*)    OS='macos';;
+    Linux*)     OS='linux' OS_DISPLAY_NAME='Linux';;
+    Darwin*)    OS='macos' OS_DISPLAY_NAME='macOS';;
     *)          echo "Unsupported operating system: ${OS}"; exit 1;;
 esac
 
@@ -41,14 +41,14 @@ mkdir -p "${FLEETCTL_INSTALL_DIR}"
 DOWNLOAD_URL="https://github.com/fleetdm/fleet/releases/download/fleet-v${latest_strippedVersion}/fleetctl_v${latest_strippedVersion}_${OS}.tar.gz"
 
 # Download the latest version of fleetctl and extract it.
-echo "Downloading fleetctl ${latest_strippedVersion} for ${OS}..."
+echo "Downloading fleetctl ${latest_strippedVersion} for ${OS_DISPLAY_NAME}..."
 curl -sSL "$DOWNLOAD_URL" | tar -xz -C "$FLEETCTL_INSTALL_DIR" --strip-components=1 fleetctl_v"${latest_strippedVersion}"_${OS}/
 echo "fleetctl installed successfully in ${FLEETCTL_INSTALL_DIR}"
 echo
 echo "To start the local demo:"
 echo
 echo "1. Start Docker Desktop"
-echo "2. Run  ~/.fleetctl/fleetctl preview"
+echo "2. To access your Fleet Premium trial, head to fleetdm.com/try-fleet and run the command in step 2."
 
 # Verify if the binary is executable
 if [[ ! -x "${FLEETCTL_INSTALL_DIR}/fleetctl" ]]; then
diff --git a/website/assets/resources/security-awareness/2022-05-security-awareness-slides.md b/website/assets/resources/security-awareness/2022-05-security-awareness-slides.md
index f3fad15238..f1fbefd163 100644
--- a/website/assets/resources/security-awareness/2022-05-security-awareness-slides.md
+++ b/website/assets/resources/security-awareness/2022-05-security-awareness-slides.md
@@ -132,7 +132,7 @@ BEC leverages our willingness to help people.
 
 ## Money transfers
 
-We have a strict process related to payments and wire transfers. If you are in the BizOps team, make sure you are aware of it.
+We have a strict process related to payments and wire transfers. If you are in the Digital Experience team, make sure you are aware of it.
 
 ## Working from shady networks and cool locations
 
@@ -179,7 +179,7 @@ Undoing git history is complicated. Consider this secret forever leaked.
 
 1. Don't panic. It's encrypted.
 2. Post about it in #g-security.
-3. In the thread in #g-security, inform someone from the BizOps team. They'll help you get a new one ASAP!
+3. In the thread in #g-security, inform someone from the Digital Experience team. They'll help you get a new one ASAP!
 
 ## If... you lose your Yubikey(s)
 
diff --git a/website/assets/styles/docsearch.less b/website/assets/styles/docsearch.less
index 9e831cbe1b..111bd4b235 100644
--- a/website/assets/styles/docsearch.less
+++ b/website/assets/styles/docsearch.less
@@ -149,6 +149,10 @@
   justify-content: center;
 }
 
+.DocSearch-VisuallyHiddenForAccessibility {
+  display: none;
+}
+
 .DocSearch-Container--Stalled .DocSearch-MagnifierLabel {
   display: none;
 }
diff --git a/website/assets/styles/layout.less b/website/assets/styles/layout.less
index d1be7f4a0a..6eefec24a9 100644
--- a/website/assets/styles/layout.less
+++ b/website/assets/styles/layout.less
@@ -144,8 +144,27 @@ html, body {
     [purpose='banner-image'] {
       height: 80px;
       min-width: 80px;
-      background-image: url('/images/continue-thumbnail.png');
       background-size: cover;
+      background-position: center;
+      border-radius: 12px;
+      &.stage-one {
+        background-image: url('/images/psystage-1-unaware-558x680@2x.png');
+      }
+      &.stage-two {
+        background-image: url('/images/cta-thumbnail-psystage-2-aware-128x128@2x.png');
+      }
+      &.stage-three {
+        background-image: url('/images/cta-thumbnail-psystage-3-intrigued-128x128@2x.png');
+      }
+      &.stage-four {
+        background-image: url('/images/cta-thumbnail-psystage-4-has-use-case-128x128@2x.png');
+      }
+      &.stage-five {
+        background-image: url('/images/cta-thumbnail-psystage-5-100x100@2x.png');
+      }
+      &.stage-six {
+        background-image: url('/images/psystage-6-has-team-buy-in-504x784@2x.png');
+      }
     }
   }
   [purpose='banner-body'].collapsed {
@@ -425,8 +444,9 @@ html, body {
       }
     }
     [purpose='gh-button'] {
-      margin-left: 20px;
-      margin-right: 20px;
+      padding: 0px 20px;
+      min-width: 140px;
+      width: 140px;
     }
     [purpose='header-dropdown'] {
       box-shadow: 0px 4px 40px rgba(0, 0, 0, 0.4);
@@ -656,7 +676,6 @@ body.detected-mobile {
       [purpose='banner-image'] {
         height: 54px;
         min-width: 54px;
-        background-image: url('/images/continue-thumbnail.png');
         background-size: cover;
       }
     }
@@ -667,7 +686,6 @@ body.detected-mobile {
       [purpose='banner-image'] {
         height: 54px;
         min-width: 54px;
-        background-image: url('/images/continue-thumbnail.png');
         background-size: cover;
       }
       transform: none;
diff --git a/website/assets/styles/pages/articles/articles.less b/website/assets/styles/pages/articles/articles.less
index 552b110da0..770943f00c 100644
--- a/website/assets/styles/pages/articles/articles.less
+++ b/website/assets/styles/pages/articles/articles.less
@@ -1,6 +1,7 @@
 #articles {
-  padding-left: 24px;
-  padding-right: 24px;
+  [purpose='page-container'] {
+    padding: 64px;
+  }
 
   [purpose='categories-and-search'] {
     padding-top: 40px;
@@ -30,9 +31,15 @@
     }
   }
   [purpose='category-title'] {
-    padding-top: 80px;
     padding-bottom: 40px;
   }
+
+  [purpose='guides-category-page'] {
+    [purpose='category-title'] {
+      margin-left: 12px;
+      margin-right: 6px;
+    }
+  }
   [purpose='rss-button'] {
     padding: 4px 8px;
     cursor: pointer;
@@ -49,7 +56,6 @@
       font-size: 16px;
     }
   }
-
   [purpose='rss-button'].copied::after {
     content: 'Link copied';
     display: flex;
@@ -74,11 +80,100 @@
     100% {opacity: 0;}
   }
 
+  [purpose='search'] {
+    // Note: We're using classes here to override the default Docsearch styles;
+    button {
+      width: 100%;
+      cursor: text;
+      margin: 0;
+    }
+    .DocSearch-Button {
+      border-top-left-radius: 6px;
+      border-bottom-left-radius: 6px;
+      border-top-right-radius: 6px;
+      border-bottom-right-radius: 6px;
+      border: 1px solid @core-fleet-black-25;
+      background-color: #FFF;
+      padding: 6px;
+      height: 36px;
+      margin: 0;
+      width: 256px;
+    }
+    .DocSearch-Button:hover {
+      box-shadow: none;
+      border: 1px solid @core-fleet-black-25;
+      color: @core-fleet-black-50;
+    }
+    .DocSearch-Search-Icon {
+      margin-left: 10px;
+      height: 16px;
+      width: 16px;
+      color: @core-fleet-black-50;
+      stroke-width: 3px;
+    }
+    .DocSearch-Button-Keys {
+      display: none;
+    }
+    .input-group:focus-within {
+      border: 1px solid @core-vibrant-blue;
+    }
+    .DocSearch-Button-Placeholder {
+      font-size: 16px;
+      font-weight: 400;
+      padding-left: 12px;
+    }
+    [purpose='disabled-search'] {
+      input {
+        padding-top: 6px;
+        padding-bottom: 6px;
+        border: none;
+        } &::placeholder {
+          font-size: 16px;
+          line-height: 24px;
+        }
+      .input-group {
+        border-top-left-radius: 6px;
+        border-bottom-left-radius: 6px;
+        border-top-right-radius: 6px;
+        border-bottom-right-radius: 6px;
+        border: 1px solid @core-fleet-black-25;
+        background: #FFF;
+      }
+      .input-group:focus-within {
+        border: 1px solid @core-vibrant-blue;
+      }
+      .docsearch-input {
+        height: 100%;
+        width: 98%;
+      }
+      .docsearch-input:focus-visible {
+        outline: none;
+      }
+      .ds-input:focus {
+        outline: rgba(0, 0, 0, 0);
+      }
+      .input-group-text {
+        color: @core-fleet-black-50;
+      }
+      .form-control {
+        height: 36px;
+        padding: 0px;
+        font-size: 16px;
+      } &:focus {
+        border: none;
+      }
+    }
+  }
+
 
   [purpose='articles'] {
-    padding-bottom: 80px;
+    width: 100%;
+    max-width: 100%;
     [purpose='article-card'] {
-
+      a {
+        text-decoration: none;
+        color: @core-fleet-black-75;
+      }
       margin-left: 10px;
       margin-right: 10px;
       margin-bottom: 40px;
@@ -123,6 +218,71 @@
       }
     }
   }
+  [purpose='guides'] {
+    column-count: 3;
+    margin-left: -2px;
+    margin-right: 14px;
+  }
+  [purpose='guide-card'] {
+    &:hover {
+        box-shadow: 0px 4px 16px 0px #E2E4EA;
+      }
+    max-width: 343px;
+    margin-left: 12px;
+    margin-right: 12px;
+    margin-bottom: 24px;
+    border-radius: 16px;
+    box-shadow: none;
+    border: 1px solid #E2E4EA;
+    display: inline-block;
+    img {
+      border-top-left-radius: 16px;
+      border-top-right-radius: 16px;
+    }
+    a {
+      text-decoration: none;
+      color: @core-fleet-black-75;
+    }
+    [purpose='article-card-body'] {
+      padding: 32px;
+      [purpose='category-name'] {
+        text-transform: uppercase;
+        color: @core-fleet-black-50;
+        font-size: 12px;
+        font-weight: 700;
+        line-height: 20px;
+        text-decoration: none;
+      }
+      p {
+        color: #515774;
+        font-size: 14px;
+        font-weight: 400;
+        line-height: 150%;
+      }
+      [purpose='article-title'] {
+
+        display: block;
+        text-decoration: none;
+        color: @core-fleet-black;
+        margin-bottom: 16px;
+        h5 {
+          font-weight: 800;
+          font-size: 16px;
+          line-height: 120%;
+        }
+      }
+      [purpose='article-details'] {
+        font-size: 12px;
+        line-height: 28px;
+        span {
+          color: @core-fleet-black-50;
+        }
+        p {
+          margin-bottom: 0px;
+        }
+      }
+    }
+  }
 
 
   @media (min-width: 1200px) {
@@ -131,8 +291,6 @@
       margin-right: 10px;
     }
     [purpose='articles'] {
-      margin-left: -25px;
-      margin-right: -25px;
       [purpose='article-card'] {
         flex: 1 1 350px;
         margin-left: 20px;
@@ -155,8 +313,12 @@
 
 
    @media (max-width: 991px) {
-    padding-left: 40px;
-    padding-right: 40px;
+    [purpose='page-container'] {
+      padding: 64px 32px;
+    }
+    [purpose='guide-card'] {
+      max-width: unset;
+    }
     [purpose='categories-and-search'] {
       padding-top: 40px;
       [purpose='categories'] {
@@ -171,9 +333,6 @@
         }
       }
     }
-    [purpose='category-title'] {
-      padding-top: 60px;
-    }
     [purpose='articles'] {
       [purpose='article-card'] {
         flex: 1 1 330px;
@@ -182,27 +341,49 @@
       margin-left: -10px;
       margin-right: -10px;
     }
+    [purpose='search'] {
+      .DocSearch-Button {
+        margin-left: 24px;
+        width: 200px;
+      }
+    }
 
   }
 
 
    @media (max-width: 767px) {
+
     [purpose='categories-and-search'] {
       [purpose='search'] {
         width: 100%;
       }
     }
-
+    [purpose='guides'] {
+      column-count: 2;
+    }
     [purpose='articles'] {
+      margin: 0 auto;
+      column-count: 2;
       [purpose='article-card'] {
         max-width: 100%;
       }
     }
+    [purpose='search'] {
+      .DocSearch-Button {
+        margin-top: 0px;
+        margin-left: 0px;
+        width: 100%;
+      }
+    }
   }
 
    @media (max-width: 576px) {
-    padding-left: 24px;
-    padding-right: 24px;
+    [purpose='page-container'] {
+      padding: 32px 24px;
+    }
+    [purpose='guides'] {
+      column-count: 1;
+    }
     [purpose='articles'] {
       margin-left: -10px;
       margin-right: -10px;
@@ -211,5 +392,15 @@
         max-width: 100%;
       }
     }
+    [purpose='guide-card'] {
+      width: 100%;
+    }
+    [purpose='search'] {
+      .DocSearch-Button {
+        margin-top: 0px;
+        margin-left: 0px;
+        width: 100%;
+      }
+    }
   }
 }
diff --git a/website/assets/styles/pages/articles/basic-article.less b/website/assets/styles/pages/articles/basic-article.less
index 034b5376a6..ad70251560 100644
--- a/website/assets/styles/pages/articles/basic-article.less
+++ b/website/assets/styles/pages/articles/basic-article.less
@@ -10,8 +10,126 @@
     width: 100%;
   }
 
+  [purpose='breadcrumbs-and-search'] {
+    padding-top: 64px;
+    max-width: 1072px;
+    margin: auto;
+    font-size: 14px;
+    [purpose='breadcrumbs'] {
+      margin-right: 24px;
+    }
+    [purpose='search'] {
+      // Note: We're using classes here to override the default Docsearch styles;
+      button {
+        width: 100%;
+        cursor: text;
+        margin: 0;
+      }
+      .DocSearch-Button {
+        border-top-left-radius: 6px;
+        border-bottom-left-radius: 6px;
+        border-top-right-radius: 6px;
+        border-bottom-right-radius: 6px;
+        border: 1px solid @core-fleet-black-25;
+        background-color: #FFF;
+        padding: 6px;
+        height: 36px;
+        margin: 0;
+        width: 256px;
+      }
+      .DocSearch-Button:hover {
+        box-shadow: none;
+        border: 1px solid @core-fleet-black-25;
+        color: @core-fleet-black-50;
+      }
+      .DocSearch-Search-Icon {
+        margin-left: 10px;
+        height: 16px;
+        width: 16px;
+        color: @core-fleet-black-50;
+        stroke-width: 3px;
+      }
+      .DocSearch-Button-Keys {
+        display: none;
+      }
+      .input-group:focus-within {
+        border: 1px solid @core-vibrant-blue;
+      }
+      .DocSearch-Button-Placeholder {
+        font-size: 16px;
+        font-weight: 400;
+        padding-left: 12px;
+      }
+      [purpose='disabled-search'] {
+        input {
+          padding-top: 6px;
+          padding-bottom: 6px;
+          border: none;
+          } &::placeholder {
+            font-size: 16px;
+            line-height: 24px;
+            color: #8B8FA2;
+          }
+        .input-group {
+          border-top-left-radius: 6px;
+          border-bottom-left-radius: 6px;
+          border-top-right-radius: 6px;
+          border-bottom-right-radius: 6px;
+          border: 1px solid @core-fleet-black-25;
+          background: #FFF;
+        }
+        .input-group:focus-within {
+          border: 1px solid @core-vibrant-blue;
+        }
+        .form-control {
+          border-radius: 6px;
+          padding: 6px;
+          height: 36px;
+          margin: 0;
+          width: 212px;
+        }
+        .docsearch-input:focus-visible {
+          outline: none;
+        }
+        .ds-input:focus {
+          outline: rgba(0, 0, 0, 0);
+        }
+        .input-group-text {
+          color: @core-fleet-black-50;
+        }
+        .form-control {
+          height: 36px;
+          padding: 0px;
+          font-size: 16px;
+        } &:focus {
+          border: none;
+        }
+      }
+    }
+
+    [purpose='breadcrumbs-category'] {
+      color: #8B8FA2;
+      text-transform: capitalize;
+      margin-right: 8px;
+      &:hover {
+        color: #192147;
+        text-decoration: none;
+      }
+    }
+    [purpose='breadcrumbs-title'] {
+      margin-left: 8px;
+    }
+
+  }
+  [purpose='article-container'] {
+    max-width: 800px;
+    margin: auto;
+    display: flex;
+    flex-direction: column;
+
+  }
   [purpose='article-title'] {
-    padding-top: 80px;
+    padding-top: 64px;
     margin-bottom: 28px;
     h1 {
       margin-bottom: 4px;
@@ -107,9 +225,9 @@
     }
   }
   [purpose='article-content'] {
-    padding-top: 24px;
-    padding-bottom: 24px;
-    word-break: break-word;
+    padding-top: 40px;
+    padding-bottom: 40px;
+    word-wrap: break-word;
     h1:first-of-type {
       display: none;
     }
@@ -126,8 +244,13 @@
       padding: 24px 0px 16px 0px;
     }
     a {
-      color: @core-vibrant-blue;
+      color: @core-fleet-black-75;
       word-break: break-word;
+      text-decoration: underline;
+      text-underline-offset: 2px;
+      &:hover {
+        color: @core-fleet-black-75;
+      }
     }
     h2 {
       font-size: 24px;
@@ -429,6 +552,18 @@
     [purpose='article-content'] {
       padding-bottom: 0px;
     }
+    [purpose='breadcrumbs-and-search'] {
+      [purpose='breadcrumbs'] {
+        margin-bottom: 24px;
+        margin-right: auto;
+      }
+      [purpose='search'] {
+        width: 100%;
+        .DocSearch-Button {
+          width: 100%;
+        }
+      }
+    }
   }
 
   @media (max-width: 769px) {
@@ -449,6 +584,10 @@
         margin-bottom: 16px;
       }
     }
+    [purpose='breadcrumbs-and-search'] {
+      padding-top: 32px;
+
+    }
 
   }
   @media (max-width: 576px) {
diff --git a/website/assets/styles/pages/device-management.less b/website/assets/styles/pages/device-management.less
index e0669aa959..10557dc619 100644
--- a/website/assets/styles/pages/device-management.less
+++ b/website/assets/styles/pages/device-management.less
@@ -35,6 +35,7 @@
     line-height: @text-lineheight;
     color: @core-fleet-black-75;
   }
+
   strong {
     color: @core-fleet-black;
   }
@@ -393,10 +394,17 @@
 
 
   [purpose='feature'] {
-    margin-bottom: 140px;
+    margin-bottom: 100px;
     h3 {
       margin-bottom: 24px;
     }
+    a {
+      color: @core-fleet-black-75;
+      text-decoration: underline;
+      &:hover {
+        color: @core-fleet-black-75;
+      }
+    }
     &:last-of-type {
       margin-bottom: 0px;
     }
@@ -429,6 +437,7 @@
   [purpose='feature-text'] {
     width: 468px;
     h2 {
+      font-size: 28px;
       margin-bottom: 32px;
     }
     p {
@@ -487,13 +496,38 @@
       }
     }
   }
-  [purpose='three-column-features'] {
-    margin-bottom: 160px;
-    max-width: 1080px;
-    [purpose='feature-row'] {
-      [purpose='feature-column'] {
-        max-width: 267px;
+  [purpose='responsive-feature-row'] {
+    margin-right: 0px;
+    margin-left: 0px;
+    [purpose='feature-item'] {
+      padding-right: 24px;
+      padding-left: 24px;
+      margin-bottom: 64px;
+      h5 {
+        font-size: 16px;
+        line-height: 1.2;
+        font-weight: 800;
       }
+      a {
+        color: @core-fleet-black-75;
+        text-decoration: underline;
+        &:hover {
+          color: @core-fleet-black-75;
+        }
+      }
+      p {
+        font-size: 14px;
+        font-weight: 400;
+        line-height: 21px;
+      }
+    }
+  }
+  [purpose='three-column-features'] {
+    max-width: 1080px;
+    h2 {
+      font-size: 32px;
+      line-height: 48px;
+      margin-bottom: 40px;
     }
   }
   [purpose='button-row'] {
@@ -661,6 +695,18 @@
         width: 50%;
       }
     }
+    [purpose='responsive-feature-row'] {
+      [purpose='feature-item'] {
+        padding-right: 24px;
+        padding-left: 24px;
+        margin-bottom: 64px;
+        p {
+          font-size: 14px;
+          font-weight: 400;
+          line-height: 21px;
+        }
+      }
+    }
 
     [purpose='testimonial-videos'] {
       width: 410px;
@@ -737,6 +783,16 @@
         }
       }
     }
+    [purpose='three-column-features'] {
+      [purpose='feature-row'] {
+        [purpose='feature-item'] {
+          margin-left: 32px;
+          margin-right: 32px;
+          max-width: 266px;
+          width: 33%;
+        }
+      }
+    }
   }
 
   @media (max-width: 767px) {
@@ -747,6 +803,9 @@
         font-size: 42px;
       }
     }
+    [purpose='feature'] {
+      margin-bottom: 80px;
+    }
 
     [purpose='calendar-feature'] {
       [purpose='feature-video'] {
@@ -805,12 +864,16 @@
     }
     [purpose='feature'].flex-column {
       [purpose='feature-text'] {
-        margin-left: auto;
+        width: 100%;
+        margin-left: 0px;
+        margin-right: 0px;
       }
     }
     [purpose='feature'].flex-column-reverse {
       [purpose='feature-text'] {
-        margin-right: auto;
+        width: 100%;
+        margin-left: 0px;
+        margin-right: 0px;
       }
     }
     [purpose='feature-image'] {
@@ -844,6 +907,16 @@
        height: 304px;
       }
     }
+    [purpose='three-column-features'] {
+      [purpose='feature-row'] {
+        [purpose='feature-item'] {
+          margin-left: 24px;
+          margin-right: 24px;
+          max-width: 266px;
+          width: 33%;
+        }
+      }
+    }
   }
 
   @media (max-width: 575px) {
@@ -871,6 +944,19 @@
         padding-left: 24px;
       }
     }
+    [purpose='responsive-feature-row'] {
+      [purpose='feature-item'] {
+        padding-right: 0px;
+        padding-left: 0px;
+        margin-bottom: 64px;
+        text-align: center;
+        p {
+          font-size: 14px;
+          font-weight: 400;
+          line-height: 21px;
+        }
+      }
+    }
     [purpose='page-section'] {
       padding-top: 48px;
       padding-bottom: 48px;
@@ -895,6 +981,21 @@
         height: calc(~'9/16 * 95vw');
       }
     }
+    [purpose='three-column-features'] {
+      [purpose='feature-row'] {
+        [purpose='feature-item'] {
+
+          margin-left: 0;
+          margin-right: 0;
+          text-align: center;
+          max-width: 320px;
+          width: 100%;
+          &:not(:last-of-type) {
+            margin-bottom: 60px;
+          }
+        }
+      }
+    }
     [purpose='two-column-features'] {
       [purpose='feature-row'] {
         margin-bottom: 64px;
diff --git a/website/assets/styles/pages/endpoint-ops.less b/website/assets/styles/pages/endpoint-ops.less
index 52cdb20351..a2459aa9eb 100644
--- a/website/assets/styles/pages/endpoint-ops.less
+++ b/website/assets/styles/pages/endpoint-ops.less
@@ -361,44 +361,52 @@
       line-height: 24px;
     }
   }
-
   [purpose='three-column-features'] {
-    margin-bottom: 160px;
     max-width: 1080px;
-    [purpose='feature-row'] {
-      &:not(:last-of-type) {
-        margin-bottom: 60px;
-      }
-      [purpose='feature-item'] {
-        margin-left: 40px;
-        margin-right: 40px;
-        max-width: 266px;
-        width: 33%;
-        p {
-          font-size: 14px;
-          font-weight: 400;
-          line-height: 21px;
-        }
-      }
-    }
+    margin-bottom: 160px;
     h2 {
       font-size: 32px;
       line-height: 48px;
       margin-bottom: 40px;
     }
   }
+  [purpose='responsive-feature-row'] {
+    margin-right: 0px;
+    margin-left: 0px;
+    [purpose='feature-item'] {
+      padding-right: 24px;
+      padding-left: 24px;
+      margin-bottom: 64px;
+      h5 {
+        font-size: 16px;
+        line-height: 1.2;
+        font-weight: 800;
+      }
+      a {
+        color: @core-fleet-black-75;
+        text-decoration: underline;
+        &:hover {
+          color: @core-fleet-black-75;
+        }
+      }
+      img {
+        height: 48px;
+        width: auto;
+        margin-bottom: 16px;
+      }
+      h5 {
+        font-weight: 800;
+        font-size: 16px;
+        line-height: 1.2;
+        margin-bottom: 16px;
+      }
 
-  [purpose='feature-item'] {
-    img {
-      height: 48px;
-      width: auto;
-      margin-bottom: 16px;
-    }
-    h5 {
-      font-weight: 800;
-      font-size: 16px;
-      line-height: 27px;
-      margin-bottom: 16px;
+      p {
+        font-size: 14px;
+        font-weight: 400;
+        line-height: 21px;
+        margin-bottom: 0px;
+      }
     }
   }
 
@@ -541,6 +549,18 @@
     [purpose='feature-text'] {
       width: 410px;
     }
+    [purpose='responsive-feature-row'] {
+      [purpose='feature-item'] {
+        padding-right: 24px;
+        padding-left: 24px;
+        margin-bottom: 64px;
+        p {
+          font-size: 14px;
+          font-weight: 400;
+          line-height: 21px;
+        }
+      }
+    }
   }
 
   @media (max-width: 767px) {
@@ -701,18 +721,16 @@
         margin-left: 10px;
       }
     }
-    [purpose='three-column-features'] {
-      [purpose='feature-row'] {
-        [purpose='feature-item'] {
-
-          margin-left: 0;
-          margin-right: 0;
-          text-align: center;
-          max-width: 320px;
-          width: 100%;
-          &:not(:last-of-type) {
-            margin-bottom: 60px;
-          }
+    [purpose='responsive-feature-row'] {
+      [purpose='feature-item'] {
+        padding-right: 0px;
+        padding-left: 0px;
+        margin-bottom: 64px;
+        text-align: center;
+        p {
+          font-size: 14px;
+          font-weight: 400;
+          line-height: 21px;
         }
       }
     }
diff --git a/website/assets/styles/pages/entrance/login.less b/website/assets/styles/pages/entrance/login.less
index 42cadfb9be..46ffa53c30 100644
--- a/website/assets/styles/pages/entrance/login.less
+++ b/website/assets/styles/pages/entrance/login.less
@@ -1,45 +1,74 @@
 #login {
-
-  padding-top: 80px;
-
   h1 {
-    font-size: 28px;
-    line-height: 38px;
+    font-size: 32px;
+    line-height: 120%;
   }
   a {
+    line-height: 150%;
     color: @core-fleet-black-75;
     text-decoration: underline;
     text-underline-offset: 2px;
+  }
+  p {
     line-height: 150%;
   }
-  [purpose='customer-login-container'] {
-    max-width: 560px;
-  }
-  [purpose='login-container'] {
-    max-width: 560px;
-    [purpose='customer-portal-form'] {
-      max-width: 560px;
-    }
+  [purpose='page-container'] {
+    padding: 64px 128px 64px 128px;
+    max-width: 1200px;
   }
+
   [purpose='page-heading'] {
-    padding-left: 30px;
-    padding-right: 30px;
-    text-align: center;
-    margin-bottom: 40px;
+    text-align: left;
+    margin-bottom: 48px;
   }
-  [purpose='register-link'] {
-    margin-bottom: 8px;
-    a {
-      float: right;
+
+  [purpose='quote-and-logos'] {
+    max-width: 310px;
+  }
+  [purpose='quote'] {
+    margin-top: 8px;
+  }
+  [purpose='quote-text'] {
+    font-size: 14px;
+    line-height: 150%;
+    font-style: italic;
+  }
+  [purpose='quote-author-info'] {
+    display: inline-flex;
+    padding: 4px 16px 4px 4px;
+    border-radius: 28px;
+    width: fit-content;
+    margin-top: 8px;
+    margin-bottom: 48px;
+    [purpose='job-title'] {
       color: @core-fleet-black-75;
-      text-decoration: underline;
-      font-size: 14px;
+      font-size: 12px;
+      font-weight: 400;
+      line-height: 18px;
+      margin-bottom: 0px;
     }
+    [purpose='name'] {
+      font-size: 12px;
+      font-weight: 700;
+      line-height: 18px;
+      margin-bottom: 0px;
+    }
+    [purpose='profile-picture'] {
+      margin-right: 16px;
+      img {
+        height: 32px;
+        width: 32px;
+      }
+    }
+  }
+  [purpose='logos'] {
+    max-width: 310px;
+  }
+  [purpose='login-form'] {
+    width: 528px;
   }
   [purpose='customer-portal-form'] {
-    max-width: 560px;
     border-radius: 16px;
-    margin-bottom: 40px;
     padding: 20px 32px 32px 32px;
     label {
       color: @core-fleet-black;
@@ -50,8 +79,36 @@
       height: 40px;
       border-radius: 6px;
     }
-    .card-body {
-      padding: 2em;
+    .selectbox {
+
+      position: relative;
+    }
+    .selectbox::after {
+      content: url('/images/chevron-12x8@2x.png');
+      right: 14px;
+      transform: scale(0.5);
+      top: 14px;
+      position: absolute;
+      pointer-events: none;
+    }
+    .selectbox select {
+      border-radius: 6px;
+      height: 48px;
+      appearance: none;
+      -webkit-appearance: none;
+    }
+    .small {
+      font-size: 12px;
+    }
+  }
+
+  [purpose='register-link'] {
+    margin-bottom: 4px;
+    a {
+      float: right;
+      color: @core-fleet-black-75;
+      text-decoration: underline;
+      font-size: 14px;
     }
   }
 
@@ -74,23 +131,64 @@
       font-weight: 700;
     }
   }
+  @media (max-width: 1200px) {
+    [purpose='page-container'] {
+      padding: 64px;
+    }
+  }
+  @media (max-width: 991px) {
+    [purpose='signup-form'] {
+      max-width: 528px;
+    }
+    [purpose='quote-and-logos'] {
+      max-width: 528px;
+      margin-top: 48px;
+    }
+    [purpose='logos'] {
+      max-width: 528px;
+    }
+    [purpose='page-heading'] {
+      text-align: center;
+      margin-left: auto;
+      margin-right: auto;
+      margin-bottom: 48px;
+      max-width: 528px;
+    }
+    [purpose='page-container'] {
+      padding: 64px 32px;
+    }
+
+  }
 
   @media (max-width: 768px) {
-    padding-top: 60px;
     [purpose='customer-portal-form'] {
       max-width: unset;
     }
+    [purpose='signup-form'] {
+      width: 100%;
+    }
+    [purpose='quote-and-logos'] {
+      width: 100%;
+    }
+    [purpose='logos'] {
+      width: 100%;
+    }
   }
 
   @media (max-width: 576px) {
-    padding-top: 40px;
     [purpose='page-heading'] {
       padding-left: 0px;
       padding-right: 0px;
     }
+    [purpose='page-container'] {
+      padding: 48px 24px;
+    }
+    [purpose='login-link'] {
+      margin-bottom: 12px;
+    }
     [purpose='customer-portal-form'] {
       .card-body {
-        padding: 1em;
+        padding: 1.5em 1em;
       }
     }
   }
diff --git a/website/assets/styles/pages/fleetctl-preview.less b/website/assets/styles/pages/fleetctl-preview.less
index 443db87c12..60b055eed9 100644
--- a/website/assets/styles/pages/fleetctl-preview.less
+++ b/website/assets/styles/pages/fleetctl-preview.less
@@ -104,18 +104,27 @@
     }
   }
   [purpose='terminal-commands'] {
-    padding: 16px 24px;
+    padding: 16px 60px 16px 24px;
     border: 1px solid @core-fleet-black-25;
     border-radius: 4px;
     margin: 16px 0px 0px;
     background: @ui-off-white;
     width: 100%;
-    overflow-x: scroll;
+    overflow: auto;
     scrollbar-width: none;
+    position: relative;
     &::-webkit-scrollbar {
       display: none;
     }
-    p {
+    [purpose='command-container'] {
+      overflow-x: scroll;
+      scrollbar-width: none;
+      position: relative;
+      &::-webkit-scrollbar {
+        display: none;
+      }
+    }
+    code {
       white-space: nowrap;
       color: @core-fleet-black-75;
       font-family: @code-font;
@@ -123,9 +132,77 @@
       font-size: 14px;
       line-height: @text-lineheight;
       margin-bottom: 0px;
-      padding-right: 24px;
+      padding: 0px;
+      border: none;
+    }
+
+    [purpose='install-copy-button'], [purpose='command-copy-button'] {
+      display: none;
+      background: url('/images/icon-copy-16x16@2x.png');
+      font-size: 32px;
+      position: absolute;
+      top: 14px;
+      right: 14px;
+      color: green;
+      width: 32px;
+      padding: 9px;
+      height: 32px;
+      background-size: 14px 14px;
+      background-position: center;
+      border-radius: 8px;
+      background-repeat: no-repeat;
+      cursor: pointer;
+      &.copied {
+        display: inline-block;
+        background: url('/images/icon-copy-clicked-checkmark-32x32@2x.png');
+        background-size: 32px 32px;
+        background-repeat: no-repeat;
+        background-position: center;
+      }
+
+    }
+    &:hover {
+      [purpose='install-copy-button'], [purpose='command-copy-button'] {
+        display: inline-block;
+        &:hover {
+          background-color: #F2F2F5;
+        }
+      }
     }
   }
+  [purpose='tip'] {
+    margin: 16px 0 32px;
+    background: #F4F4FF;
+    padding: 16px;
+    border-radius: 8px;
+    display: flex;
+    img {
+      display: flex;
+      margin: 4px 12px 0 0;
+      height: 16px;
+      width: 16px;
+      padding: 0px;
+    }
+    p {
+      display: block;
+      margin-bottom: 16px;
+      line-height: 24px;
+      font-size: 16px;
+    }
+    p:last-child {
+      margin-bottom: 0px;
+    }
+    ul {
+      padding-left: 16px;
+    }
+    ul:last-child {
+      margin-bottom: 0px;
+    }
+    li:last-child {
+      padding-bottom: 0px;
+    }
+  }
+
 
 
   [purpose='docs-button'] {
diff --git a/website/assets/styles/pages/homepage.less b/website/assets/styles/pages/homepage.less
index b9f9f5b262..489671a645 100644
--- a/website/assets/styles/pages/homepage.less
+++ b/website/assets/styles/pages/homepage.less
@@ -643,6 +643,16 @@
     }
   }
 
+  [purpose='bottom-cta'] {
+      h1 {
+        font-size: 48px;
+        max-width: 640px;
+        &.vm {
+          max-width: unset;
+        }
+      }
+    }
+
   [purpose='video-modal'] {
     [purpose='modal-dialog'] {
       width: 100%;
@@ -711,11 +721,6 @@
     [purpose='integrations-section'] {
       margin-top: 160px;
     }
-    [purpose='bottom-cta'] {
-      h1 {
-        font-size: 48px;
-      }
-    }
     [purpose='video-modal'] {
       [purpose='modal-dialog'] {
         width: 100%;
diff --git a/website/assets/styles/pages/osquery-table-details.less b/website/assets/styles/pages/osquery-table-details.less
index 39befd5dc1..b452731b13 100644
--- a/website/assets/styles/pages/osquery-table-details.less
+++ b/website/assets/styles/pages/osquery-table-details.less
@@ -178,6 +178,7 @@
   }
   [purpose='table-container'] {
     height: min-content;
+    max-width: 860px;
   }
 
   [purpose='overflow-shadow'] {
@@ -407,7 +408,9 @@
   }
 
   @media (max-width: 991px) {
-
+    [purpose='table-container'] {
+      max-width: unset;
+    }
     [purpose='schema-table'] {
       padding-top: 40px;
       [purpose='platform-logos'] {
diff --git a/website/assets/styles/pages/pricing.less b/website/assets/styles/pages/pricing.less
index 05cdaeba84..8c25326dcd 100644
--- a/website/assets/styles/pages/pricing.less
+++ b/website/assets/styles/pages/pricing.less
@@ -21,7 +21,7 @@
     line-height: 24px;
   }
   a {
-    color: @core-vibrant-blue;
+    color: #515774;
   }
   .btn {
     color: #fff;
@@ -40,8 +40,8 @@
     background: @ui-off-white;
     position: relative;
     box-shadow: 0px 2px 4px 0px rgba(0, 0, 0, 0.10) inset;
-    margin-bottom: 40px;
-    margin-top: 40px;
+    margin-bottom: 32px;
+    margin-top: 32px;
     [purpose='pricing-tier-switch'] {
       position: absolute;
       top: -1px;
@@ -168,6 +168,13 @@
     }
 
   }
+  [purpose='logos-container'] {
+    margin-top: 40px;
+    max-width: 100%;
+    [parasails-component='logo-carousel'] {
+      margin-bottom: 32px;
+    }
+  }
   [purpose='features-list'] {
 
     p {
@@ -331,6 +338,7 @@
       color: #515774;
       border-radius: 8px;
       outline: 1px solid #E2E4EA;
+      outline-offset: -1px;
       td {
         padding: 12px 24px;
         vertical-align: middle;
@@ -353,6 +361,120 @@
       }
     }
   }
+
+
+  [purpose='features-table'] {
+    .truncated {
+      max-height: 649px;
+      overflow-y: hidden;
+      justify-content: flex-start;
+      position: relative;
+      [purpose='truncated-features-fade'] {
+        position: absolute;
+        bottom: 0px;
+        background: linear-gradient(180deg, rgba(255, 255, 255, 0.00) -2.2%, #FFF 87.37%);
+        width: 100%;
+        height: 101px;
+      }
+    }
+    [purpose='show-all-features-button'] {
+      cursor: pointer;
+      color: #515774;
+      font-size: 14px;
+      font-weight: 700;
+      line-height: 150%;
+      border-radius: 16px;
+      background: #FFF;
+      padding: 8px 16px;
+      margin-bottom: 64px;
+      span {
+        height: 12px;
+        width: 12px;
+        display: inline-block;
+        background: url('/images/icon-chevron-fleet-black-75-12x12@2x.png');
+        background-size: 12px 12px;
+        background-repeat: no-repeat;
+        margin-left: 8px;
+      }
+      &:hover {
+        color: #515774;
+        background-color: #F9FAFC;
+      }
+      &.expanded {
+        span {
+          transform: rotate(180deg);
+        }
+      }
+    }
+  }
+  [purpose='faq'] {
+    padding-top: 80px;
+    border-top: 1px solid #E2E4EA;
+    margin-bottom: 80px;
+    [purpose='faq-header'] {
+      width: 392px;
+      margin-right: 16px;
+    }
+    [purpose='accordion'] {
+      width: 640px;
+      flex-grow: 1;
+      [purpose='accordion-body'] {
+        [purpose='accordion-header'] {
+          color: #192147;
+          display: flex;
+          flex-direction: row;
+          justify-content: space-between;
+          align-items: center;
+          font-weight: 700;
+          font-size: 16px;
+          line-height: 150%;
+          p {
+            margin-bottom: 0px;
+          }
+          span {
+            margin-left: 40px;
+            color: #8B8FA2;
+            font-weight: 900;
+            transform: rotate(0deg);
+            font-size: 19px;
+          }
+          &[aria-expanded] {
+            span {
+              transform: rotate(180deg);
+            }
+          }
+          &.collapsed {
+            span {
+              transform: rotate(0deg);
+            }
+          }
+        }
+        [purpose='accordion-item'] {
+          border-bottom: 1px solid #E2E4EA;
+          margin-top: 24px;
+          padding-bottom: 12px;
+        }
+        [purpose='faq-answer'] {
+          margin-right: 40px;
+          margin-bottom: 16px;
+          a {
+            text-decoration-line: underline;
+          }
+        }
+      }
+    }
+  }
+
+  [purpose='contact-note'] {
+    margin-top: 24px;
+    font-size: 16px;
+    font-style: normal;
+    font-weight: 400;
+    line-height: 24px;
+    a {
+      text-decoration-line: underline;
+    }
+  }
   [purpose='bottom-cta'] {
     padding-top: 80px;
     padding-bottom: 120px;
@@ -463,6 +585,71 @@
         width: 100%;
       }
     }
+    [purpose='features-table'] {
+      .truncated {
+        max-height: 1480px;
+        overflow-y: hidden;
+        justify-content: flex-start;
+        position: relative;
+        [purpose='truncated-features-fade'] {
+          position: absolute;
+          bottom: 0px;
+          background: linear-gradient(180deg, rgba(255, 255, 255, 0.00) -2.2%, #FFF 87.37%);
+          width: 100%;
+          height: 101px;
+        }
+      }
+    }
+    [purpose='faq'] {
+      padding-top: 80px;
+      border-top: 1px solid #E2E4EA;
+      margin-bottom: 80px;
+      [purpose='faq-header'] {
+        width: unset;
+        margin-right: 0px;
+        margin-bottom: 16px;
+      }
+      [purpose='accordion'] {
+        width: 100%;
+        [purpose='accordion-body'] {
+          [purpose='accordion-header'] {
+            color: #192147;
+            display: flex;
+            flex-direction: row;
+            justify-content: space-between;
+            align-items: center;
+            font-weight: 700;
+            font-size: 16px;
+            line-height: 150%;
+            p {
+              margin-bottom: 0px;
+            }
+            span {
+              margin-left: 40px;
+              color: #8B8FA2;
+              font-weight: 900;
+              transform: rotate(0deg);
+              font-size: 19px;
+            }
+            &[aria-expanded] {
+              span {
+                transform: rotate(180deg);
+              }
+            }
+            &.collapsed {
+              span {
+                transform: rotate(0deg);
+              }
+            }
+          }
+          [purpose='accordion-item'] {
+            border-bottom: 1px solid #E2E4EA;
+            margin-top: 16px;
+            margin-bottom: 16px;
+          }
+        }
+      }
+    }
   }
   @media (max-width: 575px) {
     // >575px:
diff --git a/website/assets/styles/pages/start.less b/website/assets/styles/pages/start.less
index 9a43754c76..436d6fdb9d 100644
--- a/website/assets/styles/pages/start.less
+++ b/website/assets/styles/pages/start.less
@@ -2,6 +2,7 @@
   background: linear-gradient(180deg, #E8F1F6 0%, #FFF 16.49%);
   a {
     color: @core-fleet-black-75;
+    text-decoration: underline;
   }
   h1 {
     font-size: 32px;
@@ -14,6 +15,13 @@
     font-weight: 800;
     line-height: 120%;
   }
+  ul {
+    margin-top: 32px;
+    padding-inline-start: 16px;
+    li {
+      margin-bottom: 24px;
+    }
+  }
   [purpose='logo-container'] {
     max-width: 524px;
     margin-left: auto;
@@ -29,15 +37,65 @@
     }
   }
   [purpose='form-container'] {
-    width: 528px;
-    margin-left: auto;
-    margin-right: auto;
-  }
-  [purpose='page-container'] {
-    padding-top: 64px;
+    min-width: 632px;
+    max-width: 632px;
     padding-left: 64px;
     padding-right: 64px;
-    padding-bottom: 64px;
+    padding-top: 32px;
+    margin-right: 20px;
+  }
+  [purpose='form-tip'] {
+    margin-top: 32px;
+    padding: 16px;
+    border-radius: 8px;
+    border: 1px solid #E6E3D0;
+    background: #FFFEF9;
+    p {
+      margin-bottom: 0px;
+      font-size: 14px;
+      line-height: 150%;
+    }
+    img {
+      height: 32px;
+      width: 32px;
+      margin-right: 12px;
+    }
+  }
+  [purpose='form-image'] {
+    width: 100%;
+    height: 680px;
+    max-width: 568px;
+    background-size: cover;
+    background-position: center;
+    background-repeat: no-repeat;
+    border-radius: 16px;
+    &.stage-one {
+      background-image: url('/images/psystage-1-unaware-558x680@2x.png');
+    }
+    &.stage-two {
+      background-image: url('/images/psystage-2-aware-508x784@2x.png');
+    }
+    &.stage-three {
+      background-image: url('/images/psystage-3-intrigued-558x680@2x.png');
+    }
+    &.stage-four {
+      background-image: url('/images/psystage-4-has-use-case-508x784@2x.png');
+    }
+    &.stage-five {
+      background-image: url('/images/cropped-fleet-cloud-city-504x784@2x.png');
+    }
+    &.stage-six {
+      background-image: url('/images/psystage-6-has-team-buy-in-504x784@2x.png');
+    }
+    &.cloud-city {
+      background-image: url('/images/cropped-fleet-cloud-city-504x784@2x.png');
+    }
+  }
+  [purpose='page-container'] {
+    padding-top: 20px;
+    padding-left: 20px;
+    padding-right: 24px;
+    padding-bottom: 24px;
     max-width: unset;
     display: flex;
     flex-direction: column;
@@ -49,7 +107,7 @@
     align-items: center;
     margin-bottom: 32px;
     img {
-      height: 18px;
+      height: 16px;
       display: inline;
       margin-left: 10px;
     }
@@ -140,6 +198,9 @@
     align-items: center;
     justify-content: start;
     user-select: none;
+    a {
+      text-decoration: none;
+    }
   }
   [purpose='submit-button'] {
     padding: 12px;
@@ -208,6 +269,9 @@
     }
 
   }
+  [parasails-component='logo-carousel'] {
+    margin-bottom: 0px;
+  }
   [purpose='quote'] {
     display: flex;
     padding: 32px;
@@ -259,6 +323,16 @@
       padding-right: 40px;
       max-width: 600px;
     }
+    [purpose='form-container'] {
+      padding: 0;
+      min-width: unset;
+      max-width: 504px;
+      margin-left: auto;
+      margin-right: auto;
+    }
+    [purpose='form-image'] {
+      display: none;
+    }
 
   }
   @media (max-width: 768px) {
@@ -267,7 +341,6 @@
       padding-left: 24px;
       padding-right: 24px;
     }
-
   }
   @media (max-width: 575px) {
     [purpose='logo-container'] {
@@ -284,7 +357,7 @@
       margin-bottom: 20px;
     }
     [purpose='form-container'] {
-      width: unset;
+      width: 100%;
       margin-left: 0;
       margin-right: 0;
     }
diff --git a/website/assets/styles/pages/vulnerability-management.less b/website/assets/styles/pages/vulnerability-management.less
index 17a1504178..87998dd3d2 100644
--- a/website/assets/styles/pages/vulnerability-management.less
+++ b/website/assets/styles/pages/vulnerability-management.less
@@ -46,7 +46,7 @@
 
   [purpose='page-headline'] {
     padding-bottom: 80px;
-    width: 680px;
+    max-width: 780px;
     h2 {
       font-size: 48px;
       font-style: normal;
diff --git a/website/config/custom.js b/website/config/custom.js
index ea67c02aef..249d5238e0 100644
--- a/website/config/custom.js
+++ b/website/config/custom.js
@@ -128,6 +128,7 @@ module.exports.custom = {
     // 'docs/Contributing/API-for-contributors.md': '', // « Covered in CODEOWNERS (2023-07-22)
     // 'schema': '',                                    // « Covered in CODEOWNERS (2023-07-22)
     'docs/01-Using-Fleet/standard-query-library/standard-query-library.yml': 'rachaelshaw', //« Built-in queries
+    '/docs/get-started/faq': 'zayhanlon',
     'ee/cis': 'sharon-fdm',//« Fleet Premium only: built-in queries  (built-in policies for CIS benchmarks)  -- FYI: On 2023-07-15, we changed this so that Sharon, Lucas, and Rachel are all maintainers, but where there is a single DRI who is automatically requested approval from.
 
     // 🫧 Articles and release notes
@@ -155,6 +156,9 @@ module.exports.custom = {
     'ee/vulnerability-dashboard/scripts': 'eashaw',
     'ee/vulnerability-dashboard/package.json': 'eashaw',
 
+    // 🫧 Bulk operations dashboard
+    'ee/bulk-operations-dashboard': 'eashaw',// (catch-all)
+
     // 🫧 Pricing and features
     // 'website/views/pages/pricing.ejs': '',                // « Covered in CODEOWNERS (2023-07-22)
     // 'handbook/company/pricing-features-table.yml': '',    // « Covered in CODEOWNERS (2023-07-22)
@@ -205,6 +209,7 @@ module.exports.custom = {
     // Reference, config surface, built-in queries, API, and other documentation
     'docs': ['rachaelshaw', 'noahtalerman', 'eashaw'],// (default for docs)
     'docs/01-Using-Fleet/standard-query-library/standard-query-library.yml': ['rachaelshaw', 'noahtalerman', 'eashaw'],// (standard query library)
+    '/docs/get-started/faq': ['ksatter', 'ddribeiro', 'zayhanlon'],
     'docs/REST API/rest-api.md': ['rachaelshaw', 'lukeheath'],// (standard query library)
     'schema': ['eashaw'],// (Osquery table schema)
     'ee/cis': ['lukeheath', 'sharon-fdm', 'lucasmrod', 'rachelElysia', 'rachaelshaw'],
@@ -232,6 +237,9 @@ module.exports.custom = {
     'ee/vulnerability-dashboard/config/routes.js': 'eashaw',
     'ee/vulnerability-dashboard/package.json': 'eashaw',
 
+    // 🫧 Bulk operations dashboard
+    'ee/bulk-operations-dashboard': 'eashaw',
+
     // Other brandfronts
     'README.md': ['mikermcneil', 'mike-j-thomas', 'lukeheath'],//« github brandfront (github.com/fleetdm/fleet)
     'tools/fleetctl-npm/README.md': ['mikermcneil', 'mike-j-thomas', 'lukeheath'],//« brandfront for fleetctl package on npm (npmjs.com/package/fleetctl)
@@ -258,7 +266,7 @@ module.exports.custom = {
     'handbook/company/product-groups.md': ['lukeheath', 'sampfluger88','mikermcneil'],
     'handbook/company/open-positions.yml': ['@sampfluger88','mikermcneil'],
     'handbook/digital-experience': ['sampfluger88','mikermcneil'],
-    'handbook/business-operations': ['sampfluger88','mikermcneil'],
+    'handbook/finance': ['sampfluger88','mikermcneil'],
     'handbook/engineering': ['sampfluger88','mikermcneil', 'lukeheath'],
     'handbook/product-design': ['sampfluger88','mikermcneil'],
     'handbook/sales': ['sampfluger88','mikermcneil'],
diff --git a/website/config/routes.js b/website/config/routes.js
index 59b068e650..57d1c0608b 100644
--- a/website/config/routes.js
+++ b/website/config/routes.js
@@ -331,7 +331,6 @@ module.exports.routes = {
   'GET /use-cases/using-elasticsearch-and-kibana-to-visualize-osquery-performance': '/guides/using-elasticsearch-and-kibana-to-visualize-osquery-performance',
   'GET /use-cases/work-may-be-watching-but-it-might-not-be-as-bad-as-you-think': '/securing/work-may-be-watching-but-it-might-not-be-as-bad-as-you-think',
   'GET /docs/contributing/testing':  '/docs/contributing/testing-and-local-development',
-  'GET /handbook/people': '/handbook/business-operations',
   'GET /handbook/people/ceo-handbook': '/handbook/ceo',
   'GET /handbook/company/ceo-handbook': '/handbook/ceo',
   'GET /handbook/growth': '/handbook/marketing#growth',
@@ -351,8 +350,8 @@ module.exports.routes = {
   'GET /device-management/fleet-user-stories-f100': '/success-stories/fleet-user-stories-wayfair',
   'GET /device-management/fleet-user-stories-schrodinger': '/success-stories/fleet-user-stories-wayfair',
   'GET /device-management/fleet-user-stories-wayfair': '/success-stories/fleet-user-stories-wayfair',
-  'GET /handbook/security': '/handbook/business-operations/security',
-  'GET /handbook/security/security-policies':'/handbook/business-operations/security-policies#information-security-policy-and-acceptable-use-policy',// « reasoning: https://github.com/fleetdm/fleet/pull/9624
+  'GET /handbook/security': '/handbook/digital-experience/security',
+  'GET /handbook/security/security-policies':'/handbook/digital-experience/security-policies#information-security-policy-and-acceptable-use-policy',// « reasoning: https://github.com/fleetdm/fleet/pull/9624
   'GET /handbook/handbook': '/handbook/company/handbook',
   'GET /handbook/company/development-groups': '/handbook/company/product-groups',
   'GET /docs/using-fleet/mdm-macos-settings': '/docs/using-fleet/mdm-custom-macos-settings',
@@ -363,11 +362,11 @@ module.exports.routes = {
   'GET /handbook/marketing': '/handbook/demand/',
   'GET /handbook/customers': '/handbook/sales/',
   'GET /handbook/product': '/handbook/product-design',
+  'GET /handbook/business-operations': '/handbook/finance',
 
   'GET /docs': '/docs/get-started/why-fleet',
   'GET /docs/get-started': '/docs/get-started/why-fleet',
   'GET /docs/rest-api': '/docs/rest-api/rest-api',
-  'GET /docs/using-fleet': '/docs/using-fleet/fleet-ui',
   'GET /docs/configuration': '/docs/configuration/fleet-server-configuration',
   'GET /docs/contributing': 'https://github.com/fleetdm/fleet/tree/main/docs/Contributing',
   'GET /docs/deploy': '/docs/deploy/introduction',
@@ -380,8 +379,8 @@ module.exports.routes = {
   'GET /docs/using-fleet/chromeos': '/docs/using-fleet/enroll-chromebooks',
   'GET /docs/using-fleet/rest-api': '/docs/rest-api/rest-api',
   'GET /docs/using-fleet/configuration-files': '/docs/configuration/configuration-files/',
-  'GET /docs/using-fleet/application-security': '/handbook/business-operations/application-security',
-  'GET /docs/using-fleet/security-audits': '/handbook/business-operations/security-audits',
+  'GET /docs/using-fleet/application-security': '/handbook/digital-experience/application-security',
+  'GET /docs/using-fleet/security-audits': '/handbook/digital-experience/security-audits',
   'GET /docs/using-fleet/process-file-events': '/guides/querying-process-file-events-table-on-centos-7',
   'GET /docs/using-fleet/audit-activities': '/docs/using-fleet/audit-logs',
   'GET /docs/using-fleet/detail-queries-summary': '/docs/using-fleet/understanding-host-vitals',
@@ -451,6 +450,37 @@ module.exports.routes = {
       return res.redirect('/tables/'+req.param('tableName'));
     }
   },
+  'GET /docs/using-fleet/fleet-ui': (req,res)=> { return res.redirect(301, '/guides/queries');},
+  'GET /docs/using-fleet/learn-how-to-use-fleet': (req,res)=> { return res.redirect(301, '/guides/queries');},
+  'GET /docs/using-fleet/fleetctl-cli': (req,res)=> { return res.redirect(301, '/guides/fleetctl');},
+  'GET /docs/using-fleet/fleet-desktop': (req,res)=> { return res.redirect(301, '/guides/fleet-desktop');},
+  'GET /docs/using-fleet/enroll-hosts': (req,res)=> { return res.redirect(301, '/guides/enroll-hosts');},
+  'GET /docs/using-fleet/manage-access': (req,res)=> { return res.redirect(301, '/guides/role-based-access');},
+  'GET /docs/using-fleet/segment-hosts': (req,res)=> { return res.redirect(301, '/guides/teams');},
+  'GET /docs/using-fleet/supported-browsers': (req,res)=> { return res.redirect(301, '/docs/get-started/faq');},
+  'GET /docs/using-fleet/supported-host-operating-systems': (req,res)=> { return res.redirect(301, '/docs/get-started/faq');},
+  'GET /docs/using-fleet/gitops': (req,res)=> { return res.redirect(301, '/docs/configuration/yaml-files');},
+  'GET /docs/using-fleet/mdm-setup': (req,res)=> { return res.redirect(301, '/guides/macos-mdm-setup');},
+  'GET /docs/using-fleet/mdm-migration-guide': (req,res)=> { return res.redirect(301, '/guides/mdm-migration');},
+  'GET /docs/using-fleet/mdm-os-updates': (req,res)=> { return res.redirect(301, '/guides/enforce-os-updates');},
+  'GET /docs/using-fleet/mdm-disk-encryption': (req,res)=> { return res.redirect(301, '/guides/enforce-disk-encryption');},
+  'GET /docs/using-fleet/mdm-custom-os-settings': (req,res)=> { return res.redirect(301, '/guides/custom-os-settings');},
+  'GET /docs/using-fleet/mdm-macos-setup-experience': (req,res)=> { return res.redirect(301, '/guides/macos-setup-experience');},
+  'GET /docs/using-fleet/scripts': (req,res)=> { return res.redirect(301, '/guides/scripts');},
+  'GET /docs/using-fleet/automations': (req,res)=> { return res.redirect(301, '/guides/automations');},
+  'GET /docs/using-fleet/puppet-module': (req,res)=> { return res.redirect(301, '/guides/puppet-module');},
+  'GET /docs/using-fleet/vulnerability-processing': (req,res)=> { return res.redirect(301, '/guides/vulnerability-processing');},
+  'GET /docs/using-fleet/cis-benchmarks': (req,res)=> { return res.redirect(301, '/guides/cis-benchmarks');},
+  'GET /docs/using-fleet/osquery-process': (req,res)=> { return res.redirect(301, '/guides/osquery-watchdog');},
+  'GET /docs/using-fleet/update-agents': (req,res)=> { return res.redirect(301, '/guides/fleetd-updates');},
+  'GET /docs/using-fleet/usage-statistics': (req,res)=> { return res.redirect(301, '/guides/fleet-usage-statistics');},
+  'GET /docs/using-fleet/downgrading-fleet': (req,res)=> { return res.redirect(301, '/guides/downgrade-fleet');},
+  'GET /docs/using-fleet/enroll-chromebooks': (req,res)=> { return res.redirect(301, '/guides/chrome-os');},
+  'GET /docs/using-fleet/audit-logs': (req,res)=> { return res.redirect(301, 'https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Audit-logs.md');},
+  'GET /docs/using-fleet/understanding-host-vitals': (req,res)=> { return res.redirect(301, 'https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Understanding-host-vitals.md');},
+  'GET /docs/using-fleet/standard-query-library': (req,res)=> { return res.redirect(301, '/guides/standard-query-library');},
+  'GET /docs/using-fleet/mdm-commands': (req,res)=> { return res.redirect(301, '/guides/mdm-commands');},
+  'GET /docs/using-fleet/log-destinations': (req,res)=> { return res.redirect(301, '/guides/log-destinations');},
 
   //  ╔╦╗╦╔═╗╔═╗  ╦═╗╔═╗╔╦╗╦╦═╗╔═╗╔═╗╔╦╗╔═╗   ┬   ╔╦╗╔═╗╦ ╦╔╗╔╦  ╔═╗╔═╗╔╦╗╔═╗
   //  ║║║║╚═╗║    ╠╦╝║╣  ║║║╠╦╝║╣ ║   ║ ╚═╗  ┌┼─   ║║║ ║║║║║║║║  ║ ║╠═╣ ║║╚═╗
@@ -473,14 +503,14 @@ module.exports.routes = {
   'GET /legal':                      '/legal/terms',
   'GET /terms':                      '/legal/terms',
   'GET /handbook/security/github':   '/handbook/security#git-hub-security',
-  'GET /slack':                      'https://join.slack.com/t/osquery/shared_invite/zt-1wkw5fzba-lWEyke60sjV6C4cdinFA1w',// Note: This redirect is used on error pages and email templates in the Fleet UI.
+  'GET /slack':                      'https://join.slack.com/t/osquery/shared_invite/zt-2op37v6qp-aVPivU5xB_FwuYElN0Z1lw',// Note: This redirect is used on error pages and email templates in the Fleet UI.
   'GET /docs/using-fleet/updating-fleet': '/docs/deploying/upgrading-fleet',
   'GET /blog':                   '/articles',
   'GET /brand':                  '/logos',
   'GET /get-started':            '/try-fleet',
   'GET /g':                       (req,res)=> { let originalQueryStringWithAmp = req.url.match(/\?(.+)$/) ? '&'+req.url.match(/\?(.+)$/)[1] : ''; return res.redirect(301, sails.config.custom.baseUrl+'/?meet-fleet'+originalQueryStringWithAmp); },
   'GET /test-fleet-sandbox':     '/register',
-  'GET /unsubscribe':             (req,res)=> { let originalQueryString = req.url.match(/\?(.+)$/) ? req.url.match(/\?(.+)$/)[1] : ''; return res.redirect(301, sails.config.custom.baseUrl+'/api/v1/unsubscribe-from-all-newsletters?'+originalQueryString);},
+  'GET /unsubscribe':             (req,res)=> { let originalQueryString = req.url.match(/\?(.+)$/) ? req.url.match(/\?(.+)$/)[1] : ''; return res.redirect(301, sails.config.custom.baseUrl+'/api/v1/unsubscribe-from-marketing-emails?'+originalQueryString);},
   'GET /tables':                 '/tables/account_policy_data',
   'GET /imagine/launch-party':  'https://www.eventbrite.com/e/601763519887',
   'GET /blackhat2023':   'https://github.com/fleetdm/fleet/tree/main/tools/blackhat-mdm', // Assets from @marcosd4h & @zwass Black Hat 2023 talk
@@ -529,6 +559,11 @@ module.exports.routes = {
   'GET /learn-more-about/host-identifiers': '/docs/rest-api/rest-api#get-host-by-identifier',
   'GET /learn-more-about/uninstall-fleetd': '/docs/using-fleet/faq#how-can-i-uninstall-fleetd',
   'GET /learn-more-about/vulnerability-processing': '/docs/using-fleet/vulnerability-processing',
+  'GET /learn-more-about/dep-profile': 'https://developer.apple.com/documentation/devicemanagement/define_a_profile',
+  'GET /learn-more-about/apple-business-manager-tokens-api': '/docs/rest-api/rest-api#list-apple-business-manager-abm-tokens',
+  'GET /learn-more-about/apple-business-manager-teams-api': 'https://github.com/fleetdm/fleet/blob/main/docs/Contributing/API-for-contributors.md#update-abm-tokens-teams',
+  'GET /learn-more-about/apple-business-manager-gitops': '/docs/using-fleet/gitops#apple-business-manager',
+  'GET /learn-more-about/s3-bootstrap-package': '/docs/configuration/fleet-server-configuration#s-3-software-installers-bucket',
 
   // Sitemap
   // =============================================================================================================
@@ -557,7 +592,7 @@ module.exports.routes = {
   'GET /defcon':                 'https://kqphpqst851.typeform.com/to/Y6NYxM5A',
   'GET /osquery-stickers':       'https://kqphpqst851.typeform.com/to/JxJ8YnxG',
   'GET /swag':                   'https://kqphpqst851.typeform.com/to/Y6NYxM5A',
-  'GET /community':              'https://join.slack.com/t/osquery/shared_invite/zt-1wkw5fzba-lWEyke60sjV6C4cdinFA1w',
+  'GET /community':              'https://join.slack.com/t/osquery/shared_invite/zt-2op37v6qp-aVPivU5xB_FwuYElN0Z1lw',
 
   // Temporary redirects
   // =============================================================================================================
@@ -605,4 +640,5 @@ module.exports.routes = {
   'POST /api/v1/save-questionnaire-progress': { action: 'save-questionnaire-progress' },
   'POST /api/v1/account/update-start-cta-visibility': { action: 'account/update-start-cta-visibility' },
   'POST /api/v1/deliver-deal-registration-submission': { action: 'deliver-deal-registration-submission' },
+  '/api/v1/unsubscribe-from-marketing-emails': { action: 'unsubscribe-from-marketing-emails' },
 };
diff --git a/website/package.json b/website/package.json
index a07935e6c1..da6d9abee2 100644
--- a/website/package.json
+++ b/website/package.json
@@ -13,7 +13,7 @@
     "moment": "2.29.4",
     "sails": "^1.5.11",
     "sails-hook-apianalytics": "^2.0.6",
-    "sails-hook-organics": "^2.2.2",
+    "sails-hook-organics": "^3.0.0",
     "sails-hook-orm": "^4.0.3",
     "sails-hook-sockets": "^3.0.0",
     "sails-postgresql": "^5.0.1"
diff --git a/website/scripts/build-static-content.js b/website/scripts/build-static-content.js
index 03050e00f0..eaa40900b3 100644
--- a/website/scripts/build-static-content.js
+++ b/website/scripts/build-static-content.js
@@ -16,7 +16,7 @@ module.exports = {
   fn: async function ({ dry, githubAccessToken }) {
     let path = require('path');
     let YAML = require('yaml');
-
+    let util = require('util');
     // FUTURE: If we ever need to gather source files from other places or branches, etc, see git history of this file circa 2021-05-19 for an example of a different strategy we might use to do that.
     let topLvlRepoPath = path.resolve(sails.config.appPath, '../');
 
@@ -390,11 +390,29 @@ module.exports = {
               }//fi
 
               // Get last modified timestamp using git, and represent it as a JS timestamp.
-              // > Inspired by https://github.com/uncletammy/doc-templater/blob/2969726b598b39aa78648c5379e4d9503b65685e/lib/compile-markdown-tree-from-remote-git-repo.js#L265-L273
-              let lastModifiedAt = (new Date((await sails.helpers.process.executeCommand.with({
-                command: `git log -1 --format="%ai" '${path.relative(topLvlRepoPath, pageSourcePath)}'`,
-                dir: topLvlRepoPath,
-              })).stdout)).getTime();
+              let lastModifiedAt;
+              if(!githubAccessToken) {
+                lastModifiedAt = Date.now();
+              } else if(process.env.GITHUB_REF_NAME && process.env.GITHUB_REF_NAME === 'main') {// Only add lastModifiedAt timestamps if this test is running on the main branch
+                let responseData = await sails.helpers.http.get.with({// [?]: https://docs.github.com/en/rest/commits/commits?apiVersion=2022-11-28#list-commits
+                  url: 'https://api.github.com/repos/fleetdm/fleet/commits',
+                  data: {
+                    path: path.join(sectionRepoPath, pageRelSourcePath),
+                    page: 1,
+                    per_page: 1,//eslint-disable-line camelcase
+                  },
+                  headers: baseHeadersForGithubRequests,
+                }).intercept((err)=>{
+                  return new Error(`When getting the commit history for ${path.join(sectionRepoPath, pageRelSourcePath)} to get a lastModifiedAt timestamp, an error occured.`, err);
+                });
+                // The value we'll use for the lastModifiedAt timestamp will be date value of the `commiter` property of the `commit` we got in the API response from github.
+                let mostRecentCommitToThisFile = responseData[0];
+                if(!mostRecentCommitToThisFile.commit || !mostRecentCommitToThisFile.commit.committer) {
+                  // Throw an error if the the response from GitHub is missing a commit or commiter.
+                  throw new Error(`When getting the commit history for ${path.join(sectionRepoPath, pageRelSourcePath)} to get a lastModifiedAt timestamp, the response from the GitHub API did not include information about the most recent commit. Response from GitHub: ${util.inspect(responseData, {depth:null})}`);
+                }
+                lastModifiedAt = (new Date(mostRecentCommitToThisFile.commit.committer.date)).getTime(); // Convert the UTC timestamp from GitHub to a JS timestamp.
+              }
 
               // Determine display title (human-readable title) to use for this page.
               let pageTitle;
@@ -560,11 +578,30 @@ module.exports = {
         let RELATIVE_PATH_TO_OPEN_POSITIONS_YML_IN_FLEET_REPO = 'handbook/company/open-positions.yml';
 
         // Get last modified timestamp using git, and represent it as a JS timestamp.
-        // > Inspired by https://github.com/uncletammy/doc-templater/blob/2969726b598b39aa78648c5379e4d9503b65685e/lib/compile-markdown-tree-from-remote-git-repo.js#L265-L273
-        let lastModifiedAt = (new Date((await sails.helpers.process.executeCommand.with({
-          command: `git log -1 --format="%ai" '${path.join(topLvlRepoPath, RELATIVE_PATH_TO_OPEN_POSITIONS_YML_IN_FLEET_REPO)}'`,
-          dir: topLvlRepoPath,
-        })).stdout)).getTime();
+        let lastModifiedAt;
+        if(!githubAccessToken) {
+          lastModifiedAt = Date.now();
+        } else {
+          // If we're including a lastModifiedAt value for schema tables, we'll send a request to the GitHub API to get a timestamp of when the last commit
+          let responseData = await sails.helpers.http.get.with({// [?]: https://docs.github.com/en/rest/commits/commits?apiVersion=2022-11-28#list-commits
+            url: 'https://api.github.com/repos/fleetdm/fleet/commits',
+            data: {
+              path: RELATIVE_PATH_TO_OPEN_POSITIONS_YML_IN_FLEET_REPO,
+              page: 1,
+              per_page: 1,//eslint-disable-line camelcase
+            },
+            headers: baseHeadersForGithubRequests,
+          }).intercept((err)=>{
+            return new Error(`When getting the commit history for the open positions YAML to get a lastModifiedAt timestamp, an error occured.`, err);
+          });
+          // The value we'll use for the lastModifiedAt timestamp will be date value of the `commiter` property of the `commit` we got in the API response from github.
+          let mostRecentCommitToThisFile = responseData[0];
+          if(!mostRecentCommitToThisFile.commit || !mostRecentCommitToThisFile.commit.committer) {
+            // Throw an error if the the response from GitHub is missing a commit or commiter.
+            throw new Error(`When trying to get a lastModifiedAt timestamp for the open positions YAML, the response from the GitHub API did not include information about the most recent commit. Response from GitHub: ${util.inspect(responseData, {depth:null})}`);
+          }
+          lastModifiedAt = (new Date(mostRecentCommitToThisFile.commit.committer.date)).getTime(); // Convert the UTC timestamp from GitHub to a JS timestamp.
+        }
 
         let openPositionsYaml = await sails.helpers.fs.read(path.join(topLvlRepoPath, RELATIVE_PATH_TO_OPEN_POSITIONS_YML_IN_FLEET_REPO)).intercept('doesNotExist', (err)=>new Error(`Could not find open positions YAML file at "${RELATIVE_PATH_TO_OPEN_POSITIONS_YML_IN_FLEET_REPO}".  Was it accidentally moved?  Raw error: `+err.message));
         let openPositionsToCreatePartialsFor = YAML.parse(openPositionsYaml, {prettyErrors: true});
@@ -673,7 +710,12 @@ module.exports = {
 
         }
         // After we build the Markdown pages, we'll merge the osquery schema with the Fleet schema overrides, then create EJS partials for each table in the merged schema.
-        let expandedTables = await sails.helpers.getExtendedOsquerySchema.with({includeLastModifiedAtValue: true});
+        let expandedTables;
+        if(githubAccessToken){
+          expandedTables = await sails.helpers.getExtendedOsquerySchema.with({includeLastModifiedAtValue: true, githubAccessToken,});
+        } else {
+          expandedTables = await sails.helpers.getExtendedOsquerySchema();
+        }
 
         // Once we have our merged schema, we'll create ejs partials for each table.
         for(let table of expandedTables) {
@@ -803,8 +845,15 @@ module.exports = {
         let yaml = await sails.helpers.fs.read(path.join(topLvlRepoPath, RELATIVE_PATH_TO_PRICING_TABLE_YML_IN_FLEET_REPO)).intercept('doesNotExist', (err)=>new Error(`Could not find pricing table features YAML file at "${RELATIVE_PATH_TO_PRICING_TABLE_YML_IN_FLEET_REPO}".  Was it accidentally moved?  Raw error: `+err.message));
         let pricingTableFeatures = YAML.parse(yaml, {prettyErrors: true});
         let VALID_PRODUCT_CATEGORIES = ['Endpoint operations', 'Device management', 'Vulnerability management'];
-        let VALID_PRICING_TABLE_CATEGORIES = ['Support', 'Deployment', 'Integrations', 'Endpoint operations', 'Device management', 'Vulnerability management'];
+        let VALID_PRICING_TABLE_CATEGORIES = ['Support', 'Deployment', 'Integrations', 'Configuration', 'Devices', 'Vulnerability management'];
+        let VALID_PRICING_TABLE_KEYS = ['industryName', 'description', 'documentationUrl', 'tier', 'jamfProHasFeature', 'jamfProtectHasFeature', 'usualDepartment', 'productCategories', 'pricingTableCategories', 'waysToUse', 'buzzwords', 'demos', 'dri', 'friendlyName', 'moreInfoUrl', 'comingSoonOn', 'screenshotSrc', 'isExperimental'];
         for(let feature of pricingTableFeatures){
+          // Throw an error if a feature contains an unrecognized key.
+          for(let key of _.keys(feature)){
+            if(!VALID_PRICING_TABLE_KEYS.includes(key)){
+              throw new Error(`Unrecognized key. Could not build pricing table config from pricing-features-table.yml. The "${feature.industryName}" feature contains an unrecognized key (${key}). To resolve, fix any typos or remove this key and try running this script again.`);
+            }
+          }
           if(feature.name) {// Compatibility check
             throw new Error(`Could not build pricing table config from pricing-features-table.yml. A feature has a "name" (${feature.name}) which is no longer supported. To resolve, add a "industryName" to this feature: ${feature}`);
           }
@@ -1091,7 +1140,6 @@ module.exports = {
         }
       });
     }
-
   }
 
 
diff --git a/website/scripts/deliver-nurture-emails.js b/website/scripts/deliver-nurture-emails.js
index 552c75b0a5..7b682460e9 100644
--- a/website/scripts/deliver-nurture-emails.js
+++ b/website/scripts/deliver-nurture-emails.js
@@ -52,7 +52,8 @@ module.exports = {
           template: 'email-nurture-stage-three',
           layout: 'layout-nurture-email',
           templateData: {
-            firstName: user.firstName
+            firstName: user.firstName,
+            emailAddress: user.emailAddress
           },
           to: user.emailAddress,
           toName: `${user.firstName} ${user.lastName}`,
@@ -76,20 +77,26 @@ module.exports = {
       if(user.psychologicalStageLastChangedAt > oneDayAgoAt) {
         continue;
       } else {
-        await sails.helpers.sendTemplateEmail.with({
-          template: 'email-nurture-stage-four',
-          layout: 'layout-nurture-email',
-          templateData: {
-            firstName: user.firstName
-          },
-          to: user.emailAddress,
-          toName: `${user.firstName} ${user.lastName}`,
-          subject: 'Deploy open-source MDM',
-          bcc: [sails.config.custom.activityCaptureEmailForNutureEmails],
-          from: sails.config.custom.contactEmailForNutureEmails,
-          fromName: sails.config.custom.contactNameForNurtureEmails,
-          ensureAck: true,
-        });
+        // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+        // Note: We commented this out because it was interfering with the ability for leads to flow
+        // without making reps wait.  We can turn it back on when we have a way for Drew to disable
+        // nurture emails on a per-contact basis from Salesforce.
+        // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+        // await sails.helpers.sendTemplateEmail.with({
+        //   template: 'email-nurture-stage-four',
+        //   layout: 'layout-nurture-email',
+        //   templateData: {
+        //     firstName: user.firstName,
+        //     emailAddress: user.emailAddress
+        //   },
+        //   to: user.emailAddress,
+        //   toName: `${user.firstName} ${user.lastName}`,
+        //   subject: 'Deploy open-source MDM',
+        //   bcc: [sails.config.custom.activityCaptureEmailForNutureEmails],
+        //   from: sails.config.custom.contactEmailForNutureEmails,
+        //   fromName: sails.config.custom.contactNameForNurtureEmails,
+        //   ensureAck: true,
+        // });
         emailedStageFourUserIds.push(user.id);
       }
     }
@@ -109,7 +116,8 @@ module.exports = {
           template: 'email-nurture-stage-five',
           layout: 'layout-nurture-email',
           templateData: {
-            firstName: user.firstName
+            firstName: user.firstName,
+            emailAddress: user.emailAddress
           },
           to: user.emailAddress,
           toName: `${user.firstName} ${user.lastName}`,
diff --git a/website/scripts/get-bug-and-pr-report.js b/website/scripts/get-bug-and-pr-report.js
index 5894be6ecb..06791bf10a 100644
--- a/website/scripts/get-bug-and-pr-report.js
+++ b/website/scripts/get-bug-and-pr-report.js
@@ -33,8 +33,10 @@ module.exports = {
     let daysSinceReleasedBugsWereOpened = [];
     let allBugsWithUnreleasedLabel = [];
     let allBugsWithReleasedLabel = [];
+    let allBugs32DaysOrOlder = [];
     let allBugsCreatedInPastWeek = [];
     let allBugsClosedInPastWeek = [];
+    let allBugsReportedByCustomersInPastWeek = [];
     let daysSincePullRequestsWereOpened = [];
     let daysSinceContributorPullRequestsWereOpened = [];
     let commitToMergeTimesInDays = [];
@@ -44,7 +46,7 @@ module.exports = {
     let allNonPublicOpenPrs = [];
     let nonPublicPrsClosedInThePastThreeWeeks = [];
 
-    // Product group KPIS
+
 
     // Endpoint operations
     let allBugsCreatedInPastWeekEndpointOps = [];
@@ -103,8 +105,16 @@ module.exports = {
           let timeOpenInMS = Math.abs(todaysDate - issueOpenedOn);
           // Convert the miliseconds to days and add the value to the daysSinceBugsWereOpened array
           let timeOpenInDays = timeOpenInMS / ONE_DAY_IN_MILLISECONDS;
+          if (timeOpenInDays >= 32) {
+            allBugs32DaysOrOlder.push(issue);
+          }
           if (timeOpenInDays <= 7) {
+            // All bugs in past week
             allBugsCreatedInPastWeek.push(issue);
+            // Customer-reported bugs
+            if (issue.labels.some(label => label.name.indexOf('customer-') >= 0)) {
+              allBugsReportedByCustomersInPastWeek.push(issue);
+            }
             // Get Endpoint Ops KPIs
             if (issue.labels.some(label => label.name === '#g-endpoint-ops')) {
               allBugsCreatedInPastWeekEndpointOps.push(issue);
@@ -132,6 +142,7 @@ module.exports = {
               }
             }
           }
+
           daysSinceBugsWereOpened.push(timeOpenInDays);
           // Send to released or unreleased bugs array
           if (issue.labels.some(label => label.name === '~unreleased bug')) {
@@ -316,8 +327,8 @@ module.exports = {
       //
       async()=>{
 
-        // Fetch confidential and classified PRs (current open, and recent closed)
-        for (let repoName of ['classified', 'confidential']) {
+        // Fetch confidential PRs (current open, and recent closed)
+        for (let repoName of ['confidential']) {
           // [?] https://docs.github.com/en/free-pro-team@latest/rest/pulls/pulls#list-pull-requests
           let openPrs = await sails.helpers.http.get(`https://api.github.com/repos/fleetdm/${encodeURIComponent(repoName)}/pulls`, {
             state: 'open',
@@ -380,25 +391,12 @@ module.exports = {
     // NOTE: If order of the KPI sheets columns changes, the order values are pushed into this array needs to change, as well.
     kpiResults.push(
       averageDaysContributorPullRequestsAreOpenFor,
-      daysSinceContributorPullRequestsWereOpened.length,
-      averageDaysPullRequestsAreOpenFor,
-      daysSincePullRequestsWereOpened.length,
+      allBugs32DaysOrOlder.length,
+      allBugsReportedByCustomersInPastWeek.length,
       averageNumberOfDaysReleasedBugsAreOpenFor,
       averageNumberOfDaysUnreleasedBugsAreOpenFor,
-      allBugsClosedInPastWeek.length,
-      averageNumberOfDaysBugsAreOpenFor,
       allBugsCreatedInPastWeek.length,
-      allBugsCreatedInPastWeekEndpointOps.length,
-      allBugsCreatedInPastWeekEndpointOpsCustomerImpacting.length,
-      allBugsCreatedInPastWeekEndpointOpsReleased.length,
-      allBugsCreatedInPastWeekEndpointOpsUnreleased.length,
-      allBugsCreatedInPastWeekMobileDeviceManagement.length,
-      allBugsCreatedInPastWeekMobileDeviceManagementCustomerImpacting.length,
-      allBugsCreatedInPastWeekMobileDeviceManagementReleased.length,
-      allBugsCreatedInPastWeekMobileDeviceManagementUnreleased.length,
-      daysSinceBugsWereOpened.length,
-      allBugsWithReleasedLabel.length,
-      allBugsWithUnreleasedLabel.length);
+      allBugsClosedInPastWeek.length,);
 
     // Log the results
     sails.log(`
@@ -407,17 +405,19 @@ module.exports = {
     ---------------------------
     ${kpiResults.join(',')}
 
-    Note: Copy the values above, then in Google sheets paste them into a cell and select "Split text to columns" to paste the values into separate cells.
+    Note: Copy the values above, then paste into Google KPI sheet and select "Split text to columns" to split the values into separate columns.
 
     Pull requests:
     ---------------------------
     Average open time (no bots, no handbook, no ceo): ${averageDaysContributorPullRequestsAreOpenFor} days.
+
     Number of open pull requests in the fleetdm/fleet Github repo (no bots, no handbook, no ceo): ${daysSinceContributorPullRequestsWereOpened.length}
 
     Average open time (all PRs): ${averageDaysPullRequestsAreOpenFor} days.
+
     Number of open pull requests in the fleetdm/fleet Github repo: ${daysSincePullRequestsWereOpened.length}
 
-    Bugs (part 1):
+    Bugs:
     ---------------------------
     Average open time (released bugs): ${averageNumberOfDaysReleasedBugsAreOpenFor} days.
 
@@ -429,6 +429,12 @@ module.exports = {
 
     Number of issues with the "bug" label opened in the past week: ${allBugsCreatedInPastWeek.length}
 
+    Number of open issues with the "bug" label in fleetdm/fleet: ${daysSinceBugsWereOpened.length}
+
+    Number of open issues with the "~released bug" label in fleetdm/fleet: ${allBugsWithReleasedLabel.length}
+
+    Number of open issues with the "~unreleased bug" label in fleetdm/fleet: ${allBugsWithUnreleasedLabel.length}
+
     Endpoint Operations:
     ---------------------------
     Number of issues with the "#g-endpoint-ops" and "bug" labels opened in the past week: ${allBugsCreatedInPastWeekEndpointOps.length}
@@ -449,17 +455,10 @@ module.exports = {
 
     Number of issues with the "#g-mdm", "bug", and "~unreleased bug" labels opened in the past week: ${allBugsCreatedInPastWeekMobileDeviceManagementUnreleased.length}
 
-    Bugs (part 2):
-    ---------------------------
-    Number of open issues with the "bug" label in fleetdm/fleet: ${daysSinceBugsWereOpened.length}
-
-    Number of open issues with the "~released bug" label in fleetdm/fleet: ${allBugsWithReleasedLabel.length}
-
-    Number of open issues with the "~unreleased bug" label in fleetdm/fleet: ${allBugsWithUnreleasedLabel.length}
-
     Pull requests requiring CEO review
     ---------------------------------------
     Number of open ~ceo pull requests in the fleetdm Github org: ${ceoDependentOpenPrs.length}
+
     Average open time (~ceo PRs): ${Math.round(ceoDependentPrOpenTime*100)/100} days.
     `);
 
diff --git a/website/scripts/migrate-lead-source-to-contact-source.js b/website/scripts/migrate-lead-source-to-contact-source.js
new file mode 100644
index 0000000000..407e1bee09
--- /dev/null
+++ b/website/scripts/migrate-lead-source-to-contact-source.js
@@ -0,0 +1,44 @@
+module.exports = {
+
+
+  friendlyName: 'Migrate lead source to contact source',
+
+
+  description: '',
+
+
+  fn: async function () {
+
+    sails.log('Running custom shell script... (`sails run migrate-lead-source-to-contact-source`)');
+
+    require('assert')(sails.config.custom.salesforceIntegrationUsername);
+    require('assert')(sails.config.custom.salesforceIntegrationPasskey);
+
+    // Log in to Salesforce.
+    let jsforce = require('jsforce');
+    let salesforceConnection = new jsforce.Connection({
+      loginUrl : 'https://fleetdm.my.salesforce.com'
+    });
+    await salesforceConnection.login(sails.config.custom.salesforceIntegrationUsername, sails.config.custom.salesforceIntegrationPasskey);
+
+    let POSSIBLE_CONTACT_SOURCES = ['Dripify', 'Website - Contact forms', 'Website - Sign up', 'Website - Swag request', 'Manual research', 'Initial qualification meeting'];
+    let contacts = (
+      await salesforceConnection.query(`SELECT Id, LeadSource, FirstName FROM Contact WHERE Contact_source__c = NULL AND LeadSource IN (${POSSIBLE_CONTACT_SOURCES.map((src)=>'\''+src+'\'').join(', ')})`)
+      // await salesforceConnection.query(`SELECT Id, LeadSource, FirstName FROM Contact WHERE LastName = 'McNeil' AND FirstName IN (${['Mike'].map((src)=>'\''+src+'\'').join(', ')}) AND LeadSource IN (${POSSIBLE_CONTACT_SOURCES.map((src)=>'\''+src+'\'').join(', ')})`)
+    ).records;// « unpack the sausage
+    // console.log(contacts);
+
+    await sails.helpers.flow.simultaneouslyForEach(contacts, async (contact)=>{
+      // console.log(`${contact.FirstName} :: ${contact.LeadSource}`);
+      await salesforceConnection.sobject('Contact').update({
+        Id: contact.Id,
+        Contact_source__c: contact.LeadSource//eslint-disable-line camelcase
+      });
+    });//∞
+
+
+  }
+
+
+};
+
diff --git a/website/scripts/send-aggregated-metrics-to-datadog.js b/website/scripts/send-aggregated-metrics-to-datadog.js
index 959c3625b5..f13826b866 100644
--- a/website/scripts/send-aggregated-metrics-to-datadog.js
+++ b/website/scripts/send-aggregated-metrics-to-datadog.js
@@ -406,6 +406,69 @@ module.exports = {
       }],
       tags: [`enabled:false`],
     });
+    // aiFeaturesDisabled
+    let numberOfInstancesWithAiFeaturesDisabled = _.where(latestStatisticsReportedByReleasedFleetVersions, {aiFeaturesDisabled: true}).length;
+    let numberOfInstancesWithAiFeaturesEnabled = numberOfInstancesToReport - numberOfInstancesWithAiFeaturesDisabled;
+    metricsToReport.push({
+      metric: 'usage_statistics.ai_features',
+      type: 3,
+      points: [{
+        timestamp: timestampForTheseMetrics,
+        value: numberOfInstancesWithAiFeaturesEnabled
+      }],
+      tags: [`enabled:true`],
+    });
+    metricsToReport.push({
+      metric: 'usage_statistics.ai_features',
+      type: 3,
+      points: [{
+        timestamp: timestampForTheseMetrics,
+        value: numberOfInstancesWithAiFeaturesDisabled
+      }],
+      tags: [`enabled:false`],
+    });
+    // maintenanceWindowsEnabled
+    let numberOfInstancesWithMaintenanceWindowsEnabled = _.where(latestStatisticsReportedByReleasedFleetVersions, {maintenanceWindowsEnabled: true}).length;
+    let numberOfInstancesWithMaintenanceWindowsDisabled = numberOfInstancesToReport - numberOfInstancesWithMaintenanceWindowsEnabled;
+    metricsToReport.push({
+      metric: 'usage_statistics.maintenance_windows',
+      type: 3,
+      points: [{
+        timestamp: timestampForTheseMetrics,
+        value: numberOfInstancesWithMaintenanceWindowsEnabled
+      }],
+      tags: [`enabled:true`],
+    });
+    metricsToReport.push({
+      metric: 'usage_statistics.maintenance_windows',
+      type: 3,
+      points: [{
+        timestamp: timestampForTheseMetrics,
+        value: numberOfInstancesWithMaintenanceWindowsDisabled
+      }],
+      tags: [`enabled:false`],
+    });
+    // maintenanceWindowsConfigured
+    let numberOfInstancesWithMaintenanceWindowsConfigured = _.where(latestStatisticsReportedByReleasedFleetVersions, {maintenanceWindowsEnabled: true}).length;
+    let numberOfInstancesWithoutMaintenanceWindowsConfigured = numberOfInstancesToReport - numberOfInstancesWithMaintenanceWindowsConfigured;
+    metricsToReport.push({
+      metric: 'usage_statistics.maintenance_windows_configured',
+      type: 3,
+      points: [{
+        timestamp: timestampForTheseMetrics,
+        value: numberOfInstancesWithMaintenanceWindowsConfigured
+      }],
+      tags: [`configured:true`],
+    });
+    metricsToReport.push({
+      metric: 'usage_statistics.maintenance_windows_configured',
+      type: 3,
+      points: [{
+        timestamp: timestampForTheseMetrics,
+        value: numberOfInstancesWithoutMaintenanceWindowsConfigured
+      }],
+      tags: [`configured:false`],
+    });
 
     // Create two metrics to track total number of hosts reported in the last week.
     let totalNumberOfHostsReportedByPremiumInstancesInTheLastWeek = _.sum(_.pluck(_.filter(latestStatisticsReportedByReleasedFleetVersions, {licenseTier: 'premium'}), 'numHostsEnrolled'));
diff --git a/website/views/emails/email-contact-form.ejs b/website/views/emails/email-contact-form.ejs
new file mode 100644
index 0000000000..0e8f8bf8ee
--- /dev/null
+++ b/website/views/emails/email-contact-form.ejs
@@ -0,0 +1,15 @@
+<% /* Note: This is NOT injected into an email layout` */ %>
+<div style="width: 100%; font-family: 'Inter','Helvetica','arial', sans-serif; box-sizing: border-box; padding: 0; margin: 0;">
+  <div style="color: #192147; font-size: 16px; box-sizing: border-box; padding: 40px 60px 80px 28px; width: 100%; max-width: 600px; margin-left: auto; margin-right: auto;">
+    <div style="background: transparent; text-align: left;">
+      <a href="https://fleetdm.com"><img style="display: inline-block; width: 162px; height: 92px; width: auto;" alt="Logo" src="https://fleetdm.com/images/logo-blue-162x92@2x.png"/></a>
+    </div>
+    <div style="margin-bottom: 48px">
+      <p style="margin-bottom: 16px;"><strong>Message:</strong></p>
+      <pre ><code><%= message %></code></pre>
+      <p style="margin-bottom: 16px;"><strong>Submitter information:</strong></p>
+      <p style="margin-bottom: 16px;"><strong>Name:</strong> <%= firstName %> <%= lastName %></p>
+      <p style="margin-bottom: 16px;"><strong>Email address:</strong> <a href="mailto:<%= firstName %> <%= lastName %><<%= emailAddress %>>"><%= emailAddress %></a></p>
+    </div>
+  </div>
+</div>
diff --git a/website/views/layouts/layout-nurture-email.ejs b/website/views/layouts/layout-nurture-email.ejs
index 007880839b..5c4df42a0e 100644
--- a/website/views/layouts/layout-nurture-email.ejs
+++ b/website/views/layouts/layout-nurture-email.ejs
@@ -18,5 +18,6 @@
         <p>© <%= (new Date()).getFullYear() %> Fleet Inc.<br> All trademarks are the property of their respective owners.</p>
       </div>
     </div>
+    <a style="font-size: 12px; color: #3E4771;" href="<%= url.resolve(sails.config.custom.baseUrl, '/unsubscribe?emailAddress='+encodeURIComponent(emailAddress)) %>">Unsubscribe</a>
   </div>
 </div>
diff --git a/website/views/layouts/layout.ejs b/website/views/layouts/layout.ejs
index ed4ebaf20b..c8a438213f 100644
--- a/website/views/layouts/layout.ejs
+++ b/website/views/layouts/layout.ejs
@@ -55,6 +55,8 @@
     !function(r){var e={};function o(n){if(e[n])return e[n].exports;var t=e[n]={i:n,l:!1,exports:{}};return r[n].call(t.exports,t,t.exports,o),t.l=!0,t.exports}o.m=r,o.c=e,o.d=function(r,e,n){o.o(r,e)||Object.defineProperty(r,e,{enumerable:!0,get:n})},o.r=function(r){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(r,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(r,"__esModule",{value:!0})},o.t=function(r,e){if(1&e&&(r=o(r)),8&e)return r;if(4&e&&"object"==typeof r&&r&&r.__esModule)return r;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:r}),2&e&&"string"!=typeof r)for(var t in r)o.d(n,t,function(e){return r[e]}.bind(null,t));return n},o.n=function(r){var e=r&&r.__esModule?function(){return r.default}:function(){return r};return o.d(e,"a",e),e},o.o=function(r,e){return Object.prototype.hasOwnProperty.call(r,e)},o.p="",o(o.s=0)}([function(r,e,o){"use strict";var n=o(1),t=o(5);_rollbarConfig=_rollbarConfig||{},_rollbarConfig.rollbarJsUrl=_rollbarConfig.rollbarJsUrl||"https://cdn.rollbar.com/rollbarjs/refs/tags/v2.22.0/rollbar.min.js",_rollbarConfig.async=void 0===_rollbarConfig.async||_rollbarConfig.async;var a=n.setupShim(window,_rollbarConfig),l=t(_rollbarConfig);window.rollbar=n.Rollbar,a.loadFull(window,document,!_rollbarConfig.async,_rollbarConfig,l)},function(r,e,o){"use strict";var n=o(2),t=o(3);function a(r){return function(){try{return r.apply(this,arguments)}catch(r){try{console.error("[Rollbar]: Internal error",r)}catch(r){}}}}var l=0;function i(r,e){this.options=r,this._rollbarOldOnError=null;var o=l++;this.shimId=function(){return o},"undefined"!=typeof window&&window._rollbarShims&&(window._rollbarShims[o]={handler:e,messages:[]})}var s=o(4),d=function(r,e){return new i(r,e)},c=function(r){return new s(d,r)};function u(r){return a((function(){var e=this,o=Array.prototype.slice.call(arguments,0),n={shim:e,method:r,args:o,ts:new Date};window._rollbarShims[this.shimId()].messages.push(n)}))}i.prototype.loadFull=function(r,e,o,n,t){var l=!1,i=e.createElement("script"),s=e.getElementsByTagName("script")[0],d=s.parentNode;i.crossOrigin="",i.src=n.rollbarJsUrl,o||(i.async=!0),i.onload=i.onreadystatechange=a((function(){if(!(l||this.readyState&&"loaded"!==this.readyState&&"complete"!==this.readyState)){i.onload=i.onreadystatechange=null;try{d.removeChild(i)}catch(r){}l=!0,function(){var e;if(void 0===r._rollbarDidLoad){e=new Error("rollbar.js did not load");for(var o,n,a,l,i=0;o=r._rollbarShims[i++];)for(o=o.messages||[];n=o.shift();)for(a=n.args||[],i=0;i<a.length;++i)if("function"==typeof(l=a[i])){l(e);break}}"function"==typeof t&&t(e)}()}})),d.insertBefore(i,s)},i.prototype.wrap=function(r,e,o){try{var n;if(n="function"==typeof e?e:function(){return e||{}},"function"!=typeof r)return r;if(r._isWrap)return r;if(!r._rollbar_wrapped&&(r._rollbar_wrapped=function(){o&&"function"==typeof o&&o.apply(this,arguments);try{return r.apply(this,arguments)}catch(o){var e=o;throw e&&("string"==typeof e&&(e=new String(e)),e._rollbarContext=n()||{},e._rollbarContext._wrappedSource=r.toString(),window._rollbarWrappedError=e),e}},r._rollbar_wrapped._isWrap=!0,r.hasOwnProperty))for(var t in r)r.hasOwnProperty(t)&&(r._rollbar_wrapped[t]=r[t]);return r._rollbar_wrapped}catch(e){return r}};for(var p="log,debug,info,warn,warning,error,critical,global,configure,handleUncaughtException,handleAnonymousErrors,handleUnhandledRejection,captureEvent,captureDomContentLoaded,captureLoad".split(","),f=0;f<p.length;++f)i.prototype[p[f]]=u(p[f]);r.exports={setupShim:function(r,e){if(r){var o=e.globalAlias||"Rollbar";if("object"==typeof r[o])return r[o];r._rollbarShims={},r._rollbarWrappedError=null;var l=new c(e);return a((function(){e.captureUncaught&&(l._rollbarOldOnError=r.onerror,n.captureUncaughtExceptions(r,l,!0),e.wrapGlobalEventHandlers&&t(r,l,!0)),e.captureUnhandledRejections&&n.captureUnhandledRejections(r,l,!0);var a=e.autoInstrument;return!1!==e.enabled&&(void 0===a||!0===a||"object"==typeof a&&a.network)&&r.addEventListener&&(r.addEventListener("load",l.captureLoad.bind(l)),r.addEventListener("DOMContentLoaded",l.captureDomContentLoaded.bind(l))),r[o]=l,l}))()}},Rollbar:c}},function(r,e,o){"use strict";function n(r,e,o,n){r._rollbarWrappedError&&(n[4]||(n[4]=r._rollbarWrappedError),n[5]||(n[5]=r._rollbarWrappedError._rollbarContext),r._rollbarWrappedError=null);var t=e.handleUncaughtException.apply(e,n);o&&o.apply(r,n),"anonymous"===t&&(e.anonymousErrorsPending+=1)}r.exports={captureUncaughtExceptions:function(r,e,o){if(r){var t;if("function"==typeof e._rollbarOldOnError)t=e._rollbarOldOnError;else if(r.onerror){for(t=r.onerror;t._rollbarOldOnError;)t=t._rollbarOldOnError;e._rollbarOldOnError=t}e.handleAnonymousErrors();var a=function(){var o=Array.prototype.slice.call(arguments,0);n(r,e,t,o)};o&&(a._rollbarOldOnError=t),r.onerror=a}},captureUnhandledRejections:function(r,e,o){if(r){"function"==typeof r._rollbarURH&&r._rollbarURH.belongsToShim&&r.removeEventListener("unhandledrejection",r._rollbarURH);var n=function(r){var o,n,t;try{o=r.reason}catch(r){o=void 0}try{n=r.promise}catch(r){n="[unhandledrejection] error getting `promise` from event"}try{t=r.detail,!o&&t&&(o=t.reason,n=t.promise)}catch(r){}o||(o="[unhandledrejection] error getting `reason` from event"),e&&e.handleUnhandledRejection&&e.handleUnhandledRejection(o,n)};n.belongsToShim=o,r._rollbarURH=n,r.addEventListener("unhandledrejection",n)}}}},function(r,e,o){"use strict";function n(r,e,o){if(e.hasOwnProperty&&e.hasOwnProperty("addEventListener")){for(var n=e.addEventListener;n._rollbarOldAdd&&n.belongsToShim;)n=n._rollbarOldAdd;var t=function(e,o,t){n.call(this,e,r.wrap(o),t)};t._rollbarOldAdd=n,t.belongsToShim=o,e.addEventListener=t;for(var a=e.removeEventListener;a._rollbarOldRemove&&a.belongsToShim;)a=a._rollbarOldRemove;var l=function(r,e,o){a.call(this,r,e&&e._rollbar_wrapped||e,o)};l._rollbarOldRemove=a,l.belongsToShim=o,e.removeEventListener=l}}r.exports=function(r,e,o){if(r){var t,a,l="EventTarget,Window,Node,ApplicationCache,AudioTrackList,ChannelMergerNode,CryptoOperation,EventSource,FileReader,HTMLUnknownElement,IDBDatabase,IDBRequest,IDBTransaction,KeyOperation,MediaController,MessagePort,ModalWindow,Notification,SVGElementInstance,Screen,TextTrack,TextTrackCue,TextTrackList,WebSocket,WebSocketWorker,Worker,XMLHttpRequest,XMLHttpRequestEventTarget,XMLHttpRequestUpload".split(",");for(t=0;t<l.length;++t)r[a=l[t]]&&r[a].prototype&&n(e,r[a].prototype,o)}}},function(r,e,o){"use strict";function n(r,e){this.impl=r(e,this),this.options=e,function(r){for(var e=function(r){return function(){var e=Array.prototype.slice.call(arguments,0);if(this.impl[r])return this.impl[r].apply(this.impl,e)}},o="log,debug,info,warn,warning,error,critical,global,configure,handleUncaughtException,handleAnonymousErrors,handleUnhandledRejection,_createItem,wrap,loadFull,shimId,captureEvent,captureDomContentLoaded,captureLoad".split(","),n=0;n<o.length;n++)r[o[n]]=e(o[n])}(n.prototype)}n.prototype._swapAndProcessMessages=function(r,e){var o,n,t;for(this.impl=r(this.options);o=e.shift();)n=o.method,t=o.args,this[n]&&"function"==typeof this[n]&&("captureDomContentLoaded"===n||"captureLoad"===n?this[n].apply(this,[t[0],o.ts]):this[n].apply(this,t));return this},r.exports=n},function(r,e,o){"use strict";r.exports=function(r){return function(e){if(!e&&!window._rollbarInitialized){for(var o,n,t=(r=r||{}).globalAlias||"Rollbar",a=window.rollbar,l=function(r){return new a(r)},i=0;o=window._rollbarShims[i++];)n||(n=o.handler),o.handler._swapAndProcessMessages(l,o.messages);window[t]=n,window._rollbarInitialized=!0}}}}]);
     // End Rollbar Snippet
     </script>
+    <% /* Cookie consent banner */ %>
+    <script id="cookieyes" type="text/javascript" src="https://cdn-cookieyes.com/client_data/71bcdd51b166ceeb18bd0d28/script.js"></script>
     <% /* Google Analytics, Google Tag Manager, Snitcher etc. */ %>
     <% /* Global site tag (gtag.js) - Google Analytics */%>
     <script async src="https://www.googletagmanager.com/gtag/js?id=G-JC3DRNY1GV"></script>
@@ -68,22 +70,6 @@
       analytics.page();
       }}();
     </script>
-    <% /* Meta pixel code */ %>
-    <script>
-      !function(f,b,e,v,n,t,s)
-      {if(f.fbq)return;n=f.fbq=function(){n.callMethod?
-      n.callMethod.apply(n,arguments):n.queue.push(arguments)};
-      if(!f._fbq)f._fbq=n;n.push=n;n.loaded=!0;n.version='2.0';
-      n.queue=[];t=b.createElement(e);t.async=!0;
-      t.src=v;s=b.getElementsByTagName(e)[0];
-      s.parentNode.insertBefore(t,s)}(window, document,'script',
-      'https://connect.facebook.net/en_US/fbevents.js');
-      fbq('init', '673041690615149');
-      fbq('track', 'PageView');
-    </script>
-    <noscript>
-      <img alt="Meta pixel" height="1" width="1" style="display:none" src="https://www.facebook.com/tr?id=673041690615149&ev=PageView&noscript=1"/>
-    </noscript>
     <%/* LinkedIn insight tag*/%>
     <script type="text/javascript">
       _linkedin_partner_id = "4365817";
@@ -121,10 +107,6 @@
           a.appendChild(r);
       })(window,document,'https://static.hotjar.com/c/hotjar-','.js?sv=');
     </script>
-    <%/* Reddit tracking pixel */%>
-    <script>
-    !function(w,d){if(!w.rdt){var p=w.rdt=function(){p.sendEvent?p.sendEvent.apply(p,arguments):p.callQueue.push(arguments)};p.callQueue=[];var t=d.createElement("script");t.src="https://www.redditstatic.com/ads/pixel.js",t.async=!0;var s=d.getElementsByTagName("script")[0];s.parentNode.insertBefore(t,s)}}(window,document);rdt('init','t2_84a3ro8l');rdt('track', 'PageVisit');
-    </script>
     <% }
     /* Otherwise, any such scripts are excluded, and we instead inject a
     robots/noindex meta tag to help prevent any unwanted visits from search engines. */
@@ -187,7 +169,7 @@
                     <a purpose="mobile-dropdown-link" href="/docs">Docs</a>
                     <a purpose="mobile-dropdown-link" href="/docs/rest-api">REST API</a>
                       <a purpose="mobile-dropdown-link" href="/guides">Guides</a>
-                    <a purpose="mobile-dropdown-link" href="/queries"><%= ['eo-it', 'mdm'].includes(primaryBuyingSituation) ? 'Device health checks' : 'Built-in queries' %></a>
+                    <a purpose="mobile-dropdown-link" href="/queries">Built-in queries</a>
                     <a purpose="mobile-dropdown-link" href="/tables">Data tables</a>
                     <span>SUPPORT</span>
                     <div purpose="indented-mobile-links">
@@ -440,9 +422,6 @@
       by the asset pipeline between "SCRIPTS" and "SCRIPTS END", or both.
       (https://sailsjs.com/docs/concepts/assets/task-automation)
     */ %>
-    <% /* Cookie consent banner */ %>
-    <script id="cookieyes" type="text/javascript" src="https://cdn-cookieyes.com/client_data/71bcdd51b166ceeb18bd0d28/script.js"></script>
-
     <%/* Stripe.js */%>
     <script src="https://js.stripe.com/v3/"></script>
 
diff --git a/website/views/pages/articles/articles.ejs b/website/views/pages/articles/articles.ejs
index 0f24be22d7..4b21814af3 100644
--- a/website/views/pages/articles/articles.ejs
+++ b/website/views/pages/articles/articles.ejs
@@ -1,50 +1,87 @@
 <div id="articles" v-cloak>
-  <div style="max-width: 1200px;" class="container-fluid p-0">
-    <div class="mx-auto">
-      <div purpose="categories-and-search" class="d-flex flex-lg-row flex-column justify-content-lg-between justify-content-md-center justify-content-start" v-if="isArticlesLandingPage">
-        <div purpose="categories" class="d-flex flex-lg-row flex-column justify-content-start">
-          <div purpose="category-filter" :class="[ filter === 'all' ? 'selected' : '']" @click="filterBy('all')">All</div>
-          <div purpose="category-filter" :class="[ filter === 'engineering' ? 'selected' : '']" @click="filterBy('engineering')">Engineering</div>
-          <div purpose="category-filter" :class="[ filter === 'security' ? 'selected' : '']" @click="filterBy('security')">Security</div>
-          <div purpose="category-filter" :class="[ filter === 'announcements' ? 'selected' : '']" @click="filterBy('announcements')">Announcements</div>
-          <div purpose="category-filter" :class="[ filter === 'guides' ? 'selected' : '']" @click="filterBy('guides')">Guides</div>
-          <div purpose="category-filter" :class="[ filter === 'success stories' ? 'selected' : '']" @click="filterBy('success stories')">Success stories</div>
-          <div purpose="category-filter" :class="[ filter === 'podcasts' ? 'selected' : '']" @click="filterBy('podcasts')">Podcasts</div>
-          <div purpose="category-filter" :class="[ filter === 'releases' ? 'selected' : '']" @click="filterBy('releases')">Releases</div>
+  <div style="max-width: 1200px;" class="container-fluid mx-auto" purpose="page-container">
+    <div v-if="category !== 'guides'">
+    <div purpose="categories-and-search" class="d-flex flex-lg-row flex-column justify-content-lg-between justify-content-md-center justify-content-start" v-if="isArticlesLandingPage">
+      <div purpose="categories" class="d-flex flex-lg-row flex-column justify-content-start">
+        <div purpose="category-filter" :class="[ filter === 'all' ? 'selected' : '']" @click="filterBy('all')">All</div>
+        <div purpose="category-filter" :class="[ filter === 'engineering' ? 'selected' : '']" @click="filterBy('engineering')">Engineering</div>
+        <div purpose="category-filter" :class="[ filter === 'security' ? 'selected' : '']" @click="filterBy('security')">Security</div>
+        <div purpose="category-filter" :class="[ filter === 'announcements' ? 'selected' : '']" @click="filterBy('announcements')">Announcements</div>
+        <div purpose="category-filter" :class="[ filter === 'guides' ? 'selected' : '']" @click="filterBy('guides')">Guides</div>
+        <div purpose="category-filter" :class="[ filter === 'success stories' ? 'selected' : '']" @click="filterBy('success stories')">Success stories</div>
+        <div purpose="category-filter" :class="[ filter === 'podcasts' ? 'selected' : '']" @click="filterBy('podcasts')">Podcasts</div>
+        <div purpose="category-filter" :class="[ filter === 'releases' ? 'selected' : '']" @click="filterBy('releases')">Releases</div>
+      </div>
+    </div>
+    <div purpose="category-title" v-else>
+      <h1>{{articleCategory}}</h1>
+      <div class="d-flex flex-sm-row flex-column justify-content-between">
+
+        <p>{{categoryDescription}}</p>
+        <a purpose="rss-button" class="px-0 px-sm-2 pt-sm-1" @click="clickCopyRssLink(category)" target="_blank"><span>Subscribe</span></a>
+      </div>
+    </div>
+    <div purpose="articles" class="card-deck d-flex justify-content-center">
+      <div purpose="article-card" class="card" v-for="article in selectedArticles">
+        <a purpose="article-card-link" :href="article.url">
+          <img style="width: 100%; height: auto;" :src="[article.meta.articleImageUrl ? article.meta.articleImageUrl : '/images/blog-fleet-logo-white-background-800x450@2x.png']" alt="Article hero image">
+        </a>
+        <div purpose="article-card-body" class="card-body d-flex flex-column">
+          <p purpose="category-name" class="pb-2 mb-0">{{article.meta.category}}</p>
+          <a purpose="article-title" :href="article.url"><h5>{{article.meta.articleTitle}}</h5></a>
+          <div purpose="article-details" class="d-flex mt-auto flex-row align-items-center">
+            <img alt="The author's GitHub profile picture" style="height: 32px; width: 32px; border-radius: 100%;" :src="'https://github.com/'+article.meta.authorGitHubUsername+'.png?size=200'">
+            <p class="pl-2 font-weight-bold">{{article.meta.authorFullName}}</p>
+          </div>
         </div>
       </div>
-      <div purpose="category-title" v-else>
-        <h1>{{articleCategory}}</h1>
-        <div class="d-flex flex-sm-row flex-column justify-content-between">
-          <p>{{categoryDescription}}</p>
-          <a purpose="rss-button" class="px-0 px-sm-2 pt-sm-1" @click="clickCopyRssLink(category)" target="_blank"><span>Subscribe</span></a>
-        </div>
+      <div purpose="article-card" class="card invisible mb-0 d-none d-sm-flex">
       </div>
-      <div purpose="articles" class="card-deck d-flex justify-content-center" v-if="selectedArticles.length > 0">
-        <div purpose="article-card" class="card" v-for="article in selectedArticles">
-          <a purpose="article-card-link" :href="article.url">
-            <img style="width: 100%; height: auto;" :src="[article.meta.articleImageUrl ? article.meta.articleImageUrl : '/images/blog-fleet-logo-white-background-800x450@2x.png']" alt="Article hero image">
-          </a>
-          <div purpose="article-card-body" class="card-body d-flex flex-column">
-            <p purpose="category-name" class="pb-2 mb-0">{{article.meta.category}}</p>
-            <a purpose="article-title" :href="article.url"><h5>{{article.meta.articleTitle}}</h5></a>
-            <div purpose="article-details" class="d-flex mt-auto flex-row align-items-center">
-              <img alt="The author's GitHub profile picture" style="height: 32px; width: 32px; border-radius: 100%;" :src="'https://github.com/'+article.meta.authorGitHubUsername+'.png?size=200'">
-              <p class="pl-2 font-weight-bold">{{article.meta.authorFullName}}</p>
+      <div purpose="article-card" class="card invisible mb-0 d-none d-sm-flex">
+      </div>
+      <div purpose="article-card" class="card invisible mb-0 d-none d-sm-flex">
+      </div>
+    </div>
+  </div>
+  <div purpose="guides-category-page" v-else>
+    <div purpose="category-title">
+      <div class="d-flex flex-md-row flex-column justify-content-between align-items-md-center">
+        <div class="d-flex flex-column justify-content-between">
+          <h1>Guides</h1>
+          <p>Learn more about how to use Fleet to accomplish your goals.</p>
+        </div>
+        <div purpose="search" id="docsearch-query">
+          <div purpose="disabled-search" class="d-flex w-100">
+            <div class="input-group">
+              <div class="input-group-prepend">
+                <span class="input-group-text border-0 bg-transparent pl-3" >
+                  <img style="height: 16px; width: 16px;" class="search" alt="search" src="/images/icon-search-16x16@2x.png">
+                </span>
+              </div>
+              <div class="form-control border-0 ">
+              <input class="docsearch-input pr-1"
+                placeholder="Search" aria-label="Search"
+                />
+              </div>
             </div>
           </div>
         </div>
-        <div purpose="article-card" class="card invisible mb-0 d-none d-sm-flex">
-        </div>
-        <div purpose="article-card" class="card invisible mb-0 d-none d-sm-flex">
-        </div>
-        <div purpose="article-card" class="card invisible mb-0 d-none d-sm-flex">
-        </div>
-      </div>
-      <div v-else>
-        <h2 class="text-muted mx-auto">No articles to display</h2>
       </div>
     </div>
+    <div purpose="guides" class="card-columns">
+      <div purpose="guide-card" class="card" v-for="article in selectedArticles">
+        <a :href="article.url">
+        <div purpose="article-card-body" class="card-body d-flex flex-column">
+          <div purpose="article-title"><h5>{{article.meta.articleTitle}}</h5></div>
+          <p class="small" v-if="article.meta.description">{{article.meta.description}}</p>
+          <div purpose="article-details" class="d-flex mt-auto flex-row align-items-center">
+            <js-timestamp :at="article.meta.publishedOn" format="timeago" always-show-year="true"></js-timestamp>
+          </div>
+        </div>
+        </a>
+      </div>
+    </div>
+  </div>
   </div>
 
 </div>
diff --git a/website/views/pages/articles/basic-article.ejs b/website/views/pages/articles/basic-article.ejs
index bbcd597ebf..e72f85219d 100644
--- a/website/views/pages/articles/basic-article.ejs
+++ b/website/views/pages/articles/basic-article.ejs
@@ -1,32 +1,60 @@
 <div id="basic-article" v-cloak>
-  <div style="max-width: 800px;" class="container-fluid px-0">
-    <div purpose="article-title">
-      <h1><%=thisPage.meta.articleTitle %></h1>
-      <h2 v-if="articleHasSubtitle && articleSubtitle !== undefined">{{articleSubtitle}}</h2>
-    </div>
-    <div class="d-flex flex-sm-row flex-column justify-content-between align-items-sm-center">
-      <div purpose="article-details" class="d-flex flex-row align-items-center">
-      <span><js-timestamp format="billing" :at="thisPage.meta.publishedOn"></js-timestamp></span>
-      <span class="px-2">|</span>
-      <img style="height: 28px; width: 28px; border-radius: 100%;" alt="The author's GitHub profile picture" :src="'https://github.com/'+thisPage.meta.authorGitHubUsername+'.png?size=200'">
-      <p class="pl-2 font-weight-bold"><%=thisPage.meta.authorFullName %></p>
+  <div class="container-fluid px-0">
+    <div purpose="breadcrumbs-and-search" class="d-flex flex-lg-row flex-column justify-content-between align-items-lg-center align-items-start">
+      <div purpose="breadcrumbs" class="d-flex flex-row align-items-start">
+        <div>
+          <a purpose="breadcrumbs-category" :href="'/'+articleCategorySlug">{{articleCategorySlug}}</a>/
+        </div>
+        <div purpose="breadcrumbs-title">
+          <span>{{thisPage.meta.articleTitle}}</span>
+        </div>
       </div>
-      <div class="d-flex flex-row align-items-center justify-content-sm-end pt-3 pt-sm-1">
-      <a purpose="rss-button" @click="clickCopyRssLink(articleCategorySlug)"><span>Subscribe</span></a>
-      <a purpose="edit-button" class="d-flex flex-row align-items-center text-nowrap" target="_blank" :href="'https://github.com/fleetdm/fleet/edit/main/articles/'+thisPage.sectionRelativeRepoPath"><img alt="A pencil icon" src="/images/pencil-16x16@2x.png">Edit page</a>
+      <div purpose="search" id="docsearch-query" class="d-flex">
+        <div purpose="disabled-search" class="d-flex w-100">
+          <div class="input-group">
+            <div class="input-group-prepend">
+              <span class="input-group-text border-0 bg-transparent pl-3" >
+                <img style="height: 16px; width: 16px;" class="search" alt="search" src="/images/icon-search-16x16@2x.png">
+              </span>
+            </div>
+            <div class="form-control border-0 ">
+            <input class="docsearch-input pr-1"
+              placeholder="Search" aria-label="Search the handbook"
+              />
+            </div>
+          </div>
+        </div>
       </div>
     </div>
-    <div purpose="article-content" class="d-flex flex-column" parasails-has-no-page-script>
-      <%- partial(path.relative(path.dirname(__filename), path.resolve( sails.config.appPath, path.join(sails.config.builtStaticContent.compiledPagePartialsAppPath, thisPage.htmlId)))) %>
-    </div>
-    <hr>
-    <div purpose="bottom-cta" class="d-block">
-      <h3 style="font-size: 24px; line-height: 32px;">Get started</h3>
-      <div class="d-flex flex-sm-row flex-column align-items-center">
-        <a href="/register" class="d-flex btn btn-primary justify-content-center align-items-center" purpose="next-steps-button">
-          Start now
-        </a>
-        <animated-arrow-button class="ml-sm-4" href="/contact">Talk to us</animated-arrow-button>
+    <div purpose="article-container">
+      <div purpose="article-title">
+        <h1><%=thisPage.meta.articleTitle %></h1>
+        <h2 v-if="articleHasSubtitle && articleSubtitle !== undefined">{{articleSubtitle}}</h2>
+      </div>
+      <div class="d-flex flex-sm-row flex-column justify-content-between align-items-sm-center">
+        <div purpose="article-details" class="d-flex flex-row align-items-center">
+        <span><js-timestamp format="billing" :at="thisPage.meta.publishedOn"></js-timestamp></span>
+        <span class="px-2">|</span>
+        <img style="height: 28px; width: 28px; border-radius: 100%;" alt="The author's GitHub profile picture" :src="'https://github.com/'+thisPage.meta.authorGitHubUsername+'.png?size=200'">
+        <p class="pl-2 font-weight-bold"><%=thisPage.meta.authorFullName %></p>
+        </div>
+        <div class="d-flex flex-row align-items-center justify-content-sm-end pt-3 pt-sm-1">
+        <a purpose="rss-button" @click="clickCopyRssLink(articleCategorySlug)"><span>Subscribe</span></a>
+        <a purpose="edit-button" class="d-flex flex-row align-items-center text-nowrap" target="_blank" :href="'https://github.com/fleetdm/fleet/edit/main/articles/'+thisPage.sectionRelativeRepoPath"><img alt="A pencil icon" src="/images/pencil-16x16@2x.png">Edit page</a>
+        </div>
+      </div>
+      <div purpose="article-content" class="d-flex flex-column" parasails-has-no-page-script>
+        <%- partial(path.relative(path.dirname(__filename), path.resolve( sails.config.appPath, path.join(sails.config.builtStaticContent.compiledPagePartialsAppPath, thisPage.htmlId)))) %>
+      </div>
+      <hr>
+      <div purpose="bottom-cta" class="d-block">
+        <h3 style="font-size: 24px; line-height: 32px;">Get started</h3>
+        <div class="d-flex flex-sm-row flex-column align-items-center">
+          <a href="/register" class="d-flex btn btn-primary justify-content-center align-items-center" purpose="next-steps-button">
+            Start now
+          </a>
+          <animated-arrow-button class="ml-sm-4" href="/contact">Talk to us</animated-arrow-button>
+        </div>
       </div>
     </div>
   </div>
diff --git a/website/views/pages/contact.ejs b/website/views/pages/contact.ejs
index 52bb23bf6f..d9045a69e4 100644
--- a/website/views/pages/contact.ejs
+++ b/website/views/pages/contact.ejs
@@ -145,17 +145,17 @@
         </div>
       </div>
       <div purpose="quote" v-else-if="primaryBuyingSituation === 'eo-it'">
-        <div purpose="logo" class="mb-4"><img height="32" alt="Deputy logo" src="/images/logo-deputy-118x28@2x.png"></div>
+        <div purpose="logo" class="mb-4"><img height="32" alt="Deputy logo" src="/images/social-proof-logo-stripe-67x32@2x.png"></div>
         <p purpose="quote-text">
-          When we look at vendors, we look for ones that are very receptive to feedback, where you’re just part of the family, I guess. Fleet’s really good at that.
+          Mad props to how easy making a deploy pkg of the agent was. I wish everyone made stuff that easy.
         </p>
         <div purpose="quote-author-info" class="d-flex flex-row align-items-center">
           <div purpose="profile-picture">
-            <img alt="Harrison Ravazzolo" src="/images/testimonial-author-harrison-ravazzolo-48x48@2x.png">
+            <img alt="Wes Whetstone" src="/images/testimonial-author-wes-whetstone-48x48@2x.png">
           </div>
           <div class="d-flex flex-column align-self-top">
-            <p purpose="name" class="font-weight-bold m-0">Harrison Ravazzolo</p>
-            <p purpose="job-title" class="m-0">Lead platform and identity engineer</p>
+            <p purpose="name" class="font-weight-bold m-0">Wes Whetstone</p>
+            <p purpose="job-title" class="m-0">Staff CPE</p>
           </div>
         </div>
       </div>
diff --git a/website/views/pages/device-management.ejs b/website/views/pages/device-management.ejs
index f7b0f37a84..0c077596e5 100644
--- a/website/views/pages/device-management.ejs
+++ b/website/views/pages/device-management.ejs
@@ -4,7 +4,7 @@
       <div purpose="hero">
         <div purpose="page-headline">
           <h4>Device management (MDM)</h4>
-          <h1>Your easiest MDM migration</h1>
+          <h1>Manage everything in one place</h1>
         </div>
         <div purpose="testimonials" class="d-flex flex-md-row flex-column align-items-center justify-content-between">
           <div purpose="testimonial-quote">
@@ -30,6 +30,57 @@
         </div>
       </div>
       <logo-carousel></logo-carousel>
+
+    <%/* Debunk the cross-platform myth */%>
+      <div purpose="page-section" class="pb-0">
+        <div purpose="feature" class="d-flex flex-md-row flex-column-reverse justify-content-between mx-auto align-items-center">
+          <div purpose="feature-text" class="d-flex flex-column">
+            <h2>Debunk the cross-platform myth</h2>
+            <p>Conventional wisdom holds that cross-platform MDM solutions don't hold up at scale. Few, if any, have lived up to the hype.</p>
+            <p>Instead, Fleet lets you work directly with data and events from each native operating system. So while you can still use familiar concepts like smart groups and extension attributes, you don’t get stuck “talking Windows” to Apple devices.</p>
+          </div>
+          <div purpose="feature-image" class="right">
+            <img alt="Transparency for end users" src="/images/mdm-debunk-cross-platform-myth-528x377@2x.png">
+          </div>
+        </div>
+
+        <div purpose="three-column-features" class="mx-auto">
+          <div purpose="responsive-feature-row" class="row d-flex flex-sm-row flex-column justify-content-lg-between justify-content-center align-items-center align-items-sm-start">
+            <div purpose="feature-item" class="pl-0 col-12 col-sm-6 col-lg-4">
+              <h5>Operating systems</h5>
+              <p>Enforce OS updates with Declarative Device Management (DDM), <a href="https://github.com/macadmins/nudge" target="_blank">Nudge</a>, and Windows Update from one console.</p>
+            </div>
+
+            <div purpose="feature-item" class="pr-0 pr-lg-4 col-12 col-sm-6 col-lg-4" >
+              <h5>Automated enrollment</h5>
+              <p>Drop-ship devices to your end users with Apple Business Manager or Autopilot and let them set up their own account. No IT help needed.</p>
+            </div>
+
+            <div purpose="feature-item" class="pl-0 pl-lg-4 pr-lg-0 col-12 col-sm-6 col-lg-4">
+              <h5>Config management</h5>
+              <p>Manage settings with configuration profiles for Apple and device profiles for Windows. Use a canary team to test changes before they go live.</p>
+            </div>
+            <div purpose="feature-item" class="pr-0 pr-lg-4 pl-lg-0 col-12 col-sm-6 col-lg-4">
+              <h5>App management</h5>
+              <p>Keep applications and plugins secure and up-to-date automatically. Install the software end users need or let them install it themselves via self service.</p>
+            </div>
+
+            <div purpose="feature-item" class="pl-0 pl-lg-4 col-12 col-sm-6 col-lg-4">
+              <h5>Scripts and events</h5>
+              <p>Easily manage and version control your custom script library. Execute shell and PowerShell scripts when computers drift from the baseline.</p>
+            </div>
+
+            <div purpose="feature-item" class="pr-0 pr-lg-4 col-12 col-sm-6 col-lg-4">
+              <h5>Keep up with Apple</h5>
+              <p>Fleet's team and community stay on top of the latest features and releases from all supported platform vendors—not just Apple.</p>
+            </div>
+          </div>
+
+          <div purpose="feature-row" class="row d-flex flex-sm-row flex-column justify-content-lg-between justify-content-center mb-0 align-items-center align-items-sm-start">
+          </div>
+        </div>
+      </div>
+
       <div purpose="comparison-section">
         <h2>Head-to-head with the big players</h2>
         <p>Considering a move to Fleet as a cross-platform, open-source MDM alternative? See how we compare:</p>
@@ -135,7 +186,6 @@
               </div>
             </div>
 
-
             <div purpose="table-row">
               <div purpose="feature-name"><p>REST API</p></div>
               <div purpose="fleet-column"><img class="mx-auto" alt="checkmark" purpose="checkmark" src="/images/icon-checkmark-green-16x16@2x.png"></div>
@@ -144,12 +194,6 @@
               </div>
             </div>
 
-            <div purpose="table-row">
-              <div purpose="feature-name"><p>MDM migration</p></div>
-              <div purpose="fleet-column"><img class="mx-auto" alt="checkmark" purpose="checkmark" src="/images/icon-checkmark-green-16x16@2x.png"></div>
-              <div purpose="comparison-column"></div>
-            </div>
-
             <div purpose="table-row">
               <div purpose="feature-name"><p>Open source</p></div>
               <div purpose="fleet-column"><img class="mx-auto" alt="checkmark" purpose="checkmark" src="/images/icon-checkmark-green-16x16@2x.png"></div>
@@ -412,7 +456,7 @@
           </div>
         </div>
 
-        <animated-arrow-button class="mx-auto" href="/pricing">Compare all features</animated-arrow-button>
+        <animated-arrow-button class="mx-auto" href="/pricing">View all features</animated-arrow-button>
       </div>
       <%/* Shorten the feedback loop section */%>
       <div purpose="page-section">
@@ -448,45 +492,6 @@
           </div>
         </div>
       </div>
-
-      <%/* Simplify your tools section */%>
-      <div purpose="page-section">
-        <div purpose="feature-headline">
-          <h2>Tidy up your tools</h2>
-          <p>Deploy a modern Mac-first MDM purpose-built for IT engineers and cross-training. Use principles from DevOps to manage Apple, Windows, and Linux computers declaratively.</p>
-        </div>
-
-        <div purpose="two-column-features" class="mx-auto">
-
-          <div purpose="feature-row" class="d-flex flex-sm-row flex-column justify-content-lg-between justify-content-center">
-            <div purpose="feature-column" class="ml-sm-0">
-            <img alt="Patch every OS" src="/images/device-management-icon-patch-every-os-48x48@2x.png">
-              <h5>Patch every OS</h5>
-              <p>Shorten patch timelines with custom, enforceable deadlines and grace periods for every operating system. Encourage updates with Declarative Device Management (DDM), Nudge, and Windows Update from one interface.</p>
-            </div>
-
-            <div purpose="feature-column" class="mr-sm-0 mb-0">
-            <img alt="Push profiles" src="/images/device-management-icon-verify-updates-and-settings-48x48@2x.png">
-              <h5>Push profiles</h5>
-              <p>Remote-control settings on your Macs and PCs like Wi-Fi, certificates, passwords, screen lock, etc.  Deploy baselines or customize your own to comply with your organization’s security requirements.</p>
-            </div>
-          </div>
-
-          <div purpose="feature-row" class="d-flex flex-sm-row flex-column justify-content-lg-between justify-content-center mb-0">
-            <div purpose="feature-column" class="ml-sm-0">
-            <img alt="Manage software installs from anywhere" src="/images/device-management-icon-automatic-posture-assessment-48x48@2x.png">
-              <h5>Manage software installs from anywhere</h5>
-              <p>Get employees the software and settings they need with less drama by managing app packages, operating system versions, and patch levels for every platform, on top of open standards and data.</p>
-            </div>
-
-            <div purpose="feature-column" class="mr-sm-0 mb-0">
-            <img alt="Access the latest Apple and Windows APIs" src="/images/device-management-icon-circular-action-48x48@2x.png">
-              <h5>Access the latest Apple and Windows APIs</h5>
-              <p>Turn on the latest native macOS and Windows operating system capabilities like DDM and Autopilot, all in one place. Fleet’s team and community test against every new Apple and Microsoft release.</p>
-            </div>
-          </div>
-        </div>
-      </div>
     </div>
   </div>
   <%/* End of page gradient */%>
diff --git a/website/views/pages/docs/basic-documentation.ejs b/website/views/pages/docs/basic-documentation.ejs
index cfd78bcf0a..cc8b15b912 100644
--- a/website/views/pages/docs/basic-documentation.ejs
+++ b/website/views/pages/docs/basic-documentation.ejs
@@ -95,24 +95,22 @@
             <div class="container-fluid px-0 pt-4">
               <ul class="px-0 mb-0 pb-3">
                 <li class="px-0 mb-2" v-for="page in findPagesByUrl()" :key="page.title">
-                  <a :href="page.url" class="font-weight-bold">
+                  <span class="font-weight-bold">
                     {{page.title}}
-                  </a>
-                  <div purpose="expanded-nav" class="pt-3" v-if="isCurrentSection(page)">
-                    <ul class="p-0 pl-2 mb-2" v-if="!_.isEmpty(findPagesByUrl(page.url))">
-                      <div purpose="nav-section" v-for="(section, sectionName) of findAndSortNavSectionsByUrl(page.url)" :key="sectionName" v-if="sectionName !== 'hidden'">
-                        <p purpose="nav-section-title" v-if="sectionName !== 'Uncategorized' && sectionName !== 'TBD'">{{sectionName}}</p>
-                        <li v-for="subpage in section" :key="subpage.title">
-                          <a :href="subpage.url" :class="subpage.title === thisPage.title ? 'topic active' : 'topic'">
-                            {{subpage.title}}
-                          </a>
-                        </li>
-                      </div>
+                  </span>
+                  <div purpose="expanded-nav" class="pt-3">
+                    <ul class="p-0 pl-2 mb-3" v-if="!_.isEmpty(findPagesByUrl(page.url))">
+                      <li v-for="subpage in findPagesByUrl(page.url)" :key="subpage.title">
+                        <a :href="subpage.url" :class="subpage.title === thisPage.title ? 'topic active' : 'topic'">
+                          {{subpage.title}}
+                        </a>
+                      </li>
                     </ul>
                   </div>
                 </li>
               </ul>
               <ul class="px-0 mb-0 pt-3" purpose="mobile-docs-nav-other-links">
+                <li class="px-0 mb-3"><a href="/guides">Guides</a></li>
                 <li class="px-0 mb-3"><a href="/tables">Data tables</a></li>
                 <li class="px-0 mb-3"><a href="/queries"><%= ['eo-it', 'mdm'].includes(primaryBuyingSituation) ? 'Device health checks' : 'Built-in queries' %></a></li>
                 <li class="px-0 mb-3"><a href="https://github.com/fleetdm/fleet/releases" target="_blank">Releases</a></li>
@@ -137,23 +135,21 @@
         <div purpose="left-sidebar" class="d-none d-lg-flex flex-column text-left pl-0 pr-4 left-sidebar">
           <ul class="p-0 pb-3 m-0 left-nav">
             <li v-for="page in findPagesByUrl()" :key="page.title">
-              <a :href="page.url" class="font-weight-bold pb-3">{{page.title}}</a>
-              <div purpose="expanded-nav" class="pt-3" v-if="isCurrentSection(page)">
-                <ul class="p-0 pl-2 mb-2">
-                  <div purpose="nav-section" v-for="(section, sectionName) of findAndSortNavSectionsByUrl(page.url)" :key="sectionName" v-if="sectionName !== 'hidden'">
-                    <p purpose="nav-section-title" v-if="sectionName !== 'Uncategorized' && sectionName !== 'TBD'">{{sectionName}}</p>
-                    <li v-for="subpage in section" :key="subpage.title">
-                      <a :href="subpage.url" :class="subpage.title === thisPage.title ? 'topic active' : 'topic'">
-                        {{subpage.title}}
-                      </a>
-                    </li>
-                  </div>
+              <span class="font-weight-bold pb-3">{{page.title}}</span>
+              <div purpose="expanded-nav" class="pt-3" >
+                <ul class="p-0 pl-2 mb-3">
+                  <li v-for="subpage in findPagesByUrl(page.url)" :key="subpage.title">
+                    <a :href="subpage.url" :class="subpage.title === thisPage.title ? 'topic active' : 'topic'">
+                      {{subpage.title}}
+                    </a>
+                  </li>
                 </ul>
               </div>
             </li>
           </ul>
-          <a class="pt-4 pb-3" target="_blank" href="/tables">Data tables</a>
-          <a class="pb-3" target="_blank" href="/queries"><%= ['eo-it', 'mdm'].includes(primaryBuyingSituation) ? 'Device health checks' : 'Built-in queries' %></a>
+          <a class="pt-4 pb-3" href="/guides">Guides</a>
+          <a class="pb-3" href="/tables">Data tables</a>
+          <a class="pb-3" href="/queries"><%= ['eo-it', 'mdm'].includes(primaryBuyingSituation) ? 'Device health checks' : 'Built-in queries' %></a>
           <a class="pb-3" target="_blank" href="https://github.com/fleetdm/fleet/releases">Releases</a>
           <a class="pb-3" target="_blank" href="/support">Support</a>
           <div class="d-none d-lg-block" purpose="swag-cta" v-if="showSwagForm">
diff --git a/website/views/pages/endpoint-ops.ejs b/website/views/pages/endpoint-ops.ejs
index c9cfbb40fa..22168e47a3 100644
--- a/website/views/pages/endpoint-ops.ejs
+++ b/website/views/pages/endpoint-ops.ejs
@@ -3,22 +3,22 @@
     <div purpose="page-content" class="mx-auto">
     <div purpose="hero">
       <div purpose="page-headline">
-        <h4>Endpoint operations <%= ['eo-security', 'vm'].includes(primaryBuyingSituation) ? 'for security' : ['eo-it', 'mdm'].includes(primaryBuyingSituation) ? 'for IT' : '' %></h4>
-        <h1><%= primaryBuyingSituation==='eo-security'? 'Instrument your endpoints' : 'Understand your computers'%></h1>
+        <h4>Endpoint operations <%= ['eo-security', 'vm'].includes(pagePersonalization) ? 'for security' : ['eo-it', 'mdm'].includes(pagePersonalization) ? 'for IT' : '' %></h4>
+        <h1><%= pagePersonalization==='eo-security'? 'Instrument your endpoints' : 'Understand your computers'%></h1>
       </div>
       <div purpose="hero-content" class="d-flex flex-md-row flex-column align-items-center justify-content-between">
         <div purpose="hero-image">
           <img alt="A device verifying compliance for every endpoint" src="/images/endpoint-operations-hero-image-380x380@2x.png">
         </div>
         <div purpose="hero-text">
-          <% if(['eo-it', 'mdm'].includes(primaryBuyingSituation)) { %>
+          <% if(['eo-it', 'mdm'].includes(pagePersonalization)) { %>
             <strong>Automate anything</strong>
             <p>Remotely run scripts and prompts to complete tasks on every kind of computer, including Linux.</p>
             <strong>Pulse check anything</strong>
             <p>Use a live connection to every endpoint to simplify audit, compliance, and reporting from workstations to data centers.</p>
             <strong>Ship data to any platform</strong>
             <p>Ship logs to any platform like Splunk, Snowflake, or <a href="/docs/using-fleet/log-destinations">any streaming infrastructure</a> like AWS Kinesis and Apache Kafka.</p>
-          <% } else if(['eo-security', 'vm'].includes(primaryBuyingSituation)) { %>
+          <% } else if(['eo-security', 'vm'].includes(pagePersonalization)) { %>
             <strong>Osquery on easy mode</strong>
             <p>Build the agent in "read-only" mode or enable remote scripting to automatically mitigate misconfigurations and vulnerabilities.</p>
             <strong>Pulse check anything</strong>
@@ -41,7 +41,7 @@
       </div>
     </div>
     <div purpose="testimonials" class="d-flex flex-md-row flex-column align-items-center justify-content-between">
-      <% if (['eo-security'].includes(primaryBuyingSituation)) { %>
+      <% if (['eo-security'].includes(pagePersonalization)) { %>
         <div purpose="testimonial-quote">
           <div purpose="quote">
             <img alt="an opening quotation mark" style="width:20px; margin-bottom: 16px;" src="/images/icon-quote-21x17@2x.png">
@@ -57,7 +57,7 @@
           </div>
             </a>
         </div>
-      <% } else if (['vm'].includes(primaryBuyingSituation)) { %>
+      <% } else if (['vm'].includes(pagePersonalization)) { %>
         <div purpose="testimonial-quote">
           <div purpose="quote">
             <img alt="an opening quotation mark" style="width:20px; margin-bottom: 16px;" src="/images/icon-quote-21x17@2x.png">
@@ -91,15 +91,15 @@
         </div>
       <% } %>
       <div purpose="testimonial-videos" class="d-flex">
-        <%if(['eo-security'].includes(primaryBuyingSituation)) {%>
+        <%if(['eo-security'].includes(pagePersonalization)) {%>
         <div purpose="testimonial-video" class="charles-zaffery mx-auto" @click="clickOpenVideoModal('charles-zaffery')">
           <span><img src="/images/icon-play-video-8x9@2x.png" alt="Play">Play video</span>
         </div>
-        <%} else if(['vm'].includes(primaryBuyingSituation)){%>
+        <%} else if(['vm'].includes(pagePersonalization)){%>
         <div purpose="testimonial-video" class="austin-anderson mx-auto" @click="clickOpenVideoModal('austin-anderson')">
           <span><img src="/images/icon-play-video-8x9@2x.png" alt="Play">Play video</span>
         </div>
-        <%} else if(['eo-it', 'mdm'].includes(primaryBuyingSituation)) {%>
+        <%} else if(['eo-it', 'mdm'].includes(pagePersonalization)) {%>
         <div purpose="testimonial-video" class="nick-fohs mx-auto" @click="clickOpenVideoModal('nick-fohs')">
           <span><img src="/images/icon-play-video-8x9@2x.png" alt="Play">Play video</span>
         </div>
@@ -116,7 +116,7 @@
     <logo-carousel></logo-carousel>
 
 
-    <% if(!primaryBuyingSituation || ['mdm', 'eo-it'].includes(primaryBuyingSituation)){%>
+    <% if(!pagePersonalization || ['mdm', 'eo-it'].includes(pagePersonalization)){%>
     <div purpose="feature" class="d-flex flex-md-row flex-column-reverse justify-content-between mx-auto align-items-center">
       <div purpose="feature-text" class="d-flex flex-column">
         <h3>Automate anything</h3>
@@ -138,43 +138,38 @@
     </div>
 
     <div purpose="three-column-features" class="mx-auto">
-
-      <div purpose="feature-row" class="d-flex flex-sm-row flex-column align-items-sm-start align-items-center justify-content-center">
-        <div purpose="feature-item" class="ml-sm-0">
+      <div purpose="responsive-feature-row" class="row d-flex flex-sm-row flex-column justify-content-lg-between justify-content-center align-items-center align-items-sm-start">
+        <div purpose="feature-item" class="pl-0 col-12 col-sm-6 col-lg-4">
           <img alt="Software and asset inventory" src="/images/icon-live-connection-48x48@2x.png" class="mx-auto mx-sm-0">
           <h5>Live connection</h5>
           <p>Talk to online devices in real time with Fleet’s live query API. Implement custom workflows like conditional access based on device posture, Identity, and more.</p>
         </div>
 
-        <div purpose="feature-item">
+        <div purpose="feature-item" class="pr-0 pr-lg-4 col-12 col-sm-6 col-lg-4" >
           <img alt="Software and asset inventory" src="/images/icon-software-and-asset-inventory-48x48@2x.png" class="mx-auto mx-sm-0">
           <h5>Software and asset inventory</h5>
           <p>Get visibility into all endpoints across any operating system*, including support for servers and containers in every cloud infrastructure.</p>
         </div>
 
-        <div purpose="feature-item" class="mr-sm-0 mb-0">
+        <div purpose="feature-item" class="pl-0 pl-lg-4 pr-lg-0 col-12 col-sm-6 col-lg-4">
           <img alt="See logins for every endpoint" src="/images/icon-see-logins-for-every-endpoint-48x48@2x.png" class="mx-auto mx-sm-0">
           <h5>See logins for every endpoint</h5>
           <p>Identify who logs in to any system, including login history and current sessions. Look up any computer by the email address of the person using it.</p>
         </div>
 
-
-      </div>
-      <div purpose="feature-row" class="d-flex flex-sm-row flex-column align-items-sm-start align-items-center">
-
-        <div purpose="feature-item" class="ml-sm-0">
+        <div purpose="feature-item" class="pr-0 pr-lg-4 pl-lg-0 col-12 col-sm-6 col-lg-4 mb-lg-0">
           <img alt="CIS benchmarks" src="/images/icon-cis-benchmarks-48x48@2x.png" class="mx-auto mx-sm-0">
           <h5>CIS benchmarks</h5>
           <p>Keep all your endpoints* compliant with customizable baselines, or use common benchmarks like CIS.</p>
         </div>
 
-        <div purpose="feature-item">
+        <div purpose="feature-item" class="pl-0 pl-lg-4 col-12 col-sm-6 col-lg-4 mb-sm-0">
           <img alt="Verify updates and settings" src="/images/icon-edr-health-check-48x48@2x.png" class="mx-auto mx-sm-0">
           <h5>EDR health checks</h5>
           <p>Verify that your EDR tools are installed and working so you can identify and address configuration issues quickly.</p>
         </div>
 
-        <div purpose="feature-item" class="mr-sm-0 mb-0">
+        <div purpose="feature-item" class="pr-0 pr-lg-4 col-12 col-sm-6 col-lg-4 mb-0">
           <img alt="Verify updates and settings" src="/images/icon-verify-updates-and-settings-48x48@2x.png" class="mx-auto mx-sm-0">
           <h5>Verify updates and settings</h5>
           <p>Track progress towards deadlines for security posture remediation projects, and enforce due dates through automations.</p>
@@ -202,23 +197,21 @@
         <h3>“Zero” trust, fewer tickets</h3>
         <p>You can use Fleet’s API to customize every aspect of conditional access – even the stuff your CISO hasn’t thought of yet.</p>
       </div>
-
       <div purpose="three-column-features" class="mx-auto">
-        <div purpose="feature-row" class="d-flex flex-sm-row flex-column align-items-sm-start align-items-center justify-content-center">
-
-          <div purpose="feature-item" class="ml-sm-0">
+        <div purpose="responsive-feature-row" class="row d-flex flex-sm-row flex-column justify-content-lg-between justify-content-sm-start justify-content-center align-items-center align-items-sm-start">
+          <div purpose="feature-item" class="pl-0 col-12 col-sm-6 col-lg-4">
             <img alt="Get in front of the IdP" src="/images/device-management-icon-control-login-experience-48x48@2x.png" class="mx-auto mx-sm-0">
             <h5>Get in front of the IdP</h5>
             <p>Gate access with <a href="https://fleetdm.com/queries">common device trust policies</a> from industry peers, or roll out your own device health checks using system data and events.</p>
           </div>
 
-          <div purpose="feature-item">
+          <div purpose="feature-item" class="pr-0 pr-lg-4 col-12 col-sm-6 col-lg-4" >
             <img alt="Step-by-step instructions" src="/images/device-management-icon-step-by-step-48x48@2x.png" class="mx-auto mx-sm-0">
             <h5>Step-by-step instructions</h5>
             <p>Show resolution steps or use <a href="https://medium.com/pinterest-engineering/enforcing-device-authn-compliance-at-pinterest-a74938cb089b" target="_blank">custom HTML</a> to show employees what they need to do to restore their access without waiting on a ticket. Then give it back automatically, as soon as the problems are fixed.</p>
           </div>
 
-          <div purpose="feature-item" class="mr-sm-0 mb-0">
+          <div purpose="feature-item" class="pl-0 pl-lg-4 pr-lg-0 col-12 col-sm-6 col-lg-4 mb-0">
             <img alt="Manage device posture" src="/images/device-management-icon-manage-device-posture-48x48@2x.png" class="mx-auto mx-sm-0">
             <h5>Live retry</h5>
             <p>Give people a way to get back to work quickly and minimize downtime. Fleet’s live query API instantly re-checks the OS version and other device state so users don’t get locked out.</p>
@@ -232,7 +225,7 @@
       </div>
       <div purpose="feature-text" class="d-flex flex-column">
         <h3>Osquery on easy mode</h3>
-        <p>Accelerate deployment and get more out of osquery. You don’t need to be an osquery expert to get the answers you need from your <%= ['vm', 'eo-security'].includes(primaryBuyingSituation) ? 'endpoints' : 'devices' %>.</p>
+        <p>Accelerate deployment and get more out of osquery. You don’t need to be an osquery expert to get the answers you need from your <%= ['vm', 'eo-security'].includes(pagePersonalization) ? 'endpoints' : 'devices' %>.</p>
         <div purpose="checklist" class="flex-column d-flex">
           <p>Remotely disable/enable agent features, choose plugins, and keep osquery up to date.</p>
           <p>Import community queries from other security teams at top brands like Palantir and Fastly.</p>
@@ -242,47 +235,45 @@
       </div>
     </div>
 
-    <% if(!primaryBuyingSituation || ['vm', 'eo-security'].includes(primaryBuyingSituation)) {%>
+    <% if(!pagePersonalization || ['vm', 'eo-security'].includes(pagePersonalization)) {%>
     <div purpose="feature-headline" class="mr-auto">
       <h3>Open security tooling</h3>
       <p>Consolidate your security tooling on top of open data standards like YAML, SQL, and JSON.</p>
     </div>
 
     <div purpose="three-column-features" class="mx-auto">
-
-      <div purpose="feature-row" class="d-flex flex-sm-row flex-column align-items-sm-start align-items-center justify-content-center">
-        <div purpose="feature-item" class="ml-sm-0">
+      <div purpose="responsive-feature-row" class="row d-flex flex-sm-row flex-column justify-content-lg-between justify-content-center align-items-center align-items-sm-start">
+        <div purpose="feature-item" class="pl-0 col-12 col-sm-6 col-lg-4">
           <img alt="Incident response (IR)" src="/images/icon-incident-response-48x48@2x.png" class="mx-auto mx-sm-0">
           <h5>Incident response (IR)</h5>
           <p>Contain and recover from breaches using live data, remote commands, and automated workflows.</p>
         </div>
 
-        <div purpose="feature-item">
+        <div purpose="feature-item" class="pr-0 pr-lg-4 col-12 col-sm-6 col-lg-4" >
           <img alt="Detection and response" src="/images/icon-detection-and-response-48x48@2x.png" class="mx-auto mx-sm-0">
           <h5>Detection and response</h5>
           <p>Ship logs and alerts when unusual behavior is detected. Run scripts on demand or when alerts trigger.</p>
         </div>
 
-        <div purpose="feature-item" class="mr-sm-0 mb-0">
+        <div purpose="feature-item" class="pl-0 pl-lg-4 pr-lg-0 col-12 col-sm-6 col-lg-4">
           <img alt="File access monitoring (FIM)" src="/images/icon-fim-48x48@2x.png" class="mx-auto mx-sm-0">
           <h5>File access monitoring (FIM)</h5>
           <p>Specify files to monitor for changes or deletions, then log those events to your SIEM or data lake.</p>
         </div>
-      </div>
-      <div purpose="feature-row" class="d-flex flex-sm-row flex-column align-items-sm-start align-items-center justify-content-center">
-        <div purpose="feature-item" class="ml-sm-0">
+
+        <div purpose="feature-item" class="pr-0 pr-lg-4 pl-lg-0 col-12 col-sm-6 col-lg-4 mb-lg-0">
           <img alt="Attack surface management" src="/images/icon-attack-surface-management-48x48@2x.png" class="mx-auto mx-sm-0">
           <h5>Attack surface management</h5>
           <p>Discover security misconfigurations and vulnerabilities and prioritize risks that matter to your organization.</p>
         </div>
 
-        <div purpose="feature-item">
+        <div purpose="feature-item" class="pl-0 pl-lg-4 col-12 col-sm-6 col-lg-4 mb-sm-0">
           <img alt="Malware detection" src="/images/icon-malware-detection-48x48@2x.png" class="mx-auto mx-sm-0">
           <h5>Malware detection</h5>
           <p>Continuously scan host filesystems for indicators of compromise (IOC). Import malware signatures from threat intelligence sources.</p>
         </div>
 
-        <div purpose="feature-item" class="mr-sm-0 mb-0">
+        <div purpose="feature-item" class="pr-0 pr-lg-4 col-12 col-sm-6 col-lg-4 mb-0">
           <img alt="Osquery made easy" src="/images/icon-osquery-made-easy-48x48@2x.png" class="mx-auto mx-sm-0">
           <h5>Osquery made easy</h5>
           <p>Collect exactly the data you need from your production infrastructure across every cloud and data center*.</p>
@@ -298,7 +289,7 @@
     <div purpose="tweets-container" class="container-fluid px-md-0 pb-0 d-flex flex-column justify-content-center">
       <div purpose="section-heading" class="mx-auto text-center">
         <h4>Who else uses Fleet?</h4>
-        <h3>Empowering <%= ['mdm'].includes(primaryBuyingSituation) ? 'IT and corporate engineering' : ['eo-it'].includes(primaryBuyingSituation) ? 'IT and client platform' : ['eo-security'].includes(primaryBuyingSituation) ? 'security and platform' : ['vm'].includes(primaryBuyingSituation) ? 'security and IT' : 'IT and security' %> teams, globally</h3>
+        <h3>Empowering <%= ['mdm'].includes(pagePersonalization) ? 'IT and corporate engineering' : ['eo-it'].includes(pagePersonalization) ? 'IT and client platform' : ['eo-security'].includes(pagePersonalization) ? 'security and platform' : ['vm'].includes(pagePersonalization) ? 'security and IT' : 'IT and security' %> teams, globally</h3>
       </div>
     </div>
 
@@ -307,7 +298,7 @@
 
       <div purpose="section-heading" class="text-center">
         <h4>Endpoint operations</h4>
-        <h3><%= primaryBuyingSituation==='eo-security'? 'Instrument your endpoints' : 'Understand your computers'%></h3>
+        <h3><%= pagePersonalization==='eo-security'? 'Instrument your endpoints' : 'Understand your computers'%></h3>
         <div purpose="button-row" style="margin-top: 32px;" class="d-flex flex-md-row flex-column justify-content-center align-items-center mx-auto">
           <a purpose="cta-button" href="/register">Start now</a>
           <animated-arrow-button href="/contact">Talk to us</animated-arrow-button>
diff --git a/website/views/pages/entrance/login.ejs b/website/views/pages/entrance/login.ejs
index 7ed6d7b471..4d55f0a281 100644
--- a/website/views/pages/entrance/login.ejs
+++ b/website/views/pages/entrance/login.ejs
@@ -1,38 +1,107 @@
 <div id="login" v-cloak>
-  <div :purpose="[showCustomerLogin ? 'customer-login-container' : 'login-container']" class="container-fluid pb-5 px-lg-0 px-3">
-    <div purpose="page-heading" v-if="showCustomerLogin">
+  <div purpose="page-container" class="container">
+    <div purpose="page-heading">
       <h1>Welcome to Fleet</h1>
       <p class="mb-0">We just need a few details in order to get started.</p>
     </div>
-    <div purpose="page-heading" v-else>
-      <h1>Welcome to Fleet</h1>
-      <p class="mb-0">Sign in to your Fleet account.</p>
-    </div>
-    <div purpose="customer-portal-form"  class="card card-body mb-5">
-      <div purpose="register-link" v-if="showCustomerLogin">
-        <a :href="registerSlug">Create an account</a>
+    <div purpose="form-container" class="d-flex flex-lg-row flex-column justify-content-between align-items-start">
+      <div purpose="login-form" class="mx-auto mx-lg-0">
+        <div purpose="customer-portal-form"  class="card card-body mb-5">
+          <div purpose="register-link" v-if="showCustomerLogin">
+            <a :href="registerSlug">Create an account</a>
+          </div>
+          <ajax-form class="customers-login" action="login" :syncing.sync="syncing" :cloud-error.sync="cloudError" :form-data="formData" :form-rules="formRules" :form-errors.sync="formErrors" @submitted="submittedForm()">
+            <div class="form-group">
+              <label for="email">Email</label>
+              <input type="email" class="form-control" :class="[formErrors.emailAddress ? 'is-invalid' : '']" v-model.trim="formData.emailAddress" autocomplete="email" focus-first>
+              <div class="invalid-feedback" v-if="formErrors.emailAddress">Please provide a valid email address.</div>
+            </div>
+            <div class="form-group">
+              <label for="password">Password</label>
+              <input type="password" class="form-control" :class="[formErrors.password ? 'is-invalid' : '']" v-model.trim="formData.password" autocomplete="current-password">
+              <div class="invalid-feedback" v-if="formErrors.password">Please enter your password.</div>
+            </div>
+            <cloud-error v-if="cloudError === 'noUser'">The email address provided doesn't match an existing account. Create an account <a href="/customers/register">here</a>.</cloud-error>
+            <cloud-error v-else-if="cloudError === 'badCombo'">Something’s not quite right with your email or password.</cloud-error>
+            <cloud-error v-else-if="cloudError"></cloud-error>
+            <div class="pb-3">
+              <ajax-button :syncing="syncing" spinner="true" purpose="submit-button" class="btn-primary mt-4 btn-lg btn-block">Sign in</ajax-button>
+            </div>
+          </ajax-form>
+          <span class="text-center small"><a href="/customers/forgot-password">Forgot your password?</a></span>
+        </div>
       </div>
-      <ajax-form class="customers-login" action="login" :syncing.sync="syncing" :cloud-error.sync="cloudError" :form-data="formData" :form-rules="formRules" :form-errors.sync="formErrors" @submitted="submittedForm()">
-        <div class="form-group">
-          <label for="email">Email</label>
-          <input type="email" class="form-control" :class="[formErrors.emailAddress ? 'is-invalid' : '']" v-model.trim="formData.emailAddress" autocomplete="email" focus-first>
-          <div class="invalid-feedback" v-if="formErrors.emailAddress">Please provide a valid email address.</div>
+      <div purpose="quote-and-logos" class="mx-auto mx-lg-0">
+        <% if(typeof primaryBuyingSituation === 'undefined' || ['mdm'].includes(primaryBuyingSituation)) { %>
+          <div purpose="quote">
+            <img alt="an opening quotation mark" style="width:20px; margin-bottom: 16px;" src="/images/icon-quote-21x17@2x.png">
+            <p purpose="quote-text">
+              Exciting. This is a team that listens to feedback.
+            </p>
+            <div purpose="quote-author-info" class="d-flex flex-row align-items-center">
+              <div purpose="profile-picture">
+                <img alt="Erik Gomez" src="/images/testimonial-author-erik-gomez-48x48@2x.png">
+              </div>
+              <div class="d-flex flex-column align-self-top">
+                <p purpose="name" class="font-weight-bold m-0">Erik Gomez</p>
+                <p purpose="job-title" class="m-0">Staff Client Platform Engineer</p>
+              </div>
+            </div>
+          </div>
+        <% } else if (['eo-it'].includes(primaryBuyingSituation)) { %>
+          <div purpose="quote">
+            <img alt="an opening quotation mark" style="width:20px; margin-bottom: 16px;" src="/images/icon-quote-21x17@2x.png">
+            <p purpose="quote-text">
+              Mad props to how easy making a deploy pkg of the agent was. I wish everyone made stuff that easy.
+            </p>
+            <div purpose="quote-author-info" class="d-flex flex-row align-items-center">
+              <div purpose="profile-picture">
+                <img alt="Wes Whetstone" src="/images/testimonial-author-wes-whetstone-48x48@2x.png">
+              </div>
+              <div class="d-flex flex-column align-self-top">
+                <p purpose="name" class="font-weight-bold m-0">Wes Whetstone</p>
+                <p purpose="job-title" class="m-0">Staff CPE</p>
+              </div>
+            </div>
+          </div>
+        <% } else if (['eo-security'].includes(primaryBuyingSituation)) { %>
+          <div purpose="quote">
+            <img alt="an opening quotation mark" style="width:20px; margin-bottom: 16px;" src="/images/icon-quote-21x17@2x.png">
+            <p purpose="quote-text">
+              Something I really appreciate about working with you guys is that it doesn't feel like I'm talking to a vendor. It actually feels like I'm talking to my team, and I really appreciate it.
+            </p>
+            <div purpose="quote-author-info" class="d-flex flex-row align-items-center">
+              <div purpose="profile-picture">
+                <img alt="Chandra Majumdar" src="/images/testimonial-author-chandra-majumdar-48x48@2x.png">
+              </div>
+              <div class="d-flex flex-column align-self-top">
+                <p purpose="name" class="font-weight-bold m-0">Chandra Majumdar</p>
+                <p purpose="job-title" class="m-0">Partner - Cyber and Strategic Risk</p>
+              </div>
+            </div>
+          </div>
+        <% } else if (['vm'].includes(primaryBuyingSituation)) { %>
+          <div purpose="quote">
+            <img alt="an opening quotation mark" style="width:20px; margin-bottom: 16px;" src="/images/icon-quote-21x17@2x.png">
+            <p purpose="quote-text">
+              The visibility down into the assets covered by the agent is phenomenal. Fleet has become the central source for a lot of things.
+            </p>
+            <div purpose="quote-author-info" class="d-flex flex-row align-items-center">
+              <div purpose="profile-picture">
+                <img alt="Andre Shields" src="/images/testimonial-author-andre-shields-48x48@2x.png">
+              </div>
+              <div class="d-flex flex-column align-self-top">
+                <p purpose="name" class="font-weight-bold m-0">Andre Shields</p>
+                <p purpose="job-title" class="m-0">Staff Cybersecurity Engineer, Vulnerability Management</p>
+              </div>
+            </div>
+          </div>
+        <% } %>
+        <div purpose="logos" class="flex-column flex-wrap align-items-center w-100">
+          <logo-carousel></logo-carousel>
         </div>
-        <div class="form-group">
-          <label for="password">Password</label>
-          <input type="password" class="form-control" :class="[formErrors.password ? 'is-invalid' : '']" v-model.trim="formData.password" autocomplete="current-password">
-          <div class="invalid-feedback" v-if="formErrors.password">Please enter your password.</div>
-        </div>
-        <cloud-error v-if="cloudError === 'noUser'">The email address provided doesn't match an existing account. Create an account <a href="/customers/register">here</a>.</cloud-error>
-        <cloud-error v-else-if="cloudError === 'badCombo'">Something’s not quite right with your email or password.</cloud-error>
-        <cloud-error v-else-if="cloudError"></cloud-error>
-        <div class="pb-3">
-          <ajax-button :syncing="syncing" spinner="true" purpose="submit-button" class="btn-primary mt-4 btn-lg btn-block">Sign in</ajax-button>
-        </div>
-      </ajax-form>
-      <span class="text-center small"><a href="/customers/forgot-password">Forgot your password?</a></span>
+      </div>
     </div>
-    <logo-carousel></logo-carousel>
   </div>
 </div>
 <%- /* Expose locals as `window.SAILS_LOCALS` :: */ exposeLocalsToBrowser() %>
diff --git a/website/views/pages/entrance/signup.ejs b/website/views/pages/entrance/signup.ejs
index 437deb454a..40b71c7c1d 100644
--- a/website/views/pages/entrance/signup.ejs
+++ b/website/views/pages/entrance/signup.ejs
@@ -80,15 +80,15 @@
           <div purpose="quote">
             <img alt="an opening quotation mark" style="width:20px; margin-bottom: 16px;" src="/images/icon-quote-21x17@2x.png">
             <p purpose="quote-text">
-              When we look at vendors, we look for ones that are very receptive to feedback, where you’re just part of the family, I guess. Fleet’s really good at that.
+              Mad props to how easy making a deploy pkg of the agent was. I wish everyone made stuff that easy.
             </p>
             <div purpose="quote-author-info" class="d-flex flex-row align-items-center">
               <div purpose="profile-picture">
-                <img alt="Harrison Ravazzolo" src="/images/testimonial-author-harrison-ravazzolo-48x48@2x.png">
+                <img alt="Wes Whetstone" src="/images/testimonial-author-wes-whetstone-48x48@2x.png">
               </div>
               <div class="d-flex flex-column align-self-top">
-                <p purpose="name" class="font-weight-bold m-0">Harrison Ravazzolo</p>
-                <p purpose="job-title" class="m-0">Lead platform and identity engineer</p>
+                <p purpose="name" class="font-weight-bold m-0">Wes Whetstone</p>
+                <p purpose="job-title" class="m-0">Staff CPE</p>
               </div>
             </div>
           </div>
diff --git a/website/views/pages/fleetctl-preview.ejs b/website/views/pages/fleetctl-preview.ejs
index 3eb350198a..068a3d3d4d 100644
--- a/website/views/pages/fleetctl-preview.ejs
+++ b/website/views/pages/fleetctl-preview.ejs
@@ -2,7 +2,7 @@
   <div purpose="page-container" class="d-flex flex-column container">
     <div purpose="page-title">
       <h1>Try Fleet</h1>
-      <p>The quickest way to try Fleet is to run a local demo with <a href="https://docs.docker.com/get-docker/" target="_blank">Docker</a>.</p>
+      <p>The quickest way to try Fleet Premium is to run a local demo with <a href="https://docs.docker.com/get-docker/" target="_blank">Docker</a>.</p>
       <p class="mb-0">Follow the instructions below to test Fleet on your macOS, Windows, and Linux device.</p>
     </div>
     <div purpose="prerequisites">
@@ -27,11 +27,28 @@
         <div purpose="numbered-steps">
           <div purpose="step">
               <p>Install the <code>fleetctl</code> command line tool:</p>
-              <div purpose="terminal-commands"> <p>curl -sSL https://fleetdm.com/resources/install-fleetctl.sh | bash</p></div>
+              <div purpose="terminal-commands">
+                <div purpose="command-container">
+                  <code>{{installCommands[selectedPlatform]}}</code>
+                </div>
+                <span purpose="install-copy-button" @click="clickCopyInstallCommand(selectedPlatform)"></span>
+              </div>
           </div>
           <div purpose="step">
             <p>Run a local demo of the Fleet server:</p>
-            <div purpose="terminal-commands"> <p>~/.fleetctl/fleetctl preview</p></div>
+            <div purpose="terminal-commands">
+              <div purpose="command-container">
+                <code v-if="trialLicenseKey && !userHasExpiredTrialLicense">{{fleetctlPreviewTerminalCommand[selectedPlatform]}} --license-key {{trialLicenseKey}}</code>
+                <code v-else>{{fleetctlPreviewTerminalCommand[selectedPlatform]}}</code>
+              </div>
+              <a purpose="command-copy-button" @click="clickCopyTerminalCommand(selectedPlatform)"></a>
+            </div>
+            <blockquote purpose="tip" v-if="userHasExpiredTrialLicense">
+              <img src="/images/icon-info-16x16@2x.png" alt="An icon indicating that this section has important information">
+              <div class="d-block">
+                <p>Your Fleet Premium trial license has expired. You can still run the free version of Fleet locally.</p>
+              </div>
+            </blockquote>
           </div>
           <div purpose="step">
             <p>The Fleet UI is now available at <a href="http://localhost:1337" target="_blank">http://localhost:1337</a>. Use the credentials below to login:</p>
@@ -44,12 +61,29 @@
       <div v-else-if="selectedPlatform === 'linux'">
         <div purpose="numbered-steps">
           <div purpose="step">
-              <p>Install the <code>fleetctl</code> command line tool:</p>
-              <div purpose="terminal-commands"> <p>curl -sSL https://fleetdm.com/resources/install-fleetctl.sh | bash</p></div>
+            <p>Install the <code>fleetctl</code> command line tool:</p>
+            <div purpose="terminal-commands">
+              <div purpose="command-container">
+                <code>{{installCommands[selectedPlatform]}}</code>
+              </div>
+              <span purpose="install-copy-button" @click="clickCopyInstallCommand(selectedPlatform)"></span>
+            </div>
           </div>
           <div purpose="step">
             <p>Run a local demo of the Fleet server:</p>
-            <div purpose="terminal-commands"> <p>~/.fleetctl/fleetctl preview</p></div>
+            <div purpose="terminal-commands">
+              <div purpose="command-container">
+                <code v-if="trialLicenseKey && !userHasExpiredTrialLicense">{{fleetctlPreviewTerminalCommand[selectedPlatform]}} --license-key {{trialLicenseKey}}</code>
+                <code v-else>{{fleetctlPreviewTerminalCommand[selectedPlatform]}}</code>
+              </div>
+              <a purpose="copy-button" @click="clickCopyTerminalCommand(selectedPlatform)"></a>
+            </div>
+            <blockquote purpose="tip" v-if="userHasExpiredTrialLicense">
+              <img src="/images/icon-info-16x16@2x.png" alt="An icon indicating that this section has important information">
+              <div class="d-block">
+                <p>Your Fleet Premium trial license has expired. You can still run the free version of Fleet locally.</p>
+              </div>
+            </blockquote>
           </div>
           <div purpose="step">
             <p>The Fleet UI is now available at <a href="http://localhost:1337" target="_blank">http://localhost:1337</a>. Use the credentials below to login:</p>
@@ -63,11 +97,28 @@
         <div purpose="numbered-steps">
           <div purpose="step">
               <p>Install the <code>fleetctl</code> command line tool:</p>
-              <div purpose="terminal-commands"><p>for /f "tokens=1,* delims=:" %a in ('curl -s https://api.github.com/repos/fleetdm/fleet/releases/latest ^| findstr "browser_download_url" ^| findstr "_windows.zip"') do (curl -kOL %b) && if not exist "%USERPROFILE%\.fleetctl" mkdir "%USERPROFILE%\.fleetctl" && for /f "delims=" %a in ('dir /b fleetctl_*_windows.zip') do tar -xf "%a" --strip-components=1 -C "%USERPROFILE%\.fleetctl" && del "%a"</p></div>
+              <div purpose="terminal-commands">
+                <div purpose="command-container">
+                  <code>{{installCommands[selectedPlatform]}}</code>
+                </div>
+                <span purpose="install-copy-button" @click="clickCopyInstallCommand(selectedPlatform)"></span>
+              </div>
           </div>
           <div purpose="step">
             <p>Run a local demo of the Fleet server:</p>
-            <div purpose="terminal-commands"> <p>%USERPROFILE%\.fleetctl\fleetctl preview</p></div>
+            <div purpose="terminal-commands">
+              <div purpose="command-container">
+                <code v-if="trialLicenseKey && !userHasExpiredTrialLicense">{{fleetctlPreviewTerminalCommand[selectedPlatform]}} --license-key {{trialLicenseKey}}</code>
+                <code v-else>{{fleetctlPreviewTerminalCommand[selectedPlatform]}}</code>
+              </div>
+              <a purpose="command-copy-button" @click="clickCopyTerminalCommand(selectedPlatform)"></a>
+            </div>
+            <blockquote purpose="tip" v-if="userHasExpiredTrialLicense">
+              <img src="/images/icon-info-16x16@2x.png" alt="An icon indicating that this section has important information">
+              <div class="d-block">
+                <p>Your Fleet Premium trial license has expired. You can still run the free version of Fleet locally.</p>
+              </div>
+            </blockquote>
           </div>
           <div purpose="step">
             <p>The Fleet UI is now available at <a href="http://localhost:1337" target="_blank">http://localhost:1337</a>. Use the credentials below to login:</p>
@@ -88,11 +139,28 @@
           </div>
           <div purpose="step">
             <p>Install the <code>fleetctl</code> command line tool:</p>
-            <div purpose="terminal-commands"> <p>npm install fleetctl -g</p></div>
+            <div purpose="terminal-commands">
+              <div purpose="command-container">
+                <code>{{installCommands[selectedPlatform]}}</code>
+              </div>
+              <span purpose="install-copy-button" @click="clickCopyInstallCommand(selectedPlatform)"></span>
+            </div>
           </div>
           <div purpose="step">
             <p>Run a local demo of the Fleet server:</p>
-            <div purpose="terminal-commands"> <p>fleetctl preview</p></div>
+            <div purpose="terminal-commands">
+              <div purpose="command-container">
+                <code v-if="trialLicenseKey && !userHasExpiredTrialLicense">{{fleetctlPreviewTerminalCommand[selectedPlatform]}} --license-key {{trialLicenseKey}}</code>
+                <code v-else>{{fleetctlPreviewTerminalCommand[selectedPlatform]}}</code>
+              </div>
+              <a purpose="command-copy-button" @click="clickCopyTerminalCommand(selectedPlatform)"></a>
+            </div>
+            <blockquote purpose="tip" v-if="userHasExpiredTrialLicense">
+              <img src="/images/icon-info-16x16@2x.png" alt="An icon indicating that this section has important information">
+              <div class="d-block">
+                <p>Your Fleet Premium trial license has expired. You can still run the free version of Fleet locally.</p>
+              </div>
+            </blockquote>
           </div>
           <div purpose="step">
             <p>The Fleet UI is now available at <a href="http://localhost:1337" target="_blank">http://localhost:1337</a>. Use the credentials below to login:</p>
diff --git a/website/views/pages/homepage.ejs b/website/views/pages/homepage.ejs
index 99d70bfbaa..7b113f4a13 100644
--- a/website/views/pages/homepage.ejs
+++ b/website/views/pages/homepage.ejs
@@ -37,10 +37,10 @@
           <img alt="Operating systems entering a glass device management dome" src="/images/device-management-hero-380x293@2x.png">
         </div>
         <div purpose="category-text-block" class="d-flex flex-column">
-          <strong>Your easiest MDM migration</strong>
-          <p>Even if you've never done an MDM migration, you've probably heard it's hard.  Fleet makes it easy to get your data in and get it out.</p>
-          <strong>Tidy up your tools</strong>
-          <p>Deploy a modern Mac-first MDM purpose-built for IT engineers and cross-training. Use principles from DevOps to manage Apple, Windows, and Linux computers declaratively.</p>
+          <strong>Everything in one place</strong>
+          <p>Manage devices consistently in a single, open platform for Apple, Windows, and Linux. Going only Mac or 50/50 Mac and Windows? What about Linux? It’s up to you. </p>
+          <strong>Debunk the cross-platform myth</strong>
+          <p>Fleet exposes familiar concepts like custom attributes and dynamic grouping, but in a way that lets you work directly with data and events from each native operating system.</p>
           <strong>Less friction</strong>
           <p>Fork the CIS benchmarks or easily build your own compliance framework. 100% source available.</p>
           <div>
@@ -62,7 +62,7 @@
           <strong>Osquery on easy mode</strong>
           <p>Use "read-only" mode or enable remote scripting to automate anything on every operating system, including Linux.</p>
           <div>
-            <a purpose="category-button" class="text-nowrap btn btn-primary" href="/endpoint-ops?utm_content=eo-it">Start with IT engineering</a>
+            <a purpose="category-button" class="text-nowrap btn btn-primary" href="/endpoint-ops?purpose=it">Start with IT engineering</a>
           </div>
         </div>
       </div>
@@ -80,7 +80,7 @@
           <strong>Ship data to any platform</strong>
           <p>Ship logs to any platform like Splunk, Snowflake, or <a href="/docs/using-fleet/log-destinations">any streaming infrastructure</a> like AWS Kinesis and Apache Kafka.</p>
           <div>
-            <a purpose="category-button" class="text-nowrap btn btn-primary" href="/endpoint-ops?utm_content=eo-security">Start with security engineering</a>
+            <a purpose="category-button" class="text-nowrap btn btn-primary" href="/endpoint-ops?purpose=security">Start with security engineering</a>
           </div>
         </div>
       </div>
@@ -108,7 +108,7 @@
              <h2><%= primaryBuyingSituation==='eo-security'? 'Instrument your endpoints' : 'Understand your computers'%></h2>
              <p>A <%= primaryBuyingSituation==='eo-security'? 'lightweight' : 'quick-fast' %> way to gather <%= primaryBuyingSituation==='vm'? 'patch level and custom reports across all your computing devices, even in OT and production environments' : primaryBuyingSituation==='eo-security'? 'deep context and custom telemetry across all your endpoints, even servers' : primaryBuyingSituation==='mdm'||primaryBuyingSituation==='eo-it'? 'compliance and inventory data across all your devices' : 'device data across all your computers' %>. Pulse check or automate anything on any platform.</p>
              <div>
-               <animated-arrow-button href="/endpoint-ops<%= primaryBuyingSituation==='eo-security' ? '?utm_content=eo-security' : '?utm_content=eo-it'%>">Start with <%= primaryBuyingSituation==='eo-security' ? 'security engineering' : 'IT engineering'%></animated-arrow-button>
+               <animated-arrow-button href="/endpoint-ops">Start with <%= primaryBuyingSituation==='eo-security' ? 'security engineering' : 'IT engineering'%></animated-arrow-button>
              </div>
            </div>
            <div purpose="endpoint-ops-image" class="right">
@@ -175,7 +175,7 @@
              <h2><%= primaryBuyingSituation==='vm'? 'Instrument your endpoints' : 'Understand your computers'%></h2>
              <p>A <%= primaryBuyingSituation==='vm'? 'lightweight' : 'quick-fast' %> way to gather <%= primaryBuyingSituation==='vm'? 'patch level and custom reports across all your computing devices, even in OT and production environments' : primaryBuyingSituation==='vm'? 'deep context and custom telemetry across all your endpoints, even servers' : primaryBuyingSituation==='mdm'||primaryBuyingSituation==='eo-it'? 'compliance and inventory data across all your devices' : 'device data across all your computers' %>. Pulse check or automate anything on any platform.</p>
              <div>
-               <animated-arrow-button href="/endpoint-ops<%= primaryBuyingSituation==='mdm' ? '?utm_content=eo-it' : '?utm_content=eo-security'%>">Start with <%= primaryBuyingSituation==='mdm' ? 'IT engineering' : 'security engineering'%></animated-arrow-button>
+               <animated-arrow-button href="/endpoint-ops">Start with <%= primaryBuyingSituation==='mdm' ? 'IT engineering' : 'security engineering'%></animated-arrow-button>
              </div>
            </div>
          </div>
@@ -373,7 +373,7 @@
     <div purpose="homepage-content" class="container">
       <div class="text-center" purpose="bottom-cta">
         <h4>For teams with lots of computing devices</h4>
-        <h1><%- partial('../partials/primary-tagline.partial.ejs') %></h1>
+        <h1 class="mx-auto <%= primaryBuyingSituation%>"><%- partial('../partials/primary-tagline.partial.ejs') %></h1>
         <div purpose="button-row" style="margin-top: 40px;" class="d-flex flex-sm-row flex-column justify-content-center align-items-center mx-auto">
           <a purpose="cta-button" href="/register">Start now</a>
           <animated-arrow-button href="/contact">Talk to us</animated-arrow-button>
@@ -384,6 +384,9 @@
   </div>
   <%/* Cloud city banner */%>
   <parallax-city></parallax-city>
+  <modal v-if="modal === 'unsubscribed'" @close="closeModal()">
+    <p class="mb-0">Your email preferences have been updated.</p>
+  </modal>
   <modal purpose="video-modal" v-if="modal === 'austin-anderson'" @close="closeModal()">
     <iframe width="560" height="315" src="https://www.youtube.com/embed/G5Ry_vQPaYc?si=vv0AfRe30yssWWRM&amp;rel=0" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" allowfullscreen></iframe>
   </modal>
diff --git a/website/views/pages/integrations.ejs b/website/views/pages/integrations.ejs
index 0303a83775..ac9a2c3466 100644
--- a/website/views/pages/integrations.ejs
+++ b/website/views/pages/integrations.ejs
@@ -15,7 +15,7 @@
         </div>
         <div purpose="integration-card-body" class="card-body">
           <p>
-            Know who opened your computer before you let them log into anything.
+            Enable single sign-on (SSO) by configuring Fleet as an Okta SAML application.
           </p>
           <div purpose="integration-card-buttons" class="d-flex flex-row justify-content-between">
             <a purpose="learn-more-link" target="_blank" href="https://www.okta.com/">Learn more</a>
@@ -29,7 +29,7 @@
         </div>
         <div purpose="integration-card-body" class="card-body">
           <p>
-            Ingest osquery data and monitor for important changes or events.
+            Import Fleet data to Snowflake.
           </p>
           <div purpose="integration-card-buttons" class="d-flex flex-row justify-content-between">
             <a purpose="learn-more-link" target="_blank"  href="https://www.snowflake.com/">Learn more</a>
@@ -73,11 +73,10 @@
         </div>
         <div purpose="integration-card-body" class="card-body">
           <p>
-            Know who opened your computer before you let them log into anything.
+            Integrate with a legacy on-prem identity server.
           </p>
           <div purpose="integration-card-buttons" class="d-flex flex-row justify-content-between">
             <a purpose="learn-more-link" target="_blank" href="https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/whatis">Learn more</a>
-            <animated-arrow-button class="py-0" href="/docs/deploy/single-sign-on-sso#other-idps">Docs</animated-arrow-button>
           </div>
         </div>
       </div>
@@ -88,11 +87,11 @@
         </div>
         <div purpose="integration-card-body" class="card-body">
           <p>
-            Deploy Fleet in Ansible.
+            Deploy Fleet with Ansible.
           </p>
           <div purpose="integration-card-buttons" class="d-flex flex-row justify-content-between">
-            <a purpose="learn-more-link" target="_blank" href="https://ansible.com">Learn more</a>
-            <animated-arrow-button class="py-0" target="_blank"  href="https://github.com/CptOfEvilMinions/FleetDM-Automation">Docs</animated-arrow-button>
+            <a purpose="learn-more-link" target="_blank" href="">Learn more</a>
+            <animated-arrow-button class="py-0" target="_blank" href="https://github.com/CptOfEvilMinions/FleetDM-Automation">Guide</animated-arrow-button>
           </div>
         </div>
       </div>
@@ -103,11 +102,11 @@
         </div>
         <div purpose="integration-card-body" class="card-body">
           <p>
-            Deploy your own self-managed Fleet in any AWS environment in minutes.
+            Deploy your own self-managed Fleet server on AWS.
           </p>
           <div purpose="integration-card-buttons" class="d-flex flex-row justify-content-between">
             <a purpose="learn-more-link" target="_blank" href="https://aws.amazon.com/">Learn more</a>
-            <animated-arrow-button class="py-0" href="/docs/deploy/deploy-on-aws-with-terraform">Get started</animated-arrow-button>
+            <animated-arrow-button class="py-0" href="/docs/deploy/deploy-fleet#aws">Get started</animated-arrow-button>
           </div>
         </div>
       </div>
@@ -117,11 +116,11 @@
         </div>
         <div purpose="integration-card-body" class="card-body">
           <p>
-            Deploy your own self-managed Fleet in the Microsoft Cloud.
+            Deploy your own self-managed Fleet server on Azure.
           </p>
           <div purpose="integration-card-buttons" class="d-flex flex-row justify-content-between">
             <a purpose="learn-more-link" target="_blank" href="https://azure.microsoft.com/en-us">Learn more</a>
-            <animated-arrow-button class="py-0" href="/docs/deploy/reference-architectures#azure">Docs</animated-arrow-button>
+            <animated-arrow-button class="py-0" href="https://chat.osquery.io/c/fleet">Community support</animated-arrow-button>
           </div>
         </div>
       </div>
@@ -132,11 +131,10 @@
         </div>
         <div purpose="integration-card-body" class="card-body">
           <p>
-            Easily issue MDM commands and standardize data across operating systems.
+            Chef is an automation tool that can be used with Fleet.
           </p>
           <div purpose="integration-card-buttons" class="d-flex flex-row justify-content-between">
             <a purpose="learn-more-link" target="_blank" href="https://www.chef.io/products/chef-infra">Learn more</a>
-            <animated-arrow-button class="py-0" target="_blank"  href="https://docs.chef.io/chef_overview/">Docs</animated-arrow-button>
           </div>
         </div>
       </div>
@@ -147,7 +145,7 @@
         </div>
         <div purpose="integration-card-body" class="card-body">
           <p>
-            Ingest osquery data and monitor for important changes or events.
+            Import Fleet data to Elastic.
           </p>
           <div purpose="integration-card-buttons" class="d-flex flex-row justify-content-between">
             <a purpose="learn-more-link" target="_blank" href="https://www.elastic.co/">Learn more</a>
@@ -189,7 +187,7 @@
         </div>
         <div purpose="integration-card-body" class="card-body">
           <p>
-            Ingest osquery data and monitor for important changes or events.
+            Import Fleet data to Chronicle.
           </p>
           <div purpose="integration-card-buttons" class="d-flex flex-row justify-content-between">
             <a purpose="learn-more-link" target="_blank" href="https://chronicle.security/">Learn more</a>
@@ -203,11 +201,11 @@
         </div>
         <div purpose="integration-card-body" class="card-body">
           <p>
-            Deploy your own self-managed Fleet in any GCP environment.
+            Deploy your own self-managed Fleet server on Google Cloud Platform (GCP).
           </p>
           <div purpose="integration-card-buttons" class="d-flex flex-row justify-content-between">
             <a purpose="learn-more-link" target="_blank" href="https://console.cloud.google.com/getting-started">Learn more</a>
-            <animated-arrow-button class="py-0" href="/docs/deploy/reference-architectures#gcp">Get started</animated-arrow-button>
+            <animated-arrow-button class="py-0" href="https://chat.osquery.io/c/fleet">Community support</animated-arrow-button>
           </div>
         </div>
       </div>
@@ -231,7 +229,7 @@
         </div>
         <div purpose="integration-card-body" class="card-body">
           <p>
-            Easily issue MDM commands and standardize data across operating systems.
+            Deploy software with Fleet and Munki.
           </p>
           <div purpose="integration-card-buttons" class="d-flex flex-row justify-content-between">
             <a purpose="learn-more-link" target="_blank" href="https://github.com/munki/munki">Learn more</a>
@@ -245,7 +243,7 @@
         </div>
         <div purpose="integration-card-body" class="card-body">
           <p>
-            Easily issue MDM commands and standardize data across operating systems.
+            Deploy configuration profiles and issue MDM commands with Fleet and Puppet.
           </p>
           <div purpose="integration-card-buttons" class="d-flex flex-row justify-content-between">
             <a purpose="learn-more-link" target="_blank" href="https://puppet.com/">Learn more</a>
@@ -260,7 +258,7 @@
         </div>
         <div purpose="integration-card-body" class="card-body">
           <p>
-            Ingest osquery data and monitor for important changes or events.
+            Import Fleet data to Splunk.
           </p>
           <div purpose="integration-card-buttons" class="d-flex flex-row justify-content-between">
             <a purpose="learn-more-link" target="_blank" href="https://www.splunk.com/">Learn more</a>
diff --git a/website/views/pages/pricing.ejs b/website/views/pages/pricing.ejs
index 99f35ad993..0a739c7529 100644
--- a/website/views/pages/pricing.ejs
+++ b/website/views/pages/pricing.ejs
@@ -64,6 +64,9 @@
           </div>
         </div>
       </div>
+      <div purpose="logos-container" class="flex-column flex-wrap align-items-center w-100">
+        <logo-carousel></logo-carousel>
+      </div>
       <div purpose="pricing-switch" class="d-flex flex-md-row flex-column justify-content-center mx-auto">
         <div purpose="pricing-switch-option" class="all" :class="[pricingMode === 'all' ? 'selected' : '']" @click="clickChangePricingMode('all')">All features</div>
         <div purpose="pricing-switch-option" class="it" :class="[pricingMode === 'IT' ? 'selected' : '']" @click="clickChangePricingMode('IT')">For IT admins</div>
@@ -73,14 +76,14 @@
     </div>
     <%// All features %>
     <div purpose="features-table" class="d-flex flex-column justify-content-center mx-auto px-0 " :class="[[pricingMode === 'all' ? 'show' : 'hide']]">
-      <div class="d-flex flex-column justify-content-center p-0">
+      <div class="d-flex flex-column p-0" :class="[showExpandedTable ? '' : 'truncated']">
         <%// Desktop features tables %>
         <div class="d-none d-md-block">
           <% for(let category of pricingTable) {%>
             <table purpose="pricing-categories-table" class="table">
              <thead>
                 <tr>
-                  <td><h4><%- category.categoryName %></h4></td>
+                  <td><h5><%- category.categoryName %></h5></td>
                   <%if(pricingTable.indexOf(category) === 0) {%>
                   <td class="text-center">
                     <strong>Free</strong>
@@ -122,37 +125,40 @@
         </div>
         <%// Mobile features tables %>
         <div purpose="mobile-feature-table-section" class="d-block d-md-none" v-for="category in pricingTable">
-          <h4>{{category.categoryName}}</h4>
-            <div purpose="mobile-features-table" class="d-flex flex-column" v-for="feature in category.features">
-              <div purpose="striped-row" class="d-flex flex-row justify-content-between align-items-center">
-                <strong class="d-block">
-                  {{feature.name}}{{feature.comingSoon ? '*' : ''}}
-                </strong>
-                <img class="d-block" purpose="tooltip-icon" src="/images/icon-more-info-14x14@2x.png" alt="More info" @click="clickOpenMobileTooltip(feature)" v-if="feature.description">
-              </div>
-              <div class="d-flex flex-row justify-content-between align-items-center">
-                Free
-                <img class="d-block" alt="checkmark" purpose="checkmark" src="/images/icon-checkmark-green-16x16@2x.png" v-if="feature.tier === 'Free'">
-              </div>
-              <div purpose="striped-row" class="d-flex flex-row justify-content-between align-items-center">
-                Premium
-                <img class="d-block" alt="checkmark" purpose="checkmark" src="/images/icon-checkmark-green-16x16@2x.png">
-              </div>
+          <h5>{{category.categoryName}}</h5>
+          <div purpose="mobile-features-table" class="d-flex flex-column" v-for="feature in category.features">
+            <div purpose="striped-row" class="d-flex flex-row justify-content-between align-items-center">
+              <strong class="d-block">
+                {{feature.name}}{{feature.comingSoon ? '*' : ''}}
+              </strong>
+              <img class="d-block" purpose="tooltip-icon" src="/images/icon-more-info-14x14@2x.png" alt="More info" @click="clickOpenMobileTooltip(feature)" v-if="feature.description">
+            </div>
+            <div class="d-flex flex-row justify-content-between align-items-center">
+              Free
+              <img class="d-block" alt="checkmark" purpose="checkmark" src="/images/icon-checkmark-green-16x16@2x.png" v-if="feature.tier === 'Free'">
+            </div>
+            <div purpose="striped-row" class="d-flex flex-row justify-content-between align-items-center">
+              Premium
+              <img class="d-block" alt="checkmark" purpose="checkmark" src="/images/icon-checkmark-green-16x16@2x.png">
             </div>
           </div>
-          <p style="color: #515774;" class="d-block d-md-none mb-0 w-100">* Coming soon</p>
+        </div>
+        <p style="color: #515774;" class="d-block d-md-none mb-0 w-100">* Coming soon</p>
+        <div purpose="truncated-features-fade">
+        </div>
       </div>
+      <div class="d-flex flex-row justify-content-center"><a :class="[showExpandedTable ? 'expanded' : '']" @click="showExpandedTable = !showExpandedTable" purpose="show-all-features-button">Show all features<span></span></a></div>
     </div>
     <%// Filtered features %>
     <div purpose="features-table" class="d-flex flex-column justify-content-center mx-auto px-0" :class="[[pricingMode === 'IT' ? 'show' : 'hide']]">
-      <div class="d-flex flex-column justify-content-center p-0">
+      <div class="d-flex flex-column p-0" :class="[showExpandedTable ? '' : 'truncated']">
         <%// Desktop features tables %>
         <div class="d-none d-md-block">
           <% for(let category of pricingTableForIt) {%>
             <table purpose="pricing-categories-table" class="table">
              <thead>
                 <tr>
-                  <td><h4><%- category.categoryName %></h4></td>
+                  <td><h5><%- category.categoryName %></h5></td>
                   <%if(pricingTableForIt.indexOf(category) === 0) {%>
                   <td class="text-center">
                     <strong>Free</strong>
@@ -194,36 +200,38 @@
         </div>
         <%// Mobile features tables %>
         <div purpose="mobile-feature-table-section" class="d-block d-md-none" v-for="category in pricingTableForIt">
-          <h4>{{category.categoryName}}</h4>
-            <div purpose="mobile-features-table" class="d-flex flex-column" v-for="feature in category.features">
-              <div purpose="striped-row" class="d-flex flex-row justify-content-between align-items-center" @click="">
-                <strong>
-                  {{feature.name}}{{feature.comingSoon ? '*' : ''}}
-                  <img class="d-inline" purpose="tooltip-icon" src="/images/icon-more-info-14x14@2x.png" alt="More info" @click="clickOpenMobileTooltip(feature)" v-if="feature.description">
-                </strong>
-              </div>
-              <div class="d-flex flex-row justify-content-between align-items-center">
-                Free
-                <img class="d-block" alt="checkmark" purpose="checkmark" src="/images/icon-checkmark-green-16x16@2x.png" v-if="feature.tier === 'Free'">
-              </div>
-              <div purpose="striped-row" class="d-flex flex-row justify-content-between align-items-center">
-                Premium
-                <img class="d-block" alt="checkmark" purpose="checkmark" src="/images/icon-checkmark-green-16x16@2x.png">
-              </div>
+          <h5>{{category.categoryName}}</h5>
+          <div purpose="mobile-features-table" class="d-flex flex-column" v-for="feature in category.features">
+            <div purpose="striped-row" class="d-flex flex-row justify-content-between align-items-center" @click="">
+              <strong class="d-block">
+                {{feature.name}}{{feature.comingSoon ? '*' : ''}}
+                <img class="d-inline" purpose="tooltip-icon" src="/images/icon-more-info-14x14@2x.png" alt="More info" @click="clickOpenMobileTooltip(feature)" v-if="feature.description">
+              </strong>
+            </div>
+            <div class="d-flex flex-row justify-content-between align-items-center">
+              Free
+              <img class="d-block" alt="checkmark" purpose="checkmark" src="/images/icon-checkmark-green-16x16@2x.png" v-if="feature.tier === 'Free'">
+            </div>
+            <div purpose="striped-row" class="d-flex flex-row justify-content-between align-items-center">
+              Premium
+              <img class="d-block" alt="checkmark" purpose="checkmark" src="/images/icon-checkmark-green-16x16@2x.png">
             </div>
           </div>
-          <p style="color: #515774;" class="d-block d-md-none mb-0 w-100">* Coming soon</p>
+        </div>
+        <p style="color: #515774;" class="d-block d-md-none mb-0 w-100">* Coming soon</p>
+        <div purpose="truncated-features-fade"></div>
       </div>
+      <div class="d-flex flex-row justify-content-center"><a :class="[showExpandedTable ? 'expanded' : '']" @click="showExpandedTable = !showExpandedTable" purpose="show-all-features-button">Show all features<span></span></a></div>
     </div>
     <div purpose="features-table" class="d-flex flex-column justify-content-center mx-auto px-0" :class="[[pricingMode === 'Security' ? 'show' : 'hide']]">
-      <div class="d-flex flex-column justify-content-center p-0">
+      <div class="d-flex flex-column p-0" :class="[showExpandedTable ? '' : 'truncated']">
         <%// Desktop features tables %>
         <div class="d-none d-md-block">
           <% for(let category of pricingTableForSecurity) {%>
             <table purpose="pricing-categories-table" class="table">
              <thead>
                 <tr>
-                  <td><h4><%- category.categoryName %></h4></td>
+                  <td><h5><%- category.categoryName %></h5></td>
                   <%if(pricingTableForSecurity.indexOf(category) === 0) {%>
                   <td class="text-center">
                     <strong>Free</strong>
@@ -265,38 +273,115 @@
         </div>
         <%// Mobile features tables %>
         <div purpose="mobile-feature-table-section" class="d-block d-md-none" v-for="category in pricingTableForSecurity">
-          <h4>{{category.categoryName}}</h4>
-            <div purpose="mobile-features-table" class="d-flex flex-column" v-for="feature in category.features">
-              <div purpose="striped-row" class="d-flex flex-row justify-content-between align-items-center">
-                <strong class="d-block">
-                  {{feature.name}}{{feature.comingSoon ? '*' : ''}}
-                </strong>
-                <img class="d-block" purpose="tooltip-icon" src="/images/icon-more-info-14x14@2x.png" alt="More info" @click="clickOpenMobileTooltip(feature)" v-if="feature.description">
-              </div>
-              <div class="d-flex flex-row justify-content-between align-items-center">
-                Free
-                <img class="d-block" alt="checkmark" purpose="checkmark" src="/images/icon-checkmark-green-16x16@2x.png" v-if="feature.tier === 'Free'">
-              </div>
-              <div purpose="striped-row" class="d-flex flex-row justify-content-between align-items-center">
-                Premium
-                <img class="d-block" alt="checkmark" purpose="checkmark" src="/images/icon-checkmark-green-16x16@2x.png">
-              </div>
+          <h5>{{category.categoryName}}</h5>
+          <div purpose="mobile-features-table" class="d-flex flex-column" v-for="feature in category.features">
+            <div purpose="striped-row" class="d-flex flex-row justify-content-between align-items-center">
+              <strong class="d-block">
+                {{feature.name}}{{feature.comingSoon ? '*' : ''}}
+              </strong>
+              <img class="d-block" purpose="tooltip-icon" src="/images/icon-more-info-14x14@2x.png" alt="More info" @click="clickOpenMobileTooltip(feature)" v-if="feature.description">
+            </div>
+            <div class="d-flex flex-row justify-content-between align-items-center">
+              Free
+              <img class="d-block" alt="checkmark" purpose="checkmark" src="/images/icon-checkmark-green-16x16@2x.png" v-if="feature.tier === 'Free'">
+            </div>
+            <div purpose="striped-row" class="d-flex flex-row justify-content-between align-items-center">
+              Premium
+              <img class="d-block" alt="checkmark" purpose="checkmark" src="/images/icon-checkmark-green-16x16@2x.png">
             </div>
           </div>
-          <p style="color: #515774;" class="d-block d-md-none mb-0 w-100">* Coming soon</p>
+        </div>
+        <p style="color: #515774;" class="d-block d-md-none mb-0 w-100">* Coming soon</p>
+        <div purpose="truncated-features-fade"></div>
       </div>
+      <div class="d-flex flex-row justify-content-center"><a :class="[showExpandedTable ? 'expanded' : '']" @click="showExpandedTable = !showExpandedTable" purpose="show-all-features-button">Show all features<span></span></a></div>
     </div>
     <%// Bottom call to action %>
-    <div purpose="bottom-cta" class="d-block mx-auto">
-      <h2 class="text-center">Questions?</h2>
-      <p class="text-center">We have answers to the most <a href="https://fleetdm.com/docs/get-started/faq">commonly asked questions</a>.</p>
-      <div class="d-flex flex-column flex-sm-row flex-nowrap btn-toolbar justify-content-center align-items-center" style="text-align: center" >
-        <a purpose="chat-button" style="max-width: 160px" class="mx-auto justify-self-center btn btn-block btn-md btn-primary mx-sm-2" href="/contact">
-          Talk to us
-        </a>
-        <animated-arrow-button class="btn btn-sm" href="/docs">
-          Read the docs
-        </animated-arrow-button>
+    <div purpose="faq" class="d-flex flex-column flex-md-row justify-content-center">
+      <div purpose="faq-header">
+        <h2>Frequently <br>asked questions</h2>
+      </div>
+      <div purpose="accordion" class="d-flex flex-column justify-content-start">
+        <div purpose="accordion-body">
+          <div purpose="accordion-item" class="mt-md-0">
+            <p purpose="accordion-header" id="accordion__header1" style="cursor: pointer;" class="accordion" data-toggle="collapse" data-target="#accordion__body1" aria-controls="accordion__body1">
+              <%
+              //  ███████╗ █████╗  ██████╗      ██████╗  ██╗
+              //  ██╔════╝██╔══██╗██╔═══██╗    ██╔═══██╗███║
+              //  █████╗  ███████║██║   ██║    ██║   ██║╚██║
+              //  ██╔══╝  ██╔══██║██║▄▄ ██║    ██║▄▄ ██║ ██║
+              //  ██║     ██║  ██║╚██████╔╝    ╚██████╔╝ ██║
+              //  ╚═╝     ╚═╝  ╚═╝ ╚══▀▀═╝      ╚══▀▀═╝  ╚═╝
+              %>
+              Parts of the UI are unfamiliar to us. Is this too far out of my team's comfort zone?
+              <span class="fa fa-angle-down"></span>
+            </p>
+            <p purpose="faq-answer" id="accordion__body1" class="collapse" aria-labelledby="accordion__header1">
+              <%
+              //  ███████╗ █████╗  ██████╗      █████╗  ██╗
+              //  ██╔════╝██╔══██╗██╔═══██╗    ██╔══██╗███║
+              //  █████╗  ███████║██║   ██║    ███████║╚██║
+              //  ██╔══╝  ██╔══██║██║▄▄ ██║    ██╔══██║ ██║
+              //  ██║     ██║  ██║╚██████╔╝    ██║  ██║ ██║
+              //  ╚═╝     ╚═╝  ╚═╝ ╚══▀▀═╝     ╚═╝  ╚═╝ ╚═╝
+              %>
+              You already know how to manage the operating system. In Fleet, you can focus on managing Apple, Windows and Linux; not Intune, Omnissa, and your anxiety.
+            </p>
+          </div>
+          <div purpose="accordion-item">
+            <p purpose="accordion-header" id="accordion__header2" style="cursor: pointer;" class="accordion" data-toggle="collapse" data-target="#accordion__body2" aria-controls="accordion__body2">
+              <%
+              //  ███████╗ █████╗  ██████╗      ██████╗ ██████╗
+              //  ██╔════╝██╔══██╗██╔═══██╗    ██╔═══██╗╚════██╗
+              //  █████╗  ███████║██║   ██║    ██║   ██║ █████╔╝
+              //  ██╔══╝  ██╔══██║██║▄▄ ██║    ██║▄▄ ██║██╔═══╝
+              //  ██║     ██║  ██║╚██████╔╝    ╚██████╔╝███████╗
+              //  ╚═╝     ╚═╝  ╚═╝ ╚══▀▀═╝      ╚══▀▀═╝ ╚══════╝
+              %>
+              Fleet is perfect, it's just missing this one feature...
+              <span class="fa fa-angle-down"></span>
+            </p>
+            <p purpose="faq-answer" id="accordion__body2" class="collapse" aria-labelledby="accordion__header2">
+              <%
+              //  ███████╗ █████╗  ██████╗      █████╗ ██████╗
+              //  ██╔════╝██╔══██╗██╔═══██╗    ██╔══██╗╚════██╗
+              //  █████╗  ███████║██║   ██║    ███████║ █████╔╝
+              //  ██╔══╝  ██╔══██║██║▄▄ ██║    ██╔══██║██╔═══╝
+              //  ██║     ██║  ██║╚██████╔╝    ██║  ██║███████╗
+              //  ╚═╝     ╚═╝  ╚═╝ ╚══▀▀═╝     ╚═╝  ╚═╝╚══════╝
+              %>
+              We're moving pretty fast, and we have every incentive to listen. At Fleet, everyone can contribute. We also regularly deliver customer promises, and all the code is 100% source-available.
+            </p>
+          </div>
+          <div purpose="accordion-item">
+            <p purpose="accordion-header" id="accordion__header3" style="cursor: pointer;" class="accordion" data-toggle="collapse" data-target="#accordion__body3" aria-controls="accordion__body3">
+              <%
+              //  ███████╗ █████╗  ██████╗      ██████╗ ██████╗
+              //  ██╔════╝██╔══██╗██╔═══██╗    ██╔═══██╗╚════██╗
+              //  █████╗  ███████║██║   ██║    ██║   ██║ █████╔╝
+              //  ██╔══╝  ██╔══██║██║▄▄ ██║    ██║▄▄ ██║ ╚═══██╗
+              //  ██║     ██║  ██║╚██████╔╝    ╚██████╔╝██████╔╝
+              //  ╚═╝     ╚═╝  ╚═╝ ╚══▀▀═╝      ╚══▀▀═╝ ╚═════╝
+              %>
+              What actually is Fleet? Was it purpose built for this kind of thing?
+              <span class="fa fa-angle-down"></span>
+            </p>
+            <p purpose="faq-answer" id="accordion__body3" class="collapse" aria-labelledby="accordion__header3">
+              <%
+              //  ███████╗ █████╗  ██████╗      █████╗ ██████╗
+              //  ██╔════╝██╔══██╗██╔═══██╗    ██╔══██╗╚════██╗
+              //  █████╗  ███████║██║   ██║    ███████║ █████╔╝
+              //  ██╔══╝  ██╔══██║██║▄▄ ██║    ██╔══██║ ╚═══██╗
+              //  ██║     ██║  ██║╚██████╔╝    ██║  ██║██████╔╝
+              //  ╚═╝     ╚═╝  ╚═╝ ╚══▀▀═╝     ╚═╝  ╚═╝╚═════╝
+              %>
+              Fleet <a href="https://fleetdm.com/handbook/company#history">started as an osquery management server</a>. After 10 years of production osquery use at scale in huge organizations, Fleet added "write" and "execute" device management capabilities, with all the necessary integrations to be comparable with other device management platforms like Omnissa (fka WS1, fka Airwatch), Jamf, Intune, and more. Today, Fleet is actively used as the next-gen MDM in homelabs all over the world, and at larger fleets at Epic Games, Cisco, Stripe, Fastly, Lear, and more.
+            </p>
+          </div>
+        </div>
+        <div class="d-flex flex-row justify-content-start">
+          <p purpose="contact-note">Couldn’t find an answer? <a href="/contact">Talk to us</a>.</p>
+        </div>
       </div>
     </div>
   </div>
diff --git a/website/views/pages/start.ejs b/website/views/pages/start.ejs
index ff17641aba..d012d01748 100644
--- a/website/views/pages/start.ejs
+++ b/website/views/pages/start.ejs
@@ -1,555 +1,664 @@
 <div id="start" v-cloak>
-  <div class="d-flex container" purpose="page-container">
+  <div class="d-flex container d-flex flex-row" purpose="page-container">
     <div purpose="form-container">
-    <%//  ┌─┐┌┬┐┌─┐┬─┐┌┬┐
-      //  └─┐ │ ├─┤├┬┘ │
-      //  └─┘ ┴ ┴ ┴┴└─ ┴ %>
-    <div v-if="currentStep === 'start'">
-      <div class=" mx-auto">
-        <h2>Let’s get started</h2>
-        <p>To see whether Fleet’s right for your team, let's have a look at your hosts and what you're trying to do.</p>
-        <p>You can come back at any time and pick up where you left off.</p>
-        <ajax-form :handle-submitting="handleSubmittingForm" :form-errors.sync="formErrors" :form-data="formData['start']" :form-rules="formRules" :syncing.sync="syncing" :cloud-error.sync="cloudError">
-        <div purpose="form-buttons">
-          <ajax-button type="submit" purpose="submit-button" class="btn btn-primary" :syncing="syncing">Start</ajax-button>
+      <%//  ┌─┐┌┬┐┌─┐┬─┐┌┬┐
+        //  └─┐ │ ├─┤├┬┘ │
+        //  └─┘ ┴ ┴ ┴┴└─ ┴ %>
+      <div v-if="currentStep === 'start'">
+        <div class=" mx-auto">
+          <h2>What to expect</h2>
+          <p>Fleet is a little different from some of the other MDMs you might have used.</p>
+          <ul>
+            <li>You can deploy it yourself at any time and it’s 100% source available.</li>
+            <li>You don’t have to talk to us first, but you can if you want to. We hang out <a href="/support">over here</a>.</li>
+            <li>Fleet customers get unlimited support, migration assistance, and even a private Slack support channel.</li>
+          </ul>
+          <ajax-form :handle-submitting="handleSubmittingForm" :form-errors.sync="formErrors" :form-data="formData['start']" :form-rules="formRules" :syncing.sync="syncing" :cloud-error.sync="cloudError">
+          <div purpose="form-buttons">
+            <ajax-button type="submit" purpose="submit-button" class="btn btn-primary" :syncing="syncing">Continue</ajax-button>
+          </div>
+          </ajax-form>
+          <div purpose="form-tip" class="d-flex flex-row align-items-center justify-content-start">
+            <div><img alt="A lightbulb" src="/images/icon-suggestion-64x64@2x.png"></div>
+            <div>
+            <p>If you’d like to chat with other customers about their experience with Fleet, just let us know.</p>
+            </div>
+          </div>
         </div>
+      </div>
+      <%//  ┬ ┬┬ ┬┌─┐┌┬┐  ┌─┐┬─┐┌─┐  ┬ ┬┌─┐┬ ┬  ┬ ┬┌─┐┬┌┐┌┌─┐  ┌─┐┬  ┌─┐┌─┐┌┬┐  ┌─┐┌─┐┬─┐
+        //  │││├─┤├─┤ │   ├─┤├┬┘├┤   └┬┘│ ││ │  │ │└─┐│││││ ┬  ├┤ │  ├┤ ├┤  │   ├┤ │ │├┬┘
+        //  └┴┘┴ ┴┴ ┴ ┴   ┴ ┴┴└─└─┘   ┴ └─┘└─┘  └─┘└─┘┴┘└┘└─┘  └  ┴─┘└─┘└─┘ ┴   └  └─┘┴└─%>
+      <div v-if="currentStep === 'what-are-you-using-fleet-for'">
+        <div purpose="progress-bar-container">
+          <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 10%"></div></div>
+          <img purpose="success-icon" alt="🚀" src="/images/icon-form-success-16x16@2x.png">
+        </div>
+        <h2>What will you use Fleet for?</h2>
+        <ajax-form :handle-submitting="handleSubmittingForm" :form-errors.sync="formErrors" :form-data="formData['what-are-you-using-fleet-for']" :form-rules="primaryBuyingSituationFormRules" :syncing.sync="syncing" :cloud-error.sync="cloudError">
+          <div class="form-group" :class="[formErrors.primaryBuyingSituation ? 'is-invalid' : '']" >
+            <label purpose="form-option" class="form-control" :class="[formData['what-are-you-using-fleet-for'].primaryBuyingSituation === 'mdm' ? 'selected' : '']">
+              <input type="radio" :class="[formErrors.primaryBuyingSituation ? 'is-invalid' : '']" v-model.trim="formData['what-are-you-using-fleet-for'].primaryBuyingSituation" value="mdm" @input="clickClearOneFormError('primaryBuyingSituation')">
+              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+              Device management (MDM)
+            </label>
+            <label purpose="form-option" class="form-control" :class="[formData['what-are-you-using-fleet-for'].primaryBuyingSituation === 'eo-security' ? 'selected' : '']">
+              <input type="radio" v-model.trim="formData['what-are-you-using-fleet-for'].primaryBuyingSituation" value="eo-security" @input="clickClearOneFormError('primaryBuyingSituation')">
+              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+              Security engineering
+            </label>
+            <label purpose="form-option" class="form-control" :class="[formData['what-are-you-using-fleet-for'].primaryBuyingSituation === 'eo-it' ? 'selected' : '']">
+              <input type="radio" :class="[formErrors.primaryBuyingSituation ? 'is-invalid' : '']" v-model.trim="formData['what-are-you-using-fleet-for'].primaryBuyingSituation" value="eo-it" @input="clickClearOneFormError('primaryBuyingSituation')">
+              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+              IT engineering
+            </label>
+  <!--           <label purpose="form-option" class="form-control" :class="[formData['what-are-you-using-fleet-for'].primaryBuyingSituation === 'vm' ? 'selected' : '']">
+              <input type="radio" :class="[formErrors.primaryBuyingSituation ? 'is-invalid' : '']" v-model.trim="formData['what-are-you-using-fleet-for'].primaryBuyingSituation" value="vm" @input="clickClearOneFormError('primaryBuyingSituation')">
+              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+              Vulnerability management
+            </label> -->
+            <div class="invalid-feedback" v-if="formErrors.primaryBuyingSituation">Please select an option</div>
+          </div>
+          <cloud-error v-if="cloudError"></cloud-error>
+          <div purpose="form-buttons">
+            <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
+            <ajax-button type="submit" purpose="submit-button" class="btn btn-primary" :syncing="syncing">Continue</ajax-button>
+          </div>
         </ajax-form>
       </div>
-    </div>
-    <%//  ┬ ┬┬ ┬┌─┐┌┬┐  ┌─┐┬─┐┌─┐  ┬ ┬┌─┐┬ ┬  ┬ ┬┌─┐┬┌┐┌┌─┐  ┌─┐┬  ┌─┐┌─┐┌┬┐  ┌─┐┌─┐┬─┐
-      //  │││├─┤├─┤ │   ├─┤├┬┘├┤   └┬┘│ ││ │  │ │└─┐│││││ ┬  ├┤ │  ├┤ ├┤  │   ├┤ │ │├┬┘
-      //  └┴┘┴ ┴┴ ┴ ┴   ┴ ┴┴└─└─┘   ┴ └─┘└─┘  └─┘└─┘┴┘└┘└─┘  └  ┴─┘└─┘└─┘ ┴   └  └─┘┴└─%>
-    <div v-if="currentStep === 'what-are-you-using-fleet-for'">
-      <div purpose="progress-bar-container">
-        <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 10%"></div></div>
-        <img purpose="success-icon" alt="🏆" src="/images/icon-form-success-12x12@2x.png">
-      </div>
-      <h2>What will you use Fleet for?</h2>
-      <ajax-form :handle-submitting="handleSubmittingForm" :form-errors.sync="formErrors" :form-data="formData['what-are-you-using-fleet-for']" :form-rules="primaryBuyingSituationFormRules" :syncing.sync="syncing" :cloud-error.sync="cloudError">
-        <div class="form-group" :class="[formErrors.primaryBuyingSituation ? 'is-invalid' : '']" >
-          <label purpose="form-option" class="form-control" :class="[formData['what-are-you-using-fleet-for'].primaryBuyingSituation === 'mdm' ? 'selected' : '']">
-            <input type="radio" :class="[formErrors.primaryBuyingSituation ? 'is-invalid' : '']" v-model.trim="formData['what-are-you-using-fleet-for'].primaryBuyingSituation" value="mdm" @input="clickClearOneFormError('primaryBuyingSituation')">
-            <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-            Device management (MDM)
-          </label>
-          <label purpose="form-option" class="form-control" :class="[formData['what-are-you-using-fleet-for'].primaryBuyingSituation === 'eo-security' ? 'selected' : '']">
-            <input type="radio" v-model.trim="formData['what-are-you-using-fleet-for'].primaryBuyingSituation" value="eo-security" @input="clickClearOneFormError('primaryBuyingSituation')">
-            <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-            Security engineering
-          </label>
-          <label purpose="form-option" class="form-control" :class="[formData['what-are-you-using-fleet-for'].primaryBuyingSituation === 'eo-it' ? 'selected' : '']">
-            <input type="radio" :class="[formErrors.primaryBuyingSituation ? 'is-invalid' : '']" v-model.trim="formData['what-are-you-using-fleet-for'].primaryBuyingSituation" value="eo-it" @input="clickClearOneFormError('primaryBuyingSituation')">
-            <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-            IT engineering
-          </label>
-<!--           <label purpose="form-option" class="form-control" :class="[formData['what-are-you-using-fleet-for'].primaryBuyingSituation === 'vm' ? 'selected' : '']">
-            <input type="radio" :class="[formErrors.primaryBuyingSituation ? 'is-invalid' : '']" v-model.trim="formData['what-are-you-using-fleet-for'].primaryBuyingSituation" value="vm" @input="clickClearOneFormError('primaryBuyingSituation')">
-            <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-            Vulnerability management
-          </label> -->
-          <div class="invalid-feedback" v-if="formErrors.primaryBuyingSituation">Please select an option</div>
-        </div>
-        <cloud-error v-if="cloudError"></cloud-error>
-        <div purpose="form-buttons">
-          <ajax-button type="submit" purpose="submit-button" class="btn btn-primary" :syncing="syncing">Continue</ajax-button>
-        </div>
-      </ajax-form>
-    </div>
-    <%//  ┬ ┬┌─┐┬  ┬┌─┐  ┬ ┬┌─┐┬ ┬  ┌─┐┬  ┬┌─┐┬─┐  ┬ ┬┌─┐┌─┐┌┬┐  ┌─┐┬  ┌─┐┌─┐┌┬┐
-      //  ├─┤├─┤└┐┌┘├┤   └┬┘│ ││ │  ├┤ └┐┌┘├┤ ├┬┘  │ │└─┐├┤  ││  ├┤ │  ├┤ ├┤  │
-      //  ┴ ┴┴ ┴ └┘ └─┘   ┴ └─┘└─┘  └─┘ └┘ └─┘┴└─  └─┘└─┘└─┘─┴┘  └  ┴─┘└─┘└─┘ ┴ %>
-    <div v-if="currentStep === 'have-you-ever-used-fleet'">
-      <div purpose="progress-bar-container">
-        <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 30%"></div></div>
-        <img purpose="success-icon" alt="🏆" src="/images/icon-form-success-12x12@2x.png">
-      </div>
-      <h2>Have you ever used Fleet?</h2>
-      <ajax-form :handle-submitting="handleSubmittingForm" :form-errors.sync="formErrors" :form-data="formData['have-you-ever-used-fleet']" :form-rules="isUsingFleetFormRules" :syncing.sync="syncing" :cloud-error.sync="cloudError">
-
-          <div class="form-group" :class="[formErrors.fleetUseStatus ? 'is-invalid' : '']">
-            <label purpose="form-option" class="form-control" :class="[formData['have-you-ever-used-fleet'].fleetUseStatus === 'yes-deployed' ? 'selected' : '']">
-              <input type="radio"  v-model.trim="formData['have-you-ever-used-fleet'].fleetUseStatus" value="yes-deployed" @input="clickClearOneFormError('fleetUseStatus')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              Yes, we actively use Fleet at work today
-            </label>
-            <label purpose="form-option" class="form-control" :class="[formData['have-you-ever-used-fleet'].fleetUseStatus === 'yes-recently-deployed' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['have-you-ever-used-fleet'].fleetUseStatus" value="yes-recently-deployed" @input="clickClearOneFormError('fleetUseStatus')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              Yes, we deployed Fleet at work recently to try it out
-            </label>
-            <label purpose="form-option" class="form-control" :class="[formData['have-you-ever-used-fleet'].fleetUseStatus === 'yes-deployed-local' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['have-you-ever-used-fleet'].fleetUseStatus" value="yes-deployed-local" @input="clickClearOneFormError('fleetUseStatus')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              Yes, but only in a local / homelab environment
-            </label>
-            <label purpose="form-option" class="form-control" :class="[formData['have-you-ever-used-fleet'].fleetUseStatus === 'yes-deployed-long-time' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['have-you-ever-used-fleet'].fleetUseStatus" value="yes-deployed-long-time" @input="clickClearOneFormError('fleetUseStatus')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              Yes, but it's been a long time
-            </label>
-            <label purpose="form-option" class="form-control" :class="[formData['have-you-ever-used-fleet'].fleetUseStatus === 'no' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['have-you-ever-used-fleet'].fleetUseStatus" value="no" @input="clickClearOneFormError('fleetUseStatus')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              No, not yet
-            </label>
-            <div class="invalid-feedback" v-if="formErrors.fleetUseStatus">Please select an option</div>
-          </div>
-        <cloud-error v-if="cloudError"></cloud-error>
-        <div purpose="form-buttons">
-          <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
-          <ajax-button type="submit" purpose="submit-button" class="btn btn-primary" :syncing="syncing">Continue</ajax-button>
-        </div>
-      </ajax-form>
-    </div>
-    <%//  ┬ ┬┌─┐┬ ┬  ┌┬┐┌─┐┌┐┌┬ ┬  ┬ ┬┌─┐┌─┐┌┬┐┌─┐
-      //  ├─┤│ ││││  │││├─┤│││└┬┘  ├─┤│ │└─┐ │ └─┐
-      //  ┴ ┴└─┘└┴┘  ┴ ┴┴ ┴┘└┘ ┴   ┴ ┴└─┘└─┘ ┴ └─┘%>
-    <div v-if="currentStep === 'how-many-hosts'">
-      <div purpose="progress-bar-container">
-        <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 70%"></div></div>
-        <img purpose="success-icon" alt="🏆" src="/images/icon-form-success-12x12@2x.png">
-      </div>
-      <div purpose="form-header">
-        <h2>About how many hosts do you have?</h2>
-        <p v-if="formData['what-are-you-using-fleet-for'].primaryBuyingSituation === 'eo-security'">Including servers, containers, workstations, and other hosts.</p>
-        <p v-else-if="formData['what-are-you-using-fleet-for'].primaryBuyingSituation === 'eo-it'">Including macOS, Windows, Linux workstations, Chromebooks, servers, and other hosts.</p>
-        <p v-else-if="formData['what-are-you-using-fleet-for'].primaryBuyingSituation === 'vm'">Including computers, servers, OT/ICS, containers, and other hosts.</p>
-      </div>
-      <ajax-form :handle-submitting="handleSubmittingForm" :form-errors.sync="formErrors" :form-data="formData['how-many-hosts']" :form-rules="numberOfHostsFormRules" :syncing.sync="syncing" :cloud-error.sync="cloudError">
-        <div class="form-group">
-
-          <div class="form-group" :class="[formErrors.numberOfHosts ? 'is-invalid' : '']">
-            <label purpose="form-option" class="form-control" :class="[formData['how-many-hosts'].numberOfHosts === '1-100' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['how-many-hosts'].numberOfHosts" value="1-100" @input="clickClearOneFormError('numberOfHosts')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              1 to 100
-            </label>
-            <label purpose="form-option" class="form-control" :class="[formData['how-many-hosts'].numberOfHosts === '100-700' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['how-many-hosts'].numberOfHosts" value="100-700" @input="clickClearOneFormError('numberOfHosts')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              100 to 700
-            </label>
-            <label purpose="form-option" class="form-control" :class="[formData['how-many-hosts'].numberOfHosts === '700-10000' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['how-many-hosts'].numberOfHosts" value="700-10000" @input="clickClearOneFormError('numberOfHosts')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              700 to 10,000
-            </label>
-            <label purpose="form-option" class="form-control" :class="[formData['how-many-hosts'].numberOfHosts === '10000+' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['how-many-hosts'].numberOfHosts" value="10000+" @input="clickClearOneFormError('numberOfHosts')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              More than 10,000
-            </label>
-            <div class="invalid-feedback" v-if="formErrors.numberOfHosts">Please select an option</div>
-          </div>
-        </div>
-        <cloud-error v-if="cloudError"></cloud-error>
-        <div purpose="form-buttons">
-          <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
-          <ajax-button type="submit" purpose="submit-button" class="btn btn-primary" :syncing="syncing">Continue</ajax-button>
-        </div>
-      </ajax-form>
-    </div>
-    <%//  ┬ ┬┬┬  ┬    ┬ ┬┌─┐┬ ┬  ┌┐ ┌─┐  ┌─┐┌─┐┬  ┌─┐  ┬ ┬┌─┐┌─┐┌┬┐┬┌┐┌┌─┐
-      //  │││││  │    └┬┘│ ││ │  ├┴┐├┤   └─┐├┤ │  ├┤   ├─┤│ │└─┐ │ │││││ ┬
-      //  └┴┘┴┴─┘┴─┘   ┴ └─┘└─┘  └─┘└─┘  └─┘└─┘┴─┘└    ┴ ┴└─┘└─┘ ┴ ┴┘└┘└─┘%>
-    <div v-if="currentStep === 'will-you-be-self-hosting'">
-      <div purpose="progress-bar-container">
-        <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 90%"></div></div>
-        <img purpose="success-icon" alt="🏆" src="/images/icon-form-success-12x12@2x.png">
-      </div>
-      <h2>Will you be hosting Fleet yourself?</h2>
-      <ajax-form :handle-submitting="handleSubmittingForm" :form-errors.sync="formErrors" :form-data="formData['will-you-be-self-hosting']" :form-rules="hostingFleetFormRules" :syncing.sync="syncing" :cloud-error.sync="cloudError">
-
-          <div class="form-group" :class="[formErrors.willSelfHost ? 'is-invalid' : '']" >
-            <label purpose="form-option" class="form-control" :class="[formData['will-you-be-self-hosting'].willSelfHost === 'true' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['will-you-be-self-hosting'].willSelfHost" value="true" @input="clickClearOneFormError('willSelfHost')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              Yes, self hosted
-            </label>
-            <label purpose="form-option" class="form-control" :class="[formData['will-you-be-self-hosting'].willSelfHost === 'false' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['will-you-be-self-hosting'].willSelfHost" value="false" @input="clickClearOneFormError('willSelfHost')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              I'd prefer not to
-            </label>
-            <div class="invalid-feedback" v-if="formErrors.willSelfHost">Please select an option</div>
-          </div>
-        <cloud-error v-if="cloudError"></cloud-error>
-        <div purpose="form-buttons">
-          <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
-          <ajax-button type="submit" purpose="submit-button" class="btn btn-primary" :syncing="syncing">Continue</ajax-button>
-        </div>
-      </ajax-form>
-    </div>
-    <%//  ┬ ┬┬ ┬┌─┐┌┬┐  ┌─┐┬─┐┌─┐  ┬ ┬┌─┐┬ ┬  ┬ ┬┌─┐┬─┐┬┌─┬┌┐┌┌─┐  ┌─┐┌┐┌
-      //  │││├─┤├─┤ │   ├─┤├┬┘├┤   └┬┘│ ││ │  ││││ │├┬┘├┴┐│││││ ┬  │ ││││  ───
-      //  └┴┘┴ ┴┴ ┴ ┴   ┴ ┴┴└─└─┘   ┴ └─┘└─┘  └┴┘└─┘┴└─┴ ┴┴┘└┘└─┘  └─┘┘└┘
-      //  ┌─┐┌─┐   ┌─┐┌─┐┌─┐┬ ┬┬─┐┬┌┬┐┬ ┬
-      //  ├┤ │ │───└─┐├┤ │  │ │├┬┘│ │ └┬┘
-      //  └─┘└─┘   └─┘└─┘└─┘└─┘┴└─┴ ┴  ┴%>
-    <div v-if="currentStep === 'what-are-you-working-on-eo-security'">
-      <div purpose="progress-bar-container">
-        <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 40%"></div></div>
-        <img purpose="success-icon" alt="🏆" src="/images/icon-form-success-12x12@2x.png">
-      </div>
-      <h2>What are you working on, mainly?</h2>
-      <ajax-form :handle-submitting="handleSubmittingForm" :form-errors.sync="formErrors" :form-data="formData['what-are-you-working-on-eo-security']" :form-rules="endpointOpsSecurityWorkingOnFormRules" :syncing.sync="syncing" :cloud-error.sync="cloudError">
-        <div class="form-group">
-
-          <div class="form-group" :class="[formErrors.endpointOpsSecurityUseCase ? 'is-invalid' : '']">
-            <label purpose="form-option" class="form-control" :class="[formData['what-are-you-working-on-eo-security'].endpointOpsSecurityUseCase === 'detection-and-response' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['what-are-you-working-on-eo-security'].endpointOpsSecurityUseCase" value="detection-and-response" @input="clickClearOneFormError('endpointOpsSecurityUseCase')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              Detection and response
-            </label>
-            <label purpose="form-option" class="form-control" :class="[formData['what-are-you-working-on-eo-security'].endpointOpsSecurityUseCase === 'production-infrastructure-security' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['what-are-you-working-on-eo-security'].endpointOpsSecurityUseCase" value="production-infrastructure-security" @input="clickClearOneFormError('endpointOpsSecurityUseCase')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              Production infrastructure / security
-            </label>
-            <label purpose="form-option" class="form-control" :class="[formData['what-are-you-working-on-eo-security'].endpointOpsSecurityUseCase === 'identity-and-access-management-endpoint-security' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['what-are-you-working-on-eo-security'].endpointOpsSecurityUseCase" value="identity-and-access-management-endpoint-security" @input="clickClearOneFormError('endpointOpsSecurityUseCase')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              Identity and access management (IAM) / endpoint security
-            </label>
-            <label purpose="form-option" class="form-control" :class="[formData['what-are-you-working-on-eo-security'].endpointOpsSecurityUseCase === 'cyber-threat-intelligence' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['what-are-you-working-on-eo-security'].endpointOpsSecurityUseCase" value="cyber-threat-intelligence" @input="clickClearOneFormError('endpointOpsSecurityUseCase')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              Cyber-threat intelligence (CTI)
-            </label>
-            <label purpose="form-option" class="form-control" :class="[formData['what-are-you-working-on-eo-security'].endpointOpsSecurityUseCase === 'risk-grc' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['what-are-you-working-on-eo-security'].endpointOpsSecurityUseCase" value="risk-grc" @input="clickClearOneFormError('endpointOpsSecurityUseCase')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              Risk (GRC)
-            </label>
-            <label purpose="form-option" class="form-control" :class="[formData['what-are-you-working-on-eo-security'].endpointOpsSecurityUseCase === 'ot-ics-iot-security' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['what-are-you-working-on-eo-security'].endpointOpsSecurityUseCase" value="ot-ics-iot-security" @input="clickClearOneFormError('endpointOpsSecurityUseCase')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              OT / ICS / IoT security
-            </label>
-            <div class="invalid-feedback" v-if="formErrors.endpointOpsSecurityUseCase">Please select an option</div>
-          </div>
-        </div>
-        <cloud-error v-if="cloudError"></cloud-error>
-        <div purpose="form-buttons">
-          <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
-          <ajax-button type="submit" purpose="submit-button" class="btn btn-primary" :syncing="syncing">Continue</ajax-button>
-        </div>
-      </ajax-form>
-    </div>
-    <%//  ┬ ┬┬ ┬┌─┐┌┬┐  ┌┬┐┌─┐┌─┐┌─┐  ┬ ┬┌─┐┬ ┬┬─┐  ┌┬┐┌─┐┌─┐┌┬┐  ┌┬┐┌─┐┌┐┌┌─┐┌─┐┌─┐
-      //  │││├─┤├─┤ │    │││ │├┤ └─┐  └┬┘│ ││ │├┬┘   │ ├┤ ├─┤│││  │││├─┤│││├─┤│ ┬├┤
-      //  └┴┘┴ ┴┴ ┴ ┴   ─┴┘└─┘└─┘└─┘   ┴ └─┘└─┘┴└─   ┴ └─┘┴ ┴┴ ┴  ┴ ┴┴ ┴┘└┘┴ ┴└─┘└─┘
-      //  ┌─┐┌─┐   ┬┌┬┐
-      //  ├┤ │ │───│ │
-      //  └─┘└─┘   ┴ ┴%>
-    <div v-if="currentStep === 'what-does-your-team-manage-eo-it'">
-      <div purpose="progress-bar-container">
-        <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 40%"></div></div>
-        <img purpose="success-icon" alt="🏆" src="/images/icon-form-success-12x12@2x.png">
-      </div>
-      <h2>What does your team manage?</h2>
-      <ajax-form :handle-submitting="handleSubmittingForm" :form-errors.sync="formErrors" :form-data="formData['what-does-your-team-manage-eo-it']" :form-rules="endpointOpsItUseCaseFormRules" :syncing.sync="syncing" :cloud-error.sync="cloudError">
-        <div class="form-group">
-
-          <div class="form-group" :class="[formErrors.endpointOpsItUseCase ? 'is-invalid' : '']">
-            <label purpose="form-option" class="form-control" :class="[formData['what-does-your-team-manage-eo-it'].endpointOpsItUseCase === 'employee-workstations' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['what-does-your-team-manage-eo-it'].endpointOpsItUseCase" value="employee-workstations" @input="clickClearOneFormError('endpointOpsItUseCase')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              Employee workstations
-            </label>
-            <label purpose="form-option" class="form-control" :class="[formData['what-does-your-team-manage-eo-it'].endpointOpsItUseCase === 'just-macos' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['what-does-your-team-manage-eo-it'].endpointOpsItUseCase" value="just-macos" @input="clickClearOneFormError('endpointOpsItUseCase')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              Just macOS
-            </label>
-            <label purpose="form-option" class="form-control" :class="[formData['what-does-your-team-manage-eo-it'].endpointOpsItUseCase === 'production-infrastructure' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['what-does-your-team-manage-eo-it'].endpointOpsItUseCase" value="production-infrastructure" @input="clickClearOneFormError('endpointOpsItUseCase')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              Production infrastructure
-            </label>
-            <label purpose="form-option" class="form-control" :class="[formData['what-does-your-team-manage-eo-it'].endpointOpsItUseCase === 'everything' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['what-does-your-team-manage-eo-it'].endpointOpsItUseCase" value="everything" @input="clickClearOneFormError('endpointOpsItUseCase')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              Everything
-            </label>
-            <div class="invalid-feedback" v-if="formErrors.endpointOpsItUseCase">Please select an option</div>
-          </div>
-        </div>
-        <cloud-error v-if="cloudError"></cloud-error>
-        <div purpose="form-buttons">
-          <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
-          <ajax-button type="submit" purpose="submit-button" class="btn btn-primary" :syncing="syncing">Continue</ajax-button>
-        </div>
-      </ajax-form>
-    </div>
-    <%//  ┬ ┬┬ ┬┌─┐┌┬┐  ┌┬┐┌─┐┌─┐┌─┐  ┬ ┬┌─┐┬ ┬┬─┐  ┌┬┐┌─┐┌─┐┌┬┐  ┌┬┐┌─┐┌┐┌┌─┐┌─┐┌─┐
-      //  │││├─┤├─┤ │    │││ │├┤ └─┐  └┬┘│ ││ │├┬┘   │ ├┤ ├─┤│││  │││├─┤│││├─┤│ ┬├┤
-      //  └┴┘┴ ┴┴ ┴ ┴   ─┴┘└─┘└─┘└─┘   ┴ └─┘└─┘┴└─   ┴ └─┘┴ ┴┴ ┴  ┴ ┴┴ ┴┘└┘┴ ┴└─┘└─┘
-      //  ┬  ┬┌┬┐
-      //  └┐┌┘│││
-      //   └┘ ┴ ┴%>
-    <div v-if="currentStep === 'what-does-your-team-manage-vm'">
-      <div purpose="progress-bar-container">
-        <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 40%"></div></div>
-        <img purpose="success-icon" alt="🏆" src="/images/icon-form-success-12x12@2x.png">
-      </div>
-      <h2>What does your team manage?</h2>
-      <ajax-form :handle-submitting="handleSubmittingForm" :form-errors.sync="formErrors" :form-data="formData['what-does-your-team-manage-vm']" :form-rules="vmUseCaseFormRules" :syncing.sync="syncing" :cloud-error.sync="cloudError">
-        <div class="form-group">
-
-          <div class="form-group" :class="[formErrors.vmUseCase ? 'is-invalid' : '']">
-            <label purpose="form-option" class="form-control" :class="[formData['what-does-your-team-manage-vm'].vmUseCase === 'ot-ics-iot-security' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['what-does-your-team-manage-vm'].vmUseCase" value="ot-ics-iot-security" @input="clickClearOneFormError('vmUseCase')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              OT / ICS / IoT security
-            </label>
-            <label purpose="form-option" class="form-control" :class="[formData['what-does-your-team-manage-vm'].vmUseCase === 'compliance-grc' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['what-does-your-team-manage-vm'].vmUseCase" value="compliance-grc" @input="clickClearOneFormError('vmUseCase')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              Compliance (GRC)
-            </label>
-            <label purpose="form-option" class="form-control" :class="[formData['what-does-your-team-manage-vm'].vmUseCase === 'cyber-threat-intelligence-security-research' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['what-does-your-team-manage-vm'].vmUseCase" value="cyber-threat-intelligence-security-research" @input="clickClearOneFormError('vmUseCase')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              Cyber-threat intelligence (CTI) / security research
-            </label>
-            <label purpose="form-option" class="form-control" :class="[formData['what-does-your-team-manage-vm'].vmUseCase === 'infrastructure-security' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['what-does-your-team-manage-vm'].vmUseCase" value="infrastructure-security" @input="clickClearOneFormError('vmUseCase')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              Infrastructure security
-            </label>
-            <label purpose="form-option" class="form-control" :class="[formData['what-does-your-team-manage-vm'].vmUseCase === 'everything' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['what-does-your-team-manage-vm'].vmUseCase" value="everything" @input="clickClearOneFormError('vmUseCase')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              Everything
-            </label>
-            <div class="invalid-feedback" v-if="formErrors.vmUseCase">Please select an option</div>
-          </div>
-        </div>
-        <cloud-error v-if="cloudError"></cloud-error>
-        <div purpose="form-buttons">
-          <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
-          <ajax-button type="submit" purpose="submit-button" class="btn btn-primary" :syncing="syncing">Continue</ajax-button>
-        </div>
-      </ajax-form>
-    </div>
-    <%//  ┬ ┬┬ ┬┌─┐┌┬┐  ┌┬┐┌─┐  ┬ ┬┌─┐┬ ┬ ┌┬┐┌─┐┌┐┌┌─┐┌─┐┌─┐
-      //  │││├─┤├─┤ │    │││ │  └┬┘│ ││ │ │││├─┤│││├─┤│ ┬├┤
-      //  └┴┘┴ ┴┴ ┴ ┴   ─┴┘└─┘   ┴ └─┘└─┘ ┴ ┴┴ ┴┘└┘┴ ┴└─┘└─┘
-      //  ┌┬┐┌┬┐┌┬┐
-      //  │││ │││││
-      //  ┴ ┴─┴┘┴ ┴%>
-    <div v-if="currentStep === 'what-do-you-manage-mdm'">
-      <div purpose="progress-bar-container">
-        <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 40%"></div></div>
-        <img purpose="success-icon" alt="🏆" src="/images/icon-form-success-12x12@2x.png">
-      </div>
-      <h2>What do you manage?</h2>
-      <ajax-form :handle-submitting="handleSubmittingForm" :form-errors.sync="formErrors" :form-data="formData['what-do-you-manage-mdm']" :form-rules="mdmUseCaseFormRules" :syncing.sync="syncing" :cloud-error.sync="cloudError">
-        <div class="form-group">
-
-          <div class="form-group" :class="[formErrors.mdmUseCase ? 'is-invalid' : '']">
-            <label purpose="form-option" class="form-control" :class="[formData['what-do-you-manage-mdm'].mdmUseCase === 'mostly-macs' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['what-do-you-manage-mdm'].mdmUseCase" value="mostly-macs" @input="clickClearOneFormError('mdmUseCase')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              Mostly Macs
-            </label>
-            <label purpose="form-option" class="form-control" :class="[formData['what-do-you-manage-mdm'].mdmUseCase === 'mostly-windows' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['what-do-you-manage-mdm'].mdmUseCase" value="mostly-windows" @input="clickClearOneFormError('mdmUseCase')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              Mostly Windows
-            </label>
-            <label purpose="form-option" class="form-control" :class="[formData['what-do-you-manage-mdm'].mdmUseCase === 'about-half-and-half' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['what-do-you-manage-mdm'].mdmUseCase" value="about-half-and-half" @input="clickClearOneFormError('mdmUseCase')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              About half and half
-            </label>
-            <label purpose="form-option" class="form-control" :class="[formData['what-do-you-manage-mdm'].mdmUseCase === 'no-use-case-yet' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['what-do-you-manage-mdm'].mdmUseCase" value="no-use-case-yet" @input="clickClearOneFormError('mdmUseCase')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              I'm just curious
-            </label>
-            <div class="invalid-feedback" v-if="formErrors.mdmUseCase">Please select an option</div>
-          </div>
-        </div>
-        <cloud-error v-if="cloudError"></cloud-error>
-        <div purpose="form-buttons">
-          <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
-          <ajax-button type="submit" purpose="submit-button" class="btn btn-primary" :syncing="syncing">Continue</ajax-button>
-        </div>
-      </ajax-form>
-    </div>
-    <%//  ┬┌─┐  ┬┌┬┐  ┌─┐┌┐┌┬ ┬  ┌─┐┌─┐┌─┐┌┬┐
-      //  │└─┐  │ │   ├─┤│││└┬┘  │ ┬│ ││ │ ││
-      //  ┴└─┘  ┴ ┴   ┴ ┴┘└┘ ┴   └─┘└─┘└─┘─┴┘%>
-    <div v-if="currentStep === 'is-it-any-good'">
-      <ajax-form :handle-submitting="handleSubmittingForm" :form-errors.sync="formErrors" :form-data="formData['is-it-any-good']" :form-rules="formRules" :syncing.sync="syncing" :cloud-error.sync="cloudError">
+      <%//  ┬ ┬┌─┐┬  ┬┌─┐  ┬ ┬┌─┐┬ ┬  ┌─┐┬  ┬┌─┐┬─┐  ┬ ┬┌─┐┌─┐┌┬┐  ┌─┐┬  ┌─┐┌─┐┌┬┐
+        //  ├─┤├─┤└┐┌┘├┤   └┬┘│ ││ │  ├┤ └┐┌┘├┤ ├┬┘  │ │└─┐├┤  ││  ├┤ │  ├┤ ├┤  │
+        //  ┴ ┴┴ ┴ └┘ └─┘   ┴ └─┘└─┘  └─┘ └┘ └─┘┴└─  └─┘└─┘└─┘─┴┘  └  ┴─┘└─┘└─┘ ┴ %>
+      <div v-if="currentStep === 'have-you-ever-used-fleet'">
         <div purpose="progress-bar-container">
-          <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 50%"></div></div>
-          <img purpose="success-icon" alt="🏆" src="/images/icon-form-success-12x12@2x.png">
+          <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 30%"></div></div>
+          <img purpose="success-icon" alt="🚀" src="/images/icon-form-success-16x16@2x.png">
         </div>
-        <h2>Is it any good?</h2>
-        <div purpose="form-header" class="mx-auto">
-          <p class="">We don’t have a public sample environment, but you can try Fleet out locally on your computer.</p>
+        <h2>Have you ever used Fleet?</h2>
+        <ajax-form :handle-submitting="handleSubmittingForm" :form-errors.sync="formErrors" :form-data="formData['have-you-ever-used-fleet']" :form-rules="isUsingFleetFormRules" :syncing.sync="syncing" :cloud-error.sync="cloudError">
+
+            <div class="form-group" :class="[formErrors.fleetUseStatus ? 'is-invalid' : '']">
+              <label purpose="form-option" class="form-control" :class="[formData['have-you-ever-used-fleet'].fleetUseStatus === 'yes-deployed' ? 'selected' : '']">
+                <input type="radio"  v-model.trim="formData['have-you-ever-used-fleet'].fleetUseStatus" value="yes-deployed" @input="clickClearOneFormError('fleetUseStatus')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                Yes, we actively use Fleet at work today
+              </label>
+              <label purpose="form-option" class="form-control" :class="[formData['have-you-ever-used-fleet'].fleetUseStatus === 'yes-recently-deployed' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['have-you-ever-used-fleet'].fleetUseStatus" value="yes-recently-deployed" @input="clickClearOneFormError('fleetUseStatus')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                Yes, we deployed Fleet at work recently to try it out
+              </label>
+              <label purpose="form-option" class="form-control" :class="[formData['have-you-ever-used-fleet'].fleetUseStatus === 'yes-deployed-local' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['have-you-ever-used-fleet'].fleetUseStatus" value="yes-deployed-local" @input="clickClearOneFormError('fleetUseStatus')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                Yes, but only in a local / homelab environment
+              </label>
+              <label purpose="form-option" class="form-control" :class="[formData['have-you-ever-used-fleet'].fleetUseStatus === 'yes-deployed-long-time' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['have-you-ever-used-fleet'].fleetUseStatus" value="yes-deployed-long-time" @input="clickClearOneFormError('fleetUseStatus')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                Yes, but it's been a long time
+              </label>
+              <label purpose="form-option" class="form-control" :class="[formData['have-you-ever-used-fleet'].fleetUseStatus === 'no' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['have-you-ever-used-fleet'].fleetUseStatus" value="no" @input="clickClearOneFormError('fleetUseStatus')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                No, not yet
+              </label>
+              <div class="invalid-feedback" v-if="formErrors.fleetUseStatus">Please select an option</div>
+            </div>
+          <cloud-error v-if="cloudError"></cloud-error>
+          <div purpose="form-buttons">
+            <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
+            <ajax-button type="submit" purpose="submit-button" class="btn btn-primary" :syncing="syncing">Continue</ajax-button>
+          </div>
+        </ajax-form>
+      </div>
+      <%//  ┬ ┬┌─┐┬ ┬  ┌┬┐┌─┐┌┐┌┬ ┬  ┬ ┬┌─┐┌─┐┌┬┐┌─┐
+        //  ├─┤│ ││││  │││├─┤│││└┬┘  ├─┤│ │└─┐ │ └─┐
+        //  ┴ ┴└─┘└┴┘  ┴ ┴┴ ┴┘└┘ ┴   ┴ ┴└─┘└─┘ ┴ └─┘%>
+      <div v-if="currentStep === 'how-many-hosts'">
+        <div purpose="progress-bar-container">
+          <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 70%"></div></div>
+          <img purpose="success-icon" alt="🚀" src="/images/icon-form-success-16x16@2x.png">
+        </div>
+        <div purpose="form-header">
+          <h2>About how many hosts do you have?</h2>
+          <p v-if="formData['what-are-you-using-fleet-for'].primaryBuyingSituation === 'eo-security'">Including servers, containers, workstations, and other hosts.</p>
+          <p v-else-if="formData['what-are-you-using-fleet-for'].primaryBuyingSituation === 'eo-it'">Including macOS, Windows, Linux workstations, Chromebooks, servers, and other hosts.</p>
+          <p v-else-if="formData['what-are-you-using-fleet-for'].primaryBuyingSituation === 'vm'">Including computers, servers, OT/ICS, containers, and other hosts.</p>
+        </div>
+        <ajax-form :handle-submitting="handleSubmittingForm" :form-errors.sync="formErrors" :form-data="formData['how-many-hosts']" :form-rules="numberOfHostsFormRules" :syncing.sync="syncing" :cloud-error.sync="cloudError">
+          <div class="form-group">
+
+            <div class="form-group" :class="[formErrors.numberOfHosts ? 'is-invalid' : '']">
+              <label purpose="form-option" class="form-control" :class="[formData['how-many-hosts'].numberOfHosts === '1-100' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['how-many-hosts'].numberOfHosts" value="1-100" @input="clickClearOneFormError('numberOfHosts')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                1 to 100
+              </label>
+              <label purpose="form-option" class="form-control" :class="[formData['how-many-hosts'].numberOfHosts === '100-700' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['how-many-hosts'].numberOfHosts" value="100-700" @input="clickClearOneFormError('numberOfHosts')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                100 to 700
+              </label>
+              <label purpose="form-option" class="form-control" :class="[formData['how-many-hosts'].numberOfHosts === '700-10000' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['how-many-hosts'].numberOfHosts" value="700-10000" @input="clickClearOneFormError('numberOfHosts')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                700 to 10,000
+              </label>
+              <label purpose="form-option" class="form-control" :class="[formData['how-many-hosts'].numberOfHosts === '10000+' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['how-many-hosts'].numberOfHosts" value="10000+" @input="clickClearOneFormError('numberOfHosts')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                More than 10,000
+              </label>
+              <div class="invalid-feedback" v-if="formErrors.numberOfHosts">Please select an option</div>
+            </div>
+          </div>
+          <cloud-error v-if="cloudError"></cloud-error>
+          <div purpose="form-buttons">
+            <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
+            <ajax-button type="submit" purpose="submit-button" class="btn btn-primary" :syncing="syncing">Continue</ajax-button>
+          </div>
+        </ajax-form>
+      </div>
+      <%//  ┬ ┬┬┬  ┬    ┬ ┬┌─┐┬ ┬  ┌┐ ┌─┐  ┌─┐┌─┐┬  ┌─┐  ┬ ┬┌─┐┌─┐┌┬┐┬┌┐┌┌─┐
+        //  │││││  │    └┬┘│ ││ │  ├┴┐├┤   └─┐├┤ │  ├┤   ├─┤│ │└─┐ │ │││││ ┬
+        //  └┴┘┴┴─┘┴─┘   ┴ └─┘└─┘  └─┘└─┘  └─┘└─┘┴─┘└    ┴ ┴└─┘└─┘ ┴ ┴┘└┘└─┘%>
+      <div v-if="currentStep === 'will-you-be-self-hosting'">
+        <div purpose="progress-bar-container">
+          <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 90%"></div></div>
+          <img purpose="success-icon" alt="🚀" src="/images/icon-form-success-16x16@2x.png">
+        </div>
+        <h2>Will you be hosting Fleet yourself?</h2>
+        <ajax-form :handle-submitting="handleSubmittingForm" :form-errors.sync="formErrors" :form-data="formData['will-you-be-self-hosting']" :form-rules="hostingFleetFormRules" :syncing.sync="syncing" :cloud-error.sync="cloudError">
+
+            <div class="form-group" :class="[formErrors.willSelfHost ? 'is-invalid' : '']" >
+              <label purpose="form-option" class="form-control" :class="[formData['will-you-be-self-hosting'].willSelfHost === 'true' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['will-you-be-self-hosting'].willSelfHost" value="true" @input="clickClearOneFormError('willSelfHost')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                Yes, self hosted
+              </label>
+              <label purpose="form-option" class="form-control" :class="[formData['will-you-be-self-hosting'].willSelfHost === 'false' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['will-you-be-self-hosting'].willSelfHost" value="false" @input="clickClearOneFormError('willSelfHost')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                I'd prefer not to
+              </label>
+              <div class="invalid-feedback" v-if="formErrors.willSelfHost">Please select an option</div>
+            </div>
+          <cloud-error v-if="cloudError"></cloud-error>
+          <div purpose="form-buttons">
+            <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
+            <ajax-button type="submit" purpose="submit-button" class="btn btn-primary" :syncing="syncing">Continue</ajax-button>
+          </div>
+        </ajax-form>
+      </div>
+      <%//  ┬ ┬┬ ┬┌─┐┌┬┐  ┌─┐┬─┐┌─┐  ┬ ┬┌─┐┬ ┬  ┬ ┬┌─┐┬─┐┬┌─┬┌┐┌┌─┐  ┌─┐┌┐┌
+        //  │││├─┤├─┤ │   ├─┤├┬┘├┤   └┬┘│ ││ │  ││││ │├┬┘├┴┐│││││ ┬  │ ││││  ───
+        //  └┴┘┴ ┴┴ ┴ ┴   ┴ ┴┴└─└─┘   ┴ └─┘└─┘  └┴┘└─┘┴└─┴ ┴┴┘└┘└─┘  └─┘┘└┘
+        //  ┌─┐┌─┐   ┌─┐┌─┐┌─┐┬ ┬┬─┐┬┌┬┐┬ ┬
+        //  ├┤ │ │───└─┐├┤ │  │ │├┬┘│ │ └┬┘
+        //  └─┘└─┘   └─┘└─┘└─┘└─┘┴└─┴ ┴  ┴%>
+      <div v-if="currentStep === 'what-are-you-working-on-eo-security'">
+        <div purpose="progress-bar-container">
+          <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 40%"></div></div>
+          <img purpose="success-icon" alt="🚀" src="/images/icon-form-success-16x16@2x.png">
+        </div>
+        <h2>What are you working on, mainly?</h2>
+        <ajax-form :handle-submitting="handleSubmittingForm" :form-errors.sync="formErrors" :form-data="formData['what-are-you-working-on-eo-security']" :form-rules="endpointOpsSecurityWorkingOnFormRules" :syncing.sync="syncing" :cloud-error.sync="cloudError">
+          <div class="form-group">
+
+            <div class="form-group" :class="[formErrors.endpointOpsSecurityUseCase ? 'is-invalid' : '']">
+              <label purpose="form-option" class="form-control" :class="[formData['what-are-you-working-on-eo-security'].endpointOpsSecurityUseCase === 'detection-and-response' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['what-are-you-working-on-eo-security'].endpointOpsSecurityUseCase" value="detection-and-response" @input="clickClearOneFormError('endpointOpsSecurityUseCase')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                Detection and response
+              </label>
+              <label purpose="form-option" class="form-control" :class="[formData['what-are-you-working-on-eo-security'].endpointOpsSecurityUseCase === 'production-infrastructure-security' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['what-are-you-working-on-eo-security'].endpointOpsSecurityUseCase" value="production-infrastructure-security" @input="clickClearOneFormError('endpointOpsSecurityUseCase')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                Production infrastructure / security
+              </label>
+              <label purpose="form-option" class="form-control" :class="[formData['what-are-you-working-on-eo-security'].endpointOpsSecurityUseCase === 'identity-and-access-management-endpoint-security' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['what-are-you-working-on-eo-security'].endpointOpsSecurityUseCase" value="identity-and-access-management-endpoint-security" @input="clickClearOneFormError('endpointOpsSecurityUseCase')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                Identity and access management (IAM) / endpoint security
+              </label>
+              <label purpose="form-option" class="form-control" :class="[formData['what-are-you-working-on-eo-security'].endpointOpsSecurityUseCase === 'cyber-threat-intelligence' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['what-are-you-working-on-eo-security'].endpointOpsSecurityUseCase" value="cyber-threat-intelligence" @input="clickClearOneFormError('endpointOpsSecurityUseCase')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                Cyber-threat intelligence (CTI)
+              </label>
+              <label purpose="form-option" class="form-control" :class="[formData['what-are-you-working-on-eo-security'].endpointOpsSecurityUseCase === 'risk-grc' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['what-are-you-working-on-eo-security'].endpointOpsSecurityUseCase" value="risk-grc" @input="clickClearOneFormError('endpointOpsSecurityUseCase')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                Risk (GRC)
+              </label>
+              <label purpose="form-option" class="form-control" :class="[formData['what-are-you-working-on-eo-security'].endpointOpsSecurityUseCase === 'ot-ics-iot-security' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['what-are-you-working-on-eo-security'].endpointOpsSecurityUseCase" value="ot-ics-iot-security" @input="clickClearOneFormError('endpointOpsSecurityUseCase')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                OT / ICS / IoT security
+              </label>
+              <div class="invalid-feedback" v-if="formErrors.endpointOpsSecurityUseCase">Please select an option</div>
+            </div>
+          </div>
+          <cloud-error v-if="cloudError"></cloud-error>
+          <div purpose="form-buttons">
+            <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
+            <ajax-button type="submit" purpose="submit-button" class="btn btn-primary" :syncing="syncing">Continue</ajax-button>
+          </div>
+        </ajax-form>
+      </div>
+      <%//  ┬ ┬┬ ┬┌─┐┌┬┐  ┌┬┐┌─┐┌─┐┌─┐  ┬ ┬┌─┐┬ ┬┬─┐  ┌┬┐┌─┐┌─┐┌┬┐  ┌┬┐┌─┐┌┐┌┌─┐┌─┐┌─┐
+        //  │││├─┤├─┤ │    │││ │├┤ └─┐  └┬┘│ ││ │├┬┘   │ ├┤ ├─┤│││  │││├─┤│││├─┤│ ┬├┤
+        //  └┴┘┴ ┴┴ ┴ ┴   ─┴┘└─┘└─┘└─┘   ┴ └─┘└─┘┴└─   ┴ └─┘┴ ┴┴ ┴  ┴ ┴┴ ┴┘└┘┴ ┴└─┘└─┘
+        //  ┌─┐┌─┐   ┬┌┬┐
+        //  ├┤ │ │───│ │
+        //  └─┘└─┘   ┴ ┴%>
+      <div v-if="currentStep === 'what-does-your-team-manage-eo-it'">
+        <div purpose="progress-bar-container">
+          <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 40%"></div></div>
+          <img purpose="success-icon" alt="🚀" src="/images/icon-form-success-16x16@2x.png">
+        </div>
+        <h2>What does your team manage?</h2>
+        <ajax-form :handle-submitting="handleSubmittingForm" :form-errors.sync="formErrors" :form-data="formData['what-does-your-team-manage-eo-it']" :form-rules="endpointOpsItUseCaseFormRules" :syncing.sync="syncing" :cloud-error.sync="cloudError">
+          <div class="form-group">
+
+            <div class="form-group" :class="[formErrors.endpointOpsItUseCase ? 'is-invalid' : '']">
+              <label purpose="form-option" class="form-control" :class="[formData['what-does-your-team-manage-eo-it'].endpointOpsItUseCase === 'employee-workstations' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['what-does-your-team-manage-eo-it'].endpointOpsItUseCase" value="employee-workstations" @input="clickClearOneFormError('endpointOpsItUseCase')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                Employee workstations
+              </label>
+              <label purpose="form-option" class="form-control" :class="[formData['what-does-your-team-manage-eo-it'].endpointOpsItUseCase === 'just-macos' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['what-does-your-team-manage-eo-it'].endpointOpsItUseCase" value="just-macos" @input="clickClearOneFormError('endpointOpsItUseCase')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                Just macOS
+              </label>
+              <label purpose="form-option" class="form-control" :class="[formData['what-does-your-team-manage-eo-it'].endpointOpsItUseCase === 'production-infrastructure' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['what-does-your-team-manage-eo-it'].endpointOpsItUseCase" value="production-infrastructure" @input="clickClearOneFormError('endpointOpsItUseCase')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                Production infrastructure
+              </label>
+              <label purpose="form-option" class="form-control" :class="[formData['what-does-your-team-manage-eo-it'].endpointOpsItUseCase === 'everything' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['what-does-your-team-manage-eo-it'].endpointOpsItUseCase" value="everything" @input="clickClearOneFormError('endpointOpsItUseCase')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                Everything
+              </label>
+              <div class="invalid-feedback" v-if="formErrors.endpointOpsItUseCase">Please select an option</div>
+            </div>
+          </div>
+          <cloud-error v-if="cloudError"></cloud-error>
+          <div purpose="form-buttons">
+            <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
+            <ajax-button type="submit" purpose="submit-button" class="btn btn-primary" :syncing="syncing">Continue</ajax-button>
+          </div>
+        </ajax-form>
+      </div>
+      <%//  ┬ ┬┬ ┬┌─┐┌┬┐  ┌┬┐┌─┐┌─┐┌─┐  ┬ ┬┌─┐┬ ┬┬─┐  ┌┬┐┌─┐┌─┐┌┬┐  ┌┬┐┌─┐┌┐┌┌─┐┌─┐┌─┐
+        //  │││├─┤├─┤ │    │││ │├┤ └─┐  └┬┘│ ││ │├┬┘   │ ├┤ ├─┤│││  │││├─┤│││├─┤│ ┬├┤
+        //  └┴┘┴ ┴┴ ┴ ┴   ─┴┘└─┘└─┘└─┘   ┴ └─┘└─┘┴└─   ┴ └─┘┴ ┴┴ ┴  ┴ ┴┴ ┴┘└┘┴ ┴└─┘└─┘
+        //  ┬  ┬┌┬┐
+        //  └┐┌┘│││
+        //   └┘ ┴ ┴%>
+      <div v-if="currentStep === 'what-does-your-team-manage-vm'">
+        <div purpose="progress-bar-container">
+          <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 40%"></div></div>
+          <img purpose="success-icon" alt="🚀" src="/images/icon-form-success-16x16@2x.png">
+        </div>
+        <h2>What does your team manage?</h2>
+        <ajax-form :handle-submitting="handleSubmittingForm" :form-errors.sync="formErrors" :form-data="formData['what-does-your-team-manage-vm']" :form-rules="vmUseCaseFormRules" :syncing.sync="syncing" :cloud-error.sync="cloudError">
+          <div class="form-group">
+
+            <div class="form-group" :class="[formErrors.vmUseCase ? 'is-invalid' : '']">
+              <label purpose="form-option" class="form-control" :class="[formData['what-does-your-team-manage-vm'].vmUseCase === 'ot-ics-iot-security' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['what-does-your-team-manage-vm'].vmUseCase" value="ot-ics-iot-security" @input="clickClearOneFormError('vmUseCase')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                OT / ICS / IoT security
+              </label>
+              <label purpose="form-option" class="form-control" :class="[formData['what-does-your-team-manage-vm'].vmUseCase === 'compliance-grc' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['what-does-your-team-manage-vm'].vmUseCase" value="compliance-grc" @input="clickClearOneFormError('vmUseCase')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                Compliance (GRC)
+              </label>
+              <label purpose="form-option" class="form-control" :class="[formData['what-does-your-team-manage-vm'].vmUseCase === 'cyber-threat-intelligence-security-research' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['what-does-your-team-manage-vm'].vmUseCase" value="cyber-threat-intelligence-security-research" @input="clickClearOneFormError('vmUseCase')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                Cyber-threat intelligence (CTI) / security research
+              </label>
+              <label purpose="form-option" class="form-control" :class="[formData['what-does-your-team-manage-vm'].vmUseCase === 'infrastructure-security' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['what-does-your-team-manage-vm'].vmUseCase" value="infrastructure-security" @input="clickClearOneFormError('vmUseCase')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                Infrastructure security
+              </label>
+              <label purpose="form-option" class="form-control" :class="[formData['what-does-your-team-manage-vm'].vmUseCase === 'everything' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['what-does-your-team-manage-vm'].vmUseCase" value="everything" @input="clickClearOneFormError('vmUseCase')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                Everything
+              </label>
+              <div class="invalid-feedback" v-if="formErrors.vmUseCase">Please select an option</div>
+            </div>
+          </div>
+          <cloud-error v-if="cloudError"></cloud-error>
+          <div purpose="form-buttons">
+            <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
+            <ajax-button type="submit" purpose="submit-button" class="btn btn-primary" :syncing="syncing">Continue</ajax-button>
+          </div>
+        </ajax-form>
+      </div>
+      <%//  ┬ ┬┬ ┬┌─┐┌┬┐  ┌┬┐┌─┐  ┬ ┬┌─┐┬ ┬ ┌┬┐┌─┐┌┐┌┌─┐┌─┐┌─┐
+        //  │││├─┤├─┤ │    │││ │  └┬┘│ ││ │ │││├─┤│││├─┤│ ┬├┤
+        //  └┴┘┴ ┴┴ ┴ ┴   ─┴┘└─┘   ┴ └─┘└─┘ ┴ ┴┴ ┴┘└┘┴ ┴└─┘└─┘
+        //  ┌┬┐┌┬┐┌┬┐
+        //  │││ │││││
+        //  ┴ ┴─┴┘┴ ┴%>
+      <div v-if="currentStep === 'what-do-you-manage-mdm'">
+        <div purpose="progress-bar-container">
+          <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 40%"></div></div>
+          <img purpose="success-icon" alt="🚀" src="/images/icon-form-success-16x16@2x.png">
+        </div>
+        <h2>What do you manage?</h2>
+        <p class="pb-3">Fleet is designed to simplify how you manage devices. Going 100% Mac, or 50/50 Mac and Windows?  What about Linux devices, or having employees enroll their personal phones? It’s up to you.</p>
+        <ajax-form :handle-submitting="handleSubmittingForm" :form-errors.sync="formErrors" :form-data="formData['what-do-you-manage-mdm']" :form-rules="mdmUseCaseFormRules" :syncing.sync="syncing" :cloud-error.sync="cloudError">
+          <div class="form-group">
+
+            <div class="form-group" :class="[formErrors.mdmUseCase ? 'is-invalid' : '']">
+              <label purpose="form-option" class="form-control" :class="[formData['what-do-you-manage-mdm'].mdmUseCase === 'mostly-macs' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['what-do-you-manage-mdm'].mdmUseCase" value="mostly-macs" @input="clickClearOneFormError('mdmUseCase')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                Mostly Macs
+              </label>
+              <label purpose="form-option" class="form-control" :class="[formData['what-do-you-manage-mdm'].mdmUseCase === 'mostly-windows' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['what-do-you-manage-mdm'].mdmUseCase" value="mostly-windows" @input="clickClearOneFormError('mdmUseCase')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                Mostly Windows
+              </label>
+              <label purpose="form-option" class="form-control" :class="[formData['what-do-you-manage-mdm'].mdmUseCase === 'about-half-and-half' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['what-do-you-manage-mdm'].mdmUseCase" value="about-half-and-half" @input="clickClearOneFormError('mdmUseCase')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                About half and half
+              </label>
+              <label purpose="form-option" class="form-control" :class="[formData['what-do-you-manage-mdm'].mdmUseCase === 'no-use-case-yet' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['what-do-you-manage-mdm'].mdmUseCase" value="no-use-case-yet" @input="clickClearOneFormError('mdmUseCase')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                I'm just curious
+              </label>
+              <label purpose="form-option" class="form-control" :class="[formData['what-do-you-manage-mdm'].mdmUseCase === 'linux' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['what-do-you-manage-mdm'].mdmUseCase" value="linux" @input="clickClearOneFormError('mdmUseCase')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                Actually, I'm here for Linux
+              </label>
+              <div class="invalid-feedback" v-if="formErrors.mdmUseCase">Please select an option</div>
+            </div>
+          </div>
+          <cloud-error v-if="cloudError"></cloud-error>
+          <div purpose="form-buttons">
+            <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
+            <ajax-button type="submit" purpose="submit-button" class="btn btn-primary" :syncing="syncing">Continue</ajax-button>
+          </div>
+        </ajax-form>
+      </div>
+      <%//  ╔═╗╦═╗╔═╗╔═╗╔═╗  ╔═╗╦  ╔═╗╔╦╗╔═╗╔═╗╦═╗╔╦╗  ╔╦╗╔╦╗╔╦╗
+        //  ║  ╠╦╝║ ║╚═╗╚═╗  ╠═╝║  ╠═╣ ║ ╠╣ ║ ║╠╦╝║║║  ║║║ ║║║║║
+        //  ╚═╝╩╚═╚═╝╚═╝╚═╝  ╩  ╩═╝╩ ╩ ╩ ╚  ╚═╝╩╚═╩ ╩  ╩ ╩═╩╝╩ ╩%>
+      <div v-if="currentStep === 'cross-platform-mdm'">
+        <ajax-form :handle-submitting="handleSubmittingForm" :form-errors.sync="formErrors" :form-data="formData['cross-platform-mdm']" :form-rules="formRules" :syncing.sync="syncing" :cloud-error.sync="cloudError">
+          <div purpose="progress-bar-container">
+            <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 45%"></div></div>
+            <img purpose="success-icon" alt="🚀" src="/images/icon-form-success-16x16@2x.png">
+          </div>
+          <h2>The myth of cross platform</h2>
+          <p>Fleet lets you work directly with data and events from the native operating system.</p>
+          <p>It still exposes familiar concepts similar to smart groups and extension attributes, but for every platform’s “special” nuance, and in a way that lets you go all the way down to the bare metal.</p>
+          <p>With Fleet you only need to manage Apple, Windows, and Linux; not Omnissa, Intune, and your anxiety.</p>
+          <div purpose="form-buttons">
+            <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
+            <ajax-button type="submit" purpose="submit-button" class="btn btn-primary" :syncing="syncing">Continue</ajax-button>
+          </div>
+        </ajax-form>
+      </div>
+      <%//  ┬┌─┐  ┬┌┬┐  ┌─┐┌┐┌┬ ┬  ┌─┐┌─┐┌─┐┌┬┐
+        //  │└─┐  │ │   ├─┤│││└┬┘  │ ┬│ ││ │ ││
+        //  ┴└─┘  ┴ ┴   ┴ ┴┘└┘ ┴   └─┘└─┘└─┘─┴┘%>
+      <div v-if="currentStep === 'is-it-any-good'">
+        <ajax-form :handle-submitting="handleSubmittingForm" :form-errors.sync="formErrors" :form-data="formData['is-it-any-good']" :form-rules="formRules" :syncing.sync="syncing" :cloud-error.sync="cloudError">
+          <div purpose="progress-bar-container">
+            <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 50%"></div></div>
+            <img purpose="success-icon" alt="🚀" src="/images/icon-form-success-16x16@2x.png">
+          </div>
+          <h2>Want to try it?</h2>
+          <div purpose="form-header" class="mx-auto">
+            <p class="">We don’t have a public sample environment, but you can try Fleet out locally on your computer.</p>
+          </div>
+          <div purpose="start-cards">
+            <a purpose="card" href="/try-fleet?start">
+              <img alt="Run a local demo of Fleet" src="/images/start-try-fleet-64x64@2x.png">
+              <h2>Try Fleet yourself</h2>
+              <p>Try Fleet locally on your device</p>
+            </a>
+            <a purpose="card" href="https://youtu.be/QpdRADHWP_o?feature=shared&t=1333" target="_blank">
+              <img alt="Watch a demo" src="/images/play-button-64x64@2x.png">
+              <h2>Watch a demo</h2>
+              <p>See what Fleet can do</p>
+            </a>
+          </div>
+          <p>Got questions? <a purpose="contact-link" href="/contact">Ask us anything</a>.</p>
+          <div purpose="form-tip" class="d-flex flex-row align-items-center justify-content-between">
+            <div><img alt="A lightbulb" src="/images/icon-suggestion-64x64@2x.png"></div>
+            <div>
+              <p>You can come back here any time to continue with your deployment.</p>
+            </div>
+          </div>
+          <div purpose="form-buttons">
+            <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
+            <ajax-button type="submit" purpose="submit-button" class="btn btn-primary" :syncing="syncing">Continue</ajax-button>
+          </div>
+        </ajax-form>
+      </div>
+      <%//  ┬ ┬┬ ┬┌─┐┌┬┐  ┌┬┐┬┌┬┐  ┬ ┬┌─┐┬ ┬  ┌┬┐┬ ┬┬┌┐┌┬┌─
+        //  │││├─┤├─┤ │    │││ ││  └┬┘│ ││ │   │ ├─┤││││├┴┐
+        //  └┴┘┴ ┴┴ ┴ ┴   ─┴┘┴─┴┘   ┴ └─┘└─┘   ┴ ┴ ┴┴┘└┘┴ ┴%>
+      <div v-if="currentStep === 'what-did-you-think'">
+        <div purpose="progress-bar-container">
+          <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 70%"></div></div>
+          <img purpose="success-icon" alt="🚀" src="/images/icon-form-success-16x16@2x.png">
+        </div>
+        <h2>What did you think?</h2>
+        <p>Now that you’ve seen what Fleet can do, what do you want to do next?</p>
+        <ajax-form :handle-submitting="handleSubmittingForm" :form-errors.sync="formErrors" :form-data="formData['what-did-you-think']" :form-rules="endpointOpsSecurityWhatDidYouThinkFormRules" :syncing.sync="syncing" :cloud-error.sync="cloudError">
+          <div class="form-group" :class="[formErrors.whatDidYouThink ? 'is-invalid' : '']">
+            <label purpose="form-option" class="form-control" :class="[formData['what-did-you-think'].whatDidYouThink === 'host-fleet-for-me' ? 'selected' : '']">
+              <input type="radio" v-model.trim="formData['what-did-you-think'].whatDidYouThink" value="host-fleet-for-me" @input="clickClearOneFormError('whatDidYouThink')">
+              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+              I’d like you to host Fleet for me
+            </label>
+            <label purpose="form-option" class="form-control" :class="[formData['what-did-you-think'].whatDidYouThink === 'deploy-fleet-in-environment' ? 'selected' : '']">
+              <input type="radio" v-model.trim="formData['what-did-you-think'].whatDidYouThink" value="deploy-fleet-in-environment" @input="clickClearOneFormError('whatDidYouThink')">
+              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+              I’d like to deploy Fleet in my environment
+            </label>
+            <label purpose="form-option" class="form-control" :class="[formData['what-did-you-think'].whatDidYouThink === 'let-me-think-about-it' ? 'selected' : '']">
+              <input type="radio" v-model.trim="formData['what-did-you-think'].whatDidYouThink" value="let-me-think-about-it" @input="clickClearOneFormError('whatDidYouThink')">
+              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+              Let me think about it
+            </label>
+            <div class="invalid-feedback" v-if="formErrors.whatDidYouThink">Please select an option</div>
+          </div>
+          <cloud-error v-if="cloudError"></cloud-error>
+          <div purpose="form-buttons">
+            <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
+            <ajax-button type="submit" purpose="submit-button" class="btn btn-primary" :syncing="syncing">Continue</ajax-button>
+          </div>
+        </ajax-form>
+      </div>
+      <%//  ┬  ┌─┐┌┬┐┌─┐  ┌┬┐┌─┐┬  ┬┌─  ┌┬┐┌─┐  ┬ ┬┌─┐┬ ┬┬─┐  ┌┬┐┌─┐┌─┐┌┬┐
+        //  │  ├┤  │ └─┐   │ ├─┤│  ├┴┐   │ │ │  └┬┘│ ││ │├┬┘   │ ├┤ ├─┤│││
+        //  ┴─┘└─┘ ┴ └─┘   ┴ ┴ ┴┴─┘┴ ┴   ┴ └─┘   ┴ └─┘└─┘┴└─   ┴ └─┘┴ ┴┴ ┴%>
+      <div v-if="currentStep === 'lets-talk-to-your-team'">
+        <div purpose="progress-bar-container">
+          <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 100%"></div></div>
+          <img purpose="success-icon" alt="🚀" src="/images/icon-form-success-16x16@2x.png">
+        </div>
+        <div class=" mx-auto">
+          <h2>Let’s talk to your team</h2>
+          <p>Great, let’s jump on a call to talk more about your fleet.</p>
         </div>
         <div purpose="start-cards">
-          <a purpose="card" href="/try-fleet?start">
-            <img alt="Run a local demo of Fleet" src="/images/start-try-fleet-64x64@2x.png">
-            <h2>Try Fleet yourself</h2>
-            <p>Try Fleet locally on your device</p>
+          <a purpose="card" @click="clickGoToCalendly()">
+            <img alt="Premium support" src="/images/icon-premium-support-64x64@2x.png">
+            <h2>Work with us</h2>
+            <p>Get support and training or schedule a personalized demo for your team.</p>
           </a>
-          <a purpose="card" href="https://youtu.be/QpdRADHWP_o?feature=shared&t=1333" target="_blank">
-            <img alt="Watch a demo" src="/images/play-button-64x64@2x.png">
-            <h2>Watch a demo</h2>
-            <p>See what Fleet can do</p>
+          <a purpose="card" @click="clickGoToCalendly()">
+            <img alt="Ask us anything" src="/images/icon-ask-anything-64x64@2x.png">
+            <h2>Got questions?</h2>
+            <p>Grab some time and ask us anything.</p>
           </a>
         </div>
-        <p>Got questions? <a purpose="contact-link" href="/contact">Ask us anything</a>.</p>
-        <p>You can come back here any time to continue with your deployment.</p>
-        <div purpose="form-buttons">
-          <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
-          <ajax-button type="submit" purpose="submit-button" class="btn btn-primary" :syncing="syncing">Continue</ajax-button>
-        </div>
-      </ajax-form>
-    </div>
-    <%//  ┬ ┬┬ ┬┌─┐┌┬┐  ┌┬┐┬┌┬┐  ┬ ┬┌─┐┬ ┬  ┌┬┐┬ ┬┬┌┐┌┬┌─
-      //  │││├─┤├─┤ │    │││ ││  └┬┘│ ││ │   │ ├─┤││││├┴┐
-      //  └┴┘┴ ┴┴ ┴ ┴   ─┴┘┴─┴┘   ┴ └─┘└─┘   ┴ ┴ ┴┴┘└┘┴ ┴%>
-    <div v-if="currentStep === 'what-did-you-think'">
-      <div purpose="progress-bar-container">
-        <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 70%"></div></div>
-        <img purpose="success-icon" alt="🏆" src="/images/icon-form-success-12x12@2x.png">
-      </div>
-      <h2>What did you think?</h2>
-      <p>Now that you’ve seen what Fleet can do, what do you want to do next?</p>
-      <ajax-form :handle-submitting="handleSubmittingForm" :form-errors.sync="formErrors" :form-data="formData['what-did-you-think']" :form-rules="endpointOpsSecurityWhatDidYouThinkFormRules" :syncing.sync="syncing" :cloud-error.sync="cloudError">
-        <div class="form-group" :class="[formErrors.whatDidYouThink ? 'is-invalid' : '']">
-          <label purpose="form-option" class="form-control" :class="[formData['what-did-you-think'].whatDidYouThink === 'host-fleet-for-me' ? 'selected' : '']">
-            <input type="radio" v-model.trim="formData['what-did-you-think'].whatDidYouThink" value="host-fleet-for-me" @input="clickClearOneFormError('whatDidYouThink')">
-            <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-            I’d like you to host Fleet for me
-          </label>
-          <label purpose="form-option" class="form-control" :class="[formData['what-did-you-think'].whatDidYouThink === 'deploy-fleet-in-environment' ? 'selected' : '']">
-            <input type="radio" v-model.trim="formData['what-did-you-think'].whatDidYouThink" value="deploy-fleet-in-environment" @input="clickClearOneFormError('whatDidYouThink')">
-            <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-            I’d like to deploy Fleet in my environment
-          </label>
-          <label purpose="form-option" class="form-control" :class="[formData['what-did-you-think'].whatDidYouThink === 'let-me-think-about-it' ? 'selected' : '']">
-            <input type="radio" v-model.trim="formData['what-did-you-think'].whatDidYouThink" value="let-me-think-about-it" @input="clickClearOneFormError('whatDidYouThink')">
-            <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-            Let me think about it
-          </label>
-          <div class="invalid-feedback" v-if="formErrors.whatDidYouThink">Please select an option</div>
-        </div>
-        <cloud-error v-if="cloudError"></cloud-error>
-        <div purpose="quote" v-else-if="!formData['what-are-you-using-fleet-for'].primaryBuyingSituation || formData['what-are-you-using-fleet-for'].primaryBuyingSituation === 'mdm'">
-          <div purpose="logo" class="mb-4"><img height="32" alt="Uber logo" src="/images/social-proof-logo-uber-71x32@2x.png"></div>
-          <p purpose="quote-text">
-            Exciting. This is a team that listens to feedback.
-          </p>
-          <div purpose="quote-author-info" class="d-flex flex-row align-items-center">
-            <div purpose="profile-picture">
-              <img alt="Erik Gomez" src="/images/testimonial-author-erik-gomez-48x48@2x.png">
-            </div>
-            <div class="d-flex flex-column align-self-top">
-              <p purpose="name" class="font-weight-bold m-0">Erik Gomez</p>
-              <p purpose="job-title" class="m-0">Staff Client Platform Engineer</p>
-            </div>
-          </div>
-        </div>
-        <div purpose="quote" v-else-if="formData['what-are-you-using-fleet-for'].primaryBuyingSituation === 'vm'">
-          <div purpose="logo" class="mb-4"><img height="32" alt="Rivian logo" src="/images/logo-rivian-dark-120x32@2x.png"></div>
-          <p purpose="quote-text">
-            The visibility down into the assets covered by the agent is phenomenal. Fleet has become the central source for a lot of things.
-          </p>
-          <div purpose="quote-author-info" class="d-flex flex-row align-items-center">
-            <div purpose="profile-picture">
-              <img alt="Andre Shields" src="/images/testimonial-author-andre-shields-48x48@2x.png">
-            </div>
-            <div class="d-flex flex-column align-self-top">
-              <p purpose="name" class="font-weight-bold m-0">Andre Shields</p>
-              <p purpose="job-title" class="m-0">Staff Cybersecurity Engineer, Vulnerability Management</p>
-            </div>
-          </div>
-        </div>
-        <div purpose="quote" v-else-if="formData['what-are-you-using-fleet-for'].primaryBuyingSituation === 'eo-it'">
-          <div purpose="logo" class="mb-4"><img height="32" alt="Deputy logo" src="/images/logo-deputy-118x28@2x.png"></div>
-          <p purpose="quote-text">
-            When we look at vendors, we look for ones that are very receptive to feedback, where you’re just part of the family, I guess. Fleet’s really good at that.
-          </p>
-          <div purpose="quote-author-info" class="d-flex flex-row align-items-center">
-            <div purpose="profile-picture">
-              <img alt="Harrison Ravazzolo" src="/images/testimonial-author-harrison-ravazzolo-48x48@2x.png">
-            </div>
-            <div class="d-flex flex-column align-self-top">
-              <p purpose="name" class="font-weight-bold m-0">Harrison Ravazzolo</p>
-              <p purpose="job-title" class="m-0">Lead platform and identity engineer</p>
-            </div>
-          </div>
-        </div>
-        <div purpose="quote" v-else-if="formData['what-are-you-using-fleet-for'].primaryBuyingSituation === 'eo-security'">
-          <div purpose="logo" class="mb-4"><img height="32" alt="Deloitte logo" src="/images/social-proof-logo-deloitte-130x32@2x.png"></div>
-          <p purpose="quote-text">
-            Something I really appreciate about working with you guys is that it doesn't feel like I'm talking to a vendor. It actually feels like I'm talking to my team, and I really appreciate it.
-          </p>
-          <div purpose="quote-author-info" class="d-flex flex-row align-items-center">
-            <div purpose="profile-picture">
-              <img alt="Chandra Majumdar" src="/images/testimonial-author-chandra-majumdar-48x48@2x.png">
-            </div>
-            <div class="d-flex flex-column align-self-top">
-              <p purpose="name" class="font-weight-bold m-0">Chandra Majumdar</p>
-              <p purpose="job-title" class="m-0">Partner - Cyber and Strategic Risk</p>
-            </div>
-          </div>
-        </div>
         <div purpose="form-buttons">
           <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
-          <ajax-button type="submit" purpose="submit-button" class="btn btn-primary" :syncing="syncing">Continue</ajax-button>
         </div>
-      </ajax-form>
-    </div>
-    <%//  ┬  ┌─┐┌┬┐┌─┐  ┌┬┐┌─┐┬  ┬┌─  ┌┬┐┌─┐  ┬ ┬┌─┐┬ ┬┬─┐  ┌┬┐┌─┐┌─┐┌┬┐
-      //  │  ├┤  │ └─┐   │ ├─┤│  ├┴┐   │ │ │  └┬┘│ ││ │├┬┘   │ ├┤ ├─┤│││
-      //  ┴─┘└─┘ ┴ └─┘   ┴ ┴ ┴┴─┘┴ ┴   ┴ └─┘   ┴ └─┘└─┘┴└─   ┴ └─┘┴ ┴┴ ┴%>
-    <div v-if="currentStep === 'lets-talk-to-your-team'">
-      <div purpose="progress-bar-container">
-        <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 100%"></div></div>
-        <img purpose="success-icon" alt="🏆" src="/images/icon-form-success-12x12@2x.png">
       </div>
-      <div class=" mx-auto">
-        <h2>Let’s talk to your team</h2>
-        <p>Great, let’s jump on a call to talk more about your fleet.</p>
-      </div>
-      <div purpose="start-cards">
-        <a purpose="card" @click="clickGoToCalendly()">
-          <img alt="Premium support" src="/images/icon-premium-support-64x64@2x.png">
-          <h2>Work with us</h2>
-          <p>Get support and training or schedule a personalized demo for your team.</p>
-        </a>
-        <a purpose="card" @click="clickGoToCalendly()">
-          <img alt="Ask us anything" src="/images/icon-ask-anything-64x64@2x.png">
-          <h2>Got questions?</h2>
-          <p>Grab some time and ask us anything.</p>
-        </a>
-      </div>
-      <div purpose="form-buttons">
-        <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
-      </div>
-    </div>
 
-    <%//  ╔╦╗┌─┐┌─┐┬  ┌─┐┬ ┬  ┌─┐┬  ┌─┐┌─┐┌┬┐  ┬┌┐┌  ┬ ┬┌─┐┬ ┬┬─┐  ┌─┐┌┐┌┬  ┬┬┬─┐┌─┐┌┐┌┌┬┐┌─┐┌┐┌┌┬┐
-      //   ║║├┤ ├─┘│  │ │└┬┘  ├┤ │  ├┤ ├┤  │   ││││  └┬┘│ ││ │├┬┘  ├┤ │││└┐┌┘│├┬┘│ │││││││├┤ │││ │
-      //  ═╩╝└─┘┴  ┴─┘└─┘ ┴   └  ┴─┘└─┘└─┘ ┴   ┴┘└┘   ┴ └─┘└─┘┴└─  └─┘┘└┘ └┘ ┴┴└─└─┘┘└┘┴ ┴└─┘┘└┘ ┴%>
-    <div v-if="currentStep === 'deploy-fleet-in-your-environment'">
-      <ajax-form :handle-submitting="handleSubmittingForm" :form-errors.sync="formErrors" :form-data="formData['deploy-fleet-in-your-environment']" :form-rules="formRules" :syncing.sync="syncing" :cloud-error.sync="cloudError">
+      <%//  ╔╦╗┌─┐┌─┐┬  ┌─┐┬ ┬  ┌─┐┬  ┌─┐┌─┐┌┬┐  ┬┌┐┌  ┬ ┬┌─┐┬ ┬┬─┐  ┌─┐┌┐┌┬  ┬┬┬─┐┌─┐┌┐┌┌┬┐┌─┐┌┐┌┌┬┐
+        //   ║║├┤ ├─┘│  │ │└┬┘  ├┤ │  ├┤ ├┤  │   ││││  └┬┘│ ││ │├┬┘  ├┤ │││└┐┌┘│├┬┘│ │││││││├┤ │││ │
+        //  ═╩╝└─┘┴  ┴─┘└─┘ ┴   └  ┴─┘└─┘└─┘ ┴   ┴┘└┘   ┴ └─┘└─┘┴└─  └─┘┘└┘ └┘ ┴┴└─└─┘┘└┘┴ ┴└─┘┘└┘ ┴%>
+      <div v-if="currentStep === 'deploy-fleet-in-your-environment'">
+        <ajax-form :handle-submitting="handleSubmittingForm" :form-errors.sync="formErrors" :form-data="formData['deploy-fleet-in-your-environment']" :form-rules="formRules" :syncing.sync="syncing" :cloud-error.sync="cloudError">
+          <div purpose="progress-bar-container">
+            <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 80%"></div></div>
+            <img purpose="success-icon" alt="🚀" src="/images/icon-form-success-16x16@2x.png">
+          </div>
+          <div class="mx-auto">
+            <h2>Deploy Fleet in your environment</h2>
+            <p>Learn how to deploy and roll out Fleet in your environment.</p>
+          </div>
+          <div purpose="start-cards">
+            <a purpose="card" href="/docs/deploy">
+              <img alt="Premium support" src="/images/icon-deploy-fleet-64x64@2x.png">
+              <h2>Deploy Fleet</h2>
+              <p>Learn how to deploy Fleet</p>
+            </a>
+            <a purpose="card" href="/support">
+              <img alt="Ask us anything" src="/images/icon-ask-anything-64x64@2x.png">
+              <h2>Got questions?</h2>
+              <p>Ask Fleet’s community of helpful, knowledgeable people.</p>
+            </a>
+          </div>
+          <div purpose="logo-container">
+          <logo-carousel></logo-carousel>
+          </div>
+          <div purpose="form-tip" class="d-flex flex-row align-items-center justify-content-start">
+            <div><img alt="A lightbulb" src="/images/icon-suggestion-64x64@2x.png"></div>
+            <div>
+              <p>You can come back any time to continue or get help.</p>
+            </div>
+          </div>
+          <div purpose="form-buttons">
+            <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
+            <ajax-button type="submit" purpose="submit-button" class="btn btn-primary" :syncing="syncing">Continue</ajax-button>
+          </div>
+        </ajax-form>
+      </div>
+
+      <%//  ┬ ┬┌─┐┬ ┬  ┬ ┬┌─┐┌─┐  ┬ ┬┌─┐┬ ┬┬─┐  ┌┬┐┌─┐┌─┐┬  ┌─┐┬ ┬┌┬┐┌─┐┌┐┌┌┬┐
+        //  ├─┤│ ││││  │││├─┤└─┐  └┬┘│ ││ │├┬┘   ││├┤ ├─┘│  │ │└┬┘│││├┤ │││ │
+        //  ┴ ┴└─┘└┴┘  └┴┘┴ ┴└─┘   ┴ └─┘└─┘┴└─  ─┴┘└─┘┴  ┴─┘└─┘ ┴ ┴ ┴└─┘┘└┘ ┴%>
+      <div v-if="currentStep === 'how-was-your-deployment'">
         <div purpose="progress-bar-container">
-          <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 80%"></div></div>
-          <img purpose="success-icon" alt="🏆" src="/images/icon-form-success-12x12@2x.png">
+          <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 90%"></div></div>
+          <img purpose="success-icon" alt="🚀" src="/images/icon-form-success-16x16@2x.png">
+        </div>
+        <h2>How was your deployment?</h2>
+        <ajax-form :handle-submitting="handleSubmittingForm" :form-errors.sync="formErrors" :form-data="formData['how-was-your-deployment']" :form-rules="howWasYourDeploymentFormRules" :syncing.sync="syncing" :cloud-error.sync="cloudError">
+          <div class="form-group">
+            <div class="form-group" :class="[formErrors.howWasYourDeployment ? 'is-invalid' : '']">
+              <label purpose="form-option" class="form-control" :class="[formData['how-was-your-deployment'].howWasYourDeployment === 'up-and-running' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['how-was-your-deployment'].howWasYourDeployment" value="up-and-running" @input="clickClearOneFormError('howWasYourDeployment')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                I’m up and running!
+              </label>
+              <label purpose="form-option" class="form-control" :class="[formData['how-was-your-deployment'].howWasYourDeployment === 'kinda-stuck' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['how-was-your-deployment'].howWasYourDeployment" value="kinda-stuck" @input="clickClearOneFormError('howWasYourDeployment')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                I’m kinda stuck
+              </label>
+              <label purpose="form-option" class="form-control" :class="[formData['how-was-your-deployment'].howWasYourDeployment === 'havent-gotten-to-it' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['how-was-your-deployment'].howWasYourDeployment" value="havent-gotten-to-it" @input="clickClearOneFormError('howWasYourDeployment')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                I haven’t gotten to it yet
+              </label>
+              <label purpose="form-option" class="form-control" :class="[formData['how-was-your-deployment'].howWasYourDeployment === 'changed-mind-want-managed-deployment' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['how-was-your-deployment'].howWasYourDeployment" value="changed-mind-want-managed-deployment" @input="clickClearOneFormError('howWasYourDeployment')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                I changed my mind, can you deploy for me?
+              </label>
+              <label purpose="form-option" class="form-control" :class="[formData['how-was-your-deployment'].howWasYourDeployment === 'decided-to-not-use-fleet' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['how-was-your-deployment'].howWasYourDeployment" value="decided-to-not-use-fleet" @input="clickClearOneFormError('howWasYourDeployment')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                I decided not to use Fleet for now
+              </label>
+              <div class="invalid-feedback" v-if="formErrors.howWasYourDeployment">Please select an option</div>
+            </div>
+          </div>
+          <cloud-error v-if="cloudError"></cloud-error>
+          <div purpose="form-buttons">
+            <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
+            <ajax-button type="submit" purpose="submit-button" class="btn btn-primary" :syncing="syncing">Continue</ajax-button>
+          </div>
+        </ajax-form>
+      </div>
+      <%//  ╦ ╦┬ ┬┌─┐┌┬┐┌─┐  ┬  ┌─┐┌─┐┌┬┐  ┌┬┐┌─┐  ┌─┐┌─┐┌┬┐  ┬ ┬┌─┐┬ ┬  ┌─┐┌─┐┌┬┐  ┬ ┬┌─┐
+        //  ║║║├─┤├─┤ │ └─┐  │  ├┤ ├┤  │    │ │ │  │ ┬├┤  │   └┬┘│ ││ │  └─┐├┤  │   │ │├─┘
+        //  ╚╩╝┴ ┴┴ ┴ ┴ └─┘  ┴─┘└─┘└   ┴    ┴ └─┘  └─┘└─┘ ┴    ┴ └─┘└─┘  └─┘└─┘ ┴   └─┘┴%>
+      <div v-if="currentStep === 'whats-left-to-get-you-set-up'">
+        <div purpose="progress-bar-container">
+          <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 100%"></div></div>
+          <img purpose="success-icon" alt="🚀" src="/images/icon-form-success-16x16@2x.png">
+        </div>
+        <h2>What’s left to get you set up?</h2>
+        <ajax-form :handle-submitting="handleSubmittingForm" :form-errors.sync="formErrors" :form-data="formData['whats-left-to-get-you-set-up']" :form-rules="whatsLeftToGetYouSetUpFormRules" :syncing.sync="syncing" :cloud-error.sync="cloudError">
+          <div class="form-group">
+            <div class="form-group" :class="[formErrors.whatsLeftToGetSetUp ? 'is-invalid' : '']">
+              <label purpose="form-option" class="form-control" :class="[formData['whats-left-to-get-you-set-up'].whatsLeftToGetSetUp === 'need-premium-license-key' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['whats-left-to-get-you-set-up'].whatsLeftToGetSetUp" value="need-premium-license-key" @input="clickClearOneFormError('whatsLeftToGetSetUp')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                I need a Fleet Premium license key
+              </label>
+              <label purpose="form-option" class="form-control" :class="[formData['whats-left-to-get-you-set-up'].whatsLeftToGetSetUp === 'help-show-fleet-to-my-team' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['whats-left-to-get-you-set-up'].whatsLeftToGetSetUp" value="help-show-fleet-to-my-team" @input="clickClearOneFormError('whatsLeftToGetSetUp')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                I could use some help showing this to my team
+              </label>
+              <label purpose="form-option" class="form-control" :class="[formData['whats-left-to-get-you-set-up'].whatsLeftToGetSetUp === 'procurement-wants-some-stuff' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['whats-left-to-get-you-set-up'].whatsLeftToGetSetUp" value="procurement-wants-some-stuff" @input="clickClearOneFormError('whatsLeftToGetSetUp')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                Procurement wants some stuff
+              </label>
+              <label purpose="form-option" class="form-control" :class="[formData['whats-left-to-get-you-set-up'].whatsLeftToGetSetUp === 'nothing' ? 'selected' : '']">
+                <input type="radio" v-model.trim="formData['whats-left-to-get-you-set-up'].whatsLeftToGetSetUp" value="nothing" @input="clickClearOneFormError('whatsLeftToGetSetUp')">
+                <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
+                Nothing, I love Fleet!
+              </label>
+              <div class="invalid-feedback" v-if="formErrors.whatsLeftToGetSetUp">Please select an option</div>
+            </div>
+          </div>
+          <cloud-error v-if="cloudError"></cloud-error>
+          <div purpose="form-buttons">
+            <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
+            <ajax-button type="submit" purpose="submit-button" class="btn btn-primary" :syncing="syncing">Continue</ajax-button>
+          </div>
+        </ajax-form>
+      </div>
+      <%//  ┌─┐┌─┐┬  ┌─┐  ┬ ┬┌─┐┌─┐┌┬┐┌─┐┌┬┐  ┌┬┐┌─┐┌─┐┬  ┌─┐┬ ┬
+        //  └─┐├┤ │  ├┤───├─┤│ │└─┐ │ ├┤  ││   ││├┤ ├─┘│  │ │└┬┘
+        //  └─┘└─┘┴─┘└    ┴ ┴└─┘└─┘ ┴ └─┘─┴┘  ─┴┘└─┘┴  ┴─┘└─┘ ┴%>
+      <div v-if="currentStep === 'self-hosted-deploy'">
+        <div purpose="progress-bar-container">
+          <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 100%"></div></div>
+          <img purpose="success-icon" alt="🚀" src="/images/icon-form-success-16x16@2x.png">
         </div>
         <div class="mx-auto">
           <h2>Deploy Fleet in your environment</h2>
-          <p>Learn how to deploy and roll out Fleet in your environment.<br>
-            You can come back any time to continue or get help.</p>
+          <p>Learn how to deploy and rollout Fleet in your environment, get a Fleet Premium license, or both.</p>
         </div>
         <div purpose="start-cards">
           <a purpose="card" href="/docs/deploy">
@@ -557,208 +666,94 @@
             <h2>Deploy Fleet</h2>
             <p>Learn how to deploy Fleet</p>
           </a>
-          <a purpose="card" href="/support">
-            <img alt="Ask us anything" src="/images/icon-ask-anything-64x64@2x.png">
-            <h2>Got questions?</h2>
-            <p>Ask Fleet’s community of helpful, knowledgeable people.</p>
+
+          <a purpose="card" href="/new-license">
+            <img alt="Purchase a Fleet Premium license" src="/images/start-purchase-license-64x64@2x.png">
+            <h2>Get a license</h2>
+            <p>Purchase a Fleet Premium license</p>
+          </a>
+        </div>
+        <div purpose="form-tip" class="d-flex flex-row align-items-center justify-content-start">
+          <div><img alt="A lightbulb" src="/images/icon-suggestion-64x64@2x.png"></div>
+          <div>
+            <p>You can come back in any time to upgrade.</p>
+          </div>
+        </div>
+
+        <div purpose="form-buttons">
+          <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
+        </div>
+      </div>
+      <%//  ┌┬┐┌─┐┌┐┌┌─┐┌─┐┌─┐┌┬┐  ┌─┐┬  ┌─┐┬ ┬┌┬┐  ┌─┐┌─┐┬─┐  ┌─┐┬─┐┌─┐┬ ┬┬┌┐┌┌─┐
+        //  │││├─┤│││├─┤│ ┬├┤  ││  │  │  │ ││ │ ││  ├┤ │ │├┬┘  │ ┬├┬┘│ │││││││││ ┬
+        //  ┴ ┴┴ ┴┘└┘┴ ┴└─┘└─┘─┴┘  └─┘┴─┘└─┘└─┘─┴┘  └  └─┘┴└─  └─┘┴└─└─┘└┴┘┴┘└┘└─┘
+        //  ┌┬┐┌─┐┌─┐┬  ┌─┐┬ ┬┌┬┐┌─┐┌┐┌┌┬┐┌─┐
+        //   ││├┤ ├─┘│  │ │└┬┘│││├┤ │││ │ └─┐
+        //  ─┴┘└─┘┴  ┴─┘└─┘ ┴ ┴ ┴└─┘┘└┘ ┴ └─┘%>
+      <div v-if="currentStep === 'managed-cloud-for-growing-deployments'">
+        <div purpose="progress-bar-container">
+          <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 100%"></div></div>
+          <img purpose="success-icon" alt="🚀" src="/images/icon-form-success-16x16@2x.png">
+        </div>
+        <div class="mx-auto">
+          <h2>Managed cloud for growing deployments</h2>
+          <p>Unfortunately, managed cloud hosting is not yet available for growing deployments of less than 700 hosts.</p>
+        </div>
+        <div purpose="start-cards" class="justify-content-start">
+          <a purpose="card" href="/docs/deploy">
+            <img alt="Premium support" src="/images/icon-deploy-fleet-64x64@2x.png">
+            <h2>Deploy Fleet</h2>
+            <p>Learn how to deploy Fleet</p>
+          </a>
+        </div>
+        <div purpose="form-buttons">
+          <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
+        </div>
+      </div>
+      <%//  ┬ ┬┌─┐┬  ┌─┐┌─┐┌┬┐┌─┐  ┌┬┐┌─┐  ┌─┐┬  ┌─┐┌─┐┌┬┐
+        //  │││├┤ │  │  │ ││││├┤    │ │ │  ├┤ │  ├┤ ├┤  │
+        //  └┴┘└─┘┴─┘└─┘└─┘┴ ┴└─┘   ┴ └─┘  └  ┴─┘└─┘└─┘ ┴%>
+      <div v-if="currentStep === 'welcome-to-fleet'">
+        <div class="text-center mx-auto">
+          <h1>Welcome to Fleet</h1>
+          <p class="mb-0">Spin up a local demo or get your Fleet Premium license key.</p>
+        </div>
+        <div purpose="start-cards">
+          <a purpose="card" href="/try-fleet?start">
+            <img alt="Run a local demo of Fleet" src="/images/start-try-fleet-64x64@2x.png">
+            <h2>Try Fleet</h2>
+            <p>Run a local demo of Fleet</p>
+          </a>
+          <a purpose="card" href="/new-license">
+            <img alt="Purchase a Fleet Premium license" src="/images/start-purchase-license-64x64@2x.png">
+            <h2>Get a license</h2>
+            <p>Purchase a Fleet Premium license</p>
           </a>
         </div>
         <div purpose="logo-container">
-        <logo-carousel></logo-carousel>
+          <logo-carousel></logo-carousel>
         </div>
         <div purpose="form-buttons">
           <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
-          <ajax-button type="submit" purpose="submit-button" class="btn btn-primary" :syncing="syncing">Continue</ajax-button>
         </div>
-      </ajax-form>
-    </div>
-
-    <%//  ┬ ┬┌─┐┬ ┬  ┬ ┬┌─┐┌─┐  ┬ ┬┌─┐┬ ┬┬─┐  ┌┬┐┌─┐┌─┐┬  ┌─┐┬ ┬┌┬┐┌─┐┌┐┌┌┬┐
-      //  ├─┤│ ││││  │││├─┤└─┐  └┬┘│ ││ │├┬┘   ││├┤ ├─┘│  │ │└┬┘│││├┤ │││ │
-      //  ┴ ┴└─┘└┴┘  └┴┘┴ ┴└─┘   ┴ └─┘└─┘┴└─  ─┴┘└─┘┴  ┴─┘└─┘ ┴ ┴ ┴└─┘┘└┘ ┴%>
-    <div v-if="currentStep === 'how-was-your-deployment'">
-      <div purpose="progress-bar-container">
-        <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 90%"></div></div>
-        <img purpose="success-icon" alt="🏆" src="/images/icon-form-success-12x12@2x.png">
       </div>
-      <h2>How was your deployment?</h2>
-      <ajax-form :handle-submitting="handleSubmittingForm" :form-errors.sync="formErrors" :form-data="formData['how-was-your-deployment']" :form-rules="howWasYourDeploymentFormRules" :syncing.sync="syncing" :cloud-error.sync="cloudError">
-        <div class="form-group">
-          <div class="form-group" :class="[formErrors.howWasYourDeployment ? 'is-invalid' : '']">
-            <label purpose="form-option" class="form-control" :class="[formData['how-was-your-deployment'].howWasYourDeployment === 'up-and-running' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['how-was-your-deployment'].howWasYourDeployment" value="up-and-running" @input="clickClearOneFormError('howWasYourDeployment')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              I’m up and running!
-            </label>
-            <label purpose="form-option" class="form-control" :class="[formData['how-was-your-deployment'].howWasYourDeployment === 'kinda-stuck' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['how-was-your-deployment'].howWasYourDeployment" value="kinda-stuck" @input="clickClearOneFormError('howWasYourDeployment')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              I’m kinda stuck
-            </label>
-            <label purpose="form-option" class="form-control" :class="[formData['how-was-your-deployment'].howWasYourDeployment === 'havent-gotten-to-it' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['how-was-your-deployment'].howWasYourDeployment" value="havent-gotten-to-it" @input="clickClearOneFormError('howWasYourDeployment')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              I haven’t gotten to it yet
-            </label>
-            <label purpose="form-option" class="form-control" :class="[formData['how-was-your-deployment'].howWasYourDeployment === 'changed-mind-want-managed-deployment' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['how-was-your-deployment'].howWasYourDeployment" value="changed-mind-want-managed-deployment" @input="clickClearOneFormError('howWasYourDeployment')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              I changed my mind, can you deploy for me?
-            </label>
-            <label purpose="form-option" class="form-control" :class="[formData['how-was-your-deployment'].howWasYourDeployment === 'decided-to-not-use-fleet' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['how-was-your-deployment'].howWasYourDeployment" value="decided-to-not-use-fleet" @input="clickClearOneFormError('howWasYourDeployment')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              I decided not to use Fleet for now
-            </label>
-            <div class="invalid-feedback" v-if="formErrors.howWasYourDeployment">Please select an option</div>
+      <%//  ┌┬┐┬ ┬┌─┐┌┐┌┬┌─┌─┐  ┌─┐┌─┐┬─┐  ┌─┐┬ ┬┌─┐┌─┐┬┌─┬┌┐┌┌─┐  ┌─┐┬ ┬┌┬┐  ╔═╗┬  ┌─┐┌─┐┌┬┐
+        //   │ ├─┤├─┤│││├┴┐└─┐  ├┤ │ │├┬┘  │  ├─┤├┤ │  ├┴┐│││││ ┬  │ ││ │ │   ╠╣ │  ├┤ ├┤  │
+        //   ┴ ┴ ┴┴ ┴┘└┘┴ ┴└─┘  └  └─┘┴└─  └─┘┴ ┴└─┘└─┘┴ ┴┴┘└┘└─┘  └─┘└─┘ ┴   ╚  ┴─┘└─┘└─┘ ┴ %>
+      <div v-if="currentStep === 'thanks-for-checking-out-fleet'">
+        <ajax-form :handle-submitting="handleSubmittingForm" :form-errors.sync="formErrors" :form-data="formData['thanks-for-checking-out-fleet']" :form-rules="formRules" :syncing.sync="syncing" :cloud-error.sync="cloudError">
+          <div style="padding-top: 50px;" class="mx-auto">
+            <h2>Thanks for checking out Fleet</h2>
+            <p>Come back at any time to pick up where you left off.</p>
           </div>
-        </div>
-        <cloud-error v-if="cloudError"></cloud-error>
-        <div purpose="form-buttons">
-          <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
-          <ajax-button type="submit" purpose="submit-button" class="btn btn-primary" :syncing="syncing">Continue</ajax-button>
-        </div>
-      </ajax-form>
-    </div>
-    <%//  ╦ ╦┬ ┬┌─┐┌┬┐┌─┐  ┬  ┌─┐┌─┐┌┬┐  ┌┬┐┌─┐  ┌─┐┌─┐┌┬┐  ┬ ┬┌─┐┬ ┬  ┌─┐┌─┐┌┬┐  ┬ ┬┌─┐
-      //  ║║║├─┤├─┤ │ └─┐  │  ├┤ ├┤  │    │ │ │  │ ┬├┤  │   └┬┘│ ││ │  └─┐├┤  │   │ │├─┘
-      //  ╚╩╝┴ ┴┴ ┴ ┴ └─┘  ┴─┘└─┘└   ┴    ┴ └─┘  └─┘└─┘ ┴    ┴ └─┘└─┘  └─┘└─┘ ┴   └─┘┴%>
-    <div v-if="currentStep === 'whats-left-to-get-you-set-up'">
-      <div purpose="progress-bar-container">
-        <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 100%"></div></div>
-        <img purpose="success-icon" alt="🏆" src="/images/icon-form-success-12x12@2x.png">
-      </div>
-      <h2>What’s left to get you set up?</h2>
-      <ajax-form :handle-submitting="handleSubmittingForm" :form-errors.sync="formErrors" :form-data="formData['whats-left-to-get-you-set-up']" :form-rules="whatsLeftToGetYouSetUpFormRules" :syncing.sync="syncing" :cloud-error.sync="cloudError">
-        <div class="form-group">
-          <div class="form-group" :class="[formErrors.whatsLeftToGetSetUp ? 'is-invalid' : '']">
-            <label purpose="form-option" class="form-control" :class="[formData['whats-left-to-get-you-set-up'].whatsLeftToGetSetUp === 'need-premium-license-key' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['whats-left-to-get-you-set-up'].whatsLeftToGetSetUp" value="need-premium-license-key" @input="clickClearOneFormError('whatsLeftToGetSetUp')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              I need a Fleet Premium license key
-            </label>
-            <label purpose="form-option" class="form-control" :class="[formData['whats-left-to-get-you-set-up'].whatsLeftToGetSetUp === 'help-show-fleet-to-my-team' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['whats-left-to-get-you-set-up'].whatsLeftToGetSetUp" value="help-show-fleet-to-my-team" @input="clickClearOneFormError('whatsLeftToGetSetUp')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              I could use some help showing this to my team
-            </label>
-            <label purpose="form-option" class="form-control" :class="[formData['whats-left-to-get-you-set-up'].whatsLeftToGetSetUp === 'procurement-wants-some-stuff' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['whats-left-to-get-you-set-up'].whatsLeftToGetSetUp" value="procurement-wants-some-stuff" @input="clickClearOneFormError('whatsLeftToGetSetUp')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              Procurement wants some stuff
-            </label>
-            <label purpose="form-option" class="form-control" :class="[formData['whats-left-to-get-you-set-up'].whatsLeftToGetSetUp === 'nothing' ? 'selected' : '']">
-              <input type="radio" v-model.trim="formData['whats-left-to-get-you-set-up'].whatsLeftToGetSetUp" value="nothing" @input="clickClearOneFormError('whatsLeftToGetSetUp')">
-              <span purpose="custom-radio"><span purpose="custom-radio-selected"></span></span>
-              Nothing, I love Fleet!
-            </label>
-            <div class="invalid-feedback" v-if="formErrors.whatsLeftToGetSetUp">Please select an option</div>
+          <div purpose="form-buttons">
+            <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
+            <ajax-button type="submit" purpose="submit-button" class="btn btn-primary" :syncing="syncing">Done</ajax-button>
           </div>
-        </div>
-        <cloud-error v-if="cloudError"></cloud-error>
-        <div purpose="form-buttons">
-          <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
-          <ajax-button type="submit" purpose="submit-button" class="btn btn-primary" :syncing="syncing">Continue</ajax-button>
-        </div>
-      </ajax-form>
-    </div>
-    <%//  ┌─┐┌─┐┬  ┌─┐  ┬ ┬┌─┐┌─┐┌┬┐┌─┐┌┬┐  ┌┬┐┌─┐┌─┐┬  ┌─┐┬ ┬
-      //  └─┐├┤ │  ├┤───├─┤│ │└─┐ │ ├┤  ││   ││├┤ ├─┘│  │ │└┬┘
-      //  └─┘└─┘┴─┘└    ┴ ┴└─┘└─┘ ┴ └─┘─┴┘  ─┴┘└─┘┴  ┴─┘└─┘ ┴%>
-    <div v-if="currentStep === 'self-hosted-deploy'">
-      <div purpose="progress-bar-container">
-        <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 100%"></div></div>
-        <img purpose="success-icon" alt="🏆" src="/images/icon-form-success-12x12@2x.png">
-      </div>
-      <div class="mx-auto">
-        <h2>Deploy Fleet in your environment</h2>
-        <p>Learn how to deploy and rollout Fleet in your environment, get a Fleet Premium license, or both. You can come back in any time to upgrade.</p>
-      </div>
-      <div purpose="start-cards">
-        <a purpose="card" href="/docs/deploy">
-          <img alt="Premium support" src="/images/icon-deploy-fleet-64x64@2x.png">
-          <h2>Deploy Fleet</h2>
-          <p>Learn how to deploy Fleet</p>
-        </a>
-
-        <a purpose="card" href="/new-license">
-          <img alt="Purchase a Fleet Premium license" src="/images/start-purchase-license-64x64@2x.png">
-          <h2>Get a license</h2>
-          <p>Purchase a Fleet Premium license</p>
-        </a>
-      </div>
-      <div purpose="form-buttons">
-        <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
+        </ajax-form>
       </div>
     </div>
-    <%//  ┌┬┐┌─┐┌┐┌┌─┐┌─┐┌─┐┌┬┐  ┌─┐┬  ┌─┐┬ ┬┌┬┐  ┌─┐┌─┐┬─┐  ┌─┐┬─┐┌─┐┬ ┬┬┌┐┌┌─┐
-      //  │││├─┤│││├─┤│ ┬├┤  ││  │  │  │ ││ │ ││  ├┤ │ │├┬┘  │ ┬├┬┘│ │││││││││ ┬
-      //  ┴ ┴┴ ┴┘└┘┴ ┴└─┘└─┘─┴┘  └─┘┴─┘└─┘└─┘─┴┘  └  └─┘┴└─  └─┘┴└─└─┘└┴┘┴┘└┘└─┘
-      //  ┌┬┐┌─┐┌─┐┬  ┌─┐┬ ┬┌┬┐┌─┐┌┐┌┌┬┐┌─┐
-      //   ││├┤ ├─┘│  │ │└┬┘│││├┤ │││ │ └─┐
-      //  ─┴┘└─┘┴  ┴─┘└─┘ ┴ ┴ ┴└─┘┘└┘ ┴ └─┘%>
-    <div v-if="currentStep === 'managed-cloud-for-growing-deployments'">
-      <div purpose="progress-bar-container">
-        <div purpose="form-progress-bar"><div purpose="current-progress" style="width: 100%"></div></div>
-        <img purpose="success-icon" alt="🏆" src="/images/icon-form-success-12x12@2x.png">
-      </div>
-      <div class="mx-auto">
-        <h2>Managed cloud for growing deployments</h2>
-        <p>Unfortunately, managed cloud hosting is not yet available for growing deployments of less than 700 hosts.</p>
-      </div>
-      <div purpose="start-cards" class="justify-content-start">
-        <a purpose="card" href="/docs/deploy">
-          <img alt="Premium support" src="/images/icon-deploy-fleet-64x64@2x.png">
-          <h2>Deploy Fleet</h2>
-          <p>Learn how to deploy Fleet</p>
-        </a>
-      </div>
-      <div purpose="form-buttons">
-        <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
-      </div>
-    </div>
-    <%//  ┬ ┬┌─┐┬  ┌─┐┌─┐┌┬┐┌─┐  ┌┬┐┌─┐  ┌─┐┬  ┌─┐┌─┐┌┬┐
-      //  │││├┤ │  │  │ ││││├┤    │ │ │  ├┤ │  ├┤ ├┤  │
-      //  └┴┘└─┘┴─┘└─┘└─┘┴ ┴└─┘   ┴ └─┘  └  ┴─┘└─┘└─┘ ┴%>
-    <div v-if="currentStep === 'welcome-to-fleet'">
-      <div class="text-center mx-auto">
-        <h1>Welcome to Fleet</h1>
-        <p class="mb-0">Spin up a local demo or get your Fleet Premium license key.</p>
-      </div>
-      <div purpose="start-cards">
-        <a purpose="card" href="/try-fleet?start">
-          <img alt="Run a local demo of Fleet" src="/images/start-try-fleet-64x64@2x.png">
-          <h2>Try Fleet</h2>
-          <p>Run a local demo of Fleet</p>
-        </a>
-        <a purpose="card" href="/new-license">
-          <img alt="Purchase a Fleet Premium license" src="/images/start-purchase-license-64x64@2x.png">
-          <h2>Get a license</h2>
-          <p>Purchase a Fleet Premium license</p>
-        </a>
-      </div>
-      <div purpose="logo-container">
-        <logo-carousel></logo-carousel>
-      </div>
-      <div purpose="form-buttons">
-        <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
-      </div>
-    </div>
-    <%//  ┌┬┐┬ ┬┌─┐┌┐┌┬┌─┌─┐  ┌─┐┌─┐┬─┐  ┌─┐┬ ┬┌─┐┌─┐┬┌─┬┌┐┌┌─┐  ┌─┐┬ ┬┌┬┐  ╔═╗┬  ┌─┐┌─┐┌┬┐
-      //   │ ├─┤├─┤│││├┴┐└─┐  ├┤ │ │├┬┘  │  ├─┤├┤ │  ├┴┐│││││ ┬  │ ││ │ │   ╠╣ │  ├┤ ├┤  │
-      //   ┴ ┴ ┴┴ ┴┘└┘┴ ┴└─┘  └  └─┘┴└─  └─┘┴ ┴└─┘└─┘┴ ┴┴┘└┘└─┘  └─┘└─┘ ┴   ╚  ┴─┘└─┘└─┘ ┴ %>
-    <div v-if="currentStep === 'thanks-for-checking-out-fleet'">
-      <ajax-form :handle-submitting="handleSubmittingForm" :form-errors.sync="formErrors" :form-data="formData['thanks-for-checking-out-fleet']" :form-rules="formRules" :syncing.sync="syncing" :cloud-error.sync="cloudError">
-        <div style="padding-top: 50px;" class="mx-auto">
-          <h2>Thanks for checking out Fleet</h2>
-          <p>Come back at any time to pick up where you left off.</p>
-        </div>
-        <div purpose="form-buttons">
-          <a purpose="back-button" @click="clickGoToPreviousStep()">Back</a>
-          <ajax-button type="submit" purpose="submit-button" class="btn btn-primary" :syncing="syncing">Done</ajax-button>
-        </div>
-      </ajax-form>
-    </div>
+    <div purpose="form-image" :class="currentStep === 'start' ? 'stage-one' : ['thanks-for-checking-out-fleet', 'what-did-you-think'].includes(currentStep) ? 'cloud-city' : ['2 - Aware'].includes(psychologicalStage) ? 'stage-two' : ['3 - Intrigued'].includes(psychologicalStage) ? 'stage-three' : ['4 - Has use case'].includes(psychologicalStage) ? 'stage-four' : ['5 - Personally confident'].includes(psychologicalStage) ? 'stage-five' : ['6 - Has team buy-in'].includes(psychologicalStage) ? 'stage-six' : 'd-none w-0'">
     </div>
   </div>
 </div>
diff --git a/website/views/pages/vulnerability-management.ejs b/website/views/pages/vulnerability-management.ejs
index bf571b88ac..e1f3982eb7 100644
--- a/website/views/pages/vulnerability-management.ejs
+++ b/website/views/pages/vulnerability-management.ejs
@@ -3,8 +3,8 @@
     <div purpose="page-content" class="mx-auto">
       <div purpose="hero">
         <div purpose="page-headline">
-          <h4>Vulnerability management</h4>
-          <h2>Build the vulnerability program you actually want</h2>
+          <h4>Open-source vulnerability reporting</h4>
+          <h2>Check vulnerabilities anywhere</h2>
         </div>
         <div purpose="hero-content" class="d-flex flex-md-row flex-column align-items-center justify-content-between">
           <div purpose="hero-image">
@@ -12,14 +12,14 @@
           </div>
           <div purpose="hero-text">
             <strong>Report what matters</strong>
-            <p>Let's face it, most built-in graphs leave you wanting more. Report MTTR and any other custom metrics exactly the way you want to using fresh data from real computers.</p>
+            <p>Report exactly when CVEs were fixed or mitigated, down to the hour.</p>
             <strong>Deep context from the environment</strong>
             <p>Fleet gives you data down to the chip level on every endpoint to help you make sense of which vulnerabilities to prioritize.</p>
             <strong>Untangle your security stack</strong>
             <p>Use open data and APIs to connect your vulnerability solution with osquery, the agent you might already have deployed.</p>
             <div purpose="button-row" class="d-flex flex-md-row flex-column justify-content-start align-items-center">
-              <a purpose="cta-button" href="/register">Start now</a>
-              <animated-arrow-button href="/contact">Talk to us</animated-arrow-button>
+              <a purpose="cta-button" href="/register">Try localhost</a>
+              <animated-arrow-button href="/support">Ask us anything</animated-arrow-button>
             </div>
           </div>
         </div>
@@ -140,11 +140,11 @@
     <div purpose="page-container" class="pb-0 container">
 
       <div purpose="section-heading" class="text-center">
-        <h4>Open-source vulnerability management</h4>
-        <h2>Build the vulnerability program you actually want</h2>
+        <h4>Open-source vulnerability reporting</h4>
+        <h2>Check vulnerabilities anywhere</h2>
         <div purpose="button-row" style="margin-top: 32px;" class="d-flex flex-md-row flex-column justify-content-center align-items-center mx-auto">
-          <a purpose="cta-button" href="/register">Start now</a>
-          <animated-arrow-button href="/contact">Talk to us</animated-arrow-button>
+          <a purpose="cta-button" href="/register">Try localhost</a>
+          <animated-arrow-button href="/support">Get help</animated-arrow-button>
         </div>
       </div>
     </div>
diff --git a/website/views/partials/continue.partial.ejs b/website/views/partials/continue.partial.ejs
index 1a7fd4107a..0b40f49ffa 100644
--- a/website/views/partials/continue.partial.ejs
+++ b/website/views/partials/continue.partial.ejs
@@ -4,7 +4,7 @@
   <div purpose="continue-banner" id="start-cta" class="d-flex justify-content-end">
     <div purpose="banner-body" class="d-flex flex-row align-items-center invisible <%- collapseStartCta ? 'collapsed' : ''%>">
       <div purpose="banner-image-background">
-        <div purpose="banner-image">
+        <div purpose="banner-image" class="<%=['2 - Aware'].includes(me.psychologicalStage) ? 'stage-two' : ['3 - Intrigued'].includes(me.psychologicalStage) ? 'stage-three' : ['4 - Has use case'].includes(me.psychologicalStage) ? 'stage-four' : ['5 - Personally confident'].includes(me.psychologicalStage) ? 'stage-five' : ['6 - Has team buy-in'].includes(me.psychologicalStage) ? 'stage-six' : ''%>">
         </div>
       </div>
       <div purpose="banner-text" class="d-flex flex-column justify-content-center">
diff --git a/yarn.lock b/yarn.lock
index eb3cec87a2..a5b02c2e19 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -4869,6 +4869,11 @@
   dependencies:
     "@types/node" "*"
 
+"@types/content-disposition@0.5.4":
+  version "0.5.4"
+  resolved "https://registry.yarnpkg.com/@types/content-disposition/-/content-disposition-0.5.4.tgz#de48cf01c79c9f1560bcfd8ae43217ab028657f8"
+  integrity sha512-0mPF08jn9zYI0n0Q/Pnz7C4kThdSt+6LD4amsrYDDpgBfrVWa3TcCOxKX1zkGgYniGagRv8heN2cbh+CAn+uuQ==
+
 "@types/cookie@^0.4.1":
   version "0.4.1"
   resolved "https://registry.yarnpkg.com/@types/cookie/-/cookie-0.4.1.tgz#bfd02c1f2224567676c1545199f87c3a861d878d"
@@ -6303,12 +6308,12 @@ axe-core@^4.2.0:
   resolved "https://registry.yarnpkg.com/axe-core/-/axe-core-4.7.0.tgz#34ba5a48a8b564f67e103f0aa5768d76e15bbbbf"
   integrity sha512-M0JtH+hlOL5pLQwHOLNYZaXuhqmvS8oExsqB1SBYgA4Dk7u/xx+YdGHXaK5pyUfed5mYXdlYiphWq3G8cRi5JQ==
 
-axios@1.6.0:
-  version "1.6.0"
-  resolved "https://registry.yarnpkg.com/axios/-/axios-1.6.0.tgz#f1e5292f26b2fd5c2e66876adc5b06cdbd7d2102"
-  integrity sha512-EZ1DYihju9pwVB+jg67ogm+Tmqc6JmhamRN6I4Zt8DfZu5lbcQGw3ozH9lFejSJgs/ibaef3A9PMXPLeefFGJg==
+axios@1.7.4:
+  version "1.7.4"
+  resolved "https://registry.yarnpkg.com/axios/-/axios-1.7.4.tgz#4c8ded1b43683c8dd362973c393f3ede24052aa2"
+  integrity sha512-DukmaFRnY6AzAALSH4J2M3k6PkaC+MfaAGdEERRWcC9q3/TWQwLpHR8ZRLKTdQ3aBDL64EdluRDjJqKw+BPZEw==
   dependencies:
-    follow-redirects "^1.15.0"
+    follow-redirects "^1.15.6"
     form-data "^4.0.0"
     proxy-from-env "^1.1.0"
 
@@ -6610,10 +6615,10 @@ bn.js@^5.0.0, bn.js@^5.2.1:
   resolved "https://registry.yarnpkg.com/bn.js/-/bn.js-5.2.1.tgz#0bc527a6a0d18d0aa8d5b0538ce4a77dccfa7b70"
   integrity sha512-eXRvHzWyYPBuB4NBy0cmYQjGitUrtqwbvlzP3G6VFnNRbsZQIxQ10PbKKHt8gZ/HW/D/747aDl+QkDqg3KQLMQ==
 
-body-parser@1.20.2:
-  version "1.20.2"
-  resolved "https://registry.yarnpkg.com/body-parser/-/body-parser-1.20.2.tgz#6feb0e21c4724d06de7ff38da36dad4f57a747fd"
-  integrity sha512-ml9pReCu3M61kGlqoTm2umSXTlRTuGTx0bfYj+uIUKKYycG5NtSbeetV3faSU6R7ajOPw0g/J1PvK4qNy7s5bA==
+body-parser@1.20.3:
+  version "1.20.3"
+  resolved "https://registry.yarnpkg.com/body-parser/-/body-parser-1.20.3.tgz#1953431221c6fb5cd63c4b36d53fab0928e548c6"
+  integrity sha512-7rAxByjUMqQ3/bHJy7D6OGXvx/MMc4IqBn/X0fcM1QUcAItpZrBEYhWGem+tzXH90c+G01ypMcYJBO9Y30203g==
   dependencies:
     bytes "3.1.2"
     content-type "~1.0.5"
@@ -6623,7 +6628,7 @@ body-parser@1.20.2:
     http-errors "2.0.0"
     iconv-lite "0.4.24"
     on-finished "2.4.1"
-    qs "6.11.0"
+    qs "6.13.0"
     raw-body "2.5.2"
     type-is "~1.6.18"
     unpipe "1.0.0"
@@ -6665,7 +6670,7 @@ brace-expansion@^2.0.1:
   dependencies:
     balanced-match "^1.0.0"
 
-braces@^3.0.2, braces@~3.0.2:
+braces@^3.0.3, braces@~3.0.2:
   version "3.0.3"
   resolved "https://registry.yarnpkg.com/braces/-/braces-3.0.3.tgz#490332f40919452272d55a8480adc0c441358789"
   integrity sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==
@@ -6952,6 +6957,17 @@ call-bind@^1.0.0, call-bind@^1.0.2:
     function-bind "^1.1.1"
     get-intrinsic "^1.0.2"
 
+call-bind@^1.0.7:
+  version "1.0.7"
+  resolved "https://registry.yarnpkg.com/call-bind/-/call-bind-1.0.7.tgz#06016599c40c56498c18769d2730be242b6fa3b9"
+  integrity sha512-GHTSNSYICQ7scH7sZ+M2rFopRoLh8t2bLSW6BbgrtLsahOIB5iyAVJf9GjWK3cYTDaMj4XdBpM1cA6pIS0Kv2w==
+  dependencies:
+    es-define-property "^1.0.0"
+    es-errors "^1.3.0"
+    function-bind "^1.1.2"
+    get-intrinsic "^1.2.4"
+    set-function-length "^1.2.1"
+
 callsites@^3.0.0:
   version "3.1.0"
   resolved "https://registry.yarnpkg.com/callsites/-/callsites-3.1.0.tgz#b3630abd8943432f54b3f0519238e33cd7df2f73"
@@ -7834,6 +7850,15 @@ defaults@^1.0.3:
   dependencies:
     clone "^1.0.2"
 
+define-data-property@^1.1.4:
+  version "1.1.4"
+  resolved "https://registry.yarnpkg.com/define-data-property/-/define-data-property-1.1.4.tgz#894dc141bb7d3060ae4366f6a0107e68fbe48c5e"
+  integrity sha512-rBMvIzlpA8v6E+SJZoo++HAYqsLrkg7MSfIinMPFhmkorw7X+dOXVJQs+QT69zGkzMyfDnIMN2Wid1+NbL3T+A==
+  dependencies:
+    es-define-property "^1.0.0"
+    es-errors "^1.3.0"
+    gopd "^1.0.1"
+
 define-lazy-prop@^2.0.0:
   version "2.0.0"
   resolved "https://registry.yarnpkg.com/define-lazy-prop/-/define-lazy-prop-2.0.0.tgz#3f7ae421129bcaaac9bc74905c98a0009ec9ee7f"
@@ -8101,10 +8126,10 @@ domhandler@^4.0.0, domhandler@^4.2.0, domhandler@^4.3.0:
   dependencies:
     domelementtype "^2.2.0"
 
-dompurify@3.0.3:
-  version "3.0.3"
-  resolved "https://registry.yarnpkg.com/dompurify/-/dompurify-3.0.3.tgz#4b115d15a091ddc96f232bcef668550a2f6f1430"
-  integrity sha512-axQ9zieHLnAnHh0sfAamKYiqXMJAVwu+LM/alQ7WDagoWessyWvMSFyW65CqF3owufNu8HBcE4cM2Vflu7YWcQ==
+dompurify@3.1.3:
+  version "3.1.3"
+  resolved "https://registry.yarnpkg.com/dompurify/-/dompurify-3.1.3.tgz#cfe3ce4232c216d923832f68f2aa18b2fb9bd223"
+  integrity sha512-5sOWYSNPaxz6o2MUPvtyxTTqR4D3L77pr5rUQoWgD5ROQtVIZQgJkXbo1DLlK3vj11YGw5+LnF4SYti4gZmwng==
 
 domutils@^1.5.1:
   version "1.7.0"
@@ -8189,9 +8214,9 @@ electron-to-chromium@^1.4.668:
   integrity sha512-RTRvkmRkGhNBPPpdrgtDKvmOEYTrPlXDfc0J/Nfq5s29tEahAwhiX4mmhNzj6febWMleulxVYPh7QwCSL/EldA==
 
 elliptic@^6.5.3, elliptic@^6.5.4:
-  version "6.5.4"
-  resolved "https://registry.yarnpkg.com/elliptic/-/elliptic-6.5.4.tgz#da37cebd31e79a1367e941b592ed1fbebd58abbb"
-  integrity sha512-iLhC6ULemrljPZb+QutR5TQGB+pdW6KGD5RSegS+8sorOZT+rdQFbsQFJgvN3eRqNALqJer4oQ16YvJHlU8hzQ==
+  version "6.5.7"
+  resolved "https://registry.yarnpkg.com/elliptic/-/elliptic-6.5.7.tgz#8ec4da2cb2939926a1b9a73619d768207e647c8b"
+  integrity sha512-ESVCtTwiA+XhY3wyh24QqRGBoP3rEdDUl3EDUUo9tft074fi19IrdpH7hLCMMP3CIj7jb3W96rn8lt/BqIlt5Q==
   dependencies:
     bn.js "^4.11.9"
     brorand "^1.1.0"
@@ -8236,6 +8261,11 @@ encodeurl@~1.0.2:
   resolved "https://registry.npmjs.org/encodeurl/-/encodeurl-1.0.2.tgz"
   integrity sha1-rT/0yG7C0CkyL1oCw6mmBslbP1k=
 
+encodeurl@~2.0.0:
+  version "2.0.0"
+  resolved "https://registry.yarnpkg.com/encodeurl/-/encodeurl-2.0.0.tgz#7b8ea898077d7e409d3ac45474ea38eaf0857a58"
+  integrity sha512-Q0n9HRi4m6JuGIV1eFlmvJB7ZEVxu93IrMyiMsGC0lrMJMWzRgx6WGquyfQgZVb31vhGgXnfmPNNXmxnOkRBrg==
+
 encoding@^0.1.12, encoding@^0.1.13:
   version "0.1.13"
   resolved "https://registry.npmjs.org/encoding/-/encoding-0.1.13.tgz"
@@ -8390,6 +8420,18 @@ es-abstract@^1.19.0, es-abstract@^1.19.1, es-abstract@^1.20.4:
     unbox-primitive "^1.0.2"
     which-typed-array "^1.1.9"
 
+es-define-property@^1.0.0:
+  version "1.0.0"
+  resolved "https://registry.yarnpkg.com/es-define-property/-/es-define-property-1.0.0.tgz#c7faefbdff8b2696cf5f46921edfb77cc4ba3845"
+  integrity sha512-jxayLKShrEqqzJ0eumQbVhTYQM27CfT1T35+gCgDFoL82JLsXqTJ76zv6A0YLOgEnLUMvLzsDsGIrl8NFpT2gQ==
+  dependencies:
+    get-intrinsic "^1.2.4"
+
+es-errors@^1.3.0:
+  version "1.3.0"
+  resolved "https://registry.yarnpkg.com/es-errors/-/es-errors-1.3.0.tgz#05f75a25dab98e4fb1dcd5e1472c0546d5057c8f"
+  integrity sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==
+
 es-get-iterator@^1.1.2:
   version "1.1.3"
   resolved "https://registry.yarnpkg.com/es-get-iterator/-/es-get-iterator-1.1.3.tgz#3ef87523c5d464d41084b2c3c9c214f1199763d6"
@@ -9058,37 +9100,37 @@ expect@^29.2.0:
     jest-message-util "^29.2.0"
     jest-util "^29.2.0"
 
-express@4.19.2, express@^4.17.3:
-  version "4.19.2"
-  resolved "https://registry.yarnpkg.com/express/-/express-4.19.2.tgz#e25437827a3aa7f2a827bc8171bbbb664a356465"
-  integrity sha512-5T6nhjsT+EOMzuck8JjBHARTHfMht0POzlA60WV2pMD3gyXw2LZnZ+ueGdNxG+0calOJcWKbpFcuzLZ91YWq9Q==
+express@4.20.0, express@^4.17.3:
+  version "4.20.0"
+  resolved "https://registry.yarnpkg.com/express/-/express-4.20.0.tgz#f1d08e591fcec770c07be4767af8eb9bcfd67c48"
+  integrity sha512-pLdae7I6QqShF5PnNTCVn4hI91Dx0Grkn2+IAsMTgMIKuQVte2dN9PeGSSAME2FR8anOhVA62QDIUaWVfEXVLw==
   dependencies:
     accepts "~1.3.8"
     array-flatten "1.1.1"
-    body-parser "1.20.2"
+    body-parser "1.20.3"
     content-disposition "0.5.4"
     content-type "~1.0.4"
     cookie "0.6.0"
     cookie-signature "1.0.6"
     debug "2.6.9"
     depd "2.0.0"
-    encodeurl "~1.0.2"
+    encodeurl "~2.0.0"
     escape-html "~1.0.3"
     etag "~1.8.1"
     finalhandler "1.2.0"
     fresh "0.5.2"
     http-errors "2.0.0"
-    merge-descriptors "1.0.1"
+    merge-descriptors "1.0.3"
     methods "~1.1.2"
     on-finished "2.4.1"
     parseurl "~1.3.3"
-    path-to-regexp "0.1.7"
+    path-to-regexp "0.1.10"
     proxy-addr "~2.0.7"
     qs "6.11.0"
     range-parser "~1.2.1"
     safe-buffer "5.2.1"
-    send "0.18.0"
-    serve-static "1.15.0"
+    send "0.19.0"
+    serve-static "1.16.0"
     setprototypeof "1.2.0"
     statuses "2.0.1"
     type-is "~1.6.18"
@@ -9352,7 +9394,7 @@ flow-parser@0.*:
   resolved "https://registry.yarnpkg.com/flow-parser/-/flow-parser-0.205.0.tgz#8756173b6488dedc31ab838e80c8f008d7a44e05"
   integrity sha512-ZJ6VuLe/BoqeI4GsF+ZuzlpfGi3FCnBrb4xDYhgEJxRt7SAj3ibRuRSsuJSRcY+lQhPZRPNbNWiQqFMxramUzw==
 
-follow-redirects@^1.15.0:
+follow-redirects@^1.15.0, follow-redirects@^1.15.6:
   version "1.15.6"
   resolved "https://registry.yarnpkg.com/follow-redirects/-/follow-redirects-1.15.6.tgz#7f815c0cda4249c74ff09e95ef97c23b5fd0399b"
   integrity sha512-wWN62YITEaOpSK584EZXJafH1AGpO8RVgElfkuXbTOrPX4fIfOyEpW/CsiNd8JdYrAoOvafRTOEnvsO++qCqFA==
@@ -9595,6 +9637,17 @@ get-intrinsic@^1.0.2, get-intrinsic@^1.1.1, get-intrinsic@^1.1.3, get-intrinsic@
     has "^1.0.3"
     has-symbols "^1.0.3"
 
+get-intrinsic@^1.2.4:
+  version "1.2.4"
+  resolved "https://registry.yarnpkg.com/get-intrinsic/-/get-intrinsic-1.2.4.tgz#e385f5a4b5227d449c3eabbad05494ef0abbeadd"
+  integrity sha512-5uYhsJH8VJBTv7oslg4BznJYhDoRI6waYCxMmCdnTrcCrHA/fCFKoTFz2JKKE0HdDFUF7/oQuhzumXJK7paBRQ==
+  dependencies:
+    es-errors "^1.3.0"
+    function-bind "^1.1.2"
+    has-proto "^1.0.1"
+    has-symbols "^1.0.3"
+    hasown "^2.0.0"
+
 get-nonce@^1.0.0:
   version "1.0.1"
   resolved "https://registry.yarnpkg.com/get-nonce/-/get-nonce-1.0.1.tgz#fdf3f0278073820d2ce9426c18f07481b1e0cdf3"
@@ -9882,6 +9935,13 @@ has-property-descriptors@^1.0.0:
   dependencies:
     get-intrinsic "^1.1.1"
 
+has-property-descriptors@^1.0.2:
+  version "1.0.2"
+  resolved "https://registry.yarnpkg.com/has-property-descriptors/-/has-property-descriptors-1.0.2.tgz#963ed7d071dc7bf5f084c5bfbe0d1b6222586854"
+  integrity sha512-55JNKuIW+vq4Ke1BjOTjM2YctQIvCT7GFzHwmfZPGo5wnrgkid0YQtnAleFSqumZm4az3n2BS+erby5ipJdgrg==
+  dependencies:
+    es-define-property "^1.0.0"
+
 has-proto@^1.0.1:
   version "1.0.1"
   resolved "https://registry.yarnpkg.com/has-proto/-/has-proto-1.0.1.tgz#1885c1305538958aff469fef37937c22795408e0"
@@ -12596,10 +12656,10 @@ meow@^9.0.0:
     type-fest "^0.18.0"
     yargs-parser "^20.2.3"
 
-merge-descriptors@1.0.1:
-  version "1.0.1"
-  resolved "https://registry.npmjs.org/merge-descriptors/-/merge-descriptors-1.0.1.tgz"
-  integrity sha1-sAqqVW3YtEVoFQ7J0blT8/kMu2E=
+merge-descriptors@1.0.3:
+  version "1.0.3"
+  resolved "https://registry.yarnpkg.com/merge-descriptors/-/merge-descriptors-1.0.3.tgz#d80319a65f3c7935351e5cfdac8f9318504dbed5"
+  integrity sha512-gaNvAS7TZ897/rVaZ0nMtAyxNyi/pdbjbAwUpFQpN70GqnVfOiXpeUUMKRBmzXaSQ8DdTX4/0ms62r2K+hE6mQ==
 
 merge-stream@^2.0.0:
   version "2.0.0"
@@ -12892,11 +12952,11 @@ micromark@^3.0.0:
     uvu "^0.5.0"
 
 micromatch@^4.0.0, micromatch@^4.0.2, micromatch@^4.0.4:
-  version "4.0.5"
-  resolved "https://registry.yarnpkg.com/micromatch/-/micromatch-4.0.5.tgz#bc8999a7cbbf77cdc89f132f6e467051b49090c6"
-  integrity sha512-DMy+ERcEW2q8Z2Po+WNXuw3c5YaUSFjAO5GsJqfEl7UjvtIuFKO6ZrKvcItdy98dwFI2N1tg3zNIdKaQT+aNdA==
+  version "4.0.8"
+  resolved "https://registry.yarnpkg.com/micromatch/-/micromatch-4.0.8.tgz#d66fa18f3a47076789320b9b1af32bd86d9fa202"
+  integrity sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==
   dependencies:
-    braces "^3.0.2"
+    braces "^3.0.3"
     picomatch "^2.3.1"
 
 microseconds@0.2.0:
@@ -13477,6 +13537,11 @@ object-inspect@^1.1.0, object-inspect@^1.12.0, object-inspect@^1.12.2, object-in
   resolved "https://registry.yarnpkg.com/object-inspect/-/object-inspect-1.12.3.tgz#ba62dffd67ee256c8c086dfae69e016cd1f198b9"
   integrity sha512-geUvdk7c+eizMNUDkRpW1wJwgfOiOeHbxBR/hLXK1aT6zmVSO0jsQcs7fj6MGw89jC/cjGfLcNOrtMYtGqm81g==
 
+object-inspect@^1.13.1:
+  version "1.13.2"
+  resolved "https://registry.yarnpkg.com/object-inspect/-/object-inspect-1.13.2.tgz#dea0088467fb991e67af4058147a24824a3043ff"
+  integrity sha512-IRZSRuzJiynemAXPYtPe5BoI/RESNYR7TYm50MC5Mqbd3Jmw5y790sErYw3V6SryFJD64b74qQQs9wn5Bg/k3g==
+
 object-is@^1.0.1:
   version "1.1.5"
   resolved "https://registry.npmjs.org/object-is/-/object-is-1.1.5.tgz"
@@ -13859,10 +13924,10 @@ path-scurry@^1.10.1:
     lru-cache "^9.1.1 || ^10.0.0"
     minipass "^5.0.0 || ^6.0.2 || ^7.0.0"
 
-path-to-regexp@0.1.7:
-  version "0.1.7"
-  resolved "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-0.1.7.tgz"
-  integrity sha1-32BBeABfUi8V60SQ5yR6G/qmf4w=
+path-to-regexp@0.1.10:
+  version "0.1.10"
+  resolved "https://registry.yarnpkg.com/path-to-regexp/-/path-to-regexp-0.1.10.tgz#67e9108c5c0551b9e5326064387de4763c4d5f8b"
+  integrity sha512-7lf7qcQidTku0Gu3YDPc8DJ1q7OOucfa/BSsIwjuh56VU7katFvuM8hULfkwB3Fns/rsVF7PwPKVw1sl5KQS9w==
 
 path-to-regexp@^1.7.0:
   version "1.8.0"
@@ -14294,13 +14359,20 @@ puppeteer-core@^2.1.1:
     rimraf "^2.6.1"
     ws "^6.1.0"
 
-qs@6.11.0, qs@^6.10.0:
+qs@6.11.0:
   version "6.11.0"
   resolved "https://registry.yarnpkg.com/qs/-/qs-6.11.0.tgz#fd0d963446f7a65e1367e01abd85429453f0c37a"
   integrity sha512-MvjoMCJwEarSbUYk5O+nmoSzSutSsTwF85zcHPQ9OrlFoZOYIjaqBAJIqIXjptyD5vThxGq52Xu/MaJzRkIk4Q==
   dependencies:
     side-channel "^1.0.4"
 
+qs@6.13.0, qs@^6.10.0:
+  version "6.13.0"
+  resolved "https://registry.yarnpkg.com/qs/-/qs-6.13.0.tgz#6ca3bd58439f7e245655798997787b0d88a51906"
+  integrity sha512-+38qI9SOr8tfZ4QmJNplMUxqjbe7LKvvZgWdExBOmd+egZTtjLB67Gu0HRX3u/XOq7UU2Nx6nsjvS16Z9uwfpg==
+  dependencies:
+    side-channel "^1.0.6"
+
 query-string@^3.0.0:
   version "3.0.3"
   resolved "https://registry.npmjs.org/query-string/-/query-string-3.0.3.tgz"
@@ -15321,6 +15393,25 @@ send@0.18.0:
     range-parser "~1.2.1"
     statuses "2.0.1"
 
+send@0.19.0:
+  version "0.19.0"
+  resolved "https://registry.yarnpkg.com/send/-/send-0.19.0.tgz#bbc5a388c8ea6c048967049dbeac0e4a3f09d7f8"
+  integrity sha512-dW41u5VfLXu8SJh5bwRmyYUbAoSB3c9uQh6L8h/KtsFREPWpbX1lrljJo186Jc4nmci/sGUZ9a0a0J2zgfq2hw==
+  dependencies:
+    debug "2.6.9"
+    depd "2.0.0"
+    destroy "1.2.0"
+    encodeurl "~1.0.2"
+    escape-html "~1.0.3"
+    etag "~1.8.1"
+    fresh "0.5.2"
+    http-errors "2.0.0"
+    mime "1.6.0"
+    ms "2.1.3"
+    on-finished "2.4.1"
+    range-parser "~1.2.1"
+    statuses "2.0.1"
+
 sentence-case@^3.0.4:
   version "3.0.4"
   resolved "https://registry.yarnpkg.com/sentence-case/-/sentence-case-3.0.4.tgz#3645a7b8c117c787fde8702056225bb62a45131f"
@@ -15344,10 +15435,10 @@ serialize-javascript@^6.0.1:
   dependencies:
     randombytes "^2.1.0"
 
-serve-static@1.15.0:
-  version "1.15.0"
-  resolved "https://registry.yarnpkg.com/serve-static/-/serve-static-1.15.0.tgz#faaef08cffe0a1a62f60cad0c4e513cff0ac9540"
-  integrity sha512-XGuRDNjXUijsUL0vl6nSD7cwURuzEgglbOaFuZM9g3kwDXOWVTck0jLzjPzGD+TazWbboZYu52/9/XPdUgne9g==
+serve-static@1.16.0:
+  version "1.16.0"
+  resolved "https://registry.yarnpkg.com/serve-static/-/serve-static-1.16.0.tgz#2bf4ed49f8af311b519c46f272bf6ac3baf38a92"
+  integrity sha512-pDLK8zwl2eKaYrs8mrPZBJua4hMplRWJ1tIFksVC3FtBEBnl8dxgeHtsaMS8DhS9i4fLObaon6ABoc4/hQGdPA==
   dependencies:
     encodeurl "~1.0.2"
     escape-html "~1.0.3"
@@ -15364,6 +15455,18 @@ set-cookie-parser@^2.4.6:
   resolved "https://registry.yarnpkg.com/set-cookie-parser/-/set-cookie-parser-2.5.1.tgz#ddd3e9a566b0e8e0862aca974a6ac0e01349430b"
   integrity sha512-1jeBGaKNGdEq4FgIrORu/N570dwoPYio8lSoYLWmX7sQ//0JY08Xh9o5pBcgmHQ/MbsYp/aZnOe1s1lIsbLprQ==
 
+set-function-length@^1.2.1:
+  version "1.2.2"
+  resolved "https://registry.yarnpkg.com/set-function-length/-/set-function-length-1.2.2.tgz#aac72314198eaed975cf77b2c3b6b880695e5449"
+  integrity sha512-pgRc4hJ4/sNjWCSS9AmnS40x3bNMDTknHgL5UaMBTMyJnU90EgWh1Rz+MC9eFu4BuN/UwZjKQuY/1v3rM7HMfg==
+  dependencies:
+    define-data-property "^1.1.4"
+    es-errors "^1.3.0"
+    function-bind "^1.1.2"
+    get-intrinsic "^1.2.4"
+    gopd "^1.0.1"
+    has-property-descriptors "^1.0.2"
+
 setimmediate@^1.0.4:
   version "1.0.5"
   resolved "https://registry.yarnpkg.com/setimmediate/-/setimmediate-1.0.5.tgz#290cbb232e306942d7d7ea9b83732ab7856f8285"
@@ -15415,6 +15518,16 @@ side-channel@^1.0.4:
     get-intrinsic "^1.0.2"
     object-inspect "^1.9.0"
 
+side-channel@^1.0.6:
+  version "1.0.6"
+  resolved "https://registry.yarnpkg.com/side-channel/-/side-channel-1.0.6.tgz#abd25fb7cd24baf45466406b1096b7831c9215f2"
+  integrity sha512-fDW/EZ6Q9RiO8eFG8Hj+7u/oW+XrPTIChwCOM2+th2A6OblDtYYIpve9m+KvI9Z4C9qSEXlaGR6bTEYHReuglA==
+  dependencies:
+    call-bind "^1.0.7"
+    es-errors "^1.3.0"
+    get-intrinsic "^1.2.4"
+    object-inspect "^1.13.1"
+
 signal-exit@^3.0.2, signal-exit@^3.0.3, signal-exit@^3.0.7:
   version "3.0.7"
   resolved "https://registry.npmjs.org/signal-exit/-/signal-exit-3.0.7.tgz"